6.1.7-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 6.1.7-rc1 review
This is the start of the stable review cycle for the 6.1.7 release. There are 183 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 18 Jan 2023 15:47:28 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.7-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.1.7-rc1
Mario Limonciello <[email protected]>
pinctrl: amd: Add dynamic debugging for active GPIOs
Ferry Toth <[email protected]>
Revert "usb: ulpi: defer ulpi_register on ulpi_read_id timeout"
Jens Axboe <[email protected]>
block: handle bio_split_to_limits() NULL return
Jens Axboe <[email protected]>
io_uring/io-wq: only free worker if it was allocated for creation
Jens Axboe <[email protected]>
io_uring/io-wq: free worker if task_work creation is canceled
Nathan Chancellor <[email protected]>
drm/i915: Fix CFI violations in gt_sysfs
Jens Axboe <[email protected]>
io_uring/poll: attempt request issue after racy poll wakeup
Pavel Begunkov <[email protected]>
io_uring: lock overflowing for IOPOLL
Johan Hovold <[email protected]>
efi: fix NULL-deref in init error path
Jaroslav Kysela <[email protected]>
ALSA: usb-audio: Fix possible NULL pointer dereference in snd_usb_pcm_has_fixed_rate()
Miaoqian Lin <[email protected]>
platform/x86/amd: Fix refcount leak in amd_pmc_probe
Maximilian Luz <[email protected]>
platform/surface: aggregator: Add missing call to ssam_request_sync_free()
Jakub Kicinski <[email protected]>
bnxt: make sure we return pages to the pool
Jie Wang <[email protected]>
net: hns3: fix wrong use of rss size during VF rss config
Clément Léger <[email protected]>
net: lan966x: check for ptp to be enabled in lan966x_ptp_deinit()
Christopher S Hall <[email protected]>
igc: Fix PPS delta between two synchronized end-points
Leo Yan <[email protected]>
perf kmem: Support field "node" in evsel__process_alloc_event() coping with recent tracepoint restructuring
Leo Yan <[email protected]>
perf kmem: Support legacy tracepoints
Ian Rogers <[email protected]>
perf build: Properly guard libbpf includes
Hariprasad Kelam <[email protected]>
octeontx2-pf: Fix resource leakage in VF driver unbind
Guillaume Nault <[email protected]>
selftests/net: l2_tos_ttl_inherit.sh: Ensure environment cleanup on failure.
Guillaume Nault <[email protected]>
selftests/net: l2_tos_ttl_inherit.sh: Run tests in their own netns.
Guillaume Nault <[email protected]>
selftests/net: l2_tos_ttl_inherit.sh: Set IPv6 addresses with "nodad".
Emeel Hakim <[email protected]>
net/mlx5e: Fix macsec possible null dereference when updating MAC security entity (SecY)
Emeel Hakim <[email protected]>
net/mlx5e: Fix macsec ssci attribute handling in offload path
Gavin Li <[email protected]>
net/mlx5e: Don't support encap rules with gbp option
Rahul Rameshbabu <[email protected]>
net/mlx5: Fix ptp max frequency adjustment range
Dragos Tatulea <[email protected]>
net/mlx5e: IPoIB, Fix child PKEY interface stats on rx path
Dragos Tatulea <[email protected]>
net/mlx5e: IPoIB, Block PKEY interfaces with less rx queues than parent
Dragos Tatulea <[email protected]>
net/mlx5e: IPoIB, Block queue count configuration when sub interfaces are present
Roy Novich <[email protected]>
net/mlx5e: Verify dev is present for fix features ndo
Moshe Shemesh <[email protected]>
net/mlx5: Fix command stats access after free
Ariel Levkovich <[email protected]>
net/mlx5e: TC, Keep mod hdr actions after mod hdr alloc
Ariel Levkovich <[email protected]>
net/mlx5: check attr pointer validity before dereferencing it
Heiner Kallweit <[email protected]>
Revert "r8169: disable detection of chip version 36"
Ido Schimmel <[email protected]>
net/sched: act_mpls: Fix warning during failed attribute validation
Zack Rusin <[email protected]>
drm/vmwgfx: Remove rcu locks from user resources
Maaz Mombasawala <[email protected]>
drm/vmwgfx: Remove vmwgfx_hashtab
Maaz Mombasawala <[email protected]>
drm/vmwgfx: Refactor ttm reference object hashtable to use linux/hashtable.
Maaz Mombasawala <[email protected]>
drm/vmwgfx: Refactor resource validation hashtable to use linux/hashtable implementation.
Maaz Mombasawala <[email protected]>
drm/vmwgfx: Remove ttm object hashtable
Maaz Mombasawala <[email protected]>
drm/vmwgfx: Refactor resource manager's hashtable to use linux/hashtable implementation.
Zack Rusin <[email protected]>
drm/vmwgfx: Write the driver id registers
Jiasheng Jiang <[email protected]>
ice: Add check for kzalloc
Yuan Can <[email protected]>
ice: Fix potential memory leak in ice_gnss_tty_write()
Luben Tuikov <[email protected]>
drm/amdgpu: Fix potential NULL dereference
Willy Tarreau <[email protected]>
tools/nolibc: fix the O_* fcntl/open macro definitions for riscv
Willy Tarreau <[email protected]>
tools/nolibc: restore mips branch ordering in the _start block
Stephan Gerhold <[email protected]>
ASoC: qcom: Fix building APQ8016 machine driver without SOUNDWIRE
Mirsad Goran Todorovac <[email protected]>
af_unix: selftest: Fix the size of the parameter to connect()
Eric Dumazet <[email protected]>
gro: take care of DODGY packets
Richard Gobert <[email protected]>
gro: avoid checking for a failed search
Minsuk Kang <[email protected]>
nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame()
Roger Pau Monne <[email protected]>
hvc/xen: lock console list traversal
Tejun Heo <[email protected]>
block: Drop spurious might_sleep() from blk_put_queue()
Christoph Hellwig <[email protected]>
block: mark blk_put_queue as potentially blocking
Christoph Hellwig <[email protected]>
block: untangle request_queue refcounting from sysfs
Christoph Hellwig <[email protected]>
block: fix error unwinding in blk_register_queue
Christoph Hellwig <[email protected]>
block: factor out a blk_debugfs_remove helper
Christoph Hellwig <[email protected]>
blk-crypto: pass a gendisk to blk_crypto_sysfs_{,un}register
Christoph Hellwig <[email protected]>
blk-mq: move the srcu_struct used for quiescing to the tagset
Yair Podemsky <[email protected]>
sched/core: Fix arch_scale_freq_tick() on tickless systems
Angela Czubak <[email protected]>
octeontx2-af: Fix LMAC config in cgx_lmac_rx_tx_enable
Jeff Layton <[email protected]>
nfsd: fix handling of cached open files in nfsd4_open codepath
Jeff Layton <[email protected]>
nfsd: rework refcounting in filecache
Chuck Lever <[email protected]>
NFSD: Add an nfsd_file_fsync tracepoint
Jeff Layton <[email protected]>
nfsd: reorganize filecache.c
Jeff Layton <[email protected]>
nfsd: remove the pages_flushed statistic from filecache
Chuck Lever <[email protected]>
NFSD: Add an NFSD_FILE_GC flag to enable nfsd_file garbage collection
Chuck Lever <[email protected]>
NFSD: Revert "NFSD: NFSv4 CLOSE should release an nfsd_file immediately"
Chuck Lever <[email protected]>
NFSD: Pass the target nfsd_file to nfsd_commit()
Tung Nguyen <[email protected]>
tipc: fix unexpected link reset due to discovery messages
Biao Huang <[email protected]>
stmmac: dwmac-mediatek: remove the dwmac_fix_mac_speed
Takashi Iwai <[email protected]>
ALSA: usb-audio: Relax hw constraints for implicit fb sync
Takashi Iwai <[email protected]>
ALSA: usb-audio: Make sure to stop endpoints before closing EPs
Arnd Bergmann <[email protected]>
mtd: cfi: allow building spi-intel standalone
Mikhail Zhilkin <[email protected]>
mtd: parsers: scpart: fix __udivdi3 undefined on mips
Emanuele Ghidoli <[email protected]>
ASoC: wm8904: fix wrong outputs volume after power reactivation
Miaoqian Lin <[email protected]>
drm/msm/dpu: Fix memory leak in msm_mdss_parse_data_bus_icc_path
Yang Li <[email protected]>
drm/msm/dpu: Fix some kernel-doc comments
Arnd Bergmann <[email protected]>
ASoC: Intel: sof-nau8825: fix module alias overflow
Brent Lu <[email protected]>
ASoC: Intel: sof_nau8825: support rt1015p speaker amplifier
Arnd Bergmann <[email protected]>
ASoC: Intel: fix sof-nau8825 link failure
Peter Wang <[email protected]>
scsi: ufs: core: WLUN suspend SSU/enter hibern8 fail recovery
Shin'ichiro Kawasaki <[email protected]>
scsi: mpi3mr: Refer CONFIG_SCSI_MPI3MR in Makefile
Michael Kelley <[email protected]>
scsi: storvsc: Fix swiotlb bounce buffer leak in confidential VM
Ricardo Ribalda <[email protected]>
regulator: da9211: Use irq handler when ready
Peter Newman <[email protected]>
x86/resctrl: Fix event counts regression in reused RMIDs
Peter Newman <[email protected]>
x86/resctrl: Fix task CLOSID/RMID update race
Juergen Gross <[email protected]>
x86/pat: Fix pat_x_mtrr_type() for MTRR disabled case
Eliav Farber <[email protected]>
EDAC/device: Fix period calculation in edac_device_reset_delay_period()
Peter Zijlstra <[email protected]>
x86/boot: Avoid using Intel mnemonics in AT&T syntax asm
Kajol Jain <[email protected]>
powerpc/imc-pmu: Fix use of mutex in IRQs disabled section
Florian Westphal <[email protected]>
selftests: netfilter: fix transaction test script timeout handling
Gavrilov Ilia <[email protected]>
netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
Waiman Long <[email protected]>
sched/core: Fix use-after-free bug in dup_user_cpus_ptr()
Robin Murphy <[email protected]>
iommu/arm-smmu: Report IOMMU_CAP_CACHE_COHERENCY even betterer
Vladimir Oltean <[email protected]>
iommu/arm-smmu: Don't unregister on shutdown
Christophe JAILLET <[email protected]>
iommu/mediatek-v1: Fix an error handling path in mtk_iommu_v1_probe()
Vladimir Oltean <[email protected]>
iommu/arm-smmu-v3: Don't unregister on shutdown
Yunfei Wang <[email protected]>
iommu/iova: Fix alloc iova overflows issue
Aaron Thompson <[email protected]>
mm: Always release pages to the buddy allocator in memblock_free_late().
Saleemkhan Jamadar <[email protected]>
drm/amdgpu: enable VCN DPG for GC IP v11.0.4
Saleemkhan Jamadar <[email protected]>
drm/amdgpu: Enable pg/cg flags on GC11_0_4 for VCN
Yifan Zhang <[email protected]>
drm/amdgpu: add soc21 common ip block support for GC 11.0.4
Evan Quan <[email protected]>
drm/amd/pm: enable GPO dynamic control support for SMU13.0.7
Evan Quan <[email protected]>
drm/amd/pm: enable GPO dynamic control support for SMU13.0.0
Candice Li <[email protected]>
drm/amd/pm: Enable bad memory page/channel recording support for smu v13_0_0
Kenneth Feng <[email protected]>
drm/amd/pm: enable mode1 reset on smu_v13_0_10
Ferry Toth <[email protected]>
usb: ulpi: defer ulpi_register on ulpi_read_id timeout
Chris Wilson <[email protected]>
drm/i915/gt: Cleanup partial engine discovery failures
Daniil Tatianin <[email protected]>
iavf/iavf_main: actually log ->src mask when talking about it
Herbert Xu <[email protected]>
ipv6: raw: Deduct extension header length in rawv6_push_pending_frames
Yang Yingliang <[email protected]>
ixgbe: fix pci device refcount leak
Hans de Goede <[email protected]>
platform/x86: sony-laptop: Don't turn off 0x153 keyboard backlight during probe
Konrad Dybcio <[email protected]>
dt-bindings: msm/dsi: Don't require vcca-supply on 14nm PHY
Konrad Dybcio <[email protected]>
dt-bindings: msm/dsi: Don't require vdds-supply on 10nm PHY
Kuogee Hsieh <[email protected]>
drm/msm/dp: do not complete dp_aux_cmd_fifo_tx() if irq is not for aux transfer
Hans de Goede <[email protected]>
platform/x86: ideapad-laptop: Add Legion 5 15ARH05 DMI id to set_fn_lock_led_list[]
Liu Shixin <[email protected]>
arm64/mm: fix incorrect file_map_count for invalid pmd
Zenghui Yu <[email protected]>
arm64: ptrace: Use ARM64_SME to guard the SME register enumerations
Bryan O'Donoghue <[email protected]>
dt-bindings: msm: dsi-phy-28nm: Add missing qcom, dsi-phy-regulator-ldo-mode
Liu Shixin <[email protected]>
arm64/mm: add pud_user_exec() check in pud_user_accessible_page()
Mark Brown <[email protected]>
arm64/signal: Always accept SVE signal frames on SME only systems
Bryan O'Donoghue <[email protected]>
dt-bindings: msm: dsi-controller-main: Fix description of core clock
Bryan O'Donoghue <[email protected]>
dt-bindings: msm: dsi-controller-main: Fix power-domain constraint
Mark Brown <[email protected]>
arm64/signal: Always allocate SVE signal frames on SME only systems
Konrad Dybcio <[email protected]>
drm/msm/adreno: Make adreno quirks not overwrite each other
Marc Zyngier <[email protected]>
firmware/psci: Don't register with debugfs if PSCI isn't available
Will Deacon <[email protected]>
firmware/psci: Fix MEM_PROTECT_RANGE function numbers
Dmitry Baryshkov <[email protected]>
drm/msm: another fix for the headless Adreno GPU
Bryan O'Donoghue <[email protected]>
dt-bindings: msm: dsi-controller-main: Fix operating-points-v2 constraint
Hans de Goede <[email protected]>
platform/x86: dell-privacy: Fix SW_CAMERA_LENS_COVER reporting
Thomas Weißschuh <[email protected]>
platform/x86: asus-wmi: Don't load fan curves without fan
Mark Pearson <[email protected]>
platform/x86: thinkpad_acpi: Fix profile mode display in AMT mode
Hans de Goede <[email protected]>
platform/x86: int3472/discrete: Ensure the clk/power enable pins are in output mode
Maximilian Luz <[email protected]>
platform/surface: aggregator: Ignore command messages not intended for us
Hans de Goede <[email protected]>
platform/x86: dell-privacy: Only register SW_CAMERA_LENS_COVER if present
Hans de Goede <[email protected]>
ACPI: video: Allow selecting NVidia-WMI-EC or Apple GMUX backlight from the cmdline
ChiYuan Huang <[email protected]>
ASoC: rt9120: Make dev PM runtime bind AsoC component PM
Jens Axboe <[email protected]>
io_uring/fdinfo: include locked hash table in fdinfo output
Paulo Alcantara <[email protected]>
cifs: fix double free on failed kerberos auth
Paulo Alcantara <[email protected]>
cifs: do not query ifaces on smb1 mounts
Paulo Alcantara <[email protected]>
cifs: fix file info setting in cifs_open_file()
Paulo Alcantara <[email protected]>
cifs: fix file info setting in cifs_query_path_info()
Volker Lendecke <[email protected]>
cifs: Fix uninitialized memory read for smb311 posix symlink create
Alex Deucher <[email protected]>
Revert "drm/amdgpu: Revert "drm/amdgpu: getting fan speed pwm for vega10 properly""
Ao Zhong <[email protected]>
drm/amd/display: move remaining FPU code to dml folder
Evan Quan <[email protected]>
drm/amd/pm: add the missing mapping for PPT feature on SMU13.0.0 and 13.0.7
Evan Quan <[email protected]>
drm/amd/pm: correct the reference clock for fan speed(rpm) calculation
YiPeng Chai <[email protected]>
drm/amdgpu: Fixed bug on error when unloading amdgpu
Mario Limonciello <[email protected]>
drm/amd: Delay removal of the firmware framebuffer
Rob Clark <[email protected]>
drm/i915: Fix potential context UAFs
Nirmoy Das <[email protected]>
drm/i915: Reserve enough fence slot for i915_vma_unbind_async
Chris Wilson <[email protected]>
drm/i915/gt: Reset twice
Arunpravin Paneer Selvam <[email protected]>
drm: Optimize drm buddy top-down allocation method
Guchun Chen <[email protected]>
drm/amd/pm/smu13: BACO is supported when it's in BACO state
Rob Clark <[email protected]>
drm/virtio: Fix GEM handle creation UAF
Heiko Carstens <[email protected]>
s390/percpu: add READ_ONCE() to arch_this_cpu_to_op_simple()
Heiko Carstens <[email protected]>
s390/cpum_sf: add READ_ONCE() semantics to compare and swap loops
Perry Yuan <[email protected]>
cpufreq: amd-pstate: fix kernel hang issue while amd-pstate unregistering
Catalin Marinas <[email protected]>
elfcore: Add a cprm parameter to elf_core_extra_{phdrs,data_size}Brian Norris <[email protected]>
ASoC: qcom: lpass-cpu: Fix fallback SD line index handling
Ivan T. Ivanov <[email protected]>
brcmfmac: Prefer DT board type over DMI board type
Alexander Egorenkov <[email protected]>
s390/kexec: fix ipl report address for kdump
Adrian Hunter <[email protected]>
perf auxtrace: Fix address filter duplicate symbol selection
Noor Azura Ahmad Tarmizi <[email protected]>
net: stmmac: add aux timestamps fifo clearance wait
Hans de Goede <[email protected]>
ACPI: Fix selecting wrong ACPI fwnode for the iGPU on some Dell laptops
Mark Rutland <[email protected]>
arm64: cmpxchg_double*: hazard against entire exchange variable
Catalin Marinas <[email protected]>
arm64: mte: Avoid the racy walk of the vma list during core dump
Catalin Marinas <[email protected]>
arm64: mte: Fix double-freeing of the temporary tag storage during coredump
Jens Axboe <[email protected]>
io_uring/poll: add hash if ready poll request can't complete inline
Jonathan Corbet <[email protected]>
docs: Fix the docs build with Sphinx 6.0
Ard Biesheuvel <[email protected]>
efi: tpm: Avoid READ_ONCE() for accessing the event log
Ding Hui <[email protected]>
efi: fix userspace infinite retry read efivars after EFI runtime services page fault
Marc Zyngier <[email protected]>
KVM: arm64: Fix S1PTW handling on RO memslots
Paolo Bonzini <[email protected]>
KVM: x86: Do not return host topology information from KVM_GET_SUPPORTED_CPUID
Luka Guzenko <[email protected]>
ALSA: hda/realtek: Enable mute/micmute LEDs on HP Spectre x360 13-aw0xxx
Yuchi Yang <[email protected]>
ALSA: hda/realtek - Turn on power early
Jaroslav Kysela <[email protected]>
ALSA: usb-audio: Always initialize fixed_rate in snd_usb_find_implicit_fb_sync_format()
Jaroslav Kysela <[email protected]>
ALSA: control-led: use strscpy in set_led_id()
Takashi Iwai <[email protected]>
Revert "ALSA: usb-audio: Drop superfluous interface setup at parsing"
Pablo Neira Ayuso <[email protected]>
netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits
-------------
Diffstat:
.../bindings/display/msm/dsi-controller-main.yaml | 4 +- .../bindings/display/msm/dsi-phy-10nm.yaml | 1 - .../bindings/display/msm/dsi-phy-14nm.yaml | 1 - .../bindings/display/msm/dsi-phy-28nm.yaml | 4 + Documentation/gpu/todo.rst | 11 - Documentation/sphinx/load_config.py | 6 +- Documentation/virt/kvm/api.rst | 14 + Makefile | 4 +- arch/arm64/include/asm/atomic_ll_sc.h | 2 +- arch/arm64/include/asm/atomic_lse.h | 2 +- arch/arm64/include/asm/kvm_emulate.h | 22 +- arch/arm64/include/asm/pgtable.h | 6 +- arch/arm64/kernel/elfcore.c | 61 ++- arch/arm64/kernel/ptrace.c | 2 +- arch/arm64/kernel/signal.c | 9 +- arch/ia64/kernel/elfcore.c | 4 +- arch/powerpc/include/asm/imc-pmu.h | 2 +- arch/powerpc/perf/imc-pmu.c | 136 +++--- arch/s390/include/asm/cpu_mf.h | 31 +- arch/s390/include/asm/percpu.h | 2 +- arch/s390/kernel/machine_kexec_file.c | 5 +- arch/s390/kernel/perf_cpum_sf.c | 101 +++-- arch/x86/boot/bioscall.S | 4 +- arch/x86/kernel/cpu/resctrl/monitor.c | 49 ++- arch/x86/kernel/cpu/resctrl/rdtgroup.c | 12 +- arch/x86/kvm/cpuid.c | 32 +- arch/x86/mm/pat/memtype.c | 3 +- arch/x86/um/elfcore.c | 4 +- block/blk-core.c | 70 +-- block/blk-crypto-internal.h | 10 +- block/blk-crypto-sysfs.c | 11 +- block/blk-ia-ranges.c | 3 +- block/blk-merge.c | 4 +- block/blk-mq.c | 38 +- block/blk-mq.h | 14 +- block/blk-sysfs.c | 134 +++--- block/blk.h | 13 +- block/bsg.c | 11 +- block/elevator.c | 2 +- block/genhd.c | 2 +- drivers/acpi/glue.c | 14 +- drivers/acpi/scan.c | 7 +- drivers/acpi/video_detect.c | 4 + drivers/block/drbd/drbd_req.c | 2 + drivers/block/ps3vram.c | 2 + drivers/cpufreq/amd-pstate.c | 1 + drivers/edac/edac_device.c | 17 +- drivers/edac/edac_module.h | 2 +- drivers/firmware/efi/efi.c | 9 +- drivers/firmware/efi/runtime-wrappers.c | 1 + drivers/firmware/psci/psci.c | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 8 + drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 6 - drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 5 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 2 +- drivers/gpu/drm/amd/amdgpu/soc21.c | 11 + .../gpu/drm/amd/display/dc/dcn32/dcn32_resource.c | 5 +- .../gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 8 + .../gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.h | 3 + .../drm/amd/pm/powerplay/hwmgr/vega10_thermal.c | 25 +- drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h | 4 + .../amd/pm/swsmu/inc/pmfw_if/smu_v13_0_0_ppsmc.h | 8 +- drivers/gpu/drm/amd/pm/swsmu/inc/smu_types.h | 5 +- drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h | 3 + drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 23 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 95 +++- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 3 + drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c | 18 + drivers/gpu/drm/amd/pm/swsmu/smu_cmn.h | 3 + drivers/gpu/drm/drm_buddy.c | 81 ++-- drivers/gpu/drm/i915/gem/i915_gem_context.c | 24 +- drivers/gpu/drm/i915/gt/intel_engine_cs.c | 7 +- drivers/gpu/drm/i915/gt/intel_gt_sysfs.c | 15 +- drivers/gpu/drm/i915/gt/intel_gt_sysfs.h | 2 +- drivers/gpu/drm/i915/gt/intel_gt_sysfs_pm.c | 461 +++++++++----------- drivers/gpu/drm/i915/gt/intel_reset.c | 34 +- drivers/gpu/drm/i915/i915_vma.c | 2 +- drivers/gpu/drm/msm/adreno/adreno_gpu.h | 10 +- .../gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c | 3 +- drivers/gpu/drm/msm/dp/dp_aux.c | 4 + drivers/gpu/drm/msm/msm_drv.c | 2 +- drivers/gpu/drm/msm/msm_mdss.c | 6 +- drivers/gpu/drm/virtio/virtgpu_ioctl.c | 19 +- drivers/gpu/drm/vmwgfx/Makefile | 2 +- drivers/gpu/drm/vmwgfx/ttm_object.c | 156 +++---- drivers/gpu/drm/vmwgfx/ttm_object.h | 32 +- drivers/gpu/drm/vmwgfx/vmwgfx_bo.c | 38 -- drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c | 62 ++- drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 71 ++- drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 29 +- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 190 ++++---- drivers/gpu/drm/vmwgfx/vmwgfx_hashtab.c | 199 --------- drivers/gpu/drm/vmwgfx/vmwgfx_hashtab.h | 83 ---- drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 33 -- drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 55 ++- drivers/gpu/drm/vmwgfx/vmwgfx_validation.h | 26 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 4 +- drivers/iommu/arm/arm-smmu/arm-smmu.c | 32 +- drivers/iommu/iova.c | 4 +- drivers/iommu/mtk_iommu_v1.c | 4 +- drivers/md/dm.c | 2 + drivers/md/md.c | 2 + drivers/mtd/parsers/scpart.c | 2 +- drivers/mtd/spi-nor/core.c | 1 + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 +- .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 2 +- drivers/net/ethernet/intel/iavf/iavf_main.c | 2 +- drivers/net/ethernet/intel/ice/ice_gnss.c | 24 +- drivers/net/ethernet/intel/igc/igc_defines.h | 2 + drivers/net/ethernet/intel/igc/igc_ptp.c | 10 +- drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c | 14 +- drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 4 +- drivers/net/ethernet/marvell/octeontx2/af/cgx.h | 1 - .../net/ethernet/marvell/octeontx2/nic/otx2_vf.c | 2 + drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 13 +- .../ethernet/mellanox/mlx5/core/en/tc_tun_vxlan.c | 2 + .../ethernet/mellanox/mlx5/core/en_accel/macsec.c | 19 +- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 3 + drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 5 +- .../ethernet/mellanox/mlx5/core/eswitch_offloads.c | 2 +- .../ethernet/mellanox/mlx5/core/ipoib/ethtool.c | 16 +- .../net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c | 38 ++ .../net/ethernet/mellanox/mlx5/core/ipoib/ipoib.h | 6 + .../ethernet/mellanox/mlx5/core/ipoib/ipoib_vlan.c | 18 +- .../net/ethernet/mellanox/mlx5/core/lib/clock.c | 2 +- .../net/ethernet/microchip/lan966x/lan966x_ptp.c | 3 + drivers/net/ethernet/realtek/r8169_main.c | 5 +- .../net/ethernet/stmicro/stmmac/dwmac-mediatek.c | 26 -- drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c | 5 +- .../net/wireless/broadcom/brcm80211/brcmfmac/of.c | 5 +- drivers/nfc/pn533/usb.c | 44 +- drivers/nvme/host/multipath.c | 2 + drivers/pinctrl/pinctrl-amd.c | 10 +- drivers/platform/surface/aggregator/controller.c | 4 +- .../surface/aggregator/ssh_request_layer.c | 14 + drivers/platform/x86/amd/pmc.c | 2 +- drivers/platform/x86/asus-wmi.c | 3 + drivers/platform/x86/dell/dell-wmi-privacy.c | 41 +- drivers/platform/x86/ideapad-laptop.c | 6 + .../platform/x86/intel/int3472/clk_and_regulator.c | 3 + drivers/platform/x86/intel/int3472/discrete.c | 4 + drivers/platform/x86/sony-laptop.c | 21 +- drivers/platform/x86/thinkpad_acpi.c | 23 +- drivers/regulator/da9211-regulator.c | 11 +- drivers/s390/block/dcssblk.c | 2 + drivers/scsi/mpi3mr/Makefile | 2 +- drivers/scsi/storvsc_drv.c | 3 + drivers/tty/hvc/hvc_xen.c | 46 +- drivers/ufs/core/ufshcd.c | 26 ++ fs/binfmt_elf.c | 4 +- fs/binfmt_elf_fdpic.c | 4 +- fs/cifs/connect.c | 9 +- fs/cifs/link.c | 1 + fs/cifs/smb1ops.c | 63 +-- fs/cifs/smb2pdu.c | 5 +- fs/nfsd/filecache.c | 484 ++++++++++++--------- fs/nfsd/filecache.h | 9 +- fs/nfsd/nfs3proc.c | 10 +- fs/nfsd/nfs4proc.c | 11 +- fs/nfsd/nfs4state.c | 20 +- fs/nfsd/trace.h | 129 +++--- fs/nfsd/vfs.c | 19 +- fs/nfsd/vfs.h | 3 +- include/acpi/acpi_bus.h | 3 +- include/linux/blk-mq.h | 4 + include/linux/blkdev.h | 15 +- include/linux/elfcore.h | 8 +- include/linux/mlx5/driver.h | 2 +- include/linux/mtd/spi-nor.h | 1 - include/linux/tpm_eventlog.h | 4 +- include/uapi/linux/psci.h | 4 +- io_uring/fdinfo.c | 12 +- io_uring/io-wq.c | 6 + io_uring/poll.c | 50 ++- io_uring/rw.c | 6 +- kernel/sched/core.c | 41 +- mm/memblock.c | 8 +- net/core/gro.c | 71 +-- net/ipv6/raw.c | 4 + net/netfilter/ipset/ip_set_bitmap_ip.c | 4 +- net/netfilter/nft_payload.c | 2 +- net/sched/act_mpls.c | 8 +- net/tipc/node.c | 12 +- sound/core/control_led.c | 5 +- sound/pci/hda/patch_realtek.c | 53 ++- sound/soc/codecs/rt9120.c | 12 + sound/soc/codecs/wm8904.c | 7 + sound/soc/intel/boards/Kconfig | 1 + sound/soc/intel/boards/sof_nau8825.c | 22 +- sound/soc/intel/common/soc-acpi-intel-adl-match.c | 18 +- sound/soc/qcom/Kconfig | 21 +- sound/soc/qcom/Makefile | 2 + sound/soc/qcom/common.c | 114 ----- sound/soc/qcom/common.h | 10 - sound/soc/qcom/lpass-cpu.c | 5 +- sound/soc/qcom/sc8280xp.c | 1 + sound/soc/qcom/sdw.c | 123 ++++++ sound/soc/qcom/sdw.h | 18 + sound/soc/qcom/sm8250.c | 1 + sound/usb/implicit.c | 3 +- sound/usb/pcm.c | 16 +- sound/usb/stream.c | 6 + tools/include/nolibc/arch-mips.h | 2 + tools/include/nolibc/arch-riscv.h | 14 +- tools/perf/builtin-kmem.c | 65 ++- tools/perf/builtin-trace.c | 2 + tools/perf/util/auxtrace.c | 2 +- tools/perf/util/bpf_counter.h | 6 + tools/testing/memblock/internal.h | 4 + .../testing/selftests/net/af_unix/test_unix_oob.c | 2 +- tools/testing/selftests/net/l2_tos_ttl_inherit.sh | 202 +++++---- .../selftests/netfilter/nft_trans_stress.sh | 16 +- tools/testing/selftests/netfilter/settings | 1 + 214 files changed, 2806 insertions(+), 2326 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/183 netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits
From: Pablo Neira Ayuso <[email protected]>
commit 696e1a48b1a1b01edad542a1ef293665864a4dd0 upstream.
If the offset + length goes over the ethernet + vlan header, then the length is adjusted to copy the bytes that are within the boundaries of the vlan_ethhdr scratchpad area. The remaining bytes beyond ethernet + vlan header are copied directly from the skbuff data area.
Fix incorrect arithmetic operator: subtract, not add, the size of the vlan header in case of double-tagged packets to adjust the length accordingly to address CVE-2023-0179.
--- net/netfilter/nft_payload.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/nft_payload.c +1 -1
@@ -62,7 +62,7 @@ nft_payload_copy_vlan(u32 *d, const strureturn false;if (offset + len >VLAN_ETH_HLEN + vlan_hlen) - ethlen -= offset + len -VLAN_ETH_HLEN + vlan_hlen; + ethlen -= offset + len -VLAN_ETH_HLEN - vlan_hlen;memcpy (dst_u8, vlanh + offset - vlan_hlen, ethlen);
Greg Kroah-Hartman
maintainerPATCH 2/183 Revert "ALSA: usb-audio: Drop superfluous interface setup at parsing"
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 16f1f838442dc6430d32d51ddda347b8421ec34b upstream.
This reverts commit ac5e2fb425e1121ceef2b9d1b3ffccc195d55707.
The commit caused a regression on Behringer UMC404HD (and likely others). As the change was meant only as a minor optimization, it's better to revert it to address the regression.
--- sound/usb/stream.c | 6 ++++++ 1 file changed, 6 insertions(+)
sound/usb/stream.c +6 -0
@@ -1222,6 +1222,12 @@ static int __snd_usb_parse_audio_interfaif (err <0 )return err; } + +/* try to set the interface... */ +usb_set_interface (chip->dev, iface_no,0 ); +snd_usb_init_pitch (chip, fp); +snd_usb_init_sample_rate (chip, fp, fp->rate_max); +usb_set_interface (chip->dev, iface_no, altno); }return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 3/183 ALSA: control-led: use strscpy in set_led_id()
In reply to Greg Kroah-HartmanFrom: Jaroslav Kysela <[email protected]>
commit 70051cffb31b5ee09096351c3b41fcae6f89de31 upstream.
The use of strncpy() in the set_led_id() was incorrect. The len variable should use 'min(sizeof(buf2) - 1, count)' expression.
Use strscpy() function to simplify things and handle the error gracefully.
--- sound/core/control_led.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
sound/core/control_led.c +2 -3
@@ -530,12 +530,11 @@ static ssize_t set_led_id(struct snd_ctl bool attach) {char buf2[256 ], *s, *os; -size_t len =max (sizeof (s) -1 , count);struct snd_ctl_elem_id id;int err; -strncpy (buf2, buf, len); - buf2[len] ='\0' ; +if (strscpy (buf2, buf,sizeof (buf2)) <0 ) +return -E2BIG ;memset (&id,0 ,sizeof (id)); id.iface =SNDRV_CTL_ELEM_IFACE_MIXER ; s = buf2;
Greg Kroah-Hartman
maintainerPATCH 4/183 ALSA: usb-audio: Always initialize fixed_rate in snd_usb_find_implicit_fb_sync_format()
In reply to Greg Kroah-HartmanFrom: Jaroslav Kysela <[email protected]>
commit 291e9da91403e0e628d7692b5ed505100e7b7706 upstream.
Handle the fallback code path, too.
--- sound/usb/implicit.c | 3 ++- sound/usb/pcm.c | 2 ++ 2 files changed, 4 insertions(+), 1 deletion(-)
sound/usb/implicit.c +2 -1
@@ -471,7 +471,7 @@ snd_usb_find_implicit_fb_sync_format(str subs =find_matching_substream (chip, stream, target->sync_ep, target->fmt_type);if (!subs) -return sync_fmt; + goto end; high_score =0 ;list_for_each_entry (fp, &subs->fmt_list, list) {
@@ -485,6 +485,7 @@ snd_usb_find_implicit_fb_sync_format(str } } + end:if (fixed_rate) *fixed_rate =snd_usb_pcm_has_fixed_rate (subs);return sync_fmt;
sound/usb/pcm.c +2 -0
@@ -163,6 +163,8 @@ bool snd_usb_pcm_has_fixed_rate(struct sstruct snd_usb_audio *chip = subs->stream->chip;int rate =-1 ; +if (!subs) +return false;if (!(chip->quirk_flags &QUIRK_FLAG_FIXED_RATE ))return false;list_for_each_entry (fp, &subs->fmt_list, list) {
Greg Kroah-Hartman
maintainerPATCH 5/183 ALSA: hda/realtek - Turn on power early
In reply to Greg Kroah-HartmanFrom: Yuchi Yang <[email protected]>
commit 1f680609bf1beac20e2a31ddcb1b88874123c39f upstream.
Turn on power early to avoid wrong state for power relation register. This can earlier update JD state when resume back.
--- sound/pci/hda/patch_realtek.c | 30 ++++++++++++++++-------------- 1 file changed, 16 insertions(+), 14 deletions(-)
sound/pci/hda/patch_realtek.c +16 -14
@@ -3564,6 +3564,15 @@ static void alc256_init(struct hda_codechda_nid_t hp_pin =alc_get_hp_pin (spec);bool hp_pin_sense; +if (spec->ultra_low_power) { +alc_update_coef_idx (codec,0x03 ,1 <<1 ,1 <<1 ); +alc_update_coef_idx (codec,0x08 ,3 <<2 ,3 <<2 ); +alc_update_coef_idx (codec,0x08 ,7 <<4 ,0 ); +alc_update_coef_idx (codec,0x3b ,1 <<15 ,0 ); +alc_update_coef_idx (codec,0x0e ,7 <<6 ,7 <<6 ); +msleep (30 ); + } +if (!hp_pin) hp_pin =0x21 ;
@@ -3575,14 +3584,6 @@ static void alc256_init(struct hda_codecmsleep (2 );alc_update_coefex_idx (codec,0x57 ,0x04 ,0x0007 ,0x1 );/* Low power */ -if (spec->ultra_low_power) { -alc_update_coef_idx (codec,0x03 ,1 <<1 ,1 <<1 ); -alc_update_coef_idx (codec,0x08 ,3 <<2 ,3 <<2 ); -alc_update_coef_idx (codec,0x08 ,7 <<4 ,0 ); -alc_update_coef_idx (codec,0x3b ,1 <<15 ,0 ); -alc_update_coef_idx (codec,0x0e ,7 <<6 ,7 <<6 ); -msleep (30 ); - }snd_hda_codec_write (codec, hp_pin,0 ,AC_VERB_SET_AMP_GAIN_MUTE ,AMP_OUT_MUTE );
@@ -3713,6 +3714,13 @@ static void alc225_init(struct hda_codechda_nid_t hp_pin =alc_get_hp_pin (spec);bool hp1_pin_sense, hp2_pin_sense; +if (spec->ultra_low_power) { +alc_update_coef_idx (codec,0x08 ,0x0f <<2 ,3 <<2 ); +alc_update_coef_idx (codec,0x0e ,7 <<6 ,7 <<6 ); +alc_update_coef_idx (codec,0x33 ,1 <<11 ,0 ); +msleep (30 ); + } +if (spec->codec_variant !=ALC269_TYPE_ALC287 && spec->codec_variant !=ALC269_TYPE_ALC245 )/* required only at boot or S3 and S4 resume time */
@@ -3734,12 +3742,6 @@ static void alc225_init(struct hda_codecmsleep (2 );alc_update_coefex_idx (codec,0x57 ,0x04 ,0x0007 ,0x1 );/* Low power */ -if (spec->ultra_low_power) { -alc_update_coef_idx (codec,0x08 ,0x0f <<2 ,3 <<2 ); -alc_update_coef_idx (codec,0x0e ,7 <<6 ,7 <<6 ); -alc_update_coef_idx (codec,0x33 ,1 <<11 ,0 ); -msleep (30 ); - }if (hp1_pin_sense || spec->ultra_low_power) snd_hda_codec_write(codec, hp_pin, 0,
Greg Kroah-Hartman
maintainerPATCH 6/183 ALSA: hda/realtek: Enable mute/micmute LEDs on HP Spectre x360 13-aw0xxx
In reply to Greg Kroah-HartmanFrom: Luka Guzenko <[email protected]>
commit ca88eeb308a221c2dcd4a64031d2e5fcd3db9eaa upstream.
The HP Spectre x360 13-aw0xxx devices use the ALC285 codec with GPIO 0x04 controlling the micmute LED and COEF 0x0b index 8 controlling the mute LED. A quirk was added to make these work as well as a fixup.
--- sound/pci/hda/patch_realtek.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+)
sound/pci/hda/patch_realtek.c +23 -0
@@ -4646,6 +4646,16 @@ static void alc285_fixup_hp_coef_micmute } } +static void alc285_fixup_hp_gpio_micmute_led (struct hda_codec *codec, +const struct hda_fixup *fix,int action) +{ +struct alc_spec *spec = codec->spec; + +if (action ==HDA_FIXUP_ACT_PRE_PROBE ) + spec->micmute_led_polarity =1 ; +alc_fixup_hp_gpio_led (codec, action,0 ,0x04 ); +} +static void alc236_fixup_hp_coef_micmute_led (struct hda_codec *codec,const struct hda_fixup *fix,int action) {
@@ -4667,6 +4677,13 @@ static void alc285_fixup_hp_mute_led(stralc285_fixup_hp_coef_micmute_led (codec, fix, action); } +static void alc285_fixup_hp_spectre_x360_mute_led (struct hda_codec *codec, +const struct hda_fixup *fix,int action) +{ +alc285_fixup_hp_mute_led_coefbit (codec, fix, action); +alc285_fixup_hp_gpio_micmute_led (codec, fix, action); +} +static void alc236_fixup_hp_mute_led (struct hda_codec *codec,const struct hda_fixup *fix,int action) {
@@ -7108,6 +7125,7 @@ enum {ALC285_FIXUP_ASUS_G533Z_PINS ,ALC285_FIXUP_HP_GPIO_LED ,ALC285_FIXUP_HP_MUTE_LED , +ALC285_FIXUP_HP_SPECTRE_X360_MUTE_LED ,ALC236_FIXUP_HP_GPIO_LED ,ALC236_FIXUP_HP_MUTE_LED , ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF,
@@ -8488,6 +8506,10 @@ static const struct hda_fixup alc269_fix .type = HDA_FIXUP_FUNC, .v.func = alc285_fixup_hp_mute_led, }, + [ALC285_FIXUP_HP_SPECTRE_X360_MUTE_LED] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc285_fixup_hp_spectre_x360_mute_led, + }, [ALC236_FIXUP_HP_GPIO_LED] = { .type = HDA_FIXUP_FUNC, .v.func = alc236_fixup_hp_gpio_led,
@@ -9330,6 +9352,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x103c ,0x86c7 ,"HP Envy AiO 32" ,ALC274_FIXUP_HP_ENVY_GPIO ),SND_PCI_QUIRK (0x103c ,0x86e7 ,"HP Spectre x360 15-eb0xxx" ,ALC285_FIXUP_HP_SPECTRE_X360_EB1 ),SND_PCI_QUIRK (0x103c ,0x86e8 ,"HP Spectre x360 15-eb0xxx" ,ALC285_FIXUP_HP_SPECTRE_X360_EB1 ), +SND_PCI_QUIRK (0x103c ,0x86f9 ,"HP Spectre x360 13-aw0xxx" ,ALC285_FIXUP_HP_SPECTRE_X360_MUTE_LED ),SND_PCI_QUIRK (0x103c ,0x8716 ,"HP Elite Dragonfly G2 Notebook PC" ,ALC285_FIXUP_HP_GPIO_AMP_INIT ),SND_PCI_QUIRK (0x103c ,0x8720 ,"HP EliteBook x360 1040 G8 Notebook PC" ,ALC285_FIXUP_HP_GPIO_AMP_INIT ), SND_PCI_QUIRK(0x103c, 0x8724, "HP EliteBook 850 G7", ALC285_FIXUP_HP_GPIO_LED),
Greg Kroah-Hartman
maintainerPATCH 7/183 KVM: x86: Do not return host topology information from KVM_GET_SUPPORTED_CPUID
In reply to Greg Kroah-HartmanFrom: Paolo Bonzini <[email protected]>
commit 45e966fcca03ecdcccac7cb236e16eea38cc18af upstream.
Passing the host topology to the guest is almost certainly wrong and will confuse the scheduler. In addition, several fields of these CPUID leaves vary on each processor; it is simply impossible to return the right values from KVM_GET_SUPPORTED_CPUID in such a way that they can be passed to KVM_SET_CPUID2.
The values that will most likely prevent confusion are all zeroes. Userspace will have to override it anyway if it wishes to present a specific topology to the guest.
--- Documentation/virt/kvm/api.rst | 14 ++++++++++++++ arch/x86/kvm/cpuid.c | 32 ++++++++++++++++---------------- 2 files changed, 30 insertions(+), 16 deletions(-)
Documentation/virt/kvm/api.rst +14 -0
@@ -8248,6 +8248,20 @@ CPU[EAX=1]:ECX[24] (TSC_DEADLINE) is not It can be enabled if ``KVM_CAP_TSC_DEADLINE_TIMER`` is present and the kernel has enabled in-kernel emulation of the local APIC. +CPU topology +~~~~~~~~~~~~ + +Several CPUID values include topology information for the host CPU: +0x0b and 0x1f for Intel systems, 0x8000001e for AMD systems. Different +versions of KVM return different values for this information and userspace +should not rely on it. Currently they return all zeroes. + +If userspace wishes to set up a guest topology, it should be careful that +the values of these three leaves differ for each CPU. In particular, +the APIC ID is found in EDX for all subleaves of 0x0b and 0x1f, and in EAX +for 0x8000001e; the latter also encodes the core id and node id in bits +7:0 of EBX and ECX respectively. + Obsolete ioctls and capabilities ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
arch/x86/kvm/cpuid.c +16 -16
@@ -759,16 +759,22 @@ struct kvm_cpuid_array {int nent; }; +static struct kvm_cpuid_entry2 *get_next_cpuid (struct kvm_cpuid_array *array) +{ +if (array->nent >= array->maxnent) +return NULL ; + +return &array->entries[array->nent++]; +} +static struct kvm_cpuid_entry2 *do_host_cpuid (struct kvm_cpuid_array *array,u32 function,u32 index) { -struct kvm_cpuid_entry2 *entry; +struct kvm_cpuid_entry2 *entry =get_next_cpuid (array); -if (array->nent >= array->maxnent) +if (!entry)return NULL ; - entry = &array->entries[array->nent++]; -memset (entry,0 ,sizeof (*entry)); entry->function = function; entry->index = index;
@@ -945,22 +951,13 @@ static inline int __do_cpuid_func(struct entry->edx = edx.full;break ; } -/* -* Per Intel's SDM, the 0x1f is a superset of 0xb, -* thus they can be handled by common code. -*/ case 0x1f :case 0xb :/* -* Populate entries until the level type (ECX[15:8]) of the -* previous entry is zero. Note, CPUID EAX.{0x1f,0xb}.0 is -* the starting entry, filled by the primary do_host_cpuid(). +* No topology; a valid topology is indicated by the presence +* of subleaf 1. */ -for (i =1 ; entry->ecx &0xff00 ; ++i) { - entry =do_host_cpuid (array, function, i); -if (!entry) - goto out; - } + entry->eax = entry->ebx = entry->ecx =0 ;break ;case 0xd : {u64 permitted_xcr0 = kvm_caps.supported_xcr0 &xstate_get_guest_group_perm ();
@@ -1193,6 +1190,9 @@ static inline int __do_cpuid_func(struct entry->ebx = entry->ecx = entry->edx =0 ;break ;case 0x8000001e : +/* Do not return host topology information. */ + entry->eax = entry->ebx = entry->ecx =0 ; + entry->edx =0 ;/* reserved */ break ;case 0x8000001F :if (!kvm_cpu_cap_has (X86_FEATURE_SEV )) {
Greg Kroah-Hartman
maintainerPATCH 8/183 KVM: arm64: Fix S1PTW handling on RO memslots
In reply to Greg Kroah-HartmanFrom: Marc Zyngier <[email protected]>
commit 406504c7b0405d74d74c15a667cd4c4620c3e7a9 upstream.
A recent development on the EFI front has resulted in guests having their page tables baked in the firmware binary, and mapped into the IPA space as part of a read-only memslot. Not only is this legitimate, but it also results in added security, so thumbs up.
It is possible to take an S1PTW translation fault if the S1 PTs are unmapped at stage-2. However, KVM unconditionally treats S1PTW as a write to correctly handle hardware AF/DB updates to the S1 PTs. Furthermore, KVM injects an exception into the guest for S1PTW writes. In the aforementioned case this results in the guest taking an abort it won't recover from, as the S1 PTs mapping the vectors suffer from the same problem.
So clearly our handling is... wrong.
Instead, switch to a two-pronged approach:
- On S1PTW translation fault, handle the fault as a read
- On S1PTW permission fault, handle the fault as a write
This is of no consequence to SW that *writes* to its PTs (the write will trigger a non-S1PTW fault), and SW that uses RO PTs will not use HW-assisted AF/DB anyway, as that'd be wrong.
Only in the case described in c4ad98e4b72c ("KVM: arm64: Assume write fault on S1PTW permission fault on instruction fetch") do we end-up with two back-to-back faults (page being evicted and faulted back). I don't think this is a case worth optimising for.
--- arch/arm64/include/asm/kvm_emulate.h | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-)
arch/arm64/include/asm/kvm_emulate.h +20 -2
@@ -373,8 +373,26 @@ static __always_inline int kvm_vcpu_sys_static inline bool kvm_is_write_fault (struct kvm_vcpu *vcpu) { -if (kvm_vcpu_abt_iss1tw (vcpu)) -return true; +if (kvm_vcpu_abt_iss1tw (vcpu)) { +/* +* Only a permission fault on a S1PTW should be +* considered as a write. Otherwise, page tables baked +* in a read-only memslot will result in an exception +* being delivered in the guest. +* +* The drawback is that we end-up faulting twice if the +* guest is using any of HW AF/DB: a translation fault +* to map the page containing the PT (read only at +* first), then a permission fault to allow the flags +* to be set. +*/ +switch (kvm_vcpu_trap_get_fault_type (vcpu)) { +case ESR_ELx_FSC_PERM: +return true; +default : +return false; + } + }if (kvm_vcpu_trap_is_iabt (vcpu))return false;
Greg Kroah-Hartman
maintainerPATCH 9/183 efi: fix userspace infinite retry read efivars after EFI runtime services page fault
In reply to Greg Kroah-HartmanFrom: Ding Hui <[email protected]>
commit e006ac3003080177cf0b673441a4241f77aaecce upstream.
After [1][2], if we catch exceptions due to EFI runtime service, we will clear EFI_RUNTIME_SERVICES bit to disable EFI runtime service, then the subsequent routine which invoke the EFI runtime service should fail.
But the userspace cat efivars through /sys/firmware/efi/efivars/ will stuck and infinite loop calling read() due to efivarfs_file_read() return -EINTR.
The -EINTR is converted from EFI_ABORTED by efi_status_to_err(), and is an improper return value in this situation, so let virt_efi_xxx() return EFI_DEVICE_ERROR and converted to -EIO to invoker.
