6.5.12-rc1 review
Subsystems (7)
Greg Kroah-Hartman
maintainerPATCH 396/550 usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jia-Ju Bai <[email protected]>
[ Upstream commit ef307bc6ef04e8c1ea843231db58e3afaafa9fa6 ]
In _dwc2_hcd_urb_enqueue(), "urb->hcpriv = NULL" is executed without holding the lock "hsotg->lock". In _dwc2_hcd_urb_dequeue():
spin_lock_irqsave(&hsotg->lock, flags);
...
if (!urb->hcpriv) {
dev_dbg(hsotg->dev, "## urb->hcpriv is NULL ##\n");
goto out;
}
rc = dwc2_hcd_urb_dequeue(hsotg, urb->hcpriv); // Use urb->hcpriv
...
out:
spin_unlock_irqrestore(&hsotg->lock, flags);When _dwc2_hcd_urb_enqueue() and _dwc2_hcd_urb_dequeue() are concurrently executed, the NULL check of "urb->hcpriv" can be executed before "urb->hcpriv = NULL". After urb->hcpriv is NULL, it can be used in the function call to dwc2_hcd_urb_dequeue(), which can cause a NULL pointer dereference.
This possible bug is found by an experimental static analysis tool developed by myself. This tool analyzes the locking APIs to extract function pairs that can be concurrently executed, and then analyzes the instructions in the paired functions to identify possible concurrency bugs including data races and atomicity violations. The above possible bug is reported, when my tool analyzes the source code of Linux 6.5.
To fix this possible bug, "urb->hcpriv = NULL" should be executed with holding the lock "hsotg->lock". After using this patch, my tool never reports the possible bug, with the kernelconfiguration allyesconfig for x86_64. Because I have no associated hardware, I cannot test the patch in runtime testing, and just verify it according to the code logic.
--- drivers/usb/dwc2/hcd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/dwc2/hcd.c +1 -1
@@ -4769,8 +4769,8 @@ static int _dwc2_hcd_urb_enqueue(struct usb_hcd *hcd, struct urb *urb,if (qh_allocated && qh->channel && qh->channel->qh == qh) qh->channel->qh =NULL ; fail2: -spin_unlock_irqrestore (&hsotg->lock, flags); urb->hcpriv =NULL ; +spin_unlock_irqrestore (&hsotg->lock, flags);kfree (qtd); fail1:if (qh_allocated) {
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 397/550 usb: chipidea: Fix DMA overwrite for Tegra
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michał Mirosław <[email protected]>
[ Upstream commit 7ab8716713c931ac79988f2592e1cf8b2e4fec1b ]
Tegra USB controllers seem to issue DMA in full 32-bit words only and thus may overwrite unevenly-sized buffers. One such occurrence is detected by SLUB when receiving a reply to a 1-byte buffer (below). Fix this by allocating a bounce buffer also for buffers with sizes not a multiple of 4.
=============================================================================
BUG kmalloc-64 (Tainted: G B ): kmalloc Redzone overwritten
-----------------------------------------------------------------------------
0x8555cd02-0x8555cd03 @offset=3330. First byte 0x0 instead of 0xcc Allocated in usb_get_status+0x2b/0xac age=1 cpu=3 pid=41
__kmem_cache_alloc_node+0x12f/0x1e4 __kmalloc+0x33/0x8c usb_get_status+0x2b/0xac hub_probe+0x5e9/0xcec usb_probe_interface+0xbf/0x21c really_probe+0xa5/0x2c4 __driver_probe_device+0x75/0x174 driver_probe_device+0x31/0x94 __device_attach_driver+0x65/0xc0 bus_for_each_drv+0x4b/0x74 __device_attach+0x69/0x120 bus_probe_device+0x65/0x6c device_add+0x48b/0x5f8 usb_set_configuration+0x37b/0x6b4 usb_generic_driver_probe+0x37/0x68 usb_probe_device+0x35/0xb4
Slab 0xbf622b80 objects=21 used=18 fp=0x8555cdc0 flags=0x800(slab|zone=0) Object 0x8555cd00 @offset=3328 fp=0x00000000
Redzone 8555ccc0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................ Redzone 8555ccd0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................ Redzone 8555cce0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................ Redzone 8555ccf0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
Object 8555cd00: 01 00 00 00 cc cc cc cc cc cc cc cc cc cc cc cc ................
Object 8555cd10: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
Object 8555cd20: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
Object 8555cd30: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
Redzone 8555cd40: cc cc cc cc ....
Padding 8555cd74: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZ
CPU: 3 PID: 41 Comm: kworker/3:1 Tainted: G B 6.6.0-rc1mq-00118-g59786f827ea1 #1115 Hardware name: NVIDIA Tegra SoC (Flattened Device Tree) Workqueue: usb_hub_wq hub_event [<8010ca28>] (unwind_backtrace) from [<801090a5>] (show_stack+0x11/0x14) [<801090a5>] (show_stack) from [<805da2fb>] (dump_stack_lvl+0x4d/0x7c) [<805da2fb>] (dump_stack_lvl) from [<8026464f>] (check_bytes_and_report+0xb3/0xe4) [<8026464f>] (check_bytes_and_report) from [<802648e1>] (check_object+0x261/0x290) [<802648e1>] (check_object) from [<802671b1>] (free_to_partial_list+0x105/0x3f8) [<802671b1>] (free_to_partial_list) from [<80268613>] (__kmem_cache_free+0x103/0x128) [<80268613>] (__kmem_cache_free) from [<80425a67>] (usb_get_status+0x73/0xac) [<80425a67>] (usb_get_status) from [<80421b31>] (hub_probe+0x5e9/0xcec) [<80421b31>] (hub_probe) from [<80428bbb>] (usb_probe_interface+0xbf/0x21c) [<80428bbb>] (usb_probe_interface) from [<803ee13d>] (really_probe+0xa5/0x2c4) [<803ee13d>] (really_probe) from [<803ee3d1>] (__driver_probe_device+0x75/0x174) [<803ee3d1>] (__driver_probe_device) from [<803ee501>] (driver_probe_device+0x31/0x94)
usb 1-1: device descriptor read/8, error -71
--- drivers/usb/chipidea/host.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/usb/chipidea/host.c +4 -3
@@ -411,12 +411,13 @@ static int ci_hdrc_alloc_dma_aligned_buffer(struct urb *urb, gfp_t mem_flags)const unsigned int ci_hdrc_usb_dma_align =32 ;size_t kmalloc_size; -if (urb->num_sgs || urb->sg || urb->transfer_buffer_length ==0 || - !((uintptr_t )urb->transfer_buffer & (ci_hdrc_usb_dma_align -1 ))) +if (urb->num_sgs || urb->sg || urb->transfer_buffer_length ==0 ) +return 0 ; +if (!((uintptr_t )urb->transfer_buffer & (ci_hdrc_usb_dma_align -1 )) && !(urb->transfer_buffer_length &3 ))return 0 ;/* Allocate a buffer with enough padding for alignment */ - kmalloc_size = urb->transfer_buffer_length + + kmalloc_size =ALIGN (urb->transfer_buffer_length,4 ) +sizeof (struct ci_hdrc_dma_aligned_buffer ) + ci_hdrc_usb_dma_align -1 ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 398/550 usb: chipidea: Simplify Tegra DMA alignment code
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michał Mirosław <[email protected]>
[ Upstream commit 2ae61a2562c0d1720545b0845829a65fb6a9c2c6 ]
The USB host on Tegra3 works with 32-bit alignment. Previous code tried to align the buffer, but it did align the wrapper struct instead, so the buffer was at a constant offset of 8 bytes (two pointers) from expected alignment. Since kmalloc() guarantees at least 8-byte alignment already, the alignment-extending is removed.
--- drivers/usb/chipidea/host.c | 45 +++++++++++++++---------------------- 1 file changed, 18 insertions(+), 27 deletions(-)
drivers/usb/chipidea/host.c +18 -27
@@ -30,8 +30,7 @@ struct ehci_ci_priv { };struct ci_hdrc_dma_aligned_buffer { -void *kmalloc_ptr; -void *old_xfer_buffer; +void *original_buffer;u8 data[]; };
@@ -380,60 +379,52 @@ static int ci_ehci_bus_suspend(struct usb_hcd *hcd)return 0 ; } -static void ci_hdrc_free_dma_aligned_buffer (struct urb *urb) +static void ci_hdrc_free_dma_aligned_buffer (struct urb *urb,bool copy_back) {struct ci_hdrc_dma_aligned_buffer *temp; -size_t length;if (!(urb->transfer_flags &URB_ALIGNED_TEMP_BUFFER ))return ; + urb->transfer_flags &= ~URB_ALIGNED_TEMP_BUFFER ; temp =container_of (urb->transfer_buffer, struct ci_hdrc_dma_aligned_buffer, data); + urb->transfer_buffer = temp->original_buffer; + +if (copy_back &&usb_urb_dir_in (urb)) { +size_t length; -if (usb_urb_dir_in (urb)) {if (usb_pipeisoc (urb->pipe)) length = urb->transfer_buffer_length;else length = urb->actual_length; -memcpy (temp->old_xfer_buffer, temp->data, length); +memcpy (temp->original_buffer, temp->data, length); } - urb->transfer_buffer = temp->old_xfer_buffer; -kfree (temp->kmalloc_ptr); - urb->transfer_flags &= ~URB_ALIGNED_TEMP_BUFFER ; +kfree (temp); }static int ci_hdrc_alloc_dma_aligned_buffer (struct urb *urb,gfp_t mem_flags) { -struct ci_hdrc_dma_aligned_buffer *temp, *kmalloc_ptr; -const unsigned int ci_hdrc_usb_dma_align =32 ; -size_t kmalloc_size; +struct ci_hdrc_dma_aligned_buffer *temp;if (urb->num_sgs || urb->sg || urb->transfer_buffer_length ==0 )return 0 ; -if (!((uintptr_t )urb->transfer_buffer & (ci_hdrc_usb_dma_align -1 )) && !(urb->transfer_buffer_length &3 )) +if (IS_ALIGNED ((uintptr_t )urb->transfer_buffer,4 ) + &&IS_ALIGNED (urb->transfer_buffer_length,4 ))return 0 ; -/* Allocate a buffer with enough padding for alignment */ - kmalloc_size =ALIGN (urb->transfer_buffer_length,4 ) + -sizeof (struct ci_hdrc_dma_aligned_buffer ) + - ci_hdrc_usb_dma_align -1 ; - - kmalloc_ptr =kmalloc (kmalloc_size, mem_flags); -if (!kmalloc_ptr) + temp =kmalloc (sizeof (*temp) +ALIGN (urb->transfer_buffer_length,4 ), mem_flags); +if (!temp)return -ENOMEM ; -/* Position our struct dma_aligned_buffer such that data is aligned */ - temp =PTR_ALIGN (kmalloc_ptr +1 , ci_hdrc_usb_dma_align) -1 ; - temp->kmalloc_ptr = kmalloc_ptr; - temp->old_xfer_buffer = urb->transfer_buffer;if (usb_urb_dir_out (urb))memcpy (temp->data, urb->transfer_buffer, urb->transfer_buffer_length); - urb->transfer_buffer = temp->data; + temp->original_buffer = urb->transfer_buffer; + urb->transfer_buffer = temp->data; urb->transfer_flags |=URB_ALIGNED_TEMP_BUFFER ;return 0 ;
@@ -450,7 +441,7 @@ static int ci_hdrc_map_urb_for_dma(struct usb_hcd *hcd, struct urb *urb, ret =usb_hcd_map_urb_for_dma (hcd, urb, mem_flags);if (ret) -ci_hdrc_free_dma_aligned_buffer (urb); +ci_hdrc_free_dma_aligned_buffer (urb, false);return ret; }
@@ -458,7 +449,7 @@ static int ci_hdrc_map_urb_for_dma(struct usb_hcd *hcd, struct urb *urb,static void ci_hdrc_unmap_urb_for_dma (struct usb_hcd *hcd,struct urb *urb) {usb_hcd_unmap_urb_for_dma (hcd, urb); -ci_hdrc_free_dma_aligned_buffer (urb); +ci_hdrc_free_dma_aligned_buffer (urb, true); }#ifdef CONFIG_PM_SLEEP
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 399/550 dmaengine: ti: edma: handle irq_of_parse_and_map() errors
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 14f6d317913f634920a640e9047aa2e66f5bdcb7 ]
Zero is not a valid IRQ for in-kernel code and the irq_of_parse_and_map() function returns zero on error. So this check for valid IRQs should only accept values > 0.
--- drivers/dma/ti/edma.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/dma/ti/edma.c +2 -2
@@ -2402,7 +2402,7 @@ static int edma_probe(struct platform_device *pdev)if (irq <0 && node) irq =irq_of_parse_and_map (node,0 ); -if (irq >=0 ) { +if (irq >0 ) { irq_name =devm_kasprintf (dev,GFP_KERNEL ,"%s_ccint" ,dev_name (dev)); ret = devm_request_irq(dev, irq, dma_irq_handler, 0, irq_name,
@@ -2418,7 +2418,7 @@ static int edma_probe(struct platform_device *pdev)if (irq <0 && node) irq =irq_of_parse_and_map (node,2 ); -if (irq >=0 ) { +if (irq >0 ) { irq_name =devm_kasprintf (dev,GFP_KERNEL ,"%s_ccerrint" ,dev_name (dev)); ret = devm_request_irq(dev, irq, dma_ccerr_handler, 0, irq_name,
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 400/550 tools/perf: Update call stack check in builtin-lock.c
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kajol Jain <[email protected]>
[ Upstream commit d7c9ae8d5d1be0c4156d1e20e4369a77b711a4cc ]
The perf test named "kernel lock contention analysis test" fails in powerpc system with below error:
[command]# ./perf test 81 -vv
81: kernel lock contention analysis test :
--- start ---
test child forked, pid 2140
Testing perf lock record and perf lock contention Testing perf lock contention --use-bpf
[Skip] No BPF support
Testing perf lock record and perf lock contention at the same time Testing perf lock contention --threads
Testing perf lock contention --lock-addr
Testing perf lock contention --type-filter (w/ spinlock) Testing perf lock contention --lock-filter (w/ tasklist_lock) Testing perf lock contention --callstack-filter (w/ unix_stream) [Fail] Recorded result should have a lock from unix_stream:
test child finished with -1
---- end ----
kernel lock contention analysis test: FAILED!
The test is failing because we get an address entry with 0 in perf lock samples for powerpc, and code for lock contention option "--callstack-filter" will not check further entries after address 0.
Below are some of the samples from test generated perf.data file, which have 0 address in the 2nd entry of callstack:
--------
sched-messaging 3409 [001] 7152.904029: lock:contention_begin: 0xc00000c80904ef00 (flags=SPIN)
c0000000001e926c __traceiter_contention_begin+0x6c ([kernel.kallsyms])
0 [unknown] ([unknown])
c000000000f8a178 native_queued_spin_lock_slowpath+0x1f8 ([kernel.kallsyms])
c000000000f89f44 _raw_spin_lock_irqsave+0x84 ([kernel.kallsyms])
c0000000001d9fd0 prepare_to_wait+0x50 ([kernel.kallsyms])
c000000000c80f50 sock_alloc_send_pskb+0x1b0 ([kernel.kallsyms])
c000000000e82298 unix_stream_sendmsg+0x2b8 ([kernel.kallsyms])
c000000000c78980 sock_sendmsg+0x80 ([kernel.kallsyms])sched-messaging 3408 [005] 7152.904036: lock:contention_begin: 0xc00000c80904ef00 (flags=SPIN)
c0000000001e926c __traceiter_contention_begin+0x6c ([kernel.kallsyms])
0 [unknown] ([unknown])
c000000000f8a178 native_queued_spin_lock_slowpath+0x1f8 ([kernel.kallsyms])
c000000000f89f44 _raw_spin_lock_irqsave+0x84 ([kernel.kallsyms])
c0000000001d9fd0 prepare_to_wait+0x50 ([kernel.kallsyms])
c000000000c80f50 sock_alloc_send_pskb+0x1b0 ([kernel.kallsyms])
c000000000e82298 unix_stream_sendmsg+0x2b8 ([kernel.kallsyms])
c000000000c78980 sock_sendmsg+0x80 ([kernel.kallsyms])--------
Based on commit 20002ded4d93 ("perf_counter: powerpc: Add callchain support"), incase of powerpc, the callchain saved by kernel always includes first three entries as the NIP (next instruction pointer), LR (link register), and the contents of LR save area in the second stack frame. In certain scenarios its possible to have invalid kernel instruction addresses in either of LR or the second stack frame's LR. In that case, kernel will store the address as zer0. Hence, its possible to have 2nd or 3rd callstack entry as 0.
As per the current code in match_callstack_filter function, we skip the callstack check incase we get 0 address. And hence the test case is failing in powerpc.
Fix this issue by updating the check in match_callstack_filter function, to not skip callstack check if the 2nd or 3rd entry have 0 address for powerpc.
Result in powerpc after patch changes:
[command]# ./perf test 81 -vv
81: kernel lock contention analysis test :
--- start ---
test child forked, pid 4570
Testing perf lock record and perf lock contention
Testing perf lock contention --use-bpf
[Skip] No BPF support
Testing perf lock record and perf lock contention at the same time Testing perf lock contention --threads
Testing perf lock contention --lock-addr
Testing perf lock contention --type-filter (w/ spinlock) Testing perf lock contention --lock-filter (w/ tasklist_lock) [Skip] Could not find 'tasklist_lock'
Testing perf lock contention --callstack-filter (w/ unix_stream) Testing perf lock contention --callstack-filter with task aggregation Testing perf lock contention CSV output
[Skip] No BPF support
test child finished with 0
---- end ----
kernel lock contention analysis test: Ok
--- tools/perf/builtin-lock.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-)
tools/perf/builtin-lock.c +16 -1
@@ -524,6 +524,7 @@ bool match_callstack_filter(struct machine *machine, u64 *callstack)struct map *kmap;struct symbol *sym;u64 ip; +const char *arch =perf_env__arch (machine->env);if (list_empty (&callstack_filters))return true;
@@ -531,7 +532,21 @@ bool match_callstack_filter(struct machine *machine, u64 *callstack)for (int i =0 ; i < max_stack_depth; i++) {struct callstack_filter *filter; -if (!callstack || !callstack[i]) +/* +* In powerpc, the callchain saved by kernel always includes +* first three entries as the NIP (next instruction pointer), +* LR (link register), and the contents of LR save area in the +* second stack frame. In certain scenarios its possible to have +* invalid kernel instruction addresses in either LR or the second +* stack frame's LR. In that case, kernel will store that address as +* zero. +* +* The below check will continue to look into callstack, +* incase first or second callstack index entry has 0 +* address for powerpc. +*/ +if (!callstack || (!callstack[i] && (strcmp (arch,"powerpc" ) || + (i !=1 && i !=2 ))))break ; ip = callstack[i];
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 401/550 misc: st_core: Do not call kfree_skb() under spin_lock_irqsave()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 4d08c3d12b61022501989f9f071514d2d6f77c47 ]
It is not allowed to call kfree_skb() from hardware interrupt context or with hardware interrupts being disabled. So replace kfree_skb() with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile tested only.
--- drivers/misc/ti-st/st_core.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/misc/ti-st/st_core.c +4 -3
@@ -15,6 +15,7 @@#include <linux/skbuff.h> #include <linux/ti_wilink_st.h> +#include <linux/netdevice.h> extern void st_kim_recv (void *,const unsigned char *,long );void st_int_recv (void *,const unsigned char *,long );
@@ -435,7 +436,7 @@ static void st_int_enqueue(struct st_data_s *st_gdata, struct sk_buff *skb)case ST_LL_AWAKE_TO_ASLEEP :pr_err ("ST LL is illegal state(%ld)," "purging received skb." ,st_ll_getstate (st_gdata)); -kfree_skb (skb); +dev_kfree_skb_irq (skb);break ;case ST_LL_ASLEEP :skb_queue_tail (&st_gdata->tx_waitq, skb);
@@ -444,7 +445,7 @@ static void st_int_enqueue(struct st_data_s *st_gdata, struct sk_buff *skb)default :pr_err ("ST LL is illegal state(%ld)," "purging received skb." ,st_ll_getstate (st_gdata)); -kfree_skb (skb); +dev_kfree_skb_irq (skb);break ; }
@@ -498,7 +499,7 @@ void st_tx_wakeup(struct st_data_s *st_data)spin_unlock_irqrestore (&st_data->lock, flags);break ; } -kfree_skb (skb); +dev_kfree_skb_irq (skb);spin_unlock_irqrestore (&st_data->lock, flags); }/* if wake-up is set in another context- restart sending */
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 402/550 tools: iio: iio_generic_buffer ensure alignment
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matti Vaittinen <[email protected]>
[ Upstream commit 2d3dff577dd0ea8fe9637a13822f7603c4a881c8 ]
The iio_generic_buffer can return garbage values when the total size of scan data is not a multiple of the largest element in the scan. This can be demonstrated by reading a scan, consisting, for example of one 4-byte and one 2-byte element, where the 4-byte element is first in the buffer.
The IIO generic buffer code does not take into account the last two padding bytes that are needed to ensure that the 4-byte data for next scan is correctly aligned.
Add the padding bytes required to align the next sample with the scan size.
--- tools/iio/iio_generic_buffer.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
tools/iio/iio_generic_buffer.c +12 -1
@@ -54,9 +54,12 @@ enum autochan {static unsigned int size_from_channelarray (struct iio_channel_info *channels,int num_channels) {unsigned int bytes =0 ; -int i =0 ; +int i =0 , max =0 ; +unsigned int misalignment;while (i < num_channels) { +if (channels[i].bytes > max) + max = channels[i].bytes;if (bytes % channels[i].bytes ==0 ) channels[i].location = bytes;else
@@ -66,6 +69,14 @@ static unsigned int size_from_channelarray(struct iio_channel_info *channels, in bytes = channels[i].location + channels[i].bytes; i++; } +/* +* We want the data in next sample to also be properly aligned so +* we'll add padding at the end if needed. Adding padding only +* works for channel data which size is 2^n bytes. +*/ + misalignment = bytes % max; +if (misalignment) + bytes += max - misalignment;return bytes; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 403/550 USB: usbip: fix stub_dev hub disconnect
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Blixt <[email protected]>
[ Upstream commit 97475763484245916735a1aa9a3310a01d46b008 ]
If a hub is disconnected that has device(s) that's attached to the usbip layer the disconnect function might fail because it tries to release the port on an already disconnected hub.
--- drivers/usb/usbip/stub_dev.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/usb/usbip/stub_dev.c +7 -2
@@ -464,8 +464,13 @@ static void stub_disconnect(struct usb_device *udev)/* release port */ rc =usb_hub_release_port (udev->parent, udev->portnum, (struct usb_dev_state *) udev); -if (rc) { -dev_dbg (&udev->dev,"unable to release port\n" ); +/* +* NOTE: If a HUB disconnect triggered disconnect of the down stream +* device usb_hub_release_port will return -ENODEV so we can safely ignore +* that error here. +*/ +if (rc && (rc != -ENODEV )) { +dev_dbg (&udev->dev,"unable to release port (%i)\n" , rc);return ; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 404/550 dmaengine: pxa_dma: Remove an erroneous BUG_ON() in pxad_free_desc()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 83c761f568733277ce1f7eb9dc9e890649c29a8c ]
If pxad_alloc_desc() fails on the first dma_pool_alloc() call, then sw_desc->nb_desc is zero.
In such a case pxad_free_desc() is called and it will BUG_ON().
Remove this erroneous BUG_ON().
It is also useless, because if "sw_desc->nb_desc == 0", then, on the first iteration of the for loop, i is -1 and the loop will not be executed. (both i and sw_desc->nb_desc are 'int')
--- drivers/dma/pxa_dma.c | 1 - 1 file changed, 1 deletion(-)
drivers/dma/pxa_dma.c +0 -1
@@ -722,7 +722,6 @@ static void pxad_free_desc(struct virt_dma_desc *vd)dma_addr_t dma;struct pxad_desc_sw *sw_desc =to_pxad_sw_desc (vd); -BUG_ON (sw_desc->nb_desc ==0 );for (i = sw_desc->nb_desc -1 ; i >=0 ; i--) {if (i >0 ) dma = sw_desc->hw_desc[i -1 ]->ddadr;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 405/550 f2fs: fix to initialize map.m_pblk in f2fs_precache_extents()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit 8b07c1fb0f1ad139373c8253f2fad8bc43fab07d ]
Otherwise, it may print random physical block address in tracepoint of f2fs_map_blocks() as below:
f2fs_map_blocks: dev = (253,16), ino = 2297, file offset = 0, start blkaddr = 0xa356c421, len = 0x0, flags = 0
--- fs/f2fs/file.c | 1 + 1 file changed, 1 insertion(+)
fs/f2fs/file.c +1 -0
@@ -3258,6 +3258,7 @@ int f2fs_precache_extents(struct inode *inode)return -EOPNOTSUPP ; map.m_lblk =0 ; + map.m_pblk =0 ; map.m_next_pgofs =NULL ; map.m_next_extent = &m_next_extent; map.m_seg_type =NO_CHECK_TYPE ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 406/550 interconnect: qcom: qdu1000: Set ACV enable_mask
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit 8517824f0e94d52ab82742106314f0b8875e03c4 ]
ACV expects an enable_mask corresponding to the APPS RSC, fill it in.
--- drivers/interconnect/qcom/qdu1000.c | 1 + 1 file changed, 1 insertion(+)
drivers/interconnect/qcom/qdu1000.c +1 -0
@@ -768,6 +768,7 @@ static struct qcom_icc_node xs_sys_tcu_cfg = {static struct qcom_icc_bcm bcm_acv = { .name ="ACV" , + .enable_mask =BIT (3 ), .num_nodes =1 , .nodes = { &ebi }, };
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 407/550 interconnect: qcom: sc7180: Retire DEFINE_QBCM
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit e451b2ea5a11fb3f6d83e1f834ae6a5f55a02bba ]
The struct definition macros are hard to read and compare, expand them.
Stable-dep-of: 1ad83c479272 ("interconnect: qcom: sc7180: Set ACV enable_mask")
--- drivers/interconnect/qcom/sc7180.c | 255 ++++++++++++++++++++++++++--- 1 file changed, 231 insertions(+), 24 deletions(-)
drivers/interconnect/qcom/sc7180.c +231 -24
@@ -153,30 +153,237 @@ DEFINE_QNODE(srvc_snoc, SC7180_SLAVE_SERVICE_SNOC, 1, 4);DEFINE_QNODE (xs_qdss_stm,SC7180_SLAVE_QDSS_STM ,1 ,4 );DEFINE_QNODE (xs_sys_tcu_cfg,SC7180_SLAVE_TCU ,1 ,8 ); -DEFINE_QBCM (bcm_acv,"ACV" , false, &ebi); -DEFINE_QBCM (bcm_mc0,"MC0" , true, &ebi); -DEFINE_QBCM (bcm_sh0,"SH0" , true, &qns_llcc); -DEFINE_QBCM (bcm_mm0,"MM0" , false, &qns_mem_noc_hf); -DEFINE_QBCM (bcm_ce0,"CE0" , false, &qxm_crypto); -DEFINE_QBCM (bcm_cn0,"CN0" , true, &qnm_snoc, &xm_qdss_dap, &qhs_a1_noc_cfg, &qhs_a2_noc_cfg, &qhs_ahb2phy0, &qhs_aop, &qhs_aoss, &qhs_boot_rom, &qhs_camera_cfg, &qhs_camera_nrt_throttle_cfg, &qhs_camera_rt_throttle_cfg, &qhs_clk_ctl, &qhs_cpr_cx, &qhs_cpr_mx, &qhs_crypto0_cfg, &qhs_dcc_cfg, &qhs_ddrss_cfg, &qhs_display_cfg, &qhs_display_rt_throttle_cfg, &qhs_display_throttle_cfg, &qhs_glm, &qhs_gpuss_cfg, &qhs_imem_cfg, &qhs_ipa, &qhs_mnoc_cfg, &qhs_mss_cfg, &qhs_npu_cfg, &qhs_npu_dma_throttle_cfg, &qhs_npu_dsp_throttle_cfg, &qhs_pimem_cfg, &qhs_prng, &qhs_qdss_cfg, &qhs_qm_cfg, &qhs_qm_mpu_cfg, &qhs_qup0, &qhs_qup1, &qhs_security, &qhs_snoc_cfg, &qhs_tcsr, &qhs_tlmm_1, &qhs_tlmm_2, &qhs_tlmm_3, &qhs_ufs_mem_cfg, &qhs_usb3, &qhs_venus_cfg, &qhs_venus_throttle_cfg, &qhs_vsense_ctrl_cfg, &srvc_cnoc); -DEFINE_QBCM (bcm_mm1,"MM1" , false, &qxm_camnoc_hf0_uncomp, &qxm_camnoc_hf1_uncomp, &qxm_camnoc_sf_uncomp, &qhm_mnoc_cfg, &qxm_mdp0, &qxm_rot, &qxm_venus0, &qxm_venus_arm9); -DEFINE_QBCM (bcm_sh2,"SH2" , false, &acm_sys_tcu); -DEFINE_QBCM (bcm_mm2,"MM2" , false, &qns_mem_noc_sf); -DEFINE_QBCM (bcm_qup0,"QUP0" , false, &qup_core_master_1, &qup_core_master_2); -DEFINE_QBCM (bcm_sh3,"SH3" , false, &qnm_cmpnoc); -DEFINE_QBCM (bcm_sh4,"SH4" , false, &acm_apps0); -DEFINE_QBCM (bcm_sn0,"SN0" , true, &qns_gemnoc_sf); -DEFINE_QBCM (bcm_co0,"CO0" , false, &qns_cdsp_gemnoc); -DEFINE_QBCM (bcm_sn1,"SN1" , false, &qxs_imem); -DEFINE_QBCM (bcm_cn1,"CN1" , false, &qhm_qspi, &xm_sdc2, &xm_emmc, &qhs_ahb2phy2, &qhs_emmc_cfg, &qhs_pdm, &qhs_qspi, &qhs_sdc2); -DEFINE_QBCM (bcm_sn2,"SN2" , false, &qxm_pimem, &qns_gemnoc_gc); -DEFINE_QBCM (bcm_co2,"CO2" , false, &qnm_npu); -DEFINE_QBCM (bcm_sn3,"SN3" , false, &qxs_pimem); -DEFINE_QBCM (bcm_co3,"CO3" , false, &qxm_npu_dsp); -DEFINE_QBCM (bcm_sn4,"SN4" , false, &xs_qdss_stm); -DEFINE_QBCM (bcm_sn7,"SN7" , false, &qnm_aggre1_noc); -DEFINE_QBCM (bcm_sn9,"SN9" , false, &qnm_aggre2_noc); -DEFINE_QBCM (bcm_sn12,"SN12" , false, &qnm_gemnoc); +static struct qcom_icc_bcm bcm_acv = { + .name ="ACV" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &ebi }, +}; + +static struct qcom_icc_bcm bcm_mc0 = { + .name ="MC0" , + .keepalive = true, + .num_nodes =1 , + .nodes = { &ebi }, +}; + +static struct qcom_icc_bcm bcm_sh0 = { + .name ="SH0" , + .keepalive = true, + .num_nodes =1 , + .nodes = { &qns_llcc }, +}; + +static struct qcom_icc_bcm bcm_mm0 = { + .name ="MM0" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qns_mem_noc_hf }, +}; + +static struct qcom_icc_bcm bcm_ce0 = { + .name ="CE0" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qxm_crypto }, +}; + +static struct qcom_icc_bcm bcm_cn0 = { + .name ="CN0" , + .keepalive = true, + .num_nodes =48 , + .nodes = { &qnm_snoc, + &xm_qdss_dap, + &qhs_a1_noc_cfg, + &qhs_a2_noc_cfg, + &qhs_ahb2phy0, + &qhs_aop, + &qhs_aoss, + &qhs_boot_rom, + &qhs_camera_cfg, + &qhs_camera_nrt_throttle_cfg, + &qhs_camera_rt_throttle_cfg, + &qhs_clk_ctl, + &qhs_cpr_cx, + &qhs_cpr_mx, + &qhs_crypto0_cfg, + &qhs_dcc_cfg, + &qhs_ddrss_cfg, + &qhs_display_cfg, + &qhs_display_rt_throttle_cfg, + &qhs_display_throttle_cfg, + &qhs_glm, + &qhs_gpuss_cfg, + &qhs_imem_cfg, + &qhs_ipa, + &qhs_mnoc_cfg, + &qhs_mss_cfg, + &qhs_npu_cfg, + &qhs_npu_dma_throttle_cfg, + &qhs_npu_dsp_throttle_cfg, + &qhs_pimem_cfg, + &qhs_prng, + &qhs_qdss_cfg, + &qhs_qm_cfg, + &qhs_qm_mpu_cfg, + &qhs_qup0, + &qhs_qup1, + &qhs_security, + &qhs_snoc_cfg, + &qhs_tcsr, + &qhs_tlmm_1, + &qhs_tlmm_2, + &qhs_tlmm_3, + &qhs_ufs_mem_cfg, + &qhs_usb3, + &qhs_venus_cfg, + &qhs_venus_throttle_cfg, + &qhs_vsense_ctrl_cfg, + &srvc_cnoc + }, +}; + +static struct qcom_icc_bcm bcm_mm1 = { + .name ="MM1" , + .keepalive = false, + .num_nodes =8 , + .nodes = { &qxm_camnoc_hf0_uncomp, + &qxm_camnoc_hf1_uncomp, + &qxm_camnoc_sf_uncomp, + &qhm_mnoc_cfg, + &qxm_mdp0, + &qxm_rot, + &qxm_venus0, + &qxm_venus_arm9 + }, +}; + +static struct qcom_icc_bcm bcm_sh2 = { + .name ="SH2" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &acm_sys_tcu }, +}; + +static struct qcom_icc_bcm bcm_mm2 = { + .name ="MM2" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qns_mem_noc_sf }, +}; + +static struct qcom_icc_bcm bcm_qup0 = { + .name ="QUP0" , + .keepalive = false, + .num_nodes =2 , + .nodes = { &qup_core_master_1, &qup_core_master_2 }, +}; + +static struct qcom_icc_bcm bcm_sh3 = { + .name ="SH3" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qnm_cmpnoc }, +}; + +static struct qcom_icc_bcm bcm_sh4 = { + .name ="SH4" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &acm_apps0 }, +}; + +static struct qcom_icc_bcm bcm_sn0 = { + .name ="SN0" , + .keepalive = true, + .num_nodes =1 , + .nodes = { &qns_gemnoc_sf }, +}; + +static struct qcom_icc_bcm bcm_co0 = { + .name ="CO0" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qns_cdsp_gemnoc }, +}; + +static struct qcom_icc_bcm bcm_sn1 = { + .name ="SN1" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qxs_imem }, +}; + +static struct qcom_icc_bcm bcm_cn1 = { + .name ="CN1" , + .keepalive = false, + .num_nodes =8 , + .nodes = { &qhm_qspi, + &xm_sdc2, + &xm_emmc, + &qhs_ahb2phy2, + &qhs_emmc_cfg, + &qhs_pdm, + &qhs_qspi, + &qhs_sdc2 + }, +}; + +static struct qcom_icc_bcm bcm_sn2 = { + .name ="SN2" , + .keepalive = false, + .num_nodes =2 , + .nodes = { &qxm_pimem, &qns_gemnoc_gc }, +}; + +static struct qcom_icc_bcm bcm_co2 = { + .name ="CO2" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qnm_npu }, +}; + +static struct qcom_icc_bcm bcm_sn3 = { + .name ="SN3" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qxs_pimem }, +}; + +static struct qcom_icc_bcm bcm_co3 = { + .name ="CO3" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qxm_npu_dsp }, +}; + +static struct qcom_icc_bcm bcm_sn4 = { + .name ="SN4" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &xs_qdss_stm }, +}; + +static struct qcom_icc_bcm bcm_sn7 = { + .name ="SN7" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qnm_aggre1_noc }, +}; + +static struct qcom_icc_bcm bcm_sn9 = { + .name ="SN9" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qnm_aggre2_noc }, +}; + +static struct qcom_icc_bcm bcm_sn12 = { + .name ="SN12" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qnm_gemnoc }, +};static struct qcom_icc_bcm *const aggre1_noc_bcms[] = { &bcm_cn1,
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 408/550 interconnect: qcom: sc7180: Set ACV enable_mask
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit 1ad83c4792722fe134c1352591420702ff7b9091 ]
ACV expects an enable_mask corresponding to the APPS RSC, fill it in.
--- drivers/interconnect/qcom/sc7180.c | 1 + 1 file changed, 1 insertion(+)
drivers/interconnect/qcom/sc7180.c +1 -0
@@ -155,6 +155,7 @@ DEFINE_QNODE(xs_sys_tcu_cfg, SC7180_SLAVE_TCU, 1, 8);static struct qcom_icc_bcm bcm_acv = { .name ="ACV" , + .enable_mask =BIT (3 ), .keepalive = false, .num_nodes =1 , .nodes = { &ebi },
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 409/550 interconnect: qcom: sc7280: Set ACV enable_mask
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit 437b8e7fcd5df792cb8b8095e9f6eccefec6c099 ]
ACV expects an enable_mask corresponding to the APPS RSC, fill it in.
--- drivers/interconnect/qcom/sc7280.c | 1 + 1 file changed, 1 insertion(+)
drivers/interconnect/qcom/sc7280.c +1 -0
@@ -1284,6 +1284,7 @@ static struct qcom_icc_node srvc_snoc = {static struct qcom_icc_bcm bcm_acv = { .name ="ACV" , + .enable_mask =BIT (3 ), .num_nodes =1 , .nodes = { &ebi }, };
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 410/550 interconnect: qcom: sc8180x: Set ACV enable_mask
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit 0fcaaed3ff4b99e5b688b799f48989f1e4bb8a8b ]
ACV expects an enable_mask corresponding to the APPS RSC, fill it in.
--- drivers/interconnect/qcom/sc8180x.c | 1 + 1 file changed, 1 insertion(+)
drivers/interconnect/qcom/sc8180x.c +1 -0
@@ -1344,6 +1344,7 @@ static struct qcom_icc_node slv_qup_core_2 = {static struct qcom_icc_bcm bcm_acv = { .name ="ACV" , + .enable_mask =BIT (3 ), .num_nodes =1 , .nodes = { &slv_ebi } };
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 411/550 interconnect: qcom: sc8280xp: Set ACV enable_mask
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit 688ffb3dcf85fc4b7ea82af842493013747a9e2c ]
ACV expects an enable_mask corresponding to the APPS RSC, fill it in.
--- drivers/interconnect/qcom/sc8280xp.c | 1 + 1 file changed, 1 insertion(+)
drivers/interconnect/qcom/sc8280xp.c +1 -0
@@ -1711,6 +1711,7 @@ static struct qcom_icc_node srvc_snoc = {static struct qcom_icc_bcm bcm_acv = { .name ="ACV" , + .enable_mask =BIT (3 ), .num_nodes =1 , .nodes = { &ebi }, };
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 412/550 interconnect: qcom: sdm670: Retire DEFINE_QBCM
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit 46cd2018c52addf2031d8aea28f8208b9423af28 ]
The struct definition macros are hard to read and compare, expand them.
Stable-dep-of: 7b85ea8b9300 ("interconnect: qcom: sdm670: Set ACV enable_mask")
--- drivers/interconnect/qcom/sdm670.c | 239 ++++++++++++++++++++++++++--- 1 file changed, 215 insertions(+), 24 deletions(-)
drivers/interconnect/qcom/sdm670.c +215 -24
@@ -131,30 +131,221 @@ DEFINE_QNODE(srvc_snoc, SDM670_SLAVE_SERVICE_SNOC, 1, 4);DEFINE_QNODE (xs_qdss_stm,SDM670_SLAVE_QDSS_STM ,1 ,4 );DEFINE_QNODE (xs_sys_tcu_cfg,SDM670_SLAVE_TCU ,1 ,8 ); -DEFINE_QBCM (bcm_acv,"ACV" , false, &ebi); -DEFINE_QBCM (bcm_mc0,"MC0" , true, &ebi); -DEFINE_QBCM (bcm_sh0,"SH0" , true, &qns_llcc); -DEFINE_QBCM (bcm_mm0,"MM0" , true, &qns_mem_noc_hf); -DEFINE_QBCM (bcm_sh1,"SH1" , false, &qns_apps_io); -DEFINE_QBCM (bcm_mm1,"MM1" , true, &qxm_camnoc_hf0_uncomp, &qxm_camnoc_hf1_uncomp, &qxm_camnoc_sf_uncomp, &qxm_camnoc_hf0, &qxm_camnoc_hf1, &qxm_mdp0, &qxm_mdp1); -DEFINE_QBCM (bcm_sh2,"SH2" , false, &qns_memnoc_snoc); -DEFINE_QBCM (bcm_mm2,"MM2" , false, &qns2_mem_noc); -DEFINE_QBCM (bcm_sh3,"SH3" , false, &acm_tcu); -DEFINE_QBCM (bcm_mm3,"MM3" , false, &qxm_camnoc_sf, &qxm_rot, &qxm_venus0, &qxm_venus1, &qxm_venus_arm9); -DEFINE_QBCM (bcm_sh5,"SH5" , false, &qnm_apps); -DEFINE_QBCM (bcm_sn0,"SN0" , true, &qns_memnoc_sf); -DEFINE_QBCM (bcm_ce0,"CE0" , false, &qxm_crypto); -DEFINE_QBCM (bcm_cn0,"CN0" , true, &qhm_spdm, &qnm_snoc, &qhs_a1_noc_cfg, &qhs_a2_noc_cfg, &qhs_aop, &qhs_aoss, &qhs_camera_cfg, &qhs_clk_ctl, &qhs_compute_dsp_cfg, &qhs_cpr_cx, &qhs_crypto0_cfg, &qhs_dcc_cfg, &qhs_ddrss_cfg, &qhs_display_cfg, &qhs_emmc_cfg, &qhs_glm, &qhs_gpuss_cfg, &qhs_imem_cfg, &qhs_ipa, &qhs_mnoc_cfg, &qhs_pdm, &qhs_phy_refgen_south, &qhs_pimem_cfg, &qhs_prng, &qhs_qdss_cfg, &qhs_qupv3_north, &qhs_qupv3_south, &qhs_sdc2, &qhs_sdc4, &qhs_snoc_cfg, &qhs_spdm, &qhs_tcsr, &qhs_tlmm_north, &qhs_tlmm_south, &qhs_tsif, &qhs_ufs_mem_cfg, &qhs_usb3_0, &qhs_venus_cfg, &qhs_vsense_ctrl_cfg, &qns_cnoc_a2noc, &srvc_cnoc); -DEFINE_QBCM (bcm_qup0,"QUP0" , false, &qhm_qup1, &qhm_qup2); -DEFINE_QBCM (bcm_sn1,"SN1" , false, &qxs_imem); -DEFINE_QBCM (bcm_sn2,"SN2" , false, &qns_memnoc_gc); -DEFINE_QBCM (bcm_sn3,"SN3" , false, &qns_cnoc); -DEFINE_QBCM (bcm_sn4,"SN4" , false, &qxm_pimem, &qxs_pimem); -DEFINE_QBCM (bcm_sn5,"SN5" , false, &xs_qdss_stm); -DEFINE_QBCM (bcm_sn8,"SN8" , false, &qnm_aggre1_noc, &srvc_aggre1_noc); -DEFINE_QBCM (bcm_sn10,"SN10" , false, &qnm_aggre2_noc, &srvc_aggre2_noc); -DEFINE_QBCM (bcm_sn11,"SN11" , false, &qnm_gladiator_sodv, &xm_gic); -DEFINE_QBCM (bcm_sn13,"SN13" , false, &qnm_memnoc); +static struct qcom_icc_bcm bcm_acv = { + .name ="ACV" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &ebi }, +}; + +static struct qcom_icc_bcm bcm_mc0 = { + .name ="MC0" , + .keepalive = true, + .num_nodes =1 , + .nodes = { &ebi }, +}; + +static struct qcom_icc_bcm bcm_sh0 = { + .name ="SH0" , + .keepalive = true, + .num_nodes =1 , + .nodes = { &qns_llcc }, +}; + +static struct qcom_icc_bcm bcm_mm0 = { + .name ="MM0" , + .keepalive = true, + .num_nodes =1 , + .nodes = { &qns_mem_noc_hf }, +}; + +static struct qcom_icc_bcm bcm_sh1 = { + .name ="SH1" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qns_apps_io }, +}; + +static struct qcom_icc_bcm bcm_mm1 = { + .name ="MM1" , + .keepalive = true, + .num_nodes =7 , + .nodes = { &qxm_camnoc_hf0_uncomp, + &qxm_camnoc_hf1_uncomp, + &qxm_camnoc_sf_uncomp, + &qxm_camnoc_hf0, + &qxm_camnoc_hf1, + &qxm_mdp0, + &qxm_mdp1 + }, +}; + +static struct qcom_icc_bcm bcm_sh2 = { + .name ="SH2" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qns_memnoc_snoc }, +}; + +static struct qcom_icc_bcm bcm_mm2 = { + .name ="MM2" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qns2_mem_noc }, +}; + +static struct qcom_icc_bcm bcm_sh3 = { + .name ="SH3" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &acm_tcu }, +}; + +static struct qcom_icc_bcm bcm_mm3 = { + .name ="MM3" , + .keepalive = false, + .num_nodes =5 , + .nodes = { &qxm_camnoc_sf, &qxm_rot, &qxm_venus0, &qxm_venus1, &qxm_venus_arm9 }, +}; + +static struct qcom_icc_bcm bcm_sh5 = { + .name ="SH5" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qnm_apps }, +}; + +static struct qcom_icc_bcm bcm_sn0 = { + .name ="SN0" , + .keepalive = true, + .num_nodes =1 , + .nodes = { &qns_memnoc_sf }, +}; + +static struct qcom_icc_bcm bcm_ce0 = { + .name ="CE0" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qxm_crypto }, +}; + +static struct qcom_icc_bcm bcm_cn0 = { + .name ="CN0" , + .keepalive = true, + .num_nodes =41 , + .nodes = { &qhm_spdm, + &qnm_snoc, + &qhs_a1_noc_cfg, + &qhs_a2_noc_cfg, + &qhs_aop, + &qhs_aoss, + &qhs_camera_cfg, + &qhs_clk_ctl, + &qhs_compute_dsp_cfg, + &qhs_cpr_cx, + &qhs_crypto0_cfg, + &qhs_dcc_cfg, + &qhs_ddrss_cfg, + &qhs_display_cfg, + &qhs_emmc_cfg, + &qhs_glm, + &qhs_gpuss_cfg, + &qhs_imem_cfg, + &qhs_ipa, + &qhs_mnoc_cfg, + &qhs_pdm, + &qhs_phy_refgen_south, + &qhs_pimem_cfg, + &qhs_prng, + &qhs_qdss_cfg, + &qhs_qupv3_north, + &qhs_qupv3_south, + &qhs_sdc2, + &qhs_sdc4, + &qhs_snoc_cfg, + &qhs_spdm, + &qhs_tcsr, + &qhs_tlmm_north, + &qhs_tlmm_south, + &qhs_tsif, + &qhs_ufs_mem_cfg, + &qhs_usb3_0, + &qhs_venus_cfg, + &qhs_vsense_ctrl_cfg, + &qns_cnoc_a2noc, + &srvc_cnoc + }, +}; + +static struct qcom_icc_bcm bcm_qup0 = { + .name ="QUP0" , + .keepalive = false, + .num_nodes =2 , + .nodes = { &qhm_qup1, &qhm_qup2 }, +}; + +static struct qcom_icc_bcm bcm_sn1 = { + .name ="SN1" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qxs_imem }, +}; + +static struct qcom_icc_bcm bcm_sn2 = { + .name ="SN2" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qns_memnoc_gc }, +}; + +static struct qcom_icc_bcm bcm_sn3 = { + .name ="SN3" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qns_cnoc }, +}; + +static struct qcom_icc_bcm bcm_sn4 = { + .name ="SN4" , + .keepalive = false, + .num_nodes =2 , + .nodes = { &qxm_pimem, &qxs_pimem }, +}; + +static struct qcom_icc_bcm bcm_sn5 = { + .name ="SN5" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &xs_qdss_stm }, +}; + +static struct qcom_icc_bcm bcm_sn8 = { + .name ="SN8" , + .keepalive = false, + .num_nodes =2 , + .nodes = { &qnm_aggre1_noc, &srvc_aggre1_noc }, +}; + +static struct qcom_icc_bcm bcm_sn10 = { + .name ="SN10" , + .keepalive = false, + .num_nodes =2 , + .nodes = { &qnm_aggre2_noc, &srvc_aggre2_noc }, +}; + +static struct qcom_icc_bcm bcm_sn11 = { + .name ="SN11" , + .keepalive = false, + .num_nodes =2 , + .nodes = { &qnm_gladiator_sodv, &xm_gic }, +}; + +static struct qcom_icc_bcm bcm_sn13 = { + .name ="SN13" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qnm_memnoc }, +};static struct qcom_icc_bcm *const aggre1_noc_bcms[] = { &bcm_qup0,
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 413/550 interconnect: qcom: sdm670: Set ACV enable_mask
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit 7b85ea8b9300be5c2818e1f61a274ff2c4c063ee ]
ACV expects an enable_mask corresponding to the APPS RSC, fill it in.
