6.5.6-rc1 review
Subsystems (9)
Greg Kroah-Hartman
maintainerPATCH 140/321 xtensa: boot: dont add include-dirs
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <[email protected]>
[ Upstream commit 54d3d7d363823782c3444ddc41bb8cf1edc80514 ]
Drop the -I<include-dir> options to prevent build warnings since there is not boot/include directory:
cc1: warning: arch/xtensa/boot/include: No such file or directory [-Wmissing-include-dirs]
Message-Id: <[email protected]>
--- arch/xtensa/boot/Makefile | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
arch/xtensa/boot/Makefile +1 -2
@@ -9,8 +9,7 @@ # KBUILD_CFLAGS used when building rest of boot (takes effect recursively) -KBUILD_CFLAGS += -fno-builtin -Iarch/$(ARCH)/boot/include -HOSTFLAGS += -Iarch/$(ARCH)/boot/include +KBUILD_CFLAGS += -fno-builtin subdir-y := lib targets += vmlinux.bin vmlinux.bin.gz
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 141/321 xtensa: umulsidi3: fix conditional expression
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <[email protected]>
[ Upstream commit 9aecda97ec3deecbfa7670877c8ddfd3d0fc87c4 ]
Even when a variant has one or more of these defines set to 1, the multiplier code paths are not used. Change the expression so that the correct code paths are used.
arch/xtensa/lib/umulsidi3.S:44:38: warning: "XCHAL_NO_MUL" is not defined, evaluates to 0 [-Wundef]
44 | #if defined(__XTENSA_CALL0_ABI__) && XCHAL_NO_MULarch/xtensa/lib/umulsidi3.S:145:38: warning: "XCHAL_NO_MUL" is not defined, evaluates to 0 [-Wundef]
145 | #if defined(__XTENSA_CALL0_ABI__) && XCHAL_NO_MULarch/xtensa/lib/umulsidi3.S:159:5: warning: "XCHAL_NO_MUL" is not defined, evaluates to 0 [-Wundef]
159 | #if XCHAL_NO_MUL
Message-Id: <[email protected]>
--- arch/xtensa/lib/umulsidi3.S | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/xtensa/lib/umulsidi3.S +3 -1
@@ -3,7 +3,9 @@ #include <asm/asmmacro.h> #include <asm/core.h> -#if !XCHAL_HAVE_MUL16 && !XCHAL_HAVE_MUL32 && !XCHAL_HAVE_MAC16 +#if XCHAL_HAVE_MUL16 || XCHAL_HAVE_MUL32 || XCHAL_HAVE_MAC16 +#define XCHAL_NO_MUL 0 +#else #define XCHAL_NO_MUL 1 #endif
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 142/321 xtensa: boot/lib: fix function prototypes
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Filippov <[email protected]>
[ Upstream commit f54d02c8f2cc4b46ba2a3bd8252a6750453b6f2b ]
Add function prototype for gunzip() to the boot library code and make exit() and zalloc() static.
arch/xtensa/boot/lib/zmem.c:8:6: warning: no previous prototype for 'exit' [-Wmissing-prototypes]
8 | void exit (void)arch/xtensa/boot/lib/zmem.c:13:7: warning: no previous prototype for 'zalloc' [-Wmissing-prototypes]
13 | void *zalloc(unsigned size)arch/xtensa/boot/lib/zmem.c:35:6: warning: no previous prototype for 'gunzip' [-Wmissing-prototypes]
35 | void gunzip (void *dst, int dstlen, unsigned char *src, int *lenp)
--- arch/xtensa/boot/lib/zmem.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
arch/xtensa/boot/lib/zmem.c +3 -2
@@ -4,13 +4,14 @@/* bits taken from ppc */ extern void *avail_ram, *end_avail; +void gunzip (void *dst,int dstlen,unsigned char *src,int *lenp); -void exit (void ) +static void exit (void ) {for (;;); } -void *zalloc (unsigned size) +static void *zalloc (unsigned int size) {void *p = avail_ram;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 143/321 power: supply: rk817: Fix node refcount leak
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Morgan <[email protected]>
[ Upstream commit 488ef44c068e79752dba8eda0b75f524f111a695 ]
Dan Carpenter reports that the Smatch static checker warning has found that there is another refcount leak in the probe function. While of_node_put() was added in one of the return paths, it should in fact be added for ALL return paths that return an error and at driver removal time.
--- drivers/power/supply/rk817_charger.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-)
drivers/power/supply/rk817_charger.c +12 -3
@@ -1045,6 +1045,13 @@ static void rk817_charging_monitor(struct work_struct *work)queue_delayed_work (system_wq, &charger->work,msecs_to_jiffies (8000 )); } +static void rk817_cleanup_node (void *data) +{ +struct device_node *node = data; + +of_node_put (node); +} +static int rk817_charger_probe (struct platform_device *pdev) {struct rk808 *rk808 =dev_get_drvdata (pdev->dev.parent);
@@ -1061,11 +1068,13 @@ static int rk817_charger_probe(struct platform_device *pdev)if (!node)return -ENODEV ; + ret =devm_add_action_or_reset (&pdev->dev, rk817_cleanup_node, node); +if (ret) +return ret; + charger =devm_kzalloc (&pdev->dev,sizeof (*charger),GFP_KERNEL ); -if (!charger) { -of_node_put (node); +if (!charger)return -ENOMEM ; - } charger->rk808 = rk808;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 144/321 powerpc/stacktrace: Fix arch_stack_walk_reliable()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Ellerman <[email protected]>
[ Upstream commit c5cc3ca707bc916a3f326364751a41f25040aef3 ]
The changes to copy_thread() made in commit eed7c420aac7 ("powerpc:copy_thread differentiate kthreads and user mode threads") inadvertently broke arch_stack_walk_reliable() because it has knowledge of the stack layout.
Fix it by changing the condition to match the new logic in copy_thread(). The changes make the comments about the stack layout incorrect, rather than rephrasing them just refer the reader to copy_thread().
Also the comment about the stack backchain is no longer true, since commit edbd0387f324 ("powerpc: copy_thread add a back chain to the switch stack frame"), so remove that as well.
--- arch/powerpc/kernel/stacktrace.c | 27 +++++---------------------- 1 file changed, 5 insertions(+), 22 deletions(-)
arch/powerpc/kernel/stacktrace.c +5 -22
@@ -73,29 +73,12 @@ int __no_sanitize_address arch_stack_walk_reliable(stack_trace_consume_fn consumbool firstframe; stack_end = stack_page +THREAD_SIZE ; -if (!is_idle_task (task)) { -/* -* For user tasks, this is the SP value loaded on -* kernel entry, see "PACAKSAVE(r13)" in _switch() and -* system_call_common(). -* -* Likewise for non-swapper kernel threads, -* this also happens to be the top of the stack -* as setup by copy_thread(). -* -* Note that stack backlinks are not properly setup by -* copy_thread() and thus, a forked task() will have -* an unreliable stack trace until it's been -* _switch()'ed to for the first time. -*/ - stack_end -=STACK_USER_INT_FRAME_SIZE ; - }else { -/* -* idle tasks have a custom stack layout, -* c.f. cpu_idle_thread_init(). -*/ + +// See copy_thread() for details. +if (task->flags &PF_KTHREAD ) stack_end -=STACK_FRAME_MIN_SIZE ; - } +else + stack_end -=STACK_USER_INT_FRAME_SIZE ;if (task == current) sp =current_stack_frame ();
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 145/321 selftests/powerpc: Fix emit_tests to work with run_kselftest.sh
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Ellerman <[email protected]>
[ Upstream commit 58b33e78a31782ffe25d404d5eba9a45fe636e27 ]
In order to use run_kselftest.sh the list of tests must be emitted to populate kselftest-list.txt.
The powerpc Makefile is written to use EMIT_TESTS. But support for EMIT_TESTS was dropped in commit d4e59a536f50 ("selftests: Use runner.sh for emit targets"). Although prior to that commit a548de0fe8e1 ("selftests: lib.mk: add test execute bit check to EMIT_TESTS") had already broken run_kselftest.sh for powerpc due to the executable check using the wrong path.
It can be fixed by replacing the EMIT_TESTS definitions with actual emit_tests rules in the powerpc Makefiles. This makes run_kselftest.sh able to run powerpc tests:
$ cd linux $ export ARCH=powerpc $ export CROSS_COMPILE=powerpc64le-linux-gnu- $ make headers $ make -j -C tools/testing/selftests install $ grep -c "^powerpc" tools/testing/selftests/kselftest_install/kselftest-list.txt 182
--- tools/testing/selftests/powerpc/Makefile | 7 +++---- tools/testing/selftests/powerpc/pmu/Makefile | 11 ++++++----- 2 files changed, 9 insertions(+), 9 deletions(-)
tools/testing/selftests/powerpc/Makefile +3 -4
@@ -59,12 +59,11 @@ override define INSTALL_RULE done; endef -override define EMIT_TESTS +emit_tests: +@for TARGET in $(SUB_DIRS); do \ BUILD_TARGET=$(OUTPUT)/$$TARGET; \ - $(MAKE) OUTPUT=$$BUILD_TARGET -s -C $$TARGET emit_tests;\ + $(MAKE) OUTPUT=$$BUILD_TARGET -s -C $$TARGET $@;\ done; -endef override define CLEAN +@for TARGET in $(SUB_DIRS); do \
@@ -77,4 +76,4 @@ endef tags: find . -name '*.c' -o -name '*.h' | xargs ctags -.PHONY: tags $(SUB_DIRS) +.PHONY: tags $(SUB_DIRS) emit_tests
tools/testing/selftests/powerpc/pmu/Makefile +6 -5
@@ -30,13 +30,14 @@ override define RUN_TESTS +TARGET=event_code_tests; BUILD_TARGET=$$OUTPUT/$$TARGET; $(MAKE) OUTPUT=$$BUILD_TARGET -C $$TARGET run_tests endef -DEFAULT_EMIT_TESTS := $(EMIT_TESTS) -override define EMIT_TESTS - $(DEFAULT_EMIT_TESTS) +emit_tests: + for TEST in $(TEST_GEN_PROGS); do \ + BASENAME_TEST=`basename $$TEST`; \ + echo "$(COLLECTION):$$BASENAME_TEST"; \ + done +TARGET=ebb; BUILD_TARGET=$$OUTPUT/$$TARGET; $(MAKE) OUTPUT=$$BUILD_TARGET -s -C $$TARGET emit_tests +TARGET=sampling_tests; BUILD_TARGET=$$OUTPUT/$$TARGET; $(MAKE) OUTPUT=$$BUILD_TARGET -s -C $$TARGET emit_tests +TARGET=event_code_tests; BUILD_TARGET=$$OUTPUT/$$TARGET; $(MAKE) OUTPUT=$$BUILD_TARGET -s -C $$TARGET emit_tests -endef DEFAULT_INSTALL_RULE := $(INSTALL_RULE) override define INSTALL_RULE
@@ -64,4 +65,4 @@ sampling_tests: event_code_tests: TARGET=$@; BUILD_TARGET=$$OUTPUT/$$TARGET; mkdir -p $$BUILD_TARGET; $(MAKE) OUTPUT=$$BUILD_TARGET -k -C $$TARGET all -.PHONY: all run_tests ebb sampling_tests event_code_tests +.PHONY: all run_tests ebb sampling_tests event_code_tests emit_tests
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 146/321 arm64: dts: imx8mp: Fix SDMA2/3 clocks
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adam Ford <[email protected]>
[ Upstream commit b739681b3f8b2a7a684a71ddd048b9b6b5400011 ]
Commit 16c984524862 ("arm64: dts: imx8mp: don't initialize audio clocks from CCM node") removed the Audio clocks from the main clock node, because the intent is to force people to setup the audio PLL clocks per board instead of having a common set of rates, since not all boards may use the various audio PLL clocks in the same way.
Unfortunately, with this parenting removed, the SDMA2 and SDMA3 clocks were slowed to 24MHz because the SDMA2/3 clocks are controlled via the audio_blk_ctrl which is clocked from IMX8MP_CLK_AUDIO_ROOT, and that clock is enabled by pgc_audio.
Per the TRM, "The SDMA2/3 target frequency is 400MHz IPG and 400MHz AHB, always 1:1 mode, to make sure there is enough throughput for all the audio use cases."
Instead of cluttering the clock node, place the clock rate and parent information into the pgc_audio node.
With the parenting and clock rates restored for IMX8MP_CLK_AUDIO_AHB, and IMX8MP_CLK_AUDIO_AXI_SRC, it appears the SDMA2 and SDMA3 run at 400MHz again.
--- arch/arm64/boot/dts/freescale/imx8mp.dtsi | 6 ++++++ 1 file changed, 6 insertions(+)
arch/arm64/boot/dts/freescale/imx8mp.dtsi +6 -0
@@ -794,6 +794,12 @@ reg = <IMX8MP_POWER_DOMAIN_AUDIOMIX>; clocks = <&clk IMX8MP_CLK_AUDIO_ROOT>, <&clk IMX8MP_CLK_AUDIO_AXI>; + assigned-clocks = <&clk IMX8MP_CLK_AUDIO_AHB>, + <&clk IMX8MP_CLK_AUDIO_AXI_SRC>; + assigned-clock-parents = <&clk IMX8MP_SYS_PLL1_800M>, + <&clk IMX8MP_SYS_PLL1_800M>; + assigned-clock-rates = <400000000>, + <600000000>; }; pgc_gpu2d: power-domain@6 {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 147/321 arm64: dts: imx8mp-beacon-kit: Fix audio_pll2 clock
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adam Ford <[email protected]>
[ Upstream commit 161af16c18f3e10d81870328928e5fff3a7d47bb ]
Commit 16c984524862 ("arm64: dts: imx8mp: don't initialize audio clocks from CCM node") removed the Audio clocks from the main clock node, because the intent is to force people to setup the audio PLL clocks per board instead of having a common set of rates since not all boards may use the various audio PLL clocks for audio devices.
This resulted in an incorrect clock rate when attempting to playback audio, since the AUDIO_PLL2 wasn't set any longer. Fix this by setting the AUDIO_PLL2 rate inside the SAI3 node since it's the SAI3 that needs it.
--- arch/arm64/boot/dts/freescale/imx8mp-beacon-kit.dts | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/freescale/imx8mp-beacon-kit.dts +3 -2
@@ -381,9 +381,10 @@ &sai3 { pinctrl-names = "default"; pinctrl-0 = <&pinctrl_sai3>; - assigned-clocks = <&clk IMX8MP_CLK_SAI3>; + assigned-clocks = <&clk IMX8MP_CLK_SAI3>, + <&clk IMX8MP_AUDIO_PLL2> ; assigned-clock-parents = <&clk IMX8MP_AUDIO_PLL2_OUT>; - assigned-clock-rates = <12288000>; + assigned-clock-rates = <12288000>, <361267200>; fsl,sai-mclk-direction-output; status = "okay"; };
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 148/321 soc: imx8m: Enable OCOTP clock for imx8mm before reading registers
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Rossi <[email protected]>
[ Upstream commit 9d1e8275a28f51599d754ce661c91e0a689c0234 ]
Commit 836fb30949d9 ("soc: imx8m: Enable OCOTP clock before reading the register") added configuration to enable the OCOTP clock before attempting to read from the associated registers.
This same kexec issue is present with the imx8m SoCs that use the imx8mm_soc_uid function (e.g. imx8mp). This requires the imx8mm_soc_uid function to configure the OCOTP clock before accessing the associated registers. This change implements the same clock enable functionality that is present in the imx8mq_soc_revision function for the imx8mm_soc_uid function.
--- drivers/soc/imx/soc-imx8m.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/soc/imx/soc-imx8m.c +10 -0
@@ -100,6 +100,7 @@ static void __init imx8mm_soc_uid(void) {void __iomem *ocotp_base;struct device_node *np; +struct clk *clk;u32 offset =of_machine_is_compatible ("fsl,imx8mp" ) ?IMX8MP_OCOTP_UID_OFFSET :0 ;
@@ -109,11 +110,20 @@ static void __init imx8mm_soc_uid(void) ocotp_base =of_iomap (np,0 );WARN_ON (!ocotp_base); + clk =of_clk_get_by_name (np,NULL ); +if (IS_ERR (clk)) { +WARN_ON (IS_ERR (clk)); +return ; + } + +clk_prepare_enable (clk); soc_uid =readl_relaxed (ocotp_base +OCOTP_UID_HIGH + offset); soc_uid <<=32 ; soc_uid |=readl_relaxed (ocotp_base +OCOTP_UID_LOW + offset); +clk_disable_unprepare (clk); +clk_put (clk);iounmap (ocotp_base);of_node_put (np); }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 149/321 arm64: dts: imx8mm-evk: Fix hdmi@3d node
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liu Ying <[email protected]>
[ Upstream commit efa97aed071e0607b15ee08ddb1b7d775b664352 ]
The hdmi@3d node's compatible string is "adi,adv7535" instead of "adi,adv7533" or "adi,adv751*".
Fix the hdmi@3d node by means of:
* Use default register addresses for "cec", "edid" and "packet", because there is no need to use a non-default address map.
* Add missing interrupt related properties.
* Drop "adi,input-*" properties which are only valid for adv751*.
* Add VDDEXT_3V3 fixed regulator
* Add "*-supply" properties, since most are required.
* Fix label names - s/adv7533/adv7535/.
--- arch/arm64/boot/dts/freescale/imx8mm-evk.dtsi | 32 ++++++++++++------- 1 file changed, 20 insertions(+), 12 deletions(-)
arch/arm64/boot/dts/freescale/imx8mm-evk.dtsi +20 -12
@@ -26,7 +26,7 @@ port { hdmi_connector_in: endpoint { - remote-endpoint = <&adv7533_out>; + remote-endpoint = <&adv7535_out>; }; }; };
@@ -72,6 +72,13 @@ enable-active-high; }; + reg_vddext_3v3: regulator-vddext-3v3 { + compatible = "regulator-fixed"; + regulator-name = "VDDEXT_3V3"; + regulator-min-microvolt = <3300000>; + regulator-max-microvolt = <3300000>; + }; + backlight: backlight { compatible = "pwm-backlight"; pwms = <&pwm1 0 5000000 0>;
@@ -317,15 +324,16 @@ hdmi@3d { compatible = "adi,adv7535"; - reg = <0x3d>, <0x3c>, <0x3e>, <0x3f>; - reg-names = "main", "cec", "edid", "packet"; + reg = <0x3d>; + interrupt-parent = <&gpio1>; + interrupts = <9 IRQ_TYPE_EDGE_FALLING>; adi,dsi-lanes = <4>; - - adi,input-depth = <8>; - adi,input-colorspace = "rgb"; - adi,input-clock = "1x"; - adi,input-style = <1>; - adi,input-justification = "evenly"; + avdd-supply = <&buck5_reg>; + dvdd-supply = <&buck5_reg>; + pvdd-supply = <&buck5_reg>; + a2vdd-supply = <&buck5_reg>; + v3p3-supply = <®_vddext_3v3>; + v1p2-supply = <&buck5_reg>; ports { #address-cells = <1>;
@@ -334,7 +342,7 @@ port@0 { reg = <0>; - adv7533_in: endpoint { + adv7535_in: endpoint { remote-endpoint = <&dsi_out>; }; };
@@ -342,7 +350,7 @@ port@1 { reg = <1>; - adv7533_out: endpoint { + adv7535_out: endpoint { remote-endpoint = <&hdmi_connector_in>; }; };
@@ -408,7 +416,7 @@ reg = <1>; dsi_out: endpoint { - remote-endpoint = <&adv7533_in>; + remote-endpoint = <&adv7535_in>; data-lanes = <1 2 3 4>; }; };
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 150/321 arm64: dts: imx: Add imx8mm-prt8mm.dtb to build
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Herring <[email protected]>
[ Upstream commit f09752eaf0e8f8befc26b44c4d3e15633e56d16a ]
imx8mm-prt8mm.dts was not getting built. Add it to the build.
--- arch/arm64/boot/dts/freescale/Makefile | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/freescale/Makefile +1 -0
@@ -66,6 +66,7 @@ dtb-$(CONFIG_ARCH_MXC) += imx8mm-mx8menlo.dtb dtb-$(CONFIG_ARCH_MXC) += imx8mm-nitrogen-r2.dtb dtb-$(CONFIG_ARCH_MXC) += imx8mm-phg.dtb dtb-$(CONFIG_ARCH_MXC) += imx8mm-phyboard-polis-rdk.dtb +dtb-$(CONFIG_ARCH_MXC) += imx8mm-prt8mm.dtb dtb-$(CONFIG_ARCH_MXC) += imx8mm-tqma8mqml-mba8mx.dtb dtb-$(CONFIG_ARCH_MXC) += imx8mm-var-som-symphony.dtb dtb-$(CONFIG_ARCH_MXC) += imx8mm-venice-gw71xx-0x.dtb
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 151/321 firmware: arm_ffa: Dont set the memory region attributes for MEM_LEND
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <[email protected]>
[ Upstream commit 9dda1178479aa0a73fe0eaabfe2d9a1c603cfeed ]
As per the FF-A specification: section "Usage of other memory region attributes", in a transaction to donate memory or lend memory to a single borrower, if the receiver is a PE or Proxy endpoint, the owner must not specify the attributes and the relayer will return INVALID_PARAMETERS if the attributes are set.
Let us not set the memory region attributes for MEM_LEND.
--- drivers/firmware/arm_ffa/driver.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-)
drivers/firmware/arm_ffa/driver.c +14 -2
@@ -397,6 +397,19 @@ static u32 ffa_get_num_pages_sg(struct scatterlist *sg)return num_pages; } +static u8 ffa_memory_attributes_get (u32 func_id) +{ +/* +* For the memory lend or donate operation, if the receiver is a PE or +* a proxy endpoint, the owner/sender must not specify the attributes +*/ +if (func_id ==FFA_FN_NATIVE (MEM_LEND ) || + func_id ==FFA_MEM_LEND ) +return 0 ; + +return FFA_MEM_NORMAL |FFA_MEM_WRITE_BACK |FFA_MEM_INNER_SHAREABLE ; +} +static int ffa_setup_and_transmit (u32 func_id,void *buffer,u32 max_fragsize,struct ffa_mem_ops_args *args)
@@ -413,8 +426,7 @@ ffa_setup_and_transmit(u32 func_id, void *buffer, u32 max_fragsize, mem_region->tag = args->tag; mem_region->flags = args->flags; mem_region->sender_id = drv_info->vm_id; - mem_region->attributes =FFA_MEM_NORMAL |FFA_MEM_WRITE_BACK | -FFA_MEM_INNER_SHAREABLE ; + mem_region->attributes =ffa_memory_attributes_get (func_id); ep_mem_access = &mem_region->ep_mem_access[0 ];for (idx =0 ; idx < args->nattrs; idx++, ep_mem_access++) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 152/321 i915/guc: Get runtime pm in busyness worker only if already active
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Umesh Nerlige Ramappa <[email protected]>
[ Upstream commit 907ef0398c938be8232b77c61cfcf50fbfd95554 ]
Ideally the busyness worker should take a gt pm wakeref because the worker only needs to be active while gt is awake. However, the gt_park path cancels the worker synchronously and this complicates the flow if the worker is also running at the same time. The cancel waits for the worker and when the worker releases the wakeref, that would call gt_park and would lead to a deadlock.
The resolution is to take the global pm wakeref if runtime pm is already active. If not, we don't need to update the busyness stats as the stats would already be updated when the gt was parked.
Note:
- We do not requeue the worker if we cannot take a reference to runtime pm since intel_guc_busyness_unpark would requeue the worker in the resume path.
- If the gt was parked longer than time taken for GT timestamp to roll over, we ignore those rollovers since we don't care about tracking the exact GT time. We only care about roll overs when the gt is active and running workloads.
- There is a window of time between gt_park and runtime suspend, where the worker may run. This is acceptable since the worker will not find any new data to update busyness.
v2: (Daniele)
- Edit commit message and code comment
- Use runtime pm in the worker
- Put runtime pm after enabling the worker
- Use Link tag and add Fixes tag
v3: (Daniele)
- Reword commit and comments and add details
--- .../gpu/drm/i915/gt/uc/intel_guc_submission.c | 38 +++++++++++++++++-- 1 file changed, 35 insertions(+), 3 deletions(-)
drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c +35 -3
@@ -1432,6 +1432,36 @@ static void guc_timestamp_ping(struct work_struct *wrk)unsigned long index;int srcu, ret; +/* +* Ideally the busyness worker should take a gt pm wakeref because the +* worker only needs to be active while gt is awake. However, the +* gt_park path cancels the worker synchronously and this complicates +* the flow if the worker is also running at the same time. The cancel +* waits for the worker and when the worker releases the wakeref, that +* would call gt_park and would lead to a deadlock. +* +* The resolution is to take the global pm wakeref if runtime pm is +* already active. If not, we don't need to update the busyness stats as +* the stats would already be updated when the gt was parked. +* +* Note: +* - We do not requeue the worker if we cannot take a reference to runtime +* pm since intel_guc_busyness_unpark would requeue the worker in the +* resume path. +* +* - If the gt was parked longer than time taken for GT timestamp to roll +* over, we ignore those rollovers since we don't care about tracking +* the exact GT time. We only care about roll overs when the gt is +* active and running workloads. +* +* - There is a window of time between gt_park and runtime suspend, +* where the worker may run. This is acceptable since the worker will +* not find any new data to update busyness. +*/ + wakeref =intel_runtime_pm_get_if_active (>->i915->runtime_pm); +if (!wakeref) +return ; +/* * Synchronize with gt reset to make sure the worker does not * corrupt the engine/guc stats. NB: can't actually block waiting
@@ -1440,10 +1470,9 @@ static void guc_timestamp_ping(struct work_struct *wrk)*/ ret =intel_gt_reset_trylock (gt, &srcu);if (ret) -return ; + goto err_trylock; - with_intel_runtime_pm(>->i915->runtime_pm, wakeref) -__update_guc_busyness_stats (guc); +__update_guc_busyness_stats (guc);/* adjust context stats for overflow */ xa_for_each (&guc->context_lookup, index, ce)
@@ -1452,6 +1481,9 @@ static void guc_timestamp_ping(struct work_struct *wrk)intel_gt_reset_unlock (gt, srcu);guc_enable_busyness_worker (guc); + +err_trylock: +intel_runtime_pm_put (>->i915->runtime_pm, wakeref); }static int guc_action_enable_usage_stats (struct intel_guc *guc)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 153/321 accel/ivpu: Do not use wait event interruptible
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanislaw Gruszka <[email protected]>
[ Upstream commit b0873eead1d1eadf13b5c80ad5d8f88b91e4910a ]
If we receive signal when waiting for IPC message response in ivpu_ipc_receive() we return error and continue to operate. Then the driver can send another IPC messages and re-use occupied slot of the message still processed by the firmware. This can result in corrupting firmware memory and following FW crash with messages:
[ 3698.569719] intel_vpu 0000:00:0b.0: [drm] ivpu_ipc_send_receive_internal(): IPC receive failed: type 0x1103, ret -512 [ 3698.569747] intel_vpu 0000:00:0b.0: [drm] ivpu_jsm_unregister_db(): Failed to unregister doorbell 3: -512 [ 3698.569756] intel_vpu 0000:00:0b.0: [drm] ivpu_ipc_tx_prepare(): IPC message vpu:0x88980000 not released by firmware [ 3698.569763] intel_vpu 0000:00:0b.0: [drm] ivpu_ipc_tx_prepare(): JSM message vpu:0x88980040 not released by firmware [ 3698.570234] intel_vpu 0000:00:0b.0: [drm] ivpu_ipc_send_receive_internal(): IPC receive failed: type 0x110e, ret -512 [ 3698.570318] intel_vpu 0000:00:0b.0: [drm] *ERROR* ivpu_mmu_dump_event(): MMU EVTQ: 0x10 (Translation fault) SSID: 0 SID: 3, e[2] 00000000, e[3] 00000208, in addr: 0x88988000, fetch addr: 0x0
To fix the issue don't use interruptible variant of wait event to allow firmware to finish IPC processing.
--- drivers/accel/ivpu/ivpu_ipc.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-)
drivers/accel/ivpu/ivpu_ipc.c +4 -7
@@ -209,10 +209,10 @@ int ivpu_ipc_receive(struct ivpu_device *vdev, struct ivpu_ipc_consumer *cons,struct ivpu_ipc_rx_msg *rx_msg;int wait_ret, ret =0 ; - wait_ret =wait_event_interruptible_timeout (cons->rx_msg_wq, - (IS_KTHREAD () &&kthread_should_stop ()) || - !list_empty (&cons->rx_msg_list), -msecs_to_jiffies (timeout_ms)); + wait_ret =wait_event_timeout (cons->rx_msg_wq, + (IS_KTHREAD () &&kthread_should_stop ()) || + !list_empty (&cons->rx_msg_list), +msecs_to_jiffies (timeout_ms));if (IS_KTHREAD () &&kthread_should_stop ())return -EINTR ;
@@ -220,9 +220,6 @@ int ivpu_ipc_receive(struct ivpu_device *vdev, struct ivpu_ipc_consumer *cons,if (wait_ret ==0 )return -ETIMEDOUT ; -if (wait_ret <0 ) -return -ERESTARTSYS ; -spin_lock_irq (&cons->rx_msg_lock); rx_msg = list_first_entry_or_null(&cons->rx_msg_list, struct ivpu_ipc_rx_msg, link);if (!rx_msg) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 154/321 accel/ivpu: Use cached buffers for FW loading
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karol Wachowski <[email protected]>
[ Upstream commit 645d694559cab36fe6a57c717efcfa27d9321396 ]
Create buffers with cache coherency on the CPU side (write-back) while disabling snooping on the VPU side. These buffers require an explicit cache flush after each CPU-side modification.
Configuring pages as write-combined may introduce significant delays, potentially taking hundreds of milliseconds for 64 MB buffers.
Added internal DRM_IVPU_BO_NOSNOOP mask which disables snooping on the VPU side. Allocate FW runtime memory buffer (64 MB) as cached with snooping-disabled.
This fixes random long FW loading times and boot params memory corruption on warmboot (due to missed wmb).
--- drivers/accel/ivpu/ivpu_fw.c | 8 +++++--- drivers/accel/ivpu/ivpu_gem.h | 5 +++++ 2 files changed, 10 insertions(+), 3 deletions(-)
drivers/accel/ivpu/ivpu_fw.c +5 -3
@@ -195,7 +195,8 @@ static int ivpu_fw_mem_init(struct ivpu_device *vdev)if (ret)return ret; - fw->mem =ivpu_bo_alloc_internal (vdev, fw->runtime_addr, fw->runtime_size,DRM_IVPU_BO_WC ); + fw->mem =ivpu_bo_alloc_internal (vdev, fw->runtime_addr, fw->runtime_size, +DRM_IVPU_BO_CACHED |DRM_IVPU_BO_NOSNOOP );if (!fw->mem) {ivpu_err (vdev,"Failed to allocate firmware runtime memory\n" );return -ENOMEM ;
@@ -272,7 +273,7 @@ int ivpu_fw_load(struct ivpu_device *vdev)memset (start,0 , size); } -wmb ();/* Flush WC buffers after writing fw->mem */ +clflush_cache_range (fw->mem->kvaddr, fw->mem->base.size);return 0 ; }
@@ -374,6 +375,7 @@ void ivpu_fw_boot_params_setup(struct ivpu_device *vdev, struct vpu_boot_paramsif (!ivpu_fw_is_cold_boot (vdev)) { boot_params->save_restore_ret_address =0 ; vdev->pm->is_warmboot = true; +clflush_cache_range (vdev->fw->mem->kvaddr,SZ_4K );return ; }
@@ -428,7 +430,7 @@ void ivpu_fw_boot_params_setup(struct ivpu_device *vdev, struct vpu_boot_params boot_params->punit_telemetry_sram_size =ivpu_hw_reg_telemetry_size_get (vdev); boot_params->vpu_telemetry_enable =ivpu_hw_reg_telemetry_enable_get (vdev); -wmb ();/* Flush WC buffers after writing bootparams */ +clflush_cache_range (vdev->fw->mem->kvaddr,SZ_4K );ivpu_fw_boot_params_print (vdev, boot_params); }
drivers/accel/ivpu/ivpu_gem.h +5 -0
@@ -8,6 +8,8 @@#include <drm/drm_gem.h> #include <drm/drm_mm.h> +#define DRM_IVPU_BO_NOSNOOP 0x10000000 +struct dma_buf ;struct ivpu_bo_ops ;struct ivpu_file_priv ;
@@ -83,6 +85,9 @@ static inline u32 ivpu_bo_cache_mode(struct ivpu_bo *bo)static inline bool ivpu_bo_is_snooped (struct ivpu_bo *bo) { +if (bo->flags &DRM_IVPU_BO_NOSNOOP ) +return false; +return ivpu_bo_cache_mode (bo) ==DRM_IVPU_BO_CACHED ; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 155/321 gpio: pmic-eic-sprd: Add can_sleep flag for PMIC EIC chip
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenhua Lin <[email protected]>
[ Upstream commit 26d9e5640d2130ee16df7b1fb6a908f460ab004c ]
The drivers uses a mutex and I2C bus access in its PMIC EIC chip get implementation. This means these functions can sleep and the PMIC EIC chip should set the can_sleep property to true.
This will ensure that a warning is printed when trying to get the value from a context that potentially can't sleep.
--- drivers/gpio/gpio-pmic-eic-sprd.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpio/gpio-pmic-eic-sprd.c +1 -0
@@ -352,6 +352,7 @@ static int sprd_pmic_eic_probe(struct platform_device *pdev) pmic_eic->chip.set_config = sprd_pmic_eic_set_config; pmic_eic->chip.set = sprd_pmic_eic_set; pmic_eic->chip.get = sprd_pmic_eic_get; + pmic_eic->chip.can_sleep = true; irq = &pmic_eic->chip.irq;gpio_irq_chip_set_chip (irq, &pmic_eic_irq_chip);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 156/321 i2c: npcm7xx: Fix callback completion ordering
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: William A. Kennington III <[email protected]>
[ Upstream commit 92e73d807b68b2214fcafca4e130b5300a9d4b3c ]
Sometimes, our completions race with new master transfers and override the bus->operation and bus->master_or_slave variables. This causes transactions to timeout and kernel crashes less frequently.
To remedy this, we re-order all completions to the very end of the function.
--- drivers/i2c/busses/i2c-npcm7xx.c | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-)
drivers/i2c/busses/i2c-npcm7xx.c +7 -10
@@ -695,6 +695,7 @@ static void npcm_i2c_callback(struct npcm_i2c *bus, {struct i2c_msg *msgs;int msgs_num; +bool do_complete = false; msgs = bus->msgs; msgs_num = bus->msgs_num;
@@ -723,23 +724,17 @@ static void npcm_i2c_callback(struct npcm_i2c *bus, msgs[1].flags & I2C_M_RD) msgs[1 ].len = info; } -if (completion_done (&bus->cmd_complete) == false) -complete (&bus->cmd_complete); -break ; - + do_complete = true; +break ;case I2C_NACK_IND :/* MASTER transmit got a NACK before tx all bytes */ bus->cmd_err = -ENXIO ; -if (bus->master_or_slave ==I2C_MASTER ) -complete (&bus->cmd_complete); - + do_complete = true;break ;case I2C_BUS_ERR_IND :/* Bus error */ bus->cmd_err = -EAGAIN ; -if (bus->master_or_slave ==I2C_MASTER ) -complete (&bus->cmd_complete); - + do_complete = true;break ;case I2C_WAKE_UP_IND :/* I2C wake up */
@@ -753,6 +748,8 @@ static void npcm_i2c_callback(struct npcm_i2c *bus,if (bus->slave) bus->master_or_slave =I2C_SLAVE ;#endif +if (do_complete) +complete (&bus->cmd_complete); }static u8 npcm_i2c_fifo_usage (struct npcm_i2c *bus)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 157/321 NFSD: Fix zero NFSv4 READ results when RQ_SPLICE_OK is not set
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit 0d32a6bbb8e7bf503855f2990f1ccce0922db87b ]
nfsd4_encode_readv() uses xdr->buf->page_len as a starting point for the nfsd_iter_read() sink buffer -- page_len is going to be offset by the parts of the COMPOUND that have already been encoded into xdr->buf->pages.
However, that value must be captured /before/ xdr_reserve_space_vec() advances page_len by the expected size of the read payload. Otherwise, the whole front part of the first page of the payload in the reply will be uninitialized.
Mantas hit this because sec=krb5i forces RQ_SPLICE_OK off, which invokes the readv part of the nfsd4_encode_read() path. Also, older Linux NFS clients appear to send shorter READ requests for files smaller than a page, whereas newer clients just send page-sized requests and let the server send as many bytes as are in the file.
--- fs/nfsd/nfs4xdr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/nfsd/nfs4xdr.c +2 -2
@@ -4105,6 +4105,7 @@ static __be32 nfsd4_encode_readv(struct nfsd4_compoundres *resp, struct file *file, unsigned long maxcount) {struct xdr_stream *xdr = resp->xdr; +unsigned int base = xdr->buf->page_len & ~PAGE_MASK ;unsigned int starting_len = xdr->buf->len;__be32 zero = xdr_zero;__be32 nfserr;
@@ -4113,8 +4114,7 @@ static __be32 nfsd4_encode_readv(struct nfsd4_compoundres *resp,return nfserr_resource; nfserr =nfsd_iter_read (resp->rqstp, read->rd_fhp, file, - read->rd_offset, &maxcount, - xdr->buf->page_len & ~PAGE_MASK , + read->rd_offset, &maxcount, base, &read->rd_eof); read->rd_length = maxcount;if (nfserr)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 158/321 x86/reboot: VMCLEAR active VMCSes before emergency reboot
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
[ Upstream commit b23c83ad2c638420ec0608a9de354507c41bec29 ]
VMCLEAR active VMCSes before any emergency reboot, not just if the kernel may kexec into a new kernel after a crash. Per Intel's SDM, the VMX architecture doesn't require the CPU to flush the VMCS cache on INIT. If an emergency reboot doesn't RESET CPUs, cached VMCSes could theoretically be kept and only be written back to memory after the new kernel is booted, i.e. could effectively corrupt memory after reboot.
Opportunistically remove the setting of the global pointer to NULL to make checkpatch happy.
--- arch/x86/include/asm/kexec.h | 2 -- arch/x86/include/asm/reboot.h | 2 ++ arch/x86/kernel/crash.c | 31 ------------------------------- arch/x86/kernel/reboot.c | 22 ++++++++++++++++++++++ arch/x86/kvm/vmx/vmx.c | 10 +++------- 5 files changed, 27 insertions(+), 40 deletions(-)
arch/x86/include/asm/kexec.h +0 -2
@@ -205,8 +205,6 @@ int arch_kimage_file_post_load_cleanup(struct kimage *image);#endif #endif -typedef void crash_vmclear_fn (void ); -extern crash_vmclear_fn __rcu *crash_vmclear_loaded_vmcss;extern void kdump_nmi_shootdown_cpus (void );#endif /* __ASSEMBLY__ */
arch/x86/include/asm/reboot.h +2 -0
@@ -25,6 +25,8 @@ void __noreturn machine_real_restart(unsigned int type);#define MRR_BIOS 0#define MRR_APM 1 +typedef void crash_vmclear_fn (void ); +extern crash_vmclear_fn __rcu *crash_vmclear_loaded_vmcss;void cpu_emergency_disable_virtualization (void );typedef void (*nmi_shootdown_cb )(int ,struct pt_regs *);
arch/x86/kernel/crash.c +0 -31
@@ -48,38 +48,12 @@ struct crash_memmap_data {unsigned int type; }; -/* -* This is used to VMCLEAR all VMCSs loaded on the -* processor. And when loading kvm_intel module, the -* callback function pointer will be assigned. -* -* protected by rcu. -*/ -crash_vmclear_fn __rcu *crash_vmclear_loaded_vmcss =NULL ; -EXPORT_SYMBOL_GPL (crash_vmclear_loaded_vmcss); - -static inline void cpu_crash_vmclear_loaded_vmcss (void ) -{ -crash_vmclear_fn *do_vmclear_operation =NULL ; - -rcu_read_lock (); - do_vmclear_operation =rcu_dereference (crash_vmclear_loaded_vmcss); -if (do_vmclear_operation) -do_vmclear_operation (); -rcu_read_unlock (); -} -#if defined(CONFIG_SMP ) && defined(CONFIG_X86_LOCAL_APIC )static void kdump_nmi_callback (int cpu,struct pt_regs *regs) {crash_save_cpu (regs, cpu); -/* -* VMCLEAR VMCSs loaded on all cpus if needed. -*/ -cpu_crash_vmclear_loaded_vmcss (); -/* * Disable Intel PT to stop its logging */
@@ -133,11 +107,6 @@ void native_machine_crash_shutdown(struct pt_regs *regs)crash_smp_send_stop (); -/* -* VMCLEAR VMCSs loaded on this cpu if needed. -*/ -cpu_crash_vmclear_loaded_vmcss (); -cpu_emergency_disable_virtualization ();/*
arch/x86/kernel/reboot.c +22 -0
@@ -787,6 +787,26 @@ void machine_crash_shutdown(struct pt_regs *regs) }#endif +/* +* This is used to VMCLEAR all VMCSs loaded on the +* processor. And when loading kvm_intel module, the +* callback function pointer will be assigned. +* +* protected by rcu. +*/ +crash_vmclear_fn __rcu *crash_vmclear_loaded_vmcss; +EXPORT_SYMBOL_GPL (crash_vmclear_loaded_vmcss); + +static inline void cpu_crash_vmclear_loaded_vmcss (void ) +{ +crash_vmclear_fn *do_vmclear_operation =NULL ; + +rcu_read_lock (); + do_vmclear_operation =rcu_dereference (crash_vmclear_loaded_vmcss); +if (do_vmclear_operation) +do_vmclear_operation (); +rcu_read_unlock (); +}/* This is the CPU performing the emergency shutdown work. */ int crashing_cpu =-1 ;
@@ -798,6 +818,8 @@ int crashing_cpu = -1;*/ void cpu_emergency_disable_virtualization (void ) { +cpu_crash_vmclear_loaded_vmcss (); +cpu_emergency_vmxoff ();cpu_emergency_svm_disable (); }
arch/x86/kvm/vmx/vmx.c +3 -7
@@ -41,7 +41,7 @@#include <asm/idtentry.h> #include <asm/io.h> #include <asm/irq_remapping.h> -#include <asm/kexec.h> +#include <asm/reboot.h> #include <asm/perf_event.h> #include <asm/mmu_context.h> #include <asm/mshyperv.h>
@@ -754,7 +754,6 @@ static int vmx_set_guest_uret_msr(struct vcpu_vmx *vmx,return ret; } -#ifdef CONFIG_KEXEC_CORE static void crash_vmclear_local_loaded_vmcss (void ) {int cpu =raw_smp_processor_id ();
@@ -764,7 +763,6 @@ static void crash_vmclear_local_loaded_vmcss(void) loaded_vmcss_on_cpu_link) vmcs_clear(v->vmcs); } -#endif /* CONFIG_KEXEC_CORE */ static void __loaded_vmcs_clear (void *arg) {
@@ -8623,10 +8621,9 @@ static void __vmx_exit(void) { allow_smaller_maxphyaddr = false; -#ifdef CONFIG_KEXEC_CORE RCU_INIT_POINTER (crash_vmclear_loaded_vmcss,NULL );synchronize_rcu (); -#endif +vmx_cleanup_l1d_flush (); }
@@ -8675,10 +8672,9 @@ static int __init vmx_init(void)pi_init_cpu (cpu); } -#ifdef CONFIG_KEXEC_CORE rcu_assign_pointer (crash_vmclear_loaded_vmcss, crash_vmclear_local_loaded_vmcss); -#endif +vmx_check_vmcs12_offsets ();/*
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 159/321 ceph: drop messages from MDS when unmounting
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiubo Li <[email protected]>
[ Upstream commit e3dfcab2080dc1f9a4b09cc1327361bc2845bfcd ]
When unmounting all the dirty buffers will be flushed and after the last osd request is finished the last reference of the i_count will be released. Then it will flush the dirty cap/snap to MDSs, and the unmounting won't wait the possible acks, which will ihold the inodes when updating the metadata locally but makes no sense any more, of this. This will make the evict_inodes() to skip these inodes.
If encrypt is enabled the kernel generate a warning when removing the encrypt keys when the skipped inodes still hold the keyring:
WARNING: CPU: 4 PID: 168846 at fs/crypto/keyring.c:242 fscrypt_destroy_keyring+0x7e/0xd0 CPU: 4 PID: 168846 Comm: umount Tainted: G S 6.1.0-rc5-ceph-g72ead199864c #1 Hardware name: Supermicro SYS-5018R-WR/X10SRW-F, BIOS 2.0 12/17/2015 RIP: 0010:fscrypt_destroy_keyring+0x7e/0xd0 RSP: 0018:ffffc9000b277e28 EFLAGS: 00010202 RAX: 0000000000000002 RBX: ffff88810d52ac00 RCX: ffff88810b56aa00 RDX: 0000000080000000 RSI: ffffffff822f3a09 RDI: ffff888108f59000 RBP: ffff8881d394fb88 R08: 0000000000000028 R09: 0000000000000000 R10: 0000000000000001 R11: 11ff4fe6834fcd91 R12: ffff8881d394fc40 R13: ffff888108f59000 R14: ffff8881d394f800 R15: 0000000000000000 FS: 00007fd83f6f1080(0000) GS:ffff88885fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f918d417000 CR3: 000000017f89a005 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> generic_shutdown_super+0x47/0x120 kill_anon_super+0x14/0x30 ceph_kill_sb+0x36/0x90 [ceph] deactivate_locked_super+0x29/0x60 cleanup_mnt+0xb8/0x140 task_work_run+0x67/0xb0 exit_to_user_mode_prepare+0x23d/0x240 syscall_exit_to_user_mode+0x25/0x60 do_syscall_64+0x40/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fd83dc39e9b
Later the kernel will crash when iput() the inodes and dereferencing the "sb->s_master_keys", which has been released by the generic_shutdown_super().
