6.1.68-rc1 review
Subsystems (7)
Greg Kroah-Hartman
maintainercover 6.1.68-rc1 review
This is the start of the stable review cycle for the 6.1.68 release. There are 194 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 13 Dec 2023 18:19:59 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.68-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.1.68-rc1
Ville Syrjälä <[email protected]>
drm/i915: Skip some timing checks on BXT/GLK DSI transcoders
Jani Nikula <[email protected]>
drm/i915/sdvo: stop caching has_hdmi_monitor in struct intel_sdvo
Ville Syrjälä <[email protected]>
drm/i915/lvds: Use REG_BIT() & co.
Ankit Nautiyal <[email protected]>
drm/i915/display: Drop check for doublescan mode in modevalid
Jia Jie Ho <[email protected]>
riscv: Kconfig: Add select ARM_AMBA to SOC_STARFIVE
Florian Westphal <[email protected]>
netfilter: nft_set_pipapo: skip inactive elements during set walk
Jiaxun Yang <[email protected]>
MIPS: Loongson64: Enable DMA noncoherent support
Jiaxun Yang <[email protected]>
MIPS: Loongson64: Handle more memory types passed from firmware
Jiaxun Yang <[email protected]>
MIPS: Loongson64: Reserve vgabios memory on boot
Sean Christopherson <[email protected]>
KVM: SVM: Update EFER software model on CR0 trap for SEV-ES
Claudio Imbrenda <[email protected]>
KVM: s390/mm: Properly reset no-dat
Thomas Bogendoerfer <[email protected]>
MIPS: kernel: Clear FPU states when setting up kernel threads
David Howells <[email protected]>
cifs: Fix flushing, invalidation and file size with FICLONE
David Howells <[email protected]>
cifs: Fix flushing, invalidation and file size with copy_file_range()
Roy Luo <[email protected]>
USB: gadget: core: adjust uevent timing on gadget unbind
Borislav Petkov (AMD) <[email protected]>
x86/CPU/AMD: Check vendor in the AMD microcode callback
Mukesh Ojha <[email protected]>
devcoredump: Send uevent once devcd is ready
Ronald Wahl <[email protected]>
serial: 8250_omap: Add earlycon support for the AM654 UART controller
Ronald Wahl <[email protected]>
serial: 8250: 8250_omap: Do not start RX DMA on THRI interrupt
Ronald Wahl <[email protected]>
serial: 8250: 8250_omap: Clear UART_HAS_RHR_IT_DIS bit
Daniel Mack <[email protected]>
serial: sc16is7xx: address RX timeout interrupt errata
Arnd Bergmann <[email protected]>
ARM: PL011: Fix DMA support
RD Babiera <[email protected]>
usb: typec: class: fix typec_altmode_put_partner to put plugs
Paulo Alcantara <[email protected]>
smb: client: fix potential NULL deref in parse_dfs_referrals()
Mathias Nyman <[email protected]>
Revert "xhci: Loosen RPM as default policy to cover for AMD xHC 1.1"
David Howells <[email protected]>
cifs: Fix non-availability of dedup breaking generic/304
Cameron Williams <[email protected]>
parport: Add support for Brainboxes IX/UC/PX parallel cards
Andy Shevchenko <[email protected]>
serial: 8250_dw: Add ACPI ID for Granite Rapids-D UART
Konstantin Aladyshev <[email protected]>
usb: gadget: f_hid: fix report descriptor allocation
Candice Li <[email protected]>
drm/amdgpu: Update EEPROM I2C address for smu v13_0_0
Candice Li <[email protected]>
drm/amdgpu: Add I2C EEPROM support on smu v13_0_6
Alex Deucher <[email protected]>
drm/amdgpu: simplify amdgpu_ras_eeprom.c
Luben Tuikov <[email protected]>
drm/amdgpu: Return from switch early for EEPROM I2C address
Luben Tuikov <[email protected]>
drm/amdgpu: Remove second moot switch to set EEPROM I2C address
Luben Tuikov <[email protected]>
drm/amdgpu: Add support for RAS table at 0x40000
Luben Tuikov <[email protected]>
drm/amdgpu: Decouple RAS EEPROM addresses from chips
Luben Tuikov <[email protected]>
drm/amdgpu: Remove redundant I2C EEPROM address
Candice Li <[email protected]>
drm/amdgpu: Add EEPROM I2C address support for ip discovery
Candice Li <[email protected]>
drm/amdgpu: Update ras eeprom support for smu v13_0_0 and v13_0_10
Prike Liang <[email protected]>
drm/amdgpu: correct the amdgpu runtime dereference usage count
Srinivasan Shanmugam <[email protected]>
drm/amd/amdgpu: Fix warnings in amdgpu/amdgpu_display.c
Tim Huang <[email protected]>
drm/amdgpu: fix memory overflow in the IB test
Boerge Struempfel <[email protected]>
gpiolib: sysfs: Fix error handling on failed export
Ashwin Dayanand Kamat <[email protected]>
x86/sev: Fix kernel crash due to late update to read-only ghcb_version
Peter Zijlstra <[email protected]>
perf: Fix perf_event_validate_size()
Hsin-Yi Wang <[email protected]>
arm64: dts: mt8183: kukui: Fix underscores in node names
Krzysztof Kozlowski <[email protected]>
arm64: dts: mediatek: add missing space before {Helge Deller <[email protected]>
parisc: Fix asm operand number out of range build error in bug table
Helge Deller <[email protected]>
parisc: Reduce size of the bug_table on 64-bit kernel by half
Steven Rostedt (Google) <[email protected]>
tracing: Stop current tracer when resizing buffer
Zheng Yejian <[email protected]>
tracing: Set actual size after ring buffer resize
Steven Rostedt (Google) <[email protected]>
ring-buffer: Force absolute timestamp on discard of event
Hengqi Chen <[email protected]>
LoongArch: BPF: Don't sign extend function return value
Hengqi Chen <[email protected]>
LoongArch: BPF: Don't sign extend memory load operand
Su Hui <[email protected]>
misc: mei: client.c: fix problem of return '-EOVERFLOW' in mei_cl_write
Su Hui <[email protected]>
misc: mei: client.c: return negative error code in mei_cl_write
Junhao He <[email protected]>
hwtracing: hisi_ptt: Add dummy callback pmu::read()
Uwe Kleine-König <[email protected]>
coresight: etm4x: Remove bogous __exit annotation for some functions
Uwe Kleine-König <[email protected]>
coresight: etm4x: Make etm4_remove_dev() return void
Carlos Llamas <[email protected]>
binder: fix memory leaks of spam and pending work
AngeloGioacchino Del Regno <[email protected]>
arm64: dts: mediatek: mt8183-evb: Fix unit_address_vs_reg warning on ntc
AngeloGioacchino Del Regno <[email protected]>
arm64: dts: mediatek: mt8183: Move thermal-zones to the root node
AngeloGioacchino Del Regno <[email protected]>
arm64: dts: mediatek: mt8183: Fix unit address for scp reserved memory
AngeloGioacchino Del Regno <[email protected]>
arm64: dts: mediatek: mt8195: Fix PM suspend/resume with venc clocks
AngeloGioacchino Del Regno <[email protected]>
arm64: dts: mediatek: mt8173-evb: Fix regulator-fixed node names
AngeloGioacchino Del Regno <[email protected]>
arm64: dts: mediatek: cherry: Fix interrupt cells for MT6360 on I2C7
Eugen Hristev <[email protected]>
arm64: dts: mediatek: mt8183-kukui-jacuzzi: fix dsi unnecessary cells properties
Eugen Hristev <[email protected]>
arm64: dts: mediatek: mt7622: fix memory node warning check
David Jeffery <[email protected]>
md/raid6: use valid sector values to determine if an I/O should wait on the reshape
Lukasz Luba <[email protected]>
powercap: DTPM: Fix missing cpufreq_cpu_put() calls
Hugh Dickins <[email protected]>
mm: fix oops when filemap_map_pmd() without prealloc_pte
Mike Kravetz <[email protected]>
hugetlb: fix null-ptr-deref in hugetlb_vma_lock_write
Francesco Dolcini <[email protected]>
platform/surface: aggregator: fix recv_buf() return value
Matthias Reichl <[email protected]>
regmap: fix bogus error on regcache_sync success
ChunHao Lin <[email protected]>
r8169: fix rtl8125b PAUSE frames blasting when suspended
Daniel Borkmann <[email protected]>
packet: Move reference count in packet_sock to atomic_long_t
Petr Pavlu <[email protected]>
tracing: Fix a possible race when disabling buffered events
Petr Pavlu <[email protected]>
tracing: Fix incomplete locking when disabling buffered events
Steven Rostedt (Google) <[email protected]>
tracing: Disable snapshot buffer when stopping instance tracers
Steven Rostedt (Google) <[email protected]>
tracing: Always update snapshot buffer size
Heiko Carstens <[email protected]>
checkstack: fix printed address
Tim Van Patten <[email protected]>
cgroup_freezer: cgroup_freezing: Check if not frozen
Ryusuke Konishi <[email protected]>
nilfs2: prevent WARNING in nilfs_sufile_set_segment_usage()
Ryusuke Konishi <[email protected]>
nilfs2: fix missing error check for sb_set_blocksize call
Steven Rostedt (Google) <[email protected]>
ring-buffer: Test last update in 32bit version of __rb_time_read()
Mario Limonciello <[email protected]>
ALSA: hda/realtek: Add Framework laptop 16 to quirks
Tim Bosse <[email protected]>
ALSA: hda/realtek: add new Framework laptop to quirks
Bin Li <[email protected]>
ALSA: hda/realtek: Enable headset on Lenovo M90 Gen5
Jason Zhang <[email protected]>
ALSA: pcm: fix out-of-bounds in snd_pcm_state_names
Sarah Grant <[email protected]>
ALSA: usb-audio: Add Pioneer DJM-450 mixer controls
Pavel Begunkov <[email protected]>
io_uring: fix mutex_unlock with unreferenced ctx
Georg Gottleuber <[email protected]>
nvme-pci: Add sleep quirk for Kingston drives
Pavel Begunkov <[email protected]>
io_uring/af_unix: disable sending io_uring over sockets
Malcolm Hart <[email protected]>
ASoC: amd: yc: Fix non-functional mic on ASUS E1504FA
JP Kobryn <[email protected]>
kprobes: consistent rcu api usage for kretprobe holder
Masami Hiramatsu (Google) <[email protected]>
rethook: Use __rcu pointer for rethook::handler
Robin Murphy <[email protected]>
iommu: Avoid more races around device probe
Yu Kuai <[email protected]>
md: don't leave 'MD_RECOVERY_FROZEN' in error path of md_set_readonly()
Ye Bin <[email protected]>
md: introduce md_ro_state
Clément Léger <[email protected]>
riscv: fix misaligned access handling of C.SWSP and C.SDSP
Fabio Estevam <[email protected]>
ARM: dts: imx28-xea: Pass the 'model' property
Philipp Zabel <[email protected]>
ARM: dts: imx7: Declare timers compatible with fsl,imx6dl-gpt
Kunwu Chan <[email protected]>
ARM: imx: Check return value of devm_kasprintf in imx_mmdc_perf_init
Dinghao Liu <[email protected]>
scsi: be2iscsi: Fix a memleak in beiscsi_init_wrb_handle()
Petr Pavlu <[email protected]>
tracing: Fix a warning when allocating buffered events fails
Fabio Estevam <[email protected]>
ARM: dts: imx6ul-pico: Describe the Ethernet PHY clock
Nathan Rossi <[email protected]>
arm64: dts: imx8mp: imx8mq: Add parkmode-disable-ss-quirk on DWC3
Peng Fan <[email protected]>
arm64: dts: imx8mq: drop usb3-resume-missing-cas from usb
Arnd Bergmann <[email protected]>
drm/bridge: tc358768: select CONFIG_VIDEOMODE_HELPERS
Shifeng Li <[email protected]>
RDMA/irdma: Avoid free the non-cqp_request scratch
Mike Marciniszyn <[email protected]>
RDMA/core: Fix umem iterator when PAGE_SIZE is greater then HCA pgsz
Dinghao Liu <[email protected]>
ASoC: wm_adsp: fix memleak in wm_adsp_buffer_populate
Christophe JAILLET <[email protected]>
hwmon: (nzxt-kraken2) Fix error handling path in kraken2_probe()
Neil Armstrong <[email protected]>
ASoC: codecs: lpass-tx-macro: set active_decimator correct default value
Armin Wolf <[email protected]>
hwmon: (acpi_power_meter) Fix 4.29 MW bug
Shifeng Li <[email protected]>
RDMA/irdma: Fix UAF in irdma_sc_ccq_get_cqe_info()
Sindhu Devale <[email protected]>
RDMA/irdma: Refactor error handling in create CQP
Kalesh AP <[email protected]>
RDMA/bnxt_re: Correct module description string
Jack Wang <[email protected]>
RDMA/rtrs-clt: Remove the warnings for req in_use check
Jack Wang <[email protected]>
RDMA/rtrs-clt: Fix the max_send_wr setting
Md Haris Iqbal <[email protected]>
RDMA/rtrs-srv: Destroy path files after making sure no IOs in-flight
Md Haris Iqbal <[email protected]>
RDMA/rtrs-srv: Free srv_mr iu only when always_invalidate is true
Md Haris Iqbal <[email protected]>
RDMA/rtrs-srv: Check return values while processing info request
Jack Wang <[email protected]>
RDMA/rtrs-clt: Start hb after path_up
Jack Wang <[email protected]>
RDMA/rtrs-srv: Do not unconditionally enable irq
Shengjiu Wang <[email protected]>
ASoC: fsl_sai: Fix no frame sync clock issue on i.MX8MP
Alex Bee <[email protected]>
arm64: dts: rockchip: Expand reg size of vdec node for RK3399
Jonas Karlman <[email protected]>
arm64: dts: rockchip: Expand reg size of vdec node for RK3328
Mustafa Ismail <[email protected]>
RDMA/irdma: Add wait for suspend on SQD
Mustafa Ismail <[email protected]>
RDMA/irdma: Do not modify to SQD on error
Junxian Huang <[email protected]>
RDMA/hns: Fix unnecessary err return when using invalid congest control algorithm
Sumit Garg <[email protected]>
tee: optee: Fix supplicant based device enumeration
Dan Carpenter <[email protected]>
mm/damon/sysfs: eliminate potential uninitialized variable warning
Ido Schimmel <[email protected]>
drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group
Ido Schimmel <[email protected]>
psample: Require 'CAP_NET_ADMIN' when joining "packets" group
John Fastabend <[email protected]>
bpf: sockmap, updating the sg structure should also update curr
Eric Dumazet <[email protected]>
tcp: do not accept ACK of bytes we never sent
Phil Sutter <[email protected]>
netfilter: xt_owner: Fix for unsafe access of sk->sk_socket
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: validate family when identifying table via handle
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: bail out on mismatching dynset and set expressions
Florian Westphal <[email protected]>
netfilter: nf_tables: fix 'exist' matching on bigendian arches
Jeremy Sowden <[email protected]>
netfilter: nft_exthdr: add boolean DCCP option matching
Konrad Dybcio <[email protected]>
dt-bindings: interrupt-controller: Allow #power-domain-cells
Rahul Bhansali <[email protected]>
octeontx2-af: Update Tx link register range
Geetha sowjanya <[email protected]>
octeontx2-af: Add missing mcs flr handler call
Geetha sowjanya <[email protected]>
octeontx2-af: Fix mcs stats register address
Geetha sowjanya <[email protected]>
octeontx2-af: Fix mcs sa cam entries size
Nithin Dabilpuram <[email protected]>
octeontx2-af: Adjust Tx credits when MCS external bypass is disabled
Yonglong Liu <[email protected]>
net: hns: fix fake link up on xge port
Yonglong Liu <[email protected]>
net: hns: fix wrong head when modify the tx feature when sending packets
Daniil Maximov <[email protected]>
net: atlantic: Fix NULL dereference of skb pointer in
Shigeru Yoshida <[email protected]>
ipv4: ip_gre: Avoid skb_pull() failure in ipgre_xmit()
Brett Creeley <[email protected]>
ionic: Fix dim work handling in split interrupt mode
Shannon Nelson <[email protected]>
ionic: fix snprintf format length warning
Paolo Abeni <[email protected]>
tcp: fix mid stream window clamp.
Dinghao Liu <[email protected]>
net: bnxt: fix a potential use-after-free in bnxt_init_tc
Jacob Keller <[email protected]>
iavf: validate tx_coalesce_usecs even if rx_coalesce_usecs is zero
Ivan Vecera <[email protected]>
i40e: Fix unexpected MFS warning message
Zhipeng Lu <[email protected]>
octeontx2-af: fix a use-after-free in rvu_npa_register_reporters
Yewon Choi <[email protected]>
xsk: Skip polling event check for unbound socket
Jianheng Zhang <[email protected]>
net: stmmac: fix FPE events losing
Naveen Mamindlapalli <[email protected]>
octeontx2-pf: consider both Rx and Tx packet stats for adaptive interrupt coalescing
Thomas Reichinger <[email protected]>
arcnet: restoring support for multiple Sohard Arcnet cards
Kunwu Chan <[email protected]>
platform/mellanox: Check devm_hwmon_device_register_with_groups() return value
Kunwu Chan <[email protected]>
platform/mellanox: Add null pointer checks for devm_kasprintf()
David Thompson <[email protected]>
mlxbf-bootctl: correctly identify secure boot with development keys
Douglas Anderson <[email protected]>
r8152: Add RTL8152_INACCESSIBLE to r8153_aldps_en()
Douglas Anderson <[email protected]>
r8152: Add RTL8152_INACCESSIBLE to r8153_pre_firmware_1()
Douglas Anderson <[email protected]>
r8152: Add RTL8152_INACCESSIBLE to r8156b_wait_loading_flash()
Douglas Anderson <[email protected]>
r8152: Add RTL8152_INACCESSIBLE checks to more loops
Douglas Anderson <[email protected]>
r8152: Rename RTL8152_UNPLUG to RTL8152_INACCESSIBLE
Randy Dunlap <[email protected]>
hv_netvsc: rndis_filter needs to select NLS
Subbaraya Sundeep <[email protected]>
octeontx2-af: Check return value of nix_get_nixlf before using nixlf
Subbaraya Sundeep <[email protected]>
octeontx2-pf: Add missing mutex lock in otx2_get_pauseparam
Eric Dumazet <[email protected]>
ipv6: fix potential NULL deref in fib6_add()
Armin Wolf <[email protected]>
platform/x86: wmi: Skip blocks with zero instances
Luca Ceresoli <[email protected]>
of: dynamic: Fix of_reconfig_get_state_change() return value documentation
Hans de Goede <[email protected]>
platform/x86: asus-wmi: Move i8042 filter install to shared asus-wmi code
Nícolas F. R. A. Prado <[email protected]>
dt: dt-extract-compatibles: Don't follow symlinks when walking tree
Nícolas F. R. A. Prado <[email protected]>
dt: dt-extract-compatibles: Handle cfile arguments in generator function
Kirill A. Shutemov <[email protected]>
x86/tdx: Allow 32-bit emulation by default
Thomas Gleixner <[email protected]>
x86/entry: Do not allow external 0x80 interrupts
Thomas Gleixner <[email protected]>
x86/entry: Convert INT 0x80 emulation to IDTENTRY
Kirill A. Shutemov <[email protected]>
x86/coco: Disable 32-bit emulation by default on TDX and SEV
Nikolay Borisov <[email protected]>
x86: Introduce ia32_enabled()
YuanShang <[email protected]>
drm/amdgpu: correct chunk_ptr to a pointer to chunk.
Masahiro Yamada <[email protected]>
kconfig: fix memory leak from range properties
Alex Pakhunov <[email protected]>
tg3: Increment tx_dropped in tg3_tso_bug()
Alex Pakhunov <[email protected]>
tg3: Move the [rt]x_dropped counters to tg3_napi
Nick Terrell <[email protected]>
zstd: Fix array-index-out-of-bounds UBSAN warning
Jozsef Kadlecsik <[email protected]>
netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test
Jan Bottorff <[email protected]>
i2c: designware: Fix corrupted memory seen in the ISR
Thomas Gleixner <[email protected]>
hrtimers: Push pending hrtimers away from outgoing CPU earlier
Steve Sistare <[email protected]>
vdpa/mlx5: preserve CVQ vringh index
-------------
Diffstat:
Documentation/ABI/testing/sysfs-bus-optee-devices | 9 + .../bindings/interrupt-controller/qcom,mpm.yaml | 4 + Makefile | 4 +- arch/arm/boot/dts/imx28-xea.dts | 1 + arch/arm/boot/dts/imx6ul-pico.dtsi | 2 + arch/arm/boot/dts/imx7s.dtsi | 8 +- arch/arm/mach-imx/mmdc.c | 7 +- arch/arm64/boot/dts/freescale/imx8mp.dtsi | 2 + arch/arm64/boot/dts/freescale/imx8mq.dtsi | 4 +- .../boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts | 2 +- arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts | 2 +- arch/arm64/boot/dts/mediatek/mt8173-evb.dts | 4 +- arch/arm64/boot/dts/mediatek/mt8183-evb.dts | 52 ++--- .../boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi | 8 +- arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi | 96 ++++---- arch/arm64/boot/dts/mediatek/mt8183-pumpkin.dts | 12 +- arch/arm64/boot/dts/mediatek/mt8183.dtsi | 242 ++++++++++----------- arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi | 2 +- arch/arm64/boot/dts/mediatek/mt8195.dtsi | 6 +- arch/arm64/boot/dts/rockchip/rk3328.dtsi | 2 +- arch/arm64/boot/dts/rockchip/rk3399.dtsi | 6 +- arch/loongarch/net/bpf_jit.c | 12 +- arch/mips/Kconfig | 2 + arch/mips/include/asm/mach-loongson64/boot_param.h | 9 +- arch/mips/kernel/process.c | 25 ++- arch/mips/loongson64/env.c | 10 +- arch/mips/loongson64/init.c | 47 ++-- arch/parisc/Kconfig | 7 +- arch/parisc/include/asm/bug.h | 36 +-- arch/riscv/Kconfig.socs | 1 + arch/riscv/kernel/traps_misaligned.c | 6 +- arch/s390/mm/pgtable.c | 2 +- arch/x86/coco/tdx/tdx.c | 1 + arch/x86/entry/common.c | 97 ++++++++- arch/x86/entry/entry_64_compat.S | 77 ------- arch/x86/include/asm/ia32.h | 23 +- arch/x86/include/asm/idtentry.h | 4 + arch/x86/include/asm/proto.h | 4 - arch/x86/kernel/cpu/amd.c | 3 + arch/x86/kernel/idt.c | 2 +- arch/x86/kernel/sev.c | 11 +- arch/x86/kvm/svm/svm.c | 8 +- arch/x86/mm/mem_encrypt_amd.c | 11 + arch/x86/xen/enlighten_pv.c | 2 +- arch/x86/xen/xen-asm.S | 2 +- drivers/acpi/scan.c | 7 +- drivers/android/binder.c | 1 + drivers/base/devcoredump.c | 3 + drivers/base/regmap/regcache.c | 3 +- drivers/gpio/gpiolib-sysfs.c | 15 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 49 +++-- drivers/gpu/drm/amd/amdgpu/amdgpu_eeprom.c | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c | 121 ++++++----- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 4 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 4 +- drivers/gpu/drm/bridge/Kconfig | 1 + drivers/gpu/drm/i915/display/icl_dsi.c | 7 + drivers/gpu/drm/i915/display/intel_crt.c | 5 + drivers/gpu/drm/i915/display/intel_display.c | 10 + drivers/gpu/drm/i915/display/intel_display.h | 3 + drivers/gpu/drm/i915/display/intel_dp.c | 5 +- drivers/gpu/drm/i915/display/intel_dp_mst.c | 4 + drivers/gpu/drm/i915/display/intel_dvo.c | 6 + drivers/gpu/drm/i915/display/intel_hdmi.c | 5 +- drivers/gpu/drm/i915/display/intel_lvds.c | 9 +- drivers/gpu/drm/i915/display/intel_sdvo.c | 22 +- drivers/gpu/drm/i915/display/intel_tv.c | 8 +- drivers/gpu/drm/i915/display/vlv_dsi.c | 18 +- drivers/gpu/drm/i915/i915_reg.h | 46 ++-- drivers/hwmon/acpi_power_meter.c | 4 + drivers/hwmon/nzxt-kraken2.c | 4 +- drivers/hwtracing/coresight/coresight-etm4x-core.c | 12 +- drivers/hwtracing/ptt/hisi_ptt.c | 5 + drivers/i2c/busses/i2c-designware-common.c | 16 +- drivers/infiniband/core/umem.c | 6 - drivers/infiniband/hw/bnxt_re/main.c | 2 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 13 +- drivers/infiniband/hw/irdma/hw.c | 49 +++-- drivers/infiniband/hw/irdma/main.c | 2 +- drivers/infiniband/hw/irdma/main.h | 2 +- drivers/infiniband/hw/irdma/verbs.c | 28 ++- drivers/infiniband/hw/irdma/verbs.h | 1 + drivers/infiniband/ulp/rtrs/rtrs-clt.c | 7 +- drivers/infiniband/ulp/rtrs/rtrs-srv.c | 37 +++- drivers/iommu/iommu.c | 19 +- drivers/iommu/of_iommu.c | 12 +- drivers/md/md.c | 174 ++++++++------- drivers/md/raid5.c | 4 +- drivers/misc/mei/client.c | 4 +- drivers/net/arcnet/arcdevice.h | 2 + drivers/net/arcnet/com20020-pci.c | 89 ++++---- drivers/net/ethernet/aquantia/atlantic/aq_ptp.c | 10 +- drivers/net/ethernet/aquantia/atlantic/aq_ptp.h | 4 +- drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 18 +- drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c | 1 + drivers/net/ethernet/broadcom/tg3.c | 42 +++- drivers/net/ethernet/broadcom/tg3.h | 4 +- drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c | 29 +++ drivers/net/ethernet/hisilicon/hns/hns_enet.c | 53 +++-- drivers/net/ethernet/hisilicon/hns/hns_enet.h | 3 +- drivers/net/ethernet/intel/i40e/i40e_main.c | 2 +- drivers/net/ethernet/intel/iavf/iavf_ethtool.c | 12 +- drivers/net/ethernet/intel/iavf/iavf_txrx.h | 1 - drivers/net/ethernet/marvell/octeontx2/af/mbox.h | 2 +- drivers/net/ethernet/marvell/octeontx2/af/mcs.c | 18 +- drivers/net/ethernet/marvell/octeontx2/af/mcs.h | 2 + .../net/ethernet/marvell/octeontx2/af/mcs_reg.h | 31 ++- drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 3 + drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 1 + .../ethernet/marvell/octeontx2/af/rvu_devlink.c | 5 +- .../net/ethernet/marvell/octeontx2/af/rvu_nix.c | 8 + .../net/ethernet/marvell/octeontx2/af/rvu_npc.c | 8 +- .../net/ethernet/marvell/octeontx2/af/rvu_reg.c | 4 +- .../net/ethernet/marvell/octeontx2/af/rvu_reg.h | 1 + .../ethernet/marvell/octeontx2/nic/otx2_ethtool.c | 6 +- .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 9 + .../net/ethernet/marvell/octeontx2/nic/otx2_txrx.c | 20 +- drivers/net/ethernet/pensando/ionic/ionic_dev.h | 2 +- drivers/net/ethernet/pensando/ionic/ionic_lif.c | 16 +- drivers/net/ethernet/realtek/r8169_main.c | 7 +- drivers/net/ethernet/stmicro/stmmac/dwmac5.c | 45 ++-- drivers/net/ethernet/stmicro/stmmac/dwmac5.h | 4 +- .../net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 3 +- drivers/net/ethernet/stmicro/stmmac/hwif.h | 4 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 8 +- drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c | 1 + drivers/net/hyperv/Kconfig | 1 + drivers/net/usb/r8152.c | 110 ++++++---- drivers/nvme/host/nvme.h | 5 + drivers/nvme/host/pci.c | 16 +- drivers/of/dynamic.c | 5 +- drivers/parport/parport_pc.c | 21 ++ drivers/platform/mellanox/mlxbf-bootctl.c | 39 ++-- drivers/platform/mellanox/mlxbf-pmc.c | 14 ++ drivers/platform/surface/aggregator/core.c | 5 +- drivers/platform/x86/Kconfig | 2 +- drivers/platform/x86/asus-nb-wmi.c | 11 - drivers/platform/x86/asus-wmi.c | 8 + drivers/platform/x86/wmi.c | 5 + drivers/powercap/dtpm_cpu.c | 17 +- drivers/scsi/be2iscsi/be_main.c | 1 + drivers/tee/optee/device.c | 17 +- drivers/tty/serial/8250/8250_dw.c | 1 + drivers/tty/serial/8250/8250_early.c | 1 + drivers/tty/serial/8250/8250_omap.c | 14 +- drivers/tty/serial/amba-pl011.c | 112 +++++----- drivers/tty/serial/sc16is7xx.c | 12 + drivers/usb/gadget/function/f_hid.c | 7 +- drivers/usb/gadget/udc/core.c | 4 +- drivers/usb/host/xhci-pci.c | 2 - drivers/usb/typec/class.c | 5 +- drivers/vdpa/mlx5/net/mlx5_vnet.c | 7 +- fs/nilfs2/sufile.c | 44 +++- fs/nilfs2/the_nilfs.c | 6 +- fs/smb/client/cifsfs.c | 174 +++++++++++++-- fs/smb/client/smb2ops.c | 2 + include/linux/cpuhotplug.h | 1 + include/linux/hrtimer.h | 4 +- include/linux/hugetlb.h | 5 +- include/linux/iommu.h | 1 + include/linux/kprobes.h | 13 +- include/linux/rethook.h | 7 +- include/linux/stmmac.h | 1 + include/net/genetlink.h | 2 + include/net/tcp.h | 9 +- include/rdma/ib_umem.h | 9 +- include/rdma/ib_verbs.h | 1 + include/uapi/linux/netfilter/nf_tables.h | 2 + io_uring/io_uring.c | 9 +- io_uring/rsrc.h | 7 - kernel/cgroup/legacy_freezer.c | 8 +- kernel/cpu.c | 8 +- kernel/events/core.c | 61 ++++-- kernel/kprobes.c | 4 +- kernel/time/hrtimer.c | 33 +-- kernel/trace/rethook.c | 23 +- kernel/trace/ring_buffer.c | 23 +- kernel/trace/trace.c | 219 ++++++++----------- lib/zstd/common/fse_decompress.c | 2 +- mm/damon/sysfs.c | 2 +- mm/filemap.c | 2 +- mm/hugetlb.c | 7 + net/core/drop_monitor.c | 4 +- net/core/filter.c | 19 ++ net/core/scm.c | 6 + net/ipv4/ip_gre.c | 11 +- net/ipv4/tcp.c | 22 +- net/ipv4/tcp_input.c | 6 +- net/ipv6/ip6_fib.c | 6 +- net/netfilter/ipset/ip_set_core.c | 14 +- net/netfilter/nf_tables_api.c | 5 +- net/netfilter/nft_dynset.c | 13 +- net/netfilter/nft_exthdr.c | 108 ++++++++- net/netfilter/nft_fib.c | 8 +- net/netfilter/nft_set_pipapo.c | 3 + net/netfilter/xt_owner.c | 16 +- net/netlink/genetlink.c | 3 + net/packet/af_packet.c | 16 +- net/packet/internal.h | 2 +- net/psample/psample.c | 3 +- net/xdp/xsk.c | 5 +- scripts/checkstack.pl | 8 +- scripts/dtc/dt-extract-compatibles | 31 ++- scripts/kconfig/symbol.c | 14 +- sound/core/pcm.c | 1 + sound/pci/hda/patch_realtek.c | 3 + sound/soc/amd/yc/acp6x-mach.c | 7 + sound/soc/codecs/lpass-tx-macro.c | 5 + sound/soc/codecs/wm_adsp.c | 8 +- sound/soc/fsl/fsl_sai.c | 21 ++ sound/usb/mixer_quirks.c | 30 +++ 213 files changed, 2316 insertions(+), 1331 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/194 vdpa/mlx5: preserve CVQ vringh index
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steve Sistare <[email protected]>
[ Upstream commit 480b3e73720f6b5d76bef2387b1f9d19ed67573b ]
mlx5_vdpa does not preserve userland's view of vring base for the control queue in the following sequence:
ioctl VHOST_SET_VRING_BASE
ioctl VHOST_VDPA_SET_STATUS VIRTIO_CONFIG_S_DRIVER_OK
mlx5_vdpa_set_status()
setup_cvq_vring()
vringh_init_iotlb()
vringh_init_kern()
vrh->last_avail_idx = 0;ioctl VHOST_GET_VRING_BASE
To fix, restore the value of cvq->vring.last_avail_idx after calling vringh_init_iotlb.
Message-Id: <[email protected]>
--- drivers/vdpa/mlx5/net/mlx5_vnet.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/vdpa/mlx5/net/mlx5_vnet.c +6 -1
@@ -2508,13 +2508,18 @@ static int setup_cvq_vring(struct mlx5_vdpa_dev *mvdev)struct mlx5_control_vq *cvq = &mvdev->cvq;int err =0 ; -if (mvdev->actual_features &BIT_ULL (VIRTIO_NET_F_CTRL_VQ )) +if (mvdev->actual_features &BIT_ULL (VIRTIO_NET_F_CTRL_VQ )) { +u16 idx = cvq->vring.last_avail_idx; + err =vringh_init_iotlb (&cvq->vring, mvdev->actual_features,MLX5_CVQ_MAX_ENT , false, (struct vring_desc *)(uintptr_t )cvq->desc_addr, (struct vring_avail *)(uintptr_t )cvq->driver_addr, (struct vring_used *)(uintptr_t )cvq->device_addr); +if (!err) + cvq->vring.last_avail_idx = cvq->vring.last_used_idx = idx; + }return err; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 2/194 hrtimers: Push pending hrtimers away from outgoing CPU earlier
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
[ Upstream commit 5c0930ccaad5a74d74e8b18b648c5eb21ed2fe94 ]
2b8272ff4a70 ("cpu/hotplug: Prevent self deadlock on CPU hot-unplug") solved the straight forward CPU hotplug deadlock vs. the scheduler bandwidth timer. Yu discovered a more involved variant where a task which has a bandwidth timer started on the outgoing CPU holds a lock and then gets throttled. If the lock required by one of the CPU hotplug callbacks the hotplug operation deadlocks because the unthrottling timer event is not handled on the dying CPU and can only be recovered once the control CPU reaches the hotplug state which pulls the pending hrtimers from the dead CPU.
Solve this by pushing the hrtimers away from the dying CPU in the dying callbacks. Nothing can queue a hrtimer on the dying CPU at that point because all other CPUs spin in stop_machine() with interrupts disabled and once the operation is finished the CPU is marked offline.
--- include/linux/cpuhotplug.h | 1 + include/linux/hrtimer.h | 4 ++-- kernel/cpu.c | 8 +++++++- kernel/time/hrtimer.c | 33 ++++++++++++--------------------- 4 files changed, 22 insertions(+), 24 deletions(-)
include/linux/cpuhotplug.h +1 -0
@@ -196,6 +196,7 @@ enum cpuhp_state {CPUHP_AP_ARM_CORESIGHT_CTI_STARTING ,CPUHP_AP_ARM64_ISNDEP_STARTING ,CPUHP_AP_SMPCFD_DYING , +CPUHP_AP_HRTIMERS_DYING ,CPUHP_AP_X86_TBOOT_DYING ,CPUHP_AP_ARM_CACHE_B15_RAC_DYING , CPUHP_AP_ONLINE,
include/linux/hrtimer.h +2 -2
@@ -531,9 +531,9 @@ extern void sysrq_timer_list_show(void);int hrtimers_prepare_cpu (unsigned int cpu);#ifdef CONFIG_HOTPLUG_CPU -int hrtimers_dead_cpu (unsigned int cpu); +int hrtimers_cpu_dying (unsigned int cpu);#else -#define hrtimers_dead_cpu NULL +#define hrtimers_cpu_dying NULL#endif #endif
kernel/cpu.c +7 -1
@@ -1733,7 +1733,7 @@ static struct cpuhp_step cpuhp_hp_states[] = { [CPUHP_HRTIMERS_PREPARE] = { .name = "hrtimers:prepare", .startup.single = hrtimers_prepare_cpu, - .teardown.single = hrtimers_dead_cpu, + .teardown.single = NULL, }, [CPUHP_SMPCFD_PREPARE] = { .name = "smpcfd:prepare",
@@ -1800,6 +1800,12 @@ static struct cpuhp_step cpuhp_hp_states[] = { .startup.single = NULL, .teardown.single = smpcfd_dying_cpu, }, + [CPUHP_AP_HRTIMERS_DYING] = { + .name = "hrtimers:dying", + .startup.single = NULL, + .teardown.single = hrtimers_cpu_dying, + }, +/* Entry state on starting. Interrupts enabled from here on. Transient * state for synchronsization */ [CPUHP_AP_ONLINE] = {
kernel/time/hrtimer.c +12 -21
@@ -2216,29 +2216,22 @@ static void migrate_hrtimer_list(struct hrtimer_clock_base *old_base, } } -int hrtimers_dead_cpu (unsigned int scpu) +int hrtimers_cpu_dying (unsigned int dying_cpu) {struct hrtimer_cpu_base *old_base, *new_base; -int i; +int i, ncpu =cpumask_first (cpu_active_mask); -BUG_ON (cpu_online (scpu)); -tick_cancel_sched_timer (scpu); +tick_cancel_sched_timer (dying_cpu); + + old_base =this_cpu_ptr (&hrtimer_bases); + new_base = &per_cpu (hrtimer_bases, ncpu); -/* -* this BH disable ensures that raise_softirq_irqoff() does -* not wakeup ksoftirqd (and acquire the pi-lock) while -* holding the cpu_base lock -*/ -local_bh_disable (); -local_irq_disable (); - old_base = &per_cpu (hrtimer_bases, scpu); - new_base =this_cpu_ptr (&hrtimer_bases);/* * The caller is globally serialized and nobody else * takes two locks at once, deadlock is not possible. */ -raw_spin_lock (&new_base->lock); -raw_spin_lock_nested (&old_base->lock,SINGLE_DEPTH_NESTING ); +raw_spin_lock (&old_base->lock); +raw_spin_lock_nested (&new_base->lock,SINGLE_DEPTH_NESTING );for (i =0 ; i <HRTIMER_MAX_CLOCK_BASES ; i++) { migrate_hrtimer_list(&old_base->clock_base[i],
@@ -2249,15 +2242,13 @@ int hrtimers_dead_cpu(unsigned int scpu)* The migration might have changed the first expiring softirq * timer on this CPU. Update it. */ -hrtimer_update_softirq_timer (new_base, false); +__hrtimer_get_next_event (new_base,HRTIMER_ACTIVE_SOFT ); +/* Tell the other CPU to retrigger the next event */ +smp_call_function_single (ncpu, retrigger_next_event,NULL ,0 ); -raw_spin_unlock (&old_base->lock);raw_spin_unlock (&new_base->lock); +raw_spin_unlock (&old_base->lock); -/* Check, if we got expired work to do */ -__hrtimer_peek_ahead_timers (); -local_irq_enable (); -local_bh_enable ();return 0 ; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 3/194 i2c: designware: Fix corrupted memory seen in the ISR
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Bottorff <[email protected]>
[ Upstream commit f726eaa787e9f9bc858c902d18a09af6bcbfcdaf ]
When running on a many core ARM64 server, errors were happening in the ISR that looked like corrupted memory. These corruptions would fix themselves if small delays were inserted in the ISR. Errors reported by the driver included "i2c_designware APMC0D0F:00: i2c_dw_xfer_msg: invalid target address" and "i2c_designware APMC0D0F:00:controller timed out" during in-band IPMI SSIF stress tests.
The problem was determined to be memory writes in the driver were not becoming visible to all cores when execution rapidly shifted between cores, like when a register write immediately triggers an ISR. Processors with weak memory ordering, like ARM64, make no guarantees about the order normal memory writes become globally visible, unless barrier instructions are used to control ordering.
To solve this, regmap accessor functions configured by this driver were changed to use non-relaxed forms of the low-level register access functions, which include a barrier on platforms that require it. This assures memory writes before a controller register access are visible to all cores. The community concluded defaulting to correct operation outweighed defaulting to the small performance gains from using relaxed access functions. Being a low speed device added weight to this choice of default register access behavior.
--- drivers/i2c/busses/i2c-designware-common.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/i2c/busses/i2c-designware-common.c +8 -8
@@ -63,7 +63,7 @@ static int dw_reg_read(void *context, unsigned int reg, unsigned int *val) {struct dw_i2c_dev *dev = context; - *val =readl_relaxed (dev->base + reg); + *val =readl (dev->base + reg);return 0 ; }
@@ -72,7 +72,7 @@ static int dw_reg_write(void *context, unsigned int reg, unsigned int val) {struct dw_i2c_dev *dev = context; -writel_relaxed (val, dev->base + reg); +writel (val, dev->base + reg);return 0 ; }
@@ -81,7 +81,7 @@ static int dw_reg_read_swab(void *context, unsigned int reg, unsigned int *val) {struct dw_i2c_dev *dev = context; - *val =swab32 (readl_relaxed (dev->base + reg)); + *val =swab32 (readl (dev->base + reg));return 0 ; }
@@ -90,7 +90,7 @@ static int dw_reg_write_swab(void *context, unsigned int reg, unsigned int val) {struct dw_i2c_dev *dev = context; -writel_relaxed (swab32 (val), dev->base + reg); +writel (swab32 (val), dev->base + reg);return 0 ; }
@@ -99,8 +99,8 @@ static int dw_reg_read_word(void *context, unsigned int reg, unsigned int *val) {struct dw_i2c_dev *dev = context; - *val =readw_relaxed (dev->base + reg) | - (readw_relaxed (dev->base + reg +2 ) <<16 ); + *val =readw (dev->base + reg) | + (readw (dev->base + reg +2 ) <<16 );return 0 ; }
@@ -109,8 +109,8 @@ static int dw_reg_write_word(void *context, unsigned int reg, unsigned int val) {struct dw_i2c_dev *dev = context; -writew_relaxed (val, dev->base + reg); -writew_relaxed (val >>16 , dev->base + reg +2 ); +writew (val, dev->base + reg); +writew (val >>16 , dev->base + reg +2 );return 0 ; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 4/194 netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jozsef Kadlecsik <[email protected]>
[ Upstream commit 28628fa952fefc7f2072ce6e8016968cc452b1ba ]
Linkui Xiao reported that there's a race condition when ipset swap and destroy is called, which can lead to crash in add/del/test element operations. Swap then destroy are usual operations to replace a set with another one in a production system. The issue can in some cases be reproduced with the script:
ipset create hash_ip1 hash:net family inet hashsize 1024 maxelem 1048576 ipset add hash_ip1 172.20.0.0/16
ipset add hash_ip1 192.168.0.0/16
iptables -A INPUT -m set --match-set hash_ip1 src -j ACCEPT while [ 1 ]
do
# ... Ongoing traffic...
ipset create hash_ip2 hash:net family inet hashsize 1024 maxelem 1048576
ipset add hash_ip2 172.20.0.0/16
ipset swap hash_ip1 hash_ip2
ipset destroy hash_ip2
sleep 0.05
doneIn the race case the possible order of the operations are
CPU0 CPU1
ip_set_test
ipset swap hash_ip1 hash_ip2 ipset destroy hash_ip2
hash_net_kadt
Swap replaces hash_ip1 with hash_ip2 and then destroy removes hash_ip2 which is the original hash_ip1. ip_set_test was called on hash_ip1 and because destroy removed it, hash_net_kadt crashes.
The fix is to force ip_set_swap() to wait for all readers to finish accessing the old set pointers by calling synchronize_rcu().
The first version of the patch was written by Linkui Xiao <[email protected]>.
v2: synchronize_rcu() is moved into ip_set_swap() in order not to burden
ip_set_destroy() unnecessarily when all sets are destroyed.
v3: Florian Westphal pointed out that all netfilter hooks run with rcu_read_lock() held
and em_ipset.c wraps the entire ip_set_test() in rcu read lock/unlock pair. So there's no need to extend the rcu read locked area in ipset itself.
Reported by: Linkui Xiao <[email protected]>
--- net/netfilter/ipset/ip_set_core.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
net/netfilter/ipset/ip_set_core.c +7 -7
@@ -61,6 +61,8 @@ MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_IPSET); ip_set_dereference((inst)->ip_set_list)[id]#define ip_set_ref_netlink (inst,id) \ rcu_dereference_raw((inst)->ip_set_list)[id] +#define ip_set_dereference_nfnl (p) \ + rcu_dereference_check(p, lockdep_nfnl_is_held(NFNL_SUBSYS_IPSET))/* The set types are implemented in modules and registered set types * can be found in ip_set_type_list. Adding/deleting types is
@@ -708,15 +710,10 @@ __ip_set_put_netlink(struct ip_set *set)static struct ip_set *ip_set_rcu_get (struct net *net,ip_set_id_t index) { -struct ip_set *set;struct ip_set_net *inst =ip_set_pernet (net); -rcu_read_lock (); -/* ip_set_list itself needs to be protected */ - set =rcu_dereference (inst->ip_set_list)[index]; -rcu_read_unlock (); - -return set; +/* ip_set_list and the set pointer need to be protected */ +return ip_set_dereference_nfnl (inst->ip_set_list)[index]; } static inline void
@@ -1399,6 +1396,9 @@ static int ip_set_swap(struct sk_buff *skb, const struct nfnl_info *info,ip_set (inst, to_id) = from;write_unlock_bh (&ip_set_ref_lock); +/* Make sure all readers of the old set pointers are completed. */ +synchronize_rcu (); +return 0 ; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 5/194 zstd: Fix array-index-out-of-bounds UBSAN warning
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nick Terrell <[email protected]>
[ Upstream commit 77618db346455129424fadbbaec596a09feaf3bb ]
Zstd used an array of length 1 to mean a flexible array for C89 compatibility. Switch to a C99 flexible array to fix the UBSAN warning.
Tested locally by booting the kernel and writing to and reading from a BtrFS filesystem with zstd compression enabled. I was unable to reproduce the issue before the fix, however it is a trivial change.
--- lib/zstd/common/fse_decompress.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
lib/zstd/common/fse_decompress.c +1 -1
@@ -312,7 +312,7 @@ size_t FSE_decompress_wksp(void* dst, size_t dstCapacity, const void* cSrc, sizetypedef struct {short ncount[FSE_MAX_SYMBOL_VALUE +1 ]; -FSE_DTable dtable[1 ];/* Dynamically sized */ +FSE_DTable dtable[];/* Dynamically sized */ }FSE_DecompressWksp ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 6/194 tg3: Move the [rt]x_dropped counters to tg3_napi
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Pakhunov <[email protected]>
[ Upstream commit 907d1bdb8b2cc0357d03a1c34d2a08d9943760b1 ]
This change moves [rt]x_dropped counters to tg3_napi so that they can be updated by a single writer, race-free.
