6.6.7-rc1 review
Subsystems (7)
Greg Kroah-Hartman
maintainercover 6.6.7-rc1 review
This is the start of the stable review cycle for the 6.6.7 release. There are 244 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 13 Dec 2023 18:19:59 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.7-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.6.7-rc1
Lijo Lazar <[email protected]>
drm/amdgpu: Restrict extended wait to PSP v13.0.6
Asad Kamal <[email protected]>
drm/amdgpu: update retry times for psp BL wait
Lijo Lazar <[email protected]>
drm/amdgpu: Fix refclk reporting for SMU v13.0.6
Jia Jie Ho <[email protected]>
riscv: Kconfig: Add select ARM_AMBA to SOC_STARFIVE
Gustavo A. R. Silva <[email protected]>
gcc-plugins: randstruct: Update code comment in relayout_struct()
Srinivas Kandagatla <[email protected]>
ASoC: qcom: sc8280xp: Limit speaker digital volumes
Florian Westphal <[email protected]>
netfilter: nft_set_pipapo: skip inactive elements during set walk
Jiaxun Yang <[email protected]>
MIPS: Loongson64: Enable DMA noncoherent support
Jiaxun Yang <[email protected]>
MIPS: Loongson64: Handle more memory types passed from firmware
Jiaxun Yang <[email protected]>
MIPS: Loongson64: Reserve vgabios memory on boot
Ian Rogers <[email protected]>
perf metrics: Avoid segv if default metricgroup isn't set
Ian Rogers <[email protected]>
perf list: Fix JSON segfault by setting the used skip_duplicate_pmus callback
Sean Christopherson <[email protected]>
KVM: SVM: Update EFER software model on CR0 trap for SEV-ES
Claudio Imbrenda <[email protected]>
KVM: s390/mm: Properly reset no-dat
Thomas Bogendoerfer <[email protected]>
MIPS: kernel: Clear FPU states when setting up kernel threads
David Howells <[email protected]>
cifs: Fix flushing, invalidation and file size with FICLONE
David Howells <[email protected]>
cifs: Fix flushing, invalidation and file size with copy_file_range()
Roy Luo <[email protected]>
USB: gadget: core: adjust uevent timing on gadget unbind
Naveen N Rao <[email protected]>
powerpc/ftrace: Fix stack teardown in ftrace_no_trace
Borislav Petkov (AMD) <[email protected]>
x86/CPU/AMD: Check vendor in the AMD microcode callback
Mukesh Ojha <[email protected]>
devcoredump: Send uevent once devcd is ready
Ronald Wahl <[email protected]>
serial: 8250_omap: Add earlycon support for the AM654 UART controller
Ronald Wahl <[email protected]>
serial: 8250: 8250_omap: Do not start RX DMA on THRI interrupt
Ronald Wahl <[email protected]>
serial: 8250: 8250_omap: Clear UART_HAS_RHR_IT_DIS bit
Daniel Mack <[email protected]>
serial: sc16is7xx: address RX timeout interrupt errata
Arnd Bergmann <[email protected]>
ARM: PL011: Fix DMA support
RD Babiera <[email protected]>
usb: typec: class: fix typec_altmode_put_partner to put plugs
Paulo Alcantara <[email protected]>
smb: client: fix potential NULL deref in parse_dfs_referrals()
Mathias Nyman <[email protected]>
Revert "xhci: Loosen RPM as default policy to cover for AMD xHC 1.1"
David Howells <[email protected]>
cifs: Fix non-availability of dedup breaking generic/304
Cameron Williams <[email protected]>
parport: Add support for Brainboxes IX/UC/PX parallel cards
Andi Shyti <[email protected]>
serial: ma35d1: Validate console index before assignment
Andy Shevchenko <[email protected]>
serial: 8250_dw: Add ACPI ID for Granite Rapids-D UART
Miquel Raynal <[email protected]>
nvmem: Do not expect fixed layouts to grab a layout driver
Konstantin Aladyshev <[email protected]>
usb: gadget: f_hid: fix report descriptor allocation
JP Kobryn <[email protected]>
kprobes: consistent rcu api usage for kretprobe holder
Srinivas Kandagatla <[email protected]>
ASoC: ops: add correct range check for limiting volume
Boerge Struempfel <[email protected]>
gpiolib: sysfs: Fix error handling on failed export
Ashwin Dayanand Kamat <[email protected]>
x86/sev: Fix kernel crash due to late update to read-only ghcb_version
Peter Zijlstra <[email protected]>
perf: Fix perf_event_validate_size()
Jiadong Zhu <[email protected]>
drm/amdgpu: disable MCBP by default
Hsin-Yi Wang <[email protected]>
arm64: dts: mt8183: kukui: Fix underscores in node names
Krzysztof Kozlowski <[email protected]>
arm64: dts: mediatek: add missing space before {Helge Deller <[email protected]>
parisc: Fix asm operand number out of range build error in bug table
Helge Deller <[email protected]>
parisc: Reduce size of the bug_table on 64-bit kernel by half
Hengqi Chen <[email protected]>
LoongArch: BPF: Don't sign extend function return value
Hengqi Chen <[email protected]>
LoongArch: BPF: Don't sign extend memory load operand
Ilkka Koskinen <[email protected]>
perf vendor events arm64: AmpereOne: Add missing DefaultMetricgroupName fields
Su Hui <[email protected]>
misc: mei: client.c: fix problem of return '-EOVERFLOW' in mei_cl_write
Su Hui <[email protected]>
misc: mei: client.c: return negative error code in mei_cl_write
Junhao He <[email protected]>
coresight: ultrasoc-smb: Fix uninitialized before use buf_hw_base
Junhao He <[email protected]>
coresight: ultrasoc-smb: Config SMB buffer before register sink
Junhao He <[email protected]>
coresight: ultrasoc-smb: Fix sleep while close preempt in enable_smb
Junhao He <[email protected]>
hwtracing: hisi_ptt: Add dummy callback pmu::read()
James Clark <[email protected]>
coresight: Fix crash when Perf and sysfs modes are used concurrently
Uwe Kleine-König <[email protected]>
coresight: etm4x: Remove bogous __exit annotation for some functions
AngeloGioacchino Del Regno <[email protected]>
arm64: dts: mediatek: mt8186: Change gpu speedbin nvmem cell name
Eugen Hristev <[email protected]>
arm64: dts: mediatek: mt8186: fix clock names for power domains
AngeloGioacchino Del Regno <[email protected]>
arm64: dts: mediatek: mt8183-evb: Fix unit_address_vs_reg warning on ntc
AngeloGioacchino Del Regno <[email protected]>
arm64: dts: mediatek: mt8183: Move thermal-zones to the root node
AngeloGioacchino Del Regno <[email protected]>
arm64: dts: mediatek: mt8183: Fix unit address for scp reserved memory
AngeloGioacchino Del Regno <[email protected]>
arm64: dts: mediatek: mt8195: Fix PM suspend/resume with venc clocks
AngeloGioacchino Del Regno <[email protected]>
arm64: dts: mediatek: mt8173-evb: Fix regulator-fixed node names
AngeloGioacchino Del Regno <[email protected]>
arm64: dts: mediatek: cherry: Fix interrupt cells for MT6360 on I2C7
Eugen Hristev <[email protected]>
arm64: dts: mediatek: mt8183-kukui-jacuzzi: fix dsi unnecessary cells properties
Eugen Hristev <[email protected]>
arm64: dts: mediatek: mt7622: fix memory node warning check
Eric Woudstra <[email protected]>
arm64: dts: mt7986: fix emmc hs400 mode without uboot initialization
Frank Wunderlich <[email protected]>
arm64: dts: mt7986: define 3W max power to both SFP on BPI-R3
Frank Wunderlich <[email protected]>
arm64: dts: mt7986: change cooling trips
Ville Syrjälä <[email protected]>
drm/i915: Skip some timing checks on BXT/GLK DSI transcoders
Ville Syrjälä <[email protected]>
drm/i915/mst: Reject modes that require the bigjoiner
Ville Syrjälä <[email protected]>
drm/i915/mst: Fix .mode_valid_ctx() return values
Thomas Zimmermann <[email protected]>
drm/atomic-helpers: Invoke end_fb_access while owning plane state
David Jeffery <[email protected]>
md/raid6: use valid sector values to determine if an I/O should wait on the reshape
Lukasz Luba <[email protected]>
powercap: DTPM: Fix missing cpufreq_cpu_put() calls
Sumanth Korikkar <[email protected]>
mm/memory_hotplug: fix error handling in add_memory_resource()
Hugh Dickins <[email protected]>
mm: fix oops when filemap_map_pmd() without prealloc_pte
Sumanth Korikkar <[email protected]>
mm/memory_hotplug: add missing mem_hotplug_lock
Baoquan He <[email protected]>
drivers/base/cpu: crash data showing should depends on KEXEC_CORE
Mike Kravetz <[email protected]>
hugetlb: fix null-ptr-deref in hugetlb_vma_lock_write
Tejun Heo <[email protected]>
workqueue: Make sure that wq_unbound_cpumask is never empty
Francesco Dolcini <[email protected]>
platform/surface: aggregator: fix recv_buf() return value
Matthias Reichl <[email protected]>
regmap: fix bogus error on regcache_sync success
ChunHao Lin <[email protected]>
r8169: fix rtl8125b PAUSE frames blasting when suspended
Daniel Borkmann <[email protected]>
packet: Move reference count in packet_sock to atomic_long_t
Hui Zhou <[email protected]>
nfp: flower: fix for take a mutex lock in soft irq context and rcu lock
Heiner Kallweit <[email protected]>
leds: trigger: netdev: fix RTNL handling to prevent potential deadlock
Petr Pavlu <[email protected]>
tracing: Fix a possible race when disabling buffered events
Petr Pavlu <[email protected]>
tracing: Fix incomplete locking when disabling buffered events
Steven Rostedt (Google) <[email protected]>
tracing: Disable snapshot buffer when stopping instance tracers
Steven Rostedt (Google) <[email protected]>
tracing: Stop current tracer when resizing buffer
Steven Rostedt (Google) <[email protected]>
tracing: Always update snapshot buffer size
Heiko Carstens <[email protected]>
checkstack: fix printed address
Tim Van Patten <[email protected]>
cgroup_freezer: cgroup_freezing: Check if not frozen
Ming Lei <[email protected]>
lib/group_cpus.c: avoid acquiring cpu hotplug lock in group_cpus_evenly
Ryusuke Konishi <[email protected]>
nilfs2: prevent WARNING in nilfs_sufile_set_segment_usage()
Ryusuke Konishi <[email protected]>
nilfs2: fix missing error check for sb_set_blocksize call
Su Hui <[email protected]>
highmem: fix a memory copy problem in memcpy_from_folio
Steven Rostedt (Google) <[email protected]>
ring-buffer: Force absolute timestamp on discard of event
Steven Rostedt (Google) <[email protected]>
ring-buffer: Test last update in 32bit version of __rb_time_read()
Takashi Iwai <[email protected]>
ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7
Mario Limonciello <[email protected]>
ALSA: hda/realtek: Add Framework laptop 16 to quirks
Tim Bosse <[email protected]>
ALSA: hda/realtek: add new Framework laptop to quirks
Bin Li <[email protected]>
ALSA: hda/realtek: Enable headset on Lenovo M90 Gen5
Aleksandrs Vinarskis <[email protected]>
ALSA: hda/realtek: fix speakers on XPS 9530 (2023)
Pascal Noël <[email protected]>
ALSA: hda/realtek: Apply quirk for ASUS UM3504DA
Jason Zhang <[email protected]>
ALSA: pcm: fix out-of-bounds in snd_pcm_state_names
Sarah Grant <[email protected]>
ALSA: usb-audio: Add Pioneer DJM-450 mixer controls
Pavel Begunkov <[email protected]>
io_uring: fix mutex_unlock with unreferenced ctx
Georg Gottleuber <[email protected]>
nvme-pci: Add sleep quirk for Kingston drives
Pavel Begunkov <[email protected]>
io_uring/af_unix: disable sending io_uring over sockets
Malcolm Hart <[email protected]>
ASoC: amd: yc: Fix non-functional mic on ASUS E1504FA
Masami Hiramatsu (Google) <[email protected]>
rethook: Use __rcu pointer for rethook::handler
Florian Fainelli <[email protected]>
scripts/gdb: fix lx-device-list-bus and lx-device-list-class
Baoquan He <[email protected]>
kernel/Kconfig.kexec: drop select of KEXEC for CRASH_DUMP
Yu Kuai <[email protected]>
md: don't leave 'MD_RECOVERY_FROZEN' in error path of md_set_readonly()
Lad Prabhakar <[email protected]>
riscv: errata: andes: Probe for IOCP only once in boot stage
Clément Léger <[email protected]>
riscv: fix misaligned access handling of C.SWSP and C.SDSP
Sam Edwards <[email protected]>
arm64: dts: rockchip: Fix eMMC Data Strobe PD on rk3588
Fabio Estevam <[email protected]>
ARM: dts: imx28-xea: Pass the 'model' property
Philipp Zabel <[email protected]>
ARM: dts: imx7: Declare timers compatible with fsl,imx6dl-gpt
Stefan Eichenberger <[email protected]>
arm64: dts: imx8-apalis: set wifi regulator to always-on
Kunwu Chan <[email protected]>
ARM: imx: Check return value of devm_kasprintf in imx_mmdc_perf_init
Peng Fan <[email protected]>
arm64: dts: imx93: correct mediamix power
Alexander Stein <[email protected]>
arm64: dts: freescale: imx8-ss-lsio: Fix #pwm-cells
Fabio Estevam <[email protected]>
arm64: dts: imx8-ss-lsio: Add PWM interrupts
Dinghao Liu <[email protected]>
scsi: be2iscsi: Fix a memleak in beiscsi_init_wrb_handle()
Petr Pavlu <[email protected]>
tracing: Fix a warning when allocating buffered events fails
Jens Axboe <[email protected]>
io_uring/kbuf: check for buffer list readiness after NULL check
Dan Carpenter <[email protected]>
io_uring/kbuf: Fix an NULL vs IS_ERR() bug in io_alloc_pbuf_ring()
Fabio Estevam <[email protected]>
ARM: dts: imx6ul-pico: Describe the Ethernet PHY clock
Nathan Rossi <[email protected]>
arm64: dts: imx8mp: imx8mq: Add parkmode-disable-ss-quirk on DWC3
Arnd Bergmann <[email protected]>
drm/bridge: tc358768: select CONFIG_VIDEOMODE_HELPERS
Shifeng Li <[email protected]>
RDMA/irdma: Avoid free the non-cqp_request scratch
Mike Marciniszyn <[email protected]>
RDMA/irdma: Fix support for 64k pages
Mike Marciniszyn <[email protected]>
RDMA/irdma: Ensure iWarp QP queue memory is OS paged aligned
Mike Marciniszyn <[email protected]>
RDMA/core: Fix umem iterator when PAGE_SIZE is greater then HCA pgsz
Dinghao Liu <[email protected]>
ASoC: wm_adsp: fix memleak in wm_adsp_buffer_populate
Sudeep Holla <[email protected]>
firmware: arm_scmi: Fix possible frequency truncation when using level indexing mode
Ulf Hansson <[email protected]>
firmware: arm_scmi: Simplify error path in scmi_dvfs_device_opps_add()
Sudeep Holla <[email protected]>
firmware: arm_scmi: Fix frequency truncation by promoting multiplier type
Ulf Hansson <[email protected]>
firmware: arm_scmi: Extend perf protocol ops to get information of a domain
Ulf Hansson <[email protected]>
firmware: arm_scmi: Extend perf protocol ops to get number of domains
Christophe JAILLET <[email protected]>
hwmon: (nzxt-kraken2) Fix error handling path in kraken2_probe()
Neil Armstrong <[email protected]>
ASoC: codecs: lpass-tx-macro: set active_decimator correct default value
Armin Wolf <[email protected]>
hwmon: (acpi_power_meter) Fix 4.29 MW bug
Stefan Wahren <[email protected]>
ARM: dts: bcm2711-rpi-400: Fix delete-node of led_act
Alex Bee <[email protected]>
ARM: dts: rockchip: Fix sdmmc_pwren's pinmux setting for RK3128
Stefan Kerkmann <[email protected]>
ARM: dts: imx6q: skov: fix ethernet clock regression
Alexander Stein <[email protected]>
arm64: dt: imx93: tqma9352-mba93xxla: Fix LPUART2 pad config
Shifeng Li <[email protected]>
RDMA/irdma: Fix UAF in irdma_sc_ccq_get_cqe_info()
Kalesh AP <[email protected]>
RDMA/bnxt_re: Correct module description string
Jack Wang <[email protected]>
RDMA/rtrs-clt: Remove the warnings for req in_use check
Jack Wang <[email protected]>
RDMA/rtrs-clt: Fix the max_send_wr setting
Md Haris Iqbal <[email protected]>
RDMA/rtrs-srv: Destroy path files after making sure no IOs in-flight
Md Haris Iqbal <[email protected]>
RDMA/rtrs-srv: Free srv_mr iu only when always_invalidate is true
Md Haris Iqbal <[email protected]>
RDMA/rtrs-srv: Check return values while processing info request
Jack Wang <[email protected]>
RDMA/rtrs-clt: Start hb after path_up
Jack Wang <[email protected]>
RDMA/rtrs-srv: Do not unconditionally enable irq
Shengjiu Wang <[email protected]>
ASoC: fsl_sai: Fix no frame sync clock issue on i.MX8MP
Alex Bee <[email protected]>
arm64: dts: rockchip: Expand reg size of vdec node for RK3399
Jonas Karlman <[email protected]>
arm64: dts: rockchip: Expand reg size of vdec node for RK3328
Mustafa Ismail <[email protected]>
RDMA/irdma: Add wait for suspend on SQD
Mustafa Ismail <[email protected]>
RDMA/irdma: Do not modify to SQD on error
Junxian Huang <[email protected]>
RDMA/hns: Fix unnecessary err return when using invalid congest control algorithm
Shigeru Yoshida <[email protected]>
RDMA/core: Fix uninit-value access in ib_get_eth_speed()
Sumit Garg <[email protected]>
tee: optee: Fix supplicant based device enumeration
Dan Carpenter <[email protected]>
mm/damon/sysfs: eliminate potential uninitialized variable warning
Arvind Yadav <[email protected]>
drm/amdkfd: get doorbell's absolute offset based on the db_size
Lee Jones <[email protected]>
drm/amd/amdgpu/amdgpu_doorbell_mgr: Correct misdocumented param 'doorbell_index'
Wen Gu <[email protected]>
net/smc: fix missing byte order conversion in CLC handshake
Sean Nyekjaer <[email protected]>
net: dsa: microchip: provide a list of valid protocols for xmit handler
Ido Schimmel <[email protected]>
drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group
Ido Schimmel <[email protected]>
psample: Require 'CAP_NET_ADMIN' when joining "packets" group
John Fastabend <[email protected]>
bpf: sockmap, updating the sg structure should also update curr
John Fastabend <[email protected]>
net: tls, update curr on splice as well
Tobias Waldekranz <[email protected]>
net: dsa: mv88e6xxx: Restore USXGMII support for 6393X
Eric Dumazet <[email protected]>
tcp: do not accept ACK of bytes we never sent
Phil Sutter <[email protected]>
netfilter: xt_owner: Fix for unsafe access of sk->sk_socket
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: validate family when identifying table via handle
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: bail out on mismatching dynset and set expressions
Florian Westphal <[email protected]>
netfilter: nf_tables: fix 'exist' matching on bigendian arches
D. Wythe <[email protected]>
netfilter: bpf: fix bad registration on nf_defrag
Konrad Dybcio <[email protected]>
dt-bindings: interrupt-controller: Allow #power-domain-cells
Rahul Bhansali <[email protected]>
octeontx2-af: Update Tx link register range
Geetha sowjanya <[email protected]>
octeontx2-af: Add missing mcs flr handler call
Geetha sowjanya <[email protected]>
octeontx2-af: Fix mcs stats register address
Geetha sowjanya <[email protected]>
octeontx2-af: Fix mcs sa cam entries size
Nithin Dabilpuram <[email protected]>
octeontx2-af: Adjust Tx credits when MCS external bypass is disabled
Yonglong Liu <[email protected]>
net: hns: fix fake link up on xge port
Yonglong Liu <[email protected]>
net: hns: fix wrong head when modify the tx feature when sending packets
Daniil Maximov <[email protected]>
net: atlantic: Fix NULL dereference of skb pointer in
Shigeru Yoshida <[email protected]>
ipv4: ip_gre: Avoid skb_pull() failure in ipgre_xmit()
Brett Creeley <[email protected]>
ionic: Fix dim work handling in split interrupt mode
Shannon Nelson <[email protected]>
ionic: fix snprintf format length warning
Paolo Abeni <[email protected]>
tcp: fix mid stream window clamp.
Dinghao Liu <[email protected]>
net: bnxt: fix a potential use-after-free in bnxt_init_tc
Jacob Keller <[email protected]>
iavf: validate tx_coalesce_usecs even if rx_coalesce_usecs is zero
Ivan Vecera <[email protected]>
i40e: Fix unexpected MFS warning message
Marcin Szycik <[email protected]>
ice: Restore fix disabling RX VLAN filtering
Zhipeng Lu <[email protected]>
octeontx2-af: fix a use-after-free in rvu_npa_register_reporters
Yewon Choi <[email protected]>
xsk: Skip polling event check for unbound socket
Jianheng Zhang <[email protected]>
net: stmmac: fix FPE events losing
Naveen Mamindlapalli <[email protected]>
octeontx2-pf: consider both Rx and Tx packet stats for adaptive interrupt coalescing
Thomas Reichinger <[email protected]>
arcnet: restoring support for multiple Sohard Arcnet cards
Kunwu Chan <[email protected]>
platform/mellanox: Check devm_hwmon_device_register_with_groups() return value
Kunwu Chan <[email protected]>
platform/mellanox: Add null pointer checks for devm_kasprintf()
David Thompson <[email protected]>
mlxbf-bootctl: correctly identify secure boot with development keys
Douglas Anderson <[email protected]>
r8152: Add RTL8152_INACCESSIBLE to r8153_aldps_en()
Douglas Anderson <[email protected]>
r8152: Add RTL8152_INACCESSIBLE to r8153_pre_firmware_1()
Douglas Anderson <[email protected]>
r8152: Add RTL8152_INACCESSIBLE to r8156b_wait_loading_flash()
Douglas Anderson <[email protected]>
r8152: Add RTL8152_INACCESSIBLE checks to more loops
Douglas Anderson <[email protected]>
r8152: Hold the rtnl_lock for all of reset
Randy Dunlap <[email protected]>
hv_netvsc: rndis_filter needs to select NLS
Yonghong Song <[email protected]>
bpf: Fix a verifier bug due to incorrect branch offset comparison with cpu=v4
Subbaraya Sundeep <[email protected]>
octeontx2-af: Check return value of nix_get_nixlf before using nixlf
Subbaraya Sundeep <[email protected]>
octeontx2-pf: Add missing mutex lock in otx2_get_pauseparam
Eric Dumazet <[email protected]>
ipv6: fix potential NULL deref in fib6_add()
Armin Wolf <[email protected]>
platform/x86: wmi: Skip blocks with zero instances
Luca Ceresoli <[email protected]>
of: dynamic: Fix of_reconfig_get_state_change() return value documentation
Hans de Goede <[email protected]>
platform/x86: asus-wmi: Move i8042 filter install to shared asus-wmi code
Nícolas F. R. A. Prado <[email protected]>
dt: dt-extract-compatibles: Don't follow symlinks when walking tree
Nícolas F. R. A. Prado <[email protected]>
dt: dt-extract-compatibles: Handle cfile arguments in generator function
Kirill A. Shutemov <[email protected]>
x86/tdx: Allow 32-bit emulation by default
Thomas Gleixner <[email protected]>
x86/entry: Do not allow external 0x80 interrupts
Thomas Gleixner <[email protected]>
x86/entry: Convert INT 0x80 emulation to IDTENTRY
Kirill A. Shutemov <[email protected]>
x86/coco: Disable 32-bit emulation by default on TDX and SEV
Nikolay Borisov <[email protected]>
x86: Introduce ia32_enabled()
Mikulas Patocka <[email protected]>
dm-crypt: start allocating with MAX_ORDER
YuanShang <[email protected]>
drm/amdgpu: correct chunk_ptr to a pointer to chunk.
Le Ma <[email protected]>
drm/amdgpu: finalizing mem_partitions at the end of GMC v9 sw_fini
Victor Lu <[email protected]>
drm/amdgpu: Do not program VF copy regs in mmhub v1.8 under SRIOV (v2)
Masahiro Yamada <[email protected]>
kconfig: fix memory leak from range properties
Masahiro Yamada <[email protected]>
modpost: fix section mismatch message for RELA
Alex Pakhunov <[email protected]>
tg3: Increment tx_dropped in tg3_tso_bug()
Alex Pakhunov <[email protected]>
tg3: Move the [rt]x_dropped counters to tg3_napi
Nick Terrell <[email protected]>
zstd: Fix array-index-out-of-bounds UBSAN warning
Dave Airlie <[email protected]>
nouveau: use an rwlock for the event lock.
Jozsef Kadlecsik <[email protected]>
netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test
Samuel Holland <[email protected]>
i2c: ocores: Move system PM hooks to the NOIRQ phase
Jan Bottorff <[email protected]>
i2c: designware: Fix corrupted memory seen in the ISR
Thomas Gleixner <[email protected]>
hrtimers: Push pending hrtimers away from outgoing CPU earlier
Mike Christie <[email protected]>
scsi: sd: Fix sshdr use in sd_suspend_common()
Steve Sistare <[email protected]>
vdpa/mlx5: preserve CVQ vringh index
-------------
Diffstat:
Documentation/ABI/testing/sysfs-bus-optee-devices | 9 + .../bindings/interrupt-controller/qcom,mpm.yaml | 4 + Makefile | 4 +- arch/arm/boot/dts/broadcom/bcm2711-rpi-400.dts | 4 +- .../dts/nxp/imx/imx6q-skov-reve-mi1010ait-1cp1.dts | 4 +- arch/arm/boot/dts/nxp/imx/imx6ul-pico.dtsi | 2 + arch/arm/boot/dts/nxp/imx/imx7s.dtsi | 8 +- arch/arm/boot/dts/nxp/mxs/imx28-xea.dts | 1 + arch/arm/boot/dts/rockchip/rk3128.dtsi | 2 +- arch/arm/include/asm/kexec.h | 4 - arch/arm/kernel/Makefile | 2 +- arch/arm/mach-imx/mmdc.c | 7 +- .../arm64/boot/dts/freescale/imx8-apalis-v1.1.dtsi | 5 +- arch/arm64/boot/dts/freescale/imx8-ss-lsio.dtsi | 12 +- arch/arm64/boot/dts/freescale/imx8mp.dtsi | 2 + arch/arm64/boot/dts/freescale/imx8mq.dtsi | 2 + .../dts/freescale/imx93-tqma9352-mba93xxla.dts | 2 +- arch/arm64/boot/dts/freescale/imx93.dtsi | 2 +- .../boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts | 2 +- arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts | 2 +- .../boot/dts/mediatek/mt7986a-bananapi-bpi-r3.dts | 12 +- arch/arm64/boot/dts/mediatek/mt7986a.dtsi | 24 +- arch/arm64/boot/dts/mediatek/mt8173-evb.dts | 4 +- arch/arm64/boot/dts/mediatek/mt8183-evb.dts | 52 ++--- .../boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi | 8 +- arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi | 96 ++++---- arch/arm64/boot/dts/mediatek/mt8183-pumpkin.dts | 12 +- arch/arm64/boot/dts/mediatek/mt8183.dtsi | 242 ++++++++++----------- arch/arm64/boot/dts/mediatek/mt8186.dtsi | 44 ++-- arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi | 2 +- arch/arm64/boot/dts/mediatek/mt8195.dtsi | 6 +- arch/arm64/boot/dts/rockchip/rk3328.dtsi | 2 +- arch/arm64/boot/dts/rockchip/rk3399.dtsi | 6 +- arch/arm64/boot/dts/rockchip/rk3588s-pinctrl.dtsi | 2 +- arch/loongarch/net/bpf_jit.c | 12 +- arch/mips/Kconfig | 2 + arch/mips/include/asm/mach-loongson64/boot_param.h | 9 +- arch/mips/kernel/process.c | 25 ++- arch/mips/loongson64/env.c | 10 +- arch/mips/loongson64/init.c | 47 ++-- arch/parisc/Kconfig | 7 +- arch/parisc/include/asm/bug.h | 36 +-- arch/powerpc/kernel/trace/ftrace_entry.S | 4 +- arch/riscv/Kconfig.socs | 1 + arch/riscv/errata/andes/errata.c | 20 +- arch/riscv/kernel/traps_misaligned.c | 6 +- arch/s390/mm/pgtable.c | 2 +- arch/x86/coco/tdx/tdx.c | 1 + arch/x86/entry/common.c | 97 ++++++++- arch/x86/entry/entry_64_compat.S | 77 ------- arch/x86/include/asm/ia32.h | 23 +- arch/x86/include/asm/idtentry.h | 4 + arch/x86/include/asm/proto.h | 4 - arch/x86/kernel/cpu/amd.c | 3 + arch/x86/kernel/idt.c | 2 +- arch/x86/kernel/sev.c | 11 +- arch/x86/kvm/svm/svm.c | 8 +- arch/x86/mm/mem_encrypt_amd.c | 11 + arch/x86/xen/enlighten_pv.c | 2 +- arch/x86/xen/xen-asm.S | 2 +- drivers/base/cpu.c | 6 +- drivers/base/devcoredump.c | 3 + drivers/base/memory.c | 18 +- drivers/base/regmap/regcache.c | 3 +- drivers/firmware/arm_scmi/perf.c | 87 +++++--- drivers/gpio/gpiolib-sysfs.c | 15 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 4 - drivers/gpu/drm/amd/amdgpu/amdgpu_doorbell.h | 5 +- drivers/gpu/drm/amd/amdgpu/amdgpu_doorbell_mgr.c | 15 +- drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 5 +- drivers/gpu/drm/amd/amdgpu/mmhub_v1_8.c | 6 +- drivers/gpu/drm/amd/amdgpu/psp_v13_0.c | 10 +- drivers/gpu/drm/amd/amdgpu/soc15.c | 3 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 3 +- drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c | 10 +- .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 3 +- drivers/gpu/drm/bridge/Kconfig | 1 + drivers/gpu/drm/drm_atomic_helper.c | 78 ++++--- drivers/gpu/drm/i915/display/icl_dsi.c | 7 + drivers/gpu/drm/i915/display/intel_crt.c | 5 + drivers/gpu/drm/i915/display/intel_display.c | 12 +- drivers/gpu/drm/i915/display/intel_display.h | 3 + drivers/gpu/drm/i915/display/intel_dp.c | 4 + drivers/gpu/drm/i915/display/intel_dp_mst.c | 20 +- drivers/gpu/drm/i915/display/intel_dvo.c | 6 + drivers/gpu/drm/i915/display/intel_hdmi.c | 4 + drivers/gpu/drm/i915/display/intel_lvds.c | 5 + drivers/gpu/drm/i915/display/intel_sdvo.c | 8 +- drivers/gpu/drm/i915/display/intel_tv.c | 8 +- drivers/gpu/drm/i915/display/vlv_dsi.c | 18 +- drivers/gpu/drm/nouveau/dispnv50/disp.c | 2 +- drivers/gpu/drm/nouveau/include/nvkm/core/event.h | 4 +- drivers/gpu/drm/nouveau/nvkm/core/event.c | 12 +- drivers/hwmon/acpi_power_meter.c | 4 + drivers/hwmon/nzxt-kraken2.c | 4 +- drivers/hwtracing/coresight/coresight-etm-perf.c | 4 +- drivers/hwtracing/coresight/coresight-etm4x-core.c | 6 +- drivers/hwtracing/coresight/ultrasoc-smb.c | 58 ++--- drivers/hwtracing/coresight/ultrasoc-smb.h | 6 +- drivers/hwtracing/ptt/hisi_ptt.c | 5 + drivers/i2c/busses/i2c-designware-common.c | 16 +- drivers/i2c/busses/i2c-ocores.c | 4 +- drivers/infiniband/core/umem.c | 6 - drivers/infiniband/core/verbs.c | 2 +- drivers/infiniband/hw/bnxt_re/main.c | 2 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 13 +- drivers/infiniband/hw/irdma/hw.c | 16 +- drivers/infiniband/hw/irdma/main.c | 2 +- drivers/infiniband/hw/irdma/main.h | 2 +- drivers/infiniband/hw/irdma/verbs.c | 35 ++- drivers/infiniband/hw/irdma/verbs.h | 1 + drivers/infiniband/ulp/rtrs/rtrs-clt.c | 7 +- drivers/infiniband/ulp/rtrs/rtrs-srv.c | 37 +++- drivers/leds/trigger/ledtrig-netdev.c | 11 +- drivers/md/dm-crypt.c | 2 +- drivers/md/md.c | 24 +- drivers/md/raid5.c | 4 +- drivers/misc/mei/client.c | 4 +- drivers/net/arcnet/arcdevice.h | 2 + drivers/net/arcnet/com20020-pci.c | 89 ++++---- drivers/net/dsa/microchip/ksz_common.c | 16 +- drivers/net/dsa/mv88e6xxx/pcs-639x.c | 31 ++- drivers/net/ethernet/aquantia/atlantic/aq_ptp.c | 10 +- drivers/net/ethernet/aquantia/atlantic/aq_ptp.h | 4 +- drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 18 +- drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c | 1 + drivers/net/ethernet/broadcom/tg3.c | 42 +++- drivers/net/ethernet/broadcom/tg3.h | 4 +- drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c | 29 +++ drivers/net/ethernet/hisilicon/hns/hns_enet.c | 53 +++-- drivers/net/ethernet/hisilicon/hns/hns_enet.h | 3 +- drivers/net/ethernet/intel/i40e/i40e_main.c | 2 +- drivers/net/ethernet/intel/iavf/iavf_ethtool.c | 12 +- drivers/net/ethernet/intel/iavf/iavf_txrx.h | 1 - .../net/ethernet/intel/ice/ice_vf_vsi_vlan_ops.c | 11 +- drivers/net/ethernet/marvell/octeontx2/af/mbox.h | 2 +- drivers/net/ethernet/marvell/octeontx2/af/mcs.c | 18 +- drivers/net/ethernet/marvell/octeontx2/af/mcs.h | 2 + .../net/ethernet/marvell/octeontx2/af/mcs_reg.h | 31 ++- drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 3 + drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 1 + .../ethernet/marvell/octeontx2/af/rvu_devlink.c | 5 +- .../net/ethernet/marvell/octeontx2/af/rvu_nix.c | 8 + .../net/ethernet/marvell/octeontx2/af/rvu_npc.c | 8 +- .../net/ethernet/marvell/octeontx2/af/rvu_reg.c | 4 +- .../net/ethernet/marvell/octeontx2/af/rvu_reg.h | 1 + .../ethernet/marvell/octeontx2/nic/otx2_ethtool.c | 6 +- .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 9 + .../net/ethernet/marvell/octeontx2/nic/otx2_txrx.c | 20 +- .../ethernet/netronome/nfp/flower/tunnel_conf.c | 127 ++++++++--- drivers/net/ethernet/pensando/ionic/ionic_dev.h | 2 +- drivers/net/ethernet/pensando/ionic/ionic_lif.c | 16 +- drivers/net/ethernet/realtek/r8169_main.c | 7 +- drivers/net/ethernet/stmicro/stmmac/dwmac5.c | 45 ++-- drivers/net/ethernet/stmicro/stmmac/dwmac5.h | 4 +- .../net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 3 +- drivers/net/ethernet/stmicro/stmmac/hwif.h | 4 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 8 +- drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c | 1 + drivers/net/hyperv/Kconfig | 1 + drivers/net/usb/r8152.c | 27 ++- drivers/nvme/host/nvme.h | 5 + drivers/nvme/host/pci.c | 16 +- drivers/nvmem/core.c | 6 + drivers/of/dynamic.c | 5 +- drivers/parport/parport_pc.c | 21 ++ drivers/platform/mellanox/mlxbf-bootctl.c | 39 ++-- drivers/platform/mellanox/mlxbf-pmc.c | 14 ++ drivers/platform/surface/aggregator/core.c | 5 +- drivers/platform/x86/Kconfig | 2 +- drivers/platform/x86/asus-nb-wmi.c | 11 - drivers/platform/x86/asus-wmi.c | 8 + drivers/platform/x86/wmi.c | 5 + drivers/powercap/dtpm_cpu.c | 17 +- drivers/scsi/be2iscsi/be_main.c | 1 + drivers/scsi/sd.c | 53 ++--- drivers/tee/optee/device.c | 17 +- drivers/tty/serial/8250/8250_dw.c | 1 + drivers/tty/serial/8250/8250_early.c | 1 + drivers/tty/serial/8250/8250_omap.c | 14 +- drivers/tty/serial/amba-pl011.c | 112 +++++----- drivers/tty/serial/ma35d1_serial.c | 10 +- drivers/tty/serial/sc16is7xx.c | 12 + drivers/usb/gadget/function/f_hid.c | 7 +- drivers/usb/gadget/udc/core.c | 4 +- drivers/usb/host/xhci-pci.c | 2 - drivers/usb/typec/class.c | 5 +- drivers/vdpa/mlx5/net/mlx5_vnet.c | 7 +- fs/nilfs2/sufile.c | 44 +++- fs/nilfs2/the_nilfs.c | 6 +- fs/smb/client/cifsfs.c | 174 +++++++++++++-- fs/smb/client/smb2ops.c | 2 + include/drm/drm_atomic_helper.h | 2 + include/linux/cpuhotplug.h | 1 + include/linux/highmem.h | 2 +- include/linux/hrtimer.h | 4 +- include/linux/hugetlb.h | 5 +- include/linux/kprobes.h | 13 +- include/linux/rethook.h | 7 +- include/linux/scmi_protocol.h | 10 + include/linux/stmmac.h | 1 + include/net/genetlink.h | 2 + include/net/tcp.h | 9 +- include/rdma/ib_umem.h | 9 +- include/rdma/ib_verbs.h | 1 + io_uring/io_uring.c | 9 +- io_uring/kbuf.c | 8 +- io_uring/rsrc.h | 7 - kernel/Kconfig.kexec | 1 - kernel/bpf/core.c | 12 +- kernel/cgroup/legacy_freezer.c | 8 +- kernel/cpu.c | 8 +- kernel/events/core.c | 61 ++++-- kernel/kprobes.c | 4 +- kernel/time/hrtimer.c | 33 +-- kernel/trace/rethook.c | 23 +- kernel/trace/ring_buffer.c | 23 +- kernel/trace/trace.c | 200 +++++++---------- kernel/workqueue.c | 22 +- lib/group_cpus.c | 22 +- lib/zstd/common/fse_decompress.c | 2 +- mm/damon/sysfs.c | 2 +- mm/filemap.c | 2 +- mm/hugetlb.c | 7 + mm/memory_hotplug.c | 15 +- net/core/drop_monitor.c | 4 +- net/core/filter.c | 19 ++ net/core/scm.c | 6 + net/ipv4/ip_gre.c | 11 +- net/ipv4/tcp.c | 22 +- net/ipv4/tcp_input.c | 6 +- net/ipv6/ip6_fib.c | 6 +- net/netfilter/ipset/ip_set_core.c | 14 +- net/netfilter/nf_bpf_link.c | 10 +- net/netfilter/nf_tables_api.c | 5 +- net/netfilter/nft_dynset.c | 13 +- net/netfilter/nft_exthdr.c | 4 +- net/netfilter/nft_fib.c | 8 +- net/netfilter/nft_set_pipapo.c | 3 + net/netfilter/xt_owner.c | 16 +- net/netlink/genetlink.c | 3 + net/packet/af_packet.c | 16 +- net/packet/internal.h | 2 +- net/psample/psample.c | 3 +- net/smc/af_smc.c | 4 +- net/smc/smc_clc.c | 9 +- net/smc/smc_clc.h | 4 +- net/tls/tls_sw.c | 2 + net/xdp/xsk.c | 5 +- scripts/checkstack.pl | 8 +- scripts/dtc/dt-extract-compatibles | 31 ++- scripts/gcc-plugins/randomize_layout_plugin.c | 3 +- scripts/gdb/linux/device.py | 16 +- scripts/kconfig/symbol.c | 14 +- scripts/mod/modpost.c | 6 +- sound/core/pcm.c | 1 + sound/pci/hda/patch_realtek.c | 6 + sound/soc/amd/yc/acp6x-mach.c | 7 + sound/soc/codecs/lpass-tx-macro.c | 5 + sound/soc/codecs/wm_adsp.c | 8 +- sound/soc/fsl/fsl_sai.c | 21 ++ sound/soc/qcom/sc8280xp.c | 17 ++ sound/soc/soc-ops.c | 2 +- sound/usb/mixer_quirks.c | 30 +++ tools/perf/builtin-list.c | 6 + .../arch/arm64/ampere/ampereone/metrics.json | 2 + tools/perf/util/metricgroup.c | 2 +- 268 files changed, 2516 insertions(+), 1404 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/244 vdpa/mlx5: preserve CVQ vringh index
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steve Sistare <[email protected]>
[ Upstream commit 480b3e73720f6b5d76bef2387b1f9d19ed67573b ]
mlx5_vdpa does not preserve userland's view of vring base for the control queue in the following sequence:
ioctl VHOST_SET_VRING_BASE
ioctl VHOST_VDPA_SET_STATUS VIRTIO_CONFIG_S_DRIVER_OK
mlx5_vdpa_set_status()
setup_cvq_vring()
vringh_init_iotlb()
vringh_init_kern()
vrh->last_avail_idx = 0;ioctl VHOST_GET_VRING_BASE
To fix, restore the value of cvq->vring.last_avail_idx after calling vringh_init_iotlb.
Message-Id: <[email protected]>
--- drivers/vdpa/mlx5/net/mlx5_vnet.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/vdpa/mlx5/net/mlx5_vnet.c +6 -1
@@ -2795,13 +2795,18 @@ static int setup_cvq_vring(struct mlx5_vdpa_dev *mvdev)struct mlx5_control_vq *cvq = &mvdev->cvq;int err =0 ; -if (mvdev->actual_features &BIT_ULL (VIRTIO_NET_F_CTRL_VQ )) +if (mvdev->actual_features &BIT_ULL (VIRTIO_NET_F_CTRL_VQ )) { +u16 idx = cvq->vring.last_avail_idx; + err =vringh_init_iotlb (&cvq->vring, mvdev->actual_features,MLX5_CVQ_MAX_ENT , false, (struct vring_desc *)(uintptr_t )cvq->desc_addr, (struct vring_avail *)(uintptr_t )cvq->driver_addr, (struct vring_used *)(uintptr_t )cvq->device_addr); +if (!err) + cvq->vring.last_avail_idx = cvq->vring.last_used_idx = idx; + }return err; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 2/244 scsi: sd: Fix sshdr use in sd_suspend_common()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Christie <[email protected]>
[ Upstream commit 3b83486399a6a9feb9c681b74c21a227d48d7020 ]
If scsi_execute_cmd() returns < 0, it doesn't initialize the sshdr, so we shouldn't access the sshdr. If it returns 0, then the cmd executed successfully, so there is no need to check the sshdr. sd_sync_cache() will only access the sshdr if it's been setup because it calls scsi_status_is_check_condition() before accessing it. However, the sd_sync_cache() caller, sd_suspend_common(), does not check.
sd_suspend_common() is only checking for ILLEGAL_REQUEST which it's using to determine if the command is supported. If it's not it just ignores the error. So to fix its sshdr use this patch just moves that check to sd_sync_cache() where it converts ILLEGAL_REQUEST to success/0. sd_suspend_common() was ignoring that error and sd_shutdown() doesn't check for errors so there will be no behavior changes.
--- drivers/scsi/sd.c | 53 ++++++++++++++++++++--------------------------- 1 file changed, 23 insertions(+), 30 deletions(-)
drivers/scsi/sd.c +23 -30
@@ -1642,24 +1642,21 @@ static unsigned int sd_check_events(struct gendisk *disk, unsigned int clearing)return disk_changed ?DISK_EVENT_MEDIA_CHANGE :0 ; } -static int sd_sync_cache (struct scsi_disk *sdkp,struct scsi_sense_hdr *sshdr) +static int sd_sync_cache (struct scsi_disk *sdkp) {int retries, res;struct scsi_device *sdp = sdkp->device;const int timeout = sdp->request_queue->rq_timeout *SD_FLUSH_TIMEOUT_MULTIPLIER ; -struct scsi_sense_hdr my_sshdr; +struct scsi_sense_hdr sshdr;const struct scsi_exec_args exec_args = { .req_flags =BLK_MQ_REQ_PM , -/* caller might not be interested in sense, but we need it */ - .sshdr = sshdr ? : &my_sshdr, + .sshdr = &sshdr, };if (!scsi_device_online (sdp))return -ENODEV ; - sshdr = exec_args.sshdr; -for (retries =3 ; retries >0 ; --retries) {unsigned char cmd[16 ] = {0 };
@@ -1684,15 +1681,23 @@ static int sd_sync_cache(struct scsi_disk *sdkp, struct scsi_sense_hdr *sshdr)return res;if (scsi_status_is_check_condition (res) && -scsi_sense_valid (sshdr)) { -sd_print_sense_hdr (sdkp, sshdr); +scsi_sense_valid (&sshdr)) { +sd_print_sense_hdr (sdkp, &sshdr);/* we need to evaluate the error return */ -if (sshdr->asc ==0x3a ||/* medium not present */ - sshdr->asc ==0x20 ||/* invalid command */ - (sshdr->asc ==0x74 && sshdr->ascq ==0x71 ))/* drive is password locked */ +if (sshdr.asc ==0x3a ||/* medium not present */ + sshdr.asc ==0x20 ||/* invalid command */ + (sshdr.asc ==0x74 && sshdr.ascq ==0x71 ))/* drive is password locked */ /* this is no error here */ return 0 ; +/* +* This drive doesn't support sync and there's not much +* we can do because this is called during shutdown +* or suspend so just return success so those operations +* can proceed. +*/ +if (sshdr.sense_key ==ILLEGAL_REQUEST ) +return 0 ; }switch (host_byte (res)) {
@@ -3847,7 +3852,7 @@ static void sd_shutdown(struct device *dev)if (sdkp->WCE && sdkp->media_present) {sd_printk (KERN_NOTICE , sdkp,"Synchronizing SCSI cache\n" ); -sd_sync_cache (sdkp,NULL ); +sd_sync_cache (sdkp); } if ((system_state != SYSTEM_RESTART &&
@@ -3868,7 +3873,6 @@ static inline bool sd_do_start_stop(struct scsi_device *sdev, bool runtime)static int sd_suspend_common (struct device *dev,bool runtime) {struct scsi_disk *sdkp =dev_get_drvdata (dev); -struct scsi_sense_hdr sshdr;int ret =0 ;if (!sdkp)/* E.g.: runtime suspend following sd_remove() */
@@ -3877,24 +3881,13 @@ static int sd_suspend_common(struct device *dev, bool runtime)if (sdkp->WCE && sdkp->media_present) {if (!sdkp->device->silence_suspend)sd_printk (KERN_NOTICE , sdkp,"Synchronizing SCSI cache\n" ); - ret =sd_sync_cache (sdkp, &sshdr); - -if (ret) { -/* ignore OFFLINE device */ -if (ret == -ENODEV ) -return 0 ; - -if (!scsi_sense_valid (&sshdr) || - sshdr.sense_key !=ILLEGAL_REQUEST ) -return ret; + ret =sd_sync_cache (sdkp); +/* ignore OFFLINE device */ +if (ret == -ENODEV ) +return 0 ; -/* -* sshdr.sense_key == ILLEGAL_REQUEST means this drive -* doesn't support sync. There's not much to do and -* suspend shouldn't fail. -*/ - ret =0 ; - } +if (ret) +return ret; }if (sd_do_start_stop (sdkp->device, runtime)) {
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 3/244 hrtimers: Push pending hrtimers away from outgoing CPU earlier
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
[ Upstream commit 5c0930ccaad5a74d74e8b18b648c5eb21ed2fe94 ]
2b8272ff4a70 ("cpu/hotplug: Prevent self deadlock on CPU hot-unplug") solved the straight forward CPU hotplug deadlock vs. the scheduler bandwidth timer. Yu discovered a more involved variant where a task which has a bandwidth timer started on the outgoing CPU holds a lock and then gets throttled. If the lock required by one of the CPU hotplug callbacks the hotplug operation deadlocks because the unthrottling timer event is not handled on the dying CPU and can only be recovered once the control CPU reaches the hotplug state which pulls the pending hrtimers from the dead CPU.
Solve this by pushing the hrtimers away from the dying CPU in the dying callbacks. Nothing can queue a hrtimer on the dying CPU at that point because all other CPUs spin in stop_machine() with interrupts disabled and once the operation is finished the CPU is marked offline.
