5.15.150-rc1 review
Subsystems (7)
Greg Kroah-Hartman
maintainerPATCH 151/245 powerpc/rtas: make all exports GPL
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Lynch <[email protected]>
[ Upstream commit 9bce6243848dfd0ff7c2be6e8d82ab9b1e6c7858 ]
The first symbol exports of RTAS functions and data came with the (now removed) scanlog driver in 2003:
At the time this was applied, EXPORT_SYMBOL_GPL() was very new, and the exports of rtas_call() etc have remained non-GPL. As new APIs have been added to the RTAS subsystem, their symbol exports have followed the convention set by existing code.
However, the historical evidence is that RTAS function exports have been added over time only to satisfy the needs of in-kernel users, and these clients must have fairly intimate knowledge of how the APIs work to use them safely. No out of tree users are known, and future ones seem unlikely.
Arguably the default for RTAS symbols should have become EXPORT_SYMBOL_GPL once it was available. Let's make it so now, and exceptions can be evaluated as needed.
Stable-dep-of: 836b5b9fcc8e ("powerpc/rtas: ensure 4KB alignment for rtas_data_buf")
--- arch/powerpc/kernel/rtas.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-)
arch/powerpc/kernel/rtas.c +11 -11
@@ -68,10 +68,10 @@ struct rtas_t rtas = {EXPORT_SYMBOL (rtas);DEFINE_SPINLOCK (rtas_data_buf_lock); -EXPORT_SYMBOL (rtas_data_buf_lock); +EXPORT_SYMBOL_GPL (rtas_data_buf_lock); char rtas_data_buf[RTAS_DATA_BUF_SIZE] __cacheline_aligned; -EXPORT_SYMBOL (rtas_data_buf); +EXPORT_SYMBOL_GPL (rtas_data_buf);unsigned long rtas_rmo_buf;
@@ -80,7 +80,7 @@ unsigned long rtas_rmo_buf;* This is done like this so rtas_flash can be a module. */ void (*rtas_flash_term_hook)(int ); -EXPORT_SYMBOL (rtas_flash_term_hook); +EXPORT_SYMBOL_GPL (rtas_flash_term_hook);/* RTAS use home made raw locking instead of spin_lock_irqsave * because those can be called from within really nasty contexts
@@ -328,7 +328,7 @@ void rtas_progress(char *s, unsigned short hex)spin_unlock (&progress_lock); } -EXPORT_SYMBOL (rtas_progress);/* needed by rtas_flash module */ +EXPORT_SYMBOL_GPL (rtas_progress);/* needed by rtas_flash module */ int rtas_token (const char *service) {
@@ -338,7 +338,7 @@ int rtas_token(const char *service) tokp =of_get_property (rtas.dev, service,NULL );return tokp ?be32_to_cpu (*tokp) :RTAS_UNKNOWN_SERVICE ; } -EXPORT_SYMBOL (rtas_token); +EXPORT_SYMBOL_GPL (rtas_token);int rtas_service_present (const char *service) {
@@ -498,7 +498,7 @@ int rtas_call(int token, int nargs, int nret, int *outputs, ...) }return ret; } -EXPORT_SYMBOL (rtas_call); +EXPORT_SYMBOL_GPL (rtas_call);/* For RTAS_BUSY (-2), delay for 1 millisecond. For an extended busy status * code of 990n, perform the hinted delay of 10^n (last digit) milliseconds.
@@ -533,7 +533,7 @@ unsigned int rtas_busy_delay(int status)return ms; } -EXPORT_SYMBOL (rtas_busy_delay); +EXPORT_SYMBOL_GPL (rtas_busy_delay);static int rtas_error_rc (int rtas_rc) {
@@ -579,7 +579,7 @@ int rtas_get_power_level(int powerdomain, int *level)return rtas_error_rc (rc);return rc; } -EXPORT_SYMBOL (rtas_get_power_level); +EXPORT_SYMBOL_GPL (rtas_get_power_level);int rtas_set_power_level (int powerdomain,int level,int *setlevel) {
@@ -597,7 +597,7 @@ int rtas_set_power_level(int powerdomain, int level, int *setlevel)return rtas_error_rc (rc);return rc; } -EXPORT_SYMBOL (rtas_set_power_level); +EXPORT_SYMBOL_GPL (rtas_set_power_level);int rtas_get_sensor (int sensor,int index,int *state) {
@@ -615,7 +615,7 @@ int rtas_get_sensor(int sensor, int index, int *state)return rtas_error_rc (rc);return rc; } -EXPORT_SYMBOL (rtas_get_sensor); +EXPORT_SYMBOL_GPL (rtas_get_sensor);int rtas_get_sensor_fast (int sensor,int index,int *state) {
@@ -676,7 +676,7 @@ int rtas_set_indicator(int indicator, int index, int new_value)return rtas_error_rc (rc);return rc; } -EXPORT_SYMBOL (rtas_set_indicator); +EXPORT_SYMBOL_GPL (rtas_set_indicator);/* * Ignoring RTAS extended delay
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 152/245 powerpc/rtas: ensure 4KB alignment for rtas_data_buf
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Lynch <[email protected]>
[ Upstream commit 836b5b9fcc8e09cea7e8a59a070349a00e818308 ]
Some RTAS functions that have work area parameters impose alignment requirements on the work area passed to them by the OS. Examples include:
- ibm,configure-connector
- ibm,update-nodes
- ibm,update-properties
4KB is the greatest alignment required by PAPR for such buffers. rtas_data_buf used to have a __page_aligned attribute in the arch/ppc64 days, but that was changed to __cacheline_aligned for unknown reasons by commit 033ef338b6e0 ("powerpc: Merge rtas.c into arch/powerpc/kernel"). That works out to 128-byte alignment on ppc64, which isn't right.
This was found by inspection and I'm not aware of any real problems caused by this. Either current RTAS implementations don't enforce the alignment constraints, or rtas_data_buf is always being placed at a 4KB boundary by accident (or both, perhaps).
Use __aligned(SZ_4K) to ensure the rtas_data_buf has alignment appropriate for all users.
--- arch/powerpc/kernel/rtas.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/kernel/rtas.c +1 -1
@@ -70,7 +70,7 @@ EXPORT_SYMBOL(rtas);DEFINE_SPINLOCK (rtas_data_buf_lock);EXPORT_SYMBOL_GPL (rtas_data_buf_lock); -char rtas_data_buf[RTAS_DATA_BUF_SIZE] __cacheline_aligned; +char rtas_data_buf[RTAS_DATA_BUF_SIZE ]__aligned(SZ_4K) ;EXPORT_SYMBOL_GPL (rtas_data_buf);unsigned long rtas_rmo_buf;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 153/245 powerpc/eeh: Small refactor of eeh_handle_normal_event()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Axtens <[email protected]>
[ Upstream commit 10b34ece132ee46dc4e6459c765d180c422a09fa ]
The control flow of eeh_handle_normal_event() is a bit tricky.
Break out one of the error handling paths - rather than be in an else block, we'll make it part of the regular body of the function and put a 'goto out;' in the true limb of the if.
Stable-dep-of: 9efcdaac36e1 ("powerpc/eeh: Set channel state after notifying the drivers")
--- arch/powerpc/kernel/eeh_driver.c | 69 ++++++++++++++++---------------- 1 file changed, 35 insertions(+), 34 deletions(-)
arch/powerpc/kernel/eeh_driver.c +35 -34
@@ -1054,45 +1054,46 @@ void eeh_handle_normal_event(struct eeh_pe *pe) }pr_info ("EEH: Recovery successful.\n" ); - }else { -/* -* About 90% of all real-life EEH failures in the field -* are due to poorly seated PCI cards. Only 10% or so are -* due to actual, failed cards. -*/ -pr_err ("EEH: Unable to recover from failure from PHB#%x-PE#%x.\n" -"Please try reseating or replacing it\n" , - pe->phb->global_number, pe->addr); + goto out; + } -eeh_slot_error_detail (pe,EEH_LOG_PERM ); +/* +* About 90% of all real-life EEH failures in the field +* are due to poorly seated PCI cards. Only 10% or so are +* due to actual, failed cards. +*/ +pr_err ("EEH: Unable to recover from failure from PHB#%x-PE#%x.\n" +"Please try reseating or replacing it\n" , + pe->phb->global_number, pe->addr); -/* Notify all devices that they're about to go down. */ -eeh_set_channel_state (pe, pci_channel_io_perm_failure); -eeh_set_irq_state (pe, false); -eeh_pe_report ("error_detected(permanent failure)" , pe, - eeh_report_failure,NULL ); +eeh_slot_error_detail (pe,EEH_LOG_PERM ); -/* Mark the PE to be removed permanently */ -eeh_pe_state_mark (pe,EEH_PE_REMOVED ); +/* Notify all devices that they're about to go down. */ +eeh_set_channel_state (pe, pci_channel_io_perm_failure); +eeh_set_irq_state (pe, false); +eeh_pe_report ("error_detected(permanent failure)" , pe, + eeh_report_failure,NULL ); -/* -* Shut down the device drivers for good. We mark -* all removed devices correctly to avoid access -* the their PCI config any more. -*/ -if (pe->type &EEH_PE_VF ) { -eeh_pe_dev_traverse (pe, eeh_rmv_device,NULL ); -eeh_pe_dev_mode_mark (pe,EEH_DEV_REMOVED ); - }else { -eeh_pe_state_clear (pe,EEH_PE_PRI_BUS , true); -eeh_pe_dev_mode_mark (pe,EEH_DEV_REMOVED ); +/* Mark the PE to be removed permanently */ +eeh_pe_state_mark (pe,EEH_PE_REMOVED ); -pci_lock_rescan_remove (); -pci_hp_remove_devices (bus); -pci_unlock_rescan_remove (); -/* The passed PE should no longer be used */ -return ; - } +/* +* Shut down the device drivers for good. We mark +* all removed devices correctly to avoid access +* the their PCI config any more. +*/ +if (pe->type &EEH_PE_VF ) { +eeh_pe_dev_traverse (pe, eeh_rmv_device,NULL ); +eeh_pe_dev_mode_mark (pe,EEH_DEV_REMOVED ); + }else { +eeh_pe_state_clear (pe,EEH_PE_PRI_BUS , true); +eeh_pe_dev_mode_mark (pe,EEH_DEV_REMOVED ); + +pci_lock_rescan_remove (); +pci_hp_remove_devices (bus); +pci_unlock_rescan_remove (); +/* The passed PE should no longer be used */ +return ; } out:
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 154/245 powerpc/eeh: Set channel state after notifying the drivers
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ganesh Goudar <[email protected]>
[ Upstream commit 9efcdaac36e1643a1b7f5337e6143ce142d381b1 ]
When a PCI error is encountered 6th time in an hour we set the channel state to perm_failure and notify the driver about the permanent failure.
However, after upstream commit 38ddc011478e ("powerpc/eeh:
Make permanently failed devices non-actionable"), EEH handler stops calling any routine once the device is marked as permanent failure. This issue can lead to fatal consequences like kernel hang with certain PCI devices.
Following log is observed with lpfc driver, with and without this change, Without this change kernel hangs, If PCI error is encountered 6 times for a device in an hour.
Without the change
EEH: Beginning: 'error_detected(permanent failure)' PCI 0132:60:00.0#600000: EEH: not actionable (1,1,1) PCI 0132:60:00.1#600000: EEH: not actionable (1,1,1)
EEH: Finished:'error_detected(permanent failure)'
With the change
EEH: Beginning: 'error_detected(permanent failure)'
EEH: Invoking lpfc->error_detected(permanent failure)
EEH: lpfc driver reports: 'disconnect'
EEH: Invoking lpfc->error_detected(permanent failure)
EEH: lpfc driver reports: 'disconnect'
EEH: Finished:'error_detected(permanent failure)'
To fix the issue, set channel state to permanent failure after notifying the drivers.
--- arch/powerpc/kernel/eeh_driver.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/powerpc/kernel/eeh_driver.c +2 -2
@@ -1069,10 +1069,10 @@ void eeh_handle_normal_event(struct eeh_pe *pe)eeh_slot_error_detail (pe,EEH_LOG_PERM );/* Notify all devices that they're about to go down. */ -eeh_set_channel_state (pe, pci_channel_io_perm_failure);eeh_set_irq_state (pe, false);eeh_pe_report ("error_detected(permanent failure)" , pe, eeh_report_failure,NULL ); +eeh_set_channel_state (pe, pci_channel_io_perm_failure);/* Mark the PE to be removed permanently */ eeh_pe_state_mark (pe,EEH_PE_REMOVED );
@@ -1189,10 +1189,10 @@ void eeh_handle_special_event(void)/* Notify all devices to be down */ eeh_pe_state_clear (pe,EEH_PE_PRI_BUS , true); -eeh_set_channel_state (pe, pci_channel_io_perm_failure);eeh_pe_report ("error_detected(permanent failure)" , pe, eeh_report_failure,NULL ); +eeh_set_channel_state (pe, pci_channel_io_perm_failure);pci_lock_rescan_remove ();list_for_each_entry (hose, &hose_list, list_node) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 155/245 PM: core: Redefine pm_ptr() macro
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Cercueil <[email protected]>
[ Upstream commit c06ef740d401d0f4ab188882bf6f8d9cf0f75eaf ]
The pm_ptr() macro was previously conditionally defined, according to the value of the CONFIG_PM option. This meant that the pointed structure was either referenced (if CONFIG_PM was set), or never referenced (if CONFIG_PM was not set), causing it to be detected as unused by the compiler.
This worked fine, but required the __maybe_unused compiler attribute to be used to every symbol pointed to by a pointer wrapped with pm_ptr().
We can do better. With this change, the pm_ptr() is now defined the same, independently of the value of CONFIG_PM. It now uses the (?:) ternary operator to conditionally resolve to its argument. Since the condition is known at compile time, the compiler will then choose to discard the unused symbols, which won't need to be tagged with __maybe_unused anymore.
This pm_ptr() macro is usually used with pointers to dev_pm_ops structures created with SIMPLE_DEV_PM_OPS() or similar macros. These do use a __maybe_unused flag, which is now useless with this change, so it later can be removed. However in the meantime it causes no harm, and all the drivers still compile fine with the new pm_ptr() macro.
Stable-dep-of: 18ab69c8ca56 ("Input: iqs269a - do not poll during suspend or resume")
--- include/linux/pm.h | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
include/linux/pm.h +1 -5
@@ -373,11 +373,7 @@ const struct dev_pm_ops __maybe_unused name = { \ SET_RUNTIME_PM_OPS(suspend_fn, resume_fn, idle_fn) \ } -#ifdef CONFIG_PM -#define pm_ptr (_ptr) (_ptr) -#else -#define pm_ptr (_ptr) NULL -#endif +#define pm_ptr (_ptr) PTR_IF(IS_ENABLED(CONFIG_PM), (_ptr))/* * PM_EVENT_ messages
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 156/245 PM: core: Add new *_PM_OPS macros, deprecate old ones
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Cercueil <[email protected]>
[ Upstream commit 1a3c7bb088266fa2db017be299f91f1c1894c857 ]
This commit introduces the following macros:
SYSTEM_SLEEP_PM_OPS()LATE_SYSTEM_SLEEP_PM_OPS()NOIRQ_SYSTEM_SLEEP_PM_OPS()RUNTIME_PM_OPS()
These new macros are very similar to their SET_*_PM_OPS() equivalent. They however differ in the fact that the callbacks they set will always be seen as referenced by the compiler. This means that the callback functions don't need to be wrapped with a #ifdef CONFIG_PM guard, or tagged with __maybe_unused, to prevent the compiler from complaining about unused static symbols. The compiler will then simply evaluate at compile time whether or not these symbols are dead code.
The callbacks that are only useful with CONFIG_PM_SLEEP is enabled, are now also wrapped with a new pm_sleep_ptr() macro, which is inspired from pm_ptr(). This is needed for drivers that use different callbacks for sleep and runtime PM, to handle the case where CONFIG_PM is set and CONFIG_PM_SLEEP is not.
This commit also deprecates the following macros:
SIMPLE_DEV_PM_OPS()UNIVERSAL_DEV_PM_OPS()
And introduces the following macros:
DEFINE_SIMPLE_DEV_PM_OPS()DEFINE_UNIVERSAL_DEV_PM_OPS()
These macros are similar to the functions they were created to replace, with the following differences:
- They use the new macros introduced above, and as such always reference the provided callback functions.
- They are not tagged with __maybe_unused. They are meant to be used with pm_ptr() or pm_sleep_ptr() for DEFINE_UNIVERSAL_DEV_PM_OPS() and DEFINE_SIMPLE_DEV_PM_OPS() respectively.
- They declare the symbol static, since every driver seems to do that anyway; and if a non-static use-case is needed an indirection pointer could be used.
The point of this change, is to progressively switch from a code model where PM callbacks are all protected behind CONFIG_PM guards, to a code model where the PM callbacks are always seen by the compiler, but discarded if not used.
Stable-dep-of: 18ab69c8ca56 ("Input: iqs269a - do not poll during suspend or resume")
--- include/linux/pm.h | 74 +++++++++++++++++++++++++++++++--------------- 1 file changed, 50 insertions(+), 24 deletions(-)
include/linux/pm.h +50 -24
@@ -300,47 +300,59 @@ struct dev_pm_ops {int (*runtime_idle)(struct device *dev); }; +#define SYSTEM_SLEEP_PM_OPS (suspend_fn, resume_fn) \ + .suspend = pm_sleep_ptr(suspend_fn), \ + .resume = pm_sleep_ptr(resume_fn), \ + .freeze = pm_sleep_ptr(suspend_fn), \ + .thaw = pm_sleep_ptr(resume_fn), \ + .poweroff = pm_sleep_ptr(suspend_fn), \ + .restore = pm_sleep_ptr(resume_fn), + +#define LATE_SYSTEM_SLEEP_PM_OPS (suspend_fn, resume_fn) \ + .suspend_late = pm_sleep_ptr(suspend_fn), \ + .resume_early = pm_sleep_ptr(resume_fn), \ + .freeze_late = pm_sleep_ptr(suspend_fn), \ + .thaw_early = pm_sleep_ptr(resume_fn), \ + .poweroff_late = pm_sleep_ptr(suspend_fn), \ + .restore_early = pm_sleep_ptr(resume_fn), + +#define NOIRQ_SYSTEM_SLEEP_PM_OPS (suspend_fn, resume_fn) \ + .suspend_noirq = pm_sleep_ptr(suspend_fn), \ + .resume_noirq = pm_sleep_ptr(resume_fn), \ + .freeze_noirq = pm_sleep_ptr(suspend_fn), \ + .thaw_noirq = pm_sleep_ptr(resume_fn), \ + .poweroff_noirq = pm_sleep_ptr(suspend_fn), \ + .restore_noirq = pm_sleep_ptr(resume_fn), + +#define RUNTIME_PM_OPS (suspend_fn, resume_fn, idle_fn) \ + .runtime_suspend = suspend_fn, \ + .runtime_resume = resume_fn, \ + .runtime_idle = idle_fn, +#ifdef CONFIG_PM_SLEEP #define SET_SYSTEM_SLEEP_PM_OPS (suspend_fn, resume_fn) \ - .suspend = suspend_fn, \ - .resume = resume_fn, \ - .freeze = suspend_fn, \ - .thaw = resume_fn, \ - .poweroff = suspend_fn, \ - .restore = resume_fn, + SYSTEM_SLEEP_PM_OPS(suspend_fn, resume_fn)#else #define SET_SYSTEM_SLEEP_PM_OPS (suspend_fn, resume_fn)#endif #ifdef CONFIG_PM_SLEEP #define SET_LATE_SYSTEM_SLEEP_PM_OPS (suspend_fn, resume_fn) \ - .suspend_late = suspend_fn, \ - .resume_early = resume_fn, \ - .freeze_late = suspend_fn, \ - .thaw_early = resume_fn, \ - .poweroff_late = suspend_fn, \ - .restore_early = resume_fn, + LATE_SYSTEM_SLEEP_PM_OPS(suspend_fn, resume_fn)#else #define SET_LATE_SYSTEM_SLEEP_PM_OPS (suspend_fn, resume_fn)#endif #ifdef CONFIG_PM_SLEEP #define SET_NOIRQ_SYSTEM_SLEEP_PM_OPS (suspend_fn, resume_fn) \ - .suspend_noirq = suspend_fn, \ - .resume_noirq = resume_fn, \ - .freeze_noirq = suspend_fn, \ - .thaw_noirq = resume_fn, \ - .poweroff_noirq = suspend_fn, \ - .restore_noirq = resume_fn, + NOIRQ_SYSTEM_SLEEP_PM_OPS(suspend_fn, resume_fn)#else #define SET_NOIRQ_SYSTEM_SLEEP_PM_OPS (suspend_fn, resume_fn)#endif #ifdef CONFIG_PM #define SET_RUNTIME_PM_OPS (suspend_fn, resume_fn, idle_fn) \ - .runtime_suspend = suspend_fn, \ - .runtime_resume = resume_fn, \ - .runtime_idle = idle_fn, + RUNTIME_PM_OPS(suspend_fn, resume_fn, idle_fn)#else #define SET_RUNTIME_PM_OPS (suspend_fn, resume_fn, idle_fn)#endif
@@ -349,9 +361,9 @@ struct dev_pm_ops {* Use this if you want to use the same suspend and resume callbacks for suspend * to RAM and hibernation. */ -#define SIMPLE_DEV_PM_OPS (name, suspend_fn, resume_fn) \ -const struct dev_pm_ops __maybe_unused name = { \ - SET_SYSTEM_SLEEP_PM_OPS(suspend_fn, resume_fn) \ +#define DEFINE_SIMPLE_DEV_PM_OPS (name, suspend_fn, resume_fn) \ +static const struct dev_pm_ops name = { \ + SYSTEM_SLEEP_PM_OPS(suspend_fn, resume_fn) \ }/*
@@ -367,6 +379,19 @@ const struct dev_pm_ops __maybe_unused name = { \* .resume_early(), to the same routines as .runtime_suspend() and * .runtime_resume(), respectively (and analogously for hibernation). */ +#define DEFINE_UNIVERSAL_DEV_PM_OPS (name, suspend_fn, resume_fn, idle_fn) \ +static const struct dev_pm_ops name = { \ + SYSTEM_SLEEP_PM_OPS(suspend_fn, resume_fn) \ + RUNTIME_PM_OPS(suspend_fn, resume_fn, idle_fn) \ +} + +/* Deprecated. Use DEFINE_SIMPLE_DEV_PM_OPS() instead. */ +#define SIMPLE_DEV_PM_OPS (name, suspend_fn, resume_fn) \ +const struct dev_pm_ops __maybe_unused name = { \ + SET_SYSTEM_SLEEP_PM_OPS(suspend_fn, resume_fn) \ +} + +/* Deprecated. Use DEFINE_UNIVERSAL_DEV_PM_OPS() instead. */ #define UNIVERSAL_DEV_PM_OPS (name, suspend_fn, resume_fn, idle_fn) \ const struct dev_pm_ops __maybe_unused name = { \ SET_SYSTEM_SLEEP_PM_OPS(suspend_fn, resume_fn) \
@@ -374,6 +399,7 @@ const struct dev_pm_ops __maybe_unused name = { \ }#define pm_ptr (_ptr) PTR_IF(IS_ENABLED(CONFIG_PM), (_ptr)) +#define pm_sleep_ptr (_ptr) PTR_IF(IS_ENABLED(CONFIG_PM_SLEEP), (_ptr))/* * PM_EVENT_ messages
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 157/245 mmc: jz4740: Use the new PM macros
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Cercueil <[email protected]>
[ Upstream commit e0d64ecc621715e9c7807e952b68475c62bbf630 ]
- Use DEFINE_SIMPLE_DEV_PM_OPS() instead of the SIMPLE_DEV_PM_OPS() macro. This makes it possible to remove the __maybe_unused flags on the callback functions.
- Since we only have callbacks for suspend/resume, we can conditionally compile the dev_pm_ops structure for when CONFIG_PM_SLEEP is enabled; so use the pm_sleep_ptr() macro instead of pm_ptr().
Stable-dep-of: 18ab69c8ca56 ("Input: iqs269a - do not poll during suspend or resume")
--- drivers/mmc/host/jz4740_mmc.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/mmc/host/jz4740_mmc.c +4 -4
@@ -1133,17 +1133,17 @@ static int jz4740_mmc_remove(struct platform_device *pdev)return 0 ; } -static int __maybe_unused jz4740_mmc_suspend (struct device *dev) +static int jz4740_mmc_suspend (struct device *dev) {return pinctrl_pm_select_sleep_state (dev); } -static int __maybe_unused jz4740_mmc_resume (struct device *dev) +static int jz4740_mmc_resume (struct device *dev) {return pinctrl_select_default_state (dev); } -static SIMPLE_DEV_PM_OPS(jz4740_mmc_pm_ops, jz4740_mmc_suspend, +DEFINE_SIMPLE_DEV_PM_OPS (jz4740_mmc_pm_ops, jz4740_mmc_suspend, jz4740_mmc_resume);static struct platform_driver jz4740_mmc_driver = {
@@ -1153,7 +1153,7 @@ static struct platform_driver jz4740_mmc_driver = { .name = "jz4740-mmc", .probe_type = PROBE_PREFER_ASYNCHRONOUS, .of_match_table = of_match_ptr(jz4740_mmc_of_match), - .pm = pm_ptr(&jz4740_mmc_pm_ops), + .pm = pm_sleep_ptr(&jz4740_mmc_pm_ops), }, };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 158/245 mmc: mxc: Use the new PM macros
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Cercueil <[email protected]>
[ Upstream commit 2cdbd92c2d1dff07ad56c39f5857ee644bbd2c8a ]
Use DEFINE_SIMPLE_DEV_PM_OPS() instead of the SIMPLE_DEV_PM_OPS() macro, along with using pm_sleep_ptr() as this driver doesn't handle runtime PM.
This makes it possible to remove the #ifdef CONFIG_PM guard around the suspend/resume functions.
Stable-dep-of: 18ab69c8ca56 ("Input: iqs269a - do not poll during suspend or resume")
--- drivers/mmc/host/mxcmmc.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/mmc/host/mxcmmc.c +2 -4
@@ -1185,7 +1185,6 @@ static int mxcmci_remove(struct platform_device *pdev)return 0 ; } -#ifdef CONFIG_PM_SLEEP static int mxcmci_suspend (struct device *dev) {struct mmc_host *mmc =dev_get_drvdata (dev);
@@ -1212,9 +1211,8 @@ static int mxcmci_resume(struct device *dev)return ret; } -#endif -static SIMPLE_DEV_PM_OPS(mxcmci_pm_ops, mxcmci_suspend, mxcmci_resume); +DEFINE_SIMPLE_DEV_PM_OPS (mxcmci_pm_ops, mxcmci_suspend, mxcmci_resume);static struct platform_driver mxcmci_driver = { .probe = mxcmci_probe,
@@ -1222,7 +1220,7 @@ static struct platform_driver mxcmci_driver = { .driver = { .name = DRIVER_NAME, .probe_type = PROBE_PREFER_ASYNCHRONOUS, - .pm = &mxcmci_pm_ops, + .pm = pm_sleep_ptr(&mxcmci_pm_ops), .of_match_table = mxcmci_of_match, } };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 159/245 PM: core: Remove static qualifier in DEFINE_SIMPLE_DEV_PM_OPS macro
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Cercueil <[email protected]>
[ Upstream commit 52cc1d7f9786d2be44a3ab9b5b48416a7618e713 ]
Keep this macro in line with the other ones. This makes it possible to use them in the cases where the underlying dev_pm_ops structure is exported.
Restore the "static" qualifier in the two drivers where the DEFINE_SIMPLE_DEV_PM_OPS macro was used.
Stable-dep-of: 18ab69c8ca56 ("Input: iqs269a - do not poll during suspend or resume")
--- drivers/mmc/host/jz4740_mmc.c | 4 ++-- drivers/mmc/host/mxcmmc.c | 2 +- include/linux/pm.h | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-)
drivers/mmc/host/jz4740_mmc.c +2 -2
@@ -1143,8 +1143,8 @@ static int jz4740_mmc_resume(struct device *dev)return pinctrl_select_default_state (dev); } -DEFINE_SIMPLE_DEV_PM_OPS (jz4740_mmc_pm_ops, jz4740_mmc_suspend, - jz4740_mmc_resume); +static DEFINE_SIMPLE_DEV_PM_OPS(jz4740_mmc_pm_ops, jz4740_mmc_suspend, + jz4740_mmc_resume);static struct platform_driver jz4740_mmc_driver = { .probe = jz4740_mmc_probe,
drivers/mmc/host/mxcmmc.c +1 -1
@@ -1212,7 +1212,7 @@ static int mxcmci_resume(struct device *dev)return ret; } -DEFINE_SIMPLE_DEV_PM_OPS (mxcmci_pm_ops, mxcmci_suspend, mxcmci_resume); +static DEFINE_SIMPLE_DEV_PM_OPS(mxcmci_pm_ops, mxcmci_suspend, mxcmci_resume);static struct platform_driver mxcmci_driver = { .probe = mxcmci_probe,
include/linux/pm.h +1 -1
@@ -362,7 +362,7 @@ struct dev_pm_ops {* to RAM and hibernation. */ #define DEFINE_SIMPLE_DEV_PM_OPS (name, suspend_fn, resume_fn) \ -static const struct dev_pm_ops name = { \ +const struct dev_pm_ops name = { \ SYSTEM_SLEEP_PM_OPS(suspend_fn, resume_fn) \ }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 160/245 Input: iqs269a - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Cameron <[email protected]>
[ Upstream commit 29eac950768a48651e2389f7d3f2ad597f6e58d1 ]
SIMPLE_DEV_PM_OPS() is deprecated as it requires explicit protection against unused function warnings. The new combination of pm_sleep_ptr() and DEFINE_SIMPLE_DEV_PM_OPS() allows the compiler to see the functions, thus suppressing the warning, but still allowing the unused code to be removed. Thus also drop the __maybe_unused markings.
Stable-dep-of: 18ab69c8ca56 ("Input: iqs269a - do not poll during suspend or resume")
--- drivers/input/misc/iqs269a.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/input/misc/iqs269a.c +4 -4
@@ -1687,7 +1687,7 @@ static int iqs269_probe(struct i2c_client *client)return error; } -static int __maybe_unused iqs269_suspend (struct device *dev) +static int iqs269_suspend (struct device *dev) {struct iqs269_private *iqs269 =dev_get_drvdata (dev);struct i2c_client *client = iqs269->client;
@@ -1746,7 +1746,7 @@ static int __maybe_unused iqs269_suspend(struct device *dev)return error; } -static int __maybe_unused iqs269_resume (struct device *dev) +static int iqs269_resume (struct device *dev) {struct iqs269_private *iqs269 =dev_get_drvdata (dev);struct i2c_client *client = iqs269->client;
@@ -1793,7 +1793,7 @@ static int __maybe_unused iqs269_resume(struct device *dev)return error; } -static SIMPLE_DEV_PM_OPS(iqs269_pm, iqs269_suspend, iqs269_resume); +static DEFINE_SIMPLE_DEV_PM_OPS(iqs269_pm, iqs269_suspend, iqs269_resume);static const struct of_device_id iqs269_of_match[] = { { .compatible ="azoteq,iqs269a" },
@@ -1805,7 +1805,7 @@ static struct i2c_driver iqs269_i2c_driver = { .driver = { .name = "iqs269a", .of_match_table = iqs269_of_match, - .pm = &iqs269_pm, + .pm = pm_sleep_ptr(&iqs269_pm), }, .probe_new = iqs269_probe, };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 161/245 Input: iqs269a - do not poll during suspend or resume
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff LaBundy <[email protected]>
[ Upstream commit 18ab69c8ca5678324efbeed874b707ce7b2feae1 ]
Polling the device while it transitions from automatic to manual power mode switching may keep the device from actually finishing the transition. The process appears to time out depending on the polling rate and the device's core clock frequency.
This is ultimately unnecessary in the first place; instead it is sufficient to write the desired mode during initialization, then disable automatic switching at suspend. This eliminates the need to ensure the device is prepared for a manual change and removes the 'suspend_mode' variable.
Similarly, polling the device while it transitions from one mode to another under manual control may time out as well. This added step does not appear to be necessary either, so drop it.
