6.0.11-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainerPATCH 150/289 net: enetc: cache accesses to &priv->si->hw
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
[ Upstream commit 715bf2610f1d1adf3d4f9b7b3dd729984ec4270a ]
The &priv->si->hw construct dereferences 2 pointers and makes lines longer than they need to be, in turn making the code harder to read.
Replace &priv->si->hw accesses with a "hw" variable when there are 2 or more accesses within a function that dereference this. This includes loops, since &priv->si->hw is a loop invariant.
Stable-dep-of: 290b5fe096e7 ("net: enetc: preserve TX ring priority across reconfiguration")
--- drivers/net/ethernet/freescale/enetc/enetc.c | 28 +++++---- drivers/net/ethernet/freescale/enetc/enetc.h | 9 +-- .../net/ethernet/freescale/enetc/enetc_qos.c | 60 +++++++++---------- 3 files changed, 49 insertions(+), 48 deletions(-)
drivers/net/ethernet/freescale/enetc/enetc.c +17 -11
@@ -2121,13 +2121,14 @@ static void enetc_setup_rxbdr(struct enetc_hw *hw, struct enetc_bdr *rx_ring)static void enetc_setup_bdrs (struct enetc_ndev_priv *priv) { +struct enetc_hw *hw = &priv->si->hw;int i;for (i =0 ; i < priv->num_tx_rings; i++) -enetc_setup_txbdr (&priv->si->hw, priv->tx_ring[i]); +enetc_setup_txbdr (hw, priv->tx_ring[i]);for (i =0 ; i < priv->num_rx_rings; i++) -enetc_setup_rxbdr (&priv->si->hw, priv->rx_ring[i]); +enetc_setup_rxbdr (hw, priv->rx_ring[i]); }static void enetc_clear_rxbdr (struct enetc_hw *hw,struct enetc_bdr *rx_ring)
@@ -2160,13 +2161,14 @@ static void enetc_clear_txbdr(struct enetc_hw *hw, struct enetc_bdr *tx_ring)static void enetc_clear_bdrs (struct enetc_ndev_priv *priv) { +struct enetc_hw *hw = &priv->si->hw;int i;for (i =0 ; i < priv->num_tx_rings; i++) -enetc_clear_txbdr (&priv->si->hw, priv->tx_ring[i]); +enetc_clear_txbdr (hw, priv->tx_ring[i]);for (i =0 ; i < priv->num_rx_rings; i++) -enetc_clear_rxbdr (&priv->si->hw, priv->rx_ring[i]); +enetc_clear_rxbdr (hw, priv->rx_ring[i]);udelay (1 ); }
@@ -2174,13 +2176,13 @@ static void enetc_clear_bdrs(struct enetc_ndev_priv *priv)static int enetc_setup_irqs (struct enetc_ndev_priv *priv) {struct pci_dev *pdev = priv->si->pdev; +struct enetc_hw *hw = &priv->si->hw;int i, j, err;for (i =0 ; i < priv->bdr_int_num; i++) {int irq =pci_irq_vector (pdev,ENETC_BDR_INT_BASE_IDX + i);struct enetc_int_vector *v = priv->int_vector[i];int entry =ENETC_BDR_INT_BASE_IDX + i; -struct enetc_hw *hw = &priv->si->hw;snprintf (v->name,sizeof (v->name),"%s-rxtx%d" , priv->ndev->name, i);
@@ -2268,13 +2270,14 @@ static void enetc_setup_interrupts(struct enetc_ndev_priv *priv)static void enetc_clear_interrupts (struct enetc_ndev_priv *priv) { +struct enetc_hw *hw = &priv->si->hw;int i;for (i =0 ; i < priv->num_tx_rings; i++) -enetc_txbdr_wr (&priv->si->hw, i,ENETC_TBIER ,0 ); +enetc_txbdr_wr (hw, i,ENETC_TBIER ,0 );for (i =0 ; i < priv->num_rx_rings; i++) -enetc_rxbdr_wr (&priv->si->hw, i,ENETC_RBIER ,0 ); +enetc_rxbdr_wr (hw, i,ENETC_RBIER ,0 ); }static int enetc_phylink_connect (struct net_device *ndev)
@@ -2441,6 +2444,7 @@ int enetc_setup_tc_mqprio(struct net_device *ndev, void *type_data) {struct enetc_ndev_priv *priv =netdev_priv (ndev);struct tc_mqprio_qopt *mqprio = type_data; +struct enetc_hw *hw = &priv->si->hw;struct enetc_bdr *tx_ring;int num_stack_tx_queues;u8 num_tc;
@@ -2457,7 +2461,7 @@ int enetc_setup_tc_mqprio(struct net_device *ndev, void *type_data)/* Reset all ring priorities to 0 */ for (i =0 ; i < priv->num_tx_rings; i++) { tx_ring = priv->tx_ring[i]; -enetc_set_bdr_prio (&priv->si->hw, tx_ring->index,0 ); +enetc_set_bdr_prio (hw, tx_ring->index,0 ); }return 0 ;
@@ -2476,7 +2480,7 @@ int enetc_setup_tc_mqprio(struct net_device *ndev, void *type_data)*/ for (i =0 ; i < num_tc; i++) { tx_ring = priv->tx_ring[i]; -enetc_set_bdr_prio (&priv->si->hw, tx_ring->index, i); +enetc_set_bdr_prio (hw, tx_ring->index, i); }/* Reset the number of netdev queues based on the TC count */
@@ -2589,19 +2593,21 @@ static int enetc_set_rss(struct net_device *ndev, int en)static void enetc_enable_rxvlan (struct net_device *ndev,bool en) {struct enetc_ndev_priv *priv =netdev_priv (ndev); +struct enetc_hw *hw = &priv->si->hw;int i;for (i =0 ; i < priv->num_rx_rings; i++) -enetc_bdr_enable_rxvlan (&priv->si->hw, i, en); +enetc_bdr_enable_rxvlan (hw, i, en); }static void enetc_enable_txvlan (struct net_device *ndev,bool en) {struct enetc_ndev_priv *priv =netdev_priv (ndev); +struct enetc_hw *hw = &priv->si->hw;int i;for (i =0 ; i < priv->num_tx_rings; i++) -enetc_bdr_enable_txvlan (&priv->si->hw, i, en); +enetc_bdr_enable_txvlan (hw, i, en); }void enetc_set_features (struct net_device *ndev,netdev_features_t features)
drivers/net/ethernet/freescale/enetc/enetc.h +5 -4
@@ -467,19 +467,20 @@ int enetc_set_psfp(struct net_device *ndev, bool en);static inline void enetc_get_max_cap (struct enetc_ndev_priv *priv) { +struct enetc_hw *hw = &priv->si->hw;u32 reg; - reg =enetc_port_rd (&priv->si->hw,ENETC_PSIDCAPR ); + reg =enetc_port_rd (hw,ENETC_PSIDCAPR ); priv->psfp_cap.max_streamid = reg &ENETC_PSIDCAPR_MSK ;/* Port stream filter capability */ - reg =enetc_port_rd (&priv->si->hw,ENETC_PSFCAPR ); + reg =enetc_port_rd (hw,ENETC_PSFCAPR ); priv->psfp_cap.max_psfp_filter = reg &ENETC_PSFCAPR_MSK ;/* Port stream gate capability */ - reg =enetc_port_rd (&priv->si->hw,ENETC_PSGCAPR ); + reg =enetc_port_rd (hw,ENETC_PSGCAPR ); priv->psfp_cap.max_psfp_gate = (reg &ENETC_PSGCAPR_SGIT_MSK ); priv->psfp_cap.max_psfp_gatelist = (reg &ENETC_PSGCAPR_GCL_MSK ) >>16 ;/* Port flow meter capability */ - reg =enetc_port_rd (&priv->si->hw,ENETC_PFMCAPR ); + reg =enetc_port_rd (hw,ENETC_PFMCAPR ); priv->psfp_cap.max_psfp_meter = reg &ENETC_PFMCAPR_MSK ; }
drivers/net/ethernet/freescale/enetc/enetc_qos.c +27 -33
180 lines not on this page · raw message
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 151/289 net: enetc: preserve TX ring priority across reconfiguration
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
[ Upstream commit 290b5fe096e7dd0aad730d1af4f7f2d9fea43e11 ]
In the blamed commit, a rudimentary reallocation procedure for RX buffer descriptors was implemented, for the situation when their format changes between normal (no PTP) and extended (PTP).
enetc_hwtstamp_set() calls enetc_close() and enetc_open() in a sequence, and this sequence loses information which was previously configured in the TX BDR Mode Register, specifically via the enetc_set_bdr_prio() call. The TX ring priority is configured by tc-mqprio and tc-taprio, and affects important things for TSN such as the TX time of packets. The issue manifests itself most visibly by the fact that isochron --txtime reports premature packet transmissions when PTP is first enabled on an enetc interface.
Save the TX ring priority in a new field in struct enetc_bdr (occupies a 2 byte hole on arm64) in order to make this survive a ring reconfiguration.
--- drivers/net/ethernet/freescale/enetc/enetc.c | 8 ++++--- drivers/net/ethernet/freescale/enetc/enetc.h | 1 + .../net/ethernet/freescale/enetc/enetc_qos.c | 21 ++++++++++++------- 3 files changed, 19 insertions(+), 11 deletions(-)
drivers/net/ethernet/freescale/enetc/enetc.c +5 -3
@@ -2058,7 +2058,7 @@ static void enetc_setup_txbdr(struct enetc_hw *hw, struct enetc_bdr *tx_ring)/* enable Tx ints by setting pkt thr to 1 */ enetc_txbdr_wr (hw, idx,ENETC_TBICR0 ,ENETC_TBICR0_ICEN |0x1 ); - tbmr =ENETC_TBMR_EN ; + tbmr =ENETC_TBMR_EN |ENETC_TBMR_SET_PRIO (tx_ring->prio);if (tx_ring->ndev->features &NETIF_F_HW_VLAN_CTAG_TX ) tbmr |=ENETC_TBMR_VIH ;
@@ -2461,7 +2461,8 @@ int enetc_setup_tc_mqprio(struct net_device *ndev, void *type_data)/* Reset all ring priorities to 0 */ for (i =0 ; i < priv->num_tx_rings; i++) { tx_ring = priv->tx_ring[i]; -enetc_set_bdr_prio (hw, tx_ring->index,0 ); + tx_ring->prio =0 ; +enetc_set_bdr_prio (hw, tx_ring->index, tx_ring->prio); }return 0 ;
@@ -2480,7 +2481,8 @@ int enetc_setup_tc_mqprio(struct net_device *ndev, void *type_data)*/ for (i =0 ; i < num_tc; i++) { tx_ring = priv->tx_ring[i]; -enetc_set_bdr_prio (hw, tx_ring->index, i); + tx_ring->prio = i; +enetc_set_bdr_prio (hw, tx_ring->index, tx_ring->prio); }/* Reset the number of netdev queues based on the TC count */
drivers/net/ethernet/freescale/enetc/enetc.h +1 -0
@@ -95,6 +95,7 @@ struct enetc_bdr {void __iomem *rcir; };u16 index; +u16 prio;int bd_count;/* # of BDs */ int next_to_use;int next_to_clean;
drivers/net/ethernet/freescale/enetc/enetc_qos.c +13 -8
@@ -134,6 +134,7 @@ int enetc_setup_tc_taprio(struct net_device *ndev, void *type_data)struct tc_taprio_qopt_offload *taprio = type_data;struct enetc_ndev_priv *priv =netdev_priv (ndev);struct enetc_hw *hw = &priv->si->hw; +struct enetc_bdr *tx_ring;int err;int i;
@@ -142,16 +143,20 @@ int enetc_setup_tc_taprio(struct net_device *ndev, void *type_data)if (priv->tx_ring[i]->tsd_enable)return -EBUSY ; -for (i =0 ; i < priv->num_tx_rings; i++) -enetc_set_bdr_prio (hw, priv->tx_ring[i]->index, - taprio->enable ? i :0 ); +for (i =0 ; i < priv->num_tx_rings; i++) { + tx_ring = priv->tx_ring[i]; + tx_ring->prio = taprio->enable ? i :0 ; +enetc_set_bdr_prio (hw, tx_ring->index, tx_ring->prio); + } err =enetc_setup_taprio (ndev, taprio); - -if (err) -for (i =0 ; i < priv->num_tx_rings; i++) -enetc_set_bdr_prio (hw, priv->tx_ring[i]->index, - taprio->enable ?0 : i); +if (err) { +for (i =0 ; i < priv->num_tx_rings; i++) { + tx_ring = priv->tx_ring[i]; + tx_ring->prio = taprio->enable ?0 : i; +enetc_set_bdr_prio (hw, tx_ring->index, tx_ring->prio); + } + }return err; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 152/289 octeontx2-pf: Add check for devm_kcalloc
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit cd07eadd5147ffdae11b6fd28b77a3872f2a2484 ]
As the devm_kcalloc may return NULL pointer,
it should be better to add check for the return
value, as same as the others.
--- drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +2 -0
@@ -4979,6 +4979,8 @@ static int nix_setup_ipolicers(struct rvu *rvu, ipolicer->ref_count =devm_kcalloc (rvu->dev, ipolicer->band_prof.max,sizeof (u16),GFP_KERNEL ); +if (!ipolicer->ref_count) +return -ENOMEM ; }/* Set policer timeunit to 2us ie (19 + 1) * 100 nsec = 2us */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 153/289 net: wwan: t7xx: Fix the ACPI memory leak
In reply to Greg Kroah-HartmanFrom: Hanjun Guo <[email protected]>
[ Upstream commit 08e8a949f684e1fbc4b1efd2337d72ec8f3613d9 ]
The ACPI buffer memory (buffer.pointer) should be freed as the buffer is not used after acpi_evaluate_object(), free it to prevent memory leak.
--- drivers/net/wwan/t7xx/t7xx_modem_ops.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/wwan/t7xx/t7xx_modem_ops.c +2 -0
@@ -165,6 +165,8 @@ static int t7xx_acpi_reset(struct t7xx_pci_dev *t7xx_dev, char *fn_name) return -EFAULT; } +kfree (buffer.pointer); +#endif return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 154/289 virtio_net: Fix probe failed when modprobe virtio_net
In reply to Greg Kroah-HartmanFrom: Li Zetao <[email protected]>
[ Upstream commit b0686565946368892c2cdf92f102392e24823588 ]
When doing the following test steps, an error was found:
step 1: modprobe virtio_net succeeded
# modprobe virtio_net <-- OK
step 2: fault injection in register_netdevice()
# modprobe -r virtio_net <-- OK
# ...
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 0 PID: 3521 Comm: modprobe
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
Call Trace:
<TASK>
...
should_failslab+0xa/0x20
...
dev_set_name+0xc0/0x100
netdev_register_kobject+0xc2/0x340
register_netdevice+0xbb9/0x1320
virtnet_probe+0x1d72/0x2658 [virtio_net]
...
</TASK>
virtio_net: probe of virtio0 failed with error -22 step 3: modprobe virtio_net failed
# modprobe virtio_net <-- failed
virtio_net: probe of virtio0 failed with error -2The root cause of the problem is that the queues are not disable on the error handling path when register_netdevice() fails in virtnet_probe(), resulting in an error "-ENOENT" returned in the next modprobe call in setup_vq().
virtio_pci_modern_device uses virtqueues to send or receive message, and "queue_enable" records whether the queues are available. In vp_modern_find_vqs(), all queues will be selected and activated, but once queues are enabled there is no way to go back except reset.
Fix it by reset virtio device on error handling path. This makes error handling follow the same order as normal device cleanup in virtnet_remove() which does: unregister, destroy failover, then reset. And that flow is better tested than error handling so we can be reasonably sure it works well.
--- drivers/net/virtio_net.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/virtio_net.c +1 -2
@@ -3933,12 +3933,11 @@ static int virtnet_probe(struct virtio_device *vdev)return 0 ; free_unregister_netdev: -virtio_reset_device (vdev); -unregister_netdev (dev); free_failover:net_failover_destroy (vi->failover); free_vqs: +virtio_reset_device (vdev);cancel_delayed_work_sync (&vi->refill);free_receive_page_frags (vi);virtnet_del_vqs (vi);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 155/289 octeontx2-af: Fix reference count issue in rvu_sdp_init()
In reply to Greg Kroah-HartmanFrom: Xiongfeng Wang <[email protected]>
[ Upstream commit ad17c2a3f11b0f6b122e7842d8f7d9a5fcc7ac63 ]
pci_get_device() will decrease the reference count for the *from* parameter. So we don't need to call put_device() to decrease the reference. Let's remove the put_device() in the loop and only decrease the reference count of the returned 'pdev' for the last loop because it will not be passed to pci_get_device() as input parameter. We don't need to check if 'pdev' is NULL because it is already checked inside pci_dev_put(). Also add pci_dev_put() for the error path.
--- drivers/net/ethernet/marvell/octeontx2/af/rvu_sdp.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/net/ethernet/marvell/octeontx2/af/rvu_sdp.c +5 -2
@@ -62,15 +62,18 @@ int rvu_sdp_init(struct rvu *rvu) pfvf->sdp_info =devm_kzalloc (rvu->dev,sizeof (struct sdp_node_info ),GFP_KERNEL ); -if (!pfvf->sdp_info) +if (!pfvf->sdp_info) { +pci_dev_put (pdev);return -ENOMEM ; + }dev_info (rvu->dev,"SDP PF number:%d\n" , sdp_pf_num[i]); -put_device (&pdev->dev); i++; } +pci_dev_put (pdev); +return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 156/289 net: thunderx: Fix the ACPI memory leak
In reply to Greg Kroah-HartmanFrom: Yu Liao <[email protected]>
[ Upstream commit 661e5ebbafd26d9d2e3c749f5cf591e55c7364f5 ]
The ACPI buffer memory (string.pointer) should be freed as the buffer is not used after returning from bgx_acpi_match_id(), free it to prevent memory leak.
--- drivers/net/ethernet/cavium/thunder/thunder_bgx.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/cavium/thunder/thunder_bgx.c +3 -1
@@ -1436,8 +1436,10 @@ static acpi_status bgx_acpi_match_id(acpi_handle handle, u32 lvl,return AE_OK ; } -if (strncmp (string.pointer, bgx_sel,4 )) +if (strncmp (string.pointer, bgx_sel,4 )) { +kfree (string.pointer);return AE_OK ; + }acpi_walk_namespace (ACPI_TYPE_DEVICE , handle,1 , bgx_acpi_register_phy,NULL , bgx,NULL );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 157/289 s390/crashdump: fix TOD programmable field size
In reply to Greg Kroah-HartmanFrom: Heiko Carstens <[email protected]>
[ Upstream commit f44e07a8afdd713ddc1a8832c39372fe5dd86895 ]
The size of the TOD programmable field was incorrectly increased from four to eight bytes with commit 1a2c5840acf9 ("s390/dump: cleanup CPU save area handling").
This leads to an elf notes section NT_S390_TODPREG which has a size of eight instead of four bytes in case of kdump, however even worse is that the contents is incorrect: it is supposed to contain only the contents of the TOD programmable field, but in fact contains a mix of the TOD programmable field (32 bit upper bits) and parts of the CPU timer register (lower 32 bits).
Fix this by simply changing the size of the todpreg field within the save area structure. This will implicitly also fix the size of the corresponding elf notes sections.
This also gets rid of this compile time warning:
in function ‘fortify_memcpy_chk’,
inlined from ‘save_area_add_regs’ at arch/s390/kernel/crash_dump.c:99:2:./include/linux/fortify-string.h:413:25: error: call to ‘__read_overflow2_field’
declared with attribute warning: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Werror=attribute-warning]
413 | __read_overflow2_field(q_size_field, size);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~--- arch/s390/kernel/crash_dump.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/s390/kernel/crash_dump.c +1 -1
@@ -45,7 +45,7 @@ struct save_area {u64 fprs[16 ];u32 fpc;u32 prefix; -u64 todpreg; +u32 todpreg;u64 timer;u64 todcmp;u64 vxrs_low[16 ];
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 158/289 io_uring/filetable: fix file reference underflow
In reply to Greg Kroah-HartmanFrom: Lin Ma <[email protected]>
[ Upstream commit 9d94c04c0db024922e886c9fd429659f22f48ea4 ]
There is an interesting reference bug when -ENOMEM occurs in calling of io_install_fixed_file(). KASan report like below:
[ 14.057131] ================================================================== [ 14.059161] BUG: KASAN: use-after-free in unix_get_socket+0x10/0x90 [ 14.060975] Read of size 8 at addr ffff88800b09cf20 by task kworker/u8:2/45 [ 14.062684] [ 14.062768] CPU: 2 PID: 45 Comm: kworker/u8:2 Not tainted 6.1.0-rc4 #1 [ 14.063099] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 [ 14.063666] Workqueue: events_unbound io_ring_exit_work [ 14.063936] Call Trace: [ 14.064065] <TASK> [ 14.064175] dump_stack_lvl+0x34/0x48 [ 14.064360] print_report+0x172/0x475 [ 14.064547] ? _raw_spin_lock_irq+0x83/0xe0 [ 14.064758] ? __virt_addr_valid+0xef/0x170 [ 14.064975] ? unix_get_socket+0x10/0x90 [ 14.065167] kasan_report+0xad/0x130 [ 14.065353] ? unix_get_socket+0x10/0x90 [ 14.065553] unix_get_socket+0x10/0x90 [ 14.065744] __io_sqe_files_unregister+0x87/0x1e0 [ 14.065989] ? io_rsrc_refs_drop+0x1c/0xd0 [ 14.066199] io_ring_exit_work+0x388/0x6a5 [ 14.066410] ? io_uring_try_cancel_requests+0x5bf/0x5bf [ 14.066674] ? try_to_wake_up+0xdb/0x910 [ 14.066873] ? virt_to_head_page+0xbe/0xbe [ 14.067080] ? __schedule+0x574/0xd20 [ 14.067273] ? read_word_at_a_time+0xe/0x20 [ 14.067492] ? strscpy+0xb5/0x190 [ 14.067665] process_one_work+0x423/0x710 [ 14.067879] worker_thread+0x2a2/0x6f0 [ 14.068073] ? process_one_work+0x710/0x710 [ 14.068284] kthread+0x163/0x1a0 [ 14.068454] ? kthread_complete_and_exit+0x20/0x20 [ 14.068697] ret_from_fork+0x22/0x30 [ 14.068886] </TASK> [ 14.069000] [ 14.069088] Allocated by task 289: [ 14.069269] kasan_save_stack+0x1e/0x40 [ 14.069463] kasan_set_track+0x21/0x30 [ 14.069652] __kasan_slab_alloc+0x58/0x70 [ 14.069899] kmem_cache_alloc+0xc5/0x200 [ 14.070100] __alloc_file+0x20/0x160 [ 14.070283] alloc_empty_file+0x3b/0xc0 [ 14.070479] path_openat+0xc3/0x1770 [ 14.070689] do_filp_open+0x150/0x270 [ 14.070888] do_sys_openat2+0x113/0x270 [ 14.071081] __x64_sys_openat+0xc8/0x140 [ 14.071283] do_syscall_64+0x3b/0x90 [ 14.071466] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 14.071791] [ 14.071874] Freed by task 0: [ 14.072027] kasan_save_stack+0x1e/0x40 [ 14.072224] kasan_set_track+0x21/0x30 [ 14.072415] kasan_save_free_info+0x2a/0x50 [ 14.072627] __kasan_slab_free+0x106/0x190 [ 14.072858] kmem_cache_free+0x98/0x340 [ 14.073075] rcu_core+0x427/0xe50 [ 14.073249] __do_softirq+0x110/0x3cd [ 14.073440] [ 14.073523] Last potentially related work creation: [ 14.073801] kasan_save_stack+0x1e/0x40 [ 14.074017] __kasan_record_aux_stack+0x97/0xb0 [ 14.074264] call_rcu+0x41/0x550 [ 14.074436] task_work_run+0xf4/0x170 [ 14.074619] exit_to_user_mode_prepare+0x113/0x120 [ 14.074858] syscall_exit_to_user_mode+0x1d/0x40 [ 14.075092] do_syscall_64+0x48/0x90 [ 14.075272] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 14.075529] [ 14.075612] Second to last potentially related work creation: [ 14.075900] kasan_save_stack+0x1e/0x40 [ 14.076098] __kasan_record_aux_stack+0x97/0xb0 [ 14.076325] task_work_add+0x72/0x1b0 [ 14.076512] fput+0x65/0xc0 [ 14.076657] filp_close+0x8e/0xa0 [ 14.076825] __x64_sys_close+0x15/0x50 [ 14.077019] do_syscall_64+0x3b/0x90 [ 14.077199] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 14.077448] [ 14.077530] The buggy address belongs to the object at ffff88800b09cf00 [ 14.077530] which belongs to the cache filp of size 232 [ 14.078105] The buggy address is located 32 bytes inside of [ 14.078105] 232-byte region [ffff88800b09cf00, ffff88800b09cfe8) [ 14.078685] [ 14.078771] The buggy address belongs to the physical page: [ 14.079046] page:000000001bd520e7 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800b09de00 pfn:0xb09c [ 14.079575] head:000000001bd520e7 order:1 compound_mapcount:0 compound_pincount:0 [ 14.079946] flags: 0x100000000010200(slab|head|node=0|zone=1) [ 14.080244] raw: 0100000000010200 0000000000000000 dead000000000001 ffff88800493cc80 [ 14.080629] raw: ffff88800b09de00 0000000080190018 00000001ffffffff 0000000000000000 [ 14.081016] page dumped because: kasan: bad access detected [ 14.081293] [ 14.081376] Memory state around the buggy address: [ 14.081618] ffff88800b09ce00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 14.081974] ffff88800b09ce80: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc [ 14.082336] >ffff88800b09cf00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 14.082690] ^ [ 14.082909] ffff88800b09cf80: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc [ 14.083266] ffff88800b09d000: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 14.083622] ==================================================================
The actual tracing of this bug is shown below:
commit 8c71fe750215 ("io_uring: ensure fput() called correspondingly when direct install fails") adds an additional fput() in io_fixed_fd_install() when io_file_bitmap_get() returns error values. In that case, the routine will never make it to io_install_fixed_file() due to an early return.
static int io_fixed_fd_install(...)
{
if (alloc_slot) {
...
ret = io_file_bitmap_get(ctx);
if (unlikely(ret < 0)) {
io_ring_submit_unlock(ctx, issue_flags);
fput(file);
return ret;
}
... }
...
ret = io_install_fixed_file(req, file, issue_flags, file_slot);
...
}
In the above scenario, the reference is okay as io_fixed_fd_install() ensures the fput() is called when something bad happens, either via bitmap or via inner io_install_fixed_file().
However, the commit 61c1b44a21d7 ("io_uring: fix deadlock on iowq file slot alloc") breaks the balance because it places fput() into the common path for both io_file_bitmap_get() and io_install_fixed_file(). Since io_install_fixed_file() handles the fput() itself, the reference underflow come across then.
There are some extra commits make the current code into io_fixed_fd_install() -> __io_fixed_fd_install() -> io_install_fixed_file()
However, the fact that there is an extra fput() is called if io_install_fixed_file() calls fput(). Traversing through the code, I find that the existing two callers to __io_fixed_fd_install():io_fixed_fd_install() and io_msg_send_fd() have fput() when handling error return, this patch simply removes the fput() in io_install_fixed_file() to fix the bug.
--- io_uring/filetable.c | 2 -- 1 file changed, 2 deletions(-)
io_uring/filetable.c +0 -2
@@ -101,8 +101,6 @@ static int io_install_fixed_file(struct io_ring_ctx *ctx, struct file *file, err:if (needs_switch)io_rsrc_node_switch (ctx, ctx->file_data); -if (ret) -fput (file);return ret; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 159/289 io_uring/poll: fix poll_refs race with cancelation
In reply to Greg Kroah-HartmanFrom: Lin Ma <[email protected]>
[ Upstream commit 12ad3d2d6c5b0131a6052de91360849e3e154846 ]
There is an interesting race condition of poll_refs which could result in a NULL pointer dereference. The crash trace is like:
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 0 PID: 30781 Comm: syz-executor.2 Not tainted 6.0.0-g493ffd6605b2 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:io_poll_remove_entry io_uring/poll.c:154 [inline] RIP: 0010:io_poll_remove_entries+0x171/0x5b4 io_uring/poll.c:190 Code: ... RSP: 0018:ffff88810dfefba0 EFLAGS: 00010202 RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000040000 RDX: ffffc900030c4000 RSI: 000000000003ffff RDI: 0000000000040000 RBP: 0000000000000008 R08: ffffffff9764d3dd R09: fffffbfff3836781 R10: fffffbfff3836781 R11: 0000000000000000 R12: 1ffff11003422d60 R13: ffff88801a116b04 R14: ffff88801a116ac0 R15: dffffc0000000000 FS: 00007f9c07497700(0000) GS:ffff88811a600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffb5c00ea98 CR3: 0000000105680005 CR4: 0000000000770ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> io_apoll_task_func+0x3f/0xa0 io_uring/poll.c:299 handle_tw_list io_uring/io_uring.c:1037 [inline] tctx_task_work+0x37e/0x4f0 io_uring/io_uring.c:1090 task_work_run+0x13a/0x1b0 kernel/task_work.c:177 get_signal+0x2402/0x25a0 kernel/signal.c:2635 arch_do_signal_or_restart+0x3b/0x660 arch/x86/kernel/signal.c:869 exit_to_user_mode_loop kernel/entry/common.c:166 [inline] exit_to_user_mode_prepare+0xc2/0x160 kernel/entry/common.c:201 __syscall_exit_to_user_mode_work kernel/entry/common.c:283 [inline] syscall_exit_to_user_mode+0x58/0x160 kernel/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x63/0xcd
The root cause for this is a tiny overlooking in io_poll_check_events() when cocurrently run with poll cancel routine io_poll_cancel_req().
The interleaving to trigger use-after-free:
CPU0 | CPU1
|
io_apoll_task_func() | io_poll_cancel_req()
io_poll_check_events() |
// do while first loop |
v = atomic_read(...) |
// v = poll_refs = 1 |
... | io_poll_mark_cancelled()
| atomic_or()
| // poll_refs =
IO_POLL_CANCEL_FLAG | 1
|
atomic_sub_return(...) |
// poll_refs = IO_POLL_CANCEL_FLAG |
// loop continue |
|
| io_poll_execute()
| io_poll_get_ownership()
| // poll_refs =
IO_POLL_CANCEL_FLAG | 1
| // gets the ownership
v = atomic_read(...) |
// poll_refs not change |
|
if (v & IO_POLL_CANCEL_FLAG) |
return -ECANCELED; |
// io_poll_check_events return |
// will go into |
// io_req_complete_failed() free req |
|
| io_apoll_task_func()
| // also go intoio_req_complete_failed()
And the interleaving to trigger the kernel WARNING:
CPU0 | CPU1
|
io_apoll_task_func() | io_poll_cancel_req()
io_poll_check_events() |
// do while first loop |
v = atomic_read(...) |
// v = poll_refs = 1 |
... | io_poll_mark_cancelled()
| atomic_or()
| // poll_refs =
IO_POLL_CANCEL_FLAG | 1
|
atomic_sub_return(...) |
// poll_refs = IO_POLL_CANCEL_FLAG |
// loop continue |
|
v = atomic_read(...) |
// v = IO_POLL_CANCEL_FLAG |
| io_poll_execute()
| io_poll_get_ownership()
| // poll_refs =
IO_POLL_CANCEL_FLAG | 1
| // gets the ownership
|
WARN_ON_ONCE(!(v & IO_POLL_REF_MASK))) |
// v & IO_POLL_REF_MASK = 0 WARN |
|
| io_apoll_task_func()
| // also go intoio_req_complete_failed()
By looking up the source code and communicating with Pavel, the implementation of this atomic poll refs should continue the loop of io_poll_check_events() just to avoid somewhere else to grab the ownership. Therefore, this patch simply adds another AND operation to make sure the loop will stop if it finds the poll_refs is exactly equal to IO_POLL_CANCEL_FLAG. Since io_poll_cancel_req() grabs ownership and will finally make its way to io_req_complete_failed(), the req will be reclaimed as expected.
--- io_uring/poll.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
io_uring/poll.c +2 -1
@@ -274,7 +274,8 @@ static int io_poll_check_events(struct io_kiocb *req, bool *locked)* Release all references, retry if someone tried to restart * task_work while we were executing it. */ - }while (atomic_sub_return (v &IO_POLL_REF_MASK , &req->poll_refs)); + }while (atomic_sub_return (v &IO_POLL_REF_MASK , &req->poll_refs) & +IO_POLL_REF_MASK );return IOU_POLL_NO_ACTION ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 160/289 lib/vdso: use "grep -E" instead of "egrep"
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
commit 8ac3b5cd3e0521d92f9755e90d140382fc292510 upstream.
The latest version of grep claims the egrep is now obsolete so the build now contains warnings that look like:
egrep: warning: egrep is obsolescent; using grep -E
fix this up by moving the vdso Makefile to use "grep -E" instead.
--- lib/vdso/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
lib/vdso/Makefile +1 -1
@@ -17,6 +17,6 @@ $(error ARCH_REL_TYPE_ABS is not set) endif quiet_cmd_vdso_check = VDSOCHK $@ - cmd_vdso_check = if $(OBJDUMP) -R $@ | egrep -h "$(ARCH_REL_TYPE_ABS)"; \ + cmd_vdso_check = if $(OBJDUMP) -R $@ | grep -E -h "$(ARCH_REL_TYPE_ABS)"; \ then (echo >&2 "$@: dynamic relocations are not supported"; \ rm -f $@; /bin/false); fi
Greg Kroah-Hartman
maintainerPATCH 161/289 can: gs_usb: remove dma allocations
In reply to Greg Kroah-HartmanFrom: Vasanth Sadhasivan <[email protected]>
commit 62f102c0d1563ff6a31082f5d83b886ad2ff7ca0 upstream.
DMA allocated buffers are a precious resource. If there is no need for DMA allocations, then it might be worth to use non-dma allocated buffers.
After testing the gs_usb driver with and without DMA allocation, there does not seem to be a significant change in latency or CPU utilization either way. Therefore, DMA allocation is not necessary and removed.
Internal buffers used within urbs were managed and freed manually. These buffers are no longer needed to be managed by the driver. The URB_FREE_BUFFER flag, allows for the buffers in question to be automatically freed.
--- drivers/net/can/usb/gs_usb.c | 39 ++++++--------------------------------- 1 file changed, 6 insertions(+), 33 deletions(-)
drivers/net/can/usb/gs_usb.c +6 -33
@@ -268,8 +268,6 @@ struct gs_can {struct usb_anchor tx_submitted;atomic_t active_tx_urbs; -void *rxbuf[GS_MAX_RX_URBS ]; -dma_addr_t rxbuf_dma[GS_MAX_RX_URBS ]; };/* usb interface struct */
@@ -587,9 +585,6 @@ static void gs_usb_xmit_callback(structif (urb->status)netdev_info (netdev,"usb xmit fail %u\n" , txc->echo_id); - -usb_free_coherent (urb->dev, urb->transfer_buffer_length, - urb->transfer_buffer, urb->transfer_dma); } static netdev_tx_t gs_can_start_xmit(struct sk_buff *skb,
@@ -618,8 +613,7 @@ static netdev_tx_t gs_can_start_xmit(strif (!urb) goto nomem_urb; - hf =usb_alloc_coherent (dev->udev, dev->hf_size_tx,GFP_ATOMIC , - &urb->transfer_dma); + hf =kmalloc (dev->hf_size_tx,GFP_ATOMIC );if (!hf) {netdev_err (netdev,"No memory left for USB buffer\n" ); goto nomem_hf;
@@ -663,7 +657,7 @@ static netdev_tx_t gs_can_start_xmit(str hf, dev->hf_size_tx, gs_usb_xmit_callback, txc); - urb->transfer_flags |=URB_NO_TRANSFER_DMA_MAP ; + urb->transfer_flags |=URB_FREE_BUFFER ;usb_anchor_urb (urb, &dev->tx_submitted);can_put_echo_skb (skb, netdev, idx,0 );
@@ -678,8 +672,6 @@ static netdev_tx_t gs_can_start_xmit(strgs_free_tx_context (txc);usb_unanchor_urb (urb); -usb_free_coherent (dev->udev, urb->transfer_buffer_length, - urb->transfer_buffer, urb->transfer_dma);if (rc == -ENODEV ) {netif_device_detach (netdev);
@@ -699,8 +691,7 @@ static netdev_tx_t gs_can_start_xmit(strreturn NETDEV_TX_OK ; badidx: -usb_free_coherent (dev->udev, urb->transfer_buffer_length, - urb->transfer_buffer, urb->transfer_dma); +kfree (hf); nomem_hf:usb_free_urb (urb);
@@ -744,7 +735,6 @@ static int gs_can_open(struct net_devicefor (i =0 ; i <GS_MAX_RX_URBS ; i++) {struct urb *urb;u8 *buf; -dma_addr_t buf_dma;/* alloc rx urb */ urb =usb_alloc_urb (0 ,GFP_KERNEL );
@@ -752,10 +742,8 @@ static int gs_can_open(struct net_devicereturn -ENOMEM ;/* alloc rx buffer */ - buf =usb_alloc_coherent (dev->udev, - dev->parent->hf_size_rx, -GFP_KERNEL , - &buf_dma); + buf =kmalloc (dev->parent->hf_size_rx, +GFP_KERNEL );if (!buf) {netdev_err (netdev,"No memory left for USB buffer\n" );
@@ -763,8 +751,6 @@ static int gs_can_open(struct net_devicereturn -ENOMEM ; } - urb->transfer_dma = buf_dma; -/* fill, anchor, and submit rx urb */ usb_fill_bulk_urb(urb, dev->udev,
@@ -773,7 +759,7 @@ static int gs_can_open(struct net_device buf, dev->parent->hf_size_rx, gs_usb_receive_bulk_callback, parent); - urb->transfer_flags |=URB_NO_TRANSFER_DMA_MAP ; + urb->transfer_flags |=URB_FREE_BUFFER ;usb_anchor_urb (urb, &parent->rx_submitted);
@@ -786,17 +772,10 @@ static int gs_can_open(struct net_device "usb_submit failed (err=%d)\n", rc);usb_unanchor_urb (urb); -usb_free_coherent (dev->udev, -sizeof (struct gs_host_frame ), - buf, - buf_dma);usb_free_urb (urb);break ; } - dev->rxbuf[i] = buf; - dev->rxbuf_dma[i] = buf_dma; -/* Drop reference, * USB core will take care of freeing it */
@@ -854,7 +833,6 @@ static int gs_can_close(struct net_devicint rc;struct gs_can *dev =netdev_priv (netdev);struct gs_usb *parent = dev->parent; -unsigned int i;netif_stop_queue (netdev);
@@ -862,11 +840,6 @@ static int gs_can_close(struct net_devic parent->active_channels--;if (!parent->active_channels) {usb_kill_anchored_urbs (&parent->rx_submitted); -for (i =0 ; i <GS_MAX_RX_URBS ; i++) -usb_free_coherent (dev->udev, -sizeof (struct gs_host_frame ), - dev->rxbuf[i], - dev->rxbuf_dma[i]); }/* Stop sending URBs */
Greg Kroah-Hartman
maintainerPATCH 162/289 usb: dwc3: exynos: Fix remove() function
In reply to Greg Kroah-HartmanFrom: Marek Szyprowski <[email protected]>
commit e0481e5b3cc12ea7ccf4552d41518c89d3509004 upstream.
The core DWC3 device node was not properly removed by the custom dwc3_exynos_remove_child() function. Replace it with generic of_platform_depopulate() which does that job right.
--- drivers/usb/dwc3/dwc3-exynos.c | 11 +---------- 1 file changed, 1 insertion(+), 10 deletions(-)
drivers/usb/dwc3/dwc3-exynos.c +1 -10
@@ -37,15 +37,6 @@ struct dwc3_exynos {struct regulator *vdd10; }; -static int dwc3_exynos_remove_child (struct device *dev,void *unused) -{ -struct platform_device *pdev =to_platform_device (dev); - -platform_device_unregister (pdev); - -return 0 ; -} -static int dwc3_exynos_probe (struct platform_device *pdev) {struct dwc3_exynos *exynos;
@@ -142,7 +133,7 @@ static int dwc3_exynos_remove(struct plastruct dwc3_exynos *exynos =platform_get_drvdata (pdev);int i; -device_for_each_child (&pdev->dev,NULL , dwc3_exynos_remove_child); +of_platform_depopulate (&pdev->dev);for (i = exynos->num_clks -1 ; i >=0 ; i--)clk_disable_unprepare (exynos->clks[i]);
Greg Kroah-Hartman
maintainerPATCH 163/289 usb: cdnsp: Fix issue with Clear Feature Halt Endpoint
In reply to Greg Kroah-HartmanFrom: Pawel Laszczak <[email protected]>
commit b25264f22b498dff3fa5c70c9bea840e83fff0d1 upstream.
During handling Clear Halt Endpoint Feature request, driver invokes Reset Endpoint command. Because this command has some issue with transition endpoint from Running to Idle state the driver must stop the endpoint by using Stop Endpoint command.
--- drivers/usb/cdns3/cdnsp-gadget.c | 12 ++++-------- drivers/usb/cdns3/cdnsp-ring.c | 3 ++- 2 files changed, 6 insertions(+), 9 deletions(-)
drivers/usb/cdns3/cdnsp-gadget.c +4 -8
@@ -600,11 +600,11 @@ int cdnsp_halt_endpoint(struct cdnsp_devtrace_cdnsp_ep_halt (value ?"Set" :"Clear" ); -if (value) { - ret =cdnsp_cmd_stop_ep (pdev, pep); -if (ret) -return ret; + ret =cdnsp_cmd_stop_ep (pdev, pep); +if (ret) +return ret; +if (value) {if (GET_EP_CTX_STATE (pep->out_ctx) ==EP_STATE_STOPPED ) {cdnsp_queue_halt_endpoint (pdev, pep->idx);cdnsp_ring_cmd_db (pdev);
@@ -613,10 +613,6 @@ int cdnsp_halt_endpoint(struct cdnsp_dev pep->ep_state |=EP_HALTED ; }else { -/* -* In device mode driver can call reset endpoint command -* from any endpoint state. -*/ cdnsp_queue_reset_ep (pdev, pep->idx);cdnsp_ring_cmd_db (pdev); ret =cdnsp_wait_for_cmd_compl (pdev);
drivers/usb/cdns3/cdnsp-ring.c +2 -1
@@ -2076,7 +2076,8 @@ int cdnsp_cmd_stop_ep(struct cdnsp_devicu32 ep_state =GET_EP_CTX_STATE (pep->out_ctx);int ret =0 ; -if (ep_state ==EP_STATE_STOPPED || ep_state ==EP_STATE_DISABLED ) { +if (ep_state ==EP_STATE_STOPPED || ep_state ==EP_STATE_DISABLED || + ep_state ==EP_STATE_HALTED ) {trace_cdnsp_ep_stopped_or_disabled (pep->out_ctx); goto ep_stopped; }
Greg Kroah-Hartman
maintainerPATCH 164/289 usb: cdnsp: fix issue with ZLP - added TD_SIZE = 1
In reply to Greg Kroah-HartmanFrom: Pawel Laszczak <[email protected]>
commit 7a21b27aafa3edead79ed97e6f22236be6b9f447 upstream.
Patch modifies the TD_SIZE in TRB before ZLP TRB. The TD_SIZE in TRB before ZLP TRB must be set to 1 to force processing ZLP TRB by controller.
--- drivers/usb/cdns3/cdnsp-ring.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
drivers/usb/cdns3/cdnsp-ring.c +10 -4
@@ -1763,10 +1763,15 @@ static u32 cdnsp_td_remainder(struct cdnint trb_buff_len, unsigned int td_total_len, struct cdnsp_request *preq, - bool more_trbs_coming) + bool more_trbs_coming, + bool zlp) { u32 maxp, total_packet_count; +/* Before ZLP driver needs set TD_SIZE = 1. */ +if (zlp) +return 1 ; +/* One TRB with a zero-length data packet. */ if (!more_trbs_coming || (transferred ==0 && trb_buff_len ==0 ) || trb_buff_len == td_total_len)
@@ -1960,7 +1965,8 @@ int cdnsp_queue_bulk_tx(struct cdnsp_dev/* Set the TRB length, TD size, and interrupter fields. */ remainder =cdnsp_td_remainder (pdev, enqd_len, trb_buff_len, full_len, preq, - more_trbs_coming); + more_trbs_coming, + zero_len_trb); length_field =TRB_LEN (trb_buff_len) |TRB_TD_SIZE (remainder) |TRB_INTR_TARGET (0 );
@@ -2025,7 +2031,7 @@ int cdnsp_queue_ctrl_tx(struct cdnsp_devif (preq->request.length >0 ) { remainder =cdnsp_td_remainder (pdev,0 , preq->request.length, - preq->request.length, preq,1 ); + preq->request.length, preq,1 ,0 ); length_field =TRB_LEN (preq->request.length) |TRB_TD_SIZE (remainder) |TRB_INTR_TARGET (0 );
@@ -2226,7 +2232,7 @@ static int cdnsp_queue_isoc_tx(struct cd/* Set the TRB length, TD size, & interrupter fields. */ remainder =cdnsp_td_remainder (pdev, running_total, trb_buff_len, td_len, preq, - more_trbs_coming); + more_trbs_coming,0 ); length_field =TRB_LEN (trb_buff_len) |TRB_INTR_TARGET (0 );
Greg Kroah-Hartman
maintainerPATCH 165/289 dma-buf: Use dma_fence_unwrap_for_each when importing fences
In reply to Greg Kroah-HartmanFrom: Jason Ekstrand <[email protected]>
commit c19083c72ea72a1c12037bb3d708014632df80e4 upstream.
Ever since 68129f431faa ("dma-buf: warn about containers in dma_resv object"), dma_resv_add_shared_fence will warn if you attempt to add a container fence. While most drivers were fine, fences can also be added to a dma_resv via the recently added DMA_BUF_IOCTL_IMPORT_SYNC_FILE. Use dma_fence_unwrap_for_each to add each fence one at a time.
--- drivers/dma-buf/dma-buf.c | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-)
drivers/dma-buf/dma-buf.c +17 -6
@@ -15,6 +15,7 @@#include <linux/slab.h> #include <linux/dma-buf.h> #include <linux/dma-fence.h> +#include <linux/dma-fence-unwrap.h> #include <linux/anon_inodes.h> #include <linux/export.h> #include <linux/debugfs.h>
@@ -391,8 +392,10 @@ static long dma_buf_import_sync_file(struct dma_buf *dmabuf, const void __user *user_data) {struct dma_buf_import_sync_file arg; -struct dma_fence *fence; +struct dma_fence *fence, *f;enum dma_resv_usage usage; +struct dma_fence_unwrap iter; +unsigned int num_fences;int ret =0 ;if (copy_from_user (&arg, user_data,sizeof (arg)))
@@ -411,13 +414,21 @@ static long dma_buf_import_sync_file(struct dma_buf *dmabuf, usage = (arg.flags &DMA_BUF_SYNC_WRITE ) ?DMA_RESV_USAGE_WRITE :DMA_RESV_USAGE_READ ; -dma_resv_lock (dmabuf->resv,NULL ); + num_fences =0 ; +dma_fence_unwrap_for_each (f, &iter, fence) + ++num_fences; - ret =dma_resv_reserve_fences (dmabuf->resv,1 ); -if (!ret) -dma_resv_add_fence (dmabuf->resv, fence, usage); +if (num_fences >0 ) { +dma_resv_lock (dmabuf->resv,NULL ); -dma_resv_unlock (dmabuf->resv); + ret =dma_resv_reserve_fences (dmabuf->resv, num_fences); +if (!ret) { +dma_fence_unwrap_for_each (f, &iter, fence) +dma_resv_add_fence (dmabuf->resv, f, usage); + } + +dma_resv_unlock (dmabuf->resv); + }dma_fence_put (fence);
Signature · 1 line
2.38.1
Greg Kroah-Hartman
maintainerPATCH 166/289 cifs: fix missing unlock in cifs_file_copychunk_range()
In reply to Greg Kroah-HartmanFrom: ChenXiaoSong <[email protected]>
commit 502487847743018c93d75b401eac2ea4c4973123 upstream.
xfstests generic/013 and generic/476 reported WARNING as follows:
WARNING: lock held when returning to user space! 6.1.0-rc5+ #4 Not tainted
------------------------------------------------
fsstress/504233 is leaving the kernel with locks still held! 2 locks held by fsstress/504233:
#0: ffff888054c38850 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at:
lock_two_nondirectories+0xcf/0xf0
#1: ffff8880b8fec750 (&sb->s_type->i_mutex_key#21/4){+.+.}-{3:3}, at:
lock_two_nondirectories+0xb7/0xf0This will lead to deadlock and hungtask.
Fix this by releasing locks when failed to write out on a file range in cifs_file_copychunk_range().
--- fs/cifs/cifsfs.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/cifs/cifsfs.c +3 -1
@@ -1252,7 +1252,7 @@ ssize_t cifs_file_copychunk_range(unsign rc =filemap_write_and_wait_range (src_inode->i_mapping, off, off + len -1 );if (rc) - goto out; + goto unlock;/* should we flush first and last page first */ truncate_inode_pages (&target_inode->i_data,0 );
@@ -1268,6 +1268,8 @@ ssize_t cifs_file_copychunk_range(unsign* that target is updated on the server */ CIFS_I (target_inode)->time =0 ; + +unlock:/* although unlocking in the reverse order from locking is not * strictly necessary here it is a little cleaner to be consistent */
Greg Kroah-Hartman
maintainerPATCH 167/289 cifs: Use after free in debug code
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
commit f391d6ee002ea022c62dc0b09d0578f3ccce81be upstream.
This debug code dereferences "old_iface" after it was already freed by the call to release_iface(). Re-order the debugging to avoid this issue.
--- fs/cifs/sess.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/cifs/sess.c +2 -2
@@ -302,14 +302,14 @@ cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server)/* now drop the ref to the current iface */ if (old_iface && iface) { -kref_put (&old_iface->refcount, release_iface);cifs_dbg (FYI ,"replacing iface: %pIS with %pIS\n" , &old_iface->sockaddr, &iface->sockaddr); - }else if (old_iface) {kref_put (&old_iface->refcount, release_iface); + }else if (old_iface) {cifs_dbg (FYI ,"releasing ref to iface: %pIS\n" , &old_iface->sockaddr); +kref_put (&old_iface->refcount, release_iface); }else {WARN_ON (!iface);cifs_dbg (FYI ,"adding new iface: %pIS\n" , &iface->sockaddr);
Signature · 1 line
2.38.1
Greg Kroah-Hartman
maintainerPATCH 168/289 ext4: fix use-after-free in ext4_ext_shift_extents
In reply to Greg Kroah-HartmanFrom: Baokun Li <[email protected]>
commit f6b1a1cf1c3ee430d3f5e47847047ce789a690aa upstream.
If the starting position of our insert range happens to be in the hole between the two ext4_extent_idx, because the lblk of the ext4_extent in the previous ext4_extent_idx is always less than the start, which leads to the "extent" variable access across the boundary, the following UAF is triggered:
==================================================================
BUG: KASAN: use-after-free in ext4_ext_shift_extents+0x257/0x790 Read of size 4 at addr ffff88819807a008 by task fallocate/8010 CPU: 3 PID: 8010 Comm: fallocate Tainted: G E 5.10.0+ #492 Call Trace: dump_stack+0x7d/0xa3 print_address_description.constprop.0+0x1e/0x220 kasan_report.cold+0x67/0x7f ext4_ext_shift_extents+0x257/0x790 ext4_insert_range+0x5b6/0x700 ext4_fallocate+0x39e/0x3d0 vfs_fallocate+0x26f/0x470 ksys_fallocate+0x3a/0x70 __x64_sys_fallocate+0x4f/0x60 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xa9 ==================================================================
For right shifts, we can divide them into the following situations：
1. When the first ee_block of ext4_extent_idx is greater than or equal to start, make right shifts directly from the first ee_block.
1) If it is greater than start, we need to continue searching in the previous ext4_extent_idx.
2) If it is equal to start, we can exit the loop (iterator=NULL).
2. When the first ee_block of ext4_extent_idx is less than start, then traverse from the last extent to find the first extent whose ee_block is less than start.
1) If extent is still the last extent after traversal, it means that the last ee_block of ext4_extent_idx is less than start, that is, start is located in the hole between idx and (idx+1), so we can exit the loop directly (break) without right shifts.
2) Otherwise, make right shifts at the corresponding position of the found extent, and then exit the loop (iterator=NULL).