--- include/linux/cpuhotplug.h | 1 + include/linux/hrtimer.h | 4 ++-- kernel/cpu.c | 8 +++++++- kernel/time/hrtimer.c | 33 ++++++++++++--------------------- 4 files changed, 22 insertions(+), 24 deletions(-)
include/linux/cpuhotplug.h +1 -0
@@ -194,6 +194,7 @@ enum cpuhp_state {CPUHP_AP_ARM_CORESIGHT_CTI_STARTING ,CPUHP_AP_ARM64_ISNDEP_STARTING ,CPUHP_AP_SMPCFD_DYING , +CPUHP_AP_HRTIMERS_DYING ,CPUHP_AP_X86_TBOOT_DYING ,CPUHP_AP_ARM_CACHE_B15_RAC_DYING , CPUHP_AP_ONLINE,
include/linux/hrtimer.h +2 -2
@@ -531,9 +531,9 @@ extern void sysrq_timer_list_show(void);int hrtimers_prepare_cpu (unsigned int cpu);#ifdef CONFIG_HOTPLUG_CPU -int hrtimers_dead_cpu (unsigned int cpu); +int hrtimers_cpu_dying (unsigned int cpu);#else -#define hrtimers_dead_cpu NULL +#define hrtimers_cpu_dying NULL#endif #endif
kernel/cpu.c +7 -1
@@ -2109,7 +2109,7 @@ static struct cpuhp_step cpuhp_hp_states[] = { [CPUHP_HRTIMERS_PREPARE] = { .name = "hrtimers:prepare", .startup.single = hrtimers_prepare_cpu, - .teardown.single = hrtimers_dead_cpu, + .teardown.single = NULL, }, [CPUHP_SMPCFD_PREPARE] = { .name = "smpcfd:prepare",
@@ -2201,6 +2201,12 @@ static struct cpuhp_step cpuhp_hp_states[] = { .startup.single = NULL, .teardown.single = smpcfd_dying_cpu, }, + [CPUHP_AP_HRTIMERS_DYING] = { + .name = "hrtimers:dying", + .startup.single = NULL, + .teardown.single = hrtimers_cpu_dying, + }, +/* Entry state on starting. Interrupts enabled from here on. Transient * state for synchronsization */ [CPUHP_AP_ONLINE] = {
kernel/time/hrtimer.c +12 -21
@@ -2219,29 +2219,22 @@ static void migrate_hrtimer_list(struct hrtimer_clock_base *old_base, } } -int hrtimers_dead_cpu (unsigned int scpu) +int hrtimers_cpu_dying (unsigned int dying_cpu) {struct hrtimer_cpu_base *old_base, *new_base; -int i; +int i, ncpu =cpumask_first (cpu_active_mask); -BUG_ON (cpu_online (scpu)); -tick_cancel_sched_timer (scpu); +tick_cancel_sched_timer (dying_cpu); + + old_base =this_cpu_ptr (&hrtimer_bases); + new_base = &per_cpu (hrtimer_bases, ncpu); -/* -* this BH disable ensures that raise_softirq_irqoff() does -* not wakeup ksoftirqd (and acquire the pi-lock) while -* holding the cpu_base lock -*/ -local_bh_disable (); -local_irq_disable (); - old_base = &per_cpu (hrtimer_bases, scpu); - new_base =this_cpu_ptr (&hrtimer_bases);/* * The caller is globally serialized and nobody else * takes two locks at once, deadlock is not possible. */ -raw_spin_lock (&new_base->lock); -raw_spin_lock_nested (&old_base->lock,SINGLE_DEPTH_NESTING ); +raw_spin_lock (&old_base->lock); +raw_spin_lock_nested (&new_base->lock,SINGLE_DEPTH_NESTING );for (i =0 ; i <HRTIMER_MAX_CLOCK_BASES ; i++) { migrate_hrtimer_list(&old_base->clock_base[i],
@@ -2252,15 +2245,13 @@ int hrtimers_dead_cpu(unsigned int scpu)* The migration might have changed the first expiring softirq * timer on this CPU. Update it. */ -hrtimer_update_softirq_timer (new_base, false); +__hrtimer_get_next_event (new_base,HRTIMER_ACTIVE_SOFT ); +/* Tell the other CPU to retrigger the next event */ +smp_call_function_single (ncpu, retrigger_next_event,NULL ,0 ); -raw_spin_unlock (&old_base->lock);raw_spin_unlock (&new_base->lock); +raw_spin_unlock (&old_base->lock); -/* Check, if we got expired work to do */ -__hrtimer_peek_ahead_timers (); -local_irq_enable (); -local_bh_enable ();return 0 ; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 4/244 i2c: designware: Fix corrupted memory seen in the ISR
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Bottorff <[email protected]>
[ Upstream commit f726eaa787e9f9bc858c902d18a09af6bcbfcdaf ]
When running on a many core ARM64 server, errors were happening in the ISR that looked like corrupted memory. These corruptions would fix themselves if small delays were inserted in the ISR. Errors reported by the driver included "i2c_designware APMC0D0F:00: i2c_dw_xfer_msg: invalid target address" and "i2c_designware APMC0D0F:00:controller timed out" during in-band IPMI SSIF stress tests.
The problem was determined to be memory writes in the driver were not becoming visible to all cores when execution rapidly shifted between cores, like when a register write immediately triggers an ISR. Processors with weak memory ordering, like ARM64, make no guarantees about the order normal memory writes become globally visible, unless barrier instructions are used to control ordering.
To solve this, regmap accessor functions configured by this driver were changed to use non-relaxed forms of the low-level register access functions, which include a barrier on platforms that require it. This assures memory writes before a controller register access are visible to all cores. The community concluded defaulting to correct operation outweighed defaulting to the small performance gains from using relaxed access functions. Being a low speed device added weight to this choice of default register access behavior.
--- drivers/i2c/busses/i2c-designware-common.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/i2c/busses/i2c-designware-common.c +8 -8
@@ -63,7 +63,7 @@ static int dw_reg_read(void *context, unsigned int reg, unsigned int *val) {struct dw_i2c_dev *dev = context; - *val =readl_relaxed (dev->base + reg); + *val =readl (dev->base + reg);return 0 ; }
@@ -72,7 +72,7 @@ static int dw_reg_write(void *context, unsigned int reg, unsigned int val) {struct dw_i2c_dev *dev = context; -writel_relaxed (val, dev->base + reg); +writel (val, dev->base + reg);return 0 ; }
@@ -81,7 +81,7 @@ static int dw_reg_read_swab(void *context, unsigned int reg, unsigned int *val) {struct dw_i2c_dev *dev = context; - *val =swab32 (readl_relaxed (dev->base + reg)); + *val =swab32 (readl (dev->base + reg));return 0 ; }
@@ -90,7 +90,7 @@ static int dw_reg_write_swab(void *context, unsigned int reg, unsigned int val) {struct dw_i2c_dev *dev = context; -writel_relaxed (swab32 (val), dev->base + reg); +writel (swab32 (val), dev->base + reg);return 0 ; }
@@ -99,8 +99,8 @@ static int dw_reg_read_word(void *context, unsigned int reg, unsigned int *val) {struct dw_i2c_dev *dev = context; - *val =readw_relaxed (dev->base + reg) | - (readw_relaxed (dev->base + reg +2 ) <<16 ); + *val =readw (dev->base + reg) | + (readw (dev->base + reg +2 ) <<16 );return 0 ; }
@@ -109,8 +109,8 @@ static int dw_reg_write_word(void *context, unsigned int reg, unsigned int val) {struct dw_i2c_dev *dev = context; -writew_relaxed (val, dev->base + reg); -writew_relaxed (val >>16 , dev->base + reg +2 ); +writew (val, dev->base + reg); +writew (val >>16 , dev->base + reg +2 );return 0 ; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 5/244 i2c: ocores: Move system PM hooks to the NOIRQ phase
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Holland <[email protected]>
[ Upstream commit 382561d16854a747e6df71034da08d20d6013dfe ]
When an I2C device contains a wake IRQ subordinate to a regmap-irq chip, the regmap-irq code must be able to perform I2C transactions during suspend_device_irqs() and resume_device_irqs(). Therefore, the bus must be suspended/resumed during the NOIRQ phase.
--- drivers/i2c/busses/i2c-ocores.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/i2c/busses/i2c-ocores.c +2 -2
@@ -771,8 +771,8 @@ static int ocores_i2c_resume(struct device *dev)return ocores_init (dev, i2c); } -static DEFINE_SIMPLE_DEV_PM_OPS(ocores_i2c_pm, - ocores_i2c_suspend, ocores_i2c_resume); +static DEFINE_NOIRQ_DEV_PM_OPS(ocores_i2c_pm, + ocores_i2c_suspend, ocores_i2c_resume);static struct platform_driver ocores_i2c_driver = { .probe = ocores_i2c_probe,
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 6/244 netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jozsef Kadlecsik <[email protected]>
[ Upstream commit 28628fa952fefc7f2072ce6e8016968cc452b1ba ]
Linkui Xiao reported that there's a race condition when ipset swap and destroy is called, which can lead to crash in add/del/test element operations. Swap then destroy are usual operations to replace a set with another one in a production system. The issue can in some cases be reproduced with the script:
ipset create hash_ip1 hash:net family inet hashsize 1024 maxelem 1048576 ipset add hash_ip1 172.20.0.0/16
ipset add hash_ip1 192.168.0.0/16
iptables -A INPUT -m set --match-set hash_ip1 src -j ACCEPT while [ 1 ]
do
# ... Ongoing traffic...
ipset create hash_ip2 hash:net family inet hashsize 1024 maxelem 1048576
ipset add hash_ip2 172.20.0.0/16
ipset swap hash_ip1 hash_ip2
ipset destroy hash_ip2
sleep 0.05
doneIn the race case the possible order of the operations are
CPU0 CPU1
ip_set_test
ipset swap hash_ip1 hash_ip2 ipset destroy hash_ip2
hash_net_kadt
Swap replaces hash_ip1 with hash_ip2 and then destroy removes hash_ip2 which is the original hash_ip1. ip_set_test was called on hash_ip1 and because destroy removed it, hash_net_kadt crashes.
The fix is to force ip_set_swap() to wait for all readers to finish accessing the old set pointers by calling synchronize_rcu().
The first version of the patch was written by Linkui Xiao <[email protected]>.
v2: synchronize_rcu() is moved into ip_set_swap() in order not to burden
ip_set_destroy() unnecessarily when all sets are destroyed.
v3: Florian Westphal pointed out that all netfilter hooks run with rcu_read_lock() held
and em_ipset.c wraps the entire ip_set_test() in rcu read lock/unlock pair. So there's no need to extend the rcu read locked area in ipset itself.
Reported by: Linkui Xiao <[email protected]>
--- net/netfilter/ipset/ip_set_core.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
net/netfilter/ipset/ip_set_core.c +7 -7
@@ -61,6 +61,8 @@ MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_IPSET); ip_set_dereference((inst)->ip_set_list)[id]#define ip_set_ref_netlink (inst,id) \ rcu_dereference_raw((inst)->ip_set_list)[id] +#define ip_set_dereference_nfnl (p) \ + rcu_dereference_check(p, lockdep_nfnl_is_held(NFNL_SUBSYS_IPSET))/* The set types are implemented in modules and registered set types * can be found in ip_set_type_list. Adding/deleting types is
@@ -708,15 +710,10 @@ __ip_set_put_netlink(struct ip_set *set)static struct ip_set *ip_set_rcu_get (struct net *net,ip_set_id_t index) { -struct ip_set *set;struct ip_set_net *inst =ip_set_pernet (net); -rcu_read_lock (); -/* ip_set_list itself needs to be protected */ - set =rcu_dereference (inst->ip_set_list)[index]; -rcu_read_unlock (); - -return set; +/* ip_set_list and the set pointer need to be protected */ +return ip_set_dereference_nfnl (inst->ip_set_list)[index]; } static inline void
@@ -1397,6 +1394,9 @@ static int ip_set_swap(struct sk_buff *skb, const struct nfnl_info *info,ip_set (inst, to_id) = from;write_unlock_bh (&ip_set_ref_lock); +/* Make sure all readers of the old set pointers are completed. */ +synchronize_rcu (); +return 0 ; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 7/244 nouveau: use an rwlock for the event lock.
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Airlie <[email protected]>
[ Upstream commit a2e36cd56041e277d7d81d35638fd8d9731e21f5 ]
This allows it to break the following circular locking dependency.
Aug 10 07:01:29 dg1test kernel: ======================================================
Aug 10 07:01:29 dg1test kernel: WARNING: possible circular locking dependency detected
Aug 10 07:01:29 dg1test kernel: 6.4.0-rc7+ #10 Not tainted
Aug 10 07:01:29 dg1test kernel: ------------------------------------------------------
Aug 10 07:01:29 dg1test kernel: wireplumber/2236 is trying to acquire lock:
Aug 10 07:01:29 dg1test kernel: ffff8fca5320da18 (&fctx->lock){-...}-{2:2}, at: nouveau_fence_wait_uevent_handler+0x2b/0x100 [nouveau]
Aug 10 07:01:29 dg1test kernel:
but task is already holding lock:
Aug 10 07:01:29 dg1test kernel: ffff8fca41208610 (&event->list_lock#2){-...}-{2:2}, at: nvkm_event_ntfy+0x50/0xf0 [nouveau]
Aug 10 07:01:29 dg1test kernel:
which lock already depends on the new lock.
Aug 10 07:01:29 dg1test kernel:
the existing dependency chain (in reverse order) is:
Aug 10 07:01:29 dg1test kernel:
-> #3 (&event->list_lock#2){-...}-{2:2}:
Aug 10 07:01:29 dg1test kernel: _raw_spin_lock_irqsave+0x4b/0x70
Aug 10 07:01:29 dg1test kernel: nvkm_event_ntfy+0x50/0xf0 [nouveau]
Aug 10 07:01:29 dg1test kernel: ga100_fifo_nonstall_intr+0x24/0x30 [nouveau]
Aug 10 07:01:29 dg1test kernel: nvkm_intr+0x12c/0x240 [nouveau]
Aug 10 07:01:29 dg1test kernel: __handle_irq_event_percpu+0x88/0x240
Aug 10 07:01:29 dg1test kernel: handle_irq_event+0x38/0x80
Aug 10 07:01:29 dg1test kernel: handle_edge_irq+0xa3/0x240
Aug 10 07:01:29 dg1test kernel: __common_interrupt+0x72/0x160
Aug 10 07:01:29 dg1test kernel: common_interrupt+0x60/0xe0
Aug 10 07:01:29 dg1test kernel: asm_common_interrupt+0x26/0x40
Aug 10 07:01:29 dg1test kernel:
-> #2 (&device->intr.lock){-...}-{2:2}:
Aug 10 07:01:29 dg1test kernel: _raw_spin_lock_irqsave+0x4b/0x70
Aug 10 07:01:29 dg1test kernel: nvkm_inth_allow+0x2c/0x80 [nouveau]
Aug 10 07:01:29 dg1test kernel: nvkm_event_ntfy_state+0x181/0x250 [nouveau]
Aug 10 07:01:29 dg1test kernel: nvkm_event_ntfy_allow+0x63/0xd0 [nouveau]
Aug 10 07:01:29 dg1test kernel: nvkm_uevent_mthd+0x4d/0x70 [nouveau]
Aug 10 07:01:29 dg1test kernel: nvkm_ioctl+0x10b/0x250 [nouveau]
Aug 10 07:01:29 dg1test kernel: nvif_object_mthd+0xa8/0x1f0 [nouveau]
Aug 10 07:01:29 dg1test kernel: nvif_event_allow+0x2a/0xa0 [nouveau]
Aug 10 07:01:29 dg1test kernel: nouveau_fence_enable_signaling+0x78/0x80 [nouveau]
Aug 10 07:01:29 dg1test kernel: __dma_fence_enable_signaling+0x5e/0x100
Aug 10 07:01:29 dg1test kernel: dma_fence_add_callback+0x4b/0xd0
Aug 10 07:01:29 dg1test kernel: nouveau_cli_work_queue+0xae/0x110 [nouveau]
Aug 10 07:01:29 dg1test kernel: nouveau_gem_object_close+0x1d1/0x2a0 [nouveau]
Aug 10 07:01:29 dg1test kernel: drm_gem_handle_delete+0x70/0xe0 [drm]
Aug 10 07:01:29 dg1test kernel: drm_ioctl_kernel+0xa5/0x150 [drm]
Aug 10 07:01:29 dg1test kernel: drm_ioctl+0x256/0x490 [drm]
Aug 10 07:01:29 dg1test kernel: nouveau_drm_ioctl+0x5a/0xb0 [nouveau]
Aug 10 07:01:29 dg1test kernel: __x64_sys_ioctl+0x91/0xd0
Aug 10 07:01:29 dg1test kernel: do_syscall_64+0x3c/0x90
Aug 10 07:01:29 dg1test kernel: entry_SYSCALL_64_after_hwframe+0x72/0xdc
Aug 10 07:01:29 dg1test kernel:
-> #1 (&event->refs_lock#4){....}-{2:2}:
Aug 10 07:01:29 dg1test kernel: _raw_spin_lock_irqsave+0x4b/0x70
Aug 10 07:01:29 dg1test kernel: nvkm_event_ntfy_state+0x37/0x250 [nouveau]
Aug 10 07:01:29 dg1test kernel: nvkm_event_ntfy_allow+0x63/0xd0 [nouveau]
Aug 10 07:01:29 dg1test kernel: nvkm_uevent_mthd+0x4d/0x70 [nouveau]
Aug 10 07:01:29 dg1test kernel: nvkm_ioctl+0x10b/0x250 [nouveau]
Aug 10 07:01:29 dg1test kernel: nvif_object_mthd+0xa8/0x1f0 [nouveau]
Aug 10 07:01:29 dg1test kernel: nvif_event_allow+0x2a/0xa0 [nouveau]
Aug 10 07:01:29 dg1test kernel: nouveau_fence_enable_signaling+0x78/0x80 [nouveau]
Aug 10 07:01:29 dg1test kernel: __dma_fence_enable_signaling+0x5e/0x100
Aug 10 07:01:29 dg1test kernel: dma_fence_add_callback+0x4b/0xd0
Aug 10 07:01:29 dg1test kernel: nouveau_cli_work_queue+0xae/0x110 [nouveau]
Aug 10 07:01:29 dg1test kernel: nouveau_gem_object_close+0x1d1/0x2a0 [nouveau]
Aug 10 07:01:29 dg1test kernel: drm_gem_handle_delete+0x70/0xe0 [drm]
Aug 10 07:01:29 dg1test kernel: drm_ioctl_kernel+0xa5/0x150 [drm]
Aug 10 07:01:29 dg1test kernel: drm_ioctl+0x256/0x490 [drm]
Aug 10 07:01:29 dg1test kernel: nouveau_drm_ioctl+0x5a/0xb0 [nouveau]
Aug 10 07:01:29 dg1test kernel: __x64_sys_ioctl+0x91/0xd0
Aug 10 07:01:29 dg1test kernel: do_syscall_64+0x3c/0x90
Aug 10 07:01:29 dg1test kernel: entry_SYSCALL_64_after_hwframe+0x72/0xdc
Aug 10 07:01:29 dg1test kernel:
-> #0 (&fctx->lock){-...}-{2:2}:
Aug 10 07:01:29 dg1test kernel: __lock_acquire+0x14e3/0x2240
Aug 10 07:01:29 dg1test kernel: lock_acquire+0xc8/0x2a0
Aug 10 07:01:29 dg1test kernel: _raw_spin_lock_irqsave+0x4b/0x70
Aug 10 07:01:29 dg1test kernel: nouveau_fence_wait_uevent_handler+0x2b/0x100 [nouveau]
Aug 10 07:01:29 dg1test kernel: nvkm_client_event+0xf/0x20 [nouveau]
Aug 10 07:01:29 dg1test kernel: nvkm_event_ntfy+0x9b/0xf0 [nouveau]
Aug 10 07:01:29 dg1test kernel: ga100_fifo_nonstall_intr+0x24/0x30 [nouveau]
Aug 10 07:01:29 dg1test kernel: nvkm_intr+0x12c/0x240 [nouveau]
Aug 10 07:01:29 dg1test kernel: __handle_irq_event_percpu+0x88/0x240
Aug 10 07:01:29 dg1test kernel: handle_irq_event+0x38/0x80
Aug 10 07:01:29 dg1test kernel: handle_edge_irq+0xa3/0x240
Aug 10 07:01:29 dg1test kernel: __common_interrupt+0x72/0x160
Aug 10 07:01:29 dg1test kernel: common_interrupt+0x60/0xe0
Aug 10 07:01:29 dg1test kernel: asm_common_interrupt+0x26/0x40
Aug 10 07:01:29 dg1test kernel:
other info that might help us debug this:
Aug 10 07:01:29 dg1test kernel: Chain exists of:
&fctx->lock --> &device->intr.lock --> &event->list_lock#2
Aug 10 07:01:29 dg1test kernel: Possible unsafe locking scenario:
Aug 10 07:01:29 dg1test kernel: CPU0 CPU1
Aug 10 07:01:29 dg1test kernel: ---- ----
Aug 10 07:01:29 dg1test kernel: lock(&event->list_lock#2);
Aug 10 07:01:29 dg1test kernel: lock(&device->intr.lock);
Aug 10 07:01:29 dg1test kernel: lock(&event->list_lock#2);
Aug 10 07:01:29 dg1test kernel: lock(&fctx->lock);
Aug 10 07:01:29 dg1test kernel:
*** DEADLOCK ***
Aug 10 07:01:29 dg1test kernel: 2 locks held by wireplumber/2236:
Aug 10 07:01:29 dg1test kernel: #0: ffff8fca53177bf8 (&device->intr.lock){-...}-{2:2}, at: nvkm_intr+0x29/0x240 [nouveau]
Aug 10 07:01:29 dg1test kernel: #1: ffff8fca41208610 (&event->list_lock#2){-...}-{2:2}, at: nvkm_event_ntfy+0x50/0xf0 [nouveau]
Aug 10 07:01:29 dg1test kernel:
stack backtrace:
Aug 10 07:01:29 dg1test kernel: CPU: 6 PID: 2236 Comm: wireplumber Not tainted 6.4.0-rc7+ #10
Aug 10 07:01:29 dg1test kernel: Hardware name: Gigabyte Technology Co., Ltd. Z390 I AORUS PRO WIFI/Z390 I AORUS PRO WIFI-CF, BIOS F8 11/05/2021
Aug 10 07:01:29 dg1test kernel: Call Trace:
Aug 10 07:01:29 dg1test kernel: <TASK>
Aug 10 07:01:29 dg1test kernel: dump_stack_lvl+0x5b/0x90
Aug 10 07:01:29 dg1test kernel: check_noncircular+0xe2/0x110
Aug 10 07:01:29 dg1test kernel: __lock_acquire+0x14e3/0x2240
Aug 10 07:01:29 dg1test kernel: lock_acquire+0xc8/0x2a0
Aug 10 07:01:29 dg1test kernel: ? nouveau_fence_wait_uevent_handler+0x2b/0x100 [nouveau]
Aug 10 07:01:29 dg1test kernel: ? lock_acquire+0xc8/0x2a0
Aug 10 07:01:29 dg1test kernel: _raw_spin_lock_irqsave+0x4b/0x70
Aug 10 07:01:29 dg1test kernel: ? nouveau_fence_wait_uevent_handler+0x2b/0x100 [nouveau]
Aug 10 07:01:29 dg1test kernel: nouveau_fence_wait_uevent_handler+0x2b/0x100 [nouveau]
Aug 10 07:01:29 dg1test kernel: nvkm_client_event+0xf/0x20 [nouveau]
Aug 10 07:01:29 dg1test kernel: nvkm_event_ntfy+0x9b/0xf0 [nouveau]
Aug 10 07:01:29 dg1test kernel: ga100_fifo_nonstall_intr+0x24/0x30 [nouveau]
Aug 10 07:01:29 dg1test kernel: nvkm_intr+0x12c/0x240 [nouveau]
Aug 10 07:01:29 dg1test kernel: __handle_irq_event_percpu+0x88/0x240
Aug 10 07:01:29 dg1test kernel: handle_irq_event+0x38/0x80
Aug 10 07:01:29 dg1test kernel: handle_edge_irq+0xa3/0x240
Aug 10 07:01:29 dg1test kernel: __common_interrupt+0x72/0x160
Aug 10 07:01:29 dg1test kernel: common_interrupt+0x60/0xe0
Aug 10 07:01:29 dg1test kernel: asm_common_interrupt+0x26/0x40
Aug 10 07:01:29 dg1test kernel: RIP: 0033:0x7fb66174d700
Aug 10 07:01:29 dg1test kernel: Code: c1 e2 05 29 ca 8d 0c 10 0f be 07 84 c0 75 eb 89 c8 c3 0f 1f 84 00 00 00 00 00 f3 0f 1e fa e9 d7 0f fc ff 0f 1f 80 00 00 00 00 <f3> 0f 1e fa e9 c7 0f fc>
Aug 10 07:01:29 dg1test kernel: RSP: 002b:00007ffdd3c48438 EFLAGS: 00000206
Aug 10 07:01:29 dg1test kernel: RAX: 000055bb758763c0 RBX: 000055bb758752c0 RCX: 00000000000028b0
Aug 10 07:01:29 dg1test kernel: RDX: 000055bb758752c0 RSI: 000055bb75887490 RDI: 000055bb75862950
Aug 10 07:01:29 dg1test kernel: RBP: 00007ffdd3c48490 R08: 000055bb75873b10 R09: 0000000000000001
Aug 10 07:01:29 dg1test kernel: R10: 0000000000000004 R11: 000055bb7587f000 R12: 000055bb75887490
Aug 10 07:01:29 dg1test kernel: R13: 000055bb757f6280 R14: 000055bb758875c0 R15: 000055bb757f6280
Aug 10 07:01:29 dg1test kernel: </TASK>--- drivers/gpu/drm/nouveau/include/nvkm/core/event.h | 4 ++-- drivers/gpu/drm/nouveau/nvkm/core/event.c | 12 ++++++------ 2 files changed, 8 insertions(+), 8 deletions(-)
drivers/gpu/drm/nouveau/include/nvkm/core/event.h +2 -2
@@ -14,7 +14,7 @@ struct nvkm_event {int index_nr;spinlock_t refs_lock; -spinlock_t list_lock; +rwlock_t list_lock;int *refs;struct list_head ntfy;
@@ -38,7 +38,7 @@ nvkm_event_init(const struct nvkm_event_func *func, struct nvkm_subdev *subdev, int types_nr, int index_nr, struct nvkm_event *event) { spin_lock_init(&event->refs_lock); -spin_lock_init (&event->list_lock); +rwlock_init (&event->list_lock);return __nvkm_event_init (func, subdev, types_nr, index_nr, event); }
drivers/gpu/drm/nouveau/nvkm/core/event.c +6 -6
@@ -81,17 +81,17 @@ nvkm_event_ntfy_state(struct nvkm_event_ntfy *ntfy)static void nvkm_event_ntfy_remove (struct nvkm_event_ntfy *ntfy) { -spin_lock_irq (&ntfy->event->list_lock); +write_lock_irq (&ntfy->event->list_lock);list_del_init (&ntfy->head); -spin_unlock_irq (&ntfy->event->list_lock); +write_unlock_irq (&ntfy->event->list_lock); }static void nvkm_event_ntfy_insert (struct nvkm_event_ntfy *ntfy) { -spin_lock_irq (&ntfy->event->list_lock); +write_lock_irq (&ntfy->event->list_lock);list_add_tail (&ntfy->head, &ntfy->event->ntfy); -spin_unlock_irq (&ntfy->event->list_lock); +write_unlock_irq (&ntfy->event->list_lock); } static void
@@ -176,7 +176,7 @@ nvkm_event_ntfy(struct nvkm_event *event, int id, u32 bits)return ;nvkm_trace (event->subdev,"event: ntfy %08x on %d\n" , bits, id); -spin_lock_irqsave (&event->list_lock, flags); +read_lock_irqsave (&event->list_lock, flags);list_for_each_entry_safe (ntfy, ntmp, &event->ntfy, head) {if (ntfy->id == id && ntfy->bits & bits) {
@@ -185,7 +185,7 @@ nvkm_event_ntfy(struct nvkm_event *event, int id, u32 bits) } } -spin_unlock_irqrestore (&event->list_lock, flags); +read_unlock_irqrestore (&event->list_lock, flags); }void
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 8/244 zstd: Fix array-index-out-of-bounds UBSAN warning
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nick Terrell <[email protected]>
[ Upstream commit 77618db346455129424fadbbaec596a09feaf3bb ]
Zstd used an array of length 1 to mean a flexible array for C89 compatibility. Switch to a C99 flexible array to fix the UBSAN warning.
Tested locally by booting the kernel and writing to and reading from a BtrFS filesystem with zstd compression enabled. I was unable to reproduce the issue before the fix, however it is a trivial change.
--- lib/zstd/common/fse_decompress.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
lib/zstd/common/fse_decompress.c +1 -1
@@ -312,7 +312,7 @@ size_t FSE_decompress_wksp(void* dst, size_t dstCapacity, const void* cSrc, sizetypedef struct {short ncount[FSE_MAX_SYMBOL_VALUE +1 ]; -FSE_DTable dtable[1 ];/* Dynamically sized */ +FSE_DTable dtable[];/* Dynamically sized */ }FSE_DecompressWksp ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 9/244 tg3: Move the [rt]x_dropped counters to tg3_napi
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Pakhunov <[email protected]>
[ Upstream commit 907d1bdb8b2cc0357d03a1c34d2a08d9943760b1 ]
This change moves [rt]x_dropped counters to tg3_napi so that they can be updated by a single writer, race-free.
--- drivers/net/ethernet/broadcom/tg3.c | 38 +++++++++++++++++++++++++---- drivers/net/ethernet/broadcom/tg3.h | 4 +-- 2 files changed, 35 insertions(+), 7 deletions(-)
drivers/net/ethernet/broadcom/tg3.c +33 -5
@@ -6845,7 +6845,7 @@ static int tg3_rx(struct tg3_napi *tnapi, int budget) desc_idx, *post_ptr); drop_it_no_recycle:/* Other statistics kept track of by card. */ - tp->rx_dropped++; + tnapi->rx_dropped++; goto next_pkt; }
@@ -8146,7 +8146,7 @@ static netdev_tx_t tg3_start_xmit(struct sk_buff *skb, struct net_device *dev) drop:dev_kfree_skb_any (skb); drop_nofree: - tp->tx_dropped++; + tnapi->tx_dropped++;return NETDEV_TX_OK ; }
@@ -9325,7 +9325,7 @@ static void __tg3_set_rx_mode(struct net_device *);/* tp->lock is held. */ static int tg3_halt (struct tg3 *tp,int kind,bool silent) { -int err; +int err, i;tg3_stop_fw (tp);
@@ -9346,6 +9346,13 @@ static int tg3_halt(struct tg3 *tp, int kind, bool silent)/* And make sure the next sample is new data */ memset (tp->hw_stats,0 ,sizeof (struct tg3_hw_stats )); + +for (i =0 ; i <TG3_IRQ_MAX_VECS ; ++i) { +struct tg3_napi *tnapi = &tp->napi[i]; + + tnapi->rx_dropped =0 ; + tnapi->tx_dropped =0 ; + } }return err;
@@ -11895,6 +11902,9 @@ static void tg3_get_nstats(struct tg3 *tp, struct rtnl_link_stats64 *stats) {struct rtnl_link_stats64 *old_stats = &tp->net_stats_prev;struct tg3_hw_stats *hw_stats = tp->hw_stats; +unsigned long rx_dropped; +unsigned long tx_dropped; +int i; stats->rx_packets = old_stats->rx_packets + get_stat64(&hw_stats->rx_ucast_packets) +
@@ -11941,8 +11951,26 @@ static void tg3_get_nstats(struct tg3 *tp, struct rtnl_link_stats64 *stats) stats->rx_missed_errors = old_stats->rx_missed_errors +get_stat64 (&hw_stats->rx_discards); - stats->rx_dropped = tp->rx_dropped; - stats->tx_dropped = tp->tx_dropped; +/* Aggregate per-queue counters. The per-queue counters are updated +* by a single writer, race-free. The result computed by this loop +* might not be 100% accurate (counters can be updated in the middle of +* the loop) but the next tg3_get_nstats() will recompute the current +* value so it is acceptable. +* +* Note that these counters wrap around at 4G on 32bit machines. +*/ + rx_dropped = (unsigned long )(old_stats->rx_dropped); + tx_dropped = (unsigned long )(old_stats->tx_dropped); + +for (i =0 ; i < tp->irq_cnt; i++) { +struct tg3_napi *tnapi = &tp->napi[i]; + + rx_dropped += tnapi->rx_dropped; + tx_dropped += tnapi->tx_dropped; + } + + stats->rx_dropped = rx_dropped; + stats->tx_dropped = tx_dropped; }static int tg3_get_regs_len (struct net_device *dev)
drivers/net/ethernet/broadcom/tg3.h +2 -2
@@ -3018,6 +3018,7 @@ struct tg3_napi {u16 *rx_rcb_prod_idx;struct tg3_rx_prodring_set prodring;struct tg3_rx_buffer_desc *rx_rcb; +unsigned long rx_dropped;u32 tx_prod____cacheline_aligned ;u32 tx_cons;
@@ -3026,6 +3027,7 @@ struct tg3_napi {u32 prodmbox;struct tg3_tx_buffer_desc *tx_ring;struct tg3_tx_ring_info *tx_buffers; +unsigned long tx_dropped;dma_addr_t status_mapping;dma_addr_t rx_rcb_mapping;
@@ -3219,8 +3221,6 @@ struct tg3 {/* begin "everything else" cacheline(s) section */ -unsigned long rx_dropped; -unsigned long tx_dropped;struct rtnl_link_stats64 net_stats_prev;struct tg3_ethtool_stats estats_prev;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 10/244 tg3: Increment tx_dropped in tg3_tso_bug()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Pakhunov <[email protected]>
[ Upstream commit 17dd5efe5f36a96bd78012594fabe21efb01186b ]
tg3_tso_bug() drops a packet if it cannot be segmented for any reason. The number of discarded frames should be incremented accordingly.
--- drivers/net/ethernet/broadcom/tg3.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/broadcom/tg3.c +3 -1
@@ -7874,8 +7874,10 @@ static int tg3_tso_bug(struct tg3 *tp, struct tg3_napi *tnapi, segs =skb_gso_segment (skb, tp->dev->features & ~(NETIF_F_TSO |NETIF_F_TSO6 )); -if (IS_ERR (segs) || !segs) +if (IS_ERR (segs) || !segs) { + tnapi->tx_dropped++; goto tg3_tso_bug_end; + } skb_list_walk_safe(segs, seg, next) {skb_mark_not_on_list (seg);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 11/244 modpost: fix section mismatch message for RELA
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masahiro Yamada <[email protected]>
[ Upstream commit 1c4a7587d1bbee0fd53b63af60e4244a62775f57 ]
The section mismatch check prints a bogus symbol name on some architectures.
[test code]
#include <linux/init.h>
int __initdata foo;
int get_foo(void) { return foo; }
If you compile it with GCC for riscv or loongarch, modpost will show an incorrect symbol name:
WARNING: modpost: vmlinux: section mismatch in reference: get_foo+0x8 (section: .text) -> done (section: .init.data)
To get the correct symbol address, the st_value must be added.
This issue has never been noticed since commit 93684d3b8062 ("kbuild:
include symbol names in section mismatch warnings") presumably because st_value becomes zero on most architectures when the referenced symbol is looked up. It is not true for riscv or loongarch, at least.
With this fix, modpost will show the correct symbol name:
WARNING: modpost: vmlinux: section mismatch in reference: get_foo+0x8 (section: .text) -> foo (section: .init.data)
--- scripts/mod/modpost.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
scripts/mod/modpost.c +4 -2
@@ -1496,13 +1496,15 @@ static void section_rela(struct module *mod, struct elf_info *elf,return ;for (rela = start; rela < stop; rela++) { +Elf_Sym *tsym;Elf_Addr taddr, r_offset;unsigned int r_type, r_sym; r_offset =TO_NATIVE (rela->r_offset);get_rel_type_and_sym (elf, rela->r_info, &r_type, &r_sym); - taddr =TO_NATIVE (rela->r_addend); + tsym = elf->symtab_start + r_sym; + taddr = tsym->st_value +TO_NATIVE (rela->r_addend);switch (elf->hdr->e_machine) {case EM_RISCV :
@@ -1517,7 +1519,7 @@ static void section_rela(struct module *mod, struct elf_info *elf,break ; } -check_section_mismatch (mod, elf, elf->symtab_start + r_sym, +check_section_mismatch (mod, elf, tsym, fsecndx, fromsec, r_offset, taddr); } }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 12/244 kconfig: fix memory leak from range properties
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masahiro Yamada <[email protected]>
[ Upstream commit ae1eff0349f2e908fc083630e8441ea6dc434dc0 ]
Currently, sym_validate_range() duplicates the range string using xstrdup(), which is overwritten by a subsequent sym_calc_value() call. It results in a memory leak.
Instead, only the pointer should be copied.
Below is a test case, with a summary from Valgrind.
[Test Kconfig]
config FOO
int "foo"
range 10 20[Test .config]
CONFIG_FOO=0
[Before]
LEAK SUMMARY:
definitely lost: 3 bytes in 1 blocks
indirectly lost: 0 bytes in 0 blocks
possibly lost: 0 bytes in 0 blocks
still reachable: 17,465 bytes in 21 blocks
suppressed: 0 bytes in 0 blocks
[After]
LEAK SUMMARY:
definitely lost: 0 bytes in 0 blocks
indirectly lost: 0 bytes in 0 blocks
possibly lost: 0 bytes in 0 blocks
still reachable: 17,462 bytes in 20 blocks
suppressed: 0 bytes in 0 blocks
--- scripts/kconfig/symbol.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-)
scripts/kconfig/symbol.c +6 -8
@@ -122,9 +122,9 @@ static long long sym_get_range_val(struct symbol *sym, int base)static void sym_validate_range (struct symbol *sym) {struct property *prop; +struct symbol *range_sym;int base;long long val, val2; -char str[64 ];switch (sym->type) {case S_INT :
@@ -140,17 +140,15 @@ static void sym_validate_range(struct symbol *sym)if (!prop)return ; val =strtoll (sym->curr.val,NULL , base); - val2 =sym_get_range_val (prop->expr->left.sym, base); + range_sym = prop->expr->left.sym; + val2 =sym_get_range_val (range_sym, base);if (val >= val2) { - val2 =sym_get_range_val (prop->expr->right.sym, base); + range_sym = prop->expr->right.sym; + val2 =sym_get_range_val (range_sym, base);if (val <= val2)return ; } -if (sym->type ==S_INT ) -sprintf (str,"%lld" , val2); -else -sprintf (str,"0x%llx" , val2); - sym->curr.val =xstrdup (str); + sym->curr.val = range_sym->curr.val; }static void sym_set_changed (struct symbol *sym)
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 13/244 drm/amdgpu: Do not program VF copy regs in mmhub v1.8 under SRIOV (v2)
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Victor Lu <[email protected]>
[ Upstream commit 0288603040c38ccfeb5342f34a52673366d90038 ]
MC_VM_AGP_* registers should not be programmed by guest driver.
v2: move early return outside of loop
--- drivers/gpu/drm/amd/amdgpu/mmhub_v1_8.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/amdgpu/mmhub_v1_8.c +3 -3
@@ -130,6 +130,9 @@ static void mmhub_v1_8_init_system_aperture_regs(struct amdgpu_device *adev)uint64_t value;int i; +if (amdgpu_sriov_vf (adev)) +return ; + inst_mask = adev->aid_mask;for_each_inst (i, inst_mask) {/* Program the AGP BAR */
@@ -139,9 +142,6 @@ static void mmhub_v1_8_init_system_aperture_regs(struct amdgpu_device *adev)WREG32_SOC15 (MMHUB , i, regMC_VM_AGP_TOP, adev->gmc.agp_end >>24 ); -if (amdgpu_sriov_vf (adev)) -return ; -/* Program the system aperture low logical page number. */ WREG32_SOC15 (MMHUB , i, regMC_VM_SYSTEM_APERTURE_LOW_ADDR,min (adev->gmc.fb_start, adev->gmc.agp_start) >>18 );
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 14/244 drm/amdgpu: finalizing mem_partitions at the end of GMC v9 sw_fini
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Le Ma <[email protected]>
[ Upstream commit bdb72185d310fc8049c7ea95221d640e9e7165e5 ]
The valid num_mem_partitions is required during ttm pool fini, thus move the cleanup at the end of the function.
--- drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c +3 -2
@@ -2220,8 +2220,6 @@ static int gmc_v9_0_sw_fini(void *handle)if (adev->ip_versions[GC_HWIP ][0 ] ==IP_VERSION (9 ,4 ,3 ))amdgpu_gmc_sysfs_fini (adev); - adev->gmc.num_mem_partitions =0 ; -kfree (adev->gmc.mem_partitions);amdgpu_gmc_ras_fini (adev);amdgpu_gem_force_release (adev);
@@ -2235,6 +2233,9 @@ static int gmc_v9_0_sw_fini(void *handle)amdgpu_bo_free_kernel (&adev->gmc.pdb0_bo,NULL , &adev->gmc.ptr_pdb0);amdgpu_bo_fini (adev); + adev->gmc.num_mem_partitions =0 ; +kfree (adev->gmc.mem_partitions); +return 0 ; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 15/244 drm/amdgpu: correct chunk_ptr to a pointer to chunk.
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: YuanShang <[email protected]>
[ Upstream commit 50d51374b498457c4dea26779d32ccfed12ddaff ]
The variable "chunk_ptr" should be a pointer pointing to a struct drm_amdgpu_cs_chunk instead of to a pointer of that.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +1 -1
@@ -207,7 +207,7 @@ static int amdgpu_cs_pass1(struct amdgpu_cs_parser *p, }for (i =0 ; i < p->nchunks; i++) { -struct drm_amdgpu_cs_chunk __user **chunk_ptr =NULL ; +struct drm_amdgpu_cs_chunk __user *chunk_ptr =NULL ;struct drm_amdgpu_cs_chunk user_chunk;uint32_t __user *cdata;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 16/244 dm-crypt: start allocating with MAX_ORDER
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
[ Upstream commit 13648e04a9b831b3dfa5cf3887dfa6cf8fe5fe69 ]
Commit 23baf831a32c ("mm, treewide: redefine MAX_ORDER sanely") changed the meaning of MAX_ORDER from exclusive to inclusive. So, we can allocate compound pages with up to 1 << MAX_ORDER pages.
Reflect this change in dm-crypt and start trying to allocate compound pages with MAX_ORDER.
--- drivers/md/dm-crypt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/md/dm-crypt.c +1 -1
@@ -1679,7 +1679,7 @@ static struct bio *crypt_alloc_buffer(struct dm_crypt_io *io, unsigned int size)unsigned int nr_iovecs = (size +PAGE_SIZE -1 ) >>PAGE_SHIFT ;gfp_t gfp_mask =GFP_NOWAIT | __GFP_HIGHMEM;unsigned int remaining_size; -unsigned int order =MAX_ORDER -1 ; +unsigned int order =MAX_ORDER ; retry:if (unlikely (gfp_mask & __GFP_DIRECT_RECLAIM))
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 17/244 x86: Introduce ia32_enabled()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikolay Borisov <[email protected]>
[ upstream commit 1da5c9bc119d3a749b519596b93f9b2667e93c4a ]
IA32 support on 64bit kernels depends on whether CONFIG_IA32_EMULATION is selected or not. As it is a compile time option it doesn't provide the flexibility to have distributions set their own policy for IA32 support and give the user the flexibility to override it.
As a first step introduce ia32_enabled() which abstracts whether IA32 compat is turned on or off. Upcoming patches will implement the ability to set IA32 compat state at boot time.
--- arch/x86/entry/common.c | 4 ++++ arch/x86/include/asm/ia32.h | 16 +++++++++++++++- 2 files changed, 19 insertions(+), 1 deletion(-)
arch/x86/entry/common.c +4 -0
@@ -96,6 +96,10 @@ static __always_inline int syscall_32_enreturn (int )regs->orig_ax; } +#ifdef CONFIG_IA32_EMULATION +bool __ia32_enabled__ro_after_init = true; +#endif +/* * Invoke a 32-bit syscall. Called with IRQs on in CONTEXT_KERNEL. */
arch/x86/include/asm/ia32.h +15 -1
@@ -68,6 +68,20 @@ extern void ia32_pick_mmap_layout(struct#endif -#endif /* CONFIG_IA32_EMULATION */ +extern bool __ia32_enabled; + +static inline bool ia32_enabled (void ) +{ +return __ia32_enabled; +} + +#else /* !CONFIG_IA32_EMULATION */ + +static inline bool ia32_enabled (void ) +{ +return IS_ENABLED (CONFIG_X86_32 ); +} + +#endif #endif /* _ASM_X86_IA32_H */
Greg Kroah-Hartman
maintainerPATCH 18/244 x86/coco: Disable 32-bit emulation by default on TDX and SEV
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Kirill A. Shutemov" <[email protected]>
[ upstream commit b82a8dbd3d2f4563156f7150c6f2ecab6e960b30 ]
The INT 0x80 instruction is used for 32-bit x86 Linux syscalls. The kernel expects to receive a software interrupt as a result of the INT 0x80 instruction. However, an external interrupt on the same vector triggers the same handler.
The kernel interprets an external interrupt on vector 0x80 as a 32-bit system call that came from userspace.
A VMM can inject external interrupts on any arbitrary vector at any time. This remains true even for TDX and SEV guests where the VMM is untrusted.
Put together, this allows an untrusted VMM to trigger int80 syscall handling at any given point. The content of the guest register file at that moment defines what syscall is triggered and its arguments. It opens the guest OS to manipulation from the VMM side.
Disable 32-bit emulation by default for TDX and SEV. User can override it with the ia32_emulation=y command line option.
[ dhansen: reword the changelog ]
--- arch/x86/coco/tdx/tdx.c | 10 ++++++++++ arch/x86/include/asm/ia32.h | 7 +++++++ arch/x86/mm/mem_encrypt_amd.c | 11 +++++++++++ 3 files changed, 28 insertions(+)
arch/x86/coco/tdx/tdx.c +10 -0
@@ -10,6 +10,7 @@#include <asm/coco.h> #include <asm/tdx.h> #include <asm/vmx.h> +#include <asm/ia32.h> #include <asm/insn.h> #include <asm/insn-eval.h> #include <asm/pgtable.h>
@@ -820,5 +821,14 @@ void __init tdx_early_init(void)*/ x86_cpuinit.parallel_bringup = false; +/* +* The VMM is capable of injecting interrupt 0x80 and triggering the +* compatibility syscall path. +* +* By default, the 32-bit emulation is disabled in order to ensure +* the safety of the VM. +*/ +ia32_disable (); +pr_info ("Guest detected\n" ); }
arch/x86/include/asm/ia32.h +7 -0
@@ -75,6 +75,11 @@ static inline bool ia32_enabled(void) return __ia32_enabled; } +static inline void ia32_disable (void ) +{ + __ia32_enabled = false; +} +#else /* !CONFIG_IA32_EMULATION */ static inline bool ia32_enabled (void )
@@ -82,6 +87,8 @@ static inline bool ia32_enabled(void)return IS_ENABLED (CONFIG_X86_32 ); } +static inline void ia32_disable (void ) {} +#endif #endif /* _ASM_X86_IA32_H */
arch/x86/mm/mem_encrypt_amd.c +11 -0
@@ -34,6 +34,7 @@#include <asm/msr.h> #include <asm/cmdline.h> #include <asm/sev.h> +#include <asm/ia32.h> #include "mm_internal.h"
@@ -517,6 +518,16 @@ void __init sme_early_init(void)*/ if (sev_status &MSR_AMD64_SEV_ES_ENABLED ) x86_cpuinit.parallel_bringup = false; + +/* +* The VMM is capable of injecting interrupt 0x80 and triggering the +* compatibility syscall path. +* +* By default, the 32-bit emulation is disabled in order to ensure +* the safety of the VM. +*/ +if (sev_status &MSR_AMD64_SEV_ENABLED ) +ia32_disable (); }void __init mem_encrypt_free_decrypted_mem (void )
Greg Kroah-Hartman
maintainerPATCH 19/244 x86/entry: Convert INT 0x80 emulation to IDTENTRY
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
[ upstream commit be5341eb0d43b1e754799498bd2e8756cc167a41 ]
There is no real reason to have a separate ASM entry point implementation for the legacy INT 0x80 syscall emulation on 64-bit.
IDTENTRY provides all the functionality needed with the only difference that it does not:
- save the syscall number (AX) into pt_regs::orig_ax
- set pt_regs::ax to -ENOSYS
Both can be done safely in the C code of an IDTENTRY before invoking any of the syscall related functions which depend on this convention.