--- drivers/input/misc/iqs269a.c | 118 +++++++++-------------------------- 1 file changed, 31 insertions(+), 87 deletions(-)
drivers/input/misc/iqs269a.c +31 -87
@@ -148,9 +148,6 @@#define IQS269_ATI_POLL_TIMEOUT_US (iqs269->delay_mult * 500000)#define IQS269_ATI_STABLE_DELAY_MS (iqs269->delay_mult * 150) -#define IQS269_PWR_MODE_POLL_SLEEP_US IQS269_ATI_POLL_SLEEP_US -#define IQS269_PWR_MODE_POLL_TIMEOUT_US IQS269_ATI_POLL_TIMEOUT_US -#define iqs269_irq_wait () usleep_range(200, 250)enum iqs269_local_cap_size {
@@ -295,7 +292,6 @@ struct iqs269_private {struct input_dev *keypad;struct input_dev *slider[IQS269_NUM_SL ];unsigned int keycode[ARRAY_SIZE (iqs269_events) *IQS269_NUM_CH ]; -unsigned int suspend_mode;unsigned int delay_mult;unsigned int ch_num;bool hall_enable;
@@ -767,17 +763,6 @@ static int iqs269_parse_prop(struct iqs269_private *iqs269) iqs269->hall_enable =device_property_present (&client->dev,"azoteq,hall-enable" ); -if (!device_property_read_u32 (&client->dev,"azoteq,suspend-mode" , - &val)) { -if (val >IQS269_SYS_SETTINGS_PWR_MODE_MAX ) { -dev_err (&client->dev,"Invalid suspend mode: %u\n" , - val); -return -EINVAL ; - } - - iqs269->suspend_mode = val; - } - error =regmap_raw_read (iqs269->regmap,IQS269_SYS_SETTINGS , sys_reg,sizeof (*sys_reg));if (error)
@@ -1005,6 +990,17 @@ static int iqs269_parse_prop(struct iqs269_private *iqs269) general &= ~IQS269_SYS_SETTINGS_DIS_AUTO ; general &= ~IQS269_SYS_SETTINGS_PWR_MODE_MASK ; +if (!device_property_read_u32 (&client->dev,"azoteq,suspend-mode" , + &val)) { +if (val >IQS269_SYS_SETTINGS_PWR_MODE_MAX ) { +dev_err (&client->dev,"Invalid suspend mode: %u\n" , + val); +return -EINVAL ; + } + + general |= (val <<IQS269_SYS_SETTINGS_PWR_MODE_SHIFT ); + } +if (!device_property_read_u32 (&client->dev,"azoteq,ulp-update" , &val)) {if (val >IQS269_SYS_SETTINGS_ULP_UPDATE_MAX ) {
@@ -1687,59 +1683,30 @@ static int iqs269_probe(struct i2c_client *client)return error; } +static u16 iqs269_general_get (struct iqs269_private *iqs269) +{ +u16 general =be16_to_cpu (iqs269->sys_reg.general); + + general &= ~IQS269_SYS_SETTINGS_REDO_ATI ; + general &= ~IQS269_SYS_SETTINGS_ACK_RESET ; + +return general |IQS269_SYS_SETTINGS_DIS_AUTO ; +} +static int iqs269_suspend (struct device *dev) {struct iqs269_private *iqs269 =dev_get_drvdata (dev);struct i2c_client *client = iqs269->client; -unsigned int val;int error; +u16 general =iqs269_general_get (iqs269); -if (!iqs269->suspend_mode) +if (!(general &IQS269_SYS_SETTINGS_PWR_MODE_MASK ))return 0 ;disable_irq (client->irq); -/* -* Automatic power mode switching must be disabled before the device is -* forced into any particular power mode. In this case, the device will -* transition into normal-power mode. -*/ - error =regmap_update_bits (iqs269->regmap,IQS269_SYS_SETTINGS , -IQS269_SYS_SETTINGS_DIS_AUTO , ~0 ); -if (error) - goto err_irq; - -/* -* The following check ensures the device has completed its transition -* into normal-power mode before a manual mode switch is performed. -*/ - error =regmap_read_poll_timeout (iqs269->regmap,IQS269_SYS_FLAGS , val, - !(val &IQS269_SYS_FLAGS_PWR_MODE_MASK ), -IQS269_PWR_MODE_POLL_SLEEP_US , -IQS269_PWR_MODE_POLL_TIMEOUT_US ); -if (error) - goto err_irq; - - error =regmap_update_bits (iqs269->regmap,IQS269_SYS_SETTINGS , -IQS269_SYS_SETTINGS_PWR_MODE_MASK , - iqs269->suspend_mode << -IQS269_SYS_SETTINGS_PWR_MODE_SHIFT ); -if (error) - goto err_irq; - -/* -* This last check ensures the device has completed its transition into -* the desired power mode to prevent any spurious interrupts from being -* triggered after iqs269_suspend has already returned. -*/ - error =regmap_read_poll_timeout (iqs269->regmap,IQS269_SYS_FLAGS , val, - (val &IQS269_SYS_FLAGS_PWR_MODE_MASK ) - == (iqs269->suspend_mode << -IQS269_SYS_FLAGS_PWR_MODE_SHIFT ), -IQS269_PWR_MODE_POLL_SLEEP_US , -IQS269_PWR_MODE_POLL_TIMEOUT_US ); + error =regmap_write (iqs269->regmap,IQS269_SYS_SETTINGS , general); -err_irq:iqs269_irq_wait ();enable_irq (client->irq);
@@ -1750,43 +1717,20 @@ static int iqs269_resume(struct device *dev) {struct iqs269_private *iqs269 =dev_get_drvdata (dev);struct i2c_client *client = iqs269->client; -unsigned int val;int error; +u16 general =iqs269_general_get (iqs269); -if (!iqs269->suspend_mode) +if (!(general &IQS269_SYS_SETTINGS_PWR_MODE_MASK ))return 0 ;disable_irq (client->irq); - error =regmap_update_bits (iqs269->regmap,IQS269_SYS_SETTINGS , -IQS269_SYS_SETTINGS_PWR_MODE_MASK ,0 ); -if (error) - goto err_irq; - -/* -* This check ensures the device has returned to normal-power mode -* before automatic power mode switching is re-enabled. -*/ - error =regmap_read_poll_timeout (iqs269->regmap,IQS269_SYS_FLAGS , val, - !(val &IQS269_SYS_FLAGS_PWR_MODE_MASK ), -IQS269_PWR_MODE_POLL_SLEEP_US , -IQS269_PWR_MODE_POLL_TIMEOUT_US ); -if (error) - goto err_irq; - - error =regmap_update_bits (iqs269->regmap,IQS269_SYS_SETTINGS , -IQS269_SYS_SETTINGS_DIS_AUTO ,0 ); -if (error) - goto err_irq; - -/* -* This step reports any events that may have been "swallowed" as a -* result of polling PWR_MODE (which automatically acknowledges any -* pending interrupts). -*/ - error =iqs269_report (iqs269); + error =regmap_write (iqs269->regmap,IQS269_SYS_SETTINGS , + general & ~IQS269_SYS_SETTINGS_PWR_MODE_MASK ); +if (!error) + error =regmap_write (iqs269->regmap,IQS269_SYS_SETTINGS , + general & ~IQS269_SYS_SETTINGS_DIS_AUTO ); -err_irq:iqs269_irq_wait ();enable_irq (client->irq);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 162/245 Input: iqs269a - do not poll during ATI
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff LaBundy <[email protected]>
[ Upstream commit b08134eb254db56e9ce8170d9b82f0d7a616b6f8 ]
After initial start-up, the driver triggers ATI (calibration) with the newly loaded register configuration in place. Next, the driver polls a register field to ensure ATI completed in a timely fashion and that the device is ready to sense.
However, communicating with the device over I2C while ATI is under- way may induce noise in the device and cause ATI to fail. As such, the vendor recommends not to poll the device during ATI.
To solve this problem, let the device naturally signal to the host that ATI is complete by way of an interrupt. A completion prevents the device from successfully probing until this happens.
As an added benefit, initial switch states are now reported in the interrupt handler at the same time ATI status is checked. As such, duplicate code that reports initial switch states has been removed from iqs269_input_init().
The former logic that scaled ATI timeout and filter settling delay is not carried forward with the new implementation, as it produces overly conservative delays at the lower clock rate.
Rather, a single timeout that covers both clock rates is used. The filter settling delay does not happen to be necessary and has been removed as well.
--- drivers/input/misc/iqs269a.c | 97 +++++++++++++++++------------------- 1 file changed, 46 insertions(+), 51 deletions(-)
drivers/input/misc/iqs269a.c +46 -51
@@ -9,6 +9,7 @@* axial sliders presented by the device. */ +#include <linux/completion.h> #include <linux/delay.h> #include <linux/device.h> #include <linux/err.h>
@@ -144,10 +145,6 @@#define IQS269_NUM_CH 8#define IQS269_NUM_SL 2 -#define IQS269_ATI_POLL_SLEEP_US (iqs269->delay_mult * 10000) -#define IQS269_ATI_POLL_TIMEOUT_US (iqs269->delay_mult * 500000) -#define IQS269_ATI_STABLE_DELAY_MS (iqs269->delay_mult * 150) -#define iqs269_irq_wait () usleep_range(200, 250)enum iqs269_local_cap_size {
@@ -289,10 +286,10 @@ struct iqs269_private {struct mutex lock;struct iqs269_switch_desc switches[ARRAY_SIZE (iqs269_events)];struct iqs269_sys_reg sys_reg; +struct completion ati_done;struct input_dev *keypad;struct input_dev *slider[IQS269_NUM_SL ];unsigned int keycode[ARRAY_SIZE (iqs269_events) *IQS269_NUM_CH ]; -unsigned int delay_mult;unsigned int ch_num;bool hall_enable;bool ati_current;
@@ -973,13 +970,8 @@ static int iqs269_parse_prop(struct iqs269_private *iqs269) general =be16_to_cpu (sys_reg->general); -if (device_property_present (&client->dev,"azoteq,clk-div" )) { +if (device_property_present (&client->dev,"azoteq,clk-div" )) general |=IQS269_SYS_SETTINGS_CLK_DIV ; - iqs269->delay_mult =4 ; - }else { - general &= ~IQS269_SYS_SETTINGS_CLK_DIV ; - iqs269->delay_mult =1 ; - }/* * Configure the device to automatically switch between normal and low-
@@ -1036,7 +1028,6 @@ static int iqs269_parse_prop(struct iqs269_private *iqs269)static int iqs269_dev_init (struct iqs269_private *iqs269) { -unsigned int val;int error;mutex_lock (&iqs269->lock);
@@ -1052,14 +1043,12 @@ static int iqs269_dev_init(struct iqs269_private *iqs269)if (error) goto err_mutex; - error =regmap_read_poll_timeout (iqs269->regmap,IQS269_SYS_FLAGS , val, - !(val &IQS269_SYS_FLAGS_IN_ATI ), -IQS269_ATI_POLL_SLEEP_US , -IQS269_ATI_POLL_TIMEOUT_US ); -if (error) - goto err_mutex; +/* +* The following delay gives the device time to deassert its RDY output +* so as to prevent an interrupt from being serviced prematurely. +*/ +usleep_range (2000 ,2100 ); -msleep (IQS269_ATI_STABLE_DELAY_MS ); iqs269->ati_current = true; err_mutex:
@@ -1071,10 +1060,8 @@ static int iqs269_dev_init(struct iqs269_private *iqs269)static int iqs269_input_init (struct iqs269_private *iqs269) {struct i2c_client *client = iqs269->client; -struct iqs269_flags flags;unsigned int sw_code, keycode;int error, i, j; -u8 dir_mask, state; iqs269->keypad =devm_input_allocate_device (&client->dev);if (!iqs269->keypad)
@@ -1087,23 +1074,7 @@ static int iqs269_input_init(struct iqs269_private *iqs269) iqs269->keypad->name ="iqs269a_keypad" ; iqs269->keypad->id.bustype =BUS_I2C ; -if (iqs269->hall_enable) { - error =regmap_raw_read (iqs269->regmap,IQS269_SYS_FLAGS , - &flags,sizeof (flags)); -if (error) { -dev_err (&client->dev, -"Failed to read initial status: %d\n" , error); -return error; - } - } -for (i =0 ; i <ARRAY_SIZE (iqs269_events); i++) { - dir_mask = flags.states[IQS269_ST_OFFS_DIR ]; -if (!iqs269_events[i].dir_up) - dir_mask = ~dir_mask; - - state = flags.states[iqs269_events[i].st_offs] & dir_mask; - sw_code = iqs269->switches[i].code;for (j =0 ; j <IQS269_NUM_CH ; j++) {
@@ -1116,13 +1087,9 @@ static int iqs269_input_init(struct iqs269_private *iqs269)switch (j) {case IQS269_CHx_HALL_ACTIVE:if (iqs269->hall_enable && - iqs269->switches[i].enabled) { + iqs269->switches[i].enabled)input_set_capability (iqs269->keypad,EV_SW , sw_code); -input_report_switch (iqs269->keypad, - sw_code, - state &BIT (j)); - } fallthrough;case IQS269_CHx_HALL_INACTIVE:
@@ -1138,14 +1105,6 @@ static int iqs269_input_init(struct iqs269_private *iqs269) } } -input_sync (iqs269->keypad); - - error =input_register_device (iqs269->keypad); -if (error) { -dev_err (&client->dev,"Failed to register keypad: %d\n" , error); -return error; - } -for (i =0 ; i <IQS269_NUM_SL ; i++) {if (!iqs269->sys_reg.slider_select[i])continue ;
@@ -1205,6 +1164,9 @@ static int iqs269_report(struct iqs269_private *iqs269)return error; } +if (be16_to_cpu (flags.system) &IQS269_SYS_FLAGS_IN_ATI ) +return 0 ; + error =regmap_raw_read (iqs269->regmap,IQS269_SLIDER_X , slider_x,sizeof (slider_x));if (error) {
@@ -1267,6 +1229,12 @@ static int iqs269_report(struct iqs269_private *iqs269)input_sync (iqs269->keypad); +/* +* The following completion signals that ATI has finished, any initial +* switch states have been reported and the keypad can be registered. +*/ +complete_all (&iqs269->ati_done); +return 0 ; }
@@ -1298,6 +1266,9 @@ static ssize_t counts_show(struct device *dev,if (!iqs269->ati_current || iqs269->hall_enable)return -EPERM ; +if (!completion_done (&iqs269->ati_done)) +return -EBUSY ; +/* * Unsolicited I2C communication prompts the device to assert its RDY * pin, so disable the interrupt line until the operation is finished
@@ -1554,7 +1525,9 @@ static ssize_t ati_trigger_show(struct device *dev, {struct iqs269_private *iqs269 =dev_get_drvdata (dev); -return scnprintf (buf,PAGE_SIZE ,"%u\n" , iqs269->ati_current); +return scnprintf (buf,PAGE_SIZE ,"%u\n" , + iqs269->ati_current && +completion_done (&iqs269->ati_done)); } static ssize_t ati_trigger_store(struct device *dev,
@@ -1574,6 +1547,7 @@ static ssize_t ati_trigger_store(struct device *dev,return count;disable_irq (client->irq); +reinit_completion (&iqs269->ati_done); error =iqs269_dev_init (iqs269);
@@ -1583,6 +1557,10 @@ static ssize_t ati_trigger_store(struct device *dev,if (error)return error; +if (!wait_for_completion_timeout (&iqs269->ati_done, +msecs_to_jiffies (2000 ))) +return -ETIMEDOUT ; +return count; }
@@ -1641,6 +1619,7 @@ static int iqs269_probe(struct i2c_client *client) }mutex_init (&iqs269->lock); +init_completion (&iqs269->ati_done); error =regmap_raw_read (iqs269->regmap,IQS269_VER_INFO , &ver_info,sizeof (ver_info));
@@ -1676,6 +1655,22 @@ static int iqs269_probe(struct i2c_client *client)return error; } +if (!wait_for_completion_timeout (&iqs269->ati_done, +msecs_to_jiffies (2000 ))) { +dev_err (&client->dev,"Failed to complete ATI\n" ); +return -ETIMEDOUT ; + } + +/* +* The keypad may include one or more switches and is not registered +* until ATI is complete and the initial switch states are read. +*/ + error =input_register_device (iqs269->keypad); +if (error) { +dev_err (&client->dev,"Failed to register keypad: %d\n" , error); +return error; + } + error =devm_device_add_group (&client->dev, &iqs269_attr_group);if (error)dev_err (&client->dev,"Failed to add attributes: %d\n" , error);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 163/245 net/sched: Refactor qdisc_graft() for ingress and clsact Qdiscs
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peilin Ye <[email protected]>
[ Upstream commit 2d5f6a8d7aef7852a9ecc555f88c673a1c91754f ]
Grafting ingress and clsact Qdiscs does not need a for-loop in qdisc_graft(). Refactor it. No functional changes intended.
--- net/sched/sch_api.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)
net/sched/sch_api.c +10 -10
@@ -1044,12 +1044,12 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent,if (parent ==NULL ) {unsigned int i, num_q, ingress; +struct netdev_queue *dev_queue; ingress =0 ; num_q = dev->num_tx_queues;if ((q && q->flags &TCQ_F_INGRESS ) || (new && new->flags &TCQ_F_INGRESS )) { - num_q =1 ; ingress =1 ;if (!dev_ingress_queue (dev)) {NL_SET_ERR_MSG (extack,"Device does not have an ingress queue" );
@@ -1065,18 +1065,18 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent,if (new && new->ops->attach && !ingress) goto skip; -for (i =0 ; i < num_q; i++) { -struct netdev_queue *dev_queue =dev_ingress_queue (dev); - -if (!ingress) +if (!ingress) { +for (i =0 ; i < num_q; i++) { dev_queue =netdev_get_tx_queue (dev, i); + old =dev_graft_qdisc (dev_queue, new); - old =dev_graft_qdisc (dev_queue, new); -if (new && i >0 ) -qdisc_refcount_inc (new); - -if (!ingress) +if (new && i >0 ) +qdisc_refcount_inc (new);qdisc_put (old); + } + }else { + dev_queue =dev_ingress_queue (dev); + old =dev_graft_qdisc (dev_queue, new); } skip:
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 164/245 netfilter: nf_tables: add rescheduling points during loop detection walks
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 81ea010667417ef3f218dfd99b69769fe66c2b67 ]
Add explicit rescheduling points during ruleset walk.
Switching to a faster algorithm is possible but this is a much smaller change, suitable for nf tree.
--- net/netfilter/nf_tables_api.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/netfilter/nf_tables_api.c +6 -0
@@ -3442,6 +3442,8 @@ int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain)if (err <0 )return err; } + +cond_resched (); }return 0 ;
@@ -10041,9 +10043,13 @@ static int nf_tables_check_loops(const struct nft_ctx *ctx,break ; } } + +cond_resched (); }list_for_each_entry (set, &ctx->table->sets, list) { +cond_resched (); +if (!nft_is_active_next (ctx->net, set))continue ; if (!(set->flags & NFT_SET_MAP) ||
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 165/245 debugobjects: Recheck debug_objects_enabled before reporting
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <[email protected]>
[ Upstream commit 8b64d420fe2450f82848178506d3e3a0bd195539 ]
syzbot is reporting false a positive ODEBUG message immediately after ODEBUG was disabled due to OOM.
[ 1062.309646][T22911] ODEBUG: Out of memory. ODEBUG disabled [ 1062.886755][ T5171] ------------[ cut here ]------------ [ 1062.892770][ T5171] ODEBUG: assert_init not available (active state 0) object: ffffc900056afb20 object type: timer_list hint: process_timeout+0x0/0x40
CPU 0 [ T5171] CPU 1 [T22911]
-------------- --------------
debug_object_assert_init() {
if (!debug_objects_enabled)
return;
db = get_bucket(addr);
lookup_object_or_alloc() {
debug_objects_enabled = 0;
return NULL;
}
debug_objects_oom() {
pr_warn("Out of memory. ODEBUG disabled\n");
// all buckets get emptied here, and
}
lookup_object_or_alloc(addr, db, descr, false, true) {
// this bucket is already empty.
return ERR_PTR(-ENOENT);
}
// Emits false positive warning.
debug_print_object(&o, "assert_init");
}Recheck debug_object_enabled in debug_print_object() to avoid that.
--- lib/debugobjects.c | 9 +++++++++ 1 file changed, 9 insertions(+)
lib/debugobjects.c +9 -0
@@ -501,6 +501,15 @@ static void debug_print_object(struct debug_obj *obj, char *msg)const struct debug_obj_descr *descr = obj->descr;static int limit; +/* +* Don't report if lookup_object_or_alloc() by the current thread +* failed because lookup_object_or_alloc()/debug_objects_oom() by a +* concurrent thread turned off debug_objects_enabled and cleared +* the hash buckets. +*/ +if (!debug_objects_enabled) +return ; +if (limit <5 && descr != descr_test) {void *hint = descr->debug_hint ? descr->debug_hint (obj->object) :NULL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 166/245 nbd: Add the maximum limit of allocated index in nbd_dev_add
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhong Jinghua <[email protected]>
[ Upstream commit f12bc113ce904777fd6ca003b473b427782b3dde ]
If the index allocated by idr_alloc greater than MINORMASK >> part_shift, the device number will overflow, resulting in failure to create a block device.
Fix it by imiting the size of the max allocation.
--- drivers/block/nbd.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/block/nbd.c +2 -1
@@ -1715,7 +1715,8 @@ static struct nbd_device *nbd_dev_add(int index, unsigned int refs)if (err == -ENOSPC ) err = -EEXIST ; }else { - err =idr_alloc (&nbd_index_idr, nbd,0 ,0 ,GFP_KERNEL ); + err =idr_alloc (&nbd_index_idr, nbd,0 , + (MINORMASK >> part_shift) +1 ,GFP_KERNEL );if (err >=0 ) index = err; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 167/245 md: fix data corruption for raid456 when reshape restart while grow up
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <[email protected]>
[ Upstream commit 873f50ece41aad5c4f788a340960c53774b5526e ]
Currently, if reshape is interrupted, echo "reshape" to sync_action will restart reshape from scratch, for example:
echo frozen > sync_action
echo reshape > sync_action
This will corrupt data before reshape_position if the array is growing, fix the problem by continue reshape from reshape_position.
--- drivers/md/md.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
drivers/md/md.c +12 -2
@@ -4919,11 +4919,21 @@ action_store(struct mddev *mddev, const char *page, size_t len)return -EINVAL ; err =mddev_lock (mddev);if (!err) { -if (test_bit (MD_RECOVERY_RUNNING , &mddev->recovery)) +if (test_bit (MD_RECOVERY_RUNNING , &mddev->recovery)) { err = -EBUSY ; -else { + }else if (mddev->reshape_position == MaxSector || + mddev->pers->check_reshape ==NULL || + mddev->pers->check_reshape (mddev)) {clear_bit (MD_RECOVERY_FROZEN , &mddev->recovery); err = mddev->pers->start_reshape (mddev); + }else { +/* +* If reshape is still in progress, and +* md_check_recovery() can continue to reshape, +* don't restart reshape because data can be +* corrupted for raid456. +*/ +clear_bit (MD_RECOVERY_FROZEN , &mddev->recovery); }mddev_unlock (mddev); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 168/245 md/raid10: prevent soft lockup while flush writes
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <[email protected]>
[ Upstream commit 010444623e7f4da6b4a4dd603a7da7469981e293 ]
Currently, there is no limit for raid1/raid10 plugged bio. While flushing writes, raid1 has cond_resched() while raid10 doesn't, and too many writes can cause soft lockup.
Follow up soft lockup can be triggered easily with writeback test for raid10 with ramdisks:
watchdog: BUG: soft lockup - CPU#10 stuck for 27s! [md0_raid10:1293] Call Trace: <TASK> call_rcu+0x16/0x20 put_object+0x41/0x80 __delete_object+0x50/0x90 delete_object_full+0x2b/0x40 kmemleak_free+0x46/0xa0 slab_free_freelist_hook.constprop.0+0xed/0x1a0 kmem_cache_free+0xfd/0x300 mempool_free_slab+0x1f/0x30 mempool_free+0x3a/0x100 bio_free+0x59/0x80 bio_put+0xcf/0x2c0 free_r10bio+0xbf/0xf0 raid_end_bio_io+0x78/0xb0 one_write_done+0x8a/0xa0 raid10_end_write_request+0x1b4/0x430 bio_endio+0x175/0x320 brd_submit_bio+0x3b9/0x9b7 [brd] __submit_bio+0x69/0xe0 submit_bio_noacct_nocheck+0x1e6/0x5a0 submit_bio_noacct+0x38c/0x7e0 flush_pending_writes+0xf0/0x240 raid10d+0xac/0x1ed0
Fix the problem by adding cond_resched() to raid10 like what raid1 did.
Note that unlimited plugged bio still need to be optimized, for example, in the case of lots of dirty pages writeback, this will take lots of memory and io will spend a long time in plug, hence io latency is bad.
--- drivers/md/raid10.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/md/raid10.c +2 -0
@@ -903,6 +903,7 @@ static void flush_pending_writes(struct r10conf *conf)else submit_bio_noacct (bio); bio = next; +cond_resched (); }blk_finish_plug (&plug); }else
@@ -1116,6 +1117,7 @@ static void raid10_unplug(struct blk_plug_cb *cb, bool from_schedule)else submit_bio_noacct (bio); bio = next; +cond_resched (); }kfree (plug); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 169/245 posix-timers: Ensure timer ID search-loop limit is valid
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
[ Upstream commit 8ce8849dd1e78dadcee0ec9acbd259d239b7069f ]
posix_timer_add() tries to allocate a posix timer ID by starting from the cached ID which was stored by the last successful allocation.
This is done in a loop searching the ID space for a free slot one by one. The loop has to terminate when the search wrapped around to the starting point.
But that's racy vs. establishing the starting point. That is read out lockless, which leads to the following problem:
CPU0 CPU1posix_timer_add()
start = sig->posix_timer_id;
lock(hash_lock);
... posix_timer_add()
if (++sig->posix_timer_id < 0)
start = sig->posix_timer_id;
sig->posix_timer_id = 0;So CPU1 can observe a negative start value, i.e. -1, and the loop break never happens because the condition can never be true:
if (sig->posix_timer_id == start)
break;
While this is unlikely to ever turn into an endless loop as the ID space is huge (INT_MAX), the racy read of the start value caught the attention of KCSAN and Dmitry unearthed that incorrectness.
Rewrite it so that all id operations are under the hash lock.
--- include/linux/sched/signal.h | 2 +- kernel/time/posix-timers.c | 31 ++++++++++++++++++------------- 2 files changed, 19 insertions(+), 14 deletions(-)
include/linux/sched/signal.h +1 -1
@@ -125,7 +125,7 @@ struct signal_struct {#ifdef CONFIG_POSIX_TIMERS /* POSIX.1b Interval Timers */ -int posix_timer_id; +unsigned int next_posix_timer_id;struct list_head posix_timers;/* ITIMER_REAL timer for the process */
kernel/time/posix-timers.c +18 -13
@@ -140,25 +140,30 @@ static struct k_itimer *posix_timer_by_id(timer_t id)static int posix_timer_add (struct k_itimer *timer) {struct signal_struct *sig = current->signal; -int first_free_id = sig->posix_timer_id;struct hlist_head *head; -int ret = -ENOENT ; +unsigned int cnt, id; -do { +/* +* FIXME: Replace this by a per signal struct xarray once there is +* a plan to handle the resulting CRIU regression gracefully. +*/ +for (cnt =0 ; cnt <=INT_MAX ; cnt++) {spin_lock (&hash_lock); - head = &posix_timers_hashtable[hash (sig, sig->posix_timer_id)]; -if (!__posix_timers_find (head, sig, sig->posix_timer_id)) { + id = sig->next_posix_timer_id; + +/* Write the next ID back. Clamp it to the positive space */ + sig->next_posix_timer_id = (id +1 ) &INT_MAX ; + + head = &posix_timers_hashtable[hash (sig, id)]; +if (!__posix_timers_find (head, sig, id)) {hlist_add_head_rcu (&timer->t_hash, head); - ret = sig->posix_timer_id; +spin_unlock (&hash_lock); +return id; } -if (++sig->posix_timer_id <0 ) - sig->posix_timer_id =0 ; -if ((sig->posix_timer_id == first_free_id) && (ret == -ENOENT )) -/* Loop over all possible ids completed */ - ret = -EAGAIN ;spin_unlock (&hash_lock); - }while (ret == -ENOENT ); -return ret; + } +/* POSIX return code when no timer ID could be allocated */ +return -EAGAIN ; }static inline void unlock_timer (struct k_itimer *timr,unsigned long flags)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 170/245 btrfs: add xxhash to fast checksum implementations
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Sterba <[email protected]>
[ Upstream commit efcfcbc6a36195c42d98e0ee697baba36da94dc8 ]
The implementation of XXHASH is now CPU only but still fast enough to be considered for the synchronous checksumming, like non-generic crc32c.
A userspace benchmark comparing it to various implementations (patched hash-speedtest from btrfs-progs):
Block size: 4096
Iterations: 1000000
Implementation: builtin
Units: CPU cycles
NULL-NOP: cycles: 73384294, cycles/i 73
NULL-MEMCPY: cycles: 228033868, cycles/i 228, 61664.320 MiB/s
CRC32C-ref: cycles: 24758559416, cycles/i 24758, 567.950 MiB/s
CRC32C-NI: cycles: 1194350470, cycles/i 1194, 11773.433 MiB/s
CRC32C-ADLERSW: cycles: 6150186216, cycles/i 6150, 2286.372 MiB/s
CRC32C-ADLERHW: cycles: 626979180, cycles/i 626, 22427.453 MiB/s
CRC32C-PCL: cycles: 466746732, cycles/i 466, 30126.699 MiB/s
XXHASH: cycles: 860656400, cycles/i 860, 16338.188 MiB/sComparing purely software implementation (ref), current outdated
accelerated using crc32q instruction (NI), optimized implementations by
M. Adler (https://stackoverflow.com/questions/17645167/implementing-sse-4-2s-crc32c-in-software/17646775#17646775)
and the best one that was taken from kernel using the PCLMULQDQ
instruction (PCL).
--- fs/btrfs/disk-io.c | 3 +++ 1 file changed, 3 insertions(+)
fs/btrfs/disk-io.c +3 -0
@@ -2338,6 +2338,9 @@ static int btrfs_init_csum_hash(struct btrfs_fs_info *fs_info, u16 csum_type)if (!strstr (crypto_shash_driver_name (csum_shash),"generic" ))set_bit (BTRFS_FS_CSUM_IMPL_FAST , &fs_info->flags);break ; +case BTRFS_CSUM_TYPE_XXHASH : +set_bit (BTRFS_FS_CSUM_IMPL_FAST , &fs_info->flags); +break ;default :break ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 171/245 ACPI: button: Add lid disable DMI quirk for Nextbook Ares 8A
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 4fd5556608bfa9c2bf276fc115ef04288331aded ]
The LID0 device on the Nextbook Ares 8A tablet always reports lid closed causing userspace to suspend the device as soon as booting is complete.
Add a DMI quirk to disable the broken lid functionality.
--- drivers/acpi/button.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/acpi/button.c +9 -0
@@ -77,6 +77,15 @@ static const struct dmi_system_id dmi_lid_quirks[] = { }, .driver_data = (void *)(long)ACPI_BUTTON_LID_INIT_DISABLED, }, + { +/* Nextbook Ares 8A tablet, _LID device always reports lid closed */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Insyde" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"CherryTrail" ), + DMI_MATCH(DMI_BIOS_VERSION, "M882"), + }, + .driver_data = (void *)(long)ACPI_BUTTON_LID_INIT_DISABLED, + }, {/* * Lenovo Yoga 9 14ITL5, initial notification of the LID device
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 172/245 ACPI: video: Add backlight=native DMI quirk for Apple iMac11,3
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 48436f2e9834b46b47b038b605c8142a1c07bc85 ]
Linux defaults to picking the non-working ACPI video backlight interface on the Apple iMac11,3 .
Add a DMI quirk to pick the working native radeon_bl0 interface instead.
Stable-dep-of: bd5d93df86a7 ("ACPI: video: Add backlight=native DMI quirk for Lenovo ThinkPad X131e (3371 AMD version)")
--- drivers/acpi/video_detect.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/acpi/video_detect.c +8 -0
@@ -341,6 +341,14 @@ static const struct dmi_system_id video_detect_dmi_table[] = { DMI_MATCH(DMI_PRODUCT_NAME, "82BK"), }, }, + { + .callback = video_detect_force_native, +/* Apple iMac11,3 */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Apple Inc." ), + DMI_MATCH(DMI_PRODUCT_NAME, "iMac11,3"), + }, + }, {/* https://bugzilla.redhat.com/show_bug.cgi?id=1217249 */ .callback = video_detect_force_native,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 173/245 ACPI: video: Add backlight=native DMI quirk for Lenovo ThinkPad X131e (3371 AMD version)
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit bd5d93df86a7ddf98a2a37e9c3751e3cb334a66c ]
Linux defaults to picking the non-working ACPI video backlight interface on the Lenovo ThinkPad X131e (3371 AMD version).
Add a DMI quirk to pick the working native radeon_bl0 interface instead.
--- drivers/acpi/video_detect.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/acpi/video_detect.c +8 -0
@@ -341,6 +341,14 @@ static const struct dmi_system_id video_detect_dmi_table[] = { DMI_MATCH(DMI_PRODUCT_NAME, "82BK"), }, }, + { + .callback = video_detect_force_native, +/* Lenovo ThinkPad X131e (3371 AMD version) */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"LENOVO" ), + DMI_MATCH(DMI_PRODUCT_NAME, "3371"), + }, + }, { .callback = video_detect_force_native,/* Apple iMac11,3 */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 174/245 arm64: set __exception_irq_entry with __irq_entry as a default
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Youngmin Nam <[email protected]>
[ Upstream commit f6794950f0e5ba37e3bbedda4d6ab0aad7395dd3 ]
filter_irq_stacks() is supposed to cut entries which are related irq entries from its call stack.
And in_irqentry_text() which is called by filter_irq_stacks() uses __irqentry_text_start/end symbol to find irq entries in callstack.
But it doesn't work correctly as without "CONFIG_FUNCTION_GRAPH_TRACER", arm64 kernel doesn't include gic_handle_irq which is entry point of arm64 irq between __irqentry_text_start and __irqentry_text_end as we discussed in below link.
https://lore.kernel.org/all/CACT4Y+aReMGLYua2rCLHgFpS9io5cZC04Q8GLs-uNmrn1ezxYQ@mail.gmail.com/#t
This problem can makes unintentional deep call stack entries especially in KASAN enabled situation as below.