--- drivers/firmware/efi/runtime-wrappers.c | 1 + 1 file changed, 1 insertion(+)
drivers/firmware/efi/runtime-wrappers.c +1 -0
@@ -62,6 +62,7 @@ struct efi_runtime_work efi_rts_work; \if (!efi_enabled (EFI_RUNTIME_SERVICES )) { \pr_warn_once ("EFI Runtime Services are disabled!\n" ); \ + efi_rts_work.status =EFI_DEVICE_ERROR ; \ goto exit; \ } \ \
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 10/183 efi: tpm: Avoid READ_ONCE() for accessing the event log
In reply to Greg Kroah-HartmanFrom: Ard Biesheuvel <[email protected]>
commit d3f450533bbcb6dd4d7d59cadc9b61b7321e4ac1 upstream.
Nathan reports that recent kernels built with LTO will crash when doing EFI boot using Fedora's GRUB and SHIM. The culprit turns out to be a misaligned load from the TPM event log, which is annotated with READ_ONCE(), and under LTO, this gets translated into a LDAR instruction which does not tolerate misaligned accesses.
Interestingly, this does not happen when booting the same kernel straight from the UEFI shell, and so the fact that the event log may appear misaligned in memory may be caused by a bug in GRUB or SHIM.
However, using READ_ONCE() to access firmware tables is slightly unusual in any case, and here, we only need to ensure that 'event' is not dereferenced again after it gets unmapped, but this is already taken care of by the implicit barrier() semantics of the early_memunmap() call.
--- include/linux/tpm_eventlog.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/linux/tpm_eventlog.h +2 -2
@@ -198,8 +198,8 @@ static __always_inline int __calc_tpm2_e* The loop below will unmap these fields if the log is larger than * one page, so save them here for reference: */ - count =READ_ONCE (event->count); - event_type =READ_ONCE (event->event_type); + count = event->count; + event_type = event->event_type;/* Verify that it's the log header */ if (event_header->pcr_idx != 0 ||
Greg Kroah-Hartman
maintainerPATCH 11/183 docs: Fix the docs build with Sphinx 6.0
In reply to Greg Kroah-HartmanFrom: Jonathan Corbet <[email protected]>
commit 0283189e8f3d0917e2ac399688df85211f48447b upstream.
Sphinx 6.0 removed the execfile_() function, which we use as part of the configuration process. They *did* warn us... Just open-code the functionality as is done in Sphinx itself.
Tested (using SPHINX_CONF, since this code is only executed with an alternative config file) on various Sphinx versions from 2.5 through 6.0.
--- Documentation/sphinx/load_config.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
Documentation/sphinx/load_config.py +4 -2
@@ -3,7 +3,7 @@ import os import sys -from sphinx.util.pycompat import execfile_ +from sphinx.util.osutil import fs_encoding # ------------------------------------------------------------------------------ def loadConfig(namespace):
@@ -48,7 +48,9 @@ def loadConfig(namespace): sys.stdout.write("load additional sphinx-config: %s\n" % config_file) config = namespace.copy() config['__file__'] = config_file - execfile_(config_file, config) + with open(config_file, 'rb') as f: + code = compile(f.read(), fs_encoding, 'exec') + exec(code, config) del config['__file__'] namespace.update(config) else:
Greg Kroah-Hartman
maintainerPATCH 12/183 io_uring/poll: add hash if ready poll request cant complete inline
In reply to Greg Kroah-HartmanFrom: Jens Axboe <[email protected]>
commit febb985c06cb6f5fac63598c0bffd4fd823d110d upstream.
If we don't, then we may lose access to it completely, leading to a request leak. This will eventually stall the ring exit process as well.
--- io_uring/poll.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-)
io_uring/poll.c +12 -5
@@ -549,6 +549,14 @@ static bool io_poll_can_finish_inline(streturn pt->owning ||io_poll_get_ownership (req); } +static void io_poll_add_hash (struct io_kiocb *req) +{ +if (req->flags &REQ_F_HASH_LOCKED ) +io_poll_req_insert_locked (req); +else +io_poll_req_insert (req); +} +/* * Returns 0 when it's handed over for polling. The caller owns the requests if * it returns non-zero, but otherwise should not touch it. Negative values
@@ -607,18 +615,17 @@ static int __io_arm_poll_handler(structif (mask && ((poll->events & (EPOLLET |EPOLLONESHOT )) == (EPOLLET |EPOLLONESHOT ))) { -if (!io_poll_can_finish_inline (req, ipt)) +if (!io_poll_can_finish_inline (req, ipt)) { +io_poll_add_hash (req);return 0 ; + }io_poll_remove_entries (req); ipt->result_mask = mask;/* no one else has access to the req, forget about the ref */ return 1 ; } -if (req->flags &REQ_F_HASH_LOCKED ) -io_poll_req_insert_locked (req); -else -io_poll_req_insert (req); +io_poll_add_hash (req);if (mask && (poll->events &EPOLLET ) &&io_poll_can_finish_inline (req, ipt)) {
Greg Kroah-Hartman
maintainerPATCH 13/183 arm64: mte: Fix double-freeing of the temporary tag storage during coredump
In reply to Greg Kroah-HartmanFrom: Catalin Marinas <[email protected]>
commit 736eedc974eaafbf4360e0ea85fc892cea72a223 upstream.
Commit 16decce22efa ("arm64: mte: Fix the stack frame size warning in mte_dump_tag_range()") moved the temporary tag storage array from the stack to slab but it also introduced an error in double freeing this object. Remove the in-loop freeing.
--- arch/arm64/kernel/elfcore.c | 1 - 1 file changed, 1 deletion(-)
arch/arm64/kernel/elfcore.c +0 -1
@@ -65,7 +65,6 @@ static int mte_dump_tag_range(struct cormte_save_page_tags (page_address (page), tags);put_page (page);if (!dump_emit (cprm, tags,MTE_PAGE_TAG_STORAGE )) { -mte_free_tag_storage (tags); ret =0 ;break ; }
Greg Kroah-Hartman
maintainerPATCH 14/183 arm64: mte: Avoid the racy walk of the vma list during core dump
In reply to Greg Kroah-HartmanFrom: Catalin Marinas <[email protected]>
commit 4f4c549feb4ecca95ae9abb88887b941d196f83a upstream.
The MTE coredump code in arch/arm64/kernel/elfcore.c iterates over the vma list without the mmap_lock held. This can race with another process or userfaultfd concurrently modifying the vma list. Change the for_each_mte_vma macro and its callers to instead use the vma snapshot taken by dump_vma_snapshot() and stored in the cprm object.
--- arch/arm64/kernel/elfcore.c | 56 ++++++++++++++++++++------------------------ 1 file changed, 26 insertions(+), 30 deletions(-)
arch/arm64/kernel/elfcore.c +26 -30
@@ -8,28 +8,27 @@#include <asm/cpufeature.h> #include <asm/mte.h> -#define for_each_mte_vma (vmi, vma) \ +#define for_each_mte_vma (cprm, i, m) \ if (system_supports_mte()) \ - for_each_vma(vmi, vma) \ - if (vma->vm_flags & VM_MTE) + for (i = 0, m = cprm->vma_meta; \ + i < cprm->vma_count; \ + i++, m = cprm->vma_meta + i) \ + if (m->flags & VM_MTE) -static unsigned long mte_vma_tag_dump_size (struct vm_area_struct *vma) +static unsigned long mte_vma_tag_dump_size (struct core_vma_metadata *m) { -if (vma->vm_flags &VM_DONTDUMP ) -return 0 ; - -return vma_pages (vma) *MTE_PAGE_TAG_STORAGE ; +return (m->dump_size >>PAGE_SHIFT ) *MTE_PAGE_TAG_STORAGE ; }/* Derived from dump_user_range(); start/end must be page-aligned */ static int mte_dump_tag_range (struct coredump_params *cprm, -unsigned long start,unsigned long end) +unsigned long start,unsigned long len) {int ret =1 ;unsigned long addr;void *tags =NULL ; -for (addr = start; addr < end; addr +=PAGE_SIZE ) { +for (addr = start; addr < start + len; addr +=PAGE_SIZE ) {struct page *page =get_dump_page (addr);/*
@@ -78,11 +77,11 @@ static int mte_dump_tag_range(struct corElf_Half elf_core_extra_phdrs (void ) { -struct vm_area_struct *vma; +int i; +struct core_vma_metadata *m;int vma_count =0 ; -VMA_ITERATOR (vmi, current->mm,0 ); -for_each_mte_vma (vmi, vma) +for_each_mte_vma (cprm, i, m) vma_count++;return vma_count;
@@ -90,18 +89,18 @@ Elf_Half elf_core_extra_phdrs(void)int elf_core_write_extra_phdrs (struct coredump_params *cprm,loff_t offset) { -struct vm_area_struct *vma; -VMA_ITERATOR (vmi, current->mm,0 ); +int i; +struct core_vma_metadata *m; -for_each_mte_vma (vmi, vma) { +for_each_mte_vma (cprm, i, m) {struct elf_phdr phdr; phdr.p_type =PT_AARCH64_MEMTAG_MTE ; phdr.p_offset = offset; - phdr.p_vaddr = vma->vm_start; + phdr.p_vaddr = m->start; phdr.p_paddr =0 ; - phdr.p_filesz =mte_vma_tag_dump_size (vma); - phdr.p_memsz = vma->vm_end - vma->vm_start; + phdr.p_filesz =mte_vma_tag_dump_size (m); + phdr.p_memsz = m->end - m->start; offset += phdr.p_filesz; phdr.p_flags =0 ; phdr.p_align =0 ;
@@ -115,26 +114,23 @@ int elf_core_write_extra_phdrs(struct cosize_t elf_core_extra_data_size (void ) { -struct vm_area_struct *vma; +int i; +struct core_vma_metadata *m;size_t data_size =0 ; -VMA_ITERATOR (vmi, current->mm,0 ); -for_each_mte_vma (vmi, vma) - data_size +=mte_vma_tag_dump_size (vma); +for_each_mte_vma (cprm, i, m) + data_size +=mte_vma_tag_dump_size (m);return data_size; }int elf_core_write_extra_data (struct coredump_params *cprm) { -struct vm_area_struct *vma; -VMA_ITERATOR (vmi, current->mm,0 ); - -for_each_mte_vma (vmi, vma) { -if (vma->vm_flags &VM_DONTDUMP ) -continue ; +int i; +struct core_vma_metadata *m; -if (!mte_dump_tag_range (cprm, vma->vm_start, vma->vm_end)) +for_each_mte_vma (cprm, i, m) { +if (!mte_dump_tag_range (cprm, m->start, m->dump_size))return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 15/183 arm64: cmpxchg_double*: hazard against entire exchange variable
In reply to Greg Kroah-HartmanFrom: Mark Rutland <[email protected]>
commit 031af50045ea97ed4386eb3751ca2c134d0fc911 upstream.
The inline assembly for arm64's cmpxchg_double*() implementations use a +Q constraint to hazard against other accesses to the memory location being exchanged. However, the pointer passed to the constraint is a pointer to unsigned long, and thus the hazard only applies to the first 8 bytes of the location.
GCC can take advantage of this, assuming that other portions of the location are unchanged, leading to a number of potential problems.
This is similar to what we fixed back in commit:
fee960bed5e857eb ("arm64: xchg: hazard against entire exchange variable")
... but we forgot to adjust cmpxchg_double*() similarly at the same time.
The same problem applies, as demonstrated with the following test:
| struct big {
| u64 lo, hi;
| } __aligned(128);
|
| unsigned long foo(struct big *b)
| {
| u64 hi_old, hi_new;
|
| hi_old = b->hi;
| cmpxchg_double_local(&b->lo, &b->hi, 0x12, 0x34, 0x56, 0x78);
| hi_new = b->hi;
|
| return hi_old ^ hi_new;
| }... which GCC 12.1.0 compiles as:
| 0000000000000000 <foo>: | 0: d503233f paciasp | 4: aa0003e4 mov x4, x0 | 8: 1400000e b 40 <foo+0x40> | c: d2800240 mov x0, #0x12 // #18 | 10: d2800681 mov x1, #0x34 // #52 | 14: aa0003e5 mov x5, x0 | 18: aa0103e6 mov x6, x1 | 1c: d2800ac2 mov x2, #0x56 // #86 | 20: d2800f03 mov x3, #0x78 // #120 | 24: 48207c82 casp x0, x1, x2, x3, [x4] | 28: ca050000 eor x0, x0, x5 | 2c: ca060021 eor x1, x1, x6 | 30: aa010000 orr x0, x0, x1 | 34: d2800000 mov x0, #0x0 // #0 <--- BANG | 38: d50323bf autiasp | 3c: d65f03c0 ret | 40: d2800240 mov x0, #0x12 // #18 | 44: d2800681 mov x1, #0x34 // #52 | 48: d2800ac2 mov x2, #0x56 // #86 | 4c: d2800f03 mov x3, #0x78 // #120 | 50: f9800091 prfm pstl1strm, [x4] | 54: c87f1885 ldxp x5, x6, [x4] | 58: ca0000a5 eor x5, x5, x0 | 5c: ca0100c6 eor x6, x6, x1 | 60: aa0600a6 orr x6, x5, x6 | 64: b5000066 cbnz x6, 70 <foo+0x70> | 68: c8250c82 stxp w5, x2, x3, [x4] | 6c: 35ffff45 cbnz w5, 54 <foo+0x54> | 70: d2800000 mov x0, #0x0 // #0 <--- BANG | 74: d50323bf autiasp | 78: d65f03c0 ret
Notice that at the lines with "BANG" comments, GCC has assumed that the higher 8 bytes are unchanged by the cmpxchg_double() call, and that hi_old ^ hi_new can be reduced to a constant zero, for both LSE and LL/SC versions of cmpxchg_double().
This patch fixes the issue by passing a pointer to __uint128_t into the +Q constraint, ensuring that the compiler hazards against the entire 16 bytes being modified.
With this change, GCC 12.1.0 compiles the above test as:
| 0000000000000000 <foo>: | 0: f9400407 ldr x7, [x0, #8] | 4: d503233f paciasp | 8: aa0003e4 mov x4, x0 | c: 1400000f b 48 <foo+0x48> | 10: d2800240 mov x0, #0x12 // #18 | 14: d2800681 mov x1, #0x34 // #52 | 18: aa0003e5 mov x5, x0 | 1c: aa0103e6 mov x6, x1 | 20: d2800ac2 mov x2, #0x56 // #86 | 24: d2800f03 mov x3, #0x78 // #120 | 28: 48207c82 casp x0, x1, x2, x3, [x4] | 2c: ca050000 eor x0, x0, x5 | 30: ca060021 eor x1, x1, x6 | 34: aa010000 orr x0, x0, x1 | 38: f9400480 ldr x0, [x4, #8] | 3c: d50323bf autiasp | 40: ca0000e0 eor x0, x7, x0 | 44: d65f03c0 ret | 48: d2800240 mov x0, #0x12 // #18 | 4c: d2800681 mov x1, #0x34 // #52 | 50: d2800ac2 mov x2, #0x56 // #86 | 54: d2800f03 mov x3, #0x78 // #120 | 58: f9800091 prfm pstl1strm, [x4] | 5c: c87f1885 ldxp x5, x6, [x4] | 60: ca0000a5 eor x5, x5, x0 | 64: ca0100c6 eor x6, x6, x1 | 68: aa0600a6 orr x6, x5, x6 | 6c: b5000066 cbnz x6, 78 <foo+0x78> | 70: c8250c82 stxp w5, x2, x3, [x4] | 74: 35ffff45 cbnz w5, 5c <foo+0x5c> | 78: f9400480 ldr x0, [x4, #8] | 7c: d50323bf autiasp | 80: ca0000e0 eor x0, x7, x0 | 84: d65f03c0 ret
... sampling the high 8 bytes before and after the cmpxchg, and performing an EOR, as we'd expect.
For backporting, I've tested this atop linux-4.9.y with GCC 5.5.0. Note that linux-4.9.y is oldest currently supported stable release, and mandates GCC 5.1+. Unfortunately I couldn't get a GCC 5.1 binary to run on my machines due to library incompatibilities.
I've also used a standalone test to check that we can use a __uint128_t pointer in a +Q constraint at least as far back as GCC 4.8.5 and LLVM 3.9.1.
--- arch/arm64/include/asm/atomic_ll_sc.h | 2 +- arch/arm64/include/asm/atomic_lse.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
arch/arm64/include/asm/atomic_ll_sc.h +1 -1
@@ -315,7 +315,7 @@ __ll_sc__cmpxchg_double##name(unsigned l" cbnz %w0, 1b\n" \ " " #mb "\n" \ "2:" \ - : "=&r" (tmp), "=&r" (ret), "+Q" (*(unsigned long *)ptr) \ + : "=&r" (tmp), "=&r" (ret), "+Q" (*(__uint128_t *)ptr) \ : "r" (old1), "r" (old2), "r" (new1), "r" (new2) \ : cl); \ \
arch/arm64/include/asm/atomic_lse.h +1 -1
@@ -311,7 +311,7 @@ __lse__cmpxchg_double##name(unsigned lon" eor %[old2], %[old2], %[oldval2]\n" \" orr %[old1], %[old1], %[old2]" \ : [old1] "+&r" (x0), [old2] "+&r" (x1), \ -[v] " +Q " (*(unsigned long *)ptr) \ +[v] " +Q " (*(__uint128_t *)ptr) \ : [new1] " r" (x2), [new2] " r" (x3), [ptr] " r" (x4), \ [oldval1] " r" (oldval1), [oldval2] " r" (oldval2) \ : cl); \
Greg Kroah-Hartman
maintainerPATCH 16/183 ACPI: Fix selecting wrong ACPI fwnode for the iGPU on some Dell laptops
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit f64e4275ef7407d5c3eca20436519bbd1f796e40 upstream.
The Dell Latitude E6430 both with and without the optional NVidia dGPU has a bug in its ACPI tables which is causing Linux to assign the wrong ACPI fwnode / companion to the pci_device for the i915 iGPU.
Specifically under the PCI root bridge there are these 2 ACPI Device()s :
Scope (_SB.PCI0)
{
Device (GFX0)
{
Name (_ADR, 0x00020000) // _ADR: Address
}
...
Device (VID)
{
Name (_ADR, 0x00020000) // _ADR: Address
...
Method (_DOS, 1, NotSerialized) // _DOS: Disable Output Switching
{
VDP8 = Arg0
VDP1 (One, VDP8)
}
Method (_DOD, 0, NotSerialized) // _DOD: Display Output Devices
{
...
}
...
}}
The non-functional GFX0 ACPI device is a problem, because this gets returned as ACPI companion-device by acpi_find_child_device() for the iGPU.
This is a long standing problem and the i915 driver does use the ACPI companion for some things, but works fine without it.
However since commit 63f534b8bad9 ("ACPI: PCI: Rework acpi_get_pci_dev()") acpi_get_pci_dev() relies on the physical-node pointer in the acpi_device and that is set on the wrong acpi_device because of the wrong acpi_find_child_device() return. This breaks the ACPI video code, leading to non working backlight control in some cases.
Add a type.backlight flag, mark ACPI video bus devices with this and make find_child_checks() return a higher score for children with this flag set, so that it picks the right companion-device.
--- drivers/acpi/glue.c | 14 ++++++++++++-- drivers/acpi/scan.c | 7 +++++-- include/acpi/acpi_bus.h | 3 ++- 3 files changed, 19 insertions(+), 5 deletions(-)
drivers/acpi/glue.c +12 -2
@@ -75,7 +75,8 @@ static struct acpi_bus_type *acpi_get_bus_type(struct device *dev) }#define FIND_CHILD_MIN_SCORE 1 -#define FIND_CHILD_MAX_SCORE 2 +#define FIND_CHILD_MID_SCORE 2 +#define FIND_CHILD_MAX_SCORE 3static int match_any (struct acpi_device *adev,void *not_used) {
@@ -96,8 +97,17 @@ static int find_child_checks(struct acpi_device *adev, bool check_children)return -ENODEV ; status =acpi_evaluate_integer (adev->handle,"_STA" ,NULL , &sta); -if (status ==AE_NOT_FOUND ) +if (status ==AE_NOT_FOUND ) { +/* +* Special case: backlight device objects without _STA are +* preferred to other objects with the same _ADR value, because +* it is more likely that they are actually useful. +*/ +if (adev->pnp.type.backlight) +return FIND_CHILD_MID_SCORE ; +return FIND_CHILD_MIN_SCORE ; + }if (ACPI_FAILURE (status) || !(sta &ACPI_STA_DEVICE_ENABLED ))return -ENODEV ;
drivers/acpi/scan.c +5 -2
@@ -1370,9 +1370,12 @@ static void acpi_set_pnp_ids(acpi_handle handle, struct acpi_device_pnp *pnp,* Some devices don't reliably have _HIDs & _CIDs, so add * synthetic HIDs to make sure drivers can find them. */ -if (acpi_is_video_device (handle)) +if (acpi_is_video_device (handle)) {acpi_add_id (pnp,ACPI_VIDEO_HID ); -else if (acpi_bay_match (handle)) + pnp->type.backlight =1 ; +break ; + } +if (acpi_bay_match (handle))acpi_add_id (pnp,ACPI_BAY_HID );else if (acpi_dock_match (handle))acpi_add_id (pnp,ACPI_DOCK_HID );
include/acpi/acpi_bus.h +2 -1
@@ -230,7 +230,8 @@ struct acpi_pnp_type { u32 hardware_id:1; u32 bus_address:1; u32 platform_id:1; - u32 reserved:29; + u32 backlight:1; + u32 reserved:28; };struct acpi_device_pnp {
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 17/183 net: stmmac: add aux timestamps fifo clearance wait
In reply to Greg Kroah-HartmanFrom: Noor Azura Ahmad Tarmizi <[email protected]>
commit ae9dcb91c6069e20b3b9505d79cbc89fd6e086f5 upstream.
Add timeout polling wait for auxiliary timestamps snapshot FIFO clear bit (ATSFC) to clear. This is to ensure no residue fifo value is being read erroneously.
--- drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c +4 -1
@@ -219,7 +219,10 @@ static int stmmac_enable(struct ptp_cloc }writel (acr_value, ptpaddr +PTP_ACR );mutex_unlock (&priv->aux_ts_lock); - ret =0 ; +/* wait for auxts fifo clear to finish */ + ret =readl_poll_timeout (ptpaddr +PTP_ACR , acr_value, + !(acr_value &PTP_ACR_ATSFC ), +10 ,10000 );break ;default :
Greg Kroah-Hartman
maintainerPATCH 18/183 perf auxtrace: Fix address filter duplicate symbol selection
In reply to Greg Kroah-HartmanFrom: Adrian Hunter <[email protected]>
commit cf129830ee820f7fc90b98df193cd49d49344d09 upstream.
When a match has been made to the nth duplicate symbol, return success not error.
Example:
Before:
$ cat file.c
cat: file.c: No such file or directory
$ cat file1.c
#include <stdio.h> static void func(void)
{
printf("First func\n");
}
void other(void);
int main()
{
func();
other();
return 0;
}
$ cat file2.c
#include <stdio.h>
static void func(void)
{
printf("Second func\n");
}
void other(void)
{
func();
}
$ gcc -Wall -Wextra -o test file1.c file2.c
$ perf record -e intel_pt//u --filter 'filter func @ ./test' -- ./test
Multiple symbols with name 'func'
#1 0x1149 l func
which is near main
#2 0x1179 l func
which is near other
Disambiguate symbol name by inserting #n after the name e.g. func #2
Or select a global symbol by inserting #0 or #g or #G
Failed to parse address filter: 'filter func @ ./test'
Filter format is: filter|start|stop|tracestop <start symbol or address> [/ <end symbol or size>] [@<file name>]
Where multiple filters are separated by space or comma.
$ perf record -e intel_pt//u --filter 'filter func #2 @ ./test' -- ./test
Failed to parse address filter: 'filter func #2 @ ./test'
Filter format is: filter|start|stop|tracestop <start symbol or address> [/ <end symbol or size>] [@<file name>]
Where multiple filters are separated by space or comma.After:
$ perf record -e intel_pt//u --filter 'filter func #2 @ ./test' -- ./test
First func
Second func
[ perf record: Woken up 1 times to write data ]
[ perf record: Captured and wrote 0.016 MB perf.data ]
$ perf script --itrace=b -Ftime,flags,ip,sym,addr --ns
1231062.526977619: tr strt 0 [unknown] => 558495708179 func
1231062.526977619: tr end call 558495708188 func => 558495708050 _init
1231062.526979286: tr strt 0 [unknown] => 55849570818d func
1231062.526979286: tr end return 55849570818f func => 55849570819d other--- tools/perf/util/auxtrace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/util/auxtrace.c +1 -1
@@ -2610,7 +2610,7 @@ static int find_dso_sym(struct dso *dso, *size = sym->start - *start;if (idx >0 ) {if (*size) -return 1 ; +return 0 ; }else if (dso_sym_match (sym, sym_name, &cnt, idx)) {print_duplicate_syms (dso, sym_name);return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 19/183 s390/kexec: fix ipl report address for kdump
In reply to Greg Kroah-HartmanFrom: Alexander Egorenkov <[email protected]>
commit c2337a40e04dde1692b5b0a46ecc59f89aaba8a1 upstream.
This commit addresses the following erroneous situation with file-based kdump executed on a system with a valid IPL report.
On s390, a kdump kernel, its initrd and IPL report if present are loaded into a special and reserved on boot memory region - crashkernel. When a system crashes and kdump was activated before, the purgatory code is entered first which swaps the crashkernel and [0 - crashkernel size] memory regions. Only after that the kdump kernel is entered. For this reason, the pointer to an IPL report in lowcore must point to the IPL report after the swap and not to the address of the IPL report that was located in crashkernel memory region before the swap. Failing to do so, makes the kdump's decompressor try to read memory from the crashkernel memory region which already contains the production's kernel memory.
The situation described above caused spontaneous kdump failures/hangs on systems where the Secure IPL is activated because on such systems an IPL report is always present. In that case kdump's decompressor tried to parse an IPL report which frequently lead to illegal memory accesses because an IPL report contains addresses to various data.
--- arch/s390/kernel/machine_kexec_file.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
arch/s390/kernel/machine_kexec_file.c +3 -2
@@ -187,8 +187,6 @@ static int kexec_file_add_ipl_report(str data->memsz =ALIGN (data->memsz,PAGE_SIZE ); buf.mem = data->memsz; -if (image->type ==KEXEC_TYPE_CRASH ) - buf.mem += crashk_res.start; ptr = (void *)ipl_cert_list_addr; end = ptr + ipl_cert_list_size;
@@ -225,6 +223,9 @@ static int kexec_file_add_ipl_report(str data->kernel_buf + offsetof(struct lowcore , ipl_parmblock_ptr); *lc_ipl_parmblock_ptr = (__u32 )buf.mem; +if (image->type ==KEXEC_TYPE_CRASH ) + buf.mem += crashk_res.start; + ret =kexec_add_buffer (&buf); out:return ret;
Greg Kroah-Hartman
maintainerPATCH 20/183 brcmfmac: Prefer DT board type over DMI board type
In reply to Greg Kroah-HartmanFrom: Ivan T. Ivanov <[email protected]>
commit a5a36720c3f650f859f5e9535dd62d06f13f4f3b upstream.
The introduction of support for Apple board types inadvertently changed the precedence order, causing hybrid SMBIOS+DT platforms to look up the firmware using the DMI information instead of the device tree compatible to generate the board type. Revert back to the old behavior, as affected platforms use firmwares named after the DT compatible.
[1] https://bugzilla.opensuse.org/show_bug.cgi?id=1206697#c13
--- drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c +3 -2
@@ -79,7 +79,8 @@ void brcmf_of_probe(struct device *dev, enum brcmf_bus_type bus_type,/* Apple ARM64 platforms have their own idea of board type, passed in * via the device tree. They also have an antenna SKU parameter */ -if (!of_property_read_string (np,"brcm,board-type" , &prop)) + err =of_property_read_string (np,"brcm,board-type" , &prop); +if (!err) settings->board_type = prop;if (!of_property_read_string (np,"apple,antenna-sku" , &prop))
@@ -87,7 +88,7 @@ void brcmf_of_probe(struct device *dev, enum brcmf_bus_type bus_type,/* Set board-type to the first string of the machine compatible prop */ root =of_find_node_by_path ("/" ); -if (root && !settings->board_type) { +if (root && err) {char *board_type;const char *tmp;
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 21/183 ASoC: qcom: lpass-cpu: Fix fallback SD line index handling
In reply to Greg Kroah-HartmanFrom: Brian Norris <[email protected]>
commit 000bca8d706d1bf7cca01af75787247c5a2fdedf upstream.
These indices should reference the ID placed within the dai_driver array, not the indices of the array itself.
This fixes commit 4ff028f6c108 ("ASoC: qcom: lpass-cpu: Make I2S SD lines configurable"), which among others, broke IPQ8064 audio (sound/soc/qcom/lpass-ipq806x.c) because it uses ID 4 but we'd stop initializing the mi2s_playback_sd_mode and mi2s_capture_sd_mode arrays at ID 0.
--- sound/soc/qcom/lpass-cpu.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
sound/soc/qcom/lpass-cpu.c +3 -2
@@ -1037,10 +1037,11 @@ static void of_lpass_cpu_parse_dai_data( struct lpass_data *data) {struct device_node *node; -int ret, id; +int ret, i, id;/* Allow all channels by default for backwards compatibility */ -for (id =0 ; id < data->variant->num_dai; id++) { +for (i =0 ; i < data->variant->num_dai; i++) { + id = data->variant->dai_driver[i].id; data->mi2s_playback_sd_mode[id] =LPAIF_I2SCTL_MODE_8CH ; data->mi2s_capture_sd_mode[id] =LPAIF_I2SCTL_MODE_8CH ; }
Greg Kroah-Hartman
maintainerPATCH 22/183 elfcore: Add a cprm parameter to elf_core_extra_{phdrs,data_size}
In reply to Greg Kroah-HartmanFrom: Catalin Marinas <[email protected]>
commit 19e183b54528f11fafeca60fc6d0821e29ff281e upstream.
A subsequent fix for arm64 will use this parameter to parse the vma information from the snapshot created by dump_vma_snapshot() rather than traversing the vma list without the mmap_lock.
--- arch/arm64/kernel/elfcore.c | 4 ++-- arch/ia64/kernel/elfcore.c | 4 ++-- arch/x86/um/elfcore.c | 4 ++-- fs/binfmt_elf.c | 4 ++-- fs/binfmt_elf_fdpic.c | 4 ++-- include/linux/elfcore.h | 8 ++++---- 6 files changed, 14 insertions(+), 14 deletions(-)
arch/arm64/kernel/elfcore.c +2 -2
@@ -75,7 +75,7 @@ static int mte_dump_tag_range(struct correturn ret; } -Elf_Half elf_core_extra_phdrs (void ) +Elf_Half elf_core_extra_phdrs (struct coredump_params *cprm) {int i;struct core_vma_metadata *m;
@@ -112,7 +112,7 @@ int elf_core_write_extra_phdrs(struct coreturn 1 ; } -size_t elf_core_extra_data_size (void ) +size_t elf_core_extra_data_size (struct coredump_params *cprm) {int i;struct core_vma_metadata *m;
arch/ia64/kernel/elfcore.c +2 -2
@@ -7,7 +7,7 @@#include <asm/elf.h> -Elf64_Half elf_core_extra_phdrs (void ) +Elf64_Half elf_core_extra_phdrs (struct coredump_params *cprm) {return GATE_EHDR ->e_phnum; }
@@ -60,7 +60,7 @@ int elf_core_write_extra_data(struct correturn 1 ; } -size_t elf_core_extra_data_size (void ) +size_t elf_core_extra_data_size (struct coredump_params *cprm) {const struct elf_phdr *const gate_phdrs = (const struct elf_phdr *) (GATE_ADDR +GATE_EHDR ->e_phoff);
arch/x86/um/elfcore.c +2 -2
@@ -7,7 +7,7 @@#include <asm/elf.h> -Elf32_Half elf_core_extra_phdrs (void ) +Elf32_Half elf_core_extra_phdrs (struct coredump_params *cprm) {return vsyscall_ehdr ? (((struct elfhdr *)vsyscall_ehdr)->e_phnum) :0 ; }
@@ -60,7 +60,7 @@ int elf_core_write_extra_data(struct correturn 1 ; } -size_t elf_core_extra_data_size (void ) +size_t elf_core_extra_data_size (struct coredump_params *cprm) {if ( vsyscall_ehdr ) { const struct elfhdr *const ehdrp =
fs/binfmt_elf.c +2 -2
@@ -2209,7 +2209,7 @@ static int elf_core_dump(struct coredump* The number of segs are recored into ELF header as 16bit value. * Please check DEFAULT_MAX_MAP_COUNT definition when you modify here. */ - segs = cprm->vma_count +elf_core_extra_phdrs (); + segs = cprm->vma_count +elf_core_extra_phdrs (cprm);/* for notes section */ segs++;
@@ -2249,7 +2249,7 @@ static int elf_core_dump(struct coredump dataoff = offset =roundup (offset,ELF_EXEC_PAGESIZE ); offset += cprm->vma_data_size; - offset +=elf_core_extra_data_size (); + offset +=elf_core_extra_data_size (cprm); e_shoff = offset;if (e_phnum ==PN_XNUM ) {
fs/binfmt_elf_fdpic.c +2 -2
@@ -1509,7 +1509,7 @@ static int elf_fdpic_core_dump(struct co tmp->next = thread_list; thread_list = tmp; - segs = cprm->vma_count +elf_core_extra_phdrs (); + segs = cprm->vma_count +elf_core_extra_phdrs (cprm);/* for notes section */ segs++;
@@ -1555,7 +1555,7 @@ static int elf_fdpic_core_dump(struct co dataoff = offset =roundup (offset,ELF_EXEC_PAGESIZE ); offset += cprm->vma_data_size; - offset +=elf_core_extra_data_size (); + offset +=elf_core_extra_data_size (cprm); e_shoff = offset;if (e_phnum ==PN_XNUM ) {
include/linux/elfcore.h +4 -4
@@ -114,14 +114,14 @@ static inline int elf_core_copy_task_fpr* Dumping its extra ELF program headers includes all the other information * a debugger needs to easily find how the gate DSO was being used. */ -extern Elf_Half elf_core_extra_phdrs (void ); +extern Elf_Half elf_core_extra_phdrs (struct coredump_params *cprm);extern int elf_core_write_extra_phdrs (struct coredump_params *cprm,loff_t offset);extern int elf_core_write_extra_data (struct coredump_params *cprm); -extern size_t elf_core_extra_data_size (void ); +extern size_t elf_core_extra_data_size (struct coredump_params *cprm);#else -static inline Elf_Half elf_core_extra_phdrs (void ) +static inline Elf_Half elf_core_extra_phdrs (struct coredump_params *cprm) {return 0 ; }
@@ -136,7 +136,7 @@ static inline int elf_core_write_extra_dreturn 1 ; } -static inline size_t elf_core_extra_data_size (void ) +static inline size_t elf_core_extra_data_size (struct coredump_params *cprm) {return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 23/183 cpufreq: amd-pstate: fix kernel hang issue while amd-pstate unregistering
In reply to Greg Kroah-HartmanFrom: Perry Yuan <[email protected]>
commit 4f3085f87b51a551a0647f218d4f324796ecb703 upstream.
In the amd_pstate_adjust_perf(), there is one cpufreq_cpu_get() call to increase increments the kobject reference count of policy and make it as busy. Therefore, a corresponding call to cpufreq_cpu_put() is needed to decrement the kobject reference count back, it will resolve the kernel hang issue when unregistering the amd-pstate driver and register the amd_pstate_epp driver instance.
--- drivers/cpufreq/amd-pstate.c | 1 + 1 file changed, 1 insertion(+)
drivers/cpufreq/amd-pstate.c +1 -0
@@ -307,6 +307,7 @@ static void amd_pstate_adjust_perf(unsig max_perf = min_perf;amd_pstate_update (cpudata, min_perf, des_perf, max_perf, true); +cpufreq_cpu_put (policy); }static int amd_get_min_freq (struct amd_cpudata *cpudata)
Greg Kroah-Hartman
maintainerPATCH 24/183 s390/cpum_sf: add READ_ONCE() semantics to compare and swap loops
In reply to Greg Kroah-HartmanFrom: Heiko Carstens <[email protected]>
commit 82d3edb50a11bf3c5ef63294d5358ba230181413 upstream.
The current cmpxchg_double() loops within the perf hw sampling code do not have READ_ONCE() semantics to read the old value from memory. This allows the compiler to generate code which reads the "old" value several times from memory, which again allows for inconsistencies.
For example:
/* Reset trailer (using compare-double-and-swap) */
do {
te_flags = te->flags & ~SDB_TE_BUFFER_FULL_MASK;
te_flags |= SDB_TE_ALERT_REQ_MASK;
} while (!cmpxchg_double(&te->flags, &te->overflow,
te->flags, te->overflow,
te_flags, 0ULL));The compiler could generate code where te->flags used within the cmpxchg_double() call may be refetched from memory and which is not necessarily identical to the previous read version which was used to generate te_flags. Which in turn means that an incorrect update could happen.
Fix this by adding READ_ONCE() semantics to all cmpxchg_double() loops. Given that READ_ONCE() cannot generate code on s390 which atomically reads 16 bytes, use a private compare-and-swap-double implementation to achieve that.
Also replace cmpxchg_double() with the private implementation to be able to re-use the old value within the loops.
As a side effect this converts the whole code to only use bit fields to read and modify bits within the hws trailer header.
--- arch/s390/include/asm/cpu_mf.h | 31 +++++------- arch/s390/kernel/perf_cpum_sf.c | 101 ++++++++++++++++++++++++---------------- 2 files changed, 77 insertions(+), 55 deletions(-)
arch/s390/include/asm/cpu_mf.h +15 -16
@@ -131,19 +131,21 @@ struct hws_combined_entry {struct hws_diag_entry diag;/* Diagnostic-sampling data entry */ } __packed; -struct hws_trailer_entry { -union { -struct { -unsigned int f:1 ;/* 0 - Block Full Indicator */ -unsigned int a:1 ;/* 1 - Alert request control */ -unsigned int t:1 ;/* 2 - Timestamp format */ - unsigned int :29; /* 3 - 31: Reserved */ -unsigned int bsdes:16 ;/* 32-47: size of basic SDE */ -unsigned int dsdes:16 ;/* 48-63: size of diagnostic SDE */ - }; -unsigned long long flags;/* 0 - 63: All indicators */ +union hws_trailer_header { +struct { +unsigned int f:1 ;/* 0 - Block Full Indicator */ +unsigned int a:1 ;/* 1 - Alert request control */ +unsigned int t:1 ;/* 2 - Timestamp format */ + unsigned int :29; /* 3 - 31: Reserved */ +unsigned int bsdes:16 ;/* 32-47: size of basic SDE */ +unsigned int dsdes:16 ;/* 48-63: size of diagnostic SDE */ +unsigned long long overflow;/* 64 - Overflow Count */ }; -unsigned long long overflow;/* 64 - sample Overflow count */ +__uint128_t val; +}; + +struct hws_trailer_entry { +union hws_trailer_header header;/* 0 - 15 Flags + Overflow Count */ unsigned char timestamp[16 ];/* 16 - 31 timestamp */ unsigned long long reserved1;/* 32 -Reserved */ unsigned long long reserved2;/* */
@@ -290,14 +292,11 @@ static inline unsigned long sample_rate_return USEC_PER_SEC * qsi->cpu_speed / rate; } -#define SDB_TE_ALERT_REQ_MASK 0x4000000000000000UL -#define SDB_TE_BUFFER_FULL_MASK 0x8000000000000000UL -/* Return TOD timestamp contained in an trailer entry */ static inline unsigned long long trailer_timestamp (struct hws_trailer_entry *te) {/* TOD in STCKE format */ -if (te->t) +if (te->header.t)return *((unsigned long long *) &te->timestamp[1 ]);/* TOD in STCK format */
arch/s390/kernel/perf_cpum_sf.c +62 -39
222 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 25/183 s390/percpu: add READ_ONCE() to arch_this_cpu_to_op_simple()
In reply to Greg Kroah-HartmanFrom: Heiko Carstens <[email protected]>
commit e3f360db08d55a14112bd27454e616a24296a8b0 upstream.
Make sure that *ptr__ within arch_this_cpu_to_op_simple() is only dereferenced once by using READ_ONCE(). Otherwise the compiler could generate incorrect code.
--- arch/s390/include/asm/percpu.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/s390/include/asm/percpu.h +1 -1
@@ -31,7 +31,7 @@pcp_op_T__ *ptr__; \preempt_disable_notrace (); \ ptr__ =raw_cpu_ptr (&(pcp)); \ - prev__ = *ptr__; \ + prev__ =READ_ONCE (*ptr__); \ do { \ old__ = prev__; \ new__ = old__ op (val); \
Greg Kroah-Hartman
maintainerPATCH 26/183 drm/virtio: Fix GEM handle creation UAF
In reply to Greg Kroah-HartmanFrom: Rob Clark <[email protected]>
commit 52531258318ed59a2dc5a43df2eaf0eb1d65438e upstream.
Userspace can guess the handle value and try to race GEM object creation with handle close, resulting in a use-after-free if we dereference the object after dropping the handle's reference. For that reason, dropping the handle's reference must be done *after* we are done dereferencing the object.
--- drivers/gpu/drm/virtio/virtgpu_ioctl.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-)
drivers/gpu/drm/virtio/virtgpu_ioctl.c +17 -2
@@ -358,10 +358,18 @@ static int virtio_gpu_resource_create_iodrm_gem_object_release (obj);return ret; } -drm_gem_object_put (obj); rc->res_handle = qobj->hw_res_handle;/* similiar to a VM address */ rc->bo_handle = handle; + +/* +* The handle owns the reference now. But we must drop our +* remaining reference *after* we no longer need to dereference +* the obj. Otherwise userspace could guess the handle and +* race closing it from another thread. +*/ +drm_gem_object_put (obj); +return 0 ; }
@@ -723,11 +731,18 @@ static int virtio_gpu_resource_create_bldrm_gem_object_release (obj);return ret; } -drm_gem_object_put (obj); rc_blob->res_handle = bo->hw_res_handle; rc_blob->bo_handle = handle; +/* +* The handle owns the reference now. But we must drop our +* remaining reference *after* we no longer need to dereference +* the obj. Otherwise userspace could guess the handle and +* race closing it from another thread. +*/ +drm_gem_object_put (obj); +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 27/183 drm/amd/pm/smu13: BACO is supported when its in BACO state
In reply to Greg Kroah-HartmanFrom: Guchun Chen <[email protected]>
commit 972fb53d3605eb6cdf0d6ae9a52e910626a91ff7 upstream.
This leverages the logic in smu11. No need to talk to SMU to check BACO enablement as it's in BACO state already.
--- drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c +4 -0
@@ -2249,6 +2249,10 @@ bool smu_v13_0_baco_is_support(struct sm !smu_baco->platform_support)return false; +/* return true if ASIC is in BACO state already */ +if (smu_v13_0_baco_get_state (smu) ==SMU_BACO_STATE_ENTER ) +return true; +if (smu_cmn_feature_is_supported (smu,SMU_FEATURE_BACO_BIT ) && !smu_cmn_feature_is_enabled (smu,SMU_FEATURE_BACO_BIT ))return false;
Greg Kroah-Hartman
maintainerPATCH 28/183 drm: Optimize drm buddy top-down allocation method
In reply to Greg Kroah-HartmanFrom: Arunpravin Paneer Selvam <[email protected]>
commit 5640e81607152d7f2d2558227c0f6cb78b8f39cf upstream.
We are observing performance drop in many usecases which include games, 3D benchmark applications,etc.. To solve this problem, We are strictly not allowing top down flag enabled allocations to steal the memory space from cpu visible region.
The idea is, we are sorting each order list entries in ascending order and compare the last entry of each order list in the freelist and return the max block.
This patch improves the 3D benchmark scores and solves fragmentation issues.
All drm buddy selftests are verfied.drm_buddy: pass:6 fail:0 skip:0 total:6
--- drivers/gpu/drm/drm_buddy.c | 83 +++++++++++++++++++++++++++++--------------- 1 file changed, 55 insertions(+), 28 deletions(-)
drivers/gpu/drm/drm_buddy.c +55 -28
@@ -38,6 +38,25 @@ static void drm_block_free(struct drm_bukmem_cache_free (slab_blocks, block); } +static void list_insert_sorted (struct drm_buddy *mm, +struct drm_buddy_block *block) +{ +struct drm_buddy_block *node; +struct list_head *head; + + head = &mm->free_list[drm_buddy_block_order (block)]; +if (list_empty (head)) { +list_add (&block->link, head); +return ; + } + +list_for_each_entry (node, head, link) +if (drm_buddy_block_offset (block) <drm_buddy_block_offset (node)) +break ; + +__list_add (&block->link, node->link.prev, &node->link); +} +static void mark_allocated (struct drm_buddy_block *block) { block->header &= ~DRM_BUDDY_HEADER_STATE ;
@@ -52,8 +71,7 @@ static void mark_free(struct drm_buddy * block->header &= ~DRM_BUDDY_HEADER_STATE ; block->header |=DRM_BUDDY_FREE ; -list_add (&block->link, - &mm->free_list[drm_buddy_block_order (block)]); +list_insert_sorted (mm, block); }static void mark_split (struct drm_buddy_block *block)
@@ -387,20 +405,26 @@ err_undo: }static struct drm_buddy_block * -get_maxblock (struct list_head *head) +get_maxblock (struct drm_buddy *mm,unsigned int order) {struct drm_buddy_block *max_block =NULL , *node; +unsigned int i; - max_block =list_first_entry_or_null (head, - struct drm_buddy_block, - link); -if (!max_block) -return NULL ; - -list_for_each_entry (node, head, link) { -if (drm_buddy_block_offset (node) > -drm_buddy_block_offset (max_block)) - max_block = node; +for (i = order; i <= mm->max_order; ++i) { +if (!list_empty (&mm->free_list[i])) { + node =list_last_entry (&mm->free_list[i], + struct drm_buddy_block, + link); +if (!max_block) { + max_block = node; +continue ; + } + +if (drm_buddy_block_offset (node) > +drm_buddy_block_offset (max_block)) { + max_block = node; + } + } }return max_block;
@@ -412,20 +436,23 @@ alloc_from_freelist(struct drm_buddy *mm unsigned long flags) {struct drm_buddy_block *block =NULL ; -unsigned int i; +unsigned int tmp;int err; -for (i = order; i <= mm->max_order; ++i) { -if (flags &DRM_BUDDY_TOPDOWN_ALLOCATION ) { - block =get_maxblock (&mm->free_list[i]); -if (block) -break ; - }else { - block =list_first_entry_or_null (&mm->free_list[i], - struct drm_buddy_block, - link); -if (block) -break ; +if (flags &DRM_BUDDY_TOPDOWN_ALLOCATION ) { + block =get_maxblock (mm, order); +if (block) +/* Store the obtained block order */ + tmp =drm_buddy_block_order (block); + }else { +for (tmp = order; tmp <= mm->max_order; ++tmp) { +if (!list_empty (&mm->free_list[tmp])) { + block =list_last_entry (&mm->free_list[tmp], + struct drm_buddy_block, + link); +if (block) +break ; + } } }
@@ -434,18 +461,18 @@ alloc_from_freelist(struct drm_buddy *mmBUG_ON (!drm_buddy_block_is_free (block)); -while (i != order) { +while (tmp != order) { err =split_block (mm, block);if (unlikely (err)) goto err_undo; block = block->right; - i--; + tmp--; }return block; err_undo: -if (i != order) +if (tmp != order)__drm_buddy_free (mm, block);return ERR_PTR (err); }
Greg Kroah-Hartman
maintainerPATCH 29/183 drm/i915/gt: Reset twice
In reply to Greg Kroah-HartmanFrom: Chris Wilson <[email protected]>
commit d3de5616d36462a646f5b360ba82d3b09ff668eb upstream.
After applying an engine reset, on some platforms like Jasperlake, we occasionally detect that the engine state is not cleared until shortly after the resume. As we try to resume the engine with volatile internal state, the first request fails with a spurious CS event (it looks like it reports a lite-restore to the hung context, instead of the expected idle->active context switch).
--- drivers/gpu/drm/i915/gt/intel_reset.c | 34 ++++++++++++++++++++++++++++------ 1 file changed, 28 insertions(+), 6 deletions(-)
drivers/gpu/drm/i915/gt/intel_reset.c +28 -6
@@ -278,6 +278,7 @@ out:static int gen6_hw_domain_reset (struct intel_gt *gt,u32 hw_domain_mask) {struct intel_uncore *uncore = gt->uncore; +int loops =2 ;int err;/*
@@ -285,18 +286,39 @@ static int gen6_hw_domain_reset(struct i* for fifo space for the write or forcewake the chip for * the read */ -intel_uncore_write_fw (uncore,GEN6_GDRST , hw_domain_mask); +do { +intel_uncore_write_fw (uncore,GEN6_GDRST , hw_domain_mask); -/* Wait for the device to ack the reset requests */ - err =__intel_wait_for_register_fw (uncore, -GEN6_GDRST , hw_domain_mask,0 , -500 ,0 , -NULL ); +/* +* Wait for the device to ack the reset requests. +* +* On some platforms, e.g. Jasperlake, we see that the +* engine register state is not cleared until shortly after +* GDRST reports completion, causing a failure as we try +* to immediately resume while the internal state is still +* in flux. If we immediately repeat the reset, the second +* reset appears to serialise with the first, and since +* it is a no-op, the registers should retain their reset +* value. However, there is still a concern that upon +* leaving the second reset, the internal engine state +* is still in flux and not ready for resuming. +*/ + err =__intel_wait_for_register_fw (uncore,GEN6_GDRST , + hw_domain_mask,0 , +2000 ,0 , +NULL ); + }while (err ==0 && --loops);if (err)GT_TRACE (gt,"Wait for 0x%08x engines reset failed\n" , hw_domain_mask); +/* +* As we have observed that the engine state is still volatile +* after GDRST is acked, impose a small delay to let everything settle. +*/ +udelay (50 ); +return err; }
Greg Kroah-Hartman
maintainerPATCH 30/183 drm/i915: Reserve enough fence slot for i915_vma_unbind_async
In reply to Greg Kroah-HartmanFrom: Nirmoy Das <[email protected]>
commit 476fdcdaaae7b06c780cdfc234c704107f16c529 upstream.
A nested dma_resv_reserve_fences(1) will not reserve slot from the 2nd call onwards and folowing dma_resv_add_fence() might hit the "BUG_ON(fobj->num_fences >= fobj->max_fences)" check.
