6.6.26-rc1 review
Subsystems (8)
Greg Kroah-Hartman
maintainercover 6.6.26-rc1 review
This is the start of the stable review cycle for the 6.6.26 release. There are 252 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 10 Apr 2024 12:52:23 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.26-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.6.26-rc1
Ard Biesheuvel <[email protected]>
x86/efistub: Remap kernel text read-only before dropping NX attribute
Ard Biesheuvel <[email protected]>
x86/sev: Move early startup code into .head.text section
Ard Biesheuvel <[email protected]>
x86/sme: Move early SME kernel encryption handling into .head.text
Ard Biesheuvel <[email protected]>
efi/libstub: Add generic support for parsing mem_encrypt=
Hou Wenlong <[email protected]>
x86/head/64: Move the __head definition to <asm/init.h>
Andrii Nakryiko <[email protected]>
bpf: support deferring bpf_link dealloc to after RCU grace period
Andrii Nakryiko <[email protected]>
bpf: put uprobe link's path and task in release callback
Davide Caratti <[email protected]>
mptcp: don't account accept() of non-MPC client as fallback to TCP
Davide Caratti <[email protected]>
mptcp: don't overwrite sock_ops in mptcp_is_tcpsk()
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: connect: fix shellcheck warnings
Sergey Shtylyov <[email protected]>
of: module: prevent NULL pointer dereference in vsnprintf()
Greg Kroah-Hartman <[email protected]>
Revert "x86/mpparse: Register APIC address only once"
Andi Shyti <[email protected]>
drm/i915/gt: Enable only one CCS for compute workload
Andi Shyti <[email protected]>
drm/i915/gt: Do not generate the command streamer for all the CCS
Andi Shyti <[email protected]>
drm/i915/gt: Disable HW load balancing for CCS
Paulo Alcantara <[email protected]>
smb: client: fix potential UAF in cifs_signal_cifsd_for_reconnect()
Paulo Alcantara <[email protected]>
smb: client: fix potential UAF in smb2_is_network_name_deleted()
Paulo Alcantara <[email protected]>
smb: client: fix potential UAF in is_valid_oplock_break()
Paulo Alcantara <[email protected]>
smb: client: fix potential UAF in smb2_is_valid_lease_break()
Paulo Alcantara <[email protected]>
smb: client: fix potential UAF in smb2_is_valid_oplock_break()
Paulo Alcantara <[email protected]>
smb: client: fix potential UAF in cifs_dump_full_key()
Paulo Alcantara <[email protected]>
smb: client: fix potential UAF in cifs_stats_proc_show()
Paulo Alcantara <[email protected]>
smb: client: fix potential UAF in cifs_stats_proc_write()
Paulo Alcantara <[email protected]>
smb: client: fix potential UAF in cifs_debug_files_proc_show()
Ritvik Budhiraja <[email protected]>
smb3: retrying on failed server close
Paulo Alcantara <[email protected]>
smb: client: serialise cifs_construct_tcon() with cifs_mount_mutex
Paulo Alcantara <[email protected]>
smb: client: handle DFS tcons in cifs_construct_tcon()
Stefan O'Rear <[email protected]>
riscv: process: Fix kernel gp leakage
Samuel Holland <[email protected]>
riscv: Fix spurious errors from __get/put_kernel_nofault
Sumanth Korikkar <[email protected]>
s390/entry: align system call table on 8 bytes
Edward Liaw <[email protected]>
selftests/mm: include strings.h for ffsl
David Hildenbrand <[email protected]>
mm/secretmem: fix GUP-fast succeeding on secretmem folios
Mark Brown <[email protected]>
arm64/ptrace: Use saved floating point state type to determine SVE layout
Kan Liang <[email protected]>
perf/x86/intel/ds: Don't clear ->pebs_data_cfg for the last PEBS event
Jason A. Donenfeld <[email protected]>
x86/coco: Require seeding RNG with RDRAND on CoCo systems
Borislav Petkov (AMD) <[email protected]>
x86/mce: Make sure to grab mce_sysfs_mutex in set_bank()
David Hildenbrand <[email protected]>
x86/mm/pat: fix VM_PAT handling in COW mappings
Herve Codina <[email protected]>
of: dynamic: Synchronize of_changeset_destroy() with the devlink removals
Herve Codina <[email protected]>
driver core: Introduce device_link_wait_removal()
Jens Axboe <[email protected]>
io_uring/kbuf: hold io_buffer_list reference over mmap
Jens Axboe <[email protected]>
io_uring: use private workqueue for exit work
Jens Axboe <[email protected]>
io_uring/kbuf: protect io_buffer_list teardown with a reference
Jens Axboe <[email protected]>
io_uring/kbuf: get rid of bl->is_ready
Jens Axboe <[email protected]>
io_uring/kbuf: get rid of lower BGID lists
I Gede Agastya Darma Laksana <[email protected]>
ALSA: hda/realtek: Update Panasonic CF-SZ6 quirk to support headset with microphone
Christoffer Sandberg <[email protected]>
ALSA: hda/realtek - Fix inactive headset mic jack
Namjae Jeon <[email protected]>
ksmbd: do not set SMB2_GLOBAL_CAP_ENCRYPTION for SMB 3.1.1
Namjae Jeon <[email protected]>
ksmbd: validate payload size in ipc response
Namjae Jeon <[email protected]>
ksmbd: don't send oplock break if rename fails
Kent Gibson <[email protected]>
gpio: cdev: fix missed label sanitizing in debounce_setup()
Bartosz Golaszewski <[email protected]>
gpio: cdev: check for NULL labels when sanitizing them for irqs
Borislav Petkov (AMD) <[email protected]>
x86/retpoline: Add NOENDBR annotation to the SRSO dummy return thunk
Jesse Brandeburg <[email protected]>
ice: fix typo in assignment
Jeff Layton <[email protected]>
nfsd: hold a lighter-weight client reference over CB_RECALL_ANY
Alexandre Ghiti <[email protected]>
riscv: Disable preemption when using patch_map()
Chuck Lever <[email protected]>
SUNRPC: Fix a slow server-side memory leak with RPC-over-TCP
Vijendar Mukunda <[email protected]>
ASoC: SOF: amd: fix for false dsp interrupts
Arnd Bergmann <[email protected]>
ata: sata_mv: Fix PCI device ID table declaration compilation warning
Thomas Richter <[email protected]>
s390/pai: fix sampling event removal for PMU device driver
Thomas Richter <[email protected]>
s390/pai: rework paiXXX_start and paiXXX_stop functions
Thomas Richter <[email protected]>
s390/pai: cleanup event initialization
Thomas Richter <[email protected]>
s390/pai_crypto: remove per-cpu variable assignement in event initialization
Thomas Richter <[email protected]>
s390/pai: initialize event count once at initialization
Huai-Yuan Liu <[email protected]>
spi: mchp-pci1xxx: Fix a possible null pointer dereference in pci1xxx_spi_probe
David Howells <[email protected]>
cifs: Fix caching to try to do open O_WRONLY as rdwr on server
Oswald Buddenhagen <[email protected]>
Revert "ALSA: emu10k1: fix synthesizer sample playback position and caching"
Li Nan <[email protected]>
scsi: sd: Unregister device if device_add_disk() failed in sd_probe()
Arnd Bergmann <[email protected]>
scsi: mylex: Fix sysfs buffer lengths
Arnd Bergmann <[email protected]>
ata: sata_sx4: fix pdc20621_get_from_dimm() on 64-bit
Richard Fitzgerald <[email protected]>
regmap: maple: Fix uninitialized symbol 'ret' warnings
Vijendar Mukunda <[email protected]>
ASoC: amd: acp: fix for acp_init function error handling
Jaewon Kim <[email protected]>
spi: s3c64xx: Use DMA mode from fifo size
Tudor Ambarus <[email protected]>
spi: s3c64xx: determine the fifo depth only once
Tudor Ambarus <[email protected]>
spi: s3c64xx: allow full FIFO masks
Tudor Ambarus <[email protected]>
spi: s3c64xx: define a magic value
Tudor Ambarus <[email protected]>
spi: s3c64xx: remove else after return
Tudor Ambarus <[email protected]>
spi: s3c64xx: explicitly include <linux/bits.h>
Tudor Ambarus <[email protected]>
spi: s3c64xx: sort headers alphabetically
Sam Protsenko <[email protected]>
spi: s3c64xx: Extract FIFO depth calculation to a dedicated macro
Stephen Lee <[email protected]>
ASoC: ops: Fix wraparound for mask in snd_soc_get_volsw
Pierre-Louis Bossart <[email protected]>
ASoC: rt722-sdca-sdw: fix locking sequence
Pierre-Louis Bossart <[email protected]>
ASoC: rt712-sdca-sdw: fix locking sequence
Pierre-Louis Bossart <[email protected]>
ASoC: rt711-sdw: fix locking sequence
Pierre-Louis Bossart <[email protected]>
ASoC: rt711-sdca: fix locking sequence
Pierre-Louis Bossart <[email protected]>
ASoC: rt5682-sdw: fix locking sequence
Rob Clark <[email protected]>
drm/prime: Unbreak virtgpu dma-buf export
Dave Airlie <[email protected]>
nouveau/uvmm: fix addr/range calcs for remap operations
Christian Hewitt <[email protected]>
drm/panfrost: fix power transition timeout warnings
Simon Trimmer <[email protected]>
ALSA: hda: cs35l56: Add ACPI device match tables
Richard Fitzgerald <[email protected]>
regmap: maple: Fix cache corruption in regcache_maple_drop()
Victor Isaev <[email protected]>
RISC-V: Update AT_VECTOR_SIZE_ARCH for new AT_MINSIGSTKSZ
Pu Lehui <[email protected]>
drivers/perf: riscv: Disable PERF_SAMPLE_BRANCH_* while not supported
Richard Fitzgerald <[email protected]>
ASoC: wm_adsp: Fix missing mutex_lock in wm_adsp_write_ctl()
Dominique Martinet <[email protected]>
9p: Fix read/write debug statements to report server reply
Jann Horn <[email protected]>
fs/pipe: Fix lockdep false-positive in watchqueue pipe_write()
Ashish Kalra <[email protected]>
KVM: SVM: Add support for allowing zero SEV ASIDs
Sean Christopherson <[email protected]>
KVM: SVM: Use unsigned integers when dealing with ASIDs
Paul Barker <[email protected]>
net: ravb: Always update error counters
Paul Barker <[email protected]>
net: ravb: Always process TX descriptor ring
Claudiu Beznea <[email protected]>
net: ravb: Let IP-specific receive function to interrogate descriptors
Vitaly Lifshits <[email protected]>
e1000e: move force SMBUS from enable ulp function to avoid PHY loss issue
Vitaly Lifshits <[email protected]>
e1000e: Minor flow correction in e1000_shutdown function
Vitaly Lifshits <[email protected]>
e1000e: Workaround for sporadic MDI error on Meteor Lake systems
Jesse Brandeburg <[email protected]>
intel: legacy: field get conversion
Jesse Brandeburg <[email protected]>
intel: add bit macro includes where needed
Ivan Vecera <[email protected]>
i40e: Remove circular header dependencies and fix headers
Ivan Vecera <[email protected]>
i40e: Split i40e_osdep.h
Ivan Vecera <[email protected]>
i40e: Move memory allocation structures to i40e_alloc.h
Ivan Vecera <[email protected]>
i40e: Simplify memory allocation functions
Ivan Vecera <[email protected]>
virtchnl: Add header dependencies
Ivan Vecera <[email protected]>
i40e: Refactor I40E_MDIO_CLAUSE* macros
Ivan Vecera <[email protected]>
i40e: Remove back pointer from i40e_hw structure
Ivan Vecera <[email protected]>
i40e: Enforce software interrupt during busy-poll exit
Ivan Vecera <[email protected]>
i40e: Remove _t suffix from enum type names
Mario Limonciello <[email protected]>
drm/amd: Flush GFXOFF requests in prepare stage
Mario Limonciello <[email protected]>
drm/amd: Add concept of running prepare_suspend() sequence for IP blocks
Mario Limonciello <[email protected]>
drm/amd: Evict resources during PM ops prepare() callback
Chris Park <[email protected]>
drm/amd/display: Prevent crash when disable stream
Dmytro Laktyushkin <[email protected]>
drm/amd/display: Fix DPSTREAM CLK on and off sequence
Christian A. Ehrhardt <[email protected]>
usb: typec: ucsi: Check for notifications after init
Krishna Kurapati <[email protected]>
usb: typec: ucsi: Fix race between typec_switch and role_switch
Alexander Wetzel <[email protected]>
scsi: sg: Avoid sg device teardown race
Aleksandr Loktionov <[email protected]>
i40e: fix vf may be used uninitialized in this function warning
Aleksandr Loktionov <[email protected]>
i40e: fix i40e_count_filters() to count only active/new filters
Aleksandr Mishin <[email protected]>
octeontx2-af: Add array index check
Su Hui <[email protected]>
octeontx2-pf: check negative error code in otx2_open()
Hariprasad Kelam <[email protected]>
octeontx2-af: Fix issue with loading coalesced KPU profiles
Antoine Tenart <[email protected]>
udp: prevent local UDP tunnel packets from being GROed
Antoine Tenart <[email protected]>
udp: do not transition UDP GRO fraglist partial checksums to unnecessary
Antoine Tenart <[email protected]>
udp: do not accept non-tunnel GSO skbs landing in a tunnel
Atlas Yu <[email protected]>
r8169: skip DASH fw status checks when DASH is disabled
David Thompson <[email protected]>
mlxbf_gige: stop interface during shutdown
Kuniyuki Iwashima <[email protected]>
ipv6: Fix infinite recursion in fib6_dump_done().
Duoming Zhou <[email protected]>
ax25: fix use-after-free bugs caused by ax25_ds_del_timer
Kuniyuki Iwashima <[email protected]>
tcp: Fix bind() regression for v6-only wildcard and v4(-mapped-v6) non-wildcard addresses.
Jakub Kicinski <[email protected]>
selftests: reuseaddr_conflict: add missing new line at the end of the output
Eric Dumazet <[email protected]>
erspan: make sure erspan_base_hdr is present in skb->head
Ivan Vecera <[email protected]>
i40e: Fix VF MAC filter removal
Petr Oros <[email protected]>
ice: fix enabling RX VLAN filtering
Antoine Tenart <[email protected]>
gro: fix ownership transfer
Antoine Tenart <[email protected]>
selftests: net: gro fwd: update vxlan GRO test expectations
Michael Krummsdorf <[email protected]>
net: dsa: mv88e6xxx: fix usable ports on 88e6020
Aleksandr Mishin <[email protected]>
net: phy: micrel: Fix potential null pointer dereference
Wei Fang <[email protected]>
net: fec: Set mac_managed_pm during probe
Duanqiang Wen <[email protected]>
net: txgbe: fix i2c dev name cannot match clkdev
Horatiu Vultur <[email protected]>
net: phy: micrel: lan8814: Fix when enabling/disabling 1-step timestamping
Piotr Wejman <[email protected]>
net: stmmac: fix rx queue priority assignment
Eric Dumazet <[email protected]>
net/sched: fix lockdep splat in qdisc_tree_reduce_backlog()
Christophe JAILLET <[email protected]>
net: dsa: sja1105: Fix parameters order in sja1110_pcs_mdio_write_c45()
Eric Dumazet <[email protected]>
net/sched: act_skbmod: prevent kernel-infoleak
Will Deacon <[email protected]>
KVM: arm64: Ensure target address is granule-aligned for range TLBI
Borislav Petkov (AMD) <[email protected]>
x86/retpoline: Do the necessary fixup to the Zen3/4 srso return thunk for !SRSO
Jakub Sitnicki <[email protected]>
bpf, sockmap: Prevent lock inversion deadlock in map delete elem
Christophe JAILLET <[email protected]>
vboxsf: Avoid an spurious warning if load_nls_xxx() fails
Eric Dumazet <[email protected]>
netfilter: validate user input for expected length
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: discard table flag update with pending basechain deletion
Ziyang Xuan <[email protected]>
netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: flush pending destroy work before exit_net release
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: reject new basechain after table flag update
Borislav Petkov (AMD) <[email protected]>
x86/bugs: Fix the SRSO mitigation on Zen3/4
Josh Poimboeuf <[email protected]>
x86/nospec: Refactor UNTRAIN_RET[_*]
Josh Poimboeuf <[email protected]>
x86/srso: Disentangle rethunk-dependent options
Josh Poimboeuf <[email protected]>
x86/srso: Improve i-cache locality for alias mitigation
Marco Pinna <[email protected]>
vsock/virtio: fix packet delivery to tap device
Haiyang Zhang <[email protected]>
net: mana: Fix Rx DMA datasize and skb_over_panic
Jose Ignacio Tornos Martinez <[email protected]>
net: usb: ax88179_178a: avoid the interface always configured as random address
Mahmoud Adam <[email protected]>
net/rds: fix possible cp null dereference
Jesper Dangaard Brouer <[email protected]>
xen-netfront: Add missing skb_mark_for_recycle
Geliang Tang <[email protected]>
selftests: mptcp: join: fix dev in check_endpoint
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: release batch on table validation from abort path
Bastien Nocera <[email protected]>
Bluetooth: Fix TOCTOU in HCI debugfs implementation
Hui Wang <[email protected]>
Bluetooth: hci_event: set the conn encrypted before conn establishes
Johan Hovold <[email protected]>
Bluetooth: add quirk for broken address properties
Johan Hovold <[email protected]>
Bluetooth: qca: fix device-address endianness
Johan Hovold <[email protected]>
arm64: dts: qcom: sc7180-trogdor: mark bluetooth address as broken
Johan Hovold <[email protected]>
Revert "Bluetooth: hci_qca: Set BDA quirk bit if fwnode exists in DT"
Uros Bizjak <[email protected]>
x86/bpf: Fix IP after emitting call depth accounting
Sean Christopherson <[email protected]>
x86/cpufeatures: Add CPUID_LNX_5 to track recently added Linux-defined word
Heiner Kallweit <[email protected]>
r8169: fix issue caused by buggy BIOS on certain boards with RTL8168d
Christian Göttsche <[email protected]>
selinux: avoid dereference of garbage after mount failure
Oliver Upton <[email protected]>
KVM: arm64: Fix host-programmed guest events in nVHE
Anup Patel <[email protected]>
RISC-V: KVM: Fix APLIC in_clrip[x] read emulation
Anup Patel <[email protected]>
RISC-V: KVM: Fix APLIC setipnum_le/be write emulation
Bartosz Golaszewski <[email protected]>
gpio: cdev: sanitize the label before requesting the interrupt
Masahiro Yamada <[email protected]>
modpost: do not make find_tosym() return NULL
Jack Brennen <[email protected]>
modpost: Optimize symbol search from linear to binary search
Sandipan Das <[email protected]>
perf/x86/amd/lbr: Use freeze based on availability
Sandipan Das <[email protected]>
x86/cpufeatures: Add new word for scattered features
Sandipan Das <[email protected]>
perf/x86/amd/core: Update and fix stalled-cycles-* events for Zen 2 and later
Borislav Petkov (AMD) <[email protected]>
x86/CPU/AMD: Add X86_FEATURE_ZEN1
Borislav Petkov (AMD) <[email protected]>
x86/CPU/AMD: Get rid of amd_erratum_1054[]
Borislav Petkov (AMD) <[email protected]>
x86/CPU/AMD: Move the DIV0 bug detection to the Zen1 init function
Borislav Petkov (AMD) <[email protected]>
x86/CPU/AMD: Move Zenbleed check to the Zen2 init function
Borislav Petkov (AMD) <[email protected]>
x86/CPU/AMD: Move erratum 1076 fix into the Zen1 init function
Borislav Petkov (AMD) <[email protected]>
x86/CPU/AMD: Carve out the erratum 1386 fix
Borislav Petkov (AMD) <[email protected]>
x86/CPU/AMD: Add ZenX generations flags
Filipe Manana <[email protected]>
btrfs: fix race when detecting delalloc ranges during fiemap
Filipe Manana <[email protected]>
btrfs: ensure fiemap doesn't race with writes when FIEMAP_FLAG_SYNC is given
Ingo Molnar <[email protected]>
Revert "x86/mm/ident_map: Use gbpages only where full GB page should be mapped."
Peter Xu <[email protected]>
mm/treewide: replace pud_large() with pud_leaf()
Arnd Bergmann <[email protected]>
dm integrity: fix out-of-range warning
Tejas Upadhyay <[email protected]>
drm/i915/mtl: Update workaround 14018575942
Matt Roper <[email protected]>
drm/i915/xelpg: Extend some workarounds/tuning to gfx version 12.74
Tejas Upadhyay <[email protected]>
drm/i915/mtl: Update workaround 14016712196
Matt Roper <[email protected]>
drm/i915: Replace several IS_METEORLAKE with proper IP version checks
Matt Roper <[email protected]>
drm/i915: Eliminate IS_MTL_GRAPHICS_STEP
Matt Roper <[email protected]>
drm/i915/xelpg: Call Xe_LPG workaround functions based on IP version
Matt Roper <[email protected]>
drm/i915: Consolidate condition for Wa_22011802037
Matt Roper <[email protected]>
drm/i915: Tidy workaround definitions
Matt Roper <[email protected]>
drm/i915/dg2: Drop pre-production GT workarounds
Florian Westphal <[email protected]>
inet: inet_defrag: prevent sk release while still in use
Hariprasad Kelam <[email protected]>
Octeontx2-af: fix pause frame configuration in GMP mode
Raju Lakkaraju <[email protected]>
net: lan743x: Add set RFE read fifo threshold for PCI1x1x chips
Justin Chen <[email protected]>
net: bcmasp: Bring up unimac after PHY link up
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: skip netdev hook unregistration if table is dormant
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: reject table flag and netdev basechain updates
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: reject destroy command to remove basechain hooks
David Howells <[email protected]>
cifs: Fix duplicate fscache cookie warnings
Andrei Matei <[email protected]>
bpf: Protect against int overflow for stack access size
David Thompson <[email protected]>
mlxbf_gige: call request_irq() after NAPI initialized
Sabrina Dubroca <[email protected]>
tls: get psock ref after taking rxlock to avoid leak
Sabrina Dubroca <[email protected]>
tls: adjust recv return with async crypto and failed copy to userspace
Sabrina Dubroca <[email protected]>
tls: recv: process_rx_list shouldn't use an offset with kvec
Jian Shen <[email protected]>
net: hns3: mark unexcuted loopback test result as UNEXECUTED
Yonglong Liu <[email protected]>
net: hns3: fix kernel crash when devlink reload during pf initialization
Jie Wang <[email protected]>
net: hns3: fix index limit to support all queue stats
Nikita Kiryushin <[email protected]>
ACPICA: debugger: check status of acpi_evaluate_object() in acpi_db_walk_for_fields()
Ido Schimmel <[email protected]>
selftests: vxlan_mdb: Fix failures with old libnet
Bjørn Mork <[email protected]>
net: wwan: t7xx: Split 64bit accesses to fix alignment issues
Eric Dumazet <[email protected]>
tcp: properly terminate timers for kernel sockets
Ravi Gunasekaran <[email protected]>
net: hsr: hsr_slave: Fix the promiscuous mode in offload mode
Alexandra Winter <[email protected]>
s390/qeth: handle deferred cc1
Kurt Kanzenbach <[email protected]>
igc: Remove stale comment about Tx timestamping
Przemek Kitszel <[email protected]>
ixgbe: avoid sleeping allocation in ixgbe_ipsec_vf_add_sa()
Jesse Brandeburg <[email protected]>
ice: fix memory corruption bug with suspend and rebuild
Michal Swiatkowski <[email protected]>
ice: realloc VSI stats arrays
Steven Zou <[email protected]>
ice: Refactor FW data type and fix bitmap casting issue
Simon Trimmer <[email protected]>
ALSA: hda: cs35l56: Set the init_done flag before component_add()
Benjamin Berg <[email protected]>
wifi: iwlwifi: mvm: include link ID when releasing frames
Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: disable multi rx queue for 9000
Johannes Berg <[email protected]>
wifi: iwlwifi: mvm: rfi: fix potential response leaks
David Thompson <[email protected]>
mlxbf_gige: stop PHY during open() error paths
Jakub Kicinski <[email protected]>
tools: ynl: fix setting presence bits in simple nests
Ryosuke Yasuoka <[email protected]>
nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet
Artem Savkov <[email protected]>
arm64: bpf: fix 32bit unconditional bswap
Pavel Sakharov <[email protected]>
dma-buf: Fix NULL pointer dereference in sanitycheck()
Puranjay Mohan <[email protected]>
bpf, arm64: fix bug in BPF_LDX_MEMSX
Ilya Leoshkevich <[email protected]>
s390/bpf: Fix bpf_plt pointer arithmetic
Hangbin Liu <[email protected]>
scripts/bpf_doc: Use silent mode when exec make cmd
Ville Syrjälä <[email protected]>
drm/i915: Pre-populate the cursor physical dma address
Maarten Lankhorst <[email protected]>
drm/i915/display: Use i915_gem_object_get_dma_address to get dma address
-------------
Diffstat:
Makefile | 4 +- arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi | 2 + arch/arm64/kernel/ptrace.c | 5 +- arch/arm64/kvm/hyp/pgtable.c | 11 +- arch/arm64/net/bpf_jit_comp.c | 4 +- arch/powerpc/mm/book3s64/pgtable.c | 2 +- arch/riscv/include/asm/uaccess.h | 4 +- arch/riscv/include/uapi/asm/auxvec.h | 2 +- arch/riscv/kernel/patch.c | 8 + arch/riscv/kernel/process.c | 3 - arch/riscv/kvm/aia_aplic.c | 37 +- arch/s390/boot/vmem.c | 2 +- arch/s390/include/asm/pgtable.h | 4 +- arch/s390/kernel/entry.S | 1 + arch/s390/kernel/perf_pai_crypto.c | 48 +-- arch/s390/kernel/perf_pai_ext.c | 43 +-- arch/s390/mm/gmap.c | 2 +- arch/s390/mm/hugetlbpage.c | 4 +- arch/s390/mm/pageattr.c | 2 +- arch/s390/mm/pgtable.c | 2 +- arch/s390/mm/vmem.c | 6 +- arch/s390/net/bpf_jit_comp.c | 46 +-- arch/sparc/mm/init_64.c | 2 +- arch/x86/boot/compressed/Makefile | 2 +- arch/x86/boot/compressed/misc.c | 1 + arch/x86/boot/compressed/sev.c | 3 + arch/x86/coco/core.c | 41 ++ arch/x86/events/amd/core.c | 24 +- arch/x86/events/amd/lbr.c | 16 +- arch/x86/events/intel/ds.c | 8 +- arch/x86/include/asm/asm-prototypes.h | 1 + arch/x86/include/asm/boot.h | 1 + arch/x86/include/asm/coco.h | 2 + arch/x86/include/asm/cpufeature.h | 8 +- arch/x86/include/asm/cpufeatures.h | 16 +- arch/x86/include/asm/disabled-features.h | 3 +- arch/x86/include/asm/init.h | 2 + arch/x86/include/asm/mem_encrypt.h | 8 +- arch/x86/include/asm/nospec-branch.h | 71 ++-- arch/x86/include/asm/required-features.h | 3 +- arch/x86/include/asm/sev.h | 10 +- arch/x86/kernel/cpu/amd.c | 129 +++++-- arch/x86/kernel/cpu/bugs.c | 5 +- arch/x86/kernel/cpu/mce/core.c | 4 +- arch/x86/kernel/cpu/scattered.c | 1 + arch/x86/kernel/head64.c | 3 +- arch/x86/kernel/mpparse.c | 10 +- arch/x86/kernel/setup.c | 2 + arch/x86/kernel/sev-shared.c | 23 +- arch/x86/kernel/sev.c | 14 +- arch/x86/kernel/vmlinux.lds.S | 7 +- arch/x86/kvm/mmu/mmu.c | 2 +- arch/x86/kvm/reverse_cpuid.h | 2 + arch/x86/kvm/svm/sev.c | 45 ++- arch/x86/kvm/trace.h | 10 +- arch/x86/lib/retpoline.S | 165 ++++---- arch/x86/mm/fault.c | 4 +- arch/x86/mm/ident_map.c | 23 +- arch/x86/mm/init_64.c | 4 +- arch/x86/mm/kasan_init_64.c | 2 +- arch/x86/mm/mem_encrypt_identity.c | 44 +-- arch/x86/mm/pat/memtype.c | 49 ++- arch/x86/mm/pat/set_memory.c | 6 +- arch/x86/mm/pgtable.c | 2 +- arch/x86/mm/pti.c | 2 +- arch/x86/net/bpf_jit_comp.c | 2 +- arch/x86/power/hibernate.c | 2 +- arch/x86/xen/mmu_pv.c | 4 +- drivers/acpi/acpica/dbnames.c | 8 +- drivers/ata/sata_mv.c | 63 ++- drivers/ata/sata_sx4.c | 6 +- drivers/base/core.c | 26 +- drivers/base/regmap/regcache-maple.c | 6 +- drivers/bluetooth/btqca.c | 8 +- drivers/bluetooth/hci_qca.c | 19 +- drivers/dma-buf/st-dma-fence-chain.c | 6 +- drivers/firmware/efi/libstub/efi-stub-helper.c | 8 + drivers/firmware/efi/libstub/efistub.h | 2 +- drivers/firmware/efi/libstub/x86-stub.c | 11 +- drivers/gpio/gpiolib-cdev.c | 58 ++- drivers/gpu/drm/amd/amdgpu/amdgpu.h | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 43 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 10 +- .../amd/display/dc/dce110/dce110_hw_sequencer.c | 3 +- drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c | 11 +- drivers/gpu/drm/amd/include/amd_shared.h | 1 + drivers/gpu/drm/drm_prime.c | 7 +- drivers/gpu/drm/i915/Makefile | 1 + drivers/gpu/drm/i915/display/intel_cursor.c | 6 +- drivers/gpu/drm/i915/display/intel_display_types.h | 1 + drivers/gpu/drm/i915/display/intel_fb_pin.c | 10 + drivers/gpu/drm/i915/display/skl_universal_plane.c | 5 +- drivers/gpu/drm/i915/gem/i915_gem_create.c | 4 +- drivers/gpu/drm/i915/gt/gen8_engine_cs.c | 10 +- drivers/gpu/drm/i915/gt/intel_engine_cs.c | 21 +- drivers/gpu/drm/i915/gt/intel_engine_pm.c | 2 +- .../gpu/drm/i915/gt/intel_execlists_submission.c | 4 +- drivers/gpu/drm/i915/gt/intel_gt.h | 31 ++ drivers/gpu/drm/i915/gt/intel_gt_ccs_mode.c | 39 ++ drivers/gpu/drm/i915/gt/intel_gt_ccs_mode.h | 13 + drivers/gpu/drm/i915/gt/intel_gt_mcr.c | 7 +- drivers/gpu/drm/i915/gt/intel_gt_regs.h | 6 + drivers/gpu/drm/i915/gt/intel_lrc.c | 38 +- drivers/gpu/drm/i915/gt/intel_mocs.c | 23 +- drivers/gpu/drm/i915/gt/intel_rc6.c | 6 +- drivers/gpu/drm/i915/gt/intel_reset.c | 20 +- drivers/gpu/drm/i915/gt/intel_reset.h | 2 + drivers/gpu/drm/i915/gt/intel_rps.c | 2 +- drivers/gpu/drm/i915/gt/intel_workarounds.c | 422 +++++++-------------- drivers/gpu/drm/i915/gt/uc/intel_guc.c | 26 +- drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c | 6 +- drivers/gpu/drm/i915/i915_debugfs.c | 2 +- drivers/gpu/drm/i915/i915_drv.h | 4 - drivers/gpu/drm/i915/i915_perf.c | 11 +- drivers/gpu/drm/i915/intel_clock_gating.c | 8 - drivers/gpu/drm/nouveau/nouveau_uvmm.c | 6 +- drivers/gpu/drm/panfrost/panfrost_gpu.c | 6 +- drivers/md/dm-integrity.c | 2 +- drivers/net/dsa/mv88e6xxx/chip.c | 6 +- drivers/net/dsa/sja1105/sja1105_mdio.c | 2 +- drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c | 28 +- drivers/net/ethernet/freescale/fec_main.c | 11 +- .../hns3/hns3_common/hclge_comm_tqp_stats.c | 2 +- drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c | 19 +- .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 4 + drivers/net/ethernet/intel/e1000/e1000_hw.c | 46 +-- drivers/net/ethernet/intel/e1000e/80003es2lan.c | 3 +- drivers/net/ethernet/intel/e1000e/82571.c | 3 +- drivers/net/ethernet/intel/e1000e/ethtool.c | 7 +- drivers/net/ethernet/intel/e1000e/hw.h | 2 + drivers/net/ethernet/intel/e1000e/ich8lan.c | 56 +-- drivers/net/ethernet/intel/e1000e/mac.c | 2 +- drivers/net/ethernet/intel/e1000e/netdev.c | 35 +- drivers/net/ethernet/intel/e1000e/phy.c | 191 ++++++---- drivers/net/ethernet/intel/e1000e/phy.h | 2 + drivers/net/ethernet/intel/fm10k/fm10k_pf.c | 4 +- drivers/net/ethernet/intel/fm10k/fm10k_vf.c | 10 +- drivers/net/ethernet/intel/i40e/i40e.h | 63 ++- drivers/net/ethernet/intel/i40e/i40e_adminq.c | 8 +- drivers/net/ethernet/intel/i40e/i40e_adminq.h | 3 +- drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h | 2 + drivers/net/ethernet/intel/i40e/i40e_alloc.h | 24 +- drivers/net/ethernet/intel/i40e/i40e_client.c | 1 - drivers/net/ethernet/intel/i40e/i40e_common.c | 12 +- drivers/net/ethernet/intel/i40e/i40e_dcb.c | 4 +- drivers/net/ethernet/intel/i40e/i40e_dcb_nl.c | 2 +- drivers/net/ethernet/intel/i40e/i40e_ddp.c | 2 +- drivers/net/ethernet/intel/i40e/i40e_debug.h | 47 +++ drivers/net/ethernet/intel/i40e/i40e_debugfs.c | 3 +- drivers/net/ethernet/intel/i40e/i40e_diag.h | 5 +- drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 3 +- drivers/net/ethernet/intel/i40e/i40e_hmc.c | 16 +- drivers/net/ethernet/intel/i40e/i40e_hmc.h | 4 + drivers/net/ethernet/intel/i40e/i40e_io.h | 16 + drivers/net/ethernet/intel/i40e/i40e_lan_hmc.c | 9 +- drivers/net/ethernet/intel/i40e/i40e_lan_hmc.h | 2 + drivers/net/ethernet/intel/i40e/i40e_main.c | 70 ++-- drivers/net/ethernet/intel/i40e/i40e_nvm.c | 3 + drivers/net/ethernet/intel/i40e/i40e_osdep.h | 59 --- drivers/net/ethernet/intel/i40e/i40e_prototype.h | 4 +- drivers/net/ethernet/intel/i40e/i40e_ptp.c | 9 +- drivers/net/ethernet/intel/i40e/i40e_register.h | 5 + drivers/net/ethernet/intel/i40e/i40e_txrx.c | 89 +++-- drivers/net/ethernet/intel/i40e/i40e_txrx.h | 6 +- drivers/net/ethernet/intel/i40e/i40e_txrx_common.h | 2 + drivers/net/ethernet/intel/i40e/i40e_type.h | 54 +-- drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 47 +-- drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h | 4 +- drivers/net/ethernet/intel/i40e/i40e_xsk.c | 4 - drivers/net/ethernet/intel/i40e/i40e_xsk.h | 4 + drivers/net/ethernet/intel/iavf/iavf_common.c | 3 +- drivers/net/ethernet/intel/iavf/iavf_ethtool.c | 5 +- drivers/net/ethernet/intel/iavf/iavf_fdir.c | 1 + drivers/net/ethernet/intel/iavf/iavf_txrx.c | 1 + drivers/net/ethernet/intel/ice/ice_adminq_cmd.h | 3 +- drivers/net/ethernet/intel/ice/ice_lag.c | 4 +- drivers/net/ethernet/intel/ice/ice_lib.c | 74 ++-- drivers/net/ethernet/intel/ice/ice_switch.c | 24 +- drivers/net/ethernet/intel/ice/ice_switch.h | 4 +- .../net/ethernet/intel/ice/ice_vf_vsi_vlan_ops.c | 18 +- drivers/net/ethernet/intel/igb/e1000_82575.c | 29 +- drivers/net/ethernet/intel/igb/e1000_i210.c | 19 +- drivers/net/ethernet/intel/igb/e1000_mac.c | 2 +- drivers/net/ethernet/intel/igb/e1000_nvm.c | 18 +- drivers/net/ethernet/intel/igb/e1000_phy.c | 13 +- drivers/net/ethernet/intel/igb/igb_ethtool.c | 8 +- drivers/net/ethernet/intel/igb/igb_main.c | 4 +- drivers/net/ethernet/intel/igbvf/mbx.c | 1 + drivers/net/ethernet/intel/igbvf/netdev.c | 33 +- drivers/net/ethernet/intel/igc/igc_i225.c | 1 + drivers/net/ethernet/intel/igc/igc_main.c | 4 - drivers/net/ethernet/intel/igc/igc_phy.c | 1 + drivers/net/ethernet/intel/ixgbe/ixgbe_common.c | 30 +- drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c | 16 +- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 2 +- drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c | 8 +- drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c | 8 +- drivers/net/ethernet/intel/ixgbe/ixgbe_x540.c | 8 +- drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c | 19 +- drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 5 + .../net/ethernet/marvell/octeontx2/af/rvu_cgx.c | 2 + .../net/ethernet/marvell/octeontx2/af/rvu_npc.c | 2 +- .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 2 +- .../ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c | 31 +- drivers/net/ethernet/microchip/lan743x_main.c | 18 + drivers/net/ethernet/microchip/lan743x_main.h | 4 + drivers/net/ethernet/microsoft/mana/mana_en.c | 2 +- drivers/net/ethernet/realtek/r8169_main.c | 40 +- drivers/net/ethernet/renesas/ravb_main.c | 33 +- drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 40 +- .../net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 38 +- drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c | 8 +- drivers/net/phy/micrel.c | 31 +- drivers/net/usb/ax88179_178a.c | 2 + drivers/net/wireless/intel/iwlwifi/iwl-trans.h | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 4 +- drivers/net/wireless/intel/iwlwifi/mvm/rfi.c | 8 +- drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 31 +- drivers/net/wwan/t7xx/t7xx_cldma.c | 4 +- drivers/net/wwan/t7xx/t7xx_hif_cldma.c | 9 +- drivers/net/wwan/t7xx/t7xx_pcie_mac.c | 8 +- drivers/net/xen-netfront.c | 1 + drivers/of/dynamic.c | 12 + drivers/of/module.c | 8 + drivers/perf/riscv_pmu.c | 4 + drivers/s390/net/qeth_core_main.c | 38 +- drivers/scsi/myrb.c | 20 +- drivers/scsi/myrs.c | 24 +- drivers/scsi/sd.c | 2 +- drivers/scsi/sg.c | 4 +- drivers/spi/spi-pci1xxxx.c | 2 + drivers/spi/spi-s3c64xx.c | 80 ++-- drivers/usb/typec/ucsi/ucsi.c | 10 +- drivers/usb/typec/ucsi/ucsi_glink.c | 14 + fs/btrfs/extent_io.c | 208 +++++++--- fs/btrfs/inode.c | 22 +- fs/nfsd/nfs4state.c | 7 +- fs/pipe.c | 17 +- fs/smb/client/cached_dir.c | 6 +- fs/smb/client/cifs_debug.c | 6 + fs/smb/client/cifsfs.c | 11 + fs/smb/client/cifsglob.h | 17 +- fs/smb/client/connect.c | 45 ++- fs/smb/client/dir.c | 15 + fs/smb/client/file.c | 111 +++++- fs/smb/client/fs_context.c | 6 +- fs/smb/client/fs_context.h | 12 + fs/smb/client/fscache.c | 16 +- fs/smb/client/fscache.h | 6 + fs/smb/client/inode.c | 2 + fs/smb/client/ioctl.c | 6 +- fs/smb/client/misc.c | 2 + fs/smb/client/smb1ops.c | 4 +- fs/smb/client/smb2misc.c | 4 + fs/smb/client/smb2ops.c | 11 +- fs/smb/client/smb2pdu.c | 2 +- fs/smb/server/ksmbd_netlink.h | 3 +- fs/smb/server/mgmt/share_config.c | 7 +- fs/smb/server/smb2ops.c | 10 +- fs/smb/server/smb2pdu.c | 3 +- fs/smb/server/transport_ipc.c | 37 ++ fs/vboxsf/super.c | 3 +- include/kvm/arm_pmu.h | 2 +- include/linux/avf/virtchnl.h | 5 + include/linux/bpf.h | 16 +- include/linux/device.h | 1 + include/linux/io_uring_types.h | 1 - include/linux/secretmem.h | 4 +- include/linux/skbuff.h | 7 +- include/linux/udp.h | 28 ++ include/net/bluetooth/hci.h | 9 + include/net/inet_connection_sock.h | 1 + include/net/mana/mana.h | 1 - include/net/sock.h | 7 + io_uring/io_uring.c | 18 +- io_uring/kbuf.c | 116 ++---- io_uring/kbuf.h | 8 +- kernel/bpf/syscall.c | 35 +- kernel/bpf/verifier.c | 5 + kernel/trace/bpf_trace.c | 10 +- mm/memory.c | 4 + net/9p/client.c | 10 +- net/ax25/ax25_dev.c | 2 +- net/bluetooth/hci_debugfs.c | 64 ++-- net/bluetooth/hci_event.c | 25 ++ net/bluetooth/hci_sync.c | 5 +- net/bridge/netfilter/ebtables.c | 6 + net/core/gro.c | 3 +- net/core/sock_map.c | 6 + net/hsr/hsr_slave.c | 3 +- net/ipv4/inet_connection_sock.c | 33 +- net/ipv4/inet_fragment.c | 70 +++- net/ipv4/ip_fragment.c | 2 +- net/ipv4/ip_gre.c | 5 + net/ipv4/netfilter/arp_tables.c | 4 + net/ipv4/netfilter/ip_tables.c | 4 + net/ipv4/tcp.c | 2 + net/ipv4/udp.c | 7 + net/ipv4/udp_offload.c | 23 +- net/ipv6/ip6_fib.c | 14 +- net/ipv6/ip6_gre.c | 3 + net/ipv6/netfilter/ip6_tables.c | 4 + net/ipv6/netfilter/nf_conntrack_reasm.c | 2 +- net/ipv6/udp.c | 2 +- net/ipv6/udp_offload.c | 8 +- net/mptcp/protocol.c | 106 ++---- net/mptcp/subflow.c | 2 + net/netfilter/nf_tables_api.c | 92 ++++- net/nfc/nci/core.c | 5 + net/rds/rdma.c | 2 +- net/sched/act_skbmod.c | 10 +- net/sched/sch_api.c | 2 +- net/sunrpc/svcsock.c | 10 +- net/tls/tls_sw.c | 7 +- net/vmw_vsock/virtio_transport.c | 3 +- scripts/bpf_doc.py | 4 +- scripts/mod/Makefile | 4 +- scripts/mod/modpost.c | 73 +--- scripts/mod/modpost.h | 25 ++ scripts/mod/symsearch.c | 199 ++++++++++ security/selinux/selinuxfs.c | 12 +- sound/pci/emu10k1/emu10k1_callback.c | 7 +- sound/pci/hda/cs35l56_hda.c | 4 +- sound/pci/hda/cs35l56_hda_i2c.c | 13 +- sound/pci/hda/cs35l56_hda_spi.c | 13 +- sound/pci/hda/patch_realtek.c | 3 +- sound/soc/amd/acp/acp-pci.c | 5 +- sound/soc/codecs/rt5682-sdw.c | 4 +- sound/soc/codecs/rt711-sdca-sdw.c | 4 +- sound/soc/codecs/rt711-sdw.c | 4 +- sound/soc/codecs/rt712-sdca-sdw.c | 5 +- sound/soc/codecs/rt722-sdca-sdw.c | 4 +- sound/soc/codecs/wm_adsp.c | 3 +- sound/soc/soc-ops.c | 2 +- sound/soc/sof/amd/acp.c | 8 +- tools/arch/x86/include/asm/cpufeatures.h | 2 +- tools/net/ynl/ynl-gen-c.py | 7 +- tools/testing/selftests/mm/vm_util.h | 2 +- tools/testing/selftests/net/mptcp/mptcp_connect.sh | 85 +++-- tools/testing/selftests/net/mptcp/mptcp_join.sh | 4 +- tools/testing/selftests/net/reuseaddr_conflict.c | 2 +- tools/testing/selftests/net/test_vxlan_mdb.sh | 205 ++++++---- tools/testing/selftests/net/udpgro_fwd.sh | 10 +- 343 files changed, 3828 insertions(+), 2302 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/252 drm/i915/display: Use i915_gem_object_get_dma_address to get dma address
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maarten Lankhorst <[email protected]>
[ Upstream commit 7054b551de18e9875fbdf8d4f3baade428353545 ]
Works better for xe like that. obj is no longer const.
Stable-dep-of: 582dc04b0658 ("drm/i915: Pre-populate the cursor physical dma address")
--- drivers/gpu/drm/i915/display/intel_cursor.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/gpu/drm/i915/display/intel_cursor.c +4 -2
@@ -23,6 +23,8 @@#include "intel_psr.h" #include "skl_watermark.h" +#include "gem/i915_gem_object.h" +/* Cursor formats */ static const u32 intel_cursor_formats[] = {DRM_FORMAT_ARGB8888 ,
@@ -33,11 +35,11 @@ static u32 intel_cursor_base(const struct intel_plane_state *plane_state)struct drm_i915_private *dev_priv =to_i915 (plane_state->uapi.plane->dev);const struct drm_framebuffer *fb = plane_state->hw.fb; -const struct drm_i915_gem_object *obj =intel_fb_obj (fb); +struct drm_i915_gem_object *obj =intel_fb_obj (fb);u32 base;if (DISPLAY_INFO (dev_priv)->cursor_needs_physical) - base =sg_dma_address (obj->mm.pages->sgl); + base =i915_gem_object_get_dma_address (obj,0 );else base =intel_plane_ggtt_offset (plane_state);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 2/252 drm/i915: Pre-populate the cursor physical dma address
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ville Syrjälä <[email protected]>
[ Upstream commit 582dc04b0658ef3b90aeb49cbdd9747c2f1eccc3 ]
Calling i915_gem_object_get_dma_address() from the vblank evade critical section triggers might_sleep().
While we know that we've already pinned the framebuffer and thus i915_gem_object_get_dma_address() will in fact not sleep in this case, it seems reasonable to keep the unconditional might_sleep() for maximum coverage.
So let's instead pre-populate the dma address during fb pinning, which all happens before we enter the vblank evade critical section.
We can use u32 for the dma address as this class of hardware doesn't support >32bit addresses.
--- drivers/gpu/drm/i915/display/intel_cursor.c | 4 +--- drivers/gpu/drm/i915/display/intel_display_types.h | 1 + drivers/gpu/drm/i915/display/intel_fb_pin.c | 10 ++++++++++ 3 files changed, 12 insertions(+), 3 deletions(-)
drivers/gpu/drm/i915/display/intel_cursor.c +1 -3
@@ -34,12 +34,10 @@ static u32 intel_cursor_base(const struct intel_plane_state *plane_state) {struct drm_i915_private *dev_priv =to_i915 (plane_state->uapi.plane->dev); -const struct drm_framebuffer *fb = plane_state->hw.fb; -struct drm_i915_gem_object *obj =intel_fb_obj (fb);u32 base;if (DISPLAY_INFO (dev_priv)->cursor_needs_physical) - base =i915_gem_object_get_dma_address (obj,0 ); + base = plane_state->phys_dma_addr;else base =intel_plane_ggtt_offset (plane_state);
drivers/gpu/drm/i915/display/intel_display_types.h +1 -0
@@ -701,6 +701,7 @@ struct intel_plane_state {#define PLANE_HAS_FENCE BIT(0)struct intel_fb_view view; +u32 phys_dma_addr;/* for cursor_needs_physical */ /* Plane pxp decryption state */ bool decrypt;
drivers/gpu/drm/i915/display/intel_fb_pin.c +10 -0
@@ -254,6 +254,16 @@ int intel_plane_pin_fb(struct intel_plane_state *plane_state)return PTR_ERR (vma); plane_state->ggtt_vma = vma; + +/* +* Pre-populate the dma address before we enter the vblank +* evade critical section as i915_gem_object_get_dma_address() +* will trigger might_sleep() even if it won't actually sleep, +* which is the case when the fb has already been pinned. +*/ +if (phys_cursor) + plane_state->phys_dma_addr = +i915_gem_object_get_dma_address (intel_fb_obj (fb),0 ); }else {struct intel_framebuffer *intel_fb =to_intel_framebuffer (fb);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 3/252 scripts/bpf_doc: Use silent mode when exec make cmd
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <[email protected]>
[ Upstream commit 5384cc0d1a88c27448a6a4e65b8abe6486de8012 ]
When getting kernel version via make, the result may be polluted by other output, like directory change info. e.g.
$ export MAKEFLAGS="-w" $ make kernelversion make: Entering directory '/home/net' 6.8.0 make: Leaving directory '/home/net'
This will distort the reStructuredText output and make latter rst2man failed like:
[...]
bpf-helpers.rst:20: (WARNING/2) Field list ends without a blank line; unexpected unindent. [...]
Using silent mode would help. e.g.
$ make -s --no-print-directory kernelversion 6.8.0
--- scripts/bpf_doc.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
scripts/bpf_doc.py +2 -2
@@ -414,8 +414,8 @@ class PrinterRST(Printer): version = version.stdout.decode().rstrip() except: try: - version = subprocess.run(['make', 'kernelversion'], cwd=linuxRoot, - capture_output=True, check=True) + version = subprocess.run(['make', '-s', '--no-print-directory', 'kernelversion'], + cwd=linuxRoot, capture_output=True, check=True) version = version.stdout.decode().rstrip() except: return 'Linux'
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 4/252 s390/bpf: Fix bpf_plt pointer arithmetic
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Leoshkevich <[email protected]>
[ Upstream commit 7ded842b356d151ece8ac4985940438e6d3998bb ]
Kui-Feng Lee reported a crash on s390x triggered by the dummy_st_ops/dummy_init_ptr_arg test [1]:
[<0000000000000002>] 0x2
[<00000000009d5cde>] bpf_struct_ops_test_run+0x156/0x250 [<000000000033145a>] __sys_bpf+0xa1a/0xd00 [<00000000003319dc>] __s390x_sys_bpf+0x44/0x50 [<0000000000c4382c>] __do_syscall+0x244/0x300 [<0000000000c59a40>] system_call+0x70/0x98
This is caused by GCC moving memcpy() after assignments in bpf_jit_plt(), resulting in NULL pointers being written instead of the return and the target addresses.
Looking at the GCC internals, the reordering is allowed because the alias analysis thinks that the memcpy() destination and the assignments' left-hand-sides are based on different objects: new_plt and bpf_plt_ret/bpf_plt_target respectively, and therefore they cannot alias.
This is in turn due to a violation of the C standard:
When two pointers are subtracted, both shall point to elements of the same array object, or one past the last element of the array object
...
Quoted 1 line
From the C's perspective,
bpf_plt_retandbpf_pltare distinct objects
and cannot be subtracted. In the practical terms, doing so confuses the GCC's alias analysis.
The code was written this way in order to let the C side know a few offsets defined in the assembly. While nice, this is by no means necessary. Fix the noncompliance by hardcoding these offsets.
[1] https://lore.kernel.org/bpf/[email protected]/
Message-ID: <[email protected]>
--- arch/s390/net/bpf_jit_comp.c | 46 ++++++++++++++++-------------------- 1 file changed, 20 insertions(+), 26 deletions(-)
arch/s390/net/bpf_jit_comp.c +20 -26
@@ -516,11 +516,12 @@ static void bpf_skip(struct bpf_jit *jit, int size)* PLT for hotpatchable calls. The calling convention is the same as for the * ftrace hotpatch trampolines: %r0 is return address, %r1 is clobbered. */ -extern const char bpf_plt[]; -extern const char bpf_plt_ret[]; -extern const char bpf_plt_target[]; -extern const char bpf_plt_end[]; -#define BPF_PLT_SIZE 32 +struct bpf_plt { +char code[16 ]; +void *ret; +void *target; +} __packed; +extern const struct bpf_plt bpf_plt; asm(".pushsection .rodata\n" " .balign 8\n"
@@ -531,15 +532,14 @@ asm(" .balign 8\n" "bpf_plt_ret: .quad 0\n" "bpf_plt_target: .quad 0\n" -"bpf_plt_end:\n" " .popsection\n" ); -static void bpf_jit_plt (void *plt,void *ret,void *target) +static void bpf_jit_plt (struct bpf_plt *plt,void *ret,void *target) { -memcpy (plt, bpf_plt,BPF_PLT_SIZE ); - *(void **)((char *)plt + (bpf_plt_ret - bpf_plt)) = ret; - *(void **)((char *)plt + (bpf_plt_target - bpf_plt)) = target ?: ret; +memcpy (plt, &bpf_plt,sizeof (*plt)); + plt->ret = ret; + plt->target = target; }/*
@@ -662,9 +662,9 @@ static void bpf_jit_epilogue(struct bpf_jit *jit, u32 stack_depth) jit->prg =ALIGN (jit->prg,8 ); jit->prologue_plt = jit->prg;if (jit->prg_buf) -bpf_jit_plt (jit->prg_buf + jit->prg, +bpf_jit_plt ((struct bpf_plt *)(jit->prg_buf + jit->prg), jit->prg_buf + jit->prologue_plt_ret,NULL ); - jit->prg +=BPF_PLT_SIZE ; + jit->prg +=sizeof (struct bpf_plt ); }static int get_probe_mem_regno (const u8 *insn)
@@ -1901,9 +1901,6 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp)struct bpf_jit jit;int pass; -if (WARN_ON_ONCE (bpf_plt_end - bpf_plt !=BPF_PLT_SIZE )) -return orig_fp; -if (!fp->jit_requested)return orig_fp;
@@ -2009,14 +2006,11 @@ bool bpf_jit_supports_far_kfunc_call(void)int bpf_arch_text_poke (void *ip,enum bpf_text_poke_type t,void *old_addr,void *new_addr) { +struct bpf_plt expected_plt, current_plt, new_plt, *plt;struct {u16 opc;s32 disp; } __packed insn; -char expected_plt[BPF_PLT_SIZE ]; -char current_plt[BPF_PLT_SIZE ]; -char new_plt[BPF_PLT_SIZE ]; -char *plt;char *ret;int err;
@@ -2035,18 +2029,18 @@ int bpf_arch_text_poke(void *ip, enum bpf_text_poke_type t,*/ }else {/* Verify the PLT. */ - plt = (char *)ip + (insn.disp <<1 ); - err =copy_from_kernel_nofault (current_plt, plt,BPF_PLT_SIZE ); + plt = ip + (insn.disp <<1 ); + err =copy_from_kernel_nofault (¤t_plt, plt, +sizeof (current_plt));if (err <0 )return err; ret = (char *)ip +6 ; -bpf_jit_plt (expected_plt, ret, old_addr); -if (memcmp (current_plt, expected_plt,BPF_PLT_SIZE )) +bpf_jit_plt (&expected_plt, ret, old_addr); +if (memcmp (¤t_plt, &expected_plt,sizeof (current_plt)))return -EINVAL ;/* Adjust the call address. */ -bpf_jit_plt (new_plt, ret, new_addr); -s390_kernel_write (plt + (bpf_plt_target - bpf_plt), - new_plt + (bpf_plt_target - bpf_plt), +bpf_jit_plt (&new_plt, ret, new_addr); +s390_kernel_write (&plt->target, &new_plt.target,sizeof (void *)); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 5/252 bpf, arm64: fix bug in BPF_LDX_MEMSX
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Puranjay Mohan <[email protected]>
[ Upstream commit 114b5b3b4bde7358624437be2f12cde1b265224e ]
A64_LDRSW() takes three registers: Xt, Xn, Xm as arguments and it loads and sign extends the value at address Xn + Xm into register Xt.
Currently, the offset is being directly used in place of the tmp register which has the offset already loaded by the last emitted instruction.
This will cause JIT failures. The easiest way to reproduce this is to test the following code through test_bpf module:
{
"BPF_LDX_MEMSX | BPF_W",
.u.insns_int = {
BPF_LD_IMM64(R1, 0x00000000deadbeefULL),
BPF_LD_IMM64(R2, 0xffffffffdeadbeefULL),
BPF_STX_MEM(BPF_DW, R10, R1, -7),
BPF_LDX_MEMSX(BPF_W, R0, R10, -7),
BPF_JMP_REG(BPF_JNE, R0, R2, 1),
BPF_ALU64_IMM(BPF_MOV, R0, 0),
BPF_EXIT_INSN(),
},
INTERNAL,
{ },
{ { 0, 0 } },
.stack_depth = 7,
},We need to use the offset as -7 to trigger this code path, there could be other valid ways to trigger this from proper BPF programs as well.
This code is rejected by the JIT because -7 is passed to A64_LDRSW() but it expects a valid register (0 - 31).
roott@pjy:~# modprobe test_bpf test_name="BPF_LDX_MEMSX | BPF_W" [11300.490371] test_bpf: test_bpf: set 'test_bpf' as the default test_suite. [11300.491750] test_bpf: #345 BPF_LDX_MEMSX | BPF_W [11300.493179] aarch64_insn_encode_register: unknown register encoding -7 [11300.494133] aarch64_insn_encode_register: unknown register encoding -7 [11300.495292] FAIL to select_runtime err=-524 [11300.496804] test_bpf: Summary: 0 PASSED, 1 FAILED, [0/0 JIT'ed] modprobe: ERROR: could not insert 'test_bpf': Invalid argument
Applying this patch fixes the issue.
root@pjy:~# modprobe test_bpf test_name="BPF_LDX_MEMSX | BPF_W" [ 292.837436] test_bpf: test_bpf: set 'test_bpf' as the default test_suite. [ 292.839416] test_bpf: #345 BPF_LDX_MEMSX | BPF_W jited:1 156 PASS [ 292.844794] test_bpf: Summary: 1 PASSED, 0 FAILED, [1/1 JIT'ed]
Message-ID: <[email protected]>
--- arch/arm64/net/bpf_jit_comp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/net/bpf_jit_comp.c +1 -1
@@ -1189,7 +1189,7 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx, }else {emit_a64_mov_i (1 , tmp, off, ctx);if (sign_extend) -emit (A64_LDRSW (dst, src_adj, off_adj), ctx); +emit (A64_LDRSW (dst, src, tmp), ctx);else emit (A64_LDR32 (dst, src, tmp), ctx); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 6/252 dma-buf: Fix NULL pointer dereference in sanitycheck()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Sakharov <[email protected]>
[ Upstream commit 2295bd846765c766701e666ed2e4b35396be25e6 ]
If due to a memory allocation failure mock_chain() returns NULL, it is passed to dma_fence_enable_sw_signaling() resulting in NULL pointer dereference there.
Call dma_fence_enable_sw_signaling() only if mock_chain() succeeds.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/dma-buf/st-dma-fence-chain.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/dma-buf/st-dma-fence-chain.c +3 -3
@@ -84,11 +84,11 @@ static int sanitycheck(void *arg)return -ENOMEM ; chain =mock_chain (NULL , f,1 ); -if (!chain) +if (chain) +dma_fence_enable_sw_signaling (chain); +else err = -ENOMEM ; -dma_fence_enable_sw_signaling (chain); -dma_fence_signal (f);dma_fence_put (f);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 7/252 arm64: bpf: fix 32bit unconditional bswap
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Artem Savkov <[email protected]>
[ Upstream commit a51cd6bf8e10793103c5870ff9e4db295a843604 ]
In case when is64 == 1 in emit(A64_REV32(is64, dst, dst), ctx) the generated insn reverses byte order for both high and low 32-bit words, resuling in an incorrect swap as indicated by the jit test:
[ 9757.262607] test_bpf: #312 BSWAP 16: 0x0123456789abcdef -> 0xefcd jited:1 8 PASS [ 9757.264435] test_bpf: #313 BSWAP 32: 0x0123456789abcdef -> 0xefcdab89 jited:1 ret 1460850314 != -271733879 (0x5712ce8a != 0xefcdab89)FAIL (1 times) [ 9757.266260] test_bpf: #314 BSWAP 64: 0x0123456789abcdef -> 0x67452301 jited:1 8 PASS [ 9757.268000] test_bpf: #315 BSWAP 64: 0x0123456789abcdef >> 32 -> 0xefcdab89 jited:1 8 PASS [ 9757.269686] test_bpf: #316 BSWAP 16: 0xfedcba9876543210 -> 0x1032 jited:1 8 PASS [ 9757.271380] test_bpf: #317 BSWAP 32: 0xfedcba9876543210 -> 0x10325476 jited:1 ret -1460850316 != 271733878 (0xa8ed3174 != 0x10325476)FAIL (1 times) [ 9757.273022] test_bpf: #318 BSWAP 64: 0xfedcba9876543210 -> 0x98badcfe jited:1 7 PASS [ 9757.274721] test_bpf: #319 BSWAP 64: 0xfedcba9876543210 >> 32 -> 0x10325476 jited:1 9 PASS
Fix this by forcing 32bit variant of rev32.
Message-ID: <[email protected]>
--- arch/arm64/net/bpf_jit_comp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/net/bpf_jit_comp.c +1 -1
@@ -876,7 +876,7 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx,emit (A64_UXTH (is64, dst, dst), ctx);break ;case 32 : -emit (A64_REV32 (is64, dst, dst), ctx); +emit (A64_REV32 (0 , dst, dst), ctx);/* upper 32 bits already cleared */ break ;case 64 :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 8/252 nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryosuke Yasuoka <[email protected]>
[ Upstream commit d24b03535e5eb82e025219c2f632b485409c898f ]
syzbot reported the following uninit-value access issue [1][2]:
nci_rx_work() parses and processes received packet. When the payload length is zero, each message type handler reads uninitialized payload and KMSAN detects this issue. The receipt of a packet with a zero-size payload is considered unexpected, and therefore, such packets should be silently discarded.