[ 2479.383395]I[0:launcher-loader: 1719] Stack depot reached limit capacity [ 2479.383538]I[0:launcher-loader: 1719] WARNING: CPU: 0 PID: 1719 at lib/stackdepot.c:129 __stack_depot_save+0x464/0x46c [ 2479.385693]I[0:launcher-loader: 1719] pstate: 624000c5 (nZCv daIF +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 2479.385724]I[0:launcher-loader: 1719] pc : __stack_depot_save+0x464/0x46c [ 2479.385751]I[0:launcher-loader: 1719] lr : __stack_depot_save+0x460/0x46c [ 2479.385774]I[0:launcher-loader: 1719] sp : ffffffc0080073c0 [ 2479.385793]I[0:launcher-loader: 1719] x29: ffffffc0080073e0 x28: ffffffd00b78a000 x27: 0000000000000000 [ 2479.385839]I[0:launcher-loader: 1719] x26: 000000000004d1dd x25: ffffff891474f000 x24: 00000000ca64d1dd [ 2479.385882]I[0:launcher-loader: 1719] x23: 0000000000000200 x22: 0000000000000220 x21: 0000000000000040 [ 2479.385925]I[0:launcher-loader: 1719] x20: ffffffc008007440 x19: 0000000000000000 x18: 0000000000000000 [ 2479.385969]I[0:launcher-loader: 1719] x17: 2065726568207475 x16: 000000000000005e x15: 2d2d2d2d2d2d2d20 [ 2479.386013]I[0:launcher-loader: 1719] x14: 5d39313731203a72 x13: 00000000002f6b30 x12: 00000000002f6af8 [ 2479.386057]I[0:launcher-loader: 1719] x11: 00000000ffffffff x10: ffffffb90aacf000 x9 : e8a74a6c16008800 [ 2479.386101]I[0:launcher-loader: 1719] x8 : e8a74a6c16008800 x7 : 00000000002f6b30 x6 : 00000000002f6af8 [ 2479.386145]I[0:launcher-loader: 1719] x5 : ffffffc0080070c8 x4 : ffffffd00b192380 x3 : ffffffd0092b313c [ 2479.386189]I[0:launcher-loader: 1719] x2 : 0000000000000001 x1 : 0000000000000004 x0 : 0000000000000022 [ 2479.386231]I[0:launcher-loader: 1719] Call trace: [ 2479.386248]I[0:launcher-loader: 1719] __stack_depot_save+0x464/0x46c [ 2479.386273]I[0:launcher-loader: 1719] kasan_save_stack+0x58/0x70 [ 2479.386303]I[0:launcher-loader: 1719] save_stack_info+0x34/0x138 [ 2479.386331]I[0:launcher-loader: 1719] kasan_save_free_info+0x18/0x24 [ 2479.386358]I[0:launcher-loader: 1719] ____kasan_slab_free+0x16c/0x170 [ 2479.386385]I[0:launcher-loader: 1719] __kasan_slab_free+0x10/0x20 [ 2479.386410]I[0:launcher-loader: 1719] kmem_cache_free+0x238/0x53c [ 2479.386435]I[0:launcher-loader: 1719] mempool_free_slab+0x1c/0x28 [ 2479.386460]I[0:launcher-loader: 1719] mempool_free+0x7c/0x1a0 [ 2479.386484]I[0:launcher-loader: 1719] bvec_free+0x34/0x80 [ 2479.386514]I[0:launcher-loader: 1719] bio_free+0x60/0x98 [ 2479.386540]I[0:launcher-loader: 1719] bio_put+0x50/0x21c [ 2479.386567]I[0:launcher-loader: 1719] f2fs_write_end_io+0x4ac/0x4d0 [ 2479.386594]I[0:launcher-loader: 1719] bio_endio+0x2dc/0x300 [ 2479.386622]I[0:launcher-loader: 1719] __dm_io_complete+0x324/0x37c [ 2479.386650]I[0:launcher-loader: 1719] dm_io_dec_pending+0x60/0xa4 [ 2479.386676]I[0:launcher-loader: 1719] clone_endio+0xf8/0x2f0 [ 2479.386700]I[0:launcher-loader: 1719] bio_endio+0x2dc/0x300 [ 2479.386727]I[0:launcher-loader: 1719] blk_update_request+0x258/0x63c [ 2479.386754]I[0:launcher-loader: 1719] scsi_end_request+0x50/0x304 [ 2479.386782]I[0:launcher-loader: 1719] scsi_io_completion+0x88/0x160 [ 2479.386808]I[0:launcher-loader: 1719] scsi_finish_command+0x17c/0x194 [ 2479.386833]I[0:launcher-loader: 1719] scsi_complete+0xcc/0x158 [ 2479.386859]I[0:launcher-loader: 1719] blk_mq_complete_request+0x4c/0x5c [ 2479.386885]I[0:launcher-loader: 1719] scsi_done_internal+0xf4/0x1e0 [ 2479.386910]I[0:launcher-loader: 1719] scsi_done+0x14/0x20 [ 2479.386935]I[0:launcher-loader: 1719] ufshcd_compl_one_cqe+0x578/0x71c [ 2479.386963]I[0:launcher-loader: 1719] ufshcd_mcq_poll_cqe_nolock+0xc8/0x150 [ 2479.386991]I[0:launcher-loader: 1719] ufshcd_intr+0x868/0xc0c [ 2479.387017]I[0:launcher-loader: 1719] __handle_irq_event_percpu+0xd0/0x348 [ 2479.387044]I[0:launcher-loader: 1719] handle_irq_event_percpu+0x24/0x74 [ 2479.387068]I[0:launcher-loader: 1719] handle_irq_event+0x74/0xe0 [ 2479.387091]I[0:launcher-loader: 1719] handle_fasteoi_irq+0x174/0x240 [ 2479.387118]I[0:launcher-loader: 1719] handle_irq_desc+0x7c/0x2c0 [ 2479.387147]I[0:launcher-loader: 1719] generic_handle_domain_irq+0x1c/0x28 [ 2479.387174]I[0:launcher-loader: 1719] gic_handle_irq+0x64/0x158 [ 2479.387204]I[0:launcher-loader: 1719] call_on_irq_stack+0x2c/0x54 [ 2479.387231]I[0:launcher-loader: 1719] do_interrupt_handler+0x70/0xa0 [ 2479.387258]I[0:launcher-loader: 1719] el1_interrupt+0x34/0x68 [ 2479.387283]I[0:launcher-loader: 1719] el1h_64_irq_handler+0x18/0x24 [ 2479.387308]I[0:launcher-loader: 1719] el1h_64_irq+0x68/0x6c [ 2479.387332]I[0:launcher-loader: 1719] blk_attempt_bio_merge+0x8/0x170 [ 2479.387356]I[0:launcher-loader: 1719] blk_mq_attempt_bio_merge+0x78/0x98 [ 2479.387383]I[0:launcher-loader: 1719] blk_mq_submit_bio+0x324/0xa40 [ 2479.387409]I[0:launcher-loader: 1719] __submit_bio+0x104/0x138 [ 2479.387436]I[0:launcher-loader: 1719] submit_bio_noacct_nocheck+0x1d0/0x4a0 [ 2479.387462]I[0:launcher-loader: 1719] submit_bio_noacct+0x618/0x804 [ 2479.387487]I[0:launcher-loader: 1719] submit_bio+0x164/0x180 [ 2479.387511]I[0:launcher-loader: 1719] f2fs_submit_read_bio+0xe4/0x1c4 [ 2479.387537]I[0:launcher-loader: 1719] f2fs_mpage_readpages+0x888/0xa4c [ 2479.387563]I[0:launcher-loader: 1719] f2fs_readahead+0xd4/0x19c [ 2479.387587]I[0:launcher-loader: 1719] read_pages+0xb0/0x4ac [ 2479.387614]I[0:launcher-loader: 1719] page_cache_ra_unbounded+0x238/0x288 [ 2479.387642]I[0:launcher-loader: 1719] do_page_cache_ra+0x60/0x6c [ 2479.387669]I[0:launcher-loader: 1719] page_cache_ra_order+0x318/0x364 [ 2479.387695]I[0:launcher-loader: 1719] ondemand_readahead+0x30c/0x3d8 [ 2479.387722]I[0:launcher-loader: 1719] page_cache_sync_ra+0xb4/0xc8 [ 2479.387749]I[0:launcher-loader: 1719] filemap_read+0x268/0xd24 [ 2479.387777]I[0:launcher-loader: 1719] f2fs_file_read_iter+0x1a0/0x62c [ 2479.387806]I[0:launcher-loader: 1719] vfs_read+0x258/0x34c [ 2479.387831]I[0:launcher-loader: 1719] ksys_pread64+0x8c/0xd0 [ 2479.387857]I[0:launcher-loader: 1719] __arm64_sys_pread64+0x48/0x54 [ 2479.387881]I[0:launcher-loader: 1719] invoke_syscall+0x58/0x158 [ 2479.387909]I[0:launcher-loader: 1719] el0_svc_common+0xf0/0x134 [ 2479.387935]I[0:launcher-loader: 1719] do_el0_svc+0x44/0x114 [ 2479.387961]I[0:launcher-loader: 1719] el0_svc+0x2c/0x80 [ 2479.387985]I[0:launcher-loader: 1719] el0t_64_sync_handler+0x48/0x114 [ 2479.388010]I[0:launcher-loader: 1719] el0t_64_sync+0x190/0x194 [ 2479.388038]I[0:launcher-loader: 1719] Kernel panic - not syncing: kernel: panic_on_warn set ...
So let's set __exception_irq_entry with __irq_entry as a default. Applying this patch, we can see gic_hande_irq is included in Systemp.map as below.
* Beforeffffffc008010000 T __do_softirqffffffc008010000 T __irqentry_text_endffffffc008010000 T __irqentry_text_startffffffc008010000 T __softirqentry_text_startffffffc008010000 T _stextffffffc00801066c T __softirqentry_text_endffffffc008010670 T __entry_text_start
* Afterffffffc008010000 T __irqentry_text_startffffffc008010000 T _stextffffffc008010000 t gic_handle_irqffffffc00801013c t gic_handle_irqffffffc008010294 T __irqentry_text_endffffffc008010298 T __do_softirqffffffc008010298 T __softirqentry_text_startffffffc008010904 T __softirqentry_text_endffffffc008010908 T __entry_text_start
--- arch/arm64/include/asm/exception.h | 5 ----- 1 file changed, 5 deletions(-)
arch/arm64/include/asm/exception.h +0 -5
@@ -8,16 +8,11 @@#define __ASM_EXCEPTION_H#include <asm/esr.h> -#include <asm/kprobes.h> #include <asm/ptrace.h> #include <linux/interrupt.h> -#ifdef CONFIG_FUNCTION_GRAPH_TRACER #define __exception_irq_entry __irq_entry -#else -#define __exception_irq_entry __kprobes -#endif static inline unsigned long disr_to_esr (u64 disr) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 175/245 arm64: mm: fix VA-range sanity check
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <[email protected]>
[ Upstream commit ab9b4008092c86dc12497af155a0901cc1156999 ]
Both create_mapping_noalloc() and update_mapping_prot() sanity-check their 'virt' parameter, but the check itself doesn't make much sense. The condition used today appears to be a historical accident.
The sanity-check condition:
if ((virt >= PAGE_END) && (virt < VMALLOC_START)) {
[ ... warning here ... ]
return;
}... can only be true for the KASAN shadow region or the module region, and there's no reason to exclude these specifically for creating and updateing mappings.
When arm64 support was first upstreamed in commit:
c1cc1552616d0f35 ("arm64: MMU initialisation")
... the condition was:
if (virt < VMALLOC_START) {
[ ... warning here ... ]
return;
}At the time, VMALLOC_START was the lowest kernel address, and this was checking whether 'virt' would be translated via TTBR1.
Subsequently in commit:
14c127c957c1c607 ("arm64: mm: Flip kernel VA space")
... the condition was changed to:
if ((virt >= VA_START) && (virt < VMALLOC_START)) {
[ ... warning here ... ]
return;
}This appear to have been a thinko. The commit moved the linear map to the bottom of the kernel address space, with VMALLOC_START being at the halfway point. The old condition would warn for changes to the linear map below this, and at the time VA_START was the end of the linear map.
Subsequently we cleaned up the naming of VA_START in commit:
77ad4ce69321abbe ("arm64: memory: rename VA_START to PAGE_END")
... keeping the erroneous condition as:
if ((virt >= PAGE_END) && (virt < VMALLOC_START)) {
[ ... warning here ... ]
return;
}Correct the condition to check against the start of the TTBR1 address space, which is currently PAGE_OFFSET. This simplifies the logic, and more clearly matches the "outside kernel range" message in the warning.
--- arch/arm64/mm/mmu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/mm/mmu.c +2 -2
@@ -435,7 +435,7 @@ static phys_addr_t pgd_pgtable_alloc(int shift)static void __init create_mapping_noalloc (phys_addr_t phys,unsigned long virt,phys_addr_t size,pgprot_t prot) { -if ((virt >=PAGE_END ) && (virt <VMALLOC_START )) { +if (virt <PAGE_OFFSET ) {pr_warn ("BUG: not creating mapping for %pa at 0x%016lx - outside kernel range\n" , &phys, virt);return ;
@@ -462,7 +462,7 @@ void __init create_pgd_mapping(struct mm_struct *mm, phys_addr_t phys,static void update_mapping_prot (phys_addr_t phys,unsigned long virt,phys_addr_t size,pgprot_t prot) { -if ((virt >=PAGE_END ) && (virt <VMALLOC_START )) { +if (virt <PAGE_OFFSET ) {pr_warn ("BUG: not updating mapping for %pa at 0x%016lx - outside kernel range\n" , &phys, virt);return ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 176/245 sched/fair: Dont balance task to its current running CPU
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yicong Yang <[email protected]>
[ Upstream commit 0dd37d6dd33a9c23351e6115ae8cdac7863bc7de ]
We've run into the case that the balancer tries to balance a migration disabled task and trigger the warning in set_task_cpu() like below:
------------[ cut here ]------------ WARNING: CPU: 7 PID: 0 at kernel/sched/core.c:3115 set_task_cpu+0x188/0x240 Modules linked in: hclgevf xt_CHECKSUM ipt_REJECT nf_reject_ipv4 <...snip> CPU: 7 PID: 0 Comm: swapper/7 Kdump: loaded Tainted: G O 6.1.0-rc4+ #1 Hardware name: Huawei TaiShan 2280 V2/BC82AMDC, BIOS 2280-V2 CS V5.B221.01 12/09/2021 pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : set_task_cpu+0x188/0x240 lr : load_balance+0x5d0/0xc60 sp : ffff80000803bc70 x29: ffff80000803bc70 x28: ffff004089e190e8 x27: ffff004089e19040 x26: ffff007effcabc38 x25: 0000000000000000 x24: 0000000000000001 x23: ffff80000803be84 x22: 000000000000000c x21: ffffb093e79e2a78 x20: 000000000000000c x19: ffff004089e19040 x18: 0000000000000000 x17: 0000000000001fad x16: 0000000000000030 x15: 0000000000000000 x14: 0000000000000003 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000001 x10: 0000000000000400 x9 : ffffb093e4cee530 x8 : 00000000fffffffe x7 : 0000000000ce168a x6 : 000000000000013e x5 : 00000000ffffffe1 x4 : 0000000000000001 x3 : 0000000000000b2a x2 : 0000000000000b2a x1 : ffffb093e6d6c510 x0 : 0000000000000001 Call trace: set_task_cpu+0x188/0x240 load_balance+0x5d0/0xc60 rebalance_domains+0x26c/0x380 _nohz_idle_balance.isra.0+0x1e0/0x370 run_rebalance_domains+0x6c/0x80 __do_softirq+0x128/0x3d8 ____do_softirq+0x18/0x24 call_on_irq_stack+0x2c/0x38 do_softirq_own_stack+0x24/0x3c __irq_exit_rcu+0xcc/0xf4 irq_exit_rcu+0x18/0x24 el1_interrupt+0x4c/0xe4 el1h_64_irq_handler+0x18/0x2c el1h_64_irq+0x74/0x78 arch_cpu_idle+0x18/0x4c default_idle_call+0x58/0x194 do_idle+0x244/0x2b0 cpu_startup_entry+0x30/0x3c secondary_start_kernel+0x14c/0x190 __secondary_switched+0xb0/0xb4 ---[ end trace 0000000000000000 ]---
Further investigation shows that the warning is superfluous, the migration disabled task is just going to be migrated to its current running CPU. This is because that on load balance if the dst_cpu is not allowed by the task, we'll re-select a new_dst_cpu as a candidate. If no task can be balanced to dst_cpu we'll try to balance the task to the new_dst_cpu instead. In this case when the migration disabled task is not on CPU it only allows to run on its current CPU, load balance will select its current CPU as new_dst_cpu and later triggers the warning above.
The new_dst_cpu is chosen from the env->dst_grpmask. Currently it contains CPUs in sched_group_span() and if we have overlapped groups it's possible to run into this case. This patch makes env->dst_grpmask of group_balance_mask() which exclude any CPUs from the busiest group and solve the issue. For balancing in a domain with no overlapped groups the behaviour keeps same as before.
--- kernel/sched/fair.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/sched/fair.c +1 -1
@@ -10177,7 +10177,7 @@ static int load_balance(int this_cpu, struct rq *this_rq, .sd = sd, .dst_cpu = this_cpu, .dst_rq = this_rq, - .dst_grpmask = sched_group_span(sd->groups), + .dst_grpmask = group_balance_mask(sd->groups), .idle = idle, .loop_break = sched_nr_migrate_break, .cpus = cpus,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 177/245 wifi: ath11k: fix registration of 6Ghz-only phy without the full channel range
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxime Bizon <[email protected]>
[ Upstream commit e2ceb1de2f83aafd8003f0b72dfd4b7441e97d14 ]
Because of what seems to be a typo, a 6Ghz-only phy for which the BDF does not allow the 7115Mhz channel will fail to register:
WARNING: CPU: 2 PID: 106 at net/wireless/core.c:907 wiphy_register+0x914/0x954 Modules linked in: ath11k_pci sbsa_gwdt CPU: 2 PID: 106 Comm: kworker/u8:5 Not tainted 6.3.0-rc7-next-20230418-00549-g1e096a17625a-dirty #9 Hardware name: Freebox V7R Board (DT) Workqueue: ath11k_qmi_driver_event ath11k_qmi_driver_event_work pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : wiphy_register+0x914/0x954 lr : ieee80211_register_hw+0x67c/0xc10 sp : ffffff800b123aa0 x29: ffffff800b123aa0 x28: 0000000000000000 x27: 0000000000000000 x26: 0000000000000000 x25: 0000000000000006 x24: ffffffc008d51418 x23: ffffffc008cb0838 x22: ffffff80176c2460 x21: 0000000000000168 x20: ffffff80176c0000 x19: ffffff80176c03e0 x18: 0000000000000014 x17: 00000000cbef338c x16: 00000000d2a26f21 x15: 00000000ad6bb85f x14: 0000000000000020 x13: 0000000000000020 x12: 00000000ffffffbd x11: 0000000000000208 x10: 00000000fffffdf7 x9 : ffffffc009394718 x8 : ffffff80176c0528 x7 : 000000007fffffff x6 : 0000000000000006 x5 : 0000000000000005 x4 : ffffff800b304284 x3 : ffffff800b304284 x2 : ffffff800b304d98 x1 : 0000000000000000 x0 : 0000000000000000 Call trace: wiphy_register+0x914/0x954 ieee80211_register_hw+0x67c/0xc10 ath11k_mac_register+0x7c4/0xe10 ath11k_core_qmi_firmware_ready+0x1f4/0x570 ath11k_qmi_driver_event_work+0x198/0x590 process_one_work+0x1b8/0x328 worker_thread+0x6c/0x414 kthread+0x100/0x104 ret_from_fork+0x10/0x20 ---[ end trace 0000000000000000 ]--- ath11k_pci 0002:01:00.0: ieee80211 registration failed: -22 ath11k_pci 0002:01:00.0: failed register the radio with mac80211: -22 ath11k_pci 0002:01:00.0: failed to create pdev core: -22
--- drivers/net/wireless/ath/ath11k/mac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ath/ath11k/mac.c +1 -1
@@ -6312,7 +6312,7 @@ static int ath11k_mac_setup_channels_rates(struct ath11k *ar, }if (supported_bands &WMI_HOST_WLAN_5G_CAP ) { -if (reg_cap->high_5ghz_chan >=ATH11K_MAX_6G_FREQ ) { +if (reg_cap->high_5ghz_chan >=ATH11K_MIN_6G_FREQ ) { channels =kmemdup (ath11k_6ghz_channels,sizeof (ath11k_6ghz_channels),GFP_KERNEL );if (!channels) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 178/245 bpf: Address KCSAN report on bpf_lru_list
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin KaFai Lau <[email protected]>
[ Upstream commit ee9fd0ac3017c4313be91a220a9ac4c99dde7ad4 ]
KCSAN reported a data-race when accessing node->ref. Although node->ref does not have to be accurate,
take this chance to use a more common READ_ONCE() and WRITE_ONCE() pattern instead of data_race().
There is an existing bpf_lru_node_is_ref() and bpf_lru_node_set_ref(). This patch also adds bpf_lru_node_clear_ref() to do the WRITE_ONCE(node->ref, 0) also.
==================================================================
BUG: KCSAN: data-race in __bpf_lru_list_rotate / __htab_lru_percpu_map_update_elem
write to 0xffff888137038deb of 1 bytes by task 11240 on cpu 1:
__bpf_lru_node_move kernel/bpf/bpf_lru_list.c:113 [inline] __bpf_lru_list_rotate_active kernel/bpf/bpf_lru_list.c:149 [inline] __bpf_lru_list_rotate+0x1bf/0x750 kernel/bpf/bpf_lru_list.c:240 bpf_lru_list_pop_free_to_local kernel/bpf/bpf_lru_list.c:329 [inline] bpf_common_lru_pop_free kernel/bpf/bpf_lru_list.c:447 [inline] bpf_lru_pop_free+0x638/0xe20 kernel/bpf/bpf_lru_list.c:499 prealloc_lru_pop kernel/bpf/hashtab.c:290 [inline] __htab_lru_percpu_map_update_elem+0xe7/0x820 kernel/bpf/hashtab.c:1316 bpf_percpu_hash_update+0x5e/0x90 kernel/bpf/hashtab.c:2313 bpf_map_update_value+0x2a9/0x370 kernel/bpf/syscall.c:200 generic_map_update_batch+0x3ae/0x4f0 kernel/bpf/syscall.c:1687 bpf_map_do_batch+0x2d9/0x3d0 kernel/bpf/syscall.c:4534 __sys_bpf+0x338/0x810 __do_sys_bpf kernel/bpf/syscall.c:5096 [inline] __se_sys_bpf kernel/bpf/syscall.c:5094 [inline] __x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5094 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
read to 0xffff888137038deb of 1 bytes by task 11241 on cpu 0:
bpf_lru_node_set_ref kernel/bpf/bpf_lru_list.h:70 [inline] __htab_lru_percpu_map_update_elem+0x2f1/0x820 kernel/bpf/hashtab.c:1332 bpf_percpu_hash_update+0x5e/0x90 kernel/bpf/hashtab.c:2313 bpf_map_update_value+0x2a9/0x370 kernel/bpf/syscall.c:200 generic_map_update_batch+0x3ae/0x4f0 kernel/bpf/syscall.c:1687 bpf_map_do_batch+0x2d9/0x3d0 kernel/bpf/syscall.c:4534 __sys_bpf+0x338/0x810 __do_sys_bpf kernel/bpf/syscall.c:5096 [inline] __se_sys_bpf kernel/bpf/syscall.c:5094 [inline] __x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5094 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
value changed: 0x01 -> 0x00
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 11241 Comm: syz-executor.3 Not tainted 6.3.0-rc7-syzkaller-00136-g6a66fdd29ea1 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023 ==================================================================
--- kernel/bpf/bpf_lru_list.c | 21 +++++++++++++-------- kernel/bpf/bpf_lru_list.h | 7 ++----- 2 files changed, 15 insertions(+), 13 deletions(-)
kernel/bpf/bpf_lru_list.c +13 -8
@@ -41,7 +41,12 @@ static struct list_head *local_pending_list(struct bpf_lru_locallist *loc_l)/* bpf_lru_node helpers */ static bool bpf_lru_node_is_ref (const struct bpf_lru_node *node) { -return node->ref; +return READ_ONCE (node->ref); +} + +static void bpf_lru_node_clear_ref (struct bpf_lru_node *node) +{ +WRITE_ONCE (node->ref,0 ); } static void bpf_lru_list_count_inc(struct bpf_lru_list *l,
@@ -89,7 +94,7 @@ static void __bpf_lru_node_move_in(struct bpf_lru_list *l,bpf_lru_list_count_inc (l, tgt_type); node->type = tgt_type; - node->ref =0 ; +bpf_lru_node_clear_ref (node);list_move (&node->list, &l->lists[tgt_type]); }
@@ -110,7 +115,7 @@ static void __bpf_lru_node_move(struct bpf_lru_list *l,bpf_lru_list_count_inc (l, tgt_type); node->type = tgt_type; } - node->ref =0 ; +bpf_lru_node_clear_ref (node);/* If the moving node is the next_inactive_rotation candidate, * move the next_inactive_rotation pointer also.
@@ -353,7 +358,7 @@ static void __local_list_add_pending(struct bpf_lru *lru, *(u32 *)((void *)node + lru->hash_offset) = hash; node->cpu = cpu; node->type =BPF_LRU_LOCAL_LIST_T_PENDING ; - node->ref =0 ; +bpf_lru_node_clear_ref (node);list_add (&node->list,local_pending_list (loc_l)); }
@@ -419,7 +424,7 @@ static struct bpf_lru_node *bpf_percpu_lru_pop_free(struct bpf_lru *lru,if (!list_empty (free_list)) { node = list_first_entry(free_list, struct bpf_lru_node, list); *(u32 *)((void *)node + lru->hash_offset) = hash; - node->ref =0 ; +bpf_lru_node_clear_ref (node);__bpf_lru_node_move (l, node,BPF_LRU_LIST_T_INACTIVE ); }
@@ -522,7 +527,7 @@ static void bpf_common_lru_push_free(struct bpf_lru *lru, } node->type =BPF_LRU_LOCAL_LIST_T_FREE ; - node->ref =0 ; +bpf_lru_node_clear_ref (node);list_move (&node->list,local_free_list (loc_l));raw_spin_unlock_irqrestore (&loc_l->lock, flags);
@@ -568,7 +573,7 @@ static void bpf_common_lru_populate(struct bpf_lru *lru, void *buf, node = (struct bpf_lru_node *)(buf + node_offset); node->type =BPF_LRU_LIST_T_FREE ; - node->ref =0 ; +bpf_lru_node_clear_ref (node);list_add (&node->list, &l->lists[BPF_LRU_LIST_T_FREE ]); buf += elem_size; }
@@ -594,7 +599,7 @@ static void bpf_percpu_lru_populate(struct bpf_lru *lru, void *buf, node = (struct bpf_lru_node *)(buf + node_offset); node->cpu = cpu; node->type =BPF_LRU_LIST_T_FREE ; - node->ref =0 ; +bpf_lru_node_clear_ref (node);list_add (&node->list, &l->lists[BPF_LRU_LIST_T_FREE ]); i++; buf += elem_size;
kernel/bpf/bpf_lru_list.h +2 -5
@@ -63,11 +63,8 @@ struct bpf_lru {static inline void bpf_lru_node_set_ref (struct bpf_lru_node *node) { -/* ref is an approximation on access frequency. It does not -* have to be very accurate. Hence, no protection is used. -*/ -if (!node->ref) - node->ref =1 ; +if (!READ_ONCE (node->ref)) +WRITE_ONCE (node->ref,1 ); } int bpf_lru_init(struct bpf_lru *lru, bool percpu, u32 hash_offset,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 179/245 devlink: report devlink_port_type_warn source device
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Oros <[email protected]>
[ Upstream commit a52305a81d6bb74b90b400dfa56455d37872fe4b ]
devlink_port_type_warn is scheduled for port devlink and warning when the port type is not set. But from this warning it is not easy found out which device (driver) has no devlink port set.
[ 3709.975552] Type was not set for devlink port. [ 3709.975579] WARNING: CPU: 1 PID: 13092 at net/devlink/leftover.c:6775 devlink_port_type_warn+0x11/0x20 [ 3709.993967] Modules linked in: openvswitch nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nfnetlink bluetooth rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs vhost_net vhost vhost_iotlb tap tun bridge stp llc qrtr intel_rapl_msr intel_rapl_common i10nm_edac nfit libnvdimm x86_pkg_temp_thermal mlx5_ib intel_powerclamp coretemp dell_wmi ledtrig_audio sparse_keymap ipmi_ssif kvm_intel ib_uverbs rfkill ib_core video kvm iTCO_wdt acpi_ipmi intel_vsec irqbypass ipmi_si iTCO_vendor_support dcdbas ipmi_devintf mei_me ipmi_msghandler rapl mei intel_cstate isst_if_mmio isst_if_mbox_pci dell_smbios intel_uncore isst_if_common i2c_i801 dell_wmi_descriptor wmi_bmof i2c_smbus intel_pch_thermal pcspkr acpi_power_meter xfs libcrc32c sd_mod sg nvme_tcp mgag200 i2c_algo_bit nvme_fabrics drm_shmem_helper drm_kms_helper nvme syscopyarea ahci sysfillrect sysimgblt nvme_core fb_sys_fops crct10dif_pclmul libahci mlx5_core sfc crc32_pclmul nvme_common drm [ 3709.994030] crc32c_intel mtd t10_pi mlxfw libata tg3 mdio megaraid_sas psample ghash_clmulni_intel pci_hyperv_intf wmi dm_multipath sunrpc dm_mirror dm_region_hash dm_log dm_mod be2iscsi bnx2i cnic uio cxgb4i cxgb4 tls libcxgbi libcxgb qla4xxx iscsi_boot_sysfs iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi fuse [ 3710.108431] CPU: 1 PID: 13092 Comm: kworker/1:1 Kdump: loaded Not tainted 5.14.0-319.el9.x86_64 #1 [ 3710.108435] Hardware name: Dell Inc. PowerEdge R750/0PJ80M, BIOS 1.8.2 09/14/2022 [ 3710.108437] Workqueue: events devlink_port_type_warn [ 3710.108440] RIP: 0010:devlink_port_type_warn+0x11/0x20 [ 3710.108443] Code: 84 76 fe ff ff 48 c7 03 20 0e 1a ad 31 c0 e9 96 fd ff ff 66 0f 1f 44 00 00 0f 1f 44 00 00 48 c7 c7 18 24 4e ad e8 ef 71 62 ff <0f> 0b c3 cc cc cc cc 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 f6 87 [ 3710.108445] RSP: 0018:ff3b6d2e8b3c7e90 EFLAGS: 00010282 [ 3710.108447] RAX: 0000000000000000 RBX: ff366d6580127080 RCX: 0000000000000027 [ 3710.108448] RDX: 0000000000000027 RSI: 00000000ffff86de RDI: ff366d753f41f8c8 [ 3710.108449] RBP: ff366d658ff5a0c0 R08: ff366d753f41f8c0 R09: ff3b6d2e8b3c7e18 [ 3710.108450] R10: 0000000000000001 R11: 0000000000000023 R12: ff366d753f430600 [ 3710.108451] R13: ff366d753f436900 R14: 0000000000000000 R15: ff366d753f436905 [ 3710.108452] FS: 0000000000000000(0000) GS:ff366d753f400000(0000) knlGS:0000000000000000 [ 3710.108453] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 3710.108454] CR2: 00007f1c57bc74e0 CR3: 000000111d26a001 CR4: 0000000000773ee0 [ 3710.108456] PKRU: 55555554 [ 3710.108457] Call Trace: [ 3710.108458] <TASK> [ 3710.108459] process_one_work+0x1e2/0x3b0 [ 3710.108466] ? rescuer_thread+0x390/0x390 [ 3710.108468] worker_thread+0x50/0x3a0 [ 3710.108471] ? rescuer_thread+0x390/0x390 [ 3710.108473] kthread+0xdd/0x100 [ 3710.108477] ? kthread_complete_and_exit+0x20/0x20 [ 3710.108479] ret_from_fork+0x1f/0x30 [ 3710.108485] </TASK> [ 3710.108486] ---[ end trace 1b4b23cd0c65d6a0 ]---
After patch:
[ 402.473064] ice 0000:41:00.0: Type was not set for devlink port. [ 402.473064] ice 0000:41:00.1: Type was not set for devlink port.
--- net/core/devlink.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
net/core/devlink.c +4 -1
@@ -9055,7 +9055,10 @@ EXPORT_SYMBOL_GPL(devlink_free);static void devlink_port_type_warn (struct work_struct *work) { -WARN (true,"Type was not set for devlink port." ); +struct devlink_port *port =container_of (to_delayed_work (work), + struct devlink_port, + type_warn_dw); +dev_warn (port->devlink->dev,"Type was not set for devlink port." ); }static bool devlink_port_type_should_warn (struct devlink_port *devlink_port)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 180/245 wifi: wext-core: Fix -Wstringop-overflow warning in ioctl_standard_iw_point()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gustavo A. R. Silva <[email protected]>
[ Upstream commit 71e7552c90db2a2767f5c17c7ec72296b0d92061 ]
-Wstringop-overflow is legitimately warning us about extra_size pontentially being zero at some point, hence potenially ending up _allocating_ zero bytes of memory for extra pointer and then trying to access such object in a call to copy_from_user().
Fix this by adding a sanity check to ensure we never end up trying to allocate zero bytes of data for extra pointer, before continue executing the rest of the code in the function.
Address the following -Wstringop-overflow warning seen when built
m68k architecture with allyesconfig configuration:
from net/wireless/wext-core.c:11:
In function '_copy_from_user',
inlined from 'copy_from_user' at include/linux/uaccess.h:183:7,
inlined from 'ioctl_standard_iw_point' at net/wireless/wext-core.c:825:7:arch/m68k/include/asm/string.h:48:25: warning: '__builtin_memset' writing 1 or more bytes into a region of size 0 overflows the destination [-Wstringop-overflow=]
48 | #define memset(d, c, n) __builtin_memset(d, c, n)
| ^~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/uaccess.h:153:17: note: in expansion of macro 'memset'
153 | memset(to + (n - res), 0, res);
| ^~~~~~In function 'kmalloc',
inlined from 'kzalloc' at include/linux/slab.h:694:9,
inlined from 'ioctl_standard_iw_point' at net/wireless/wext-core.c:819:10:include/linux/slab.h:577:16: note: at offset 1 into destination object of size 0 allocated by '__kmalloc'
577 | return __kmalloc(size, flags);
| ^~~~~~~~~~~~~~~~~~~~~~This help with the ongoing efforts to globally enable -Wstringop-overflow.
--- net/wireless/wext-core.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/wireless/wext-core.c +6 -0
@@ -799,6 +799,12 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd, } } +/* Sanity-check to ensure we never end up _allocating_ zero +* bytes of data for extra. +*/ +if (extra_size <=0 ) +return -EFAULT ; +/* kzalloc() ensures NULL-termination for essid_compat. */ extra =kzalloc (extra_size,GFP_KERNEL );if (!extra)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 181/245 igb: Fix igb_down hung on surprise removal
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ying Hsu <[email protected]>
[ Upstream commit 004d25060c78fc31f66da0fa439c544dda1ac9d5 ]
In a setup where a Thunderbolt hub connects to Ethernet and a display through USB Type-C, users may experience a hung task timeout when they remove the cable between the PC and the Thunderbolt hub. This is because the igb_down function is called multiple times when the Thunderbolt hub is unplugged. For example, the igb_io_error_detected triggers the first call, and the igb_remove triggers the second call. The second call to igb_down will block at napi_synchronize. Here's the call trace:
__schedule+0x3b0/0xddb
? __mod_timer+0x164/0x5d3
schedule+0x44/0xa8
schedule_timeout+0xb2/0x2a4
? run_local_timers+0x4e/0x4e
msleep+0x31/0x38
igb_down+0x12c/0x22a [igb 6615058754948bfde0bf01429257eb59f13030d4]
__igb_close+0x6f/0x9c [igb 6615058754948bfde0bf01429257eb59f13030d4]
igb_close+0x23/0x2b [igb 6615058754948bfde0bf01429257eb59f13030d4]
__dev_close_many+0x95/0xec
dev_close_many+0x6e/0x103
unregister_netdevice_many+0x105/0x5b1
unregister_netdevice_queue+0xc2/0x10d
unregister_netdev+0x1c/0x23
igb_remove+0xa7/0x11c [igb 6615058754948bfde0bf01429257eb59f13030d4]
pci_device_remove+0x3f/0x9c
device_release_driver_internal+0xfe/0x1b4
pci_stop_bus_device+0x5b/0x7f
pci_stop_bus_device+0x30/0x7f
pci_stop_bus_device+0x30/0x7f
pci_stop_and_remove_bus_device+0x12/0x19
pciehp_unconfigure_device+0x76/0xe9
pciehp_disable_slot+0x6e/0x131
pciehp_handle_presence_or_link_change+0x7a/0x3f7
pciehp_ist+0xbe/0x194
irq_thread_fn+0x22/0x4d
? irq_thread+0x1fd/0x1fd
irq_thread+0x17b/0x1fd
? irq_forced_thread_fn+0x5f/0x5f
kthread+0x142/0x153
? __irq_get_irqchip_state+0x46/0x46
? kthread_associate_blkcg+0x71/0x71
ret_from_fork+0x1f/0x30In this case, igb_io_error_detected detaches the network interface and requests a PCIE slot reset, however, the PCIE reset callback is not being invoked and thus the Ethernet connection breaks down. As the PCIE error in this case is a non-fatal one, requesting a slot reset can be avoided.
This patch fixes the task hung issue and preserves Ethernet connection by ignoring non-fatal PCIE errors.
--- drivers/net/ethernet/intel/igb/igb_main.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/intel/igb/igb_main.c +5 -0
@@ -9451,6 +9451,11 @@ static pci_ers_result_t igb_io_error_detected(struct pci_dev *pdev,struct net_device *netdev =pci_get_drvdata (pdev);struct igb_adapter *adapter =netdev_priv (netdev); +if (state == pci_channel_io_normal) { +dev_warn (&pdev->dev,"Non-correctable non-fatal error reported.\n" ); +return PCI_ERS_RESULT_CAN_RECOVER ; + } +netif_device_detach (netdev);if (state == pci_channel_io_perm_failure)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 182/245 wifi: iwlwifi: mvm: avoid baid size integer overflow
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 1a528ab1da324d078ec60283c34c17848580df24 ]
Roee reported various hard-to-debug crashes with pings in EHT aggregation scenarios. Enabling KASAN showed that we access the BAID allocation out of bounds, and looking at the code a bit shows that since the reorder buffer entry (struct iwl_mvm_reorder_buf_entry) is 128 bytes if debug such as lockdep is enabled, then staring from an agg size 512 we overflow the size calculation, and allocate a much smaller structure than we should, causing slab corruption once we initialize this.
Fix this by simply using u32 instead of u16.
--- drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/mvm/sta.c +1 -1
@@ -2544,7 +2544,7 @@ int iwl_mvm_sta_rx_agg(struct iwl_mvm *mvm, struct ieee80211_sta *sta, }if (iwl_mvm_has_new_rx_api (mvm) && start) { -u16 reorder_buf_size = buf_size *sizeof (baid_data->entries[0 ]); +u32 reorder_buf_size = buf_size *sizeof (baid_data->entries[0 ]);/* sparse doesn't like the __align() so don't check */ #ifndef __CHECKER__
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 183/245 exfat: support dynamic allocate bh for exfat_entry_set_cache
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuezhang Mo <[email protected]>
[ Upstream commit a3ff29a95fde16906304455aa8c0bd84eb770258 ]
In special cases, a file or a directory may occupied more than 19 directory entries, pre-allocating 3 bh is not enough. Such as
- Support vendor secondary directory entry in the future.