--- fs/ceph/caps.c | 6 +++- fs/ceph/mds_client.c | 12 +++++-- fs/ceph/mds_client.h | 11 +++++-- fs/ceph/quota.c | 14 ++++----- fs/ceph/snap.c | 10 +++--- fs/ceph/super.c | 75 +++++++++++++++++++++++++++++++++++++++++--- fs/ceph/super.h | 3 ++ 7 files changed, 109 insertions(+), 22 deletions(-)
fs/ceph/caps.c +5 -1
@@ -4105,6 +4105,9 @@ void ceph_handle_caps(struct ceph_mds_session *session,dout ("handle_caps from mds%d\n" , session->s_mds); +if (!ceph_inc_mds_stopping_blocker (mdsc, session)) +return ; +/* decode */ end = msg->front.iov_base + msg->front.iov_len;if (msg->front.iov_len <sizeof (*h))
@@ -4201,7 +4204,6 @@ void ceph_handle_caps(struct ceph_mds_session *session, vino.snap, inode);mutex_lock (&session->s_mutex); -inc_session_sequence (session);dout (" mds%d seq %lld cap seq %u\n" , session->s_mds, session->s_seq, (unsigned )seq);
@@ -4309,6 +4311,8 @@ void ceph_handle_caps(struct ceph_mds_session *session, done_unlocked:iput (inode); out: +ceph_dec_mds_stopping_blocker (mdsc); +ceph_put_string (extra_info.pool_ns);/* Defer closing the sessions after s_mutex lock being released */
fs/ceph/mds_client.c +10 -2
@@ -4550,6 +4550,9 @@ static void handle_lease(struct ceph_mds_client *mdsc,dout ("handle_lease from mds%d\n" , mds); +if (!ceph_inc_mds_stopping_blocker (mdsc, session)) +return ; +/* decode */ if (msg->front.iov_len <sizeof (*h) +sizeof (u32)) goto bad;
@@ -4568,8 +4571,6 @@ static void handle_lease(struct ceph_mds_client *mdsc, dname.len, dname.name);mutex_lock (&session->s_mutex); -inc_session_sequence (session); -if (!inode) {dout ("handle_lease no inode %llx\n" , vino.ino); goto release;
@@ -4631,9 +4632,13 @@ static void handle_lease(struct ceph_mds_client *mdsc, out:mutex_unlock (&session->s_mutex);iput (inode); + +ceph_dec_mds_stopping_blocker (mdsc);return ; bad: +ceph_dec_mds_stopping_blocker (mdsc); +pr_err ("corrupt lease message\n" );ceph_msg_dump (msg); }
@@ -4829,6 +4834,9 @@ int ceph_mdsc_init(struct ceph_fs_client *fsc) }init_completion (&mdsc->safe_umount_waiters); +spin_lock_init (&mdsc->stopping_lock); +atomic_set (&mdsc->stopping_blockers,0 ); +init_completion (&mdsc->stopping_waiter);init_waitqueue_head (&mdsc->session_close_wq);INIT_LIST_HEAD (&mdsc->waiting_for_map); mdsc->quotarealms_inodes =RB_ROOT ;
fs/ceph/mds_client.h +8 -3
@@ -381,8 +381,9 @@ struct cap_wait { };enum { -CEPH_MDSC_STOPPING_BEGIN =1 , -CEPH_MDSC_STOPPING_FLUSHED =2 , +CEPH_MDSC_STOPPING_BEGIN =1 , +CEPH_MDSC_STOPPING_FLUSHING =2 , +CEPH_MDSC_STOPPING_FLUSHED =3 , };/*
@@ -401,7 +402,11 @@ struct ceph_mds_client {struct ceph_mds_session **sessions;/* NULL for mds if no session */ atomic_t num_sessions;int max_sessions;/* len of sessions array */ -int stopping;/* true if shutting down */ + +spinlock_t stopping_lock;/* protect snap_empty */ +int stopping;/* the stage of shutting down */ +atomic_t stopping_blockers; +struct completion stopping_waiter;atomic64_t quotarealms_count;/* # realms with quota */ /*
fs/ceph/quota.c +7 -7
@@ -47,25 +47,23 @@ void ceph_handle_quota(struct ceph_mds_client *mdsc,struct inode *inode;struct ceph_inode_info *ci; +if (!ceph_inc_mds_stopping_blocker (mdsc, session)) +return ; +if (msg->front.iov_len <sizeof (*h)) {pr_err ("%s corrupt message mds%d len %d\n" , __func__, session->s_mds, (int )msg->front.iov_len);ceph_msg_dump (msg); -return ; + goto out; } -/* increment msg sequence number */ -mutex_lock (&session->s_mutex); -inc_session_sequence (session); -mutex_unlock (&session->s_mutex); -/* lookup inode */ vino.ino =le64_to_cpu (h->ino); vino.snap =CEPH_NOSNAP ; inode =ceph_find_inode (sb, vino);if (!inode) {pr_warn ("Failed to find inode %llu\n" , vino.ino); -return ; + goto out; } ci =ceph_inode (inode);
@@ -78,6 +76,8 @@ void ceph_handle_quota(struct ceph_mds_client *mdsc,spin_unlock (&ci->i_ceph_lock);iput (inode); +out: +ceph_dec_mds_stopping_blocker (mdsc); } static struct ceph_quotarealm_inode *
fs/ceph/snap.c +6 -4
@@ -1015,6 +1015,9 @@ void ceph_handle_snap(struct ceph_mds_client *mdsc,int locked_rwsem =0 ;bool close_sessions = false; +if (!ceph_inc_mds_stopping_blocker (mdsc, session)) +return ; +/* decode */ if (msg->front.iov_len <sizeof (*h)) goto bad;
@@ -1030,10 +1033,6 @@ void ceph_handle_snap(struct ceph_mds_client *mdsc,dout ("%s from mds%d op %s split %llx tracelen %d\n" , __func__, mds,ceph_snap_op_name (op), split, trace_len); -mutex_lock (&session->s_mutex); -inc_session_sequence (session); -mutex_unlock (&session->s_mutex); -down_write (&mdsc->snap_rwsem); locked_rwsem =1 ;
@@ -1151,6 +1150,7 @@ void ceph_handle_snap(struct ceph_mds_client *mdsc,up_write (&mdsc->snap_rwsem);flush_snaps (mdsc); +ceph_dec_mds_stopping_blocker (mdsc);return ; bad:
@@ -1160,6 +1160,8 @@ void ceph_handle_snap(struct ceph_mds_client *mdsc,if (locked_rwsem)up_write (&mdsc->snap_rwsem); +ceph_dec_mds_stopping_blocker (mdsc); +if (close_sessions)ceph_mdsc_close_sessions (mdsc);return ;
fs/ceph/super.c +70 -5
95 lines not on this page · raw message
fs/ceph/super.h +3 -0
@@ -1375,4 +1375,7 @@ extern bool ceph_quota_update_statfs(struct ceph_fs_client *fsc, struct kstatfs *buf);extern void ceph_cleanup_quotarealms_inodes (struct ceph_mds_client *mdsc); +bool ceph_inc_mds_stopping_blocker (struct ceph_mds_client *mdsc, +struct ceph_mds_session *session); +void ceph_dec_mds_stopping_blocker (struct ceph_mds_client *mdsc);#endif /* _FS_CEPH_SUPER_H */
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 160/321 dma-debug: dont call __dma_entry_alloc_check_leak() under free_entries_lock
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Senozhatsky <[email protected]>
[ Upstream commit fb5a4315591dae307a65fc246ca80b5159d296e1 ]
__dma_entry_alloc_check_leak() calls into printk -> serial console output (qcom geni) and grabs port->lock under free_entries_lock spin lock, which is a reverse locking dependency chain as qcom_geni IRQ handler can call into dma-debug code and grab free_entries_lock under port->lock.
Move __dma_entry_alloc_check_leak() call out of free_entries_lock scope so that we don't acquire serial console's port->lock under it.
Trimmed-down lockdep splat:
The existing dependency chain (in reverse order) is:
-> #2 (free_entries_lock){-.-.}-{2:2}:
_raw_spin_lock_irqsave+0x60/0x80
dma_entry_alloc+0x38/0x110
debug_dma_map_page+0x60/0xf8
dma_map_page_attrs+0x1e0/0x230
dma_map_single_attrs.constprop.0+0x6c/0xc8
geni_se_rx_dma_prep+0x40/0xcc
qcom_geni_serial_isr+0x310/0x510
__handle_irq_event_percpu+0x110/0x244
handle_irq_event_percpu+0x20/0x54
handle_irq_event+0x50/0x88
handle_fasteoi_irq+0xa4/0xcc
handle_irq_desc+0x28/0x40
generic_handle_domain_irq+0x24/0x30
gic_handle_irq+0xc4/0x148
do_interrupt_handler+0xa4/0xb0
el1_interrupt+0x34/0x64
el1h_64_irq_handler+0x18/0x24
el1h_64_irq+0x64/0x68
arch_local_irq_enable+0x4/0x8
____do_softirq+0x18/0x24
...
-> #1 (&port_lock_key){-.-.}-{2:2}:
_raw_spin_lock_irqsave+0x60/0x80
qcom_geni_serial_console_write+0x184/0x1dc
console_flush_all+0x344/0x454
console_unlock+0x94/0xf0
vprintk_emit+0x238/0x24c
vprintk_default+0x3c/0x48
vprintk+0xb4/0xbc
_printk+0x68/0x90
register_console+0x230/0x38c
uart_add_one_port+0x338/0x494
qcom_geni_serial_probe+0x390/0x424
platform_probe+0x70/0xc0
really_probe+0x148/0x280
__driver_probe_device+0xfc/0x114
driver_probe_device+0x44/0x100
__device_attach_driver+0x64/0xdc
bus_for_each_drv+0xb0/0xd8
__device_attach+0xe4/0x140
device_initial_probe+0x1c/0x28
bus_probe_device+0x44/0xb0
device_add+0x538/0x668
of_device_add+0x44/0x50
of_platform_device_create_pdata+0x94/0xc8
of_platform_bus_create+0x270/0x304
of_platform_populate+0xac/0xc4
devm_of_platform_populate+0x60/0xac
geni_se_probe+0x154/0x160
platform_probe+0x70/0xc0
...
-> #0 (console_owner){-...}-{0:0}:
__lock_acquire+0xdf8/0x109c
lock_acquire+0x234/0x284
console_flush_all+0x330/0x454
console_unlock+0x94/0xf0
vprintk_emit+0x238/0x24c
vprintk_default+0x3c/0x48
vprintk+0xb4/0xbc
_printk+0x68/0x90
dma_entry_alloc+0xb4/0x110
debug_dma_map_sg+0xdc/0x2f8
__dma_map_sg_attrs+0xac/0xe4
dma_map_sgtable+0x30/0x4c
get_pages+0x1d4/0x1e4 [msm]
msm_gem_pin_pages_locked+0x38/0xac [msm]
msm_gem_pin_vma_locked+0x58/0x88 [msm]
msm_ioctl_gem_submit+0xde4/0x13ac [msm]
drm_ioctl_kernel+0xe0/0x15c
drm_ioctl+0x2e8/0x3f4
vfs_ioctl+0x30/0x50
...Chain exists of: console_owner --> &port_lock_key --> free_entries_lock Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(free_entries_lock);
lock(&port_lock_key);
lock(free_entries_lock); lock(console_owner);
*** DEADLOCK ***
Call trace: dump_backtrace+0xb4/0xf0 show_stack+0x20/0x30 dump_stack_lvl+0x60/0x84 dump_stack+0x18/0x24 print_circular_bug+0x1cc/0x234 check_noncircular+0x78/0xac __lock_acquire+0xdf8/0x109c lock_acquire+0x234/0x284 console_flush_all+0x330/0x454 console_unlock+0x94/0xf0 vprintk_emit+0x238/0x24c vprintk_default+0x3c/0x48 vprintk+0xb4/0xbc _printk+0x68/0x90 dma_entry_alloc+0xb4/0x110 debug_dma_map_sg+0xdc/0x2f8 __dma_map_sg_attrs+0xac/0xe4 dma_map_sgtable+0x30/0x4c get_pages+0x1d4/0x1e4 [msm] msm_gem_pin_pages_locked+0x38/0xac [msm] msm_gem_pin_vma_locked+0x58/0x88 [msm] msm_ioctl_gem_submit+0xde4/0x13ac [msm] drm_ioctl_kernel+0xe0/0x15c drm_ioctl+0x2e8/0x3f4 vfs_ioctl+0x30/0x50 ...
--- kernel/dma/debug.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-)
kernel/dma/debug.c +15 -5
@@ -637,15 +637,19 @@ static struct dma_debug_entry *__dma_entry_alloc(void)return entry; } -static void __dma_entry_alloc_check_leak (void ) +/* +* This should be called outside of free_entries_lock scope to avoid potential +* deadlocks with serial consoles that use DMA. +*/ +static void __dma_entry_alloc_check_leak (u32 nr_entries) { -u32 tmp = nr_total_entries % nr_prealloc_entries; +u32 tmp = nr_entries % nr_prealloc_entries;/* Shout each time we tick over some multiple of the initial pool */ if (tmp <DMA_DEBUG_DYNAMIC_ENTRIES ) {pr_info ("dma_debug_entry pool grown to %u (%u00%%)\n" , - nr_total_entries, - (nr_total_entries / nr_prealloc_entries)); + nr_entries, + (nr_entries / nr_prealloc_entries)); } }
@@ -656,8 +660,10 @@ static void __dma_entry_alloc_check_leak(void)*/ static struct dma_debug_entry *dma_entry_alloc (void ) { +bool alloc_check_leak = false;struct dma_debug_entry *entry;unsigned long flags; +u32 nr_entries;spin_lock_irqsave (&free_entries_lock, flags);if (num_free_entries ==0 ) {
@@ -667,13 +673,17 @@ static struct dma_debug_entry *dma_entry_alloc(void)pr_err ("debugging out of memory - disabling\n" );return NULL ; } -__dma_entry_alloc_check_leak (); + alloc_check_leak = true; + nr_entries = nr_total_entries; } entry =__dma_entry_alloc ();spin_unlock_irqrestore (&free_entries_lock, flags); +if (alloc_check_leak) +__dma_entry_alloc_check_leak (nr_entries); +#ifdef CONFIG_STACKTRACE entry->stack_len = stack_trace_save(entry->stack_entries, ARRAY_SIZE(entry->stack_entries),
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 161/321 bpf: Annotate bpf_long_memcpy with data_race
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
[ Upstream commit 6a86b5b5cd76d2734304a0173f5f01aa8aa2025e ]
syzbot reported a data race splat between two processes trying to update the same BPF map value via syscall on different CPUs:
BUG: KCSAN: data-race in bpf_percpu_array_update / bpf_percpu_array_update
write to 0xffffe8fffe7425d8 of 8 bytes by task 8257 on cpu 1:
bpf_long_memcpy include/linux/bpf.h:428 [inline] bpf_obj_memcpy include/linux/bpf.h:441 [inline] copy_map_value_long include/linux/bpf.h:464 [inline] bpf_percpu_array_update+0x3bb/0x500 kernel/bpf/arraymap.c:380 bpf_map_update_value+0x190/0x370 kernel/bpf/syscall.c:175 generic_map_update_batch+0x3ae/0x4f0 kernel/bpf/syscall.c:1749 bpf_map_do_batch+0x2df/0x3d0 kernel/bpf/syscall.c:4648 __sys_bpf+0x28a/0x780 __do_sys_bpf kernel/bpf/syscall.c:5241 [inline] __se_sys_bpf kernel/bpf/syscall.c:5239 [inline] __x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5239 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
write to 0xffffe8fffe7425d8 of 8 bytes by task 8268 on cpu 0:
bpf_long_memcpy include/linux/bpf.h:428 [inline] bpf_obj_memcpy include/linux/bpf.h:441 [inline] copy_map_value_long include/linux/bpf.h:464 [inline] bpf_percpu_array_update+0x3bb/0x500 kernel/bpf/arraymap.c:380 bpf_map_update_value+0x190/0x370 kernel/bpf/syscall.c:175 generic_map_update_batch+0x3ae/0x4f0 kernel/bpf/syscall.c:1749 bpf_map_do_batch+0x2df/0x3d0 kernel/bpf/syscall.c:4648 __sys_bpf+0x28a/0x780 __do_sys_bpf kernel/bpf/syscall.c:5241 [inline] __se_sys_bpf kernel/bpf/syscall.c:5239 [inline] __x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5239 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
value changed: 0x0000000000000000 -> 0xfffffff000002788
The bpf_long_memcpy is used with 8-byte aligned pointers, power-of-8 size and forced to use long read/writes to try to atomically copy long counters. It is best-effort only and no barriers are here since it _will_ race with concurrent updates from BPF programs. The bpf_long_memcpy() is called from bpf(2) syscall. Marco suggested that the best way to make this known to KCSAN would be to use data_race() annotation.
--- include/linux/bpf.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/bpf.h +1 -1
@@ -425,7 +425,7 @@ static inline void bpf_long_memcpy(void *dst, const void *src, u32 size) size /=sizeof (long );while (size--) - *ldst++ = *lsrc++; +data_race (*ldst++ = *lsrc++); }/* copy everything but bpf_spin_lock, bpf_timer, and kptrs. There could be one of each. */
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 162/321 ASoC: amd: yc: Add DMI entries to support Victus by HP Gaming Laptop 15-fb0xxx (8A3E)
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shubh <[email protected]>
[ Upstream commit d1cf5d30b43f1a331032ebf3e11d9e366ab0f885 ]
This model requires an additional detection quirk to enable the internal microphone.
--- sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ 1 file changed, 7 insertions(+)
sound/soc/amd/yc/acp6x-mach.c +7 -0
@@ -325,6 +325,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { DMI_MATCH(DMI_BOARD_NAME, "8A22"), } }, + { + .driver_data = &acp6x_card, + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"HP" ), + DMI_MATCH(DMI_BOARD_NAME, "8A3E"), + } + }, { .driver_data = &acp6x_card, .matches = {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 163/321 spi: sun6i: reduce DMA RX transfer width to single byte
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tobias Schramm <[email protected]>
[ Upstream commit 171f8a49f212e87a8b04087568e1b3d132e36a18 ]
Through empirical testing it has been determined that sometimes RX SPI transfers with DMA enabled return corrupted data. This is down to single or even multiple bytes lost during DMA transfer from SPI peripheral to memory. It seems the RX FIFO within the SPI peripheral can become confused when performing bus read accesses wider than a single byte to it during an active SPI transfer.
This patch reduces the width of individual DMA read accesses to the RX FIFO to a single byte to mitigate that issue.
--- drivers/spi/spi-sun6i.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-sun6i.c +1 -1
@@ -211,7 +211,7 @@ static int sun6i_spi_prepare_dma(struct sun6i_spi *sspi,struct dma_slave_config rxconf = { .direction =DMA_DEV_TO_MEM , .src_addr = sspi->dma_addr_rx, - .src_addr_width =DMA_SLAVE_BUSWIDTH_4_BYTES , + .src_addr_width =DMA_SLAVE_BUSWIDTH_1_BYTE , .src_maxburst =8 , };
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 164/321 spi: sun6i: fix race between DMA RX transfer completion and RX FIFO drain
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tobias Schramm <[email protected]>
[ Upstream commit 1f11f4202caf5710204d334fe63392052783876d ]
Previously the transfer complete IRQ immediately drained to RX FIFO to read any data remaining in FIFO to the RX buffer. This behaviour is correct when dealing with SPI in interrupt mode. However in DMA mode the transfer complete interrupt still fires as soon as all bytes to be transferred have been stored in the FIFO. At that point data in the FIFO still needs to be picked up by the DMA engine. Thus the drain procedure and DMA engine end up racing to read from RX FIFO, corrupting any data read. Additionally the RX buffer pointer is never adjusted according to DMA progress in DMA mode, thus calling the RX FIFO drain procedure in DMA mode is a bug.
Fix corruptions in DMA RX mode by draining RX FIFO only in interrupt mode. Also wait for completion of RX DMA when in DMA mode before returning to ensure all data has been copied to the supplied memory buffer.
--- drivers/spi/spi-sun6i.c | 29 ++++++++++++++++++++++++++++- 1 file changed, 28 insertions(+), 1 deletion(-)
drivers/spi/spi-sun6i.c +28 -1
@@ -106,6 +106,7 @@ struct sun6i_spi {struct reset_control *rstc;struct completion done; +struct completion dma_rx_done;const u8 *tx_buf;u8 *rx_buf;
@@ -200,6 +201,13 @@ static size_t sun6i_spi_max_transfer_size(struct spi_device *spi)return SUN6I_MAX_XFER_SIZE -1 ; } +static void sun6i_spi_dma_rx_cb (void *param) +{ +struct sun6i_spi *sspi = param; + +complete (&sspi->dma_rx_done); +} +static int sun6i_spi_prepare_dma (struct sun6i_spi *sspi,struct spi_transfer *tfr) {
@@ -224,6 +232,8 @@ static int sun6i_spi_prepare_dma(struct sun6i_spi *sspi, DMA_PREP_INTERRUPT);if (!rxdesc)return -EINVAL ; + rxdesc->callback_param = sspi; + rxdesc->callback = sun6i_spi_dma_rx_cb; } txdesc =NULL ;
@@ -279,6 +289,7 @@ static int sun6i_spi_transfer_one(struct spi_master *master,return -EINVAL ;reinit_completion (&sspi->done); +reinit_completion (&sspi->dma_rx_done); sspi->tx_buf = tfr->tx_buf; sspi->rx_buf = tfr->rx_buf; sspi->len = tfr->len;
@@ -479,6 +490,22 @@ static int sun6i_spi_transfer_one(struct spi_master *master, start = jiffies; timeout =wait_for_completion_timeout (&sspi->done,msecs_to_jiffies (tx_time)); + +if (!use_dma) { +sun6i_spi_drain_fifo (sspi); + }else { +if (timeout && rx_len) { +/* +* Even though RX on the peripheral side has finished +* RX DMA might still be in flight +*/ + timeout =wait_for_completion_timeout (&sspi->dma_rx_done, + timeout); +if (!timeout) +dev_warn (&master->dev,"RX DMA timeout\n" ); + } + } + end = jiffies;if (!timeout) { dev_warn(&master->dev,
@@ -506,7 +533,6 @@ static irqreturn_t sun6i_spi_handler(int irq, void *dev_id)/* Transfer complete */ if (status &SUN6I_INT_CTL_TC ) {sun6i_spi_write (sspi,SUN6I_INT_STA_REG ,SUN6I_INT_CTL_TC ); -sun6i_spi_drain_fifo (sspi);complete (&sspi->done);return IRQ_HANDLED ; }
@@ -665,6 +691,7 @@ static int sun6i_spi_probe(struct platform_device *pdev) }init_completion (&sspi->done); +init_completion (&sspi->dma_rx_done); sspi->rstc =devm_reset_control_get_exclusive (&pdev->dev,NULL );if (IS_ERR (sspi->rstc)) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 165/321 nvme-fc: Prevent null pointer dereference in nvme_fc_io_getuuid()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nigel Kirkland <[email protected]>
[ Upstream commit 8ae5b3a685dc59a8cf7ccfe0e850999ba9727a3c ]
The nvme_fc_fcp_op structure describing an AEN operation is initialized with a null request structure pointer. An FC LLDD may make a call to nvme_fc_io_getuuid passing a pointer to an nvmefc_fcp_req for an AEN operation.
Add validation of the request structure pointer before dereference.
--- drivers/nvme/host/fc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nvme/host/fc.c +1 -1
@@ -1924,7 +1924,7 @@ char *nvme_fc_io_getuuid(struct nvmefc_fcp_req *req)struct nvme_fc_fcp_op *op =fcp_req_to_fcp_op (req);struct request *rq = op->rq; -if (!IS_ENABLED (CONFIG_BLK_CGROUP_FC_APPID ) || !rq->bio) +if (!IS_ENABLED (CONFIG_BLK_CGROUP_FC_APPID ) || !rq || !rq->bio)return NULL ;return blkcg_get_fc_appid (rq->bio); }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 166/321 parisc: sba: Fix compile warning wrt list of SBA devices
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <[email protected]>
[ Upstream commit eb3255ee8f6f4691471a28fbf22db5e8901116cd ]
Fix this makecheck warning:drivers/parisc/sba_iommu.c:98:19: warning: symbol 'sba_list'
was not declared. Should it be static?
--- arch/parisc/include/asm/ropes.h | 3 +++ drivers/char/agp/parisc-agp.c | 2 -- 2 files changed, 3 insertions(+), 2 deletions(-)
arch/parisc/include/asm/ropes.h +3 -0
@@ -86,6 +86,9 @@ struct sba_device {struct ioc ioc[MAX_IOC ]; }; +/* list of SBA's in system, see drivers/parisc/sba_iommu.c */ +extern struct sba_device *sba_list; +#define ASTRO_RUNWAY_PORT 0x582#define IKE_MERCED_PORT 0x803#define REO_MERCED_PORT 0x804
drivers/char/agp/parisc-agp.c +0 -2
@@ -394,8 +394,6 @@ find_quicksilver(struct device *dev, void *data)static int __init parisc_agp_init (void ) { -extern struct sba_device *sba_list; -int err =-1 ;struct parisc_device *sba =NULL , *lba =NULL ;struct lba_device *lbadev =NULL ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 167/321 parisc: sba-iommu: Fix sparse warnigs
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <[email protected]>
[ Upstream commit c1ebb94071cb4455177bafa619423acb3494d15d ]
Fix sparse warnings, as pdir is __le64 *.
--- arch/parisc/include/asm/ropes.h | 4 ++-- drivers/parisc/iommu-helpers.h | 4 ++-- drivers/parisc/sba_iommu.c | 28 ++++++++++++++-------------- 3 files changed, 18 insertions(+), 18 deletions(-)
arch/parisc/include/asm/ropes.h +2 -2
@@ -29,7 +29,7 @@struct ioc {void __iomem *ioc_hpa;/* I/O MMU base address */ char *res_map;/* resource map, bit == pdir entry */ -u64 *pdir_base;/* physical base address */ +__le64 *pdir_base;/* physical base address */ unsigned long ibase;/* pdir IOV Space base - shared w/lba_pci */ unsigned long imask;/* pdir IOV Space mask - shared w/lba_pci */ #ifdef ZX1_SUPPORT
@@ -113,7 +113,7 @@ static inline int IS_PLUTO(struct parisc_device *d) {#define SBA_PDIR_VALID_BIT 0x8000000000000000ULL -#define SBA_AGPGART_COOKIE 0x0000badbadc0ffeeULL +#define SBA_AGPGART_COOKIE (__force __le64) 0x0000badbadc0ffeeULL#define SBA_FUNC_ID 0x0000/* function id */ #define SBA_FCLASS 0x0008/* function class, bist, header, rev... */
drivers/parisc/iommu-helpers.h +2 -2
@@ -14,13 +14,13 @@static inline unsigned int iommu_fill_pdir (struct ioc *ioc,struct scatterlist *startsg,int nents,unsigned long hint, -void (*iommu_io_pdir_entry)(u64 *,space_t ,unsigned long , +void (*iommu_io_pdir_entry)(__le64 *,space_t ,unsigned long ,unsigned long )) {struct scatterlist *dma_sg = startsg;/* pointer to current DMA */ unsigned int n_mappings =0 ;unsigned long dma_offset =0 , dma_len =0 ; -u64 *pdirp =NULL ; +__le64 *pdirp =NULL ;/* Horrible hack. For efficiency's sake, dma_sg starts one * entry below the true start (it is immediately incremented
drivers/parisc/sba_iommu.c +14 -14
@@ -202,7 +202,7 @@ static void sba_dump_pdir_entry(struct ioc *ioc, char *msg, uint pide) {/* start printing from lowest pde in rval */ - u64 *ptr = &(ioc->pdir_base[pide & (~0U * BITS_PER_LONG)]); + __le64 *ptr = &(ioc->pdir_base[pide & (~0U * BITS_PER_LONG)]);unsigned long *rptr = (unsigned long *) &(ioc->res_map[(pide >>3 ) & ~(sizeof (unsigned long ) -1 )]);uint rcnt;
@@ -569,7 +569,7 @@ typedef unsigned long space_t;*/ static void -sba_io_pdir_entry (u64 *pdir_ptr,space_t sid,unsigned long vba, +sba_io_pdir_entry (__le64 *pdir_ptr,space_t sid,unsigned long vba,unsigned long hint) {u64 pa;/* physical address */
@@ -613,7 +613,7 @@ static void sba_mark_invalid(struct ioc *ioc, dma_addr_t iova, size_t byte_cnt) { u32 iovp = (u32) SBA_IOVP(ioc,iova); -u64 *pdir_ptr = &ioc->pdir_base[PDIR_INDEX (iovp)]; +__le64 *pdir_ptr = &ioc->pdir_base[PDIR_INDEX (iovp)];#ifdef ASSERT_PDIR_SANITY /* Assert first pdir entry is set.
@@ -714,7 +714,7 @@ sba_map_single(struct device *dev, void *addr, size_t size,unsigned long flags;dma_addr_t iovp;dma_addr_t offset; -u64 *pdir_start; +__le64 *pdir_start;int pide; ioc =GET_IOC (dev);
@@ -1432,7 +1432,7 @@ sba_ioc_init(struct parisc_device *sba, struct ioc *ioc, int ioc_num) ioc->pdir_size = pdir_size = (iova_space_size/IOVP_SIZE ) *sizeof (u64); - DBG_INIT("%s() hpa 0x%lx mem %ldMB IOV %dMB (%d bits)\n", + DBG_INIT("%s() hpa %px mem %ldMB IOV %dMB (%d bits)\n", __func__, ioc->ioc_hpa, (unsigned long) totalram_pages() >> (20 - PAGE_SHIFT),
@@ -1469,7 +1469,7 @@ sba_ioc_init(struct parisc_device *sba, struct ioc *ioc, int ioc_num) ioc->iovp_mask = ~(iova_space_mask +PAGE_SIZE -1 );#endif -DBG_INIT ("%s() IOV base 0x%lx mask 0x%0lx\n" , +DBG_INIT ("%s() IOV base %#lx mask %#0lx\n" , __func__, ioc->ibase, ioc->imask);/*
@@ -1581,7 +1581,7 @@ printk("sba_hw_init(): mem_boot 0x%x 0x%x 0x%x 0x%x\n", PAGE0->mem_boot.hpa,if (!IS_PLUTO (sba_dev->dev)) { ioc_ctl =READ_REG (sba_dev->sba_hpa+IOC_CTRL ); -DBG_INIT ("%s() hpa 0x%lx ioc_ctl 0x%Lx ->" , +DBG_INIT ("%s() hpa %px ioc_ctl 0x%Lx ->" , __func__, sba_dev->sba_hpa, ioc_ctl); ioc_ctl &= ~(IOC_CTRL_RM |IOC_CTRL_NC |IOC_CTRL_CE ); ioc_ctl |=IOC_CTRL_DD |IOC_CTRL_D4 |IOC_CTRL_TC ;
@@ -1666,14 +1666,14 @@ printk("sba_hw_init(): mem_boot 0x%x 0x%x 0x%x 0x%x\n", PAGE0->mem_boot.hpa,/* flush out the last writes */ READ_REG (sba_dev->ioc[i].ioc_hpa +ROPE7_CTL ); -DBG_INIT (" ioc[%d] ROPE_CFG 0x%Lx ROPE_DBG 0x%Lx\n" , +DBG_INIT (" ioc[%d] ROPE_CFG %#lx ROPE_DBG %lx\n" , i, -READ_REG (sba_dev->ioc[i].ioc_hpa +0x40 ), -READ_REG (sba_dev->ioc[i].ioc_hpa +0x50 ) + (unsigned long )READ_REG (sba_dev->ioc[i].ioc_hpa +0x40 ), + (unsigned long )READ_REG (sba_dev->ioc[i].ioc_hpa +0x50 ) ); -DBG_INIT (" STATUS_CONTROL 0x%Lx FLUSH_CTRL 0x%Lx\n" , -READ_REG (sba_dev->ioc[i].ioc_hpa +0x108 ), -READ_REG (sba_dev->ioc[i].ioc_hpa +0x400 ) +DBG_INIT (" STATUS_CONTROL %#lx FLUSH_CTRL %#lx\n" , + (unsigned long )READ_REG (sba_dev->ioc[i].ioc_hpa +0x108 ), + (unsigned long )READ_REG (sba_dev->ioc[i].ioc_hpa +0x400 ) );if (IS_PLUTO (sba_dev->dev)) {
@@ -1737,7 +1737,7 @@ sba_common_init(struct sba_device *sba_dev)#ifdef ASSERT_PDIR_SANITY /* Mark first bit busy - ie no IOVA 0 */ sba_dev->ioc[i].res_map[0 ] =0x80 ; - sba_dev->ioc[i].pdir_base[0 ] =0xeeffc0addbba0080ULL ; + sba_dev->ioc[i].pdir_base[0 ] = (__force __le64 )0xeeffc0addbba0080ULL ;#endif /* Third (and last) part of PIRANHA BUG */
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 168/321 parisc: ccio-dma: Fix sparse warnings
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <[email protected]>
[ Upstream commit 9a47a710cf517801a8b4fff9949c4cecb5fd019a ]
--- drivers/parisc/ccio-dma.c | 18 +++++++++--------- drivers/parisc/iommu-helpers.h | 4 ++-- 2 files changed, 11 insertions(+), 11 deletions(-)
drivers/parisc/ccio-dma.c +9 -9
@@ -222,7 +222,7 @@ struct ioa_registers {struct ioc {struct ioa_registers __iomem *ioc_regs;/* I/O MMU base address */ u8 *res_map;/* resource map, bit == pdir entry */ -u64 *pdir_base;/* physical base address */ +__le64 *pdir_base;/* physical base address */ u32 pdir_size;/* bytes, function of IOV Space size */ u32 res_hint;/* next available IOVP - circular search */
@@ -347,7 +347,7 @@ ccio_alloc_range(struct ioc *ioc, struct device *dev, size_t size)BUG_ON (pages_needed ==0 );BUG_ON ((pages_needed *IOVP_SIZE ) >DMA_CHUNK_SIZE ); -DBG_RES ("%s() size: %d pages_needed %d\n" , +DBG_RES ("%s() size: %zu pages_needed %d\n" , __func__, size, pages_needed);/*
@@ -435,7 +435,7 @@ ccio_free_range(struct ioc *ioc, dma_addr_t iova, unsigned long pages_mapped)BUG_ON ((pages_mapped *IOVP_SIZE ) >DMA_CHUNK_SIZE );BUG_ON (pages_mapped >BITS_PER_LONG ); -DBG_RES ("%s(): res_idx: %d pages_mapped %d\n" , +DBG_RES ("%s(): res_idx: %d pages_mapped %lu\n" , __func__, res_idx, pages_mapped);#ifdef CCIO_COLLECT_STATS
@@ -551,7 +551,7 @@ static u32 hint_lookup[] = {* index are bits 12:19 of the value returned by LCI. */ static void -ccio_io_pdir_entry (u64 *pdir_ptr,space_t sid,unsigned long vba, +ccio_io_pdir_entry (__le64 *pdir_ptr,space_t sid,unsigned long vba,unsigned long hints) { registerunsigned long pa;
@@ -727,7 +727,7 @@ ccio_map_single(struct device *dev, void *addr, size_t size,unsigned long flags;dma_addr_t iovp;dma_addr_t offset; -u64 *pdir_start; +__le64 *pdir_start;unsigned long hint = hint_lookup[(int )direction];BUG_ON (!dev);
@@ -754,8 +754,8 @@ ccio_map_single(struct device *dev, void *addr, size_t size, pdir_start = &(ioc->pdir_base[idx]); -DBG_RUN ("%s() 0x%p -> 0x%lx size: %0x%x\n" , - __func__, addr, (long )iovp | offset, size); +DBG_RUN ("%s() %px -> %#lx size: %zu\n" , + __func__, addr, (long )(iovp | offset), size);/* If not cacheline aligned, force SAFE_DMA on the whole mess */ if ((size %L1_CACHE_BYTES ) || ((unsigned long )addr %L1_CACHE_BYTES ))
@@ -813,7 +813,7 @@ ccio_unmap_page(struct device *dev, dma_addr_t iova, size_t size,return ; } -DBG_RUN ("%s() iovp 0x%lx/%x\n" , +DBG_RUN ("%s() iovp %#lx/%zx\n" , __func__, (long )iova, size); iova ^= offset;/* clear offset bits */
@@ -1291,7 +1291,7 @@ ccio_ioc_init(struct ioc *ioc) iova_space_size>>20 , iov_order + PAGE_SHIFT); - ioc->pdir_base = (u64 *)__get_free_pages (GFP_KERNEL , + ioc->pdir_base = (__le64 *)__get_free_pages (GFP_KERNEL ,get_order (ioc->pdir_size));if (NULL == ioc->pdir_base) {panic ("%s() could not allocate I/O Page Table\n" , __func__);
drivers/parisc/iommu-helpers.h +2 -2
@@ -31,8 +31,8 @@ iommu_fill_pdir(struct ioc *ioc, struct scatterlist *startsg, int nents,unsigned long vaddr;long size; -DBG_RUN_SG (" %d : %08lx/%05x %p/%05x\n" , nents, - (unsigned long )sg_dma_address (startsg), cnt, +DBG_RUN_SG (" %d : %08lx %p/%05x\n" , nents, + (unsigned long )sg_dma_address (startsg),sg_virt (startsg), startsg->length );
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 169/321 parisc: iosapic.c: Fix sparse warnings
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <[email protected]>
[ Upstream commit 927c6c8aa27c284a799b8c18784e37d3373af908 ]
--- drivers/parisc/iosapic.c | 4 ++-- drivers/parisc/iosapic_private.h | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
drivers/parisc/iosapic.c +2 -2
@@ -202,9 +202,9 @@ static inline void iosapic_write(void __iomem *iosapic, unsigned int reg, u32 vastatic DEFINE_SPINLOCK (iosapic_lock); -static inline void iosapic_eoi (void __iomem *addr,unsigned int data) +static inline void iosapic_eoi (__le32 __iomem *addr,__le32 data) { -__raw_writel (data, addr); +__raw_writel ((__force u32 )data, addr); }/*
drivers/parisc/iosapic_private.h +2 -2
@@ -118,8 +118,8 @@ struct iosapic_irt {struct vector_info {struct iosapic_info *iosapic;/* I/O SAPIC this vector is on */ struct irt_entry *irte;/* IRT entry */ -u32 __iomem *eoi_addr;/* precalculate EOI reg address */ -u32 eoi_data;/* IA64: ? PA: swapped txn_data */ +__le32 __iomem *eoi_addr;/* precalculate EOI reg address */ +__le32 eoi_data;/* IA64: ? PA: swapped txn_data */ int txn_irq;/* virtual IRQ number for processor */ ulong txn_addr;/* IA64: id_eid PA: partial HPA */ u32 txn_data;/* CPU interrupt bit */
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 170/321 parisc: drivers: Fix sparse warning
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <[email protected]>
[ Upstream commit b137b9d60b8add5620a06c687a71ce18776730b0 ]
Fix "warning: directive in macro's argument list" warning.
--- arch/parisc/kernel/drivers.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/parisc/kernel/drivers.c +1 -1
@@ -925,9 +925,9 @@ static __init void qemu_header(void)pr_info ("#define PARISC_MODEL \"%s\"\n\n" , boot_cpu_data.pdc.sys_model_name); +#define p ((unsigned long *)&boot_cpu_data.pdc.model)pr_info ("#define PARISC_PDC_MODEL 0x%lx, 0x%lx, 0x%lx, " "0x%lx, 0x%lx, 0x%lx, 0x%lx, 0x%lx, 0x%lx\n\n" , - #define p ((unsigned long *)&boot_cpu_data.pdc.model) p[0 ], p[1 ], p[2 ], p[3 ], p[4 ], p[5 ], p[6 ], p[7 ], p[8 ]);#undef p
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 171/321 parisc: irq: Make irq_stack_union static to avoid sparse warning
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <[email protected]>
[ Upstream commit b1bef1388c427cdad7331a9c8eb4ebbbe5b954b0 ]
--- arch/parisc/kernel/irq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/parisc/kernel/irq.c +1 -1
@@ -365,7 +365,7 @@ union irq_stack_union {volatile unsigned int lock[1 ]; }; -DEFINE_PER_CPU(union irq_stack_union, irq_stack_union) = { +static DEFINE_PER_CPU(union irq_stack_union, irq_stack_union) = { .slock = {1 ,1 ,1 ,1 }, };#endif
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 172/321 scsi: qedf: Add synchronization between I/O completions and abort
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javed Hasan <[email protected]>
[ Upstream commit 7df0b2605489bef3f4223ad66f1f9bb8d50d4cd2 ]
Avoid race condition between I/O completion and abort processing by protecting the cmd_type with the rport lock.
--- drivers/scsi/qedf/qedf_io.c | 10 ++++++++-- drivers/scsi/qedf/qedf_main.c | 7 ++++++- 2 files changed, 14 insertions(+), 3 deletions(-)
drivers/scsi/qedf/qedf_io.c +8 -2
@@ -1904,6 +1904,7 @@ int qedf_initiate_abts(struct qedf_ioreq *io_req, bool return_scsi_cmd_on_abts) goto drop_rdata_kref; } +spin_lock_irqsave (&fcport->rport_lock, flags);if (!test_bit (QEDF_CMD_OUTSTANDING , &io_req->flags) ||test_bit (QEDF_CMD_IN_CLEANUP , &io_req->flags) ||test_bit (QEDF_CMD_IN_ABORT , &io_req->flags)) {
@@ -1911,17 +1912,20 @@ int qedf_initiate_abts(struct qedf_ioreq *io_req, bool return_scsi_cmd_on_abts)"io_req xid=0x%x sc_cmd=%p already in cleanup or abort processing or already completed.\n" , io_req->xid, io_req->sc_cmd); rc =1 ; +spin_unlock_irqrestore (&fcport->rport_lock, flags); goto drop_rdata_kref; } +/* Set the command type to abort */ + io_req->cmd_type =QEDF_ABTS ; +spin_unlock_irqrestore (&fcport->rport_lock, flags); +kref_get (&io_req->refcount); xid = io_req->xid; qedf->control_requests++; qedf->packet_aborts++; -/* Set the command type to abort */ - io_req->cmd_type =QEDF_ABTS ; io_req->return_scsi_cmd_on_abts = return_scsi_cmd_on_abts;set_bit (QEDF_CMD_IN_ABORT , &io_req->flags);
@@ -2210,7 +2214,9 @@ int qedf_initiate_cleanup(struct qedf_ioreq *io_req, refcount, fcport, fcport->rdata->ids.port_id);/* Cleanup cmds re-use the same TID as the original I/O */ +spin_lock_irqsave (&fcport->rport_lock, flags); io_req->cmd_type =QEDF_CLEANUP ; +spin_unlock_irqrestore (&fcport->rport_lock, flags); io_req->return_scsi_cmd_on_abts = return_scsi_cmd_on_abts;init_completion (&io_req->cleanup_done);
drivers/scsi/qedf/qedf_main.c +6 -1
@@ -2805,6 +2805,8 @@ void qedf_process_cqe(struct qedf_ctx *qedf, struct fcoe_cqe *cqe)struct qedf_ioreq *io_req;struct qedf_rport *fcport;u32 comp_type; +u8 io_comp_type; +unsigned long flags; comp_type = (cqe->cqe_data >>FCOE_CQE_CQE_TYPE_SHIFT ) &FCOE_CQE_CQE_TYPE_MASK ;
@@ -2838,11 +2840,14 @@ void qedf_process_cqe(struct qedf_ctx *qedf, struct fcoe_cqe *cqe)return ; } +spin_lock_irqsave (&fcport->rport_lock, flags); + io_comp_type = io_req->cmd_type; +spin_unlock_irqrestore (&fcport->rport_lock, flags);switch (comp_type) {case FCOE_GOOD_COMPLETION_CQE_TYPE :atomic_inc (&fcport->free_sqes); -switch (io_req->cmd_type) { +switch (io_comp_type) {case QEDF_SCSI_CMD :qedf_scsi_completion (qedf, cqe, io_req);break ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 173/321 scsi: ufs: core: Move __ufshcd_send_uic_cmd() outside host_lock
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kiwoong Kim <[email protected]>
[ Upstream commit 2d3f59cf868b4a2dd678a96cd49bdd91411bd59f ]
__ufshcd_send_uic_cmd() is wrapped by uic_cmd_mutex and its related contexts are accessed within the section wrapped by uic_cmd_mutex. Thus, wrapping with host_lock is redundant.
--- drivers/ufs/core/ufshcd.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
drivers/ufs/core/ufshcd.c +1 -5
@@ -2416,7 +2416,6 @@ __ufshcd_send_uic_cmd(struct ufs_hba *hba, struct uic_command *uic_cmd, bool completion) {lockdep_assert_held (&hba->uic_cmd_mutex); -lockdep_assert_held (hba->host->host_lock);if (!ufshcd_ready_for_uic_cmd (hba)) { dev_err(hba->dev,
@@ -2443,7 +2442,6 @@ __ufshcd_send_uic_cmd(struct ufs_hba *hba, struct uic_command *uic_cmd,int ufshcd_send_uic_cmd (struct ufs_hba *hba,struct uic_command *uic_cmd) {int ret; -unsigned long flags;if (hba->quirks &UFSHCD_QUIRK_BROKEN_UIC_CMD )return 0 ;
@@ -2452,9 +2450,7 @@ int ufshcd_send_uic_cmd(struct ufs_hba *hba, struct uic_command *uic_cmd)mutex_lock (&hba->uic_cmd_mutex);ufshcd_add_delay_before_dme_cmd (hba); -spin_lock_irqsave (hba->host->host_lock, flags); ret =__ufshcd_send_uic_cmd (hba, uic_cmd, true); -spin_unlock_irqrestore (hba->host->host_lock, flags);if (!ret) ret =ufshcd_wait_for_uic_cmd (hba, uic_cmd);
@@ -4166,8 +4162,8 @@ static int ufshcd_uic_pwr_ctrl(struct ufs_hba *hba, struct uic_command *cmd)wmb (); reenable_intr = true; } - ret =__ufshcd_send_uic_cmd (hba, cmd, false);spin_unlock_irqrestore (hba->host->host_lock, flags); + ret =__ufshcd_send_uic_cmd (hba, cmd, false);if (ret) { dev_err(hba->dev, "pwr ctrl cmd 0x%x with mode 0x%x uic error %d\n",
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 174/321 scsi: ufs: core: Poll HCS.UCRDY before issuing a UIC command
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kiwoong Kim <[email protected]>
[ Upstream commit d32533d30e2119b0c0aa17596734f1f842f750df ]
With auto hibern8 enabled, UIC could be busy processing a hibern8 operation and the HCI would reports UIC not ready for a short while through HCS.UCRDY. The UFS driver doesn't currently handle this situation. The UFSHCI spec specifies UCRDY like this: whether the host controller is ready to process UIC COMMAND
The 'ready' could be seen as many different meanings. If the meaning includes not processing any request from HCI, processing a hibern8 operation can be 'not ready'. In this situation, the driver needs to wait until the operations is completed.