--- fs/ext4/extents.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-)
fs/ext4/extents.c +13 -5
@@ -5183,6 +5183,7 @@ ext4_ext_shift_extents(struct inode *ino* and it is decreased till we reach start. */ again: + ret =0 ;if (SHIFT ==SHIFT_LEFT ) iterator = &start;else
@@ -5226,14 +5227,21 @@ again:ext4_ext_get_actual_len (extent); }else { extent =EXT_FIRST_EXTENT (path[depth].p_hdr); -if (le32_to_cpu (extent->ee_block) >0 ) +if (le32_to_cpu (extent->ee_block) > start) *iterator =le32_to_cpu (extent->ee_block) -1 ; -else -/* Beginning is reached, end of the loop */ +else if (le32_to_cpu (extent->ee_block) == start) iterator =NULL ; -/* Update path extent in case we need to stop */ -while (le32_to_cpu (extent->ee_block) < start) +else { + extent =EXT_LAST_EXTENT (path[depth].p_hdr); +while (le32_to_cpu (extent->ee_block) >= start) + extent--; + +if (extent ==EXT_LAST_EXTENT (path[depth].p_hdr)) +break ; + extent++; + iterator =NULL ; + } path[depth].p_ext = extent; } ret = ext4_ext_shift_path_extents(path, shift, inode,
Greg Kroah-Hartman
maintainerPATCH 169/289 arm64: dts: rockchip: lower rk3399-puma-haikou SD controller clock frequency
In reply to Greg Kroah-HartmanFrom: Jakob Unterwurzacher <[email protected]>
commit 91e8b74fe6381e083f8aa55217bb0562785ab398 upstream.
CRC errors (code -84 EILSEQ) have been observed for some SanDisk Ultra A1 cards when running at 50MHz.
Waveform analysis suggest that the level shifters that are used on the RK3399-Q7 module for voltage translation between 3.0 and 3.3V don't handle clock rates at or above 48MHz properly. Back off to 40MHz for some safety margin.
--- arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dts +1 -1
@@ -207,7 +207,7 @@ cap-sd-highspeed; cd-gpios = <&gpio0 RK_PA7 GPIO_ACTIVE_LOW>; disable-wp; - max-frequency = <150000000>; + max-frequency = <40000000>; pinctrl-names = "default"; pinctrl-0 = <&sdmmc_clk &sdmmc_cmd &sdmmc_cd &sdmmc_bus4>; vmmc-supply = <&vcc3v3_baseboard>;
Greg Kroah-Hartman
maintainerPATCH 170/289 kbuild: fix -Wimplicit-function-declaration in license_is_gpl_compatible
In reply to Greg Kroah-HartmanFrom: Sam James <[email protected]>
commit 50c697215a8cc22f0e58c88f06f2716c05a26e85 upstream.
Add missing <linux/string.h> include for strcmp.
Clang 16 makes -Wimplicit-function-declaration an error by default. Unfortunately, out of tree modules may use this in configure scripts, which means failure might cause silent miscompilation or misconfiguration.
For more information, see LWN.net [0] or LLVM's Discourse [1], gentoo-dev@ [2], or the (new) c-std-porting mailing list [3].
[0] https://lwn.net/Articles/913505/
[1] https://discourse.llvm.org/t/configure-script-breakage-with-the-new-werror-implicit-function-declaration/65213
[2] https://archives.gentoo.org/gentoo-dev/message/dd9f2d3082b8b6f8dfbccb0639e6e240
[3] hosted at lists.linux.dev.
--- include/linux/license.h | 2 ++ 1 file changed, 2 insertions(+)
include/linux/license.h +2 -0
@@ -2,6 +2,8 @@#ifndef __LICENSE_H#define __LICENSE_H +#include <linux/string.h> +static inline int license_is_gpl_compatible (const char *license) { return (strcmp(license, "GPL") == 0
Greg Kroah-Hartman
maintainerPATCH 171/289 iio: adc: aspeed: Remove the trim valid dts property.
In reply to Greg Kroah-HartmanFrom: Billy Tsai <[email protected]>
commit fdd0d6b2eb35c83d6b1226ad20b346a4b45ddfb8 upstream.
The dts property "aspeed,trim-data-valid" is currently used to determine whether to read trimming data from the OTP register. If this is set on a device without valid trimming data in the OTP the ADC will not function correctly. This patch drops the use of this property and instead uses the default (unprogrammed) OTP value of 0 to detect when a fallback value of 0x8 should be used rather then the value read from the OTP.
--- drivers/iio/adc/aspeed_adc.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)
drivers/iio/adc/aspeed_adc.c +5 -6
@@ -202,6 +202,8 @@ static int aspeed_adc_set_trim_data(stru ((scu_otp) & (data->model_data->trim_locate->field)) >>__ffs (data->model_data->trim_locate->field); +if (!trimming_val) + trimming_val =0x8 ; } dev_dbg(data->dev, "trimming val = %d, offset = %08x, fields = %08x\n",
@@ -563,12 +565,9 @@ static int aspeed_adc_probe(struct platfif (ret)return ret; -if (of_find_property (data->dev->of_node,"aspeed,trim-data-valid" , -NULL )) { - ret =aspeed_adc_set_trim_data (indio_dev); -if (ret) -return ret; - } + ret =aspeed_adc_set_trim_data (indio_dev); +if (ret) +return ret;if (of_find_property (data->dev->of_node,"aspeed,battery-sensing" ,NULL )) {
Greg Kroah-Hartman
maintainerPATCH 172/289 iio: light: apds9960: fix wrong register for gesture gain
In reply to Greg Kroah-HartmanFrom: Alejandro Concepción Rodríguez <[email protected]>
commit 0aa60ff5d996d4ecdd4a62699c01f6d00f798d59 upstream.
Gesture Gain Control is in REG_GCONF_2 (0xa3), not in REG_CONFIG_2 (0x90).
--- drivers/iio/light/apds9960.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/iio/light/apds9960.c +6 -6
@@ -54,9 +54,6 @@#define APDS9960_REG_CONTROL_PGAIN_MASK_SHIFT 2#define APDS9960_REG_CONFIG_2 0x90 -#define APDS9960_REG_CONFIG_2_GGAIN_MASK 0x60 -#define APDS9960_REG_CONFIG_2_GGAIN_MASK_SHIFT 5 -#define APDS9960_REG_ID 0x92#define APDS9960_REG_STATUS 0x93
@@ -77,6 +74,9 @@#define APDS9960_REG_GCONF_1_GFIFO_THRES_MASK_SHIFT 6#define APDS9960_REG_GCONF_2 0xa3 +#define APDS9960_REG_GCONF_2_GGAIN_MASK 0x60 +#define APDS9960_REG_GCONF_2_GGAIN_MASK_SHIFT 5 +#define APDS9960_REG_GOFFSET_U 0xa4#define APDS9960_REG_GOFFSET_D 0xa5#define APDS9960_REG_GPULSE 0xa6
@@ -396,9 +396,9 @@ static int apds9960_set_pxs_gain(struct } ret =regmap_update_bits (data->regmap, -APDS9960_REG_CONFIG_2 , -APDS9960_REG_CONFIG_2_GGAIN_MASK , - idx <<APDS9960_REG_CONFIG_2_GGAIN_MASK_SHIFT ); +APDS9960_REG_GCONF_2 , +APDS9960_REG_GCONF_2_GGAIN_MASK , + idx <<APDS9960_REG_GCONF_2_GGAIN_MASK_SHIFT );if (!ret) data->pxs_gain = idx;mutex_unlock (&data->lock);
Greg Kroah-Hartman
maintainerPATCH 173/289 iio: core: Fix entry not deleted when iio_register_sw_trigger_type() fails
In reply to Greg Kroah-HartmanFrom: Chen Zhongjin <[email protected]>
commit 4ad09d956f8eacff61e67e5b13ba8ebec3232f76 upstream.
In iio_register_sw_trigger_type(), configfs_register_default_group() is possible to fail, but the entry add to iio_trigger_types_list is not deleted.
This leaves wild in iio_trigger_types_list, which can cause page fault when module is loading again. So fix this by list_del(&t->list) in error path.
BUG: unable to handle page fault for address: fffffbfff81d7400 Call Trace: <TASK> iio_register_sw_trigger_type do_one_initcall do_init_module load_module ...
--- drivers/iio/industrialio-sw-trigger.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/iio/industrialio-sw-trigger.c +5 -1
@@ -58,8 +58,12 @@ int iio_register_sw_trigger_type(struct t->group =configfs_register_default_group (iio_triggers_group, t->name, &iio_trigger_type_group_type); -if (IS_ERR (t->group)) +if (IS_ERR (t->group)) { +mutex_lock (&iio_trigger_types_lock); +list_del (&t->list); +mutex_unlock (&iio_trigger_types_lock); ret =PTR_ERR (t->group); + }return ret; }
Greg Kroah-Hartman
maintainerPATCH 174/289 iio: accel: bma400: Fix memory leak in bma400_get_steps_reg()
In reply to Greg Kroah-HartmanFrom: Dong Chenchen <[email protected]>
commit 20690cd50e68c0313472c7539460168b8ea6444d upstream.
When regmap_bulk_read() fails, it does not free steps_raw, which will cause a memory leak issue, this patch fixes it.
--- drivers/iio/accel/bma400_core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/iio/accel/bma400_core.c +3 -1
@@ -673,8 +673,10 @@ static int bma400_get_steps_reg(struct b ret =regmap_bulk_read (data->regmap,BMA400_STEP_CNT0_REG , steps_raw,BMA400_STEP_RAW_LEN ); -if (ret) +if (ret) { +kfree (steps_raw);return ret; + } *val =get_unaligned_le24 (steps_raw);kfree (steps_raw);return IIO_VAL_INT ;
Greg Kroah-Hartman
maintainerPATCH 175/289 dt-bindings: iio: adc: Remove the property "aspeed,trim-data-valid"
In reply to Greg Kroah-HartmanFrom: Billy Tsai <[email protected]>
commit 398e3479874f381cca8726ca5d8a31e1bf35a3cd upstream.
If the property is set on a device without valid trimming data in the OTP the ADC will not function correctly. Therefore, this patch drops the use of this property to avoid this scenario.
--- Documentation/devicetree/bindings/iio/adc/aspeed,ast2600-adc.yaml | 7 ------- 1 file changed, 7 deletions(-)
Documentation/devicetree/bindings/iio/adc/aspeed,ast2600-adc.yaml +0 -7
@@ -62,13 +62,6 @@ properties: description: Inform the driver that last channel will be used to sensor battery. - aspeed,trim-data-valid: - type: boolean - description: | - The ADC reference voltage can be calibrated to obtain the trimming - data which will be stored in otp. This property informs the driver that - the data store in the otp is valid. - required: - compatible - reg
Greg Kroah-Hartman
maintainerPATCH 176/289 mm/damon/sysfs-schemes: skip stats update if the scheme directory is removed
In reply to Greg Kroah-HartmanFrom: SeongJae Park <[email protected]>
commit 8468b486612c808c9e337708d66a435498f1735c upstream.
A DAMON sysfs interface user can start DAMON with a scheme, remove the sysfs directory for the scheme, and then ask update of the scheme's stats. Because the schemes stats update logic isn't aware of the situation, it results in an invalid memory access. Fix the bug by checking if the scheme sysfs directory exists.
--- mm/damon/sysfs.c | 4 ++++ 1 file changed, 4 insertions(+)
mm/damon/sysfs.c +4 -0
@@ -2342,6 +2342,10 @@ static int damon_sysfs_upd_schemes_statsdamon_for_each_scheme (scheme, ctx) {struct damon_sysfs_stats *sysfs_stats; +/* user could have removed the scheme sysfs dir */ +if (schemes_idx >= sysfs_schemes->nr) +break ; + sysfs_stats = sysfs_schemes->schemes_arr[schemes_idx++]->stats; sysfs_stats->nr_tried = scheme->stat.nr_tried; sysfs_stats->sz_tried = scheme->stat.sz_tried;
Greg Kroah-Hartman
maintainerPATCH 177/289 virt/sev-guest: Prevent IV reuse in the SNP guest driver
In reply to Greg Kroah-HartmanFrom: Peter Gonda <[email protected]>
commit 47894e0fa6a56a42be6a47c767e79cce8125489d upstream.
The AMD Secure Processor (ASP) and an SNP guest use a series of AES-GCM keys called VMPCKs to communicate securely with each other. The IV to this scheme is a sequence number that both the ASP and the guest track.
Currently, this sequence number in a guest request must exactly match the sequence number tracked by the ASP. This means that if the guest sees an error from the host during a request it can only retry that exact request or disable the VMPCK to prevent an IV reuse. AES-GCM cannot tolerate IV reuse, see: "Authentication Failures in NIST version of GCM" - Antoine Joux et al.
In order to address this, make handle_guest_request() delete the VMPCK on any non successful return. To allow userspace querying the cert_data length make handle_guest_request() save the number of pages required by the host, then have handle_guest_request() retry the request without requesting the extended data, then return the number of pages required back to userspace.
[ bp: Massage, incorporate Tom's review comments. ]
--- drivers/virt/coco/sev-guest/sev-guest.c | 84 ++++++++++++++++++++----- 1 file changed, 70 insertions(+), 14 deletions(-)
drivers/virt/coco/sev-guest/sev-guest.c +70 -14
@@ -67,8 +67,27 @@ static bool is_vmpck_empty(struct snp_guest_dev *snp_dev)return true; } +/* +* If an error is received from the host or AMD Secure Processor (ASP) there +* are two options. Either retry the exact same encrypted request or discontinue +* using the VMPCK. +* +* This is because in the current encryption scheme GHCB v2 uses AES-GCM to +* encrypt the requests. The IV for this scheme is the sequence number. GCM +* cannot tolerate IV reuse. +* +* The ASP FW v1.51 only increments the sequence numbers on a successful +* guest<->ASP back and forth and only accepts messages at its exact sequence +* number. +* +* So if the sequence number were to be reused the encryption scheme is +* vulnerable. If the sequence number were incremented for a fresh IV the ASP +* will reject the request. +*/ static void snp_disable_vmpck (struct snp_guest_dev *snp_dev) { +dev_alert (snp_dev->dev,"Disabling vmpck_id %d to prevent IV reuse.\n" , + vmpck_id);memzero_explicit (snp_dev->vmpck,VMPCK_KEY_LEN ); snp_dev->vmpck =NULL ; }
@@ -321,34 +340,71 @@ static int handle_guest_request(struct snp_guest_dev *snp_dev, u64 exit_code, inif (rc)return rc; -/* Call firmware to process the request */ +/* +* Call firmware to process the request. In this function the encrypted +* message enters shared memory with the host. So after this call the +* sequence number must be incremented or the VMPCK must be deleted to +* prevent reuse of the IV. +*/ rc =snp_issue_guest_request (exit_code, &snp_dev->input, &err); + +/* +* If the extended guest request fails due to having too small of a +* certificate data buffer, retry the same guest request without the +* extended data request in order to increment the sequence number +* and thus avoid IV reuse. +*/ +if (exit_code ==SVM_VMGEXIT_EXT_GUEST_REQUEST && + err ==SNP_GUEST_REQ_INVALID_LEN ) { +const unsigned int certs_npages = snp_dev->input.data_npages; + + exit_code =SVM_VMGEXIT_GUEST_REQUEST ; + +/* +* If this call to the firmware succeeds, the sequence number can +* be incremented allowing for continued use of the VMPCK. If +* there is an error reflected in the return value, this value +* is checked further down and the result will be the deletion +* of the VMPCK and the error code being propagated back to the +* user as an ioctl() return code. +*/ + rc =snp_issue_guest_request (exit_code, &snp_dev->input, &err); + +/* +* Override the error to inform callers the given extended +* request buffer size was too small and give the caller the +* required buffer size. +*/ + err =SNP_GUEST_REQ_INVALID_LEN ; + snp_dev->input.data_npages = certs_npages; + } +if (fw_err) *fw_err = err; -if (rc) -return rc; +if (rc) { +dev_alert (snp_dev->dev, +"Detected error from ASP request. rc: %d, fw_err: %llu\n" , + rc, *fw_err); + goto disable_vmpck; + } -/* -* The verify_and_dec_payload() will fail only if the hypervisor is -* actively modifying the message header or corrupting the encrypted payload. -* This hints that hypervisor is acting in a bad faith. Disable the VMPCK so that -* the key cannot be used for any communication. The key is disabled to ensure -* that AES-GCM does not use the same IV while encrypting the request payload. -*/ rc =verify_and_dec_payload (snp_dev, resp_buf, resp_sz);if (rc) {dev_alert (snp_dev->dev, -"Detected unexpected decode failure, disabling the vmpck_id %d\n" , - vmpck_id); -snp_disable_vmpck (snp_dev); -return rc; +"Detected unexpected decode failure from ASP. rc: %d\n" , + rc); + goto disable_vmpck; }/* Increment to new message sequence after payload decryption was successful. */ snp_inc_msg_seqno (snp_dev);return 0 ; + +disable_vmpck: +snp_disable_vmpck (snp_dev); +return rc; }static int get_report (struct snp_guest_dev *snp_dev,struct snp_guest_request_ioctl *arg)
Signature · 1 line
2.38.1
Greg Kroah-Hartman
maintainerPATCH 178/289 cpufreq: amd-pstate: cpufreq: amd-pstate: reset MSR_AMD_PERF_CTL register at init
In reply to Greg Kroah-HartmanFrom: Wyes Karny <[email protected]>
commit 919f4557696939625085435ebde09a539de2349c upstream.
MSR_AMD_PERF_CTL is guaranteed to be 0 on a cold boot. However, on a kexec boot, for instance, it may have a non-zero value (if the cpu was in a non-P0 Pstate). In such cases, the cores with non-P0 Pstates at boot will never be pushed to P0, let alone boost frequencies.
Kexec is a common workflow for reboot on Linux and this creates a regression in performance. Fix it by explicitly setting the MSR_AMD_PERF_CTL to 0 during amd_pstate driver init.
--- drivers/cpufreq/amd-pstate.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/cpufreq/amd-pstate.c +10 -0
@@ -483,12 +483,22 @@ static void amd_pstate_boost_init(struct amd_pstate_driver.boost_enabled = true; } +static void amd_perf_ctl_reset (unsigned int cpu) +{ +wrmsrl_on_cpu (cpu,MSR_AMD_PERF_CTL ,0 ); +} +static int amd_pstate_cpu_init (struct cpufreq_policy *policy) {int min_freq, max_freq, nominal_freq, lowest_nonlinear_freq, ret;struct device *dev;struct amd_cpudata *cpudata; +/* +* Resetting PERF_CTL_MSR will put the CPU in P0 frequency, +* which is ideal for initialization process. +*/ +amd_perf_ctl_reset (policy->cpu); dev =get_cpu_device (policy->cpu);if (!dev)return -ENODEV ;
Greg Kroah-Hartman
maintainerPATCH 179/289 zonefs: Fix active zone accounting
In reply to Greg Kroah-HartmanFrom: Damien Le Moal <[email protected]>
commit db58653ce0c7cf4d155727852607106f890005c0 upstream.
If a file zone transitions to the offline or readonly state from an active state, we must clear the zone active flag and decrement the active seq file counter. Do so in zonefs_account_active() using the new zonefs inode flags ZONEFS_ZONE_OFFLINE and ZONEFS_ZONE_READONLY. These flags are set if necessary in zonefs_check_zone_condition() based on the result of report zones operation after an IO error.
--- fs/zonefs/super.c | 11 +++++++++++ fs/zonefs/zonefs.h | 6 ++++-- 2 files changed, 15 insertions(+), 2 deletions(-)
fs/zonefs/super.c +11 -0
@@ -41,6 +41,13 @@ static void zonefs_account_active(structreturn ;/* +* For zones that transitioned to the offline or readonly condition, +* we only need to clear the active state. +*/ +if (zi->i_flags & (ZONEFS_ZONE_OFFLINE |ZONEFS_ZONE_READONLY )) + goto out; + +/* * If the zone is active, that is, if it is explicitly open or * partially written, check if it was already accounted as active. */
@@ -53,6 +60,7 @@ static void zonefs_account_active(structreturn ; } +out:/* The zone is not active. If it was, update the active count */ if (zi->i_flags &ZONEFS_ZONE_ACTIVE ) { zi->i_flags &= ~ZONEFS_ZONE_ACTIVE ;
@@ -324,6 +332,7 @@ static loff_t zonefs_check_zone_conditio inode->i_flags |=S_IMMUTABLE ; inode->i_mode &= ~0777 ; zone->wp = zone->start; + zi->i_flags |=ZONEFS_ZONE_OFFLINE ;return 0 ;case BLK_ZONE_COND_READONLY :/*
@@ -342,8 +351,10 @@ static loff_t zonefs_check_zone_conditio zone->cond =BLK_ZONE_COND_OFFLINE ; inode->i_mode &= ~0777 ; zone->wp = zone->start; + zi->i_flags |=ZONEFS_ZONE_OFFLINE ;return 0 ; } + zi->i_flags |=ZONEFS_ZONE_READONLY ; inode->i_mode &= ~0222 ;return i_size_read (inode);case BLK_ZONE_COND_FULL :
fs/zonefs/zonefs.h +4 -2
@@ -39,8 +39,10 @@ static inline enum zonefs_ztype zonefs_zreturn ZONEFS_ZTYPE_SEQ ; } -#define ZONEFS_ZONE_OPEN (1 << 0) -#define ZONEFS_ZONE_ACTIVE (1 << 1) +#define ZONEFS_ZONE_OPEN (1U << 0) +#define ZONEFS_ZONE_ACTIVE (1U << 1) +#define ZONEFS_ZONE_OFFLINE (1U << 2) +#define ZONEFS_ZONE_READONLY (1U << 3)/* * In-memory inode data.
Greg Kroah-Hartman
maintainerPATCH 180/289 bus: ixp4xx: Dont touch bit 7 on IXP42x
In reply to Greg Kroah-HartmanFrom: Linus Walleij <[email protected]>
commit ff5a19909b49fe5c0b01ae197f84b741e0f698dc upstream.
We face some regressions on a few IXP42x systems when accessing flash, the following unrelated error prints appear from the PCI driver:
ixp4xx-pci c0000000.pci: PCI: abort_handler addr = 0xff9ffb5f,
isr = 0x0, status = 0x22a0
ixp4xx-pci c0000000.pci: imprecise abort
(...)
It turns out that while bit 7 is masked "reserved" it is not unused, so masking it off as zero is dangerous, and breaks flash access on some systems such as the NSLU2. Be more careful and avoid masking off any of the reserved bits 7, 8, 9 or 30. Only keep masking EXP_WORD (bit 2) on IXP43x which is necessary in some setups.
--- drivers/bus/intel-ixp4xx-eb.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
drivers/bus/intel-ixp4xx-eb.c +3 -6
@@ -49,7 +49,7 @@#define IXP4XX_EXP_SIZE_SHIFT 10#define IXP4XX_EXP_CNFG_0 BIT(9)/* Always zero */ #define IXP43X_EXP_SYNC_INTEL BIT(8)/* Only on IXP43x */ -#define IXP43X_EXP_EXP_CHIP BIT(7)/* Only on IXP43x */ +#define IXP43X_EXP_EXP_CHIP BIT(7)/* Only on IXP43x, dangerous to touch on IXP42x */ #define IXP4XX_EXP_BYTE_RD16 BIT(6)#define IXP4XX_EXP_HRDY_POL BIT(5)/* Only on IXP42x */ #define IXP4XX_EXP_MUX_EN BIT(4)
@@ -57,8 +57,6 @@#define IXP4XX_EXP_WORD BIT(2)/* Always zero */ #define IXP4XX_EXP_WR_EN BIT(1)#define IXP4XX_EXP_BYTE_EN BIT(0) -#define IXP42X_RESERVED (BIT(30)|IXP4XX_EXP_CNFG_0|BIT(8)|BIT(7)|IXP4XX_EXP_WORD) -#define IXP43X_RESERVED (BIT(30)|IXP4XX_EXP_CNFG_0|BIT(5)|IXP4XX_EXP_WORD)#define IXP4XX_EXP_CNFG0 0x20#define IXP4XX_EXP_CNFG0_MEM_MAP BIT(31)
@@ -252,10 +250,9 @@ static void ixp4xx_exp_setup_chipselect( cs_cfg |= val <<IXP4XX_EXP_CYC_TYPE_SHIFT ; } -if (eb->is_42x) - cs_cfg &= ~IXP42X_RESERVED ;if (eb->is_43x) { - cs_cfg &= ~IXP43X_RESERVED ; +/* Should always be zero */ + cs_cfg &= ~IXP4XX_EXP_WORD ;/* * This bit for Intel strata flash is currently unused, but let's * report it if we find one.
Greg Kroah-Hartman
maintainerPATCH 181/289 spi: spi-imx: Fix spi_bus_clk if requested clock is higher than input clock
In reply to Greg Kroah-HartmanFrom: Frieder Schrempf <[email protected]>
commit db2d2dc9a0b58c6faefb6b002fdbed4f0362d1a4 upstream.
In case the requested bus clock is higher than the input clock, the correct dividers (pre = 0, post = 0) are returned from mx51_ecspi_clkdiv(), but *fres is left uninitialized and therefore contains an arbitrary value.
This causes trouble for the recently introduced PIO polling feature as the value in spi_imx->spi_bus_clk is used there to calculate for which transfers to enable PIO polling.
Fix this by setting *fres even if no clock dividers are in use.
This issue was observed on Kontron BL i.MX8MM with an SPI peripheral clock set to 50 MHz by default and a requested SPI bus clock of 80 MHz for the SPI NOR flash.
With the fix applied the debug message from mx51_ecspi_clkdiv() now prints the following:
spi_imx 30820000.spi: mx51_ecspi_clkdiv: fin: 50000000, fspi: 50000000,
post: 0, pre: 0
--- drivers/spi/spi-imx.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/spi/spi-imx.c +1 -2
@@ -444,8 +444,7 @@ static unsigned int mx51_ecspi_clkdiv(stunsigned int pre, post;unsigned int fin = spi_imx->spi_clk; -if (unlikely (fspi > fin)) -return 0 ; + fspi =min (fspi, fin); post =fls (fin) -fls (fspi);if (fin > fspi << post)
Greg Kroah-Hartman
maintainerPATCH 182/289 spi: spi-imx: spi_imx_transfer_one(): check for DMA transfer first
In reply to Greg Kroah-HartmanFrom: Marc Kleine-Budde <[email protected]>
commit e85e9e0d8cb759013d6474011c227f92e442d746 upstream.
The SPI framework checks for each transfer (with the struct spi_controller::can_dma callback) whether the driver wants to use DMA for the transfer. If the driver returns true, the SPI framework will map the transfer's data to the device, start the actual transfer and map the data back.
In commit 07e759387788 ("spi: spi-imx: add PIO polling support") the spi-imx driver's spi_imx_transfer_one() function was extended. If the estimated duration of a transfer does not exceed a configurable duration, a polling transfer function is used. This check happens before checking if the driver decided earlier for a DMA transfer.
If spi_imx_can_dma() decided to use a DMA transfer, and the user configured a big maximum polling duration, a polling transfer will be used. The DMA unmap after the transfer destroys the transferred data.
To fix this problem check in spi_imx_transfer_one() if the driver decided for DMA transfer first, then check the limits for a polling transfer.
--- drivers/spi/spi-imx.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/spi/spi-imx.c +7 -3
@@ -1606,6 +1606,13 @@ static int spi_imx_transfer_one(struct spi_controller *controller,if (spi_imx->slave_mode)return spi_imx_pio_transfer_slave (spi, transfer); +/* +* If we decided in spi_imx_can_dma() that we want to do a DMA +* transfer, the SPI transfer has already been mapped, so we +* have to do the DMA transfer here. +*/ +if (spi_imx->usedma) +return spi_imx_dma_transfer (spi_imx, transfer);/* * Calculate the estimated time in us the transfer runs. Find * the number of Hz per byte per polling limit.
@@ -1617,9 +1624,6 @@ static int spi_imx_transfer_one(struct spi_controller *controller,if (transfer->len < byte_limit)return spi_imx_poll_transfer (spi, transfer); -if (spi_imx->usedma) -return spi_imx_dma_transfer (spi_imx, transfer); -return spi_imx_pio_transfer (spi, transfer); }
Signature · 1 line
2.38.1
Greg Kroah-Hartman
maintainerPATCH 183/289 init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash
In reply to Greg Kroah-HartmanFrom: Alexandre Belloni <[email protected]>
[ Upstream commit 534bd70374d646f17e2cebe0e6e4cdd478ce4f0c ]
When using dash as /bin/sh, the CC_HAS_ASM_GOTO_TIED_OUTPUT test fails with a syntax error which is not the one we are looking for:
<stdin>: In function ‘foo’:
<stdin>:1:29: warning: missing terminating " character <stdin>:1:29: error: missing terminating " character <stdin>:2:5: error: expected ‘:’ before ‘+’ token <stdin>:2:7: warning: missing terminating " character <stdin>:2:7: error: missing terminating " character <stdin>:2:5: error: expected declaration or statement at end of input
Removing '\n' solves this.
--- init/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
init/Kconfig +1 -1
@@ -76,7 +76,7 @@ config CC_HAS_ASM_GOTO_OUTPUT config CC_HAS_ASM_GOTO_TIED_OUTPUT depends on CC_HAS_ASM_GOTO_OUTPUT # Detect buggy gcc and clang, fixed in gcc-11 clang-14. - def_bool $(success,echo 'int foo(int *x) { asm goto (".long (%l[bar]) - .\n": "+m"(*x) ::: bar); return *x; bar: return 0; }' | $CC -x c - -c -o /dev/null) + def_bool $(success,echo 'int foo(int *x) { asm goto (".long (%l[bar]) - .": "+m"(*x) ::: bar); return *x; bar: return 0; }' | $CC -x c - -c -o /dev/null) config TOOLS_SUPPORT_RELR def_bool $(success,env "CC=$(CC)" "LD=$(LD)" "NM=$(NM)" "OBJCOPY=$(OBJCOPY)" $(srctree)/scripts/tools-support-relr.sh)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 184/289 NFSD: Fix reads with a non-zero offset that dont end on a page boundary
In reply to Greg Kroah-HartmanFrom: Chuck Lever <[email protected]>
[ Upstream commit ac8db824ead0de2e9111337c401409d010fba2f0 ]
This was found when virtual machines with nfs-mounted qcow2 disks failed to boot properly.
--- fs/nfsd/vfs.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
fs/nfsd/vfs.c +4 -3
@@ -847,10 +847,11 @@ nfsd_splice_actor(struct pipe_inode_info *pipe, struct pipe_buffer *buf,struct svc_rqst *rqstp = sd->u.data;struct page *page = buf->page;// may be a compound one unsigned offset = buf->offset; +struct page *last_page; - page += offset /PAGE_SIZE ; -for (int i = sd->len; i >0 ; i -=PAGE_SIZE ) -svc_rqst_replace_page (rqstp, page++); + last_page = page + (offset + sd->len -1 ) /PAGE_SIZE ; +for (page += offset /PAGE_SIZE ; page <= last_page; page++) +svc_rqst_replace_page (rqstp, page);if (rqstp->rq_res.page_len ==0 )// first call rqstp->rq_res.page_base = offset %PAGE_SIZE ; rqstp->rq_res.page_len += sd->len;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 185/289 nios2: add FORCE for vmlinuz.gz
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit 869e4ae4cd2a23d625aaa14ae62dbebf768cb77d ]
Add FORCE to placate a warning from make:
arch/nios2/boot/Makefile:24: FORCE prerequisite is missing
--- arch/nios2/boot/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/nios2/boot/Makefile +1 -1
@@ -20,7 +20,7 @@ $(obj)/vmlinux.bin: vmlinux FORCE $(obj)/vmlinux.gz: $(obj)/vmlinux.bin FORCE $(call if_changed,gzip) -$(obj)/vmImage: $(obj)/vmlinux.gz +$(obj)/vmImage: $(obj)/vmlinux.gz FORCE $(call if_changed,uimage) @$(kecho) 'Kernel: $@ is ready'
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 186/289 drm/amdgpu: Enable SA software trap.
In reply to Greg Kroah-HartmanFrom: David Belanger <[email protected]>
[ Upstream commit 585a82618bc422508c0c8ae0dfe2f76f22c28361 ]
Enables support for software trap for MES >= 4.
Adapted from implementation from Jay Cornwall.
v2: Add IP version check in conditions.
v3: Remove debugger code changes.
Stable-dep-of: 6640f8e5adb6 ("drm/amdkfd: update GFX11 CWSR trap handler")
--- drivers/gpu/drm/amd/amdgpu/mes_v11_0.c | 6 +- .../gpu/drm/amd/amdkfd/cwsr_trap_handler.h | 771 +++++++++--------- .../amd/amdkfd/cwsr_trap_handler_gfx10.asm | 21 + 3 files changed, 413 insertions(+), 385 deletions(-)
drivers/gpu/drm/amd/amdgpu/mes_v11_0.c +5 -1
@@ -190,7 +190,11 @@ static int mes_v11_0_add_hw_queue(struct amdgpu_mes *mes, mes_add_queue_pkt.trap_handler_addr = input->tba_addr; mes_add_queue_pkt.tma_addr = input->tma_addr; mes_add_queue_pkt.is_kfd_process = input->is_kfd_process; - mes_add_queue_pkt.trap_en =1 ; + +if (!(((adev->mes.sched_version &AMDGPU_MES_VERSION_MASK ) >=4 ) && + (adev->ip_versions[GC_HWIP ][0 ] >=IP_VERSION (11 ,0 ,0 )) && + (adev->ip_versions[GC_HWIP ][0 ] <=IP_VERSION (11 ,0 ,3 )))) + mes_add_queue_pkt.trap_en =1 ;/* For KFD, gds_size is re-used for queue size (needed in MES for AQL queues) */ mes_add_queue_pkt.is_aql_queue = input->is_aql_queue;
drivers/gpu/drm/amd/amdkfd/cwsr_trap_handler.h +387 -384
874 lines not on this page · raw message
drivers/gpu/drm/amd/amdkfd/cwsr_trap_handler_gfx10.asm +21 -0
@@ -43,12 +43,14 @@ #define HAVE_XNACK (ASIC_FAMILY < CHIP_SIENNA_CICHLID) #define HAVE_SENDMSG_RTN (ASIC_FAMILY >= CHIP_PLUM_BONITO) #define HAVE_BUFFER_LDS_LOAD (ASIC_FAMILY < CHIP_PLUM_BONITO) +#define SW_SA_TRAP (ASIC_FAMILY >= CHIP_PLUM_BONITO) var SINGLE_STEP_MISSED_WORKAROUND = 1 //workaround for lost MODE.DEBUG_EN exception when SAVECTX raised var SQ_WAVE_STATUS_SPI_PRIO_MASK = 0x00000006 var SQ_WAVE_STATUS_HALT_MASK = 0x2000 var SQ_WAVE_STATUS_ECC_ERR_MASK = 0x20000 +var SQ_WAVE_STATUS_TRAP_EN_SHIFT = 6 var SQ_WAVE_LDS_ALLOC_LDS_SIZE_SHIFT = 12 var SQ_WAVE_LDS_ALLOC_LDS_SIZE_SIZE = 9
@@ -183,6 +185,13 @@ L_SKIP_RESTORE: s_getreg_b32 s_save_trapsts, hwreg(HW_REG_TRAPSTS) +#if SW_SA_TRAP + // If ttmp1[31] is set then trap may occur early. + // Spin wait until SAVECTX exception is raised. + s_bitcmp1_b32 s_save_pc_hi, 31 + s_cbranch_scc1 L_CHECK_SAVE +#endif + s_and_b32 ttmp2, s_save_status, SQ_WAVE_STATUS_HALT_MASK s_cbranch_scc0 L_NOT_HALTED
@@ -1061,8 +1070,20 @@ L_RESTORE_HWREG: s_and_b32 s_restore_pc_hi, s_restore_pc_hi, 0x0000ffff //pc[47:32] //Do it here in order not to affect STATUS s_and_b64 exec, exec, exec // Restore STATUS.EXECZ, not writable by s_setreg_b32 s_and_b64 vcc, vcc, vcc // Restore STATUS.VCCZ, not writable by s_setreg_b32 + +#if SW_SA_TRAP + // If traps are enabled then return to the shader with PRIV=0. + // Otherwise retain PRIV=1 for subsequent context save requests. + s_getreg_b32 s_restore_tmp, hwreg(HW_REG_STATUS) + s_bitcmp1_b32 s_restore_tmp, SQ_WAVE_STATUS_TRAP_EN_SHIFT + s_cbranch_scc1 L_RETURN_WITHOUT_PRIV + s_setreg_b32 hwreg(HW_REG_STATUS), s_restore_status // SCC is included, which is changed by previous salu + s_setpc_b64 [s_restore_pc_lo, s_restore_pc_hi] +L_RETURN_WITHOUT_PRIV: +#endif + s_setreg_b32 hwreg(HW_REG_STATUS), s_restore_status // SCC is included, which is changed by previous salu s_rfe_b64 s_restore_pc_lo //Return to the main shader program and resume execution L_END_PGM:
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 187/289 drm/amdkfd: update GFX11 CWSR trap handler
In reply to Greg Kroah-HartmanFrom: Jay Cornwall <[email protected]>
[ Upstream commit 6640f8e5adb69a0550fe1d224d3ac64c10f00eef ]
With corresponding FW change fixes issue where triggering CWSR on a workgroup with waves in s_barrier wouldn't lead to a back-off and therefore cause a hang.
--- .../gpu/drm/amd/amdkfd/cwsr_trap_handler.h | 764 +++++++++--------- .../amd/amdkfd/cwsr_trap_handler_gfx10.asm | 6 + 2 files changed, 389 insertions(+), 381 deletions(-)
drivers/gpu/drm/amd/amdkfd/cwsr_trap_handler.h +383 -381
@@ -2495,442 +2495,444 @@ static const uint32_t cwsr_trap_gfx10_hex[] = { 0xbf9f0000, 0x00000000, };static const uint32_t cwsr_trap_gfx11_hex[] = { -0xbfa00001 ,0xbfa0021e , +0xbfa00001 ,0xbfa00221 ,0xb0804006 ,0xb8f8f802 ,0x9178ff78 ,0x00020006 , -0xb8fbf803 ,0xbf0d9f6d , -0xbfa20006 ,0x8b6eff78 , -0x00002000 ,0xbfa10009 , -0x8b6eff6d ,0x00ff0000 , -0xbfa2001e ,0x8b6eff7b , -0x00000400 ,0xbfa20041 , -0xbf830010 ,0xb8fbf803 , -0xbfa0fffa ,0x8b6eff7b , -0x00000900 ,0xbfa20015 , -0x8b6eff7b ,0x000071ff , -0xbfa10008 ,0x8b6fff7b , -0x00007080 ,0xbfa10001 , -0xbeee1287 ,0xb8eff801 , -0x846e8c6e ,0x8b6e6f6e , -0xbfa2000a ,0x8b6eff6d , -0x00ff0000 ,0xbfa20007 , -0xb8eef801 ,0x8b6eff6e , -0x00000800 ,0xbfa20003 , +0xb8fbf803 ,0xbf0d9e6d , +0xbfa10001 ,0xbfbd0000 , +0xbf0d9f6d ,0xbfa20006 , +0x8b6eff78 ,0x00002000 , +0xbfa10009 ,0x8b6eff6d , +0x00ff0000 ,0xbfa2001e ,0x8b6eff7b ,0x00000400 , -0xbfa20026 ,0xbefa4d82 , -0xbf89fc07 ,0x84fa887a , -0xf4005bbd ,0xf8000010 , -0xbf89fc07 ,0x846e976e , -0x9177ff77 ,0x00800000 , -0x8c776e77 ,0xf4045bbd , -0xf8000000 ,0xbf89fc07 , -0xf4045ebd ,0xf8000008 , -0xbf89fc07 ,0x8bee6e6e , -0xbfa10001 ,0xbe80486e , -0x8b6eff6d ,0x01ff0000 , -0xbfa20005 ,0x8c78ff78 , -0x00002000 ,0x80ec886c , -0x82ed806d ,0xbfa00005 , -0x8b6eff6d ,0x01000000 , -0xbfa20002 ,0x806c846c , -0x826d806d ,0x8b6dff6d , -0x0000ffff ,0x8bfe7e7e , -0x8bea6a6a ,0xb978f802 , -0xbe804a6c ,0x8b6dff6d , -0x0000ffff ,0xbefa0080 , -0xb97a0283 ,0xbeee007e , -0xbeef007f ,0xbefe0180 , -0xbefe4d84 ,0xbf89fc07 , -0x8b7aff7f ,0x04000000 , -0x847a857a ,0x8c6d7a6d , -0xbefa007e ,0x8b7bff7f , -0x0000ffff ,0xbefe00c1 , -0xbeff00c1 ,0xdca6c000 , -0x007a0000 ,0x7e000280 , -0xbefe007a ,0xbeff007b , -0xb8fb02dc ,0x847b997b , -0xb8fa3b05 ,0x807a817a , -0xbf0d997b ,0xbfa20002 , -0x847a897a ,0xbfa00001 , -0x847a8a7a ,0xb8fb1e06 , -0x847b8a7b ,0x807a7b7a , +0xbfa20041 ,0xbf830010 , +0xb8fbf803 ,0xbfa0fffa , +0x8b6eff7b ,0x00000900 , +0xbfa20015 ,0x8b6eff7b , +0x000071ff ,0xbfa10008 , +0x8b6fff7b ,0x00007080 , +0xbfa10001 ,0xbeee1287 , +0xb8eff801 ,0x846e8c6e , +0x8b6e6f6e ,0xbfa2000a , +0x8b6eff6d ,0x00ff0000 , +0xbfa20007 ,0xb8eef801 , +0x8b6eff6e ,0x00000800 , +0xbfa20003 ,0x8b6eff7b , +0x00000400 ,0xbfa20026 , +0xbefa4d82 ,0xbf89fc07 , +0x84fa887a ,0xf4005bbd , +0xf8000010 ,0xbf89fc07 , +0x846e976e ,0x9177ff77 , +0x00800000 ,0x8c776e77 , +0xf4045bbd ,0xf8000000 , +0xbf89fc07 ,0xf4045ebd , +0xf8000008 ,0xbf89fc07 , +0x8bee6e6e ,0xbfa10001 , +0xbe80486e ,0x8b6eff6d , +0x01ff0000 ,0xbfa20005 , +0x8c78ff78 ,0x00002000 , +0x80ec886c ,0x82ed806d , +0xbfa00005 ,0x8b6eff6d , +0x01000000 ,0xbfa20002 , +0x806c846c ,0x826d806d , +0x8b6dff6d ,0x0000ffff , +0x8bfe7e7e ,0x8bea6a6a , +0xb978f802 ,0xbe804a6c , +0x8b6dff6d ,0x0000ffff , +0xbefa0080 ,0xb97a0283 , +0xbeee007e ,0xbeef007f , +0xbefe0180 ,0xbefe4d84 , +0xbf89fc07 ,0x8b7aff7f , +0x04000000 ,0x847a857a , +0x8c6d7a6d ,0xbefa007e ,0x8b7bff7f ,0x0000ffff , -0x807aff7a ,0x00000200 , -0x807a7e7a ,0x827b807b , -0xd7610000 ,0x00010870 , -0xd7610000 ,0x00010a71 , -0xd7610000 ,0x00010c72 , -0xd7610000 ,0x00010e73 , -0xd7610000 ,0x00011074 , -0xd7610000 ,0x00011275 , -0xd7610000 ,0x00011476 , -0xd7610000 ,0x00011677 , -0xd7610000 ,0x00011a79 , -0xd7610000 ,0x00011c7e , -0xd7610000 ,0x00011e7f , -0xbefe00ff ,0x00003fff , -0xbeff0080 ,0xdca6c040 , -0x007a0000 ,0xd760007a , -0x00011d00 ,0xd760007b , -0x00011f00 ,0xbefe007a , -0xbeff007b ,0xbef4007e , -0x8b75ff7f ,0x0000ffff , -0x8c75ff75 ,0x00040000 , -0xbef60080 ,0xbef700ff , -0x10807fac ,0xbef1007d , -0xbef00080 ,0xb8f302dc , -0x84739973 ,0xbefe00c1 , -0x857d9973 ,0x8b7d817d , -0xbf06817d ,0xbfa20002 , -0xbeff0080 ,0xbfa00002 , -0xbeff00c1 ,0xbfa00009 , +0xbefe00c1 ,0xbeff00c1 , +0xdca6c000 ,0x007a0000 , +0x7e000280 ,0xbefe007a , +0xbeff007b ,0xb8fb02dc , +0x847b997b ,0xb8fa3b05 , +0x807a817a ,0xbf0d997b , +0xbfa20002 ,0x847a897a , +0xbfa00001 ,0x847a8a7a , +0xb8fb1e06 ,0x847b8a7b , +0x807a7b7a ,0x8b7bff7f , +0x0000ffff ,0x807aff7a , +0x00000200 ,0x807a7e7a , +0x827b807b ,0xd7610000 , +0x00010870 ,0xd7610000 , +0x00010a71 ,0xd7610000 , +0x00010c72 ,0xd7610000 , +0x00010e73 ,0xd7610000 , +0x00011074 ,0xd7610000 , +0x00011275 ,0xd7610000 , +0x00011476 ,0xd7610000 , +0x00011677 ,0xd7610000 , +0x00011a79 ,0xd7610000 , +0x00011c7e ,0xd7610000 , +0x00011e7f ,0xbefe00ff , +0x00003fff ,0xbeff0080 , +0xdca6c040 ,0x007a0000 , +0xd760007a ,0x00011d00 , +0xd760007b ,0x00011f00 , +0xbefe007a ,0xbeff007b , +0xbef4007e ,0x8b75ff7f , +0x0000ffff ,0x8c75ff75 , +0x00040000 ,0xbef60080 , +0xbef700ff ,0x10807fac , +0xbef1007d ,0xbef00080 , +0xb8f302dc ,0x84739973 , +0xbefe00c1 ,0x857d9973 , +0x8b7d817d ,0xbf06817d , +0xbfa20002 ,0xbeff0080 , +0xbfa00002 ,0xbeff00c1 , +0xbfa00009 ,0xbef600ff , +0x01000000 ,0xe0685080 , +0x701d0100 ,0xe0685100 , +0x701d0200 ,0xe0685180 , +0x701d0300 ,0xbfa00008 ,0xbef600ff ,0x01000000 , -0xe0685080 ,0x701d0100 , -0xe0685100 ,0x701d0200 , -0xe0685180 ,0x701d0300 , -0xbfa00008 ,0xbef600ff , -0x01000000 ,0xe0685100 , -0x701d0100 ,0xe0685200 , -0x701d0200 ,0xe0685300 , -0x701d0300 ,0xb8f03b05 , -0x80708170 ,0xbf0d9973 , -0xbfa20002 ,0x84708970 , -0xbfa00001 ,0x84708a70 , -0xb8fa1e06 ,0x847a8a7a , -0x80707a70 ,0x8070ff70 , -0x00000200 ,0xbef600ff , -0x01000000 ,0x7e000280 , -0x7e020280 ,0x7e040280 , -0xbefd0080 ,0xd7610002 , -0x0000fa71 ,0x807d817d , -0xd7610002 ,0x0000fa6c , -0x807d817d ,0x917aff6d , -0x80000000 ,0xd7610002 , -0x0000fa7a ,0x807d817d , -0xd7610002 ,0x0000fa6e , -0x807d817d ,0xd7610002 , -0x0000fa6f ,0x807d817d , -0xd7610002 ,0x0000fa78 , -0x807d817d ,0xb8faf803 , -0xd7610002 ,0x0000fa7a , -0x807d817d ,0xd7610002 , -0x0000fa7b ,0x807d817d , -0xb8f1f801 ,0xd7610002 , -0x0000fa71 ,0x807d817d , -0xb8f1f814 ,0xd7610002 , -0x0000fa71 ,0x807d817d , -0xb8f1f815 ,0xd7610002 , -0x0000fa71 ,0x807d817d , -0xbefe00ff ,0x0000ffff , -0xbeff0080 ,0xe0685000 , -0x701d0200 ,0xbefe00c1 , +0xe0685100 ,0x701d0100 , +0xe0685200 ,0x701d0200 , +0xe0685300 ,0x701d0300 ,0xb8f03b05 ,0x80708170 ,0xbf0d9973 ,0xbfa20002 ,0x84708970 ,0xbfa00001 ,0x84708a70 ,0xb8fa1e06 ,0x847a8a7a ,0x80707a70 , +0x8070ff70 ,0x00000200 ,0xbef600ff ,0x01000000 , -0xbef90080 ,0xbefd0080 , -0xbf800000 ,0xbe804100 , -0xbe824102 ,0xbe844104 , -0xbe864106 ,0xbe884108 , -0xbe8a410a ,0xbe8c410c , -0xbe8e410e ,0xd7610002 , -0x0000f200 ,0x80798179 , -0xd7610002 ,0x0000f201 , +0x7e000280 ,0x7e020280 , +0x7e040280 ,0xbefd0080 , +0xd7610002 ,0x0000fa71 , +0x807d817d ,0xd7610002 , +0x0000fa6c ,0x807d817d , +0x917aff6d ,0x80000000 , +0xd7610002 ,0x0000fa7a , +0x807d817d ,0xd7610002 , +0x0000fa6e ,0x807d817d , +0xd7610002 ,0x0000fa6f , +0x807d817d ,0xd7610002 , +0x0000fa78 ,0x807d817d , +0xb8faf803 ,0xd7610002 , +0x0000fa7a ,0x807d817d , +0xd7610002 ,0x0000fa7b , +0x807d817d ,0xb8f1f801 , +0xd7610002 ,0x0000fa71 , +0x807d817d ,0xb8f1f814 , +0xd7610002 ,0x0000fa71 , +0x807d817d ,0xb8f1f815 , +0xd7610002 ,0x0000fa71 , +0x807d817d ,0xbefe00ff , +0x0000ffff ,0xbeff0080 , +0xe0685000 ,0x701d0200 , +0xbefe00c1 ,0xb8f03b05 , +0x80708170 ,0xbf0d9973 , +0xbfa20002 ,0x84708970 , +0xbfa00001 ,0x84708a70 , +0xb8fa1e06 ,0x847a8a7a , +0x80707a70 ,0xbef600ff , +0x01000000 ,0xbef90080 , +0xbefd0080 ,0xbf800000 , +0xbe804100 ,0xbe824102 , +0xbe844104 ,0xbe864106 , +0xbe884108 ,0xbe8a410a , +0xbe8c410c ,0xbe8e410e , +0xd7610002 ,0x0000f200 ,0x80798179 ,0xd7610002 , -0x0000f202 ,0x80798179 , -0xd7610002 ,0x0000f203 , +0x0000f201 ,0x80798179 , +0xd7610002 ,0x0000f202 ,0x80798179 ,0xd7610002 , -0x0000f204 ,0x80798179 , -0xd7610002 ,0x0000f205 , +0x0000f203 ,0x80798179 , +0xd7610002 ,0x0000f204 ,0x80798179 ,0xd7610002 , -0x0000f206 ,0x80798179 , -0xd7610002 ,0x0000f207 , +0x0000f205 ,0x80798179 , +0xd7610002 ,0x0000f206 ,0x80798179 ,0xd7610002 , -0x0000f208 ,0x80798179 , -0xd7610002 ,0x0000f209 , +0x0000f207 ,0x80798179 , +0xd7610002 ,0x0000f208 ,0x80798179 ,0xd7610002 , -0x0000f20a ,0x80798179 , -0xd7610002 ,0x0000f20b , +0x0000f209 ,0x80798179 , +0xd7610002 ,0x0000f20a ,0x80798179 ,0xd7610002 , -0x0000f20c ,0x80798179 , -0xd7610002 ,0x0000f20d , +0x0000f20b ,0x80798179 , +0xd7610002 ,0x0000f20c ,0x80798179 ,0xd7610002 , -0x0000f20e ,0x80798179 , -0xd7610002 ,0x0000f20f , -0x80798179 ,0xbf06a079 , -0xbfa10006 ,0xe0685000 , -0x701d0200 ,0x8070ff70 , -0x00000080 ,0xbef90080 , -0x7e040280 ,0x807d907d , -0xbf0aff7d ,0x00000060 , -0xbfa2ffbc ,0xbe804100 , -0xbe824102 ,0xbe844104 , -0xbe864106 ,0xbe884108 , -0xbe8a410a ,0xd7610002 , -0x0000f200 ,0x80798179 , -0xd7610002 ,0x0000f201 , +0x0000f20d ,0x80798179 , +0xd7610002 ,0x0000f20e ,0x80798179 ,0xd7610002 , -0x0000f202 ,0x80798179 , -0xd7610002 ,0x0000f203 , +0x0000f20f ,0x80798179 , +0xbf06a079 ,0xbfa10006 , +0xe0685000 ,0x701d0200 , +0x8070ff70 ,0x00000080 , +0xbef90080 ,0x7e040280 , +0x807d907d ,0xbf0aff7d , +0x00000060 ,0xbfa2ffbc , +0xbe804100 ,0xbe824102 , +0xbe844104 ,0xbe864106 , +0xbe884108 ,0xbe8a410a , +0xd7610002 ,0x0000f200 ,0x80798179 ,0xd7610002 , -0x0000f204 ,0x80798179 , -0xd7610002 ,0x0000f205 , +0x0000f201 ,0x80798179 , +0xd7610002 ,0x0000f202 ,0x80798179 ,0xd7610002 , -0x0000f206 ,0x80798179 , -0xd7610002 ,0x0000f207 , +0x0000f203 ,0x80798179 , +0xd7610002 ,0x0000f204 ,0x80798179 ,0xd7610002 , -0x0000f208 ,0x80798179 , -0xd7610002 ,0x0000f209 , +0x0000f205 ,0x80798179 , +0xd7610002 ,0x0000f206 ,0x80798179 ,0xd7610002 , -0x0000f20a ,0x80798179 , -0xd7610002 ,0x0000f20b , -0x80798179 ,0xe0685000 , -0x701d0200 ,0xbefe00c1 , -0x857d9973 ,0x8b7d817d , -0xbf06817d ,0xbfa20002 , -0xbeff0080 ,0xbfa00001 , -0xbeff00c1 ,0xb8fb4306 , -0x8b7bc17b ,0xbfa10044 , -0xbfbd0000 ,0x8b7aff6d , -0x80000000 ,0xbfa10040 , -0x847b867b ,0x847b827b , -0xbef6007b ,0xb8f03b05 , -0x80708170 ,0xbf0d9973 , -0xbfa20002 ,0x84708970 , -0xbfa00001 ,0x84708a70 , -0xb8fa1e06 ,0x847a8a7a , -0x80707a70 ,0x8070ff70 , -0x00000200 ,0x8070ff70 , -0x00000080 ,0xbef600ff , -0x01000000 ,0xd71f0000 , -0x000100c1 ,0xd7200000 , -0x000200c1 ,0x16000084 , -0x857d9973 ,0x8b7d817d , -0xbf06817d ,0xbefd0080 , -0xbfa20012 ,0xbe8300ff , -0x00000080 ,0xbf800000 , -0xbf800000 ,0xbf800000 , -0xd8d80000 ,0x01000000 , -0xbf890000 ,0xe0685000 , -0x701d0100 ,0x807d037d , -0x80700370 ,0xd5250000 , -0x0001ff00 ,0x00000080 , -0xbf0a7b7d ,0xbfa2fff4 , -0xbfa00011 ,0xbe8300ff , -0x00000100 ,0xbf800000 , -0xbf800000 ,0xbf800000 , -0xd8d80000 ,0x01000000 , -0xbf890000 ,0xe0685000 , -0x701d0100 ,0x807d037d , -0x80700370 ,0xd5250000 , -0x0001ff00 ,0x00000100 , -0xbf0a7b7d ,0xbfa2fff4 , +0x0000f207 ,0x80798179 , +0xd7610002 ,0x0000f208 , +0x80798179 ,0xd7610002 , +0x0000f209 ,0x80798179 , +0xd7610002 ,0x0000f20a , +0x80798179 ,0xd7610002 , +0x0000f20b ,0x80798179 , +0xe0685000 ,0x701d0200 ,0xbefe00c1 ,0x857d9973 ,0x8b7d817d ,0xbf06817d , -0xbfa20004 ,0xbef000ff , -0x00000200 ,0xbeff0080 , -0xbfa00003 ,0xbef000ff , -0x00000400 ,0xbeff00c1 , -0xb8fb3b05 ,0x807b817b , -0x847b827b ,0x857d9973 , +0xbfa20002 ,0xbeff0080 , +0xbfa00001 ,0xbeff00c1 , +0xb8fb4306 ,0x8b7bc17b , +0xbfa10044 ,0xbfbd0000 , +0x8b7aff6d ,0x80000000 , +0xbfa10040 ,0x847b867b , +0x847b827b ,0xbef6007b , +0xb8f03b05 ,0x80708170 , +0xbf0d9973 ,0xbfa20002 , +0x84708970 ,0xbfa00001 , +0x84708a70 ,0xb8fa1e06 , +0x847a8a7a ,0x80707a70 , +0x8070ff70 ,0x00000200 , +0x8070ff70 ,0x00000080 , +0xbef600ff ,0x01000000 , +0xd71f0000 ,0x000100c1 , +0xd7200000 ,0x000200c1 , +0x16000084 ,0x857d9973 ,0x8b7d817d ,0xbf06817d , -0xbfa20017 ,0xbef600ff , -0x01000000 ,0xbefd0084 , -0xbf0a7b7d ,0xbfa10037 , -0x7e008700 ,0x7e028701 , -0x7e048702 ,0x7e068703 , -0xe0685000 ,0x701d0000 , -0xe0685080 ,0x701d0100 , -0xe0685100 ,0x701d0200 , -0xe0685180 ,0x701d0300 , -0x807d847d ,0x8070ff70 , -0x00000200 ,0xbf0a7b7d , -0xbfa2ffef ,0xbfa00025 , +0xbefd0080 ,0xbfa20012 , +0xbe8300ff ,0x00000080 , +0xbf800000 ,0xbf800000 , +0xbf800000 ,0xd8d80000 , +0x01000000 ,0xbf890000 , +0xe0685000 ,0x701d0100 , +0x807d037d ,0x80700370 , +0xd5250000 ,0x0001ff00 , +0x00000080 ,0xbf0a7b7d , +0xbfa2fff4 ,0xbfa00011 , +0xbe8300ff ,0x00000100 , +0xbf800000 ,0xbf800000 , +0xbf800000 ,0xd8d80000 , +0x01000000 ,0xbf890000 , +0xe0685000 ,0x701d0100 , +0x807d037d ,0x80700370 , +0xd5250000 ,0x0001ff00 , +0x00000100 ,0xbf0a7b7d , +0xbfa2fff4 ,0xbefe00c1 , +0x857d9973 ,0x8b7d817d , +0xbf06817d ,0xbfa20004 , +0xbef000ff ,0x00000200 , +0xbeff0080 ,0xbfa00003 , +0xbef000ff ,0x00000400 , +0xbeff00c1 ,0xb8fb3b05 , +0x807b817b ,0x847b827b , +0x857d9973 ,0x8b7d817d , +0xbf06817d ,0xbfa20017 ,0xbef600ff ,0x01000000 ,0xbefd0084 ,0xbf0a7b7d , -0xbfa10011 ,0x7e008700 , +0xbfa10037 ,0x7e008700 ,0x7e028701 ,0x7e048702 ,0x7e068703 ,0xe0685000 , -0x701d0000 ,0xe0685100 , -0x701d0100 ,0xe0685200 , -0x701d0200 ,0xe0685300 , +0x701d0000 ,0xe0685080 , +0x701d0100 ,0xe0685100 , +0x701d0200 ,0xe0685180 ,0x701d0300 ,0x807d847d , -0x8070ff70 ,0x00000400 , +0x8070ff70 ,0x00000200 ,0xbf0a7b7d ,0xbfa2ffef , -0xb8fb1e06 ,0x8b7bc17b , -0xbfa1000c ,0x847b837b , -0x807b7d7b ,0xbefe00c1 , -0xbeff0080 ,0x7e008700 , +0xbfa00025 ,0xbef600ff , +0x01000000 ,0xbefd0084 , +0xbf0a7b7d ,0xbfa10011 , +0x7e008700 ,0x7e028701 , +0x7e048702 ,0x7e068703 ,0xe0685000 ,0x701d0000 , -0x807d817d ,0x8070ff70 , -0x00000080 ,0xbf0a7b7d , -0xbfa2fff8 ,0xbfa00146 , -0xbef4007e ,0x8b75ff7f , -0x0000ffff ,0x8c75ff75 , -0x00040000 ,0xbef60080 , -0xbef700ff ,0x10807fac , -0xb8f202dc ,0x84729972 , -0x8b6eff7f ,0x04000000 , -0xbfa1003a ,0xbefe00c1 , -0x857d9972 ,0x8b7d817d , -0xbf06817d ,0xbfa20002 , -0xbeff0080 ,0xbfa00001 , -0xbeff00c1 ,0xb8ef4306 , -0x8b6fc16f ,0xbfa1002f , -0x846f866f ,0x846f826f , -0xbef6006f ,0xb8f83b05 , -0x80788178 ,0xbf0d9972 , -0xbfa20002 ,0x84788978 , -0xbfa00001 ,0x84788a78 , -0xb8ee1e06 ,0x846e8a6e , -0x80786e78 ,0x8078ff78 , -0x00000200 ,0x8078ff78 , -0x00000080 ,0xbef600ff , -0x01000000 ,0x857d9972 , -0x8b7d817d ,0xbf06817d , -0xbefd0080 ,0xbfa2000c , -0xe0500000 ,0x781d0000 , -0xbf8903f7 ,0xdac00000 , -0x00000000 ,0x807dff7d , -0x00000080 ,0x8078ff78 , -0x00000080 ,0xbf0a6f7d , -0xbfa2fff5 ,0xbfa0000b , -0xe0500000 ,0x781d0000 , -0xbf8903f7 ,0xdac00000 , -0x00000000 ,0x807dff7d , -0x00000100 ,0x8078ff78 , -0x00000100 ,0xbf0a6f7d , -0xbfa2fff5 ,0xbef80080 , +0xe0685100 ,0x701d0100 , +0xe0685200 ,0x701d0200 , +0xe0685300 ,0x701d0300 , +0x807d847d ,0x8070ff70 , +0x00000400 ,0xbf0a7b7d , +0xbfa2ffef ,0xb8fb1e06 , +0x8b7bc17b ,0xbfa1000c , +0x847b837b ,0x807b7d7b , +0xbefe00c1 ,0xbeff0080 , +0x7e008700 ,0xe0685000 , +0x701d0000 ,0x807d817d , +0x8070ff70 ,0x00000080 , +0xbf0a7b7d ,0xbfa2fff8 , +0xbfa00146 ,0xbef4007e , +0x8b75ff7f ,0x0000ffff , +0x8c75ff75 ,0x00040000 , +0xbef60080 ,0xbef700ff , +0x10807fac ,0xb8f202dc , +0x84729972 ,0x8b6eff7f , +0x04000000 ,0xbfa1003a ,0xbefe00c1 ,0x857d9972 ,0x8b7d817d ,0xbf06817d ,0xbfa20002 ,0xbeff0080 ,0xbfa00001 ,0xbeff00c1 , -0xb8ef3b05 ,0x806f816f , -0x846f826f ,0x857d9972 , -0x8b7d817d ,0xbf06817d , -0xbfa20024 ,0xbef600ff , -0x01000000 ,0xbeee0078 , +0xb8ef4306 ,0x8b6fc16f , +0xbfa1002f ,0x846f866f , +0x846f826f ,0xbef6006f , +0xb8f83b05 ,0x80788178 , +0xbf0d9972 ,0xbfa20002 , +0x84788978 ,0xbfa00001 , +0x84788a78 ,0xb8ee1e06 , +0x846e8a6e ,0x80786e78 ,0x8078ff78 ,0x00000200 , -0xbefd0084 ,0xbf0a6f7d , -0xbfa10050 ,0xe0505000 , -0x781d0000 ,0xe0505080 , -0x781d0100 ,0xe0505100 , -0x781d0200 ,0xe0505180 , -0x781d0300 ,0xbf8903f7 , -0x7e008500 ,0x7e028501 , -0x7e048502 ,0x7e068503 , -0x807d847d ,0x8078ff78 , -0x00000200 ,0xbf0a6f7d , -0xbfa2ffee ,0xe0505000 , -0x6e1d0000 ,0xe0505080 , -0x6e1d0100 ,0xe0505100 , -0x6e1d0200 ,0xe0505180 , -0x6e1d0300 ,0xbf8903f7 , -0xbfa00034 ,0xbef600ff , -0x01000000 ,0xbeee0078 , -0x8078ff78 ,0x00000400 , -0xbefd0084 ,0xbf0a6f7d , -0xbfa10012 ,0xe0505000 , -0x781d0000 ,0xe0505100 , -0x781d0100 ,0xe0505200 , -0x781d0200 ,0xe0505300 , -0x781d0300 ,0xbf8903f7 , -0x7e008500 ,0x7e028501 , -0x7e048502 ,0x7e068503 , -0x807d847d ,0x8078ff78 , -0x00000400 ,0xbf0a6f7d , -0xbfa2ffee ,0xb8ef1e06 , -0x8b6fc16f ,0xbfa1000e , -0x846f836f ,0x806f7d6f , -0xbefe00c1 ,0xbeff0080 , +0x8078ff78 ,0x00000080 , +0xbef600ff ,0x01000000 , +0x857d9972 ,0x8b7d817d , +0xbf06817d ,0xbefd0080 , +0xbfa2000c ,0xe0500000 , +0x781d0000 ,0xbf8903f7 , +0xdac00000 ,0x00000000 , +0x807dff7d ,0x00000080 , +0x8078ff78 ,0x00000080 , +0xbf0a6f7d ,0xbfa2fff5 , +0xbfa0000b ,0xe0500000 , +0x781d0000 ,0xbf8903f7 , +0xdac00000 ,0x00000000 , +0x807dff7d ,0x00000100 , +0x8078ff78 ,0x00000100 , +0xbf0a6f7d ,0xbfa2fff5 , +0xbef80080 ,0xbefe00c1 , +0x857d9972 ,0x8b7d817d , +0xbf06817d ,0xbfa20002 , +0xbeff0080 ,0xbfa00001 , +0xbeff00c1 ,0xb8ef3b05 , +0x806f816f ,0x846f826f , +0x857d9972 ,0x8b7d817d , +0xbf06817d ,0xbfa20024 , +0xbef600ff ,0x01000000 , +0xbeee0078 ,0x8078ff78 , +0x00000200 ,0xbefd0084 , +0xbf0a6f7d ,0xbfa10050 ,0xe0505000 ,0x781d0000 , +0xe0505080 ,0x781d0100 , +0xe0505100 ,0x781d0200 , +0xe0505180 ,0x781d0300 ,0xbf8903f7 ,0x7e008500 , -0x807d817d ,0x8078ff78 , -0x00000080 ,0xbf0a6f7d , -0xbfa2fff7 ,0xbeff00c1 , +0x7e028501 ,0x7e048502 , +0x7e068503 ,0x807d847d , +0x8078ff78 ,0x00000200 , +0xbf0a6f7d ,0xbfa2ffee ,0xe0505000 ,0x6e1d0000 , -0xe0505100 ,0x6e1d0100 , -0xe0505200 ,0x6e1d0200 , -0xe0505300 ,0x6e1d0300 , -0xbf8903f7 ,0xb8f83b05 , -0x80788178 ,0xbf0d9972 , -0xbfa20002 ,0x84788978 , -0xbfa00001 ,0x84788a78 , -0xb8ee1e06 ,0x846e8a6e , -0x80786e78 ,0x8078ff78 , -0x00000200 ,0x80f8ff78 , -0x00000050 ,0xbef600ff , -0x01000000 ,0xbefd00ff , -0x0000006c ,0x80f89078 , -0xf428403a ,0xf0000000 , -0xbf89fc07 ,0x80fd847d , -0xbf800000 ,0xbe804300 , -0xbe824302 ,0x80f8a078 , -0xf42c403a ,0xf0000000 , -0xbf89fc07 ,0x80fd887d , -0xbf800000 ,0xbe804300 , -0xbe824302 ,0xbe844304 , -0xbe864306 ,0x80f8c078 , -0xf430403a ,0xf0000000 , -0xbf89fc07 ,0x80fd907d , -0xbf800000 ,0xbe804300 , -0xbe824302 ,0xbe844304 , -0xbe864306 ,0xbe884308 , -0xbe8a430a ,0xbe8c430c , -0xbe8e430e ,0xbf06807d , -0xbfa1fff0 ,0xb980f801 , -0x00000000 ,0xbfbd0000 , +0xe0505080 ,0x6e1d0100 , +0xe0505100 ,0x6e1d0200 , +0xe0505180 ,0x6e1d0300 , +0xbf8903f7 ,0xbfa00034 , +0xbef600ff ,0x01000000 , +0xbeee0078 ,0x8078ff78 , +0x00000400 ,0xbefd0084 , +0xbf0a6f7d ,0xbfa10012 , +0xe0505000 ,0x781d0000 , +0xe0505100 ,0x781d0100 , +0xe0505200 ,0x781d0200 , +0xe0505300 ,0x781d0300 , +0xbf8903f7 ,0x7e008500 , +0x7e028501 ,0x7e048502 , +0x7e068503 ,0x807d847d , +0x8078ff78 ,0x00000400 , +0xbf0a6f7d ,0xbfa2ffee , +0xb8ef1e06 ,0x8b6fc16f , +0xbfa1000e ,0x846f836f , +0x806f7d6f ,0xbefe00c1 , +0xbeff0080 ,0xe0505000 , +0x781d0000 ,0xbf8903f7 , +0x7e008500 ,0x807d817d , +0x8078ff78 ,0x00000080 , +0xbf0a6f7d ,0xbfa2fff7 , +0xbeff00c1 ,0xe0505000 , +0x6e1d0000 ,0xe0505100 , +0x6e1d0100 ,0xe0505200 , +0x6e1d0200 ,0xe0505300 , +0x6e1d0300 ,0xbf8903f7 ,0xb8f83b05 ,0x80788178 ,0xbf0d9972 ,0xbfa20002 ,0x84788978 ,0xbfa00001 ,0x84788a78 ,0xb8ee1e06 ,0x846e8a6e ,0x80786e78 ,0x8078ff78 ,0x00000200 , +0x80f8ff78 ,0x00000050 ,0xbef600ff ,0x01000000 , -0xf4205bfa ,0xf0000000 , -0x80788478 ,0xf4205b3a , +0xbefd00ff ,0x0000006c , +0x80f89078 ,0xf428403a , +0xf0000000 ,0xbf89fc07 , +0x80fd847d ,0xbf800000 , +0xbe804300 ,0xbe824302 , +0x80f8a078 ,0xf42c403a , +0xf0000000 ,0xbf89fc07 , +0x80fd887d ,0xbf800000 , +0xbe804300 ,0xbe824302 , +0xbe844304 ,0xbe864306 , +0x80f8c078 ,0xf430403a , +0xf0000000 ,0xbf89fc07 , +0x80fd907d ,0xbf800000 , +0xbe804300 ,0xbe824302 , +0xbe844304 ,0xbe864306 , +0xbe884308 ,0xbe8a430a , +0xbe8c430c ,0xbe8e430e , +0xbf06807d ,0xbfa1fff0 , +0xb980f801 ,0x00000000 , +0xbfbd0000 ,0xb8f83b05 , +0x80788178 ,0xbf0d9972 , +0xbfa20002 ,0x84788978 , +0xbfa00001 ,0x84788a78 , +0xb8ee1e06 ,0x846e8a6e , +0x80786e78 ,0x8078ff78 , +0x00000200 ,0xbef600ff , +0x01000000 ,0xf4205bfa ,0xf0000000 ,0x80788478 , -0xf4205b7a ,0xf0000000 , -0x80788478 ,0xf4205c3a , +0xf4205b3a ,0xf0000000 , +0x80788478 ,0xf4205b7a ,0xf0000000 ,0x80788478 , -0xf4205c7a ,0xf0000000 , -0x80788478 ,0xf4205eba , +0xf4205c3a ,0xf0000000 , +0x80788478 ,0xf4205c7a ,0xf0000000 ,0x80788478 , -0xf4205efa ,0xf0000000 , -0x80788478 ,0xf4205e7a , +0xf4205eba ,0xf0000000 , +0x80788478 ,0xf4205efa ,0xf0000000 ,0x80788478 , -0xf4205cfa ,0xf0000000 , -0x80788478 ,0xf4205bba , +0xf4205e7a ,0xf0000000 , +0x80788478 ,0xf4205cfa ,0xf0000000 ,0x80788478 , -0xbf89fc07 ,0xb96ef814 ,0xf4205bba ,0xf0000000 ,0x80788478 ,0xbf89fc07 , -0xb96ef815 ,0xbefd006f , -0xbefe0070 ,0xbeff0071 , -0x8b6f7bff ,0x000003ff , -0xb96f4803 ,0x8b6f7bff , -0xfffff800 ,0x856f8b6f , -0xb96fa2c3 ,0xb973f801 , -0xb8ee3b05 ,0x806e816e , -0xbf0d9972 ,0xbfa20002 , -0x846e896e ,0xbfa00001 , -0x846e8a6e ,0xb8ef1e06 , -0x846f8a6f ,0x806e6f6e , -0x806eff6e ,0x00000200 , -0x806e746e ,0x826f8075 , -0x8b6fff6f ,0x0000ffff , -0xf4085c37 ,0xf8000050 , -0xf4085d37 ,0xf8000060 , -0xf4005e77 ,0xf8000074 , -0xbf89fc07 ,0x8b6dff6d , -0x0000ffff ,0x8bfe7e7e , -0x8bea6a6a ,0xb8eef802 , -0xbf0d866e ,0xbfa20002 , -0xb97af802 ,0xbe80486c , -0xb97af802 ,0xbe804a6c , -0xbfb00000 ,0xbf9f0000 , +0xb96ef814 ,0xf4205bba , +0xf0000000 ,0x80788478 , +0xbf89fc07 ,0xb96ef815 , +0xbefd006f ,0xbefe0070 , +0xbeff0071 ,0x8b6f7bff , +0x000003ff ,0xb96f4803 , +0x8b6f7bff ,0xfffff800 , +0x856f8b6f ,0xb96fa2c3 , +0xb973f801 ,0xb8ee3b05 , +0x806e816e ,0xbf0d9972 , +0xbfa20002 ,0x846e896e , +0xbfa00001 ,0x846e8a6e , +0xb8ef1e06 ,0x846f8a6f , +0x806e6f6e ,0x806eff6e , +0x00000200 ,0x806e746e , +0x826f8075 ,0x8b6fff6f , +0x0000ffff ,0xf4085c37 , +0xf8000050 ,0xf4085d37 , +0xf8000060 ,0xf4005e77 , +0xf8000074 ,0xbf89fc07 , +0x8b6dff6d ,0x0000ffff , +0x8bfe7e7e ,0x8bea6a6a , +0xb8eef802 ,0xbf0d866e , +0xbfa20002 ,0xb97af802 , +0xbe80486c ,0xb97af802 , +0xbe804a6c ,0xbfb00000 ,0xbf9f0000 ,0xbf9f0000 ,0xbf9f0000 ,0xbf9f0000 , +0xbf9f0000 ,0x00000000 , };
drivers/gpu/drm/amd/amdkfd/cwsr_trap_handler_gfx10.asm +6 -0
@@ -186,6 +186,12 @@ L_SKIP_RESTORE: s_getreg_b32 s_save_trapsts, hwreg(HW_REG_TRAPSTS) #if SW_SA_TRAP + // If ttmp1[30] is set then issue s_barrier to unblock dependent waves. + s_bitcmp1_b32 s_save_pc_hi, 30 + s_cbranch_scc0 L_TRAP_NO_BARRIER + s_barrier + +L_TRAP_NO_BARRIER: // If ttmp1[31] is set then trap may occur early. // Spin wait until SAVECTX exception is raised. s_bitcmp1_b32 s_save_pc_hi, 31
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 188/289 drm/amd/display: Added debug option for forcing subvp num ways
In reply to Greg Kroah-HartmanFrom: Lee, Alvin <[email protected]>
[ Upstream commit 5c1a431aaf52bbba8b6e2c4e9b4037a09509c0e3 ]
[Description]
Regkey option for forcing num ways for subvp for debug purposes
Stable-dep-of: 4d2852412306 ("drm/amd/display: Fix calculation for cursor CAB allocation")
--- drivers/gpu/drm/amd/display/dc/dc.h | 1 + .../drm/amd/display/dc/dcn32/dcn32_resource_helpers.c | 11 ++++++++--- 2 files changed, 9 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/display/dc/dc.h +1 -0
@@ -746,6 +746,7 @@ struct dc_debug_options {bool force_disable_subvp;bool force_subvp_mclk_switch;bool allow_sw_cursor_fallback; +unsigned int force_subvp_num_ways;bool force_usr_allow;/* uses value at boot and disables switch */ bool disable_dtb_ref_clk_switch;
drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource_helpers.c +8 -3
@@ -54,13 +54,14 @@ uint32_t dcn32_helper_calculate_num_ways_for_subvp(struct dc *dc, struct dc_statuint32_t num_mblks =0 ;uint32_t cache_lines_per_plane =0 ;uint32_t i =0 , j =0 ; -uint32_t mblk_width =0 ; -uint32_t mblk_height =0 ; +uint16_t mblk_width =0 ; +uint16_t mblk_height =0 ;uint32_t full_vp_width_blk_aligned =0 ;uint32_t full_vp_height_blk_aligned =0 ;uint32_t mall_alloc_width_blk_aligned =0 ;uint32_t mall_alloc_height_blk_aligned =0 ; -uint32_t full_vp_height =0 ; +uint16_t full_vp_height =0 ; +bool subvp_in_use = false;for (i =0 ; i < dc->res_pool->pipe_count; i++) {struct pipe_ctx *pipe = &context->res_ctx.pipe_ctx[i];
@@ -70,6 +71,7 @@ uint32_t dcn32_helper_calculate_num_ways_for_subvp(struct dc *dc, struct dc_stat pipe->stream->mall_stream_config.type == SUBVP_PHANTOM) {struct pipe_ctx *main_pipe =NULL ; + subvp_in_use = true;/* Get full viewport height from main pipe (required for MBLK calculation) */ for (j =0 ; j < dc->res_pool->pipe_count; j++) { main_pipe = &context->res_ctx.pipe_ctx[j];
@@ -129,6 +131,9 @@ uint32_t dcn32_helper_calculate_num_ways_for_subvp(struct dc *dc, struct dc_statif (cache_lines_used % lines_per_way >0 ) num_ways++; +if (subvp_in_use && dc->debug.force_subvp_num_ways >0 ) + num_ways = dc->debug.force_subvp_num_ways; +return num_ways; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 189/289 drm/amd/display: Add debug option for allocating extra way for cursor
In reply to Greg Kroah-HartmanFrom: Alvin Lee <[email protected]>
[ Upstream commit 6eef37460584269b240f45aa47ebb61aae848082 ]
[Why and How]
- Add a debug option for allocating extra way for cursor
- Remove usage of cache_cursor_addr since it's not gaurenteed to be populated
- Include cursor size in MALL calculation if it exceeds the DCN cursor buffer size (and don't need extra way for cursor)
Stable-dep-of: 4d2852412306 ("drm/amd/display: Fix calculation for cursor CAB allocation")
--- drivers/gpu/drm/amd/display/dc/dc.h | 1 + drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c | 10 ++++++---- drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c | 1 + .../gpu/drm/amd/display/dc/dcn321/dcn321_resource.c | 1 + 4 files changed, 9 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/display/dc/dc.h +1 -0
@@ -747,6 +747,7 @@ struct dc_debug_options {bool force_subvp_mclk_switch;bool allow_sw_cursor_fallback;unsigned int force_subvp_num_ways; +bool alloc_extra_way_for_cursor;bool force_usr_allow;/* uses value at boot and disables switch */ bool disable_dtb_ref_clk_switch;
drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c +6 -4
@@ -304,7 +304,8 @@ static uint32_t dcn32_calculate_cab_allocation(struct dc *dc, struct dc_state *c* using the max for calculation */ if (hubp->curs_attr.width >0 ) { - cursor_size = hubp->curs_attr.width * hubp->curs_attr.height; +// Round cursor width to next multiple of 64 + cursor_size = (((hubp->curs_attr.width +63 ) /64 ) *64 ) * hubp->curs_attr.height;break ; } }
@@ -325,7 +326,8 @@ static uint32_t dcn32_calculate_cab_allocation(struct dc *dc, struct dc_state *cbreak ; } -if (stream->cursor_position.enable && plane->address.grph.cursor_cache_addr.quad_part) { +if (stream->cursor_position.enable && !dc->debug.alloc_extra_way_for_cursor && + cursor_size >16384 ) { cache_lines_used +=dcn32_cache_lines_for_surface (dc, cursor_size, plane->address.grph.cursor_cache_addr.quad_part); }
@@ -345,8 +347,8 @@ static uint32_t dcn32_calculate_cab_allocation(struct dc *dc, struct dc_state *c plane = ctx->stream_status[i].plane_states[j];if (stream->cursor_position.enable && plane && - !plane->address.grph.cursor_cache_addr.quad_part && - cursor_size >16384 ) { + dc->debug.alloc_extra_way_for_cursor && + cursor_size >16384 ) {/* Cursor caching is not supported since it won't be on the same line. * So we need an extra line to accommodate it. With large cursors and a single 4k monitor * this case triggers corruption. If we're at the edge, then dont trigger display refresh
drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c +1 -0
@@ -872,6 +872,7 @@ static const struct dc_debug_options debug_defaults_drv = { .enable_single_display_2to1_odm_policy = true, .enable_dp_dig_pixel_rate_div_policy = 1, .allow_sw_cursor_fallback = false, + .alloc_extra_way_for_cursor = true, };static const struct dc_debug_options debug_defaults_diags = {
drivers/gpu/drm/amd/display/dc/dcn321/dcn321_resource.c +1 -0
@@ -873,6 +873,7 @@ static const struct dc_debug_options debug_defaults_drv = { .enable_single_display_2to1_odm_policy = true, .enable_dp_dig_pixel_rate_div_policy = 1, .allow_sw_cursor_fallback = false, + .alloc_extra_way_for_cursor = true, };static const struct dc_debug_options debug_defaults_diags = {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 190/289 drm/amd/display: Update MALL SS NumWays calculation
In reply to Greg Kroah-HartmanFrom: Alvin Lee <[email protected]>
[ Upstream commit 525a65c77db51cf5d6c6d8e3f8d07efeb2270416 ]
[Description]
Update MALL SS NumWays calculation according
to programming guide.
Stable-dep-of: 4d2852412306 ("drm/amd/display: Fix calculation for cursor CAB allocation")
--- drivers/gpu/drm/amd/display/dc/dc.h | 1 + .../drm/amd/display/dc/dcn32/dcn32_hwseq.c | 207 ++++++++---------- 2 files changed, 98 insertions(+), 110 deletions(-)
drivers/gpu/drm/amd/display/dc/dc.h +1 -0
@@ -747,6 +747,7 @@ struct dc_debug_options {bool force_subvp_mclk_switch;bool allow_sw_cursor_fallback;unsigned int force_subvp_num_ways; +unsigned int force_mall_ss_num_ways;bool alloc_extra_way_for_cursor;bool force_usr_allow;/* uses value at boot and disables switch */
drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c +97 -110
248 lines not on this page · raw message
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 191/289 drm/amd/display: Fix calculation for cursor CAB allocation
In reply to Greg Kroah-HartmanFrom: George Shen <[email protected]>
[ Upstream commit 4d285241230676ba8b888701b89684b4e0360fcc ]
[Why]
The cursor size (in memory) is currently incorrectly calculated, resulting not enough CAB being allocated for static screen cursor in MALL refresh. This results in cursor image corruption.
[How]
Use cursor pitch instead of cursor width when calculating cursor size. Update num cache lines calculation to use the result of the cursor size calculation instead of manually recalculating again.
--- drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-)
drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c +5 -9
@@ -284,8 +284,7 @@ static uint32_t dcn32_calculate_cab_allocation(struct dc *dc, struct dc_state *cusing the max for calculation */ if (hubp->curs_attr.width >0 ) { -// Round cursor width to next multiple of 64 - cursor_size = (((hubp->curs_attr.width +63 ) /64 ) *64 ) * hubp->curs_attr.height; + cursor_size = hubp->curs_attr.pitch * hubp->curs_attr.height;switch (pipe->stream->cursor_attributes.color_format) {case CURSOR_MODE_MONO :
@@ -310,9 +309,9 @@ static uint32_t dcn32_calculate_cab_allocation(struct dc *dc, struct dc_state *c cursor_size > 16384) {/* cursor_num_mblk = CEILING(num_cursors*cursor_width*cursor_width*cursor_Bpe/mblk_bytes, 1) */ - cache_lines_used += (((hubp->curs_attr.width * hubp->curs_attr.height * cursor_bpp + -DCN3_2_MALL_MBLK_SIZE_BYTES -1 ) /DCN3_2_MALL_MBLK_SIZE_BYTES ) * -DCN3_2_MALL_MBLK_SIZE_BYTES ) / dc->caps.cache_line_size +2 ; + cache_lines_used += (((cursor_size +DCN3_2_MALL_MBLK_SIZE_BYTES -1 ) / +DCN3_2_MALL_MBLK_SIZE_BYTES ) *DCN3_2_MALL_MBLK_SIZE_BYTES ) / + dc->caps.cache_line_size +2 ; }break ; }
@@ -730,10 +729,7 @@ void dcn32_update_mall_sel(struct dc *dc, struct dc_state *context)struct hubp *hubp = pipe->plane_res.hubp;if (pipe->stream && pipe->plane_state && hubp && hubp->funcs->hubp_update_mall_sel) { -//Round cursor width up to next multiple of 64 -int cursor_width = ((hubp->curs_attr.width +63 ) /64 ) *64 ; -int cursor_height = hubp->curs_attr.height; -int cursor_size = cursor_width * cursor_height; +int cursor_size = hubp->curs_attr.pitch * hubp->curs_attr.height;switch (hubp->curs_attr.color_format) {case CURSOR_MODE_MONO :
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 192/289 usb: dwc3: gadget: conditionally remove requests
In reply to Greg Kroah-HartmanFrom: Michael Grzeschik <[email protected]>
[ Upstream commit b44c0e7fef51ee7e8ca8c6efbf706f5613787100 ]
The functions stop_active_transfers and ep_disable are both calling remove_requests. This functions in both cases will giveback the requests with status ESHUTDOWN, which also represents an physical disconnection. For ep_disable this is not true. This patch adds the status parameter to remove_requests and sets the status to ECONNRESET on ep_disable.
Stable-dep-of: f90f5afd5083 ("usb: dwc3: gadget: Clear ep descriptor last")
--- drivers/usb/dwc3/gadget.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/usb/dwc3/gadget.c +6 -6
@@ -965,7 +965,7 @@ static int __dwc3_gadget_ep_enable(struct dwc3_ep *dep, unsigned int action)return 0 ; } -static void dwc3_remove_requests (struct dwc3 *dwc,struct dwc3_ep *dep) +static void dwc3_remove_requests (struct dwc3 *dwc,struct dwc3_ep *dep,int status) {struct dwc3_request *req;
@@ -975,19 +975,19 @@ static void dwc3_remove_requests(struct dwc3 *dwc, struct dwc3_ep *dep)while (!list_empty (&dep->started_list)) { req =next_request (&dep->started_list); -dwc3_gadget_giveback (dep, req, -ESHUTDOWN ); +dwc3_gadget_giveback (dep, req, status); }while (!list_empty (&dep->pending_list)) { req =next_request (&dep->pending_list); -dwc3_gadget_giveback (dep, req, -ESHUTDOWN ); +dwc3_gadget_giveback (dep, req, status); }while (!list_empty (&dep->cancelled_list)) { req =next_request (&dep->cancelled_list); -dwc3_gadget_giveback (dep, req, -ESHUTDOWN ); +dwc3_gadget_giveback (dep, req, status); } }
@@ -1022,7 +1022,7 @@ static int __dwc3_gadget_ep_disable(struct dwc3_ep *dep) dep->endpoint.desc =NULL ; } -dwc3_remove_requests (dwc, dep); +dwc3_remove_requests (dwc, dep, -ECONNRESET ); dep->stream_capable = false; dep->type =0 ;
@@ -2350,7 +2350,7 @@ static void dwc3_stop_active_transfers(struct dwc3 *dwc)if (!dep)continue ; -dwc3_remove_requests (dwc, dep); +dwc3_remove_requests (dwc, dep, -ESHUTDOWN ); } }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 193/289 usb: dwc3: gadget: Return -ESHUTDOWN on ep disable
In reply to Greg Kroah-HartmanFrom: Thinh Nguyen <[email protected]>
[ Upstream commit ffb9da4a04c69567bad717707b6fdfbc4c216ef4 ]
The usb_request API clearly noted that removed requests due to disabled endpoint should have -ESHUTDOWN status returned. Don't change this behavior.
Stable-dep-of: f90f5afd5083 ("usb: dwc3: gadget: Clear ep descriptor last")
--- drivers/usb/dwc3/gadget.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/dwc3/gadget.c +1 -1
@@ -1022,7 +1022,7 @@ static int __dwc3_gadget_ep_disable(struct dwc3_ep *dep) dep->endpoint.desc =NULL ; } -dwc3_remove_requests (dwc, dep, -ECONNRESET ); +dwc3_remove_requests (dwc, dep, -ESHUTDOWN ); dep->stream_capable = false; dep->type =0 ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 194/289 usb: dwc3: gadget: Clear ep descriptor last
In reply to Greg Kroah-HartmanFrom: Thinh Nguyen <[email protected]>
[ Upstream commit f90f5afd5083a7cb4aee13bd4cc0ae600bd381ca ]
Until the endpoint is disabled, its descriptors should remain valid. When its requests are removed from ep disable, the request completion routine may attempt to access the endpoint's descriptor. Don't clear the descriptors before that.
--- drivers/usb/dwc3/gadget.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/usb/dwc3/gadget.c +6 -6
@@ -1016,18 +1016,18 @@ static int __dwc3_gadget_ep_disable(struct dwc3_ep *dep) reg &= ~DWC3_DALEPENA_EP (dep->number);dwc3_writel (dwc->regs,DWC3_DALEPENA , reg); -/* Clear out the ep descriptors for non-ep0 */ -if (dep->number >1 ) { - dep->endpoint.comp_desc =NULL ; - dep->endpoint.desc =NULL ; - } -dwc3_remove_requests (dwc, dep, -ESHUTDOWN ); dep->stream_capable = false; dep->type =0 ; dep->flags &=DWC3_EP_TXFIFO_RESIZED ; +/* Clear out the ep descriptors for non-ep0 */ +if (dep->number >1 ) { + dep->endpoint.comp_desc =NULL ; + dep->endpoint.desc =NULL ; + } +return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 195/289 io_uring: cmpxchg for poll arm refs release
In reply to Greg Kroah-HartmanFrom: Pavel Begunkov <[email protected]>
commit 2f3893437a4ebf2e892ca172e9e122841319d675 upstream.
Replace atomically substracting the ownership reference at the end of arming a poll with a cmpxchg. We try to release ownership by setting 0 assuming that poll_refs didn't change while we were arming. If it did change, we keep the ownership and use it to queue a tw, which is fully capable to process all events and (even tolerates spurious wake ups).
It's a bit more elegant as we reduce races b/w setting the cancellation flag and getting refs with this release, and with that we don't have to worry about any kinds of underflows. It's not the fastest path for polling. The performance difference b/w cmpxchg and atomic dec is usually negligible and it's not the fastest path.
--- io_uring/poll.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
io_uring/poll.c +3 -5
@@ -519,7 +519,6 @@ static int __io_arm_poll_handler(struct unsigned issue_flags) {struct io_ring_ctx *ctx = req->ctx; -int v;INIT_HLIST_NODE (&req->hash_node); req->work.cancel_seq =atomic_read (&ctx->cancel_seq);
@@ -587,11 +586,10 @@ static int __io_arm_poll_handler(structif (ipt->owning) {/* -* Release ownership. If someone tried to queue a tw while it was -* locked, kick it off for them. +* Try to release ownership. If we see a change of state, e.g. +* poll was waken up, queue up a tw, it'll deal with it. */ - v =atomic_dec_return (&req->poll_refs); -if (unlikely (v &IO_POLL_REF_MASK )) +if (atomic_cmpxchg (&req->poll_refs,1 ,0 ) !=1 )__io_poll_execute (req,0 ); }return 0 ;
Greg Kroah-Hartman
maintainerPATCH 196/289 io_uring: make poll refs more robust
In reply to Greg Kroah-HartmanFrom: Pavel Begunkov <[email protected]>
commit a26a35e9019fd70bf3cf647dcfdae87abc7bacea upstream.
poll_refs carry two functions, the first is ownership over the request. The second is notifying the io_poll_check_events() that there was an event but wake up couldn't grab the ownership, so io_poll_check_events() should retry.
We want to make poll_refs more robust against overflows. Instead of always incrementing it, which covers two purposes with one atomic, check if poll_refs is elevated enough and if so set a retry flag without attempts to grab ownership. The gap between the bias check and following atomics may seem racy, but we don't need it to be strict. Moreover there might only be maximum 4 parallel updates: by the first and the second poll entries, __io_arm_poll_handler() and cancellation. From those four, only poll wake ups may be executed multiple times, but they're protected by a spin.
--- io_uring/poll.c | 36 +++++++++++++++++++++++++++++++++++- 1 file changed, 35 insertions(+), 1 deletion(-)
io_uring/poll.c +35 -1
@@ -40,7 +40,14 @@ struct io_poll_table { };#define IO_POLL_CANCEL_FLAG BIT(31) -#define IO_POLL_REF_MASK GENMASK(30, 0) +#define IO_POLL_RETRY_FLAG BIT(30) +#define IO_POLL_REF_MASK GENMASK(29, 0) + +/* +* We usually have 1-2 refs taken, 128 is more than enough and we want to +* maximise the margin between this amount and the moment when it overflows. +*/ +#define IO_POLL_REF_BIAS 128#define IO_WQE_F_DOUBLE 1
@@ -58,6 +65,21 @@ static inline bool wqe_is_double(structreturn priv &IO_WQE_F_DOUBLE ; } +static bool io_poll_get_ownership_slowpath (struct io_kiocb *req) +{ +int v; + +/* +* poll_refs are already elevated and we don't have much hope for +* grabbing the ownership. Instead of incrementing set a retry flag +* to notify the loop that there might have been some change. +*/ + v =atomic_fetch_or (IO_POLL_RETRY_FLAG , &req->poll_refs); +if (v &IO_POLL_REF_MASK ) +return false; +return !(atomic_fetch_inc (&req->poll_refs) &IO_POLL_REF_MASK ); +} +/* * If refs part of ->poll_refs (see IO_POLL_REF_MASK) is 0, it's free. We can * bump it and acquire ownership. It's disallowed to modify requests while not
@@ -66,6 +88,8 @@ static inline bool wqe_is_double(struct*/ static inline bool io_poll_get_ownership (struct io_kiocb *req) { +if (unlikely (atomic_read (&req->poll_refs) >=IO_POLL_REF_BIAS )) +return io_poll_get_ownership_slowpath (req);return !(atomic_fetch_inc (&req->poll_refs) &IO_POLL_REF_MASK ); }
@@ -235,6 +259,16 @@ static int io_poll_check_events(struct i*/ if ((v &IO_POLL_REF_MASK ) !=1 ) req->cqe.res =0 ; +if (v &IO_POLL_RETRY_FLAG ) { + req->cqe.res =0 ; +/* +* We won't find new events that came in between +* vfs_poll and the ref put unless we clear the flag +* in advance. +*/ +atomic_andnot (IO_POLL_RETRY_FLAG , &req->poll_refs); + v &= ~IO_POLL_RETRY_FLAG ; + }/* the mask was stashed in __io_poll_execute */ if (!req->cqe.res) {
Greg Kroah-Hartman
maintainerPATCH 197/289 io_uring: clear TIF_NOTIFY_SIGNAL if set and task_work not available
In reply to Greg Kroah-HartmanFrom: Jens Axboe <[email protected]>
commit 7cfe7a09489c1cefee7181e07b5f2bcbaebd9f41 upstream.
With how task_work is added and signaled, we can have TIF_NOTIFY_SIGNAL set and no task_work pending as it got run in a previous loop. Treat TIF_NOTIFY_SIGNAL like get_signal(), always clear it if set regardless of whether or not task_work is pending to run.
--- io_uring/io_uring.h | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
io_uring/io_uring.h +7 -2
@@ -229,9 +229,14 @@ static inline unsigned int io_sqring_entstatic inline bool io_run_task_work (void ) { +/* +* Always check-and-clear the task_work notification signal. With how +* signaling works for task_work, we can find it set with nothing to +* run. We need to clear it for that case, like get_signal() does. +*/ +if (test_thread_flag (TIF_NOTIFY_SIGNAL )) +clear_notify_signal ();if (task_work_pending (current)) { -if (test_thread_flag (TIF_NOTIFY_SIGNAL )) -clear_notify_signal ();__set_current_state (TASK_RUNNING );task_work_run ();return 1 ;
Greg Kroah-Hartman
maintainerPATCH 198/289 nilfs2: fix nilfs_sufile_mark_dirty() not set segment usage as dirty
In reply to Greg Kroah-HartmanFrom: Chen Zhongjin <[email protected]>
commit 512c5ca01a3610ab14ff6309db363de51f1c13a6 upstream.
When extending segments, nilfs_sufile_alloc() is called to get an unassigned segment, then mark it as dirty to avoid accidentally allocating the same segment in the future.
But for some special cases such as a corrupted image it can be unreliable. If such corruption of the dirty state of the segment occurs, nilfs2 may reallocate a segment that is in use and pick the same segment for writing twice at the same time.
This will cause the problem reported by syzkaller:
https://syzkaller.appspot.com/bug?id=c7c4748e11ffcc367cef04f76e02e931833cbd24
This case started with segbuf1.segnum = 3, nextnum = 4 when constructed. It supposed segment 4 has already been allocated and marked as dirty.
However the dirty state was corrupted and segment 4 usage was not dirty. For the first time nilfs_segctor_extend_segments() segment 4 was allocated again, which made segbuf2 and next segbuf3 had same segment 4.
sb_getblk() will get same bh for segbuf2 and segbuf3, and this bh is added to both buffer lists of two segbuf. It makes the lists broken which causes NULL pointer dereference.
Fix the problem by setting usage as dirty every time in nilfs_sufile_mark_dirty(), which is called during constructing current segment to be written out and before allocating next segment.
--- fs/nilfs2/sufile.c | 8 ++++++++ 1 file changed, 8 insertions(+)
fs/nilfs2/sufile.c +8 -0
@@ -495,14 +495,22 @@ void nilfs_sufile_do_free(struct inode *int nilfs_sufile_mark_dirty (struct inode *sufile,__u64 segnum) {struct buffer_head *bh; +void *kaddr; +struct nilfs_segment_usage *su;int ret; +down_write (&NILFS_MDT (sufile)->mi_sem); ret =nilfs_sufile_get_segment_usage_block (sufile, segnum,0 , &bh);if (!ret) {mark_buffer_dirty (bh);nilfs_mdt_mark_dirty (sufile); + kaddr =kmap_atomic (bh->b_page); + su =nilfs_sufile_block_get_segment_usage (sufile, segnum, bh, kaddr); +nilfs_segment_usage_set_dirty (su); +kunmap_atomic (kaddr);brelse (bh); } +up_write (&NILFS_MDT (sufile)->mi_sem);return ret; }
Greg Kroah-Hartman
maintainerPATCH 199/289 gcov: clang: fix the buffer overflow issue
In reply to Greg Kroah-HartmanFrom: Mukesh Ojha <[email protected]>
commit a6f810efabfd789d3bbafeacb4502958ec56c5ce upstream.
Currently, in clang version of gcov code when module is getting removed gcov_info_add() incorrectly adds the sfn_ptr->counter to all the dst->functions and it result in the kernel panic in below crash report. Fix this by properly handling it.
[ 8.899094][ T599] Unable to handle kernel write to read-only memory at virtual address ffffff80461cc000 [ 8.899100][ T599] Mem abort info: [ 8.899102][ T599] ESR = 0x9600004f [ 8.899103][ T599] EC = 0x25: DABT (current EL), IL = 32 bits [ 8.899105][ T599] SET = 0, FnV = 0 [ 8.899107][ T599] EA = 0, S1PTW = 0 [ 8.899108][ T599] FSC = 0x0f: level 3 permission fault [ 8.899110][ T599] Data abort info: [ 8.899111][ T599] ISV = 0, ISS = 0x0000004f [ 8.899113][ T599] CM = 0, WnR = 1 [ 8.899114][ T599] swapper pgtable: 4k pages, 39-bit VAs, pgdp=00000000ab8de000 [ 8.899116][ T599] [ffffff80461cc000] pgd=18000009ffcde003, p4d=18000009ffcde003, pud=18000009ffcde003, pmd=18000009ffcad003, pte=00600000c61cc787 [ 8.899124][ T599] Internal error: Oops: 9600004f [#1] PREEMPT SMP [ 8.899265][ T599] Skip md ftrace buffer dump for: 0x1609e0 .... .., [ 8.899544][ T599] CPU: 7 PID: 599 Comm: modprobe Tainted: G S OE 5.15.41-android13-8-g38e9b1af6bce #1 [ 8.899547][ T599] Hardware name: XXX (DT) [ 8.899549][ T599] pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 8.899551][ T599] pc : gcov_info_add+0x9c/0xb8 [ 8.899557][ T599] lr : gcov_event+0x28c/0x6b8 [ 8.899559][ T599] sp : ffffffc00e733b00 [ 8.899560][ T599] x29: ffffffc00e733b00 x28: ffffffc00e733d30 x27: ffffffe8dc297470 [ 8.899563][ T599] x26: ffffffe8dc297000 x25: ffffffe8dc297000 x24: ffffffe8dc297000 [ 8.899566][ T599] x23: ffffffe8dc0a6200 x22: ffffff880f68bf20 x21: 0000000000000000 [ 8.899569][ T599] x20: ffffff880f68bf00 x19: ffffff8801babc00 x18: ffffffc00d7f9058 [ 8.899572][ T599] x17: 0000000000088793 x16: ffffff80461cbe00 x15: 9100052952800785 [ 8.899575][ T599] x14: 0000000000000200 x13: 0000000000000041 x12: 9100052952800785 [ 8.899577][ T599] x11: ffffffe8dc297000 x10: ffffffe8dc297000 x9 : ffffff80461cbc80 [ 8.899580][ T599] x8 : ffffff8801babe80 x7 : ffffffe8dc2ec000 x6 : ffffffe8dc2ed000 [ 8.899583][ T599] x5 : 000000008020001f x4 : fffffffe2006eae0 x3 : 000000008020001f [ 8.899586][ T599] x2 : ffffff8027c49200 x1 : ffffff8801babc20 x0 : ffffff80461cb3a0 [ 8.899589][ T599] Call trace: [ 8.899590][ T599] gcov_info_add+0x9c/0xb8 [ 8.899592][ T599] gcov_module_notifier+0xbc/0x120 [ 8.899595][ T599] blocking_notifier_call_chain+0xa0/0x11c [ 8.899598][ T599] do_init_module+0x2a8/0x33c [ 8.899600][ T599] load_module+0x23cc/0x261c [ 8.899602][ T599] __arm64_sys_finit_module+0x158/0x194 [ 8.899604][ T599] invoke_syscall+0x94/0x2bc [ 8.899607][ T599] el0_svc_common+0x1d8/0x34c [ 8.899609][ T599] do_el0_svc+0x40/0x54 [ 8.899611][ T599] el0_svc+0x94/0x2f0 [ 8.899613][ T599] el0t_64_sync_handler+0x88/0xec [ 8.899615][ T599] el0t_64_sync+0x1b4/0x1b8 [ 8.899618][ T599] Code: f905f56c f86e69ec f86e6a0f 8b0c01ec (f82e6a0c) [ 8.899620][ T599] ---[ end trace ed5218e9e5b6e2e6 ]---
--- kernel/gcov/clang.c | 2 ++ 1 file changed, 2 insertions(+)
kernel/gcov/clang.c +2 -0
@@ -280,6 +280,8 @@ void gcov_info_add(struct gcov_info *dstfor (i =0 ; i < sfn_ptr->num_counters; i++) dfn_ptr->counters[i] += sfn_ptr->counters[i]; + + sfn_ptr =list_next_entry (sfn_ptr, head); } }
Greg Kroah-Hartman
maintainerPATCH 200/289 mm/cgroup/reclaim: fix dirty pages throttling on cgroup v1
In reply to Greg Kroah-HartmanFrom: Aneesh Kumar K.V <[email protected]>
commit 81a70c21d9170de67a45843bdd627f4cce9c4215 upstream.
balance_dirty_pages doesn't do the required dirty throttling on cgroupv1. See commit 9badce000e2c ("cgroup, writeback: don't enable cgroup writeback on traditional hierarchies"). Instead, the kernel depends on writeback throttling in shrink_folio_list to achieve the same goal. With large memory systems, the flusher may not be able to writeback quickly enough such that we will start finding pages in the shrink_folio_list already in writeback. Hence for cgroupv1 let's do a reclaim throttle after waking up the flusher.
The below test which used to fail on a 256GB system completes till the the file system is full with this change.
root@lp2:/sys/fs/cgroup/memory# mkdir test root@lp2:/sys/fs/cgroup/memory# cd test/ root@lp2:/sys/fs/cgroup/memory/test# echo 120M > memory.limit_in_bytes root@lp2:/sys/fs/cgroup/memory/test# echo $$ > tasks root@lp2:/sys/fs/cgroup/memory/test# dd if=/dev/zero of=/home/kvaneesh/test bs=1M Killed
--- mm/vmscan.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
mm/vmscan.c +13 -1
@@ -2472,8 +2472,20 @@ shrink_inactive_list(unsigned long nr_to* the flushers simply cannot keep up with the allocation * rate. Nudge the flusher threads in case they are asleep. */ -if (stat.nr_unqueued_dirty == nr_taken) +if (stat.nr_unqueued_dirty == nr_taken) {wakeup_flusher_threads (WB_REASON_VMSCAN ); +/* +* For cgroupv1 dirty throttling is achieved by waking up +* the kernel flusher here and later waiting on folios +* which are in writeback to finish (see shrink_folio_list()). +* +* Flusher may not be able to issue writeback quickly +* enough for cgroupv1 writeback throttling to work +* on a large system. +*/ +if (!writeback_throttling_sane (sc)) +reclaim_throttle (pgdat,VMSCAN_THROTTLE_WRITEBACK ); + } sc->nr.dirty += stat.nr_dirty; sc->nr.congested += stat.nr_congested;
Greg Kroah-Hartman
maintainerPATCH 201/289 mm: vmscan: fix extreme overreclaim and swap floods
In reply to Greg Kroah-HartmanFrom: Johannes Weiner <[email protected]>
commit f53af4285d775cd9a9a146fc438bd0a1bee1838a upstream.