--- drivers/interconnect/qcom/sdm670.c | 1 + 1 file changed, 1 insertion(+)
drivers/interconnect/qcom/sdm670.c +1 -0
@@ -133,6 +133,7 @@ DEFINE_QNODE(xs_sys_tcu_cfg, SDM670_SLAVE_TCU, 1, 8);static struct qcom_icc_bcm bcm_acv = { .name ="ACV" , + .enable_mask =BIT (3 ), .keepalive = false, .num_nodes =1 , .nodes = { &ebi },
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 414/550 interconnect: qcom: sdm845: Retire DEFINE_QBCM
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit 35f490c5e4e833e81be464d89404b26ee20740ef ]
The struct definition macros are hard to read and compare, expand them.
Stable-dep-of: f8fe97a9fd20 ("interconnect: qcom: sdm845: Set ACV enable_mask")
--- drivers/interconnect/qcom/sdm845.c | 277 ++++++++++++++++++++++++++--- 1 file changed, 249 insertions(+), 28 deletions(-)
drivers/interconnect/qcom/sdm845.c +249 -28
@@ -146,34 +146,255 @@ DEFINE_QNODE(srvc_snoc, SDM845_SLAVE_SERVICE_SNOC, 1, 4);DEFINE_QNODE (xs_qdss_stm,SDM845_SLAVE_QDSS_STM ,1 ,4 );DEFINE_QNODE (xs_sys_tcu_cfg,SDM845_SLAVE_TCU ,1 ,8 ); -DEFINE_QBCM (bcm_acv,"ACV" , false, &ebi); -DEFINE_QBCM (bcm_mc0,"MC0" , true, &ebi); -DEFINE_QBCM (bcm_sh0,"SH0" , true, &qns_llcc); -DEFINE_QBCM (bcm_mm0,"MM0" , false, &qns_mem_noc_hf); -DEFINE_QBCM (bcm_sh1,"SH1" , false, &qns_apps_io); -DEFINE_QBCM (bcm_mm1,"MM1" , true, &qxm_camnoc_hf0_uncomp, &qxm_camnoc_hf1_uncomp, &qxm_camnoc_sf_uncomp, &qxm_camnoc_hf0, &qxm_camnoc_hf1, &qxm_mdp0, &qxm_mdp1); -DEFINE_QBCM (bcm_sh2,"SH2" , false, &qns_memnoc_snoc); -DEFINE_QBCM (bcm_mm2,"MM2" , false, &qns2_mem_noc); -DEFINE_QBCM (bcm_sh3,"SH3" , false, &acm_tcu); -DEFINE_QBCM (bcm_mm3,"MM3" , false, &qxm_camnoc_sf, &qxm_rot, &qxm_venus0, &qxm_venus1, &qxm_venus_arm9); -DEFINE_QBCM (bcm_sh5,"SH5" , false, &qnm_apps); -DEFINE_QBCM (bcm_sn0,"SN0" , true, &qns_memnoc_sf); -DEFINE_QBCM (bcm_ce0,"CE0" , false, &qxm_crypto); -DEFINE_QBCM (bcm_cn0,"CN0" , false, &qhm_spdm, &qhm_tic, &qnm_snoc, &xm_qdss_dap, &qhs_a1_noc_cfg, &qhs_a2_noc_cfg, &qhs_aop, &qhs_aoss, &qhs_camera_cfg, &qhs_clk_ctl, &qhs_compute_dsp_cfg, &qhs_cpr_cx, &qhs_crypto0_cfg, &qhs_dcc_cfg, &qhs_ddrss_cfg, &qhs_display_cfg, &qhs_glm, &qhs_gpuss_cfg, &qhs_imem_cfg, &qhs_ipa, &qhs_mnoc_cfg, &qhs_pcie0_cfg, &qhs_pcie_gen3_cfg, &qhs_pdm, &qhs_phy_refgen_south, &qhs_pimem_cfg, &qhs_prng, &qhs_qdss_cfg, &qhs_qupv3_north, &qhs_qupv3_south, &qhs_sdc2, &qhs_sdc4, &qhs_snoc_cfg, &qhs_spdm, &qhs_spss_cfg, &qhs_tcsr, &qhs_tlmm_north, &qhs_tlmm_south, &qhs_tsif, &qhs_ufs_card_cfg, &qhs_ufs_mem_cfg, &qhs_usb3_0, &qhs_usb3_1, &qhs_venus_cfg, &qhs_vsense_ctrl_cfg, &qns_cnoc_a2noc, &srvc_cnoc); -DEFINE_QBCM (bcm_qup0,"QUP0" , false, &qhm_qup1, &qhm_qup2); -DEFINE_QBCM (bcm_sn1,"SN1" , false, &qxs_imem); -DEFINE_QBCM (bcm_sn2,"SN2" , false, &qns_memnoc_gc); -DEFINE_QBCM (bcm_sn3,"SN3" , false, &qns_cnoc); -DEFINE_QBCM (bcm_sn4,"SN4" , false, &qxm_pimem); -DEFINE_QBCM (bcm_sn5,"SN5" , false, &xs_qdss_stm); -DEFINE_QBCM (bcm_sn6,"SN6" , false, &qhs_apss, &srvc_snoc, &xs_sys_tcu_cfg); -DEFINE_QBCM (bcm_sn7,"SN7" , false, &qxs_pcie); -DEFINE_QBCM (bcm_sn8,"SN8" , false, &qxs_pcie_gen3); -DEFINE_QBCM (bcm_sn9,"SN9" , false, &srvc_aggre1_noc, &qnm_aggre1_noc); -DEFINE_QBCM (bcm_sn11,"SN11" , false, &srvc_aggre2_noc, &qnm_aggre2_noc); -DEFINE_QBCM (bcm_sn12,"SN12" , false, &qnm_gladiator_sodv, &xm_gic); -DEFINE_QBCM (bcm_sn14,"SN14" , false, &qnm_pcie_anoc); -DEFINE_QBCM (bcm_sn15,"SN15" , false, &qnm_memnoc); +static struct qcom_icc_bcm bcm_acv = { + .name ="ACV" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &ebi }, +}; + +static struct qcom_icc_bcm bcm_mc0 = { + .name ="MC0" , + .keepalive = true, + .num_nodes =1 , + .nodes = { &ebi }, +}; + +static struct qcom_icc_bcm bcm_sh0 = { + .name ="SH0" , + .keepalive = true, + .num_nodes =1 , + .nodes = { &qns_llcc }, +}; + +static struct qcom_icc_bcm bcm_mm0 = { + .name ="MM0" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qns_mem_noc_hf }, +}; + +static struct qcom_icc_bcm bcm_sh1 = { + .name ="SH1" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qns_apps_io }, +}; + +static struct qcom_icc_bcm bcm_mm1 = { + .name ="MM1" , + .keepalive = true, + .num_nodes =7 , + .nodes = { &qxm_camnoc_hf0_uncomp, + &qxm_camnoc_hf1_uncomp, + &qxm_camnoc_sf_uncomp, + &qxm_camnoc_hf0, + &qxm_camnoc_hf1, + &qxm_mdp0, + &qxm_mdp1 + }, +}; + +static struct qcom_icc_bcm bcm_sh2 = { + .name ="SH2" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qns_memnoc_snoc }, +}; + +static struct qcom_icc_bcm bcm_mm2 = { + .name ="MM2" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qns2_mem_noc }, +}; + +static struct qcom_icc_bcm bcm_sh3 = { + .name ="SH3" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &acm_tcu }, +}; + +static struct qcom_icc_bcm bcm_mm3 = { + .name ="MM3" , + .keepalive = false, + .num_nodes =5 , + .nodes = { &qxm_camnoc_sf, &qxm_rot, &qxm_venus0, &qxm_venus1, &qxm_venus_arm9 }, +}; + +static struct qcom_icc_bcm bcm_sh5 = { + .name ="SH5" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qnm_apps }, +}; + +static struct qcom_icc_bcm bcm_sn0 = { + .name ="SN0" , + .keepalive = true, + .num_nodes =1 , + .nodes = { &qns_memnoc_sf }, +}; + +static struct qcom_icc_bcm bcm_ce0 = { + .name ="CE0" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qxm_crypto }, +}; + +static struct qcom_icc_bcm bcm_cn0 = { + .name ="CN0" , + .keepalive = false, + .num_nodes =47 , + .nodes = { &qhm_spdm, + &qhm_tic, + &qnm_snoc, + &xm_qdss_dap, + &qhs_a1_noc_cfg, + &qhs_a2_noc_cfg, + &qhs_aop, + &qhs_aoss, + &qhs_camera_cfg, + &qhs_clk_ctl, + &qhs_compute_dsp_cfg, + &qhs_cpr_cx, + &qhs_crypto0_cfg, + &qhs_dcc_cfg, + &qhs_ddrss_cfg, + &qhs_display_cfg, + &qhs_glm, + &qhs_gpuss_cfg, + &qhs_imem_cfg, + &qhs_ipa, + &qhs_mnoc_cfg, + &qhs_pcie0_cfg, + &qhs_pcie_gen3_cfg, + &qhs_pdm, + &qhs_phy_refgen_south, + &qhs_pimem_cfg, + &qhs_prng, + &qhs_qdss_cfg, + &qhs_qupv3_north, + &qhs_qupv3_south, + &qhs_sdc2, + &qhs_sdc4, + &qhs_snoc_cfg, + &qhs_spdm, + &qhs_spss_cfg, + &qhs_tcsr, + &qhs_tlmm_north, + &qhs_tlmm_south, + &qhs_tsif, + &qhs_ufs_card_cfg, + &qhs_ufs_mem_cfg, + &qhs_usb3_0, + &qhs_usb3_1, + &qhs_venus_cfg, + &qhs_vsense_ctrl_cfg, + &qns_cnoc_a2noc, + &srvc_cnoc + }, +}; + +static struct qcom_icc_bcm bcm_qup0 = { + .name ="QUP0" , + .keepalive = false, + .num_nodes =2 , + .nodes = { &qhm_qup1, &qhm_qup2 }, +}; + +static struct qcom_icc_bcm bcm_sn1 = { + .name ="SN1" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qxs_imem }, +}; + +static struct qcom_icc_bcm bcm_sn2 = { + .name ="SN2" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qns_memnoc_gc }, +}; + +static struct qcom_icc_bcm bcm_sn3 = { + .name ="SN3" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qns_cnoc }, +}; + +static struct qcom_icc_bcm bcm_sn4 = { + .name ="SN4" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qxm_pimem }, +}; + +static struct qcom_icc_bcm bcm_sn5 = { + .name ="SN5" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &xs_qdss_stm }, +}; + +static struct qcom_icc_bcm bcm_sn6 = { + .name ="SN6" , + .keepalive = false, + .num_nodes =3 , + .nodes = { &qhs_apss, &srvc_snoc, &xs_sys_tcu_cfg }, +}; + +static struct qcom_icc_bcm bcm_sn7 = { + .name ="SN7" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qxs_pcie }, +}; + +static struct qcom_icc_bcm bcm_sn8 = { + .name ="SN8" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qxs_pcie_gen3 }, +}; + +static struct qcom_icc_bcm bcm_sn9 = { + .name ="SN9" , + .keepalive = false, + .num_nodes =2 , + .nodes = { &srvc_aggre1_noc, &qnm_aggre1_noc }, +}; + +static struct qcom_icc_bcm bcm_sn11 = { + .name ="SN11" , + .keepalive = false, + .num_nodes =2 , + .nodes = { &srvc_aggre2_noc, &qnm_aggre2_noc }, +}; + +static struct qcom_icc_bcm bcm_sn12 = { + .name ="SN12" , + .keepalive = false, + .num_nodes =2 , + .nodes = { &qnm_gladiator_sodv, &xm_gic }, +}; + +static struct qcom_icc_bcm bcm_sn14 = { + .name ="SN14" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qnm_pcie_anoc }, +}; + +static struct qcom_icc_bcm bcm_sn15 = { + .name ="SN15" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qnm_memnoc }, +};static struct qcom_icc_bcm *const aggre1_noc_bcms[] = { &bcm_sn9,
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 415/550 interconnect: qcom: sdm845: Set ACV enable_mask
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit f8fe97a9fd2098de0570387029065eef657d50ee ]
ACV expects an enable_mask corresponding to the APPS RSC, fill it in.
--- drivers/interconnect/qcom/sdm845.c | 1 + 1 file changed, 1 insertion(+)
drivers/interconnect/qcom/sdm845.c +1 -0
@@ -148,6 +148,7 @@ DEFINE_QNODE(xs_sys_tcu_cfg, SDM845_SLAVE_TCU, 1, 8);static struct qcom_icc_bcm bcm_acv = { .name ="ACV" , + .enable_mask =BIT (3 ), .keepalive = false, .num_nodes =1 , .nodes = { &ebi },
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 416/550 interconnect: qcom: sm6350: Retire DEFINE_QBCM
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit ab2c1cb5740a7d2240b40b7b494700078db4eb13 ]
The struct definition macros are hard to read and compare, expand them.
Stable-dep-of: fe7a3abf4111 ("interconnect: qcom: sm6350: Set ACV enable_mask")
--- drivers/interconnect/qcom/sm6350.c | 251 ++++++++++++++++++++++++++--- 1 file changed, 226 insertions(+), 25 deletions(-)
drivers/interconnect/qcom/sm6350.c +226 -25
@@ -142,31 +142,232 @@ DEFINE_QNODE(srvc_snoc, SM6350_SLAVE_SERVICE_SNOC, 1, 4);DEFINE_QNODE (xs_qdss_stm,SM6350_SLAVE_QDSS_STM ,1 ,4 );DEFINE_QNODE (xs_sys_tcu_cfg,SM6350_SLAVE_TCU ,1 ,8 ); -DEFINE_QBCM (bcm_acv,"ACV" , false, &ebi); -DEFINE_QBCM (bcm_ce0,"CE0" , false, &qxm_crypto); -DEFINE_QBCM (bcm_cn0,"CN0" , true, &qnm_snoc, &xm_qdss_dap, &qhs_a1_noc_cfg, &qhs_a2_noc_cfg, &qhs_ahb2phy0, &qhs_aoss, &qhs_boot_rom, &qhs_camera_cfg, &qhs_camera_nrt_thrott_cfg, &qhs_camera_rt_throttle_cfg, &qhs_clk_ctl, &qhs_cpr_cx, &qhs_cpr_mx, &qhs_crypto0_cfg, &qhs_dcc_cfg, &qhs_ddrss_cfg, &qhs_display_cfg, &qhs_display_throttle_cfg, &qhs_glm, &qhs_gpuss_cfg, &qhs_imem_cfg, &qhs_ipa, &qhs_mnoc_cfg, &qhs_mss_cfg, &qhs_npu_cfg, &qhs_pimem_cfg, &qhs_prng, &qhs_qdss_cfg, &qhs_qm_cfg, &qhs_qm_mpu_cfg, &qhs_qup0, &qhs_qup1, &qhs_security, &qhs_snoc_cfg, &qhs_tcsr, &qhs_ufs_mem_cfg, &qhs_usb3_0, &qhs_venus_cfg, &qhs_venus_throttle_cfg, &qhs_vsense_ctrl_cfg, &srvc_cnoc); -DEFINE_QBCM (bcm_cn1,"CN1" , false, &xm_emmc, &xm_sdc2, &qhs_ahb2phy2, &qhs_emmc_cfg, &qhs_pdm, &qhs_sdc2); -DEFINE_QBCM (bcm_co0,"CO0" , false, &qns_cdsp_gemnoc); -DEFINE_QBCM (bcm_co2,"CO2" , false, &qnm_npu); -DEFINE_QBCM (bcm_co3,"CO3" , false, &qxm_npu_dsp); -DEFINE_QBCM (bcm_mc0,"MC0" , true, &ebi); -DEFINE_QBCM (bcm_mm0,"MM0" , true, &qns_mem_noc_hf); -DEFINE_QBCM (bcm_mm1,"MM1" , true, &qxm_camnoc_hf0_uncomp, &qxm_camnoc_icp_uncomp, &qxm_camnoc_sf_uncomp, &qxm_camnoc_hf, &qxm_mdp0); -DEFINE_QBCM (bcm_mm2,"MM2" , false, &qns_mem_noc_sf); -DEFINE_QBCM (bcm_mm3,"MM3" , false, &qhm_mnoc_cfg, &qnm_video0, &qnm_video_cvp, &qxm_camnoc_sf); -DEFINE_QBCM (bcm_qup0,"QUP0" , false, &qup0_core_master, &qup1_core_master, &qup0_core_slave, &qup1_core_slave); -DEFINE_QBCM (bcm_sh0,"SH0" , true, &qns_llcc); -DEFINE_QBCM (bcm_sh2,"SH2" , false, &acm_sys_tcu); -DEFINE_QBCM (bcm_sh3,"SH3" , false, &qnm_cmpnoc); -DEFINE_QBCM (bcm_sh4,"SH4" , false, &acm_apps); -DEFINE_QBCM (bcm_sn0,"SN0" , true, &qns_gemnoc_sf); -DEFINE_QBCM (bcm_sn1,"SN1" , false, &qxs_imem); -DEFINE_QBCM (bcm_sn2,"SN2" , false, &qns_gemnoc_gc); -DEFINE_QBCM (bcm_sn3,"SN3" , false, &qxs_pimem); -DEFINE_QBCM (bcm_sn4,"SN4" , false, &xs_qdss_stm); -DEFINE_QBCM (bcm_sn5,"SN5" , false, &qnm_aggre1_noc); -DEFINE_QBCM (bcm_sn6,"SN6" , false, &qnm_aggre2_noc); -DEFINE_QBCM (bcm_sn10,"SN10" , false, &qnm_gemnoc); +static struct qcom_icc_bcm bcm_acv = { + .name ="ACV" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &ebi }, +}; + +static struct qcom_icc_bcm bcm_ce0 = { + .name ="CE0" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qxm_crypto }, +}; + +static struct qcom_icc_bcm bcm_cn0 = { + .name ="CN0" , + .keepalive = true, + .num_nodes =41 , + .nodes = { &qnm_snoc, + &xm_qdss_dap, + &qhs_a1_noc_cfg, + &qhs_a2_noc_cfg, + &qhs_ahb2phy0, + &qhs_aoss, + &qhs_boot_rom, + &qhs_camera_cfg, + &qhs_camera_nrt_thrott_cfg, + &qhs_camera_rt_throttle_cfg, + &qhs_clk_ctl, + &qhs_cpr_cx, + &qhs_cpr_mx, + &qhs_crypto0_cfg, + &qhs_dcc_cfg, + &qhs_ddrss_cfg, + &qhs_display_cfg, + &qhs_display_throttle_cfg, + &qhs_glm, + &qhs_gpuss_cfg, + &qhs_imem_cfg, + &qhs_ipa, + &qhs_mnoc_cfg, + &qhs_mss_cfg, + &qhs_npu_cfg, + &qhs_pimem_cfg, + &qhs_prng, + &qhs_qdss_cfg, + &qhs_qm_cfg, + &qhs_qm_mpu_cfg, + &qhs_qup0, + &qhs_qup1, + &qhs_security, + &qhs_snoc_cfg, + &qhs_tcsr, + &qhs_ufs_mem_cfg, + &qhs_usb3_0, + &qhs_venus_cfg, + &qhs_venus_throttle_cfg, + &qhs_vsense_ctrl_cfg, + &srvc_cnoc + }, +}; + +static struct qcom_icc_bcm bcm_cn1 = { + .name ="CN1" , + .keepalive = false, + .num_nodes =6 , + .nodes = { &xm_emmc, + &xm_sdc2, + &qhs_ahb2phy2, + &qhs_emmc_cfg, + &qhs_pdm, + &qhs_sdc2 + }, +}; + +static struct qcom_icc_bcm bcm_co0 = { + .name ="CO0" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qns_cdsp_gemnoc }, +}; + +static struct qcom_icc_bcm bcm_co2 = { + .name ="CO2" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qnm_npu }, +}; + +static struct qcom_icc_bcm bcm_co3 = { + .name ="CO3" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qxm_npu_dsp }, +}; + +static struct qcom_icc_bcm bcm_mc0 = { + .name ="MC0" , + .keepalive = true, + .num_nodes =1 , + .nodes = { &ebi }, +}; + +static struct qcom_icc_bcm bcm_mm0 = { + .name ="MM0" , + .keepalive = true, + .num_nodes =1 , + .nodes = { &qns_mem_noc_hf }, +}; + +static struct qcom_icc_bcm bcm_mm1 = { + .name ="MM1" , + .keepalive = true, + .num_nodes =5 , + .nodes = { &qxm_camnoc_hf0_uncomp, + &qxm_camnoc_icp_uncomp, + &qxm_camnoc_sf_uncomp, + &qxm_camnoc_hf, + &qxm_mdp0 + }, +}; + +static struct qcom_icc_bcm bcm_mm2 = { + .name ="MM2" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qns_mem_noc_sf }, +}; + +static struct qcom_icc_bcm bcm_mm3 = { + .name ="MM3" , + .keepalive = false, + .num_nodes =4 , + .nodes = { &qhm_mnoc_cfg, &qnm_video0, &qnm_video_cvp, &qxm_camnoc_sf }, +}; + +static struct qcom_icc_bcm bcm_qup0 = { + .name ="QUP0" , + .keepalive = false, + .num_nodes =4 , + .nodes = { &qup0_core_master, &qup1_core_master, &qup0_core_slave, &qup1_core_slave }, +}; + +static struct qcom_icc_bcm bcm_sh0 = { + .name ="SH0" , + .keepalive = true, + .num_nodes =1 , + .nodes = { &qns_llcc }, +}; + +static struct qcom_icc_bcm bcm_sh2 = { + .name ="SH2" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &acm_sys_tcu }, +}; + +static struct qcom_icc_bcm bcm_sh3 = { + .name ="SH3" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qnm_cmpnoc }, +}; + +static struct qcom_icc_bcm bcm_sh4 = { + .name ="SH4" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &acm_apps }, +}; + +static struct qcom_icc_bcm bcm_sn0 = { + .name ="SN0" , + .keepalive = true, + .num_nodes =1 , + .nodes = { &qns_gemnoc_sf }, +}; + +static struct qcom_icc_bcm bcm_sn1 = { + .name ="SN1" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qxs_imem }, +}; + +static struct qcom_icc_bcm bcm_sn2 = { + .name ="SN2" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qns_gemnoc_gc }, +}; + +static struct qcom_icc_bcm bcm_sn3 = { + .name ="SN3" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qxs_pimem }, +}; + +static struct qcom_icc_bcm bcm_sn4 = { + .name ="SN4" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &xs_qdss_stm }, +}; + +static struct qcom_icc_bcm bcm_sn5 = { + .name ="SN5" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qnm_aggre1_noc }, +}; + +static struct qcom_icc_bcm bcm_sn6 = { + .name ="SN6" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qnm_aggre2_noc }, +}; + +static struct qcom_icc_bcm bcm_sn10 = { + .name ="SN10" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qnm_gemnoc }, +};static struct qcom_icc_bcm *const aggre1_noc_bcms[] = { &bcm_cn1,
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 417/550 interconnect: qcom: sm6350: Set ACV enable_mask
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit fe7a3abf4111992af3de51d22383a8e8a0affe1e ]
ACV expects an enable_mask corresponding to the APPS RSC, fill it in.
--- drivers/interconnect/qcom/sm6350.c | 1 + 1 file changed, 1 insertion(+)
drivers/interconnect/qcom/sm6350.c +1 -0
@@ -144,6 +144,7 @@ DEFINE_QNODE(xs_sys_tcu_cfg, SM6350_SLAVE_TCU, 1, 8);static struct qcom_icc_bcm bcm_acv = { .name ="ACV" , + .enable_mask =BIT (3 ), .keepalive = false, .num_nodes =1 , .nodes = { &ebi },
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 418/550 interconnect: qcom: sm8150: Retire DEFINE_QBCM
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit 670699a4225b8cba6962f965b227e0175d09ecda ]
The struct definition macros are hard to read and compare, expand them.
Stable-dep-of: 7ed42176406e ("interconnect: qcom: sm8150: Set ACV enable_mask")
--- drivers/interconnect/qcom/sm8150.c | 283 ++++++++++++++++++++++++++--- 1 file changed, 255 insertions(+), 28 deletions(-)
drivers/interconnect/qcom/sm8150.c +255 -28
@@ -154,34 +154,261 @@ DEFINE_QNODE(xs_pcie_1, SM8150_SLAVE_PCIE_1, 1, 8);DEFINE_QNODE (xs_qdss_stm,SM8150_SLAVE_QDSS_STM ,1 ,4 );DEFINE_QNODE (xs_sys_tcu_cfg,SM8150_SLAVE_TCU ,1 ,8 ); -DEFINE_QBCM (bcm_acv,"ACV" , false, &ebi); -DEFINE_QBCM (bcm_mc0,"MC0" , true, &ebi); -DEFINE_QBCM (bcm_sh0,"SH0" , true, &qns_llcc); -DEFINE_QBCM (bcm_mm0,"MM0" , true, &qns_mem_noc_hf); -DEFINE_QBCM (bcm_mm1,"MM1" , false, &qxm_camnoc_hf0_uncomp, &qxm_camnoc_hf1_uncomp, &qxm_camnoc_sf_uncomp, &qxm_camnoc_hf0, &qxm_camnoc_hf1, &qxm_mdp0, &qxm_mdp1); -DEFINE_QBCM (bcm_sh2,"SH2" , false, &qns_gem_noc_snoc); -DEFINE_QBCM (bcm_mm2,"MM2" , false, &qxm_camnoc_sf, &qns2_mem_noc); -DEFINE_QBCM (bcm_sh3,"SH3" , false, &acm_gpu_tcu, &acm_sys_tcu); -DEFINE_QBCM (bcm_mm3,"MM3" , false, &qxm_rot, &qxm_venus0, &qxm_venus1, &qxm_venus_arm9); -DEFINE_QBCM (bcm_sh4,"SH4" , false, &qnm_cmpnoc); -DEFINE_QBCM (bcm_sh5,"SH5" , false, &acm_apps); -DEFINE_QBCM (bcm_sn0,"SN0" , true, &qns_gemnoc_sf); -DEFINE_QBCM (bcm_co0,"CO0" , false, &qns_cdsp_mem_noc); -DEFINE_QBCM (bcm_ce0,"CE0" , false, &qxm_crypto); -DEFINE_QBCM (bcm_sn1,"SN1" , false, &qxs_imem); -DEFINE_QBCM (bcm_co1,"CO1" , false, &qnm_npu); -DEFINE_QBCM (bcm_cn0,"CN0" , true, &qhm_spdm, &qnm_snoc, &qhs_a1_noc_cfg, &qhs_a2_noc_cfg, &qhs_ahb2phy_south, &qhs_aop, &qhs_aoss, &qhs_camera_cfg, &qhs_clk_ctl, &qhs_compute_dsp, &qhs_cpr_cx, &qhs_cpr_mmcx, &qhs_cpr_mx, &qhs_crypto0_cfg, &qhs_ddrss_cfg, &qhs_display_cfg, &qhs_emac_cfg, &qhs_glm, &qhs_gpuss_cfg, &qhs_imem_cfg, &qhs_ipa, &qhs_mnoc_cfg, &qhs_npu_cfg, &qhs_pcie0_cfg, &qhs_pcie1_cfg, &qhs_phy_refgen_north, &qhs_pimem_cfg, &qhs_prng, &qhs_qdss_cfg, &qhs_qspi, &qhs_qupv3_east, &qhs_qupv3_north, &qhs_qupv3_south, &qhs_sdc2, &qhs_sdc4, &qhs_snoc_cfg, &qhs_spdm, &qhs_spss_cfg, &qhs_ssc_cfg, &qhs_tcsr, &qhs_tlmm_east, &qhs_tlmm_north, &qhs_tlmm_south, &qhs_tlmm_west, &qhs_tsif, &qhs_ufs_card_cfg, &qhs_ufs_mem_cfg, &qhs_usb3_0, &qhs_usb3_1, &qhs_venus_cfg, &qhs_vsense_ctrl_cfg, &qns_cnoc_a2noc, &srvc_cnoc); -DEFINE_QBCM (bcm_qup0,"QUP0" , false, &qhm_qup0, &qhm_qup1, &qhm_qup2); -DEFINE_QBCM (bcm_sn2,"SN2" , false, &qns_gemnoc_gc); -DEFINE_QBCM (bcm_sn3,"SN3" , false, &srvc_aggre1_noc, &srvc_aggre2_noc, &qns_cnoc); -DEFINE_QBCM (bcm_sn4,"SN4" , false, &qxs_pimem); -DEFINE_QBCM (bcm_sn5,"SN5" , false, &xs_qdss_stm); -DEFINE_QBCM (bcm_sn8,"SN8" , false, &xs_pcie_0, &xs_pcie_1); -DEFINE_QBCM (bcm_sn9,"SN9" , false, &qnm_aggre1_noc); -DEFINE_QBCM (bcm_sn11,"SN11" , false, &qnm_aggre2_noc); -DEFINE_QBCM (bcm_sn12,"SN12" , false, &qxm_pimem, &xm_gic); -DEFINE_QBCM (bcm_sn14,"SN14" , false, &qns_pcie_mem_noc); -DEFINE_QBCM (bcm_sn15,"SN15" , false, &qnm_gemnoc); +static struct qcom_icc_bcm bcm_acv = { + .name ="ACV" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &ebi }, +}; + +static struct qcom_icc_bcm bcm_mc0 = { + .name ="MC0" , + .keepalive = true, + .num_nodes =1 , + .nodes = { &ebi }, +}; + +static struct qcom_icc_bcm bcm_sh0 = { + .name ="SH0" , + .keepalive = true, + .num_nodes =1 , + .nodes = { &qns_llcc }, +}; + +static struct qcom_icc_bcm bcm_mm0 = { + .name ="MM0" , + .keepalive = true, + .num_nodes =1 , + .nodes = { &qns_mem_noc_hf }, +}; + +static struct qcom_icc_bcm bcm_mm1 = { + .name ="MM1" , + .keepalive = false, + .num_nodes =7 , + .nodes = { &qxm_camnoc_hf0_uncomp, + &qxm_camnoc_hf1_uncomp, + &qxm_camnoc_sf_uncomp, + &qxm_camnoc_hf0, + &qxm_camnoc_hf1, + &qxm_mdp0, + &qxm_mdp1 + }, +}; + +static struct qcom_icc_bcm bcm_sh2 = { + .name ="SH2" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qns_gem_noc_snoc }, +}; + +static struct qcom_icc_bcm bcm_mm2 = { + .name ="MM2" , + .keepalive = false, + .num_nodes =2 , + .nodes = { &qxm_camnoc_sf, &qns2_mem_noc }, +}; + +static struct qcom_icc_bcm bcm_sh3 = { + .name ="SH3" , + .keepalive = false, + .num_nodes =2 , + .nodes = { &acm_gpu_tcu, &acm_sys_tcu }, +}; + +static struct qcom_icc_bcm bcm_mm3 = { + .name ="MM3" , + .keepalive = false, + .num_nodes =4 , + .nodes = { &qxm_rot, &qxm_venus0, &qxm_venus1, &qxm_venus_arm9 }, +}; + +static struct qcom_icc_bcm bcm_sh4 = { + .name ="SH4" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qnm_cmpnoc }, +}; + +static struct qcom_icc_bcm bcm_sh5 = { + .name ="SH5" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &acm_apps }, +}; + +static struct qcom_icc_bcm bcm_sn0 = { + .name ="SN0" , + .keepalive = true, + .num_nodes =1 , + .nodes = { &qns_gemnoc_sf }, +}; + +static struct qcom_icc_bcm bcm_co0 = { + .name ="CO0" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qns_cdsp_mem_noc }, +}; + +static struct qcom_icc_bcm bcm_ce0 = { + .name ="CE0" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qxm_crypto }, +}; + +static struct qcom_icc_bcm bcm_sn1 = { + .name ="SN1" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qxs_imem }, +}; + +static struct qcom_icc_bcm bcm_co1 = { + .name ="CO1" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qnm_npu }, +}; + +static struct qcom_icc_bcm bcm_cn0 = { + .name ="CN0" , + .keepalive = true, + .num_nodes =53 , + .nodes = { &qhm_spdm, + &qnm_snoc, + &qhs_a1_noc_cfg, + &qhs_a2_noc_cfg, + &qhs_ahb2phy_south, + &qhs_aop, + &qhs_aoss, + &qhs_camera_cfg, + &qhs_clk_ctl, + &qhs_compute_dsp, + &qhs_cpr_cx, + &qhs_cpr_mmcx, + &qhs_cpr_mx, + &qhs_crypto0_cfg, + &qhs_ddrss_cfg, + &qhs_display_cfg, + &qhs_emac_cfg, + &qhs_glm, + &qhs_gpuss_cfg, + &qhs_imem_cfg, + &qhs_ipa, + &qhs_mnoc_cfg, + &qhs_npu_cfg, + &qhs_pcie0_cfg, + &qhs_pcie1_cfg, + &qhs_phy_refgen_north, + &qhs_pimem_cfg, + &qhs_prng, + &qhs_qdss_cfg, + &qhs_qspi, + &qhs_qupv3_east, + &qhs_qupv3_north, + &qhs_qupv3_south, + &qhs_sdc2, + &qhs_sdc4, + &qhs_snoc_cfg, + &qhs_spdm, + &qhs_spss_cfg, + &qhs_ssc_cfg, + &qhs_tcsr, + &qhs_tlmm_east, + &qhs_tlmm_north, + &qhs_tlmm_south, + &qhs_tlmm_west, + &qhs_tsif, + &qhs_ufs_card_cfg, + &qhs_ufs_mem_cfg, + &qhs_usb3_0, + &qhs_usb3_1, + &qhs_venus_cfg, + &qhs_vsense_ctrl_cfg, + &qns_cnoc_a2noc, + &srvc_cnoc + }, +}; + +static struct qcom_icc_bcm bcm_qup0 = { + .name ="QUP0" , + .keepalive = false, + .num_nodes =3 , + .nodes = { &qhm_qup0, &qhm_qup1, &qhm_qup2 }, +}; + +static struct qcom_icc_bcm bcm_sn2 = { + .name ="SN2" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qns_gemnoc_gc }, +}; + +static struct qcom_icc_bcm bcm_sn3 = { + .name ="SN3" , + .keepalive = false, + .num_nodes =3 , + .nodes = { &srvc_aggre1_noc, &srvc_aggre2_noc, &qns_cnoc }, +}; + +static struct qcom_icc_bcm bcm_sn4 = { + .name ="SN4" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qxs_pimem }, +}; + +static struct qcom_icc_bcm bcm_sn5 = { + .name ="SN5" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &xs_qdss_stm }, +}; + +static struct qcom_icc_bcm bcm_sn8 = { + .name ="SN8" , + .keepalive = false, + .num_nodes =2 , + .nodes = { &xs_pcie_0, &xs_pcie_1 }, +}; + +static struct qcom_icc_bcm bcm_sn9 = { + .name ="SN9" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qnm_aggre1_noc }, +}; + +static struct qcom_icc_bcm bcm_sn11 = { + .name ="SN11" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qnm_aggre2_noc }, +}; + +static struct qcom_icc_bcm bcm_sn12 = { + .name ="SN12" , + .keepalive = false, + .num_nodes =2 , + .nodes = { &qxm_pimem, &xm_gic }, +}; + +static struct qcom_icc_bcm bcm_sn14 = { + .name ="SN14" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qns_pcie_mem_noc }, +}; + +static struct qcom_icc_bcm bcm_sn15 = { + .name ="SN15" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qnm_gemnoc }, +};static struct qcom_icc_bcm *const aggre1_noc_bcms[] = { &bcm_qup0,
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 419/550 interconnect: qcom: sm8150: Set ACV enable_mask
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit 7ed42176406e5a2c9a5767d0d75690c7d1588027 ]
ACV expects an enable_mask corresponding to the APPS RSC, fill it in.
--- drivers/interconnect/qcom/sm8150.c | 1 + 1 file changed, 1 insertion(+)
drivers/interconnect/qcom/sm8150.c +1 -0
@@ -156,6 +156,7 @@ DEFINE_QNODE(xs_sys_tcu_cfg, SM8150_SLAVE_TCU, 1, 8);static struct qcom_icc_bcm bcm_acv = { .name ="ACV" , + .enable_mask =BIT (3 ), .keepalive = false, .num_nodes =1 , .nodes = { &ebi },
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 420/550 interconnect: qcom: sm8350: Retire DEFINE_QBCM
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit edd13c04ff0d90ed152902a88f01f466c77a0cf9 ]
The struct definition macros are hard to read and compare, expand them.