Aside of ASM code reduction this prepares for detecting and handling a local APIC injected vector 0x80.
--- arch/x86/entry/common.c | 58 ++++++++++++++++++++++++++++- arch/x86/entry/entry_64_compat.S | 77 --------------------------------------- arch/x86/include/asm/idtentry.h | 4 ++ arch/x86/include/asm/proto.h | 4 -- arch/x86/kernel/idt.c | 2 - arch/x86/xen/enlighten_pv.c | 2 - arch/x86/xen/xen-asm.S | 2 - 7 files changed, 64 insertions(+), 85 deletions(-)
arch/x86/entry/common.c +57 -1
@@ -119,7 +119,62 @@ static __always_inline void do_syscall_3 } } -/* Handles int $0x80 */ +#ifdef CONFIG_IA32_EMULATION +/** +* int80_emulation - 32-bit legacy syscall entry +* +* This entry point can be used by 32-bit and 64-bit programs to perform +* 32-bit system calls. Instances of INT $0x80 can be found inline in +* various programs and libraries. It is also used by the vDSO's +* __kernel_vsyscall fallback for hardware that doesn't support a faster +* entry method. Restarted 32-bit system calls also fall back to INT +* $0x80 regardless of what instruction was originally used to do the +* system call. +* +* This is considered a slow path. It is not used by most libc +* implementations on modern hardware except during process startup. +* +* The arguments for the INT $0x80 based syscall are on stack in the +* pt_regs structure: +* eax: system call number +* ebx, ecx, edx, esi, edi, ebp: arg1 - arg 6 +*/ +DEFINE_IDTENTRY_RAW (int80_emulation) +{ +int nr; + +/* Establish kernel context. */ +enter_from_user_mode (regs); + +instrumentation_begin (); +add_random_kstack_offset (); + +/* +* The low level idtentry code pushed -1 into regs::orig_ax +* and regs::ax contains the syscall number. +* +* User tracing code (ptrace or signal handlers) might assume +* that the regs::orig_ax contains a 32-bit number on invoking +* a 32-bit syscall. +* +* Establish the syscall convention by saving the 32bit truncated +* syscall number in regs::orig_ax and by invalidating regs::ax. +*/ + regs->orig_ax = regs->ax &GENMASK (31 ,0 ); + regs->ax = -ENOSYS ; + + nr =syscall_32_enter (regs); + +local_irq_enable (); + nr =syscall_enter_from_user_mode_work (regs, nr); +do_syscall_32_irqs_on (regs, nr); + +instrumentation_end (); +syscall_exit_to_user_mode (regs); +} +#else /* CONFIG_IA32_EMULATION */ + +/* Handles int $0x80 on a 32bit kernel */ __visible noinstr void do_int80_syscall_32(struct pt_regs *regs) {int nr =syscall_32_enter (regs);
@@ -138,6 +193,7 @@ __visible noinstr void do_int80_syscall_instrumentation_end ();syscall_exit_to_user_mode (regs); } +#endif /* !CONFIG_IA32_EMULATION */ static noinstr bool __do_fast_syscall_32(struct pt_regs *regs) {
arch/x86/entry/entry_64_compat.S +0 -77
80 lines not on this page · raw message
arch/x86/include/asm/idtentry.h +4 -0
@@ -569,6 +569,10 @@ DECLARE_IDTENTRY_RAW(X86_TRAP_UD, exc_iDECLARE_IDTENTRY_RAW (X86_TRAP_BP , exc_int3);DECLARE_IDTENTRY_RAW_ERRORCODE (X86_TRAP_PF , exc_page_fault); +#if defined(CONFIG_IA32_EMULATION ) +DECLARE_IDTENTRY_RAW (IA32_SYSCALL_VECTOR , int80_emulation); +#endif +#ifdef CONFIG_X86_MCE #ifdef CONFIG_X86_64 DECLARE_IDTENTRY_MCE (X86_TRAP_MC , exc_machine_check);
arch/x86/include/asm/proto.h +0 -4
@@ -32,10 +32,6 @@ void entry_SYSCALL_compat(void);void entry_SYSCALL_compat_safe_stack (void );void entry_SYSRETL_compat_unsafe_stack (void );void entry_SYSRETL_compat_end (void ); -void entry_INT80_compat (void ); -#ifdef CONFIG_XEN_PV -void xen_entry_INT80_compat (void ); -#endif #endif void x86_configure_nx (void );
arch/x86/kernel/idt.c +1 -1
@@ -117,7 +117,7 @@ static const __initconst struct idt_data SYSG(X86_TRAP_OF, asm_exc_overflow),#if defined(CONFIG_IA32_EMULATION ) - SYSG(IA32_SYSCALL_VECTOR, entry_INT80_compat), + SYSG(IA32_SYSCALL_VECTOR, asm_int80_emulation),#elif defined(CONFIG_X86_32 ) SYSG(IA32_SYSCALL_VECTOR, entry_INT80_32),#endif
arch/x86/xen/enlighten_pv.c +1 -1
@@ -704,7 +704,7 @@ static struct trap_array_entry trap_arra TRAP_ENTRY(exc_int3, false ), TRAP_ENTRY(exc_overflow, false ),#ifdef CONFIG_IA32_EMULATION - { entry_INT80_compat, xen_entry_INT80_compat, false }, +TRAP_ENTRY (int80_emulation, false ), #endifTRAP_ENTRY (exc_page_fault, false ), TRAP_ENTRY(exc_divide_error, false ),
arch/x86/xen/xen-asm.S +1 -1
@@ -156,7 +156,7 @@ xen_pv_trap asm_xenpv_exc_machine_check #endif /* CONFIG_X86_MCE */ xen_pv_trap asm_exc_simd_coprocessor_error #ifdef CONFIG_IA32_EMULATION -xen_pv_trap entry_INT80_compat +xen_pv_trap asm_int80_emulation #endif xen_pv_trap asm_exc_xen_unknown_trap xen_pv_trap asm_exc_xen_hypervisor_callback
Greg Kroah-Hartman
maintainerPATCH 20/244 x86/entry: Do not allow external 0x80 interrupts
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
[ upstream commit 55617fb991df535f953589586468612351575704 ]
The INT 0x80 instruction is used for 32-bit x86 Linux syscalls. The kernel expects to receive a software interrupt as a result of the INT 0x80 instruction. However, an external interrupt on the same vector also triggers the same codepath.
An external interrupt on vector 0x80 will currently be interpreted as a 32-bit system call, and assuming that it was a user context.
Panic on external interrupts on the vector.
To distinguish software interrupts from external ones, the kernel checks the APIC ISR bit relevant to the 0x80 vector. For software interrupts, this bit will be 0.
--- arch/x86/entry/common.c | 37 ++++++++++++++++++++++++++++++++++++- 1 file changed, 36 insertions(+), 1 deletion(-)
arch/x86/entry/common.c +36 -1
@@ -25,6 +25,7 @@#include <xen/events.h> #endif +#include <asm/apic.h> #include <asm/desc.h> #include <asm/traps.h> #include <asm/vdso.h>
@@ -120,6 +121,25 @@ static __always_inline void do_syscall_3 }#ifdef CONFIG_IA32_EMULATION +static __always_inline bool int80_is_external(void) +{ +const unsigned int offs = (0x80 /32 ) *0x10 ; +const u32 bit =BIT (0x80 %32 ); + +/* The local APIC on XENPV guests is fake */ +if (cpu_feature_enabled (X86_FEATURE_XENPV )) +return false; + +/* +* If vector 0x80 is set in the APIC ISR then this is an external +* interrupt. Either from broken hardware or injected by a VMM. +* +* Note: In guest mode this is only valid for secure guests where +* the secure module fully controls the vAPIC exposed to the guest. +*/ +return apic_read (APIC_ISR + offs) & bit; +} +/** * int80_emulation - 32-bit legacy syscall entry *
@@ -143,12 +163,27 @@ DEFINE_IDTENTRY_RAW(int80_emulation) {int nr; -/* Establish kernel context. */ +/* Kernel does not use INT $0x80! */ +if (unlikely (!user_mode (regs))) { +irqentry_enter (regs); +instrumentation_begin (); +panic ("Unexpected external interrupt 0x80\n" ); + } + +/* +* Establish kernel context for instrumentation, including for +* int80_is_external() below which calls into the APIC driver. +* Identical for soft and external interrupts. +*/ enter_from_user_mode (regs);instrumentation_begin ();add_random_kstack_offset (); +/* Validate that this is a soft interrupt to the extent possible */ +if (unlikely (int80_is_external ())) +panic ("Unexpected external interrupt 0x80\n" ); +/* * The low level idtentry code pushed -1 into regs::orig_ax * and regs::ax contains the syscall number.
Greg Kroah-Hartman
maintainerPATCH 21/244 x86/tdx: Allow 32-bit emulation by default
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Kirill A. Shutemov" <[email protected]>
[ upstream commit f4116bfc44621882556bbf70f5284fbf429a5cf6 ]
32-bit emulation was disabled on TDX to prevent a possible attack by a VMM injecting an interrupt on vector 0x80.
Now that int80_emulation() has a check for external interrupts the limitation can be lifted.
To distinguish software interrupts from external ones, int80_emulation() checks the APIC ISR bit relevant to the 0x80 vector. For software interrupts, this bit will be 0.
On TDX, the VAPIC state (including ISR) is protected and cannot be manipulated by the VMM. The ISR bit is set by the microcode flow during the handling of posted interrupts.
[ dhansen: more changelog tweaks ]
--- arch/x86/coco/tdx/tdx.c | 9 --------- 1 file changed, 9 deletions(-)
arch/x86/coco/tdx/tdx.c +0 -9
@@ -821,14 +821,5 @@ void __init tdx_early_init(void)*/ x86_cpuinit.parallel_bringup = false; -/* -* The VMM is capable of injecting interrupt 0x80 and triggering the -* compatibility syscall path. -* -* By default, the 32-bit emulation is disabled in order to ensure -* the safety of the VM. -*/ -ia32_disable (); -pr_info ("Guest detected\n" ); }
Greg Kroah-Hartman
maintainerPATCH 22/244 dt: dt-extract-compatibles: Handle cfile arguments in generator function
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nícolas F. R. A. Prado <[email protected]>
[ Upstream commit eb2139fc0da63b89a2ad565ecd8133a37e8b7c4f ]
Move the handling of the cfile arguments to a separate generator function to avoid redundancy.
Stable-dep-of: 8f51593cdcab ("dt: dt-extract-compatibles: Don't follow symlinks when walking tree")
--- scripts/dtc/dt-extract-compatibles | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-)
scripts/dtc/dt-extract-compatibles +11 -8
@@ -49,6 +49,14 @@ def print_compat(filename, compatibles): else: print(*compatibles, sep='\n') +def files_to_parse(path_args): + for f in path_args: + if os.path.isdir(f): + for filename in glob.iglob(f + "/**/*.c", recursive=True): + yield filename + else: + yield f + show_filename = False if __name__ == "__main__":
@@ -59,11 +67,6 @@ if __name__ == "__main__": show_filename = args.with_filename - for f in args.cfile: - if os.path.isdir(f): - for filename in glob.iglob(f + "/**/*.c", recursive=True): - compat_list = parse_compatibles(filename) - print_compat(filename, compat_list) - else: - compat_list = parse_compatibles(f) - print_compat(f, compat_list) + for f in files_to_parse(args.cfile): + compat_list = parse_compatibles(f) + print_compat(f, compat_list)
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 23/244 dt: dt-extract-compatibles: Dont follow symlinks when walking tree
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nícolas F. R. A. Prado <[email protected]>
[ Upstream commit 8f51593cdcab82fb23ef2e1a0010b2e6f99aae02 ]
The iglob function, which we use to find C source files in the kernel tree, always follows symbolic links. This can cause unintentional recursions whenever a symbolic link points to a parent directory. A common scenario is building the kernel with the output set to a directory inside the kernel tree, which will contain such a symlink.
Instead of using the iglob function, use os.walk to traverse the directory tree, which by default doesn't follow symbolic links. fnmatch is then used to match the glob on the filename, as well as ignore hidden files (which were ignored by default with iglob).
This approach runs just as fast as using iglob.
--- scripts/dtc/dt-extract-compatibles | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
scripts/dtc/dt-extract-compatibles +12 -2
@@ -1,8 +1,8 @@ #!/usr/bin/env python3 # SPDX-License-Identifier: GPL-2.0-only +import fnmatch import os -import glob import re import argparse
@@ -49,10 +49,20 @@ def print_compat(filename, compatibles): else: print(*compatibles, sep='\n') +def glob_without_symlinks(root, glob): + for path, dirs, files in os.walk(root): + # Ignore hidden directories + for d in dirs: + if fnmatch.fnmatch(d, ".*"): + dirs.remove(d) + for f in files: + if fnmatch.fnmatch(f, glob): + yield os.path.join(path, f) + def files_to_parse(path_args): for f in path_args: if os.path.isdir(f): - for filename in glob.iglob(f + "/**/*.c", recursive=True): + for filename in glob_without_symlinks(f, "*.c"): yield filename else: yield f
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 24/244 platform/x86: asus-wmi: Move i8042 filter install to shared asus-wmi code
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit b52cbca22cbf6c9d2700c1e576d0ddcc670e49d5 ]
asus-nb-wmi calls i8042_install_filter() in some cases, but it never calls i8042_remove_filter(). This means that a dangling pointer to the filter function is left after rmmod leading to crashes.
Fix this by moving the i8042-filter installation to the shared asus-wmi code and also remove it from the shared code on driver unbind.
--- drivers/platform/x86/Kconfig | 2 +- drivers/platform/x86/asus-nb-wmi.c | 11 ----------- drivers/platform/x86/asus-wmi.c | 8 ++++++++ 3 files changed, 9 insertions(+), 12 deletions(-)
drivers/platform/x86/Kconfig +1 -1
@@ -263,6 +263,7 @@ config ASUS_WMI depends on RFKILL || RFKILL = n depends on HOTPLUG_PCI depends on ACPI_VIDEO || ACPI_VIDEO = n + depends on SERIO_I8042 || SERIO_I8042 = n select INPUT_SPARSEKMAP select LEDS_CLASS select NEW_LEDS
@@ -279,7 +280,6 @@ config ASUS_WMI config ASUS_NB_WMI tristate "Asus Notebook WMI Driver" depends on ASUS_WMI - depends on SERIO_I8042 || SERIO_I8042 = n help This is a driver for newer Asus notebooks. It adds extra features like wireless radio and bluetooth control, leds, hotkeys, backlight...
drivers/platform/x86/asus-nb-wmi.c +0 -11
@@ -501,8 +501,6 @@ static const struct dmi_system_id asus_quirks[] = {static void asus_nb_wmi_quirks (struct asus_wmi_driver *driver) { -int ret; - quirks = &quirk_asus_unknown;dmi_check_system (asus_quirks);
@@ -517,15 +515,6 @@ static void asus_nb_wmi_quirks(struct asus_wmi_driver *driver)if (tablet_mode_sw !=-1 ) quirks->tablet_switch_mode = tablet_mode_sw; - -if (quirks->i8042_filter) { - ret =i8042_install_filter (quirks->i8042_filter); -if (ret) { -pr_warn ("Unable to install key filter\n" ); -return ; - } -pr_info ("Using i8042 filter function for receiving events\n" ); - } }static const struct key_entry asus_nb_wmi_keymap[] = {
drivers/platform/x86/asus-wmi.c +8 -0
@@ -4437,6 +4437,12 @@ static int asus_wmi_add(struct platform_device *pdev) goto fail_wmi_handler; } +if (asus->driver->quirks->i8042_filter) { + err =i8042_install_filter (asus->driver->quirks->i8042_filter); +if (err) +pr_warn ("Unable to install key filter - %d\n" , err); + } +asus_wmi_battery_init (asus);asus_wmi_debugfs_init (asus);
@@ -4471,6 +4477,8 @@ static int asus_wmi_remove(struct platform_device *device)struct asus_wmi *asus; asus =platform_get_drvdata (device); +if (asus->driver->quirks->i8042_filter) +i8042_remove_filter (asus->driver->quirks->i8042_filter);wmi_remove_notify_handler (asus->driver->event_guid);asus_wmi_backlight_exit (asus);asus_wmi_input_exit (asus);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 25/244 of: dynamic: Fix of_reconfig_get_state_change() return value documentation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Ceresoli <[email protected]>
[ Upstream commit d79972789d17499b6091ded2fc0c6763c501a5ba ]
The documented numeric return values do not match the actual returned values. Fix them by using the enum names instead of raw numbers.
--- drivers/of/dynamic.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/of/dynamic.c +3 -2
@@ -98,8 +98,9 @@ int of_reconfig_notify(unsigned long action, struct of_reconfig_data *p)* * Returns the new state of a device based on the notifier used. * -* Return: 0 on device going from enabled to disabled, 1 on device -* going from disabled to enabled and -1 on no change. +* Return: OF_RECONFIG_CHANGE_REMOVE on device going from enabled to +* disabled, OF_RECONFIG_CHANGE_ADD on device going from disabled to +* enabled and OF_RECONFIG_NO_CHANGE on no change. */ int of_reconfig_get_state_change (unsigned long action,struct of_reconfig_data *pr) {
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 26/244 platform/x86: wmi: Skip blocks with zero instances
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <[email protected]>
[ Upstream commit cbf54f37600e874d82886aa3b2f471778cae01ce ]
Some machines like the HP Omen 17 ck2000nf contain WMI blocks with zero instances, so any WMI driver which tries to handle the associated WMI device will fail.
Skip such WMI blocks to avoid confusing any WMI drivers.
--- drivers/platform/x86/wmi.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/platform/x86/wmi.c +5 -0
@@ -1285,6 +1285,11 @@ static int parse_wdg(struct device *wmi_bus_dev, struct acpi_device *device)if (debug_dump_wdg)wmi_dump_wdg (&gblock[i]); +if (!gblock[i].instance_count) { +dev_info (wmi_bus_dev,FW_INFO "%pUL has zero instances\n" , &gblock[i].guid); +continue ; + } +if (guid_already_parsed_for_legacy (device, &gblock[i].guid))continue ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 27/244 ipv6: fix potential NULL deref in fib6_add()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 75475bb51e78a3f54ad2f69380f2a1c985e85f2d ]
If fib6_find_prefix() returns NULL, we should silently fallback using fib6_null_entry regardless of RT6_DEBUG value.
syzbot reported:
WARNING: CPU: 0 PID: 5477 at net/ipv6/ip6_fib.c:1516 fib6_add+0x310d/0x3fa0 net/ipv6/ip6_fib.c:1516 Modules linked in: CPU: 0 PID: 5477 Comm: syz-executor.0 Not tainted 6.7.0-rc2-syzkaller-00029-g9b6de136b5f0 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 RIP: 0010:fib6_add+0x310d/0x3fa0 net/ipv6/ip6_fib.c:1516 Code: 00 48 8b 54 24 68 e8 42 22 00 00 48 85 c0 74 14 49 89 c6 e8 d5 d3 c2 f7 eb 5d e8 ce d3 c2 f7 e9 ca 00 00 00 e8 c4 d3 c2 f7 90 <0f> 0b 90 48 b8 00 00 00 00 00 fc ff df 48 8b 4c 24 38 80 3c 01 00 RSP: 0018:ffffc90005067740 EFLAGS: 00010293 RAX: ffffffff89cba5bc RBX: ffffc90005067ab0 RCX: ffff88801a2e9dc0 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 RBP: ffffc90005067980 R08: ffffffff89cbca85 R09: 1ffff110040d4b85 R10: dffffc0000000000 R11: ffffed10040d4b86 R12: 00000000ffffffff R13: 1ffff110051c3904 R14: ffff8880206a5c00 R15: ffff888028e1c820 FS: 00007f763783c6c0(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f763783bff8 CR3: 000000007f74d000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> __ip6_ins_rt net/ipv6/route.c:1303 [inline] ip6_route_add+0x88/0x120 net/ipv6/route.c:3847 ipv6_route_ioctl+0x525/0x7b0 net/ipv6/route.c:4467 inet6_ioctl+0x21a/0x270 net/ipv6/af_inet6.c:575 sock_do_ioctl+0x152/0x460 net/socket.c:1220 sock_ioctl+0x615/0x8c0 net/socket.c:1339 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:871 [inline] __se_sys_ioctl+0xf8/0x170 fs/ioctl.c:857 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x45/0x110 arch/x86/entry/common.c:82
--- net/ipv6/ip6_fib.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
net/ipv6/ip6_fib.c +1 -5
@@ -1511,13 +1511,9 @@ int fib6_add(struct fib6_node *root, struct fib6_info *rt,if (!pn_leaf && !(pn->fn_flags &RTN_RTINFO )) { pn_leaf =fib6_find_prefix (info->nl_net, table, pn); -#if RT6_DEBUG >=2 -if (!pn_leaf) { -WARN_ON (!pn_leaf); +if (!pn_leaf) pn_leaf = info->nl_net->ipv6.fib6_null_entry; - } -#endif fib6_info_hold (pn_leaf);rcu_assign_pointer (pn->leaf, pn_leaf); }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 28/244 octeontx2-pf: Add missing mutex lock in otx2_get_pauseparam
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Subbaraya Sundeep <[email protected]>
[ Upstream commit 9572c949385aa2ef10368287c439bcb7935137c8 ]
All the mailbox messages sent to AF needs to be guarded by mutex lock. Add the missing lock in otx2_get_pauseparam function.
--- drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c +5 -1
@@ -334,9 +334,12 @@ static void otx2_get_pauseparam(struct net_device *netdev,if (is_otx2_lbkvf (pfvf->pdev))return ; +mutex_lock (&pfvf->mbox.lock); req =otx2_mbox_alloc_msg_cgx_cfg_pause_frm (&pfvf->mbox); -if (!req) +if (!req) { +mutex_unlock (&pfvf->mbox.lock);return ; + }if (!otx2_sync_mbox_msg (&pfvf->mbox)) { rsp = (struct cgx_pause_frm_cfg *)
@@ -344,6 +347,7 @@ static void otx2_get_pauseparam(struct net_device *netdev, pause->rx_pause = rsp->rx_pause; pause->tx_pause = rsp->tx_pause; } +mutex_unlock (&pfvf->mbox.lock); } static int otx2_set_pauseparam(struct net_device *netdev,
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 29/244 octeontx2-af: Check return value of nix_get_nixlf before using nixlf
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Subbaraya Sundeep <[email protected]>
[ Upstream commit 830139e7b6911266a84a77e1f18abf758995cc89 ]
If a NIXLF is not attached to a PF/VF device then nix_get_nixlf function fails and returns proper error code. But npc_get_default_entry_action does not check it and uses garbage value in subsequent calls. Fix this by cheking the return value of nix_get_nixlf.
--- drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c +7 -1
@@ -389,7 +389,13 @@ static u64 npc_get_default_entry_action(struct rvu *rvu, struct npc_mcam *mcam,int bank, nixlf, index;/* get ucast entry rule entry index */ -nix_get_nixlf (rvu, pf_func, &nixlf,NULL ); +if (nix_get_nixlf (rvu, pf_func, &nixlf,NULL )) { +dev_err (rvu->dev,"%s: nixlf not attached to pcifunc:0x%x\n" , + __func__, pf_func); +/* Action 0 is drop */ +return 0 ; + } + index =npc_get_nixlf_mcam_index (mcam, pf_func, nixlf,NIXLF_UCAST_ENTRY ); bank =npc_get_bank (mcam, index);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 30/244 bpf: Fix a verifier bug due to incorrect branch offset comparison with cpu=v4
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yonghong Song <[email protected]>
[ Upstream commit dfce9cb3140592b886838e06f3e0c25fea2a9cae ]
Bpf cpu=v4 support is introduced in [1] and Commit 4cd58e9af8b9 ("bpf: Support new 32bit offset jmp instruction") added support for new 32bit offset jmp instruction. Unfortunately, in function bpf_adj_delta_to_off(), for new branch insn with 32bit offset, the offset (plus/minor a small delta) compares to 16-bit offset bound [S16_MIN, S16_MAX], which caused the following verification failure:
$ ./test_progs-cpuv4 -t verif_scale_pyperf180 ... insn 10 cannot be patched due to 16-bit range ... libbpf: failed to load object 'pyperf180.bpf.o' scale_test:FAIL:expect_success unexpected error: -12 (errno 12) #405 verif_scale_pyperf180:FAIL
Note that due to recent llvm18 development, the patch [2] (already applied in bpf-next) needs to be applied to bpf tree for testing purpose.
The fix is rather simple. For 32bit offset branch insn, the adjusted offset compares to [S32_MIN, S32_MAX] and then verification succeeded.
[1] https://lore.kernel.org/all/[email protected]
[2] https://lore.kernel.org/bpf/[email protected]
--- kernel/bpf/core.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
kernel/bpf/core.c +8 -4
@@ -371,14 +371,18 @@ static int bpf_adj_delta_to_imm(struct bpf_insn *insn, u32 pos, s32 end_old,static int bpf_adj_delta_to_off (struct bpf_insn *insn,u32 pos,s32 end_old,s32 end_new,s32 curr,const bool probe_pass) { -const s32 off_min =S16_MIN , off_max =S16_MAX ; +s64 off_min, off_max, off;s32 delta = end_new - end_old; -s32 off; -if (insn->code == (BPF_JMP32 |BPF_JA )) +if (insn->code == (BPF_JMP32 |BPF_JA )) { off = insn->imm; -else + off_min =S32_MIN ; + off_max =S32_MAX ; + }else { off = insn->off; + off_min =S16_MIN ; + off_max =S16_MAX ; + }if (curr < pos && curr + off +1 >= end_old) off += delta;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 31/244 hv_netvsc: rndis_filter needs to select NLS
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <[email protected]>
[ Upstream commit 6c89f49964375c904cea33c0247467873f4daf2c ]
rndis_filter uses utf8s_to_utf16s() which is provided by setting NLS, so select NLS to fix the build error:
ERROR: modpost: "utf8s_to_utf16s" [drivers/net/hyperv/hv_netvsc.ko] undefined!
--- drivers/net/hyperv/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/net/hyperv/Kconfig +1 -0
@@ -3,5 +3,6 @@ config HYPERV_NET tristate "Microsoft Hyper-V virtual network driver" depends on HYPERV select UCS2_STRING + select NLS help Select this option to enable the Hyper-V virtual network driver.
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 32/244 r8152: Hold the rtnl_lock for all of reset
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Anderson <[email protected]>
[ Upstream commit e62adaeecdc6a1e8ae86e7f3f9f8223a3ede94f5 ]
As of commit d9962b0d4202 ("r8152: Block future register access if register access fails") there is a race condition that can happen between the USB device reset thread and napi_enable() (not) getting called during rtl8152_open(). Specifically:
* While rtl8152_open() is running we get a register access error that's _not_ -ENODEV and queue up a USB reset.
* rtl8152_open() exits before calling napi_enable() due to any reason (including usb_submit_urb() returning an error).
In that case:
* Since the USB reset is perform in a separate thread asynchronously, it can run at anytime USB device lock is not held - even before rtl8152_open() has exited with an error and caused __dev_open() to clear the __LINK_STATE_START bit.
* The rtl8152_pre_reset() will notice that the netif_running() returns true (since __LINK_STATE_START wasn't cleared) so it won't exit early.
* rtl8152_pre_reset() will then hang in napi_disable() because napi_enable() was never called.
We can fix the race by making sure that the r8152 reset routines don't run at the same time as we're opening the device. Specifically we need the reset routines in their entirety rely on the return value of netif_running(). The only way to reliably depend on that is for them to hold the rntl_lock() mutex for the duration of reset.
Grabbing the rntl_lock() mutex for the duration of reset seems like a long time, but reset is not expected to be common and the rtnl_lock() mutex is already held for long durations since the core grabs it around the open/close calls.
--- drivers/net/usb/r8152.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
drivers/net/usb/r8152.c +7 -6
@@ -8364,6 +8364,8 @@ static int rtl8152_pre_reset(struct usb_interface *intf)struct r8152 *tp =usb_get_intfdata (intf);struct net_device *netdev; +rtnl_lock (); +if (!tp || !test_bit (PROBED_WITH_NO_ERRORS , &tp->flags))return 0 ;
@@ -8395,20 +8397,17 @@ static int rtl8152_post_reset(struct usb_interface *intf)struct sockaddr sa;if (!tp || !test_bit (PROBED_WITH_NO_ERRORS , &tp->flags)) -return 0 ; + goto exit;rtl_set_accessible (tp);/* reset the MAC address in case of policy change */ -if (determine_ethernet_addr (tp, &sa) >=0 ) { -rtnl_lock (); +if (determine_ethernet_addr (tp, &sa) >=0 )dev_set_mac_address (tp->netdev, &sa,NULL ); -rtnl_unlock (); - } netdev = tp->netdev;if (!netif_running (netdev)) -return 0 ; + goto exit;set_bit (WORK_ENABLE , &tp->flags);if (netif_carrier_ok (netdev)) {
@@ -8427,6 +8426,8 @@ static int rtl8152_post_reset(struct usb_interface *intf)if (!list_empty (&tp->rx_done))napi_schedule (&tp->napi); +exit: +rtnl_unlock ();return 0 ; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 33/244 r8152: Add RTL8152_INACCESSIBLE checks to more loops
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Anderson <[email protected]>
[ Upstream commit 32a574c7e2685aa8138754d4d755f9246cc6bd48 ]
Previous commits added checks for RTL8152_INACCESSIBLE in the loops in the driver. There are still a few more that keep tripping the driver up in error cases and make things take longer than they should. Add those in.
All the loops that are part of this commit existed in some form or another since the r8152 driver was first introduced, though RTL8152_INACCESSIBLE was known as RTL8152_UNPLUG before commit 715f67f33af4 ("r8152: Rename RTL8152_UNPLUG to RTL8152_INACCESSIBLE")
--- drivers/net/usb/r8152.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/net/usb/r8152.c +8 -0
@@ -2967,6 +2967,8 @@ static void rtl8152_nic_reset(struct r8152 *tp)ocp_write_byte (tp,MCU_TYPE_PLA ,PLA_CR ,CR_RST );for (i =0 ; i <1000 ; i++) { +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags)) +break ;if (!(ocp_read_byte (tp,MCU_TYPE_PLA ,PLA_CR ) &CR_RST ))break ;usleep_range (100 ,400 );
@@ -3296,6 +3298,8 @@ static void rtl_disable(struct r8152 *tp)rxdy_gated_en (tp, true);for (i =0 ; i <1000 ; i++) { +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags)) +break ; ocp_data =ocp_read_byte (tp,MCU_TYPE_PLA ,PLA_OOB_CTRL );if ((ocp_data &FIFO_EMPTY ) ==FIFO_EMPTY )break ;
@@ -3303,6 +3307,8 @@ static void rtl_disable(struct r8152 *tp) }for (i =0 ; i <1000 ; i++) { +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags)) +break ;if (ocp_read_word (tp,MCU_TYPE_PLA ,PLA_TCR0 ) &TCR0_TX_EMPTY )break ;usleep_range (1000 ,2000 );
@@ -5466,6 +5472,8 @@ static void wait_oob_link_list_ready(struct r8152 *tp)int i;for (i =0 ; i <1000 ; i++) { +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags)) +break ; ocp_data =ocp_read_byte (tp,MCU_TYPE_PLA ,PLA_OOB_CTRL );if (ocp_data &LINK_LIST_READY )break ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 34/244 r8152: Add RTL8152_INACCESSIBLE to r8156b_wait_loading_flash()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Anderson <[email protected]>
[ Upstream commit 8a67b47fced9f6a84101eb9ec5ce4c7d64204bc7 ]
Delay loops in r8152 should break out if RTL8152_INACCESSIBLE is set so that they don't delay too long if the device becomes inaccessible. Add the break to the loop in r8156b_wait_loading_flash().
--- drivers/net/usb/r8152.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/usb/r8152.c +2 -0
@@ -5488,6 +5488,8 @@ static void r8156b_wait_loading_flash(struct r8152 *tp)int i;for (i =0 ; i <100 ; i++) { +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags)) +break ;if (ocp_read_word (tp,MCU_TYPE_USB ,USB_GPHY_CTRL ) &GPHY_PATCH_DONE )break ;usleep_range (1000 ,2000 );
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 35/244 r8152: Add RTL8152_INACCESSIBLE to r8153_pre_firmware_1()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Anderson <[email protected]>
[ Upstream commit 8c53a7bd706535a9cf4e2ec3a4e8d61d46353ca0 ]
Delay loops in r8152 should break out if RTL8152_INACCESSIBLE is set so that they don't delay too long if the device becomes inaccessible. Add the break to the loop in r8153_pre_firmware_1().
--- drivers/net/usb/r8152.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/usb/r8152.c +2 -0
@@ -5612,6 +5612,8 @@ static int r8153_pre_firmware_1(struct r8152 *tp)for (i =0 ; i <104 ; i++) {u32 ocp_data =ocp_read_byte (tp,MCU_TYPE_USB ,USB_WDT1_CTRL ); +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags)) +return -ENODEV ;if (!(ocp_data &WTD1_EN ))break ;usleep_range (1000 ,2000 );
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 36/244 r8152: Add RTL8152_INACCESSIBLE to r8153_aldps_en()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Anderson <[email protected]>
[ Upstream commit 79321a793945fdbff2f405f84712d0ab81bed287 ]
Delay loops in r8152 should break out if RTL8152_INACCESSIBLE is set so that they don't delay too long if the device becomes inaccessible. Add the break to the loop in r8153_aldps_en().
--- drivers/net/usb/r8152.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/usb/r8152.c +2 -0
@@ -5770,6 +5770,8 @@ static void r8153_aldps_en(struct r8152 *tp, bool enable) data &= ~EN_ALDPS ;ocp_reg_write (tp,OCP_POWER_CFG , data);for (i =0 ; i <20 ; i++) { +if (test_bit (RTL8152_INACCESSIBLE , &tp->flags)) +return ;usleep_range (1000 ,2000 );if (ocp_read_word (tp,MCU_TYPE_PLA ,0xe000 ) &0x0100 )break ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 37/244 mlxbf-bootctl: correctly identify secure boot with development keys
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Thompson <[email protected]>
[ Upstream commit d4eef75279f5e9d594f5785502038c763ce42268 ]
The secure boot state of the BlueField SoC is represented by two bits:
0 = production state
1 = secure boot enabled
2 = non-secure (secure boot disabled)
3 = RMA state
There is also a single bit to indicate whether production keys or development keys are being used when secure boot is enabled. This single bit (specified by MLXBF_BOOTCTL_SB_DEV_MASK) only has meaning if secure boot state equals 1 (secure boot enabled).
The secure boot states are as follows:
- “GA secured” is when secure boot is enabled with official production keys.
- “Secured (development)” is when secure boot is enabled with development keys.
Without this fix “GA Secured” is displayed on development cards which is misleading. This patch updates the logic in "lifecycle_state_show()" to handle the case where the SoC is configured for secure boot and is using development keys.
--- drivers/platform/mellanox/mlxbf-bootctl.c | 39 +++++++++++++++-------- 1 file changed, 26 insertions(+), 13 deletions(-)
drivers/platform/mellanox/mlxbf-bootctl.c +26 -13
@@ -20,6 +20,7 @@#define MLXBF_BOOTCTL_SB_SECURE_MASK 0x03#define MLXBF_BOOTCTL_SB_TEST_MASK 0x0c +#define MLXBF_BOOTCTL_SB_DEV_MASK BIT(4)#define MLXBF_SB_KEY_NUM 4
@@ -40,11 +41,18 @@ static struct mlxbf_bootctl_name boot_names[] = { { MLXBF_BOOTCTL_NONE, "none" }, }; +enum { +MLXBF_BOOTCTL_SB_LIFECYCLE_PRODUCTION =0 , +MLXBF_BOOTCTL_SB_LIFECYCLE_GA_SECURE =1 , +MLXBF_BOOTCTL_SB_LIFECYCLE_GA_NON_SECURE =2 , +MLXBF_BOOTCTL_SB_LIFECYCLE_RMA =3 +}; +static const char *const mlxbf_bootctl_lifecycle_states[] = { - [0 ] ="Production" , - [1 ] ="GA Secured" , - [2 ] ="GA Non-Secured" , - [3 ] ="RMA" , + [MLXBF_BOOTCTL_SB_LIFECYCLE_PRODUCTION ] ="Production" , + [MLXBF_BOOTCTL_SB_LIFECYCLE_GA_SECURE ] ="GA Secured" , + [MLXBF_BOOTCTL_SB_LIFECYCLE_GA_NON_SECURE ] ="GA Non-Secured" , + [MLXBF_BOOTCTL_SB_LIFECYCLE_RMA ] ="RMA" , };/* Log header format. */
@@ -247,25 +255,30 @@ static ssize_t second_reset_action_store(struct device *dev,static ssize_t lifecycle_state_show (struct device *dev,struct device_attribute *attr,char *buf) { +int status_bits; +int use_dev_key; +int test_state;int lc_state; - lc_state =mlxbf_bootctl_smc (MLXBF_BOOTCTL_GET_TBB_FUSE_STATUS , -MLXBF_BOOTCTL_FUSE_STATUS_LIFECYCLE ); -if (lc_state <0 ) -return lc_state; + status_bits =mlxbf_bootctl_smc (MLXBF_BOOTCTL_GET_TBB_FUSE_STATUS , +MLXBF_BOOTCTL_FUSE_STATUS_LIFECYCLE ); +if (status_bits <0 ) +return status_bits; - lc_state &= -MLXBF_BOOTCTL_SB_TEST_MASK |MLXBF_BOOTCTL_SB_SECURE_MASK ; + use_dev_key = status_bits &MLXBF_BOOTCTL_SB_DEV_MASK ; + test_state = status_bits &MLXBF_BOOTCTL_SB_TEST_MASK ; + lc_state = status_bits &MLXBF_BOOTCTL_SB_SECURE_MASK ;/* * If the test bits are set, we specify that the current state may be * due to using the test bits. */ -if (lc_state &MLXBF_BOOTCTL_SB_TEST_MASK ) { - lc_state &=MLXBF_BOOTCTL_SB_SECURE_MASK ; - +if (test_state) {return sprintf (buf,"%s(test)\n" , mlxbf_bootctl_lifecycle_states[lc_state]); + }else if (use_dev_key && + (lc_state ==MLXBF_BOOTCTL_SB_LIFECYCLE_GA_SECURE )) { +return sprintf (buf,"Secured (development)\n" ); }return sprintf (buf,"%s\n" , mlxbf_bootctl_lifecycle_states[lc_state]);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 38/244 platform/mellanox: Add null pointer checks for devm_kasprintf()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kunwu Chan <[email protected]>
[ Upstream commit 2c7c857f5fed997be93047d2de853d7f10c8defe ]
devm_kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure.
Compile-tested only.
--- drivers/platform/mellanox/mlxbf-pmc.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/platform/mellanox/mlxbf-pmc.c +12 -0
@@ -1202,6 +1202,8 @@ static int mlxbf_pmc_init_perftype_counter(struct device *dev, int blk_num) attr->dev_attr.show = mlxbf_pmc_event_list_show; attr->nr = blk_num; attr->dev_attr.attr.name =devm_kasprintf (dev,GFP_KERNEL ,"event_list" ); +if (!attr->dev_attr.attr.name) +return -ENOMEM ; pmc->block[blk_num].block_attr[i] = &attr->dev_attr.attr; attr =NULL ;
@@ -1214,6 +1216,8 @@ static int mlxbf_pmc_init_perftype_counter(struct device *dev, int blk_num) attr->nr = blk_num; attr->dev_attr.attr.name =devm_kasprintf (dev,GFP_KERNEL ,"enable" ); +if (!attr->dev_attr.attr.name) +return -ENOMEM ; pmc->block[blk_num].block_attr[++i] = &attr->dev_attr.attr; attr =NULL ; }
@@ -1240,6 +1244,8 @@ static int mlxbf_pmc_init_perftype_counter(struct device *dev, int blk_num) attr->nr = blk_num; attr->dev_attr.attr.name =devm_kasprintf (dev,GFP_KERNEL ,"counter%d" , j); +if (!attr->dev_attr.attr.name) +return -ENOMEM ; pmc->block[blk_num].block_attr[++i] = &attr->dev_attr.attr; attr =NULL ;
@@ -1251,6 +1257,8 @@ static int mlxbf_pmc_init_perftype_counter(struct device *dev, int blk_num) attr->nr = blk_num; attr->dev_attr.attr.name =devm_kasprintf (dev,GFP_KERNEL ,"event%d" , j); +if (!attr->dev_attr.attr.name) +return -ENOMEM ; pmc->block[blk_num].block_attr[++i] = &attr->dev_attr.attr; attr =NULL ; }
@@ -1283,6 +1291,8 @@ static int mlxbf_pmc_init_perftype_reg(struct device *dev, int blk_num) attr->nr = blk_num; attr->dev_attr.attr.name =devm_kasprintf (dev,GFP_KERNEL , events[j].evt_name); +if (!attr->dev_attr.attr.name) +return -ENOMEM ; pmc->block[blk_num].block_attr[i] = &attr->dev_attr.attr; attr =NULL ; i++;
@@ -1311,6 +1321,8 @@ static int mlxbf_pmc_create_groups(struct device *dev, int blk_num) pmc->block[blk_num].block_attr_grp.attrs = pmc->block[blk_num].block_attr; pmc->block[blk_num].block_attr_grp.name =devm_kasprintf ( dev,GFP_KERNEL , pmc->block_name[blk_num]); +if (!pmc->block[blk_num].block_attr_grp.name) +return -ENOMEM ; pmc->groups[blk_num] = &pmc->block[blk_num].block_attr_grp;return 0 ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 39/244 platform/mellanox: Check devm_hwmon_device_register_with_groups() return value
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kunwu Chan <[email protected]>
[ Upstream commit 3494a594315b56516988afb6854d75dee5b501db ]
devm_hwmon_device_register_with_groups() returns an error pointer upon failure. Check its return value for errors.
Compile-tested only.
--- drivers/platform/mellanox/mlxbf-pmc.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/platform/mellanox/mlxbf-pmc.c +2 -0
@@ -1454,6 +1454,8 @@ static int mlxbf_pmc_probe(struct platform_device *pdev) pmc->hwmon_dev =devm_hwmon_device_register_with_groups ( dev,"bfperf" , pmc, pmc->groups); +if (IS_ERR (pmc->hwmon_dev)) +return PTR_ERR (pmc->hwmon_dev);platform_set_drvdata (pdev, pmc);return 0 ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 40/244 arcnet: restoring support for multiple Sohard Arcnet cards
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Reichinger <[email protected]>
[ Upstream commit 6b17a597fc2f13aaaa0a2780eb7edb9ae7ac9aea ]
Probe of Sohard Arcnet cards fails,
if 2 or more cards are installed in a system.
See kernel log:
[ 2.759203] arcnet: arcnet loaded [ 2.763648] arcnet:com20020: COM20020 chipset support (by David Woodhouse et al.) [ 2.770585] arcnet:com20020_pci: COM20020 PCI support [ 2.772295] com20020 0000:02:00.0: enabling device (0000 -> 0003) [ 2.772354] (unnamed net_device) (uninitialized): PLX-PCI Controls ... [ 3.071301] com20020 0000:02:00.0 arc0-0 (uninitialized): PCI COM20020: station FFh found at F080h, IRQ 101. [ 3.071305] com20020 0000:02:00.0 arc0-0 (uninitialized): Using CKP 64 - data rate 2.5 Mb/s [ 3.071534] com20020 0000:07:00.0: enabling device (0000 -> 0003) [ 3.071581] (unnamed net_device) (uninitialized): PLX-PCI Controls ... [ 3.369501] com20020 0000:07:00.0: Led pci:green:tx:0-0 renamed to pci:green:tx:0-0_1 due to name collision [ 3.369535] com20020 0000:07:00.0: Led pci:red:recon:0-0 renamed to pci:red:recon:0-0_1 due to name collision [ 3.370586] com20020 0000:07:00.0 arc0-0 (uninitialized): PCI COM20020: station E1h found at C000h, IRQ 35. [ 3.370589] com20020 0000:07:00.0 arc0-0 (uninitialized): Using CKP 64 - data rate 2.5 Mb/s [ 3.370608] com20020: probe of 0000:07:00.0 failed with error -5
commit 5ef216c1f848 ("arcnet: com20020-pci: add rotary index support") changes the device name of all COM20020 based PCI cards, even if only some cards support this:
snprintf(dev->name, sizeof(dev->name), "arc%d-%d", dev->dev_id, i);
The error happens because all Sohard Arcnet cards would be called arc0-0, since the Sohard Arcnet cards don't have a PLX rotary coder. I.e. EAE Arcnet cards have a PLX rotary coder,
which sets the first decimal, ensuring unique devices names.
This patch adds two new card feature flags to indicate which cards support LEDs and the PLX rotary coder.
For EAE based cards the names still depend on the PLX rotary coder (untested, since missing EAE hardware).
For Sohard based cards, this patch will result in devices being called arc0, arc1, ... (tested).
--- drivers/net/arcnet/arcdevice.h | 2 + drivers/net/arcnet/com20020-pci.c | 89 ++++++++++++++++--------------- 2 files changed, 48 insertions(+), 43 deletions(-)
drivers/net/arcnet/arcdevice.h +2 -0
@@ -186,6 +186,8 @@ do { \#define ARC_IS_5MBIT 1/* card default speed is 5MBit */ #define ARC_CAN_10MBIT 2/* card uses COM20022, supporting 10MBit, but default is 2.5MBit. */ +#define ARC_HAS_LED 4/* card has software controlled LEDs */ +#define ARC_HAS_ROTARY 8/* card has rotary encoder */ /* information needed to define an encapsulation driver */ struct ArcProto {
drivers/net/arcnet/com20020-pci.c +46 -43
133 lines not on this page · raw message
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 41/244 octeontx2-pf: consider both Rx and Tx packet stats for adaptive interrupt coalescing
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naveen Mamindlapalli <[email protected]>
[ Upstream commit adbf100fc47001c93d7e513ecac6fd6e04d5b4a1 ]
The current adaptive interrupt coalescing code updates only rx packet stats for dim algorithm. This patch also updates tx packet stats which will be useful when there is only tx traffic. Also moved configuring hardware adaptive interrupt setting to driver dim callback.
--- .../ethernet/marvell/octeontx2/nic/otx2_pf.c | 9 +++++++++ .../marvell/octeontx2/nic/otx2_txrx.c | 20 +++++++++---------- 2 files changed, 19 insertions(+), 10 deletions(-)
drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +9 -0
@@ -1688,6 +1688,14 @@ static void otx2_do_set_rx_mode(struct otx2_nic *pf)mutex_unlock (&pf->mbox.lock); } +static void otx2_set_irq_coalesce (struct otx2_nic *pfvf) +{ +int cint; + +for (cint =0 ; cint < pfvf->hw.cint_cnt; cint++) +otx2_config_irq_coalescing (pfvf, cint); +} +static void otx2_dim_work (struct work_struct *w) {struct dim_cq_moder cur_moder;
@@ -1703,6 +1711,7 @@ static void otx2_dim_work(struct work_struct *w) CQ_TIMER_THRESH_MAX : cur_moder.usec; pfvf->hw.cq_ecount_wait = (cur_moder.pkts >NAPI_POLL_WEIGHT ) ?NAPI_POLL_WEIGHT : cur_moder.pkts; +otx2_set_irq_coalesce (pfvf); dim->state =DIM_START_MEASURE ; }
drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c +10 -10
@@ -512,11 +512,18 @@ static void otx2_adjust_adaptive_coalese(struct otx2_nic *pfvf, struct otx2_cq_p {struct dim_sample dim_sample;u64 rx_frames, rx_bytes; +u64 tx_frames, tx_bytes; rx_frames =OTX2_GET_RX_STATS (RX_BCAST ) +OTX2_GET_RX_STATS (RX_MCAST ) +OTX2_GET_RX_STATS (RX_UCAST ); rx_bytes =OTX2_GET_RX_STATS (RX_OCTS ); -dim_update_sample (pfvf->napi_events, rx_frames, rx_bytes, &dim_sample); + tx_bytes =OTX2_GET_TX_STATS (TX_OCTS ); + tx_frames =OTX2_GET_TX_STATS (TX_UCAST ); + +dim_update_sample (pfvf->napi_events, + rx_frames + tx_frames, + rx_bytes + tx_bytes, + &dim_sample);net_dim (&cq_poll->dim, dim_sample); }
@@ -558,16 +565,9 @@ int otx2_napi_handler(struct napi_struct *napi, int budget)if (pfvf->flags &OTX2_FLAG_INTF_DOWN )return workdone; -/* Check for adaptive interrupt coalesce */ -if (workdone !=0 && - ((pfvf->flags &OTX2_FLAG_ADPTV_INT_COAL_ENABLED ) == -OTX2_FLAG_ADPTV_INT_COAL_ENABLED )) { -/* Adjust irq coalese using net_dim */ +/* Adjust irq coalese using net_dim */ +if (pfvf->flags &OTX2_FLAG_ADPTV_INT_COAL_ENABLED )otx2_adjust_adaptive_coalese (pfvf, cq_poll); -/* Update irq coalescing */ -for (i =0 ; i < pfvf->hw.cint_cnt; i++) -otx2_config_irq_coalescing (pfvf, i); - }if (unlikely (!filled_cnt)) {struct refill_work *work;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 42/244 net: stmmac: fix FPE events losing
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianheng Zhang <[email protected]>
[ Upstream commit 37e4b8df27bc68340f3fc80dbb27e3549c7f881c ]
The status bits of register MAC_FPE_CTRL_STS are clear on read. Using 32-bit read for MAC_FPE_CTRL_STS in dwmac5_fpe_configure() and dwmac5_fpe_send_mpacket() clear the status bits. Then the stmmac interrupt handler missing FPE event status and leads to FPE handshaking failure and retries.