I915 hit above nested dma_resv case in ttm_bo_handle_move_mem() with async unbind:
dma_resv_reserve_fences() from --> ttm_bo_handle_move_mem()
dma_resv_reserve_fences() from --> i915_vma_unbind_async()
dma_resv_add_fence() from --> i915_vma_unbind_async()dma_resv_add_fence() from -->ttm_bo_move_accel_cleanup()
Resolve this by adding an extra fence in i915_vma_unbind_async().
--- drivers/gpu/drm/i915/i915_vma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/i915/i915_vma.c +1 -1
@@ -2114,7 +2114,7 @@ int i915_vma_unbind_async(struct i915_vmif (!obj->mm.rsgt)return -EBUSY ; - err =dma_resv_reserve_fences (obj->base.resv,1 ); + err =dma_resv_reserve_fences (obj->base.resv,2 );if (err)return -EBUSY ;
Greg Kroah-Hartman
maintainerPATCH 31/183 drm/i915: Fix potential context UAFs
In reply to Greg Kroah-HartmanFrom: Rob Clark <[email protected]>
commit afce71ff6daa9c0f852df0727fe32c6fb107f0fa upstream.
gem_context_register() makes the context visible to userspace, and which point a separate thread can trigger the I915_GEM_CONTEXT_DESTROY ioctl. So we need to ensure that nothing uses the ctx ptr after this. And we need to ensure that adding the ctx to the xarray is the *last* thing that gem_context_register() does with the ctx pointer.
--- drivers/gpu/drm/i915/gem/i915_gem_context.c | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-)
drivers/gpu/drm/i915/gem/i915_gem_context.c +18 -6
@@ -1688,6 +1688,10 @@ void i915_gem_init__contexts(struct drm_init_contexts (&i915->gem.contexts); } +/* +* Note that this implicitly consumes the ctx reference, by placing +* the ctx in the context_xa. +*/ static void gem_context_register (struct i915_gem_context *ctx,struct drm_i915_file_private *fpriv,u32 id)
@@ -1703,10 +1707,6 @@ static void gem_context_register(structsnprintf (ctx->name,sizeof (ctx->name),"%s[%d]" , current->comm,pid_nr (ctx->pid)); -/* And finally expose ourselves to userspace via the idr */ - old =xa_store (&fpriv->context_xa, id, ctx,GFP_KERNEL ); -WARN_ON (old); -spin_lock (&ctx->client->ctx_lock);list_add_tail_rcu (&ctx->client_link, &ctx->client->ctx_list);spin_unlock (&ctx->client->ctx_lock);
@@ -1714,6 +1714,10 @@ static void gem_context_register(structspin_lock (&i915->gem.contexts.lock);list_add_tail (&ctx->link, &i915->gem.contexts.list);spin_unlock (&i915->gem.contexts.lock); + +/* And finally expose ourselves to userspace via the idr */ + old =xa_store (&fpriv->context_xa, id, ctx,GFP_KERNEL ); +WARN_ON (old); } int i915_gem_context_open(struct drm_i915_private *i915,
@@ -2199,14 +2203,22 @@ finalize_create_context_locked(struct drif (IS_ERR (ctx))return ctx; +/* +* One for the xarray and one for the caller. We need to grab +* the reference *prior* to making the ctx visble to userspace +* in gem_context_register(), as at any point after that +* userspace can try to race us with another thread destroying +* the context under our feet. +*/ +i915_gem_context_get (ctx); +gem_context_register (ctx, file_priv, id); old =xa_erase (&file_priv->proto_context_xa, id);GEM_BUG_ON (old != pc);proto_context_close (file_priv->dev_priv, pc); -/* One for the xarray and one for the caller */ -return i915_gem_context_get (ctx); +return ctx; } struct i915_gem_context *
Greg Kroah-Hartman
maintainerPATCH 32/183 drm/amd: Delay removal of the firmware framebuffer
In reply to Greg Kroah-HartmanFrom: Mario Limonciello <[email protected]>
commit 1923bc5a56daeeabd7e9093bad2febcd6af2416a upstream.
Removing the firmware framebuffer from the driver means that even if the driver doesn't support the IP blocks in a GPU it will no longer be functional after the driver fails to initialize.
This change will ensure that unsupported IP blocks at least cause the driver to work with the EFI framebuffer.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 8 ++++++++ drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 6 ------ 2 files changed, 8 insertions(+), 6 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +8 -0
@@ -36,6 +36,7 @@#include <generated/utsrelease.h> #include <linux/pci-p2pdma.h> +#include <drm/drm_aperture.h> #include <drm/drm_atomic_helper.h> #include <drm/drm_probe_helper.h> #include <drm/amdgpu_drm.h>
@@ -89,6 +90,8 @@ MODULE_FIRMWARE("amdgpu/navi12_gpu_info.#define AMDGPU_MAX_RETRY_LIMIT 2#define AMDGPU_RETRY_SRIOV_RESET (r) ((r) == -EBUSY || (r) == -ETIMEDOUT || (r) == -EINVAL) +static const struct drm_driver amdgpu_kms_driver; +const char *amdgpu_asic_name[] = {"TAHITI" ,"PITCAIRN" ,
@@ -3677,6 +3680,11 @@ int amdgpu_device_init(struct amdgpu_devif (r)return r; +/* Get rid of things like offb */ + r =drm_aperture_remove_conflicting_pci_framebuffers (adev->pdev, &amdgpu_kms_driver); +if (r) +return r; +/* Enable TMZ based on IP_VERSION */ amdgpu_gmc_tmz_set (adev);
drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +0 -6
@@ -23,7 +23,6 @@*/ #include <drm/amdgpu_drm.h> -#include <drm/drm_aperture.h> #include <drm/drm_drv.h> #include <drm/drm_gem.h> #include <drm/drm_vblank.h>
@@ -2123,11 +2122,6 @@ static int amdgpu_pci_probe(struct pci_d }#endif -/* Get rid of things like offb */ - ret =drm_aperture_remove_conflicting_pci_framebuffers (pdev, &amdgpu_kms_driver); -if (ret) -return ret; - adev =devm_drm_dev_alloc (&pdev->dev, &amdgpu_kms_driver,typeof (*adev), ddev);if (IS_ERR (adev))return PTR_ERR (adev);
Greg Kroah-Hartman
maintainerPATCH 33/183 drm/amdgpu: Fixed bug on error when unloading amdgpu
In reply to Greg Kroah-HartmanFrom: YiPeng Chai <[email protected]>
commit 99f1a36c90a7524972be5a028424c57fa17753ee upstream.
Fixed bug on error when unloading amdgpu.
The error message is as follows:
[ 377.706202] kernel BUG at drivers/gpu/drm/drm_buddy.c:278! [ 377.706215] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI [ 377.706222] CPU: 4 PID: 8610 Comm: modprobe Tainted: G IOE 6.0.0-thomas #1 [ 377.706231] Hardware name: ASUS System Product Name/PRIME Z390-A, BIOS 2004 11/02/2021 [ 377.706238] RIP: 0010:drm_buddy_free_block+0x26/0x30 [drm_buddy] [ 377.706264] Code: 00 00 00 90 0f 1f 44 00 00 48 8b 0e 89 c8 25 00 0c 00 00 3d 00 04 00 00 75 10 48 8b 47 18 48 d3 e0 48 01 47 28 e9 fa fe ff ff <0f> 0b 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 41 54 55 48 89 f5 53 [ 377.706282] RSP: 0018:ffffad2dc4683cb8 EFLAGS: 00010287 [ 377.706289] RAX: 0000000000000000 RBX: ffff8b1743bd5138 RCX: 0000000000000000 [ 377.706297] RDX: ffff8b1743bd5160 RSI: ffff8b1743bd5c78 RDI: ffff8b16d1b25f70 [ 377.706304] RBP: ffff8b1743bd59e0 R08: 0000000000000001 R09: 0000000000000001 [ 377.706311] R10: ffff8b16c8572400 R11: ffffad2dc4683cf0 R12: ffff8b16d1b25f70 [ 377.706318] R13: ffff8b16d1b25fd0 R14: ffff8b1743bd59c0 R15: ffff8b16d1b25f70 [ 377.706325] FS: 00007fec56c72c40(0000) GS:ffff8b1836500000(0000) knlGS:0000000000000000 [ 377.706334] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 377.706340] CR2: 00007f9b88c1ba50 CR3: 0000000110450004 CR4: 00000000003706e0 [ 377.706347] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 377.706354] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 377.706361] Call Trace: [ 377.706365] <TASK> [ 377.706369] drm_buddy_free_list+0x2a/0x60 [drm_buddy] [ 377.706376] amdgpu_vram_mgr_fini+0xea/0x180 [amdgpu] [ 377.706572] amdgpu_ttm_fini+0x12e/0x1a0 [amdgpu] [ 377.706650] amdgpu_bo_fini+0x22/0x90 [amdgpu] [ 377.706727] gmc_v11_0_sw_fini+0x26/0x30 [amdgpu] [ 377.706821] amdgpu_device_fini_sw+0xa1/0x3c0 [amdgpu] [ 377.706897] amdgpu_driver_release_kms+0x12/0x30 [amdgpu] [ 377.706975] drm_dev_release+0x20/0x40 [drm] [ 377.707006] release_nodes+0x35/0xb0 [ 377.707014] devres_release_all+0x8b/0xc0 [ 377.707020] device_unbind_cleanup+0xe/0x70 [ 377.707027] device_release_driver_internal+0xee/0x160 [ 377.707033] driver_detach+0x44/0x90 [ 377.707039] bus_remove_driver+0x55/0xe0 [ 377.707045] pci_unregister_driver+0x3b/0x90 [ 377.707052] amdgpu_exit+0x11/0x6c [amdgpu] [ 377.707194] __x64_sys_delete_module+0x142/0x2b0 [ 377.707201] ? fpregs_assert_state_consistent+0x22/0x50 [ 377.707208] ? exit_to_user_mode_prepare+0x3e/0x190 [ 377.707215] do_syscall_64+0x38/0x90 [ 377.707221] entry_SYSCALL_64_after_hwframe+0x63/0xcd
--- drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c +1 -1
@@ -882,7 +882,7 @@ void amdgpu_vram_mgr_fini(struct amdgpu_kfree (rsv);list_for_each_entry_safe (rsv, temp, &mgr->reserved_pages, blocks) { -drm_buddy_free_list (&mgr->mm, &rsv->blocks); +drm_buddy_free_list (&mgr->mm, &rsv->allocated);kfree (rsv); }drm_buddy_fini (&mgr->mm);
Greg Kroah-Hartman
maintainerPATCH 34/183 drm/amd/pm: correct the reference clock for fan speed(rpm) calculation
In reply to Greg Kroah-HartmanFrom: Evan Quan <[email protected]>
commit 6fea87637bf36bd285227f490132e83582ab7513 upstream.
Correct the reference clock as 25Mhz for SMU13 fan speed calculation.
--- drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c +2 -2
@@ -1258,7 +1258,8 @@ int smu_v13_0_set_fan_speed_rpm(struct s uint32_t speed) {struct amdgpu_device *adev = smu->adev; -uint32_t tach_period, crystal_clock_freq; +uint32_t crystal_clock_freq =2500 ; +uint32_t tach_period;int ret;if (!speed)
@@ -1268,7 +1269,6 @@ int smu_v13_0_set_fan_speed_rpm(struct sif (ret)return ret; - crystal_clock_freq =amdgpu_asic_get_xclk (adev); tach_period =60 * crystal_clock_freq *10000 / (8 * speed); WREG32_SOC15(THM, 0, regCG_TACH_CTRL, REG_SET_FIELD(RREG32_SOC15(THM, 0, regCG_TACH_CTRL),
Greg Kroah-Hartman
maintainerPATCH 35/183 drm/amd/pm: add the missing mapping for PPT feature on SMU13.0.0 and 13.0.7
In reply to Greg Kroah-HartmanFrom: Evan Quan <[email protected]>
commit 318ca20893c19ead02845a08204c3f9249bb74cd upstream.
Then we are able to set a new ppt limit via the hwmon interface(power1_cap).
--- drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 1 + drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 1 + 2 files changed, 2 insertions(+)
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c +1 -0
@@ -189,6 +189,7 @@ static struct cmn2asic_mapping smu_v13_0 FEA_MAP(SOC_PCC), [SMU_FEATURE_DPM_VCLK_BIT] = {1, FEATURE_MM_DPM_BIT}, [SMU_FEATURE_DPM_DCLK_BIT] = {1, FEATURE_MM_DPM_BIT}, + [SMU_FEATURE_PPT_BIT] = {1, FEATURE_THROTTLERS_BIT}, };static struct cmn2asic_mapping smu_v13_0_0_table_map[SMU_TABLE_COUNT ] = {
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c +1 -0
@@ -191,6 +191,7 @@ static struct cmn2asic_mapping smu_v13_0 FEA_MAP(SOC_PCC), [SMU_FEATURE_DPM_VCLK_BIT] = {1, FEATURE_MM_DPM_BIT}, [SMU_FEATURE_DPM_DCLK_BIT] = {1, FEATURE_MM_DPM_BIT}, + [SMU_FEATURE_PPT_BIT] = {1, FEATURE_THROTTLERS_BIT}, };static struct cmn2asic_mapping smu_v13_0_7_table_map[SMU_TABLE_COUNT ] = {
Greg Kroah-Hartman
maintainerPATCH 36/183 drm/amd/display: move remaining FPU code to dml folder
In reply to Greg Kroah-HartmanFrom: Ao Zhong <[email protected]>
commit 58ddbecb14c792b7fe0d92ae5e25c9179d62ff25 upstream.
pipes[pipe_cnt].pipe.src.dcc_fraction_of_zs_req_luma = 0; pipes[pipe_cnt].pipe.src.dcc_fraction_of_zs_req_chroma = 0; these two operations in dcn32/dcn32_resource.c still need to use FPU, This will cause compilation to fail on ARM64 platforms because -mgeneral-regs-only is enabled by default to disable the hardware FPU. Therefore, imitate the dcn31_zero_pipe_dcc_fraction function in dml/dcn31/dcn31_fpu.c, declare the dcn32_zero_pipe_dcc_fraction function in dcn32_fpu.c, and move above two operations into this function.
--- drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c | 5 +++-- drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 8 ++++++++ drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.h | 3 +++ 3 files changed, 14 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c +3 -2
@@ -1919,8 +1919,9 @@ int dcn32_populate_dml_pipes_from_contex timing = &pipe->stream->timing; pipes[pipe_cnt].pipe.src.gpuvm = true; - pipes[pipe_cnt].pipe.src.dcc_fraction_of_zs_req_luma =0 ; - pipes[pipe_cnt].pipe.src.dcc_fraction_of_zs_req_chroma =0 ; +DC_FP_START (); +dcn32_zero_pipe_dcc_fraction (pipes, pipe_cnt); +DC_FP_END (); pipes[pipe_cnt].pipe.dest.vfront_porch = timing->v_front_porch; pipes[pipe_cnt].pipe.src.gpuvm_min_page_size_kbytes =256 ;// according to spreadsheet pipes[pipe_cnt].pipe.src.unbounded_req_mode = false;
drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c +8 -0
@@ -2546,3 +2546,11 @@ void dcn32_update_bw_bounding_box_fpu(st } } +void dcn32_zero_pipe_dcc_fraction (display_e2e_pipe_params_st *pipes, +int pipe_cnt) +{ +dc_assert_fp_enabled (); + + pipes[pipe_cnt].pipe.src.dcc_fraction_of_zs_req_luma =0 ; + pipes[pipe_cnt].pipe.src.dcc_fraction_of_zs_req_chroma =0 ; +}
drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.h +3 -0
@@ -73,4 +73,7 @@ int dcn32_find_dummy_latency_index_for_fvoid dcn32_patch_dpm_table (struct clk_bw_params *bw_params); +void dcn32_zero_pipe_dcc_fraction (display_e2e_pipe_params_st *pipes, +int pipe_cnt); +#endif
Greg Kroah-Hartman
maintainerPATCH 37/183 Revert "drm/amdgpu: Revert "drm/amdgpu: getting fan speed pwm for vega10 properly""
In reply to Greg Kroah-HartmanFrom: Alex Deucher <[email protected]>
This reverts commit 9ccd11718d76b95c69aa773f2abedef560776037
The original commit 16fb4dca95daa ("drm/amdgpu: getting fan speed pwm for vega10 properly")
was reverted in commit 4545ae2ed3f2 ("drm/amdgpu: Revert "drm/amdgpu: getting fan speed pwm for vega10 properly""). but the test that resulted in the revert was wrong and was fixed so the
revert was reverted in commit 30b8e7b8ee3b ("Revert "drm/amdgpu: Revert "drm/amdgpu: getting fan speed pwm for vega10 properly"""). That should have been the end of it, but then Sasha picked up the
original revert again and it was committed as 9ccd11718d76. So drop
that commit so we get back to where we need to be.
--- drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_thermal.c | 25 +++++++--------- 1 file changed, 12 insertions(+), 13 deletions(-)
drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_thermal.c +12 -13
@@ -67,22 +67,21 @@ int vega10_fan_ctrl_get_fan_speed_info(sint vega10_fan_ctrl_get_fan_speed_pwm (struct pp_hwmgr *hwmgr,uint32_t *speed) { -uint32_t current_rpm; -uint32_t percent =0 ; +struct amdgpu_device *adev = hwmgr->adev; +uint32_t duty100, duty; +uint64_t tmp64; -if (hwmgr->thermal_controller.fanInfo.bNoFan) -return 0 ; + duty100 =REG_GET_FIELD (RREG32_SOC15 (THM ,0 , mmCG_FDO_CTRL1), +CG_FDO_CTRL1 ,FMAX_DUTY100 ); + duty =REG_GET_FIELD (RREG32_SOC15 (THM ,0 , mmCG_THERMAL_STATUS), +CG_THERMAL_STATUS ,FDO_PWM_DUTY ); -if (vega10_get_current_rpm (hwmgr, ¤t_rpm)) -return -1 ; +if (!duty100) +return -EINVAL ; -if (hwmgr->thermal_controller. - advanceFanControlParameters.usMaxFanRPM !=0 ) - percent = current_rpm *255 / - hwmgr->thermal_controller. - advanceFanControlParameters.usMaxFanRPM; - - *speed =MIN (percent,255 ); + tmp64 = (uint64_t )duty *255 ; +do_div (tmp64, duty100); + *speed =MIN ((uint32_t )tmp64,255 );return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 38/183 cifs: Fix uninitialized memory read for smb311 posix symlink create
In reply to Greg Kroah-HartmanFrom: Volker Lendecke <[email protected]>
commit a152d05ae4a71d802d50cf9177dba34e8bb09f68 upstream.
If smb311 posix is enabled, we send the intended mode for file creation in the posix create context. Instead of using what's there on the stack, create the mfsymlink file with 0644.
--- fs/cifs/link.c | 1 + 1 file changed, 1 insertion(+)
fs/cifs/link.c +1 -0
@@ -428,6 +428,7 @@ smb3_create_mf_symlink(unsigned int xid, oparms.disposition =FILE_CREATE ; oparms.fid = &fid; oparms.reconnect = false; + oparms.mode =0644 ; rc =SMB2_open (xid, &oparms, utf16_path, &oplock,NULL ,NULL ,NULL ,NULL );
Greg Kroah-Hartman
maintainerPATCH 39/183 cifs: fix file info setting in cifs_query_path_info()
In reply to Greg Kroah-HartmanFrom: Paulo Alcantara <[email protected]>
commit 29cf28235e3e57e0af01ae29db57a75f87a2ada8 upstream.
We missed to set file info when CIFSSMBQPathInfo() returned 0, thus leaving cifs_open_info_data::fi unset.
Fix this by setting cifs_open_info_data::fi when either CIFSSMBQPathInfo() or SMBQueryInformation() succeed.
--- fs/cifs/smb1ops.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
fs/cifs/smb1ops.c +6 -3
@@ -562,17 +562,20 @@ static int cifs_query_path_info(const unsigned int xid, struct cifs_tcon *tcon,if ((rc == -EOPNOTSUPP ) || (rc == -EINVAL )) { rc =SMBQueryInformation (xid, tcon, full_path, &fi, cifs_sb->local_nls,cifs_remap (cifs_sb)); -if (!rc) -move_cifs_info_to_smb2 (&data->fi, &fi); *adjustTZ = true; } -if (!rc && (le32_to_cpu (fi.Attributes) &ATTR_REPARSE )) { +if (!rc) {int tmprc;int oplock =0 ;struct cifs_fid fid;struct cifs_open_parms oparms; +move_cifs_info_to_smb2 (&data->fi, &fi); + +if (!(le32_to_cpu (fi.Attributes) &ATTR_REPARSE )) +return 0 ; + oparms.tcon = tcon; oparms.cifs_sb = cifs_sb; oparms.desired_access =FILE_READ_ATTRIBUTES ;
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 40/183 cifs: fix file info setting in cifs_open_file()
In reply to Greg Kroah-HartmanFrom: Paulo Alcantara <[email protected]>
commit ba5d4c1596cada37793d405dd18d695cd3508902 upstream.
In cifs_open_file(), @buf must hold a pointer to a cifs_open_info_data structure which is passed by cifs_nt_open(), so assigning @buf directly to @fi was obviously wrong.
Fix this by passing a valid FILE_ALL_INFO structure to SMBLegacyOpen() and CIFS_open(), and then copy the set structure to the corresponding cifs_open_info_data::fi field with move_cifs_info_to_smb2() helper.
--- fs/cifs/smb1ops.c | 54 ++++++++++++++++++++++++----------------------- 1 file changed, 28 insertions(+), 26 deletions(-)
fs/cifs/smb1ops.c +28 -26
@@ -719,17 +719,25 @@ cifs_mkdir_setinfo(struct inode *inode, const char *full_path,static int cifs_open_file (const unsigned int xid,struct cifs_open_parms *oparms,__u32 *oplock,void *buf) { -FILE_ALL_INFO *fi = buf; +struct cifs_open_info_data *data = buf; +FILE_ALL_INFO fi = {}; +int rc;if (!(oparms->tcon->ses->capabilities &CAP_NT_SMBS )) -return SMBLegacyOpen (xid, oparms->tcon, oparms->path, - oparms->disposition, - oparms->desired_access, - oparms->create_options, - &oparms->fid->netfid, oplock, fi, - oparms->cifs_sb->local_nls, -cifs_remap (oparms->cifs_sb)); -return CIFS_open (xid, oparms, oplock, fi); + rc =SMBLegacyOpen (xid, oparms->tcon, oparms->path, + oparms->disposition, + oparms->desired_access, + oparms->create_options, + &oparms->fid->netfid, oplock, &fi, + oparms->cifs_sb->local_nls, +cifs_remap (oparms->cifs_sb)); +else + rc =CIFS_open (xid, oparms, oplock, &fi); + +if (!rc && data) +move_cifs_info_to_smb2 (&data->fi, &fi); + +return rc; } static void
@@ -1053,7 +1061,7 @@ cifs_make_node(unsigned int xid, struct inode *inode,struct cifs_sb_info *cifs_sb =CIFS_SB (inode->i_sb);struct inode *newinode =NULL ;int rc = -EPERM ; -FILE_ALL_INFO *buf =NULL ; +struct cifs_open_info_data buf = {};struct cifs_io_parms io_parms;__u32 oplock =0 ;struct cifs_fid fid;
@@ -1085,14 +1093,14 @@ cifs_make_node(unsigned int xid, struct inode *inode, cifs_sb->local_nls, cifs_remap(cifs_sb));if (rc) - goto out; +return rc; rc =cifs_get_inode_info_unix (&newinode, full_path, inode->i_sb, xid);if (rc ==0 )d_instantiate (dentry, newinode); - goto out; +return rc; }/*
@@ -1100,19 +1108,13 @@ cifs_make_node(unsigned int xid, struct inode *inode,* support block and char device (no socket & fifo) */ if (!(cifs_sb->mnt_cifs_flags &CIFS_MOUNT_UNX_EMUL )) - goto out; +return rc;if (!S_ISCHR (mode) && !S_ISBLK (mode)) - goto out; +return rc;cifs_dbg (FYI ,"sfu compat create special file\n" ); - buf =kmalloc (sizeof (FILE_ALL_INFO ),GFP_KERNEL ); -if (buf ==NULL ) { - rc = -ENOMEM ; - goto out; - } - oparms.tcon = tcon; oparms.cifs_sb = cifs_sb; oparms.desired_access =GENERIC_WRITE ;
@@ -1127,21 +1129,21 @@ cifs_make_node(unsigned int xid, struct inode *inode, oplock =REQ_OPLOCK ; else oplock =0 ; - rc = tcon->ses->server->ops->open (xid, &oparms, &oplock, buf); + rc = tcon->ses->server->ops->open (xid, &oparms, &oplock, &buf);if (rc) - goto out; +return rc;/* * BB Do not bother to decode buf since no local inode yet to put * timestamps in, but we can reuse it safely. */ - pdev = (struct win_dev *)buf; + pdev = (struct win_dev *)&buf.fi; io_parms.pid = current->tgid; io_parms.tcon = tcon; io_parms.offset =0 ; io_parms.length =sizeof (struct win_dev ); - iov[1 ].iov_base = buf; + iov[1 ].iov_base = &buf.fi; iov[1 ].iov_len =sizeof (struct win_dev );if (S_ISCHR (mode)) {memcpy (pdev->type,"IntxCHR" ,8 );
@@ -1160,8 +1162,8 @@ cifs_make_node(unsigned int xid, struct inode *inode,d_drop (dentry);/* FIXME: add code here to set EAs */ -out: -kfree (buf); + +cifs_free_open_info (&buf);return rc; }
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 41/183 cifs: do not query ifaces on smb1 mounts
In reply to Greg Kroah-HartmanFrom: Paulo Alcantara <[email protected]>
commit 22aeb01db7080e18c6aeb4361cc2556c9887099a upstream.
Users have reported the following error on every 600 seconds (SMB_INTERFACE_POLL_INTERVAL) when mounting SMB1 shares:
CIFS: VFS: \\srv\share error -5 on ioctl to get interface list
It's supported only by SMB2+, so do not query network interfaces on SMB1 mounts.
--- fs/cifs/connect.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
fs/cifs/connect.c +6 -3
@@ -2609,11 +2609,14 @@ cifs_get_tcon(struct cifs_ses *ses, struINIT_LIST_HEAD (&tcon->pending_opens); tcon->status =TID_GOOD ; -/* schedule query interfaces poll */ INIT_DELAYED_WORK (&tcon->query_interfaces, smb2_query_server_interfaces); -queue_delayed_work (cifsiod_wq, &tcon->query_interfaces, - (SMB_INTERFACE_POLL_INTERVAL *HZ )); +if (ses->server->dialect >=SMB30_PROT_ID && + (ses->server->capabilities &SMB2_GLOBAL_CAP_MULTI_CHANNEL )) { +/* schedule query interfaces poll */ +queue_delayed_work (cifsiod_wq, &tcon->query_interfaces, + (SMB_INTERFACE_POLL_INTERVAL *HZ )); + }spin_lock (&cifs_tcp_ses_lock);list_add (&tcon->tcon_list, &ses->tcon_list);
Greg Kroah-Hartman
maintainerPATCH 42/183 cifs: fix double free on failed kerberos auth
In reply to Greg Kroah-HartmanFrom: Paulo Alcantara <[email protected]>
commit 39e8db3c860e2678ce5a7d74193925876507c9eb upstream.
If session setup failed with kerberos auth, we ended up freeing cifs_ses::auth_key.response twice in SMB2_auth_kerberos() and sesInfoFree().
Fix this by zeroing out cifs_ses::auth_key.response after freeing it in SMB2_auth_kerberos().
--- fs/cifs/smb2pdu.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/cifs/smb2pdu.c +4 -1
@@ -1479,8 +1479,11 @@ SMB2_auth_kerberos(struct SMB2_sess_data out_put_spnego_key:key_invalidate (spnego_key);key_put (spnego_key); -if (rc) +if (rc) {kfree_sensitive (ses->auth_key.response); + ses->auth_key.response =NULL ; + ses->auth_key.len =0 ; + } out: sess_data->result = rc; sess_data->func =NULL ;
Greg Kroah-Hartman
maintainerPATCH 43/183 io_uring/fdinfo: include locked hash table in fdinfo output
In reply to Greg Kroah-HartmanFrom: Jens Axboe <[email protected]>
commit ea97cbebaf861d99c3e892275147e6fca6d2c1ca upstream.
A previous commit split the hash table for polled requests into two parts, but didn't get the fdinfo output updated. This means that it's less useful for debugging, as we may think a given request is not pending poll.
Fix this up by dumping the locked hash table contents too.
--- io_uring/fdinfo.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
io_uring/fdinfo.c +10 -2
@@ -170,12 +170,11 @@ static __cold void __io_uring_show_fdinfxa_for_each (&ctx->personalities, index, cred)io_uring_show_cred (m, index, cred); } -if (has_lock) -mutex_unlock (&ctx->uring_lock);seq_puts (m,"PollList:\n" );for (i =0 ; i < (1U << ctx->cancel_table.hash_bits); i++) {struct io_hash_bucket *hb = &ctx->cancel_table.hbs[i]; +struct io_hash_bucket *hbl = &ctx->cancel_table_locked.hbs[i];struct io_kiocb *req;spin_lock (&hb->lock);
@@ -183,8 +182,17 @@ static __cold void __io_uring_show_fdinfseq_printf (m," op=%d, task_works=%d\n" , req->opcode,task_work_pending (req->task));spin_unlock (&hb->lock); + +if (!has_lock) +continue ; +hlist_for_each_entry (req, &hbl->list, hash_node) +seq_printf (m," op=%d, task_works=%d\n" , req->opcode, +task_work_pending (req->task)); } +if (has_lock) +mutex_unlock (&ctx->uring_lock); +seq_puts (m,"CqOverflowList:\n" );spin_lock (&ctx->completion_lock);list_for_each_entry (ocqe, &ctx->cq_overflow_list, list) {
Greg Kroah-Hartman
maintainerPATCH 44/183 ASoC: rt9120: Make dev PM runtime bind AsoC component PM
In reply to Greg Kroah-HartmanFrom: ChiYuan Huang <[email protected]>
commit 7161bd540eebebae2bbe8c79de25d8caf12dbf78 upstream.
RT9120 uses PM runtime autosuspend to decrease the frequently on/off spent time. This exists one case, when pcm is closed and dev PM is waiting for autosuspend time expired to enter runtime suspend state. At the mean time, system is going to enter suspend, dev PM runtime suspend won't be called. It makes the rt9120 suspend consumption current not as expected.
This patch can fix the rt9120 dev PM issue during runtime autosuspend and system suspend by binding dev PM runtime and ASoC component PM.
--- sound/soc/codecs/rt9120.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
sound/soc/codecs/rt9120.c +12 -0
@@ -177,8 +177,20 @@ static int rt9120_codec_probe(struct snd_soc_component *comp)return 0 ; } +static int rt9120_codec_suspend (struct snd_soc_component *comp) +{ +return pm_runtime_force_suspend (comp->dev); +} + +static int rt9120_codec_resume (struct snd_soc_component *comp) +{ +return pm_runtime_force_resume (comp->dev); +} +static const struct snd_soc_component_driver rt9120_component_driver = { .probe = rt9120_codec_probe, + .suspend = rt9120_codec_suspend, + .resume = rt9120_codec_resume, .controls = rt9120_snd_controls, .num_controls =ARRAY_SIZE (rt9120_snd_controls), .dapm_widgets = rt9120_dapm_widgets,
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 45/183 ACPI: video: Allow selecting NVidia-WMI-EC or Apple GMUX backlight from the cmdline
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit 420a1116aef0e8e12c305508f45ce73e5ae30a09 upstream.
The patches adding NVidia-WMI-EC and Apple GMUX backlight detection support to acpi_video_get_backlight_type(), forgot to update acpi_video_parse_cmdline() to allow manually selecting these from the commandline.
Add support for these to acpi_video_parse_cmdline().
--- drivers/acpi/video_detect.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/acpi/video_detect.c +4 -0
@@ -50,6 +50,10 @@ static void acpi_video_parse_cmdline(void) acpi_backlight_cmdline = acpi_backlight_video;if (!strcmp ("native" , acpi_video_backlight_string)) acpi_backlight_cmdline = acpi_backlight_native; +if (!strcmp ("nvidia_wmi_ec" , acpi_video_backlight_string)) + acpi_backlight_cmdline = acpi_backlight_nvidia_wmi_ec; +if (!strcmp ("apple_gmux" , acpi_video_backlight_string)) + acpi_backlight_cmdline = acpi_backlight_apple_gmux;if (!strcmp ("none" , acpi_video_backlight_string)) acpi_backlight_cmdline = acpi_backlight_none; }
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 46/183 platform/x86: dell-privacy: Only register SW_CAMERA_LENS_COVER if present
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit 6dc485f9940df8105ea729cbeb7a7d18d409dde5 upstream.
Unlike keys where userspace only reacts to keypresses, userspace may act on switches in both (0 and 1) of their positions.
For example if a SW_TABLET_MODE switch is registered then GNOME will not automatically show the onscreen keyboard when a text field gets focus on touchscreen devices when SW_TABLET_MODE reports 0 and when SW_TABLET_MODE reports 1 libinput will block (filter out) builtin keyboard and touchpad events.
So to avoid unwanted side-effects EV_SW type inputs should only be registered if they are actually present, only register SW_CAMERA_LENS_COVER if it is actually there.
--- drivers/platform/x86/dell/dell-wmi-privacy.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-)
drivers/platform/x86/dell/dell-wmi-privacy.c +15 -4
@@ -292,7 +292,7 @@ static int dell_privacy_wmi_probe(struct {struct privacy_wmi_data *priv;struct key_entry *keymap; -int ret, i; +int ret, i, j; ret =wmi_has_guid (DELL_PRIVACY_GUID );if (!ret)
@@ -318,9 +318,20 @@ static int dell_privacy_wmi_probe(struct/* remap the keymap code with Dell privacy key type 0x12 as prefix * KEY_MICMUTE scancode will be reported as 0x120001 */ -for (i =0 ; i <ARRAY_SIZE (dell_wmi_keymap_type_0012); i++) { - keymap[i] = dell_wmi_keymap_type_0012[i]; - keymap[i].code |= (0x0012 <<16 ); +for (i =0 , j =0 ; i <ARRAY_SIZE (dell_wmi_keymap_type_0012); i++) { +/* +* Unlike keys where only presses matter, userspace may act +* on switches in both of their positions. Only register +* SW_CAMERA_LENS_COVER if it is actually there. +*/ +if (dell_wmi_keymap_type_0012[i].type ==KE_VSW && + dell_wmi_keymap_type_0012[i].sw.code ==SW_CAMERA_LENS_COVER && + !(priv->features_present &BIT (DELL_PRIVACY_TYPE_CAMERA ))) +continue ; + + keymap[j] = dell_wmi_keymap_type_0012[i]; + keymap[j].code |= (0x0012 <<16 ); + j++; } ret =sparse_keymap_setup (priv->input_dev, keymap,NULL );kfree (keymap);
Greg Kroah-Hartman
maintainerPATCH 47/183 platform/surface: aggregator: Ignore command messages not intended for us
In reply to Greg Kroah-HartmanFrom: Maximilian Luz <[email protected]>
commit ae0fa0a3126a86c801c3220fcd8eefe03aa39f3e upstream.
It is possible that we (the host/kernel driver) receive command messages that are not intended for us. Ignore those for now.
The whole story is a bit more complicated: It is possible to enable debug output on SAM, which is sent via SSH command messages. By default this output is sent to a debug connector, with its own target ID (TID=0x03). It is possible to override the target of the debug output and set it to the host/kernel driver. This, however, does not change the original target ID of the message. Meaning, we receive messages with TID=0x03 (debug) but expect to only receive messages with TID=0x00 (host).
The problem is that the different target ID also comes with a different scope of request IDs. In particular, these do not follow the standard event rules (i.e. do not fall into a set of small reserved values). Therefore, current message handling interprets them as responses to pending requests and tries to match them up via the request ID. However, these debug output messages are not in fact responses, and therefore this will at best fail to find the request and at worst pass on the wrong data as response for a request.
Therefore ignore any command messages not intended for us (host) for now. We can implement support for the debug messages once we have a better understanding of them.
Note that this may also provide a bit more stability and avoid some driver confusion in case any other targets want to talk to us in the future, since we don't yet know what to do with those as well. A warning for the dropped messages should suffice for now and also give us a chance of discovering new targets if they come along without any potential for bugs/instabilities.
--- drivers/platform/surface/aggregator/ssh_request_layer.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/platform/surface/aggregator/ssh_request_layer.c +14 -0
@@ -916,6 +916,20 @@ static void ssh_rtl_rx_command(struct ssif (sshp_parse_command (dev, data, &command, &command_data))return ; +/* +* Check if the message was intended for us. If not, drop it. +* +* Note: We will need to change this to handle debug messages. On newer +* generation devices, these seem to be sent to tid_out=0x03. We as +* host can still receive them as they can be forwarded via an override +* option on SAM, but doing so does not change tid_out=0x00. +*/ +if (command->tid_out !=0x00 ) { +rtl_warn (rtl,"rtl: dropping message not intended for us (tid = %#04x)\n" , + command->tid_out); +return ; + } +if (ssh_rqid_is_event (get_unaligned_le16 (&command->rqid)))ssh_rtl_rx_event (rtl, command, &command_data);else
Greg Kroah-Hartman
maintainerPATCH 48/183 platform/x86: int3472/discrete: Ensure the clk/power enable pins are in output mode
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit cf5ac2d45f6e4d11ad78e7b10ae9a4121ba5e995 upstream.
acpi_get_and_request_gpiod() does not take a gpio_lookup_flags argument specifying that the pins direction should be initialized to a specific value.
This means that in some cases the pins might be left in input mode, causing the gpiod_set() calls made to enable the clk / regulator to not work.
One example of this problem is the clk-enable GPIO for the ov01a1s sensor on a Dell Latitude 9420 being left in input mode causing the clk to never get enabled.
Explicitly set the direction of the pins to output to fix this.
--- drivers/platform/x86/intel/int3472/clk_and_regulator.c | 3 +++ drivers/platform/x86/intel/int3472/discrete.c | 4 ++++ 2 files changed, 7 insertions(+)
drivers/platform/x86/intel/int3472/clk_and_regulator.c +3 -0
@@ -181,6 +181,9 @@ int skl_int3472_register_regulator(strucreturn PTR_ERR (int3472->regulator.gpio); } +/* Ensure the pin is in output mode and non-active state */ +gpiod_direction_output (int3472->regulator.gpio,0 ); + cfg.dev = &int3472->adev->dev; cfg.init_data = &init_data; cfg.ena_gpiod = int3472->regulator.gpio;
drivers/platform/x86/intel/int3472/discrete.c +4 -0
@@ -168,6 +168,8 @@ static int skl_int3472_map_gpio_to_clk(sreturn (PTR_ERR (gpio)); int3472->clock.ena_gpio = gpio; +/* Ensure the pin is in output mode and non-active state */ +gpiod_direction_output (int3472->clock.ena_gpio,0 );break ;case INT3472_GPIO_TYPE_PRIVACY_LED : gpio =acpi_get_and_request_gpiod (path, pin,"int3472,privacy-led" );
@@ -175,6 +177,8 @@ static int skl_int3472_map_gpio_to_clk(sreturn (PTR_ERR (gpio)); int3472->clock.led_gpio = gpio; +/* Ensure the pin is in output mode and non-active state */ +gpiod_direction_output (int3472->clock.led_gpio,0 );break ;default :dev_err (int3472->dev,"Invalid GPIO type 0x%02x for clock\n" , type);
Greg Kroah-Hartman
maintainerPATCH 49/183 platform/x86: thinkpad_acpi: Fix profile mode display in AMT mode
In reply to Greg Kroah-HartmanFrom: Mark Pearson <[email protected]>
commit fde5f74ccfc771941b018b5415fa9664426e10ad upstream.
Recently AMT mode was enabled (somewhat unexpectedly) on the Lenovo Z13 platform. The FW is advertising it is available and the driver tries to use it - unfortunately it reports the profile mode incorrectly.
Note, there is also some extra work needed to enable the dynamic aspect of AMT support that I will be following up with; but more testing is needed first. This patch just fixes things so the profiles are reported correctly.
--- drivers/platform/x86/thinkpad_acpi.c | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-)
drivers/platform/x86/thinkpad_acpi.c +17 -6
@@ -10315,9 +10315,11 @@ static DEFINE_MUTEX(dytc_mutex);static int dytc_capabilities;static bool dytc_mmc_get_available; -static int convert_dytc_to_profile (int dytcmode,enum platform_profile_option *profile) +static int convert_dytc_to_profile (int funcmode,int dytcmode, +enum platform_profile_option *profile) { -if (dytc_capabilities &BIT (DYTC_FC_MMC )) { +switch (funcmode) { +case DYTC_FUNCTION_MMC :switch (dytcmode) {case DYTC_MODE_MMC_LOWPOWER : *profile =PLATFORM_PROFILE_LOW_POWER ;
@@ -10333,8 +10335,7 @@ static int convert_dytc_to_profile(int dreturn -EINVAL ; }return 0 ; - } -if (dytc_capabilities &BIT (DYTC_FC_PSC )) { +case DYTC_FUNCTION_PSC :switch (dytcmode) {case DYTC_MODE_PSC_LOWPOWER : *profile =PLATFORM_PROFILE_LOW_POWER ;
@@ -10348,6 +10349,14 @@ static int convert_dytc_to_profile(int ddefault :/* Unknown mode */ return -EINVAL ; } +return 0 ; +case DYTC_FUNCTION_AMT : +/* For now return balanced. It's the closest we have to 'auto' */ + *profile =PLATFORM_PROFILE_BALANCED ; +return 0 ; +default : +/* Unknown function */ +return -EOPNOTSUPP ; }return 0 ; }
@@ -10496,6 +10505,7 @@ static int dytc_profile_set(struct platf err =dytc_command (DYTC_SET_COMMAND (DYTC_FUNCTION_PSC , perfmode,1 ), &output);if (err) goto unlock; +/* system supports AMT, activate it when on balanced */ if (dytc_capabilities &BIT (DYTC_FC_AMT ))dytc_control_amt (profile ==PLATFORM_PROFILE_BALANCED );
@@ -10511,7 +10521,7 @@ static void dytc_profile_refresh(void) {enum platform_profile_option profile;int output, err =0 ; -int perfmode; +int perfmode, funcmode;mutex_lock (&dytc_mutex);if (dytc_capabilities &BIT (DYTC_FC_MMC )) {
@@ -10526,8 +10536,9 @@ static void dytc_profile_refresh(void)if (err)return ; + funcmode = (output >>DYTC_GET_FUNCTION_BIT ) &0xF ; perfmode = (output >>DYTC_GET_MODE_BIT ) &0xF ; -convert_dytc_to_profile (perfmode, &profile); +convert_dytc_to_profile (funcmode, perfmode, &profile);if (profile != dytc_current_profile) { dytc_current_profile = profile;platform_profile_notify ();
Greg Kroah-Hartman
maintainerPATCH 50/183 platform/x86: asus-wmi: Dont load fan curves without fan
In reply to Greg Kroah-HartmanFrom: Thomas Weißschuh <[email protected]>
commit 01fd7e7851ba2275662f771ee17d1f80e7bbfa52 upstream.
If we do not have a fan it does not make sense to load curves for it. This removes the following warnings from the kernel log:
asus_wmi: fan_curve_get_factory_default (0x00110024) failed: -19asus_wmi: fan_curve_get_factory_default (0x00110025) failed: -19
--- drivers/platform/x86/asus-wmi.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/platform/x86/asus-wmi.c +3 -0
@@ -2436,6 +2436,9 @@ static int fan_curve_check_present(struc *available = false; +if (asus->fan_type ==FAN_TYPE_NONE ) +return 0 ; + err =fan_curve_get_factory_default (asus, fan_dev);if (err) {return 0 ;
Greg Kroah-Hartman
maintainerPATCH 51/183 platform/x86: dell-privacy: Fix SW_CAMERA_LENS_COVER reporting
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit 1af7fef0d9d3fa075bf4e850f705df1fe97d33ce upstream.
Use KE_VSW instead of KE_SW for the SW_CAMERA_LENS_COVER key_entry and get the value of the switch from the status field when handling SW_CAMERA_LENS_COVER events, instead of always reporting 0.
Also correctly set the initial SW_CAMERA_LENS_COVER value.
--- drivers/platform/x86/dell/dell-wmi-privacy.c | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-)
drivers/platform/x86/dell/dell-wmi-privacy.c +16 -6
@@ -61,7 +61,7 @@ static const struct key_entry dell_wmi_k/* privacy mic mute */ { KE_KEY, 0x0001, { KEY_MICMUTE } },/* privacy camera mute */ - { KE_SW, 0x0002, { SW_CAMERA_LENS_COVER } }, + { KE_VSW, 0x0002, { SW_CAMERA_LENS_COVER } }, { KE_END, 0}, };
@@ -115,11 +115,15 @@ bool dell_privacy_process_event(int typeswitch (code) {case DELL_PRIVACY_AUDIO_EVENT :/* Mic mute */ -case DELL_PRIVACY_CAMERA_EVENT :/* Camera mute */ priv->last_status = status;sparse_keymap_report_entry (priv->input_dev, key,1 , true); ret = true;break ; +case DELL_PRIVACY_CAMERA_EVENT :/* Camera mute */ + priv->last_status = status; +sparse_keymap_report_entry (priv->input_dev, key, !(status &CAMERA_STATUS ), false); + ret = true; +break ;default :dev_dbg (&priv->wdev->dev,"unknown event type 0x%04x 0x%04x\n" , type, code); }
@@ -304,6 +308,11 @@ static int dell_privacy_wmi_probe(structdev_set_drvdata (&wdev->dev, priv); priv->wdev = wdev; + + ret =get_current_status (priv->wdev); +if (ret) +return ret; +/* create evdev passing interface */ priv->input_dev =devm_input_allocate_device (&wdev->dev);if (!priv->input_dev)
@@ -342,11 +351,12 @@ static int dell_privacy_wmi_probe(struct priv->input_dev->name ="Dell Privacy Driver" ; priv->input_dev->id.bustype =BUS_HOST ; - ret =input_register_device (priv->input_dev); -if (ret) -return ret; +/* Report initial camera-cover status */ +if (priv->features_present &BIT (DELL_PRIVACY_TYPE_CAMERA )) +input_report_switch (priv->input_dev,SW_CAMERA_LENS_COVER , + !(priv->last_status &CAMERA_STATUS )); - ret =get_current_status (priv->wdev); + ret =input_register_device (priv->input_dev);if (ret)return ret;
Greg Kroah-Hartman
maintainerPATCH 52/183 dt-bindings: msm: dsi-controller-main: Fix operating-points-v2 constraint
In reply to Greg Kroah-HartmanFrom: Bryan O'Donoghue <[email protected]>
commit cdf64343f91a1225e9e3d4ce4261962cd41b4ddd upstream.
The existing msm8916.dtsi does not depend on nor require operating points.
Patchwork: https://patchwork.freedesktop.org/patch/515940/
--- Documentation/devicetree/bindings/display/msm/dsi-controller-main.yaml | 1 - 1 file changed, 1 deletion(-)
Documentation/devicetree/bindings/display/msm/dsi-controller-main.yaml +0 -1
@@ -135,7 +135,6 @@ required: - assigned-clocks - assigned-clock-parents - power-domains - - operating-points-v2 - ports additionalProperties: false
Greg Kroah-Hartman
maintainerPATCH 53/183 drm/msm: another fix for the headless Adreno GPU
In reply to Greg Kroah-HartmanFrom: Dmitry Baryshkov <[email protected]>
commit 00dd060ab3cf95ca6ede7853bc14397014971b5e upstream.
Fix another oops reproducible when rebooting the board with the Adreno GPU working in the headless mode (e.g. iMX platforms).