- Since file directory entry is damaged, the SecondaryCount field is bigger than 18.
So this commit supports dynamic allocation of bh.
--- fs/exfat/dir.c | 15 +++++++++++++++ fs/exfat/exfat_fs.h | 5 ++++- 2 files changed, 19 insertions(+), 1 deletion(-)
fs/exfat/dir.c +15 -0
@@ -618,6 +618,10 @@ int exfat_free_dentry_set(struct exfat_entry_set_cache *es, int sync)bforget (es->bh[i]); else brelse(es->bh[i]); + +if (IS_DYNAMIC_ES (es)) +kfree (es->bh); +kfree (es);return err; }
@@ -853,6 +857,7 @@ struct exfat_entry_set_cache *exfat_get_dentry_set(struct super_block *sb,/* byte offset in sector */ off =EXFAT_BLK_OFFSET (byte_offset, sb); es->start_off = off; + es->bh = es->__bh;/* sector offset in cluster */ sec =EXFAT_B_TO_BLK (byte_offset, sb);
@@ -872,6 +877,16 @@ struct exfat_entry_set_cache *exfat_get_dentry_set(struct super_block *sb, es->num_entries = num_entries; num_bh =EXFAT_B_TO_BLK_ROUND_UP (off + num_entries *DENTRY_SIZE , sb); +if (num_bh >ARRAY_SIZE (es->__bh)) { + es->bh =kmalloc_array (num_bh,sizeof (*es->bh),GFP_KERNEL ); +if (!es->bh) { +brelse (bh); +kfree (es); +return NULL ; + } + es->bh[0 ] = bh; + } +for (i =1 ; i < num_bh; i++) {/* get the next sector */ if (exfat_is_last_sector_in_cluster (sbi, sec)) {
fs/exfat/exfat_fs.h +4 -1
@@ -170,10 +170,13 @@ struct exfat_entry_set_cache {bool modified;unsigned int start_off;int num_bh; -struct buffer_head *bh[DIR_CACHE_SIZE ]; +struct buffer_head *__bh[DIR_CACHE_SIZE ]; +struct buffer_head **bh;unsigned int num_entries; }; +#define IS_DYNAMIC_ES (es) ((es)->__bh != (es)->bh) +struct exfat_dir_entry {struct exfat_chain dir;int entry;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 184/245 arm64: dts: rockchip: fix regulator name on rk3399-rock-4
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: FUKAUMI Naoki <[email protected]>
[ Upstream commit 69448624b770aa88a71536a16900dd3cc6002919 ]
fix regulator name
ref:
https://dl.radxa.com/rockpi4/docs/hw/rockpi4/rockpi4_v13_sch_20181112.pdf
--- .../boot/dts/rockchip/rk3399-rock-pi-4.dtsi | 25 ++++++++++--------- 1 file changed, 13 insertions(+), 12 deletions(-)
arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi +13 -12
@@ -98,24 +98,25 @@ vcc5v0_host: vcc5v0-host-regulator { vin-supply = <&vcc5v0_sys>; }; - vcc5v0_typec: vcc5v0-typec-regulator { + vbus_typec: vbus-typec-regulator { compatible = "regulator-fixed"; enable-active-high; gpio = <&gpio1 RK_PA3 GPIO_ACTIVE_HIGH>; pinctrl-names = "default"; pinctrl-0 = <&vcc5v0_typec_en>; - regulator-name = "vcc5v0_typec"; + regulator-name = "vbus_typec"; regulator-always-on; vin-supply = <&vcc5v0_sys>; }; - vcc_lan: vcc3v3-phy-regulator { + vcc3v3_lan: vcc3v3-lan-regulator { compatible = "regulator-fixed"; - regulator-name = "vcc_lan"; + regulator-name = "vcc3v3_lan"; regulator-always-on; regulator-boot-on; regulator-min-microvolt = <3300000>; regulator-max-microvolt = <3300000>; + vin-supply = <&vcc3v3_sys>; }; vdd_log: vdd-log {
@@ -162,7 +163,7 @@ &gmac { assigned-clocks = <&cru SCLK_RMII_SRC>; assigned-clock-parents = <&clkin_gmac>; clock_in_out = "input"; - phy-supply = <&vcc_lan>; + phy-supply = <&vcc3v3_lan>; phy-mode = "rgmii"; pinctrl-names = "default"; pinctrl-0 = <&rgmii_pins>;
@@ -267,8 +268,8 @@ regulator-state-mem { }; }; - vcc1v8_codec: LDO_REG1 { - regulator-name = "vcc1v8_codec"; + vcca1v8_codec: LDO_REG1 { + regulator-name = "vcca1v8_codec"; regulator-always-on; regulator-boot-on; regulator-min-microvolt = <1800000>;
@@ -278,8 +279,8 @@ regulator-state-mem { }; }; - vcc1v8_hdmi: LDO_REG2 { - regulator-name = "vcc1v8_hdmi"; + vcca1v8_hdmi: LDO_REG2 { + regulator-name = "vcca1v8_hdmi"; regulator-always-on; regulator-boot-on; regulator-min-microvolt = <1800000>;
@@ -336,8 +337,8 @@ regulator-state-mem { }; }; - vcc0v9_hdmi: LDO_REG7 { - regulator-name = "vcc0v9_hdmi"; + vcca0v9_hdmi: LDO_REG7 { + regulator-name = "vcca0v9_hdmi"; regulator-always-on; regulator-boot-on; regulator-min-microvolt = <900000>;
@@ -456,7 +457,7 @@ &io_domains { status = "okay"; bt656-supply = <&vcc_3v0>; - audio-supply = <&vcc1v8_codec>; + audio-supply = <&vcca1v8_codec>; sdmmc-supply = <&vcc_sdio>; gpio1830-supply = <&vcc_3v0>; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 185/245 arm64: dts: rockchip: add ES8316 codec for ROCK Pi 4
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Bee <[email protected]>
[ Upstream commit 65bd2b8bdb3bddc37bea695789713916327e1c1f ]
ROCK Pi 4 boards have the codec connected to i2s0 and it is accessible via i2c1 address 0x11.
Add an audio-graph-card for it.
--- .../boot/dts/rockchip/rk3399-rock-pi-4.dtsi | 28 +++++++++++++++++++ 1 file changed, 28 insertions(+)
arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi +28 -0
@@ -36,6 +36,12 @@ sdio_pwrseq: sdio-pwrseq { reset-gpios = <&gpio0 RK_PB2 GPIO_ACTIVE_LOW>; }; + sound { + compatible = "audio-graph-card"; + label = "Analog"; + dais = <&i2s0_p0>; + }; + vcc12v_dcin: dc-12v { compatible = "regulator-fixed"; regulator-name = "vcc12v_dcin";
@@ -423,6 +429,20 @@ &i2c1 { i2c-scl-rising-time-ns = <300>; i2c-scl-falling-time-ns = <15>; status = "okay"; + + es8316: codec@11 { + compatible = "everest,es8316"; + reg = <0x11>; + clocks = <&cru SCLK_I2S_8CH_OUT>; + clock-names = "mclk"; + #sound-dai-cells = <0>; + + port { + es8316_p0_0: endpoint { + remote-endpoint = <&i2s0_p0_0>; + }; + }; + }; }; &i2c3 {
@@ -442,6 +462,14 @@ &i2s0 { rockchip,capture-channels = <2>; rockchip,playback-channels = <2>; status = "okay"; + + i2s0_p0: port { + i2s0_p0_0: endpoint { + dai-format = "i2s"; + mclk-fs = <256>; + remote-endpoint = <&es8316_p0_0>; + }; + }; }; &i2s1 {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 186/245 arm64: dts: rockchip: add SPDIF node for ROCK Pi 4
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Bee <[email protected]>
[ Upstream commit 697dd494cb1cf56acfb764214a1e4788e4d1a983 ]
Add a SPDIF audio-graph-card to ROCK Pi 4 device tree.
It's not enabled by default since all dma channels are used by the (already) enabled i2s0/1/2 and the pin is muxed with GPIO4_C5 which might be in use already.
If enabled SPDIF_TX will be available at pin #15.
--- .../boot/dts/rockchip/rk3399-rock-pi-4.dtsi | 26 +++++++++++++++++++ 1 file changed, 26 insertions(+)
arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi +26 -0
@@ -42,6 +42,23 @@ sound { dais = <&i2s0_p0>; }; + sound-dit { + compatible = "audio-graph-card"; + label = "SPDIF"; + dais = <&spdif_p0>; + }; + + spdif-dit { + compatible = "linux,spdif-dit"; + #sound-dai-cells = <0>; + + port { + dit_p0_0: endpoint { + remote-endpoint = <&spdif_p0_0>; + }; + }; + }; + vcc12v_dcin: dc-12v { compatible = "regulator-fixed"; regulator-name = "vcc12v_dcin";
@@ -631,6 +648,15 @@ &sdhci { status = "okay"; }; +&spdif { + + spdif_p0: port { + spdif_p0_0: endpoint { + remote-endpoint = <&dit_p0_0>; + }; + }; +}; + &tcphy0 { status = "okay"; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 187/245 ARM: dts: BCM53573: Describe on-SoC BCM53125 rev 4 switch
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafał Miłecki <[email protected]>
[ Upstream commit 9fb90ae6cae7f8fe4fbf626945f32cd9da2c3892 ]
BCM53573 family SoC have Ethernet switch connected to the first Ethernet controller (accessible over MDIO).
--- arch/arm/boot/dts/bcm53573.dtsi | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
arch/arm/boot/dts/bcm53573.dtsi +18 -0
@@ -181,6 +181,24 @@ ohci_port2: port@2 { gmac0: ethernet@5000 { reg = <0x5000 0x1000>; + + mdio { + #address-cells = <1>; + #size-cells = <0>; + + switch: switch@1e { + compatible = "brcm,bcm53125"; + reg = <0x1e>; + + status = "disabled"; + + /* ports are defined in board DTS */ + ports { + #address-cells = <1>; + #size-cells = <0>; + }; + }; + }; }; gmac1: ethernet@b000 {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 188/245 ACPI: video: Add backlight=native DMI quirk for Apple iMac12,1 and iMac12,2
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 8cf04bb321f036dd2e523e993897e0789bd5265c ]
Linux defaults to picking the non-working ACPI video backlight interface on the Apple iMac12,1 and iMac12,2.
Add a DMI quirk to pick the working native radeon_bl0 interface instead.
--- drivers/acpi/video_detect.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
drivers/acpi/video_detect.c +18 -0
@@ -357,6 +357,24 @@ static const struct dmi_system_id video_detect_dmi_table[] = { DMI_MATCH(DMI_PRODUCT_NAME, "iMac11,3"), }, }, + { +/* https://gitlab.freedesktop.org/drm/amd/-/issues/1838 */ + .callback = video_detect_force_native, +/* Apple iMac12,1 */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Apple Inc." ), + DMI_MATCH(DMI_PRODUCT_NAME, "iMac12,1"), + }, + }, + { +/* https://gitlab.freedesktop.org/drm/amd/-/issues/2753 */ + .callback = video_detect_force_native, +/* Apple iMac12,2 */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Apple Inc." ), + DMI_MATCH(DMI_PRODUCT_NAME, "iMac12,2"), + }, + }, {/* https://bugzilla.redhat.com/show_bug.cgi?id=1217249 */ .callback = video_detect_force_native,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 189/245 ACPI: resource: Add ASUS model S5402ZA to quirks
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kellen Renshaw <[email protected]>
[ Upstream commit 6e5cbe7c4b41824e500acbb42411da692d1435f1 ]
The Asus Vivobook S5402ZA has the same keyboard issue as Asus Vivobook K3402ZA/K3502ZA. The kernel overrides IRQ 1 to Edge_High when it should be Active_Low.
This patch adds the S5402ZA model to the quirk list.
--- drivers/acpi/resource.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/acpi/resource.c +7 -0
@@ -421,6 +421,13 @@ static const struct dmi_system_id asus_laptop[] = { DMI_MATCH(DMI_BOARD_NAME, "K3502ZA"), }, }, + { + .ident = "Asus Vivobook S5402ZA", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_BOARD_NAME, "S5402ZA"), + }, + }, { } };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 190/245 ACPI: resource: Skip IRQ override on Asus Vivobook S5602ZA
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tamim Khan <[email protected]>
[ Upstream commit b5f9223a105d9b56954ad1ca3eace4eaf26c99ed ]
Like the Asus Vivobook K3402ZA/K3502ZA/S5402ZA Asus Vivobook S5602ZA has an ACPI DSDT table the describes IRQ 1 as ActiveLow while the kernel overrides it to Edge_High. This prevents the keyboard on this laptop from working. To fix this add this laptop to the skip_override_table so that the kernel does not override IRQ 1.
--- drivers/acpi/resource.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/acpi/resource.c +7 -0
@@ -428,6 +428,13 @@ static const struct dmi_system_id asus_laptop[] = { DMI_MATCH(DMI_BOARD_NAME, "S5402ZA"), }, }, + { + .ident = "Asus Vivobook S5602ZA", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_BOARD_NAME, "S5602ZA"), + }, + }, { } };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 191/245 ACPI: resource: Add Asus ExpertBook B2502 to Asus quirks
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 7203481fd12b1257938519efb2460ea02b9236ee ]
The Asus ExpertBook B2502 has the same keyboard issue as Asus Vivobook K3402ZA/K3502ZA. The kernel overrides IRQ 1 to Edge_High when it should be Active_Low.
This patch adds the ExpertBook B2502 model to the existing quirk list of Asus laptops with this issue.
Stable-dep-of: 77c724888238 ("ACPI: resource: Skip IRQ override on Asus Expertbook B2402CBA")
--- drivers/acpi/resource.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/acpi/resource.c +7 -0
@@ -435,6 +435,13 @@ static const struct dmi_system_id asus_laptop[] = { DMI_MATCH(DMI_BOARD_NAME, "S5602ZA"), }, }, + { + .ident = "Asus ExpertBook B2502", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_BOARD_NAME, "B2502CBA"), + }, + }, { } };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 192/245 ACPI: resource: Skip IRQ override on Asus Expertbook B2402CBA
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tamim Khan <[email protected]>
[ Upstream commit 77c7248882385397cd7dffe9e1437f59f32ce2de ]
Like the Asus Expertbook B2502CBA and various Asus Vivobook laptops, the Asus Expertbook B2402CBA has an ACPI DSDT table that describes IRQ 1 as ActiveLow while the kernel overrides it to Edge_High. This prevents the keyboard from working. To fix this issue, add this laptop to the skip_override_table so that the kernel does not override IRQ 1.
--- drivers/acpi/resource.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/acpi/resource.c +7 -0
@@ -435,6 +435,13 @@ static const struct dmi_system_id asus_laptop[] = { DMI_MATCH(DMI_BOARD_NAME, "S5602ZA"), }, }, + { + .ident = "Asus ExpertBook B2402CBA", + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"ASUSTeK COMPUTER INC." ), + DMI_MATCH(DMI_BOARD_NAME, "B2402CBA"), + }, + }, { .ident ="Asus ExpertBook B2502" , .matches = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 193/245 ACPI: resource: Skip IRQ override on ASUS ExpertBook B1502CBA
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Menzel <[email protected]>
[ Upstream commit 05cda427126f30ce3fc8ffd82fd6f5196398d502 ]
Like the ASUS ExpertBook B2502CBA and various ASUS Vivobook laptops, the ASUS ExpertBook B1502CBA has an ACPI DSDT table that describes IRQ 1 as ActiveLow while the kernel overrides it to Edge_High.
$ sudo dmesg | grep DMI
DMI: ASUSTeK COMPUTER INC. ASUS EXPERTBOOK B1502CBA_B1502CBA/B1502CBA, BIOS B1502CBA.300 01/18/2023
$ grep -A 40 PS2K dsdt.dsl | grep IRQ -A 1
IRQ (Level, ActiveLow, Exclusive, )
{1}This prevents the keyboard from working. To fix this issue, add this laptop to the skip_override_table so that the kernel does not override IRQ 1.
--- drivers/acpi/resource.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/acpi/resource.c +7 -0
@@ -435,6 +435,13 @@ static const struct dmi_system_id asus_laptop[] = { DMI_MATCH(DMI_BOARD_NAME, "S5602ZA"), }, }, + { + .ident = "Asus ExpertBook B1502CBA", + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"ASUSTeK COMPUTER INC." ), + DMI_MATCH(DMI_BOARD_NAME, "B1502CBA"), + }, + }, { .ident ="Asus ExpertBook B2402CBA" , .matches = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 194/245 xhci: cleanup xhci_hub_control port references
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <[email protected]>
[ Upstream commit faaae0190dcd1e230616c85bbc3b339f27ba5b81 ]
Both port number and port structure of a port are referred to several times when handing hub requests in xhci.
Use more suitable data types and readable names for these. Cleanup only, no functional changes
Stable-dep-of: d7cdfc319b2b ("xhci: track port suspend state correctly in unsuccessful resume cases")
--- drivers/usb/host/xhci-hub.c | 123 ++++++++++++++++++------------------ 1 file changed, 63 insertions(+), 60 deletions(-)
drivers/usb/host/xhci-hub.c +63 -60
@@ -1194,11 +1194,14 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,u16 test_mode =0 ;struct xhci_hub *rhub;struct xhci_port **ports; +struct xhci_port *port; +int portnum1; rhub =xhci_get_rhub (hcd); ports = rhub->ports; max_ports = rhub->num_ports; bus_state = &rhub->bus_state; + portnum1 = wIndex &0xff ;spin_lock_irqsave (&xhci->lock, flags);switch (typeReq) {
@@ -1232,10 +1235,12 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,spin_unlock_irqrestore (&xhci->lock, flags);return retval;case GetPortStatus: -if (!wIndex || wIndex > max_ports) +if (!portnum1 || portnum1 > max_ports) goto error; + wIndex--; - temp =readl (ports[wIndex]->addr); + port = ports[portnum1 -1 ]; + temp =readl (port->addr);if (temp == ~(u32 )0 ) {xhci_hc_died (xhci); retval = -ENODEV ;
@@ -1248,7 +1253,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, goto error;xhci_dbg (xhci,"Get port status %d-%d read: 0x%x, return 0x%x" , - hcd->self.busnum, wIndex +1 , temp, status); + hcd->self.busnum, portnum1, temp, status);put_unaligned (cpu_to_le32 (status), (__le32 *) buf);/* if USB 3.1 extended port status return additional 4 bytes */
@@ -1260,7 +1265,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, retval = -EINVAL ;break ; } - port_li =readl (ports[wIndex]->addr +PORTLI ); + port_li =readl (port->addr +PORTLI ); status =xhci_get_ext_port_status (temp, port_li);put_unaligned_le32 (status, &buf[4 ]); }
@@ -1274,11 +1279,14 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, test_mode = (wIndex &0xff00 ) >>8 ;/* The MSB of wIndex is the U1/U2 timeout */ timeout = (wIndex &0xff00 ) >>8 ; + wIndex &=0xff ; -if (!wIndex || wIndex > max_ports) +if (!portnum1 || portnum1 > max_ports) goto error; + + port = ports[portnum1 -1 ]; wIndex--; - temp =readl (ports[wIndex]->addr); + temp =readl (port->addr);if (temp == ~(u32 )0 ) {xhci_hc_died (xhci); retval = -ENODEV ;
@@ -1288,11 +1296,10 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,/* FIXME: What new port features do we need to support? */ switch (wValue) {case USB_PORT_FEAT_SUSPEND : - temp =readl (ports[wIndex]->addr); + temp =readl (port->addr);if ((temp &PORT_PLS_MASK ) !=XDEV_U0 ) {/* Resume the port to U0 first */ -xhci_set_link_state (xhci, ports[wIndex], -XDEV_U0 ); +xhci_set_link_state (xhci, port,XDEV_U0 );spin_unlock_irqrestore (&xhci->lock, flags);msleep (10 );spin_lock_irqsave (&xhci->lock, flags);
@@ -1301,16 +1308,16 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,* a port unless the port reports that it is in the * enabled (PED = ‘1’,PLS < ‘3’) state. */ - temp =readl (ports[wIndex]->addr); + temp =readl (port->addr);if ((temp &PORT_PE ) ==0 || (temp &PORT_RESET ) || (temp &PORT_PLS_MASK ) >=XDEV_U3 ) {xhci_warn (xhci,"USB core suspending port %d-%d not in U0/U1/U2\n" , - hcd->self.busnum, wIndex +1 ); + hcd->self.busnum, portnum1); goto error; } slot_id =xhci_find_slot_id_by_port (hcd, xhci, - wIndex +1 ); + portnum1);if (!slot_id) {xhci_warn (xhci,"slot_id is zero\n" ); goto error;
@@ -1320,21 +1327,21 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,xhci_stop_device (xhci, slot_id,1 );spin_lock_irqsave (&xhci->lock, flags); -xhci_set_link_state (xhci, ports[wIndex],XDEV_U3 ); +xhci_set_link_state (xhci, port,XDEV_U3 );spin_unlock_irqrestore (&xhci->lock, flags);msleep (10 );/* wait device to enter */ spin_lock_irqsave (&xhci->lock, flags); - temp =readl (ports[wIndex]->addr); + temp =readl (port->addr); bus_state->suspended_ports |=1 << wIndex;break ;case USB_PORT_FEAT_LINK_STATE : - temp =readl (ports[wIndex]->addr); + temp =readl (port->addr);/* Disable port */ if (link_state ==USB_SS_PORT_LS_SS_DISABLED ) {xhci_dbg (xhci,"Disable port %d-%d\n" , - hcd->self.busnum, wIndex +1 ); + hcd->self.busnum, portnum1); temp =xhci_port_state_to_neutral (temp);/* * Clear all change bits, so that we get a new
@@ -1343,18 +1350,17 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, temp |=PORT_CSC |PORT_PEC |PORT_WRC |PORT_OCC |PORT_RC |PORT_PLC |PORT_CEC ; -writel (temp |PORT_PE , ports[wIndex]->addr); - temp =readl (ports[wIndex]->addr); +writel (temp |PORT_PE , port->addr); + temp =readl (port->addr);break ; }/* Put link in RxDetect (enable port) */ if (link_state ==USB_SS_PORT_LS_RX_DETECT ) {xhci_dbg (xhci,"Enable port %d-%d\n" , - hcd->self.busnum, wIndex +1 ); -xhci_set_link_state (xhci, ports[wIndex], - link_state); - temp =readl (ports[wIndex]->addr); + hcd->self.busnum, portnum1); +xhci_set_link_state (xhci, port, link_state); + temp =readl (port->addr);break ; }
@@ -1384,11 +1390,10 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, }xhci_dbg (xhci,"Enable compliance mode transition for port %d-%d\n" , - hcd->self.busnum, wIndex +1 ); -xhci_set_link_state (xhci, ports[wIndex], - link_state); + hcd->self.busnum, portnum1); +xhci_set_link_state (xhci, port, link_state); - temp =readl (ports[wIndex]->addr); + temp =readl (port->addr);break ; }/* Port must be enabled */
@@ -1399,8 +1404,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,/* Can't set port link state above '3' (U3) */ if (link_state >USB_SS_PORT_LS_U3 ) {xhci_warn (xhci,"Cannot set port %d-%d link state %d\n" , - hcd->self.busnum, wIndex +1 , - link_state); + hcd->self.busnum, portnum1, link_state); goto error; }
@@ -1425,8 +1429,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,reinit_completion (&bus_state->u3exit_done[wIndex]); }if (pls <=XDEV_U3 )/* U1, U2, U3 */ -xhci_set_link_state (xhci, ports[wIndex], -USB_SS_PORT_LS_U0 ); +xhci_set_link_state (xhci, port,USB_SS_PORT_LS_U0 );if (!wait_u0) {if (pls >XDEV_U3 ) goto error;
@@ -1436,16 +1439,16 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,if (!wait_for_completion_timeout (&bus_state->u3exit_done[wIndex],msecs_to_jiffies (500 )))xhci_dbg (xhci,"missing U0 port change event for port %d-%d\n" , - hcd->self.busnum, wIndex +1 ); + hcd->self.busnum, portnum1);spin_lock_irqsave (&xhci->lock, flags); - temp =readl (ports[wIndex]->addr); + temp =readl (port->addr);break ; }if (link_state ==USB_SS_PORT_LS_U3 ) {int retries =16 ; slot_id =xhci_find_slot_id_by_port (hcd, xhci, - wIndex +1 ); + portnum1);if (slot_id) {/* unlock to execute stop endpoint * commands */
@@ -1454,16 +1457,16 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,xhci_stop_device (xhci, slot_id,1 );spin_lock_irqsave (&xhci->lock, flags); } -xhci_set_link_state (xhci, ports[wIndex],USB_SS_PORT_LS_U3 ); +xhci_set_link_state (xhci, port,USB_SS_PORT_LS_U3 );spin_unlock_irqrestore (&xhci->lock, flags);while (retries--) {usleep_range (4000 ,8000 ); - temp =readl (ports[wIndex]->addr); + temp =readl (port->addr);if ((temp &PORT_PLS_MASK ) ==XDEV_U3 )break ; }spin_lock_irqsave (&xhci->lock, flags); - temp =readl (ports[wIndex]->addr); + temp =readl (port->addr); bus_state->suspended_ports |=1 << wIndex; }break ;
@@ -1478,39 +1481,38 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,break ;case USB_PORT_FEAT_RESET : temp = (temp |PORT_RESET ); -writel (temp, ports[wIndex]->addr); +writel (temp, port->addr); - temp =readl (ports[wIndex]->addr); + temp =readl (port->addr);xhci_dbg (xhci,"set port reset, actual port %d-%d status = 0x%x\n" , - hcd->self.busnum, wIndex +1 , temp); + hcd->self.busnum, portnum1, temp);break ;case USB_PORT_FEAT_REMOTE_WAKE_MASK : -xhci_set_remote_wake_mask (xhci, ports[wIndex], - wake_mask); - temp =readl (ports[wIndex]->addr); +xhci_set_remote_wake_mask (xhci, port, wake_mask); + temp =readl (port->addr);xhci_dbg (xhci,"set port remote wake mask, actual port %d-%d status = 0x%x\n" , - hcd->self.busnum, wIndex +1 , temp); + hcd->self.busnum, portnum1, temp);break ;case USB_PORT_FEAT_BH_PORT_RESET : temp |=PORT_WR ; -writel (temp, ports[wIndex]->addr); - temp =readl (ports[wIndex]->addr); +writel (temp, port->addr); + temp =readl (port->addr);break ;case USB_PORT_FEAT_U1_TIMEOUT :if (hcd->speed <HCD_USB3 ) goto error; - temp =readl (ports[wIndex]->addr +PORTPMSC ); + temp =readl (port->addr +PORTPMSC ); temp &= ~PORT_U1_TIMEOUT_MASK ; temp |=PORT_U1_TIMEOUT (timeout); -writel (temp, ports[wIndex]->addr +PORTPMSC ); +writel (temp, port->addr +PORTPMSC );break ;case USB_PORT_FEAT_U2_TIMEOUT :if (hcd->speed <HCD_USB3 ) goto error; - temp =readl (ports[wIndex]->addr +PORTPMSC ); + temp =readl (port->addr +PORTPMSC ); temp &= ~PORT_U2_TIMEOUT_MASK ; temp |=PORT_U2_TIMEOUT (timeout); -writel (temp, ports[wIndex]->addr +PORTPMSC ); +writel (temp, port->addr +PORTPMSC );break ;case USB_PORT_FEAT_TEST :/* 4.19.6 Port Test Modes (USB2 Test Mode) */
@@ -1526,13 +1528,16 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, goto error; }/* unblock any posted writes */ - temp =readl (ports[wIndex]->addr); + temp =readl (port->addr);break ;case ClearPortFeature: -if (!wIndex || wIndex > max_ports) +if (!portnum1 || portnum1 > max_ports) goto error; + + port = ports[portnum1 -1 ]; + wIndex--; - temp =readl (ports[wIndex]->addr); + temp =readl (port->addr);if (temp == ~(u32 )0 ) {xhci_hc_died (xhci); retval = -ENODEV ;
@@ -1542,7 +1547,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, temp =xhci_port_state_to_neutral (temp);switch (wValue) {case USB_PORT_FEAT_SUSPEND : - temp =readl (ports[wIndex]->addr); + temp =readl (port->addr);xhci_dbg (xhci,"clear USB_PORT_FEAT_SUSPEND\n" );xhci_dbg (xhci,"PORTSC %04x\n" , temp);if (temp &PORT_RESET )
@@ -1553,20 +1558,18 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,set_bit (wIndex, &bus_state->resuming_ports);usb_hcd_start_port_resume (&hcd->self, wIndex); -xhci_set_link_state (xhci, ports[wIndex], -XDEV_RESUME ); +xhci_set_link_state (xhci, port,XDEV_RESUME );spin_unlock_irqrestore (&xhci->lock, flags);msleep (USB_RESUME_TIMEOUT );spin_lock_irqsave (&xhci->lock, flags); -xhci_set_link_state (xhci, ports[wIndex], -XDEV_U0 ); +xhci_set_link_state (xhci, port,XDEV_U0 );clear_bit (wIndex, &bus_state->resuming_ports);usb_hcd_end_port_resume (&hcd->self, wIndex); } bus_state->port_c_suspend |=1 << wIndex; slot_id =xhci_find_slot_id_by_port (hcd, xhci, - wIndex +1 ); + portnum1);if (!slot_id) {xhci_dbg (xhci,"slot_id is zero\n" ); goto error;
@@ -1584,11 +1587,11 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,case USB_PORT_FEAT_C_PORT_LINK_STATE :case USB_PORT_FEAT_C_PORT_CONFIG_ERROR :xhci_clear_port_change_bit (xhci, wValue, wIndex, - ports[wIndex]->addr, temp); + port->addr, temp);break ;case USB_PORT_FEAT_ENABLE :xhci_disable_port (hcd, xhci, wIndex, - ports[wIndex]->addr, temp); + port->addr, temp);break ;case USB_PORT_FEAT_POWER :xhci_set_port_power (xhci, hcd, wIndex, false, &flags);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 195/245 xhci: move port specific items such as state completions to port structure
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <[email protected]>
[ Upstream commit 2996e9fc00c378987c18ecbafe5624581b18c0d6 ]
Now that we have a port structure for each port it makes sense to move per port variables, timestamps and completions there. Get rid of storing bitfileds and arrays of port specific items per bus.
Move
unsigned long resume_done;
insigned long rexit_ports
struct completion rexit_done;
struct completion u3exit_done;
Rename rexit_ports to rexit_active, and remove a redundant hcd speed check while checking if rexit_active is set.
Stable-dep-of: d7cdfc319b2b ("xhci: track port suspend state correctly in unsuccessful resume cases")
--- drivers/usb/host/xhci-hub.c | 31 +++++++++++++++---------------- drivers/usb/host/xhci-mem.c | 10 +++------- drivers/usb/host/xhci-ring.c | 13 ++++++------- drivers/usb/host/xhci.h | 9 ++++----- 4 files changed, 28 insertions(+), 35 deletions(-)
drivers/usb/host/xhci-hub.c +15 -16
@@ -924,7 +924,7 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,return -EINVAL ; }/* did port event handler already start resume timing? */ -if (!bus_state->resume_done[wIndex]) { +if (!port->resume_done) {/* If not, maybe we are in a host initated resume? */ if (test_bit (wIndex, &bus_state->resuming_ports)) {/* Host initated resume doesn't time the resume
@@ -941,28 +941,27 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,msecs_to_jiffies (USB_RESUME_TIMEOUT );set_bit (wIndex, &bus_state->resuming_ports); - bus_state->resume_done[wIndex] = timeout; + port->resume_done = timeout;mod_timer (&hcd->rh_timer, timeout);usb_hcd_start_port_resume (&hcd->self, wIndex); }/* Has resume been signalled for USB_RESUME_TIME yet? */ - }else if (time_after_eq (jiffies, bus_state->resume_done[wIndex])) { + }else if (time_after_eq (jiffies, port->resume_done)) {int time_left;xhci_dbg (xhci,"resume USB2 port %d-%d\n" , hcd->self.busnum, wIndex +1 ); - bus_state->resume_done[wIndex] =0 ; + port->resume_done =0 ;clear_bit (wIndex, &bus_state->resuming_ports); - -set_bit (wIndex, &bus_state->rexit_ports); + port->rexit_active = true;xhci_test_and_clear_bit (xhci, port,PORT_PLC );xhci_set_link_state (xhci, port,XDEV_U0 );spin_unlock_irqrestore (&xhci->lock, *flags); time_left =wait_for_completion_timeout ( - &bus_state->rexit_done[wIndex], + &port->rexit_done,msecs_to_jiffies (XHCI_MAX_REXIT_TIMEOUT_MS ));spin_lock_irqsave (&xhci->lock, *flags);
@@ -981,7 +980,7 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,xhci_warn (xhci,"Port resume timed out, port %d-%d: 0x%x\n" , hcd->self.busnum, wIndex +1 , port_status); *status |=USB_PORT_STAT_SUSPEND ; -clear_bit (wIndex, &bus_state->rexit_ports); + port->rexit_active = false; }usb_hcd_end_port_resume (&hcd->self, wIndex);
@@ -1088,10 +1087,10 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status,if (link_state ==XDEV_U2 ) *status |=USB_PORT_STAT_L1 ;if (link_state ==XDEV_U0 ) { -if (bus_state->resume_done[portnum]) +if (port->resume_done)usb_hcd_end_port_resume (&port->rhub->hcd->self, portnum); - bus_state->resume_done[portnum] =0 ; + port->resume_done =0 ;clear_bit (portnum, &bus_state->resuming_ports);if (bus_state->suspended_ports & (1 << portnum)) { bus_state->suspended_ports &= ~(1 << portnum);
@@ -1163,11 +1162,11 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,* Clear stale usb2 resume signalling variables in case port changed * state during resume signalling. For example on error */ -if ((bus_state->resume_done[wIndex] || +if ((port->resume_done ||test_bit (wIndex, &bus_state->resuming_ports)) && (raw_port_status &PORT_PLS_MASK ) !=XDEV_U3 && (raw_port_status &PORT_PLS_MASK ) !=XDEV_RESUME ) { - bus_state->resume_done[wIndex] =0 ; + port->resume_done =0 ;clear_bit (wIndex, &bus_state->resuming_ports);usb_hcd_end_port_resume (&hcd->self, wIndex); }
@@ -1426,7 +1425,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, pls == XDEV_RESUME || pls == XDEV_RECOVERY) { wait_u0 = true; -reinit_completion (&bus_state->u3exit_done[wIndex]); +reinit_completion (&port->u3exit_done); }if (pls <=XDEV_U3 )/* U1, U2, U3 */ xhci_set_link_state (xhci, port,USB_SS_PORT_LS_U0 );
@@ -1436,7 +1435,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,break ; }spin_unlock_irqrestore (&xhci->lock, flags); -if (!wait_for_completion_timeout (&bus_state->u3exit_done[wIndex], +if (!wait_for_completion_timeout (&port->u3exit_done,msecs_to_jiffies (500 )))xhci_dbg (xhci,"missing U0 port change event for port %d-%d\n" , hcd->self.busnum, portnum1);
@@ -1675,8 +1674,8 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf)if ((temp & mask) !=0 || (bus_state->port_c_suspend &1 << i) || - (bus_state->resume_done[i] &&time_after_eq ( - jiffies, bus_state->resume_done[i]))) { + (ports[i]->resume_done &&time_after_eq ( + jiffies, ports[i]->resume_done))) { buf[(i +1 ) /8 ] |=1 << (i +1 ) %8 ; status =1 ; }
drivers/usb/host/xhci-mem.c +3 -7
@@ -2318,6 +2318,9 @@ static int xhci_setup_port_arrays(struct xhci_hcd *xhci, gfp_t flags) xhci->hw_ports[i].addr = &xhci->op_regs->port_status_base +NUM_PORT_REGS * i; xhci->hw_ports[i].hw_portnum = i; + +init_completion (&xhci->hw_ports[i].rexit_done); +init_completion (&xhci->hw_ports[i].u3exit_done); } xhci->rh_bw = kcalloc_node(num_ports, sizeof(*xhci->rh_bw), flags,
@@ -2587,13 +2590,6 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)*/ for (i =0 ; i <MAX_HC_SLOTS ; i++) xhci->devs[i] =NULL ; -for (i =0 ; i <USB_MAXCHILDREN ; i++) { - xhci->usb2_rhub.bus_state.resume_done[i] =0 ; - xhci->usb3_rhub.bus_state.resume_done[i] =0 ; -/* Only the USB 2.0 completions will ever be used. */ -init_completion (&xhci->usb2_rhub.bus_state.rexit_done[i]); -init_completion (&xhci->usb3_rhub.bus_state.u3exit_done[i]); - }if (scratchpad_alloc (xhci, flags)) goto fail;
drivers/usb/host/xhci-ring.c +6 -7
@@ -1987,7 +1987,7 @@ static void handle_port_status(struct xhci_hcd *xhci, goto cleanup; }else if (!test_bit (hcd_portnum, &bus_state->resuming_ports)) {xhci_dbg (xhci,"resume HS port %d\n" , port_id); - bus_state->resume_done[hcd_portnum] = jiffies + + port->resume_done = jiffies +msecs_to_jiffies (USB_RESUME_TIMEOUT );set_bit (hcd_portnum, &bus_state->resuming_ports);/* Do the rest in GetPortStatus after resume time delay.