To avoid clear status bits of MAC_FPE_CTRL_STS in dwmac5_fpe_configure() and dwmac5_fpe_send_mpacket(), add fpe_csr to stmmac_fpe_cfg structure to cache the control bits of MAC_FPE_CTRL_STS and to avoid reading MAC_FPE_CTRL_STS in those methods.
--- drivers/net/ethernet/stmicro/stmmac/dwmac5.c | 45 ++++++++----------- drivers/net/ethernet/stmicro/stmmac/dwmac5.h | 4 +- .../ethernet/stmicro/stmmac/dwxgmac2_core.c | 3 +- drivers/net/ethernet/stmicro/stmmac/hwif.h | 4 +- .../net/ethernet/stmicro/stmmac/stmmac_main.c | 8 +++- .../net/ethernet/stmicro/stmmac/stmmac_tc.c | 1 + include/linux/stmmac.h | 1 + 7 files changed, 36 insertions(+), 30 deletions(-)
drivers/net/ethernet/stmicro/stmmac/dwmac5.c +19 -26
@@ -710,28 +710,22 @@ void dwmac5_est_irq_status(void __iomem *ioaddr, struct net_device *dev, } } -void dwmac5_fpe_configure (void __iomem *ioaddr,u32 num_txq,u32 num_rxq, +void dwmac5_fpe_configure (void __iomem *ioaddr,struct stmmac_fpe_cfg *cfg, +u32 num_txq,u32 num_rxq,bool enable) {u32 value; -if (!enable) { - value =readl (ioaddr +MAC_FPE_CTRL_STS ); - - value &= ~EFPE ; - -writel (value, ioaddr +MAC_FPE_CTRL_STS ); -return ; +if (enable) { + cfg->fpe_csr =EFPE ; + value =readl (ioaddr +GMAC_RXQ_CTRL1 ); + value &= ~GMAC_RXQCTRL_FPRQ ; + value |= (num_rxq -1 ) <<GMAC_RXQCTRL_FPRQ_SHIFT ; +writel (value, ioaddr +GMAC_RXQ_CTRL1 ); + }else { + cfg->fpe_csr =0 ; } - - value =readl (ioaddr +GMAC_RXQ_CTRL1 ); - value &= ~GMAC_RXQCTRL_FPRQ ; - value |= (num_rxq -1 ) <<GMAC_RXQCTRL_FPRQ_SHIFT ; -writel (value, ioaddr +GMAC_RXQ_CTRL1 ); - - value =readl (ioaddr +MAC_FPE_CTRL_STS ); - value |=EFPE ; -writel (value, ioaddr +MAC_FPE_CTRL_STS ); +writel (cfg->fpe_csr, ioaddr +MAC_FPE_CTRL_STS ); }int dwmac5_fpe_irq_status (void __iomem *ioaddr,struct net_device *dev)
@@ -741,6 +735,9 @@ int dwmac5_fpe_irq_status(void __iomem *ioaddr, struct net_device *dev) status =FPE_EVENT_UNKNOWN ; +/* Reads from the MAC_FPE_CTRL_STS register should only be performed +* here, since the status flags of MAC_FPE_CTRL_STS are "clear on read" +*/ value =readl (ioaddr +MAC_FPE_CTRL_STS );if (value &TRSP ) {
@@ -766,19 +763,15 @@ int dwmac5_fpe_irq_status(void __iomem *ioaddr, struct net_device *dev)return status; } -void dwmac5_fpe_send_mpacket (void __iomem *ioaddr,enum stmmac_mpacket_type type) +void dwmac5_fpe_send_mpacket (void __iomem *ioaddr,struct stmmac_fpe_cfg *cfg, +enum stmmac_mpacket_type type) { -u32 value; +u32 value = cfg->fpe_csr; - value =readl (ioaddr +MAC_FPE_CTRL_STS ); - -if (type ==MPACKET_VERIFY ) { - value &= ~SRSP ; +if (type ==MPACKET_VERIFY ) value |=SVER ; - }else { - value &= ~SVER ; +else if (type ==MPACKET_RESPONSE ) value |=SRSP ; - }writel (value, ioaddr +MAC_FPE_CTRL_STS ); }
drivers/net/ethernet/stmicro/stmmac/dwmac5.h +3 -1
@@ -153,9 +153,11 @@ int dwmac5_est_configure(void __iomem *ioaddr, struct stmmac_est *cfg, unsigned int ptp_rate);void dwmac5_est_irq_status (void __iomem *ioaddr,struct net_device *dev,struct stmmac_extra_stats *x,u32 txqcnt); -void dwmac5_fpe_configure (void __iomem *ioaddr,u32 num_txq,u32 num_rxq, +void dwmac5_fpe_configure (void __iomem *ioaddr,struct stmmac_fpe_cfg *cfg, +u32 num_txq,u32 num_rxq,bool enable);void dwmac5_fpe_send_mpacket (void __iomem *ioaddr, +struct stmmac_fpe_cfg *cfg,enum stmmac_mpacket_type type);int dwmac5_fpe_irq_status (void __iomem *ioaddr,struct net_device *dev);
drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c +2 -1
@@ -1484,7 +1484,8 @@ static int dwxgmac3_est_configure(void __iomem *ioaddr, struct stmmac_est *cfg,return 0 ; } -static void dwxgmac3_fpe_configure (void __iomem *ioaddr,u32 num_txq, +static void dwxgmac3_fpe_configure (void __iomem *ioaddr,struct stmmac_fpe_cfg *cfg, +u32 num_txq,u32 num_rxq,bool enable) {u32 value;
drivers/net/ethernet/stmicro/stmmac/hwif.h +3 -1
@@ -412,9 +412,11 @@ struct stmmac_ops { unsigned int ptp_rate);void (*est_irq_status)(void __iomem *ioaddr,struct net_device *dev,struct stmmac_extra_stats *x,u32 txqcnt); -void (*fpe_configure)(void __iomem *ioaddr,u32 num_txq,u32 num_rxq, +void (*fpe_configure)(void __iomem *ioaddr,struct stmmac_fpe_cfg *cfg, +u32 num_txq,u32 num_rxq,bool enable);void (*fpe_send_mpacket)(void __iomem *ioaddr, +struct stmmac_fpe_cfg *cfg,enum stmmac_mpacket_type type);int (*fpe_irq_status)(void __iomem *ioaddr,struct net_device *dev); };
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +7 -1
@@ -964,7 +964,8 @@ static void stmmac_fpe_link_state_handle(struct stmmac_priv *priv, bool is_up)bool *hs_enable = &fpe_cfg->hs_enable;if (is_up && *hs_enable) { -stmmac_fpe_send_mpacket (priv, priv->ioaddr,MPACKET_VERIFY ); +stmmac_fpe_send_mpacket (priv, priv->ioaddr, fpe_cfg, +MPACKET_VERIFY ); }else { *lo_state =FPE_STATE_OFF ; *lp_state =FPE_STATE_OFF ;
@@ -5803,6 +5804,7 @@ static void stmmac_fpe_event_status(struct stmmac_priv *priv, int status)/* If user has requested FPE enable, quickly response */ if (*hs_enable)stmmac_fpe_send_mpacket (priv, priv->ioaddr, + fpe_cfg,MPACKET_RESPONSE ); }
@@ -7227,6 +7229,7 @@ static void stmmac_fpe_lp_task(struct work_struct *work)if (*lo_state ==FPE_STATE_ENTERING_ON && *lp_state ==FPE_STATE_ENTERING_ON ) {stmmac_fpe_configure (priv, priv->ioaddr, + fpe_cfg, priv->plat->tx_queues_to_use, priv->plat->rx_queues_to_use, *enable);
@@ -7245,6 +7248,7 @@ static void stmmac_fpe_lp_task(struct work_struct *work)netdev_info (priv->dev,SEND_VERIFY_MPAKCET_FMT , *lo_state, *lp_state);stmmac_fpe_send_mpacket (priv, priv->ioaddr, + fpe_cfg,MPACKET_VERIFY ); }/* Sleep then retry */
@@ -7259,6 +7263,7 @@ void stmmac_fpe_handshake(struct stmmac_priv *priv, bool enable)if (priv->plat->fpe_cfg->hs_enable != enable) {if (enable) {stmmac_fpe_send_mpacket (priv, priv->ioaddr, + priv->plat->fpe_cfg,MPACKET_VERIFY ); }else { priv->plat->fpe_cfg->lo_fpe_state =FPE_STATE_OFF ;
@@ -7719,6 +7724,7 @@ int stmmac_suspend(struct device *dev)if (priv->dma_cap.fpesel) {/* Disable FPE */ stmmac_fpe_configure (priv, priv->ioaddr, + priv->plat->fpe_cfg, priv->plat->tx_queues_to_use, priv->plat->rx_queues_to_use, false);
drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c +1 -0
@@ -1079,6 +1079,7 @@ static int tc_setup_taprio(struct stmmac_priv *priv, priv->plat->fpe_cfg->enable = false;stmmac_fpe_configure (priv, priv->ioaddr, + priv->plat->fpe_cfg, priv->plat->tx_queues_to_use, priv->plat->rx_queues_to_use, false);
include/linux/stmmac.h +1 -0
@@ -174,6 +174,7 @@ struct stmmac_fpe_cfg {bool hs_enable;/* FPE handshake enable */ enum stmmac_fpe_state lp_fpe_state;/* Link Partner FPE state */ enum stmmac_fpe_state lo_fpe_state;/* Local station FPE state */ +u32 fpe_csr;/* MAC_FPE_CTRL_STS reg cache */ };struct stmmac_safety_feature_cfg {
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 43/244 xsk: Skip polling event check for unbound socket
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yewon Choi <[email protected]>
[ Upstream commit e4d008d49a7135214e0ee70537405b6a069e3a3f ]
In xsk_poll(), checking available events and setting mask bits should be executed only when a socket has been bound. Setting mask bits for unbound socket is meaningless.
Currently, it checks events even when xsk_check_common() failed. To prevent this, we move goto location (skip_tx) after that checking.
--- net/xdp/xsk.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
net/xdp/xsk.c +2 -3
@@ -919,7 +919,7 @@ static __poll_t xsk_poll(struct file *file, struct socket *sock,rcu_read_lock ();if (xsk_check_common (xs)) - goto skip_tx; + goto out; pool = xs->pool;
@@ -931,12 +931,11 @@ static __poll_t xsk_poll(struct file *file, struct socket *sock,xsk_generic_xmit (sk); } -skip_tx:if (xs->rx && !xskq_prod_is_empty (xs->rx)) mask |=EPOLLIN |EPOLLRDNORM ;if (xs->tx &&xsk_tx_writeable (xs)) mask |=EPOLLOUT |EPOLLWRNORM ; - +out:rcu_read_unlock ();return mask; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 44/244 octeontx2-af: fix a use-after-free in rvu_npa_register_reporters
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhipeng Lu <[email protected]>
[ Upstream commit 3c91c909f13f0c32b0d54d75c3f798479b1a84f5 ]
The rvu_dl will be freed in rvu_npa_health_reporters_destroy(rvu_dl) after the create_workqueue fails, and after that free, the rvu_dl will be translate back through rvu_npa_health_reporters_create, rvu_health_reporters_create, and rvu_register_dl. Finally it goes to the err_dl_health label, being freed again in rvu_health_reporters_destroy(rvu) by rvu_npa_health_reporters_destroy. In the second calls of rvu_npa_health_reporters_destroy, however, it uses rvu_dl->rvu_npa_health_reporter, which is already freed at the end of rvu_npa_health_reporters_destroy in the first call.
So this patch prevents the first destroy by instantly returning -ENONMEN when create_workqueue fails. In addition, since the failure of create_workqueue is the only entrence of label err, it has been integrated into the error-handling path of create_workqueue.
--- drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c +1 -4
@@ -1285,7 +1285,7 @@ static int rvu_npa_register_reporters(struct rvu_devlink *rvu_dl) rvu_dl->devlink_wq =create_workqueue ("rvu_devlink_wq" );if (!rvu_dl->devlink_wq) - goto err; +return -ENOMEM ;INIT_WORK (&rvu_reporters->intr_work, rvu_npa_intr_work);INIT_WORK (&rvu_reporters->err_work, rvu_npa_err_work);
@@ -1293,9 +1293,6 @@ static int rvu_npa_register_reporters(struct rvu_devlink *rvu_dl)INIT_WORK (&rvu_reporters->ras_work, rvu_npa_ras_work);return 0 ; -err: -rvu_npa_health_reporters_destroy (rvu_dl); -return -ENOMEM ; }static int rvu_npa_health_reporters_create (struct rvu_devlink *rvu_dl)
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 45/244 ice: Restore fix disabling RX VLAN filtering
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marcin Szycik <[email protected]>
[ Upstream commit 4e7f0087b058cc3cab8f3c32141b51aa5457d298 ]
Fix setting dis_rx_filtering depending on whether port vlan is being turned on or off. This was originally fixed in commit c793f8ea15e3 ("ice:
Fix disabling Rx VLAN filtering with port VLAN enabled"), but while refactoring ice_vf_vsi_init_vlan_ops(), the fix has been lost. Restore the fix along with the original comment from that change.
Also delete duplicate lines in ice_port_vlan_on().
--- drivers/net/ethernet/intel/ice/ice_vf_vsi_vlan_ops.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/net/ethernet/intel/ice/ice_vf_vsi_vlan_ops.c +8 -3
@@ -32,7 +32,6 @@ static void ice_port_vlan_on(struct ice_vsi *vsi)/* setup outer VLAN ops */ vlan_ops->set_port_vlan = ice_vsi_set_outer_port_vlan; vlan_ops->clear_port_vlan = ice_vsi_clear_outer_port_vlan; - vlan_ops->clear_port_vlan = ice_vsi_clear_outer_port_vlan;/* setup inner VLAN ops */ vlan_ops = &vsi->inner_vlan_ops;
@@ -47,8 +46,13 @@ static void ice_port_vlan_on(struct ice_vsi *vsi) vlan_ops->set_port_vlan = ice_vsi_set_inner_port_vlan; vlan_ops->clear_port_vlan = ice_vsi_clear_inner_port_vlan; - vlan_ops->clear_port_vlan = ice_vsi_clear_inner_port_vlan; } + +/* all Rx traffic should be in the domain of the assigned port VLAN, +* so prevent disabling Rx VLAN filtering +*/ + vlan_ops->dis_rx_filtering = noop_vlan; + vlan_ops->ena_rx_filtering = ice_vsi_ena_rx_vlan_filtering; }
@@ -77,6 +81,8 @@ static void ice_port_vlan_off(struct ice_vsi *vsi) vlan_ops->del_vlan = ice_vsi_del_vlan; } + vlan_ops->dis_rx_filtering = ice_vsi_dis_rx_vlan_filtering; +if (!test_bit (ICE_FLAG_VF_VLAN_PRUNING , pf->flags)) vlan_ops->ena_rx_filtering = noop_vlan;else
@@ -141,7 +147,6 @@ void ice_vf_vsi_init_vlan_ops(struct ice_vsi *vsi) &vsi->outer_vlan_ops : &vsi->inner_vlan_ops; vlan_ops->add_vlan = ice_vsi_add_vlan; - vlan_ops->dis_rx_filtering = ice_vsi_dis_rx_vlan_filtering; vlan_ops->ena_tx_filtering = ice_vsi_ena_tx_vlan_filtering; vlan_ops->dis_tx_filtering = ice_vsi_dis_tx_vlan_filtering; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 46/244 i40e: Fix unexpected MFS warning message
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Vecera <[email protected]>
[ Upstream commit 7d9f22b3d3ef379ed05bd3f3e2de83dfa8da8258 ]
Commit 3a2c6ced90e1 ("i40e: Add a check to see if MFS is set") added a warning message that reports unexpected size of port's MFS (max frame size) value. This message use for the port number local variable 'i' that is wrong.
In i40e_probe() this 'i' variable is used only to iterate VSIs to find FDIR VSI:
<code>
...
/* if FDIR VSI was set up, start it now */
for (i = 0; i < pf->num_alloc_vsi; i++) {
if (pf->vsi[i] && pf->vsi[i]->type == I40E_VSI_FDIR) {
i40e_vsi_open(pf->vsi[i]);
break;
}
}...
</code>
So the warning message use for the port number index of FDIR VSI if this exists or pf->num_alloc_vsi if not.
Fix the message by using 'pf->hw.port' for the port number.
--- drivers/net/ethernet/intel/i40e/i40e_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/intel/i40e/i40e_main.c +1 -1
@@ -16195,7 +16195,7 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent) I40E_PRTGL_SAH_MFS_MASK) >> I40E_PRTGL_SAH_MFS_SHIFT;if (val <MAX_FRAME_SIZE_DEFAULT )dev_warn (&pdev->dev,"MFS for port %x has been set below the default: %x\n" , - i, val); + pf->hw.port, val);/* Add a filter to drop all Flow control frames from any VSI from being * transmitted. By doing so we stop a malicious VF from sending out
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 47/244 iavf: validate tx_coalesce_usecs even if rx_coalesce_usecs is zero
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Keller <[email protected]>
[ Upstream commit a206d9959f5ccd0fb2d54a997c993947ae0e881c ]
In __iavf_set_coalesce, the driver checks both ec->rx_coalesce_usecs and ec->tx_coalesce_usecs for validity. It does this via a chain if if/else-if blocks. If every single branch of the series of if statements exited, this would be fine. However, the rx_coalesce_usecs is checked against zero to print an informative message if use_adaptive_rx_coalesce is enabled. If this check is true, it short circuits the entire chain of statements, preventing validation of the tx_coalesce_usecs field.
Indeed, since commit e792779e6b63 ("iavf: Prevent changing static ITR values if adaptive moderation is on") the iavf driver actually rejects any change to the tx_coalesce_usecs or rx_coalesce_usecs when use_adaptive_tx_coalesce or use_adaptive_rx_coalesce is enabled, making this checking a bit redundant.
Fix this error by removing the unnecessary and redundant checks for use_adaptive_rx_coalesce and use_adaptive_tx_coalesce. Since zero is a valid value, and since the tx_coalesce_usecs and rx_coalesce_usecs fields are already unsigned, remove the minimum value check. This allows assigning an ITR value ranging from 0-8160 as described by the printed message.
--- drivers/net/ethernet/intel/iavf/iavf_ethtool.c | 12 ++---------- drivers/net/ethernet/intel/iavf/iavf_txrx.h | 1 - 2 files changed, 2 insertions(+), 11 deletions(-)
drivers/net/ethernet/intel/iavf/iavf_ethtool.c +2 -10
@@ -829,18 +829,10 @@ static int __iavf_set_coalesce(struct net_device *netdev,struct iavf_adapter *adapter =netdev_priv (netdev);int i; -if (ec->rx_coalesce_usecs ==0 ) { -if (ec->use_adaptive_rx_coalesce) -netif_info (adapter, drv, netdev,"rx-usecs=0, need to disable adaptive-rx for a complete disable\n" ); - }else if ((ec->rx_coalesce_usecs <IAVF_MIN_ITR ) || - (ec->rx_coalesce_usecs >IAVF_MAX_ITR )) { +if (ec->rx_coalesce_usecs >IAVF_MAX_ITR ) {netif_info (adapter, drv, netdev,"Invalid value, rx-usecs range is 0-8160\n" );return -EINVAL ; - }else if (ec->tx_coalesce_usecs ==0 ) { -if (ec->use_adaptive_tx_coalesce) -netif_info (adapter, drv, netdev,"tx-usecs=0, need to disable adaptive-tx for a complete disable\n" ); - }else if ((ec->tx_coalesce_usecs <IAVF_MIN_ITR ) || - (ec->tx_coalesce_usecs >IAVF_MAX_ITR )) { + }else if (ec->tx_coalesce_usecs >IAVF_MAX_ITR ) {netif_info (adapter, drv, netdev,"Invalid value, tx-usecs range is 0-8160\n" );return -EINVAL ; }
drivers/net/ethernet/intel/iavf/iavf_txrx.h +0 -1
@@ -15,7 +15,6 @@*/ #define IAVF_ITR_DYNAMIC 0x8000/* use top bit as a flag */ #define IAVF_ITR_MASK 0x1FFE/* mask for ITR register value */ -#define IAVF_MIN_ITR 2/* reg uses 2 usec resolution */ #define IAVF_ITR_100K 10/* all values below must be even */ #define IAVF_ITR_50K 20#define IAVF_ITR_20K 50
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 48/244 net: bnxt: fix a potential use-after-free in bnxt_init_tc
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dinghao Liu <[email protected]>
[ Upstream commit d007caaaf052f82ca2340d4c7b32d04a3f5dbf3f ]
When flow_indr_dev_register() fails, bnxt_init_tc will free bp->tc_info through kfree(). However, the caller function bnxt_init_one() will ignore this failure and call bnxt_shutdown_tc() on failure of bnxt_dl_register(), where a use-after-free happens. Fix this issue by setting bp->tc_info to NULL after kfree().
--- drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c +1 -0
@@ -2075,6 +2075,7 @@ int bnxt_init_tc(struct bnxt *bp)rhashtable_destroy (&tc_info->flow_table); free_tc_info:kfree (tc_info); + bp->tc_info =NULL ;return rc; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 49/244 tcp: fix mid stream window clamp.
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
[ Upstream commit 58d3aade20cdddbac6c9707ac0f3f5f8c1278b74 ]
After the blamed commit below, if the user-space application performs window clamping when tp->rcv_wnd is 0, the TCP socket will never be able to announce a non 0 receive window, even after completely emptying the receive buffer and re-setting the window clamp to higher values.
Refactor tcp_set_window_clamp() to address the issue: when the user decreases the current clamp value, set rcv_ssthresh according to the same logic used at buffer initialization, but ensuring reserved mem provisioning.
To avoid code duplication factor-out the relevant bits from tcp_adjust_rcv_ssthresh() in a new helper and reuse it in the above scenario.
When increasing the clamp value, give the rcv_ssthresh a chance to grow according to previously implemented heuristic.
--- include/net/tcp.h | 9 +++++++-- net/ipv4/tcp.c | 22 +++++++++++++++++++--- 2 files changed, 26 insertions(+), 5 deletions(-)
include/net/tcp.h +7 -2
@@ -1480,17 +1480,22 @@ static inline int tcp_full_space(const struct sock *sk)return tcp_win_from_space (sk,READ_ONCE (sk->sk_rcvbuf)); } -static inline void tcp_adjust_rcv_ssthresh (struct sock *sk) +static inline void __tcp_adjust_rcv_ssthresh (struct sock *sk,u32 new_ssthresh) {int unused_mem =sk_unused_reserved_mem (sk);struct tcp_sock *tp =tcp_sk (sk); - tp->rcv_ssthresh =min (tp->rcv_ssthresh,4U * tp->advmss); + tp->rcv_ssthresh =min (tp->rcv_ssthresh, new_ssthresh);if (unused_mem) tp->rcv_ssthresh =max_t (u32, tp->rcv_ssthresh,tcp_win_from_space (sk, unused_mem)); } +static inline void tcp_adjust_rcv_ssthresh (struct sock *sk) +{ +__tcp_adjust_rcv_ssthresh (sk,4U *tcp_sk (sk)->advmss); +} +void tcp_cleanup_rbuf (struct sock *sk,int copied);void __tcp_cleanup_rbuf (struct sock *sk,int copied);
net/ipv4/tcp.c +19 -3
@@ -3368,9 +3368,25 @@ int tcp_set_window_clamp(struct sock *sk, int val)return -EINVAL ; tp->window_clamp =0 ; }else { - tp->window_clamp = val <SOCK_MIN_RCVBUF /2 ? -SOCK_MIN_RCVBUF /2 : val; - tp->rcv_ssthresh =min (tp->rcv_wnd, tp->window_clamp); +u32 new_rcv_ssthresh, old_window_clamp = tp->window_clamp; +u32 new_window_clamp = val <SOCK_MIN_RCVBUF /2 ? +SOCK_MIN_RCVBUF /2 : val; + +if (new_window_clamp == old_window_clamp) +return 0 ; + + tp->window_clamp = new_window_clamp; +if (new_window_clamp < old_window_clamp) { +/* need to apply the reserved mem provisioning only +* when shrinking the window clamp +*/ +__tcp_adjust_rcv_ssthresh (sk, tp->window_clamp); + + }else { + new_rcv_ssthresh =min (tp->rcv_wnd, tp->window_clamp); + tp->rcv_ssthresh =max (new_rcv_ssthresh, + tp->rcv_ssthresh); + } }return 0 ; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 50/244 ionic: fix snprintf format length warning
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shannon Nelson <[email protected]>
[ Upstream commit 0ceb3860a67652f9d36dfdecfcd2cb3eb2f4537d ]
Our friendly kernel test robot has reminded us that with a new check we have a warning about a potential string truncation. In this case it really doesn't hurt anything, but it is worth addressing especially since there really is no reason to reserve so many bytes for our queue names. It seems that cutting the queue name buffer length in half stops the complaint.
--- drivers/net/ethernet/pensando/ionic/ionic_dev.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/pensando/ionic/ionic_dev.h +1 -1
@@ -222,7 +222,7 @@ struct ionic_desc_info {void *cb_arg; }; -#define IONIC_QUEUE_NAME_MAX_SZ 32 +#define IONIC_QUEUE_NAME_MAX_SZ 16struct ionic_queue {struct device *dev;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 51/244 ionic: Fix dim work handling in split interrupt mode
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brett Creeley <[email protected]>
[ Upstream commit 4115ba677c35f694b62298e55f0e04ce84eed469 ]
Currently ionic_dim_work() is incorrect when in split interrupt mode. This is because the interrupt rate is only being changed for the Rx side even for dim running on Tx. Fix this by using the qcq from the container_of macro. Also, introduce some local variables for a bit of cleanup.
--- drivers/net/ethernet/pensando/ionic/ionic_lif.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/net/ethernet/pensando/ionic/ionic_lif.c +8 -8
@@ -49,24 +49,24 @@ static void ionic_lif_queue_identify(struct ionic_lif *lif);static void ionic_dim_work (struct work_struct *work) { struct dim *dim = container_of(work, struct dim, work); +struct ionic_intr_info *intr;struct dim_cq_moder cur_moder;struct ionic_qcq *qcq; +struct ionic_lif *lif;u32 new_coal; cur_moder =net_dim_get_rx_moderation (dim->mode, dim->profile_ix); qcq = container_of(dim, struct ionic_qcq, dim); - new_coal =ionic_coal_usec_to_hw (qcq->q.lif->ionic, cur_moder.usec); + lif = qcq->q.lif; + new_coal =ionic_coal_usec_to_hw (lif->ionic, cur_moder.usec); new_coal = new_coal ? new_coal :1 ; -if (qcq->intr.dim_coal_hw != new_coal) { -unsigned int qi = qcq->cq.bound_q->index; -struct ionic_lif *lif = qcq->q.lif; - - qcq->intr.dim_coal_hw = new_coal; + intr = &qcq->intr; +if (intr->dim_coal_hw != new_coal) { + intr->dim_coal_hw = new_coal;ionic_intr_coal_init (lif->ionic->idev.intr_ctrl, - lif->rxqcqs[qi]->intr.index, - qcq->intr.dim_coal_hw); + intr->index, intr->dim_coal_hw); } dim->state =DIM_START_MEASURE ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 52/244 ipv4: ip_gre: Avoid skb_pull() failure in ipgre_xmit()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shigeru Yoshida <[email protected]>
[ Upstream commit 80d875cfc9d3711a029f234ef7d680db79e8fa4b ]
In ipgre_xmit(), skb_pull() may fail even if pskb_inet_may_pull() returns true. For example, applications can use PF_PACKET to create a malformed packet with no IP header. This type of packet causes a problem such as uninit-value access.
This patch ensures that skb_pull() can pull the required size by checking the skb with pskb_network_may_pull() before skb_pull().
--- net/ipv4/ip_gre.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
net/ipv4/ip_gre.c +7 -4
@@ -635,15 +635,18 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb, }if (dev->header_ops) { +int pull_len = tunnel->hlen +sizeof (struct iphdr ); +if (skb_cow_head (skb,0 )) goto free_skb; tnl_params = (const struct iphdr *)skb->data; -/* Pull skb since ip_tunnel_xmit() needs skb->data pointing -* to gre header. -*/ -skb_pull (skb, tunnel->hlen +sizeof (struct iphdr )); +if (!pskb_network_may_pull (skb, pull_len)) + goto free_skb; + +/* ip_tunnel_xmit() needs skb->data pointing to gre header. */ +skb_pull (skb, pull_len);skb_reset_mac_header (skb); if (skb->ip_summed == CHECKSUM_PARTIAL &&
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 53/244 net: atlantic: Fix NULL dereference of skb pointer in
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniil Maximov <[email protected]>
[ Upstream commit cbe860be36095e68e4e5561ab43610982fb429fd ]
If is_ptp_ring == true in the loop of __aq_ring_xdp_clean function, then a timestamp is stored from a packet in a field of skb object, which is not allocated at the moment of the call (skb == NULL).
Generalize aq_ptp_extract_ts and other affected functions so they don't work with struct sk_buff*, but with struct skb_shared_hwtstamps*.
Found by Linux Verification Center (linuxtesting.org) with SVACE
--- .../net/ethernet/aquantia/atlantic/aq_ptp.c | 10 +++++----- .../net/ethernet/aquantia/atlantic/aq_ptp.h | 4 ++-- .../net/ethernet/aquantia/atlantic/aq_ring.c | 18 ++++++++++++------ 3 files changed, 19 insertions(+), 13 deletions(-)
drivers/net/ethernet/aquantia/atlantic/aq_ptp.c +5 -5
@@ -553,17 +553,17 @@ void aq_ptp_tx_hwtstamp(struct aq_nic_s *aq_nic, u64 timestamp)/* aq_ptp_rx_hwtstamp - utility function which checks for RX time stamp * @adapter: pointer to adapter struct -* @skb: particular skb to send timestamp with +* @shhwtstamps: particular skb_shared_hwtstamps to save timestamp * * if the timestamp is valid, we convert it into the timecounter ns * value, then store that result into the hwtstamps structure which * is passed up the network stack */ -static void aq_ptp_rx_hwtstamp (struct aq_ptp_s *aq_ptp,struct sk_buff *skb, +static void aq_ptp_rx_hwtstamp (struct aq_ptp_s *aq_ptp,struct skb_shared_hwtstamps *shhwtstamps,u64 timestamp) { timestamp -=atomic_read (&aq_ptp->offset_ingress); -aq_ptp_convert_to_hwtstamp (aq_ptp,skb_hwtstamps (skb), timestamp); +aq_ptp_convert_to_hwtstamp (aq_ptp, shhwtstamps, timestamp); } void aq_ptp_hwtstamp_config_get(struct aq_ptp_s *aq_ptp,
@@ -639,7 +639,7 @@ bool aq_ptp_ring(struct aq_nic_s *aq_nic, struct aq_ring_s *ring) &aq_ptp->ptp_rx == ring || &aq_ptp->hwts_rx == ring; } -u16 aq_ptp_extract_ts (struct aq_nic_s *aq_nic,struct sk_buff *skb,u8 *p, +u16 aq_ptp_extract_ts (struct aq_nic_s *aq_nic,struct skb_shared_hwtstamps *shhwtstamps,u8 *p,unsigned int len) {struct aq_ptp_s *aq_ptp = aq_nic->aq_ptp;
@@ -648,7 +648,7 @@ u16 aq_ptp_extract_ts(struct aq_nic_s *aq_nic, struct sk_buff *skb, u8 *p, p, len, ×tamp);if (ret >0 ) -aq_ptp_rx_hwtstamp (aq_ptp, skb, timestamp); +aq_ptp_rx_hwtstamp (aq_ptp, shhwtstamps, timestamp);return ret; }
drivers/net/ethernet/aquantia/atlantic/aq_ptp.h +2 -2
@@ -67,7 +67,7 @@ int aq_ptp_hwtstamp_config_set(struct aq_ptp_s *aq_ptp,/* Return either ring is belong to PTP or not*/ bool aq_ptp_ring (struct aq_nic_s *aq_nic,struct aq_ring_s *ring); -u16 aq_ptp_extract_ts (struct aq_nic_s *aq_nic,struct sk_buff *skb,u8 *p, +u16 aq_ptp_extract_ts (struct aq_nic_s *aq_nic,struct skb_shared_hwtstamps *shhwtstamps,u8 *p,unsigned int len);struct ptp_clock *aq_ptp_get_ptp_clock (struct aq_ptp_s *aq_ptp);
@@ -143,7 +143,7 @@ static inline bool aq_ptp_ring(struct aq_nic_s *aq_nic, struct aq_ring_s *ring) }static inline u16 aq_ptp_extract_ts (struct aq_nic_s *aq_nic, -struct sk_buff *skb,u8 *p, +struct skb_shared_hwtstamps *shhwtstamps,u8 *p,unsigned int len) {return 0 ;
drivers/net/ethernet/aquantia/atlantic/aq_ring.c +12 -6
@@ -647,7 +647,7 @@ static int __aq_ring_rx_clean(struct aq_ring_s *self, struct napi_struct *napi, }if (is_ptp_ring) buff->len -= -aq_ptp_extract_ts (self->aq_nic, skb, +aq_ptp_extract_ts (self->aq_nic,skb_hwtstamps (skb),aq_buf_vaddr (&buff->rxdata), buff->len);
@@ -742,6 +742,8 @@ static int __aq_ring_xdp_clean(struct aq_ring_s *rx_ring,struct aq_ring_buff_s *buff = &rx_ring->buff_ring[rx_ring->sw_head];bool is_ptp_ring =aq_ptp_ring (rx_ring->aq_nic, rx_ring);struct aq_ring_buff_s *buff_ =NULL ; +u16 ptp_hwtstamp_len =0 ; +struct skb_shared_hwtstamps shhwtstamps;struct sk_buff *skb =NULL ;unsigned int next_ =0U ;struct xdp_buff xdp;
@@ -810,11 +812,12 @@ static int __aq_ring_xdp_clean(struct aq_ring_s *rx_ring, hard_start =page_address (buff->rxdata.page) + buff->rxdata.pg_off - rx_ring->page_offset; -if (is_ptp_ring) - buff->len -= -aq_ptp_extract_ts (rx_ring->aq_nic, skb, -aq_buf_vaddr (&buff->rxdata), - buff->len); +if (is_ptp_ring) { + ptp_hwtstamp_len =aq_ptp_extract_ts (rx_ring->aq_nic, &shhwtstamps, +aq_buf_vaddr (&buff->rxdata), + buff->len); + buff->len -= ptp_hwtstamp_len; + }xdp_init_buff (&xdp, frame_sz, &rx_ring->xdp_rxq); xdp_prepare_buff(&xdp, hard_start, rx_ring->page_offset,
@@ -834,6 +837,9 @@ static int __aq_ring_xdp_clean(struct aq_ring_s *rx_ring,if (IS_ERR (skb) || !skb)continue ; +if (ptp_hwtstamp_len >0 ) + *skb_hwtstamps (skb) = shhwtstamps; +if (buff->is_vlan)__vlan_hwaccel_put_tag (skb,htons (ETH_P_8021Q ), buff->vlan_rx_tag);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 54/244 net: hns: fix wrong head when modify the tx feature when sending packets
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yonglong Liu <[email protected]>
[ Upstream commit 84757d0839451b20b11e993128f0a77393ca50c1 ]
Upon changing the tx feature, the hns driver will modify the maybe_stop_tx() and fill_desc() functions, if the modify happens during packet sending, will cause the hardware and software pointers do not match, and the port can not work anymore.
This patch deletes the maybe_stop_tx() and fill_desc() functions modification when setting tx feature, and use the skb_is_gro() to determine which functions to use in the tx path.
--- drivers/net/ethernet/hisilicon/hns/hns_enet.c | 53 +++++++++++-------- drivers/net/ethernet/hisilicon/hns/hns_enet.h | 3 +- 2 files changed, 33 insertions(+), 23 deletions(-)
drivers/net/ethernet/hisilicon/hns/hns_enet.c +31 -22
@@ -142,7 +142,8 @@ MODULE_DEVICE_TABLE(acpi, hns_enet_acpi_match);static void fill_desc (struct hnae_ring *ring,void *priv,int size,dma_addr_t dma,int frag_end, -int buf_num,enum hns_desc_type type,int mtu) +int buf_num,enum hns_desc_type type,int mtu, +bool is_gso) {struct hnae_desc *desc = &ring->desc[ring->next_to_use];struct hnae_desc_cb *desc_cb = &ring->desc_cb[ring->next_to_use];
@@ -275,6 +276,15 @@ static int hns_nic_maybe_stop_tso(return 0 ; } +static int hns_nic_maybe_stop_tx_v2 (struct sk_buff **out_skb,int *bnum, +struct hnae_ring *ring) +{ +if (skb_is_gso (*out_skb)) +return hns_nic_maybe_stop_tso (out_skb, bnum, ring); +else +return hns_nic_maybe_stop_tx (out_skb, bnum, ring); +} +static void fill_tso_desc (struct hnae_ring *ring,void *priv,int size,dma_addr_t dma,int frag_end,int buf_num,enum hns_desc_type type,int mtu)
@@ -300,6 +310,19 @@ static void fill_tso_desc(struct hnae_ring *ring, void *priv, mtu); } +static void fill_desc_v2 (struct hnae_ring *ring,void *priv, +int size,dma_addr_t dma,int frag_end, +int buf_num,enum hns_desc_type type,int mtu, +bool is_gso) +{ +if (is_gso) +fill_tso_desc (ring, priv, size, dma, frag_end, buf_num, type, + mtu); +else +fill_v2_desc (ring, priv, size, dma, frag_end, buf_num, type, + mtu); +} +netdev_tx_t hns_nic_net_xmit_hw (struct net_device *ndev,struct sk_buff *skb,struct hns_nic_ring_data *ring_data)
@@ -313,6 +336,7 @@ netdev_tx_t hns_nic_net_xmit_hw(struct net_device *ndev,int seg_num;dma_addr_t dma;int size, next_to_use; +bool is_gso;int i;switch (priv->ops.maybe_stop_tx (&skb, &buf_num, ring)) {
@@ -339,8 +363,9 @@ netdev_tx_t hns_nic_net_xmit_hw(struct net_device *ndev, ring->stats.sw_err_cnt++; goto out_err_tx_ok; } + is_gso =skb_is_gso (skb); priv->ops.fill_desc (ring, skb, size, dma, seg_num ==1 ?1 :0 , - buf_num,DESC_TYPE_SKB , ndev->mtu); + buf_num,DESC_TYPE_SKB , ndev->mtu, is_gso);/* fill the fragments */ for (i =1 ; i < seg_num; i++) {
@@ -354,7 +379,7 @@ netdev_tx_t hns_nic_net_xmit_hw(struct net_device *ndev, } priv->ops.fill_desc (ring,skb_frag_page (frag), size, dma, seg_num -1 == i ?1 :0 , buf_num, -DESC_TYPE_PAGE , ndev->mtu); +DESC_TYPE_PAGE , ndev->mtu, is_gso); }/*complete translate all packets*/
@@ -1776,15 +1801,6 @@ static int hns_nic_set_features(struct net_device *netdev,netdev_info (netdev,"enet v1 do not support tso!\n" );break ;default : -if (features & (NETIF_F_TSO |NETIF_F_TSO6 )) { - priv->ops.fill_desc = fill_tso_desc; - priv->ops.maybe_stop_tx = hns_nic_maybe_stop_tso; -/* The chip only support 7*4096 */ -netif_set_tso_max_size (netdev,7 *4096 ); - }else { - priv->ops.fill_desc = fill_v2_desc; - priv->ops.maybe_stop_tx = hns_nic_maybe_stop_tx; - }break ; } netdev->features = features;
@@ -2159,16 +2175,9 @@ static void hns_nic_set_priv_ops(struct net_device *netdev) priv->ops.maybe_stop_tx = hns_nic_maybe_stop_tx; }else { priv->ops.get_rxd_bnum = get_v2rx_desc_bnum; -if ((netdev->features &NETIF_F_TSO ) || - (netdev->features &NETIF_F_TSO6 )) { - priv->ops.fill_desc = fill_tso_desc; - priv->ops.maybe_stop_tx = hns_nic_maybe_stop_tso; -/* This chip only support 7*4096 */ -netif_set_tso_max_size (netdev,7 *4096 ); - }else { - priv->ops.fill_desc = fill_v2_desc; - priv->ops.maybe_stop_tx = hns_nic_maybe_stop_tx; - } + priv->ops.fill_desc = fill_desc_v2; + priv->ops.maybe_stop_tx = hns_nic_maybe_stop_tx_v2; +netif_set_tso_max_size (netdev,7 *4096 );/* enable tso when init * control tso on/off through TSE bit in bd */
drivers/net/ethernet/hisilicon/hns/hns_enet.h +2 -1
@@ -44,7 +44,8 @@ struct hns_nic_ring_data {struct hns_nic_ops {void (*fill_desc)(struct hnae_ring *ring,void *priv,int size,dma_addr_t dma,int frag_end, -int buf_num,enum hns_desc_type type,int mtu); +int buf_num,enum hns_desc_type type,int mtu, +bool is_gso);int (*maybe_stop_tx)(struct sk_buff **out_skb,int *bnum,struct hnae_ring *ring);void (*get_rxd_bnum)(u32 bnum_flag,int *out_bnum);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 55/244 net: hns: fix fake link up on xge port
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yonglong Liu <[email protected]>
[ Upstream commit f708aba40f9c1eeb9c7e93ed4863b5f85b09b288 ]
If a xge port just connect with an optical module and no fiber, it may have a fake link up because there may be interference on the hardware. This patch adds an anti-shake to avoid the problem. And the time of anti-shake is base on tests.
--- .../net/ethernet/hisilicon/hns/hns_dsaf_mac.c | 29 +++++++++++++++++++ 1 file changed, 29 insertions(+)
drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c +29 -0
@@ -66,6 +66,27 @@ static enum mac_mode hns_get_enet_interface(const struct hns_mac_cb *mac_cb) } } +static u32 hns_mac_link_anti_shake (struct mac_driver *mac_ctrl_drv) +{ +#define HNS_MAC_LINK_WAIT_TIME 5 +#define HNS_MAC_LINK_WAIT_CNT 40 + +u32 link_status =0 ; +int i; + +if (!mac_ctrl_drv->get_link_status) +return link_status; + +for (i =0 ; i <HNS_MAC_LINK_WAIT_CNT ; i++) { +msleep (HNS_MAC_LINK_WAIT_TIME ); + mac_ctrl_drv->get_link_status (mac_ctrl_drv, &link_status); +if (!link_status) +break ; + } + +return link_status; +} +void hns_mac_get_link_status (struct hns_mac_cb *mac_cb,u32 *link_status) {struct mac_driver *mac_ctrl_drv;
@@ -83,6 +104,14 @@ void hns_mac_get_link_status(struct hns_mac_cb *mac_cb, u32 *link_status) &sfp_prsnt);if (!ret) *link_status = *link_status && sfp_prsnt; + +/* for FIBER port, it may have a fake link up. +* when the link status changes from down to up, we need to do +* anti-shake. the anti-shake time is base on tests. +* only FIBER port need to do this. +*/ +if (*link_status && !mac_cb->link) + *link_status =hns_mac_link_anti_shake (mac_ctrl_drv); } mac_cb->link = *link_status;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 56/244 octeontx2-af: Adjust Tx credits when MCS external bypass is disabled
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nithin Dabilpuram <[email protected]>
[ Upstream commit dca6fa8644b89f54345e55501b1419316ba5cb29 ]
When MCS external bypass is disabled, MCS returns additional 2 credits(32B) for every packet Tx'ed on LMAC. To account for these extra credits, NIX_AF_TX_LINKX_NORM_CREDIT.CC_MCS_CNT needs to be configured as otherwise NIX Tx credits would overflow and will never be returned to idle state credit count causing issues with credit control and MTU change.
This patch fixes the same by configuring CC_MCS_CNT at probe time for MCS enabled SoC's
--- drivers/net/ethernet/marvell/octeontx2/af/mcs.c | 14 +++++++++++++- drivers/net/ethernet/marvell/octeontx2/af/mcs.h | 2 ++ drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 1 + .../net/ethernet/marvell/octeontx2/af/rvu_nix.c | 8 ++++++++ .../net/ethernet/marvell/octeontx2/af/rvu_reg.h | 1 + 5 files changed, 25 insertions(+), 1 deletion(-)
drivers/net/ethernet/marvell/octeontx2/af/mcs.c +13 -1
@@ -1219,6 +1219,17 @@ struct mcs *mcs_get_pdata(int mcs_id)return NULL ; } +bool is_mcs_bypass (int mcs_id) +{ +struct mcs *mcs_dev; + +list_for_each_entry (mcs_dev, &mcs_list, mcs_list) { +if (mcs_dev->mcs_id == mcs_id) +return mcs_dev->bypass; + } +return true; +} +void mcs_set_port_cfg (struct mcs *mcs,struct mcs_port_cfg_set_req *req) {u64 val =0 ;
@@ -1436,7 +1447,7 @@ static int mcs_x2p_calibration(struct mcs *mcs)return err; } -static void mcs_set_external_bypass (struct mcs *mcs,u8 bypass) +static void mcs_set_external_bypass (struct mcs *mcs,bool bypass) {u64 val;
@@ -1447,6 +1458,7 @@ static void mcs_set_external_bypass(struct mcs *mcs, u8 bypass)else val &= ~BIT_ULL (6 );mcs_reg_write (mcs,MCSX_MIL_GLOBAL , val); + mcs->bypass = bypass; }static void mcs_global_cfg (struct mcs *mcs)
drivers/net/ethernet/marvell/octeontx2/af/mcs.h +2 -0
@@ -149,6 +149,7 @@ struct mcs {u16 num_vec;void *rvu;u16 *tx_sa_active; +bool bypass; };struct mcs_ops {
@@ -206,6 +207,7 @@ void mcs_get_custom_tag_cfg(struct mcs *mcs, struct mcs_custom_tag_cfg_get_req *int mcs_alloc_ctrlpktrule (struct rsrc_bmap *rsrc,u16 *pf_map,u16 offset,u16 pcifunc);int mcs_free_ctrlpktrule (struct mcs *mcs,struct mcs_free_ctrl_pkt_rule_req *req);int mcs_ctrlpktrule_write (struct mcs *mcs,struct mcs_ctrl_pkt_rule_write_req *req); +bool is_mcs_bypass (int mcs_id);/* CN10K-B APIs */ void cn10kb_mcs_set_hw_capabilities (struct mcs *mcs);
drivers/net/ethernet/marvell/octeontx2/af/rvu.h +1 -0
@@ -345,6 +345,7 @@ struct nix_hw {struct nix_txvlan txvlan;struct nix_ipolicer *ipolicer;u64 *tx_credits; +u8 cc_mcs_cnt; };/* RVU block's capabilities or functionality,
drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +8 -0
@@ -12,6 +12,7 @@#include "rvu_reg.h" #include "rvu.h" #include "npc.h" +#include "mcs.h" #include "cgx.h" #include "lmac_common.h" #include "rvu_npc_hash.h"
@@ -4389,6 +4390,12 @@ static void nix_link_config(struct rvu *rvu, int blkaddr, SDP_HW_MAX_FRS << 16 | NIC_HW_MIN_FRS); } +/* Get MCS external bypass status for CN10K-B */ +if (mcs_get_blkcnt () ==1 ) { +/* Adjust for 2 credits when external bypass is disabled */ + nix_hw->cc_mcs_cnt =is_mcs_bypass (0 ) ?0 :2 ; + } +/* Set credits for Tx links assuming max packet length allowed. * This will be reconfigured based on MTU set for PF/VF. */
@@ -4412,6 +4419,7 @@ static void nix_link_config(struct rvu *rvu, int blkaddr, tx_credits = (lmac_fifo_len - lmac_max_frs) /16 ;/* Enable credits and set credit pkt count to max allowed */ cfg = (tx_credits <<12 ) | (0x1FF <<2 ) |BIT_ULL (1 ); + cfg |=FIELD_PREP (NIX_AF_LINKX_MCS_CNT_MASK , nix_hw->cc_mcs_cnt); link = iter + slink; nix_hw->tx_credits[link] = tx_credits;
drivers/net/ethernet/marvell/octeontx2/af/rvu_reg.h +1 -0
@@ -437,6 +437,7 @@#define NIX_AF_LINKX_BASE_MASK GENMASK_ULL(11, 0)#define NIX_AF_LINKX_RANGE_MASK GENMASK_ULL(19, 16) +#define NIX_AF_LINKX_MCS_CNT_MASK GENMASK_ULL(33, 32)/* SSO */ #define SSO_AF_CONST (0x1000)
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 57/244 octeontx2-af: Fix mcs sa cam entries size
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geetha sowjanya <[email protected]>
[ Upstream commit 9723b2cca1f0e980c53156b52ea73b93966b3c8a ]
On latest silicon versions SA cam entries increased to 256. This patch fixes the datatype of sa_entries in mcs_hw_info struct to u16 to hold 256 entries.