--- drivers/net/ethernet/broadcom/tg3.c | 38 +++++++++++++++++++++++++---- drivers/net/ethernet/broadcom/tg3.h | 4 +-- 2 files changed, 35 insertions(+), 7 deletions(-)
drivers/net/ethernet/broadcom/tg3.c +33 -5
@@ -6853,7 +6853,7 @@ static int tg3_rx(struct tg3_napi *tnapi, int budget) desc_idx, *post_ptr); drop_it_no_recycle:/* Other statistics kept track of by card. */ - tp->rx_dropped++; + tnapi->rx_dropped++; goto next_pkt; }
@@ -8151,7 +8151,7 @@ static netdev_tx_t tg3_start_xmit(struct sk_buff *skb, struct net_device *dev) drop:dev_kfree_skb_any (skb); drop_nofree: - tp->tx_dropped++; + tnapi->tx_dropped++;return NETDEV_TX_OK ; }
@@ -9330,7 +9330,7 @@ static void __tg3_set_rx_mode(struct net_device *);/* tp->lock is held. */ static int tg3_halt (struct tg3 *tp,int kind,bool silent) { -int err; +int err, i;tg3_stop_fw (tp);
@@ -9351,6 +9351,13 @@ static int tg3_halt(struct tg3 *tp, int kind, bool silent)/* And make sure the next sample is new data */ memset (tp->hw_stats,0 ,sizeof (struct tg3_hw_stats )); + +for (i =0 ; i <TG3_IRQ_MAX_VECS ; ++i) { +struct tg3_napi *tnapi = &tp->napi[i]; + + tnapi->rx_dropped =0 ; + tnapi->tx_dropped =0 ; + } }return err;
@@ -11900,6 +11907,9 @@ static void tg3_get_nstats(struct tg3 *tp, struct rtnl_link_stats64 *stats) {struct rtnl_link_stats64 *old_stats = &tp->net_stats_prev;struct tg3_hw_stats *hw_stats = tp->hw_stats; +unsigned long rx_dropped; +unsigned long tx_dropped; +int i; stats->rx_packets = old_stats->rx_packets + get_stat64(&hw_stats->rx_ucast_packets) +
@@ -11946,8 +11956,26 @@ static void tg3_get_nstats(struct tg3 *tp, struct rtnl_link_stats64 *stats) stats->rx_missed_errors = old_stats->rx_missed_errors +get_stat64 (&hw_stats->rx_discards); - stats->rx_dropped = tp->rx_dropped; - stats->tx_dropped = tp->tx_dropped; +/* Aggregate per-queue counters. The per-queue counters are updated +* by a single writer, race-free. The result computed by this loop +* might not be 100% accurate (counters can be updated in the middle of +* the loop) but the next tg3_get_nstats() will recompute the current +* value so it is acceptable. +* +* Note that these counters wrap around at 4G on 32bit machines. +*/ + rx_dropped = (unsigned long )(old_stats->rx_dropped); + tx_dropped = (unsigned long )(old_stats->tx_dropped); + +for (i =0 ; i < tp->irq_cnt; i++) { +struct tg3_napi *tnapi = &tp->napi[i]; + + rx_dropped += tnapi->rx_dropped; + tx_dropped += tnapi->tx_dropped; + } + + stats->rx_dropped = rx_dropped; + stats->tx_dropped = tx_dropped; }static int tg3_get_regs_len (struct net_device *dev)
drivers/net/ethernet/broadcom/tg3.h +2 -2
@@ -3018,6 +3018,7 @@ struct tg3_napi {u16 *rx_rcb_prod_idx;struct tg3_rx_prodring_set prodring;struct tg3_rx_buffer_desc *rx_rcb; +unsigned long rx_dropped;u32 tx_prod____cacheline_aligned ;u32 tx_cons;
@@ -3026,6 +3027,7 @@ struct tg3_napi {u32 prodmbox;struct tg3_tx_buffer_desc *tx_ring;struct tg3_tx_ring_info *tx_buffers; +unsigned long tx_dropped;dma_addr_t status_mapping;dma_addr_t rx_rcb_mapping;
@@ -3219,8 +3221,6 @@ struct tg3 {/* begin "everything else" cacheline(s) section */ -unsigned long rx_dropped; -unsigned long tx_dropped;struct rtnl_link_stats64 net_stats_prev;struct tg3_ethtool_stats estats_prev;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 7/194 tg3: Increment tx_dropped in tg3_tso_bug()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Pakhunov <[email protected]>
[ Upstream commit 17dd5efe5f36a96bd78012594fabe21efb01186b ]
tg3_tso_bug() drops a packet if it cannot be segmented for any reason. The number of discarded frames should be incremented accordingly.
--- drivers/net/ethernet/broadcom/tg3.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/broadcom/tg3.c +3 -1
@@ -7879,8 +7879,10 @@ static int tg3_tso_bug(struct tg3 *tp, struct tg3_napi *tnapi, segs =skb_gso_segment (skb, tp->dev->features & ~(NETIF_F_TSO |NETIF_F_TSO6 )); -if (IS_ERR (segs) || !segs) +if (IS_ERR (segs) || !segs) { + tnapi->tx_dropped++; goto tg3_tso_bug_end; + } skb_list_walk_safe(segs, seg, next) {skb_mark_not_on_list (seg);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 8/194 kconfig: fix memory leak from range properties
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masahiro Yamada <[email protected]>
[ Upstream commit ae1eff0349f2e908fc083630e8441ea6dc434dc0 ]
Currently, sym_validate_range() duplicates the range string using xstrdup(), which is overwritten by a subsequent sym_calc_value() call. It results in a memory leak.
Instead, only the pointer should be copied.
Below is a test case, with a summary from Valgrind.
[Test Kconfig]
config FOO
int "foo"
range 10 20[Test .config]
CONFIG_FOO=0
[Before]
LEAK SUMMARY:
definitely lost: 3 bytes in 1 blocks
indirectly lost: 0 bytes in 0 blocks
possibly lost: 0 bytes in 0 blocks
still reachable: 17,465 bytes in 21 blocks
suppressed: 0 bytes in 0 blocks
[After]
LEAK SUMMARY:
definitely lost: 0 bytes in 0 blocks
indirectly lost: 0 bytes in 0 blocks
possibly lost: 0 bytes in 0 blocks
still reachable: 17,462 bytes in 20 blocks
suppressed: 0 bytes in 0 blocks
--- scripts/kconfig/symbol.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-)
scripts/kconfig/symbol.c +6 -8
@@ -122,9 +122,9 @@ static long long sym_get_range_val(struct symbol *sym, int base)static void sym_validate_range (struct symbol *sym) {struct property *prop; +struct symbol *range_sym;int base;long long val, val2; -char str[64 ];switch (sym->type) {case S_INT :
@@ -140,17 +140,15 @@ static void sym_validate_range(struct symbol *sym)if (!prop)return ; val =strtoll (sym->curr.val,NULL , base); - val2 =sym_get_range_val (prop->expr->left.sym, base); + range_sym = prop->expr->left.sym; + val2 =sym_get_range_val (range_sym, base);if (val >= val2) { - val2 =sym_get_range_val (prop->expr->right.sym, base); + range_sym = prop->expr->right.sym; + val2 =sym_get_range_val (range_sym, base);if (val <= val2)return ; } -if (sym->type ==S_INT ) -sprintf (str,"%lld" , val2); -else -sprintf (str,"0x%llx" , val2); - sym->curr.val =xstrdup (str); + sym->curr.val = range_sym->curr.val; }static void sym_set_changed (struct symbol *sym)
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 9/194 drm/amdgpu: correct chunk_ptr to a pointer to chunk.
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: YuanShang <[email protected]>
[ Upstream commit 50d51374b498457c4dea26779d32ccfed12ddaff ]
The variable "chunk_ptr" should be a pointer pointing to a struct drm_amdgpu_cs_chunk instead of to a pointer of that.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +1 -1
@@ -201,7 +201,7 @@ static int amdgpu_cs_pass1(struct amdgpu_cs_parser *p, }for (i =0 ; i < p->nchunks; i++) { -struct drm_amdgpu_cs_chunk __user **chunk_ptr =NULL ; +struct drm_amdgpu_cs_chunk __user *chunk_ptr =NULL ;struct drm_amdgpu_cs_chunk user_chunk;uint32_t __user *cdata;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 10/194 x86: Introduce ia32_enabled()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikolay Borisov <[email protected]>
[ upstream commit 1da5c9bc119d3a749b519596b93f9b2667e93c4a ]
IA32 support on 64bit kernels depends on whether CONFIG_IA32_EMULATION is selected or not. As it is a compile time option it doesn't provide the flexibility to have distributions set their own policy for IA32 support and give the user the flexibility to override it.
As a first step introduce ia32_enabled() which abstracts whether IA32 compat is turned on or off. Upcoming patches will implement the ability to set IA32 compat state at boot time.
--- arch/x86/entry/common.c | 4 ++++ arch/x86/include/asm/ia32.h | 16 +++++++++++++++- 2 files changed, 19 insertions(+), 1 deletion(-)
arch/x86/entry/common.c +4 -0
@@ -96,6 +96,10 @@ static __always_inline int syscall_32_enreturn (int )regs->orig_ax; } +#ifdef CONFIG_IA32_EMULATION +bool __ia32_enabled__ro_after_init = true; +#endif +/* * Invoke a 32-bit syscall. Called with IRQs on in CONTEXT_KERNEL. */
arch/x86/include/asm/ia32.h +15 -1
@@ -68,6 +68,20 @@ extern void ia32_pick_mmap_layout(struct#endif -#endif /* CONFIG_IA32_EMULATION */ +extern bool __ia32_enabled; + +static inline bool ia32_enabled (void ) +{ +return __ia32_enabled; +} + +#else /* !CONFIG_IA32_EMULATION */ + +static inline bool ia32_enabled (void ) +{ +return IS_ENABLED (CONFIG_X86_32 ); +} + +#endif #endif /* _ASM_X86_IA32_H */
Greg Kroah-Hartman
maintainerPATCH 11/194 x86/coco: Disable 32-bit emulation by default on TDX and SEV
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Kirill A. Shutemov" <[email protected]>
[ upstream commit b82a8dbd3d2f4563156f7150c6f2ecab6e960b30 ]
The INT 0x80 instruction is used for 32-bit x86 Linux syscalls. The kernel expects to receive a software interrupt as a result of the INT 0x80 instruction. However, an external interrupt on the same vector triggers the same handler.
The kernel interprets an external interrupt on vector 0x80 as a 32-bit system call that came from userspace.
A VMM can inject external interrupts on any arbitrary vector at any time. This remains true even for TDX and SEV guests where the VMM is untrusted.
Put together, this allows an untrusted VMM to trigger int80 syscall handling at any given point. The content of the guest register file at that moment defines what syscall is triggered and its arguments. It opens the guest OS to manipulation from the VMM side.
Disable 32-bit emulation by default for TDX and SEV. User can override it with the ia32_emulation=y command line option.
[ dhansen: reword the changelog ]
--- arch/x86/coco/tdx/tdx.c | 10 ++++++++++ arch/x86/include/asm/ia32.h | 7 +++++++ arch/x86/mm/mem_encrypt_amd.c | 11 +++++++++++ 3 files changed, 28 insertions(+)
arch/x86/coco/tdx/tdx.c +10 -0
@@ -8,6 +8,7 @@#include <asm/coco.h> #include <asm/tdx.h> #include <asm/vmx.h> +#include <asm/ia32.h> #include <asm/insn.h> #include <asm/insn-eval.h> #include <asm/pgtable.h>
@@ -829,5 +830,14 @@ void __init tdx_early_init(void) x86_platform.guest.enc_cache_flush_required = tdx_cache_flush_required; x86_platform.guest.enc_tlb_flush_required = tdx_tlb_flush_required; +/* +* The VMM is capable of injecting interrupt 0x80 and triggering the +* compatibility syscall path. +* +* By default, the 32-bit emulation is disabled in order to ensure +* the safety of the VM. +*/ +ia32_disable (); +pr_info ("Guest detected\n" ); }
arch/x86/include/asm/ia32.h +7 -0
@@ -75,6 +75,11 @@ static inline bool ia32_enabled(void) return __ia32_enabled; } +static inline void ia32_disable (void ) +{ + __ia32_enabled = false; +} +#else /* !CONFIG_IA32_EMULATION */ static inline bool ia32_enabled (void )
@@ -82,6 +87,8 @@ static inline bool ia32_enabled(void)return IS_ENABLED (CONFIG_X86_32 ); } +static inline void ia32_disable (void ) {} +#endif #endif /* _ASM_X86_IA32_H */
arch/x86/mm/mem_encrypt_amd.c +11 -0
@@ -34,6 +34,7 @@#include <asm/msr.h> #include <asm/cmdline.h> #include <asm/sev.h> +#include <asm/ia32.h> #include "mm_internal.h"
@@ -502,6 +503,16 @@ void __init sme_early_init(void) x86_platform.guest.enc_status_change_finish = amd_enc_status_change_finish; x86_platform.guest.enc_tlb_flush_required = amd_enc_tlb_flush_required; x86_platform.guest.enc_cache_flush_required = amd_enc_cache_flush_required; + +/* +* The VMM is capable of injecting interrupt 0x80 and triggering the +* compatibility syscall path. +* +* By default, the 32-bit emulation is disabled in order to ensure +* the safety of the VM. +*/ +if (sev_status &MSR_AMD64_SEV_ENABLED ) +ia32_disable (); }void __init mem_encrypt_free_decrypted_mem (void )
Greg Kroah-Hartman
maintainerPATCH 12/194 x86/entry: Convert INT 0x80 emulation to IDTENTRY
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
[ upstream commit be5341eb0d43b1e754799498bd2e8756cc167a41 ]
There is no real reason to have a separate ASM entry point implementation for the legacy INT 0x80 syscall emulation on 64-bit.
IDTENTRY provides all the functionality needed with the only difference that it does not:
- save the syscall number (AX) into pt_regs::orig_ax
- set pt_regs::ax to -ENOSYS
Both can be done safely in the C code of an IDTENTRY before invoking any of the syscall related functions which depend on this convention.
Aside of ASM code reduction this prepares for detecting and handling a local APIC injected vector 0x80.
--- arch/x86/entry/common.c | 58 ++++++++++++++++++++++++++++- arch/x86/entry/entry_64_compat.S | 77 --------------------------------------- arch/x86/include/asm/idtentry.h | 4 ++ arch/x86/include/asm/proto.h | 4 -- arch/x86/kernel/idt.c | 2 - arch/x86/xen/enlighten_pv.c | 2 - arch/x86/xen/xen-asm.S | 2 - 7 files changed, 64 insertions(+), 85 deletions(-)
arch/x86/entry/common.c +57 -1
@@ -119,7 +119,62 @@ static __always_inline void do_syscall_3 } } -/* Handles int $0x80 */ +#ifdef CONFIG_IA32_EMULATION +/** +* int80_emulation - 32-bit legacy syscall entry +* +* This entry point can be used by 32-bit and 64-bit programs to perform +* 32-bit system calls. Instances of INT $0x80 can be found inline in +* various programs and libraries. It is also used by the vDSO's +* __kernel_vsyscall fallback for hardware that doesn't support a faster +* entry method. Restarted 32-bit system calls also fall back to INT +* $0x80 regardless of what instruction was originally used to do the +* system call. +* +* This is considered a slow path. It is not used by most libc +* implementations on modern hardware except during process startup. +* +* The arguments for the INT $0x80 based syscall are on stack in the +* pt_regs structure: +* eax: system call number +* ebx, ecx, edx, esi, edi, ebp: arg1 - arg 6 +*/ +DEFINE_IDTENTRY_RAW (int80_emulation) +{ +int nr; + +/* Establish kernel context. */ +enter_from_user_mode (regs); + +instrumentation_begin (); +add_random_kstack_offset (); + +/* +* The low level idtentry code pushed -1 into regs::orig_ax +* and regs::ax contains the syscall number. +* +* User tracing code (ptrace or signal handlers) might assume +* that the regs::orig_ax contains a 32-bit number on invoking +* a 32-bit syscall. +* +* Establish the syscall convention by saving the 32bit truncated +* syscall number in regs::orig_ax and by invalidating regs::ax. +*/ + regs->orig_ax = regs->ax &GENMASK (31 ,0 ); + regs->ax = -ENOSYS ; + + nr =syscall_32_enter (regs); + +local_irq_enable (); + nr =syscall_enter_from_user_mode_work (regs, nr); +do_syscall_32_irqs_on (regs, nr); + +instrumentation_end (); +syscall_exit_to_user_mode (regs); +} +#else /* CONFIG_IA32_EMULATION */ + +/* Handles int $0x80 on a 32bit kernel */ __visible noinstr void do_int80_syscall_32(struct pt_regs *regs) {int nr =syscall_32_enter (regs);
@@ -138,6 +193,7 @@ __visible noinstr void do_int80_syscall_instrumentation_end ();syscall_exit_to_user_mode (regs); } +#endif /* !CONFIG_IA32_EMULATION */ static noinstr bool __do_fast_syscall_32(struct pt_regs *regs) {
arch/x86/entry/entry_64_compat.S +0 -77
80 lines not on this page · raw message
arch/x86/include/asm/idtentry.h +4 -0
@@ -569,6 +569,10 @@ DECLARE_IDTENTRY_RAW(X86_TRAP_UD, exc_iDECLARE_IDTENTRY_RAW (X86_TRAP_BP , exc_int3);DECLARE_IDTENTRY_RAW_ERRORCODE (X86_TRAP_PF , exc_page_fault); +#if defined(CONFIG_IA32_EMULATION ) +DECLARE_IDTENTRY_RAW (IA32_SYSCALL_VECTOR , int80_emulation); +#endif +#ifdef CONFIG_X86_MCE #ifdef CONFIG_X86_64 DECLARE_IDTENTRY_MCE (X86_TRAP_MC , exc_machine_check);
arch/x86/include/asm/proto.h +0 -4
@@ -32,10 +32,6 @@ void entry_SYSCALL_compat(void);void entry_SYSCALL_compat_safe_stack (void );void entry_SYSRETL_compat_unsafe_stack (void );void entry_SYSRETL_compat_end (void ); -void entry_INT80_compat (void ); -#ifdef CONFIG_XEN_PV -void xen_entry_INT80_compat (void ); -#endif #endif void x86_configure_nx (void );
arch/x86/kernel/idt.c +1 -1
@@ -117,7 +117,7 @@ static const __initconst struct idt_data SYSG(X86_TRAP_OF, asm_exc_overflow),#if defined(CONFIG_IA32_EMULATION ) - SYSG(IA32_SYSCALL_VECTOR, entry_INT80_compat), + SYSG(IA32_SYSCALL_VECTOR, asm_int80_emulation),#elif defined(CONFIG_X86_32 ) SYSG(IA32_SYSCALL_VECTOR, entry_INT80_32),#endif
arch/x86/xen/enlighten_pv.c +1 -1
@@ -623,7 +623,7 @@ static struct trap_array_entry trap_arra TRAP_ENTRY(exc_int3, false ), TRAP_ENTRY(exc_overflow, false ),#ifdef CONFIG_IA32_EMULATION - { entry_INT80_compat, xen_entry_INT80_compat, false }, +TRAP_ENTRY (int80_emulation, false ), #endifTRAP_ENTRY (exc_page_fault, false ), TRAP_ENTRY(exc_divide_error, false ),
arch/x86/xen/xen-asm.S +1 -1
@@ -156,7 +156,7 @@ xen_pv_trap asm_xenpv_exc_machine_check #endif /* CONFIG_X86_MCE */ xen_pv_trap asm_exc_simd_coprocessor_error #ifdef CONFIG_IA32_EMULATION -xen_pv_trap entry_INT80_compat +xen_pv_trap asm_int80_emulation #endif xen_pv_trap asm_exc_xen_unknown_trap xen_pv_trap asm_exc_xen_hypervisor_callback
Greg Kroah-Hartman
maintainerPATCH 13/194 x86/entry: Do not allow external 0x80 interrupts
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
[ upstream commit 55617fb991df535f953589586468612351575704 ]
The INT 0x80 instruction is used for 32-bit x86 Linux syscalls. The kernel expects to receive a software interrupt as a result of the INT 0x80 instruction. However, an external interrupt on the same vector also triggers the same codepath.
An external interrupt on vector 0x80 will currently be interpreted as a 32-bit system call, and assuming that it was a user context.
Panic on external interrupts on the vector.
To distinguish software interrupts from external ones, the kernel checks the APIC ISR bit relevant to the 0x80 vector. For software interrupts, this bit will be 0.
--- arch/x86/entry/common.c | 37 ++++++++++++++++++++++++++++++++++++- 1 file changed, 36 insertions(+), 1 deletion(-)
arch/x86/entry/common.c +36 -1
@@ -25,6 +25,7 @@#include <xen/events.h> #endif +#include <asm/apic.h> #include <asm/desc.h> #include <asm/traps.h> #include <asm/vdso.h>
@@ -120,6 +121,25 @@ static __always_inline void do_syscall_3 }#ifdef CONFIG_IA32_EMULATION +static __always_inline bool int80_is_external(void) +{ +const unsigned int offs = (0x80 /32 ) *0x10 ; +const u32 bit =BIT (0x80 %32 ); + +/* The local APIC on XENPV guests is fake */ +if (cpu_feature_enabled (X86_FEATURE_XENPV )) +return false; + +/* +* If vector 0x80 is set in the APIC ISR then this is an external +* interrupt. Either from broken hardware or injected by a VMM. +* +* Note: In guest mode this is only valid for secure guests where +* the secure module fully controls the vAPIC exposed to the guest. +*/ +return apic_read (APIC_ISR + offs) & bit; +} +/** * int80_emulation - 32-bit legacy syscall entry *
@@ -143,12 +163,27 @@ DEFINE_IDTENTRY_RAW(int80_emulation) {int nr; -/* Establish kernel context. */ +/* Kernel does not use INT $0x80! */ +if (unlikely (!user_mode (regs))) { +irqentry_enter (regs); +instrumentation_begin (); +panic ("Unexpected external interrupt 0x80\n" ); + } + +/* +* Establish kernel context for instrumentation, including for +* int80_is_external() below which calls into the APIC driver. +* Identical for soft and external interrupts. +*/ enter_from_user_mode (regs);instrumentation_begin ();add_random_kstack_offset (); +/* Validate that this is a soft interrupt to the extent possible */ +if (unlikely (int80_is_external ())) +panic ("Unexpected external interrupt 0x80\n" ); +/* * The low level idtentry code pushed -1 into regs::orig_ax * and regs::ax contains the syscall number.
Greg Kroah-Hartman
maintainerPATCH 14/194 x86/tdx: Allow 32-bit emulation by default
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Kirill A. Shutemov" <[email protected]>
[ upstream commit f4116bfc44621882556bbf70f5284fbf429a5cf6 ]
32-bit emulation was disabled on TDX to prevent a possible attack by a VMM injecting an interrupt on vector 0x80.
Now that int80_emulation() has a check for external interrupts the limitation can be lifted.
To distinguish software interrupts from external ones, int80_emulation() checks the APIC ISR bit relevant to the 0x80 vector. For software interrupts, this bit will be 0.
On TDX, the VAPIC state (including ISR) is protected and cannot be manipulated by the VMM. The ISR bit is set by the microcode flow during the handling of posted interrupts.
[ dhansen: more changelog tweaks ]
--- arch/x86/coco/tdx/tdx.c | 9 --------- 1 file changed, 9 deletions(-)
arch/x86/coco/tdx/tdx.c +0 -9
@@ -830,14 +830,5 @@ void __init tdx_early_init(void) x86_platform.guest.enc_cache_flush_required = tdx_cache_flush_required; x86_platform.guest.enc_tlb_flush_required = tdx_tlb_flush_required; -/* -* The VMM is capable of injecting interrupt 0x80 and triggering the -* compatibility syscall path. -* -* By default, the 32-bit emulation is disabled in order to ensure -* the safety of the VM. -*/ -ia32_disable (); -pr_info ("Guest detected\n" ); }
Greg Kroah-Hartman
maintainerPATCH 15/194 dt: dt-extract-compatibles: Handle cfile arguments in generator function
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nícolas F. R. A. Prado <[email protected]>
[ Upstream commit eb2139fc0da63b89a2ad565ecd8133a37e8b7c4f ]
Move the handling of the cfile arguments to a separate generator function to avoid redundancy.
Stable-dep-of: 8f51593cdcab ("dt: dt-extract-compatibles: Don't follow symlinks when walking tree")
--- scripts/dtc/dt-extract-compatibles | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-)
scripts/dtc/dt-extract-compatibles +11 -8
@@ -49,6 +49,14 @@ def print_compat(filename, compatibles): else: print(*compatibles, sep='\n') +def files_to_parse(path_args): + for f in path_args: + if os.path.isdir(f): + for filename in glob.iglob(f + "/**/*.c", recursive=True): + yield filename + else: + yield f + show_filename = False if __name__ == "__main__":
@@ -59,11 +67,6 @@ if __name__ == "__main__": show_filename = args.with_filename - for f in args.cfile: - if os.path.isdir(f): - for filename in glob.iglob(f + "/**/*.c", recursive=True): - compat_list = parse_compatibles(filename) - print_compat(filename, compat_list) - else: - compat_list = parse_compatibles(f) - print_compat(f, compat_list) + for f in files_to_parse(args.cfile): + compat_list = parse_compatibles(f) + print_compat(f, compat_list)
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 16/194 dt: dt-extract-compatibles: Dont follow symlinks when walking tree
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nícolas F. R. A. Prado <[email protected]>
[ Upstream commit 8f51593cdcab82fb23ef2e1a0010b2e6f99aae02 ]
The iglob function, which we use to find C source files in the kernel tree, always follows symbolic links. This can cause unintentional recursions whenever a symbolic link points to a parent directory. A common scenario is building the kernel with the output set to a directory inside the kernel tree, which will contain such a symlink.
Instead of using the iglob function, use os.walk to traverse the directory tree, which by default doesn't follow symbolic links. fnmatch is then used to match the glob on the filename, as well as ignore hidden files (which were ignored by default with iglob).
This approach runs just as fast as using iglob.
--- scripts/dtc/dt-extract-compatibles | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
scripts/dtc/dt-extract-compatibles +12 -2
@@ -1,8 +1,8 @@ #!/usr/bin/env python3 # SPDX-License-Identifier: GPL-2.0-only +import fnmatch import os -import glob import re import argparse
@@ -49,10 +49,20 @@ def print_compat(filename, compatibles): else: print(*compatibles, sep='\n') +def glob_without_symlinks(root, glob): + for path, dirs, files in os.walk(root): + # Ignore hidden directories + for d in dirs: + if fnmatch.fnmatch(d, ".*"): + dirs.remove(d) + for f in files: + if fnmatch.fnmatch(f, glob): + yield os.path.join(path, f) + def files_to_parse(path_args): for f in path_args: if os.path.isdir(f): - for filename in glob.iglob(f + "/**/*.c", recursive=True): + for filename in glob_without_symlinks(f, "*.c"): yield filename else: yield f
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 17/194 platform/x86: asus-wmi: Move i8042 filter install to shared asus-wmi code
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit b52cbca22cbf6c9d2700c1e576d0ddcc670e49d5 ]
asus-nb-wmi calls i8042_install_filter() in some cases, but it never calls i8042_remove_filter(). This means that a dangling pointer to the filter function is left after rmmod leading to crashes.
Fix this by moving the i8042-filter installation to the shared asus-wmi code and also remove it from the shared code on driver unbind.
--- drivers/platform/x86/Kconfig | 2 +- drivers/platform/x86/asus-nb-wmi.c | 11 ----------- drivers/platform/x86/asus-wmi.c | 8 ++++++++ 3 files changed, 9 insertions(+), 12 deletions(-)
drivers/platform/x86/Kconfig +1 -1
@@ -271,6 +271,7 @@ config ASUS_WMI depends on RFKILL || RFKILL = n depends on HOTPLUG_PCI depends on ACPI_VIDEO || ACPI_VIDEO = n + depends on SERIO_I8042 || SERIO_I8042 = n select INPUT_SPARSEKMAP select LEDS_CLASS select NEW_LEDS
@@ -287,7 +288,6 @@ config ASUS_WMI config ASUS_NB_WMI tristate "Asus Notebook WMI Driver" depends on ASUS_WMI - depends on SERIO_I8042 || SERIO_I8042 = n help This is a driver for newer Asus notebooks. It adds extra features like wireless radio and bluetooth control, leds, hotkeys, backlight...
drivers/platform/x86/asus-nb-wmi.c +0 -11
@@ -501,8 +501,6 @@ static const struct dmi_system_id asus_quirks[] = {static void asus_nb_wmi_quirks (struct asus_wmi_driver *driver) { -int ret; - quirks = &quirk_asus_unknown;dmi_check_system (asus_quirks);
@@ -517,15 +515,6 @@ static void asus_nb_wmi_quirks(struct asus_wmi_driver *driver)if (tablet_mode_sw !=-1 ) quirks->tablet_switch_mode = tablet_mode_sw; - -if (quirks->i8042_filter) { - ret =i8042_install_filter (quirks->i8042_filter); -if (ret) { -pr_warn ("Unable to install key filter\n" ); -return ; - } -pr_info ("Using i8042 filter function for receiving events\n" ); - } }static const struct key_entry asus_nb_wmi_keymap[] = {
drivers/platform/x86/asus-wmi.c +8 -0
@@ -3839,6 +3839,12 @@ static int asus_wmi_add(struct platform_device *pdev) goto fail_wmi_handler; } +if (asus->driver->quirks->i8042_filter) { + err =i8042_install_filter (asus->driver->quirks->i8042_filter); +if (err) +pr_warn ("Unable to install key filter - %d\n" , err); + } +asus_wmi_battery_init (asus);asus_wmi_debugfs_init (asus);
@@ -3873,6 +3879,8 @@ static int asus_wmi_remove(struct platform_device *device)struct asus_wmi *asus; asus =platform_get_drvdata (device); +if (asus->driver->quirks->i8042_filter) +i8042_remove_filter (asus->driver->quirks->i8042_filter);wmi_remove_notify_handler (asus->driver->event_guid);asus_wmi_backlight_exit (asus);asus_wmi_input_exit (asus);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 18/194 of: dynamic: Fix of_reconfig_get_state_change() return value documentation
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Ceresoli <[email protected]>
[ Upstream commit d79972789d17499b6091ded2fc0c6763c501a5ba ]
The documented numeric return values do not match the actual returned values. Fix them by using the enum names instead of raw numbers.
--- drivers/of/dynamic.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/of/dynamic.c +3 -2
@@ -104,8 +104,9 @@ int of_reconfig_notify(unsigned long action, struct of_reconfig_data *p)* * Returns the new state of a device based on the notifier used. * -* Return: 0 on device going from enabled to disabled, 1 on device -* going from disabled to enabled and -1 on no change. +* Return: OF_RECONFIG_CHANGE_REMOVE on device going from enabled to +* disabled, OF_RECONFIG_CHANGE_ADD on device going from disabled to +* enabled and OF_RECONFIG_NO_CHANGE on no change. */ int of_reconfig_get_state_change (unsigned long action,struct of_reconfig_data *pr) {
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 19/194 platform/x86: wmi: Skip blocks with zero instances
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <[email protected]>
[ Upstream commit cbf54f37600e874d82886aa3b2f471778cae01ce ]
Some machines like the HP Omen 17 ck2000nf contain WMI blocks with zero instances, so any WMI driver which tries to handle the associated WMI device will fail.
Skip such WMI blocks to avoid confusing any WMI drivers.
--- drivers/platform/x86/wmi.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/platform/x86/wmi.c +5 -0
@@ -1227,6 +1227,11 @@ static int parse_wdg(struct device *wmi_bus_dev, struct acpi_device *device)if (debug_dump_wdg)wmi_dump_wdg (&gblock[i]); +if (!gblock[i].instance_count) { +dev_info (wmi_bus_dev,FW_INFO "%pUL has zero instances\n" , &gblock[i].guid); +continue ; + } +if (guid_already_parsed_for_legacy (device, &gblock[i].guid))continue ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 20/194 ipv6: fix potential NULL deref in fib6_add()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 75475bb51e78a3f54ad2f69380f2a1c985e85f2d ]
If fib6_find_prefix() returns NULL, we should silently fallback using fib6_null_entry regardless of RT6_DEBUG value.
syzbot reported:
WARNING: CPU: 0 PID: 5477 at net/ipv6/ip6_fib.c:1516 fib6_add+0x310d/0x3fa0 net/ipv6/ip6_fib.c:1516 Modules linked in: CPU: 0 PID: 5477 Comm: syz-executor.0 Not tainted 6.7.0-rc2-syzkaller-00029-g9b6de136b5f0 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 RIP: 0010:fib6_add+0x310d/0x3fa0 net/ipv6/ip6_fib.c:1516 Code: 00 48 8b 54 24 68 e8 42 22 00 00 48 85 c0 74 14 49 89 c6 e8 d5 d3 c2 f7 eb 5d e8 ce d3 c2 f7 e9 ca 00 00 00 e8 c4 d3 c2 f7 90 <0f> 0b 90 48 b8 00 00 00 00 00 fc ff df 48 8b 4c 24 38 80 3c 01 00 RSP: 0018:ffffc90005067740 EFLAGS: 00010293 RAX: ffffffff89cba5bc RBX: ffffc90005067ab0 RCX: ffff88801a2e9dc0 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 RBP: ffffc90005067980 R08: ffffffff89cbca85 R09: 1ffff110040d4b85 R10: dffffc0000000000 R11: ffffed10040d4b86 R12: 00000000ffffffff R13: 1ffff110051c3904 R14: ffff8880206a5c00 R15: ffff888028e1c820 FS: 00007f763783c6c0(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f763783bff8 CR3: 000000007f74d000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> __ip6_ins_rt net/ipv6/route.c:1303 [inline] ip6_route_add+0x88/0x120 net/ipv6/route.c:3847 ipv6_route_ioctl+0x525/0x7b0 net/ipv6/route.c:4467 inet6_ioctl+0x21a/0x270 net/ipv6/af_inet6.c:575 sock_do_ioctl+0x152/0x460 net/socket.c:1220 sock_ioctl+0x615/0x8c0 net/socket.c:1339 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:871 [inline] __se_sys_ioctl+0xf8/0x170 fs/ioctl.c:857 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x45/0x110 arch/x86/entry/common.c:82
--- net/ipv6/ip6_fib.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
net/ipv6/ip6_fib.c +1 -5
@@ -1502,13 +1502,9 @@ int fib6_add(struct fib6_node *root, struct fib6_info *rt,if (!pn_leaf && !(pn->fn_flags &RTN_RTINFO )) { pn_leaf =fib6_find_prefix (info->nl_net, table, pn); -#if RT6_DEBUG >=2 -if (!pn_leaf) { -WARN_ON (!pn_leaf); +if (!pn_leaf) pn_leaf = info->nl_net->ipv6.fib6_null_entry; - } -#endif fib6_info_hold (pn_leaf);rcu_assign_pointer (pn->leaf, pn_leaf); }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 21/194 octeontx2-pf: Add missing mutex lock in otx2_get_pauseparam
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Subbaraya Sundeep <[email protected]>
[ Upstream commit 9572c949385aa2ef10368287c439bcb7935137c8 ]
All the mailbox messages sent to AF needs to be guarded by mutex lock. Add the missing lock in otx2_get_pauseparam function.
--- drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c +5 -1
@@ -323,9 +323,12 @@ static void otx2_get_pauseparam(struct net_device *netdev,if (is_otx2_lbkvf (pfvf->pdev))return ; +mutex_lock (&pfvf->mbox.lock); req =otx2_mbox_alloc_msg_cgx_cfg_pause_frm (&pfvf->mbox); -if (!req) +if (!req) { +mutex_unlock (&pfvf->mbox.lock);return ; + }if (!otx2_sync_mbox_msg (&pfvf->mbox)) { rsp = (struct cgx_pause_frm_cfg *)
@@ -333,6 +336,7 @@ static void otx2_get_pauseparam(struct net_device *netdev, pause->rx_pause = rsp->rx_pause; pause->tx_pause = rsp->tx_pause; } +mutex_unlock (&pfvf->mbox.lock); } static int otx2_set_pauseparam(struct net_device *netdev,
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 22/194 octeontx2-af: Check return value of nix_get_nixlf before using nixlf
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Subbaraya Sundeep <[email protected]>
[ Upstream commit 830139e7b6911266a84a77e1f18abf758995cc89 ]
If a NIXLF is not attached to a PF/VF device then nix_get_nixlf function fails and returns proper error code. But npc_get_default_entry_action does not check it and uses garbage value in subsequent calls. Fix this by cheking the return value of nix_get_nixlf.
--- drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c +7 -1
@@ -389,7 +389,13 @@ static u64 npc_get_default_entry_action(struct rvu *rvu, struct npc_mcam *mcam,int bank, nixlf, index;/* get ucast entry rule entry index */ -nix_get_nixlf (rvu, pf_func, &nixlf,NULL ); +if (nix_get_nixlf (rvu, pf_func, &nixlf,NULL )) { +dev_err (rvu->dev,"%s: nixlf not attached to pcifunc:0x%x\n" , + __func__, pf_func); +/* Action 0 is drop */ +return 0 ; + } + index =npc_get_nixlf_mcam_index (mcam, pf_func, nixlf,NIXLF_UCAST_ENTRY ); bank =npc_get_bank (mcam, index);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 23/194 hv_netvsc: rndis_filter needs to select NLS
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <[email protected]>
[ Upstream commit 6c89f49964375c904cea33c0247467873f4daf2c ]
rndis_filter uses utf8s_to_utf16s() which is provided by setting NLS, so select NLS to fix the build error:
ERROR: modpost: "utf8s_to_utf16s" [drivers/net/hyperv/hv_netvsc.ko] undefined!
--- drivers/net/hyperv/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/net/hyperv/Kconfig +1 -0
@@ -3,5 +3,6 @@ config HYPERV_NET tristate "Microsoft Hyper-V virtual network driver" depends on HYPERV select UCS2_STRING + select NLS help Select this option to enable the Hyper-V virtual network driver.
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 24/194 r8152: Rename RTL8152_UNPLUG to RTL8152_INACCESSIBLE
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Anderson <[email protected]>
[ Upstream commit 715f67f33af45ce2cc3a5b1ef133cc8c8e7787b0 ]
Whenever the RTL8152_UNPLUG is set that just tells the driver that all accesses will fail and we should just immediately bail. A future patch will use this same concept at a time when the driver hasn't actually been unplugged but is about to be reset. Rename the flag in preparation for the future patch.
This is a no-op change and just a search and replace.
Stable-dep-of: 32a574c7e268 ("r8152: Add RTL8152_INACCESSIBLE checks to more loops")
--- drivers/net/usb/r8152.c | 96 ++++++++++++++++++++--------------------- 1 file changed, 48 insertions(+), 48 deletions(-)
drivers/net/usb/r8152.c +48 -48
@@ -763,7 +763,7 @@ enum rtl_register_content {/* rtl8152 flags */ enum rtl8152_flags { -RTL8152_UNPLUG =0 , +RTL8152_INACCESSIBLE =0 ,RTL8152_SET_RX_MODE ,WORK_ENABLE ,RTL8152_LINK_CHG ,
@@ -1244,7 +1244,7 @@ int set_registers(struct r8152 *tp, u16 value, u16 index, u16 size, void *data)static void rtl_set_unplug (struct r8152 *tp) {if (tp->udev->state ==USB_STATE_NOTATTACHED ) { -set_bit (RTL8152_UNPLUG , &tp->flags); +set_bit (RTL8152_INACCESSIBLE , &tp->flags);smp_mb__after_atomic (); } }
@@ -1255,7 +1255,7 @@ static int generic_ocp_read(struct r8152 *tp, u16 index, u16 size,u16 limit =64 ;int ret =0 ; -if (test_bit (RTL8152_UNPLUG , &tp->flags)) +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags))return -ENODEV ;/* both size and indix must be 4 bytes align */
@@ -1299,7 +1299,7 @@ static int generic_ocp_write(struct r8152 *tp, u16 index, u16 byteen,u16 byteen_start, byteen_end, byen;u16 limit =512 ; -if (test_bit (RTL8152_UNPLUG , &tp->flags)) +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags))return -ENODEV ;/* both size and indix must be 4 bytes align */
@@ -1529,7 +1529,7 @@ static int read_mii_word(struct net_device *netdev, int phy_id, int reg)struct r8152 *tp =netdev_priv (netdev);int ret; -if (test_bit (RTL8152_UNPLUG , &tp->flags)) +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags))return -ENODEV ;if (phy_id !=R8152_PHY_ID )
@@ -1545,7 +1545,7 @@ void write_mii_word(struct net_device *netdev, int phy_id, int reg, int val) {struct r8152 *tp =netdev_priv (netdev); -if (test_bit (RTL8152_UNPLUG , &tp->flags)) +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags))return ;if (phy_id !=R8152_PHY_ID )
@@ -1750,7 +1750,7 @@ static void read_bulk_callback(struct urb *urb)if (!tp)return ; -if (test_bit (RTL8152_UNPLUG , &tp->flags)) +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags))return ;if (!test_bit (WORK_ENABLE , &tp->flags))
@@ -1842,7 +1842,7 @@ static void write_bulk_callback(struct urb *urb)if (!test_bit (WORK_ENABLE , &tp->flags))return ; -if (test_bit (RTL8152_UNPLUG , &tp->flags)) +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags))return ;if (!skb_queue_empty (&tp->tx_queue))
@@ -1863,7 +1863,7 @@ static void intr_callback(struct urb *urb)if (!test_bit (WORK_ENABLE , &tp->flags))return ; -if (test_bit (RTL8152_UNPLUG , &tp->flags)) +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags))return ;switch (status) {
@@ -2607,7 +2607,7 @@ static void bottom_half(struct tasklet_struct *t) {struct r8152 *tp =from_tasklet (tp, t, tx_tl); -if (test_bit (RTL8152_UNPLUG , &tp->flags)) +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags))return ;if (!test_bit (WORK_ENABLE , &tp->flags))
@@ -2650,7 +2650,7 @@ int r8152_submit_rx(struct r8152 *tp, struct rx_agg *agg, gfp_t mem_flags)int ret;/* The rx would be stopped, so skip submitting */ -if (test_bit (RTL8152_UNPLUG , &tp->flags) || +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags) || !test_bit (WORK_ENABLE , &tp->flags) || !netif_carrier_ok (tp->netdev))return 0 ;
@@ -3050,7 +3050,7 @@ static int rtl_enable(struct r8152 *tp)static int rtl8152_enable (struct r8152 *tp) { -if (test_bit (RTL8152_UNPLUG , &tp->flags)) +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags))return -ENODEV ;set_tx_qlen (tp);
@@ -3137,7 +3137,7 @@ static int rtl8153_enable(struct r8152 *tp) {u32 ocp_data; -if (test_bit (RTL8152_UNPLUG , &tp->flags)) +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags))return -ENODEV ;set_tx_qlen (tp);
@@ -3169,7 +3169,7 @@ static void rtl_disable(struct r8152 *tp)u32 ocp_data;int i; -if (test_bit (RTL8152_UNPLUG , &tp->flags)) { +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags)) {rtl_drop_queued_tx (tp);return ; }
@@ -3623,7 +3623,7 @@ static u16 r8153_phy_status(struct r8152 *tp, u16 desired) }msleep (20 ); -if (test_bit (RTL8152_UNPLUG , &tp->flags)) +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags))break ; }
@@ -3655,7 +3655,7 @@ static void r8153b_ups_en(struct r8152 *tp, bool enable)int i;for (i =0 ; i <500 ; i++) { -if (test_bit (RTL8152_UNPLUG , &tp->flags)) +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags))return ;if (ocp_read_word (tp,MCU_TYPE_PLA ,PLA_BOOT_CTRL ) &AUTOLOAD_DONE )
@@ -3697,7 +3697,7 @@ static void r8153c_ups_en(struct r8152 *tp, bool enable)int i;for (i =0 ; i <500 ; i++) { -if (test_bit (RTL8152_UNPLUG , &tp->flags)) +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags))return ;if (ocp_read_word (tp,MCU_TYPE_PLA ,PLA_BOOT_CTRL ) &AUTOLOAD_DONE )
@@ -4062,8 +4062,8 @@ static int rtl_phy_patch_request(struct r8152 *tp, bool request, bool wait)for (i =0 ; wait && i <5000 ; i++) {u32 ocp_data; -if (test_bit (RTL8152_UNPLUG , &tp->flags)) -break ; +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags)) +return -ENODEV ;usleep_range (1000 ,2000 ); ocp_data =ocp_reg_read (tp,OCP_PHY_PATCH_STAT );
@@ -6026,7 +6026,7 @@ static int rtl8156_enable(struct r8152 *tp)u32 ocp_data;u16 speed; -if (test_bit (RTL8152_UNPLUG , &tp->flags)) +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags))return -ENODEV ;r8156_fc_parameter (tp);
@@ -6084,7 +6084,7 @@ static int rtl8156b_enable(struct r8152 *tp)u32 ocp_data;u16 speed; -if (test_bit (RTL8152_UNPLUG , &tp->flags)) +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags))return -ENODEV ;set_tx_qlen (tp);
@@ -6270,7 +6270,7 @@ static int rtl8152_set_speed(struct r8152 *tp, u8 autoneg, u32 speed, u8 duplex,static void rtl8152_up (struct r8152 *tp) { -if (test_bit (RTL8152_UNPLUG , &tp->flags)) +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags))return ;r8152_aldps_en (tp, false);
@@ -6280,7 +6280,7 @@ static void rtl8152_up(struct r8152 *tp)static void rtl8152_down (struct r8152 *tp) { -if (test_bit (RTL8152_UNPLUG , &tp->flags)) { +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags)) {rtl_drop_queued_tx (tp);return ; }
@@ -6295,7 +6295,7 @@ static void rtl8153_up(struct r8152 *tp) {u32 ocp_data; -if (test_bit (RTL8152_UNPLUG , &tp->flags)) +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags))return ;r8153_u1u2en (tp, false);
@@ -6335,7 +6335,7 @@ static void rtl8153_down(struct r8152 *tp) {u32 ocp_data; -if (test_bit (RTL8152_UNPLUG , &tp->flags)) { +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags)) {rtl_drop_queued_tx (tp);return ; }
@@ -6356,7 +6356,7 @@ static void rtl8153b_up(struct r8152 *tp) {u32 ocp_data; -if (test_bit (RTL8152_UNPLUG , &tp->flags)) +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags))return ;r8153b_u1u2en (tp, false);
@@ -6380,7 +6380,7 @@ static void rtl8153b_down(struct r8152 *tp) {u32 ocp_data; -if (test_bit (RTL8152_UNPLUG , &tp->flags)) { +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags)) {rtl_drop_queued_tx (tp);return ; }
@@ -6417,7 +6417,7 @@ static void rtl8153c_up(struct r8152 *tp) {u32 ocp_data; -if (test_bit (RTL8152_UNPLUG , &tp->flags)) +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags))return ;r8153b_u1u2en (tp, false);
@@ -6498,7 +6498,7 @@ static void rtl8156_up(struct r8152 *tp) {u32 ocp_data; -if (test_bit (RTL8152_UNPLUG , &tp->flags)) +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags))return ;r8153b_u1u2en (tp, false);
@@ -6571,7 +6571,7 @@ static void rtl8156_down(struct r8152 *tp) {u32 ocp_data; -if (test_bit (RTL8152_UNPLUG , &tp->flags)) { +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags)) {rtl_drop_queued_tx (tp);return ; }
@@ -6709,7 +6709,7 @@ static void rtl_work_func_t(struct work_struct *work)/* If the device is unplugged or !netif_running(), the workqueue * doesn't need to wake the device, and could return directly. */ -if (test_bit (RTL8152_UNPLUG , &tp->flags) || !netif_running (tp->netdev)) +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags) || !netif_running (tp->netdev))return ;if (usb_autopm_get_interface (tp->intf) <0 )
@@ -6748,7 +6748,7 @@ static void rtl_hw_phy_work_func_t(struct work_struct *work) { struct r8152 *tp = container_of(work, struct r8152, hw_phy_work.work); -if (test_bit (RTL8152_UNPLUG , &tp->flags)) +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags))return ;if (usb_autopm_get_interface (tp->intf) <0 )
@@ -6875,7 +6875,7 @@ static int rtl8152_close(struct net_device *netdev)netif_stop_queue (netdev); res =usb_autopm_get_interface (tp->intf); -if (res <0 ||test_bit (RTL8152_UNPLUG , &tp->flags)) { +if (res <0 ||test_bit (RTL8152_INACCESSIBLE , &tp->flags)) {rtl_drop_queued_tx (tp);rtl_stop_rx (tp); }else {
@@ -6908,7 +6908,7 @@ static void r8152b_init(struct r8152 *tp)u32 ocp_data;u16 data; -if (test_bit (RTL8152_UNPLUG , &tp->flags)) +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags))return ; data =r8152_mdio_read (tp,MII_BMCR );
@@ -6952,7 +6952,7 @@ static void r8153_init(struct r8152 *tp)u16 data;int i; -if (test_bit (RTL8152_UNPLUG , &tp->flags)) +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags))return ;r8153_u1u2en (tp, false);
@@ -6963,7 +6963,7 @@ static void r8153_init(struct r8152 *tp)break ;msleep (20 ); -if (test_bit (RTL8152_UNPLUG , &tp->flags)) +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags))break ; }
@@ -7092,7 +7092,7 @@ static void r8153b_init(struct r8152 *tp)u16 data;int i; -if (test_bit (RTL8152_UNPLUG , &tp->flags)) +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags))return ;r8153b_u1u2en (tp, false);
@@ -7103,7 +7103,7 @@ static void r8153b_init(struct r8152 *tp)break ;msleep (20 ); -if (test_bit (RTL8152_UNPLUG , &tp->flags)) +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags))break ; }
@@ -7174,7 +7174,7 @@ static void r8153c_init(struct r8152 *tp)u16 data;int i; -if (test_bit (RTL8152_UNPLUG , &tp->flags)) +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags))return ;r8153b_u1u2en (tp, false);
@@ -7194,7 +7194,7 @@ static void r8153c_init(struct r8152 *tp)break ;msleep (20 ); -if (test_bit (RTL8152_UNPLUG , &tp->flags)) +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags))return ; }
@@ -8023,7 +8023,7 @@ static void r8156_init(struct r8152 *tp)u16 data;int i; -if (test_bit (RTL8152_UNPLUG , &tp->flags)) +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags))return ; ocp_data =ocp_read_byte (tp,MCU_TYPE_USB ,USB_ECM_OP );
@@ -8044,7 +8044,7 @@ static void r8156_init(struct r8152 *tp)break ;msleep (20 ); -if (test_bit (RTL8152_UNPLUG , &tp->flags)) +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags))return ; }
@@ -8119,7 +8119,7 @@ static void r8156b_init(struct r8152 *tp)u16 data;int i; -if (test_bit (RTL8152_UNPLUG , &tp->flags)) +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags))return ; ocp_data =ocp_read_byte (tp,MCU_TYPE_USB ,USB_ECM_OP );
@@ -8153,7 +8153,7 @@ static void r8156b_init(struct r8152 *tp)break ;msleep (20 ); -if (test_bit (RTL8152_UNPLUG , &tp->flags)) +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags))return ; }
@@ -9219,7 +9219,7 @@ static int rtl8152_ioctl(struct net_device *netdev, struct ifreq *rq, int cmd)struct mii_ioctl_data *data =if_mii (rq);int res; -if (test_bit (RTL8152_UNPLUG , &tp->flags)) +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags))return -ENODEV ; res =usb_autopm_get_interface (tp->intf);
@@ -9321,7 +9321,7 @@ static const struct net_device_ops rtl8152_netdev_ops = {static void rtl8152_unload (struct r8152 *tp) { -if (test_bit (RTL8152_UNPLUG , &tp->flags)) +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags))return ;if (tp->version !=RTL_VER_01 )
@@ -9330,7 +9330,7 @@ static void rtl8152_unload(struct r8152 *tp)static void rtl8153_unload (struct r8152 *tp) { -if (test_bit (RTL8152_UNPLUG , &tp->flags)) +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags))return ;r8153_power_cut_en (tp, false);
@@ -9338,7 +9338,7 @@ static void rtl8153_unload(struct r8152 *tp)static void rtl8153b_unload (struct r8152 *tp) { -if (test_bit (RTL8152_UNPLUG , &tp->flags)) +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags))return ;r8153b_power_cut_en (tp, false);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 25/194 r8152: Add RTL8152_INACCESSIBLE checks to more loops
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Anderson <[email protected]>
[ Upstream commit 32a574c7e2685aa8138754d4d755f9246cc6bd48 ]
Previous commits added checks for RTL8152_INACCESSIBLE in the loops in the driver. There are still a few more that keep tripping the driver up in error cases and make things take longer than they should. Add those in.