@@ -1996,7 +1996,7 @@ static void handle_port_status(struct xhci_hcd *xhci,*/ set_bit (HCD_FLAG_POLL_RH , &hcd->flags);mod_timer (&hcd->rh_timer, - bus_state->resume_done[hcd_portnum]); + port->resume_done);usb_hcd_start_port_resume (&hcd->self, hcd_portnum); bogus_port_status = true; }
@@ -2008,7 +2008,7 @@ static void handle_port_status(struct xhci_hcd *xhci, (portsc & PORT_PLS_MASK) == XDEV_U1 || (portsc & PORT_PLS_MASK) == XDEV_U2)) {xhci_dbg (xhci,"resume SS port %d finished\n" , port_id); -complete (&bus_state->u3exit_done[hcd_portnum]); +complete (&port->u3exit_done);/* We've just brought the device into U0/1/2 through either the * Resume state after a device remote wakeup, or through the * U3Exit state after a host-initiated resume. If it's a device
@@ -2033,10 +2033,9 @@ static void handle_port_status(struct xhci_hcd *xhci,* RExit to a disconnect state). If so, let the the driver know it's * out of the RExit state. */ -if (!DEV_SUPERSPEED_ANY (portsc) && hcd->speed <HCD_USB3 && -test_and_clear_bit (hcd_portnum, - &bus_state->rexit_ports)) { -complete (&bus_state->rexit_done[hcd_portnum]); +if (hcd->speed <HCD_USB3 && port->rexit_active) { +complete (&port->rexit_done); + port->rexit_active = false; bogus_port_status = true; goto cleanup; }
drivers/usb/host/xhci.h +4 -5
@@ -1708,13 +1708,8 @@ struct xhci_bus_state {u32 port_c_suspend;u32 suspended_ports;u32 port_remote_wakeup; -unsigned long resume_done[USB_MAXCHILDREN ];/* which ports have started to resume */ unsigned long resuming_ports; -/* Which ports are waiting on RExit to U0 transition. */ -unsigned long rexit_ports; -struct completion rexit_done[USB_MAXCHILDREN ]; -struct completion u3exit_done[USB_MAXCHILDREN ]; };
@@ -1738,6 +1733,10 @@ struct xhci_port {struct xhci_hub *rhub;struct xhci_port_cap *port_cap; unsigned int lpm_incapable:1; +unsigned long resume_done; +bool rexit_active; +struct completion rexit_done; +struct completion u3exit_done; };struct xhci_hub {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 196/245 xhci: rename resume_done to resume_timestamp
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <[email protected]>
[ Upstream commit a909d629ae77b97b6288bc3cfe68560454bf79c6 ]
resume_done is just a timestamp, avoid confusing it with completions related to port state transitions that are named *_done
Stable-dep-of: d7cdfc319b2b ("xhci: track port suspend state correctly in unsuccessful resume cases")
--- drivers/usb/host/xhci-hub.c | 20 ++++++++++---------- drivers/usb/host/xhci-ring.c | 4 ++-- drivers/usb/host/xhci.h | 2 +- 3 files changed, 13 insertions(+), 13 deletions(-)
drivers/usb/host/xhci-hub.c +10 -10
@@ -924,7 +924,7 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,return -EINVAL ; }/* did port event handler already start resume timing? */ -if (!port->resume_done) { +if (!port->resume_timestamp) {/* If not, maybe we are in a host initated resume? */ if (test_bit (wIndex, &bus_state->resuming_ports)) {/* Host initated resume doesn't time the resume
@@ -941,18 +941,18 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,msecs_to_jiffies (USB_RESUME_TIMEOUT );set_bit (wIndex, &bus_state->resuming_ports); - port->resume_done = timeout; + port->resume_timestamp = timeout;mod_timer (&hcd->rh_timer, timeout);usb_hcd_start_port_resume (&hcd->self, wIndex); }/* Has resume been signalled for USB_RESUME_TIME yet? */ - }else if (time_after_eq (jiffies, port->resume_done)) { + }else if (time_after_eq (jiffies, port->resume_timestamp)) {int time_left;xhci_dbg (xhci,"resume USB2 port %d-%d\n" , hcd->self.busnum, wIndex +1 ); - port->resume_done =0 ; + port->resume_timestamp =0 ;clear_bit (wIndex, &bus_state->resuming_ports); port->rexit_active = true;
@@ -1087,10 +1087,10 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status,if (link_state ==XDEV_U2 ) *status |=USB_PORT_STAT_L1 ;if (link_state ==XDEV_U0 ) { -if (port->resume_done) +if (port->resume_timestamp)usb_hcd_end_port_resume (&port->rhub->hcd->self, portnum); - port->resume_done =0 ; + port->resume_timestamp =0 ;clear_bit (portnum, &bus_state->resuming_ports);if (bus_state->suspended_ports & (1 << portnum)) { bus_state->suspended_ports &= ~(1 << portnum);
@@ -1162,11 +1162,11 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,* Clear stale usb2 resume signalling variables in case port changed * state during resume signalling. For example on error */ -if ((port->resume_done || +if ((port->resume_timestamp ||test_bit (wIndex, &bus_state->resuming_ports)) && (raw_port_status &PORT_PLS_MASK ) !=XDEV_U3 && (raw_port_status &PORT_PLS_MASK ) !=XDEV_RESUME ) { - port->resume_done =0 ; + port->resume_timestamp =0 ;clear_bit (wIndex, &bus_state->resuming_ports);usb_hcd_end_port_resume (&hcd->self, wIndex); }
@@ -1674,8 +1674,8 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf)if ((temp & mask) !=0 || (bus_state->port_c_suspend &1 << i) || - (ports[i]->resume_done &&time_after_eq ( - jiffies, ports[i]->resume_done))) { + (ports[i]->resume_timestamp &&time_after_eq ( + jiffies, ports[i]->resume_timestamp))) { buf[(i +1 ) /8 ] |=1 << (i +1 ) %8 ; status =1 ; }
drivers/usb/host/xhci-ring.c +2 -2
@@ -1987,7 +1987,7 @@ static void handle_port_status(struct xhci_hcd *xhci, goto cleanup; }else if (!test_bit (hcd_portnum, &bus_state->resuming_ports)) {xhci_dbg (xhci,"resume HS port %d\n" , port_id); - port->resume_done = jiffies + + port->resume_timestamp = jiffies +msecs_to_jiffies (USB_RESUME_TIMEOUT );set_bit (hcd_portnum, &bus_state->resuming_ports);/* Do the rest in GetPortStatus after resume time delay.
@@ -1996,7 +1996,7 @@ static void handle_port_status(struct xhci_hcd *xhci,*/ set_bit (HCD_FLAG_POLL_RH , &hcd->flags);mod_timer (&hcd->rh_timer, - port->resume_done); + port->resume_timestamp);usb_hcd_start_port_resume (&hcd->self, hcd_portnum); bogus_port_status = true; }
drivers/usb/host/xhci.h +1 -1
@@ -1733,7 +1733,7 @@ struct xhci_port {struct xhci_hub *rhub;struct xhci_port_cap *port_cap; unsigned int lpm_incapable:1; -unsigned long resume_done; +unsigned long resume_timestamp;bool rexit_active;struct completion rexit_done;struct completion u3exit_done;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 197/245 xhci: clear usb2 resume related variables in one place.
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <[email protected]>
[ Upstream commit 0e6275452ce26d7ff274a5c1b15ed581a26f7986 ]
Initially resume related USB2 variables were cleared once port successfully resumed to U0. Later code was added to clean up stale resume variables in case of port failed to resume to U0.
Clear the variables in one place after port is no longer resuming or in suspended U3 state.
Stable-dep-of: d7cdfc319b2b ("xhci: track port suspend state correctly in unsuccessful resume cases")
--- drivers/usb/host/xhci-hub.c | 38 ++++++++++++++++--------------------- 1 file changed, 16 insertions(+), 22 deletions(-)
drivers/usb/host/xhci-hub.c +16 -22
@@ -1071,7 +1071,6 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status,struct xhci_bus_state *bus_state;u32 link_state;u32 portnum; -int ret; bus_state = &port->rhub->bus_state; link_state = portsc &PORT_PLS_MASK ;
@@ -1087,23 +1086,30 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status,if (link_state ==XDEV_U2 ) *status |=USB_PORT_STAT_L1 ;if (link_state ==XDEV_U0 ) { -if (port->resume_timestamp) -usb_hcd_end_port_resume (&port->rhub->hcd->self, - portnum); - port->resume_timestamp =0 ; -clear_bit (portnum, &bus_state->resuming_ports);if (bus_state->suspended_ports & (1 << portnum)) { bus_state->suspended_ports &= ~(1 << portnum); bus_state->port_c_suspend |=1 << portnum; } }if (link_state ==XDEV_RESUME ) { - ret =xhci_handle_usb2_port_link_resume (port, status, - portsc, flags); -if (ret) -return ; +xhci_handle_usb2_port_link_resume (port, status, portsc, + flags); } } + +/* +* Clear usb2 resume signalling variables if port is no longer suspended +* or resuming. Port either resumed to U0/U1/U2, disconnected, or in a +* error state. Resume related variables should be cleared in all those cases. +*/ +if ((link_state !=XDEV_U3 && + link_state !=XDEV_RESUME ) && + (port->resume_timestamp || +test_bit (portnum, &bus_state->resuming_ports))) { + port->resume_timestamp =0 ; +clear_bit (portnum, &bus_state->resuming_ports); +usb_hcd_end_port_resume (&port->rhub->hcd->self, portnum); + } }/*
@@ -1158,18 +1164,6 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,else xhci_get_usb2_port_status (port, &status, raw_port_status, flags); -/* -* Clear stale usb2 resume signalling variables in case port changed -* state during resume signalling. For example on error -*/ -if ((port->resume_timestamp || -test_bit (wIndex, &bus_state->resuming_ports)) && - (raw_port_status &PORT_PLS_MASK ) !=XDEV_U3 && - (raw_port_status &PORT_PLS_MASK ) !=XDEV_RESUME ) { - port->resume_timestamp =0 ; -clear_bit (wIndex, &bus_state->resuming_ports); -usb_hcd_end_port_resume (&hcd->self, wIndex); - }if (bus_state->port_c_suspend & (1 << wIndex)) status |=USB_PORT_STAT_C_SUSPEND <<16 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 198/245 xhci: decouple usb2 port resume and get_port_status request handling
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <[email protected]>
[ Upstream commit b0425784b942fffbbdb804896197f1dbccda37c5 ]
The get port status hub request code in xhci-hub.c will complete usb2 port resume signalling if signalling has been going on for long enough.
The code that completes the resume signalling, and the code that returns the port status have gotten too intertwined, so separate them a bit.
Stable-dep-of: d7cdfc319b2b ("xhci: track port suspend state correctly in unsuccessful resume cases")
--- drivers/usb/host/xhci-hub.c | 47 ++++++++++++++++++++----------------- 1 file changed, 25 insertions(+), 22 deletions(-)
drivers/usb/host/xhci-hub.c +25 -22
@@ -905,7 +905,7 @@ static void xhci_del_comp_mod_timer(struct xhci_hcd *xhci, u32 status, }static int xhci_handle_usb2_port_link_resume (struct xhci_port *port, -u32 *status,u32 portsc, +u32 portsc,unsigned long *flags) {struct xhci_bus_state *bus_state;
@@ -920,7 +920,6 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port, wIndex = port->hcd_portnum;if ((portsc &PORT_RESET ) || !(portsc &PORT_PE )) { - *status =0xffffffff ;return -EINVAL ; }/* did port event handler already start resume timing? */
@@ -954,6 +953,8 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port, port->resume_timestamp =0 ;clear_bit (wIndex, &bus_state->resuming_ports); + +reinit_completion (&port->rexit_done); port->rexit_active = true;xhci_test_and_clear_bit (xhci, port,PORT_PLC );
@@ -970,7 +971,6 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port, wIndex + 1);if (!slot_id) {xhci_dbg (xhci,"slot_id is zero\n" ); - *status =0xffffffff ;return -ENODEV ; }xhci_ring_device (xhci, slot_id);
@@ -979,22 +979,19 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,xhci_warn (xhci,"Port resume timed out, port %d-%d: 0x%x\n" , hcd->self.busnum, wIndex +1 , port_status); - *status |=USB_PORT_STAT_SUSPEND ; - port->rexit_active = false; +/* +* keep rexit_active set if U0 transition failed so we +* know to report PORT_STAT_SUSPEND status back to +* usbcore. It will be cleared later once the port is +* out of RESUME/U3 state +*/ }usb_hcd_end_port_resume (&hcd->self, wIndex); bus_state->port_c_suspend |=1 << wIndex; bus_state->suspended_ports &= ~(1 << wIndex); - }else { -/* -* The resume has been signaling for less than -* USB_RESUME_TIME. Report the port status as SUSPEND, -* let the usbcore check port status again and clear -* resume signaling later. -*/ - *status |=USB_PORT_STAT_SUSPEND ; } +return 0 ; }
@@ -1071,6 +1068,7 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status,struct xhci_bus_state *bus_state;u32 link_state;u32 portnum; +int err; bus_state = &port->rhub->bus_state; link_state = portsc &PORT_PLS_MASK ;
@@ -1092,8 +1090,12 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status, } }if (link_state ==XDEV_RESUME ) { -xhci_handle_usb2_port_link_resume (port, status, portsc, - flags); + err =xhci_handle_usb2_port_link_resume (port, portsc, + flags); +if (err <0 ) + *status =0xffffffff ; +else if (port->resume_timestamp || port->rexit_active) + *status |=USB_PORT_STAT_SUSPEND ; } }
@@ -1102,13 +1104,14 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status,* or resuming. Port either resumed to U0/U1/U2, disconnected, or in a * error state. Resume related variables should be cleared in all those cases. */ -if ((link_state !=XDEV_U3 && - link_state !=XDEV_RESUME ) && - (port->resume_timestamp || -test_bit (portnum, &bus_state->resuming_ports))) { - port->resume_timestamp =0 ; -clear_bit (portnum, &bus_state->resuming_ports); -usb_hcd_end_port_resume (&port->rhub->hcd->self, portnum); +if (link_state !=XDEV_U3 && link_state !=XDEV_RESUME ) { +if (port->resume_timestamp || +test_bit (portnum, &bus_state->resuming_ports)) { + port->resume_timestamp =0 ; +clear_bit (portnum, &bus_state->resuming_ports); +usb_hcd_end_port_resume (&port->rhub->hcd->self, portnum); + } + port->rexit_active =0 ; } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 199/245 xhci: track port suspend state correctly in unsuccessful resume cases
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <[email protected]>
[ Upstream commit d7cdfc319b2bcf6899ab0a05eec0958bc802a9a1 ]
xhci-hub.c tracks suspended ports in a suspended_port bitfield. This is checked when responding to a Get_Status(PORT) request to see if a port in running U0 state was recently resumed, and adds the required USB_PORT_STAT_C_SUSPEND change bit in those cases.
The suspended_port bit was left uncleared if a device is disconnected during suspend. The bit remained set even when a new device was connected and enumerated. The set bit resulted in a incorrect Get_Status(PORT) response with a bogus USB_PORT_STAT_C_SUSPEND change
bit set once the new device reached U0 link state.
USB_PORT_STAT_C_SUSPEND change bit is only used for USB2 ports, but xhci-hub keeps track of both USB2 and USB3 suspended ports.
--- drivers/usb/host/xhci-hub.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-)
drivers/usb/host/xhci-hub.c +10 -9
@@ -1043,19 +1043,19 @@ static void xhci_get_usb3_port_status(struct xhci_port *port, u32 *status, *status |=USB_PORT_STAT_C_CONFIG_ERROR <<16 ;/* USB3 specific wPortStatus bits */ -if (portsc &PORT_POWER ) { +if (portsc &PORT_POWER ) *status |=USB_SS_PORT_STAT_POWER ; -/* link state handling */ -if (link_state ==XDEV_U0 ) - bus_state->suspended_ports &= ~(1 << portnum); - } -/* remote wake resume signaling complete */ -if (bus_state->port_remote_wakeup & (1 << portnum) && +/* no longer suspended or resuming */ +if (link_state !=XDEV_U3 && link_state !=XDEV_RESUME && link_state !=XDEV_RECOVERY ) { - bus_state->port_remote_wakeup &= ~(1 << portnum); -usb_hcd_end_port_resume (&hcd->self, portnum); +/* remote wake resume signaling complete */ +if (bus_state->port_remote_wakeup & (1 << portnum)) { + bus_state->port_remote_wakeup &= ~(1 << portnum); +usb_hcd_end_port_resume (&hcd->self, portnum); + } + bus_state->suspended_ports &= ~(1 << portnum); }xhci_hub_report_usb3_link_state (xhci, status, portsc);
@@ -1112,6 +1112,7 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status,usb_hcd_end_port_resume (&port->rhub->hcd->self, portnum); } port->rexit_active =0 ; + bus_state->suspended_ports &= ~(1 << portnum); } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 200/245 cifs: add a warning when the in-flight count goes negative
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shyam Prasad N <[email protected]>
[ Upstream commit e4645cc2f1e2d6f268bb8dcfac40997c52432aed ]
We've seen the in-flight count go into negative with some internal stress testing in Microsoft.
Adding a WARN when this happens, in hope of understanding why this happens when it happens.
--- fs/cifs/smb2ops.c | 1 + 1 file changed, 1 insertion(+)
fs/cifs/smb2ops.c +1 -0
@@ -85,6 +85,7 @@ smb2_add_credits(struct TCP_Server_Info *server, *val =65000 ;/* Don't get near 64K credits, avoid srv bugs */ pr_warn_once ("server overflowed SMB3 credits\n" ); } +WARN_ON_ONCE (server->in_flight ==0 ); server->in_flight--; if (server->in_flight == 0 && ((optype & CIFS_OP_MASK) != CIFS_NEG_OP) &&
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 201/245 IB/hfi1: Fix a memleak in init_credit_return
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhipeng Lu <[email protected]>
[ Upstream commit 809aa64ebff51eb170ee31a95f83b2d21efa32e2 ]
When dma_alloc_coherent fails to allocate dd->cr_base[i].va, init_credit_return should deallocate dd->cr_base and dd->cr_base[i] that allocated before. Or those resources would be never freed and a memleak is triggered.
--- drivers/infiniband/hw/hfi1/pio.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/infiniband/hw/hfi1/pio.c +5 -1
@@ -2089,7 +2089,7 @@ int init_credit_return(struct hfi1_devdata *dd)"Unable to allocate credit return DMA range for NUMA %d\n" , i); ret = -ENOMEM ; - goto done; + goto free_cr_base; } }set_dev_node (&dd->pcidev->dev, dd->node);
@@ -2097,6 +2097,10 @@ int init_credit_return(struct hfi1_devdata *dd) ret =0 ; done:return ret; + +free_cr_base: +free_credit_return (dd); + goto done; }void free_credit_return (struct hfi1_devdata *dd)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 202/245 RDMA/bnxt_re: Return error for SRQ resize
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kalesh AP <[email protected]>
[ Upstream commit 3687b450c5f32e80f179ce4b09e0454da1449eac ]
SRQ resize is not supported in the driver. But driver is not returning error from bnxt_re_modify_srq() for SRQ resize.
--- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/infiniband/hw/bnxt_re/ib_verbs.c +2 -3
@@ -1705,7 +1705,7 @@ int bnxt_re_modify_srq(struct ib_srq *ib_srq, struct ib_srq_attr *srq_attr,switch (srq_attr_mask) {case IB_SRQ_MAX_WR :/* SRQ resize is not supported */ -break ; +return -EINVAL ;case IB_SRQ_LIMIT :/* Change the SRQ threshold */ if (srq_attr->srq_limit > srq->qplib_srq.max_wqe)
@@ -1720,13 +1720,12 @@ int bnxt_re_modify_srq(struct ib_srq *ib_srq, struct ib_srq_attr *srq_attr,/* On success, update the shadow */ srq->srq_limit = srq_attr->srq_limit;/* No need to Build and send response back to udata */ -break ; +return 0 ;default :ibdev_err (&rdev->ibdev,"Unsupported srq_attr_mask 0x%x" , srq_attr_mask);return -EINVAL ; } -return 0 ; }int bnxt_re_query_srq (struct ib_srq *ib_srq,struct ib_srq_attr *srq_attr)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 203/245 RDMA/irdma: Fix KASAN issue with tasklet
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Marciniszyn <[email protected]>
[ Upstream commit bd97cea7b18a0a553773af806dfbfac27a7c4acb ]
KASAN testing revealed the following issue assocated with freeing an IRQ.
[50006.466686] Call Trace: [50006.466691] <IRQ> [50006.489538] dump_stack+0x5c/0x80 [50006.493475] print_address_description.constprop.6+0x1a/0x150 [50006.499872] ? irdma_sc_process_ceq+0x483/0x790 [irdma] [50006.505742] ? irdma_sc_process_ceq+0x483/0x790 [irdma] [50006.511644] kasan_report.cold.11+0x7f/0x118 [50006.516572] ? irdma_sc_process_ceq+0x483/0x790 [irdma] [50006.522473] irdma_sc_process_ceq+0x483/0x790 [irdma] [50006.528232] irdma_process_ceq+0xb2/0x400 [irdma] [50006.533601] ? irdma_hw_flush_wqes_callback+0x370/0x370 [irdma] [50006.540298] irdma_ceq_dpc+0x44/0x100 [irdma] [50006.545306] tasklet_action_common.isra.14+0x148/0x2c0 [50006.551096] __do_softirq+0x1d0/0xaf8 [50006.555396] irq_exit_rcu+0x219/0x260 [50006.559670] irq_exit+0xa/0x20 [50006.563320] smp_apic_timer_interrupt+0x1bf/0x690 [50006.568645] apic_timer_interrupt+0xf/0x20 [50006.573341] </IRQ>
The issue is that a tasklet could be pending on another core racing the delete of the irq.
Fix by insuring any scheduled tasklet is killed after deleting the irq.
--- drivers/infiniband/hw/irdma/hw.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/infiniband/hw/irdma/hw.c +7 -0
@@ -562,6 +562,13 @@ static void irdma_destroy_irq(struct irdma_pci_f *rf, dev->irq_ops->irdma_dis_irq (dev, msix_vec->idx);irq_set_affinity_hint (msix_vec->irq,NULL );free_irq (msix_vec->irq, dev_id); +if (rf == dev_id) { +tasklet_kill (&rf->dpc_tasklet); + }else { +struct irdma_ceq *iwceq = (struct irdma_ceq *)dev_id; + +tasklet_kill (&iwceq->dpc_tasklet); + } }/**
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 204/245 RDMA/irdma: Validate max_send_wr and max_recv_wr
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shiraz Saleem <[email protected]>
[ Upstream commit ee107186bcfd25d7873258f3f75440e20f5e6416 ]
Validate that max_send_wr and max_recv_wr is within the supported range.
--- drivers/infiniband/hw/irdma/verbs.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/infiniband/hw/irdma/verbs.c +3 -1
@@ -749,7 +749,9 @@ static int irdma_validate_qp_attrs(struct ib_qp_init_attr *init_attr,if (init_attr->cap.max_inline_data > uk_attrs->max_hw_inline || init_attr->cap.max_send_sge > uk_attrs->max_hw_wq_frags || - init_attr->cap.max_recv_sge > uk_attrs->max_hw_wq_frags) + init_attr->cap.max_recv_sge > uk_attrs->max_hw_wq_frags || + init_attr->cap.max_send_wr > uk_attrs->max_hw_wq_quanta || + init_attr->cap.max_recv_wr > uk_attrs->max_hw_rq_quanta)return -EINVAL ;if (rdma_protocol_roce (&iwdev->ibdev,1 )) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 205/245 RDMA/irdma: Set the CQ read threshold for GEN 1
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mustafa Ismail <[email protected]>
[ Upstream commit 666047f3ece9f991774c1fe9b223139a9ef8908d ]
The CQ shadow read threshold is currently not set for GEN 2. This could cause an invalid CQ overflow condition, so remove the GEN check that exclused GEN 1.
--- drivers/infiniband/hw/irdma/verbs.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/infiniband/hw/irdma/verbs.c +2 -3
@@ -2076,9 +2076,8 @@ static int irdma_create_cq(struct ib_cq *ibcq, info.cq_base_pa = iwcq->kmem.pa; } -if (dev->hw_attrs.uk_attrs.hw_rev >=IRDMA_GEN_2 ) - info.shadow_read_threshold =min (info.cq_uk_init_info.cq_size /2 , - (u32 )IRDMA_MAX_CQ_READ_THRESH ); + info.shadow_read_threshold =min (info.cq_uk_init_info.cq_size /2 , + (u32 )IRDMA_MAX_CQ_READ_THRESH );if (irdma_sc_cq_init (cq, &info)) {ibdev_dbg (&iwdev->ibdev,"VERBS: init cq fail\n" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 206/245 RDMA/irdma: Add AE for too many RNRS
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mustafa Ismail <[email protected]>
[ Upstream commit 630bdb6f28ca9e5ff79e244030170ac788478332 ]
Add IRDMA_AE_LLP_TOO_MANY_RNRS to the list of AE's processed as an abnormal asyncronous event.
--- drivers/infiniband/hw/irdma/defs.h | 1 + drivers/infiniband/hw/irdma/hw.c | 1 + 2 files changed, 2 insertions(+)
drivers/infiniband/hw/irdma/defs.h +1 -0
@@ -345,6 +345,7 @@ enum irdma_cqp_op_type {#define IRDMA_AE_LLP_TOO_MANY_KEEPALIVE_RETRIES 0x050b#define IRDMA_AE_LLP_DOUBT_REACHABILITY 0x050c#define IRDMA_AE_LLP_CONNECTION_ESTABLISHED 0x050e +#define IRDMA_AE_LLP_TOO_MANY_RNRS 0x050f#define IRDMA_AE_RESOURCE_EXHAUSTION 0x0520#define IRDMA_AE_RESET_SENT 0x0601#define IRDMA_AE_TERMINATE_SENT 0x0602
drivers/infiniband/hw/irdma/hw.c +1 -0
@@ -379,6 +379,7 @@ static void irdma_process_aeq(struct irdma_pci_f *rf)case IRDMA_AE_LLP_TOO_MANY_RETRIES :case IRDMA_AE_LCE_QP_CATASTROPHIC :case IRDMA_AE_LCE_FUNCTION_CATASTROPHIC : +case IRDMA_AE_LLP_TOO_MANY_RNRS :case IRDMA_AE_LCE_CQ_CATASTROPHIC :case IRDMA_AE_UDA_XMIT_DGRAM_TOO_LONG :default :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 207/245 RDMA/srpt: Support specifying the srpt_service_guid parameter
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
[ Upstream commit fdfa083549de5d50ebf7f6811f33757781e838c0 ]
Make loading ib_srpt with this parameter set work. The current behavior is that setting that parameter while loading the ib_srpt kernel module triggers the following kernel crash:
BUG: kernel NULL pointer dereference, address: 0000000000000000 Call Trace: <TASK> parse_one+0x18c/0x1d0 parse_args+0xe1/0x230 load_module+0x8de/0xa60 init_module_from_file+0x8b/0xd0 idempotent_init_module+0x181/0x240 __x64_sys_finit_module+0x5a/0xb0 do_syscall_64+0x5f/0xe0 entry_SYSCALL_64_after_hwframe+0x6e/0x76
--- drivers/infiniband/ulp/srpt/ib_srpt.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/infiniband/ulp/srpt/ib_srpt.c +6 -2
@@ -79,12 +79,16 @@ module_param(srpt_srq_size, int, 0444);MODULE_PARM_DESC (srpt_srq_size,"Shared receive queue (SRQ) size." ); +static int srpt_set_u64_x (const char *buffer,const struct kernel_param *kp) +{ +return kstrtou64 (buffer,16 , (u64 *)kp->arg); +}static int srpt_get_u64_x (char *buffer,const struct kernel_param *kp) {return sprintf (buffer,"0x%016llx\n" , *(u64 *)kp->arg); } -module_param_call (srpt_service_guid,NULL , srpt_get_u64_x, &srpt_service_guid, -0444 ); +module_param_call (srpt_service_guid, srpt_set_u64_x, srpt_get_u64_x, + &srpt_service_guid,0444 );MODULE_PARM_DESC (srpt_service_guid,"Using this value for ioc_guid, id_ext, and cm_listen_id instead of using the node_guid of the first HCA." );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 208/245 RDMA/qedr: Fix qedr_create_user_qp error flow
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kamal Heib <[email protected]>
[ Upstream commit 5ba4e6d5863c53e937f49932dee0ecb004c65928 ]
Avoid the following warning by making sure to free the allocated resources in case that qedr_init_user_queue() fail.
-----------[ cut here ]-----------
WARNING: CPU: 0 PID: 143192 at drivers/infiniband/core/rdma_core.c:874 uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs] Modules linked in: tls target_core_user uio target_core_pscsi target_core_file target_core_iblock ib_srpt ib_srp scsi_transport_srp nfsd nfs_acl rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs 8021q garp mrp stp llc ext4 mbcache jbd2 opa_vnic ib_umad ib_ipoib sunrpc rdma_ucm ib_isert iscsi_target_mod target_core_mod ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm hfi1 intel_rapl_msr intel_rapl_common mgag200 qedr sb_edac drm_shmem_helper rdmavt x86_pkg_temp_thermal drm_kms_helper intel_powerclamp ib_uverbs coretemp i2c_algo_bit kvm_intel dell_wmi_descriptor ipmi_ssif sparse_keymap kvm ib_core rfkill syscopyarea sysfillrect video sysimgblt irqbypass ipmi_si ipmi_devintf fb_sys_fops rapl iTCO_wdt mxm_wmi iTCO_vendor_support intel_cstate pcspkr dcdbas intel_uncore ipmi_msghandler lpc_ich acpi_power_meter mei_me mei fuse drm xfs libcrc32c qede sd_mod ahci libahci t10_pi sg crct10dif_pclmul crc32_pclmul crc32c_intel qed libata tg3 ghash_clmulni_intel megaraid_sas crc8 wmi [last unloaded: ib_srpt] CPU: 0 PID: 143192 Comm: fi_rdm_tagged_p Kdump: loaded Not tainted 5.14.0-408.el9.x86_64 #1 Hardware name: Dell Inc. PowerEdge R430/03XKDV, BIOS 2.14.0 01/25/2022 RIP: 0010:uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs] Code: 5d 41 5c 41 5d 41 5e e9 0f 26 1b dd 48 89 df e8 67 6a ff ff 49 8b 86 10 01 00 00 48 85 c0 74 9c 4c 89 e7 e8 83 c0 cb dd eb 92 <0f> 0b eb be 0f 0b be 04 00 00 00 48 89 df e8 8e f5 ff ff e9 6d ff RSP: 0018:ffffb7c6cadfbc60 EFLAGS: 00010286 RAX: ffff8f0889ee3f60 RBX: ffff8f088c1a5200 RCX: 00000000802a0016 RDX: 00000000802a0017 RSI: 0000000000000001 RDI: ffff8f0880042600 RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000 R10: ffff8f11fffd5000 R11: 0000000000039000 R12: ffff8f0d5b36cd80 R13: ffff8f088c1a5250 R14: ffff8f1206d91000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8f11d7c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000147069200e20 CR3: 00000001c7210002 CR4: 00000000001706f0 Call Trace: <TASK> ? show_trace_log_lvl+0x1c4/0x2df ? show_trace_log_lvl+0x1c4/0x2df ? ib_uverbs_close+0x1f/0xb0 [ib_uverbs] ? uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs] ? __warn+0x81/0x110 ? uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs] ? report_bug+0x10a/0x140 ? handle_bug+0x3c/0x70 ? exc_invalid_op+0x14/0x70 ? asm_exc_invalid_op+0x16/0x20 ? uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs] ib_uverbs_close+0x1f/0xb0 [ib_uverbs] __fput+0x94/0x250 task_work_run+0x5c/0x90 do_exit+0x270/0x4a0 do_group_exit+0x2d/0x90 get_signal+0x87c/0x8c0 arch_do_signal_or_restart+0x25/0x100 ? ib_uverbs_ioctl+0xc2/0x110 [ib_uverbs] exit_to_user_mode_loop+0x9c/0x130 exit_to_user_mode_prepare+0xb6/0x100 syscall_exit_to_user_mode+0x12/0x40 do_syscall_64+0x69/0x90 ? syscall_exit_work+0x103/0x130 ? syscall_exit_to_user_mode+0x22/0x40 ? do_syscall_64+0x69/0x90 ? syscall_exit_work+0x103/0x130 ? syscall_exit_to_user_mode+0x22/0x40 ? do_syscall_64+0x69/0x90 ? do_syscall_64+0x69/0x90 ? common_interrupt+0x43/0xa0 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x1470abe3ec6b Code: Unable to access opcode bytes at RIP 0x1470abe3ec41. RSP: 002b:00007fff13ce9108 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: fffffffffffffffc RBX: 00007fff13ce9218 RCX: 00001470abe3ec6b RDX: 00007fff13ce9200 RSI: 00000000c0181b01 RDI: 0000000000000004 RBP: 00007fff13ce91e0 R08: 0000558d9655da10 R09: 0000558d9655dd00 R10: 00007fff13ce95c0 R11: 0000000000000246 R12: 00007fff13ce9358 R13: 0000000000000013 R14: 0000558d9655db50 R15: 00007fff13ce9470 </TASK>
--[ end trace 888a9b92e04c5c97 ]--
--- drivers/infiniband/hw/qedr/verbs.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
drivers/infiniband/hw/qedr/verbs.c +10 -1
@@ -1888,8 +1888,17 @@ static int qedr_create_user_qp(struct qedr_dev *dev,/* RQ - read access only (0) */ rc =qedr_init_user_queue (udata, dev, &qp->urq, ureq.rq_addr, ureq.rq_len, true,0 , alloc_and_init); -if (rc) +if (rc) { +ib_umem_release (qp->usq.umem); + qp->usq.umem =NULL ; +if (rdma_protocol_roce (&dev->ibdev,1 )) { +qedr_free_pbl (dev, &qp->usq.pbl_info, + qp->usq.pbl_tbl); + }else { +kfree (qp->usq.pbl_tbl); + }return rc; + } }memset (&in_params,0 ,sizeof (in_params));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 209/245 arm64: dts: rockchip: set num-cs property for spi on px30
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Stuebner <[email protected]>
[ Upstream commit 334bf0710c98d391f4067b72f535d6c4c84dfb6f ]
The px30 has two spi controllers with two chip-selects each. The num-cs property is specified as the total number of chip selects a controllers has and is used since 2020 to find uses of chipselects outside that range in the Rockchip spi driver.