--- drivers/net/ethernet/marvell/octeontx2/af/mbox.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/marvell/octeontx2/af/mbox.h +1 -1
@@ -1938,7 +1938,7 @@ struct mcs_hw_info {u8 tcam_entries;/* RX/TX Tcam entries per mcs block */ u8 secy_entries;/* RX/TX SECY entries per mcs block */ u8 sc_entries;/* RX/TX SC CAM entries per mcs block */ -u8 sa_entries;/* PN table entries = SA entries */ +u16 sa_entries;/* PN table entries = SA entries */ u64 rsvd[16 ]; };
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 58/244 octeontx2-af: Fix mcs stats register address
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geetha sowjanya <[email protected]>
[ Upstream commit 3ba98a8c6f8ceb4e01a78f973d8d9017020bbd57 ]
This patch adds the miss mcs stats register
for mcs supported platforms.
--- .../net/ethernet/marvell/octeontx2/af/mcs.c | 4 +-- .../ethernet/marvell/octeontx2/af/mcs_reg.h | 31 ++++++++++++++++--- 2 files changed, 29 insertions(+), 6 deletions(-)
drivers/net/ethernet/marvell/octeontx2/af/mcs.c +2 -2
@@ -117,7 +117,7 @@ void mcs_get_rx_secy_stats(struct mcs *mcs, struct mcs_secy_stats *stats, int id reg =MCSX_CSE_RX_MEM_SLAVE_INPKTSSECYTAGGEDCTLX (id); stats->pkt_tagged_ctl_cnt =mcs_reg_read (mcs, reg); - reg =MCSX_CSE_RX_MEM_SLAVE_INPKTSSECYUNTAGGEDORNOTAGX (id); + reg =MCSX_CSE_RX_MEM_SLAVE_INPKTSSECYUNTAGGEDX (id); stats->pkt_untaged_cnt =mcs_reg_read (mcs, reg); reg =MCSX_CSE_RX_MEM_SLAVE_INPKTSSECYCTLX (id);
@@ -215,7 +215,7 @@ void mcs_get_sc_stats(struct mcs *mcs, struct mcs_sc_stats *stats, reg =MCSX_CSE_RX_MEM_SLAVE_INPKTSSCNOTVALIDX (id); stats->pkt_notvalid_cnt =mcs_reg_read (mcs, reg); - reg =MCSX_CSE_RX_MEM_SLAVE_INPKTSSCUNCHECKEDOROKX (id); + reg =MCSX_CSE_RX_MEM_SLAVE_INPKTSSCUNCHECKEDX (id); stats->pkt_unchecked_cnt =mcs_reg_read (mcs, reg);if (mcs->hw->mcs_blks >1 ) {
drivers/net/ethernet/marvell/octeontx2/af/mcs_reg.h +27 -4
@@ -810,14 +810,37 @@ offset =0x9d8ull ; \ offset; }) +#define MCSX_CSE_RX_MEM_SLAVE_INPKTSSCUNCHECKEDX (a) ({ \ + u64 offset; \ + \ + offset = 0xee80ull; \ + if (mcs->hw->mcs_blks > 1) \ + offset = 0xe818ull; \ + offset += (a) * 0x8ull; \ + offset; }) + +#define MCSX_CSE_RX_MEM_SLAVE_INPKTSSECYUNTAGGEDX (a) ({ \ + u64 offset; \ + \ + offset = 0xa680ull; \ + if (mcs->hw->mcs_blks > 1) \ + offset = 0xd018ull; \ + offset += (a) * 0x8ull; \ + offset; }) + +#define MCSX_CSE_RX_MEM_SLAVE_INPKTSSCLATEORDELAYEDX (a) ({ \ + u64 offset; \ + \ + offset = 0xf680ull; \ + if (mcs->hw->mcs_blks > 1) \ + offset = 0xe018ull; \ + offset += (a) * 0x8ull; \ + offset; }) +#define MCSX_CSE_RX_MEM_SLAVE_INOCTETSSCDECRYPTEDX (a) (0xe680ull + (a) * 0x8ull)#define MCSX_CSE_RX_MEM_SLAVE_INOCTETSSCVALIDATEX (a) (0xde80ull + (a) * 0x8ull) -#define MCSX_CSE_RX_MEM_SLAVE_INPKTSSECYUNTAGGEDORNOTAGX (a) (0xa680ull + (a) * 0x8ull)#define MCSX_CSE_RX_MEM_SLAVE_INPKTSSECYNOTAGX (a) (0xd218 + (a) * 0x8ull) -#define MCSX_CSE_RX_MEM_SLAVE_INPKTSSECYUNTAGGEDX (a) (0xd018ull + (a) * 0x8ull) -#define MCSX_CSE_RX_MEM_SLAVE_INPKTSSCUNCHECKEDOROKX (a) (0xee80ull + (a) * 0x8ull)#define MCSX_CSE_RX_MEM_SLAVE_INPKTSSECYCTLX (a) (0xb680ull + (a) * 0x8ull) -#define MCSX_CSE_RX_MEM_SLAVE_INPKTSSCLATEORDELAYEDX (a) (0xf680ull + (a) * 0x8ull)#define MCSX_CSE_RX_MEM_SLAVE_INPKTSSAINVALIDX (a) (0x12680ull + (a) * 0x8ull)#define MCSX_CSE_RX_MEM_SLAVE_INPKTSSANOTUSINGSAERRORX (a) (0x15680ull + (a) * 0x8ull)#define MCSX_CSE_RX_MEM_SLAVE_INPKTSSANOTVALIDX (a) (0x13680ull + (a) * 0x8ull)
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 59/244 octeontx2-af: Add missing mcs flr handler call
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geetha sowjanya <[email protected]>
[ Upstream commit d431abd0a9aa27be379fb5f8304062071b0f5a7e ]
If mcs resources are attached to PF/VF. These resources need to be freed on FLR. This patch add missing mcs flr call on PF FLR.
--- drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/marvell/octeontx2/af/rvu.c +3 -0
@@ -2631,6 +2631,9 @@ static void __rvu_flr_handler(struct rvu *rvu, u16 pcifunc)rvu_npc_free_mcam_entries (rvu, pcifunc,-1 );rvu_mac_reset (rvu, pcifunc); +if (rvu->mcs_blk_cnt) +rvu_mcs_flr_handler (rvu, pcifunc); +mutex_unlock (&rvu->flr_lock); }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 60/244 octeontx2-af: Update Tx link register range
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rahul Bhansali <[email protected]>
[ Upstream commit 7336fc196748f82646b630d5a2e9d283e200b988 ]
On new silicons the TX channels for transmit level has increased. This patch fixes the respective register offset range to configure the newly added channels.
--- drivers/net/ethernet/marvell/octeontx2/af/rvu_reg.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/marvell/octeontx2/af/rvu_reg.c +2 -2
@@ -31,8 +31,8 @@ static struct hw_reg_map txsch_reg_map[NIX_TXSCH_LVL_CNT] = { {NIX_TXSCH_LVL_TL4, 3, 0xFFFF, {{0x0B00, 0x0B08}, {0x0B10, 0x0B18}, {0x1200, 0x12E0} } }, {NIX_TXSCH_LVL_TL3, 4, 0xFFFF, {{0x1000, 0x10E0}, {0x1600, 0x1608}, - {0x1610, 0x1618}, {0x1700, 0x17B0} } }, - {NIX_TXSCH_LVL_TL2, 2, 0xFFFF, {{0x0E00, 0x0EE0}, {0x1700, 0x17B0} } }, + {0x1610, 0x1618}, {0x1700, 0x17C8} } }, + {NIX_TXSCH_LVL_TL2, 2, 0xFFFF, {{0x0E00, 0x0EE0}, {0x1700, 0x17C8} } }, {NIX_TXSCH_LVL_TL1, 1, 0xFFFF, {{0x0C00, 0x0D98} } }, };
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 61/244 dt-bindings: interrupt-controller: Allow #power-domain-cells
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit c0a2755aced969e0125fd68ccd95269b28d8913a ]
MPM provides a single genpd. Allow #power-domain-cells = <0>.
--- .../devicetree/bindings/interrupt-controller/qcom,mpm.yaml | 4 ++++ 1 file changed, 4 insertions(+)
Documentation/devicetree/bindings/interrupt-controller/qcom,mpm.yaml +4 -0
@@ -62,6 +62,9 @@ properties: - description: MPM pin number - description: GIC SPI number for the MPM pin + '#power-domain-cells': + const: 0 + required: - compatible - reg
@@ -93,4 +96,5 @@ examples: <86 183>, <90 260>, <91 260>; + #power-domain-cells = <0>; };
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 62/244 netfilter: bpf: fix bad registration on nf_defrag
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: D. Wythe <[email protected]>
[ Upstream commit 1834d62ae88500f37cba4439c3237aa85242272e ]
We should pass a pointer to global_hook to the get_proto_defrag_hook() instead of its value, since the passed value won't be updated even if the request module was loaded successfully.
Log:
[ 54.915713] nf_defrag_ipv4 has bad registration [ 54.915779] WARNING: CPU: 3 PID: 6323 at net/netfilter/nf_bpf_link.c:62 get_proto_defrag_hook+0x137/0x160 [ 54.915835] CPU: 3 PID: 6323 Comm: fentry Kdump: loaded Tainted: G E 6.7.0-rc2+ #35 [ 54.915839] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 [ 54.915841] RIP: 0010:get_proto_defrag_hook+0x137/0x160 [ 54.915844] Code: 4f 8c e8 2c cf 68 ff 80 3d db 83 9a 01 00 0f 85 74 ff ff ff 48 89 ee 48 c7 c7 8f 12 4f 8c c6 05 c4 83 9a 01 01 e8 09 ee 5f ff <0f> 0b e9 57 ff ff ff 49 8b 3c 24 4c 63 e5 e8 36 28 6c ff 4c 89 e0 [ 54.915849] RSP: 0018:ffffb676003fbdb0 EFLAGS: 00010286 [ 54.915852] RAX: 0000000000000023 RBX: ffff9596503d5600 RCX: ffff95996fce08c8 [ 54.915854] RDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ffff95996fce08c0 [ 54.915855] RBP: ffffffff8c4f12de R08: 0000000000000000 R09: 00000000fffeffff [ 54.915859] R10: ffffb676003fbc70 R11: ffffffff8d363ae8 R12: 0000000000000000 [ 54.915861] R13: ffffffff8e1f75c0 R14: ffffb676003c9000 R15: 00007ffd15e78ef0 [ 54.915864] FS: 00007fb6e9cab740(0000) GS:ffff95996fcc0000(0000) knlGS:0000000000000000 [ 54.915867] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 54.915868] CR2: 00007ffd15e75c40 CR3: 0000000101e62006 CR4: 0000000000360ef0 [ 54.915870] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 54.915871] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 54.915873] Call Trace: [ 54.915891] <TASK> [ 54.915894] ? __warn+0x84/0x140 [ 54.915905] ? get_proto_defrag_hook+0x137/0x160 [ 54.915908] ? __report_bug+0xea/0x100 [ 54.915925] ? report_bug+0x2b/0x80 [ 54.915928] ? handle_bug+0x3c/0x70 [ 54.915939] ? exc_invalid_op+0x18/0x70 [ 54.915942] ? asm_exc_invalid_op+0x1a/0x20 [ 54.915948] ? get_proto_defrag_hook+0x137/0x160 [ 54.915950] bpf_nf_link_attach+0x1eb/0x240 [ 54.915953] link_create+0x173/0x290 [ 54.915969] __sys_bpf+0x588/0x8f0 [ 54.915974] __x64_sys_bpf+0x20/0x30 [ 54.915977] do_syscall_64+0x45/0xf0 [ 54.915989] entry_SYSCALL_64_after_hwframe+0x6e/0x76 [ 54.915998] RIP: 0033:0x7fb6e9daa51d [ 54.916001] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 2b 89 0c 00 f7 d8 64 89 01 48 [ 54.916003] RSP: 002b:00007ffd15e78ed8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 54.916006] RAX: ffffffffffffffda RBX: 00007ffd15e78fc0 RCX: 00007fb6e9daa51d [ 54.916007] RDX: 0000000000000040 RSI: 00007ffd15e78ef0 RDI: 000000000000001c [ 54.916009] RBP: 000000000000002d R08: 00007fb6e9e73a60 R09: 0000000000000001 [ 54.916010] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 54.916012] R13: 0000000000000006 R14: 0000000000000000 R15: 0000000000000000 [ 54.916014] </TASK> [ 54.916015] ---[ end trace 0000000000000000 ]---
--- net/netfilter/nf_bpf_link.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
net/netfilter/nf_bpf_link.c +5 -5
@@ -31,7 +31,7 @@ struct bpf_nf_link {#if IS_ENABLED (CONFIG_NF_DEFRAG_IPV4 ) ||IS_ENABLED (CONFIG_NF_DEFRAG_IPV6 )static const struct nf_defrag_hook *get_proto_defrag_hook (struct bpf_nf_link *link, -const struct nf_defrag_hook __rcu *global_hook, +const struct nf_defrag_hook __rcu **ptr_global_hook,const char *mod) {const struct nf_defrag_hook *hook;
@@ -39,7 +39,7 @@ get_proto_defrag_hook(struct bpf_nf_link *link,/* RCU protects us from races against module unloading */ rcu_read_lock (); - hook =rcu_dereference (global_hook); + hook =rcu_dereference (*ptr_global_hook);if (!hook) {rcu_read_unlock (); err =request_module (mod);
@@ -47,7 +47,7 @@ get_proto_defrag_hook(struct bpf_nf_link *link,return ERR_PTR (err <0 ? err : -EINVAL );rcu_read_lock (); - hook =rcu_dereference (global_hook); + hook =rcu_dereference (*ptr_global_hook); }if (hook &&try_module_get (hook->owner)) {
@@ -78,7 +78,7 @@ static int bpf_nf_enable_defrag(struct bpf_nf_link *link)switch (link->hook_ops.pf) {#if IS_ENABLED (CONFIG_NF_DEFRAG_IPV4 )case NFPROTO_IPV4 : - hook =get_proto_defrag_hook (link, nf_defrag_v4_hook,"nf_defrag_ipv4" ); + hook =get_proto_defrag_hook (link, &nf_defrag_v4_hook,"nf_defrag_ipv4" );if (IS_ERR (hook))return PTR_ERR (hook);
@@ -87,7 +87,7 @@ static int bpf_nf_enable_defrag(struct bpf_nf_link *link)#endif #if IS_ENABLED (CONFIG_NF_DEFRAG_IPV6 )case NFPROTO_IPV6 : - hook =get_proto_defrag_hook (link, nf_defrag_v6_hook,"nf_defrag_ipv6" ); + hook =get_proto_defrag_hook (link, &nf_defrag_v6_hook,"nf_defrag_ipv6" );if (IS_ERR (hook))return PTR_ERR (hook);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 63/244 netfilter: nf_tables: fix exist matching on bigendian arches
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 63331e37fb227e796894b31d713697612c8dee7f ]
Maze reports "tcp option fastopen exists" fails to match on OpenWrt 22.03.5, r20134-5f15225c1e (5.10.176) router.
"tcp option fastopen exists" translates to:
inet
[ exthdr load tcpopt 1b @ 34 + 0 present => reg 1 ] [ cmp eq reg 1 0x00000001 ]
.. but existing nft userspace generates a 1-byte compare.
On LSB (x86), "*reg32 = 1" is identical to nft_reg_store8(reg32, 1), but not on MSB, which will place the 1 last. IOW, on bigendian aches the cmp8 is awalys false.
Make sure we store this in a consistent fashion, so existing userspace will also work on MSB (bigendian).
Regardless of this patch we can also change nft userspace to generate 'reg32 == 0' and 'reg32 != 0' instead of u8 == 0 // u8 == 1 when adding 'option x missing/exists' expressions as well.
--- net/netfilter/nft_exthdr.c | 4 ++-- net/netfilter/nft_fib.c | 8 ++++++-- 2 files changed, 8 insertions(+), 4 deletions(-)
net/netfilter/nft_exthdr.c +2 -2
@@ -214,7 +214,7 @@ static void nft_exthdr_tcp_eval(const struct nft_expr *expr, offset = i + priv->offset;if (priv->flags &NFT_EXTHDR_F_PRESENT ) { - *dest =1 ; +nft_reg_store8 (dest,1 ); }else {if (priv->len %NFT_REG32_SIZE ) dest[priv->len /NFT_REG32_SIZE ] =0 ;
@@ -461,7 +461,7 @@ static void nft_exthdr_dccp_eval(const struct nft_expr *expr, type = bufp[0 ];if (type == priv->type) { - *dest =1 ; +nft_reg_store8 (dest,1 );return ; }
net/netfilter/nft_fib.c +6 -2
@@ -145,11 +145,15 @@ void nft_fib_store_result(void *reg, const struct nft_fib *priv,switch (priv->result) {case NFT_FIB_RESULT_OIF : index = dev ? dev->ifindex :0 ; - *dreg = (priv->flags &NFTA_FIB_F_PRESENT ) ? !!index : index; +if (priv->flags &NFTA_FIB_F_PRESENT ) +nft_reg_store8 (dreg, !!index); +else + *dreg = index; +break ;case NFT_FIB_RESULT_OIFNAME :if (priv->flags &NFTA_FIB_F_PRESENT ) - *dreg = !!dev; +nft_reg_store8 (dreg, !!dev);else strscpy_pad (reg, dev ? dev->name :"" ,IFNAMSIZ );break ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 64/244 netfilter: nf_tables: bail out on mismatching dynset and set expressions
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 3701cd390fd731ee7ae8b8006246c8db82c72bea ]
If dynset expressions provided by userspace is larger than the declared set expressions, then bail out.
--- net/netfilter/nft_dynset.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
net/netfilter/nft_dynset.c +9 -4
@@ -279,10 +279,15 @@ static int nft_dynset_init(const struct nft_ctx *ctx, priv->expr_array[i] = dynset_expr; priv->num_exprs++; -if (set->num_exprs && - dynset_expr->ops != set->exprs[i]->ops) { - err = -EOPNOTSUPP ; - goto err_expr_free; +if (set->num_exprs) { +if (i >= set->num_exprs) { + err = -EINVAL ; + goto err_expr_free; + } +if (dynset_expr->ops != set->exprs[i]->ops) { + err = -EOPNOTSUPP ; + goto err_expr_free; + } } i++; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 65/244 netfilter: nf_tables: validate family when identifying table via handle
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit f6e1532a2697b81da00bfb184e99d15e01e9d98c ]
Validate table family when looking up for it via NFTA_TABLE_HANDLE.
--- net/netfilter/nf_tables_api.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
net/netfilter/nf_tables_api.c +3 -2
@@ -805,7 +805,7 @@ static struct nft_table *nft_table_lookup(const struct net *net,static struct nft_table *nft_table_lookup_byhandle (const struct net *net,const struct nlattr *nla, -u8 genmask,u32 nlpid) +int family,u8 genmask,u32 nlpid) {struct nftables_pernet *nft_net;struct nft_table *table;
@@ -813,6 +813,7 @@ static struct nft_table *nft_table_lookup_byhandle(const struct net *net, nft_net =nft_pernet (net);list_for_each_entry (table, &nft_net->tables, list) {if (be64_to_cpu (nla_get_be64 (nla)) == table->handle && + table->family == family &&nft_active_genmask (table, genmask)) {if (nft_table_has_owner (table) && nlpid && table->nlpid != nlpid)
@@ -1546,7 +1547,7 @@ static int nf_tables_deltable(struct sk_buff *skb, const struct nfnl_info *info,if (nla[NFTA_TABLE_HANDLE ]) { attr = nla[NFTA_TABLE_HANDLE ]; - table =nft_table_lookup_byhandle (net, attr, genmask, + table =nft_table_lookup_byhandle (net, attr, family, genmask,NETLINK_CB (skb).portid); }else { attr = nla[NFTA_TABLE_NAME ];
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 66/244 netfilter: xt_owner: Fix for unsafe access of sk->sk_socket
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phil Sutter <[email protected]>
[ Upstream commit 7ae836a3d630e146b732fe8ef7d86b243748751f ]
A concurrently running sock_orphan() may NULL the sk_socket pointer in between check and deref. Follow other users (like nft_meta.c for instance) and acquire sk_callback_lock before dereferencing sk_socket.
--- net/netfilter/xt_owner.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
net/netfilter/xt_owner.c +12 -4
@@ -76,18 +76,23 @@ owner_mt(const struct sk_buff *skb, struct xt_action_param *par)*/ return false; - filp = sk->sk_socket->file; -if (filp ==NULL ) +read_lock_bh (&sk->sk_callback_lock); + filp = sk->sk_socket ? sk->sk_socket->file :NULL ; +if (filp ==NULL ) { +read_unlock_bh (&sk->sk_callback_lock);return ((info->match ^ info->invert) & (XT_OWNER_UID |XT_OWNER_GID )) ==0 ; + }if (info->match &XT_OWNER_UID ) {kuid_t uid_min =make_kuid (net->user_ns, info->uid_min);kuid_t uid_max =make_kuid (net->user_ns, info->uid_max);if ((uid_gte (filp->f_cred->fsuid, uid_min) &&uid_lte (filp->f_cred->fsuid, uid_max)) ^ - !(info->invert &XT_OWNER_UID )) + !(info->invert &XT_OWNER_UID )) { +read_unlock_bh (&sk->sk_callback_lock);return false; + } }if (info->match &XT_OWNER_GID ) {
@@ -112,10 +117,13 @@ owner_mt(const struct sk_buff *skb, struct xt_action_param *par) } } -if (match ^ !(info->invert &XT_OWNER_GID )) +if (match ^ !(info->invert &XT_OWNER_GID )) { +read_unlock_bh (&sk->sk_callback_lock);return false; + } } +read_unlock_bh (&sk->sk_callback_lock);return true; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 67/244 tcp: do not accept ACK of bytes we never sent
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 3d501dd326fb1c73f1b8206d4c6e1d7b15c07e27 ]
This patch is based on a detailed report and ideas from Yepeng Pan and Christian Rossow.
ACK seq validation is currently following RFC 5961 5.2 guidelines:
The ACK value is considered acceptable only if
it is in the range of ((SND.UNA - MAX.SND.WND) <= SEG.ACK <= SND.NXT). All incoming segments whose ACK value doesn't satisfy the above condition MUST be discarded and an ACK sent back. It needs to be noted that RFC 793 on page 72 (fifth check) says: "If the ACK is a duplicate (SEG.ACK < SND.UNA), it can be ignored. If the ACK acknowledges something not yet sent (SEG.ACK > SND.NXT) then send an ACK, drop the segment, and return". The "ignored" above implies that the processing of the incoming data segment continues, which means the ACK value is treated as acceptable. This mitigation makes the ACK check more stringent since any ACK < SND.UNA wouldn't be accepted, instead only ACKs that are in the range ((SND.UNA - MAX.SND.WND) <= SEG.ACK <= SND.NXT) get through.
This can be refined for new (and possibly spoofed) flows, by not accepting ACK for bytes that were never sent.
This greatly improves TCP security at a little cost.
I added a Fixes: tag to make sure this patch will reach stable trees, even if the 'blamed' patch was adhering to the RFC.
tp->bytes_acked was added in linux-4.2
Following packetdrill test (courtesy of Yepeng Pan) shows the issue at hand:
0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3 +0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0 +0 bind(3, ..., ...) = 0
+0 listen(3, 1024) = 0
// ---------------- Handshake ------------------- //
// when window scale is set to 14 the window size can be extended to // 65535 * (2^14) = 1073725440. Linux would accept an ACK packet // with ack number in (Server_ISN+1-1073725440. Server_ISN+1) // ,though this ack number acknowledges some data never // sent by the server.
+0 < S 0:0(0) win 65535 <mss 1400,nop,wscale 14>
+0 > S. 0:0(0) ack 1 <...>
+0 < . 1:1(0) ack 1 win 65535
+0 accept(3, ..., ...) = 4
// For the established connection, we send an ACK packet, // the ack packet uses ack number 1 - 1073725300 + 2^32, // where 2^32 is used to wrap around.
// Note: we used 1073725300 instead of 1073725440 to avoid possible // edge cases.
// 1 - 1073725300 + 2^32 = 3221241997
// Oops, old kernels happily accept this packet.
+0 < . 1:1001(1000) ack 3221241997 win 65535
// After the kernel fix the following will be replaced by a challenge ACK, // and prior malicious frame would be dropped.
+0 > . 1:1(0) ack 1001
--- net/ipv4/tcp_input.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
net/ipv4/tcp_input.c +5 -1
@@ -3809,8 +3809,12 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)* then we can probably ignore it. */ if (before (ack, prior_snd_una)) { +u32 max_window; + +/* do not accept ACK for bytes we never sent. */ + max_window =min_t (u64, tp->max_window, tp->bytes_acked);/* RFC 5961 5.2 [Blind Data Injection Attack].[Mitigation] */ -if (before (ack, prior_snd_una - tp->max_window)) { +if (before (ack, prior_snd_una - max_window)) {if (!(flag &FLAG_NO_CHALLENGE_ACK ))tcp_send_challenge_ack (sk);return -SKB_DROP_REASON_TCP_TOO_OLD_ACK ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 68/244 net: dsa: mv88e6xxx: Restore USXGMII support for 6393X
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tobias Waldekranz <[email protected]>
[ Upstream commit 0c7ed1f9197aecada33a08b022e484a97bf584ba ]
In 4a56212774ac, USXGMII support was added for 6393X, but this was lost in the PCS conversion (the blamed commit), most likely because these efforts where more or less done in parallel.
Restore this feature by porting Michal's patch to fit the new implementation.
--- drivers/net/dsa/mv88e6xxx/pcs-639x.c | 31 ++++++++++++++++++++++++++-- 1 file changed, 29 insertions(+), 2 deletions(-)
drivers/net/dsa/mv88e6xxx/pcs-639x.c +29 -2
@@ -465,6 +465,7 @@ mv88e639x_pcs_select(struct mv88e6xxx_chip *chip, int port,case PHY_INTERFACE_MODE_10GBASER :case PHY_INTERFACE_MODE_XAUI :case PHY_INTERFACE_MODE_RXAUI : +case PHY_INTERFACE_MODE_USXGMII :return &mpcs->xg_pcs;default :
@@ -873,7 +874,8 @@ static int mv88e6393x_xg_pcs_post_config(struct phylink_pcs *pcs,struct mv88e639x_pcs *mpcs =xg_pcs_to_mv88e639x_pcs (pcs);int err; -if (interface ==PHY_INTERFACE_MODE_10GBASER ) { +if (interface ==PHY_INTERFACE_MODE_10GBASER || + interface ==PHY_INTERFACE_MODE_USXGMII ) { err =mv88e6393x_erratum_5_2 (mpcs);if (err)return err;
@@ -886,12 +888,37 @@ static int mv88e6393x_xg_pcs_post_config(struct phylink_pcs *pcs,return mv88e639x_xg_pcs_enable (mpcs); } +static void mv88e6393x_xg_pcs_get_state (struct phylink_pcs *pcs, +struct phylink_link_state *state) +{ +struct mv88e639x_pcs *mpcs =xg_pcs_to_mv88e639x_pcs (pcs); +u16 status, lp_status; +int err; + +if (state->interface !=PHY_INTERFACE_MODE_USXGMII ) +return mv88e639x_xg_pcs_get_state (pcs, state); + + state->link = false; + + err =mv88e639x_read (mpcs,MV88E6390_USXGMII_PHY_STATUS , &status); + err = err ? :mv88e639x_read (mpcs,MV88E6390_USXGMII_LP_STATUS , &lp_status); +if (err) { +dev_err (mpcs->mdio.dev.parent, +"can't read USXGMII status: %pe\n" ,ERR_PTR (err)); +return ; + } + + state->link = !!(status &MDIO_USXGMII_LINK ); + state->an_complete = state->link; +phylink_decode_usxgmii_word (state, lp_status); +} +static const struct phylink_pcs_ops mv88e6393x_xg_pcs_ops = { .pcs_enable = mv88e6393x_xg_pcs_enable, .pcs_disable = mv88e6393x_xg_pcs_disable, .pcs_pre_config = mv88e6393x_xg_pcs_pre_config, .pcs_post_config = mv88e6393x_xg_pcs_post_config, - .pcs_get_state = mv88e639x_xg_pcs_get_state, + .pcs_get_state = mv88e6393x_xg_pcs_get_state, .pcs_config = mv88e639x_xg_pcs_config, };
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 69/244 net: tls, update curr on splice as well
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Fastabend <[email protected]>
[ Upstream commit c5a595000e2677e865a39f249c056bc05d6e55fd ]
The curr pointer must also be updated on the splice similar to how we do this for other copy types.
--- net/tls/tls_sw.c | 2 ++ 1 file changed, 2 insertions(+)
net/tls/tls_sw.c +2 -0
@@ -952,6 +952,8 @@ static int tls_sw_sendmsg_splice(struct sock *sk, struct msghdr *msg, }sk_msg_page_add (msg_pl, page, part, off); + msg_pl->sg.copybreak =0 ; + msg_pl->sg.curr = msg_pl->sg.end;sk_mem_charge (sk, part); *copied += part; try_to_copy -= part;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 70/244 bpf: sockmap, updating the sg structure should also update curr
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Fastabend <[email protected]>
[ Upstream commit bb9aefde5bbaf6c168c77ba635c155b4980c2287 ]
Curr pointer should be updated when the sg structure is shifted.
--- net/core/filter.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+)
net/core/filter.c +19 -0
@@ -2591,6 +2591,22 @@ BPF_CALL_2(bpf_msg_cork_bytes, struct sk_msg *, msg, u32, bytes)return 0 ; } +static void sk_msg_reset_curr (struct sk_msg *msg) +{ +u32 i = msg->sg.start; +u32 len =0 ; + +do { + len +=sk_msg_elem (msg, i)->length; +sk_msg_iter_var_next (i); +if (len >= msg->sg.size) +break ; + }while (i != msg->sg.end); + + msg->sg.curr = i; + msg->sg.copybreak =0 ; +} +static const struct bpf_func_proto bpf_msg_cork_bytes_proto = { .func = bpf_msg_cork_bytes, .gpl_only = false,
@@ -2710,6 +2726,7 @@ BPF_CALL_4(bpf_msg_pull_data, struct sk_msg *, msg, u32, start, msg->sg.end - shift + NR_MSG_FRAG_IDS : msg->sg.end - shift; out: +sk_msg_reset_curr (msg); msg->data =sg_virt (&msg->sg.data[first_sge]) + start - offset; msg->data_end = msg->data + bytes;return 0 ;
@@ -2846,6 +2863,7 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_msg *, msg, u32, start, msg->sg.data[new] = rsge; } +sk_msg_reset_curr (msg);sk_msg_compute_data_pointers (msg);return 0 ; }
@@ -3014,6 +3032,7 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start,sk_mem_uncharge (msg->sk, len - pop); msg->sg.size -= (len - pop); +sk_msg_reset_curr (msg);sk_msg_compute_data_pointers (msg);return 0 ; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 71/244 psample: Require CAP_NET_ADMIN when joining "packets" group
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 44ec98ea5ea9cfecd31a5c4cc124703cb5442832 ]
The "psample" generic netlink family notifies sampled packets over the "packets" multicast group. This is problematic since by default generic netlink allows non-root users to listen to these notifications.
Fix by marking the group with the 'GENL_UNS_ADMIN_PERM' flag. This will prevent non-root users or root without the 'CAP_NET_ADMIN' capability (in the user namespace owning the network namespace) from joining the group.
Tested using [1].
Before:
# capsh -- -c ./psample_repo # capsh --drop=cap_net_admin -- -c ./psample_repo
After:
# capsh -- -c ./psample_repo # capsh --drop=cap_net_admin -- -c ./psample_repo Failed to join "packets" multicast group
[1]
$ cat psample.c #include <stdio.h> #include <netlink/genl/ctrl.h> #include <netlink/genl/genl.h> #include <netlink/socket.h>
int join_grp(struct nl_sock *sk, const char *grp_name) {
int grp, err;
grp = genl_ctrl_resolve_grp(sk, "psample", grp_name);
if (grp < 0) {
fprintf(stderr, "Failed to resolve \"%s\" multicast group\n",
grp_name);
return grp;
}
err = nl_socket_add_memberships(sk, grp, NFNLGRP_NONE); if (err) {
fprintf(stderr, "Failed to join \"%s\" multicast group\n",
grp_name);
return err;
}
return 0;
}
int main(int argc, char **argv)
{
struct nl_sock *sk;
int err;
sk = nl_socket_alloc();
if (!sk) {
fprintf(stderr, "Failed to allocate socket\n"); return -1;
}
err = genl_connect(sk);
if (err) {
fprintf(stderr, "Failed to connect socket\n"); return err;
}
err = join_grp(sk, "config");
if (err)
return err;
err = join_grp(sk, "packets");
if (err)
return err;
return 0;
}
$ gcc -I/usr/include/libnl3 -lnl-3 -lnl-genl-3 -o psample_repo psample.c
--- net/psample/psample.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/psample/psample.c +2 -1
@@ -31,7 +31,8 @@ enum psample_nl_multicast_groups {static const struct genl_multicast_group psample_nl_mcgrps[] = { [PSAMPLE_NL_MCGRP_CONFIG ] = { .name =PSAMPLE_NL_MCGRP_CONFIG_NAME }, - [PSAMPLE_NL_MCGRP_SAMPLE ] = { .name =PSAMPLE_NL_MCGRP_SAMPLE_NAME }, + [PSAMPLE_NL_MCGRP_SAMPLE ] = { .name =PSAMPLE_NL_MCGRP_SAMPLE_NAME , + .flags =GENL_UNS_ADMIN_PERM }, };static struct genl_family psample_nl_family__ro_after_init ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 72/244 drop_monitor: Require CAP_SYS_ADMIN when joining "events" group
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit e03781879a0d524ce3126678d50a80484a513c4b ]
The "NET_DM" generic netlink family notifies drop locations over the "events" multicast group. This is problematic since by default generic netlink allows non-root users to listen to these notifications.
Fix by adding a new field to the generic netlink multicast group structure that when set prevents non-root users or root without the 'CAP_SYS_ADMIN' capability (in the user namespace owning the network namespace) from joining the group. Set this field for the "events" group. Use 'CAP_SYS_ADMIN' rather than 'CAP_NET_ADMIN' because of the nature of the information that is shared over this group.
Note that the capability check in this case will always be performed against the initial user namespace since the family is not netns aware and only operates in the initial network namespace.
A new field is added to the structure rather than using the "flags" field because the existing field uses uAPI flags and it is inappropriate to add a new uAPI flag for an internal kernel check. In net-next we can rework the "flags" field to use internal flags and fold the new field into it. But for now, in order to reduce the amount of changes, add a new field.
Since the information can only be consumed by root, mark the control plane operations that start and stop the tracing as root-only using the 'GENL_ADMIN_PERM' flag.
Tested using [1].
Before:
# capsh -- -c ./dm_repo # capsh --drop=cap_sys_admin -- -c ./dm_repo
After:
# capsh -- -c ./dm_repo # capsh --drop=cap_sys_admin -- -c ./dm_repo Failed to join "events" multicast group
[1]
$ cat dm.c #include <stdio.h> #include <netlink/genl/ctrl.h> #include <netlink/genl/genl.h> #include <netlink/socket.h>
int main(int argc, char **argv)
{
struct nl_sock *sk;
int grp, err;
sk = nl_socket_alloc();
if (!sk) {
fprintf(stderr, "Failed to allocate socket\n"); return -1;
}
err = genl_connect(sk);
if (err) {
fprintf(stderr, "Failed to connect socket\n"); return err;
}
grp = genl_ctrl_resolve_grp(sk, "NET_DM", "events"); if (grp < 0) {
fprintf(stderr,
"Failed to resolve \"events\" multicast group\n");
return grp;
}
err = nl_socket_add_memberships(sk, grp, NFNLGRP_NONE);
if (err) {
fprintf(stderr, "Failed to join \"events\" multicast group\n"); return err;
}
return 0;
}
$ gcc -I/usr/include/libnl3 -lnl-3 -lnl-genl-3 -o dm_repo dm.c
--- include/net/genetlink.h | 2 ++ net/core/drop_monitor.c | 4 +++- net/netlink/genetlink.c | 3 +++ 3 files changed, 8 insertions(+), 1 deletion(-)
include/net/genetlink.h +2 -0
@@ -12,10 +12,12 @@* struct genl_multicast_group - generic netlink multicast group * @name: name of the multicast group, names are per-family * @flags: GENL_* flags (%GENL_ADMIN_PERM or %GENL_UNS_ADMIN_PERM) +* @cap_sys_admin: whether %CAP_SYS_ADMIN is required for binding */ struct genl_multicast_group {char name[GENL_NAMSIZ ];u8 flags; +u8 cap_sys_admin:1 ; };struct genl_split_ops ;
net/core/drop_monitor.c +3 -1
@@ -183,7 +183,7 @@ static struct sk_buff *reset_per_cpu_data(struct per_cpu_dm_data *data) }static const struct genl_multicast_group dropmon_mcgrps[] = { - { .name ="events" , }, + { .name ="events" , .cap_sys_admin =1 }, };static void send_dm_alert (struct work_struct *work)
@@ -1619,11 +1619,13 @@ static const struct genl_small_ops dropmon_ops[] = { .cmd = NET_DM_CMD_START, .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, .doit = net_dm_cmd_trace, + .flags = GENL_ADMIN_PERM, }, { .cmd = NET_DM_CMD_STOP, .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, .doit = net_dm_cmd_trace, + .flags = GENL_ADMIN_PERM, }, { .cmd = NET_DM_CMD_CONFIG_GET,
net/netlink/genetlink.c +3 -0
@@ -1690,6 +1690,9 @@ static int genl_bind(struct net *net, int group)if ((grp->flags &GENL_UNS_ADMIN_PERM ) && !ns_capable (net->user_ns,CAP_NET_ADMIN )) ret = -EPERM ; +if (grp->cap_sys_admin && + !ns_capable (net->user_ns,CAP_SYS_ADMIN )) + ret = -EPERM ;break ; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 73/244 net: dsa: microchip: provide a list of valid protocols for xmit handler
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Nyekjaer <[email protected]>
[ Upstream commit 1499b89289bf272fd83cb296c82fb5519d0fe93f ]
Provide a list of valid protocols for which the driver will provide it's deferred xmit handler.
When using DSA_TAG_PROTO_KSZ8795 protocol, it does not provide a "connect" method, therefor ksz_connect() is not allocating ksz_tagger_data.
This avoids the following null pointer dereference:
ksz_connect_tag_protocol from dsa_register_switch+0x9ac/0xee0 dsa_register_switch from ksz_switch_register+0x65c/0x828 ksz_switch_register from ksz_spi_probe+0x11c/0x168 ksz_spi_probe from spi_probe+0x84/0xa8
spi_probe from really_probe+0xc8/0x2d8
--- drivers/net/dsa/microchip/ksz_common.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
drivers/net/dsa/microchip/ksz_common.c +12 -4
@@ -2624,10 +2624,18 @@ static int ksz_connect_tag_protocol(struct dsa_switch *ds, {struct ksz_tagger_data *tagger_data; - tagger_data =ksz_tagger_data (ds); - tagger_data->xmit_work_fn = ksz_port_deferred_xmit; - -return 0 ; +switch (proto) { +case DSA_TAG_PROTO_KSZ8795 : +return 0 ; +case DSA_TAG_PROTO_KSZ9893 : +case DSA_TAG_PROTO_KSZ9477 : +case DSA_TAG_PROTO_LAN937X : + tagger_data =ksz_tagger_data (ds); + tagger_data->xmit_work_fn = ksz_port_deferred_xmit; +return 0 ; +default : +return -EPROTONOSUPPORT ; + } } static int ksz_port_vlan_filtering(struct dsa_switch *ds, int port,
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 74/244 net/smc: fix missing byte order conversion in CLC handshake
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wen Gu <[email protected]>
[ Upstream commit c5a10397d4571bcfd4bd7ca211ee47bcb6792ec3 ]
The byte order conversions of ISM GID and DMB token are missing in process of CLC accept and confirm. So fix it.
--- net/smc/af_smc.c | 4 ++-- net/smc/smc_clc.c | 9 ++++----- net/smc/smc_clc.h | 4 ++-- 3 files changed, 8 insertions(+), 9 deletions(-)
net/smc/af_smc.c +2 -2
@@ -723,7 +723,7 @@ static void smcd_conn_save_peer_info(struct smc_sock *smc,int bufsize =smc_uncompress_bufsize (clc->d0.dmbe_size); smc->conn.peer_rmbe_idx = clc->d0.dmbe_idx; - smc->conn.peer_token = clc->d0.token; + smc->conn.peer_token =ntohll (clc->d0.token);/* msg header takes up space in the buffer */ smc->conn.peer_rmbe_size = bufsize -sizeof (struct smcd_cdc_msg );atomic_set (&smc->conn.peer_rmbe_space, smc->conn.peer_rmbe_size);
@@ -1415,7 +1415,7 @@ static int smc_connect_ism(struct smc_sock *smc,if (rc)return rc; } - ini->ism_peer_gid[ini->ism_selected] = aclc->d0.gid; + ini->ism_peer_gid[ini->ism_selected] =ntohll (aclc->d0.gid);/* there is only one lgr role for SMC-D; use server lock */ mutex_lock (&smc_server_lgr_pending);
net/smc/smc_clc.c +4 -5
@@ -1004,6 +1004,7 @@ static int smc_clc_send_confirm_accept(struct smc_sock *smc, {struct smc_connection *conn = &smc->conn;struct smc_clc_first_contact_ext_v2x fce; +struct smcd_dev *smcd = conn->lgr->smcd;struct smc_clc_msg_accept_confirm *clc;struct smc_clc_fce_gid_ext gle;struct smc_clc_msg_trail trl;
@@ -1021,17 +1022,15 @@ static int smc_clc_send_confirm_accept(struct smc_sock *smc,memcpy (clc->hdr.eyecatcher,SMCD_EYECATCHER ,sizeof (SMCD_EYECATCHER )); clc->hdr.typev1 =SMC_TYPE_D ; - clc->d0.gid = - conn->lgr->smcd->ops->get_local_gid (conn->lgr->smcd); - clc->d0.token = conn->rmb_desc->token; + clc->d0.gid =htonll (smcd->ops->get_local_gid (smcd)); + clc->d0.token =htonll (conn->rmb_desc->token); clc->d0.dmbe_size = conn->rmbe_size_comp; clc->d0.dmbe_idx =0 ;memcpy (&clc->d0.linkid, conn->lgr->id,SMC_LGR_ID_SIZE );if (version ==SMC_V1 ) { clc->hdr.length =htons (SMCD_CLC_ACCEPT_CONFIRM_LEN ); }else { - clc_v2->d1.chid = -htons (smc_ism_get_chid (conn->lgr->smcd)); + clc_v2->d1.chid =htons (smc_ism_get_chid (smcd));if (eid && eid[0 ])memcpy (clc_v2->d1.eid, eid,SMC_MAX_EID_LEN ); len =SMCD_CLC_ACCEPT_CONFIRM_LEN_V2 ;
net/smc/smc_clc.h +2 -2
@@ -204,8 +204,8 @@ struct smcr_clc_msg_accept_confirm { /* SMCR accept/confirm */ } __packed;struct smcd_clc_msg_accept_confirm_common {/* SMCD accept/confirm */ -u64 gid;/* Sender GID */ -u64 token;/* DMB token */ +__be64 gid;/* Sender GID */ +__be64 token;/* DMB token */ u8 dmbe_idx;/* DMBE index */ #if defined(__BIG_ENDIAN_BITFIELD) u8 dmbe_size : 4, /* buf size (compressed) */
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 75/244 drm/amd/amdgpu/amdgpu_doorbell_mgr: Correct misdocumented param doorbell_index
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lee Jones <[email protected]>
[ Upstream commit 04cef5f58395806294a64118cf8a39534bd032a2 ]
Fixes the following W=1 kernel build warning(s):
drivers/gpu/drm/amd/amdgpu/amdgpu_doorbell_mgr.c:123: warning: Function parameter or member 'doorbell_index' not described in 'amdgpu_doorbell_index_on_bar' drivers/gpu/drm/amd/amdgpu/amdgpu_doorbell_mgr.c:123: warning: Excess function parameter 'db_index' description in 'amdgpu_doorbell_index_on_bar'
--- drivers/gpu/drm/amd/amdgpu/amdgpu_doorbell_mgr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_doorbell_mgr.c +1 -1
@@ -113,7 +113,7 @@ void amdgpu_mm_wdoorbell64(struct amdgpu_device *adev, u32 index, u64 v)* * @adev: amdgpu_device pointer * @db_bo: doorbell object's bo -* @db_index: doorbell relative index in this doorbell object +* @doorbell_index: doorbell relative index in this doorbell object * * returns doorbell's absolute index in BAR */
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 76/244 drm/amdkfd: get doorbells absolute offset based on the db_size
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arvind Yadav <[email protected]>
[ Upstream commit 367a0af43373d4f791cc8b466a659ecf5aa52377 ]
Here, Adding db_size in byte to find the doorbell's absolute offset for both 32-bit and 64-bit doorbell sizes. So that doorbell offset will be aligned based on the doorbell size.
v2:
- Addressed the review comment from Felix.
v3:
- Adding doorbell_size as parameter to get db absolute offset. v4:
Squash the two patches into one.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_doorbell.h | 5 +++-- drivers/gpu/drm/amd/amdgpu/amdgpu_doorbell_mgr.c | 13 +++++++++---- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 3 ++- drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c | 10 ++++++++-- .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 3 ++- 5 files changed, 24 insertions(+), 10 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_doorbell.h +3 -2
@@ -357,8 +357,9 @@ int amdgpu_doorbell_init(struct amdgpu_device *adev);void amdgpu_doorbell_fini (struct amdgpu_device *adev);int amdgpu_doorbell_create_kernel_doorbells (struct amdgpu_device *adev);uint32_t amdgpu_doorbell_index_on_bar (struct amdgpu_device *adev, -struct amdgpu_bo *db_bo, -uint32_t doorbell_index); +struct amdgpu_bo *db_bo, +uint32_t doorbell_index, +uint32_t db_size);#define RDOORBELL32 (index) amdgpu_mm_rdoorbell(adev, (index))#define WDOORBELL32 (index, v) amdgpu_mm_wdoorbell(adev, (index), (v))
drivers/gpu/drm/amd/amdgpu/amdgpu_doorbell_mgr.c +9 -4
@@ -114,19 +114,24 @@ void amdgpu_mm_wdoorbell64(struct amdgpu_device *adev, u32 index, u64 v)* @adev: amdgpu_device pointer * @db_bo: doorbell object's bo * @doorbell_index: doorbell relative index in this doorbell object +* @db_size: doorbell size is in byte * * returns doorbell's absolute index in BAR */ uint32_t amdgpu_doorbell_index_on_bar (struct amdgpu_device *adev, -struct amdgpu_bo *db_bo, -uint32_t doorbell_index) +struct amdgpu_bo *db_bo, +uint32_t doorbell_index, +uint32_t db_size) {int db_bo_offset; db_bo_offset =amdgpu_bo_gpu_offset_no_check (db_bo); -/* doorbell index is 32 bit but doorbell's size is 64-bit, so *2 */ -return db_bo_offset /sizeof (u32) + doorbell_index *2 ; +/* doorbell index is 32 bit but doorbell's size can be 32 bit +* or 64 bit, so *db_size(in byte)/4 for alignment. +*/ +return db_bo_offset /sizeof (u32) + doorbell_index * +DIV_ROUND_UP (db_size,4 ); }/**
drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c +2 -1
@@ -407,7 +407,8 @@ static int allocate_doorbell(struct qcm_process_device *qpd, q->properties.doorbell_off =amdgpu_doorbell_index_on_bar (dev->adev, qpd->proc_doorbells, - q->doorbell_id); + q->doorbell_id, + dev->kfd->device_info.doorbell_size);return 0 ; }
drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c +8 -2
@@ -161,7 +161,10 @@ void __iomem *kfd_get_kernel_doorbell(struct kfd_dev *kfd,if (inx >=KFD_MAX_NUM_OF_QUEUES_PER_PROCESS )return NULL ; - *doorbell_off =amdgpu_doorbell_index_on_bar (kfd->adev, kfd->doorbells, inx); + *doorbell_off =amdgpu_doorbell_index_on_bar (kfd->adev, + kfd->doorbells, + inx, + kfd->device_info.doorbell_size); inx *=2 ; pr_debug("Get kernel queue doorbell\n"
@@ -240,7 +243,10 @@ phys_addr_t kfd_get_process_doorbells(struct kfd_process_device *pdd)return 0 ; } - first_db_index =amdgpu_doorbell_index_on_bar (adev, pdd->qpd.proc_doorbells,0 ); + first_db_index =amdgpu_doorbell_index_on_bar (adev, + pdd->qpd.proc_doorbells, +0 , + pdd->dev->kfd->device_info.doorbell_size);return adev->doorbell.base + first_db_index *sizeof (uint32_t ); }
drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c +2 -1
@@ -377,7 +377,8 @@ int pqm_create_queue(struct process_queue_manager *pqm,*/ uint32_t first_db_index =amdgpu_doorbell_index_on_bar (pdd->dev->adev, pdd->qpd.proc_doorbells, -0 ); +0 , + pdd->dev->kfd->device_info.doorbell_size); *p_doorbell_offset_in_process = (q->properties.doorbell_off - first_db_index) *sizeof (uint32_t );
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 77/244 mm/damon/sysfs: eliminate potential uninitialized variable warning
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 85c2ceaafbd306814a3a4740bf4d95ac26a8b36a ]
The "err" variable is not initialized if damon_target_has_pid(ctx) is false and sys_target->regions->nr is zero.