--- drivers/ufs/core/ufshcd.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/ufs/core/ufshcd.c +6 -1
@@ -22,6 +22,7 @@#include <linux/module.h> #include <linux/regulator/consumer.h> #include <linux/sched/clock.h> +#include <linux/iopoll.h> #include <scsi/scsi_cmnd.h> #include <scsi/scsi_dbg.h> #include <scsi/scsi_driver.h>
@@ -2324,7 +2325,11 @@ static inline int ufshcd_hba_capabilities(struct ufs_hba *hba)*/ static inline bool ufshcd_ready_for_uic_cmd (struct ufs_hba *hba) { -return ufshcd_readl (hba,REG_CONTROLLER_STATUS ) &UIC_COMMAND_READY ; +u32 val; +int ret =read_poll_timeout (ufshcd_readl, val, val &UIC_COMMAND_READY , +500 ,UIC_CMD_TIMEOUT *1000 , false, hba, +REG_CONTROLLER_STATUS ); +return ret ==0 ? true : false; }/**
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 175/321 selftests/ftrace: Correctly enable event in instance-event.tc
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Yejian <[email protected]>
[ Upstream commit f4e4ada586995b17f828c6d147d1800eb1471450 ]
Function instance_set() expects to enable event 'sched_switch', so we should set 1 to its 'enable' file.
Testcase passed after this patch:
# ./ftracetest test.d/instances/instance-event.tc === Ftrace unit tests === [1] Test creation and deletion of trace instances while setting an event [PASS]
# of passed: 1 # of failed: 0 # of unresolved: 0 # of untested: 0 # of unsupported: 0 # of xfailed: 0 # of undefined(test bug): 0
--- .../testing/selftests/ftrace/test.d/instances/instance-event.tc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/ftrace/test.d/instances/instance-event.tc +1 -1
@@ -39,7 +39,7 @@ instance_read() { instance_set() { while :; do - echo 1 > foo/events/sched/sched_switch + echo 1 > foo/events/sched/sched_switch/enable done 2> /dev/null }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 176/321 ring-buffer: Avoid softlockup in ring_buffer_resize()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Yejian <[email protected]>
[ Upstream commit f6bd2c92488c30ef53b5bd80c52f0a7eee9d545a ]
When user resize all trace ring buffer through file 'buffer_size_kb', then in ring_buffer_resize(), kernel allocates buffer pages for each cpu in a loop.
If the kernel preemption model is PREEMPT_NONE and there are many cpus and there are many buffer pages to be allocated, it may not give up cpu for a long time and finally cause a softlockup.
To avoid it, call cond_resched() after each cpu buffer allocation.
--- kernel/trace/ring_buffer.c | 2 ++ 1 file changed, 2 insertions(+)
kernel/trace/ring_buffer.c +2 -0
@@ -2206,6 +2206,8 @@ int ring_buffer_resize(struct trace_buffer *buffer, unsigned long size, err = -ENOMEM ; goto out_err; } + +cond_resched (); }cpus_read_lock ();
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 177/321 btrfs: assert delayed node locked when removing delayed item
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit a57c2d4e46f519b24558ae0752c17eec416ac72a ]
When removing a delayed item, or releasing which will remove it as well, we will modify one of the delayed node's rbtrees and item counter if the delayed item is in one of the rbtrees. This require having the delayed node's mutex locked, otherwise we will race with other tasks modifying the rbtrees and the counter.
This is motivated by a previous version of another patch actually calling btrfs_release_delayed_item() after unlocking the delayed node's mutex and against a delayed item that is in a rbtree.
So assert at __btrfs_remove_delayed_item() that the delayed node's mutex is locked.
--- fs/btrfs/delayed-inode.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
fs/btrfs/delayed-inode.c +8 -4
@@ -412,6 +412,7 @@ static void finish_one_item(struct btrfs_delayed_root *delayed_root)static void __btrfs_remove_delayed_item (struct btrfs_delayed_item *delayed_item) { +struct btrfs_delayed_node *delayed_node = delayed_item->delayed_node;struct rb_root_cached *root;struct btrfs_delayed_root *delayed_root;
@@ -419,18 +420,21 @@ static void __btrfs_remove_delayed_item(struct btrfs_delayed_item *delayed_item)if (RB_EMPTY_NODE (&delayed_item->rb_node))return ; - delayed_root = delayed_item->delayed_node->root->fs_info->delayed_root; +/* If it's in a rbtree, then we need to have delayed node locked. */ +lockdep_assert_held (&delayed_node->mutex); + + delayed_root = delayed_node->root->fs_info->delayed_root;BUG_ON (!delayed_root);if (delayed_item->type ==BTRFS_DELAYED_INSERTION_ITEM ) - root = &delayed_item->delayed_node->ins_root; + root = &delayed_node->ins_root;else - root = &delayed_item->delayed_node->del_root; + root = &delayed_node->del_root;rb_erase_cached (&delayed_item->rb_node, root);RB_CLEAR_NODE (&delayed_item->rb_node); - delayed_item->delayed_node->count--; + delayed_node->count--;finish_one_item (delayed_root); }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 178/321 selftests: fix dependency checker script
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo B. Marliere <[email protected]>
[ Upstream commit 5f9dd2e896a91bfca90f8463eb6808c03d535d8a ]
This patch fixes inconsistencies in the parsing rules of the levels 1 and 2 of the kselftest_deps.sh. It was added the levels 4 and 5 to account for a few edge cases that are present in some tests, also some
minor identation styling have been fixed (s/ /\t/g).
--- tools/testing/selftests/kselftest_deps.sh | 77 +++++++++++++++++++---- 1 file changed, 65 insertions(+), 12 deletions(-)
tools/testing/selftests/kselftest_deps.sh +65 -12
@@ -46,11 +46,11 @@ fi print_targets=0 while getopts "p" arg; do - case $arg in - p) + case $arg in + p) print_targets=1 shift;; - esac + esac done if [ $# -eq 0 ]
@@ -92,6 +92,10 @@ pass_cnt=0 # Get all TARGETS from selftests Makefile targets=$(grep -E "^TARGETS +|^TARGETS =" Makefile | cut -d "=" -f2) +# Initially, in LDLIBS related lines, the dep checker needs +# to ignore lines containing the following strings: +filter="\$(VAR_LDLIBS)\|pkg-config\|PKG_CONFIG\|IOURING_EXTRA_LIBS" + # Single test case if [ $# -eq 2 ] then
@@ -100,6 +104,8 @@ then l1_test $test l2_test $test l3_test $test + l4_test $test + l5_test $test print_results $1 $2 exit $?
@@ -113,7 +119,7 @@ fi # Append space at the end of the list to append more tests. l1_tests=$(grep -r --include=Makefile "^LDLIBS" | \ - grep -v "VAR_LDLIBS" | awk -F: '{print $1}') + grep -v "$filter" | awk -F: '{print $1}' | uniq) # Level 2: LDLIBS set dynamically. #
@@ -126,7 +132,7 @@ l1_tests=$(grep -r --include=Makefile "^LDLIBS" | \ # Append space at the end of the list to append more tests. l2_tests=$(grep -r --include=Makefile ": LDLIBS" | \ - grep -v "VAR_LDLIBS" | awk -F: '{print $1}') + grep -v "$filter" | awk -F: '{print $1}' | uniq) # Level 3 # memfd and others use pkg-config to find mount and fuse libs
@@ -138,11 +144,32 @@ l2_tests=$(grep -r --include=Makefile ": LDLIBS" | \ # VAR_LDLIBS := $(shell pkg-config fuse --libs 2>/dev/null) l3_tests=$(grep -r --include=Makefile "^VAR_LDLIBS" | \ - grep -v "pkg-config" | awk -F: '{print $1}') + grep -v "pkg-config\|PKG_CONFIG" | awk -F: '{print $1}' | uniq) -#echo $l1_tests -#echo $l2_1_tests -#echo $l3_tests +# Level 4 +# some tests may fall back to default using `|| echo -l<libname>` +# if pkg-config doesn't find the libs, instead of using VAR_LDLIBS +# as per level 3 checks. +# e.g: +# netfilter/Makefile +# LDLIBS += $(shell $(HOSTPKG_CONFIG) --libs libmnl 2>/dev/null || echo -lmnl) +l4_tests=$(grep -r --include=Makefile "^LDLIBS" | \ + grep "pkg-config\|PKG_CONFIG" | awk -F: '{print $1}' | uniq) + +# Level 5 +# some tests may use IOURING_EXTRA_LIBS to add extra libs to LDLIBS, +# which in turn may be defined in a sub-Makefile +# e.g.: +# mm/Makefile +# $(OUTPUT)/gup_longterm: LDLIBS += $(IOURING_EXTRA_LIBS) +l5_tests=$(grep -r --include=Makefile "LDLIBS +=.*\$(IOURING_EXTRA_LIBS)" | \ + awk -F: '{print $1}' | uniq) + +#echo l1_tests $l1_tests +#echo l2_tests $l2_tests +#echo l3_tests $l3_tests +#echo l4_tests $l4_tests +#echo l5_tests $l5_tests all_tests print_results $1 $2
@@ -164,24 +191,32 @@ all_tests() for test in $l3_tests; do l3_test $test done + + for test in $l4_tests; do + l4_test $test + done + + for test in $l5_tests; do + l5_test $test + done } # Use same parsing used for l1_tests and pick libraries this time. l1_test() { test_libs=$(grep --include=Makefile "^LDLIBS" $test | \ - grep -v "VAR_LDLIBS" | \ + grep -v "$filter" | \ sed -e 's/\:/ /' | \ sed -e 's/+/ /' | cut -d "=" -f 2) check_libs $test $test_libs } -# Use same parsing used for l2__tests and pick libraries this time. +# Use same parsing used for l2_tests and pick libraries this time. l2_test() { test_libs=$(grep --include=Makefile ": LDLIBS" $test | \ - grep -v "VAR_LDLIBS" | \ + grep -v "$filter" | \ sed -e 's/\:/ /' | sed -e 's/+/ /' | \ cut -d "=" -f 2)
@@ -197,6 +232,24 @@ l3_test() check_libs $test $test_libs } +l4_test() +{ + test_libs=$(grep --include=Makefile "^VAR_LDLIBS\|^LDLIBS" $test | \ + grep "\(pkg-config\|PKG_CONFIG\).*|| echo " | \ + sed -e 's/.*|| echo //' | sed -e 's/)$//') + + check_libs $test $test_libs +} + +l5_test() +{ + tests=$(find $(dirname "$test") -type f -name "*.mk") + test_libs=$(grep "^IOURING_EXTRA_LIBS +\?=" $tests | \ + cut -d "=" -f 2) + + check_libs $test $test_libs +} + check_libs() {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 179/321 ring-buffer: Do not attempt to read past "commit"
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt (Google) <[email protected]>
[ Upstream commit 95a404bd60af6c4d9d8db01ad14fe8957ece31ca ]
When iterating over the ring buffer while the ring buffer is active, the writer can corrupt the reader. There's barriers to help detect this and handle it, but that code missed the case where the last event was at the very end of the page and has only 4 bytes left.
The checks to detect the corruption by the writer to reads needs to see the length of the event. If the length in the first 4 bytes is zero then the length is stored in the second 4 bytes. But if the writer is in the process of updating that code, there's a small window where the length in the first 4 bytes could be zero even though the length is only 4 bytes. That will cause rb_event_length() to read the next 4 bytes which could happen to be off the allocated page.
To protect against this, fail immediately if the next event pointer is less than 8 bytes from the end of the commit (last byte of data), as all events must be a minimum of 8 bytes anyway.
--- kernel/trace/ring_buffer.c | 5 +++++ 1 file changed, 5 insertions(+)
kernel/trace/ring_buffer.c +5 -0
@@ -2398,6 +2398,11 @@ rb_iter_head_event(struct ring_buffer_iter *iter)*/ commit =rb_page_commit (iter_head_page);smp_rmb (); + +/* An event needs to be at least 8 bytes in size */ +if (iter->head > commit -8 ) + goto reset; + event =__rb_page_index (iter_head_page, iter->head); length =rb_event_length (event);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 180/321 net/smc: bugfix for smcr v2 server connect success statistic
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangguan Wang <[email protected]>
[ Upstream commit 6912e724832c47bb381eb1bd1e483ec8df0d0f0f ]
In the macro SMC_STAT_SERV_SUCC_INC, the smcd_version is used to determin whether to increase the v1 statistic or the v2 statistic. It is correct for SMCD. But for SMCR, smcr_version should be used.
--- net/smc/smc_stats.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/smc/smc_stats.h +2 -1
@@ -243,8 +243,9 @@ while (0)#define SMC_STAT_SERV_SUCC_INC (net, _ini) \ do { \ typeof(_ini) i = (_ini); \ - bool is_v2 = (i->smcd_version & SMC_V2); \ bool is_smcd = (i->is_smcd); \ + u8 version = is_smcd ? i->smcd_version : i->smcr_version; \ + bool is_v2 = (version & SMC_V2); \ typeof(net->smc.smc_stats) smc_stats = (net)->smc.smc_stats; \ if (is_v2 && is_smcd) \ this_cpu_inc(smc_stats->smc[SMC_TYPE_D].srv_v2_succ_cnt); \
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 181/321 ata: sata_mv: Fix incorrect string length computation in mv_dump_mem()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit e97eb65dd464e7f118a16a26337322d07eb653e2 ]
snprintf() returns the "number of characters which *would* be generated for the given input", not the size *really* generated.
In order to avoid too large values for 'o' (and potential negative values for "sizeof(linebuf) o") use scnprintf() instead of snprintf().
Note that given the "w < 4" in the for loop, the buffer can NOT overflow, but using the *right* function is always better.
--- drivers/ata/sata_mv.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/ata/sata_mv.c +2 -2
@@ -1255,8 +1255,8 @@ static void mv_dump_mem(struct device *dev, void __iomem *start, unsigned bytes)for (b =0 ; b < bytes; ) {for (w =0 , o =0 ; b < bytes && w <4 ; w++) { - o +=snprintf (linebuf + o,sizeof (linebuf) - o, -"%08x " ,readl (start + b)); + o +=scnprintf (linebuf + o,sizeof (linebuf) - o, +"%08x " ,readl (start + b)); b +=sizeof (u32); } dev_dbg(dev, "%s: %p: %s\n",
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 182/321 efi/x86: Ensure that EFI_RUNTIME_MAP is enabled for kexec
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <[email protected]>
[ Upstream commit aba7e066c738d4b349413a271b2a236aa55bacbc ]
CONFIG_EFI_RUNTIME_MAP needs to be enabled in order for kexec to be able to provide the required information about the EFI runtime mappings to the incoming kernel, regardless of whether kexec_load() or kexec_file_load() is being used. Without this information, kexec boot in EFI mode is not possible.
The CONFIG_EFI_RUNTIME_MAP option is currently directly configurable if CONFIG_EXPERT is enabled, so that it can be turned on for debugging purposes even if KEXEC is not enabled. However, the upshot of this is that it can also be disabled even when it shouldn't.
So tweak the Kconfig declarations to avoid this situation.
--- arch/x86/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/Kconfig +1 -1
@@ -1955,6 +1955,7 @@ config EFI select UCS2_STRING select EFI_RUNTIME_WRAPPERS select ARCH_USE_MEMREMAP_PROT + select EFI_RUNTIME_MAP if KEXEC_CORE help This enables the kernel to use EFI runtime services that are available (such as the EFI variable services).
@@ -2030,7 +2031,6 @@ config EFI_MAX_FAKE_MEM config EFI_RUNTIME_MAP bool "Export EFI runtime maps to sysfs" if EXPERT depends on EFI - default KEXEC_CORE help Export EFI runtime memory regions to /sys/firmware/efi/runtime-map. That memory map is required by the 2nd kernel to set up EFI virtual
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 183/321 platform/mellanox: mlxbf-bootctl: add NET dependency into Kconfig
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Thompson <[email protected]>
[ Upstream commit c2dffda1d8f7511505bbbf16ba282f2079b30089 ]
The latest version of the mlxbf_bootctl driver utilizes "sysfs_format_mac", and this API is only available if NET is defined in the kernel configuration. This patch changes the mlxbf_bootctl Kconfig to depend on NET.
--- drivers/platform/mellanox/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/platform/mellanox/Kconfig +1 -0
@@ -60,6 +60,7 @@ config MLXBF_BOOTCTL tristate "Mellanox BlueField Firmware Boot Control driver" depends on ARM64 depends on ACPI + depends on NET help The Mellanox BlueField firmware implements functionality to request swapping the primary and alternate eMMC boot partition,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 184/321 platform/x86: asus-wmi: Support 2023 ROG X16 tablet mode
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luke D. Jones <[email protected]>
[ Upstream commit 4106a70ddad57ee6d8f98b81d6f036740c72762b ]
Add quirk for ASUS ROG X16 (GV601V, 2023 versions) Flow 2-in-1 to enable tablet mode with lid flip (all screen rotations).
--- drivers/platform/x86/asus-nb-wmi.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/platform/x86/asus-nb-wmi.c +9 -0
@@ -478,6 +478,15 @@ static const struct dmi_system_id asus_quirks[] = { }, .driver_data = &quirk_asus_tablet_mode, }, + { + .callback = dmi_matched, + .ident = "ASUS ROG FLOW X16", + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"ASUSTeK COMPUTER INC." ), + DMI_MATCH(DMI_PRODUCT_NAME, "GV601V"), + }, + .driver_data = &quirk_asus_tablet_mode, + }, { .callback = dmi_matched, .ident = "ASUS VivoBook E410MA",
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 185/321 thermal/of: add missing of_node_put()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julia Lawall <[email protected]>
[ Upstream commit 8a81cf96f5510aaf9a65d103f7405079a7b0fcc5 ]
for_each_child_of_node performs an of_node_get on each iteration, so a break out of the loop requires an of_node_put.
This was done using the Coccinelle semantic patch iterators/for_each_child.cocci
--- drivers/thermal/thermal_of.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/thermal/thermal_of.c +6 -2
@@ -38,8 +38,10 @@ static int of_find_trip_id(struct device_node *np, struct device_node *trip)*/ for_each_child_of_node (trips, t) { -if (t == trip) +if (t == trip) { +of_node_put (t); goto out; + } i++; }
@@ -402,8 +404,10 @@ static int thermal_of_for_each_cooling_maps(struct thermal_zone_device *tz,for_each_child_of_node (cm_np, child) { ret =thermal_of_for_each_cooling_device (tz_np, child, tz, cdev, action); -if (ret) +if (ret) { +of_node_put (child);break ; + } }of_node_put (cm_np);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 186/321 drm/amdgpu: Store CU info from all XCCs for GFX v9.4.3
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mukul Joshi <[email protected]>
[ Upstream commit 97e3c6a853f2af9145daf0c6ca25bcdf55c759d4 ]
Currently, we store CU info only for a single XCC assuming that it is the same for all XCCs. However, that may not be true. As a result, store CU info for all XCCs. This info is later used for CU masking.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 2 +- drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 4 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 76 +++++++++---------- drivers/gpu/drm/amd/amdkfd/kfd_crat.c | 3 +- drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c | 8 +- drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 11 ++- .../gpu/drm/amd/include/kgd_kfd_interface.h | 6 +- 14 files changed, 60 insertions(+), 65 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c +1 -1
@@ -492,7 +492,7 @@ void amdgpu_amdkfd_get_cu_info(struct amdgpu_device *adev, struct kfd_cu_info *c cu_info->cu_active_number = acu_info.number; cu_info->cu_ao_mask = acu_info.ao_cu_mask;memcpy (&cu_info->cu_bitmap[0 ], &acu_info.bitmap[0 ], -sizeof (acu_info.bitmap)); +sizeof (cu_info->cu_bitmap)); cu_info->num_shader_engines = adev->gfx.config.max_shader_engines; cu_info->num_shader_arrays_per_engine = adev->gfx.config.max_sh_per_se; cu_info->num_cu_per_sh = adev->gfx.config.max_cu_per_sh;
drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h +2 -1
@@ -43,6 +43,7 @@#define AMDGPU_GFX_LBPW_DISABLED_MODE 0x00000008L#define AMDGPU_MAX_GC_INSTANCES 8 +#define KGD_MAX_QUEUES 128#define AMDGPU_MAX_GFX_QUEUES KGD_MAX_QUEUES#define AMDGPU_MAX_COMPUTE_QUEUES KGD_MAX_QUEUES
@@ -254,7 +255,7 @@ struct amdgpu_cu_info {uint32_t number;uint32_t ao_cu_mask;uint32_t ao_cu_bitmap[4 ][4 ]; -uint32_t bitmap[4 ][4 ]; +uint32_t bitmap[AMDGPU_MAX_GC_INSTANCES ][4 ][4 ]; };struct amdgpu_gfx_ras {
drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +1 -1
@@ -839,7 +839,7 @@ int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)memcpy (&dev_info->cu_ao_bitmap[0 ], &adev->gfx.cu_info.ao_cu_bitmap[0 ],sizeof (adev->gfx.cu_info.ao_cu_bitmap));memcpy (&dev_info->cu_bitmap[0 ], &adev->gfx.cu_info.bitmap[0 ], -sizeof (adev->gfx.cu_info.bitmap)); +sizeof (dev_info->cu_bitmap)); dev_info->vram_type = adev->gmc.vram_type; dev_info->vram_bit_width = adev->gmc.vram_width; dev_info->vce_harvest_config = adev->vce.harvest_config;
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +1 -1
@@ -9448,7 +9448,7 @@ static int gfx_v10_0_get_cu_info(struct amdgpu_device *adev,gfx_v10_0_set_user_wgp_inactive_bitmap_per_sh ( adev, disable_masks[i *2 + j]); bitmap =gfx_v10_0_get_cu_active_bitmap_per_sh (adev); - cu_info->bitmap[i][j] = bitmap; + cu_info->bitmap[0 ][i][j] = bitmap;for (k =0 ; k < adev->gfx.config.max_cu_per_sh; k++) {if (bitmap & mask) {
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c +1 -1
@@ -6394,7 +6394,7 @@ static int gfx_v11_0_get_cu_info(struct amdgpu_device *adev,* SE6: {SH0,SH1} --> {bitmap[2][2], bitmap[2][3]} * SE7: {SH0,SH1} --> {bitmap[3][2], bitmap[3][3]} */ - cu_info->bitmap[i %4 ][j + (i /4 ) *2 ] = bitmap; + cu_info->bitmap[0 ][i %4 ][j + (i /4 ) *2 ] = bitmap;for (k =0 ; k < adev->gfx.config.max_cu_per_sh; k++) {if (bitmap & mask)
drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c +1 -1
@@ -3577,7 +3577,7 @@ static void gfx_v6_0_get_cu_info(struct amdgpu_device *adev)gfx_v6_0_set_user_cu_inactive_bitmap ( adev, disable_masks[i *2 + j]); bitmap =gfx_v6_0_get_cu_enabled (adev); - cu_info->bitmap[i][j] = bitmap; + cu_info->bitmap[0 ][i][j] = bitmap;for (k =0 ; k < adev->gfx.config.max_cu_per_sh; k++) {if (bitmap & mask) {
drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c +1 -1
@@ -5122,7 +5122,7 @@ static void gfx_v7_0_get_cu_info(struct amdgpu_device *adev)gfx_v7_0_set_user_cu_inactive_bitmap ( adev, disable_masks[i *2 + j]); bitmap =gfx_v7_0_get_cu_active_bitmap (adev); - cu_info->bitmap[i][j] = bitmap; + cu_info->bitmap[0 ][i][j] = bitmap;for (k =0 ; k < adev->gfx.config.max_cu_per_sh; k ++) {if (bitmap & mask) {
drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c +1 -1
@@ -7121,7 +7121,7 @@ static void gfx_v8_0_get_cu_info(struct amdgpu_device *adev)gfx_v8_0_set_user_cu_inactive_bitmap ( adev, disable_masks[i *2 + j]); bitmap =gfx_v8_0_get_cu_active_bitmap (adev); - cu_info->bitmap[i][j] = bitmap; + cu_info->bitmap[0 ][i][j] = bitmap;for (k =0 ; k < adev->gfx.config.max_cu_per_sh; k ++) {if (bitmap & mask) {
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +2 -2
@@ -1497,7 +1497,7 @@ static void gfx_v9_0_init_always_on_cu_mask(struct amdgpu_device *adev)amdgpu_gfx_select_se_sh (adev, i, j,0xffffffff ,0 );for (k =0 ; k < adev->gfx.config.max_cu_per_sh; k ++) { -if (cu_info->bitmap[i][j] & mask) { +if (cu_info->bitmap[0 ][i][j] & mask) {if (counter == pg_always_on_cu_num)WREG32_SOC15 (GC ,0 , mmRLC_PG_ALWAYS_ON_CU_MASK, cu_bitmap);if (counter < always_on_cu_num)
@@ -7237,7 +7237,7 @@ static int gfx_v9_0_get_cu_info(struct amdgpu_device *adev,* SE6,SH0 --> bitmap[2][1] * SE7,SH0 --> bitmap[3][1] */ - cu_info->bitmap[i %4 ][j + i /4 ] = bitmap; + cu_info->bitmap[0 ][i %4 ][j + i /4 ] = bitmap;for (k =0 ; k < adev->gfx.config.max_cu_per_sh; k ++) {if (bitmap & mask) {
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c +34 -42
109 lines not on this page · raw message
drivers/gpu/drm/amd/amdkfd/kfd_crat.c +2 -1
@@ -2154,7 +2154,8 @@ static int kfd_create_vcrat_image_gpu(void *pcrat_image,amdgpu_amdkfd_get_cu_info (kdev->adev, &cu_info); cu->num_simd_per_cu = cu_info.simd_per_cu; - cu->num_simd_cores = cu_info.simd_per_cu * cu_info.cu_active_number; + cu->num_simd_cores = cu_info.simd_per_cu * + (cu_info.cu_active_number / kdev->kfd->num_nodes); cu->max_waves_simd = cu_info.max_waves_per_simd; cu->wave_front_size = cu_info.wave_front_size;
drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c +5 -3
@@ -104,11 +104,13 @@ void mqd_symmetrically_map_cu_mask(struct mqd_manager *mm,bool wgp_mode_req =KFD_GC_VERSION (mm->dev) >=IP_VERSION (10 ,0 ,0 );uint32_t en_mask = wgp_mode_req ?0x3 :0x1 ;int i, se, sh, cu, cu_bitmap_sh_mul, inc = wgp_mode_req ?2 :1 ; +uint32_t cu_active_per_node;amdgpu_amdkfd_get_cu_info (mm->dev->adev, &cu_info); -if (cu_mask_count > cu_info.cu_active_number) - cu_mask_count = cu_info.cu_active_number; + cu_active_per_node = cu_info.cu_active_number / mm->dev->kfd->num_nodes; +if (cu_mask_count > cu_active_per_node) + cu_mask_count = cu_active_per_node;/* Exceeding these bounds corrupts the stack and indicates a coding error. * Returning with no CU's enabled will hang the queue, which should be
@@ -141,7 +143,7 @@ void mqd_symmetrically_map_cu_mask(struct mqd_manager *mm,for (se =0 ; se < cu_info.num_shader_engines; se++)for (sh =0 ; sh < cu_info.num_shader_arrays_per_engine; sh++) cu_per_sh[se][sh] =hweight32 ( - cu_info.cu_bitmap[se %4 ][sh + (se /4 ) * cu_bitmap_sh_mul]); + cu_info.cu_bitmap[0 ][se %4 ][sh + (se /4 ) * cu_bitmap_sh_mul]);/* Symmetrically map cu_mask to all SEs & SHs: * se_mask programs up to 2 SH in the upper and lower 16 bits.
drivers/gpu/drm/amd/amdkfd/kfd_topology.c +5 -6
@@ -450,8 +450,7 @@ static ssize_t node_show(struct kobject *kobj, struct attribute *attr,sysfs_show_32bit_prop (buffer, offs,"cpu_cores_count" , dev->node_props.cpu_cores_count);sysfs_show_32bit_prop (buffer, offs,"simd_count" , - dev->gpu ? (dev->node_props.simd_count * -NUM_XCC (dev->gpu->xcc_mask)) :0 ); + dev->gpu ? dev->node_props.simd_count :0 );sysfs_show_32bit_prop (buffer, offs,"mem_banks_count" , dev->node_props.mem_banks_count); sysfs_show_32bit_prop(buffer, offs, "caches_count",
@@ -1658,7 +1657,7 @@ static int fill_in_l2_l3_pcache(struct kfd_cache_properties **props_ext,int i, j, k;struct kfd_cache_properties *pcache =NULL ; - cu_sibling_map_mask = cu_info->cu_bitmap[0 ][0 ]; + cu_sibling_map_mask = cu_info->cu_bitmap[0 ][0 ][0 ]; cu_sibling_map_mask &= ((1 << pcache_info[cache_type].num_cu_shared) -1 ); first_active_cu =ffs (cu_sibling_map_mask);
@@ -1701,7 +1700,7 @@ static int fill_in_l2_l3_pcache(struct kfd_cache_properties **props_ext, pcache->sibling_map[k+3 ] = (uint8_t )((cu_sibling_map_mask >>24 ) &0xFF ); k +=4 ; - cu_sibling_map_mask = cu_info->cu_bitmap[i %4 ][j + i /4 ]; + cu_sibling_map_mask = cu_info->cu_bitmap[0 ][i %4 ][j + i /4 ]; cu_sibling_map_mask &= ((1 << pcache_info[cache_type].num_cu_shared) -1 ); } }
@@ -1762,8 +1761,8 @@ static void kfd_fill_cache_non_crat_info(struct kfd_topology_device *dev, structfor (k =0 ; k < pcu_info->num_cu_per_sh; k += pcache_info[ct].num_cu_shared) { ret =fill_in_l1_pcache (&props_ext, pcache_info, pcu_info, - pcu_info->cu_bitmap[i %4 ][j + i /4 ], ct, - cu_processor_id, k); + pcu_info->cu_bitmap[0 ][i %4 ][j + i /4 ], ct, + cu_processor_id, k);if (ret <0 )break ;
drivers/gpu/drm/amd/include/kgd_kfd_interface.h +3 -3
@@ -31,12 +31,12 @@#include <linux/types.h> #include <linux/bitmap.h> #include <linux/dma-fence.h> +#include "amdgpu_irq.h" +#include "amdgpu_gfx.h" struct pci_dev ;struct amdgpu_device ; -#define KGD_MAX_QUEUES 128 -struct kfd_dev ;struct kgd_mem ;
@@ -68,7 +68,7 @@ struct kfd_cu_info {uint32_t wave_front_size;uint32_t max_scratch_slots_per_cu;uint32_t lds_size; -uint32_t cu_bitmap[4 ][4 ]; +uint32_t cu_bitmap[AMDGPU_MAX_GC_INSTANCES ][4 ][4 ]; };/* For getting GPU local memory information from KGD */
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 187/321 drm/amdkfd: Update cache info reporting for GFX v9.4.3
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mukul Joshi <[email protected]>
[ Upstream commit 0752e66e91fa86fa5481b04b22053363833ffb85 ]
Update cache info reporting in sysfs to report the correct number of CUs and associated cache information based on different spatial partitioning modes.
--- drivers/gpu/drm/amd/amdkfd/kfd_crat.h | 4 ++ drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 82 +++++++++++++---------- drivers/gpu/drm/amd/amdkfd/kfd_topology.h | 2 +- 3 files changed, 51 insertions(+), 37 deletions(-)
drivers/gpu/drm/amd/amdkfd/kfd_crat.h +4 -0
@@ -79,6 +79,10 @@ struct crat_header {#define CRAT_SUBTYPE_IOLINK_AFFINITY 5#define CRAT_SUBTYPE_MAX 6 +/* +* Do not change the value of CRAT_SIBLINGMAP_SIZE from 32 +* as it breaks the ABI. +*/ #define CRAT_SIBLINGMAP_SIZE 32/*
drivers/gpu/drm/amd/amdkfd/kfd_topology.c +46 -36
120 lines not on this page · raw message
drivers/gpu/drm/amd/amdkfd/kfd_topology.h +1 -1
@@ -86,7 +86,7 @@ struct kfd_mem_properties {struct attribute attr; }; -#define CACHE_SIBLINGMAP_SIZE 64 +#define CACHE_SIBLINGMAP_SIZE 128struct kfd_cache_properties {struct list_head list;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 188/321 drm/amdkfd: Update CU masking for GFX 9.4.3
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mukul Joshi <[email protected]>
[ Upstream commit fc6efed2c728c9c10b058512fc9c1613f870a8e8 ]
The CU mask passed from user-space will change based on different spatial partitioning mode. As a result, update CU masking code for GFX9.4.3 to work for all partitioning modes.
--- drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c | 28 ++++++++--- drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.h | 2 +- .../gpu/drm/amd/amdkfd/kfd_mqd_manager_cik.c | 2 +- .../gpu/drm/amd/amdkfd/kfd_mqd_manager_v10.c | 2 +- .../gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c | 2 +- .../gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c | 46 ++++++++++++------- .../gpu/drm/amd/amdkfd/kfd_mqd_manager_vi.c | 2 +- 7 files changed, 56 insertions(+), 28 deletions(-)
drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c +22 -6
@@ -97,14 +97,16 @@ void free_mqd_hiq_sdma(struct mqd_manager *mm, void *mqd,void mqd_symmetrically_map_cu_mask (struct mqd_manager *mm,const uint32_t *cu_mask,uint32_t cu_mask_count, -uint32_t *se_mask) +uint32_t *se_mask,uint32_t inst) {struct kfd_cu_info cu_info;uint32_t cu_per_sh[KFD_MAX_NUM_SE ][KFD_MAX_NUM_SH_PER_SE ] = {0 };bool wgp_mode_req =KFD_GC_VERSION (mm->dev) >=IP_VERSION (10 ,0 ,0 );uint32_t en_mask = wgp_mode_req ?0x3 :0x1 ; -int i, se, sh, cu, cu_bitmap_sh_mul, inc = wgp_mode_req ?2 :1 ; +int i, se, sh, cu, cu_bitmap_sh_mul, cu_inc = wgp_mode_req ?2 :1 ;uint32_t cu_active_per_node; +int inc = cu_inc *NUM_XCC (mm->dev->xcc_mask); +int xcc_inst = inst +ffs (mm->dev->xcc_mask) -1 ;amdgpu_amdkfd_get_cu_info (mm->dev->adev, &cu_info);
@@ -143,7 +145,8 @@ void mqd_symmetrically_map_cu_mask(struct mqd_manager *mm,for (se =0 ; se < cu_info.num_shader_engines; se++)for (sh =0 ; sh < cu_info.num_shader_arrays_per_engine; sh++) cu_per_sh[se][sh] =hweight32 ( - cu_info.cu_bitmap[0 ][se %4 ][sh + (se /4 ) * cu_bitmap_sh_mul]); + cu_info.cu_bitmap[xcc_inst][se %4 ][sh + (se /4 ) * + cu_bitmap_sh_mul]);/* Symmetrically map cu_mask to all SEs & SHs: * se_mask programs up to 2 SH in the upper and lower 16 bits.
@@ -166,20 +169,33 @@ void mqd_symmetrically_map_cu_mask(struct mqd_manager *mm,* cu_mask[0] bit8 -> se_mask[0] bit1 (SE0,SH0,CU1) * ... * +* For GFX 9.4.3, the following code only looks at a +* subset of the cu_mask corresponding to the inst parameter. +* If we have n XCCs under one GPU node +* cu_mask[0] bit0 -> XCC0 se_mask[0] bit0 (XCC0,SE0,SH0,CU0) +* cu_mask[0] bit1 -> XCC1 se_mask[0] bit0 (XCC1,SE0,SH0,CU0) +* .. +* cu_mask[0] bitn -> XCCn se_mask[0] bit0 (XCCn,SE0,SH0,CU0) +* cu_mask[0] bit n+1 -> XCC0 se_mask[1] bit0 (XCC0,SE1,SH0,CU0) +* +* For example, if there are 6 XCCs under 1 KFD node, this code +* running for each inst, will look at the bits as: +* inst, inst + 6, inst + 12... +* * First ensure all CUs are disabled, then enable user specified CUs. */ for (i =0 ; i < cu_info.num_shader_engines; i++) se_mask[i] =0 ; - i =0 ; -for (cu =0 ; cu <16 ; cu += inc) { + i = inst; +for (cu =0 ; cu <16 ; cu += cu_inc) {for (sh =0 ; sh < cu_info.num_shader_arrays_per_engine; sh++) {for (se =0 ; se < cu_info.num_shader_engines; se++) {if (cu_per_sh[se][sh] > cu) {if (cu_mask[i /32 ] & (en_mask << (i %32 ))) se_mask[se] |= en_mask << (cu + sh *16 ); i += inc; -if (i == cu_mask_count) +if (i >= cu_mask_count)return ; } }
drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.h +1 -1
@@ -138,7 +138,7 @@ void free_mqd_hiq_sdma(struct mqd_manager *mm, void *mqd,void mqd_symmetrically_map_cu_mask (struct mqd_manager *mm,const uint32_t *cu_mask,uint32_t cu_mask_count, -uint32_t *se_mask); +uint32_t *se_mask,uint32_t inst); int kfd_hiq_load_mqd_kiq(struct mqd_manager *mm, void *mqd, uint32_t pipe_id, uint32_t queue_id,
drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_cik.c +1 -1
@@ -52,7 +52,7 @@ static void update_cu_mask(struct mqd_manager *mm, void *mqd,return ;mqd_symmetrically_map_cu_mask (mm, - minfo->cu_mask.ptr, minfo->cu_mask.count, se_mask); + minfo->cu_mask.ptr, minfo->cu_mask.count, se_mask,0 ); m =get_mqd (mqd); m->compute_static_thread_mgmt_se0 = se_mask[0 ];
drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v10.c +1 -1
@@ -52,7 +52,7 @@ static void update_cu_mask(struct mqd_manager *mm, void *mqd,return ;mqd_symmetrically_map_cu_mask (mm, - minfo->cu_mask.ptr, minfo->cu_mask.count, se_mask); + minfo->cu_mask.ptr, minfo->cu_mask.count, se_mask,0 ); m =get_mqd (mqd); m->compute_static_thread_mgmt_se0 = se_mask[0 ];
drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c +1 -1
@@ -71,7 +71,7 @@ static void update_cu_mask(struct mqd_manager *mm, void *mqd, }mqd_symmetrically_map_cu_mask (mm, - minfo->cu_mask.ptr, minfo->cu_mask.count, se_mask); + minfo->cu_mask.ptr, minfo->cu_mask.count, se_mask,0 ); m->compute_static_thread_mgmt_se0 = se_mask[0 ]; m->compute_static_thread_mgmt_se1 = se_mask[1 ];
drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c +29 -17
76 lines not on this page · raw message
drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_vi.c +1 -1
@@ -55,7 +55,7 @@ static void update_cu_mask(struct mqd_manager *mm, void *mqd,return ;mqd_symmetrically_map_cu_mask (mm, - minfo->cu_mask.ptr, minfo->cu_mask.count, se_mask); + minfo->cu_mask.ptr, minfo->cu_mask.count, se_mask,0 ); m =get_mqd (mqd); m->compute_static_thread_mgmt_se0 = se_mask[0 ];
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 189/321 drm/amd/display: Dont check registers, if using AUX BL control
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Swapnil Patel <[email protected]>
[ Upstream commit f5b2c10b57615828b531bb0ae56bd6325a41167e ]
[Why]
Currently the driver looks DCN registers to access if BL is on or not. This check is not valid if we are using AUX based brightness control. This causes driver to not send out "backlight off" command during power off sequence as it already thinks it is off.
[How]
Only check DCN registers if we aren't using AUX based brightness control.
--- drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c +3 -1
@@ -964,7 +964,9 @@ void dce110_edp_backlight_control(return ; } -if (link->panel_cntl) { +if (link->panel_cntl && !(link->dpcd_sink_ext_caps.bits.oled || + link->dpcd_sink_ext_caps.bits.hdr_aux_backlight_control ==1 || + link->dpcd_sink_ext_caps.bits.sdr_aux_backlight_control ==1 )) {bool is_backlight_on = link->panel_cntl->funcs->is_panel_backlight_on (link->panel_cntl);if ((enable && is_backlight_on) || (!enable && !is_backlight_on)) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 190/321 drm/amdgpu/soc21: dont remap HDP registers for SR-IOV
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit 1832403cd41ca6b19b24e9d64f79cb08d920ca44 ]
This matches the behavior for soc15 and nv.
--- drivers/gpu/drm/amd/amdgpu/soc21.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/soc21.c +1 -1
@@ -786,7 +786,7 @@ static int soc21_common_hw_init(void *handle)* for the purpose of expose those registers * to process space */ -if (adev->nbio.funcs->remap_hdp_registers) +if (adev->nbio.funcs->remap_hdp_registers && !amdgpu_sriov_vf (adev)) adev->nbio.funcs->remap_hdp_registers (adev);/* enable the doorbell aperture */ adev->nbio.funcs->enable_doorbell_aperture (adev, true);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 191/321 drm/amdgpu/nbio4.3: set proper rmmio_remap.reg_offset for SR-IOV
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit ab43213e7afd08ac68d4282060bacf309e70fd14 ]
Needed for HDP flush to work correctly.
--- drivers/gpu/drm/amd/amdgpu/nbio_v4_3.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/amd/amdgpu/nbio_v4_3.c +3 -0
@@ -345,6 +345,9 @@ static void nbio_v4_3_init_registers(struct amdgpu_device *adev) data &= ~RCC_DEV0_EPF2_STRAP2__STRAP_NO_SOFT_RESET_DEV0_F2_MASK ;WREG32_SOC15 (NBIO ,0 , regRCC_DEV0_EPF2_STRAP2, data); } +if (amdgpu_sriov_vf (adev)) + adev->rmmio_remap.reg_offset =SOC15_REG_OFFSET (NBIO ,0 , + regBIF_BX_DEV0_EPF0_VF0_HDP_MEM_COHERENCY_FLUSH_CNTL) <<2 ; }static u32 nbio_v4_3_get_rom_offset (struct amdgpu_device *adev)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 192/321 drm/amdgpu: fallback to old RAS error message for aqua_vanjaram
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hawking Zhang <[email protected]>
[ Upstream commit ffd6bde302061aeee405ab364403af30210f0b99 ]
So driver doesn't generate incorrect message until the new format is settled down for aqua_vanjaram
--- drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c +4 -2
@@ -1061,7 +1061,8 @@ int amdgpu_ras_query_error_status(struct amdgpu_device *adev, info->ce_count = obj->err_data.ce_count;if (err_data.ce_count) { -if (adev->smuio.funcs && +if (!adev->aid_mask && + adev->smuio.funcs && adev->smuio.funcs->get_socket_id && adev->smuio.funcs->get_die_id) { dev_info(adev->dev, "socket: %d, die: %d "
@@ -1081,7 +1082,8 @@ int amdgpu_ras_query_error_status(struct amdgpu_device *adev, } }if (err_data.ue_count) { -if (adev->smuio.funcs && +if (!adev->aid_mask && + adev->smuio.funcs && adev->smuio.funcs->get_socket_id && adev->smuio.funcs->get_die_id) { dev_info(adev->dev, "socket: %d, die: %d "
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 193/321 drm/amdkfd: Checkpoint and restore queues on GFX11
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Francis <[email protected]>
[ Upstream commit 9296da8c40900b4dae3d973aa22be306e2a77671 ]
The code in kfd_mqd_manager_v11.c to support criu dump and restore of queue state was missing.
Added it; should be equivalent to kfd_mqd_manager_v10.c.
--- .../gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c | 41 +++++++++++++++++++ 1 file changed, 41 insertions(+)
drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c +41 -0
@@ -321,6 +321,43 @@ static int get_wave_state(struct mqd_manager *mm, void *mqd,return 0 ; } +static void checkpoint_mqd (struct mqd_manager *mm,void *mqd,void *mqd_dst,void *ctl_stack_dst) +{ +struct v11_compute_mqd *m; + + m =get_mqd (mqd); + +memcpy (mqd_dst, m,sizeof (struct v11_compute_mqd )); +} + +static void restore_mqd (struct mqd_manager *mm,void **mqd, +struct kfd_mem_obj *mqd_mem_obj,uint64_t *gart_addr, +struct queue_properties *qp, +const void *mqd_src, +const void *ctl_stack_src,const u32 ctl_stack_size) +{ +uint64_t addr; +struct v11_compute_mqd *m; + + m = (struct v11_compute_mqd *) mqd_mem_obj->cpu_ptr; + addr = mqd_mem_obj->gpu_addr; + +memcpy (m, mqd_src,sizeof (*m)); + + *mqd = m; +if (gart_addr) + *gart_addr = addr; + + m->cp_hqd_pq_doorbell_control = + qp->doorbell_off << +CP_HQD_PQ_DOORBELL_CONTROL__DOORBELL_OFFSET__SHIFT ; +pr_debug ("cp_hqd_pq_doorbell_control 0x%x\n" , + m->cp_hqd_pq_doorbell_control); + + qp->is_active =0 ; +} + +static void init_mqd_hiq (struct mqd_manager *mm,void **mqd,struct kfd_mem_obj *mqd_mem_obj,uint64_t *gart_addr,struct queue_properties *q)
@@ -438,6 +475,8 @@ struct mqd_manager *mqd_manager_init_v11(enum KFD_MQD_TYPE type, mqd->mqd_size =sizeof (struct v11_compute_mqd ); mqd->get_wave_state = get_wave_state; mqd->mqd_stride = kfd_mqd_stride; + mqd->checkpoint_mqd = checkpoint_mqd; + mqd->restore_mqd = restore_mqd;#if defined(CONFIG_DEBUG_FS ) mqd->debugfs_show_mqd = debugfs_show_mqd;#endif
@@ -482,6 +521,8 @@ struct mqd_manager *mqd_manager_init_v11(enum KFD_MQD_TYPE type, mqd->update_mqd = update_mqd_sdma; mqd->destroy_mqd = kfd_destroy_mqd_sdma; mqd->is_occupied = kfd_is_occupied_sdma; + mqd->checkpoint_mqd = checkpoint_mqd; + mqd->restore_mqd = restore_mqd; mqd->mqd_size =sizeof (struct v11_sdma_mqd ); mqd->mqd_stride = kfd_mqd_stride;#if defined(CONFIG_DEBUG_FS )
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 194/321 drm/amdgpu: Handle null atom context in VBIOS info ioctl
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Francis <[email protected]>
[ Upstream commit 5e7e82254270c8cf8b107451c5de01cee2f135ae ]
On some APU systems, there is no atom context and so the atom_context struct is null.