Stable-dep-of: df1b8356a80a ("interconnect: qcom: sm8350: Set ACV enable_mask")
--- drivers/interconnect/qcom/sm8350.c | 308 ++++++++++++++++++++++++++--- 1 file changed, 276 insertions(+), 32 deletions(-)
drivers/interconnect/qcom/sm8350.c +276 -32
@@ -165,38 +165,282 @@ DEFINE_QNODE(ebi_disp, SM8350_SLAVE_EBI1_DISP, 4, 4);DEFINE_QNODE (qns_mem_noc_hf_disp,SM8350_SLAVE_MNOC_HF_MEM_NOC_DISP ,2 ,32 ,SM8350_MASTER_MNOC_HF_MEM_NOC_DISP );DEFINE_QNODE (qns_mem_noc_sf_disp,SM8350_SLAVE_MNOC_SF_MEM_NOC_DISP ,2 ,32 ,SM8350_MASTER_MNOC_SF_MEM_NOC_DISP ); -DEFINE_QBCM (bcm_acv,"ACV" , false, &ebi); -DEFINE_QBCM (bcm_ce0,"CE0" , false, &qxm_crypto); -DEFINE_QBCM (bcm_cn0,"CN0" , true, &qnm_gemnoc_cnoc, &qnm_gemnoc_pcie); -DEFINE_QBCM (bcm_cn1,"CN1" , false, &xm_qdss_dap, &qhs_ahb2phy0, &qhs_ahb2phy1, &qhs_aoss, &qhs_apss, &qhs_camera_cfg, &qhs_clk_ctl, &qhs_compute_cfg, &qhs_cpr_cx, &qhs_cpr_mmcx, &qhs_cpr_mx, &qhs_crypto0_cfg, &qhs_cx_rdpm, &qhs_dcc_cfg, &qhs_display_cfg, &qhs_gpuss_cfg, &qhs_hwkm, &qhs_imem_cfg, &qhs_ipa, &qhs_ipc_router, &qhs_mss_cfg, &qhs_mx_rdpm, &qhs_pcie0_cfg, &qhs_pcie1_cfg, &qhs_pimem_cfg, &qhs_pka_wrapper_cfg, &qhs_pmu_wrapper_cfg, &qhs_qdss_cfg, &qhs_qup0, &qhs_qup1, &qhs_qup2, &qhs_security, &qhs_spss_cfg, &qhs_tcsr, &qhs_tlmm, &qhs_ufs_card_cfg, &qhs_ufs_mem_cfg, &qhs_usb3_0, &qhs_usb3_1, &qhs_venus_cfg, &qhs_vsense_ctrl_cfg, &qns_a1_noc_cfg, &qns_a2_noc_cfg, &qns_ddrss_cfg, &qns_mnoc_cfg, &qns_snoc_cfg, &srvc_cnoc); -DEFINE_QBCM (bcm_cn2,"CN2" , false, &qhs_lpass_cfg, &qhs_pdm, &qhs_qspi, &qhs_sdc2, &qhs_sdc4); -DEFINE_QBCM (bcm_co0,"CO0" , false, &qns_nsp_gemnoc); -DEFINE_QBCM (bcm_co3,"CO3" , false, &qxm_nsp); -DEFINE_QBCM (bcm_mc0,"MC0" , true, &ebi); -DEFINE_QBCM (bcm_mm0,"MM0" , true, &qns_mem_noc_hf); -DEFINE_QBCM (bcm_mm1,"MM1" , false, &qnm_camnoc_hf, &qxm_mdp0, &qxm_mdp1); -DEFINE_QBCM (bcm_mm4,"MM4" , false, &qns_mem_noc_sf); -DEFINE_QBCM (bcm_mm5,"MM5" , false, &qnm_camnoc_icp, &qnm_camnoc_sf, &qnm_video0, &qnm_video1, &qnm_video_cvp, &qxm_rot); -DEFINE_QBCM (bcm_sh0,"SH0" , true, &qns_llcc); -DEFINE_QBCM (bcm_sh2,"SH2" , false, &alm_gpu_tcu, &alm_sys_tcu); -DEFINE_QBCM (bcm_sh3,"SH3" , false, &qnm_cmpnoc); -DEFINE_QBCM (bcm_sh4,"SH4" , false, &chm_apps); -DEFINE_QBCM (bcm_sn0,"SN0" , true, &qns_gemnoc_sf); -DEFINE_QBCM (bcm_sn2,"SN2" , false, &qns_gemnoc_gc); -DEFINE_QBCM (bcm_sn3,"SN3" , false, &qxs_pimem); -DEFINE_QBCM (bcm_sn4,"SN4" , false, &xs_qdss_stm); -DEFINE_QBCM (bcm_sn5,"SN5" , false, &xm_pcie3_0); -DEFINE_QBCM (bcm_sn6,"SN6" , false, &xm_pcie3_1); -DEFINE_QBCM (bcm_sn7,"SN7" , false, &qnm_aggre1_noc); -DEFINE_QBCM (bcm_sn8,"SN8" , false, &qnm_aggre2_noc); -DEFINE_QBCM (bcm_sn14,"SN14" , false, &qns_pcie_mem_noc); -DEFINE_QBCM (bcm_acv_disp,"ACV" , false, &ebi_disp); -DEFINE_QBCM (bcm_mc0_disp,"MC0" , false, &ebi_disp); -DEFINE_QBCM (bcm_mm0_disp,"MM0" , false, &qns_mem_noc_hf_disp); -DEFINE_QBCM (bcm_mm1_disp,"MM1" , false, &qxm_mdp0_disp, &qxm_mdp1_disp); -DEFINE_QBCM (bcm_mm4_disp,"MM4" , false, &qns_mem_noc_sf_disp); -DEFINE_QBCM (bcm_mm5_disp,"MM5" , false, &qxm_rot_disp); -DEFINE_QBCM (bcm_sh0_disp,"SH0" , false, &qns_llcc_disp); +static struct qcom_icc_bcm bcm_acv = { + .name ="ACV" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &ebi }, +}; + +static struct qcom_icc_bcm bcm_ce0 = { + .name ="CE0" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qxm_crypto }, +}; + +static struct qcom_icc_bcm bcm_cn0 = { + .name ="CN0" , + .keepalive = true, + .num_nodes =2 , + .nodes = { &qnm_gemnoc_cnoc, &qnm_gemnoc_pcie }, +}; + +static struct qcom_icc_bcm bcm_cn1 = { + .name ="CN1" , + .keepalive = false, + .num_nodes =47 , + .nodes = { &xm_qdss_dap, + &qhs_ahb2phy0, + &qhs_ahb2phy1, + &qhs_aoss, + &qhs_apss, + &qhs_camera_cfg, + &qhs_clk_ctl, + &qhs_compute_cfg, + &qhs_cpr_cx, + &qhs_cpr_mmcx, + &qhs_cpr_mx, + &qhs_crypto0_cfg, + &qhs_cx_rdpm, + &qhs_dcc_cfg, + &qhs_display_cfg, + &qhs_gpuss_cfg, + &qhs_hwkm, + &qhs_imem_cfg, + &qhs_ipa, + &qhs_ipc_router, + &qhs_mss_cfg, + &qhs_mx_rdpm, + &qhs_pcie0_cfg, + &qhs_pcie1_cfg, + &qhs_pimem_cfg, + &qhs_pka_wrapper_cfg, + &qhs_pmu_wrapper_cfg, + &qhs_qdss_cfg, + &qhs_qup0, + &qhs_qup1, + &qhs_qup2, + &qhs_security, + &qhs_spss_cfg, + &qhs_tcsr, + &qhs_tlmm, + &qhs_ufs_card_cfg, + &qhs_ufs_mem_cfg, + &qhs_usb3_0, + &qhs_usb3_1, + &qhs_venus_cfg, + &qhs_vsense_ctrl_cfg, + &qns_a1_noc_cfg, + &qns_a2_noc_cfg, + &qns_ddrss_cfg, + &qns_mnoc_cfg, + &qns_snoc_cfg, + &srvc_cnoc + }, +}; + +static struct qcom_icc_bcm bcm_cn2 = { + .name ="CN2" , + .keepalive = false, + .num_nodes =5 , + .nodes = { &qhs_lpass_cfg, &qhs_pdm, &qhs_qspi, &qhs_sdc2, &qhs_sdc4 }, +}; + +static struct qcom_icc_bcm bcm_co0 = { + .name ="CO0" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qns_nsp_gemnoc }, +}; + +static struct qcom_icc_bcm bcm_co3 = { + .name ="CO3" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qxm_nsp }, +}; + +static struct qcom_icc_bcm bcm_mc0 = { + .name ="MC0" , + .keepalive = true, + .num_nodes =1 , + .nodes = { &ebi }, +}; + +static struct qcom_icc_bcm bcm_mm0 = { + .name ="MM0" , + .keepalive = true, + .num_nodes =1 , + .nodes = { &qns_mem_noc_hf }, +}; + +static struct qcom_icc_bcm bcm_mm1 = { + .name ="MM1" , + .keepalive = false, + .num_nodes =3 , + .nodes = { &qnm_camnoc_hf, &qxm_mdp0, &qxm_mdp1 }, +}; + +static struct qcom_icc_bcm bcm_mm4 = { + .name ="MM4" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qns_mem_noc_sf }, +}; + +static struct qcom_icc_bcm bcm_mm5 = { + .name ="MM5" , + .keepalive = false, + .num_nodes =6 , + .nodes = { &qnm_camnoc_icp, + &qnm_camnoc_sf, + &qnm_video0, + &qnm_video1, + &qnm_video_cvp, + &qxm_rot + }, +}; + +static struct qcom_icc_bcm bcm_sh0 = { + .name ="SH0" , + .keepalive = true, + .num_nodes =1 , + .nodes = { &qns_llcc }, +}; + +static struct qcom_icc_bcm bcm_sh2 = { + .name ="SH2" , + .keepalive = false, + .num_nodes =2 , + .nodes = { &alm_gpu_tcu, &alm_sys_tcu }, +}; + +static struct qcom_icc_bcm bcm_sh3 = { + .name ="SH3" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qnm_cmpnoc }, +}; + +static struct qcom_icc_bcm bcm_sh4 = { + .name ="SH4" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &chm_apps }, +}; + +static struct qcom_icc_bcm bcm_sn0 = { + .name ="SN0" , + .keepalive = true, + .num_nodes =1 , + .nodes = { &qns_gemnoc_sf }, +}; + +static struct qcom_icc_bcm bcm_sn2 = { + .name ="SN2" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qns_gemnoc_gc }, +}; + +static struct qcom_icc_bcm bcm_sn3 = { + .name ="SN3" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qxs_pimem }, +}; + +static struct qcom_icc_bcm bcm_sn4 = { + .name ="SN4" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &xs_qdss_stm }, +}; + +static struct qcom_icc_bcm bcm_sn5 = { + .name ="SN5" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &xm_pcie3_0 }, +}; + +static struct qcom_icc_bcm bcm_sn6 = { + .name ="SN6" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &xm_pcie3_1 }, +}; + +static struct qcom_icc_bcm bcm_sn7 = { + .name ="SN7" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qnm_aggre1_noc }, +}; + +static struct qcom_icc_bcm bcm_sn8 = { + .name ="SN8" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qnm_aggre2_noc }, +}; + +static struct qcom_icc_bcm bcm_sn14 = { + .name ="SN14" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qns_pcie_mem_noc }, +}; + +static struct qcom_icc_bcm bcm_acv_disp = { + .name ="ACV" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &ebi_disp }, +}; + +static struct qcom_icc_bcm bcm_mc0_disp = { + .name ="MC0" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &ebi_disp }, +}; + +static struct qcom_icc_bcm bcm_mm0_disp = { + .name ="MM0" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qns_mem_noc_hf_disp }, +}; + +static struct qcom_icc_bcm bcm_mm1_disp = { + .name ="MM1" , + .keepalive = false, + .num_nodes =2 , + .nodes = { &qxm_mdp0_disp, &qxm_mdp1_disp }, +}; + +static struct qcom_icc_bcm bcm_mm4_disp = { + .name ="MM4" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qns_mem_noc_sf_disp }, +}; + +static struct qcom_icc_bcm bcm_mm5_disp = { + .name ="MM5" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qxm_rot_disp }, +}; + +static struct qcom_icc_bcm bcm_sh0_disp = { + .name ="SH0" , + .keepalive = false, + .num_nodes =1 , + .nodes = { &qns_llcc_disp }, +};static struct qcom_icc_bcm *const aggre1_noc_bcms[] = { };
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 421/550 interconnect: qcom: sm8350: Set ACV enable_mask
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit df1b8356a80ab47a7623e08facf36fe434ea9722 ]
ACV expects an enable_mask corresponding to the APPS RSC, fill it in.
--- drivers/interconnect/qcom/sm8350.c | 1 + 1 file changed, 1 insertion(+)
drivers/interconnect/qcom/sm8350.c +1 -0
@@ -167,6 +167,7 @@ DEFINE_QNODE(qns_mem_noc_sf_disp, SM8350_SLAVE_MNOC_SF_MEM_NOC_DISP, 2, 32, SM83static struct qcom_icc_bcm bcm_acv = { .name ="ACV" , + .enable_mask =BIT (3 ), .keepalive = false, .num_nodes =1 , .nodes = { &ebi },
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 422/550 powerpc: Only define __parse_fpscr() when required
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit c7e0d9bb9154c6e6b2ac8746faba27b53393f25e ]
Clang 17 reports:
arch/powerpc/kernel/traps.c:1167:19: error: unused function '__parse_fpscr' [-Werror,-Wunused-function]
__parse_fpscr() is called from two sites. First call is guarded by #ifdef CONFIG_PPC_FPU_REGS
Second call is guarded by CONFIG_MATH_EMULATION which selects CONFIG_PPC_FPU_REGS.
So only define __parse_fpscr() when CONFIG_PPC_FPU_REGS is defined.
--- arch/powerpc/kernel/traps.c | 2 ++ 1 file changed, 2 insertions(+)
arch/powerpc/kernel/traps.c +2 -0
@@ -1164,6 +1164,7 @@ static void emulate_single_step(struct pt_regs *regs)__single_step_exception (regs); } +#ifdef CONFIG_PPC_FPU_REGS static inline int __parse_fpscr (unsigned long fpscr) {int ret =FPE_FLTUNK ;
@@ -1190,6 +1191,7 @@ static inline int __parse_fpscr(unsigned long fpscr) return ret; } +#endif static void parse_fpe (struct pt_regs *regs) {
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 423/550 interconnect: fix error handling in qnoc_probe()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Yingliang <[email protected]>
[ Upstream commit 273f74a2e7d15a5c216a4a26b84b1563c7092c9d ]
Add missing clk_disable_unprepare() and clk_bulk_disable_unprepare() in the error path in qnoc_probe(). And when qcom_icc_qos_set() fails, it needs remove nodes and disable clks.
--- drivers/interconnect/qcom/icc-rpm.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
drivers/interconnect/qcom/icc-rpm.c +10 -4
@@ -491,7 +491,7 @@ int qnoc_probe(struct platform_device *pdev) ret =devm_clk_bulk_get (dev, qp->num_intf_clks, qp->intf_clks);if (ret) -return ret; + goto err_disable_unprepare_clk; provider = &qp->provider; provider->dev = dev;
@@ -506,13 +506,15 @@ int qnoc_probe(struct platform_device *pdev)/* If this fails, bus accesses will crash the platform! */ ret =clk_bulk_prepare_enable (qp->num_intf_clks, qp->intf_clks);if (ret) -return ret; + goto err_disable_unprepare_clk;for (i =0 ; i < num_nodes; i++) {size_t j; node =icc_node_create (qnodes[i]->id);if (IS_ERR (node)) { +clk_bulk_disable_unprepare (qp->num_intf_clks, + qp->intf_clks); ret =PTR_ERR (node); goto err_remove_nodes; }
@@ -528,8 +530,11 @@ int qnoc_probe(struct platform_device *pdev)if (qnodes[i]->qos.ap_owned && qnodes[i]->qos.qos_mode !=NOC_QOS_MODE_INVALID ) { ret =qcom_icc_qos_set (node); -if (ret) -return ret; +if (ret) { +clk_bulk_disable_unprepare (qp->num_intf_clks, + qp->intf_clks); + goto err_remove_nodes; + } } data->nodes[i] = node;
@@ -557,6 +562,7 @@ int qnoc_probe(struct platform_device *pdev)icc_provider_deregister (provider); err_remove_nodes:icc_nodes_remove (provider); +err_disable_unprepare_clk:clk_bulk_disable_unprepare (qp->num_bus_clks, qp->bus_clks);return ret;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 424/550 perf build: Add missing comment about NO_LIBTRACEEVENT=1
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <[email protected]>
[ Upstream commit c1783ddfb62420c44cdf4672dad2046f056c624b ]
By default perf will fail the build if the development files for libtraceevent are not available.
To build perf without libtraceevent support, disabling several features such as 'perf trace', one needs to add NO_LIBTRACEVENT=1 to the make command line.
Add the missing comments about that to the tools/perf/Makefile.perf file, just like all the other such command line toggles.
--- tools/perf/Makefile.perf | 4 ++++ 1 file changed, 4 insertions(+)
tools/perf/Makefile.perf +4 -0
@@ -69,6 +69,10 @@ include ../scripts/utilities.mak # Define NO_LIBDW_DWARF_UNWIND if you do not want libdw support # for dwarf backtrace post unwind. # +# Define NO_LIBTRACEEVENT=1 if you don't want libtraceevent to be linked, +# this will remove multiple features and tools, such as 'perf trace', +# that need it to read tracefs event format files, etc. +# # Define NO_PERF_READ_VDSO32 if you do not want to build perf-read-vdso32 # for reading the 32-bit compatibility VDSO in 64-bit mode #
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 425/550 perf parse-events: Fix for term values that are raw events
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit b20576fd7fe39554b212095c3c0d7a3dff512515 ]
Raw events can be strings like 'r0xead' but the 0x is optional so they can also be 'read'. On IcelakeX uncore_imc_free_running has an event called 'read' which may be programmed as:
```
$ perf stat -e 'uncore_imc_free_running/event=read/' -a sleep 1
```
However, the PE_RAW type isn't allowed on the right of a term, even
though in this case we just want to interpret it as a string. This
leads to the following error on IcelakeX:
```
$ perf stat -e 'uncore_imc_free_running/event=read/' -a sleep 1
event syntax error: '..nning/event=read/'
\___ parser error
Run 'perf list' for a list of valid events
Usage: perf stat [<options>] [<command>]
-e, --event <event> event selector. use 'perf list' to list available events
```Fix this by allowing raw types on the right of terms and treat them as strings, just as is already done for PE_LEGACY_CACHE. Make this consistent by just entirely removing name_or_legacy and always using name_or_raw that covers all three cases.
--- tools/perf/util/parse-events.y | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
tools/perf/util/parse-events.y +3 -5
@@ -81,7 +81,7 @@ static void free_list_evsel(struct list_head* list_evsel) %type <str> PE_MODIFIER_BP %type <str> PE_EVENT_NAME %type <str> PE_DRV_CFG_TERM -%type <str> name_or_raw name_or_legacy +%type <str> name_or_raw %destructor { free ($$); } <str> %type <term> event_term %destructor { parse_events_term__delete ($$); } <term>
@@ -721,8 +721,6 @@ event_term name_or_raw: PE_RAW | PE_NAME | PE_LEGACY_CACHE -name_or_legacy: PE_NAME | PE_LEGACY_CACHE - event_term: PE_RAW {
@@ -737,7 +735,7 @@ PE_RAW $$ = term; } | -name_or_raw '=' name_or_legacy +name_or_raw '=' name_or_raw { struct parse_events_term *term; int err = parse_events_term__str(&term, PARSE_EVENTS__TERM_TYPE_USER, $1, $3, &@1, &@3);
@@ -816,7 +814,7 @@ PE_TERM_HW $$ = term; } | -PE_TERM '=' name_or_legacy +PE_TERM '=' name_or_raw { struct parse_events_term *term; int err = parse_events_term__str(&term, (int)$1, NULL, $3, &@1, &@3);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 426/550 perf pmu: Remove logic for PMU name being NULL
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit c091ee90897aacf60aee510464cfc28b4041186f ]
The PMU name could be NULL in the case of the fake_pmu. Initialize the name for the fake_pmu to "fake" so that all other logic can assume it is initialized. Add a const to the type of name so that a literal can be used to avoid additional initialization code. Propagate the cost through related routines and remove now unnecessary "(char *)" casts. Doing this located a bug in builtin-list for the pmu_glob that was missing a strdup.
Stable-dep-of: 85f73c377b2a ("perf mem-events: Avoid uninitialized read")
--- tools/perf/arch/arm64/util/mem-events.c | 2 +- tools/perf/arch/powerpc/util/mem-events.c | 6 +++--- tools/perf/arch/x86/util/mem-events.c | 8 ++++---- tools/perf/arch/x86/util/pmu.c | 10 +++++----- tools/perf/builtin-list.c | 2 +- tools/perf/tests/pmu-events.c | 16 ++++++++-------- tools/perf/util/env.c | 8 ++------ tools/perf/util/header.c | 8 +------- tools/perf/util/mem-events.c | 16 ++++++++-------- tools/perf/util/mem-events.h | 2 +- tools/perf/util/parse-events.c | 7 ++----- tools/perf/util/parse-events.h | 2 +- tools/perf/util/parse-events.y | 2 +- tools/perf/util/pmu.c | 16 +++++++++------- tools/perf/util/pmu.h | 8 ++++---- 15 files changed, 51 insertions(+), 62 deletions(-)
tools/perf/arch/arm64/util/mem-events.c +1 -1
@@ -20,7 +20,7 @@ struct perf_mem_event *perf_mem_events__ptr(int i)return &perf_mem_events[i]; } -char *perf_mem_events__name (int i,char *pmu_name__maybe_unused ) +const char *perf_mem_events__name (int i,const char *pmu_name__maybe_unused ) {struct perf_mem_event *e =perf_mem_events__ptr (i);
tools/perf/arch/powerpc/util/mem-events.c +3 -3
@@ -3,10 +3,10 @@#include "mem-events.h" /* PowerPC does not support 'ldlat' parameter. */ -char *perf_mem_events__name (int i,char *pmu_name__maybe_unused ) +const char *perf_mem_events__name (int i,const char *pmu_name__maybe_unused ) {if (i ==PERF_MEM_EVENTS__LOAD ) -return (char *)"cpu/mem-loads/" ; +return "cpu/mem-loads/" ; -return (char *)"cpu/mem-stores/" ; +return "cpu/mem-stores/" ; }
tools/perf/arch/x86/util/mem-events.c +4 -4
@@ -52,7 +52,7 @@ bool is_mem_loads_aux_event(struct evsel *leader)return leader->core.attr.config ==MEM_LOADS_AUX ; } -char *perf_mem_events__name (int i,char *pmu_name) +const char *perf_mem_events__name (int i,const char *pmu_name) {struct perf_mem_event *e =perf_mem_events__ptr (i);
@@ -65,7 +65,7 @@ char *perf_mem_events__name(int i, char *pmu_name)if (!pmu_name) { mem_loads_name__init = true; - pmu_name = (char *)"cpu" ; + pmu_name ="cpu" ; }if (perf_pmus__have_event (pmu_name,"mem-loads-aux" )) {
@@ -82,12 +82,12 @@ char *perf_mem_events__name(int i, char *pmu_name)if (i ==PERF_MEM_EVENTS__STORE ) {if (!pmu_name) - pmu_name = (char *)"cpu" ; + pmu_name ="cpu" ;scnprintf (mem_stores_name,sizeof (mem_stores_name), e->name, pmu_name);return mem_stores_name; } -return (char *)e->name; +return e->name; }
tools/perf/arch/x86/util/pmu.c +5 -5
@@ -126,7 +126,7 @@ static int setup_pmu_alias_list(void)return ret; } -static char *__pmu_find_real_name (const char *name) +static const char *__pmu_find_real_name (const char *name) {struct pmu_alias *pmu_alias;
@@ -135,10 +135,10 @@ static char *__pmu_find_real_name(const char *name)return pmu_alias->name; } -return (char *)name; +return name; } -char *pmu_find_real_name (const char *name) +const char *pmu_find_real_name (const char *name) {if (cached_list)return __pmu_find_real_name (name);
@@ -149,7 +149,7 @@ char *pmu_find_real_name(const char *name)return __pmu_find_real_name (name); } -static char *__pmu_find_alias_name (const char *name) +static const char *__pmu_find_alias_name (const char *name) {struct pmu_alias *pmu_alias;
@@ -160,7 +160,7 @@ static char *__pmu_find_alias_name(const char *name)return NULL ; } -char *pmu_find_alias_name (const char *name) +const char *pmu_find_alias_name (const char *name) {if (cached_list)return __pmu_find_alias_name (name);
tools/perf/builtin-list.c +1 -1
@@ -502,7 +502,7 @@ int cmd_list(int argc, const char **argv) ret =-1 ; goto out; } - default_ps.pmu_glob = pmu->name; + default_ps.pmu_glob =strdup (pmu->name); } } print_cb.print_start (ps);
tools/perf/tests/pmu-events.c +8 -8
@@ -508,7 +508,7 @@ static struct perf_pmu_alias *find_alias(const char *test_event, struct list_hea }/* Verify aliases are as expected */ -static int __test_core_pmu_event_aliases (char *pmu_name,int *count) +static int __test_core_pmu_event_aliases (const char *pmu_name,int *count) {struct perf_pmu_test_event const **test_event_table;struct perf_pmu *pmu;
@@ -635,7 +635,7 @@ static int __test_uncore_pmu_event_aliases(struct perf_pmu_test_pmu *test_pmu)static struct perf_pmu_test_pmu test_pmus[] = { { .pmu = { - .name = (char *)"hisi_sccl1_ddrc2" , + .name ="hisi_sccl1_ddrc2" , .is_uncore =1 , }, .aliases = {
@@ -644,7 +644,7 @@ static struct perf_pmu_test_pmu test_pmus[] = { }, { .pmu = { - .name = (char *)"uncore_cbox_0", + .name = "uncore_cbox_0", .is_uncore = 1, }, .aliases = {
@@ -655,7 +655,7 @@ static struct perf_pmu_test_pmu test_pmus[] = { }, { .pmu = { - .name = (char *)"hisi_sccl3_l3c7", + .name = "hisi_sccl3_l3c7", .is_uncore = 1, }, .aliases = {
@@ -664,7 +664,7 @@ static struct perf_pmu_test_pmu test_pmus[] = { }, { .pmu = { - .name = (char *)"uncore_imc_free_running_0", + .name = "uncore_imc_free_running_0", .is_uncore = 1, }, .aliases = {
@@ -673,7 +673,7 @@ static struct perf_pmu_test_pmu test_pmus[] = { }, { .pmu = { - .name = (char *)"uncore_imc_0", + .name = "uncore_imc_0", .is_uncore = 1, }, .aliases = {
@@ -682,7 +682,7 @@ static struct perf_pmu_test_pmu test_pmus[] = { }, { .pmu = { - .name = (char *)"uncore_sys_ddr_pmu0", + .name = "uncore_sys_ddr_pmu0", .is_uncore = 1, .id = (char *)"v8", },
@@ -692,7 +692,7 @@ static struct perf_pmu_test_pmu test_pmus[] = { }, { .pmu = { - .name = (char *)"uncore_sys_ccn_pmu4", + .name = "uncore_sys_ccn_pmu4", .is_uncore = 1, .id = (char *)"0x01", },
tools/perf/util/env.c +2 -6
@@ -324,11 +324,9 @@ int perf_env__read_pmu_mappings(struct perf_env *env)u32 pmu_num =0 ;struct strbuf sb; -while ((pmu =perf_pmus__scan (pmu))) { -if (!pmu->name) -continue ; +while ((pmu =perf_pmus__scan (pmu))) pmu_num++; - } +if (!pmu_num) {pr_debug ("pmu mappings not available\n" );return -ENOENT ;
@@ -339,8 +337,6 @@ int perf_env__read_pmu_mappings(struct perf_env *env)return -ENOMEM ;while ((pmu =perf_pmus__scan (pmu))) { -if (!pmu->name) -continue ;if (strbuf_addf (&sb,"%u:%s" , pmu->type, pmu->name) <0 ) goto error;/* include a NULL character at the end */
tools/perf/util/header.c +1 -7
@@ -746,20 +746,14 @@ static int write_pmu_mappings(struct feat_fd *ff,* Do a first pass to count number of pmu to avoid lseek so this * works in pipe mode as well. */ -while ((pmu =perf_pmus__scan (pmu))) { -if (!pmu->name) -continue ; +while ((pmu =perf_pmus__scan (pmu))) pmu_num++; - } ret =do_write (ff, &pmu_num,sizeof (pmu_num));if (ret <0 )return ret;while ((pmu =perf_pmus__scan (pmu))) { -if (!pmu->name) -continue ; - ret =do_write (ff, &pmu->type,sizeof (pmu->type));if (ret <0 )return ret;
tools/perf/util/mem-events.c +8 -8
@@ -37,7 +37,7 @@ struct perf_mem_event * __weak perf_mem_events__ptr(int i)return &perf_mem_events[i]; } -char *__weak perf_mem_events__name (int i,char *pmu_name__maybe_unused ) +const char *__weak perf_mem_events__name (int i,const char *pmu_name__maybe_unused ) {struct perf_mem_event *e =perf_mem_events__ptr (i);
@@ -53,7 +53,7 @@ char * __weak perf_mem_events__name(int i, char *pmu_name __maybe_unused)return mem_loads_name; } -return (char *)e->name; +return e->name; }__weak bool is_mem_loads_aux_event (struct evsel *leader__maybe_unused )
@@ -186,7 +186,6 @@ int perf_mem_events__record_args(const char **rec_argv, int *argv_nr,int i = *argv_nr, k =0 ;struct perf_mem_event *e;struct perf_pmu *pmu; -char *s;for (int j =0 ; j <PERF_MEM_EVENTS__MAX ; j++) { e =perf_mem_events__ptr (j);
@@ -209,15 +208,16 @@ int perf_mem_events__record_args(const char **rec_argv, int *argv_nr, }while ((pmu =perf_pmus__scan (pmu)) !=NULL ) { +const char *s =perf_mem_events__name (j, pmu->name); + rec_argv[i++] ="-e" ; - s =perf_mem_events__name (j, pmu->name);if (s) { - s =strdup (s); -if (!s) +char *copy =strdup (s); +if (!copy)return -1 ; - rec_argv[i++] = s; - rec_tmp[k++] = s; + rec_argv[i++] = copy; + rec_tmp[k++] = copy; } } }
tools/perf/util/mem-events.h +1 -1
@@ -38,7 +38,7 @@ extern unsigned int perf_mem_events__loads_ldlat;int perf_mem_events__parse (const char *str);int perf_mem_events__init (void ); -char *perf_mem_events__name (int i,char *pmu_name); +const char *perf_mem_events__name (int i,const char *pmu_name);struct perf_mem_event *perf_mem_events__ptr (int i);bool is_mem_loads_aux_event (struct evsel *leader);
tools/perf/util/parse-events.c +2 -5
@@ -271,7 +271,7 @@ __add_event(struct list_head *list, int *idx, evsel->core.is_pmu_core = pmu ? pmu->is_core : false; evsel->auto_merge_stats = auto_merge_stats; evsel->pmu = pmu; - evsel->pmu_name = pmu && pmu->name ?strdup (pmu->name) :NULL ; + evsel->pmu_name = pmu ?strdup (pmu->name) :NULL ;if (name) evsel->name =strdup (name);
@@ -446,9 +446,6 @@ bool parse_events__filter_pmu(const struct parse_events_state *parse_state,if (parse_state->pmu_filter ==NULL )return false; -if (pmu->name ==NULL ) -return true; -return strcmp (parse_state->pmu_filter, pmu->name) !=0 ; }
@@ -1551,7 +1548,7 @@ static bool config_term_percore(struct list_head *config_terms) }int parse_events_add_pmu (struct parse_events_state *parse_state, -struct list_head *list,char *name, +struct list_head *list,const char *name,struct list_head *head_config,bool auto_merge_stats) {
tools/perf/util/parse-events.h +1 -1
@@ -190,7 +190,7 @@ int parse_events_add_breakpoint(struct parse_events_state *parse_state, u64 addr, char *type, u64 len, struct list_head *head_config);int parse_events_add_pmu (struct parse_events_state *parse_state, -struct list_head *list,char *name, +struct list_head *list,const char *name,struct list_head *head_config,bool auto_merge_stats);
tools/perf/util/parse-events.y +1 -1
@@ -312,7 +312,7 @@ PE_NAME opt_pmu_config } while ((pmu = perf_pmus__scan(pmu)) != NULL) { - char *name = pmu->name; + const char *name = pmu->name; if (parse_events__filter_pmu(parse_state, pmu)) continue;
tools/perf/util/pmu.c +9 -7
@@ -29,7 +29,9 @@#include "fncache.h" #include "util/evsel_config.h" -struct perf_pmu perf_pmu__fake; +struct perf_pmu perf_pmu__fake = { + .name ="fake" , +};/** * struct perf_pmu_format - Values from a format file read from
@@ -840,13 +842,13 @@ perf_pmu__get_default_config(struct perf_pmu *pmu __maybe_unused)return NULL ; } -char *__weak +const char *__weak pmu_find_real_name (const char *name) { -return (char *)name; +return name; } -char *__weak +const char *__weak pmu_find_alias_name (const char *name__maybe_unused ) {return NULL ;
@@ -866,8 +868,8 @@ struct perf_pmu *perf_pmu__lookup(struct list_head *pmus, int dirfd, const charLIST_HEAD (format);LIST_HEAD (aliases);__u32 type; -char *name =pmu_find_real_name (lookup_name); -char *alias_name; +const char *name =pmu_find_real_name (lookup_name); +const char *alias_name;/* * The pmu data we store & need consists of the pmu
@@ -1710,7 +1712,7 @@ void perf_pmu__warn_invalid_config(struct perf_pmu *pmu, __u64 config, name ?: "N/A", buf, config_name, config); } -int perf_pmu__match (char *pattern,char *name,char *tok) +int perf_pmu__match (const char *pattern,const char *name,const char *tok) {if (!name)return -1 ;
tools/perf/util/pmu.h +4 -4
@@ -39,7 +39,7 @@ struct perf_pmu_caps {*/ struct perf_pmu {/** @name: The name of the PMU such as "cpu". */ -char *name; +const char *name;/** * @alias_name: Optional alternate name for the PMU determined in * architecture specific code.
@@ -275,10 +275,10 @@ void perf_pmu__warn_invalid_config(struct perf_pmu *pmu, __u64 config, const char *config_name);void perf_pmu__warn_invalid_formats (struct perf_pmu *pmu); -int perf_pmu__match (char *pattern,char *name,char *tok); +int perf_pmu__match (const char *pattern,const char *name,const char *tok); -char *pmu_find_real_name (const char *name); -char *pmu_find_alias_name (const char *name); +const char *pmu_find_real_name (const char *name); +const char *pmu_find_alias_name (const char *name);double perf_pmu__cpu_slots_per_cycle (void );int perf_pmu__event_source_devices_scnprintf (char *pathname,size_t size); int perf_pmu__pathname_scnprintf(char *buf, size_t size,
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 427/550 perf mem-events: Avoid uninitialized read
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 85f73c377b2ac9988a204b119aebb33ca5c60083 ]
pmu should be initialized to NULL before perf_pmus__scan loop. Fix and shrink the scope of pmu at the same time. Issue detected by clang-tidy.
--- tools/perf/util/mem-events.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
tools/perf/util/mem-events.c +2 -1
@@ -185,7 +185,6 @@ int perf_mem_events__record_args(const char **rec_argv, int *argv_nr, {int i = *argv_nr, k =0 ;struct perf_mem_event *e; -struct perf_pmu *pmu;for (int j =0 ; j <PERF_MEM_EVENTS__MAX ; j++) { e =perf_mem_events__ptr (j);
@@ -202,6 +201,8 @@ int perf_mem_events__record_args(const char **rec_argv, int *argv_nr, rec_argv[i++] ="-e" ; rec_argv[i++] =perf_mem_events__name (j,NULL ); }else { +struct perf_pmu *pmu =NULL ; +if (!e->supported) {perf_mem_events__print_unsupport_hybrid (e, j);return -1 ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 428/550 s390/ap: re-init AP queues on config on
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harald Freudenberger <[email protected]>
[ Upstream commit 32d1d9204f8db3360be55e65bd182a1a68f93308 ]
On a state toggle from config off to config on and on the state toggle from checkstop to not checkstop the queue's internal states was set but the state machine was not nudged. This did not care as on the first enqueue of a request the state machine kick ran.
However, within an Secure Execution guest a queue is only chosen by the scheduler when it has been bound. But to bind a queue, it needs to run through the initial states (reset, enable interrupts, ...). So this is like a chicken-and-egg problem and the result was in fact that a queue was unusable after a config off/on toggle.
With some slight rework of the handling of these states now the new function _ap_queue_init_state() is called which is the core of the ap_queue_init_state() function but without locking handling. This has the benefit that it can be called on all the places where a (re-)init of the AP queue's state machine is needed.
--- drivers/s390/crypto/ap_bus.c | 21 ++++++++++----------- drivers/s390/crypto/ap_bus.h | 1 + drivers/s390/crypto/ap_queue.c | 9 +++++++-- 3 files changed, 18 insertions(+), 13 deletions(-)
drivers/s390/crypto/ap_bus.c +10 -11
@@ -1873,15 +1873,18 @@ static inline void ap_scan_domains(struct ap_card *ac) }/* get it and thus adjust reference counter */ get_device (dev); -if (decfg) +if (decfg) {AP_DBF_INFO ("%s(%d,%d) new (decfg) queue dev created\n" , __func__, ac->id, dom); -else if (chkstop) + }else if (chkstop) {AP_DBF_INFO ("%s(%d,%d) new (chkstop) queue dev created\n" , __func__, ac->id, dom); -else + }else { +/* nudge the queue's state machine */ +ap_queue_init_state (aq);AP_DBF_INFO ("%s(%d,%d) new queue dev created\n" , __func__, ac->id, dom); + } goto put_dev_and_continue; }/* handle state changes on already existing queue device */
@@ -1903,10 +1906,8 @@ static inline void ap_scan_domains(struct ap_card *ac) }else if (!chkstop && aq->chkstop) {/* checkstop off */ aq->chkstop = false; -if (aq->dev_state >AP_DEV_STATE_UNINITIATED ) { - aq->dev_state =AP_DEV_STATE_OPERATING ; - aq->sm_state =AP_SM_STATE_RESET_START ; - } +if (aq->dev_state >AP_DEV_STATE_UNINITIATED ) +_ap_queue_init_state (aq);spin_unlock_bh (&aq->lock);AP_DBF_DBG ("%s(%d,%d) queue dev checkstop off\n" , __func__, ac->id, dom);
@@ -1930,10 +1931,8 @@ static inline void ap_scan_domains(struct ap_card *ac) }else if (!decfg && !aq->config) {/* config on this queue device */ aq->config = true; -if (aq->dev_state >AP_DEV_STATE_UNINITIATED ) { - aq->dev_state =AP_DEV_STATE_OPERATING ; - aq->sm_state =AP_SM_STATE_RESET_START ; - } +if (aq->dev_state >AP_DEV_STATE_UNINITIATED ) +_ap_queue_init_state (aq);spin_unlock_bh (&aq->lock);AP_DBF_DBG ("%s(%d,%d) queue dev config on\n" , __func__, ac->id, dom);
drivers/s390/crypto/ap_bus.h +1 -0
@@ -301,6 +301,7 @@ struct ap_queue *ap_queue_create(ap_qid_t qid, int device_type);void ap_queue_prepare_remove (struct ap_queue *aq);void ap_queue_remove (struct ap_queue *aq);void ap_queue_init_state (struct ap_queue *aq); +void _ap_queue_init_state (struct ap_queue *aq);struct ap_card *ap_card_create (int id,int queue_depth,int raw_type,int comp_type,unsigned int functions,int ml);
drivers/s390/crypto/ap_queue.c +7 -2
@@ -1205,14 +1205,19 @@ void ap_queue_remove(struct ap_queue *aq)spin_unlock_bh (&aq->lock); } -void ap_queue_init_state (struct ap_queue *aq) +void _ap_queue_init_state (struct ap_queue *aq) { -spin_lock_bh (&aq->lock); aq->dev_state =AP_DEV_STATE_OPERATING ; aq->sm_state =AP_SM_STATE_RESET_START ; aq->last_err_rc =0 ; aq->assoc_idx =ASSOC_IDX_INVALID ;ap_wait (ap_sm_event (aq,AP_SM_EVENT_POLL )); +} + +void ap_queue_init_state (struct ap_queue *aq) +{ +spin_lock_bh (&aq->lock); +_ap_queue_init_state (aq);spin_unlock_bh (&aq->lock); }EXPORT_SYMBOL (ap_queue_init_state);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 429/550 modpost: fix tee MODULE_DEVICE_TABLE built on big-endian host
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masahiro Yamada <[email protected]>
[ Upstream commit 7f54e00e5842663c2cea501bbbdfa572c94348a3 ]
When MODULE_DEVICE_TABLE(tee, ) is built on a host with a different endianness from the target architecture, it results in an incorrect MODULE_ALIAS().
For example, see a case where drivers/char/hw_random/optee-rng.c is built as a module for ARM little-endian.
If you build it on a little-endian host, you will get the correct MODULE_ALIAS:
$ grep MODULE_ALIAS drivers/char/hw_random/optee-rng.mod.c
MODULE_ALIAS("tee:ab7a617c-b8e7-4d8f-8301-d09b61036b64*");However, if you build it on a big-endian host, you will get a wrong MODULE_ALIAS:
$ grep MODULE_ALIAS drivers/char/hw_random/optee-rng.mod.c
MODULE_ALIAS("tee:646b0361-9bd0-0183-8f4d-e7b87c617aab*");The same problem also occurs when you enable CONFIG_CPU_BIG_ENDIAN, and build it on a little-endian host.
This issue has been unnoticed because the ARM kernel is configured for little-endian by default, and most likely built on a little-endian host (cross-build on x86 or native-build on ARM).
The uuid field must not be reversed because uuid_t is an array of __u8.
--- scripts/mod/file2alias.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
scripts/mod/file2alias.c +5 -5
@@ -1348,13 +1348,13 @@ static int do_typec_entry(const char *filename, void *symval, char *alias)/* Looks like: tee:uuid */ static int do_tee_entry (const char *filename,void *symval,char *alias) { -DEF_FIELD (symval, tee_client_device_id, uuid); +DEF_FIELD_ADDR (symval, tee_client_device_id, uuid);sprintf (alias,"tee:%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x%02x-%02x%02x%02x%02x%02x%02x" , - uuid.b[0 ], uuid.b[1 ], uuid.b[2 ], uuid.b[3 ], uuid.b[4 ], - uuid.b[5 ], uuid.b[6 ], uuid.b[7 ], uuid.b[8 ], uuid.b[9 ], - uuid.b[10 ], uuid.b[11 ], uuid.b[12 ], uuid.b[13 ], uuid.b[14 ], - uuid.b[15 ]); + uuid->b[0 ], uuid->b[1 ], uuid->b[2 ], uuid->b[3 ], uuid->b[4 ], + uuid->b[5 ], uuid->b[6 ], uuid->b[7 ], uuid->b[8 ], uuid->b[9 ], + uuid->b[10 ], uuid->b[11 ], uuid->b[12 ], uuid->b[13 ], uuid->b[14 ], + uuid->b[15 ]);add_wildcard (alias);return 1 ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 430/550 modpost: fix ishtp MODULE_DEVICE_TABLE built on big-endian host
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masahiro Yamada <[email protected]>
[ Upstream commit ac96a15a0f0c8812a3aaa587b871cd5527f6d736 ]
When MODULE_DEVICE_TABLE(ishtp, ) is built on a host with a different endianness from the target architecture, it results in an incorrect MODULE_ALIAS().
For example, see a case where drivers/platform/x86/intel/ishtp_eclite.c is built as a module for x86.
If you build it on a little-endian host, you will get the correct MODULE_ALIAS:
$ grep MODULE_ALIAS drivers/platform/x86/intel/ishtp_eclite.mod.c
MODULE_ALIAS("ishtp:{6A19CC4B-D760-4DE3-B14D-F25EBD0FBCD9}");However, if you build it on a big-endian host, you will get a wrong MODULE_ALIAS:
$ grep MODULE_ALIAS drivers/platform/x86/intel/ishtp_eclite.mod.c
MODULE_ALIAS("ishtp:{BD0FBCD9-F25E-B14D-4DE3-D7606A19CC4B}");This issue has been unnoticed because the x86 kernel is most likely built natively on an x86 host.
The guid field must not be reversed because guid_t is an array of __u8.
--- scripts/mod/file2alias.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
scripts/mod/file2alias.c +2 -2
@@ -1401,10 +1401,10 @@ static int do_mhi_ep_entry(const char *filename, void *symval, char *alias)/* Looks like: ishtp:{guid} */ static int do_ishtp_entry (const char *filename,void *symval,char *alias) { -DEF_FIELD (symval, ishtp_device_id, guid); +DEF_FIELD_ADDR (symval, ishtp_device_id, guid);strcpy (alias,ISHTP_MODULE_PREFIX "{" ); -add_guid (alias, guid); +add_guid (alias, *guid);strcat (alias,"}" );return 1 ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 431/550 perf tools: Do not ignore the default vmlinux.h
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namhyung Kim <[email protected]>
[ Upstream commit 1f36b190ad2dea68e3a7e84b7b2f24ce8c4063ea ]
The recent change made it possible to generate vmlinux.h from BTF and to ignore the file. But we also have a minimal vmlinux.h that will be used by default. It should not be ignored by GIT.
--- tools/perf/util/bpf_skel/vmlinux/.gitignore | 1 + 1 file changed, 1 insertion(+) create mode 100644 tools/perf/util/bpf_skel/vmlinux/.gitignore
tools/perf/util/bpf_skel/vmlinux/.gitignore new file +1 -0
@@ -0,0 +1 @@ +!vmlinux.h
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 432/550 powerpc/40x: Remove stale PTE_ATOMIC_UPDATES macro
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit cc8ee288f484a2a59c01ccd4d8a417d6ed3466e3 ]
40x TLB handlers were reworked by commit 2c74e2586bb9 ("powerpc/40x:
Rework 40x PTE access and TLB miss") to not require PTE_ATOMIC_UPDATES anymore.
Then commit 4e1df545e2fa ("powerpc/pgtable: Drop PTE_ATOMIC_UPDATES") removed all code related to PTE_ATOMIC_UPDATES.
Remove left over PTE_ATOMIC_UPDATES macro.
--- arch/powerpc/include/asm/nohash/32/pte-40x.h | 3 --- 1 file changed, 3 deletions(-)
arch/powerpc/include/asm/nohash/32/pte-40x.h +0 -3
@@ -69,9 +69,6 @@#define _PTE_NONE_MASK 0 -/* Until my rework is finished, 40x still needs atomic PTE updates */ -#define PTE_ATOMIC_UPDATES 1 -#define _PAGE_BASE_NC (_PAGE_PRESENT | _PAGE_ACCESSED)#define _PAGE_BASE (_PAGE_BASE_NC)
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 433/550 powerpc/xive: Fix endian conversion size
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Gray <[email protected]>
[ Upstream commit ff7a60ab1e065257a0e467c13b519f4debcd7fcf ]
Sparse reports a size mismatch in the endian swap. The Opal implementation[1] passes the value as a __be64, and the receiving variable out_qsize is a u64, so the use of be32_to_cpu() appears to be an error.
[1]: https://github.com/open-power/skiboot/blob/80e2b1dc73/hw/xive.c#L3854
--- arch/powerpc/sysdev/xive/native.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/sysdev/xive/native.c +1 -1
@@ -802,7 +802,7 @@ int xive_native_get_queue_info(u32 vp_id, u32 prio,if (out_qpage) *out_qpage =be64_to_cpu (qpage);if (out_qsize) - *out_qsize =be32_to_cpu (qsize); + *out_qsize =be64_to_cpu (qsize);if (out_qeoi_page) *out_qeoi_page =be64_to_cpu (qeoi_page);if (out_escalate_irq)
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 434/550 powerpc: Hide empty pt_regs at base of the stack
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Ellerman <[email protected]>
[ Upstream commit d45c4b48dafb5820e5cc267ff9a6d7784d13a43c ]
A thread started via eg. user_mode_thread() runs in the kernel to begin with and then may later return to userspace. While it's running in the kernel it has a pt_regs at the base of its kernel stack, but that pt_regs is all zeroes.