--- mm/damon/sysfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/damon/sysfs.c +1 -1
@@ -1172,7 +1172,7 @@ static int damon_sysfs_update_target(struct damon_target *target,struct damon_ctx *ctx, struct damon_sysfs_target *sys_target) { - int err; + int err = 0;if (damon_target_has_pid (ctx)) { err =damon_sysfs_update_target_pid (target, sys_target->pid);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 78/244 tee: optee: Fix supplicant based device enumeration
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sumit Garg <[email protected]>
[ Upstream commit 7269cba53d906cf257c139d3b3a53ad272176bca ]
Currently supplicant dependent optee device enumeration only registers devices whenever tee-supplicant is invoked for the first time. But it forgets to remove devices when tee-supplicant daemon stops running and closes its context gracefully. This leads to following error for fTPM driver during reboot/shutdown:
[ 73.466791] tpm tpm0: ftpm_tee_tpm_op_send: SUBMIT_COMMAND invoke error: 0xffff3024
Fix this by adding an attribute for supplicant dependent devices so that the user-space service can detect and detach supplicant devices before closing the supplicant:
$ for dev in /sys/bus/tee/devices/*; do if [[ -f "$dev/need_supplicant" && -f "$dev/driver/unbind" ]]; \
then echo $(basename "$dev") > $dev/driver/unbind; fi done--- .../ABI/testing/sysfs-bus-optee-devices | 9 +++++++++ drivers/tee/optee/device.c | 17 +++++++++++++++-- 2 files changed, 24 insertions(+), 2 deletions(-)
Documentation/ABI/testing/sysfs-bus-optee-devices +9 -0
@@ -6,3 +6,12 @@ Description: OP-TEE bus provides reference to registered drivers under this directory. The <uuid> matches Trusted Application (TA) driver and corresponding TA in secure OS. Drivers are free to create needed API under optee-ta-<uuid> directory. + +What: /sys/bus/tee/devices/optee-ta-<uuid>/need_supplicant +Date: November 2023 +KernelVersion: 6.7 +Contact: [email protected] +Description: + Allows to distinguish whether an OP-TEE based TA/device requires user-space + tee-supplicant to function properly or not. This attribute will be present for + devices which depend on tee-supplicant to be running.
drivers/tee/optee/device.c +15 -2
@@ -60,7 +60,16 @@ static void optee_release_device(struct device *dev)kfree (optee_device); } -static int optee_register_device (const uuid_t *device_uuid) +static ssize_t need_supplicant_show (struct device *dev, +struct device_attribute *attr, +char *buf) +{ +return 0 ; +} + +static DEVICE_ATTR_RO (need_supplicant); + +static int optee_register_device (const uuid_t *device_uuid,u32 func) {struct tee_client_device *optee_device =NULL ;int rc;
@@ -83,6 +92,10 @@ static int optee_register_device(const uuid_t *device_uuid)put_device (&optee_device->dev); } +if (func ==PTA_CMD_GET_DEVICES_SUPP ) +device_create_file (&optee_device->dev, + &dev_attr_need_supplicant); +return rc; }
@@ -142,7 +155,7 @@ static int __optee_enumerate_devices(u32 func) num_devices = shm_size /sizeof (uuid_t);for (idx =0 ; idx < num_devices; idx++) { - rc =optee_register_device (&device_uuid[idx]); + rc =optee_register_device (&device_uuid[idx], func);if (rc) goto out_shm; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 79/244 RDMA/core: Fix uninit-value access in ib_get_eth_speed()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shigeru Yoshida <[email protected]>
[ Upstream commit 0550d4604e2ca4e653dc13f0c009fc42106b6bfc ]
KMSAN reported the following uninit-value access issue:
lo speed is unknown, defaulting to 1000
=====================================================
BUG: KMSAN: uninit-value in ib_get_width_and_speed drivers/infiniband/core/verbs.c:1889 [inline] BUG: KMSAN: uninit-value in ib_get_eth_speed+0x546/0xaf0 drivers/infiniband/core/verbs.c:1998 ib_get_width_and_speed drivers/infiniband/core/verbs.c:1889 [inline] ib_get_eth_speed+0x546/0xaf0 drivers/infiniband/core/verbs.c:1998 siw_query_port drivers/infiniband/sw/siw/siw_verbs.c:173 [inline] siw_get_port_immutable+0x6f/0x120 drivers/infiniband/sw/siw/siw_verbs.c:203 setup_port_data drivers/infiniband/core/device.c:848 [inline] setup_device drivers/infiniband/core/device.c:1244 [inline] ib_register_device+0x1589/0x1df0 drivers/infiniband/core/device.c:1383 siw_device_register drivers/infiniband/sw/siw/siw_main.c:72 [inline] siw_newlink+0x129e/0x13d0 drivers/infiniband/sw/siw/siw_main.c:490 nldev_newlink+0x8fd/0xa60 drivers/infiniband/core/nldev.c:1763 rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline] rdma_nl_rcv+0xe8a/0x1120 drivers/infiniband/core/netlink.c:259 netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline] netlink_unicast+0xf4b/0x1230 net/netlink/af_netlink.c:1368 netlink_sendmsg+0x1242/0x1420 net/netlink/af_netlink.c:1910 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] ____sys_sendmsg+0x997/0xd60 net/socket.c:2588 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2642 __sys_sendmsg net/socket.c:2671 [inline] __do_sys_sendmsg net/socket.c:2680 [inline] __se_sys_sendmsg net/socket.c:2678 [inline] __x64_sys_sendmsg+0x2fa/0x4a0 net/socket.c:2678 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b
Local variable lksettings created at:
ib_get_eth_speed+0x4b/0xaf0 drivers/infiniband/core/verbs.c:1974 siw_query_port drivers/infiniband/sw/siw/siw_verbs.c:173 [inline] siw_get_port_immutable+0x6f/0x120 drivers/infiniband/sw/siw/siw_verbs.c:203 CPU: 0 PID: 11257 Comm: syz-executor.1 Not tainted 6.6.0-14500-g1c41041124bd #10 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-1.fc38 04/01/2014 =====================================================
If __ethtool_get_link_ksettings() fails, netdev_speed is set to the default value, SPEED_1000. In this case, if lanes field of struct ethtool_link_ksettings is not initialized, an uninitialized value is passed to ib_get_width_and_speed(). This causes the above issue. This patch resolves the issue by initializing lanes to 0.
--- drivers/infiniband/core/verbs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/core/verbs.c +1 -1
@@ -1968,7 +1968,7 @@ int ib_get_eth_speed(struct ib_device *dev, u32 port_num, u16 *speed, u8 *width)int rc;u32 netdev_speed;struct net_device *netdev; -struct ethtool_link_ksettings lksettings; +struct ethtool_link_ksettings lksettings = {};if (rdma_port_get_link_layer (dev, port_num) !=IB_LINK_LAYER_ETHERNET )return -EINVAL ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 80/244 RDMA/hns: Fix unnecessary err return when using invalid congest control algorithm
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junxian Huang <[email protected]>
[ Upstream commit efb9cbf66440482ceaa90493d648226ab7ec2ebf ]
Add a default congest control algorithm so that driver won't return an error when the configured algorithm is invalid.
--- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/infiniband/hw/hns/hns_roce_hw_v2.c +9 -4
@@ -4755,10 +4755,15 @@ static int check_cong_type(struct ib_qp *ibqp, cong_alg->wnd_mode_sel =WND_LIMIT ;break ;default : -ibdev_err (&hr_dev->ib_dev, -"error type(%u) for congestion selection.\n" , - hr_dev->caps.cong_type); -return -EINVAL ; +ibdev_warn (&hr_dev->ib_dev, +"invalid type(%u) for congestion selection.\n" , + hr_dev->caps.cong_type); + hr_dev->caps.cong_type =CONG_TYPE_DCQCN ; + cong_alg->alg_sel =CONG_DCQCN ; + cong_alg->alg_sub_sel =UNSUPPORT_CONG_LEVEL ; + cong_alg->dip_vld =DIP_INVALID ; + cong_alg->wnd_mode_sel =WND_LIMIT ; +break ; }return 0 ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 81/244 RDMA/irdma: Do not modify to SQD on error
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mustafa Ismail <[email protected]>
[ Upstream commit ba12ab66aa83a2340a51ad6e74b284269745138c ]
Remove the modify to SQD before going to ERROR state. It is not needed.
--- drivers/infiniband/hw/irdma/verbs.c | 7 ------- 1 file changed, 7 deletions(-)
drivers/infiniband/hw/irdma/verbs.c +0 -7
@@ -1424,13 +1424,6 @@ int irdma_modify_qp_roce(struct ib_qp *ibqp, struct ib_qp_attr *attr,case IB_QPS_SQE :case IB_QPS_ERR :case IB_QPS_RESET : -if (iwqp->iwarp_state ==IRDMA_QP_STATE_RTS ) { -spin_unlock_irqrestore (&iwqp->lock, flags); - info.next_iwarp_state =IRDMA_QP_STATE_SQD ; -irdma_hw_modify_qp (iwdev, iwqp, &info, true); -spin_lock_irqsave (&iwqp->lock, flags); - } -if (iwqp->iwarp_state ==IRDMA_QP_STATE_ERROR ) {spin_unlock_irqrestore (&iwqp->lock, flags);if (udata && udata->inlen) {
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 82/244 RDMA/irdma: Add wait for suspend on SQD
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mustafa Ismail <[email protected]>
[ Upstream commit bd6da690c27d75cae432c09162d054b34fa2156f ]
Currently, there is no wait for the QP suspend to complete on a modify to SQD state. Add a wait, after the modify to SQD state, for the Suspend Complete AE. While we are at it, update the suspend timeout value in irdma_prep_tc_change to use IRDMA_EVENT_TIMEOUT_MS too.
--- drivers/infiniband/hw/irdma/hw.c | 6 +++++- drivers/infiniband/hw/irdma/main.c | 2 +- drivers/infiniband/hw/irdma/main.h | 2 +- drivers/infiniband/hw/irdma/verbs.c | 21 +++++++++++++++++++++ drivers/infiniband/hw/irdma/verbs.h | 1 + 5 files changed, 29 insertions(+), 3 deletions(-)
drivers/infiniband/hw/irdma/hw.c +5 -1
@@ -321,7 +321,11 @@ static void irdma_process_aeq(struct irdma_pci_f *rf)break ;case IRDMA_AE_QP_SUSPEND_COMPLETE :if (iwqp->iwdev->vsi.tc_change_pending) { -atomic_dec (&iwqp->sc_qp.vsi->qp_suspend_reqs); +if (!atomic_dec_return (&qp->vsi->qp_suspend_reqs)) +wake_up (&iwqp->iwdev->suspend_wq); + } +if (iwqp->suspend_pending) { + iwqp->suspend_pending = false;wake_up (&iwqp->iwdev->suspend_wq); }break ;
drivers/infiniband/hw/irdma/main.c +1 -1
@@ -48,7 +48,7 @@ static void irdma_prep_tc_change(struct irdma_device *iwdev)/* Wait for all qp's to suspend */ wait_event_timeout (iwdev->suspend_wq, !atomic_read (&iwdev->vsi.qp_suspend_reqs), -IRDMA_EVENT_TIMEOUT ); +msecs_to_jiffies (IRDMA_EVENT_TIMEOUT_MS ));irdma_ws_reset (&iwdev->vsi); }
drivers/infiniband/hw/irdma/main.h +1 -1
@@ -78,7 +78,7 @@ extern struct auxiliary_driver i40iw_auxiliary_drv;#define MAX_DPC_ITERATIONS 128 -#define IRDMA_EVENT_TIMEOUT 50000 +#define IRDMA_EVENT_TIMEOUT_MS 5000#define IRDMA_VCHNL_EVENT_TIMEOUT 100000#define IRDMA_RST_TIMEOUT_HZ 4
drivers/infiniband/hw/irdma/verbs.c +21 -0
@@ -1157,6 +1157,21 @@ static u8 irdma_roce_get_vlan_prio(const struct ib_gid_attr *attr, u8 prio)return prio; } +static int irdma_wait_for_suspend (struct irdma_qp *iwqp) +{ +if (!wait_event_timeout (iwqp->iwdev->suspend_wq, + !iwqp->suspend_pending, +msecs_to_jiffies (IRDMA_EVENT_TIMEOUT_MS ))) { + iwqp->suspend_pending = false; +ibdev_warn (&iwqp->iwdev->ibdev, +"modify_qp timed out waiting for suspend. qp_id = %d, last_ae = 0x%x\n" , + iwqp->ibqp.qp_num, iwqp->last_aeq); +return -EBUSY ; + } + +return 0 ; +} +/** * irdma_modify_qp_roce - modify qp request * @ibqp: qp's pointer for modify
@@ -1420,6 +1435,7 @@ int irdma_modify_qp_roce(struct ib_qp *ibqp, struct ib_qp_attr *attr, info.next_iwarp_state =IRDMA_QP_STATE_SQD ; issue_modify_qp =1 ; + iwqp->suspend_pending = true;break ;case IB_QPS_SQE :case IB_QPS_ERR :
@@ -1460,6 +1476,11 @@ int irdma_modify_qp_roce(struct ib_qp *ibqp, struct ib_qp_attr *attr, ctx_info->rem_endpoint_idx = udp_info->arp_idx;if (irdma_hw_modify_qp (iwdev, iwqp, &info, true))return -EINVAL ; +if (info.next_iwarp_state ==IRDMA_QP_STATE_SQD ) { + ret =irdma_wait_for_suspend (iwqp); +if (ret) +return ret; + }spin_lock_irqsave (&iwqp->lock, flags);if (iwqp->iwarp_state == info.curr_iwarp_state) { iwqp->iwarp_state = info.next_iwarp_state;
drivers/infiniband/hw/irdma/verbs.h +1 -0
@@ -196,6 +196,7 @@ struct irdma_qp { u8 flush_issued : 1; u8 sig_all : 1; u8 pau_mode : 1; + u8 suspend_pending : 1; u8 rsvd : 1;u8 iwarp_state;u16 term_sq_flush_code;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 83/244 arm64: dts: rockchip: Expand reg size of vdec node for RK3328
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Karlman <[email protected]>
[ Upstream commit 0b6240d697a96eaa45a2a5503a274ebb4f162fa3 ]
Expand the reg size for the vdec node to include cache/performance registers the rkvdec driver writes to.
--- arch/arm64/boot/dts/rockchip/rk3328.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/rockchip/rk3328.dtsi +1 -1
@@ -668,7 +668,7 @@ vdec: video-codec@ff360000 { compatible = "rockchip,rk3328-vdec", "rockchip,rk3399-vdec"; - reg = <0x0 0xff360000 0x0 0x400>; + reg = <0x0 0xff360000 0x0 0x480>; interrupts = <GIC_SPI 7 IRQ_TYPE_LEVEL_HIGH>; clocks = <&cru ACLK_RKVDEC>, <&cru HCLK_RKVDEC>, <&cru SCLK_VDEC_CABAC>, <&cru SCLK_VDEC_CORE>;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 84/244 arm64: dts: rockchip: Expand reg size of vdec node for RK3399
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Bee <[email protected]>
[ Upstream commit 35938c18291b5da7422b2fac6dac0af11aa8d0d7 ]
Expand the reg size for the vdec node to include cache/performance registers the rkvdec driver writes to. Also add missing clocks to the related power-domain.
--- arch/arm64/boot/dts/rockchip/rk3399.dtsi | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/rockchip/rk3399.dtsi +4 -2
@@ -1109,7 +1109,9 @@ power-domain@RK3399_PD_VDU { reg = <RK3399_PD_VDU>; clocks = <&cru ACLK_VDU>, - <&cru HCLK_VDU>; + <&cru HCLK_VDU>, + <&cru SCLK_VDU_CA>, + <&cru SCLK_VDU_CORE>; pm_qos = <&qos_video_m1_r>, <&qos_video_m1_w>; #power-domain-cells = <0>;
@@ -1385,7 +1387,7 @@ vdec: video-codec@ff660000 { compatible = "rockchip,rk3399-vdec"; - reg = <0x0 0xff660000 0x0 0x400>; + reg = <0x0 0xff660000 0x0 0x480>; interrupts = <GIC_SPI 116 IRQ_TYPE_LEVEL_HIGH 0>; clocks = <&cru ACLK_VDU>, <&cru HCLK_VDU>, <&cru SCLK_VDU_CA>, <&cru SCLK_VDU_CORE>;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 85/244 ASoC: fsl_sai: Fix no frame sync clock issue on i.MX8MP
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shengjiu Wang <[email protected]>
[ Upstream commit 14e8442e0789598514f3c9de014950de9feda7a4 ]
On i.MX8MP, when the TERE and FSD_MSTR enabled before configuring the word width, there will be no frame sync clock issue, because old word width impact the generation of frame sync.
TERE enabled earlier only for i.MX8MP case for the hardware limitation, So need to disable FSD_MSTR before configuring word width, then enable FSD_MSTR bit for this specific case.
--- sound/soc/fsl/fsl_sai.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+)
sound/soc/fsl/fsl_sai.c +21 -0
@@ -674,6 +674,20 @@ static int fsl_sai_hw_params(struct snd_pcm_substream *substream,FSL_SAI_CR3_TRCE_MASK , FSL_SAI_CR3_TRCE((dl_cfg[dl_cfg_idx].mask[tx] & trce_mask))); +/* +* When the TERE and FSD_MSTR enabled before configuring the word width +* There will be no frame sync clock issue, because word width impact +* the generation of frame sync clock. +* +* TERE enabled earlier only for i.MX8MP case for the hardware limitation, +* We need to disable FSD_MSTR before configuring word width, then enable +* FSD_MSTR bit for this specific case. +*/ +if (sai->soc_data->mclk_with_tere && sai->mclk_direction_output && + !sai->is_consumer_mode) +regmap_update_bits (sai->regmap,FSL_SAI_xCR4 (tx, ofs), +FSL_SAI_CR4_FSD_MSTR ,0 ); + regmap_update_bits(sai->regmap, FSL_SAI_xCR4(tx, ofs), FSL_SAI_CR4_SYWD_MASK | FSL_SAI_CR4_FRSZ_MASK | FSL_SAI_CR4_CHMOD_MASK,
@@ -681,6 +695,13 @@ static int fsl_sai_hw_params(struct snd_pcm_substream *substream,regmap_update_bits (sai->regmap,FSL_SAI_xCR5 (tx, ofs),FSL_SAI_CR5_WNW_MASK |FSL_SAI_CR5_W0W_MASK |FSL_SAI_CR5_FBT_MASK , val_cr5); + +/* Enable FSD_MSTR after configuring word width */ +if (sai->soc_data->mclk_with_tere && sai->mclk_direction_output && + !sai->is_consumer_mode) +regmap_update_bits (sai->regmap,FSL_SAI_xCR4 (tx, ofs), +FSL_SAI_CR4_FSD_MSTR ,FSL_SAI_CR4_FSD_MSTR ); +regmap_write (sai->regmap,FSL_SAI_xMR (tx), ~0UL - ((1 <<min (channels, slots)) -1 ));
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 86/244 RDMA/rtrs-srv: Do not unconditionally enable irq
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jack Wang <[email protected]>
[ Upstream commit 3ee7ecd712048ade6482bea4b2f3dcaf039c0348 ]
When IO is completed, rtrs can be called in softirq context, unconditionally enabling irq could cause panic.
To be on safe side, use spin_lock_irqsave and spin_unlock_irqrestore instread.
--- drivers/infiniband/ulp/rtrs/rtrs-srv.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/infiniband/ulp/rtrs/rtrs-srv.c +3 -2
@@ -65,8 +65,9 @@ static bool rtrs_srv_change_state(struct rtrs_srv_path *srv_path, {enum rtrs_srv_state old_state;bool changed = false; +unsigned long flags; -spin_lock_irq (&srv_path->state_lock); +spin_lock_irqsave (&srv_path->state_lock, flags); old_state = srv_path->state;switch (new_state) {case RTRS_SRV_CONNECTED :
@@ -87,7 +88,7 @@ static bool rtrs_srv_change_state(struct rtrs_srv_path *srv_path, }if (changed) srv_path->state = new_state; -spin_unlock_irq (&srv_path->state_lock); +spin_unlock_irqrestore (&srv_path->state_lock, flags);return changed; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 87/244 RDMA/rtrs-clt: Start hb after path_up
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jack Wang <[email protected]>
[ Upstream commit 3e44a61b5db873612e20e7b7922468d7d1ac2d22 ]
If we start hb too early, it will confuse server side to close the session.
--- drivers/infiniband/ulp/rtrs/rtrs-clt.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/infiniband/ulp/rtrs/rtrs-clt.c +1 -2
@@ -2345,8 +2345,6 @@ static int init_conns(struct rtrs_clt_path *clt_path)if (err) goto destroy; -rtrs_start_hb (&clt_path->s); -return 0 ; destroy:
@@ -2620,6 +2618,7 @@ static int init_path(struct rtrs_clt_path *clt_path) goto out; }rtrs_clt_path_up (clt_path); +rtrs_start_hb (&clt_path->s); out:mutex_unlock (&clt_path->init_mutex);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 88/244 RDMA/rtrs-srv: Check return values while processing info request
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Md Haris Iqbal <[email protected]>
[ Upstream commit ed1e52aefa16f15dc2f04054a3baf11726a7460e ]
While processing info request, it could so happen that the srv_path goes to CLOSING state, cause of any of the error events from RDMA. That state change should be picked up while trying to change the state in process_info_req, by checking the return value. In case the state change call in process_info_req fails, we fail the processing.
We should also check the return value for rtrs_srv_path_up, since it sends a link event to the client above, and the client can fail for any reason.
--- drivers/infiniband/ulp/rtrs/rtrs-srv.c | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-)
drivers/infiniband/ulp/rtrs/rtrs-srv.c +18 -6
@@ -710,20 +710,23 @@ static void rtrs_srv_info_rsp_done(struct ib_cq *cq, struct ib_wc *wc)WARN_ON (wc->opcode !=IB_WC_SEND ); } -static void rtrs_srv_path_up (struct rtrs_srv_path *srv_path) +static int rtrs_srv_path_up (struct rtrs_srv_path *srv_path) {struct rtrs_srv_sess *srv = srv_path->srv;struct rtrs_srv_ctx *ctx = srv->ctx; -int up; +int up, ret =0 ;mutex_lock (&srv->paths_ev_mutex); up = ++srv->paths_up;if (up ==1 ) - ctx->ops.link_ev (srv,RTRS_SRV_LINK_EV_CONNECTED ,NULL ); + ret = ctx->ops.link_ev (srv,RTRS_SRV_LINK_EV_CONNECTED ,NULL );mutex_unlock (&srv->paths_ev_mutex);/* Mark session as established */ - srv_path->established = true; +if (!ret) + srv_path->established = true; + +return ret; }static void rtrs_srv_path_down (struct rtrs_srv_path *srv_path)
@@ -852,7 +855,12 @@ static int process_info_req(struct rtrs_srv_con *con, goto iu_free;kobject_get (&srv_path->kobj);get_device (&srv_path->srv->dev); -rtrs_srv_change_state (srv_path,RTRS_SRV_CONNECTED ); + err =rtrs_srv_change_state (srv_path,RTRS_SRV_CONNECTED ); +if (!err) { +rtrs_err (s,"rtrs_srv_change_state(), err: %d\n" , err); + goto iu_free; + } +rtrs_srv_start_hb (srv_path);/*
@@ -861,7 +869,11 @@ static int process_info_req(struct rtrs_srv_con *con,* all connections are successfully established. Thus, simply notify * listener with a proper event if we are the first path. */ -rtrs_srv_path_up (srv_path); + err =rtrs_srv_path_up (srv_path); +if (err) { +rtrs_err (s,"rtrs_srv_path_up(), err: %d\n" , err); + goto iu_free; + } ib_dma_sync_single_for_device(srv_path->s.dev->ib_dev, tx_iu->dma_addr,
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 89/244 RDMA/rtrs-srv: Free srv_mr iu only when always_invalidate is true
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Md Haris Iqbal <[email protected]>
[ Upstream commit 3a71cd6ca0ce33d1af019ecf1d7167406fa54400 ]
Since srv_mr->iu is allocated and used only when always_invalidate is true, free it only when always_invalidate is true.
--- drivers/infiniband/ulp/rtrs/rtrs-srv.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/infiniband/ulp/rtrs/rtrs-srv.c +4 -1
@@ -551,7 +551,10 @@ static void unmap_cont_bufs(struct rtrs_srv_path *srv_path)struct rtrs_srv_mr *srv_mr; srv_mr = &srv_path->mrs[i]; -rtrs_iu_free (srv_mr->iu, srv_path->s.dev->ib_dev,1 ); + +if (always_invalidate) +rtrs_iu_free (srv_mr->iu, srv_path->s.dev->ib_dev,1 ); +ib_dereg_mr (srv_mr->mr);ib_dma_unmap_sg (srv_path->s.dev->ib_dev, srv_mr->sgt.sgl, srv_mr->sgt.nents,DMA_BIDIRECTIONAL );
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 90/244 RDMA/rtrs-srv: Destroy path files after making sure no IOs in-flight
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Md Haris Iqbal <[email protected]>
[ Upstream commit c4d32e77fc1006f99eeb78417efc3d81a384072a ]
Destroying path files may lead to the freeing of rdma_stats. This creates the following race.
An IO is in-flight, or has just passed the session state check in process_read/process_write. The close_work gets triggered and the function rtrs_srv_close_work() starts and does destroy path which frees the rdma_stats. After this the function process_read/process_write resumes and tries to update the stats through the function rtrs_srv_update_rdma_stats
This commit solves the problem by moving the destroy path function to a later point. This point makes sure any inflights are completed. This is done by qp drain, and waiting for all in-flights through ops_id.
--- drivers/infiniband/ulp/rtrs/rtrs-srv.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/infiniband/ulp/rtrs/rtrs-srv.c +2 -1
@@ -1532,7 +1532,6 @@ static void rtrs_srv_close_work(struct work_struct *work) srv_path =container_of (work,typeof (*srv_path), close_work); -rtrs_srv_destroy_path_files (srv_path);rtrs_srv_stop_hb (srv_path);for (i =0 ; i < srv_path->s.con_num; i++) {
@@ -1552,6 +1551,8 @@ static void rtrs_srv_close_work(struct work_struct *work)/* Wait for all completion */ wait_for_completion (&srv_path->complete_done); +rtrs_srv_destroy_path_files (srv_path); +/* Notify upper layer if we are the last path */ rtrs_srv_path_down (srv_path);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 91/244 RDMA/rtrs-clt: Fix the max_send_wr setting
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jack Wang <[email protected]>
[ Upstream commit 6d09f6f7d7584e099633282ea915988914f86529 ]
For each write request, we need Request, Response Memory Registration, Local Invalidate.
--- drivers/infiniband/ulp/rtrs/rtrs-clt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/ulp/rtrs/rtrs-clt.c +1 -1
@@ -1694,7 +1694,7 @@ static int create_con_cq_qp(struct rtrs_clt_con *con) clt_path->s.dev_ref++; max_send_wr =min_t (int, wr_limit,/* QD * (REQ + RSP + FR REGS or INVS) + drain */ - clt_path->queue_depth *3 +1 ); + clt_path->queue_depth *4 +1 ); max_recv_wr =min_t (int, wr_limit, clt_path->queue_depth *3 +1 ); max_send_sge =2 ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 92/244 RDMA/rtrs-clt: Remove the warnings for req in_use check
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jack Wang <[email protected]>
[ Upstream commit 0c8bb6eb70ca41031f663b4481aac9ac78b53bc6 ]
As we chain the WR during write request: memory registration, rdma write, local invalidate, if only the last WR fail to send due to send queue overrun, the server can send back the reply, while client mark the req->in_use to false in case of error in rtrs_clt_req when error out from rtrs_post_rdma_write_sg.
--- drivers/infiniband/ulp/rtrs/rtrs-clt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/ulp/rtrs/rtrs-clt.c +1 -1
@@ -384,7 +384,7 @@ static void complete_rdma_req(struct rtrs_clt_io_req *req, int errno,struct rtrs_clt_path *clt_path;int err; -if (WARN_ON (!req->in_use)) +if (!req->in_use)return ;if (WARN_ON (!req->con))return ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 93/244 RDMA/bnxt_re: Correct module description string
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kalesh AP <[email protected]>
[ Upstream commit 422b19f7f006e813ee0865aadce6a62b3c263c42 ]
The word "Driver" is repeated twice in the "modinfo bnxt_re" output description. Fix it.
--- drivers/infiniband/hw/bnxt_re/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/bnxt_re/main.c +1 -1
@@ -71,7 +71,7 @@ static char version[] =BNXT_RE_DESC "\n" ;MODULE_AUTHOR ("Eddie Wai <[email protected]>" ); -MODULE_DESCRIPTION (BNXT_RE_DESC " Driver" ); +MODULE_DESCRIPTION (BNXT_RE_DESC );MODULE_LICENSE ("Dual BSD/GPL" );/* globals */
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 94/244 RDMA/irdma: Fix UAF in irdma_sc_ccq_get_cqe_info()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shifeng Li <[email protected]>
[ Upstream commit 2b78832f50c4d711e161b166d7d8790968051546 ]
When removing the irdma driver or unplugging its aux device, the ccq queue is released before destorying the cqp_cmpl_wq queue. But in the window, there may still be completion events for wqes. That will cause a UAF in irdma_sc_ccq_get_cqe_info().
[34693.333191] BUG: KASAN: use-after-free in irdma_sc_ccq_get_cqe_info+0x82f/0x8c0 [irdma] [34693.333194] Read of size 8 at addr ffff889097f80818 by task kworker/u67:1/26327 [34693.333194] [34693.333199] CPU: 9 PID: 26327 Comm: kworker/u67:1 Kdump: loaded Tainted: G O --------- -t - 4.18.0 #1 [34693.333200] Hardware name: SANGFOR Inspur/NULL, BIOS 4.1.13 08/01/2016 [34693.333211] Workqueue: cqp_cmpl_wq cqp_compl_worker [irdma] [34693.333213] Call Trace: [34693.333220] dump_stack+0x71/0xab [34693.333226] print_address_description+0x6b/0x290 [34693.333238] ? irdma_sc_ccq_get_cqe_info+0x82f/0x8c0 [irdma] [34693.333240] kasan_report+0x14a/0x2b0 [34693.333251] irdma_sc_ccq_get_cqe_info+0x82f/0x8c0 [irdma] [34693.333264] ? irdma_free_cqp_request+0x151/0x1e0 [irdma] [34693.333274] irdma_cqp_ce_handler+0x1fb/0x3b0 [irdma] [34693.333285] ? irdma_ctrl_init_hw+0x2c20/0x2c20 [irdma] [34693.333290] ? __schedule+0x836/0x1570 [34693.333293] ? strscpy+0x83/0x180 [34693.333296] process_one_work+0x56a/0x11f0 [34693.333298] worker_thread+0x8f/0xf40 [34693.333301] ? __kthread_parkme+0x78/0xf0 [34693.333303] ? rescuer_thread+0xc50/0xc50 [34693.333305] kthread+0x2a0/0x390 [34693.333308] ? kthread_destroy_worker+0x90/0x90 [34693.333310] ret_from_fork+0x1f/0x40
--- drivers/infiniband/hw/irdma/hw.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/infiniband/hw/irdma/hw.c +3 -3
@@ -585,9 +585,6 @@ static void irdma_destroy_cqp(struct irdma_pci_f *rf)struct irdma_cqp *cqp = &rf->cqp;int status =0 ; -if (rf->cqp_cmpl_wq) -destroy_workqueue (rf->cqp_cmpl_wq); - status =irdma_sc_cqp_destroy (dev->cqp);if (status)ibdev_dbg (to_ibdev (dev),"ERR: Destroy CQP failed %d\n" , status);
@@ -752,6 +749,9 @@ static void irdma_destroy_ccq(struct irdma_pci_f *rf)struct irdma_ccq *ccq = &rf->ccq;int status =0 ; +if (rf->cqp_cmpl_wq) +destroy_workqueue (rf->cqp_cmpl_wq); +if (!rf->reset) status =irdma_sc_ccq_destroy (dev->ccq,0 , true);if (status)
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 95/244 arm64: dt: imx93: tqma9352-mba93xxla: Fix LPUART2 pad config
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Stein <[email protected]>
[ Upstream commit 2bfba37b3d90d6d2d499d5b0dfe99c05c38b1b54 ]
LPUART2_RTS# has an external pull-down, so do not enable the internal pull-up at the same time, use a pull-down instead.
--- arch/arm64/boot/dts/freescale/imx93-tqma9352-mba93xxla.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/freescale/imx93-tqma9352-mba93xxla.dts +1 -1
@@ -577,7 +577,7 @@ fsl,pins = < MX93_PAD_UART2_TXD__LPUART2_TX 0x31e MX93_PAD_UART2_RXD__LPUART2_RX 0x31e - MX93_PAD_SAI1_TXD0__LPUART2_RTS_B 0x31e + MX93_PAD_SAI1_TXD0__LPUART2_RTS_B 0x51e >; };
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 96/244 ARM: dts: imx6q: skov: fix ethernet clock regression
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Kerkmann <[email protected]>
[ Upstream commit 6552218f4dc47ba3c6c5b58cc1e9eb208a2b438b ]
A regression was introduced in the Skov specific i.MX6 flavor reve-mi1010ait-1cp1 device tree causing the external ethernet controller to not being selected as the clock source for the i.MX6 ethernet MAC, resulting in a none functional ethernet interface. The root cause is that the ethernet clock selection is now part of the clocks node, which is overwritten in the specific device tree and wasn't updated to contain these ethernet clocks.
--- arch/arm/boot/dts/nxp/imx/imx6q-skov-reve-mi1010ait-1cp1.dts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/nxp/imx/imx6q-skov-reve-mi1010ait-1cp1.dts +2 -2
@@ -37,9 +37,9 @@ &clks { assigned-clocks = <&clks IMX6QDL_CLK_LDB_DI0_SEL>, - <&clks IMX6QDL_CLK_LDB_DI1_SEL>; + <&clks IMX6QDL_CLK_LDB_DI1_SEL>, <&clks IMX6QDL_CLK_ENET_REF_SEL>; assigned-clock-parents = <&clks IMX6QDL_CLK_PLL5_VIDEO_DIV>, - <&clks IMX6QDL_CLK_PLL5_VIDEO_DIV>; + <&clks IMX6QDL_CLK_PLL5_VIDEO_DIV>, <&clk50m_phy>; }; &hdmi {
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 97/244 ARM: dts: rockchip: Fix sdmmc_pwrens pinmux setting for RK3128
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Bee <[email protected]>
[ Upstream commit 0c349b5001f8bdcead844484c15a0c4dfb341157 ]
RK3128's reference design uses sdmmc_pwren pincontrol as GPIO - see [0].
Let's change it in the SoC DT as well.
[0] https://github.com/rockchip-linux/kernel/commit/8c62deaf6025
--- arch/arm/boot/dts/rockchip/rk3128.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/rockchip/rk3128.dtsi +1 -1
@@ -795,7 +795,7 @@ }; sdmmc_pwren: sdmmc-pwren { - rockchip,pins = <1 RK_PB6 1 &pcfg_pull_default>; + rockchip,pins = <1 RK_PB6 RK_FUNC_GPIO &pcfg_pull_default>; }; sdmmc_bus4: sdmmc-bus4 {
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 98/244 ARM: dts: bcm2711-rpi-400: Fix delete-node of led_act
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wahren <[email protected]>
[ Upstream commit dc761f11af2e39119d3a7942e3d10615f3d900e7 ]
The LED ACT which is included from bcm2711-rpi-4-b doesn't exists on the Raspberry Pi 400. So the bcm2711-rpi-400.dts tries to use the delete-node directive in order to remove the complete node. Unfortunately the usage get broken in commit 1156e3a78bcc ("ARM: dts: bcm283x: Move ACT LED into separate dtsi") and now ACT and PWR LED using the same GPIO and this prevent probing of led-gpios on Raspberry Pi 400:
leds-gpio: probe of leds failed with error -16
So fix the delete-node directive.
--- arch/arm/boot/dts/broadcom/bcm2711-rpi-400.dts | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
arch/arm/boot/dts/broadcom/bcm2711-rpi-400.dts +1 -3
@@ -36,9 +36,7 @@ gpios = <&gpio 42 GPIO_ACTIVE_HIGH>; }; -&leds { - /delete-node/ led_act; -}; +/delete-node/ &led_act; &pm { /delete-property/ system-power-controller;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 99/244 hwmon: (acpi_power_meter) Fix 4.29 MW bug
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <[email protected]>
[ Upstream commit 1fefca6c57fb928d2131ff365270cbf863d89c88 ]
The ACPI specification says:
"If an error occurs while obtaining the meter reading or if the value is not available then an Integer with all bits set is returned"
Since the "integer" is 32 bits in case of the ACPI power meter, userspace will get a power reading of 2^32 * 1000 miliwatts (~4.29 MW) in case of such an error. This was discovered due to a lm_sensors bugreport (https://github.com/lm-sensors/lm-sensors/issues/460).
Fix this by returning -ENODATA instead.
--- drivers/hwmon/acpi_power_meter.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/hwmon/acpi_power_meter.c +4 -0
@@ -31,6 +31,7 @@#define POWER_METER_CAN_NOTIFY (1 << 3)#define POWER_METER_IS_BATTERY (1 << 8)#define UNKNOWN_HYSTERESIS 0xFFFFFFFF +#define UNKNOWN_POWER 0xFFFFFFFF#define METER_NOTIFY_CONFIG 0x80#define METER_NOTIFY_TRIP 0x81
@@ -348,6 +349,9 @@ static ssize_t show_power(struct device *dev,update_meter (resource);mutex_unlock (&resource->lock); +if (resource->power ==UNKNOWN_POWER ) +return -ENODATA ; +return sprintf (buf,"%llu\n" , resource->power *1000 ); }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 100/244 ASoC: codecs: lpass-tx-macro: set active_decimator correct default value
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neil Armstrong <[email protected]>
[ Upstream commit a2f35ed1d237c459100adb0c39bb811d7f170977 ]
The -1 value for active_decimator[dai_id] is considered as "not set", but at probe the table is initialized a 0, this prevents enabling the DEC0 Mixer since it will be considered as already set.
Initialize the table entries as -1 to fix tx_macro_tx_mixer_put().
--- sound/soc/codecs/lpass-tx-macro.c | 5 +++++ 1 file changed, 5 insertions(+)
sound/soc/codecs/lpass-tx-macro.c +5 -0
@@ -2021,6 +2021,11 @@ static int tx_macro_probe(struct platform_device *pdev) tx->dev = dev; +/* Set active_decimator default value */ + tx->active_decimator[TX_MACRO_AIF1_CAP ] =-1 ; + tx->active_decimator[TX_MACRO_AIF2_CAP ] =-1 ; + tx->active_decimator[TX_MACRO_AIF3_CAP ] =-1 ; +/* set MCLK and NPL rates */ clk_set_rate (tx->mclk,MCLK_FREQ );clk_set_rate (tx->npl,MCLK_FREQ );
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 101/244 hwmon: (nzxt-kraken2) Fix error handling path in kraken2_probe()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 35fe2ad259a3bfca15ab78c8ffb5278cb6149c89 ]
There is no point in calling hid_hw_stop() if hid_hw_start() has failed. There is no point in calling hid_hw_close() if hid_hw_open() has failed.
Update the error handling path accordingly.
--- drivers/hwmon/nzxt-kraken2.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/hwmon/nzxt-kraken2.c +2 -2
@@ -161,13 +161,13 @@ static int kraken2_probe(struct hid_device *hdev, ret =hid_hw_start (hdev,HID_CONNECT_HIDRAW );if (ret) {hid_err (hdev,"hid hw start failed with %d\n" , ret); - goto fail_and_stop; +return ret; } ret =hid_hw_open (hdev);if (ret) {hid_err (hdev,"hid hw open failed with %d\n" , ret); - goto fail_and_close; + goto fail_and_stop; } priv->hwmon_dev = hwmon_device_register_with_info(&hdev->dev, "kraken2",
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 102/244 firmware: arm_scmi: Extend perf protocol ops to get number of domains
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ulf Hansson <[email protected]>
[ Upstream commit e9090e70e618cd62ab7bf2914511e5eea31a2535 ]
Similar to other protocol ops, it's useful for an scmi module driver to get the number of supported performance domains, hence let's make this available by adding a new perf protocol callback. Note that, a user is being added from subsequent changes.
Stable-dep-of: 8e3c98d9187e ("firmware: arm_scmi: Fix frequency truncation by promoting multiplier type")
--- drivers/firmware/arm_scmi/perf.c | 8 ++++++++ include/linux/scmi_protocol.h | 2 ++ 2 files changed, 10 insertions(+)
drivers/firmware/arm_scmi/perf.c +8 -0
@@ -423,6 +423,13 @@ scmi_perf_describe_levels_get(const struct scmi_protocol_handle *ph,return ret; } +static int scmi_perf_num_domains_get (const struct scmi_protocol_handle *ph) +{ +struct scmi_perf_info *pi = ph->get_priv (ph); + +return pi->num_domains; +} +static int scmi_perf_msg_limits_set (const struct scmi_protocol_handle *ph,u32 domain,u32 max_perf,u32 min_perf) {
@@ -948,6 +955,7 @@ scmi_power_scale_get(const struct scmi_protocol_handle *ph) }static const struct scmi_perf_proto_ops perf_proto_ops = { + .num_domains_get = scmi_perf_num_domains_get, .limits_set = scmi_perf_limits_set, .limits_get = scmi_perf_limits_get, .level_set = scmi_perf_level_set,
include/linux/scmi_protocol.h +2 -0
@@ -101,6 +101,7 @@ struct scmi_clk_proto_ops {* struct scmi_perf_proto_ops - represents the various operations provided * by SCMI Performance Protocol * +* @num_domains_get: gets the number of supported performance domains * @limits_set: sets limits on the performance level of a domain * @limits_get: gets limits on the performance level of a domain * @level_set: sets the performance level of a domain
@@ -120,6 +121,7 @@ struct scmi_clk_proto_ops {* or in some other (abstract) scale */ struct scmi_perf_proto_ops { +int (*num_domains_get)(const struct scmi_protocol_handle *ph);int (*limits_set)(const struct scmi_protocol_handle *ph,u32 domain,u32 max_perf,u32 min_perf); int (*limits_get)(const struct scmi_protocol_handle *ph, u32 domain,
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 103/244 firmware: arm_scmi: Extend perf protocol ops to get information of a domain
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ulf Hansson <[email protected]>
[ Upstream commit 3d99ed60721bf2e108c8fc660775766057689a92 ]
Similar to other protocol ops, it's useful for an scmi module driver to get some generic information of a performance domain. Therefore, let's add a new callback to provide this information. The information is currently limited to the name of the performance domain and whether the set-level operation is supported, although this can easily be extended if we find the need for it.
Stable-dep-of: 8e3c98d9187e ("firmware: arm_scmi: Fix frequency truncation by promoting multiplier type")
--- drivers/firmware/arm_scmi/perf.c | 47 ++++++++++++++++++++------------ include/linux/scmi_protocol.h | 8 ++++++ 2 files changed, 38 insertions(+), 17 deletions(-)
drivers/firmware/arm_scmi/perf.c +30 -17
@@ -145,7 +145,6 @@ struct scmi_msg_resp_perf_describe_levels_v4 {struct perf_dom_info {u32 id;bool set_limits; -bool set_perf;bool perf_limit_notify;bool perf_level_notify;bool perf_fastchannels;
@@ -154,7 +153,7 @@ struct perf_dom_info {u32 sustained_freq_khz;u32 sustained_perf_level;u32 mult_factor; -char name[SCMI_MAX_STR_SIZE ]; +struct scmi_perf_domain_info info;struct scmi_opp opp[MAX_OPPS ];struct scmi_fc_info *fc_info;struct xarray opps_by_idx;
@@ -257,7 +256,7 @@ scmi_perf_domain_attributes_get(const struct scmi_protocol_handle *ph, flags =le32_to_cpu (attr->flags); dom_info->set_limits =SUPPORTS_SET_LIMITS (flags); - dom_info->set_perf =SUPPORTS_SET_PERF_LVL (flags); + dom_info->info.set_perf =SUPPORTS_SET_PERF_LVL (flags); dom_info->perf_limit_notify =SUPPORTS_PERF_LIMIT_NOTIFY (flags); dom_info->perf_level_notify =SUPPORTS_PERF_LEVEL_NOTIFY (flags); dom_info->perf_fastchannels =SUPPORTS_PERF_FASTCHANNELS (flags);
@@ -276,7 +275,8 @@ scmi_perf_domain_attributes_get(const struct scmi_protocol_handle *ph, dom_info->mult_factor = (dom_info->sustained_freq_khz *1000 ) / dom_info->sustained_perf_level; -strscpy (dom_info->name, attr->name,SCMI_SHORT_NAME_MAX_SIZE ); +strscpy (dom_info->info.name, attr->name, +SCMI_SHORT_NAME_MAX_SIZE ); } ph->xops->xfer_put (ph, t);
@@ -288,7 +288,7 @@ scmi_perf_domain_attributes_get(const struct scmi_protocol_handle *ph,if (!ret &&PROTOCOL_REV_MAJOR (version) >=0x3 &&SUPPORTS_EXTENDED_NAMES (flags)) ph->hops->extended_name_get (ph,PERF_DOMAIN_NAME_GET , - dom_info->id, dom_info->name, + dom_info->id, dom_info->info.name,SCMI_MAX_STR_SIZE );if (dom_info->level_indexing_mode) {
@@ -430,6 +430,29 @@ static int scmi_perf_num_domains_get(const struct scmi_protocol_handle *ph)return pi->num_domains; } +static inline struct perf_dom_info * +scmi_perf_domain_lookup (const struct scmi_protocol_handle *ph,u32 domain) +{ +struct scmi_perf_info *pi = ph->get_priv (ph); + +if (domain >= pi->num_domains) +return ERR_PTR (-EINVAL ); + +return pi->dom_info + domain; +} + +static const struct scmi_perf_domain_info * +scmi_perf_info_get (const struct scmi_protocol_handle *ph,u32 domain) +{ +struct perf_dom_info *dom; + + dom =scmi_perf_domain_lookup (ph, domain); +if (IS_ERR (dom)) +return ERR_PTR (-EINVAL ); + +return &dom->info; +} +static int scmi_perf_msg_limits_set (const struct scmi_protocol_handle *ph,u32 domain,u32 max_perf,u32 min_perf) {
@@ -453,17 +476,6 @@ static int scmi_perf_msg_limits_set(const struct scmi_protocol_handle *ph,return ret; } -static inline struct perf_dom_info * -scmi_perf_domain_lookup (const struct scmi_protocol_handle *ph,u32 domain) -{ -struct scmi_perf_info *pi = ph->get_priv (ph); - -if (domain >= pi->num_domains) -return ERR_PTR (-EINVAL ); - -return pi->dom_info + domain; -} -static int __scmi_perf_limits_set (const struct scmi_protocol_handle *ph,struct perf_dom_info *dom,u32 max_perf,u32 min_perf)
@@ -819,7 +831,7 @@ static int scmi_dvfs_device_opps_add(const struct scmi_protocol_handle *ph, }dev_dbg (dev,"[%d][%s]:: Registered OPP[%d] %lu\n" , - domain, dom->name, idx, freq); + domain, dom->info.name, idx, freq); }return 0 ; }
@@ -956,6 +968,7 @@ scmi_power_scale_get(const struct scmi_protocol_handle *ph)static const struct scmi_perf_proto_ops perf_proto_ops = { .num_domains_get = scmi_perf_num_domains_get, + .info_get = scmi_perf_info_get, .limits_set = scmi_perf_limits_set, .limits_get = scmi_perf_limits_get, .level_set = scmi_perf_level_set,
include/linux/scmi_protocol.h +8 -0
@@ -97,11 +97,17 @@ struct scmi_clk_proto_ops { u32 clk_id); }; +struct scmi_perf_domain_info { +char name[SCMI_MAX_STR_SIZE ]; +bool set_perf; +}; +/** * struct scmi_perf_proto_ops - represents the various operations provided * by SCMI Performance Protocol * * @num_domains_get: gets the number of supported performance domains +* @info_get: get the information of a performance domain * @limits_set: sets limits on the performance level of a domain * @limits_get: gets limits on the performance level of a domain * @level_set: sets the performance level of a domain
@@ -122,6 +128,8 @@ struct scmi_clk_proto_ops {*/ struct scmi_perf_proto_ops {int (*num_domains_get)(const struct scmi_protocol_handle *ph); +const struct scmi_perf_domain_info __must_check *(*info_get) + (const struct scmi_protocol_handle *ph,u32 domain);int (*limits_set)(const struct scmi_protocol_handle *ph,u32 domain,u32 max_perf,u32 min_perf); int (*limits_get)(const struct scmi_protocol_handle *ph, u32 domain,
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 104/244 firmware: arm_scmi: Fix frequency truncation by promoting multiplier type
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <[email protected]>
[ Upstream commit 8e3c98d9187e09274fc000a7d1a77b070a42d259 ]
Fix the possible frequency truncation for all values equal to or greater 4GHz on 64bit machines by updating the multiplier 'mult_factor' to 'unsigned long' type. It is also possible that the multiplier itself can be greater than or equal to 2^32. So we need to also fix the equation computing the value of the multiplier.