This patch resolved this issue by checking payload size before calling each message type handler codes.
--- net/nfc/nci/core.c | 5 +++++ 1 file changed, 5 insertions(+)
net/nfc/nci/core.c +5 -0
@@ -1516,6 +1516,11 @@ static void nci_rx_work(struct work_struct *work)nfc_send_to_raw_sock (ndev->nfc_dev, skb,RAW_PAYLOAD_NCI ,NFC_DIRECTION_RX ); +if (!nci_plen (skb->data)) { +kfree_skb (skb); +break ; + } +/* Process frame */ switch (nci_mt (skb->data)) {case NCI_MT_RSP_PKT :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 9/252 tools: ynl: fix setting presence bits in simple nests
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit f6c8f5e8694c7a78c94e408b628afa6255cc428a ]
When we set members of simple nested structures in requests we need to set "presence" bits for all the nesting layers below. This has nothing to do with the presence type of the last layer.
--- tools/net/ynl/ynl-gen-c.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
tools/net/ynl/ynl-gen-c.py +5 -2
@@ -198,8 +198,11 @@ class Type(SpecAttr): presence = '' for i in range(0, len(ref)): presence = f"{var}->{'.'.join(ref[:i] + [''])}_present.{ref[i]}" - if self.presence_type() == 'bit': - code.append(presence + ' = 1;') + # Every layer below last is a nest, so we know it uses bit presence + # last layer is "self" and may be a complex type + if i == len(ref) - 1 and self.presence_type() != 'bit': + continue + code.append(presence + ' = 1;') code += self._setter_lines(ri, member, presence) func_name = f"{op_prefix(ri, direction, deref=deref)}_set_{'_'.join(ref)}"
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 10/252 mlxbf_gige: stop PHY during open() error paths
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Thompson <[email protected]>
[ Upstream commit d6c30c5a168f8586b8bcc0d8e42e2456eb05209b ]
The mlxbf_gige_open() routine starts the PHY as part of normal initialization. The mlxbf_gige_open() routine must stop the PHY during its error paths.
--- drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c +4 -1
@@ -157,7 +157,7 @@ static int mlxbf_gige_open(struct net_device *netdev) err =mlxbf_gige_tx_init (priv);if (err) - goto free_irqs; + goto phy_deinit; err =mlxbf_gige_rx_init (priv);if (err) goto tx_deinit;
@@ -185,6 +185,9 @@ static int mlxbf_gige_open(struct net_device *netdev) tx_deinit:mlxbf_gige_tx_deinit (priv); +phy_deinit: +phy_stop (phydev); + free_irqs:mlxbf_gige_free_irqs (priv);return err;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 11/252 wifi: iwlwifi: mvm: rfi: fix potential response leaks
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 06a093807eb7b5c5b29b6cff49f8174a4e702341 ]
If the rx payload length check fails, or if kmemdup() fails, we still need to free the command response. Fix that.
--- drivers/net/wireless/intel/iwlwifi/mvm/rfi.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/net/wireless/intel/iwlwifi/mvm/rfi.c +6 -2
@@ -132,14 +132,18 @@ struct iwl_rfi_freq_table_resp_cmd *iwl_rfi_get_freq_table(struct iwl_mvm *mvm)if (ret)return ERR_PTR (ret); -if (WARN_ON_ONCE (iwl_rx_packet_payload_len (cmd.resp_pkt) != resp_size)) +if (WARN_ON_ONCE (iwl_rx_packet_payload_len (cmd.resp_pkt) != + resp_size)) { +iwl_free_resp (&cmd);return ERR_PTR (-EIO ); + } resp =kmemdup (cmd.resp_pkt->data, resp_size,GFP_KERNEL ); +iwl_free_resp (&cmd); +if (!resp)return ERR_PTR (-ENOMEM ); -iwl_free_resp (&cmd);return resp; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 12/252 wifi: iwlwifi: disable multi rx queue for 9000
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
[ Upstream commit 29fa9a984b6d1075020f12071a89897fd62ed27f ]
Multi rx queue allows to spread the load of the Rx streams on different CPUs. 9000 series required complex synchronization mechanisms from the driver side since the hardware / firmware is not able to provide information about duplicate packets and timeouts inside the reordering buffer.
Users have complained that for newer devices, all those synchronization mechanisms have caused spurious packet drops. Those packet drops disappeared if we simplify the code, but unfortunately, we can't have RSS enabled on 9000 series without this complex code.
Remove support for RSS on 9000 so that we can make the code much simpler for newer devices and fix the bugs for them.
The down side of this patch is a that all the Rx path will be routed to a single CPU, but this has never been an issue, the modern CPUs are just fast enough to cope with all the traffic.
Stable-dep-of: e78d78773089 ("wifi: iwlwifi: mvm: include link ID when releasing frames")
--- drivers/net/wireless/intel/iwlwifi/iwl-trans.h | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 4 +++- drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 11 ++++++++++- 3 files changed, 14 insertions(+), 3 deletions(-)
drivers/net/wireless/intel/iwlwifi/iwl-trans.h +1 -1
@@ -278,7 +278,7 @@ static inline void iwl_free_rxb(struct iwl_rx_cmd_buffer *r)#define IWL_MGMT_TID 15#define IWL_FRAME_LIMIT 64#define IWL_MAX_RX_HW_QUEUES 16 -#define IWL_9000_MAX_RX_HW_QUEUES 6 +#define IWL_9000_MAX_RX_HW_QUEUES 1/** * enum iwl_wowlan_status - WoWLAN image/device status
drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +3 -1
@@ -352,7 +352,9 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)ieee80211_hw_set (hw,HAS_RATE_CONTROL ); } -if (iwl_mvm_has_new_rx_api (mvm)) +/* We want to use the mac80211's reorder buffer for 9000 */ +if (iwl_mvm_has_new_rx_api (mvm) && + mvm->trans->trans_cfg->device_family >IWL_DEVICE_FAMILY_9000 )ieee80211_hw_set (hw,SUPPORTS_REORDERING_BUFFER ); if (fw_has_capa(&mvm->fw->ucode_capa,
drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c +10 -1
@@ -963,6 +963,9 @@ static bool iwl_mvm_reorder(struct iwl_mvm *mvm, baid = (reorder &IWL_RX_MPDU_REORDER_BAID_MASK ) >>IWL_RX_MPDU_REORDER_BAID_SHIFT ; +if (mvm->trans->trans_cfg->device_family ==IWL_DEVICE_FAMILY_9000 ) +return false; +/* * This also covers the case of receiving a Block Ack Request * outside a BA session; we'll pass it to mac80211 and that
@@ -2621,9 +2624,15 @@ void iwl_mvm_rx_mpdu_mq(struct iwl_mvm *mvm, struct napi_struct *napi,if (!iwl_mvm_reorder (mvm, napi, queue, sta, skb, desc) &&likely (!iwl_mvm_time_sync_frame (mvm, skb, hdr->addr2)) && -likely (!iwl_mvm_mei_filter_scan (mvm, skb))) +likely (!iwl_mvm_mei_filter_scan (mvm, skb))) { +if (mvm->trans->trans_cfg->device_family ==IWL_DEVICE_FAMILY_9000 && + (desc->mac_flags2 &IWL_RX_MPDU_MFLG2_AMSDU ) && + !(desc->amsdu_info &IWL_RX_MPDU_AMSDU_LAST_SUBFRAME )) + rx_status->flag |=RX_FLAG_AMSDU_MORE ; +iwl_mvm_pass_packet_to_mac80211 (mvm, napi, skb, queue, sta, link_sta); + } out:rcu_read_unlock (); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 13/252 wifi: iwlwifi: mvm: include link ID when releasing frames
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Berg <[email protected]>
[ Upstream commit e78d7877308989ef91b64a3c746ae31324c07caa ]
When releasing frames from the reorder buffer, the link ID was not included in the RX status information. This subsequently led mac80211 to drop the frame. Change it so that the link information is set immediately when possible so that it doesn't not need to be filled in anymore when submitting the frame to mac80211.
--- drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 20 ++++++++----------- 1 file changed, 8 insertions(+), 12 deletions(-)
drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c +8 -12
@@ -236,21 +236,13 @@ static void iwl_mvm_add_rtap_sniffer_config(struct iwl_mvm *mvm,static void iwl_mvm_pass_packet_to_mac80211 (struct iwl_mvm *mvm,struct napi_struct *napi,struct sk_buff *skb,int queue, -struct ieee80211_sta *sta, -struct ieee80211_link_sta *link_sta) +struct ieee80211_sta *sta) {if (unlikely (iwl_mvm_check_pn (mvm, skb, queue, sta))) {kfree_skb (skb);return ; } -if (sta && sta->valid_links && link_sta) { -struct ieee80211_rx_status *rx_status =IEEE80211_SKB_RXCB (skb); - - rx_status->link_valid =1 ; - rx_status->link_id = link_sta->link_id; - } -ieee80211_rx_napi (mvm->hw, sta, skb, napi); }
@@ -636,7 +628,7 @@ static void iwl_mvm_release_frames(struct iwl_mvm *mvm,while ((skb =__skb_dequeue (skb_list))) {iwl_mvm_pass_packet_to_mac80211 (mvm, napi, skb, reorder_buf->queue, - sta,NULL /* FIXME */ ); + sta); reorder_buf->num_stored--; } }
@@ -2489,6 +2481,11 @@ void iwl_mvm_rx_mpdu_mq(struct iwl_mvm *mvm, struct napi_struct *napi,if (IS_ERR (sta)) sta =NULL ; link_sta =rcu_dereference (mvm->fw_id_to_link_sta[id]); + +if (sta && sta->valid_links && link_sta) { + rx_status->link_valid =1 ; + rx_status->link_id = link_sta->link_id; + } } }else if (!is_multicast_ether_addr (hdr->addr2)) {/*
@@ -2630,8 +2627,7 @@ void iwl_mvm_rx_mpdu_mq(struct iwl_mvm *mvm, struct napi_struct *napi, !(desc->amsdu_info & IWL_RX_MPDU_AMSDU_LAST_SUBFRAME)) rx_status->flag |= RX_FLAG_AMSDU_MORE; -iwl_mvm_pass_packet_to_mac80211 (mvm, napi, skb, queue, sta, - link_sta); +iwl_mvm_pass_packet_to_mac80211 (mvm, napi, skb, queue, sta); } out:rcu_read_unlock ();
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 14/252 ALSA: hda: cs35l56: Set the init_done flag before component_add()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Trimmer <[email protected]>
[ Upstream commit cafe9c6a72cf1ffe96d2561d988a141cb5c093db ]
Initialization is completed before adding the component as that can start the process of the device binding and trigger actions that check init_done.
Message-ID: <[email protected]>
--- sound/pci/hda/cs35l56_hda.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/pci/hda/cs35l56_hda.c +2 -2
@@ -978,14 +978,14 @@ int cs35l56_hda_common_probe(struct cs35l56_hda *cs35l56, int id)pm_runtime_mark_last_busy (cs35l56->base.dev);pm_runtime_enable (cs35l56->base.dev); + cs35l56->base.init_done = true; + ret =component_add (cs35l56->base.dev, &cs35l56_hda_comp_ops);if (ret) {dev_err (cs35l56->base.dev,"Register component failed: %d\n" , ret); goto pm_err; } - cs35l56->base.init_done = true; -return 0 ; pm_err:
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 15/252 ice: Refactor FW data type and fix bitmap casting issue
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Zou <[email protected]>
[ Upstream commit 817b18965b58a6e5fb6ce97abf01b03a205a6aea ]
According to the datasheet, the recipe association data is an 8-byte little-endian value. It is described as 'Bitmap of the recipe indexes associated with this profile', it is from 24 to 31 byte area in FW. Therefore, it is defined to '__le64 recipe_assoc' in struct ice_aqc_recipe_to_profile. And then fix the bitmap casting issue, as we must never ever use castings for bitmap type.
--- .../net/ethernet/intel/ice/ice_adminq_cmd.h | 3 ++- drivers/net/ethernet/intel/ice/ice_lag.c | 4 ++-- drivers/net/ethernet/intel/ice/ice_switch.c | 24 +++++++++++-------- drivers/net/ethernet/intel/ice/ice_switch.h | 4 ++-- 4 files changed, 20 insertions(+), 15 deletions(-)
drivers/net/ethernet/intel/ice/ice_adminq_cmd.h +2 -1
@@ -592,8 +592,9 @@ struct ice_aqc_recipe_data_elem {struct ice_aqc_recipe_to_profile {__le16 profile_id;u8 rsvd[6 ]; - DECLARE_BITMAP(recipe_assoc, ICE_MAX_NUM_RECIPES); +__le64 recipe_assoc; }; +static_assert (sizeof (struct ice_aqc_recipe_to_profile ) ==16 );/* Add/Update/Remove/Get switch rules (indirect 0x02A0, 0x02A1, 0x02A2, 0x02A3) */
drivers/net/ethernet/intel/ice/ice_lag.c +2 -2
@@ -2000,14 +2000,14 @@ int ice_init_lag(struct ice_pf *pf)/* associate recipes to profiles */ for (n =0 ; n <ICE_PROFID_IPV6_GTPU_IPV6_TCP_INNER ; n++) { err =ice_aq_get_recipe_to_profile (&pf->hw, n, - (u8 *)&recipe_bits,NULL ); + &recipe_bits,NULL );if (err)continue ;if (recipe_bits &BIT (ICE_SW_LKUP_DFLT )) { recipe_bits |=BIT (lag->pf_recipe);ice_aq_map_recipe_to_profile (&pf->hw, n, - (u8 *)&recipe_bits,NULL ); + recipe_bits,NULL ); } }
drivers/net/ethernet/intel/ice/ice_switch.c +14 -10
@@ -2032,12 +2032,12 @@ ice_update_recipe_lkup_idx(struct ice_hw *hw,* ice_aq_map_recipe_to_profile - Map recipe to packet profile * @hw: pointer to the HW struct * @profile_id: package profile ID to associate the recipe with -* @r_bitmap: Recipe bitmap filled in and need to be returned as response +* @r_assoc: Recipe bitmap filled in and need to be returned as response * @cd: pointer to command details structure or NULL * Recipe to profile association (0x0291) */ int -ice_aq_map_recipe_to_profile (struct ice_hw *hw,u32 profile_id,u8 *r_bitmap, +ice_aq_map_recipe_to_profile (struct ice_hw *hw,u32 profile_id,u64 r_assoc,struct ice_sq_cd *cd) {struct ice_aqc_recipe_to_profile *cmd;
@@ -2049,7 +2049,7 @@ ice_aq_map_recipe_to_profile(struct ice_hw *hw, u32 profile_id, u8 *r_bitmap,/* Set the recipe ID bit in the bitmask to let the device know which * profile we are associating the recipe to */ -memcpy (cmd->recipe_assoc, r_bitmap,sizeof (cmd->recipe_assoc)); + cmd->recipe_assoc =cpu_to_le64 (r_assoc);return ice_aq_send_cmd (hw, &desc,NULL ,0 , cd); }
@@ -2058,12 +2058,12 @@ ice_aq_map_recipe_to_profile(struct ice_hw *hw, u32 profile_id, u8 *r_bitmap,* ice_aq_get_recipe_to_profile - Map recipe to packet profile * @hw: pointer to the HW struct * @profile_id: package profile ID to associate the recipe with -* @r_bitmap: Recipe bitmap filled in and need to be returned as response +* @r_assoc: Recipe bitmap filled in and need to be returned as response * @cd: pointer to command details structure or NULL * Associate profile ID with given recipe (0x0293) */ int -ice_aq_get_recipe_to_profile (struct ice_hw *hw,u32 profile_id,u8 *r_bitmap, +ice_aq_get_recipe_to_profile (struct ice_hw *hw,u32 profile_id,u64 *r_assoc,struct ice_sq_cd *cd) {struct ice_aqc_recipe_to_profile *cmd;
@@ -2076,7 +2076,7 @@ ice_aq_get_recipe_to_profile(struct ice_hw *hw, u32 profile_id, u8 *r_bitmap, status =ice_aq_send_cmd (hw, &desc,NULL ,0 , cd);if (!status) -memcpy (r_bitmap, cmd->recipe_assoc,sizeof (cmd->recipe_assoc)); + *r_assoc =le64_to_cpu (cmd->recipe_assoc);return status; }
@@ -2121,6 +2121,7 @@ int ice_alloc_recipe(struct ice_hw *hw, u16 *rid)static void ice_get_recp_to_prof_map (struct ice_hw *hw) {DECLARE_BITMAP (r_bitmap,ICE_MAX_NUM_RECIPES ); +u64 recp_assoc;u16 i;for (i =0 ; i < hw->switch_info->max_used_prof_index +1 ; i++) {
@@ -2128,8 +2129,9 @@ static void ice_get_recp_to_prof_map(struct ice_hw *hw)bitmap_zero (profile_to_recipe[i],ICE_MAX_NUM_RECIPES );bitmap_zero (r_bitmap,ICE_MAX_NUM_RECIPES ); -if (ice_aq_get_recipe_to_profile (hw, i, (u8 *)r_bitmap,NULL )) +if (ice_aq_get_recipe_to_profile (hw, i, &recp_assoc,NULL ))continue ; +bitmap_from_arr64 (r_bitmap, &recp_assoc,ICE_MAX_NUM_RECIPES );bitmap_copy (profile_to_recipe[i], r_bitmap,ICE_MAX_NUM_RECIPES );for_each_set_bit (j, r_bitmap,ICE_MAX_NUM_RECIPES )
@@ -5431,22 +5433,24 @@ ice_add_adv_recipe(struct ice_hw *hw, struct ice_adv_lkup_elem *lkups,*/ list_for_each_entry (fvit, &rm->fv_list, list_entry) {DECLARE_BITMAP (r_bitmap,ICE_MAX_NUM_RECIPES ); +u64 recp_assoc;u16 j; status =ice_aq_get_recipe_to_profile (hw, fvit->profile_id, - (u8 *)r_bitmap,NULL ); + &recp_assoc,NULL );if (status) goto err_unroll; +bitmap_from_arr64 (r_bitmap, &recp_assoc,ICE_MAX_NUM_RECIPES );bitmap_or (r_bitmap, r_bitmap, rm->r_bitmap,ICE_MAX_NUM_RECIPES ); status =ice_acquire_change_lock (hw,ICE_RES_WRITE );if (status) goto err_unroll; +bitmap_to_arr64 (&recp_assoc, r_bitmap,ICE_MAX_NUM_RECIPES ); status =ice_aq_map_recipe_to_profile (hw, fvit->profile_id, - (u8 *)r_bitmap, -NULL ); + recp_assoc,NULL );ice_release_change_lock (hw);if (status)
drivers/net/ethernet/intel/ice/ice_switch.h +2 -2
@@ -424,10 +424,10 @@ int ice_aq_add_recipe(struct ice_hw *hw,struct ice_aqc_recipe_data_elem *s_recipe_list, u16 num_recipes, struct ice_sq_cd *cd);int -ice_aq_get_recipe_to_profile (struct ice_hw *hw,u32 profile_id,u8 *r_bitmap, +ice_aq_get_recipe_to_profile (struct ice_hw *hw,u32 profile_id,u64 *r_assoc,struct ice_sq_cd *cd);int -ice_aq_map_recipe_to_profile (struct ice_hw *hw,u32 profile_id,u8 *r_bitmap, +ice_aq_map_recipe_to_profile (struct ice_hw *hw,u32 profile_id,u64 r_assoc,struct ice_sq_cd *cd);#endif /* _ICE_SWITCH_H_ */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 16/252 ice: realloc VSI stats arrays
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Swiatkowski <[email protected]>
[ Upstream commit 5995ef88e3a8c2b014f51256a88be8e336532ce7 ]
Previously only case when queues amount is lower was covered. Implement realloc for case when queues amount is higher than previous one. Use krealloc() function and zero new allocated elements.
It has to be done before ice_vsi_def_cfg(), because stats element for ring is set there.
Stable-dep-of: 1cb7fdb1dfde ("ice: fix memory corruption bug with suspend and rebuild")
--- drivers/net/ethernet/intel/ice/ice_lib.c | 58 ++++++++++++++++-------- 1 file changed, 39 insertions(+), 19 deletions(-)
drivers/net/ethernet/intel/ice/ice_lib.c +39 -19
@@ -3084,27 +3084,26 @@ ice_vsi_rebuild_set_coalesce(struct ice_vsi *vsi, }/** -* ice_vsi_realloc_stat_arrays - Frees unused stat structures +* ice_vsi_realloc_stat_arrays - Frees unused stat structures or alloc new ones * @vsi: VSI pointer -* @prev_txq: Number of Tx rings before ring reallocation -* @prev_rxq: Number of Rx rings before ring reallocation */ -static void -ice_vsi_realloc_stat_arrays (struct ice_vsi *vsi,int prev_txq,int prev_rxq) +static int +ice_vsi_realloc_stat_arrays (struct ice_vsi *vsi) { +u16 req_txq = vsi->req_txq ? vsi->req_txq : vsi->alloc_txq; +u16 req_rxq = vsi->req_rxq ? vsi->req_rxq : vsi->alloc_rxq; +struct ice_ring_stats **tx_ring_stats; +struct ice_ring_stats **rx_ring_stats;struct ice_vsi_stats *vsi_stat;struct ice_pf *pf = vsi->back; +u16 prev_txq = vsi->alloc_txq; +u16 prev_rxq = vsi->alloc_rxq;int i; -if (!prev_txq || !prev_rxq) -return ; -if (vsi->type ==ICE_VSI_CHNL ) -return ; - vsi_stat = pf->vsi_stats[vsi->idx]; -if (vsi->num_txq < prev_txq) { -for (i = vsi->num_txq; i < prev_txq; i++) { +if (req_txq < prev_txq) { +for (i = req_txq; i < prev_txq; i++) {if (vsi_stat->tx_ring_stats[i]) {kfree_rcu (vsi_stat->tx_ring_stats[i], rcu);WRITE_ONCE (vsi_stat->tx_ring_stats[i],NULL );
@@ -3112,14 +3111,36 @@ ice_vsi_realloc_stat_arrays(struct ice_vsi *vsi, int prev_txq, int prev_rxq) } } -if (vsi->num_rxq < prev_rxq) { -for (i = vsi->num_rxq; i < prev_rxq; i++) { + tx_ring_stats = vsi_stat->rx_ring_stats; + vsi_stat->tx_ring_stats = +krealloc_array (vsi_stat->tx_ring_stats, req_txq, +sizeof (*vsi_stat->tx_ring_stats), +GFP_KERNEL | __GFP_ZERO); +if (!vsi_stat->tx_ring_stats) { + vsi_stat->tx_ring_stats = tx_ring_stats; +return -ENOMEM ; + } + +if (req_rxq < prev_rxq) { +for (i = req_rxq; i < prev_rxq; i++) {if (vsi_stat->rx_ring_stats[i]) {kfree_rcu (vsi_stat->rx_ring_stats[i], rcu);WRITE_ONCE (vsi_stat->rx_ring_stats[i],NULL ); } } } + + rx_ring_stats = vsi_stat->rx_ring_stats; + vsi_stat->rx_ring_stats = +krealloc_array (vsi_stat->rx_ring_stats, req_rxq, +sizeof (*vsi_stat->rx_ring_stats), +GFP_KERNEL | __GFP_ZERO); +if (!vsi_stat->rx_ring_stats) { + vsi_stat->rx_ring_stats = rx_ring_stats; +return -ENOMEM ; + } + +return 0 ; }/**
@@ -3136,9 +3157,9 @@ int ice_vsi_rebuild(struct ice_vsi *vsi, u32 vsi_flags) {struct ice_vsi_cfg_params params = {};struct ice_coalesce_stored *coalesce; -int ret, prev_txq, prev_rxq;int prev_num_q_vectors =0 ;struct ice_pf *pf; +int ret;if (!vsi)return -EINVAL ;
@@ -3157,8 +3178,9 @@ int ice_vsi_rebuild(struct ice_vsi *vsi, u32 vsi_flags) prev_num_q_vectors =ice_vsi_rebuild_get_coalesce (vsi, coalesce); - prev_txq = vsi->num_txq; - prev_rxq = vsi->num_rxq; + ret =ice_vsi_realloc_stat_arrays (vsi); +if (ret) + goto err_vsi_cfg;ice_vsi_decfg (vsi); ret =ice_vsi_cfg_def (vsi, ¶ms);
@@ -3176,8 +3198,6 @@ int ice_vsi_rebuild(struct ice_vsi *vsi, u32 vsi_flags)return ice_schedule_reset (pf,ICE_RESET_PFR ); } -ice_vsi_realloc_stat_arrays (vsi, prev_txq, prev_rxq); -ice_vsi_rebuild_set_coalesce (vsi, coalesce, prev_num_q_vectors);kfree (coalesce);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 17/252 ice: fix memory corruption bug with suspend and rebuild
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Brandeburg <[email protected]>
[ Upstream commit 1cb7fdb1dfde1aab66780b4ba44dba6402172111 ]
The ice driver would previously panic after suspend. This is caused from the driver *only* calling the ice_vsi_free_q_vectors() function by itself, when it is suspending. Since commit b3e7b3a6ee92 ("ice: prevent NULL pointer deref during reload") the driver has zeroed out num_q_vectors, and only restored it in ice_vsi_cfg_def().
This further causes the ice_rebuild() function to allocate a zero length buffer, after which num_q_vectors is updated, and then the new value of num_q_vectors is used to index into the zero length buffer, which corrupts memory.
The fix entails making sure all the code referencing num_q_vectors only does so after it has been reset via ice_vsi_cfg_def().
I didn't perform a full bisect, but I was able to test against 6.1.77 kernel and that ice driver works fine for suspend/resume with no panic, so sometime since then, this problem was introduced.
Also clean up an un-needed init of a local variable in the function being modified.
PANIC from 6.8.0-rc1:
[1026674.915596] PM: suspend exit [1026675.664697] ice 0000:17:00.1: PTP reset successful [1026675.664707] ice 0000:17:00.1: 2755 msecs passed between update to cached PHC time [1026675.667660] ice 0000:b1:00.0: PTP reset successful [1026675.675944] ice 0000:b1:00.0: 2832 msecs passed between update to cached PHC time [1026677.137733] ixgbe 0000:31:00.0 ens787: NIC Link is Up 1 Gbps, Flow Control: None [1026677.190201] BUG: kernel NULL pointer dereference, address: 0000000000000010 [1026677.192753] ice 0000:17:00.0: PTP reset successful [1026677.192764] ice 0000:17:00.0: 4548 msecs passed between update to cached PHC time [1026677.197928] #PF: supervisor read access in kernel mode [1026677.197933] #PF: error_code(0x0000) - not-present page [1026677.197937] PGD 1557a7067 P4D 0 [1026677.212133] ice 0000:b1:00.1: PTP reset successful [1026677.212143] ice 0000:b1:00.1: 4344 msecs passed between update to cached PHC time [1026677.212575] [1026677.243142] Oops: 0000 [#1] PREEMPT SMP NOPTI [1026677.247918] CPU: 23 PID: 42790 Comm: kworker/23:0 Kdump: loaded Tainted: G W 6.8.0-rc1+ #1 [1026677.257989] Hardware name: Intel Corporation M50CYP2SBSTD/M50CYP2SBSTD, BIOS SE5C620.86B.01.01.0005.2202160810 02/16/2022 [1026677.269367] Workqueue: ice ice_service_task [ice] [1026677.274592] RIP: 0010:ice_vsi_rebuild_set_coalesce+0x130/0x1e0 [ice] [1026677.281421] Code: 0f 84 3a ff ff ff 41 0f b7 74 ec 02 66 89 b0 22 02 00 00 81 e6 ff 1f 00 00 e8 ec fd ff ff e9 35 ff ff ff 48 8b 43 30 49 63 ed <41> 0f b7 34 24 41 83 c5 01 48 8b 3c e8 66 89 b7 aa 02 00 00 81 e6 [1026677.300877] RSP: 0018:ff3be62a6399bcc0 EFLAGS: 00010202 [1026677.306556] RAX: ff28691e28980828 RBX: ff28691e41099828 RCX: 0000000000188000 [1026677.314148] RDX: 0000000000000000 RSI: 0000000000000010 RDI: ff28691e41099828 [1026677.321730] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [1026677.329311] R10: 0000000000000007 R11: ffffffffffffffc0 R12: 0000000000000010 [1026677.336896] R13: 0000000000000000 R14: 0000000000000000 R15: ff28691e0eaa81a0 [1026677.344472] FS: 0000000000000000(0000) GS:ff28693cbffc0000(0000) knlGS:0000000000000000 [1026677.353000] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [1026677.359195] CR2: 0000000000000010 CR3: 0000000128df4001 CR4: 0000000000771ef0 [1026677.366779] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [1026677.374369] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [1026677.381952] PKRU: 55555554 [1026677.385116] Call Trace: [1026677.388023] <TASK> [1026677.390589] ? __die+0x20/0x70 [1026677.394105] ? page_fault_oops+0x82/0x160 [1026677.398576] ? do_user_addr_fault+0x65/0x6a0 [1026677.403307] ? exc_page_fault+0x6a/0x150 [1026677.407694] ? asm_exc_page_fault+0x22/0x30 [1026677.412349] ? ice_vsi_rebuild_set_coalesce+0x130/0x1e0 [ice] [1026677.418614] ice_vsi_rebuild+0x34b/0x3c0 [ice] [1026677.423583] ice_vsi_rebuild_by_type+0x76/0x180 [ice] [1026677.429147] ice_rebuild+0x18b/0x520 [ice] [1026677.433746] ? delay_tsc+0x8f/0xc0 [1026677.437630] ice_do_reset+0xa3/0x190 [ice] [1026677.442231] ice_service_task+0x26/0x440 [ice] [1026677.447180] process_one_work+0x174/0x340 [1026677.451669] worker_thread+0x27e/0x390 [1026677.455890] ? __pfx_worker_thread+0x10/0x10 [1026677.460627] kthread+0xee/0x120 [1026677.464235] ? __pfx_kthread+0x10/0x10 [1026677.468445] ret_from_fork+0x2d/0x50 [1026677.472476] ? __pfx_kthread+0x10/0x10 [1026677.476671] ret_from_fork_asm+0x1b/0x30 [1026677.481050] </TASK>
--- drivers/net/ethernet/intel/ice/ice_lib.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/net/ethernet/intel/ice/ice_lib.c +9 -9
@@ -3157,7 +3157,7 @@ int ice_vsi_rebuild(struct ice_vsi *vsi, u32 vsi_flags) {struct ice_vsi_cfg_params params = {};struct ice_coalesce_stored *coalesce; -int prev_num_q_vectors =0 ; +int prev_num_q_vectors;struct ice_pf *pf;int ret;
@@ -3171,13 +3171,6 @@ int ice_vsi_rebuild(struct ice_vsi *vsi, u32 vsi_flags)if (WARN_ON (vsi->type ==ICE_VSI_VF && !vsi->vf))return -EINVAL ; - coalesce =kcalloc (vsi->num_q_vectors, -sizeof (struct ice_coalesce_stored ),GFP_KERNEL ); -if (!coalesce) -return -ENOMEM ; - - prev_num_q_vectors =ice_vsi_rebuild_get_coalesce (vsi, coalesce); - ret =ice_vsi_realloc_stat_arrays (vsi);if (ret) goto err_vsi_cfg;
@@ -3187,6 +3180,13 @@ int ice_vsi_rebuild(struct ice_vsi *vsi, u32 vsi_flags)if (ret) goto err_vsi_cfg; + coalesce =kcalloc (vsi->num_q_vectors, +sizeof (struct ice_coalesce_stored ),GFP_KERNEL ); +if (!coalesce) +return -ENOMEM ; + + prev_num_q_vectors =ice_vsi_rebuild_get_coalesce (vsi, coalesce); + ret =ice_vsi_cfg_tc_lan (pf, vsi);if (ret) {if (vsi_flags &ICE_VSI_FLAG_INIT ) {
@@ -3205,8 +3205,8 @@ int ice_vsi_rebuild(struct ice_vsi *vsi, u32 vsi_flags) err_vsi_cfg_tc_lan:ice_vsi_decfg (vsi); -err_vsi_cfg:kfree (coalesce); +err_vsi_cfg:return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 18/252 ixgbe: avoid sleeping allocation in ixgbe_ipsec_vf_add_sa()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Przemek Kitszel <[email protected]>
[ Upstream commit aec806fb4afba5fe80b09e29351379a4292baa43 ]
Change kzalloc() flags used in ixgbe_ipsec_vf_add_sa() to GFP_ATOMIC, to avoid sleeping in IRQ context.