If the thread oopses in that state, it leads to an ugly stack trace with a big block of zero GPRs, as reported by Joel:
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0) CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.5.0-rc7-00004-gf7757129e3de-dirty #3 Hardware name: IBM PowerNV (emulated by qemu) POWER9 0x4e1200 opal:v7.0 PowerNV Call Trace: [c0000000036afb00] [c0000000010dd058] dump_stack_lvl+0x6c/0x9c (unreliable) [c0000000036afb30] [c00000000013c524] panic+0x178/0x424 [c0000000036afbd0] [c000000002005100] mount_root_generic+0x250/0x324 [c0000000036afca0] [c0000000020057d0] prepare_namespace+0x2d4/0x344 [c0000000036afd20] [c0000000020049c0] kernel_init_freeable+0x358/0x3ac [c0000000036afdf0] [c0000000000111b0] kernel_init+0x30/0x1a0 [c0000000036afe50] [c00000000000debc] ret_from_kernel_user_thread+0x14/0x1c --- interrupt: 0 at 0x0 NIP: 0000000000000000 LR: 0000000000000000 CTR: 0000000000000000 REGS: c0000000036afe80 TRAP: 0000 Not tainted (6.5.0-rc7-00004-gf7757129e3de-dirty) MSR: 0000000000000000 <> CR: 00000000 XER: 00000000 CFAR: 0000000000000000 IRQMASK: 0 GPR00: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 GPR04: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 GPR08: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 GPR12: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 GPR20: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 GPR24: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 GPR28: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 NIP [0000000000000000] 0x0 LR [0000000000000000] 0x0 --- interrupt: 0
The all-zero pt_regs looks ugly and conveys no useful information, other than its presence. So detect that case and just show the presence of the frame by printing the interrupt marker, eg:
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0) CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.5.0-rc3-00126-g18e9506562a0-dirty #301 Hardware name: IBM pSeries (emulated by qemu) POWER9 (raw) 0x4e1202 0xf000005 of:SLOF,HEAD hv:linux,kvm pSeries Call Trace: [c000000003aabb00] [c000000001143db8] dump_stack_lvl+0x6c/0x9c (unreliable) [c000000003aabb30] [c00000000014c624] panic+0x178/0x424 [c000000003aabbd0] [c0000000020050fc] mount_root_generic+0x250/0x324 [c000000003aabca0] [c0000000020057cc] prepare_namespace+0x2d4/0x344 [c000000003aabd20] [c0000000020049bc] kernel_init_freeable+0x358/0x3ac [c000000003aabdf0] [c0000000000111b0] kernel_init+0x30/0x1a0 [c000000003aabe50] [c00000000000debc] ret_from_kernel_user_thread+0x14/0x1c --- interrupt: 0 at 0x0
To avoid ever suppressing a valid pt_regs make sure the pt_regs has a zero MSR and TRAP value, and is located at the very base of the stack.
--- arch/powerpc/kernel/process.c | 26 +++++++++++++++++++++++--- 1 file changed, 23 insertions(+), 3 deletions(-)
arch/powerpc/kernel/process.c +23 -3
@@ -2258,6 +2258,22 @@ unsigned long __get_wchan(struct task_struct *p)return ret; } +static bool empty_user_regs (struct pt_regs *regs,struct task_struct *tsk) +{ +unsigned long stack_page; + +// A non-empty pt_regs should never have a zero MSR or TRAP value. +if (regs->msr || regs->trap) +return false; + +// Check it sits at the very base of the stack + stack_page = (unsigned long )task_stack_page (tsk); +if ((unsigned long )(regs +1 ) != stack_page +THREAD_SIZE ) +return false; + +return true; +} +static int kstack_depth_to_print =CONFIG_PRINT_STACK_DEPTH ; void __no_sanitize_address show_stack(struct task_struct *tsk,
@@ -2322,9 +2338,13 @@ void __no_sanitize_address show_stack(struct task_struct *tsk, lr = regs->link;printk ("%s--- interrupt: %lx at %pS\n" , loglvl, regs->trap, (void *)regs->nip); -__show_regs (regs); -printk ("%s--- interrupt: %lx\n" , - loglvl, regs->trap); + +// Detect the case of an empty pt_regs at the very base +// of the stack and suppress showing it in full. +if (!empty_user_regs (regs, tsk)) { +__show_regs (regs); +printk ("%s--- interrupt: %lx\n" , loglvl, regs->trap); + } firstframe =1 ; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 435/550 perf trace: Use the right bpf_probe_read(_str) variant for reading user data
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Richter <[email protected]>
[ Upstream commit 5069211e2f0b47e75119805e23ae6352d871e263 ]
Perf test case 111 Check open filename arg using perf trace + vfs_getname fails on s390. This is caused by a failing function bpf_probe_read() in file util/bpf_skel/augmented_raw_syscalls.bpf.c.
The root cause is the lookup by address. Function bpf_probe_read() is used. This function works only for architectures with ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE.
On s390 is not possible to determine from the address to which address space the address belongs to (user or kernel space).
Replace bpf_probe_read() by bpf_probe_read_kernel() and bpf_probe_read_str() by bpf_probe_read_user_str() to explicity specify the address space the address refers to.
Output before:
# ./perf trace -eopen,openat -- touch /tmp/111 libbpf: prog 'sys_enter': BPF program load failed: Invalid argument libbpf: prog 'sys_enter': -- BEGIN PROG LOAD LOG -- reg type unsupported for arg#0 function sys_enter#75 0: R1=ctx(off=0,imm=0) R10=fp0 ; int sys_enter(struct syscall_enter_args *args) 0: (bf) r6 = r1 ; R1=ctx(off=0,imm=0) R6_w=ctx(off=0,imm=0) ; return bpf_get_current_pid_tgid(); 1: (85) call bpf_get_current_pid_tgid#14 ; R0_w=scalar() 2: (63) *(u32 *)(r10 -8) = r0 ; R0_w=scalar() R10=fp0 fp-8=????mmmm 3: (bf) r2 = r10 ; R2_w=fp0 R10=fp0 ; ..... lines deleted here ..... 23: (bf) r3 = r6 ; R3_w=ctx(off=0,imm=0) R6=ctx(off=0,imm=0) 24: (85) call bpf_probe_read#4 unknown func bpf_probe_read#4 processed 23 insns (limit 1000000) max_states_per_insn 0 \ total_states 2 peak_states 2 mark_read 2 -- END PROG LOAD LOG -- libbpf: prog 'sys_enter': failed to load: -22 libbpf: failed to load object 'augmented_raw_syscalls_bpf' libbpf: failed to load BPF skeleton 'augmented_raw_syscalls_bpf': -22 ....
Output after:
# ./perf test -Fv 111
111: Check open filename arg using perf trace + vfs_getname :
--- start ---
1.085 ( 0.011 ms): touch/320753 openat(dfd: CWD, filename: \
"/tmp/temporary_file.SWH85", \
flags: CREAT|NOCTTY|NONBLOCK|WRONLY, mode: IRUGO|IWUGO) = 3
---- end ----
Check open filename arg using perf trace + vfs_getname: Ok
#Test with the sleep command shows:
Output before:
# ./perf trace -e *sleep sleep 1.234567890
0.000 (1234.681 ms): sleep/63114 clock_nanosleep(rqtp: \
{ .tv_sec: 0, .tv_nsec: 0 }, rmtp: 0x3ffe0979720) = 0
#Output after:
# ./perf trace -e *sleep sleep 1.234567890
0.000 (1234.686 ms): sleep/64277 clock_nanosleep(rqtp: \
{ .tv_sec: 1, .tv_nsec: 234567890 }, rmtp: 0x3fff3df9ea0) = 0
#--- tools/perf/examples/bpf/augmented_raw_syscalls.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
tools/perf/examples/bpf/augmented_raw_syscalls.c +8 -8
@@ -147,7 +147,7 @@ static inlineunsigned int augmented_arg__read_str (struct augmented_arg *augmented_arg,const void *arg,unsigned int arg_len) {unsigned int augmented_len =sizeof (*augmented_arg); -int string_len =bpf_probe_read_str (&augmented_arg->value, arg_len, arg); +int string_len =bpf_probe_read_user_str (&augmented_arg->value, arg_len, arg); augmented_arg->size = augmented_arg->err =0 ;/*
@@ -196,7 +196,7 @@ int sys_enter_connect(struct syscall_enter_args *args)if (socklen >sizeof (augmented_args->saddr)) socklen =sizeof (augmented_args->saddr); -bpf_probe_read (&augmented_args->saddr, socklen, sockaddr_arg); +bpf_probe_read_user (&augmented_args->saddr, socklen, sockaddr_arg);return augmented__output (args, augmented_args, len + socklen); }
@@ -215,7 +215,7 @@ int sys_enter_sendto(struct syscall_enter_args *args)if (socklen >sizeof (augmented_args->saddr)) socklen =sizeof (augmented_args->saddr); -bpf_probe_read (&augmented_args->saddr, socklen, sockaddr_arg); +bpf_probe_read_user (&augmented_args->saddr, socklen, sockaddr_arg);return augmented__output (args, augmented_args, len + socklen); }
@@ -305,7 +305,7 @@ int sys_enter_perf_event_open(struct syscall_enter_args *args)if (augmented_args ==NULL ) goto failure; -if (bpf_probe_read (&augmented_args->__data,sizeof (*attr), attr) <0 ) +if (bpf_probe_read_user (&augmented_args->__data,sizeof (*attr), attr) <0 ) goto failure; attr_read = (const struct perf_event_attr_size *)augmented_args->__data;
@@ -319,7 +319,7 @@ int sys_enter_perf_event_open(struct syscall_enter_args *args) goto failure;// Now that we read attr->size and tested it against the size limits, read it completely -if (bpf_probe_read (&augmented_args->__data, size, attr) <0 ) +if (bpf_probe_read_user (&augmented_args->__data, size, attr) <0 ) goto failure;return augmented__output (args, augmented_args, len + size);
@@ -341,7 +341,7 @@ int sys_enter_clock_nanosleep(struct syscall_enter_args *args)if (size >sizeof (augmented_args->__data)) goto failure; -bpf_probe_read (&augmented_args->__data, size, rqtp_arg); +bpf_probe_read_user (&augmented_args->__data, size, rqtp_arg);return augmented__output (args, augmented_args, len + size); failure:
@@ -380,7 +380,7 @@ int sys_enter(struct syscall_enter_args *args)if (augmented_args ==NULL )return 1 ; -bpf_probe_read (&augmented_args->args,sizeof (augmented_args->args), args); +bpf_probe_read_kernel (&augmented_args->args,sizeof (augmented_args->args), args);/* * Jump to syscall specific augmenter, even if the default one,
@@ -401,7 +401,7 @@ int sys_exit(struct syscall_exit_args *args)if (pid_filter__has (&pids_filtered,getpid ()))return 0 ; -bpf_probe_read (&exit_args,sizeof (exit_args), args); +bpf_probe_read_kernel (&exit_args,sizeof (exit_args), args);/* * Jump to syscall specific return augmenter, even if the default one, * "!raw_syscalls:unaugmented" that will just return 1 to return the
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 436/550 powerpc/vas: Limit open window failure messages in log bufffer
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haren Myneni <[email protected]>
[ Upstream commit 73b25505ce043b561028e5571d84dc82aa53c2b4 ]
The VAS open window call prints error message and returns -EBUSY after the migration suspend event initiated and until the resume event completed on the destination system. It can cause the log buffer filled with these error messages if the user space issues continuous open window calls. Similar case even for DLPAR CPU remove event when no credits are available until the credits are freed or with the other DLPAR CPU add event.
So changes in the patch to use pr_err_ratelimited() instead of pr_err() to display open window failure and not-available credits error messages.
Use pr_fmt() and make the corresponding changes to have the consistencein prefix all pr_*() messages (vas-api.c).
--- arch/powerpc/platforms/book3s/vas-api.c | 34 ++++++++++++------------- arch/powerpc/platforms/pseries/vas.c | 4 +-- 2 files changed, 18 insertions(+), 20 deletions(-)
arch/powerpc/platforms/book3s/vas-api.c +16 -18
@@ -4,6 +4,8 @@* Copyright (C) 2019 Haren Myneni, IBM Corp */ +#define pr_fmt (fmt) "vas-api: " fmt +#include <linux/kernel.h> #include <linux/device.h> #include <linux/cdev.h>
@@ -78,7 +80,7 @@ int get_vas_user_win_ref(struct vas_user_win_ref *task_ref) task_ref->mm =get_task_mm (current);if (!task_ref->mm) {put_pid (task_ref->pid); -pr_err ("VAS: pid(%d): mm_struct is not found\n" , +pr_err ("pid(%d): mm_struct is not found\n" , current->pid);return -EPERM ; }
@@ -235,8 +237,7 @@ void vas_update_csb(struct coprocessor_request_block *crb, rc =kill_pid_info (SIGSEGV , &info, pid);rcu_read_unlock (); -pr_devel ("%s(): pid %d kill_proc_info() rc %d\n" , __func__, -pid_vnr (pid), rc); +pr_devel ("pid %d kill_proc_info() rc %d\n" ,pid_vnr (pid), rc); }void vas_dump_crb (struct coprocessor_request_block *crb)
@@ -294,7 +295,7 @@ static int coproc_ioc_tx_win_open(struct file *fp, unsigned long arg) rc =copy_from_user (&uattr, uptr,sizeof (uattr));if (rc) { -pr_err ("%s(): copy_from_user() returns %d\n" , __func__, rc); +pr_err ("copy_from_user() returns %d\n" , rc);return -EFAULT ; }
@@ -311,7 +312,7 @@ static int coproc_ioc_tx_win_open(struct file *fp, unsigned long arg) txwin = cp_inst->coproc->vops->open_win (uattr.vas_id, uattr.flags, cp_inst->coproc->cop_type);if (IS_ERR (txwin)) { -pr_err ("%s() VAS window open failed, %ld\n" , __func__, +pr_err_ratelimited ("VAS window open failed rc=%ld\n" ,PTR_ERR (txwin));return PTR_ERR (txwin); }
@@ -405,8 +406,7 @@ static vm_fault_t vas_mmap_fault(struct vm_fault *vmf)* window is not opened. Shouldn't expect this error. */ if (!cp_inst || !cp_inst->txwin) { -pr_err ("%s(): Unexpected fault on paste address with TX window closed\n" , - __func__); +pr_err ("Unexpected fault on paste address with TX window closed\n" );return VM_FAULT_SIGBUS ; }
@@ -421,8 +421,7 @@ static vm_fault_t vas_mmap_fault(struct vm_fault *vmf)* issue NX request. */ if (txwin->task_ref.vma != vmf->vma) { -pr_err ("%s(): No previous mapping with paste address\n" , - __func__); +pr_err ("No previous mapping with paste address\n" );return VM_FAULT_SIGBUS ; }
@@ -481,19 +480,19 @@ static int coproc_mmap(struct file *fp, struct vm_area_struct *vma) txwin = cp_inst->txwin;if ((vma->vm_end - vma->vm_start) >PAGE_SIZE ) { -pr_debug ("%s(): size 0x%zx, PAGE_SIZE 0x%zx\n" , __func__, +pr_debug ("size 0x%zx, PAGE_SIZE 0x%zx\n" , (vma->vm_end - vma->vm_start),PAGE_SIZE );return -EINVAL ; }/* Ensure instance has an open send window */ if (!txwin) { -pr_err ("%s(): No send window open?\n" , __func__); +pr_err ("No send window open?\n" );return -EINVAL ; }if (!cp_inst->coproc->vops || !cp_inst->coproc->vops->paste_addr) { -pr_err ("%s(): VAS API is not registered\n" , __func__); +pr_err ("VAS API is not registered\n" );return -EACCES ; }
@@ -510,14 +509,14 @@ static int coproc_mmap(struct file *fp, struct vm_area_struct *vma)*/ mutex_lock (&txwin->task_ref.mmap_mutex);if (txwin->status !=VAS_WIN_ACTIVE ) { -pr_err ("%s(): Window is not active\n" , __func__); +pr_err ("Window is not active\n" ); rc = -EACCES ; goto out; } paste_addr = cp_inst->coproc->vops->paste_addr (txwin);if (!paste_addr) { -pr_err ("%s(): Window paste address failed\n" , __func__); +pr_err ("Window paste address failed\n" ); rc = -EINVAL ; goto out; }
@@ -533,8 +532,8 @@ static int coproc_mmap(struct file *fp, struct vm_area_struct *vma) rc =remap_pfn_range (vma, vma->vm_start, pfn + vma->vm_pgoff, vma->vm_end - vma->vm_start, prot); -pr_devel ("%s(): paste addr %llx at %lx, rc %d\n" , __func__, - paste_addr, vma->vm_start, rc); +pr_devel ("paste addr %llx at %lx, rc %d\n" , paste_addr, + vma->vm_start, rc); txwin->task_ref.vma = vma; vma->vm_ops = &vas_vm_ops;
@@ -609,8 +608,7 @@ int vas_register_coproc_api(struct module *mod, enum vas_cop_type cop_type, goto err; } -pr_devel ("%s: Added dev [%d,%d]\n" , __func__,MAJOR (devno), -MINOR (devno)); +pr_devel ("Added dev [%d,%d]\n" ,MAJOR (devno),MINOR (devno));return 0 ;
arch/powerpc/platforms/pseries/vas.c +2 -2
@@ -340,7 +340,7 @@ static struct vas_window *vas_allocate_window(int vas_id, u64 flags,if (atomic_inc_return (&cop_feat_caps->nr_used_credits) >atomic_read (&cop_feat_caps->nr_total_credits)) { -pr_err ("Credits are not available to allocate window\n" ); +pr_err_ratelimited ("Credits are not available to allocate window\n" ); rc = -EINVAL ; goto out; }
@@ -423,7 +423,7 @@ static struct vas_window *vas_allocate_window(int vas_id, u64 flags,put_vas_user_win_ref (&txwin->vas_win.task_ref); rc = -EBUSY ; -pr_err ("No credit is available to allocate window\n" ); +pr_err_ratelimited ("No credit is available to allocate window\n" ); out_free:/*
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 437/550 powerpc/imc-pmu: Use the correct spinlock initializer.
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <[email protected]>
[ Upstream commit 007240d59c11f87ac4f6cfc6a1d116630b6b634c ]
The macro __SPIN_LOCK_INITIALIZER() is implementation specific. Users that desire to initialize a spinlock in a struct must use __SPIN_LOCK_UNLOCKED().
Use __SPIN_LOCK_UNLOCKED() for the spinlock_t in imc_global_refc.
--- arch/powerpc/perf/imc-pmu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/perf/imc-pmu.c +1 -1
@@ -51,7 +51,7 @@ static int trace_imc_mem_size;* core and trace-imc */ static struct imc_pmu_ref imc_global_refc = { - .lock =__SPIN_LOCK_INITIALIZER (imc_global_refc.lock), + .lock =__SPIN_LOCK_UNLOCKED (imc_global_refc.lock), .id =0 , .refc =0 , };
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 438/550 powerpc/pseries: fix potential memory leak in init_cpu_associativity()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Yufen <[email protected]>
[ Upstream commit 95f1a128cd728a7257d78e868f1f5a145fc43736 ]
If the vcpu_associativity alloc memory successfully but the pcpu_associativity fails to alloc memory, the vcpu_associativity memory leaks.
--- arch/powerpc/platforms/pseries/lpar.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/powerpc/platforms/pseries/lpar.c +3 -1
@@ -525,8 +525,10 @@ static ssize_t vcpudispatch_stats_write(struct file *file, const char __user *p,if (cmd) { rc =init_cpu_associativity (); -if (rc) +if (rc) { +destroy_cpu_associativity (); goto out; + }for_each_possible_cpu (cpu) { disp =per_cpu_ptr (&vcpu_disp_data, cpu);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 439/550 perf vendor events: Update PMC used in PM_RUN_INST_CMPL event for power10 platform
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kajol Jain <[email protected]>
[ Upstream commit 3f8b6e5b11192dacb721d2d28ea4589917f5e822 ]
The CPI_STALL_RATIO metric group can be used to present the high level CPI stall breakdown metrics in powerpc, which will show:
- DISPATCH_STALL_CPI ( Dispatch stall cycles per insn )
- ISSUE_STALL_CPI ( Issue stall cycles per insn )
- EXECUTION_STALL_CPI ( Execution stall cycles per insn )
- COMPLETION_STALL_CPI ( Completion stall cycles per insn )
Commit cf26e043c2a9 ("perf vendor events power10: Add JSON metric events to present CPI stall cycles in powerpc)" which added the CPI_STALL_RATIO metric group, also modified
the PMC value used in PM_RUN_INST_CMPL event from PMC4 to PMC5, to avoid multiplexing of events.
But that got revert in recent changes. Fix this issue by changing back the PMC value used in PM_RUN_INST_CMPL to PMC5.
Result with the fix:
./perf stat --metric-no-group -M CPI_STALL_RATIO <workload>
Performance counter stats for 'workload':
68,745,426 PM_CMPL_STALL # 0.21 COMPLETION_STALL_CPI
7,692,827 PM_ISSUE_STALL # 0.02 ISSUE_STALL_CPI
322,638,223 PM_RUN_INST_CMPL # 0.05 DISPATCH_STALL_CPI
# 0.48 EXECUTION_STALL_CPI
16,858,553 PM_DISP_STALL_CYC
153,880,133 PM_EXEC_STALL
0.089774592 seconds time elapsed"--metric-no-group" is used for forcing PM_RUN_INST_CMPL to be scheduled in all group for more accuracy.
--- tools/perf/pmu-events/arch/powerpc/power10/pmc.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/pmu-events/arch/powerpc/power10/pmc.json +1 -1
@@ -190,7 +190,7 @@ "BriefDescription": "Threshold counter exceeded a value of 128." }, { - "EventCode": "0x400FA", + "EventCode": "0x500FA", "EventName": "PM_RUN_INST_CMPL", "BriefDescription": "PowerPC instruction completed while the run latch is set." }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 440/550 xhci: Loosen RPM as default policy to cover for AMD xHC 1.1
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Basavaraj Natikar <[email protected]>
[ Upstream commit 4baf1218150985ee3ab0a27220456a1f027ea0ac ]
The AMD USB host controller (1022:43f7) isn't going into PCI D3 by default without anything connected. This is because the policy that was introduced by commit a611bf473d1f ("xhci-pci: Set runtime PM as default policy on all xHC 1.2 or later devices") only covered 1.2 or later.
The 1.1 specification also has the same requirement as the 1.2 specification for D3 support. So expand the runtime PM as default policy to all AMD 1.1 devices as well.
--- drivers/usb/host/xhci-pci.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/host/xhci-pci.c +2 -0
@@ -535,6 +535,8 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)/* xHC spec requires PCI devices to support D3hot and D3cold */ if (xhci->hci_version >=0x120 ) xhci->quirks |=XHCI_DEFAULT_PM_RUNTIME_ALLOW ; +else if (pdev->vendor ==PCI_VENDOR_ID_AMD && xhci->hci_version >=0x110 ) + xhci->quirks |=XHCI_DEFAULT_PM_RUNTIME_ALLOW ;if (xhci->quirks &XHCI_RESET_ON_RESUME ) xhci_dbg_trace(xhci, trace_xhci_dbg_quirks,
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 441/550 usb: host: xhci-plat: fix possible kernel oops while resuming
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Shtylyov <[email protected]>
[ Upstream commit a5f928db59519a15e82ecba4ae3e7cbf5a44715a ]
If this driver enables the xHC clocks while resuming from sleep, it calls clk_prepare_enable() without checking for errors and blithely goes on to read/write the xHC's registers -- which, with the xHC not being clocked, at least on ARM32 usually causes an imprecise external abort exceptions which cause kernel oops. Currently, the chips for which the driver does the clock dance on suspend/resume seem to be the Broadcom STB SoCs, based on ARM32 CPUs, as it seems...
Found by Linux Verification Center (linuxtesting.org) with the Svace static analysis tool.
--- drivers/usb/host/xhci-plat.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-)
drivers/usb/host/xhci-plat.c +19 -4
@@ -459,23 +459,38 @@ static int __maybe_unused xhci_plat_resume(struct device *dev)int ret;if (!device_may_wakeup (dev) && (xhci->quirks &XHCI_SUSPEND_RESUME_CLKS )) { -clk_prepare_enable (xhci->clk); -clk_prepare_enable (xhci->reg_clk); + ret =clk_prepare_enable (xhci->clk); +if (ret) +return ret; + + ret =clk_prepare_enable (xhci->reg_clk); +if (ret) { +clk_disable_unprepare (xhci->clk); +return ret; + } } ret =xhci_priv_resume_quirk (hcd);if (ret) -return ret; + goto disable_clks; ret =xhci_resume (xhci,PMSG_RESUME );if (ret) -return ret; + goto disable_clks;pm_runtime_disable (dev);pm_runtime_set_active (dev);pm_runtime_enable (dev);return 0 ; + +disable_clks: +if (!device_may_wakeup (dev) && (xhci->quirks &XHCI_SUSPEND_RESUME_CLKS )) { +clk_disable_unprepare (xhci->clk); +clk_disable_unprepare (xhci->reg_clk); + } + +return ret; }static int __maybe_unused xhci_plat_runtime_suspend (struct device *dev)
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 442/550 perf machine: Avoid out of bounds LBR memory read
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit ab8ce150781d326c6bfbe1e09f175ffde1186f80 ]
Running perf top with address sanitizer and "--call-graph=lbr" fails due to reading sample 0 when no samples exist. Add a guard to prevent this.
--- tools/perf/util/machine.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-)
tools/perf/util/machine.c +12 -10
@@ -2622,16 +2622,18 @@ static int lbr_callchain_add_lbr_ip(struct thread *thread,save_lbr_cursor_node (thread, cursor, i); } -/* Add LBR ip from first entries.to */ - ip = entries[0 ].to; - flags = &entries[0 ].flags; - *branch_from = entries[0 ].from; - err =add_callchain_ip (thread, cursor, parent, - root_al, &cpumode, ip, - true, flags,NULL , - *branch_from); -if (err) -return err; +if (lbr_nr >0 ) { +/* Add LBR ip from first entries.to */ + ip = entries[0 ].to; + flags = &entries[0 ].flags; + *branch_from = entries[0 ].from; + err =add_callchain_ip (thread, cursor, parent, + root_al, &cpumode, ip, + true, flags,NULL , + *branch_from); +if (err) +return err; + }return 0 ; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 443/550 libperf rc_check: Make implicit enabling work for GCC
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 75265320d290c5f5891f16967b94883676c46705 ]
Make the implicit REFCOUNT_CHECKING robust to when building with GCC.
--- tools/lib/perf/include/internal/rc_check.h | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
tools/lib/perf/include/internal/rc_check.h +5 -1
@@ -9,8 +9,12 @@* Enable reference count checking implicitly with leak checking, which is * integrated into address sanitizer. */ -#if defined(LEAK_SANITIZER ) || defined(ADDRESS_SANITIZER ) +#if defined(__SANITIZE_ADDRESS__) || defined(LEAK_SANITIZER ) || defined(ADDRESS_SANITIZER )#define REFCNT_CHECKING 1 +#elif defined(__has_feature) +#if __has_feature (address_sanitizer) ||__has_feature (leak_sanitizer) +#define REFCNT_CHECKING 1 +#endif #endif /*
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 444/550 perf hist: Add missing puts to hist__account_cycles
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit c1149037f65bcf0334886180ebe3d5efcf214912 ]
Caught using reference count checking on perf top with "--call-graph=lbr". After this no memory leaks were detected.
--- tools/perf/util/hist.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
tools/perf/util/hist.c +7 -3
@@ -2676,8 +2676,6 @@ void hist__account_cycles(struct branch_stack *bs, struct addr_location *al,/* If we have branch cycles always annotate them. */ if (bs && bs->nr && entries[0 ].flags.cycles) { -int i; - bi =sample__resolve_bstack (sample, al);if (bi) {struct addr_map_symbol *prev =NULL ;
@@ -2692,7 +2690,7 @@ void hist__account_cycles(struct branch_stack *bs, struct addr_location *al,* Note that perf stores branches reversed from * program order! */ -for (i = bs->nr -1 ; i >=0 ; i--) { +for (int i = bs->nr -1 ; i >=0 ; i--) {addr_map_symbol__account_cycles (&bi[i].from, nonany_branch_mode ?NULL : prev, bi[i].flags.cycles);
@@ -2701,6 +2699,12 @@ void hist__account_cycles(struct branch_stack *bs, struct addr_location *al,if (total_cycles) *total_cycles += bi[i].flags.cycles; } +for (unsigned int i =0 ; i < bs->nr; i++) { +map__put (bi[i].to.ms.map); +maps__put (bi[i].to.ms.maps); +map__put (bi[i].from.ms.map); +maps__put (bi[i].from.ms.maps); + }free (bi); } }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 445/550 perf vendor events intel: Fix broadwellde tma_info_system_dram_bw_use metric
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 3779416eed25a843364b940decee452620a1de4b ]
Broadwell-de has a consumer core and server uncore. The uncore_arb PMU isn't present and the broadwellx style cbox PMU should be used instead. Fix the tma_info_system_dram_bw_use metric to use the server metric rather than client.
The associated converter script fix is in:
https://github.com/intel/perfmon/pull/111
--- tools/perf/pmu-events/arch/x86/broadwellde/bdwde-metrics.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/pmu-events/arch/x86/broadwellde/bdwde-metrics.json +1 -1
@@ -652,7 +652,7 @@ }, { "BriefDescription": "Average external Memory Bandwidth Use for reads and writes [GB / sec]", - "MetricExpr": "64 * (arb@event\\=0x81\\,umask\\=0x1@ + arb@event\\=0x84\\,umask\\=0x1@) / 1e6 / duration_time / 1e3", + "MetricExpr": "64 * (UNC_M_CAS_COUNT.RD + UNC_M_CAS_COUNT.WR) / 1e9 / duration_time", "MetricGroup": "HPC;Mem;MemoryBW;SoC;tma_issueBW", "MetricName": "tma_info_system_dram_bw_use", "PublicDescription": "Average external Memory Bandwidth Use for reads and writes [GB / sec]. Related metrics: tma_fb_full, tma_mem_bandwidth, tma_sq_full"
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 446/550 perf vendor events intel: Add broadwellde two metrics
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 19a214bffdf7abb8d472895bb944d9c269ab1699 ]
Add tma_info_system_socket_clks and uncore_freq metrics that require a broadwellx style uncore event for UNC_CLOCK.
The associated converter script fix is in:
https://github.com/intel/perfmon/pull/112
--- .../arch/x86/broadwellde/bdwde-metrics.json | 12 ++++++++++++ 1 file changed, 12 insertions(+)
tools/perf/pmu-events/arch/x86/broadwellde/bdwde-metrics.json +12 -0
@@ -48,6 +48,12 @@ "MetricName": "C7_Pkg_Residency", "ScaleUnit": "100%" }, + { + "BriefDescription": "Uncore frequency per die [GHZ]", + "MetricExpr": "tma_info_system_socket_clks / #num_dies / duration_time / 1e9", + "MetricGroup": "SoC", + "MetricName": "UNCORE_FREQ" + }, { "BriefDescription": "Percentage of cycles spent in System Management Interrupts.", "MetricExpr": "((msr@aperf@ - cycles) / msr@aperf@ if msr@smi@ > 0 else 0)",
@@ -690,6 +696,12 @@ "MetricGroup": "SMT", "MetricName": "tma_info_system_smt_2t_utilization" }, + { + "BriefDescription": "Socket actual clocks when any core is active on that socket", + "MetricExpr": "cbox_0@event\\=0x0@", + "MetricGroup": "SoC", + "MetricName": "tma_info_system_socket_clks" + }, { "BriefDescription": "Average Frequency Utilization relative nominal frequency", "MetricExpr": "tma_info_thread_clks / CPU_CLK_UNHALTED.REF_TSC",
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 447/550 9p/net: fix possible memory leak in p9_check_errors()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangyu Hua <[email protected]>
[ Upstream commit ce07087964208eee2ca2f9ee4a98f8b5d9027fe6 ]
When p9pdu_readf() is called with "s?d" attribute, it allocates a pointer that will store a string. But when p9pdu_readf() fails while handling "d" then this pointer will not be freed in p9_check_errors().
Message-ID: <[email protected]>
--- net/9p/client.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/9p/client.c +4 -2
@@ -540,12 +540,14 @@ static int p9_check_errors(struct p9_client *c, struct p9_req_t *req)return 0 ;if (!p9_is_proto_dotl (c)) { -char *ename; +char *ename =NULL ; err =p9pdu_readf (&req->rc, c->proto_version,"s?d" , &ename, &ecode); -if (err) +if (err) { +kfree (ename); goto out_err; + }if (p9_is_proto_dotu (c) && ecode <512 ) err = -ecode;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 448/550 rtla: Fix uninitialized variable found
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Ian King <[email protected]>
[ Upstream commit 696444a544ecd6d62c1edc89516b376cefb28929 ]
Variable found is not being initialized, in the case where the desired mount is not found the variable contains garbage. Fix this by initializing it to zero.
--- tools/tracing/rtla/src/utils.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/tracing/rtla/src/utils.c +1 -1
@@ -538,7 +538,7 @@ static const int find_mount(const char *fs, char *mp, int sizeof_mp) {char mount_point[MAX_PATH ];char type[100 ]; -int found; +int found =0 ;FILE *fp; fp =fopen ("/proc/mounts" ,"r" );
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 449/550 i3c: Fix potential refcount leak in i3c_master_register_new_i3c_devs
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dinghao Liu <[email protected]>
[ Upstream commit cab63f64887616e3c4e31cfd8103320be6ebc8d3 ]
put_device() needs to be called on failure of device_register() to give up the reference initialized in it to avoid refcount leak.
--- drivers/i3c/master.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/i3c/master.c +3 -1
@@ -1521,9 +1521,11 @@ i3c_master_register_new_i3c_devs(struct i3c_master_controller *master) desc->dev->dev.of_node = desc->boardinfo->of_node; ret =device_register (&desc->dev->dev); -if (ret) +if (ret) {dev_err (&master->dev,"Failed to add I3C device (err = %d)\n" , ret); +put_device (&desc->dev->dev); + } } }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 450/550 rtc: brcmstb-waketimer: support level alarm_irq
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Doug Berger <[email protected]>
[ Upstream commit e005a9b35b464be5b2e0194f717e90e7e496785d ]
Some devices (e.g. BCM72112) use an alarm_irq interrupt that is connected to a level interrupt controller rather than an edge interrupt controller. In this case, the interrupt cannot be left enabled by the irq handler while preserving the hardware wake-up signal on wake capable devices or an interrupt storm will occur.
The alarm_expired flag is introduced to allow the disabling of the interrupt when an alarm expires and to support balancing the calls to disable_irq() and enable_irq() in accordance with the existing design.
--- drivers/rtc/rtc-brcmstb-waketimer.c | 47 ++++++++++++++++++++++++++--- 1 file changed, 42 insertions(+), 5 deletions(-)
drivers/rtc/rtc-brcmstb-waketimer.c +42 -5
@@ -1,6 +1,6 @@// SPDX-License-Identifier: GPL-2.0-only /* -* Copyright © 2014-2017 Broadcom +* Copyright © 2014-2023 Broadcom */ #define pr_fmt (fmt) KBUILD_MODNAME ": " fmt
@@ -34,6 +34,7 @@ struct brcmstb_waketmr {u32 rate;unsigned long rtc_alarm;bool alarm_en; +bool alarm_expired; };#define BRCMSTB_WKTMR_EVENT 0x00
@@ -64,6 +65,11 @@ static inline void brcmstb_waketmr_clear_alarm(struct brcmstb_waketmr *timer)writel_relaxed (reg -1 , timer->base +BRCMSTB_WKTMR_ALARM );writel_relaxed (WKTMR_ALARM_EVENT , timer->base +BRCMSTB_WKTMR_EVENT ); (void )readl_relaxed (timer->base +BRCMSTB_WKTMR_EVENT ); +if (timer->alarm_expired) { + timer->alarm_expired = false; +/* maintain call balance */ +enable_irq (timer->alarm_irq); + } } static void brcmstb_waketmr_set_alarm(struct brcmstb_waketmr *timer,
@@ -105,10 +111,17 @@ static irqreturn_t brcmstb_alarm_irq(int irq, void *data)return IRQ_HANDLED ;if (timer->alarm_en) { -if (!device_may_wakeup (timer->dev)) +if (device_may_wakeup (timer->dev)) { +disable_irq_nosync (irq); + timer->alarm_expired = true; + }else {writel_relaxed (WKTMR_ALARM_EVENT , timer->base +BRCMSTB_WKTMR_EVENT ); + }rtc_update_irq (timer->rtc,1 ,RTC_IRQF |RTC_AF ); + }else { +writel_relaxed (WKTMR_ALARM_EVENT , + timer->base +BRCMSTB_WKTMR_EVENT ); }return IRQ_HANDLED ;
@@ -221,8 +234,14 @@ static int brcmstb_waketmr_alarm_enable(struct device *dev, !brcmstb_waketmr_is_pending(timer))return -EINVAL ; timer->alarm_en = true; -if (timer->alarm_irq) +if (timer->alarm_irq) { +if (timer->alarm_expired) { + timer->alarm_expired = false; +/* maintain call balance */ +enable_irq (timer->alarm_irq); + }enable_irq (timer->alarm_irq); + } }else if (!enabled && timer->alarm_en) {if (timer->alarm_irq)disable_irq (timer->alarm_irq);
@@ -352,6 +371,17 @@ static int brcmstb_waketmr_suspend(struct device *dev)return brcmstb_waketmr_prepare_suspend (timer); } +static int brcmstb_waketmr_suspend_noirq (struct device *dev) +{ +struct brcmstb_waketmr *timer =dev_get_drvdata (dev); + +/* Catch any alarms occurring prior to noirq */ +if (timer->alarm_expired &&device_may_wakeup (dev)) +return -EBUSY ; + +return 0 ; +} +static int brcmstb_waketmr_resume (struct device *dev) {struct brcmstb_waketmr *timer =dev_get_drvdata (dev);
@@ -368,10 +398,17 @@ static int brcmstb_waketmr_resume(struct device *dev)return ret; } +#else +#define brcmstb_waketmr_suspend NULL +#define brcmstb_waketmr_suspend_noirq NULL +#define brcmstb_waketmr_resume NULL#endif /* CONFIG_PM_SLEEP */ -static SIMPLE_DEV_PM_OPS(brcmstb_waketmr_pm_ops, - brcmstb_waketmr_suspend, brcmstb_waketmr_resume); +static const struct dev_pm_ops brcmstb_waketmr_pm_ops = { + .suspend = brcmstb_waketmr_suspend, + .suspend_noirq = brcmstb_waketmr_suspend_noirq, + .resume = brcmstb_waketmr_resume, +};static const __maybe_unused struct of_device_id brcmstb_waketmr_of_match[] = { { .compatible ="brcm,brcmstb-waketimer" },
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 451/550 cxl/pci: Remove unnecessary device reference management in sanitize work
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <[email protected]>
[ Upstream commit 76fe8713dd0a1331d84d767e8e5d3f365d959e8a ]
Given that any particular put_device() could be the final put of the device, the fact that there are usages of cxlds->dev after put_device(cxlds->dev) is a red flag. Drop the reference counting since the device is pinned by being registered and will not be unregistered without triggering the driver + workqueue to shutdown.
Stable-dep-of: 5f2da1971446 ("cxl/pci: Fix sanitize notifier setup")
--- drivers/cxl/pci.c | 5 ----- 1 file changed, 5 deletions(-)
drivers/cxl/pci.c +0 -5
@@ -152,8 +152,6 @@ static void cxl_mbox_sanitize_work(struct work_struct *work)mutex_lock (&mds->mbox_mutex);if (cxl_mbox_background_complete (cxlds)) { mds->security.poll_tmo_secs =0 ; -put_device (cxlds->dev); -if (mds->security.sanitize_node)sysfs_notify_dirent (mds->security.sanitize_node);
@@ -296,9 +294,6 @@ static int __cxl_pci_mbox_send_cmd(struct cxl_memdev_state *mds,*/ if (mbox_cmd->opcode ==CXL_MBOX_OP_SANITIZE ) {if (mds->security.poll) { -/* hold the device throughout */ -get_device (cxlds->dev); -/* give first timeout a second */ timeout =1 ; mds->security.poll_tmo_secs = timeout;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 452/550 cxl/pci: Cleanup sanitize to always poll
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <[email protected]>
[ Upstream commit e30a106558e7d1e06d1fcfd12466dc646673d03d ]
In preparation for fixing the init/teardown of the 'sanitize' workqueue and sysfs notification mechanism, arrange for cxl_mbox_sanitize_work() to be the single location where the sysfs attribute is notified. With that change there is no distinction between polled mode and interrupt mode. All the interrupt does is accelerate the polling interval.
The change to check for "mds->security.sanitize_node" under the lock is there to ensure that the interrupt, the work routine and the setup/teardown code can all have a consistent view of the registered notifier and the workqueue state. I.e. the expectation is that the interrupt is live past the point that the sanitize sysfs attribute is published, and it may race teardown, so it must be consulted under a lock. Given that new locking requirement, cxl_pci_mbox_irq() is moved from hard to thread irq context.
Lastly, some opportunistic replacements of "queue_delayed_work(system_wq, ...)", which is just open coded schedule_delayed_work(), are included.
Stable-dep-of: 5f2da1971446 ("cxl/pci: Fix sanitize notifier setup")
--- drivers/cxl/core/memdev.c | 3 +- drivers/cxl/cxlmem.h | 2 -- drivers/cxl/pci.c | 60 ++++++++++++++++----------------------- 3 files changed, 26 insertions(+), 39 deletions(-)
drivers/cxl/core/memdev.c +1 -2
@@ -561,8 +561,7 @@ static void cxl_memdev_security_shutdown(struct device *dev)struct cxl_memdev *cxlmd =to_cxl_memdev (dev);struct cxl_memdev_state *mds =to_cxl_memdev_state (cxlmd->cxlds); -if (mds->security.poll) -cancel_delayed_work_sync (&mds->security.poll_dwork); +cancel_delayed_work_sync (&mds->security.poll_dwork); }static void cxl_memdev_shutdown (struct device *dev)
drivers/cxl/cxlmem.h +0 -2
@@ -360,7 +360,6 @@ struct cxl_fw_state {* * @state: state of last security operation * @enabled_cmds: All security commands enabled in the CEL -* @poll: polling for sanitization is enabled, device has no mbox irq support * @poll_tmo_secs: polling timeout * @poll_dwork: polling work item * @sanitize_node: sanitation sysfs file to notify
@@ -368,7 +367,6 @@ struct cxl_fw_state {struct cxl_security_state {unsigned long state; DECLARE_BITMAP(enabled_cmds, CXL_SEC_ENABLED_MAX); -bool poll;int poll_tmo_secs;struct delayed_work poll_dwork;struct kernfs_node *sanitize_node;
drivers/cxl/pci.c +25 -35
98 lines not on this page · raw message
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 453/550 cxl/pci: Remove inconsistent usage of dev_err_probe()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <[email protected]>
[ Upstream commit 2627c995c15dc375f4b5a591d782a14b1c0e3e7d ]
If dev_err_probe() is to be used it should at least be used consistently within the same function. It is also worth questioning whether every potential -ENOMEM needs an explicit error message.
Remove the cxl_setup_fw_upload() error prints for what are rare / hardware-independent failures.
Stable-dep-of: 5f2da1971446 ("cxl/pci: Fix sanitize notifier setup")
--- drivers/cxl/core/memdev.c | 13 ++----------- 1 file changed, 2 insertions(+), 11 deletions(-)
drivers/cxl/core/memdev.c +2 -11
@@ -970,7 +970,6 @@ int cxl_memdev_setup_fw_upload(struct cxl_memdev_state *mds)struct cxl_dev_state *cxlds = &mds->cxlds;struct device *dev = &cxlds->cxlmd->dev;struct fw_upload *fwl; -int rc;if (!test_bit (CXL_MEM_COMMAND_ID_GET_FW_INFO , mds->enabled_cmds))return 0 ;
@@ -978,17 +977,9 @@ int cxl_memdev_setup_fw_upload(struct cxl_memdev_state *mds) fwl =firmware_upload_register (THIS_MODULE , dev,dev_name (dev), &cxl_memdev_fw_ops, mds);if (IS_ERR (fwl)) -return dev_err_probe (dev,PTR_ERR (fwl), -"Failed to register firmware loader\n" ); - - rc =devm_add_action_or_reset (cxlds->dev, devm_cxl_remove_fw_upload, - fwl); -if (rc) -dev_err (dev, -"Failed to add firmware loader remove action: %d\n" , - rc); +return PTR_ERR (fwl); -return rc; +return devm_add_action_or_reset (cxlds->dev, devm_cxl_remove_fw_upload, fwl); }EXPORT_SYMBOL_NS_GPL (cxl_memdev_setup_fw_upload,CXL );
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 454/550 cxl/pci: Clarify devm host for memdev relative setup
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <[email protected]>
[ Upstream commit f29a824b0b6710328a78b018de3c2cfa9db65876 ]
It is all too easy to get confused about @dev usage in the CXL driver stack. Before adding a new cxl_pci_probe() setup operation that has a devm lifetime dependent on @cxlds->dev binding, but also references @cxlmd->dev, and prints messages, rework the devm_cxl_add_memdev() and cxl_memdev_setup_fw_upload() function signatures to make this distinction explicit. I.e. pass in the devm context as an @host argument rather than infer it from other objects.