Unable to handle kernel NULL pointer dereference at virtual address 00000000 when read [00000000] *pgd=74936831, *pte=00000000, *ppte=00000000 Internal error: Oops: 17 [#1] ARM CPU: 0 PID: 51 Comm: reboot Not tainted 6.2.0-rc1-dirty #11 Hardware name: Freescale i.MX53 (Device Tree Support) PC is at msm_atomic_commit_tail+0x50/0x970 LR is at commit_tail+0x9c/0x188 pc : [<c06aa430>] lr : [<c067a214>] psr: 600e0013
sp : e0851d30 ip : ee4eb7eb fp : 00090acc
r10: 00000058 r9 : c2193014 r8 : c4310000
r7 : c4759380 r6 : 07bef61d r5 : 00000000 r4 : 00000000
r3 : c44cc440 r2 : 00000000 r1 : 00000000 r0 : 00000000
Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none
Control: 10c5387d Table: 74910019 DAC: 00000051
Register r0 information: NULL pointer
Register r1 information: NULL pointer
Register r2 information: NULL pointer
Register r3 information: slab kmalloc-1k start c44cc400 pointer offset 64 size 1024 Register r4 information: NULL pointer
Register r5 information: NULL pointer
Register r6 information: non-paged memory
Register r7 information: slab kmalloc-128 start c4759380 pointer offset 0 size 128 Register r8 information: slab kmalloc-2k start c4310000 pointer offset 0 size 2048 Register r9 information: non-slab/vmalloc memory
Register r10 information: non-paged memory
Register r11 information: non-paged memory
Register r12 information: non-paged memory
Process reboot (pid: 51, stack limit = 0xc80046d9)
Stack: (0xe0851d30 to 0xe0852000)
1d20: c4759380 fbd77200 000005ff 002b9c70
1d40: c4759380 c4759380 00000000 07bef61d 00000600 c0d6fe7c c2193014 00000058 1d60: 00090acc c067a214 00000000 c4759380 c4310000 00000000 c44cc854 c067a89c 1d80: 00000000 00000000 00000000 c4310468 00000000 c4759380 c4310000 c4310468 1da0: c4310470 c0643258 c4759380 00000000 00000000 c0c4ee24 00000000 c44cc810 1dc0: 00000000 c0c4ee24 00000000 c44cc810 00000000 0347d2a8 e0851e00 e0851e00 1de0: c4759380 c067ad20 c4310000 00000000 c44cc810 c27f8718 c44cc854 c067adb8 1e00: c4933000 00000002 00000001 00000000 00000000 c2130850 00000000 c2130854 1e20: c25fc488 00000000 c0ff162c 00000000 00000001 00000002 00000000 00000000 1e40: c43102c0 c43102c0 00000000 0347d2a8 c44cc810 c44cc814 c2133da8 c06d1a60 1e60: 00000000 00000000 00079028 c2012f24 fee1dead c4933000 00000058 c01431e4 1e80: 01234567 c0143a20 00000000 00000000 00000000 00000000 00000000 00000000 1ea0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 1ec0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 1ee0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 1f00: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 1f20: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 1f40: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 1f60: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 1f80: 00000000 00000000 00000000 0347d2a8 00000002 00000004 00000078 00000058 1fa0: c010028c c0100060 00000002 00000004 fee1dead 28121969 01234567 00079028 1fc0: 00000002 00000004 00000078 00000058 0002fdc5 00000000 00000000 00090acc 1fe0: 00000058 becc9c64 b6e97e05 b6e0e5f6 600e0030 fee1dead 00000000 00000000
msm_atomic_commit_tail from commit_tail+0x9c/0x188
commit_tail from drm_atomic_helper_commit+0x160/0x188 drm_atomic_helper_commit from drm_atomic_commit+0xac/0xe0 drm_atomic_commit from drm_atomic_helper_disable_all+0x1b0/0x1c0 drm_atomic_helper_disable_all from drm_atomic_helper_shutdown+0x88/0x140 drm_atomic_helper_shutdown from device_shutdown+0x16c/0x240 device_shutdown from kernel_restart+0x38/0x90
kernel_restart from __do_sys_reboot+0x174/0x224
__do_sys_reboot from ret_fast_syscall+0x0/0x1c
Exception stack(0xe0851fa8 to 0xe0851ff0) 1fa0: 00000002 00000004 fee1dead 28121969 01234567 00079028 1fc0: 00000002 00000004 00000078 00000058 0002fdc5 00000000 00000000 00090acc 1fe0: 00000058 becc9c64 b6e97e05 b6e0e5f6 Code: 15922088 1184421c e1500003 1afffff8 (e5953000) ---[ end trace 0000000000000000 ]---
Patchwork: https://patchwork.freedesktop.org/patch/516909/
--- drivers/gpu/drm/msm/msm_drv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/msm/msm_drv.c +1 -1
@@ -1271,7 +1271,7 @@ void msm_drv_shutdown(struct platform_de* msm_drm_init, drm_dev->registered is used as an indicator that the * shutdown will be successful. */ -if (drm && drm->registered) +if (drm && drm->registered && priv->kms)drm_atomic_helper_shutdown (drm); }
Greg Kroah-Hartman
maintainerPATCH 54/183 firmware/psci: Fix MEM_PROTECT_RANGE function numbers
In reply to Greg Kroah-HartmanFrom: Will Deacon <[email protected]>
commit f3dc61cde80d48751999c4cb46daf3b2185e6895 upstream.
PSCI v1.1 offers 32-bit and 64-bit variants of the MEM_PROTECT_RANGE call using function identifier 20.
Fix the incorrect definitions of the MEM_PROTECT_CHECK_RANGE calls in the PSCI UAPI header.
--- include/uapi/linux/psci.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/uapi/linux/psci.h +2 -2
@@ -58,7 +58,7 @@#define PSCI_1_1_FN_SYSTEM_RESET2 PSCI_0_2_FN(18)#define PSCI_1_1_FN_MEM_PROTECT PSCI_0_2_FN(19) -#define PSCI_1_1_FN_MEM_PROTECT_CHECK_RANGE PSCI_0_2_FN(19) +#define PSCI_1_1_FN_MEM_PROTECT_CHECK_RANGE PSCI_0_2_FN(20)#define PSCI_1_0_FN64_CPU_DEFAULT_SUSPEND PSCI_0_2_FN64(12)#define PSCI_1_0_FN64_NODE_HW_STATE PSCI_0_2_FN64(13)
@@ -67,7 +67,7 @@#define PSCI_1_0_FN64_STAT_COUNT PSCI_0_2_FN64(17)#define PSCI_1_1_FN64_SYSTEM_RESET2 PSCI_0_2_FN64(18) -#define PSCI_1_1_FN64_MEM_PROTECT_CHECK_RANGE PSCI_0_2_FN64(19) +#define PSCI_1_1_FN64_MEM_PROTECT_CHECK_RANGE PSCI_0_2_FN64(20)/* PSCI v0.2 power state encoding for CPU_SUSPEND function */ #define PSCI_0_2_POWER_STATE_ID_MASK 0xffff
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 55/183 firmware/psci: Dont register with debugfs if PSCI isnt available
In reply to Greg Kroah-HartmanFrom: Marc Zyngier <[email protected]>
commit cef139299fd86098c6e3dbd389d1d0b2462d7710 upstream.
Contrary to popular belief, PSCI is not a universal property of an ARM/arm64 system. There is a garden variety of systems out there that don't (or even cannot) implement it.
I'm the first one deplore such a situation, but hey...
On such systems, a "cat /sys/kernel/debug/psci" results in fireworks, as no invocation callback is registered.
Check for the invoke_psci_fn and psci_ops.get_version pointers before registering with the debugfs subsystem, avoiding the issue altogether.
--- drivers/firmware/psci/psci.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/firmware/psci/psci.c +3 -0
@@ -440,6 +440,9 @@ static const struct file_operations psci_debugfs_ops = {static int __init psci_debugfs_init (void ) { +if (!invoke_psci_fn || !psci_ops.get_version) +return 0 ; +return PTR_ERR_OR_ZERO (debugfs_create_file ("psci" ,0444 ,NULL ,NULL , &psci_debugfs_ops)); }
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 56/183 drm/msm/adreno: Make adreno quirks not overwrite each other
In reply to Greg Kroah-HartmanFrom: Konrad Dybcio <[email protected]>
commit 13ef096e342b00e30b95a90c6c13eee1f0bec4c5 upstream.
So far the adreno quirks have all been assigned with an OR operator, which is problematic, because they were assigned consecutive integer values, which makes checking them with an AND operator kind of no bueno..
Switch to using BIT(n) so that only the quirks that the programmer chose are taken into account when evaluating info->quirks & ADRENO_QUIRK_...
Patchwork: https://patchwork.freedesktop.org/patch/516456/
--- drivers/gpu/drm/msm/adreno/adreno_gpu.h | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
drivers/gpu/drm/msm/adreno/adreno_gpu.h +4 -6
@@ -29,11 +29,9 @@ enum { ADRENO_FW_MAX, }; -enum adreno_quirks { -ADRENO_QUIRK_TWO_PASS_USE_WFI =1 , -ADRENO_QUIRK_FAULT_DETECT_MASK =2 , -ADRENO_QUIRK_LMLOADKILL_DISABLE =3 , -}; +#define ADRENO_QUIRK_TWO_PASS_USE_WFI BIT(0) +#define ADRENO_QUIRK_FAULT_DETECT_MASK BIT(1) +#define ADRENO_QUIRK_LMLOADKILL_DISABLE BIT(2)struct adreno_rev {uint8_t core;
@@ -65,7 +63,7 @@ struct adreno_info {const char *name;const char *fw[ADRENO_FW_MAX ];uint32_t gmem; -enum adreno_quirks quirks; +u64 quirks;struct msm_gpu *(*init)(struct drm_device *dev);const char *zapfw;u32 inactive_period;
Greg Kroah-Hartman
maintainerPATCH 57/183 arm64/signal: Always allocate SVE signal frames on SME only systems
In reply to Greg Kroah-HartmanFrom: Mark Brown <[email protected]>
commit f26cd7372160da2eba31061d7943348ab9f2c01d upstream.
Currently we only allocate space for SVE signal frames on systems that support SVE, meaning that SME only systems do not allocate a signal frame for streaming mode SVE state. Change the check so space is allocated if either feature is supported.
--- arch/arm64/kernel/signal.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/kernel/signal.c +1 -1
@@ -729,7 +729,7 @@ static int setup_sigframe_layout(structreturn err; } -if (system_supports_sve ()) { +if (system_supports_sve () ||system_supports_sme ()) {unsigned int vq =0 ; if (add_all || test_thread_flag(TIF_SVE) ||
Greg Kroah-Hartman
maintainerPATCH 58/183 dt-bindings: msm: dsi-controller-main: Fix power-domain constraint
In reply to Greg Kroah-HartmanFrom: Bryan O'Donoghue <[email protected]>
commit a6f033938beb31f893302a93f83ec0b6460c6cac upstream.
power-domain is required for the sc7180 dispcc GDSC but not every qcom SoC has a similar dependency for example the apq8064.
Most Qcom SoC's using mdss-dsi-ctrl seem to have the ability to power-collapse the MDP without collapsing DSI.
For example the qcom vendor kernel commit for apq8084, msm8226, msm8916, msm8974.
"ARM: dts: msm: add mdss gdsc supply to dsi controller device
It is possible for the DSI controller to be active when MDP is power collapsed. DSI controller needs to have it's own vote for mdss gdsc to ensure that gdsc remains on in such cases."
This however doesn't appear to be the case for the apq8064 so we shouldn't be marking power-domain as required in yaml checks.
Patchwork: https://patchwork.freedesktop.org/patch/515958/
--- Documentation/devicetree/bindings/display/msm/dsi-controller-main.yaml | 1 - 1 file changed, 1 deletion(-)
Documentation/devicetree/bindings/display/msm/dsi-controller-main.yaml +0 -1
@@ -134,7 +134,6 @@ required: - phy-names - assigned-clocks - assigned-clock-parents - - power-domains - ports additionalProperties: false
Greg Kroah-Hartman
maintainerPATCH 59/183 dt-bindings: msm: dsi-controller-main: Fix description of core clock
In reply to Greg Kroah-HartmanFrom: Bryan O'Donoghue <[email protected]>
commit 654ffe4b793b42ed6b5909daff0b91809916d94e upstream.
There's a typo in describing the core clock as an 'escape' clock. The accurate description is 'core'.
Patchwork: https://patchwork.freedesktop.org/patch/515938/
--- Documentation/devicetree/bindings/display/msm/dsi-controller-main.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Documentation/devicetree/bindings/display/msm/dsi-controller-main.yaml +1 -1
@@ -32,7 +32,7 @@ properties: - description: Display byte clock - description: Display byte interface clock - description: Display pixel clock - - description: Display escape clock + - description: Display core clock - description: Display AHB clock - description: Display AXI clock
Greg Kroah-Hartman
maintainerPATCH 60/183 arm64/signal: Always accept SVE signal frames on SME only systems
In reply to Greg Kroah-HartmanFrom: Mark Brown <[email protected]>
commit 7dde62f0687c8856b6c0660066c7ee83a6a6f033 upstream.
Currently we reject an attempt to restore a SVE signal frame on a system with SME but not SVE supported. This means that it is not possible to disable streaming mode via signal return as this is configured via the flags in the SVE signal context. Instead accept the signal frame, we will require it to have a vector length of 0 specified and no payload since the task will have no SVE vector length configured.
--- arch/arm64/kernel/signal.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
arch/arm64/kernel/signal.c +6 -1
@@ -280,7 +280,12 @@ static int restore_sve_fpsimd_context(st vl =task_get_sme_vl (current); }else { -if (!system_supports_sve ()) +/* +* A SME only system use SVE for streaming mode so can +* have a SVE formatted context with a zero VL and no +* payload data. +*/ +if (!system_supports_sve () && !system_supports_sme ())return -EINVAL ; vl =task_get_sve_vl (current);
Greg Kroah-Hartman
maintainerPATCH 61/183 arm64/mm: add pud_user_exec() check in pud_user_accessible_page()
In reply to Greg Kroah-HartmanFrom: Liu Shixin <[email protected]>
commit 730a11f982e61aaef758ab552dfb7c30de79e99b upstream.
Add check for the executable case in pud_user_accessible_page() too like what we did for pte and pmd.
--- arch/arm64/include/asm/pgtable.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/include/asm/pgtable.h +2 -2
@@ -682,7 +682,7 @@ static inline unsigned long pmd_page_vad#define pud_leaf (pud) (pud_present(pud) && !pud_table(pud))#define pud_valid (pud) pte_valid(pud_pte(pud))#define pud_user (pud) pte_user(pud_pte(pud)) - +#define pud_user_exec (pud) pte_user_exec(pud_pte(pud))static inline void set_pud (pud_t *pudp,pud_t pud) {
@@ -868,7 +868,7 @@ static inline bool pmd_user_accessible_pstatic inline bool pud_user_accessible_page (pud_t pud) { -return pud_leaf (pud) &&pud_user (pud); +return pud_leaf (pud) && (pud_user (pud) ||pud_user_exec (pud)); }#endif
Greg Kroah-Hartman
maintainerPATCH 62/183 dt-bindings: msm: dsi-phy-28nm: Add missing qcom, dsi-phy-regulator-ldo-mode
In reply to Greg Kroah-HartmanFrom: Bryan O'Donoghue <[email protected]>
commit be79f805a1e1b95605c825f1c513bdd2c8b167ed upstream.
Add in missing qcom,dsi-phy-regulator-ldo-mode to the 28nm DSI PHY. When converting from .txt to .yaml we missed this one.
Patchwork: https://patchwork.freedesktop.org/patch/516205/
--- Documentation/devicetree/bindings/display/msm/dsi-phy-28nm.yaml | 4 ++++ 1 file changed, 4 insertions(+)
Documentation/devicetree/bindings/display/msm/dsi-phy-28nm.yaml +4 -0
@@ -34,6 +34,10 @@ properties: vddio-supply: description: Phandle to vdd-io regulator device node. + qcom,dsi-phy-regulator-ldo-mode: + type: boolean + description: Indicates if the LDO mode PHY regulator is wanted. + required: - compatible - reg
Greg Kroah-Hartman
maintainerPATCH 63/183 arm64: ptrace: Use ARM64_SME to guard the SME register enumerations
In reply to Greg Kroah-HartmanFrom: Zenghui Yu <[email protected]>
commit eb9a85261e297292c4cc44b628c1373c996cedc2 upstream.
We currently guard REGSET_{SSVE, ZA} using ARM64_SVE for no good reason. Both enumerations would be pointless without ARM64_SME and create two empty entries in aarch64_regsets[] which would then become part of a process's native regset view (they should be ignored though).
Switch to use ARM64_SME instead.
--- arch/arm64/kernel/ptrace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/kernel/ptrace.c +1 -1
@@ -1364,7 +1364,7 @@ enum aarch64_regset {#ifdef CONFIG_ARM64_SVE REGSET_SVE,#endif -#ifdef CONFIG_ARM64_SVE +#ifdef CONFIG_ARM64_SME REGSET_SSVE, REGSET_ZA,#endif
Greg Kroah-Hartman
maintainerPATCH 64/183 arm64/mm: fix incorrect file_map_count for invalid pmd
In reply to Greg Kroah-HartmanFrom: Liu Shixin <[email protected]>
commit 74c2f81054510d45b813548cb0a1c4ebf87cdd5f upstream.
The page table check trigger BUG_ON() unexpectedly when split hugepage:
------------[ cut here ]------------
kernel BUG at mm/page_table_check.c:119!
Internal error: Oops - BUG: 00000000f2000800 [#1] SMP
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in:
CPU: 7 PID: 210 Comm: transhuge-stres Not tainted 6.1.0-rc3+ #748
Hardware name: linux,dummy-virt (DT)
pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : page_table_check_set.isra.0+0x398/0x468
lr : page_table_check_set.isra.0+0x1c0/0x468
[...]
Call trace:
page_table_check_set.isra.0+0x398/0x468
__page_table_check_pte_set+0x160/0x1c0
__split_huge_pmd_locked+0x900/0x1648
__split_huge_pmd+0x28c/0x3b8
unmap_page_range+0x428/0x858
unmap_single_vma+0xf4/0x1c8
zap_page_range+0x2b0/0x410
madvise_vma_behavior+0xc44/0xe78
do_madvise+0x280/0x698
__arm64_sys_madvise+0x90/0xe8
invoke_syscall.constprop.0+0xdc/0x1d8
do_el0_svc+0xf4/0x3f8
el0_svc+0x58/0x120
el0t_64_sync_handler+0xb8/0xc0
el0t_64_sync+0x19c/0x1a0[...]
On arm64, pmd_leaf() will return true even if the pmd is invalid due to pmd_present_invalid() check. So in pmdp_invalidate() the file_map_count will not only decrease once but also increase once. Then in set_pte_at(), the file_map_count increase again, and so trigger BUG_ON() unexpectedly.
Add !pmd_present_invalid() check in pmd_user_accessible_page() to fix the problem.
--- arch/arm64/include/asm/pgtable.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/include/asm/pgtable.h +1 -1
@@ -863,7 +863,7 @@ static inline bool pte_user_accessible_pstatic inline bool pmd_user_accessible_page (pmd_t pmd) { -return pmd_leaf (pmd) && (pmd_user (pmd) ||pmd_user_exec (pmd)); +return pmd_leaf (pmd) && !pmd_present_invalid (pmd) && (pmd_user (pmd) ||pmd_user_exec (pmd)); }static inline bool pud_user_accessible_page (pud_t pud)
Greg Kroah-Hartman
maintainerPATCH 65/183 platform/x86: ideapad-laptop: Add Legion 5 15ARH05 DMI id to set_fn_lock_led_list[]
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit f4b7f8febd4d9b615fbec2a06bf352b9c3729b11 upstream.
The Lenovo Legion 5 15ARH05 needs ideapad-laptop to call SALS_FNLOCK_ON / SALS_FNLOCK_OFF on Fn-lock state change to get the LED in the Fn key to correctly reflect the Fn-lock state.
Add a DMI match for the Legion 5 15ARH05 to the set_fn_lock_led_list[] table for this.
--- drivers/platform/x86/ideapad-laptop.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/platform/x86/ideapad-laptop.c +6 -0
@@ -1615,6 +1615,12 @@ static const struct dmi_system_id set_fn DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo Legion R7000P2020H"), } }, + { + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo Legion 5 15ARH05"), + } + }, {} };
Greg Kroah-Hartman
maintainerPATCH 66/183 drm/msm/dp: do not complete dp_aux_cmd_fifo_tx() if irq is not for aux transfer
In reply to Greg Kroah-HartmanFrom: Kuogee Hsieh <[email protected]>
commit 1cba0d150fa102439114a91b3e215909efc9f169 upstream.
There are 3 possible interrupt sources are handled by DP controller, HPDstatus, Controller state changes and Aux read/write transaction. At every irq, DP controller have to check isr status of every interrupt sources and service the interrupt if its isr status bits shows interrupts are pending. There is potential race condition may happen at current aux isr handler implementation since it is always complete dp_aux_cmd_fifo_tx() even irq is not for aux read or write transaction. This may cause aux read transaction return premature if host aux data read is in the middle of waiting for sink to complete transferring data to host while irq happen. This will cause host's receiving buffer contains unexpected data. This patch fixes this problem by checking aux isr and return immediately at aux isr handler if there are no any isr status bits set.
Current there is a bug report regrading eDP edid corruption happen during system booting up. After lengthy debugging to found that VIDEO_READY interrupt was continuously firing during system booting up which cause dp_aux_isr() to complete dp_aux_cmd_fifo_tx() prematurely to retrieve data from aux hardware buffer which is not yet contains complete data transfer from sink. This cause edid corruption.
Follows are the signature at kernel logs when problem happen, EDID has corrupt header
panel-simple-dp-aux aux-aea0000.edp: Couldn't identify panel via EDID
Changes in v2:
-- do complete if (ret == IRQ_HANDLED) ay dp-aux_isr() -- add more commit text
Changes in v3:
-- add Stephen suggested
-- dp_aux_isr() return IRQ_XXX back to caller
-- dp_ctrl_isr() return IRQ_XXX back to caller
Changes in v4:
-- split into two patches
Changes in v5:
-- delete empty line between tags
Changes in v6:
-- remove extra "that" and fixed line more than 75 char at commit text
Patchwork: https://patchwork.freedesktop.org/patch/516121/
--- drivers/gpu/drm/msm/dp/dp_aux.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/msm/dp/dp_aux.c +4 -0
@@ -423,6 +423,10 @@ void dp_aux_isr(struct drm_dp_aux *dp_au isr =dp_catalog_aux_get_irq (aux->catalog); +/* no interrupts pending, return immediately */ +if (!isr) +return ; +if (!aux->cmd_busy)return ;
Greg Kroah-Hartman
maintainerPATCH 67/183 dt-bindings: msm/dsi: Dont require vdds-supply on 10nm PHY
In reply to Greg Kroah-HartmanFrom: Konrad Dybcio <[email protected]>
commit ef11cb7a29c0e13031c968190ea8f86104e7fb6a upstream.
On some SoCs (hello SM6350) vdds-supply is not wired to any smd-rpm or rpmh regulator, but instead powered by the VDD_MX/mx.lvl line, which is voted for in the DSI ctrl node.
Patchwork: https://patchwork.freedesktop.org/patch/511889/
--- Documentation/devicetree/bindings/display/msm/dsi-phy-10nm.yaml | 1 - 1 file changed, 1 deletion(-)
Documentation/devicetree/bindings/display/msm/dsi-phy-10nm.yaml +0 -1
@@ -69,7 +69,6 @@ required: - compatible - reg - reg-names - - vdds-supply unevaluatedProperties: false
Greg Kroah-Hartman
maintainerPATCH 68/183 dt-bindings: msm/dsi: Dont require vcca-supply on 14nm PHY
In reply to Greg Kroah-HartmanFrom: Konrad Dybcio <[email protected]>
commit a2117773c839a8439a3771e0c040b5c505b083a7 upstream.
On some SoCs (hello SM6115) vcca-supply is not wired to any smd-rpm or rpmh regulator, but instead powered by the VDD_MX line, which is voted for in the DSI ctrl node.
Patchwork: https://patchwork.freedesktop.org/patch/513555/
--- Documentation/devicetree/bindings/display/msm/dsi-phy-14nm.yaml | 1 - 1 file changed, 1 deletion(-)
Documentation/devicetree/bindings/display/msm/dsi-phy-14nm.yaml +0 -1
@@ -38,7 +38,6 @@ required: - compatible - reg - reg-names - - vcca-supply unevaluatedProperties: false
Greg Kroah-Hartman
maintainerPATCH 69/183 platform/x86: sony-laptop: Dont turn off 0x153 keyboard backlight during probe
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit ad75bd85b1db69c97eefea07b375567821f6ef58 upstream.
The 0x153 version of the kbd backlight control SNC handle has no separate address to probe if the backlight is there.
This turns the probe call into a set keyboard backlight call with a value of 0 turning off the keyboard backlight.
Skip probing when there is no separate probe address to avoid this.
--- drivers/platform/x86/sony-laptop.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-)
drivers/platform/x86/sony-laptop.c +14 -7
@@ -1888,14 +1888,21 @@ static int sony_nc_kbd_backlight_setup(sbreak ; } - ret =sony_call_snc_handle (handle, probe_base, &result); -if (ret) -return ret; +/* +* Only probe if there is a separate probe_base, otherwise the probe call +* is equivalent to __sony_nc_kbd_backlight_mode_set(0), resulting in +* the keyboard backlight being turned off. +*/ +if (probe_base) { + ret =sony_call_snc_handle (handle, probe_base, &result); +if (ret) +return ret; -if ((handle ==0x0137 && !(result &0x02 )) || - !(result &0x01 )) { -dprintk ("no backlight keyboard found\n" ); -return 0 ; +if ((handle ==0x0137 && !(result &0x02 )) || + !(result &0x01 )) { +dprintk ("no backlight keyboard found\n" ); +return 0 ; + } } kbdbl_ctl =kzalloc (sizeof (*kbdbl_ctl),GFP_KERNEL );
Greg Kroah-Hartman
maintainerPATCH 70/183 ixgbe: fix pci device refcount leak
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
commit b93fb4405fcb5112c5739c5349afb52ec7f15c07 upstream.
As the comment of pci_get_domain_bus_and_slot() says, it returns a PCI device with refcount incremented, when finish using it, the caller must decrement the reference count by calling pci_dev_put().
In ixgbe_get_first_secondary_devfn() and ixgbe_x550em_a_has_mii(), pci_dev_put() is called to avoid leak.
--- drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c +9 -5
@@ -855,9 +855,11 @@ static struct pci_dev *ixgbe_get_first_s rp_pdev =pci_get_domain_bus_and_slot (0 ,0 , devfn);if (rp_pdev && rp_pdev->subordinate) { bus = rp_pdev->subordinate->number; +pci_dev_put (rp_pdev);return pci_get_domain_bus_and_slot (0 , bus,0 ); } +pci_dev_put (rp_pdev);return NULL ; }
@@ -874,6 +876,7 @@ static bool ixgbe_x550em_a_has_mii(strucstruct ixgbe_adapter *adapter = hw->back;struct pci_dev *pdev = adapter->pdev;struct pci_dev *func0_pdev; +bool has_mii = false;/* For the C3000 family of SoCs (x550em_a) the internal ixgbe devices * are always downstream of root ports @ 0000:00:16.0 & 0000:00:17.0
@@ -884,15 +887,16 @@ static bool ixgbe_x550em_a_has_mii(struc func0_pdev =ixgbe_get_first_secondary_devfn (PCI_DEVFN (0x16 ,0 ));if (func0_pdev) {if (func0_pdev == pdev) -return true; -else -return false; + has_mii = true; + goto out; } func0_pdev =ixgbe_get_first_secondary_devfn (PCI_DEVFN (0x17 ,0 ));if (func0_pdev == pdev) -return true; + has_mii = true; -return false; +out: +pci_dev_put (func0_pdev); +return has_mii; }/**
Greg Kroah-Hartman
maintainerPATCH 71/183 ipv6: raw: Deduct extension header length in rawv6_push_pending_frames
In reply to Greg Kroah-HartmanFrom: Herbert Xu <[email protected]>
commit cb3e9864cdbe35ff6378966660edbcbac955fe17 upstream.
The total cork length created by ip6_append_data includes extension headers, so we must exclude them when comparing them against the IPV6_CHECKSUM offset which does not include extension headers.
--- net/ipv6/raw.c | 4 ++++ 1 file changed, 4 insertions(+)
net/ipv6/raw.c +4 -0
@@ -505,6 +505,7 @@ csum_copy_err:static int rawv6_push_pending_frames (struct sock *sk,struct flowi6 *fl6,struct raw6_sock *rp) { +struct ipv6_txoptions *opt;struct sk_buff *skb;int err =0 ;int offset;
@@ -522,6 +523,9 @@ static int rawv6_push_pending_frames(str offset = rp->offset; total_len =inet_sk (sk)->cork.base.length; + opt =inet6_sk (sk)->cork.opt; + total_len -= opt ? opt->opt_flen :0 ; +if (offset >= total_len -1 ) { err = -EINVAL ;ip6_flush_pending_frames (sk);
Greg Kroah-Hartman
maintainerPATCH 72/183 iavf/iavf_main: actually log ->src mask when talking about it
In reply to Greg Kroah-HartmanFrom: Daniil Tatianin <[email protected]>
commit 6650c8e906ce58404bfdfceceeba7bd10d397d40 upstream.
This fixes a copy-paste issue where dev_err would log the dst mask even though it is clearly talking about src.
Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool.
--- drivers/net/ethernet/intel/iavf/iavf_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/intel/iavf/iavf_main.c +1 -1
@@ -3850,7 +3850,7 @@ static int iavf_parse_cls_flower(struct field_flags |=IAVF_CLOUD_FIELD_IIP ; }else {dev_err (&adapter->pdev->dev,"Bad ip src mask 0x%08x\n" , -be32_to_cpu (match.mask->dst)); +be32_to_cpu (match.mask->src));return -EINVAL ; } }
Greg Kroah-Hartman
maintainerPATCH 73/183 drm/i915/gt: Cleanup partial engine discovery failures
In reply to Greg Kroah-HartmanFrom: Chris Wilson <[email protected]>
[ Upstream commit 78a033433a5ae4fee85511ee075bc9a48312c79e ]
If we abort driver initialisation in the middle of gt/engine discovery, some engines will be fully setup and some not. Those incompletely setup engines only have 'engine->release == NULL' and so will leak any of the common objects allocated.
v2:
- Drop the destroy_pinned_context() helper for now. It's not really worth it with just a single callsite at the moment. (Janusz)
--- drivers/gpu/drm/i915/gt/intel_engine_cs.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/gpu/drm/i915/gt/intel_engine_cs.c +6 -1
@@ -1343,8 +1343,13 @@ int intel_engines_init(struct intel_gt *gt)return err; err =setup (engine); -if (err) +if (err) { +intel_engine_cleanup_common (engine);return err; + } + +/* The backend should now be responsible for cleanup */ +GEM_BUG_ON (engine->release ==NULL ); err =engine_init_common (engine);if (err)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 74/183 usb: ulpi: defer ulpi_register on ulpi_read_id timeout
In reply to Greg Kroah-HartmanFrom: Ferry Toth <[email protected]>
[ Upstream commit 8a7b31d545d3a15f0e6f5984ae16f0ca4fd76aac ]
Since commit 0f0101719138 ("usb: dwc3: Don't switch OTG -> peripheral if extcon is present") Dual Role support on Intel Merrifield platform broke due to rearranging the call to dwc3_get_extcon().
It appears to be caused by ulpi_read_id() on the first test write failing with -ETIMEDOUT. Currently ulpi_read_id() expects to discover the phy via DT when the test write fails and returns 0 in that case, even if DT does not provide the phy. As a result usb probe completes without phy.
Make ulpi_read_id() return -ETIMEDOUT to its user if the first test write fails. The user should then handle it appropriately. A follow up patch will make dwc3_core_init() set -EPROBE_DEFER in this case and bail out.
--- drivers/usb/common/ulpi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/common/ulpi.c +1 -1
@@ -207,7 +207,7 @@ static int ulpi_read_id(struct ulpi *ulpi)/* Test the interface */ ret =ulpi_write (ulpi,ULPI_SCRATCH ,0xaa );if (ret <0 ) - goto err; +return ret; ret =ulpi_read (ulpi,ULPI_SCRATCH );if (ret <0 )
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 75/183 drm/amd/pm: enable mode1 reset on smu_v13_0_10
In reply to Greg Kroah-HartmanFrom: Kenneth Feng <[email protected]>
[ Upstream commit 60cfad329ab877cb62975ea78ed442c2496990ba ]
enable mode1 reset and prioritize debug port on smu_v13_0_10 as a more reliable message processing
v2 - move mode1 reset callback to smu_v13_0_0_ppt.c
Stable-dep-of: 1794f6a9535b ("drm/amd/pm: enable GPO dynamic control support for SMU13.0.0")
--- drivers/gpu/drm/amd/amdgpu/soc21.c | 1 + drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h | 4 ++ .../drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 53 ++++++++++++++++++- drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c | 18 +++++++ drivers/gpu/drm/amd/pm/swsmu/smu_cmn.h | 3 ++ 5 files changed, 77 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/soc21.c +1 -0
@@ -322,6 +322,7 @@ soc21_asic_reset_method(struct amdgpu_device *adev)switch (adev->ip_versions[MP1_HWIP ][0 ]) {case IP_VERSION (13 ,0 ,0 ):case IP_VERSION (13 ,0 ,7 ): +case IP_VERSION (13 ,0 ,10 ):return AMD_RESET_METHOD_MODE1 ;case IP_VERSION (13 ,0 ,4 ):return AMD_RESET_METHOD_MODE2 ;
drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h +4 -0
@@ -568,6 +568,10 @@ struct smu_contextu32 param_reg;u32 msg_reg;u32 resp_reg; + +u32 debug_param_reg; +u32 debug_msg_reg; +u32 debug_resp_reg; };struct i2c_adapter ;
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c +51 -2
75 lines not on this page · raw message
drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c +18 -0
@@ -233,6 +233,18 @@ static void __smu_cmn_send_msg(struct smu_context *smu,WREG32 (smu->msg_reg, msg); } +static int __smu_cmn_send_debug_msg (struct smu_context *smu, +u32 msg, +u32 param) +{ +struct amdgpu_device *adev = smu->adev; + +WREG32 (smu->debug_param_reg, param); +WREG32 (smu->debug_msg_reg, msg); +WREG32 (smu->debug_resp_reg,0 ); + +return 0 ; +}/** * smu_cmn_send_msg_without_waiting -- send the message; don't wait for status * @smu: pointer to an SMU context
@@ -386,6 +398,12 @@ int smu_cmn_send_smc_msg(struct smu_context *smu, read_arg); } +int smu_cmn_send_debug_smc_msg (struct smu_context *smu, +uint32_t msg) +{ +return __smu_cmn_send_debug_msg (smu, msg,0 ); +} +int smu_cmn_to_asic_specific_index (struct smu_context *smu,enum smu_cmn2asic_mapping_type type,uint32_t index)
drivers/gpu/drm/amd/pm/swsmu/smu_cmn.h +3 -0
@@ -42,6 +42,9 @@ int smu_cmn_send_smc_msg(struct smu_context *smu,enum smu_message_type msg, uint32_t *read_arg); +int smu_cmn_send_debug_smc_msg (struct smu_context *smu, +uint32_t msg); +int smu_cmn_wait_for_response (struct smu_context *smu); int smu_cmn_to_asic_specific_index(struct smu_context *smu,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 76/183 drm/amd/pm: Enable bad memory page/channel recording support for smu v13_0_0
In reply to Greg Kroah-HartmanFrom: Candice Li <[email protected]>
[ Upstream commit 48aa62f07467c8fcd4b4ec7851e13c83e89a1558 ]
Send message to SMU to update bad memory page and bad channel info.
Stable-dep-of: 1794f6a9535b ("drm/amd/pm: enable GPO dynamic control support for SMU13.0.0")
--- .../pm/swsmu/inc/pmfw_if/smu_v13_0_0_ppsmc.h | 8 +++- drivers/gpu/drm/amd/pm/swsmu/inc/smu_types.h | 4 +- .../drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 39 +++++++++++++++++++ 3 files changed, 49 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/pm/swsmu/inc/pmfw_if/smu_v13_0_0_ppsmc.h +7 -1
@@ -131,7 +131,13 @@#define PPSMC_MSG_EnableAudioStutterWA 0x44#define PPSMC_MSG_PowerUpUmsch 0x45#define PPSMC_MSG_PowerDownUmsch 0x46 -#define PPSMC_Message_Count 0x47 +#define PPSMC_MSG_SetDcsArch 0x47 +#define PPSMC_MSG_TriggerVFFLR 0x48 +#define PPSMC_MSG_SetNumBadMemoryPagesRetired 0x49 +#define PPSMC_MSG_SetBadMemoryPagesRetiredFlagsPerChannel 0x4A +#define PPSMC_MSG_SetPriorityDeltaGain 0x4B +#define PPSMC_MSG_AllowIHHostInterrupt 0x4C +#define PPSMC_Message_Count 0x4D//Debug Dump Message #define DEBUGSMC_MSG_TestMessage 0x1
drivers/gpu/drm/amd/pm/swsmu/inc/smu_types.h +3 -1
@@ -239,7 +239,9 @@__SMU_DUMMY_MAP (DriverMode2Reset), \__SMU_DUMMY_MAP (GetGfxOffStatus), \__SMU_DUMMY_MAP (GetGfxOffEntryCount), \ -__SMU_DUMMY_MAP (LogGfxOffResidency), +__SMU_DUMMY_MAP (LogGfxOffResidency), \ +__SMU_DUMMY_MAP (SetNumBadMemoryPagesRetired), \ +__SMU_DUMMY_MAP (SetBadMemoryPagesRetiredFlagsPerChannel), #undef __SMU_DUMMY_MAP#define __SMU_DUMMY_MAP (type) SMU_MSG_##type
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c +39 -0
@@ -141,6 +141,9 @@ static struct cmn2asic_msg_mapping smu_v13_0_0_message_map[SMU_MSG_MAX_COUNT] =MSG_MAP (PrepareMp1ForUnload, PPSMC_MSG_PrepareMp1ForUnload,0 ),MSG_MAP (DFCstateControl, PPSMC_MSG_SetExternalClientDfCstateAllow,0 ),MSG_MAP (ArmD3, PPSMC_MSG_ArmD3,0 ), +MSG_MAP (SetNumBadMemoryPagesRetired, PPSMC_MSG_SetNumBadMemoryPagesRetired,0 ), +MSG_MAP (SetBadMemoryPagesRetiredFlagsPerChannel, + PPSMC_MSG_SetBadMemoryPagesRetiredFlagsPerChannel, 0), }; static struct cmn2asic_mapping smu_v13_0_0_clk_map[SMU_CLK_COUNT] = {
@@ -1928,6 +1931,40 @@ static void smu_v13_0_0_set_smu_mailbox_registers(struct smu_context *smu) smu->debug_resp_reg =SOC15_REG_OFFSET (MP1 ,0 , mmMP1_SMN_C2PMSG_54); } +static int smu_v13_0_0_smu_send_bad_mem_page_num (struct smu_context *smu, +uint32_t size) +{ +int ret =0 ; + +/* message SMU to update the bad page number on SMUBUS */ + ret =smu_cmn_send_smc_msg_with_param (smu, + SMU_MSG_SetNumBadMemoryPagesRetired, + size,NULL ); +if (ret) +dev_err (smu->adev->dev, +"[%s] failed to message SMU to update bad memory pages number\n" , + __func__); + +return ret; +} + +static int smu_v13_0_0_send_bad_mem_channel_flag (struct smu_context *smu, +uint32_t size) +{ +int ret =0 ; + +/* message SMU to update the bad channel info on SMUBUS */ + ret =smu_cmn_send_smc_msg_with_param (smu, + SMU_MSG_SetBadMemoryPagesRetiredFlagsPerChannel, + size,NULL ); +if (ret) +dev_err (smu->adev->dev, +"[%s] failed to message SMU to update bad memory pages channel info\n" , + __func__); + +return ret; +} +static const struct pptable_funcs smu_v13_0_0_ppt_funcs = { .get_allowed_feature_mask = smu_v13_0_0_get_allowed_feature_mask, .set_default_dpm_table = smu_v13_0_0_set_default_dpm_table,
@@ -1998,6 +2035,8 @@ static const struct pptable_funcs smu_v13_0_0_ppt_funcs = { .mode1_reset = smu_v13_0_0_mode1_reset, .set_mp1_state = smu_v13_0_0_set_mp1_state, .set_df_cstate = smu_v13_0_0_set_df_cstate, + .send_hbm_bad_pages_num = smu_v13_0_0_smu_send_bad_mem_page_num, + .send_hbm_bad_channel_flag = smu_v13_0_0_send_bad_mem_channel_flag, };void smu_v13_0_0_set_ppt_funcs (struct smu_context *smu)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 77/183 drm/amd/pm: enable GPO dynamic control support for SMU13.0.0
In reply to Greg Kroah-HartmanFrom: Evan Quan <[email protected]>
[ Upstream commit 1794f6a9535bb5234c2b747d1bc6dad03249245a ]
To better support UMD pstate profilings, the GPO feature needs to be switched on/off accordingly.
--- drivers/gpu/drm/amd/pm/swsmu/inc/smu_types.h | 3 ++- drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h | 3 +++ drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 15 +++++++++++++++ .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 2 ++ 4 files changed, 22 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/pm/swsmu/inc/smu_types.h +2 -1
@@ -241,7 +241,8 @@__SMU_DUMMY_MAP (GetGfxOffEntryCount), \__SMU_DUMMY_MAP (LogGfxOffResidency), \__SMU_DUMMY_MAP (SetNumBadMemoryPagesRetired), \ -__SMU_DUMMY_MAP (SetBadMemoryPagesRetiredFlagsPerChannel), +__SMU_DUMMY_MAP (SetBadMemoryPagesRetiredFlagsPerChannel), \ +__SMU_DUMMY_MAP (AllowGpo), #undef __SMU_DUMMY_MAP#define __SMU_DUMMY_MAP (type) SMU_MSG_##type
drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h +3 -0
@@ -273,6 +273,9 @@ int smu_v13_0_init_pptable_microcode(struct smu_context *smu);int smu_v13_0_run_btc (struct smu_context *smu); +int smu_v13_0_gpo_control (struct smu_context *smu, +bool enablement); +int smu_v13_0_deep_sleep_control (struct smu_context *smu,bool enablement);
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c +15 -0
@@ -2148,6 +2148,21 @@ int smu_v13_0_run_btc(struct smu_context *smu)return res; } +int smu_v13_0_gpo_control (struct smu_context *smu, +bool enablement) +{ +int res; + + res =smu_cmn_send_smc_msg_with_param (smu, + SMU_MSG_AllowGpo, + enablement ?1 :0 , +NULL ); +if (res) +dev_err (smu->adev->dev,"SetGpoAllow %d failed!\n" , enablement); + +return res; +} +int smu_v13_0_deep_sleep_control (struct smu_context *smu,bool enablement) {
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c +2 -0
@@ -144,6 +144,7 @@ static struct cmn2asic_msg_mapping smu_v13_0_0_message_map[SMU_MSG_MAX_COUNT] =MSG_MAP (SetNumBadMemoryPagesRetired, PPSMC_MSG_SetNumBadMemoryPagesRetired,0 ),MSG_MAP (SetBadMemoryPagesRetiredFlagsPerChannel, PPSMC_MSG_SetBadMemoryPagesRetiredFlagsPerChannel,0 ), + MSG_MAP(AllowGpo, PPSMC_MSG_SetGpoAllow, 0), }; static struct cmn2asic_mapping smu_v13_0_0_clk_map[SMU_CLK_COUNT] = {
@@ -2037,6 +2038,7 @@ static const struct pptable_funcs smu_v13_0_0_ppt_funcs = { .set_df_cstate = smu_v13_0_0_set_df_cstate, .send_hbm_bad_pages_num = smu_v13_0_0_smu_send_bad_mem_page_num, .send_hbm_bad_channel_flag = smu_v13_0_0_send_bad_mem_channel_flag, + .gpo_control = smu_v13_0_gpo_control, };void smu_v13_0_0_set_ppt_funcs (struct smu_context *smu)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 78/183 drm/amd/pm: enable GPO dynamic control support for SMU13.0.7
In reply to Greg Kroah-HartmanFrom: Evan Quan <[email protected]>
[ Upstream commit 62b9f835a6c60171845642afec4ce4b44865f10f ]
To better support UMD pstate profilings, the GPO feature needs to be switched on/off accordingly.
--- drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c +2 -0
@@ -123,6 +123,7 @@ static struct cmn2asic_msg_mapping smu_v13_0_7_message_map[SMU_MSG_MAX_COUNT] =MSG_MAP (SetMGpuFanBoostLimitRpm, PPSMC_MSG_SetMGpuFanBoostLimitRpm,0 ),MSG_MAP (DFCstateControl, PPSMC_MSG_SetExternalClientDfCstateAllow,0 ),MSG_MAP (ArmD3, PPSMC_MSG_ArmD3,0 ), + MSG_MAP(AllowGpo, PPSMC_MSG_SetGpoAllow, 0), }; static struct cmn2asic_mapping smu_v13_0_7_clk_map[SMU_CLK_COUNT] = {
@@ -1712,6 +1713,7 @@ static const struct pptable_funcs smu_v13_0_7_ppt_funcs = { .mode1_reset = smu_v13_0_mode1_reset, .set_mp1_state = smu_v13_0_7_set_mp1_state, .set_df_cstate = smu_v13_0_7_set_df_cstate, + .gpo_control = smu_v13_0_gpo_control, };void smu_v13_0_7_set_ppt_funcs (struct smu_context *smu)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 79/183 drm/amdgpu: add soc21 common ip block support for GC 11.0.4
In reply to Greg Kroah-HartmanFrom: Yifan Zhang <[email protected]>
[ Upstream commit 311d52367d0a7985ee1132662bad46f09169eed2 ]
Add common soc21 ip block support for GC 11.0.4.
Stable-dep-of: e1d900df63ad ("drm/amdgpu: enable VCN DPG for GC IP v11.0.4")
--- drivers/gpu/drm/amd/amdgpu/soc21.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/gpu/drm/amd/amdgpu/soc21.c +6 -0
@@ -653,6 +653,12 @@ static int soc21_common_early_init(void *handle) } adev->external_rev_id = adev->rev_id +0x20 ;break ; +case IP_VERSION (11 ,0 ,4 ): + adev->cg_flags =0 ; + adev->pg_flags =0 ; + adev->external_rev_id = adev->rev_id +0x1 ; +break ; +default :/* FIXME: not supported yet */ return -EINVAL ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 80/183 drm/amdgpu: Enable pg/cg flags on GC11_0_4 for VCN
In reply to Greg Kroah-HartmanFrom: Saleemkhan Jamadar <[email protected]>
[ Upstream commit 2a0fe2ca6e9c9bf9c47a9f9f0d67c13281a13f8c ]
This enable VCN PG, CG and JPEG PG, CG
Stable-dep-of: e1d900df63ad ("drm/amdgpu: enable VCN DPG for GC IP v11.0.4")
--- drivers/gpu/drm/amd/amdgpu/soc21.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/soc21.c +5 -2
@@ -654,8 +654,11 @@ static int soc21_common_early_init(void *handle) adev->external_rev_id = adev->rev_id +0x20 ;break ;case IP_VERSION (11 ,0 ,4 ): - adev->cg_flags =0 ; - adev->pg_flags =0 ; + adev->cg_flags =AMD_CG_SUPPORT_VCN_MGCG | +AMD_CG_SUPPORT_JPEG_MGCG ; + adev->pg_flags =AMD_PG_SUPPORT_VCN | +AMD_PG_SUPPORT_GFX_PG | +AMD_PG_SUPPORT_JPEG ; adev->external_rev_id = adev->rev_id +0x1 ;break ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 81/183 drm/amdgpu: enable VCN DPG for GC IP v11.0.4
In reply to Greg Kroah-HartmanFrom: Saleemkhan Jamadar <[email protected]>
[ Upstream commit e1d900df63adcb748905131dd6258e570e11aed1 ]
Enable VCN Dynamic Power Gating control for GC IP v11.0.4.
--- drivers/gpu/drm/amd/amdgpu/soc21.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/amd/amdgpu/soc21.c +1 -0
@@ -657,6 +657,7 @@ static int soc21_common_early_init(void *handle) adev->cg_flags =AMD_CG_SUPPORT_VCN_MGCG |AMD_CG_SUPPORT_JPEG_MGCG ; adev->pg_flags =AMD_PG_SUPPORT_VCN | +AMD_PG_SUPPORT_VCN_DPG |AMD_PG_SUPPORT_GFX_PG |AMD_PG_SUPPORT_JPEG ; adev->external_rev_id = adev->rev_id +0x1 ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 82/183 mm: Always release pages to the buddy allocator in memblock_free_late().
In reply to Greg Kroah-HartmanFrom: Aaron Thompson <[email protected]>
commit 115d9d77bb0f9152c60b6e8646369fa7f6167593 upstream.
If CONFIG_DEFERRED_STRUCT_PAGE_INIT is enabled, memblock_free_pages() only releases pages to the buddy allocator if they are not in the deferred range. This is correct for free pages (as defined by for_each_free_mem_pfn_range_in_zone()) because free pages in the deferred range will be initialized and released as part of the deferred init process. memblock_free_pages() is called by memblock_free_late(), which is used to free reserved ranges after memblock_free_all() has run. All pages in reserved ranges have been initialized at that point, and accordingly, those pages are not touched by the deferred init process. This means that currently, if the pages that memblock_free_late() intends to release are in the deferred range, they will never be released to the buddy allocator. They will forever be reserved.
In addition, memblock_free_pages() calls kmsan_memblock_free_pages(), which is also correct for free pages but is not correct for reserved pages. KMSAN metadata for reserved pages is initialized by kmsan_init_shadow(), which runs shortly before memblock_free_all().
For both of these reasons, memblock_free_pages() should only be called for free pages, and memblock_free_late() should call __free_pages_core() directly instead.
One case where this issue can occur in the wild is EFI boot on x86_64. The x86 EFI code reserves all EFI boot services memory ranges via memblock_reserve() and frees them later via memblock_free_late() (efi_reserve_boot_services() and efi_free_boot_services(), respectively). If any of those ranges happens to fall within the deferred init range, the pages will not be released and that memory will be unavailable.
For example, on an Amazon EC2 t3.micro VM (1 GB) booting via EFI:
v6.2-rc2:
# grep -E 'Node|spanned|present|managed' /proc/zoneinfo
Node 0, zone DMA
spanned 4095
present 3999
managed 3840
Node 0, zone DMA32
spanned 246652
present 245868
managed 178867v6.2-rc2 + patch:
# grep -E 'Node|spanned|present|managed' /proc/zoneinfo
Node 0, zone DMA
spanned 4095
present 3999
managed 3840
Node 0, zone DMA32
spanned 246652
present 245868
managed 222816 # +43,949 pages--- mm/memblock.c | 8 +++++++- tools/testing/memblock/internal.h | 4 ++++ 2 files changed, 11 insertions(+), 1 deletion(-)
mm/memblock.c +7 -1
@@ -1640,7 +1640,13 @@ void __init memblock_free_late(phys_addr end =PFN_DOWN (base + size);for (; cursor < end; cursor++) { -memblock_free_pages (pfn_to_page (cursor), cursor,0 ); +/* +* Reserved pages are always initialized by the end of +* memblock_free_all() (by memmap_init() and, if deferred +* initialization is enabled, memmap_init_reserved_pages()), so +* these pages can be released directly to the buddy allocator. +*/ +__free_pages_core (pfn_to_page (cursor),0 );totalram_pages_inc (); } }
tools/testing/memblock/internal.h +4 -0
@@ -15,6 +15,10 @@ bool mirrored_kernelcore = false;struct page {}; +void __free_pages_core (struct page *page,unsigned int order) +{ +} +void memblock_free_pages (struct page *page,unsigned long pfn,unsigned int order) {
Greg Kroah-Hartman
maintainerPATCH 83/183 iommu/iova: Fix alloc iova overflows issue
In reply to Greg Kroah-HartmanFrom: Yunfei Wang <[email protected]>
commit dcdb3ba7e2a8caae7bfefd603bc22fd0ce9a389c upstream.
In __alloc_and_insert_iova_range, there is an issue that retry_pfn overflows. The value of iovad->anchor.pfn_hi is ~0UL, then when iovad->cached_node is iovad->anchor, curr_iova->pfn_hi + 1 will overflow. As a result, if the retry logic is executed, low_pfn is updated to 0, and then new_pfn < low_pfn returns false to make the allocation successful.