--- drivers/firmware/arm_scmi/perf.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/firmware/arm_scmi/perf.c +3 -3
@@ -152,7 +152,7 @@ struct perf_dom_info {u32 opp_count;u32 sustained_freq_khz;u32 sustained_perf_level; -u32 mult_factor; +unsigned long mult_factor;struct scmi_perf_domain_info info;struct scmi_opp opp[MAX_OPPS ];struct scmi_fc_info *fc_info;
@@ -273,8 +273,8 @@ scmi_perf_domain_attributes_get(const struct scmi_protocol_handle *ph, dom_info->mult_factor =1000 ; else dom_info->mult_factor = - (dom_info->sustained_freq_khz *1000 ) / - dom_info->sustained_perf_level; + (dom_info->sustained_freq_khz *1000UL ) + / dom_info->sustained_perf_level;strscpy (dom_info->info.name, attr->name,SCMI_SHORT_NAME_MAX_SIZE ); }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 105/244 firmware: arm_scmi: Simplify error path in scmi_dvfs_device_opps_add()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ulf Hansson <[email protected]>
[ Upstream commit 033ca4de129646e9969a6838b44cca0fac38e219 ]
Let's simplify the code in scmi_dvfs_device_opps_add() by using dev_pm_opp_remove_all_dynamic() in the error path.
Stable-dep-of: 77f5032e94f2 ("firmware: arm_scmi: Fix possible frequency truncation when using level indexing mode")
--- drivers/firmware/arm_scmi/perf.c | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-)
drivers/firmware/arm_scmi/perf.c +4 -12
@@ -799,7 +799,6 @@ static int scmi_dvfs_device_opps_add(const struct scmi_protocol_handle *ph, {int idx, ret, domain;unsigned long freq; -struct scmi_opp *opp;struct perf_dom_info *dom; domain =scmi_dev_domain_id (dev);
@@ -810,23 +809,16 @@ static int scmi_dvfs_device_opps_add(const struct scmi_protocol_handle *ph,if (IS_ERR (dom))return PTR_ERR (dom); -for (opp = dom->opp, idx =0 ; idx < dom->opp_count; idx++, opp++) { +for (idx =0 ; idx < dom->opp_count; idx++) {if (!dom->level_indexing_mode) - freq = opp->perf * dom->mult_factor; + freq = dom->opp[idx].perf * dom->mult_factor;else - freq = opp->indicative_freq *1000 ; + freq = dom->opp[idx].indicative_freq *1000 ; ret =dev_pm_opp_add (dev, freq,0 );if (ret) {dev_warn (dev,"failed to add opp %luHz\n" , freq); - -while (idx-- >0 ) { -if (!dom->level_indexing_mode) - freq = (--opp)->perf * dom->mult_factor; -else - freq = (--opp)->indicative_freq *1000 ; -dev_pm_opp_remove (dev, freq); - } +dev_pm_opp_remove_all_dynamic (dev);return ret; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 106/244 firmware: arm_scmi: Fix possible frequency truncation when using level indexing mode
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <[email protected]>
[ Upstream commit 77f5032e94f244ba08db51e17ca8f37bd7ff9acb ]
The multiplier is already promoted to unsigned long, however the frequency calculations done when using level indexing mode doesn't use the multiplier computed. It instead hardcodes the multiplier value of 1000 at all the usage sites.
Clean that up by assigning the multiplier value of 1000 when using the perf level indexing mode and update the frequency calculations to use the multiplier instead. It should fix the possible frequency truncation for all the values greater than or equal to 4GHz on 64-bit machines.
--- drivers/firmware/arm_scmi/perf.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/firmware/arm_scmi/perf.c +7 -5
@@ -268,7 +268,8 @@ scmi_perf_domain_attributes_get(const struct scmi_protocol_handle *ph, dom_info->sustained_perf_level =le32_to_cpu (attr->sustained_perf_level);if (!dom_info->sustained_freq_khz || - !dom_info->sustained_perf_level) + !dom_info->sustained_perf_level || + dom_info->level_indexing_mode)/* CPUFreq converts to kHz, hence default 1000 */ dom_info->mult_factor =1000 ;else
@@ -813,7 +814,7 @@ static int scmi_dvfs_device_opps_add(const struct scmi_protocol_handle *ph,if (!dom->level_indexing_mode) freq = dom->opp[idx].perf * dom->mult_factor;else - freq = dom->opp[idx].indicative_freq *1000 ; + freq = dom->opp[idx].indicative_freq * dom->mult_factor; ret =dev_pm_opp_add (dev, freq,0 );if (ret) {
@@ -862,7 +863,8 @@ static int scmi_dvfs_freq_set(const struct scmi_protocol_handle *ph, u32 domain, }else {struct scmi_opp *opp; - opp =LOOKUP_BY_FREQ (dom->opps_by_freq, freq /1000 ); + opp =LOOKUP_BY_FREQ (dom->opps_by_freq, + freq / dom->mult_factor);if (!opp)return -EIO ;
@@ -896,7 +898,7 @@ static int scmi_dvfs_freq_get(const struct scmi_protocol_handle *ph, u32 domain,if (!opp)return -EIO ; - *freq = opp->indicative_freq *1000 ; + *freq = opp->indicative_freq * dom->mult_factor; }return ret;
@@ -919,7 +921,7 @@ static int scmi_dvfs_est_power_get(const struct scmi_protocol_handle *ph,if (!dom->level_indexing_mode) opp_freq = opp->perf * dom->mult_factor;else - opp_freq = opp->indicative_freq *1000 ; + opp_freq = opp->indicative_freq * dom->mult_factor;if (opp_freq < *freq)continue ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 107/244 ASoC: wm_adsp: fix memleak in wm_adsp_buffer_populate
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dinghao Liu <[email protected]>
[ Upstream commit 29046a78a3c0a1f8fa0427f164caa222f003cf5b ]
When wm_adsp_buffer_read() fails, we should free buf->regions. Otherwise, the callers of wm_adsp_buffer_populate() will directly free buf on failure, which makes buf->regions a leaked memory.
--- sound/soc/codecs/wm_adsp.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
sound/soc/codecs/wm_adsp.c +6 -2
@@ -1451,12 +1451,12 @@ static int wm_adsp_buffer_populate(struct wm_adsp_compr_buf *buf) ret =wm_adsp_buffer_read (buf, caps->region_defs[i].base_offset, ®ion->base_addr);if (ret <0 ) -return ret; + goto err; ret =wm_adsp_buffer_read (buf, caps->region_defs[i].size_offset, &offset);if (ret <0 ) -return ret; + goto err; region->cumulative_size = offset;
@@ -1467,6 +1467,10 @@ static int wm_adsp_buffer_populate(struct wm_adsp_compr_buf *buf) }return 0 ; + +err: +kfree (buf->regions); +return ret; }static void wm_adsp_buffer_clear (struct wm_adsp_compr_buf *buf)
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 108/244 RDMA/core: Fix umem iterator when PAGE_SIZE is greater then HCA pgsz
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Marciniszyn <[email protected]>
[ Upstream commit 4fbc3a52cd4d14de3793f4b2c721d7306ea84cf9 ]
64k pages introduce the situation in this diagram when the HCA 4k page size is being used:
+-------------------------------------------+ <--- 64k aligned VA | | | HCA 4k page | | | +-------------------------------------------+ | o | | | | o | | | | o | +-------------------------------------------+ | | | HCA 4k page | | | +-------------------------------------------+ <--- Live HCA page |OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO| <--- offset | | <--- VA | MR data | +-------------------------------------------+ | | | HCA 4k page | | | +-------------------------------------------+ | o | | | | o | | | | o | +-------------------------------------------+ | | | HCA 4k page | | | +-------------------------------------------+
The VA addresses are coming from rdma-core in this diagram can be arbitrary, but for 64k pages, the VA may be offset by some number of HCA 4k pages and followed by some number of HCA 4k pages.
The current iterator doesn't account for either the preceding 4k pages or the following 4k pages.
Fix the issue by extending the ib_block_iter to contain the number of DMA pages like comment [1] says and by using __sg_advance to start the iterator at the first live HCA page.
The changes are contained in a parallel set of iterator start and next functions that are umem aware and specific to umem since there is one user of the rdma_for_each_block() without umem.
These two fixes prevents the extra pages before and after the user MR data.
Fix the preceding pages by using the __sq_advance field to start at the first 4k page containing MR data.
Fix the following pages by saving the number of pgsz blocks in the iterator state and downcounting on each next.
This fix allows for the elimination of the small page crutch noted in the Fixes.
--- drivers/infiniband/core/umem.c | 6 ------ include/rdma/ib_umem.h | 9 ++++++++- include/rdma/ib_verbs.h | 1 + 3 files changed, 9 insertions(+), 7 deletions(-)
drivers/infiniband/core/umem.c +0 -6
@@ -96,12 +96,6 @@ unsigned long ib_umem_find_best_pgsz(struct ib_umem *umem,return page_size; } -/* rdma_for_each_block() has a bug if the page size is smaller than the -* page size used to build the umem. For now prevent smaller page sizes -* from being returned. -*/ - pgsz_bitmap &=GENMASK (BITS_PER_LONG -1 ,PAGE_SHIFT ); -/* The best result is the smallest page size that results in the minimum * number of required pages. Compute the largest page size that could * work based on VA address bits that don't change.
include/rdma/ib_umem.h +8 -1
@@ -77,6 +77,13 @@ static inline void __rdma_umem_block_iter_start(struct ib_block_iter *biter, {__rdma_block_iter_start (biter, umem->sgt_append.sgt.sgl, umem->sgt_append.sgt.nents, pgsz); + biter->__sg_advance =ib_umem_offset (umem) & ~(pgsz -1 ); + biter->__sg_numblocks =ib_umem_num_dma_blocks (umem, pgsz); +} + +static inline bool __rdma_umem_block_iter_next (struct ib_block_iter *biter) +{ +return __rdma_block_iter_next (biter) && biter->__sg_numblocks--; }/**
@@ -92,7 +99,7 @@ static inline void __rdma_umem_block_iter_start(struct ib_block_iter *biter,*/ #define rdma_umem_for_each_dma_block (umem, biter, pgsz) \ for (__rdma_umem_block_iter_start(biter, umem, pgsz); \ - __rdma_block_iter_next(biter);) + __rdma_umem_block_iter_next(biter);)#ifdef CONFIG_INFINIBAND_USER_MEM
include/rdma/ib_verbs.h +1 -0
@@ -2846,6 +2846,7 @@ struct ib_block_iter {/* internal states */ struct scatterlist *__sg;/* sg holding the current aligned block */ dma_addr_t __dma_addr;/* unaligned DMA address of this block */ +size_t __sg_numblocks;/* ib_umem_num_dma_blocks() */ unsigned int __sg_nents;/* number of SG entries */ unsigned int __sg_advance;/* number of bytes to advance in sg in next step */ unsigned int __pg_bit;/* alignment of current block */
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 109/244 RDMA/irdma: Ensure iWarp QP queue memory is OS paged aligned
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Marciniszyn <[email protected]>
[ Upstream commit 0a5ec366de7e94192669ba08de6ed336607fd282 ]
The SQ is shared for between kernel and used by storing the kernel page pointer and passing that to a kmap_atomic().
This then requires that the alignment is PAGE_SIZE aligned.
Fix by adding an iWarp specific alignment check.
--- drivers/infiniband/hw/irdma/verbs.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/infiniband/hw/irdma/verbs.c +5 -0
@@ -2935,6 +2935,11 @@ static int irdma_reg_user_mr_type_qp(struct irdma_mem_reg_req req,int err;u8 lvl; +/* iWarp: Catch page not starting on OS page boundary */ +if (!rdma_protocol_roce (&iwdev->ibdev,1 ) && +ib_umem_offset (iwmr->region)) +return -EINVAL ; + total = req.sq_pages + req.rq_pages +1 ;if (total > iwmr->page_cnt)return -EINVAL ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 110/244 RDMA/irdma: Fix support for 64k pages
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Marciniszyn <[email protected]>
[ Upstream commit 03769f72d66edab82484449ed594cb6b00ae0223 ]
Virtual QP and CQ require a 4K HW page size but the driver passes PAGE_SIZE to ib_umem_find_best_pgsz() instead.
Fix this by using the appropriate 4k value in the bitmap passed to ib_umem_find_best_pgsz().
--- drivers/infiniband/hw/irdma/verbs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/irdma/verbs.c +1 -1
@@ -2903,7 +2903,7 @@ static struct irdma_mr *irdma_alloc_iwmr(struct ib_umem *region, iwmr->type = reg_type; pgsz_bitmap = (reg_type ==IRDMA_MEMREG_TYPE_MEM ) ? - iwdev->rf->sc_dev.hw_attrs.page_size_cap :PAGE_SIZE ; + iwdev->rf->sc_dev.hw_attrs.page_size_cap :SZ_4K ; iwmr->page_size =ib_umem_find_best_pgsz (region, pgsz_bitmap, virt);if (unlikely (!iwmr->page_size)) {
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 111/244 RDMA/irdma: Avoid free the non-cqp_request scratch
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shifeng Li <[email protected]>
[ Upstream commit e3e82fcb79eeb3f1a88a89f676831773caff514a ]
When creating ceq_0 during probing irdma, cqp.sc_cqp will be sent as a cqp_request to cqp->sc_cqp.sq_ring. If the request is pending when removing the irdma driver or unplugging its aux device, cqp.sc_cqp will be dereferenced as wrong struct in irdma_free_pending_cqp_request().
PID: 3669 TASK: ffff88aef892c000 CPU: 28 COMMAND: "kworker/28:0"
#0 [fffffe0000549e38] crash_nmi_callback at ffffffff810e3a34 #1 [fffffe0000549e40] nmi_handle at ffffffff810788b2 #2 [fffffe0000549ea0] default_do_nmi at ffffffff8107938f #3 [fffffe0000549eb8] do_nmi at ffffffff81079582 #4 [fffffe0000549ef0] end_repeat_nmi at ffffffff82e016b4
[exception RIP: native_queued_spin_lock_slowpath+1291]
RIP: ffffffff8127e72b RSP: ffff88aa841ef778 RFLAGS: 00000046
RAX: 0000000000000000 RBX: ffff88b01f849700 RCX: ffffffff8127e47e
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff83857ec0
RBP: ffff88afe3e4efc8 R8: ffffed15fc7c9dfa R9: ffffed15fc7c9dfa
R10: 0000000000000001 R11: ffffed15fc7c9df9 R12: 0000000000740000
R13: ffff88b01f849708 R14: 0000000000000003 R15: ffffed1603f092e1
ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0000 -- <NMI exception stack> --
#5 [ffff88aa841ef778] native_queued_spin_lock_slowpath at ffffffff8127e72b #6 [ffff88aa841ef7b0] _raw_spin_lock_irqsave at ffffffff82c22aa4
#7 [ffff88aa841ef7c8] __wake_up_common_lock at ffffffff81257363
#8 [ffff88aa841ef888] irdma_free_pending_cqp_request at ffffffffa0ba12cc [irdma] #9 [ffff88aa841ef958] irdma_cleanup_pending_cqp_op at ffffffffa0ba1469 [irdma] #10 [ffff88aa841ef9c0] irdma_ctrl_deinit_hw at ffffffffa0b2989f [irdma] #11 [ffff88aa841efa28] irdma_remove at ffffffffa0b252df [irdma]
#12 [ffff88aa841efae8] auxiliary_bus_remove at ffffffff8219afdb
#13 [ffff88aa841efb00] device_release_driver_internal at ffffffff821882e6 #14 [ffff88aa841efb38] bus_remove_device at ffffffff82184278
#15 [ffff88aa841efb88] device_del at ffffffff82179d23
#16 [ffff88aa841efc48] ice_unplug_aux_dev at ffffffffa0eb1c14 [ice] #17 [ffff88aa841efc68] ice_service_task at ffffffffa0d88201 [ice] #18 [ffff88aa841efde8] process_one_work at ffffffff811c589a
#19 [ffff88aa841efe60] worker_thread at ffffffff811c71ff
#20 [ffff88aa841eff10] kthread at ffffffff811d87a0
#21 [ffff88aa841eff50] ret_from_fork at ffffffff82e0022f
--- drivers/infiniband/hw/irdma/hw.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/infiniband/hw/irdma/hw.c +1 -3
@@ -1184,7 +1184,6 @@ static int irdma_create_ceq(struct irdma_pci_f *rf, struct irdma_ceq *iwceq,int status;struct irdma_ceq_init_info info = {};struct irdma_sc_dev *dev = &rf->sc_dev; -u64 scratch;u32 ceq_size; info.ceq_id = ceq_id;
@@ -1205,14 +1204,13 @@ static int irdma_create_ceq(struct irdma_pci_f *rf, struct irdma_ceq *iwceq, iwceq->sc_ceq.ceq_id = ceq_id; info.dev = dev; info.vsi = vsi; - scratch = (uintptr_t )&rf->cqp.sc_cqp; status =irdma_sc_ceq_init (&iwceq->sc_ceq, &info);if (!status) {if (dev->ceq_valid) status =irdma_cqp_ceq_cmd (&rf->sc_dev, &iwceq->sc_ceq,IRDMA_OP_CEQ_CREATE );else - status =irdma_sc_cceq_create (&iwceq->sc_ceq, scratch); + status =irdma_sc_cceq_create (&iwceq->sc_ceq,0 ); }if (status) {
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 112/244 drm/bridge: tc358768: select CONFIG_VIDEOMODE_HELPERS
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 26513300978f7285c3e776c144f27ef71be61f57 ]
A dependency on this feature was recently introduced:
x86_64-linux-ld: vmlinux.o: in function `tc358768_bridge_pre_enable':
tc358768.c:(.text+0xbe3dae): undefined reference to `drm_display_mode_to_videomode'
Make sure this is always enabled.
--- drivers/gpu/drm/bridge/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/bridge/Kconfig +1 -0
@@ -313,6 +313,7 @@ config DRM_TOSHIBA_TC358768 select REGMAP_I2C select DRM_PANEL select DRM_MIPI_DSI + select VIDEOMODE_HELPERS help Toshiba TC358768AXBG/TC358778XBG DSI bridge chip driver.
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 113/244 arm64: dts: imx8mp: imx8mq: Add parkmode-disable-ss-quirk on DWC3
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Rossi <[email protected]>
[ Upstream commit 209043cf092d7b0d4739921b3f11d6d0b451eabf ]
The i.MX8MP and i.MX8MQ devices both use the same DWC3 controller and are both affected by a known issue with the controller due to specific behaviour when park mode is enabled in SuperSpeed host mode operation.
Under heavy USB traffic from multiple endpoints the controller will sometimes incorrectly process transactions such that some transactions are lost, or the controller may hang when processing transactions. When the controller hangs it does not recover.
This issue is documented partially within the linux-imx vendor kernel which references a Synopsys STAR number 9001415732 in commits [1] and additional details in [2]. Those commits provide some additional controller internal implementation specifics around the incorrect behaviour of the SuperSpeed host controller operation when park mode is enabled.
The summary of this issue is that the host controller can incorrectly enter/exit park mode such that part of the controller is in a state which behaves as if in park mode even though it is not. In this state the controller incorrectly calculates the number of TRBs available which results in incorrect access of the internal caches causing the overwrite of pending requests in the cache which should have been processed but are ignored. This can cause the controller to drop the requests or hang waiting for the pending state of the dropped requests.
The workaround for this issue is to disable park mode for SuperSpeed operation of the controller through the GUCTL1[17] bit. This is already available as a quirk for the DWC3 controller and can be enabled via the 'snps,parkmode-disable-ss-quirk' device tree property.
It is possible to replicate this failure on an i.MX8MP EVK with a USB Hub connecting 4 SuperSpeed USB flash drives. Performing continuous small read operations (dd if=/dev/sd... of=/dev/null bs=16) on the block devices will result in device errors initially and will eventually result in the controller hanging.
[13240.896936] xhci-hcd xhci-hcd.0.auto: WARN Event TRB for slot 4 ep 2 with no TDs queued? [13240.990708] usb 2-1.3: reset SuperSpeed USB device number 5 using xhci-hcd [13241.015582] sd 2:0:0:0: [sdc] tag#0 UNKNOWN(0x2003) Result: hostbyte=0x07 driverbyte=DRIVER_OK cmd_age=0s [13241.025198] sd 2:0:0:0: [sdc] tag#0 CDB: opcode=0x28 28 00 00 00 03 e0 00 01 00 00 [13241.032949] I/O error, dev sdc, sector 992 op 0x0:(READ) flags 0x80700 phys_seg 25 prio class 2 [13272.150710] usb 2-1.2: reset SuperSpeed USB device number 4 using xhci-hcd [13272.175469] sd 1:0:0:0: [sdb] tag#0 UNKNOWN(0x2003) Result: hostbyte=0x03 driverbyte=DRIVER_OK cmd_age=31s [13272.185365] sd 1:0:0:0: [sdb] tag#0 CDB: opcode=0x28 28 00 00 00 03 e0 00 01 00 00 [13272.193385] I/O error, dev sdb, sector 992 op 0x0:(READ) flags 0x80700 phys_seg 18 prio class 2 [13434.846556] xhci-hcd xhci-hcd.0.auto: xHCI host not responding to stop endpoint command [13434.854592] xhci-hcd xhci-hcd.0.auto: xHCI host controller not responding, assume dead [13434.862553] xhci-hcd xhci-hcd.0.auto: HC died; cleaning up
[1] https://github.com/nxp-imx/linux-imx/commit/97a5349d936b08cf301730b59e4e8855283f815c
[2] https://github.com/nxp-imx/linux-imx/commit/b4b5cbc5a12d7c3b920d1d7cba0ada3379e4e42b
--- arch/arm64/boot/dts/freescale/imx8mp.dtsi | 2 ++ arch/arm64/boot/dts/freescale/imx8mq.dtsi | 2 ++ 2 files changed, 4 insertions(+)
arch/arm64/boot/dts/freescale/imx8mp.dtsi +2 -0
@@ -2030,6 +2030,7 @@ phys = <&usb3_phy0>, <&usb3_phy0>; phy-names = "usb2-phy", "usb3-phy"; snps,gfladj-refclk-lpm-sel-quirk; + snps,parkmode-disable-ss-quirk; }; };
@@ -2072,6 +2073,7 @@ phys = <&usb3_phy1>, <&usb3_phy1>; phy-names = "usb2-phy", "usb3-phy"; snps,gfladj-refclk-lpm-sel-quirk; + snps,parkmode-disable-ss-quirk; }; };
arch/arm64/boot/dts/freescale/imx8mq.dtsi +2 -0
@@ -1649,6 +1649,7 @@ phys = <&usb3_phy0>, <&usb3_phy0>; phy-names = "usb2-phy", "usb3-phy"; power-domains = <&pgc_otg1>; + snps,parkmode-disable-ss-quirk; status = "disabled"; };
@@ -1680,6 +1681,7 @@ phys = <&usb3_phy1>, <&usb3_phy1>; phy-names = "usb2-phy", "usb3-phy"; power-domains = <&pgc_otg2>; + snps,parkmode-disable-ss-quirk; status = "disabled"; };
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 114/244 ARM: dts: imx6ul-pico: Describe the Ethernet PHY clock
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <[email protected]>
[ Upstream commit d951f8f5f23a9417b7952f22b33784c73caa1ebb ]
Since commit c7e73b5051d6 ("ARM: imx: mach-imx6ul: remove 14x14 EVK specific PHY fixup")thet Ethernet PHY is no longer configured via code in board file.
This caused Ethernet to stop working.
Fix this problem by describing the clocks and clock-names to the Ethernet PHY node so that the KSZ8081 chip can be clocked correctly.
--- arch/arm/boot/dts/nxp/imx/imx6ul-pico.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/arm/boot/dts/nxp/imx/imx6ul-pico.dtsi +2 -0
@@ -121,6 +121,8 @@ max-speed = <100>; interrupt-parent = <&gpio5>; interrupts = <6 IRQ_TYPE_LEVEL_LOW>; + clocks = <&clks IMX6UL_CLK_ENET_REF>; + clock-names = "rmii-ref"; }; }; };
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 115/244 io_uring/kbuf: Fix an NULL vs IS_ERR() bug in io_alloc_pbuf_ring()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit e53f7b54b1fdecae897f25002ff0cff04faab228 ]
The io_mem_alloc() function returns error pointers, not NULL. Update the check accordingly.
--- io_uring/kbuf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
io_uring/kbuf.c +2 -2
@@ -623,8 +623,8 @@ static int io_alloc_pbuf_ring(struct io_ring_ctx *ctx, ibf =io_lookup_buf_free_entry (ctx, ring_size);if (!ibf) { ptr =io_mem_alloc (ring_size); -if (!ptr) -return -ENOMEM ; +if (IS_ERR (ptr)) +return PTR_ERR (ptr);/* Allocate and store deferred free entry */ ibf =kmalloc (sizeof (*ibf),GFP_KERNEL_ACCOUNT );
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 116/244 io_uring/kbuf: check for buffer list readiness after NULL check
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <[email protected]>
[ Upstream commit 9865346b7e8374b57f1c3ccacdc77846c6352ff4 ]
Move the buffer list 'is_ready' check below the validity check for the buffer list for a given group.
--- io_uring/kbuf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
io_uring/kbuf.c +2 -2
@@ -743,6 +743,8 @@ void *io_pbuf_get_address(struct io_ring_ctx *ctx, unsigned long bgid) bl =__io_buffer_get_list (ctx,smp_load_acquire (&ctx->io_bl), bgid); +if (!bl || !bl->is_mmap) +return NULL ;/* * Ensure the list is fully setup. Only strictly needed for RCU lookup * via mmap, and in that case only for the array indexed groups. For
@@ -750,8 +752,6 @@ void *io_pbuf_get_address(struct io_ring_ctx *ctx, unsigned long bgid)*/ if (!smp_load_acquire (&bl->is_ready))return NULL ; -if (!bl || !bl->is_mmap) -return NULL ;return bl->buf_ring; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 117/244 tracing: Fix a warning when allocating buffered events fails
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Pavlu <[email protected]>
[ Upstream commit 34209fe83ef8404353f91ab4ea4035dbc9922d04 ]
Function trace_buffered_event_disable() produces an unexpected warning when the previous call to trace_buffered_event_enable() fails to allocate pages for buffered events.
The situation can occur as follows:
* The counter trace_buffered_event_ref is at 0.
* The soft mode gets enabled for some event and trace_buffered_event_enable() is called. The function increments trace_buffered_event_ref to 1 and starts allocating event pages.
* The allocation fails for some page and trace_buffered_event_disable() is called for cleanup.
* Function trace_buffered_event_disable() decrements trace_buffered_event_ref back to 0, recognizes that it was the last use of buffered events and frees all allocated pages.
* The control goes back to trace_buffered_event_enable() which returns. The caller of trace_buffered_event_enable() has no information that the function actually failed.
* Some time later, the soft mode is disabled for the same event. Function trace_buffered_event_disable() is called. It warns on "WARN_ON_ONCE(!trace_buffered_event_ref)" and returns.
Buffered events are just an optimization and can handle failures. Make trace_buffered_event_enable() exit on the first failure and left any cleanup later to when trace_buffered_event_disable() is called.
--- kernel/trace/trace.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)
kernel/trace/trace.c +5 -6
@@ -2769,8 +2769,11 @@ void trace_buffered_event_enable(void)for_each_tracing_cpu (cpu) { page =alloc_pages_node (cpu_to_node (cpu),GFP_KERNEL | __GFP_NORETRY,0 ); -if (!page) - goto failed; +/* This is just an optimization and can handle failures */ +if (!page) { +pr_err ("Failed to allocate event buffer\n" ); +break ; + } event =page_address (page);memset (event,0 ,sizeof (*event));
@@ -2784,10 +2787,6 @@ void trace_buffered_event_enable(void)WARN_ON_ONCE (1 );preempt_enable (); } - -return ; - failed: -trace_buffered_event_disable (); }static void enable_trace_buffered_event (void *data)
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 118/244 scsi: be2iscsi: Fix a memleak in beiscsi_init_wrb_handle()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dinghao Liu <[email protected]>
[ Upstream commit 235f2b548d7f4ac5931d834f05d3f7f5166a2e72 ]
When an error occurs in the for loop of beiscsi_init_wrb_handle(), we should free phwi_ctxt->be_wrbq before returning an error code to prevent potential memleak.
--- drivers/scsi/be2iscsi/be_main.c | 1 + 1 file changed, 1 insertion(+)
drivers/scsi/be2iscsi/be_main.c +1 -0
@@ -2710,6 +2710,7 @@ static int beiscsi_init_wrb_handle(struct beiscsi_hba *phba)kfree (pwrb_context->pwrb_handle_base);kfree (pwrb_context->pwrb_handle_basestd); } +kfree (phwi_ctxt->be_wrbq);return -ENOMEM ; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 119/244 arm64: dts: imx8-ss-lsio: Add PWM interrupts
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <[email protected]>
[ Upstream commit 6c32f75d67a8c1ea94295234db7c11a29c189e6f ]
The PWM interrupt is mandatory per imx-pwm.yaml.
Add them.
This also fixes the followig schema warning:
imx8qm-apalis-v1.1-ixora-v1.2.dtb: pwm@5d000000: 'oneOf' conditional failed, one must be fixed:
'interrupts' is a required property
'interrupts-extended' is a required property
from schema $id: http://devicetree.org/schemas/pwm/imx-pwm.yaml#
Stable-dep-of: d863a2f4f475 ("arm64: dts: freescale: imx8-ss-lsio: Fix #pwm-cells")
--- arch/arm64/boot/dts/freescale/imx8-ss-lsio.dtsi | 4 ++++ 1 file changed, 4 insertions(+)
arch/arm64/boot/dts/freescale/imx8-ss-lsio.dtsi +4 -0
@@ -37,6 +37,7 @@ lsio_subsys: bus@5d000000 { assigned-clocks = <&clk IMX_SC_R_PWM_0 IMX_SC_PM_CLK_PER>; assigned-clock-rates = <24000000>; #pwm-cells = <2>; + interrupts = <GIC_SPI 94 IRQ_TYPE_LEVEL_HIGH>; status = "disabled"; };
@@ -49,6 +50,7 @@ lsio_subsys: bus@5d000000 { assigned-clocks = <&clk IMX_SC_R_PWM_1 IMX_SC_PM_CLK_PER>; assigned-clock-rates = <24000000>; #pwm-cells = <2>; + interrupts = <GIC_SPI 95 IRQ_TYPE_LEVEL_HIGH>; status = "disabled"; };
@@ -61,6 +63,7 @@ lsio_subsys: bus@5d000000 { assigned-clocks = <&clk IMX_SC_R_PWM_2 IMX_SC_PM_CLK_PER>; assigned-clock-rates = <24000000>; #pwm-cells = <2>; + interrupts = <GIC_SPI 96 IRQ_TYPE_LEVEL_HIGH>; status = "disabled"; };
@@ -73,6 +76,7 @@ lsio_subsys: bus@5d000000 { assigned-clocks = <&clk IMX_SC_R_PWM_3 IMX_SC_PM_CLK_PER>; assigned-clock-rates = <24000000>; #pwm-cells = <2>; + interrupts = <GIC_SPI 97 IRQ_TYPE_LEVEL_HIGH>; status = "disabled"; };
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 120/244 arm64: dts: freescale: imx8-ss-lsio: Fix #pwm-cells
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Stein <[email protected]>
[ Upstream commit d863a2f4f47560d71447650822857fc3d2aea715 ]
i.MX8QM/QXP supports inverted PWM output, thus #pwm-cells needs to be set to 3.
--- arch/arm64/boot/dts/freescale/imx8-ss-lsio.dtsi | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/arm64/boot/dts/freescale/imx8-ss-lsio.dtsi +4 -4
@@ -36,7 +36,7 @@ lsio_subsys: bus@5d000000 { <&pwm0_lpcg 1>; assigned-clocks = <&clk IMX_SC_R_PWM_0 IMX_SC_PM_CLK_PER>; assigned-clock-rates = <24000000>; - #pwm-cells = <2>; + #pwm-cells = <3>; interrupts = <GIC_SPI 94 IRQ_TYPE_LEVEL_HIGH>; status = "disabled"; };
@@ -49,7 +49,7 @@ lsio_subsys: bus@5d000000 { <&pwm1_lpcg 1>; assigned-clocks = <&clk IMX_SC_R_PWM_1 IMX_SC_PM_CLK_PER>; assigned-clock-rates = <24000000>; - #pwm-cells = <2>; + #pwm-cells = <3>; interrupts = <GIC_SPI 95 IRQ_TYPE_LEVEL_HIGH>; status = "disabled"; };
@@ -62,7 +62,7 @@ lsio_subsys: bus@5d000000 { <&pwm2_lpcg 1>; assigned-clocks = <&clk IMX_SC_R_PWM_2 IMX_SC_PM_CLK_PER>; assigned-clock-rates = <24000000>; - #pwm-cells = <2>; + #pwm-cells = <3>; interrupts = <GIC_SPI 96 IRQ_TYPE_LEVEL_HIGH>; status = "disabled"; };
@@ -75,7 +75,7 @@ lsio_subsys: bus@5d000000 { <&pwm3_lpcg 1>; assigned-clocks = <&clk IMX_SC_R_PWM_3 IMX_SC_PM_CLK_PER>; assigned-clock-rates = <24000000>; - #pwm-cells = <2>; + #pwm-cells = <3>; interrupts = <GIC_SPI 97 IRQ_TYPE_LEVEL_HIGH>; status = "disabled"; };
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 121/244 arm64: dts: imx93: correct mediamix power
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <[email protected]>
[ Upstream commit d4cb68a5d3a1ed30ecaf1591eb901523faa13496 ]
"nic_media" clock should be enabled when power on/off mediamix, otherwise power on/off will fail. Because "media_axi_root" clock is the parent of "nic_media" clock, so replace "media_axi_clock" clock with "nic_media" clock in mediamix node.
--- arch/arm64/boot/dts/freescale/imx93.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/freescale/imx93.dtsi +1 -1
@@ -373,7 +373,7 @@ compatible = "fsl,imx93-src-slice"; reg = <0x44462400 0x400>, <0x44465800 0x400>; #power-domain-cells = <0>; - clocks = <&clk IMX93_CLK_MEDIA_AXI>, + clocks = <&clk IMX93_CLK_NIC_MEDIA_GATE>, <&clk IMX93_CLK_MEDIA_APB>; }; };
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 122/244 ARM: imx: Check return value of devm_kasprintf in imx_mmdc_perf_init
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kunwu Chan <[email protected]>
[ Upstream commit 1c2b1049af3f86545fcc5fae0fc725fb64b3a09e ]
devm_kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Ensure the allocation was successful by checking the pointer validity.
Release the id allocated in 'mmdc_pmu_init' when 'devm_kasprintf' return NULL
--- arch/arm/mach-imx/mmdc.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
arch/arm/mach-imx/mmdc.c +6 -1
@@ -501,6 +501,10 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b name =devm_kasprintf (&pdev->dev,GFP_KERNEL ,"mmdc%d" , ret); +if (!name) { + ret = -ENOMEM ; + goto pmu_release_id; + } pmu_mmdc->mmdc_ipg_clk = mmdc_ipg_clk; pmu_mmdc->devtype_data = (struct fsl_mmdc_devtype_data *)of_id->data;
@@ -523,9 +527,10 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b pmu_register_err:pr_warn ("MMDC Perf PMU failed (%d), disabled\n" , ret); -ida_simple_remove (&mmdc_ida, pmu_mmdc->id);cpuhp_state_remove_instance_nocalls (cpuhp_mmdc_state, &pmu_mmdc->node);hrtimer_cancel (&pmu_mmdc->hrtimer); +pmu_release_id: +ida_simple_remove (&mmdc_ida, pmu_mmdc->id); pmu_free:kfree (pmu_mmdc);return ret;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 123/244 arm64: dts: imx8-apalis: set wifi regulator to always-on
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Eichenberger <[email protected]>
[ Upstream commit 04179605ab604dba32571a05cd06423afc9eca19 ]
Make sure that the wifi regulator is always on. The wifi driver itself puts the wifi module into suspend mode. If we cut the power the driver will crash when resuming from suspend.
--- arch/arm64/boot/dts/freescale/imx8-apalis-v1.1.dtsi | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
arch/arm64/boot/dts/freescale/imx8-apalis-v1.1.dtsi +1 -4
@@ -82,12 +82,9 @@ pinctrl-0 = <&pinctrl_wifi_pdn>; gpio = <&lsio_gpio1 28 GPIO_ACTIVE_HIGH>; enable-active-high; + regulator-always-on; regulator-name = "wifi_pwrdn_fake_regulator"; regulator-settling-time-us = <100>; - - regulator-state-mem { - regulator-off-in-suspend; - }; }; reg_pcie_switch: regulator-pcie-switch {
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 124/244 ARM: dts: imx7: Declare timers compatible with fsl,imx6dl-gpt
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philipp Zabel <[email protected]>
[ Upstream commit 397caf68e2d36532054cb14ae8995537f27f8b61 ]
The timer nodes declare compatibility with "fsl,imx6sx-gpt", which itself is compatible with "fsl,imx6dl-gpt". Switch the fallback compatible from "fsl,imx6sx-gpt" to "fsl,imx6dl-gpt".
--- arch/arm/boot/dts/nxp/imx/imx7s.dtsi | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/arm/boot/dts/nxp/imx/imx7s.dtsi +4 -4
@@ -454,7 +454,7 @@ }; gpt1: timer@302d0000 { - compatible = "fsl,imx7d-gpt", "fsl,imx6sx-gpt"; + compatible = "fsl,imx7d-gpt", "fsl,imx6dl-gpt"; reg = <0x302d0000 0x10000>; interrupts = <GIC_SPI 55 IRQ_TYPE_LEVEL_HIGH>; clocks = <&clks IMX7D_GPT1_ROOT_CLK>,
@@ -463,7 +463,7 @@ }; gpt2: timer@302e0000 { - compatible = "fsl,imx7d-gpt", "fsl,imx6sx-gpt"; + compatible = "fsl,imx7d-gpt", "fsl,imx6dl-gpt"; reg = <0x302e0000 0x10000>; interrupts = <GIC_SPI 54 IRQ_TYPE_LEVEL_HIGH>; clocks = <&clks IMX7D_GPT2_ROOT_CLK>,
@@ -473,7 +473,7 @@ }; gpt3: timer@302f0000 { - compatible = "fsl,imx7d-gpt", "fsl,imx6sx-gpt"; + compatible = "fsl,imx7d-gpt", "fsl,imx6dl-gpt"; reg = <0x302f0000 0x10000>; interrupts = <GIC_SPI 53 IRQ_TYPE_LEVEL_HIGH>; clocks = <&clks IMX7D_GPT3_ROOT_CLK>,
@@ -483,7 +483,7 @@ }; gpt4: timer@30300000 { - compatible = "fsl,imx7d-gpt", "fsl,imx6sx-gpt"; + compatible = "fsl,imx7d-gpt", "fsl,imx6dl-gpt"; reg = <0x30300000 0x10000>; interrupts = <GIC_SPI 52 IRQ_TYPE_LEVEL_HIGH>; clocks = <&clks IMX7D_GPT4_ROOT_CLK>,
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 125/244 ARM: dts: imx28-xea: Pass the model property
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <[email protected]>
[ Upstream commit 63ef8fc9bcee6b73ca445a19a7ac6bd544723c9f ]
Per root-node.yaml, 'model' is a required property.
Pass it to fix the following dt-schema warning:
imx28-xea.dtb: /: 'model' is a required property
from schema $id: http://devicetree.org/schemas/root-node.yaml#
--- arch/arm/boot/dts/nxp/mxs/imx28-xea.dts | 1 + 1 file changed, 1 insertion(+)
arch/arm/boot/dts/nxp/mxs/imx28-xea.dts +1 -0
@@ -8,6 +8,7 @@ #include "imx28-lwe.dtsi" / { + model = "Liebherr XEA board"; compatible = "lwn,imx28-xea", "fsl,imx28"; };
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 126/244 arm64: dts: rockchip: Fix eMMC Data Strobe PD on rk3588
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sam Edwards <[email protected]>
[ Upstream commit 37f3d6108730713c411827ab4af764909f4dfc78 ]
JEDEC standard JESD84-B51 defines the eMMC Data Strobe line, which is currently used only in HS400 mode, as a device->host clock signal that "is used only in read operation. The Data Strobe is always High-Z (not driven by the device and pulled down by RDS) or Driven Low in write operation, except during CRC status response." RDS is a pull-down resistor specified in the 10K-100K ohm range. Thus per the standard, the Data Strobe is always pulled to ground (by the eMMC and/or RDS) during write operations.
Evidently, the eMMC host controller in the RK3588 considers an active voltage on the eMMC-DS line during a write to be an error.
The default (i.e. hardware reset, and Rockchip BSP) behavior for the RK3588 is to activate the eMMC-DS pin's builtin pull-down. As a result, many RK3588 board designers do not bother adding a dedicated RDS resistor, instead relying on the RK3588's internal bias. The current devicetree, however, disables this bias (pcfg_pull_none), breaking HS400-mode writes for boards without a dedicated RDS, but with an eMMC chip that chooses to High-Z (instead of drive-low) the eMMC-DS line. (The Turing RK1 is one such board.)
Fix this by changing the bias in the (common) emmc_data_strobe case to reflect the expected hardware/BSP behavior. This is unlikely to cause regressions elsewhere: the pull-down is only relevant for High-Z eMMCs, and if this is redundant with a (dedicated) RDS resistor, the effective result is only a lower resistance to ground -- where the range of tolerance is quite high. If it does, it's better fixed in the specific devicetrees.
--- arch/arm64/boot/dts/rockchip/rk3588s-pinctrl.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/rockchip/rk3588s-pinctrl.dtsi +1 -1
@@ -369,7 +369,7 @@ emmc_data_strobe: emmc-data-strobe { rockchip,pins = /* emmc_data_strobe */ - <2 RK_PA2 1 &pcfg_pull_none>; + <2 RK_PA2 1 &pcfg_pull_down>; }; };
Signature · 1 line
2.42.0
Re: [PATCH 6.6 126/244] arm64: dts: rockchip: Fix eMMC Data Strobe PD on rk3588
Quoted 1 line · Greg Kroah-Hartman
6.6-stable review patch. If anyone has any objections, please let me know.
Hi Greg,
This is my first stable review and I don't know the policy on what we do with "won't hurt, might help, not strictly needed" cases (which I believe this one is). I'll instead list the reasons for/against it (to give some background) and will let you/others make the call.
Reasons FOR including this patch in 6.6-stable:
- It is the correct (i.e. standards-compliant) thing to do.
- Because of that, I'd be very surprised if it caused a regression.
- It would be helpful to people who are backporting support for the affected board(s) onto 6.6 while they wait for 6.7. (I am one.)
Reasons AGAINST including this patch in 6.6-stable:
- The bug it fixes is a solid, reliable crash on boot, which happens virtually 100% of the time on affected boards. If it affected any of the boards supported by 6.6, we'd probably have heard of it by now.
- 6.6 isn't LTS, so it isn't likely to be targeted with backported support for affected board(s) from 6.7 once 6.7 releases. That is, my last point in favor only applies in the short term.
Ultimately, either including it or not will have my full support.
Hope this helps!
Happy Monday,
Sam
Quoted 58 lines
------------------
From: Sam Edwards <[email protected]>
[ Upstream commit
37f3d6108730713c411827ab4af764909f4dfc78]JEDEC standard JESD84-B51 defines the eMMC Data Strobe line, which is currently used only in HS400 mode, as a
device->hostclock signal that "is used only in read operation. The Data Strobe is always High-Z (not driven by the device and pulled down by RDS) or Driven Low in write operation, except during CRC status response." RDS is a pull-down resistor specified in the 10K-100K ohm range. Thus per the standard, the Data Strobe is always pulled to ground (by the eMMC and/or RDS) during write operations.Evidently, the eMMC host controller in the RK3588 considers an active voltage on the eMMC-DS line during a write to be an error.
The default (i.e. hardware reset, and Rockchip BSP) behavior for the RK3588 is to activate the eMMC-DS pin's builtin pull-down. As a result, many RK3588 board designers do not bother adding a dedicated RDS resistor, instead relying on the RK3588's internal bias. The current devicetree, however, disables this bias (
pcfg_pull_none), breaking HS400-mode writes for boards without a dedicated RDS, but with an eMMC chip that chooses to High-Z (instead of drive-low) the eMMC-DS line. (The Turing RK1 is one such board.)Fix this by changing the bias in the (common)
emmc_data_strobecase to reflect the expected hardware/BSP behavior. This is unlikely to cause regressions elsewhere: the pull-down is only relevant for High-Z eMMCs, and if this is redundant with a (dedicated) RDS resistor, the effective result is only a lower resistance to ground -- where the range of tolerance is quite high. If it does, it's better fixed in the specific devicetrees.Fixes d85f8a5c798d5 ("arm64: dts: rockchip: Add rk3588 pinctrl data")Signed-off-by Sam Edwards <[email protected]>Signed-off-by Heiko Stuebner <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- arch/arm64/boot/dts/rockchip/rk3588s-pinctrl.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)arch/arm64/boot/dts/rockchip/rk3588s-pinctrl.dtsi +1
-1@@ -369,7 +369,7 @@ emmc_data_strobe: emmc-data-strobe { rockchip,pins = /* emmc_data_strobe */ - <2 RK_PA2 1 &pcfg_pull_none>; + <2 RK_PA2 1 &pcfg_pull_down>; }; };
Greg Kroah-Hartman
maintainerRe: [PATCH 6.6 126/244] arm64: dts: rockchip: Fix eMMC Data Strobe PD on rk3588
Quoted 10 lines · Sam Edwards
Quoted 1 line · Greg Kroah-Hartman
6.6-stable review patch. If anyone has any objections, please let me know.
Hi Greg,
This is my first stable review and I don't know the policy on what we do with "won't hurt, might help, not strictly needed" cases (which I believe this one is). I'll instead list the reasons for/against it (to give some background) and will let you/others make the call.
Quoted 5 lines
Reasons FOR including this patch in 6.6-stable:
- It is the correct (i.e. standards-compliant) thing to do.
- Because of that, I'd be very surprised if it caused a regression.
- It would be helpful to people who are backporting support for the affected board(s) onto 6.6 while they wait for 6.7. (I am one.)
Great!
Quoted 4 lines
Reasons AGAINST including this patch in 6.6-stable:
- The bug it fixes is a solid, reliable crash on boot, which happens virtually 100% of the time on affected boards. If it affected any of the boards supported by 6.6, we'd probably have heard of it by now.
Ok, but as this is marked "Fixes:" that is why it was picked up.