Dan Carpenter, with the help of Smatch, has found following issue:
The patch eda0333ac293: "ixgbe: add VF IPsec management" from Aug 13, 2018 (linux-next), leads to the following Smatch static checker
warning: drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c:917 ixgbe_ipsec_vf_add_sa()
warn: sleeping in IRQ context
The call tree that Smatch is worried about is:ixgbe_msix_other() <- IRQ handler
-> ixgbe_msg_task()
-> ixgbe_rcv_msg_from_vf()
-> ixgbe_ipsec_vf_add_sa()
--- drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c +8 -8
@@ -914,7 +914,13 @@ int ixgbe_ipsec_vf_add_sa(struct ixgbe_adapter *adapter, u32 *msgbuf, u32 vf) goto err_out; } - xs =kzalloc (sizeof (*xs),GFP_KERNEL ); + algo =xfrm_aead_get_byname (aes_gcm_name,IXGBE_IPSEC_AUTH_BITS ,1 ); +if (unlikely (!algo)) { + err = -ENOENT ; + goto err_out; + } + + xs =kzalloc (sizeof (*xs),GFP_ATOMIC );if (unlikely (!xs)) { err = -ENOMEM ; goto err_out;
@@ -930,14 +936,8 @@ int ixgbe_ipsec_vf_add_sa(struct ixgbe_adapter *adapter, u32 *msgbuf, u32 vf)memcpy (&xs->id.daddr.a4, sam->addr,sizeof (xs->id.daddr.a4)); xs->xso.dev = adapter->netdev; - algo =xfrm_aead_get_byname (aes_gcm_name,IXGBE_IPSEC_AUTH_BITS ,1 ); -if (unlikely (!algo)) { - err = -ENOENT ; - goto err_xs; - } - aead_len =sizeof (*xs->aead) +IXGBE_IPSEC_KEY_BITS /8 ; - xs->aead =kzalloc (aead_len,GFP_KERNEL ); + xs->aead =kzalloc (aead_len,GFP_ATOMIC );if (unlikely (!xs->aead)) { err = -ENOMEM ; goto err_xs;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 19/252 igc: Remove stale comment about Tx timestamping
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kurt Kanzenbach <[email protected]>
[ Upstream commit 47ce2956c7a61ff354723e28235205fa2012265b ]
The initial igc Tx timestamping implementation used only one register for retrieving Tx timestamps. Commit 3ed247e78911 ("igc: Add support for multiple in-flight TX timestamps") added support for utilizing all four of them e.g., for multiple domain support. Remove the stale comment/FIXME.
--- drivers/net/ethernet/intel/igc/igc_main.c | 4 ---- 1 file changed, 4 deletions(-)
drivers/net/ethernet/intel/igc/igc_main.c +0 -4
@@ -1640,10 +1640,6 @@ static netdev_tx_t igc_xmit_frame_ring(struct sk_buff *skb,if (unlikely (test_bit (IGC_RING_FLAG_TX_HWTSTAMP , &tx_ring->flags) &&skb_shinfo (skb)->tx_flags &SKBTX_HW_TSTAMP )) { -/* FIXME: add support for retrieving timestamps from -* the other timer registers before skipping the -* timestamping request. -*/ unsigned long flags;u32 tstamp_flags;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 20/252 s390/qeth: handle deferred cc1
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandra Winter <[email protected]>
[ Upstream commit afb373ff3f54c9d909efc7f810dc80a9742807b2 ]
The IO subsystem expects a driver to retry a ccw_device_start, when the subsequent interrupt response block (irb) contains a deferred condition code 1.
Symptoms before this commit:
On the read channel we always trigger the next read anyhow, so no different behaviour here.
On the write channel we may experience timeout errors, because the expected reply will never be received without the retry. Other callers of qeth_send_control_data() may wrongly assume that the ccw was successful, which may cause problems later.
Note that since
commit 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers") and
commit 5ef1dc40ffa6 ("s390/cio: fix invalid -EBUSY on ccw_device_start") deferred CC1s are much more likely to occur. See the commit message of the latter for more background information.
--- drivers/s390/net/qeth_core_main.c | 38 +++++++++++++++++++++++++++++-- 1 file changed, 36 insertions(+), 2 deletions(-)
drivers/s390/net/qeth_core_main.c +36 -2
@@ -1179,6 +1179,20 @@ static int qeth_check_irb_error(struct qeth_card *card, struct ccw_device *cdev, } } +/** +* qeth_irq() - qeth interrupt handler +* @cdev: ccw device +* @intparm: expect pointer to iob +* @irb: Interruption Response Block +* +* In the good path: +* corresponding qeth channel is locked with last used iob as active_cmd. +* But this function is also called for error interrupts. +* +* Caller ensures that: +* Interrupts are disabled; ccw device lock is held; +* +*/ static void qeth_irq (struct ccw_device *cdev,unsigned long intparm,struct irb *irb) {
@@ -1220,11 +1234,10 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm, iob = (struct qeth_cmd_buffer *) (addr_t )intparm; } -qeth_unlock_channel (card, channel); - rc =qeth_check_irb_error (card, cdev, irb);if (rc) {/* IO was terminated, free its resources. */ +qeth_unlock_channel (card, channel);if (iob)qeth_cancel_cmd (iob, rc);return ;
@@ -1268,6 +1281,7 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm, rc =qeth_get_problem (card, cdev, irb);if (rc) { card->read_or_write_problem =1 ; +qeth_unlock_channel (card, channel);if (iob)qeth_cancel_cmd (iob, rc);qeth_clear_ipacmd_list (card);
@@ -1276,6 +1290,26 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm, } } +if (scsw_cmd_is_valid_cc (&irb->scsw) && irb->scsw.cmd.cc ==1 && iob) { +/* channel command hasn't started: retry. +* active_cmd is still set to last iob +*/ +QETH_CARD_TEXT (card,2 ,"irqcc1" ); + rc =ccw_device_start_timeout (cdev,__ccw_from_cmd (iob), + (addr_t )iob,0 ,0 , iob->timeout); +if (rc) { +QETH_DBF_MESSAGE (2 , +"ccw retry on %x failed, rc = %i\n" , +CARD_DEVID (card), rc); +QETH_CARD_TEXT_ (card,2 ," err%d" , rc); +qeth_unlock_channel (card, channel); +qeth_cancel_cmd (iob, rc); + } +return ; + } + +qeth_unlock_channel (card, channel); +if (iob) {/* sanity check: */ if (irb->scsw.cmd.count > iob->length) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 21/252 net: hsr: hsr_slave: Fix the promiscuous mode in offload mode
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ravi Gunasekaran <[email protected]>
[ Upstream commit b11c81731c810efe592e510bb0110e0db6877419 ]
commit e748d0fd66ab ("net: hsr: Disable promiscuous mode in offload mode") disables promiscuous mode of slave devices while creating an HSR interface. But while deleting the HSR interface, it does not take care of it. It decreases the promiscuous mode count, which eventually enables promiscuous mode on the slave devices when creating HSR interface again.
Fix this by not decrementing the promiscuous mode count while deleting the HSR interface when offload is enabled.
--- net/hsr/hsr_slave.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/hsr/hsr_slave.c +2 -1
@@ -220,7 +220,8 @@ void hsr_del_port(struct hsr_port *port)netdev_update_features (master->dev);dev_set_mtu (master->dev,hsr_get_max_mtu (hsr));netdev_rx_handler_unregister (port->dev); -dev_set_promiscuity (port->dev,-1 ); +if (!port->hsr->fwd_offloaded) +dev_set_promiscuity (port->dev,-1 );netdev_upper_dev_unlink (port->dev, master->dev); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 22/252 tcp: properly terminate timers for kernel sockets
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 151c9c724d05d5b0dd8acd3e11cb69ef1f2dbada ]
We had various syzbot reports about tcp timers firing after the corresponding netns has been dismantled.
Fortunately Josef Bacik could trigger the issue more often, and could test a patch I wrote two years ago.
When TCP sockets are closed, we call inet_csk_clear_xmit_timers() to 'stop' the timers.
inet_csk_clear_xmit_timers() can be called from any context, including when socket lock is held.
This is the reason it uses sk_stop_timer(), aka del_timer(). This means that ongoing timers might finish much later.
For user sockets, this is fine because each running timer holds a reference on the socket, and the user socket holds a reference on the netns.
For kernel sockets, we risk that the netns is freed before timer can complete, because kernel sockets do not hold reference on the netns.
This patch adds inet_csk_clear_xmit_timers_sync() function that using sk_stop_timer_sync() to make sure all timers are terminated before the kernel socket is released. Modules using kernel sockets close them in their netns exit() handler.
Also add sock_not_owned_by_me() helper to get LOCKDEP support : inet_csk_clear_xmit_timers_sync() must not be called while socket lock is held.
It is very possible we can revert in the future commit 3a58f13a881e ("net: rds: acquire refcount on TCP sockets") which attempted to solve the issue in rds only. (net/smc/af_smc.c and net/mptcp/subflow.c have similar code)
We probably can remove the check_net() tests from tcp_out_of_resources() and __tcp_close() in the future.
--- include/net/inet_connection_sock.h | 1 + include/net/sock.h | 7 +++++++ net/ipv4/inet_connection_sock.c | 14 ++++++++++++++ net/ipv4/tcp.c | 2 ++ 4 files changed, 24 insertions(+)
include/net/inet_connection_sock.h +1 -0
@@ -173,6 +173,7 @@ void inet_csk_init_xmit_timers(struct sock *sk,void (*delack_handler)(struct timer_list *), void (*keepalive_handler)(struct timer_list *));void inet_csk_clear_xmit_timers (struct sock *sk); +void inet_csk_clear_xmit_timers_sync (struct sock *sk);static inline void inet_csk_schedule_ack (struct sock *sk) {
include/net/sock.h +7 -0
@@ -1808,6 +1808,13 @@ static inline void sock_owned_by_me(const struct sock *sk)#endif } +static inline void sock_not_owned_by_me (const struct sock *sk) +{ +#ifdef CONFIG_LOCKDEP +WARN_ON_ONCE (lockdep_sock_is_held (sk) && debug_locks); +#endif +} +static inline bool sock_owned_by_user (const struct sock *sk) {sock_owned_by_me (sk);
net/ipv4/inet_connection_sock.c +14 -0
@@ -774,6 +774,20 @@ void inet_csk_clear_xmit_timers(struct sock *sk) }EXPORT_SYMBOL (inet_csk_clear_xmit_timers); +void inet_csk_clear_xmit_timers_sync (struct sock *sk) +{ +struct inet_connection_sock *icsk =inet_csk (sk); + +/* ongoing timer handlers need to acquire socket lock. */ +sock_not_owned_by_me (sk); + + icsk->icsk_pending = icsk->icsk_ack.pending =0 ; + +sk_stop_timer_sync (sk, &icsk->icsk_retransmit_timer); +sk_stop_timer_sync (sk, &icsk->icsk_delack_timer); +sk_stop_timer_sync (sk, &sk->sk_timer); +} +void inet_csk_delete_keepalive_timer (struct sock *sk) {sk_stop_timer (sk, &sk->sk_timer);
net/ipv4/tcp.c +2 -0
@@ -2931,6 +2931,8 @@ void tcp_close(struct sock *sk, long timeout)lock_sock (sk);__tcp_close (sk, timeout);release_sock (sk); +if (!sk->sk_net_refcnt) +inet_csk_clear_xmit_timers_sync (sk);sock_put (sk); }EXPORT_SYMBOL (tcp_close);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 23/252 net: wwan: t7xx: Split 64bit accesses to fix alignment issues
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjørn Mork <[email protected]>
[ Upstream commit 7d5a7dd5a35876f0ecc286f3602a88887a788217 ]
Some of the registers are aligned on a 32bit boundary, causing alignment faults on 64bit platforms.
Unable to handle kernel paging request at virtual address ffffffc084a1d004 Mem abort info: ESR = 0x0000000096000061 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x21: alignment fault Data abort info: ISV = 0, ISS = 0x00000061, ISS2 = 0x00000000 CM = 0, WnR = 1, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 swapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000046ad6000 [ffffffc084a1d004] pgd=100000013ffff003, p4d=100000013ffff003, pud=100000013ffff003, pmd=0068000020a00711 Internal error: Oops: 0000000096000061 [#1] SMP Modules linked in: mtk_t7xx(+) qcserial pppoe ppp_async option nft_fib_inet nf_flow_table_inet mt7921u(O) mt7921s(O) mt7921e(O) mt7921_common(O) iwlmvm(O) iwldvm(O) usb_wwan rndis_host qmi_wwan pppox ppp_generic nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet nft_reject nft_redir nft_quota nft_numgen nft_nat nft_masq nft_log nft_limit nft_hash nft_flow_offload nft_fib_ipv6 nft_fib_ipv4 nft_fib nft_ct nft_chain_nat nf_tables nf_nat nf_flow_table nf_conntrack mt7996e(O) mt792x_usb(O) mt792x_lib(O) mt7915e(O) mt76_usb(O) mt76_sdio(O) mt76_connac_lib(O) mt76(O) mac80211(O) iwlwifi(O) huawei_cdc_ncm cfg80211(O) cdc_ncm cdc_ether wwan usbserial usbnet slhc sfp rtc_pcf8563 nfnetlink nf_reject_ipv6 nf_reject_ipv4 nf_log_syslog nf_defrag_ipv6 nf_defrag_ipv4 mt6577_auxadc mdio_i2c libcrc32c compat(O) cdc_wdm cdc_acm at24 crypto_safexcel pwm_fan i2c_gpio i2c_smbus industrialio i2c_algo_bit i2c_mux_reg i2c_mux_pca954x i2c_mux_pca9541 i2c_mux_gpio i2c_mux dummy oid_registry tun sha512_arm64 sha1_ce sha1_generic seqiv md5 geniv des_generic libdes cbc authencesn authenc leds_gpio xhci_plat_hcd xhci_pci xhci_mtk_hcd xhci_hcd nvme nvme_core gpio_button_hotplug(O) dm_mirror dm_region_hash dm_log dm_crypt dm_mod dax usbcore usb_common ptp aquantia pps_core mii tpm encrypted_keys trusted CPU: 3 PID: 5266 Comm: kworker/u9:1 Tainted: G O 6.6.22 #0 Hardware name: Bananapi BPI-R4 (DT) Workqueue: md_hk_wq t7xx_fsm_uninit [mtk_t7xx] pstate: 804000c5 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : t7xx_cldma_hw_set_start_addr+0x1c/0x3c [mtk_t7xx] lr : t7xx_cldma_start+0xac/0x13c [mtk_t7xx] sp : ffffffc085d63d30 x29: ffffffc085d63d30 x28: 0000000000000000 x27: 0000000000000000 x26: 0000000000000000 x25: ffffff80c804f2c0 x24: ffffff80ca196c05 x23: 0000000000000000 x22: ffffff80c814b9b8 x21: ffffff80c814b128 x20: 0000000000000001 x19: ffffff80c814b080 x18: 0000000000000014 x17: 0000000055c9806b x16: 000000007c5296d0 x15: 000000000f6bca68 x14: 00000000dbdbdce4 x13: 000000001aeaf72a x12: 0000000000000001 x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 x8 : ffffff80ca1ef6b4 x7 : ffffff80c814b818 x6 : 0000000000000018 x5 : 0000000000000870 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 000000010a947000 x1 : ffffffc084a1d004 x0 : ffffffc084a1d004 Call trace: t7xx_cldma_hw_set_start_addr+0x1c/0x3c [mtk_t7xx] t7xx_fsm_uninit+0x578/0x5ec [mtk_t7xx] process_one_work+0x154/0x2a0 worker_thread+0x2ac/0x488 kthread+0xe0/0xec ret_from_fork+0x10/0x20 Code: f9400800 91001000 8b214001 d50332bf (f9000022) ---[ end trace 0000000000000000 ]---
The inclusion of io-64-nonatomic-lo-hi.h indicates that all 64bit accesses can be replaced by pairs of nonatomic 32bit access. Fix alignment by forcing all accesses to be 32bit on 64bit platforms.
--- drivers/net/wwan/t7xx/t7xx_cldma.c | 4 ++-- drivers/net/wwan/t7xx/t7xx_hif_cldma.c | 9 +++++---- drivers/net/wwan/t7xx/t7xx_pcie_mac.c | 8 ++++---- 3 files changed, 11 insertions(+), 10 deletions(-)
drivers/net/wwan/t7xx/t7xx_cldma.c +2 -2
@@ -106,7 +106,7 @@ bool t7xx_cldma_tx_addr_is_set(struct t7xx_cldma_hw *hw_info, unsigned int qno) {u32 offset =REG_CLDMA_UL_START_ADDRL_0 + qno *ADDR_SIZE ; -return ioread64 (hw_info->ap_pdn_base + offset); +return ioread64_lo_hi (hw_info->ap_pdn_base + offset); } void t7xx_cldma_hw_set_start_addr(struct t7xx_cldma_hw *hw_info, unsigned int qno, u64 address,
@@ -117,7 +117,7 @@ void t7xx_cldma_hw_set_start_addr(struct t7xx_cldma_hw *hw_info, unsigned int qn reg = tx_rx ==MTK_RX ? hw_info->ap_ao_base +REG_CLDMA_DL_START_ADDRL_0 : hw_info->ap_pdn_base +REG_CLDMA_UL_START_ADDRL_0 ; -iowrite64 (address, reg + offset); +iowrite64_lo_hi (address, reg + offset); } void t7xx_cldma_hw_resume_queue(struct t7xx_cldma_hw *hw_info, unsigned int qno,
drivers/net/wwan/t7xx/t7xx_hif_cldma.c +5 -4
@@ -139,8 +139,9 @@ static int t7xx_cldma_gpd_rx_from_q(struct cldma_queue *queue, int budget, boolreturn -ENODEV ; } - gpd_addr =ioread64 (hw_info->ap_pdn_base +REG_CLDMA_DL_CURRENT_ADDRL_0 + - queue->index *sizeof (u64)); + gpd_addr =ioread64_lo_hi (hw_info->ap_pdn_base + +REG_CLDMA_DL_CURRENT_ADDRL_0 + + queue->index *sizeof (u64));if (req->gpd_addr == gpd_addr || hwo_polling_count++ >=100 )return 0 ;
@@ -318,8 +319,8 @@ static void t7xx_cldma_txq_empty_hndl(struct cldma_queue *queue)struct t7xx_cldma_hw *hw_info = &md_ctrl->hw_info;/* Check current processing TGPD, 64-bit address is in a table by Q index */ - ul_curr_addr =ioread64 (hw_info->ap_pdn_base +REG_CLDMA_UL_CURRENT_ADDRL_0 + - queue->index *sizeof (u64)); + ul_curr_addr =ioread64_lo_hi (hw_info->ap_pdn_base +REG_CLDMA_UL_CURRENT_ADDRL_0 + + queue->index *sizeof (u64));if (req->gpd_addr != ul_curr_addr) {spin_unlock_irqrestore (&md_ctrl->cldma_lock, flags); dev_err(md_ctrl->dev, "CLDMA%d queue %d is not empty\n",
drivers/net/wwan/t7xx/t7xx_pcie_mac.c +4 -4
@@ -75,7 +75,7 @@ static void t7xx_pcie_mac_atr_tables_dis(void __iomem *pbase, enum t7xx_atr_src_for (i =0 ; i <ATR_TABLE_NUM_PER_ATR ; i++) { offset =ATR_PORT_OFFSET * port +ATR_TABLE_OFFSET * i; reg = pbase +ATR_PCIE_WIN0_T0_ATR_PARAM_SRC_ADDR + offset; -iowrite64 (0 , reg); +iowrite64_lo_hi (0 , reg); } }
@@ -112,17 +112,17 @@ static int t7xx_pcie_mac_atr_cfg(struct t7xx_pci_dev *t7xx_dev, struct t7xx_atr_ reg = pbase +ATR_PCIE_WIN0_T0_TRSL_ADDR + offset; value = cfg->trsl_addr &ATR_PCIE_WIN0_ADDR_ALGMT ; -iowrite64 (value, reg); +iowrite64_lo_hi (value, reg); reg = pbase +ATR_PCIE_WIN0_T0_TRSL_PARAM + offset;iowrite32 (cfg->trsl_id, reg); reg = pbase +ATR_PCIE_WIN0_T0_ATR_PARAM_SRC_ADDR + offset; value = (cfg->src_addr &ATR_PCIE_WIN0_ADDR_ALGMT ) | (atr_size <<1 ) |BIT (0 ); -iowrite64 (value, reg); +iowrite64_lo_hi (value, reg);/* Ensure ATR is set */ -ioread64 (reg); +ioread64_lo_hi (reg);return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 24/252 selftests: vxlan_mdb: Fix failures with old libnet
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit f1425529c33def8b46faae4400dd9e2bbaf16a05 ]
Locally generated IP multicast packets (such as the ones used in the test) do not perform routing and simply egress the bound device.
However, as explained in commit 8bcfb4ae4d97 ("selftests: forwarding:
Fix failing tests with old libnet"), old versions of libnet (used by mausezahn) do not use the "SO_BINDTODEVICE" socket option. Specifically, the library started using the option for IPv6 sockets in version 1.1.6 and for IPv4 sockets in version 1.2. This explains why on Ubuntu - which uses version 1.1.6 - the IPv4 overlay tests are failing whereas the IPv6 ones are passing.
Fix by specifying the source and destination MAC of the packets which will cause mausezahn to use a packet socket instead of an IP socket.