This is in preparation for adding a devm_cxl_sanitize_setup_notifier().
Note the whitespace fixup near the change of the devm_cxl_add_memdev() signature. That uncaught typo originated in the patch that added cxl_memdev_security_init().
Stable-dep-of: 5f2da1971446 ("cxl/pci: Fix sanitize notifier setup")
--- drivers/cxl/core/memdev.c | 16 ++++++++-------- drivers/cxl/cxlmem.h | 5 +++-- drivers/cxl/pci.c | 4 ++-- tools/testing/cxl/test/mem.c | 4 ++-- 4 files changed, 15 insertions(+), 14 deletions(-)
drivers/cxl/core/memdev.c +8 -8
@@ -960,12 +960,12 @@ static const struct fw_upload_ops cxl_memdev_fw_ops = { .cleanup = cxl_fw_cleanup, }; -static void devm_cxl_remove_fw_upload (void *fwl) +static void cxl_remove_fw_upload (void *fwl) {firmware_upload_unregister (fwl); } -int cxl_memdev_setup_fw_upload (struct cxl_memdev_state *mds) +int devm_cxl_setup_fw_upload (struct device *host,struct cxl_memdev_state *mds) {struct cxl_dev_state *cxlds = &mds->cxlds;struct device *dev = &cxlds->cxlmd->dev;
@@ -978,10 +978,9 @@ int cxl_memdev_setup_fw_upload(struct cxl_memdev_state *mds) &cxl_memdev_fw_ops, mds);if (IS_ERR (fwl))return PTR_ERR (fwl); - -return devm_add_action_or_reset (cxlds->dev, devm_cxl_remove_fw_upload, fwl); +return devm_add_action_or_reset (host, cxl_remove_fw_upload, fwl); } -EXPORT_SYMBOL_NS_GPL (cxl_memdev_setup_fw_upload,CXL ); +EXPORT_SYMBOL_NS_GPL (devm_cxl_setup_fw_upload,CXL );static const struct file_operations cxl_memdev_fops = { .owner =THIS_MODULE ,
@@ -1019,9 +1018,10 @@ static int cxl_memdev_security_init(struct cxl_memdev *cxlmd) }return devm_add_action_or_reset (cxlds->dev, put_sanitize, mds); - } +} -struct cxl_memdev *devm_cxl_add_memdev (struct cxl_dev_state *cxlds) +struct cxl_memdev *devm_cxl_add_memdev (struct device *host, +struct cxl_dev_state *cxlds) {struct cxl_memdev *cxlmd;struct device *dev;
@@ -1053,7 +1053,7 @@ struct cxl_memdev *devm_cxl_add_memdev(struct cxl_dev_state *cxlds)if (rc) goto err; - rc =devm_add_action_or_reset (cxlds->dev, cxl_memdev_unregister, cxlmd); + rc =devm_add_action_or_reset (host, cxl_memdev_unregister, cxlmd);if (rc)return ERR_PTR (rc);return cxlmd;
drivers/cxl/cxlmem.h +3 -2
@@ -84,9 +84,10 @@ static inline bool is_cxl_endpoint(struct cxl_port *port)return is_cxl_memdev (port->uport_dev); } -struct cxl_memdev *devm_cxl_add_memdev (struct cxl_dev_state *cxlds); +struct cxl_memdev *devm_cxl_add_memdev (struct device *host, +struct cxl_dev_state *cxlds);struct cxl_memdev_state ; -int cxl_memdev_setup_fw_upload (struct cxl_memdev_state *mds); +int devm_cxl_setup_fw_upload (struct device *host,struct cxl_memdev_state *mds);int devm_cxl_dpa_reserve (struct cxl_endpoint_decoder *cxled,resource_size_t base,resource_size_t len,resource_size_t skipped);
drivers/cxl/pci.c +2 -2
@@ -868,11 +868,11 @@ static int cxl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)if (rc)return rc; - cxlmd =devm_cxl_add_memdev (cxlds); + cxlmd =devm_cxl_add_memdev (&pdev->dev, cxlds);if (IS_ERR (cxlmd))return PTR_ERR (cxlmd); - rc =cxl_memdev_setup_fw_upload (mds); + rc =devm_cxl_setup_fw_upload (&pdev->dev, mds);if (rc)return rc;
tools/testing/cxl/test/mem.c +2 -2
@@ -1450,11 +1450,11 @@ static int cxl_mock_mem_probe(struct platform_device *pdev) mdata->mes.mds = mds;cxl_mock_add_event_logs (&mdata->mes); - cxlmd =devm_cxl_add_memdev (cxlds); + cxlmd =devm_cxl_add_memdev (&pdev->dev, cxlds);if (IS_ERR (cxlmd))return PTR_ERR (cxlmd); - rc =cxl_memdev_setup_fw_upload (mds); + rc =devm_cxl_setup_fw_upload (&pdev->dev, mds);if (rc)return rc;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 455/550 cxl/pci: Fix sanitize notifier setup
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <[email protected]>
[ Upstream commit 5f2da19714465739da2449253b13ac06cb353a26 ]
Fix a race condition between the mailbox-background command interrupt firing and the security-state sysfs attribute being removed.
The race is difficult to see due to the awkward placement of the sanitize-notifier setup code and the multiple places the teardown calls are made, cxl_memdev_security_init() and cxl_memdev_security_shutdown().
Unify setup in one place, cxl_sanitize_setup_notifier(). Arrange for the paired cxl_sanitize_teardown_notifier() to safely quiet the notifier and let the cxl_memdev + irq be unregistered later in the flow.
Note: The special wrinkle of the sanitize notifier is that it interacts with interrupts, which are enabled early in the flow, and it interacts with memdev sysfs which is not initialized until late in the flow. Hence why this setup routine takes an @cxlmd argument, and not just @mds.
This fix is also needed as a preparation fix for a memdev unregistration crash.
--- drivers/cxl/core/memdev.c | 86 ++++++++++++++++++++------------------- drivers/cxl/cxlmem.h | 2 + drivers/cxl/pci.c | 4 ++ 3 files changed, 50 insertions(+), 42 deletions(-)
drivers/cxl/core/memdev.c +44 -42
@@ -556,20 +556,11 @@ void clear_exclusive_cxl_commands(struct cxl_memdev_state *mds, }EXPORT_SYMBOL_NS_GPL (clear_exclusive_cxl_commands,CXL ); -static void cxl_memdev_security_shutdown (struct device *dev) -{ -struct cxl_memdev *cxlmd =to_cxl_memdev (dev); -struct cxl_memdev_state *mds =to_cxl_memdev_state (cxlmd->cxlds); - -cancel_delayed_work_sync (&mds->security.poll_dwork); -} -static void cxl_memdev_shutdown (struct device *dev) {struct cxl_memdev *cxlmd =to_cxl_memdev (dev);down_write (&cxl_memdev_rwsem); -cxl_memdev_security_shutdown (dev); cxlmd->cxlds =NULL ;up_write (&cxl_memdev_rwsem); }
@@ -991,35 +982,6 @@ static const struct file_operations cxl_memdev_fops = { .llseek = noop_llseek, }; -static void put_sanitize (void *data) -{ -struct cxl_memdev_state *mds = data; - -sysfs_put (mds->security.sanitize_node); -} - -static int cxl_memdev_security_init (struct cxl_memdev *cxlmd) -{ -struct cxl_dev_state *cxlds = cxlmd->cxlds; -struct cxl_memdev_state *mds =to_cxl_memdev_state (cxlds); -struct device *dev = &cxlmd->dev; -struct kernfs_node *sec; - - sec =sysfs_get_dirent (dev->kobj.sd,"security" ); -if (!sec) { -dev_err (dev,"sysfs_get_dirent 'security' failed\n" ); -return -ENODEV ; - } - mds->security.sanitize_node =sysfs_get_dirent (sec,"state" ); -sysfs_put (sec); -if (!mds->security.sanitize_node) { -dev_err (dev,"sysfs_get_dirent 'state' failed\n" ); -return -ENODEV ; - } - -return devm_add_action_or_reset (cxlds->dev, put_sanitize, mds); -} -struct cxl_memdev *devm_cxl_add_memdev (struct device *host,struct cxl_dev_state *cxlds) {
@@ -1049,10 +1011,6 @@ struct cxl_memdev *devm_cxl_add_memdev(struct device *host,if (rc) goto err; - rc =cxl_memdev_security_init (cxlmd); -if (rc) - goto err; - rc =devm_add_action_or_reset (host, cxl_memdev_unregister, cxlmd);if (rc)return ERR_PTR (rc);
@@ -1069,6 +1027,50 @@ struct cxl_memdev *devm_cxl_add_memdev(struct device *host, }EXPORT_SYMBOL_NS_GPL (devm_cxl_add_memdev,CXL ); +static void sanitize_teardown_notifier (void *data) +{ +struct cxl_memdev_state *mds = data; +struct kernfs_node *state; + +/* +* Prevent new irq triggered invocations of the workqueue and +* flush inflight invocations. +*/ +mutex_lock (&mds->mbox_mutex); + state = mds->security.sanitize_node; + mds->security.sanitize_node =NULL ; +mutex_unlock (&mds->mbox_mutex); + +cancel_delayed_work_sync (&mds->security.poll_dwork); +sysfs_put (state); +} + +int devm_cxl_sanitize_setup_notifier (struct device *host, +struct cxl_memdev *cxlmd) +{ +struct cxl_dev_state *cxlds = cxlmd->cxlds; +struct cxl_memdev_state *mds =to_cxl_memdev_state (cxlds); +struct kernfs_node *sec; + +if (!test_bit (CXL_SEC_ENABLED_SANITIZE , mds->security.enabled_cmds)) +return 0 ; + +/* +* Note, the expectation is that @cxlmd would have failed to be +* created if these sysfs_get_dirent calls fail. +*/ + sec =sysfs_get_dirent (cxlmd->dev.kobj.sd,"security" ); +if (!sec) +return -ENOENT ; + mds->security.sanitize_node =sysfs_get_dirent (sec,"state" ); +sysfs_put (sec); +if (!mds->security.sanitize_node) +return -ENOENT ; + +return devm_add_action_or_reset (host, sanitize_teardown_notifier, mds); +} +EXPORT_SYMBOL_NS_GPL (devm_cxl_sanitize_setup_notifier,CXL ); +__init int cxl_memdev_init (void ) {dev_t devt;
drivers/cxl/cxlmem.h +2 -0
@@ -86,6 +86,8 @@ static inline bool is_cxl_endpoint(struct cxl_port *port)struct cxl_memdev *devm_cxl_add_memdev (struct device *host,struct cxl_dev_state *cxlds); +int devm_cxl_sanitize_setup_notifier (struct device *host, +struct cxl_memdev *cxlmd);struct cxl_memdev_state ;int devm_cxl_setup_fw_upload (struct device *host,struct cxl_memdev_state *mds); int devm_cxl_dpa_reserve(struct cxl_endpoint_decoder *cxled,
drivers/cxl/pci.c +4 -0
@@ -876,6 +876,10 @@ static int cxl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)if (rc)return rc; + rc =devm_cxl_sanitize_setup_notifier (&pdev->dev, cxlmd); +if (rc) +return rc; + pmu_count =cxl_count_regblock (pdev,CXL_REGLOC_RBI_PMU );for (i =0 ; i < pmu_count; i++) {struct cxl_pmu_regs pmu_regs;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 456/550 cxl/memdev: Fix sanitize vs decoder setup locking
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <[email protected]>
[ Upstream commit 339818380868e34ff2c482db05031bf47a67d609 ]
The sanitize operation is destructive and the expectation is that the device is unmapped while in progress. The current implementation does a lockless check for decoders being active, but then does nothing to prevent decoders from racing to be committed. Introduce state tracking to resolve this race.
This incidentally cleans up unpriveleged userspace from triggering mmio read cycles by spinning on reading the 'security/state' attribute. Which at a minimum is a waste since the kernel state machine can cache the completion result.
Lastly cxl_mem_sanitize() was mistakenly marked EXPORT_SYMBOL() in the original implementation, but an export was never required.
--- drivers/cxl/core/core.h | 1 + drivers/cxl/core/hdm.c | 19 ++++++++++++++ drivers/cxl/core/mbox.c | 55 ++++++++++++++++++++++++++++----------- drivers/cxl/core/memdev.c | 43 ++++++++++++------------------ drivers/cxl/core/port.c | 6 +++++ drivers/cxl/core/region.c | 6 ----- drivers/cxl/cxlmem.h | 4 ++- drivers/cxl/pci.c | 5 ++++ 8 files changed, 90 insertions(+), 49 deletions(-)
drivers/cxl/core/core.h +1 -0
@@ -75,6 +75,7 @@ resource_size_t __rcrb_to_component(struct device *dev, enum cxl_rcrb which);extern struct rw_semaphore cxl_dpa_rwsem; +extern struct rw_semaphore cxl_region_rwsem;int cxl_memdev_init (void );void cxl_memdev_exit (void );
drivers/cxl/core/hdm.c +19 -0
@@ -650,6 +650,25 @@ static int cxl_decoder_commit(struct cxl_decoder *cxld)return -EBUSY ; } +/* +* For endpoint decoders hosted on CXL memory devices that +* support the sanitize operation, make sure sanitize is not in-flight. +*/ +if (is_endpoint_decoder (&cxld->dev)) { +struct cxl_endpoint_decoder *cxled = +to_cxl_endpoint_decoder (&cxld->dev); +struct cxl_memdev *cxlmd =cxled_to_memdev (cxled); +struct cxl_memdev_state *mds = +to_cxl_memdev_state (cxlmd->cxlds); + +if (mds && mds->security.sanitize_active) { +dev_dbg (&cxlmd->dev, +"attempted to commit %s during sanitize\n" , +dev_name (&cxld->dev)); +return -EBUSY ; + } + } +down_read (&cxl_dpa_rwsem);/* common decoder settings */ ctrl =readl (hdm +CXL_HDM_DECODER0_CTRL_OFFSET (cxld->id));
drivers/cxl/core/mbox.c +40 -15
67 lines not on this page · raw message
drivers/cxl/core/memdev.c +16 -27
77 lines not on this page · raw message
drivers/cxl/core/port.c +6 -0
@@ -28,6 +28,12 @@* instantiated by the core. */ +/* +* All changes to the interleave configuration occur with this lock held +* for write. +*/ +DECLARE_RWSEM (cxl_region_rwsem); +static DEFINE_IDA (cxl_port_ida);static DEFINE_XARRAY (cxl_root_buses);
drivers/cxl/core/region.c +0 -6
@@ -28,12 +28,6 @@* 3. Decoder targets */ -/* -* All changes to the interleave configuration occur with this lock held -* for write. -*/ -static DECLARE_RWSEM (cxl_region_rwsem); -static struct cxl_region *to_cxl_region (struct device *dev); static ssize_t uuid_show(struct device *dev, struct device_attribute *attr,
drivers/cxl/cxlmem.h +3 -1
@@ -364,6 +364,7 @@ struct cxl_fw_state {* @state: state of last security operation * @enabled_cmds: All security commands enabled in the CEL * @poll_tmo_secs: polling timeout +* @sanitize_active: sanitize completion pending * @poll_dwork: polling work item * @sanitize_node: sanitation sysfs file to notify */
@@ -371,6 +372,7 @@ struct cxl_security_state {unsigned long state;DECLARE_BITMAP (enabled_cmds,CXL_SEC_ENABLED_MAX );int poll_tmo_secs; +bool sanitize_active;struct delayed_work poll_dwork;struct kernfs_node *sanitize_node; };
@@ -884,7 +886,7 @@ static inline void cxl_mem_active_dec(void) }#endif -int cxl_mem_sanitize (struct cxl_memdev_state *mds,u16 cmd); +int cxl_mem_sanitize (struct cxl_memdev *cxlmd,u16 cmd);struct cxl_hdm {struct cxl_component_regs regs;
drivers/cxl/pci.c +5 -0
@@ -154,6 +154,7 @@ static void cxl_mbox_sanitize_work(struct work_struct *work) mds->security.poll_tmo_secs =0 ;if (mds->security.sanitize_node)sysfs_notify_dirent (mds->security.sanitize_node); + mds->security.sanitize_active = false;dev_dbg (cxlds->dev,"Sanitization operation ended\n" ); }else {
@@ -292,9 +293,13 @@ static int __cxl_pci_mbox_send_cmd(struct cxl_memdev_state *mds,* and allow userspace to poll(2) for completion. */ if (mbox_cmd->opcode ==CXL_MBOX_OP_SANITIZE ) { +if (mds->security.sanitize_active) +return -EBUSY ; +/* give first timeout a second */ timeout =1 ; mds->security.poll_tmo_secs = timeout; + mds->security.sanitize_active = true;schedule_delayed_work (&mds->security.poll_dwork, timeout *HZ );dev_dbg (dev,"Sanitization operation started\n" );
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 457/550 cxl/mem: Fix shutdown order
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <[email protected]>
[ Upstream commit 88d3917f82ed4215a2154432c26de1480a61b209 ]
Ira reports that removing cxl_mock_mem causes a crash with the following trace:
BUG: kernel NULL pointer dereference, address: 0000000000000044 [..] RIP: 0010:cxl_region_decode_reset+0x7f/0x180 [cxl_core] [..] Call Trace: <TASK> cxl_region_detach+0xe8/0x210 [cxl_core] cxl_decoder_kill_region+0x27/0x40 [cxl_core] cxld_unregister+0x29/0x40 [cxl_core] devres_release_all+0xb8/0x110 device_unbind_cleanup+0xe/0x70 device_release_driver_internal+0x1d2/0x210 bus_remove_device+0xd7/0x150 device_del+0x155/0x3e0 device_unregister+0x13/0x60 devm_release_action+0x4d/0x90 ? __pfx_unregister_port+0x10/0x10 [cxl_core] delete_endpoint+0x121/0x130 [cxl_core] devres_release_all+0xb8/0x110 device_unbind_cleanup+0xe/0x70 device_release_driver_internal+0x1d2/0x210 bus_remove_device+0xd7/0x150 device_del+0x155/0x3e0 ? lock_release+0x142/0x290 cdev_device_del+0x15/0x50 cxl_memdev_unregister+0x54/0x70 [cxl_core]
This crash is due to the clearing out the cxl_memdev's driver context (@cxlds) before the subsystem is done with it. This is ultimately due to the region(s), that this memdev is a member, being torn down and expecting to be able to de-reference @cxlds, like here:
static int cxl_region_decode_reset(struct cxl_region *cxlr, int count)
...
if (cxlds->rcd)
goto endpoint_reset;...
Fix it by keeping the driver context valid until memdev-device unregistration, and subsequently the entire stack of related dependencies, unwinds.
--- drivers/cxl/core/memdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/cxl/core/memdev.c +1 -1
@@ -559,8 +559,8 @@ static void cxl_memdev_unregister(void *_cxlmd)struct cxl_memdev *cxlmd = _cxlmd;struct device *dev = &cxlmd->dev; -cxl_memdev_shutdown (dev);cdev_device_del (&cxlmd->cdev, dev); +cxl_memdev_shutdown (dev);put_device (dev); }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 458/550 virt: sevguest: Fix passing a stack buffer as a scatterlist target
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <[email protected]>
[ Upstream commit db10cb9b574675402bfd8fe1a31aafdd45b002df ]
CONFIG_DEBUG_SG highlights that get_{report,ext_report,derived_key)()} are passing stack buffers as the @req_buf argument to handle_guest_request(), generating a Call Trace of the following form:
WARNING: CPU: 0 PID: 1175 at include/linux/scatterlist.h:187 enc_dec_message+0x518/0x5b0 [sev_guest]
[..]
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
RIP: 0010:enc_dec_message+0x518/0x5b0 [sev_guest]
Call Trace:
<TASK>
[..]
handle_guest_request+0x135/0x520 [sev_guest]
get_ext_report+0x1ec/0x3e0 [sev_guest]
snp_guest_ioctl+0x157/0x200 [sev_guest]Note that the above Call Trace was with the DEBUG_SG BUG_ON()s converted to WARN_ON()s.
This is benign as long as there are no hardware crypto accelerators loaded for the aead cipher, and no subsequent dma_map_sg() is performed on the scatterlist. However, sev-guest can not assume the presence of an aead accelerator nor can it assume that CONFIG_DEBUG_SG is disabled.
Resolve this bug by allocating virt_addr_valid() memory, similar to the other buffers am @snp_dev instance carries, to marshal requests from user buffers to kernel buffers.
--- drivers/virt/coco/sev-guest/sev-guest.c | 45 ++++++++++++++----------- 1 file changed, 25 insertions(+), 20 deletions(-)
drivers/virt/coco/sev-guest/sev-guest.c +25 -20
@@ -57,6 +57,11 @@ struct snp_guest_dev {struct snp_secrets_page_layout *layout;struct snp_req_data input; +union { +struct snp_report_req report; +struct snp_derived_key_req derived_key; +struct snp_ext_report_req ext_report; + } req;u32 *os_area_msg_seqno;u8 *vmpck; };
@@ -473,8 +478,8 @@ static int handle_guest_request(struct snp_guest_dev *snp_dev, u64 exit_code,static int get_report (struct snp_guest_dev *snp_dev,struct snp_guest_request_ioctl *arg) {struct snp_guest_crypto *crypto = snp_dev->crypto; +struct snp_report_req *req = &snp_dev->req.report;struct snp_report_resp *resp; -struct snp_report_req req;int rc, resp_len;lockdep_assert_held (&snp_cmd_mutex);
@@ -482,7 +487,7 @@ static int get_report(struct snp_guest_dev *snp_dev, struct snp_guest_request_ioif (!arg->req_data || !arg->resp_data)return -EINVAL ; -if (copy_from_user (&req, (void __user *)arg->req_data,sizeof (req))) +if (copy_from_user (req, (void __user *)arg->req_data,sizeof (*req)))return -EFAULT ;/*
@@ -496,7 +501,7 @@ static int get_report(struct snp_guest_dev *snp_dev, struct snp_guest_request_ioreturn -ENOMEM ; rc =handle_guest_request (snp_dev,SVM_VMGEXIT_GUEST_REQUEST , arg, -SNP_MSG_REPORT_REQ , &req,sizeof (req), resp->data, +SNP_MSG_REPORT_REQ , req,sizeof (*req), resp->data, resp_len);if (rc) goto e_free;
@@ -511,9 +516,9 @@ static int get_report(struct snp_guest_dev *snp_dev, struct snp_guest_request_iostatic int get_derived_key (struct snp_guest_dev *snp_dev,struct snp_guest_request_ioctl *arg) { +struct snp_derived_key_req *req = &snp_dev->req.derived_key;struct snp_guest_crypto *crypto = snp_dev->crypto;struct snp_derived_key_resp resp = {0 }; -struct snp_derived_key_req req;int rc, resp_len;/* Response data is 64 bytes and max authsize for GCM is 16 bytes. */ u8 buf[64 +16 ];
@@ -532,11 +537,11 @@ static int get_derived_key(struct snp_guest_dev *snp_dev, struct snp_guest_requeif (sizeof (buf) < resp_len)return -ENOMEM ; -if (copy_from_user (&req, (void __user *)arg->req_data,sizeof (req))) +if (copy_from_user (req, (void __user *)arg->req_data,sizeof (*req)))return -EFAULT ; rc =handle_guest_request (snp_dev,SVM_VMGEXIT_GUEST_REQUEST , arg, -SNP_MSG_KEY_REQ , &req,sizeof (req), buf, resp_len); +SNP_MSG_KEY_REQ , req,sizeof (*req), buf, resp_len);if (rc)return rc;
@@ -552,8 +557,8 @@ static int get_derived_key(struct snp_guest_dev *snp_dev, struct snp_guest_requestatic int get_ext_report (struct snp_guest_dev *snp_dev,struct snp_guest_request_ioctl *arg) { +struct snp_ext_report_req *req = &snp_dev->req.ext_report;struct snp_guest_crypto *crypto = snp_dev->crypto; -struct snp_ext_report_req req;struct snp_report_resp *resp;int ret, npages =0 , resp_len;
@@ -562,18 +567,18 @@ static int get_ext_report(struct snp_guest_dev *snp_dev, struct snp_guest_requesif (!arg->req_data || !arg->resp_data)return -EINVAL ; -if (copy_from_user (&req, (void __user *)arg->req_data,sizeof (req))) +if (copy_from_user (req, (void __user *)arg->req_data,sizeof (*req)))return -EFAULT ;/* userspace does not want certificate data */ -if (!req.certs_len || !req.certs_address) +if (!req->certs_len || !req->certs_address) goto cmd; -if (req.certs_len >SEV_FW_BLOB_MAX_SIZE || - !IS_ALIGNED (req.certs_len,PAGE_SIZE )) +if (req->certs_len >SEV_FW_BLOB_MAX_SIZE || + !IS_ALIGNED (req->certs_len,PAGE_SIZE ))return -EINVAL ; -if (!access_ok ((const void __user *)req.certs_address, req.certs_len)) +if (!access_ok ((const void __user *)req->certs_address, req->certs_len))return -EFAULT ;/*
@@ -582,8 +587,8 @@ static int get_ext_report(struct snp_guest_dev *snp_dev, struct snp_guest_reques* the host. If host does not supply any certs in it, then copy * zeros to indicate that certificate data was not provided. */ -memset (snp_dev->certs_data,0 , req.certs_len); - npages = req.certs_len >>PAGE_SHIFT ; +memset (snp_dev->certs_data,0 , req->certs_len); + npages = req->certs_len >>PAGE_SHIFT ; cmd:/* * The intermediate response buffer is used while decrypting the
@@ -597,14 +602,14 @@ static int get_ext_report(struct snp_guest_dev *snp_dev, struct snp_guest_reques snp_dev->input.data_npages = npages; ret =handle_guest_request (snp_dev,SVM_VMGEXIT_EXT_GUEST_REQUEST , arg, -SNP_MSG_REPORT_REQ , &req.data, -sizeof (req.data), resp->data, resp_len); +SNP_MSG_REPORT_REQ , &req->data, +sizeof (req->data), resp->data, resp_len);/* If certs length is invalid then copy the returned length */ if (arg->vmm_error ==SNP_GUEST_VMM_ERR_INVALID_LEN ) { - req.certs_len = snp_dev->input.data_npages <<PAGE_SHIFT ; + req->certs_len = snp_dev->input.data_npages <<PAGE_SHIFT ; -if (copy_to_user ((void __user *)arg->req_data, &req,sizeof (req))) +if (copy_to_user ((void __user *)arg->req_data, req,sizeof (*req))) ret = -EFAULT ; }
@@ -612,8 +617,8 @@ static int get_ext_report(struct snp_guest_dev *snp_dev, struct snp_guest_reques goto e_free;if (npages && -copy_to_user ((void __user *)req.certs_address, snp_dev->certs_data, - req.certs_len)) { +copy_to_user ((void __user *)req->certs_address, snp_dev->certs_data, + req->certs_len)) { ret = -EFAULT ; goto e_free; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 459/550 rtc: pcf85363: Allow to wake up system without IRQ
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Looijmans <[email protected]>
[ Upstream commit 1e786b03705938870dafb629f2248f88d507a0ff ]
When wakeup-source is set in the devicetree, set up the device for using the output as interrupt instead of clock. This is similar to how other RTC devices handle this.
This allows the clock chip to turn on the board when wired to do so in hardware.
Stable-dep-of: 2be36c09b6b0 ("rtc: pcf85363: fix wrong mask/val parameters in regmap_update_bits call")
--- drivers/rtc/rtc-pcf85363.c | 30 +++++++++++++++++++++--------- 1 file changed, 21 insertions(+), 9 deletions(-)
drivers/rtc/rtc-pcf85363.c +21 -9
@@ -403,6 +403,7 @@ static int pcf85363_probe(struct i2c_client *client) }, };int ret, i, err; +bool wakeup_source;if (data) config = data;
@@ -432,25 +433,36 @@ static int pcf85363_probe(struct i2c_client *client) pcf85363->rtc->ops = &rtc_ops; pcf85363->rtc->range_min =RTC_TIMESTAMP_BEGIN_2000 ; pcf85363->rtc->range_max =RTC_TIMESTAMP_END_2099 ; -clear_bit (RTC_FEATURE_ALARM , pcf85363->rtc->features); + + wakeup_source =device_property_read_bool (&client->dev, +"wakeup-source" ); +if (client->irq >0 || wakeup_source) { +regmap_write (pcf85363->regmap,CTRL_FLAGS ,0 ); +regmap_update_bits (pcf85363->regmap,CTRL_PIN_IO , +PIN_IO_INTA_OUT ,PIN_IO_INTAPM ); + }if (client->irq >0 ) {unsigned long irqflags =IRQF_TRIGGER_LOW ;if (dev_fwnode (&client->dev)) irqflags =0 ; - -regmap_write (pcf85363->regmap,CTRL_FLAGS ,0 ); -regmap_update_bits (pcf85363->regmap,CTRL_PIN_IO , -PIN_IO_INTA_OUT ,PIN_IO_INTAPM ); ret =devm_request_threaded_irq (&client->dev, client->irq,NULL , pcf85363_rtc_handle_irq, irqflags |IRQF_ONESHOT ,"pcf85363" , client); -if (ret) -dev_warn (&client->dev,"unable to request IRQ, alarms disabled\n" ); -else -set_bit (RTC_FEATURE_ALARM , pcf85363->rtc->features); +if (ret) { +dev_warn (&client->dev, +"unable to request IRQ, alarms disabled\n" ); + client->irq =0 ; + } + } + +if (client->irq >0 || wakeup_source) { +device_init_wakeup (&client->dev, true); +set_bit (RTC_FEATURE_ALARM , pcf85363->rtc->features); + }else { +clear_bit (RTC_FEATURE_ALARM , pcf85363->rtc->features); } ret =devm_rtc_register_device (pcf85363->rtc);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 460/550 rtc: pcf85363: fix wrong mask/val parameters in regmap_update_bits call
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <[email protected]>
[ Upstream commit 2be36c09b6b07306be33519e1aa70d2e2a2161bb ]
The current implementation passes PIN_IO_INTA_OUT (2) as a mask and PIN_IO_INTAPM (GENMASK(1, 0)) as a value.
Swap the variables to assign mask and value the right way.
This error was first introduced with the alarm support. For better or worse it worked as expected because 0x02 was applied as a mask to 0x03, resulting 0x02 anyway. This will of course not work for any other value.
--- drivers/rtc/rtc-pcf85363.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/rtc/rtc-pcf85363.c +1 -1
@@ -439,7 +439,7 @@ static int pcf85363_probe(struct i2c_client *client)if (client->irq >0 || wakeup_source) {regmap_write (pcf85363->regmap,CTRL_FLAGS ,0 );regmap_update_bits (pcf85363->regmap,CTRL_PIN_IO , -PIN_IO_INTA_OUT ,PIN_IO_INTAPM ); +PIN_IO_INTAPM ,PIN_IO_INTA_OUT ); }if (client->irq >0 ) {
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 461/550 cxl/region: Prepare the decoder match range helper for reuse
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alison Schofield <[email protected]>
[ Upstream commit 1110581412c7a223439bb3ecdcdd9f4432e08231 ]
match_decoder_by_range() and decoder_match_range() both determine if an HPA range matches a decoder. The first does it for root decoders and the second one operates on switch decoders.
Tidy these up with clear naming and make the switch helper more like the root decoder helper in style and functionality. Make it take the actual range, rather than an endpoint decoder from which it extracts the range. Require an exact match on switch decoders, because unlike a root decoder that maps an entire region, Linux only supports 1:1 mapping of switch to endpoint decoders. Note that root-decoders are a super-set of switch-decoders and the range they cover is a super-set of a region, hence the use of range_contains() for that case.
Aside from aesthetics and maintainability, this is in preparation for reuse.
Stable-dep-of: 0cf36a85c140 ("cxl/region: Use cxl_calc_interleave_pos() for auto-discovery")
--- drivers/cxl/core/region.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-)
drivers/cxl/core/region.c +11 -6
@@ -1482,16 +1482,20 @@ static struct cxl_port *next_port(struct cxl_port *port)return port->parent_dport->port; } -static int decoder_match_range (struct device *dev,void *data) +static int match_switch_decoder_by_range (struct device *dev,void *data) { -struct cxl_endpoint_decoder *cxled = data;struct cxl_switch_decoder *cxlsd; +struct range *r1, *r2 = data;if (!is_switch_decoder (dev))return 0 ; cxlsd =to_cxl_switch_decoder (dev); -return range_contains (&cxlsd->cxld.hpa_range, &cxled->cxld.hpa_range); + r1 = &cxlsd->cxld.hpa_range; + +if (is_root_decoder (dev)) +return range_contains (r1, r2); +return (r1->start == r2->start && r1->end == r2->end); } static void find_positions(const struct cxl_switch_decoder *cxlsd,
@@ -1560,7 +1564,8 @@ static int cmp_decode_pos(const void *a, const void *b) goto err; } - dev =device_find_child (&port->dev, cxled_a, decoder_match_range); + dev =device_find_child (&port->dev, &cxled_a->cxld.hpa_range, + match_switch_decoder_by_range);if (!dev) {struct range *range = &cxled_a->cxld.hpa_range;
@@ -2691,7 +2696,7 @@ static int devm_cxl_add_dax_region(struct cxl_region *cxlr)return rc; } -static int match_decoder_by_range (struct device *dev,void *data) +static int match_root_decoder_by_range (struct device *dev,void *data) {struct range *r1, *r2 = data;struct cxl_root_decoder *cxlrd;
@@ -2822,7 +2827,7 @@ int cxl_add_to_region(struct cxl_port *root, struct cxl_endpoint_decoder *cxled)int rc; cxlrd_dev =device_find_child (&root->dev, &cxld->hpa_range, - match_decoder_by_range); + match_root_decoder_by_range);if (!cxlrd_dev) { dev_err(cxlmd->dev.parent, "%s:%s no CXL window for range %#llx:%#llx\n",
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 462/550 cxl/region: Calculate a target position in a region interleave
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alison Schofield <[email protected]>
[ Upstream commit a3e00c964fb943934af916f48f0dd43b5110c866 ]
Introduce a calculation to find a target's position in a region interleave. Perform a self-test of the calculation on user-defined regions.
The region driver uses the kernel sort() function to put region targets in relative order. Positions are assigned based on each target's index in that sorted list. That relative sort doesn't consider the offset of a port into its parent port which causes some auto-discovered regions to fail creation. In one failure case, a 2 + 2 config (2 host bridges each with 2 endpoints), the sort puts all the targets of one port ahead of another port when they were expected to be interleaved.
In preparation for repairing the autodiscovery region assembly, introduce a new method for discovering a target position in the region interleave.
cxl_calc_interleave_pos() adds a method to find the target position by ascending from an endpoint to a root decoder. The calculation starts with the endpoint's local position and position in the parent port. It traverses towards the root decoder and examines both position and ways in order to allow the position to be refined all the way to the root decoder.
This calculation: position = position * parent_ways + parent_pos; applied iteratively yields the correct position.
Include a self-test that exercises this new position calculation against every successfully configured user-defined region.
Stable-dep-of: 0cf36a85c140 ("cxl/region: Use cxl_calc_interleave_pos() for auto-discovery")
--- drivers/cxl/core/region.c | 127 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 127 insertions(+)
drivers/cxl/core/region.c +127 -0
@@ -1498,6 +1498,113 @@ static int match_switch_decoder_by_range(struct device *dev, void *data)return (r1->start == r2->start && r1->end == r2->end); } +static int find_pos_and_ways (struct cxl_port *port,struct range *range, +int *pos,int *ways) +{ +struct cxl_switch_decoder *cxlsd; +struct cxl_port *parent; +struct device *dev; +int rc = -ENXIO ; + + parent =next_port (port); +if (!parent) +return rc; + + dev =device_find_child (&parent->dev, range, + match_switch_decoder_by_range); +if (!dev) { +dev_err (port->uport_dev, +"failed to find decoder mapping %#llx-%#llx\n" , + range->start, range->end); +return rc; + } + cxlsd =to_cxl_switch_decoder (dev); + *ways = cxlsd->cxld.interleave_ways; + +for (int i =0 ; i < *ways; i++) { +if (cxlsd->target[i] == port->parent_dport) { + *pos = i; + rc =0 ; +break ; + } + } +put_device (dev); + +return rc; +} + +/** +* cxl_calc_interleave_pos() - calculate an endpoint position in a region +* @cxled: endpoint decoder member of given region +* +* The endpoint position is calculated by traversing the topology from +* the endpoint to the root decoder and iteratively applying this +* calculation: +* +* position = position * parent_ways + parent_pos; +* +* ...where @position is inferred from switch and root decoder target lists. +* +* Return: position >= 0 on success +* -ENXIO on failure +*/ +static int cxl_calc_interleave_pos (struct cxl_endpoint_decoder *cxled) +{ +struct cxl_port *iter, *port =cxled_to_port (cxled); +struct cxl_memdev *cxlmd =cxled_to_memdev (cxled); +struct range *range = &cxled->cxld.hpa_range; +int parent_ways =0 , parent_pos =0 , pos =0 ; +int rc; + +/* +* Example: the expected interleave order of the 4-way region shown +* below is: mem0, mem2, mem1, mem3 +* +* root_port +* / \ +* host_bridge_0 host_bridge_1 +* | | | | +* mem0 mem1 mem2 mem3 +* +* In the example the calculator will iterate twice. The first iteration +* uses the mem position in the host-bridge and the ways of the host- +* bridge to generate the first, or local, position. The second +* iteration uses the host-bridge position in the root_port and the ways +* of the root_port to refine the position. +* +* A trace of the calculation per endpoint looks like this: +* mem0: pos = 0 * 2 + 0 mem2: pos = 0 * 2 + 0 +* pos = 0 * 2 + 0 pos = 0 * 2 + 1 +* pos: 0 pos: 1 +* +* mem1: pos = 0 * 2 + 1 mem3: pos = 0 * 2 + 1 +* pos = 1 * 2 + 0 pos = 1 * 2 + 1 +* pos: 2 pos = 3 +* +* Note that while this example is simple, the method applies to more +* complex topologies, including those with switches. +*/ + +/* Iterate from endpoint to root_port refining the position */ +for (iter = port; iter; iter =next_port (iter)) { +if (is_cxl_root (iter)) +break ; + + rc =find_pos_and_ways (iter, range, &parent_pos, &parent_ways); +if (rc) +return rc; + + pos = pos * parent_ways + parent_pos; + } + +dev_dbg (&cxlmd->dev, +"decoder:%s parent:%s port:%s range:%#llx-%#llx pos:%d\n" , +dev_name (&cxled->cxld.dev),dev_name (cxlmd->dev.parent), +dev_name (&port->dev), range->start, range->end, pos); + +return pos; +} + static void find_positions(const struct cxl_switch_decoder *cxlsd, const struct cxl_port *iter_a, const struct cxl_port *iter_b, int *a_pos,
@@ -1761,6 +1868,26 @@ static int cxl_region_attach(struct cxl_region *cxlr, .end = p->res->end, }; +if (p->nr_targets != p->interleave_ways) +return 0 ; + +/* +* Test the auto-discovery position calculator function +* against this successfully created user-defined region. +* A fail message here means that this interleave config +* will fail when presented as CXL_REGION_F_AUTO. +*/ +for (int i =0 ; i < p->nr_targets; i++) { +struct cxl_endpoint_decoder *cxled = p->targets[i]; +int test_pos; + + test_pos =cxl_calc_interleave_pos (cxled); +dev_dbg (&cxled->cxld.dev, +"Test cxl_calc_interleave_pos(): %s test_pos:%d cxled->pos:%d\n" , + (test_pos == cxled->pos) ?"success" :"fail" , + test_pos, cxled->pos); + } +return 0 ; err_decrement:
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 463/550 cxl/region: Use cxl_calc_interleave_pos() for auto-discovery
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alison Schofield <[email protected]>
[ Upstream commit 0cf36a85c1408f86a967fb1db721de1b89b9e675 ]
For auto-discovered regions the driver must assign each target to a valid position in the region interleave set based on the decoder topology.
The current implementation fails to parse valid decode topologies, as it does not consider the child offset into a parent port. The sort put all targets of one port ahead of another port when an interleave was expected, causing the region assembly to fail.
Replace the existing relative sort with cxl_calc_interleave_pos() that finds the exact position in a region interleave for an endpoint based on a walk up the ancestral tree from endpoint to root decoder.
cxl_calc_interleave_pos() was introduced in a prior patch, so the work here is to use it in cxl_region_sort_targets().
Remove the obsoleted helper functions from the prior sort.
Testing passes on pre-production hardware with BIOS defined regions that natively trigger this autodiscovery path of the region driver. Testing passes a CXL unit test using the dev_dbg() calculation test (see cxl_region_attach()) across an expanded set of region configs:
1, 1, 1+1, 1+1+1, 2, 2+2, 2+2+2, 2+2+2+2, 4, 4+4, where each number represents the count of endpoints per host bridge.
--- drivers/cxl/core/region.c | 127 +++++--------------------------------- 1 file changed, 15 insertions(+), 112 deletions(-)
drivers/cxl/core/region.c +15 -112
@@ -1475,6 +1475,14 @@ static int cxl_region_attach_auto(struct cxl_region *cxlr,return 0 ; } +static int cmp_interleave_pos (const void *a,const void *b) +{ +struct cxl_endpoint_decoder *cxled_a = *(typeof (cxled_a) *)a; +struct cxl_endpoint_decoder *cxled_b = *(typeof (cxled_b) *)b; + +return cxled_a->pos - cxled_b->pos; +} +static struct cxl_port *next_port (struct cxl_port *port) {if (!port->parent_dport)
@@ -1605,131 +1613,26 @@ static int cxl_calc_interleave_pos(struct cxl_endpoint_decoder *cxled)return pos; } -static void find_positions (const struct cxl_switch_decoder *cxlsd, -const struct cxl_port *iter_a, -const struct cxl_port *iter_b,int *a_pos, -int *b_pos) -{ -int i; - -for (i =0 , *a_pos =-1 , *b_pos =-1 ; i < cxlsd->nr_targets; i++) { -if (cxlsd->target[i] == iter_a->parent_dport) - *a_pos = i; -else if (cxlsd->target[i] == iter_b->parent_dport) - *b_pos = i; -if (*a_pos >=0 && *b_pos >=0 ) -break ; - } -} - -static int cmp_decode_pos (const void *a,const void *b) -{ -struct cxl_endpoint_decoder *cxled_a = *(typeof (cxled_a) *)a; -struct cxl_endpoint_decoder *cxled_b = *(typeof (cxled_b) *)b; -struct cxl_memdev *cxlmd_a =cxled_to_memdev (cxled_a); -struct cxl_memdev *cxlmd_b =cxled_to_memdev (cxled_b); -struct cxl_port *port_a =cxled_to_port (cxled_a); -struct cxl_port *port_b =cxled_to_port (cxled_b); -struct cxl_port *iter_a, *iter_b, *port =NULL ; -struct cxl_switch_decoder *cxlsd; -struct device *dev; -int a_pos, b_pos; -unsigned int seq; - -/* Exit early if any prior sorting failed */ -if (cxled_a->pos <0 || cxled_b->pos <0 ) -return 0 ; - -/* -* Walk up the hierarchy to find a shared port, find the decoder that -* maps the range, compare the relative position of those dport -* mappings. -*/ -for (iter_a = port_a; iter_a; iter_a =next_port (iter_a)) { -struct cxl_port *next_a, *next_b; - - next_a =next_port (iter_a); -if (!next_a) -break ; - -for (iter_b = port_b; iter_b; iter_b =next_port (iter_b)) { - next_b =next_port (iter_b); -if (next_a != next_b) -continue ; - port = next_a; -break ; - } - -if (port) -break ; - } - -if (!port) { -dev_err (cxlmd_a->dev.parent, -"failed to find shared port with %s\n" , -dev_name (cxlmd_b->dev.parent)); - goto err; - } - - dev =device_find_child (&port->dev, &cxled_a->cxld.hpa_range, - match_switch_decoder_by_range); -if (!dev) { -struct range *range = &cxled_a->cxld.hpa_range; - -dev_err (port->uport_dev, -"failed to find decoder that maps %#llx-%#llx\n" , - range->start, range->end); - goto err; - } - - cxlsd =to_cxl_switch_decoder (dev); -do { - seq =read_seqbegin (&cxlsd->target_lock); -find_positions (cxlsd, iter_a, iter_b, &a_pos, &b_pos); - }while (read_seqretry (&cxlsd->target_lock, seq)); - -put_device (dev); - -if (a_pos <0 || b_pos <0 ) { -dev_err (port->uport_dev, -"failed to find shared decoder for %s and %s\n" , -dev_name (cxlmd_a->dev.parent), -dev_name (cxlmd_b->dev.parent)); - goto err; - } - -dev_dbg (port->uport_dev,"%s comes %s %s\n" , -dev_name (cxlmd_a->dev.parent), - a_pos - b_pos <0 ?"before" :"after" , -dev_name (cxlmd_b->dev.parent)); - -return a_pos - b_pos; -err: - cxled_a->pos =-1 ; -return 0 ; -} -static int cxl_region_sort_targets (struct cxl_region *cxlr) {struct cxl_region_params *p = &cxlr->params;int i, rc =0 ; -sort (p->targets, p->nr_targets,sizeof (p->targets[0 ]), cmp_decode_pos, -NULL ); -for (i =0 ; i < p->nr_targets; i++) {struct cxl_endpoint_decoder *cxled = p->targets[i]; + cxled->pos =cxl_calc_interleave_pos (cxled);/* -* Record that sorting failed, but still continue to restore -* cxled->pos with its ->targets[] position so that follow-on -* code paths can reliably do p->targets[cxled->pos] to -* self-reference their entry. +* Record that sorting failed, but still continue to calc +* cxled->pos so that follow-on code paths can reliably +* do p->targets[cxled->pos] to self-reference their entry. */ if (cxled->pos <0 ) rc = -ENXIO ; - cxled->pos = i; } +/* Keep the cxlr target list in interleave position order */ +sort (p->targets, p->nr_targets,sizeof (p->targets[0 ]), + cmp_interleave_pos,NULL );dev_dbg (&cxlr->dev,"region sort %s\n" , rc ?"failed" :"successful" );return rc;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 464/550 cxl/region: Fix cxl_region_rwsem lock held when returning to user space
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Zhijian <[email protected]>
[ Upstream commit 3531b27f1f04a6bc9c95cf00d40efe618d57aa93 ]
Fix a missed "goto out" to unlock on error to cleanup this splat:
WARNING: lock held when returning to user space!