During proactive reclaim, we sometimes observe severe overreclaim, with several thousand times more pages reclaimed than requested.
This trace was obtained from shrink_lruvec() during such an instance:
prio:0 anon_cost:1141521 file_cost:7767
nr_reclaimed:4387406 nr_to_reclaim:1047 (or_factor:4190)
nr=[7161123 345 578 1111]While he reclaimer requested 4M, vmscan reclaimed close to 16G, most of it by swapping. These requests take over a minute, during which the write() to memory.reclaim is unkillably stuck inside the kernel.
Digging into the source, this is caused by the proportional reclaim bailout logic. This code tries to resolve a fundamental conflict: to reclaim roughly what was requested, while also aging all LRUs fairly and in accordance to their size, swappiness, refault rates etc. The way it attempts fairness is that once the reclaim goal has been reached, it stops scanning the LRUs with the smaller remaining scan targets, and adjusts the remainder of the bigger LRUs according to how much of the smaller LRUs was scanned. It then finishes scanning that remainder regardless of the reclaim goal.
This works fine if priority levels are low and the LRU lists are comparable in size. However, in this instance, the cgroup that is targeted by proactive reclaim has almost no files left - they've already been squeezed out by proactive reclaim earlier - and the remaining anon pages are hot. Anon rotations cause the priority level to drop to 0, which results in reclaim targeting all of anon (a lot) and all of file (almost nothing). By the time reclaim decides to bail, it has scanned most or all of the file target, and therefor must also scan most or all of the enormous anon target. This target is thousands of times larger than the reclaim goal, thus causing the overreclaim.
The bailout code hasn't changed in years, why is this failing now? The most likely explanations are two other recent changes in anon reclaim:
1. Before the series starting with commit 5df741963d52 ("mm: fix LRU balancing effect of new transparent huge pages"), the VM was overall relatively reluctant to swap at all, even if swap was configured. This means the LRU balancing code didn't come into play as often as it does now, and mostly in high pressure situations where pronounced swap activity wouldn't be as surprising.
2. For historic reasons, shrink_lruvec() loops on the scan targets of all LRU lists except the active anon one, meaning it would bail if the only remaining pages to scan were active anon - even if there were a lot of them.
Before the series starting with commit ccc5dc67340c ("mm/vmscan:
make active/inactive ratio as 1:1 for anon lru"), most anon pages would live on the active LRU; the inactive one would contain only a handful of preselected reclaim candidates. After the series, anon gets aged similarly to file, and the inactive list is the default for new anon pages as well, making it often the much bigger list.
As a result, the VM is now more likely to actually finish large anon targets than before.
Change the code such that only one SWAP_CLUSTER_MAX-sized nudge toward the larger LRU lists is made before bailing out on a met reclaim goal.
This fixes the extreme overreclaim problem.
Fairness is more subtle and harder to evaluate. No obvious misbehavior was observed on the test workload, in any case. Conceptually, fairness should primarily be a cumulative effect from regular, lower priority scans. Once the VM is in trouble and needs to escalate scan targets to make forward progress, fairness needs to take a backseat. This is also acknowledged by the myriad exceptions in get_scan_count(). This patch makes fairness decrease gradually, as it keeps fairness work static over increasing priority levels with growing scan targets. This should make more sense - although we may have to re-visit the exact values.
--- mm/vmscan.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
mm/vmscan.c +4 -6
@@ -2967,8 +2967,8 @@ static void shrink_lruvec(struct lruvecenum lru_list lru;unsigned long nr_reclaimed =0 ;unsigned long nr_to_reclaim = sc->nr_to_reclaim; +bool proportional_reclaim;struct blk_plug plug; -bool scan_adjusted;get_scan_count (lruvec, sc, nr);
@@ -2986,8 +2986,8 @@ static void shrink_lruvec(struct lruvec* abort proportional reclaim if either the file or anon lru has already * dropped to zero at the first pass. */ - scan_adjusted = (!cgroup_reclaim (sc) && !current_is_kswapd () && - sc->priority ==DEF_PRIORITY ); + proportional_reclaim = (!cgroup_reclaim (sc) && !current_is_kswapd () && + sc->priority ==DEF_PRIORITY );blk_start_plug (&plug); while (nr[LRU_INACTIVE_ANON] || nr[LRU_ACTIVE_FILE] ||
@@ -3007,7 +3007,7 @@ static void shrink_lruvec(struct lruveccond_resched (); -if (nr_reclaimed < nr_to_reclaim || scan_adjusted) +if (nr_reclaimed < nr_to_reclaim || proportional_reclaim)continue ;/*
@@ -3058,8 +3058,6 @@ static void shrink_lruvec(struct lruvec nr_scanned = targets[lru] - nr[lru]; nr[lru] = targets[lru] * (100 - percentage) /100 ; nr[lru] -=min (nr[lru], nr_scanned); - - scan_adjusted = true; }blk_finish_plug (&plug); sc->nr_reclaimed += nr_reclaimed;
Greg Kroah-Hartman
maintainerPATCH 202/289 fpga: m10bmc-sec: Fix kconfig dependencies
In reply to Greg Kroah-HartmanFrom: Russ Weight <[email protected]>
commit dfd10332596ef11ceafd29c4e21b4117be423fc4 upstream.
The secure update driver depends on the firmware-upload functionality of the firmware-loader. The firmware-loader is carried in the firmware-class driver which is enabled with the tristate CONFIG_FW_LOADER option. The firmware-upload functionality is included in the firmware-class driver if the bool FW_UPLOAD config is set.
The current dependency statement, "depends on FW_UPLOAD", is not adequate because it does not implicitly turn on FW_LOADER. Instead of adding a dependency, follow the convention used by drivers that require the FW_LOADER_USER_HELPER functionality of the firmware-loader by using select for both FW_LOADER and FW_UPLOAD.
--- drivers/fpga/Kconfig | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/fpga/Kconfig +3 -1
@@ -246,7 +246,9 @@ config FPGA_MGR_VERSAL_FPGA config FPGA_M10_BMC_SEC_UPDATE tristate "Intel MAX10 BMC Secure Update driver" - depends on MFD_INTEL_M10_BMC && FW_UPLOAD + depends on MFD_INTEL_M10_BMC + select FW_LOADER + select FW_UPLOAD help Secure update support for the Intel MAX10 board management controller.
Signature · 1 line
2.38.1
Greg Kroah-Hartman
maintainerPATCH 203/289 KVM: x86/mmu: Fix race condition in direct_page_fault
In reply to Greg Kroah-HartmanFrom: Kazuki Takiguchi <[email protected]>
commit 47b0c2e4c220f2251fd8dcfbb44479819c715e15 upstream.
make_mmu_pages_available() must be called with mmu_lock held for write. However, if the TDP MMU is used, it will be called with mmu_lock held for read.
This function does nothing unless shadow pages are used, so there is no race unless nested TDP is used.
Since nested TDP uses shadow pages, old shadow pages may be zapped by this function even when the TDP MMU is enabled.
Since shadow pages are never allocated by kvm_tdp_mmu_map(), a race condition can be avoided by not calling make_mmu_pages_available() if the TDP MMU is currently in use.
I encountered this when repeatedly starting and stopping nested VM. It can be artificially caused by allocating a large number of nested TDP SPTEs.
For example, the following BUG and general protection fault are caused in the host kernel.
pte_list_remove: 00000000cd54fc10 many->many
------------[ cut here ]------------ kernel BUG at arch/x86/kvm/mmu/mmu.c:963! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:pte_list_remove.cold+0x16/0x48 [kvm] Call Trace: <TASK> drop_spte+0xe0/0x180 [kvm] mmu_page_zap_pte+0x4f/0x140 [kvm] __kvm_mmu_prepare_zap_page+0x62/0x3e0 [kvm] kvm_mmu_zap_oldest_mmu_pages+0x7d/0xf0 [kvm] direct_page_fault+0x3cb/0x9b0 [kvm] kvm_tdp_page_fault+0x2c/0xa0 [kvm] kvm_mmu_page_fault+0x207/0x930 [kvm] npf_interception+0x47/0xb0 [kvm_amd] svm_invoke_exit_handler+0x13c/0x1a0 [kvm_amd] svm_handle_exit+0xfc/0x2c0 [kvm_amd] kvm_arch_vcpu_ioctl_run+0xa79/0x1780 [kvm] kvm_vcpu_ioctl+0x29b/0x6f0 [kvm] __x64_sys_ioctl+0x95/0xd0 do_syscall_64+0x5c/0x90 general protection fault, probably for non-canonical address 0xdead000000000122: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:kvm_mmu_commit_zap_page.part.0+0x4b/0xe0 [kvm] Call Trace: <TASK> kvm_mmu_zap_oldest_mmu_pages+0xae/0xf0 [kvm] direct_page_fault+0x3cb/0x9b0 [kvm] kvm_tdp_page_fault+0x2c/0xa0 [kvm] kvm_mmu_page_fault+0x207/0x930 [kvm] npf_interception+0x47/0xb0 [kvm_amd]
CVE: CVE-2022-45869
--- arch/x86/kvm/mmu/mmu.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
arch/x86/kvm/mmu/mmu.c +7 -6
@@ -2431,6 +2431,7 @@ static bool __kvm_mmu_prepare_zap_page(s {bool list_unstable, zapped_root = false; +lockdep_assert_held_write (&kvm->mmu_lock);trace_kvm_mmu_prepare_zap_page (sp); ++kvm->stat.mmu_shadow_zapped; *nr_zapped =mmu_zap_unsync_children (kvm, sp, invalid_list);
@@ -4250,14 +4251,14 @@ static int direct_page_fault(struct kvm_if (is_page_fault_stale (vcpu, fault, mmu_seq)) goto out_unlock; - r =make_mmu_pages_available (vcpu); -if (r) - goto out_unlock; - -if (is_tdp_mmu_fault) +if (is_tdp_mmu_fault) { r =kvm_tdp_mmu_map (vcpu, fault); -else + }else { + r =make_mmu_pages_available (vcpu); +if (r) + goto out_unlock; r =__direct_map (vcpu, fault); + } out_unlock:if (is_tdp_mmu_fault)
Greg Kroah-Hartman
maintainerPATCH 204/289 KVM: x86/xen: Only do in-kernel acceleration of hypercalls for guest CPL0
In reply to Greg Kroah-HartmanFrom: David Woodhouse <[email protected]>
commit c2b8cdfaf3a6721afe0c8c060a631b1c67a7f1ee upstream.
There are almost no hypercalls which are valid from CPL > 0, and definitely none which are handled by the kernel.
--- arch/x86/kvm/xen.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
arch/x86/kvm/xen.c +11 -1
@@ -1216,6 +1216,7 @@ int kvm_xen_hypercall(struct kvm_vcpu *vbool longmode;u64 input, params[6 ], r = -ENOSYS ;bool handled = false; +u8 cpl; input = (u64 )kvm_register_read (vcpu,VCPU_REGS_RAX );
@@ -1243,9 +1244,17 @@ int kvm_xen_hypercall(struct kvm_vcpu *v params[5] = (u64)kvm_r9_read(vcpu); }#endif + cpl =static_call (kvm_x86_get_cpl)(vcpu);trace_kvm_xen_hypercall (input, params[0 ], params[1 ], params[2 ], params[3 ], params[4 ], params[5 ]); +/* +* Only allow hypercall acceleration for CPL0. The rare hypercalls that +* are permitted in guest userspace can be handled by the VMM. +*/ +if (unlikely (cpl >0 )) + goto handle_in_userspace; +switch (input) {case __HYPERVISOR_xen_version:if (params[0 ] == XENVER_version && vcpu->kvm->arch.xen.xen_version) {
@@ -1280,10 +1289,11 @@ int kvm_xen_hypercall(struct kvm_vcpu *vif (handled)return kvm_xen_hypercall_set_result (vcpu, r); +handle_in_userspace: vcpu->run->exit_reason =KVM_EXIT_XEN ; vcpu->run->xen.type =KVM_EXIT_XEN_HCALL ; vcpu->run->xen.u.hcall.longmode = longmode; - vcpu->run->xen.u.hcall.cpl =static_call (kvm_x86_get_cpl)(vcpu); + vcpu->run->xen.u.hcall.cpl = cpl; vcpu->run->xen.u.hcall.input = input; vcpu->run->xen.u.hcall.params[0 ] = params[0 ]; vcpu->run->xen.u.hcall.params[1 ] = params[1 ];
Greg Kroah-Hartman
maintainerPATCH 205/289 KVM: x86/xen: Validate port number in SCHEDOP_poll
In reply to Greg Kroah-HartmanFrom: David Woodhouse <[email protected]>
commit 4ea9439fd537313f3381f0af4ebbf05e3f51a58c upstream.
We shouldn't allow guests to poll on arbitrary port numbers off the end of the event channel table.
[dwmw2: my bug though; the original version did check the validity as a
side-effect of an idr_find() which I ripped out in refactoring.]
--- arch/x86/kvm/xen.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-)
arch/x86/kvm/xen.c +12 -8
@@ -954,6 +954,14 @@ static int kvm_xen_hypercall_complete_usreturn kvm_xen_hypercall_set_result (vcpu, run->xen.u.hcall.result); } +static inline int max_evtchn_port (struct kvm *kvm) +{ +if (IS_ENABLED (CONFIG_64BIT ) && kvm->arch.xen.long_mode) +return EVTCHN_2L_NR_CHANNELS ; +else +return COMPAT_EVTCHN_2L_NR_CHANNELS ; +} +static bool wait_pending_event (struct kvm_vcpu *vcpu,int nr_ports,evtchn_port_t *ports) {
@@ -1042,6 +1050,10 @@ static bool kvm_xen_schedop_poll(struct *r = -EFAULT ; goto out; } +if (ports[i] >=max_evtchn_port (vcpu->kvm)) { + *r = -EINVAL ; + goto out; + } }if (sched_poll.nr_ports ==1 )
@@ -1308,14 +1320,6 @@ handle_in_userspace:return 0 ; } -static inline int max_evtchn_port (struct kvm *kvm) -{ -if (IS_ENABLED (CONFIG_64BIT ) && kvm->arch.xen.long_mode) -return EVTCHN_2L_NR_CHANNELS ; -else -return COMPAT_EVTCHN_2L_NR_CHANNELS ; -} -static void kvm_xen_check_poller (struct kvm_vcpu *vcpu,int port) {int poll_evtchn = vcpu->arch.xen.poll_evtchn;
Greg Kroah-Hartman
maintainerPATCH 206/289 drm/i915/gvt: Get reference to KVM iff attachment to VM is successful
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit 9ed1fdee9ee324f3505ff066287ee53143caaaa2 upstream.
Get a reference to KVM if and only if a vGPU is successfully attached to the VM to avoid leaking a reference if there's no available vGPU. On open_device() failure, vfio_device_open() doesn't invoke close_device().
--- drivers/gpu/drm/i915/gvt/kvmgt.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/gpu/drm/i915/gvt/kvmgt.c +1 -2
@@ -765,8 +765,6 @@ static int intel_vgpu_open_device(structreturn -ESRCH ; } -kvm_get_kvm (vgpu->vfio_device.kvm); -if (__kvmgt_vgpu_exist (vgpu))return -EEXIST ;
@@ -777,6 +775,7 @@ static int intel_vgpu_open_device(struct vgpu->track_node.track_write = kvmgt_page_track_write; vgpu->track_node.track_flush_slot = kvmgt_page_track_flush_slot; +kvm_get_kvm (vgpu->vfio_device.kvm);kvm_page_track_register_notifier (vgpu->vfio_device.kvm, &vgpu->track_node);
Greg Kroah-Hartman
maintainerPATCH 207/289 KVM: x86: nSVM: leave nested mode on vCPU free
In reply to Greg Kroah-HartmanFrom: Maxim Levitsky <[email protected]>
commit 917401f26a6af5756d89b550a8e1bd50cf42b07e upstream.
If the VM was terminated while nested, we free the nested state while the vCPU still is in nested mode.
Soon a warning will be added for this condition.
Message-Id: <[email protected]>
--- arch/x86/kvm/svm/svm.c | 1 + 1 file changed, 1 insertion(+)
arch/x86/kvm/svm/svm.c +1 -0
@@ -1440,6 +1440,7 @@ static void svm_vcpu_free(struct kvm_vcp*/ svm_clear_current_vmcb (svm->vmcb); +svm_leave_nested (vcpu);svm_free_nested (svm);sev_free_vcpu (vcpu);
Greg Kroah-Hartman
maintainerPATCH 208/289 KVM: x86: forcibly leave nested mode on vCPU reset
In reply to Greg Kroah-HartmanFrom: Maxim Levitsky <[email protected]>
commit ed129ec9057f89d615ba0c81a4984a90345a1684 upstream.
While not obivous, kvm_vcpu_reset() leaves the nested mode by clearing 'vcpu->arch.hflags' but it does so without all the required housekeeping.
On SVM, it is possible to have a vCPU reset while in guest mode because
unlike VMX, on SVM, INIT's are not latched in SVM non root mode and in addition to that L1 doesn't have to intercept triple fault, which should also trigger L1's reset if happens in L2 while L1 didn't intercept it.
If one of the above conditions happen, KVM will continue to use vmcb02
while not having in the guest mode.
Later the IA32_EFER will be cleared which will lead to freeing of the nested guest state which will (correctly) free the vmcb02, but since KVM still uses it (incorrectly) this will lead to a use after free and kernel crash.
This issue is assigned CVE-2022-3344
Message-Id: <[email protected]>
--- arch/x86/kvm/x86.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
arch/x86/kvm/x86.c +10 -0
@@ -11789,8 +11789,18 @@ void kvm_vcpu_reset(struct kvm_vcpu *vcpWARN_ON_ONCE (!init_event && (old_cr0 ||kvm_read_cr3 (vcpu) ||kvm_read_cr4 (vcpu))); +/* +* SVM doesn't unconditionally VM-Exit on INIT and SHUTDOWN, thus it's +* possible to INIT the vCPU while L2 is active. Force the vCPU back +* into L1 as EFER.SVME is cleared on INIT (along with all other EFER +* bits), i.e. virtualization is disabled. +*/ +if (is_guest_mode (vcpu)) +kvm_leave_nested (vcpu); +kvm_lapic_reset (vcpu, init_event); +WARN_ON_ONCE (is_guest_mode (vcpu) ||is_smm (vcpu)); vcpu->arch.hflags =0 ; vcpu->arch.smi_pending =0 ;
Greg Kroah-Hartman
maintainerPATCH 209/289 KVM: x86: nSVM: harden svm_free_nested against freeing vmcb02 while still in use
In reply to Greg Kroah-HartmanFrom: Maxim Levitsky <[email protected]>
commit 16ae56d7e0528559bf8dc9070e3bfd8ba3de80df upstream.
Make sure that KVM uses vmcb01 before freeing nested state, and warn if that is not the case.
This is a minimal fix for CVE-2022-3344 making the kernel print a warning instead of a kernel panic.
Message-Id: <[email protected]>
--- arch/x86/kvm/svm/nested.c | 3 +++ 1 file changed, 3 insertions(+)
arch/x86/kvm/svm/nested.c +3 -0
@@ -1143,6 +1143,9 @@ void svm_free_nested(struct vcpu_svm *svif (!svm->nested.initialized)return ; +if (WARN_ON_ONCE (svm->vmcb != svm->vmcb01.ptr)) +svm_switch_vmcb (svm, &svm->vmcb01); +svm_vcpu_free_msrpm (svm->nested.msrpm); svm->nested.msrpm =NULL ;
Greg Kroah-Hartman
maintainerPATCH 210/289 KVM: x86: add kvm_leave_nested
In reply to Greg Kroah-HartmanFrom: Maxim Levitsky <[email protected]>
commit f9697df251438b0798780900e8b43bdb12a56d64 upstream.
add kvm_leave_nested which wraps a call to nested_ops->leave_nested into a function.
Message-Id: <[email protected]>
--- arch/x86/kvm/svm/nested.c | 3 --- arch/x86/kvm/vmx/nested.c | 3 --- arch/x86/kvm/x86.c | 8 +++++++- 3 files changed, 7 insertions(+), 7 deletions(-)
arch/x86/kvm/svm/nested.c +0 -3
@@ -1164,9 +1164,6 @@ void svm_free_nested(struct vcpu_svm *sv svm->nested.initialized = false; } -/* -* Forcibly leave nested mode in order to be able to reset the VCPU later on. -*/ void svm_leave_nested (struct kvm_vcpu *vcpu) {struct vcpu_svm *svm =to_svm (vcpu);
arch/x86/kvm/vmx/nested.c +0 -3
@@ -6294,9 +6294,6 @@ out:return kvm_state.size; } -/* -* Forcibly leave nested mode in order to be able to reset the VCPU later on. -*/ void vmx_leave_nested (struct kvm_vcpu *vcpu) {if (is_guest_mode (vcpu)) {
arch/x86/kvm/x86.c +7 -1
@@ -611,6 +611,12 @@ void kvm_deliver_exception_payload(struc }EXPORT_SYMBOL_GPL (kvm_deliver_exception_payload); +/* Forcibly leave the nested mode in cases like a vCPU reset */ +static void kvm_leave_nested (struct kvm_vcpu *vcpu) +{ + kvm_x86_ops.nested_ops->leave_nested (vcpu); +} +static void kvm_multiple_exception (struct kvm_vcpu *vcpu,unsigned nr,bool has_error,u32 error_code,bool has_payload,unsigned long payload,bool reinject)
@@ -5154,7 +5160,7 @@ static int kvm_vcpu_ioctl_x86_set_vcpu_eif (events->flags &KVM_VCPUEVENT_VALID_SMM ) {if (!!(vcpu->arch.hflags &HF_SMM_MASK ) != events->smi.smm) { - kvm_x86_ops.nested_ops->leave_nested (vcpu); +kvm_leave_nested (vcpu);kvm_smm_changed (vcpu, events->smi.smm); }
Greg Kroah-Hartman
maintainerPATCH 211/289 KVM: x86: remove exit_int_info warning in svm_handle_exit
In reply to Greg Kroah-HartmanFrom: Maxim Levitsky <[email protected]>
commit 05311ce954aebe75935d9ae7d38ac82b5b796e33 upstream.
It is valid to receive external interrupt and have broken IDT entry, which will lead to #GP with exit_int_into that will contain the index of the IDT entry (e.g any value).
Other exceptions can happen as well, like #NP or #SS (if stack switch fails).
Thus this warning can be user triggred and has very little value.
Message-Id: <[email protected]>
--- arch/x86/kvm/svm/svm.c | 15 --------------- 1 file changed, 15 deletions(-)
arch/x86/kvm/svm/svm.c +0 -15
@@ -346,12 +346,6 @@ int svm_set_efer(struct kvm_vcpu *vcpu,return 0 ; } -static int is_external_interrupt (u32 info) -{ - info &=SVM_EVTINJ_TYPE_MASK |SVM_EVTINJ_VALID ; -return info == (SVM_EVTINJ_VALID |SVM_EVTINJ_TYPE_INTR ); -} -static u32 svm_get_interrupt_shadow (struct kvm_vcpu *vcpu) {struct vcpu_svm *svm =to_svm (vcpu);
@@ -3427,15 +3421,6 @@ static int svm_handle_exit(struct kvm_vcreturn 0 ; } -if (is_external_interrupt (svm->vmcb->control.exit_int_info) && - exit_code !=SVM_EXIT_EXCP_BASE +PF_VECTOR && - exit_code !=SVM_EXIT_NPF && exit_code !=SVM_EXIT_TASK_SWITCH && - exit_code !=SVM_EXIT_INTR && exit_code !=SVM_EXIT_NMI ) -printk (KERN_ERR "%s: unexpected exit_int_info 0x%x " -"exit_code 0x%x\n" , - __func__, svm->vmcb->control.exit_int_info, - exit_code); -if (exit_fastpath !=EXIT_FASTPATH_NONE )return 1 ;
Greg Kroah-Hartman
maintainerPATCH 212/289 KVM: Update gfn_to_pfn_cache khva when it moves within the same page
In reply to Greg Kroah-HartmanFrom: David Woodhouse <[email protected]>
commit 8332f0ed4f187c7b700831bd7cc83ce180a944b9 upstream.
In the case where a GPC is refreshed to a different location within the same page, we didn't bother to update it. Mostly we don't need to, but since the ->khva field also includes the offset within the page, that does have to be updated.
--- virt/kvm/pfncache.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
virt/kvm/pfncache.c +6 -1
@@ -297,7 +297,12 @@ int kvm_gfn_to_pfn_cache_refresh(structif (!gpc->valid || old_uhva != gpc->uhva) { ret =hva_to_pfn_retry (kvm, gpc); }else { -/* If the HVA→PFN mapping was already valid, don't unmap it. */ +/* +* If the HVA→PFN mapping was already valid, don't unmap it. +* But do update gpc->khva because the offset within the page +* may have changed. +*/ + gpc->khva = old_khva + page_offset; old_pfn =KVM_PFN_ERR_FAULT ; old_khva =NULL ; ret =0 ;
Greg Kroah-Hartman
maintainerPATCH 213/289 x86/tsx: Add a feature bit for TSX control MSR support
In reply to Greg Kroah-HartmanFrom: Pawan Gupta <[email protected]>
commit aaa65d17eec372c6a9756833f3964ba05b05ea14 upstream.
Support for the TSX control MSR is enumerated in MSR_IA32_ARCH_CAPABILITIES. This is different from how other CPU features are enumerated i.e. via CPUID. Currently, a call to tsx_ctrl_is_supported() is required for enumerating the feature. In the absence of a feature bit for TSX control, any code that relies on checking feature bits directly will not work.
In preparation for adding a feature bit check in MSR save/restore during suspend/resume, set a new feature bit X86_FEATURE_TSX_CTRL when MSR_IA32_TSX_CTRL is present. Also make tsx_ctrl_is_supported() use the new feature bit to avoid any overhead of reading the MSR.
[ bp: Remove tsx_ctrl_is_supported(), add room for two more feature
bits in word 11 which are coming up in the next merge window. ]
--- arch/x86/include/asm/cpufeatures.h | 3 ++ arch/x86/kernel/cpu/tsx.c | 38 ++++++++++++++++--------------------- 2 files changed, 20 insertions(+), 21 deletions(-)
arch/x86/include/asm/cpufeatures.h +3 -0
@@ -305,6 +305,9 @@#define X86_FEATURE_USE_IBPB_FW (11*32+16)/* "" Use IBPB during runtime firmware calls */ #define X86_FEATURE_RSB_VMEXIT_LITE (11*32+17)/* "" Fill RSB on VM exit when EIBRS is enabled */ + +#define X86_FEATURE_MSR_TSX_CTRL (11*32+20)/* "" MSR IA32_TSX_CTRL (Intel) implemented */ +/* Intel-defined CPU features, CPUID level 0x00000007:1 (EAX), word 12 */ #define X86_FEATURE_AVX_VNNI (12*32+ 4)/* AVX VNNI instructions */ #define X86_FEATURE_AVX512_BF16 (12*32+ 5)/* AVX512 BFLOAT16 instructions */
arch/x86/kernel/cpu/tsx.c +17 -21
@@ -58,24 +58,6 @@ static void tsx_enable(void)wrmsrl (MSR_IA32_TSX_CTRL , tsx); } -static bool tsx_ctrl_is_supported (void ) -{ -u64 ia32_cap =x86_read_arch_cap_msr (); - -/* -* TSX is controlled via MSR_IA32_TSX_CTRL. However, support for this -* MSR is enumerated by ARCH_CAP_TSX_MSR bit in MSR_IA32_ARCH_CAPABILITIES. -* -* TSX control (aka MSR_IA32_TSX_CTRL) is only available after a -* microcode update on CPUs that have their MSR_IA32_ARCH_CAPABILITIES -* bit MDS_NO=1. CPUs with MDS_NO=0 are not planned to get -* MSR_IA32_TSX_CTRL support even after a microcode update. Thus, -* tsx= cmdline requests will do nothing on CPUs without -* MSR_IA32_TSX_CTRL support. -*/ -return !!(ia32_cap &ARCH_CAP_TSX_CTRL_MSR ); -} -static enum tsx_ctrl_states x86_get_tsx_auto_mode (void ) {if (boot_cpu_has_bug (X86_BUG_TAA ))
@@ -135,7 +117,7 @@ static void tsx_clear_cpuid(void)rdmsrl (MSR_TSX_FORCE_ABORT , msr); msr |=MSR_TFA_TSX_CPUID_CLEAR ;wrmsrl (MSR_TSX_FORCE_ABORT , msr); - }else if (tsx_ctrl_is_supported ()) { + }else if (cpu_feature_enabled (X86_FEATURE_MSR_TSX_CTRL )) {rdmsrl (MSR_IA32_TSX_CTRL , msr); msr |=TSX_CTRL_CPUID_CLEAR ;wrmsrl (MSR_IA32_TSX_CTRL , msr);
@@ -158,7 +140,8 @@ static void tsx_dev_mode_disable(void)u64 mcu_opt_ctrl;/* Check if RTM_ALLOW exists */ -if (!boot_cpu_has_bug (X86_BUG_TAA ) || !tsx_ctrl_is_supported () || +if (!boot_cpu_has_bug (X86_BUG_TAA ) || + !cpu_feature_enabled (X86_FEATURE_MSR_TSX_CTRL ) || !cpu_feature_enabled (X86_FEATURE_SRBDS_CTRL ))return ;
@@ -191,7 +174,20 @@ void __init tsx_init(void)return ; } -if (!tsx_ctrl_is_supported ()) { +/* +* TSX is controlled via MSR_IA32_TSX_CTRL. However, support for this +* MSR is enumerated by ARCH_CAP_TSX_MSR bit in MSR_IA32_ARCH_CAPABILITIES. +* +* TSX control (aka MSR_IA32_TSX_CTRL) is only available after a +* microcode update on CPUs that have their MSR_IA32_ARCH_CAPABILITIES +* bit MDS_NO=1. CPUs with MDS_NO=0 are not planned to get +* MSR_IA32_TSX_CTRL support even after a microcode update. Thus, +* tsx= cmdline requests will do nothing on CPUs without +* MSR_IA32_TSX_CTRL support. +*/ +if (x86_read_arch_cap_msr () &ARCH_CAP_TSX_CTRL_MSR ) { +setup_force_cpu_cap (X86_FEATURE_MSR_TSX_CTRL ); + }else { tsx_ctrl_state =TSX_CTRL_NOT_SUPPORTED ;return ; }
Greg Kroah-Hartman
maintainerPATCH 214/289 x86/pm: Add enumeration check before spec MSRs save/restore setup
In reply to Greg Kroah-HartmanFrom: Pawan Gupta <[email protected]>
commit 50bcceb7724e471d9b591803889df45dcbb584bc upstream.
pm_save_spec_msr() keeps a list of all the MSRs which _might_ need to be saved and restored at hibernate and resume. However, it has zero awareness of CPU support for these MSRs. It mostly works by unconditionally attempting to manipulate these MSRs and relying on rdmsrl_safe() being able to handle a #GP on CPUs where the support is unavailable.
However, it's possible for reads (RDMSR) to be supported for a given MSR while writes (WRMSR) are not. In this case, msr_build_context() sees a successful read (RDMSR) and marks the MSR as valid. Then, later, a write (WRMSR) fails, producing a nasty (but harmless) error message. This causes restore_processor_state() to try and restore it, but writing this MSR is not allowed on the Intel Atom N2600 leading to:
unchecked MSR access error: WRMSR to 0x122 (tried to write 0x0000000000000002) \
at rIP: 0xffffffff8b07a574 (native_write_msr+0x4/0x20)
Call Trace:
<TASK>
restore_processor_state
x86_acpi_suspend_lowlevel
acpi_suspend_enter
suspend_devices_and_enter
pm_suspend.cold
state_store
kernfs_fop_write_iter
vfs_write
ksys_write
do_syscall_64
? do_syscall_64
? up_read
? lock_is_held_type
? asm_exc_page_fault
? lockdep_hardirqs_on
entry_SYSCALL_64_after_hwframeTo fix this, add the corresponding X86_FEATURE bit for each MSR. Avoid trying to manipulate the MSR when the feature bit is clear. This required adding a X86_FEATURE bit for MSRs that do not have one already, but it's a small price to pay.
[ bp: Move struct msr_enumeration inside the only function that uses it. ]
--- arch/x86/power/cpu.c | 23 +++++++++++++++-------- 1 file changed, 15 insertions(+), 8 deletions(-)
arch/x86/power/cpu.c +15 -8
@@ -513,16 +513,23 @@ static int pm_cpu_check(const struct x86static void pm_save_spec_msr (void ) { -u32 spec_msr_id[] = { -MSR_IA32_SPEC_CTRL , -MSR_IA32_TSX_CTRL , -MSR_TSX_FORCE_ABORT , -MSR_IA32_MCU_OPT_CTRL , -MSR_AMD64_LS_CFG , -MSR_AMD64_DE_CFG , +struct msr_enumeration { +u32 msr_no; +u32 feature; + } msr_enum[] = { + {MSR_IA32_SPEC_CTRL ,X86_FEATURE_MSR_SPEC_CTRL }, + {MSR_IA32_TSX_CTRL ,X86_FEATURE_MSR_TSX_CTRL }, + {MSR_TSX_FORCE_ABORT ,X86_FEATURE_TSX_FORCE_ABORT }, + {MSR_IA32_MCU_OPT_CTRL ,X86_FEATURE_SRBDS_CTRL }, + {MSR_AMD64_LS_CFG ,X86_FEATURE_LS_CFG_SSBD }, + {MSR_AMD64_DE_CFG ,X86_FEATURE_LFENCE_RDTSC }, }; +int i; -msr_build_context (spec_msr_id,ARRAY_SIZE (spec_msr_id)); +for (i =0 ; i <ARRAY_SIZE (msr_enum); i++) { +if (boot_cpu_has (msr_enum[i].feature)) +msr_build_context (&msr_enum[i].msr_no,1 ); + } }static int pm_check_save_msr (void )
Greg Kroah-Hartman
maintainerPATCH 215/289 x86/ioremap: Fix page aligned size calculation in __ioremap_caller()
In reply to Greg Kroah-HartmanFrom: Michael Kelley <[email protected]>
commit 4dbd6a3e90e03130973688fd79e19425f720d999 upstream.
Current code re-calculates the size after aligning the starting and ending physical addresses on a page boundary. But the re-calculation also embeds the masking of high order bits that exceed the size of the physical address space (via PHYSICAL_PAGE_MASK). If the masking removes any high order bits, the size calculation results in a huge value that is likely to immediately fail.
Fix this by re-calculating the page-aligned size first. Then mask any high order bits using PHYSICAL_PAGE_MASK.
--- arch/x86/mm/ioremap.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
arch/x86/mm/ioremap.c +7 -1
@@ -216,9 +216,15 @@ __ioremap_caller(resource_size_t phys_ad* Mappings have to be page-aligned */ offset = phys_addr & ~PAGE_MASK ; - phys_addr &=PHYSICAL_PAGE_MASK ; + phys_addr &=PAGE_MASK ; size =PAGE_ALIGN (last_addr+1 ) - phys_addr; +/* +* Mask out any bits not part of the actual physical +* address, like memory encryption bits. +*/ + phys_addr &=PHYSICAL_PAGE_MASK ; + retval =memtype_reserve (phys_addr, (u64 )phys_addr + size, pcm, &new_pcm);if (retval) {
Greg Kroah-Hartman
maintainerPATCH 216/289 mm: fix unexpected changes to {failslab|fail_page_alloc}.attr
In reply to Greg Kroah-HartmanFrom: Qi Zheng <[email protected]>
commit ea4452de2ae987342fadbdd2c044034e6480daad upstream.
When we specify __GFP_NOWARN, we only expect that no warnings will be issued for current caller. But in the __should_failslab() and __should_fail_alloc_page(), the local GFP flags alter the global {failslab|fail_page_alloc}.attr, which is persistent and shared by all tasks. This is not what we expected, let's fix it.
--- include/linux/fault-inject.h | 7 +++++-- lib/fault-inject.c | 13 ++++++++----- mm/failslab.c | 12 ++++++++++-- mm/page_alloc.c | 7 +++++-- 4 files changed, 28 insertions(+), 11 deletions(-)
include/linux/fault-inject.h +5 -2
@@ -20,7 +20,6 @@ struct fault_attr {atomic_t space;unsigned long verbose;bool task_filter; -bool no_warn;unsigned long stacktrace_depth;unsigned long require_start;unsigned long require_end;
@@ -32,6 +31,10 @@ struct fault_attr {struct dentry *dname; }; +enum fault_flags { +FAULT_NOWARN =1 <<0 , +}; +#define FAULT_ATTR_INITIALIZER { \ .interval = 1, \ .times = ATOMIC_INIT(1), \
@@ -40,11 +43,11 @@ struct fault_attr { .ratelimit_state = RATELIMIT_STATE_INIT_DISABLED, \ .verbose = 2, \ .dname = NULL, \ - .no_warn = false, \ }#define DECLARE_FAULT_ATTR (name) struct fault_attr name = FAULT_ATTR_INITIALIZERint setup_fault_attr (struct fault_attr *attr,char *str); +bool should_fail_ex (struct fault_attr *attr,ssize_t size,int flags);bool should_fail (struct fault_attr *attr,ssize_t size);#ifdef CONFIG_FAULT_INJECTION_DEBUG_FS
lib/fault-inject.c +8 -5
@@ -41,9 +41,6 @@ EXPORT_SYMBOL_GPL(setup_fault_attr);static void fail_dump (struct fault_attr *attr) { -if (attr->no_warn) -return ; -if (attr->verbose >0 &&__ratelimit (&attr->ratelimit_state)) {printk (KERN_NOTICE "FAULT_INJECTION: forcing a failure.\n" "name %pd, interval %lu, probability %lu, "
@@ -103,7 +100,7 @@ static inline bool fail_stacktrace(struc* http://www.nongnu.org/failmalloc/ */ -bool should_fail (struct fault_attr *attr,ssize_t size) +bool should_fail_ex (struct fault_attr *attr,ssize_t size,int flags) {if (in_task ()) {unsigned int fail_nth =READ_ONCE (current->fail_nth);
@@ -146,13 +143,19 @@ bool should_fail(struct fault_attr *attrreturn false; fail: -fail_dump (attr); +if (!(flags &FAULT_NOWARN )) +fail_dump (attr);if (atomic_read (&attr->times) !=-1 )atomic_dec_not_zero (&attr->times);return true; } + +bool should_fail (struct fault_attr *attr,ssize_t size) +{ +return should_fail_ex (attr, size,0 ); +}EXPORT_SYMBOL_GPL (should_fail);#ifdef CONFIG_FAULT_INJECTION_DEBUG_FS
mm/failslab.c +10 -2
@@ -16,6 +16,8 @@ static struct {bool __should_failslab (struct kmem_cache *s,gfp_t gfpflags) { +int flags =0 ; +/* No fault-injection for bootstrap cache */ if (unlikely (s == kmem_cache))return false;
@@ -30,10 +32,16 @@ bool __should_failslab(struct kmem_cacheif (failslab.cache_filter && !(s->flags &SLAB_FAILSLAB ))return false; +/* +* In some cases, it expects to specify __GFP_NOWARN +* to avoid printing any information(not just a warning), +* thus avoiding deadlocks. See commit 6b9dbedbe349 for +* details. +*/ if (gfpflags & __GFP_NOWARN) - failslab.attr.no_warn = true; + flags |=FAULT_NOWARN ; -return should_fail (&failslab.attr, s->object_size); +return should_fail_ex (&failslab.attr, s->object_size, flags); }static int __init setup_failslab (char *str)
mm/page_alloc.c +5 -2
@@ -3883,6 +3883,8 @@ __setup("fail_page_alloc=", setup_fail_pstatic bool __should_fail_alloc_page (gfp_t gfp_mask,unsigned int order) { +int flags =0 ; +if (order < fail_page_alloc.min_order)return false;if (gfp_mask & __GFP_NOFAIL)
@@ -3893,10 +3895,11 @@ static bool __should_fail_alloc_page(gfp (gfp_mask & __GFP_DIRECT_RECLAIM))return false; +/* See comment in __should_failslab() */ if (gfp_mask & __GFP_NOWARN) - fail_page_alloc.attr.no_warn = true; + flags |=FAULT_NOWARN ; -return should_fail (&fail_page_alloc.attr,1 << order); +return should_fail_ex (&fail_page_alloc.attr,1 << order, flags); }#ifdef CONFIG_FAULT_INJECTION_DEBUG_FS
Greg Kroah-Hartman
maintainerPATCH 217/289 mm: correctly charge compressed memory to its memcg
In reply to Greg Kroah-HartmanFrom: Li Liguang <[email protected]>
commit cd08d80ecdac577bad2e8d6805c7a3859fdefb8d upstream.
Kswapd will reclaim memory when memory pressure is high, the annonymous memory will be compressed and stored in the zpool if zswap is enabled. The memcg_kmem_bypass() in get_obj_cgroup_from_page() will bypass the kernel thread and cause the compressed memory not be charged to its memory cgroup.
Remove the memcg_kmem_bypass() call and properly charge compressed memory to its corresponding memory cgroup.
--- mm/memcontrol.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/memcontrol.c +1 -1
@@ -2971,7 +2971,7 @@ struct obj_cgroup *get_obj_cgroup_from_p {struct obj_cgroup *objcg; -if (!memcg_kmem_enabled () ||memcg_kmem_bypass ()) +if (!memcg_kmem_enabled ())return NULL ;if (PageMemcgKmem (page)) {
Greg Kroah-Hartman
maintainerPATCH 218/289 LoongArch: Clear FPU/SIMD thread info flags for kernel thread
In reply to Greg Kroah-HartmanFrom: Huacai Chen <[email protected]>
commit e428e9613531d1ef6bd0d91352899712b29134fb upstream.
If a kernel thread is created by a user thread, it may carry FPU/SIMD thread info flags (TIF_USEDFPU, TIF_USEDSIMD, etc.). Then it will be considered as a fpu owner and kernel try to save its FPU/SIMD context and cause such errors:
[ 41.518931] do_fpu invoked from kernel context![#1]: [ 41.523933] CPU: 1 PID: 395 Comm: iou-wrk-394 Not tainted 6.1.0-rc5+ #217 [ 41.530757] Hardware name: Loongson Loongson-3A5000-7A1000-1w-CRB/Loongson-LS3A5000-7A1000-1w-CRB, BIOS vUDK2018-LoongArch-V2.0.pre-beta8 08/18/2022 [ 41.544064] $ 0 : 0000000000000000 90000000011e9468 9000000106c7c000 9000000106c7fcf0 [ 41.552101] $ 4 : 9000000106305d40 9000000106689800 9000000106c7fd08 0000000003995818 [ 41.560138] $ 8 : 0000000000000001 90000000009a72e4 0000000000000020 fffffffffffffffc [ 41.568174] $12 : 0000000000000000 0000000000000000 0000000000000020 00000009aab7e130 [ 41.576211] $16 : 00000000000001ff 0000000000000407 0000000000000001 0000000000000000 [ 41.584247] $20 : 0000000000000000 0000000000000001 9000000106c7fd70 90000001002f0400 [ 41.592284] $24 : 0000000000000000 900000000178f740 90000000011e9834 90000001063057c0 [ 41.600320] $28 : 0000000000000000 0000000000000001 9000000006826b40 9000000106305140 [ 41.608356] era : 9000000000228848 _save_fp+0x0/0xd8 [ 41.613542] ra : 90000000011e9468 __schedule+0x568/0x8d0 [ 41.619160] CSR crmd: 000000b0 [ 41.619163] CSR prmd: 00000000 [ 41.622359] CSR euen: 00000000 [ 41.625558] CSR ecfg: 00071c1c [ 41.628756] CSR estat: 000f0000 [ 41.635239] ExcCode : f (SubCode 0) [ 41.638783] PrId : 0014c010 (Loongson-64bit) [ 41.643191] Modules linked in: acpi_ipmi vfat fat ipmi_si ipmi_devintf cfg80211 ipmi_msghandler rfkill fuse efivarfs [ 41.653734] Process iou-wrk-394 (pid: 395, threadinfo=0000000004ebe913, task=00000000636fa1be) [ 41.662375] Stack : 00000000ffff0875 9000000006800ec0 9000000006800ec0 90000000002d57e0 [ 41.670412] 0000000000000001 0000000000000000 9000000106535880 0000000000000001 [ 41.678450] 9000000105291800 0000000000000000 9000000105291838 900000000178e000 [ 41.686487] 9000000106c7fd90 9000000106305140 0000000000000001 90000000011e9834 [ 41.694523] 00000000ffff0875 90000000011f034c 9000000105291838 9000000105291830 [ 41.702561] 0000000000000000 9000000006801440 00000000ffff0875 90000000002d48c0 [ 41.710597] 9000000128800001 9000000106305140 9000000105291838 9000000105291838 [ 41.718634] 9000000105291830 9000000107811740 9000000105291848 90000000009bf1e0 [ 41.726672] 9000000105291830 9000000107811748 2d6b72772d756f69 0000000000343933 [ 41.734708] 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [ 41.742745] ... [ 41.745252] Call Trace: [ 42.197868] [<9000000000228848>] _save_fp+0x0/0xd8 [ 42.205214] [<90000000011ed468>] __schedule+0x568/0x8d0 [ 42.210485] [<90000000011ed834>] schedule+0x64/0xd4 [ 42.215411] [<90000000011f434c>] schedule_timeout+0x88/0x188 [ 42.221115] [<90000000009c36d0>] io_wqe_worker+0x184/0x350 [ 42.226645] [<9000000000221cf0>] ret_from_kernel_thread+0xc/0x9c
This can be easily triggered by ltp testcase syscalls/io_uring02 and it can also be easily fixed by clearing the FPU/SIMD thread info flags for kernel threads in copy_thread().
--- arch/loongarch/kernel/process.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
arch/loongarch/kernel/process.c +5 -4
@@ -152,7 +152,7 @@ int copy_thread(struct task_struct *p, c childregs->csr_crmd = p->thread.csr_crmd; childregs->csr_prmd = p->thread.csr_prmd; childregs->csr_ecfg = p->thread.csr_ecfg; -return 0 ; + goto out; }/* user thread */
@@ -171,14 +171,15 @@ int copy_thread(struct task_struct *p, c*/ childregs->csr_euen =0 ; +if (clone_flags &CLONE_SETTLS ) + childregs->regs[2 ] = tls; + +out:clear_tsk_thread_flag (p,TIF_USEDFPU );clear_tsk_thread_flag (p,TIF_USEDSIMD );clear_tsk_thread_flag (p,TIF_LSX_CTX_LIVE );clear_tsk_thread_flag (p,TIF_LASX_CTX_LIVE ); -if (clone_flags &CLONE_SETTLS ) - childregs->regs[2 ] = tls; -return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 219/289 LoongArch: Set _PAGE_DIRTY only if _PAGE_WRITE is set in {pmd,pte}_mkdirty()
In reply to Greg Kroah-HartmanFrom: Huacai Chen <[email protected]>
commit bf2f34a506e66e2979de6b17c337c5d4b25b4d2c upstream.
Now {pmd,pte}_mkdirty() set _PAGE_DIRTY bit unconditionally, this causes random segmentation fault after commit 0ccf7f168e17bb7e ("mm/thp: carry over dirty bit when thp splits on pmd").
The reason is: when fork(), parent process use pmd_wrprotect() to clear huge page's _PAGE_WRITE and _PAGE_DIRTY (for COW); then pte_mkdirty() set _PAGE_DIRTY as well as _PAGE_MODIFIED while splitting dirty huge pages; once _PAGE_DIRTY is set, there will be no tlb modify exception so the COW machanism fails; and at last memory corruption occurred between parent and child processes.
So, we should set _PAGE_DIRTY only when _PAGE_WRITE is set in {pmd,pte}_ mkdirty().
--- arch/loongarch/include/asm/pgtable.h | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
arch/loongarch/include/asm/pgtable.h +6 -2
@@ -349,7 +349,9 @@ static inline pte_t pte_mkclean(pte_t ptstatic inline pte_t pte_mkdirty (pte_t pte) { -pte_val (pte) |= (_PAGE_DIRTY | _PAGE_MODIFIED); +pte_val (pte) |= _PAGE_MODIFIED; +if (pte_val (pte) & _PAGE_WRITE) +pte_val (pte) |= _PAGE_DIRTY;return pte; }
@@ -475,7 +477,9 @@ static inline pmd_t pmd_mkclean(pmd_t pmstatic inline pmd_t pmd_mkdirty (pmd_t pmd) { -pmd_val (pmd) |= (_PAGE_DIRTY | _PAGE_MODIFIED); +pmd_val (pmd) |= _PAGE_MODIFIED; +if (pmd_val (pmd) & _PAGE_WRITE) +pmd_val (pmd) |= _PAGE_DIRTY;return pmd; }
Greg Kroah-Hartman
maintainerPATCH 220/289 ASoC: SOF: Fix compilation when HDA_AUDIO_CODEC config is disabled
In reply to Greg Kroah-HartmanFrom: Cezary Rojewski <[email protected]>
commit 1cda83e42bf66beb06bf61c7a78951ec0c028898 upstream.
hda_codec_device_init() expects three parameters, not two.
--- sound/soc/sof/intel/hda-codec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/sof/intel/hda-codec.c +1 -1
@@ -213,7 +213,7 @@ out: put_device(&codec->core.dev); }#else - codec =hda_codec_device_init (&hbus->core, address); + codec =hda_codec_device_init (&hbus->core, address,HDA_DEV_ASOC ); ret =PTR_ERR_OR_ZERO (codec);#endif
Greg Kroah-Hartman
maintainerPATCH 221/289 ASoC: Intel: fix unused-variable warning in probe_codec
In reply to Greg Kroah-HartmanFrom: Gaosheng Cui <[email protected]>
commit 515626a33a194c4caaf2879dbf9e00e882582af0 upstream.
In configurations with CONFIG_SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC=n, gcc warns about an unused variable:
sound/soc/intel/skylake/skl.c: In function ‘probe_codec’:sound/soc/intel/skylake/skl.c:729:18: error: unused variable ‘skl’ [-Werror=unused-variable]
struct skl_dev *skl = bus_to_skl(bus);
^~~cc1: all warnings being treated as errors
--- sound/soc/intel/skylake/skl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/intel/skylake/skl.c +1 -1
@@ -726,8 +726,8 @@ static int probe_codec(struct hdac_bus *unsigned int cmd = (addr <<28 ) | (AC_NODE_ROOT <<20 ) | (AC_VERB_PARAMETERS <<8 ) |AC_PAR_VENDOR_ID ;unsigned int res =-1 ; -struct skl_dev *skl =bus_to_skl (bus);#if IS_ENABLED (CONFIG_SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC ) +struct skl_dev *skl =bus_to_skl (bus);struct hdac_hda_priv *hda_codec;#endif struct hda_codec *codec;
Greg Kroah-Hartman
maintainerPATCH 222/289 ASoC: Intel: Skylake: fix possible memory leak in skl_codec_device_init()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
commit 0e213813df02da048ffd22a2c4fac041768ca327 upstream.
If snd_hdac_device_register() fails, 'codec' and name allocated in dev_set_name() called in snd_hdac_device_init() are leaked. Fix this by calling put_device(), so they can be freed in snd_hda_codec_dev_release() and kobject_cleanup().
--- sound/soc/intel/skylake/skl.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-)
sound/soc/intel/skylake/skl.c +1 -7
@@ -689,11 +689,6 @@ static void load_codec_module(struct hda#endif /* CONFIG_SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC */ -static void skl_codec_device_exit (struct device *dev) -{ -snd_hdac_device_exit (dev_to_hdac_dev (dev)); -} -static struct hda_codec *skl_codec_device_init (struct hdac_bus *bus,int addr) {struct hda_codec *codec;
@@ -706,12 +701,11 @@ static struct hda_codec *skl_codec_devic } codec->core.type =HDA_DEV_ASOC ; - codec->core.dev.release = skl_codec_device_exit; ret =snd_hdac_device_register (&codec->core);if (ret) {dev_err (bus->dev,"failed to register hdac device\n" ); -snd_hdac_device_exit (&codec->core); +put_device (&codec->core.dev);return ERR_PTR (ret); }
Greg Kroah-Hartman
maintainerPATCH 223/289 ASoC: SOF: Intel: hda-codec: fix possible memory leak in hda_codec_device_init()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
commit e9441675edc1bb8dbfadacf68aafacca60d65a25 upstream.