Add a check to the VBIOS_INFO branch of amdgpu_info_ioctl to handle this case, returning all zeroes.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +11 -6
@@ -940,12 +940,17 @@ int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)struct atom_context *atom_context; atom_context = adev->mode_info.atom_context; -memcpy (vbios_info.name, atom_context->name,sizeof (atom_context->name)); -memcpy (vbios_info.vbios_pn, atom_context->vbios_pn,sizeof (atom_context->vbios_pn)); - vbios_info.version = atom_context->version; -memcpy (vbios_info.vbios_ver_str, atom_context->vbios_ver_str, -sizeof (atom_context->vbios_ver_str)); -memcpy (vbios_info.date, atom_context->date,sizeof (atom_context->date)); +if (atom_context) { +memcpy (vbios_info.name, atom_context->name, +sizeof (atom_context->name)); +memcpy (vbios_info.vbios_pn, atom_context->vbios_pn, +sizeof (atom_context->vbios_pn)); + vbios_info.version = atom_context->version; +memcpy (vbios_info.vbios_ver_str, atom_context->vbios_ver_str, +sizeof (atom_context->vbios_ver_str)); +memcpy (vbios_info.date, atom_context->date, +sizeof (atom_context->date)); + }return copy_to_user (out, &vbios_info,min ((size_t )size,sizeof (vbios_info))) ? -EFAULT :0 ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 195/321 objtool: Fix _THIS_IP_ detection for cold functions
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <[email protected]>
[ Upstream commit 72178d5d1a38dd185d1db15f177f2d122ef10d9b ]
Cold functions and their non-cold counterparts can use _THIS_IP_ to reference each other. Don't warn about !ENDBR in that case.
Note that for GCC this is currently irrelevant in light of the following commit
c27cd083cfb9 ("Compiler attributes: GCC cold function alignment workarounds")
which disabled cold functions in the kernel. However this may still be possible with Clang.
Fixes several warnings like the following:
drivers/scsi/bnx2i/bnx2i.prelink.o: warning: objtool: bnx2i_hw_ep_disconnect+0x19d: relocation to !ENDBR: bnx2i_hw_ep_disconnect.cold+0x0 drivers/net/ipvlan/ipvlan.prelink.o: warning: objtool: ipvlan_addr4_event.cold+0x28: relocation to !ENDBR: ipvlan_addr4_event+0xda drivers/net/ipvlan/ipvlan.prelink.o: warning: objtool: ipvlan_addr6_event.cold+0x26: relocation to !ENDBR: ipvlan_addr6_event+0xb7 drivers/net/ethernet/broadcom/tg3.prelink.o: warning: objtool: tg3_set_ringparam.cold+0x17: relocation to !ENDBR: tg3_set_ringparam+0x115 drivers/net/ethernet/broadcom/tg3.prelink.o: warning: objtool: tg3_self_test.cold+0x17: relocation to !ENDBR: tg3_self_test+0x2e1 drivers/target/iscsi/cxgbit/cxgbit.prelink.o: warning: objtool: __cxgbit_free_conn.cold+0x24: relocation to !ENDBR: __cxgbit_free_conn+0xfb net/can/can.prelink.o: warning: objtool: can_rx_unregister.cold+0x2c: relocation to !ENDBR: can_rx_unregister+0x11b drivers/net/ethernet/qlogic/qed/qed.prelink.o: warning: objtool: qed_spq_post+0xc0: relocation to !ENDBR: qed_spq_post.cold+0x9a drivers/net/ethernet/qlogic/qed/qed.prelink.o: warning: objtool: qed_iwarp_ll2_comp_syn_pkt.cold+0x12f: relocation to !ENDBR: qed_iwarp_ll2_comp_syn_pkt+0x34b net/tipc/tipc.prelink.o: warning: objtool: tipc_nametbl_publish.cold+0x21: relocation to !ENDBR: tipc_nametbl_publish+0xa6
--- tools/objtool/check.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
tools/objtool/check.c +2 -1
@@ -4333,7 +4333,8 @@ static int validate_ibt_insn(struct objtool_file *file, struct instruction *insncontinue ; } -if (insn_func (dest) &&insn_func (dest) ==insn_func (insn)) { +if (insn_func (dest) &&insn_func (insn) && +insn_func (dest)->pfunc ==insn_func (insn)->pfunc) {/* * Anything from->to self is either _THIS_IP_ or * IRET-to-self.
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 196/321 nvme-pci: do not set the NUMA node of device if it has none
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pratyush Yadav <[email protected]>
[ Upstream commit dad651b2a44eb6b201738f810254279dca29d30d ]
If a device has no NUMA node information associated with it, the driver puts the device in node first_memory_node (say node 0). Not having a NUMA node and being associated with node 0 are completely different things and it makes little sense to mix the two.
--- drivers/nvme/host/pci.c | 3 --- 1 file changed, 3 deletions(-)
drivers/nvme/host/pci.c +0 -3
@@ -2916,9 +2916,6 @@ static struct nvme_dev *nvme_pci_alloc_dev(struct pci_dev *pdev,struct nvme_dev *dev;int ret = -ENOMEM ; -if (node ==NUMA_NO_NODE ) -set_dev_node (&pdev->dev, first_memory_node); - dev =kzalloc_node (sizeof (*dev),GFP_KERNEL , node);if (!dev)return ERR_PTR (-ENOMEM );
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 197/321 riscv: errata: fix T-Head dcache.cva encoding
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Icenowy Zheng <[email protected]>
[ Upstream commit 8eb8fe67e2c84324398f5983c41b4f831d0705b3 ]
The dcache.cva encoding shown in the comments are wrong, it's for dcache.cval1 (which is restricted to L1) instead.
Fix this in the comment and in the hardcoded instruction.
--- arch/riscv/include/asm/errata_list.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/riscv/include/asm/errata_list.h +2 -2
@@ -100,7 +100,7 @@ asm volatile(ALTERNATIVE( \* | 31 - 25 | 24 - 20 | 19 - 15 | 14 - 12 | 11 - 7 | 6 - 0 | * 0000001 01001 rs1 000 00000 0001011 * dcache.cva rs1 (clean, virtual address) -* 0000001 00100 rs1 000 00000 0001011 +* 0000001 00101 rs1 000 00000 0001011 * * dcache.cipa rs1 (clean then invalidate, physical address) * | 31 - 25 | 24 - 20 | 19 - 15 | 14 - 12 | 11 - 7 | 6 - 0 |
@@ -113,7 +113,7 @@ asm volatile(ALTERNATIVE( \* 0000000 11001 00000 000 00000 0001011 */ #define THEAD_inval_A0 ".long 0x0265000b" -#define THEAD_clean_A0 ".long 0x0245000b" +#define THEAD_clean_A0 ".long 0x0255000b"#define THEAD_flush_A0 ".long 0x0275000b"#define THEAD_SYNC_S ".long 0x0190000b"
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 198/321 scsi: pm80xx: Use phy-specific SAS address when sending PHY_START command
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Grzedzicki <[email protected]>
[ Upstream commit 71996bb835aed58c7ec4967be1d05190a27339ec ]
Some cards have more than one SAS address. Using an incorrect address causes communication issues with some devices like expanders.
--- drivers/scsi/pm8001/pm8001_hwi.c | 2 +- drivers/scsi/pm8001/pm80xx_hwi.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/scsi/pm8001/pm8001_hwi.c +1 -1
@@ -4180,7 +4180,7 @@ pm8001_chip_phy_start_req(struct pm8001_hba_info *pm8001_ha, u8 phy_id) payload.sas_identify.dev_type =SAS_END_DEVICE ; payload.sas_identify.initiator_bits =SAS_PROTOCOL_ALL ;memcpy (payload.sas_identify.sas_addr, - pm8001_ha->sas_addr,SAS_ADDR_SIZE ); + &pm8001_ha->phy[phy_id].dev_sas_addr,SAS_ADDR_SIZE ); payload.sas_identify.phy_id = phy_id; return pm8001_mpi_build_cmd(pm8001_ha, 0, opcode, &payload,
drivers/scsi/pm8001/pm80xx_hwi.c +1 -1
@@ -4676,7 +4676,7 @@ pm80xx_chip_phy_start_req(struct pm8001_hba_info *pm8001_ha, u8 phy_id) payload.sas_identify.dev_type =SAS_END_DEVICE ; payload.sas_identify.initiator_bits =SAS_PROTOCOL_ALL ;memcpy (payload.sas_identify.sas_addr, - &pm8001_ha->sas_addr,SAS_ADDR_SIZE ); + &pm8001_ha->phy[phy_id].dev_sas_addr,SAS_ADDR_SIZE ); payload.sas_identify.phy_id = phy_id; return pm8001_mpi_build_cmd(pm8001_ha, 0, opcode, &payload,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 199/321 scsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Grzedzicki <[email protected]>
[ Upstream commit c13e7331745852d0dd7c35eabbe181cbd5b01172 ]
Tags allocated for OPC_INB_SET_CONTROLLER_CONFIG command need to be freed when we receive the response.
--- drivers/scsi/pm8001/pm80xx_hwi.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/scsi/pm8001/pm80xx_hwi.c +2 -0
@@ -3671,10 +3671,12 @@ static int mpi_set_controller_config_resp(struct pm8001_hba_info *pm8001_ha, (struct set_ctrl_cfg_resp *)(piomb +4 );u32 status =le32_to_cpu (pPayload->status);u32 err_qlfr_pgcd =le32_to_cpu (pPayload->err_qlfr_pgcd); +u32 tag =le32_to_cpu (pPayload->tag);pm8001_dbg (pm8001_ha,MSG ,"SET CONTROLLER RESP: status 0x%x qlfr_pgcd 0x%x\n" , status, err_qlfr_pgcd); +pm8001_tag_free (pm8001_ha, tag);return 0 ; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 200/321 smb3: correct places where ENOTSUPP is used instead of preferred EOPNOTSUPP
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steve French <[email protected]>
[ Upstream commit ebc3d4e44a7e05457825e03d0560153687265523 ]
checkpatch flagged a few places with:
WARNING: ENOTSUPP is not a SUSV4 error code, prefer EOPNOTSUPP
Also fixed minor typo
--- fs/smb/client/inode.c | 2 +- fs/smb/client/smb2ops.c | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-)
fs/smb/client/inode.c +1 -1
@@ -2610,7 +2610,7 @@ int cifs_fiemap(struct inode *inode, struct fiemap_extent_info *fei, u64 start, }cifsFileInfo_put (cfile); -return -ENOTSUPP ; +return -EOPNOTSUPP ; }int cifs_truncate_page (struct address_space *mapping,loff_t from)
fs/smb/client/smb2ops.c +3 -3
@@ -297,7 +297,7 @@ smb2_adjust_credits(struct TCP_Server_Info *server,cifs_server_dbg (VFS ,"request has less credits (%d) than required (%d)" , credits->value, new_val); -return -ENOTSUPP ; +return -EOPNOTSUPP ; }spin_lock (&server->req_lock);
@@ -1159,7 +1159,7 @@ smb2_set_ea(const unsigned int xid, struct cifs_tcon *tcon,/* Use a fudge factor of 256 bytes in case we collide * with a different set_EAs command. */ -if (CIFSMaxBufSize -MAX_SMB2_CREATE_RESPONSE_SIZE - +if (CIFSMaxBufSize -MAX_SMB2_CREATE_RESPONSE_SIZE -MAX_SMB2_CLOSE_RESPONSE_SIZE -256 < used_len + ea_name_len + ea_value_len +1 ) { rc = -ENOSPC ;
@@ -4716,7 +4716,7 @@ handle_read_data(struct TCP_Server_Info *server, struct mid_q_entry *mid,if (shdr->Command !=SMB2_READ ) {cifs_server_dbg (VFS ,"only big read responses are supported\n" ); -return -ENOTSUPP ; +return -EOPNOTSUPP ; } if (server->ops->is_session_expired &&
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 201/321 ata: libata-eh: do not clear ATA_PFLAG_EH_PENDING in ata_eh_reset()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <[email protected]>
[ Upstream commit 80cc944eca4f0baa9c381d0706f3160e491437f2 ]
ata_scsi_port_error_handler() starts off by clearing ATA_PFLAG_EH_PENDING, before calling ap->ops->error_handler() (without holding the ap->lock).
If an error IRQ is received while ap->ops->error_handler() is running, the irq handler will set ATA_PFLAG_EH_PENDING.
Once ap->ops->error_handler() returns, ata_scsi_port_error_handler() checks if ATA_PFLAG_EH_PENDING is set, and if it is, another iteration of ATA EH is performed.
The problem is that ATA_PFLAG_EH_PENDING is not only cleared by ata_scsi_port_error_handler(), it is also cleared by ata_eh_reset().
ata_eh_reset() is called by ap->ops->error_handler(). This additional clearing done by ata_eh_reset() breaks the whole retry logic in ata_scsi_port_error_handler(). Thus, if an error IRQ is received while ap->ops->error_handler() is running, the port will currently remain frozen and will never get re-enabled.
The additional clearing in ata_eh_reset() was introduced in commit 1e641060c4b5 ("libata: clear eh_info on reset completion").
Looking at the original error report:
https://marc.info/?l=linux-ide&m=124765325828495&w=2
We can see the following happening:
[ 1.074659] ata3: XXX port freeze [ 1.074700] ata3: XXX hardresetting link, stopping engine [ 1.074746] ata3: XXX flipping SControl
[ 1.411471] ata3: XXX irq_stat=400040 CONN|PHY [ 1.411475] ata3: XXX port freeze
[ 1.420049] ata3: XXX starting engine [ 1.420096] ata3: XXX rc=0, class=1 [ 1.420142] ata3: XXX clearing IRQs for thawing [ 1.420188] ata3: XXX port thawed [ 1.420234] ata3: SATA link up 3.0 Gbps (SStatus 123 SControl 300)
We are not supposed to be able to receive an error IRQ while the port is frozen (PxIE is set to 0, i.e. all IRQs for the port are disabled).
AHCI 1.3.1 section 10.7.1.1 First Tier (IS Register) states:
"Each bit location can be thought of as reporting a '1' if the virtual "interrupt line" for that port is indicating it wishes to generate an interrupt. That is, if a port has one or more interrupt status bit set, and the enables for those status bits are set, then this bit shall be set."
Additionally, AHCI state P:ComInit clearly shows that the state machine will only jump to P:ComInitSetIS (which sets IS.IPS(x) to '1'), if PxIE.PCE is set to '1'. In our case, PxIE is set to 0, so IS.IPS(x) won't get set.
So IS.IPS(x) only gets set if PxIS and PxIE is set.
AHCI 1.3.1 section 10.7.1.1 First Tier (IS Register) also states:
"The bits in this register are read/write clear. It is set by the level of the virtual interrupt line being a set, and cleared by a write of '1' from the software."
So if IS.IPS(x) is set, you need to explicitly clear it by writing a 1 to IS.IPS(x) for that port.
Since PxIE is cleared, the only way to get an interrupt while the port is frozen, is if IS.IPS(x) is set, and the only way IS.IPS(x) can be set when the port is frozen, is if it was set before the port was frozen.
However, since commit 737dd811a3db ("ata: libahci: clear pending interrupt status"), we clear both PxIS and IS.IPS(x) after freezing the port, but before the COMRESET, so the problem that commit 1e641060c4b5 ("libata:
clear eh_info on reset completion") fixed can no longer happen.
Thus, revert commit 1e641060c4b5 ("libata: clear eh_info on reset completion"), so that the retry logic in ata_scsi_port_error_handler() works once again. (The retry logic is still needed, since we can still get an error IRQ _after_ the port has been thawed, but before ata_scsi_port_error_handler() takes the ap->lock in order to check if ATA_PFLAG_EH_PENDING is set.)
--- drivers/ata/libata-eh.c | 13 +++---------- 1 file changed, 3 insertions(+), 10 deletions(-)
drivers/ata/libata-eh.c +3 -10
@@ -2822,18 +2822,11 @@ int ata_eh_reset(struct ata_link *link, int classify, } } -/* -* Some controllers can't be frozen very well and may set spurious -* error conditions during reset. Clear accumulated error -* information and re-thaw the port if frozen. As reset is the -* final recovery action and we cross check link onlineness against -* device classification later, no hotplug event is lost by this. -*/ +/* clear cached SError */ spin_lock_irqsave (link->ap->lock, flags); -memset (&link->eh_info,0 ,sizeof (link->eh_info)); + link->eh_info.serror =0 ;if (slave) -memset (&slave->eh_info,0 ,sizeof (link->eh_info)); - ap->pflags &= ~ATA_PFLAG_EH_PENDING ; + slave->eh_info.serror =0 ;spin_unlock_irqrestore (link->ap->lock, flags);if (ata_port_is_frozen (ap))
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 202/321 ata: libata-eh: do not thaw the port twice in ata_eh_reset()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <[email protected]>
[ Upstream commit 7a3bc2b3989e05bbaa904a63279049a401491c84 ]
commit 1e641060c4b5 ("libata: clear eh_info on reset completion") added a workaround that broke the retry mechanism in ATA EH.
Tejun himself suggested to remove this workaround when it was identified to cause additional problems:
https://lore.kernel.org/linux-ide/[email protected]/
He even said:
"Hmm... it seems I wasn't thinking straight when I added that work around."
https://lore.kernel.org/linux-ide/[email protected]/
While removing the workaround solved the issue, however, the workaround was kept to avoid "spurious hotplug events during reset", and instead another workaround was added on top of the existing workaround in commit 8c56cacc724c ("libata: fix unexpectedly frozen port after ata_eh_reset()").
Because these IRQs happened when the port was frozen, we know that they were actually a side effect of PxIS and IS.IPS(x) not being cleared before the COMRESET. This is now done in commit 94152042eaa9 ("ata: libahci: clear pending interrupt status"), so these workarounds can now be removed.
Since commit 1e641060c4b5 ("libata: clear eh_info on reset completion") has now been reverted, the ATA EH retry mechanism is functional again, so there is once again no need to thaw the port more than once in ata_eh_reset().
This reverts "the workaround on top of the workaround" introduced in commit 8c56cacc724c ("libata: fix unexpectedly frozen port after ata_eh_reset()").
--- drivers/ata/libata-eh.c | 3 --- 1 file changed, 3 deletions(-)
drivers/ata/libata-eh.c +0 -3
@@ -2829,9 +2829,6 @@ int ata_eh_reset(struct ata_link *link, int classify, slave->eh_info.serror =0 ;spin_unlock_irqrestore (link->ap->lock, flags); -if (ata_port_is_frozen (ap)) -ata_eh_thaw_port (ap); -/* * Make sure onlineness and classification result correspond. * Hotplug could have happened during reset and some
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 203/321 Add DMI ID for MSI Bravo 15 B7ED
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Walt Holman <[email protected]>
[ Upstream commit e616a916fe8431ebd5eb3cf4ac224d143c57083c ]
--- sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ 1 file changed, 7 insertions(+)
sound/soc/amd/yc/acp6x-mach.c +7 -0
@@ -255,6 +255,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { DMI_MATCH(DMI_PRODUCT_NAME, "M6500RC"), } }, + { + .driver_data = &acp6x_card, + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"Micro-Star International Co., Ltd." ), + DMI_MATCH(DMI_PRODUCT_NAME, "Bravo 15 B7ED"), + } + }, { .driver_data = &acp6x_card, .matches = {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 204/321 spi: nxp-fspi: reset the FLSHxCR1 registers
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Han Xu <[email protected]>
[ Upstream commit 18495676f7886e105133f1dc06c1d5e8d5436f32 ]
Reset the FLSHxCR1 registers to default value. ROM may set the register value and it affects the SPI NAND normal functions.
--- drivers/spi/spi-nxp-fspi.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/spi/spi-nxp-fspi.c +7 -0
@@ -1085,6 +1085,13 @@ static int nxp_fspi_default_setup(struct nxp_fspi *f)fspi_writel (f,FSPI_AHBCR_PREF_EN |FSPI_AHBCR_RDADDROPT , base +FSPI_AHBCR ); +/* Reset the FLSHxCR1 registers. */ + reg =FSPI_FLSHXCR1_TCSH (0x3 ) |FSPI_FLSHXCR1_TCSS (0x3 ); +fspi_writel (f, reg, base +FSPI_FLSHA1CR1 ); +fspi_writel (f, reg, base +FSPI_FLSHA2CR1 ); +fspi_writel (f, reg, base +FSPI_FLSHB1CR1 ); +fspi_writel (f, reg, base +FSPI_FLSHB2CR1 ); +/* AHB Read - Set lut sequence ID for all CS. */ fspi_writel (f,SEQID_LUT , base +FSPI_FLSHA1CR2 );fspi_writel (f,SEQID_LUT , base +FSPI_FLSHA2CR2 );
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 205/321 spi: stm32: add a delay before SPI disable
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Valentin Caron <[email protected]>
[ Upstream commit 6de8a70c84ee0586fdde4e671626b9caca6aed74 ]
As explained in errata sheet, in section "2.14.5 Truncation of SPI output signals after EOT event":
On STM32MP1x, EOT interrupt can be thrown before the true end of communication.
So we add a delay of a half period to wait the real end of the transmission.
--- drivers/spi/spi-stm32.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/spi/spi-stm32.c +8 -0
@@ -275,6 +275,7 @@ struct stm32_spi_cfg {* @fifo_size: size of the embedded fifo in bytes * @cur_midi: master inter-data idleness in ns * @cur_speed: speed configured in Hz +* @cur_half_period: time of a half bit in us * @cur_bpw: number of bits in a single SPI data frame * @cur_fthlv: fifo threshold level (data frames in a single data packet) * @cur_comm: SPI communication mode
@@ -302,6 +303,7 @@ struct stm32_spi {unsigned int cur_midi;unsigned int cur_speed; +unsigned int cur_half_period;unsigned int cur_bpw;unsigned int cur_fthlv;unsigned int cur_comm;
@@ -466,6 +468,8 @@ static int stm32_spi_prepare_mbr(struct stm32_spi *spi, u32 speed_hz, spi->cur_speed = spi->clk_rate / (1 << mbrdiv); + spi->cur_half_period =DIV_ROUND_CLOSEST (USEC_PER_SEC ,2 * spi->cur_speed); +return mbrdiv -1 ; }
@@ -707,6 +711,10 @@ static void stm32h7_spi_disable(struct stm32_spi *spi)return ; } +/* Add a delay to make sure that transmission is ended. */ +if (spi->cur_half_period) +udelay (spi->cur_half_period); +if (spi->cur_usedma && spi->dma_tx)dmaengine_terminate_async (spi->dma_tx);if (spi->cur_usedma && spi->dma_rx)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 206/321 ASoC: fsl: imx-pcm-rpmsg: Add SNDRV_PCM_INFO_BATCH flag
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shengjiu Wang <[email protected]>
[ Upstream commit 2f9426905a63be7ccf8cd10109caf1848aa0993a ]
The rpmsg pcm device is a device which should support double buffering.
Found this issue with pipewire. When there is no SNDRV_PCM_INFO_BATCH flag in driver, the pipewire will set headroom to be zero, and because rpmsg pcm device don't support residue report, when the latency setting is small, the "delay" always larger than "target" in alsa-pcm.c, that reading next period data is not scheduled on time.
With SNDRV_PCM_INFO_BATCH flag in driver, the pipewire will select a smaller period size for device, then the task of reading next period data will be scheduled on time.
--- sound/soc/fsl/imx-pcm-rpmsg.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/fsl/imx-pcm-rpmsg.c +1 -0
@@ -19,6 +19,7 @@static struct snd_pcm_hardware imx_rpmsg_pcm_hardware = { .info =SNDRV_PCM_INFO_INTERLEAVED |SNDRV_PCM_INFO_BLOCK_TRANSFER | +SNDRV_PCM_INFO_BATCH |SNDRV_PCM_INFO_MMAP |SNDRV_PCM_INFO_MMAP_VALID | SNDRV_PCM_INFO_NO_PERIOD_WAKEUP |
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 207/321 spi: intel-pci: Add support for Granite Rapids SPI serial flash
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mika Westerberg <[email protected]>
[ Upstream commit 9855d60cfc720ff32355484c119acafd3c4dc806 ]
Intel Granite Rapids has a flash controller that is compatible with the other Cannon Lake derivatives. Add Granite Rapids PCI ID to the driver list of supported devices.
--- drivers/spi/spi-intel-pci.c | 1 + 1 file changed, 1 insertion(+)
drivers/spi/spi-intel-pci.c +1 -0
@@ -72,6 +72,7 @@ static const struct pci_device_id intel_spi_pci_ids[] = { { PCI_VDEVICE(INTEL, 0x4da4), (unsigned long)&bxt_info }, { PCI_VDEVICE(INTEL, 0x51a4), (unsigned long)&cnl_info }, { PCI_VDEVICE(INTEL, 0x54a4), (unsigned long)&cnl_info }, + { PCI_VDEVICE(INTEL, 0x5794), (unsigned long)&cnl_info }, { PCI_VDEVICE(INTEL, 0x7a24), (unsigned long)&cnl_info }, { PCI_VDEVICE(INTEL, 0x7aa4), (unsigned long)&cnl_info }, { PCI_VDEVICE(INTEL, 0x7e23), (unsigned long)&cnl_info },
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 208/321 bpf: Ensure unit_size is matched with slab cache object size
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hou Tao <[email protected]>
[ Upstream commit c930472552022bd09aab3cd946ba3f243070d5c7 ]
Add extra check in bpf_mem_alloc_init() to ensure the unit_size of bpf_mem_cache is matched with the object_size of underlying slab cache. If these two sizes are unmatched, print a warning once and return -EINVAL in bpf_mem_alloc_init(), so the mismatch can be found early and the potential issue can be prevented.
--- kernel/bpf/memalloc.c | 33 +++++++++++++++++++++++++++++++-- 1 file changed, 31 insertions(+), 2 deletions(-)
kernel/bpf/memalloc.c +31 -2
@@ -370,6 +370,24 @@ static void prefill_mem_cache(struct bpf_mem_cache *c, int cpu)alloc_bulk (c, c->unit_size <=256 ?4 :1 ,cpu_to_node (cpu)); } +static int check_obj_size (struct bpf_mem_cache *c,unsigned int idx) +{ +struct llist_node *first; +unsigned int obj_size; + + first = c->free_llist.first; +if (!first) +return 0 ; + + obj_size =ksize (first); +if (obj_size != c->unit_size) { +WARN_ONCE (1 ,"bpf_mem_cache[%u]: unexpected object size %u, expect %u\n" , + idx, obj_size, c->unit_size); +return -EINVAL ; + } +return 0 ; +} +/* When size != 0 bpf_mem_cache for each cpu. * This is typical bpf hash map use case when all elements have equal size. *
@@ -380,10 +398,10 @@ static void prefill_mem_cache(struct bpf_mem_cache *c, int cpu)int bpf_mem_alloc_init (struct bpf_mem_alloc *ma,int size,bool percpu) {static u16 sizes[NUM_CACHES ] = {96 ,192 ,16 ,32 ,64 ,128 ,256 ,512 ,1024 ,2048 ,4096 }; +int cpu, i, err, unit_size, percpu_size =0 ;struct bpf_mem_caches *cc,__percpu *pcc;struct bpf_mem_cache *c,__percpu *pc;struct obj_cgroup *objcg =NULL ; -int cpu, i, unit_size, percpu_size =0 ;if (size) { pc =__alloc_percpu_gfp (sizeof (*pc),8 ,GFP_KERNEL );
@@ -419,6 +437,7 @@ int bpf_mem_alloc_init(struct bpf_mem_alloc *ma, int size, bool percpu) pcc =__alloc_percpu_gfp (sizeof (*cc),8 ,GFP_KERNEL );if (!pcc)return -ENOMEM ; + err =0 ;#ifdef CONFIG_MEMCG_KMEM objcg =get_obj_cgroup_from_current ();#endif
@@ -429,10 +448,20 @@ int bpf_mem_alloc_init(struct bpf_mem_alloc *ma, int size, bool percpu) c->unit_size = sizes[i]; c->objcg = objcg;prefill_mem_cache (c, cpu); + err =check_obj_size (c, i); +if (err) + goto out; } } + +out: ma->caches = pcc; -return 0 ; +/* refill_work is either zeroed or initialized, so it is safe to +* call irq_work_sync(). +*/ +if (err) +bpf_mem_alloc_destroy (ma); +return err; }static void drain_mem_cache (struct bpf_mem_cache *c)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 209/321 bpf: Clarify error expectations from bpf_clone_redirect
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanislav Fomichev <[email protected]>
[ Upstream commit 7cb779a6867fea00b4209bcf6de2f178a743247d ]
Commit 151e887d8ff9 ("veth: Fixing transmit return status for dropped packets") exposed the fact that bpf_clone_redirect is capable of returning raw NET_XMIT_XXX return codes.
This is in the conflict with its UAPI doc which says the following:
"0 on success, or a negative error in case of failure."
Update the UAPI to reflect the fact that bpf_clone_redirect can return positive error numbers, but don't explicitly define their meaning.
--- include/uapi/linux/bpf.h | 4 +++- tools/include/uapi/linux/bpf.h | 4 +++- 2 files changed, 6 insertions(+), 2 deletions(-)
include/uapi/linux/bpf.h +3 -1
@@ -1897,7 +1897,9 @@ union bpf_attr {* performed again, if the helper is used in combination with * direct packet access. * Return -* 0 on success, or a negative error in case of failure. +* 0 on success, or a negative error in case of failure. Positive +* error indicates a potential drop or congestion in the target +* device. The particular positive error codes are not defined. * * u64 bpf_get_current_pid_tgid(void) * Description
tools/include/uapi/linux/bpf.h +3 -1
@@ -1897,7 +1897,9 @@ union bpf_attr {* performed again, if the helper is used in combination with * direct packet access. * Return -* 0 on success, or a negative error in case of failure. +* 0 on success, or a negative error in case of failure. Positive +* error indicates a potential drop or congestion in the target +* device. The particular positive error codes are not defined. * * u64 bpf_get_current_pid_tgid(void) * Description
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 210/321 ASoC: rt5640: Only cancel jack-detect work on suspend if active
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 8fc7cc507d61fc655172836c74fb7fcc8b7a978b ]
If jack-detection is not used; or has already been disabled then there is no need to call rt5640_cancel_work().
Move the rt5640_cancel_work() inside the "if (rt5640->jack) {}" block, grouping it together with the disabling of the IRQ which queues the work in the first place.
This also makes suspend() symetrical with resume() which re-queues the work in an "if (rt5640->jack) {}" block.
--- sound/soc/codecs/rt5640.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/rt5640.c +1 -1
@@ -2802,9 +2802,9 @@ static int rt5640_suspend(struct snd_soc_component *component)if (rt5640->jack) {/* disable jack interrupts during system suspend */ disable_irq (rt5640->irq); +rt5640_cancel_work (rt5640); } -rt5640_cancel_work (rt5640);snd_soc_component_force_bias_level (component,SND_SOC_BIAS_OFF );rt5640_reset (component);regcache_cache_only (rt5640->regmap, true);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 211/321 ALSA: hda: intel-sdw-acpi: Use u8 type for link index
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <[email protected]>
[ Upstream commit 485ddd519fbd89a9d9ac4b02be489e03cbbeebba ]
Use consistently u8 for sdw link index. The id is limited to 4, u8 is adequate in size to store it.
This change will also fixes the following compiler warning/error (W=1):
sound/hda/intel-sdw-acpi.c: In function ‘sdw_intel_acpi_scan’:sound/hda/intel-sdw-acpi.c:34:35: error: ‘-subproperties’ directive output may be truncated writing 14 bytes into a region of size between 7 and 17 [-Werror=format-truncation=]
34 | "mipi-sdw-link-%d-subproperties", i);
| ^~~~~~~~~~~~~~In function ‘is_link_enabled’,
inlined from ‘sdw_intel_scan_controller’ at sound/hda/intel-sdw-acpi.c:106:8,
inlined from ‘sdw_intel_acpi_scan’ at sound/hda/intel-sdw-acpi.c:180:9:sound/hda/intel-sdw-acpi.c:33:9: note: ‘snprintf’ output between 30 and 40 bytes into a destination of size 32
33 | snprintf(name, sizeof(name),
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
34 | "mipi-sdw-link-%d-subproperties", i);
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~cc1: all warnings being treated as errors
The warnings got brought to light by a recent patch upstream:
commit 6d4ab2e97dcf ("extrawarn: enable format and stringop overflow warnings in W=1")
--- sound/hda/intel-sdw-acpi.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
sound/hda/intel-sdw-acpi.c +4 -4
@@ -23,7 +23,7 @@ static int ctrl_link_mask;module_param_named (sdw_link_mask, ctrl_link_mask, int,0444 );MODULE_PARM_DESC (sdw_link_mask,"Intel link mask (one bit per link)" ); -static bool is_link_enabled (struct fwnode_handle *fw_node,int i) +static bool is_link_enabled (struct fwnode_handle *fw_node,u8 idx) {struct fwnode_handle *link;char name[32 ];
@@ -31,7 +31,7 @@ static bool is_link_enabled(struct fwnode_handle *fw_node, int i)/* Find master handle */ snprintf (name,sizeof (name), -"mipi-sdw-link-%d-subproperties" , i); +"mipi-sdw-link-%hhu-subproperties" , idx); link =fwnode_get_named_child_node (fw_node, name);if (!link)
@@ -51,8 +51,8 @@ static int sdw_intel_scan_controller(struct sdw_intel_acpi_info *info) {struct acpi_device *adev =acpi_fetch_acpi_dev (info->handle); -int ret, i; -u8 count; +u8 count, i; +int ret;if (!adev)return -EINVAL ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 212/321 ASoC: cs42l42: Ensure a reset pulse meets minimum pulse width.
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Fitzgerald <[email protected]>
[ Upstream commit 41dac81b56c82c51a6d00fda5f3af7691ffee2d7 ]
The CS42L42 can accept very short reset pulses of a few microseconds but there's no reason to force a very short pulse.
Allow a wide range for the usleep_range() so it can be relaxed about the choice of timing source.
--- sound/soc/codecs/cs42l42.c | 4 ++++ 1 file changed, 4 insertions(+)
sound/soc/codecs/cs42l42.c +4 -0
@@ -2320,6 +2320,10 @@ int cs42l42_common_probe(struct cs42l42_private *cs42l42,if (cs42l42->reset_gpio) {dev_dbg (cs42l42->dev,"Found reset GPIO\n" ); + +/* Ensure minimum reset pulse width */ +usleep_range (10 ,500 ); +gpiod_set_value_cansleep (cs42l42->reset_gpio,1 ); }usleep_range (CS42L42_BOOT_TIME_US ,CS42L42_BOOT_TIME_US *2 );
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 213/321 ASoC: cs42l42: Dont rely on GPIOD_OUT_LOW to set RESET initially low
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Fitzgerald <[email protected]>
[ Upstream commit a479b44ac0a0ac25cd48e5356200078924d78022 ]
The ACPI setting for a GPIO default state has higher priority than the flag passed to devm_gpiod_get_optional() so ACPI can override the GPIOD_OUT_LOW. Explicitly set the GPIO low when hard resetting.
Although GPIOD_OUT_LOW can't be relied on this doesn't seem like a reason to stop passing it to devm_gpiod_get_optional(). So we still pass it to state our intent, but can deal with it having no effect.
--- sound/soc/codecs/cs42l42.c | 6 ++++++ 1 file changed, 6 insertions(+)
sound/soc/codecs/cs42l42.c +6 -0
@@ -2321,6 +2321,12 @@ int cs42l42_common_probe(struct cs42l42_private *cs42l42,if (cs42l42->reset_gpio) {dev_dbg (cs42l42->dev,"Found reset GPIO\n" ); +/* +* ACPI can override the default GPIO state we requested +* so ensure that we start with RESET low. +*/ +gpiod_set_value_cansleep (cs42l42->reset_gpio,0 ); +/* Ensure minimum reset pulse width */ usleep_range (10 ,500 );
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 214/321 ASoC: cs42l42: Avoid stale SoundWire ATTACH after hard reset
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Fitzgerald <[email protected]>
[ Upstream commit 2d066c6a78654c179f95c9beda1985d4c6befa4e ]
In SoundWire mode leave hard RESET asserted when exiting probe, and wait for an UNATTACHED notification before deasserting RESET.
If the boot state of the reset GPIO was deasserted it is possible that the SoundWire core had already enumerated the CS42L42 before cs42l42_sdw_probe() is called. When cs42l42_common_probe() hard resets the CS42L42 it triggers a race condition:
1) After cs42l42_sdw_probe() returns the thread that called it will call cs42l42_sdw_update_status() to report the last status recorded by the SoundWire core.
2) The SoundWire bus master will see a PING with the CS42L42 now reporting as unenumerated and will trigger the core SoundWire code to start enumerating CS42L42.
These two threads are racing against each other. If (1) happens before (2) a stale ATTACHED notification will be reported to the cs42l42 driver when in fact the status of cs42l42 is now unattached.
To avoid this race condition:
- Leave RESET asserted on exit from cs42l42_sdw_probe(). This ensures that an UNATTACHED notification must be sent to the cs42l42 driver. If cs42l42 was already enumerated it will be seen to drop off the bus, causing an UNATTACH notification. If it was never enumerated the status is already UNATTACHED and this will be reported by thread (1).
- When the UNATTACH notification is received, release RESET. This will cause CS42L42 to be enumerated and eventually report an ATTACHED notification.
- The ATTACHED notification is now valid.
--- sound/soc/codecs/cs42l42-sdw.c | 20 ++++++++++++++++++++ sound/soc/codecs/cs42l42.c | 11 ++++++++++- sound/soc/codecs/cs42l42.h | 1 + 3 files changed, 31 insertions(+), 1 deletion(-)
sound/soc/codecs/cs42l42-sdw.c +20 -0
@@ -344,6 +344,16 @@ static int cs42l42_sdw_update_status(struct sdw_slave *peripheral,switch (status) {case SDW_SLAVE_ATTACHED :dev_dbg (cs42l42->dev,"ATTACHED\n" ); + +/* +* The SoundWire core can report stale ATTACH notifications +* if we hard-reset CS42L42 in probe() but it had already been +* enumerated. Reject the ATTACH if we haven't yet seen an +* UNATTACH report for the device being in reset. +*/ +if (cs42l42->sdw_waiting_first_unattach) +break ; +/* * Initialise codec, this only needs to be done once. * When resuming from suspend, resume callback will handle re-init of codec,
@@ -354,6 +364,16 @@ static int cs42l42_sdw_update_status(struct sdw_slave *peripheral,break ;case SDW_SLAVE_UNATTACHED :dev_dbg (cs42l42->dev,"UNATTACHED\n" ); + +if (cs42l42->sdw_waiting_first_unattach) { +/* +* SoundWire core has seen that CS42L42 is not on +* the bus so release RESET and wait for ATTACH. +*/ + cs42l42->sdw_waiting_first_unattach = false; +gpiod_set_value_cansleep (cs42l42->reset_gpio,1 ); + } +break ;default :break ;
sound/soc/codecs/cs42l42.c +10 -1
@@ -2330,7 +2330,16 @@ int cs42l42_common_probe(struct cs42l42_private *cs42l42,/* Ensure minimum reset pulse width */ usleep_range (10 ,500 ); -gpiod_set_value_cansleep (cs42l42->reset_gpio,1 ); +/* +* On SoundWire keep the chip in reset until we get an UNATTACH +* notification from the SoundWire core. This acts as a +* synchronization point to reject stale ATTACH notifications +* if the chip was already enumerated before we reset it. +*/ +if (cs42l42->sdw_peripheral) + cs42l42->sdw_waiting_first_unattach = true; +else +gpiod_set_value_cansleep (cs42l42->reset_gpio,1 ); }usleep_range (CS42L42_BOOT_TIME_US ,CS42L42_BOOT_TIME_US *2 );
sound/soc/codecs/cs42l42.h +1 -0
@@ -53,6 +53,7 @@ struct cs42l42_private {u8 stream_use;bool hp_adc_up_pending;bool suspended; +bool sdw_waiting_first_unattach;bool init_done; };
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 215/321 firmware: cirrus: cs_dsp: Only log list of algorithms in debug build
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Fitzgerald <[email protected]>
[ Upstream commit 69343ce91435f222052015c5af86b550391bac85 ]
Change the logging of each algorithm from info level to debug level.
On the original devices supported by this code there were typically only one or two algorithms in a firmware and one or two DSPs so this logging only used a small number of log lines.
However, for the latest devices there could be 30-40 algorithms in a firmware and 8 DSPs being loaded in parallel, so using 300+ lines of log for information that isn't particularly important to have logged.
--- drivers/firmware/cirrus/cs_dsp.c | 34 ++++++++++++++++---------------- 1 file changed, 17 insertions(+), 17 deletions(-)
drivers/firmware/cirrus/cs_dsp.c +17 -17
@@ -1863,15 +1863,15 @@ static int cs_dsp_adsp2_setup_algs(struct cs_dsp *dsp)return PTR_ERR (adsp2_alg);for (i =0 ; i < n_algs; i++) { -cs_dsp_info (dsp, -"%d: ID %x v%d.%d.%d XM@%x YM@%x ZM@%x\n" , - i,be32_to_cpu (adsp2_alg[i].alg.id), - (be32_to_cpu (adsp2_alg[i].alg.ver) &0xff0000 ) >>16 , - (be32_to_cpu (adsp2_alg[i].alg.ver) &0xff00 ) >>8 , -be32_to_cpu (adsp2_alg[i].alg.ver) &0xff , -be32_to_cpu (adsp2_alg[i].xm), -be32_to_cpu (adsp2_alg[i].ym), -be32_to_cpu (adsp2_alg[i].zm)); +cs_dsp_dbg (dsp, +"%d: ID %x v%d.%d.%d XM@%x YM@%x ZM@%x\n" , + i,be32_to_cpu (adsp2_alg[i].alg.id), + (be32_to_cpu (adsp2_alg[i].alg.ver) &0xff0000 ) >>16 , + (be32_to_cpu (adsp2_alg[i].alg.ver) &0xff00 ) >>8 , +be32_to_cpu (adsp2_alg[i].alg.ver) &0xff , +be32_to_cpu (adsp2_alg[i].xm), +be32_to_cpu (adsp2_alg[i].ym), +be32_to_cpu (adsp2_alg[i].zm)); alg_region = cs_dsp_create_region(dsp, WMFW_ADSP2_XM, adsp2_alg[i].alg.id,
@@ -1996,14 +1996,14 @@ static int cs_dsp_halo_setup_algs(struct cs_dsp *dsp)return PTR_ERR (halo_alg);for (i =0 ; i < n_algs; i++) { -cs_dsp_info (dsp, -"%d: ID %x v%d.%d.%d XM@%x YM@%x\n" , - i,be32_to_cpu (halo_alg[i].alg.id), - (be32_to_cpu (halo_alg[i].alg.ver) &0xff0000 ) >>16 , - (be32_to_cpu (halo_alg[i].alg.ver) &0xff00 ) >>8 , -be32_to_cpu (halo_alg[i].alg.ver) &0xff , -be32_to_cpu (halo_alg[i].xm_base), -be32_to_cpu (halo_alg[i].ym_base)); +cs_dsp_dbg (dsp, +"%d: ID %x v%d.%d.%d XM@%x YM@%x\n" , + i,be32_to_cpu (halo_alg[i].alg.id), + (be32_to_cpu (halo_alg[i].alg.ver) &0xff0000 ) >>16 , + (be32_to_cpu (halo_alg[i].alg.ver) &0xff00 ) >>8 , +be32_to_cpu (halo_alg[i].alg.ver) &0xff , +be32_to_cpu (halo_alg[i].xm_base), +be32_to_cpu (halo_alg[i].ym_base)); ret = cs_dsp_halo_create_regions(dsp, halo_alg[i].alg.id, halo_alg[i].alg.ver,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 216/321 ASoC: wm_adsp: Fix missing locking in wm_adsp_[read|write]_ctl()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Fitzgerald <[email protected]>
[ Upstream commit 781118bc2fc1026c8285f83ea7ecab07071a09c4 ]
wm_adsp_read_ctl() and wm_adsp_write_ctl() must hold the cs_dsp pwr_lock mutex when calling cs_dsp_coeff_read_ctrl() and cs_dsp_coeff_write_ctrl().
--- sound/soc/codecs/wm_adsp.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
sound/soc/codecs/wm_adsp.c +11 -2
@@ -687,7 +687,10 @@ int wm_adsp_write_ctl(struct wm_adsp *dsp, const char *name, int type,struct wm_coeff_ctl *ctl;int ret; +mutex_lock (&dsp->cs_dsp.pwr_lock); ret =cs_dsp_coeff_write_ctrl (cs_ctl,0 , buf, len); +mutex_unlock (&dsp->cs_dsp.pwr_lock); +if (ret <0 )return ret;
@@ -703,8 +706,14 @@ EXPORT_SYMBOL_GPL(wm_adsp_write_ctl);int wm_adsp_read_ctl (struct wm_adsp *dsp,const char *name,int type,unsigned int alg,void *buf,size_t len) { -return cs_dsp_coeff_read_ctrl (cs_dsp_get_ctl (&dsp->cs_dsp, name, type, alg), -0 , buf, len); +int ret; + +mutex_lock (&dsp->cs_dsp.pwr_lock); + ret =cs_dsp_coeff_read_ctrl (cs_dsp_get_ctl (&dsp->cs_dsp, name, type, alg), +0 , buf, len); +mutex_unlock (&dsp->cs_dsp.pwr_lock); + +return ret; }EXPORT_SYMBOL_GPL (wm_adsp_read_ctl);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 217/321 memblock tests: fix warning: "__ALIGN_KERNEL" redefined
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Rapoport (IBM) <[email protected]>
[ Upstream commit 5e1bffbdb63baf89f3bf0b6bafb50903432a7434 ]
Building memblock tests produces the following warning:
cc -I. -I../../include -Wall -O2 -fsanitize=address -fsanitize=undefined -D CONFIG_PHYS_ADDR_T_64BIT -c -o main.o main.c
In file included from ../../include/linux/pfn.h:5,
from ./linux/memory_hotplug.h:6,
from ./linux/init.h:7,
from ./linux/memblock.h:11,
from tests/common.h:8,
from tests/basic_api.h:5,
from main.c:2:
../../include/linux/mm.h:14: warning: "__ALIGN_KERNEL" redefined
14 | #define __ALIGN_KERNEL(x, a) __ALIGN_KERNEL_MASK(x, (typeof(x))(a) - 1)
|
In file included from ../../include/linux/mm.h:6,
from ../../include/linux/pfn.h:5,
from ./linux/memory_hotplug.h:6,
from ./linux/init.h:7,
from ./linux/memblock.h:11,
from tests/common.h:8,
from tests/basic_api.h:5,
from main.c:2:
../../include/uapi/linux/const.h:31: note: this is the location of the previous definition
31 | #define __ALIGN_KERNEL(x, a) __ALIGN_KERNEL_MASK(x, (__typeof__(x))(a) - 1)
|Remove definitions of __ALIGN_KERNEL and __ALIGN_KERNEL_MASK from tools/include/linux/mm.h to fix it.