--- tools/testing/selftests/net/test_vxlan_mdb.sh | 205 +++++++++++------- 1 file changed, 128 insertions(+), 77 deletions(-)
tools/testing/selftests/net/test_vxlan_mdb.sh +128 -77
@@ -984,6 +984,7 @@ encap_params_common() local plen=$1; shift local enc_ethtype=$1; shift local grp=$1; shift + local grp_dmac=$1; shift local src=$1; shift local mz=$1; shift
@@ -1002,11 +1003,11 @@ encap_params_common() run_cmd "bridge -n $ns1 mdb replace dev vx0 port vx0 grp $grp permanent dst $vtep2_ip src_vni 10020" run_cmd "tc -n $ns2 filter replace dev vx0 ingress pref 1 handle 101 proto all flower enc_dst_ip $vtep1_ip action pass" - run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 1 log_test $? 0 "Destination IP - match" - run_cmd "ip netns exec $ns1 $mz br0.20 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.20 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 1 log_test $? 0 "Destination IP - no match"
@@ -1019,20 +1020,20 @@ encap_params_common() run_cmd "bridge -n $ns1 mdb replace dev vx0 port vx0 grp $grp permanent dst $vtep1_ip dst_port 1111 src_vni 10020" run_cmd "tc -n $ns2 filter replace dev veth0 ingress pref 1 handle 101 proto $enc_ethtype flower ip_proto udp dst_port 4789 action pass" - run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev veth0 ingress" 101 1 log_test $? 0 "Default destination port - match" - run_cmd "ip netns exec $ns1 $mz br0.20 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.20 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev veth0 ingress" 101 1 log_test $? 0 "Default destination port - no match" run_cmd "tc -n $ns2 filter replace dev veth0 ingress pref 1 handle 101 proto $enc_ethtype flower ip_proto udp dst_port 1111 action pass" - run_cmd "ip netns exec $ns1 $mz br0.20 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.20 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev veth0 ingress" 101 1 log_test $? 0 "Non-default destination port - match" - run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev veth0 ingress" 101 1 log_test $? 0 "Non-default destination port - no match"
@@ -1045,11 +1046,11 @@ encap_params_common() run_cmd "bridge -n $ns1 mdb replace dev vx0 port vx0 grp $grp permanent dst $vtep1_ip src_vni 10020" run_cmd "tc -n $ns2 filter replace dev vx0 ingress pref 1 handle 101 proto all flower enc_key_id 10010 action pass" - run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 1 log_test $? 0 "Default destination VNI - match" - run_cmd "ip netns exec $ns1 $mz br0.20 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.20 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 1 log_test $? 0 "Default destination VNI - no match"
@@ -1057,11 +1058,11 @@ encap_params_common() run_cmd "bridge -n $ns1 mdb replace dev vx0 port vx0 grp $grp permanent dst $vtep1_ip vni 10010 src_vni 10020" run_cmd "tc -n $ns2 filter replace dev vx0 ingress pref 1 handle 101 proto all flower enc_key_id 10020 action pass" - run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 1 log_test $? 0 "Non-default destination VNI - match" - run_cmd "ip netns exec $ns1 $mz br0.20 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.20 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 1 log_test $? 0 "Non-default destination VNI - no match"
@@ -1079,6 +1080,7 @@ encap_params_ipv4_ipv4() local plen=32 local enc_ethtype="ip" local grp=239.1.1.1 + local grp_dmac=01:00:5e:01:01:01 local src=192.0.2.129 echo
@@ -1086,7 +1088,7 @@ encap_params_ipv4_ipv4() echo "------------------------------------------------------------------" encap_params_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $enc_ethtype \ - $grp $src "mausezahn" + $grp $grp_dmac $src "mausezahn" } encap_params_ipv6_ipv4()
@@ -1098,6 +1100,7 @@ encap_params_ipv6_ipv4() local plen=32 local enc_ethtype="ip" local grp=ff0e::1 + local grp_dmac=33:33:00:00:00:01 local src=2001:db8:100::1 echo
@@ -1105,7 +1108,7 @@ encap_params_ipv6_ipv4() echo "------------------------------------------------------------------" encap_params_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $enc_ethtype \ - $grp $src "mausezahn -6" + $grp $grp_dmac $src "mausezahn -6" } encap_params_ipv4_ipv6()
@@ -1117,6 +1120,7 @@ encap_params_ipv4_ipv6() local plen=128 local enc_ethtype="ipv6" local grp=239.1.1.1 + local grp_dmac=01:00:5e:01:01:01 local src=192.0.2.129 echo
@@ -1124,7 +1128,7 @@ encap_params_ipv4_ipv6() echo "------------------------------------------------------------------" encap_params_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $enc_ethtype \ - $grp $src "mausezahn" + $grp $grp_dmac $src "mausezahn" } encap_params_ipv6_ipv6()
@@ -1136,6 +1140,7 @@ encap_params_ipv6_ipv6() local plen=128 local enc_ethtype="ipv6" local grp=ff0e::1 + local grp_dmac=33:33:00:00:00:01 local src=2001:db8:100::1 echo
@@ -1143,7 +1148,7 @@ encap_params_ipv6_ipv6() echo "------------------------------------------------------------------" encap_params_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $enc_ethtype \ - $grp $src "mausezahn -6" + $grp $grp_dmac $src "mausezahn -6" } starg_exclude_ir_common()
@@ -1154,6 +1159,7 @@ starg_exclude_ir_common() local vtep2_ip=$1; shift local plen=$1; shift local grp=$1; shift + local grp_dmac=$1; shift local valid_src=$1; shift local invalid_src=$1; shift local mz=$1; shift
@@ -1175,14 +1181,14 @@ starg_exclude_ir_common() run_cmd "bridge -n $ns1 mdb replace dev vx0 port vx0 grp $grp permanent filter_mode exclude source_list $invalid_src dst $vtep2_ip src_vni 10010" # Check that invalid source is not forwarded to any VTEP. - run_cmd "ip netns exec $ns1 $mz br0.10 -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 0 log_test $? 0 "Block excluded source - first VTEP" tc_check_packets "$ns2" "dev vx0 ingress" 102 0 log_test $? 0 "Block excluded source - second VTEP" # Check that valid source is forwarded to both VTEPs. - run_cmd "ip netns exec $ns1 $mz br0.10 -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 1 log_test $? 0 "Forward valid source - first VTEP" tc_check_packets "$ns2" "dev vx0 ingress" 102 1
@@ -1192,14 +1198,14 @@ starg_exclude_ir_common() run_cmd "bridge -n $ns1 mdb del dev vx0 port vx0 grp $grp dst $vtep2_ip src_vni 10010" # Check that invalid source is not forwarded to any VTEP. - run_cmd "ip netns exec $ns1 $mz br0.10 -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 1 log_test $? 0 "Block excluded source after removal - first VTEP" tc_check_packets "$ns2" "dev vx0 ingress" 102 1 log_test $? 0 "Block excluded source after removal - second VTEP" # Check that valid source is forwarded to the remaining VTEP. - run_cmd "ip netns exec $ns1 $mz br0.10 -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 2 log_test $? 0 "Forward valid source after removal - first VTEP" tc_check_packets "$ns2" "dev vx0 ingress" 102 1
@@ -1214,6 +1220,7 @@ starg_exclude_ir_ipv4_ipv4() local vtep2_ip=198.51.100.200 local plen=32 local grp=239.1.1.1 + local grp_dmac=01:00:5e:01:01:01 local valid_src=192.0.2.129 local invalid_src=192.0.2.145
@@ -1222,7 +1229,7 @@ starg_exclude_ir_ipv4_ipv4() echo "-------------------------------------------------------------" starg_exclude_ir_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $grp \ - $valid_src $invalid_src "mausezahn" + $grp_dmac $valid_src $invalid_src "mausezahn" } starg_exclude_ir_ipv6_ipv4()
@@ -1233,6 +1240,7 @@ starg_exclude_ir_ipv6_ipv4() local vtep2_ip=198.51.100.200 local plen=32 local grp=ff0e::1 + local grp_dmac=33:33:00:00:00:01 local valid_src=2001:db8:100::1 local invalid_src=2001:db8:200::1
@@ -1241,7 +1249,7 @@ starg_exclude_ir_ipv6_ipv4() echo "-------------------------------------------------------------" starg_exclude_ir_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $grp \ - $valid_src $invalid_src "mausezahn -6" + $grp_dmac $valid_src $invalid_src "mausezahn -6" } starg_exclude_ir_ipv4_ipv6()
@@ -1252,6 +1260,7 @@ starg_exclude_ir_ipv4_ipv6() local vtep2_ip=2001:db8:2000::1 local plen=128 local grp=239.1.1.1 + local grp_dmac=01:00:5e:01:01:01 local valid_src=192.0.2.129 local invalid_src=192.0.2.145
@@ -1260,7 +1269,7 @@ starg_exclude_ir_ipv4_ipv6() echo "-------------------------------------------------------------" starg_exclude_ir_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $grp \ - $valid_src $invalid_src "mausezahn" + $grp_dmac $valid_src $invalid_src "mausezahn" } starg_exclude_ir_ipv6_ipv6()
@@ -1271,6 +1280,7 @@ starg_exclude_ir_ipv6_ipv6() local vtep2_ip=2001:db8:2000::1 local plen=128 local grp=ff0e::1 + local grp_dmac=33:33:00:00:00:01 local valid_src=2001:db8:100::1 local invalid_src=2001:db8:200::1
@@ -1279,7 +1289,7 @@ starg_exclude_ir_ipv6_ipv6() echo "-------------------------------------------------------------" starg_exclude_ir_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $grp \ - $valid_src $invalid_src "mausezahn -6" + $grp_dmac $valid_src $invalid_src "mausezahn -6" } starg_include_ir_common()
@@ -1290,6 +1300,7 @@ starg_include_ir_common() local vtep2_ip=$1; shift local plen=$1; shift local grp=$1; shift + local grp_dmac=$1; shift local valid_src=$1; shift local invalid_src=$1; shift local mz=$1; shift
@@ -1311,14 +1322,14 @@ starg_include_ir_common() run_cmd "bridge -n $ns1 mdb replace dev vx0 port vx0 grp $grp permanent filter_mode include source_list $valid_src dst $vtep2_ip src_vni 10010" # Check that invalid source is not forwarded to any VTEP. - run_cmd "ip netns exec $ns1 $mz br0.10 -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 0 log_test $? 0 "Block excluded source - first VTEP" tc_check_packets "$ns2" "dev vx0 ingress" 102 0 log_test $? 0 "Block excluded source - second VTEP" # Check that valid source is forwarded to both VTEPs. - run_cmd "ip netns exec $ns1 $mz br0.10 -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 1 log_test $? 0 "Forward valid source - first VTEP" tc_check_packets "$ns2" "dev vx0 ingress" 102 1
@@ -1328,14 +1339,14 @@ starg_include_ir_common() run_cmd "bridge -n $ns1 mdb del dev vx0 port vx0 grp $grp dst $vtep2_ip src_vni 10010" # Check that invalid source is not forwarded to any VTEP. - run_cmd "ip netns exec $ns1 $mz br0.10 -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 1 log_test $? 0 "Block excluded source after removal - first VTEP" tc_check_packets "$ns2" "dev vx0 ingress" 102 1 log_test $? 0 "Block excluded source after removal - second VTEP" # Check that valid source is forwarded to the remaining VTEP. - run_cmd "ip netns exec $ns1 $mz br0.10 -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 2 log_test $? 0 "Forward valid source after removal - first VTEP" tc_check_packets "$ns2" "dev vx0 ingress" 102 1
@@ -1350,6 +1361,7 @@ starg_include_ir_ipv4_ipv4() local vtep2_ip=198.51.100.200 local plen=32 local grp=239.1.1.1 + local grp_dmac=01:00:5e:01:01:01 local valid_src=192.0.2.129 local invalid_src=192.0.2.145
@@ -1358,7 +1370,7 @@ starg_include_ir_ipv4_ipv4() echo "-------------------------------------------------------------" starg_include_ir_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $grp \ - $valid_src $invalid_src "mausezahn" + $grp_dmac $valid_src $invalid_src "mausezahn" } starg_include_ir_ipv6_ipv4()
@@ -1369,6 +1381,7 @@ starg_include_ir_ipv6_ipv4() local vtep2_ip=198.51.100.200 local plen=32 local grp=ff0e::1 + local grp_dmac=33:33:00:00:00:01 local valid_src=2001:db8:100::1 local invalid_src=2001:db8:200::1
@@ -1377,7 +1390,7 @@ starg_include_ir_ipv6_ipv4() echo "-------------------------------------------------------------" starg_include_ir_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $grp \ - $valid_src $invalid_src "mausezahn -6" + $grp_dmac $valid_src $invalid_src "mausezahn -6" } starg_include_ir_ipv4_ipv6()
@@ -1388,6 +1401,7 @@ starg_include_ir_ipv4_ipv6() local vtep2_ip=2001:db8:2000::1 local plen=128 local grp=239.1.1.1 + local grp_dmac=01:00:5e:01:01:01 local valid_src=192.0.2.129 local invalid_src=192.0.2.145
@@ -1396,7 +1410,7 @@ starg_include_ir_ipv4_ipv6() echo "-------------------------------------------------------------" starg_include_ir_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $grp \ - $valid_src $invalid_src "mausezahn" + $grp_dmac $valid_src $invalid_src "mausezahn" } starg_include_ir_ipv6_ipv6()
@@ -1407,6 +1421,7 @@ starg_include_ir_ipv6_ipv6() local vtep2_ip=2001:db8:2000::1 local plen=128 local grp=ff0e::1 + local grp_dmac=33:33:00:00:00:01 local valid_src=2001:db8:100::1 local invalid_src=2001:db8:200::1
@@ -1415,7 +1430,7 @@ starg_include_ir_ipv6_ipv6() echo "-------------------------------------------------------------" starg_include_ir_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $grp \ - $valid_src $invalid_src "mausezahn -6" + $grp_dmac $valid_src $invalid_src "mausezahn -6" } starg_exclude_p2mp_common()
@@ -1425,6 +1440,7 @@ starg_exclude_p2mp_common() local mcast_grp=$1; shift local plen=$1; shift local grp=$1; shift + local grp_dmac=$1; shift local valid_src=$1; shift local invalid_src=$1; shift local mz=$1; shift
@@ -1442,12 +1458,12 @@ starg_exclude_p2mp_common() run_cmd "bridge -n $ns1 mdb replace dev vx0 port vx0 grp $grp permanent filter_mode exclude source_list $invalid_src dst $mcast_grp src_vni 10010 via veth0" # Check that invalid source is not forwarded. - run_cmd "ip netns exec $ns1 $mz br0.10 -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 0 log_test $? 0 "Block excluded source" # Check that valid source is forwarded. - run_cmd "ip netns exec $ns1 $mz br0.10 -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 1 log_test $? 0 "Forward valid source"
@@ -1455,7 +1471,7 @@ starg_exclude_p2mp_common() run_cmd "ip -n $ns2 address del $mcast_grp/$plen dev veth0" # Check that valid source is not received anymore. - run_cmd "ip netns exec $ns1 $mz br0.10 -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 1 log_test $? 0 "Receive of valid source after removal from group" }
@@ -1467,6 +1483,7 @@ starg_exclude_p2mp_ipv4_ipv4() local mcast_grp=238.1.1.1 local plen=32 local grp=239.1.1.1 + local grp_dmac=01:00:5e:01:01:01 local valid_src=192.0.2.129 local invalid_src=192.0.2.145
@@ -1474,7 +1491,7 @@ starg_exclude_p2mp_ipv4_ipv4() echo "Data path: (*, G) EXCLUDE - P2MP - IPv4 overlay / IPv4 underlay" echo "---------------------------------------------------------------" - starg_exclude_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp \ + starg_exclude_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp $grp_dmac \ $valid_src $invalid_src "mausezahn" }
@@ -1485,6 +1502,7 @@ starg_exclude_p2mp_ipv6_ipv4() local mcast_grp=238.1.1.1 local plen=32 local grp=ff0e::1 + local grp_dmac=33:33:00:00:00:01 local valid_src=2001:db8:100::1 local invalid_src=2001:db8:200::1
@@ -1492,7 +1510,7 @@ starg_exclude_p2mp_ipv6_ipv4() echo "Data path: (*, G) EXCLUDE - P2MP - IPv6 overlay / IPv4 underlay" echo "---------------------------------------------------------------" - starg_exclude_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp \ + starg_exclude_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp $grp_dmac \ $valid_src $invalid_src "mausezahn -6" }
@@ -1503,6 +1521,7 @@ starg_exclude_p2mp_ipv4_ipv6() local mcast_grp=ff0e::2 local plen=128 local grp=239.1.1.1 + local grp_dmac=01:00:5e:01:01:01 local valid_src=192.0.2.129 local invalid_src=192.0.2.145
@@ -1510,7 +1529,7 @@ starg_exclude_p2mp_ipv4_ipv6() echo "Data path: (*, G) EXCLUDE - P2MP - IPv4 overlay / IPv6 underlay" echo "---------------------------------------------------------------" - starg_exclude_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp \ + starg_exclude_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp $grp_dmac \ $valid_src $invalid_src "mausezahn" }
@@ -1521,6 +1540,7 @@ starg_exclude_p2mp_ipv6_ipv6() local mcast_grp=ff0e::2 local plen=128 local grp=ff0e::1 + local grp_dmac=33:33:00:00:00:01 local valid_src=2001:db8:100::1 local invalid_src=2001:db8:200::1
@@ -1528,7 +1548,7 @@ starg_exclude_p2mp_ipv6_ipv6() echo "Data path: (*, G) EXCLUDE - P2MP - IPv6 overlay / IPv6 underlay" echo "---------------------------------------------------------------" - starg_exclude_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp \ + starg_exclude_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp $grp_dmac \ $valid_src $invalid_src "mausezahn -6" }
@@ -1539,6 +1559,7 @@ starg_include_p2mp_common() local mcast_grp=$1; shift local plen=$1; shift local grp=$1; shift + local grp_dmac=$1; shift local valid_src=$1; shift local invalid_src=$1; shift local mz=$1; shift
@@ -1556,12 +1577,12 @@ starg_include_p2mp_common() run_cmd "bridge -n $ns1 mdb replace dev vx0 port vx0 grp $grp permanent filter_mode include source_list $valid_src dst $mcast_grp src_vni 10010 via veth0" # Check that invalid source is not forwarded. - run_cmd "ip netns exec $ns1 $mz br0.10 -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $invalid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 0 log_test $? 0 "Block excluded source" # Check that valid source is forwarded. - run_cmd "ip netns exec $ns1 $mz br0.10 -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 1 log_test $? 0 "Forward valid source"
@@ -1569,7 +1590,7 @@ starg_include_p2mp_common() run_cmd "ip -n $ns2 address del $mcast_grp/$plen dev veth0" # Check that valid source is not received anymore. - run_cmd "ip netns exec $ns1 $mz br0.10 -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $valid_src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 1 log_test $? 0 "Receive of valid source after removal from group" }
@@ -1581,6 +1602,7 @@ starg_include_p2mp_ipv4_ipv4() local mcast_grp=238.1.1.1 local plen=32 local grp=239.1.1.1 + local grp_dmac=01:00:5e:01:01:01 local valid_src=192.0.2.129 local invalid_src=192.0.2.145
@@ -1588,7 +1610,7 @@ starg_include_p2mp_ipv4_ipv4() echo "Data path: (*, G) INCLUDE - P2MP - IPv4 overlay / IPv4 underlay" echo "---------------------------------------------------------------" - starg_include_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp \ + starg_include_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp $grp_dmac \ $valid_src $invalid_src "mausezahn" }
@@ -1599,6 +1621,7 @@ starg_include_p2mp_ipv6_ipv4() local mcast_grp=238.1.1.1 local plen=32 local grp=ff0e::1 + local grp_dmac=33:33:00:00:00:01 local valid_src=2001:db8:100::1 local invalid_src=2001:db8:200::1
@@ -1606,7 +1629,7 @@ starg_include_p2mp_ipv6_ipv4() echo "Data path: (*, G) INCLUDE - P2MP - IPv6 overlay / IPv4 underlay" echo "---------------------------------------------------------------" - starg_include_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp \ + starg_include_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp $grp_dmac \ $valid_src $invalid_src "mausezahn -6" }
@@ -1617,6 +1640,7 @@ starg_include_p2mp_ipv4_ipv6() local mcast_grp=ff0e::2 local plen=128 local grp=239.1.1.1 + local grp_dmac=01:00:5e:01:01:01 local valid_src=192.0.2.129 local invalid_src=192.0.2.145
@@ -1624,7 +1648,7 @@ starg_include_p2mp_ipv4_ipv6() echo "Data path: (*, G) INCLUDE - P2MP - IPv4 overlay / IPv6 underlay" echo "---------------------------------------------------------------" - starg_include_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp \ + starg_include_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp $grp_dmac \ $valid_src $invalid_src "mausezahn" }
@@ -1635,6 +1659,7 @@ starg_include_p2mp_ipv6_ipv6() local mcast_grp=ff0e::2 local plen=128 local grp=ff0e::1 + local grp_dmac=33:33:00:00:00:01 local valid_src=2001:db8:100::1 local invalid_src=2001:db8:200::1
@@ -1642,7 +1667,7 @@ starg_include_p2mp_ipv6_ipv6() echo "Data path: (*, G) INCLUDE - P2MP - IPv6 overlay / IPv6 underlay" echo "---------------------------------------------------------------" - starg_include_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp \ + starg_include_p2mp_common $ns1 $ns2 $mcast_grp $plen $grp $grp_dmac \ $valid_src $invalid_src "mausezahn -6" }
@@ -1654,6 +1679,7 @@ egress_vni_translation_common() local plen=$1; shift local proto=$1; shift local grp=$1; shift + local grp_dmac=$1; shift local src=$1; shift local mz=$1; shift
@@ -1689,20 +1715,20 @@ egress_vni_translation_common() # Make sure that packets sent from the first VTEP over VLAN 10 are # received by the SVI corresponding to the L3VNI (14000 / VLAN 4000) on # the second VTEP, since it is configured as PVID. - run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev br0.4000 ingress" 101 1 log_test $? 0 "Egress VNI translation - PVID configured" # Remove PVID flag from VLAN 4000 on the second VTEP and make sure # packets are no longer received by the SVI interface. run_cmd "bridge -n $ns2 vlan add vid 4000 dev vx0" - run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev br0.4000 ingress" 101 1 log_test $? 0 "Egress VNI translation - no PVID configured" # Reconfigure the PVID and make sure packets are received again. run_cmd "bridge -n $ns2 vlan add vid 4000 dev vx0 pvid" - run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev br0.4000 ingress" 101 2 log_test $? 0 "Egress VNI translation - PVID reconfigured" }
@@ -1715,6 +1741,7 @@ egress_vni_translation_ipv4_ipv4() local plen=32 local proto="ipv4" local grp=239.1.1.1 + local grp_dmac=01:00:5e:01:01:01 local src=192.0.2.129 echo
@@ -1722,7 +1749,7 @@ egress_vni_translation_ipv4_ipv4() echo "----------------------------------------------------------------" egress_vni_translation_common $ns1 $ns2 $mcast_grp $plen $proto $grp \ - $src "mausezahn" + $grp_dmac $src "mausezahn" } egress_vni_translation_ipv6_ipv4()
@@ -1733,6 +1760,7 @@ egress_vni_translation_ipv6_ipv4() local plen=32 local proto="ipv6" local grp=ff0e::1 + local grp_dmac=33:33:00:00:00:01 local src=2001:db8:100::1 echo
@@ -1740,7 +1768,7 @@ egress_vni_translation_ipv6_ipv4() echo "----------------------------------------------------------------" egress_vni_translation_common $ns1 $ns2 $mcast_grp $plen $proto $grp \ - $src "mausezahn -6" + $grp_dmac $src "mausezahn -6" } egress_vni_translation_ipv4_ipv6()
@@ -1751,6 +1779,7 @@ egress_vni_translation_ipv4_ipv6() local plen=128 local proto="ipv4" local grp=239.1.1.1 + local grp_dmac=01:00:5e:01:01:01 local src=192.0.2.129 echo
@@ -1758,7 +1787,7 @@ egress_vni_translation_ipv4_ipv6() echo "----------------------------------------------------------------" egress_vni_translation_common $ns1 $ns2 $mcast_grp $plen $proto $grp \ - $src "mausezahn" + $grp_dmac $src "mausezahn" } egress_vni_translation_ipv6_ipv6()
@@ -1769,6 +1798,7 @@ egress_vni_translation_ipv6_ipv6() local plen=128 local proto="ipv6" local grp=ff0e::1 + local grp_dmac=33:33:00:00:00:01 local src=2001:db8:100::1 echo
@@ -1776,7 +1806,7 @@ egress_vni_translation_ipv6_ipv6() echo "----------------------------------------------------------------" egress_vni_translation_common $ns1 $ns2 $mcast_grp $plen $proto $grp \ - $src "mausezahn -6" + $grp_dmac $src "mausezahn -6" } all_zeros_mdb_common()
@@ -1789,12 +1819,18 @@ all_zeros_mdb_common() local vtep4_ip=$1; shift local plen=$1; shift local ipv4_grp=239.1.1.1 + local ipv4_grp_dmac=01:00:5e:01:01:01 local ipv4_unreg_grp=239.2.2.2 + local ipv4_unreg_grp_dmac=01:00:5e:02:02:02 local ipv4_ll_grp=224.0.0.100 + local ipv4_ll_grp_dmac=01:00:5e:00:00:64 local ipv4_src=192.0.2.129 local ipv6_grp=ff0e::1 + local ipv6_grp_dmac=33:33:00:00:00:01 local ipv6_unreg_grp=ff0e::2 + local ipv6_unreg_grp_dmac=33:33:00:00:00:02 local ipv6_ll_grp=ff02::1 + local ipv6_ll_grp_dmac=33:33:00:00:00:01 local ipv6_src=2001:db8:100::1 # Install all-zeros (catchall) MDB entries for IPv4 and IPv6 traffic
@@ -1830,7 +1866,7 @@ all_zeros_mdb_common() # Send registered IPv4 multicast and make sure it only arrives to the # first VTEP. - run_cmd "ip netns exec $ns1 mausezahn br0.10 -A $ipv4_src -B $ipv4_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 mausezahn br0.10 -a own -b $ipv4_grp_dmac -A $ipv4_src -B $ipv4_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 1 log_test $? 0 "Registered IPv4 multicast - first VTEP" tc_check_packets "$ns2" "dev vx0 ingress" 102 0
@@ -1838,7 +1874,7 @@ all_zeros_mdb_common() # Send unregistered IPv4 multicast that is not link-local and make sure # it arrives to the first and second VTEPs. - run_cmd "ip netns exec $ns1 mausezahn br0.10 -A $ipv4_src -B $ipv4_unreg_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 mausezahn br0.10 -a own -b $ipv4_unreg_grp_dmac -A $ipv4_src -B $ipv4_unreg_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 2 log_test $? 0 "Unregistered IPv4 multicast - first VTEP" tc_check_packets "$ns2" "dev vx0 ingress" 102 1
@@ -1846,7 +1882,7 @@ all_zeros_mdb_common() # Send IPv4 link-local multicast traffic and make sure it does not # arrive to any VTEP. - run_cmd "ip netns exec $ns1 mausezahn br0.10 -A $ipv4_src -B $ipv4_ll_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 mausezahn br0.10 -a own -b $ipv4_ll_grp_dmac -A $ipv4_src -B $ipv4_ll_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 2 log_test $? 0 "Link-local IPv4 multicast - first VTEP" tc_check_packets "$ns2" "dev vx0 ingress" 102 1
@@ -1881,7 +1917,7 @@ all_zeros_mdb_common() # Send registered IPv6 multicast and make sure it only arrives to the # third VTEP. - run_cmd "ip netns exec $ns1 mausezahn -6 br0.10 -A $ipv6_src -B $ipv6_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 mausezahn -6 br0.10 -a own -b $ipv6_grp_dmac -A $ipv6_src -B $ipv6_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 103 1 log_test $? 0 "Registered IPv6 multicast - third VTEP" tc_check_packets "$ns2" "dev vx0 ingress" 104 0
@@ -1889,7 +1925,7 @@ all_zeros_mdb_common() # Send unregistered IPv6 multicast that is not link-local and make sure # it arrives to the third and fourth VTEPs. - run_cmd "ip netns exec $ns1 mausezahn -6 br0.10 -A $ipv6_src -B $ipv6_unreg_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 mausezahn -6 br0.10 -a own -b $ipv6_unreg_grp_dmac -A $ipv6_src -B $ipv6_unreg_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 103 2 log_test $? 0 "Unregistered IPv6 multicast - third VTEP" tc_check_packets "$ns2" "dev vx0 ingress" 104 1
@@ -1897,7 +1933,7 @@ all_zeros_mdb_common() # Send IPv6 link-local multicast traffic and make sure it does not # arrive to any VTEP. - run_cmd "ip netns exec $ns1 mausezahn -6 br0.10 -A $ipv6_src -B $ipv6_ll_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 mausezahn -6 br0.10 -a own -b $ipv6_ll_grp_dmac -A $ipv6_src -B $ipv6_ll_grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 103 2 log_test $? 0 "Link-local IPv6 multicast - third VTEP" tc_check_packets "$ns2" "dev vx0 ingress" 104 1
@@ -1972,6 +2008,7 @@ mdb_fdb_common() local plen=$1; shift local proto=$1; shift local grp=$1; shift + local grp_dmac=$1; shift local src=$1; shift local mz=$1; shift
@@ -1995,7 +2032,7 @@ mdb_fdb_common() # Send IP multicast traffic and make sure it is forwarded by the MDB # and only arrives to the first VTEP. - run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 1 log_test $? 0 "IP multicast - first VTEP" tc_check_packets "$ns2" "dev vx0 ingress" 102 0
@@ -2012,7 +2049,7 @@ mdb_fdb_common() # Remove the MDB entry and make sure that IP multicast is now forwarded # by the FDB to the second VTEP. run_cmd "bridge -n $ns1 mdb del dev vx0 port vx0 grp $grp dst $vtep1_ip src_vni 10010" - run_cmd "ip netns exec $ns1 $mz br0.10 -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" + run_cmd "ip netns exec $ns1 $mz br0.10 -a own -b $grp_dmac -A $src -B $grp -t udp sp=12345,dp=54321 -p 100 -c 1 -q" tc_check_packets "$ns2" "dev vx0 ingress" 101 1 log_test $? 0 "IP multicast after removal - first VTEP" tc_check_packets "$ns2" "dev vx0 ingress" 102 2
@@ -2028,14 +2065,15 @@ mdb_fdb_ipv4_ipv4() local plen=32 local proto="ipv4" local grp=239.1.1.1 + local grp_dmac=01:00:5e:01:01:01 local src=192.0.2.129 echo echo "Data path: MDB with FDB - IPv4 overlay / IPv4 underlay" echo "------------------------------------------------------" - mdb_fdb_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $proto $grp $src \ - "mausezahn" + mdb_fdb_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $proto $grp \ + $grp_dmac $src "mausezahn" } mdb_fdb_ipv6_ipv4()
@@ -2047,14 +2085,15 @@ mdb_fdb_ipv6_ipv4() local plen=32 local proto="ipv6" local grp=ff0e::1 + local grp_dmac=33:33:00:00:00:01 local src=2001:db8:100::1 echo echo "Data path: MDB with FDB - IPv6 overlay / IPv4 underlay" echo "------------------------------------------------------" - mdb_fdb_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $proto $grp $src \ - "mausezahn -6" + mdb_fdb_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $proto $grp \ + $grp_dmac $src "mausezahn -6" } mdb_fdb_ipv4_ipv6()
@@ -2066,14 +2105,15 @@ mdb_fdb_ipv4_ipv6() local plen=128 local proto="ipv4" local grp=239.1.1.1 + local grp_dmac=01:00:5e:01:01:01 local src=192.0.2.129 echo echo "Data path: MDB with FDB - IPv4 overlay / IPv6 underlay" echo "------------------------------------------------------" - mdb_fdb_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $proto $grp $src \ - "mausezahn" + mdb_fdb_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $proto $grp \ + $grp_dmac $src "mausezahn" } mdb_fdb_ipv6_ipv6()
@@ -2085,14 +2125,15 @@ mdb_fdb_ipv6_ipv6() local plen=128 local proto="ipv6" local grp=ff0e::1 + local grp_dmac=33:33:00:00:00:01 local src=2001:db8:100::1 echo echo "Data path: MDB with FDB - IPv6 overlay / IPv6 underlay" echo "------------------------------------------------------" - mdb_fdb_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $proto $grp $src \ - "mausezahn -6" + mdb_fdb_common $ns1 $ns2 $vtep1_ip $vtep2_ip $plen $proto $grp \ + $grp_dmac $src "mausezahn -6" } mdb_grp1_loop()
@@ -2127,7 +2168,9 @@ mdb_torture_common() local vtep1_ip=$1; shift local vtep2_ip=$1; shift local grp1=$1; shift + local grp1_dmac=$1; shift local grp2=$1; shift + local grp2_dmac=$1; shift local src=$1; shift local mz=$1; shift local pid1
@@ -2152,9 +2195,9 @@ mdb_torture_common() pid1=$! mdb_grp2_loop $ns1 $vtep1_ip $vtep2_ip $grp2 & pid2=$! - ip netns exec $ns1 $mz br0.10 -A $src -B $grp1 -t udp sp=12345,dp=54321 -p 100 -c 0 -q & + ip netns exec $ns1 $mz br0.10 -a own -b $grp1_dmac -A $src -B $grp1 -t udp sp=12345,dp=54321 -p 100 -c 0 -q & pid3=$! - ip netns exec $ns1 $mz br0.10 -A $src -B $grp2 -t udp sp=12345,dp=54321 -p 100 -c 0 -q & + ip netns exec $ns1 $mz br0.10 -a own -b $grp2_dmac -A $src -B $grp2 -t udp sp=12345,dp=54321 -p 100 -c 0 -q & pid4=$! sleep 30
@@ -2170,15 +2213,17 @@ mdb_torture_ipv4_ipv4() local vtep1_ip=198.51.100.100 local vtep2_ip=198.51.100.200 local grp1=239.1.1.1 + local grp1_dmac=01:00:5e:01:01:01 local grp2=239.2.2.2 + local grp2_dmac=01:00:5e:02:02:02 local src=192.0.2.129 echo echo "Data path: MDB torture test - IPv4 overlay / IPv4 underlay" echo "----------------------------------------------------------" - mdb_torture_common $ns1 $vtep1_ip $vtep2_ip $grp1 $grp2 $src \ - "mausezahn" + mdb_torture_common $ns1 $vtep1_ip $vtep2_ip $grp1 $grp1_dmac $grp2 \ + $grp2_dmac $src "mausezahn" } mdb_torture_ipv6_ipv4()
@@ -2187,15 +2232,17 @@ mdb_torture_ipv6_ipv4() local vtep1_ip=198.51.100.100 local vtep2_ip=198.51.100.200 local grp1=ff0e::1 + local grp1_dmac=33:33:00:00:00:01 local grp2=ff0e::2 + local grp2_dmac=33:33:00:00:00:02 local src=2001:db8:100::1 echo echo "Data path: MDB torture test - IPv6 overlay / IPv4 underlay" echo "----------------------------------------------------------" - mdb_torture_common $ns1 $vtep1_ip $vtep2_ip $grp1 $grp2 $src \ - "mausezahn -6" + mdb_torture_common $ns1 $vtep1_ip $vtep2_ip $grp1 $grp1_dmac $grp2 \ + $grp2_dmac $src "mausezahn -6" } mdb_torture_ipv4_ipv6()
@@ -2204,15 +2251,17 @@ mdb_torture_ipv4_ipv6() local vtep1_ip=2001:db8:1000::1 local vtep2_ip=2001:db8:2000::1 local grp1=239.1.1.1 + local grp1_dmac=01:00:5e:01:01:01 local grp2=239.2.2.2 + local grp2_dmac=01:00:5e:02:02:02 local src=192.0.2.129 echo echo "Data path: MDB torture test - IPv4 overlay / IPv6 underlay" echo "----------------------------------------------------------" - mdb_torture_common $ns1 $vtep1_ip $vtep2_ip $grp1 $grp2 $src \ - "mausezahn" + mdb_torture_common $ns1 $vtep1_ip $vtep2_ip $grp1 $grp1_dmac $grp2 \ + $grp2_dmac $src "mausezahn" } mdb_torture_ipv6_ipv6()
@@ -2221,15 +2270,17 @@ mdb_torture_ipv6_ipv6() local vtep1_ip=2001:db8:1000::1 local vtep2_ip=2001:db8:2000::1 local grp1=ff0e::1 + local grp1_dmac=33:33:00:00:00:01 local grp2=ff0e::2 + local grp2_dmac=33:33:00:00:00:02 local src=2001:db8:100::1 echo echo "Data path: MDB torture test - IPv6 overlay / IPv6 underlay" echo "----------------------------------------------------------" - mdb_torture_common $ns1 $vtep1_ip $vtep2_ip $grp1 $grp2 $src \ - "mausezahn -6" + mdb_torture_common $ns1 $vtep1_ip $vtep2_ip $grp1 $grp1_dmac $grp2 \ + $grp2_dmac $src "mausezahn -6" } ################################################################################
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 25/252 ACPICA: debugger: check status of acpi_evaluate_object() in acpi_db_walk_for_fields()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Kiryushin <[email protected]>
[ Upstream commit 40e2710860e57411ab57a1529c5a2748abbe8a19 ]
ACPICA commit 9061cd9aa131205657c811a52a9f8325a040c6c9
Errors in acpi_evaluate_object() can lead to incorrect state of buffer.
This can lead to access to data in previously ACPI_FREEd buffer and secondary ACPI_FREE to the same buffer later.
Handle errors in acpi_evaluate_object the same way it is done earlier with acpi_ns_handle_to_pathname.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/acpi/acpica/dbnames.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/acpi/acpica/dbnames.c +6 -2
@@ -550,8 +550,12 @@ acpi_db_walk_for_fields(acpi_handle obj_handle,ACPI_FREE (buffer.pointer); buffer.length =ACPI_ALLOCATE_LOCAL_BUFFER ; -acpi_evaluate_object (obj_handle,NULL ,NULL , &buffer); - + status =acpi_evaluate_object (obj_handle,NULL ,NULL , &buffer); +if (ACPI_FAILURE (status)) { +acpi_os_printf ("Could Not evaluate object %p\n" , + obj_handle); +return (AE_OK ); + }/* * Since this is a field unit, surround the output in braces */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 26/252 net: hns3: fix index limit to support all queue stats
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jie Wang <[email protected]>
[ Upstream commit 47e39d213e09c6cae0d6b4d95e454ea404013312 ]
Currently, hns hardware supports more than 512 queues and the index limit in hclge_comm_tqps_update_stats is wrong. So this patch removes it.