If snd_hdac_device_register() fails, 'codec' and name allocated in dev_set_name() called in snd_hdac_device_init() are leaked. Fix this by calling put_device(), so they can be freed in snd_hda_codec_dev_release() and kobject_cleanup().
--- sound/soc/sof/intel/hda-codec.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-)
sound/soc/sof/intel/hda-codec.c +1 -7
@@ -109,11 +109,6 @@ EXPORT_SYMBOL_NS(hda_codec_jack_check, S#define is_generic_config (x) 0#endif -static void hda_codec_device_exit (struct device *dev) -{ -snd_hdac_device_exit (dev_to_hdac_dev (dev)); -} -static struct hda_codec *hda_codec_device_init (struct hdac_bus *bus,int addr,int type) {struct hda_codec *codec;
@@ -126,12 +121,11 @@ static struct hda_codec *hda_codec_devic } codec->core.type = type; - codec->core.dev.release = hda_codec_device_exit; ret =snd_hdac_device_register (&codec->core);if (ret) {dev_err (bus->dev,"failed to register hdac device\n" ); -snd_hdac_device_exit (&codec->core); +put_device (&codec->core.dev);return ERR_PTR (ret); }
Greg Kroah-Hartman
maintainerPATCH 224/289 Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode
In reply to Greg Kroah-HartmanFrom: Aman Dhoot <[email protected]>
[ Upstream commit ac5408991ea6b06e29129b4d4861097c4c3e0d59 ]
The device works fine in native RMI mode, there is no reason to use legacy PS/2 mode with it.
--- drivers/input/mouse/synaptics.c | 1 + 1 file changed, 1 insertion(+)
drivers/input/mouse/synaptics.c +1 -0
@@ -191,6 +191,7 @@ static const char * const smbus_pnp_ids[] = {"SYN3221" ,/* HP 15-ay000 */ "SYN323d" ,/* HP Spectre X360 13-w013dx */ "SYN3257" ,/* HP Envy 13-ad105ng */ +"SYN3286" ,/* HP Laptop 15-da3001TU */ NULL };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 225/289 ASoC: amd: yc: Add Alienware m17 R5 AMD into DMI table
In reply to Greg Kroah-HartmanFrom: Brent Mendelsohn <[email protected]>
[ Upstream commit d40b6529c6269cd5afddb1116a383cab9f126694 ]
This model requires an additional detection quirk to enable the internal microphone - BIOS doesn't seem to support AcpDmicConnected (nothing in acpidump output).
--- sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ 1 file changed, 7 insertions(+)
sound/soc/amd/yc/acp6x-mach.c +7 -0
@@ -206,6 +206,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { DMI_MATCH(DMI_PRODUCT_NAME, "UM5302TA"), } }, + { + .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "Alienware"), + DMI_MATCH(DMI_PRODUCT_NAME, "Alienware m17 R5 AMD"), + } + }, {} };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 226/289 ASoC: Intel: bytcht_es8316: Add quirk for the Nanote UMPC-01
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit 8bb0ac0e6f64ebdf15d963c26b028de391c9bcf9 ]
The Nanote UMPC-01 mini laptop has stereo speakers, while the default bytcht_es8316 settings assume a mono speaker setup. Add a quirk for this.
--- sound/soc/intel/boards/bytcht_es8316.c | 7 +++++++ 1 file changed, 7 insertions(+)
sound/soc/intel/boards/bytcht_es8316.c +7 -0
@@ -443,6 +443,13 @@ static const struct dmi_system_id byt_cht_es8316_quirk_table[] = { | BYT_CHT_ES8316_INTMIC_IN2_MAP | BYT_CHT_ES8316_JD_INVERTED), }, + {/* Nanote UMPC-01 */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"RWC CO.,LTD" ), + DMI_MATCH(DMI_PRODUCT_NAME, "UMPC-01"), + }, + .driver_data = (void *)BYT_CHT_ES8316_INTMIC_IN1_MAP, + }, { /* Teclast X98 Plus II */ .matches = { DMI_MATCH(DMI_SYS_VENDOR, "TECLAST"),
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 227/289 ASoC: Intel: soc-acpi: add ES83x6 support to IceLake
In reply to Greg Kroah-HartmanFrom: Pierre-Louis Bossart <[email protected]>
[ Upstream commit 9a1d248bb4beaf1b43d17ba12481ee0629fa29b9 ]
Missing entry to find a machine driver for ES83x6-based platforms.
--- sound/soc/intel/common/soc-acpi-intel-icl-match.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
sound/soc/intel/common/soc-acpi-intel-icl-match.c +13 -0
@@ -10,6 +10,11 @@#include <sound/soc-acpi-intel-match.h> #include "../skylake/skl.h" +static const struct snd_soc_acpi_codecs essx_83x6 = { + .num_codecs =3 , + .codecs = {"ESSX8316" ,"ESSX8326" ,"ESSX8336" }, +}; +static struct skl_machine_pdata icl_pdata = { .use_tplg_pcm = true, };
@@ -27,6 +32,14 @@ struct snd_soc_acpi_mach snd_soc_acpi_intel_icl_machines[] = { .drv_name = "sof_rt5682", .sof_tplg_filename = "sof-icl-rt5682.tplg", }, + { + .comp_ids = &essx_83x6, + .drv_name = "sof-essx8336", + .sof_tplg_filename = "sof-icl-es8336", /* the tplg suffix is added at run time */ + .tplg_quirk_mask = SND_SOC_ACPI_TPLG_INTEL_SSP_NUMBER | + SND_SOC_ACPI_TPLG_INTEL_SSP_MSB | + SND_SOC_ACPI_TPLG_INTEL_DMIC_NUMBER, + }, {}, };EXPORT_SYMBOL_GPL (snd_soc_acpi_intel_icl_machines);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 228/289 tools: iio: iio_generic_buffer: Fix read size
In reply to Greg Kroah-HartmanFrom: Matti Vaittinen <[email protected]>
[ Upstream commit 7c919b619bcc68158921b1bd968f0e704549bbb6 ]
When noevents is true and small buffer is used the allocated memory for holding the data may be smaller than the hard-coded 64 bytes. This can cause the iio_generic_buffer to crash.
Following was recorded on beagle bone black with v6.0 kernel and the digit fix patch:
https://lore.kernel.org/all/[email protected]/
using valgrind;
==339== Using Valgrind-3.18.1 and LibVEX; rerun with -h for copyright info ==339== Command: /iio_generic_buffer -n kx022-accel -T0 -e -l 10 -a -w 2000000 ==339== Parent PID: 307
==339==
==339== Syscall param read(buf) points to unaddressable byte(s)
==339== at 0x496BFA4: read (read.c:26)
==339== by 0x11699: main (iio_generic_buffer.c:724)
==339== Address 0x4ab3518 is 0 bytes after a block of size 160 alloc'd
==339== at 0x4864B70: malloc (vg_replace_malloc.c:381)
==339== by 0x115BB: main (iio_generic_buffer.c:677)
Fix this by always using the same size for reading as was used for data storage allocation.
--- tools/iio/iio_generic_buffer.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/iio/iio_generic_buffer.c +2 -2
@@ -715,12 +715,12 @@ int main(int argc, char **argv)continue ; } - toread = buf_len; }else {usleep (timedelay); - toread =64 ; } + toread = buf_len; + read_size =read (buf_fd, data, toread * scan_size);if (read_size <0 ) {if (errno ==EAGAIN ) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 229/289 ASoC: hda: intel-dsp-config: add ES83x6 quirk for IceLake
In reply to Greg Kroah-HartmanFrom: Pierre-Louis Bossart <[email protected]>
[ Upstream commit 5d73263f9e7c54ccb20814dc50809b9deb9e2bc7 ]
Yet another hardware variant we need to handle.
--- sound/hda/intel-dsp-config.c | 5 +++++ 1 file changed, 5 insertions(+)
sound/hda/intel-dsp-config.c +5 -0
@@ -320,6 +320,11 @@ static const struct config_entry config_table[] = { {} } }, + { + .flags = FLAG_SOF, + .device = 0x34c8, + .codec_hid = &essx_83x6, + }, { .flags = FLAG_SOF | FLAG_SOF_ONLY_IF_DMIC_OR_SOUNDWIRE, .device = 0x34c8,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 230/289 ASoC: SOF: ipc3-topology: use old pipeline teardown flow with SOF2.1 and older
In reply to Greg Kroah-HartmanFrom: Kai Vehmanen <[email protected]>
[ Upstream commit 003b786b678919e072c2b12ffa73901ef840963e ]
Originally in commit b2ebcf42a48f ("ASoC: SOF: free widgets in sof_tear_down_pipelines() for static pipelines"), freeing of pipeline components at suspend was only done with recent FW as there were known limitations in older firmware versions.
Tests show that if static pipelines are used, i.e. all pipelines are setup whenever firmware is powered up, the reverse action of freeing all components at power down, leads to firmware failures with also SOF2.0 and SOF2.1 based firmware.
The problems can be specific to certain topologies with e.g. components not prepared to be freed at suspend (as this did not happen with older SOF kernels).
To avoid hitting these problems when kernel is upgraded and used with an older firmware, bump the firmware requirement to SOF2.2 or newer. If an older firmware is used, and pipeline is a static one, do not free the components at suspend. This ensures the suspend flow remains backwards compatible with older firmware versions. This limitation does not apply if the product configuration is updated to dynamic pipelines.
The limitation is not linked to firmware ABI, as the interface to free pipeline components has been available already before ABI3.19. The problem is in the implementation, so firmware version should be used to decide whether it is safe to use the newer flow or not. This patch adds a new SOF_FW_VER() macro to compare SOF firmware release versions.
--- include/sound/sof/info.h | 4 ++++ sound/soc/sof/ipc3-topology.c | 15 ++++++++++----- 2 files changed, 14 insertions(+), 5 deletions(-)
include/sound/sof/info.h +4 -0
@@ -36,6 +36,10 @@ enum sof_ipc_ext_data { SOF_IPC_EXT_USER_ABI_INFO = 4, }; +/* Build u32 number in format MMmmmppp */ +#define SOF_FW_VER (MAJOR ,MINOR ,PATCH ) ((uint32_t)( \ + ((MAJOR) << 24) | ((MINOR) << 12) | (PATCH))) +/* FW version - SOF_IPC_GLB_VERSION */ struct sof_ipc_fw_version {struct sof_ipc_hdr hdr;
sound/soc/sof/ipc3-topology.c +10 -5
@@ -2242,6 +2242,7 @@ static int sof_ipc3_tear_down_all_pipelines(struct snd_sof_dev *sdev, bool verifstruct sof_ipc_fw_version *v = &sdev->fw_ready.version;struct snd_sof_widget *swidget;struct snd_sof_route *sroute; +bool dyn_widgets = false;int ret;/*
@@ -2251,12 +2252,14 @@ static int sof_ipc3_tear_down_all_pipelines(struct snd_sof_dev *sdev, bool verif* topology loading the sound card unavailable to open PCMs. */ list_for_each_entry (swidget, &sdev->widget_list, list) { -if (swidget->dynamic_pipeline_widget) +if (swidget->dynamic_pipeline_widget) { + dyn_widgets = true;continue ; + } -/* Do not free widgets for static pipelines with FW ABI older than 3.19 */ +/* Do not free widgets for static pipelines with FW older than SOF2.2 */ if (!verify && !swidget->dynamic_pipeline_widget && - v->abi_version <SOF_ABI_VER (3 ,19 ,0 )) { +SOF_FW_VER (v->major, v->minor, v->micro) <SOF_FW_VER (2 ,2 ,0 )) { swidget->use_count =0 ; swidget->complete =0 ;continue ;
@@ -2270,9 +2273,11 @@ static int sof_ipc3_tear_down_all_pipelines(struct snd_sof_dev *sdev, bool verif/* * Tear down all pipelines associated with PCMs that did not get suspended * and unset the prepare flag so that they can be set up again during resume. -* Skip this step for older firmware. +* Skip this step for older firmware unless topology has any +* dynamic pipeline (in which case the step is mandatory). */ -if (!verify && v->abi_version >=SOF_ABI_VER (3 ,19 ,0 )) { +if (!verify && (dyn_widgets ||SOF_FW_VER (v->major, v->minor, v->micro) >= +SOF_FW_VER (2 ,2 ,0 ))) { ret =sof_tear_down_left_over_pipelines (sdev);if (ret <0 ) {dev_err (sdev->dev,"failed to tear down paused pipelines\n" );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 231/289 serial: 8250: 8250_omap: Avoid RS485 RTS glitch on ->set_termios()
In reply to Greg Kroah-HartmanFrom: Lukas Wunner <[email protected]>
[ Upstream commit 038ee49fef18710bedd38b531d173ccd746b2d8d ]
RS485-enabled UART ports on TI Sitara SoCs with active-low polarity exhibit a Transmit Enable glitch on ->set_termios():
omap8250_restore_regs(), which is called from omap_8250_set_termios(), sets the TCRTLR bit in the MCR register and clears all other bits, including RTS. If RTS uses active-low polarity, it is now asserted for no reason.
The TCRTLR bit is subsequently cleared by writing up->mcr to the MCR register. That variable is always zero, so the RTS bit is still cleared (incorrectly so if RTS is active-high).
(up->mcr is not, as one might think, a cache of the MCR register's current value. Rather, it only caches a single bit of that register, the AFE bit. And it only does so if the UART supports the AFE bit, which OMAP does not. For details see serial8250_do_set_termios() and serial8250_do_set_mctrl().)
Finally at the end of omap8250_restore_regs(), the MCR register is restored (and RTS deasserted) by a call to up->port.ops->set_mctrl() (which equals serial8250_set_mctrl()) and serial8250_em485_stop_tx().
So there's an RTS glitch between setting TCRTLR and calling serial8250_em485_stop_tx(). Avoid by using a read-modify-write when setting TCRTLR.
While at it, drop a redundant initialization of up->mcr. As explained above, the variable isn't used by the driver and it is already initialized to zero because it is part of the static struct serial8250_ports[] declared in 8250_core.c. (Static structs are initialized to zero per section 6.7.8 nr. 10 of the C99 standard.)
--- drivers/tty/serial/8250/8250_omap.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/tty/serial/8250/8250_omap.c +4 -3
@@ -293,6 +293,7 @@ static void omap8250_restore_regs(struct uart_8250_port *up) {struct omap8250_priv *priv = up->port.private_data;struct uart_8250_dma *dma = up->dma; +u8 mcr =serial8250_in_MCR (up);if (dma && dma->tx_running) {/*
@@ -309,7 +310,7 @@ static void omap8250_restore_regs(struct uart_8250_port *up)serial_out (up,UART_EFR ,UART_EFR_ECB );serial_out (up,UART_LCR ,UART_LCR_CONF_MODE_A ); -serial8250_out_MCR (up,UART_MCR_TCRTLR ); +serial8250_out_MCR (up, mcr |UART_MCR_TCRTLR );serial_out (up,UART_FCR , up->fcr);omap8250_update_scr (up, priv);
@@ -325,7 +326,8 @@ static void omap8250_restore_regs(struct uart_8250_port *up)serial_out (up,UART_LCR ,0 );/* drop TCR + TLR access, we setup XON/XOFF later */ -serial8250_out_MCR (up, up->mcr); +serial8250_out_MCR (up, mcr); +serial_out (up,UART_IER , up->ier);serial_out (up,UART_LCR ,UART_LCR_CONF_MODE_B );
@@ -670,7 +672,6 @@ static int omap_8250_startup(struct uart_port *port)pm_runtime_get_sync (port->dev); - up->mcr =0 ;serial_out (up,UART_FCR ,UART_FCR_CLEAR_RCVR |UART_FCR_CLEAR_XMIT );serial_out (up,UART_LCR ,UART_LCR_WLEN8 );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 232/289 Revert "tty: n_gsm: avoid call of sleeping functions from atomic context"
In reply to Greg Kroah-HartmanFrom: Fedor Pchelkin <[email protected]>
[ Upstream commit acdab4cb4ba7e5f94d2b422ebd7bf4bf68178fb2 ]
This reverts commit 902e02ea9385373ce4b142576eef41c642703955.
The above commit is reverted as the usage of tx_mutex seems not to solve the problem described in 902e02ea9385 ("tty: n_gsm: avoid call of sleeping functions from atomic context") and just moves the bug to another place.
--- drivers/tty/n_gsm.c | 53 +++++++++++++++++++++++++-------------------- 1 file changed, 29 insertions(+), 24 deletions(-)
drivers/tty/n_gsm.c +29 -24
@@ -248,7 +248,7 @@ struct gsm_mux {bool constipated;/* Asked by remote to shut up */ bool has_devices;/* Devices were registered */ -struct mutex tx_mutex; +spinlock_t tx_lock;unsigned int tx_bytes;/* TX data outstanding */ #define TX_THRESH_HI 8192#define TX_THRESH_LO 2048
@@ -680,6 +680,7 @@ static int gsm_send(struct gsm_mux *gsm, int addr, int cr, int control)struct gsm_msg *msg;u8 *dp;int ocr; +unsigned long flags; msg =gsm_data_alloc (gsm, addr,0 , control);if (!msg)
@@ -701,10 +702,10 @@ static int gsm_send(struct gsm_mux *gsm, int addr, int cr, int control)gsm_print_packet ("Q->" , addr, cr, control,NULL ,0 ); -mutex_lock (&gsm->tx_mutex); +spin_lock_irqsave (&gsm->tx_lock, flags);list_add_tail (&msg->list, &gsm->tx_ctrl_list); gsm->tx_bytes += msg->len; -mutex_unlock (&gsm->tx_mutex); +spin_unlock_irqrestore (&gsm->tx_lock, flags);gsmld_write_trigger (gsm);return 0 ;
@@ -729,7 +730,7 @@ static void gsm_dlci_clear_queues(struct gsm_mux *gsm, struct gsm_dlci *dlci)spin_unlock_irqrestore (&dlci->lock, flags);/* Clear data packets in MUX write queue */ -mutex_lock (&gsm->tx_mutex); +spin_lock_irqsave (&gsm->tx_lock, flags);list_for_each_entry_safe (msg, nmsg, &gsm->tx_data_list, list) {if (msg->addr != addr)continue ;
@@ -737,7 +738,7 @@ static void gsm_dlci_clear_queues(struct gsm_mux *gsm, struct gsm_dlci *dlci)list_del (&msg->list);kfree (msg); } -mutex_unlock (&gsm->tx_mutex); +spin_unlock_irqrestore (&gsm->tx_lock, flags); }/**
@@ -1023,9 +1024,10 @@ static void __gsm_data_queue(struct gsm_dlci *dlci, struct gsm_msg *msg)static void gsm_data_queue (struct gsm_dlci *dlci,struct gsm_msg *msg) { -mutex_lock (&dlci->gsm->tx_mutex); +unsigned long flags; +spin_lock_irqsave (&dlci->gsm->tx_lock, flags);__gsm_data_queue (dlci, msg); -mutex_unlock (&dlci->gsm->tx_mutex); +spin_unlock_irqrestore (&dlci->gsm->tx_lock, flags); }/**
@@ -1037,7 +1039,7 @@ static void gsm_data_queue(struct gsm_dlci *dlci, struct gsm_msg *msg)* is data. Keep to the MRU of the mux. This path handles the usual tty * interface which is a byte stream with optional modem data. * -* Caller must hold the tx_mutex of the mux. +* Caller must hold the tx_lock of the mux. */ static int gsm_dlci_data_output (struct gsm_mux *gsm,struct gsm_dlci *dlci)
@@ -1097,7 +1099,7 @@ static int gsm_dlci_data_output(struct gsm_mux *gsm, struct gsm_dlci *dlci)* is data. Keep to the MRU of the mux. This path handles framed data * queued as skbuffs to the DLCI. * -* Caller must hold the tx_mutex of the mux. +* Caller must hold the tx_lock of the mux. */ static int gsm_dlci_data_output_framed(struct gsm_mux *gsm,
@@ -1113,7 +1115,7 @@ static int gsm_dlci_data_output_framed(struct gsm_mux *gsm,if (dlci->adaption ==4 ) overhead =1 ; -/* dlci->skb is locked by tx_mutex */ +/* dlci->skb is locked by tx_lock */ if (dlci->skb ==NULL ) { dlci->skb =skb_dequeue_tail (&dlci->skb_list);if (dlci->skb ==NULL )
@@ -1167,7 +1169,7 @@ static int gsm_dlci_data_output_framed(struct gsm_mux *gsm,* Push an empty frame in to the transmit queue to update the modem status * bits and to transmit an optional break. * -* Caller must hold the tx_mutex of the mux. +* Caller must hold the tx_lock of the mux. */ static int gsm_dlci_modem_output(struct gsm_mux *gsm, struct gsm_dlci *dlci,
@@ -1281,12 +1283,13 @@ static int gsm_dlci_data_sweep(struct gsm_mux *gsm)static void gsm_dlci_data_kick (struct gsm_dlci *dlci) { +unsigned long flags;int sweep;if (dlci->constipated)return ; -mutex_lock (&dlci->gsm->tx_mutex); +spin_lock_irqsave (&dlci->gsm->tx_lock, flags);/* If we have nothing running then we need to fire up */ sweep = (dlci->gsm->tx_bytes <TX_THRESH_LO );if (dlci->gsm->tx_bytes ==0 ) {
@@ -1297,7 +1300,7 @@ static void gsm_dlci_data_kick(struct gsm_dlci *dlci) }if (sweep)gsm_dlci_data_sweep (dlci->gsm); -mutex_unlock (&dlci->gsm->tx_mutex); +spin_unlock_irqrestore (&dlci->gsm->tx_lock, flags); }/*
@@ -1991,13 +1994,14 @@ static void gsm_dlci_command(struct gsm_dlci *dlci, const u8 *data, int len)static void gsm_kick_timeout (struct work_struct *work) { struct gsm_mux *gsm = container_of(work, struct gsm_mux, kick_timeout.work); +unsigned long flags;int sent =0 ; -mutex_lock (&gsm->tx_mutex); +spin_lock_irqsave (&gsm->tx_lock, flags);/* If we have nothing running then we need to fire up */ if (gsm->tx_bytes <TX_THRESH_LO ) sent =gsm_dlci_data_sweep (gsm); -mutex_unlock (&gsm->tx_mutex); +spin_unlock_irqrestore (&gsm->tx_lock, flags);if (sent && debug &4 )pr_info ("%s TX queue stalled\n" , __func__);
@@ -2527,7 +2531,6 @@ static void gsm_free_mux(struct gsm_mux *gsm)break ; } } -mutex_destroy (&gsm->tx_mutex);mutex_destroy (&gsm->mutex);kfree (gsm->txframe);kfree (gsm->buf);
@@ -2599,7 +2602,6 @@ static struct gsm_mux *gsm_alloc_mux(void) }spin_lock_init (&gsm->lock);mutex_init (&gsm->mutex); -mutex_init (&gsm->tx_mutex);kref_init (&gsm->ref);INIT_LIST_HEAD (&gsm->tx_ctrl_list);INIT_LIST_HEAD (&gsm->tx_data_list);
@@ -2608,6 +2610,7 @@ static struct gsm_mux *gsm_alloc_mux(void)INIT_WORK (&gsm->tx_work, gsmld_write_task);init_waitqueue_head (&gsm->event);spin_lock_init (&gsm->control_lock); +spin_lock_init (&gsm->tx_lock); gsm->t1 =T1 ; gsm->t2 =T2 ;
@@ -2632,7 +2635,6 @@ static struct gsm_mux *gsm_alloc_mux(void) }spin_unlock (&gsm_mux_lock);if (i ==MAX_MUX ) { -mutex_destroy (&gsm->tx_mutex);mutex_destroy (&gsm->mutex);kfree (gsm->txframe);kfree (gsm->buf);
@@ -2788,16 +2790,17 @@ static void gsmld_write_trigger(struct gsm_mux *gsm)static void gsmld_write_task (struct work_struct *work) { struct gsm_mux *gsm = container_of(work, struct gsm_mux, tx_work); +unsigned long flags;int i, ret;/* All outstanding control channel and control messages and one data * frame is sent. */ ret = -ENODEV ; -mutex_lock (&gsm->tx_mutex); +spin_lock_irqsave (&gsm->tx_lock, flags);if (gsm->tty) ret =gsm_data_kick (gsm); -mutex_unlock (&gsm->tx_mutex); +spin_unlock_irqrestore (&gsm->tx_lock, flags);if (ret >=0 )for (i =0 ; i <NUM_DLCI ; i++)
@@ -3005,6 +3008,7 @@ static ssize_t gsmld_write(struct tty_struct *tty, struct file *file, const unsigned char *buf, size_t nr) {struct gsm_mux *gsm = tty->disc_data; +unsigned long flags;int space;int ret;
@@ -3012,13 +3016,13 @@ static ssize_t gsmld_write(struct tty_struct *tty, struct file *file,return -ENODEV ; ret = -ENOBUFS ; -mutex_lock (&gsm->tx_mutex); +spin_lock_irqsave (&gsm->tx_lock, flags); space =tty_write_room (tty);if (space >= nr) ret = tty->ops->write (tty, buf, nr);else set_bit (TTY_DO_WRITE_WAKEUP , &tty->flags); -mutex_unlock (&gsm->tx_mutex); +spin_unlock_irqrestore (&gsm->tx_lock, flags);return ret; }
@@ -3315,13 +3319,14 @@ static struct tty_ldisc_ops tty_ldisc_packet = {static void gsm_modem_upd_via_data (struct gsm_dlci *dlci,u8 brk) {struct gsm_mux *gsm = dlci->gsm; +unsigned long flags;if (dlci->state !=DLCI_OPEN || dlci->adaption !=2 )return ; -mutex_lock (&gsm->tx_mutex); +spin_lock_irqsave (&gsm->tx_lock, flags);gsm_dlci_modem_output (gsm, dlci, brk); -mutex_unlock (&gsm->tx_mutex); +spin_unlock_irqrestore (&gsm->tx_lock, flags); }/**
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 233/289 Revert "tty: n_gsm: replace kicktimer with delayed_work"
In reply to Greg Kroah-HartmanFrom: Fedor Pchelkin <[email protected]>
[ Upstream commit 15743ae50e04aa907131e3ae8d66e9a2964ea232 ]
This reverts commit c9ab053e56ce13a949977398c8edc12e6c02fc95.
The above commit is reverted as it was a prerequisite for tx_mutex introduction and tx_mutex has been removed as it does not correctly work in order to protect tx data.
--- drivers/tty/n_gsm.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/tty/n_gsm.c +8 -8
@@ -256,7 +256,7 @@ struct gsm_mux {struct list_head tx_data_list;/* Pending data packets */ /* Control messages */ -struct delayed_work kick_timeout;/* Kick TX queuing on timeout */ +struct timer_list kick_timer;/* Kick TX queuing on timeout */ struct timer_list t2_timer;/* Retransmit timer for commands */ int cretries;/* Command retry counter */ struct gsm_control *pending_cmd;/* Our current pending command */
@@ -1009,7 +1009,7 @@ static void __gsm_data_queue(struct gsm_dlci *dlci, struct gsm_msg *msg) gsm->tx_bytes += msg->len;gsmld_write_trigger (gsm); -schedule_delayed_work (&gsm->kick_timeout,10 * gsm->t1 *HZ /100 ); +mod_timer (&gsm->kick_timer, jiffies +10 * gsm->t1 *HZ /100 ); }/**
@@ -1984,16 +1984,16 @@ static void gsm_dlci_command(struct gsm_dlci *dlci, const u8 *data, int len) }/** -* gsm_kick_timeout - transmit if possible -* @work: work contained in our gsm object +* gsm_kick_timer - transmit if possible +* @t: timer contained in our gsm object * * Transmit data from DLCIs if the queue is empty. We can't rely on * a tty wakeup except when we filled the pipe so we need to fire off * new data ourselves in other cases. */ -static void gsm_kick_timeout (struct work_struct *work) +static void gsm_kick_timer (struct timer_list *t) { - struct gsm_mux *gsm = container_of(work, struct gsm_mux, kick_timeout.work); +struct gsm_mux *gsm =from_timer (gsm, t, kick_timer);unsigned long flags;int sent =0 ;
@@ -2458,7 +2458,7 @@ static void gsm_cleanup_mux(struct gsm_mux *gsm, bool disc) }/* Finish outstanding timers, making sure they are done */ -cancel_delayed_work_sync (&gsm->kick_timeout); +del_timer_sync (&gsm->kick_timer);del_timer_sync (&gsm->t2_timer);/* Finish writing to ldisc */
@@ -2605,7 +2605,7 @@ static struct gsm_mux *gsm_alloc_mux(void)kref_init (&gsm->ref);INIT_LIST_HEAD (&gsm->tx_ctrl_list);INIT_LIST_HEAD (&gsm->tx_data_list); -INIT_DELAYED_WORK (&gsm->kick_timeout, gsm_kick_timeout); +timer_setup (&gsm->kick_timer, gsm_kick_timer,0 );timer_setup (&gsm->t2_timer, gsm_control_retransmit,0 );INIT_WORK (&gsm->tx_work, gsmld_write_task);init_waitqueue_head (&gsm->event);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 234/289 Input: goodix - try resetting the controller when no config is set
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit c7e37cc6240767f794678d11704935d49cc81d59 ]
On ACPI systems (irq_pin_access_method == IRQ_PIN_ACCESS_ACPI_*) the driver does not reset the controller at probe time, because sometimes the system firmware loads a config and resetting might loose this config.
On the Nanote UMPC-01 device OTOH the config is in flash of the controller, the controller needs a reset to load this; and the system firmware does not reset the controller on a cold boot.
To fix the Nanote UMPC-01 touchscreen not working on a cold boot, try resetting the controller and then re-reading the config when encountering a config with 0 width/height/max_touch_num value and the controller has not already been reset by goodix_ts_probe().
This should be safe to do in general because normally we should never encounter a config with 0 width/height/max_touch_num. Doing this in general not only avoids the need for a DMI quirk, but also might help other systems.
--- drivers/input/touchscreen/goodix.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/input/touchscreen/goodix.c +11 -0
@@ -1158,6 +1158,7 @@ static int goodix_configure_dev(struct goodix_ts_data *ts)input_set_abs_params (ts->input_dev,ABS_MT_WIDTH_MAJOR ,0 ,255 ,0 ,0 );input_set_abs_params (ts->input_dev,ABS_MT_TOUCH_MAJOR ,0 ,255 ,0 ,0 ); +retry_read_config:/* Read configuration and apply touchscreen parameters */ goodix_read_config (ts);
@@ -1165,6 +1166,16 @@ static int goodix_configure_dev(struct goodix_ts_data *ts)touchscreen_parse_properties (ts->input_dev, true, &ts->prop);if (!ts->prop.max_x || !ts->prop.max_y || !ts->max_touch_num) { +if (!ts->reset_controller_at_probe && + ts->irq_pin_access_method !=IRQ_PIN_ACCESS_NONE ) { +dev_info (&ts->client->dev,"Config not set, resetting controller\n" ); +/* Retry after a controller reset */ + ts->reset_controller_at_probe = true; + error =goodix_reset (ts); +if (error) +return error; + goto retry_read_config; + }dev_err (&ts->client->dev,"Invalid config (%d, %d, %d), using defaults\n" , ts->prop.max_x, ts->prop.max_y, ts->max_touch_num);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 235/289 bpf: Convert BPF_DISPATCHER to use static_call() (not ftrace)
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
[ Upstream commit c86df29d11dfba27c0a1f5039cd6fe387fbf4239 ]
The dispatcher function is currently abusing the ftrace __fentry__ call location for its own purposes -- this obviously gives trouble when the dispatcher and ftrace are both in use.
A previous solution tried using __attribute__((patchable_function_entry())) which works, except it is GCC-8+ only, breaking the build on the earlier still supported compilers. Instead use static_call() -- which has its own annotations and does not conflict with ftrace -- to rewrite the dispatch function.
By using: return static_call()(ctx, insni, bpf_func) you get a perfect forwarding tail call as function body (iow a single jmp instruction). By having the default static_call() target be bpf_dispatcher_nop_func() it retains the default behaviour (an indirect call to the argument function). Only once a dispatcher program is attached is the target rewritten to directly call the JIT'ed image.
--- include/linux/bpf.h | 39 ++++++++++++++++++++++++++++++++++++++- kernel/bpf/dispatcher.c | 22 ++++++++-------------- 2 files changed, 46 insertions(+), 15 deletions(-)
include/linux/bpf.h +38 -1
@@ -27,6 +27,7 @@#include <linux/bpfptr.h> #include <linux/btf.h> #include <linux/rcupdate_trace.h> +#include <linux/static_call.h> struct bpf_verifier_env ;struct bpf_verifier_log ;
@@ -894,6 +895,10 @@ struct bpf_dispatcher {void *rw_image;u32 image_off;struct bpf_ksym ksym; +#ifdef CONFIG_HAVE_STATIC_CALL +struct static_call_key *sc_key; +void *sc_tramp; +#endif }; static __always_inline __nocfi unsigned int bpf_dispatcher_nop_func(
@@ -911,6 +916,34 @@ struct bpf_trampoline *bpf_trampoline_get(u64 key, struct bpf_attach_target_info *tgt_info);void bpf_trampoline_put (struct bpf_trampoline *tr);int arch_prepare_bpf_dispatcher (void *image,void *buf,s64 *funcs,int num_funcs); + +/* +* When the architecture supports STATIC_CALL replace the bpf_dispatcher_fn +* indirection with a direct call to the bpf program. If the architecture does +* not have STATIC_CALL, avoid a double-indirection. +*/ +#ifdef CONFIG_HAVE_STATIC_CALL + +#define __BPF_DISPATCHER_SC_INIT (_name) \ + .sc_key = &STATIC_CALL_KEY(_name), \ + .sc_tramp = STATIC_CALL_TRAMP_ADDR(_name), + +#define __BPF_DISPATCHER_SC (name) \ + DEFINE_STATIC_CALL(bpf_dispatcher_##name##_call, bpf_dispatcher_nop_func) + +#define __BPF_DISPATCHER_CALL (name) \ + static_call(bpf_dispatcher_##name##_call)(ctx, insnsi, bpf_func) + +#define __BPF_DISPATCHER_UPDATE (_d, _new) \ + __static_call_update((_d)->sc_key, (_d)->sc_tramp, (_new)) + +#else +#define __BPF_DISPATCHER_SC_INIT (name) +#define __BPF_DISPATCHER_SC (name) +#define __BPF_DISPATCHER_CALL (name) bpf_func(ctx, insnsi) +#define __BPF_DISPATCHER_UPDATE (_d, _new) +#endif +#define BPF_DISPATCHER_INIT (_name) { \ .mutex = __MUTEX_INITIALIZER(_name.mutex), \ .func = &_name##_func, \
@@ -922,25 +955,29 @@ int arch_prepare_bpf_dispatcher(void *image, void *buf, s64 *funcs, int num_func .name = #_name, \ .lnode = LIST_HEAD_INIT(_name.ksym.lnode), \ }, \ + __BPF_DISPATCHER_SC_INIT(_name##_call) \ }#define DEFINE_BPF_DISPATCHER (name) \ + __BPF_DISPATCHER_SC(name); \ noinline __nocfi unsigned int bpf_dispatcher_##name##_func( \ const void *ctx, \ const struct bpf_insn *insnsi, \ bpf_func_t bpf_func) \ { \ - return bpf_func(ctx, insnsi); \ + return __BPF_DISPATCHER_CALL(name); \ } \ EXPORT_SYMBOL(bpf_dispatcher_##name##_func); \ struct bpf_dispatcher bpf_dispatcher_##name = \ BPF_DISPATCHER_INIT(bpf_dispatcher_##name); +#define DECLARE_BPF_DISPATCHER (name) \ unsigned int bpf_dispatcher_##name##_func( \ const void *ctx, \ const struct bpf_insn *insnsi, \ bpf_func_t bpf_func); \ extern struct bpf_dispatcher bpf_dispatcher_##name; +#define BPF_DISPATCHER_FUNC (name) bpf_dispatcher_##name##_func#define BPF_DISPATCHER_PTR (name) (&bpf_dispatcher_##name) void bpf_dispatcher_change_prog(struct bpf_dispatcher *d, struct bpf_prog *from,
kernel/bpf/dispatcher.c +8 -14
@@ -4,6 +4,7 @@#include <linux/hash.h> #include <linux/bpf.h> #include <linux/filter.h> +#include <linux/static_call.h> /* The BPF dispatcher is a multiway branch code generator. The * dispatcher is a mechanism to avoid the performance penalty of an
@@ -104,17 +105,11 @@ static int bpf_dispatcher_prepare(struct bpf_dispatcher *d, void *image, void *bstatic void bpf_dispatcher_update (struct bpf_dispatcher *d,int prev_num_progs) { -void *old, *new, *tmp; -u32 noff; -int err; - -if (!prev_num_progs) { - old =NULL ; - noff =0 ; - }else { - old = d->image + d->image_off; +void *new, *tmp; +u32 noff =0 ; + +if (prev_num_progs) noff = d->image_off ^ (PAGE_SIZE /2 ); - } new = d->num_progs ? d->image + noff :NULL ; tmp = d->num_progs ? d->rw_image + noff :NULL ;
@@ -128,11 +123,10 @@ static void bpf_dispatcher_update(struct bpf_dispatcher *d, int prev_num_progs)return ; } - err =bpf_arch_text_poke (d->func,BPF_MOD_JUMP , old, new); -if (err || !new) -return ; +__BPF_DISPATCHER_UPDATE (d, new ?: &bpf_dispatcher_nop_func); - d->image_off = noff; +if (new) + d->image_off = noff; } void bpf_dispatcher_change_prog(struct bpf_dispatcher *d, struct bpf_prog *from,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 236/289 ASoC: sof_es8336: reduce pop noise on speaker
In reply to Greg Kroah-HartmanFrom: Zhu Ning <[email protected]>
[ Upstream commit 89cdb224f2abe37ec4ac21ba0d9ddeb5a6a9cf68 ]
The Speaker GPIO needs to be turned on slightly behind the codec turned on. It also need to be turned off slightly before the codec turned down. Current code uses delay in DAPM_EVENT to do it but the mdelay delays the DAPM itself and thus has no effect. A delayed_work is added to turn on the speaker.
The Speaker is turned off in .trigger since trigger is called slightly before the DAPM events.
------------
v1: cancel delayed work while disabling speaker.
--- sound/soc/intel/boards/sof_es8336.c | 60 ++++++++++++++++++++++------- 1 file changed, 46 insertions(+), 14 deletions(-)
sound/soc/intel/boards/sof_es8336.c +46 -14
@@ -63,6 +63,7 @@ struct sof_es8336_private {struct snd_soc_jack jack;struct list_head hdmi_pcm_list;bool speaker_en; +struct delayed_work pcm_pop_work; };struct sof_hdmi_pcm {
@@ -111,6 +112,46 @@ static void log_quirks(struct device *dev)dev_info (dev,"quirk headset at mic1 port enabled\n" ); } +static void pcm_pop_work_events (struct work_struct *work) +{ +struct sof_es8336_private *priv = + container_of(work, struct sof_es8336_private, pcm_pop_work.work); + +gpiod_set_value_cansleep (priv->gpio_speakers, priv->speaker_en); + +if (quirk &SOF_ES8336_HEADPHONE_GPIO ) +gpiod_set_value_cansleep (priv->gpio_headphone, priv->speaker_en); + +} + +static int sof_8336_trigger (struct snd_pcm_substream *substream,int cmd) +{ +struct snd_soc_pcm_runtime *rtd =asoc_substream_to_rtd (substream); +struct snd_soc_card *card = rtd->card; +struct sof_es8336_private *priv =snd_soc_card_get_drvdata (card); + +switch (cmd) { +case SNDRV_PCM_TRIGGER_START : +case SNDRV_PCM_TRIGGER_PAUSE_RELEASE : +case SNDRV_PCM_TRIGGER_RESUME : +break ; + +case SNDRV_PCM_TRIGGER_PAUSE_PUSH : +case SNDRV_PCM_TRIGGER_SUSPEND : +case SNDRV_PCM_TRIGGER_STOP : +if (priv->speaker_en == false) +if (substream->stream ==0 ) { +cancel_delayed_work (&priv->pcm_pop_work); +gpiod_set_value_cansleep (priv->gpio_speakers, true); + } +break ; +default : +return -EINVAL ; + } + +return 0 ; +} +static int sof_es8316_speaker_power_event (struct snd_soc_dapm_widget *w,struct snd_kcontrol *kcontrol,int event) {
@@ -122,19 +163,7 @@ static int sof_es8316_speaker_power_event(struct snd_soc_dapm_widget *w, priv->speaker_en = !SND_SOC_DAPM_EVENT_ON (event); -if (SND_SOC_DAPM_EVENT_ON (event)) -msleep (70 ); - -gpiod_set_value_cansleep (priv->gpio_speakers, priv->speaker_en); - -if (!(quirk &SOF_ES8336_HEADPHONE_GPIO )) -return 0 ; - -if (SND_SOC_DAPM_EVENT_ON (event)) -msleep (70 ); - -gpiod_set_value_cansleep (priv->gpio_headphone, priv->speaker_en); - +queue_delayed_work (system_wq, &priv->pcm_pop_work,msecs_to_jiffies (70 ));return 0 ; }
@@ -344,6 +373,7 @@ static int sof_es8336_hw_params(struct snd_pcm_substream *substream,/* machine stream operations */ static struct snd_soc_ops sof_es8336_ops = { .hw_params = sof_es8336_hw_params, + .trigger = sof_8336_trigger, };static struct snd_soc_dai_link_component platform_component[] = {
@@ -722,7 +752,8 @@ static int sof_es8336_probe(struct platform_device *pdev) }INIT_LIST_HEAD (&priv->hdmi_pcm_list); - +INIT_DELAYED_WORK (&priv->pcm_pop_work, + pcm_pop_work_events);snd_soc_card_set_drvdata (card, priv);if (mach->mach_params.dmic_num >0 ) {
@@ -751,6 +782,7 @@ static int sof_es8336_remove(struct platform_device *pdev)struct snd_soc_card *card =platform_get_drvdata (pdev);struct sof_es8336_private *priv =snd_soc_card_get_drvdata (card); +cancel_delayed_work (&priv->pcm_pop_work);gpiod_put (priv->gpio_speakers);device_remove_software_node (priv->codec_dev);put_device (priv->codec_dev);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 237/289 Input: soc_button_array - add use_low_level_irq module parameter
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit 8e9ada1d0e72b4737df400fe1bba48dc42a68df7 ]
It seems that the Windows drivers for the ACPI0011 soc_button_array device use low level triggered IRQs rather then using edge triggering.
Some ACPI tables depend on this, directly poking the GPIO controller's registers to clear the trigger type when closing a laptop's/2-in-1's lid and re-instating the trigger when opening the lid again.
Linux sets the edge/level on which to trigger to both low+high since it is using edge type IRQs, the ACPI tables then ends up also setting the bit for level IRQs and since both low and high level have been selected by Linux we get an IRQ storm leading to soft lockups.
As a workaround for this the soc_button_array already contains a DMI quirk table with device models known to have this issue.
Add a module parameter for this so that users can easily test if their device is affected too and so that they can use the module parameter as a workaround.
--- drivers/input/misc/soc_button_array.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/input/misc/soc_button_array.c +6 -1
@@ -18,6 +18,10 @@#include <linux/gpio.h> #include <linux/platform_device.h> +static bool use_low_level_irq; +module_param (use_low_level_irq, bool,0444 ); +MODULE_PARM_DESC (use_low_level_irq,"Use low-level triggered IRQ instead of edge triggered" ); +struct soc_button_info {const char *name;int acpi_index;
@@ -164,7 +168,8 @@ soc_button_device_create(struct platform_device *pdev, }/* See dmi_use_low_level_irq[] comment */ -if (!autorepeat &&dmi_check_system (dmi_use_low_level_irq)) { +if (!autorepeat && (use_low_level_irq || +dmi_check_system (dmi_use_low_level_irq))) {irq_set_irq_type (irq,IRQ_TYPE_LEVEL_LOW ); gpio_keys[n_buttons].irq = irq; gpio_keys[n_buttons].gpio = -ENOENT ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 238/289 Input: soc_button_array - add Acer Switch V 10 to dmi_use_low_level_irq[]
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit e13757f52496444b994a7ac67b6e517a15d89bbc ]
Like on the Acer Switch 10 SW5-012, the Acer Switch V 10 SW5-017's _LID method messes with home- and power-button GPIO IRQ settings, causing an IRQ storm.
Add a quirk entry for the Acer Switch V 10 to the dmi_use_low_level_irq[] DMI quirk list, to use low-level IRQs on this model, fixing the IRQ storm.
--- drivers/input/misc/soc_button_array.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/input/misc/soc_button_array.c +7 -0
@@ -77,6 +77,13 @@ static const struct dmi_system_id dmi_use_low_level_irq[] = { DMI_MATCH(DMI_PRODUCT_NAME, "Aspire SW5-012"), }, }, + { +/* Acer Switch V 10 SW5-017, same issue as Acer Switch 10 SW5-012. */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), + DMI_MATCH(DMI_PRODUCT_NAME, "SW5-017"), + }, + }, {/* * Acer One S1003. _LID method messes with power-button GPIO
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 239/289 pinctrl: qcom: sc8280xp: Rectify UFS reset pins
In reply to Greg Kroah-HartmanFrom: Anjana Hari <[email protected]>
[ Upstream commit f04a2862f9c3f64962b8709c75d788efba6df26b ]
UFS reset pin offsets are wrongly configured for SC8280XP, correcting the same for both UFS instances here.
--- drivers/pinctrl/qcom/pinctrl-sc8280xp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pinctrl/qcom/pinctrl-sc8280xp.c +2 -2
@@ -1873,8 +1873,8 @@ static const struct msm_pingroup sc8280xp_groups[] = { [225] = PINGROUP(225, hs3_mi2s, phase_flag, _, _, _, _, egpio), [226] = PINGROUP(226, hs3_mi2s, phase_flag, _, _, _, _, egpio), [227] = PINGROUP(227, hs3_mi2s, phase_flag, _, _, _, _, egpio), - [228] = UFS_RESET(ufs_reset, 0xf1004), - [229] = UFS_RESET(ufs1_reset, 0xf3004), + [228] = UFS_RESET(ufs_reset, 0xf1000), + [229] = UFS_RESET(ufs1_reset, 0xf3000), [230] = SDC_QDSD_PINGROUP(sdc2_clk, 0xe8000, 14, 6), [231] = SDC_QDSD_PINGROUP(sdc2_cmd, 0xe8000, 11, 3), [232] = SDC_QDSD_PINGROUP(sdc2_data, 0xe8000, 9, 0),
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 240/289 Input: i8042 - apply probe defer to more ASUS ZenBook models
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
[ Upstream commit 26c263bf1847d4dadba016a0457c4c5f446407bf ]
There are yet a few more ASUS ZenBook models that require the deferred probe. At least, there are different ZenBook UX325x and UX425x models. Let's extend the DMI matching table entries for adapting those missing models.
--- drivers/input/serio/i8042-x86ia64io.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/input/serio/i8042-x86ia64io.h +4 -4
@@ -114,18 +114,18 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = { .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_NEVER) }, { - /* ASUS ZenBook UX425UA */ + /* ASUS ZenBook UX425UA/QA */ .matches = { DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), - DMI_MATCH(DMI_PRODUCT_NAME, "ZenBook UX425UA"), + DMI_MATCH(DMI_PRODUCT_NAME, "ZenBook UX425"), }, .driver_data = (void *)(SERIO_QUIRK_PROBE_DEFER | SERIO_QUIRK_RESET_NEVER) }, { - /* ASUS ZenBook UM325UA */ + /* ASUS ZenBook UM325UA/QA */ .matches = { DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), - DMI_MATCH(DMI_PRODUCT_NAME, "ZenBook UX325UA_UM325UA"), + DMI_MATCH(DMI_PRODUCT_NAME, "ZenBook UX325"), }, .driver_data = (void *)(SERIO_QUIRK_PROBE_DEFER | SERIO_QUIRK_RESET_NEVER) },
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 241/289 ASoC: stm32: dfsdm: manage cb buffers cleanup
In reply to Greg Kroah-HartmanFrom: Olivier Moysan <[email protected]>
[ Upstream commit 7d945b046be3d2605dbb1806e73095aadd7ae129 ]
Ensure that resources allocated by iio_channel_get_all_cb() are released on driver unbind.
--- sound/soc/stm/stm32_adfsdm.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
sound/soc/stm/stm32_adfsdm.c +11 -0
@@ -304,6 +304,11 @@ static int stm32_adfsdm_dummy_cb(const void *data, void *private)return 0 ; } +static void stm32_adfsdm_cleanup (void *data) +{ +iio_channel_release_all_cb (data); +} +static struct snd_soc_component_driver stm32_adfsdm_soc_platform = { .open = stm32_adfsdm_pcm_open, .close = stm32_adfsdm_pcm_close,
@@ -350,6 +355,12 @@ static int stm32_adfsdm_probe(struct platform_device *pdev)if (IS_ERR (priv->iio_cb))return PTR_ERR (priv->iio_cb); + ret =devm_add_action_or_reset (&pdev->dev, stm32_adfsdm_cleanup, priv->iio_cb); +if (ret <0 ) { +dev_err (&pdev->dev,"Unable to add action\n" ); +return ret; + } + component =devm_kzalloc (&pdev->dev,sizeof (*component),GFP_KERNEL );if (!component)return -ENOMEM ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 242/289 xen-pciback: Allow setting PCI_MSIX_FLAGS_MASKALL too
In reply to Greg Kroah-HartmanFrom: Marek Marczykowski-Górecki <[email protected]>
[ Upstream commit 5e29500eba2aa19e1323df46f64dafcd4a327092 ]
When Xen domain configures MSI-X, the usual approach is to enable MSI-X together with masking all of them via the config space, then fill the table and only then clear PCI_MSIX_FLAGS_MASKALL. Allow doing this via QEMU running in a stub domain.
Previously, when changing PCI_MSIX_FLAGS_MASKALL was not allowed, the whole write was aborted, preventing change to the PCI_MSIX_FLAGS_ENABLE bit too.
Note the Xen hypervisor intercepts this write anyway, and may keep the PCI_MSIX_FLAGS_MASKALL bit set if it wishes to. It will store the guest-requested state and will apply it eventually.
--- drivers/xen/xen-pciback/conf_space_capability.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/xen/xen-pciback/conf_space_capability.c +6 -3
@@ -190,13 +190,16 @@ static const struct config_field caplist_pm[] = { };static struct msi_msix_field_config { -u16 enable_bit;/* bit for enabling MSI/MSI-X */ -unsigned int int_type;/* interrupt type for exclusiveness check */ +u16 enable_bit;/* bit for enabling MSI/MSI-X */ +u16 allowed_bits;/* bits allowed to be changed */ +unsigned int int_type;/* interrupt type for exclusiveness check */ } msi_field_config = { .enable_bit =PCI_MSI_FLAGS_ENABLE , + .allowed_bits =PCI_MSI_FLAGS_ENABLE , .int_type =INTERRUPT_TYPE_MSI , }, msix_field_config = { .enable_bit =PCI_MSIX_FLAGS_ENABLE , + .allowed_bits =PCI_MSIX_FLAGS_ENABLE |PCI_MSIX_FLAGS_MASKALL , .int_type =INTERRUPT_TYPE_MSIX , };
@@ -229,7 +232,7 @@ static int msi_msix_flags_write(struct pci_dev *dev, int offset, u16 new_value,return 0 ;if (!dev_data->allow_interrupt_control || - (new_value ^ old_value) & ~field_config->enable_bit) + (new_value ^ old_value) & ~field_config->allowed_bits)return PCIBIOS_SET_FAILED ;if (new_value & field_config->enable_bit) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 243/289 xen/platform-pci: add missing free_irq() in error path
In reply to Greg Kroah-HartmanFrom: ruanjinjie <[email protected]>
[ Upstream commit c53717e1e3f0d0f9129b2e0dbc6dcc5e0a8132e9 ]
free_irq() is missing in case of error in platform_pci_probe(), fix that.
--- drivers/xen/platform-pci.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/xen/platform-pci.c +5 -2
@@ -144,7 +144,7 @@ static int platform_pci_probe(struct pci_dev *pdev,if (ret) {dev_warn (&pdev->dev,"Unable to set the evtchn callback " "err=%d\n" , ret); - goto out; + goto irq_out; } }
@@ -152,13 +152,16 @@ static int platform_pci_probe(struct pci_dev *pdev, grant_frames =alloc_xen_mmio (PAGE_SIZE * max_nr_gframes); ret =gnttab_setup_auto_xlat_frames (grant_frames);if (ret) - goto out; + goto irq_out; ret =gnttab_init ();if (ret) goto grant_out;return 0 ; grant_out:gnttab_free_auto_xlat_frames (); +irq_out: +if (!xen_have_vector_callback) +free_irq (pdev->irq, pdev); out:pci_release_region (pdev,0 ); mem_out:
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 244/289 platform/x86: thinkpad_acpi: Enable s2idle quirk for 21A1 machine type
In reply to Greg Kroah-HartmanFrom: Lennard Gäher <[email protected]>
[ Upstream commit 53e16a6e3e69425081f8352e13e9fd23bf1abfca ]
Previously, the s2idle quirk was only active for the 21A0 machine type of the P14s Gen2a product. This also enables it for the second 21A1 type, thus reducing wake-up times from s2idle.