All the loops that are part of this commit existed in some form or another since the r8152 driver was first introduced, though RTL8152_INACCESSIBLE was known as RTL8152_UNPLUG before commit 715f67f33af4 ("r8152: Rename RTL8152_UNPLUG to RTL8152_INACCESSIBLE")
--- drivers/net/usb/r8152.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/net/usb/r8152.c +8 -0
@@ -2857,6 +2857,8 @@ static void rtl8152_nic_reset(struct r8152 *tp)ocp_write_byte (tp,MCU_TYPE_PLA ,PLA_CR ,CR_RST );for (i =0 ; i <1000 ; i++) { +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags)) +break ;if (!(ocp_read_byte (tp,MCU_TYPE_PLA ,PLA_CR ) &CR_RST ))break ;usleep_range (100 ,400 );
@@ -3186,6 +3188,8 @@ static void rtl_disable(struct r8152 *tp)rxdy_gated_en (tp, true);for (i =0 ; i <1000 ; i++) { +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags)) +break ; ocp_data =ocp_read_byte (tp,MCU_TYPE_PLA ,PLA_OOB_CTRL );if ((ocp_data &FIFO_EMPTY ) ==FIFO_EMPTY )break ;
@@ -3193,6 +3197,8 @@ static void rtl_disable(struct r8152 *tp) }for (i =0 ; i <1000 ; i++) { +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags)) +break ;if (ocp_read_word (tp,MCU_TYPE_PLA ,PLA_TCR0 ) &TCR0_TX_EMPTY )break ;usleep_range (1000 ,2000 );
@@ -5381,6 +5387,8 @@ static void wait_oob_link_list_ready(struct r8152 *tp)int i;for (i =0 ; i <1000 ; i++) { +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags)) +break ; ocp_data =ocp_read_byte (tp,MCU_TYPE_PLA ,PLA_OOB_CTRL );if (ocp_data &LINK_LIST_READY )break ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 26/194 r8152: Add RTL8152_INACCESSIBLE to r8156b_wait_loading_flash()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Anderson <[email protected]>
[ Upstream commit 8a67b47fced9f6a84101eb9ec5ce4c7d64204bc7 ]
Delay loops in r8152 should break out if RTL8152_INACCESSIBLE is set so that they don't delay too long if the device becomes inaccessible. Add the break to the loop in r8156b_wait_loading_flash().
--- drivers/net/usb/r8152.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/usb/r8152.c +2 -0
@@ -5403,6 +5403,8 @@ static void r8156b_wait_loading_flash(struct r8152 *tp)int i;for (i =0 ; i <100 ; i++) { +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags)) +break ;if (ocp_read_word (tp,MCU_TYPE_USB ,USB_GPHY_CTRL ) &GPHY_PATCH_DONE )break ;usleep_range (1000 ,2000 );
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 27/194 r8152: Add RTL8152_INACCESSIBLE to r8153_pre_firmware_1()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Anderson <[email protected]>
[ Upstream commit 8c53a7bd706535a9cf4e2ec3a4e8d61d46353ca0 ]
Delay loops in r8152 should break out if RTL8152_INACCESSIBLE is set so that they don't delay too long if the device becomes inaccessible. Add the break to the loop in r8153_pre_firmware_1().
--- drivers/net/usb/r8152.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/usb/r8152.c +2 -0
@@ -5527,6 +5527,8 @@ static int r8153_pre_firmware_1(struct r8152 *tp)for (i =0 ; i <104 ; i++) {u32 ocp_data =ocp_read_byte (tp,MCU_TYPE_USB ,USB_WDT1_CTRL ); +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags)) +return -ENODEV ;if (!(ocp_data &WTD1_EN ))break ;usleep_range (1000 ,2000 );
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 28/194 r8152: Add RTL8152_INACCESSIBLE to r8153_aldps_en()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Anderson <[email protected]>
[ Upstream commit 79321a793945fdbff2f405f84712d0ab81bed287 ]
Delay loops in r8152 should break out if RTL8152_INACCESSIBLE is set so that they don't delay too long if the device becomes inaccessible. Add the break to the loop in r8153_aldps_en().
--- drivers/net/usb/r8152.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/usb/r8152.c +2 -0
@@ -5685,6 +5685,8 @@ static void r8153_aldps_en(struct r8152 *tp, bool enable) data &= ~EN_ALDPS ;ocp_reg_write (tp,OCP_POWER_CFG , data);for (i =0 ; i <20 ; i++) { +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags)) +return ;usleep_range (1000 ,2000 );if (ocp_read_word (tp,MCU_TYPE_PLA ,0xe000 ) &0x0100 )break ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 29/194 mlxbf-bootctl: correctly identify secure boot with development keys
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Thompson <[email protected]>
[ Upstream commit d4eef75279f5e9d594f5785502038c763ce42268 ]
The secure boot state of the BlueField SoC is represented by two bits:
0 = production state
1 = secure boot enabled
2 = non-secure (secure boot disabled)
3 = RMA state
There is also a single bit to indicate whether production keys or development keys are being used when secure boot is enabled. This single bit (specified by MLXBF_BOOTCTL_SB_DEV_MASK) only has meaning if secure boot state equals 1 (secure boot enabled).
The secure boot states are as follows:
- “GA secured” is when secure boot is enabled with official production keys.
- “Secured (development)” is when secure boot is enabled with development keys.
Without this fix “GA Secured” is displayed on development cards which is misleading. This patch updates the logic in "lifecycle_state_show()" to handle the case where the SoC is configured for secure boot and is using development keys.
--- drivers/platform/mellanox/mlxbf-bootctl.c | 39 +++++++++++++++-------- 1 file changed, 26 insertions(+), 13 deletions(-)
drivers/platform/mellanox/mlxbf-bootctl.c +26 -13
@@ -17,6 +17,7 @@#define MLXBF_BOOTCTL_SB_SECURE_MASK 0x03#define MLXBF_BOOTCTL_SB_TEST_MASK 0x0c +#define MLXBF_BOOTCTL_SB_DEV_MASK BIT(4)#define MLXBF_SB_KEY_NUM 4
@@ -37,11 +38,18 @@ static struct mlxbf_bootctl_name boot_names[] = { { MLXBF_BOOTCTL_NONE, "none" }, }; +enum { +MLXBF_BOOTCTL_SB_LIFECYCLE_PRODUCTION =0 , +MLXBF_BOOTCTL_SB_LIFECYCLE_GA_SECURE =1 , +MLXBF_BOOTCTL_SB_LIFECYCLE_GA_NON_SECURE =2 , +MLXBF_BOOTCTL_SB_LIFECYCLE_RMA =3 +}; +static const char *const mlxbf_bootctl_lifecycle_states[] = { - [0 ] ="Production" , - [1 ] ="GA Secured" , - [2 ] ="GA Non-Secured" , - [3 ] ="RMA" , + [MLXBF_BOOTCTL_SB_LIFECYCLE_PRODUCTION ] ="Production" , + [MLXBF_BOOTCTL_SB_LIFECYCLE_GA_SECURE ] ="GA Secured" , + [MLXBF_BOOTCTL_SB_LIFECYCLE_GA_NON_SECURE ] ="GA Non-Secured" , + [MLXBF_BOOTCTL_SB_LIFECYCLE_RMA ] ="RMA" , };/* ARM SMC call which is atomic and no need for lock. */
@@ -165,25 +173,30 @@ static ssize_t second_reset_action_store(struct device *dev,static ssize_t lifecycle_state_show (struct device *dev,struct device_attribute *attr,char *buf) { +int status_bits; +int use_dev_key; +int test_state;int lc_state; - lc_state =mlxbf_bootctl_smc (MLXBF_BOOTCTL_GET_TBB_FUSE_STATUS , -MLXBF_BOOTCTL_FUSE_STATUS_LIFECYCLE ); -if (lc_state <0 ) -return lc_state; + status_bits =mlxbf_bootctl_smc (MLXBF_BOOTCTL_GET_TBB_FUSE_STATUS , +MLXBF_BOOTCTL_FUSE_STATUS_LIFECYCLE ); +if (status_bits <0 ) +return status_bits; - lc_state &= -MLXBF_BOOTCTL_SB_TEST_MASK |MLXBF_BOOTCTL_SB_SECURE_MASK ; + use_dev_key = status_bits &MLXBF_BOOTCTL_SB_DEV_MASK ; + test_state = status_bits &MLXBF_BOOTCTL_SB_TEST_MASK ; + lc_state = status_bits &MLXBF_BOOTCTL_SB_SECURE_MASK ;/* * If the test bits are set, we specify that the current state may be * due to using the test bits. */ -if (lc_state &MLXBF_BOOTCTL_SB_TEST_MASK ) { - lc_state &=MLXBF_BOOTCTL_SB_SECURE_MASK ; - +if (test_state) {return sprintf (buf,"%s(test)\n" , mlxbf_bootctl_lifecycle_states[lc_state]); + }else if (use_dev_key && + (lc_state ==MLXBF_BOOTCTL_SB_LIFECYCLE_GA_SECURE )) { +return sprintf (buf,"Secured (development)\n" ); }return sprintf (buf,"%s\n" , mlxbf_bootctl_lifecycle_states[lc_state]);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 30/194 platform/mellanox: Add null pointer checks for devm_kasprintf()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kunwu Chan <[email protected]>
[ Upstream commit 2c7c857f5fed997be93047d2de853d7f10c8defe ]
devm_kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure.
Compile-tested only.
--- drivers/platform/mellanox/mlxbf-pmc.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/platform/mellanox/mlxbf-pmc.c +12 -0
@@ -1202,6 +1202,8 @@ static int mlxbf_pmc_init_perftype_counter(struct device *dev, int blk_num) attr->dev_attr.show = mlxbf_pmc_event_list_show; attr->nr = blk_num; attr->dev_attr.attr.name =devm_kasprintf (dev,GFP_KERNEL ,"event_list" ); +if (!attr->dev_attr.attr.name) +return -ENOMEM ; pmc->block[blk_num].block_attr[i] = &attr->dev_attr.attr; attr =NULL ;
@@ -1214,6 +1216,8 @@ static int mlxbf_pmc_init_perftype_counter(struct device *dev, int blk_num) attr->nr = blk_num; attr->dev_attr.attr.name =devm_kasprintf (dev,GFP_KERNEL ,"enable" ); +if (!attr->dev_attr.attr.name) +return -ENOMEM ; pmc->block[blk_num].block_attr[++i] = &attr->dev_attr.attr; attr =NULL ; }
@@ -1240,6 +1244,8 @@ static int mlxbf_pmc_init_perftype_counter(struct device *dev, int blk_num) attr->nr = blk_num; attr->dev_attr.attr.name =devm_kasprintf (dev,GFP_KERNEL ,"counter%d" , j); +if (!attr->dev_attr.attr.name) +return -ENOMEM ; pmc->block[blk_num].block_attr[++i] = &attr->dev_attr.attr; attr =NULL ;
@@ -1251,6 +1257,8 @@ static int mlxbf_pmc_init_perftype_counter(struct device *dev, int blk_num) attr->nr = blk_num; attr->dev_attr.attr.name =devm_kasprintf (dev,GFP_KERNEL ,"event%d" , j); +if (!attr->dev_attr.attr.name) +return -ENOMEM ; pmc->block[blk_num].block_attr[++i] = &attr->dev_attr.attr; attr =NULL ; }
@@ -1283,6 +1291,8 @@ static int mlxbf_pmc_init_perftype_reg(struct device *dev, int blk_num) attr->nr = blk_num; attr->dev_attr.attr.name =devm_kasprintf (dev,GFP_KERNEL , events[j].evt_name); +if (!attr->dev_attr.attr.name) +return -ENOMEM ; pmc->block[blk_num].block_attr[i] = &attr->dev_attr.attr; attr =NULL ; i++;
@@ -1311,6 +1321,8 @@ static int mlxbf_pmc_create_groups(struct device *dev, int blk_num) pmc->block[blk_num].block_attr_grp.attrs = pmc->block[blk_num].block_attr; pmc->block[blk_num].block_attr_grp.name =devm_kasprintf ( dev,GFP_KERNEL , pmc->block_name[blk_num]); +if (!pmc->block[blk_num].block_attr_grp.name) +return -ENOMEM ; pmc->groups[blk_num] = &pmc->block[blk_num].block_attr_grp;return 0 ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 31/194 platform/mellanox: Check devm_hwmon_device_register_with_groups() return value
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kunwu Chan <[email protected]>
[ Upstream commit 3494a594315b56516988afb6854d75dee5b501db ]
devm_hwmon_device_register_with_groups() returns an error pointer upon failure. Check its return value for errors.
Compile-tested only.
--- drivers/platform/mellanox/mlxbf-pmc.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/platform/mellanox/mlxbf-pmc.c +2 -0
@@ -1454,6 +1454,8 @@ static int mlxbf_pmc_probe(struct platform_device *pdev) pmc->hwmon_dev =devm_hwmon_device_register_with_groups ( dev,"bfperf" , pmc, pmc->groups); +if (IS_ERR (pmc->hwmon_dev)) +return PTR_ERR (pmc->hwmon_dev);platform_set_drvdata (pdev, pmc);return 0 ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 32/194 arcnet: restoring support for multiple Sohard Arcnet cards
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Reichinger <[email protected]>
[ Upstream commit 6b17a597fc2f13aaaa0a2780eb7edb9ae7ac9aea ]
Probe of Sohard Arcnet cards fails,
if 2 or more cards are installed in a system.
See kernel log:
[ 2.759203] arcnet: arcnet loaded [ 2.763648] arcnet:com20020: COM20020 chipset support (by David Woodhouse et al.) [ 2.770585] arcnet:com20020_pci: COM20020 PCI support [ 2.772295] com20020 0000:02:00.0: enabling device (0000 -> 0003) [ 2.772354] (unnamed net_device) (uninitialized): PLX-PCI Controls ... [ 3.071301] com20020 0000:02:00.0 arc0-0 (uninitialized): PCI COM20020: station FFh found at F080h, IRQ 101. [ 3.071305] com20020 0000:02:00.0 arc0-0 (uninitialized): Using CKP 64 - data rate 2.5 Mb/s [ 3.071534] com20020 0000:07:00.0: enabling device (0000 -> 0003) [ 3.071581] (unnamed net_device) (uninitialized): PLX-PCI Controls ... [ 3.369501] com20020 0000:07:00.0: Led pci:green:tx:0-0 renamed to pci:green:tx:0-0_1 due to name collision [ 3.369535] com20020 0000:07:00.0: Led pci:red:recon:0-0 renamed to pci:red:recon:0-0_1 due to name collision [ 3.370586] com20020 0000:07:00.0 arc0-0 (uninitialized): PCI COM20020: station E1h found at C000h, IRQ 35. [ 3.370589] com20020 0000:07:00.0 arc0-0 (uninitialized): Using CKP 64 - data rate 2.5 Mb/s [ 3.370608] com20020: probe of 0000:07:00.0 failed with error -5
commit 5ef216c1f848 ("arcnet: com20020-pci: add rotary index support") changes the device name of all COM20020 based PCI cards, even if only some cards support this:
snprintf(dev->name, sizeof(dev->name), "arc%d-%d", dev->dev_id, i);
The error happens because all Sohard Arcnet cards would be called arc0-0, since the Sohard Arcnet cards don't have a PLX rotary coder. I.e. EAE Arcnet cards have a PLX rotary coder,
which sets the first decimal, ensuring unique devices names.
This patch adds two new card feature flags to indicate which cards support LEDs and the PLX rotary coder.
For EAE based cards the names still depend on the PLX rotary coder (untested, since missing EAE hardware).
For Sohard based cards, this patch will result in devices being called arc0, arc1, ... (tested).
--- drivers/net/arcnet/arcdevice.h | 2 + drivers/net/arcnet/com20020-pci.c | 89 ++++++++++++++++--------------- 2 files changed, 48 insertions(+), 43 deletions(-)
drivers/net/arcnet/arcdevice.h +2 -0
@@ -186,6 +186,8 @@ do { \#define ARC_IS_5MBIT 1/* card default speed is 5MBit */ #define ARC_CAN_10MBIT 2/* card uses COM20022, supporting 10MBit, but default is 2.5MBit. */ +#define ARC_HAS_LED 4/* card has software controlled LEDs */ +#define ARC_HAS_ROTARY 8/* card has rotary encoder */ /* information needed to define an encapsulation driver */ struct ArcProto {
drivers/net/arcnet/com20020-pci.c +46 -43
133 lines not on this page · raw message
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 33/194 octeontx2-pf: consider both Rx and Tx packet stats for adaptive interrupt coalescing
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naveen Mamindlapalli <[email protected]>
[ Upstream commit adbf100fc47001c93d7e513ecac6fd6e04d5b4a1 ]
The current adaptive interrupt coalescing code updates only rx packet stats for dim algorithm. This patch also updates tx packet stats which will be useful when there is only tx traffic. Also moved configuring hardware adaptive interrupt setting to driver dim callback.
--- .../ethernet/marvell/octeontx2/nic/otx2_pf.c | 9 +++++++++ .../marvell/octeontx2/nic/otx2_txrx.c | 20 +++++++++---------- 2 files changed, 19 insertions(+), 10 deletions(-)
drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +9 -0
@@ -1676,6 +1676,14 @@ static void otx2_do_set_rx_mode(struct otx2_nic *pf)mutex_unlock (&pf->mbox.lock); } +static void otx2_set_irq_coalesce (struct otx2_nic *pfvf) +{ +int cint; + +for (cint =0 ; cint < pfvf->hw.cint_cnt; cint++) +otx2_config_irq_coalescing (pfvf, cint); +} +static void otx2_dim_work (struct work_struct *w) {struct dim_cq_moder cur_moder;
@@ -1691,6 +1699,7 @@ static void otx2_dim_work(struct work_struct *w) CQ_TIMER_THRESH_MAX : cur_moder.usec; pfvf->hw.cq_ecount_wait = (cur_moder.pkts >NAPI_POLL_WEIGHT ) ?NAPI_POLL_WEIGHT : cur_moder.pkts; +otx2_set_irq_coalesce (pfvf); dim->state =DIM_START_MEASURE ; }
drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c +10 -10
@@ -510,11 +510,18 @@ static void otx2_adjust_adaptive_coalese(struct otx2_nic *pfvf, struct otx2_cq_p {struct dim_sample dim_sample;u64 rx_frames, rx_bytes; +u64 tx_frames, tx_bytes; rx_frames =OTX2_GET_RX_STATS (RX_BCAST ) +OTX2_GET_RX_STATS (RX_MCAST ) +OTX2_GET_RX_STATS (RX_UCAST ); rx_bytes =OTX2_GET_RX_STATS (RX_OCTS ); -dim_update_sample (pfvf->napi_events, rx_frames, rx_bytes, &dim_sample); + tx_bytes =OTX2_GET_TX_STATS (TX_OCTS ); + tx_frames =OTX2_GET_TX_STATS (TX_UCAST ); + +dim_update_sample (pfvf->napi_events, + rx_frames + tx_frames, + rx_bytes + tx_bytes, + &dim_sample);net_dim (&cq_poll->dim, dim_sample); }
@@ -555,16 +562,9 @@ int otx2_napi_handler(struct napi_struct *napi, int budget)if (pfvf->flags &OTX2_FLAG_INTF_DOWN )return workdone; -/* Check for adaptive interrupt coalesce */ -if (workdone !=0 && - ((pfvf->flags &OTX2_FLAG_ADPTV_INT_COAL_ENABLED ) == -OTX2_FLAG_ADPTV_INT_COAL_ENABLED )) { -/* Adjust irq coalese using net_dim */ +/* Adjust irq coalese using net_dim */ +if (pfvf->flags &OTX2_FLAG_ADPTV_INT_COAL_ENABLED )otx2_adjust_adaptive_coalese (pfvf, cq_poll); -/* Update irq coalescing */ -for (i =0 ; i < pfvf->hw.cint_cnt; i++) -otx2_config_irq_coalescing (pfvf, i); - }/* Re-enable interrupts */ otx2_write64(pfvf, NIX_LF_CINTX_ENA_W1S(cq_poll->cint_idx),
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 34/194 net: stmmac: fix FPE events losing
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianheng Zhang <[email protected]>
[ Upstream commit 37e4b8df27bc68340f3fc80dbb27e3549c7f881c ]
The status bits of register MAC_FPE_CTRL_STS are clear on read. Using 32-bit read for MAC_FPE_CTRL_STS in dwmac5_fpe_configure() and dwmac5_fpe_send_mpacket() clear the status bits. Then the stmmac interrupt handler missing FPE event status and leads to FPE handshaking failure and retries.
To avoid clear status bits of MAC_FPE_CTRL_STS in dwmac5_fpe_configure() and dwmac5_fpe_send_mpacket(), add fpe_csr to stmmac_fpe_cfg structure to cache the control bits of MAC_FPE_CTRL_STS and to avoid reading MAC_FPE_CTRL_STS in those methods.
--- drivers/net/ethernet/stmicro/stmmac/dwmac5.c | 45 ++++++++----------- drivers/net/ethernet/stmicro/stmmac/dwmac5.h | 4 +- .../ethernet/stmicro/stmmac/dwxgmac2_core.c | 3 +- drivers/net/ethernet/stmicro/stmmac/hwif.h | 4 +- .../net/ethernet/stmicro/stmmac/stmmac_main.c | 8 +++- .../net/ethernet/stmicro/stmmac/stmmac_tc.c | 1 + include/linux/stmmac.h | 1 + 7 files changed, 36 insertions(+), 30 deletions(-)
drivers/net/ethernet/stmicro/stmmac/dwmac5.c +19 -26
@@ -710,28 +710,22 @@ void dwmac5_est_irq_status(void __iomem *ioaddr, struct net_device *dev, } } -void dwmac5_fpe_configure (void __iomem *ioaddr,u32 num_txq,u32 num_rxq, +void dwmac5_fpe_configure (void __iomem *ioaddr,struct stmmac_fpe_cfg *cfg, +u32 num_txq,u32 num_rxq,bool enable) {u32 value; -if (!enable) { - value =readl (ioaddr +MAC_FPE_CTRL_STS ); - - value &= ~EFPE ; - -writel (value, ioaddr +MAC_FPE_CTRL_STS ); -return ; +if (enable) { + cfg->fpe_csr =EFPE ; + value =readl (ioaddr +GMAC_RXQ_CTRL1 ); + value &= ~GMAC_RXQCTRL_FPRQ ; + value |= (num_rxq -1 ) <<GMAC_RXQCTRL_FPRQ_SHIFT ; +writel (value, ioaddr +GMAC_RXQ_CTRL1 ); + }else { + cfg->fpe_csr =0 ; } - - value =readl (ioaddr +GMAC_RXQ_CTRL1 ); - value &= ~GMAC_RXQCTRL_FPRQ ; - value |= (num_rxq -1 ) <<GMAC_RXQCTRL_FPRQ_SHIFT ; -writel (value, ioaddr +GMAC_RXQ_CTRL1 ); - - value =readl (ioaddr +MAC_FPE_CTRL_STS ); - value |=EFPE ; -writel (value, ioaddr +MAC_FPE_CTRL_STS ); +writel (cfg->fpe_csr, ioaddr +MAC_FPE_CTRL_STS ); }int dwmac5_fpe_irq_status (void __iomem *ioaddr,struct net_device *dev)
@@ -741,6 +735,9 @@ int dwmac5_fpe_irq_status(void __iomem *ioaddr, struct net_device *dev) status =FPE_EVENT_UNKNOWN ; +/* Reads from the MAC_FPE_CTRL_STS register should only be performed +* here, since the status flags of MAC_FPE_CTRL_STS are "clear on read" +*/ value =readl (ioaddr +MAC_FPE_CTRL_STS );if (value &TRSP ) {
@@ -766,19 +763,15 @@ int dwmac5_fpe_irq_status(void __iomem *ioaddr, struct net_device *dev)return status; } -void dwmac5_fpe_send_mpacket (void __iomem *ioaddr,enum stmmac_mpacket_type type) +void dwmac5_fpe_send_mpacket (void __iomem *ioaddr,struct stmmac_fpe_cfg *cfg, +enum stmmac_mpacket_type type) { -u32 value; +u32 value = cfg->fpe_csr; - value =readl (ioaddr +MAC_FPE_CTRL_STS ); - -if (type ==MPACKET_VERIFY ) { - value &= ~SRSP ; +if (type ==MPACKET_VERIFY ) value |=SVER ; - }else { - value &= ~SVER ; +else if (type ==MPACKET_RESPONSE ) value |=SRSP ; - }writel (value, ioaddr +MAC_FPE_CTRL_STS ); }
drivers/net/ethernet/stmicro/stmmac/dwmac5.h +3 -1
@@ -153,9 +153,11 @@ int dwmac5_est_configure(void __iomem *ioaddr, struct stmmac_est *cfg, unsigned int ptp_rate);void dwmac5_est_irq_status (void __iomem *ioaddr,struct net_device *dev,struct stmmac_extra_stats *x,u32 txqcnt); -void dwmac5_fpe_configure (void __iomem *ioaddr,u32 num_txq,u32 num_rxq, +void dwmac5_fpe_configure (void __iomem *ioaddr,struct stmmac_fpe_cfg *cfg, +u32 num_txq,u32 num_rxq,bool enable);void dwmac5_fpe_send_mpacket (void __iomem *ioaddr, +struct stmmac_fpe_cfg *cfg,enum stmmac_mpacket_type type);int dwmac5_fpe_irq_status (void __iomem *ioaddr,struct net_device *dev);
drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c +2 -1
@@ -1441,7 +1441,8 @@ static int dwxgmac3_est_configure(void __iomem *ioaddr, struct stmmac_est *cfg,return 0 ; } -static void dwxgmac3_fpe_configure (void __iomem *ioaddr,u32 num_txq, +static void dwxgmac3_fpe_configure (void __iomem *ioaddr,struct stmmac_fpe_cfg *cfg, +u32 num_txq,u32 num_rxq,bool enable) {u32 value;
drivers/net/ethernet/stmicro/stmmac/hwif.h +3 -1
@@ -392,9 +392,11 @@ struct stmmac_ops { unsigned int ptp_rate);void (*est_irq_status)(void __iomem *ioaddr,struct net_device *dev,struct stmmac_extra_stats *x,u32 txqcnt); -void (*fpe_configure)(void __iomem *ioaddr,u32 num_txq,u32 num_rxq, +void (*fpe_configure)(void __iomem *ioaddr,struct stmmac_fpe_cfg *cfg, +u32 num_txq,u32 num_rxq,bool enable);void (*fpe_send_mpacket)(void __iomem *ioaddr, +struct stmmac_fpe_cfg *cfg,enum stmmac_mpacket_type type);int (*fpe_irq_status)(void __iomem *ioaddr,struct net_device *dev); };
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +7 -1
@@ -957,7 +957,8 @@ static void stmmac_fpe_link_state_handle(struct stmmac_priv *priv, bool is_up)bool *hs_enable = &fpe_cfg->hs_enable;if (is_up && *hs_enable) { -stmmac_fpe_send_mpacket (priv, priv->ioaddr,MPACKET_VERIFY ); +stmmac_fpe_send_mpacket (priv, priv->ioaddr, fpe_cfg, +MPACKET_VERIFY ); }else { *lo_state =FPE_STATE_OFF ; *lp_state =FPE_STATE_OFF ;
@@ -5704,6 +5705,7 @@ static void stmmac_fpe_event_status(struct stmmac_priv *priv, int status)/* If user has requested FPE enable, quickly response */ if (*hs_enable)stmmac_fpe_send_mpacket (priv, priv->ioaddr, + fpe_cfg,MPACKET_RESPONSE ); }
@@ -7028,6 +7030,7 @@ static void stmmac_fpe_lp_task(struct work_struct *work)if (*lo_state ==FPE_STATE_ENTERING_ON && *lp_state ==FPE_STATE_ENTERING_ON ) {stmmac_fpe_configure (priv, priv->ioaddr, + fpe_cfg, priv->plat->tx_queues_to_use, priv->plat->rx_queues_to_use, *enable);
@@ -7046,6 +7049,7 @@ static void stmmac_fpe_lp_task(struct work_struct *work)netdev_info (priv->dev,SEND_VERIFY_MPAKCET_FMT , *lo_state, *lp_state);stmmac_fpe_send_mpacket (priv, priv->ioaddr, + fpe_cfg,MPACKET_VERIFY ); }/* Sleep then retry */
@@ -7060,6 +7064,7 @@ void stmmac_fpe_handshake(struct stmmac_priv *priv, bool enable)if (priv->plat->fpe_cfg->hs_enable != enable) {if (enable) {stmmac_fpe_send_mpacket (priv, priv->ioaddr, + priv->plat->fpe_cfg,MPACKET_VERIFY ); }else { priv->plat->fpe_cfg->lo_fpe_state =FPE_STATE_OFF ;
@@ -7472,6 +7477,7 @@ int stmmac_suspend(struct device *dev)if (priv->dma_cap.fpesel) {/* Disable FPE */ stmmac_fpe_configure (priv, priv->ioaddr, + priv->plat->fpe_cfg, priv->plat->tx_queues_to_use, priv->plat->rx_queues_to_use, false);
drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c +1 -0
@@ -1073,6 +1073,7 @@ static int tc_setup_taprio(struct stmmac_priv *priv, priv->plat->fpe_cfg->enable = false;stmmac_fpe_configure (priv, priv->ioaddr, + priv->plat->fpe_cfg, priv->plat->tx_queues_to_use, priv->plat->rx_queues_to_use, false);
include/linux/stmmac.h +1 -0
@@ -172,6 +172,7 @@ struct stmmac_fpe_cfg {bool hs_enable;/* FPE handshake enable */ enum stmmac_fpe_state lp_fpe_state;/* Link Partner FPE state */ enum stmmac_fpe_state lo_fpe_state;/* Local station FPE state */ +u32 fpe_csr;/* MAC_FPE_CTRL_STS reg cache */ };struct stmmac_safety_feature_cfg {
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 35/194 xsk: Skip polling event check for unbound socket
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yewon Choi <[email protected]>
[ Upstream commit e4d008d49a7135214e0ee70537405b6a069e3a3f ]
In xsk_poll(), checking available events and setting mask bits should be executed only when a socket has been bound. Setting mask bits for unbound socket is meaningless.
Currently, it checks events even when xsk_check_common() failed. To prevent this, we move goto location (skip_tx) after that checking.
--- net/xdp/xsk.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
net/xdp/xsk.c +2 -3
@@ -722,7 +722,7 @@ static __poll_t xsk_poll(struct file *file, struct socket *sock,rcu_read_lock ();if (xsk_check_common (xs)) - goto skip_tx; + goto out; pool = xs->pool;
@@ -734,12 +734,11 @@ static __poll_t xsk_poll(struct file *file, struct socket *sock,xsk_generic_xmit (sk); } -skip_tx:if (xs->rx && !xskq_prod_is_empty (xs->rx)) mask |=EPOLLIN |EPOLLRDNORM ;if (xs->tx &&xsk_tx_writeable (xs)) mask |=EPOLLOUT |EPOLLWRNORM ; - +out:rcu_read_unlock ();return mask; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 36/194 octeontx2-af: fix a use-after-free in rvu_npa_register_reporters
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhipeng Lu <[email protected]>
[ Upstream commit 3c91c909f13f0c32b0d54d75c3f798479b1a84f5 ]
The rvu_dl will be freed in rvu_npa_health_reporters_destroy(rvu_dl) after the create_workqueue fails, and after that free, the rvu_dl will be translate back through rvu_npa_health_reporters_create, rvu_health_reporters_create, and rvu_register_dl. Finally it goes to the err_dl_health label, being freed again in rvu_health_reporters_destroy(rvu) by rvu_npa_health_reporters_destroy. In the second calls of rvu_npa_health_reporters_destroy, however, it uses rvu_dl->rvu_npa_health_reporter, which is already freed at the end of rvu_npa_health_reporters_destroy in the first call.
So this patch prevents the first destroy by instantly returning -ENONMEN when create_workqueue fails. In addition, since the failure of create_workqueue is the only entrence of label err, it has been integrated into the error-handling path of create_workqueue.
--- drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c +1 -4
@@ -1285,7 +1285,7 @@ static int rvu_npa_register_reporters(struct rvu_devlink *rvu_dl) rvu_dl->devlink_wq =create_workqueue ("rvu_devlink_wq" );if (!rvu_dl->devlink_wq) - goto err; +return -ENOMEM ;INIT_WORK (&rvu_reporters->intr_work, rvu_npa_intr_work);INIT_WORK (&rvu_reporters->err_work, rvu_npa_err_work);
@@ -1293,9 +1293,6 @@ static int rvu_npa_register_reporters(struct rvu_devlink *rvu_dl)INIT_WORK (&rvu_reporters->ras_work, rvu_npa_ras_work);return 0 ; -err: -rvu_npa_health_reporters_destroy (rvu_dl); -return -ENOMEM ; }static int rvu_npa_health_reporters_create (struct rvu_devlink *rvu_dl)
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 37/194 i40e: Fix unexpected MFS warning message
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Vecera <[email protected]>
[ Upstream commit 7d9f22b3d3ef379ed05bd3f3e2de83dfa8da8258 ]
Commit 3a2c6ced90e1 ("i40e: Add a check to see if MFS is set") added a warning message that reports unexpected size of port's MFS (max frame size) value. This message use for the port number local variable 'i' that is wrong.
In i40e_probe() this 'i' variable is used only to iterate VSIs to find FDIR VSI:
<code>
...
/* if FDIR VSI was set up, start it now */
for (i = 0; i < pf->num_alloc_vsi; i++) {
if (pf->vsi[i] && pf->vsi[i]->type == I40E_VSI_FDIR) {
i40e_vsi_open(pf->vsi[i]);
break;
}
}...
</code>
So the warning message use for the port number index of FDIR VSI if this exists or pf->num_alloc_vsi if not.
Fix the message by using 'pf->hw.port' for the port number.
--- drivers/net/ethernet/intel/i40e/i40e_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/intel/i40e/i40e_main.c +1 -1
@@ -16158,7 +16158,7 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent) I40E_PRTGL_SAH_MFS_MASK) >> I40E_PRTGL_SAH_MFS_SHIFT;if (val <MAX_FRAME_SIZE_DEFAULT )dev_warn (&pdev->dev,"MFS for port %x has been set below the default: %x\n" , - i, val); + pf->hw.port, val);/* Add a filter to drop all Flow control frames from any VSI from being * transmitted. By doing so we stop a malicious VF from sending out
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 38/194 iavf: validate tx_coalesce_usecs even if rx_coalesce_usecs is zero
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Keller <[email protected]>
[ Upstream commit a206d9959f5ccd0fb2d54a997c993947ae0e881c ]
In __iavf_set_coalesce, the driver checks both ec->rx_coalesce_usecs and ec->tx_coalesce_usecs for validity. It does this via a chain if if/else-if blocks. If every single branch of the series of if statements exited, this would be fine. However, the rx_coalesce_usecs is checked against zero to print an informative message if use_adaptive_rx_coalesce is enabled. If this check is true, it short circuits the entire chain of statements, preventing validation of the tx_coalesce_usecs field.
Indeed, since commit e792779e6b63 ("iavf: Prevent changing static ITR values if adaptive moderation is on") the iavf driver actually rejects any change to the tx_coalesce_usecs or rx_coalesce_usecs when use_adaptive_tx_coalesce or use_adaptive_rx_coalesce is enabled, making this checking a bit redundant.
Fix this error by removing the unnecessary and redundant checks for use_adaptive_rx_coalesce and use_adaptive_tx_coalesce. Since zero is a valid value, and since the tx_coalesce_usecs and rx_coalesce_usecs fields are already unsigned, remove the minimum value check. This allows assigning an ITR value ranging from 0-8160 as described by the printed message.
--- drivers/net/ethernet/intel/iavf/iavf_ethtool.c | 12 ++---------- drivers/net/ethernet/intel/iavf/iavf_txrx.h | 1 - 2 files changed, 2 insertions(+), 11 deletions(-)
drivers/net/ethernet/intel/iavf/iavf_ethtool.c +2 -10
@@ -829,18 +829,10 @@ static int __iavf_set_coalesce(struct net_device *netdev,struct iavf_adapter *adapter =netdev_priv (netdev);int i; -if (ec->rx_coalesce_usecs ==0 ) { -if (ec->use_adaptive_rx_coalesce) -netif_info (adapter, drv, netdev,"rx-usecs=0, need to disable adaptive-rx for a complete disable\n" ); - }else if ((ec->rx_coalesce_usecs <IAVF_MIN_ITR ) || - (ec->rx_coalesce_usecs >IAVF_MAX_ITR )) { +if (ec->rx_coalesce_usecs >IAVF_MAX_ITR ) {netif_info (adapter, drv, netdev,"Invalid value, rx-usecs range is 0-8160\n" );return -EINVAL ; - }else if (ec->tx_coalesce_usecs ==0 ) { -if (ec->use_adaptive_tx_coalesce) -netif_info (adapter, drv, netdev,"tx-usecs=0, need to disable adaptive-tx for a complete disable\n" ); - }else if ((ec->tx_coalesce_usecs <IAVF_MIN_ITR ) || - (ec->tx_coalesce_usecs >IAVF_MAX_ITR )) { + }else if (ec->tx_coalesce_usecs >IAVF_MAX_ITR ) {netif_info (adapter, drv, netdev,"Invalid value, tx-usecs range is 0-8160\n" );return -EINVAL ; }
drivers/net/ethernet/intel/iavf/iavf_txrx.h +0 -1
@@ -15,7 +15,6 @@*/ #define IAVF_ITR_DYNAMIC 0x8000/* use top bit as a flag */ #define IAVF_ITR_MASK 0x1FFE/* mask for ITR register value */ -#define IAVF_MIN_ITR 2/* reg uses 2 usec resolution */ #define IAVF_ITR_100K 10/* all values below must be even */ #define IAVF_ITR_50K 20#define IAVF_ITR_20K 50
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 39/194 net: bnxt: fix a potential use-after-free in bnxt_init_tc
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dinghao Liu <[email protected]>
[ Upstream commit d007caaaf052f82ca2340d4c7b32d04a3f5dbf3f ]
When flow_indr_dev_register() fails, bnxt_init_tc will free bp->tc_info through kfree(). However, the caller function bnxt_init_one() will ignore this failure and call bnxt_shutdown_tc() on failure of bnxt_dl_register(), where a use-after-free happens. Fix this issue by setting bp->tc_info to NULL after kfree().
--- drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c +1 -0
@@ -2075,6 +2075,7 @@ int bnxt_init_tc(struct bnxt *bp)rhashtable_destroy (&tc_info->flow_table); free_tc_info:kfree (tc_info); + bp->tc_info =NULL ;return rc; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 40/194 tcp: fix mid stream window clamp.
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
[ Upstream commit 58d3aade20cdddbac6c9707ac0f3f5f8c1278b74 ]
After the blamed commit below, if the user-space application performs window clamping when tp->rcv_wnd is 0, the TCP socket will never be able to announce a non 0 receive window, even after completely emptying the receive buffer and re-setting the window clamp to higher values.
Refactor tcp_set_window_clamp() to address the issue: when the user decreases the current clamp value, set rcv_ssthresh according to the same logic used at buffer initialization, but ensuring reserved mem provisioning.
To avoid code duplication factor-out the relevant bits from tcp_adjust_rcv_ssthresh() in a new helper and reuse it in the above scenario.
When increasing the clamp value, give the rcv_ssthresh a chance to grow according to previously implemented heuristic.
--- include/net/tcp.h | 9 +++++++-- net/ipv4/tcp.c | 22 +++++++++++++++++++--- 2 files changed, 26 insertions(+), 5 deletions(-)
include/net/tcp.h +7 -2
@@ -1460,17 +1460,22 @@ static inline int tcp_full_space(const struct sock *sk)return tcp_win_from_space (sk,READ_ONCE (sk->sk_rcvbuf)); } -static inline void tcp_adjust_rcv_ssthresh (struct sock *sk) +static inline void __tcp_adjust_rcv_ssthresh (struct sock *sk,u32 new_ssthresh) {int unused_mem =sk_unused_reserved_mem (sk);struct tcp_sock *tp =tcp_sk (sk); - tp->rcv_ssthresh =min (tp->rcv_ssthresh,4U * tp->advmss); + tp->rcv_ssthresh =min (tp->rcv_ssthresh, new_ssthresh);if (unused_mem) tp->rcv_ssthresh =max_t (u32, tp->rcv_ssthresh,tcp_win_from_space (sk, unused_mem)); } +static inline void tcp_adjust_rcv_ssthresh (struct sock *sk) +{ +__tcp_adjust_rcv_ssthresh (sk,4U *tcp_sk (sk)->advmss); +} +void tcp_cleanup_rbuf (struct sock *sk,int copied);void __tcp_cleanup_rbuf (struct sock *sk,int copied);
net/ipv4/tcp.c +19 -3
@@ -3473,9 +3473,25 @@ int tcp_set_window_clamp(struct sock *sk, int val)return -EINVAL ; tp->window_clamp =0 ; }else { - tp->window_clamp = val <SOCK_MIN_RCVBUF /2 ? -SOCK_MIN_RCVBUF /2 : val; - tp->rcv_ssthresh =min (tp->rcv_wnd, tp->window_clamp); +u32 new_rcv_ssthresh, old_window_clamp = tp->window_clamp; +u32 new_window_clamp = val <SOCK_MIN_RCVBUF /2 ? +SOCK_MIN_RCVBUF /2 : val; + +if (new_window_clamp == old_window_clamp) +return 0 ; + + tp->window_clamp = new_window_clamp; +if (new_window_clamp < old_window_clamp) { +/* need to apply the reserved mem provisioning only +* when shrinking the window clamp +*/ +__tcp_adjust_rcv_ssthresh (sk, tp->window_clamp); + + }else { + new_rcv_ssthresh =min (tp->rcv_wnd, tp->window_clamp); + tp->rcv_ssthresh =max (new_rcv_ssthresh, + tp->rcv_ssthresh); + } }return 0 ; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 41/194 ionic: fix snprintf format length warning
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shannon Nelson <[email protected]>
[ Upstream commit 0ceb3860a67652f9d36dfdecfcd2cb3eb2f4537d ]
Our friendly kernel test robot has reminded us that with a new check we have a warning about a potential string truncation. In this case it really doesn't hurt anything, but it is worth addressing especially since there really is no reason to reserve so many bytes for our queue names. It seems that cutting the queue name buffer length in half stops the complaint.