--- tools/include/linux/mm.h | 2 -- 1 file changed, 2 deletions(-)
tools/include/linux/mm.h +0 -2
@@ -11,8 +11,6 @@#define PHYS_ADDR_MAX (~(phys_addr_t)0) -#define __ALIGN_KERNEL (x, a) __ALIGN_KERNEL_MASK(x, (typeof(x))(a) - 1) -#define __ALIGN_KERNEL_MASK (x, mask) (((x) + (mask)) & ~(mask))#define ALIGN (x, a) __ALIGN_KERNEL((x), (a))#define ALIGN_DOWN (x, a) __ALIGN_KERNEL((x) - ((a) - 1), (a))
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 218/321 =?UTF-8?q?memblock=20tests:=20fix=20warning=20=E2=80=98struct=20s?= =?UTF-8?q?eq=5Ffile=E2=80=99=20declared=20inside=20parameter=20list?=
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Rapoport (IBM) <[email protected]>
[ Upstream commit 55122e0130e51eb71f5ec62d10525db0468f28e8 ]
Building memblock tests produces the following warning:
cc -I. -I../../include -Wall -O2 -fsanitize=address -fsanitize=undefined -D CONFIG_PHYS_ADDR_T_64BIT -c -o main.o main.c
In file included from tests/common.h:9,
from tests/basic_api.h:5,
from main.c:2:./linux/memblock.h:601:50: warning: ‘struct seq_file’ declared inside parameter list will not be visible outside of this definition or declaration
601 | static inline void memtest_report_meminfo(struct seq_file *m) { }
| ^~~~~~~~
Add declaration of 'struct seq_file' to tools/include/linux/seq_file.h to fix it.
--- tools/include/linux/seq_file.h | 2 ++ tools/testing/memblock/tests/basic_api.c | 2 +- tools/testing/memblock/tests/common.h | 1 + 3 files changed, 4 insertions(+), 1 deletion(-)
tools/include/linux/seq_file.h +2 -0
@@ -1,4 +1,6 @@#ifndef _TOOLS_INCLUDE_LINUX_SEQ_FILE_H#define _TOOLS_INCLUDE_LINUX_SEQ_FILE_H +struct seq_file ; +#endif /* _TOOLS_INCLUDE_LINUX_SEQ_FILE_H */
tools/testing/memblock/tests/basic_api.c +1 -1
@@ -1,7 +1,7 @@// SPDX-License-Identifier: GPL-2.0-or-later +#include "basic_api.h" #include <string.h> #include <linux/memblock.h> -#include "basic_api.h" #define EXPECTED_MEMBLOCK_REGIONS 128#define FUNC_ADD "memblock_add"
tools/testing/memblock/tests/common.h +1 -0
@@ -5,6 +5,7 @@#include <stdlib.h> #include <assert.h> #include <linux/types.h> +#include <linux/seq_file.h> #include <linux/memblock.h> #include <linux/sizes.h> #include <linux/printk.h>
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 219/321 ASoC: imx-rpmsg: Set ignore_pmdown_time for dai_link
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chancel Liu <[email protected]>
[ Upstream commit fac58baf8fcfcd7481e8f6d60206ce2a47c1476c ]
i.MX rpmsg sound cards work on codec slave mode. MCLK will be disabled by CPU DAI driver in hw_free(). Some codec requires MCLK present at power up/down sequence. So need to set ignore_pmdown_time to power down codec immediately before MCLK is turned off.
Take WM8962 as an example, if MCLK is disabled before DAPM power down playback stream, FIFO error will arise in WM8962 which will have bad impact on playback next.
--- sound/soc/fsl/imx-rpmsg.c | 8 ++++++++ 1 file changed, 8 insertions(+)
sound/soc/fsl/imx-rpmsg.c +8 -0
@@ -89,6 +89,14 @@ static int imx_rpmsg_probe(struct platform_device *pdev)SND_SOC_DAIFMT_NB_NF |SND_SOC_DAIFMT_CBC_CFC ; +/* +* i.MX rpmsg sound cards work on codec slave mode. MCLK will be +* disabled by CPU DAI driver in hw_free(). Some codec requires MCLK +* present at power up/down sequence. So need to set ignore_pmdown_time +* to power down codec immediately before MCLK is turned off. +*/ + data->dai.ignore_pmdown_time =1 ; +/* Optional codec node */ ret =of_parse_phandle_with_fixed_args (np,"audio-codec" ,0 ,0 , &args);if (ret) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 220/321 ASoC: SOF: sof-audio: Fix DSP core put imbalance on widget setup failure
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <[email protected]>
[ Upstream commit bb0216d4db9ecaa51af45d8504757becbe5c050d ]
In case the widget setup fails we should only decrement the core usage count if the sof_widget_free_unlocked() has not been called as part of the error handling.sof_widget_free_unlocked() calls snd_sof_dsp_core_put() and the additional core_put will cause imbalance in core usage count.
Use the existing use_count_decremented to handle this issue.
--- sound/soc/sof/sof-audio.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/soc/sof/sof-audio.c +2 -1
@@ -212,7 +212,8 @@ static int sof_widget_setup_unlocked(struct snd_sof_dev *sdev,sof_widget_free_unlocked (sdev, swidget); use_count_decremented = true; core_put: -snd_sof_dsp_core_put (sdev, swidget->core); +if (!use_count_decremented) +snd_sof_dsp_core_put (sdev, swidget->core); pipe_widget_free:if (swidget->id != snd_soc_dapm_scheduler)sof_widget_free_unlocked (sdev, swidget->spipe->pipe_widget);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 221/321 media: vb2: frame_vector.c: replace WARN_ONCE with a comment
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <[email protected]>
[ Upstream commit 735de5caf79e06cc9fb96b1b4f4974674ae3e917 ]
The WARN_ONCE was issued also in cases that had nothing to do with VM_IO (e.g. if the start address was just a random value and uaccess fails with -EFAULT).
There are no reports of WARN_ONCE being issued for actual VM_IO cases, so just drop it and instead add a note to the comment before the function.
--- drivers/media/common/videobuf2/frame_vector.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/media/common/videobuf2/frame_vector.c +4 -2
@@ -31,6 +31,10 @@* different type underlying the specified range of virtual addresses. * When the function isn't able to map a single page, it returns error. * +* Note that get_vaddr_frames() cannot follow VM_IO mappings. It used +* to be able to do that, but that could (racily) return non-refcounted +* pfns. +* * This function takes care of grabbing mmap_lock as necessary. */ int get_vaddr_frames(unsigned long start, unsigned int nr_frames, bool write,
@@ -59,8 +63,6 @@ int get_vaddr_frames(unsigned long start, unsigned int nr_frames, bool write,if (likely (ret >0 ))return ret; -/* This used to (racily) return non-refcounted pfns. Let people know */ -WARN_ONCE (1 ,"get_vaddr_frames() cannot follow VM_IO mapping" ); vec->nr_frames =0 ;return ret ? ret : -EFAULT ; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 222/321 NFSv4.1: fix zero value filehandle in post open getattr
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olga Kornievskaia <[email protected]>
[ Upstream commit 4506f23e117161a20104c8fa04f33e1ca63c26af ]
Currently, if the OPEN compound experiencing an error and needs to get the file attributes separately, it will send a stand alone GETATTR but it would use the filehandle from the results of the OPEN compound. In case of the CLAIM_FH OPEN, nfs_openres's fh is zero value. That generate a GETATTR that's sent with a zero value filehandle, and results in the server returning an error.
Instead, for the CLAIM_FH OPEN, take the filehandle that was used in the PUTFH of the OPEN compound.
--- fs/nfs/nfs4proc.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
fs/nfs/nfs4proc.c +5 -1
@@ -2703,8 +2703,12 @@ static int _nfs4_proc_open(struct nfs4_opendata *data,return status; }if (!(o_res->f_attr->valid &NFS_ATTR_FATTR )) { +struct nfs_fh *fh = &o_res->fh; +nfs4_sequence_free_slot (&o_res->seq_res); -nfs4_proc_getattr (server, &o_res->fh, o_res->f_attr,NULL ); +if (o_arg->claim ==NFS4_OPEN_CLAIM_FH ) + fh =NFS_FH (d_inode (data->dentry)); +nfs4_proc_getattr (server, fh, o_res->f_attr,NULL ); }return 0 ; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 223/321 ASoC: SOF: Intel: MTL: Reduce the DSP init timeout
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ranjani Sridharan <[email protected]>
[ Upstream commit e0f96246c4402514acda040be19ee24c1619e01a ]
20s seems unnecessarily large for the DSP init timeout. This coupled with multiple FW boot attempts causes an excessive delay in the error path when booting in recovery mode. Reduce it to 0.5s and use the existing HDA_DSP_INIT_TIMEOUT_US.
--- sound/soc/sof/intel/mtl.c | 2 +- sound/soc/sof/intel/mtl.h | 1 - 2 files changed, 1 insertion(+), 2 deletions(-)
sound/soc/sof/intel/mtl.c +1 -1
@@ -460,7 +460,7 @@ int mtl_dsp_cl_init(struct snd_sof_dev *sdev, int stream_tag, bool imr_boot)/* step 3: wait for IPC DONE bit from ROM */ ret =snd_sof_dsp_read_poll_timeout (sdev,HDA_DSP_BAR , chip->ipc_ack, status, ((status & chip->ipc_ack_mask) == chip->ipc_ack_mask), -HDA_DSP_REG_POLL_INTERVAL_US ,MTL_DSP_PURGE_TIMEOUT_US ); +HDA_DSP_REG_POLL_INTERVAL_US ,HDA_DSP_INIT_TIMEOUT_US );if (ret <0 ) {if (hda->boot_iteration ==HDA_FW_BOOT_ATTEMPTS )dev_err (sdev->dev,"timeout waiting for purge IPC done\n" );
sound/soc/sof/intel/mtl.h +0 -1
@@ -62,7 +62,6 @@#define MTL_DSP_IRQSTS_IPC BIT(0)#define MTL_DSP_IRQSTS_SDW BIT(6) -#define MTL_DSP_PURGE_TIMEOUT_US 20000000/* 20s */ #define MTL_DSP_REG_POLL_INTERVAL_US 10/* 10 us */ /* Memory windows */
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 224/321 powerpc/watchpoints: Disable preemption in thread_change_pc()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Gray <[email protected]>
[ Upstream commit cc879ab3ce39bc39f9b1d238b283f43a5f6f957d ]
thread_change_pc() uses CPU local data, so must be protected from swapping CPUs while it is reading the breakpoint struct.
The error is more noticeable after 1e60f3564bad ("powerpc/watchpoints:
Track perf single step directly on the breakpoint"), which added an unconditional __this_cpu_read() call in thread_change_pc(). However the existing __this_cpu_read() that runs if a breakpoint does need to be re-inserted has the same issue.
--- arch/powerpc/kernel/hw_breakpoint.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
arch/powerpc/kernel/hw_breakpoint.c +6 -1
@@ -505,11 +505,13 @@ void thread_change_pc(struct task_struct *tsk, struct pt_regs *regs)struct arch_hw_breakpoint *info;int i; +preempt_disable (); +for (i =0 ; i <nr_wp_slots (); i++) {if (unlikely (tsk->thread.last_hit_ubp[i])) goto reset; } -return ; + goto out; reset:regs_set_return_msr (regs, regs->msr & ~MSR_SE );
@@ -518,6 +520,9 @@ void thread_change_pc(struct task_struct *tsk, struct pt_regs *regs)__set_breakpoint (i, info); tsk->thread.last_hit_ubp[i] =NULL ; } + +out: +preempt_enable (); }static bool is_larx_stcx_instr (int type)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 225/321 powerpc/watchpoint: Disable pagefaults when getting user instruction
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Gray <[email protected]>
[ Upstream commit 3241f260eb830d27d09cc604690ec24533fdb433 ]
This is called in an atomic context, so is not allowed to sleep if a user page needs to be faulted in and has nowhere it can be deferred to. The pagefault_disabled() function is documented as preventing user access methods from sleeping.
In practice the page will be mapped in nearly always because we are reading the instruction that just triggered the watchpoint trap.
--- arch/powerpc/kernel/hw_breakpoint_constraints.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
arch/powerpc/kernel/hw_breakpoint_constraints.c +6 -1
@@ -131,8 +131,13 @@ void wp_get_instr_detail(struct pt_regs *regs, ppc_inst_t *instr, int *type, int *size, unsigned long *ea) { struct instruction_op op; +int err; -if (__get_user_instr (*instr, (void __user *)regs->nip)) +pagefault_disable (); + err =__get_user_instr (*instr, (void __user *)regs->nip); +pagefault_enable (); + +if (err)return ;analyse_instr (&op, regs, *instr);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 226/321 powerpc/watchpoints: Annotate atomic context in more places
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Gray <[email protected]>
[ Upstream commit 27646b2e02b096a6936b3e3b6ba334ae20763eab ]
It can be easy to miss that the notifier mechanism invokes the callbacks in an atomic context, so add some comments to that effect on the two handlers we register here.
--- arch/powerpc/kernel/hw_breakpoint.c | 9 +++++++++ 1 file changed, 9 insertions(+)
arch/powerpc/kernel/hw_breakpoint.c +9 -0
@@ -637,6 +637,11 @@ static void handle_p10dd1_spurious_exception(struct arch_hw_breakpoint **info, } } +/* +* Handle a DABR or DAWR exception. +* +* Called in atomic context. +*/ int hw_breakpoint_handler (struct die_args *args) {bool err = false;
@@ -763,6 +768,8 @@ NOKPROBE_SYMBOL(hw_breakpoint_handler);/* * Handle single-step exceptions following a DABR hit. +* +* Called in atomic context. */ static int single_step_dabr_instruction (struct die_args *args) {
@@ -820,6 +827,8 @@ NOKPROBE_SYMBOL(single_step_dabr_instruction);/* * Handle debug exception notifications. +* +* Called in atomic context. */ int hw_breakpoint_exceptions_notify (struct notifier_block *unused,unsigned long val,void *data)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 227/321 ncsi: Propagate carrier gain/loss events to the NCSI controller
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johnathan Mantey <[email protected]>
[ Upstream commit 3780bb29311eccb7a1c9641032a112eed237f7e3 ]
Report the carrier/no-carrier state for the network interface shared between the BMC and the passthrough channel. Without this functionality the BMC is unable to reconfigure the NIC in the event of a re-cabling to a different subnet.
--- net/ncsi/ncsi-aen.c | 5 +++++ 1 file changed, 5 insertions(+)
net/ncsi/ncsi-aen.c +5 -0
@@ -89,6 +89,11 @@ static int ncsi_aen_handler_lsc(struct ncsi_dev_priv *ndp,if ((had_link == has_link) || chained)return 0 ; +if (had_link) +netif_carrier_off (ndp->ndev.dev); +else +netif_carrier_on (ndp->ndev.dev); +if (!ndp->multi_package && !nc->package->multi_channel) {if (had_link) { ndp->flags |=NCSI_DEV_RESHUFFLE ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 228/321 net: hsr: Add __packed to struct hsr_sup_tlv.
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <[email protected]>
[ Upstream commit fbd825fcd7dd4c11d4c48c3d0adc248a4a0ce90b ]
Struct hsr_sup_tlv describes HW layout and therefore it needs a __packed attribute to ensure the compiler does not add any padding. Due to the size and __packed attribute of the structs that use hsr_sup_tlv it has no functional impact.
Add __packed to struct hsr_sup_tlv.
--- net/hsr/hsr_main.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/hsr/hsr_main.h +1 -1
@@ -83,7 +83,7 @@ struct hsr_vlan_ethhdr {struct hsr_sup_tlv {u8 HSR_TLV_type;u8 HSR_TLV_length; -}; +} __packed;/* HSR/PRP Supervision Frame data types. * Field names as defined in the IEC:2010 standard for HSR.
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 229/321 tsnep: Fix NAPI scheduling
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gerhard Engleder <[email protected]>
[ Upstream commit ea852c17f5382a0a52041cfbd9a4451ae0fa1a38 ]
According to the NAPI documentation networking/napi.rst, drivers which have to mask interrupts explicitly should use the napi_schedule_prep() and __napi_schedule() calls.
No problem seen so far with current implementation. Nevertheless, let's align the implementation with documentation.
--- drivers/net/ethernet/engleder/tsnep_main.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
drivers/net/ethernet/engleder/tsnep_main.c +10 -4
@@ -86,8 +86,11 @@ static irqreturn_t tsnep_irq(int irq, void *arg)/* handle TX/RX queue 0 interrupt */ if ((active & adapter->queue[0 ].irq_mask) !=0 ) { -tsnep_disable_irq (adapter, adapter->queue[0 ].irq_mask); -napi_schedule (&adapter->queue[0 ].napi); +if (napi_schedule_prep (&adapter->queue[0 ].napi)) { +tsnep_disable_irq (adapter, adapter->queue[0 ].irq_mask); +/* schedule after masking to avoid races */ +__napi_schedule (&adapter->queue[0 ].napi); + } }return IRQ_HANDLED ;
@@ -98,8 +101,11 @@ static irqreturn_t tsnep_irq_txrx(int irq, void *arg)struct tsnep_queue *queue = arg;/* handle TX/RX queue interrupt */ -tsnep_disable_irq (queue->adapter, queue->irq_mask); -napi_schedule (&queue->napi); +if (napi_schedule_prep (&queue->napi)) { +tsnep_disable_irq (queue->adapter, queue->irq_mask); +/* schedule after masking to avoid races */ +__napi_schedule (&queue->napi); + }return IRQ_HANDLED ; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 230/321 tsnep: Fix ethtool channels
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gerhard Engleder <[email protected]>
[ Upstream commit a7f991953d73dd50c4c23b5437c0139960e1fad4 ]
According to the NAPI documentation networking/napi.rst, for the ethtool API a channel is a IRQ/NAPI which services queues of a given type.
tsnep uses a single IRQ/NAPI instance for every TX/RX queue pair. Therefore, combined channels shall be returned instead of separate tx/rx channels.
--- drivers/net/ethernet/engleder/tsnep_ethtool.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/net/ethernet/engleder/tsnep_ethtool.c +2 -4
@@ -300,10 +300,8 @@ static void tsnep_ethtool_get_channels(struct net_device *netdev, {struct tsnep_adapter *adapter =netdev_priv (netdev); - ch->max_rx = adapter->num_rx_queues; - ch->max_tx = adapter->num_tx_queues; - ch->rx_count = adapter->num_rx_queues; - ch->tx_count = adapter->num_tx_queues; + ch->max_combined = adapter->num_queues; + ch->combined_count = adapter->num_queues; } static int tsnep_ethtool_get_ts_info(struct net_device *netdev,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 231/321 tsnep: Fix NAPI polling with budget 0
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gerhard Engleder <[email protected]>
[ Upstream commit 46589db3817bd8b523701274885984b5a5dda7d1 ]
According to the NAPI documentation networking/napi.rst, Rx specific APIs like page pool and XDP cannot be used at all when budget is 0. skb Tx processing should happen regardless of the budget.
Stop NAPI polling after Tx processing and skip Rx processing if budget is 0.
--- drivers/net/ethernet/engleder/tsnep_main.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/engleder/tsnep_main.c +4 -0
@@ -1733,6 +1733,10 @@ static int tsnep_poll(struct napi_struct *napi, int budget)if (queue->tx) complete =tsnep_tx_poll (queue->tx, budget); +/* handle case where we are called by netpoll with a budget of 0 */ +if (unlikely (budget <=0 )) +return budget; +if (queue->rx) { done = queue->rx->xsk_pool ? tsnep_rx_poll_zc(queue->rx, napi, budget) :
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 232/321 gfs2: fix glock shrinker ref issues
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bob Peterson <[email protected]>
[ Upstream commit 62862485a4c3a52029fc30f4bdde9af04afdafc9 ]
Before this patch, function gfs2_scan_glock_lru would only try to free glocks that had a reference count of 0. But if the reference count ever got to 0, the glock should have already been freed.
Shrinker function gfs2_dispose_glock_lru checks whether glocks on the LRU are demote_ok, and if so, tries to demote them. But that's only possible if the reference count is at least 1.
This patch changes gfs2_scan_glock_lru so it will try to demote and/or dispose of glocks that have a reference count of 1 and which are either demotable, or are already unlocked.
--- fs/gfs2/glock.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/gfs2/glock.c +3 -1
@@ -2017,7 +2017,9 @@ static long gfs2_scan_glock_lru(int nr)if (!test_bit (GLF_LOCK , &gl->gl_flags)) {if (!spin_trylock (&gl->gl_lockref.lock))continue ; -if (!gl->gl_lockref.count) { +if (gl->gl_lockref.count <=1 && + (gl->gl_state ==LM_ST_UNLOCKED || +demote_ok (gl))) {list_move (&gl->gl_lru, &dispose);atomic_dec (&lru_count); freed++;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 233/321 i2c: designware: fix __i2c_dw_disable() in case master is holding SCL low
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yann Sionneau <[email protected]>
[ Upstream commit 2409205acd3c7c877f3d0080cac6a5feb3358f83 ]
The DesignWare IP can be synthesized with the IC_EMPTYFIFO_HOLD_MASTER_EN parameter.
In this case, when the TX FIFO gets empty and the last command didn't have the STOP bit (IC_DATA_CMD[9]), the controller will hold SCL low until a new command is pushed into the TX FIFO or the transfer is aborted.
When the controller is holding SCL low, it cannot be disabled. The transfer must first be aborted.
Also, the bus recovery won't work because SCL is held low by the master.
Check if the master is holding SCL low in __i2c_dw_disable() before trying to disable the controller. If SCL is held low, an abort is initiated. When the abort is done, then proceed with disabling the controller.
This whole situation can happen for instance during SMBus read data block if the slave just responds with "byte count == 0".
This puts the driver in an unrecoverable state, because the controller is holding SCL low and the current __i2c_dw_disable() procedure is not working. In this situation only a SoC reset can fix the i2c bus.
--- drivers/i2c/busses/i2c-designware-common.c | 17 +++++++++++++++++ drivers/i2c/busses/i2c-designware-core.h | 3 +++ 2 files changed, 20 insertions(+)
drivers/i2c/busses/i2c-designware-common.c +17 -0
@@ -441,8 +441,25 @@ int i2c_dw_set_sda_hold(struct dw_i2c_dev *dev)void __i2c_dw_disable (struct dw_i2c_dev *dev) { +unsigned int raw_intr_stats; +unsigned int enable;int timeout =100 ; +bool abort_needed;unsigned int status; +int ret; + +regmap_read (dev->map,DW_IC_RAW_INTR_STAT , &raw_intr_stats); +regmap_read (dev->map,DW_IC_ENABLE , &enable); + + abort_needed = raw_intr_stats &DW_IC_INTR_MST_ON_HOLD ; +if (abort_needed) { +regmap_write (dev->map,DW_IC_ENABLE , enable |DW_IC_ENABLE_ABORT ); + ret =regmap_read_poll_timeout (dev->map,DW_IC_ENABLE , enable, + !(enable &DW_IC_ENABLE_ABORT ),10 , +100 ); +if (ret) +dev_err (dev->dev,"timeout while trying to abort current transfer\n" ); + } do { __i2c_dw_disable_nowait(dev);
drivers/i2c/busses/i2c-designware-core.h +3 -0
@@ -98,6 +98,7 @@#define DW_IC_INTR_START_DET BIT(10)#define DW_IC_INTR_GEN_CALL BIT(11)#define DW_IC_INTR_RESTART_DET BIT(12) +#define DW_IC_INTR_MST_ON_HOLD BIT(13)#define DW_IC_INTR_DEFAULT_MASK (DW_IC_INTR_RX_FULL | \ DW_IC_INTR_TX_ABRT | \
@@ -108,6 +109,8 @@ DW_IC_INTR_RX_UNDER | \ DW_IC_INTR_RD_REQ) +#define DW_IC_ENABLE_ABORT BIT(1) +#define DW_IC_STATUS_ACTIVITY BIT(0)#define DW_IC_STATUS_TFE BIT(2)#define DW_IC_STATUS_RFNE BIT(3)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 234/321 LoongArch: Use _UL() and _ULL()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 3563b477ddfe057ff1ef63636cacf198130276cb ]
Use _UL() and _ULL() that are provided by const.h.
--- arch/loongarch/include/asm/addrspace.h | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
arch/loongarch/include/asm/addrspace.h +6 -6
@@ -19,7 +19,7 @@*/ #ifndef __ASSEMBLY__#ifndef PHYS_OFFSET -#define PHYS_OFFSET _AC(0, UL) +#define PHYS_OFFSET _UL(0)#endif extern unsigned long vm_map_base;#endif /* __ASSEMBLY__ */
@@ -43,7 +43,7 @@ extern unsigned long vm_map_base;* Memory above this physical address will be considered highmem. */ #ifndef HIGHMEM_START -#define HIGHMEM_START (_AC(1, UL) << _AC(DMW_PABITS, UL)) +#define HIGHMEM_START (_UL(1) << _UL(DMW_PABITS))#endif #define TO_PHYS (x) ( ((x) & TO_PHYS_MASK))
@@ -65,16 +65,16 @@ extern unsigned long vm_map_base;#define _ATYPE_#define _ATYPE32_#define _ATYPE64_ -#define _CONST64_ (x) x#else #define _ATYPE_ __PTRDIFF_TYPE__#define _ATYPE32_ int#define _ATYPE64_ __s64 +#endif +#ifdef CONFIG_64BIT -#define _CONST64_ (x) x ## UL +#define _CONST64_ (x) _UL(x)#else -#define _CONST64_ (x) x ## ULL -#endif +#define _CONST64_ (x) _ULL(x)#endif /*
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 235/321 LoongArch: Set all reserved memblocks on Node#0 at initialization
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
[ Upstream commit b795fb9f5861ee256070d59e33130980a01fadd7 ]
After commit 61167ad5fecdea ("mm: pass nid to reserve_bootmem_region()") we get a panic if DEFERRED_STRUCT_PAGE_INIT is enabled:
[ 0.000000] CPU 0 Unable to handle kernel paging request at virtual address 0000000000002b82, era == 90000000040e3f28, ra == 90000000040e3f18 [ 0.000000] Oops[#1]: [ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 6.5.0+ #733 [ 0.000000] pc 90000000040e3f28 ra 90000000040e3f18 tp 90000000046f4000 sp 90000000046f7c90 [ 0.000000] a0 0000000000000001 a1 0000000000200000 a2 0000000000000040 a3 90000000046f7ca0 [ 0.000000] a4 90000000046f7ca4 a5 0000000000000000 a6 90000000046f7c38 a7 0000000000000000 [ 0.000000] t0 0000000000000002 t1 9000000004b00ac8 t2 90000000040e3f18 t3 90000000040f0800 [ 0.000000] t4 00000000000f0000 t5 80000000ffffe07e t6 0000000000000003 t7 900000047fff5e20 [ 0.000000] t8 aaaaaaaaaaaaaaab u0 0000000000000018 s9 0000000000000000 s0 fffffefffe000000 [ 0.000000] s1 0000000000000000 s2 0000000000000080 s3 0000000000000040 s4 0000000000000000 [ 0.000000] s5 0000000000000000 s6 fffffefffe000000 s7 900000000470b740 s8 9000000004ad4000 [ 0.000000] ra: 90000000040e3f18 reserve_bootmem_region+0xec/0x21c [ 0.000000] ERA: 90000000040e3f28 reserve_bootmem_region+0xfc/0x21c [ 0.000000] CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE) [ 0.000000] PRMD: 00000000 (PPLV0 -PIE -PWE) [ 0.000000] EUEN: 00000000 (-FPE -SXE -ASXE -BTE) [ 0.000000] ECFG: 00070800 (LIE=11 VS=7) [ 0.000000] ESTAT: 00010800 [PIL] (IS=11 ECode=1 EsubCode=0) [ 0.000000] BADV: 0000000000002b82 [ 0.000000] PRID: 0014d000 (Loongson-64bit, Loongson-3A6000) [ 0.000000] Modules linked in: [ 0.000000] Process swapper (pid: 0, threadinfo=(____ptrval____), task=(____ptrval____)) [ 0.000000] Stack : 0000000000000000 9000000002eb5430 0000003a00000020 90000000045ccd00 [ 0.000000] 900000000470e000 90000000002c1918 0000000000000000 9000000004110780 [ 0.000000] 00000000fe6c0000 0000000480000000 9000000004b4e368 9000000004110748 [ 0.000000] 0000000000000000 900000000421ca84 9000000004620000 9000000004564970 [ 0.000000] 90000000046f7d78 9000000002cc9f70 90000000002c1918 900000000470e000 [ 0.000000] 9000000004564970 90000000040bc0e0 90000000046f7d78 0000000000000000 [ 0.000000] 0000000000004000 90000000045ccd00 0000000000000000 90000000002c1918 [ 0.000000] 90000000002c1900 900000000470b700 9000000004b4df78 9000000004620000 [ 0.000000] 90000000046200a8 90000000046200a8 0000000000000000 9000000004218b2c [ 0.000000] 9000000004270008 0000000000000001 0000000000000000 90000000045ccd00 [ 0.000000] ... [ 0.000000] Call Trace: [ 0.000000] [<90000000040e3f28>] reserve_bootmem_region+0xfc/0x21c [ 0.000000] [<900000000421ca84>] memblock_free_all+0x114/0x350 [ 0.000000] [<9000000004218b2c>] mm_core_init+0x138/0x3cc [ 0.000000] [<9000000004200e38>] start_kernel+0x488/0x7a4 [ 0.000000] [<90000000040df0d8>] kernel_entry+0xd8/0xdc [ 0.000000] [ 0.000000] Code: 02eb21ad 00410f4c 380c31ac <262b818d> 6800b70d 02c1c196 0015001c 57fe4bb1 260002cd
The reason is early memblock_reserve() in memblock_init() set node id to MAX_NUMNODES, making NODE_DATA(nid) a NULL dereference in the call chain reserve_bootmem_region() -> init_reserved_page(). After memblock_init(), those late calls of memblock_reserve() operate on subregions of memblock .memory regions. As a result, these reserved regions will be set to the correct node at the first iteration of memmap_init_reserved_pages().
So set all reserved memblocks on Node#0 at initialization can avoid this panic.
--- arch/loongarch/kernel/mem.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/loongarch/kernel/mem.c +3 -1
@@ -50,7 +50,6 @@ void __init memblock_init(void) }memblock_set_current_limit (PFN_PHYS (max_low_pfn)); -memblock_set_node (0 ,PHYS_ADDR_MAX , &memblock.memory,0 );/* Reserve the first 2MB */ memblock_reserve (PHYS_OFFSET ,0x200000 );
@@ -58,4 +57,7 @@ void __init memblock_init(void)/* Reserve the kernel text/data/bss */ memblock_reserve (__pa_symbol (&_text),__pa_symbol (&_end) -__pa_symbol (&_text)); + +memblock_set_node (0 ,PHYS_ADDR_MAX , &memblock.memory,0 ); +memblock_set_node (0 ,PHYS_ADDR_MAX , &memblock.reserved,0 ); }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 236/321 fbdev/sh7760fb: Depend on FB=y
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <[email protected]>
[ Upstream commit f75f71b2c418a27a7c05139bb27a0c83adf88d19 ]
Fix linker error if FB=m about missing fb_io_read and fb_io_write. The linker's error message suggests that this config setting has already been broken for other symbols.
All errors (new ones prefixed by >>):
sh4-linux-ld: drivers/video/fbdev/sh7760fb.o: in function `sh7760fb_probe':
sh7760fb.c:(.text+0x374): undefined reference to `framebuffer_alloc'
sh4-linux-ld: sh7760fb.c:(.text+0x394): undefined reference to `fb_videomode_to_var'
sh4-linux-ld: sh7760fb.c:(.text+0x39c): undefined reference to `fb_alloc_cmap'
sh4-linux-ld: sh7760fb.c:(.text+0x3a4): undefined reference to `register_framebuffer'
sh4-linux-ld: sh7760fb.c:(.text+0x3ac): undefined reference to `fb_dealloc_cmap'
sh4-linux-ld: sh7760fb.c:(.text+0x434): undefined reference to `framebuffer_release'
sh4-linux-ld: drivers/video/fbdev/sh7760fb.o: in function `sh7760fb_remove':
sh7760fb.c:(.text+0x800): undefined reference to `unregister_framebuffer'
sh4-linux-ld: sh7760fb.c:(.text+0x804): undefined reference to `fb_dealloc_cmap'
sh4-linux-ld: sh7760fb.c:(.text+0x814): undefined reference to `framebuffer_release'Quoted 2 lines
Quoted 2 lines
sh4-linux-ld: drivers/video/fbdev/sh7760fb.o:(.rodata+0xc): undefined reference to `fb_io_read'
sh4-linux-ld: drivers/video/fbdev/sh7760fb.o:(.rodata+0x10): undefined reference to `fb_io_write'
sh4-linux-ld: drivers/video/fbdev/sh7760fb.o:(.rodata+0x2c): undefined reference to `cfb_fillrect'
sh4-linux-ld: drivers/video/fbdev/sh7760fb.o:(.rodata+0x30): undefined reference to `cfb_copyarea'
sh4-linux-ld: drivers/video/fbdev/sh7760fb.o:(.rodata+0x34): undefined reference to `cfb_imageblit'--- drivers/video/fbdev/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/video/fbdev/Kconfig +1 -1
@@ -2003,7 +2003,7 @@ config FB_COBALT config FB_SH7760 bool "SH7760/SH7763/SH7720/SH7721 LCDC support" - depends on FB && (CPU_SUBTYPE_SH7760 || CPU_SUBTYPE_SH7763 \ + depends on FB=y && (CPU_SUBTYPE_SH7760 || CPU_SUBTYPE_SH7763 \ || CPU_SUBTYPE_SH7720 || CPU_SUBTYPE_SH7721) select FB_CFB_FILLRECT select FB_CFB_COPYAREA
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 237/321 perf build: Define YYNOMEM as YYNOABORT for bison < 3.81
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <[email protected]>
[ Upstream commit 88cc47e24597971b05b6e94c28a2fc81d2a8d61a ]
YYNOMEM was introduced in bison 3.81, so define it as YYABORT for older versions, which should provide the previous perf behaviour.
--- tools/perf/util/Build | 6 ++++++ 1 file changed, 6 insertions(+)
tools/perf/util/Build +6 -0
@@ -301,6 +301,12 @@ ifeq ($(BISON_GE_35),1) else bison_flags += -w endif + +BISON_LT_381 := $(shell expr $(shell $(BISON) --version | grep bison | sed -e 's/.\+ \([0-9]\+\).\([0-9]\+\).\([0-9]\+\)/\1\2\3/g') \< 381) +ifeq ($(BISON_LT_381),1) + bison_flags += -DYYNOMEM=YYABORT +endif + CFLAGS_parse-events-bison.o += $(bison_flags) CFLAGS_pmu-bison.o += -DYYLTYPE_IS_TRIVIAL=0 $(bison_flags) CFLAGS_expr-bison.o += -DYYLTYPE_IS_TRIVIAL=0 $(bison_flags)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 238/321 ASoC: cs35l56: Call pm_runtime_dont_use_autosuspend()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Fitzgerald <[email protected]>
commit ec03804552e9a723569e14d2512f36a8e70dc640 upstream
Driver remove() must call pm_runtime_dont_use_autosuspend().
Drivers that call pm_runtime_use_autosuspend() must disable it in driver remove(). Unfortunately until recently this was only mentioned in 1 line in a 900+ line document so most people hadn't noticed this. It has only recently been added to the kerneldoc of pm_runtime_use_autosuspend().
Backport note: This is the same change as the upstream commit but the cs35l56->base.dev argument in the upstream code is cs35l56->dev in older releases.
--- sound/soc/codecs/cs35l56.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/codecs/cs35l56.c +1 -0
@@ -1594,6 +1594,7 @@ void cs35l56_remove(struct cs35l56_private *cs35l56)flush_workqueue (cs35l56->dsp_wq);destroy_workqueue (cs35l56->dsp_wq); +pm_runtime_dont_use_autosuspend (cs35l56->dev);pm_runtime_suspend (cs35l56->dev);pm_runtime_disable (cs35l56->dev);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 239/321 iommu/arm-smmu-v3: Fix soft lockup triggered by arm_smmu_mm_invalidate_range
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolin Chen <[email protected]>
commit d5afb4b47e13161b3f33904d45110f9e6463bad6 upstream.
When running an SVA case, the following soft lockup is triggered:
--------------------------------------------------------------------
watchdog: BUG: soft lockup - CPU#244 stuck for 26s! pstate: 83400009 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : arm_smmu_cmdq_issue_cmdlist+0x178/0xa50 lr : arm_smmu_cmdq_issue_cmdlist+0x150/0xa50
sp : ffff8000d83ef290
x29: ffff8000d83ef290 x28: 000000003b9aca00 x27: 0000000000000000
x26: ffff8000d83ef3c0 x25: da86c0812194a0e8 x24: 0000000000000000
x23: 0000000000000040 x22: ffff8000d83ef340 x21: ffff0000c63980c0
x20: 0000000000000001 x19: ffff0000c6398080 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: ffff3000b4a3bbb0
x14: ffff3000b4a30888 x13: ffff3000b4a3cf60 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000000000 x9 : ffffc08120e4d6bc x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000048cfa x5 : 0000000000000000 x4 : 0000000000000001 x3 : 000000000000000a x2 : 0000000080000000 x1 : 0000000000000000 x0 : 0000000000000001
Call trace: arm_smmu_cmdq_issue_cmdlist+0x178/0xa50 __arm_smmu_tlb_inv_range+0x118/0x254 arm_smmu_tlb_inv_range_asid+0x6c/0x130 arm_smmu_mm_invalidate_range+0xa0/0xa4 __mmu_notifier_invalidate_range_end+0x88/0x120 unmap_vmas+0x194/0x1e0 unmap_region+0xb4/0x144 do_mas_align_munmap+0x290/0x490 do_mas_munmap+0xbc/0x124 __vm_munmap+0xa8/0x19c __arm64_sys_munmap+0x28/0x50 invoke_syscall+0x78/0x11c el0_svc_common.constprop.0+0x58/0x1c0 do_el0_svc+0x34/0x60 el0_svc+0x2c/0xd4 el0t_64_sync_handler+0x114/0x140 el0t_64_sync+0x1a4/0x1a8 --------------------------------------------------------------------
The commit 06ff87bae8d3 ("arm64: mm: remove unused functions and variable protoypes") fixed a similar lockup on the CPU MMU side. Yet, it can occur to SMMU too since arm_smmu_mm_invalidate_range() is typically called next to MMU tlb flush function, e.g.
tlb_flush_mmu_tlbonly {
tlb_flush {
__flush_tlb_range {
// check MAX_TLBI_OPS
}
}
mmu_notifier_invalidate_range {
arm_smmu_mm_invalidate_range {
// does not check MAX_TLBI_OPS
}
}
}Clone a CMDQ_MAX_TLBI_OPS from the MAX_TLBI_OPS in tlbflush.h, since in an SVA case SMMU uses the CPU page table, so it makes sense to align with the tlbflush code. Then, replace per-page TLBI commands with a single per-asid TLBI command, if the request size hits this threshold.
--- .../iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c | 27 ++++++++++++++++--- 1 file changed, 24 insertions(+), 3 deletions(-)
drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c +24 -3
@@ -186,6 +186,15 @@ static void arm_smmu_free_shared_cd(struct arm_smmu_ctx_desc *cd) } } +/* +* Cloned from the MAX_TLBI_OPS in arch/arm64/include/asm/tlbflush.h, this +* is used as a threshold to replace per-page TLBI commands to issue in the +* command queue with an address-space TLBI command, when SMMU w/o a range +* invalidation feature handles too many per-page TLBI commands, which will +* otherwise result in a soft lockup. +*/ +#define CMDQ_MAX_TLBI_OPS (1 << (PAGE_SHIFT - 3)) +static void arm_smmu_mm_invalidate_range (struct mmu_notifier *mn,struct mm_struct *mm,unsigned long start,unsigned long end)
@@ -200,10 +209,22 @@ static void arm_smmu_mm_invalidate_range(struct mmu_notifier *mn,* range. So do a simple translation here by calculating size correctly. */ size = end - start; +if (!(smmu_domain->smmu->features &ARM_SMMU_FEAT_RANGE_INV )) { +if (size >=CMDQ_MAX_TLBI_OPS *PAGE_SIZE ) + size =0 ; + } + +if (!(smmu_domain->smmu->features &ARM_SMMU_FEAT_BTM )) { +if (!size) +arm_smmu_tlb_inv_asid (smmu_domain->smmu, + smmu_mn->cd->asid); +else +arm_smmu_tlb_inv_range_asid (start, size, + smmu_mn->cd->asid, +PAGE_SIZE , false, + smmu_domain); + } -if (!(smmu_domain->smmu->features &ARM_SMMU_FEAT_BTM )) -arm_smmu_tlb_inv_range_asid (start, size, smmu_mn->cd->asid, -PAGE_SIZE , false, smmu_domain);arm_smmu_atc_inv_domain (smmu_domain, mm->pasid, start, size); }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 240/321 spi: zynqmp-gqspi: fix clock imbalance on probe failure
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 1527b076ae2cb6a9c590a02725ed39399fcad1cf upstream.
Make sure that the device is not runtime suspended before explicitly disabling the clocks on probe failure and on driver unbind to avoid a clock enable-count imbalance.
--- drivers/spi/spi-zynqmp-gqspi.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/spi/spi-zynqmp-gqspi.c +8 -4
@@ -1342,9 +1342,9 @@ static int zynqmp_qspi_probe(struct platreturn 0 ; clk_dis_all: -pm_runtime_put_sync (&pdev->dev); -pm_runtime_set_suspended (&pdev->dev);pm_runtime_disable (&pdev->dev); +pm_runtime_put_noidle (&pdev->dev); +pm_runtime_set_suspended (&pdev->dev);clk_disable_unprepare (xqspi->refclk); clk_dis_pclk:clk_disable_unprepare (xqspi->pclk);
@@ -1368,11 +1368,15 @@ static void zynqmp_qspi_remove(struct pl {struct zynqmp_qspi *xqspi =platform_get_drvdata (pdev); +pm_runtime_get_sync (&pdev->dev); +zynqmp_gqspi_write (xqspi,GQSPI_EN_OFST ,0x0 ); + +pm_runtime_disable (&pdev->dev); +pm_runtime_put_noidle (&pdev->dev); +pm_runtime_set_suspended (&pdev->dev);clk_disable_unprepare (xqspi->refclk);clk_disable_unprepare (xqspi->pclk); -pm_runtime_set_suspended (&pdev->dev); -pm_runtime_disable (&pdev->dev); }MODULE_DEVICE_TABLE (of, zynqmp_qspi_of_match);
Greg Kroah-Hartman
maintainerPATCH 241/321 x86/sgx: Resolves SECS reclaim vs. page fault for EAUG race
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haitao Huang <[email protected]>
commit c6c2adcba50c2622ed25ba5d5e7f05f584711358 upstream.
The SGX EPC reclaimer (ksgxd) may reclaim the SECS EPC page for an enclave and set secs.epc_page to NULL. The SECS page is used for EAUG and ELDU in the SGX page fault handler. However, the NULL check for secs.epc_page is only done for ELDU, not EAUG before being used.
Fix this by doing the same NULL check and reloading of the SECS page as needed for both EAUG and ELDU.
The SECS page holds global enclave metadata. It can only be reclaimed when there are no other enclave pages remaining. At that point, virtually nothing can be done with the enclave until the SECS page is paged back in.
An enclave can not run nor generate page faults without a resident SECS page. But it is still possible for a #PF for a non-SECS page to race with paging out the SECS page: when the last resident non-SECS page A triggers a #PF in a non-resident page B, and then page A and the SECS both are paged out before the #PF on B is handled.
Hitting this bug requires that race triggered with a #PF for EAUG. Following is a trace when it happens.
BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:sgx_encl_eaug_page+0xc7/0x210 Call Trace: ? __kmem_cache_alloc_node+0x16a/0x440 ? xa_load+0x6e/0xa0 sgx_vma_fault+0x119/0x230 __do_fault+0x36/0x140 do_fault+0x12f/0x400 __handle_mm_fault+0x728/0x1110 handle_mm_fault+0x105/0x310 do_user_addr_fault+0x1ee/0x750 ? __this_cpu_preempt_check+0x13/0x20 exc_page_fault+0x76/0x180 asm_exc_page_fault+0x27/0x30
--- arch/x86/kernel/cpu/sgx/encl.c | 30 +++++++++++++++++++++++++----- 1 file changed, 25 insertions(+), 5 deletions(-)
arch/x86/kernel/cpu/sgx/encl.c +25 -5
@@ -235,6 +235,21 @@ static struct sgx_epc_page *sgx_encl_eldreturn epc_page; } +/* +* Ensure the SECS page is not swapped out. Must be called with encl->lock +* to protect the enclave states including SECS and ensure the SECS page is +* not swapped out again while being used. +*/ +static struct sgx_epc_page *sgx_encl_load_secs (struct sgx_encl *encl) +{ +struct sgx_epc_page *epc_page = encl->secs.epc_page; + +if (!epc_page) + epc_page =sgx_encl_eldu (&encl->secs,NULL ); + +return epc_page; +} +static struct sgx_encl_page *__sgx_encl_load_page (struct sgx_encl *encl,struct sgx_encl_page *entry) {
@@ -248,11 +263,9 @@ static struct sgx_encl_page *__sgx_encl_return entry; } -if (!(encl->secs.epc_page)) { - epc_page =sgx_encl_eldu (&encl->secs,NULL ); -if (IS_ERR (epc_page)) -return ERR_CAST (epc_page); - } + epc_page =sgx_encl_load_secs (encl); +if (IS_ERR (epc_page)) +return ERR_CAST (epc_page); epc_page =sgx_encl_eldu (entry, encl->secs.epc_page);if (IS_ERR (epc_page))
@@ -339,6 +352,13 @@ static vm_fault_t sgx_encl_eaug_page(strmutex_lock (&encl->lock); + epc_page =sgx_encl_load_secs (encl); +if (IS_ERR (epc_page)) { +if (PTR_ERR (epc_page) == -EBUSY ) + vmret =VM_FAULT_NOPAGE ; + goto err_out_unlock; + } + epc_page =sgx_alloc_epc_page (encl_page, false);if (IS_ERR (epc_page)) {if (PTR_ERR (epc_page) == -EBUSY )
Greg Kroah-Hartman
maintainerPATCH 242/321 x86/srso: Add SRSO mitigation for Hygon processors
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pu Wen <[email protected]>
commit a5ef7d68cea1344cf524f04981c2b3f80bedbb0d upstream.
Add mitigation for the speculative return stack overflow vulnerability which exists on Hygon processors too.
--- arch/x86/kernel/cpu/common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/cpu/common.c +1 -1
@@ -1288,7 +1288,7 @@ static const struct x86_cpu_id cpu_vuln_VULNBL_AMD (0x15 ,RETBLEED ),VULNBL_AMD (0x16 ,RETBLEED ),VULNBL_AMD (0x17 ,RETBLEED |SMT_RSB |SRSO ), -VULNBL_HYGON (0x18 ,RETBLEED |SMT_RSB ), +VULNBL_HYGON (0x18 ,RETBLEED |SMT_RSB |SRSO ), VULNBL_AMD(0x19, SRSO), {} };
Greg Kroah-Hartman
maintainerPATCH 243/321 KVM: SVM: INTERCEPT_RDTSCP is never intercepted anyway
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Bonzini <[email protected]>
commit e8d93d5d93f85949e7299be289c6e7e1154b2f78 upstream.
svm_recalc_instruction_intercepts() is always called at least once before the vCPU is started, so the setting or clearing of the RDTSCP intercept can be dropped from the TSC_AUX virtualization support.
Extracted from a patch by Tom Lendacky.
--- arch/x86/kvm/svm/sev.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
arch/x86/kvm/svm/sev.c +1 -4
@@ -2994,11 +2994,8 @@ static void sev_es_init_vmcb(struct vcpuif (boot_cpu_has (X86_FEATURE_V_TSC_AUX ) && (guest_cpuid_has (&svm->vcpu,X86_FEATURE_RDTSCP ) || -guest_cpuid_has (&svm->vcpu,X86_FEATURE_RDPID ))) { +guest_cpuid_has (&svm->vcpu,X86_FEATURE_RDPID )))set_msr_interception (vcpu, svm->msrpm,MSR_TSC_AUX ,1 ,1 ); -if (guest_cpuid_has (&svm->vcpu,X86_FEATURE_RDTSCP )) -svm_clr_intercept (svm,INTERCEPT_RDTSCP ); - } }void sev_init_vmcb (struct vcpu_svm *svm)
Greg Kroah-Hartman
maintainerPATCH 244/321 KVM: SVM: Fix TSC_AUX virtualization setup
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tom Lendacky <[email protected]>
commit e0096d01c4fcb8c96c05643cfc2c20ab78eae4da upstream.
The checks for virtualizing TSC_AUX occur during the vCPU reset processing path. However, at the time of initial vCPU reset processing, when the vCPU is first created, not all of the guest CPUID information has been set. In this case the RDTSCP and RDPID feature support for the guest is not in place and so TSC_AUX virtualization is not established.
This continues for each vCPU created for the guest. On the first boot of an AP, vCPU reset processing is executed as a result of an APIC INIT event, this time with all of the guest CPUID information set, resulting in TSC_AUX virtualization being enabled, but only for the APs. The BSP always sees a TSC_AUX value of 0 which probably went unnoticed because, at least for Linux, the BSP TSC_AUX value is 0.
Move the TSC_AUX virtualization enablement out of the init_vmcb() path and into the vcpu_after_set_cpuid() path to allow for proper initialization of the support after the guest CPUID information has been set.
With the TSC_AUX virtualization support now in the vcpu_set_after_cpuid() path, the intercepts must be either cleared or set based on the guest CPUID input.
Message-Id: <4137fbcb9008951ab5f0befa74a0399d2cce809a.1694811272.git.thomas.lendacky@amd.com>
--- arch/x86/kvm/svm/sev.c | 31 ++++++++++++++++++++++++++----- arch/x86/kvm/svm/svm.c | 9 ++------- arch/x86/kvm/svm/svm.h | 1 + 3 files changed, 29 insertions(+), 12 deletions(-)
arch/x86/kvm/svm/sev.c +26 -5
@@ -2945,6 +2945,32 @@ int sev_es_string_io(struct vcpu_svm *sv count, in); } +static void sev_es_vcpu_after_set_cpuid (struct vcpu_svm *svm) +{ +struct kvm_vcpu *vcpu = &svm->vcpu; + +if (boot_cpu_has (X86_FEATURE_V_TSC_AUX )) { +bool v_tsc_aux =guest_cpuid_has (vcpu,X86_FEATURE_RDTSCP ) || +guest_cpuid_has (vcpu,X86_FEATURE_RDPID ); + +set_msr_interception (vcpu, svm->msrpm,MSR_TSC_AUX , v_tsc_aux, v_tsc_aux); + } +} + +void sev_vcpu_after_set_cpuid (struct vcpu_svm *svm) +{ +struct kvm_vcpu *vcpu = &svm->vcpu; +struct kvm_cpuid_entry2 *best; + +/* For sev guests, the memory encryption bit is not reserved in CR3. */ + best =kvm_find_cpuid_entry (vcpu,0x8000001F ); +if (best) + vcpu->arch.reserved_gpa_bits &= ~(1UL << (best->ebx &0x3f )); + +if (sev_es_guest (svm->vcpu.kvm)) +sev_es_vcpu_after_set_cpuid (svm); +} +static void sev_es_init_vmcb (struct vcpu_svm *svm) {struct kvm_vcpu *vcpu = &svm->vcpu;
@@ -2991,11 +3017,6 @@ static void sev_es_init_vmcb(struct vcpuset_msr_interception (vcpu, svm->msrpm,MSR_IA32_LASTBRANCHTOIP ,1 ,1 );set_msr_interception (vcpu, svm->msrpm,MSR_IA32_LASTINTFROMIP ,1 ,1 );set_msr_interception (vcpu, svm->msrpm,MSR_IA32_LASTINTTOIP ,1 ,1 ); - -if (boot_cpu_has (X86_FEATURE_V_TSC_AUX ) && - (guest_cpuid_has (&svm->vcpu,X86_FEATURE_RDTSCP ) || -guest_cpuid_has (&svm->vcpu,X86_FEATURE_RDPID ))) -set_msr_interception (vcpu, svm->msrpm,MSR_TSC_AUX ,1 ,1 ); }void sev_init_vmcb (struct vcpu_svm *svm)
arch/x86/kvm/svm/svm.c +2 -7
@@ -4217,7 +4217,6 @@ static bool svm_has_emulated_msr(structstatic void svm_vcpu_after_set_cpuid (struct kvm_vcpu *vcpu) {struct vcpu_svm *svm =to_svm (vcpu); -struct kvm_cpuid_entry2 *best; vcpu->arch.xsaves_enabled =guest_cpuid_has (vcpu,X86_FEATURE_XSAVE ) && boot_cpu_has(X86_FEATURE_XSAVE) &&
@@ -4252,12 +4251,8 @@ static void svm_vcpu_after_set_cpuid(strset_msr_interception (vcpu, svm->msrpm,MSR_IA32_FLUSH_CMD ,0 , !!guest_cpuid_has (vcpu,X86_FEATURE_FLUSH_L1D )); -/* For sev guests, the memory encryption bit is not reserved in CR3. */ -if (sev_guest (vcpu->kvm)) { - best =kvm_find_cpuid_entry (vcpu,0x8000001F ); -if (best) - vcpu->arch.reserved_gpa_bits &= ~(1UL << (best->ebx &0x3f )); - } +if (sev_guest (vcpu->kvm)) +sev_vcpu_after_set_cpuid (svm);init_vmcb_after_set_cpuid (vcpu); }
arch/x86/kvm/svm/svm.h +1 -0
@@ -733,6 +733,7 @@ void __init sev_hardware_setup(void);void sev_hardware_unsetup (void );int sev_cpu_init (struct svm_cpu_data *sd);void sev_init_vmcb (struct vcpu_svm *svm); +void sev_vcpu_after_set_cpuid (struct vcpu_svm *svm);void sev_free_vcpu (struct kvm_vcpu *vcpu);int sev_handle_vmgexit (struct kvm_vcpu *vcpu);int sev_es_string_io (struct vcpu_svm *svm,int size,unsigned int port,int in);
Greg Kroah-Hartman
maintainerPATCH 245/321 KVM: x86/mmu: Open code leaf invalidation from mmu_notifier
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit 50107e8b2a8a59d8cec7e8454e27c1f8e365acdb upstream.
The mmu_notifier path is a bit of a special snowflake, e.g. it zaps only a single address space (because it's per-slot), and can't always yield. Because of this, it calls kvm_tdp_mmu_zap_leafs() in ways that no one else does.
Iterate manually over the leafs in response to an mmu_notifier invalidation, instead of invoking kvm_tdp_mmu_zap_leafs(). Drop the @can_yield param from kvm_tdp_mmu_zap_leafs() as its sole remaining caller unconditionally passes "true".
Message-Id: <[email protected]>
--- arch/x86/kvm/mmu/mmu.c | 2 +- arch/x86/kvm/mmu/tdp_mmu.c | 13 +++++++++---- arch/x86/kvm/mmu/tdp_mmu.h | 4 ++-- 3 files changed, 12 insertions(+), 7 deletions(-)
arch/x86/kvm/mmu/mmu.c +1 -1
@@ -6308,7 +6308,7 @@ void kvm_zap_gfn_range(struct kvm *kvm,if (tdp_mmu_enabled) {for (i =0 ; i <KVM_ADDRESS_SPACE_NUM ; i++) flush =kvm_tdp_mmu_zap_leafs (kvm, i, gfn_start, - gfn_end, true, flush); + gfn_end, flush); }if (flush)
arch/x86/kvm/mmu/tdp_mmu.c +9 -4
@@ -878,12 +878,12 @@ static bool tdp_mmu_zap_leafs(struct kvm* more SPTEs were zapped since the MMU lock was last acquired. */ bool kvm_tdp_mmu_zap_leafs (struct kvm *kvm,int as_id,gfn_t start,gfn_t end, -bool can_yield,bool flush) +bool flush) {struct kvm_mmu_page *root;for_each_tdp_mmu_root_yield_safe (kvm, root, as_id) - flush =tdp_mmu_zap_leafs (kvm, root, start, end, can_yield, flush); + flush =tdp_mmu_zap_leafs (kvm, root, start, end, true, flush);return flush; }
@@ -1146,8 +1146,13 @@ retry:bool kvm_tdp_mmu_unmap_gfn_range (struct kvm *kvm,struct kvm_gfn_range *range,bool flush) { -return kvm_tdp_mmu_zap_leafs (kvm, range->slot->as_id, range->start, - range->end, range->may_block, flush); +struct kvm_mmu_page *root; + +for_each_tdp_mmu_root_yield_safe (kvm, root, range->slot->as_id) + flush =tdp_mmu_zap_leafs (kvm, root, range->start, range->end, + range->may_block, flush); + +return flush; } typedef bool (*tdp_handler_t)(struct kvm *kvm, struct tdp_iter *iter,
arch/x86/kvm/mmu/tdp_mmu.h +2 -2
@@ -20,8 +20,8 @@ __must_check static inline bool kvm_tdp_void kvm_tdp_mmu_put_root (struct kvm *kvm,struct kvm_mmu_page *root,bool shared); -bool kvm_tdp_mmu_zap_leafs (struct kvm *kvm,int as_id,gfn_t start, -gfn_t end,bool can_yield,bool flush); +bool kvm_tdp_mmu_zap_leafs (struct kvm *kvm,int as_id,gfn_t start,gfn_t end, +bool flush);bool kvm_tdp_mmu_zap_sp (struct kvm *kvm,struct kvm_mmu_page *sp);void kvm_tdp_mmu_zap_all (struct kvm *kvm);void kvm_tdp_mmu_invalidate_all_roots (struct kvm *kvm);
Greg Kroah-Hartman
maintainerPATCH 246/321 KVM: x86/mmu: Do not filter address spaces in for_each_tdp_mmu_root_yield_safe()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Bonzini <[email protected]>
commit 441a5dfcd96854cbcb625709e2694a9c60adfaab upstream.
All callers except the MMU notifier want to process all address spaces. Remove the address space ID argument of for_each_tdp_mmu_root_yield_safe() and switch the MMU notifier to use __for_each_tdp_mmu_root_yield_safe().
Extracted out of a patch by Sean Christopherson <[email protected]>
--- arch/x86/kvm/mmu/mmu.c | 8 ++------ arch/x86/kvm/mmu/tdp_mmu.c | 22 +++++++++++----------- arch/x86/kvm/mmu/tdp_mmu.h | 3 +-- 3 files changed, 14 insertions(+), 19 deletions(-)
arch/x86/kvm/mmu/mmu.c +2 -6
@@ -6294,7 +6294,6 @@ static bool kvm_rmap_zap_gfn_range(strucvoid kvm_zap_gfn_range (struct kvm *kvm,gfn_t gfn_start,gfn_t gfn_end) {bool flush; -int i;if (WARN_ON_ONCE (gfn_end <= gfn_start))return ;
@@ -6305,11 +6304,8 @@ void kvm_zap_gfn_range(struct kvm *kvm, flush =kvm_rmap_zap_gfn_range (kvm, gfn_start, gfn_end); -if (tdp_mmu_enabled) { -for (i =0 ; i <KVM_ADDRESS_SPACE_NUM ; i++) - flush =kvm_tdp_mmu_zap_leafs (kvm, i, gfn_start, - gfn_end, flush); - } +if (tdp_mmu_enabled) + flush =kvm_tdp_mmu_zap_leafs (kvm, gfn_start, gfn_end, flush);if (flush)kvm_flush_remote_tlbs_range (kvm, gfn_start, gfn_end - gfn_start);
arch/x86/kvm/mmu/tdp_mmu.c +11 -11
@@ -211,8 +211,12 @@ static struct kvm_mmu_page *tdp_mmu_next#define for_each_valid_tdp_mmu_root_yield_safe (_kvm, _root, _as_id, _shared) \ __for_each_tdp_mmu_root_yield_safe(_kvm, _root, _as_id, _shared, true) -#define for_each_tdp_mmu_root_yield_safe (_kvm, _root, _as_id) \ - __for_each_tdp_mmu_root_yield_safe(_kvm, _root, _as_id, false, false) +#define for_each_tdp_mmu_root_yield_safe (_kvm, _root) \ + for (_root = tdp_mmu_next_root(_kvm, NULL, false, false); \ + _root; \ + _root = tdp_mmu_next_root(_kvm, _root, false, false)) \ + if (!kvm_lockdep_assert_mmu_lock_held(_kvm, false)) { \ + } else/* * Iterate over all TDP MMU roots. Requires that mmu_lock be held for write,
@@ -877,12 +881,11 @@ static bool tdp_mmu_zap_leafs(struct kvm* true if a TLB flush is needed before releasing the MMU lock, i.e. if one or * more SPTEs were zapped since the MMU lock was last acquired. */ -bool kvm_tdp_mmu_zap_leafs (struct kvm *kvm,int as_id,gfn_t start,gfn_t end, -bool flush) +bool kvm_tdp_mmu_zap_leafs (struct kvm *kvm,gfn_t start,gfn_t end,bool flush) {struct kvm_mmu_page *root; -for_each_tdp_mmu_root_yield_safe (kvm, root, as_id) +for_each_tdp_mmu_root_yield_safe (kvm, root) flush =tdp_mmu_zap_leafs (kvm, root, start, end, true, flush);return flush;
@@ -891,7 +894,6 @@ bool kvm_tdp_mmu_zap_leafs(struct kvm *kvoid kvm_tdp_mmu_zap_all (struct kvm *kvm) {struct kvm_mmu_page *root; -int i;/* * Zap all roots, including invalid roots, as all SPTEs must be dropped
@@ -905,10 +907,8 @@ void kvm_tdp_mmu_zap_all(struct kvm *kvm* is being destroyed or the userspace VMM has exited. In both cases, * KVM_RUN is unreachable, i.e. no vCPUs will ever service the request. */ -for (i =0 ; i <KVM_ADDRESS_SPACE_NUM ; i++) { -for_each_tdp_mmu_root_yield_safe (kvm, root, i) -tdp_mmu_zap_root (kvm, root, false); - } +for_each_tdp_mmu_root_yield_safe (kvm, root) +tdp_mmu_zap_root (kvm, root, false); }/*
@@ -1148,7 +1148,7 @@ bool kvm_tdp_mmu_unmap_gfn_range(struct {struct kvm_mmu_page *root; -for_each_tdp_mmu_root_yield_safe (kvm, root, range->slot->as_id) +__for_each_tdp_mmu_root_yield_safe (kvm, root, range->slot->as_id, false, false) flush =tdp_mmu_zap_leafs (kvm, root, range->start, range->end, range->may_block, flush);
arch/x86/kvm/mmu/tdp_mmu.h +1 -2
@@ -20,8 +20,7 @@ __must_check static inline bool kvm_tdp_void kvm_tdp_mmu_put_root (struct kvm *kvm,struct kvm_mmu_page *root,bool shared); -bool kvm_tdp_mmu_zap_leafs (struct kvm *kvm,int as_id,gfn_t start,gfn_t end, -bool flush); +bool kvm_tdp_mmu_zap_leafs (struct kvm *kvm,gfn_t start,gfn_t end,bool flush);bool kvm_tdp_mmu_zap_sp (struct kvm *kvm,struct kvm_mmu_page *sp);void kvm_tdp_mmu_zap_all (struct kvm *kvm);void kvm_tdp_mmu_invalidate_all_roots (struct kvm *kvm);
Greg Kroah-Hartman
maintainerPATCH 247/321 KVM: x86/mmu: Stop zapping invalidated TDP MMU roots asynchronously
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit 0df9dab891ff0d9b646d82e4fe038229e4c02451 upstream.
Stop zapping invalidate TDP MMU roots via work queue now that KVM preserves TDP MMU roots until they are explicitly invalidated. Zapping roots asynchronously was effectively a workaround to avoid stalling a vCPU for an extended during if a vCPU unloaded a root, which at the time happened whenever the guest toggled CR0.WP (a frequent operation for some guest kernels).
While a clever hack, zapping roots via an unbound worker had subtle, unintended consequences on host scheduling, especially when zapping multiple roots, e.g. as part of a memslot. Because the work of zapping a root is no longer bound to the task that initiated the zap, things like the CPU affinity and priority of the original task get lost. Losing the affinity and priority can be especially problematic if unbound workqueues aren't affined to a small number of CPUs, as zapping multiple roots can cause KVM to heavily utilize the majority of CPUs in the system, *beyond* the CPUs KVM is already using to run vCPUs.
When deleting a memslot via KVM_SET_USER_MEMORY_REGION, the async root zap can result in KVM occupying all logical CPUs for ~8ms, and result in high priority tasks not being scheduled in in a timely manner. In v5.15, which doesn't preserve unloaded roots, the issues were even more noticeable as KVM would zap roots more frequently and could occupy all CPUs for 50ms+.
Consuming all CPUs for an extended duration can lead to significant jitter throughout the system, e.g. on ChromeOS with virtio-gpu, deleting memslots is a semi-frequent operation as memslots are deleted and recreated with different host virtual addresses to react to host GPU drivers allocating and freeing GPU blobs. On ChromeOS, the jitter manifests as audio blips during games due to the audio server's tasks not getting scheduled in promptly, despite the tasks having a high realtime priority.
Deleting memslots isn't exactly a fast path and should be avoided when possible, and ChromeOS is working towards utilizing MAP_FIXED to avoid the memslot shenanigans, but KVM is squarely in the wrong. Not to mention that removing the async zapping eliminates a non-trivial amount of complexity.
Note, one of the subtle behaviors hidden behind the async zapping is that KVM would zap invalidated roots only once (ignoring partial zaps from things like mmu_notifier events). Preserve this behavior by adding a flag to identify roots that are scheduled to be zapped versus roots that have already been zapped but not yet freed.
Add a comment calling out why kvm_tdp_mmu_invalidate_all_roots() can encounter invalid roots, as it's not at all obvious why zapping invalidated roots shouldn't simply zap all invalid roots.
Message-Id: <[email protected]>
--- arch/x86/include/asm/kvm_host.h | 3 arch/x86/kvm/mmu/mmu.c | 12 --- arch/x86/kvm/mmu/mmu_internal.h | 15 ++-- arch/x86/kvm/mmu/tdp_mmu.c | 133 ++++++++++++++++------------------------ arch/x86/kvm/mmu/tdp_mmu.h | 2 arch/x86/kvm/x86.c | 5 - 6 files changed, 68 insertions(+), 102 deletions(-)
arch/x86/include/asm/kvm_host.h +1 -2
@@ -1400,7 +1400,6 @@ struct kvm_arch {* the thread holds the MMU lock in write mode. */ spinlock_t tdp_mmu_pages_lock; -struct workqueue_struct *tdp_mmu_zap_wq;#endif /* CONFIG_X86_64 */ /*
@@ -1814,7 +1813,7 @@ void kvm_mmu_vendor_module_exit(void);void kvm_mmu_destroy (struct kvm_vcpu *vcpu);int kvm_mmu_create (struct kvm_vcpu *vcpu); -int kvm_mmu_init_vm (struct kvm *kvm); +void kvm_mmu_init_vm (struct kvm *kvm);void kvm_mmu_uninit_vm (struct kvm *kvm);void kvm_mmu_after_set_cpuid (struct kvm_vcpu *vcpu);
arch/x86/kvm/mmu/mmu.c +3 -9
@@ -6206,21 +6206,17 @@ static void kvm_mmu_invalidate_zap_pageskvm_mmu_zap_all_fast (kvm); } -int kvm_mmu_init_vm (struct kvm *kvm) +void kvm_mmu_init_vm (struct kvm *kvm) {struct kvm_page_track_notifier_node *node = &kvm->arch.mmu_sp_tracker; -int r;INIT_LIST_HEAD (&kvm->arch.active_mmu_pages);INIT_LIST_HEAD (&kvm->arch.zapped_obsolete_pages);INIT_LIST_HEAD (&kvm->arch.possible_nx_huge_pages);spin_lock_init (&kvm->arch.mmu_unsync_pages_lock); -if (tdp_mmu_enabled) { - r =kvm_mmu_init_tdp_mmu (kvm); -if (r <0 ) -return r; - } +if (tdp_mmu_enabled) +kvm_mmu_init_tdp_mmu (kvm); node->track_write = kvm_mmu_pte_write; node->track_flush_slot = kvm_mmu_invalidate_zap_pages_in_memslot;
@@ -6233,8 +6229,6 @@ int kvm_mmu_init_vm(struct kvm *kvm) kvm->arch.split_desc_cache.kmem_cache = pte_list_desc_cache; kvm->arch.split_desc_cache.gfp_zero = __GFP_ZERO; - -return 0 ; }static void mmu_free_vm_memory_caches (struct kvm *kvm)
arch/x86/kvm/mmu/mmu_internal.h +7 -8
@@ -56,7 +56,12 @@ struct kvm_mmu_page {bool tdp_mmu_page;bool unsync; -u8 mmu_valid_gen; +union { +u8 mmu_valid_gen; + +/* Only accessed under slots_lock. */ +bool tdp_mmu_scheduled_root_to_zap; + };/* * The shadow page can't be replaced by an equivalent huge page
@@ -98,13 +103,7 @@ struct kvm_mmu_page {struct kvm_rmap_head parent_ptes;/* rmap pointers to parent sptes */ tdp_ptep_t ptep; }; -union { - DECLARE_BITMAP(unsync_child_bitmap, 512); -struct { -struct work_struct tdp_mmu_async_work; -void *tdp_mmu_async_data; - }; - }; +DECLARE_BITMAP (unsync_child_bitmap,512 );/* * Tracks shadow pages that, if zapped, would allow KVM to create an NX
arch/x86/kvm/mmu/tdp_mmu.c +55 -78
208 lines not on this page · raw message
arch/x86/kvm/mmu/tdp_mmu.h +1 -1
@@ -7,7 +7,7 @@#include "spte.h" -int kvm_mmu_init_tdp_mmu (struct kvm *kvm); +void kvm_mmu_init_tdp_mmu (struct kvm *kvm);void kvm_mmu_uninit_tdp_mmu (struct kvm *kvm);hpa_t kvm_tdp_mmu_get_vcpu_root_hpa (struct kvm_vcpu *vcpu);
arch/x86/kvm/x86.c +1 -4
@@ -12302,9 +12302,7 @@ int kvm_arch_init_vm(struct kvm *kvm, unif (ret) goto out; - ret =kvm_mmu_init_vm (kvm); -if (ret) - goto out_page_track; +kvm_mmu_init_vm (kvm); ret =static_call (kvm_x86_vm_init)(kvm);if (ret)
@@ -12349,7 +12347,6 @@ int kvm_arch_init_vm(struct kvm *kvm, un out_uninit_mmu:kvm_mmu_uninit_vm (kvm); -out_page_track:kvm_page_track_cleanup (kvm); out:return ret;
Greg Kroah-Hartman
maintainerPATCH 248/321 mptcp: fix bogus receive window shrinkage with multiple subflows
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
commit 6bec041147a2a64a490d1f813e8a004443061b38 upstream.
In case multiple subflows race to update the mptcp-level receive window, the subflow losing the race should use the window value provided by the "winning" subflow to update it's own tcp-level rcv_wnd.
To such goal, the current code bogusly uses the mptcp-level rcv_wnd value as observed before the update attempt. On unlucky circumstances that may lead to TCP-level window shrinkage, and stall the other end.
Address the issue feeding to the rcv wnd update the correct value.
--- net/mptcp/options.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
net/mptcp/options.c +3 -2
@@ -1269,12 +1269,13 @@ static void mptcp_set_rwin(struct tcp_soif (rcv_wnd == rcv_wnd_old)break ; -if (before64 (rcv_wnd_new, rcv_wnd)) { + + rcv_wnd_old = rcv_wnd; +if (before64 (rcv_wnd_new, rcv_wnd_old)) {MPTCP_INC_STATS (sock_net (ssk),MPTCP_MIB_RCVWNDCONFLICTUPDATE ); goto raise_win; }MPTCP_INC_STATS (sock_net (ssk),MPTCP_MIB_RCVWNDCONFLICT ); - rcv_wnd_old = rcv_wnd; }return ; }
Greg Kroah-Hartman
maintainerPATCH 249/321 mptcp: move __mptcp_error_report in protocol.c
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
commit d5fbeff1ab812b6c473b6924bee8748469462e2c upstream.
This will simplify the next patch ("mptcp: process pending subflow error on close").
No functional change intended.
--- net/mptcp/protocol.c | 36 ++++++++++++++++++++++++++++++++++++ net/mptcp/subflow.c | 36 ------------------------------------ 2 files changed, 36 insertions(+), 36 deletions(-)
net/mptcp/protocol.c +36 -0
@@ -772,6 +772,42 @@ static bool __mptcp_ofo_queue(struct mptreturn moved; } +void __mptcp_error_report (struct sock *sk) +{ +struct mptcp_subflow_context *subflow; +struct mptcp_sock *msk =mptcp_sk (sk); + +mptcp_for_each_subflow (msk, subflow) { +struct sock *ssk =mptcp_subflow_tcp_sock (subflow); +int err =sock_error (ssk); +int ssk_state; + +if (!err) +continue ; + +/* only propagate errors on fallen-back sockets or +* on MPC connect +*/ +if (sk->sk_state !=TCP_SYN_SENT && !__mptcp_check_fallback (msk)) +continue ; + +/* We need to propagate only transition to CLOSE state. +* Orphaned socket will see such state change via +* subflow_sched_work_if_closed() and that path will properly +* destroy the msk as needed. +*/ + ssk_state =inet_sk_state_load (ssk); +if (ssk_state ==TCP_CLOSE && !sock_flag (sk,SOCK_DEAD )) +inet_sk_state_store (sk, ssk_state); +WRITE_ONCE (sk->sk_err, -err); + +/* This barrier is coupled with smp_rmb() in mptcp_poll() */ +smp_wmb (); +sk_error_report (sk); +break ; + } +} +/* In most cases we will be able to lock the mptcp socket. If its already * owned, we need to defer to the work queue to avoid ABBA deadlock. */
net/mptcp/subflow.c +0 -36
@@ -1362,42 +1362,6 @@ void mptcp_space(const struct sock *ssk, *full_space =tcp_full_space (sk); } -void __mptcp_error_report (struct sock *sk) -{ -struct mptcp_subflow_context *subflow; -struct mptcp_sock *msk =mptcp_sk (sk); - -mptcp_for_each_subflow (msk, subflow) { -struct sock *ssk =mptcp_subflow_tcp_sock (subflow); -int err =sock_error (ssk); -int ssk_state; - -if (!err) -continue ; - -/* only propagate errors on fallen-back sockets or -* on MPC connect -*/ -if (sk->sk_state !=TCP_SYN_SENT && !__mptcp_check_fallback (msk)) -continue ; - -/* We need to propagate only transition to CLOSE state. -* Orphaned socket will see such state change via -* subflow_sched_work_if_closed() and that path will properly -* destroy the msk as needed. -*/ - ssk_state =inet_sk_state_load (ssk); -if (ssk_state ==TCP_CLOSE && !sock_flag (sk,SOCK_DEAD )) -inet_sk_state_store (sk, ssk_state); -WRITE_ONCE (sk->sk_err, -err); - -/* This barrier is coupled with smp_rmb() in mptcp_poll() */ -smp_wmb (); -sk_error_report (sk); -break ; - } -} -static void subflow_error_report (struct sock *ssk) {struct sock *sk =mptcp_subflow_ctx (ssk)->conn;
Greg Kroah-Hartman
maintainerPATCH 250/321 mptcp: process pending subflow error on close
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
commit 9f1a98813b4b686482e5ef3c9d998581cace0ba6 upstream.
On incoming TCP reset, subflow closing could happen before error propagation. That in turn could cause the socket error being ignored, and a missing socket state transition, as reported by Daire-Byrne.
Address the issues explicitly checking for subflow socket error at close time. To avoid code duplication, factor-out of __mptcp_error_report() a new helper implementing the relevant bits.
--- net/mptcp/protocol.c | 63 +++++++++++++++++++++++++++------------------------ 1 file changed, 34 insertions(+), 29 deletions(-)
net/mptcp/protocol.c +34 -29
@@ -772,40 +772,44 @@ static bool __mptcp_ofo_queue(struct mptreturn moved; } -void __mptcp_error_report (struct sock *sk) +static bool __mptcp_subflow_error_report (struct sock *sk,struct sock *ssk) { -struct mptcp_subflow_context *subflow; -struct mptcp_sock *msk =mptcp_sk (sk); +int err =sock_error (ssk); +int ssk_state; -mptcp_for_each_subflow (msk, subflow) { -struct sock *ssk =mptcp_subflow_tcp_sock (subflow); -int err =sock_error (ssk); -int ssk_state; +if (!err) +return false; -if (!err) -continue ; +/* only propagate errors on fallen-back sockets or +* on MPC connect +*/ +if (sk->sk_state !=TCP_SYN_SENT && !__mptcp_check_fallback (mptcp_sk (sk))) +return false; -/* only propagate errors on fallen-back sockets or -* on MPC connect -*/ -if (sk->sk_state !=TCP_SYN_SENT && !__mptcp_check_fallback (msk)) -continue ; +/* We need to propagate only transition to CLOSE state. +* Orphaned socket will see such state change via +* subflow_sched_work_if_closed() and that path will properly +* destroy the msk as needed. +*/ + ssk_state =inet_sk_state_load (ssk); +if (ssk_state ==TCP_CLOSE && !sock_flag (sk,SOCK_DEAD )) +inet_sk_state_store (sk, ssk_state); +WRITE_ONCE (sk->sk_err, -err); + +/* This barrier is coupled with smp_rmb() in mptcp_poll() */ +smp_wmb (); +sk_error_report (sk); +return true; +} -/* We need to propagate only transition to CLOSE state. -* Orphaned socket will see such state change via -* subflow_sched_work_if_closed() and that path will properly -* destroy the msk as needed. -*/ - ssk_state =inet_sk_state_load (ssk); -if (ssk_state ==TCP_CLOSE && !sock_flag (sk,SOCK_DEAD )) -inet_sk_state_store (sk, ssk_state); -WRITE_ONCE (sk->sk_err, -err); - -/* This barrier is coupled with smp_rmb() in mptcp_poll() */ -smp_wmb (); -sk_error_report (sk); -break ; - } +void __mptcp_error_report (struct sock *sk) +{ +struct mptcp_subflow_context *subflow; +struct mptcp_sock *msk =mptcp_sk (sk); + +mptcp_for_each_subflow (msk, subflow) +if (__mptcp_subflow_error_report (sk,mptcp_subflow_tcp_sock (subflow))) +break ; }/* In most cases we will be able to lock the mptcp socket. If its already
@@ -2417,6 +2421,7 @@ static void __mptcp_close_ssk(struct soc } out_release: +__mptcp_subflow_error_report (sk, ssk);release_sock (ssk);sock_put (ssk);
Greg Kroah-Hartman
maintainerPATCH 251/321 misc: rtsx: Fix some platforms can not boot and move the l1ss judgment to probe
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricky WU <[email protected]>
commit 0e4cac557531a4c93de108d9ff11329fcad482ff upstream.
commit 101bd907b424 ("misc: rtsx: judge ASPM Mode to set PETXCFG Reg") some readers no longer force #CLKREQ to low
when the system need to enter ASPM.
But some platform maybe not implement complete ASPM?
it causes some platforms can not boot
Like in the past only the platform support L1ss we release the #CLKREQ. Move the judgment (L1ss) to probe,
we think read config space one time when the driver start is enough
--- drivers/misc/cardreader/rts5227.c | 55 +++-------------------------------- drivers/misc/cardreader/rts5228.c | 57 +++++++++++-------------------------- drivers/misc/cardreader/rts5249.c | 56 ++++-------------------------------- drivers/misc/cardreader/rts5260.c | 43 ++++++++------------------- drivers/misc/cardreader/rts5261.c | 52 ++++++++------------------------- drivers/misc/cardreader/rtsx_pcr.c | 51 +++++++++++++++++++++++++++++---- 6 files changed, 102 insertions(+), 212 deletions(-)
drivers/misc/cardreader/rts5227.c +6 -49
@@ -83,63 +83,20 @@ static void rts5227_fetch_vendor_settingstatic void rts5227_init_from_cfg (struct rtsx_pcr *pcr) { -struct pci_dev *pdev = pcr->pci; -int l1ss; -u32 lval;struct rtsx_cr_option *option = &pcr->option; - l1ss =pci_find_ext_capability (pdev,PCI_EXT_CAP_ID_L1SS ); -if (!l1ss) -return ; - -pci_read_config_dword (pdev, l1ss +PCI_L1SS_CTL1 , &lval); -if (CHK_PCI_PID (pcr,0x522A )) { -if (0 == (lval &0x0F )) -rtsx_pci_enable_oobs_polling (pcr); -else +if (rtsx_check_dev_flag (pcr,ASPM_L1_1_EN |ASPM_L1_2_EN + |PM_L1_1_EN |PM_L1_2_EN ))rtsx_pci_disable_oobs_polling (pcr); +else +rtsx_pci_enable_oobs_polling (pcr); } -if (lval &PCI_L1SS_CTL1_ASPM_L1_1 ) -rtsx_set_dev_flag (pcr,ASPM_L1_1_EN ); -else -rtsx_clear_dev_flag (pcr,ASPM_L1_1_EN ); - -if (lval &PCI_L1SS_CTL1_ASPM_L1_2 ) -rtsx_set_dev_flag (pcr,ASPM_L1_2_EN ); -else -rtsx_clear_dev_flag (pcr,ASPM_L1_2_EN ); - -if (lval &PCI_L1SS_CTL1_PCIPM_L1_1 ) -rtsx_set_dev_flag (pcr,PM_L1_1_EN ); -else -rtsx_clear_dev_flag (pcr,PM_L1_1_EN ); - -if (lval &PCI_L1SS_CTL1_PCIPM_L1_2 ) -rtsx_set_dev_flag (pcr,PM_L1_2_EN ); -else -rtsx_clear_dev_flag (pcr,PM_L1_2_EN ); -if (option->ltr_en) { -u16 val; - -pcie_capability_read_word (pcr->pci,PCI_EXP_DEVCTL2 , &val); -if (val &PCI_EXP_DEVCTL2_LTR_EN ) { - option->ltr_enabled = true; - option->ltr_active = true; +if (option->ltr_enabled)rtsx_set_ltr_latency (pcr, option->ltr_active_latency); - }else { - option->ltr_enabled = false; - } } - -if (rtsx_check_dev_flag (pcr,ASPM_L1_1_EN |ASPM_L1_2_EN - |PM_L1_1_EN |PM_L1_2_EN )) - option->force_clkreq_0 = false; -else - option->force_clkreq_0 = true; - }static int rts5227_extra_init_hw (struct rtsx_pcr *pcr)
@@ -195,7 +152,7 @@ static int rts5227_extra_init_hw(struct } } -if (option->force_clkreq_0 && pcr->aspm_mode ==ASPM_MODE_CFG ) +if (option->force_clkreq_0)rtsx_pci_add_cmd (pcr,WRITE_REG_CMD ,PETXCFG ,FORCE_CLKREQ_DELINK_MASK ,FORCE_CLKREQ_LOW );else
drivers/misc/cardreader/rts5228.c +17 -40
82 lines not on this page · raw message
drivers/misc/cardreader/rts5249.c +7 -49
89 lines not on this page · raw message
drivers/misc/cardreader/rts5260.c +13 -30
66 lines not on this page · raw message
drivers/misc/cardreader/rts5261.c +13 -39
73 lines not on this page · raw message
drivers/misc/cardreader/rtsx_pcr.c +46 -5
70 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 252/321 Revert "tty: n_gsm: fix UAF in gsm_cleanup_mux"
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Starke <[email protected]>
commit 29346e217b8ab8a52889b88f00b268278d6b7668 upstream.
This reverts commit 9b9c8195f3f0d74a826077fc1c01b9ee74907239.
The commit above is reverted as it did not solve the original issue.
gsm_cleanup_mux() tries to free up the virtual ttys by calling gsm_dlci_release() for each available DLCI. There, dlci_put() is called to decrease the reference counter for the DLCI via tty_port_put() which finally calls gsm_dlci_free(). This already clears the pointer which is being checked in gsm_cleanup_mux() before calling gsm_dlci_release(). Therefore, it is not necessary to clear this pointer in gsm_cleanup_mux() as done in the reverted commit. The commit introduces a null pointer dereference:
<TASK> ? __die+0x1f/0x70 ? page_fault_oops+0x156/0x420 ? search_exception_tables+0x37/0x50 ? fixup_exception+0x21/0x310 ? exc_page_fault+0x69/0x150 ? asm_exc_page_fault+0x26/0x30 ? tty_port_put+0x19/0xa0 gsmtty_cleanup+0x29/0x80 [n_gsm] release_one_tty+0x37/0xe0 process_one_work+0x1e6/0x3e0 worker_thread+0x4c/0x3d0 ? __pfx_worker_thread+0x10/0x10 kthread+0xe1/0x110 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2f/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK>
The actual issue is that nothing guards dlci_put() from being called multiple times while the tty driver was triggered but did not yet finished calling gsm_dlci_free().
--- drivers/tty/n_gsm.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/tty/n_gsm.c +1 -3
@@ -3071,10 +3071,8 @@ static void gsm_cleanup_mux(struct gsm_m gsm->has_devices = false; }for (i =NUM_DLCI -1 ; i >=0 ; i--) -if (gsm->dlci[i]) { +if (gsm->dlci[i])gsm_dlci_release (gsm->dlci[i]); - gsm->dlci[i] =NULL ; - }mutex_unlock (&gsm->mutex);/* Now wipe the queues */ tty_ldisc_flush (gsm->tty);
Greg Kroah-Hartman
maintainerPATCH 253/321 scsi: core: ata: Do no try to probe for CDL on old drives
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
commit 2132df16f53b4f01ab25f5d404f36a22244ae342 upstream.
Some old drives (e.g. an Ultra320 SCSI disk as reported by John) do not seem to execute MAINTENANCE_IN / MI_REPORT_SUPPORTED_OPERATION_CODES commands correctly and hang when a non-zero service action is specified (one command format with service action case in scsi_report_opcode()).
Currently, CDL probing with scsi_cdl_check_cmd() is the only caller using a non zero service action for scsi_report_opcode(). To avoid issues with these old drives, do not attempt CDL probe if the device reports support for an SPC version lower than 5 (CDL was introduced in SPC-5). To keep things working with ATA devices which probe for the CDL T2A and T2B pages introduced with SPC-6, modify ata_scsiop_inq_std() to claim SPC-6 version compatibility for ATA drives supporting CDL.
SPC-6 standard version number is defined as Dh (= 13) in SPC-6 r09. Fix scsi_probe_lun() to correctly capture this value by changing the bit mask for the second byte of the INQUIRY response from 0x7 to 0xf. include/scsi/scsi.h is modified to add the definition SCSI_SPC_6 with the value 14 (Dh + 1). The missing definitions for the SCSI_SPC_4 and SCSI_SPC_5 versions are also added.
--- drivers/ata/libata-scsi.c | 3 +++ drivers/scsi/scsi.c | 11 +++++++++++ drivers/scsi/scsi_scan.c | 2 +- include/scsi/scsi.h | 3 +++ 4 files changed, 18 insertions(+), 1 deletion(-)
drivers/ata/libata-scsi.c +3 -0
@@ -1892,6 +1892,9 @@ static unsigned int ata_scsiop_inq_std(s hdr[2 ] =0x7 ;/* claim SPC-5 version compatibility */ } +if (args->dev->flags &ATA_DFLAG_CDL ) + hdr[2 ] =0xd ;/* claim SPC-6 version compatibility */ +memcpy (rbuf, hdr,sizeof (hdr));memcpy (&rbuf[8 ],"ATA " ,8 );ata_id_string (args->id, &rbuf[16 ],ATA_ID_PROD ,16 );
drivers/scsi/scsi.c +11 -0
@@ -613,6 +613,17 @@ void scsi_cdl_check(struct scsi_device *bool cdl_supported;unsigned char *buf; +/* +* Support for CDL was defined in SPC-5. Ignore devices reporting an +* lower SPC version. This also avoids problems with old drives choking +* on MAINTENANCE_IN / MI_REPORT_SUPPORTED_OPERATION_CODES with a +* service action specified, as done in scsi_cdl_check_cmd(). +*/ +if (sdev->scsi_level <SCSI_SPC_5 ) { + sdev->cdl_supported =0 ; +return ; + } + buf =kmalloc (SCSI_CDL_CHECK_BUF_LEN ,GFP_KERNEL );if (!buf) { sdev->cdl_supported =0 ;
drivers/scsi/scsi_scan.c +1 -1
@@ -822,7 +822,7 @@ static int scsi_probe_lun(struct scsi_de* device is attached at LUN 0 (SCSI_SCAN_TARGET_PRESENT) so * non-zero LUNs can be scanned. */ - sdev->scsi_level = inq_result[2 ] &0x07 ; + sdev->scsi_level = inq_result[2 ] &0x0f ;if (sdev->scsi_level >=2 || (sdev->scsi_level ==1 && (inq_result[3 ] &0x0f ) ==1 )) sdev->scsi_level++;
include/scsi/scsi.h +3 -0
@@ -157,6 +157,9 @@ enum scsi_disposition {#define SCSI_3 4/* SPC */ #define SCSI_SPC_2 5#define SCSI_SPC_3 6 +#define SCSI_SPC_4 7 +#define SCSI_SPC_5 8 +#define SCSI_SPC_6 14/* * INQ PERIPHERAL QUALIFIERS
Greg Kroah-Hartman
maintainerPATCH 254/321 serial: 8250_port: Check IRQ data before use
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
commit cce7fc8b29961b64fadb1ce398dc5ff32a79643b upstream.
In case the leaf driver wants to use IRQ polling (irq = 0) and IIR register shows that an interrupt happened in the 8250 hardware the IRQ data can be NULL. In such a case we need to skip the wake event as we came to this path from the timer interrupt and quite likely system is already awake.
Without this fix we have got an Oops:
serial8250: ttyS0 at I/O 0x3f8 (irq = 0, base_baud = 115200) is a 16550A
...
BUG: kernel NULL pointer dereference, address: 0000000000000010
RIP: 0010:serial8250_handle_irq+0x7c/0x240
Call Trace:
? serial8250_handle_irq+0x7c/0x240
? __pfx_serial8250_timeout+0x10/0x10--- drivers/tty/serial/8250/8250_port.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/tty/serial/8250/8250_port.c +4 -1
@@ -1929,7 +1929,10 @@ int serial8250_handle_irq(struct uart_po skip_rx = true;if (status & (UART_LSR_DR |UART_LSR_BI ) && !skip_rx) { -if (irqd_is_wakeup_set (irq_get_irq_data (port->irq))) +struct irq_data *d; + + d =irq_get_irq_data (port->irq); +if (d &&irqd_is_wakeup_set (d))pm_wakeup_event (tport->tty->dev,0 );if (!up->dma ||handle_rx_dma (up, iir)) status =serial8250_rx_chars (up, status);
Greg Kroah-Hartman
maintainerPATCH 255/321 nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pan Bian <[email protected]>
commit 7ee29facd8a9c5a26079148e36bcf07141b3a6bc upstream.