--- drivers/platform/x86/thinkpad_acpi.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/platform/x86/thinkpad_acpi.c +8 -0
@@ -4497,6 +4497,14 @@ static const struct dmi_system_id fwbug_list[] __initconst = { DMI_MATCH(DMI_PRODUCT_NAME, "21A0"), } }, + { + .ident = "P14s Gen2 AMD", + .driver_data = &quirk_s2idle_bug, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "21A1"), + } + }, {} };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 245/289 platform/x86: asus-wmi: add missing pci_dev_put() in asus_wmi_set_xusb2pr()
In reply to Greg Kroah-HartmanFrom: Xiongfeng Wang <[email protected]>
[ Upstream commit d0cdd85046b15089df71a50548617ac1025300d0 ]
pci_get_device() will increase the reference count for the returned pci_dev. We need to use pci_dev_put() to decrease the reference count before asus_wmi_set_xusb2pr() returns.
--- drivers/platform/x86/asus-wmi.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/platform/x86/asus-wmi.c +2 -0
@@ -1656,6 +1656,8 @@ static void asus_wmi_set_xusb2pr(struct asus_wmi *asus)pci_write_config_dword (xhci_pdev,USB_INTEL_XUSB2PR ,cpu_to_le32 (ports_available)); +pci_dev_put (xhci_pdev); +pr_info ("set USB_INTEL_XUSB2PR old: 0x%04x, new: 0x%04x\n" , orig_ports_available, ports_available); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 246/289 platform/x86: acer-wmi: Enable SW_TABLET_MODE on Switch V 10 (SW5-017)
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit 1e817b889c7d8c14e7005258e15fec62edafe03c ]
Like the Acer Switch 10 (SW5-012) and Acer Switch 10 (S1003) models the Acer Switch V 10 (SW5-017) supports reporting SW_TABLET_MODE through acer-wmi.
Add a DMI quirk for the SW5-017 setting force_caps to ACER_CAP_KBD_DOCK (these devices have no other acer-wmi based functionality).
--- drivers/platform/x86/acer-wmi.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/platform/x86/acer-wmi.c +9 -0
@@ -564,6 +564,15 @@ static const struct dmi_system_id acer_quirks[] __initconst = { }, .driver_data = (void *)ACER_CAP_KBD_DOCK, }, + { + .callback = set_force_caps, + .ident = "Acer Aspire Switch V 10 SW5-017", + .matches = { +DMI_EXACT_MATCH (DMI_SYS_VENDOR ,"Acer" ), + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "SW5-017"), + }, + .driver_data = (void *)ACER_CAP_KBD_DOCK, + }, { .callback = set_force_caps, .ident = "Acer One 10 (S1003)",
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 247/289 platform/surface: aggregator_registry: Add support for Surface Pro 9
In reply to Greg Kroah-HartmanFrom: Maximilian Luz <[email protected]>
[ Upstream commit d076f30957b1d026e9f6340691624926db0d369d ]
Add device nodes to enable support for battery and charger status, the ACPI platform profile, as well as internal and type-cover HID devices (including sensors, touchpad, keyboard, and other miscellaneous devices) on the Surface Pro 9.
This does not include support for a tablet-mode switch yet, as that is now handled via the POS subsystem (unlike the Surface Pro 8, where it is handled via the KIP subsystem) and therefore needs further changes.
While we're at it, also add the missing comment for the Surface Pro 8.
--- .../surface/surface_aggregator_registry.c | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+)
drivers/platform/surface/surface_aggregator_registry.c +21 -0
@@ -268,6 +268,7 @@ static const struct software_node *ssam_node_group_sp7[] = { NULL, }; +/* Devices for Surface Pro 8 */ static const struct software_node *ssam_node_group_sp8[] = { &ssam_node_root, &ssam_node_hub_kip,
@@ -284,6 +285,23 @@ static const struct software_node *ssam_node_group_sp8[] = { NULL, }; +/* Devices for Surface Pro 9 */ +static const struct software_node *ssam_node_group_sp9[] = { + &ssam_node_root, + &ssam_node_hub_kip, + &ssam_node_bat_ac, + &ssam_node_bat_main, + &ssam_node_tmp_pprof, +/* TODO: Tablet mode switch (via POS subsystem) */ + &ssam_node_hid_kip_keyboard, + &ssam_node_hid_kip_penstash, + &ssam_node_hid_kip_touchpad, + &ssam_node_hid_kip_fwupd, + &ssam_node_hid_sam_sensors, + &ssam_node_hid_sam_ucm_ucsi, +NULL , +}; +/* -- SSAM platform/meta-hub driver. ---------------------------------------- */
@@ -303,6 +321,9 @@ static const struct acpi_device_id ssam_platform_hub_match[] = {/* Surface Pro 8 */ { "MSHW0263", (unsigned long)ssam_node_group_sp8 }, +/* Surface Pro 9 */ + { "MSHW0343", (unsigned long)ssam_node_group_sp9 }, +/* Surface Book 2 */ { "MSHW0107", (unsigned long)ssam_node_group_gen5 },
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 248/289 drm/amd/display: use uclk pstate latency for fw assisted mclk validation dcn32
In reply to Greg Kroah-HartmanFrom: Dillon Varone <[email protected]>
[ Upstream commit c149947b188c651b943c1d8ca1494d1a98a3e27f ]
[WHY?]
DCN32 uses fclk pstate watermarks for dummy pstate, and must always be supported.
[HOW?]
Validation needs to be run with fclk pstate latency set
as the dummy pstate latency to get correct prefetch and bandwidth outputs.
--- .../gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c +15 -1
@@ -1700,6 +1700,12 @@ void dcn32_calculate_wm_and_dlg_fpu(struct dc *dc, struct dc_state *context,*/ context->bw_ctx.dml.soc.dram_clock_change_latency_us = dc->clk_mgr->bw_params->wm_table.nv_entries[WM_A ].dml_input.pstate_latency_us; +/* For DCN32/321 need to validate with fclk pstate change latency equal to dummy so +* prefetch is scheduled correctly to account for dummy pstate. +*/ +if (dummy_latency_index ==0 ) + context->bw_ctx.dml.soc.fclk_change_latency_us = + dc->clk_mgr->bw_params->dummy_pstate_table[dummy_latency_index].dummy_pstate_latency_us;dcn32_internal_validate_bw (dc, context, pipes, &pipe_cnt, &vlevel, false); maxMpcComb = context->bw_ctx.dml.vba.maxMpcComb; dcfclk = context->bw_ctx.dml.vba.DCFCLKState[vlevel][context->bw_ctx.dml.vba.maxMpcComb];
@@ -1879,6 +1885,10 @@ void dcn32_calculate_wm_and_dlg_fpu(struct dc *dc, struct dc_state *context, context->perf_params.stutter_period_us = context->bw_ctx.dml.vba.StutterPeriod; +if (context->bw_ctx.bw.dcn.clk.fw_based_mclk_switching && dummy_latency_index ==0 ) + context->bw_ctx.dml.soc.fclk_change_latency_us = + dc->clk_mgr->bw_params->dummy_pstate_table[dummy_latency_index].dummy_pstate_latency_us; +dcn32_calculate_dlg_params (dc, context, pipes, pipe_cnt, vlevel);if (!pstate_en)
@@ -1886,8 +1896,12 @@ void dcn32_calculate_wm_and_dlg_fpu(struct dc *dc, struct dc_state *context, context->bw_ctx.dml.soc.dram_clock_change_latency_us = dc->clk_mgr->bw_params->wm_table.nv_entries[WM_A ].dml_input.pstate_latency_us; -if (context->bw_ctx.bw.dcn.clk.fw_based_mclk_switching) +if (context->bw_ctx.bw.dcn.clk.fw_based_mclk_switching) {dcn30_setup_mclk_switch_using_fw_based_vblank_stretch (dc, context); +if (dummy_latency_index ==0 ) + context->bw_ctx.dml.soc.fclk_change_latency_us = + dc->clk_mgr->bw_params->wm_table.nv_entries[WM_A ].dml_input.fclk_change_latency_us; + } } static void dcn32_get_optimal_dcfclk_fclk_for_uclk(unsigned int uclk_mts,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 249/289 drm/amdgpu: disable BACO support on more cards
In reply to Greg Kroah-HartmanFrom: Guchun Chen <[email protected]>
[ Upstream commit 192039f12233c9063d040266e7c98188c7c89dec ]
Otherwise, some unexpected PCIE AER errors will be observed in runtime suspend/resume cycle.
--- drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c +4 -0
@@ -378,6 +378,10 @@ static void sienna_cichlid_check_bxco_support(struct smu_context *smu) ((adev->pdev->device ==0x73BF ) && (adev->pdev->revision ==0xCF )) || ((adev->pdev->device ==0x7422 ) && + (adev->pdev->revision ==0x00 )) || + ((adev->pdev->device ==0x73A3 ) && + (adev->pdev->revision ==0x00 )) || + ((adev->pdev->device ==0x73E3 ) && (adev->pdev->revision == 0x00))) smu_baco->platform_support = false;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 250/289 drm/amdkfd: Fix a memory limit issue
In reply to Greg Kroah-HartmanFrom: Eric Huang <[email protected]>
[ Upstream commit 6f9eea4392a178af19360694b1db64f985d0b459 ]
It is to resolve a regression, which fails to allocate VRAM due to no free memory in application, the reason is we add check of vram_pin_size for memory limit, and application is pinning the memory for Peerdirect, KFD should not count it in memory limit. So removing vram_pin_size will resolve it.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c +1 -3
@@ -170,9 +170,7 @@ int amdgpu_amdkfd_reserve_mem_limit(struct amdgpu_device *adev, (kfd_mem_limit.ttm_mem_used + ttm_mem_needed > kfd_mem_limit.max_ttm_mem_limit) || (adev && adev->kfd.vram_used + vram_needed > - adev->gmc.real_vram_size - -atomic64_read (&adev->vram_pin_size) - - reserved_for_pt)) { + adev->gmc.real_vram_size - reserved_for_pt)) { ret = -ENOMEM ; goto release; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 251/289 zonefs: fix zone report size in __zonefs_io_error()
In reply to Greg Kroah-HartmanFrom: Damien Le Moal <[email protected]>
[ Upstream commit 7dd12d65ac646046a3fe0bbf9a4e86f4514207b3 ]
When an IO error occurs, the function __zonefs_io_error() is used to issue a zone report to obtain the latest zone information from the device. This function gets a zone report for all zones used as storage for a file, which is always 1 zone except for files representing aggregated conventional zones.
The number of zones of a zone report for a file is calculated in __zonefs_io_error() by doing a bit-shift of the inode i_zone_size field, which is equal to or larger than the device zone size. However, this calculation does not take into account that the last zone of a zoned device may be smaller than the zone size reported by bdev_zone_sectors() (which is used to set the bit shift size). As a result, if an error occurs for an IO targetting such last smaller zone, the zone report will ask for 0 zones, leading to an invalid zone report.
Fix this by using the fact that all files require a 1 zone report, except if the inode i_zone_size field indicates a zone size larger than the device zone size. This exception case corresponds to a mount with aggregated conventional zones.
A check for this exception is added to the file inode initialization during mount. If an invalid setup is detected, emit an error and fail the mount (check contributed by Johannes Thumshirn).
--- fs/zonefs/super.c | 37 +++++++++++++++++++++++++++---------- 1 file changed, 27 insertions(+), 10 deletions(-)
fs/zonefs/super.c +27 -10
@@ -489,14 +489,22 @@ static void __zonefs_io_error(struct inode *inode, bool write)struct super_block *sb = inode->i_sb;struct zonefs_sb_info *sbi =ZONEFS_SB (sb);unsigned int noio_flag; -unsigned int nr_zones = - zi->i_zone_size >> (sbi->s_zone_sectors_shift +SECTOR_SHIFT ); +unsigned int nr_zones =1 ;struct zonefs_ioerr_data err = { .inode = inode, .write = write, };int ret; +/* +* The only files that have more than one zone are conventional zone +* files with aggregated conventional zones, for which the inode zone +* size is always larger than the device zone size. +*/ +if (zi->i_zone_size >bdev_zone_sectors (sb->s_bdev)) + nr_zones = zi->i_zone_size >> + (sbi->s_zone_sectors_shift +SECTOR_SHIFT ); +/* * Memory allocations in blkdev_report_zones() can trigger a memory * reclaim which may in turn cause a recursion into zonefs as well as
@@ -1418,6 +1426,14 @@ static int zonefs_init_file_inode(struct inode *inode, struct blk_zone *zone, zi->i_ztype = type; zi->i_zsector = zone->start; zi->i_zone_size = zone->len <<SECTOR_SHIFT ; +if (zi->i_zone_size >bdev_zone_sectors (sb->s_bdev) <<SECTOR_SHIFT && + !(sbi->s_features &ZONEFS_F_AGGRCNV )) { +zonefs_err (sb, +"zone size %llu doesn't match device's zone sectors %llu\n" , + zi->i_zone_size, +bdev_zone_sectors (sb->s_bdev) <<SECTOR_SHIFT ); +return -EINVAL ; + } zi->i_max_size =min_t (loff_t,MAX_LFS_FILESIZE , zone->capacity <<SECTOR_SHIFT );
@@ -1467,11 +1483,11 @@ static struct dentry *zonefs_create_inode(struct dentry *parent,struct inode *dir =d_inode (parent);struct dentry *dentry;struct inode *inode; -int ret; +int ret = -ENOMEM ; dentry =d_alloc_name (parent, name);if (!dentry) -return NULL ; +return ERR_PTR (ret); inode =new_inode (parent->d_sb);if (!inode)
@@ -1496,7 +1512,7 @@ static struct dentry *zonefs_create_inode(struct dentry *parent, dput:dput (dentry); -return NULL ; +return ERR_PTR (ret); }struct zonefs_zone_data {
@@ -1516,7 +1532,7 @@ static int zonefs_create_zgroup(struct zonefs_zone_data *zd,struct blk_zone *zone, *next, *end;const char *zgroup_name;char *file_name; -struct dentry *dir; +struct dentry *dir, *dent;unsigned int n =0 ;int ret;
@@ -1534,8 +1550,8 @@ static int zonefs_create_zgroup(struct zonefs_zone_data *zd, zgroup_name ="seq" ; dir =zonefs_create_inode (sb->s_root, zgroup_name,NULL , type); -if (!dir) { - ret = -ENOMEM ; +if (IS_ERR (dir)) { + ret =PTR_ERR (dir); goto free; }
@@ -1581,8 +1597,9 @@ static int zonefs_create_zgroup(struct zonefs_zone_data *zd,* Use the file number within its group as file name. */ snprintf (file_name,ZONEFS_NAME_MAX -1 ,"%u" , n); -if (!zonefs_create_inode (dir, file_name, zone, type)) { - ret = -ENOMEM ; + dent =zonefs_create_inode (dir, file_name, zone, type); +if (IS_ERR (dent)) { + ret =PTR_ERR (dent); goto free; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 252/289 platform/surface: aggregator_registry: Add support for Surface Laptop 5
In reply to Greg Kroah-HartmanFrom: Maximilian Luz <[email protected]>
[ Upstream commit 4a567d164d0e0c57e7b694b988db86361f130cb7 ]
Add device nodes to enable support for battery and charger status, the ACPI platform profile, as well as internal HID devices (including touchpad and keyboard) on the Surface Laptop 5.
--- .../surface/surface_aggregator_registry.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
drivers/platform/surface/surface_aggregator_registry.c +16 -0
@@ -234,6 +234,19 @@ static const struct software_node *ssam_node_group_sl3[] = { NULL, }; +/* Devices for Surface Laptop 5. */ +static const struct software_node *ssam_node_group_sl5[] = { + &ssam_node_root, + &ssam_node_bat_ac, + &ssam_node_bat_main, + &ssam_node_tmp_pprof, + &ssam_node_hid_main_keyboard, + &ssam_node_hid_main_touchpad, + &ssam_node_hid_main_iid5, + &ssam_node_hid_sam_ucm_ucsi, +NULL , +}; +/* Devices for Surface Laptop Studio. */ static const struct software_node *ssam_node_group_sls[] = { &ssam_node_root,
@@ -345,6 +358,9 @@ static const struct acpi_device_id ssam_platform_hub_match[] = {/* Surface Laptop 4 (13", Intel) */ { "MSHW0250", (unsigned long)ssam_node_group_sl3 }, +/* Surface Laptop 5 */ + { "MSHW0350", (unsigned long)ssam_node_group_sl5 }, +/* Surface Laptop Go 1 */ { "MSHW0118", (unsigned long)ssam_node_group_slg1 },
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 253/289 platform/x86: hp-wmi: Ignore Smart Experience App event
In reply to Greg Kroah-HartmanFrom: Kai-Heng Feng <[email protected]>
[ Upstream commit 8b9b6a044b408283b086702b1d9e3cf4ba45b426 ]
Sometimes hp-wmi driver complains on system resume:
[ 483.116451] hp_wmi: Unknown event_id - 33 - 0x0
According to HP it's a feature called "HP Smart Experience App" and it's safe to be ignored.
--- drivers/platform/x86/hp-wmi.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/platform/x86/hp-wmi.c +3 -0
@@ -90,6 +90,7 @@ enum hp_wmi_event_ids {HPWMI_PEAKSHIFT_PERIOD =0x0F ,HPWMI_BATTERY_CHARGE_PERIOD =0x10 ,HPWMI_SANITIZATION_MODE =0x17 , + HPWMI_SMART_EXPERIENCE_APP = 0x21, };/*
@@ -857,6 +858,8 @@ static void hp_wmi_notify(u32 value, void *context)break ;case HPWMI_SANITIZATION_MODE :break ; +case HPWMI_SMART_EXPERIENCE_APP : +break ;default :pr_info ("Unknown event_id - %d - 0x%x\n" , event_id, event_data);break ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 254/289 platform/x86: ideapad-laptop: Fix interrupt storm on fn-lock toggle on some Yoga laptops
In reply to Greg Kroah-HartmanFrom: Arnav Rawat <[email protected]>
[ Upstream commit 81a5603a0f50fd7cf17ff21d106052215eaf2028 ]
Commit 3ae86d2d4704 ("platform/x86: ideapad-laptop: Fix Legion 5 Fn lock LED") uses the WMI event-id for the fn-lock event on some Legion 5 laptops to manually toggle the fn-lock LED because the EC does not do it itself. However, the same WMI ID is also sent on some Yoga laptops. Here, setting the fn-lock state is not valid behavior, and causes the EC to spam interrupts until the laptop is rebooted.
Add a set_fn_lock_led_list[] DMI-id list and only enable the workaround to manually set the LED on models on this list.
--- drivers/platform/x86/ideapad-laptop.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)
drivers/platform/x86/ideapad-laptop.c +17 -0
@@ -136,6 +136,7 @@ struct ideapad_private { bool dytc : 1; bool fan_mode : 1; bool fn_lock : 1; + bool set_fn_lock_led : 1; bool hw_rfkill_switch : 1; bool kbd_bl : 1; bool touchpad_ctrl_via_ec : 1;
@@ -1501,6 +1502,9 @@ static void ideapad_wmi_notify(u32 value, void *context)ideapad_input_report (priv, value);break ;case 208 : +if (!priv->features.set_fn_lock_led) +break ; +if (!eval_hals (priv->adev->handle, &result)) {bool state =test_bit (HALS_FNLOCK_STATE_BIT , &result);
@@ -1514,6 +1518,18 @@ static void ideapad_wmi_notify(u32 value, void *context) }#endif +/* On some models we need to call exec_sals(SALS_FNLOCK_ON/OFF) to set the LED */ +static const struct dmi_system_id set_fn_lock_led_list[] = { + { +/* https://bugzilla.kernel.org/show_bug.cgi?id=212671 */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"LENOVO" ), +DMI_MATCH (DMI_PRODUCT_VERSION ,"Lenovo Legion R7000P2020H" ), + } + }, + {} +}; +/* * Some ideapads have a hardware rfkill switch, but most do not have one. * Reading VPCCMD_R_RF always results in 0 on models without a hardware rfkill,
@@ -1556,6 +1572,7 @@ static void ideapad_check_features(struct ideapad_private *priv)acpi_handle handle = priv->adev->handle;unsigned long val; + priv->features.set_fn_lock_led =dmi_check_system (set_fn_lock_led_list); priv->features.hw_rfkill_switch =dmi_check_system (hw_rfkill_list);/* Most ideapads with ELAN0634 touchpad don't use EC touchpad switch */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 255/289 platform/x86: ideapad-laptop: Add module parameters to match DMI quirk tables
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit b44fd994e45112b58b6c1dec4451d9a925784589 ]
Add module parameters to allow setting the hw_rfkill_switch and set_fn_lock_led feature flags for testing these on laptops which are not on the DMI-id based allow lists for these 2 flags.
--- drivers/platform/x86/ideapad-laptop.c | 22 +++++++++++++++++++--- 1 file changed, 19 insertions(+), 3 deletions(-)
drivers/platform/x86/ideapad-laptop.c +19 -3
@@ -155,7 +155,21 @@ MODULE_PARM_DESC(no_bt_rfkill, "No rfkill for bluetooth.");static bool allow_v4_dytc;module_param (allow_v4_dytc, bool,0444 ); -MODULE_PARM_DESC (allow_v4_dytc,"Enable DYTC version 4 platform-profile support." ); +MODULE_PARM_DESC (allow_v4_dytc, +"Enable DYTC version 4 platform-profile support. " +"If you need this please report this to: [email protected]" ); + +static bool hw_rfkill_switch; +module_param (hw_rfkill_switch, bool,0444 ); +MODULE_PARM_DESC (hw_rfkill_switch, +"Enable rfkill support for laptops with a hw on/off wifi switch/slider. " +"If you need this please report this to: [email protected]" ); + +static bool set_fn_lock_led; +module_param (set_fn_lock_led, bool,0444 ); +MODULE_PARM_DESC (set_fn_lock_led, +"Enable driver based updates of the fn-lock LED on fn-lock changes. " +"If you need this please report this to: [email protected]" );/* * ACPI Helpers
@@ -1572,8 +1586,10 @@ static void ideapad_check_features(struct ideapad_private *priv)acpi_handle handle = priv->adev->handle;unsigned long val; - priv->features.set_fn_lock_led =dmi_check_system (set_fn_lock_led_list); - priv->features.hw_rfkill_switch =dmi_check_system (hw_rfkill_list); + priv->features.set_fn_lock_led = + set_fn_lock_led ||dmi_check_system (set_fn_lock_led_list); + priv->features.hw_rfkill_switch = + hw_rfkill_switch ||dmi_check_system (hw_rfkill_list);/* Most ideapads with ELAN0634 touchpad don't use EC touchpad switch */ if (acpi_dev_present ("ELAN0634" ,NULL ,-1 ))
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 256/289 tcp: configurable source port perturb table size
In reply to Greg Kroah-HartmanFrom: Gleb Mazovetskiy <[email protected]>
[ Upstream commit aeac4ec8f46d610a10adbaeff5e2edf6a88ffc62 ]
On embedded systems with little memory and no relevant security concerns, it is beneficial to reduce the size of the table.
Reducing the size from 2^16 to 2^8 saves 255 KiB of kernel RAM.
Makes the table size configurable as an expert option.
The size was previously increased from 2^8 to 2^16
in commit 4c2c8f03a5ab ("tcp: increase source port perturb table to 2^16").
--- net/ipv4/Kconfig | 10 ++++++++++ net/ipv4/inet_hashtables.c | 10 +++++----- 2 files changed, 15 insertions(+), 5 deletions(-)
net/ipv4/Kconfig +10 -0
@@ -402,6 +402,16 @@ config INET_IPCOMP If unsure, say Y. +config INET_TABLE_PERTURB_ORDER + int "INET: Source port perturbation table size (as power of 2)" if EXPERT + default 16 + help + Source port perturbation table size (as power of 2) for + RFC 6056 3.3.4. Algorithm 4: Double-Hash Port Selection Algorithm. + + The default is almost always what you want. + Only change this if you know what you are doing. + config INET_XFRM_TUNNEL tristate select INET_TUNNEL
net/ipv4/inet_hashtables.c +5 -5
@@ -679,13 +679,13 @@ EXPORT_SYMBOL_GPL(inet_unhash);* Note that we use 32bit integers (vs RFC 'short integers') * because 2^16 is not a multiple of num_ephemeral and this * property might be used by clever attacker. +* * RFC claims using TABLE_LENGTH=10 buckets gives an improvement, though -* attacks were since demonstrated, thus we use 65536 instead to really -* give more isolation and privacy, at the expense of 256kB of kernel -* memory. +* attacks were since demonstrated, thus we use 65536 by default instead +* to really give more isolation and privacy, at the expense of 256kB +* of kernel memory. */ -#define INET_TABLE_PERTURB_SHIFT 16 -#define INET_TABLE_PERTURB_SIZE (1 << INET_TABLE_PERTURB_SHIFT) +#define INET_TABLE_PERTURB_SIZE (1 << CONFIG_INET_TABLE_PERTURB_ORDER)static u32 *table_perturb; int __inet_hash_connect(struct inet_timewait_death_row *death_row,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 257/289 block: make blk_set_default_limits() private
In reply to Greg Kroah-HartmanFrom: Keith Busch <[email protected]>
[ Upstream commit b3228254bb6e91e57f920227f72a1a7d81925d81 ]
There are no external users of this function.
--- block/blk-settings.c | 1 - block/blk.h | 1 + include/linux/blkdev.h | 1 - 3 files changed, 1 insertion(+), 2 deletions(-)
block/blk-settings.c +0 -1
@@ -59,7 +59,6 @@ void blk_set_default_limits(struct queue_limits *lim) lim->zone_write_granularity =0 ; lim->dma_alignment =511 ; } -EXPORT_SYMBOL (blk_set_default_limits);/** * blk_set_stacking_limits - set default limits for stacking devices
block/blk.h +1 -0
@@ -324,6 +324,7 @@ void blk_rq_set_mixed_merge(struct request *rq);bool blk_rq_merge_ok (struct request *rq,struct bio *bio);enum elv_merge blk_try_merge (struct request *rq,struct bio *bio); +void blk_set_default_limits (struct queue_limits *lim);int blk_dev_init (void );/*
include/linux/blkdev.h +0 -1
@@ -946,7 +946,6 @@ extern void blk_queue_io_min(struct request_queue *q, unsigned int min);extern void blk_limits_io_opt (struct queue_limits *limits,unsigned int opt);extern void blk_queue_io_opt (struct request_queue *q,unsigned int opt);extern void blk_set_queue_depth (struct request_queue *q,unsigned int depth); -extern void blk_set_default_limits (struct queue_limits *lim);extern void blk_set_stacking_limits (struct queue_limits *lim);extern int blk_stack_limits (struct queue_limits *t,struct queue_limits *b,sector_t offset);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 258/289 dm-integrity: set dma_alignment limit in io_hints
In reply to Greg Kroah-HartmanFrom: Keith Busch <[email protected]>
[ Upstream commit 29aa778bb66795e6a78b1c99beadc83887827868 ]
This device mapper needs bio vectors to be sized and memory aligned to the logical block size. Set the minimum required queue limit accordingly.
--- drivers/md/dm-integrity.c | 1 + 1 file changed, 1 insertion(+)
drivers/md/dm-integrity.c +1 -0
@@ -3370,6 +3370,7 @@ static void dm_integrity_io_hints(struct dm_target *ti, struct queue_limits *lim limits->logical_block_size = ic->sectors_per_block <<SECTOR_SHIFT ; limits->physical_block_size = ic->sectors_per_block <<SECTOR_SHIFT ;blk_limits_io_min (limits, ic->sectors_per_block <<SECTOR_SHIFT ); + limits->dma_alignment = limits->logical_block_size -1 ; } }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 259/289 dm-log-writes: set dma_alignment limit in io_hints
In reply to Greg Kroah-HartmanFrom: Keith Busch <[email protected]>
[ Upstream commit 50a893359cd2643ee1afc96eedc9e7084cab49fa ]
This device mapper needs bio vectors to be sized and memory aligned to the logical block size. Set the minimum required queue limit accordingly.
--- drivers/md/dm-log-writes.c | 1 + 1 file changed, 1 insertion(+)
drivers/md/dm-log-writes.c +1 -0
@@ -875,6 +875,7 @@ static void log_writes_io_hints(struct dm_target *ti, struct queue_limits *limit limits->logical_block_size =bdev_logical_block_size (lc->dev->bdev); limits->physical_block_size =bdev_physical_block_size (lc->dev->bdev); limits->io_min = limits->physical_block_size; + limits->dma_alignment = limits->logical_block_size -1 ; }#if IS_ENABLED (CONFIG_FS_DAX )
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 260/289 net: usb: qmi_wwan: add Telit 0x103a composition
In reply to Greg Kroah-HartmanFrom: Enrico Sau <[email protected]>
[ Upstream commit e103ba33998d0f25653cc8ebe745b68d1ee10cda ]
Add the following Telit LE910C4-WWX composition:
0x103a: rmnet
--- drivers/net/usb/qmi_wwan.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/usb/qmi_wwan.c +1 -0
@@ -1357,6 +1357,7 @@ static const struct usb_device_id products[] = { {QMI_FIXED_INTF(0x2357, 0x0201, 4)}, /* TP-LINK HSUPA Modem MA180 */ {QMI_FIXED_INTF(0x2357, 0x9000, 4)}, /* TP-LINK MA260 */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1031, 3)}, /* Telit LE910C1-EUX */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x103a, 0)}, /* Telit LE910C4-WWX */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1040, 2)}, /* Telit LE922A */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1050, 2)}, /* Telit FN980 */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1057, 2)}, /* Telit FN980 */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 261/289 scsi: mpi3mr: Suppress command reply debug prints
In reply to Greg Kroah-HartmanFrom: Shin'ichiro Kawasaki <[email protected]>
[ Upstream commit 7d21fcfb409500dc9b114567f0ef8d30b3190dee ]
After it receives command reply, mpi3mr driver checks command result. If the result is not zero, it prints out command information. This debug information is confusing since they are printed even when the non-zero result is expected. "Power-on or device reset occurred" is printed for Test Unit Ready command at drive detection. Inquiry failure for unsupported VPD page header is also printed. They are harmless but look like failures.
To avoid the confusion, print the command reply debug information only when the module parameter logging_level has value MPI3_DEBUG_SCSI_ERROR= 64, in same manner as mpt3sas driver.
--- drivers/scsi/mpi3mr/mpi3mr_os.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/scsi/mpi3mr/mpi3mr_os.c +2 -1
@@ -2930,7 +2930,8 @@ void mpi3mr_process_op_reply_desc(struct mpi3mr_ioc *mrioc, }if (scmd->result != (DID_OK <<16 ) && (scmd->cmnd[0 ] !=ATA_12 ) && - (scmd->cmnd[0 ] !=ATA_16 )) { + (scmd->cmnd[0 ] !=ATA_16 ) && + mrioc->logging_level &MPI3_DEBUG_SCSI_ERROR ) {ioc_info (mrioc,"%s :scmd->result 0x%x\n" , __func__, scmd->result);scsi_print_command (scmd);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 262/289 scsi: iscsi: Fix possible memory leak when device_register() failed
In reply to Greg Kroah-HartmanFrom: Zhou Guanghui <[email protected]>
[ Upstream commit f014165faa7b953b81dcbf18835936e5f8d01f2a ]
If device_register() returns error, the name allocated by the dev_set_name() need be freed. As described in the comment of device_register(), we should use put_device() to give up the reference in the error path.
Fix this by calling put_device(), the name will be freed in the kobject_cleanup(), and this patch modified resources will be released by calling the corresponding callback function in the device_release().
--- drivers/scsi/scsi_transport_iscsi.c | 31 +++++++++++++++-------------- 1 file changed, 16 insertions(+), 15 deletions(-)
drivers/scsi/scsi_transport_iscsi.c +16 -15
@@ -231,7 +231,7 @@ iscsi_create_endpoint(int dd_size)dev_set_name (&ep->dev,"ep-%d" , id); err =device_register (&ep->dev);if (err) - goto free_id; + goto put_dev; err =sysfs_create_group (&ep->dev.kobj, &iscsi_endpoint_group);if (err)
@@ -245,10 +245,12 @@ iscsi_create_endpoint(int dd_size)device_unregister (&ep->dev);return NULL ; -free_id: +put_dev:mutex_lock (&iscsi_ep_idr_mutex);idr_remove (&iscsi_ep_idr, id);mutex_unlock (&iscsi_ep_idr_mutex); +put_device (&ep->dev); +return NULL ; free_ep:kfree (ep);return NULL ;
@@ -766,7 +768,7 @@ iscsi_create_iface(struct Scsi_Host *shost, struct iscsi_transport *transport, err =device_register (&iface->dev);if (err) - goto free_iface; + goto put_dev; err =sysfs_create_group (&iface->dev.kobj, &iscsi_iface_group);if (err)
@@ -780,9 +782,8 @@ iscsi_create_iface(struct Scsi_Host *shost, struct iscsi_transport *transport,device_unregister (&iface->dev);return NULL ; -free_iface: -put_device (iface->dev.parent); -kfree (iface); +put_dev: +put_device (&iface->dev);return NULL ; }EXPORT_SYMBOL_GPL (iscsi_create_iface);
@@ -1251,15 +1252,15 @@ iscsi_create_flashnode_sess(struct Scsi_Host *shost, int index, err =device_register (&fnode_sess->dev);if (err) - goto free_fnode_sess; + goto put_dev;if (dd_size) fnode_sess->dd_data = &fnode_sess[1 ];return fnode_sess; -free_fnode_sess: -kfree (fnode_sess); +put_dev: +put_device (&fnode_sess->dev);return NULL ; }EXPORT_SYMBOL_GPL (iscsi_create_flashnode_sess);
@@ -1299,15 +1300,15 @@ iscsi_create_flashnode_conn(struct Scsi_Host *shost, err =device_register (&fnode_conn->dev);if (err) - goto free_fnode_conn; + goto put_dev;if (dd_size) fnode_conn->dd_data = &fnode_conn[1 ];return fnode_conn; -free_fnode_conn: -kfree (fnode_conn); +put_dev: +put_device (&fnode_conn->dev);return NULL ; }EXPORT_SYMBOL_GPL (iscsi_create_flashnode_conn);
@@ -4815,7 +4816,7 @@ iscsi_register_transport(struct iscsi_transport *tt)dev_set_name (&priv->dev,"%s" , tt->name); err =device_register (&priv->dev);if (err) - goto free_priv; + goto put_dev; err =sysfs_create_group (&priv->dev.kobj, &iscsi_transport_group);if (err)
@@ -4850,8 +4851,8 @@ iscsi_register_transport(struct iscsi_transport *tt) unregister_dev:device_unregister (&priv->dev);return NULL ; -free_priv: -kfree (priv); +put_dev: +put_device (&priv->dev);return NULL ; }EXPORT_SYMBOL_GPL (iscsi_register_transport);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 263/289 gpu: host1x: Avoid trying to use GART on Tegra20
In reply to Greg Kroah-HartmanFrom: Robin Murphy <[email protected]>
[ Upstream commit c2418f911a31a266af4fbaca998dc73d3676475a ]
Since commit c7e3ca515e78 ("iommu/tegra: gart: Do not register with bus") quite some time ago, the GART driver has effectively disabled itself to avoid issues with the GPU driver expecting it to work in ways that it doesn't. As of commit 57365a04c921 ("iommu: Move bus setup to IOMMU device registration") that bodge no longer works, but really the GPU driver should be responsible for its own behaviour anyway. Make the workaround explicit.
--- drivers/gpu/drm/tegra/drm.c | 4 ++++ drivers/gpu/host1x/dev.c | 4 ++++ 2 files changed, 8 insertions(+)
drivers/gpu/drm/tegra/drm.c +4 -0
@@ -1093,6 +1093,10 @@ static bool host1x_drm_wants_iommu(struct host1x_device *dev)struct host1x *host1x =dev_get_drvdata (dev->dev.parent);struct iommu_domain *domain; +/* Our IOMMU usage policy doesn't currently play well with GART */ +if (of_machine_is_compatible ("nvidia,tegra20" )) +return false; +/* * If the Tegra DRM clients are backed by an IOMMU, push buffers are * likely to be allocated beyond the 32-bit boundary if sufficient
drivers/gpu/host1x/dev.c +4 -0
@@ -292,6 +292,10 @@ static void host1x_setup_virtualization_tables(struct host1x *host)static bool host1x_wants_iommu (struct host1x *host1x) { +/* Our IOMMU usage policy doesn't currently play well with GART */ +if (of_machine_is_compatible ("nvidia,tegra20" )) +return false; +/* * If we support addressing a maximum of 32 bits of physical memory * and if the host1x firewall is enabled, there's no need to enable
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 264/289 dm integrity: flush the journal on suspend
In reply to Greg Kroah-HartmanFrom: Mikulas Patocka <[email protected]>
[ Upstream commit 5e5dab5ec763d600fe0a67837dd9155bdc42f961 ]
This commit flushes the journal on suspend. It is prerequisite for the next commit that enables activating dm integrity devices in read-only mode.
Note that we deliberately didn't flush the journal on suspend, so that the journal replay code would be tested. However, the dm-integrity code is 5 years old now, so that journal replay is well-tested, and we can make this change now.
--- drivers/md/dm-integrity.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-)
drivers/md/dm-integrity.c +1 -6
@@ -2591,10 +2591,6 @@ static void integrity_writer(struct work_struct *w)unsigned prev_free_sectors; -/* the following test is not needed, but it tests the replay code */ -if (unlikely (dm_post_suspending (ic->ti)) && !ic->meta_dev) -return ; -spin_lock_irq (&ic->endio_wait.lock); write_start = ic->committed_section; write_sections = ic->n_committed_sections;
@@ -3101,8 +3097,7 @@ static void dm_integrity_postsuspend(struct dm_target *ti)drain_workqueue (ic->commit_wq);if (ic->mode =='J' ) { -if (ic->meta_dev) -queue_work (ic->writer_wq, &ic->writer_work); +queue_work (ic->writer_wq, &ic->writer_work);drain_workqueue (ic->writer_wq);dm_integrity_flush_buffers (ic, true); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 265/289 dm integrity: clear the journal on suspend
In reply to Greg Kroah-HartmanFrom: Mikulas Patocka <[email protected]>
[ Upstream commit 984bf2cc531e778e49298fdf6730e0396166aa21 ]
There was a problem that a user burned a dm-integrity image on CDROM and could not activate it because it had a non-empty journal.
Fix this problem by flushing the journal (done by the previous commit) and clearing the journal (done by this commit). Once the journal is cleared, dm-integrity won't attempt to replay it on the next activation.
--- drivers/md/dm-integrity.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
drivers/md/dm-integrity.c +13 -0
@@ -263,6 +263,7 @@ struct dm_integrity_c {struct completion crypto_backoff; +bool wrote_to_journal;bool journal_uptodate;bool just_formatted;bool recalculate_flag;
@@ -2375,6 +2376,8 @@ static void integrity_commit(struct work_struct *w)if (!commit_sections) goto release_flush_bios; + ic->wrote_to_journal = true; + i = commit_start;for (n =0 ; n < commit_sections; n++) {for (j =0 ; j < ic->journal_section_entries; j++) {
@@ -3100,6 +3103,14 @@ static void dm_integrity_postsuspend(struct dm_target *ti)queue_work (ic->writer_wq, &ic->writer_work);drain_workqueue (ic->writer_wq);dm_integrity_flush_buffers (ic, true); +if (ic->wrote_to_journal) { +init_journal (ic, ic->free_section, + ic->journal_sections - ic->free_section, ic->commit_seq); +if (ic->free_section) { +init_journal (ic,0 , ic->free_section, +next_commit_seq (ic->commit_seq)); + } + } }if (ic->mode =='B' ) {
@@ -3127,6 +3138,8 @@ static void dm_integrity_resume(struct dm_target *ti)DEBUG_print ("resume\n" ); + ic->wrote_to_journal = false; +if (ic->provided_data_sectors != old_provided_data_sectors) { if (ic->provided_data_sectors > old_provided_data_sectors && ic->mode == 'B' &&
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 266/289 fuse: lock inode unconditionally in fuse_fallocate()
In reply to Greg Kroah-HartmanFrom: Miklos Szeredi <[email protected]>
commit 44361e8cf9ddb23f17bdcc40ca944abf32e83e79 upstream.
file_modified() must be called with inode lock held. fuse_fallocate() didn't lock the inode in case of just FALLOC_KEEP_SIZE flags value, which resulted in a kernel Warning in notify_change().
Lock the inode unconditionally, like all other fallocate implementations do.
--- fs/fuse/file.c | 41 ++++++++++++++++++----------------------- 1 file changed, 18 insertions(+), 23 deletions(-)
fs/fuse/file.c +18 -23
@@ -2963,11 +2963,9 @@ static long fuse_file_fallocate(struct f .mode = mode };int err; -bool lock_inode = !(mode &FALLOC_FL_KEEP_SIZE ) || - (mode & (FALLOC_FL_PUNCH_HOLE | -FALLOC_FL_ZERO_RANGE )); - -bool block_faults =FUSE_IS_DAX (inode) && lock_inode; +bool block_faults =FUSE_IS_DAX (inode) && + (!(mode &FALLOC_FL_KEEP_SIZE ) || + (mode & (FALLOC_FL_PUNCH_HOLE |FALLOC_FL_ZERO_RANGE )));if (mode & ~(FALLOC_FL_KEEP_SIZE |FALLOC_FL_PUNCH_HOLE |FALLOC_FL_ZERO_RANGE ))
@@ -2976,22 +2974,20 @@ static long fuse_file_fallocate(struct fif (fm->fc->no_fallocate)return -EOPNOTSUPP ; -if (lock_inode) { -inode_lock (inode); -if (block_faults) { -filemap_invalidate_lock (inode->i_mapping); - err =fuse_dax_break_layouts (inode,0 ,0 ); -if (err) - goto out; - } - -if (mode & (FALLOC_FL_PUNCH_HOLE |FALLOC_FL_ZERO_RANGE )) { -loff_t endbyte = offset + length -1 ; - - err =fuse_writeback_range (inode, offset, endbyte); -if (err) - goto out; - } +inode_lock (inode); +if (block_faults) { +filemap_invalidate_lock (inode->i_mapping); + err =fuse_dax_break_layouts (inode,0 ,0 ); +if (err) + goto out; + } + +if (mode & (FALLOC_FL_PUNCH_HOLE |FALLOC_FL_ZERO_RANGE )) { +loff_t endbyte = offset + length -1 ; + + err =fuse_writeback_range (inode, offset, endbyte); +if (err) + goto out; } if (!(mode & FALLOC_FL_KEEP_SIZE) &&
@@ -3039,8 +3035,7 @@ out:if (block_faults)filemap_invalidate_unlock (inode->i_mapping); -if (lock_inode) -inode_unlock (inode); +inode_unlock (inode);fuse_flush_time_update (inode);
Greg Kroah-Hartman
maintainerPATCH 267/289 wifi: wilc1000: validate pairwise and authentication suite offsets
In reply to Greg Kroah-HartmanFrom: Phil Turnbull <[email protected]>
commit cd21d99e595ec1d8721e1058dcdd4f1f7de1d793 upstream.
There is no validation of 'offset' which can trigger an out-of-bounds read when extracting RSN capabilities.
--- drivers/net/wireless/microchip/wilc1000/hif.c | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-)
drivers/net/wireless/microchip/wilc1000/hif.c +16 -5
@@ -482,14 +482,25 @@ void *wilc_parse_join_bss_param(struct c rsn_ie =cfg80211_find_ie (WLAN_EID_RSN , ies->data, ies->len);if (rsn_ie) { +int rsn_ie_len =sizeof (struct element ) + rsn_ie[1 ];int offset =8 ; - param->mode_802_11i =2 ; - param->rsn_found = true;/* extract RSN capabilities */ - offset += (rsn_ie[offset] *4 ) +2 ; - offset += (rsn_ie[offset] *4 ) +2 ; -memcpy (param->rsn_cap, &rsn_ie[offset],2 ); +if (offset < rsn_ie_len) { +/* skip over pairwise suites */ + offset += (rsn_ie[offset] *4 ) +2 ; + +if (offset < rsn_ie_len) { +/* skip over authentication suites */ + offset += (rsn_ie[offset] *4 ) +2 ; + +if (offset +1 < rsn_ie_len) { + param->mode_802_11i =2 ; + param->rsn_found = true; +memcpy (param->rsn_cap, &rsn_ie[offset],2 ); + } + } + } }if (param->rsn_found) {
Greg Kroah-Hartman
maintainerPATCH 268/289 wifi: wilc1000: validate length of IEEE80211_P2P_ATTR_OPER_CHANNEL attribute
In reply to Greg Kroah-HartmanFrom: Phil Turnbull <[email protected]>
commit 051ae669e4505abbe05165bebf6be7922de11f41 upstream.
Validate that the IEEE80211_P2P_ATTR_OPER_CHANNEL attribute contains enough space for a 'struct struct wilc_attr_oper_ch'. If the attribute is too small then it triggers an out-of-bounds write later in the function.
--- drivers/net/wireless/microchip/wilc1000/cfg80211.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
drivers/net/wireless/microchip/wilc1000/cfg80211.c +12 -2
@@ -956,14 +956,24 @@ static inline void wilc_wfi_cfg_parse_chreturn ;while (index +sizeof (*e) <= len) { +u16 attr_size; + e = (struct wilc_attr_entry *)&buf[index]; + attr_size =le16_to_cpu (e->attr_len); + +if (index +sizeof (*e) + attr_size > len) +return ; +if (e->attr_type ==IEEE80211_P2P_ATTR_CHANNEL_LIST ) ch_list_idx = index; -else if (e->attr_type ==IEEE80211_P2P_ATTR_OPER_CHANNEL ) +else if (e->attr_type ==IEEE80211_P2P_ATTR_OPER_CHANNEL && + attr_size == (sizeof (struct wilc_attr_oper_ch ) -sizeof (*e))) op_ch_idx = index; +if (ch_list_idx && op_ch_idx)break ; - index +=le16_to_cpu (e->attr_len) +sizeof (*e); + + index +=sizeof (*e) + attr_size; }if (ch_list_idx) {
Greg Kroah-Hartman
maintainerPATCH 269/289 wifi: wilc1000: validate length of IEEE80211_P2P_ATTR_CHANNEL_LIST attribute
In reply to Greg Kroah-HartmanFrom: Phil Turnbull <[email protected]>
commit f9b62f9843c7b0afdaecabbcebf1dbba18599408 upstream.
Validate that the IEEE80211_P2P_ATTR_CHANNEL_LIST attribute contains enough space for a 'struct wilc_attr_oper_ch'. If the attribute is too small then it can trigger an out-of-bounds write later in the function.
'struct wilc_attr_oper_ch' is variable sized so also check 'attr_len' does not extend beyond the end of 'buf'.
--- drivers/net/wireless/microchip/wilc1000/cfg80211.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/wireless/microchip/wilc1000/cfg80211.c +2 -1
@@ -964,7 +964,8 @@ static inline void wilc_wfi_cfg_parse_chif (index +sizeof (*e) + attr_size > len)return ; -if (e->attr_type ==IEEE80211_P2P_ATTR_CHANNEL_LIST ) +if (e->attr_type ==IEEE80211_P2P_ATTR_CHANNEL_LIST && + attr_size >= (sizeof (struct wilc_attr_ch_list ) -sizeof (*e))) ch_list_idx = index;else if (e->attr_type ==IEEE80211_P2P_ATTR_OPER_CHANNEL && attr_size == (sizeof (struct wilc_attr_oper_ch ) -sizeof (*e)))
Greg Kroah-Hartman
maintainerPATCH 270/289 wifi: wilc1000: validate number of channels
In reply to Greg Kroah-HartmanFrom: Phil Turnbull <[email protected]>
commit 0cdfa9e6f0915e3d243e2393bfa8a22e12d553b0 upstream.
There is no validation of 'e->no_of_channels' which can trigger an out-of-bounds write in the following 'memset' call. Validate that the number of channels does not extends beyond the size of the channel list element.
--- drivers/net/wireless/microchip/wilc1000/cfg80211.c | 22 +++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-)
drivers/net/wireless/microchip/wilc1000/cfg80211.c +16 -6
@@ -978,19 +978,29 @@ static inline void wilc_wfi_cfg_parse_ch }if (ch_list_idx) { -u16 attr_size; -struct wilc_ch_list_elem *e; -int i; +u16 elem_size; ch_list = (struct wilc_attr_ch_list *)&buf[ch_list_idx]; - attr_size =le16_to_cpu (ch_list->attr_len); -for (i =0 ; i < attr_size;) { +/* the number of bytes following the final 'elem' member */ + elem_size =le16_to_cpu (ch_list->attr_len) - + (sizeof (*ch_list) -sizeof (struct wilc_attr_entry )); +for (unsigned int i =0 ; i < elem_size;) { +struct wilc_ch_list_elem *e; + e = (struct wilc_ch_list_elem *)(ch_list->elem + i); + + i +=sizeof (*e); +if (i > elem_size) +break ; + + i += e->no_of_channels; +if (i > elem_size) +break ; +if (e->op_class ==WILC_WLAN_OPERATING_CLASS_2_4GHZ ) {memset (e->ch_list, sta_ch, e->no_of_channels);break ; } - i += e->no_of_channels; } }
Greg Kroah-Hartman
maintainerPATCH 271/289 btrfs: free btrfs_path before copying root refs to userspace
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
commit b740d806166979488e798e41743aaec051f2443f upstream.