6.6.0-rc3-lizhijian+ #213 Not tainted
------------------------------------------------
cxl/673 is leaving the kernel with locks still held!
1 lock held by cxl/673:
#0: ffffffffa013b9d0 (cxl_region_rwsem){++++}-{3:3}, at: commit_store+0x7d/0x3e0 [cxl_core]In terms of user visible impact of this bug for backports:
cxl_region_invalidate_memregion() on x86 invokes wbinvd which is a problematic instruction for virtualized environments. So, on virtualized x86, cxl_region_invalidate_memregion() returns an error. This failure case got missed because CXL memory-expander device passthrough is not a production use case, and emulation of CXL devices is typically limited to kernel development builds with CONFIG_CXL_REGION_INVALIDATION_TEST=y, that makes cxl_region_invalidate_memregion() succeed.
In other words, the expected exposure of this bug is limited to CXL subsystem development environments using QEMU that neglected CONFIG_CXL_REGION_INVALIDATION_TEST=y.
--- drivers/cxl/core/region.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/cxl/core/region.c +1 -1
@@ -288,7 +288,7 @@ static ssize_t commit_store(struct device *dev, struct device_attribute *attr,*/ rc =cxl_region_invalidate_memregion (cxlr);if (rc) -return rc; + goto out;if (commit) { rc =cxl_region_decode_commit (cxlr);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 465/550 cxl/core/regs: Rename @dev to @host in struct cxl_register_map
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robert Richter <[email protected]>
[ Upstream commit dd22581f89537163f065e8ef7c125ce0fddf62cc ]
The primary role of @dev is to host the mappings for devm operations. @dev is too ambiguous as a name. I.e. when does @dev refer to the 'struct device *' instance that the registers belong, and when does @dev refer to the 'struct device *' instance hosting the mapping for devm operations?
Clarify the role of @dev in cxl_register_map by renaming it to @host. Also, rename local variables to 'host' where map->host is used.
Stable-dep-of: 33d9c987bf8f ("cxl/port: Fix @host confusion in cxl_dport_setup_regs()")
--- drivers/cxl/core/hdm.c | 2 +- drivers/cxl/core/port.c | 4 ++-- drivers/cxl/core/regs.c | 28 ++++++++++++++-------------- drivers/cxl/cxl.h | 4 ++-- drivers/cxl/pci.c | 2 +- 5 files changed, 20 insertions(+), 20 deletions(-)
drivers/cxl/core/hdm.c +1 -1
@@ -85,7 +85,7 @@ static int map_hdm_decoder_regs(struct cxl_port *port, void __iomem *crb, struct cxl_component_regs *regs) {struct cxl_register_map map = { - .dev = &port->dev, + .host = &port->dev, .resource = port->component_reg_phys, .base = crb, .max_size =CXL_COMPONENT_REG_BLOCK_SIZE ,
drivers/cxl/core/port.c +2 -2
@@ -697,14 +697,14 @@ static struct cxl_port *cxl_port_alloc(struct device *uport_dev,return ERR_PTR (rc); } -static int cxl_setup_comp_regs (struct device *dev,struct cxl_register_map *map, +static int cxl_setup_comp_regs (struct device *host,struct cxl_register_map *map,resource_size_t component_reg_phys) {if (component_reg_phys ==CXL_RESOURCE_NONE )return 0 ; *map = (struct cxl_register_map ) { - .dev = dev, + .host = host, .reg_type =CXL_REGLOC_RBI_COMPONENT , .resource = component_reg_phys, .max_size =CXL_COMPONENT_REG_BLOCK_SIZE ,
drivers/cxl/core/regs.c +14 -14
@@ -204,7 +204,7 @@ int cxl_map_component_regs(const struct cxl_register_map *map, struct cxl_component_regs *regs, unsigned long map_mask) { -struct device *dev = map->dev; +struct device *host = map->host;struct mapinfo {const struct cxl_reg_map *rmap;void __iomem **addr;
@@ -225,7 +225,7 @@ int cxl_map_component_regs(const struct cxl_register_map *map,continue ; phys_addr = map->resource + mi->rmap->offset; length = mi->rmap->size; - *(mi->addr) =devm_cxl_iomap_block (dev, phys_addr, length); + *(mi->addr) =devm_cxl_iomap_block (host, phys_addr, length);if (!*(mi->addr))return -ENOMEM ; }
@@ -237,7 +237,7 @@ EXPORT_SYMBOL_NS_GPL(cxl_map_component_regs, CXL);int cxl_map_device_regs (const struct cxl_register_map *map,struct cxl_device_regs *regs) { -struct device *dev = map->dev; +struct device *host = map->host;resource_size_t phys_addr = map->resource;struct mapinfo {const struct cxl_reg_map *rmap;
@@ -259,7 +259,7 @@ int cxl_map_device_regs(const struct cxl_register_map *map, addr = phys_addr + mi->rmap->offset; length = mi->rmap->size; - *(mi->addr) =devm_cxl_iomap_block (dev, addr, length); + *(mi->addr) =devm_cxl_iomap_block (host, addr, length);if (!*(mi->addr))return -ENOMEM ; }
@@ -309,7 +309,7 @@ int cxl_find_regblock_instance(struct pci_dev *pdev, enum cxl_regloc_type type,int regloc, i; *map = (struct cxl_register_map ) { - .dev = &pdev->dev, + .host = &pdev->dev, .resource =CXL_RESOURCE_NONE , };
@@ -403,15 +403,15 @@ EXPORT_SYMBOL_NS_GPL(cxl_map_pmu_regs, CXL);static int cxl_map_regblock (struct cxl_register_map *map) { -struct device *dev = map->dev; +struct device *host = map->host; map->base =ioremap (map->resource, map->max_size);if (!map->base) { -dev_err (dev,"failed to map registers\n" ); +dev_err (host,"failed to map registers\n" );return -ENOMEM ; } -dev_dbg (dev,"Mapped CXL Memory Device resource %pa\n" , &map->resource); +dev_dbg (host,"Mapped CXL Memory Device resource %pa\n" , &map->resource);return 0 ; }
@@ -425,28 +425,28 @@ static int cxl_probe_regs(struct cxl_register_map *map) {struct cxl_component_reg_map *comp_map;struct cxl_device_reg_map *dev_map; -struct device *dev = map->dev; +struct device *host = map->host;void __iomem *base = map->base;switch (map->reg_type) {case CXL_REGLOC_RBI_COMPONENT : comp_map = &map->component_map; -cxl_probe_component_regs (dev, base, comp_map); -dev_dbg (dev,"Set up component registers\n" ); +cxl_probe_component_regs (host, base, comp_map); +dev_dbg (host,"Set up component registers\n" );break ;case CXL_REGLOC_RBI_MEMDEV : dev_map = &map->device_map; -cxl_probe_device_regs (dev, base, dev_map); +cxl_probe_device_regs (host, base, dev_map);if (!dev_map->status.valid || !dev_map->mbox.valid || !dev_map->memdev.valid) { -dev_err (dev,"registers not found: %s%s%s\n" , +dev_err (host,"registers not found: %s%s%s\n" , !dev_map->status.valid ?"status " :"" , !dev_map->mbox.valid ?"mbox " :"" , !dev_map->memdev.valid ?"memdev " :"" );return -ENXIO ; } -dev_dbg (dev,"Probing device registers...\n" ); +dev_dbg (host,"Probing device registers...\n" );break ;default :break ;
drivers/cxl/cxl.h +2 -2
@@ -247,7 +247,7 @@ struct cxl_pmu_reg_map {/** * struct cxl_register_map - DVSEC harvested register block mapping parameters -* @dev: device for devm operations and logging +* @host: device for devm operations and logging * @base: virtual base of the register-block-BAR + @block_offset * @resource: physical resource base of the register block * @max_size: maximum mapping size to perform register search
@@ -257,7 +257,7 @@ struct cxl_pmu_reg_map {* @pmu_map: cxl_reg_maps for CXL Performance Monitoring Units */ struct cxl_register_map { -struct device *dev; +struct device *host;void __iomem *base;resource_size_t resource;resource_size_t max_size;
drivers/cxl/pci.c +1 -1
@@ -474,7 +474,7 @@ static int cxl_rcrb_get_comp_regs(struct pci_dev *pdev,resource_size_t component_reg_phys; *map = (struct cxl_register_map ) { - .dev = &pdev->dev, + .host = &pdev->dev, .resource =CXL_RESOURCE_NONE , };
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 466/550 cxl/port: Fix @host confusion in cxl_dport_setup_regs()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <[email protected]>
[ Upstream commit 33d9c987bf8fb68a9292aba7cc4b1711fcb1be4d ]
commit 5d2ffbe4b81a ("cxl/port: Store the downstream port's Component Register mappings in struct cxl_dport")
...moved the dport component registers from a raw component_reg_phys passed in at dport instantiation time to a 'struct cxl_register_map' populated with both the component register data *and* the "host" device for mapping operations.
While typical CXL switch dports are mapped by their associated 'struct cxl_port', an RCH host bridge dport registered by cxl_acpi needs to wait until the cxl_mem driver makes the attachment to map the registers. This is because there are no intervening 'struct cxl_port' instances between the root cxl_port and the endpoint port in an RCH topology.
For now just mark the host as NULL in the RCH dport case until code that needs to map the dport registers arrives.
This patch is not flagged for -stable since nothing in the current driver uses the dport->comp_map.
Now, I am slightly uneasy that cxl_setup_comp_regs() sets map->host to a wrong value and then cxl_dport_setup_regs() fixes it up, but the alternatives I came up with are more messy. For example, adding an @logdev to 'struct cxl_register_map' that the dev_printk()s can fall back to when @host is NULL. I settled on "post-fixup+comment" since it is only RCH dports that have this special case where register probing is split between a host-bridge RCRB lookup and when cxl_mem_probe() does the association of the cxl_memdev and endpoint port.
[moved rename of @comp_map to @reg_map into next patch]
--- drivers/cxl/core/port.c | 43 +++++++++++++++++++++++++++++------------ 1 file changed, 31 insertions(+), 12 deletions(-)
drivers/cxl/core/port.c +31 -12
@@ -722,13 +722,23 @@ static int cxl_port_setup_regs(struct cxl_port *port, component_reg_phys); } -static int cxl_dport_setup_regs (struct cxl_dport *dport, +static int cxl_dport_setup_regs (struct device *host,struct cxl_dport *dport,resource_size_t component_reg_phys) { +int rc; +if (dev_is_platform (dport->dport_dev))return 0 ; -return cxl_setup_comp_regs (dport->dport_dev, &dport->comp_map, - component_reg_phys); + +/* +* use @dport->dport_dev for the context for error messages during +* register probing, and fixup @host after the fact, since @host may be +* NULL. +*/ + rc =cxl_setup_comp_regs (dport->dport_dev, &dport->comp_map, + component_reg_phys); + dport->comp_map.host = host; +return rc; } static struct cxl_port *__devm_cxl_add_port(struct device *host,
@@ -989,7 +999,16 @@ __devm_cxl_add_dport(struct cxl_port *port, struct device *dport_dev,if (!dport)return ERR_PTR (-ENOMEM ); -if (rcrb !=CXL_RESOURCE_NONE ) { + dport->dport_dev = dport_dev; + dport->port_id = port_id; + dport->port = port; + +if (rcrb ==CXL_RESOURCE_NONE ) { + rc =cxl_dport_setup_regs (&port->dev, dport, + component_reg_phys); +if (rc) +return ERR_PTR (rc); + }else { dport->rcrb.base = rcrb; component_reg_phys =__rcrb_to_component (dport_dev, &dport->rcrb,CXL_RCRB_DOWNSTREAM );
@@ -998,6 +1017,14 @@ __devm_cxl_add_dport(struct cxl_port *port, struct device *dport_dev,return ERR_PTR (-ENXIO ); } +/* +* RCH @dport is not ready to map until associated with its +* memdev +*/ + rc =cxl_dport_setup_regs (NULL , dport, component_reg_phys); +if (rc) +return ERR_PTR (rc); + dport->rch = true; }
@@ -1005,14 +1032,6 @@ __devm_cxl_add_dport(struct cxl_port *port, struct device *dport_dev,dev_dbg (dport_dev,"Component Registers found for dport: %pa\n" , &component_reg_phys); - dport->dport_dev = dport_dev; - dport->port_id = port_id; - dport->port = port; - - rc =cxl_dport_setup_regs (dport, component_reg_phys); -if (rc) -return ERR_PTR (rc); -cond_cxl_root_lock (port); rc =add_dport (port, dport);cond_cxl_root_unlock (port);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 467/550 cxl/hdm: Remove broken error path
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <[email protected]>
[ Upstream commit 5d09c63f11f083707b60c8ea0bb420651c47740f ]
Dan reports that cxl_decoder_commit() potentially leaks a hold of cxl_dpa_rwsem. The potential error case is a "should not" happen scenario, turn it into a "can not" happen scenario by adding the error check to cxl_port_setup_targets() where other setting validation occurs.
--- drivers/cxl/core/hdm.c | 19 ++----------------- drivers/cxl/core/region.c | 8 ++++++++ 2 files changed, 10 insertions(+), 17 deletions(-)
drivers/cxl/core/hdm.c +2 -17
@@ -575,17 +575,11 @@ static void cxld_set_type(struct cxl_decoder *cxld, u32 *ctrl) CXL_HDM_DECODER0_CTRL_HOSTONLY); } -static int cxlsd_set_targets (struct cxl_switch_decoder *cxlsd,u64 *tgt) +static void cxlsd_set_targets (struct cxl_switch_decoder *cxlsd,u64 *tgt) {struct cxl_dport **t = &cxlsd->target[0 ];int ways = cxlsd->cxld.interleave_ways; -if (dev_WARN_ONCE (&cxlsd->cxld.dev, - ways >8 || ways > cxlsd->nr_targets, -"ways: %d overflows targets: %d\n" , ways, - cxlsd->nr_targets)) -return -ENXIO ; - *tgt =FIELD_PREP (GENMASK (7 ,0 ), t[0 ]->port_id);if (ways >1 ) *tgt |=FIELD_PREP (GENMASK (15 ,8 ), t[1 ]->port_id);
@@ -601,8 +595,6 @@ static int cxlsd_set_targets(struct cxl_switch_decoder *cxlsd, u64 *tgt) *tgt |=FIELD_PREP (GENMASK_ULL (55 ,48 ), t[6 ]->port_id);if (ways >7 ) *tgt |=FIELD_PREP (GENMASK_ULL (63 ,56 ), t[7 ]->port_id); - -return 0 ; }/*
@@ -689,13 +681,7 @@ static int cxl_decoder_commit(struct cxl_decoder *cxld)void __iomem *tl_lo = hdm +CXL_HDM_DECODER0_TL_LOW (id);u64 targets; - rc =cxlsd_set_targets (cxlsd, &targets); -if (rc) { -dev_dbg (&port->dev,"%s: target configuration error\n" , -dev_name (&cxld->dev)); - goto err; - } - +cxlsd_set_targets (cxlsd, &targets);writel (upper_32_bits (targets), tl_hi);writel (lower_32_bits (targets), tl_lo); }else {
@@ -713,7 +699,6 @@ static int cxl_decoder_commit(struct cxl_decoder *cxld) port->commit_end++; rc =cxld_await_commit (hdm, cxld->id); -err:if (rc) {dev_dbg (&port->dev,"%s: error %d committing decoder\n" ,dev_name (&cxld->dev), rc);
drivers/cxl/core/region.c +8 -0
@@ -1190,6 +1190,14 @@ static int cxl_port_setup_targets(struct cxl_port *port,return rc; } +if (iw >8 || iw > cxlsd->nr_targets) { +dev_dbg (&cxlr->dev, +"%s:%s:%s: ways: %d overflows targets: %d\n" , +dev_name (port->uport_dev),dev_name (&port->dev), +dev_name (&cxld->dev), iw, cxlsd->nr_targets); +return -ENXIO ; + } +if (test_bit (CXL_REGION_F_AUTO , &cxlr->flags)) { if (cxld->interleave_ways != iw || cxld->interleave_granularity != ig ||
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 468/550 pcmcia: cs: fix possible hung task and memory leak pccardd()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Yingliang <[email protected]>
[ Upstream commit e3ea1b4847e49234e691c0d66bf030bd65bb7f2b ]
If device_register() returns error in pccardd(), it leads two issues:
1. The socket_released has never been completed, it will block pcmcia_unregister_socket(), because of waiting for completion of socket_released.
2. The device name allocated by dev_set_name() is leaked.
Fix this two issues by calling put_device() when device_register() fails. socket_released can be completed in pcmcia_release_socket(), the name can be freed in kobject_cleanup().
--- drivers/pcmcia/cs.c | 1 + 1 file changed, 1 insertion(+)
drivers/pcmcia/cs.c +1 -0
@@ -605,6 +605,7 @@ static int pccardd(void *__skt)dev_warn (&skt->dev,"PCMCIA: unable to register socket\n" ); skt->thread =NULL ;complete (&skt->thread_done); +put_device (&skt->dev);return 0 ; } ret =pccard_sysfs_add_socket (&skt->dev);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 469/550 pcmcia: ds: fix refcount leak in pcmcia_device_add()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Yingliang <[email protected]>
[ Upstream commit 402ab979b29126068e0b596b641422ff7490214c ]
As the comment of device_register() says, it should use put_device() to give up the reference in the error path. Then, insofar resources will be freed in pcmcia_release_dev(), the error path is no longer needed. In particular, this means that the (previously missing) dropping of the reference to &p_dev->function_config->ref is now handled by pcmcia_release_dev().
--- drivers/pcmcia/ds.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/pcmcia/ds.c +8 -2
@@ -573,8 +573,14 @@ static struct pcmcia_device *pcmcia_device_add(struct pcmcia_socket *s,pcmcia_device_query (p_dev); -if (device_register (&p_dev->dev)) - goto err_unreg; +if (device_register (&p_dev->dev)) { +mutex_lock (&s->ops_mutex); +list_del (&p_dev->socket_device_list); + s->device_count--; +mutex_unlock (&s->ops_mutex); +put_device (&p_dev->dev); +return NULL ; + }return p_dev;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 470/550 pcmcia: ds: fix possible name leak in error path in pcmcia_device_add()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Yingliang <[email protected]>
[ Upstream commit 99e1241049a92dd3e9a90a0f91e32ce390133278 ]
Afer commit 1fa5ae857bb1 ("driver core: get rid of struct device's bus_id string array"), the name of device is allocated dynamically. Therefore, it needs to be freed, which is done by the driver core for us once all references to the device are gone. Therefore, move the dev_set_name() call immediately before the call device_register(), which either succeeds (then the freeing will be done upon subsequent remvoal), or puts the reference in the error call. Also, it is not unusual that the return value of dev_set_name is not checked.
--- drivers/pcmcia/ds.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/pcmcia/ds.c +1 -3
@@ -513,9 +513,6 @@ static struct pcmcia_device *pcmcia_device_add(struct pcmcia_socket *s,/* by default don't allow DMA */ p_dev->dma_mask =0 ; p_dev->dev.dma_mask = &p_dev->dma_mask; -dev_set_name (&p_dev->dev,"%d.%d" , p_dev->socket->sock, p_dev->device_no); -if (!dev_name (&p_dev->dev)) - goto err_free; p_dev->devname =kasprintf (GFP_KERNEL ,"pcmcia%s" ,dev_name (&p_dev->dev));if (!p_dev->devname) goto err_free;
@@ -573,6 +570,7 @@ static struct pcmcia_device *pcmcia_device_add(struct pcmcia_socket *s,pcmcia_device_query (p_dev); +dev_set_name (&p_dev->dev,"%d.%d" , p_dev->socket->sock, p_dev->device_no);if (device_register (&p_dev->dev)) {mutex_lock (&s->ops_mutex);list_del (&p_dev->socket_device_list);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 471/550 media: imx-jpeg: initiate a drain of the capture queue in dynamic resolution change
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Qian <[email protected]>
[ Upstream commit 1c2786632e20c8f0fd4004fae3b3490276e5e5da ]
The last buffer from before the change must be marked, with the V4L2_BUF_FLAG_LAST flag,
similarly to the Drain sequence above.
Meanwhile if V4L2_DEC_CMD_STOP is sent before
the source change triggered,
we need to restore the is_draing flag after
the draining in dynamic resolution change.
--- .../media/platform/nxp/imx-jpeg/mxc-jpeg.c | 27 ++++++++++++++++--- 1 file changed, 24 insertions(+), 3 deletions(-)
drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c +24 -3
@@ -1322,6 +1322,20 @@ static bool mxc_jpeg_compare_format(const struct mxc_jpeg_fmt *fmt1,return false; } +static void mxc_jpeg_set_last_buffer (struct mxc_jpeg_ctx *ctx) +{ +struct vb2_v4l2_buffer *next_dst_buf; + + next_dst_buf =v4l2_m2m_dst_buf_remove (ctx->fh.m2m_ctx); +if (!next_dst_buf) { + ctx->fh.m2m_ctx->is_draining = true; + ctx->fh.m2m_ctx->next_buf_last = true; +return ; + } + +v4l2_m2m_last_buffer_done (ctx->fh.m2m_ctx, next_dst_buf); +} +static bool mxc_jpeg_source_change (struct mxc_jpeg_ctx *ctx,struct mxc_jpeg_src_buf *jpeg_src_buf) {
@@ -1378,6 +1392,8 @@ static bool mxc_jpeg_source_change(struct mxc_jpeg_ctx *ctx,mxc_jpeg_sizeimage (q_data_cap);notify_src_chg (ctx); ctx->source_change =1 ; +if (vb2_is_streaming (v4l2_m2m_get_dst_vq (ctx->fh.m2m_ctx))) +mxc_jpeg_set_last_buffer (ctx); }return ctx->source_change ? true : false;
@@ -1638,8 +1654,13 @@ static void mxc_jpeg_stop_streaming(struct vb2_queue *q)v4l2_m2m_buf_done (vbuf,VB2_BUF_STATE_ERROR ); } -if (V4L2_TYPE_IS_OUTPUT (q->type) || !ctx->source_change) -v4l2_m2m_update_stop_streaming_state (ctx->fh.m2m_ctx, q); +v4l2_m2m_update_stop_streaming_state (ctx->fh.m2m_ctx, q); +/* if V4L2_DEC_CMD_STOP is sent before the source change triggered, +* restore the is_draining flag +*/ +if (V4L2_TYPE_IS_CAPTURE (q->type) && ctx->source_change && ctx->fh.m2m_ctx->last_src_buf) + ctx->fh.m2m_ctx->is_draining = true; +if (V4L2_TYPE_IS_OUTPUT (q->type) &&v4l2_m2m_has_stopped (ctx->fh.m2m_ctx)) {notify_eos (ctx);
@@ -1916,7 +1937,7 @@ static int mxc_jpeg_buf_prepare(struct vb2_buffer *vb)return -EINVAL ;for (i =0 ; i < q_data->fmt->mem_planes; i++) { sizeimage =mxc_jpeg_get_plane_size (q_data, i); -if (vb2_plane_size (vb, i) < sizeimage) { +if (!ctx->source_change &&vb2_plane_size (vb, i) < sizeimage) {dev_err (dev,"plane %d too small (%lu < %lu)" , i,vb2_plane_size (vb, i), sizeimage);return -EINVAL ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 472/550 media: hantro: Check whether reset op is defined before use
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
[ Upstream commit 88d4b23a629ebd34f682f770cb6c2116c851f7b8 ]
The i.MX8MM/N/P does not define the .reset op since reset of the VPU is done by genpd. Check whether the .reset op is defined before calling it to avoid NULL pointer dereference.
Note that the Fixes tag is set to the commit which removed the reset op from i.MX8M Hantro G2 implementation, this is because before this commit all the implementations did define the .reset op.
--- drivers/media/platform/verisilicon/hantro_drv.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/media/platform/verisilicon/hantro_drv.c +2 -1
@@ -125,7 +125,8 @@ void hantro_watchdog(struct work_struct *work) ctx =v4l2_m2m_get_curr_priv (vpu->m2m_dev);if (ctx) {vpu_err ("frame processing timed out!\n" ); - ctx->codec_ops->reset (ctx); +if (ctx->codec_ops->reset) + ctx->codec_ops->reset (ctx);hantro_job_finish (vpu, ctx,VB2_BUF_STATE_ERROR ); } }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 473/550 media: verisilicon: Do not enable G2 postproc downscale if source is narrower than destination
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
[ Upstream commit 6e481d52d363218a3e6feb31694da74b38b30fad ]
In case of encoded input VP9 data width that is not multiple of macroblock size, which is 16 (e.g. 1080x1920 frames, where 1080 is multiple of 8), the width is padded to be a multiple of macroblock size (for 1080x1920 frames, that is 1088x1920).
The hantro_postproc_g2_enable() checks whether the encoded data width is equal to decoded frame width, and if not, enables down-scale mode. For a frame where input is 1080x1920 and output is 1088x1920, this is incorrect as no down-scale happens, the frame is only padded. Enabling the down-scale mode in this case results in corrupted frames.
Fix this by adjusting the check to test whether encoded data width is greater than decoded frame width, and only in that case enable the down-scale mode.
To generate input test data to trigger this bug, use e.g.:
$ gst-launch-1.0 videotestsrc ! video/x-raw,width=272,height=256,format=I420 ! \
vp9enc ! matroskamux ! filesink location=/tmp/test.vp9
To trigger the bug upon decoding (note that the NV12 must be forced, as
that assures the output data would pass the G2 postproc):
$ gst-launch-1.0 filesrc location=/tmp/test.vp9 ! matroskademux ! vp9parse ! \
v4l2slvp9dec ! video/x-raw,format=NV12 ! videoconvert ! fbdevsink--- drivers/media/platform/verisilicon/hantro_postproc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/platform/verisilicon/hantro_postproc.c +1 -1
@@ -107,7 +107,7 @@ static void hantro_postproc_g1_enable(struct hantro_ctx *ctx)static int down_scale_factor (struct hantro_ctx *ctx) { -if (ctx->src_fmt.width == ctx->dst_fmt.width) +if (ctx->src_fmt.width <= ctx->dst_fmt.width)return 0 ;return DIV_ROUND_CLOSEST (ctx->src_fmt.width, ctx->dst_fmt.width);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 474/550 media: ov5640: fix vblank unchange issue when work at dvp mode
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guoniu.zhou <[email protected]>
[ Upstream commit 8fc29e3c9f682d4ad9b0764d44ecc6c19b000051 ]
The value of V4L2_CID_VBLANK control is initialized to default vblank value of 640x480 when driver probe. When OV5640 work at DVP mode, the control value won't update and lead to sensor can't output data if the resolution remain the same as last time since incorrect total vertical size. So update it when there is a new value applied.
--- drivers/media/i2c/ov5640.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-)
drivers/media/i2c/ov5640.c +14 -5
@@ -2850,12 +2850,22 @@ static int ov5640_try_fmt_internal(struct v4l2_subdev *sd,return 0 ; } +static void __v4l2_ctrl_vblank_update (struct ov5640_dev *sensor,u32 vblank) +{ +const struct ov5640_mode_info *mode = sensor->current_mode; + +__v4l2_ctrl_modify_range (sensor->ctrls.vblank,OV5640_MIN_VBLANK , +OV5640_MAX_VTS - mode->height,1 , vblank); + +__v4l2_ctrl_s_ctrl (sensor->ctrls.vblank, vblank); +} +static int ov5640_update_pixel_rate (struct ov5640_dev *sensor) {const struct ov5640_mode_info *mode = sensor->current_mode;enum ov5640_pixel_rate_id pixel_rate_id = mode->pixel_rate;struct v4l2_mbus_framefmt *fmt = &sensor->fmt; -const struct ov5640_timings *timings; +const struct ov5640_timings *timings =ov5640_timings (sensor, mode);s32 exposure_val, exposure_max;unsigned int hblank;unsigned int i =0 ;
@@ -2874,6 +2884,8 @@ static int ov5640_update_pixel_rate(struct ov5640_dev *sensor)__v4l2_ctrl_s_ctrl_int64 (sensor->ctrls.pixel_rate,ov5640_calc_pixel_rate (sensor)); +__v4l2_ctrl_vblank_update (sensor, timings->vblank_def); +return 0 ; }
@@ -2916,15 +2928,12 @@ static int ov5640_update_pixel_rate(struct ov5640_dev *sensor)__v4l2_ctrl_s_ctrl_int64 (sensor->ctrls.pixel_rate, pixel_rate);__v4l2_ctrl_s_ctrl (sensor->ctrls.link_freq, i); - timings =ov5640_timings (sensor, mode); hblank = timings->htot - mode->width;__v4l2_ctrl_modify_range (sensor->ctrls.hblank, hblank, hblank,1 , hblank); vblank = timings->vblank_def; -__v4l2_ctrl_modify_range (sensor->ctrls.vblank,OV5640_MIN_VBLANK , -OV5640_MAX_VTS - mode->height,1 , vblank); -__v4l2_ctrl_s_ctrl (sensor->ctrls.vblank, vblank); +__v4l2_ctrl_vblank_update (sensor, vblank); exposure_max = timings->crop.height + vblank -4 ; exposure_val = clamp_t(s32, sensor->ctrls.exposure->val,
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 475/550 media: i2c: max9286: Fix some redundant of_node_put() calls
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 0822315e46b400f611cba1193456ee6a5dc3e41d ]
This is odd to have a of_node_put() just after a for_each_child_of_node() or a for_each_endpoint_of_node() loop. It should already be called during the last iteration.
Remove these calls.
--- drivers/media/i2c/max9286.c | 2 -- 1 file changed, 2 deletions(-)
drivers/media/i2c/max9286.c +0 -2
@@ -1461,7 +1461,6 @@ static int max9286_parse_dt(struct max9286_priv *priv) i2c_mux_mask |=BIT (id); } -of_node_put (node);of_node_put (i2c_mux);/* Parse the endpoints */
@@ -1525,7 +1524,6 @@ static int max9286_parse_dt(struct max9286_priv *priv) priv->source_mask |=BIT (ep.port); priv->nsources++; } -of_node_put (node);of_property_read_u32 (dev->of_node,"maxim,bus-width" , &priv->bus_width);switch (priv->bus_width) {
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 476/550 media: ov5640: Fix a memory leak when ov5640_probe fails
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaolei Wang <[email protected]>
[ Upstream commit 20290feaaeb76cc719921aad275ccb18662a7c3a ]
sensor->ctrls.handler is initialized in ov5640_init_controls(), so when the sensor is not connected and ov5640_sensor_resume() fails, sensor->ctrls.handler should be released, otherwise a memory leak will be detected:
unreferenced object 0xc674ca80 (size 64):
comm "swapper/0", pid 1, jiffies 4294938337 (age 204.880s) hex dump (first 32 bytes):
80 55 75 c6 80 54 75 c6 00 55 75 c6 80 52 75 c6 .Uu..Tu..Uu..Ru.
00 53 75 c6 00 00 00 00 00 00 00 00 00 00 00 00 .Su..........--- drivers/media/i2c/ov5640.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/media/i2c/ov5640.c +3 -2
@@ -3928,7 +3928,7 @@ static int ov5640_probe(struct i2c_client *client) ret =ov5640_sensor_resume (dev);if (ret) {dev_err (dev,"failed to power on\n" ); - goto entity_cleanup; + goto free_ctrls; }pm_runtime_set_active (dev);
@@ -3953,8 +3953,9 @@ static int ov5640_probe(struct i2c_client *client) err_pm_runtime:pm_runtime_put_noidle (dev);pm_runtime_disable (dev); -v4l2_ctrl_handler_free (&sensor->ctrls.handler);ov5640_sensor_suspend (dev); +free_ctrls: +v4l2_ctrl_handler_free (&sensor->ctrls.handler); entity_cleanup:media_entity_cleanup (&sensor->sd.entity);mutex_destroy (&sensor->lock);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 477/550 media: bttv: fix use after free error due to btv->timeout timer
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Wang <[email protected]>
[ Upstream commit bd5b50b329e850d467e7bcc07b2b6bde3752fbda ]
There may be some a race condition between timer function bttv_irq_timeout and bttv_remove. The timer is setup in probe and there is no timer_delete operation in remove function. When it hit kfree btv, the function might still be invoked, which will cause use after free bug.
This bug is found by static analysis, it may be false positive.
Fix it by adding del_timer_sync invoking to the remove function.
cpu0 cpu1
bttv_probe
->timer_setup
->bttv_set_dma
->mod_timer;
bttv_remove
->kfree(btv);
->bttv_irq_timeout
->USE btv--- drivers/media/pci/bt8xx/bttv-driver.c | 1 + 1 file changed, 1 insertion(+)
drivers/media/pci/bt8xx/bttv-driver.c +1 -0
@@ -3830,6 +3830,7 @@ static void bttv_remove(struct pci_dev *pci_dev)/* free resources */ free_irq (btv->c.pci->irq,btv); +del_timer_sync (&btv->timeout);iounmap (btv->bt848_mmio);release_mem_region (pci_resource_start (btv->c.pci,0 ),pci_resource_len (btv->c.pci,0 ));
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 478/550 media: amphion: handle firmware debug message
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Qian <[email protected]>
[ Upstream commit 6496617b2b06d7004a5cbd53d48f19567d6b018c ]
decoder firmware may notify host some debug message, it can help analyze the state of the firmware in case of error
--- drivers/media/platform/amphion/vpu_defs.h | 1 + drivers/media/platform/amphion/vpu_helpers.c | 1 + drivers/media/platform/amphion/vpu_malone.c | 1 + drivers/media/platform/amphion/vpu_msgs.c | 31 ++++++++++++++++---- 4 files changed, 29 insertions(+), 5 deletions(-)
drivers/media/platform/amphion/vpu_defs.h +1 -0
@@ -71,6 +71,7 @@ enum {VPU_MSG_ID_TIMESTAMP_INFO ,VPU_MSG_ID_FIRMWARE_XCPT ,VPU_MSG_ID_PIC_SKIPPED , + VPU_MSG_ID_DBG_MSG, }; enum VPU_ENC_MEMORY_RESOURSE {
drivers/media/platform/amphion/vpu_helpers.c +1 -0
@@ -489,6 +489,7 @@ const char *vpu_id_name(u32 id)case VPU_MSG_ID_UNSUPPORTED :return "unsupported" ;case VPU_MSG_ID_FIRMWARE_XCPT :return "exception" ;case VPU_MSG_ID_PIC_SKIPPED :return "skipped" ; +case VPU_MSG_ID_DBG_MSG :return "debug msg" ; }return "<unknown>" ; }
drivers/media/platform/amphion/vpu_malone.c +1 -0
@@ -747,6 +747,7 @@ static struct vpu_pair malone_msgs[] = { {VPU_MSG_ID_UNSUPPORTED, VID_API_EVENT_UNSUPPORTED_STREAM}, {VPU_MSG_ID_FIRMWARE_XCPT, VID_API_EVENT_FIRMWARE_XCPT}, {VPU_MSG_ID_PIC_SKIPPED, VID_API_EVENT_PIC_SKIPPED}, + {VPU_MSG_ID_DBG_MSG, VID_API_EVENT_DBG_MSG_DEC}, }; static void vpu_malone_pack_fs_alloc(struct vpu_rpc_event *pkt,
drivers/media/platform/amphion/vpu_msgs.c +26 -5
@@ -23,6 +23,7 @@struct vpu_msg_handler {u32 id;void (*done)(struct vpu_inst *inst,struct vpu_rpc_event *pkt); +u32 is_str; };static void vpu_session_handle_start_done (struct vpu_inst *inst,struct vpu_rpc_event *pkt)
@@ -154,7 +155,7 @@ static void vpu_session_handle_error(struct vpu_inst *inst, struct vpu_rpc_event {char *str = (char *)pkt->data; -if (strlen (str)) +if (*str)dev_err (inst->dev,"instance %d firmware error : %s\n" , inst->id, str);else dev_err (inst->dev,"instance %d is unsupported stream\n" , inst->id);
@@ -180,6 +181,21 @@ static void vpu_session_handle_pic_skipped(struct vpu_inst *inst, struct vpu_rpcvpu_inst_unlock (inst); } +static void vpu_session_handle_dbg_msg (struct vpu_inst *inst,struct vpu_rpc_event *pkt) +{ +char *str = (char *)pkt->data; + +if (*str) +dev_info (inst->dev,"instance %d firmware dbg msg : %s\n" , inst->id, str); +} + +static void vpu_terminate_string_msg (struct vpu_rpc_event *pkt) +{ +if (pkt->hdr.num ==ARRAY_SIZE (pkt->data)) + pkt->hdr.num--; + pkt->data[pkt->hdr.num] =0 ; +} +static struct vpu_msg_handler handlers[] = { {VPU_MSG_ID_START_DONE , vpu_session_handle_start_done}, {VPU_MSG_ID_STOP_DONE , vpu_session_handle_stop_done},
@@ -193,9 +209,10 @@ static struct vpu_msg_handler handlers[] = { {VPU_MSG_ID_PIC_DECODED, vpu_session_handle_pic_decoded}, {VPU_MSG_ID_DEC_DONE, vpu_session_handle_pic_done}, {VPU_MSG_ID_PIC_EOS, vpu_session_handle_eos}, - {VPU_MSG_ID_UNSUPPORTED, vpu_session_handle_error}, - {VPU_MSG_ID_FIRMWARE_XCPT, vpu_session_handle_firmware_xcpt}, + {VPU_MSG_ID_UNSUPPORTED, vpu_session_handle_error, true}, + {VPU_MSG_ID_FIRMWARE_XCPT, vpu_session_handle_firmware_xcpt, true}, {VPU_MSG_ID_PIC_SKIPPED, vpu_session_handle_pic_skipped}, + {VPU_MSG_ID_DBG_MSG, vpu_session_handle_dbg_msg, true}, };static int vpu_session_handle_msg (struct vpu_inst *inst,struct vpu_rpc_event *msg)
@@ -219,8 +236,12 @@ static int vpu_session_handle_msg(struct vpu_inst *inst, struct vpu_rpc_event *m } } -if (handler && handler->done) - handler->done (inst, msg); +if (handler) { +if (handler->is_str) +vpu_terminate_string_msg (msg); +if (handler->done) + handler->done (inst, msg); + }vpu_response_cmd (inst, msg_id,1 );
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 479/550 media: mtk-jpegenc: Fix bug in JPEG encode quality selection
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fei Shao <[email protected]>
[ Upstream commit 0aeccc63f3bc4cfd49dc4893da1409402ee6b295 ]
The driver uses the upper-bound approach to decide the target JPEG encode quality, but there's a logic bug that if the desired quality is higher than what the driver can support, the driver falls back to using the worst quality.
Fix the bug by assuming using the best quality in the beginning, and with trivial refactor to avoid long lines.
--- drivers/media/platform/mediatek/jpeg/mtk_jpeg_enc_hw.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/media/platform/mediatek/jpeg/mtk_jpeg_enc_hw.c +3 -2
@@ -127,6 +127,7 @@ void mtk_jpeg_set_enc_params(struct mtk_jpeg_ctx *ctx, void __iomem *base)u32 img_stride;u32 mem_stride;u32 i, enc_quality; +u32 nr_enc_quality =ARRAY_SIZE (mtk_jpeg_enc_quality); value = width <<16 | height;writel (value, base +JPEG_ENC_IMG_SIZE );
@@ -157,8 +158,8 @@ void mtk_jpeg_set_enc_params(struct mtk_jpeg_ctx *ctx, void __iomem *base)writel (img_stride, base +JPEG_ENC_IMG_STRIDE );writel (mem_stride, base +JPEG_ENC_STRIDE ); - enc_quality = mtk_jpeg_enc_quality[0 ].hardware_value; -for (i =0 ; i <ARRAY_SIZE (mtk_jpeg_enc_quality); i++) { + enc_quality = mtk_jpeg_enc_quality[nr_enc_quality -1 ].hardware_value; +for (i =0 ; i < nr_enc_quality; i++) {if (ctx->enc_quality <= mtk_jpeg_enc_quality[i].quality_param) { enc_quality = mtk_jpeg_enc_quality[i].hardware_value;break ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 480/550 media: s3c-camif: Avoid inappropriate kfree()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Katya Orlova <[email protected]>
[ Upstream commit 61334819aca018c3416ee6c330a08a49c1524fc3 ]
s3c_camif_register_video_node() works with video_device structure stored as a field of camif_vp, so it should not be kfreed.
But there is video_device_release() on error path that do it.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/media/platform/samsung/s3c-camif/camif-capture.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/media/platform/samsung/s3c-camif/camif-capture.c +2 -4
@@ -1133,12 +1133,12 @@ int s3c_camif_register_video_node(struct camif_dev *camif, int idx) ret =vb2_queue_init (q);if (ret) - goto err_vd_rel; +return ret; vp->pad.flags =MEDIA_PAD_FL_SINK ; ret =media_entity_pads_init (&vfd->entity,1 , &vp->pad);if (ret) - goto err_vd_rel; +return ret;video_set_drvdata (vfd, vp);
@@ -1171,8 +1171,6 @@ int s3c_camif_register_video_node(struct camif_dev *camif, int idx)v4l2_ctrl_handler_free (&vp->ctrl_handler); err_me_cleanup:media_entity_cleanup (&vfd->entity); -err_vd_rel: -video_device_release (vfd);return ret; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 481/550 media: vidtv: psi: Add check for kstrdup
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiasheng Jiang <[email protected]>
[ Upstream commit 76a2c5df6ca8bd8ada45e953b8c72b746f42918d ]
Add check for the return value of kstrdup() and return the error if it fails in order to avoid NULL pointer dereference.