In nilfs_gccache_submit_read_data(), brelse(bh) is called to drop the reference count of bh when the call to nilfs_dat_translate() fails. If the reference count hits 0 and its owner page gets unlocked, bh may be freed. However, bh->b_page is dereferenced to put the page after that, which may result in a use-after-free bug. This patch moves the release operation after unlocking and putting the page.
NOTE: The function in question is only called in GC, and in combination with current userland tools, address translation using DAT does not occur in that function, so the code path that causes this issue will not be executed. However, it is possible to run that code path by intentionally modifying the userland GC library or by calling the GC ioctl directly.
--- fs/nilfs2/gcinode.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
fs/nilfs2/gcinode.c +3 -3
@@ -73,10 +73,8 @@ int nilfs_gccache_submit_read_data(strucstruct the_nilfs *nilfs = inode->i_sb->s_fs_info; err =nilfs_dat_translate (nilfs->ns_dat, vbn, &pbn); -if (unlikely (err)) {/* -EIO, -ENOMEM, -ENOENT */ -brelse (bh); +if (unlikely (err))/* -EIO, -ENOMEM, -ENOENT */ goto failed; - } }lock_buffer (bh);
@@ -102,6 +100,8 @@ int nilfs_gccache_submit_read_data(struc failed:unlock_page (bh->b_page);put_page (bh->b_page); +if (unlikely (err)) +brelse (bh);return err; }
Greg Kroah-Hartman
maintainerPATCH 256/321 crypto: sm2 - Fix crash caused by uninitialized context
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tianjia Zhang <[email protected]>
commit 21155620fbf2edbb071144894ff9d67ba9a1faa0 upstream.
In sm2_compute_z_digest() function, the newly allocated structure mpi_ec_ctx is used, but forget to initialize it, which will cause a crash when performing subsequent operations.
--- crypto/sm2.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
crypto/sm2.c +5 -1
@@ -278,10 +278,14 @@ int sm2_compute_z_digest(struct shash_desc *desc,if (!ec)return -ENOMEM ; - err =__sm2_set_pub_key (ec, key, keylen); + err =sm2_ec_ctx_init (ec);if (err) goto out_free_ec; + err =__sm2_set_pub_key (ec, key, keylen); +if (err) + goto out_deinit_ec; + bits_len =SM2_DEFAULT_USERID_LEN *8 ; entl[0 ] = bits_len >>8 ; entl[1 ] = bits_len &0xff ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 257/321 ALSA: rawmidi: Fix NULL dereference at proc read
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit b2ce0027d7b2905495021c5208f92043eb493146 upstream.
At the implementation of the optional proc fs in rawmidi, I forgot that rmidi->ops itself is optional and can be NULL.
Add the proper NULL check for avoiding the Oops.
--- sound/core/rawmidi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/core/rawmidi.c +1 -1
@@ -1770,7 +1770,7 @@ static void snd_rawmidi_proc_info_read(struct snd_info_entry *entry,if (IS_ENABLED (CONFIG_SND_UMP ))snd_iprintf (buffer,"Type: %s\n" ,rawmidi_is_ump (rmidi) ?"UMP" :"Legacy" ); -if (rmidi->ops->proc_read) +if (rmidi->ops && rmidi->ops->proc_read) rmidi->ops->proc_read (entry, buffer);mutex_lock (&rmidi->open_mutex);if (rmidi->info_flags &SNDRV_RAWMIDI_INFO_OUTPUT ) {
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 258/321 ALSA: hda: Disable power save for solving pop issue on Lenovo ThinkCentre M70q
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kailang Yang <[email protected]>
commit 057a28ef93bdbe84326d34cdb5543afdaab49fe1 upstream.
Lenovo ThinkCentre M70q had boot up pop noise.
Disable power save will solve pop issue.
--- sound/pci/hda/hda_intel.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/hda_intel.c +1 -0
@@ -2223,6 +2223,7 @@ static const struct snd_pci_quirk power_SND_PCI_QUIRK (0x8086 ,0x2068 ,"Intel NUC7i3BNB" ,0 ),/* https://bugzilla.kernel.org/show_bug.cgi?id=198611 */ SND_PCI_QUIRK (0x17aa ,0x2227 ,"Lenovo X1 Carbon 3rd Gen" ,0 ), +SND_PCI_QUIRK (0x17aa ,0x316e ,"Lenovo ThinkCentre M70q" ,0 ),/* https://bugzilla.redhat.com/show_bug.cgi?id=1689623 */ SND_PCI_QUIRK(0x17aa, 0x367b, "Lenovo IdeaCentre B550", 0),/* https://bugzilla.redhat.com/show_bug.cgi?id=1572975 */
Greg Kroah-Hartman
maintainerPATCH 259/321 LoongArch: Fix lockdep static memory detection
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <[email protected]>
commit 68ffa230daa0d35b7cce476098433d763d5fd42f upstream.
Since commit 0a6b58c5cd0d ("lockdep: fix static memory detection even more") the lockdep code uses is_kernel_core_data(), is_kernel_rodata() and init_section_contains() to verify if a lock is located inside a kernel static data section.
This change triggers a failure on LoongArch, for which the vmlinux.lds.S script misses to put the locks (as part of in the .data.rel symbols) into the Linux data section.
This patch fixes the lockdep problem by moving *(.data.rel*) symbols into the kernel data section (from _sdata to _edata).
Additionally, move other wrongly assigned symbols too:
- altinstructions into the _initdata section,
- PLT symbols behind the read-only section, and
- *(.la_abs) into the data section.
--- arch/loongarch/kernel/vmlinux.lds.S | 55 ++++++++++++++++++------------------ 1 file changed, 28 insertions(+), 27 deletions(-)
arch/loongarch/kernel/vmlinux.lds.S +28 -27
@@ -53,33 +53,6 @@ SECTIONS . = ALIGN(PECOFF_SEGMENT_ALIGN); _etext = .; - /* - * struct alt_inst entries. From the header (alternative.h): - * "Alternative instructions for different CPU types or capabilities" - * Think locking instructions on spinlocks. - */ - . = ALIGN(4); - .altinstructions : AT(ADDR(.altinstructions) - LOAD_OFFSET) { - __alt_instructions = .; - *(.altinstructions) - __alt_instructions_end = .; - } - -#ifdef CONFIG_RELOCATABLE - . = ALIGN(8); - .la_abs : AT(ADDR(.la_abs) - LOAD_OFFSET) { - __la_abs_begin = .; - *(.la_abs) - __la_abs_end = .; - } -#endif - - .got : ALIGN(16) { *(.got) } - .plt : ALIGN(16) { *(.plt) } - .got.plt : ALIGN(16) { *(.got.plt) } - - .data.rel : { *(.data.rel*) } - . = ALIGN(PECOFF_SEGMENT_ALIGN); __init_begin = .; __inittext_begin = .;
@@ -94,6 +67,18 @@ SECTIONS __initdata_begin = .; + /* + * struct alt_inst entries. From the header (alternative.h): + * "Alternative instructions for different CPU types or capabilities" + * Think locking instructions on spinlocks. + */ + . = ALIGN(4); + .altinstructions : AT(ADDR(.altinstructions) - LOAD_OFFSET) { + __alt_instructions = .; + *(.altinstructions) + __alt_instructions_end = .; + } + INIT_DATA_SECTION(16) .exit.data : { EXIT_DATA
@@ -113,6 +98,11 @@ SECTIONS _sdata = .; RO_DATA(4096) + + .got : ALIGN(16) { *(.got) } + .plt : ALIGN(16) { *(.plt) } + .got.plt : ALIGN(16) { *(.got.plt) } + RW_DATA(1 << CONFIG_L1_CACHE_SHIFT, PAGE_SIZE, THREAD_SIZE) .rela.dyn : ALIGN(8) {
@@ -121,6 +111,17 @@ SECTIONS __rela_dyn_end = .; } + .data.rel : { *(.data.rel*) } + +#ifdef CONFIG_RELOCATABLE + . = ALIGN(8); + .la_abs : AT(ADDR(.la_abs) - LOAD_OFFSET) { + __la_abs_begin = .; + *(.la_abs) + __la_abs_end = .; + } +#endif + .sdata : { *(.sdata) }
Greg Kroah-Hartman
maintainerPATCH 260/321 LoongArch: Define relocation types for ABI v2.10
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiezhu Yang <[email protected]>
commit 2761498876adebff77a43574639005b29e912c43 upstream.
The relocation types from 101 to 109 are used by GNU binutils >= 2.41, add their definitions to use them in later patches.
--- arch/loongarch/include/asm/elf.h | 9 +++++++++ arch/loongarch/kernel/module.c | 2 +- 2 files changed, 10 insertions(+), 1 deletion(-)
arch/loongarch/include/asm/elf.h +9 -0
@@ -111,6 +111,15 @@#define R_LARCH_TLS_GD_HI20 98#define R_LARCH_32_PCREL 99#define R_LARCH_RELAX 100 +#define R_LARCH_DELETE 101 +#define R_LARCH_ALIGN 102 +#define R_LARCH_PCREL20_S2 103 +#define R_LARCH_CFA 104 +#define R_LARCH_ADD6 105 +#define R_LARCH_SUB6 106 +#define R_LARCH_ADD_ULEB128 107 +#define R_LARCH_SUB_ULEB128 108 +#define R_LARCH_64_PCREL 109#ifndef ELF_ARCH
arch/loongarch/kernel/module.c +1 -1
@@ -382,7 +382,7 @@ typedef int (*reloc_rela_handler)(struct/* The handlers for known reloc types */ static reloc_rela_handler reloc_rela_handlers[] = { - [R_LARCH_NONE ...R_LARCH_RELAX ] = apply_r_larch_error, + [R_LARCH_NONE ...R_LARCH_64_PCREL ] = apply_r_larch_error, [R_LARCH_NONE ] = apply_r_larch_none, [R_LARCH_32 ] = apply_r_larch_32,
Greg Kroah-Hartman
maintainerPATCH 261/321 LoongArch: numa: Fix high_memory calculation
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
commit 1943feecf80e73ecc03ce40271f29c6cea142bac upstream.
For 64bit kernel without HIGHMEM, high_memory is the virtual address of the highest physical address in the system. But __va(get_num_physpages() << PAGE_SHIFT) is not what we want for high_memory because there may be holes in the physical address space. On the other hand, max_low_pfn is calculated from memblock_end_of_DRAM(), which is exactly corresponding to the highest physical address, so use it for high_memory calculation.
--- arch/loongarch/kernel/numa.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/loongarch/kernel/numa.c +1 -1
@@ -468,7 +468,7 @@ void __init paging_init(void)void __init mem_init (void ) { - high_memory = (void *)__va (get_num_physpages () <<PAGE_SHIFT ); + high_memory = (void *)__va (max_low_pfn <<PAGE_SHIFT );memblock_free_all ();setup_zero_pages ();/* This comes from node 0 */ }
Greg Kroah-Hartman
maintainerPATCH 262/321 LoongArch: Add support for 32_PCREL relocation type
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiezhu Yang <[email protected]>
commit c1c2ce2d3bf903c50f3da7346d394127ffcc93ac upstream.
When build and update kernel with the latest upstream binutils and loongson3_defconfig, module loader fails with:
kmod: zsmalloc: Unsupport relocation type 99, please add its support.
kmod: fuse: Unsupport relocation type 99, please add its support.
kmod: ipmi_msghandler: Unsupport relocation type 99, please add its support.
kmod: ipmi_msghandler: Unsupport relocation type 99, please add its support.
kmod: pstore: Unsupport relocation type 99, please add its support.
kmod: drm_display_helper: Unsupport relocation type 99, please add its support.
kmod: drm_display_helper: Unsupport relocation type 99, please add its support.
kmod: drm_display_helper: Unsupport relocation type 99, please add its support.
kmod: fuse: Unsupport relocation type 99, please add its support.
kmod: fat: Unsupport relocation type 99, please add its support.
This is because the latest upstream binutils replaces a pair of ADD32 and SUB32 with 32_PCREL, so add support for 32_PCREL relocation type.
--- arch/loongarch/kernel/module.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
arch/loongarch/kernel/module.c +10 -0
@@ -367,6 +367,15 @@ static int apply_r_larch_got_pc(struct mreturn apply_r_larch_pcala (mod, location, got, rela_stack, rela_stack_top, type); } +static int apply_r_larch_32_pcrel (struct module *mod,u32 *location,Elf_Addr v, +s64 *rela_stack,size_t *rela_stack_top,unsigned int type) +{ +ptrdiff_t offset = (void *)v - (void *)location; + + *(u32 *)location = offset; +return 0 ; +} +/* * reloc_handlers_rela() - Apply a particular relocation to a module * @mod: the module to apply the reloc to
@@ -396,6 +405,7 @@ static reloc_rela_handler reloc_rela_han [R_LARCH_SOP_POP_32_S_10_5 ... R_LARCH_SOP_POP_32_U] = apply_r_larch_sop_imm_field, [R_LARCH_ADD32 ... R_LARCH_SUB64] = apply_r_larch_add_sub, [R_LARCH_PCALA_HI20...R_LARCH_PCALA64_HI12] = apply_r_larch_pcala, + [R_LARCH_32_PCREL] = apply_r_larch_32_pcrel, }; int apply_relocate_add(Elf_Shdr *sechdrs, const char *strtab,
Greg Kroah-Hartman
maintainerPATCH 263/321 LoongArch: Add support for 64_PCREL relocation type
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiezhu Yang <[email protected]>
commit b1dc55a3d6a86cc2c1ae664ad7280bff4c0fc28f upstream.
When build and update kernel with the latest upstream binutils and loongson3_defconfig, module loader fails with:
kmod: zsmalloc: Unknown relocation type 109
kmod: fuse: Unknown relocation type 109
kmod: fuse: Unknown relocation type 109
kmod: radeon: Unknown relocation type 109
kmod: nf_tables: Unknown relocation type 109
kmod: nf_tables: Unknown relocation type 109
This is because the latest upstream binutils replaces a pair of ADD64 and SUB64 with 64_PCREL, so add support for 64_PCREL relocation type.
--- arch/loongarch/kernel/module.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
arch/loongarch/kernel/module.c +10 -0
@@ -376,6 +376,15 @@ static int apply_r_larch_32_pcrel(structreturn 0 ; } +static int apply_r_larch_64_pcrel (struct module *mod,u32 *location,Elf_Addr v, +s64 *rela_stack,size_t *rela_stack_top,unsigned int type) +{ +ptrdiff_t offset = (void *)v - (void *)location; + + *(u64 *)location = offset; +return 0 ; +} +/* * reloc_handlers_rela() - Apply a particular relocation to a module * @mod: the module to apply the reloc to
@@ -406,6 +415,7 @@ static reloc_rela_handler reloc_rela_han [R_LARCH_ADD32 ... R_LARCH_SUB64] = apply_r_larch_add_sub, [R_LARCH_PCALA_HI20...R_LARCH_PCALA64_HI12] = apply_r_larch_pcala, [R_LARCH_32_PCREL] = apply_r_larch_32_pcrel, + [R_LARCH_64_PCREL] = apply_r_larch_64_pcrel, }; int apply_relocate_add(Elf_Shdr *sechdrs, const char *strtab,
Greg Kroah-Hartman
maintainerPATCH 264/321 ata: libata-scsi: link ata port and scsi device
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
commit fb99ef17865035a6657786d4b2af11a27ba23f9b upstream.
There is no direct device ancestry defined between an ata_device and its scsi device which prevents the power management code from correctly ordering suspend and resume operations. Create such ancestry with the ata device as the parent to ensure that the scsi device (child) is suspended before the ata device and that resume handles the ata device before the scsi device.
The parent-child (supplier-consumer) relationship is established between the ata_port (parent) and the scsi device (child) with the function device_add_link(). The parent used is not the ata_device as the PM operations are defined per port and the status of all devices connected through that port is controlled from the port operations.
The device link is established with the new function ata_scsi_slave_alloc(), and this function is used to define the ->slave_alloc callback of the scsi host template of all ata drivers.
--- drivers/ata/libata-scsi.c | 45 ++++++++++++++++++++++++++++++++++++++++----- include/linux/libata.h | 2 ++ 2 files changed, 42 insertions(+), 5 deletions(-)
drivers/ata/libata-scsi.c +40 -5
@@ -1140,6 +1140,42 @@ int ata_scsi_dev_config(struct scsi_devi }/** +* ata_scsi_slave_alloc - Early setup of SCSI device +* @sdev: SCSI device to examine +* +* This is called from scsi_alloc_sdev() when the scsi device +* associated with an ATA device is scanned on a port. +* +* LOCKING: +* Defined by SCSI layer. We don't really care. +*/ + +int ata_scsi_slave_alloc (struct scsi_device *sdev) +{ +struct ata_port *ap =ata_shost_to_port (sdev->host); +struct device_link *link; + +ata_scsi_sdev_config (sdev); + +/* +* Create a link from the ata_port device to the scsi device to ensure +* that PM does suspend/resume in the correct order: the scsi device is +* consumer (child) and the ata port the supplier (parent). +*/ + link =device_link_add (&sdev->sdev_gendev, &ap->tdev, +DL_FLAG_STATELESS | +DL_FLAG_PM_RUNTIME |DL_FLAG_RPM_ACTIVE ); +if (!link) { +ata_port_err (ap,"Failed to create link to scsi device %s\n" , +dev_name (&sdev->sdev_gendev)); +return -ENODEV ; + } + +return 0 ; +} +EXPORT_SYMBOL_GPL (ata_scsi_slave_alloc); + +/** * ata_scsi_slave_config - Set SCSI device attributes * @sdev: SCSI device to examine *
@@ -1155,14 +1191,11 @@ int ata_scsi_slave_config(struct scsi_de {struct ata_port *ap =ata_shost_to_port (sdev->host);struct ata_device *dev =__ata_scsi_find_dev (ap, sdev); -int rc =0 ; - -ata_scsi_sdev_config (sdev);if (dev) - rc =ata_scsi_dev_config (sdev, dev); +return ata_scsi_dev_config (sdev, dev); -return rc; +return 0 ; }EXPORT_SYMBOL_GPL (ata_scsi_slave_config);
@@ -1189,6 +1222,8 @@ void ata_scsi_slave_destroy(struct scsi_if (!ap->ops->error_handler)return ; +device_link_remove (&sdev->sdev_gendev, &ap->tdev); +spin_lock_irqsave (ap->lock, flags); dev =__ata_scsi_find_dev (ap, sdev);if (dev && dev->sdev) {
include/linux/libata.h +2 -0
@@ -1155,6 +1155,7 @@ extern int ata_std_bios_param(struct scsstruct block_device *bdev, sector_t capacity, int geom[]);extern void ata_scsi_unlock_native_capacity (struct scsi_device *sdev); +extern int ata_scsi_slave_alloc (struct scsi_device *sdev);extern int ata_scsi_slave_config (struct scsi_device *sdev);extern void ata_scsi_slave_destroy (struct scsi_device *sdev); extern int ata_scsi_change_queue_depth(struct scsi_device *sdev,
@@ -1408,6 +1409,7 @@ extern const struct attribute_group *ata .this_id = ATA_SHT_THIS_ID, \ .emulated = ATA_SHT_EMULATED, \ .proc_name = drv_name, \ + .slave_alloc = ata_scsi_slave_alloc, \ .slave_destroy = ata_scsi_slave_destroy, \ .bios_param = ata_std_bios_param, \ .unlock_native_capacity = ata_scsi_unlock_native_capacity,\
Greg Kroah-Hartman
maintainerPATCH 265/321 scsi: sd: Differentiate system and runtime start/stop management
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
commit 3cc2ffe5c16dc65dfac354bc5b5bc98d3b397567 upstream.
The underlying device and driver of a SCSI disk may have different system and runtime power mode control requirements. This is because runtime power management affects only the SCSI disk, while system level power management affects all devices, including the controller for the SCSI disk.
For instance, issuing a START STOP UNIT command when a SCSI disk is runtime suspended and resumed is fine: the command is translated to a STANDBY IMMEDIATE command to spin down the ATA disk and to a VERIFY command to wake it up. The SCSI disk runtime operations have no effect on the ata port device used to connect the ATA disk. However, for system suspend/resume operations, the ATA port used to connect the device will also be suspended and resumed, with the resume operation requiring re-validating the device link and the device itself. In this case, issuing a VERIFY command to spinup the disk must be done before starting to revalidate the device, when the ata port is being resumed. In such case, we must not allow the SCSI disk driver to issue START STOP UNIT commands.
Allow a low level driver to refine the SCSI disk start/stop management by differentiating system and runtime cases with two new SCSI device
flags: manage_system_start_stop and manage_runtime_start_stop. These new flags replace the current manage_start_stop flag. Drivers setting the manage_start_stop are modifed to set both new flags, thus preserving the existing start/stop management behavior. For backward compatibility, the old manage_start_stop sysfs device attribute is kept as a read-only attribute showing a value of 1 for devices enabling both new flags and 0 otherwise.
--- drivers/ata/libata-scsi.c | 3 + drivers/firewire/sbp2.c | 9 +++- drivers/scsi/sd.c | 90 ++++++++++++++++++++++++++++++++++++--------- include/scsi/scsi_device.h | 5 ++ 4 files changed, 84 insertions(+), 23 deletions(-)
drivers/ata/libata-scsi.c +2 -1
@@ -1106,7 +1106,8 @@ int ata_scsi_dev_config(struct scsi_devi* will be woken up by ata_port_pm_resume() with a port reset * and device revalidation. */ - sdev->manage_start_stop =1 ; + sdev->manage_system_start_stop = true; + sdev->manage_runtime_start_stop = true; sdev->no_start_on_resume =1 ; }
drivers/firewire/sbp2.c +6 -3
@@ -81,7 +81,8 @@ MODULE_PARM_DESC(exclusive_login, "Exclu* * - power condition * Set the power condition field in the START STOP UNIT commands sent by -* sd_mod on suspend, resume, and shutdown (if manage_start_stop is on). +* sd_mod on suspend, resume, and shutdown (if manage_system_start_stop or +* manage_runtime_start_stop is on). * Some disks need this to spin down or to resume properly. * * - override internal blacklist
@@ -1517,8 +1518,10 @@ static int sbp2_scsi_slave_configure(str sdev->use_10_for_rw =1 ; -if (sbp2_param_exclusive_login) - sdev->manage_start_stop =1 ; +if (sbp2_param_exclusive_login) { + sdev->manage_system_start_stop = true; + sdev->manage_runtime_start_stop = true; + }if (sdev->type ==TYPE_ROM ) sdev->use_10_for_ms =1 ;
drivers/scsi/sd.c +72 -18
169 lines not on this page · raw message
include/scsi/scsi_device.h +4 -1
@@ -161,6 +161,10 @@ struct scsi_device {* pass settings from slave_alloc to scsi * core. */ unsigned int eh_timeout;/* Error handling timeout */ + +bool manage_system_start_stop;/* Let HLD (sd) manage system start/stop */ +bool manage_runtime_start_stop;/* Let HLD (sd) manage runtime start/stop */ + unsigned removable:1; unsigned changed:1; /* Data invalid due to media change */ unsigned busy:1; /* Used to prevent races */
@@ -193,7 +197,6 @@ struct scsi_device { unsigned use_192_bytes_for_3f:1; /* ask for 192 bytes from page 0x3f */ unsigned no_start_on_add:1; /* do not issue start on add */ unsigned allow_restart:1; /* issue START_UNIT in error handler */ - unsigned manage_start_stop:1; /* Let HLD (sd) manage start/stop */ unsigned no_start_on_resume:1; /* Do not issue START_STOP_UNIT on resume */ unsigned start_stop_pwr_cond:1; /* Set power cond. in START_STOP_UNIT */ unsigned no_uld_attach:1; /* disable connecting to upper level drivers */
Greg Kroah-Hartman
maintainerPATCH 266/321 scsi: sd: Do not issue commands to suspended disks on shutdown
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
commit 99398d2070ab03d13f90b758ad397e19a65fffb0 upstream.
If an error occurs when resuming a host adapter before the devices attached to the adapter are resumed, the adapter low level driver may remove the scsi host, resulting in a call to sd_remove() for the disks of the host. This in turn results in a call to sd_shutdown() which will issue a synchronize cache command and a start stop unit command to spindown the disk. sd_shutdown() issues the commands only if the device is not already runtime suspended but does not check the power state for system-wide suspend/resume. That is, the commands may be issued with the device in a suspended state, which causes PM resume to hang, forcing a reset of the machine to recover.
Fix this by tracking the suspended state of a disk by introducing the suspended boolean field in the scsi_disk structure. This flag is set to true when the disk is suspended is sd_suspend_common() and resumed with sd_resume(). When suspended is true, sd_shutdown() is not executed from sd_remove().
--- drivers/scsi/sd.c | 17 +++++++++++++---- drivers/scsi/sd.h | 1 + 2 files changed, 14 insertions(+), 4 deletions(-)
drivers/scsi/sd.c +13 -4
@@ -3780,7 +3780,8 @@ static int sd_remove(struct device *dev)device_del (&sdkp->disk_dev);del_gendisk (sdkp->disk); -sd_shutdown (dev); +if (!sdkp->suspended) +sd_shutdown (dev);put_disk (sdkp->disk);return 0 ;
@@ -3911,6 +3912,9 @@ static int sd_suspend_common(struct devi ret =0 ; } +if (!ret) + sdkp->suspended = true; +return ret; }
@@ -3930,21 +3934,26 @@ static int sd_suspend_runtime(struct devstatic int sd_resume (struct device *dev,bool runtime) {struct scsi_disk *sdkp =dev_get_drvdata (dev); -int ret; +int ret =0 ;if (!sdkp)/* E.g.: runtime resume at the start of sd_probe() */ return 0 ; -if (!sd_do_start_stop (sdkp->device, runtime)) +if (!sd_do_start_stop (sdkp->device, runtime)) { + sdkp->suspended = false;return 0 ; + }if (!sdkp->device->no_start_on_resume) {sd_printk (KERN_NOTICE , sdkp,"Starting disk\n" ); ret =sd_start_stop_device (sdkp,1 ); } -if (!ret) +if (!ret) {opal_unlock_from_suspend (sdkp->opal_dev); + sdkp->suspended = false; + } +return ret; }
drivers/scsi/sd.h +1 -0
@@ -131,6 +131,7 @@ struct scsi_disk {u8 provisioning_mode;u8 zeroing_mode;u8 nr_actuators;/* Number of actuators */ +bool suspended;/* Disk is suspended (stopped) */ unsigned ATO : 1; /* state of disk ATO bit */ unsigned cache_override : 1; /* temp override of WCE,RCD */ unsigned WCE : 1; /* state of disk WCE bit */
Greg Kroah-Hartman
maintainerPATCH 267/321 ata: libata-scsi: ignore reserved bits for REPORT SUPPORTED OPERATION CODES
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <[email protected]>
commit 3ef600923521616ebe192c893468ad0424de2afb upstream.
For REPORT SUPPORTED OPERATION CODES command, the service action field is defined as bits 0-4 in the second byte in the CDB. Bits 5-7 in the second byte are reserved.
Only look at the service action field in the second byte when determining if the MAINTENANCE IN opcode is a REPORT SUPPORTED OPERATION CODES command.
This matches how we only look at the service action field in the second byte when determining if the SERVICE ACTION IN(16) opcode is a READ CAPACITY(16) command (reserved bits 5-7 in the second byte are ignored).
--- drivers/ata/libata-scsi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/ata/libata-scsi.c +1 -1
@@ -4487,7 +4487,7 @@ void ata_scsi_simulate(struct ata_devicebreak ;case MAINTENANCE_IN : -if (scsicmd[1 ] ==MI_REPORT_SUPPORTED_OPERATION_CODES ) +if ((scsicmd[1 ] &0x1f ) ==MI_REPORT_SUPPORTED_OPERATION_CODES )ata_scsi_rbuf_fill (&args, ata_scsiop_maint_in);else ata_scsi_set_invalid_field (dev, cmd,1 ,0xff );
Greg Kroah-Hartman
maintainerPATCH 268/321 io_uring/fs: remove sqe->rw_flags checking from LINKAT
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <[email protected]>
commit a52d4f657568d6458e873f74a9602e022afe666f upstream.
This is unionized with the actual link flags, so they can of course be set and they will be evaluated further down. If not we fail any LINKAT that has to set option flags.
--- io_uring/fs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
io_uring/fs.c +1 -1
@@ -243,7 +243,7 @@ int io_linkat_prep(struct io_kiocb *req, struct io_link *lnk = io_kiocb_to_cmd(req, struct io_link);const char __user *oldf, *newf; -if (sqe->rw_flags || sqe->buf_index || sqe->splice_fd_in) +if (sqe->buf_index || sqe->splice_fd_in)return -EINVAL ;if (unlikely (req->flags &REQ_F_FIXED_FILE ))return -EBADF ;
Greg Kroah-Hartman
maintainerPATCH 269/321 i2c: i801: unregister tco_pdev in i801_probe() error path
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiner Kallweit <[email protected]>
commit 3914784553f68c931fc666dbe7e86fe881aada38 upstream.
We have to unregister tco_pdev also if i2c_add_adapter() fails.
--- drivers/i2c/busses/i2c-i801.c | 1 + 1 file changed, 1 insertion(+)
drivers/i2c/busses/i2c-i801.c +1 -0
@@ -1754,6 +1754,7 @@ static int i801_probe(struct pci_dev *de "SMBus I801 adapter at %04lx", priv->smba); err =i2c_add_adapter (&priv->adapter);if (err) { +platform_device_unregister (priv->tco_pdev);i801_acpi_remove (priv);return err; }
Greg Kroah-Hartman
maintainerPATCH 270/321 ASoC: amd: yc: Fix non-functional mic on Lenovo 82QF and 82UG
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: August Wikerfors <[email protected]>
commit 1263cc0f414d212129c0f1289b49b7df77f92084 upstream.
Like the Lenovo 82TL and 82V2, the Lenovo 82QF (Yoga 7 14ARB7) and 82UG (Legion S7 16ARHA7) both need a quirk entry for the internal microphone to function. Commit c008323fe361 ("ASoC: amd: yc: Fix a non-functional mic on Lenovo 82SJ") restricted the quirk that previously matched "82" to "82V2", breaking microphone functionality on these devices. Fix this by adding specific quirks for these models, as was done for the Lenovo 82TL.
--- sound/soc/amd/yc/acp6x-mach.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
sound/soc/amd/yc/acp6x-mach.c +14 -0
@@ -217,10 +217,24 @@ static const struct dmi_system_id yc_acp .driver_data = &acp6x_card, .matches = {DMI_MATCH (DMI_BOARD_VENDOR ,"LENOVO" ), + DMI_MATCH(DMI_PRODUCT_NAME, "82QF"), + } + }, + { + .driver_data = &acp6x_card, + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"LENOVO" ), DMI_MATCH(DMI_PRODUCT_NAME, "82V2"), } }, { + .driver_data = &acp6x_card, + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"LENOVO" ), + DMI_MATCH(DMI_PRODUCT_NAME, "82UG"), + } + }, + { .driver_data = &acp6x_card, .matches = { DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."),
Greg Kroah-Hartman
maintainerPATCH 271/321 kernel/sched: Modify initial boot task idle setup
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liam R. Howlett <[email protected]>
commit cff9b2332ab762b7e0586c793c431a8f2ea4db04 upstream.
Initial booting is setting the task flag to idle (PF_IDLE) by the call path sched_init() -> init_idle(). Having the task idle and calling call_rcu() in kernel/rcu/tiny.c means that TIF_NEED_RESCHED will be set. Subsequent calls to any cond_resched() will enable IRQs, potentially earlier than the IRQ setup has completed. Recent changes have caused just this scenario and IRQs have been enabled early.
This causes a warning later in start_kernel() as interrupts are enabled before they are fully set up.
Fix this issue by setting the PF_IDLE flag later in the boot sequence.
Although the boot task was marked as idle since (at least) d80e4fda576d, I am not sure that it is wrong to do so. The forced context-switch on idle task was introduced in the tiny_rcu update, so I'm going to claim this fixes 5f6130fa52ee.
--- kernel/sched/core.c | 2 +- kernel/sched/idle.c | 1 + 2 files changed, 2 insertions(+), 1 deletion(-)
kernel/sched/core.c +1 -1
@@ -9271,7 +9271,7 @@ void __init init_idle(struct task_struct* PF_KTHREAD should already be set at this point; regardless, make it * look like a proper per-CPU kthread. */ - idle->flags |=PF_IDLE |PF_KTHREAD |PF_NO_SETAFFINITY ; + idle->flags |=PF_KTHREAD |PF_NO_SETAFFINITY ;kthread_set_per_cpu (idle, cpu);#ifdef CONFIG_SMP
kernel/sched/idle.c +1 -0
@@ -373,6 +373,7 @@ EXPORT_SYMBOL_GPL(play_idle_precise);void cpu_startup_entry (enum cpuhp_state state) { + current->flags |=PF_IDLE ;arch_cpu_idle_prepare ();cpuhp_online_idle (state);while (1 )
Greg Kroah-Hartman
maintainerPATCH 272/321 sched/rt: Fix live lock between select_fallback_rq() and RT push
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joel Fernandes (Google) <[email protected]>
commit fc09027786c900368de98d03d40af058bcb01ad9 upstream.
During RCU-boost testing with the TREE03 rcutorture config, I found that after a few hours, the machine locks up.
On tracing, I found that there is a live lock happening between 2 CPUs. One CPU has an RT task running, while another CPU is being offlined which also has an RT task running. During this offlining, all threads are migrated. The migration thread is repeatedly scheduled to migrate actively running tasks on the CPU being offlined. This results in a live lock because select_fallback_rq() keeps picking the CPU that an RT task is already running on only to get pushed back to the CPU being offlined.
It is anyway pointless to pick CPUs for pushing tasks to if they are being offlined only to get migrated away to somewhere else. This could also add unwanted latency to this task.
Fix these issues by not selecting CPUs in RT if they are not 'active' for scheduling, using the cpu_active_mask. Other parts in core.c already use cpu_active_mask to prevent tasks from being put on CPUs going offline.
With this fix I ran the tests for days and could not reproduce the hang. Without the patch, I hit it in a few hours.
--- kernel/sched/cpupri.c | 1 + 1 file changed, 1 insertion(+)
kernel/sched/cpupri.c +1 -0
@@ -101,6 +101,7 @@ static inline int __cpupri_find(struct cif (lowest_mask) {cpumask_and (lowest_mask, &p->cpus_mask, vec->mask); +cpumask_and (lowest_mask, lowest_mask, cpu_active_mask);/* * We have to ensure that we have at least one bit
Greg Kroah-Hartman
maintainerPATCH 273/321 Revert "SUNRPC dont update timeout value on connection reset"
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
commit a275ab62606bcd894ddff09460f7d253828313dc upstream.
This reverts commit 88428cc4ae7abcc879295fbb19373dd76aad2bdd.
The problem this commit is intended to fix was comprehensively fixed in commit 7de62bc09fe6 ("SUNRPC dont update timeout value on connection reset").
Since then, this commit has been preventing the correct timeout of soft mounted requests.
--- net/sunrpc/clnt.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
net/sunrpc/clnt.c +1 -2
@@ -2474,8 +2474,7 @@ call_status(struct rpc_task *task) goto out_exit; } task->tk_action = call_encode; -if (status != -ECONNRESET && status != -ECONNABORTED ) -rpc_check_timeout (task); +rpc_check_timeout (task);return ; out_exit:rpc_call_rpcerror (task, status);
Greg Kroah-Hartman
maintainerPATCH 274/321 NFSv4: Fix a state manager thread deadlock regression
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
commit 956fd46f97d238032cb5fa4771cdaccc6e760f9a upstream.
Commit 4dc73c679114 reintroduces the deadlock that was fixed by commit aeabb3c96186 ("NFSv4: Fix a NFSv4 state manager deadlock") because it prevents the setup of new threads to handle reboot recovery, while the older recovery thread is stuck returning delegations.
--- fs/nfs/nfs4proc.c | 4 +++- fs/nfs/nfs4state.c | 38 ++++++++++++++++++++++++++------------ 2 files changed, 29 insertions(+), 13 deletions(-)
fs/nfs/nfs4proc.c +3 -1
@@ -10622,7 +10622,9 @@ static void nfs4_disable_swap(struct ino*/ struct nfs_client *clp =NFS_SERVER (inode)->nfs_client; -nfs4_schedule_state_manager (clp); +set_bit (NFS4CLNT_RUN_MANAGER , &clp->cl_state); +clear_bit (NFS4CLNT_MANAGER_AVAILABLE , &clp->cl_state); +wake_up_var (&clp->cl_state); }static const struct inode_operations nfs4_dir_inode_operations = {
fs/nfs/nfs4state.c +26 -12
@@ -1209,16 +1209,26 @@ void nfs4_schedule_state_manager(struct {struct task_struct *task;char buf[INET6_ADDRSTRLEN +sizeof ("-manager" ) +1 ]; +struct rpc_clnt *clnt = clp->cl_rpcclient; +bool swapon = false; -if (clp->cl_rpcclient->cl_shutdown) +if (clnt->cl_shutdown)return ;set_bit (NFS4CLNT_RUN_MANAGER , &clp->cl_state); -if (test_and_set_bit (NFS4CLNT_MANAGER_AVAILABLE , &clp->cl_state) !=0 ) { -wake_up_var (&clp->cl_state); -return ; + +if (atomic_read (&clnt->cl_swapper)) { + swapon = !test_and_set_bit (NFS4CLNT_MANAGER_AVAILABLE , + &clp->cl_state); +if (!swapon) { +wake_up_var (&clp->cl_state); +return ; + } } -set_bit (NFS4CLNT_MANAGER_RUNNING , &clp->cl_state); + +if (test_and_set_bit (NFS4CLNT_MANAGER_RUNNING , &clp->cl_state) !=0 ) +return ; +__module_get (THIS_MODULE );refcount_inc (&clp->cl_count);
@@ -1235,8 +1245,9 @@ void nfs4_schedule_state_manager(struct __func__, PTR_ERR(task));if (!nfs_client_init_is_complete (clp))nfs_mark_client_ready (clp,PTR_ERR (task)); +if (swapon) +clear_bit (NFS4CLNT_MANAGER_AVAILABLE , &clp->cl_state);nfs4_clear_state_manager_bit (clp); -clear_bit (NFS4CLNT_MANAGER_AVAILABLE , &clp->cl_state);nfs_put_client (clp);module_put (THIS_MODULE ); }
@@ -2741,22 +2752,25 @@ static int nfs4_run_state_manager(void *allow_signal (SIGKILL ); again: -set_bit (NFS4CLNT_MANAGER_RUNNING , &clp->cl_state);nfs4_state_manager (clp); -if (atomic_read (&cl->cl_swapper)) { + +if (test_bit (NFS4CLNT_MANAGER_AVAILABLE , &clp->cl_state) && + !test_bit (NFS4CLNT_MANAGER_RUNNING , &clp->cl_state)) {wait_var_event_interruptible (&clp->cl_state,test_bit (NFS4CLNT_RUN_MANAGER , &clp->cl_state)); -if (atomic_read (&cl->cl_swapper) && -test_bit (NFS4CLNT_RUN_MANAGER , &clp->cl_state)) +if (!atomic_read (&cl->cl_swapper)) +clear_bit (NFS4CLNT_MANAGER_AVAILABLE , &clp->cl_state); +if (refcount_read (&clp->cl_count) >1 && !signalled () && + !test_and_set_bit (NFS4CLNT_MANAGER_RUNNING , &clp->cl_state)) goto again;/* Either no longer a swapper, or were signalled */ +clear_bit (NFS4CLNT_MANAGER_AVAILABLE , &clp->cl_state); } -clear_bit (NFS4CLNT_MANAGER_AVAILABLE , &clp->cl_state);if (refcount_read (&clp->cl_count) >1 && !signalled () &&test_bit (NFS4CLNT_RUN_MANAGER , &clp->cl_state) && - !test_and_set_bit (NFS4CLNT_MANAGER_AVAILABLE , &clp->cl_state)) + !test_and_set_bit (NFS4CLNT_MANAGER_RUNNING , &clp->cl_state)) goto again;nfs_put_client (clp);
Greg Kroah-Hartman
maintainerPATCH 275/321 ACPI: NFIT: Fix incorrect calculation of idt size
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Liao <[email protected]>
commit 33908660e814203e996f6e775d033c5c32fcf9a7 upstream.
acpi_nfit_interleave's field 'line_offset' is switched to flexible array [1], but sizeof_idt() still calculates the size in the form of 1-element array.
Therefore, fix incorrect calculation in sizeof_idt().
[1] https://lore.kernel.org/lkml/2652195.BddDVKsqQX@kreacher/
--- drivers/acpi/nfit/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/nfit/core.c +1 -1
@@ -855,7 +855,7 @@ static size_t sizeof_idt(struct acpi_nfit_interleave *idt) {if (idt->header.length <sizeof (*idt))return 0 ; -return sizeof (*idt) +sizeof (u32) * (idt->line_count -1 ); +return sizeof (*idt) +sizeof (u32) * idt->line_count; } static bool add_idt(struct acpi_nfit_desc *acpi_desc,
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 276/321 timers: Tag (hr)timer softirq as hotplug safe
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frederic Weisbecker <[email protected]>
commit 1a6a464774947920dcedcf7409be62495c7cedd0 upstream.
Specific stress involving frequent CPU-hotplug operations, such as running rcutorture for example, may trigger the following message:
NOHZ tick-stop error: local softirq work is pending, handler #02!!!"
This happens in the CPU-down hotplug process, after CPUHP_AP_SMPBOOT_THREADS whose teardown callback parks ksoftirqd, and before the target CPU shuts down through CPUHP_AP_IDLE_DEAD. In this fragile intermediate state, softirqs waiting for threaded handling may be forever ignored and eventually reported by the idle task as in the above example.
However some vectors are known to be safe as long as the corresponding subsystems have teardown callbacks handling the migration of their events. The above error message reports pending timers softirq although this vector can be considered as hotplug safe because the CPUHP_TIMERS_PREPARE teardown callback performs the necessary migration of timers after the death of the CPU. Hrtimers also have a similar hotplug handling.
Therefore this error message, as far as (hr-)timers are concerned, can be considered spurious and the relevant softirq vectors can be marked as hotplug safe.
--- include/linux/interrupt.h | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
include/linux/interrupt.h +5 -1
@@ -569,8 +569,12 @@ enum* 2) rcu_report_dead() reports the final quiescent states. * * _ IRQ_POLL: irq_poll_cpu_dead() migrates the queue +* +* _ (HR)TIMER_SOFTIRQ: (hr)timers_dead_cpu() migrates the queue */ -#define SOFTIRQ_HOTPLUG_SAFE_MASK (BIT(RCU_SOFTIRQ) | BIT(IRQ_POLL_SOFTIRQ)) +#define SOFTIRQ_HOTPLUG_SAFE_MASK (BIT(TIMER_SOFTIRQ) | BIT(IRQ_POLL_SOFTIRQ) |\ + BIT(HRTIMER_SOFTIRQ) | BIT(RCU_SOFTIRQ)) +/* map softirq index to softirq name. update 'softirq_to_name' in * kernel/softirq.c when adding a new softirq.
Greg Kroah-Hartman
maintainerPATCH 277/321 drm/tests: Fix incorrect argument in drm_test_mm_insert_range
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Janusz Krzysztofik <[email protected]>
commit 2ba157983974ae1b6aaef7d4953812020d6f1eb5 upstream.
While drm_mm test was converted form igt selftest to kunit, unexpected value of "end" argument equal "start" was introduced to one of calls to a function that executes the drm_test_mm_insert_range for specific start/end pair of arguments. As a consequence, DRM_MM_BUG_ON(end <= start) is triggered. Fix it by restoring the original value.
--- drivers/gpu/drm/tests/drm_mm_test.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/tests/drm_mm_test.c +1 -1
@@ -939,7 +939,7 @@ static void drm_test_mm_insert_range(strKUNIT_ASSERT_FALSE (test,__drm_test_mm_insert_range (test, count, size,0 , max -1 ));KUNIT_ASSERT_FALSE (test,__drm_test_mm_insert_range (test, count, size,0 , max /2 ));KUNIT_ASSERT_FALSE (test,__drm_test_mm_insert_range (test, count, size, - max /2 , max /2 )); + max /2 , max));KUNIT_ASSERT_FALSE (test,__drm_test_mm_insert_range (test, count, size, max /4 +1 ,3 * max /4 -1 ));
Greg Kroah-Hartman
maintainerPATCH 278/321 cxl/mbox: Fix CEL logic for poison and security commands
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ira Weiny <[email protected]>
commit d2f706058826b803f5b9dc3f6d4c213ae0c54eb9 upstream.
The following debug output was observed while testing CXL
cxl_core:cxl_walk_cel:721: cxl_mock_mem cxl_mem.0: Opcode 0x4300 unsupported by driver
opcode 0x4300 (Get Poison) is supported by the driver and the mock device supports it. The logic should be checking that the opcode is both not poison and not security.
Fix the logic to allow poison and security commands.
--- drivers/cxl/core/mbox.c | 23 ++++++++++++----------- 1 file changed, 12 insertions(+), 11 deletions(-)
drivers/cxl/core/mbox.c +12 -11
@@ -715,24 +715,25 @@ static void cxl_walk_cel(struct cxl_memdev_state *mds, size_t size, u8 *cel)for (i =0 ; i < cel_entries; i++) {u16 opcode =le16_to_cpu (cel_entry[i].opcode);struct cxl_mem_command *cmd =cxl_mem_find_command (opcode); +int enabled =0 ; -if (!cmd && (!cxl_is_poison_command (opcode) || - !cxl_is_security_command (opcode))) { -dev_dbg (dev, -"Opcode 0x%04x unsupported by driver\n" , opcode); -continue ; +if (cmd) { +set_bit (cmd->info.id, mds->enabled_cmds); + enabled++; } -if (cmd) -set_bit (cmd->info.id, mds->enabled_cmds); - -if (cxl_is_poison_command (opcode)) +if (cxl_is_poison_command (opcode)) {cxl_set_poison_cmd_enabled (&mds->poison, opcode); + enabled++; + } -if (cxl_is_security_command (opcode)) +if (cxl_is_security_command (opcode)) {cxl_set_security_cmd_enabled (&mds->security, opcode); + enabled++; + } -dev_dbg (dev,"Opcode 0x%04x enabled\n" , opcode); +dev_dbg (dev,"Opcode 0x%04x %s\n" , opcode, + enabled ?"enabled" :"unsupported by driver" ); } }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 279/321 arm64: defconfig: remove CONFIG_COMMON_CLK_NPCM8XX=y
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikko Rapeli <[email protected]>
commit 7d3e4e9d3bde9c8bd8914d47ddaa90e0d0ffbcab upstream.