--- drivers/net/ethernet/pensando/ionic/ionic_dev.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/pensando/ionic/ionic_dev.h +1 -1
@@ -214,7 +214,7 @@ struct ionic_desc_info {void *cb_arg; }; -#define IONIC_QUEUE_NAME_MAX_SZ 32 +#define IONIC_QUEUE_NAME_MAX_SZ 16struct ionic_queue {struct device *dev;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 42/194 ionic: Fix dim work handling in split interrupt mode
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brett Creeley <[email protected]>
[ Upstream commit 4115ba677c35f694b62298e55f0e04ce84eed469 ]
Currently ionic_dim_work() is incorrect when in split interrupt mode. This is because the interrupt rate is only being changed for the Rx side even for dim running on Tx. Fix this by using the qcq from the container_of macro. Also, introduce some local variables for a bit of cleanup.
--- drivers/net/ethernet/pensando/ionic/ionic_lif.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/net/ethernet/pensando/ionic/ionic_lif.c +8 -8
@@ -46,24 +46,24 @@ static void ionic_lif_queue_identify(struct ionic_lif *lif);static void ionic_dim_work (struct work_struct *work) { struct dim *dim = container_of(work, struct dim, work); +struct ionic_intr_info *intr;struct dim_cq_moder cur_moder;struct ionic_qcq *qcq; +struct ionic_lif *lif;u32 new_coal; cur_moder =net_dim_get_rx_moderation (dim->mode, dim->profile_ix); qcq = container_of(dim, struct ionic_qcq, dim); - new_coal =ionic_coal_usec_to_hw (qcq->q.lif->ionic, cur_moder.usec); + lif = qcq->q.lif; + new_coal =ionic_coal_usec_to_hw (lif->ionic, cur_moder.usec); new_coal = new_coal ? new_coal :1 ; -if (qcq->intr.dim_coal_hw != new_coal) { -unsigned int qi = qcq->cq.bound_q->index; -struct ionic_lif *lif = qcq->q.lif; - - qcq->intr.dim_coal_hw = new_coal; + intr = &qcq->intr; +if (intr->dim_coal_hw != new_coal) { + intr->dim_coal_hw = new_coal;ionic_intr_coal_init (lif->ionic->idev.intr_ctrl, - lif->rxqcqs[qi]->intr.index, - qcq->intr.dim_coal_hw); + intr->index, intr->dim_coal_hw); } dim->state =DIM_START_MEASURE ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 43/194 ipv4: ip_gre: Avoid skb_pull() failure in ipgre_xmit()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shigeru Yoshida <[email protected]>
[ Upstream commit 80d875cfc9d3711a029f234ef7d680db79e8fa4b ]
In ipgre_xmit(), skb_pull() may fail even if pskb_inet_may_pull() returns true. For example, applications can use PF_PACKET to create a malformed packet with no IP header. This type of packet causes a problem such as uninit-value access.
This patch ensures that skb_pull() can pull the required size by checking the skb with pskb_network_may_pull() before skb_pull().
--- net/ipv4/ip_gre.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
net/ipv4/ip_gre.c +7 -4
@@ -634,15 +634,18 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb, }if (dev->header_ops) { +int pull_len = tunnel->hlen +sizeof (struct iphdr ); +if (skb_cow_head (skb,0 )) goto free_skb; tnl_params = (const struct iphdr *)skb->data; -/* Pull skb since ip_tunnel_xmit() needs skb->data pointing -* to gre header. -*/ -skb_pull (skb, tunnel->hlen +sizeof (struct iphdr )); +if (!pskb_network_may_pull (skb, pull_len)) + goto free_skb; + +/* ip_tunnel_xmit() needs skb->data pointing to gre header. */ +skb_pull (skb, pull_len);skb_reset_mac_header (skb); if (skb->ip_summed == CHECKSUM_PARTIAL &&
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 44/194 net: atlantic: Fix NULL dereference of skb pointer in
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniil Maximov <[email protected]>
[ Upstream commit cbe860be36095e68e4e5561ab43610982fb429fd ]
If is_ptp_ring == true in the loop of __aq_ring_xdp_clean function, then a timestamp is stored from a packet in a field of skb object, which is not allocated at the moment of the call (skb == NULL).
Generalize aq_ptp_extract_ts and other affected functions so they don't work with struct sk_buff*, but with struct skb_shared_hwtstamps*.
Found by Linux Verification Center (linuxtesting.org) with SVACE
--- .../net/ethernet/aquantia/atlantic/aq_ptp.c | 10 +++++----- .../net/ethernet/aquantia/atlantic/aq_ptp.h | 4 ++-- .../net/ethernet/aquantia/atlantic/aq_ring.c | 18 ++++++++++++------ 3 files changed, 19 insertions(+), 13 deletions(-)
drivers/net/ethernet/aquantia/atlantic/aq_ptp.c +5 -5
@@ -553,17 +553,17 @@ void aq_ptp_tx_hwtstamp(struct aq_nic_s *aq_nic, u64 timestamp)/* aq_ptp_rx_hwtstamp - utility function which checks for RX time stamp * @adapter: pointer to adapter struct -* @skb: particular skb to send timestamp with +* @shhwtstamps: particular skb_shared_hwtstamps to save timestamp * * if the timestamp is valid, we convert it into the timecounter ns * value, then store that result into the hwtstamps structure which * is passed up the network stack */ -static void aq_ptp_rx_hwtstamp (struct aq_ptp_s *aq_ptp,struct sk_buff *skb, +static void aq_ptp_rx_hwtstamp (struct aq_ptp_s *aq_ptp,struct skb_shared_hwtstamps *shhwtstamps,u64 timestamp) { timestamp -=atomic_read (&aq_ptp->offset_ingress); -aq_ptp_convert_to_hwtstamp (aq_ptp,skb_hwtstamps (skb), timestamp); +aq_ptp_convert_to_hwtstamp (aq_ptp, shhwtstamps, timestamp); } void aq_ptp_hwtstamp_config_get(struct aq_ptp_s *aq_ptp,
@@ -639,7 +639,7 @@ bool aq_ptp_ring(struct aq_nic_s *aq_nic, struct aq_ring_s *ring) &aq_ptp->ptp_rx == ring || &aq_ptp->hwts_rx == ring; } -u16 aq_ptp_extract_ts (struct aq_nic_s *aq_nic,struct sk_buff *skb,u8 *p, +u16 aq_ptp_extract_ts (struct aq_nic_s *aq_nic,struct skb_shared_hwtstamps *shhwtstamps,u8 *p,unsigned int len) {struct aq_ptp_s *aq_ptp = aq_nic->aq_ptp;
@@ -648,7 +648,7 @@ u16 aq_ptp_extract_ts(struct aq_nic_s *aq_nic, struct sk_buff *skb, u8 *p, p, len, ×tamp);if (ret >0 ) -aq_ptp_rx_hwtstamp (aq_ptp, skb, timestamp); +aq_ptp_rx_hwtstamp (aq_ptp, shhwtstamps, timestamp);return ret; }
drivers/net/ethernet/aquantia/atlantic/aq_ptp.h +2 -2
@@ -67,7 +67,7 @@ int aq_ptp_hwtstamp_config_set(struct aq_ptp_s *aq_ptp,/* Return either ring is belong to PTP or not*/ bool aq_ptp_ring (struct aq_nic_s *aq_nic,struct aq_ring_s *ring); -u16 aq_ptp_extract_ts (struct aq_nic_s *aq_nic,struct sk_buff *skb,u8 *p, +u16 aq_ptp_extract_ts (struct aq_nic_s *aq_nic,struct skb_shared_hwtstamps *shhwtstamps,u8 *p,unsigned int len);struct ptp_clock *aq_ptp_get_ptp_clock (struct aq_ptp_s *aq_ptp);
@@ -143,7 +143,7 @@ static inline bool aq_ptp_ring(struct aq_nic_s *aq_nic, struct aq_ring_s *ring) }static inline u16 aq_ptp_extract_ts (struct aq_nic_s *aq_nic, -struct sk_buff *skb,u8 *p, +struct skb_shared_hwtstamps *shhwtstamps,u8 *p,unsigned int len) {return 0 ;
drivers/net/ethernet/aquantia/atlantic/aq_ring.c +12 -6
@@ -647,7 +647,7 @@ static int __aq_ring_rx_clean(struct aq_ring_s *self, struct napi_struct *napi, }if (is_ptp_ring) buff->len -= -aq_ptp_extract_ts (self->aq_nic, skb, +aq_ptp_extract_ts (self->aq_nic,skb_hwtstamps (skb),aq_buf_vaddr (&buff->rxdata), buff->len);
@@ -742,6 +742,8 @@ static int __aq_ring_xdp_clean(struct aq_ring_s *rx_ring,struct aq_ring_buff_s *buff = &rx_ring->buff_ring[rx_ring->sw_head];bool is_ptp_ring =aq_ptp_ring (rx_ring->aq_nic, rx_ring);struct aq_ring_buff_s *buff_ =NULL ; +u16 ptp_hwtstamp_len =0 ; +struct skb_shared_hwtstamps shhwtstamps;struct sk_buff *skb =NULL ;unsigned int next_ =0U ;struct xdp_buff xdp;
@@ -810,11 +812,12 @@ static int __aq_ring_xdp_clean(struct aq_ring_s *rx_ring, hard_start =page_address (buff->rxdata.page) + buff->rxdata.pg_off - rx_ring->page_offset; -if (is_ptp_ring) - buff->len -= -aq_ptp_extract_ts (rx_ring->aq_nic, skb, -aq_buf_vaddr (&buff->rxdata), - buff->len); +if (is_ptp_ring) { + ptp_hwtstamp_len =aq_ptp_extract_ts (rx_ring->aq_nic, &shhwtstamps, +aq_buf_vaddr (&buff->rxdata), + buff->len); + buff->len -= ptp_hwtstamp_len; + }xdp_init_buff (&xdp, frame_sz, &rx_ring->xdp_rxq); xdp_prepare_buff(&xdp, hard_start, rx_ring->page_offset,
@@ -834,6 +837,9 @@ static int __aq_ring_xdp_clean(struct aq_ring_s *rx_ring,if (IS_ERR (skb) || !skb)continue ; +if (ptp_hwtstamp_len >0 ) + *skb_hwtstamps (skb) = shhwtstamps; +if (buff->is_vlan)__vlan_hwaccel_put_tag (skb,htons (ETH_P_8021Q ), buff->vlan_rx_tag);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 45/194 net: hns: fix wrong head when modify the tx feature when sending packets
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yonglong Liu <[email protected]>
[ Upstream commit 84757d0839451b20b11e993128f0a77393ca50c1 ]
Upon changing the tx feature, the hns driver will modify the maybe_stop_tx() and fill_desc() functions, if the modify happens during packet sending, will cause the hardware and software pointers do not match, and the port can not work anymore.
This patch deletes the maybe_stop_tx() and fill_desc() functions modification when setting tx feature, and use the skb_is_gro() to determine which functions to use in the tx path.
--- drivers/net/ethernet/hisilicon/hns/hns_enet.c | 53 +++++++++++-------- drivers/net/ethernet/hisilicon/hns/hns_enet.h | 3 +- 2 files changed, 33 insertions(+), 23 deletions(-)
drivers/net/ethernet/hisilicon/hns/hns_enet.c +31 -22
@@ -142,7 +142,8 @@ MODULE_DEVICE_TABLE(acpi, hns_enet_acpi_match);static void fill_desc (struct hnae_ring *ring,void *priv,int size,dma_addr_t dma,int frag_end, -int buf_num,enum hns_desc_type type,int mtu) +int buf_num,enum hns_desc_type type,int mtu, +bool is_gso) {struct hnae_desc *desc = &ring->desc[ring->next_to_use];struct hnae_desc_cb *desc_cb = &ring->desc_cb[ring->next_to_use];
@@ -275,6 +276,15 @@ static int hns_nic_maybe_stop_tso(return 0 ; } +static int hns_nic_maybe_stop_tx_v2 (struct sk_buff **out_skb,int *bnum, +struct hnae_ring *ring) +{ +if (skb_is_gso (*out_skb)) +return hns_nic_maybe_stop_tso (out_skb, bnum, ring); +else +return hns_nic_maybe_stop_tx (out_skb, bnum, ring); +} +static void fill_tso_desc (struct hnae_ring *ring,void *priv,int size,dma_addr_t dma,int frag_end,int buf_num,enum hns_desc_type type,int mtu)
@@ -300,6 +310,19 @@ static void fill_tso_desc(struct hnae_ring *ring, void *priv, mtu); } +static void fill_desc_v2 (struct hnae_ring *ring,void *priv, +int size,dma_addr_t dma,int frag_end, +int buf_num,enum hns_desc_type type,int mtu, +bool is_gso) +{ +if (is_gso) +fill_tso_desc (ring, priv, size, dma, frag_end, buf_num, type, + mtu); +else +fill_v2_desc (ring, priv, size, dma, frag_end, buf_num, type, + mtu); +} +netdev_tx_t hns_nic_net_xmit_hw (struct net_device *ndev,struct sk_buff *skb,struct hns_nic_ring_data *ring_data)
@@ -313,6 +336,7 @@ netdev_tx_t hns_nic_net_xmit_hw(struct net_device *ndev,int seg_num;dma_addr_t dma;int size, next_to_use; +bool is_gso;int i;switch (priv->ops.maybe_stop_tx (&skb, &buf_num, ring)) {
@@ -339,8 +363,9 @@ netdev_tx_t hns_nic_net_xmit_hw(struct net_device *ndev, ring->stats.sw_err_cnt++; goto out_err_tx_ok; } + is_gso =skb_is_gso (skb); priv->ops.fill_desc (ring, skb, size, dma, seg_num ==1 ?1 :0 , - buf_num,DESC_TYPE_SKB , ndev->mtu); + buf_num,DESC_TYPE_SKB , ndev->mtu, is_gso);/* fill the fragments */ for (i =1 ; i < seg_num; i++) {
@@ -354,7 +379,7 @@ netdev_tx_t hns_nic_net_xmit_hw(struct net_device *ndev, } priv->ops.fill_desc (ring,skb_frag_page (frag), size, dma, seg_num -1 == i ?1 :0 , buf_num, -DESC_TYPE_PAGE , ndev->mtu); +DESC_TYPE_PAGE , ndev->mtu, is_gso); }/*complete translate all packets*/
@@ -1776,15 +1801,6 @@ static int hns_nic_set_features(struct net_device *netdev,netdev_info (netdev,"enet v1 do not support tso!\n" );break ;default : -if (features & (NETIF_F_TSO |NETIF_F_TSO6 )) { - priv->ops.fill_desc = fill_tso_desc; - priv->ops.maybe_stop_tx = hns_nic_maybe_stop_tso; -/* The chip only support 7*4096 */ -netif_set_tso_max_size (netdev,7 *4096 ); - }else { - priv->ops.fill_desc = fill_v2_desc; - priv->ops.maybe_stop_tx = hns_nic_maybe_stop_tx; - }break ; } netdev->features = features;
@@ -2159,16 +2175,9 @@ static void hns_nic_set_priv_ops(struct net_device *netdev) priv->ops.maybe_stop_tx = hns_nic_maybe_stop_tx; }else { priv->ops.get_rxd_bnum = get_v2rx_desc_bnum; -if ((netdev->features &NETIF_F_TSO ) || - (netdev->features &NETIF_F_TSO6 )) { - priv->ops.fill_desc = fill_tso_desc; - priv->ops.maybe_stop_tx = hns_nic_maybe_stop_tso; -/* This chip only support 7*4096 */ -netif_set_tso_max_size (netdev,7 *4096 ); - }else { - priv->ops.fill_desc = fill_v2_desc; - priv->ops.maybe_stop_tx = hns_nic_maybe_stop_tx; - } + priv->ops.fill_desc = fill_desc_v2; + priv->ops.maybe_stop_tx = hns_nic_maybe_stop_tx_v2; +netif_set_tso_max_size (netdev,7 *4096 );/* enable tso when init * control tso on/off through TSE bit in bd */
drivers/net/ethernet/hisilicon/hns/hns_enet.h +2 -1
@@ -44,7 +44,8 @@ struct hns_nic_ring_data {struct hns_nic_ops {void (*fill_desc)(struct hnae_ring *ring,void *priv,int size,dma_addr_t dma,int frag_end, -int buf_num,enum hns_desc_type type,int mtu); +int buf_num,enum hns_desc_type type,int mtu, +bool is_gso);int (*maybe_stop_tx)(struct sk_buff **out_skb,int *bnum,struct hnae_ring *ring);void (*get_rxd_bnum)(u32 bnum_flag,int *out_bnum);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 46/194 net: hns: fix fake link up on xge port
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yonglong Liu <[email protected]>
[ Upstream commit f708aba40f9c1eeb9c7e93ed4863b5f85b09b288 ]
If a xge port just connect with an optical module and no fiber, it may have a fake link up because there may be interference on the hardware. This patch adds an anti-shake to avoid the problem. And the time of anti-shake is base on tests.
--- .../net/ethernet/hisilicon/hns/hns_dsaf_mac.c | 29 +++++++++++++++++++ 1 file changed, 29 insertions(+)
drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c +29 -0
@@ -66,6 +66,27 @@ static enum mac_mode hns_get_enet_interface(const struct hns_mac_cb *mac_cb) } } +static u32 hns_mac_link_anti_shake (struct mac_driver *mac_ctrl_drv) +{ +#define HNS_MAC_LINK_WAIT_TIME 5 +#define HNS_MAC_LINK_WAIT_CNT 40 + +u32 link_status =0 ; +int i; + +if (!mac_ctrl_drv->get_link_status) +return link_status; + +for (i =0 ; i <HNS_MAC_LINK_WAIT_CNT ; i++) { +msleep (HNS_MAC_LINK_WAIT_TIME ); + mac_ctrl_drv->get_link_status (mac_ctrl_drv, &link_status); +if (!link_status) +break ; + } + +return link_status; +} +void hns_mac_get_link_status (struct hns_mac_cb *mac_cb,u32 *link_status) {struct mac_driver *mac_ctrl_drv;
@@ -83,6 +104,14 @@ void hns_mac_get_link_status(struct hns_mac_cb *mac_cb, u32 *link_status) &sfp_prsnt);if (!ret) *link_status = *link_status && sfp_prsnt; + +/* for FIBER port, it may have a fake link up. +* when the link status changes from down to up, we need to do +* anti-shake. the anti-shake time is base on tests. +* only FIBER port need to do this. +*/ +if (*link_status && !mac_cb->link) + *link_status =hns_mac_link_anti_shake (mac_ctrl_drv); } mac_cb->link = *link_status;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 47/194 octeontx2-af: Adjust Tx credits when MCS external bypass is disabled
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nithin Dabilpuram <[email protected]>
[ Upstream commit dca6fa8644b89f54345e55501b1419316ba5cb29 ]
When MCS external bypass is disabled, MCS returns additional 2 credits(32B) for every packet Tx'ed on LMAC. To account for these extra credits, NIX_AF_TX_LINKX_NORM_CREDIT.CC_MCS_CNT needs to be configured as otherwise NIX Tx credits would overflow and will never be returned to idle state credit count causing issues with credit control and MTU change.
This patch fixes the same by configuring CC_MCS_CNT at probe time for MCS enabled SoC's
--- drivers/net/ethernet/marvell/octeontx2/af/mcs.c | 14 +++++++++++++- drivers/net/ethernet/marvell/octeontx2/af/mcs.h | 2 ++ drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 1 + .../net/ethernet/marvell/octeontx2/af/rvu_nix.c | 8 ++++++++ .../net/ethernet/marvell/octeontx2/af/rvu_reg.h | 1 + 5 files changed, 25 insertions(+), 1 deletion(-)
drivers/net/ethernet/marvell/octeontx2/af/mcs.c +13 -1
@@ -1219,6 +1219,17 @@ struct mcs *mcs_get_pdata(int mcs_id)return NULL ; } +bool is_mcs_bypass (int mcs_id) +{ +struct mcs *mcs_dev; + +list_for_each_entry (mcs_dev, &mcs_list, mcs_list) { +if (mcs_dev->mcs_id == mcs_id) +return mcs_dev->bypass; + } +return true; +} +void mcs_set_port_cfg (struct mcs *mcs,struct mcs_port_cfg_set_req *req) {u64 val =0 ;
@@ -1436,7 +1447,7 @@ static int mcs_x2p_calibration(struct mcs *mcs)return err; } -static void mcs_set_external_bypass (struct mcs *mcs,u8 bypass) +static void mcs_set_external_bypass (struct mcs *mcs,bool bypass) {u64 val;
@@ -1447,6 +1458,7 @@ static void mcs_set_external_bypass(struct mcs *mcs, u8 bypass)else val &= ~BIT_ULL (6 );mcs_reg_write (mcs,MCSX_MIL_GLOBAL , val); + mcs->bypass = bypass; }static void mcs_global_cfg (struct mcs *mcs)
drivers/net/ethernet/marvell/octeontx2/af/mcs.h +2 -0
@@ -149,6 +149,7 @@ struct mcs {u16 num_vec;void *rvu;u16 *tx_sa_active; +bool bypass; };struct mcs_ops {
@@ -206,6 +207,7 @@ void mcs_get_custom_tag_cfg(struct mcs *mcs, struct mcs_custom_tag_cfg_get_req *int mcs_alloc_ctrlpktrule (struct rsrc_bmap *rsrc,u16 *pf_map,u16 offset,u16 pcifunc);int mcs_free_ctrlpktrule (struct mcs *mcs,struct mcs_free_ctrl_pkt_rule_req *req);int mcs_ctrlpktrule_write (struct mcs *mcs,struct mcs_ctrl_pkt_rule_write_req *req); +bool is_mcs_bypass (int mcs_id);/* CN10K-B APIs */ void cn10kb_mcs_set_hw_capabilities (struct mcs *mcs);
drivers/net/ethernet/marvell/octeontx2/af/rvu.h +1 -0
@@ -325,6 +325,7 @@ struct nix_hw {struct nix_txvlan txvlan;struct nix_ipolicer *ipolicer;u64 *tx_credits; +u8 cc_mcs_cnt; };/* RVU block's capabilities or functionality,
drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +8 -0
@@ -12,6 +12,7 @@#include "rvu_reg.h" #include "rvu.h" #include "npc.h" +#include "mcs.h" #include "cgx.h" #include "lmac_common.h" #include "rvu_npc_hash.h"
@@ -4164,6 +4165,12 @@ static void nix_link_config(struct rvu *rvu, int blkaddr, SDP_HW_MAX_FRS << 16 | NIC_HW_MIN_FRS); } +/* Get MCS external bypass status for CN10K-B */ +if (mcs_get_blkcnt () ==1 ) { +/* Adjust for 2 credits when external bypass is disabled */ + nix_hw->cc_mcs_cnt =is_mcs_bypass (0 ) ?0 :2 ; + } +/* Set credits for Tx links assuming max packet length allowed. * This will be reconfigured based on MTU set for PF/VF. */
@@ -4187,6 +4194,7 @@ static void nix_link_config(struct rvu *rvu, int blkaddr, tx_credits = (lmac_fifo_len - lmac_max_frs) /16 ;/* Enable credits and set credit pkt count to max allowed */ cfg = (tx_credits <<12 ) | (0x1FF <<2 ) |BIT_ULL (1 ); + cfg |=FIELD_PREP (NIX_AF_LINKX_MCS_CNT_MASK , nix_hw->cc_mcs_cnt); link = iter + slink; nix_hw->tx_credits[link] = tx_credits;
drivers/net/ethernet/marvell/octeontx2/af/rvu_reg.h +1 -0
@@ -434,6 +434,7 @@#define NIX_AF_LINKX_BASE_MASK GENMASK_ULL(11, 0)#define NIX_AF_LINKX_RANGE_MASK GENMASK_ULL(19, 16) +#define NIX_AF_LINKX_MCS_CNT_MASK GENMASK_ULL(33, 32)/* SSO */ #define SSO_AF_CONST (0x1000)
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 48/194 octeontx2-af: Fix mcs sa cam entries size
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geetha sowjanya <[email protected]>
[ Upstream commit 9723b2cca1f0e980c53156b52ea73b93966b3c8a ]
On latest silicon versions SA cam entries increased to 256. This patch fixes the datatype of sa_entries in mcs_hw_info struct to u16 to hold 256 entries.
--- drivers/net/ethernet/marvell/octeontx2/af/mbox.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/marvell/octeontx2/af/mbox.h +1 -1
@@ -1877,7 +1877,7 @@ struct mcs_hw_info {u8 tcam_entries;/* RX/TX Tcam entries per mcs block */ u8 secy_entries;/* RX/TX SECY entries per mcs block */ u8 sc_entries;/* RX/TX SC CAM entries per mcs block */ -u8 sa_entries;/* PN table entries = SA entries */ +u16 sa_entries;/* PN table entries = SA entries */ u64 rsvd[16 ]; };
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 49/194 octeontx2-af: Fix mcs stats register address
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geetha sowjanya <[email protected]>
[ Upstream commit 3ba98a8c6f8ceb4e01a78f973d8d9017020bbd57 ]
This patch adds the miss mcs stats register
for mcs supported platforms.
--- .../net/ethernet/marvell/octeontx2/af/mcs.c | 4 +-- .../ethernet/marvell/octeontx2/af/mcs_reg.h | 31 ++++++++++++++++--- 2 files changed, 29 insertions(+), 6 deletions(-)
drivers/net/ethernet/marvell/octeontx2/af/mcs.c +2 -2
@@ -117,7 +117,7 @@ void mcs_get_rx_secy_stats(struct mcs *mcs, struct mcs_secy_stats *stats, int id reg =MCSX_CSE_RX_MEM_SLAVE_INPKTSSECYTAGGEDCTLX (id); stats->pkt_tagged_ctl_cnt =mcs_reg_read (mcs, reg); - reg =MCSX_CSE_RX_MEM_SLAVE_INPKTSSECYUNTAGGEDORNOTAGX (id); + reg =MCSX_CSE_RX_MEM_SLAVE_INPKTSSECYUNTAGGEDX (id); stats->pkt_untaged_cnt =mcs_reg_read (mcs, reg); reg =MCSX_CSE_RX_MEM_SLAVE_INPKTSSECYCTLX (id);
@@ -215,7 +215,7 @@ void mcs_get_sc_stats(struct mcs *mcs, struct mcs_sc_stats *stats, reg =MCSX_CSE_RX_MEM_SLAVE_INPKTSSCNOTVALIDX (id); stats->pkt_notvalid_cnt =mcs_reg_read (mcs, reg); - reg =MCSX_CSE_RX_MEM_SLAVE_INPKTSSCUNCHECKEDOROKX (id); + reg =MCSX_CSE_RX_MEM_SLAVE_INPKTSSCUNCHECKEDX (id); stats->pkt_unchecked_cnt =mcs_reg_read (mcs, reg);if (mcs->hw->mcs_blks >1 ) {
drivers/net/ethernet/marvell/octeontx2/af/mcs_reg.h +27 -4
@@ -810,14 +810,37 @@ offset =0x9d8ull ; \ offset; }) +#define MCSX_CSE_RX_MEM_SLAVE_INPKTSSCUNCHECKEDX (a) ({ \ + u64 offset; \ + \ + offset = 0xee80ull; \ + if (mcs->hw->mcs_blks > 1) \ + offset = 0xe818ull; \ + offset += (a) * 0x8ull; \ + offset; }) + +#define MCSX_CSE_RX_MEM_SLAVE_INPKTSSECYUNTAGGEDX (a) ({ \ + u64 offset; \ + \ + offset = 0xa680ull; \ + if (mcs->hw->mcs_blks > 1) \ + offset = 0xd018ull; \ + offset += (a) * 0x8ull; \ + offset; }) + +#define MCSX_CSE_RX_MEM_SLAVE_INPKTSSCLATEORDELAYEDX (a) ({ \ + u64 offset; \ + \ + offset = 0xf680ull; \ + if (mcs->hw->mcs_blks > 1) \ + offset = 0xe018ull; \ + offset += (a) * 0x8ull; \ + offset; }) +#define MCSX_CSE_RX_MEM_SLAVE_INOCTETSSCDECRYPTEDX (a) (0xe680ull + (a) * 0x8ull)#define MCSX_CSE_RX_MEM_SLAVE_INOCTETSSCVALIDATEX (a) (0xde80ull + (a) * 0x8ull) -#define MCSX_CSE_RX_MEM_SLAVE_INPKTSSECYUNTAGGEDORNOTAGX (a) (0xa680ull + (a) * 0x8ull)#define MCSX_CSE_RX_MEM_SLAVE_INPKTSSECYNOTAGX (a) (0xd218 + (a) * 0x8ull) -#define MCSX_CSE_RX_MEM_SLAVE_INPKTSSECYUNTAGGEDX (a) (0xd018ull + (a) * 0x8ull) -#define MCSX_CSE_RX_MEM_SLAVE_INPKTSSCUNCHECKEDOROKX (a) (0xee80ull + (a) * 0x8ull)#define MCSX_CSE_RX_MEM_SLAVE_INPKTSSECYCTLX (a) (0xb680ull + (a) * 0x8ull) -#define MCSX_CSE_RX_MEM_SLAVE_INPKTSSCLATEORDELAYEDX (a) (0xf680ull + (a) * 0x8ull)#define MCSX_CSE_RX_MEM_SLAVE_INPKTSSAINVALIDX (a) (0x12680ull + (a) * 0x8ull)#define MCSX_CSE_RX_MEM_SLAVE_INPKTSSANOTUSINGSAERRORX (a) (0x15680ull + (a) * 0x8ull)#define MCSX_CSE_RX_MEM_SLAVE_INPKTSSANOTVALIDX (a) (0x13680ull + (a) * 0x8ull)
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 50/194 octeontx2-af: Add missing mcs flr handler call
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geetha sowjanya <[email protected]>
[ Upstream commit d431abd0a9aa27be379fb5f8304062071b0f5a7e ]
If mcs resources are attached to PF/VF. These resources need to be freed on FLR. This patch add missing mcs flr call on PF FLR.
--- drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/marvell/octeontx2/af/rvu.c +3 -0
@@ -2622,6 +2622,9 @@ static void __rvu_flr_handler(struct rvu *rvu, u16 pcifunc)*/ rvu_npc_free_mcam_entries (rvu, pcifunc,-1 ); +if (rvu->mcs_blk_cnt) +rvu_mcs_flr_handler (rvu, pcifunc); +mutex_unlock (&rvu->flr_lock); }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 51/194 octeontx2-af: Update Tx link register range
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rahul Bhansali <[email protected]>
[ Upstream commit 7336fc196748f82646b630d5a2e9d283e200b988 ]
On new silicons the TX channels for transmit level has increased. This patch fixes the respective register offset range to configure the newly added channels.
--- drivers/net/ethernet/marvell/octeontx2/af/rvu_reg.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/marvell/octeontx2/af/rvu_reg.c +2 -2
@@ -31,8 +31,8 @@ static struct hw_reg_map txsch_reg_map[NIX_TXSCH_LVL_CNT] = { {NIX_TXSCH_LVL_TL4, 3, 0xFFFF, {{0x0B00, 0x0B08}, {0x0B10, 0x0B18}, {0x1200, 0x12E0} } }, {NIX_TXSCH_LVL_TL3, 4, 0xFFFF, {{0x1000, 0x10E0}, {0x1600, 0x1608}, - {0x1610, 0x1618}, {0x1700, 0x17B0} } }, - {NIX_TXSCH_LVL_TL2, 2, 0xFFFF, {{0x0E00, 0x0EE0}, {0x1700, 0x17B0} } }, + {0x1610, 0x1618}, {0x1700, 0x17C8} } }, + {NIX_TXSCH_LVL_TL2, 2, 0xFFFF, {{0x0E00, 0x0EE0}, {0x1700, 0x17C8} } }, {NIX_TXSCH_LVL_TL1, 1, 0xFFFF, {{0x0C00, 0x0D98} } }, };
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 52/194 dt-bindings: interrupt-controller: Allow #power-domain-cells
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit c0a2755aced969e0125fd68ccd95269b28d8913a ]
MPM provides a single genpd. Allow #power-domain-cells = <0>.
--- .../devicetree/bindings/interrupt-controller/qcom,mpm.yaml | 4 ++++ 1 file changed, 4 insertions(+)
Documentation/devicetree/bindings/interrupt-controller/qcom,mpm.yaml +4 -0
@@ -62,6 +62,9 @@ properties: - description: MPM pin number - description: GIC SPI number for the MPM pin + '#power-domain-cells': + const: 0 + required: - compatible - reg
@@ -93,4 +96,5 @@ examples: <86 183>, <90 260>, <91 260>; + #power-domain-cells = <0>; };
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 53/194 netfilter: nft_exthdr: add boolean DCCP option matching
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeremy Sowden <[email protected]>
[ Upstream commit b9f9a485fb0eb80b0e2b90410b28cbb9b0e85687 ]
The xt_dccp iptables module supports the matching of DCCP packets based on the presence or absence of DCCP options. Extend nft_exthdr to add this functionality to nftables.
Stable-dep-of: 63331e37fb22 ("netfilter: nf_tables: fix 'exist' matching on bigendian arches")
--- include/uapi/linux/netfilter/nf_tables.h | 2 + net/netfilter/nft_exthdr.c | 106 +++++++++++++++++++++++ 2 files changed, 108 insertions(+)
include/uapi/linux/netfilter/nf_tables.h +2 -0
@@ -816,12 +816,14 @@ enum nft_exthdr_flags {* @NFT_EXTHDR_OP_TCP: match against tcp options * @NFT_EXTHDR_OP_IPV4: match against ipv4 options * @NFT_EXTHDR_OP_SCTP: match against sctp chunks +* @NFT_EXTHDR_OP_DCCP: match against dccp otions */ enum nft_exthdr_op {NFT_EXTHDR_OP_IPV6 ,NFT_EXTHDR_OP_TCPOPT ,NFT_EXTHDR_OP_IPV4 ,NFT_EXTHDR_OP_SCTP , +NFT_EXTHDR_OP_DCCP , __NFT_EXTHDR_OP_MAX };#define NFT_EXTHDR_OP_MAX (__NFT_EXTHDR_OP_MAX - 1)
net/netfilter/nft_exthdr.c +106 -0
136 lines not on this page · raw message
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 54/194 netfilter: nf_tables: fix exist matching on bigendian arches
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 63331e37fb227e796894b31d713697612c8dee7f ]
Maze reports "tcp option fastopen exists" fails to match on OpenWrt 22.03.5, r20134-5f15225c1e (5.10.176) router.
"tcp option fastopen exists" translates to:
inet
[ exthdr load tcpopt 1b @ 34 + 0 present => reg 1 ] [ cmp eq reg 1 0x00000001 ]
.. but existing nft userspace generates a 1-byte compare.
On LSB (x86), "*reg32 = 1" is identical to nft_reg_store8(reg32, 1), but not on MSB, which will place the 1 last. IOW, on bigendian aches the cmp8 is awalys false.
Make sure we store this in a consistent fashion, so existing userspace will also work on MSB (bigendian).
Regardless of this patch we can also change nft userspace to generate 'reg32 == 0' and 'reg32 != 0' instead of u8 == 0 // u8 == 1 when adding 'option x missing/exists' expressions as well.
--- net/netfilter/nft_exthdr.c | 4 ++-- net/netfilter/nft_fib.c | 8 ++++++-- 2 files changed, 8 insertions(+), 4 deletions(-)
net/netfilter/nft_exthdr.c +2 -2
@@ -215,7 +215,7 @@ static void nft_exthdr_tcp_eval(const struct nft_expr *expr, offset = i + priv->offset;if (priv->flags &NFT_EXTHDR_F_PRESENT ) { - *dest =1 ; +nft_reg_store8 (dest,1 ); }else {if (priv->len %NFT_REG32_SIZE ) dest[priv->len /NFT_REG32_SIZE ] =0 ;
@@ -462,7 +462,7 @@ static void nft_exthdr_dccp_eval(const struct nft_expr *expr, type = bufp[0 ];if (type == priv->type) { - *dest =1 ; +nft_reg_store8 (dest,1 );return ; }
net/netfilter/nft_fib.c +6 -2
@@ -144,11 +144,15 @@ void nft_fib_store_result(void *reg, const struct nft_fib *priv,switch (priv->result) {case NFT_FIB_RESULT_OIF : index = dev ? dev->ifindex :0 ; - *dreg = (priv->flags &NFTA_FIB_F_PRESENT ) ? !!index : index; +if (priv->flags &NFTA_FIB_F_PRESENT ) +nft_reg_store8 (dreg, !!index); +else + *dreg = index; +break ;case NFT_FIB_RESULT_OIFNAME :if (priv->flags &NFTA_FIB_F_PRESENT ) - *dreg = !!dev; +nft_reg_store8 (dreg, !!dev);else strncpy (reg, dev ? dev->name :"" ,IFNAMSIZ );break ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 55/194 netfilter: nf_tables: bail out on mismatching dynset and set expressions
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 3701cd390fd731ee7ae8b8006246c8db82c72bea ]
If dynset expressions provided by userspace is larger than the declared set expressions, then bail out.
--- net/netfilter/nft_dynset.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
net/netfilter/nft_dynset.c +9 -4
@@ -279,10 +279,15 @@ static int nft_dynset_init(const struct nft_ctx *ctx, priv->expr_array[i] = dynset_expr; priv->num_exprs++; -if (set->num_exprs && - dynset_expr->ops != set->exprs[i]->ops) { - err = -EOPNOTSUPP ; - goto err_expr_free; +if (set->num_exprs) { +if (i >= set->num_exprs) { + err = -EINVAL ; + goto err_expr_free; + } +if (dynset_expr->ops != set->exprs[i]->ops) { + err = -EOPNOTSUPP ; + goto err_expr_free; + } } i++; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 56/194 netfilter: nf_tables: validate family when identifying table via handle
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit f6e1532a2697b81da00bfb184e99d15e01e9d98c ]
Validate table family when looking up for it via NFTA_TABLE_HANDLE.
--- net/netfilter/nf_tables_api.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
net/netfilter/nf_tables_api.c +3 -2
@@ -805,7 +805,7 @@ static struct nft_table *nft_table_lookup(const struct net *net,static struct nft_table *nft_table_lookup_byhandle (const struct net *net,const struct nlattr *nla, -u8 genmask,u32 nlpid) +int family,u8 genmask,u32 nlpid) {struct nftables_pernet *nft_net;struct nft_table *table;
@@ -813,6 +813,7 @@ static struct nft_table *nft_table_lookup_byhandle(const struct net *net, nft_net =nft_pernet (net);list_for_each_entry (table, &nft_net->tables, list) {if (be64_to_cpu (nla_get_be64 (nla)) == table->handle && + table->family == family &&nft_active_genmask (table, genmask)) {if (nft_table_has_owner (table) && nlpid && table->nlpid != nlpid)
@@ -1537,7 +1538,7 @@ static int nf_tables_deltable(struct sk_buff *skb, const struct nfnl_info *info,if (nla[NFTA_TABLE_HANDLE ]) { attr = nla[NFTA_TABLE_HANDLE ]; - table =nft_table_lookup_byhandle (net, attr, genmask, + table =nft_table_lookup_byhandle (net, attr, family, genmask,NETLINK_CB (skb).portid); }else { attr = nla[NFTA_TABLE_NAME ];
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 57/194 netfilter: xt_owner: Fix for unsafe access of sk->sk_socket
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phil Sutter <[email protected]>
[ Upstream commit 7ae836a3d630e146b732fe8ef7d86b243748751f ]
A concurrently running sock_orphan() may NULL the sk_socket pointer in between check and deref. Follow other users (like nft_meta.c for instance) and acquire sk_callback_lock before dereferencing sk_socket.
--- net/netfilter/xt_owner.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
net/netfilter/xt_owner.c +12 -4
@@ -76,18 +76,23 @@ owner_mt(const struct sk_buff *skb, struct xt_action_param *par)*/ return false; - filp = sk->sk_socket->file; -if (filp ==NULL ) +read_lock_bh (&sk->sk_callback_lock); + filp = sk->sk_socket ? sk->sk_socket->file :NULL ; +if (filp ==NULL ) { +read_unlock_bh (&sk->sk_callback_lock);return ((info->match ^ info->invert) & (XT_OWNER_UID |XT_OWNER_GID )) ==0 ; + }if (info->match &XT_OWNER_UID ) {kuid_t uid_min =make_kuid (net->user_ns, info->uid_min);kuid_t uid_max =make_kuid (net->user_ns, info->uid_max);if ((uid_gte (filp->f_cred->fsuid, uid_min) &&uid_lte (filp->f_cred->fsuid, uid_max)) ^ - !(info->invert &XT_OWNER_UID )) + !(info->invert &XT_OWNER_UID )) { +read_unlock_bh (&sk->sk_callback_lock);return false; + } }if (info->match &XT_OWNER_GID ) {
@@ -112,10 +117,13 @@ owner_mt(const struct sk_buff *skb, struct xt_action_param *par) } } -if (match ^ !(info->invert &XT_OWNER_GID )) +if (match ^ !(info->invert &XT_OWNER_GID )) { +read_unlock_bh (&sk->sk_callback_lock);return false; + } } +read_unlock_bh (&sk->sk_callback_lock);return true; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 58/194 tcp: do not accept ACK of bytes we never sent
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 3d501dd326fb1c73f1b8206d4c6e1d7b15c07e27 ]
This patch is based on a detailed report and ideas from Yepeng Pan and Christian Rossow.
ACK seq validation is currently following RFC 5961 5.2 guidelines:
The ACK value is considered acceptable only if
it is in the range of ((SND.UNA - MAX.SND.WND) <= SEG.ACK <= SND.NXT). All incoming segments whose ACK value doesn't satisfy the above condition MUST be discarded and an ACK sent back. It needs to be noted that RFC 793 on page 72 (fifth check) says: "If the ACK is a duplicate (SEG.ACK < SND.UNA), it can be ignored. If the ACK acknowledges something not yet sent (SEG.ACK > SND.NXT) then send an ACK, drop the segment, and return". The "ignored" above implies that the processing of the incoming data segment continues, which means the ACK value is treated as acceptable. This mitigation makes the ACK check more stringent since any ACK < SND.UNA wouldn't be accepted, instead only ACKs that are in the range ((SND.UNA - MAX.SND.WND) <= SEG.ACK <= SND.NXT) get through.
This can be refined for new (and possibly spoofed) flows, by not accepting ACK for bytes that were never sent.
This greatly improves TCP security at a little cost.
I added a Fixes: tag to make sure this patch will reach stable trees, even if the 'blamed' patch was adhering to the RFC.
tp->bytes_acked was added in linux-4.2
Following packetdrill test (courtesy of Yepeng Pan) shows the issue at hand:
0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3 +0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0 +0 bind(3, ..., ...) = 0
+0 listen(3, 1024) = 0
// ---------------- Handshake ------------------- //
// when window scale is set to 14 the window size can be extended to // 65535 * (2^14) = 1073725440. Linux would accept an ACK packet // with ack number in (Server_ISN+1-1073725440. Server_ISN+1) // ,though this ack number acknowledges some data never // sent by the server.
+0 < S 0:0(0) win 65535 <mss 1400,nop,wscale 14>
+0 > S. 0:0(0) ack 1 <...>
+0 < . 1:1(0) ack 1 win 65535
+0 accept(3, ..., ...) = 4
// For the established connection, we send an ACK packet, // the ack packet uses ack number 1 - 1073725300 + 2^32, // where 2^32 is used to wrap around.
// Note: we used 1073725300 instead of 1073725440 to avoid possible // edge cases.
// 1 - 1073725300 + 2^32 = 3221241997
// Oops, old kernels happily accept this packet.
+0 < . 1:1001(1000) ack 3221241997 win 65535
// After the kernel fix the following will be replaced by a challenge ACK, // and prior malicious frame would be dropped.
+0 > . 1:1(0) ack 1001
--- net/ipv4/tcp_input.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
net/ipv4/tcp_input.c +5 -1
@@ -3803,8 +3803,12 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)* then we can probably ignore it. */ if (before (ack, prior_snd_una)) { +u32 max_window; + +/* do not accept ACK for bytes we never sent. */ + max_window =min_t (u64, tp->max_window, tp->bytes_acked);/* RFC 5961 5.2 [Blind Data Injection Attack].[Mitigation] */ -if (before (ack, prior_snd_una - tp->max_window)) { +if (before (ack, prior_snd_una - max_window)) {if (!(flag &FLAG_NO_CHALLENGE_ACK ))tcp_send_challenge_ack (sk);return -SKB_DROP_REASON_TCP_TOO_OLD_ACK ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 59/194 bpf: sockmap, updating the sg structure should also update curr
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Fastabend <[email protected]>
[ Upstream commit bb9aefde5bbaf6c168c77ba635c155b4980c2287 ]
Curr pointer should be updated when the sg structure is shifted.
--- net/core/filter.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+)
net/core/filter.c +19 -0
@@ -2582,6 +2582,22 @@ BPF_CALL_2(bpf_msg_cork_bytes, struct sk_msg *, msg, u32, bytes)return 0 ; } +static void sk_msg_reset_curr (struct sk_msg *msg) +{ +u32 i = msg->sg.start; +u32 len =0 ; + +do { + len +=sk_msg_elem (msg, i)->length; +sk_msg_iter_var_next (i); +if (len >= msg->sg.size) +break ; + }while (i != msg->sg.end); + + msg->sg.curr = i; + msg->sg.copybreak =0 ; +} +static const struct bpf_func_proto bpf_msg_cork_bytes_proto = { .func = bpf_msg_cork_bytes, .gpl_only = false,
@@ -2701,6 +2717,7 @@ BPF_CALL_4(bpf_msg_pull_data, struct sk_msg *, msg, u32, start, msg->sg.end - shift + NR_MSG_FRAG_IDS : msg->sg.end - shift; out: +sk_msg_reset_curr (msg); msg->data =sg_virt (&msg->sg.data[first_sge]) + start - offset; msg->data_end = msg->data + bytes;return 0 ;
@@ -2837,6 +2854,7 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_msg *, msg, u32, start, msg->sg.data[new] = rsge; } +sk_msg_reset_curr (msg);sk_msg_compute_data_pointers (msg);return 0 ; }
@@ -3005,6 +3023,7 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start,sk_mem_uncharge (msg->sk, len - pop); msg->sg.size -= (len - pop); +sk_msg_reset_curr (msg);sk_msg_compute_data_pointers (msg);return 0 ; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 60/194 psample: Require CAP_NET_ADMIN when joining "packets" group
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 44ec98ea5ea9cfecd31a5c4cc124703cb5442832 ]
The "psample" generic netlink family notifies sampled packets over the "packets" multicast group. This is problematic since by default generic netlink allows non-root users to listen to these notifications.
Fix by marking the group with the 'GENL_UNS_ADMIN_PERM' flag. This will prevent non-root users or root without the 'CAP_NET_ADMIN' capability (in the user namespace owning the network namespace) from joining the group.
Tested using [1].