Without the property set, the default is 1, so spi devices using the second chipselect will not be created.
--- arch/arm64/boot/dts/rockchip/px30.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/boot/dts/rockchip/px30.dtsi +2 -0
@@ -585,6 +585,7 @@ clock-names = "spiclk", "apb_pclk"; dmas = <&dmac 12>, <&dmac 13>; dma-names = "tx", "rx"; + num-cs = <2>; pinctrl-names = "default"; pinctrl-0 = <&spi0_clk &spi0_csn &spi0_miso &spi0_mosi>; #address-cells = <1>;
@@ -600,6 +601,7 @@ clock-names = "spiclk", "apb_pclk"; dmas = <&dmac 14>, <&dmac 15>; dma-names = "tx", "rx"; + num-cs = <2>; pinctrl-names = "default"; pinctrl-0 = <&spi1_clk &spi1_csn0 &spi1_csn1 &spi1_miso &spi1_mosi>; #address-cells = <1>;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 210/245 RDMA/srpt: fix function pointer cast warnings
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit eb5c7465c3240151cd42a55c7ace9da0026308a1 ]
clang-16 notices that srpt_qp_event() gets called through an incompatible pointer here:
drivers/infiniband/ulp/srpt/ib_srpt.c:1815:5: error: cast from 'void (*)(struct ib_event *, struct srpt_rdma_ch *)' to 'void (*)(struct ib_event *, void *)' converts to incompatible function type [-Werror,-Wcast-function-type-strict]
1815 | = (void(*)(struct ib_event *, void*))srpt_qp_event;
Change srpt_qp_event() to use the correct prototype and adjust the argument inside of it.
--- drivers/infiniband/ulp/srpt/ib_srpt.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/infiniband/ulp/srpt/ib_srpt.c +5 -4
@@ -214,10 +214,12 @@ static const char *get_ch_state_name(enum rdma_ch_state s)/** * srpt_qp_event - QP event callback function * @event: Description of the event that occurred. -* @ch: SRPT RDMA channel. +* @ptr: SRPT RDMA channel. */ -static void srpt_qp_event (struct ib_event *event,struct srpt_rdma_ch *ch) +static void srpt_qp_event (struct ib_event *event,void *ptr) { +struct srpt_rdma_ch *ch = ptr; +pr_debug ("QP event %d on ch=%p sess_name=%s-%d state=%s\n" , event->event, ch, ch->sess_name, ch->qp->qp_num,get_ch_state_name (ch->state));
@@ -1811,8 +1813,7 @@ static int srpt_create_ch_ib(struct srpt_rdma_ch *ch) ch->cq_size = ch->rq_size + sq_size; qp_init->qp_context = (void *)ch; - qp_init->event_handler - = (void (*)(struct ib_event *,void *))srpt_qp_event; + qp_init->event_handler = srpt_qp_event; qp_init->send_cq = ch->cq; qp_init->recv_cq = ch->cq; qp_init->sq_sig_type =IB_SIGNAL_REQ_WR ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 211/245 bpf, scripts: Correct GPL license name
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gianmarco Lusvardi <[email protected]>
[ Upstream commit e37243b65d528a8a9f8b9a57a43885f8e8dfc15c ]
The bpf_doc script refers to the GPL as the "GNU Privacy License". I strongly suspect that the author wanted to refer to the GNU General Public License, under which the Linux kernel is released, as, to the best of my knowledge, there is no license named "GNU Privacy License". This patch corrects the license name in the script accordingly.
--- scripts/bpf_doc.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
scripts/bpf_doc.py +1 -1
@@ -369,7 +369,7 @@ eBPF programs can have an associated license, passed along with the bytecode instructions to the kernel when the programs are loaded. The format for that string is identical to the one in use for kernel modules (Dual licenses, such as "Dual BSD/GPL", may be used). Some helper functions are only accessible to -programs that are compatible with the GNU Privacy License (GPL). +programs that are compatible with the GNU General Public License (GNU GPL). In order to use such helpers, the eBPF program must be loaded with the correct license string passed (via **attr**) to the **bpf**\ () system call, and this
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 212/245 scsi: jazz_esp: Only build if SCSI core is builtin
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <[email protected]>
[ Upstream commit 9ddf190a7df77b77817f955fdb9c2ae9d1c9c9a3 ]
JAZZ_ESP is a bool kconfig symbol that selects SCSI_SPI_ATTRS. When CONFIG_SCSI=m, this results in SCSI_SPI_ATTRS=m while JAZZ_ESP=y, which causes many undefined symbol linker errors.
Fix this by only offering to build this driver when CONFIG_SCSI=y.
[mkp: JAZZ_ESP is unique in that it does not support being compiled as a module unlike the remaining SPI SCSI HBA drivers]
--- drivers/scsi/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/Kconfig +1 -1
@@ -1296,7 +1296,7 @@ source "drivers/scsi/arm/Kconfig" config JAZZ_ESP bool "MIPS JAZZ FAS216 SCSI support" - depends on MACH_JAZZ && SCSI + depends on MACH_JAZZ && SCSI=y select SCSI_SPI_ATTRS help This is the driver for the onboard SCSI host adapter of MIPS Magnum
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 213/245 nouveau: fix function cast warnings
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 0affdba22aca5573f9d989bcb1d71d32a6a03efe ]
clang-16 warns about casting between incompatible function types:
drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c:161:10: error: cast from 'void (*)(const struct firmware *)' to 'void (*)(void *)' converts to incompatible function type [-Werror,-Wcast-function-type-strict]
161 | .fini = (void(*)(void *))release_firmware,
This one was done to use the generic shadow_fw_release() function as a callback for struct nvbios_source. Change it to use the same prototype as the other five instances, with a trivial helper function that actually calls release_firmware.
--- drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c +7 -1
@@ -154,11 +154,17 @@ shadow_fw_init(struct nvkm_bios *bios, const char *name)return (void *)fw; } +static void +shadow_fw_release (void *fw) +{ +release_firmware (fw); +} +static const struct nvbios_source shadow_fw = { .name ="firmware" , .init = shadow_fw_init, - .fini = (void (*)(void *))release_firmware, + .fini = shadow_fw_release, .read = shadow_fw_read, .rw = false, };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 214/245 net: stmmac: Fix incorrect dereference in interrupt handlers
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Sakharov <[email protected]>
[ Upstream commit 97dde84026339e4b4af9a6301f825d1828d7874b ]
If 'dev' or 'data' is NULL, the 'priv' variable has an incorrect address when dereferencing calling netdev_err().
Since we get as 'dev_id' or 'data' what was passed as the 'dev' argument to request_irq() during interrupt initialization (that is, the net_device and rx/tx queue pointers initialized at the time of the call) and since there are usually no checks for the 'dev_id' argument in such handlers in other drivers, remove these checks from the handlers in stmmac driver.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- .../net/ethernet/stmicro/stmmac/stmmac_main.c | 20 ------------------- 1 file changed, 20 deletions(-)
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +0 -20
@@ -5737,11 +5737,6 @@ static irqreturn_t stmmac_mac_interrupt(int irq, void *dev_id)struct net_device *dev = (struct net_device *)dev_id;struct stmmac_priv *priv =netdev_priv (dev); -if (unlikely (!dev)) { -netdev_err (priv->dev,"%s: invalid dev pointer\n" , __func__); -return IRQ_NONE ; - } -/* Check if adapter is up */ if (test_bit (STMMAC_DOWN , &priv->state))return IRQ_HANDLED ;
@@ -5757,11 +5752,6 @@ static irqreturn_t stmmac_safety_interrupt(int irq, void *dev_id)struct net_device *dev = (struct net_device *)dev_id;struct stmmac_priv *priv =netdev_priv (dev); -if (unlikely (!dev)) { -netdev_err (priv->dev,"%s: invalid dev pointer\n" , __func__); -return IRQ_NONE ; - } -/* Check if adapter is up */ if (test_bit (STMMAC_DOWN , &priv->state))return IRQ_HANDLED ;
@@ -5781,11 +5771,6 @@ static irqreturn_t stmmac_msi_intr_tx(int irq, void *data) priv = container_of(tx_q, struct stmmac_priv, tx_queue[chan]); -if (unlikely (!data)) { -netdev_err (priv->dev,"%s: invalid dev pointer\n" , __func__); -return IRQ_NONE ; - } -/* Check if adapter is up */ if (test_bit (STMMAC_DOWN , &priv->state))return IRQ_HANDLED ;
@@ -5824,11 +5809,6 @@ static irqreturn_t stmmac_msi_intr_rx(int irq, void *data) priv = container_of(rx_q, struct stmmac_priv, rx_queue[chan]); -if (unlikely (!data)) { -netdev_err (priv->dev,"%s: invalid dev pointer\n" , __func__); -return IRQ_NONE ; - } -/* Check if adapter is up */ if (test_bit (STMMAC_DOWN , &priv->state))return IRQ_HANDLED ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 215/245 ipv4: properly combine dev_base_seq and ipv4.dev_addr_genid
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 081a0e3b0d4c061419d3f4679dec9f68725b17e4 ]
net->dev_base_seq and ipv4.dev_addr_genid are monotonically increasing.
If we XOR their values, we could miss to detect if both values were changed with the same amount.
--- net/ipv4/devinet.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-)
net/ipv4/devinet.c +17 -4
@@ -1797,6 +1797,21 @@ static int in_dev_dump_addr(struct in_device *in_dev, struct sk_buff *skb,return err; } +/* Combine dev_addr_genid and dev_base_seq to detect changes. +*/ +static u32 inet_base_seq (const struct net *net) +{ +u32 res =atomic_read (&net->ipv4.dev_addr_genid) + + net->dev_base_seq; + +/* Must not return 0 (see nl_dump_check_consistent()). +* Chose a value far away from 0. +*/ +if (!res) + res =0x80000000 ; +return res; +} +static int inet_dump_ifaddr (struct sk_buff *skb,struct netlink_callback *cb) {const struct nlmsghdr *nlh = cb->nlh;
@@ -1848,8 +1863,7 @@ static int inet_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb) idx =0 ; head = &tgt_net->dev_index_head[h];rcu_read_lock (); - cb->seq =atomic_read (&tgt_net->ipv4.dev_addr_genid) ^ - tgt_net->dev_base_seq; + cb->seq =inet_base_seq (tgt_net);hlist_for_each_entry_rcu (dev, head, index_hlist) {if (idx < s_idx) goto cont;
@@ -2250,8 +2264,7 @@ static int inet_netconf_dump_devconf(struct sk_buff *skb, idx =0 ; head = &net->dev_index_head[h];rcu_read_lock (); - cb->seq =atomic_read (&net->ipv4.dev_addr_genid) ^ - net->dev_base_seq; + cb->seq =inet_base_seq (net);hlist_for_each_entry_rcu (dev, head, index_hlist) {if (idx < s_idx) goto cont;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 216/245 ipv6: properly combine dev_base_seq and ipv6.dev_addr_genid
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit e898e4cd1aab271ca414f9ac6e08e4c761f6913c ]
net->dev_base_seq and ipv6.dev_addr_genid are monotonically increasing.
If we XOR their values, we could miss to detect if both values were changed with the same amount.
--- net/ipv6/addrconf.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-)
net/ipv6/addrconf.c +18 -3
@@ -707,6 +707,22 @@ static int inet6_netconf_get_devconf(struct sk_buff *in_skb,return err; } +/* Combine dev_addr_genid and dev_base_seq to detect changes. +*/ +static u32 inet6_base_seq (const struct net *net) +{ +u32 res =atomic_read (&net->ipv6.dev_addr_genid) + + net->dev_base_seq; + +/* Must not return 0 (see nl_dump_check_consistent()). +* Chose a value far away from 0. +*/ +if (!res) + res =0x80000000 ; +return res; +} + +static int inet6_netconf_dump_devconf (struct sk_buff *skb,struct netlink_callback *cb) {
@@ -740,8 +756,7 @@ static int inet6_netconf_dump_devconf(struct sk_buff *skb, idx =0 ; head = &net->dev_index_head[h];rcu_read_lock (); - cb->seq =atomic_read (&net->ipv6.dev_addr_genid) ^ - net->dev_base_seq; + cb->seq =inet6_base_seq (net);hlist_for_each_entry_rcu (dev, head, index_hlist) {if (idx < s_idx) goto cont;
@@ -5316,7 +5331,7 @@ static int inet6_dump_addr(struct sk_buff *skb, struct netlink_callback *cb, }rcu_read_lock (); - cb->seq =atomic_read (&tgt_net->ipv6.dev_addr_genid) ^ tgt_net->dev_base_seq; + cb->seq =inet6_base_seq (tgt_net);for (h = s_h; h <NETDEV_HASHENTRIES ; h++, s_idx =0 ) { idx =0 ; head = &tgt_net->dev_index_head[h];
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 217/245 ata: libahci_platform: Convert to using devm bulk clocks API
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Serge Semin <[email protected]>
[ Upstream commit e28b3abf8020a884bd3b7758ea8915365af8fadf ]
In order to simplify the clock-related code there is a way to convert the current fixed clocks array into using the common bulk clocks kernel API with dynamic set of the clock handlers and device-managed clock-resource tracking. It's a bit tricky due to the complication coming from the requirement to support the platforms (da850, spear13xx) with the non-OF-based clock source, but still doable.
Before this modification there are two methods have been used to get the clocks connected to an AHCI device: clk_get() - to get the very first clock in the list and of_clk_get() - to get the rest of them. Basically the platforms with non-OF-based clocks definition could specify only a single reference clock source. The platforms with OF-hw clocks have been luckier and could setup up to AHCI_MAX_CLKS clocks. Such semantic can be retained with using devm_clk_bulk_get_all() to retrieve the clocks defined via the DT firmware and devm_clk_get_optional() otherwise. In both cases using the device-managed version of the methods will cause the automatic resources deallocation on the AHCI device removal event. The only complicated part in the suggested approach is the explicit allocation and initialization of the clk_bulk_data structure instance for the non-OF reference clocks. It's required in order to use the Bulk Clocks API for the both denoted cases of the clocks definition.
Note aside with the clock-related code reduction and natural simplification, there are several bonuses the suggested modification provides. First of all the limitation of having no greater than AHCI_MAX_CLKS clocks is now removed, since the devm_clk_bulk_get_all() method will allocate as many reference clocks data descriptors as there are clocks specified for the device. Secondly the clock names are auto-detected. So the LLDD (glue) drivers can make sure that the required clocks are specified just by checking the clock IDs in the clk_bulk_data array. Thirdly using the handy Bulk Clocks kernel API improves the clocks-handling code readability. And the last but not least this modification implements a true optional clocks support to the ahci_platform_get_resources() method. Indeed the previous clocks getting procedure just stopped getting the clocks on any errors (aside from non-critical -EPROBE_DEFER) in a way so the callee wasn't even informed about abnormal loop termination. The new implementation lacks of such problem. The ahci_platform_get_resources() will return an error code if the corresponding clocks getting method ends execution abnormally.
Stable-dep-of: 26c8404e162b ("ata: ahci_ceva: fix error handling for Xilinx GT PHY support")
--- drivers/ata/ahci.h | 4 +- drivers/ata/ahci_da850.c | 47 ++++++++----------- drivers/ata/ahci_dm816.c | 4 +- drivers/ata/libahci_platform.c | 83 ++++++++++++++++------------------ 4 files changed, 61 insertions(+), 77 deletions(-)
drivers/ata/ahci.h +2 -2
@@ -39,7 +39,6 @@enum {AHCI_MAX_PORTS =32 , -AHCI_MAX_CLKS =5 ,AHCI_MAX_SG =168 ,/* hardware max is 64K */ AHCI_DMA_BOUNDARY =0xffffffff ,AHCI_MAX_CMDS =32 ,
@@ -343,7 +342,8 @@ struct ahci_host_priv {u32 em_msg_type;/* EM message type */ u32 remapped_nvme;/* NVMe remapped device count */ bool got_runtime_pm;/* Did we do pm_runtime_get? */ -struct clk *clks[AHCI_MAX_CLKS ];/* Optional */ +unsigned int n_clks; +struct clk_bulk_data *clks;/* Optional */ struct reset_control *rsts;/* Optional */ struct regulator **target_pwrs;/* Optional */ struct regulator *ahci_regulator;/* Optional */
drivers/ata/ahci_da850.c +19 -28
62 lines not on this page · raw message
drivers/ata/ahci_dm816.c +2 -2
@@ -69,12 +69,12 @@ static int ahci_dm816_phy_init(struct ahci_host_priv *hpriv, struct device *dev)* keep-alive clock and the external reference clock. We need the * rate of the latter to calculate the correct value of MPY bits. */ -if (!hpriv->clks[1 ]) { +if (hpriv->n_clks <2 ) {dev_err (dev,"reference clock not supplied\n" );return -EINVAL ; } - refclk_rate =clk_get_rate (hpriv->clks[1 ]); + refclk_rate =clk_get_rate (hpriv->clks[1 ].clk);if ((refclk_rate %100 ) !=0 ) {dev_err (dev,"reference clock rate must be divisible by 100\n" );return -EINVAL ;
drivers/ata/libahci_platform.c +38 -45
134 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 218/245 ata: libahci_platform: Introduce reset assertion/deassertion methods
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Serge Semin <[email protected]>
[ Upstream commit f67f12ff57bcfcd7d64280f748787793217faeaf ]
Currently the ACHI-platform library supports only the assert and deassert reset signals and ignores the platforms with self-deasserting reset lines. That prone to having the platforms with self-deasserting reset method misbehaviour when it comes to resuming from sleep state after the clocks have been fully disabled. For such cases the controller needs to be fully reset all over after the reference clocks are enabled and stable, otherwise the controller state machine might be in an undetermined state.
The best solution would be to auto-detect which reset method is supported by the particular platform and use it implicitly in the framework of the ahci_platform_enable_resources()/ahci_platform_disable_resources() methods. Alas it can't be implemented due to the AHCI-platform library already supporting the shared reset control lines. As [1] says in such case we have to use only one of the next methods:
+ reset_control_assert()/reset_control_deassert();
+ reset_control_reset()/reset_control_rearm().
If the driver had an exclusive control over the reset lines we could have been able to manipulate the lines with no much limitation and just used the combination of the methods above to cover all the possible reset-control cases. Since the shared reset control has already been advertised and couldn't be changed with no risk to breaking the platforms relying on it, we have no choice but to make the platform drivers to determine which reset methods the platform reset system supports.
In order to implement both types of reset control support we suggest to introduce the new AHCI-platform flag: AHCI_PLATFORM_RST_TRIGGER, which when passed to the ahci_platform_get_resources() method together with the AHCI_PLATFORM_GET_RESETS flag will indicate that the reset lines are self-deasserting thus the reset_control_reset()/reset_control_rearm() will be used to control the reset state. Otherwise the reset_control_deassert()/reset_control_assert() methods will be utilized.
[1] Documentation/driver-api/reset.rst
Stable-dep-of: 26c8404e162b ("ata: ahci_ceva: fix error handling for Xilinx GT PHY support")
--- drivers/ata/ahci.h | 1 + drivers/ata/libahci_platform.c | 50 ++++++++++++++++++++++++++++++---- include/linux/ahci_platform.h | 5 +++- 3 files changed, 50 insertions(+), 6 deletions(-)
drivers/ata/ahci.h +1 -0
@@ -344,6 +344,7 @@ struct ahci_host_priv {bool got_runtime_pm;/* Did we do pm_runtime_get? */ unsigned int n_clks;struct clk_bulk_data *clks;/* Optional */ +unsigned int f_rsts;struct reset_control *rsts;/* Optional */ struct regulator **target_pwrs;/* Optional */ struct regulator *ahci_regulator;/* Optional */
drivers/ata/libahci_platform.c +45 -5
82 lines not on this page · raw message
include/linux/ahci_platform.h +4 -1
@@ -23,6 +23,8 @@ int ahci_platform_enable_phys(struct ahci_host_priv *hpriv);void ahci_platform_disable_phys (struct ahci_host_priv *hpriv);int ahci_platform_enable_clks (struct ahci_host_priv *hpriv);void ahci_platform_disable_clks (struct ahci_host_priv *hpriv); +int ahci_platform_deassert_rsts (struct ahci_host_priv *hpriv); +int ahci_platform_assert_rsts (struct ahci_host_priv *hpriv);int ahci_platform_enable_regulators (struct ahci_host_priv *hpriv);void ahci_platform_disable_regulators (struct ahci_host_priv *hpriv);int ahci_platform_enable_resources (struct ahci_host_priv *hpriv);
@@ -41,6 +43,7 @@ int ahci_platform_resume_host(struct device *dev);int ahci_platform_suspend (struct device *dev);int ahci_platform_resume (struct device *dev); -#define AHCI_PLATFORM_GET_RESETS 0x01 +#define AHCI_PLATFORM_GET_RESETS BIT(0) +#define AHCI_PLATFORM_RST_TRIGGER BIT(1)#endif /* _AHCI_PLATFORM_H */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 219/245 ata: ahci_ceva: fix error handling for Xilinx GT PHY support
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Radhey Shyam Pandey <[email protected]>
[ Upstream commit 26c8404e162b43dddcb037ba2d0cb58c0ed60aab ]
Platform clock and phy error resources are not cleaned up in Xilinx GT PHY error path.
To fix introduce the function ceva_ahci_platform_enable_resources() which is a customized version of ahci_platform_enable_resources() and inline with SATA IP programming sequence it does:
- Assert SATA reset
- Program PS GTR phy
- Bring SATA by de-asserting the reset
- Wait for GT lane PLL to be locked
ceva_ahci_platform_enable_resources() is also used in the resume path as the same SATA programming sequence (as in probe) should be followed. Also cleanup the mixed usage of ahci_platform_enable_resources() and custom implementation in the probe function as both are not required.
--- drivers/ata/ahci_ceva.c | 125 +++++++++++++++++++++++++--------------- 1 file changed, 79 insertions(+), 46 deletions(-)
drivers/ata/ahci_ceva.c +79 -46
@@ -88,7 +88,6 @@ struct ceva_ahci_priv {u32 axicc;bool is_cci_enabled;int flags; -struct reset_control *rst; }; static unsigned int ceva_ahci_read_id(struct ata_device *dev,
@@ -189,6 +188,60 @@ static struct scsi_host_template ahci_platform_sht = { AHCI_SHT(DRV_NAME), }; +static int ceva_ahci_platform_enable_resources (struct ahci_host_priv *hpriv) +{ +int rc, i; + + rc =ahci_platform_enable_regulators (hpriv); +if (rc) +return rc; + + rc =ahci_platform_enable_clks (hpriv); +if (rc) + goto disable_regulator; + +/* Assert the controller reset */ + rc =ahci_platform_assert_rsts (hpriv); +if (rc) + goto disable_clks; + +for (i =0 ; i < hpriv->nports; i++) { + rc =phy_init (hpriv->phys[i]); +if (rc) + goto disable_rsts; + } + +/* De-assert the controller reset */ +ahci_platform_deassert_rsts (hpriv); + +for (i =0 ; i < hpriv->nports; i++) { + rc =phy_power_on (hpriv->phys[i]); +if (rc) { +phy_exit (hpriv->phys[i]); + goto disable_phys; + } + } + +return 0 ; + +disable_rsts: +ahci_platform_deassert_rsts (hpriv); + +disable_phys: +while (--i >=0 ) { +phy_power_off (hpriv->phys[i]); +phy_exit (hpriv->phys[i]); + } + +disable_clks: +ahci_platform_disable_clks (hpriv); + +disable_regulator: +ahci_platform_disable_regulators (hpriv); + +return rc; +} +static int ceva_ahci_probe (struct platform_device *pdev) {struct device_node *np = pdev->dev.of_node;
@@ -203,47 +256,19 @@ static int ceva_ahci_probe(struct platform_device *pdev)return -ENOMEM ; cevapriv->ahci_pdev = pdev; - - cevapriv->rst =devm_reset_control_get_optional_exclusive (&pdev->dev, -NULL ); -if (IS_ERR (cevapriv->rst)) -dev_err_probe (&pdev->dev,PTR_ERR (cevapriv->rst), -"failed to get reset\n" ); - hpriv =ahci_platform_get_resources (pdev,0 );if (IS_ERR (hpriv))return PTR_ERR (hpriv); -if (!cevapriv->rst) { - rc =ahci_platform_enable_resources (hpriv); -if (rc) -return rc; - }else { -int i; + hpriv->rsts =devm_reset_control_get_optional_exclusive (&pdev->dev, +NULL ); +if (IS_ERR (hpriv->rsts)) +return dev_err_probe (&pdev->dev,PTR_ERR (hpriv->rsts), +"failed to get reset\n" ); - rc =ahci_platform_enable_clks (hpriv); -if (rc) -return rc; -/* Assert the controller reset */ -reset_control_assert (cevapriv->rst); - -for (i =0 ; i < hpriv->nports; i++) { - rc =phy_init (hpriv->phys[i]); -if (rc) -return rc; - } - -/* De-assert the controller reset */ -reset_control_deassert (cevapriv->rst); - -for (i =0 ; i < hpriv->nports; i++) { - rc =phy_power_on (hpriv->phys[i]); -if (rc) { -phy_exit (hpriv->phys[i]); -return rc; - } - } - } + rc =ceva_ahci_platform_enable_resources (hpriv); +if (rc) +return rc;if (of_property_read_bool (np,"ceva,broken-gen2" )) cevapriv->flags =CEVA_FLAG_BROKEN_GEN2 ;
@@ -252,52 +277,60 @@ static int ceva_ahci_probe(struct platform_device *pdev)if (of_property_read_u8_array (np,"ceva,p0-cominit-params" , (u8 *)&cevapriv->pp2c[0 ],4 ) <0 ) {dev_warn (dev,"ceva,p0-cominit-params property not defined\n" ); -return -EINVAL ; + rc = -EINVAL ; + goto disable_resources; }if (of_property_read_u8_array (np,"ceva,p1-cominit-params" , (u8 *)&cevapriv->pp2c[1 ],4 ) <0 ) {dev_warn (dev,"ceva,p1-cominit-params property not defined\n" ); -return -EINVAL ; + rc = -EINVAL ; + goto disable_resources; }/* Read OOB timing value for COMWAKE from device-tree*/ if (of_property_read_u8_array (np,"ceva,p0-comwake-params" , (u8 *)&cevapriv->pp3c[0 ],4 ) <0 ) {dev_warn (dev,"ceva,p0-comwake-params property not defined\n" ); -return -EINVAL ; + rc = -EINVAL ; + goto disable_resources; }if (of_property_read_u8_array (np,"ceva,p1-comwake-params" , (u8 *)&cevapriv->pp3c[1 ],4 ) <0 ) {dev_warn (dev,"ceva,p1-comwake-params property not defined\n" ); -return -EINVAL ; + rc = -EINVAL ; + goto disable_resources; }/* Read phy BURST timing value from device-tree */ if (of_property_read_u8_array (np,"ceva,p0-burst-params" , (u8 *)&cevapriv->pp4c[0 ],4 ) <0 ) {dev_warn (dev,"ceva,p0-burst-params property not defined\n" ); -return -EINVAL ; + rc = -EINVAL ; + goto disable_resources; }if (of_property_read_u8_array (np,"ceva,p1-burst-params" , (u8 *)&cevapriv->pp4c[1 ],4 ) <0 ) {dev_warn (dev,"ceva,p1-burst-params property not defined\n" ); -return -EINVAL ; + rc = -EINVAL ; + goto disable_resources; }/* Read phy RETRY interval timing value from device-tree */ if (of_property_read_u16_array (np,"ceva,p0-retry-params" , (u16 *)&cevapriv->pp5c[0 ],2 ) <0 ) {dev_warn (dev,"ceva,p0-retry-params property not defined\n" ); -return -EINVAL ; + rc = -EINVAL ; + goto disable_resources; }if (of_property_read_u16_array (np,"ceva,p1-retry-params" , (u16 *)&cevapriv->pp5c[1 ],2 ) <0 ) {dev_warn (dev,"ceva,p1-retry-params property not defined\n" ); -return -EINVAL ; + rc = -EINVAL ; + goto disable_resources; }/*
@@ -335,7 +368,7 @@ static int __maybe_unused ceva_ahci_resume(struct device *dev)struct ahci_host_priv *hpriv = host->private_data;int rc; - rc =ahci_platform_enable_resources (hpriv); + rc =ceva_ahci_platform_enable_resources (hpriv);if (rc)return rc;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 220/245 bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin KaFai Lau <[email protected]>
[ Upstream commit 0281b919e175bb9c3128bd3872ac2903e9436e3f ]
The following race is possible between bpf_timer_cancel_and_free and bpf_timer_cancel. It will lead a UAF on the timer->timer.
bpf_timer_cancel(); spin_lock(); t = timer->time; spin_unlock(); bpf_timer_cancel_and_free(); spin_lock(); t = timer->timer; timer->timer = NULL; spin_unlock(); hrtimer_cancel(&t->timer); kfree(t); /* UAF on t */ hrtimer_cancel(&t->timer);
In bpf_timer_cancel_and_free, this patch frees the timer->timer after a rcu grace period. This requires a rcu_head addition to the "struct bpf_hrtimer". Another kfree(t) happens in bpf_timer_init, this does not need a kfree_rcu because it is still under the spin_lock and timer->timer has not been visible by others yet.
In bpf_timer_cancel, rcu_read_lock() is added because this helper can be used in a non rcu critical section context (e.g. from a sleepable bpf prog). Other timer->timer usages in helpers.c have been audited, bpf_timer_cancel() is the only place where timer->timer is used outside of the spin_lock.
Another solution considered is to mark a t->flag in bpf_timer_cancel and clear it after hrtimer_cancel() is done. In bpf_timer_cancel_and_free, it busy waits for the flag to be cleared before kfree(t). This patch goes with a straight forward solution and frees timer->timer after a rcu grace period.
--- kernel/bpf/helpers.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
kernel/bpf/helpers.c +4 -1
@@ -1048,6 +1048,7 @@ struct bpf_hrtimer {struct bpf_prog *prog;void __rcu *callback_fn;void *value; +struct rcu_head rcu; };/* the actual struct hidden inside uapi struct bpf_timer */
@@ -1269,6 +1270,7 @@ BPF_CALL_1(bpf_timer_cancel, struct bpf_timer_kern *, timer)if (in_nmi ())return -EOPNOTSUPP ; +rcu_read_lock ();__bpf_spin_lock_irqsave (&timer->lock); t = timer->timer;if (!t) {
@@ -1290,6 +1292,7 @@ BPF_CALL_1(bpf_timer_cancel, struct bpf_timer_kern *, timer)* if it was running. */ ret = ret ?:hrtimer_cancel (&t->timer); +rcu_read_unlock ();return ret; }
@@ -1344,7 +1347,7 @@ void bpf_timer_cancel_and_free(void *val)*/ if (this_cpu_read (hrtimer_running) != t)hrtimer_cancel (&t->timer); -kfree (t); +kfree_rcu (t, rcu); }const struct bpf_func_proto bpf_get_current_task_proto__weak ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 221/245 afs: Increase buffer size in afs_update_volume_status()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniil Dulov <[email protected]>
[ Upstream commit 6ea38e2aeb72349cad50e38899b0ba6fbcb2af3d ]
The max length of volume->vid value is 20 characters. So increase idbuf[] size up to 24 to avoid overflow.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
[DH: Actually, it's 20 + NUL, so increase it to 24 and use snprintf()]
--- fs/afs/volume.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/afs/volume.c +2 -2
@@ -327,7 +327,7 @@ static int afs_update_volume_status(struct afs_volume *volume, struct key *key) {struct afs_server_list *new, *old, *discard;struct afs_vldb_entry *vldb; -char idbuf[16 ]; +char idbuf[24 ];int ret, idsz;_enter ("" );
@@ -335,7 +335,7 @@ static int afs_update_volume_status(struct afs_volume *volume, struct key *key)/* We look up an ID by passing it as a decimal string in the * operation's name parameter. */ - idsz =sprintf (idbuf,"%llu" , volume->vid); + idsz =snprintf (idbuf,sizeof (idbuf),"%llu" , volume->vid); vldb =afs_vl_lookup_vldb (volume->cell, key, idbuf, idsz);if (IS_ERR (vldb)) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 222/245 ipv6: sr: fix possible use-after-free and null-ptr-deref
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasiliy Kovalev <[email protected]>
[ Upstream commit 5559cea2d5aa3018a5f00dd2aca3427ba09b386b ]
The pernet operations structure for the subsystem must be registered before registering the generic netlink family.
--- net/ipv6/seg6.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-)
net/ipv6/seg6.c +11 -9
@@ -507,22 +507,24 @@ int __init seg6_init(void) {int err; - err =genl_register_family (&seg6_genl_family); + err =register_pernet_subsys (&ip6_segments_ops);if (err) goto out; - err =register_pernet_subsys (&ip6_segments_ops); + err =genl_register_family (&seg6_genl_family);if (err) - goto out_unregister_genl; + goto out_unregister_pernet;#ifdef CONFIG_IPV6_SEG6_LWTUNNEL err =seg6_iptunnel_init ();if (err) - goto out_unregister_pernet; + goto out_unregister_genl; err =seg6_local_init (); -if (err) - goto out_unregister_pernet; +if (err) { +seg6_iptunnel_exit (); + goto out_unregister_genl; + }#endif #ifdef CONFIG_IPV6_SEG6_HMAC
@@ -543,11 +545,11 @@ int __init seg6_init(void)#endif #endif #ifdef CONFIG_IPV6_SEG6_LWTUNNEL -out_unregister_pernet: -unregister_pernet_subsys (&ip6_segments_ops); -#endif out_unregister_genl:genl_unregister_family (&seg6_genl_family); +#endif +out_unregister_pernet: +unregister_pernet_subsys (&ip6_segments_ops); goto out; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 223/245 packet: move from strlcpy with unused retval to strscpy
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wolfram Sang <[email protected]>
[ Upstream commit 8fc9d51ea2d32a05f7d7cf86a25cc86ecc57eb45 ]
Follow the advice of the below link and prefer 'strscpy' in this subsystem. Conversion is 1:1 because the return value is not used. Generated by a coccinelle script.
Stable-dep-of: a7d6027790ac ("arp: Prevent overflow in arp_req_get().")