There is no code for this config option and enabling it in defconfig causes warnings from tools which are detecting unused and obsolete kernel config flags since the flag will be completely missing from effective build config after "make olddefconfig".
Fixes yocto kernel recipe build time warning:
WARNING: [kernel config]: This BSP contains fragments with warnings:
...
[INFO]: the following symbols were not found in the active configuration:
- CONFIG_COMMON_CLK_NPCM8XX
The flag was added with commit 45472f1e5348c7b755b4912f2f529ec81cea044b v5.19-rc4-15-g45472f1e5348 so 6.1 and 6.4 stable kernel trees are affected.
--- arch/arm64/configs/defconfig | 1 - 1 file changed, 1 deletion(-)
arch/arm64/configs/defconfig +0 -1
@@ -1145,7 +1145,6 @@ CONFIG_COMMON_CLK_S2MPS11=y CONFIG_COMMON_CLK_PWM=y CONFIG_COMMON_CLK_RS9_PCIE=y CONFIG_COMMON_CLK_VC5=y -CONFIG_COMMON_CLK_NPCM8XX=y CONFIG_COMMON_CLK_BD718XX=m CONFIG_CLK_RASPBERRYPI=m CONFIG_CLK_IMX8MM=y
Greg Kroah-Hartman
maintainerPATCH 280/321 mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
commit 45120b15743fa7c0aa53d5db6dfb4c8f87be4abd upstream.
When CONFIG_DAMON_VADDR_KUNIT_TEST=y and making CONFIG_DEBUG_KMEMLEAK=y and CONFIG_DEBUG_KMEMLEAK_AUTO_SCAN=y, the below memory leak is detected.
Since commit 9f86d624292c ("mm/damon/vaddr-test: remove unnecessary variables"), the damon_destroy_ctx() is removed, but still call damon_new_target() and damon_new_region(), the damon_region which is allocated by kmem_cache_alloc() in damon_new_region() and the damon_target which is allocated by kmalloc in damon_new_target() are not freed. And the damon_region which is allocated in damon_new_region() in damon_set_regions() is also not freed.
So use damon_destroy_target to free all the damon_regions and damon_target.
unreferenced object 0xffff888107c9a940 (size 64):
comm "kunit_try_catch", pid 1069, jiffies 4294670592 (age 732.761s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 06 00 00 00 6b 6b 6b 6b ............kkkk
60 c7 9c 07 81 88 ff ff f8 cb 9c 07 81 88 ff ff `...............
backtrace:
[<ffffffff817e0167>] kmalloc_trace+0x27/0xa0
[<ffffffff819c11cf>] damon_new_target+0x3f/0x1b0
[<ffffffff819c7d55>] damon_do_test_apply_three_regions.constprop.0+0x95/0x3e0
[<ffffffff819c82be>] damon_test_apply_three_regions1+0x21e/0x260
[<ffffffff829fce6a>] kunit_generic_run_threadfn_adapter+0x4a/0x90
[<ffffffff81237cf6>] kthread+0x2b6/0x380
[<ffffffff81097add>] ret_from_fork+0x2d/0x70
[<ffffffff81003791>] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff8881079cc740 (size 56):
comm "kunit_try_catch", pid 1069, jiffies 4294670592 (age 732.761s)
hex dump (first 32 bytes):
05 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 ................
6b 6b 6b 6b 6b 6b 6b 6b 00 00 00 00 6b 6b 6b 6b kkkkkkkk....kkkk
backtrace:
[<ffffffff819bc492>] damon_new_region+0x22/0x1c0
[<ffffffff819c7d91>] damon_do_test_apply_three_regions.constprop.0+0xd1/0x3e0
[<ffffffff819c82be>] damon_test_apply_three_regions1+0x21e/0x260
[<ffffffff829fce6a>] kunit_generic_run_threadfn_adapter+0x4a/0x90
[<ffffffff81237cf6>] kthread+0x2b6/0x380
[<ffffffff81097add>] ret_from_fork+0x2d/0x70
[<ffffffff81003791>] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff888107c9ac40 (size 64):
comm "kunit_try_catch", pid 1071, jiffies 4294670595 (age 732.843s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 06 00 00 00 6b 6b 6b 6b ............kkkk
a0 cc 9c 07 81 88 ff ff 78 a1 76 07 81 88 ff ff ........x.v.....
backtrace:
[<ffffffff817e0167>] kmalloc_trace+0x27/0xa0
[<ffffffff819c11cf>] damon_new_target+0x3f/0x1b0
[<ffffffff819c7d55>] damon_do_test_apply_three_regions.constprop.0+0x95/0x3e0
[<ffffffff819c851e>] damon_test_apply_three_regions2+0x21e/0x260
[<ffffffff829fce6a>] kunit_generic_run_threadfn_adapter+0x4a/0x90
[<ffffffff81237cf6>] kthread+0x2b6/0x380
[<ffffffff81097add>] ret_from_fork+0x2d/0x70
[<ffffffff81003791>] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff8881079ccc80 (size 56):
comm "kunit_try_catch", pid 1071, jiffies 4294670595 (age 732.843s)
hex dump (first 32 bytes):
05 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 ................
6b 6b 6b 6b 6b 6b 6b 6b 00 00 00 00 6b 6b 6b 6b kkkkkkkk....kkkk
backtrace:
[<ffffffff819bc492>] damon_new_region+0x22/0x1c0
[<ffffffff819c7d91>] damon_do_test_apply_three_regions.constprop.0+0xd1/0x3e0
[<ffffffff819c851e>] damon_test_apply_three_regions2+0x21e/0x260
[<ffffffff829fce6a>] kunit_generic_run_threadfn_adapter+0x4a/0x90
[<ffffffff81237cf6>] kthread+0x2b6/0x380
[<ffffffff81097add>] ret_from_fork+0x2d/0x70
[<ffffffff81003791>] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff888107c9af40 (size 64):
comm "kunit_try_catch", pid 1073, jiffies 4294670597 (age 733.011s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 06 00 00 00 6b 6b 6b 6b ............kkkk
20 a2 76 07 81 88 ff ff b8 a6 76 07 81 88 ff ff .v.......v.....
backtrace:
[<ffffffff817e0167>] kmalloc_trace+0x27/0xa0
[<ffffffff819c11cf>] damon_new_target+0x3f/0x1b0
[<ffffffff819c7d55>] damon_do_test_apply_three_regions.constprop.0+0x95/0x3e0
[<ffffffff819c877e>] damon_test_apply_three_regions3+0x21e/0x260
[<ffffffff829fce6a>] kunit_generic_run_threadfn_adapter+0x4a/0x90
[<ffffffff81237cf6>] kthread+0x2b6/0x380
[<ffffffff81097add>] ret_from_fork+0x2d/0x70
[<ffffffff81003791>] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff88810776a200 (size 56):
comm "kunit_try_catch", pid 1073, jiffies 4294670597 (age 733.011s)
hex dump (first 32 bytes):
05 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 ................
6b 6b 6b 6b 6b 6b 6b 6b 00 00 00 00 6b 6b 6b 6b kkkkkkkk....kkkk
backtrace:
[<ffffffff819bc492>] damon_new_region+0x22/0x1c0
[<ffffffff819c7d91>] damon_do_test_apply_three_regions.constprop.0+0xd1/0x3e0
[<ffffffff819c877e>] damon_test_apply_three_regions3+0x21e/0x260
[<ffffffff829fce6a>] kunit_generic_run_threadfn_adapter+0x4a/0x90
[<ffffffff81237cf6>] kthread+0x2b6/0x380
[<ffffffff81097add>] ret_from_fork+0x2d/0x70
[<ffffffff81003791>] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff88810776a740 (size 56):
comm "kunit_try_catch", pid 1073, jiffies 4294670597 (age 733.025s)
hex dump (first 32 bytes):
3d 00 00 00 00 00 00 00 3f 00 00 00 00 00 00 00 =.......?.......
6b 6b 6b 6b 6b 6b 6b 6b 00 00 00 00 6b 6b 6b 6b kkkkkkkk....kkkk
backtrace:
[<ffffffff819bc492>] damon_new_region+0x22/0x1c0
[<ffffffff819bfcc2>] damon_set_regions+0x4c2/0x8e0
[<ffffffff819c7dbb>] damon_do_test_apply_three_regions.constprop.0+0xfb/0x3e0
[<ffffffff819c877e>] damon_test_apply_three_regions3+0x21e/0x260
[<ffffffff829fce6a>] kunit_generic_run_threadfn_adapter+0x4a/0x90
[<ffffffff81237cf6>] kthread+0x2b6/0x380
[<ffffffff81097add>] ret_from_fork+0x2d/0x70
[<ffffffff81003791>] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff888108038240 (size 64):
comm "kunit_try_catch", pid 1075, jiffies 4294670600 (age 733.022s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 03 00 00 00 6b 6b 6b 6b ............kkkk
48 ad 76 07 81 88 ff ff 98 ae 76 07 81 88 ff ff H.v.......v.....
backtrace:
[<ffffffff817e0167>] kmalloc_trace+0x27/0xa0
[<ffffffff819c11cf>] damon_new_target+0x3f/0x1b0
[<ffffffff819c7d55>] damon_do_test_apply_three_regions.constprop.0+0x95/0x3e0
[<ffffffff819c898d>] damon_test_apply_three_regions4+0x1cd/0x210
[<ffffffff829fce6a>] kunit_generic_run_threadfn_adapter+0x4a/0x90
[<ffffffff81237cf6>] kthread+0x2b6/0x380
[<ffffffff81097add>] ret_from_fork+0x2d/0x70
[<ffffffff81003791>] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff88810776ad28 (size 56):
comm "kunit_try_catch", pid 1075, jiffies 4294670600 (age 733.022s)
hex dump (first 32 bytes):
05 00 00 00 00 00 00 00 07 00 00 00 00 00 00 00 ................
6b 6b 6b 6b 6b 6b 6b 6b 00 00 00 00 6b 6b 6b 6b kkkkkkkk....kkkk
backtrace:
[<ffffffff819bc492>] damon_new_region+0x22/0x1c0
[<ffffffff819bfcc2>] damon_set_regions+0x4c2/0x8e0
[<ffffffff819c7dbb>] damon_do_test_apply_three_regions.constprop.0+0xfb/0x3e0
[<ffffffff819c898d>] damon_test_apply_three_regions4+0x1cd/0x210
[<ffffffff829fce6a>] kunit_generic_run_threadfn_adapter+0x4a/0x90
[<ffffffff81237cf6>] kthread+0x2b6/0x380
[<ffffffff81097add>] ret_from_fork+0x2d/0x70
[<ffffffff81003791>] ret_from_fork_asm+0x11/0x20--- mm/damon/vaddr-test.h | 2 ++ 1 file changed, 2 insertions(+)
mm/damon/vaddr-test.h +2 -0
@@ -148,6 +148,8 @@ static void damon_do_test_apply_three_reKUNIT_EXPECT_EQ (test, r->ar.start, expected[i *2 ]);KUNIT_EXPECT_EQ (test, r->ar.end, expected[i *2 +1 ]); } + +damon_destroy_target (t); }/*
Greg Kroah-Hartman
maintainerPATCH 281/321 selftests/mm: fix awk usage in charge_reserved_hugetlb.sh and hugetlb_reparenting_test.sh that may cause error
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juntong Deng <[email protected]>
commit bbe246f875d064ecfb872fe4f66152e743dfd22d upstream.
According to the awk manual, the -e option does not need to be specified in front of 'program' (unless you need to mix program-file).
The redundant -e option can cause error when users use awk tools other than gawk (for example, mawk does not support the -e option).
Error Example:
awk: not an option: -e
--- tools/testing/selftests/mm/charge_reserved_hugetlb.sh | 4 ++-- tools/testing/selftests/mm/hugetlb_reparenting_test.sh | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
tools/testing/selftests/mm/charge_reserved_hugetlb.sh +2 -2
@@ -25,7 +25,7 @@ if [[ "$1" == "-cgroup-v2" ]]; then fi if [[ $cgroup2 ]]; then - cgroup_path=$(mount -t cgroup2 | head -1 | awk -e '{print $3}') + cgroup_path=$(mount -t cgroup2 | head -1 | awk '{print $3}') if [[ -z "$cgroup_path" ]]; then cgroup_path=/dev/cgroup/memory mount -t cgroup2 none $cgroup_path
@@ -33,7 +33,7 @@ if [[ $cgroup2 ]]; then fi echo "+hugetlb" >$cgroup_path/cgroup.subtree_control else - cgroup_path=$(mount -t cgroup | grep ",hugetlb" | awk -e '{print $3}') + cgroup_path=$(mount -t cgroup | grep ",hugetlb" | awk '{print $3}') if [[ -z "$cgroup_path" ]]; then cgroup_path=/dev/cgroup/memory mount -t cgroup memory,hugetlb $cgroup_path
tools/testing/selftests/mm/hugetlb_reparenting_test.sh +2 -2
@@ -20,7 +20,7 @@ fi if [[ $cgroup2 ]]; then - CGROUP_ROOT=$(mount -t cgroup2 | head -1 | awk -e '{print $3}') + CGROUP_ROOT=$(mount -t cgroup2 | head -1 | awk '{print $3}') if [[ -z "$CGROUP_ROOT" ]]; then CGROUP_ROOT=/dev/cgroup/memory mount -t cgroup2 none $CGROUP_ROOT
@@ -28,7 +28,7 @@ if [[ $cgroup2 ]]; then fi echo "+hugetlb +memory" >$CGROUP_ROOT/cgroup.subtree_control else - CGROUP_ROOT=$(mount -t cgroup | grep ",hugetlb" | awk -e '{print $3}') + CGROUP_ROOT=$(mount -t cgroup | grep ",hugetlb" | awk '{print $3}') if [[ -z "$CGROUP_ROOT" ]]; then CGROUP_ROOT=/dev/cgroup/memory mount -t cgroup memory,hugetlb $CGROUP_ROOT
Greg Kroah-Hartman
maintainerPATCH 282/321 mm: mempolicy: keep VMA walk if both MPOL_MF_STRICT and MPOL_MF_MOVE are specified
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Shi <[email protected]>
commit 24526268f4e38c9ec0c4a30de4f37ad2a2a84e47 upstream.
When calling mbind() with MPOL_MF_{MOVE|MOVEALL} | MPOL_MF_STRICT, kernel should attempt to migrate all existing pages, and return -EIO if there is misplaced or unmovable page. Then commit 6f4576e3687b ("mempolicy: apply page table walker on queue_pages_range()") messed up the return value and didn't break VMA scan early ianymore when MPOL_MF_STRICT alone. The return value problem was fixed by commit a7f40cfe3b7a ("mm: mempolicy:
make mbind() return -EIO when MPOL_MF_STRICT is specified"), but it broke the VMA walk early if unmovable page is met, it may cause some pages are not migrated as expected.
The code should conceptually do:
if (MPOL_MF_MOVE|MOVEALL)
scan all vmas
try to migrate the existing pages
return success
else if (MPOL_MF_MOVE* | MPOL_MF_STRICT)
scan all vmas
try to migrate the existing pages
return -EIO if unmovable or migration failed
else /* MPOL_MF_STRICT alone */
break early if meets unmovable and don't call mbind_range() at all
else /* none of those flags */
check the ranges in test_walk, EFAULT without mbind_range() if discontig.
Fixed the behavior.
--- mm/mempolicy.c | 39 +++++++++++++++++++-------------------- 1 file changed, 19 insertions(+), 20 deletions(-)
mm/mempolicy.c +19 -20
@@ -426,6 +426,7 @@ struct queue_pages {unsigned long start;unsigned long end;struct vm_area_struct *first; +bool has_unmovable; };/*
@@ -446,9 +447,8 @@ static inline bool queue_folio_required(/* * queue_folios_pmd() has three possible return values: * 0 - folios are placed on the right node or queued successfully, or -* special page is met, i.e. huge zero page. -* 1 - there is unmovable folio, and MPOL_MF_MOVE* & MPOL_MF_STRICT were -* specified. +* special page is met, i.e. zero page, or unmovable page is found +* but continue walking (indicated by queue_pages.has_unmovable). * -EIO - is migration entry or only MPOL_MF_STRICT was specified and an * existing folio was already on a node that does not follow the * policy.
@@ -479,7 +479,7 @@ static int queue_folios_pmd(pmd_t *pmd,if (flags & (MPOL_MF_MOVE |MPOL_MF_MOVE_ALL )) {if (!vma_migratable (walk->vma) ||migrate_folio_add (folio, qp->pagelist, flags)) { - ret =1 ; + qp->has_unmovable = true; goto unlock; } }else
@@ -495,9 +495,8 @@ unlock:* * queue_folios_pte_range() has three possible return values: * 0 - folios are placed on the right node or queued successfully, or -* special page is met, i.e. zero page. -* 1 - there is unmovable folio, and MPOL_MF_MOVE* & MPOL_MF_STRICT were -* specified. +* special page is met, i.e. zero page, or unmovable page is found +* but continue walking (indicated by queue_pages.has_unmovable). * -EIO - only MPOL_MF_STRICT was specified and an existing folio was already * on a node that does not follow the policy. */
@@ -508,7 +507,6 @@ static int queue_folios_pte_range(pmd_tstruct folio *folio;struct queue_pages *qp = walk->private;unsigned long flags = qp->flags; -bool has_unmovable = false;pte_t *pte, *mapped_pte;pte_t ptent;spinlock_t *ptl;
@@ -538,11 +536,12 @@ static int queue_folios_pte_range(pmd_tif (!queue_folio_required (folio, qp))continue ;if (flags & (MPOL_MF_MOVE |MPOL_MF_MOVE_ALL )) { -/* MPOL_MF_STRICT must be specified if we get here */ -if (!vma_migratable (vma)) { - has_unmovable = true; -break ; - } +/* +* MPOL_MF_STRICT must be specified if we get here. +* Continue walking vmas due to MPOL_MF_MOVE* flags. +*/ +if (!vma_migratable (vma)) + qp->has_unmovable = true;/* * Do not abort immediately since there may be
@@ -550,16 +549,13 @@ static int queue_folios_pte_range(pmd_t* need migrate other LRU pages. */ if (migrate_folio_add (folio, qp->pagelist, flags)) - has_unmovable = true; + qp->has_unmovable = true; }else break ; }pte_unmap_unlock (mapped_pte, ptl);cond_resched (); -if (has_unmovable) -return 1 ; -return addr != end ? -EIO :0 ; }
@@ -599,7 +595,7 @@ static int queue_folios_hugetlb(pte_t *p* Detecting misplaced folio but allow migrating folios which * have been queued. */ - ret =1 ; + qp->has_unmovable = true; goto unlock; }
@@ -620,7 +616,7 @@ static int queue_folios_hugetlb(pte_t *p* Failed to isolate folio but allow migrating pages * which have been queued. */ - ret =1 ; + qp->has_unmovable = true; } unlock:spin_unlock (ptl);
@@ -756,12 +752,15 @@ queue_pages_range(struct mm_struct *mm, .start = start, .end = end, .first = NULL, + .has_unmovable = false, };const struct mm_walk_ops *ops = lock_vma ? &queue_pages_lock_vma_walk_ops : &queue_pages_walk_ops; err =walk_page_range (mm, start, end, ops, &qp); +if (qp.has_unmovable) + err =1 ;if (!qp.first)/* whole range in hole */ err = -EFAULT ;
@@ -1358,7 +1357,7 @@ static long do_mbind(unsigned long startputback_movable_pages (&pagelist); } -if ((ret >0 ) || (nr_failed && (flags &MPOL_MF_STRICT ))) +if (((ret >0 ) || nr_failed) && (flags &MPOL_MF_STRICT )) err = -EIO ; }else { up_out:
Greg Kroah-Hartman
maintainerPATCH 283/321 mm/slab_common: fix slab_caches list corruption after kmem_cache_destroy()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael Aquini <[email protected]>
commit 46a9ea6681907a3be6b6b0d43776dccc62cad6cf upstream.
After the commit in Fixes:, if a module that created a slab cache does not release all of its allocated objects before destroying the cache (at rmmod time), we might end up releasing the kmem_cache object without removing it from the slab_caches list thus corrupting the list as kmem_cache_destroy() ignores the return value from shutdown_cache(), which in turn never removes the kmem_cache object from slabs_list in case __kmem_cache_shutdown() fails to release all of the cache's slabs.
This is easily observable on a kernel built with CONFIG_DEBUG_LIST=y as after that ill release the system will immediately trip on list_add, or list_del, assertions similar to the one shown below as soon as another kmem_cache gets created, or destroyed:
[ 1041.213632] list_del corruption. next->prev should be ffff89f596fb5768, but was 52f1e5016aeee75d. (next=ffff89f595a1b268) [ 1041.219165] ------------[ cut here ]------------ [ 1041.221517] kernel BUG at lib/list_debug.c:62! [ 1041.223452] invalid opcode: 0000 [#1] PREEMPT SMP PTI [ 1041.225408] CPU: 2 PID: 1852 Comm: rmmod Kdump: loaded Tainted: G B W OE 6.5.0 #15 [ 1041.228244] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS edk2-20230524-3.fc37 05/24/2023 [ 1041.231212] RIP: 0010:__list_del_entry_valid+0xae/0xb0
Another quick way to trigger this issue, in a kernel with CONFIG_SLUB=y, is to set slub_debug to poison the released objects and then just run cat /proc/slabinfo after removing the module that leaks slab objects, in which case the kernel will panic:
[ 50.954843] general protection fault, probably for non-canonical address 0xa56b6b6b6b6b6b8b: 0000 [#1] PREEMPT SMP PTI [ 50.961545] CPU: 2 PID: 1495 Comm: cat Kdump: loaded Tainted: G B W OE 6.5.0 #15 [ 50.966808] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS edk2-20230524-3.fc37 05/24/2023 [ 50.972663] RIP: 0010:get_slabinfo+0x42/0xf0
This patch fixes this issue by properly checking shutdown_cache()'s return value before taking the kmem_cache_release() branch.
--- mm/slab_common.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
mm/slab_common.c +6 -6
@@ -479,7 +479,7 @@ void slab_kmem_cache_release(struct kmemvoid kmem_cache_destroy (struct kmem_cache *s) { -int refcnt; +int err = -EBUSY ;bool rcu_set;if (unlikely (!s) || !kasan_check_byte (s))
@@ -490,17 +490,17 @@ void kmem_cache_destroy(struct kmem_cach rcu_set = s->flags &SLAB_TYPESAFE_BY_RCU ; - refcnt = --s->refcount; -if (refcnt) + s->refcount--; +if (s->refcount) goto out_unlock; -WARN (shutdown_cache (s), -"%s %s: Slab cache still has objects when called from %pS" , + err =shutdown_cache (s); +WARN (err,"%s %s: Slab cache still has objects when called from %pS" , __func__, s->name, (void *)_RET_IP_); out_unlock:mutex_unlock (&slab_mutex);cpus_read_unlock (); -if (!refcnt && !rcu_set) +if (!err && !rcu_set)kmem_cache_release (s); }EXPORT_SYMBOL (kmem_cache_destroy);
Greg Kroah-Hartman
maintainerPATCH 284/321 mm: page_alloc: fix CMA and HIGHATOMIC landing on the wrong buddy list
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Weiner <[email protected]>
commit 7b086755fb8cdbb6b3e45a1bbddc00e7f9b1dc03 upstream.
Commit 4b23a68f9536 ("mm/page_alloc: protect PCP lists with a spinlock") bypasses the pcplist on lock contention and returns the page directly to the buddy list of the page's migratetype.
For pages that don't have their own pcplist, such as CMA and HIGHATOMIC, the migratetype is temporarily updated such that the page can hitch a ride on the MOVABLE pcplist. Their true type is later reassessed when flushing in free_pcppages_bulk(). However, when lock contention is detected after the type was already overridden, the bypass will then put the page on the wrong buddy list.
Once on the MOVABLE buddy list, the page becomes eligible for fallbacks and even stealing. In the case of HIGHATOMIC, otherwise ineligible allocations can dip into the highatomic reserves. In the case of CMA, the page can be lost from the CMA region permanently.
Use a separate pcpmigratetype variable for the pcplist override. Use the original migratetype when going directly to the buddy. This fixes the bug and should make the intentions more obvious in the code.
Originally sent here to address the HIGHATOMIC case:
https://lore.kernel.org/lkml/[email protected]/
Changelog updated in response to the CMA-specific bug report.
--- mm/page_alloc.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
mm/page_alloc.c +6 -6
@@ -2438,7 +2438,7 @@ void free_unref_page(struct page *page,struct per_cpu_pages *pcp;struct zone *zone;unsigned long pfn =page_to_pfn (page); -int migratetype; +int migratetype, pcpmigratetype;if (!free_unref_page_prepare (page, pfn, order))return ;
@@ -2446,24 +2446,24 @@ void free_unref_page(struct page *page,/* * We only track unmovable, reclaimable and movable on pcp lists. * Place ISOLATE pages on the isolated list because they are being -* offlined but treat HIGHATOMIC as movable pages so we can get those -* areas back if necessary. Otherwise, we may have to free +* offlined but treat HIGHATOMIC and CMA as movable pages so we can +* get those areas back if necessary. Otherwise, we may have to free * excessively into the page allocator */ - migratetype =get_pcppage_migratetype (page); + migratetype = pcpmigratetype =get_pcppage_migratetype (page);if (unlikely (migratetype >=MIGRATE_PCPTYPES )) {if (unlikely (is_migrate_isolate (migratetype))) {free_one_page (page_zone (page), page, pfn, order, migratetype,FPI_NONE );return ; } - migratetype =MIGRATE_MOVABLE ; + pcpmigratetype =MIGRATE_MOVABLE ; } zone =page_zone (page);pcp_trylock_prepare (UP_flags); pcp =pcp_spin_trylock (zone->per_cpu_pageset);if (pcp) { -free_unref_page_commit (zone, pcp, page, migratetype, order); +free_unref_page_commit (zone, pcp, page, pcpmigratetype, order);pcp_spin_unlock (pcp); }else {free_one_page (zone, page, pfn, order, migratetype,FPI_NONE );
Greg Kroah-Hartman
maintainerPATCH 285/321 mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Weiner <[email protected]>
commit 9ea9cb00a82b53ec39630eac718776d37e41b35a upstream.
Breno and Josef report a deadlock scenario from cgroup reclaim re-entering the filesystem:
[ 361.546690] ======================================================
[ 361.559210] WARNING: possible circular locking dependency detected
[ 361.571703] 6.5.0-0_fbk700_debug_rc0_kbuilder_13159_gbf787a128001 #1 Tainted: G S E
[ 361.589704] ------------------------------------------------------
[ 361.602277] find/9315 is trying to acquire lock:
[ 361.611625] ffff88837ba140c0 (&delayed_node->mutex){+.+.}-{4:4}, at: __btrfs_release_delayed_node+0x68/0x4f0
[ 361.631437]
[ 361.631437] but task is already holding lock:
[ 361.643243] ffff8881765b8678 (btrfs-tree-01){++++}-{4:4}, at: btrfs_tree_read_lock+0x1e/0x40[ 362.904457] mutex_lock_nested+0x1c/0x30 [ 362.912414] __btrfs_release_delayed_node+0x68/0x4f0 [ 362.922460] btrfs_evict_inode+0x301/0x770 [ 362.982726] evict+0x17c/0x380 [ 362.988944] prune_icache_sb+0x100/0x1d0 [ 363.005559] super_cache_scan+0x1f8/0x260 [ 363.013695] do_shrink_slab+0x2a2/0x540 [ 363.021489] shrink_slab_memcg+0x237/0x3d0 [ 363.050606] shrink_slab+0xa7/0x240 [ 363.083382] shrink_node_memcgs+0x262/0x3b0 [ 363.091870] shrink_node+0x1a4/0x720 [ 363.099150] shrink_zones+0x1f6/0x5d0 [ 363.148798] do_try_to_free_pages+0x19b/0x5e0 [ 363.157633] try_to_free_mem_cgroup_pages+0x266/0x370 [ 363.190575] reclaim_high+0x16f/0x1f0 [ 363.208409] mem_cgroup_handle_over_high+0x10b/0x270 [ 363.246678] try_charge_memcg+0xaf2/0xc70 [ 363.304151] charge_memcg+0xf0/0x350 [ 363.320070] __mem_cgroup_charge+0x28/0x40 [ 363.328371] __filemap_add_folio+0x870/0xd50 [ 363.371303] filemap_add_folio+0xdd/0x310 [ 363.399696] __filemap_get_folio+0x2fc/0x7d0 [ 363.419086] pagecache_get_page+0xe/0x30 [ 363.427048] alloc_extent_buffer+0x1cd/0x6a0 [ 363.435704] read_tree_block+0x43/0xc0 [ 363.443316] read_block_for_search+0x361/0x510 [ 363.466690] btrfs_search_slot+0xc8c/0x1520
This is caused by the mem_cgroup_handle_over_high() not respecting the gfp_mask of the allocation context. We used to only call this function on resume to userspace, where no locks were held. But c9afe31ec443 ("memcg:
synchronously enforce memory.high for large overcharges") added a call from the allocation context without considering the gfp.
--- include/linux/memcontrol.h | 4 ++-- include/linux/resume_user_mode.h | 2 +- mm/memcontrol.c | 6 +++--- 3 files changed, 6 insertions(+), 6 deletions(-)
include/linux/memcontrol.h +2 -2
@@ -919,7 +919,7 @@ unsigned long mem_cgroup_get_zone_lru_sireturn READ_ONCE (mz->lru_zone_size[zone_idx][lru]); } -void mem_cgroup_handle_over_high (void ); +void mem_cgroup_handle_over_high (gfp_t gfp_mask);unsigned long mem_cgroup_get_max (struct mem_cgroup *memcg);
@@ -1460,7 +1460,7 @@ static inline void mem_cgroup_unlock_pagrcu_read_unlock (); } -static inline void mem_cgroup_handle_over_high (void ) +static inline void mem_cgroup_handle_over_high (gfp_t gfp_mask) { }
include/linux/resume_user_mode.h +1 -1
@@ -55,7 +55,7 @@ static inline void resume_user_mode_work }#endif -mem_cgroup_handle_over_high (); +mem_cgroup_handle_over_high (GFP_KERNEL );blkcg_maybe_throttle_current ();rseq_handle_notify_resume (NULL , regs);
mm/memcontrol.c +3 -3
@@ -2559,7 +2559,7 @@ static unsigned long calculate_high_dela* Scheduled by try_charge() to be executed from the userland return path * and reclaims memory over the high limit. */ -void mem_cgroup_handle_over_high (void ) +void mem_cgroup_handle_over_high (gfp_t gfp_mask) {unsigned long penalty_jiffies;unsigned long pflags;
@@ -2587,7 +2587,7 @@ retry_reclaim:*/ nr_reclaimed =reclaim_high (memcg, in_retry ?SWAP_CLUSTER_MAX : nr_pages, -GFP_KERNEL ); + gfp_mask);/* * memory.high is breached and reclaim is unable to keep up. Throttle
@@ -2823,7 +2823,7 @@ done_restock:if (current->memcg_nr_pages_over_high >MEMCG_CHARGE_BATCH && !(current->flags &PF_MEMALLOC ) &&gfpflags_allow_blocking (gfp_mask)) { -mem_cgroup_handle_over_high (); +mem_cgroup_handle_over_high (gfp_mask); }return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 286/321 cxl/port: Fix cxl_test register enumeration regression
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <[email protected]>
commit a76b62518eb30ef59158fa777ab2e2a23e1334f9 upstream.
The cxl_test unit test environment models a CXL topology for sysfs/user-ABI regression testing. It uses interface mocking via the "--wrap=" linker option to redirect cxl_core routines that parse hardware registers with versions that just publish objects, like devm_cxl_enumerate_decoders().
Starting with:
Commit 19ab69a60e3b ("cxl/port: Store the port's Component Register mappings in struct cxl_port")
...port register enumeration is moved into devm_cxl_add_port(). This conflicts with the "cxl_test avoids emulating registers stance" so either the port code needs to be refactored (too violent), or modified so that register enumeration is skipped on "fake" cxl_test ports (annoying, but straightforward).
This conflict has happened previously and the "check for platform device" workaround to avoid instrusive refactoring was deployed in those scenarios. In general, refactoring should only benefit production code, test code needs to remain minimally instrusive to the greatest extent possible.
This was missed previously because it may sometimes just cause warning messages to be emitted, but it can also cause test failures. The backport to -stable is only nice to have for clean cxl_test runs.
--- drivers/cxl/core/port.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/cxl/core/port.c +9 -4
@@ -1,5 +1,6 @@// SPDX-License-Identifier: GPL-2.0-only /* Copyright(c) 2020 Intel Corporation. All rights reserved. */ +#include <linux/platform_device.h> #include <linux/memregion.h> #include <linux/workqueue.h> #include <linux/debugfs.h>
@@ -706,16 +707,20 @@ static int cxl_setup_comp_regs(struct device *dev, struct cxl_register_map *map,return cxl_setup_regs (map); } -static inline int cxl_port_setup_regs (struct cxl_port *port, -resource_size_t component_reg_phys) +static int cxl_port_setup_regs (struct cxl_port *port, +resource_size_t component_reg_phys) { +if (dev_is_platform (port->uport_dev)) +return 0 ;return cxl_setup_comp_regs (&port->dev, &port->comp_map, component_reg_phys); } -static inline int cxl_dport_setup_regs (struct cxl_dport *dport, -resource_size_t component_reg_phys) +static int cxl_dport_setup_regs (struct cxl_dport *dport, +resource_size_t component_reg_phys) { +if (dev_is_platform (dport->dport_dev)) +return 0 ;return cxl_setup_comp_regs (dport->dport_dev, &dport->comp_map, component_reg_phys); }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 287/321 cxl/pci: Fix appropriate checking for _OSC while handling CXL RAS registers
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Smita Koralahalli <[email protected]>
commit 0339dc39a521ead3dbcf101acd8c028c61db57dc upstream.
cxl_pci fails to unmask CXL protocol errors when CXL memory error reporting is not granted native control. Given that CXL memory error reporting uses the event interface and protocol errors use AER, unmask protocol errors based only on the native AER setting. Without this change end user deployments will fail to report protocol errors in the case where native memory error handling is not granted to Linux.
Also, return zero instead of an error code to not block the communication with the cxl device when in native memory error reporting mode.
--- drivers/cxl/pci.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/cxl/pci.c +3 -3
@@ -541,9 +541,9 @@ static int cxl_pci_ras_unmask(struct pci_dev *pdev)return 0 ; } -/* BIOS has CXL error control */ -if (!host_bridge->native_cxl_error) -return -ENXIO ; +/* BIOS has PCIe AER error control */ +if (!host_bridge->native_aer) +return 0 ; rc =pcie_capability_read_word (pdev,PCI_EXP_DEVCTL , &cap);if (rc)
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 288/321 ring-buffer: Fix bytes info in per_cpu buffer stats
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Yejian <[email protected]>
commit 45d99ea451d0c30bfd4864f0fe485d7dac014902 upstream.
The 'bytes' info in file 'per_cpu/cpu<X>/stats' means the number of bytes in cpu buffer that have not been consumed. However, currently after consuming data by reading file 'trace_pipe', the 'bytes' info was not changed as expected.
# cat per_cpu/cpu0/stats entries: 0 overrun: 0 commit overrun: 0 bytes: 568 <--- 'bytes' is problematical !!! oldest event ts: 8651.371479 now ts: 8653.912224 dropped events: 0 read events: 8
The root cause is incorrect stat on cpu_buffer->read_bytes. To fix it:
1. When stat 'read_bytes', account consumed event in rb_advance_reader();
2. When stat 'entries_bytes', exclude the discarded padding event which is smaller than minimum size because it is invisible to reader. Then use rb_page_commit() instead of BUF_PAGE_SIZE at where accounting for page-based read/remove/overrun.
Also correct the comments of ring_buffer_bytes_cpu() in this patch.
--- kernel/trace/ring_buffer.c | 28 +++++++++++++++------------- 1 file changed, 15 insertions(+), 13 deletions(-)
kernel/trace/ring_buffer.c +15 -13
@@ -354,6 +354,11 @@ static void rb_init_page(struct buffer_dlocal_set (&bpage->commit,0 ); } +static __always_inline unsigned int rb_page_commit(struct buffer_page *bpage) +{ +return local_read (&bpage->page->commit); +} +static void free_buffer_page (struct buffer_page *bpage) {free_page ((unsigned long )bpage->page);
@@ -2011,7 +2016,7 @@ rb_remove_pages(struct ring_buffer_per_c* Increment overrun to account for the lost events. */ local_add (page_entries, &cpu_buffer->overrun); -local_sub (BUF_PAGE_SIZE , &cpu_buffer->entries_bytes); +local_sub (rb_page_commit (to_remove_page), &cpu_buffer->entries_bytes);local_inc (&cpu_buffer->pages_lost); }
@@ -2375,11 +2380,6 @@ rb_reader_event(struct ring_buffer_per_c cpu_buffer->reader_page->read); } -static __always_inline unsigned rb_page_commit (struct buffer_page *bpage) -{ -return local_read (&bpage->page->commit); -} -static struct ring_buffer_event *rb_iter_head_event (struct ring_buffer_iter *iter) {
@@ -2525,7 +2525,7 @@ rb_handle_head_page(struct ring_buffer_p* the counters. */ local_add (entries, &cpu_buffer->overrun); -local_sub (BUF_PAGE_SIZE , &cpu_buffer->entries_bytes); +local_sub (rb_page_commit (next_page), &cpu_buffer->entries_bytes);local_inc (&cpu_buffer->pages_lost);/*
@@ -2668,9 +2668,6 @@ rb_reset_tail(struct ring_buffer_per_cpu event =__rb_page_index (tail_page, tail); -/* account for padding bytes */ -local_add (BUF_PAGE_SIZE - tail, &cpu_buffer->entries_bytes); -/* * Save the original length to the meta data. * This will be used by the reader to add lost event
@@ -2684,7 +2681,8 @@ rb_reset_tail(struct ring_buffer_per_cpu* write counter enough to allow another writer to slip * in on this page. * We put in a discarded commit instead, to make sure -* that this space is not used again. +* that this space is not used again, and this space will +* not be accounted into 'entries_bytes'. * * If we are less than the minimum size, we don't need to * worry about it.
@@ -2709,6 +2707,9 @@ rb_reset_tail(struct ring_buffer_per_cpu/* time delta must be non zero */ event->time_delta =1 ; +/* account for padding bytes */ +local_add (BUF_PAGE_SIZE - tail, &cpu_buffer->entries_bytes); +/* Make sure the padding is visible before the tail_page->write update */ smp_wmb ();
@@ -4223,7 +4224,7 @@ u64 ring_buffer_oldest_event_ts(struct tEXPORT_SYMBOL_GPL (ring_buffer_oldest_event_ts);/** -* ring_buffer_bytes_cpu - get the number of bytes consumed in a cpu buffer +* ring_buffer_bytes_cpu - get the number of bytes unconsumed in a cpu buffer * @buffer: The ring buffer * @cpu: The per CPU buffer to read from. */
@@ -4731,6 +4732,7 @@ static void rb_advance_reader(struct rin length =rb_event_length (event); cpu_buffer->reader_page->read += length; + cpu_buffer->read_bytes += length; }static void rb_advance_iter (struct ring_buffer_iter *iter)
@@ -5824,7 +5826,7 @@ int ring_buffer_read_page(struct trace_b }else {/* update the entry counter */ cpu_buffer->read +=rb_page_entries (reader); - cpu_buffer->read_bytes +=BUF_PAGE_SIZE ; + cpu_buffer->read_bytes +=rb_page_commit (reader);/* swap the pages */ rb_init_page (bpage);
Greg Kroah-Hartman
maintainerPATCH 289/321 ring-buffer: Update "shortest_full" in polling
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt (Google) <[email protected]>
commit 1e0cb399c7653462d9dadf8ab9425337c355d358 upstream.
It was discovered that the ring buffer polling was incorrectly stating that read would not block, but that's because polling did not take into account that reads will block if the "buffer-percent" was set. Instead, the ring buffer polling would say reads would not block if there was any data in the ring buffer. This was incorrect behavior from a user space point of view. This was fixed by commit 42fb0a1e84ff by having the polling code check if the ring buffer had more data than what the user specified "buffer percent" had.
The problem now is that the polling code did not register itself to the writer that it wanted to wait for a specific "full" value of the ring buffer. The result was that the writer would wake the polling waiter whenever there was a new event. The polling waiter would then wake up, see that there's not enough data in the ring buffer to notify user space and then go back to sleep. The next event would wake it up again.
Before the polling fix was added, the code would wake up around 100 times for a hackbench 30 benchmark. After the "fix", due to the constant waking of the writer, it would wake up over 11,0000 times! It would never leave the kernel, so the user space behavior was still "correct", but this definitely is not the desired effect.
To fix this, have the polling code add what it's waiting for to the "shortest_full" variable, to tell the writer not to wake it up if the buffer is not as full as it expects to be.
Note, after this fix, it appears that the waiter is now woken up around 2x the times it was before (~200). This is a tremendous improvement from the 11,000 times, but I will need to spend some time to see why polling is more aggressive in its wakeups than the read blocking code.
--- kernel/trace/ring_buffer.c | 3 +++ 1 file changed, 3 insertions(+)
kernel/trace/ring_buffer.c +3 -0
@@ -1142,6 +1142,9 @@ __poll_t ring_buffer_poll_wait(struct trif (full) {poll_wait (filp, &work->full_waiters, poll_table); work->full_waiters_pending = true; +if (!cpu_buffer->shortest_full || + cpu_buffer->shortest_full > full) + cpu_buffer->shortest_full = full; }else {poll_wait (filp, &work->waiters, poll_table); work->waiters_pending = true;
Greg Kroah-Hartman
maintainerPATCH 290/321 btrfs: refresh dir last index during a rewinddir(3) call
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
commit e60aa5da14d01fed8411202dbe4adf6c44bd2a57 upstream.
When opening a directory we find what's the index of its last entry and then store it in the directory's file handle private data (struct btrfs_file_private::last_index), so that in the case new directory entries are added to a directory after an opendir(3) call we don't end up in an infinite loop (see commit 9b378f6ad48c ("btrfs: fix infinite directory reads")) when calling readdir(3).
However once rewinddir(3) is called, POSIX states [1] that any new directory entries added after the previous opendir(3) call, must be returned by subsequent calls to readdir(3):
"The rewinddir() function shall reset the position of the directory
stream to which dirp refers to the beginning of the directory. It shall also cause the directory stream to refer to the current state of the corresponding directory, as a call to opendir() would have done."
We currently don't refresh the last_index field of the struct btrfs_file_private associated to the directory, so after a rewinddir(3) we are not returning any new entries added after the opendir(3) call.
Fix this by finding the current last index of the directory when llseek is called against the directory.
This can be reproduced by the following C program provided by Ian Johnson:
#include <dirent.h>
#include <stdio.h>
int main(void) {
DIR *dir = opendir("test"); FILE *file;
file = fopen("test/1", "w");
fwrite("1", 1, 1, file);
fclose(file);
file = fopen("test/2", "w");
fwrite("2", 1, 1, file);
fclose(file);
rewinddir(dir);
struct dirent *entry;
while ((entry = readdir(dir))) {
printf("%s\n", entry->d_name);
}
closedir(dir);
return 0;}
--- fs/btrfs/inode.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)
fs/btrfs/inode.c +14 -1
@@ -5979,6 +5979,19 @@ static int btrfs_opendir(struct inode *ireturn 0 ; } +static loff_t btrfs_dir_llseek (struct file *file,loff_t offset,int whence) +{ +struct btrfs_file_private *private = file->private_data; +int ret; + + ret =btrfs_get_dir_last_index (BTRFS_I (file_inode (file)), + &private->last_index); +if (ret) +return ret; + +return generic_file_llseek (file, offset, whence); +} +struct dir_entry {u64 ino;u64 offset;
@@ -11059,7 +11072,7 @@ static const struct inode_operations btr };static const struct file_operations btrfs_dir_file_operations = { - .llseek = generic_file_llseek, + .llseek = btrfs_dir_llseek, .read = generic_read_dir, .iterate_shared = btrfs_real_readdir, .open = btrfs_opendir,
Greg Kroah-Hartman
maintainerPATCH 291/321 btrfs: file_remove_privs needs an exclusive lock in direct io write
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bernd Schubert <[email protected]>
commit 9af86694fd5d387992699ec99007ed374966ce9a upstream.
This was noticed by Miklos that file_remove_privs might call into notify_change(), which requires to hold an exclusive lock. The problem exists in FUSE and btrfs. We can fix it without any additional helpers from VFS, in case the privileges would need to be dropped, change the lock type to be exclusive and redo the loop.
--- fs/btrfs/file.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-)
fs/btrfs/file.c +14 -2
@@ -1466,8 +1466,13 @@ static ssize_t btrfs_direct_write(structif (iocb->ki_flags &IOCB_NOWAIT ) ilock_flags |=BTRFS_ILOCK_TRY ; -/* If the write DIO is within EOF, use a shared lock */ -if (iocb->ki_pos +iov_iter_count (from) <=i_size_read (inode)) +/* +* If the write DIO is within EOF, use a shared lock and also only if +* security bits will likely not be dropped by file_remove_privs() called +* from btrfs_write_check(). Either will need to be rechecked after the +* lock was acquired. +*/ +if (iocb->ki_pos +iov_iter_count (from) <=i_size_read (inode) &&IS_NOSEC (inode)) ilock_flags |=BTRFS_ILOCK_SHARED ; relock:
@@ -1475,6 +1480,13 @@ relock:if (err <0 )return err; +/* Shared lock cannot be used with security bits set. */ +if ((ilock_flags &BTRFS_ILOCK_SHARED ) && !IS_NOSEC (inode)) { +btrfs_inode_unlock (BTRFS_I (inode), ilock_flags); + ilock_flags &= ~BTRFS_ILOCK_SHARED ; + goto relock; + } + err =generic_write_checks (iocb, from);if (err <=0 ) {btrfs_inode_unlock (BTRFS_I (inode), ilock_flags);