Before:
# capsh -- -c ./psample_repo # capsh --drop=cap_net_admin -- -c ./psample_repo
After:
# capsh -- -c ./psample_repo # capsh --drop=cap_net_admin -- -c ./psample_repo Failed to join "packets" multicast group
[1]
$ cat psample.c #include <stdio.h> #include <netlink/genl/ctrl.h> #include <netlink/genl/genl.h> #include <netlink/socket.h>
int join_grp(struct nl_sock *sk, const char *grp_name) {
int grp, err;
grp = genl_ctrl_resolve_grp(sk, "psample", grp_name);
if (grp < 0) {
fprintf(stderr, "Failed to resolve \"%s\" multicast group\n",
grp_name);
return grp;
}
err = nl_socket_add_memberships(sk, grp, NFNLGRP_NONE); if (err) {
fprintf(stderr, "Failed to join \"%s\" multicast group\n",
grp_name);
return err;
}
return 0;
}
int main(int argc, char **argv)
{
struct nl_sock *sk;
int err;
sk = nl_socket_alloc();
if (!sk) {
fprintf(stderr, "Failed to allocate socket\n"); return -1;
}
err = genl_connect(sk);
if (err) {
fprintf(stderr, "Failed to connect socket\n"); return err;
}
err = join_grp(sk, "config");
if (err)
return err;
err = join_grp(sk, "packets");
if (err)
return err;
return 0;
}
$ gcc -I/usr/include/libnl3 -lnl-3 -lnl-genl-3 -o psample_repo psample.c
--- net/psample/psample.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/psample/psample.c +2 -1
@@ -31,7 +31,8 @@ enum psample_nl_multicast_groups {static const struct genl_multicast_group psample_nl_mcgrps[] = { [PSAMPLE_NL_MCGRP_CONFIG ] = { .name =PSAMPLE_NL_MCGRP_CONFIG_NAME }, - [PSAMPLE_NL_MCGRP_SAMPLE ] = { .name =PSAMPLE_NL_MCGRP_SAMPLE_NAME }, + [PSAMPLE_NL_MCGRP_SAMPLE ] = { .name =PSAMPLE_NL_MCGRP_SAMPLE_NAME , + .flags =GENL_UNS_ADMIN_PERM }, };static struct genl_family psample_nl_family__ro_after_init ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 61/194 drop_monitor: Require CAP_SYS_ADMIN when joining "events" group
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit e03781879a0d524ce3126678d50a80484a513c4b ]
The "NET_DM" generic netlink family notifies drop locations over the "events" multicast group. This is problematic since by default generic netlink allows non-root users to listen to these notifications.
Fix by adding a new field to the generic netlink multicast group structure that when set prevents non-root users or root without the 'CAP_SYS_ADMIN' capability (in the user namespace owning the network namespace) from joining the group. Set this field for the "events" group. Use 'CAP_SYS_ADMIN' rather than 'CAP_NET_ADMIN' because of the nature of the information that is shared over this group.
Note that the capability check in this case will always be performed against the initial user namespace since the family is not netns aware and only operates in the initial network namespace.
A new field is added to the structure rather than using the "flags" field because the existing field uses uAPI flags and it is inappropriate to add a new uAPI flag for an internal kernel check. In net-next we can rework the "flags" field to use internal flags and fold the new field into it. But for now, in order to reduce the amount of changes, add a new field.
Since the information can only be consumed by root, mark the control plane operations that start and stop the tracing as root-only using the 'GENL_ADMIN_PERM' flag.
Tested using [1].
Before:
# capsh -- -c ./dm_repo # capsh --drop=cap_sys_admin -- -c ./dm_repo
After:
# capsh -- -c ./dm_repo # capsh --drop=cap_sys_admin -- -c ./dm_repo Failed to join "events" multicast group
[1]
$ cat dm.c #include <stdio.h> #include <netlink/genl/ctrl.h> #include <netlink/genl/genl.h> #include <netlink/socket.h>
int main(int argc, char **argv)
{
struct nl_sock *sk;
int grp, err;
sk = nl_socket_alloc();
if (!sk) {
fprintf(stderr, "Failed to allocate socket\n"); return -1;
}
err = genl_connect(sk);
if (err) {
fprintf(stderr, "Failed to connect socket\n"); return err;
}
grp = genl_ctrl_resolve_grp(sk, "NET_DM", "events"); if (grp < 0) {
fprintf(stderr,
"Failed to resolve \"events\" multicast group\n");
return grp;
}
err = nl_socket_add_memberships(sk, grp, NFNLGRP_NONE);
if (err) {
fprintf(stderr, "Failed to join \"events\" multicast group\n"); return err;
}
return 0;
}
$ gcc -I/usr/include/libnl3 -lnl-3 -lnl-genl-3 -o dm_repo dm.c
--- include/net/genetlink.h | 2 ++ net/core/drop_monitor.c | 4 +++- net/netlink/genetlink.c | 3 +++ 3 files changed, 8 insertions(+), 1 deletion(-)
include/net/genetlink.h +2 -0
@@ -12,10 +12,12 @@* struct genl_multicast_group - generic netlink multicast group * @name: name of the multicast group, names are per-family * @flags: GENL_* flags (%GENL_ADMIN_PERM or %GENL_UNS_ADMIN_PERM) +* @cap_sys_admin: whether %CAP_SYS_ADMIN is required for binding */ struct genl_multicast_group {char name[GENL_NAMSIZ ];u8 flags; +u8 cap_sys_admin:1 ; };struct genl_ops ;
net/core/drop_monitor.c +3 -1
@@ -181,7 +181,7 @@ static struct sk_buff *reset_per_cpu_data(struct per_cpu_dm_data *data) }static const struct genl_multicast_group dropmon_mcgrps[] = { - { .name ="events" , }, + { .name ="events" , .cap_sys_admin =1 }, };static void send_dm_alert (struct work_struct *work)
@@ -1604,11 +1604,13 @@ static const struct genl_small_ops dropmon_ops[] = { .cmd = NET_DM_CMD_START, .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, .doit = net_dm_cmd_trace, + .flags = GENL_ADMIN_PERM, }, { .cmd = NET_DM_CMD_STOP, .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, .doit = net_dm_cmd_trace, + .flags = GENL_ADMIN_PERM, }, { .cmd = NET_DM_CMD_CONFIG_GET,
net/netlink/genetlink.c +3 -0
@@ -1438,6 +1438,9 @@ static int genl_bind(struct net *net, int group)if ((grp->flags &GENL_UNS_ADMIN_PERM ) && !ns_capable (net->user_ns,CAP_NET_ADMIN )) ret = -EPERM ; +if (grp->cap_sys_admin && + !ns_capable (net->user_ns,CAP_SYS_ADMIN )) + ret = -EPERM ;break ; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 62/194 mm/damon/sysfs: eliminate potential uninitialized variable warning
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 85c2ceaafbd306814a3a4740bf4d95ac26a8b36a ]
The "err" variable is not initialized if damon_target_has_pid(ctx) is false and sys_target->regions->nr is zero.
--- mm/damon/sysfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/damon/sysfs.c +1 -1
@@ -2210,7 +2210,7 @@ static int damon_sysfs_update_target(struct damon_target *target,struct damon_ctx *ctx, struct damon_sysfs_target *sys_target) { - int err; + int err = 0;if (damon_target_has_pid (ctx)) { err =damon_sysfs_update_target_pid (target, sys_target->pid);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 63/194 tee: optee: Fix supplicant based device enumeration
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sumit Garg <[email protected]>
[ Upstream commit 7269cba53d906cf257c139d3b3a53ad272176bca ]
Currently supplicant dependent optee device enumeration only registers devices whenever tee-supplicant is invoked for the first time. But it forgets to remove devices when tee-supplicant daemon stops running and closes its context gracefully. This leads to following error for fTPM driver during reboot/shutdown:
[ 73.466791] tpm tpm0: ftpm_tee_tpm_op_send: SUBMIT_COMMAND invoke error: 0xffff3024
Fix this by adding an attribute for supplicant dependent devices so that the user-space service can detect and detach supplicant devices before closing the supplicant:
$ for dev in /sys/bus/tee/devices/*; do if [[ -f "$dev/need_supplicant" && -f "$dev/driver/unbind" ]]; \
then echo $(basename "$dev") > $dev/driver/unbind; fi done--- .../ABI/testing/sysfs-bus-optee-devices | 9 +++++++++ drivers/tee/optee/device.c | 17 +++++++++++++++-- 2 files changed, 24 insertions(+), 2 deletions(-)
Documentation/ABI/testing/sysfs-bus-optee-devices +9 -0
@@ -6,3 +6,12 @@ Description: OP-TEE bus provides reference to registered drivers under this directory. The <uuid> matches Trusted Application (TA) driver and corresponding TA in secure OS. Drivers are free to create needed API under optee-ta-<uuid> directory. + +What: /sys/bus/tee/devices/optee-ta-<uuid>/need_supplicant +Date: November 2023 +KernelVersion: 6.7 +Contact: [email protected] +Description: + Allows to distinguish whether an OP-TEE based TA/device requires user-space + tee-supplicant to function properly or not. This attribute will be present for + devices which depend on tee-supplicant to be running.
drivers/tee/optee/device.c +15 -2
@@ -60,7 +60,16 @@ static void optee_release_device(struct device *dev)kfree (optee_device); } -static int optee_register_device (const uuid_t *device_uuid) +static ssize_t need_supplicant_show (struct device *dev, +struct device_attribute *attr, +char *buf) +{ +return 0 ; +} + +static DEVICE_ATTR_RO (need_supplicant); + +static int optee_register_device (const uuid_t *device_uuid,u32 func) {struct tee_client_device *optee_device =NULL ;int rc;
@@ -83,6 +92,10 @@ static int optee_register_device(const uuid_t *device_uuid)put_device (&optee_device->dev); } +if (func ==PTA_CMD_GET_DEVICES_SUPP ) +device_create_file (&optee_device->dev, + &dev_attr_need_supplicant); +return rc; }
@@ -142,7 +155,7 @@ static int __optee_enumerate_devices(u32 func) num_devices = shm_size /sizeof (uuid_t);for (idx =0 ; idx < num_devices; idx++) { - rc =optee_register_device (&device_uuid[idx]); + rc =optee_register_device (&device_uuid[idx], func);if (rc) goto out_shm; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 64/194 RDMA/hns: Fix unnecessary err return when using invalid congest control algorithm
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junxian Huang <[email protected]>
[ Upstream commit efb9cbf66440482ceaa90493d648226ab7ec2ebf ]
Add a default congest control algorithm so that driver won't return an error when the configured algorithm is invalid.
--- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/infiniband/hw/hns/hns_roce_hw_v2.c +9 -4
@@ -4913,10 +4913,15 @@ static int check_cong_type(struct ib_qp *ibqp, cong_alg->wnd_mode_sel =WND_LIMIT ;break ;default : -ibdev_err (&hr_dev->ib_dev, -"error type(%u) for congestion selection.\n" , - hr_dev->caps.cong_type); -return -EINVAL ; +ibdev_warn (&hr_dev->ib_dev, +"invalid type(%u) for congestion selection.\n" , + hr_dev->caps.cong_type); + hr_dev->caps.cong_type =CONG_TYPE_DCQCN ; + cong_alg->alg_sel =CONG_DCQCN ; + cong_alg->alg_sub_sel =UNSUPPORT_CONG_LEVEL ; + cong_alg->dip_vld =DIP_INVALID ; + cong_alg->wnd_mode_sel =WND_LIMIT ; +break ; }return 0 ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 65/194 RDMA/irdma: Do not modify to SQD on error
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mustafa Ismail <[email protected]>
[ Upstream commit ba12ab66aa83a2340a51ad6e74b284269745138c ]
Remove the modify to SQD before going to ERROR state. It is not needed.
--- drivers/infiniband/hw/irdma/verbs.c | 7 ------- 1 file changed, 7 deletions(-)
drivers/infiniband/hw/irdma/verbs.c +0 -7
@@ -1363,13 +1363,6 @@ int irdma_modify_qp_roce(struct ib_qp *ibqp, struct ib_qp_attr *attr,case IB_QPS_SQE :case IB_QPS_ERR :case IB_QPS_RESET : -if (iwqp->iwarp_state ==IRDMA_QP_STATE_RTS ) { -spin_unlock_irqrestore (&iwqp->lock, flags); - info.next_iwarp_state =IRDMA_QP_STATE_SQD ; -irdma_hw_modify_qp (iwdev, iwqp, &info, true); -spin_lock_irqsave (&iwqp->lock, flags); - } -if (iwqp->iwarp_state ==IRDMA_QP_STATE_ERROR ) {spin_unlock_irqrestore (&iwqp->lock, flags);if (udata && udata->inlen) {
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 66/194 RDMA/irdma: Add wait for suspend on SQD
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mustafa Ismail <[email protected]>
[ Upstream commit bd6da690c27d75cae432c09162d054b34fa2156f ]
Currently, there is no wait for the QP suspend to complete on a modify to SQD state. Add a wait, after the modify to SQD state, for the Suspend Complete AE. While we are at it, update the suspend timeout value in irdma_prep_tc_change to use IRDMA_EVENT_TIMEOUT_MS too.
--- drivers/infiniband/hw/irdma/hw.c | 6 +++++- drivers/infiniband/hw/irdma/main.c | 2 +- drivers/infiniband/hw/irdma/main.h | 2 +- drivers/infiniband/hw/irdma/verbs.c | 21 +++++++++++++++++++++ drivers/infiniband/hw/irdma/verbs.h | 1 + 5 files changed, 29 insertions(+), 3 deletions(-)
drivers/infiniband/hw/irdma/hw.c +5 -1
@@ -322,7 +322,11 @@ static void irdma_process_aeq(struct irdma_pci_f *rf)break ;case IRDMA_AE_QP_SUSPEND_COMPLETE :if (iwqp->iwdev->vsi.tc_change_pending) { -atomic_dec (&iwqp->sc_qp.vsi->qp_suspend_reqs); +if (!atomic_dec_return (&qp->vsi->qp_suspend_reqs)) +wake_up (&iwqp->iwdev->suspend_wq); + } +if (iwqp->suspend_pending) { + iwqp->suspend_pending = false;wake_up (&iwqp->iwdev->suspend_wq); }break ;
drivers/infiniband/hw/irdma/main.c +1 -1
@@ -48,7 +48,7 @@ static void irdma_prep_tc_change(struct irdma_device *iwdev)/* Wait for all qp's to suspend */ wait_event_timeout (iwdev->suspend_wq, !atomic_read (&iwdev->vsi.qp_suspend_reqs), -IRDMA_EVENT_TIMEOUT ); +msecs_to_jiffies (IRDMA_EVENT_TIMEOUT_MS ));irdma_ws_reset (&iwdev->vsi); }
drivers/infiniband/hw/irdma/main.h +1 -1
@@ -78,7 +78,7 @@ extern struct auxiliary_driver i40iw_auxiliary_drv;#define MAX_DPC_ITERATIONS 128 -#define IRDMA_EVENT_TIMEOUT 50000 +#define IRDMA_EVENT_TIMEOUT_MS 5000#define IRDMA_VCHNL_EVENT_TIMEOUT 100000#define IRDMA_RST_TIMEOUT_HZ 4
drivers/infiniband/hw/irdma/verbs.c +21 -0
@@ -1098,6 +1098,21 @@ static int irdma_query_pkey(struct ib_device *ibdev, u32 port, u16 index,return 0 ; } +static int irdma_wait_for_suspend (struct irdma_qp *iwqp) +{ +if (!wait_event_timeout (iwqp->iwdev->suspend_wq, + !iwqp->suspend_pending, +msecs_to_jiffies (IRDMA_EVENT_TIMEOUT_MS ))) { + iwqp->suspend_pending = false; +ibdev_warn (&iwqp->iwdev->ibdev, +"modify_qp timed out waiting for suspend. qp_id = %d, last_ae = 0x%x\n" , + iwqp->ibqp.qp_num, iwqp->last_aeq); +return -EBUSY ; + } + +return 0 ; +} +/** * irdma_modify_qp_roce - modify qp request * @ibqp: qp's pointer for modify
@@ -1359,6 +1374,7 @@ int irdma_modify_qp_roce(struct ib_qp *ibqp, struct ib_qp_attr *attr, info.next_iwarp_state =IRDMA_QP_STATE_SQD ; issue_modify_qp =1 ; + iwqp->suspend_pending = true;break ;case IB_QPS_SQE :case IB_QPS_ERR :
@@ -1399,6 +1415,11 @@ int irdma_modify_qp_roce(struct ib_qp *ibqp, struct ib_qp_attr *attr, ctx_info->rem_endpoint_idx = udp_info->arp_idx;if (irdma_hw_modify_qp (iwdev, iwqp, &info, true))return -EINVAL ; +if (info.next_iwarp_state ==IRDMA_QP_STATE_SQD ) { + ret =irdma_wait_for_suspend (iwqp); +if (ret) +return ret; + }spin_lock_irqsave (&iwqp->lock, flags);if (iwqp->iwarp_state == info.curr_iwarp_state) { iwqp->iwarp_state = info.next_iwarp_state;
drivers/infiniband/hw/irdma/verbs.h +1 -0
@@ -193,6 +193,7 @@ struct irdma_qp { u8 flush_issued : 1; u8 sig_all : 1; u8 pau_mode : 1; + u8 suspend_pending : 1; u8 rsvd : 1;u8 iwarp_state;u16 term_sq_flush_code;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 67/194 arm64: dts: rockchip: Expand reg size of vdec node for RK3328
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Karlman <[email protected]>
[ Upstream commit 0b6240d697a96eaa45a2a5503a274ebb4f162fa3 ]
Expand the reg size for the vdec node to include cache/performance registers the rkvdec driver writes to.
--- arch/arm64/boot/dts/rockchip/rk3328.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/rockchip/rk3328.dtsi +1 -1
@@ -666,7 +666,7 @@ vdec: video-codec@ff360000 { compatible = "rockchip,rk3328-vdec", "rockchip,rk3399-vdec"; - reg = <0x0 0xff360000 0x0 0x400>; + reg = <0x0 0xff360000 0x0 0x480>; interrupts = <GIC_SPI 7 IRQ_TYPE_LEVEL_HIGH>; clocks = <&cru ACLK_RKVDEC>, <&cru HCLK_RKVDEC>, <&cru SCLK_VDEC_CABAC>, <&cru SCLK_VDEC_CORE>;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 68/194 arm64: dts: rockchip: Expand reg size of vdec node for RK3399
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Bee <[email protected]>
[ Upstream commit 35938c18291b5da7422b2fac6dac0af11aa8d0d7 ]
Expand the reg size for the vdec node to include cache/performance registers the rkvdec driver writes to. Also add missing clocks to the related power-domain.
--- arch/arm64/boot/dts/rockchip/rk3399.dtsi | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/rockchip/rk3399.dtsi +4 -2
@@ -1062,7 +1062,9 @@ power-domain@RK3399_PD_VDU { reg = <RK3399_PD_VDU>; clocks = <&cru ACLK_VDU>, - <&cru HCLK_VDU>; + <&cru HCLK_VDU>, + <&cru SCLK_VDU_CA>, + <&cru SCLK_VDU_CORE>; pm_qos = <&qos_video_m1_r>, <&qos_video_m1_w>; #power-domain-cells = <0>;
@@ -1338,7 +1340,7 @@ vdec: video-codec@ff660000 { compatible = "rockchip,rk3399-vdec"; - reg = <0x0 0xff660000 0x0 0x400>; + reg = <0x0 0xff660000 0x0 0x480>; interrupts = <GIC_SPI 116 IRQ_TYPE_LEVEL_HIGH 0>; clocks = <&cru ACLK_VDU>, <&cru HCLK_VDU>, <&cru SCLK_VDU_CA>, <&cru SCLK_VDU_CORE>;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 69/194 ASoC: fsl_sai: Fix no frame sync clock issue on i.MX8MP
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shengjiu Wang <[email protected]>
[ Upstream commit 14e8442e0789598514f3c9de014950de9feda7a4 ]
On i.MX8MP, when the TERE and FSD_MSTR enabled before configuring the word width, there will be no frame sync clock issue, because old word width impact the generation of frame sync.
TERE enabled earlier only for i.MX8MP case for the hardware limitation, So need to disable FSD_MSTR before configuring word width, then enable FSD_MSTR bit for this specific case.
--- sound/soc/fsl/fsl_sai.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+)
sound/soc/fsl/fsl_sai.c +21 -0
@@ -674,6 +674,20 @@ static int fsl_sai_hw_params(struct snd_pcm_substream *substream,FSL_SAI_CR3_TRCE_MASK , FSL_SAI_CR3_TRCE((dl_cfg[dl_cfg_idx].mask[tx] & trce_mask))); +/* +* When the TERE and FSD_MSTR enabled before configuring the word width +* There will be no frame sync clock issue, because word width impact +* the generation of frame sync clock. +* +* TERE enabled earlier only for i.MX8MP case for the hardware limitation, +* We need to disable FSD_MSTR before configuring word width, then enable +* FSD_MSTR bit for this specific case. +*/ +if (sai->soc_data->mclk_with_tere && sai->mclk_direction_output && + !sai->is_consumer_mode) +regmap_update_bits (sai->regmap,FSL_SAI_xCR4 (tx, ofs), +FSL_SAI_CR4_FSD_MSTR ,0 ); + regmap_update_bits(sai->regmap, FSL_SAI_xCR4(tx, ofs), FSL_SAI_CR4_SYWD_MASK | FSL_SAI_CR4_FRSZ_MASK | FSL_SAI_CR4_CHMOD_MASK,
@@ -681,6 +695,13 @@ static int fsl_sai_hw_params(struct snd_pcm_substream *substream,regmap_update_bits (sai->regmap,FSL_SAI_xCR5 (tx, ofs),FSL_SAI_CR5_WNW_MASK |FSL_SAI_CR5_W0W_MASK |FSL_SAI_CR5_FBT_MASK , val_cr5); + +/* Enable FSD_MSTR after configuring word width */ +if (sai->soc_data->mclk_with_tere && sai->mclk_direction_output && + !sai->is_consumer_mode) +regmap_update_bits (sai->regmap,FSL_SAI_xCR4 (tx, ofs), +FSL_SAI_CR4_FSD_MSTR ,FSL_SAI_CR4_FSD_MSTR ); +regmap_write (sai->regmap,FSL_SAI_xMR (tx), ~0UL - ((1 <<min (channels, slots)) -1 ));
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 70/194 RDMA/rtrs-srv: Do not unconditionally enable irq
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jack Wang <[email protected]>
[ Upstream commit 3ee7ecd712048ade6482bea4b2f3dcaf039c0348 ]
When IO is completed, rtrs can be called in softirq context, unconditionally enabling irq could cause panic.
To be on safe side, use spin_lock_irqsave and spin_unlock_irqrestore instread.
--- drivers/infiniband/ulp/rtrs/rtrs-srv.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/infiniband/ulp/rtrs/rtrs-srv.c +3 -2
@@ -63,8 +63,9 @@ static bool rtrs_srv_change_state(struct rtrs_srv_path *srv_path, {enum rtrs_srv_state old_state;bool changed = false; +unsigned long flags; -spin_lock_irq (&srv_path->state_lock); +spin_lock_irqsave (&srv_path->state_lock, flags); old_state = srv_path->state;switch (new_state) {case RTRS_SRV_CONNECTED :
@@ -85,7 +86,7 @@ static bool rtrs_srv_change_state(struct rtrs_srv_path *srv_path, }if (changed) srv_path->state = new_state; -spin_unlock_irq (&srv_path->state_lock); +spin_unlock_irqrestore (&srv_path->state_lock, flags);return changed; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 71/194 RDMA/rtrs-clt: Start hb after path_up
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jack Wang <[email protected]>
[ Upstream commit 3e44a61b5db873612e20e7b7922468d7d1ac2d22 ]
If we start hb too early, it will confuse server side to close the session.
--- drivers/infiniband/ulp/rtrs/rtrs-clt.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/infiniband/ulp/rtrs/rtrs-clt.c +1 -2
@@ -2346,8 +2346,6 @@ static int init_conns(struct rtrs_clt_path *clt_path)if (err) goto destroy; -rtrs_start_hb (&clt_path->s); -return 0 ; destroy:
@@ -2621,6 +2619,7 @@ static int init_path(struct rtrs_clt_path *clt_path) goto out; }rtrs_clt_path_up (clt_path); +rtrs_start_hb (&clt_path->s); out:mutex_unlock (&clt_path->init_mutex);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 72/194 RDMA/rtrs-srv: Check return values while processing info request
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Md Haris Iqbal <[email protected]>
[ Upstream commit ed1e52aefa16f15dc2f04054a3baf11726a7460e ]
While processing info request, it could so happen that the srv_path goes to CLOSING state, cause of any of the error events from RDMA. That state change should be picked up while trying to change the state in process_info_req, by checking the return value. In case the state change call in process_info_req fails, we fail the processing.
We should also check the return value for rtrs_srv_path_up, since it sends a link event to the client above, and the client can fail for any reason.
--- drivers/infiniband/ulp/rtrs/rtrs-srv.c | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-)
drivers/infiniband/ulp/rtrs/rtrs-srv.c +18 -6
@@ -715,20 +715,23 @@ static void rtrs_srv_info_rsp_done(struct ib_cq *cq, struct ib_wc *wc)WARN_ON (wc->opcode !=IB_WC_SEND ); } -static void rtrs_srv_path_up (struct rtrs_srv_path *srv_path) +static int rtrs_srv_path_up (struct rtrs_srv_path *srv_path) {struct rtrs_srv_sess *srv = srv_path->srv;struct rtrs_srv_ctx *ctx = srv->ctx; -int up; +int up, ret =0 ;mutex_lock (&srv->paths_ev_mutex); up = ++srv->paths_up;if (up ==1 ) - ctx->ops.link_ev (srv,RTRS_SRV_LINK_EV_CONNECTED ,NULL ); + ret = ctx->ops.link_ev (srv,RTRS_SRV_LINK_EV_CONNECTED ,NULL );mutex_unlock (&srv->paths_ev_mutex);/* Mark session as established */ - srv_path->established = true; +if (!ret) + srv_path->established = true; + +return ret; }static void rtrs_srv_path_down (struct rtrs_srv_path *srv_path)
@@ -857,7 +860,12 @@ static int process_info_req(struct rtrs_srv_con *con, goto iu_free;kobject_get (&srv_path->kobj);get_device (&srv_path->srv->dev); -rtrs_srv_change_state (srv_path,RTRS_SRV_CONNECTED ); + err =rtrs_srv_change_state (srv_path,RTRS_SRV_CONNECTED ); +if (!err) { +rtrs_err (s,"rtrs_srv_change_state(), err: %d\n" , err); + goto iu_free; + } +rtrs_srv_start_hb (srv_path);/*
@@ -866,7 +874,11 @@ static int process_info_req(struct rtrs_srv_con *con,* all connections are successfully established. Thus, simply notify * listener with a proper event if we are the first path. */ -rtrs_srv_path_up (srv_path); + err =rtrs_srv_path_up (srv_path); +if (err) { +rtrs_err (s,"rtrs_srv_path_up(), err: %d\n" , err); + goto iu_free; + } ib_dma_sync_single_for_device(srv_path->s.dev->ib_dev, tx_iu->dma_addr,
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 73/194 RDMA/rtrs-srv: Free srv_mr iu only when always_invalidate is true
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Md Haris Iqbal <[email protected]>
[ Upstream commit 3a71cd6ca0ce33d1af019ecf1d7167406fa54400 ]
Since srv_mr->iu is allocated and used only when always_invalidate is true, free it only when always_invalidate is true.
--- drivers/infiniband/ulp/rtrs/rtrs-srv.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/infiniband/ulp/rtrs/rtrs-srv.c +4 -1
@@ -549,7 +549,10 @@ static void unmap_cont_bufs(struct rtrs_srv_path *srv_path)struct rtrs_srv_mr *srv_mr; srv_mr = &srv_path->mrs[i]; -rtrs_iu_free (srv_mr->iu, srv_path->s.dev->ib_dev,1 ); + +if (always_invalidate) +rtrs_iu_free (srv_mr->iu, srv_path->s.dev->ib_dev,1 ); +ib_dereg_mr (srv_mr->mr);ib_dma_unmap_sg (srv_path->s.dev->ib_dev, srv_mr->sgt.sgl, srv_mr->sgt.nents,DMA_BIDIRECTIONAL );
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 74/194 RDMA/rtrs-srv: Destroy path files after making sure no IOs in-flight
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Md Haris Iqbal <[email protected]>
[ Upstream commit c4d32e77fc1006f99eeb78417efc3d81a384072a ]
Destroying path files may lead to the freeing of rdma_stats. This creates the following race.
An IO is in-flight, or has just passed the session state check in process_read/process_write. The close_work gets triggered and the function rtrs_srv_close_work() starts and does destroy path which frees the rdma_stats. After this the function process_read/process_write resumes and tries to update the stats through the function rtrs_srv_update_rdma_stats
This commit solves the problem by moving the destroy path function to a later point. This point makes sure any inflights are completed. This is done by qp drain, and waiting for all in-flights through ops_id.
--- drivers/infiniband/ulp/rtrs/rtrs-srv.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/infiniband/ulp/rtrs/rtrs-srv.c +2 -1
@@ -1537,7 +1537,6 @@ static void rtrs_srv_close_work(struct work_struct *work) srv_path =container_of (work,typeof (*srv_path), close_work); -rtrs_srv_destroy_path_files (srv_path);rtrs_srv_stop_hb (srv_path);for (i =0 ; i < srv_path->s.con_num; i++) {
@@ -1557,6 +1556,8 @@ static void rtrs_srv_close_work(struct work_struct *work)/* Wait for all completion */ wait_for_completion (&srv_path->complete_done); +rtrs_srv_destroy_path_files (srv_path); +/* Notify upper layer if we are the last path */ rtrs_srv_path_down (srv_path);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 75/194 RDMA/rtrs-clt: Fix the max_send_wr setting
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jack Wang <[email protected]>
[ Upstream commit 6d09f6f7d7584e099633282ea915988914f86529 ]
For each write request, we need Request, Response Memory Registration, Local Invalidate.
--- drivers/infiniband/ulp/rtrs/rtrs-clt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/ulp/rtrs/rtrs-clt.c +1 -1
@@ -1694,7 +1694,7 @@ static int create_con_cq_qp(struct rtrs_clt_con *con) clt_path->s.dev_ref++; max_send_wr =min_t (int, wr_limit,/* QD * (REQ + RSP + FR REGS or INVS) + drain */ - clt_path->queue_depth *3 +1 ); + clt_path->queue_depth *4 +1 ); max_recv_wr =min_t (int, wr_limit, clt_path->queue_depth *3 +1 ); max_send_sge =2 ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 76/194 RDMA/rtrs-clt: Remove the warnings for req in_use check
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jack Wang <[email protected]>
[ Upstream commit 0c8bb6eb70ca41031f663b4481aac9ac78b53bc6 ]
As we chain the WR during write request: memory registration, rdma write, local invalidate, if only the last WR fail to send due to send queue overrun, the server can send back the reply, while client mark the req->in_use to false in case of error in rtrs_clt_req when error out from rtrs_post_rdma_write_sg.
--- drivers/infiniband/ulp/rtrs/rtrs-clt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/ulp/rtrs/rtrs-clt.c +1 -1
@@ -382,7 +382,7 @@ static void complete_rdma_req(struct rtrs_clt_io_req *req, int errno,struct rtrs_clt_path *clt_path;int err; -if (WARN_ON (!req->in_use)) +if (!req->in_use)return ;if (WARN_ON (!req->con))return ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 77/194 RDMA/bnxt_re: Correct module description string
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kalesh AP <[email protected]>
[ Upstream commit 422b19f7f006e813ee0865aadce6a62b3c263c42 ]
The word "Driver" is repeated twice in the "modinfo bnxt_re" output description. Fix it.
--- drivers/infiniband/hw/bnxt_re/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/bnxt_re/main.c +1 -1
@@ -70,7 +70,7 @@ static char version[] =BNXT_RE_DESC "\n" ;MODULE_AUTHOR ("Eddie Wai <[email protected]>" ); -MODULE_DESCRIPTION (BNXT_RE_DESC " Driver" ); +MODULE_DESCRIPTION (BNXT_RE_DESC );MODULE_LICENSE ("Dual BSD/GPL" );/* globals */
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 78/194 RDMA/irdma: Refactor error handling in create CQP
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sindhu Devale <[email protected]>
[ Upstream commit 133b1cba46c6c8b67c630eacc0a1e4969da16517 ]
In case of a failure in irdma_create_cqp, do not call irdma_destroy_cqp, but cleanup all the allocated resources in reverse order.
Drop the extra argument in irdma_destroy_cqp as its no longer needed.
Stable-dep-of: 2b78832f50c4 ("RDMA/irdma: Fix UAF in irdma_sc_ccq_get_cqe_info()")
--- drivers/infiniband/hw/irdma/hw.c | 35 +++++++++++++++++++------------- 1 file changed, 21 insertions(+), 14 deletions(-)
drivers/infiniband/hw/irdma/hw.c +21 -14
@@ -572,7 +572,7 @@ static void irdma_destroy_irq(struct irdma_pci_f *rf,* Issue destroy cqp request and * free the resources associated with the cqp */ -static void irdma_destroy_cqp (struct irdma_pci_f *rf,bool free_hwcqp) +static void irdma_destroy_cqp (struct irdma_pci_f *rf) {struct irdma_sc_dev *dev = &rf->sc_dev;struct irdma_cqp *cqp = &rf->cqp;
@@ -580,8 +580,8 @@ static void irdma_destroy_cqp(struct irdma_pci_f *rf, bool free_hwcqp)if (rf->cqp_cmpl_wq)destroy_workqueue (rf->cqp_cmpl_wq); -if (free_hwcqp) - status =irdma_sc_cqp_destroy (dev->cqp); + + status =irdma_sc_cqp_destroy (dev->cqp);if (status)ibdev_dbg (to_ibdev (dev),"ERR: Destroy CQP failed %d\n" , status);
@@ -925,8 +925,8 @@ static int irdma_create_cqp(struct irdma_pci_f *rf) cqp->scratch_array =kcalloc (sqsize,sizeof (*cqp->scratch_array),GFP_KERNEL );if (!cqp->scratch_array) { -kfree (cqp->cqp_requests); -return -ENOMEM ; + status = -ENOMEM ; + goto err_scratch; } dev->cqp = &cqp->sc_cqp;
@@ -936,15 +936,14 @@ static int irdma_create_cqp(struct irdma_pci_f *rf) cqp->sq.va =dma_alloc_coherent (dev->hw->device, cqp->sq.size, &cqp->sq.pa,GFP_KERNEL );if (!cqp->sq.va) { -kfree (cqp->scratch_array); -kfree (cqp->cqp_requests); -return -ENOMEM ; + status = -ENOMEM ; + goto err_sq; } status =irdma_obj_aligned_mem (rf, &mem,sizeof (struct irdma_cqp_ctx ),IRDMA_HOST_CTX_ALIGNMENT_M );if (status) - goto exit; + goto err_ctx; dev->cqp->host_ctx_pa = mem.pa; dev->cqp->host_ctx = mem.va;
@@ -970,7 +969,7 @@ static int irdma_create_cqp(struct irdma_pci_f *rf) status =irdma_sc_cqp_init (dev->cqp, &cqp_init_info);if (status) {ibdev_dbg (to_ibdev (dev),"ERR: cqp init status %d\n" , status); - goto exit; + goto err_ctx; }spin_lock_init (&cqp->req_lock);
@@ -981,7 +980,7 @@ static int irdma_create_cqp(struct irdma_pci_f *rf)ibdev_dbg (to_ibdev (dev),"ERR: cqp create failed - status %d maj_err %d min_err %d\n" , status, maj_err, min_err); - goto exit; + goto err_ctx; }INIT_LIST_HEAD (&cqp->cqp_avail_reqs);
@@ -995,8 +994,16 @@ static int irdma_create_cqp(struct irdma_pci_f *rf)init_waitqueue_head (&cqp->remove_wq);return 0 ; -exit: -irdma_destroy_cqp (rf, false); +err_ctx: +dma_free_coherent (dev->hw->device, cqp->sq.size, + cqp->sq.va, cqp->sq.pa); + cqp->sq.va =NULL ; +err_sq: +kfree (cqp->scratch_array); + cqp->scratch_array =NULL ; +err_scratch: +kfree (cqp->cqp_requests); + cqp->cqp_requests =NULL ;return status; }
@@ -1744,7 +1751,7 @@ void irdma_ctrl_deinit_hw(struct irdma_pci_f *rf) rf->reset, rf->rdma_ver); fallthrough;case CQP_CREATED : -irdma_destroy_cqp (rf, true); +irdma_destroy_cqp (rf); fallthrough;case INITIAL_STATE :irdma_del_init_mem (rf);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 79/194 RDMA/irdma: Fix UAF in irdma_sc_ccq_get_cqe_info()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shifeng Li <[email protected]>
[ Upstream commit 2b78832f50c4d711e161b166d7d8790968051546 ]
When removing the irdma driver or unplugging its aux device, the ccq queue is released before destorying the cqp_cmpl_wq queue. But in the window, there may still be completion events for wqes. That will cause a UAF in irdma_sc_ccq_get_cqe_info().
[34693.333191] BUG: KASAN: use-after-free in irdma_sc_ccq_get_cqe_info+0x82f/0x8c0 [irdma] [34693.333194] Read of size 8 at addr ffff889097f80818 by task kworker/u67:1/26327 [34693.333194] [34693.333199] CPU: 9 PID: 26327 Comm: kworker/u67:1 Kdump: loaded Tainted: G O --------- -t - 4.18.0 #1 [34693.333200] Hardware name: SANGFOR Inspur/NULL, BIOS 4.1.13 08/01/2016 [34693.333211] Workqueue: cqp_cmpl_wq cqp_compl_worker [irdma] [34693.333213] Call Trace: [34693.333220] dump_stack+0x71/0xab [34693.333226] print_address_description+0x6b/0x290 [34693.333238] ? irdma_sc_ccq_get_cqe_info+0x82f/0x8c0 [irdma] [34693.333240] kasan_report+0x14a/0x2b0 [34693.333251] irdma_sc_ccq_get_cqe_info+0x82f/0x8c0 [irdma] [34693.333264] ? irdma_free_cqp_request+0x151/0x1e0 [irdma] [34693.333274] irdma_cqp_ce_handler+0x1fb/0x3b0 [irdma] [34693.333285] ? irdma_ctrl_init_hw+0x2c20/0x2c20 [irdma] [34693.333290] ? __schedule+0x836/0x1570 [34693.333293] ? strscpy+0x83/0x180 [34693.333296] process_one_work+0x56a/0x11f0 [34693.333298] worker_thread+0x8f/0xf40 [34693.333301] ? __kthread_parkme+0x78/0xf0 [34693.333303] ? rescuer_thread+0xc50/0xc50 [34693.333305] kthread+0x2a0/0x390 [34693.333308] ? kthread_destroy_worker+0x90/0x90 [34693.333310] ret_from_fork+0x1f/0x40
--- drivers/infiniband/hw/irdma/hw.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/infiniband/hw/irdma/hw.c +3 -3
@@ -578,9 +578,6 @@ static void irdma_destroy_cqp(struct irdma_pci_f *rf)struct irdma_cqp *cqp = &rf->cqp;int status =0 ; -if (rf->cqp_cmpl_wq) -destroy_workqueue (rf->cqp_cmpl_wq); - status =irdma_sc_cqp_destroy (dev->cqp);if (status)ibdev_dbg (to_ibdev (dev),"ERR: Destroy CQP failed %d\n" , status);
@@ -745,6 +742,9 @@ static void irdma_destroy_ccq(struct irdma_pci_f *rf)struct irdma_ccq *ccq = &rf->ccq;int status =0 ; +if (rf->cqp_cmpl_wq) +destroy_workqueue (rf->cqp_cmpl_wq); +if (!rf->reset) status =irdma_sc_ccq_destroy (dev->ccq,0 , true);if (status)
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 80/194 hwmon: (acpi_power_meter) Fix 4.29 MW bug
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <[email protected]>
[ Upstream commit 1fefca6c57fb928d2131ff365270cbf863d89c88 ]
The ACPI specification says:
"If an error occurs while obtaining the meter reading or if the value is not available then an Integer with all bits set is returned"
Since the "integer" is 32 bits in case of the ACPI power meter, userspace will get a power reading of 2^32 * 1000 miliwatts (~4.29 MW) in case of such an error. This was discovered due to a lm_sensors bugreport (https://github.com/lm-sensors/lm-sensors/issues/460).
Fix this by returning -ENODATA instead.
--- drivers/hwmon/acpi_power_meter.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/hwmon/acpi_power_meter.c +4 -0
@@ -31,6 +31,7 @@#define POWER_METER_CAN_NOTIFY (1 << 3)#define POWER_METER_IS_BATTERY (1 << 8)#define UNKNOWN_HYSTERESIS 0xFFFFFFFF +#define UNKNOWN_POWER 0xFFFFFFFF#define METER_NOTIFY_CONFIG 0x80#define METER_NOTIFY_TRIP 0x81
@@ -348,6 +349,9 @@ static ssize_t show_power(struct device *dev,update_meter (resource);mutex_unlock (&resource->lock); +if (resource->power ==UNKNOWN_POWER ) +return -ENODATA ; +return sprintf (buf,"%llu\n" , resource->power *1000 ); }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 81/194 ASoC: codecs: lpass-tx-macro: set active_decimator correct default value
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neil Armstrong <[email protected]>
[ Upstream commit a2f35ed1d237c459100adb0c39bb811d7f170977 ]
The -1 value for active_decimator[dai_id] is considered as "not set", but at probe the table is initialized a 0, this prevents enabling the DEC0 Mixer since it will be considered as already set.
Initialize the table entries as -1 to fix tx_macro_tx_mixer_put().
--- sound/soc/codecs/lpass-tx-macro.c | 5 +++++ 1 file changed, 5 insertions(+)
sound/soc/codecs/lpass-tx-macro.c +5 -0
@@ -1871,6 +1871,11 @@ static int tx_macro_probe(struct platform_device *pdev) tx->dev = dev; +/* Set active_decimator default value */ + tx->active_decimator[TX_MACRO_AIF1_CAP ] =-1 ; + tx->active_decimator[TX_MACRO_AIF2_CAP ] =-1 ; + tx->active_decimator[TX_MACRO_AIF3_CAP ] =-1 ; +/* set MCLK and NPL rates */ clk_set_rate (tx->mclk,MCLK_FREQ );clk_set_rate (tx->npl,MCLK_FREQ );
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 82/194 hwmon: (nzxt-kraken2) Fix error handling path in kraken2_probe()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 35fe2ad259a3bfca15ab78c8ffb5278cb6149c89 ]
There is no point in calling hid_hw_stop() if hid_hw_start() has failed. There is no point in calling hid_hw_close() if hid_hw_open() has failed.
Update the error handling path accordingly.
--- drivers/hwmon/nzxt-kraken2.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/hwmon/nzxt-kraken2.c +2 -2
@@ -161,13 +161,13 @@ static int kraken2_probe(struct hid_device *hdev, ret =hid_hw_start (hdev,HID_CONNECT_HIDRAW );if (ret) {hid_err (hdev,"hid hw start failed with %d\n" , ret); - goto fail_and_stop; +return ret; } ret =hid_hw_open (hdev);if (ret) {hid_err (hdev,"hid hw open failed with %d\n" , ret); - goto fail_and_close; + goto fail_and_stop; } priv->hwmon_dev = hwmon_device_register_with_info(&hdev->dev, "kraken2",
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 83/194 ASoC: wm_adsp: fix memleak in wm_adsp_buffer_populate
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dinghao Liu <[email protected]>
[ Upstream commit 29046a78a3c0a1f8fa0427f164caa222f003cf5b ]
When wm_adsp_buffer_read() fails, we should free buf->regions. Otherwise, the callers of wm_adsp_buffer_populate() will directly free buf on failure, which makes buf->regions a leaked memory.
--- sound/soc/codecs/wm_adsp.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
sound/soc/codecs/wm_adsp.c +6 -2
@@ -1401,12 +1401,12 @@ static int wm_adsp_buffer_populate(struct wm_adsp_compr_buf *buf) ret =wm_adsp_buffer_read (buf, caps->region_defs[i].base_offset, ®ion->base_addr);if (ret <0 ) -return ret; + goto err; ret =wm_adsp_buffer_read (buf, caps->region_defs[i].size_offset, &offset);if (ret <0 ) -return ret; + goto err; region->cumulative_size = offset;
@@ -1417,6 +1417,10 @@ static int wm_adsp_buffer_populate(struct wm_adsp_compr_buf *buf) }return 0 ; + +err: +kfree (buf->regions); +return ret; }static void wm_adsp_buffer_clear (struct wm_adsp_compr_buf *buf)
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 84/194 RDMA/core: Fix umem iterator when PAGE_SIZE is greater then HCA pgsz
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Marciniszyn <[email protected]>
[ Upstream commit 4fbc3a52cd4d14de3793f4b2c721d7306ea84cf9 ]
64k pages introduce the situation in this diagram when the HCA 4k page size is being used:
+-------------------------------------------+ <--- 64k aligned VA | | | HCA 4k page | | | +-------------------------------------------+ | o | | | | o | | | | o | +-------------------------------------------+ | | | HCA 4k page | | | +-------------------------------------------+ <--- Live HCA page |OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO| <--- offset | | <--- VA | MR data | +-------------------------------------------+ | | | HCA 4k page | | | +-------------------------------------------+ | o | | | | o | | | | o | +-------------------------------------------+ | | | HCA 4k page | | | +-------------------------------------------+
The VA addresses are coming from rdma-core in this diagram can be arbitrary, but for 64k pages, the VA may be offset by some number of HCA 4k pages and followed by some number of HCA 4k pages.
The current iterator doesn't account for either the preceding 4k pages or the following 4k pages.
Fix the issue by extending the ib_block_iter to contain the number of DMA pages like comment [1] says and by using __sg_advance to start the iterator at the first live HCA page.
The changes are contained in a parallel set of iterator start and next functions that are umem aware and specific to umem since there is one user of the rdma_for_each_block() without umem.
These two fixes prevents the extra pages before and after the user MR data.
Fix the preceding pages by using the __sq_advance field to start at the first 4k page containing MR data.
Fix the following pages by saving the number of pgsz blocks in the iterator state and downcounting on each next.
This fix allows for the elimination of the small page crutch noted in the Fixes.
--- drivers/infiniband/core/umem.c | 6 ------ include/rdma/ib_umem.h | 9 ++++++++- include/rdma/ib_verbs.h | 1 + 3 files changed, 9 insertions(+), 7 deletions(-)
drivers/infiniband/core/umem.c +0 -6
@@ -96,12 +96,6 @@ unsigned long ib_umem_find_best_pgsz(struct ib_umem *umem,return page_size; } -/* rdma_for_each_block() has a bug if the page size is smaller than the -* page size used to build the umem. For now prevent smaller page sizes -* from being returned. -*/ - pgsz_bitmap &=GENMASK (BITS_PER_LONG -1 ,PAGE_SHIFT ); -/* The best result is the smallest page size that results in the minimum * number of required pages. Compute the largest page size that could * work based on VA address bits that don't change.
include/rdma/ib_umem.h +8 -1
@@ -78,6 +78,13 @@ static inline void __rdma_umem_block_iter_start(struct ib_block_iter *biter, {__rdma_block_iter_start (biter, umem->sgt_append.sgt.sgl, umem->sgt_append.sgt.nents, pgsz); + biter->__sg_advance =ib_umem_offset (umem) & ~(pgsz -1 ); + biter->__sg_numblocks =ib_umem_num_dma_blocks (umem, pgsz); +} + +static inline bool __rdma_umem_block_iter_next (struct ib_block_iter *biter) +{ +return __rdma_block_iter_next (biter) && biter->__sg_numblocks--; }/**
@@ -93,7 +100,7 @@ static inline void __rdma_umem_block_iter_start(struct ib_block_iter *biter,*/ #define rdma_umem_for_each_dma_block (umem, biter, pgsz) \ for (__rdma_umem_block_iter_start(biter, umem, pgsz); \ - __rdma_block_iter_next(biter);) + __rdma_umem_block_iter_next(biter);)#ifdef CONFIG_INFINIBAND_USER_MEM
include/rdma/ib_verbs.h +1 -0
@@ -2835,6 +2835,7 @@ struct ib_block_iter {/* internal states */ struct scatterlist *__sg;/* sg holding the current aligned block */ dma_addr_t __dma_addr;/* unaligned DMA address of this block */ +size_t __sg_numblocks;/* ib_umem_num_dma_blocks() */ unsigned int __sg_nents;/* number of SG entries */ unsigned int __sg_advance;/* number of bytes to advance in sg in next step */ unsigned int __pg_bit;/* alignment of current block */
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 85/194 RDMA/irdma: Avoid free the non-cqp_request scratch
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shifeng Li <[email protected]>
[ Upstream commit e3e82fcb79eeb3f1a88a89f676831773caff514a ]
When creating ceq_0 during probing irdma, cqp.sc_cqp will be sent as a cqp_request to cqp->sc_cqp.sq_ring. If the request is pending when removing the irdma driver or unplugging its aux device, cqp.sc_cqp will be dereferenced as wrong struct in irdma_free_pending_cqp_request().