--- .../ethernet/hisilicon/hns3/hns3_common/hclge_comm_tqp_stats.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_tqp_stats.c +1 -1
@@ -85,7 +85,7 @@ int hclge_comm_tqps_update_stats(struct hnae3_handle *handle,hclge_comm_cmd_setup_basic_desc (&desc,HCLGE_OPC_QUERY_TX_STATS , true); - desc.data[0 ] =cpu_to_le32 (tqp->index &0x1ff ); + desc.data[0 ] =cpu_to_le32 (tqp->index); ret =hclge_comm_cmd_send (hw, &desc,1 );if (ret) { dev_err(&hw->cmq.csq.pdev->dev,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 27/252 net: hns3: fix kernel crash when devlink reload during pf initialization
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yonglong Liu <[email protected]>
[ Upstream commit 93305b77ffcb042f1538ecc383505e87d95aa05a ]
The devlink reload process will access the hardware resources, but the register operation is done before the hardware is initialized. So, processing the devlink reload during initialization may lead to kernel crash. This patch fixes this by taking devl_lock during initialization.
--- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +4 -0
@@ -11614,6 +11614,8 @@ static int hclge_init_ae_dev(struct hnae3_ae_dev *ae_dev)if (ret) goto err_pci_uninit; +devl_lock (hdev->devlink); +/* Firmware command queue initialize */ ret =hclge_comm_cmd_queue_init (hdev->pdev, &hdev->hw.hw);if (ret)
@@ -11793,6 +11795,7 @@ static int hclge_init_ae_dev(struct hnae3_ae_dev *ae_dev)hclge_task_schedule (hdev,round_jiffies_relative (HZ )); +devl_unlock (hdev->devlink);return 0 ; err_mdiobus_unreg:
@@ -11805,6 +11808,7 @@ static int hclge_init_ae_dev(struct hnae3_ae_dev *ae_dev) err_cmd_uninit:hclge_comm_cmd_uninit (hdev->ae_dev, &hdev->hw.hw); err_devlink_uninit: +devl_unlock (hdev->devlink);hclge_devlink_uninit (hdev); err_pci_uninit:pcim_iounmap (pdev, hdev->hw.hw.io_base);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 28/252 net: hns3: mark unexcuted loopback test result as UNEXECUTED
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jian Shen <[email protected]>
[ Upstream commit 5bd088d6c21a45ee70e6116879310e54174d75eb ]
Currently, loopback test may be skipped when resetting, but the test result will still show as 'PASS', because the driver doesn't set ETH_TEST_FL_FAILED flag. Fix it by setting the flag and initializating the value to UNEXECUTED.
--- .../ethernet/hisilicon/hns3/hns3_ethtool.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-)
drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c +17 -2
@@ -78,6 +78,9 @@ static const struct hns3_stats hns3_rxq_stats[] = {#define HNS3_NIC_LB_TEST_NO_MEM_ERR 1#define HNS3_NIC_LB_TEST_TX_CNT_ERR 2#define HNS3_NIC_LB_TEST_RX_CNT_ERR 3 +#define HNS3_NIC_LB_TEST_UNEXECUTED 4 + +static int hns3_get_sset_count (struct net_device *netdev,int stringset);static int hns3_lp_setup (struct net_device *ndev,enum hnae3_loop loop,bool en) {
@@ -418,18 +421,26 @@ static void hns3_do_external_lb(struct net_device *ndev,static void hns3_self_test (struct net_device *ndev,struct ethtool_test *eth_test,u64 *data) { +int cnt =hns3_get_sset_count (ndev,ETH_SS_TEST );struct hns3_nic_priv *priv =netdev_priv (ndev);struct hnae3_handle *h = priv->ae_handle;int st_param[HNAE3_LOOP_NONE ][2 ];bool if_running =netif_running (ndev); +int i; + +/* initialize the loopback test result, avoid marking an unexcuted +* loopback test as PASS. +*/ +for (i =0 ; i < cnt; i++) + data[i] =HNS3_NIC_LB_TEST_UNEXECUTED ;if (hns3_nic_resetting (ndev)) {netdev_err (ndev,"dev resetting!" ); -return ; + goto failure; }if (!(eth_test->flags Ð_TEST_FL_OFFLINE )) -return ; + goto failure;if (netif_msg_ifdown (h))netdev_info (ndev,"self test start\n" );
@@ -451,6 +462,10 @@ static void hns3_self_test(struct net_device *ndev,if (netif_msg_ifdown (h))netdev_info (ndev,"self test end\n" ); +return ; + +failure: + eth_test->flags |=ETH_TEST_FL_FAILED ; } static void hns3_update_limit_promisc_mode(struct net_device *netdev,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 29/252 tls: recv: process_rx_list shouldnt use an offset with kvec
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit 7608a971fdeb4c3eefa522d1bfe8d4bc6b2481cc ]
Only MSG_PEEK needs to copy from an offset during the final process_rx_list call, because the bytes we copied at the beginning of tls_sw_recvmsg were left on the rx_list. In the KVEC case, we removed data from the rx_list as we were copying it, so there's no need to use an offset, just like in the normal case.
--- net/tls/tls_sw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/tls/tls_sw.c +1 -1
@@ -2152,7 +2152,7 @@ int tls_sw_recvmsg(struct sock *sk, }/* Drain records from the rx_list & copy if required */ -if (is_peek || is_kvec) +if (is_peek) err =process_rx_list (ctx, msg, &control, copied + peeked, decrypted - peeked, is_peek,NULL );else
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 30/252 tls: adjust recv return with async crypto and failed copy to userspace
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit 85eef9a41d019b59be7bc91793f26251909c0710 ]
process_rx_list may not copy as many bytes as we want to the userspace buffer, for example in case we hit an EFAULT during the copy. If this happens, we should only count the bytes that were actually copied, which may be 0.
Subtracting async_copy_bytes is correct in both peek and !peek cases, because decrypted == async_copy_bytes + peeked for the peek case: peek is always !ZC, and we can go through either the sync or async path. In the async case, we add chunk to both decrypted and async_copy_bytes. In the sync case, we add chunk to both decrypted and peeked. I missed that in commit 6caaf104423d ("tls: fix peeking with sync+async decryption").
--- net/tls/tls_sw.c | 3 +++ 1 file changed, 3 insertions(+)
net/tls/tls_sw.c +3 -0
@@ -2158,6 +2158,9 @@ int tls_sw_recvmsg(struct sock *sk,else err =process_rx_list (ctx, msg, &control,0 , async_copy_bytes, is_peek,NULL ); + +/* we could have copied less than we wanted, and possibly nothing */ + decrypted +=max (err,0 ) - async_copy_bytes; } copied += decrypted;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 31/252 tls: get psock ref after taking rxlock to avoid leak
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit 417e91e856099e9b8a42a2520e2255e6afe024be ]
At the start of tls_sw_recvmsg, we take a reference on the psock, and then call tls_rx_reader_lock. If that fails, we return directly without releasing the reference.
Instead of adding a new label, just take the reference after locking has succeeded, since we don't need it before.
--- net/tls/tls_sw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/tls/tls_sw.c +1 -1
@@ -1976,10 +1976,10 @@ int tls_sw_recvmsg(struct sock *sk,if (unlikely (flags &MSG_ERRQUEUE ))return sock_recv_errqueue (sk, msg, len,SOL_IP ,IP_RECVERR ); - psock =sk_psock_get (sk); err =tls_rx_reader_lock (sk, ctx, flags &MSG_DONTWAIT );if (err <0 )return err; + psock =sk_psock_get (sk); bpf_strp_enabled =sk_psock_strp_enabled (psock);/* If crypto failed the connection is broken */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 32/252 mlxbf_gige: call request_irq() after NAPI initialized
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Thompson <[email protected]>
[ Upstream commit f7442a634ac06b953fc1f7418f307b25acd4cfbc ]
The mlxbf_gige driver encounters a NULL pointer exception in mlxbf_gige_open() when kdump is enabled. The sequence to reproduce the exception is as follows:
a) enable kdump
b) trigger kdump via "echo c > /proc/sysrq-trigger"
c) kdump kernel executes
d) kdump kernel loads mlxbf_gige module
e) the mlxbf_gige module runs its open() as the
the "oob_net0" interface is brought up
f) mlxbf_gige module will experience an exception
during its open(), something like:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
Mem abort info:
ESR = 0x0000000086000004
EC = 0x21: IABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x04: level 0 translation fault
user pgtable: 4k pages, 48-bit VAs, pgdp=00000000e29a4000
[0000000000000000] pgd=0000000000000000, p4d=0000000000000000
Internal error: Oops: 0000000086000004 [#1] SMP
CPU: 0 PID: 812 Comm: NetworkManager Tainted: G OE 5.15.0-1035-bluefield #37-Ubuntu
Hardware name: https://www.mellanox.com BlueField-3 SmartNIC Main Card/BlueField-3 SmartNIC Main Card, BIOS 4.6.0.13024 Jan 19 2024
pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : 0x0
lr : __napi_poll+0x40/0x230
sp : ffff800008003e00
x29: ffff800008003e00 x28: 0000000000000000 x27: 00000000ffffffff
x26: ffff000066027238 x25: ffff00007cedec00 x24: ffff800008003ec8
x23: 000000000000012c x22: ffff800008003eb7 x21: 0000000000000000
x20: 0000000000000001 x19: ffff000066027238 x18: 0000000000000000
x17: ffff578fcb450000 x16: ffffa870b083c7c0 x15: 0000aaab010441d0
x14: 0000000000000001 x13: 00726f7272655f65 x12: 6769675f6662786c
x11: 0000000000000000 x10: 0000000000000000 x9 : ffffa870b0842398
x8 : 0000000000000004 x7 : fe5a48b9069706ea x6 : 17fdb11fc84ae0d2
x5 : d94a82549d594f35 x4 : 0000000000000000 x3 : 0000000000400100
x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000066027238
Call trace:
0x0
net_rx_action+0x178/0x360
__do_softirq+0x15c/0x428
__irq_exit_rcu+0xac/0xec
irq_exit+0x18/0x2c
handle_domain_irq+0x6c/0xa0
gic_handle_irq+0xec/0x1b0
call_on_irq_stack+0x20/0x2c
do_interrupt_handler+0x5c/0x70
el1_interrupt+0x30/0x50
el1h_64_irq_handler+0x18/0x2c
el1h_64_irq+0x7c/0x80
__setup_irq+0x4c0/0x950
request_threaded_irq+0xf4/0x1bc
mlxbf_gige_request_irqs+0x68/0x110 [mlxbf_gige]
mlxbf_gige_open+0x5c/0x170 [mlxbf_gige]
__dev_open+0x100/0x220
__dev_change_flags+0x16c/0x1f0
dev_change_flags+0x2c/0x70
do_setlink+0x220/0xa40
__rtnl_newlink+0x56c/0x8a0
rtnl_newlink+0x58/0x84
rtnetlink_rcv_msg+0x138/0x3c4
netlink_rcv_skb+0x64/0x130
rtnetlink_rcv+0x20/0x30
netlink_unicast+0x2ec/0x360
netlink_sendmsg+0x278/0x490
__sock_sendmsg+0x5c/0x6c
____sys_sendmsg+0x290/0x2d4
___sys_sendmsg+0x84/0xd0
__sys_sendmsg+0x70/0xd0
__arm64_sys_sendmsg+0x2c/0x40
invoke_syscall+0x78/0x100
el0_svc_common.constprop.0+0x54/0x184
do_el0_svc+0x30/0xac
el0_svc+0x48/0x160
el0t_64_sync_handler+0xa4/0x12c
el0t_64_sync+0x1a4/0x1a8
Code: bad PC value
---[ end trace 7d1c3f3bf9d81885 ]---
Kernel panic - not syncing: Oops: Fatal exception in interrupt
Kernel Offset: 0x2870a7a00000 from 0xffff800008000000
PHYS_OFFSET: 0x80000000
CPU features: 0x0,000005c1,a3332a5a
Memory Limit: none
---[ end Kernel panic - not syncing: Oops: Fatal exception in interrupt ]---The exception happens because there is a pending RX interrupt before the call to request_irq(RX IRQ) executes. Then, the RX IRQ handler fires immediately after this request_irq() completes. The RX IRQ handler runs "napi_schedule()" before NAPI is fully initialized via "netif_napi_add()" and "napi_enable()", both which happen later in the open() logic.
The logic in mlxbf_gige_open() must fully initialize NAPI before any calls to request_irq() execute.
--- .../mellanox/mlxbf_gige/mlxbf_gige_main.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-)
drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c +11 -7
@@ -139,13 +139,10 @@ static int mlxbf_gige_open(struct net_device *netdev) control |=MLXBF_GIGE_CONTROL_PORT_EN ;writeq (control, priv->base +MLXBF_GIGE_CONTROL ); - err =mlxbf_gige_request_irqs (priv); -if (err) -return err;mlxbf_gige_cache_stats (priv); err =mlxbf_gige_clean_port (priv);if (err) - goto free_irqs; +return err;/* Clear driver's valid_polarity to match hardware, * since the above call to clean_port() resets the
@@ -166,6 +163,10 @@ static int mlxbf_gige_open(struct net_device *netdev)napi_enable (&priv->napi);netif_start_queue (netdev); + err =mlxbf_gige_request_irqs (priv); +if (err) + goto napi_deinit; +/* Set bits in INT_EN that we care about */ int_en =MLXBF_GIGE_INT_EN_HW_ACCESS_ERROR | MLXBF_GIGE_INT_EN_TX_CHECKSUM_INPUTS |
@@ -182,14 +183,17 @@ static int mlxbf_gige_open(struct net_device *netdev)return 0 ; +napi_deinit: +netif_stop_queue (netdev); +napi_disable (&priv->napi); +netif_napi_del (&priv->napi); +mlxbf_gige_rx_deinit (priv); + tx_deinit:mlxbf_gige_tx_deinit (priv); phy_deinit:phy_stop (phydev); - -free_irqs: -mlxbf_gige_free_irqs (priv);return err; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 33/252 bpf: Protect against int overflow for stack access size
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrei Matei <[email protected]>
[ Upstream commit ecc6a2101840177e57c925c102d2d29f260d37c8 ]
This patch re-introduces protection against the size of access to stack memory being negative; the access size can appear negative as a result of overflowing its signed int representation. This should not actually happen, as there are other protections along the way, but we should protect against it anyway. One code path was missing such protections (fixed in the previous patch in the series), causing out-of-bounds array accesses in check_stack_range_initialized(). This patch causes the verification of a program with such a non-sensical access size to fail.
This check used to exist in a more indirect way, but was inadvertendly removed in a833a17aeac7.
--- kernel/bpf/verifier.c | 5 +++++ 1 file changed, 5 insertions(+)
kernel/bpf/verifier.c +5 -0
@@ -6637,6 +6637,11 @@ static int check_stack_access_within_bounds( err =check_stack_slot_within_bounds (env, min_off, state, type);if (!err && max_off >0 ) err = -EINVAL ;/* out of stack access into non-negative offsets */ +if (!err && access_size <0 ) +/* access_size should not be negative (or overflow an int); others checks +* along the way should have prevented such an access. +*/ + err = -EFAULT ;/* invalid negative access size; integer overflow? */ if (err) {if (tnum_is_const (reg->var_off)) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 34/252 cifs: Fix duplicate fscache cookie warnings
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
[ Upstream commit 8876a37277cb832e1861c35f8c661825179f73f5 ]
fscache emits a lot of duplicate cookie warnings with cifs because the index key for the fscache cookies does not include everything that the cifs_find_inode() function does. The latter is used with iget5_locked() to distinguish between inodes in the local inode cache.
Fix this by adding the creation time and file type to the fscache cookie key.
Additionally, add a couple of comments to note that if one is changed the other must be also.
--- fs/smb/client/fscache.c | 16 +++++++++++++++- fs/smb/client/inode.c | 2 ++ 2 files changed, 17 insertions(+), 1 deletion(-)
fs/smb/client/fscache.c +15 -1
@@ -12,6 +12,16 @@#include "cifs_fs_sb.h" #include "cifsproto.h" +/* +* Key for fscache inode. [!] Contents must match comparisons in cifs_find_inode(). +*/ +struct cifs_fscache_inode_key { + +__le64 uniqueid;/* server inode number */ +__le64 createtime;/* creation time on server */ +u8 type;/* S_IFMT file type */ +} __packed; +static void cifs_fscache_fill_volume_coherency (struct cifs_tcon *tcon,struct cifs_fscache_volume_coherency_data *cd)
@@ -97,15 +107,19 @@ void cifs_fscache_release_super_cookie(struct cifs_tcon *tcon)void cifs_fscache_get_inode_cookie (struct inode *inode) {struct cifs_fscache_inode_coherency_data cd; +struct cifs_fscache_inode_key key;struct cifsInodeInfo *cifsi =CIFS_I (inode);struct cifs_sb_info *cifs_sb =CIFS_SB (inode->i_sb);struct cifs_tcon *tcon =cifs_sb_master_tcon (cifs_sb); + key.uniqueid =cpu_to_le64 (cifsi->uniqueid); + key.createtime =cpu_to_le64 (cifsi->createtime); + key.type = (inode->i_mode &S_IFMT ) >>12 ;cifs_fscache_fill_coherency (&cifsi->netfs.inode, &cd); cifsi->netfs.cache =fscache_acquire_cookie (tcon->fscache,0 , - &cifsi->uniqueid,sizeof (cifsi->uniqueid), + &key,sizeof (key), &cd,sizeof (cd),i_size_read (&cifsi->netfs.inode));if (cifsi->netfs.cache)
fs/smb/client/inode.c +2 -0
@@ -1390,6 +1390,8 @@ cifs_find_inode(struct inode *inode, void *opaque) {struct cifs_fattr *fattr = opaque; +/* [!] The compared values must be the same in struct cifs_fscache_inode_key. */ +/* don't match inode with different uniqueid */ if (CIFS_I (inode)->uniqueid != fattr->cf_uniqueid)return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 35/252 netfilter: nf_tables: reject destroy command to remove basechain hooks
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit b32ca27fa238ff83427d23bef2a5b741e2a88a1e ]
Report EOPNOTSUPP if NFT_MSG_DESTROYCHAIN is used to delete hooks in an existing netdev basechain, thus, only NFT_MSG_DELCHAIN is allowed.
--- net/netfilter/nf_tables_api.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/netfilter/nf_tables_api.c +2 -1
@@ -2934,7 +2934,8 @@ static int nf_tables_delchain(struct sk_buff *skb, const struct nfnl_info *info,nft_ctx_init (&ctx, net, skb, info->nlh, family, table, chain, nla);if (nla[NFTA_CHAIN_HOOK ]) { -if (chain->flags &NFT_CHAIN_HW_OFFLOAD ) +if (NFNL_MSG_TYPE (info->nlh->nlmsg_type) ==NFT_MSG_DESTROYCHAIN || + chain->flags &NFT_CHAIN_HW_OFFLOAD )return -EOPNOTSUPP ;if (nft_is_base_chain (chain)) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 36/252 netfilter: nf_tables: reject table flag and netdev basechain updates
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 1e1fb6f00f52812277963365d9bd835b9b0ea4e0 ]
netdev basechain updates are stored in the transaction object hook list. When setting on the table dormant flag, it iterates over the existing hooks in the basechain. Thus, skipping the hooks that are being added/deleted in this transaction, which leaves hook registration in inconsistent state.
Reject table flag updates in combination with netdev basechain updates in the same batch:
- Update table flags and add/delete basechain: Check from basechain update path if there are pending flag updates for this table.
- add/delete basechain and update table flags: Iterate over the transaction list to search for basechain updates from the table update path.
In both cases, the batch is rejected. Based on suggestion from Florian Westphal.
--- net/netfilter/nf_tables_api.c | 31 ++++++++++++++++++++++++++++++- 1 file changed, 30 insertions(+), 1 deletion(-)
net/netfilter/nf_tables_api.c +30 -1
@@ -1200,6 +1200,25 @@ static void nf_tables_table_disable(struct net *net, struct nft_table *table)#define __NFT_TABLE_F_UPDATE (__NFT_TABLE_F_WAS_DORMANT | \ __NFT_TABLE_F_WAS_AWAKEN) +static bool nft_table_pending_update (const struct nft_ctx *ctx) +{ +struct nftables_pernet *nft_net =nft_pernet (ctx->net); +struct nft_trans *trans; + +if (ctx->table->flags & __NFT_TABLE_F_UPDATE) +return true; + +list_for_each_entry (trans, &nft_net->commit_list, list) { +if ((trans->msg_type ==NFT_MSG_NEWCHAIN || + trans->msg_type ==NFT_MSG_DELCHAIN ) && + trans->ctx.table == ctx->table && +nft_trans_chain_update (trans)) +return true; + } + +return false; +} +static int nf_tables_updtable (struct nft_ctx *ctx) {struct nft_trans *trans;
@@ -1223,7 +1242,7 @@ static int nf_tables_updtable(struct nft_ctx *ctx)return -EOPNOTSUPP ;/* No dormant off/on/off/on games in single transaction */ -if (ctx->table->flags & __NFT_TABLE_F_UPDATE) +if (nft_table_pending_update (ctx))return -EINVAL ; trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE,
@@ -2621,6 +2640,13 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy, } } +if (table->flags & __NFT_TABLE_F_UPDATE && + !list_empty (&hook.list)) { +NL_SET_BAD_ATTR (extack, attr); + err = -EOPNOTSUPP ; + goto err_hooks; + } +if (!(table->flags &NFT_TABLE_F_DORMANT ) &&nft_is_base_chain (chain) && !list_empty (&hook.list)) {
@@ -2850,6 +2876,9 @@ static int nft_delchain_hook(struct nft_ctx *ctx,struct nft_trans *trans;int err; +if (ctx->table->flags & __NFT_TABLE_F_UPDATE) +return -EOPNOTSUPP ; + err =nft_chain_parse_hook (ctx->net, basechain, nla, &chain_hook, ctx->family, chain->flags, extack);if (err <0 )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 37/252 netfilter: nf_tables: skip netdev hook unregistration if table is dormant
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 216e7bf7402caf73f4939a8e0248392e96d7c0da ]
Skip hook unregistration when adding or deleting devices from an existing netdev basechain. Otherwise, commit/abort path try to unregister hooks which not enabled.
--- net/netfilter/nf_tables_api.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
net/netfilter/nf_tables_api.c +10 -6
@@ -10083,9 +10083,11 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)if (nft_trans_chain_update (trans)) {nf_tables_chain_notify (&trans->ctx,NFT_MSG_DELCHAIN , &nft_trans_chain_hooks (trans)); -nft_netdev_unregister_hooks (net, - &nft_trans_chain_hooks (trans), - true); +if (!(trans->ctx.table->flags &NFT_TABLE_F_DORMANT )) { +nft_netdev_unregister_hooks (net, + &nft_trans_chain_hooks (trans), + true); + } }else {nft_chain_del (trans->ctx.chain); nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN,
@@ -10357,9 +10359,11 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)break ;case NFT_MSG_NEWCHAIN :if (nft_trans_chain_update (trans)) { -nft_netdev_unregister_hooks (net, - &nft_trans_chain_hooks (trans), - true); +if (!(trans->ctx.table->flags &NFT_TABLE_F_DORMANT )) { +nft_netdev_unregister_hooks (net, + &nft_trans_chain_hooks (trans), + true); + }free_percpu (nft_trans_chain_stats (trans));kfree (nft_trans_chain_name (trans));nft_trans_destroy (trans);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 38/252 net: bcmasp: Bring up unimac after PHY link up
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Chen <[email protected]>
[ Upstream commit dfd222e2aef68818320a57b13a1c52a44c22bc80 ]
The unimac requires the PHY RX clk during reset or it may be put into a bad state. Bring up the unimac after link up to ensure the PHY RX clk exists.
--- .../net/ethernet/broadcom/asp2/bcmasp_intf.c | 28 +++++++++++++------ 1 file changed, 19 insertions(+), 9 deletions(-)
drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c +19 -9
@@ -391,7 +391,9 @@ static void umac_reset(struct bcmasp_intf *intf)umac_wl (intf,0x0 ,UMC_CMD );umac_wl (intf,UMC_CMD_SW_RESET ,UMC_CMD );usleep_range (10 ,100 ); -umac_wl (intf,0x0 ,UMC_CMD ); +/* We hold the umac in reset and bring it out of +* reset when phy link is up. +*/ } static void umac_set_hw_addr(struct bcmasp_intf *intf,
@@ -411,6 +413,8 @@ static void umac_enable_set(struct bcmasp_intf *intf, u32 mask,u32 reg; reg =umac_rl (intf,UMC_CMD ); +if (reg &UMC_CMD_SW_RESET ) +return ;if (enable) reg |= mask;else
@@ -429,7 +433,6 @@ static void umac_init(struct bcmasp_intf *intf)umac_wl (intf,0x800 ,UMC_FRM_LEN );umac_wl (intf,0xffff ,UMC_PAUSE_CNTRL );umac_wl (intf,0x800 ,UMC_RX_MAX_PKT_SZ ); -umac_enable_set (intf,UMC_CMD_PROMISC ,1 ); }static int bcmasp_tx_poll (struct napi_struct *napi,int budget)
@@ -656,6 +659,12 @@ static void bcmasp_adj_link(struct net_device *dev)UMC_CMD_HD_EN |UMC_CMD_RX_PAUSE_IGNORE | UMC_CMD_TX_PAUSE_IGNORE); reg |= cmd_bits; +if (reg &UMC_CMD_SW_RESET ) { + reg &= ~UMC_CMD_SW_RESET ; +umac_wl (intf, reg,UMC_CMD ); +udelay (2 ); + reg |=UMC_CMD_TX_EN |UMC_CMD_RX_EN |UMC_CMD_PROMISC ; + }umac_wl (intf, reg,UMC_CMD ); intf->eee.eee_active =phy_init_eee (phydev,0 ) >=0 ;
@@ -1061,9 +1070,6 @@ static int bcmasp_netif_init(struct net_device *dev, bool phy_connect)umac_init (intf); -/* Disable the UniMAC RX/TX */ -umac_enable_set (intf, (UMC_CMD_RX_EN |UMC_CMD_TX_EN ),0 ); -umac_set_hw_addr (intf, dev->dev_addr); intf->old_duplex =-1 ;
@@ -1083,9 +1089,6 @@ static int bcmasp_netif_init(struct net_device *dev, bool phy_connect)bcmasp_enable_rx (intf,1 ); -/* Turn on UniMAC TX/RX */ -umac_enable_set (intf, (UMC_CMD_RX_EN |UMC_CMD_TX_EN ),1 ); - intf->crc_fwd = !!(umac_rl (intf,UMC_CMD ) &UMC_CMD_CRC_FWD );bcmasp_netif_start (dev);
@@ -1321,7 +1324,14 @@ static void bcmasp_suspend_to_wol(struct bcmasp_intf *intf)if (intf->wolopts &WAKE_FILTER )bcmasp_netfilt_suspend (intf); -/* UniMAC receive needs to be turned on */ +/* Bring UniMAC out of reset if needed and enable RX */ + reg =umac_rl (intf,UMC_CMD ); +if (reg &UMC_CMD_SW_RESET ) + reg &= ~UMC_CMD_SW_RESET ; + + reg |=UMC_CMD_RX_EN |UMC_CMD_PROMISC ; +umac_wl (intf, reg,UMC_CMD ); +umac_enable_set (intf,UMC_CMD_RX_EN ,1 );if (intf->parent->wol_irq >0 ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 39/252 net: lan743x: Add set RFE read fifo threshold for PCI1x1x chips
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raju Lakkaraju <[email protected]>
[ Upstream commit e4a58989f5c839316ac63675e8800b9eed7dbe96 ]
PCI11x1x Rev B0 devices might drop packets when receiving back to back frames at 2.5G link speed. Change the B0 Rev device's Receive filtering Engine FIFO threshold parameter from its hardware default of 4 to 3 dwords to prevent the problem. Rev C0 and later hardware already defaults to 3 dwords.
--- drivers/net/ethernet/microchip/lan743x_main.c | 18 ++++++++++++++++++ drivers/net/ethernet/microchip/lan743x_main.h | 4 ++++ 2 files changed, 22 insertions(+)
drivers/net/ethernet/microchip/lan743x_main.c +18 -0
@@ -25,6 +25,8 @@#define PCS_POWER_STATE_DOWN 0x6#define PCS_POWER_STATE_UP 0x4 +#define RFE_RD_FIFO_TH_3_DWORDS 0x3 +static void pci11x1x_strap_get_status (struct lan743x_adapter *adapter) {u32 chip_rev;
@@ -3223,6 +3225,21 @@ static void lan743x_full_cleanup(struct lan743x_adapter *adapter)lan743x_pci_cleanup (adapter); } +static void pci11x1x_set_rfe_rd_fifo_threshold (struct lan743x_adapter *adapter) +{ +u16 rev = adapter->csr.id_rev &ID_REV_CHIP_REV_MASK_ ; + +if (rev ==ID_REV_CHIP_REV_PCI11X1X_B0_ ) { +u32 misc_ctl; + + misc_ctl =lan743x_csr_read (adapter,MISC_CTL_0 ); + misc_ctl &= ~MISC_CTL_0_RFE_READ_FIFO_MASK_ ; + misc_ctl |=FIELD_PREP (MISC_CTL_0_RFE_READ_FIFO_MASK_ , +RFE_RD_FIFO_TH_3_DWORDS ); +lan743x_csr_write (adapter,MISC_CTL_0 , misc_ctl); + } +} +static int lan743x_hardware_init (struct lan743x_adapter *adapter,struct pci_dev *pdev) {
@@ -3238,6 +3255,7 @@ static int lan743x_hardware_init(struct lan743x_adapter *adapter,pci11x1x_strap_get_status (adapter);spin_lock_init (&adapter->eth_syslock_spinlock);mutex_init (&adapter->sgmii_rw_lock); +pci11x1x_set_rfe_rd_fifo_threshold (adapter); }else { adapter->max_tx_channels =LAN743X_MAX_TX_CHANNELS ; adapter->used_tx_channels =LAN743X_USED_TX_CHANNELS ;
drivers/net/ethernet/microchip/lan743x_main.h +4 -0
@@ -26,6 +26,7 @@#define ID_REV_CHIP_REV_MASK_ (0x0000FFFF)#define ID_REV_CHIP_REV_A0_ (0x00000000)#define ID_REV_CHIP_REV_B0_ (0x00000010) +#define ID_REV_CHIP_REV_PCI11X1X_B0_ (0x000000B0)#define FPGA_REV (0x04)#define FPGA_REV_GET_MINOR_ (fpga_rev) (((fpga_rev) >> 8) & 0x000000FF)
@@ -311,6 +312,9 @@#define SGMII_CTL_LINK_STATUS_SOURCE_ BIT(8)#define SGMII_CTL_SGMII_POWER_DN_ BIT(1) +#define MISC_CTL_0 (0x920) +#define MISC_CTL_0_RFE_READ_FIFO_MASK_ GENMASK(6, 4) +/* Vendor Specific SGMII MMD details */ #define SR_VSMMD_PCS_ID1 0x0004#define SR_VSMMD_PCS_ID2 0x0005
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 40/252 Octeontx2-af: fix pause frame configuration in GMP mode
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hariprasad Kelam <[email protected]>
[ Upstream commit 40d4b4807cadd83fb3f46cc8cd67a945b5b25461 ]
The Octeontx2 MAC block (CGX) has separate data paths (SMU and GMP) for different speeds, allowing for efficient data transfer.
The previous patch which added pause frame configuration has a bug due to which pause frame feature is not working in GMP mode.
This patch fixes the issue by configurating appropriate registers.
--- drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/marvell/octeontx2/af/cgx.c +5 -0
@@ -808,6 +808,11 @@ static int cgx_lmac_enadis_pause_frm(void *cgxd, int lmac_id,if (!is_lmac_valid (cgx, lmac_id))return -ENODEV ; + cfg =cgx_read (cgx, lmac_id,CGXX_GMP_GMI_RXX_FRM_CTL ); + cfg &= ~CGX_GMP_GMI_RXX_FRM_CTL_CTL_BCK ; + cfg |= rx_pause ?CGX_GMP_GMI_RXX_FRM_CTL_CTL_BCK :0x0 ; +cgx_write (cgx, lmac_id,CGXX_GMP_GMI_RXX_FRM_CTL , cfg); + cfg =cgx_read (cgx, lmac_id,CGXX_SMUX_RX_FRM_CTL ); cfg &= ~CGX_SMUX_RX_FRM_CTL_CTL_BCK ; cfg |= rx_pause ?CGX_SMUX_RX_FRM_CTL_CTL_BCK :0x0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 41/252 inet: inet_defrag: prevent sk release while still in use
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 18685451fc4e546fc0e718580d32df3c0e5c8272 ]
ip_local_out() and other functions can pass skb->sk as function argument.
If the skb is a fragment and reassembly happens before such function call returns, the sk must not be released.
This affects skb fragments reassembled via netfilter or similar modules, e.g. openvswitch or ct_act.c, when run as part of tx pipeline.
Eric Dumazet made an initial analysis of this bug. Quoting Eric:
Calling ip_defrag() in output path is also implying skb_orphan(), which is buggy because output path relies on sk not disappearing.
A relevant old patch about the issue was :
8282f27449bf ("inet: frag: Always orphan skbs inside ip_defrag()")
[..]
net/ipv4/ip_output.c depends on skb->sk being set, and probably to an inet socket, not an arbitrary one.
If we orphan the packet in ipvlan, then downstream things like FQ packet scheduler will not work properly.
We need to change ip_defrag() to only use skb_orphan() when really needed, ie whenever frag_list is going to be used.
Eric suggested to stash sk in fragment queue and made an initial patch. However there is a problem with this:
If skb is refragmented again right after, ip_do_fragment() will copy head->sk to the new fragments, and sets up destructor to sock_wfree. IOW, we have no choice but to fix up sk_wmem accouting to reflect the fully reassembled skb, else wmem will underflow.
This change moves the orphan down into the core, to last possible moment. As ip_defrag_offset is aliased with sk_buff->sk member, we must move the offset into the FRAG_CB, else skb->sk gets clobbered.
This allows to delay the orphaning long enough to learn if the skb has to be queued or if the skb is completing the reasm queue.
In the former case, things work as before, skb is orphaned. This is safe because skb gets queued/stolen and won't continue past reasm engine.
In the latter case, we will steal the skb->sk reference, reattach it to the head skb, and fix up wmem accouting when inet_frag inflates truesize.
--- include/linux/skbuff.h | 7 +-- net/ipv4/inet_fragment.c | 70 ++++++++++++++++++++----- net/ipv4/ip_fragment.c | 2 +- net/ipv6/netfilter/nf_conntrack_reasm.c | 2 +- 4 files changed, 60 insertions(+), 21 deletions(-)
include/linux/skbuff.h +1 -6
@@ -736,8 +736,6 @@ typedef unsigned char *sk_buff_data_t;* @list: queue head * @ll_node: anchor in an llist (eg socket defer_list) * @sk: Socket we are owned by -* @ip_defrag_offset: (aka @sk) alternate use of @sk, used in -* fragmentation management * @dev: Device we arrived on/are leaving by * @dev_scratch: (aka @dev) alternate use of @dev when @dev would be %NULL * @cb: Control buffer. Free for use by every layer. Put private vars here
@@ -860,10 +858,7 @@ struct sk_buff {struct llist_node ll_node; }; -union { -struct sock *sk; -int ip_defrag_offset; - }; +struct sock *sk;union {ktime_t tstamp;
net/ipv4/inet_fragment.c +57 -13
158 lines not on this page · raw message
net/ipv4/ip_fragment.c +1 -1
@@ -384,6 +384,7 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb) }skb_dst_drop (skb); +skb_orphan (skb);return -EINPROGRESS ; insert_error:
@@ -487,7 +488,6 @@ int ip_defrag(struct net *net, struct sk_buff *skb, u32 user)struct ipq *qp;__IP_INC_STATS (net,IPSTATS_MIB_REASMREQDS ); -skb_orphan (skb);/* Lookup (or create) queue header */ qp =ip_find (net,ip_hdr (skb), user, vif);
net/ipv6/netfilter/nf_conntrack_reasm.c +1 -1
@@ -294,6 +294,7 @@ static int nf_ct_frag6_queue(struct frag_queue *fq, struct sk_buff *skb, }skb_dst_drop (skb); +skb_orphan (skb);return -EINPROGRESS ; insert_error:
@@ -469,7 +470,6 @@ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user) hdr =ipv6_hdr (skb); fhdr = (struct frag_hdr *)skb_transport_header (skb); -skb_orphan (skb); fq =fq_find (net, fhdr->identification, user, hdr, skb->dev ? skb->dev->ifindex :0 );if (fq ==NULL ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 42/252 drm/i915/dg2: Drop pre-production GT workarounds
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Roper <[email protected]>
[ Upstream commit eaeb4b3614529bfa8a7edfdd7ecf6977b27f18b2 ]
DG2 first production steppings were C0 (for DG2-G10), B1 (for DG2-G11), and A1 (for DG2-G12). Several workarounds that apply onto to pre-production hardware can be dropped. Furthermore, several workarounds that apply to all production steppings can have their conditions simplified to no longer check the GT stepping.
v2:
- Keep Wa_16011777198 in place for now; it will be removed separately in a follow-up patch to keep review easier.
Bspec: 44477
Stable-dep-of: 186bce682772 ("drm/i915/mtl: Update workaround 14018575942")
--- drivers/gpu/drm/i915/gt/intel_lrc.c | 34 +--- drivers/gpu/drm/i915/gt/intel_mocs.c | 21 +- drivers/gpu/drm/i915/gt/intel_rc6.c | 6 +- drivers/gpu/drm/i915/gt/intel_workarounds.c | 211 +------------------- drivers/gpu/drm/i915/gt/uc/intel_guc.c | 20 +- drivers/gpu/drm/i915/intel_clock_gating.c | 8 - 6 files changed, 21 insertions(+), 279 deletions(-)
drivers/gpu/drm/i915/gt/intel_lrc.c +2 -32
@@ -1316,29 +1316,6 @@ gen12_emit_cmd_buf_wa(const struct intel_context *ce, u32 *cs)return cs; } -/* -* On DG2 during context restore of a preempted context in GPGPU mode, -* RCS restore hang is detected. This is extremely timing dependent. -* To address this below sw wabb is implemented for DG2 A steppings. -*/ -static u32 * -dg2_emit_rcs_hang_wabb (const struct intel_context *ce,u32 *cs) -{ - *cs++ =MI_LOAD_REGISTER_IMM (1 ); - *cs++ =i915_mmio_reg_offset (GEN12_STATE_ACK_DEBUG (ce->engine->mmio_base)); - *cs++ =0x21 ; - - *cs++ =MI_LOAD_REGISTER_REG ; - *cs++ =i915_mmio_reg_offset (RING_NOPID (ce->engine->mmio_base)); - *cs++ =i915_mmio_reg_offset (XEHP_CULLBIT1 ); - - *cs++ =MI_LOAD_REGISTER_REG ; - *cs++ =i915_mmio_reg_offset (RING_NOPID (ce->engine->mmio_base)); - *cs++ =i915_mmio_reg_offset (XEHP_CULLBIT2 ); - -return cs; -} -/* * The bspec's tuning guide asks us to program a vertical watermark value of * 0x3FF. However this register is not saved/restored properly by the
@@ -1363,14 +1340,8 @@ gen12_emit_indirect_ctx_rcs(const struct intel_context *ce, u32 *cs) cs =gen12_emit_cmd_buf_wa (ce, cs); cs =gen12_emit_restore_scratch (ce, cs); -/* Wa_22011450934:dg2 */ -if (IS_DG2_GRAPHICS_STEP (ce->engine->i915,G10 ,STEP_A0 ,STEP_B0 ) || -IS_DG2_GRAPHICS_STEP (ce->engine->i915,G11 ,STEP_A0 ,STEP_B0 )) - cs =dg2_emit_rcs_hang_wabb (ce, cs); -/* Wa_16013000631:dg2 */ -if (IS_DG2_GRAPHICS_STEP (ce->engine->i915,G10 ,STEP_B0 ,STEP_C0 ) || -IS_DG2_G11 (ce->engine->i915)) +if (IS_DG2_G11 (ce->engine->i915)) cs =gen8_emit_pipe_control (cs,PIPE_CONTROL_INSTRUCTION_CACHE_INVALIDATE ,0 ); cs =gen12_emit_aux_table_inv (ce->engine, cs);
@@ -1391,8 +1362,7 @@ gen12_emit_indirect_ctx_xcs(const struct intel_context *ce, u32 *cs) cs =gen12_emit_restore_scratch (ce, cs);/* Wa_16013000631:dg2 */ -if (IS_DG2_GRAPHICS_STEP (ce->engine->i915,G10 ,STEP_B0 ,STEP_C0 ) || -IS_DG2_G11 (ce->engine->i915)) +if (IS_DG2_G11 (ce->engine->i915))if (ce->engine->class ==COMPUTE_CLASS ) cs = gen8_emit_pipe_control(cs, PIPE_CONTROL_INSTRUCTION_CACHE_INVALIDATE,
drivers/gpu/drm/i915/gt/intel_mocs.c +2 -19
@@ -404,18 +404,6 @@ static const struct drm_i915_mocs_entry dg2_mocs_table[] = { MOCS_ENTRY(3, 0, L3_3_WB | L3_LKUP(1)), }; -static const struct drm_i915_mocs_entry dg2_mocs_table_g10_ax[] = { -/* Wa_14011441408: Set Go to Memory for MOCS#0 */ -MOCS_ENTRY (0 ,0 ,L3_1_UC |L3_GLBGO (1 ) |L3_LKUP (1 )), -/* UC - Coherent; GO:Memory */ -MOCS_ENTRY (1 ,0 ,L3_1_UC |L3_GLBGO (1 ) |L3_LKUP (1 )), -/* UC - Non-Coherent; GO:Memory */ -MOCS_ENTRY (2 ,0 ,L3_1_UC |L3_GLBGO (1 )), - -/* WB - LC */ -MOCS_ENTRY (3 ,0 ,L3_3_WB |L3_LKUP (1 )), -}; -static const struct drm_i915_mocs_entry pvc_mocs_table[] = {/* Error */ MOCS_ENTRY (0 ,0 ,L3_3_WB ),
@@ -521,13 +509,8 @@ static unsigned int get_mocs_settings(const struct drm_i915_private *i915, table->wb_index =2 ; table->unused_entries_index =2 ; }else if (IS_DG2 (i915)) { -if (IS_DG2_GRAPHICS_STEP (i915,G10 ,STEP_A0 ,STEP_B0 )) { - table->size =ARRAY_SIZE (dg2_mocs_table_g10_ax); - table->table = dg2_mocs_table_g10_ax; - }else { - table->size =ARRAY_SIZE (dg2_mocs_table); - table->table = dg2_mocs_table; - } + table->size =ARRAY_SIZE (dg2_mocs_table); + table->table = dg2_mocs_table; table->uc_index =1 ; table->n_entries =GEN9_NUM_MOCS_ENTRIES ; table->unused_entries_index =3 ;
drivers/gpu/drm/i915/gt/intel_rc6.c +2 -4
@@ -118,14 +118,12 @@ static void gen11_rc6_enable(struct intel_rc6 *rc6)GEN6_RC_CTL_EI_MODE (1 );/* -* Wa_16011777198 and BSpec 52698 - Render powergating must be off. +* BSpec 52698 - Render powergating must be off. * FIXME BSpec is outdated, disabling powergating for MTL is just * temporary wa and should be removed after fixing real cause * of forcewake timeouts. */ -if (IS_METEORLAKE (gt->i915) || -IS_DG2_GRAPHICS_STEP (gt->i915,G10 ,STEP_A0 ,STEP_C0 ) || -IS_DG2_GRAPHICS_STEP (gt->i915,G11 ,STEP_A0 ,STEP_B0 )) +if (IS_METEORLAKE (gt->i915)) pg_enable =GEN9_MEDIA_PG_ENABLE |GEN11_MEDIA_SAMPLER_PG_ENABLE ;
drivers/gpu/drm/i915/gt/intel_workarounds.c +10 -201
303 lines not on this page · raw message
drivers/gpu/drm/i915/gt/uc/intel_guc.c +5 -15
@@ -272,18 +272,14 @@ static u32 guc_ctl_wa_flags(struct intel_guc *guc) GRAPHICS_VER_FULL(gt->i915) < IP_VER(12, 50)) flags |=GUC_WA_POLLCS ; -/* Wa_16011759253:dg2_g10:a0 */ -if (IS_DG2_GRAPHICS_STEP (gt->i915,G10 ,STEP_A0 ,STEP_B0 )) - flags |=GUC_WA_GAM_CREDITS ; -/* Wa_14014475959 */ if (IS_MTL_GRAPHICS_STEP (gt->i915,M ,STEP_A0 ,STEP_B0 ) ||IS_DG2 (gt->i915)) flags |=GUC_WA_HOLD_CCS_SWITCHOUT ;/* -* Wa_14012197797:dg2_g10:a0,dg2_g11:a0 -* Wa_22011391025:dg2_g10,dg2_g11,dg2_g12 +* Wa_14012197797 +* Wa_22011391025 * * The same WA bit is used for both and 22011391025 is applicable to * all DG2.
@@ -297,17 +293,11 @@ static u32 guc_ctl_wa_flags(struct intel_guc *guc) GRAPHICS_VER_FULL(gt->i915) < IP_VER(12, 70))) flags |=GUC_WA_PRE_PARSER ; -/* Wa_16011777198:dg2 */ -if (IS_DG2_GRAPHICS_STEP (gt->i915,G10 ,STEP_A0 ,STEP_C0 ) || -IS_DG2_GRAPHICS_STEP (gt->i915,G11 ,STEP_A0 ,STEP_B0 )) - flags |=GUC_WA_RCS_RESET_BEFORE_RC6 ; -/* -* Wa_22012727170:dg2_g10[a0-c0), dg2_g11[a0..) -* Wa_22012727685:dg2_g11[a0..) +* Wa_22012727170 +* Wa_22012727685 */ -if (IS_DG2_GRAPHICS_STEP (gt->i915,G10 ,STEP_A0 ,STEP_C0 ) || -IS_DG2_GRAPHICS_STEP (gt->i915,G11 ,STEP_A0 ,STEP_FOREVER )) +if (IS_DG2_G11 (gt->i915)) flags |=GUC_WA_CONTEXT_ISOLATION ;/* Wa_16015675438 */
drivers/gpu/drm/i915/intel_clock_gating.c +0 -8
@@ -396,14 +396,6 @@ static void dg2_init_clock_gating(struct drm_i915_private *i915)/* Wa_22010954014:dg2 */ intel_uncore_rmw (&i915->uncore,XEHP_CLOCK_GATE_DIS ,0 ,SGSI_SIDECLK_DIS ); - -/* -* Wa_14010733611:dg2_g10 -* Wa_22010146351:dg2_g10 -*/ -if (IS_DG2_GRAPHICS_STEP (i915,G10 ,STEP_A0 ,STEP_B0 )) -intel_uncore_rmw (&i915->uncore,XEHP_CLOCK_GATE_DIS ,0 , -SGR_DIS |SGGI_DIS ); }static void pvc_init_clock_gating (struct drm_i915_private *i915)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 43/252 drm/i915: Tidy workaround definitions
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Roper <[email protected]>
[ Upstream commit f1c805716516f9e648e13f0108cea8096e0c7023 ]
Removal of the DG2 pre-production workarounds has left duplicate condition blocks in a couple places, as well as some inconsistent platform ordering. Reshuffle and consolidate some of the workarounds to reduce the number of condition blocks and to more consistently follow the "newest platform first" convention. Code movement only; no functional change.
Stable-dep-of: 186bce682772 ("drm/i915/mtl: Update workaround 14018575942")
--- drivers/gpu/drm/i915/gt/intel_workarounds.c | 100 +++++++++----------- 1 file changed, 46 insertions(+), 54 deletions(-)
drivers/gpu/drm/i915/gt/intel_workarounds.c +46 -54
@@ -2337,6 +2337,19 @@ rcs_engine_wa_init(struct intel_engine_cs *engine, struct i915_wa_list *wal) true); } +if (IS_DG2 (i915) ||IS_ALDERLAKE_P (i915) ||IS_ALDERLAKE_S (i915) || +IS_DG1 (i915) ||IS_ROCKETLAKE (i915) ||IS_TIGERLAKE (i915)) { +/* +* Wa_1606700617:tgl,dg1,adl-p +* Wa_22010271021:tgl,rkl,dg1,adl-s,adl-p +* Wa_14010826681:tgl,dg1,rkl,adl-p +* Wa_18019627453:dg2 +*/ +wa_masked_en (wal, +GEN9_CS_DEBUG_MODE1 , +FF_DOP_CLOCK_GATE_DISABLE ); + } +if (IS_ALDERLAKE_P (i915) ||IS_ALDERLAKE_S (i915) ||IS_DG1 (i915) ||IS_ROCKETLAKE (i915) ||IS_TIGERLAKE (i915)) {/* Wa_1606931601:tgl,rkl,dg1,adl-s,adl-p */
@@ -2350,19 +2363,11 @@ rcs_engine_wa_init(struct intel_engine_cs *engine, struct i915_wa_list *wal)*/ wa_write_or (wal,GEN7_FF_THREAD_MODE ,GEN12_FF_TESSELATION_DOP_GATE_DISABLE ); - } -if (IS_ALDERLAKE_P (i915) ||IS_DG2 (i915) ||IS_ALDERLAKE_S (i915) || -IS_DG1 (i915) ||IS_ROCKETLAKE (i915) ||IS_TIGERLAKE (i915)) { -/* -* Wa_1606700617:tgl,dg1,adl-p -* Wa_22010271021:tgl,rkl,dg1,adl-s,adl-p -* Wa_14010826681:tgl,dg1,rkl,adl-p -* Wa_18019627453:dg2 -*/ -wa_masked_en (wal, -GEN9_CS_DEBUG_MODE1 , -FF_DOP_CLOCK_GATE_DISABLE ); +/* Wa_1406941453:tgl,rkl,dg1,adl-s,adl-p */ +wa_mcr_masked_en (wal, +GEN10_SAMPLER_MODE , +ENABLE_SMALLPL ); } if (IS_ALDERLAKE_P(i915) || IS_ALDERLAKE_S(i915) ||
@@ -2389,14 +2394,6 @@ rcs_engine_wa_init(struct intel_engine_cs *engine, struct i915_wa_list *wal) GEN8_RC_SEMA_IDLE_MSG_DISABLE); } -if (IS_DG1 (i915) ||IS_ROCKETLAKE (i915) ||IS_TIGERLAKE (i915) || -IS_ALDERLAKE_S (i915) ||IS_ALDERLAKE_P (i915)) { -/* Wa_1406941453:tgl,rkl,dg1,adl-s,adl-p */ -wa_mcr_masked_en (wal, -GEN10_SAMPLER_MODE , -ENABLE_SMALLPL ); - } -if (GRAPHICS_VER (i915) ==11 ) {/* This is not an Wa. Enable for better image quality */ wa_masked_en(wal,
@@ -2877,6 +2874,9 @@ general_render_compute_wa_init(struct intel_engine_cs *engine, struct i915_wa_li/* Wa_22013037850 */ wa_mcr_write_or (wal,LSC_CHICKEN_BIT_0_UDW ,DISABLE_128B_EVICTION_COMMAND_UDW ); + +/* Wa_18017747507 */ +wa_masked_en (wal,VFG_PREEMPTION_CHICKEN ,POLYGON_TRIFAN_LINELOOP_DISABLE ); } if (IS_MTL_GRAPHICS_STEP(i915, M, STEP_A0, STEP_B0) ||
@@ -2887,11 +2887,20 @@ general_render_compute_wa_init(struct intel_engine_cs *engine, struct i915_wa_liwa_mcr_write_or (wal,LSC_CHICKEN_BIT_0 ,DISABLE_D8_D16_COASLESCE ); } -if (IS_MTL_GRAPHICS_STEP (i915,M ,STEP_A0 ,STEP_B0 ) || -IS_MTL_GRAPHICS_STEP (i915,P ,STEP_A0 ,STEP_B0 ) || -IS_DG2 (i915)) { -/* Wa_18017747507 */ -wa_masked_en (wal,VFG_PREEMPTION_CHICKEN ,POLYGON_TRIFAN_LINELOOP_DISABLE ); +if (IS_PONTEVECCHIO (i915) ||IS_DG2 (i915)) { +/* Wa_14015227452:dg2,pvc */ +wa_mcr_masked_en (wal,GEN9_ROW_CHICKEN4 ,XEHP_DIS_BBL_SYSPIPE ); + +/* Wa_16015675438:dg2,pvc */ +wa_masked_en (wal,FF_SLICE_CS_CHICKEN2 ,GEN12_PERF_FIX_BALANCING_CFE_DISABLE ); + } + +if (IS_DG2 (i915)) { +/* +* Wa_16011620976:dg2_g11 +* Wa_22015475538:dg2 +*/ +wa_mcr_write_or (wal,LSC_CHICKEN_BIT_0_UDW ,DIS_CHAIN_2XSIMD8 ); }if (IS_DG2_G11 (i915)) {
@@ -2906,6 +2915,18 @@ general_render_compute_wa_init(struct intel_engine_cs *engine, struct i915_wa_li/* Wa_22013059131:dg2 */ wa_mcr_write_or (wal,LSC_CHICKEN_BIT_0 ,FORCE_1_SUB_MESSAGE_PER_FRAGMENT ); + +/* +* Wa_22012654132 +* +* Note that register 0xE420 is write-only and cannot be read +* back for verification on DG2 (due to Wa_14012342262), so +* we need to explicitly skip the readback. +*/ +wa_mcr_add (wal,GEN10_CACHE_MODE_SS ,0 , +_MASKED_BIT_ENABLE (ENABLE_PREFETCH_INTO_IC ), +0 /* write-only, so skip validation */ , + true); }if (IS_XEHPSDV (i915)) {
@@ -2923,35 +2944,6 @@ general_render_compute_wa_init(struct intel_engine_cs *engine, struct i915_wa_liwa_mcr_masked_en (wal,GEN8_HALF_SLICE_CHICKEN1 ,GEN7_PSD_SINGLE_PORT_DISPATCH_ENABLE ); } - -if (IS_DG2 (i915) ||IS_PONTEVECCHIO (i915)) { -/* Wa_14015227452:dg2,pvc */ -wa_mcr_masked_en (wal,GEN9_ROW_CHICKEN4 ,XEHP_DIS_BBL_SYSPIPE ); - -/* Wa_16015675438:dg2,pvc */ -wa_masked_en (wal,FF_SLICE_CS_CHICKEN2 ,GEN12_PERF_FIX_BALANCING_CFE_DISABLE ); - } - -if (IS_DG2 (i915)) { -/* -* Wa_16011620976:dg2_g11 -* Wa_22015475538:dg2 -*/ -wa_mcr_write_or (wal,LSC_CHICKEN_BIT_0_UDW ,DIS_CHAIN_2XSIMD8 ); - } - -if (IS_DG2_G11 (i915)) -/* -* Wa_22012654132 -* -* Note that register 0xE420 is write-only and cannot be read -* back for verification on DG2 (due to Wa_14012342262), so -* we need to explicitly skip the readback. -*/ -wa_mcr_add (wal,GEN10_CACHE_MODE_SS ,0 , -_MASKED_BIT_ENABLE (ENABLE_PREFETCH_INTO_IC ), -0 /* write-only, so skip validation */ , - true); } static void
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 44/252 drm/i915: Consolidate condition for Wa_22011802037
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Roper <[email protected]>
[ Upstream commit 28c46feec7f8760683ef08f12746630a3598173e ]
The workaround bounds for Wa_22011802037 are somewhat complex and are replicated in several places throughout the code. Pull the condition out to a helper function to prevent mistakes if this condition needs to change again in the future.
Stable-dep-of: 186bce682772 ("drm/i915/mtl: Update workaround 14018575942")
--- drivers/gpu/drm/i915/gt/intel_engine_cs.c | 4 +--- .../drm/i915/gt/intel_execlists_submission.c | 4 +--- drivers/gpu/drm/i915/gt/intel_reset.c | 18 ++++++++++++++++++ drivers/gpu/drm/i915/gt/intel_reset.h | 2 ++ drivers/gpu/drm/i915/gt/uc/intel_guc.c | 4 +--- .../gpu/drm/i915/gt/uc/intel_guc_submission.c | 4 +--- 6 files changed, 24 insertions(+), 12 deletions(-)
drivers/gpu/drm/i915/gt/intel_engine_cs.c +1 -3
@@ -1616,9 +1616,7 @@ static int __intel_engine_stop_cs(struct intel_engine_cs *engine,* Wa_22011802037: Prior to doing a reset, ensure CS is * stopped, set ring stop bit and prefetch disable bit to halt CS */ -if (IS_MTL_GRAPHICS_STEP (engine->i915,M ,STEP_A0 ,STEP_B0 ) || - (GRAPHICS_VER (engine->i915) >=11 && -GRAPHICS_VER_FULL (engine->i915) <IP_VER (12 ,70 ))) +if (intel_engine_reset_needs_wa_22011802037 (engine->gt))intel_uncore_write_fw (uncore,RING_MODE_GEN7 (engine->mmio_base),_MASKED_BIT_ENABLE (GEN12_GFX_PREFETCH_DISABLE ));
drivers/gpu/drm/i915/gt/intel_execlists_submission.c +1 -3
@@ -3001,9 +3001,7 @@ static void execlists_reset_prepare(struct intel_engine_cs *engine)* Wa_22011802037: In addition to stopping the cs, we need * to wait for any pending mi force wakeups */ -if (IS_MTL_GRAPHICS_STEP (engine->i915,M ,STEP_A0 ,STEP_B0 ) || - (GRAPHICS_VER (engine->i915) >=11 && -GRAPHICS_VER_FULL (engine->i915) <IP_VER (12 ,70 ))) +if (intel_engine_reset_needs_wa_22011802037 (engine->gt))intel_engine_wait_for_pending_mi_fw (engine); engine->execlists.reset_ccid =active_ccid (engine);
drivers/gpu/drm/i915/gt/intel_reset.c +18 -0
@@ -1632,6 +1632,24 @@ void __intel_fini_wedge(struct intel_wedge_me *w) w->gt =NULL ; } +/* +* Wa_22011802037 requires that we (or the GuC) ensure that no command +* streamers are executing MI_FORCE_WAKE while an engine reset is initiated. +*/ +bool intel_engine_reset_needs_wa_22011802037 (struct intel_gt *gt) +{ +if (GRAPHICS_VER (gt->i915) <11 ) +return false; + +if (IS_MTL_GRAPHICS_STEP (gt->i915,M ,STEP_A0 ,STEP_B0 )) +return true; + +if (GRAPHICS_VER_FULL (gt->i915) >=IP_VER (12 ,70 )) +return false; + +return true; +} +#if IS_ENABLED (CONFIG_DRM_I915_SELFTEST )#include "selftest_reset.c" #include "selftest_hangcheck.c"
drivers/gpu/drm/i915/gt/intel_reset.h +2 -0
@@ -78,4 +78,6 @@ void __intel_fini_wedge(struct intel_wedge_me *w);bool intel_has_gpu_reset (const struct intel_gt *gt);bool intel_has_reset_engine (const struct intel_gt *gt); +bool intel_engine_reset_needs_wa_22011802037 (struct intel_gt *gt); +#endif /* I915_RESET_H */
drivers/gpu/drm/i915/gt/uc/intel_guc.c +1 -3
@@ -288,9 +288,7 @@ static u32 guc_ctl_wa_flags(struct intel_guc *guc) flags |=GUC_WA_DUAL_QUEUE ;/* Wa_22011802037: graphics version 11/12 */ -if (IS_MTL_GRAPHICS_STEP (gt->i915,M ,STEP_A0 ,STEP_B0 ) || - (GRAPHICS_VER (gt->i915) >=11 && -GRAPHICS_VER_FULL (gt->i915) <IP_VER (12 ,70 ))) +if (intel_engine_reset_needs_wa_22011802037 (gt)) flags |=GUC_WA_PRE_PARSER ;/*
drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c +1 -3
@@ -1690,9 +1690,7 @@ static void guc_engine_reset_prepare(struct intel_engine_cs *engine)* Wa_22011802037: In addition to stopping the cs, we need * to wait for any pending mi force wakeups */ -if (IS_MTL_GRAPHICS_STEP (engine->i915,M ,STEP_A0 ,STEP_B0 ) || - (GRAPHICS_VER (engine->i915) >=11 && -GRAPHICS_VER_FULL (engine->i915) <IP_VER (12 ,70 ))) { +if (intel_engine_reset_needs_wa_22011802037 (engine->gt)) {intel_engine_stop_cs (engine);intel_engine_wait_for_pending_mi_fw (engine); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 45/252 drm/i915/xelpg: Call Xe_LPG workaround functions based on IP version
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Roper <[email protected]>
[ Upstream commit f7696ded7c9e358670dae1801660f442f059c7db ]
Although some of our Xe_LPG workarounds were already being applied based on IP version correctly, others were matching on MTL as a base platform, which is incorrect. Although MTL is the only platform right now that uses Xe_LPG IP, this may not always be the case. If a future platform re-uses this graphics IP, the same workarounds should be applied, even if it isn't a "MTL" platform.
We were also incorrectly applying Xe_LPG workarounds/tuning to the Xe_LPM+ media IP in one or two places; we should make sure that we don't try to apply graphics workarounds to the media GT and vice versa where they don't belong. A new helper macro IS_GT_IP_RANGE() is added to help ensure this is handled properly -- it checks that the GT matches the IP type being tested as well as the IP version falling in the proper range.