This issue occurs in the following two situations:
1. The first iova size exceeds the domain size. When initializing iova domain, iovad->cached_node is assigned as iovad->anchor. For example, the iova domain size is 10M, start_pfn is 0x1_F000_0000, and the iova size allocated for the first time is 11M. The following is the log information, new->pfn_lo is smaller than iovad->cached_node.
Example log as follows:
[ 223.798112][T1705487] sh: [name:iova&]__alloc_and_insert_iova_range start_pfn:0x1f0000,retry_pfn:0x0,size:0xb00,limit_pfn:0x1f0a00 [ 223.799590][T1705487] sh: [name:iova&]__alloc_and_insert_iova_range
success start_pfn:0x1f0000,new->pfn_lo:0x1efe00,new->pfn_hi:0x1f08ff
2. The node with the largest iova->pfn_lo value in the iova domain is deleted, iovad->cached_node will be updated to iovad->anchor, and then the alloc iova size exceeds the maximum iova size that can be allocated in the domain.
After judging that retry_pfn is less than limit_pfn, call retry_pfn+1 to fix the overflow issue.
--- drivers/iommu/iova.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/iommu/iova.c +2 -2
@@ -197,7 +197,7 @@ static int __alloc_and_insert_iova_range curr =__get_cached_rbnode (iovad, limit_pfn); curr_iova =to_iova (curr); - retry_pfn = curr_iova->pfn_hi +1 ; + retry_pfn = curr_iova->pfn_hi; retry: do {
@@ -211,7 +211,7 @@ retry:if (high_pfn < size || new_pfn < low_pfn) {if (low_pfn == iovad->start_pfn && retry_pfn < limit_pfn) { high_pfn = limit_pfn; - low_pfn = retry_pfn; + low_pfn = retry_pfn +1 ; curr =iova_find_limit (iovad, limit_pfn); curr_iova =to_iova (curr); goto retry;
Greg Kroah-Hartman
maintainerPATCH 84/183 iommu/arm-smmu-v3: Dont unregister on shutdown
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
commit 32ea2c57dc216b6ad8125fa680d31daa5d421c95 upstream.
Similar to SMMUv2, this driver calls iommu_device_unregister() from the shutdown path, which removes the IOMMU groups with no coordination whatsoever with their users - shutdown methods are optional in device drivers. This can lead to NULL pointer dereferences in those drivers' DMA API calls, or worse.
Instead of calling the full arm_smmu_device_remove() from arm_smmu_device_shutdown(), let's pick only the relevant function call - arm_smmu_device_disable() - more or less the reverse of arm_smmu_device_reset() - and call just that from the shutdown path.
--- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +3 -1
@@ -3854,7 +3854,9 @@ static int arm_smmu_device_remove(structstatic void arm_smmu_device_shutdown (struct platform_device *pdev) { -arm_smmu_device_remove (pdev); +struct arm_smmu_device *smmu =platform_get_drvdata (pdev); + +arm_smmu_device_disable (smmu); }static const struct of_device_id arm_smmu_of_match[] = {
Greg Kroah-Hartman
maintainerPATCH 85/183 iommu/mediatek-v1: Fix an error handling path in mtk_iommu_v1_probe()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
commit 142e821f68cf5da79ce722cb9c1323afae30e185 upstream.
A clk, prepared and enabled in mtk_iommu_v1_hw_init(), is not released in the error handling path of mtk_iommu_v1_probe().
Add the corresponding clk_disable_unprepare(), as already done in the remove function.
--- drivers/iommu/mtk_iommu_v1.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/iommu/mtk_iommu_v1.c +3 -1
@@ -685,7 +685,7 @@ static int mtk_iommu_v1_probe(struct pla ret =iommu_device_sysfs_add (&data->iommu, &pdev->dev,NULL ,dev_name (&pdev->dev));if (ret) -return ret; + goto out_clk_unprepare; ret =iommu_device_register (&data->iommu, &mtk_iommu_v1_ops, dev);if (ret)
@@ -700,6 +700,8 @@ out_dev_unreg:iommu_device_unregister (&data->iommu); out_sysfs_remove:iommu_device_sysfs_remove (&data->iommu); +out_clk_unprepare: +clk_disable_unprepare (data->bclk);return ret; }
Greg Kroah-Hartman
maintainerPATCH 86/183 iommu/arm-smmu: Dont unregister on shutdown
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
commit ce31e6ca68bd7639bd3e5ef97be215031842bbab upstream.
Michael Walle says he noticed the following stack trace while performing a shutdown with "reboot -f". He suggests he got "lucky" and just hit the correct spot for the reboot while there was a packet transmission in flight.
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000098 CPU: 0 PID: 23 Comm: kworker/0:1 Not tainted 6.1.0-rc5-00088-gf3600ff8e322 #1930 Hardware name: Kontron KBox A-230-LS (DT) pc : iommu_get_dma_domain+0x14/0x20 lr : iommu_dma_map_page+0x9c/0x254 Call trace: iommu_get_dma_domain+0x14/0x20 dma_map_page_attrs+0x1ec/0x250 enetc_start_xmit+0x14c/0x10b0 enetc_xmit+0x60/0xdc dev_hard_start_xmit+0xb8/0x210 sch_direct_xmit+0x11c/0x420 __dev_queue_xmit+0x354/0xb20 ip6_finish_output2+0x280/0x5b0 __ip6_finish_output+0x15c/0x270 ip6_output+0x78/0x15c NF_HOOK.constprop.0+0x50/0xd0 mld_sendpack+0x1bc/0x320 mld_ifc_work+0x1d8/0x4dc process_one_work+0x1e8/0x460 worker_thread+0x178/0x534 kthread+0xe0/0xe4 ret_from_fork+0x10/0x20 Code: d503201f f9416800 d503233f d50323bf (f9404c00) ---[ end trace 0000000000000000 ]--- Kernel panic - not syncing: Oops: Fatal exception in interrupt
This appears to be reproducible when the board has a fixed IP address, is ping flooded from another host, and "reboot -f" is used.
The following is one more manifestation of the issue:
$ reboot -f kvm: exiting hardware virtualization cfg80211: failed to load regulatory.db arm-smmu 5000000.iommu: disabling translation sdhci-esdhc 2140000.mmc: Removing from iommu group 11 sdhci-esdhc 2150000.mmc: Removing from iommu group 12 fsl-edma 22c0000.dma-controller: Removing from iommu group 17 dwc3 3100000.usb: Removing from iommu group 9 dwc3 3110000.usb: Removing from iommu group 10 ahci-qoriq 3200000.sata: Removing from iommu group 2 fsl-qdma 8380000.dma-controller: Removing from iommu group 20 platform f080000.display: Removing from iommu group 0 etnaviv-gpu f0c0000.gpu: Removing from iommu group 1 etnaviv etnaviv: Removing from iommu group 1 caam_jr 8010000.jr: Removing from iommu group 13 caam_jr 8020000.jr: Removing from iommu group 14 caam_jr 8030000.jr: Removing from iommu group 15 caam_jr 8040000.jr: Removing from iommu group 16 fsl_enetc 0000:00:00.0: Removing from iommu group 4 arm-smmu 5000000.iommu: Blocked unknown Stream ID 0x429; boot with "arm-smmu.disable_bypass=0" to allow, but this may have security implications arm-smmu 5000000.iommu: GFSR 0x80000002, GFSYNR0 0x00000002, GFSYNR1 0x00000429, GFSYNR2 0x00000000 fsl_enetc 0000:00:00.1: Removing from iommu group 5 arm-smmu 5000000.iommu: Blocked unknown Stream ID 0x429; boot with "arm-smmu.disable_bypass=0" to allow, but this may have security implications arm-smmu 5000000.iommu: GFSR 0x80000002, GFSYNR0 0x00000002, GFSYNR1 0x00000429, GFSYNR2 0x00000000 arm-smmu 5000000.iommu: Blocked unknown Stream ID 0x429; boot with "arm-smmu.disable_bypass=0" to allow, but this may have security implications arm-smmu 5000000.iommu: GFSR 0x80000002, GFSYNR0 0x00000000, GFSYNR1 0x00000429, GFSYNR2 0x00000000 fsl_enetc 0000:00:00.2: Removing from iommu group 6 fsl_enetc_mdio 0000:00:00.3: Removing from iommu group 8 mscc_felix 0000:00:00.5: Removing from iommu group 3 fsl_enetc 0000:00:00.6: Removing from iommu group 7 pcieport 0001:00:00.0: Removing from iommu group 18 arm-smmu 5000000.iommu: Blocked unknown Stream ID 0x429; boot with "arm-smmu.disable_bypass=0" to allow, but this may have security implications arm-smmu 5000000.iommu: GFSR 0x00000002, GFSYNR0 0x00000000, GFSYNR1 0x00000429, GFSYNR2 0x00000000 pcieport 0002:00:00.0: Removing from iommu group 19 Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a8 pc : iommu_get_dma_domain+0x14/0x20 lr : iommu_dma_unmap_page+0x38/0xe0 Call trace: iommu_get_dma_domain+0x14/0x20 dma_unmap_page_attrs+0x38/0x1d0 enetc_unmap_tx_buff.isra.0+0x6c/0x80 enetc_poll+0x170/0x910 __napi_poll+0x40/0x1e0 net_rx_action+0x164/0x37c __do_softirq+0x128/0x368 run_ksoftirqd+0x68/0x90 smpboot_thread_fn+0x14c/0x190 Code: d503201f f9416800 d503233f d50323bf (f9405400) ---[ end trace 0000000000000000 ]--- Kernel panic - not syncing: Oops: Fatal exception in interrupt ---[ end Kernel panic - not syncing: Oops: Fatal exception in interrupt ]---
The problem seems to be that iommu_group_remove_device() is allowed to run with no coordination whatsoever with the shutdown procedure of the enetc PCI device. In fact, it almost seems as if it implies that the pci_driver :: shutdown() method is mandatory if DMA is used with an IOMMU, otherwise this is inevitable. That was never the case; shutdown methods are optional in device drivers.
This is the call stack that leads to iommu_group_remove_device() during reboot:
kernel_restart
-> device_shutdown
-> platform_shutdown
-> arm_smmu_device_shutdown
-> arm_smmu_device_remove
-> iommu_device_unregister
-> bus_for_each_dev
-> remove_iommu_group
-> iommu_release_device
-> iommu_group_remove_deviceI don't know much about the arm_smmu driver, but arm_smmu_device_shutdown() invoking arm_smmu_device_remove() looks suspicious, since it causes the IOMMU device to unregister and that's where everything starts to unravel. It forces all other devices which depend on IOMMU groups to also point their ->shutdown() to ->remove(), which will make reboot slower overall.
There are 2 moments relevant to this behavior. First was commit b06c076ea962 ("Revert "iommu/arm-smmu: Make arm-smmu explicitly non-modular"") when arm_smmu_device_shutdown() was made to run the exact same thing as arm_smmu_device_remove(). Prior to that, there was no iommu_device_unregister() call in arm_smmu_device_shutdown(). However, that was benign until commit 57365a04c921 ("iommu: Move bus setup to IOMMU device registration"), which made iommu_device_unregister() call remove_iommu_group().
Restore the old shutdown behavior by making remove() call shutdown(), but shutdown() does not call the remove() specific bits.
--- drivers/iommu/arm/arm-smmu/arm-smmu.c | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-)
drivers/iommu/arm/arm-smmu/arm-smmu.c +14 -8
@@ -2188,19 +2188,16 @@ static int arm_smmu_device_probe(structreturn 0 ; } -static int arm_smmu_device_remove (struct platform_device *pdev) +static void arm_smmu_device_shutdown (struct platform_device *pdev) {struct arm_smmu_device *smmu =platform_get_drvdata (pdev);if (!smmu) -return -ENODEV ; +return ;if (!bitmap_empty (smmu->context_map,ARM_SMMU_MAX_CBS ))dev_notice (&pdev->dev,"disabling translation\n" ); -iommu_device_unregister (&smmu->iommu); -iommu_device_sysfs_remove (&smmu->iommu); -arm_smmu_rpm_get (smmu);/* Turn the thing off */ arm_smmu_gr0_write (smmu, ARM_SMMU_GR0_sCR0, ARM_SMMU_sCR0_CLIENTPD);
@@ -2212,12 +2209,21 @@ static int arm_smmu_device_remove(structclk_bulk_disable (smmu->num_clks, smmu->clks);clk_bulk_unprepare (smmu->num_clks, smmu->clks); -return 0 ; } -static void arm_smmu_device_shutdown (struct platform_device *pdev) +static int arm_smmu_device_remove (struct platform_device *pdev) { -arm_smmu_device_remove (pdev); +struct arm_smmu_device *smmu =platform_get_drvdata (pdev); + +if (!smmu) +return -ENODEV ; + +iommu_device_unregister (&smmu->iommu); +iommu_device_sysfs_remove (&smmu->iommu); + +arm_smmu_device_shutdown (pdev); + +return 0 ; }static int __maybe_unused arm_smmu_runtime_resume (struct device *dev)
Greg Kroah-Hartman
maintainerPATCH 87/183 iommu/arm-smmu: Report IOMMU_CAP_CACHE_COHERENCY even betterer
In reply to Greg Kroah-HartmanFrom: Robin Murphy <[email protected]>
commit ac9c5e92dd15b9927e7355ccf79df76a58b44344 upstream.
Although it's vanishingly unlikely that anyone would integrate an SMMU within a coherent interconnect without also making the pagetable walk interface coherent, the same effect happens if a coherent SMMU fails to advertise CTTW correctly. This turns out to be the case on some popular NXP SoCs, where VFIO started failing the IOMMU_CAP_CACHE_COHERENCY test, even though IOMMU_CACHE *was* previously achieving the desired effect anyway thanks to the underlying integration.
While those SoCs stand to gain some more general benefits from a firmware update to override CTTW correctly in DT/ACPI, it's also easy to work around this in Linux as well, to avoid imposing too much on affected users - since the upstream client devices *are* correctly marked as coherent, we can trivially infer their coherent paths through the SMMU as well.
--- drivers/iommu/arm/arm-smmu/arm-smmu.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/iommu/arm/arm-smmu/arm-smmu.c +8 -2
@@ -1319,8 +1319,14 @@ static bool arm_smmu_capable(struct deviswitch (cap) {case IOMMU_CAP_CACHE_COHERENCY : -/* Assume that a coherent TCU implies coherent TBUs */ -return cfg->smmu->features &ARM_SMMU_FEAT_COHERENT_WALK ; +/* +* It's overwhelmingly the case in practice that when the pagetable +* walk interface is connected to a coherent interconnect, all the +* translation interfaces are too. Furthermore if the device is +* natively coherent, then its translation interface must also be. +*/ +return cfg->smmu->features &ARM_SMMU_FEAT_COHERENT_WALK || +device_get_dma_attr (dev) ==DEV_DMA_COHERENT ;case IOMMU_CAP_NOEXEC :return true;default :
Greg Kroah-Hartman
maintainerPATCH 88/183 sched/core: Fix use-after-free bug in dup_user_cpus_ptr()
In reply to Greg Kroah-HartmanFrom: Waiman Long <[email protected]>
commit 87ca4f9efbd7cc649ff43b87970888f2812945b8 upstream.
Since commit 07ec77a1d4e8 ("sched: Allow task CPU affinity to be restricted on asymmetric systems"), the setting and clearing of user_cpus_ptr are done under pi_lock for arm64 architecture. However, dup_user_cpus_ptr() accesses user_cpus_ptr without any lock protection. Since sched_setaffinity() can be invoked from another process, the process being modified may be undergoing fork() at the same time. When racing with the clearing of user_cpus_ptr in __set_cpus_allowed_ptr_locked(), it can lead to user-after-free and possibly double-free in arm64 kernel.
Commit 8f9ea86fdf99 ("sched: Always preserve the user requested cpumask") fixes this problem as user_cpus_ptr, once set, will never be cleared in a task's lifetime. However, this bug was re-introduced in commit 851a723e45d1 ("sched: Always clear user_cpus_ptr in do_set_cpus_allowed()") which allows the clearing of user_cpus_ptr in do_set_cpus_allowed(). This time, it will affect all arches.
Fix this bug by always clearing the user_cpus_ptr of the newly cloned/forked task before the copying process starts and check the user_cpus_ptr state of the source task under pi_lock.
Note to stable, this patch won't be applicable to stable releases. Just copy the new dup_user_cpus_ptr() function over.
--- kernel/sched/core.c | 37 +++++++++++++++++++++++++++++++++---- 1 file changed, 33 insertions(+), 4 deletions(-)
kernel/sched/core.c +33 -4
@@ -2587,14 +2587,43 @@ void do_set_cpus_allowed(struct task_strint dup_user_cpus_ptr (struct task_struct *dst,struct task_struct *src,int node) { -if (!src->user_cpus_ptr) +cpumask_t *user_mask; +unsigned long flags; + +/* +* Always clear dst->user_cpus_ptr first as their user_cpus_ptr's +* may differ by now due to racing. +*/ + dst->user_cpus_ptr =NULL ; + +/* +* This check is racy and losing the race is a valid situation. +* It is not worth the extra overhead of taking the pi_lock on +* every fork/clone. +*/ +if (data_race (!src->user_cpus_ptr))return 0 ; - dst->user_cpus_ptr =kmalloc_node (cpumask_size (),GFP_KERNEL , node); -if (!dst->user_cpus_ptr) + user_mask =kmalloc_node (cpumask_size (),GFP_KERNEL , node); +if (!user_mask)return -ENOMEM ; -cpumask_copy (dst->user_cpus_ptr, src->user_cpus_ptr); +/* +* Use pi_lock to protect content of user_cpus_ptr +* +* Though unlikely, user_cpus_ptr can be reset to NULL by a concurrent +* do_set_cpus_allowed(). +*/ +raw_spin_lock_irqsave (&src->pi_lock, flags); +if (src->user_cpus_ptr) { +swap (dst->user_cpus_ptr, user_mask); +cpumask_copy (dst->user_cpus_ptr, src->user_cpus_ptr); + } +raw_spin_unlock_irqrestore (&src->pi_lock, flags); + +if (unlikely (user_mask)) +kfree (user_mask); +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 89/183 netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
In reply to Greg Kroah-HartmanFrom: Gavrilov Ilia <[email protected]>
commit 9ea4b476cea1b7d461d16dda25ca3c7e616e2d15 upstream.
When first_ip is 0, last_ip is 0xFFFFFFFF, and netmask is 31, the value of an arithmetic expression 2 << (netmask - mask_bits - 1) is subject to overflow due to a failure casting operands to a larger data type before performing the arithmetic.
Note that it's harmless since the value will be checked at the next step.
Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with SVACE.
--- net/netfilter/ipset/ip_set_bitmap_ip.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/netfilter/ipset/ip_set_bitmap_ip.c +2 -2
@@ -308,8 +308,8 @@ bitmap_ip_create(struct net *net, structreturn -IPSET_ERR_BITMAP_RANGE ;pr_debug ("mask_bits %u, netmask %u\n" , mask_bits, netmask); - hosts =2 << (32 - netmask -1 ); - elements =2 << (netmask - mask_bits -1 ); + hosts =2U << (32 - netmask -1 ); + elements =2UL << (netmask - mask_bits -1 ); }if (elements >IPSET_BITMAP_MAX_RANGE +1 )return -IPSET_ERR_BITMAP_RANGE_SIZE ;
Greg Kroah-Hartman
maintainerPATCH 90/183 selftests: netfilter: fix transaction test script timeout handling
In reply to Greg Kroah-HartmanFrom: Florian Westphal <[email protected]>
commit c273289fac370b6488757236cd62cc2cf04830b7 upstream.
The kselftest framework uses a default timeout of 45 seconds for all test scripts.
Increase the timeout to two minutes for the netfilter tests, this should hopefully be enough,
Make sure that, should the script be canceled, the net namespace and the spawned ping instances are removed.
--- tools/testing/selftests/netfilter/nft_trans_stress.sh | 16 +++++++++------- tools/testing/selftests/netfilter/settings | 1 + 2 files changed, 10 insertions(+), 7 deletions(-) create mode 100644 tools/testing/selftests/netfilter/settings
tools/testing/selftests/netfilter/nft_trans_stress.sh +9 -7
@@ -10,12 +10,20 @@ ksft_skip=4 testns=testns-$(mktemp -u "XXXXXXXX") +tmp="" tables="foo bar baz quux" global_ret=0 eret=0 lret=0 +cleanup() { + ip netns pids "$testns" | xargs kill 2>/dev/null + ip netns del "$testns" + + rm -f "$tmp" +} + check_result() { local r=$1
@@ -43,6 +51,7 @@ if [ $? -ne 0 ];then exit $ksft_skip fi +trap cleanup EXIT tmp=$(mktemp) for table in $tables; do
@@ -139,11 +148,4 @@ done check_result $lret "add/delete with nftrace enabled" -pkill -9 ping - -wait - -rm -f "$tmp" -ip netns del "$testns" - exit $global_ret
tools/testing/selftests/netfilter/settings new file +1 -0
@@ -0,0 +1 @@ +timeout=120
Greg Kroah-Hartman
maintainerPATCH 91/183 powerpc/imc-pmu: Fix use of mutex in IRQs disabled section
In reply to Greg Kroah-HartmanFrom: Kajol Jain <[email protected]>
commit 76d588dddc459fefa1da96e0a081a397c5c8e216 upstream.
Current imc-pmu code triggers a WARNING with CONFIG_DEBUG_ATOMIC_SLEEP and CONFIG_PROVE_LOCKING enabled, while running a thread_imc event.
Command to trigger the warning:
# perf stat -e thread_imc/CPM_CS_FROM_L4_MEM_X_DPTEG/ sleep 5
Performance counter stats for 'sleep 5':
0 thread_imc/CPM_CS_FROM_L4_MEM_X_DPTEG/
5.002117947 seconds time elapsed
0.000131000 seconds user
0.001063000 seconds sysBelow is snippet of the warning in dmesg:
BUG: sleeping function called from invalid context at kernel/locking/mutex.c:580
in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 2869, name: perf-exec
preempt_count: 2, expected: 0
4 locks held by perf-exec/2869:
#0: c00000004325c540 (&sig->cred_guard_mutex){+.+.}-{3:3}, at: bprm_execve+0x64/0xa90
#1: c00000004325c5d8 (&sig->exec_update_lock){++++}-{3:3}, at: begin_new_exec+0x460/0xef0
#2: c0000003fa99d4e0 (&cpuctx_lock){-...}-{2:2}, at: perf_event_exec+0x290/0x510
#3: c000000017ab8418 (&ctx->lock){....}-{2:2}, at: perf_event_exec+0x29c/0x510
irq event stamp: 4806
hardirqs last enabled at (4805): [<c000000000f65b94>] _raw_spin_unlock_irqrestore+0x94/0xd0
hardirqs last disabled at (4806): [<c0000000003fae44>] perf_event_exec+0x394/0x510
softirqs last enabled at (0): [<c00000000013c404>] copy_process+0xc34/0x1ff0
softirqs last disabled at (0): [<0000000000000000>] 0x0
CPU: 36 PID: 2869 Comm: perf-exec Not tainted 6.2.0-rc2-00011-g1247637727f2 #61
Hardware name: 8375-42A POWER9 0x4e1202 opal:v7.0-16-g9b85f7d961 PowerNV
Call Trace:
dump_stack_lvl+0x98/0xe0 (unreliable)
__might_resched+0x2f8/0x310
__mutex_lock+0x6c/0x13f0
thread_imc_event_add+0xf4/0x1b0
event_sched_in+0xe0/0x210
merge_sched_in+0x1f0/0x600
visit_groups_merge.isra.92.constprop.166+0x2bc/0x6c0
ctx_flexible_sched_in+0xcc/0x140
ctx_sched_in+0x20c/0x2a0
ctx_resched+0x104/0x1c0
perf_event_exec+0x340/0x510
begin_new_exec+0x730/0xef0
load_elf_binary+0x3f8/0x1e10
...
do not call blocking ops when !TASK_RUNNING; state=2001 set at [<00000000fd63e7cf>] do_nanosleep+0x60/0x1a0
WARNING: CPU: 36 PID: 2869 at kernel/sched/core.c:9912 __might_sleep+0x9c/0xb0
CPU: 36 PID: 2869 Comm: sleep Tainted: G W 6.2.0-rc2-00011-g1247637727f2 #61
Hardware name: 8375-42A POWER9 0x4e1202 opal:v7.0-16-g9b85f7d961 PowerNV
NIP: c000000000194a1c LR: c000000000194a18 CTR: c000000000a78670
REGS: c00000004d2134e0 TRAP: 0700 Tainted: G W (6.2.0-rc2-00011-g1247637727f2)
MSR: 9000000000021033 <SF,HV,ME,IR,DR,RI,LE> CR: 48002824 XER: 00000000
CFAR: c00000000013fb64 IRQMASK: 1The above warning triggered because the current imc-pmu code uses mutex lock in interrupt disabled sections. The function mutex_lock() internally calls __might_resched(), which will check if IRQs are disabled and in case IRQs are disabled, it will trigger the warning.
Fix the issue by changing the mutex lock to spinlock.
--- arch/powerpc/include/asm/imc-pmu.h | 2 arch/powerpc/perf/imc-pmu.c | 136 +++++++++++++++++-------------------- 2 files changed, 67 insertions(+), 71 deletions(-)
arch/powerpc/include/asm/imc-pmu.h +1 -1
@@ -137,7 +137,7 @@ struct imc_pmu {* are inited. */ struct imc_pmu_ref { -struct mutex lock; +spinlock_t lock;unsigned int id;int refc; };
arch/powerpc/perf/imc-pmu.c +66 -70
474 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 92/183 x86/boot: Avoid using Intel mnemonics in AT&T syntax asm
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
commit 7c6dd961d0c8e7e8f9fdc65071fb09ece702e18d upstream.
With 'GNU assembler (GNU Binutils for Debian) 2.39.90.20221231' the build now reports:
arch/x86/realmode/rm/../../boot/bioscall.S: Assembler messages:
arch/x86/realmode/rm/../../boot/bioscall.S:35: Warning: found movsd'; assuming movsl' was meant arch/x86/realmode/rm/../../boot/bioscall.S:70: Warning: found movsd'; assuming movsl' was meant
arch/x86/boot/bioscall.S: Assembler messages:
arch/x86/boot/bioscall.S:35: Warning: found movsd'; assuming movsl' was meant arch/x86/boot/bioscall.S:70: Warning: found movsd'; assuming movsl' was meant
Which is due to:
PR gas/29525
Note that with the dropped CMPSD and MOVSD Intel Syntax string insn templates taking operands, mixed IsString/non-IsString template groups (with memory operands) cannot occur anymore. With that maybe_adjust_templates() becomes unnecessary (and is hence being removed).
More details: https://sourceware.org/bugzilla/show_bug.cgi?id=29525
Borislav Petkov further explains:
" the particular problem here is is that the 'd' suffix is
"conflicting" in the sense that you can have SSE mnemonics like movsD %xmm... and the same thing also for string ops (which is the case here) so apparently the agreement in binutils land is to use the always accepted suffixes 'l' or 'q' and phase out 'd' slowly... "
--- arch/x86/boot/bioscall.S | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/boot/bioscall.S +2 -2
@@ -32,7 +32,7 @@ intcall: movw %dx, %si movw %sp, %di movw $11, %cx - rep; movsd + rep; movsl /* Pop full state from the stack */ popal
@@ -67,7 +67,7 @@ intcall: jz 4f movw %sp, %si movw $11, %cx - rep; movsd + rep; movsl 4: addw $44, %sp /* Restore state and return */
Greg Kroah-Hartman
maintainerPATCH 93/183 EDAC/device: Fix period calculation in edac_device_reset_delay_period()
In reply to Greg Kroah-HartmanFrom: Eliav Farber <[email protected]>
commit e84077437902ec99eba0a6b516df772653f142c7 upstream.
Fix period calculation in case user sets a value of 1000. The input of round_jiffies_relative() should be in jiffies and not in milli-seconds.
[ bp: Use the same code pattern as in edac_device_workq_setup() for
clarity. ]
--- drivers/edac/edac_device.c | 17 ++++++++--------- drivers/edac/edac_module.h | 2 +- 2 files changed, 9 insertions(+), 10 deletions(-)
drivers/edac/edac_device.c +8 -9
@@ -394,17 +394,16 @@ static void edac_device_workq_teardown(s* Then restart the workq on the new delay */ void edac_device_reset_delay_period (struct edac_device_ctl_info *edac_dev, -unsigned long value) +unsigned long msec) { -unsigned long jiffs =msecs_to_jiffies (value); + edac_dev->poll_msec = msec; + edac_dev->delay =msecs_to_jiffies (msec); -if (value ==1000 ) - jiffs =round_jiffies_relative (value); - - edac_dev->poll_msec = value; - edac_dev->delay = jiffs; - -edac_mod_work (&edac_dev->work, jiffs); +/* See comment in edac_device_workq_setup() above */ +if (edac_dev->poll_msec ==1000 ) +edac_mod_work (&edac_dev->work,round_jiffies_relative (edac_dev->delay)); +else +edac_mod_work (&edac_dev->work, edac_dev->delay); }int edac_device_alloc_index (void )
drivers/edac/edac_module.h +1 -1
@@ -52,7 +52,7 @@ bool edac_stop_work(struct delayed_workbool edac_mod_work (struct delayed_work *work,unsigned long delay);extern void edac_device_reset_delay_period (struct edac_device_ctl_info - *edac_dev,unsigned long value); + *edac_dev,unsigned long msec);extern void edac_mc_reset_delay_period (unsigned long value);/*
Greg Kroah-Hartman
maintainerPATCH 94/183 x86/pat: Fix pat_x_mtrr_type() for MTRR disabled case
In reply to Greg Kroah-HartmanFrom: Juergen Gross <[email protected]>
commit 90b926e68f500844dff16b5bcea178dc55cf580a upstream.
Since
72cbc8f04fe2 ("x86/PAT: Have pat_enabled() properly reflect state when running on Xen")
PAT can be enabled without MTRR.
This has resulted in problems e.g. for a SEV-SNP guest running under Hyper-V, when trying to establish a new mapping via memremap() with WB caching mode, as pat_x_mtrr_type() will call mtrr_type_lookup(), which in turn is returning MTRR_TYPE_INVALID due to MTRR being disabled in this configuration.
The result is a mapping with UC- caching, leading to severe performance degradation.
Fix that by handling MTRR_TYPE_INVALID the same way as MTRR_TYPE_WRBACK in pat_x_mtrr_type() because MTRR_TYPE_INVALID means MTRRs are disabled.
[ bp: Massage commit message. ]
--- arch/x86/mm/pat/memtype.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/x86/mm/pat/memtype.c +2 -1
@@ -434,7 +434,8 @@ static unsigned long pat_x_mtrr_type(u64u8 mtrr_type, uniform; mtrr_type =mtrr_type_lookup (start, end, &uniform); -if (mtrr_type !=MTRR_TYPE_WRBACK ) +if (mtrr_type !=MTRR_TYPE_WRBACK && + mtrr_type !=MTRR_TYPE_INVALID )return _PAGE_CACHE_MODE_UC_MINUS;return _PAGE_CACHE_MODE_WB;
Greg Kroah-Hartman
maintainerPATCH 95/183 x86/resctrl: Fix task CLOSID/RMID update race
In reply to Greg Kroah-HartmanFrom: Peter Newman <[email protected]>
commit fe1f0714385fbcf76b0cbceb02b7277d842014fc upstream.
When the user moves a running task to a new rdtgroup using the task's file interface or by deleting its rdtgroup, the resulting change in CLOSID/RMID must be immediately propagated to the PQR_ASSOC MSR on the task(s) CPUs.
x86 allows reordering loads with prior stores, so if the task starts running between a task_curr() check that the CPU hoisted before the stores in the CLOSID/RMID update then it can start running with the old CLOSID/RMID until it is switched again because __rdtgroup_move_task() failed to determine that it needs to be interrupted to obtain the new CLOSID/RMID.
Refer to the diagram below:
CPU 0 CPU 1
----- -----__rdtgroup_move_task():
curr <- t1->cpu->rq->curr
__schedule():
rq->curr <- t1
resctrl_sched_in():
t1->{closid,rmid} -> {1,1} t1->{closid,rmid} <- {2,2}
if (curr == t1) // false
IPI(t1->cpu)
A similar race impacts rdt_move_group_tasks(), which updates tasks in a deleted rdtgroup.
In both cases, use smp_mb() to order the task_struct::{closid,rmid} stores before the loads in task_curr(). In particular, in the rdt_move_group_tasks() case, simply execute an smp_mb() on every iteration with a matching task.
It is possible to use a single smp_mb() in rdt_move_group_tasks(), but this would require two passes and a means of remembering which task_structs were updated in the first loop. However, benchmarking results below showed too little performance impact in the simple approach to justify implementing the two-pass approach.
Times below were collected using perf stat to measure the time to remove a group containing a 1600-task, parallel workload.
CPU: Intel(R) Xeon(R) Platinum P-8136 CPU @ 2.00GHz (112 threads)
# mkdir /sys/fs/resctrl/test # echo $$ > /sys/fs/resctrl/test/tasks # perf bench sched messaging -g 40 -l 100000
task-clock time ranges collected using:
# perf stat rmdir /sys/fs/resctrl/test
Baseline: 1.54 - 1.60 ms smp_mb() every matching task: 1.57 - 1.67 ms
[ bp: Massage commit message. ]
--- arch/x86/kernel/cpu/resctrl/rdtgroup.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
arch/x86/kernel/cpu/resctrl/rdtgroup.c +11 -1
@@ -580,8 +580,10 @@ static int __rdtgroup_move_task(struct t/* * Ensure the task's closid and rmid are written before determining if * the task is current that will decide if it will be interrupted. +* This pairs with the full barrier between the rq->curr update and +* resctrl_sched_in() during context switch. */ -barrier (); +smp_mb ();/* * By now, the task's closid and rmid are set. If the task is current
@@ -2402,6 +2404,14 @@ static void rdt_move_group_tasks(structWRITE_ONCE (t->rmid, to->mon.rmid);/* +* Order the closid/rmid stores above before the loads +* in task_curr(). This pairs with the full barrier +* between the rq->curr update and resctrl_sched_in() +* during context switch. +*/ +smp_mb (); + +/* * If the task is on a CPU, set the CPU in the mask. * The detection is inaccurate as tasks might move or * schedule before the smp function call takes place.
Greg Kroah-Hartman
maintainerPATCH 96/183 x86/resctrl: Fix event counts regression in reused RMIDs
In reply to Greg Kroah-HartmanFrom: Peter Newman <[email protected]>
commit 2a81160d29d65b5876ab3f824fda99ae0219f05e upstream.
When creating a new monitoring group, the RMID allocated for it may have been used by a group which was previously removed. In this case, the hardware counters will have non-zero values which should be deducted from what is reported in the new group's counts.
resctrl_arch_reset_rmid() initializes the prev_msr value for counters to 0, causing the initial count to be charged to the new group. Resurrect __rmid_read() and use it to initialize prev_msr correctly.
Unlike before, __rmid_read() checks for error bits in the MSR read so that callers don't need to.
--- arch/x86/kernel/cpu/resctrl/monitor.c | 49 ++++++++++++++++++--------- 1 file changed, 33 insertions(+), 16 deletions(-)
arch/x86/kernel/cpu/resctrl/monitor.c +33 -16
@@ -146,6 +146,30 @@ static inline struct rmid_entry *__rmid_entry(u32 rmid)return entry; } +static int __rmid_read (u32 rmid,enum resctrl_event_id eventid,u64 *val) +{ +u64 msr_val; + +/* +* As per the SDM, when IA32_QM_EVTSEL.EvtID (bits 7:0) is configured +* with a valid event code for supported resource type and the bits +* IA32_QM_EVTSEL.RMID (bits 41:32) are configured with valid RMID, +* IA32_QM_CTR.data (bits 61:0) reports the monitored data. +* IA32_QM_CTR.Error (bit 63) and IA32_QM_CTR.Unavailable (bit 62) +* are error bits. +*/ +wrmsr (MSR_IA32_QM_EVTSEL , eventid, rmid); +rdmsrl (MSR_IA32_QM_CTR , msr_val); + +if (msr_val &RMID_VAL_ERROR ) +return -EIO ; +if (msr_val &RMID_VAL_UNAVAIL ) +return -EINVAL ; + + *val = msr_val; +return 0 ; +} +static struct arch_mbm_state *get_arch_mbm_state (struct rdt_hw_domain *hw_dom,u32 rmid,enum resctrl_event_id eventid)
@@ -172,8 +196,12 @@ void resctrl_arch_reset_rmid(struct rdt_resource *r, struct rdt_domain *d,struct arch_mbm_state *am; am =get_arch_mbm_state (hw_dom, rmid, eventid); -if (am) +if (am) {memset (am,0 ,sizeof (*am)); + +/* Record any initial, non-zero count value. */ +__rmid_read (rmid, eventid, &am->prev_msr); + } }static u64 mbm_overflow_count (u64 prev_msr,u64 cur_msr,unsigned int width)
@@ -191,25 +219,14 @@ int resctrl_arch_rmid_read(struct rdt_resource *r, struct rdt_domain *d,struct rdt_hw_domain *hw_dom =resctrl_to_arch_dom (d);struct arch_mbm_state *am;u64 msr_val, chunks; +int ret;if (!cpumask_test_cpu (smp_processor_id (), &d->cpu_mask))return -EINVAL ; -/* -* As per the SDM, when IA32_QM_EVTSEL.EvtID (bits 7:0) is configured -* with a valid event code for supported resource type and the bits -* IA32_QM_EVTSEL.RMID (bits 41:32) are configured with valid RMID, -* IA32_QM_CTR.data (bits 61:0) reports the monitored data. -* IA32_QM_CTR.Error (bit 63) and IA32_QM_CTR.Unavailable (bit 62) -* are error bits. -*/ -wrmsr (MSR_IA32_QM_EVTSEL , eventid, rmid); -rdmsrl (MSR_IA32_QM_CTR , msr_val); - -if (msr_val &RMID_VAL_ERROR ) -return -EIO ; -if (msr_val &RMID_VAL_UNAVAIL ) -return -EINVAL ; + ret =__rmid_read (rmid, eventid, &msr_val); +if (ret) +return ret; am =get_arch_mbm_state (hw_dom, rmid, eventid);if (am) {
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 97/183 regulator: da9211: Use irq handler when ready
In reply to Greg Kroah-HartmanFrom: Ricardo Ribalda <[email protected]>
[ Upstream commit 02228f6aa6a64d588bc31e3267d05ff184d772eb ]
If the system does not come from reset (like when it is kexec()), the regulator might have an IRQ waiting for us.
If we enable the IRQ handler before its structures are ready, we crash.
This patch fixes:
[ 1.141839] Unable to handle kernel read from unreadable memory at virtual address 0000000000000078 [ 1.316096] Call trace: [ 1.316101] blocking_notifier_call_chain+0x20/0xa8 [ 1.322757] cpu cpu0: dummy supplies not allowed for exclusive requests [ 1.327823] regulator_notifier_call_chain+0x1c/0x2c [ 1.327825] da9211_irq_handler+0x68/0xf8 [ 1.327829] irq_thread+0x11c/0x234 [ 1.327833] kthread+0x13c/0x154
--- drivers/regulator/da9211-regulator.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/regulator/da9211-regulator.c +6 -5
@@ -498,6 +498,12 @@ static int da9211_i2c_probe(struct i2c_client *i2c) chip->chip_irq = i2c->irq; + ret =da9211_regulator_init (chip); +if (ret <0 ) { +dev_err (chip->dev,"Failed to initialize regulator: %d\n" , ret); +return ret; + } +if (chip->chip_irq !=0 ) { ret = devm_request_threaded_irq(chip->dev, chip->chip_irq, NULL, da9211_irq_handler,
@@ -512,11 +518,6 @@ static int da9211_i2c_probe(struct i2c_client *i2c)dev_warn (chip->dev,"No IRQ configured\n" ); } - ret =da9211_regulator_init (chip); - -if (ret <0 ) -dev_err (chip->dev,"Failed to initialize regulator: %d\n" , ret); -return ret; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 98/183 scsi: storvsc: Fix swiotlb bounce buffer leak in confidential VM
In reply to Greg Kroah-HartmanFrom: Michael Kelley <[email protected]>
[ Upstream commit 67ff3d0a49f3d445c3922e30a54e03c161da561e ]
storvsc_queuecommand() maps the scatter/gather list using scsi_dma_map(), which in a confidential VM allocates swiotlb bounce buffers. If the I/O submission fails in storvsc_do_io(), the I/O is typically retried by higher level code, but the bounce buffer memory is never freed. The mostly like cause of I/O submission failure is a full VMBus channel ring buffer, which is not uncommon under high I/O loads. Eventually enough bounce buffer memory leaks that the confidential VM can't do any I/O. The same problem can arise in a non-confidential VM with kernel boot parameter swiotlb=force.
Fix this by doing scsi_dma_unmap() in the case of an I/O submission error, which frees the bounce buffer memory.
--- drivers/scsi/storvsc_drv.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/scsi/storvsc_drv.c +3 -0
@@ -1823,6 +1823,9 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd) ret =storvsc_do_io (dev, cmd_request,get_cpu ());put_cpu (); +if (ret) +scsi_dma_unmap (scmnd); +if (ret == -EAGAIN ) {/* no more space */ ret =SCSI_MLQUEUE_DEVICE_BUSY ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 99/183 scsi: mpi3mr: Refer CONFIG_SCSI_MPI3MR in Makefile
In reply to Greg Kroah-HartmanFrom: Shin'ichiro Kawasaki <[email protected]>
[ Upstream commit f0a43ba6c66cc0688e2748d986a1459fdd3442ef ]
When Kconfig item CONFIG_SCSI_MPI3MR was introduced for mpi3mr driver, the Makefile of the driver was not modified to refer the Kconfig item.
As a result, mpi3mr.ko is built regardless of the Kconfig item value y or m. Also, if 'make localmodconfig' can not find the Kconfig item in the Makefile, then it does not generate CONFIG_SCSI_MPI3MR=m even when mpi3mr.ko is loaded on the system.
Refer to the Kconfig item to avoid the issues.
--- drivers/scsi/mpi3mr/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/mpi3mr/Makefile +1 -1
@@ -1,5 +1,5 @@ # mpi3mr makefile -obj-m += mpi3mr.o +obj-$(CONFIG_SCSI_MPI3MR) += mpi3mr.o mpi3mr-y += mpi3mr_os.o \ mpi3mr_fw.o \ mpi3mr_app.o \
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 100/183 scsi: ufs: core: WLUN suspend SSU/enter hibern8 fail recovery
In reply to Greg Kroah-HartmanFrom: Peter Wang <[email protected]>
[ Upstream commit 1a5665fc8d7a000671ebd3fe69c6f9acf1e0dcd9 ]
When SSU/enter hibern8 fail in WLUN suspend flow, trigger the error handler and return busy to break the suspend. Otherwise the consumer will get stuck in runtime suspend status.
--- drivers/ufs/core/ufshcd.c | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+)
drivers/ufs/core/ufshcd.c +26 -0
@@ -6094,6 +6094,14 @@ void ufshcd_schedule_eh_work(struct ufs_hba *hba) } } +static void ufshcd_force_error_recovery (struct ufs_hba *hba) +{ +spin_lock_irq (hba->host->host_lock); + hba->force_reset = true; +ufshcd_schedule_eh_work (hba); +spin_unlock_irq (hba->host->host_lock); +} +static void ufshcd_clk_scaling_allow (struct ufs_hba *hba,bool allow) {down_write (&hba->clk_scaling_lock);
@@ -9066,6 +9074,15 @@ static int __ufshcd_wl_suspend(struct ufs_hba *hba, enum ufs_pm_op pm_op)if (!hba->dev_info.b_rpm_dev_flush_capable) { ret =ufshcd_set_dev_pwr_mode (hba, req_dev_pwr_mode); +if (ret && pm_op !=UFS_SHUTDOWN_PM ) { +/* +* If return err in suspend flow, IO will hang. +* Trigger error handler and break suspend for +* error recovery. +*/ +ufshcd_force_error_recovery (hba); + ret = -EBUSY ; + }if (ret) goto enable_scaling; }
@@ -9077,6 +9094,15 @@ static int __ufshcd_wl_suspend(struct ufs_hba *hba, enum ufs_pm_op pm_op)*/ check_for_bkops = !ufshcd_is_ufs_dev_deepsleep (hba); ret =ufshcd_link_state_transition (hba, req_link_state, check_for_bkops); +if (ret && pm_op !=UFS_SHUTDOWN_PM ) { +/* +* If return err in suspend flow, IO will hang. +* Trigger error handler and break suspend for +* error recovery. +*/ +ufshcd_force_error_recovery (hba); + ret = -EBUSY ; + }if (ret) goto set_dev_active;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 101/183 ASoC: Intel: fix sof-nau8825 link failure
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit 63f3d99b7efe4c5404a9388c05780917099cecf4 ]
The snd-soc-sof_nau8825.ko module fails to link unless the sof_realtek_common support is also enabled:
ERROR: modpost: "sof_rt1015p_codec_conf" [sound/soc/intel/boards/snd-soc-sof_nau8825.ko] undefined!
ERROR: modpost: "sof_rt1015p_dai_link" [sound/soc/intel/boards/snd-soc-sof_nau8825.ko] undefined!
--- sound/soc/intel/boards/Kconfig | 1 + 1 file changed, 1 insertion(+)
sound/soc/intel/boards/Kconfig +1 -0
@@ -558,6 +558,7 @@ config SND_SOC_INTEL_SOF_NAU8825_MACH select SND_SOC_HDAC_HDMI select SND_SOC_INTEL_HDA_DSP_COMMON select SND_SOC_INTEL_SOF_MAXIM_COMMON + select SND_SOC_INTEL_SOF_REALTEK_COMMON help This adds support for ASoC machine driver for SOF platforms with nau8825 codec.
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 102/183 ASoC: Intel: sof_nau8825: support rt1015p speaker amplifier
In reply to Greg Kroah-HartmanFrom: Brent Lu <[email protected]>
[ Upstream commit 13c459fa37c9f26e9bf884a832dd67598b5c4d3e ]
Add rt1015p speaker amplifier support with a new board info 'adl_rt1015p_nau8825' which supports NAU8825 on SSP0 and ALC1015Q on SSP1.
Stable-dep-of: 3e78986a840d ("ASoC: Intel: sof-nau8825: fix module alias overflow")
--- sound/soc/intel/boards/sof_nau8825.c | 16 ++++++++++++++++ .../soc/intel/common/soc-acpi-intel-adl-match.c | 12 ++++++++++++ 2 files changed, 28 insertions(+)
sound/soc/intel/boards/sof_nau8825.c +16 -0
@@ -47,6 +47,7 @@#define SOF_RT1019P_SPEAKER_AMP_PRESENT BIT(14)#define SOF_MAX98373_SPEAKER_AMP_PRESENT BIT(15)#define SOF_MAX98360A_SPEAKER_AMP_PRESENT BIT(16) +#define SOF_RT1015P_SPEAKER_AMP_PRESENT BIT(17)static unsigned long sof_nau8825_quirk =SOF_NAU8825_SSP_CODEC (0 );
@@ -483,6 +484,8 @@ static struct snd_soc_dai_link *sof_card_dai_links_create(struct device *dev, }else if (sof_nau8825_quirk &SOF_MAX98360A_SPEAKER_AMP_PRESENT ) {max_98360a_dai_link (&links[id]); + }else if (sof_nau8825_quirk &SOF_RT1015P_SPEAKER_AMP_PRESENT ) { +sof_rt1015p_dai_link (&links[id]); }else { goto devm_err; }
@@ -576,6 +579,8 @@ static int sof_audio_probe(struct platform_device *pdev)if (sof_nau8825_quirk &SOF_MAX98373_SPEAKER_AMP_PRESENT )max_98373_set_codec_conf (&sof_audio_card_nau8825); +else if (sof_nau8825_quirk &SOF_RT1015P_SPEAKER_AMP_PRESENT ) +sof_rt1015p_codec_conf (&sof_audio_card_nau8825);if (sof_nau8825_quirk &SOF_SSP_BT_OFFLOAD_PRESENT ) sof_audio_card_nau8825.num_links++;
@@ -642,6 +647,16 @@ static const struct platform_device_id board_ids[] = { SOF_SSP_BT_OFFLOAD_PRESENT), }, + { + .name = "adl_rt1015p_nau8825", + .driver_data = (kernel_ulong_t)(SOF_NAU8825_SSP_CODEC(0) | + SOF_SPEAKER_AMP_PRESENT | + SOF_RT1015P_SPEAKER_AMP_PRESENT | + SOF_NAU8825_SSP_AMP(1) | + SOF_NAU8825_NUM_HDMIDEV(4) | + SOF_BT_OFFLOAD_SSP(2) | + SOF_SSP_BT_OFFLOAD_PRESENT), + }, { } };MODULE_DEVICE_TABLE (platform, board_ids);
@@ -663,3 +678,4 @@ MODULE_AUTHOR("Mac Chiang <[email protected]>");MODULE_LICENSE ("GPL" );MODULE_IMPORT_NS (SND_SOC_INTEL_HDA_DSP_COMMON );MODULE_IMPORT_NS (SND_SOC_INTEL_SOF_MAXIM_COMMON ); +MODULE_IMPORT_NS (SND_SOC_INTEL_SOF_REALTEK_COMMON );
sound/soc/intel/common/soc-acpi-intel-adl-match.c +12 -0
@@ -430,6 +430,11 @@ static const struct snd_soc_acpi_codecs adl_rt5682_rt5682s_hp = { .codecs = {"10EC5682", "RTL5682"}, }; +static const struct snd_soc_acpi_codecs adl_rt1015p_amp = { + .num_codecs =1 , + .codecs = {"RTL1015" } +}; +static const struct snd_soc_acpi_codecs adl_rt1019p_amp = { .num_codecs =1 , .codecs = {"RTL1019"}
@@ -495,6 +500,13 @@ struct snd_soc_acpi_mach snd_soc_acpi_intel_adl_machines[] = { .quirk_data = &adl_rt1019p_amp, .sof_tplg_filename = "sof-adl-rt1019-rt5682.tplg", }, + { + .id = "10508825", + .drv_name = "adl_rt1015p_nau8825", + .machine_quirk = snd_soc_acpi_codec_list, + .quirk_data = &adl_rt1015p_amp, + .sof_tplg_filename = "sof-adl-rt1015-nau8825.tplg", + }, { .id = "10508825", .drv_name = "sof_nau8825",
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 103/183 ASoC: Intel: sof-nau8825: fix module alias overflow
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit 3e78986a840d59dd27e636eae3f52dc11125c835 ]
The maximum name length for a platform_device_id entry is 20 characters including the trailing NUL byte. The sof_nau8825.c file exceeds that, which causes an obscure error message:
sound/soc/intel/boards/snd-soc-sof_nau8825.mod.c:35:45: error: illegal character encoding in string literal [-Werror,-Winvalid-source-encoding]
MODULE_ALIAS("platform:adl_max98373_nau8825<U+0018><AA>");
^~~~
include/linux/module.h:168:49: note: expanded from macro 'MODULE_ALIAS'
^~~~~~
include/linux/module.h:165:56: note: expanded from macro 'MODULE_INFO'
^~~~include/linux/moduleparam.h:26:47: note: expanded from macro '__MODULE_INFO'
= __MODULE_INFO_PREFIX __stringify(tag) "=" info
I could not figure out how to make the module handling robust enough to handle this better, but as a quick fix, using slightly shorter names that are still unique avoids the build issue.