PID: 3669 TASK: ffff88aef892c000 CPU: 28 COMMAND: "kworker/28:0"
#0 [fffffe0000549e38] crash_nmi_callback at ffffffff810e3a34 #1 [fffffe0000549e40] nmi_handle at ffffffff810788b2 #2 [fffffe0000549ea0] default_do_nmi at ffffffff8107938f #3 [fffffe0000549eb8] do_nmi at ffffffff81079582 #4 [fffffe0000549ef0] end_repeat_nmi at ffffffff82e016b4
[exception RIP: native_queued_spin_lock_slowpath+1291]
RIP: ffffffff8127e72b RSP: ffff88aa841ef778 RFLAGS: 00000046
RAX: 0000000000000000 RBX: ffff88b01f849700 RCX: ffffffff8127e47e
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff83857ec0
RBP: ffff88afe3e4efc8 R8: ffffed15fc7c9dfa R9: ffffed15fc7c9dfa
R10: 0000000000000001 R11: ffffed15fc7c9df9 R12: 0000000000740000
R13: ffff88b01f849708 R14: 0000000000000003 R15: ffffed1603f092e1
ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0000 -- <NMI exception stack> --
#5 [ffff88aa841ef778] native_queued_spin_lock_slowpath at ffffffff8127e72b #6 [ffff88aa841ef7b0] _raw_spin_lock_irqsave at ffffffff82c22aa4
#7 [ffff88aa841ef7c8] __wake_up_common_lock at ffffffff81257363
#8 [ffff88aa841ef888] irdma_free_pending_cqp_request at ffffffffa0ba12cc [irdma] #9 [ffff88aa841ef958] irdma_cleanup_pending_cqp_op at ffffffffa0ba1469 [irdma] #10 [ffff88aa841ef9c0] irdma_ctrl_deinit_hw at ffffffffa0b2989f [irdma] #11 [ffff88aa841efa28] irdma_remove at ffffffffa0b252df [irdma]
#12 [ffff88aa841efae8] auxiliary_bus_remove at ffffffff8219afdb
#13 [ffff88aa841efb00] device_release_driver_internal at ffffffff821882e6 #14 [ffff88aa841efb38] bus_remove_device at ffffffff82184278
#15 [ffff88aa841efb88] device_del at ffffffff82179d23
#16 [ffff88aa841efc48] ice_unplug_aux_dev at ffffffffa0eb1c14 [ice] #17 [ffff88aa841efc68] ice_service_task at ffffffffa0d88201 [ice] #18 [ffff88aa841efde8] process_one_work at ffffffff811c589a
#19 [ffff88aa841efe60] worker_thread at ffffffff811c71ff
#20 [ffff88aa841eff10] kthread at ffffffff811d87a0
#21 [ffff88aa841eff50] ret_from_fork at ffffffff82e0022f
--- drivers/infiniband/hw/irdma/hw.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/infiniband/hw/irdma/hw.c +1 -3
@@ -1170,7 +1170,6 @@ static int irdma_create_ceq(struct irdma_pci_f *rf, struct irdma_ceq *iwceq,int status;struct irdma_ceq_init_info info = {};struct irdma_sc_dev *dev = &rf->sc_dev; -u64 scratch;u32 ceq_size; info.ceq_id = ceq_id;
@@ -1191,14 +1190,13 @@ static int irdma_create_ceq(struct irdma_pci_f *rf, struct irdma_ceq *iwceq, iwceq->sc_ceq.ceq_id = ceq_id; info.dev = dev; info.vsi = vsi; - scratch = (uintptr_t )&rf->cqp.sc_cqp; status =irdma_sc_ceq_init (&iwceq->sc_ceq, &info);if (!status) {if (dev->ceq_valid) status =irdma_cqp_ceq_cmd (&rf->sc_dev, &iwceq->sc_ceq,IRDMA_OP_CEQ_CREATE );else - status =irdma_sc_cceq_create (&iwceq->sc_ceq, scratch); + status =irdma_sc_cceq_create (&iwceq->sc_ceq,0 ); }if (status) {
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 86/194 drm/bridge: tc358768: select CONFIG_VIDEOMODE_HELPERS
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 26513300978f7285c3e776c144f27ef71be61f57 ]
A dependency on this feature was recently introduced:
x86_64-linux-ld: vmlinux.o: in function `tc358768_bridge_pre_enable':
tc358768.c:(.text+0xbe3dae): undefined reference to `drm_display_mode_to_videomode'
Make sure this is always enabled.
--- drivers/gpu/drm/bridge/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/bridge/Kconfig +1 -0
@@ -309,6 +309,7 @@ config DRM_TOSHIBA_TC358768 select REGMAP_I2C select DRM_PANEL select DRM_MIPI_DSI + select VIDEOMODE_HELPERS help Toshiba TC358768AXBG/TC358778XBG DSI bridge chip driver.
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 87/194 arm64: dts: imx8mq: drop usb3-resume-missing-cas from usb
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <[email protected]>
[ Upstream commit fcd3f50845be909c9e0f8ac402874a2fb4b09c6c ]
The property is NXP downstream property that there is no user in upstream, drop it.
Stable-dep-of: 209043cf092d ("arm64: dts: imx8mp: imx8mq: Add parkmode-disable-ss-quirk on DWC3")
--- arch/arm64/boot/dts/freescale/imx8mq.dtsi | 2 -- 1 file changed, 2 deletions(-)
arch/arm64/boot/dts/freescale/imx8mq.dtsi +0 -2
@@ -1431,7 +1431,6 @@ phys = <&usb3_phy0>, <&usb3_phy0>; phy-names = "usb2-phy", "usb3-phy"; power-domains = <&pgc_otg1>; - usb3-resume-missing-cas; status = "disabled"; };
@@ -1463,7 +1462,6 @@ phys = <&usb3_phy1>, <&usb3_phy1>; phy-names = "usb2-phy", "usb3-phy"; power-domains = <&pgc_otg2>; - usb3-resume-missing-cas; status = "disabled"; };
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 88/194 arm64: dts: imx8mp: imx8mq: Add parkmode-disable-ss-quirk on DWC3
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Rossi <[email protected]>
[ Upstream commit 209043cf092d7b0d4739921b3f11d6d0b451eabf ]
The i.MX8MP and i.MX8MQ devices both use the same DWC3 controller and are both affected by a known issue with the controller due to specific behaviour when park mode is enabled in SuperSpeed host mode operation.
Under heavy USB traffic from multiple endpoints the controller will sometimes incorrectly process transactions such that some transactions are lost, or the controller may hang when processing transactions. When the controller hangs it does not recover.
This issue is documented partially within the linux-imx vendor kernel which references a Synopsys STAR number 9001415732 in commits [1] and additional details in [2]. Those commits provide some additional controller internal implementation specifics around the incorrect behaviour of the SuperSpeed host controller operation when park mode is enabled.
The summary of this issue is that the host controller can incorrectly enter/exit park mode such that part of the controller is in a state which behaves as if in park mode even though it is not. In this state the controller incorrectly calculates the number of TRBs available which results in incorrect access of the internal caches causing the overwrite of pending requests in the cache which should have been processed but are ignored. This can cause the controller to drop the requests or hang waiting for the pending state of the dropped requests.
The workaround for this issue is to disable park mode for SuperSpeed operation of the controller through the GUCTL1[17] bit. This is already available as a quirk for the DWC3 controller and can be enabled via the 'snps,parkmode-disable-ss-quirk' device tree property.
It is possible to replicate this failure on an i.MX8MP EVK with a USB Hub connecting 4 SuperSpeed USB flash drives. Performing continuous small read operations (dd if=/dev/sd... of=/dev/null bs=16) on the block devices will result in device errors initially and will eventually result in the controller hanging.
[13240.896936] xhci-hcd xhci-hcd.0.auto: WARN Event TRB for slot 4 ep 2 with no TDs queued? [13240.990708] usb 2-1.3: reset SuperSpeed USB device number 5 using xhci-hcd [13241.015582] sd 2:0:0:0: [sdc] tag#0 UNKNOWN(0x2003) Result: hostbyte=0x07 driverbyte=DRIVER_OK cmd_age=0s [13241.025198] sd 2:0:0:0: [sdc] tag#0 CDB: opcode=0x28 28 00 00 00 03 e0 00 01 00 00 [13241.032949] I/O error, dev sdc, sector 992 op 0x0:(READ) flags 0x80700 phys_seg 25 prio class 2 [13272.150710] usb 2-1.2: reset SuperSpeed USB device number 4 using xhci-hcd [13272.175469] sd 1:0:0:0: [sdb] tag#0 UNKNOWN(0x2003) Result: hostbyte=0x03 driverbyte=DRIVER_OK cmd_age=31s [13272.185365] sd 1:0:0:0: [sdb] tag#0 CDB: opcode=0x28 28 00 00 00 03 e0 00 01 00 00 [13272.193385] I/O error, dev sdb, sector 992 op 0x0:(READ) flags 0x80700 phys_seg 18 prio class 2 [13434.846556] xhci-hcd xhci-hcd.0.auto: xHCI host not responding to stop endpoint command [13434.854592] xhci-hcd xhci-hcd.0.auto: xHCI host controller not responding, assume dead [13434.862553] xhci-hcd xhci-hcd.0.auto: HC died; cleaning up
[1] https://github.com/nxp-imx/linux-imx/commit/97a5349d936b08cf301730b59e4e8855283f815c
[2] https://github.com/nxp-imx/linux-imx/commit/b4b5cbc5a12d7c3b920d1d7cba0ada3379e4e42b
--- arch/arm64/boot/dts/freescale/imx8mp.dtsi | 2 ++ arch/arm64/boot/dts/freescale/imx8mq.dtsi | 2 ++ 2 files changed, 4 insertions(+)
arch/arm64/boot/dts/freescale/imx8mp.dtsi +2 -0
@@ -1301,6 +1301,7 @@ phys = <&usb3_phy0>, <&usb3_phy0>; phy-names = "usb2-phy", "usb3-phy"; snps,gfladj-refclk-lpm-sel-quirk; + snps,parkmode-disable-ss-quirk; }; };
@@ -1343,6 +1344,7 @@ phys = <&usb3_phy1>, <&usb3_phy1>; phy-names = "usb2-phy", "usb3-phy"; snps,gfladj-refclk-lpm-sel-quirk; + snps,parkmode-disable-ss-quirk; }; };
arch/arm64/boot/dts/freescale/imx8mq.dtsi +2 -0
@@ -1431,6 +1431,7 @@ phys = <&usb3_phy0>, <&usb3_phy0>; phy-names = "usb2-phy", "usb3-phy"; power-domains = <&pgc_otg1>; + snps,parkmode-disable-ss-quirk; status = "disabled"; };
@@ -1462,6 +1463,7 @@ phys = <&usb3_phy1>, <&usb3_phy1>; phy-names = "usb2-phy", "usb3-phy"; power-domains = <&pgc_otg2>; + snps,parkmode-disable-ss-quirk; status = "disabled"; };
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 89/194 ARM: dts: imx6ul-pico: Describe the Ethernet PHY clock
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <[email protected]>
[ Upstream commit d951f8f5f23a9417b7952f22b33784c73caa1ebb ]
Since commit c7e73b5051d6 ("ARM: imx: mach-imx6ul: remove 14x14 EVK specific PHY fixup")thet Ethernet PHY is no longer configured via code in board file.
This caused Ethernet to stop working.
Fix this problem by describing the clocks and clock-names to the Ethernet PHY node so that the KSZ8081 chip can be clocked correctly.
--- arch/arm/boot/dts/imx6ul-pico.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/arm/boot/dts/imx6ul-pico.dtsi +2 -0
@@ -121,6 +121,8 @@ max-speed = <100>; interrupt-parent = <&gpio5>; interrupts = <6 IRQ_TYPE_LEVEL_LOW>; + clocks = <&clks IMX6UL_CLK_ENET_REF>; + clock-names = "rmii-ref"; }; }; };
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 90/194 tracing: Fix a warning when allocating buffered events fails
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Pavlu <[email protected]>
[ Upstream commit 34209fe83ef8404353f91ab4ea4035dbc9922d04 ]
Function trace_buffered_event_disable() produces an unexpected warning when the previous call to trace_buffered_event_enable() fails to allocate pages for buffered events.
The situation can occur as follows:
* The counter trace_buffered_event_ref is at 0.
* The soft mode gets enabled for some event and trace_buffered_event_enable() is called. The function increments trace_buffered_event_ref to 1 and starts allocating event pages.
* The allocation fails for some page and trace_buffered_event_disable() is called for cleanup.
* Function trace_buffered_event_disable() decrements trace_buffered_event_ref back to 0, recognizes that it was the last use of buffered events and frees all allocated pages.
* The control goes back to trace_buffered_event_enable() which returns. The caller of trace_buffered_event_enable() has no information that the function actually failed.
* Some time later, the soft mode is disabled for the same event. Function trace_buffered_event_disable() is called. It warns on "WARN_ON_ONCE(!trace_buffered_event_ref)" and returns.
Buffered events are just an optimization and can handle failures. Make trace_buffered_event_enable() exit on the first failure and left any cleanup later to when trace_buffered_event_disable() is called.
--- kernel/trace/trace.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)
kernel/trace/trace.c +5 -6
@@ -2707,8 +2707,11 @@ void trace_buffered_event_enable(void)for_each_tracing_cpu (cpu) { page =alloc_pages_node (cpu_to_node (cpu),GFP_KERNEL | __GFP_NORETRY,0 ); -if (!page) - goto failed; +/* This is just an optimization and can handle failures */ +if (!page) { +pr_err ("Failed to allocate event buffer\n" ); +break ; + } event =page_address (page);memset (event,0 ,sizeof (*event));
@@ -2722,10 +2725,6 @@ void trace_buffered_event_enable(void)WARN_ON_ONCE (1 );preempt_enable (); } - -return ; - failed: -trace_buffered_event_disable (); }static void enable_trace_buffered_event (void *data)
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 91/194 scsi: be2iscsi: Fix a memleak in beiscsi_init_wrb_handle()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dinghao Liu <[email protected]>
[ Upstream commit 235f2b548d7f4ac5931d834f05d3f7f5166a2e72 ]
When an error occurs in the for loop of beiscsi_init_wrb_handle(), we should free phwi_ctxt->be_wrbq before returning an error code to prevent potential memleak.
--- drivers/scsi/be2iscsi/be_main.c | 1 + 1 file changed, 1 insertion(+)
drivers/scsi/be2iscsi/be_main.c +1 -0
@@ -2710,6 +2710,7 @@ static int beiscsi_init_wrb_handle(struct beiscsi_hba *phba)kfree (pwrb_context->pwrb_handle_base);kfree (pwrb_context->pwrb_handle_basestd); } +kfree (phwi_ctxt->be_wrbq);return -ENOMEM ; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 92/194 ARM: imx: Check return value of devm_kasprintf in imx_mmdc_perf_init
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kunwu Chan <[email protected]>
[ Upstream commit 1c2b1049af3f86545fcc5fae0fc725fb64b3a09e ]
devm_kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Ensure the allocation was successful by checking the pointer validity.
Release the id allocated in 'mmdc_pmu_init' when 'devm_kasprintf' return NULL
--- arch/arm/mach-imx/mmdc.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
arch/arm/mach-imx/mmdc.c +6 -1
@@ -502,6 +502,10 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b name =devm_kasprintf (&pdev->dev,GFP_KERNEL ,"mmdc%d" , ret); +if (!name) { + ret = -ENOMEM ; + goto pmu_release_id; + } pmu_mmdc->mmdc_ipg_clk = mmdc_ipg_clk; pmu_mmdc->devtype_data = (struct fsl_mmdc_devtype_data *)of_id->data;
@@ -524,9 +528,10 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b pmu_register_err:pr_warn ("MMDC Perf PMU failed (%d), disabled\n" , ret); -ida_simple_remove (&mmdc_ida, pmu_mmdc->id);cpuhp_state_remove_instance_nocalls (cpuhp_mmdc_state, &pmu_mmdc->node);hrtimer_cancel (&pmu_mmdc->hrtimer); +pmu_release_id: +ida_simple_remove (&mmdc_ida, pmu_mmdc->id); pmu_free:kfree (pmu_mmdc);return ret;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 93/194 ARM: dts: imx7: Declare timers compatible with fsl,imx6dl-gpt
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philipp Zabel <[email protected]>
[ Upstream commit 397caf68e2d36532054cb14ae8995537f27f8b61 ]
The timer nodes declare compatibility with "fsl,imx6sx-gpt", which itself is compatible with "fsl,imx6dl-gpt". Switch the fallback compatible from "fsl,imx6sx-gpt" to "fsl,imx6dl-gpt".
--- arch/arm/boot/dts/imx7s.dtsi | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/arm/boot/dts/imx7s.dtsi +4 -4
@@ -454,7 +454,7 @@ }; gpt1: timer@302d0000 { - compatible = "fsl,imx7d-gpt", "fsl,imx6sx-gpt"; + compatible = "fsl,imx7d-gpt", "fsl,imx6dl-gpt"; reg = <0x302d0000 0x10000>; interrupts = <GIC_SPI 55 IRQ_TYPE_LEVEL_HIGH>; clocks = <&clks IMX7D_GPT1_ROOT_CLK>,
@@ -463,7 +463,7 @@ }; gpt2: timer@302e0000 { - compatible = "fsl,imx7d-gpt", "fsl,imx6sx-gpt"; + compatible = "fsl,imx7d-gpt", "fsl,imx6dl-gpt"; reg = <0x302e0000 0x10000>; interrupts = <GIC_SPI 54 IRQ_TYPE_LEVEL_HIGH>; clocks = <&clks IMX7D_GPT2_ROOT_CLK>,
@@ -473,7 +473,7 @@ }; gpt3: timer@302f0000 { - compatible = "fsl,imx7d-gpt", "fsl,imx6sx-gpt"; + compatible = "fsl,imx7d-gpt", "fsl,imx6dl-gpt"; reg = <0x302f0000 0x10000>; interrupts = <GIC_SPI 53 IRQ_TYPE_LEVEL_HIGH>; clocks = <&clks IMX7D_GPT3_ROOT_CLK>,
@@ -483,7 +483,7 @@ }; gpt4: timer@30300000 { - compatible = "fsl,imx7d-gpt", "fsl,imx6sx-gpt"; + compatible = "fsl,imx7d-gpt", "fsl,imx6dl-gpt"; reg = <0x30300000 0x10000>; interrupts = <GIC_SPI 52 IRQ_TYPE_LEVEL_HIGH>; clocks = <&clks IMX7D_GPT4_ROOT_CLK>,
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 94/194 ARM: dts: imx28-xea: Pass the model property
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <[email protected]>
[ Upstream commit 63ef8fc9bcee6b73ca445a19a7ac6bd544723c9f ]
Per root-node.yaml, 'model' is a required property.
Pass it to fix the following dt-schema warning:
imx28-xea.dtb: /: 'model' is a required property
from schema $id: http://devicetree.org/schemas/root-node.yaml#
--- arch/arm/boot/dts/imx28-xea.dts | 1 + 1 file changed, 1 insertion(+)
arch/arm/boot/dts/imx28-xea.dts +1 -0
@@ -8,6 +8,7 @@ #include "imx28-lwe.dtsi" / { + model = "Liebherr XEA board"; compatible = "lwn,imx28-xea", "fsl,imx28"; };
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 95/194 riscv: fix misaligned access handling of C.SWSP and C.SDSP
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Clément Léger <[email protected]>
[ Upstream commit 22e0eb04837a63af111fae35a92f7577676b9bc8 ]
This is a backport of a fix that was done in OpenSBI: ec0559eb315b ("lib: sbi_misaligned_ldst: Fix handling of C.SWSP and C.SDSP").
Unlike C.LWSP/C.LDSP, these encodings can be used with the zero register, so checking that the rs2 field is non-zero is unnecessary.
Additionally, the previous check was incorrect since it was checking the immediate field of the instruction instead of the rs2 field.
--- arch/riscv/kernel/traps_misaligned.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
arch/riscv/kernel/traps_misaligned.c +2 -4
@@ -342,16 +342,14 @@ int handle_misaligned_store(struct pt_regs *regs) } else if ((insn & INSN_MASK_C_SD) == INSN_MATCH_C_SD) { len =8 ; val.data_ulong =GET_RS2S (insn, regs); - }else if ((insn &INSN_MASK_C_SDSP ) ==INSN_MATCH_C_SDSP && - ((insn >>SH_RD ) &0x1f )) { + }else if ((insn &INSN_MASK_C_SDSP ) ==INSN_MATCH_C_SDSP ) { len =8 ; val.data_ulong =GET_RS2C (insn, regs);#endif }else if ((insn &INSN_MASK_C_SW ) ==INSN_MATCH_C_SW ) { len =4 ; val.data_ulong =GET_RS2S (insn, regs); - }else if ((insn &INSN_MASK_C_SWSP ) ==INSN_MATCH_C_SWSP && - ((insn >>SH_RD ) &0x1f )) { + }else if ((insn &INSN_MASK_C_SWSP ) ==INSN_MATCH_C_SWSP ) { len =4 ; val.data_ulong =GET_RS2C (insn, regs); }else {
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 96/194 md: introduce md_ro_state
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ye Bin <[email protected]>
[ Upstream commit f97a5528b21eb175d90dce2df9960c8d08e1be82 ]
Introduce md_ro_state for mddev->ro, so it is easy to understand.
Stable-dep-of: c9f7cb5b2bc9 ("md: don't leave 'MD_RECOVERY_FROZEN' in error path of md_set_readonly()")
--- drivers/md/md.c | 152 ++++++++++++++++++++++++++---------------------- 1 file changed, 82 insertions(+), 70 deletions(-)
drivers/md/md.c +82 -70
@@ -93,6 +93,18 @@ static int remove_and_add_spares(struct mddev *mddev, struct md_rdev *this);static void mddev_detach (struct mddev *mddev); +enum md_ro_state { +MD_RDWR , +MD_RDONLY , +MD_AUTO_READ , +MD_MAX_STATE +}; + +static bool md_is_rdwr (struct mddev *mddev) +{ +return (mddev->ro ==MD_RDWR ); +} +/* * Default number of read corrections we'll attempt on an rdev * before ejecting it from the array. We divide the read error
@@ -444,7 +456,7 @@ static void md_submit_bio(struct bio *bio)if (!bio)return ; -if (mddev->ro ==1 &&unlikely (rw ==WRITE )) { +if (mddev->ro ==MD_RDONLY &&unlikely (rw ==WRITE )) {if (bio_sectors (bio) !=0 ) bio->bi_status =BLK_STS_IOERR ;bio_endio (bio);
@@ -2643,7 +2655,7 @@ void md_update_sb(struct mddev *mddev, int force_change)int any_badblocks_changed =0 ;int ret =-1 ; -if (mddev->ro) { +if (!md_is_rdwr (mddev)) {if (force_change)set_bit (MD_SB_CHANGE_DEVS , &mddev->sb_flags);return ;
@@ -3909,7 +3921,7 @@ level_store(struct mddev *mddev, const char *buf, size_t len) goto out_unlock; } rv = -EROFS ; -if (mddev->ro) +if (!md_is_rdwr (mddev)) goto out_unlock;/* request to change the personality. Need to ensure:
@@ -4115,7 +4127,7 @@ layout_store(struct mddev *mddev, const char *buf, size_t len)if (mddev->pers) {if (mddev->pers->check_reshape ==NULL ) err = -EBUSY ; -else if (mddev->ro) +else if (!md_is_rdwr (mddev)) err = -EROFS ;else { mddev->new_layout = n;
@@ -4224,7 +4236,7 @@ chunk_size_store(struct mddev *mddev, const char *buf, size_t len)if (mddev->pers) {if (mddev->pers->check_reshape ==NULL ) err = -EBUSY ; -else if (mddev->ro) +else if (!md_is_rdwr (mddev)) err = -EROFS ;else { mddev->new_chunk_sectors = n >>9 ;
@@ -4347,13 +4359,13 @@ array_state_show(struct mddev *mddev, char *page)if (mddev->pers && !test_bit (MD_NOT_READY , &mddev->flags)) {switch (mddev->ro) { -case 1 : +case MD_RDONLY : st = readonly;break ; -case 2 : +case MD_AUTO_READ : st = read_auto;break ; -case 0 : +case MD_RDWR :spin_lock (&mddev->lock);if (test_bit (MD_SB_CHANGE_PENDING , &mddev->sb_flags)) st = write_pending;
@@ -4389,7 +4401,8 @@ array_state_store(struct mddev *mddev, const char *buf, size_t len)int err =0 ;enum array_state st =match_word (buf, array_states); -if (mddev->pers && (st == active || st == clean) && mddev->ro !=1 ) { +if (mddev->pers && (st == active || st == clean) && + mddev->ro !=MD_RDONLY ) {/* don't take reconfig_mutex when toggling between * clean and active */
@@ -4433,23 +4446,23 @@ array_state_store(struct mddev *mddev, const char *buf, size_t len)if (mddev->pers) err =md_set_readonly (mddev,NULL );else { - mddev->ro =1 ; + mddev->ro =MD_RDONLY ;set_disk_ro (mddev->gendisk,1 ); err =do_md_run (mddev); }break ;case read_auto:if (mddev->pers) { -if (mddev->ro ==0 ) +if (md_is_rdwr (mddev)) err =md_set_readonly (mddev,NULL ); -else if (mddev->ro ==1 ) +else if (mddev->ro ==MD_RDONLY ) err =restart_array (mddev);if (err ==0 ) { - mddev->ro =2 ; + mddev->ro =MD_AUTO_READ ;set_disk_ro (mddev->gendisk,0 ); } }else { - mddev->ro =2 ; + mddev->ro =MD_AUTO_READ ; err =do_md_run (mddev); }break ;
@@ -4474,7 +4487,7 @@ array_state_store(struct mddev *mddev, const char *buf, size_t len)wake_up (&mddev->sb_wait); err =0 ; }else { - mddev->ro =0 ; + mddev->ro =MD_RDWR ;set_disk_ro (mddev->gendisk,0 ); err =do_md_run (mddev); }
@@ -4775,7 +4788,7 @@ action_show(struct mddev *mddev, char *page)if (test_bit (MD_RECOVERY_FROZEN , &recovery)) type ="frozen" ;else if (test_bit (MD_RECOVERY_RUNNING , &recovery) || - (!mddev->ro &&test_bit (MD_RECOVERY_NEEDED , &recovery))) { + (md_is_rdwr (mddev) &&test_bit (MD_RECOVERY_NEEDED , &recovery))) {if (test_bit (MD_RECOVERY_RESHAPE , &recovery)) type ="reshape" ;else if (test_bit (MD_RECOVERY_SYNC , &recovery)) {
@@ -4861,11 +4874,11 @@ action_store(struct mddev *mddev, const char *page, size_t len)set_bit (MD_RECOVERY_REQUESTED , &mddev->recovery);set_bit (MD_RECOVERY_SYNC , &mddev->recovery); } -if (mddev->ro ==2 ) { +if (mddev->ro ==MD_AUTO_READ ) {/* A write to sync_action is enough to justify * canceling read-auto mode */ - mddev->ro =0 ; + mddev->ro =MD_RDWR ;md_wakeup_thread (mddev->sync_thread); }set_bit (MD_RECOVERY_NEEDED , &mddev->recovery);
@@ -5093,8 +5106,7 @@ max_sync_store(struct mddev *mddev, const char *buf, size_t len) goto out_unlock; err = -EBUSY ; -if (max < mddev->resync_max && - mddev->ro ==0 && +if (max < mddev->resync_max &&md_is_rdwr (mddev) &&test_bit (MD_RECOVERY_RUNNING , &mddev->recovery)) goto out_unlock;
@@ -5829,8 +5841,8 @@ int md_run(struct mddev *mddev)continue ;sync_blockdev (rdev->bdev);invalidate_bdev (rdev->bdev); -if (mddev->ro !=1 &&rdev_read_only (rdev)) { - mddev->ro =1 ; +if (mddev->ro !=MD_RDONLY &&rdev_read_only (rdev)) { + mddev->ro =MD_RDONLY ;if (mddev->gendisk)set_disk_ro (mddev->gendisk,1 ); }
@@ -5938,8 +5950,8 @@ int md_run(struct mddev *mddev) mddev->ok_start_degraded = start_dirty_degraded; -if (start_readonly && mddev->ro ==0 ) - mddev->ro =2 ;/* read-only, but switch on first write */ +if (start_readonly &&md_is_rdwr (mddev)) + mddev->ro =MD_AUTO_READ ;/* read-only, but switch on first write */ err = pers->run (mddev);if (err)
@@ -6017,8 +6029,8 @@ int md_run(struct mddev *mddev) mddev->sysfs_action =sysfs_get_dirent_safe (mddev->kobj.sd,"sync_action" ); mddev->sysfs_completed =sysfs_get_dirent_safe (mddev->kobj.sd,"sync_completed" ); mddev->sysfs_degraded =sysfs_get_dirent_safe (mddev->kobj.sd,"degraded" ); - }else if (mddev->ro ==2 )/* auto-readonly not meaningful */ - mddev->ro =0 ; + }else if (mddev->ro ==MD_AUTO_READ ) + mddev->ro =MD_RDWR ;atomic_set (&mddev->max_corr_read_errors,MD_DEFAULT_MAX_CORRECTED_READ_ERRORS );
@@ -6036,7 +6048,7 @@ int md_run(struct mddev *mddev)if (rdev->raid_disk >=0 )sysfs_link_rdev (mddev, rdev);/* failure here is OK */ -if (mddev->degraded && !mddev->ro) +if (mddev->degraded &&md_is_rdwr (mddev))/* This ensures that recovering status is reported immediately * via sysfs - until a lack of spares is confirmed. */
@@ -6128,7 +6140,7 @@ static int restart_array(struct mddev *mddev)return -ENXIO ;if (!mddev->pers)return -EINVAL ; -if (!mddev->ro) +if (md_is_rdwr (mddev))return -EBUSY ;rcu_read_lock ();
@@ -6147,7 +6159,7 @@ static int restart_array(struct mddev *mddev)return -EROFS ; mddev->safemode =0 ; - mddev->ro =0 ; + mddev->ro =MD_RDWR ;set_disk_ro (disk,0 );pr_debug ("md: %s switched to read-write mode.\n" ,mdname (mddev));/* Kick recovery or resync if necessary */
@@ -6174,7 +6186,7 @@ static void md_clean(struct mddev *mddev) mddev->clevel[0 ] =0 ; mddev->flags =0 ; mddev->sb_flags =0 ; - mddev->ro =0 ; + mddev->ro =MD_RDWR ; mddev->metadata_type[0 ] =0 ; mddev->chunk_sectors =0 ; mddev->ctime = mddev->utime =0 ;
@@ -6226,7 +6238,7 @@ static void __md_stop_writes(struct mddev *mddev) }md_bitmap_flush (mddev); -if (mddev->ro ==0 && +if (md_is_rdwr (mddev) && ((!mddev->in_sync && !mddev_is_clustered (mddev)) || mddev->sb_flags)) {/* mark array as shutdown cleanly */
@@ -6340,9 +6352,9 @@ static int md_set_readonly(struct mddev *mddev, struct block_device *bdev)__md_stop_writes (mddev); err = -ENXIO ; -if (mddev->ro==1 ) +if (mddev->ro ==MD_RDONLY ) goto out; - mddev->ro =1 ; + mddev->ro =MD_RDONLY ;set_disk_ro (mddev->gendisk,1 );clear_bit (MD_RECOVERY_FROZEN , &mddev->recovery);set_bit (MD_RECOVERY_NEEDED , &mddev->recovery);
@@ -6399,7 +6411,7 @@ static int do_md_stop(struct mddev *mddev, int mode,return -EBUSY ; }if (mddev->pers) { -if (mddev->ro) +if (!md_is_rdwr (mddev))set_disk_ro (disk,0 );__md_stop_writes (mddev);
@@ -6416,8 +6428,8 @@ static int do_md_stop(struct mddev *mddev, int mode,mutex_unlock (&mddev->open_mutex); mddev->changed =1 ; -if (mddev->ro) - mddev->ro =0 ; +if (!md_is_rdwr (mddev)) + mddev->ro =MD_RDWR ; }else mutex_unlock (&mddev->open_mutex);/*
@@ -7232,7 +7244,7 @@ static int update_size(struct mddev *mddev, sector_t num_sectors)if (test_bit (MD_RECOVERY_RUNNING , &mddev->recovery) || mddev->sync_thread)return -EBUSY ; -if (mddev->ro) +if (!md_is_rdwr (mddev))return -EROFS ;rdev_for_each (rdev, mddev) {
@@ -7262,7 +7274,7 @@ static int update_raid_disks(struct mddev *mddev, int raid_disks)/* change the number of raid disks */ if (mddev->pers->check_reshape ==NULL )return -EINVAL ; -if (mddev->ro) +if (!md_is_rdwr (mddev))return -EROFS ;if (raid_disks <=0 || (mddev->max_disks && raid_disks >= mddev->max_disks))
@@ -7686,26 +7698,25 @@ static int md_ioctl(struct block_device *bdev, fmode_t mode,* The remaining ioctls are changing the state of the * superblock, so we do not allow them on read-only arrays. */ -if (mddev->ro && mddev->pers) { -if (mddev->ro ==2 ) { - mddev->ro =0 ; -sysfs_notify_dirent_safe (mddev->sysfs_state); -set_bit (MD_RECOVERY_NEEDED , &mddev->recovery); -/* mddev_unlock will wake thread */ -/* If a device failed while we were read-only, we -* need to make sure the metadata is updated now. -*/ -if (test_bit (MD_SB_CHANGE_DEVS , &mddev->sb_flags)) { -mddev_unlock (mddev); -wait_event (mddev->sb_wait, - !test_bit (MD_SB_CHANGE_DEVS , &mddev->sb_flags) && - !test_bit (MD_SB_CHANGE_PENDING , &mddev->sb_flags)); -mddev_lock_nointr (mddev); - } - }else { +if (!md_is_rdwr (mddev) && mddev->pers) { +if (mddev->ro !=MD_AUTO_READ ) { err = -EROFS ; goto unlock; } + mddev->ro =MD_RDWR ; +sysfs_notify_dirent_safe (mddev->sysfs_state); +set_bit (MD_RECOVERY_NEEDED , &mddev->recovery); +/* mddev_unlock will wake thread */ +/* If a device failed while we were read-only, we +* need to make sure the metadata is updated now. +*/ +if (test_bit (MD_SB_CHANGE_DEVS , &mddev->sb_flags)) { +mddev_unlock (mddev); +wait_event (mddev->sb_wait, + !test_bit (MD_SB_CHANGE_DEVS , &mddev->sb_flags) && + !test_bit (MD_SB_CHANGE_PENDING , &mddev->sb_flags)); +mddev_lock_nointr (mddev); + } }switch (cmd) {
@@ -7791,11 +7802,11 @@ static int md_set_read_only(struct block_device *bdev, bool ro)* Transitioning to read-auto need only happen for arrays that call * md_write_start and which are not ready for writes yet. */ -if (!ro && mddev->ro ==1 && mddev->pers) { +if (!ro && mddev->ro ==MD_RDONLY && mddev->pers) { err =restart_array (mddev);if (err) goto out_unlock; - mddev->ro =2 ; + mddev->ro =MD_AUTO_READ ; } out_unlock:
@@ -8269,9 +8280,9 @@ static int md_seq_show(struct seq_file *seq, void *v)seq_printf (seq,"%s : %sactive" ,mdname (mddev), mddev->pers ?"" :"in" );if (mddev->pers) { -if (mddev->ro==1 ) +if (mddev->ro ==MD_RDONLY )seq_printf (seq," (read-only)" ); -if (mddev->ro==2 ) +if (mddev->ro ==MD_AUTO_READ )seq_printf (seq," (auto-read-only)" );seq_printf (seq," %s" , mddev->pers->name); }
@@ -8530,10 +8541,10 @@ bool md_write_start(struct mddev *mddev, struct bio *bi)if (bio_data_dir (bi) !=WRITE )return true; -BUG_ON (mddev->ro ==1 ); -if (mddev->ro ==2 ) { +BUG_ON (mddev->ro ==MD_RDONLY ); +if (mddev->ro ==MD_AUTO_READ ) {/* need to switch to read/write */ - mddev->ro =0 ; + mddev->ro =MD_RDWR ;set_bit (MD_RECOVERY_NEEDED , &mddev->recovery);md_wakeup_thread (mddev->thread);md_wakeup_thread (mddev->sync_thread);
@@ -8584,7 +8595,7 @@ void md_write_inc(struct mddev *mddev, struct bio *bi) {if (bio_data_dir (bi) !=WRITE )return ; -WARN_ON_ONCE (mddev->in_sync || mddev->ro); +WARN_ON_ONCE (mddev->in_sync || !md_is_rdwr (mddev));percpu_ref_get (&mddev->writes_pending); }EXPORT_SYMBOL (md_write_inc);
@@ -8690,7 +8701,7 @@ void md_allow_write(struct mddev *mddev) {if (!mddev->pers)return ; -if (mddev->ro) +if (!md_is_rdwr (mddev))return ;if (!mddev->pers->sync_request)return ;
@@ -8738,7 +8749,7 @@ void md_do_sync(struct md_thread *thread)if (test_bit (MD_RECOVERY_DONE , &mddev->recovery) ||test_bit (MD_RECOVERY_WAIT , &mddev->recovery))return ; -if (mddev->ro) {/* never try to sync a read-only array */ +if (!md_is_rdwr (mddev)) {/* never try to sync a read-only array */ set_bit (MD_RECOVERY_INTR , &mddev->recovery);return ; }
@@ -9207,9 +9218,9 @@ static int remove_and_add_spares(struct mddev *mddev,if (test_bit (Faulty, &rdev->flags))continue ;if (!test_bit (Journal, &rdev->flags)) { -if (mddev->ro && - ! (rdev->saved_raid_disk >=0 && - !test_bit (Bitmap_sync, &rdev->flags))) +if (!md_is_rdwr (mddev) && + !(rdev->saved_raid_disk >=0 && + !test_bit (Bitmap_sync, &rdev->flags)))continue ; rdev->recovery_offset =0 ;
@@ -9307,7 +9318,8 @@ void md_check_recovery(struct mddev *mddev)flush_signals (current); } -if (mddev->ro && !test_bit (MD_RECOVERY_NEEDED , &mddev->recovery)) +if (!md_is_rdwr (mddev) && + !test_bit (MD_RECOVERY_NEEDED , &mddev->recovery))return ; if ( ! ( (mddev->sb_flags & ~ (1<<MD_SB_CHANGE_PENDING)) ||
@@ -9326,7 +9338,7 @@ void md_check_recovery(struct mddev *mddev)if (!mddev->external && mddev->safemode ==1 ) mddev->safemode =0 ; -if (mddev->ro) { +if (!md_is_rdwr (mddev)) {struct md_rdev *rdev;if (!mddev->external && mddev->in_sync)/* 'Blocked' flag not needed as failed devices
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 97/194 md: dont leave MD_RECOVERY_FROZEN in error path of md_set_readonly()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <[email protected]>
[ Upstream commit c9f7cb5b2bc968adcdc686c197ed108f47fd8eb0 ]
If md_set_readonly() failed, the array could still be read-write, however 'MD_RECOVERY_FROZEN' could still be set, which leave the array in an abnormal state that sync or recovery can't continue anymore. Hence make sure the flag is cleared after md_set_readonly() returns.
--- drivers/md/md.c | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-)
drivers/md/md.c +13 -11
@@ -6314,6 +6314,9 @@ static int md_set_readonly(struct mddev *mddev, struct block_device *bdev)int err =0 ;int did_freeze =0 ; +if (mddev->external &&test_bit (MD_SB_CHANGE_PENDING , &mddev->sb_flags)) +return -EBUSY ; +if (!test_bit (MD_RECOVERY_FROZEN , &mddev->recovery)) { did_freeze =1 ;set_bit (MD_RECOVERY_FROZEN , &mddev->recovery);
@@ -6326,8 +6329,6 @@ static int md_set_readonly(struct mddev *mddev, struct block_device *bdev)* which will now never happen */ wake_up_process (mddev->sync_thread->tsk); -if (mddev->external &&test_bit (MD_SB_CHANGE_PENDING , &mddev->sb_flags)) -return -EBUSY ;mddev_unlock (mddev);wait_event (resync_wait, !test_bit (MD_RECOVERY_RUNNING , &mddev->recovery));
@@ -6340,29 +6341,30 @@ static int md_set_readonly(struct mddev *mddev, struct block_device *bdev) mddev->sync_thread || test_bit(MD_RECOVERY_RUNNING, &mddev->recovery)) {pr_warn ("md: %s still in use.\n" ,mdname (mddev)); -if (did_freeze) { -clear_bit (MD_RECOVERY_FROZEN , &mddev->recovery); -set_bit (MD_RECOVERY_NEEDED , &mddev->recovery); -md_wakeup_thread (mddev->thread); - } err = -EBUSY ; goto out; } +if (mddev->pers) {__md_stop_writes (mddev); - err = -ENXIO ; -if (mddev->ro ==MD_RDONLY ) +if (mddev->ro ==MD_RDONLY ) { + err = -ENXIO ; goto out; + } + mddev->ro =MD_RDONLY ;set_disk_ro (mddev->gendisk,1 ); + } + +out: +if ((mddev->pers && !err) || did_freeze) {clear_bit (MD_RECOVERY_FROZEN , &mddev->recovery);set_bit (MD_RECOVERY_NEEDED , &mddev->recovery);md_wakeup_thread (mddev->thread);sysfs_notify_dirent_safe (mddev->sysfs_state); - err =0 ; } -out: +mutex_unlock (&mddev->open_mutex);return err; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 98/194 iommu: Avoid more races around device probe
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Murphy <[email protected]>
commit a2e7e59a94269484a83386972ca07c22fd188854 upstream.
It turns out there are more subtle races beyond just the main part of __iommu_probe_device() itself running in parallel - the dev_iommu_free() on the way out of an unsuccessful probe can still manage to trip up concurrent accesses to a device's fwspec. Thus, extend the scope of iommu_probe_device_lock() to also serialise fwspec creation and initial retrieval.
--- drivers/acpi/scan.c | 7 ++++++- drivers/iommu/iommu.c | 19 +++++++++---------- drivers/iommu/of_iommu.c | 12 +++++++++--- include/linux/iommu.h | 1 + 4 files changed, 25 insertions(+), 14 deletions(-)
drivers/acpi/scan.c +6 -1
@@ -1563,17 +1563,22 @@ static const struct iommu_ops *acpi_iommint err;const struct iommu_ops *ops; +/* Serialise to make dev->iommu stable under our potential fwspec */ +mutex_lock (&iommu_probe_device_lock);/* * If we already translated the fwspec there is nothing left to do, * return the iommu_ops. */ ops =acpi_iommu_fwspec_ops (dev); -if (ops) +if (ops) { +mutex_unlock (&iommu_probe_device_lock);return ops; + } err =iort_iommu_configure_id (dev, id_in);if (err && err != -EPROBE_DEFER ) err =viot_iommu_configure (dev); +mutex_unlock (&iommu_probe_device_lock);/* * If we have reason to believe the IOMMU driver missed the initial
drivers/iommu/iommu.c +9 -10
@@ -278,12 +278,13 @@ static void dev_iommu_free(struct devicekfree (param); } +DEFINE_MUTEX (iommu_probe_device_lock); +static int __iommu_probe_device (struct device *dev,struct list_head *group_list) {const struct iommu_ops *ops = dev->bus->iommu_ops;struct iommu_device *iommu_dev;struct iommu_group *group; -static DEFINE_MUTEX (iommu_probe_device_lock);int ret;if (!ops)
@@ -295,11 +296,9 @@ static int __iommu_probe_device(struct d* probably be able to use device_lock() here to minimise the scope, * but for now enforcing a simple global ordering is fine. */ -mutex_lock (&iommu_probe_device_lock); -if (!dev_iommu_get (dev)) { - ret = -ENOMEM ; - goto err_unlock; - } +lockdep_assert_held (&iommu_probe_device_lock); +if (!dev_iommu_get (dev)) +return -ENOMEM ;if (!try_module_get (ops->owner)) { ret = -EINVAL ;
@@ -326,7 +325,6 @@ static int __iommu_probe_device(struct dmutex_unlock (&group->mutex);iommu_group_put (group); -mutex_unlock (&iommu_probe_device_lock);iommu_device_link (iommu_dev, dev);return 0 ;
@@ -341,9 +339,6 @@ out_module_put: err_free:dev_iommu_free (dev); -err_unlock: -mutex_unlock (&iommu_probe_device_lock); -return ret; }
@@ -353,7 +348,9 @@ int iommu_probe_device(struct device *destruct iommu_group *group;int ret; +mutex_lock (&iommu_probe_device_lock); ret =__iommu_probe_device (dev,NULL ); +mutex_unlock (&iommu_probe_device_lock);if (ret) goto err_out;
@@ -1684,7 +1681,9 @@ static int probe_iommu_group(struct devireturn 0 ; } +mutex_lock (&iommu_probe_device_lock); ret =__iommu_probe_device (dev, group_list); +mutex_unlock (&iommu_probe_device_lock);if (ret == -ENODEV ) ret =0 ;
drivers/iommu/of_iommu.c +9 -3
@@ -112,16 +112,20 @@ const struct iommu_ops *of_iommu_configu const u32 *id) {const struct iommu_ops *ops =NULL ; -struct iommu_fwspec *fwspec =dev_iommu_fwspec_get (dev); +struct iommu_fwspec *fwspec;int err =NO_IOMMU ;if (!master_np)return NULL ; +/* Serialise to make dev->iommu stable under our potential fwspec */ +mutex_lock (&iommu_probe_device_lock); + fwspec =dev_iommu_fwspec_get (dev);if (fwspec) { -if (fwspec->ops) +if (fwspec->ops) { +mutex_unlock (&iommu_probe_device_lock);return fwspec->ops; - + }/* In the deferred case, start again from scratch */ iommu_fwspec_free (dev); }
@@ -155,6 +159,8 @@ const struct iommu_ops *of_iommu_configu fwspec =dev_iommu_fwspec_get (dev); ops = fwspec->ops; } +mutex_unlock (&iommu_probe_device_lock); +/* * If we have reason to believe the IOMMU driver missed the initial * probe for dev, replay it to get things in order.
include/linux/iommu.h +1 -0
@@ -657,6 +657,7 @@ static inline void dev_iommu_priv_set(st dev->iommu->priv = priv; } +extern struct mutex iommu_probe_device_lock;int iommu_probe_device (struct device *dev);void iommu_release_device (struct device *dev);
Greg Kroah-Hartman
maintainerPATCH 99/194 rethook: Use __rcu pointer for rethook::handler
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu (Google) <[email protected]>
commit a1461f1fd6cfdc4b8917c9d4a91e92605d1f28dc upstream.
Since the rethook::handler is an RCU-maganged pointer so that it will notice readers the rethook is stopped (unregistered) or not, it should be an __rcu pointer and use appropriate functions to be accessed. This will use appropriate memory barrier when accessing it. OTOH, rethook::data is never changed, so we don't need to check it in get_kretprobe().