Syzbot reported the following lockdep splat
======================================================
WARNING: possible circular locking dependency detected 6.0.0-rc7-syzkaller-18095-gbbed346d5a96 #0 Not tainted
------------------------------------------------------
syz-executor307/3029 is trying to acquire lock:ffff0000c02525d8 (&mm->mmap_lock){++++}-{3:3}, at: __might_fault+0x54/0xb4 mm/memory.c:5576
but task is already holding lock:ffff0000c958a608 (btrfs-root-00){++++}-{3:3}, at: __btrfs_tree_read_lock fs/btrfs/locking.c:134 [inline] ffff0000c958a608 (btrfs-root-00){++++}-{3:3}, at: btrfs_tree_read_lock fs/btrfs/locking.c:140 [inline] ffff0000c958a608 (btrfs-root-00){++++}-{3:3}, at: btrfs_read_lock_root_node+0x13c/0x1c0 fs/btrfs/locking.c:279
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #3 (btrfs-root-00){++++}-{3:3}:
down_read_nested+0x64/0x84 kernel/locking/rwsem.c:1624
__btrfs_tree_read_lock fs/btrfs/locking.c:134 [inline]
btrfs_tree_read_lock fs/btrfs/locking.c:140 [inline]
btrfs_read_lock_root_node+0x13c/0x1c0 fs/btrfs/locking.c:279
btrfs_search_slot_get_root+0x74/0x338 fs/btrfs/ctree.c:1637
btrfs_search_slot+0x1b0/0xfd8 fs/btrfs/ctree.c:1944
btrfs_update_root+0x6c/0x5a0 fs/btrfs/root-tree.c:132
commit_fs_roots+0x1f0/0x33c fs/btrfs/transaction.c:1459
btrfs_commit_transaction+0x89c/0x12d8 fs/btrfs/transaction.c:2343
flush_space+0x66c/0x738 fs/btrfs/space-info.c:786
btrfs_async_reclaim_metadata_space+0x43c/0x4e0 fs/btrfs/space-info.c:1059
process_one_work+0x2d8/0x504 kernel/workqueue.c:2289
worker_thread+0x340/0x610 kernel/workqueue.c:2436
kthread+0x12c/0x158 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860-> #2 (&fs_info->reloc_mutex){+.+.}-{3:3}:
__mutex_lock_common+0xd4/0xca8 kernel/locking/mutex.c:603
__mutex_lock kernel/locking/mutex.c:747 [inline]
mutex_lock_nested+0x38/0x44 kernel/locking/mutex.c:799
btrfs_record_root_in_trans fs/btrfs/transaction.c:516 [inline]
start_transaction+0x248/0x944 fs/btrfs/transaction.c:752
btrfs_start_transaction+0x34/0x44 fs/btrfs/transaction.c:781
btrfs_create_common+0xf0/0x1b4 fs/btrfs/inode.c:6651
btrfs_create+0x8c/0xb0 fs/btrfs/inode.c:6697
lookup_open fs/namei.c:3413 [inline]
open_last_lookups fs/namei.c:3481 [inline]
path_openat+0x804/0x11c4 fs/namei.c:3688
do_filp_open+0xdc/0x1b8 fs/namei.c:3718
do_sys_openat2+0xb8/0x22c fs/open.c:1313
do_sys_open fs/open.c:1329 [inline]
__do_sys_openat fs/open.c:1345 [inline]
__se_sys_openat fs/open.c:1340 [inline]
__arm64_sys_openat+0xb0/0xe0 fs/open.c:1340
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x48/0x164 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:636
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:654
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581-> #1 (sb_internal#2){.+.+}-{0:0}:
percpu_down_read include/linux/percpu-rwsem.h:51 [inline]
__sb_start_write include/linux/fs.h:1826 [inline]
sb_start_intwrite include/linux/fs.h:1948 [inline]
start_transaction+0x360/0x944 fs/btrfs/transaction.c:683
btrfs_join_transaction+0x30/0x40 fs/btrfs/transaction.c:795
btrfs_dirty_inode+0x50/0x140 fs/btrfs/inode.c:6103
btrfs_update_time+0x1c0/0x1e8 fs/btrfs/inode.c:6145
inode_update_time fs/inode.c:1872 [inline]
touch_atime+0x1f0/0x4a8 fs/inode.c:1945
file_accessed include/linux/fs.h:2516 [inline]
btrfs_file_mmap+0x50/0x88 fs/btrfs/file.c:2407
call_mmap include/linux/fs.h:2192 [inline]
mmap_region+0x7fc/0xc14 mm/mmap.c:1752
do_mmap+0x644/0x97c mm/mmap.c:1540
vm_mmap_pgoff+0xe8/0x1d0 mm/util.c:552
ksys_mmap_pgoff+0x1cc/0x278 mm/mmap.c:1586
__do_sys_mmap arch/arm64/kernel/sys.c:28 [inline]
__se_sys_mmap arch/arm64/kernel/sys.c:21 [inline]
__arm64_sys_mmap+0x58/0x6c arch/arm64/kernel/sys.c:21
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x48/0x164 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:636
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:654
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581-> #0 (&mm->mmap_lock){++++}-{3:3}:
check_prev_add kernel/locking/lockdep.c:3095 [inline]
check_prevs_add kernel/locking/lockdep.c:3214 [inline]
validate_chain kernel/locking/lockdep.c:3829 [inline]
__lock_acquire+0x1530/0x30a4 kernel/locking/lockdep.c:5053
lock_acquire+0x100/0x1f8 kernel/locking/lockdep.c:5666
__might_fault+0x7c/0xb4 mm/memory.c:5577
_copy_to_user include/linux/uaccess.h:134 [inline]
copy_to_user include/linux/uaccess.h:160 [inline]
btrfs_ioctl_get_subvol_rootref+0x3a8/0x4bc fs/btrfs/ioctl.c:3203
btrfs_ioctl+0xa08/0xa64 fs/btrfs/ioctl.c:5556
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl fs/ioctl.c:856 [inline]
__arm64_sys_ioctl+0xd0/0x140 fs/ioctl.c:856
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x48/0x164 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:636
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:654
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581other info that might help us debug this:
Chain exists of: &mm->mmap_lock --> &fs_info->reloc_mutex --> btrfs-root-00 Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(btrfs-root-00);
lock(&fs_info->reloc_mutex);
lock(btrfs-root-00); lock(&mm->mmap_lock);
*** DEADLOCK ***
1 lock held by syz-executor307/3029:
#0: ffff0000c958a608 (btrfs-root-00){++++}-{3:3}, at: __btrfs_tree_read_lock fs/btrfs/locking.c:134 [inline] #0: ffff0000c958a608 (btrfs-root-00){++++}-{3:3}, at: btrfs_tree_read_lock fs/btrfs/locking.c:140 [inline] #0: ffff0000c958a608 (btrfs-root-00){++++}-{3:3}, at: btrfs_read_lock_root_node+0x13c/0x1c0 fs/btrfs/locking.c:279
stack backtrace: CPU: 0 PID: 3029 Comm: syz-executor307 Not tainted 6.0.0-rc7-syzkaller-18095-gbbed346d5a96 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/30/2022 Call trace: dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:156 show_stack+0x2c/0x54 arch/arm64/kernel/stacktrace.c:163 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x104/0x16c lib/dump_stack.c:106 dump_stack+0x1c/0x58 lib/dump_stack.c:113 print_circular_bug+0x2c4/0x2c8 kernel/locking/lockdep.c:2053 check_noncircular+0x14c/0x154 kernel/locking/lockdep.c:2175 check_prev_add kernel/locking/lockdep.c:3095 [inline] check_prevs_add kernel/locking/lockdep.c:3214 [inline] validate_chain kernel/locking/lockdep.c:3829 [inline] __lock_acquire+0x1530/0x30a4 kernel/locking/lockdep.c:5053 lock_acquire+0x100/0x1f8 kernel/locking/lockdep.c:5666 __might_fault+0x7c/0xb4 mm/memory.c:5577 _copy_to_user include/linux/uaccess.h:134 [inline] copy_to_user include/linux/uaccess.h:160 [inline] btrfs_ioctl_get_subvol_rootref+0x3a8/0x4bc fs/btrfs/ioctl.c:3203 btrfs_ioctl+0xa08/0xa64 fs/btrfs/ioctl.c:5556 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __arm64_sys_ioctl+0xd0/0x140 fs/ioctl.c:856 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall arch/arm64/kernel/syscall.c:52 [inline] el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x48/0x164 arch/arm64/kernel/syscall.c:206 el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:636 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:654 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581
We do generally the right thing here, copying the references into a temporary buffer, however we are still holding the path when we do copy_to_user from the temporary buffer. Fix this by freeing the path before we copy to user space.
--- fs/btrfs/ioctl.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/btrfs/ioctl.c +2 -1
@@ -3194,6 +3194,8 @@ static int btrfs_ioctl_get_subvol_rootre } out: +btrfs_free_path (path); +if (!ret || ret == -EOVERFLOW ) { rootrefs->num_items = found;/* update min_treeid for next search */
@@ -3205,7 +3207,6 @@ out: }kfree (rootrefs); -btrfs_free_path (path);return ret; }
Greg Kroah-Hartman
maintainerPATCH 272/289 btrfs: free btrfs_path before copying inodes to userspace
In reply to Greg Kroah-HartmanFrom: Anand Jain <[email protected]>
commit 418ffb9e3cf6c4e2574d3a732b724916684bd133 upstream.
btrfs_ioctl_logical_to_ino() frees the search path after the userspace copy from the temp buffer @inodes. Which potentially can lead to a lock splat.
Fix this by freeing the path before we copy @inodes to userspace.
--- fs/btrfs/ioctl.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-)
fs/btrfs/ioctl.c +7 -9
@@ -4282,21 +4282,20 @@ static long btrfs_ioctl_logical_to_ino(s size =min_t (u32, loi->size,SZ_16M ); } - path =btrfs_alloc_path (); -if (!path) { - ret = -ENOMEM ; - goto out; - } - inodes =init_data_container (size);if (IS_ERR (inodes)) { ret =PTR_ERR (inodes); - inodes =NULL ; - goto out; + goto out_loi; } + path =btrfs_alloc_path (); +if (!path) { + ret = -ENOMEM ; + goto out; + } ret =iterate_inodes_from_logical (loi->logical, fs_info, path, inodes, ignore_offset); +btrfs_free_path (path);if (ret == -EINVAL ) ret = -ENOENT ;if (ret <0 )
@@ -4308,7 +4307,6 @@ static long btrfs_ioctl_logical_to_ino(s ret = -EFAULT ; out: -btrfs_free_path (path);kvfree (inodes); out_loi:kfree (loi);
Greg Kroah-Hartman
maintainerPATCH 273/289 btrfs: free btrfs_path before copying fspath to userspace
In reply to Greg Kroah-HartmanFrom: Anand Jain <[email protected]>
commit 8cf96b409d9b3946ece58ced13f92d0f775b0442 upstream.
btrfs_ioctl_ino_to_path() frees the search path after the userspace copy from the temp buffer @ipath->fspath. Which potentially can lead to a lock splat warning.
Fix this by freeing the path before we copy it to userspace.
--- fs/btrfs/ioctl.c | 2 ++ 1 file changed, 2 insertions(+)
fs/btrfs/ioctl.c +2 -0
@@ -4232,6 +4232,8 @@ static long btrfs_ioctl_ino_to_path(stru ipath->fspath->val[i] = rel_ptr; } +btrfs_free_path (path); + path =NULL ; ret =copy_to_user ((void __user *)(unsigned long )ipa->fspath, ipath->fspath, size);if (ret) {
Greg Kroah-Hartman
maintainerPATCH 274/289 btrfs: free btrfs_path before copying subvol info to userspace
In reply to Greg Kroah-HartmanFrom: Anand Jain <[email protected]>
commit 013c1c5585ebcfb19c88efe79063d0463b1b6159 upstream.
btrfs_ioctl_get_subvol_info() frees the search path after the userspace copy from the temp buffer @subvol_info. This can lead to a lock splat warning.
Fix this by freeing the path before we copy it to userspace.
--- fs/btrfs/ioctl.c | 2 ++ 1 file changed, 2 insertions(+)
fs/btrfs/ioctl.c +2 -0
@@ -3105,6 +3105,8 @@ static int btrfs_ioctl_get_subvol_info(s } } +btrfs_free_path (path); + path =NULL ;if (copy_to_user (argp, subvol_info,sizeof (*subvol_info))) ret = -EFAULT ;
Greg Kroah-Hartman
maintainerPATCH 275/289 btrfs: zoned: fix missing endianness conversion in sb_write_pointer
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
commit c51f0e6a1254b3ac2d308e1c6fd8fb936992b455 upstream.
generation is an on-disk __le64 value, so use btrfs_super_generation to convert it to host endian before comparing it.
--- fs/btrfs/zoned.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/btrfs/zoned.c +2 -1
@@ -134,7 +134,8 @@ static int sb_write_pointer(struct block super[i] =page_address (page[i]); } -if (super[0 ]->generation > super[1 ]->generation) +if (btrfs_super_generation (super[0 ]) > +btrfs_super_generation (super[1 ])) sector = zones[1 ].start;else sector = zones[0 ].start;
Greg Kroah-Hartman
maintainerPATCH 276/289 btrfs: use kvcalloc in btrfs_get_dev_zone_info
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
commit 8fe97d47b52ae1ad130470b1780f0ded4ba609a4 upstream.
Otherwise the kernel memory allocator seems to be unhappy about failing order 6 allocations for the zones array, that cause 100% reproducible mount failures in my qemu setup:
[26.078981] mount: page allocation failure: order:6, mode:0x40dc0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO), nodemask=(null) [26.079741] CPU: 0 PID: 2965 Comm: mount Not tainted 6.1.0-rc5+ #185 [26.080181] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [26.080950] Call Trace: [26.081132] <TASK> [26.081291] dump_stack_lvl+0x56/0x6f [26.081554] warn_alloc+0x117/0x140 [26.081808] ? __alloc_pages_direct_compact+0x1b5/0x300 [26.082174] __alloc_pages_slowpath.constprop.0+0xd0e/0xde0 [26.082569] __alloc_pages+0x32a/0x340 [26.082836] __kmalloc_large_node+0x4d/0xa0 [26.083133] ? trace_kmalloc+0x29/0xd0 [26.083399] kmalloc_large+0x14/0x60 [26.083654] btrfs_get_dev_zone_info+0x1b9/0xc00 [26.083980] ? _raw_spin_unlock_irqrestore+0x28/0x50 [26.084328] btrfs_get_dev_zone_info_all_devices+0x54/0x80 [26.084708] open_ctree+0xed4/0x1654 [26.084974] btrfs_mount_root.cold+0x12/0xde [26.085288] ? lock_is_held_type+0xe2/0x140 [26.085603] legacy_get_tree+0x28/0x50 [26.085876] vfs_get_tree+0x1d/0xb0 [26.086139] vfs_kern_mount.part.0+0x6c/0xb0 [26.086456] btrfs_mount+0x118/0x3a0 [26.086728] ? lock_is_held_type+0xe2/0x140 [26.087043] legacy_get_tree+0x28/0x50 [26.087323] vfs_get_tree+0x1d/0xb0 [26.087587] path_mount+0x2ba/0xbe0 [26.087850] ? _raw_spin_unlock_irqrestore+0x38/0x50 [26.088217] __x64_sys_mount+0xfe/0x140 [26.088506] do_syscall_64+0x35/0x80 [26.088776] entry_SYSCALL_64_after_hwframe+0x63/0xcd
--- fs/btrfs/zoned.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
fs/btrfs/zoned.c +3 -3
@@ -467,7 +467,7 @@ int btrfs_get_dev_zone_info(struct btrfs goto out; } - zones =kcalloc (BTRFS_REPORT_NR_ZONES ,sizeof (struct blk_zone ),GFP_KERNEL ); + zones =kvcalloc (BTRFS_REPORT_NR_ZONES ,sizeof (struct blk_zone ),GFP_KERNEL );if (!zones) { ret = -ENOMEM ; goto out;
@@ -586,7 +586,7 @@ int btrfs_get_dev_zone_info(struct btrfs } -kfree (zones); +kvfree (zones);switch (bdev_zoned_model (bdev)) {case BLK_ZONED_HM :
@@ -618,7 +618,7 @@ int btrfs_get_dev_zone_info(struct btrfsreturn 0 ; out: -kfree (zones); +kvfree (zones); out_free_zone_info:btrfs_destroy_dev_zone_info (device);
Greg Kroah-Hartman
maintainerPATCH 277/289 btrfs: sysfs: normalize the error handling branch in btrfs_init_sysfs()
In reply to Greg Kroah-HartmanFrom: Zhen Lei <[email protected]>
commit ffdbb44f2f23f963b8f5672e35c3a26088177a62 upstream.
Although kset_unregister() can eventually remove all attribute files, explicitly rolling back with the matching function makes the code logic look clearer.
--- fs/btrfs/sysfs.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
fs/btrfs/sysfs.c +5 -2
@@ -2251,8 +2251,11 @@ int __init btrfs_init_sysfs(void)#ifdef CONFIG_BTRFS_DEBUG ret =sysfs_create_group (&btrfs_kset->kobj, &btrfs_debug_feature_attr_group); -if (ret) - goto out2; +if (ret) { +sysfs_unmerge_group (&btrfs_kset->kobj, + &btrfs_static_feature_attr_group); + goto out_remove_group; + }#endif return 0 ;
Greg Kroah-Hartman
maintainerPATCH 278/289 btrfs: do not modify log tree while holding a leaf from fs tree locked
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
commit 796787c978efbbdb50e245718c784eb94f59eac4 upstream.
When logging an inode in full mode, or when logging xattrs or when logging the dir index items of a directory, we are modifying the log tree while holding a read lock on a leaf from the fs/subvolume tree. This can lead to a deadlock in rare circumstances, but it is a real possibility, and it was recently reported by syzbot with the following trace from lockdep:
WARNING: possible circular locking dependency detected
6.1.0-rc5-next-20221116-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor.1/16154 is trying to acquire lock:
ffff88807e3084a0 (&delayed_node->mutex){+.+.}-{3:3}, at: __btrfs_release_delayed_node.part.0+0xa1/0xf30 fs/btrfs/delayed-inode.c:256
but task is already holding lock:
ffff88807df33078 (btrfs-log-00){++++}-{3:3}, at: __btrfs_tree_lock+0x32/0x3d0 fs/btrfs/locking.c:197
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (btrfs-log-00){++++}-{3:3}:
down_read_nested+0x9e/0x450 kernel/locking/rwsem.c:1634
__btrfs_tree_read_lock+0x32/0x350 fs/btrfs/locking.c:135
btrfs_tree_read_lock fs/btrfs/locking.c:141 [inline]
btrfs_read_lock_root_node+0x82/0x3a0 fs/btrfs/locking.c:280
btrfs_search_slot_get_root fs/btrfs/ctree.c:1678 [inline]
btrfs_search_slot+0x3ca/0x2c70 fs/btrfs/ctree.c:1998
btrfs_lookup_csum+0x116/0x3f0 fs/btrfs/file-item.c:209
btrfs_csum_file_blocks+0x40e/0x1370 fs/btrfs/file-item.c:1021
log_csums.isra.0+0x244/0x2d0 fs/btrfs/tree-log.c:4258
copy_items.isra.0+0xbfb/0xed0 fs/btrfs/tree-log.c:4403
copy_inode_items_to_log+0x13d6/0x1d90 fs/btrfs/tree-log.c:5873
btrfs_log_inode+0xb19/0x4680 fs/btrfs/tree-log.c:6495
btrfs_log_inode_parent+0x890/0x2a20 fs/btrfs/tree-log.c:6982
btrfs_log_dentry_safe+0x59/0x80 fs/btrfs/tree-log.c:7083
btrfs_sync_file+0xa41/0x13c0 fs/btrfs/file.c:1921
vfs_fsync_range+0x13e/0x230 fs/sync.c:188
generic_write_sync include/linux/fs.h:2856 [inline]
iomap_dio_complete+0x73a/0x920 fs/iomap/direct-io.c:128
btrfs_direct_write fs/btrfs/file.c:1536 [inline]
btrfs_do_write_iter+0xba2/0x1470 fs/btrfs/file.c:1668
call_write_iter include/linux/fs.h:2160 [inline]
do_iter_readv_writev+0x20b/0x3b0 fs/read_write.c:735
do_iter_write+0x182/0x700 fs/read_write.c:861
vfs_iter_write+0x74/0xa0 fs/read_write.c:902
iter_file_splice_write+0x745/0xc90 fs/splice.c:686
do_splice_from fs/splice.c:764 [inline]
direct_splice_actor+0x114/0x180 fs/splice.c:931
splice_direct_to_actor+0x335/0x8a0 fs/splice.c:886
do_splice_direct+0x1ab/0x280 fs/splice.c:974
do_sendfile+0xb19/0x1270 fs/read_write.c:1255
__do_sys_sendfile64 fs/read_write.c:1323 [inline]
__se_sys_sendfile64 fs/read_write.c:1309 [inline]
__x64_sys_sendfile64+0x259/0x2c0 fs/read_write.c:1309
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd-> #1 (btrfs-tree-00){++++}-{3:3}:
__lock_release kernel/locking/lockdep.c:5382 [inline]
lock_release+0x371/0x810 kernel/locking/lockdep.c:5688
up_write+0x2a/0x520 kernel/locking/rwsem.c:1614
btrfs_tree_unlock_rw fs/btrfs/locking.h:189 [inline]
btrfs_unlock_up_safe+0x1e3/0x290 fs/btrfs/locking.c:238
search_leaf fs/btrfs/ctree.c:1832 [inline]
btrfs_search_slot+0x265e/0x2c70 fs/btrfs/ctree.c:2074
btrfs_insert_empty_items+0xbd/0x1c0 fs/btrfs/ctree.c:4133
btrfs_insert_delayed_item+0x826/0xfa0 fs/btrfs/delayed-inode.c:746
btrfs_insert_delayed_items fs/btrfs/delayed-inode.c:824 [inline]
__btrfs_commit_inode_delayed_items fs/btrfs/delayed-inode.c:1111 [inline]
__btrfs_run_delayed_items+0x280/0x590 fs/btrfs/delayed-inode.c:1153
flush_space+0x147/0xe90 fs/btrfs/space-info.c:728
btrfs_async_reclaim_metadata_space+0x541/0xc10 fs/btrfs/space-info.c:1086
process_one_work+0x9bf/0x1710 kernel/workqueue.c:2289
worker_thread+0x669/0x1090 kernel/workqueue.c:2436
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308-> #0 (&delayed_node->mutex){+.+.}-{3:3}:
check_prev_add kernel/locking/lockdep.c:3097 [inline]
check_prevs_add kernel/locking/lockdep.c:3216 [inline]
validate_chain kernel/locking/lockdep.c:3831 [inline]
__lock_acquire+0x2a43/0x56d0 kernel/locking/lockdep.c:5055
lock_acquire kernel/locking/lockdep.c:5668 [inline]
lock_acquire+0x1e3/0x630 kernel/locking/lockdep.c:5633
__mutex_lock_common kernel/locking/mutex.c:603 [inline]
__mutex_lock+0x12f/0x1360 kernel/locking/mutex.c:747
__btrfs_release_delayed_node.part.0+0xa1/0xf30 fs/btrfs/delayed-inode.c:256
__btrfs_release_delayed_node fs/btrfs/delayed-inode.c:251 [inline]
btrfs_release_delayed_node fs/btrfs/delayed-inode.c:281 [inline]
btrfs_remove_delayed_node+0x52/0x60 fs/btrfs/delayed-inode.c:1285
btrfs_evict_inode+0x511/0xf30 fs/btrfs/inode.c:5554
evict+0x2ed/0x6b0 fs/inode.c:664
dispose_list+0x117/0x1e0 fs/inode.c:697
prune_icache_sb+0xeb/0x150 fs/inode.c:896
super_cache_scan+0x391/0x590 fs/super.c:106
do_shrink_slab+0x464/0xce0 mm/vmscan.c:843
shrink_slab_memcg mm/vmscan.c:912 [inline]
shrink_slab+0x388/0x660 mm/vmscan.c:991
shrink_node_memcgs mm/vmscan.c:6088 [inline]
shrink_node+0x93d/0x1f30 mm/vmscan.c:6117
shrink_zones mm/vmscan.c:6355 [inline]
do_try_to_free_pages+0x3b4/0x17a0 mm/vmscan.c:6417
try_to_free_mem_cgroup_pages+0x3a4/0xa70 mm/vmscan.c:6732
reclaim_high.constprop.0+0x182/0x230 mm/memcontrol.c:2393
mem_cgroup_handle_over_high+0x190/0x520 mm/memcontrol.c:2578
try_charge_memcg+0xe0c/0x12f0 mm/memcontrol.c:2816
try_charge mm/memcontrol.c:2827 [inline]
charge_memcg+0x90/0x3b0 mm/memcontrol.c:6889
__mem_cgroup_charge+0x2b/0x90 mm/memcontrol.c:6910
mem_cgroup_charge include/linux/memcontrol.h:667 [inline]
__filemap_add_folio+0x615/0xf80 mm/filemap.c:852
filemap_add_folio+0xaf/0x1e0 mm/filemap.c:934
__filemap_get_folio+0x389/0xd80 mm/filemap.c:1976
pagecache_get_page+0x2e/0x280 mm/folio-compat.c:104
find_or_create_page include/linux/pagemap.h:612 [inline]
alloc_extent_buffer+0x2b9/0x1580 fs/btrfs/extent_io.c:4588
btrfs_init_new_buffer fs/btrfs/extent-tree.c:4869 [inline]
btrfs_alloc_tree_block+0x2e1/0x1320 fs/btrfs/extent-tree.c:4988
__btrfs_cow_block+0x3b2/0x1420 fs/btrfs/ctree.c:440
btrfs_cow_block+0x2fa/0x950 fs/btrfs/ctree.c:595
btrfs_search_slot+0x11b0/0x2c70 fs/btrfs/ctree.c:2038
btrfs_update_root+0xdb/0x630 fs/btrfs/root-tree.c:137
update_log_root fs/btrfs/tree-log.c:2841 [inline]
btrfs_sync_log+0xbfb/0x2870 fs/btrfs/tree-log.c:3064
btrfs_sync_file+0xdb9/0x13c0 fs/btrfs/file.c:1947
vfs_fsync_range+0x13e/0x230 fs/sync.c:188
generic_write_sync include/linux/fs.h:2856 [inline]
iomap_dio_complete+0x73a/0x920 fs/iomap/direct-io.c:128
btrfs_direct_write fs/btrfs/file.c:1536 [inline]
btrfs_do_write_iter+0xba2/0x1470 fs/btrfs/file.c:1668
call_write_iter include/linux/fs.h:2160 [inline]
do_iter_readv_writev+0x20b/0x3b0 fs/read_write.c:735
do_iter_write+0x182/0x700 fs/read_write.c:861
vfs_iter_write+0x74/0xa0 fs/read_write.c:902
iter_file_splice_write+0x745/0xc90 fs/splice.c:686
do_splice_from fs/splice.c:764 [inline]
direct_splice_actor+0x114/0x180 fs/splice.c:931
splice_direct_to_actor+0x335/0x8a0 fs/splice.c:886
do_splice_direct+0x1ab/0x280 fs/splice.c:974
do_sendfile+0xb19/0x1270 fs/read_write.c:1255
__do_sys_sendfile64 fs/read_write.c:1323 [inline]
__se_sys_sendfile64 fs/read_write.c:1309 [inline]
__x64_sys_sendfile64+0x259/0x2c0 fs/read_write.c:1309
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcdother info that might help us debug this:
Chain exists of:
&delayed_node->mutex --> btrfs-tree-00 --> btrfs-log-00
Possible unsafe locking scenario: CPU0 CPU1
---- ----
lock(btrfs-log-00);
lock(btrfs-tree-00);
lock(btrfs-log-00);
lock(&delayed_node->mutex);Holding a read lock on a leaf from a fs/subvolume tree creates a nasty lock dependency when we are COWing extent buffers for the log tree and we have two tasks modifying the log tree, with each one in one of the following 2 scenarios:
1) Modifying the log tree triggers an extent buffer allocation while holding a write lock on a parent extent buffer from the log tree. Allocating the pages for an extent buffer, or the extent buffer struct, can trigger inode eviction and finally the inode eviction will trigger a release/remove of a delayed node, which requires taking the delayed node's mutex;
2) Allocating a metadata extent for a log tree can trigger the async reclaim thread and make us wait for it to release enough space and unblock our reservation ticket. The reclaim thread can start flushing delayed items, and that in turn results in the need to lock delayed node mutexes and in the need to write lock extent buffers of a subvolume tree - all this while holding a write lock on the parent extent buffer in the log tree.
So one task in scenario 1) running in parallel with another task in scenario 2) could lead to a deadlock, one wanting to lock a delayed node mutex while having a read lock on a leaf from the subvolume, while the other is holding the delayed node's mutex and wants to write lock the same subvolume leaf for flushing delayed items.
Fix this by cloning the leaf of the fs/subvolume tree, release/unlock the fs/subvolume leaf and use the clone leaf instead.
--- fs/btrfs/tree-log.c | 59 ++++++++++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 55 insertions(+), 4 deletions(-)
fs/btrfs/tree-log.c +55 -4
@@ -3834,15 +3834,29 @@ static int process_dir_items_leaf(struct u64 *last_old_dentry_offset) {struct btrfs_root *log = inode->root->log_root; -struct extent_buffer *src = path->nodes[0 ]; -const int nritems =btrfs_header_nritems (src); +struct extent_buffer *src; +const int nritems =btrfs_header_nritems (path->nodes[0 ]);const u64 ino =btrfs_ino (inode);bool last_found = false;int batch_start =0 ;int batch_size =0 ;int i; -for (i = path->slots[0 ]; i < nritems; i++) { +/* +* We need to clone the leaf, release the read lock on it, and use the +* clone before modifying the log tree. See the comment at copy_items() +* about why we need to do this. +*/ + src =btrfs_clone_extent_buffer (path->nodes[0 ]); +if (!src) +return -ENOMEM ; + + i = path->slots[0 ]; +btrfs_release_path (path); + path->nodes[0 ] = src; + path->slots[0 ] = i; + +for (; i < nritems; i++) {struct btrfs_dir_item *di;struct btrfs_key key;int ret;
@@ -4414,7 +4428,7 @@ static noinline int copy_items(struct bt {struct btrfs_root *log = inode->root->log_root;struct btrfs_file_extent_item *extent; -struct extent_buffer *src = src_path->nodes[0 ]; +struct extent_buffer *src;int ret =0 ;struct btrfs_key *ins_keys;u32 *ins_sizes;
@@ -4425,6 +4439,43 @@ static noinline int copy_items(struct btconst bool skip_csum = (inode->flags &BTRFS_INODE_NODATASUM );const u64 i_size =i_size_read (&inode->vfs_inode); +/* +* To keep lockdep happy and avoid deadlocks, clone the source leaf and +* use the clone. This is because otherwise we would be changing the log +* tree, to insert items from the subvolume tree or insert csum items, +* while holding a read lock on a leaf from the subvolume tree, which +* creates a nasty lock dependency when COWing log tree nodes/leaves: +* +* 1) Modifying the log tree triggers an extent buffer allocation while +* holding a write lock on a parent extent buffer from the log tree. +* Allocating the pages for an extent buffer, or the extent buffer +* struct, can trigger inode eviction and finally the inode eviction +* will trigger a release/remove of a delayed node, which requires +* taking the delayed node's mutex; +* +* 2) Allocating a metadata extent for a log tree can trigger the async +* reclaim thread and make us wait for it to release enough space and +* unblock our reservation ticket. The reclaim thread can start +* flushing delayed items, and that in turn results in the need to +* lock delayed node mutexes and in the need to write lock extent +* buffers of a subvolume tree - all this while holding a write lock +* on the parent extent buffer in the log tree. +* +* So one task in scenario 1) running in parallel with another task in +* scenario 2) could lead to a deadlock, one wanting to lock a delayed +* node mutex while having a read lock on a leaf from the subvolume, +* while the other is holding the delayed node's mutex and wants to +* write lock the same subvolume leaf for flushing delayed items. +*/ + src =btrfs_clone_extent_buffer (src_path->nodes[0 ]); +if (!src) +return -ENOMEM ; + + i = src_path->slots[0 ]; +btrfs_release_path (src_path); + src_path->nodes[0 ] = src; + src_path->slots[0 ] = i; + ins_data =kmalloc (nr *sizeof (struct btrfs_key ) + nr *sizeof (u32),GFP_NOFS );if (!ins_data)
Greg Kroah-Hartman
maintainerPATCH 279/289 drm/i915/ttm: never purge busy objects
In reply to Greg Kroah-HartmanFrom: Matthew Auld <[email protected]>
commit 00a6c36cca760d0b659f894dee728555b193c5e1 upstream.
In i915_gem_madvise_ioctl() we immediately purge the object is not currently used, like when the mm.pages are NULL. With shmem the pages might still be hanging around or are perhaps swapped out. Similarly with ttm we might still have the pages hanging around on the ttm resource, like with lmem or shmem, but here we need to be extra careful since async unbinds are possible as well as in-progress kernel moves. In i915_ttm_purge() we expect the pipeline-gutting to nuke the ttm resource for us, however if it's busy the memory is only moved to a ghost object, which then leads to broken behaviour when for example clearing the i915_tt->filp, since the actual ttm_tt is still alive and populated, even though it's been moved to the ghost object. When we later destroy the ghost object we hit the following, since the filp is now NULL:
[ +0.006982] #PF: supervisor read access in kernel mode [ +0.005149] #PF: error_code(0x0000) - not-present page [ +0.005147] PGD 11631d067 P4D 11631d067 PUD 115972067 PMD 0 [ +0.005676] Oops: 0000 [#1] PREEMPT SMP NOPTI [ +0.012962] Workqueue: events ttm_device_delayed_workqueue [ttm] [ +0.006022] RIP: 0010:i915_ttm_tt_unpopulate+0x3a/0x70 [i915] [ +0.005879] Code: 89 fb 48 85 f6 74 11 8b 55 4c 48 8b 7d 30 45 31 c0 31 c9 e8 18 6a e5 e0 80 7d 60 00 74 20 48 8b 45 68 8b 55 08 4c 89 e7 5b 5d <48> 8b 40 20 83 e2 01 41 5c 89 d1 48 8b 70 30 e9 42 b2 ff ff 4c 89 [ +0.018782] RSP: 0000:ffffc9000bf6fd70 EFLAGS: 00010202 [ +0.005244] RAX: 0000000000000000 RBX: ffff8883e12ae380 RCX: 0000000000000000 [ +0.007150] RDX: 000000008000000e RSI: ffffffff823559b4 RDI: ffff8883e12ae3c0 [ +0.007142] RBP: ffff888103b65d48 R08: 0000000000000001 R09: 0000000000000001 [ +0.007144] R10: 0000000000000001 R11: ffff88829c2c8040 R12: ffff8883e12ae3c0 [ +0.007148] R13: 0000000000000001 R14: ffff888115184140 R15: ffff888115184248 [ +0.007154] FS: 0000000000000000(0000) GS:ffff88844db00000(0000) knlGS:0000000000000000 [ +0.008108] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ +0.005763] CR2: 0000000000000020 CR3: 000000013fdb4004 CR4: 00000000003706e0 [ +0.007152] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ +0.007145] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ +0.007154] Call Trace: [ +0.002459] <TASK> [ +0.002126] ttm_tt_unpopulate.part.0+0x17/0x70 [ttm] [ +0.005068] ttm_bo_tt_destroy+0x1c/0x50 [ttm] [ +0.004464] ttm_bo_cleanup_memtype_use+0x25/0x40 [ttm] [ +0.005244] ttm_bo_cleanup_refs+0x90/0x2c0 [ttm] [ +0.004721] ttm_bo_delayed_delete+0x235/0x250 [ttm] [ +0.004981] ttm_device_delayed_workqueue+0x13/0x40 [ttm] [ +0.005422] process_one_work+0x248/0x560 [ +0.004028] worker_thread+0x4b/0x390 [ +0.003682] ? process_one_work+0x560/0x560 [ +0.004199] kthread+0xeb/0x120 [ +0.003163] ? kthread_complete_and_exit+0x20/0x20 [ +0.004815] ret_from_fork+0x1f/0x30
v2:
- Just use ttm_bo_wait() directly (Niranjana)
- Add testcase reference
Testcase: igt@gem_madvise@dontneed-evict-race
--- drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/i915/gem/i915_gem_ttm.c +4 -0
@@ -642,6 +642,10 @@ static int i915_ttm_truncate(struct drm_WARN_ON_ONCE (obj->mm.madv ==I915_MADV_WILLNEED ); + err =ttm_bo_wait (bo, true, false); +if (err) +return err; + err =i915_ttm_move_notify (bo);if (err)return err;
Greg Kroah-Hartman
maintainerPATCH 280/289 drm/display/dp_mst: Fix drm_dp_mst_add_affected_dsc_crtcs() return code
In reply to Greg Kroah-HartmanFrom: Lyude Paul <[email protected]>
commit 2f3a1273862cb82cca227630cc7f04ce0c94b6bb upstream.
Looks like that we're accidentally dropping a pretty important return code here. For some reason, we just return -EINVAL if we fail to get the MST topology state. This is wrong: error codes are important and should never be squashed without being handled, which here seems to have the potential to cause a deadlock.
--- drivers/gpu/drm/display/drm_dp_mst_topology.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/display/drm_dp_mst_topology.c +1 -1
@@ -5293,7 +5293,7 @@ int drm_dp_mst_add_affected_dsc_crtcs(st mst_state =drm_atomic_get_mst_topology_state (state, mgr);if (IS_ERR (mst_state)) -return -EINVAL ; +return PTR_ERR (mst_state);list_for_each_entry (pos, &mst_state->vcpis, next) {
Greg Kroah-Hartman
maintainerPATCH 281/289 drm/amd/dc/dce120: Fix audio register mapping, stop triggering KASAN
In reply to Greg Kroah-HartmanFrom: Lyude Paul <[email protected]>
commit 44035ec2fde1114254ee465f9ba3bb246b0b6283 upstream.
There's been a very long running bug that seems to have been neglected for a while, where amdgpu consistently triggers a KASAN error at start:
BUG: KASAN: global-out-of-bounds in read_indirect_azalia_reg+0x1d4/0x2a0 [amdgpu] Read of size 4 at addr ffffffffc2274b28 by task modprobe/1889
After digging through amd's rather creative method for accessing registers, I eventually discovered the problem likely has to do with the fact that on my dce120 GPU there are supposedly 7 sets of audio registers. But we only define a register mapping for 6 sets.
So, fix this and fix the KASAN warning finally.
--- drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c +2 -1
@@ -359,7 +359,8 @@ static const struct dce_audio_registersaudio_regs (2 ),audio_regs (3 ),audio_regs (4 ), - audio_regs(5) +audio_regs (5 ), + audio_regs(6), };#define DCE120_AUD_COMMON_MASK_SH_LIST (mask_sh)\
Greg Kroah-Hartman
maintainerPATCH 282/289 drm/amd/display: No display after resume from WB/CB
In reply to Greg Kroah-HartmanFrom: Tsung-hua Lin <[email protected]>
commit a6e1775da04ab042bc9e2e42399fa25714c253da upstream.
[why]
First MST sideband message returns AUX_RET_ERROR_HPD_DISCON on certain intel platform. Aux transaction considered failure if HPD unexpected pulled low. The actual aux transaction success in such case, hence do not return error.
[how]
Not returning error when AUX_RET_ERROR_HPD_DISCON detected on the first sideband message.
v2: squash in fix (Alex)
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 37 ++++++++++++++++++++++ 1 file changed, 37 insertions(+)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +37 -0
@@ -1371,7 +1371,44 @@ static const struct dmi_system_id hpd_di DMI_MATCH(DMI_PRODUCT_NAME, "Precision 3460"), }, }, + { + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), + DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex Tower Plus 7010"), + }, + }, + { + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), + DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex Tower 7010"), + }, + }, + { + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), + DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex SFF Plus 7010"), + }, + }, + { + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), + DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex SFF 7010"), + }, + }, + { + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), + DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex Micro Plus 7010"), + }, + }, + { + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), + DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex Micro 7010"), + }, + }, {} + /* TODO: refactor this from a fixed table to a dynamic option */ }; static void retrieve_dmi_info(struct amdgpu_display_manager *dm)
Greg Kroah-Hartman
maintainerPATCH 283/289 drm/amdgpu/psp: dont free PSP buffers on suspend
In reply to Greg Kroah-HartmanFrom: Alex Deucher <[email protected]>
commit 4f2bea62cf3874c5a58e987b0b472f9fb57117a2 upstream.
We can reuse the same buffers on resume.
v2: squash in S4 fix from Shikai
--- drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +9 -7
@@ -171,6 +171,7 @@ void psp_ta_free_shared_buf(struct ta_me {amdgpu_bo_free_kernel (&mem_ctx->shared_bo, &mem_ctx->shared_mc_addr, &mem_ctx->shared_buf); + mem_ctx->shared_bo =NULL ; }static void psp_free_shared_bufs (struct psp_context *psp)
@@ -181,6 +182,7 @@ static void psp_free_shared_bufs(struct/* free TMR memory buffer */ pptr =amdgpu_sriov_vf (psp->adev) ? &tmr_buf :NULL ;amdgpu_bo_free_kernel (&psp->tmr_bo, &psp->tmr_mc_addr, pptr); + psp->tmr_bo =NULL ;/* free xgmi shared memory */ psp_ta_free_shared_buf (&psp->xgmi_context.context.mem_context);
@@ -728,7 +730,7 @@ static int psp_load_toc(struct psp_conte/* Set up Trusted Memory Region */ static int psp_tmr_init (struct psp_context *psp) { -int ret; +int ret =0 ;int tmr_size;void *tmr_buf;void **pptr;
@@ -755,10 +757,12 @@ static int psp_tmr_init(struct psp_conte } } - pptr =amdgpu_sriov_vf (psp->adev) ? &tmr_buf :NULL ; - ret =amdgpu_bo_create_kernel (psp->adev, tmr_size,PSP_TMR_ALIGNMENT , -AMDGPU_GEM_DOMAIN_VRAM , - &psp->tmr_bo, &psp->tmr_mc_addr, pptr); +if (!psp->tmr_bo) { + pptr =amdgpu_sriov_vf (psp->adev) ? &tmr_buf :NULL ; + ret =amdgpu_bo_create_kernel (psp->adev, tmr_size,PSP_TMR_ALIGNMENT , +AMDGPU_GEM_DOMAIN_VRAM , + &psp->tmr_bo, &psp->tmr_mc_addr, pptr); + }return ret; }
@@ -2720,8 +2724,6 @@ static int psp_suspend(void *handle) } out: -psp_free_shared_bufs (psp); -return ret; }
Greg Kroah-Hartman
maintainerPATCH 284/289 drm/amdgpu: Enable Aldebaran devices to report CU Occupancy
In reply to Greg Kroah-HartmanFrom: Ramesh Errabolu <[email protected]>
commit b9ab82da8804ec22c7e91ffd9d56c7a3abff0c8e upstream.
Allow user to know number of compute units (CU) that are in use at any given moment. Enable access to the method kgd_gfx_v9_get_cu_occupancy that computes CU occupancy.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_aldebaran.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_aldebaran.c +1 -0
@@ -41,5 +41,6 @@ const struct kfd2kgd_calls aldebaran_kfd .get_atc_vmid_pasid_mapping_info = kgd_gfx_v9_get_atc_vmid_pasid_mapping_info, .set_vm_context_page_table_base = kgd_gfx_v9_set_vm_context_page_table_base, + .get_cu_occupancy = kgd_gfx_v9_get_cu_occupancy, .program_trap_handler_settings = kgd_gfx_v9_program_trap_handler_settings };
Greg Kroah-Hartman
maintainerPATCH 285/289 drm/amd/amdgpu: reserve vm invalidation engine for firmware
In reply to Greg Kroah-HartmanFrom: Jack Xiao <[email protected]>
commit 91abf28a636291135ea5cab9af40f017cff6afce upstream.
If mes enabled, reserve VM invalidation engine 5 for firmware.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c +6 -0
@@ -479,6 +479,12 @@ int amdgpu_gmc_allocate_vm_inv_eng(strucunsigned i;unsigned vmhub, inv_eng; +if (adev->enable_mes) { +/* reserve engine 5 for firmware */ +for (vmhub =0 ; vmhub <AMDGPU_MAX_VMHUBS ; vmhub++) + vm_inv_engs[vmhub] &= ~(1 <<5 ); + } +for (i =0 ; i < adev->num_rings; ++i) { ring = adev->rings[i]; vmhub = ring->funcs->vmhub;
Greg Kroah-Hartman
maintainerPATCH 286/289 drm/amd/display: Update soc bounding box for dcn32/dcn321
In reply to Greg Kroah-HartmanFrom: Dillon Varone <[email protected]>
commit 5d82c82f1dbee264f7a94587adbbfee607706902 upstream.
[Description]
New values for soc bounding box and dummy pstate.
--- drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 6 +++--- drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c | 8 ++++---- 2 files changed, 7 insertions(+), 7 deletions(-)
drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c +3 -3
@@ -157,7 +157,7 @@ struct _vcs_dpi_soc_bounding_box_st dcn3 .dispclk_dppclk_vco_speed_mhz = 4300.0, .do_urgent_latency_adjustment = true, .urgent_latency_adjustment_fabric_clock_component_us = 1.0, - .urgent_latency_adjustment_fabric_clock_reference_mhz = 1000, + .urgent_latency_adjustment_fabric_clock_reference_mhz = 3000, };void dcn32_build_wm_range_table_fpu (struct clk_mgr_internal *clk_mgr)
@@ -211,7 +211,7 @@ void dcn32_build_wm_range_table_fpu(stru/* 'DalDummyClockChangeLatencyNs' registry key option set to 0x7FFFFFFF can be used to disable Set C for dummy p-state */ if (clk_mgr->base.ctx->dc->bb_overrides.dummy_clock_change_latency_ns !=0x7FFFFFFF ) { clk_mgr->base.bw_params->wm_table.nv_entries[WM_C ].valid = true; - clk_mgr->base.bw_params->wm_table.nv_entries[WM_C ].dml_input.pstate_latency_us =38 ; + clk_mgr->base.bw_params->wm_table.nv_entries[WM_C ].dml_input.pstate_latency_us =50 ; clk_mgr->base.bw_params->wm_table.nv_entries[WM_C ].dml_input.fclk_change_latency_us = fclk_change_latency_us; clk_mgr->base.bw_params->wm_table.nv_entries[WM_C ].dml_input.sr_exit_time_us = sr_exit_time_us; clk_mgr->base.bw_params->wm_table.nv_entries[WM_C ].dml_input.sr_enter_plus_exit_time_us = sr_enter_plus_exit_time_us;
@@ -221,7 +221,7 @@ void dcn32_build_wm_range_table_fpu(stru clk_mgr->base.bw_params->wm_table.nv_entries[WM_C ].pmfw_breakdown.min_uclk = min_uclk_mhz; clk_mgr->base.bw_params->wm_table.nv_entries[WM_C ].pmfw_breakdown.max_uclk =0xFFFF ; clk_mgr->base.bw_params->dummy_pstate_table[0 ].dram_speed_mts = clk_mgr->base.bw_params->clk_table.entries[0 ].memclk_mhz *16 ; - clk_mgr->base.bw_params->dummy_pstate_table[0 ].dummy_pstate_latency_us =38 ; + clk_mgr->base.bw_params->dummy_pstate_table[0 ].dummy_pstate_latency_us =50 ; clk_mgr->base.bw_params->dummy_pstate_table[1 ].dram_speed_mts = clk_mgr->base.bw_params->clk_table.entries[1 ].memclk_mhz *16 ; clk_mgr->base.bw_params->dummy_pstate_table[1 ].dummy_pstate_latency_us =9 ; clk_mgr->base.bw_params->dummy_pstate_table[2 ].dram_speed_mts = clk_mgr->base.bw_params->clk_table.entries[2 ].memclk_mhz *16 ;
drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c +4 -4
@@ -125,9 +125,9 @@ struct _vcs_dpi_soc_bounding_box_st dcn3 .sr_enter_plus_exit_z8_time_us = 320, .writeback_latency_us = 12.0, .round_trip_ping_latency_dcfclk_cycles = 263, - .urgent_latency_pixel_data_only_us = 9.35, - .urgent_latency_pixel_mixed_with_vm_data_us = 9.35, - .urgent_latency_vm_data_only_us = 9.35, + .urgent_latency_pixel_data_only_us = 4, + .urgent_latency_pixel_mixed_with_vm_data_us = 4, + .urgent_latency_vm_data_only_us = 4, .fclk_change_latency_us = 20, .usr_retraining_latency_us = 2, .smn_latency_us = 2,
@@ -155,7 +155,7 @@ struct _vcs_dpi_soc_bounding_box_st dcn3 .dispclk_dppclk_vco_speed_mhz = 4300.0, .do_urgent_latency_adjustment = true, .urgent_latency_adjustment_fabric_clock_component_us = 1.0, - .urgent_latency_adjustment_fabric_clock_reference_mhz = 1000, + .urgent_latency_adjustment_fabric_clock_reference_mhz = 3000, };static void get_optimal_ntuple (struct _vcs_dpi_voltage_scaling_st *entry)
Greg Kroah-Hartman
maintainerPATCH 287/289 drm/amdgpu: always register an MMU notifier for userptr
In reply to Greg Kroah-HartmanFrom: Christian König <[email protected]>
commit b39df63b16b64a3af42695acb9bc567aad144776 upstream.
Since switching to HMM we always need that because we no longer grab references to the pages.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c +3 -5
@@ -413,11 +413,9 @@ int amdgpu_gem_userptr_ioctl(struct drm_if (r) goto release_object; -if (args->flags &AMDGPU_GEM_USERPTR_REGISTER ) { - r =amdgpu_mn_register (bo, args->addr); -if (r) - goto release_object; - } + r =amdgpu_mn_register (bo, args->addr); +if (r) + goto release_object;if (args->flags &AMDGPU_GEM_USERPTR_VALIDATE ) { r =amdgpu_ttm_tt_get_user_pages (bo, bo->tbo.ttm->pages);
Greg Kroah-Hartman
maintainerPATCH 288/289 drm/amdgpu: Partially revert "drm/amdgpu: update drm_display_info correctly when the edid is read"
In reply to Greg Kroah-HartmanFrom: Alex Deucher <[email protected]>
commit 602ad43c3cd8f15cbb25ce9bb494129edb2024ed upstream.
This partially reverts 20543be93ca45968f344261c1a997177e51bd7e1.
Calling drm_connector_update_edid_property() in amdgpu_connector_free_edid() causes a noticeable pause in the system every 10 seconds on polled outputs so revert this part of the change.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 1 - 1 file changed, 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c +0 -1
@@ -328,7 +328,6 @@ static void amdgpu_connector_free_edid(skfree (amdgpu_connector->edid); amdgpu_connector->edid =NULL ; -drm_connector_update_edid_property (connector,NULL ); }static int amdgpu_connector_ddc_get_modes (struct drm_connector *connector)
Greg Kroah-Hartman
maintainerPATCH 289/289 drm/i915: fix TLB invalidation for Gen12 video and compute engines
In reply to Greg Kroah-HartmanFrom: Andrzej Hajda <[email protected]>
commit 04aa64375f48a5d430b5550d9271f8428883e550 upstream.
In case of Gen12 video and compute engines, TLB_INV registers are masked - to modify one bit, corresponding bit in upper half of the register must be enabled, otherwise nothing happens.
CVE: CVE-2022-4139
--- drivers/gpu/drm/i915/gt/intel_gt.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/gpu/drm/i915/gt/intel_gt.c +5 -0
@@ -961,6 +961,11 @@ static void mmio_invalidate_full(structif (!i915_mmio_reg_offset (rb.reg))continue ; +if (GRAPHICS_VER (i915) ==12 && (engine->class ==VIDEO_DECODE_CLASS || + engine->class ==VIDEO_ENHANCEMENT_CLASS || + engine->class ==COMPUTE_CLASS )) + rb.bit =_MASKED_BIT_ENABLE (rb.bit); +intel_uncore_write_fw (uncore, rb.reg, rb.bit); awake |= engine->mask; }
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.0.11 release. There are 289 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 02 Dec 2022 18:05:05 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.0.11-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.0.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:
Signature · 1 line
Florian
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.0.11 release. There are 289 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 02 Dec 2022 18:05:05 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.0.11-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.0.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.0.11 release. There are 289 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 02 Dec 2022 18:05:05 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.0.11-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.0.y
and the diffstat can be found below.thanks,
greg k-h
Hi Greg,
Compiled and booted on my test system Lenovo P50s: Intel Core i7 No emergency and critical messages in the dmesg
./perf bench sched all
# Running sched/messaging benchmark...
# 20 sender and receiver processes per group
# 10 groups == 400 processes run
Total time: 0.710 [sec]
# Running sched/pipe benchmark...
# Executed 1000000 pipe operations between two processes
Total time: 9.551 [sec]
9.551475 usecs/op
104695 ops/secThanks
-Zan
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.0.11 release. There are 289 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 02 Dec 2022 18:05:05 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.0.11-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.0.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro's test farm.
Regressions found on x86_64:
- build-clang-15-allmodconfig-x86_64
- build-clang-nightly-allmodconfig-x86_64
bpf: Convert BPF_DISPATCHER to use static_call() (not ftrace) [ Upstream commit c86df29d11dfba27c0a1f5039cd6fe387fbf4239 ]
Causing the following build warnings / errors with clang-15 allmodconfig on x86_64,
Build error:
make --silent --keep-going --jobs=8 O=/home/tuxbuild/.cache/tuxmake/builds/1/build LLVM=1 LLVM_IAS=1 ARCH=x86_64 SRCARCH=x86 CROSS_COMPILE=x86_64-linux-gnu- 'HOSTCC=sccache clang' 'CC=sccache clang' kernel/bpf/dispatcher.c:126:33: error: pointer type mismatch ('void *' and 'unsigned int (*)(const void *, const struct bpf_insn *, bpf_func_t)' (aka 'unsigned int (*)(const void *, const struct bpf_insn *, unsigned int (*)(const void *, const struct bpf_insn *))')) [-Werror,-Wpointer-type-mismatch]
__BPF_DISPATCHER_UPDATE(d, new ?: &bpf_dispatcher_nop_func);
~~~ ^ ~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/bpf.h:938:54: note: expanded from macro '__BPF_DISPATCHER_UPDATE'
__static_call_update((_d)->sc_key, (_d)->sc_tramp, (_new))
^~~~1 error generated.
Build logs:
- https://builds.tuxbuild.com/2IHYTj6JN108YShWQ8K8Fd0HyVW/
--
Linaro LKFT
https://lkft.linaro.org
Quoted 45 lines · Naresh Kamboju
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.0.11 release. There are 289 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 02 Dec 2022 18:05:05 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.0.11-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.0.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro's test farm.
Regressions found onx86_64:- build-clang-15-allmodconfig-x86_64
- build-clang-nightly-allmodconfig-x86_64bpf: Convert
BPF_DISPATCHERto usestatic_call()(not ftrace) [ Upstream commitc86df29d11dfba27c0a1f5039cd6fe387fbf4239]Causing the following build warnings / errors with clang-15 allmodconfig on
x86_64,Build error:
make --silent --keep-going --jobs=8 O=/home/tuxbuild/.cache/tuxmake/builds/1/build LLVM=1 LLVM_IAS=1 ARCH=x86_64 SRCARCH=x86 CROSS_COMPILE=x86_64-linux-gnu- 'HOSTCC=sccache clang' 'CC=sccache clang'kernel/bpf/dispatcher.c:126:33: error: pointer type mismatch ('void *' and 'unsigned int (*)(const void *, const structbpf_insn*,bpf_func_t)' (aka 'unsigned int (*)(const void *, const structbpf_insn*, unsigned int (*)(const void *, const structbpf_insn*))')) [-Werror,-Wpointer-type-mismatch]
Quoted 6 lines
__BPF_DISPATCHER_UPDATE(d, new ?: &bpf_dispatcher_nop_func); ~~~ ^ ~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/bpf.h:938:54: note: expanded from macro '__BPF_DISPATCHER_UPDATE' __static_call_update((_d)->sc_key, (_d)->sc_tramp, (_new)) ^~~~1 error generated.
Thanks for the report! This is fixed with upstream commit a679120edfcf ("bpf: Add explicit cast to 'void *' for __BPF_DISPATCHER_UPDATE()"), which was marked as a fix for c86df29d11df.