--- sound/soc/intel/boards/sof_nau8825.c | 8 ++++---- sound/soc/intel/common/soc-acpi-intel-adl-match.c | 8 ++++---- 2 files changed, 8 insertions(+), 8 deletions(-)
sound/soc/intel/boards/sof_nau8825.c +4 -4
@@ -618,7 +618,7 @@ static const struct platform_device_id board_ids[] = { }, { - .name = "adl_rt1019p_nau8825", + .name = "adl_rt1019p_8825", .driver_data = (kernel_ulong_t)(SOF_NAU8825_SSP_CODEC(0) | SOF_SPEAKER_AMP_PRESENT | SOF_RT1019P_SPEAKER_AMP_PRESENT |
@@ -626,7 +626,7 @@ static const struct platform_device_id board_ids[] = { SOF_NAU8825_NUM_HDMIDEV(4)), }, { - .name = "adl_max98373_nau8825", + .name = "adl_max98373_8825", .driver_data = (kernel_ulong_t)(SOF_NAU8825_SSP_CODEC(0) | SOF_SPEAKER_AMP_PRESENT | SOF_MAX98373_SPEAKER_AMP_PRESENT |
@@ -637,7 +637,7 @@ static const struct platform_device_id board_ids[] = { }, {/* The limitation of length of char array, shorten the name */ - .name = "adl_mx98360a_nau8825", + .name = "adl_mx98360a_8825", .driver_data = (kernel_ulong_t)(SOF_NAU8825_SSP_CODEC(0) | SOF_SPEAKER_AMP_PRESENT | SOF_MAX98360A_SPEAKER_AMP_PRESENT |
@@ -648,7 +648,7 @@ static const struct platform_device_id board_ids[] = { }, { - .name = "adl_rt1015p_nau8825", + .name = "adl_rt1015p_8825", .driver_data = (kernel_ulong_t)(SOF_NAU8825_SSP_CODEC(0) | SOF_SPEAKER_AMP_PRESENT | SOF_RT1015P_SPEAKER_AMP_PRESENT |
sound/soc/intel/common/soc-acpi-intel-adl-match.c +4 -4
@@ -474,21 +474,21 @@ struct snd_soc_acpi_mach snd_soc_acpi_intel_adl_machines[] = { }, { .id = "10508825", - .drv_name = "adl_rt1019p_nau8825", + .drv_name = "adl_rt1019p_8825", .machine_quirk = snd_soc_acpi_codec_list, .quirk_data = &adl_rt1019p_amp, .sof_tplg_filename = "sof-adl-rt1019-nau8825.tplg", }, { .id = "10508825", - .drv_name = "adl_max98373_nau8825", + .drv_name = "adl_max98373_8825", .machine_quirk = snd_soc_acpi_codec_list, .quirk_data = &adl_max98373_amp, .sof_tplg_filename = "sof-adl-max98373-nau8825.tplg", }, { .id = "10508825", - .drv_name = "adl_mx98360a_nau8825", + .drv_name = "adl_mx98360a_8825", .machine_quirk = snd_soc_acpi_codec_list, .quirk_data = &adl_max98360a_amp, .sof_tplg_filename = "sof-adl-max98360a-nau8825.tplg",
@@ -502,7 +502,7 @@ struct snd_soc_acpi_mach snd_soc_acpi_intel_adl_machines[] = { }, { .id = "10508825", - .drv_name = "adl_rt1015p_nau8825", + .drv_name = "adl_rt1015p_8825", .machine_quirk = snd_soc_acpi_codec_list, .quirk_data = &adl_rt1015p_amp, .sof_tplg_filename = "sof-adl-rt1015-nau8825.tplg",
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 104/183 drm/msm/dpu: Fix some kernel-doc comments
In reply to Greg Kroah-HartmanFrom: Yang Li <[email protected]>
[ Upstream commit 1bdeb321d1f856346fe0078af09c9e7ffbd2ca7a ]
Make the description of @init to @p in dpu_encoder_phys_wb_init() and remove @wb_roi in dpu_encoder_phys_wb_setup_fb() to clear the below warnings:
drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c:139: warning: Excess function parameter 'wb_roi' description in 'dpu_encoder_phys_wb_setup_fb' drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c:699: warning: Function parameter or member 'p' not described in 'dpu_encoder_phys_wb_init' drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c:699: warning: Excess function parameter 'init' description in 'dpu_encoder_phys_wb_init'
Patchwork: https://patchwork.freedesktop.org/patch/511605/
--- drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c +1 -2
@@ -132,7 +132,6 @@ static void dpu_encoder_phys_wb_set_qos(struct dpu_encoder_phys *phys_enc)* dpu_encoder_phys_wb_setup_fb - setup output framebuffer * @phys_enc: Pointer to physical encoder * @fb: Pointer to output framebuffer -* @wb_roi: Pointer to output region of interest */ static void dpu_encoder_phys_wb_setup_fb (struct dpu_encoder_phys *phys_enc,struct drm_framebuffer *fb)
@@ -692,7 +691,7 @@ static void dpu_encoder_phys_wb_init_ops(struct dpu_encoder_phys_ops *ops)/** * dpu_encoder_phys_wb_init - initialize writeback encoder -* @init: Pointer to init info structure with initialization params +* @p: Pointer to init info structure with initialization params */ struct dpu_encoder_phys *dpu_encoder_phys_wb_init (struct dpu_enc_phys_init_params *p)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 105/183 drm/msm/dpu: Fix memory leak in msm_mdss_parse_data_bus_icc_path
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 45dac1352b55b1d8cb17f218936b2bc2bc1fb4ee ]
of_icc_get() alloc resources for path1, we should release it when not need anymore. Early return when IS_ERR_OR_NULL(path0) may leak path1. Defer getting path1 to fix this.
Patchwork: https://patchwork.freedesktop.org/patch/514264/
--- drivers/gpu/drm/msm/msm_mdss.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/gpu/drm/msm/msm_mdss.c +4 -2
@@ -46,15 +46,17 @@ struct msm_mdss {static int msm_mdss_parse_data_bus_icc_path (struct device *dev,struct msm_mdss *msm_mdss) { -struct icc_path *path0 =of_icc_get (dev,"mdp0-mem" ); -struct icc_path *path1 =of_icc_get (dev,"mdp1-mem" ); +struct icc_path *path0; +struct icc_path *path1; + path0 =of_icc_get (dev,"mdp0-mem" );if (IS_ERR_OR_NULL (path0))return PTR_ERR_OR_ZERO (path0); msm_mdss->path[0 ] = path0; msm_mdss->num_paths =1 ; + path1 =of_icc_get (dev,"mdp1-mem" );if (!IS_ERR_OR_NULL (path1)) { msm_mdss->path[1 ] = path1; msm_mdss->num_paths++;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 106/183 ASoC: wm8904: fix wrong outputs volume after power reactivation
In reply to Greg Kroah-HartmanFrom: Emanuele Ghidoli <[email protected]>
[ Upstream commit 472a6309c6467af89dbf660a8310369cc9cb041f ]
Restore volume after charge pump and PGA activation to ensure that volume settings are correctly applied when re-enabling codec from SND_SOC_BIAS_OFF state.CLASS_W, CHARGE_PUMP and POWER_MANAGEMENT_2 register configuration affect how the volume register are applied and must be configured first.
--- sound/soc/codecs/wm8904.c | 7 +++++++ 1 file changed, 7 insertions(+)
sound/soc/codecs/wm8904.c +7 -0
@@ -697,6 +697,7 @@ static int out_pga_event(struct snd_soc_dapm_widget *w,int dcs_mask;int dcs_l, dcs_r;int dcs_l_reg, dcs_r_reg; +int an_out_reg;int timeout;int pwr_reg;
@@ -712,6 +713,7 @@ static int out_pga_event(struct snd_soc_dapm_widget *w, dcs_mask =WM8904_DCS_ENA_CHAN_0 |WM8904_DCS_ENA_CHAN_1 ; dcs_r_reg =WM8904_DC_SERVO_8 ; dcs_l_reg =WM8904_DC_SERVO_9 ; + an_out_reg =WM8904_ANALOGUE_OUT1_LEFT ; dcs_l =0 ; dcs_r =1 ;break ;
@@ -720,6 +722,7 @@ static int out_pga_event(struct snd_soc_dapm_widget *w, dcs_mask =WM8904_DCS_ENA_CHAN_2 |WM8904_DCS_ENA_CHAN_3 ; dcs_r_reg =WM8904_DC_SERVO_6 ; dcs_l_reg =WM8904_DC_SERVO_7 ; + an_out_reg =WM8904_ANALOGUE_OUT2_LEFT ; dcs_l =2 ; dcs_r =3 ;break ;
@@ -792,6 +795,10 @@ static int out_pga_event(struct snd_soc_dapm_widget *w,snd_soc_component_update_bits (component, reg,WM8904_HPL_ENA_OUTP |WM8904_HPR_ENA_OUTP ,WM8904_HPL_ENA_OUTP |WM8904_HPR_ENA_OUTP ); + +/* Update volume, requires PGA to be powered */ + val =snd_soc_component_read (component, an_out_reg); +snd_soc_component_write (component, an_out_reg, val);break ;case SND_SOC_DAPM_POST_PMU :
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 107/183 mtd: parsers: scpart: fix __udivdi3 undefined on mips
In reply to Greg Kroah-HartmanFrom: Mikhail Zhilkin <[email protected]>
[ Upstream commit 105c14b84d93168431abba5d55e6c26fa4b65abb ]
This fixes the following compile error on mips architecture with clang version 16.0.0 reported by the 0-DAY CI Kernel Test Service:
ld.lld: error: undefined symbol: __udivdi3
referenced by scpart.c mtd/parsers/scpart.o:(scpart_parse) in archive drivers/built-in.a
As a workaround this makes 'offs' a 32-bit type. This is enough, because the mtd containing partition table practically does not exceed 1 MB. We can revert this when the [Link] has been resolved.
--- drivers/mtd/parsers/scpart.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/parsers/scpart.c +1 -1
@@ -50,7 +50,7 @@ static int scpart_scan_partmap(struct mtd_info *master, loff_t partmap_offs,int cnt =0 ;int res =0 ;int res2; -loff_t offs; +uint32_t offs;size_t retlen;struct sc_part_desc *pdesc =NULL ;struct sc_part_desc *tmpdesc;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 108/183 mtd: cfi: allow building spi-intel standalone
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit d19ab1f785d0b6b9f709799f0938658903821ba1 ]
When MTD or MTD_CFI_GEOMETRY is disabled, the spi-intel driver fails to build, as it includes the shared CFI header:
include/linux/mtd/cfi.h:62:2: error: #warning No CONFIG_MTD_CFI_Ix selected. No NOR chip support can work. [-Werror=cpp]
62 | #warning No CONFIG_MTD_CFI_Ix selected. No NOR chip support can work.
linux/mtd/spi-nor.h does not actually need to include cfi.h, so remove the inclusion here to fix the warning. This uncovers a missing #include in spi-nor/core.c so add that there to prevent a different build issue.
--- drivers/mtd/spi-nor/core.c | 1 + include/linux/mtd/spi-nor.h | 1 - 2 files changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/spi-nor/core.c +1 -0
@@ -10,6 +10,7 @@#include <linux/err.h> #include <linux/errno.h> #include <linux/module.h> +#include <linux/delay.h> #include <linux/device.h> #include <linux/mutex.h> #include <linux/math64.h>
include/linux/mtd/spi-nor.h +0 -1
@@ -7,7 +7,6 @@#define __LINUX_MTD_SPI_NOR_H#include <linux/bitops.h> -#include <linux/mtd/cfi.h> #include <linux/mtd/mtd.h> #include <linux/spi/spi-mem.h>
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 109/183 ALSA: usb-audio: Make sure to stop endpoints before closing EPs
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
[ Upstream commit 0599313e26666e79f6e7fe1450588431b8cb25d5 ]
At the PCM hw params, we may re-configure the endpoints and it's done by a temporary EP close followed by re-open. A potential problem there is that the EP might be already running internally at the PCM prepare stage; it's seen typically in the playback stream with the implicit feedback sync. As this stream start isn't tracked by the core PCM layer, we'd need to stop it explicitly, and that's the missing piece.
This patch adds the stop_endpoints() call at snd_usb_hw_params() to assure the stream stop before closing the EPs.
--- sound/usb/pcm.c | 2 ++ 1 file changed, 2 insertions(+)
sound/usb/pcm.c +2 -0
@@ -527,6 +527,8 @@ static int snd_usb_hw_params(struct snd_pcm_substream *substream,if (snd_usb_endpoint_compatible (chip, subs->data_endpoint, fmt, hw_params)) goto unlock; +if (stop_endpoints (subs, false)) +sync_pending_stops (subs);close_endpoints (chip, subs); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 110/183 ALSA: usb-audio: Relax hw constraints for implicit fb sync
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
[ Upstream commit d463ac1acb454fafed58f695cb3067fbf489f3a0 ]
The fix commit the commit e4ea77f8e53f ("ALSA: usb-audio: Always apply the hw constraints for implicit fb sync") tried to address the bug where an incorrect PCM parameter is chosen when two (implicit fb) streams are set up at the same time. This change had, however, some side effect: once when the sync endpoint is chosen and set up, this restriction is applied at the next hw params unless it's freed via hw free explicitly.
This patch is a workaround for the problem by relaxing the hw constraints a bit for the implicit fb sync. We still keep applying the hw constraints for implicit fb sync, but only when the matching sync EP is being used by other streams.
--- sound/usb/pcm.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
sound/usb/pcm.c +7 -2
@@ -939,8 +939,13 @@ get_sync_ep_from_substream(struct snd_usb_substream *subs)continue ;/* for the implicit fb, check the sync ep as well */ ep =snd_usb_get_endpoint (chip, fp->sync_ep); -if (ep && ep->cur_audiofmt) -return ep; +if (ep && ep->cur_audiofmt) { +/* ditto, if the sync (data) ep is used by others, +* this stream is restricted by the sync ep +*/ +if (ep != subs->sync_endpoint || ep->opened >1 ) +return ep; + } }return NULL ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 111/183 stmmac: dwmac-mediatek: remove the dwmac_fix_mac_speed
In reply to Greg Kroah-HartmanFrom: Biao Huang <[email protected]>
[ Upstream commit c26de7507d1f5ffa5daf6a4980ef7896889691a9 ]
In current driver, MAC will always enable 2ns delay in RGMII mode, but that's not the correct usage.
Remove the dwmac_fix_mac_speed() in driver, and recommend "rgmii-id" for phy-mode in device tree.
--- .../ethernet/stmicro/stmmac/dwmac-mediatek.c | 26 ------------------- 1 file changed, 26 deletions(-)
drivers/net/ethernet/stmicro/stmmac/dwmac-mediatek.c +0 -26
@@ -90,7 +90,6 @@ struct mediatek_dwmac_plat_data {struct mediatek_dwmac_variant {int (*dwmac_set_phy_interface)(struct mediatek_dwmac_plat_data *plat);int (*dwmac_set_delay)(struct mediatek_dwmac_plat_data *plat); -void (*dwmac_fix_mac_speed)(void *priv,unsigned int speed);/* clock ids to be requested */ const char *const *clk_list;
@@ -443,32 +442,9 @@ static int mt8195_set_delay(struct mediatek_dwmac_plat_data *plat)return 0 ; } -static void mt8195_fix_mac_speed (void *priv,unsigned int speed) -{ -struct mediatek_dwmac_plat_data *priv_plat = priv; - -if ((phy_interface_mode_is_rgmii (priv_plat->phy_mode))) { -/* prefer 2ns fixed delay which is controlled by TXC_PHASE_CTRL, -* when link speed is 1Gbps with RGMII interface, -* Fall back to delay macro circuit for 10/100Mbps link speed. -*/ -if (speed ==SPEED_1000 ) -regmap_update_bits (priv_plat->peri_regmap, -MT8195_PERI_ETH_CTRL0 , -MT8195_RGMII_TXC_PHASE_CTRL | -MT8195_DLY_GTXC_ENABLE | -MT8195_DLY_GTXC_INV | -MT8195_DLY_GTXC_STAGES , -MT8195_RGMII_TXC_PHASE_CTRL ); -else -mt8195_set_delay (priv_plat); - } -} -static const struct mediatek_dwmac_variant mt8195_gmac_variant = { .dwmac_set_phy_interface = mt8195_set_interface, .dwmac_set_delay = mt8195_set_delay, - .dwmac_fix_mac_speed = mt8195_fix_mac_speed, .clk_list = mt8195_dwmac_clk_l, .num_clks =ARRAY_SIZE (mt8195_dwmac_clk_l), .dma_bit_mask =35 ,
@@ -619,8 +595,6 @@ static int mediatek_dwmac_common_data(struct platform_device *pdev, plat->bsp_priv = priv_plat; plat->init = mediatek_dwmac_init; plat->clks_config = mediatek_dwmac_clks_config; -if (priv_plat->variant->dwmac_fix_mac_speed) - plat->fix_mac_speed = priv_plat->variant->dwmac_fix_mac_speed; plat->safety_feat_cfg = devm_kzalloc(&pdev->dev, sizeof(*plat->safety_feat_cfg),
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 112/183 tipc: fix unexpected link reset due to discovery messages
In reply to Greg Kroah-HartmanFrom: Tung Nguyen <[email protected]>
[ Upstream commit c244c092f1ed2acfb5af3d3da81e22367d3dd733 ]
This unexpected behavior is observed:
node 1 | node 2
------ | ------
link is established | link is established
reboot | link is reset
up | send discovery message
receive discovery message |
link is established | link is established
send discovery message |
| receive discovery message
| link is reset (unexpected)
| send reset message
link is reset |It is due to delayed re-discovery as described in function tipc_node_check_dest(): "this link endpoint has already reset and re-established contact with the peer, before receiving a discovery message from that node."
However, commit 598411d70f85 has changed the condition for calling tipc_node_link_down() which was the acceptance of new media address.
This commit fixes this by restoring the old and correct behavior.
--- net/tipc/node.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
net/tipc/node.c +8 -4
@@ -1179,8 +1179,9 @@ void tipc_node_check_dest(struct net *net, u32 addr,bool addr_match = false;bool sign_match = false;bool link_up = false; +bool link_is_reset = false;bool accept_addr = false; -bool reset = true; +bool reset = false;char *if_name;unsigned long intv;u16 session;
@@ -1200,14 +1201,14 @@ void tipc_node_check_dest(struct net *net, u32 addr,/* Prepare to validate requesting node's signature and media address */ l = le->link; link_up = l &&tipc_link_is_up (l); + link_is_reset = l &&tipc_link_is_reset (l); addr_match = l && !memcmp (&le->maddr, maddr,sizeof (*maddr)); sign_match = (signature == n->signature);/* These three flags give us eight permutations: */ if (sign_match && addr_match && link_up) { -/* All is fine. Do nothing. */ - reset = false; +/* All is fine. Ignore requests. */ /* Peer node is not a container/local namespace */ if (!n->peer_hash_mix) n->peer_hash_mix = hash_mixes;
@@ -1232,6 +1233,7 @@ void tipc_node_check_dest(struct net *net, u32 addr,*/ accept_addr = true; *respond = true; + reset = true; }else if (!sign_match && addr_match && link_up) {/* Peer node rebooted. Two possibilities: * - Delayed re-discovery; this link endpoint has already
@@ -1263,6 +1265,7 @@ void tipc_node_check_dest(struct net *net, u32 addr, n->signature = signature; accept_addr = true; *respond = true; + reset = true; }if (!accept_addr)
@@ -1291,6 +1294,7 @@ void tipc_node_check_dest(struct net *net, u32 addr,tipc_link_fsm_evt (l,LINK_RESET_EVT );if (n->state ==NODE_FAILINGOVER )tipc_link_fsm_evt (l,LINK_FAILOVER_BEGIN_EVT ); + link_is_reset =tipc_link_is_reset (l); le->link = l; n->link_cnt++;tipc_node_calculate_timer (n, l);
@@ -1303,7 +1307,7 @@ void tipc_node_check_dest(struct net *net, u32 addr,memcpy (&le->maddr, maddr,sizeof (*maddr)); exit:tipc_node_write_unlock (n); -if (reset && l && !tipc_link_is_reset (l)) +if (reset && !link_is_reset)tipc_node_link_down (n, b->identity, false);tipc_node_put (n); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 113/183 NFSD: Pass the target nfsd_file to nfsd_commit()
In reply to Greg Kroah-HartmanFrom: Chuck Lever <[email protected]>
[ Upstream commit c252849082ff525af18b4f253b3c9ece94e951ed ]
In a moment I'm going to introduce separate nfsd_file types, one of which is garbage-collected; the other, not. The garbage-collected variety is to be used by NFSv2 and v3, and the non-garbage-collected variety is to be used by NFSv4.
nfsd_commit() is invoked by both NFSv3 and NFSv4 consumers. We want nfsd_commit() to find and use the correct variety of cached nfsd_file object for the NFS version that is in use.
Stable-dep-of: 0b3a551fa58b ("nfsd: fix handling of cached open files in nfsd4_open codepath")
--- fs/nfsd/nfs3proc.c | 10 +++++++++- fs/nfsd/nfs4proc.c | 11 ++++++++++- fs/nfsd/vfs.c | 15 ++++----------- fs/nfsd/vfs.h | 3 ++- 4 files changed, 25 insertions(+), 14 deletions(-)
fs/nfsd/nfs3proc.c +9 -1
@@ -13,6 +13,7 @@#include "cache.h" #include "xdr3.h" #include "vfs.h" +#include "filecache.h" #define NFSDDBG_FACILITY NFSDDBG_PROC
@@ -763,6 +764,7 @@ nfsd3_proc_commit(struct svc_rqst *rqstp) {struct nfsd3_commitargs *argp = rqstp->rq_argp;struct nfsd3_commitres *resp = rqstp->rq_resp; +struct nfsd_file *nf; dprintk("nfsd: COMMIT(3) %s %u@%Lu\n", SVCFH_fmt(&argp->fh),
@@ -770,8 +772,14 @@ nfsd3_proc_commit(struct svc_rqst *rqstp) (unsigned long long) argp->offset);fh_copy (&resp->fh, &argp->fh); - resp->status =nfsd_commit (rqstp, &resp->fh, argp->offset, + resp->status =nfsd_file_acquire (rqstp, &resp->fh,NFSD_MAY_WRITE | +NFSD_MAY_NOT_BREAK_LEASE , &nf); +if (resp->status) + goto out; + resp->status =nfsd_commit (rqstp, &resp->fh, nf, argp->offset, argp->count, resp->verf); +nfsd_file_put (nf); +out:return rpc_success; }
fs/nfsd/nfs4proc.c +10 -1
@@ -731,10 +731,19 @@ nfsd4_commit(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, union nfsd4_op_u *u) {struct nfsd4_commit *commit = &u->commit; +struct nfsd_file *nf; +__be32 status; -return nfsd_commit (rqstp, &cstate->current_fh, commit->co_offset, + status =nfsd_file_acquire (rqstp, &cstate->current_fh,NFSD_MAY_WRITE | +NFSD_MAY_NOT_BREAK_LEASE , &nf); +if (status != nfs_ok) +return status; + + status =nfsd_commit (rqstp, &cstate->current_fh, nf, commit->co_offset, commit->co_count, (__be32 *)commit->co_verf.data); +nfsd_file_put (nf); +return status; } static __be32
fs/nfsd/vfs.c +4 -11
@@ -1133,6 +1133,7 @@ nfsd_write(struct svc_rqst *rqstp, struct svc_fh *fhp, loff_t offset,* nfsd_commit - Commit pending writes to stable storage * @rqstp: RPC request being processed * @fhp: NFS filehandle +* @nf: target file * @offset: raw offset from beginning of file * @count: raw count of bytes to sync * @verf: filled in with the server's current write verifier
@@ -1149,19 +1150,13 @@ nfsd_write(struct svc_rqst *rqstp, struct svc_fh *fhp, loff_t offset,* An nfsstat value in network byte order. */ __be32 -nfsd_commit (struct svc_rqst *rqstp,struct svc_fh *fhp,u64 offset, -u32 count,__be32 *verf) +nfsd_commit (struct svc_rqst *rqstp,struct svc_fh *fhp,struct nfsd_file *nf, +u64 offset,u32 count,__be32 *verf) { +__be32 err = nfs_ok;u64 maxbytes;loff_t start, end;struct nfsd_net *nn; -struct nfsd_file *nf; -__be32 err; - - err =nfsd_file_acquire (rqstp, fhp, -NFSD_MAY_WRITE |NFSD_MAY_NOT_BREAK_LEASE , &nf); -if (err) - goto out;/* * Convert the client-provided (offset, count) range to a
@@ -1202,8 +1197,6 @@ nfsd_commit(struct svc_rqst *rqstp, struct svc_fh *fhp, u64 offset, }else nfsd_copy_write_verifier (verf, nn); -nfsd_file_put (nf); -out:return err; }
fs/nfsd/vfs.h +2 -1
@@ -88,7 +88,8 @@ __be32 nfsd_access(struct svc_rqst *, struct svc_fh *, u32 *, u32 *);__be32 nfsd_create_setattr (struct svc_rqst *rqstp,struct svc_fh *fhp,struct svc_fh *resfhp,struct nfsd_attrs *iap);__be32 nfsd_commit (struct svc_rqst *rqst,struct svc_fh *fhp, -u64 offset,u32 count,__be32 *verf); +struct nfsd_file *nf,u64 offset,u32 count, +__be32 *verf);#ifdef CONFIG_NFSD_V4 __be32 nfsd_getxattr (struct svc_rqst *rqstp,struct svc_fh *fhp,char *name,void **bufp,int *lenp);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 114/183 NFSD: Revert "NFSD: NFSv4 CLOSE should release an nfsd_file immediately"
In reply to Greg Kroah-HartmanFrom: Chuck Lever <[email protected]>
[ Upstream commit dcf3f80965ca787c70def402cdf1553c93c75529 ]
This reverts commit 5e138c4a750dc140d881dab4a8804b094bbc08d2.
That commit attempted to make files available to other users as soon as all NFSv4 clients were done with them, rather than waiting until the filecache LRU had garbage collected them.
It gets the reference counting wrong, for one thing.
But it also misses that DELEGRETURN should release a file in the same fashion. In fact, any nfsd_file_put() on an file held open by an NFSv4 client needs potentially to release the file immediately...
Clear the way for implementing that idea.
Stable-dep-of: 0b3a551fa58b ("nfsd: fix handling of cached open files in nfsd4_open codepath")
--- fs/nfsd/filecache.c | 18 ------------------ fs/nfsd/filecache.h | 1 - fs/nfsd/nfs4state.c | 4 ++-- 3 files changed, 2 insertions(+), 21 deletions(-)
fs/nfsd/filecache.c +0 -18
@@ -444,24 +444,6 @@ nfsd_file_put(struct nfsd_file *nf)nfsd_file_put_noref (nf); } -/** -* nfsd_file_close - Close an nfsd_file -* @nf: nfsd_file to close -* -* If this is the final reference for @nf, free it immediately. -* This reflects an on-the-wire CLOSE or DELEGRETURN into the -* VFS and exported filesystem. -*/ -void nfsd_file_close (struct nfsd_file *nf) -{ -nfsd_file_put (nf); -if (refcount_dec_if_one (&nf->nf_ref)) { -nfsd_file_unhash (nf); -nfsd_file_lru_remove (nf); -nfsd_file_free (nf); - } -} -struct nfsd_file *nfsd_file_get (struct nfsd_file *nf) {
fs/nfsd/filecache.h +0 -1
@@ -52,7 +52,6 @@ void nfsd_file_cache_shutdown(void);int nfsd_file_cache_start_net (struct net *net);void nfsd_file_cache_shutdown_net (struct net *net);void nfsd_file_put (struct nfsd_file *nf); -void nfsd_file_close (struct nfsd_file *nf);struct nfsd_file *nfsd_file_get (struct nfsd_file *nf);void nfsd_file_close_inode_sync (struct inode *inode);bool nfsd_file_is_cached (struct inode *inode);
fs/nfsd/nfs4state.c +2 -2
@@ -842,9 +842,9 @@ static void __nfs4_file_put_access(struct nfs4_file *fp, int oflag)swap (f2, fp->fi_fds[O_RDWR ]);spin_unlock (&fp->fi_lock);if (f1) -nfsd_file_close (f1); +nfsd_file_put (f1);if (f2) -nfsd_file_close (f2); +nfsd_file_put (f2); } }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 115/183 NFSD: Add an NFSD_FILE_GC flag to enable nfsd_file garbage collection
In reply to Greg Kroah-HartmanFrom: Chuck Lever <[email protected]>
[ Upstream commit 4d1ea8455716ca070e3cd85767e6f6a562a58b1b ]
NFSv4 operations manage the lifetime of nfsd_file items they use by means of NFSv4 OPEN and CLOSE. Hence there's no need for them to be garbage collected.
Introduce a mechanism to enable garbage collection for nfsd_file items used only by NFSv2/3 callers.
Note that the change in nfsd_file_put() ensures that both CLOSE and DELEGRETURN will actually close out and free an nfsd_file on last reference of a non-garbage-collected file.
Stable-dep-of: 0b3a551fa58b ("nfsd: fix handling of cached open files in nfsd4_open codepath")
--- fs/nfsd/filecache.c | 63 +++++++++++++++++++++++++++++++++++++++------ fs/nfsd/filecache.h | 3 +++ fs/nfsd/nfs3proc.c | 4 +-- fs/nfsd/trace.h | 3 ++- fs/nfsd/vfs.c | 4 +-- 5 files changed, 64 insertions(+), 13 deletions(-)
fs/nfsd/filecache.c +55 -8
@@ -63,6 +63,7 @@ struct nfsd_file_lookup_key {struct net *net;const struct cred *cred;unsigned char need; +bool gc;enum nfsd_file_lookup_type type; };
@@ -162,6 +163,8 @@ static int nfsd_file_obj_cmpfn(struct rhashtable_compare_arg *arg,return 1 ;if (!nfsd_match_cred (nf->nf_cred, key->cred))return 1 ; +if (!!test_bit (NFSD_FILE_GC , &nf->nf_flags) != key->gc) +return 1 ;if (test_bit (NFSD_FILE_HASHED , &nf->nf_flags) ==0 )return 1 ;break ;
@@ -297,6 +300,8 @@ nfsd_file_alloc(struct nfsd_file_lookup_key *key, unsigned int may) nf->nf_flags =0 ;__set_bit (NFSD_FILE_HASHED , &nf->nf_flags);__set_bit (NFSD_FILE_PENDING , &nf->nf_flags); +if (key->gc) +__set_bit (NFSD_FILE_GC , &nf->nf_flags); nf->nf_inode = key->inode;/* nf_ref is pre-incremented for hash table */ refcount_set (&nf->nf_ref,2 );
@@ -428,16 +433,27 @@ nfsd_file_put_noref(struct nfsd_file *nf) } } +static void +nfsd_file_unhash_and_put (struct nfsd_file *nf) +{ +if (nfsd_file_unhash (nf)) +nfsd_file_put_noref (nf); +} +void nfsd_file_put (struct nfsd_file *nf) {might_sleep (); -nfsd_file_lru_add (nf); -if (test_bit (NFSD_FILE_HASHED , &nf->nf_flags) ==0 ) { +if (test_bit (NFSD_FILE_GC , &nf->nf_flags)) +nfsd_file_lru_add (nf); +else if (refcount_read (&nf->nf_ref) ==2 ) +nfsd_file_unhash_and_put (nf); + +if (!test_bit (NFSD_FILE_HASHED , &nf->nf_flags)) {nfsd_file_flush (nf);nfsd_file_put_noref (nf); - }else if (nf->nf_file) { + }else if (nf->nf_file &&test_bit (NFSD_FILE_GC , &nf->nf_flags)) {nfsd_file_put_noref (nf);nfsd_file_schedule_laundrette (); }else
@@ -1016,12 +1032,14 @@ nfsd_file_is_cached(struct inode *inode)static __be32 nfsd_file_do_acquire (struct svc_rqst *rqstp,struct svc_fh *fhp, -unsigned int may_flags,struct nfsd_file **pnf,bool open) +unsigned int may_flags,struct nfsd_file **pnf, +bool open,bool want_gc) {struct nfsd_file_lookup_key key = { .type =NFSD_FILE_KEY_FULL , .need = may_flags &NFSD_FILE_MAY_MASK , .net =SVC_NET (rqstp), + .gc = want_gc, };bool open_retry = true;struct nfsd_file *nf;
@@ -1117,14 +1135,35 @@ nfsd_file_do_acquire(struct svc_rqst *rqstp, struct svc_fh *fhp,* then unhash. */ if (status != nfs_ok || key.inode->i_nlink ==0 ) -if (nfsd_file_unhash (nf)) -nfsd_file_put_noref (nf); +nfsd_file_unhash_and_put (nf);clear_bit_unlock (NFSD_FILE_PENDING , &nf->nf_flags);smp_mb__after_atomic ();wake_up_bit (&nf->nf_flags,NFSD_FILE_PENDING ); goto out; } +/** +* nfsd_file_acquire_gc - Get a struct nfsd_file with an open file +* @rqstp: the RPC transaction being executed +* @fhp: the NFS filehandle of the file to be opened +* @may_flags: NFSD_MAY_ settings for the file +* @pnf: OUT: new or found "struct nfsd_file" object +* +* The nfsd_file object returned by this API is reference-counted +* and garbage-collected. The object is retained for a few +* seconds after the final nfsd_file_put() in case the caller +* wants to re-use it. +* +* Returns nfs_ok and sets @pnf on success; otherwise an nfsstat in +* network byte order is returned. +*/ +__be32 +nfsd_file_acquire_gc (struct svc_rqst *rqstp,struct svc_fh *fhp, +unsigned int may_flags,struct nfsd_file **pnf) +{ +return nfsd_file_do_acquire (rqstp, fhp, may_flags, pnf, true, true); +} +/** * nfsd_file_acquire - Get a struct nfsd_file with an open file * @rqstp: the RPC transaction being executed
@@ -1132,6 +1171,10 @@ nfsd_file_do_acquire(struct svc_rqst *rqstp, struct svc_fh *fhp,* @may_flags: NFSD_MAY_ settings for the file * @pnf: OUT: new or found "struct nfsd_file" object * +* The nfsd_file_object returned by this API is reference-counted +* but not garbage-collected. The object is unhashed after the +* final nfsd_file_put(). +* * Returns nfs_ok and sets @pnf on success; otherwise an nfsstat in * network byte order is returned. */
@@ -1139,7 +1182,7 @@ __be32 nfsd_file_acquire(struct svc_rqst *rqstp, struct svc_fh *fhp, unsigned int may_flags, struct nfsd_file **pnf) { - return nfsd_file_do_acquire(rqstp, fhp, may_flags, pnf, true); + return nfsd_file_do_acquire(rqstp, fhp, may_flags, pnf, true, false); }/**
@@ -1149,6 +1192,10 @@ nfsd_file_acquire(struct svc_rqst *rqstp, struct svc_fh *fhp,* @may_flags: NFSD_MAY_ settings for the file * @pnf: OUT: new or found "struct nfsd_file" object * +* The nfsd_file_object returned by this API is reference-counted +* but not garbage-collected. The object is released immediately +* one RCU grace period after the final nfsd_file_put(). +* * Returns nfs_ok and sets @pnf on success; otherwise an nfsstat in * network byte order is returned. */
@@ -1156,7 +1203,7 @@ __be32 nfsd_file_create(struct svc_rqst *rqstp, struct svc_fh *fhp, unsigned int may_flags, struct nfsd_file **pnf) { - return nfsd_file_do_acquire(rqstp, fhp, may_flags, pnf, false); + return nfsd_file_do_acquire(rqstp, fhp, may_flags, pnf, false, false); }/*
fs/nfsd/filecache.h +3 -0
@@ -38,6 +38,7 @@ struct nfsd_file {#define NFSD_FILE_HASHED (0)#define NFSD_FILE_PENDING (1)#define NFSD_FILE_REFERENCED (2) +#define NFSD_FILE_GC (3)unsigned long nf_flags;struct inode *nf_inode;/* don't deref */ refcount_t nf_ref;
@@ -55,6 +56,8 @@ void nfsd_file_put(struct nfsd_file *nf);struct nfsd_file *nfsd_file_get (struct nfsd_file *nf);void nfsd_file_close_inode_sync (struct inode *inode);bool nfsd_file_is_cached (struct inode *inode); +__be32 nfsd_file_acquire_gc (struct svc_rqst *rqstp,struct svc_fh *fhp, +unsigned int may_flags,struct nfsd_file **nfp);__be32 nfsd_file_acquire (struct svc_rqst *rqstp,struct svc_fh *fhp,unsigned int may_flags,struct nfsd_file **nfp); __be32 nfsd_file_create(struct svc_rqst *rqstp, struct svc_fh *fhp,
fs/nfsd/nfs3proc.c +2 -2
@@ -772,8 +772,8 @@ nfsd3_proc_commit(struct svc_rqst *rqstp) (unsigned long long) argp->offset);fh_copy (&resp->fh, &argp->fh); - resp->status =nfsd_file_acquire (rqstp, &resp->fh,NFSD_MAY_WRITE | -NFSD_MAY_NOT_BREAK_LEASE , &nf); + resp->status =nfsd_file_acquire_gc (rqstp, &resp->fh,NFSD_MAY_WRITE | +NFSD_MAY_NOT_BREAK_LEASE , &nf);if (resp->status) goto out; resp->status = nfsd_commit(rqstp, &resp->fh, nf, argp->offset,
fs/nfsd/trace.h +2 -1
@@ -817,7 +817,8 @@ DEFINE_CLID_EVENT(confirmed_r);__print_flags (val,"|" , \ { 1 << NFSD_FILE_HASHED, "HASHED" }, \ { 1 << NFSD_FILE_PENDING, "PENDING" }, \ - { 1 << NFSD_FILE_REFERENCED, "REFERENCED"}) + { 1 << NFSD_FILE_REFERENCED, "REFERENCED"}, \ + { 1 << NFSD_FILE_GC, "GC"}) DECLARE_EVENT_CLASS(nfsd_file_class, TP_PROTO(struct nfsd_file *nf),
fs/nfsd/vfs.c +2 -2
@@ -1085,7 +1085,7 @@ __be32 nfsd_read(struct svc_rqst *rqstp, struct svc_fh *fhp,__be32 err;trace_nfsd_read_start (rqstp, fhp, offset, *count); - err =nfsd_file_acquire (rqstp, fhp,NFSD_MAY_READ , &nf); + err =nfsd_file_acquire_gc (rqstp, fhp,NFSD_MAY_READ , &nf);if (err)return err;
@@ -1117,7 +1117,7 @@ nfsd_write(struct svc_rqst *rqstp, struct svc_fh *fhp, loff_t offset,trace_nfsd_write_start (rqstp, fhp, offset, *cnt); - err =nfsd_file_acquire (rqstp, fhp,NFSD_MAY_WRITE , &nf); + err =nfsd_file_acquire_gc (rqstp, fhp,NFSD_MAY_WRITE , &nf);if (err) goto out;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 116/183 nfsd: remove the pages_flushed statistic from filecache
In reply to Greg Kroah-HartmanFrom: Jeff Layton <[email protected]>
[ Upstream commit 1f696e230ea5198e393368b319eb55651828d687 ]
We're counting mapping->nrpages, but not all of those are necessarily dirty. We don't really have a simple way to count just the dirty pages, so just remove this stat since it's not accurate.
Stable-dep-of: 0b3a551fa58b ("nfsd: fix handling of cached open files in nfsd4_open codepath")
--- fs/nfsd/filecache.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-)
fs/nfsd/filecache.c +1 -6
@@ -33,7 +33,6 @@ static DEFINE_PER_CPU(unsigned long, nfsd_file_cache_hits); static DEFINE_PER_CPU(unsigned long, nfsd_file_acquisitions); static DEFINE_PER_CPU(unsigned long, nfsd_file_releases); static DEFINE_PER_CPU(unsigned long, nfsd_file_total_age); -static DEFINE_PER_CPU(unsigned long, nfsd_file_pages_flushed); static DEFINE_PER_CPU(unsigned long, nfsd_file_evictions);struct nfsd_fcache_disposal {
@@ -371,7 +370,6 @@ nfsd_file_flush(struct nfsd_file *nf)if (!file || !(file->f_mode &FMODE_WRITE ))return ; -this_cpu_add (nfsd_file_pages_flushed, file->f_mapping->nrpages);if (vfs_fsync (file,1 ) !=0 )nfsd_reset_write_verifier (net_generic (nf->nf_net, nfsd_net_id)); }
@@ -998,7 +996,6 @@ nfsd_file_cache_shutdown(void)per_cpu (nfsd_file_acquisitions, i) =0 ;per_cpu (nfsd_file_releases, i) =0 ;per_cpu (nfsd_file_total_age, i) =0 ; -per_cpu (nfsd_file_pages_flushed, i) =0 ;per_cpu (nfsd_file_evictions, i) =0 ; } }
@@ -1213,7 +1210,7 @@ nfsd_file_create(struct svc_rqst *rqstp, struct svc_fh *fhp,*/ int nfsd_file_cache_stats_show (struct seq_file *m,void *v) { -unsigned long releases =0 , pages_flushed =0 , evictions =0 ; +unsigned long releases =0 , evictions =0 ;unsigned long hits =0 , acquisitions =0 ;unsigned int i, count =0 , buckets =0 ;unsigned long lru =0 , total_age =0 ;
@@ -1241,7 +1238,6 @@ int nfsd_file_cache_stats_show(struct seq_file *m, void *v) releases +=per_cpu (nfsd_file_releases, i); total_age +=per_cpu (nfsd_file_total_age, i); evictions +=per_cpu (nfsd_file_evictions, i); - pages_flushed +=per_cpu (nfsd_file_pages_flushed, i); }seq_printf (m,"total entries: %u\n" , count);
@@ -1255,6 +1251,5 @@ int nfsd_file_cache_stats_show(struct seq_file *m, void *v)seq_printf (m,"mean age (ms): %ld\n" , total_age / releases); else seq_printf(m, "mean age (ms): -\n"); -seq_printf (m,"pages flushed: %lu\n" , pages_flushed);return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 117/183 nfsd: reorganize filecache.c
In reply to Greg Kroah-HartmanFrom: Jeff Layton <[email protected]>
[ Upstream commit 8214118589881b2d390284410c5ff275e7a5e03c ]
In a coming patch, we're going to rework how the filecache refcounting works. Move some code around in the function to reduce the churn in the later patches, and rename some of the functions with (hopefully) clearer
names: nfsd_file_flush becomes nfsd_file_fsync, and nfsd_file_unhash_and_dispose is renamed to nfsd_file_unhash_and_queue.
Also, the nfsd_file_put_final tracepoint is renamed to nfsd_file_free, to better match the name of the function from which it's called.
Stable-dep-of: 0b3a551fa58b ("nfsd: fix handling of cached open files in nfsd4_open codepath")
--- fs/nfsd/filecache.c | 111 ++++++++++++++++++++++---------------------- fs/nfsd/trace.h | 4 +- 2 files changed, 58 insertions(+), 57 deletions(-)
fs/nfsd/filecache.c +56 -55
@@ -310,16 +310,59 @@ nfsd_file_alloc(struct nfsd_file_lookup_key *key, unsigned int may)return nf; } +static void +nfsd_file_fsync (struct nfsd_file *nf) +{ +struct file *file = nf->nf_file; + +if (!file || !(file->f_mode &FMODE_WRITE )) +return ; +if (vfs_fsync (file,1 ) !=0 ) +nfsd_reset_write_verifier (net_generic (nf->nf_net, nfsd_net_id)); +} + +static int +nfsd_file_check_write_error (struct nfsd_file *nf) +{ +struct file *file = nf->nf_file; + +if (!file || !(file->f_mode &FMODE_WRITE )) +return 0 ; +return filemap_check_wb_err (file->f_mapping,READ_ONCE (file->f_wb_err)); +} + +static void +nfsd_file_hash_remove (struct nfsd_file *nf) +{ +trace_nfsd_file_unhash (nf); + +if (nfsd_file_check_write_error (nf)) +nfsd_reset_write_verifier (net_generic (nf->nf_net, nfsd_net_id)); +rhashtable_remove_fast (&nfsd_file_rhash_tbl, &nf->nf_rhash, + nfsd_file_rhash_params); +} + +static bool +nfsd_file_unhash (struct nfsd_file *nf) +{ +if (test_and_clear_bit (NFSD_FILE_HASHED , &nf->nf_flags)) { +nfsd_file_hash_remove (nf); +return true; + } +return false; +} +static bool nfsd_file_free (struct nfsd_file *nf) {s64 age =ktime_to_ms (ktime_sub (ktime_get (), nf->nf_birthtime));bool flush = false; +trace_nfsd_file_free (nf); +this_cpu_inc (nfsd_file_releases);this_cpu_add (nfsd_file_total_age, age); -trace_nfsd_file_put_final (nf);if (nf->nf_mark)nfsd_file_mark_put (nf->nf_mark);if (nf->nf_file) {
@@ -353,27 +396,6 @@ nfsd_file_check_writeback(struct nfsd_file *nf)mapping_tagged (mapping,PAGECACHE_TAG_WRITEBACK ); } -static int -nfsd_file_check_write_error (struct nfsd_file *nf) -{ -struct file *file = nf->nf_file; - -if (!file || !(file->f_mode &FMODE_WRITE )) -return 0 ; -return filemap_check_wb_err (file->f_mapping,READ_ONCE (file->f_wb_err)); -} - -static void -nfsd_file_flush (struct nfsd_file *nf) -{ -struct file *file = nf->nf_file; - -if (!file || !(file->f_mode &FMODE_WRITE )) -return ; -if (vfs_fsync (file,1 ) !=0 ) -nfsd_reset_write_verifier (net_generic (nf->nf_net, nfsd_net_id)); -} -static void nfsd_file_lru_add (struct nfsd_file *nf) {set_bit (NFSD_FILE_REFERENCED , &nf->nf_flags);
@@ -387,31 +409,18 @@ static void nfsd_file_lru_remove(struct nfsd_file *nf)trace_nfsd_file_lru_del (nf); } -static void -nfsd_file_hash_remove (struct nfsd_file *nf) -{ -trace_nfsd_file_unhash (nf); - -if (nfsd_file_check_write_error (nf)) -nfsd_reset_write_verifier (net_generic (nf->nf_net, nfsd_net_id)); -rhashtable_remove_fast (&nfsd_file_rhash_tbl, &nf->nf_rhash, - nfsd_file_rhash_params); -} - -static bool -nfsd_file_unhash (struct nfsd_file *nf) +struct nfsd_file * +nfsd_file_get (struct nfsd_file *nf) { -if (test_and_clear_bit (NFSD_FILE_HASHED , &nf->nf_flags)) { -nfsd_file_hash_remove (nf); -return true; - } -return false; +if (likely (refcount_inc_not_zero (&nf->nf_ref))) +return nf; +return NULL ; }static void -nfsd_file_unhash_and_dispose (struct nfsd_file *nf,struct list_head *dispose) +nfsd_file_unhash_and_queue (struct nfsd_file *nf,struct list_head *dispose) { -trace_nfsd_file_unhash_and_dispose (nf); +trace_nfsd_file_unhash_and_queue (nf);if (nfsd_file_unhash (nf)) {/* caller must call nfsd_file_dispose_list() later */ nfsd_file_lru_remove (nf);
@@ -449,7 +458,7 @@ nfsd_file_put(struct nfsd_file *nf)nfsd_file_unhash_and_put (nf);if (!test_bit (NFSD_FILE_HASHED , &nf->nf_flags)) { -nfsd_file_flush (nf); +nfsd_file_fsync (nf);nfsd_file_put_noref (nf); }else if (nf->nf_file &&test_bit (NFSD_FILE_GC , &nf->nf_flags)) {nfsd_file_put_noref (nf);
@@ -458,14 +467,6 @@ nfsd_file_put(struct nfsd_file *nf)nfsd_file_put_noref (nf); } -struct nfsd_file * -nfsd_file_get (struct nfsd_file *nf) -{ -if (likely (refcount_inc_not_zero (&nf->nf_ref))) -return nf; -return NULL ; -} -static void nfsd_file_dispose_list (struct list_head *dispose) {
@@ -474,7 +475,7 @@ nfsd_file_dispose_list(struct list_head *dispose)while (!list_empty (dispose)) { nf = list_first_entry(dispose, struct nfsd_file, nf_lru);list_del_init (&nf->nf_lru); -nfsd_file_flush (nf); +nfsd_file_fsync (nf);nfsd_file_put_noref (nf); } }
@@ -488,7 +489,7 @@ nfsd_file_dispose_list_sync(struct list_head *dispose)while (!list_empty (dispose)) { nf = list_first_entry(dispose, struct nfsd_file, nf_lru);list_del_init (&nf->nf_lru); -nfsd_file_flush (nf); +nfsd_file_fsync (nf);if (!refcount_dec_and_test (&nf->nf_ref))continue ;if (nfsd_file_free (nf))
@@ -688,7 +689,7 @@ __nfsd_file_close_inode(struct inode *inode, struct list_head *dispose) nfsd_file_rhash_params);if (!nf)break ; -nfsd_file_unhash_and_dispose (nf, dispose); +nfsd_file_unhash_and_queue (nf, dispose); count++; }while (1 );rcu_read_unlock ();
@@ -890,7 +891,7 @@ __nfsd_file_cache_purge(struct net *net) nf =rhashtable_walk_next (&iter);while (!IS_ERR_OR_NULL (nf)) {if (!net || nf->nf_net == net) -nfsd_file_unhash_and_dispose (nf, &dispose); +nfsd_file_unhash_and_queue (nf, &dispose); nf =rhashtable_walk_next (&iter); }
fs/nfsd/trace.h +2 -2
@@ -850,10 +850,10 @@ DEFINE_EVENT(nfsd_file_class, name, \ TP_PROTO(struct nfsd_file *nf), \ TP_ARGS(nf)) -DEFINE_NFSD_FILE_EVENT(nfsd_file_put_final); +DEFINE_NFSD_FILE_EVENT(nfsd_file_free); DEFINE_NFSD_FILE_EVENT(nfsd_file_unhash); DEFINE_NFSD_FILE_EVENT(nfsd_file_put); -DEFINE_NFSD_FILE_EVENT(nfsd_file_unhash_and_dispose); +DEFINE_NFSD_FILE_EVENT(nfsd_file_unhash_and_queue); TRACE_EVENT(nfsd_file_alloc, TP_PROTO(
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 118/183 NFSD: Add an nfsd_file_fsync tracepoint
In reply to Greg Kroah-HartmanFrom: Chuck Lever <[email protected]>
[ Upstream commit d7064eaf688cfe454c50db9f59298463d80d403c ]
Add a tracepoint to capture the number of filecache-triggered fsync calls and which files needed it. Also, record when an fsync triggers a write verifier reset.