NOTE: To avoid sparse warning, rethook::handler is defined by a raw function pointer type with __rcu instead of rethook_handler_t.
--- include/linux/kprobes.h | 6 ++---- include/linux/rethook.h | 7 ++++++- kernel/trace/rethook.c | 23 ++++++++++++++--------- 3 files changed, 22 insertions(+), 14 deletions(-)
include/linux/kprobes.h +2 -4
@@ -202,10 +202,8 @@ extern int arch_trampoline_kprobe(struct#ifdef CONFIG_KRETPROBE_ON_RETHOOK static nokprobe_inline struct kretprobe *get_kretprobe(struct kretprobe_instance *ri) { -RCU_LOCKDEP_WARN (!rcu_read_lock_any_held (), -"Kretprobe is accessed from instance under preemptive context" ); - -return (struct kretprobe *)READ_ONCE (ri->node.rethook->data); +/* rethook::data is non-changed field, so that you can access it freely. */ +return (struct kretprobe *)ri->node.rethook->data; }static nokprobe_inline unsigned long get_kretprobe_retaddr (struct kretprobe_instance *ri) {
include/linux/rethook.h +6 -1
@@ -29,7 +29,12 @@ typedef void (*rethook_handler_t) (struc*/ struct rethook {void *data; -rethook_handler_t handler; +/* +* To avoid sparse warnings, this uses a raw function pointer with +* __rcu, instead of rethook_handler_t. But this must be same as +* rethook_handler_t. +*/ +void (__rcu *handler) (struct rethook_node *,void *,struct pt_regs *);struct freelist_head pool;refcount_t ref;struct rcu_head rcu;
kernel/trace/rethook.c +14 -9
@@ -63,7 +63,7 @@ static void rethook_free_rcu(struct rcu_*/ void rethook_stop (struct rethook *rh) { -WRITE_ONCE (rh->handler,NULL ); +rcu_assign_pointer (rh->handler,NULL ); }/**
@@ -78,11 +78,17 @@ void rethook_stop(struct rethook *rh)*/ void rethook_free (struct rethook *rh) { -WRITE_ONCE (rh->handler,NULL ); +rethook_stop (rh);call_rcu (&rh->rcu, rethook_free_rcu); } +static inline rethook_handler_t rethook_get_handler (struct rethook *rh) +{ +return (rethook_handler_t )rcu_dereference_check (rh->handler, +rcu_read_lock_any_held ()); +} +/** * rethook_alloc() - Allocate struct rethook. * @data: a data to pass the @handler when hooking the return.
@@ -102,7 +108,7 @@ struct rethook *rethook_alloc(void *data } rh->data = data; - rh->handler = handler; +rcu_assign_pointer (rh->handler, handler); rh->pool.head =NULL ;refcount_set (&rh->ref,1 );
@@ -142,9 +148,10 @@ static void free_rethook_node_rcu(struct*/ void rethook_recycle (struct rethook_node *node) { -lockdep_assert_preemption_disabled (); +rethook_handler_t handler; -if (likely (READ_ONCE (node->rethook->handler))) + handler =rethook_get_handler (node->rethook); +if (likely (handler))freelist_add (&node->freelist, &node->rethook->pool);else call_rcu (&node->rcu, free_rethook_node_rcu);
@@ -160,11 +167,9 @@ NOKPROBE_SYMBOL(rethook_recycle);*/ struct rethook_node *rethook_try_get (struct rethook *rh) { -rethook_handler_t handler =READ_ONCE (rh->handler); +rethook_handler_t handler =rethook_get_handler (rh);struct freelist_node *fn; -lockdep_assert_preemption_disabled (); -/* Check whether @rh is going to be freed. */ if (unlikely (!handler))return NULL ;
@@ -312,7 +317,7 @@ unsigned long rethook_trampoline_handler rhn = container_of(first, struct rethook_node, llist);if (WARN_ON_ONCE (rhn->frame != frame))break ; - handler =READ_ONCE (rhn->rethook->handler); + handler =rethook_get_handler (rhn->rethook);if (handler)handler (rhn, rhn->rethook->data, regs);
Greg Kroah-Hartman
maintainerPATCH 100/194 kprobes: consistent rcu api usage for kretprobe holder
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: JP Kobryn <[email protected]>
commit d839a656d0f3caca9f96e9bf912fd394ac6a11bc upstream.
It seems that the pointer-to-kretprobe "rp" within the kretprobe_holder is RCU-managed, based on the (non-rethook) implementation of get_kretprobe(). The thought behind this patch is to make use of the RCU API where possible when accessing this pointer so that the needed barriers are always in place and to self-document the code.
The __rcu annotation to "rp" allows for sparse RCU checking. Plain writes done to the "rp" pointer are changed to make use of the RCU macro for assignment. For the single read, the implementation of get_kretprobe() is simplified by making use of an RCU macro which accomplishes the same, but note that the log warning text will be more generic.
I did find that there is a difference in assembly generated between the usage of the RCU macros vs without. For example, on arm64, when using rcu_assign_pointer(), the corresponding store instruction is a store-release (STLR) which has an implicit barrier. When normal assignment is done, a regular store (STR) is found. In the macro case, this seems to be a result of rcu_assign_pointer() using smp_store_release() when the value to write is not NULL.
--- include/linux/kprobes.h | 7 ++----- kernel/kprobes.c | 4 ++-- 2 files changed, 4 insertions(+), 7 deletions(-)
include/linux/kprobes.h +2 -5
@@ -140,7 +140,7 @@ static inline bool kprobe_ftrace(struct* */ struct kretprobe_holder { -struct kretprobe *rp; +struct kretprobe __rcu *rp;refcount_t ref; };
@@ -248,10 +248,7 @@ unsigned long kretprobe_trampoline_handl static nokprobe_inline struct kretprobe *get_kretprobe(struct kretprobe_instance *ri) { -RCU_LOCKDEP_WARN (!rcu_read_lock_any_held (), -"Kretprobe is accessed from instance under preemptive context" ); - -return READ_ONCE (ri->rph->rp); +return rcu_dereference_check (ri->rph->rp,rcu_read_lock_any_held ()); }static nokprobe_inline unsigned long get_kretprobe_retaddr (struct kretprobe_instance *ri)
kernel/kprobes.c +2 -2
@@ -2253,7 +2253,7 @@ int register_kretprobe(struct kretprobeif (!rp->rph)return -ENOMEM ; - rp->rph->rp = rp; +rcu_assign_pointer (rp->rph->rp, rp);for (i =0 ; i < rp->maxactive; i++) { inst =kzalloc (sizeof (struct kretprobe_instance ) + rp->data_size,GFP_KERNEL );
@@ -2314,7 +2314,7 @@ void unregister_kretprobes(struct kretpr#ifdef CONFIG_KRETPROBE_ON_RETHOOK rethook_free (rps[i]->rh);#else - rps[i]->rph->rp =NULL ; +rcu_assign_pointer (rps[i]->rph->rp,NULL );#endif }mutex_unlock (&kprobe_mutex);
Greg Kroah-Hartman
maintainerPATCH 101/194 ASoC: amd: yc: Fix non-functional mic on ASUS E1504FA
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Malcolm Hart <[email protected]>
commit b24e3590c94ab0aba6e455996b502a83baa5c31c upstream.
This patch adds ASUSTeK COMPUTER INC "E1504FA" to the quirks file acp6x-mach.c to enable microphone array on ASUS Vivobook GO 15.
I have this laptop and can confirm that the patch succeeds in enabling the microphone array.
Rule: add
--- sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ 1 file changed, 7 insertions(+)
sound/soc/amd/yc/acp6x-mach.c +7 -0
@@ -286,6 +286,13 @@ static const struct dmi_system_id yc_acp { .driver_data = &acp6x_card, .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"ASUSTeK COMPUTER INC." ), + DMI_MATCH(DMI_PRODUCT_NAME, "E1504FA"), + } + }, + { + .driver_data = &acp6x_card, + .matches = {DMI_MATCH (DMI_BOARD_VENDOR ,"TIMI" ), DMI_MATCH(DMI_PRODUCT_NAME, "Redmi Book Pro 15 2022"), }
Greg Kroah-Hartman
maintainerPATCH 102/194 io_uring/af_unix: disable sending io_uring over sockets
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Begunkov <[email protected]>
commit 705318a99a138c29a512a72c3e0043b3cd7f55f4 upstream.
File reference cycles have caused lots of problems for io_uring in the past, and it still doesn't work exactly right and races with unix_stream_read_generic(). The safest fix would be to completely disallow sending io_uring files via sockets via SCM_RIGHT, so there are no possible cycles invloving registered files and thus rendering SCM accounting on the io_uring side unnecessary.
--- io_uring/rsrc.h | 7 ------- net/core/scm.c | 6 ++++++ 2 files changed, 6 insertions(+), 7 deletions(-)
io_uring/rsrc.h +0 -7
@@ -79,17 +79,10 @@ int io_sqe_files_register(struct io_ringint __io_scm_file_account (struct io_ring_ctx *ctx,struct file *file); -#if defined(CONFIG_UNIX ) -static inline bool io_file_need_scm (struct file *filp) -{ -return !!unix_get_socket (filp); -} -#else static inline bool io_file_need_scm (struct file *filp) {return false; } -#endif static inline int io_scm_file_account (struct io_ring_ctx *ctx,struct file *file)
net/core/scm.c +6 -0
@@ -26,6 +26,7 @@#include <linux/nsproxy.h> #include <linux/slab.h> #include <linux/errqueue.h> +#include <linux/io_uring.h> #include <linux/uaccess.h>
@@ -103,6 +104,11 @@ static int scm_fp_copy(struct cmsghdr *cif (fd <0 || !(file =fget_raw (fd)))return -EBADF ; +/* don't allow io_uring files */ +if (io_uring_get_socket (file)) { +fput (file); +return -EINVAL ; + } *fpp++ = file; fpl->count++; }
Greg Kroah-Hartman
maintainerPATCH 103/194 nvme-pci: Add sleep quirk for Kingston drives
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Georg Gottleuber <[email protected]>
commit 107b4e063d78c300b21e2d5291b1aa94c514ea5b upstream.
Some Kingston NV1 and A2000 are wasting a lot of power on specific TUXEDO platforms in s2idle sleep if 'Simple Suspend' is used.
This patch applies a new quirk 'Force No Simple Suspend' to achieve a low power sleep without 'Simple Suspend'.
--- drivers/nvme/host/nvme.h | 5 +++++ drivers/nvme/host/pci.c | 16 +++++++++++++++- 2 files changed, 20 insertions(+), 1 deletion(-)
drivers/nvme/host/nvme.h +5 -0
@@ -154,6 +154,11 @@ enum nvme_quirks {* No temperature thresholds for channels other than 0 (Composite). */ NVME_QUIRK_NO_SECONDARY_TEMP_THRESH = (1 <<19 ), + +/* +* Disables simple suspend/resume path. +*/ + NVME_QUIRK_FORCE_NO_SIMPLE_SUSPEND = (1 << 20), };/*
drivers/nvme/host/pci.c +15 -1
@@ -3093,6 +3093,18 @@ static unsigned long check_vendor_combinif ((dmi_match (DMI_BOARD_VENDOR ,"LENOVO" )) &&dmi_match (DMI_BOARD_NAME ,"LNVNB161216" ))return NVME_QUIRK_SIMPLE_SUSPEND ; + }else if (pdev->vendor ==0x2646 && (pdev->device ==0x2263 || + pdev->device ==0x500f )) { +/* +* Exclude some Kingston NV1 and A2000 devices from +* NVME_QUIRK_SIMPLE_SUSPEND. Do a full suspend to save a +* lot fo energy with s2idle sleep on some TUXEDO platforms. +*/ +if (dmi_match (DMI_BOARD_NAME ,"NS5X_NS7XAU" ) || +dmi_match (DMI_BOARD_NAME ,"NS5x_7xAU" ) || +dmi_match (DMI_BOARD_NAME ,"NS5x_7xPU" ) || +dmi_match (DMI_BOARD_NAME ,"PH4PRX1_PH6PRX1" )) +return NVME_QUIRK_FORCE_NO_SIMPLE_SUSPEND ; }return 0 ;
@@ -3133,7 +3145,9 @@ static struct nvme_dev *nvme_pci_alloc_d dev->dev =get_device (&pdev->dev); quirks |=check_vendor_combination_bug (pdev); -if (!noacpi &&acpi_storage_d3 (&pdev->dev)) { +if (!noacpi && + !(quirks &NVME_QUIRK_FORCE_NO_SIMPLE_SUSPEND ) && +acpi_storage_d3 (&pdev->dev)) {/* * Some systems use a bios work around to ask for D3 on * platforms that support kernel managed suspend.
Greg Kroah-Hartman
maintainerPATCH 104/194 io_uring: fix mutex_unlock with unreferenced ctx
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Begunkov <[email protected]>
commit f7b32e785042d2357c5abc23ca6db1b92c91a070 upstream.
Callers of mutex_unlock() have to make sure that the mutex stays alive for the whole duration of the function call. For io_uring that means that the following pattern is not valid unless we ensure that the context outlives the mutex_unlock() call.
mutex_lock(&ctx->uring_lock);req_put(req); // typically via io_req_task_submit() mutex_unlock(&ctx->uring_lock);
Most contexts are fine: io-wq pins requests, syscalls hold the file, task works are taking ctx references and so on. However, the task work fallback path doesn't follow the rule.
--- io_uring/io_uring.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
io_uring/io_uring.c +3 -6
@@ -1377,6 +1377,7 @@ static __cold void io_iopoll_try_reap_evif (!(ctx->flags &IORING_SETUP_IOPOLL ))return ; +percpu_ref_get (&ctx->refs);mutex_lock (&ctx->uring_lock);while (!wq_list_empty (&ctx->iopoll_list)) {/* let it sleep and repeat later if can't complete a request */
@@ -1394,6 +1395,7 @@ static __cold void io_iopoll_try_reap_ev } }mutex_unlock (&ctx->uring_lock); +percpu_ref_put (&ctx->refs); }static int io_iopoll_check (struct io_ring_ctx *ctx,long min)
@@ -2800,12 +2802,7 @@ static __cold void io_ring_exit_work(strinit_completion (&exit.completion);init_task_work (&exit.task_work, io_tctx_exit_cb); exit.ctx = ctx; -/* -* Some may use context even when all refs and requests have been put, -* and they are free to do so while still holding uring_lock or -* completion_lock, see io_req_task_submit(). Apart from other work, -* this lock/unlock section also waits them to finish. -*/ +mutex_lock (&ctx->uring_lock);while (!list_empty (&ctx->tctx_list)) {WARN_ON_ONCE (time_after (jiffies, timeout));
Greg Kroah-Hartman
maintainerPATCH 105/194 ALSA: usb-audio: Add Pioneer DJM-450 mixer controls
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sarah Grant <[email protected]>
commit bbb8e71965c3737bdc691afd803a34bfd61cfbeb upstream.
These values mirror those of the Pioneer DJM-250MK2 as the channel layout appears identical based on my observations. This duplication could be removed in later contributions if desired.
--- sound/usb/mixer_quirks.c | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+)
sound/usb/mixer_quirks.c +30 -0
@@ -2978,6 +2978,7 @@ static int snd_bbfpro_controls_create(st#define SND_DJM_850_IDX 0x2#define SND_DJM_900NXS2_IDX 0x3#define SND_DJM_750MK2_IDX 0x4 +#define SND_DJM_450_IDX 0x5#define SND_DJM_CTL (_name, suffix, _default_value, _windex) { \
@@ -3108,6 +3109,31 @@ static const struct snd_djm_ctl snd_djm_ }; +// DJM-450 +static const u16 snd_djm_opts_450_cap1[] = { +0x0103 ,0x0100 ,0x0106 ,0x0107 ,0x0108 ,0x0109 ,0x010d ,0x010a }; + +static const u16 snd_djm_opts_450_cap2[] = { +0x0203 ,0x0200 ,0x0206 ,0x0207 ,0x0208 ,0x0209 ,0x020d ,0x020a }; + +static const u16 snd_djm_opts_450_cap3[] = { +0x030a ,0x0311 ,0x0312 ,0x0307 ,0x0308 ,0x0309 ,0x030d }; + +static const u16 snd_djm_opts_450_pb1[] = {0x0100 ,0x0101 ,0x0104 }; +static const u16 snd_djm_opts_450_pb2[] = {0x0200 ,0x0201 ,0x0204 }; +static const u16 snd_djm_opts_450_pb3[] = {0x0300 ,0x0301 ,0x0304 }; + +static const struct snd_djm_ctl snd_djm_ctls_450[] = { +SND_DJM_CTL ("Capture Level" , cap_level,0 ,SND_DJM_WINDEX_CAPLVL ), + SND_DJM_CTL("Ch1 Input", 450_cap1, 2, SND_DJM_WINDEX_CAP), + SND_DJM_CTL("Ch2 Input", 450_cap2, 2, SND_DJM_WINDEX_CAP), + SND_DJM_CTL("Ch3 Input", 450_cap3, 0, SND_DJM_WINDEX_CAP), + SND_DJM_CTL("Ch1 Output", 450_pb1, 0, SND_DJM_WINDEX_PB), + SND_DJM_CTL("Ch2 Output", 450_pb2, 1, SND_DJM_WINDEX_PB), + SND_DJM_CTL("Ch3 Output", 450_pb3, 2, SND_DJM_WINDEX_PB) +}; + +// DJM-750 static const u16 snd_djm_opts_750_cap1[] = {0x0101 ,0x0103 ,0x0106 ,0x0107 ,0x0108 ,0x0109 ,0x010a ,0x010f };
@@ -3203,6 +3229,7 @@ static const struct snd_djm_device snd_d [SND_DJM_850_IDX] = SND_DJM_DEVICE(850), [SND_DJM_900NXS2_IDX] = SND_DJM_DEVICE(900nxs2), [SND_DJM_750MK2_IDX] = SND_DJM_DEVICE(750mk2), + [SND_DJM_450_IDX] = SND_DJM_DEVICE(450), };
@@ -3449,6 +3476,9 @@ int snd_usb_mixer_apply_create_quirk(strcase USB_ID (0x2b73 ,0x0017 ):/* Pioneer DJ DJM-250MK2 */ err =snd_djm_controls_create (mixer,SND_DJM_250MK2_IDX );break ; +case USB_ID (0x2b73 ,0x0013 ):/* Pioneer DJ DJM-450 */ + err =snd_djm_controls_create (mixer,SND_DJM_450_IDX ); +break ;case USB_ID (0x08e4 ,0x017f ):/* Pioneer DJ DJM-750 */ err =snd_djm_controls_create (mixer,SND_DJM_750_IDX );break ;
Greg Kroah-Hartman
maintainerPATCH 106/194 ALSA: pcm: fix out-of-bounds in snd_pcm_state_names
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Zhang <[email protected]>
commit 2b3a7a302c9804e463f2ea5b54dc3a6ad106a344 upstream.
The pcm state can be SNDRV_PCM_STATE_DISCONNECTED at disconnect callback, and there is not an entry of SNDRV_PCM_STATE_DISCONNECTED in snd_pcm_state_names.
This patch adds the missing entry to resolve this issue.
cat /proc/asound/card2/pcm0p/sub0/status
That results in stack traces like the following:
[ 99.702732][ T5171] Unexpected kernel BRK exception at EL1 [ 99.702774][ T5171] Internal error: BRK handler: f2005512 [#1] PREEMPT SMP [ 99.703858][ T5171] Modules linked in: bcmdhd(E) (...) [ 99.747425][ T5171] CPU: 3 PID: 5171 Comm: cat Tainted: G C OE 5.10.189-android13-4-00003-g4a17384380d8-ab11086999 #1 [ 99.748447][ T5171] Hardware name: Rockchip RK3588 CVTE V10 Board (DT) [ 99.749024][ T5171] pstate: 60400005 (nZCv daif +PAN -UAO -TCO BTYPE=--) [ 99.749616][ T5171] pc : snd_pcm_substream_proc_status_read+0x264/0x2bc [ 99.750204][ T5171] lr : snd_pcm_substream_proc_status_read+0xa4/0x2bc [ 99.750778][ T5171] sp : ffffffc0175abae0 [ 99.751132][ T5171] x29: ffffffc0175abb80 x28: ffffffc009a2c498 [ 99.751665][ T5171] x27: 0000000000000001 x26: ffffff810cbae6e8 [ 99.752199][ T5171] x25: 0000000000400cc0 x24: ffffffc0175abc60 [ 99.752729][ T5171] x23: 0000000000000000 x22: ffffff802f558400 [ 99.753263][ T5171] x21: ffffff81d8d8ff00 x20: ffffff81020cdc00 [ 99.753795][ T5171] x19: ffffff802d110000 x18: ffffffc014fbd058 [ 99.754326][ T5171] x17: 0000000000000000 x16: 0000000000000000 [ 99.754861][ T5171] x15: 000000000000c276 x14: ffffffff9a976fda [ 99.755392][ T5171] x13: 0000000065689089 x12: 000000000000d72e [ 99.755923][ T5171] x11: ffffff802d110000 x10: 00000000000000e0 [ 99.756457][ T5171] x9 : 9c431600c8385d00 x8 : 0000000000000008 [ 99.756990][ T5171] x7 : 0000000000000000 x6 : 000000000000003f [ 99.757522][ T5171] x5 : 0000000000000040 x4 : ffffffc0175abb70 [ 99.758056][ T5171] x3 : 0000000000000001 x2 : 0000000000000001 [ 99.758588][ T5171] x1 : 0000000000000000 x0 : 0000000000000000 [ 99.759123][ T5171] Call trace: [ 99.759404][ T5171] snd_pcm_substream_proc_status_read+0x264/0x2bc [ 99.759958][ T5171] snd_info_seq_show+0x54/0xa4 [ 99.760370][ T5171] seq_read_iter+0x19c/0x7d4 [ 99.760770][ T5171] seq_read+0xf0/0x128 [ 99.761117][ T5171] proc_reg_read+0x100/0x1f8 [ 99.761515][ T5171] vfs_read+0xf4/0x354 [ 99.761869][ T5171] ksys_read+0x7c/0x148 [ 99.762226][ T5171] __arm64_sys_read+0x20/0x30 [ 99.762625][ T5171] el0_svc_common+0xd0/0x1e4 [ 99.763023][ T5171] el0_svc+0x28/0x98 [ 99.763358][ T5171] el0_sync_handler+0x8c/0xf0 [ 99.763759][ T5171] el0_sync+0x1b8/0x1c0 [ 99.764118][ T5171] Code: d65f03c0 b9406102 17ffffae 94191565 (d42aa240) [ 99.764715][ T5171] ---[ end trace 1eeffa3e17c58e10 ]--- [ 99.780720][ T5171] Kernel panic - not syncing: BRK handler: Fatal exception
--- sound/core/pcm.c | 1 + 1 file changed, 1 insertion(+)
sound/core/pcm.c +1 -0
@@ -253,6 +253,7 @@ static const char * const snd_pcm_state_STATE (DRAINING ),STATE (PAUSED ),STATE (SUSPENDED ), + STATE(DISCONNECTED), };static const char *const snd_pcm_access_names[] = {
Greg Kroah-Hartman
maintainerPATCH 107/194 ALSA: hda/realtek: Enable headset on Lenovo M90 Gen5
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bin Li <[email protected]>
commit 6f7e4664e597440dfbdb8b2931c561b717030d07 upstream.
Lenovo M90 Gen5 is equipped with ALC897, and it needs ALC897_FIXUP_HEADSET_MIC_PIN quirk to make its headset mic work.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -11952,6 +11952,7 @@ static const struct snd_pci_quirk alc662SND_PCI_QUIRK (0x17aa ,0x32f7 ,"Lenovo ThinkCentre M90" ,ALC897_FIXUP_HEADSET_MIC_PIN ),SND_PCI_QUIRK (0x17aa ,0x3321 ,"Lenovo ThinkCentre M70 Gen4" ,ALC897_FIXUP_HEADSET_MIC_PIN ),SND_PCI_QUIRK (0x17aa ,0x331b ,"Lenovo ThinkCentre M90 Gen4" ,ALC897_FIXUP_HEADSET_MIC_PIN ), +SND_PCI_QUIRK (0x17aa ,0x3364 ,"Lenovo ThinkCentre M90 Gen5" ,ALC897_FIXUP_HEADSET_MIC_PIN ),SND_PCI_QUIRK (0x17aa ,0x3742 ,"Lenovo TianYi510Pro-14IOB" ,ALC897_FIXUP_HEADSET_MIC_PIN2 ),SND_PCI_QUIRK (0x17aa ,0x38af ,"Lenovo Ideapad Y550P" ,ALC662_FIXUP_IDEAPAD ), SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Ideapad Y550", ALC662_FIXUP_IDEAPAD),
Greg Kroah-Hartman
maintainerPATCH 108/194 ALSA: hda/realtek: add new Framework laptop to quirks
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Bosse <[email protected]>
commit 33038efb64f7576bac635164021f5c984d4c755f upstream.
The Framework Laptop 13 (AMD Ryzen 7040Series) has an ALC295 with a disconnected or faulty headset mic presence detect similar to the previous models. It works with the same quirk chain as 309d7363ca3d9fcdb92ff2d958be14d7e8707f68. This model has a VID:PID of f111:0006.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -10031,6 +10031,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x8086 ,0x2081 ,"Intel NUC 10" ,ALC256_FIXUP_INTEL_NUC10 ),SND_PCI_QUIRK (0x8086 ,0x3038 ,"Intel NUC 13" ,ALC295_FIXUP_CHROME_BOOK ),SND_PCI_QUIRK (0xf111 ,0x0001 ,"Framework Laptop" ,ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE ), +SND_PCI_QUIRK (0xf111 ,0x0006 ,"Framework Laptop" ,ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE ), #if 0/* Below is a quirk table taken from the old code.
Greg Kroah-Hartman
maintainerPATCH 109/194 ALSA: hda/realtek: Add Framework laptop 16 to quirks
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
commit 8804fa04a492f4176ea407390052292912227820 upstream.
The Framework 16" laptop has the same controller as other Framework models. Apply the presence detection quirk.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -10031,6 +10031,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x8086 ,0x2081 ,"Intel NUC 10" ,ALC256_FIXUP_INTEL_NUC10 ),SND_PCI_QUIRK (0x8086 ,0x3038 ,"Intel NUC 13" ,ALC295_FIXUP_CHROME_BOOK ),SND_PCI_QUIRK (0xf111 ,0x0001 ,"Framework Laptop" ,ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE ), +SND_PCI_QUIRK (0xf111 ,0x0005 ,"Framework Laptop" ,ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0xf111 ,0x0006 ,"Framework Laptop" ,ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE ), #if 0
Greg Kroah-Hartman
maintainerPATCH 110/194 ring-buffer: Test last update in 32bit version of __rb_time_read()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt (Google) <[email protected]>
commit f458a1453424e03462b5bb539673c9a3cddda480 upstream.
Since 64 bit cmpxchg() is very expensive on 32bit architectures, the timestamp used by the ring buffer does some interesting tricks to be able to still have an atomic 64 bit number. It originally just used 60 bits and broke it up into two 32 bit words where the extra 2 bits were used for synchronization. But this was not enough for all use cases, and all 64 bits were required.
The 32bit version of the ring buffer timestamp was then broken up into 3 32bit words using the same counter trick. But one update was not done. The check to see if the read operation was done without interruption only checked the first two words and not last one (like it had before this update). Fix it by making sure all three updates happen without interruption by comparing the initial counter with the last updated counter.
--- kernel/trace/ring_buffer.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/trace/ring_buffer.c +2 -2
@@ -646,8 +646,8 @@ static inline bool __rb_time_read(rb_tim *cnt =rb_time_cnt (top); -/* If top and bottom counts don't match, this interrupted a write */ -if (*cnt !=rb_time_cnt (bottom)) +/* If top and msb counts don't match, this interrupted a write */ +if (*cnt !=rb_time_cnt (msb))return false;/* The shift to msb will lose its cnt bits */
Greg Kroah-Hartman
maintainerPATCH 111/194 nilfs2: fix missing error check for sb_set_blocksize call
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <[email protected]>
commit d61d0ab573649789bf9eb909c89a1a193b2e3d10 upstream.
When mounting a filesystem image with a block size larger than the page size, nilfs2 repeatedly outputs long error messages with stack traces to the kernel log, such as the following:
getblk(): invalid block size 8192 requested
logical block size: 512
...
Call Trace: dump_stack_lvl+0x92/0xd4 dump_stack+0xd/0x10 bdev_getblk+0x33a/0x354 __breadahead+0x11/0x80 nilfs_search_super_root+0xe2/0x704 [nilfs2] load_nilfs+0x72/0x504 [nilfs2] nilfs_mount+0x30f/0x518 [nilfs2] legacy_get_tree+0x1b/0x40 vfs_get_tree+0x18/0xc4 path_mount+0x786/0xa88 __ia32_sys_mount+0x147/0x1a8 __do_fast_syscall_32+0x56/0xc8 do_fast_syscall_32+0x29/0x58 do_SYSENTER_32+0x15/0x18 entry_SYSENTER_32+0x98/0xf1 ...
This overloads the system logger. And to make matters worse, it sometimes crashes the kernel with a memory access violation.
This is because the return value of the sb_set_blocksize() call, which should be checked for errors, is not checked.
The latter issue is due to out-of-buffer memory being accessed based on a large block size that caused sb_set_blocksize() to fail for buffers read with the initial minimum block size that remained unupdated in the super_block structure.
Since nilfs2 mkfs tool does not accept block sizes larger than the system page size, this has been overlooked. However, it is possible to create this situation by intentionally modifying the tool or by passing a filesystem image created on a system with a large page size to a system with a smaller page size and mounting it.
Fix this issue by inserting the expected error handling for the call to sb_set_blocksize().
--- fs/nilfs2/the_nilfs.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
fs/nilfs2/the_nilfs.c +5 -1
@@ -716,7 +716,11 @@ int init_nilfs(struct the_nilfs *nilfs, goto failed_sbh; }nilfs_release_super_block (nilfs); -sb_set_blocksize (sb, blocksize); +if (!sb_set_blocksize (sb, blocksize)) { +nilfs_err (sb,"bad blocksize %d" , blocksize); + err = -EINVAL ; + goto out; + } err =nilfs_load_super_block (nilfs, sb, blocksize, &sbp);if (err)
Greg Kroah-Hartman
maintainerPATCH 112/194 nilfs2: prevent WARNING in nilfs_sufile_set_segment_usage()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <[email protected]>
commit 675abf8df1353e0e3bde314993e0796c524cfbf0 upstream.
If nilfs2 reads a disk image with corrupted segment usage metadata, and its segment usage information is marked as an error for the segment at the write location, nilfs_sufile_set_segment_usage() can trigger WARN_ONs during log writing.
Segments newly allocated for writing with nilfs_sufile_alloc() will not have this error flag set, but this unexpected situation will occur if the segment indexed by either nilfs->ns_segnum or nilfs->ns_nextnum (active segment) was marked in error.
Fix this issue by inserting a sanity check to treat it as a file system corruption.
Since error returns are not allowed during the execution phase where nilfs_sufile_set_segment_usage() is used, this inserts the sanity check into nilfs_sufile_mark_dirty() which pre-reads the buffer containing the segment usage record to be updated and sets it up in a dirty state for writing.
In addition, nilfs_sufile_set_segment_usage() is also called when canceling log writing and undoing segment usage update, so in order to avoid issuing the same kernel warning in that case, in case of cancellation, avoid checking the error flag in nilfs_sufile_set_segment_usage().
--- fs/nilfs2/sufile.c | 42 +++++++++++++++++++++++++++++++++++------- 1 file changed, 35 insertions(+), 7 deletions(-)
fs/nilfs2/sufile.c +35 -7
@@ -501,15 +501,38 @@ int nilfs_sufile_mark_dirty(struct inodedown_write (&NILFS_MDT (sufile)->mi_sem); ret =nilfs_sufile_get_segment_usage_block (sufile, segnum,0 , &bh); -if (!ret) { -mark_buffer_dirty (bh); -nilfs_mdt_mark_dirty (sufile); - kaddr =kmap_atomic (bh->b_page); - su =nilfs_sufile_block_get_segment_usage (sufile, segnum, bh, kaddr); +if (ret) + goto out_sem; + + kaddr =kmap_atomic (bh->b_page); + su =nilfs_sufile_block_get_segment_usage (sufile, segnum, bh, kaddr); +if (unlikely (nilfs_segment_usage_error (su))) { +struct the_nilfs *nilfs = sufile->i_sb->s_fs_info; + +kunmap_atomic (kaddr); +brelse (bh); +if (nilfs_segment_is_active (nilfs, segnum)) { +nilfs_error (sufile->i_sb, +"active segment %llu is erroneous" , + (unsigned long long )segnum); + }else { +/* +* Segments marked erroneous are never allocated by +* nilfs_sufile_alloc(); only active segments, ie, +* the segments indexed by ns_segnum or ns_nextnum, +* can be erroneous here. +*/ +WARN_ON_ONCE (1 ); + } + ret = -EIO ; + }else {nilfs_segment_usage_set_dirty (su);kunmap_atomic (kaddr); +mark_buffer_dirty (bh); +nilfs_mdt_mark_dirty (sufile);brelse (bh); } +out_sem:up_write (&NILFS_MDT (sufile)->mi_sem);return ret; }
@@ -536,9 +559,14 @@ int nilfs_sufile_set_segment_usage(struc kaddr =kmap_atomic (bh->b_page); su =nilfs_sufile_block_get_segment_usage (sufile, segnum, bh, kaddr); -WARN_ON (nilfs_segment_usage_error (su)); -if (modtime) +if (modtime) { +/* +* Check segusage error and set su_lastmod only when updating +* this entry with a valid timestamp, not for cancellation. +*/ +WARN_ON_ONCE (nilfs_segment_usage_error (su)); su->su_lastmod =cpu_to_le64 (modtime); + } su->su_nblocks =cpu_to_le32 (nblocks);kunmap_atomic (kaddr);
Greg Kroah-Hartman
maintainerPATCH 113/194 cgroup_freezer: cgroup_freezing: Check if not frozen
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Van Patten <[email protected]>
commit cff5f49d433fcd0063c8be7dd08fa5bf190c6c37 upstream.
__thaw_task() was recently updated to warn if the task being thawed was part of a freezer cgroup that is still currently freezing:
void __thaw_task(struct task_struct *p)
{
...
if (WARN_ON_ONCE(freezing(p)))
goto unlock;This has exposed a bug in cgroup1 freezing where when CGROUP_FROZEN is asserted, the CGROUP_FREEZING bits are not also cleared at the same time. Meaning, when a cgroup is marked FROZEN it continues to be marked FREEZING as well. This causes the WARNING to trigger, because cgroup_freezing() thinks the cgroup is still freezing.
There are two ways to fix this:
1. Whenever FROZEN is set, clear FREEZING for the cgroup and all children cgroups.
2. Update cgroup_freezing() to also verify that FROZEN is not set.
This patch implements option (2), since it's smaller and more straightforward.
--- kernel/cgroup/legacy_freezer.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
kernel/cgroup/legacy_freezer.c +7 -1
@@ -66,9 +66,15 @@ static struct freezer *parent_freezer(struct freezer *freezer)bool cgroup_freezing (struct task_struct *task) {bool ret; +unsigned int state;rcu_read_lock (); - ret =task_freezer (task)->state &CGROUP_FREEZING ; +/* Check if the cgroup is still FREEZING, but not FROZEN. The extra +* !FROZEN check is required, because the FREEZING bit is not cleared +* when the state FROZEN is reached. +*/ + state =task_freezer (task)->state; + ret = (state &CGROUP_FREEZING ) && !(state &CGROUP_FROZEN );rcu_read_unlock ();return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 114/194 checkstack: fix printed address
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <[email protected]>
commit ee34db3f271cea4d4252048617919c2caafe698b upstream.
All addresses printed by checkstack have an extra incorrect 0 appended at the end.
This was introduced with commit 677f1410e058 ("scripts/checkstack.pl: don't display $dre as different entity"): since then the address is taken from the line which contains the function name, instead of the line which contains stack consumption. E.g. on s390:
0000000000100a30 <do_one_initcall>:
...
100a44: e3 f0 ff 70 ff 71 lay %r15,-144(%r15)
So the used regex which matches spaces and hexadecimal numbers to extract an address now matches a different substring. Subsequently replacing spaces with 0 appends a zero at the and, instead of replacing leading spaces.
Fix this by using the proper regex, and simplify the code a bit.
--- scripts/checkstack.pl | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
scripts/checkstack.pl +2 -6
@@ -146,15 +146,11 @@ $total_size = 0; while (my $line = <STDIN>) { if ($line =~ m/$funcre/) { $func = $1; - next if $line !~ m/^($xs*)/; + next if $line !~ m/^($x*)/; if ($total_size > $min_stack) { push @stack, "$intro$total_size\n"; } - - $addr = $1; - $addr =~ s/ /0/g; - $addr = "0x$addr"; - + $addr = "0x$1"; $intro = "$addr $func [$file]:"; my $padlen = 56 - length($intro); while ($padlen > 0) {
Greg Kroah-Hartman
maintainerPATCH 115/194 tracing: Always update snapshot buffer size
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt (Google) <[email protected]>
commit 7be76461f302ec05cbd62b90b2a05c64299ca01f upstream.
It use to be that only the top level instance had a snapshot buffer (for latency tracers like wakeup and irqsoff). The update of the ring buffer size would check if the instance was the top level and if so, it would also update the snapshot buffer as it needs to be the same as the main buffer.
Now that lower level instances also has a snapshot buffer, they too need to update their snapshot buffer sizes when the main buffer is changed, otherwise the following can be triggered:
# cd /sys/kernel/tracing # echo 1500 > buffer_size_kb # mkdir instances/foo # echo irqsoff > instances/foo/current_tracer # echo 1000 > instances/foo/buffer_size_kb
Produces:
WARNING: CPU: 2 PID: 856 at kernel/trace/trace.c:1938 update_max_tr_single.part.0+0x27d/0x320
Which is:
ret = ring_buffer_swap_cpu(tr->max_buffer.buffer, tr->array_buffer.buffer, cpu);
if (ret == -EBUSY) {
[..]
}
WARN_ON_ONCE(ret && ret != -EAGAIN && ret != -EBUSY); <== hereThat's because ring_buffer_swap_cpu() has:
int ret = -EINVAL; [..] /* At least make sure the two buffers are somewhat the same */ if (cpu_buffer_a->nr_pages != cpu_buffer_b->nr_pages) goto out; [..] out: return ret;
}
Instead, update all instances' snapshot buffer sizes when their main buffer size is updated.
--- kernel/trace/trace.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
kernel/trace/trace.c +1 -2
@@ -6306,8 +6306,7 @@ static int __tracing_resize_ring_buffer(return ret;#ifdef CONFIG_TRACER_MAX_TRACE -if (!(tr->flags &TRACE_ARRAY_FL_GLOBAL ) || - !tr->current_trace->use_max_tr) +if (!tr->current_trace->use_max_tr) goto out; ret =ring_buffer_resize (tr->max_buffer.buffer, size, cpu);
Greg Kroah-Hartman
maintainerPATCH 116/194 tracing: Disable snapshot buffer when stopping instance tracers
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt (Google) <[email protected]>
commit b538bf7d0ec11ca49f536dfda742a5f6db90a798 upstream.
It use to be that only the top level instance had a snapshot buffer (for latency tracers like wakeup and irqsoff). When stopping a tracer in an instance would not disable the snapshot buffer. This could have some unintended consequences if the irqsoff tracer is enabled.
Consolidate the tracing_start/stop() with tracing_start/stop_tr() so that all instances behave the same. The tracing_start/stop() functions will just call their respective tracing_start/stop_tr() with the global_array passed in.
--- kernel/trace/trace.c | 110 +++++++++++++++------------------------------------ 1 file changed, 34 insertions(+), 76 deletions(-)
kernel/trace/trace.c +34 -76
@@ -2297,13 +2297,7 @@ int is_tracing_stopped(void)return global_trace.stop_count; } -/** -* tracing_start - quick start of the tracer -* -* If tracing is enabled but was stopped by tracing_stop, -* this will start the tracer back up. -*/ -void tracing_start (void ) +static void tracing_start_tr (struct trace_array *tr) {struct trace_buffer *buffer;unsigned long flags;
@@ -2311,119 +2305,83 @@ void tracing_start(void)if (tracing_disabled)return ; -raw_spin_lock_irqsave (&global_trace.start_lock, flags); -if (--global_trace.stop_count) { -if (global_trace.stop_count <0 ) { +raw_spin_lock_irqsave (&tr->start_lock, flags); +if (--tr->stop_count) { +if (WARN_ON_ONCE (tr->stop_count <0 )) {/* Someone screwed up their debugging */ -WARN_ON_ONCE (1 ); - global_trace.stop_count =0 ; + tr->stop_count =0 ; } goto out; }/* Prevent the buffers from switching */ -arch_spin_lock (&global_trace.max_lock); +arch_spin_lock (&tr->max_lock); - buffer = global_trace.array_buffer.buffer; + buffer = tr->array_buffer.buffer;if (buffer)ring_buffer_record_enable (buffer);#ifdef CONFIG_TRACER_MAX_TRACE - buffer = global_trace.max_buffer.buffer; + buffer = tr->max_buffer.buffer;if (buffer)ring_buffer_record_enable (buffer);#endif -arch_spin_unlock (&global_trace.max_lock); - - out: -raw_spin_unlock_irqrestore (&global_trace.start_lock, flags); -} - -static void tracing_start_tr (struct trace_array *tr) -{ -struct trace_buffer *buffer; -unsigned long flags; - -if (tracing_disabled) -return ; - -/* If global, we need to also start the max tracer */ -if (tr->flags &TRACE_ARRAY_FL_GLOBAL ) -return tracing_start (); - -raw_spin_lock_irqsave (&tr->start_lock, flags); - -if (--tr->stop_count) { -if (tr->stop_count <0 ) { -/* Someone screwed up their debugging */ -WARN_ON_ONCE (1 ); - tr->stop_count =0 ; - } - goto out; - } - - buffer = tr->array_buffer.buffer; -if (buffer) -ring_buffer_record_enable (buffer); +arch_spin_unlock (&tr->max_lock); out:raw_spin_unlock_irqrestore (&tr->start_lock, flags); }/** -* tracing_stop - quick stop of the tracer +* tracing_start - quick start of the tracer * -* Light weight way to stop tracing. Use in conjunction with -* tracing_start. +* If tracing is enabled but was stopped by tracing_stop, +* this will start the tracer back up. */ -void tracing_stop (void ) +void tracing_start (void ) + +{ +return tracing_start_tr (&global_trace); +} + +static void tracing_stop_tr (struct trace_array *tr) {struct trace_buffer *buffer;unsigned long flags; -raw_spin_lock_irqsave (&global_trace.start_lock, flags); -if (global_trace.stop_count++) +raw_spin_lock_irqsave (&tr->start_lock, flags); +if (tr->stop_count++) goto out;/* Prevent the buffers from switching */ -arch_spin_lock (&global_trace.max_lock); +arch_spin_lock (&tr->max_lock); - buffer = global_trace.array_buffer.buffer; + buffer = tr->array_buffer.buffer;if (buffer)ring_buffer_record_disable (buffer);#ifdef CONFIG_TRACER_MAX_TRACE - buffer = global_trace.max_buffer.buffer; + buffer = tr->max_buffer.buffer;if (buffer)ring_buffer_record_disable (buffer);#endif -arch_spin_unlock (&global_trace.max_lock); +arch_spin_unlock (&tr->max_lock); out: -raw_spin_unlock_irqrestore (&global_trace.start_lock, flags); +raw_spin_unlock_irqrestore (&tr->start_lock, flags); } -static void tracing_stop_tr (struct trace_array *tr) +/** +* tracing_stop - quick stop of the tracer +* +* Light weight way to stop tracing. Use in conjunction with +* tracing_start. +*/ +void tracing_stop (void ) { -struct trace_buffer *buffer; -unsigned long flags; - -/* If global, we need to also stop the max tracer */ -if (tr->flags &TRACE_ARRAY_FL_GLOBAL ) -return tracing_stop (); - -raw_spin_lock_irqsave (&tr->start_lock, flags); -if (tr->stop_count++) - goto out; - - buffer = tr->array_buffer.buffer; -if (buffer) -ring_buffer_record_disable (buffer); - - out: -raw_spin_unlock_irqrestore (&tr->start_lock, flags); +return tracing_stop_tr (&global_trace); }static int trace_save_cmdline (struct task_struct *tsk)
Greg Kroah-Hartman
maintainerPATCH 117/194 tracing: Fix incomplete locking when disabling buffered events
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Pavlu <[email protected]>
commit 7fed14f7ac9cf5e38c693836fe4a874720141845 upstream.
The following warning appears when using buffered events:
[ 203.556451] WARNING: CPU: 53 PID: 10220 at kernel/trace/ring_buffer.c:3912 ring_buffer_discard_commit+0x2eb/0x420 [...] [ 203.670690] CPU: 53 PID: 10220 Comm: stress-ng-sysin Tainted: G E 6.7.0-rc2-default #4 56e6d0fcf5581e6e51eaaecbdaec2a2338c80f3a [ 203.670704] Hardware name: Intel Corp. GROVEPORT/GROVEPORT, BIOS GVPRCRB1.86B.0016.D04.1705030402 05/03/2017 [ 203.670709] RIP: 0010:ring_buffer_discard_commit+0x2eb/0x420 [ 203.735721] Code: 4c 8b 4a 50 48 8b 42 48 49 39 c1 0f 84 b3 00 00 00 49 83 e8 01 75 b1 48 8b 42 10 f0 ff 40 08 0f 0b e9 fc fe ff ff f0 ff 47 08 <0f> 0b e9 77 fd ff ff 48 8b 42 10 f0 ff 40 08 0f 0b e9 f5 fe ff ff [ 203.735734] RSP: 0018:ffffb4ae4f7b7d80 EFLAGS: 00010202 [ 203.735745] RAX: 0000000000000000 RBX: ffffb4ae4f7b7de0 RCX: ffff8ac10662c000 [ 203.735754] RDX: ffff8ac0c750be00 RSI: ffff8ac10662c000 RDI: ffff8ac0c004d400 [ 203.781832] RBP: ffff8ac0c039cea0 R08: 0000000000000000 R09: 0000000000000000 [ 203.781839] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 203.781842] R13: ffff8ac10662c000 R14: ffff8ac0c004d400 R15: ffff8ac10662c008 [ 203.781846] FS: 00007f4cd8a67740(0000) GS:ffff8ad798880000(0000) knlGS:0000000000000000 [ 203.781851] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 203.781855] CR2: 0000559766a74028 CR3: 00000001804c4000 CR4: 00000000001506f0 [ 203.781862] Call Trace: [ 203.781870] <TASK> [ 203.851949] trace_event_buffer_commit+0x1ea/0x250 [ 203.851967] trace_event_raw_event_sys_enter+0x83/0xe0 [ 203.851983] syscall_trace_enter.isra.0+0x182/0x1a0 [ 203.851990] do_syscall_64+0x3a/0xe0 [ 203.852075] entry_SYSCALL_64_after_hwframe+0x6e/0x76 [ 203.852090] RIP: 0033:0x7f4cd870fa77 [ 203.982920] Code: 00 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 90 b8 89 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d e9 43 0e 00 f7 d8 64 89 01 48 [ 203.982932] RSP: 002b:00007fff99717dd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000089 [ 203.982942] RAX: ffffffffffffffda RBX: 0000558ea1d7b6f0 RCX: 00007f4cd870fa77 [ 203.982948] RDX: 0000000000000000 RSI: 00007fff99717de0 RDI: 0000558ea1d7b6f0 [ 203.982957] RBP: 00007fff99717de0 R08: 00007fff997180e0 R09: 00007fff997180e0 [ 203.982962] R10: 00007fff997180e0 R11: 0000000000000246 R12: 00007fff99717f40 [ 204.049239] R13: 00007fff99718590 R14: 0000558e9f2127a8 R15: 00007fff997180b0 [ 204.049256] </TASK>
For instance, it can be triggered by running these two commands in parallel:
$ while true; do
echo hist:key=id.syscall:val=hitcount > \
/sys/kernel/debug/tracing/events/raw_syscalls/sys_enter/trigger;
done
$ stress-ng --sysinfo $(nproc)The warning indicates that the current ring_buffer_per_cpu is not in the committing state. It happens because the active ring_buffer_event doesn't actually come from the ring_buffer_per_cpu but is allocated from trace_buffered_event.