--- drivers/media/test-drivers/vidtv/vidtv_psi.c | 45 +++++++++++++++++--- 1 file changed, 40 insertions(+), 5 deletions(-)
drivers/media/test-drivers/vidtv/vidtv_psi.c +40 -5
@@ -301,16 +301,29 @@ struct vidtv_psi_desc_service *vidtv_psi_service_desc_init(struct vidtv_psi_desc desc->service_name_len = service_name_len; -if (service_name && service_name_len) +if (service_name && service_name_len) { desc->service_name =kstrdup (service_name,GFP_KERNEL ); +if (!desc->service_name) + goto free_desc; + } desc->provider_name_len = provider_name_len; -if (provider_name && provider_name_len) +if (provider_name && provider_name_len) { desc->provider_name =kstrdup (provider_name,GFP_KERNEL ); +if (!desc->provider_name) + goto free_desc_service_name; + }vidtv_psi_desc_chain (head, (struct vidtv_psi_desc *)desc);return desc; + +free_desc_service_name: +if (service_name && service_name_len) +kfree (desc->service_name); +free_desc: +kfree (desc); +return NULL ; }struct vidtv_psi_desc_registration
@@ -355,8 +368,13 @@ struct vidtv_psi_desc_network_name desc->length = network_name_len; -if (network_name && network_name_len) +if (network_name && network_name_len) { desc->network_name =kstrdup (network_name,GFP_KERNEL ); +if (!desc->network_name) { +kfree (desc); +return NULL ; + } + }vidtv_psi_desc_chain (head, (struct vidtv_psi_desc *)desc);return desc;
@@ -442,15 +460,32 @@ struct vidtv_psi_desc_short_event iso_language_code ="eng" ; desc->iso_language_code =kstrdup (iso_language_code,GFP_KERNEL ); +if (!desc->iso_language_code) + goto free_desc; -if (event_name && event_name_len) +if (event_name && event_name_len) { desc->event_name =kstrdup (event_name,GFP_KERNEL ); +if (!desc->event_name) + goto free_desc_language_code; + } -if (text && text_len) +if (text && text_len) { desc->text =kstrdup (text,GFP_KERNEL ); +if (!desc->text) + goto free_desc_event_name; + }vidtv_psi_desc_chain (head, (struct vidtv_psi_desc *)desc);return desc; + +free_desc_event_name: +if (event_name && event_name_len) +kfree (desc->event_name); +free_desc_language_code: +kfree (desc->iso_language_code); +free_desc: +kfree (desc); +return NULL ; }struct vidtv_psi_desc *vidtv_psi_desc_clone (struct vidtv_psi_desc *desc)
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 482/550 media: vidtv: mux: Add check and kfree for kstrdup
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiasheng Jiang <[email protected]>
[ Upstream commit 1fd6eb12642e0c32692924ff359c07de4b781d78 ]
Add check for the return value of kstrdup() and return the error if it fails in order to avoid NULL pointer dereference. Moreover, use kfree() in the later error handling in order to avoid memory leak.
--- drivers/media/test-drivers/vidtv/vidtv_mux.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/media/test-drivers/vidtv/vidtv_mux.c +6 -1
@@ -504,13 +504,16 @@ struct vidtv_mux *vidtv_mux_init(struct dvb_frontend *fe, m->priv = args->priv; m->network_id = args->network_id; m->network_name =kstrdup (args->network_name,GFP_KERNEL ); +if (!m->network_name) + goto free_mux_buf; + m->timing.current_jiffies =get_jiffies_64 ();if (args->channels) m->channels = args->channels;else if (vidtv_channels_init (m) <0 ) - goto free_mux_buf; + goto free_mux_network_name;/* will alloc data for pmt_sections after initializing pat */ if (vidtv_channel_si_init (m) <0 )
@@ -527,6 +530,8 @@ struct vidtv_mux *vidtv_mux_init(struct dvb_frontend *fe,vidtv_channel_si_destroy (m); free_channels:vidtv_channels_destroy (m); +free_mux_network_name: +kfree (m->network_name); free_mux_buf:vfree (m->mux_buf); free_mux:
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 483/550 media: cedrus: Fix clock/reset sequence
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jernej Skrabec <[email protected]>
[ Upstream commit 36fe515c1a3cd5eac148e8a591a82108d92d5522 ]
According to H6 user manual, resets should always be de-asserted before clocks are enabled. This is also consistent with vendor driver.
--- .../staging/media/sunxi/cedrus/cedrus_hw.c | 24 +++++++++---------- 1 file changed, 12 insertions(+), 12 deletions(-)
drivers/staging/media/sunxi/cedrus/cedrus_hw.c +12 -12
@@ -172,12 +172,12 @@ int cedrus_hw_suspend(struct device *device) {struct cedrus_dev *dev =dev_get_drvdata (device); -reset_control_assert (dev->rstc); -clk_disable_unprepare (dev->ram_clk);clk_disable_unprepare (dev->mod_clk);clk_disable_unprepare (dev->ahb_clk); +reset_control_assert (dev->rstc); +return 0 ; }
@@ -186,11 +186,18 @@ int cedrus_hw_resume(struct device *device)struct cedrus_dev *dev =dev_get_drvdata (device);int ret; + ret =reset_control_reset (dev->rstc); +if (ret) { +dev_err (dev->dev,"Failed to apply reset\n" ); + +return ret; + } + ret =clk_prepare_enable (dev->ahb_clk);if (ret) {dev_err (dev->dev,"Failed to enable AHB clock\n" ); -return ret; + goto err_rst; } ret =clk_prepare_enable (dev->mod_clk);
@@ -207,21 +214,14 @@ int cedrus_hw_resume(struct device *device) goto err_mod_clk; } - ret =reset_control_reset (dev->rstc); -if (ret) { -dev_err (dev->dev,"Failed to apply reset\n" ); - - goto err_ram_clk; - } -return 0 ; -err_ram_clk: -clk_disable_unprepare (dev->ram_clk); err_mod_clk:clk_disable_unprepare (dev->mod_clk); err_ahb_clk:clk_disable_unprepare (dev->ahb_clk); +err_rst: +reset_control_assert (dev->rstc);return ret; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 484/550 media: cadence: csi2rx: Unregister v4l2 async notifier
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pratyush Yadav <[email protected]>
[ Upstream commit b2701715301a49b53d05c7d43f3fedc3b8743bfc ]
The notifier is added to the global notifier list when registered. When the module is removed, the struct csi2rx_priv in which the notifier is embedded, is destroyed. As a result the notifier list has a reference to a notifier that no longer exists. This causes invalid memory accesses when the list is iterated over. Similar for when the probe fails. Unregister and clean up the notifier to avoid this.
--- drivers/media/platform/cadence/cdns-csi2rx.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/media/platform/cadence/cdns-csi2rx.c +6 -1
@@ -404,8 +404,10 @@ static int csi2rx_parse_dt(struct csi2rx_priv *csi2rx) asd =v4l2_async_nf_add_fwnode_remote (&csi2rx->notifier, fwh, struct v4l2_async_subdev);of_node_put (ep); -if (IS_ERR (asd)) +if (IS_ERR (asd)) { +v4l2_async_nf_cleanup (&csi2rx->notifier);return PTR_ERR (asd); + } csi2rx->notifier.ops = &csi2rx_notifier_ops;
@@ -467,6 +469,7 @@ static int csi2rx_probe(struct platform_device *pdev)return 0 ; err_cleanup: +v4l2_async_nf_unregister (&csi2rx->notifier);v4l2_async_nf_cleanup (&csi2rx->notifier); err_free_priv:kfree (csi2rx);
@@ -477,6 +480,8 @@ static void csi2rx_remove(struct platform_device *pdev) {struct csi2rx_priv *csi2rx =platform_get_drvdata (pdev); +v4l2_async_nf_unregister (&csi2rx->notifier); +v4l2_async_nf_cleanup (&csi2rx->notifier);v4l2_async_unregister_subdev (&csi2rx->subdev);kfree (csi2rx); }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 485/550 media: dvb-usb-v2: af9035: fix missing unlock
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <[email protected]>
[ Upstream commit f31b2cb85f0ee165d78e1c43f6d69f82cc3b2145 ]
Instead of returning an error, goto the mutex unlock at the end of the function.
Fixes smatch warning:
drivers/media/usb/dvb-usb-v2/af9035.c:467 af9035_i2c_master_xfer() warn: inconsistent returns '&d->i2c_mutex'.
Locked on : 326,387
Unlocked on: 465,467
--- drivers/media/usb/dvb-usb-v2/af9035.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/media/usb/dvb-usb-v2/af9035.c +9 -4
@@ -322,8 +322,10 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap, ret = -EOPNOTSUPP ; }else if ((msg[0 ].addr == state->af9033_i2c_addr[0 ]) || (msg[0 ].addr == state->af9033_i2c_addr[1 ])) { -if (msg[0 ].len <3 || msg[1 ].len <1 ) -return -EOPNOTSUPP ; +if (msg[0 ].len <3 || msg[1 ].len <1 ) { + ret = -EOPNOTSUPP ; + goto unlock; + }/* demod access via firmware interface */ u32 reg = msg[0 ].buf[0 ] <<16 | msg[0 ].buf[1 ] <<8 | msg[0 ].buf[2 ];
@@ -383,8 +385,10 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap, ret = -EOPNOTSUPP ; }else if ((msg[0 ].addr == state->af9033_i2c_addr[0 ]) || (msg[0 ].addr == state->af9033_i2c_addr[1 ])) { -if (msg[0 ].len <3 ) -return -EOPNOTSUPP ; +if (msg[0 ].len <3 ) { + ret = -EOPNOTSUPP ; + goto unlock; + }/* demod access via firmware interface */ u32 reg = msg[0 ].buf[0 ] <<16 | msg[0 ].buf[1 ] <<8 | msg[0 ].buf[2 ];
@@ -459,6 +463,7 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap, ret = -EOPNOTSUPP ; } +unlock:mutex_unlock (&d->i2c_mutex);if (ret <0 )
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 486/550 media: verisilicon: Fixes clock list for rk3588 av1 decoder
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Gaignard <[email protected]>
[ Upstream commit 39377f84fb98561b86b645f0b7c33512eba7afaf ]
Mainlined RK3588 clock driver manage by itself the dependency between aclk/hclk and their root clocks (aclk_vdpu_root/hclk_vdpu_root). RK3588 av1 video decoder do not have to take care of it anymore so remove them from the list and be compliant with yaml bindings description.
--- drivers/media/platform/verisilicon/rockchip_vpu_hw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/platform/verisilicon/rockchip_vpu_hw.c +1 -1
@@ -648,7 +648,7 @@ static const char * const rockchip_vpu_clk_names[] = { };static const char *const rk3588_vpu981_vpu_clk_names[] = { -"aclk" ,"hclk" ,"aclk_vdpu_root" ,"hclk_vdpu_root" +"aclk" ,"hclk" , };/* VDPU1/VEPU1 */
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 487/550 media: imx-jpeg: notify source chagne event when the first picture parsed
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Qian <[email protected]>
[ Upstream commit b833b178498dafa2156cfb6f4d3ce4581c21f1e5 ]
After gstreamer rework the dynamic resolution change handling, gstreamer stop doing capture buffer allocation based on guesses and wait for the source change event when available. It requires driver always notify source change event in the initialization, even if the size parsed is equal to the size set on capture queue. otherwise, the pipeline will be stalled.
Currently driver may not notify source change event if the parsed format and size are equal to those previously established, but it may stall the gstreamer pipeline.
The link of gstreamer patch is
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/4437
--- drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c | 7 ++++++- drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.h | 1 + 2 files changed, 7 insertions(+), 1 deletion(-)
drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c +6 -1
@@ -1348,7 +1348,8 @@ static bool mxc_jpeg_source_change(struct mxc_jpeg_ctx *ctx, q_data_cap =mxc_jpeg_get_q_data (ctx,V4L2_BUF_TYPE_VIDEO_CAPTURE );if (mxc_jpeg_compare_format (q_data_cap->fmt, jpeg_src_buf->fmt)) jpeg_src_buf->fmt = q_data_cap->fmt; -if (q_data_cap->fmt != jpeg_src_buf->fmt || +if (ctx->need_initial_source_change_evt || + q_data_cap->fmt != jpeg_src_buf->fmt || q_data_cap->w != jpeg_src_buf->w || q_data_cap->h != jpeg_src_buf->h) { dev_dbg(dev, "Detected jpeg res=(%dx%d)->(%dx%d), pixfmt=%c%c%c%c\n",
@@ -1392,6 +1393,7 @@ static bool mxc_jpeg_source_change(struct mxc_jpeg_ctx *ctx,mxc_jpeg_sizeimage (q_data_cap);notify_src_chg (ctx); ctx->source_change =1 ; + ctx->need_initial_source_change_evt = false;if (vb2_is_streaming (v4l2_m2m_get_dst_vq (ctx->fh.m2m_ctx)))mxc_jpeg_set_last_buffer (ctx); }
@@ -1611,6 +1613,9 @@ static int mxc_jpeg_queue_setup(struct vb2_queue *q,for (i =0 ; i < *nplanes; i++) sizes[i] =mxc_jpeg_get_plane_size (q_data, i); +if (V4L2_TYPE_IS_OUTPUT (q->type)) + ctx->need_initial_source_change_evt = true; +return 0 ; }
drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.h +1 -0
@@ -99,6 +99,7 @@ struct mxc_jpeg_ctx {enum mxc_jpeg_enc_state enc_state;int slot;unsigned int source_change; +bool need_initial_source_change_evt;bool header_parsed;struct v4l2_ctrl_handler ctrl_handler;u8 jpeg_quality;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 488/550 media: platform: mtk-mdp3: fix uninitialized variable in mdp_path_config()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Moudy Ho <[email protected]>
[ Upstream commit 2a76e7679b594ea3e1b3b7fb6c3d67158114020d ]
Fix the build warnings that were detected by the linux-media build scripts tool:
drivers/media/platform/mediatek/mdp3/mtk-mdp3-cmdq.c:
In function 'mdp_path_config.isra':drivers/media/platform/mediatek/mdp3/mtk-mdp3-cmdq.c:
warning: 'ctx' may be used uninitialized [-Wmaybe-uninitialized]
| out = CFG_COMP(MT8195, ctx->param, outputs[0]);
| ~~~^~~~~~~
drivers/media/platform/mediatek/mdp3/mtk-img-ipi.h: note:
in definition of macro 'CFG_COMP'
| (IS_ERR_OR_NULL(comp) ? 0 : _CFG_COMP(plat, comp, mem))
| ^~~~
drivers/media/platform/mediatek/mdp3/mtk-mdp3-cmdq.c:
note: 'ctx' was declared here
| struct mdp_comp_ctx *ctx;
|--- drivers/media/platform/mediatek/mdp3/mtk-mdp3-cmdq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/platform/mediatek/mdp3/mtk-mdp3-cmdq.c +1 -1
@@ -261,11 +261,11 @@ static int mdp_path_config(struct mdp_dev *mdp, struct mdp_cmdq_cmd *cmd,const struct v4l2_rect *compose;u32 out =0 ; + ctx = &path->comps[index];if (CFG_CHECK (MT8183 , p_id)) out =CFG_COMP (MT8183 , ctx->param, outputs[0 ]); compose = path->composes[out]; - ctx = &path->comps[index]; ret =call_op (ctx, config_frame, cmd, compose);if (ret)return ret;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 489/550 media: cec: meson: always include meson sub-directory in Makefile
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <[email protected]>
[ Upstream commit 94e27fbeca27d8c772fc2bc807730aaee5886055 ]
'meson' directory contains two separate drivers, so it should be added to Makefile compilation hierarchy unconditionally, because otherwise the meson-ao-cec-g12a won't be compiled if meson-ao-cec is not selected.
--- drivers/media/cec/platform/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/cec/platform/Makefile +1 -1
@@ -6,7 +6,7 @@ # Please keep it in alphabetic order obj-$(CONFIG_CEC_CROS_EC) += cros-ec/ obj-$(CONFIG_CEC_GPIO) += cec-gpio/ -obj-$(CONFIG_CEC_MESON_AO) += meson/ +obj-y += meson/ obj-$(CONFIG_CEC_SAMSUNG_S5P) += s5p/ obj-$(CONFIG_CEC_SECO) += seco/ obj-$(CONFIG_CEC_STI) += sti/
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 490/550 cpupower: fix reference to nonexistent document
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vegard Nossum <[email protected]>
[ Upstream commit 6feb1a9641197ee630bf43b5c34ea1d9f8b4a0aa ]
This file was renamed from .txt to .rst and left a dangling reference. Fix it.
--- tools/power/cpupower/man/cpupower-powercap-info.1 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/power/cpupower/man/cpupower-powercap-info.1 +1 -1
@@ -17,7 +17,7 @@ settings of all cores, see cpupower(1) how to choose specific cores. .SH "DOCUMENTATION" kernel sources: -Documentation/power/powercap/powercap.txt +Documentation/power/powercap/powercap.rst .SH "SEE ALSO"
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 491/550 regmap: prevent noinc writes from clobbering cache
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Wolsieffer <[email protected]>
[ Upstream commit 984a4afdc87a1fc226fd657b1cd8255c13d3fc1a ]
Currently, noinc writes are cached as if they were standard incrementing writes, overwriting unrelated register values in the cache. Instead, we want to cache the last value written to the register, as is done in the accelerated noinc handler (regmap_noinc_readwrite).
--- drivers/base/regmap/regmap.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
drivers/base/regmap/regmap.c +9 -7
@@ -1714,17 +1714,19 @@ static int _regmap_raw_write_impl(struct regmap *map, unsigned int reg, }if (!map->cache_bypass && map->format.parse_val) { -unsigned int ival; +unsigned int ival, offset;int val_bytes = map->format.val_bytes; -for (i =0 ; i < val_len / val_bytes; i++) { - ival = map->format.parse_val (val + (i * val_bytes)); - ret =regcache_write (map, - reg +regmap_get_offset (map, i), - ival); + +/* Cache the last written value for noinc writes */ + i = noinc ? val_len - val_bytes :0 ; +for (; i < val_len; i += val_bytes) { + ival = map->format.parse_val (val + i); + offset = noinc ?0 :regmap_get_offset (map, i / val_bytes); + ret =regcache_write (map, reg + offset, ival);if (ret) {dev_err (map->dev,"Error in caching of register: %x ret: %d\n" , - reg +regmap_get_offset (map, i), ret); + reg + offset, ret);return ret; } }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 492/550 drm/amdgpu/gfx10,11: use memcpy_to/fromio for MQDs
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit b3c942bb6c32a8ddc1d52ee6bc24b8cf732dddf4 ]
Since they were moved to VRAM, we need to use the IO variants of memcpy.
--- drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 12 ++++++------ drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 12 ++++++------ 2 files changed, 12 insertions(+), 12 deletions(-)
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +6 -6
@@ -6466,11 +6466,11 @@ static int gfx_v10_0_gfx_init_queue(struct amdgpu_ring *ring)nv_grbm_select (adev,0 ,0 ,0 ,0 );mutex_unlock (&adev->srbm_mutex);if (adev->gfx.me.mqd_backup[mqd_idx]) -memcpy (adev->gfx.me.mqd_backup[mqd_idx], mqd,sizeof (*mqd)); +memcpy_fromio (adev->gfx.me.mqd_backup[mqd_idx], mqd,sizeof (*mqd)); }else {/* restore mqd with the backup copy */ if (adev->gfx.me.mqd_backup[mqd_idx]) -memcpy (mqd, adev->gfx.me.mqd_backup[mqd_idx],sizeof (*mqd)); +memcpy_toio (mqd, adev->gfx.me.mqd_backup[mqd_idx],sizeof (*mqd));/* reset the ring */ ring->wptr =0 ; *ring->wptr_cpu_addr =0 ;
@@ -6744,7 +6744,7 @@ static int gfx_v10_0_kiq_init_queue(struct amdgpu_ring *ring)if (amdgpu_in_reset (adev)) {/* for GPU_RESET case */ /* reset MQD to a clean status */ if (adev->gfx.kiq[0 ].mqd_backup) -memcpy (mqd, adev->gfx.kiq[0 ].mqd_backup,sizeof (*mqd)); +memcpy_toio (mqd, adev->gfx.kiq[0 ].mqd_backup,sizeof (*mqd));/* reset ring buffer */ ring->wptr =0 ;
@@ -6767,7 +6767,7 @@ static int gfx_v10_0_kiq_init_queue(struct amdgpu_ring *ring)mutex_unlock (&adev->srbm_mutex);if (adev->gfx.kiq[0 ].mqd_backup) -memcpy (adev->gfx.kiq[0 ].mqd_backup, mqd,sizeof (*mqd)); +memcpy_fromio (adev->gfx.kiq[0 ].mqd_backup, mqd,sizeof (*mqd)); }return 0 ;
@@ -6788,11 +6788,11 @@ static int gfx_v10_0_kcq_init_queue(struct amdgpu_ring *ring)mutex_unlock (&adev->srbm_mutex);if (adev->gfx.mec.mqd_backup[mqd_idx]) -memcpy (adev->gfx.mec.mqd_backup[mqd_idx], mqd,sizeof (*mqd)); +memcpy_fromio (adev->gfx.mec.mqd_backup[mqd_idx], mqd,sizeof (*mqd)); }else {/* restore MQD to a clean status */ if (adev->gfx.mec.mqd_backup[mqd_idx]) -memcpy (mqd, adev->gfx.mec.mqd_backup[mqd_idx],sizeof (*mqd)); +memcpy_toio (mqd, adev->gfx.mec.mqd_backup[mqd_idx],sizeof (*mqd));/* reset ring buffer */ ring->wptr =0 ;atomic64_set ((atomic64_t *)ring->wptr_cpu_addr,0 );
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c +6 -6
@@ -3684,11 +3684,11 @@ static int gfx_v11_0_gfx_init_queue(struct amdgpu_ring *ring)soc21_grbm_select (adev,0 ,0 ,0 ,0 );mutex_unlock (&adev->srbm_mutex);if (adev->gfx.me.mqd_backup[mqd_idx]) -memcpy (adev->gfx.me.mqd_backup[mqd_idx], mqd,sizeof (*mqd)); +memcpy_fromio (adev->gfx.me.mqd_backup[mqd_idx], mqd,sizeof (*mqd)); }else {/* restore mqd with the backup copy */ if (adev->gfx.me.mqd_backup[mqd_idx]) -memcpy (mqd, adev->gfx.me.mqd_backup[mqd_idx],sizeof (*mqd)); +memcpy_toio (mqd, adev->gfx.me.mqd_backup[mqd_idx],sizeof (*mqd));/* reset the ring */ ring->wptr =0 ; *ring->wptr_cpu_addr =0 ;
@@ -3977,7 +3977,7 @@ static int gfx_v11_0_kiq_init_queue(struct amdgpu_ring *ring)if (amdgpu_in_reset (adev)) {/* for GPU_RESET case */ /* reset MQD to a clean status */ if (adev->gfx.kiq[0 ].mqd_backup) -memcpy (mqd, adev->gfx.kiq[0 ].mqd_backup,sizeof (*mqd)); +memcpy_toio (mqd, adev->gfx.kiq[0 ].mqd_backup,sizeof (*mqd));/* reset ring buffer */ ring->wptr =0 ;
@@ -4000,7 +4000,7 @@ static int gfx_v11_0_kiq_init_queue(struct amdgpu_ring *ring)mutex_unlock (&adev->srbm_mutex);if (adev->gfx.kiq[0 ].mqd_backup) -memcpy (adev->gfx.kiq[0 ].mqd_backup, mqd,sizeof (*mqd)); +memcpy_fromio (adev->gfx.kiq[0 ].mqd_backup, mqd,sizeof (*mqd)); }return 0 ;
@@ -4021,11 +4021,11 @@ static int gfx_v11_0_kcq_init_queue(struct amdgpu_ring *ring)mutex_unlock (&adev->srbm_mutex);if (adev->gfx.mec.mqd_backup[mqd_idx]) -memcpy (adev->gfx.mec.mqd_backup[mqd_idx], mqd,sizeof (*mqd)); +memcpy_fromio (adev->gfx.mec.mqd_backup[mqd_idx], mqd,sizeof (*mqd)); }else {/* restore MQD to a clean status */ if (adev->gfx.mec.mqd_backup[mqd_idx]) -memcpy (mqd, adev->gfx.mec.mqd_backup[mqd_idx],sizeof (*mqd)); +memcpy_toio (mqd, adev->gfx.mec.mqd_backup[mqd_idx],sizeof (*mqd));/* reset ring buffer */ ring->wptr =0 ;atomic64_set ((atomic64_t *)ring->wptr_cpu_addr,0 );
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 493/550 drm/amdgpu: dont put MQDs in VRAM on ARM | ARM64
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit ba0fb4b48c19a2d2380fc16ca4af236a0871d279 ]
Issues were reported with commit 1cfb4d612127 ("drm/amdgpu: put MQDs in VRAM") on an ADLINK Ampere Altra Developer Platform (AVA developer platform).
Various ARM systems seem to have problems related to PCIe and MMIO access. In this case, I'm not sure if this is specific to the ADLINK platform or ARM in general. Seems to be some coherency issue with VRAM. For now, just don't put MQDs in VRAM on ARM.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c +2 -0
@@ -383,9 +383,11 @@ int amdgpu_gfx_mqd_sw_init(struct amdgpu_device *adev,struct amdgpu_ring *ring = &kiq->ring;u32 domain =AMDGPU_GEM_DOMAIN_GTT ; +#if !defined(CONFIG_ARM ) && !defined(CONFIG_ARM64 )/* Only enable on gfx10 and 11 for now to avoid changing behavior on older chips */ if (adev->ip_versions[GC_HWIP ][0 ] >=IP_VERSION (10 ,0 ,0 )) domain |=AMDGPU_GEM_DOMAIN_VRAM ; +#endif /* create MQD for KIQ */ if (!adev->enable_mes_kiq && !ring->mqd_obj) {
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 494/550 pwm: sti: Reduce number of allocations and drop usage of chip_data
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
[ Upstream commit 2d6812b41e0d832919d72c72ebddf361df53ba1b ]
Instead of using one allocation per capture channel, use a single one. Also store it in driver data instead of chip data.
This has several advantages:
- driver data isn't cleared when pwm_put() is called
- Reduces memory fragmentation
Also register the pwm chip only after the per capture channel data is initialized as the capture callback relies on this initialization and it might be called even before pwmchip_add() returns.
It would be still better to have struct sti_pwm_compat_data and the per-channel data struct sti_cpt_ddata in a single memory chunk, but that's not easily possible because the number of capture channels isn't known yet when the driver data struct is allocated.
--- drivers/pwm/pwm-sti.c | 29 ++++++++++++++--------------- 1 file changed, 14 insertions(+), 15 deletions(-)
drivers/pwm/pwm-sti.c +14 -15
@@ -79,6 +79,7 @@ struct sti_pwm_compat_data {unsigned int cpt_num_devs;unsigned int max_pwm_cnt;unsigned int max_prescale; +struct sti_cpt_ddata *ddata; };struct sti_pwm_chip {
@@ -314,7 +315,7 @@ static int sti_pwm_capture(struct pwm_chip *chip, struct pwm_device *pwm, {struct sti_pwm_chip *pc =to_sti_pwmchip (chip);struct sti_pwm_compat_data *cdata = pc->cdata; -struct sti_cpt_ddata *ddata =pwm_get_chip_data (pwm); +struct sti_cpt_ddata *ddata = &cdata->ddata[pwm->hwpwm];struct device *dev = pc->dev;unsigned int effective_ticks;unsigned long long high, low;
@@ -440,7 +441,7 @@ static irqreturn_t sti_pwm_interrupt(int irq, void *data)while (cpt_int_stat) { devicenum =ffs (cpt_int_stat) -1 ; - ddata =pwm_get_chip_data (&pc->chip.pwms[devicenum]); + ddata = &pc->cdata->ddata[devicenum];/* * Capture input:
@@ -638,30 +639,28 @@ static int sti_pwm_probe(struct platform_device *pdev)dev_err (dev,"failed to prepare clock\n" );return ret; } + + cdata->ddata =devm_kzalloc (dev, cdata->cpt_num_devs *sizeof (*cdata->ddata),GFP_KERNEL ); +if (!cdata->ddata) +return -ENOMEM ; } pc->chip.dev = dev; pc->chip.ops = &sti_pwm_ops; pc->chip.npwm = pc->cdata->pwm_num_devs; - ret =pwmchip_add (&pc->chip); -if (ret <0 ) { -clk_unprepare (pc->pwm_clk); -clk_unprepare (pc->cpt_clk); -return ret; - } -for (i =0 ; i < cdata->cpt_num_devs; i++) { -struct sti_cpt_ddata *ddata; - - ddata =devm_kzalloc (dev,sizeof (*ddata),GFP_KERNEL ); -if (!ddata) -return -ENOMEM ; +struct sti_cpt_ddata *ddata = &cdata->ddata[i];init_waitqueue_head (&ddata->wait);mutex_init (&ddata->lock); + } -pwm_set_chip_data (&pc->chip.pwms[i], ddata); + ret =pwmchip_add (&pc->chip); +if (ret <0 ) { +clk_unprepare (pc->pwm_clk); +clk_unprepare (pc->cpt_clk); +return ret; }platform_set_drvdata (pdev, pc);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 495/550 pwm: brcmstb: Utilize appropriate clock APIs in suspend/resume
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fainelli <[email protected]>
[ Upstream commit e9bc4411548aaa738905d37851a0146c16b3bb21 ]
The suspend/resume functions currently utilize clk_disable()/clk_enable() respectively which may be no-ops with certain clock providers such as SCMI. Fix this to use clk_disable_unprepare() and clk_prepare_enable() respectively as we should.
--- drivers/pwm/pwm-brcmstb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pwm/pwm-brcmstb.c +2 -2
@@ -288,7 +288,7 @@ static int brcmstb_pwm_suspend(struct device *dev) {struct brcmstb_pwm *p =dev_get_drvdata (dev); -clk_disable (p->clk); +clk_disable_unprepare (p->clk);return 0 ; }
@@ -297,7 +297,7 @@ static int brcmstb_pwm_resume(struct device *dev) {struct brcmstb_pwm *p =dev_get_drvdata (dev); -clk_enable (p->clk); +clk_prepare_enable (p->clk);return 0 ; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 496/550 Input: synaptics-rmi4 - fix use after free in rmi_unregister_function()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit eb988e46da2e4eae89f5337e047ce372fe33d5b1 ]
The put_device() calls rmi_release_function() which frees "fn" so the dereference on the next line "fn->num_of_irqs" is a use after free. Move the put_device() to the end to fix this.
--- drivers/input/rmi4/rmi_bus.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/input/rmi4/rmi_bus.c +1 -1
@@ -277,11 +277,11 @@ void rmi_unregister_function(struct rmi_function *fn)device_del (&fn->dev);of_node_put (fn->dev.of_node); -put_device (&fn->dev);for (i =0 ; i < fn->num_of_irqs; i++)irq_dispose_mapping (fn->irq[i]); +put_device (&fn->dev); }/**
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 497/550 watchdog: ixp4xx: Make sure restart always works
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <[email protected]>
[ Upstream commit b4075ecfe348a44209534c75ad72392c63a489a6 ]
The IXP4xx watchdog in early "A0" silicon is unreliable and cannot be registered, however for some systems such as the USRobotics USR8200 the watchdog is the only restart option, so implement a "dummy" watchdog that can only support restart in this case.
--- drivers/watchdog/ixp4xx_wdt.c | 28 +++++++++++++++++++++++++--- 1 file changed, 25 insertions(+), 3 deletions(-)
drivers/watchdog/ixp4xx_wdt.c +25 -3
@@ -105,6 +105,25 @@ static const struct watchdog_ops ixp4xx_wdt_ops = { .owner = THIS_MODULE, }; +/* +* The A0 version of the IXP422 had a bug in the watchdog making +* is useless, but we still need to use it to restart the system +* as it is the only way, so in this special case we register a +* "dummy" watchdog that doesn't really work, but will support +* the restart operation. +*/ +static int ixp4xx_wdt_dummy (struct watchdog_device *wdd) +{ +return 0 ; +} + +static const struct watchdog_ops ixp4xx_wdt_restart_only_ops = { + .start = ixp4xx_wdt_dummy, + .stop = ixp4xx_wdt_dummy, + .restart = ixp4xx_wdt_restart, + .owner =THIS_MODULE , +}; +static const struct watchdog_info ixp4xx_wdt_info = { .options =WDIOF_KEEPALIVEPING |WDIOF_MAGICCLOSE
@@ -114,14 +133,17 @@ static const struct watchdog_info ixp4xx_wdt_info = {static int ixp4xx_wdt_probe (struct platform_device *pdev) { +static const struct watchdog_ops *iwdt_ops;struct device *dev = &pdev->dev;struct ixp4xx_wdt *iwdt;struct clk *clk;int ret;if (!(read_cpuid_id () &0xf ) && !cpu_is_ixp46x ()) { -dev_err (dev,"Rev. A0 IXP42x CPU detected - watchdog disabled\n" ); -return -ENODEV ; +dev_info (dev,"Rev. A0 IXP42x CPU detected - only restart supported\n" ); + iwdt_ops = &ixp4xx_wdt_restart_only_ops; + }else { + iwdt_ops = &ixp4xx_wdt_ops; } iwdt =devm_kzalloc (dev,sizeof (*iwdt),GFP_KERNEL );
@@ -141,7 +163,7 @@ static int ixp4xx_wdt_probe(struct platform_device *pdev) iwdt->rate =IXP4XX_TIMER_FREQ ; iwdt->wdd.info = &ixp4xx_wdt_info; - iwdt->wdd.ops = &ixp4xx_wdt_ops; + iwdt->wdd.ops = iwdt_ops; iwdt->wdd.min_timeout =1 ; iwdt->wdd.max_timeout =U32_MAX / iwdt->rate; iwdt->wdd.parent = dev;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 498/550 llc: verify mac len before reading mac header
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Willem de Bruijn <[email protected]>
[ Upstream commit 7b3ba18703a63f6fd487183b9262b08e5632da1b ]
LLC reads the mac header with eth_hdr without verifying that the skb has an Ethernet header.
Syzbot was able to enter llc_rcv on a tun device. Tun can insert packets without mac len and with user configurable skb->protocol (passing a tun_pi header when not configuring IFF_NO_PI).
BUG: KMSAN: uninit-value in llc_station_ac_send_test_r net/llc/llc_station.c:81 [inline]
BUG: KMSAN: uninit-value in llc_station_rcv+0x6fb/0x1290 net/llc/llc_station.c:111
llc_station_ac_send_test_r net/llc/llc_station.c:81 [inline]
llc_station_rcv+0x6fb/0x1290 net/llc/llc_station.c:111
llc_rcv+0xc5d/0x14a0 net/llc/llc_input.c:218
__netif_receive_skb_one_core net/core/dev.c:5523 [inline]
__netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5637
netif_receive_skb_internal net/core/dev.c:5723 [inline]
netif_receive_skb+0x58/0x660 net/core/dev.c:5782
tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1555
tun_get_user+0x54c5/0x69c0 drivers/net/tun.c:2002Add a mac_len test before all three eth_hdr(skb) calls under net/llc.
There are further uses in include/net/llc_pdu.h. All these are protected by a test skb->protocol == ETH_P_802_2. Which does not protect against this tun scenario.
But the mac_len test added in this patch in llc_fixup_skb will indirectly protect those too. That is called from llc_rcv before any other LLC code.
It is tempting to just add a blanket mac_len check in llc_rcv, but not sure whether that could break valid LLC paths that do not assume an Ethernet header. 802.2 LLC may be used on top of non-802.3 protocols in principle. The below referenced commit shows that used to, on top of Token Ring.
At least one of the three eth_hdr uses goes back to before the start of git history. But the one that syzbot exercises is introduced in this commit. That commit is old enough (2008), that effectively all stable kernels should receive this.
--- net/llc/llc_input.c | 10 ++++++++-- net/llc/llc_s_ac.c | 3 +++ net/llc/llc_station.c | 3 +++ 3 files changed, 14 insertions(+), 2 deletions(-)
net/llc/llc_input.c +8 -2
@@ -127,8 +127,14 @@ static inline int llc_fixup_skb(struct sk_buff *skb) skb->transport_header += llc_len;skb_pull (skb, llc_len);if (skb->protocol ==htons (ETH_P_802_2 )) { -__be16 pdulen =eth_hdr (skb)->h_proto; -s32 data_size =ntohs (pdulen) - llc_len; +__be16 pdulen; +s32 data_size; + +if (skb->mac_len <ETH_HLEN ) +return 0 ; + + pdulen =eth_hdr (skb)->h_proto; + data_size =ntohs (pdulen) - llc_len;if (data_size <0 || !pskb_may_pull (skb, data_size))
net/llc/llc_s_ac.c +3 -0
@@ -153,6 +153,9 @@ int llc_sap_action_send_test_r(struct llc_sap *sap, struct sk_buff *skb)int rc =1 ;u32 data_size; +if (skb->mac_len <ETH_HLEN ) +return 1 ; +llc_pdu_decode_sa (skb, mac_da);llc_pdu_decode_da (skb, mac_sa);llc_pdu_decode_ssap (skb, &dsap);
net/llc/llc_station.c +3 -0
@@ -76,6 +76,9 @@ static int llc_station_ac_send_test_r(struct sk_buff *skb)u32 data_size;struct sk_buff *nskb; +if (skb->mac_len <ETH_HLEN ) + goto out; +/* The test request command is type U (llc_len = 3) */ data_size =ntohs (eth_hdr (skb)->h_proto) -3 ; nskb =llc_alloc_frame (NULL , skb->dev,LLC_PDU_TYPE_U , data_size);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 499/550 hsr: Prevent use after free in prp_create_tagged_frame()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 876f8ab52363f649bcc74072157dfd7adfbabc0d ]
The prp_fill_rct() function can fail. In that situation, it frees the skb and returns NULL. Meanwhile on the success path, it returns the original skb. So it's straight forward to fix bug by using the returned value.
--- net/hsr/hsr_forward.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
net/hsr/hsr_forward.c +1 -3
@@ -342,9 +342,7 @@ struct sk_buff *prp_create_tagged_frame(struct hsr_frame_info *frame, skb =skb_copy_expand (frame->skb_std,0 ,skb_tailroom (frame->skb_std) +HSR_HLEN ,GFP_ATOMIC ); -prp_fill_rct (skb, frame, port); - -return skb; +return prp_fill_rct (skb, frame, port); } static void hsr_deliver_master(struct sk_buff *skb, struct net_device *dev,
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 500/550 tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shigeru Yoshida <[email protected]>
[ Upstream commit 19b3f72a41a8751e26bffc093bb7e1cef29ad579 ]
syzbot reported the following uninit-value access issue [1]:
=====================================================
BUG: KMSAN: uninit-value in strlen lib/string.c:418 [inline] BUG: KMSAN: uninit-value in strstr+0xb8/0x2f0 lib/string.c:756 strlen lib/string.c:418 [inline] strstr+0xb8/0x2f0 lib/string.c:756 tipc_nl_node_reset_link_stats+0x3ea/0xb50 net/tipc/node.c:2595 genl_family_rcv_msg_doit net/netlink/genetlink.c:971 [inline] genl_family_rcv_msg net/netlink/genetlink.c:1051 [inline] genl_rcv_msg+0x11ec/0x1290 net/netlink/genetlink.c:1066 netlink_rcv_skb+0x371/0x650 net/netlink/af_netlink.c:2545 genl_rcv+0x40/0x60 net/netlink/genetlink.c:1075 netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline] netlink_unicast+0xf47/0x1250 net/netlink/af_netlink.c:1368 netlink_sendmsg+0x1238/0x13d0 net/netlink/af_netlink.c:1910 sock_sendmsg_nosec net/socket.c:730 [inline] sock_sendmsg net/socket.c:753 [inline] ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2541 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2595 __sys_sendmsg net/socket.c:2624 [inline] __do_sys_sendmsg net/socket.c:2633 [inline] __se_sys_sendmsg net/socket.c:2631 [inline] __x64_sys_sendmsg+0x307/0x490 net/socket.c:2631 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
Uninit was created at:
slab_post_alloc_hook+0x12f/0xb70 mm/slab.h:767 slab_alloc_node mm/slub.c:3478 [inline] kmem_cache_alloc_node+0x577/0xa80 mm/slub.c:3523 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:559 __alloc_skb+0x318/0x740 net/core/skbuff.c:650 alloc_skb include/linux/skbuff.h:1286 [inline] netlink_alloc_large_skb net/netlink/af_netlink.c:1214 [inline] netlink_sendmsg+0xb34/0x13d0 net/netlink/af_netlink.c:1885 sock_sendmsg_nosec net/socket.c:730 [inline] sock_sendmsg net/socket.c:753 [inline] ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2541 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2595 __sys_sendmsg net/socket.c:2624 [inline] __do_sys_sendmsg net/socket.c:2633 [inline] __se_sys_sendmsg net/socket.c:2631 [inline] __x64_sys_sendmsg+0x307/0x490 net/socket.c:2631 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
TIPC bearer-related names including link names must be null-terminated strings. If a link name which is not null-terminated is passed through netlink, strstr() and similar functions can cause buffer overrun. This causes the above issue.
This patch changes the nla_policy for bearer-related names from NLA_STRING to NLA_NUL_STRING. This resolves the issue by ensuring that only null-terminated strings are accepted as bearer-related names.
syzbot reported similar uninit-value issue related to bearer names [2]. The root cause of this issue is that a non-null-terminated bearer name was passed. This patch also resolved this issue.
--- net/tipc/netlink.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/tipc/netlink.c +2 -2
@@ -88,7 +88,7 @@ const struct nla_policy tipc_nl_net_policy[TIPC_NLA_NET_MAX + 1] = {const struct nla_policy tipc_nl_link_policy[TIPC_NLA_LINK_MAX +1 ] = { [TIPC_NLA_LINK_UNSPEC ] = { .type =NLA_UNSPEC }, - [TIPC_NLA_LINK_NAME ] = { .type =NLA_STRING , + [TIPC_NLA_LINK_NAME ] = { .type =NLA_NUL_STRING , .len =TIPC_MAX_LINK_NAME }, [TIPC_NLA_LINK_MTU ] = { .type =NLA_U32 }, [TIPC_NLA_LINK_BROADCAST ] = { .type =NLA_FLAG },
@@ -125,7 +125,7 @@ const struct nla_policy tipc_nl_prop_policy[TIPC_NLA_PROP_MAX + 1] = {const struct nla_policy tipc_nl_bearer_policy[TIPC_NLA_BEARER_MAX +1 ] = { [TIPC_NLA_BEARER_UNSPEC ] = { .type =NLA_UNSPEC }, - [TIPC_NLA_BEARER_NAME ] = { .type =NLA_STRING , + [TIPC_NLA_BEARER_NAME ] = { .type =NLA_NUL_STRING , .len =TIPC_MAX_BEARER_NAME }, [TIPC_NLA_BEARER_PROP ] = { .type =NLA_NESTED }, [TIPC_NLA_BEARER_DOMAIN ] = { .type =NLA_U32 }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 501/550 rxrpc: Fix two connection reaping bugs
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
[ Upstream commit 61e4a86600029e6e8d468d1fad6b6c749bebed19 ]
Fix two connection reaping bugs:
(1) rxrpc_connection_expiry is in units of seconds, so rxrpc_disconnect_call() needs to multiply it by HZ when adding it to jiffies.
(2) rxrpc_client_conn_reap_timeout() should set RXRPC_CLIENT_REAP_TIMER if local->kill_all_client_conns is clear, not if it is set (in which case we don't need the timer). Without this, old client connections don't get cleaned up until the local endpoint is cleaned up.
--- net/rxrpc/conn_object.c | 2 +- net/rxrpc/local_object.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
net/rxrpc/conn_object.c +1 -1
@@ -212,7 +212,7 @@ void rxrpc_disconnect_call(struct rxrpc_call *call) conn->idle_timestamp = jiffies;if (atomic_dec_and_test (&conn->active))rxrpc_set_service_reap_timer (conn->rxnet, - jiffies + rxrpc_connection_expiry); + jiffies + rxrpc_connection_expiry *HZ ); }rxrpc_put_call (call, rxrpc_call_put_io_thread);
net/rxrpc/local_object.c +1 -1
@@ -87,7 +87,7 @@ static void rxrpc_client_conn_reap_timeout(struct timer_list *timer)struct rxrpc_local *local = container_of(timer, struct rxrpc_local, client_conn_reap_timer); -if (local->kill_all_client_conns && +if (!local->kill_all_client_conns &&test_and_set_bit (RXRPC_CLIENT_CONN_REAP_TIMER , &local->client_conn_flags))rxrpc_wake_up_io_thread (local); }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 502/550 bpf: Check map->usercnt after timer->timer is assigned
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hou Tao <[email protected]>
[ Upstream commit fd381ce60a2d79cc967506208085336d3d268ae0 ]
When there are concurrent uref release and bpf timer init operations, the following sequence diagram is possible. It will break the guarantee provided by bpf_timer: bpf_timer will still be alive after userspace application releases or unpins the map. It also will lead to kmemleak for old kernel version which doesn't release bpf_timer when map is released.
bpf program X:
bpf_timer_init()
lock timer->lock
read timer->timer as NULL
read map->usercnt != 0
process Y:
close(map_fd)
// put last uref
bpf_map_put_uref()
atomic_dec_and_test(map->usercnt)
array_map_free_timers()
bpf_timer_cancel_and_free()
// just return
read timer->timer is NULL
t = bpf_map_kmalloc_node()
timer->timer = t unlock timer->lock
Fix the problem by checking map->usercnt after timer->timer is assigned, so when there are concurrent uref release and bpf timer init, either bpf_timer_cancel_and_free() from uref release reads a no-NULL timer or the newly-added atomic64_read() returns a zero usercnt.