Examples:
<...>-97 [007] 262.505611: nfsd_file_free: inode=0xffff888171e08140 ref=0 flags=GC may=WRITE nf_file=0xffff8881373d2400 <...>-97 [007] 262.505612: nfsd_file_fsync: inode=0xffff888171e08140 ref=0 flags=GC may=WRITE nf_file=0xffff8881373d2400 ret=0 <...>-97 [007] 262.505623: nfsd_file_free: inode=0xffff888171e08dc0 ref=0 flags=GC may=WRITE nf_file=0xffff8881373d1e00 <...>-97 [007] 262.505624: nfsd_file_fsync: inode=0xffff888171e08dc0 ref=0 flags=GC may=WRITE nf_file=0xffff8881373d1e00 ret=0
Stable-dep-of: 0b3a551fa58b ("nfsd: fix handling of cached open files in nfsd4_open codepath")
--- fs/nfsd/filecache.c | 5 ++++- fs/nfsd/trace.h | 31 +++++++++++++++++++++++++++++++ 2 files changed, 35 insertions(+), 1 deletion(-)
fs/nfsd/filecache.c +4 -1
@@ -314,10 +314,13 @@ static void nfsd_file_fsync(struct nfsd_file *nf) {struct file *file = nf->nf_file; +int ret;if (!file || !(file->f_mode &FMODE_WRITE ))return ; -if (vfs_fsync (file,1 ) !=0 ) + ret =vfs_fsync (file,1 ); +trace_nfsd_file_fsync (nf, ret); +if (ret)nfsd_reset_write_verifier (net_generic (nf->nf_net, nfsd_net_id)); }
fs/nfsd/trace.h +31 -0
@@ -1182,6 +1182,37 @@ DEFINE_EVENT(nfsd_file_lruwalk_class, name, \DEFINE_NFSD_FILE_LRUWALK_EVENT (nfsd_file_gc_removed);DEFINE_NFSD_FILE_LRUWALK_EVENT (nfsd_file_shrinker_removed); +TRACE_EVENT (nfsd_file_fsync, +TP_PROTO ( + const struct nfsd_file *nf, + int ret + ), +TP_ARGS (nf, ret), +TP_STRUCT__entry ( + __field(void *, nf_inode) + __field(int, nf_ref) + __field(int, ret) + __field(unsigned long, nf_flags) + __field(unsigned char, nf_may) + __field(struct file *, nf_file) + ), +TP_fast_assign ( + __entry->nf_inode = nf->nf_inode; + __entry->nf_ref = refcount_read(&nf->nf_ref); + __entry->ret = ret; + __entry->nf_flags = nf->nf_flags; + __entry->nf_may = nf->nf_may; + __entry->nf_file = nf->nf_file; + ), +TP_printk ("inode=%p ref=%d flags=%s may=%s nf_file=%p ret=%d" , + __entry->nf_inode, + __entry->nf_ref, +show_nf_flags (__entry->nf_flags), +show_nfsd_may_flags (__entry->nf_may), + __entry->nf_file, __entry->ret + ) +); +#include "cache.h" TRACE_DEFINE_ENUM (RC_DROPIT );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 119/183 nfsd: rework refcounting in filecache
In reply to Greg Kroah-HartmanFrom: Jeff Layton <[email protected]>
[ Upstream commit ac3a2585f018f10039b4a856dcb122da88c1c1c9 ]
The filecache refcounting is a bit non-standard for something searchable by RCU, in that we maintain a sentinel reference while it's hashed. This in turn requires that we have to do things differently in the "put" depending on whether its hashed, which we believe to have led to races.
There are other problems in here too. nfsd_file_close_inode_sync can end up freeing an nfsd_file while there are still outstanding references to it, and there are a number of subtle ToC/ToU races.
Rework the code so that the refcount is what drives the lifecycle. When the refcount goes to zero, then unhash and rcu free the object. A task searching for a nfsd_file is allowed to bump its refcount, but only if it's not already 0. Ensure that we don't make any other changes to it until a reference is held.
With this change, the LRU carries a reference. Take special care to deal with it when removing an entry from the list, and ensure that we only repurpose the nf_lru list_head when the refcount is 0 to ensure exclusive access to it.
Stable-dep-of: 0b3a551fa58b ("nfsd: fix handling of cached open files in nfsd4_open codepath")
--- fs/nfsd/filecache.c | 318 +++++++++++++++++++++++--------------------- fs/nfsd/trace.h | 51 +++---- 2 files changed, 189 insertions(+), 180 deletions(-)
fs/nfsd/filecache.c +170 -148
@@ -302,8 +302,7 @@ nfsd_file_alloc(struct nfsd_file_lookup_key *key, unsigned int may)if (key->gc)__set_bit (NFSD_FILE_GC , &nf->nf_flags); nf->nf_inode = key->inode; -/* nf_ref is pre-incremented for hash table */ -refcount_set (&nf->nf_ref,2 ); +refcount_set (&nf->nf_ref,1 ); nf->nf_may = key->need; nf->nf_mark =NULL ; }
@@ -355,24 +354,35 @@ nfsd_file_unhash(struct nfsd_file *nf)return false; } -static bool +static void nfsd_file_free (struct nfsd_file *nf) {s64 age =ktime_to_ms (ktime_sub (ktime_get (), nf->nf_birthtime)); -bool flush = false;trace_nfsd_file_free (nf);this_cpu_inc (nfsd_file_releases);this_cpu_add (nfsd_file_total_age, age); +nfsd_file_unhash (nf); + +/* +* We call fsync here in order to catch writeback errors. It's not +* strictly required by the protocol, but an nfsd_file could get +* evicted from the cache before a COMMIT comes in. If another +* task were to open that file in the interim and scrape the error, +* then the client may never see it. By calling fsync here, we ensure +* that writeback happens before the entry is freed, and that any +* errors reported result in the write verifier changing. +*/ +nfsd_file_fsync (nf); +if (nf->nf_mark)nfsd_file_mark_put (nf->nf_mark);if (nf->nf_file) {get_file (nf->nf_file);filp_close (nf->nf_file,NULL );fput (nf->nf_file); - flush = true; }/*
@@ -380,10 +390,9 @@ nfsd_file_free(struct nfsd_file *nf)* WARN and leak it to preserve system stability. */ if (WARN_ON_ONCE (!list_empty (&nf->nf_lru))) -return flush; +return ;call_rcu (&nf->nf_rcu, nfsd_file_slab_free); -return flush; } static bool
@@ -399,17 +408,23 @@ nfsd_file_check_writeback(struct nfsd_file *nf)mapping_tagged (mapping,PAGECACHE_TAG_WRITEBACK ); } -static void nfsd_file_lru_add (struct nfsd_file *nf) +static bool nfsd_file_lru_add (struct nfsd_file *nf) {set_bit (NFSD_FILE_REFERENCED , &nf->nf_flags); -if (list_lru_add (&nfsd_file_lru, &nf->nf_lru)) +if (list_lru_add (&nfsd_file_lru, &nf->nf_lru)) {trace_nfsd_file_lru_add (nf); +return true; + } +return false; } -static void nfsd_file_lru_remove (struct nfsd_file *nf) +static bool nfsd_file_lru_remove (struct nfsd_file *nf) { -if (list_lru_del (&nfsd_file_lru, &nf->nf_lru)) +if (list_lru_del (&nfsd_file_lru, &nf->nf_lru)) {trace_nfsd_file_lru_del (nf); +return true; + } +return false; } struct nfsd_file *
@@ -420,86 +435,60 @@ nfsd_file_get(struct nfsd_file *nf)return NULL ; } -static void -nfsd_file_unhash_and_queue (struct nfsd_file *nf,struct list_head *dispose) -{ -trace_nfsd_file_unhash_and_queue (nf); -if (nfsd_file_unhash (nf)) { -/* caller must call nfsd_file_dispose_list() later */ -nfsd_file_lru_remove (nf); -list_add (&nf->nf_lru, dispose); - } -} - -static void -nfsd_file_put_noref (struct nfsd_file *nf) -{ -trace_nfsd_file_put (nf); - -if (refcount_dec_and_test (&nf->nf_ref)) { -WARN_ON (test_bit (NFSD_FILE_HASHED , &nf->nf_flags)); -nfsd_file_lru_remove (nf); -nfsd_file_free (nf); - } -} - -static void -nfsd_file_unhash_and_put (struct nfsd_file *nf) -{ -if (nfsd_file_unhash (nf)) -nfsd_file_put_noref (nf); -} - +/** +* nfsd_file_put - put the reference to a nfsd_file +* @nf: nfsd_file of which to put the reference +* +* Put a reference to a nfsd_file. In the non-GC case, we just put the +* reference immediately. In the GC case, if the reference would be +* the last one, the put it on the LRU instead to be cleaned up later. +*/ void nfsd_file_put (struct nfsd_file *nf) {might_sleep (); +trace_nfsd_file_put (nf); -if (test_bit (NFSD_FILE_GC , &nf->nf_flags)) -nfsd_file_lru_add (nf); -else if (refcount_read (&nf->nf_ref) ==2 ) -nfsd_file_unhash_and_put (nf); - -if (!test_bit (NFSD_FILE_HASHED , &nf->nf_flags)) { -nfsd_file_fsync (nf); -nfsd_file_put_noref (nf); - }else if (nf->nf_file &&test_bit (NFSD_FILE_GC , &nf->nf_flags)) { -nfsd_file_put_noref (nf); -nfsd_file_schedule_laundrette (); - }else -nfsd_file_put_noref (nf); -} - -static void -nfsd_file_dispose_list (struct list_head *dispose) -{ -struct nfsd_file *nf; +if (test_bit (NFSD_FILE_GC , &nf->nf_flags) && +test_bit (NFSD_FILE_HASHED , &nf->nf_flags)) { +/* +* If this is the last reference (nf_ref == 1), then try to +* transfer it to the LRU. +*/ +if (refcount_dec_not_one (&nf->nf_ref)) +return ; + +/* Try to add it to the LRU. If that fails, decrement. */ +if (nfsd_file_lru_add (nf)) { +/* If it's still hashed, we're done */ +if (test_bit (NFSD_FILE_HASHED , &nf->nf_flags)) { +nfsd_file_schedule_laundrette (); +return ; + } -while (!list_empty (dispose)) { - nf = list_first_entry(dispose, struct nfsd_file, nf_lru); -list_del_init (&nf->nf_lru); -nfsd_file_fsync (nf); -nfsd_file_put_noref (nf); +/* +* We're racing with unhashing, so try to remove it from +* the LRU. If removal fails, then someone else already +* has our reference. +*/ +if (!nfsd_file_lru_remove (nf)) +return ; + } } +if (refcount_dec_and_test (&nf->nf_ref)) +nfsd_file_free (nf); }static void -nfsd_file_dispose_list_sync (struct list_head *dispose) +nfsd_file_dispose_list (struct list_head *dispose) { -bool flush = false;struct nfsd_file *nf; -while (!list_empty (dispose)) { +while (!list_empty (dispose)) { nf = list_first_entry(dispose, struct nfsd_file, nf_lru);list_del_init (&nf->nf_lru); -nfsd_file_fsync (nf); -if (!refcount_dec_and_test (&nf->nf_ref)) -continue ; -if (nfsd_file_free (nf)) - flush = true; +nfsd_file_free (nf); } -if (flush) -flush_delayed_fput (); } static void
@@ -569,21 +558,8 @@ nfsd_file_lru_cb(struct list_head *item, struct list_lru_one *lru,struct list_head *head = arg; struct nfsd_file *nf = list_entry(item, struct nfsd_file, nf_lru); -/* -* Do a lockless refcount check. The hashtable holds one reference, so -* we look to see if anything else has a reference, or if any have -* been put since the shrinker last ran. Those don't get unhashed and -* released. -* -* Note that in the put path, we set the flag and then decrement the -* counter. Here we check the counter and then test and clear the flag. -* That order is deliberate to ensure that we can do this locklessly. -*/ -if (refcount_read (&nf->nf_ref) >1 ) { -list_lru_isolate (lru, &nf->nf_lru); -trace_nfsd_file_gc_in_use (nf); -return LRU_REMOVED ; - } +/* We should only be dealing with GC entries here */ +WARN_ON_ONCE (!test_bit (NFSD_FILE_GC , &nf->nf_flags));/* * Don't throw out files that are still undergoing I/O or
@@ -594,40 +570,30 @@ nfsd_file_lru_cb(struct list_head *item, struct list_lru_one *lru,return LRU_SKIP ; } +/* If it was recently added to the list, skip it */ if (test_and_clear_bit (NFSD_FILE_REFERENCED , &nf->nf_flags)) {trace_nfsd_file_gc_referenced (nf);return LRU_ROTATE ; } -if (!test_and_clear_bit (NFSD_FILE_HASHED , &nf->nf_flags)) { -trace_nfsd_file_gc_hashed (nf); -return LRU_SKIP ; +/* +* Put the reference held on behalf of the LRU. If it wasn't the last +* one, then just remove it from the LRU and ignore it. +*/ +if (!refcount_dec_and_test (&nf->nf_ref)) { +trace_nfsd_file_gc_in_use (nf); +list_lru_isolate (lru, &nf->nf_lru); +return LRU_REMOVED ; } +/* Refcount went to zero. Unhash it and queue it to the dispose list */ +nfsd_file_unhash (nf);list_lru_isolate_move (lru, &nf->nf_lru, head);this_cpu_inc (nfsd_file_evictions);trace_nfsd_file_gc_disposed (nf);return LRU_REMOVED ; } -/* -* Unhash items on @dispose immediately, then queue them on the -* disposal workqueue to finish releasing them in the background. -* -* cel: Note that between the time list_lru_shrink_walk runs and -* now, these items are in the hash table but marked unhashed. -* Why release these outside of lru_cb ? There's no lock ordering -* problem since lru_cb currently takes no lock. -*/ -static void nfsd_file_gc_dispose_list (struct list_head *dispose) -{ -struct nfsd_file *nf; - -list_for_each_entry (nf, dispose, nf_lru) -nfsd_file_hash_remove (nf); -nfsd_file_dispose_list_delayed (dispose); -} -static void nfsd_file_gc (void ) {
@@ -637,7 +603,7 @@ nfsd_file_gc(void) ret =list_lru_walk (&nfsd_file_lru, nfsd_file_lru_cb, &dispose,list_lru_count (&nfsd_file_lru));trace_nfsd_file_gc_removed (ret,list_lru_count (&nfsd_file_lru)); -nfsd_file_gc_dispose_list (&dispose); +nfsd_file_dispose_list_delayed (&dispose); } static void
@@ -662,7 +628,7 @@ nfsd_file_lru_scan(struct shrinker *s, struct shrink_control *sc) ret =list_lru_shrink_walk (&nfsd_file_lru, sc, nfsd_file_lru_cb, &dispose);trace_nfsd_file_shrinker_removed (ret,list_lru_count (&nfsd_file_lru)); -nfsd_file_gc_dispose_list (&dispose); +nfsd_file_dispose_list_delayed (&dispose);return ret; }
@@ -672,72 +638,111 @@ static struct shrinker nfsd_file_shrinker = { .seeks = 1, }; -/* -* Find all cache items across all net namespaces that match @inode and -* move them to @dispose. The lookup is atomic wrt nfsd_file_acquire(). +/** +* nfsd_file_queue_for_close: try to close out any open nfsd_files for an inode +* @inode: inode on which to close out nfsd_files +* @dispose: list on which to gather nfsd_files to close out +* +* An nfsd_file represents a struct file being held open on behalf of nfsd. An +* open file however can block other activity (such as leases), or cause +* undesirable behavior (e.g. spurious silly-renames when reexporting NFS). +* +* This function is intended to find open nfsd_files when this sort of +* conflicting access occurs and then attempt to close those files out. +* +* Populates the dispose list with entries that have already had their +* refcounts go to zero. The actual free of an nfsd_file can be expensive, +* so we leave it up to the caller whether it wants to wait or not. */ -static unsigned int -__nfsd_file_close_inode (struct inode *inode,struct list_head *dispose) +static void +nfsd_file_queue_for_close (struct inode *inode,struct list_head *dispose) {struct nfsd_file_lookup_key key = { .type =NFSD_FILE_KEY_INODE , .inode = inode, }; -unsigned int count =0 ;struct nfsd_file *nf;rcu_read_lock ();do { +int decrement =1 ; + nf =rhashtable_lookup (&nfsd_file_rhash_tbl, &key, nfsd_file_rhash_params);if (!nf)break ; -nfsd_file_unhash_and_queue (nf, dispose); - count++; + +/* If we raced with someone else unhashing, ignore it */ +if (!nfsd_file_unhash (nf)) +continue ; + +/* If we can't get a reference, ignore it */ +if (!nfsd_file_get (nf)) +continue ; + +/* Extra decrement if we remove from the LRU */ +if (nfsd_file_lru_remove (nf)) + ++decrement; + +/* If refcount goes to 0, then put on the dispose list */ +if (refcount_sub_and_test (decrement, &nf->nf_ref)) { +list_add (&nf->nf_lru, dispose); +trace_nfsd_file_closing (nf); + } }while (1 );rcu_read_unlock (); -return count; }/** -* nfsd_file_close_inode_sync - attempt to forcibly close a nfsd_file +* nfsd_file_close_inode - attempt a delayed close of a nfsd_file * @inode: inode of the file to attempt to remove * -* Unhash and put, then flush and fput all cache items associated with @inode. +* Close out any open nfsd_files that can be reaped for @inode. The +* actual freeing is deferred to the dispose_list_delayed infrastructure. +* +* This is used by the fsnotify callbacks and setlease notifier. */ -void -nfsd_file_close_inode_sync (struct inode *inode) +static void +nfsd_file_close_inode (struct inode *inode) {LIST_HEAD (dispose); -unsigned int count; - count =__nfsd_file_close_inode (inode, &dispose); -trace_nfsd_file_close_inode_sync (inode, count); -nfsd_file_dispose_list_sync (&dispose); +nfsd_file_queue_for_close (inode, &dispose); +nfsd_file_dispose_list_delayed (&dispose); }/** -* nfsd_file_close_inode - attempt a delayed close of a nfsd_file +* nfsd_file_close_inode_sync - attempt to forcibly close a nfsd_file * @inode: inode of the file to attempt to remove * -* Unhash and put all cache item associated with @inode. +* Close out any open nfsd_files that can be reaped for @inode. The +* nfsd_files are closed out synchronously. +* +* This is called from nfsd_rename and nfsd_unlink to avoid silly-renames +* when reexporting NFS. */ -static void -nfsd_file_close_inode (struct inode *inode) +void +nfsd_file_close_inode_sync (struct inode *inode) { +struct nfsd_file *nf;LIST_HEAD (dispose); -unsigned int count; - count =__nfsd_file_close_inode (inode, &dispose); -trace_nfsd_file_close_inode (inode, count); -nfsd_file_dispose_list_delayed (&dispose); +trace_nfsd_file_close (inode); + +nfsd_file_queue_for_close (inode, &dispose); +while (!list_empty (&dispose)) { + nf = list_first_entry(&dispose, struct nfsd_file, nf_lru); +list_del_init (&nf->nf_lru); +nfsd_file_free (nf); + } +flush_delayed_fput (); }/** * nfsd_file_delayed_close - close unused nfsd_files * @work: dummy * -* Walk the LRU list and close any entries that have not been used since +* Walk the LRU list and destroy any entries that have not been used since * the last scan. */ static void
@@ -759,7 +764,7 @@ nfsd_file_lease_notifier_call(struct notifier_block *nb, unsigned long arg,/* Only close files for F_SETLEASE leases */ if (fl->fl_flags &FL_LEASE ) -nfsd_file_close_inode_sync (file_inode (fl->fl_file)); +nfsd_file_close_inode (file_inode (fl->fl_file));return 0 ; }
@@ -880,6 +885,13 @@ nfsd_file_cache_init(void) goto out; } +/** +* __nfsd_file_cache_purge: clean out the cache for shutdown +* @net: net-namespace to shut down the cache (may be NULL) +* +* Walk the nfsd_file cache and close out any that match @net. If @net is NULL, +* then close out everything. Called when an nfsd instance is being shut down. +*/ static void __nfsd_file_cache_purge (struct net *net) {
@@ -893,8 +905,11 @@ __nfsd_file_cache_purge(struct net *net) nf =rhashtable_walk_next (&iter);while (!IS_ERR_OR_NULL (nf)) { -if (!net || nf->nf_net == net) -nfsd_file_unhash_and_queue (nf, &dispose); +if (!net || nf->nf_net == net) { +nfsd_file_unhash (nf); +nfsd_file_lru_remove (nf); +list_add (&nf->nf_lru, &dispose); + } nf =rhashtable_walk_next (&iter); }
@@ -1061,8 +1076,12 @@ nfsd_file_do_acquire(struct svc_rqst *rqstp, struct svc_fh *fhp,if (nf) nf =nfsd_file_get (nf);rcu_read_unlock (); -if (nf) + +if (nf) { +if (nfsd_file_lru_remove (nf)) +WARN_ON_ONCE (refcount_dec_and_test (&nf->nf_ref)); goto wait_for_construction; + } nf =nfsd_file_alloc (&key, may_flags);if (!nf) {
@@ -1095,11 +1114,11 @@ nfsd_file_do_acquire(struct svc_rqst *rqstp, struct svc_fh *fhp, goto out; } open_retry = false; -nfsd_file_put_noref (nf); +if (refcount_dec_and_test (&nf->nf_ref)) +nfsd_file_free (nf); goto retry; } -nfsd_file_lru_remove (nf);this_cpu_inc (nfsd_file_cache_hits); status =nfserrno (nfsd_open_break_lease (file_inode (nf->nf_file), may_flags));
@@ -1109,7 +1128,8 @@ nfsd_file_do_acquire(struct svc_rqst *rqstp, struct svc_fh *fhp,this_cpu_inc (nfsd_file_acquisitions); *pnf = nf; }else { -nfsd_file_put (nf); +if (refcount_dec_and_test (&nf->nf_ref)) +nfsd_file_free (nf); nf =NULL ; }
@@ -1135,8 +1155,10 @@ nfsd_file_do_acquire(struct svc_rqst *rqstp, struct svc_fh *fhp,* If construction failed, or we raced with a call to unlink() * then unhash. */ -if (status != nfs_ok || key.inode->i_nlink ==0 ) -nfsd_file_unhash_and_put (nf); +if (status == nfs_ok && key.inode->i_nlink ==0 ) + status = nfserr_jukebox; +if (status != nfs_ok) +nfsd_file_unhash (nf);clear_bit_unlock (NFSD_FILE_PENDING , &nf->nf_flags);smp_mb__after_atomic ();wake_up_bit (&nf->nf_flags,NFSD_FILE_PENDING );
fs/nfsd/trace.h +19 -32
81 lines not on this page · raw message
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 120/183 nfsd: fix handling of cached open files in nfsd4_open codepath
In reply to Greg Kroah-HartmanFrom: Jeff Layton <[email protected]>
[ Upstream commit 0b3a551fa58b4da941efeb209b3770868e2eddd7 ]
Commit fb70bf124b05 ("NFSD: Instantiate a struct file when creating a regular NFSv4 file") added the ability to cache an open fd over a compound. There are a couple of problems with the way this currently works:
It's racy, as a newly-created nfsd_file can end up with its PENDING bit cleared while the nf is hashed, and the nf_file pointer is still zeroed out. Other tasks can find it in this state and they expect to see a valid nf_file, and can oops if nf_file is NULL.
Also, there is no guarantee that we'll end up creating a new nfsd_file if one is already in the hash. If an extant entry is in the hash with a valid nf_file, nfs4_get_vfs_file will clobber its nf_file pointer with the value of op_file and the old nf_file will leak.
Fix both issues by making a new nfsd_file_acquirei_opened variant that takes an optional file pointer. If one is present when this is called, we'll take a new reference to it instead of trying to open the file. If the nfsd_file already has a valid nf_file, we'll just ignore the optional file and pass the nfsd_file back as-is.
Also rework the tracepoints a bit to allow for an "opened" variant and don't try to avoid counting acquisitions in the case where we already have a cached open file.
--- fs/nfsd/filecache.c | 40 ++++++++++++++++++---------------- fs/nfsd/filecache.h | 5 +++-- fs/nfsd/nfs4state.c | 16 ++++---------- fs/nfsd/trace.h | 52 ++++++++++++--------------------------------- 4 files changed, 42 insertions(+), 71 deletions(-)
fs/nfsd/filecache.c +22 -18
@@ -1048,8 +1048,8 @@ nfsd_file_is_cached(struct inode *inode)static __be32 nfsd_file_do_acquire (struct svc_rqst *rqstp,struct svc_fh *fhp, -unsigned int may_flags,struct nfsd_file **pnf, -bool open,bool want_gc) +unsigned int may_flags,struct file *file, +struct nfsd_file **pnf,bool want_gc) {struct nfsd_file_lookup_key key = { .type =NFSD_FILE_KEY_FULL ,
@@ -1124,8 +1124,7 @@ nfsd_file_do_acquire(struct svc_rqst *rqstp, struct svc_fh *fhp, status =nfserrno (nfsd_open_break_lease (file_inode (nf->nf_file), may_flags)); out:if (status == nfs_ok) { -if (open) -this_cpu_inc (nfsd_file_acquisitions); +this_cpu_inc (nfsd_file_acquisitions); *pnf = nf; }else {if (refcount_dec_and_test (&nf->nf_ref))
@@ -1135,20 +1134,23 @@ nfsd_file_do_acquire(struct svc_rqst *rqstp, struct svc_fh *fhp, out_status:put_cred (key.cred); -if (open) -trace_nfsd_file_acquire (rqstp, key.inode, may_flags, nf, status); +trace_nfsd_file_acquire (rqstp, key.inode, may_flags, nf, status);return status; open_file:trace_nfsd_file_alloc (nf); nf->nf_mark =nfsd_file_mark_find_or_create (nf, key.inode);if (nf->nf_mark) { -if (open) { +if (file) { +get_file (file); + nf->nf_file = file; + status = nfs_ok; +trace_nfsd_file_opened (nf, status); + }else { status =nfsd_open_verified (rqstp, fhp, may_flags, &nf->nf_file);trace_nfsd_file_open (nf, status); - }else - status = nfs_ok; + } }else status = nfserr_jukebox;/*
@@ -1184,7 +1186,7 @@ __be32 nfsd_file_acquire_gc(struct svc_rqst *rqstp, struct svc_fh *fhp, unsigned int may_flags, struct nfsd_file **pnf) { - return nfsd_file_do_acquire(rqstp, fhp, may_flags, pnf, true, true); + return nfsd_file_do_acquire(rqstp, fhp, may_flags, NULL, pnf, true); }/**
@@ -1205,28 +1207,30 @@ __be32 nfsd_file_acquire(struct svc_rqst *rqstp, struct svc_fh *fhp, unsigned int may_flags, struct nfsd_file **pnf) { - return nfsd_file_do_acquire(rqstp, fhp, may_flags, pnf, true, false); + return nfsd_file_do_acquire(rqstp, fhp, may_flags, NULL, pnf, false); }/** -* nfsd_file_create - Get a struct nfsd_file, do not open +* nfsd_file_acquire_opened - Get a struct nfsd_file using existing open file * @rqstp: the RPC transaction being executed * @fhp: the NFS filehandle of the file just created * @may_flags: NFSD_MAY_ settings for the file +* @file: cached, already-open file (may be NULL) * @pnf: OUT: new or found "struct nfsd_file" object * -* The nfsd_file_object returned by this API is reference-counted -* but not garbage-collected. The object is released immediately -* one RCU grace period after the final nfsd_file_put(). +* Acquire a nfsd_file object that is not GC'ed. If one doesn't already exist, +* and @file is non-NULL, use it to instantiate a new nfsd_file instead of +* opening a new one. * * Returns nfs_ok and sets @pnf on success; otherwise an nfsstat in * network byte order is returned. */ __be32 -nfsd_file_create (struct svc_rqst *rqstp,struct svc_fh *fhp, -unsigned int may_flags,struct nfsd_file **pnf) +nfsd_file_acquire_opened (struct svc_rqst *rqstp,struct svc_fh *fhp, +unsigned int may_flags,struct file *file, +struct nfsd_file **pnf) { -return nfsd_file_do_acquire (rqstp, fhp, may_flags, pnf, false, false); +return nfsd_file_do_acquire (rqstp, fhp, may_flags, file, pnf, false); }/*
fs/nfsd/filecache.h +3 -2
@@ -60,7 +60,8 @@ __be32 nfsd_file_acquire_gc(struct svc_rqst *rqstp, struct svc_fh *fhp, unsigned int may_flags, struct nfsd_file **nfp);__be32 nfsd_file_acquire (struct svc_rqst *rqstp,struct svc_fh *fhp,unsigned int may_flags,struct nfsd_file **nfp); -__be32 nfsd_file_create (struct svc_rqst *rqstp,struct svc_fh *fhp, -unsigned int may_flags,struct nfsd_file **nfp); +__be32 nfsd_file_acquire_opened (struct svc_rqst *rqstp,struct svc_fh *fhp, +unsigned int may_flags,struct file *file, +struct nfsd_file **nfp);int nfsd_file_cache_stats_show (struct seq_file *m,void *v);#endif /* _FS_NFSD_FILECACHE_H */
fs/nfsd/nfs4state.c +4 -12
@@ -5211,18 +5211,10 @@ static __be32 nfs4_get_vfs_file(struct svc_rqst *rqstp, struct nfs4_file *fp,if (!fp->fi_fds[oflag]) {spin_unlock (&fp->fi_lock); -if (!open->op_filp) { - status =nfsd_file_acquire (rqstp, cur_fh, access, &nf); -if (status != nfs_ok) - goto out_put_access; - }else { - status =nfsd_file_create (rqstp, cur_fh, access, &nf); -if (status != nfs_ok) - goto out_put_access; - nf->nf_file = open->op_filp; - open->op_filp =NULL ; -trace_nfsd_file_create (rqstp, access, nf); - } + status =nfsd_file_acquire_opened (rqstp, cur_fh, access, + open->op_filp, &nf); +if (status != nfs_ok) + goto out_put_access;spin_lock (&fp->fi_lock);if (!fp->fi_fds[oflag]) {
fs/nfsd/trace.h +13 -39
70 lines not on this page · raw message
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 121/183 octeontx2-af: Fix LMAC config in cgx_lmac_rx_tx_enable
In reply to Greg Kroah-HartmanFrom: Angela Czubak <[email protected]>
[ Upstream commit b4e9b8763e417db31c7088103cc557d55cb7a8f5 ]
PF netdev can request AF to enable or disable reception and transmission on assigned CGX::LMAC. The current code instead of disabling or enabling 'reception and transmission' also disables/enable the LMAC. This patch fixes this issue.
--- drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 4 ++-- drivers/net/ethernet/marvell/octeontx2/af/cgx.h | 1 - 2 files changed, 2 insertions(+), 3 deletions(-)
drivers/net/ethernet/marvell/octeontx2/af/cgx.c +2 -2
@@ -768,9 +768,9 @@ int cgx_lmac_rx_tx_enable(void *cgxd, int lmac_id, bool enable) cfg =cgx_read (cgx, lmac_id,CGXX_CMRX_CFG );if (enable) - cfg |=CMR_EN |DATA_PKT_RX_EN |DATA_PKT_TX_EN ; + cfg |=DATA_PKT_RX_EN |DATA_PKT_TX_EN ;else - cfg &= ~(CMR_EN |DATA_PKT_RX_EN |DATA_PKT_TX_EN ); + cfg &= ~(DATA_PKT_RX_EN |DATA_PKT_TX_EN );cgx_write (cgx, lmac_id,CGXX_CMRX_CFG , cfg);return 0 ; }
drivers/net/ethernet/marvell/octeontx2/af/cgx.h +0 -1
@@ -30,7 +30,6 @@#define CMR_P2X_SEL_SHIFT 59ULL#define CMR_P2X_SEL_NIX0 1ULL#define CMR_P2X_SEL_NIX1 2ULL -#define CMR_EN BIT_ULL(55)#define DATA_PKT_TX_EN BIT_ULL(53)#define DATA_PKT_RX_EN BIT_ULL(54)#define CGX_LMAC_TYPE_SHIFT 40
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 122/183 sched/core: Fix arch_scale_freq_tick() on tickless systems
In reply to Greg Kroah-HartmanFrom: Yair Podemsky <[email protected]>
[ Upstream commit 7fb3ff22ad8772bbf0e3ce1ef3eb7b09f431807f ]
In order for the scheduler to be frequency invariant we measure the ratio between the maximum CPU frequency and the actual CPU frequency.
During long tickless periods of time the calculations that keep track of that might overflow, in the function scale_freq_tick():
if (check_shl_overflow(acnt, 2*SCHED_CAPACITY_SHIFT, &acnt))
goto error;
eventually forcing the kernel to disable the feature for all CPUs, and show the warning message:
"Scheduler frequency invariance went wobbly, disabling!".
Let's avoid that by limiting the frequency invariant calculations to CPUs with regular tick.
--- kernel/sched/core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
kernel/sched/core.c +3 -1
@@ -5498,7 +5498,9 @@ void scheduler_tick(void)unsigned long thermal_pressure;u64 resched_latency; -arch_scale_freq_tick (); +if (housekeeping_cpu (cpu,HK_TYPE_TICK )) +arch_scale_freq_tick (); +sched_clock_tick ();rq_lock (rq, &rf);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 123/183 blk-mq: move the srcu_struct used for quiescing to the tagset
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
[ Upstream commit 80bd4a7aab4c9ce59bf5e35fdf52aa23d8a3c9f5 ]
All I/O submissions have fairly similar latencies, and a tagset-wide quiesce is a fairly common operation.
Stable-dep-of: 49e4d04f0486 ("block: Drop spurious might_sleep() from blk_put_queue()")
--- block/blk-core.c | 27 +++++---------------------- block/blk-mq.c | 33 +++++++++++++++++++++++++-------- block/blk-mq.h | 14 +++++++------- block/blk-sysfs.c | 9 ++------- block/blk.h | 9 +-------- block/genhd.c | 2 +- include/linux/blk-mq.h | 4 ++++ include/linux/blkdev.h | 9 --------- 8 files changed, 45 insertions(+), 62 deletions(-)
block/blk-core.c +5 -22
@@ -65,7 +65,6 @@ DEFINE_IDA(blk_queue_ida);* For queue allocation */ struct kmem_cache *blk_requestq_cachep; -struct kmem_cache *blk_requestq_srcu_cachep;/* * Controlling structure to kblockd
@@ -373,26 +372,20 @@ static void blk_timeout_work(struct work_struct *work) { } -struct request_queue *blk_alloc_queue (int node_id,bool alloc_srcu) +struct request_queue *blk_alloc_queue (int node_id) {struct request_queue *q; - q =kmem_cache_alloc_node (blk_get_queue_kmem_cache (alloc_srcu), -GFP_KERNEL | __GFP_ZERO, node_id); + q =kmem_cache_alloc_node (blk_requestq_cachep,GFP_KERNEL | __GFP_ZERO, + node_id);if (!q)return NULL ; -if (alloc_srcu) { -blk_queue_flag_set (QUEUE_FLAG_HAS_SRCU , q); -if (init_srcu_struct (q->srcu) !=0 ) - goto fail_q; - } - q->last_merge =NULL ; q->id =ida_alloc (&blk_queue_ida,GFP_KERNEL );if (q->id <0 ) - goto fail_srcu; + goto fail_q; q->stats =blk_alloc_queue_stats ();if (!q->stats)
@@ -434,11 +427,8 @@ struct request_queue *blk_alloc_queue(int node_id, bool alloc_srcu)blk_free_queue_stats (q->stats); fail_id:ida_free (&blk_queue_ida, q->id); -fail_srcu: -if (alloc_srcu) -cleanup_srcu_struct (q->srcu); fail_q: -kmem_cache_free (blk_get_queue_kmem_cache (alloc_srcu), q); +kmem_cache_free (blk_requestq_cachep, q);return NULL ; }
@@ -1183,9 +1173,6 @@ int __init blk_dev_init(void) sizeof_field(struct request, cmd_flags));BUILD_BUG_ON (REQ_OP_BITS +REQ_FLAG_BITS >8 * sizeof_field(struct bio, bi_opf)); -BUILD_BUG_ON (ALIGN (offsetof(struct request_queue , srcu), - __alignof__(struct request_queue )) != -sizeof (struct request_queue ));/* used for unplugging and affects IO latency/throughput - HIGHPRI */ kblockd_workqueue = alloc_workqueue("kblockd",
@@ -1196,10 +1183,6 @@ int __init blk_dev_init(void) blk_requestq_cachep =kmem_cache_create ("request_queue" ,sizeof (struct request_queue ),0 ,SLAB_PANIC ,NULL ); - blk_requestq_srcu_cachep =kmem_cache_create ("request_queue_srcu" , -sizeof (struct request_queue ) + -sizeof (struct srcu_struct ),0 ,SLAB_PANIC ,NULL ); - blk_debugfs_root =debugfs_create_dir ("block" ,NULL );return 0 ;
block/blk-mq.c +25 -8
@@ -261,8 +261,8 @@ EXPORT_SYMBOL_GPL(blk_mq_quiesce_queue_nowait);*/ void blk_mq_wait_quiesce_done (struct request_queue *q) { -if (blk_queue_has_srcu (q)) -synchronize_srcu (q->srcu); +if (q->tag_set->flags &BLK_MQ_F_BLOCKING ) +synchronize_srcu (q->tag_set->srcu);else synchronize_rcu (); }
@@ -4007,7 +4007,7 @@ static struct request_queue *blk_mq_init_queue_data(struct blk_mq_tag_set *set,struct request_queue *q;int ret; - q =blk_alloc_queue (set->numa_node, set->flags &BLK_MQ_F_BLOCKING ); + q =blk_alloc_queue (set->numa_node);if (!q)return ERR_PTR (-ENOMEM ); q->queuedata = queuedata;
@@ -4179,9 +4179,6 @@ static void blk_mq_update_poll_flag(struct request_queue *q)int blk_mq_init_allocated_queue (struct blk_mq_tag_set *set,struct request_queue *q) { -WARN_ON_ONCE (blk_queue_has_srcu (q) != - !!(set->flags &BLK_MQ_F_BLOCKING )); -/* mark the queue as mq asap */ q->mq_ops = set->ops;
@@ -4438,8 +4435,18 @@ int blk_mq_alloc_tag_set(struct blk_mq_tag_set *set)if (set->nr_maps ==1 && set->nr_hw_queues > nr_cpu_ids) set->nr_hw_queues = nr_cpu_ids; -if (blk_mq_alloc_tag_set_tags (set, set->nr_hw_queues) <0 ) -return -ENOMEM ; +if (set->flags &BLK_MQ_F_BLOCKING ) { + set->srcu =kmalloc (sizeof (*set->srcu),GFP_KERNEL ); +if (!set->srcu) +return -ENOMEM ; + ret =init_srcu_struct (set->srcu); +if (ret) + goto out_free_srcu; + } + + ret =blk_mq_alloc_tag_set_tags (set, set->nr_hw_queues); +if (ret) + goto out_cleanup_srcu; ret = -ENOMEM ;for (i =0 ; i < set->nr_maps; i++) {
@@ -4469,6 +4476,12 @@ int blk_mq_alloc_tag_set(struct blk_mq_tag_set *set) }kfree (set->tags); set->tags =NULL ; +out_cleanup_srcu: +if (set->flags &BLK_MQ_F_BLOCKING ) +cleanup_srcu_struct (set->srcu); +out_free_srcu: +if (set->flags &BLK_MQ_F_BLOCKING ) +kfree (set->srcu);return ret; }EXPORT_SYMBOL (blk_mq_alloc_tag_set);
@@ -4508,6 +4521,10 @@ void blk_mq_free_tag_set(struct blk_mq_tag_set *set)kfree (set->tags); set->tags =NULL ; +if (set->flags &BLK_MQ_F_BLOCKING ) { +cleanup_srcu_struct (set->srcu); +kfree (set->srcu); + } }EXPORT_SYMBOL (blk_mq_free_tag_set);
block/blk-mq.h +7 -7
@@ -377,17 +377,17 @@ static inline bool hctx_may_queue(struct blk_mq_hw_ctx *hctx,/* run the code block in @dispatch_ops with rcu/srcu read lock held */ #define __blk_mq_run_dispatch_ops (q, check_sleep, dispatch_ops) \ do { \ - if (!blk_queue_has_srcu(q)) { \ - rcu_read_lock(); \ - (dispatch_ops); \ - rcu_read_unlock(); \ - } else { \ + if ((q)->tag_set->flags & BLK_MQ_F_BLOCKING) { \ int srcu_idx; \ \ might_sleep_if(check_sleep); \ - srcu_idx = srcu_read_lock((q)->srcu); \ + srcu_idx = srcu_read_lock((q)->tag_set->srcu); \ (dispatch_ops); \ - srcu_read_unlock((q)->srcu, srcu_idx); \ + srcu_read_unlock((q)->tag_set->srcu, srcu_idx); \ + } else { \ + rcu_read_lock(); \ + (dispatch_ops); \ + rcu_read_unlock(); \ } \ } while (0)
block/blk-sysfs.c +2 -7
@@ -739,10 +739,8 @@ queue_attr_store(struct kobject *kobj, struct attribute *attr,static void blk_free_queue_rcu (struct rcu_head *rcu_head) { - struct request_queue *q = container_of(rcu_head, struct request_queue, - rcu_head); - -kmem_cache_free (blk_get_queue_kmem_cache (blk_queue_has_srcu (q)), q); +kmem_cache_free (blk_requestq_cachep, + container_of(rcu_head, struct request_queue, rcu_head)); }/**
@@ -779,9 +777,6 @@ static void blk_release_queue(struct kobject *kobj)if (queue_is_mq (q))blk_mq_release (q); -if (blk_queue_has_srcu (q)) -cleanup_srcu_struct (q->srcu); -ida_free (&blk_queue_ida, q->id);call_rcu (&q->rcu_head, blk_free_queue_rcu); }
block/blk.h +1 -8
@@ -27,7 +27,6 @@ struct blk_flush_queue { };extern struct kmem_cache *blk_requestq_cachep; -extern struct kmem_cache *blk_requestq_srcu_cachep;extern struct kobj_type blk_queue_ktype;extern struct ida blk_queue_ida;
@@ -428,13 +427,7 @@ int bio_add_hw_page(struct request_queue *q, struct bio *bio, struct page *page, unsigned int len, unsigned int offset, unsigned int max_sectors, bool *same_page); -static inline struct kmem_cache *blk_get_queue_kmem_cache (bool srcu) -{ -if (srcu) -return blk_requestq_srcu_cachep; -return blk_requestq_cachep; -} -struct request_queue *blk_alloc_queue (int node_id,bool alloc_srcu); +struct request_queue *blk_alloc_queue (int node_id);int disk_scan_partitions (struct gendisk *disk,fmode_t mode,void *owner);
block/genhd.c +1 -1
@@ -1417,7 +1417,7 @@ struct gendisk *__blk_alloc_disk(int node, struct lock_class_key *lkclass)struct request_queue *q;struct gendisk *disk; - q =blk_alloc_queue (node, false); + q =blk_alloc_queue (node);if (!q)return NULL ;
include/linux/blk-mq.h +4 -0
@@ -7,6 +7,7 @@#include <linux/lockdep.h> #include <linux/scatterlist.h> #include <linux/prefetch.h> +#include <linux/srcu.h> struct blk_mq_tags ;struct blk_flush_queue ;
@@ -501,6 +502,8 @@ enum hctx_type {* @tag_list_lock: Serializes tag_list accesses. * @tag_list: List of the request queues that use this tag set. See also * request_queue.tag_set_list. +* @srcu: Use as lock when type of the request queue is blocking +* (BLK_MQ_F_BLOCKING). */ struct blk_mq_tag_set {struct blk_mq_queue_map map[HCTX_MAX_TYPES ];
@@ -521,6 +524,7 @@ struct blk_mq_tag_set {struct mutex tag_list_lock;struct list_head tag_list; +struct srcu_struct *srcu; };/**
include/linux/blkdev.h +0 -9
@@ -22,7 +22,6 @@#include <linux/blkzoned.h> #include <linux/sched.h> #include <linux/sbitmap.h> -#include <linux/srcu.h> #include <linux/uuid.h> #include <linux/xarray.h>
@@ -544,18 +543,11 @@ struct request_queue {struct mutex debugfs_mutex;bool mq_sysfs_init_done; - -/** -* @srcu: Sleepable RCU. Use as lock when type of the request queue -* is blocking (BLK_MQ_F_BLOCKING). Must be the last member -*/ -struct srcu_struct srcu[]; };/* Keep blk_queue_flag_name[] in sync with the definitions below */ #define QUEUE_FLAG_STOPPED 0/* queue is stopped */ #define QUEUE_FLAG_DYING 1/* queue being torn down */ -#define QUEUE_FLAG_HAS_SRCU 2/* SRCU is allocated */ #define QUEUE_FLAG_NOMERGES 3/* disable merge attempts */ #define QUEUE_FLAG_SAME_COMP 4/* complete on same CPU-group */ #define QUEUE_FLAG_FAIL_IO 5/* fake timeout */
@@ -591,7 +583,6 @@ bool blk_queue_flag_test_and_set(unsigned int flag, struct request_queue *q);#define blk_queue_stopped (q) test_bit(QUEUE_FLAG_STOPPED, &(q)->queue_flags)#define blk_queue_dying (q) test_bit(QUEUE_FLAG_DYING, &(q)->queue_flags) -#define blk_queue_has_srcu (q) test_bit(QUEUE_FLAG_HAS_SRCU, &(q)->queue_flags)#define blk_queue_init_done (q) test_bit(QUEUE_FLAG_INIT_DONE, &(q)->queue_flags)#define blk_queue_nomerges (q) test_bit(QUEUE_FLAG_NOMERGES, &(q)->queue_flags)#define blk_queue_noxmerges (q) \
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 124/183 blk-crypto: pass a gendisk to blk_crypto_sysfs_{,un}register
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
[ Upstream commit 450deb93df7d457cdd93594a1987f9650c749b96 ]
Prepare for changes to the block layer sysfs handling by passing the readily available gendisk to blk_crypto_sysfs_{,un}register.
Stable-dep-of: 49e4d04f0486 ("block: Drop spurious might_sleep() from blk_put_queue()")
--- block/blk-crypto-internal.h | 10 ++++++---- block/blk-crypto-sysfs.c | 7 ++++--- block/blk-sysfs.c | 4 ++-- 3 files changed, 12 insertions(+), 9 deletions(-)
block/blk-crypto-internal.h +6 -4
@@ -21,9 +21,9 @@ extern const struct blk_crypto_mode blk_crypto_modes[];#ifdef CONFIG_BLK_INLINE_ENCRYPTION -int blk_crypto_sysfs_register (struct request_queue *q); +int blk_crypto_sysfs_register (struct gendisk *disk); -void blk_crypto_sysfs_unregister (struct request_queue *q); +void blk_crypto_sysfs_unregister (struct gendisk *disk);void bio_crypt_dun_increment (u64 dun[BLK_CRYPTO_DUN_ARRAY_SIZE ],unsigned int inc);
@@ -67,12 +67,14 @@ static inline bool blk_crypto_rq_is_encrypted(struct request *rq)#else /* CONFIG_BLK_INLINE_ENCRYPTION */ -static inline int blk_crypto_sysfs_register (struct request_queue *q) +static inline int blk_crypto_sysfs_register (struct gendisk *disk) {return 0 ; } -static inline void blk_crypto_sysfs_unregister (struct request_queue *q) { } +static inline void blk_crypto_sysfs_unregister (struct gendisk *disk) +{ +}static inline bool bio_crypt_rq_ctx_compatible (struct request *rq,struct bio *bio)
block/blk-crypto-sysfs.c +4 -3
@@ -126,8 +126,9 @@ static struct kobj_type blk_crypto_ktype = {* If the request_queue has a blk_crypto_profile, create the "crypto" * subdirectory in sysfs (/sys/block/$disk/queue/crypto/). */ -int blk_crypto_sysfs_register (struct request_queue *q) +int blk_crypto_sysfs_register (struct gendisk *disk) { +struct request_queue *q = disk->queue;struct blk_crypto_kobj *obj;int err;
@@ -149,9 +150,9 @@ int blk_crypto_sysfs_register(struct request_queue *q)return 0 ; } -void blk_crypto_sysfs_unregister (struct request_queue *q) +void blk_crypto_sysfs_unregister (struct gendisk *disk) { -kobject_put (q->crypto_kobject); +kobject_put (disk->queue->crypto_kobject); }static int __init blk_crypto_sysfs_init (void )
block/blk-sysfs.c +2 -2
@@ -833,7 +833,7 @@ int blk_register_queue(struct gendisk *disk) goto put_dev; } - ret =blk_crypto_sysfs_register (q); + ret =blk_crypto_sysfs_register (disk);if (ret) goto put_dev;
@@ -910,7 +910,7 @@ void blk_unregister_queue(struct gendisk *disk)*/ if (queue_is_mq (q))blk_mq_sysfs_unregister (disk); -blk_crypto_sysfs_unregister (q); +blk_crypto_sysfs_unregister (disk);mutex_lock (&q->sysfs_lock);elv_unregister_queue (q);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 125/183 block: factor out a blk_debugfs_remove helper
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
[ Upstream commit 6fc75f309d291d328b4ea2f91bef0ff56e4bc7c2 ]
Split the debugfs removal from blk_unregister_queue into a helper so that the it can be reused for blk_register_queue error handling.