--- net/packet/af_packet.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/packet/af_packet.c +2 -2
@@ -1874,7 +1874,7 @@ static int packet_rcv_spkt(struct sk_buff *skb, struct net_device *dev,*/ spkt->spkt_family = dev->type; -strlcpy (spkt->spkt_device, dev->name,sizeof (spkt->spkt_device)); +strscpy (spkt->spkt_device, dev->name,sizeof (spkt->spkt_device)); spkt->spkt_protocol = skb->protocol;/*
@@ -3540,7 +3540,7 @@ static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr,rcu_read_lock (); dev =dev_get_by_index_rcu (sock_net (sk),READ_ONCE (pkt_sk (sk)->ifindex));if (dev) -strlcpy (uaddr->sa_data, dev->name,sizeof (uaddr->sa_data)); +strscpy (uaddr->sa_data, dev->name,sizeof (uaddr->sa_data));rcu_read_unlock ();return sizeof (*uaddr);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 224/245 net: dev: Convert sa_data to flexible array in struct sockaddr
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit b5f0de6df6dce8d641ef58ef7012f3304dffb9a1 ]
One of the worst offenders of "fake flexible arrays" is struct sockaddr, as it is the classic example of why GCC and Clang have been traditionally forced to treat all trailing arrays as fake flexible arrays: in the distant misty past, sa_data became too small, and code started just treating it as a flexible array, even though it was fixed-size. The special case by the compiler is specifically that sizeof(sa->sa_data) and FORTIFY_SOURCE (which uses __builtin_object_size(sa->sa_data, 1)) do not agree (14 and -1 respectively), which makes FORTIFY_SOURCE treat it as a flexible array.
However, the coming -fstrict-flex-arrays compiler flag will remove these special cases so that FORTIFY_SOURCE can gain coverage over all the trailing arrays in the kernel that are _not_ supposed to be treated as a flexible array. To deal with this change, convert sa_data to a true flexible array. To keep the structure size the same, move sa_data into a union with a newly introduced sa_data_min with the original size. The result is that FORTIFY_SOURCE can continue to have no idea how large sa_data may actually be, but anything using sizeof(sa->sa_data) must switch to sizeof(sa->sa_data_min).
Stable-dep-of: a7d6027790ac ("arp: Prevent overflow in arp_req_get().")
--- include/linux/socket.h | 5 ++++- net/core/dev.c | 2 +- net/core/dev_ioctl.c | 2 +- net/packet/af_packet.c | 10 +++++----- 4 files changed, 11 insertions(+), 8 deletions(-)
include/linux/socket.h +4 -1
@@ -31,7 +31,10 @@ typedef __kernel_sa_family_t sa_family_t;struct sockaddr {sa_family_t sa_family;/* address family, AF_xxx */ -char sa_data[14 ];/* 14 bytes of protocol address */ +union { +char sa_data_min[14 ];/* Minimum 14 bytes of protocol address */ + DECLARE_FLEX_ARRAY(char, sa_data); + }; };struct linger {
net/core/dev.c +1 -1
@@ -9090,7 +9090,7 @@ EXPORT_SYMBOL(dev_set_mac_address_user);int dev_get_mac_address (struct sockaddr *sa,struct net *net,char *dev_name) { -size_t size =sizeof (sa->sa_data); +size_t size =sizeof (sa->sa_data_min);struct net_device *dev;int ret =0 ;
net/core/dev_ioctl.c +1 -1
@@ -339,7 +339,7 @@ static int dev_ifsioc(struct net *net, struct ifreq *ifr, void __user *data,if (ifr->ifr_hwaddr.sa_family != dev->type)return -EINVAL ;memcpy (dev->broadcast, ifr->ifr_hwaddr.sa_data, -min (sizeof (ifr->ifr_hwaddr.sa_data), +min (sizeof (ifr->ifr_hwaddr.sa_data_min), (size_t )dev->addr_len));call_netdevice_notifiers (NETDEV_CHANGEADDR , dev);return 0 ;
net/packet/af_packet.c +5 -5
@@ -3252,7 +3252,7 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr, int addr_len) {struct sock *sk = sock->sk; -char name[sizeof (uaddr->sa_data) +1 ]; +char name[sizeof (uaddr->sa_data_min) +1 ];/* * Check legality
@@ -3263,8 +3263,8 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr,/* uaddr->sa_data comes from the userspace, it's not guaranteed to be * zero-terminated. */ -memcpy (name, uaddr->sa_data,sizeof (uaddr->sa_data)); - name[sizeof (uaddr->sa_data)] =0 ; +memcpy (name, uaddr->sa_data,sizeof (uaddr->sa_data_min)); + name[sizeof (uaddr->sa_data_min)] =0 ;return packet_do_bind (sk, name,0 ,0 ); }
@@ -3536,11 +3536,11 @@ static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr,return -EOPNOTSUPP ; uaddr->sa_family =AF_PACKET ; -memset (uaddr->sa_data,0 ,sizeof (uaddr->sa_data)); +memset (uaddr->sa_data,0 ,sizeof (uaddr->sa_data_min));rcu_read_lock (); dev =dev_get_by_index_rcu (sock_net (sk),READ_ONCE (pkt_sk (sk)->ifindex));if (dev) -strscpy (uaddr->sa_data, dev->name,sizeof (uaddr->sa_data)); +strscpy (uaddr->sa_data, dev->name,sizeof (uaddr->sa_data_min));rcu_read_unlock ();return sizeof (*uaddr);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 225/245 drm/nouveau/instmem: fix uninitialized_var.cocci warning
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guo Zhengkui <[email protected]>
[ Upstream commit 2046e733e125fa58ed997f3d26d43543faf82c95 ]
Fix following coccicheck warning:
drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv50.c:316:11-12:
WARNING this kind of initialization is deprecated.
void *map = map has the same form ofuninitialized_var() macro. I remove the redundant assignement. It has been tested with gcc (Debian 8.3.0-6) 8.3.0.
The patch which removed uninitialized_var() is:
https://lore.kernel.org/all/[email protected]/
And there is very few "/* GCC */" comments in the Linux kernel code now.
Stable-dep-of: 3b1ae9b71c2a ("octeontx2-af: Consider the action set by PF")
--- drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv50.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv50.c +1 -1
@@ -313,7 +313,7 @@ nv50_instobj_dtor(struct nvkm_memory *memory)struct nv50_instobj *iobj =nv50_instobj (memory);struct nvkm_instmem *imem = &iobj->imem->base;struct nvkm_vma *bar; -void *map = map; +void *map;mutex_lock (&imem->mutex);if (likely (iobj->lru.next))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 226/245 octeontx2-af: Consider the action set by PF
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Subbaraya Sundeep <[email protected]>
[ Upstream commit 3b1ae9b71c2a97f848b00fb085a2bd29bddbe8d9 ]
AF reserves MCAM entries for each PF, VF present in the system and populates the entry with DMAC and action with default RSS so that basic packet I/O works. Since PF/VF is not aware of the RSS action installed by AF, AF only fixup the actions of the rules installed by PF/VF with corresponding default RSS action. This worked well for rules installed by PF/VF for features like RX VLAN offload and DMAC filters but rules involving action like drop/forward to queue are also getting modified by AF. Hence fix it by setting the default RSS action only if requested by PF/VF.
--- drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c +4 -0
@@ -436,6 +436,10 @@ static void npc_fixup_vf_rule(struct rvu *rvu, struct npc_mcam *mcam,return ; } +/* AF modifies given action iff PF/VF has requested for it */ +if ((entry->action &0xFULL ) !=NIX_RX_ACTION_DEFAULT ) +return ; +/* copy VF default entry action to the VF mcam entry */ rx_action =npc_get_default_entry_action (rvu, mcam, blkaddr, target_func);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 227/245 s390: use the correct count for __iowrite64_copy()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gunthorpe <[email protected]>
[ Upstream commit 723a2cc8d69d4342b47dfddbfe6c19f1b135f09b ]
The signature for __iowrite64_copy() requires the number of 64 bit quantities, not bytes. Multiple by 8 to get to a byte length before invoking zpci_memcpy_toio()
--- arch/s390/pci/pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/s390/pci/pci.c +1 -1
@@ -228,7 +228,7 @@ resource_size_t pcibios_align_resource(void *data, const struct resource *res,/* combine single writes by using store-block insn */ void __iowrite64_copy (void __iomem *to,const void *from,size_t count) { -zpci_memcpy_toio (to, from, count); +zpci_memcpy_toio (to, from, count *8 ); }static void __iomem *__ioremap (phys_addr_t addr,size_t size,pgprot_t prot)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 228/245 tls: rx: jump to a more appropriate label
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit bfc06e1aaa130b86a81ce3c41ec71a2f5e191690 ]
'recv_end:' checks num_async and decrypted, and is then followed by the 'end' label. Since we know that decrypted and num_async are 0 at the start we can jump to 'end'.
Move the init of decrypted and num_async to let the compiler catch if I'm wrong.
Stable-dep-of: fdfbaec5923d ("tls: stop recv() if initial process_rx_list gave us non-DATA")
--- net/tls/tls_sw.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
net/tls/tls_sw.c +4 -3
@@ -1755,6 +1755,7 @@ int tls_sw_recvmsg(struct sock *sk,struct tls_sw_context_rx *ctx =tls_sw_ctx_rx (tls_ctx);struct tls_prot_info *prot = &tls_ctx->prot_info;struct sk_psock *psock; +int num_async, pending;unsigned char control =0 ;ssize_t decrypted =0 ;struct strp_msg *rxm;
@@ -1767,8 +1768,6 @@ int tls_sw_recvmsg(struct sock *sk,bool is_kvec =iov_iter_is_kvec (&msg->msg_iter);bool is_peek = flags &MSG_PEEK ;bool bpf_strp_enabled; -int num_async =0 ; -int pending; flags |= nonblock;
@@ -1790,12 +1789,14 @@ int tls_sw_recvmsg(struct sock *sk, }if (len <= copied) - goto recv_end; + goto end; target =sock_rcvlowat (sk, flags &MSG_WAITALL , len); len = len - copied; timeo =sock_rcvtimeo (sk, flags &MSG_DONTWAIT ); + decrypted =0 ; + num_async =0 ;while (len && (decrypted + copied < target || ctx->recv_pkt)) {bool retain_skb = false;bool zc = false;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 229/245 tls: rx: drop pointless else after goto
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit d5123edd10cf9d324fcb88e276bdc7375f3c5321 ]
Pointless else branch after goto makes the code harder to refactor down the line.
Stable-dep-of: fdfbaec5923d ("tls: stop recv() if initial process_rx_list gave us non-DATA")
--- net/tls/tls_sw.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
net/tls/tls_sw.c +1 -2
@@ -1784,10 +1784,9 @@ int tls_sw_recvmsg(struct sock *sk,if (err <0 ) {tls_err_abort (sk, err); goto end; - }else { - copied = err; } + copied = err;if (len <= copied) goto end;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 230/245 tls: stop recv() if initial process_rx_list gave us non-DATA
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit fdfbaec5923d9359698cbb286bc0deadbb717504 ]
If we have a non-DATA record on the rx_list and another record of the same type still on the queue, we will end up merging them:
- process_rx_list copies the non-DATA record
- we start the loop and process the first available record since it's of the same type
- we break out of the loop since the record was not DATA
Just check the record type and jump to the end in case process_rx_list did some work.
--- net/tls/tls_sw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/tls/tls_sw.c +1 -1
@@ -1787,7 +1787,7 @@ int tls_sw_recvmsg(struct sock *sk, } copied = err; -if (len <= copied) +if (len <= copied || (copied && control !=TLS_RECORD_TYPE_DATA )) goto end; target =sock_rcvlowat (sk, flags &MSG_WAITALL , len);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 231/245 netfilter: nf_tables: set dormant flag on hook register failure
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit bccebf64701735533c8db37773eeacc6566cc8ec ]
We need to set the dormant flag again if we fail to register the hooks.
During memory pressure hook registration can fail and we end up with a table marked as active but no registered hooks.
On table/base chain deletion, nf_tables will attempt to unregister the hook again which yields a warn splat from the nftables core.
--- net/netfilter/nf_tables_api.c | 1 + 1 file changed, 1 insertion(+)
net/netfilter/nf_tables_api.c +1 -0
@@ -1193,6 +1193,7 @@ static int nf_tables_updtable(struct nft_ctx *ctx)return 0 ; err_register_hooks: + ctx->table->flags |=NFT_TABLE_F_DORMANT ;nft_trans_destroy (trans);return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 232/245 netfilter: flowtable: simplify route logic
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit fa502c86566680ac62bc28ec883a069bf7a2aa5e ]
Grab reference to dst from skbuff earlier to simplify route caching.
Stable-dep-of: 9e0f0430389b ("netfilter: nft_flow_offload: reset dst in route object after setting up flow")
--- include/net/netfilter/nf_flow_table.h | 4 ++-- net/netfilter/nf_flow_table_core.c | 24 +++--------------------- net/netfilter/nft_flow_offload.c | 12 ++++++++---- 3 files changed, 13 insertions(+), 27 deletions(-)
include/net/netfilter/nf_flow_table.h +2 -2
@@ -257,8 +257,8 @@ nf_flow_table_offload_del_cb(struct nf_flowtable *flow_table,up_write (&flow_table->flow_block_lock); } -int flow_offload_route_init (struct flow_offload *flow, -const struct nf_flow_route *route); +void flow_offload_route_init (struct flow_offload *flow, +const struct nf_flow_route *route);int flow_offload_add (struct nf_flowtable *flow_table,struct flow_offload *flow); void flow_offload_refresh(struct nf_flowtable *flow_table,
net/netfilter/nf_flow_table_core.c +3 -21
@@ -124,9 +124,6 @@ static int flow_offload_fill_route(struct flow_offload *flow,break ;case FLOW_OFFLOAD_XMIT_XFRM :case FLOW_OFFLOAD_XMIT_NEIGH : -if (!dst_hold_safe (route->tuple[dir].dst)) -return -1 ; - flow_tuple->dst_cache = dst; flow_tuple->dst_cookie =flow_offload_dst_cookie (flow_tuple);break ;
@@ -147,27 +144,12 @@ static void nft_flow_dst_release(struct flow_offload *flow,dst_release (flow->tuplehash[dir].tuple.dst_cache); } -int flow_offload_route_init (struct flow_offload *flow, +void flow_offload_route_init (struct flow_offload *flow,const struct nf_flow_route *route) { -int err; - - err =flow_offload_fill_route (flow, route,FLOW_OFFLOAD_DIR_ORIGINAL ); -if (err <0 ) -return err; - - err =flow_offload_fill_route (flow, route,FLOW_OFFLOAD_DIR_REPLY ); -if (err <0 ) - goto err_route_reply; - +flow_offload_fill_route (flow, route,FLOW_OFFLOAD_DIR_ORIGINAL ); +flow_offload_fill_route (flow, route,FLOW_OFFLOAD_DIR_REPLY ); flow->type =NF_FLOW_OFFLOAD_ROUTE ; - -return 0 ; - -err_route_reply: -nft_flow_dst_release (flow,FLOW_OFFLOAD_DIR_ORIGINAL ); - -return err; }EXPORT_SYMBOL_GPL (flow_offload_route_init);
net/netfilter/nft_flow_offload.c +8 -4
@@ -240,9 +240,14 @@ static int nft_flow_route(const struct nft_pktinfo *pkt,break ; } +if (!dst_hold_safe (this_dst)) +return -ENOENT ; +nf_route (nft_net (pkt), &other_dst, &fl, false,nft_pf (pkt)); -if (!other_dst) +if (!other_dst) { +dst_release (this_dst);return -ENOENT ; + }nft_default_forward_path (route, this_dst, dir);nft_default_forward_path (route, other_dst, !dir);
@@ -326,8 +331,7 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,if (!flow) goto err_flow_alloc; -if (flow_offload_route_init (flow, &route) <0 ) - goto err_flow_add; +flow_offload_route_init (flow, &route);if (tcph) { ct->proto.tcp.seen[0 ].flags |=IP_CT_TCP_FLAG_BE_LIBERAL ;
@@ -338,12 +342,12 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,if (ret <0 ) goto err_flow_add; -dst_release (route.tuple[!dir].dst);return ; err_flow_add:flow_offload_free (flow); err_flow_alloc: +dst_release (route.tuple[dir].dst);dst_release (route.tuple[!dir].dst); err_flow_route:clear_bit (IPS_OFFLOAD_BIT , &ct->status);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 233/245 netfilter: nft_flow_offload: reset dst in route object after setting up flow
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 9e0f0430389be7696396c62f037be4bf72cf93e3 ]
dst is transferred to the flow object, route object does not own it anymore. Reset dst in route object, otherwise if flow_offload_add() fails, error path releases dst twice, leading to a refcount underflow.
--- include/net/netfilter/nf_flow_table.h | 2 +- net/netfilter/nf_flow_table_core.c | 16 +++++++++++++--- 2 files changed, 14 insertions(+), 4 deletions(-)
include/net/netfilter/nf_flow_table.h +1 -1
@@ -258,7 +258,7 @@ nf_flow_table_offload_del_cb(struct nf_flowtable *flow_table, }void flow_offload_route_init (struct flow_offload *flow, -const struct nf_flow_route *route); +struct nf_flow_route *route);int flow_offload_add (struct nf_flowtable *flow_table,struct flow_offload *flow); void flow_offload_refresh(struct nf_flowtable *flow_table,
net/netfilter/nf_flow_table_core.c +13 -3
@@ -86,12 +86,22 @@ static u32 flow_offload_dst_cookie(struct flow_offload_tuple *flow_tuple)return 0 ; } +static struct dst_entry *nft_route_dst_fetch (struct nf_flow_route *route, +enum flow_offload_tuple_dir dir) +{ +struct dst_entry *dst = route->tuple[dir].dst; + + route->tuple[dir].dst =NULL ; + +return dst; +} +static int flow_offload_fill_route (struct flow_offload *flow, -const struct nf_flow_route *route, +struct nf_flow_route *route,enum flow_offload_tuple_dir dir) {struct flow_offload_tuple *flow_tuple = &flow->tuplehash[dir].tuple; -struct dst_entry *dst = route->tuple[dir].dst; +struct dst_entry *dst =nft_route_dst_fetch (route, dir);int i, j =0 ;switch (flow_tuple->l3proto) {
@@ -145,7 +155,7 @@ static void nft_flow_dst_release(struct flow_offload *flow, }void flow_offload_route_init (struct flow_offload *flow, -const struct nf_flow_route *route) +struct nf_flow_route *route) {flow_offload_fill_route (flow, route,FLOW_OFFLOAD_DIR_ORIGINAL );flow_offload_fill_route (flow, route,FLOW_OFFLOAD_DIR_REPLY );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 234/245 netfilter: nft_flow_offload: release dst in case direct xmit path is used
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 8762785f459be1cfe6fcf7285c123aad6a3703f0 ]
Direct xmit does not use it since it calls dev_queue_xmit() to send packets, hence it calls dst_release().
kmemleak reports:
unreferenced object 0xffff88814f440900 (size 184):
comm "softirq", pid 0, jiffies 4294951896 hex dump (first 32 bytes):
00 60 5b 04 81 88 ff ff 00 e6 e8 82 ff ff ff ff .`[.............
21 0b 50 82 ff ff ff ff 00 00 00 00 00 00 00 00 !.P.............
backtrace (crc cb2bf5d6):
[<000000003ee17107>] kmem_cache_alloc+0x286/0x340
[<0000000021a5de2c>] dst_alloc+0x43/0xb0
[<00000000f0671159>] rt_dst_alloc+0x2e/0x190
[<00000000fe5092c9>] __mkroute_output+0x244/0x980
[<000000005fb96fb0>] ip_route_output_flow+0xc0/0x160
[<0000000045367433>] nf_ip_route+0xf/0x30
[<0000000085da1d8e>] nf_route+0x2d/0x60
[<00000000d1ecd1cb>] nft_flow_route+0x171/0x6a0 [nft_flow_offload]
[<00000000d9b2fb60>] nft_flow_offload_eval+0x4e8/0x700 [nft_flow_offload]
[<000000009f447dbb>] expr_call_ops_eval+0x53/0x330 [nf_tables]
[<00000000072e1be6>] nft_do_chain+0x17c/0x840 [nf_tables]
[<00000000d0551029>] nft_do_chain_inet+0xa1/0x210 [nf_tables]
[<0000000097c9d5c6>] nf_hook_slow+0x5b/0x160
[<0000000005eccab1>] ip_forward+0x8b6/0x9b0
[<00000000553a269b>] ip_rcv+0x221/0x230
[<00000000412872e5>] __netif_receive_skb_one_core+0xfe/0x110--- net/netfilter/nf_flow_table_core.c | 1 + 1 file changed, 1 insertion(+)
net/netfilter/nf_flow_table_core.c +1 -0
@@ -131,6 +131,7 @@ static int flow_offload_fill_route(struct flow_offload *flow, ETH_ALEN); flow_tuple->out.ifidx = route->tuple[dir].out.ifindex; flow_tuple->out.hw_ifidx = route->tuple[dir].out.hw_ifindex; +dst_release (dst);break ;case FLOW_OFFLOAD_XMIT_XFRM :case FLOW_OFFLOAD_XMIT_NEIGH :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 235/245 drm/syncobj: call drm_syncobj_fence_add_wait when WAIT_AVAILABLE flag is set
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Erik Kurzinger <[email protected]>
[ Upstream commit 3c43177ffb54ea5be97505eb8e2690e99ac96bc9 ]
When waiting for a syncobj timeline point whose fence has not yet been submitted with the WAIT_FOR_SUBMIT flag, a callback is registered using drm_syncobj_fence_add_wait and the thread is put to sleep until the timeout expires. If the fence is submitted before then, drm_syncobj_add_point will wake up the sleeping thread immediately which will proceed to wait for the fence to be signaled.
However, if the WAIT_AVAILABLE flag is used instead, drm_syncobj_fence_add_wait won't get called, meaning the waiting thread will always sleep for the full timeout duration, even if the fence gets submitted earlier. If it turns out that the fence *has* been submitted by the time it eventually wakes up, it will still indicate to userspace that the wait completed successfully (it won't return -ETIME), but it will have taken much longer than it should have.
To fix this, we must call drm_syncobj_fence_add_wait if *either* the WAIT_FOR_SUBMIT flag or the WAIT_AVAILABLE flag is set. The only difference being that with WAIT_FOR_SUBMIT we will also wait for the fence to be signaled after it has been submitted while with WAIT_AVAILABLE we will return immediately.
IGT test patch: https://lists.freedesktop.org/archives/igt-dev/2024-January/067537.html
v1 -> v2: adjust lockdep_assert_none_held_once condition
(cherry picked from commit 8c44ea81634a4a337df70a32621a5f3791be23df)
--- drivers/gpu/drm/drm_syncobj.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/gpu/drm/drm_syncobj.c +4 -2
@@ -1021,7 +1021,8 @@ static signed long drm_syncobj_array_wait_timeout(struct drm_syncobj **syncobjs,uint64_t *points;uint32_t signaled_count, i; -if (flags &DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT ) +if (flags & (DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT | +DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE ))lockdep_assert_none_held_once (); points =kmalloc_array (count,sizeof (*points),GFP_KERNEL );
@@ -1090,7 +1091,8 @@ static signed long drm_syncobj_array_wait_timeout(struct drm_syncobj **syncobjs,* fallthough and try a 0 timeout wait! */ -if (flags &DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT ) { +if (flags & (DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT | +DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE )) {for (i =0 ; i < count; ++i)drm_syncobj_fence_add_wait (syncobjs[i], &entries[i]); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 236/245 drm/amd/display: Fix memory leak in dm_sw_fini()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <[email protected]>
[ Upstream commit bae67893578d608e35691dcdfa90c4957debf1d3 ]
After destroying dmub_srv, the memory associated with it is not freed, causing a memory leak:
unreferenced object 0xffff896302b45800 (size 1024):
comm "(udev-worker)", pid 222, jiffies 4294894636 hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc 6265fd77):
[<ffffffff993495ed>] kmalloc_trace+0x29d/0x340
[<ffffffffc0ea4a94>] dm_dmub_sw_init+0xb4/0x450 [amdgpu]
[<ffffffffc0ea4e55>] dm_sw_init+0x15/0x2b0 [amdgpu]
[<ffffffffc0ba8557>] amdgpu_device_init+0x1417/0x24e0 [amdgpu]
[<ffffffffc0bab285>] amdgpu_driver_load_kms+0x15/0x190 [amdgpu]
[<ffffffffc0ba09c7>] amdgpu_pci_probe+0x187/0x4e0 [amdgpu]
[<ffffffff9968fd1e>] local_pci_probe+0x3e/0x90
[<ffffffff996918a3>] pci_device_probe+0xc3/0x230
[<ffffffff99805872>] really_probe+0xe2/0x480
[<ffffffff99805c98>] __driver_probe_device+0x78/0x160
[<ffffffff99805daf>] driver_probe_device+0x1f/0x90
[<ffffffff9980601e>] __driver_attach+0xce/0x1c0
[<ffffffff99803170>] bus_for_each_dev+0x70/0xc0
[<ffffffff99804822>] bus_add_driver+0x112/0x210
[<ffffffff99807245>] driver_register+0x55/0x100
[<ffffffff990012d1>] do_one_initcall+0x41/0x300Fix this by freeing dmub_srv after destroying it.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +1 -0
@@ -2088,6 +2088,7 @@ static int dm_sw_fini(void *handle)if (adev->dm.dmub_srv) {dmub_srv_destroy (adev->dm.dmub_srv); +kfree (adev->dm.dmub_srv); adev->dm.dmub_srv =NULL ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 237/245 i2c: imx: Add timer for handling the stop condition
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Corey Minyard <[email protected]>
[ Upstream commit f89bf95632b41695402996d96476c44c641d23d7 ]
Most IMX I2C interfaces don't generate an interrupt on a stop condition, so it won't generate a timely stop event on a slave mode transfer. Some users, like IPMB, need a timely stop event to work properly.
So, add a timer and add the proper handling to generate a stop event in slave mode if the interface goes idle.
Stable-dep-of: 87aec499368d ("i2c: imx: when being a target, mark the last read as processed")
--- drivers/i2c/busses/i2c-imx.c | 92 ++++++++++++++++++++++++++++-------- 1 file changed, 73 insertions(+), 19 deletions(-)
drivers/i2c/busses/i2c-imx.c +73 -19
@@ -37,6 +37,8 @@#include <linux/io.h> #include <linux/iopoll.h> #include <linux/kernel.h> +#include <linux/spinlock.h> +#include <linux/hrtimer.h> #include <linux/module.h> #include <linux/of.h> #include <linux/of_device.h>
@@ -51,6 +53,8 @@/* This will be the driver name the kernel reports */ #define DRIVER_NAME "imx-i2c" +#define I2C_IMX_CHECK_DELAY 30000/* Time to check for bus idle, in NS */ +/* * Enable DMA if transfer byte size is bigger than this threshold. * As the hardware request, it must bigger than 4 bytes.\
@@ -210,6 +214,10 @@ struct imx_i2c_struct {struct imx_i2c_dma *dma;struct i2c_client *slave;enum i2c_slave_event last_slave_event; + +/* For checking slave events. */ +spinlock_t slave_lock; +struct hrtimer slave_timer; };static const struct imx_i2c_hwdata imx1_i2c_hwdata = {
@@ -680,7 +688,7 @@ static void i2c_imx_slave_event(struct imx_i2c_struct *i2c_imx,static void i2c_imx_slave_finish_op (struct imx_i2c_struct *i2c_imx) { -u8 val; +u8 val =0 ;while (i2c_imx->last_slave_event !=I2C_SLAVE_STOP ) {switch (i2c_imx->last_slave_event) {
@@ -701,10 +709,11 @@ static void i2c_imx_slave_finish_op(struct imx_i2c_struct *i2c_imx) } } -static irqreturn_t i2c_imx_slave_isr (struct imx_i2c_struct *i2c_imx, -unsigned int status,unsigned int ctl) +/* Returns true if the timer should be restarted, false if not. */ +static irqreturn_t i2c_imx_slave_handle (struct imx_i2c_struct *i2c_imx, +unsigned int status,unsigned int ctl) { -u8 value; +u8 value =0 ;if (status &I2SR_IAL ) {/* Arbitration lost */ i2c_imx_clear_irq (i2c_imx,I2SR_IAL );
@@ -712,6 +721,16 @@ static irqreturn_t i2c_imx_slave_isr(struct imx_i2c_struct *i2c_imx,return IRQ_HANDLED ; } +if (!(status &I2SR_IBB )) { +/* No master on the bus, that could mean a stop condition. */ +i2c_imx_slave_finish_op (i2c_imx); +return IRQ_HANDLED ; + } + +if (!(status &I2SR_ICF )) +/* Data transfer still in progress, ignore this. */ + goto out; +if (status &I2SR_IAAS ) {/* Addressed as a slave */ i2c_imx_slave_finish_op (i2c_imx);if (status &I2SR_SRW ) {/* Master wants to read from us*/
@@ -737,16 +756,9 @@ static irqreturn_t i2c_imx_slave_isr(struct imx_i2c_struct *i2c_imx,imx_i2c_read_reg (i2c_imx,IMX_I2C_I2DR ); } }else if (!(ctl &I2CR_MTX )) {/* Receive mode */ -if (status &I2SR_IBB ) {/* No STOP signal detected */ - value =imx_i2c_read_reg (i2c_imx,IMX_I2C_I2DR ); -i2c_imx_slave_event (i2c_imx, -I2C_SLAVE_WRITE_RECEIVED , &value); - }else {/* STOP signal is detected */ -dev_dbg (&i2c_imx->adapter.dev, -"STOP signal detected" ); -i2c_imx_slave_event (i2c_imx, -I2C_SLAVE_STOP , &value); - } + value =imx_i2c_read_reg (i2c_imx,IMX_I2C_I2DR ); +i2c_imx_slave_event (i2c_imx, +I2C_SLAVE_WRITE_RECEIVED , &value); }else if (!(status &I2SR_RXAK )) {/* Transmit mode received ACK */ ctl |=I2CR_MTX ;imx_i2c_write_reg (ctl, i2c_imx,IMX_I2C_I2CR );
@@ -755,15 +767,43 @@ static irqreturn_t i2c_imx_slave_isr(struct imx_i2c_struct *i2c_imx, I2C_SLAVE_READ_PROCESSED, &value);imx_i2c_write_reg (value, i2c_imx,IMX_I2C_I2DR ); - }else {/* Transmit mode received NAK */ + }else {/* Transmit mode received NAK, operation is done */ ctl &= ~I2CR_MTX ;imx_i2c_write_reg (ctl, i2c_imx,IMX_I2C_I2CR );imx_i2c_read_reg (i2c_imx,IMX_I2C_I2DR ); +i2c_imx_slave_finish_op (i2c_imx); +return IRQ_HANDLED ; } +out: +/* +* No need to check the return value here. If it returns 0 or +* 1, then everything is fine. If it returns -1, then the +* timer is running in the handler. This will still work, +* though it may be redone (or already have been done) by the +* timer function. +*/ +hrtimer_try_to_cancel (&i2c_imx->slave_timer); +hrtimer_forward_now (&i2c_imx->slave_timer,I2C_IMX_CHECK_DELAY ); +hrtimer_restart (&i2c_imx->slave_timer);return IRQ_HANDLED ; } +static enum hrtimer_restart i2c_imx_slave_timeout (struct hrtimer *t) +{ + struct imx_i2c_struct *i2c_imx = container_of(t, struct imx_i2c_struct, + slave_timer); +unsigned int ctl, status; +unsigned long flags; + +spin_lock_irqsave (&i2c_imx->slave_lock, flags); + status =imx_i2c_read_reg (i2c_imx,IMX_I2C_I2SR ); + ctl =imx_i2c_read_reg (i2c_imx,IMX_I2C_I2CR ); +i2c_imx_slave_handle (i2c_imx, status, ctl); +spin_unlock_irqrestore (&i2c_imx->slave_lock, flags); +return HRTIMER_NORESTART ; +} +static void i2c_imx_slave_init (struct imx_i2c_struct *i2c_imx) {int temp;
@@ -843,7 +883,9 @@ static irqreturn_t i2c_imx_isr(int irq, void *dev_id) {struct imx_i2c_struct *i2c_imx = dev_id;unsigned int ctl, status; +unsigned long flags; +spin_lock_irqsave (&i2c_imx->slave_lock, flags); status =imx_i2c_read_reg (i2c_imx,IMX_I2C_I2SR ); ctl =imx_i2c_read_reg (i2c_imx,IMX_I2C_I2CR );
@@ -851,14 +893,20 @@ static irqreturn_t i2c_imx_isr(int irq, void *dev_id)i2c_imx_clear_irq (i2c_imx,I2SR_IIF );if (i2c_imx->slave) {if (!(ctl &I2CR_MSTA )) { -return i2c_imx_slave_isr (i2c_imx, status, ctl); - }else if (i2c_imx->last_slave_event != -I2C_SLAVE_STOP ) { -i2c_imx_slave_finish_op (i2c_imx); +irqreturn_t ret; + + ret =i2c_imx_slave_handle (i2c_imx, + status, ctl); +spin_unlock_irqrestore (&i2c_imx->slave_lock, + flags); +return ret; } +i2c_imx_slave_finish_op (i2c_imx); } +spin_unlock_irqrestore (&i2c_imx->slave_lock, flags);return i2c_imx_master_isr (i2c_imx, status); } +spin_unlock_irqrestore (&i2c_imx->slave_lock, flags);return IRQ_NONE ; }
@@ -1380,6 +1428,10 @@ static int i2c_imx_probe(struct platform_device *pdev)if (!i2c_imx)return -ENOMEM ; +spin_lock_init (&i2c_imx->slave_lock); +hrtimer_init (&i2c_imx->slave_timer,CLOCK_MONOTONIC ,HRTIMER_MODE_ABS ); + i2c_imx->slave_timer.function = i2c_imx_slave_timeout; + match =device_get_match_data (&pdev->dev);if (match) i2c_imx->hwdata = match;
@@ -1491,6 +1543,8 @@ static int i2c_imx_remove(struct platform_device *pdev) ret =pm_runtime_get_sync (&pdev->dev); +hrtimer_cancel (&i2c_imx->slave_timer); +/* remove adapter */ dev_dbg (&i2c_imx->adapter.dev,"adapter removed\n" );i2c_del_adapter (&i2c_imx->adapter);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 238/245 i2c: imx: when being a target, mark the last read as processed
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Corey Minyard <[email protected]>
[ Upstream commit 87aec499368d488c20292952d6d4be7cb9e49c5e ]
When being a target, NAK from the controller means that all bytes have been transferred. So, the last byte needs also to be marked as 'processed'. Otherwise index registers of backends may not increase.
--- drivers/i2c/busses/i2c-imx.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/i2c/busses/i2c-imx.c +5 -0
@@ -771,6 +771,11 @@ static irqreturn_t i2c_imx_slave_handle(struct imx_i2c_struct *i2c_imx, ctl &= ~I2CR_MTX ;imx_i2c_write_reg (ctl, i2c_imx,IMX_I2C_I2CR );imx_i2c_read_reg (i2c_imx,IMX_I2C_I2DR ); + +/* flag the last byte as processed */ +i2c_imx_slave_event (i2c_imx, +I2C_SLAVE_READ_PROCESSED , &value); +i2c_imx_slave_finish_op (i2c_imx);return IRQ_HANDLED ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 239/245 cifs: fix mid leak during reconnection after timeout threshold
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shyam Prasad N <[email protected]>
commit 69cba9d3c1284e0838ae408830a02c4a063104bc upstream.
When the number of responses with status of STATUS_IO_TIMEOUT exceeds a specified threshold (NUM_STATUS_IO_TIMEOUT), we reconnect the connection. But we do not return the mid, or the credits returned for the mid, or reduce the number of in-flight requests.
This bug could result in the server->in_flight count to go bad, and also cause a leak in the mids.
This change moves the check to a few lines below where the response is decrypted, even of the response is read from the transform header. This way, the code for returning the mids can be reused.
Also, the cifs_reconnect was reconnecting just the transport connection before. In case of multi-channel, this may not be what we want to do after several timeouts. Changed that to reconnect the session and the tree too.
Also renamed NUM_STATUS_IO_TIMEOUT to a more appropriate name MAX_STATUS_IO_TIMEOUT.