The bug is in function trace_buffered_event_disable() where the following normally happens:
* The code invokes disable_trace_buffered_event() via smp_call_function_many() and follows it by synchronize_rcu(). This increments the per-CPU variable trace_buffered_event_cnt on each target CPU and grants trace_buffered_event_disable() the exclusive access to the per-CPU variable trace_buffered_event.
* Maintenance is performed on trace_buffered_event, all per-CPU event buffers get freed.
* The code invokes enable_trace_buffered_event() via smp_call_function_many(). This decrements trace_buffered_event_cnt and releases the access to trace_buffered_event.
A problem is that smp_call_function_many() runs a given function on all target CPUs except on the current one. The following can then occur:
* Task X executing trace_buffered_event_disable() runs on CPU 0.
* The control reaches synchronize_rcu() and the task gets rescheduled on another CPU 1.
* The RCU synchronization finishes. At this point, trace_buffered_event_disable() has the exclusive access to all trace_buffered_event variables except trace_buffered_event[CPU0] because trace_buffered_event_cnt[CPU0] is never incremented and if the buffer is currently unused, remains set to 0.
* A different task Y is scheduled on CPU 0 and hits a trace event. The code in trace_event_buffer_lock_reserve() sees that trace_buffered_event_cnt[CPU0] is set to 0 and decides the use the buffer provided by trace_buffered_event[CPU0].
* Task X continues its execution in trace_buffered_event_disable(). The code incorrectly frees the event buffer pointed by trace_buffered_event[CPU0] and resets the variable to NULL.
* Task Y writes event data to the now freed buffer and later detects the created inconsistency.
The issue is observable since commit dea499781a11 ("tracing: Fix warning in trace_buffered_event_disable()") which moved the call of trace_buffered_event_disable() in __ftrace_event_enable_disable() earlier, prior to invoking call->class->reg(.. TRACE_REG_UNREGISTER ..). The underlying problem in trace_buffered_event_disable() is however present since the original implementation in commit 0fc1b09ff1ff ("tracing: Use temp buffer when filtering events").
Fix the problem by replacing the two smp_call_function_many() calls with on_each_cpu_mask() which invokes a given callback on all CPUs.
--- kernel/trace/trace.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-)
kernel/trace/trace.c +4 -8
@@ -2717,11 +2717,9 @@ void trace_buffered_event_disable(void)if (--trace_buffered_event_ref)return ; -preempt_disable ();/* For each CPU, set the buffer as used. */ -smp_call_function_many (tracing_buffer_mask, - disable_trace_buffered_event,NULL ,1 ); -preempt_enable (); +on_each_cpu_mask (tracing_buffer_mask, disable_trace_buffered_event, +NULL , true);/* Wait for all current users to finish */ synchronize_rcu ();
@@ -2736,11 +2734,9 @@ void trace_buffered_event_disable(void)*/ smp_wmb (); -preempt_disable ();/* Do the work on each cpu */ -smp_call_function_many (tracing_buffer_mask, - enable_trace_buffered_event,NULL ,1 ); -preempt_enable (); +on_each_cpu_mask (tracing_buffer_mask, enable_trace_buffered_event,NULL , + true); }static struct trace_buffer *temp_buffer;
Greg Kroah-Hartman
maintainerPATCH 118/194 tracing: Fix a possible race when disabling buffered events
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Pavlu <[email protected]>
commit c0591b1cccf708a47bc465c62436d669a4213323 upstream.
Function trace_buffered_event_disable() is responsible for freeing pages backing buffered events and this process can run concurrently with trace_event_buffer_lock_reserve().
The following race is currently possible:
* Function trace_buffered_event_disable() is called on CPU 0. It increments trace_buffered_event_cnt on each CPU and waits via synchronize_rcu() for each user of trace_buffered_event to complete.
* After synchronize_rcu() is finished, function trace_buffered_event_disable() has the exclusive access to trace_buffered_event. All counters trace_buffered_event_cnt are at 1 and all pointers trace_buffered_event are still valid.
* At this point, on a different CPU 1, the execution reaches trace_event_buffer_lock_reserve(). The function calls preempt_disable_notrace() and only now enters an RCU read-side critical section. The function proceeds and reads a still valid pointer from trace_buffered_event[CPU1] into the local variable "entry". However, it doesn't yet read trace_buffered_event_cnt[CPU1] which happens later.
* Function trace_buffered_event_disable() continues. It frees trace_buffered_event[CPU1] and decrements trace_buffered_event_cnt[CPU1] back to 0.
* Function trace_event_buffer_lock_reserve() continues. It reads and increments trace_buffered_event_cnt[CPU1] from 0 to 1. This makes it believe that it can use the "entry" that it already obtained but the pointer is now invalid and any access results in a use-after-free.
Fix the problem by making a second synchronize_rcu() call after all trace_buffered_event values are set to NULL. This waits on all potential users in trace_event_buffer_lock_reserve() that still read a previous pointer from trace_buffered_event.
--- kernel/trace/trace.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
kernel/trace/trace.c +8 -4
@@ -2728,13 +2728,17 @@ void trace_buffered_event_disable(void)free_page ((unsigned long )per_cpu (trace_buffered_event, cpu));per_cpu (trace_buffered_event, cpu) =NULL ; } +/* -* Make sure trace_buffered_event is NULL before clearing -* trace_buffered_event_cnt. +* Wait for all CPUs that potentially started checking if they can use +* their event buffer only after the previous synchronize_rcu() call and +* they still read a valid pointer from trace_buffered_event. It must be +* ensured they don't see cleared trace_buffered_event_cnt else they +* could wrongly decide to use the pointed-to buffer which is now freed. */ -smp_wmb (); +synchronize_rcu (); -/* Do the work on each cpu */ +/* For each CPU, relinquish the buffer */ on_each_cpu_mask (tracing_buffer_mask, enable_trace_buffered_event,NULL , true); }
Greg Kroah-Hartman
maintainerPATCH 119/194 packet: Move reference count in packet_sock to atomic_long_t
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
commit db3fadacaf0c817b222090290d06ca2a338422d0 upstream.
In some potential instances the reference count on struct packet_sock could be saturated and cause overflows which gets the kernel a bit confused. To prevent this, move to a 64-bit atomic reference count on 64-bit architectures to prevent the possibility of this type to overflow.
Because we can not handle saturation, using refcount_t is not possible in this place. Maybe someday in the future if it changes it could be used. Also, instead of using plain atomic64_t, use atomic_long_t instead. 32-bit machines tend to be memory-limited (i.e. anything that increases a reference uses so much memory that you can't actually get to 2**32 references). 32-bit architectures also tend to have serious problems with 64-bit atomics. Hence, atomic_long_t is the more natural solution.
--- net/packet/af_packet.c | 16 ++++++++-------- net/packet/internal.h | 2 +- 2 files changed, 9 insertions(+), 9 deletions(-)
net/packet/af_packet.c +8 -8
@@ -4275,7 +4275,7 @@ static void packet_mm_open(struct vm_arestruct sock *sk = sock->sk;if (sk) -atomic_inc (&pkt_sk (sk)->mapped); +atomic_long_inc (&pkt_sk (sk)->mapped); }static void packet_mm_close (struct vm_area_struct *vma)
@@ -4285,7 +4285,7 @@ static void packet_mm_close(struct vm_arstruct sock *sk = sock->sk;if (sk) -atomic_dec (&pkt_sk (sk)->mapped); +atomic_long_dec (&pkt_sk (sk)->mapped); }static const struct vm_operations_struct packet_mmap_ops = {
@@ -4380,7 +4380,7 @@ static int packet_set_ring(struct sock * err = -EBUSY ;if (!closing) { -if (atomic_read (&po->mapped)) +if (atomic_long_read (&po->mapped)) goto out;if (packet_read_pending (rb)) goto out;
@@ -4483,7 +4483,7 @@ static int packet_set_ring(struct sock * err = -EBUSY ;mutex_lock (&po->pg_vec_lock); -if (closing ||atomic_read (&po->mapped) ==0 ) { +if (closing ||atomic_long_read (&po->mapped) ==0 ) { err =0 ;spin_lock_bh (&rb_queue->lock);swap (rb->pg_vec, pg_vec);
@@ -4501,9 +4501,9 @@ static int packet_set_ring(struct sock * po->prot_hook.func = (po->rx_ring.pg_vec) ? tpacket_rcv : packet_rcv;skb_queue_purge (rb_queue); -if (atomic_read (&po->mapped)) -pr_err ("packet_mmap: vma is busy: %d\n" , -atomic_read (&po->mapped)); +if (atomic_long_read (&po->mapped)) +pr_err ("packet_mmap: vma is busy: %ld\n" , +atomic_long_read (&po->mapped)); }mutex_unlock (&po->pg_vec_lock);
@@ -4581,7 +4581,7 @@ static int packet_mmap(struct file *file } } -atomic_inc (&po->mapped); +atomic_long_inc (&po->mapped); vma->vm_ops = &packet_mmap_ops; err =0 ;
net/packet/internal.h +1 -1
@@ -126,7 +126,7 @@ struct packet_sock {__be16 num;struct packet_rollover *rollover;struct packet_mclist *mclist; -atomic_t mapped; +atomic_long_t mapped;enum tpacket_versions tp_version;unsigned int tp_hdrlen;unsigned int tp_reserve;
Greg Kroah-Hartman
maintainerPATCH 120/194 r8169: fix rtl8125b PAUSE frames blasting when suspended
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: ChunHao Lin <[email protected]>
commit 4b0768b6556af56ee9b7cf4e68452a2b6289ae45 upstream.
When FIFO reaches near full state, device will issue pause frame. If pause slot is enabled(set to 1), in this time, device will issue pause frame only once. But if pause slot is disabled(set to 0), device will keep sending pause frames until FIFO reaches near empty state.
When pause slot is disabled, if there is no one to handle receive packets, device FIFO will reach near full state and keep sending pause frames. That will impact entire local area network.
This issue can be reproduced in Chromebox (not Chromebook) in developer mode running a test image (and v5.10 kernel):
1) ping -f $CHROMEBOX (from workstation on same local network)
2) run "powerd_dbus_suspend" from command line on the $CHROMEBOX
3) ping $ROUTER (wait until ping fails from workstation)
Takes about ~20-30 seconds after step 2 for the local network to stop working.
Fix this issue by enabling pause slot to only send pause frame once when FIFO reaches near full state.
--- drivers/net/ethernet/realtek/r8169_main.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/net/ethernet/realtek/r8169_main.c +6 -1
@@ -193,6 +193,7 @@ enum rtl_registers {/* No threshold before first PCI xfer */ #define RX_FIFO_THRESH (7 << RXCFG_FIFO_SHIFT)#define RX_EARLY_OFF (1 << 11) +#define RX_PAUSE_SLOT_ON (1 << 11)/* 8125b and later */ #define RXCFG_DMA_SHIFT 8/* Unlimited maximum PCI burst. */ #define RX_DMA_BURST (7 << RXCFG_DMA_SHIFT)
@@ -2237,9 +2238,13 @@ static void rtl_init_rxcfg(struct rtl816 case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_53:RTL_W32 (tp, RxConfig,RX128_INT_EN |RX_MULTI_EN |RX_DMA_BURST |RX_EARLY_OFF );break ; - case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_63: +case RTL_GIGA_MAC_VER_61 :RTL_W32 (tp, RxConfig,RX_FETCH_DFLT_8125 |RX_DMA_BURST );break ; +case RTL_GIGA_MAC_VER_63 : +RTL_W32 (tp, RxConfig,RX_FETCH_DFLT_8125 |RX_DMA_BURST | +RX_PAUSE_SLOT_ON ); +break ;default :RTL_W32 (tp, RxConfig,RX128_INT_EN |RX_DMA_BURST );break ;
Greg Kroah-Hartman
maintainerPATCH 121/194 regmap: fix bogus error on regcache_sync success
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthias Reichl <[email protected]>
commit fea88064445a59584460f7f67d102b6e5fc1ca1d upstream.
Since commit 0ec7731655de ("regmap: Ensure range selector registers are updated after cache sync") opening pcm512x based soundcards fail with EINVAL and dmesg shows sync cache and pm_runtime_get errors:
[ 228.794676] pcm512x 1-004c: Failed to sync cache: -22 [ 228.794740] pcm512x 1-004c: ASoC: error at snd_soc_pcm_component_pm_runtime_get on pcm512x.1-004c: -22
This is caused by the cache check result leaking out into the regcache_sync return value.
Fix this by making the check local-only, as the comment above the regcache_read call states a non-zero return value means there's nothing to do so the return value should not be altered.
--- drivers/base/regmap/regcache.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/base/regmap/regcache.c +1 -2
@@ -410,8 +410,7 @@ out: rb_entry(node, struct regmap_range_node, node);/* If there's nothing in the cache there's nothing to sync */ - ret =regcache_read (map, this->selector_reg, &i); -if (ret !=0 ) +if (regcache_read (map, this->selector_reg, &i) !=0 )continue ; ret =_regmap_write (map, this->selector_reg, i);
Greg Kroah-Hartman
maintainerPATCH 122/194 platform/surface: aggregator: fix recv_buf() return value
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Dolcini <[email protected]>
commit c8820c92caf0770bec976b01fa9e82bb993c5865 upstream.
Serdev recv_buf() callback is supposed to return the amount of bytes consumed, therefore an int in between 0 and count.
Do not return negative number in case of issue, when ssam_controller_receive_buf() returns ESHUTDOWN just returns 0, e.g. no bytes consumed, this keep the exact same behavior as it was before.
This fixes a potential WARN in serdev-ttyport.c:ttyport_receive_buf().
--- drivers/platform/surface/aggregator/core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/platform/surface/aggregator/core.c +4 -1
@@ -231,9 +231,12 @@ static int ssam_receive_buf(struct serde size_t n) {struct ssam_controller *ctrl; +int ret; ctrl =serdev_device_get_drvdata (dev); -return ssam_controller_receive_buf (ctrl, buf, n); + ret =ssam_controller_receive_buf (ctrl, buf, n); + +return ret <0 ?0 : ret; }static void ssam_write_wakeup (struct serdev_device *dev)
Greg Kroah-Hartman
maintainerPATCH 123/194 hugetlb: fix null-ptr-deref in hugetlb_vma_lock_write
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Kravetz <[email protected]>
commit 187da0f8250aa94bd96266096aef6f694e0b4cd2 upstream.
The routine __vma_private_lock tests for the existence of a reserve map associated with a private hugetlb mapping. A pointer to the reserve map is in vma->vm_private_data. __vma_private_lock was checking the pointer for NULL. However, it is possible that the low bits of the pointer could be used as flags. In such instances, vm_private_data is not NULL and not a valid pointer. This results in the null-ptr-deref reported by syzbot:
general protection fault, probably for non-canonical address 0xdffffc000000001d: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef] CPU: 0 PID: 5048 Comm: syz-executor139 Not tainted 6.6.0-rc7-syzkaller-00142-g88 8cf78c29e2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 1 0/09/2023 RIP: 0010:__lock_acquire+0x109/0x5de0 kernel/locking/lockdep.c:5004 ... Call Trace: <TASK> lock_acquire kernel/locking/lockdep.c:5753 [inline] lock_acquire+0x1ae/0x510 kernel/locking/lockdep.c:5718 down_write+0x93/0x200 kernel/locking/rwsem.c:1573 hugetlb_vma_lock_write mm/hugetlb.c:300 [inline] hugetlb_vma_lock_write+0xae/0x100 mm/hugetlb.c:291 __hugetlb_zap_begin+0x1e9/0x2b0 mm/hugetlb.c:5447 hugetlb_zap_begin include/linux/hugetlb.h:258 [inline] unmap_vmas+0x2f4/0x470 mm/memory.c:1733 exit_mmap+0x1ad/0xa60 mm/mmap.c:3230 __mmput+0x12a/0x4d0 kernel/fork.c:1349 mmput+0x62/0x70 kernel/fork.c:1371 exit_mm kernel/exit.c:567 [inline] do_exit+0x9ad/0x2a20 kernel/exit.c:861 __do_sys_exit kernel/exit.c:991 [inline] __se_sys_exit kernel/exit.c:989 [inline] __x64_sys_exit+0x42/0x50 kernel/exit.c:989 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
Mask off low bit flags before checking for NULL pointer. In addition, the reserve map only 'belongs' to the OWNER (parent in parent/child relationships) so also check for the OWNER flag.
--- include/linux/hugetlb.h | 5 +---- mm/hugetlb.c | 7 +++++++ 2 files changed, 8 insertions(+), 4 deletions(-)
include/linux/hugetlb.h +1 -4
@@ -880,10 +880,7 @@ static inline bool hugepage_migration_sureturn arch_hugetlb_migration_supported (h); } -static inline bool __vma_private_lock (struct vm_area_struct *vma) -{ -return (!(vma->vm_flags &VM_MAYSHARE )) && vma->vm_private_data; -} +bool __vma_private_lock (struct vm_area_struct *vma);/* * Movability check is different as compared to migration check.
mm/hugetlb.c +7 -0
@@ -1189,6 +1189,13 @@ static int is_vma_resv_set(struct vm_arereturn (get_vma_private_data (vma) & flag) !=0 ; } +bool __vma_private_lock (struct vm_area_struct *vma) +{ +return !(vma->vm_flags &VM_MAYSHARE ) && +get_vma_private_data (vma) & ~HPAGE_RESV_MASK && +is_vma_resv_set (vma,HPAGE_RESV_OWNER ); +} +void hugetlb_dup_vma_private (struct vm_area_struct *vma) {VM_BUG_ON_VMA (!is_vm_hugetlb_page (vma), vma);
Greg Kroah-Hartman
maintainerPATCH 124/194 mm: fix oops when filemap_map_pmd() without prealloc_pte
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hugh Dickins <[email protected]>
commit 9aa1345d66b8132745ffb99b348b1492088da9e2 upstream.
syzbot reports oops in lockdep's __lock_acquire(), called from __pte_offset_map_lock() called from filemap_map_pages(); or when I run the repro, the oops comes in pmd_install(), called from filemap_map_pmd() called from filemap_map_pages(), just before the __pte_offset_map_lock().
The problem is that filemap_map_pmd() has been assuming that when it finds pmd_none(), a page table has already been prepared in prealloc_pte; and indeed do_fault_around() has been careful to preallocate one there, when it finds pmd_none(): but what if *pmd became none in between?
My 6.6 mods in mm/khugepaged.c, avoiding mmap_lock for write, have made it easy for *pmd to be cleared while servicing a page fault; but even before those, a huge *pmd might be zapped while a fault is serviced.
The difference in symptomatic stack traces comes from the "memory model" in use: pmd_install() uses pmd_populate() uses page_to_pfn(): in some models that is strict, and will oops on the NULL prealloc_pte; in other models, it will construct a bogus value to be populated into *pmd, then __pte_offset_map_lock() oops when trying to access split ptlock pointer (or some other symptom in normal case of ptlock embedded not pointer).
--- mm/filemap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/filemap.c +1 -1
@@ -3319,7 +3319,7 @@ static bool filemap_map_pmd(struct vm_fa } } -if (pmd_none (*vmf->pmd)) +if (pmd_none (*vmf->pmd) && vmf->prealloc_pte)pmd_install (mm, vmf->pmd, &vmf->prealloc_pte);/* See comment in handle_pte_fault() */
Greg Kroah-Hartman
maintainerPATCH 125/194 powercap: DTPM: Fix missing cpufreq_cpu_put() calls
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukasz Luba <[email protected]>
commit bdefd9913bdd453991ef756b6f7176e8ad80d786 upstream.
The policy returned by cpufreq_cpu_get() has to be released with the help of cpufreq_cpu_put() to balance its kobject reference counter properly.
Add the missing calls to cpufreq_cpu_put() in the code.
--- drivers/powercap/dtpm_cpu.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-)
drivers/powercap/dtpm_cpu.c +13 -4
@@ -140,6 +140,8 @@ static void pd_release(struct dtpm *dtpmif (policy) {for_each_cpu (dtpm_cpu->cpu, policy->related_cpus)per_cpu (dtpm_per_cpu, dtpm_cpu->cpu) =NULL ; + +cpufreq_cpu_put (policy); }kfree (dtpm_cpu);
@@ -191,12 +193,16 @@ static int __dtpm_cpu_setup(int cpu, strreturn 0 ; pd =em_cpu_get (cpu); -if (!pd ||em_is_artificial (pd)) -return -EINVAL ; +if (!pd ||em_is_artificial (pd)) { + ret = -EINVAL ; + goto release_policy; + } dtpm_cpu =kzalloc (sizeof (*dtpm_cpu),GFP_KERNEL ); -if (!dtpm_cpu) -return -ENOMEM ; +if (!dtpm_cpu) { + ret = -ENOMEM ; + goto release_policy; + }dtpm_init (&dtpm_cpu->dtpm, &dtpm_ops); dtpm_cpu->cpu = cpu;
@@ -216,6 +222,7 @@ static int __dtpm_cpu_setup(int cpu, strif (ret) goto out_dtpm_unregister; +cpufreq_cpu_put (policy);return 0 ; out_dtpm_unregister:
@@ -227,6 +234,8 @@ out_kfree_dtpm_cpu:per_cpu (dtpm_per_cpu, cpu) =NULL ;kfree (dtpm_cpu); +release_policy: +cpufreq_cpu_put (policy);return ret; }
Greg Kroah-Hartman
maintainerPATCH 126/194 md/raid6: use valid sector values to determine if an I/O should wait on the reshape
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Jeffery <[email protected]>
commit c467e97f079f0019870c314996fae952cc768e82 upstream.
During a reshape or a RAID6 array such as expanding by adding an additional disk, I/Os to the region of the array which have not yet been reshaped can stall indefinitely. This is from errors in the stripe_ahead_of_reshape function causing md to think the I/O is to a region in the actively undergoing the reshape.
stripe_ahead_of_reshape fails to account for the q disk having a sector value of 0. By not excluding the q disk from the for loop, raid6 will always generate a min_sector value of 0, causing a return value which stalls.
The function's max_sector calculation also uses min() when it should use max(), causing the max_sector value to always be 0. During a backwards rebuild this can cause the opposite problem where it allows I/O to advance when it should wait.
Fixing these errors will allow safe I/O to advance in a timely manner and delay only I/O which is unsafe due to stripes in the middle of undergoing the reshape.
--- drivers/md/raid5.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/md/raid5.c +2 -2
@@ -5905,11 +5905,11 @@ static bool stripe_ahead_of_reshape(struint dd_idx;for (dd_idx =0 ; dd_idx < sh->disks; dd_idx++) { -if (dd_idx == sh->pd_idx) +if (dd_idx == sh->pd_idx || dd_idx == sh->qd_idx)continue ; min_sector =min (min_sector, sh->dev[dd_idx].sector); - max_sector =min (max_sector, sh->dev[dd_idx].sector); + max_sector =max (max_sector, sh->dev[dd_idx].sector); }spin_lock_irq (&conf->device_lock);
Greg Kroah-Hartman
maintainerPATCH 127/194 arm64: dts: mediatek: mt7622: fix memory node warning check
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eugen Hristev <[email protected]>
commit 8e6ecbfd44b5542a7598c1c5fc9c6dcb5d367f2a upstream.
dtbs_check throws a warning at the memory node:
Warning (unit_address_vs_reg): /memory: node has a reg or ranges property, but no unit name
fix by adding the address into the node name.
--- arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts | 2 +- arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts +1 -1
@@ -72,7 +72,7 @@ }; }; - memory { + memory@40000000 { reg = <0 0x40000000 0 0x40000000>; };
arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts +1 -1
@@ -54,7 +54,7 @@ }; }; - memory { + memory@40000000 { reg = <0 0x40000000 0 0x20000000>; };
Greg Kroah-Hartman
maintainerPATCH 128/194 arm64: dts: mediatek: mt8183-kukui-jacuzzi: fix dsi unnecessary cells properties
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eugen Hristev <[email protected]>
commit 74543b303a9abfe4fa253d1fa215281baa05ff3a upstream.
dtbs_check throws a warning at the dsi node:
Warning (avoid_unnecessary_addr_size): /soc/dsi@14014000: unnecessary #address-cells/#size-cells without "ranges" or child "reg" property
Other DTS have a panel child node with a reg, so the parent dtsi must have the address-cells and size-cells, however this specific DT has the panel removed, but not the cells, hence the warning above.
If panel is deleted then the cells must also be deleted since they are tied together, as the child node in this DT does not have a reg.
--- arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi +2 -0
@@ -101,6 +101,8 @@ &dsi0 { status = "okay"; + /delete-property/#size-cells; + /delete-property/#address-cells; /delete-node/panel@0; ports { port {
Greg Kroah-Hartman
maintainerPATCH 129/194 arm64: dts: mediatek: cherry: Fix interrupt cells for MT6360 on I2C7
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <[email protected]>
commit 5943b8f7449df9881b273db07bdde1e7120dccf0 upstream.
Change interrupt cells to 2 to suppress interrupts_property warning.
--- arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi +1 -1
@@ -207,7 +207,7 @@ pinctrl-0 = <&i2c7_pins>; pmic@34 { - #interrupt-cells = <1>; + #interrupt-cells = <2>; compatible = "mediatek,mt6360"; reg = <0x34>; interrupt-controller;
Greg Kroah-Hartman
maintainerPATCH 130/194 arm64: dts: mediatek: mt8173-evb: Fix regulator-fixed node names
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <[email protected]>
commit 24165c5dad7ba7c7624d05575a5e0cc851396c71 upstream.
Fix a unit_address_vs_reg warning for the USB VBUS fixed regulators by renaming the regulator nodes from regulator@{0,1} to regulator-usb-p0 and regulator-usb-p1.
--- arch/arm64/boot/dts/mediatek/mt8173-evb.dts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/mediatek/mt8173-evb.dts +2 -2
@@ -43,7 +43,7 @@ id-gpio = <&pio 16 GPIO_ACTIVE_HIGH>; }; - usb_p1_vbus: regulator@0 { + usb_p1_vbus: regulator-usb-p1 { compatible = "regulator-fixed"; regulator-name = "usb_vbus"; regulator-min-microvolt = <5000000>;
@@ -52,7 +52,7 @@ enable-active-high; }; - usb_p0_vbus: regulator@1 { + usb_p0_vbus: regulator-usb-p0 { compatible = "regulator-fixed"; regulator-name = "vbus"; regulator-min-microvolt = <5000000>;
Greg Kroah-Hartman
maintainerPATCH 131/194 arm64: dts: mediatek: mt8195: Fix PM suspend/resume with venc clocks
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <[email protected]>
commit 61b94d54421a1f3670ddd5396ec70afe833e9405 upstream.
Before suspending the LARBs we're making sure that any operation is
done: this never happens because we are unexpectedly unclocking the LARB20 before executing the suspend handler for the MediaTek Smart Multimedia Interface (SMI) and the cause of this is incorrect clocks on this LARB.
Fix this issue by changing the Local Arbiter 20 (used by the video encoder secondary core) apb clock to CLK_VENC_CORE1_VENC; furthermore, in order to make sure that both the PM resume and video encoder operation is stable, add the CLK_VENC(_CORE1)_LARB clock to the VENC (main core) and VENC_CORE1 power domains, as this IP cannot communicate with the rest of the system (the AP) without local arbiter clocks being operational.
--- arch/arm64/boot/dts/mediatek/mt8195.dtsi | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
arch/arm64/boot/dts/mediatek/mt8195.dtsi +5 -1
@@ -471,6 +471,8 @@ power-domain@MT8195_POWER_DOMAIN_VENC_CORE1 { reg = <MT8195_POWER_DOMAIN_VENC_CORE1>; + clocks = <&vencsys_core1 CLK_VENC_CORE1_LARB>; + clock-names = "venc1-larb"; mediatek,infracfg = <&infracfg_ao>; #power-domain-cells = <0>; };
@@ -533,6 +535,8 @@ power-domain@MT8195_POWER_DOMAIN_VENC { reg = <MT8195_POWER_DOMAIN_VENC>; + clocks = <&vencsys CLK_VENC_LARB>; + clock-names = "venc0-larb"; mediatek,infracfg = <&infracfg_ao>; #power-domain-cells = <0>; };
@@ -1985,7 +1989,7 @@ reg = <0 0x1b010000 0 0x1000>; mediatek,larb-id = <20>; mediatek,smi = <&smi_common_vpp>; - clocks = <&vencsys_core1 CLK_VENC_CORE1_LARB>, + clocks = <&vencsys_core1 CLK_VENC_CORE1_VENC>, <&vencsys_core1 CLK_VENC_CORE1_GALS>, <&vppsys0 CLK_VPP0_GALS_VDO0_VDO1_VENCSYS_CORE1>; clock-names = "apb", "smi", "gals";
Greg Kroah-Hartman
maintainerPATCH 132/194 arm64: dts: mediatek: mt8183: Fix unit address for scp reserved memory
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <[email protected]>
commit 19cba9a6c071db57888dc6b2ec1d9bf8996ea681 upstream.
The reserved memory for scp had node name "scp_mem_region" and also without unit-address: change the name to "memory@(address)". This fixes a unit_address_vs_reg warning.
--- arch/arm64/boot/dts/mediatek/mt8183-evb.dts | 2 +- arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/mediatek/mt8183-evb.dts +1 -1
@@ -30,7 +30,7 @@ #address-cells = <2>; #size-cells = <2>; ranges; - scp_mem_reserved: scp_mem_region { + scp_mem_reserved: memory@50000000 { compatible = "shared-dma-pool"; reg = <0 0x50000000 0 0x2900000>; no-map;
arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi +1 -1
@@ -108,7 +108,7 @@ #size-cells = <2>; ranges; - scp_mem_reserved: scp_mem_region { + scp_mem_reserved: memory@50000000 { compatible = "shared-dma-pool"; reg = <0 0x50000000 0 0x2900000>; no-map;
Greg Kroah-Hartman
maintainerPATCH 133/194 arm64: dts: mediatek: mt8183: Move thermal-zones to the root node
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <[email protected]>
commit 5a60d63439694590cd5ab1f998fc917ff7ba1c1d upstream.
The thermal zones are not a soc bus device: move it to the root node to solve simple_bus_reg warnings.
--- arch/arm64/boot/dts/mediatek/mt8183.dtsi | 242 +++++++++++++++---------------- 1 file changed, 121 insertions(+), 121 deletions(-)
arch/arm64/boot/dts/mediatek/mt8183.dtsi +121 -121
@@ -1136,127 +1136,6 @@ nvmem-cell-names = "calibration-data"; }; - thermal_zones: thermal-zones { - cpu_thermal: cpu-thermal { - polling-delay-passive = <100>; - polling-delay = <500>; - thermal-sensors = <&thermal 0>; - sustainable-power = <5000>; - - trips { - threshold: trip-point0 { - temperature = <68000>; - hysteresis = <2000>; - type = "passive"; - }; - - target: trip-point1 { - temperature = <80000>; - hysteresis = <2000>; - type = "passive"; - }; - - cpu_crit: cpu-crit { - temperature = <115000>; - hysteresis = <2000>; - type = "critical"; - }; - }; - - cooling-maps { - map0 { - trip = <&target>; - cooling-device = <&cpu0 - THERMAL_NO_LIMIT - THERMAL_NO_LIMIT>, - <&cpu1 - THERMAL_NO_LIMIT - THERMAL_NO_LIMIT>, - <&cpu2 - THERMAL_NO_LIMIT - THERMAL_NO_LIMIT>, - <&cpu3 - THERMAL_NO_LIMIT - THERMAL_NO_LIMIT>; - contribution = <3072>; - }; - map1 { - trip = <&target>; - cooling-device = <&cpu4 - THERMAL_NO_LIMIT - THERMAL_NO_LIMIT>, - <&cpu5 - THERMAL_NO_LIMIT - THERMAL_NO_LIMIT>, - <&cpu6 - THERMAL_NO_LIMIT - THERMAL_NO_LIMIT>, - <&cpu7 - THERMAL_NO_LIMIT - THERMAL_NO_LIMIT>; - contribution = <1024>; - }; - }; - }; - - /* The tzts1 ~ tzts6 don't need to polling */ - /* The tzts1 ~ tzts6 don't need to thermal throttle */ - - tzts1: tzts1 { - polling-delay-passive = <0>; - polling-delay = <0>; - thermal-sensors = <&thermal 1>; - sustainable-power = <5000>; - trips {}; - cooling-maps {}; - }; - - tzts2: tzts2 { - polling-delay-passive = <0>; - polling-delay = <0>; - thermal-sensors = <&thermal 2>; - sustainable-power = <5000>; - trips {}; - cooling-maps {}; - }; - - tzts3: tzts3 { - polling-delay-passive = <0>; - polling-delay = <0>; - thermal-sensors = <&thermal 3>; - sustainable-power = <5000>; - trips {}; - cooling-maps {}; - }; - - tzts4: tzts4 { - polling-delay-passive = <0>; - polling-delay = <0>; - thermal-sensors = <&thermal 4>; - sustainable-power = <5000>; - trips {}; - cooling-maps {}; - }; - - tzts5: tzts5 { - polling-delay-passive = <0>; - polling-delay = <0>; - thermal-sensors = <&thermal 5>; - sustainable-power = <5000>; - trips {}; - cooling-maps {}; - }; - - tztsABB: tztsABB { - polling-delay-passive = <0>; - polling-delay = <0>; - thermal-sensors = <&thermal 6>; - sustainable-power = <5000>; - trips {}; - cooling-maps {}; - }; - }; - pwm0: pwm@1100e000 { compatible = "mediatek,mt8183-disp-pwm"; reg = <0 0x1100e000 0 0x1000>;
@@ -2031,4 +1910,125 @@ power-domains = <&spm MT8183_POWER_DOMAIN_CAM>; }; }; + + thermal_zones: thermal-zones { + cpu_thermal: cpu-thermal { + polling-delay-passive = <100>; + polling-delay = <500>; + thermal-sensors = <&thermal 0>; + sustainable-power = <5000>; + + trips { + threshold: trip-point0 { + temperature = <68000>; + hysteresis = <2000>; + type = "passive"; + }; + + target: trip-point1 { + temperature = <80000>; + hysteresis = <2000>; + type = "passive"; + }; + + cpu_crit: cpu-crit { + temperature = <115000>; + hysteresis = <2000>; + type = "critical"; + }; + }; + + cooling-maps { + map0 { + trip = <&target>; + cooling-device = <&cpu0 + THERMAL_NO_LIMIT + THERMAL_NO_LIMIT>, + <&cpu1 + THERMAL_NO_LIMIT + THERMAL_NO_LIMIT>, + <&cpu2 + THERMAL_NO_LIMIT + THERMAL_NO_LIMIT>, + <&cpu3 + THERMAL_NO_LIMIT + THERMAL_NO_LIMIT>; + contribution = <3072>; + }; + map1 { + trip = <&target>; + cooling-device = <&cpu4 + THERMAL_NO_LIMIT + THERMAL_NO_LIMIT>, + <&cpu5 + THERMAL_NO_LIMIT + THERMAL_NO_LIMIT>, + <&cpu6 + THERMAL_NO_LIMIT + THERMAL_NO_LIMIT>, + <&cpu7 + THERMAL_NO_LIMIT + THERMAL_NO_LIMIT>; + contribution = <1024>; + }; + }; + }; + + /* The tzts1 ~ tzts6 don't need to polling */ + /* The tzts1 ~ tzts6 don't need to thermal throttle */ + + tzts1: tzts1 { + polling-delay-passive = <0>; + polling-delay = <0>; + thermal-sensors = <&thermal 1>; + sustainable-power = <5000>; + trips {}; + cooling-maps {}; + }; + + tzts2: tzts2 { + polling-delay-passive = <0>; + polling-delay = <0>; + thermal-sensors = <&thermal 2>; + sustainable-power = <5000>; + trips {}; + cooling-maps {}; + }; + + tzts3: tzts3 { + polling-delay-passive = <0>; + polling-delay = <0>; + thermal-sensors = <&thermal 3>; + sustainable-power = <5000>; + trips {}; + cooling-maps {}; + }; + + tzts4: tzts4 { + polling-delay-passive = <0>; + polling-delay = <0>; + thermal-sensors = <&thermal 4>; + sustainable-power = <5000>; + trips {}; + cooling-maps {}; + }; + + tzts5: tzts5 { + polling-delay-passive = <0>; + polling-delay = <0>; + thermal-sensors = <&thermal 5>; + sustainable-power = <5000>; + trips {}; + cooling-maps {}; + }; + + tztsABB: tztsABB { + polling-delay-passive = <0>; + polling-delay = <0>; + thermal-sensors = <&thermal 6>; + sustainable-power = <5000>; + trips {}; + cooling-maps {}; + }; + }; };
Greg Kroah-Hartman
maintainerPATCH 134/194 arm64: dts: mediatek: mt8183-evb: Fix unit_address_vs_reg warning on ntc
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <[email protected]>
commit 9dea1c724fc36643e83216c1f5a26613412150db upstream.
The NTC is defined as ntc@0 but it doesn't need any address at all. Fix the unit_address_vs_reg warning by dropping the unit address: since the node name has to be generic also fully rename it from ntc@0 to thermal-sensor.
--- arch/arm64/boot/dts/mediatek/mt8183-evb.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/mediatek/mt8183-evb.dts +1 -1
@@ -37,7 +37,7 @@ }; }; - ntc@0 { + thermal-sensor { compatible = "murata,ncp03wf104"; pullup-uv = <1800000>; pullup-ohm = <390000>;
Greg Kroah-Hartman
maintainerPATCH 135/194 binder: fix memory leaks of spam and pending work
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <[email protected]>
commit 1aa3aaf8953c84bad398adf6c3cabc9d6685bf7d upstream
A transaction complete work is allocated and queued for each transaction. Under certain conditions the work->type might be marked as BINDER_WORK_TRANSACTION_ONEWAY_SPAM_SUSPECT to notify userspace about potential spamming threads or as BINDER_WORK_TRANSACTION_PENDING when the target is currently frozen.
However, these work types are not being handled in binder_release_work() so they will leak during a cleanup. This was reported by syzkaller with the following kmemleak dump:
BUG: memory leak
unreferenced object 0xffff88810e2d6de0 (size 32):
comm "syz-executor338", pid 5046, jiffies 4294968230 (age 13.590s)
hex dump (first 32 bytes):
e0 6d 2d 0e 81 88 ff ff e0 6d 2d 0e 81 88 ff ff .m-......m-.....
04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff81573b75>] kmalloc_trace+0x25/0x90 mm/slab_common.c:1114
[<ffffffff83d41873>] kmalloc include/linux/slab.h:599 [inline]
[<ffffffff83d41873>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83d41873>] binder_transaction+0x573/0x4050 drivers/android/binder.c:3152
[<ffffffff83d45a05>] binder_thread_write+0x6b5/0x1860 drivers/android/binder.c:4010
[<ffffffff83d486dc>] binder_ioctl_write_read drivers/android/binder.c:5066 [inline]
[<ffffffff83d486dc>] binder_ioctl+0x1b2c/0x3cf0 drivers/android/binder.c:5352
[<ffffffff816b25f2>] vfs_ioctl fs/ioctl.c:51 [inline]
[<ffffffff816b25f2>] __do_sys_ioctl fs/ioctl.c:871 [inline]
[<ffffffff816b25f2>] __se_sys_ioctl fs/ioctl.c:857 [inline]
[<ffffffff816b25f2>] __x64_sys_ioctl+0xf2/0x140 fs/ioctl.c:857
[<ffffffff84b30008>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff84b30008>] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
[<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0xcdFix the leaks by kfreeing these work types in binder_release_work() and handle them as a BINDER_WORK_TRANSACTION_COMPLETE cleanup.
[cmllamas: backport to v6.1 by dropping BINDER_WORK_TRANSACTION_PENDING
as commit 0567461a7a6e is not present. Remove fixes tag accordingly.]
--- drivers/android/binder.c | 1 + 1 file changed, 1 insertion(+)
drivers/android/binder.c +1 -0
@@ -4788,6 +4788,7 @@ static void binder_release_work(struct binder_proc *proc,"undelivered TRANSACTION_ERROR: %u\n" , e->cmd); }break ; +case BINDER_WORK_TRANSACTION_ONEWAY_SPAM_SUSPECT :case BINDER_WORK_TRANSACTION_COMPLETE : {binder_debug (BINDER_DEBUG_DEAD_TRANSACTION ,"undelivered TRANSACTION_COMPLETE\n" );
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 136/194 coresight: etm4x: Make etm4_remove_dev() return void
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
[ Upstream commit c5f231f1a7e18d28e02b282d33541d31358360e4 ]
etm4_remove_dev() returned zero unconditionally. Make it return void instead, which makes it clear in the callers that there is no error to handle. Simplify etm4_remove_platform_dev() accordingly.
Stable-dep-of: 348ddab81f7b ("coresight: etm4x: Remove bogous __exit annotation for some functions")
--- drivers/hwtracing/coresight/coresight-etm4x-core.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
drivers/hwtracing/coresight/coresight-etm4x-core.c +3 -5
@@ -2072,7 +2072,7 @@ static void clear_etmdrvdata(void *info) etmdrvdata[cpu] =NULL ; } -static int __exit etm4_remove_dev(struct etmv4_drvdata *drvdata) +static void __exit etm4_remove_dev(struct etmv4_drvdata *drvdata) {etm_perf_symlink (drvdata->csdev, false);/*
@@ -2094,7 +2094,6 @@ static int __exit etm4_remove_dev(struct etmv4_drvdata *drvdata)cscfg_unregister_csdev (drvdata->csdev);coresight_unregister (drvdata->csdev); -return 0 ; } static void __exit etm4_remove_amba(struct amba_device *adev)
@@ -2107,13 +2106,12 @@ static void __exit etm4_remove_amba(struct amba_device *adev) static int __exit etm4_remove_platform_dev(struct platform_device *pdev) { -int ret =0 ;struct etmv4_drvdata *drvdata =dev_get_drvdata (&pdev->dev);if (drvdata) - ret =etm4_remove_dev (drvdata); +etm4_remove_dev (drvdata);pm_runtime_disable (&pdev->dev); -return ret; +return 0 ; }static const struct amba_id etm4_ids[] = {
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 137/194 coresight: etm4x: Remove bogous __exit annotation for some functions
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
[ Upstream commit 348ddab81f7b0983d9fb158df910254f08d3f887 ]
etm4_platform_driver (which lives in ".data" contains a reference to etm4_remove_platform_dev(). So the latter must not be marked with __exit which results in the function being discarded for a build with CONFIG_CORESIGHT_SOURCE_ETM4X=y which in turn makes the remove pointer contain invalid data.
etm4x_amba_driver referencing etm4_remove_amba() has the same issue.
Drop the __exit annotations for the two affected functions and a third one that is called by the other two.
For reasons I don't understand this isn't catched by building with CONFIG_DEBUG_SECTION_MISMATCH=y.
--- drivers/hwtracing/coresight/coresight-etm4x-core.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/hwtracing/coresight/coresight-etm4x-core.c +3 -3
@@ -2072,7 +2072,7 @@ static void clear_etmdrvdata(void *info) etmdrvdata[cpu] =NULL ; } -static void __exit etm4_remove_dev(struct etmv4_drvdata *drvdata) +static void etm4_remove_dev (struct etmv4_drvdata *drvdata) {etm_perf_symlink (drvdata->csdev, false);/*
@@ -2096,7 +2096,7 @@ static void __exit etm4_remove_dev(struct etmv4_drvdata *drvdata) } -static void __exit etm4_remove_amba(struct amba_device *adev) +static void etm4_remove_amba (struct amba_device *adev) {struct etmv4_drvdata *drvdata =dev_get_drvdata (&adev->dev);
@@ -2104,7 +2104,7 @@ static void __exit etm4_remove_amba(struct amba_device *adev)etm4_remove_dev (drvdata); } -static int __exit etm4_remove_platform_dev(struct platform_device *pdev) +static int etm4_remove_platform_dev (struct platform_device *pdev) {struct etmv4_drvdata *drvdata =dev_get_drvdata (&pdev->dev);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 138/194 hwtracing: hisi_ptt: Add dummy callback pmu::read()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junhao He <[email protected]>
[ Upstream commit 55e0a2fb0cb5ab7c9c99c1ad4d3e6954de8b73a0 ]
When start trace with perf option "-C $cpu" and immediately stop it with SIGTERM or others, the perf core will invoke pmu::read() while the driver doesn't implement it. Add a dummy pmu::read() to avoid any issues.
--- drivers/hwtracing/ptt/hisi_ptt.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/hwtracing/ptt/hisi_ptt.c +5 -0
@@ -837,6 +837,10 @@ static void hisi_ptt_pmu_del(struct perf_event *event, int flags)hisi_ptt_pmu_stop (event,PERF_EF_UPDATE ); } +static void hisi_ptt_pmu_read (struct perf_event *event) +{ +} +static void hisi_ptt_remove_cpuhp_instance (void *hotplug_node) {cpuhp_state_remove_instance_nocalls (hisi_ptt_pmu_online, hotplug_node);
@@ -880,6 +884,7 @@ static int hisi_ptt_register_pmu(struct hisi_ptt *hisi_ptt) .stop = hisi_ptt_pmu_stop, .add = hisi_ptt_pmu_add, .del = hisi_ptt_pmu_del, + .read = hisi_ptt_pmu_read, }; reg =readl (hisi_ptt->iobase +HISI_PTT_LOCATION );
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 139/194 misc: mei: client.c: return negative error code in mei_cl_write
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <[email protected]>
[ Upstream commit 8f06aee8089cf42fd99a20184501bd1347ce61b9 ]
mei_msg_hdr_init() return negative error code, rets should be 'PTR_ERR(mei_hdr)' rather than '-PTR_ERR(mei_hdr)'.
--- drivers/misc/mei/client.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/misc/mei/client.c +1 -1
@@ -1978,7 +1978,7 @@ ssize_t mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb) mei_hdr =mei_msg_hdr_init (cb);if (IS_ERR (mei_hdr)) { - rets = -PTR_ERR (mei_hdr); + rets =PTR_ERR (mei_hdr); mei_hdr =NULL ; goto err; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 140/194 misc: mei: client.c: fix problem of return -EOVERFLOW in mei_cl_write
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <[email protected]>
[ Upstream commit ee6236027218f8531916f1c5caa5dc330379f287 ]
Clang static analyzer complains that value stored to 'rets' is never read.Let 'buf_len = -EOVERFLOW' to make sure we can return '-EOVERFLOW'.
--- drivers/misc/mei/client.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/misc/mei/client.c +1 -1
@@ -2002,7 +2002,7 @@ ssize_t mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb) hbuf_slots =mei_hbuf_empty_slots (dev);if (hbuf_slots <0 ) { - rets = -EOVERFLOW ; + buf_len = -EOVERFLOW ; goto out; }
Signature · 1 line
2.42.0