Stable-dep-of: 49e4d04f0486 ("block: Drop spurious might_sleep() from blk_put_queue()")
--- block/blk-sysfs.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-)
block/blk-sysfs.c +14 -7
@@ -797,6 +797,19 @@ struct kobj_type blk_queue_ktype = { .release = blk_release_queue, }; +static void blk_debugfs_remove (struct gendisk *disk) +{ +struct request_queue *q = disk->queue; + +mutex_lock (&q->debugfs_mutex); +blk_trace_shutdown (q); +debugfs_remove_recursive (q->debugfs_dir); + q->debugfs_dir =NULL ; + q->sched_debugfs_dir =NULL ; + q->rqos_debugfs_dir =NULL ; +mutex_unlock (&q->debugfs_mutex); +} +/** * blk_register_queue - register a block layer queue with sysfs * @disk: Disk of which the request queue should be registered with sysfs.
@@ -922,11 +935,5 @@ void blk_unregister_queue(struct gendisk *disk)kobject_del (&q->kobj);mutex_unlock (&q->sysfs_dir_lock); -mutex_lock (&q->debugfs_mutex); -blk_trace_shutdown (q); -debugfs_remove_recursive (q->debugfs_dir); - q->debugfs_dir =NULL ; - q->sched_debugfs_dir =NULL ; - q->rqos_debugfs_dir =NULL ; -mutex_unlock (&q->debugfs_mutex); +blk_debugfs_remove (disk); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 126/183 block: fix error unwinding in blk_register_queue
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
[ Upstream commit 40602997be26887bdfa3d58659c3acb4579099e9 ]
blk_register_queue fails to handle errors from blk_mq_sysfs_register, leaks various resources on errors and accidentally sets queue refs percpu refcount to percpu mode on kobject_add failure. Fix all that by properly unwinding on errors.
Stable-dep-of: 49e4d04f0486 ("block: Drop spurious might_sleep() from blk_put_queue()")
--- block/blk-sysfs.c | 28 ++++++++++++++++------------ 1 file changed, 16 insertions(+), 12 deletions(-)
block/blk-sysfs.c +16 -12
@@ -820,13 +820,15 @@ int blk_register_queue(struct gendisk *disk)int ret;mutex_lock (&q->sysfs_dir_lock); - ret =kobject_add (&q->kobj, &disk_to_dev (disk)->kobj,"queue" );if (ret <0 ) - goto unlock; + goto out_unlock_dir; -if (queue_is_mq (q)) -blk_mq_sysfs_register (disk); +if (queue_is_mq (q)) { + ret =blk_mq_sysfs_register (disk); +if (ret) + goto out_del_queue_kobj; + }mutex_lock (&q->sysfs_lock);mutex_lock (&q->debugfs_mutex);
@@ -838,17 +840,17 @@ int blk_register_queue(struct gendisk *disk) ret =disk_register_independent_access_ranges (disk);if (ret) - goto put_dev; + goto out_debugfs_remove;if (q->elevator) { ret =elv_register_queue (q, false);if (ret) - goto put_dev; + goto out_unregister_ia_ranges; } ret =blk_crypto_sysfs_register (disk);if (ret) - goto put_dev; + goto out_elv_unregister;blk_queue_flag_set (QUEUE_FLAG_REGISTERED , q);wbt_enable_default (q);
@@ -859,8 +861,6 @@ int blk_register_queue(struct gendisk *disk)if (q->elevator)kobject_uevent (&q->elevator->kobj,KOBJ_ADD );mutex_unlock (&q->sysfs_lock); - -unlock:mutex_unlock (&q->sysfs_dir_lock);/*
@@ -879,13 +879,17 @@ int blk_register_queue(struct gendisk *disk)return ret; -put_dev: +out_elv_unregister:elv_unregister_queue (q); +out_unregister_ia_ranges:disk_unregister_independent_access_ranges (disk); +out_debugfs_remove: +blk_debugfs_remove (disk);mutex_unlock (&q->sysfs_lock); -mutex_unlock (&q->sysfs_dir_lock); +out_del_queue_kobj:kobject_del (&q->kobj); - +out_unlock_dir: +mutex_unlock (&q->sysfs_dir_lock);return ret; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 127/183 block: untangle request_queue refcounting from sysfs
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
[ Upstream commit 2bd85221a625b316114bafaab527770b607095d3 ]
The kobject embedded into the request_queue is used for the queue directory in sysfs, but that is a child of the gendisks directory and is intimately tied to it. Move this kobject to the gendisk and use a refcount_t in the request_queue for the actual request_queue refcounting that is completely unrelated to the device model.
Stable-dep-of: 49e4d04f0486 ("block: Drop spurious might_sleep() from blk_put_queue()")
--- block/blk-core.c | 42 ++++++++++++++++---- block/blk-crypto-sysfs.c | 4 +- block/blk-ia-ranges.c | 3 +- block/blk-sysfs.c | 86 +++++++++++----------------------------- block/blk.h | 4 -- block/bsg.c | 11 +++-- block/elevator.c | 2 +- include/linux/blkdev.h | 6 +-- 8 files changed, 71 insertions(+), 87 deletions(-)
block/blk-core.c +34 -8
@@ -59,12 +59,12 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(block_split);EXPORT_TRACEPOINT_SYMBOL_GPL (block_unplug);EXPORT_TRACEPOINT_SYMBOL_GPL (block_rq_insert); -DEFINE_IDA (blk_queue_ida); +static DEFINE_IDA (blk_queue_ida);/* * For queue allocation */ -struct kmem_cache *blk_requestq_cachep; +static struct kmem_cache *blk_requestq_cachep;/* * Controlling structure to kblockd
@@ -252,19 +252,46 @@ void blk_clear_pm_only(struct request_queue *q) }EXPORT_SYMBOL_GPL (blk_clear_pm_only); +static void blk_free_queue_rcu (struct rcu_head *rcu_head) +{ +kmem_cache_free (blk_requestq_cachep, + container_of(rcu_head, struct request_queue, rcu_head)); +} + +static void blk_free_queue (struct request_queue *q) +{ +might_sleep (); + +percpu_ref_exit (&q->q_usage_counter); + +if (q->poll_stat) +blk_stat_remove_callback (q, q->poll_cb); +blk_stat_free_callback (q->poll_cb); + +blk_free_queue_stats (q->stats); +kfree (q->poll_stat); + +if (queue_is_mq (q)) +blk_mq_release (q); + +ida_free (&blk_queue_ida, q->id); +call_rcu (&q->rcu_head, blk_free_queue_rcu); +} +/** * blk_put_queue - decrement the request_queue refcount * @q: the request_queue structure to decrement the refcount for * -* Decrements the refcount of the request_queue kobject. When this reaches 0 -* we'll have blk_release_queue() called. +* Decrements the refcount of the request_queue and free it when the refcount +* reaches 0. * * Context: Any context, but the last reference must not be dropped from * atomic context. */ void blk_put_queue (struct request_queue *q) { -kobject_put (&q->kobj); +if (refcount_dec_and_test (&q->refs)) +blk_free_queue (q); }EXPORT_SYMBOL (blk_put_queue);
@@ -399,8 +426,7 @@ struct request_queue *blk_alloc_queue(int node_id)INIT_WORK (&q->timeout_work, blk_timeout_work);INIT_LIST_HEAD (&q->icq_list); -kobject_init (&q->kobj, &blk_queue_ktype); - +refcount_set (&q->refs,1 );mutex_init (&q->debugfs_mutex);mutex_init (&q->sysfs_lock);mutex_init (&q->sysfs_dir_lock);
@@ -444,7 +470,7 @@ bool blk_get_queue(struct request_queue *q) {if (unlikely (blk_queue_dying (q)))return false; -kobject_get (&q->kobj); +refcount_inc (&q->refs);return true; }EXPORT_SYMBOL (blk_get_queue);
block/blk-crypto-sysfs.c +2 -2
@@ -140,8 +140,8 @@ int blk_crypto_sysfs_register(struct gendisk *disk)return -ENOMEM ; obj->profile = q->crypto_profile; - err =kobject_init_and_add (&obj->kobj, &blk_crypto_ktype, &q->kobj, -"crypto" ); + err =kobject_init_and_add (&obj->kobj, &blk_crypto_ktype, + &disk->queue_kobj,"crypto" );if (err) {kobject_put (&obj->kobj);return err;
block/blk-ia-ranges.c +2 -1
@@ -123,7 +123,8 @@ int disk_register_independent_access_ranges(struct gendisk *disk)*/ WARN_ON (iars->sysfs_registered); ret =kobject_init_and_add (&iars->kobj, &blk_ia_ranges_ktype, - &q->kobj,"%s" ,"independent_access_ranges" ); + &disk->queue_kobj,"%s" , +"independent_access_ranges" );if (ret) { disk->ia_ranges =NULL ;kobject_put (&iars->kobj);
block/blk-sysfs.c +23 -63
156 lines not on this page · raw message
block/blk.h +0 -4
@@ -26,10 +26,6 @@ struct blk_flush_queue {spinlock_t mq_flush_lock; }; -extern struct kmem_cache *blk_requestq_cachep; -extern struct kobj_type blk_queue_ktype; -extern struct ida blk_queue_ida; -bool is_flush_rq (struct request *req); struct blk_flush_queue *blk_alloc_flush_queue(int node, int cmd_size,
block/bsg.c +7 -4
@@ -175,8 +175,10 @@ static void bsg_device_release(struct device *dev)void bsg_unregister_queue (struct bsg_device *bd) { -if (bd->queue->kobj.sd) -sysfs_remove_link (&bd->queue->kobj,"bsg" ); +struct gendisk *disk = bd->queue->disk; + +if (disk && disk->queue_kobj.sd) +sysfs_remove_link (&disk->queue_kobj,"bsg" );cdev_device_del (&bd->cdev, &bd->device);put_device (&bd->device); }
@@ -216,8 +218,9 @@ struct bsg_device *bsg_register_queue(struct request_queue *q,if (ret) goto out_put_device; -if (q->kobj.sd) { - ret =sysfs_create_link (&q->kobj, &bd->device.kobj,"bsg" ); +if (q->disk && q->disk->queue_kobj.sd) { + ret =sysfs_create_link (&q->disk->queue_kobj, &bd->device.kobj, +"bsg" );if (ret) goto out_device_del; }
block/elevator.c +1 -1
@@ -499,7 +499,7 @@ int elv_register_queue(struct request_queue *q, bool uevent)lockdep_assert_held (&q->sysfs_lock); - error =kobject_add (&e->kobj, &q->kobj,"%s" ,"iosched" ); + error =kobject_add (&e->kobj, &q->disk->queue_kobj,"iosched" );if (!error) {struct elv_fs_entry *attr = e->type->elevator_attrs;if (attr) {
include/linux/blkdev.h +2 -4
@@ -155,6 +155,7 @@ struct gendisk {unsigned open_partitions;/* number of open partitions */ struct backing_dev_info *bdi; +struct kobject queue_kobj;/* the queue/ directory */ struct kobject *slave_dir;#ifdef CONFIG_BLOCK_HOLDER_DEPRECATED struct list_head slave_bdevs;
@@ -437,10 +438,7 @@ struct request_queue {struct gendisk *disk; -/* -* queue kobject -*/ -struct kobject kobj; +refcount_t refs;/* * mq queue kobject
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 128/183 block: mark blk_put_queue as potentially blocking
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
[ Upstream commit 63f93fd6fa5717769a78d6d7bea6f7f9a1ccca8e ]
We can't just say that the last reference release may block, as any reference dropped could be the last one. So move the might_sleep() from blk_free_queue to blk_put_queue and update the documentation.
Stable-dep-of: 49e4d04f0486 ("block: Drop spurious might_sleep() from blk_put_queue()")
--- block/blk-core.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
block/blk-core.c +2 -4
@@ -260,8 +260,6 @@ static void blk_free_queue_rcu(struct rcu_head *rcu_head)static void blk_free_queue (struct request_queue *q) { -might_sleep (); -percpu_ref_exit (&q->q_usage_counter);if (q->poll_stat)
@@ -285,11 +283,11 @@ static void blk_free_queue(struct request_queue *q)* Decrements the refcount of the request_queue and free it when the refcount * reaches 0. * -* Context: Any context, but the last reference must not be dropped from -* atomic context. +* Context: Can sleep. */ void blk_put_queue (struct request_queue *q) { +might_sleep ();if (refcount_dec_and_test (&q->refs))blk_free_queue (q); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 129/183 block: Drop spurious might_sleep() from blk_put_queue()
In reply to Greg Kroah-HartmanFrom: Tejun Heo <[email protected]>
[ Upstream commit 49e4d04f0486117ac57a97890eb1db6d52bf82b3 ]
Dan reports the following smatch detected the following:
block/blk-cgroup.c:1863 blkcg_schedule_throttle() warn: sleeping in atomic context
caused by blkcg_schedule_throttle() calling blk_put_queue() in an non-sleepable context.
blk_put_queue() acquired might_sleep() in 63f93fd6fa57 ("block: mark blk_put_queue as potentially blocking") which transferred the might_sleep() from blk_free_queue().
blk_free_queue() acquired might_sleep() in e8c7d14ac6c3 ("block: revert back to synchronous request_queue removal") while turning request_queue removal synchronous. However, this isn't necessary as nothing in the free path actually requires sleeping.
It's pretty unusual to require a sleeping context in a put operation and it's not needed in the first place. Let's drop it.
--- block/blk-core.c | 3 --- 1 file changed, 3 deletions(-)
block/blk-core.c +0 -3
@@ -282,12 +282,9 @@ static void blk_free_queue(struct request_queue *q)* * Decrements the refcount of the request_queue and free it when the refcount * reaches 0. -* -* Context: Can sleep. */ void blk_put_queue (struct request_queue *q) { -might_sleep ();if (refcount_dec_and_test (&q->refs))blk_free_queue (q); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 130/183 hvc/xen: lock console list traversal
In reply to Greg Kroah-HartmanFrom: Roger Pau Monne <[email protected]>
[ Upstream commit c0dccad87cf68fc6012aec7567e354353097ec1a ]
The currently lockless access to the xen console list in vtermno_to_xencons() is incorrect, as additions and removals from the list can happen anytime, and as such the traversal of the list to get the private console data for a given termno needs to happen with the lock held. Note users that modify the list already do so with the lock taken.
Adjust current lock takers to use the _irq{save,restore} helpers, since the context in which vtermno_to_xencons() is called can have interrupts disabled. Use the _irq{save,restore} set of helpers to switch the current callers to disable interrupts in the locked region. I haven't checked if existing users could instead use the _irq variant, as I think it's safer to use _irq{save,restore} upfront.
While there switch from using list_for_each_entry_safe tolist_for_each_entry: the current entry cursor won't be removed as part of the code in the loop body, so using the _safe variant is pointless.
--- drivers/tty/hvc/hvc_xen.c | 46 ++++++++++++++++++++++++--------------- 1 file changed, 29 insertions(+), 17 deletions(-)
drivers/tty/hvc/hvc_xen.c +29 -17
@@ -52,17 +52,22 @@ static DEFINE_SPINLOCK(xencons_lock);static struct xencons_info *vtermno_to_xencons (int vtermno) { -struct xencons_info *entry, *n, *ret =NULL ; +struct xencons_info *entry, *ret =NULL ; +unsigned long flags; -if (list_empty (&xenconsoles)) -return NULL ; +spin_lock_irqsave (&xencons_lock, flags); +if (list_empty (&xenconsoles)) { +spin_unlock_irqrestore (&xencons_lock, flags); +return NULL ; + } -list_for_each_entry_safe (entry, n, &xenconsoles, list) { +list_for_each_entry (entry, &xenconsoles, list) {if (entry->vtermno == vtermno) { ret = entry;break ; } } +spin_unlock_irqrestore (&xencons_lock, flags);return ret; }
@@ -223,7 +228,7 @@ static int xen_hvm_console_init(void) {int r;uint64_t v =0 ; -unsigned long gfn; +unsigned long gfn, flags;struct xencons_info *info;if (!xen_hvm_domain ())
@@ -258,9 +263,9 @@ static int xen_hvm_console_init(void) goto err; info->vtermno =HVC_COOKIE ; -spin_lock (&xencons_lock); +spin_lock_irqsave (&xencons_lock, flags);list_add_tail (&info->list, &xenconsoles); -spin_unlock (&xencons_lock); +spin_unlock_irqrestore (&xencons_lock, flags);return 0 ; err:
@@ -283,6 +288,7 @@ static int xencons_info_pv_init(struct xencons_info *info, int vtermno)static int xen_pv_console_init (void ) {struct xencons_info *info; +unsigned long flags;if (!xen_pv_domain ())return -ENODEV ;
@@ -299,9 +305,9 @@ static int xen_pv_console_init(void)/* already configured */ return 0 ; } -spin_lock (&xencons_lock); +spin_lock_irqsave (&xencons_lock, flags);xencons_info_pv_init (info,HVC_COOKIE ); -spin_unlock (&xencons_lock); +spin_unlock_irqrestore (&xencons_lock, flags);return 0 ; }
@@ -309,6 +315,7 @@ static int xen_pv_console_init(void)static int xen_initial_domain_console_init (void ) {struct xencons_info *info; +unsigned long flags;if (!xen_initial_domain ())return -ENODEV ;
@@ -323,9 +330,9 @@ static int xen_initial_domain_console_init(void) info->irq =bind_virq_to_irq (VIRQ_CONSOLE ,0 , false); info->vtermno =HVC_COOKIE ; -spin_lock (&xencons_lock); +spin_lock_irqsave (&xencons_lock, flags);list_add_tail (&info->list, &xenconsoles); -spin_unlock (&xencons_lock); +spin_unlock_irqrestore (&xencons_lock, flags);return 0 ; }
@@ -380,10 +387,12 @@ static void xencons_free(struct xencons_info *info)static int xen_console_remove (struct xencons_info *info) { +unsigned long flags; +xencons_disconnect_backend (info); -spin_lock (&xencons_lock); +spin_lock_irqsave (&xencons_lock, flags);list_del (&info->list); -spin_unlock (&xencons_lock); +spin_unlock_irqrestore (&xencons_lock, flags);if (info->xbdev !=NULL )xencons_free (info);else {
@@ -464,6 +473,7 @@ static int xencons_probe(struct xenbus_device *dev, {int ret, devid;struct xencons_info *info; +unsigned long flags; devid = dev->nodename[strlen (dev->nodename) -1 ] -'0' ;if (devid ==0 )
@@ -482,9 +492,9 @@ static int xencons_probe(struct xenbus_device *dev, ret =xencons_connect_backend (dev, info);if (ret <0 ) goto error; -spin_lock (&xencons_lock); +spin_lock_irqsave (&xencons_lock, flags);list_add_tail (&info->list, &xenconsoles); -spin_unlock (&xencons_lock); +spin_unlock_irqrestore (&xencons_lock, flags);return 0 ;
@@ -584,10 +594,12 @@ static int __init xen_hvc_init(void) info->hvc =hvc_alloc (HVC_COOKIE , info->irq, ops,256 );if (IS_ERR (info->hvc)) { +unsigned long flags; + r =PTR_ERR (info->hvc); -spin_lock (&xencons_lock); +spin_lock_irqsave (&xencons_lock, flags);list_del (&info->list); -spin_unlock (&xencons_lock); +spin_unlock_irqrestore (&xencons_lock, flags);if (info->irq)unbind_from_irqhandler (info->irq,NULL );kfree (info);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 131/183 nfc: pn533: Wait for out_urbs completion in pn533_usb_send_frame()
In reply to Greg Kroah-HartmanFrom: Minsuk Kang <[email protected]>
[ Upstream commit 9dab880d675b9d0dd56c6428e4e8352a3339371d ]
Fix a use-after-free that occurs in hcd when in_urb sent from pn533_usb_send_frame() is completed earlier than out_urb. Its callback frees the skb data in pn533_send_async_complete() that is used as a transfer buffer of out_urb. Wait before sending in_urb until the callback of out_urb is called. To modify the callback of out_urb alone, separate the complete function of out_urb and ack_urb.
Found by a modified version of syzkaller.
BUG: KASAN: use-after-free in dummy_timer Call Trace: memcpy (mm/kasan/shadow.c:65) dummy_perform_transfer (drivers/usb/gadget/udc/dummy_hcd.c:1352) transfer (drivers/usb/gadget/udc/dummy_hcd.c:1453) dummy_timer (drivers/usb/gadget/udc/dummy_hcd.c:1972) arch_static_branch (arch/x86/include/asm/jump_label.h:27) static_key_false (include/linux/jump_label.h:207) timer_expire_exit (include/trace/events/timer.h:127) call_timer_fn (kernel/time/timer.c:1475) expire_timers (kernel/time/timer.c:1519) __run_timers (kernel/time/timer.c:1790) run_timer_softirq (kernel/time/timer.c:1803)
--- drivers/nfc/pn533/usb.c | 44 ++++++++++++++++++++++++++++++++++++++--- 1 file changed, 41 insertions(+), 3 deletions(-)
drivers/nfc/pn533/usb.c +41 -3
@@ -153,10 +153,17 @@ static int pn533_usb_send_ack(struct pn533 *dev, gfp_t flags)return usb_submit_urb (phy->ack_urb, flags); } +struct pn533_out_arg { +struct pn533_usb_phy *phy; +struct completion done; +}; +static int pn533_usb_send_frame (struct pn533 *dev,struct sk_buff *out) {struct pn533_usb_phy *phy = dev->phy; +struct pn533_out_arg arg; +void *cntx;int rc;if (phy->priv ==NULL )
@@ -168,10 +175,17 @@ static int pn533_usb_send_frame(struct pn533 *dev,print_hex_dump_debug ("PN533 TX: " ,DUMP_PREFIX_NONE ,16 ,1 , out->data, out->len, false); +init_completion (&arg.done); + cntx = phy->out_urb->context; + phy->out_urb->context = &arg; + rc =usb_submit_urb (phy->out_urb,GFP_KERNEL );if (rc)return rc; +wait_for_completion (&arg.done); + phy->out_urb->context = cntx; +if (dev->protocol_type ==PN533_PROTO_REQ_RESP ) {/* request for response for sent packet directly */ rc =pn533_submit_urb_for_response (phy,GFP_KERNEL );
@@ -408,7 +422,31 @@ static int pn533_acr122_poweron_rdr(struct pn533_usb_phy *phy)return arg.rc; } -static void pn533_send_complete (struct urb *urb) +static void pn533_out_complete (struct urb *urb) +{ +struct pn533_out_arg *arg = urb->context; +struct pn533_usb_phy *phy = arg->phy; + +switch (urb->status) { +case 0 : +break ;/* success */ +case -ECONNRESET : +case -ENOENT : +dev_dbg (&phy->udev->dev, +"The urb has been stopped (status %d)\n" , + urb->status); +break ; +case -ESHUTDOWN : +default : +nfc_err (&phy->udev->dev, +"Urb failure (status %d)\n" , + urb->status); + } + +complete (&arg->done); +} + +static void pn533_ack_complete (struct urb *urb) {struct pn533_usb_phy *phy = urb->context;
@@ -496,10 +534,10 @@ static int pn533_usb_probe(struct usb_interface *interface,usb_fill_bulk_urb (phy->out_urb, phy->udev,usb_sndbulkpipe (phy->udev, out_endpoint), -NULL ,0 , pn533_send_complete, phy); +NULL ,0 , pn533_out_complete, phy);usb_fill_bulk_urb (phy->ack_urb, phy->udev,usb_sndbulkpipe (phy->udev, out_endpoint), -NULL ,0 , pn533_send_complete, phy); +NULL ,0 , pn533_ack_complete, phy);switch (id->driver_info) {case PN533_DEVICE_STD :
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 132/183 gro: avoid checking for a failed search
In reply to Greg Kroah-HartmanFrom: Richard Gobert <[email protected]>
[ Upstream commit e081ecf084d31809242fb0b9f35484d5fb3a161a ]
After searching for a protocol handler in dev_gro_receive, checking for failure is redundant. Skip the failure code after finding the corresponding handler.
Stable-dep-of: 7871f54e3dee ("gro: take care of DODGY packets")
--- net/core/gro.c | 70 +++++++++++++++++++++++++------------------------- 1 file changed, 35 insertions(+), 35 deletions(-)
net/core/gro.c +35 -35
@@ -489,45 +489,45 @@ static enum gro_result dev_gro_receive(struct napi_struct *napi, struct sk_buffrcu_read_lock ();list_for_each_entry_rcu (ptype, head, list) { -if (ptype->type != type || !ptype->callbacks.gro_receive) -continue ; - -skb_set_network_header (skb,skb_gro_offset (skb)); -skb_reset_mac_len (skb); - BUILD_BUG_ON(sizeof_field(struct napi_gro_cb, zeroed) != sizeof(u32)); -BUILD_BUG_ON (!IS_ALIGNED (offsetof(struct napi_gro_cb , zeroed), -sizeof (u32)));/* Avoid slow unaligned acc */ - *(u32 *)&NAPI_GRO_CB (skb)->zeroed =0 ; -NAPI_GRO_CB (skb)->flush =skb_has_frag_list (skb); -NAPI_GRO_CB (skb)->is_atomic =1 ; -NAPI_GRO_CB (skb)->count =1 ; -if (unlikely (skb_is_gso (skb))) { -NAPI_GRO_CB (skb)->count =skb_shinfo (skb)->gso_segs; -/* Only support TCP at the moment. */ -if (!skb_is_gso_tcp (skb)) -NAPI_GRO_CB (skb)->flush =1 ; - } - -/* Setup for GRO checksum validation */ -switch (skb->ip_summed) { -case CHECKSUM_COMPLETE : -NAPI_GRO_CB (skb)->csum = skb->csum; -NAPI_GRO_CB (skb)->csum_valid =1 ; -break ; -case CHECKSUM_UNNECESSARY : -NAPI_GRO_CB (skb)->csum_cnt = skb->csum_level +1 ; -break ; - } +if (ptype->type == type && ptype->callbacks.gro_receive) + goto found_ptype; + } +rcu_read_unlock (); + goto normal; + +found_ptype: +skb_set_network_header (skb,skb_gro_offset (skb)); +skb_reset_mac_len (skb); + BUILD_BUG_ON(sizeof_field(struct napi_gro_cb, zeroed) != sizeof(u32)); +BUILD_BUG_ON (!IS_ALIGNED (offsetof(struct napi_gro_cb , zeroed), +sizeof (u32)));/* Avoid slow unaligned acc */ + *(u32 *)&NAPI_GRO_CB (skb)->zeroed =0 ; +NAPI_GRO_CB (skb)->flush =skb_has_frag_list (skb); +NAPI_GRO_CB (skb)->is_atomic =1 ; +NAPI_GRO_CB (skb)->count =1 ; +if (unlikely (skb_is_gso (skb))) { +NAPI_GRO_CB (skb)->count =skb_shinfo (skb)->gso_segs; +/* Only support TCP at the moment. */ +if (!skb_is_gso_tcp (skb)) +NAPI_GRO_CB (skb)->flush =1 ; + } - pp =INDIRECT_CALL_INET (ptype->callbacks.gro_receive, - ipv6_gro_receive, inet_gro_receive, - &gro_list->list, skb); +/* Setup for GRO checksum validation */ +switch (skb->ip_summed) { +case CHECKSUM_COMPLETE : +NAPI_GRO_CB (skb)->csum = skb->csum; +NAPI_GRO_CB (skb)->csum_valid =1 ; +break ; +case CHECKSUM_UNNECESSARY : +NAPI_GRO_CB (skb)->csum_cnt = skb->csum_level +1 ;break ; } -rcu_read_unlock (); -if (&ptype->list == head) - goto normal; + pp =INDIRECT_CALL_INET (ptype->callbacks.gro_receive, + ipv6_gro_receive, inet_gro_receive, + &gro_list->list, skb); + +rcu_read_unlock ();if (PTR_ERR (pp) == -EINPROGRESS ) { ret =GRO_CONSUMED ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 133/183 gro: take care of DODGY packets
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 7871f54e3deed68a27111dda162c4fe9b9c65f8f ]
Jaroslav reported a recent throughput regression with virtio_net caused by blamed commit.
It is unclear if DODGY GSO packets coming from user space can be accepted by GRO engine in the future with minimal changes, and if there is any expected gain from it.
In the meantime, make sure to detect and flush DODGY packets.
--- net/core/gro.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
net/core/gro.c +3 -2
@@ -507,8 +507,9 @@ static enum gro_result dev_gro_receive(struct napi_struct *napi, struct sk_buffNAPI_GRO_CB (skb)->count =1 ;if (unlikely (skb_is_gso (skb))) {NAPI_GRO_CB (skb)->count =skb_shinfo (skb)->gso_segs; -/* Only support TCP at the moment. */ -if (!skb_is_gso_tcp (skb)) +/* Only support TCP and non DODGY users. */ +if (!skb_is_gso_tcp (skb) || + (skb_shinfo (skb)->gso_type &SKB_GSO_DODGY ))NAPI_GRO_CB (skb)->flush =1 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 134/183 af_unix: selftest: Fix the size of the parameter to connect()
In reply to Greg Kroah-HartmanFrom: Mirsad Goran Todorovac <[email protected]>
[ Upstream commit 7d6ceeb1875cc08dc3d1e558e191434d94840cd5 ]
Adjust size parameter in connect() to match the type of the parameter, to fix "No such file or directory" error in selftests/net/af_unix/ test_oob_unix.c:127.
The existing code happens to work provided that the autogenerated pathname is shorter than sizeof (struct sockaddr), which is why it hasn't been noticed earlier.
Visible from the trace excerpt:
bind(3, {sa_family=AF_UNIX, sun_path="unix_oob_453059"}, 110) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fa6a6577a10) = 453060 [pid <child>] connect(6, {sa_family=AF_UNIX, sun_path="unix_oob_45305"}, 16) = -1 ENOENT (No such file or directory)
BUG: The filename is trimmed to sizeof (struct sockaddr).
--- tools/testing/selftests/net/af_unix/test_unix_oob.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/net/af_unix/test_unix_oob.c +1 -1
@@ -124,7 +124,7 @@ void producer(struct sockaddr_un *consumer_addr)wait_for_signal (pipefd[0 ]);if (connect (cfd, (struct sockaddr *)consumer_addr, -sizeof (struct sockaddr )) !=0 ) { +sizeof (*consumer_addr)) !=0 ) {perror ("Connect failed" );kill (0 ,SIGTERM );exit (1 );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 135/183 ASoC: qcom: Fix building APQ8016 machine driver without SOUNDWIRE
In reply to Greg Kroah-HartmanFrom: Stephan Gerhold <[email protected]>
[ Upstream commit 0cbf1ecd8c4801ec7566231491f7ad9cec31098b ]
Older Qualcomm platforms like APQ8016 do not have hardware support for SoundWire, so kernel configurations made specifically for those platforms will usually not have CONFIG_SOUNDWIRE enabled.
Unfortunately commit 8d89cf6ff229 ("ASoC: qcom: cleanup and fix dependency of QCOM_COMMON") breaks those kernel configurations, because SOUNDWIRE is now a required dependency for SND_SOC_QCOM_COMMON (and in turn also SND_SOC_APQ8016_SBC). Trying to migrate such a kernel config silently disables SND_SOC_APQ8016_SBC and breaks audio functionality.
The soundwire helpers in common.c are only used by two of the Qualcomm audio machine drivers, so building and requiring CONFIG_SOUNDWIRE for all platforms is unnecessary.
There is no need to stuff all common code into a single module. Fix the issue by moving the soundwire helpers to a separate SND_SOC_QCOM_SDW module/option that is selected only by the machine drivers that make use of them. This also allows reverting the imply/depends changes from the previous fix because both SM8250 and SC8280XP already depend on SOUNDWIRE, so the soundwire helpers will be only built if SOUNDWIRE is really enabled.
--- sound/soc/qcom/Kconfig | 21 ++++--- sound/soc/qcom/Makefile | 2 + sound/soc/qcom/common.c | 114 ----------------------------------- sound/soc/qcom/common.h | 10 ---- sound/soc/qcom/sc8280xp.c | 1 + sound/soc/qcom/sdw.c | 123 ++++++++++++++++++++++++++++++++++++++ sound/soc/qcom/sdw.h | 18 ++++++ sound/soc/qcom/sm8250.c | 1 + 8 files changed, 157 insertions(+), 133 deletions(-) create mode 100644 sound/soc/qcom/sdw.c create mode 100644 sound/soc/qcom/sdw.h
sound/soc/qcom/Kconfig +12 -9
@@ -2,7 +2,6 @@ menuconfig SND_SOC_QCOM tristate "ASoC support for QCOM platforms" depends on ARCH_QCOM || COMPILE_TEST - imply SND_SOC_QCOM_COMMON help Say Y or M if you want to add support to use audio devices in Qualcomm Technologies SOC-based platforms.
@@ -60,14 +59,16 @@ config SND_SOC_STORM config SND_SOC_APQ8016_SBC tristate "SoC Audio support for APQ8016 SBC platforms" select SND_SOC_LPASS_APQ8016 - depends on SND_SOC_QCOM_COMMON + select SND_SOC_QCOM_COMMON help Support for Qualcomm Technologies LPASS audio block in APQ8016 SOC-based systems. Say Y if you want to use audio devices on MI2S. config SND_SOC_QCOM_COMMON - depends on SOUNDWIRE + tristate + +config SND_SOC_QCOM_SDW tristate config SND_SOC_QDSP6_COMMON
@@ -144,7 +145,7 @@ config SND_SOC_MSM8996 depends on QCOM_APR depends on COMMON_CLK select SND_SOC_QDSP6 - depends on SND_SOC_QCOM_COMMON + select SND_SOC_QCOM_COMMON help Support for Qualcomm Technologies LPASS audio block in APQ8096 SoC-based systems.
@@ -155,7 +156,7 @@ config SND_SOC_SDM845 depends on QCOM_APR && I2C && SOUNDWIRE depends on COMMON_CLK select SND_SOC_QDSP6 - depends on SND_SOC_QCOM_COMMON + select SND_SOC_QCOM_COMMON select SND_SOC_RT5663 select SND_SOC_MAX98927 imply SND_SOC_CROS_EC_CODEC
@@ -169,7 +170,8 @@ config SND_SOC_SM8250 depends on QCOM_APR && SOUNDWIRE depends on COMMON_CLK select SND_SOC_QDSP6 - depends on SND_SOC_QCOM_COMMON + select SND_SOC_QCOM_COMMON + select SND_SOC_QCOM_SDW help To add support for audio on Qualcomm Technologies Inc. SM8250 SoC-based systems.
@@ -180,7 +182,8 @@ config SND_SOC_SC8280XP depends on QCOM_APR && SOUNDWIRE depends on COMMON_CLK select SND_SOC_QDSP6 - depends on SND_SOC_QCOM_COMMON + select SND_SOC_QCOM_COMMON + select SND_SOC_QCOM_SDW help To add support for audio on Qualcomm Technologies Inc. SC8280XP SoC-based systems.
@@ -190,7 +193,7 @@ config SND_SOC_SC7180 tristate "SoC Machine driver for SC7180 boards" depends on I2C && GPIOLIB depends on SOUNDWIRE || SOUNDWIRE=n - depends on SND_SOC_QCOM_COMMON + select SND_SOC_QCOM_COMMON select SND_SOC_LPASS_SC7180 select SND_SOC_MAX98357A select SND_SOC_RT5682_I2C
@@ -204,7 +207,7 @@ config SND_SOC_SC7180 config SND_SOC_SC7280 tristate "SoC Machine driver for SC7280 boards" depends on I2C && SOUNDWIRE - depends on SND_SOC_QCOM_COMMON + select SND_SOC_QCOM_COMMON select SND_SOC_LPASS_SC7280 select SND_SOC_MAX98357A select SND_SOC_WCD938X_SDW
sound/soc/qcom/Makefile +2 -0
@@ -28,6 +28,7 @@ snd-soc-sdm845-objs := sdm845.o snd-soc-sm8250-objs := sm8250.o snd-soc-sc8280xp-objs := sc8280xp.o snd-soc-qcom-common-objs := common.o +snd-soc-qcom-sdw-objs := sdw.o obj-$(CONFIG_SND_SOC_STORM) += snd-soc-storm.o obj-$(CONFIG_SND_SOC_APQ8016_SBC) += snd-soc-apq8016-sbc.o
@@ -38,6 +39,7 @@ obj-$(CONFIG_SND_SOC_SC8280XP) += snd-soc-sc8280xp.o obj-$(CONFIG_SND_SOC_SDM845) += snd-soc-sdm845.o obj-$(CONFIG_SND_SOC_SM8250) += snd-soc-sm8250.o obj-$(CONFIG_SND_SOC_QCOM_COMMON) += snd-soc-qcom-common.o +obj-$(CONFIG_SND_SOC_QCOM_SDW) += snd-soc-qcom-sdw.o #DSP lib obj-$(CONFIG_SND_SOC_QDSP6) += qdsp6/
sound/soc/qcom/common.c +0 -114
120 lines not on this page · raw message
sound/soc/qcom/common.h +0 -10
@@ -5,19 +5,9 @@#define __QCOM_SND_COMMON_H__#include <sound/soc.h> -#include <linux/soundwire/sdw.h> int qcom_snd_parse_of (struct snd_soc_card *card);int qcom_snd_wcd_jack_setup (struct snd_soc_pcm_runtime *rtd,struct snd_soc_jack *jack,bool *jack_setup); -int qcom_snd_sdw_prepare (struct snd_pcm_substream *substream, -struct sdw_stream_runtime *runtime, -bool *stream_prepared); -int qcom_snd_sdw_hw_params (struct snd_pcm_substream *substream, -struct snd_pcm_hw_params *params, -struct sdw_stream_runtime **psruntime); -int qcom_snd_sdw_hw_free (struct snd_pcm_substream *substream, -struct sdw_stream_runtime *sruntime, -bool *stream_prepared);#endif
sound/soc/qcom/sc8280xp.c +1 -0
@@ -12,6 +12,7 @@#include <linux/input-event-codes.h> #include "qdsp6/q6afe.h" #include "common.h" +#include "sdw.h" #define DRIVER_NAME "sc8280xp"
sound/soc/qcom/sdw.c new file +123 -0
123 lines not on this page · raw message
sound/soc/qcom/sdw.h new file +18 -0
@@ -0,0 +1,18 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +// Copyright (c) 2018, The Linux Foundation. All rights reserved. + +#ifndef __QCOM_SND_SDW_H__ +#define __QCOM_SND_SDW_H__ + +#include <linux/soundwire/sdw.h> + +int qcom_snd_sdw_prepare (struct snd_pcm_substream *substream, +struct sdw_stream_runtime *runtime, +bool *stream_prepared); +int qcom_snd_sdw_hw_params (struct snd_pcm_substream *substream, +struct snd_pcm_hw_params *params, +struct sdw_stream_runtime **psruntime); +int qcom_snd_sdw_hw_free (struct snd_pcm_substream *substream, +struct sdw_stream_runtime *sruntime, +bool *stream_prepared); +#endif
sound/soc/qcom/sm8250.c +1 -0
@@ -12,6 +12,7 @@#include <linux/input-event-codes.h> #include "qdsp6/q6afe.h" #include "common.h" +#include "sdw.h" #define DRIVER_NAME "sm8250"#define MI2S_BCLK_RATE 1536000
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 136/183 tools/nolibc: restore mips branch ordering in the _start block
In reply to Greg Kroah-HartmanFrom: Willy Tarreau <[email protected]>
[ Upstream commit 184177c3d6e023da934761e198c281344d7dd65b ]
Depending on the compiler used and the optimization options, the sbrk() test was crashing, both on real hardware (mips-24kc) and in qemu. One such example is kernel.org toolchain in version 11.3 optimizing at -Os.
Inspecting the sys_brk() call shows the following code:
0040047c <sys_brk>:
40047c: 24020fcd li v0,4045
400480: 27bdffe0 addiu sp,sp,-32
400484: 0000000c syscall
400488: 27bd0020 addiu sp,sp,32
40048c: 10e00001 beqz a3,400494 <sys_brk+0x18>
400490: 00021023 negu v0,v0
400494: 03e00008 jr raIt is obviously wrong, the "negu" instruction is placed in beqz's delayed slot, and worse, there's no nop nor instruction after the return, so the next function's first instruction (addiu sip,sip,-32) will also be executed as part of the delayed slot that follows the return.
This is caused by the ".set noreorder" directive in the _start block, that applies to the whole program. The compiler emits code without the delayed slots and relies on the compiler to swap instructions when this option is not set. Removing the option would require to change the startup code in a way that wouldn't make it look like the resulting code, which would not be easy to debug. Instead let's just save the default ordering before changing it, and restore it at the end of the _start block. Now the code is correct:
0040047c <sys_brk>:
40047c: 24020fcd li v0,4045
400480: 27bdffe0 addiu sp,sp,-32
400484: 0000000c syscall
400488: 10e00002 beqz a3,400494 <sys_brk+0x18>
40048c: 27bd0020 addiu sp,sp,32
400490: 00021023 negu v0,v0
400494: 03e00008 jr ra
400498: 00000000 nop--- tools/include/nolibc/arch-mips.h | 2 ++ 1 file changed, 2 insertions(+)
tools/include/nolibc/arch-mips.h +2 -0
@@ -192,6 +192,7 @@ struct sys_stat_struct { __asm__ (".section .text\n" ".weak __start\n" ".set nomips16\n" +".set push\n" ".set noreorder\n" ".option pic0\n" ".ent __start\n"
@@ -210,6 +211,7 @@ __asm__ (".section .text\n""li $v0, 4001\n" // NR_exit == 4001 "syscall\n" ".end __start\n" +".set pop\n" "");#endif // _NOLIBC_ARCH_MIPS_H
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 137/183 tools/nolibc: fix the O_* fcntl/open macro definitions for riscv
In reply to Greg Kroah-HartmanFrom: Willy Tarreau <[email protected]>
[ Upstream commit 00b18da4089330196906b9fe075c581c17eb726c ]
When RISCV port was imported in 5.2, the O_* macros were taken with their octal value and written as-is in hex, resulting in the getdents64() to fail in nolibc-test.
--- tools/include/nolibc/arch-riscv.h | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
tools/include/nolibc/arch-riscv.h +7 -7
@@ -11,13 +11,13 @@#define O_RDONLY 0#define O_WRONLY 1#define O_RDWR 2 -#define O_CREAT 0x100 -#define O_EXCL 0x200 -#define O_NOCTTY 0x400 -#define O_TRUNC 0x1000 -#define O_APPEND 0x2000 -#define O_NONBLOCK 0x4000 -#define O_DIRECTORY 0x200000 +#define O_CREAT 0x40 +#define O_EXCL 0x80 +#define O_NOCTTY 0x100 +#define O_TRUNC 0x200 +#define O_APPEND 0x400 +#define O_NONBLOCK 0x800 +#define O_DIRECTORY 0x10000struct sys_stat_struct {unsigned long st_dev;/* Device. */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 138/183 drm/amdgpu: Fix potential NULL dereference
In reply to Greg Kroah-HartmanFrom: Luben Tuikov <[email protected]>
[ Upstream commit 0be7ed8e7eb15282b5d0f6fdfea884db594ea9bf ]
Fix potential NULL dereference, in the case when "man", the resource manager might be NULL, when/if we print debug information.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_object.c +3 -2
@@ -468,8 +468,9 @@ static bool amdgpu_bo_validate_size(struct amdgpu_device *adev,return true; fail: -DRM_DEBUG ("BO size %lu > total memory in domain: %llu\n" , size, - man->size); +if (man) +DRM_DEBUG ("BO size %lu > total memory in domain: %llu\n" , size, + man->size);return false; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 139/183 ice: Fix potential memory leak in ice_gnss_tty_write()
In reply to Greg Kroah-HartmanFrom: Yuan Can <[email protected]>
[ Upstream commit f58985620f55580a07d40062c4115d8c9cf6ae27 ]
The ice_gnss_tty_write() return directly if the write_buf alloc failed, leaking the cmd_buf.
Fix by free cmd_buf if write_buf alloc failed.
--- drivers/net/ethernet/intel/ice/ice_gnss.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/intel/ice/ice_gnss.c +1 -0
@@ -363,6 +363,7 @@ ice_gnss_tty_write(struct tty_struct *tty, const unsigned char *buf, int count)/* Send the data out to a hardware port */ write_buf =kzalloc (sizeof (*write_buf),GFP_KERNEL );if (!write_buf) { +kfree (cmd_buf); err = -ENOMEM ; goto exit; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 140/183 ice: Add check for kzalloc
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit 40543b3d9d2c13227ecd3aa90a713c201d1d7f09 ]
Add the check for the return value of kzalloc in order to avoid NULL pointer dereference.
Moreover, use the goto-label to share the clean code.
--- drivers/net/ethernet/intel/ice/ice_gnss.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-)
drivers/net/ethernet/intel/ice/ice_gnss.c +14 -9
@@ -461,6 +461,9 @@ static struct tty_driver *ice_gnss_create_tty_driver(struct ice_pf *pf)for (i =0 ; i <ICE_GNSS_TTY_MINOR_DEVICES ; i++) { pf->gnss_tty_port[i] =kzalloc (sizeof (*pf->gnss_tty_port[i]),GFP_KERNEL ); +if (!pf->gnss_tty_port[i]) + goto err_out; + pf->gnss_serial[i] =NULL ;tty_port_init (pf->gnss_tty_port[i]);
@@ -470,21 +473,23 @@ static struct tty_driver *ice_gnss_create_tty_driver(struct ice_pf *pf) err =tty_register_driver (tty_driver);if (err) {dev_err (dev,"Failed to register TTY driver err=%d\n" , err); - -for (i =0 ; i <ICE_GNSS_TTY_MINOR_DEVICES ; i++) { -tty_port_destroy (pf->gnss_tty_port[i]); -kfree (pf->gnss_tty_port[i]); - } -kfree (ttydrv_name); -tty_driver_kref_put (pf->ice_gnss_tty_driver); - -return NULL ; + goto err_out; }for (i =0 ; i <ICE_GNSS_TTY_MINOR_DEVICES ; i++)dev_info (dev,"%s%d registered\n" , ttydrv_name, i);return tty_driver; + +err_out: +while (i--) { +tty_port_destroy (pf->gnss_tty_port[i]); +kfree (pf->gnss_tty_port[i]); + } +kfree (ttydrv_name); +tty_driver_kref_put (pf->ice_gnss_tty_driver); + +return NULL ; }/**
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 141/183 drm/vmwgfx: Write the driver id registers
In reply to Greg Kroah-HartmanFrom: Zack Rusin <[email protected]>
[ Upstream commit 7f4c33778686cc2d34cb4ef65b4265eea874c159 ]
Driver id registers are a new mechanism in the svga device to hint to the device which driver is running. This should not change device behavior in any way, but might be convenient to work-around specific bugs in guest drivers.
Stable-dep-of: a309c7194e8a ("drm/vmwgfx: Remove rcu locks from user resources")
--- drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 43 +++++++++++++++++++++++------ 1 file changed, 34 insertions(+), 9 deletions(-)
drivers/gpu/drm/vmwgfx/vmwgfx_drv.c +34 -9
@@ -25,10 +25,13 @@* **************************************************************************/ -#include <linux/dma-mapping.h> -#include <linux/module.h> -#include <linux/pci.h> -#include <linux/cc_platform.h> + +#include "vmwgfx_drv.h" + +#include "vmwgfx_devcaps.h" +#include "vmwgfx_mksstat.h" +#include "vmwgfx_binding.h" +#include "ttm_object.h" #include <drm/drm_aperture.h> #include <drm/drm_drv.h>
@@ -41,11 +44,11 @@#include <drm/ttm/ttm_placement.h> #include <generated/utsrelease.h> -#include "ttm_object.h" -#include "vmwgfx_binding.h" -#include "vmwgfx_devcaps.h" -#include "vmwgfx_drv.h" -#include "vmwgfx_mksstat.h" +#include <linux/cc_platform.h> +#include <linux/dma-mapping.h> +#include <linux/module.h> +#include <linux/pci.h> +#include <linux/version.h> #define VMWGFX_DRIVER_DESC "Linux drm driver for VMware graphics devices"
@@ -806,6 +809,27 @@ static int vmw_detect_version(struct vmw_private *dev)return 0 ; } +static void vmw_write_driver_id (struct vmw_private *dev) +{ +if ((dev->capabilities2 &SVGA_CAP2_DX2 ) !=0 ) { +vmw_write (dev,SVGA_REG_GUEST_DRIVER_ID , +SVGA_REG_GUEST_DRIVER_ID_LINUX ); + +vmw_write (dev,SVGA_REG_GUEST_DRIVER_VERSION1 , +LINUX_VERSION_MAJOR <<24 | +LINUX_VERSION_PATCHLEVEL <<16 | +LINUX_VERSION_SUBLEVEL ); +vmw_write (dev,SVGA_REG_GUEST_DRIVER_VERSION2 , +VMWGFX_DRIVER_MAJOR <<24 | +VMWGFX_DRIVER_MINOR <<16 | +VMWGFX_DRIVER_PATCHLEVEL ); +vmw_write (dev,SVGA_REG_GUEST_DRIVER_VERSION3 ,0 ); + +vmw_write (dev,SVGA_REG_GUEST_DRIVER_ID , +SVGA_REG_GUEST_DRIVER_ID_SUBMIT ); + } +} +static int vmw_driver_load (struct vmw_private *dev_priv,u32 pci_id) {int ret;
@@ -1091,6 +1115,7 @@ static int vmw_driver_load(struct vmw_private *dev_priv, u32 pci_id)vmw_host_printf ("vmwgfx: Module Version: %d.%d.%d (kernel: %s)" ,VMWGFX_DRIVER_MAJOR ,VMWGFX_DRIVER_MINOR ,VMWGFX_DRIVER_PATCHLEVEL ,UTS_RELEASE ); +vmw_write_driver_id (dev_priv);if (dev_priv->enable_fb) {vmw_fifo_resource_inc (dev_priv);
Signature · 1 line
2.35.1