--- fs/cifs/connect.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-)
fs/cifs/connect.c +15 -4
@@ -59,7 +59,7 @@ extern bool disable_legacy_dialects;#define TLINK_IDLE_EXPIRE (600 * HZ)/* Drop the connection to not overload the server */ -#define NUM_STATUS_IO_TIMEOUT 5 +#define MAX_STATUS_IO_TIMEOUT 5struct mount_ctx {struct cifs_sb_info *cifs_sb;
@@ -965,6 +965,7 @@ cifs_demultiplex_thread(void *p)struct mid_q_entry *mids[MAX_COMPOUND ];char *bufs[MAX_COMPOUND ];unsigned int noreclaim_flag, num_io_timeout =0 ; +bool pending_reconnect = false; noreclaim_flag =memalloc_noreclaim_save ();cifs_dbg (FYI ,"Demultiplex PID: %d\n" ,task_pid_nr (current));
@@ -1004,6 +1005,8 @@ cifs_demultiplex_thread(void *p)cifs_dbg (FYI ,"RFC1002 header 0x%x\n" , pdu_length);if (!is_smb_response (server, buf[0 ]))continue ; + + pending_reconnect = false; next_pdu: server->pdu_size = pdu_length;
@@ -1063,10 +1066,13 @@ next_pdu:if (server->ops->is_status_io_timeout && server->ops->is_status_io_timeout (buf)) { num_io_timeout++; -if (num_io_timeout >NUM_STATUS_IO_TIMEOUT ) { -cifs_reconnect (server); +if (num_io_timeout >MAX_STATUS_IO_TIMEOUT ) { +cifs_server_dbg (VFS , +"Number of request timeouts exceeded %d. Reconnecting" , +MAX_STATUS_IO_TIMEOUT ); + + pending_reconnect = true; num_io_timeout =0 ; -continue ; } }
@@ -1113,6 +1119,11 @@ next_pdu: buf = server->smallbuf; goto next_pdu; } + +/* do this reconnect at the very end after processing all MIDs */ +if (pending_reconnect) +cifs_reconnect (server); + }/* end while !EXITING */ /* buffer usually freed in free_mid - need to free it here on exit */
Greg Kroah-Hartman
maintainerPATCH 240/245 fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
commit b820de741ae48ccf50dd95e297889c286ff4f760 upstream.
If kiocb_set_cancel_fn() is called for I/O submitted via io_uring, the following kernel warning appears:
WARNING: CPU: 3 PID: 368 at fs/aio.c:598 kiocb_set_cancel_fn+0x9c/0xa8 Call trace: kiocb_set_cancel_fn+0x9c/0xa8 ffs_epfile_read_iter+0x144/0x1d0 io_read+0x19c/0x498 io_issue_sqe+0x118/0x27c io_submit_sqes+0x25c/0x5fc __arm64_sys_io_uring_enter+0x104/0xab0 invoke_syscall+0x58/0x11c el0_svc_common+0xb4/0xf4 do_el0_svc+0x2c/0xb0 el0_svc+0x2c/0xa4 el0t_64_sync_handler+0x68/0xb4 el0t_64_sync+0x1a4/0x1a8
Fix this by setting the IOCB_AIO_RW flag for read and write I/O that is submitted by libaio.
--- fs/aio.c | 9 ++++++++- include/linux/fs.h | 2 ++ 2 files changed, 10 insertions(+), 1 deletion(-)
fs/aio.c +8 -1
@@ -568,6 +568,13 @@ void kiocb_set_cancel_fn(struct kiocb *istruct kioctx *ctx = req->ki_ctx;unsigned long flags; +/* +* kiocb didn't come from aio or is neither a read nor a write, hence +* ignore it. +*/ +if (!(iocb->ki_flags &IOCB_AIO_RW )) +return ; +if (WARN_ON_ONCE (!list_empty (&req->ki_list)))return ;
@@ -1453,7 +1460,7 @@ static int aio_prep_rw(struct kiocb *req req->ki_complete = aio_complete_rw; req->private =NULL ; req->ki_pos = iocb->aio_offset; - req->ki_flags =iocb_flags (req->ki_filp); + req->ki_flags =iocb_flags (req->ki_filp) |IOCB_AIO_RW ;if (iocb->aio_flags &IOCB_FLAG_RESFD ) req->ki_flags |=IOCB_EVENTFD ; req->ki_hint =ki_hint_validate (file_write_hint (req->ki_filp));
include/linux/fs.h +2 -0
@@ -322,6 +322,8 @@ enum rw_hint {#define IOCB_NOIO (1 << 20)/* can use bio alloc cache */ #define IOCB_ALLOC_CACHE (1 << 21) +/* kiocb is a read or write operation submitted by fs/aio.c. */ +#define IOCB_AIO_RW (1 << 23)struct kiocb {struct file *ki_filp;
Greg Kroah-Hartman
maintainerPATCH 241/245 arp: Prevent overflow in arp_req_get().
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
commit a7d6027790acea24446ddd6632d394096c0f4667 upstream.
syzkaller reported an overflown write in arp_req_get(). [0]
When ioctl(SIOCGARP) is issued, arp_req_get() looks up an neighbour entry and copies neigh->ha to struct arpreq.arp_ha.sa_data.
The arp_ha here is struct sockaddr, not struct sockaddr_storage, so the sa_data buffer is just 14 bytes.
In the splat below, 2 bytes are overflown to the next int field, arp_flags. We initialise the field just after the memcpy(), so it's not a problem.
However, when dev->addr_len is greater than 22 (e.g. MAX_ADDR_LEN), arp_netmask is overwritten, which could be set as htonl(0xFFFFFFFFUL) in arp_ioctl() before calling arp_req_get().
To avoid the overflow, let's limit the max length of memcpy().
Note that commit b5f0de6df6dc ("net: dev: Convert sa_data to flexible array in struct sockaddr") just silenced syzkaller.
[0]:
memcpy: detected field-spanning write (size 16) of single field "r->arp_ha.sa_data" at net/ipv4/arp.c:1128 (size 14)
WARNING: CPU: 0 PID: 144638 at net/ipv4/arp.c:1128 arp_req_get+0x411/0x4a0 net/ipv4/arp.c:1128 Modules linked in: CPU: 0 PID: 144638 Comm: syz-executor.4 Not tainted 6.1.74 #31 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-5 04/01/2014 RIP: 0010:arp_req_get+0x411/0x4a0 net/ipv4/arp.c:1128 Code: fd ff ff e8 41 42 de fb b9 0e 00 00 00 4c 89 fe 48 c7 c2 20 6d ab 87 48 c7 c7 80 6d ab 87 c6 05 25 af 72 04 01 e8 5f 8d ad fb <0f> 0b e9 6c fd ff ff e8 13 42 de fb be 03 00 00 00 4c 89 e7 e8 a6 RSP: 0018:ffffc900050b7998 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff88803a815000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff8641a44a RDI: 0000000000000001 RBP: ffffc900050b7a98 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 203a7970636d656d R12: ffff888039c54000 R13: 1ffff92000a16f37 R14: ffff88803a815084 R15: 0000000000000010 FS: 00007f172bf306c0(0000) GS:ffff88805aa00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f172b3569f0 CR3: 0000000057f12005 CR4: 0000000000770ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> arp_ioctl+0x33f/0x4b0 net/ipv4/arp.c:1261 inet_ioctl+0x314/0x3a0 net/ipv4/af_inet.c:981 sock_do_ioctl+0xdf/0x260 net/socket.c:1204 sock_ioctl+0x3ef/0x650 net/socket.c:1321 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x18e/0x220 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x37/0x90 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x64/0xce RIP: 0033:0x7f172b262b8d Code: 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f172bf300b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f172b3abf80 RCX: 00007f172b262b8d RDX: 0000000020000000 RSI: 0000000000008954 RDI: 0000000000000003 RBP: 00007f172b2d3493 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007f172b3abf80 R15: 00007f172bf10000 </TASK>
--- net/ipv4/arp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/ipv4/arp.c +2 -1
@@ -1104,7 +1104,8 @@ static int arp_req_get(struct arpreq *r,if (neigh) {if (!(neigh->nud_state &NUD_NOARP )) {read_lock_bh (&neigh->lock); -memcpy (r->arp_ha.sa_data, neigh->ha, dev->addr_len); +memcpy (r->arp_ha.sa_data, neigh->ha, +min (dev->addr_len, (unsigned char )sizeof (r->arp_ha.sa_data_min))); r->arp_flags =arp_state_to_flags (neigh);read_unlock_bh (&neigh->lock); r->arp_ha.sa_family = dev->type;
Greg Kroah-Hartman
maintainerPATCH 242/245 netfilter: nf_tables: fix scheduling-while-atomic splat
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
commit 2024439bd5ceb145eeeb428b2a59e9b905153ac3 upstream.
nf_tables_check_loops() can be called from rhashtable list walk so cond_resched() cannot be used here.
--- net/netfilter/nf_tables_api.c | 4 ---- 1 file changed, 4 deletions(-)
net/netfilter/nf_tables_api.c +0 -4
@@ -10044,13 +10044,9 @@ static int nf_tables_check_loops(const sbreak ; } } - -cond_resched (); }list_for_each_entry (set, &ctx->table->sets, list) { -cond_resched (); -if (!nft_is_active_next (ctx->net, set))continue ; if (!(set->flags & NFT_SET_MAP) ||
Greg Kroah-Hartman
maintainerPATCH 243/245 ext4: regenerate buddy after block freeing failed if under fc replay
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
commit c9b528c35795b711331ed36dc3dbee90d5812d4e upstream.
This mostly reverts commit 6bd97bf273bd ("ext4: remove redundant mb_regenerate_buddy()") and reintroduces mb_regenerate_buddy(). Based on code in mb_free_blocks(), fast commit replay can end up marking as free blocks that are already marked as such. This causes corruption of the buddy bitmap so we need to regenerate it in that case.
--- fs/ext4/mballoc.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)
fs/ext4/mballoc.c +20 -0
@@ -1168,6 +1168,24 @@ void ext4_mb_generate_buddy(struct supermb_update_avg_fragment_size (sb, grp); } +static void mb_regenerate_buddy (struct ext4_buddy *e4b) +{ +int count; +int order =1 ; +void *buddy; + +while ((buddy =mb_find_buddy (e4b, order++, &count))) +ext4_set_bits (buddy,0 , count); + + e4b->bd_info->bb_fragments =0 ; +memset (e4b->bd_info->bb_counters,0 , +sizeof (*e4b->bd_info->bb_counters) * + (e4b->bd_sb->s_blocksize_bits +2 )); + +ext4_mb_generate_buddy (e4b->bd_sb, e4b->bd_buddy, + e4b->bd_bitmap, e4b->bd_group, e4b->bd_info); +} +/* The buddy information is attached the buddy cache inode * for convenience. The information regarding each group * is loaded via ext4_mb_load_buddy. The information involve
@@ -1846,6 +1864,8 @@ static void mb_free_blocks(struct inodeext4_mark_group_bitmap_corrupted ( sb, e4b->bd_group,EXT4_GROUP_INFO_BBITMAP_CORRUPT ); + }else { +mb_regenerate_buddy (e4b); } goto done; }
Greg Kroah-Hartman
maintainerPATCH 244/245 ext4: avoid bb_free and bb_fragments inconsistency in mb_free_blocks()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
commit 2331fd4a49864e1571b4f50aa3aa1536ed6220d0 upstream.
After updating bb_free in mb_free_blocks, it is possible to return without updating bb_fragments because the block being freed is found to have already been freed, which leads to inconsistency between bb_free and bb_fragments.
Since the group may be unlocked in ext4_grp_locked_error(), this can lead to problems such as dividing by zero when calculating the average fragment length. Hence move the update of bb_free to after the block double-free check guarantees that the corresponding statistics are updated only after the core block bitmap is modified.
--- fs/ext4/mballoc.c | 39 +++++++++++++++++++++------------------ 1 file changed, 21 insertions(+), 18 deletions(-)
fs/ext4/mballoc.c +21 -18
@@ -1835,11 +1835,6 @@ static void mb_free_blocks(struct inodemb_check_buddy (e4b);mb_free_blocks_double (inode, e4b, first, count); -this_cpu_inc (discard_pa_seq); - e4b->bd_info->bb_free += count; -if (first < e4b->bd_info->bb_first_free) - e4b->bd_info->bb_first_free = first; -/* access memory sequentially: check left neighbour, * clear range and then check right neighbour */
@@ -1853,23 +1848,31 @@ static void mb_free_blocks(struct inodestruct ext4_sb_info *sbi =EXT4_SB (sb);ext4_fsblk_t blocknr; +/* +* Fastcommit replay can free already freed blocks which +* corrupts allocation info. Regenerate it. +*/ +if (sbi->s_mount_state &EXT4_FC_REPLAY ) { +mb_regenerate_buddy (e4b); + goto check; + } + blocknr =ext4_group_first_block_no (sb, e4b->bd_group); blocknr +=EXT4_C2B (sbi, block); -if (!(sbi->s_mount_state &EXT4_FC_REPLAY )) { -ext4_grp_locked_error (sb, e4b->bd_group, - inode ? inode->i_ino :0 , - blocknr, -"freeing already freed block (bit %u); block bitmap corrupt." , - block); -ext4_mark_group_bitmap_corrupted ( - sb, e4b->bd_group, +ext4_grp_locked_error (sb, e4b->bd_group, + inode ? inode->i_ino :0 , blocknr, +"freeing already freed block (bit %u); block bitmap corrupt." , + block); +ext4_mark_group_bitmap_corrupted (sb, e4b->bd_group,EXT4_GROUP_INFO_BBITMAP_CORRUPT ); - }else { -mb_regenerate_buddy (e4b); - } - goto done; +return ; } +this_cpu_inc (discard_pa_seq); + e4b->bd_info->bb_free += count; +if (first < e4b->bd_info->bb_first_free) + e4b->bd_info->bb_first_free = first; +/* let's maintain fragments counter */ if (left_is_free && right_is_free) e4b->bd_info->bb_fragments--;
@@ -1894,9 +1897,9 @@ static void mb_free_blocks(struct inodeif (first <= last)mb_buddy_mark_free (e4b, first >>1 , last >>1 ); -done:mb_set_largest_free_order (sb, e4b->bd_info);mb_update_avg_fragment_size (sb, e4b->bd_info); +check:mb_check_buddy (e4b); }
Greg Kroah-Hartman
maintainerPATCH 245/245 netfilter: nf_tables: cant schedule in nft_chain_validate
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
commit 314c82841602a111c04a7210c21dc77e0d560242 upstream.
Can be called via nft set element list iteration, which may acquire rcu and/or bh read lock (depends on set type).
BUG: sleeping function called from invalid context at net/netfilter/nf_tables_api.c:3353
in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 1232, name: nftpreempt_count: 0, expected: 0
RCU nest depth: 1, expected: 0
2 locks held by nft/1232:
#0: ffff8881180e3ea8 (&nft_net->commit_mutex){+.+.}-{3:3}, at: nf_tables_valid_genid #1: ffffffff83f5f540 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire
Call Trace: nft_chain_validate nft_lookup_validate_setelem nft_pipapo_walk nft_lookup_validate nft_chain_validate nft_immediate_validate nft_chain_validate nf_tables_validate nf_tables_abort
No choice but to move it to nf_tables_validate().
--- net/netfilter/nf_tables_api.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/netfilter/nf_tables_api.c +2 -2
@@ -3443,8 +3443,6 @@ int nft_chain_validate(const struct nft_if (err <0 )return err; } - -cond_resched (); }return 0 ;
@@ -3468,6 +3466,8 @@ static int nft_table_validate(struct net err =nft_chain_validate (&ctx, chain);if (err <0 )return err; + +cond_resched (); }return 0 ;
Hello,
Quoted 5 lines · On Tue, 27 Feb 2024 14:23:08 +0100 Greg Kroah-Hartman…
This is the start of the stable review cycle for the 5.15.150 release. There are 245 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 8 lines
Responses should be made by Thu, 29 Feb 2024 13:15:36 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.150-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.
This rc kernel passes DAMON functionality test[1] on my test machine. Attaching the test results summary below. Please note that I retrieved the kernel from linux-stable-rc tree[2].
[1] https://github.com/awslabs/damon-tests/tree/next/corr
[2] 3ab4d9c9e190 ("Linux 5.15.150-rc1")
Thanks,
SJ
[...]
---
ok 1 selftests: damon: debugfs_attrs.sh
ok 1 selftests: damon-tests: kunit.sh
ok 2 selftests: damon-tests: huge_count_read_write.sh
ok 3 selftests: damon-tests: buffer_overflow.sh
ok 4 selftests: damon-tests: rm_contexts.sh
ok 5 selftests: damon-tests: record_null_deref.sh
ok 6 selftests: damon-tests: dbgfs_target_ids_read_before_terminate_race.sh ok 7 selftests: damon-tests: dbgfs_target_ids_pid_leak.sh
ok 8 selftests: damon-tests: damo_tests.sh
ok 9 selftests: damon-tests: masim-record.sh
ok 10 selftests: damon-tests: build_i386.sh
ok 11 selftests: damon-tests: build_arm64.sh
ok 12 selftests: damon-tests: build_m68k.sh
ok 13 selftests: damon-tests: build_i386_idle_flag.sh
ok 14 selftests: damon-tests: build_i386_highpte.sh
ok 15 selftests: damon-tests: build_nomemcg.sh
[33m
[92mPASS [39m
Hi!
Quoted 7 lines
This is the start of the stable review cycle for the 5.15.150 release. There are 245 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 29 Feb 2024 13:15:36 +0000. Anything received after that time might be too late.
We get build errors on risc-v:
CC drivers/clocksource/dummy_timer.o
2773 CC net/sunrpc/timer.o 2774 CC drivers/firmware/efi/libstub/lib-fdt_rw.o
2775In file included from ./include/linux/list.h:9,
2776 from ./include/linux/module.h:12,
2777 from drivers/net/ethernet/realtek/r8169_main.c:12:2778drivers/net/ethernet/realtek/r8169_main.c:5512:23: error: 'rtl8169_pm_ops' undeclared here (not in a function); did you mean 'rtl8169_poll'? 2779 5512 | .driver.pm = pm_ptr(&rtl8169_pm_ops),
2780 | ^~~~~~~~~~~~~~2781./include/linux/kernel.h:46:38: note: in definition of macro 'PTR_IF'
2782 46 | #define PTR_IF(cond, ptr) ((cond) ? (ptr) : NULL)
2783 | ^~~2784drivers/net/ethernet/realtek/r8169_main.c:5512:15: note: in expansion of macro 'pm_ptr'
2785 5512 | .driver.pm = pm_ptr(&rtl8169_pm_ops),
2786 | ^~~~~~
2787 CC net/sunrpc/xdr.o 2788 CC drivers/clocksource/timer-riscv.o 2789make[4]: *** [scripts/Makefile.build:289: drivers/net/ethernet/realtek/r8169_main.o] Error 1 2790make[4]: *** Waiting for unfinished jobs.... 2791 CC drivers/mmc/core/sdio_bus.o 2792 CC net/sunrpc/sunrpc_syms.o 2793 CC fs/fhandle.o
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/pipelines/1192614164
Best regards,
Pavel
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Erika Unter HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Hello!
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.150 release. There are 245 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 29 Feb 2024 13:15:36 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.150-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
We're seeing build regressions here with RISC-V, with GCC 8, GCC 12, and Clang 17:
-----8<-----
In file included from /builds/linux/include/linux/list.h:9,
from /builds/linux/include/linux/module.h:12,
from /builds/linux/drivers/net/ethernet/realtek/r8169_main.c:12:
/builds/linux/drivers/net/ethernet/realtek/r8169_main.c:5512:35: error: 'rtl8169_pm_ops' undeclared here (not in a function); did you mean 'rtl8169_poll'?
5512 | .driver.pm = pm_ptr(&rtl8169_pm_ops),
| ^~~~~~~~~~~~~~
/builds/linux/include/linux/kernel.h:46:44: note: in definition of macro 'PTR_IF'
46 | #define PTR_IF(cond, ptr) ((cond) ? (ptr) : NULL)
| ^~~ /builds/linux/drivers/net/ethernet/realtek/r8169_main.c:5512:27: note: in expansion of macro 'pm_ptr'
5512 | .driver.pm = pm_ptr(&rtl8169_pm_ops),
| ^~~~~~
make[5]: *** [/builds/linux/scripts/Makefile.build:289: drivers/net/ethernet/realtek/r8169_main.o] Error 1
----->8-----
Bisection points to:
commit ac2871f646a8f556203f5b6be875ce406d855ddb
Author: Paul Cercueil <[email protected]>
Date: Tue Dec 7 00:20:59 2021 +0000
PM: core: Redefine pm_ptr() macro
[ Upstream commit c06ef740d401d0f4ab188882bf6f8d9cf0f75eaf ]
A revert could not be done cleanly.
Tuxmake reproducer:
tuxmake --runtime podman --target-arch riscv --toolchain gcc-12 --kconfig defconfig
Greetings!
Daniel Díaz
[email protected]
Greg Kroah-Hartman
maintainerQuoted 47 lines · Daniel Díaz
Hello!
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.150 release. There are 245 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 29 Feb 2024 13:15:36 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.150-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
We're seeing build regressions here with RISC-V, with GCC 8, GCC 12, and Clang 17:
-----8<-----
In file included from /builds/linux/include/linux/list.h:9,from /builds/linux/include/linux/module.h:12, from /builds/linux/drivers/net/ethernet/realtek/r8169_main.c:12: /builds/linux/drivers/net/ethernet/realtek/r8169_main.c:5512:35: error: 'rtl8169_pm_ops' undeclared here (not in a function); did you mean 'rtl8169_poll'? 5512 | .driver.pm = pm_ptr(&rtl8169_pm_ops), | ^~~~~~~~~~~~~~ /builds/linux/include/linux/kernel.h:46:44: note: in definition of macro 'PTR_IF' 46 | #define PTR_IF(cond, ptr) ((cond) ? (ptr) : NULL) | ^~~/builds/linux/drivers/net/ethernet/realtek/r8169_main.c:5512:27: note: in expansion of macro '
pm_ptr'
5512 | .driver.pm =pm_ptr(&rtl8169_pm_ops),
| ^~~~~~
make[5]: *** [/builds/linux/scripts/Makefile.build:289:drivers/net/ethernet/realtek/r8169_main.o] Error 1
----->8-----Bisection points to:
commit
ac2871f646a8f556203f5b6be875ce406d855ddb
Author: Paul Cercueil <[email protected]>
Date: Tue Dec 7 00:20:59 2021 +0000
PM: core: Redefinepm_ptr()macro
[ Upstream commitc06ef740d401d0f4ab188882bf6f8d9cf0f75eaf]
Quoted 7 lines
A revert could not be done cleanly.
Tuxmake reproducer:
tuxmake --runtime podman --target-arch riscv --toolchain gcc-12 --kconfig defconfig
I've been beating on this for a while and I really don't know what is happening, sorry. The driver looks fine, something is "odd" with riscv here that is not "odd" with other arches.
I'll leave this as-is for now and hopefully someone who relies on riscv can help track it down.
thanks,
greg k-h
Quoted 50 lines · Greg Kroah-Hartman
Quoted 49 lines · Daniel Díaz
Hello!
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.150 release. There are 245 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 29 Feb 2024 13:15:36 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.150-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
We're seeing build regressions here with RISC-V, with GCC 8, GCC 12, and Clang 17:
-----8<-----
In file included from /builds/linux/include/linux/list.h:9,from /builds/linux/include/linux/module.h:12, from /builds/linux/drivers/net/ethernet/realtek/r8169_main.c:12: /builds/linux/drivers/net/ethernet/realtek/r8169_main.c:5512:35: error: 'rtl8169_pm_ops' undeclared here (not in a function); did you mean 'rtl8169_poll'? 5512 | .driver.pm = pm_ptr(&rtl8169_pm_ops), | ^~~~~~~~~~~~~~ /builds/linux/include/linux/kernel.h:46:44: note: in definition of macro 'PTR_IF' 46 | #define PTR_IF(cond, ptr) ((cond) ? (ptr) : NULL) | ^~~ /builds/linux/drivers/net/ethernet/realtek/r8169_main.c:5512:27: note: in expansion of macro 'pm_ptr' 5512 | .driver.pm = pm_ptr(&rtl8169_pm_ops), | ^~~~~~ make[5]: *** [/builds/linux/scripts/Makefile.build:289: drivers/net/ethernet/realtek/r8169_main.o] Error 1----->8-----
Bisection points to:
commit ac2871f646a8f556203f5b6be875ce406d855ddb Author: Paul Cercueil <[email protected]> Date: Tue Dec 7 00:20:59 2021 +0000 PM: core: Redefine pm_ptr() macro [ Upstream commit c06ef740d401d0f4ab188882bf6f8d9cf0f75eaf ]A revert could not be done cleanly.
Quoted 8 lines
Quoted 5 lines
Tuxmake reproducer:
tuxmake --runtime podman --target-arch riscv --toolchain gcc-12 --kconfig defconfigI've been beating on this for a while and I really don't know what is happening, sorry. The driver looks fine, something is "odd" with riscv
No, the driver is not fine. Upstream has commit 8fe6e670640e ("r8169: use new PM macros") which makes rtl8169_pm_ops unconditional. That commit is missing in v5.15.y. Applying it makes the problem disappear.
In other words, the problem is not riscv specific, but will be seen if the realtek driver is built with CONFIG_PM=n (which happens to be the case with riscv:defconfig).
Guenter
Greg Kroah-Hartman
maintainerQuoted 60 lines · Guenter Roeck
Quoted 50 lines · Greg Kroah-Hartman
Quoted 49 lines · Daniel Díaz
Hello!
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.150 release. There are 245 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 29 Feb 2024 13:15:36 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.150-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
We're seeing build regressions here with RISC-V, with GCC 8, GCC 12, and Clang 17:
-----8<-----
In file included from /builds/linux/include/linux/list.h:9,from /builds/linux/include/linux/module.h:12, from /builds/linux/drivers/net/ethernet/realtek/r8169_main.c:12: /builds/linux/drivers/net/ethernet/realtek/r8169_main.c:5512:35: error: 'rtl8169_pm_ops' undeclared here (not in a function); did you mean 'rtl8169_poll'? 5512 | .driver.pm = pm_ptr(&rtl8169_pm_ops), | ^~~~~~~~~~~~~~ /builds/linux/include/linux/kernel.h:46:44: note: in definition of macro 'PTR_IF' 46 | #define PTR_IF(cond, ptr) ((cond) ? (ptr) : NULL) | ^~~ /builds/linux/drivers/net/ethernet/realtek/r8169_main.c:5512:27: note: in expansion of macro 'pm_ptr' 5512 | .driver.pm = pm_ptr(&rtl8169_pm_ops), | ^~~~~~ make[5]: *** [/builds/linux/scripts/Makefile.build:289: drivers/net/ethernet/realtek/r8169_main.o] Error 1----->8-----
Bisection points to:
commit ac2871f646a8f556203f5b6be875ce406d855ddb Author: Paul Cercueil <[email protected]> Date: Tue Dec 7 00:20:59 2021 +0000 PM: core: Redefine pm_ptr() macro [ Upstream commit c06ef740d401d0f4ab188882bf6f8d9cf0f75eaf ]A revert could not be done cleanly.
Quoted 8 lines
Quoted 5 lines
Tuxmake reproducer:
tuxmake --runtime podman --target-arch riscv --toolchain gcc-12 --kconfig defconfigI've been beating on this for a while and I really don't know what is happening, sorry. The driver looks fine, something is "odd" with riscv
Quoted 7 lines
No, the driver is not fine. Upstream has commit
8fe6e670640e("r8169: use new PM macros") which makesrtl8169_pm_opsunconditional. That commit is missing in v5.15.y. Applying it makes the problem disappear.In other words, the problem is not riscv specific, but will be seen if the realtek driver is built with
CONFIG_PM=n(which happens to be the case with riscv:defconfig).
Ugh, that wasn't obvious, I was thinking that the CONFIG_PM thing would have worked properly there and was digging in riscv code all over the place...
Thanks for this, now queued up.
greg k-h
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.150 release. There are 245 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 29 Feb 2024 13:15:36 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.150-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:
Signature · 1 line
Florian
Quoted 5 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.150 release. There are 245 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 8 lines
Responses should be made by Thu, 29 Feb 2024 13:15:36 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.150-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.
KernelCI report for stable-rc/linux-5.15.y for this week.
## stable-rc HEAD for linux-5.15.y:
Date: 2024-02-27
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git/log/?h=3ab4d9c9e190217ee7e974c70b96795cd2f74611
## Build failures:
riscv:
- defconfig (gcc-10) and rv32_defconfig (gcc-10)
- Build details :- https://linux.kernelci.org/build/stable-rc/branch/linux-5.15.y/kernel/v5.15.149-246-g3ab4d9c9e190/
- Errors :-
drivers/net/ethernet/realtek/r8169_main.c:5512:23: error: ‘rtl8169_pm_ops’ undeclared here (not in a function); did you mean ‘rtl8169_poll’?
## Boot failures:
No **new** boot failures seen for the stable-rc/linux-5.15.y commit head \o/
Thanks,
Shreeya Patel
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.150 release. There are 245 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 29 Feb 2024 13:15:36 +0000. Anything received after that time might be too late.
No regressions found on WSL (x86 and arm64).
Built, booted, and reviewed dmesg.
Thank you. :)
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.150 release. There are 245 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 29 Feb 2024 13:15:36 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.150-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v5.15:
10 builds: 10 pass, 0 fail
26 boots: 26 pass, 0 fail
102 tests: 102 pass, 0 failLinux version: 5.15.150-rc1-g3ab4d9c9e190
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra194-p3509-0000+p3668-0000,
tegra20-ventana, tegra210-p2371-2180,
tegra210-p3450-0000, tegra30-cardhu-a04Jon
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.150 release. There are 245 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 29 Feb 2024 13:15:36 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.150-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Quoted 9 lines
This is the start of the stable review cycle for the 5.15.150 release. There are 245 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 29 Feb 2024 13:15:36 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.150-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my x86_64 and ARM64 test systems. No errors or regressions.
Thanks.
Hi Greg,
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.150 release. There are 245 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 29 Feb 2024 13:15:36 +0000. Anything received after that time might be too late.
No problems seen on x86_64 and aarch64 with our testing.
Thanks,
Harshit
Quoted 10 lines
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.150-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.150 release. There are 245 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 29 Feb 2024 13:15:36 +0000. Anything received after that time might be too late.
$ git grep dma_fence_allocate_private_stub
drivers/dma-buf/dma-fence-unwrap.c: return dma_fence_allocate_private_stub(timestamp);
^^^^^^^^^
drivers/dma-buf/dma-fence-unwrap.c: tmp = dma_fence_allocate_private_stub(ktime_get());
^^^^^^^^^^^
drivers/dma-buf/dma-fence.c: * dma_fence_allocate_private_stub - return a private, signaled fence
drivers/dma-buf/dma-fence.c:struct dma_fence *dma_fence_allocate_private_stub(void)
^^^^
drivers/dma-buf/dma-fence.c:EXPORT_SYMBOL(dma_fence_allocate_private_stub);
drivers/gpu/drm/drm_syncobj.c: struct dma_fence *fence = dma_fence_allocate_private_stub();
include/linux/dma-fence.h:struct dma_fence *dma_fence_allocate_private_stub(void);
^^^^This was introduced with commit 4e82b9c11d3cd ("dma-buf: add dma_fence_timestamp helper") in v5.15.149. The additional parameter to dma_fence_allocate_private_stub() was introduced in the upstream kernel with commit f781f661e8c99 ("dma-buf: keep the signaling time of merged fences v3") which is missing in v5.15.y.
Guenter
Greg Kroah-Hartman
maintainerQuoted 10 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.150 release. There are 245 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 29 Feb 2024 13:15:36 +0000. Anything received after that time might be too late.
Quoted 12 lines
$ git grep dma_fence_allocate_private_stub
drivers/dma-buf/dma-fence-unwrap.c: return dma_fence_allocate_private_stub(timestamp);
^^^^^^^^^
drivers/dma-buf/dma-fence-unwrap.c: tmp = dma_fence_allocate_private_stub(ktime_get());
^^^^^^^^^^^
drivers/dma-buf/dma-fence.c: * dma_fence_allocate_private_stub - return a private, signaled fence
drivers/dma-buf/dma-fence.c:struct dma_fence *dma_fence_allocate_private_stub(void)
^^^^
drivers/dma-buf/dma-fence.c:EXPORT_SYMBOL(dma_fence_allocate_private_stub);
drivers/gpu/drm/drm_syncobj.c: struct dma_fence *fence = dma_fence_allocate_private_stub();
include/linux/dma-fence.h:struct dma_fence *dma_fence_allocate_private_stub(void);
^^^^How is any of this building then? Does no one actually use dma-fence-unwrap.c?
Quoted 4 lines
This was introduced with commit
4e82b9c11d3cd("dma-buf: adddma_fence_timestamphelper") in v5.15.149. The additional parameter todma_fence_allocate_private_stub()was introduced in the upstream kernel with commitf781f661e8c99("dma-buf: keep the signaling time of merged fences v3") which is missing in v5.15.y.
f781f661e8c99 still uses an option to dma_fence_allocate_private_stub():
- return dma_fence_get_stub();
+ return dma_fence_allocate_private_stub(timestamp);
So backporting that will continue the breakage, right?
confused,
greg k-h
Quoted 24 lines · Greg Kroah-Hartman
Quoted 10 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.150 release. There are 245 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 29 Feb 2024 13:15:36 +0000. Anything received after that time might be too late.
Quoted 12 lines
$ git grep dma_fence_allocate_private_stub drivers/dma-buf/dma-fence-unwrap.c: return dma_fence_allocate_private_stub(timestamp); ^^^^^^^^^ drivers/dma-buf/dma-fence-unwrap.c: tmp = dma_fence_allocate_private_stub(ktime_get()); ^^^^^^^^^^^ drivers/dma-buf/dma-fence.c: * dma_fence_allocate_private_stub - return a private, signaled fence drivers/dma-buf/dma-fence.c:struct dma_fence *dma_fence_allocate_private_stub(void) ^^^^ drivers/dma-buf/dma-fence.c:EXPORT_SYMBOL(dma_fence_allocate_private_stub); drivers/gpu/drm/drm_syncobj.c: struct dma_fence *fence = dma_fence_allocate_private_stub(); include/linux/dma-fence.h:struct dma_fence *dma_fence_allocate_private_stub(void); ^^^^
Quoted 3 lines
How is any of this building then? Does no one actually use
dma-fence-unwrap.c?
It was found as part of the merge of v5.15.149 into ChromeOS. I did not check the detailed circumstances and/or why ChromeOS stumbled over the problem. The merge introduces other problems for us. We are busy tracking those down, so I don't have much time to look into this further (not blaming v5.15.y, more likely it is the result of conflicts between deviating code bases).
Quoted 9 lines
Quoted 4 lines
This was introduced with commit
4e82b9c11d3cd("dma-buf: adddma_fence_timestamphelper") in v5.15.149. The additional parameter todma_fence_allocate_private_stub()was introduced in the upstream kernel with commitf781f661e8c99("dma-buf: keep the signaling time of merged fences v3") which is missing in v5.15.y.
f781f661e8c99still uses an option todma_fence_allocate_private_stub():(quoted diff) +1
-1- return dma_fence_get_stub(); + return dma_fence_allocate_private_stub(timestamp);
Quoted 4 lines
So backporting that will continue the breakage, right?
confused,
Most likely I missed some other commit when running "git blame". Never mind, though. We'll deal with the problem internally. It was just a note to let people know that there is some inconsistency in v5.15.y.
Thanks,
Guenter