Because atomic_dec_and_test(map->usercnt) and READ_ONCE(timer->timer) in bpf_timer_cancel_and_free() are not protected by a lock, so add a memory barrier to guarantee the order between map->usercnt and timer->timer. Also use WRITE_ONCE(timer->timer, x) to match the lockless read of timer->timer in bpf_timer_cancel_and_free().
--- kernel/bpf/helpers.c | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-)
kernel/bpf/helpers.c +16 -9
@@ -1174,13 +1174,6 @@ BPF_CALL_3(bpf_timer_init, struct bpf_timer_kern *, timer, struct bpf_map *, map ret = -EBUSY ; goto out; } -if (!atomic64_read (&map->usercnt)) { -/* maps with timers must be either held by user space -* or pinned in bpffs. -*/ - ret = -EPERM ; - goto out; - }/* allocate hrtimer via map_kmalloc to use memcg accounting */ t =bpf_map_kmalloc_node (map,sizeof (*t),GFP_ATOMIC , map->numa_node);if (!t) {
@@ -1193,7 +1186,21 @@ BPF_CALL_3(bpf_timer_init, struct bpf_timer_kern *, timer, struct bpf_map *, maprcu_assign_pointer (t->callback_fn,NULL );hrtimer_init (&t->timer, clockid,HRTIMER_MODE_REL_SOFT ); t->timer.function = bpf_timer_cb; - timer->timer = t; +WRITE_ONCE (timer->timer, t); +/* Guarantee the order between timer->timer and map->usercnt. So +* when there are concurrent uref release and bpf timer init, either +* bpf_timer_cancel_and_free() called by uref release reads a no-NULL +* timer or atomic64_read() below returns a zero usercnt. +*/ +smp_mb (); +if (!atomic64_read (&map->usercnt)) { +/* maps with timers must be either held by user space +* or pinned in bpffs. +*/ +WRITE_ONCE (timer->timer,NULL ); +kfree (t); + ret = -EPERM ; + } out:__bpf_spin_unlock_irqrestore (&timer->lock);return ret;
@@ -1368,7 +1375,7 @@ void bpf_timer_cancel_and_free(void *val)/* The subsequent bpf_timer_start/cancel() helpers won't be able to use * this timer, since it won't be initialized. */ - timer->timer =NULL ; +WRITE_ONCE (timer->timer,NULL ); out:__bpf_spin_unlock_irqrestore (&timer->lock);if (!t)
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 503/550 inet: shrink struct flowi_common
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 1726483b79a72e0150734d5367e4a0238bf8fcff ]
I am looking at syzbot reports triggering kernel stack overflows involving a cascade of ipvlan devices.
We can save 8 bytes in struct flowi_common.
This patch alone will not fix the issue, but is a start.
--- include/net/flow.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/net/flow.h +1 -1
@@ -40,8 +40,8 @@ struct flowi_common {#define FLOWI_FLAG_KNOWN_NH 0x02__u32 flowic_secid;kuid_t flowic_uid; -struct flowi_tunnel flowic_tun_key;__u32 flowic_multipath_hash; +struct flowi_tunnel flowic_tun_key; };union flowi_uli {
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 504/550 octeontx2-pf: Fix error codes
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ratheesh Kannoth <[email protected]>
[ Upstream commit 96b9a68d1a6e4f889d453874c9e359aa720b520f ]
Some of error codes were wrong. Fix the same.
--- .../marvell/octeontx2/nic/otx2_struct.h | 34 +++++++++---------- 1 file changed, 17 insertions(+), 17 deletions(-)
drivers/net/ethernet/marvell/octeontx2/nic/otx2_struct.h +17 -17
@@ -318,23 +318,23 @@ enum nix_snd_status_e {NIX_SND_STATUS_EXT_ERR =0x6 ,NIX_SND_STATUS_JUMP_FAULT =0x7 ,NIX_SND_STATUS_JUMP_POISON =0x8 , -NIX_SND_STATUS_CRC_ERR =0x9 , -NIX_SND_STATUS_IMM_ERR =0x10 , -NIX_SND_STATUS_SG_ERR =0x11 , -NIX_SND_STATUS_MEM_ERR =0x12 , -NIX_SND_STATUS_INVALID_SUBDC =0x13 , -NIX_SND_STATUS_SUBDC_ORDER_ERR =0x14 , -NIX_SND_STATUS_DATA_FAULT =0x15 , -NIX_SND_STATUS_DATA_POISON =0x16 , -NIX_SND_STATUS_NPC_DROP_ACTION =0x17 , -NIX_SND_STATUS_LOCK_VIOL =0x18 , -NIX_SND_STATUS_NPC_UCAST_CHAN_ERR =0x19 , -NIX_SND_STATUS_NPC_MCAST_CHAN_ERR =0x20 , -NIX_SND_STATUS_NPC_MCAST_ABORT =0x21 , -NIX_SND_STATUS_NPC_VTAG_PTR_ERR =0x22 , -NIX_SND_STATUS_NPC_VTAG_SIZE_ERR =0x23 , -NIX_SND_STATUS_SEND_MEM_FAULT =0x24 , -NIX_SND_STATUS_SEND_STATS_ERR =0x25 , +NIX_SND_STATUS_CRC_ERR =0x10 , +NIX_SND_STATUS_IMM_ERR =0x11 , +NIX_SND_STATUS_SG_ERR =0x12 , +NIX_SND_STATUS_MEM_ERR =0x13 , +NIX_SND_STATUS_INVALID_SUBDC =0x14 , +NIX_SND_STATUS_SUBDC_ORDER_ERR =0x15 , +NIX_SND_STATUS_DATA_FAULT =0x16 , +NIX_SND_STATUS_DATA_POISON =0x17 , +NIX_SND_STATUS_NPC_DROP_ACTION =0x20 , +NIX_SND_STATUS_LOCK_VIOL =0x21 , +NIX_SND_STATUS_NPC_UCAST_CHAN_ERR =0x22 , +NIX_SND_STATUS_NPC_MCAST_CHAN_ERR =0x23 , +NIX_SND_STATUS_NPC_MCAST_ABORT =0x24 , +NIX_SND_STATUS_NPC_VTAG_PTR_ERR =0x25 , +NIX_SND_STATUS_NPC_VTAG_SIZE_ERR =0x26 , +NIX_SND_STATUS_SEND_MEM_FAULT =0x27 , +NIX_SND_STATUS_SEND_STATS_ERR =0x28 , NIX_SND_STATUS_MAX, };
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 505/550 octeontx2-pf: Fix holes in error code
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ratheesh Kannoth <[email protected]>
[ Upstream commit 7aeeb2cb7a2570bb69a87ad14018b03e06ce5be5 ]
Error code strings are not getting printed properly due to holes. Print error code as well.
--- .../ethernet/marvell/octeontx2/nic/otx2_pf.c | 80 +++++++++++-------- 1 file changed, 46 insertions(+), 34 deletions(-)
drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +46 -34
@@ -1192,31 +1192,32 @@ static char *nix_mnqerr_e_str[NIX_MNQERR_MAX] = { };static char *nix_snd_status_e_str[NIX_SND_STATUS_MAX ] = { -"NIX_SND_STATUS_GOOD" , -"NIX_SND_STATUS_SQ_CTX_FAULT" , -"NIX_SND_STATUS_SQ_CTX_POISON" , -"NIX_SND_STATUS_SQB_FAULT" , -"NIX_SND_STATUS_SQB_POISON" , -"NIX_SND_STATUS_HDR_ERR" , -"NIX_SND_STATUS_EXT_ERR" , -"NIX_SND_STATUS_JUMP_FAULT" , -"NIX_SND_STATUS_JUMP_POISON" , -"NIX_SND_STATUS_CRC_ERR" , -"NIX_SND_STATUS_IMM_ERR" , -"NIX_SND_STATUS_SG_ERR" , -"NIX_SND_STATUS_MEM_ERR" , -"NIX_SND_STATUS_INVALID_SUBDC" , -"NIX_SND_STATUS_SUBDC_ORDER_ERR" , -"NIX_SND_STATUS_DATA_FAULT" , -"NIX_SND_STATUS_DATA_POISON" , -"NIX_SND_STATUS_NPC_DROP_ACTION" , -"NIX_SND_STATUS_LOCK_VIOL" , -"NIX_SND_STATUS_NPC_UCAST_CHAN_ERR" , -"NIX_SND_STATUS_NPC_MCAST_CHAN_ERR" , -"NIX_SND_STATUS_NPC_MCAST_ABORT" , -"NIX_SND_STATUS_NPC_VTAG_PTR_ERR" , -"NIX_SND_STATUS_NPC_VTAG_SIZE_ERR" , -"NIX_SND_STATUS_SEND_STATS_ERR" , + [NIX_SND_STATUS_GOOD ] ="NIX_SND_STATUS_GOOD" , + [NIX_SND_STATUS_SQ_CTX_FAULT ] ="NIX_SND_STATUS_SQ_CTX_FAULT" , + [NIX_SND_STATUS_SQ_CTX_POISON ] ="NIX_SND_STATUS_SQ_CTX_POISON" , + [NIX_SND_STATUS_SQB_FAULT ] ="NIX_SND_STATUS_SQB_FAULT" , + [NIX_SND_STATUS_SQB_POISON ] ="NIX_SND_STATUS_SQB_POISON" , + [NIX_SND_STATUS_HDR_ERR ] ="NIX_SND_STATUS_HDR_ERR" , + [NIX_SND_STATUS_EXT_ERR ] ="NIX_SND_STATUS_EXT_ERR" , + [NIX_SND_STATUS_JUMP_FAULT ] ="NIX_SND_STATUS_JUMP_FAULT" , + [NIX_SND_STATUS_JUMP_POISON ] ="NIX_SND_STATUS_JUMP_POISON" , + [NIX_SND_STATUS_CRC_ERR ] ="NIX_SND_STATUS_CRC_ERR" , + [NIX_SND_STATUS_IMM_ERR ] ="NIX_SND_STATUS_IMM_ERR" , + [NIX_SND_STATUS_SG_ERR ] ="NIX_SND_STATUS_SG_ERR" , + [NIX_SND_STATUS_MEM_ERR ] ="NIX_SND_STATUS_MEM_ERR" , + [NIX_SND_STATUS_INVALID_SUBDC ] ="NIX_SND_STATUS_INVALID_SUBDC" , + [NIX_SND_STATUS_SUBDC_ORDER_ERR ] ="NIX_SND_STATUS_SUBDC_ORDER_ERR" , + [NIX_SND_STATUS_DATA_FAULT ] ="NIX_SND_STATUS_DATA_FAULT" , + [NIX_SND_STATUS_DATA_POISON ] ="NIX_SND_STATUS_DATA_POISON" , + [NIX_SND_STATUS_NPC_DROP_ACTION ] ="NIX_SND_STATUS_NPC_DROP_ACTION" , + [NIX_SND_STATUS_LOCK_VIOL ] ="NIX_SND_STATUS_LOCK_VIOL" , + [NIX_SND_STATUS_NPC_UCAST_CHAN_ERR ] ="NIX_SND_STAT_NPC_UCAST_CHAN_ERR" , + [NIX_SND_STATUS_NPC_MCAST_CHAN_ERR ] ="NIX_SND_STAT_NPC_MCAST_CHAN_ERR" , + [NIX_SND_STATUS_NPC_MCAST_ABORT ] ="NIX_SND_STATUS_NPC_MCAST_ABORT" , + [NIX_SND_STATUS_NPC_VTAG_PTR_ERR ] ="NIX_SND_STATUS_NPC_VTAG_PTR_ERR" , + [NIX_SND_STATUS_NPC_VTAG_SIZE_ERR ] ="NIX_SND_STATUS_NPC_VTAG_SIZE_ERR" , + [NIX_SND_STATUS_SEND_MEM_FAULT ] ="NIX_SND_STATUS_SEND_MEM_FAULT" , + [NIX_SND_STATUS_SEND_STATS_ERR ] ="NIX_SND_STATUS_SEND_STATS_ERR" , };static irqreturn_t otx2_q_intr_handler (int irq,void *data)
@@ -1237,14 +1238,16 @@ static irqreturn_t otx2_q_intr_handler(int irq, void *data)continue ;if (val &BIT_ULL (42 )) { -netdev_err (pf->netdev,"CQ%lld: error reading NIX_LF_CQ_OP_INT, NIX_LF_ERR_INT 0x%llx\n" , +netdev_err (pf->netdev, +"CQ%lld: error reading NIX_LF_CQ_OP_INT, NIX_LF_ERR_INT 0x%llx\n" , qidx,otx2_read64 (pf,NIX_LF_ERR_INT )); }else {if (val &BIT_ULL (NIX_CQERRINT_DOOR_ERR ))netdev_err (pf->netdev,"CQ%lld: Doorbell error" , qidx);if (val &BIT_ULL (NIX_CQERRINT_CQE_FAULT )) -netdev_err (pf->netdev,"CQ%lld: Memory fault on CQE write to LLC/DRAM" , +netdev_err (pf->netdev, +"CQ%lld: Memory fault on CQE write to LLC/DRAM" , qidx); }
@@ -1271,7 +1274,8 @@ static irqreturn_t otx2_q_intr_handler(int irq, void *data) (val & NIX_SQINT_BITS));if (val &BIT_ULL (42 )) { -netdev_err (pf->netdev,"SQ%lld: error reading NIX_LF_SQ_OP_INT, NIX_LF_ERR_INT 0x%llx\n" , +netdev_err (pf->netdev, +"SQ%lld: error reading NIX_LF_SQ_OP_INT, NIX_LF_ERR_INT 0x%llx\n" , qidx,otx2_read64 (pf,NIX_LF_ERR_INT )); goto done; }
@@ -1281,8 +1285,11 @@ static irqreturn_t otx2_q_intr_handler(int irq, void *data) goto chk_mnq_err_dbg; sq_op_err_code =FIELD_GET (GENMASK (7 ,0 ), sq_op_err_dbg); -netdev_err (pf->netdev,"SQ%lld: NIX_LF_SQ_OP_ERR_DBG(%llx) err=%s\n" , - qidx, sq_op_err_dbg, nix_sqoperr_e_str[sq_op_err_code]); +netdev_err (pf->netdev, +"SQ%lld: NIX_LF_SQ_OP_ERR_DBG(0x%llx) err=%s(%#x)\n" , + qidx, sq_op_err_dbg, + nix_sqoperr_e_str[sq_op_err_code], + sq_op_err_code);otx2_write64 (pf,NIX_LF_SQ_OP_ERR_DBG ,BIT_ULL (44 ));
@@ -1299,16 +1306,21 @@ static irqreturn_t otx2_q_intr_handler(int irq, void *data) goto chk_snd_err_dbg; mnq_err_code =FIELD_GET (GENMASK (7 ,0 ), mnq_err_dbg); -netdev_err (pf->netdev,"SQ%lld: NIX_LF_MNQ_ERR_DBG(%llx) err=%s\n" , - qidx, mnq_err_dbg, nix_mnqerr_e_str[mnq_err_code]); +netdev_err (pf->netdev, +"SQ%lld: NIX_LF_MNQ_ERR_DBG(0x%llx) err=%s(%#x)\n" , + qidx, mnq_err_dbg, nix_mnqerr_e_str[mnq_err_code], + mnq_err_code);otx2_write64 (pf,NIX_LF_MNQ_ERR_DBG ,BIT_ULL (44 )); chk_snd_err_dbg: snd_err_dbg =otx2_read64 (pf,NIX_LF_SEND_ERR_DBG );if (snd_err_dbg &BIT (44 )) { snd_err_code =FIELD_GET (GENMASK (7 ,0 ), snd_err_dbg); -netdev_err (pf->netdev,"SQ%lld: NIX_LF_SND_ERR_DBG:0x%llx err=%s\n" , - qidx, snd_err_dbg, nix_snd_status_e_str[snd_err_code]); +netdev_err (pf->netdev, +"SQ%lld: NIX_LF_SND_ERR_DBG:0x%llx err=%s(%#x)\n" , + qidx, snd_err_dbg, + nix_snd_status_e_str[snd_err_code], + snd_err_code);otx2_write64 (pf,NIX_LF_SEND_ERR_DBG ,BIT_ULL (44 )); }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 506/550 net: page_pool: add missing free_percpu when page_pool_init fail
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jian Shen <[email protected]>
[ Upstream commit 8ffbd1669ed1d58939d6e878dffaa2f60bf961a4 ]
When ptr_ring_init() returns failure in page_pool_init(), free_percpu() is not called to free pool->recycle_stats, which may cause memory leak.
--- net/core/page_pool.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
net/core/page_pool.c +5 -1
@@ -210,8 +210,12 @@ static int page_pool_init(struct page_pool *pool,return -ENOMEM ;#endif -if (ptr_ring_init (&pool->ring, ring_qsize,GFP_KERNEL ) <0 ) +if (ptr_ring_init (&pool->ring, ring_qsize,GFP_KERNEL ) <0 ) { +#ifdef CONFIG_PAGE_POOL_STATS +free_percpu (pool->recycle_stats); +#endif return -ENOMEM ; + }atomic_set (&pool->pages_state_release_cnt,0 );
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 507/550 dccp: Call security_inet_conn_request() after setting IPv4 addresses.
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit fa2df45af13091f76b89adb84a28f13818d5d631 ]
Initially, commit 4237c75c0a35 ("[MLSXFRM]: Auto-labeling of child sockets") introduced security_inet_conn_request() in some functions where reqsk is allocated. The hook is added just after the allocation, so reqsk's IPv4 remote address was not initialised then.
However, SELinux/Smack started to read it in netlbl_req_setattr() after the cited commits.
This bug was partially fixed by commit 284904aa7946 ("lsm: Relocate the IPv4 security_inet_conn_request() hooks").
This patch fixes the last bug in DCCPv4.
--- net/dccp/ipv4.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/dccp/ipv4.c +3 -3
@@ -630,9 +630,6 @@ int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb)if (dccp_parse_options (sk, dreq, skb)) goto drop_and_free; -if (security_inet_conn_request (sk, skb, req)) - goto drop_and_free; - ireq =inet_rsk (req);sk_rcv_saddr_set (req_to_sk (req),ip_hdr (skb)->daddr);sk_daddr_set (req_to_sk (req),ip_hdr (skb)->saddr);
@@ -640,6 +637,9 @@ int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb) ireq->ireq_family =AF_INET ; ireq->ir_iif =READ_ONCE (sk->sk_bound_dev_if); +if (security_inet_conn_request (sk, skb, req)) + goto drop_and_free; +/* * Step 3: Process LISTEN state *
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 508/550 dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses.
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 23be1e0e2a83a8543214d2599a31d9a2185a796b ]
Initially, commit 4237c75c0a35 ("[MLSXFRM]: Auto-labeling of child sockets") introduced security_inet_conn_request() in some functions where reqsk is allocated. The hook is added just after the allocation, so reqsk's IPv6 remote address was not initialised then.
However, SELinux/Smack started to read it in netlbl_req_setattr() after commit e1adea927080 ("calipso: Allow request sockets to be relabelled by the lsm.").
Commit 284904aa7946 ("lsm: Relocate the IPv4 security_inet_conn_request() hooks") fixed that kind of issue only in TCPv4 because IPv6 labeling was not supported at that time. Finally, the same issue was introduced again in IPv6.
Let's apply the same fix on DCCPv6 and TCPv6.
--- net/dccp/ipv6.c | 6 +++--- net/ipv6/syncookies.c | 7 ++++--- 2 files changed, 7 insertions(+), 6 deletions(-)
net/dccp/ipv6.c +3 -3
@@ -360,15 +360,15 @@ static int dccp_v6_conn_request(struct sock *sk, struct sk_buff *skb)if (dccp_parse_options (sk, dreq, skb)) goto drop_and_free; -if (security_inet_conn_request (sk, skb, req)) - goto drop_and_free; - ireq =inet_rsk (req); ireq->ir_v6_rmt_addr =ipv6_hdr (skb)->saddr; ireq->ir_v6_loc_addr =ipv6_hdr (skb)->daddr; ireq->ireq_family =AF_INET6 ; ireq->ir_mark =inet_request_mark (sk, skb); +if (security_inet_conn_request (sk, skb, req)) + goto drop_and_free; +if (ipv6_opt_accepted (sk, skb,IP6CB (skb)) || np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo || np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim) {
net/ipv6/syncookies.c +4 -3
@@ -180,14 +180,15 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb) treq =tcp_rsk (req); treq->tfo_listener = false; -if (security_inet_conn_request (sk, skb, req)) - goto out_free; - req->mss = mss; ireq->ir_rmt_port = th->source; ireq->ir_num =ntohs (th->dest); ireq->ir_v6_rmt_addr =ipv6_hdr (skb)->saddr; ireq->ir_v6_loc_addr =ipv6_hdr (skb)->daddr; + +if (security_inet_conn_request (sk, skb, req)) + goto out_free; +if (ipv6_opt_accepted (sk, skb, &TCP_SKB_CB (skb)->header.h6) || np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo || np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim) {
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 509/550 net: r8169: Disable multicast filter for RTL8168H and RTL8107E
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patrick Thompson <[email protected]>
[ Upstream commit efa5f1311c4998e9e6317c52bc5ee93b3a0f36df ]
RTL8168H and RTL8107E ethernet adapters erroneously filter unicast eapol packets unless allmulti is enabled. These devices correspond to RTL_GIGA_MAC_VER_46 and VER_48. Add an exception for VER_46 and VER_48 in the same way that VER_35 has an exception.
--- drivers/net/ethernet/realtek/r8169_main.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/realtek/r8169_main.c +3 -1
@@ -2584,7 +2584,9 @@ static void rtl_set_rx_mode(struct net_device *dev) rx_mode |= AcceptAllPhys; }else if (netdev_mc_count (dev) >MC_FILTER_LIMIT || dev->flags &IFF_ALLMULTI || - tp->mac_version ==RTL_GIGA_MAC_VER_35 ) { + tp->mac_version ==RTL_GIGA_MAC_VER_35 || + tp->mac_version ==RTL_GIGA_MAC_VER_46 || + tp->mac_version ==RTL_GIGA_MAC_VER_48 ) {/* accept all multicasts */ }else if (netdev_mc_empty (dev)) { rx_mode &= ~AcceptMulticast;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 510/550 Fix termination state for idr_for_each_entry_ul()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <[email protected]>
[ Upstream commit e8ae8ad479e2d037daa33756e5e72850a7bd37a9 ]
The comment for idr_for_each_entry_ul() states
after normal termination @entry is left with the value NULL
This is not correct in the case where UINT_MAX has an entry in the idr. In that case @entry will be non-NULL after termination.
No current code depends on the documentation being correct, but to save future code we should fix it.
Also fix idr_for_each_entry_continue_ul(). While this is not documented as leaving @entry as NULL, the mellanox driver appears to depend on it doing so. So make that explicit in the documentation as well as in the code.
--- include/linux/idr.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
include/linux/idr.h +4 -2
@@ -200,7 +200,7 @@ static inline void idr_preload_end(void)*/ #define idr_for_each_entry_ul (idr, entry, tmp, id) \ for (tmp = 0, id = 0; \ - tmp <= id && ((entry) = idr_get_next_ul(idr, &(id))) != NULL; \ + ((entry) = tmp <= id ? idr_get_next_ul(idr, &(id)) : NULL) != NULL; \ tmp = id, ++id)/**
@@ -224,10 +224,12 @@ static inline void idr_preload_end(void)* @id: Entry ID. * * Continue to iterate over entries, continuing after the current position. +* After normal termination @entry is left with the value NULL. This +* is convenient for a "not found" value. */ #define idr_for_each_entry_continue_ul (idr, entry, tmp, id) \ for (tmp = id; \ - tmp <= id && ((entry) = idr_get_next_ul(idr, &(id))) != NULL; \ + ((entry) = tmp <= id ? idr_get_next_ul(idr, &(id)) : NULL) != NULL; \ tmp = id, ++id)/*
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 511/550 net: stmmac: xgmac: Enable support for multiple Flexible PPS outputs
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Furong Xu <[email protected]>
[ Upstream commit db456d90a4c1b43b6251fa4348c8adc59b583274 ]
Quoted 1 line
From XGMAC Core 3.20 and later, each Flexible PPS has individual PPSEN bit
to select Fixed mode or Flexible mode. The PPSEN must be set, or it stays in Fixed PPS mode by default.
XGMAC Core prior 3.20, only PPSEN0(bit 4) is writable. PPSEN{1,2,3} are read-only reserved, and they are already in Flexible mode by default, our new code always set PPSEN{1,2,3} do not make things worse ;-)
--- drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h | 2 +- .../net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 14 +++++++++++++- 2 files changed, 14 insertions(+), 2 deletions(-)
drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h +1 -1
@@ -222,7 +222,7 @@ ((val) << XGMAC_PPS_MINIDX(x))#define XGMAC_PPSCMD_START 0x2#define XGMAC_PPSCMD_STOP 0x5 -#define XGMAC_PPSEN0 BIT(4) +#define XGMAC_PPSENx (x) BIT(4 + (x) * 8)#define XGMAC_PPSx_TARGET_TIME_SEC (x) (0x00000d80 + (x) * 0x10)#define XGMAC_PPSx_TARGET_TIME_NSEC (x) (0x00000d84 + (x) * 0x10)#define XGMAC_TRGTBUSY0 BIT(31)
drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c +13 -1
@@ -1138,7 +1138,19 @@ static int dwxgmac2_flex_pps_config(void __iomem *ioaddr, int index, val |=XGMAC_PPSCMDx (index,XGMAC_PPSCMD_START ); val |=XGMAC_TRGTMODSELx (index,XGMAC_PPSCMD_START ); - val |=XGMAC_PPSEN0 ; + +/* XGMAC Core has 4 PPS outputs at most. +* +* Prior XGMAC Core 3.20, Fixed mode or Flexible mode are selectable for +* PPS0 only via PPSEN0. PPS{1,2,3} are in Flexible mode by default, +* and can not be switched to Fixed mode, since PPSEN{1,2,3} are +* read-only reserved to 0. +* But we always set PPSEN{1,2,3} do not make things worse ;-) +* +* From XGMAC Core 3.20 and later, PPSEN{0,1,2,3} are writable and must +* be set, or the PPS outputs stay in Fixed PPS mode by default. +*/ + val |=XGMAC_PPSENx (index);writel (cfg->start.tv_sec, ioaddr +XGMAC_PPSx_TARGET_TIME_SEC (index));
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 512/550 selftests: pmtu.sh: fix result checking
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <[email protected]>
[ Upstream commit 63e201916b27260218e528a2f8758be47f99bbf4 ]
In the PMTU test, when all previous tests are skipped and the new test passes, the exit code is set to 0. However, the current check mistakenly treats this as an assignment, causing the check to pass every time.
Consequently, regardless of how many tests have failed, if the latest test passes, the PMTU test will report a pass.
--- tools/testing/selftests/net/pmtu.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/net/pmtu.sh +1 -1
@@ -2048,7 +2048,7 @@ run_test() { case $ret in 0) all_skipped=false - [ $exitcode=$ksft_skip ] && exitcode=0 + [ $exitcode -eq $ksft_skip ] && exitcode=0 ;; $ksft_skip) [ $all_skipped = true ] && exitcode=$ksft_skip
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 513/550 octeontx2-pf: Free pending and dropped SQEs
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geetha sowjanya <[email protected]>
[ Upstream commit 3423ca23e08bf285a324237abe88e7e7d9becfe6 ]
On interface down, the pending SQEs in the NIX get dropped or drained out during SMQ flush. But skb's pointed by these SQEs never get free or updated to the stack as respective CQE never get added.
This patch fixes the issue by freeing all valid skb's in SQ SG list.
--- .../marvell/octeontx2/nic/otx2_common.c | 15 +++---- .../marvell/octeontx2/nic/otx2_common.h | 1 + .../ethernet/marvell/octeontx2/nic/otx2_pf.c | 1 + .../marvell/octeontx2/nic/otx2_txrx.c | 42 +++++++++++++++++++ 4 files changed, 49 insertions(+), 10 deletions(-)
drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c +5 -10
@@ -816,7 +816,6 @@ void otx2_sqb_flush(struct otx2_nic *pfvf)int qidx, sqe_tail, sqe_head;struct otx2_snd_queue *sq;u64 incr, *ptr, val; -int timeout =1000 ; ptr = (u64 *)otx2_get_regaddr (pfvf,NIX_LF_SQ_OP_STATUS );for (qidx =0 ; qidx <otx2_get_total_tx_queues (pfvf); qidx++) {
@@ -825,15 +824,11 @@ void otx2_sqb_flush(struct otx2_nic *pfvf)continue ; incr = (u64 )qidx <<32 ; -while (timeout) { - val =otx2_atomic64_add (incr, ptr); - sqe_head = (val >>20 ) &0x3F ; - sqe_tail = (val >>28 ) &0x3F ; -if (sqe_head == sqe_tail) -break ; -usleep_range (1 ,3 ); - timeout--; - } + val =otx2_atomic64_add (incr, ptr); + sqe_head = (val >>20 ) &0x3F ; + sqe_tail = (val >>28 ) &0x3F ; +if (sqe_head != sqe_tail) +usleep_range (50 ,60 ); } }
drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h +1 -0
@@ -972,6 +972,7 @@ int otx2_txschq_config(struct otx2_nic *pfvf, int lvl, int prio, bool pfc_en);int otx2_txsch_alloc (struct otx2_nic *pfvf);void otx2_txschq_stop (struct otx2_nic *pfvf);void otx2_txschq_free_one (struct otx2_nic *pfvf,u16 lvl,u16 schq); +void otx2_free_pending_sqe (struct otx2_nic *pfvf);void otx2_sqb_flush (struct otx2_nic *pfvf);int otx2_alloc_rbuf (struct otx2_nic *pfvf,struct otx2_pool *pool,dma_addr_t *dma);
drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +1 -0
@@ -1600,6 +1600,7 @@ static void otx2_free_hw_resources(struct otx2_nic *pf)else otx2_cleanup_tx_cqes (pf, cq); } +otx2_free_pending_sqe (pf);otx2_free_sq_res (pf);
drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c +42 -0
69 lines not on this page · raw message
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 514/550 net/smc: fix dangling sock under state SMC_APPFINCLOSEWAIT
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: D. Wythe <[email protected]>
[ Upstream commit 5211c9729484c923f8d2e06bd29f9322cc42bb8f ]
Considering scenario:
smc_cdc_rx_handler__smc_release
sock_set_flagsmc_close_active()sock_set_flag
__set_bit(DEAD) __set_bit(DONE)
Dues to __set_bit is not atomic, the DEAD or DONE might be lost. if the DEAD flag lost, the state SMC_CLOSED will be never be reached in smc_close_passive_work:
if (sock_flag(sk, SOCK_DEAD) &&
smc_close_sent_any_close(conn)) {
sk->sk_state = SMC_CLOSED;
} else {
/* just shutdown, but not yet closed locally */
sk->sk_state = SMC_APPFINCLOSEWAIT;
}Replace sock_set_flags or __set_bit to set_bit will fix this problem. Since set_bit is atomic.
--- net/smc/af_smc.c | 4 ++-- net/smc/smc.h | 5 +++++ net/smc/smc_cdc.c | 2 +- net/smc/smc_close.c | 2 +- 4 files changed, 9 insertions(+), 4 deletions(-)
net/smc/af_smc.c +2 -2
@@ -275,7 +275,7 @@ static int __smc_release(struct smc_sock *smc)if (!smc->use_fallback) { rc =smc_close_active (smc); -sock_set_flag (sk,SOCK_DEAD ); +smc_sock_set_flag (sk,SOCK_DEAD ); sk->sk_shutdown |=SHUTDOWN_MASK ; }else {if (sk->sk_state !=SMC_CLOSED ) {
@@ -1722,7 +1722,7 @@ static int smc_clcsock_accept(struct smc_sock *lsmc, struct smc_sock **new_smc)if (new_clcsock)sock_release (new_clcsock); new_sk->sk_state =SMC_CLOSED ; -sock_set_flag (new_sk,SOCK_DEAD ); +smc_sock_set_flag (new_sk,SOCK_DEAD );sock_put (new_sk);/* final */ *new_smc =NULL ; goto out;
net/smc/smc.h +5 -0
@@ -374,4 +374,9 @@ int smc_nl_dump_hs_limitation(struct sk_buff *skb, struct netlink_callback *cb);int smc_nl_enable_hs_limitation (struct sk_buff *skb,struct genl_info *info);int smc_nl_disable_hs_limitation (struct sk_buff *skb,struct genl_info *info); +static inline void smc_sock_set_flag (struct sock *sk,enum sock_flags flag) +{ +set_bit (flag, &sk->sk_flags); +} +#endif /* __SMC_H */
net/smc/smc_cdc.c +1 -1
@@ -385,7 +385,7 @@ static void smc_cdc_msg_recv_action(struct smc_sock *smc, smc->sk.sk_shutdown |=RCV_SHUTDOWN ;if (smc->clcsock && smc->clcsock->sk) smc->clcsock->sk->sk_shutdown |=RCV_SHUTDOWN ; -sock_set_flag (&smc->sk,SOCK_DONE ); +smc_sock_set_flag (&smc->sk,SOCK_DONE );sock_hold (&smc->sk);/* sock_put in close_work */ if (!queue_work (smc_close_wq, &conn->close_work))sock_put (&smc->sk);
net/smc/smc_close.c +1 -1
@@ -173,7 +173,7 @@ void smc_close_active_abort(struct smc_sock *smc)break ; } -sock_set_flag (sk,SOCK_DEAD ); +smc_sock_set_flag (sk,SOCK_DEAD ); sk->sk_state_change (sk);if (release_clcsock) {
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 515/550 net/smc: allow cdc msg send rather than drop it with NULL sndbuf_desc
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: D. Wythe <[email protected]>
[ Upstream commit c5bf605ba4f9d6fbbb120595ab95002f4716edcb ]
This patch re-fix the issues mentioned by commit 22a825c541d7 ("net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler()").
Blocking sending message do solve the issues though, but it also prevents the peer to receive the final message. Besides, in logic, whether the sndbuf_desc is NULL or not have no impact on the processing of cdc message sending.
Hence that, this patch allows the cdc message sending but to check the sndbuf_desc with care in smc_cdc_tx_handler().
--- net/smc/smc_cdc.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
net/smc/smc_cdc.c +4 -5
@@ -28,13 +28,15 @@ static void smc_cdc_tx_handler(struct smc_wr_tx_pend_priv *pnd_snd, {struct smc_cdc_tx_pend *cdcpend = (struct smc_cdc_tx_pend *)pnd_snd;struct smc_connection *conn = cdcpend->conn; +struct smc_buf_desc *sndbuf_desc;struct smc_sock *smc;int diff; + sndbuf_desc = conn->sndbuf_desc; smc = container_of(conn, struct smc_sock, conn);bh_lock_sock (&smc->sk); -if (!wc_status) { - diff =smc_curs_diff (cdcpend->conn->sndbuf_desc->len, +if (!wc_status && sndbuf_desc) { + diff =smc_curs_diff (sndbuf_desc->len, &cdcpend->conn->tx_curs_fin, &cdcpend->cursor);/* sndbuf_space is decreased in smc_sendmsg */
@@ -114,9 +116,6 @@ int smc_cdc_msg_send(struct smc_connection *conn,union smc_host_cursor cfed;int rc; -if (unlikely (!READ_ONCE (conn->sndbuf_desc))) -return -ENOBUFS ; -smc_cdc_add_pending_send (conn, pend); conn->tx_cdc_seq++;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 516/550 net/smc: put sk reference if close work was canceled
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: D. Wythe <[email protected]>
[ Upstream commit aa96fbd6d78d9770323b21e2c92bd38821be8852 ]
Note that we always hold a reference to sock when attempting to submit close_work. Therefore, if we have successfully canceled close_work from pending, we MUST release that reference to avoid potential leaks.
--- net/smc/smc_close.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/smc/smc_close.c +2 -1
@@ -116,7 +116,8 @@ static void smc_close_cancel_work(struct smc_sock *smc)struct sock *sk = &smc->sk;release_sock (sk); -cancel_work_sync (&smc->conn.close_work); +if (cancel_work_sync (&smc->conn.close_work)) +sock_put (sk);cancel_delayed_work_sync (&smc->conn.tx_work);lock_sock (sk); }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 517/550 nvme: fix error-handling for io_uring nvme-passthrough
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anuj Gupta <[email protected]>
[ Upstream commit 1147dd0503564fa0e03489a039f9e0c748a03db4 ]
Driver may return an error before submitting the command to the device. Ensure that such error is propagated up.
--- drivers/nvme/host/ioctl.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/nvme/host/ioctl.c +5 -2
@@ -511,10 +511,13 @@ static enum rq_end_io_ret nvme_uring_cmd_end_io(struct request *req,struct nvme_uring_cmd_pdu *pdu =nvme_uring_cmd_pdu (ioucmd); req->bio = pdu->bio; -if (nvme_req (req)->flags &NVME_REQ_CANCELLED ) +if (nvme_req (req)->flags &NVME_REQ_CANCELLED ) { pdu->nvme_status = -EINTR ; -else + }else { pdu->nvme_status =nvme_req (req)->status; +if (!pdu->nvme_status) + pdu->nvme_status =blk_status_to_errno (err); + } pdu->u.result =le64_to_cpu (nvme_req (req)->result.u64);/*
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 518/550 riscv: boot: Fix creation of loader.bin
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit 57a4542cb7c9baa1509c3366b57a08d75b212ead ]
When flashing loader.bin for K210 using kflash:
[ERROR] This is an ELF file and cannot be programmed to flash directly: arch/riscv/boot/loader.bin
Before, loader.bin relied on "OBJCOPYFLAGS := -O binary" in the main RISC-V Makefile to create a boot image with the right format. With this removed, the image is now created in the wrong (ELF) format.
Fix this by adding an explicit rule.
--- arch/riscv/boot/Makefile | 1 + 1 file changed, 1 insertion(+)
arch/riscv/boot/Makefile +1 -0
@@ -17,6 +17,7 @@ KCOV_INSTRUMENT := n OBJCOPYFLAGS_Image :=-O binary -R .note -R .note.gnu.build-id -R .comment -S +OBJCOPYFLAGS_loader.bin :=-O binary OBJCOPYFLAGS_xipImage :=-O binary -R .note -R .note.gnu.build-id -R .comment -S targets := Image Image.* loader loader.o loader.lds loader.bin
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 519/550 tg3: power down device only on SYSTEM_POWER_OFF
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: George Shuklin <[email protected]>
[ Upstream commit 9fc3bc7643341dc5be7d269f3d3dbe441d8d7ac3 ]
Dell R650xs servers hangs on reboot if tg3 driver calls tg3_power_down.
This happens only if network adapters (BCM5720 for R650xs) were initialized using SNP (e.g. by booting ipxe.efi).
The actual problem is on Dell side, but this fix allows servers to come back alive after reboot.
--- drivers/net/ethernet/broadcom/tg3.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/broadcom/tg3.c +2 -1
@@ -18082,7 +18082,8 @@ static void tg3_shutdown(struct pci_dev *pdev)if (netif_running (dev))dev_close (dev); -tg3_power_down (tp); +if (system_state ==SYSTEM_POWER_OFF ) +tg3_power_down (tp);rtnl_unlock ();
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 520/550 nbd: fix uaf in nbd_open
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Lingfeng <[email protected]>
[ Upstream commit 327462725b0f759f093788dfbcb2f1fd132f956b ]
Commit 4af5f2e03013 ("nbd: use blk_mq_alloc_disk and blk_cleanup_disk") cleans up disk by blk_cleanup_disk() and it won't set disk->private_data as NULL as before. UAF may be triggered in nbd_open() if someone tries to open nbd device right after nbd_put() since nbd has been free in nbd_dev_remove().
Fix this by implementing ->free_disk and free private data in it.
--- drivers/block/nbd.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
drivers/block/nbd.c +9 -2
@@ -250,7 +250,6 @@ static void nbd_dev_remove(struct nbd_device *nbd)struct gendisk *disk = nbd->disk;del_gendisk (disk); -put_disk (disk);blk_mq_free_tag_set (&nbd->tag_set);/*
@@ -261,7 +260,7 @@ static void nbd_dev_remove(struct nbd_device *nbd)idr_remove (&nbd_index_idr, nbd->index);mutex_unlock (&nbd_index_mutex);destroy_workqueue (nbd->recv_workq); -kfree (nbd); +put_disk (disk); }static void nbd_dev_remove_work (struct work_struct *work)
@@ -1609,6 +1608,13 @@ static void nbd_release(struct gendisk *disk)nbd_put (nbd); } +static void nbd_free_disk (struct gendisk *disk) +{ +struct nbd_device *nbd = disk->private_data; + +kfree (nbd); +} +static const struct block_device_operations nbd_fops = { .owner =THIS_MODULE ,
@@ -1616,6 +1622,7 @@ static const struct block_device_operations nbd_fops = .release = nbd_release, .ioctl = nbd_ioctl, .compat_ioctl = nbd_ioctl, + .free_disk = nbd_free_disk, };#if IS_ENABLED (CONFIG_DEBUG_FS )
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 521/550 blk-core: use pr_warn_ratelimited() in bio_check_ro()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <[email protected]>
[ Upstream commit 1b0a151c10a6d823f033023b9fdd9af72a89591b ]
If one of the underlying disks of raid or dm is set to read-only, then each io will generate new log, which will cause message storm. This environment is indeed problematic, however we can't make sure our naive custormer won't do this, hence use pr_warn_ratelimited() to prevent message storm in this case.
--- block/blk-core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
block/blk-core.c +2 -2
@@ -500,8 +500,8 @@ static inline void bio_check_ro(struct bio *bio)if (op_is_write (bio_op (bio)) &&bdev_read_only (bio->bi_bdev)) {if (op_is_flush (bio->bi_opf) && !bio_sectors (bio))return ; -pr_warn ("Trying to write to read-only block-device %pg\n" , - bio->bi_bdev); +pr_warn_ratelimited ("Trying to write to read-only block-device %pg\n" , + bio->bi_bdev);/* Older lvm-tools actually trigger this */ } }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 522/550 vsock/virtio: remove socket from connected/bound list on shutdown
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filippo Storniolo <[email protected]>
[ Upstream commit 3a5cc90a4d1756072619fe511d07621bdef7f120 ]
If the same remote peer, using the same port, tries to connect to a server on a listening port more than once, the server will reject the connection, causing a "connection reset by peer" error on the remote peer. This is due to the presence of a dangling socket from a previous connection in both the connected and bound socket lists.
The inconsistency of the above lists only occurs when the remote peer disconnects and the server remains active.
This bug does not occur when the server socket is closed:virtio_transport_release() will eventually schedule a call to virtio_transport_do_close() and the latter will remove the socket from the bound and connected socket lists and clear the sk_buff.
However, virtio_transport_do_close() will only perform the above actions if it has been scheduled, and this will not happen if the server is processing the shutdown message from a remote peer.
To fix this, introduce a call to vsock_remove_sock() when the server is handling a client disconnect.
This is to remove the socket from the bound and connected socket lists without clearing the sk_buff.
--- net/vmw_vsock/virtio_transport_common.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)
net/vmw_vsock/virtio_transport_common.c +11 -5
@@ -1150,11 +1150,17 @@ virtio_transport_recv_connected(struct sock *sk, vsk->peer_shutdown |=RCV_SHUTDOWN ;if (le32_to_cpu (hdr->flags) &VIRTIO_VSOCK_SHUTDOWN_SEND ) vsk->peer_shutdown |=SEND_SHUTDOWN ; -if (vsk->peer_shutdown ==SHUTDOWN_MASK && -vsock_stream_has_data (vsk) <=0 && - !sock_flag (sk,SOCK_DONE )) { - (void )virtio_transport_reset (vsk,NULL ); -virtio_transport_do_close (vsk, true); +if (vsk->peer_shutdown ==SHUTDOWN_MASK ) { +if (vsock_stream_has_data (vsk) <=0 && !sock_flag (sk,SOCK_DONE )) { + (void )virtio_transport_reset (vsk,NULL ); +virtio_transport_do_close (vsk, true); + } +/* Remove this socket anyway because the remote peer sent +* the shutdown. This way a new connection will succeed +* if the remote peer uses the same source port, +* even if the old socket is still unreleased, but now disconnected. +*/ +vsock_remove_sock (vsk); }if (le32_to_cpu (virtio_vsock_hdr (skb)->flags)) sk->sk_state_change (sk);
Signature · 1 line
2.42.0