Quoted 1 line
- 6.6 isn't LTS
It isn't? That's news to me, you might want to check the page:
https://kernel.org/category/releases.html
:)
thanks,
greg k-h
Re: [PATCH 6.6 126/244] arm64: dts: rockchip: Fix eMMC Data Strobe PD on rk3588
Quoted 6 lines · Greg Kroah-Hartman
Quoted 1 line · Sam Edwards
- 6.6 isn't LTS
It isn't? That's news to me, you might want to check the page:
https://kernel.org/category/releases.html
:)
Hi Greg,
Haha, oh man... the resource I referenced on Monday was out-of-date and didn't reflect that 6.6 was LTS until ~6 hours after I had clicked "send." Should have seen the look on my face when I got your reply and went to check it again; had a moment of doubting my own grip on reality until I saw the edit history. Serves me right for not relying on kernel.org *first,* I guess!
Okay, since 6.6 is LTS, it makes a ton of sense that this patch should be in stable-6.6 and I withdraw my prior apprehensions. Sorry for the confusion. :)
Quoted 3 lines
thanks,
greg k-h
Thank you as well,
Sam
Greg Kroah-Hartman
maintainerPATCH 127/244 riscv: fix misaligned access handling of C.SWSP and C.SDSP
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Clément Léger <[email protected]>
[ Upstream commit 22e0eb04837a63af111fae35a92f7577676b9bc8 ]
This is a backport of a fix that was done in OpenSBI: ec0559eb315b ("lib: sbi_misaligned_ldst: Fix handling of C.SWSP and C.SDSP").
Unlike C.LWSP/C.LDSP, these encodings can be used with the zero register, so checking that the rs2 field is non-zero is unnecessary.
Additionally, the previous check was incorrect since it was checking the immediate field of the instruction instead of the rs2 field.
--- arch/riscv/kernel/traps_misaligned.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
arch/riscv/kernel/traps_misaligned.c +2 -4
@@ -342,16 +342,14 @@ int handle_misaligned_store(struct pt_regs *regs) } else if ((insn & INSN_MASK_C_SD) == INSN_MATCH_C_SD) { len =8 ; val.data_ulong =GET_RS2S (insn, regs); - }else if ((insn &INSN_MASK_C_SDSP ) ==INSN_MATCH_C_SDSP && - ((insn >>SH_RD ) &0x1f )) { + }else if ((insn &INSN_MASK_C_SDSP ) ==INSN_MATCH_C_SDSP ) { len =8 ; val.data_ulong =GET_RS2C (insn, regs);#endif }else if ((insn &INSN_MASK_C_SW ) ==INSN_MATCH_C_SW ) { len =4 ; val.data_ulong =GET_RS2S (insn, regs); - }else if ((insn &INSN_MASK_C_SWSP ) ==INSN_MATCH_C_SWSP && - ((insn >>SH_RD ) &0x1f )) { + }else if ((insn &INSN_MASK_C_SWSP ) ==INSN_MATCH_C_SWSP ) { len =4 ; val.data_ulong =GET_RS2C (insn, regs); }else {
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 128/244 riscv: errata: andes: Probe for IOCP only once in boot stage
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lad Prabhakar <[email protected]>
[ Upstream commit ed5b7cfd7839f9280a63365c1133482b42d0981f ]
We need to probe for IOCP only once during boot stage, as we were probing for IOCP for all the stages this caused the below issue during module-init stage,
[9.019104] Unable to handle kernel paging request at virtual address ffffffff8100d3a0 [9.027153] Oops [#1] [9.029421] Modules linked in: rcar_canfd renesas_usbhs i2c_riic can_dev spi_rspi i2c_core [9.037686] CPU: 0 PID: 90 Comm: udevd Not tainted 6.7.0-rc1+ #57 [9.043756] Hardware name: Renesas SMARC EVK based on r9a07g043f01 (DT) [9.050339] epc : riscv_noncoherent_supported+0x10/0x3e [9.055558] ra : andes_errata_patch_func+0x4a/0x52 [9.060418] epc : ffffffff8000d8c2 ra : ffffffff8000d95c sp : ffffffc8003abb00 [9.067607] gp : ffffffff814e25a0 tp : ffffffd80361e540 t0 : 0000000000000000 [9.074795] t1 : 000000000900031e t2 : 0000000000000001 s0 : ffffffc8003abb20 [9.081984] s1 : ffffffff015b57c7 a0 : 0000000000000000 a1 : 0000000000000001 [9.089172] a2 : 0000000000000000 a3 : 0000000000000000 a4 : ffffffff8100d8be [9.096360] a5 : 0000000000000001 a6 : 0000000000000001 a7 : 000000000900031e [9.103548] s2 : ffffffff015b57d7 s3 : 0000000000000001 s4 : 000000000000031e [9.110736] s5 : 8000000000008a45 s6 : 0000000000000500 s7 : 000000000000003f [9.117924] s8 : ffffffc8003abd48 s9 : ffffffff015b1140 s10: ffffffff8151a1b0 [9.125113] s11: ffffffff015b1000 t3 : 0000000000000001 t4 : fefefefefefefeff [9.132301] t5 : ffffffff015b57c7 t6 : ffffffd8b63a6000 [9.137587] status: 0000000200000120 badaddr: ffffffff8100d3a0 cause: 000000000000000f [9.145468] [<ffffffff8000d8c2>] riscv_noncoherent_supported+0x10/0x3e [9.151972] [<ffffffff800027e8>] _apply_alternatives+0x84/0x86 [9.157784] [<ffffffff800029be>] apply_module_alternatives+0x10/0x1a [9.164113] [<ffffffff80008fcc>] module_finalize+0x5e/0x7a [9.169583] [<ffffffff80085cd6>] load_module+0xfd8/0x179c [9.174965] [<ffffffff80086630>] init_module_from_file+0x76/0xaa [9.180948] [<ffffffff800867f6>] __riscv_sys_finit_module+0x176/0x2a8 [9.187365] [<ffffffff80889862>] do_trap_ecall_u+0xbe/0x130 [9.192922] [<ffffffff808920bc>] ret_from_exception+0x0/0x64 [9.198573] Code: 0009 b7e9 6797 014d a783 85a7 c799 4785 0717 0100 (0123) aef7 [9.205994] ---[ end trace 0000000000000000 ]---
This is because we called riscv_noncoherent_supported() for all the stages during IOCP probe. riscv_noncoherent_supported() function sets noncoherent_supported variable to true which has an annotation set to "__ro_after_init" due to which we were seeing the above splat. Fix this by probing for IOCP only once in boot stage by having a boolean variable "done" which will be set to true upon IOCP probe in errata_probe_iocp() and we bail out early if "done" is set to true.
While at it make return type of errata_probe_iocp() to void as we were not checking the return value in andes_errata_patch_func().
--- arch/riscv/errata/andes/errata.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-)
arch/riscv/errata/andes/errata.c +13 -7
@@ -38,29 +38,35 @@ static long ax45mp_iocp_sw_workaround(void)return ret.error ?0 : ret.value; } -static bool errata_probe_iocp (unsigned int stage,unsigned long arch_id,unsigned long impid) +static void errata_probe_iocp (unsigned int stage,unsigned long arch_id,unsigned long impid) { +static bool done; +if (!IS_ENABLED (CONFIG_ERRATA_ANDES_CMO )) -return false; +return ; + +if (done) +return ; + + done = true;if (arch_id !=ANDESTECH_AX45MP_MARCHID || impid !=ANDESTECH_AX45MP_MIMPID ) -return false; +return ;if (!ax45mp_iocp_sw_workaround ()) -return false; +return ;/* Set this just to make core cbo code happy */ riscv_cbom_block_size =1 ;riscv_noncoherent_supported (); - -return true; } void __init_or_module andes_errata_patch_func(struct alt_entry *begin, struct alt_entry *end,unsigned long archid,unsigned long impid,unsigned int stage) { -errata_probe_iocp (stage, archid, impid); +if (stage ==RISCV_ALTERNATIVES_BOOT ) +errata_probe_iocp (stage, archid, impid);/* we have nothing to patch here ATM so just return back */ }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 129/244 md: dont leave MD_RECOVERY_FROZEN in error path of md_set_readonly()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <[email protected]>
[ Upstream commit c9f7cb5b2bc968adcdc686c197ed108f47fd8eb0 ]
If md_set_readonly() failed, the array could still be read-write, however 'MD_RECOVERY_FROZEN' could still be set, which leave the array in an abnormal state that sync or recovery can't continue anymore. Hence make sure the flag is cleared after md_set_readonly() returns.
--- drivers/md/md.c | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-)
drivers/md/md.c +13 -11
@@ -6316,6 +6316,9 @@ static int md_set_readonly(struct mddev *mddev, struct block_device *bdev)int err =0 ;int did_freeze =0 ; +if (mddev->external &&test_bit (MD_SB_CHANGE_PENDING , &mddev->sb_flags)) +return -EBUSY ; +if (!test_bit (MD_RECOVERY_FROZEN , &mddev->recovery)) { did_freeze =1 ;set_bit (MD_RECOVERY_FROZEN , &mddev->recovery);
@@ -6330,8 +6333,6 @@ static int md_set_readonly(struct mddev *mddev, struct block_device *bdev)*/ md_wakeup_thread_directly (mddev->sync_thread); -if (mddev->external &&test_bit (MD_SB_CHANGE_PENDING , &mddev->sb_flags)) -return -EBUSY ;mddev_unlock (mddev);wait_event (resync_wait, !test_bit (MD_RECOVERY_RUNNING , &mddev->recovery));
@@ -6344,29 +6345,30 @@ static int md_set_readonly(struct mddev *mddev, struct block_device *bdev) mddev->sync_thread || test_bit(MD_RECOVERY_RUNNING, &mddev->recovery)) {pr_warn ("md: %s still in use.\n" ,mdname (mddev)); -if (did_freeze) { -clear_bit (MD_RECOVERY_FROZEN , &mddev->recovery); -set_bit (MD_RECOVERY_NEEDED , &mddev->recovery); -md_wakeup_thread (mddev->thread); - } err = -EBUSY ; goto out; } +if (mddev->pers) {__md_stop_writes (mddev); - err = -ENXIO ; -if (mddev->ro ==MD_RDONLY ) +if (mddev->ro ==MD_RDONLY ) { + err = -ENXIO ; goto out; + } + mddev->ro =MD_RDONLY ;set_disk_ro (mddev->gendisk,1 ); + } + +out: +if ((mddev->pers && !err) || did_freeze) {clear_bit (MD_RECOVERY_FROZEN , &mddev->recovery);set_bit (MD_RECOVERY_NEEDED , &mddev->recovery);md_wakeup_thread (mddev->thread);sysfs_notify_dirent_safe (mddev->sysfs_state); - err =0 ; } -out: +mutex_unlock (&mddev->open_mutex);return err; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 130/244 kernel/Kconfig.kexec: drop select of KEXEC for CRASH_DUMP
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baoquan He <[email protected]>
[ Upstream commit dccf78d39f1069a5ddf4328bf0c97aa5f2f4296e ]
Ignat Korchagin complained that a potential config regression was introduced by commit 89cde455915f ("kexec: consolidate kexec and crash options into kernel/Kconfig.kexec"). Before the commit, CONFIG_CRASH_DUMP has no dependency on CONFIG_KEXEC. After the commit, CRASH_DUMP selects KEXEC. That enforces system to have CONFIG_KEXEC=y as long as CONFIG_CRASH_DUMP=Y which people may not want.
In Ignat's case, he sets CONFIG_CRASH_DUMP=y, CONFIG_KEXEC_FILE=y and CONFIG_KEXEC=n because kexec_load interface could have security issue if kernel/initrd has no chance to be signed and verified.
CRASH_DUMP has select of KEXEC because Eric, author of above commit, met a LKP report of build failure when posting patch of earlier version. Please see below link to get detail of the LKP report:
https://lore.kernel.org/all/[email protected]/T/#u
In fact, that LKP report is triggered because arm's <asm/kexec.h> is wrapped in CONFIG_KEXEC ifdeffery scope. That is wrong. CONFIG_KEXEC controls the enabling/disabling of kexec_load interface, but not kexec feature. Removing the wrongly added CONFIG_KEXEC ifdeffery scope in <asm/kexec.h> of arm allows us to drop the select KEXEC for CRASH_DUMP. Meanwhile, change arch/arm/kernel/Makefile to let machine_kexec.o relocate_kernel.o depend on KEXEC_CORE.
--- arch/arm/include/asm/kexec.h | 4 ---- arch/arm/kernel/Makefile | 2 +- kernel/Kconfig.kexec | 1 - 3 files changed, 1 insertion(+), 6 deletions(-)
arch/arm/include/asm/kexec.h +0 -4
@@ -2,8 +2,6 @@#ifndef _ARM_KEXEC_H#define _ARM_KEXEC_H -#ifdef CONFIG_KEXEC -/* Maximum physical address we can use pages from */ #define KEXEC_SOURCE_MEMORY_LIMIT (-1UL)/* Maximum address we can reach in physical address mode */
@@ -82,6 +80,4 @@ static inline struct page *boot_pfn_to_page(unsigned long boot_pfn)#endif /* __ASSEMBLY__ */ -#endif /* CONFIG_KEXEC */ -#endif /* _ARM_KEXEC_H */
arch/arm/kernel/Makefile +1 -1
@@ -59,7 +59,7 @@ obj-$(CONFIG_FUNCTION_TRACER) += entry-ftrace.o obj-$(CONFIG_DYNAMIC_FTRACE) += ftrace.o insn.o patch.o obj-$(CONFIG_FUNCTION_GRAPH_TRACER) += ftrace.o insn.o patch.o obj-$(CONFIG_JUMP_LABEL) += jump_label.o insn.o patch.o -obj-$(CONFIG_KEXEC) += machine_kexec.o relocate_kernel.o +obj-$(CONFIG_KEXEC_CORE) += machine_kexec.o relocate_kernel.o # Main staffs in KPROBES are in arch/arm/probes/ . obj-$(CONFIG_KPROBES) += patch.o insn.o obj-$(CONFIG_OABI_COMPAT) += sys_oabi-compat.o
kernel/Kconfig.kexec +0 -1
@@ -97,7 +97,6 @@ config CRASH_DUMP depends on ARCH_SUPPORTS_KEXEC select CRASH_CORE select KEXEC_CORE - select KEXEC help Generate crash dump after being started by kexec. This should be normally only set in special crash dump kernels
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 131/244 scripts/gdb: fix lx-device-list-bus and lx-device-list-class
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fainelli <[email protected]>
[ Upstream commit 801a2b1b49f4dcf06703130922806e9c639c2ca8 ]
After the conversion to bus_to_subsys() and class_to_subsys(), the gdb scripts listing the system buses and classes respectively was broken, fix those by returning the subsys_priv pointer and have the various caller de-reference either the 'bus' or 'class' structure members accordingly.
--- scripts/gdb/linux/device.py | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
scripts/gdb/linux/device.py +8 -8
@@ -36,26 +36,26 @@ def for_each_bus(): for kobj in kset_for_each_object(gdb.parse_and_eval('bus_kset')): subsys = container_of(kobj, kset_type.get_type().pointer(), 'kobj') subsys_priv = container_of(subsys, subsys_private_type.get_type().pointer(), 'subsys') - yield subsys_priv['bus'] + yield subsys_priv def for_each_class(): for kobj in kset_for_each_object(gdb.parse_and_eval('class_kset')): subsys = container_of(kobj, kset_type.get_type().pointer(), 'kobj') subsys_priv = container_of(subsys, subsys_private_type.get_type().pointer(), 'subsys') - yield subsys_priv['class'] + yield subsys_priv def get_bus_by_name(name): for item in for_each_bus(): - if item['name'].string() == name: + if item['bus']['name'].string() == name: return item raise gdb.GdbError("Can't find bus type {!r}".format(name)) def get_class_by_name(name): for item in for_each_class(): - if item['name'].string() == name: + if item['class']['name'].string() == name: return item raise gdb.GdbError("Can't find device class {!r}".format(name))
@@ -70,13 +70,13 @@ def klist_for_each(klist): def bus_for_each_device(bus): - for kn in klist_for_each(bus['p']['klist_devices']): + for kn in klist_for_each(bus['klist_devices']): dp = container_of(kn, device_private_type.get_type().pointer(), 'knode_bus') yield dp['device'] def class_for_each_device(cls): - for kn in klist_for_each(cls['p']['klist_devices']): + for kn in klist_for_each(cls['klist_devices']): dp = container_of(kn, device_private_type.get_type().pointer(), 'knode_class') yield dp['device']
@@ -103,7 +103,7 @@ class LxDeviceListBus(gdb.Command): def invoke(self, arg, from_tty): if not arg: for bus in for_each_bus(): - gdb.write('bus {}:\t{}\n'.format(bus['name'].string(), bus)) + gdb.write('bus {}:\t{}\n'.format(bus['bus']['name'].string(), bus)) for dev in bus_for_each_device(bus): _show_device(dev, level=1) else:
@@ -123,7 +123,7 @@ class LxDeviceListClass(gdb.Command): def invoke(self, arg, from_tty): if not arg: for cls in for_each_class(): - gdb.write("class {}:\t{}\n".format(cls['name'].string(), cls)) + gdb.write("class {}:\t{}\n".format(cls['class']['name'].string(), cls)) for dev in class_for_each_device(cls): _show_device(dev, level=1) else:
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 132/244 rethook: Use __rcu pointer for rethook::handler
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu (Google) <[email protected]>
commit a1461f1fd6cfdc4b8917c9d4a91e92605d1f28dc upstream.
Since the rethook::handler is an RCU-maganged pointer so that it will notice readers the rethook is stopped (unregistered) or not, it should be an __rcu pointer and use appropriate functions to be accessed. This will use appropriate memory barrier when accessing it. OTOH, rethook::data is never changed, so we don't need to check it in get_kretprobe().
NOTE: To avoid sparse warning, rethook::handler is defined by a raw function pointer type with __rcu instead of rethook_handler_t.
--- include/linux/kprobes.h | 6 ++---- include/linux/rethook.h | 7 ++++++- kernel/trace/rethook.c | 23 ++++++++++++++--------- 3 files changed, 22 insertions(+), 14 deletions(-)
include/linux/kprobes.h +2 -4
@@ -202,10 +202,8 @@ extern int arch_trampoline_kprobe(struct#ifdef CONFIG_KRETPROBE_ON_RETHOOK static nokprobe_inline struct kretprobe *get_kretprobe(struct kretprobe_instance *ri) { -RCU_LOCKDEP_WARN (!rcu_read_lock_any_held (), -"Kretprobe is accessed from instance under preemptive context" ); - -return (struct kretprobe *)READ_ONCE (ri->node.rethook->data); +/* rethook::data is non-changed field, so that you can access it freely. */ +return (struct kretprobe *)ri->node.rethook->data; }static nokprobe_inline unsigned long get_kretprobe_retaddr (struct kretprobe_instance *ri) {
include/linux/rethook.h +6 -1
@@ -29,7 +29,12 @@ typedef void (*rethook_handler_t) (struc*/ struct rethook {void *data; -rethook_handler_t handler; +/* +* To avoid sparse warnings, this uses a raw function pointer with +* __rcu, instead of rethook_handler_t. But this must be same as +* rethook_handler_t. +*/ +void (__rcu *handler) (struct rethook_node *,void *,unsigned long ,struct pt_regs *);struct freelist_head pool;refcount_t ref;struct rcu_head rcu;
kernel/trace/rethook.c +14 -9
@@ -63,7 +63,7 @@ static void rethook_free_rcu(struct rcu_*/ void rethook_stop (struct rethook *rh) { -WRITE_ONCE (rh->handler,NULL ); +rcu_assign_pointer (rh->handler,NULL ); }/**
@@ -78,11 +78,17 @@ void rethook_stop(struct rethook *rh)*/ void rethook_free (struct rethook *rh) { -WRITE_ONCE (rh->handler,NULL ); +rethook_stop (rh);call_rcu (&rh->rcu, rethook_free_rcu); } +static inline rethook_handler_t rethook_get_handler (struct rethook *rh) +{ +return (rethook_handler_t )rcu_dereference_check (rh->handler, +rcu_read_lock_any_held ()); +} +/** * rethook_alloc() - Allocate struct rethook. * @data: a data to pass the @handler when hooking the return.
@@ -102,7 +108,7 @@ struct rethook *rethook_alloc(void *data } rh->data = data; - rh->handler = handler; +rcu_assign_pointer (rh->handler, handler); rh->pool.head =NULL ;refcount_set (&rh->ref,1 );
@@ -142,9 +148,10 @@ static void free_rethook_node_rcu(struct*/ void rethook_recycle (struct rethook_node *node) { -lockdep_assert_preemption_disabled (); +rethook_handler_t handler; -if (likely (READ_ONCE (node->rethook->handler))) + handler =rethook_get_handler (node->rethook); +if (likely (handler))freelist_add (&node->freelist, &node->rethook->pool);else call_rcu (&node->rcu, free_rethook_node_rcu);
@@ -160,11 +167,9 @@ NOKPROBE_SYMBOL(rethook_recycle);*/ struct rethook_node *rethook_try_get (struct rethook *rh) { -rethook_handler_t handler =READ_ONCE (rh->handler); +rethook_handler_t handler =rethook_get_handler (rh);struct freelist_node *fn; -lockdep_assert_preemption_disabled (); -/* Check whether @rh is going to be freed. */ if (unlikely (!handler))return NULL ;
@@ -312,7 +317,7 @@ unsigned long rethook_trampoline_handler rhn = container_of(first, struct rethook_node, llist);if (WARN_ON_ONCE (rhn->frame != frame))break ; - handler =READ_ONCE (rhn->rethook->handler); + handler =rethook_get_handler (rhn->rethook);if (handler)handler (rhn, rhn->rethook->data, correct_ret_addr, regs);
Greg Kroah-Hartman
maintainerPATCH 133/244 ASoC: amd: yc: Fix non-functional mic on ASUS E1504FA
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Malcolm Hart <[email protected]>
commit b24e3590c94ab0aba6e455996b502a83baa5c31c upstream.
This patch adds ASUSTeK COMPUTER INC "E1504FA" to the quirks file acp6x-mach.c to enable microphone array on ASUS Vivobook GO 15.
I have this laptop and can confirm that the patch succeeds in enabling the microphone array.
Rule: add
--- sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ 1 file changed, 7 insertions(+)
sound/soc/amd/yc/acp6x-mach.c +7 -0
@@ -286,6 +286,13 @@ static const struct dmi_system_id yc_acp { .driver_data = &acp6x_card, .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"ASUSTeK COMPUTER INC." ), + DMI_MATCH(DMI_PRODUCT_NAME, "E1504FA"), + } + }, + { + .driver_data = &acp6x_card, + .matches = {DMI_MATCH (DMI_BOARD_VENDOR ,"Micro-Star International Co., Ltd." ), DMI_MATCH(DMI_PRODUCT_NAME, "Bravo 15 B7ED"), }
Greg Kroah-Hartman
maintainerPATCH 134/244 io_uring/af_unix: disable sending io_uring over sockets
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Begunkov <[email protected]>
commit 705318a99a138c29a512a72c3e0043b3cd7f55f4 upstream.
File reference cycles have caused lots of problems for io_uring in the past, and it still doesn't work exactly right and races with unix_stream_read_generic(). The safest fix would be to completely disallow sending io_uring files via sockets via SCM_RIGHT, so there are no possible cycles invloving registered files and thus rendering SCM accounting on the io_uring side unnecessary.
--- io_uring/rsrc.h | 7 ------- net/core/scm.c | 6 ++++++ 2 files changed, 6 insertions(+), 7 deletions(-)
io_uring/rsrc.h +0 -7
@@ -77,17 +77,10 @@ int io_sqe_files_register(struct io_ringint __io_scm_file_account (struct io_ring_ctx *ctx,struct file *file); -#if defined(CONFIG_UNIX ) -static inline bool io_file_need_scm (struct file *filp) -{ -return !!unix_get_socket (filp); -} -#else static inline bool io_file_need_scm (struct file *filp) {return false; } -#endif static inline int io_scm_file_account (struct io_ring_ctx *ctx,struct file *file)
net/core/scm.c +6 -0
@@ -26,6 +26,7 @@#include <linux/nsproxy.h> #include <linux/slab.h> #include <linux/errqueue.h> +#include <linux/io_uring.h> #include <linux/uaccess.h>
@@ -103,6 +104,11 @@ static int scm_fp_copy(struct cmsghdr *cif (fd <0 || !(file =fget_raw (fd)))return -EBADF ; +/* don't allow io_uring files */ +if (io_uring_get_socket (file)) { +fput (file); +return -EINVAL ; + } *fpp++ = file; fpl->count++; }
Greg Kroah-Hartman
maintainerPATCH 135/244 nvme-pci: Add sleep quirk for Kingston drives
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Georg Gottleuber <[email protected]>
commit 107b4e063d78c300b21e2d5291b1aa94c514ea5b upstream.
Some Kingston NV1 and A2000 are wasting a lot of power on specific TUXEDO platforms in s2idle sleep if 'Simple Suspend' is used.
This patch applies a new quirk 'Force No Simple Suspend' to achieve a low power sleep without 'Simple Suspend'.
--- drivers/nvme/host/nvme.h | 5 +++++ drivers/nvme/host/pci.c | 16 +++++++++++++++- 2 files changed, 20 insertions(+), 1 deletion(-)
drivers/nvme/host/nvme.h +5 -0
@@ -156,6 +156,11 @@ enum nvme_quirks {* No temperature thresholds for channels other than 0 (Composite). */ NVME_QUIRK_NO_SECONDARY_TEMP_THRESH = (1 <<19 ), + +/* +* Disables simple suspend/resume path. +*/ + NVME_QUIRK_FORCE_NO_SIMPLE_SUSPEND = (1 << 20), };/*
drivers/nvme/host/pci.c +15 -1
@@ -2903,6 +2903,18 @@ static unsigned long check_vendor_combinif ((dmi_match (DMI_BOARD_VENDOR ,"LENOVO" )) &&dmi_match (DMI_BOARD_NAME ,"LNVNB161216" ))return NVME_QUIRK_SIMPLE_SUSPEND ; + }else if (pdev->vendor ==0x2646 && (pdev->device ==0x2263 || + pdev->device ==0x500f )) { +/* +* Exclude some Kingston NV1 and A2000 devices from +* NVME_QUIRK_SIMPLE_SUSPEND. Do a full suspend to save a +* lot fo energy with s2idle sleep on some TUXEDO platforms. +*/ +if (dmi_match (DMI_BOARD_NAME ,"NS5X_NS7XAU" ) || +dmi_match (DMI_BOARD_NAME ,"NS5x_7xAU" ) || +dmi_match (DMI_BOARD_NAME ,"NS5x_7xPU" ) || +dmi_match (DMI_BOARD_NAME ,"PH4PRX1_PH6PRX1" )) +return NVME_QUIRK_FORCE_NO_SIMPLE_SUSPEND ; }return 0 ;
@@ -2933,7 +2945,9 @@ static struct nvme_dev *nvme_pci_alloc_d dev->dev =get_device (&pdev->dev); quirks |=check_vendor_combination_bug (pdev); -if (!noacpi &&acpi_storage_d3 (&pdev->dev)) { +if (!noacpi && + !(quirks &NVME_QUIRK_FORCE_NO_SIMPLE_SUSPEND ) && +acpi_storage_d3 (&pdev->dev)) {/* * Some systems use a bios work around to ask for D3 on * platforms that support kernel managed suspend.
Greg Kroah-Hartman
maintainerPATCH 136/244 io_uring: fix mutex_unlock with unreferenced ctx
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Begunkov <[email protected]>
commit f7b32e785042d2357c5abc23ca6db1b92c91a070 upstream.
Callers of mutex_unlock() have to make sure that the mutex stays alive for the whole duration of the function call. For io_uring that means that the following pattern is not valid unless we ensure that the context outlives the mutex_unlock() call.
mutex_lock(&ctx->uring_lock);req_put(req); // typically via io_req_task_submit() mutex_unlock(&ctx->uring_lock);
Most contexts are fine: io-wq pins requests, syscalls hold the file, task works are taking ctx references and so on. However, the task work fallback path doesn't follow the rule.
--- io_uring/io_uring.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
io_uring/io_uring.c +3 -6
@@ -269,6 +269,7 @@ static __cold void io_fallback_req_func(struct io_kiocb *req, *tmp;struct io_tw_state ts = { .locked = true, }; +percpu_ref_get (&ctx->refs);mutex_lock (&ctx->uring_lock);llist_for_each_entry_safe (req, tmp, node, io_task_work.node) req->io_task_work.func (req, &ts);
@@ -276,6 +277,7 @@ static __cold void io_fallback_req_func(return ;io_submit_flush_completions (ctx);mutex_unlock (&ctx->uring_lock); +percpu_ref_put (&ctx->refs); }static int io_alloc_hash_table (struct io_hash_table *table,unsigned bits)
@@ -3138,12 +3140,7 @@ static __cold void io_ring_exit_work(strinit_completion (&exit.completion);init_task_work (&exit.task_work, io_tctx_exit_cb); exit.ctx = ctx; -/* -* Some may use context even when all refs and requests have been put, -* and they are free to do so while still holding uring_lock or -* completion_lock, see io_req_task_submit(). Apart from other work, -* this lock/unlock section also waits them to finish. -*/ +mutex_lock (&ctx->uring_lock);while (!list_empty (&ctx->tctx_list)) {WARN_ON_ONCE (time_after (jiffies, timeout));
Greg Kroah-Hartman
maintainerPATCH 137/244 ALSA: usb-audio: Add Pioneer DJM-450 mixer controls
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sarah Grant <[email protected]>
commit bbb8e71965c3737bdc691afd803a34bfd61cfbeb upstream.
These values mirror those of the Pioneer DJM-250MK2 as the channel layout appears identical based on my observations. This duplication could be removed in later contributions if desired.
--- sound/usb/mixer_quirks.c | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+)
sound/usb/mixer_quirks.c +30 -0
@@ -2978,6 +2978,7 @@ static int snd_bbfpro_controls_create(st#define SND_DJM_850_IDX 0x2#define SND_DJM_900NXS2_IDX 0x3#define SND_DJM_750MK2_IDX 0x4 +#define SND_DJM_450_IDX 0x5#define SND_DJM_CTL (_name, suffix, _default_value, _windex) { \
@@ -3108,6 +3109,31 @@ static const struct snd_djm_ctl snd_djm_ }; +// DJM-450 +static const u16 snd_djm_opts_450_cap1[] = { +0x0103 ,0x0100 ,0x0106 ,0x0107 ,0x0108 ,0x0109 ,0x010d ,0x010a }; + +static const u16 snd_djm_opts_450_cap2[] = { +0x0203 ,0x0200 ,0x0206 ,0x0207 ,0x0208 ,0x0209 ,0x020d ,0x020a }; + +static const u16 snd_djm_opts_450_cap3[] = { +0x030a ,0x0311 ,0x0312 ,0x0307 ,0x0308 ,0x0309 ,0x030d }; + +static const u16 snd_djm_opts_450_pb1[] = {0x0100 ,0x0101 ,0x0104 }; +static const u16 snd_djm_opts_450_pb2[] = {0x0200 ,0x0201 ,0x0204 }; +static const u16 snd_djm_opts_450_pb3[] = {0x0300 ,0x0301 ,0x0304 }; + +static const struct snd_djm_ctl snd_djm_ctls_450[] = { +SND_DJM_CTL ("Capture Level" , cap_level,0 ,SND_DJM_WINDEX_CAPLVL ), + SND_DJM_CTL("Ch1 Input", 450_cap1, 2, SND_DJM_WINDEX_CAP), + SND_DJM_CTL("Ch2 Input", 450_cap2, 2, SND_DJM_WINDEX_CAP), + SND_DJM_CTL("Ch3 Input", 450_cap3, 0, SND_DJM_WINDEX_CAP), + SND_DJM_CTL("Ch1 Output", 450_pb1, 0, SND_DJM_WINDEX_PB), + SND_DJM_CTL("Ch2 Output", 450_pb2, 1, SND_DJM_WINDEX_PB), + SND_DJM_CTL("Ch3 Output", 450_pb3, 2, SND_DJM_WINDEX_PB) +}; + +// DJM-750 static const u16 snd_djm_opts_750_cap1[] = {0x0101 ,0x0103 ,0x0106 ,0x0107 ,0x0108 ,0x0109 ,0x010a ,0x010f };
@@ -3203,6 +3229,7 @@ static const struct snd_djm_device snd_d [SND_DJM_850_IDX] = SND_DJM_DEVICE(850), [SND_DJM_900NXS2_IDX] = SND_DJM_DEVICE(900nxs2), [SND_DJM_750MK2_IDX] = SND_DJM_DEVICE(750mk2), + [SND_DJM_450_IDX] = SND_DJM_DEVICE(450), };
@@ -3449,6 +3476,9 @@ int snd_usb_mixer_apply_create_quirk(strcase USB_ID (0x2b73 ,0x0017 ):/* Pioneer DJ DJM-250MK2 */ err =snd_djm_controls_create (mixer,SND_DJM_250MK2_IDX );break ; +case USB_ID (0x2b73 ,0x0013 ):/* Pioneer DJ DJM-450 */ + err =snd_djm_controls_create (mixer,SND_DJM_450_IDX ); +break ;case USB_ID (0x08e4 ,0x017f ):/* Pioneer DJ DJM-750 */ err =snd_djm_controls_create (mixer,SND_DJM_750_IDX );break ;
Greg Kroah-Hartman
maintainerPATCH 138/244 ALSA: pcm: fix out-of-bounds in snd_pcm_state_names
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Zhang <[email protected]>
commit 2b3a7a302c9804e463f2ea5b54dc3a6ad106a344 upstream.
The pcm state can be SNDRV_PCM_STATE_DISCONNECTED at disconnect callback, and there is not an entry of SNDRV_PCM_STATE_DISCONNECTED in snd_pcm_state_names.
This patch adds the missing entry to resolve this issue.
cat /proc/asound/card2/pcm0p/sub0/status
That results in stack traces like the following:
[ 99.702732][ T5171] Unexpected kernel BRK exception at EL1 [ 99.702774][ T5171] Internal error: BRK handler: f2005512 [#1] PREEMPT SMP [ 99.703858][ T5171] Modules linked in: bcmdhd(E) (...) [ 99.747425][ T5171] CPU: 3 PID: 5171 Comm: cat Tainted: G C OE 5.10.189-android13-4-00003-g4a17384380d8-ab11086999 #1 [ 99.748447][ T5171] Hardware name: Rockchip RK3588 CVTE V10 Board (DT) [ 99.749024][ T5171] pstate: 60400005 (nZCv daif +PAN -UAO -TCO BTYPE=--) [ 99.749616][ T5171] pc : snd_pcm_substream_proc_status_read+0x264/0x2bc [ 99.750204][ T5171] lr : snd_pcm_substream_proc_status_read+0xa4/0x2bc [ 99.750778][ T5171] sp : ffffffc0175abae0 [ 99.751132][ T5171] x29: ffffffc0175abb80 x28: ffffffc009a2c498 [ 99.751665][ T5171] x27: 0000000000000001 x26: ffffff810cbae6e8 [ 99.752199][ T5171] x25: 0000000000400cc0 x24: ffffffc0175abc60 [ 99.752729][ T5171] x23: 0000000000000000 x22: ffffff802f558400 [ 99.753263][ T5171] x21: ffffff81d8d8ff00 x20: ffffff81020cdc00 [ 99.753795][ T5171] x19: ffffff802d110000 x18: ffffffc014fbd058 [ 99.754326][ T5171] x17: 0000000000000000 x16: 0000000000000000 [ 99.754861][ T5171] x15: 000000000000c276 x14: ffffffff9a976fda [ 99.755392][ T5171] x13: 0000000065689089 x12: 000000000000d72e [ 99.755923][ T5171] x11: ffffff802d110000 x10: 00000000000000e0 [ 99.756457][ T5171] x9 : 9c431600c8385d00 x8 : 0000000000000008 [ 99.756990][ T5171] x7 : 0000000000000000 x6 : 000000000000003f [ 99.757522][ T5171] x5 : 0000000000000040 x4 : ffffffc0175abb70 [ 99.758056][ T5171] x3 : 0000000000000001 x2 : 0000000000000001 [ 99.758588][ T5171] x1 : 0000000000000000 x0 : 0000000000000000 [ 99.759123][ T5171] Call trace: [ 99.759404][ T5171] snd_pcm_substream_proc_status_read+0x264/0x2bc [ 99.759958][ T5171] snd_info_seq_show+0x54/0xa4 [ 99.760370][ T5171] seq_read_iter+0x19c/0x7d4 [ 99.760770][ T5171] seq_read+0xf0/0x128 [ 99.761117][ T5171] proc_reg_read+0x100/0x1f8 [ 99.761515][ T5171] vfs_read+0xf4/0x354 [ 99.761869][ T5171] ksys_read+0x7c/0x148 [ 99.762226][ T5171] __arm64_sys_read+0x20/0x30 [ 99.762625][ T5171] el0_svc_common+0xd0/0x1e4 [ 99.763023][ T5171] el0_svc+0x28/0x98 [ 99.763358][ T5171] el0_sync_handler+0x8c/0xf0 [ 99.763759][ T5171] el0_sync+0x1b8/0x1c0 [ 99.764118][ T5171] Code: d65f03c0 b9406102 17ffffae 94191565 (d42aa240) [ 99.764715][ T5171] ---[ end trace 1eeffa3e17c58e10 ]--- [ 99.780720][ T5171] Kernel panic - not syncing: BRK handler: Fatal exception
--- sound/core/pcm.c | 1 + 1 file changed, 1 insertion(+)
sound/core/pcm.c +1 -0
@@ -253,6 +253,7 @@ static const char * const snd_pcm_state_STATE (DRAINING ),STATE (PAUSED ),STATE (SUSPENDED ), + STATE(DISCONNECTED), };static const char *const snd_pcm_access_names[] = {
Greg Kroah-Hartman
maintainerPATCH 139/244 ALSA: hda/realtek: Apply quirk for ASUS UM3504DA
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pascal Noël <[email protected]>
commit c5c325bb5849868d76969d3fe014515f5e99eabc upstream.
The ASUS UM3504DA uses a Realtek HDA codec and two CS35L41 amplifiers via I2C. Apply existing quirk to model.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -9873,6 +9873,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x1043 ,0x17f3 ,"ROG Ally RC71L_RC71L" ,ALC294_FIXUP_ASUS_ALLY ),SND_PCI_QUIRK (0x1043 ,0x1881 ,"ASUS Zephyrus S/M" ,ALC294_FIXUP_ASUS_GX502_PINS ),SND_PCI_QUIRK (0x1043 ,0x18b1 ,"Asus MJ401TA" ,ALC256_FIXUP_ASUS_HEADSET_MIC ), +SND_PCI_QUIRK (0x1043 ,0x18d3 ,"ASUS UM3504DA" ,ALC294_FIXUP_CS35L41_I2C_2 ),SND_PCI_QUIRK (0x1043 ,0x18f1 ,"Asus FX505DT" ,ALC256_FIXUP_ASUS_HEADSET_MIC ),SND_PCI_QUIRK (0x1043 ,0x194e ,"ASUS UX563FD" ,ALC294_FIXUP_ASUS_HPE ), SND_PCI_QUIRK(0x1043, 0x1970, "ASUS UX550VE", ALC289_FIXUP_ASUS_GA401),
Greg Kroah-Hartman
maintainerPATCH 140/244 ALSA: hda/realtek: fix speakers on XPS 9530 (2023)
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandrs Vinarskis <[email protected]>
commit cd14dedf15be432066e63783c63d650f2800cd48 upstream.
XPS 9530 has 2 tweeters and 2 subwoofers powered by CS35L41 amplifier, SPI connected. For subwoofers to work, it requires both to enable amplifier support, and to enable output to subwoofers via 0x17 quirk (similalry to XPS 9510/9520).
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -9615,6 +9615,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x1028 ,0x0b1a ,"Dell Precision 5570" ,ALC289_FIXUP_DUAL_SPK ),SND_PCI_QUIRK (0x1028 ,0x0b37 ,"Dell Inspiron 16 Plus 7620 2-in-1" ,ALC295_FIXUP_DELL_INSPIRON_TOP_SPEAKERS ),SND_PCI_QUIRK (0x1028 ,0x0b71 ,"Dell Inspiron 16 Plus 7620" ,ALC295_FIXUP_DELL_INSPIRON_TOP_SPEAKERS ), +SND_PCI_QUIRK (0x1028 ,0x0beb ,"Dell XPS 15 9530 (2023)" ,ALC289_FIXUP_DELL_CS35L41_SPI_2 ),SND_PCI_QUIRK (0x1028 ,0x0c03 ,"Dell Precision 5340" ,ALC269_FIXUP_DELL4_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1028 ,0x0c19 ,"Dell Precision 3340" ,ALC236_FIXUP_DELL_DUAL_CODECS ), SND_PCI_QUIRK(0x1028, 0x0c1a, "Dell Precision 3340", ALC236_FIXUP_DELL_DUAL_CODECS),
Greg Kroah-Hartman
maintainerPATCH 141/244 ALSA: hda/realtek: Enable headset on Lenovo M90 Gen5
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bin Li <[email protected]>
commit 6f7e4664e597440dfbdb8b2931c561b717030d07 upstream.
Lenovo M90 Gen5 is equipped with ALC897, and it needs ALC897_FIXUP_HEADSET_MIC_PIN quirk to make its headset mic work.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -12107,6 +12107,7 @@ static const struct snd_pci_quirk alc662SND_PCI_QUIRK (0x17aa ,0x32f7 ,"Lenovo ThinkCentre M90" ,ALC897_FIXUP_HEADSET_MIC_PIN ),SND_PCI_QUIRK (0x17aa ,0x3321 ,"Lenovo ThinkCentre M70 Gen4" ,ALC897_FIXUP_HEADSET_MIC_PIN ),SND_PCI_QUIRK (0x17aa ,0x331b ,"Lenovo ThinkCentre M90 Gen4" ,ALC897_FIXUP_HEADSET_MIC_PIN ), +SND_PCI_QUIRK (0x17aa ,0x3364 ,"Lenovo ThinkCentre M90 Gen5" ,ALC897_FIXUP_HEADSET_MIC_PIN ),SND_PCI_QUIRK (0x17aa ,0x3742 ,"Lenovo TianYi510Pro-14IOB" ,ALC897_FIXUP_HEADSET_MIC_PIN2 ),SND_PCI_QUIRK (0x17aa ,0x38af ,"Lenovo Ideapad Y550P" ,ALC662_FIXUP_IDEAPAD ), SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Ideapad Y550", ALC662_FIXUP_IDEAPAD),
Greg Kroah-Hartman
maintainerPATCH 142/244 ALSA: hda/realtek: add new Framework laptop to quirks
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Bosse <[email protected]>
commit 33038efb64f7576bac635164021f5c984d4c755f upstream.
The Framework Laptop 13 (AMD Ryzen 7040Series) has an ALC295 with a disconnected or faulty headset mic presence detect similar to the previous models. It works with the same quirk chain as 309d7363ca3d9fcdb92ff2d958be14d7e8707f68. This model has a VID:PID of f111:0006.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -10182,6 +10182,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x8086 ,0x2081 ,"Intel NUC 10" ,ALC256_FIXUP_INTEL_NUC10 ),SND_PCI_QUIRK (0x8086 ,0x3038 ,"Intel NUC 13" ,ALC295_FIXUP_CHROME_BOOK ),SND_PCI_QUIRK (0xf111 ,0x0001 ,"Framework Laptop" ,ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE ), +SND_PCI_QUIRK (0xf111 ,0x0006 ,"Framework Laptop" ,ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE ), #if 0/* Below is a quirk table taken from the old code.
Greg Kroah-Hartman
maintainerPATCH 143/244 ALSA: hda/realtek: Add Framework laptop 16 to quirks
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
commit 8804fa04a492f4176ea407390052292912227820 upstream.
The Framework 16" laptop has the same controller as other Framework models. Apply the presence detection quirk.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -10182,6 +10182,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x8086 ,0x2081 ,"Intel NUC 10" ,ALC256_FIXUP_INTEL_NUC10 ),SND_PCI_QUIRK (0x8086 ,0x3038 ,"Intel NUC 13" ,ALC295_FIXUP_CHROME_BOOK ),SND_PCI_QUIRK (0xf111 ,0x0001 ,"Framework Laptop" ,ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE ), +SND_PCI_QUIRK (0xf111 ,0x0005 ,"Framework Laptop" ,ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0xf111 ,0x0006 ,"Framework Laptop" ,ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE ), #if 0
Greg Kroah-Hartman
maintainerPATCH 144/244 ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 634e5e1e06f5cdd614a1bc429ecb243a51cc009d upstream.
Lenovo Yoga Pro 7 14APH8 (PCI SSID 17aa:3882) seems requiring the similar workaround like Yoga 9 model for the bass speaker.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -10116,6 +10116,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x17aa ,0x387d ,"Yoga S780-16 pro Quad AAC" ,ALC287_FIXUP_TAS2781_I2C ),SND_PCI_QUIRK (0x17aa ,0x387e ,"Yoga S780-16 pro Quad YC" ,ALC287_FIXUP_TAS2781_I2C ),SND_PCI_QUIRK (0x17aa ,0x3881 ,"YB9 dual power mode2 YC" ,ALC287_FIXUP_TAS2781_I2C ), +SND_PCI_QUIRK (0x17aa ,0x3882 ,"Lenovo Yoga Pro 7 14APH8" ,ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN ),SND_PCI_QUIRK (0x17aa ,0x3884 ,"Y780 YG DUAL" ,ALC287_FIXUP_TAS2781_I2C ),SND_PCI_QUIRK (0x17aa ,0x3886 ,"Y780 VECO DUAL" ,ALC287_FIXUP_TAS2781_I2C ), SND_PCI_QUIRK(0x17aa, 0x38a7, "Y780P AMD YG dual", ALC287_FIXUP_TAS2781_I2C),
Greg Kroah-Hartman
maintainerPATCH 145/244 ring-buffer: Test last update in 32bit version of __rb_time_read()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt (Google) <[email protected]>
commit f458a1453424e03462b5bb539673c9a3cddda480 upstream.
Since 64 bit cmpxchg() is very expensive on 32bit architectures, the timestamp used by the ring buffer does some interesting tricks to be able to still have an atomic 64 bit number. It originally just used 60 bits and broke it up into two 32 bit words where the extra 2 bits were used for synchronization. But this was not enough for all use cases, and all 64 bits were required.
The 32bit version of the ring buffer timestamp was then broken up into 3 32bit words using the same counter trick. But one update was not done. The check to see if the read operation was done without interruption only checked the first two words and not last one (like it had before this update). Fix it by making sure all three updates happen without interruption by comparing the initial counter with the last updated counter.
--- kernel/trace/ring_buffer.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/trace/ring_buffer.c +2 -2
@@ -644,8 +644,8 @@ static inline bool __rb_time_read(rb_tim *cnt =rb_time_cnt (top); -/* If top and bottom counts don't match, this interrupted a write */ -if (*cnt !=rb_time_cnt (bottom)) +/* If top and msb counts don't match, this interrupted a write */ +if (*cnt !=rb_time_cnt (msb))return false;/* The shift to msb will lose its cnt bits */
Greg Kroah-Hartman
maintainerPATCH 146/244 ring-buffer: Force absolute timestamp on discard of event
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt (Google) <[email protected]>
commit b2dd797543cfa6580eac8408dd67fa02164d9e56 upstream.
There's a race where if an event is discarded from the ring buffer and an interrupt were to happen at that time and insert an event, the time stamp is still used from the discarded event as an offset. This can screw up the timings.
If the event is going to be discarded, set the "before_stamp" to zero. When a new event comes in, it compares the "before_stamp" with the "write_stamp" and if they are not equal, it will insert an absolute timestamp. This will prevent the timings from getting out of sync due to the discarded event.
--- kernel/trace/ring_buffer.c | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-)
kernel/trace/ring_buffer.c +8 -11
@@ -3030,23 +3030,20 @@ rb_try_to_discard(struct ring_buffer_perlocal_read (&bpage->write) & ~RB_WRITE_MASK ;unsigned long event_length =rb_event_length (event); +/* +* For the before_stamp to be different than the write_stamp +* to make sure that the next event adds an absolute +* value and does not rely on the saved write stamp, which +* is now going to be bogus. +*/ +rb_time_set (&cpu_buffer->before_stamp,0 ); +/* Something came in, can't discard */ if (!rb_time_cmpxchg (&cpu_buffer->write_stamp, write_stamp, write_stamp - delta))return false;/* -* It's possible that the event time delta is zero -* (has the same time stamp as the previous event) -* in which case write_stamp and before_stamp could -* be the same. In such a case, force before_stamp -* to be different than write_stamp. It doesn't -* matter what it is, as long as its different. -*/ -if (!delta) -rb_time_set (&cpu_buffer->before_stamp,0 ); - -/* * If an event were to come in now, it would see that the * write_stamp and the before_stamp are different, and assume * that this event just added itself before updating