Cheers,
Nathan
Greg Kroah-Hartman
maintainerQuoted 53 lines · Nathan Chancellor
Quoted 45 lines · Naresh Kamboju
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.0.11 release. There are 289 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 02 Dec 2022 18:05:05 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.0.11-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.0.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro's test farm.
Regressions found onx86_64:- build-clang-15-allmodconfig-x86_64
- build-clang-nightly-allmodconfig-x86_64bpf: Convert
BPF_DISPATCHERto usestatic_call()(not ftrace) [ Upstream commitc86df29d11dfba27c0a1f5039cd6fe387fbf4239]Causing the following build warnings / errors with clang-15 allmodconfig on
x86_64,Build error:
make --silent --keep-going --jobs=8 O=/home/tuxbuild/.cache/tuxmake/builds/1/build LLVM=1 LLVM_IAS=1 ARCH=x86_64 SRCARCH=x86 CROSS_COMPILE=x86_64-linux-gnu- 'HOSTCC=sccache clang' 'CC=sccache clang'kernel/bpf/dispatcher.c:126:33: error: pointer type mismatch ('void *' and 'unsigned int (*)(const void *, const structbpf_insn*,bpf_func_t)' (aka 'unsigned int (*)(const void *, const structbpf_insn*, unsigned int (*)(const void *, const structbpf_insn*))')) [-Werror,-Wpointer-type-mismatch]Quoted 6 lines
__BPF_DISPATCHER_UPDATE(d, new ?: &bpf_dispatcher_nop_func); ~~~ ^ ~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/bpf.h:938:54: note: expanded from macro '__BPF_DISPATCHER_UPDATE' __static_call_update((_d)->sc_key, (_d)->sc_tramp, (_new)) ^~~~1 error generated.
Quoted 3 lines
Thanks for the report! This is fixed with upstream commit
a679120edfcf("bpf: Add explicit cast to 'void *' for__BPF_DISPATCHER_UPDATE()"), which was marked as a fix forc86df29d11df.
Now queued up. I forgot to run my "do we need fixes for the fixes" script on the queues, sorry about that.
greg k-h
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.0.11 release. There are 289 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 02 Dec 2022 18:05:05 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.0.11-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.0.y
and the diffstat can be found below.thanks,
greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.0.11 release. There are 289 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 02 Dec 2022 18:05:05 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.0.11-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.0.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro's test farm.
On the arm32bit TI Beagleboard X15 the intermittent Internal error: noticed on stable-rc 6.0.11-rc1 attached boot log. I have re-tested multiple on stable-rc 6.0.11-rc1 but not reproduced.
Old report that was reported on Linux next-20220526 tag.
Internal error: Oops: 5 [#1] SMP ARM: PC is at l3_interrupt_handler
https://lore.kernel.org/all/CA+G9fYtNLnFs-RWeSkLDq9imwout7px4O13OqAgGxK1O6fGEBA@mail.gmail.com/The stable-rc 6.0.11-rc1 x15 crash log details,
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.0.y/build/v6.0.9-604-g57e2fc7c0112/testrun/13332986/suite/log-parser-test/tests/
--
Linaro LKFT
https://lkft.linaro.org
Starting kernel ...
[ 0.000000] Booting Linux on physical CPU 0x0 [ 0.000000] Linux version 6.0.11-rc1 (tuxmake@tuxmake) (arm-linux-gnueabihf-gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2) #1 SMP @1669834074 [ 0.000000] CPU: ARMv7 Processor [412fc0f2] revision 2 (ARMv7), cr=10c5387d [ 0.000000] CPU: div instructions available: patching division code [ 0.000000] CPU: PIPT / VIPT nonaliasing data cache, PIPT instruction cache [ 0.000000] OF: fdt: Machine model: TI AM5728 BeagleBoard-X15 [ 0.000000] Memory policy: Data cache writealloc [ 0.000000] efi: UEFI not found. [ 0.000000] Reserved memory: created CMA memory pool at 0x95800000, size 56 MiB [ 0.000000] OF: reserved mem: initialized node ipu2-memory@95800000, compatible id shared-dma-pool [ 0.000000] Reserved memory: created CMA memory pool at 0x99000000, size 64 MiB [ 0.000000] OF: reserved mem: initialized node dsp1-memory@99000000, compatible id shared-dma-pool [ 0.000000] Reserved memory: created CMA memory pool at 0x9d000000, size 32 MiB [ 0.000000] OF: reserved mem: initialized node ipu1-memory@9d000000, compatible id shared-dma-pool [ 0.000000] Reserved memory: created CMA memory pool at 0x9f000000, size 8 MiB [ 0.000000] OF: reserved mem: initialized node dsp2-memory@9f000000, compatible id shared-dma-pool [ 0.000000] cma: Reserved 64 MiB at 0xfb800000 [ 0.000000] OMAP4: Map 0xafe00000 to (ptrval) for dram barrier [ 0.000000] Zone ranges: [ 0.000000] DMA [mem 0x0000000080000000-0x00000000afdfffff] [ 0.000000] Normal empty [ 0.000000] HighMem [mem 0x00000000afe00000-0x00000000ffffefff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x0000000080000000-0x00000000afdfffff] [ 0.000000] node 0: [mem 0x00000000b0000000-0x00000000ffffefff] [ 0.000000] Initmem setup node 0 [mem 0x0000000080000000-0x00000000ffffefff] [ 0.000000] On node 0, zone HighMem: 512 pages in unavailable ranges [ 0.000000] DRA752 ES2.0 [ 0.000000] percpu: Embedded 16 pages/cpu s35156 r8192 d22188 u65536 [ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 522051 [ 0.000000] Kernel command line: console=ttyS2,115200n8 root=PARTUUID=21674ce0-3b3d-d74e-a1fb-cb0f72855b64 rw rootfstype=ext4 rootwait [ 0.000000] Dentry cache hash table entries: 131072 (order: 7, 524288 bytes, linear) [ 0.000000] Inode-cache hash table entries: 65536 (order: 6, 262144 bytes, linear) [ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off [ 0.000000] Memory: 1812560K/2095100K available (17408K kernel code, 2688K rwdata, 8948K rodata, 2048K init, 505K bss, 53164K reserved, 229376K cma-reserved, 1245180K highmem) [ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1 [ 0.000000] ftrace: allocating 60953 entries in 179 pages [ 0.000000] ftrace: allocated 179 pages with 5 groups [ 0.000000] trace event string verifier disabled [ 0.000000] rcu: Hierarchical RCU implementation. [ 0.000000] rcu: RCU event tracing is enabled. [ 0.000000] rcu: RCU restricting CPUs from NR_CPUS=16 to nr_cpu_ids=2. [ 0.000000] Rude variant of Tasks RCU enabled. [ 0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies. [ 0.000000] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=2 [ 0.000000] NR_IRQS: 16, nr_irqs: 16, preallocated irqs: 16 [ 0.000000] GIC: Using split EOI/Deactivate mode [ 0.000000] rcu: srcu_init: Setting srcu_struct sizes based on contention. [ 0.000000] OMAP clocksource: 32k_counter at 32768 Hz [ 0.000000] clocksource: 32k_counter: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 58327039986419 ns [ 0.000000] sched_clock: 32 bits at 33kHz, resolution 30517ns, wraps every 65535999984741ns [ 0.002593] TI gptimer clockevent: always-on 32786 Hz at /ocp/interconnect@4ae00000/segment@10000/target-module@8000 [ 0.007171] TI gptimer percpu-dmtimer: 20000000 Hz at /ocp/interconnect@48800000/segment@0/target-module@2c000 [ 0.007385] TI gptimer percpu-dmtimer: 20000000 Hz at /ocp/interconnect@48800000/segment@0/target-module@2e000 [ 0.010711] Console: colour dummy device 80x30 [ 0.010742] Calibrating delay loop... 1993.93 BogoMIPS (lpj=9969664) [ 0.063232] pid_max: default: 32768 minimum: 301 [ 0.063385] Mount-cache hash table entries: 2048 (order: 1, 8192 bytes, linear) [ 0.063415] Mountpoint-cache hash table entries: 2048 (order: 1, 8192 bytes, linear) [ 0.063995] CPU: Testing write buffer coherency: ok [ 0.064025] CPU0: Spectre v2: using ICIALLU workaround [ 0.064056] CPU0: Spectre BHB: enabling loop workaround for all CPUs [ 0.064270] /cpus/cpu@0 missing clock-frequency property [ 0.064300] /cpus/cpu@1 missing clock-frequency property [ 0.064331] CPU0: thread -1, cpu 0, socket 0, mpidr 80000000 [ 0.065093] cblist_init_generic: Setting adjustable number of callback queues. [ 0.065093] cblist_init_generic: Setting shift to 1 and lim to 1. [ 0.065185] Setting up static identity map for 0x80300000 - 0x803000ac [ 0.068511] rcu: Hierarchical SRCU implementation. [ 0.068511] rcu: Max phase no-delay instances is 1000. [ 0.077545] EFI services will not be available. [ 0.078155] smp: Bringing up secondary CPUs ... [ 0.138305] CPU1: thread -1, cpu 1, socket 0, mpidr 80000001 [ 0.138336] CPU1: Spectre v2: using ICIALLU workaround [ 0.138458] smp: Brought up 1 node, 2 CPUs [ 0.138458] SMP: Total of 2 processors activated (3994.41 BogoMIPS). [ 0.138488] CPU: All CPU(s) started in HYP mode. [ 0.138488] CPU: Virtualization extensions available. [ 0.138946] devtmpfs: initialized [ 0.160430] VFP support v0.3: implementor 41 architecture 4 part 30 variant f rev 0 [ 0.160583] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns [ 0.160614] futex hash table entries: 512 (order: 3, 32768 bytes, linear) [ 0.164062] pinctrl core: initialized pinctrl subsystem [ 0.169921] DMI not present or invalid. [ 0.170410] NET: Registered PF_NETLINK/PF_ROUTE protocol family [ 0.172851] DMA: preallocated 256 KiB pool for atomic coherent allocations [ 0.176788] thermal_sys: Registered thermal governor 'step_wise' [ 0.177856] cpuidle: using governor menu [ 0.219360] platform encoder: Fixing up cyclic dependency with connector [ 0.219940] No ATAGs? [ 0.220031] hw-breakpoint: found 5 (+1 reserved) breakpoint and 4 watchpoint registers. [ 0.220031] hw-breakpoint: maximum watchpoint size is 8 bytes. [ 0.227783] Serial: AMBA PL011 UART driver [ 0.240203] kprobes: kprobe jump-optimization is enabled. All kprobes are optimized if possible. [ 0.249786] cryptd: max_cpu_qlen set to 1000 [ 0.256072] iommu: Default domain type: Translated [ 0.256072] iommu: DMA domain TLB invalidation policy: strict mode [ 0.256622] SCSI subsystem initialized [ 0.257019] usbcore: registered new interface driver usbfs [ 0.257049] usbcore: registered new interface driver hub [ 0.257080] usbcore: registered new device driver usb [ 0.258148] mc: Linux media interface: v0.10 [ 0.258178] videodev: Linux video capture interface: v2.00 [ 0.258239] pps_core: LinuxPPS API ver. 1 registered [ 0.258270] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <[email protected]> [ 0.258270] PTP clock support registered [ 0.258422] EDAC MC: Ver: 3.0.0 [ 1.034301] vgaarb: loaded [ 1.034576] clocksource: Switched to clocksource 32k_counter [ 1.091918] NET: Registered PF_INET protocol family [ 1.092132] IP idents hash table entries: 16384 (order: 5, 131072 bytes, linear) [ 1.093261] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear) [ 1.093292] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear) [ 1.093322] TCP established hash table entries: 8192 (order: 3, 32768 bytes, linear) [ 1.093383] TCP bind hash table entries: 8192 (order: 4, 65536 bytes, linear) [ 1.093505] TCP: Hash tables configured (established 8192 bind 8192) [ 1.093627] MPTCP token hash table entries: 1024 (order: 2, 16384 bytes, linear) [ 1.093658] UDP hash table entries: 512 (order: 2, 16384 bytes, linear) [ 1.093688] UDP-Lite hash table entries: 512 (order: 2, 16384 bytes, linear) [ 1.093841] NET: Registered PF_UNIX/PF_LOCAL protocol family [ 1.094360] RPC: Registered named UNIX socket transport module. [ 1.094360] RPC: Registered udp transport module. [ 1.094360] RPC: Registered tcp transport module. [ 1.094390] RPC: Registered tcp NFSv4.1 backchannel transport module. [ 1.094390] PCI: CLS 0 bytes, default 64 [ 1.094879] armv7-pmu pmu: hw perfevents: no interrupt-affinity property, guessing. [ 1.095092] hw perfevents: enabled with armv7_cortex_a15 PMU driver, 7 counters available [ 1.096038] Initialise system trusted keyrings [ 1.096252] workingset: timestamp_bits=14 max_order=19 bucket_order=5 [ 1.102630] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 1.103332] NFS: Registering the id_resolver key type [ 1.103363] Key type id_resolver registered [ 1.103393] Key type id_legacy registered [ 1.103454] nfs4filelayout_init: NFSv4 File Layout Driver Registering... [ 1.103454] nfs4flexfilelayout_init: NFSv4 Flexfile Layout Driver Registering... [ 1.103485] ntfs: driver 2.1.32 [Flags: R/O]. [ 1.104888] jitterentropy: Initialization failed with host not compliant with requirements: 2 [ 1.104888] NET: Registered PF_ALG protocol family [ 1.104919] Key type asymmetric registered [ 1.104919] Asymmetric key parser 'x509' registered [ 1.105072] bounce: pool size: 64 pages [ 1.105163] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 246) [ 1.105163] io scheduler mq-deadline registered [ 1.105163] io scheduler kyber registered [ 1.188262] Serial: 8250/16550 driver, 5 ports, IRQ sharing enabled [ 1.191528] SuperH (H)SCI(F) driver initialized [ 1.192230] msm_serial: driver initialized [ 1.192230] STMicroelectronics ASC driver initialized [ 1.193847] STM32 USART driver initialized [ 1.206268] brd: module loaded [ 1.210998] loop: module loaded [ 1.221221] CAN device driver interface [ 1.222045] bgmac_bcma: Broadcom 47xx GBit MAC driver loaded [ 1.222839] e1000e: Intel(R) PRO/1000 Network Driver [ 1.222839] e1000e: Copyright(c) 1999 - 2015 Intel Corporation. [ 1.222869] igb: Intel(R) Gigabit Ethernet Network Driver [ 1.222900] igb: Copyright (c) 2007-2014 Intel Corporation. [ 1.223358] QLogic FastLinQ 4xxxx Core Module qed [ 1.223358] qede init: QLogic FastLinQ 4xxxx Ethernet Driver qede [ 1.226135] pegasus: Pegasus/Pegasus II USB Ethernet driver [ 1.226165] usbcore: registered new interface driver pegasus [ 1.226196] usbcore: registered new interface driver asix [ 1.226226] usbcore: registered new interface driver ax88179_178a [ 1.226257] usbcore: registered new interface driver cdc_ether [ 1.226287] usbcore: registered new interface driver smsc75xx [ 1.226348] usbcore: registered new interface driver smsc95xx [ 1.226379] usbcore: registered new interface driver net1080 [ 1.226409] usbcore: registered new interface driver cdc_subset [ 1.226440] usbcore: registered new interface driver zaurus [ 1.226501] usbcore: registered new interface driver cdc_ncm [ 1.228302] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver [ 1.228302] ehci-pci: EHCI PCI platform driver [ 1.228332] ehci-platform: EHCI generic platform driver [ 1.228485] ehci-omap: OMAP-EHCI Host Controller driver [ 1.228576] ehci-orion: EHCI orion driver [ 1.228698] SPEAr-ehci: EHCI SPEAr driver [ 1.228820] ehci-st: EHCI STMicroelectronics driver [ 1.228912] ehci-atmel: EHCI Atmel driver [ 1.229034] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver [ 1.229034] ohci-pci: OHCI PCI platform driver [ 1.229064] ohci-platform: OHCI generic platform driver [ 1.229187] SPEAr-ohci: OHCI SPEAr driver [ 1.229309] ohci-st: OHCI STMicroelectronics driver [ 1.229400] ohci-atmel: OHCI Atmel driver [ 1.229797] usbcore: registered new interface driver usb-storage [ 1.233703] i2c_dev: i2c /dev entries driver [ 1.245147] cpu cpu0: Failed to set OPP config [ 1.246704] sdhci: Secure Digital Host Controller Interface driver [ 1.246734] sdhci: Copyright(c) Pierre Ossman [ 1.248138] Synopsys Designware Multimedia Card Interface Driver [ 1.249420] sdhci-pltfm: SDHCI platform and OF driver helper [ 1.251770] ledtrig-cpu: registered to indicate activity on CPUs [ 1.255645] usbcore: registered new interface driver usbhid [ 1.255645] usbhid: USB HID core driver [ 1.258544] cs_system_cfg: CoreSight Configuration manager initialised [ 1.262573] NET: Registered PF_INET6 protocol family [ 1.263549] Segment Routing with IPv6 [ 1.263580] In-situ OAM (IOAM) with IPv6 [ 1.263641] sit: IPv6, IPv4 and MPLS over IPv4 tunneling driver [ 1.264129] NET: Registered PF_PACKET protocol family [ 1.264129] can: controller area network core [ 1.264190] NET: Registered PF_CAN protocol family [ 1.264190] can: raw protocol [ 1.264221] can: broadcast manager protocol [ 1.264221] can: netlink gateway - max_hops=1 [ 1.264495] Key type dns_resolver registered [ 1.264556] ThumbEE CPU extension supported. [ 1.264617] Registering SWP/SWPB emulation handler [ 1.264984] omap_voltage_late_init: Voltage driver support not added [ 1.265014] Power Management for TI OMAP4+ devices. [ 1.265869] registered taskstats version 1 [ 1.265869] Loading compiled-in X.509 certificates [ 1.331085] pinctrl-single 4a003400.pinmux: 282 pins, size 1128 [ 1.391998] omap-dma-engine 4a056000.dma-controller: OMAP DMA engine driver (LinkedList1/2/3 supported) [ 1.411712] ahci 4a140000.sata: supply ahci not found, using dummy regulator [ 1.411804] ahci 4a140000.sata: supply phy not found, using dummy regulator [ 1.411926] ahci 4a140000.sata: supply target not found, using dummy regulator [ 1.412292] ahci 4a140000.sata: forcing port_map 0x0 -> 0x1 [ 1.412322] ahci 4a140000.sata: AHCI 0001.0300 32 slots 1 ports 3 Gbps 0x1 impl platform mode [ 1.412322] ahci 4a140000.sata: flags: 64bit ncq sntf pm led clo only pmp pio slum part ccc apst [ 1.413635] scsi host0: ahci [ 1.413879] ata1: SATA max UDMA/133 mmio [mem 0x4a140000-0x4a1410ff] port 0x100 irq 98 [ 1.428741] gpio gpiochip0: (gpio-0-31): not an immutable chip, please consider fixing it! [ 1.429138] OMAP GPIO hardware version 0.1 [ 1.434173] ti-sysc: probe of 4ae18000.target-module failed with error -16 [ 1.449310] printk: console [ttyS2] disabled [ 1.449401] 48020000.serial: ttyS2 at MMIO 0x48020000 (irq = 101, base_baud = 3000000) is a 8250 [ 1.746398] ata1: SATA link down (SStatus 0 SControl 300) [ 2.787048] printk: console [ttyS2] enabled [ 2.806579] gpio gpiochip1: (gpio-32-63): not an immutable chip, please consider fixing it! [ 2.817199] gpio gpiochip2: (gpio-64-95): not an immutable chip, please consider fixing it! [ 2.827697] gpio gpiochip3: (gpio-96-127): not an immutable chip, please consider fixing it! [ 2.838256] gpio gpiochip4: (gpio-128-159): not an immutable chip, please consider fixing it! [ 2.848907] gpio gpiochip5: (gpio-160-191): not an immutable chip, please consider fixing it! [ 2.859527] gpio gpiochip6: (gpio-192-223): not an immutable chip, please consider fixing it! [ 2.870239] gpio gpiochip7: (gpio-224-255): not an immutable chip, please consider fixing it! [ 2.882171] omap_i2c 48060000.i2c: bus 2 rev0.12 at 400 kHz [ 2.897308] palmas 0-0058: Irq flag is 0x00000008 [ 2.928894] palmas 0-0058: Muxing GPIO 2f, PWM 0, LED 0 [ 2.977050] at24 0-0050: supply vcc not found, using dummy regulator [ 2.983856] at24 0-0050: 4096 byte 24c32 EEPROM, writable, 1 bytes/write [ 2.990753] omap_i2c 48070000.i2c: bus 0 rev0.12 at 400 kHz [ 3.010711] omap_rng 48090000.rng: Random Number Generator ver. 20 [ 3.010955] random: crng init done [ 3.025238] omap_gpio 4805d000.gpio: Could not set line 27 debounce to 200000 microseconds (-22) [ 3.034057] sdhci-omap 4809c000.mmc: Got CD GPIO [ 3.039031] sdhci-omap 4809c000.mmc: supply vqmmc not found, using dummy regulator [ 3.070953] sdhci-omap 4809c000.mmc: no pinctrl state for ddr_3_3v mode [ 3.104827] mmc0: SDHCI controller on 4809c000.mmc [4809c000.mmc] using ADMA [ 3.124603] davinci_mdio 48485000.mdio: davinci mdio revision 1.6, bus freq 1000000 [ 3.135528] davinci_mdio 48485000.mdio: phy[1]: device 48485000.mdio:01, driver Micrel KSZ9031 Gigabit PHY [ 3.145263] davinci_mdio 48485000.mdio: phy[2]: device 48485000.mdio:02, driver Micrel KSZ9031 Gigabit PHY [ 3.155578] cpsw-switch 48484000.switch: initialized cpsw ale version 1.4 [ 3.162414] cpsw-switch 48484000.switch: ALE Table size 1024 [ 3.168182] cpsw-switch 48484000.switch: cpts: overflow check period 500 (jiffies) [ 3.175842] cpsw-switch 48484000.switch: CPTS: ref_clk_freq:266000000 calc_mult:4036623398 calc_shift:30 error:-1 nsec/sec [ 3.187011] cpsw-switch 48484000.switch: Detected MACID = f8:30:02:cf:6e:e6 [ 3.194030] cpsw-switch 48484000.switch: Detected MACID = f8:30:02:cf:6e:e7 [ 3.202789] cpsw-switch 48484000.switch: initialized (regs 0x48484000, pool size 256) hw_ver:0019010F 1.15 (0) [ 3.237701] ti-sysc: probe of 4882c000.target-module failed with error -16 [ 3.247070] ti-sysc: probe of 4882e000.target-module failed with error -16 [ 3.290252] dra7-pcie 51000000.pcie: host bridge /ocp/target-module@51000000/pcie@51000000 ranges: [ 3.299346] dra7-pcie 51000000.pcie: IO 0x0020003000..0x0020012fff -> 0x0000000000 [ 3.307556] dra7-pcie 51000000.pcie: MEM 0x0020013000..0x002fffffff -> 0x0020013000 [ 3.315795] dra7-pcie 51000000.pcie: iATU unroll: disabled [ 3.321319] dra7-pcie 51000000.pcie: iATU regions: 16 ob, 4 ib, align 4K, limit 4G [ 4.329772] dra7-pcie 51000000.pcie: Phy link never came up [ 4.335540] dra7-pcie 51000000.pcie: PCI host bridge to bus 0000:00 [ 4.341857] pci_bus 0000:00: root bus resource [bus 00-ff] [ 4.347412] pci_bus 0000:00: root bus resource [io 0x0000-0xffff] [ 4.353607] pci_bus 0000:00: root bus resource [mem 0x20013000-0x2fffffff] [ 4.360565] pci 0000:00:00.0: [104c:8888] type 01 class 0x060400 [ 4.366638] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x000fffff] [ 4.372955] pci 0000:00:00.0: reg 0x14: [mem 0x00000000-0x0000ffff] [ 4.379364] pci 0000:00:00.0: supports D1 [ 4.383392] pci 0000:00:00.0: PME# supported from D0 D1 D3hot [ 4.396392] PCI: bus0: Fast back to back transfers disabled [ 4.402313] PCI: bus1: Fast back to back transfers enabled [ 4.407867] pci 0000:00:00.0: BAR 0: assigned [mem 0x20100000-0x201fffff] [ 4.414703] pci 0000:00:00.0: BAR 1: assigned [mem 0x20020000-0x2002ffff] [ 4.421539] pci 0000:00:00.0: PCI bridge to [bus 01-ff] [ 4.427215] pcieport 0000:00:00.0: PME: Signaling with IRQ 135 [ 4.442047] edma 43300000.dma: memcpy is disabled [ 4.449768] edma 43300000.dma: TI EDMA DMA engine driver [ 4.484130] ti_abb 4ae07e30.regulator-abb-dspeve: can't request region for resource [mem 0x4ae06010-0x4ae06013] [ 4.494293] ti_abb: probe of 4ae07e30.regulator-abb-dspeve failed with error -16 [ 4.503906] ti_abb 4ae07de4.regulator-abb-gpu: can't request region for resource [mem 0x4ae06010-0x4ae06013] [ 4.513824] ti_abb: probe of 4ae07de4.regulator-abb-gpu failed with error -16 [ 4.547515] ti_opp_supply: probe of 4a003b20.opp-supply failed with error 1 [ 4.606109] rtc-ds1307 2-006f: registered as rtc0 [ 4.611145] rtc-ds1307 2-006f: hctosys: unable to read the hardware clock [ 4.622070] palmas-rtc 48070000.i2c:tps659038@58:tps659038_rtc: registered as rtc1 [ 4.635375] sdhci-omap 480b4000.mmc: supply pbias not found, using dummy regulator [ 4.644439] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller [ 4.649993] xhci-hcd xhci-hcd.1.auto: new USB bus registered, assigned bus number 1 [ 4.658325] xhci-hcd xhci-hcd.1.auto: hcc params 0x0220f04c hci version 0x100 quirks 0x0000000002010010 [ 4.667816] xhci-hcd xhci-hcd.1.auto: irq 142, io mem 0x48890000 [ 4.673980] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller [ 4.679504] xhci-hcd xhci-hcd.1.auto: new USB bus registered, assigned bus number 2 [ 4.683502] mmc1: SDHCI controller on 480b4000.mmc [480b4000.mmc] using ADMA [ 4.687225] xhci-hcd xhci-hcd.1.auto: Host supports USB 3.0 SuperSpeed [ 4.701568] hub 1-0:1.0: USB hub found [ 4.705383] hub 1-0:1.0: 1 port detected [ 4.709716] usb usb2: We don't know the algorithms for LPM for this host, disabling LPM. [ 4.718475] hub 2-0:1.0: USB hub found [ 4.722381] hub 2-0:1.0: 1 port detected [ 4.732055] Waiting for root device PARTUUID=21674ce0-3b3d-d74e-a1fb-cb0f72855b64... [ 4.771789] mmc1: new DDR MMC card at address 0001 [ 4.777160] mmcblk1: mmc1:0001 M62704 3.53 GiB [ 4.786254] mmcblk1: p1 p2 p3 p4 p5 p6 p7 p8 p9 p10 p11 p12 p13 p14 [ 4.794189] mmcblk1boot0: mmc1:0001 M62704 2.00 MiB [ 4.800140] mmcblk1boot1: mmc1:0001 M62704 2.00 MiB [ 4.806060] mmcblk1rpmb: mmc1:0001 M62704 512 KiB, chardev (235:0) [ 5.034576] usb 1-1: new high-speed USB device number 2 using xhci-hcd [ 5.080200] EXT4-fs (mmcblk1p12): mounted filesystem with ordered data mode. Quota mode: disabled. [ 5.093444] VFS: Mounted root (ext4 filesystem) on device 179:12. [ 5.100830] devtmpfs: mounted [ 5.114898] Freeing unused kernel image (initmem) memory: 2048K [ 5.121093] Run /sbin/init as init process [ 5.241271] systemd[1]: System time before build time, advancing clock. [ 5.260406] systemd[1]: systemd 250.5+ running in system mode (-PAM -AUDIT -SELINUX -APPARMOR +IMA -SMACK +SECCOMP -GCRYPT -GNUTLS -OPENSSL +ACL +BLKID -CURL -ELFUTILS -FIDO2 -IDN2 -IDN -IPTC +KMOD -LIBCRYPTSETUP +LIBFDISK -PCRE2 -PWQUALITY -P11KIT -QRENCODE -BZIP2 -LZ4 -XZ -ZLIB +ZSTD -BPF_FRAMEWORK +XKBCOMMON +UTMP +SYSVINIT default-hierarchy=hybrid) [ 5.277526] hub 1-1:1.0: USB hub found [ 5.292297] systemd[1]: Detected architecture arm. [ 5.295684] hub 1-1:1.0: 4 ports detected [ 5.374694] usb 2-1: new SuperSpeed USB device number 2 using xhci-hcd
Welcome to Linux-Kernel-Functional-Testing nodistro.0!
[ 5.415313] systemd[1]: Hostname set to <am57xx-evm>.
[ 5.424713] systemd[1]: Initializing machine ID from random generator.
[ 5.453491] hub 2-1:1.0: USB hub found
[ 5.457489] hub 2-1:1.0: 4 ports detected
[ 5.744598] ata1: SATA link up 3.0 Gbps (SStatus 123 SControl 300)
[ 5.754943] ata1.00: ATA-9: SanDisk SSD PLUS 120GB, UE5000RL, max UDMA/133
[ 5.761871] ata1.00: 234455040 sectors, multi 1: LBA48 NCQ (depth 32)
[ 5.769134] ata1.00: Features: Dev-Sleep
[ 5.778015] ata1.00: configured for UDMA/133
[ 5.782501] scsi 0:0:0:0: Direct-Access ATA SanDisk SSD PLUS 00RL PQ: 0 ANSI: 5
[ 5.791534] sd 0:0:0:0: [sda] 234455040 512-byte logical blocks: (120 GB/112 GiB)
[ 5.804595] sd 0:0:0:0: [sda] Write Protect is off
[ 5.809478] sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
[ 5.818695] sd 0:0:0:0: [sda] Preferred minimum I/O size 512 bytes
[ 5.826110] sd 0:0:0:0: [sda] Attached SCSI disk
[ 6.182128] systemd[1]: Queued start job for default target Multi-User System.
[ 6.263397] systemd[1]: Created slice Slice /system/getty.
[ OK ] Created slice Slice /system/getty.
[ 6.306396] systemd[1]: Created slice Slice /system/modprobe.
[ OK ] Created slice Slice /system/modprobe.
[ 6.346130] systemd[1]: Created slice Slice /system/serial-getty.
[ OK ] Created slice Slice /system/serial-getty.
[ 6.385833] systemd[1]: Created slice User and Session Slice.
[ OK ] Created slice User and Session Slice.
[ 6.425415] systemd[1]: Started Dispatch Password Requests to Console Directory Watch.
[ OK ] Started Dispatch Password …ts to Console Directory Watch.
[ 6.464904] systemd[1]: Started Forward Password Requests to Wall Directory Watch.
[ OK ] Started Forward Password R…uests to Wall Directory Watch.
[ 6.505645] systemd[1]: Reached target Path Units.
[ OK ] Reached target Path Units.
[ 6.544769] systemd[1]: Reached target Remote File Systems.
[ OK ] Reached target Remote File Systems.
[ 6.585113] systemd[1]: Reached target Slice Units.
[ OK ] Reached target Slice Units.
[ 6.624786] systemd[1]: Reached target Swaps.
[ OK ] Reached target Swaps.
[ 6.656433] systemd[1]: Listening on RPCbind Server Activation Socket.
[ OK ] Listening on RPCbind Server Activation Socket.
[ 6.694763] systemd[1]: Reached target RPC Port Mapper.
[ OK ] Reached target RPC Port Mapper.
[ 6.736267] systemd[1]: Listening on Syslog Socket.
[ OK ] Listening on Syslog Socket.
[ 6.774932] systemd[1]: Listening on initctl Compatibility Named Pipe.
[ OK ] Listening on initctl Compatibility Named Pipe.
[ 6.836822] systemd[1]: Journal Audit Socket was skipped because of a failed condition check (ConditionSecurity=audit).
[ 6.848266] systemd[1]: Listening on Journal Socket (/dev/log).
[ OK ] Listening on Journal Socket (/dev/log).
[ 6.885162] systemd[1]: Listening on Journal Socket.
[ OK ] Listening on Journal Socket.
[ 6.926025] systemd[1]: Listening on Network Service Netlink Socket.
[ OK ] Listening on Network Service Netlink Socket.
[ 6.965209] systemd[1]: Listening on udev Control Socket.
[ OK ] Listening on udev Control Socket.
[ 7.005126] systemd[1]: Listening on udev Kernel Socket.
[ OK ] Listening on udev Kernel Socket.
[ 7.045745] systemd[1]: Listening on User Database Manager Socket.
[ OK ] Listening on User Database Manager Socket.
[ 7.085815] systemd[1]: Huge Pages File System was skipped because of a failed condition check (ConditionPathExists=/sys/kernel/mm/hugepages).
[ 7.145019] systemd[1]: Mounting POSIX Message Queue File System...
Mounting POSIX Message Queue File System...
[ 7.188415] systemd[1]: Mounting Kernel Debug File System...
Mounting Kernel Debug File System...
[ 7.228271] systemd[1]: Mounting Kernel Trace File System...
Mounting Kernel Trace File System...
[ 7.315032] systemd[1]: Mounting Temporary Directory /tmp...
Mounting Temporary Directory /tmp...
[ 7.348327] systemd[1]: Starting Create List of Static Device Nodes...
Starting Create List of Static Device Nodes...
[ 7.389221] systemd[1]: Starting Load Kernel Module configfs...
Starting Load Kernel Module configfs...
[ 7.439117] systemd[1]: Starting Load Kernel Module drm...
Starting Load Kernel Module drm...
[ 7.525238] systemd[1]: Starting Load Kernel Module fuse...
Starting Load Kernel Module fuse...
[ 7.557830] systemd[1]: Starting Start psplash boot splash screen...
Starting Start psplash boot splash screen...
[ 7.598632] systemd[1]: Starting RPC Bind...
Starting RPC Bind...
[ 7.634887] systemd[1]: File System Check on Root Device was skipped because of a failed condition check (ConditionPathIsReadWrite=!/).
[ 7.648071] systemd[1]: systemd-journald.service: unit configures an IP firewall, but the local system does not support BPF/cgroup firewalling.
[ 7.661041] systemd[1]: (This warning is only shown for the first unit using IP firewalling.)
[ 7.705169] systemd[1]: Starting Journal Service...
Starting Journal Service...
[ 7.739410] systemd[1]: Starting Load Kernel Modules...
Starting Load Kernel Modules...
[ 7.777160] systemd[1]: Starting Generate network units from Kernel command line...
Starting Generate network …ts from Kernel command line...
[ 7.856719] systemd[1]: Starting Remount Root and Kernel File Systems...
Starting Remount Root and Kernel File Systems[ 7.879089] EXT4-fs (mmcblk1p12): re-mounted. Quota mode: disabled.
...
[ 7.918670] systemd[1]: Starting Coldplug All udev Devices...
Starting Coldplug All udev Devices...
[ 7.970916] systemd[1]: Started RPC Bind.
[ OK ] Started RPC Bind.
[ 8.015502] systemd[1]: Started Journal Service.
[ OK ] Started Journal Service.
[ OK ] Mounted POSIX Message Queue File System.
[ OK ] Mounted Kernel Debug File System.
[ OK ] Mounted Kernel Trace File System.
[ OK ] Mounted Temporary Directory /tmp.
[ OK ] Finished Create List of Static Device Nodes.
[ OK ] Finished Load Kernel Module configfs.
[ OK ] Finished Load Kernel Module drm.
[ OK ] Finished Load Kernel Module fuse.
[FAILED] Failed to start Start psplash boot splash screen.
See 'systemctl status psplash-start.service' for details.
[DEPEND] Dependency failed for Star…progress communication helper.
[ OK ] Finished Load Kernel Modules.
[ OK ] Finished Generate network units from Kernel command line.
[ OK ] Finished Remount Root and Kernel File Systems.
Mounting Kernel Configuration File System...
Starting Flush Journal to Persistent Storage...
[ 8.640930] systemd-journald[235]: Received client request to flush runtime journal.
Starting Apply Kernel Variables...
Starting Create System Users...
[ OK ] Mounted Kernel Configuration File System.
[ OK ] Finished Flush Journal to Persistent Storage.
[ OK ] Finished Apply Kernel Variables.
[ OK ] Finished Create System Users.
Starting Create Static Device Nodes in /dev...
[ OK ] Finished Create Static Device Nodes in /dev.
[ OK ] Reached target Preparation for Local File Systems. Mounting /var/volatile...
Starting Rule-based Manage…for Device Events and Files...
[ OK ] Mounted /var/volatile.
Starting Load/Save Random Seed...
[ OK ] Reached target Local File Systems.
Starting Rebuild Dynamic Linker Cache... Starting Create Volatile Files and Directories...
[ OK ] Started Rule-based Manager for Device Events and Files.
[ OK ] Finished Coldplug All udev Devices.
[ OK ] Finished Load/Save Random Seed.
[ OK ] Finished Create Volatile Files and Directories.
Starting Rebuild Journal Catalog...
Starting Network Time Synchronization...
Starting Wait for udev To …plete Device Initialization...
Starting Record System Boot/Shutdown in UTMP...
[ OK ] Finished Rebuild Dynamic Linker Cache.
[ OK ] Finished Rebuild Journal Catalog.
[ OK ] Started Network Time Synchronization.
[ OK ] Finished Record System Boot/Shutdown in UTMP.
[ OK ] Reached target System Time Set.
Starting Update is Completed...
[ OK ] Finished Update is Completed.
[ 11.174957] usbcore: registered new device driver onboard-usb-hub
[ 11.477539] etnaviv etnaviv: bound 59000000.gpu (ops gpu_ops [etnaviv])
[ 11.484313] etnaviv-gpu 59000000.gpu: model: GC320, revision: 5301
[ 11.505157] [drm] Initialized etnaviv 1.3.0 20151214 for etnaviv on minor 0
[ 11.617126] hub 1-1:1.0: USB hub found
[ 11.622070] hub 1-1:1.0: 4 ports detected
[ OK ] Listening on Load/Save RF …itch Status /dev/rfkill Watch.
[ 11.777160] hub 1-1:1.0: USB hub found
[ 11.780975] hub 1-1:1.0: 4 ports detected
[ 12.033996] hub 2-1:1.0: USB hub found
[ 12.037841] hub 2-1:1.0: 4 ports detected
[ 12.113342] hub 2-1:1.0: USB hub found
[ 12.117187] hub 2-1:1.0: 4 ports detected
[ OK ] Finished Wait for udev To Complete Device Initialization.
[ OK ] Started Hardware RNG Entropy Gatherer Daemon.
[ OK ] Reached target System Initialization.
[ OK ] Started Daily rotation of log files.
[ OK ] Started Daily Cleanup of Temporary Directories.
[ OK ] Reached target Timer Units.
[ OK ] Listening on Avahi mDNS/DNS-SD Stack Activation Socket.
[ OK ] Listening on D-Bus System Message Bus Socket.
Starting sshd.socket...
[ OK ] Listening on sshd.socket.
[ OK ] Reached target Socket Units.
[ OK ] Reached target Basic System.
[ OK ] Started Kernel Logging Service.
[ OK ] Started System Logging Service.
[ OK ] Started Periodic Command Scheduler. Starting D-Bus System Message Bus...
[ OK ] Started Getty on tty1.
Starting IPv6 Packet Filtering Framework... Starting IPv4 Packet Filtering Framework... Starting Telephony service...
[ OK ] Started Serial Getty on ttyS2.
[ OK ] Reached target Login Prompts.
[ 13.546081] Bluetooth: Core ver 2.22
[ 13.555175] NET: Registered PF_BLUETOOTH protocol family
[ 13.560516] Bluetooth: HCI device and connection manager initialized
[ 13.566925] Bluetooth: HCI socket layer initialized
[ 13.571838] Bluetooth: L2CAP socket layer initialized
[ 13.576965] Bluetooth: SCO socket layer initialized
Starting Resets System Activity Logs...
Starting User Login Management...
Starting OpenSSH Key Generation...
[ OK ] Started D-Bus System Message Bus.
[ OK ] Finished IPv6 Packet Filtering Framework.
[ OK ] Finished IPv4 Packet Filtering Framework.
[ OK ] Finished Resets System Activity Logs.
[ OK ] Reached target Preparation for Network.
Starting Network Configuration...
[ OK ] Started Telephony service.
[ OK ] Started User Login Management.
[ 14.176635] cfg80211: Loading compiled-in X.509 certificates for regulatory database
[ 14.256225] cfg80211: Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7'
[ OK ] Started Network Configuration.
[ 14.356201] cpsw-switch 48484000.switch: starting ndev. mode: dual_mac
Starting Network Name Resolution...
[ 14.504577] Micrel KSZ9031 Gigabit PHY 48485000.mdio:02: attached PHY driver (mii_bus:phy_addr=48485000.mdio:02, irq=POLL)
[ 14.559631] cpsw-switch 48484000.switch: starting ndev. mode: dual_mac
[ 14.675628] Micrel KSZ9031 Gigabit PHY 48485000.mdio:01: attached PHY driver (mii_bus:phy_addr=48485000.mdio:01, irq=POLL)
[ OK ] Started Network Name Resolution.
[ OK ] Reached target Network.
[ OK ] Reached target Host and Network Name Lookups.
Starting Avahi mDNS/DNS-SD Stack...
[ OK ] Started Avahi mDNS/DNS-SD Stack.
[ OK ] Reached target Multi-User System.
Starting Record Runlevel Change in UTMP...
[ OK ] Finished Record Runlevel Change in UTMP.
[ 16.656158] cpsw-switch 48484000.switch eth1: Link is Up - 100Mbps/Full - flow control off
[ 16.664489] IPv6: ADDRCONF(NETDEV_CHANGE): eth1: link becomes ready
[ 18.896118] cpsw-switch 48484000.switch eth0: Link is Up - 1Gbps/Full - flow control off
[ 18.904296] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes readyLinux-Kernel-Functional-Testing nodistro.0 am57xx-evm ttyS2
am57xx-evm login: root
root
7[r[999;999H[6n[ 21.618377] platform 488c0000.omap_dwc3_2: deferred probe pending
[ 21.624511] platform sound0: deferred probe pending
root@am57xx-evm:~#
root@am57xx-evm:~# # # root@am57xx-evm:~# export SHELL=/bin/sh export SHELL=/bin/sh root@am57xx-evm:~# . /lava-5900484/environment . /lava-5900484/environment root@am57xx-evm:~# /lava-5900484/bin/lava-test-runner /lava-5900484/0 /lava-5900484/bin/lava-test-runner /lava-5900484/0 + export TESTRUN_ID=0_prep-tmp-disk + TESTRUN_ID=0_prep-tmp-disk + cd /lava-5900484/0/tests/0_prep-tmp-disk ++ cat uuid + UUID=5900484_2.1.4.1 + set +x <LAVA_SIGNAL_STARTRUN 0_prep-tmp-disk 5900484_2.1.4.1> ++ lava-target-storage SATA + export STORAGE_DEV=/dev/disk/by-id/ata-SanDisk_SSD_PLUS_120GB_190703A00329 + STORAGE_DEV=/dev/disk/by-id/ata-SanDisk_SSD_PLUS_120GB_190703A00329 + test -n /dev/disk/by-id/ata-SanDisk_SSD_PLUS_120GB_190703A00329 + echo y + mkfs.ext4 /dev/disk/by-id/ata-SanDisk_SSD_PLUS_120GB_190703A00329 mke2fs 1.46.5 (30-Dec-2021) Discarding device blocks: 0/29306880 1048576/29306880 7864320/29306880[ 30.527496] 8<--- cut here --- [ 30.530578] Unable to handle kernel paging request at virtual address f880350c [ 30.537841] [f880350c] *pgd=00000000 [ 30.541442] Internal error: Oops: 5 [#1] SMP ARM [ 30.546081] Modules linked in: cfg80211 bluetooth etnaviv snd_soc_simple_card snd_soc_simple_card_utils gpu_sched onboard_usb_hub snd_soc_davinci_mcasp snd_soc_ti_udma snd_soc_ti_edma snd_soc_ti_sdma snd_soc_core ac97_bus snd_pcm_dmaengine snd_pcm snd_timer snd soundcore display_connector [ 30.571807] CPU: 0 PID: 287 Comm: rngd Not tainted 6.0.11-rc1 #1 [ 30.577850] Hardware name: Generic DRA74X (Flattened Device Tree) [ 30.583984] PC is at l3_interrupt_handler+0x70/0x384 [ 30.588958] LR is at 0x3 [ 30.591522] pc : [<c089019c>] lr : [<00000003>] psr: 200d0193 [ 30.597808] sp : f0001eb8 ip : 0000000c fp : 00000000 [ 30.603057] r10: 00000060 r9 : c226a320 r8 : 00000060 [ 30.608306] r7 : f8000000 r6 : c39d4940 r5 : c210c8c0 r4 : c39e4200 [ 30.614868] r3 : 00000000 r2 : f880350c r1 : c210c64c r0 : c39d4948 [ 30.621429] Flags: nzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment none [ 30.628692] Control: 10c5387d Table: 84f3406a DAC: 00000051 [ 30.634460] Register r0 information: slab kmalloc-128 start c39d4900 pointer offset 72 size 128 [ 30.643218] Register r1 information: non-slab/vmalloc memory [ 30.648895] Register r2 information: non-paged memory [ 30.653991] Register r3 information: NULL pointer [ 30.658721] Register r4 information: slab kmalloc-64 start c39e4200 pointer offset 0 size 64 [ 30.667205] Register r5 information: non-slab/vmalloc memory [ 30.672912] Register r6 information: slab kmalloc-128 start c39d4900 pointer offset 64 size 128 [ 30.681640] Register r7 information: 0-page vmalloc region starting at 0xf8000000 allocated at iotable_init+0x0/0xf4 [ 30.692230] Register r8 information: non-paged memory [ 30.697326] Register r9 information: non-slab/vmalloc memory [ 30.703002] Register r10 information: non-paged memory [ 30.708160] Register r11 information: NULL pointer [ 30.712982] Register r12 information: non-paged memory [ 30.718139] Process rngd (pid: 287, stack limit = 0x49af5199) [ 30.723937] Stack: (0xf0001eb8 to 0xf0002000) [ 30.728302] 1ea0: 00000008 f0001f10 [ 30.736511] 1ec0: c2f43480 00000003 00000406 c087457c c3b82024 00000001 00000000 00000001 [ 30.744750] 1ee0: c2f43480 00000000 00000000 8b7f63d6 c3b80200 c3b82024 00000001 c2f43480 [ 30.752960] 1f00: c2d3b800 00000100 c2003080 c0796ab0 00000000 8b7f63d6 00000000 c49e0e00 [ 30.761169] 1f20: 00000000 00000000 c3b82000 c0bf797c c49e0ea8 00000000 c2f43480 c49e0e00 [ 30.769378] 1f40: c226a320 8b7f63d6 c49e0ea8 c39e4200 c2013a68 00000000 c39d3700 c226a340 [ 30.777618] 1f60: c226a320 00000060 c2f43480 c03b85e8 c2003094 00000000 c2009f50 c2269993 [ 30.785827] 1f80: c226a320 c39d3700 c2013a68 c39d376c c1f97510 fa21200c f0001fd0 9e97da7a [ 30.794036] 1fa0: f12adfa8 c03b87d8 c39d3700 c2013a68 fa212000 c03bd2e0 c200aa08 c210a274 [ 30.802276] 1fc0: fa212000 c03b7d8c c200aa08 c0301804 c1f97504 f12adfb0 00000000 c2f43480 [ 30.810485] 1fe0: c1f91044 6ad6d48f 9e97da7a c130b0d8 b6f22d36 800d0030 ffffffff c08597bc [ 30.818695] l3_interrupt_handler from __handle_irq_event_percpu+0xa0/0x1fc [ 30.825714] __handle_irq_event_percpu from handle_irq_event+0x4c/0x94 [ 30.832275] handle_irq_event from handle_fasteoi_irq+0xa0/0x194 [ 30.838317] handle_fasteoi_irq from generic_handle_domain_irq+0x30/0x40 [ 30.845031] generic_handle_domain_irq from gic_handle_irq+0x90/0xb0 [ 30.851440] gic_handle_irq from generic_handle_arch_irq+0x34/0x44 [ 30.857666] generic_handle_arch_irq from call_with_stack+0x18/0x20 [ 30.863952] call_with_stack from __irq_usr+0x7c/0xa0 [ 30.869049] Exception stack(0xf12adfb0 to 0xf12adff8) [ 30.874114] dfa0: 9e97da7a 6ad6d48f 9e97da7a 6ad6d48f [ 30.882324] dfc0: 00000002 00000000 00000000 b6b9e8e8 9e97da78 6ad6d48f 9e97da7a 6ad6d48f [ 30.890563] dfe0: 00000000 b6b9e8e8 b6f23701 b6f22d36 800d0030 ffffffff [ 30.897186] Code: e4907004 e5952000 e08c2002 e0872002 (e5924000) [ 30.903320] ---[ end trace 0000000000000000 ]--- [ 30.907958] Kernel panic - not syncing: Fatal exception in interrupt [ 30.914367] CPU1: stopping [ 30.917083] CPU: 1 PID: 291 Comm: rngd Tainted: G D 6.0.11-rc1 #1 [ 30.924591] Hardware name: Generic DRA74X (Flattened Device Tree) [ 30.930725] unwind_backtrace from show_stack+0x18/0x1c [ 30.935974] show_stack from dump_stack_lvl+0x58/0x70 [ 30.941070] dump_stack_lvl from do_handle_IPI+0x2e0/0x318 [ 30.946594] do_handle_IPI from ipi_handler+0x20/0x28 [ 30.951660] ipi_handler from handle_percpu_devid_irq+0x94/0x1e8 [ 30.957702] handle_percpu_devid_irq from generic_handle_domain_irq+0x30/0x40 [ 30.964874] generic_handle_domain_irq from gic_handle_irq+0x90/0xb0 [ 30.971282] gic_handle_irq from generic_handle_arch_irq+0x34/0x44 [ 30.977478] generic_handle_arch_irq from call_with_stack+0x18/0x20 [ 30.983795] call_with_stack from __irq_svc+0x9c/0xb8 [ 30.988861] Exception stack(0xf12a5ef8 to 0xf12a5f40) [ 30.993927] 5ee0: 0011baa7 00000000 [ 31.002166] 5f00: 626ad21a 0000270a 00000000 c22c9480 f12a5f80 00001706 c03002f0 c2f47380 [ 31.010375] 5f20: 00000193 becec000 f12a5f24 f12a5f48 c03e98b8 c03e98bc 600f0013 ffffffff [ 31.018585] __irq_svc from ktime_get_real_ts64+0x58/0x174 [ 31.024108] ktime_get_real_ts64 from posix_get_realtime_timespec+0x14/0x1c [ 31.031127] posix_get_realtime_timespec from sys_clock_gettime+0x64/0xc8 [ 31.037933] sys_clock_gettime from __sys_trace_return+0x0/0x10 [ 31.043884] Exception stack(0xf12a5fa8 to 0xf12a5ff0) [ 31.048980] 5fa0: 00000000 b61fea18 00000000 b61fea18 00000000 00000000 [ 31.057189] 5fc0: 00000000 b61fea18 b61feacc 00000193 000172a0 00000000 b59ff000 becec000 [ 31.065399] 5fe0: becec020 b61fe9c0 beced55c beced6b8 [ 31.070465] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---
Quoted 5 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.0.11 release. There are 289 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Successfully cross-compiled for arm64 (bcm2711_defconfig, GCC 10.2.0) and powerpc (ps3_defconfig, GCC 12.2.0).
Signature · 1 line
An old man doll... just what I always wanted! - Clara
Hi Greg,
Quoted 7 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.0.11 release. There are 289 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 02 Dec 2022 18:05:05 +0000. Anything received after that time might be too late.
Build test (gcc version 12.2.1 20221127):
mips: 52 configs -> no failure
arm: 100 configs -> no failure
arm64: 3 configs -> no failurex86_64: 4 configs -> no failure alpha allmodconfig -> no failure csky allmodconfig -> no failure powerpc allmodconfig -> no failure riscv allmodconfig -> no failure s390 allmodconfig -> no failure xtensa allmodconfig -> no failure
Boot test:x86_64: Booted on my test laptop. No regression.x86_64: Booted on qemu. No regression. [1]
mips: Booted on ci20 board. No regression. [2]
[1]. https://openqa.qa.codethink.co.uk/tests/2253
[2]. https://openqa.qa.codethink.co.uk/tests/2258
--
Regards
Sudip
Hey Greg,
Ran tests and boot tested on my system, no regressions found
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.0.11 release. There are 289 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 02 Dec 2022 18:05:05 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.0.11-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.0.y
and the diffstat can be found below.thanks,
greg k-h
Tested rc1 against the Fedora build system (aarch64, armv7, ppc64le, s390x, x86_64), and boot tested x86_64. No regressions noted.