Note that many of the stepping-based workarounds are still incorrectly checking for a MTL base platform; that will be remedied in a later patch.
v2:
- Rework macro into a slightly more generic IS_GT_IP_RANGE() that can be used for either GFX or MEDIA checks.
v3:
- Switch back to separate macros for gfx and media. (Jani)
- Move macro to intel_gt.h. (Andi)
Stable-dep-of: 186bce682772 ("drm/i915/mtl: Update workaround 14018575942")
--- drivers/gpu/drm/i915/gt/intel_gt.h | 11 ++++++ drivers/gpu/drm/i915/gt/intel_workarounds.c | 38 +++++++++++---------- 2 files changed, 31 insertions(+), 18 deletions(-)
drivers/gpu/drm/i915/gt/intel_gt.h +11 -0
@@ -14,6 +14,17 @@struct drm_i915_private ;struct drm_printer ; +/* +* Check that the GT is a graphics GT and has an IP version within the +* specified range (inclusive). +*/ +#define IS_GFX_GT_IP_RANGE (gt, from, until) ( \ + BUILD_BUG_ON_ZERO((from) < IP_VER(2, 0)) + \ + BUILD_BUG_ON_ZERO((until) < (from)) + \ + ((gt)->type != GT_MEDIA && \ + GRAPHICS_VER_FULL((gt)->i915) >= (from) && \ + GRAPHICS_VER_FULL((gt)->i915) <= (until))) +#define GT_TRACE (gt, fmt, ...) do { \ const struct intel_gt *gt__ __maybe_unused = (gt); \ GEM_TRACE("%s " fmt, dev_name(gt__->i915->drm.dev), \
drivers/gpu/drm/i915/gt/intel_workarounds.c +20 -18
@@ -781,8 +781,8 @@ static void dg2_ctx_workarounds_init(struct intel_engine_cs *engine,wa_masked_en (wal,CACHE_MODE_1 ,MSAA_OPTIMIZATION_REDUC_DISABLE ); } -static void mtl_ctx_gt_tuning_init (struct intel_engine_cs *engine, -struct i915_wa_list *wal) +static void xelpg_ctx_gt_tuning_init (struct intel_engine_cs *engine, +struct i915_wa_list *wal) {struct drm_i915_private *i915 = engine->i915;
@@ -793,12 +793,12 @@ static void mtl_ctx_gt_tuning_init(struct intel_engine_cs *engine,wa_add (wal,DRAW_WATERMARK ,VERT_WM_VAL ,0x3FF ,0 , false); } -static void mtl_ctx_workarounds_init (struct intel_engine_cs *engine, -struct i915_wa_list *wal) +static void xelpg_ctx_workarounds_init (struct intel_engine_cs *engine, +struct i915_wa_list *wal) {struct drm_i915_private *i915 = engine->i915; -mtl_ctx_gt_tuning_init (engine, wal); +xelpg_ctx_gt_tuning_init (engine, wal);if (IS_MTL_GRAPHICS_STEP (i915,M ,STEP_A0 ,STEP_B0 ) ||IS_MTL_GRAPHICS_STEP (i915,P ,STEP_A0 ,STEP_B0 )) {
@@ -907,8 +907,8 @@ __intel_engine_init_ctx_wa(struct intel_engine_cs *engine,if (engine->class !=RENDER_CLASS ) goto done; -if (IS_METEORLAKE (i915)) -mtl_ctx_workarounds_init (engine, wal); +if (IS_GFX_GT_IP_RANGE (engine->gt,IP_VER (12 ,70 ),IP_VER (12 ,71 ))) +xelpg_ctx_workarounds_init (engine, wal);else if (IS_PONTEVECCHIO (i915)) ;/* noop; none at this time */ else if (IS_DG2 (i915))
@@ -1688,10 +1688,8 @@ xelpmp_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal)*/ static void gt_tuning_settings (struct intel_gt *gt,struct i915_wa_list *wal) { -if (IS_METEORLAKE (gt->i915)) { -if (gt->type !=GT_MEDIA ) -wa_mcr_write_or (wal,XEHP_L3SCQREG7 ,BLEND_FILL_CACHING_OPT_DIS ); - +if (IS_GFX_GT_IP_RANGE (gt,IP_VER (12 ,70 ),IP_VER (12 ,71 ))) { +wa_mcr_write_or (wal,XEHP_L3SCQREG7 ,BLEND_FILL_CACHING_OPT_DIS );wa_mcr_write_or (wal,XEHP_SQCM ,EN_32B_ACCESS ); }
@@ -1723,7 +1721,7 @@ gt_init_workarounds(struct intel_gt *gt, struct i915_wa_list *wal)return ; } -if (GRAPHICS_VER_FULL (i915) >=IP_VER (12 ,70 )) +if (IS_GFX_GT_IP_RANGE (gt,IP_VER (12 ,70 ),IP_VER (12 ,71 )))xelpg_gt_workarounds_init (gt, wal);else if (IS_PONTEVECCHIO (i915))pvc_gt_workarounds_init (gt, wal);
@@ -2172,7 +2170,7 @@ static void pvc_whitelist_build(struct intel_engine_cs *engine)blacklist_trtt (engine); } -static void mtl_whitelist_build (struct intel_engine_cs *engine) +static void xelpg_whitelist_build (struct intel_engine_cs *engine) {struct i915_wa_list *w = &engine->whitelist;
@@ -2194,8 +2192,10 @@ void intel_engine_init_whitelist(struct intel_engine_cs *engine)wa_init_start (w, engine->gt,"whitelist" , engine->name); -if (IS_METEORLAKE (i915)) -mtl_whitelist_build (engine); +if (engine->gt->type ==GT_MEDIA ) + ;/* none yet */ +else if (IS_GFX_GT_IP_RANGE (engine->gt,IP_VER (12 ,70 ),IP_VER (12 ,71 ))) +xelpg_whitelist_build (engine);else if (IS_PONTEVECCHIO (i915))pvc_whitelist_build (engine);else if (IS_DG2 (i915))
@@ -2795,10 +2795,12 @@ ccs_engine_wa_init(struct intel_engine_cs *engine, struct i915_wa_list *wal)* function invoked by __intel_engine_init_ctx_wa(). */ static void -add_render_compute_tuning_settings (struct drm_i915_private *i915, +add_render_compute_tuning_settings (struct intel_gt *gt,struct i915_wa_list *wal) { -if (IS_METEORLAKE (i915) ||IS_DG2 (i915)) +struct drm_i915_private *i915 = gt->i915; + +if (IS_GFX_GT_IP_RANGE (gt,IP_VER (12 ,70 ),IP_VER (12 ,71 )) ||IS_DG2 (i915))wa_mcr_write_clr_set (wal,RT_CTRL ,STACKID_CTRL ,STACKID_CTRL_512 );/*
@@ -2828,7 +2830,7 @@ general_render_compute_wa_init(struct intel_engine_cs *engine, struct i915_wa_li {struct drm_i915_private *i915 = engine->i915; -add_render_compute_tuning_settings (i915, wal); +add_render_compute_tuning_settings (engine->gt, wal);if (GRAPHICS_VER (i915) >=11 ) {/* This is not a Wa (although referred to as
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 46/252 drm/i915: Eliminate IS_MTL_GRAPHICS_STEP
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Roper <[email protected]>
[ Upstream commit 5a213086a025349361b5cf75c8fd4591d96a7a99 ]
Several workarounds are guarded by IS_MTL_GRAPHICS_STEP. However none of these workarounds are actually tied to MTL as a platform; they only relate to the Xe_LPG graphics IP, regardless of what platform it appears in. At the moment MTL is the only platform that uses Xe_LPG with IP versions 12.70 and 12.71, but we can't count on this being true in the future. Switch these to use a new IS_GFX_GT_IP_STEP() macro instead that is purely based on IP version. IS_GFX_GT_IP_STEP() is also GT-based rather than device-based, which will help prevent mistakes where we accidentally try to apply Xe_LPG graphics workarounds to the Xe_LPM+ media GT and vice-versa.
v2:
- Switch to a more generic and shorter IS_GT_IP_STEP macro that can be used for both graphics and media IP (and any other kind of GTs that show up in the future).
v3:
- Switch back to long-form IS_GFX_GT_IP_STEP macro. (Jani)
- Move macro to intel_gt.h. (Andi)
v4:
- Build IS_GFX_GT_IP_STEP on top of IS_GFX_GT_IP_RANGE and IS_GRAPHICS_STEP building blocks and name the parameters from/until rather than begin/fixed. (Jani)
- Fix usage examples in comment.
v5:
- Tweak comment on macro. (Gustavo)
Stable-dep-of: 186bce682772 ("drm/i915/mtl: Update workaround 14018575942")
--- .../drm/i915/display/skl_universal_plane.c | 5 +- drivers/gpu/drm/i915/gt/gen8_engine_cs.c | 11 +++-- drivers/gpu/drm/i915/gt/intel_gt.h | 20 ++++++++ drivers/gpu/drm/i915/gt/intel_gt_mcr.c | 7 ++- drivers/gpu/drm/i915/gt/intel_lrc.c | 4 +- drivers/gpu/drm/i915/gt/intel_reset.c | 2 +- drivers/gpu/drm/i915/gt/intel_workarounds.c | 48 ++++++++++--------- drivers/gpu/drm/i915/gt/uc/intel_guc.c | 2 +- .../gpu/drm/i915/gt/uc/intel_guc_submission.c | 2 +- drivers/gpu/drm/i915/i915_drv.h | 4 -- 10 files changed, 62 insertions(+), 43 deletions(-)
drivers/gpu/drm/i915/display/skl_universal_plane.c +3 -2
@@ -20,6 +20,7 @@#include "skl_scaler.h" #include "skl_universal_plane.h" #include "skl_watermark.h" +#include "gt/intel_gt.h" #include "pxp/intel_pxp.h" static const u32 skl_plane_formats[] = {
@@ -2169,8 +2170,8 @@ static bool skl_plane_has_rc_ccs(struct drm_i915_private *i915, enum pipe pipe, enum plane_id plane_id) { /* Wa_14017240301 */ - if (IS_MTL_GRAPHICS_STEP(i915, M, STEP_A0, STEP_B0) || - IS_MTL_GRAPHICS_STEP(i915, P, STEP_A0, STEP_B0)) + if (IS_GFX_GT_IP_STEP(to_gt(i915), IP_VER(12, 70), STEP_A0, STEP_B0) || + IS_GFX_GT_IP_STEP(to_gt(i915), IP_VER(12, 71), STEP_A0, STEP_B0)) return false; /* Wa_22011186057 */
drivers/gpu/drm/i915/gt/gen8_engine_cs.c +6 -5
@@ -4,9 +4,9 @@*/ #include "gen8_engine_cs.h" -#include "i915_drv.h" #include "intel_engine_regs.h" #include "intel_gpu_commands.h" +#include "intel_gt.h" #include "intel_lrc.h" #include "intel_ring.h"
@@ -226,8 +226,8 @@ u32 *gen12_emit_aux_table_inv(struct intel_engine_cs *engine, u32 *cs)static int mtl_dummy_pipe_control (struct i915_request *rq) {/* Wa_14016712196 */ -if (IS_MTL_GRAPHICS_STEP (rq->i915,M ,STEP_A0 ,STEP_B0 ) || -IS_MTL_GRAPHICS_STEP (rq->i915,P ,STEP_A0 ,STEP_B0 )) { +if (IS_GFX_GT_IP_STEP (rq->engine->gt,IP_VER (12 ,70 ),STEP_A0 ,STEP_B0 ) || +IS_GFX_GT_IP_STEP (rq->engine->gt,IP_VER (12 ,71 ),STEP_A0 ,STEP_B0 )) {u32 *cs;/* dummy PIPE_CONTROL + depth flush */
@@ -808,6 +808,7 @@ u32 *gen12_emit_fini_breadcrumb_xcs(struct i915_request *rq, u32 *cs)u32 *gen12_emit_fini_breadcrumb_rcs (struct i915_request *rq,u32 *cs) {struct drm_i915_private *i915 = rq->i915; +struct intel_gt *gt = rq->engine->gt; u32 flags = (PIPE_CONTROL_CS_STALL | PIPE_CONTROL_TLB_INVALIDATE | PIPE_CONTROL_TILE_CACHE_FLUSH |
@@ -818,8 +819,8 @@ u32 *gen12_emit_fini_breadcrumb_rcs(struct i915_request *rq, u32 *cs) PIPE_CONTROL_FLUSH_ENABLE);/* Wa_14016712196 */ -if (IS_MTL_GRAPHICS_STEP (i915,M ,STEP_A0 ,STEP_B0 ) || -IS_MTL_GRAPHICS_STEP (i915,P ,STEP_A0 ,STEP_B0 )) +if (IS_GFX_GT_IP_STEP (gt,IP_VER (12 ,70 ),STEP_A0 ,STEP_B0 ) || +IS_GFX_GT_IP_STEP (gt,IP_VER (12 ,71 ),STEP_A0 ,STEP_B0 ))/* dummy PIPE_CONTROL + depth flush */ cs =gen12_emit_pipe_control (cs,0 ,PIPE_CONTROL_DEPTH_CACHE_FLUSH ,0 );
drivers/gpu/drm/i915/gt/intel_gt.h +20 -0
@@ -25,6 +25,26 @@ struct drm_printer; GRAPHICS_VER_FULL((gt)->i915) >= (from) && \ GRAPHICS_VER_FULL((gt)->i915) <= (until))) +/* +* Check that the GT is a graphics GT with a specific IP version and has +* a stepping in the range [from, until). The lower stepping bound is +* inclusive, the upper bound is exclusive. The most common use-case of this +* macro is for checking bounds for workarounds, which usually have a stepping +* ("from") at which the hardware issue is first present and another stepping +* ("until") at which a hardware fix is present and the software workaround is +* no longer necessary. E.g., +* +* IS_GFX_GT_IP_STEP(gt, IP_VER(12, 70), STEP_A0, STEP_B0) +* IS_GFX_GT_IP_STEP(gt, IP_VER(12, 71), STEP_B1, STEP_FOREVER) +* +* "STEP_FOREVER" can be passed as "until" for workarounds that have no upper +* stepping bound for the specified IP version. +*/ +#define IS_GFX_GT_IP_STEP (gt, ipver, from, until) ( \ + BUILD_BUG_ON_ZERO((until) <= (from)) + \ + (IS_GFX_GT_IP_RANGE((gt), (ipver), (ipver)) && \ + IS_GRAPHICS_STEP((gt)->i915, (from), (until)))) +#define GT_TRACE (gt, fmt, ...) do { \ const struct intel_gt *gt__ __maybe_unused = (gt); \ GEM_TRACE("%s " fmt, dev_name(gt__->i915->drm.dev), \
drivers/gpu/drm/i915/gt/intel_gt_mcr.c +3 -4
@@ -3,8 +3,7 @@* Copyright © 2022 Intel Corporation */ -#include "i915_drv.h" - +#include "intel_gt.h" #include "intel_gt_mcr.h" #include "intel_gt_print.h" #include "intel_gt_regs.h"
@@ -166,8 +165,8 @@ void intel_gt_mcr_init(struct intel_gt *gt) gt->steering_table[OADDRM ] = xelpmp_oaddrm_steering_table; }else if (GRAPHICS_VER_FULL (i915) >=IP_VER (12 ,70 )) {/* Wa_14016747170 */ -if (IS_MTL_GRAPHICS_STEP (i915,M ,STEP_A0 ,STEP_B0 ) || -IS_MTL_GRAPHICS_STEP (i915,P ,STEP_A0 ,STEP_B0 )) +if (IS_GFX_GT_IP_STEP (gt,IP_VER (12 ,70 ),STEP_A0 ,STEP_B0 ) || +IS_GFX_GT_IP_STEP (gt,IP_VER (12 ,71 ),STEP_A0 ,STEP_B0 )) fuse =REG_FIELD_GET (MTL_GT_L3_EXC_MASK ,intel_uncore_read (gt->uncore,MTL_GT_ACTIVITY_FACTOR ));
drivers/gpu/drm/i915/gt/intel_lrc.c +2 -2
@@ -1347,8 +1347,8 @@ gen12_emit_indirect_ctx_rcs(const struct intel_context *ce, u32 *cs) cs =gen12_emit_aux_table_inv (ce->engine, cs);/* Wa_16014892111 */ -if (IS_MTL_GRAPHICS_STEP (ce->engine->i915,M ,STEP_A0 ,STEP_B0 ) || -IS_MTL_GRAPHICS_STEP (ce->engine->i915,P ,STEP_A0 ,STEP_B0 ) || +if (IS_GFX_GT_IP_STEP (ce->engine->gt,IP_VER (12 ,70 ),STEP_A0 ,STEP_B0 ) || +IS_GFX_GT_IP_STEP (ce->engine->gt,IP_VER (12 ,71 ),STEP_A0 ,STEP_B0 ) ||IS_DG2 (ce->engine->i915)) cs =dg2_emit_draw_watermark_setting (cs);
drivers/gpu/drm/i915/gt/intel_reset.c +1 -1
@@ -1641,7 +1641,7 @@ bool intel_engine_reset_needs_wa_22011802037(struct intel_gt *gt)if (GRAPHICS_VER (gt->i915) <11 )return false; -if (IS_MTL_GRAPHICS_STEP (gt->i915,M ,STEP_A0 ,STEP_B0 )) +if (IS_GFX_GT_IP_STEP (gt,IP_VER (12 ,70 ),STEP_A0 ,STEP_B0 ))return true;if (GRAPHICS_VER_FULL (gt->i915) >=IP_VER (12 ,70 ))
drivers/gpu/drm/i915/gt/intel_workarounds.c +25 -23
122 lines not on this page · raw message
drivers/gpu/drm/i915/gt/uc/intel_guc.c +1 -1
@@ -273,7 +273,7 @@ static u32 guc_ctl_wa_flags(struct intel_guc *guc) flags |=GUC_WA_POLLCS ;/* Wa_14014475959 */ -if (IS_MTL_GRAPHICS_STEP (gt->i915,M ,STEP_A0 ,STEP_B0 ) || +if (IS_GFX_GT_IP_STEP (gt,IP_VER (12 ,70 ),STEP_A0 ,STEP_B0 ) ||IS_DG2 (gt->i915)) flags |=GUC_WA_HOLD_CCS_SWITCHOUT ;
drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c +1 -1
@@ -4297,7 +4297,7 @@ static void guc_default_vfuncs(struct intel_engine_cs *engine)/* Wa_14014475959:dg2 */ if (engine->class ==COMPUTE_CLASS ) -if (IS_MTL_GRAPHICS_STEP (engine->i915,M ,STEP_A0 ,STEP_B0 ) || +if (IS_GFX_GT_IP_STEP (engine->gt,IP_VER (12 ,70 ),STEP_A0 ,STEP_B0 ) ||IS_DG2 (engine->i915)) engine->flags |=I915_ENGINE_USES_WA_HOLD_CCS_SWITCHOUT ;
drivers/gpu/drm/i915/i915_drv.h +0 -4
@@ -658,10 +658,6 @@ IS_SUBPLATFORM(const struct drm_i915_private *i915,#define IS_XEHPSDV_GRAPHICS_STEP (__i915, since, until) \ (IS_XEHPSDV(__i915) && IS_GRAPHICS_STEP(__i915, since, until)) -#define IS_MTL_GRAPHICS_STEP (__i915, variant, since, until) \ - (IS_SUBPLATFORM(__i915, INTEL_METEORLAKE, INTEL_SUBPLATFORM_##variant) && \ - IS_GRAPHICS_STEP(__i915, since, until)) -#define IS_MTL_DISPLAY_STEP (__i915, since, until) \ (IS_METEORLAKE(__i915) && \ IS_DISPLAY_STEP(__i915, since, until))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 47/252 drm/i915: Replace several IS_METEORLAKE with proper IP version checks
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Roper <[email protected]>
[ Upstream commit 14128d64090fa88445376cb8ccf91c50c08bd410 ]
Many of the IS_METEORLAKE conditions throughout the driver are supposed to be checks for Xe_LPG and/or Xe_LPM+ IP, not for the MTL platform specifically. Update those checks to ensure that the code will still operate properly if/when these IP versions show up on future platforms.
v2:
- Update two more conditions (one for pg_enable, one for MTL HuC compatibility).
v3:
- Don't change GuC/HuC compatibility check, which sounds like it truly is specific to the MTL platform. (Gustavo)
- Drop a non-lineage workaround number for the OA timestamp frequency workaround. (Gustavo)
Stable-dep-of: 186bce682772 ("drm/i915/mtl: Update workaround 14018575942")
--- drivers/gpu/drm/i915/gem/i915_gem_create.c | 4 ++-- drivers/gpu/drm/i915/gt/intel_engine_pm.c | 2 +- drivers/gpu/drm/i915/gt/intel_mocs.c | 2 +- drivers/gpu/drm/i915/gt/intel_rc6.c | 2 +- drivers/gpu/drm/i915/gt/intel_reset.c | 2 +- drivers/gpu/drm/i915/gt/intel_rps.c | 2 +- drivers/gpu/drm/i915/i915_debugfs.c | 2 +- drivers/gpu/drm/i915/i915_perf.c | 11 +++++------ 8 files changed, 13 insertions(+), 14 deletions(-)
drivers/gpu/drm/i915/gem/i915_gem_create.c +2 -2
@@ -405,8 +405,8 @@ static int ext_set_pat(struct i915_user_extension __user *base, void *data)BUILD_BUG_ON (sizeof (struct drm_i915_gem_create_ext_set_pat ) != offsetofend(struct drm_i915_gem_create_ext_set_pat, rsvd)); -/* Limiting the extension only to Meteor Lake */ -if (!IS_METEORLAKE (i915)) +/* Limiting the extension only to Xe_LPG and beyond */ +if (GRAPHICS_VER_FULL (i915) <IP_VER (12 ,70 ))return -ENODEV ;if (copy_from_user (&ext, base,sizeof (ext)))
drivers/gpu/drm/i915/gt/intel_engine_pm.c +1 -1
@@ -21,7 +21,7 @@ static void intel_gsc_idle_msg_enable(struct intel_engine_cs *engine) {struct drm_i915_private *i915 = engine->i915; -if (IS_METEORLAKE (i915) && engine->id ==GSC0 ) { +if (MEDIA_VER (i915) >=13 && engine->id ==GSC0 ) {intel_uncore_write (engine->gt->uncore,RC_PSMI_CTRL_GSCCS ,_MASKED_BIT_DISABLE (IDLE_MSG_DISABLE ));
drivers/gpu/drm/i915/gt/intel_mocs.c +1 -1
@@ -495,7 +495,7 @@ static unsigned int get_mocs_settings(const struct drm_i915_private *i915,memset (table,0 ,sizeof (struct drm_i915_mocs_table )); table->unused_entries_index =I915_MOCS_PTE ; -if (IS_METEORLAKE (i915)) { +if (IS_GFX_GT_IP_RANGE (&i915->gt0,IP_VER (12 ,70 ),IP_VER (12 ,71 ))) { table->size =ARRAY_SIZE (mtl_mocs_table); table->table = mtl_mocs_table; table->n_entries =MTL_NUM_MOCS_ENTRIES ;
drivers/gpu/drm/i915/gt/intel_rc6.c +1 -1
@@ -123,7 +123,7 @@ static void gen11_rc6_enable(struct intel_rc6 *rc6)* temporary wa and should be removed after fixing real cause * of forcewake timeouts. */ -if (IS_METEORLAKE (gt->i915)) +if (IS_GFX_GT_IP_RANGE (gt,IP_VER (12 ,70 ),IP_VER (12 ,71 ))) pg_enable =GEN9_MEDIA_PG_ENABLE |GEN11_MEDIA_SAMPLER_PG_ENABLE ;
drivers/gpu/drm/i915/gt/intel_reset.c +1 -1
@@ -705,7 +705,7 @@ static int __reset_guc(struct intel_gt *gt)static bool needs_wa_14015076503 (struct intel_gt *gt,intel_engine_mask_t engine_mask) { -if (!IS_METEORLAKE (gt->i915) || !HAS_ENGINE (gt,GSC0 )) +if (MEDIA_VER_FULL (gt->i915) !=IP_VER (13 ,0 ) || !HAS_ENGINE (gt,GSC0 ))return false;if (!__HAS_ENGINE (engine_mask,GSC0 ))
drivers/gpu/drm/i915/gt/intel_rps.c +1 -1
@@ -1161,7 +1161,7 @@ void gen6_rps_get_freq_caps(struct intel_rps *rps, struct intel_rps_freq_caps *c {struct drm_i915_private *i915 =rps_to_i915 (rps); -if (IS_METEORLAKE (i915)) +if (GRAPHICS_VER_FULL (i915) >=IP_VER (12 ,70 ))return mtl_get_freq_caps (rps, caps);else return __gen6_rps_get_freq_caps (rps, caps);
drivers/gpu/drm/i915/i915_debugfs.c +1 -1
@@ -144,7 +144,7 @@ static const char *i915_cache_level_str(struct drm_i915_gem_object *obj) {struct drm_i915_private *i915 =obj_to_i915 (obj); -if (IS_METEORLAKE (i915)) { +if (IS_GFX_GT_IP_RANGE (to_gt (i915),IP_VER (12 ,70 ),IP_VER (12 ,71 ))) {switch (obj->pat_index) {case 0 :return " WB" ;case 1 :return " WT" ;
drivers/gpu/drm/i915/i915_perf.c +5 -6
@@ -3255,11 +3255,10 @@ get_sseu_config(struct intel_sseu *out_sseu,*/ u32 i915_perf_oa_timestamp_frequency (struct drm_i915_private *i915) { -/* -* Wa_18013179988:dg2 -* Wa_14015846243:mtl -*/ -if (IS_DG2 (i915) ||IS_METEORLAKE (i915)) { +struct intel_gt *gt =to_gt (i915); + +/* Wa_18013179988 */ +if (IS_DG2 (i915) ||IS_GFX_GT_IP_RANGE (gt,IP_VER (12 ,70 ),IP_VER (12 ,71 ))) {intel_wakeref_t wakeref;u32 reg, shift;
@@ -4564,7 +4563,7 @@ static bool xehp_is_valid_b_counter_addr(struct i915_perf *perf, u32 addr)static bool gen12_is_valid_mux_addr (struct i915_perf *perf,u32 addr) { -if (IS_METEORLAKE (perf->i915)) +if (GRAPHICS_VER_FULL (perf->i915) >=IP_VER (12 ,70 ))return reg_in_range_table (addr, mtl_oa_mux_regs);else return reg_in_range_table (addr, gen12_oa_mux_regs);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 48/252 drm/i915/mtl: Update workaround 14016712196
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejas Upadhyay <[email protected]>
[ Upstream commit 7467e1da906468bcbd311023b30708193103ecf9 ]
Now this workaround is permanent workaround on MTL and DG2, earlier we used to apply on MTL A0 step only. VLK-45480
Stable-dep-of: 186bce682772 ("drm/i915/mtl: Update workaround 14018575942")
--- drivers/gpu/drm/i915/gt/gen8_engine_cs.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/gpu/drm/i915/gt/gen8_engine_cs.c +3 -4
@@ -226,8 +226,8 @@ u32 *gen12_emit_aux_table_inv(struct intel_engine_cs *engine, u32 *cs)static int mtl_dummy_pipe_control (struct i915_request *rq) {/* Wa_14016712196 */ -if (IS_GFX_GT_IP_STEP (rq->engine->gt,IP_VER (12 ,70 ),STEP_A0 ,STEP_B0 ) || -IS_GFX_GT_IP_STEP (rq->engine->gt,IP_VER (12 ,71 ),STEP_A0 ,STEP_B0 )) { +if (IS_GFX_GT_IP_RANGE (rq->engine->gt,IP_VER (12 ,70 ),IP_VER (12 ,71 )) || +IS_DG2 (rq->i915)) {u32 *cs;/* dummy PIPE_CONTROL + depth flush */
@@ -819,8 +819,7 @@ u32 *gen12_emit_fini_breadcrumb_rcs(struct i915_request *rq, u32 *cs) PIPE_CONTROL_FLUSH_ENABLE);/* Wa_14016712196 */ -if (IS_GFX_GT_IP_STEP (gt,IP_VER (12 ,70 ),STEP_A0 ,STEP_B0 ) || -IS_GFX_GT_IP_STEP (gt,IP_VER (12 ,71 ),STEP_A0 ,STEP_B0 )) +if (IS_GFX_GT_IP_RANGE (gt,IP_VER (12 ,70 ),IP_VER (12 ,71 )) ||IS_DG2 (i915))/* dummy PIPE_CONTROL + depth flush */ cs =gen12_emit_pipe_control (cs,0 ,PIPE_CONTROL_DEPTH_CACHE_FLUSH ,0 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 49/252 drm/i915/xelpg: Extend some workarounds/tuning to gfx version 12.74
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Roper <[email protected]>
[ Upstream commit c44d4ef47fdad0a33966de89f9064e19736bb52f ]
Some of our existing Xe_LPG workarounds and tuning are also applicable to the version 12.74 variant. Extend the condition bounds accordingly. Also fix the comment on Wa_14018575942 while we're at it.
v2: Extend some more workarounds (Harish)
Stable-dep-of: 186bce682772 ("drm/i915/mtl: Update workaround 14018575942")
--- drivers/gpu/drm/i915/gt/gen8_engine_cs.c | 4 ++-- drivers/gpu/drm/i915/gt/intel_workarounds.c | 24 +++++++++++++-------- drivers/gpu/drm/i915/i915_perf.c | 2 +- 3 files changed, 18 insertions(+), 12 deletions(-)
drivers/gpu/drm/i915/gt/gen8_engine_cs.c +2 -2
@@ -226,7 +226,7 @@ u32 *gen12_emit_aux_table_inv(struct intel_engine_cs *engine, u32 *cs)static int mtl_dummy_pipe_control (struct i915_request *rq) {/* Wa_14016712196 */ -if (IS_GFX_GT_IP_RANGE (rq->engine->gt,IP_VER (12 ,70 ),IP_VER (12 ,71 )) || +if (IS_GFX_GT_IP_RANGE (rq->engine->gt,IP_VER (12 ,70 ),IP_VER (12 ,74 )) ||IS_DG2 (rq->i915)) {u32 *cs;
@@ -819,7 +819,7 @@ u32 *gen12_emit_fini_breadcrumb_rcs(struct i915_request *rq, u32 *cs) PIPE_CONTROL_FLUSH_ENABLE);/* Wa_14016712196 */ -if (IS_GFX_GT_IP_RANGE (gt,IP_VER (12 ,70 ),IP_VER (12 ,71 )) ||IS_DG2 (i915)) +if (IS_GFX_GT_IP_RANGE (gt,IP_VER (12 ,70 ),IP_VER (12 ,74 )) ||IS_DG2 (i915))/* dummy PIPE_CONTROL + depth flush */ cs =gen12_emit_pipe_control (cs,0 ,PIPE_CONTROL_DEPTH_CACHE_FLUSH ,0 );
drivers/gpu/drm/i915/gt/intel_workarounds.c +15 -9
@@ -788,8 +788,13 @@ static void xelpg_ctx_gt_tuning_init(struct intel_engine_cs *engine,dg2_ctx_gt_tuning_init (engine, wal); -if (IS_GFX_GT_IP_STEP (gt,IP_VER (12 ,70 ),STEP_B0 ,STEP_FOREVER ) || -IS_GFX_GT_IP_STEP (gt,IP_VER (12 ,71 ),STEP_B0 ,STEP_FOREVER )) +/* +* Due to Wa_16014892111, the DRAW_WATERMARK tuning must be done in +* gen12_emit_indirect_ctx_rcs() rather than here on some early +* steppings. +*/ +if (!(IS_GFX_GT_IP_STEP (gt,IP_VER (12 ,70 ),STEP_A0 ,STEP_B0 ) || +IS_GFX_GT_IP_STEP (gt,IP_VER (12 ,71 ),STEP_A0 ,STEP_B0 )))wa_add (wal,DRAW_WATERMARK ,VERT_WM_VAL ,0x3FF ,0 , false); }
@@ -907,7 +912,7 @@ __intel_engine_init_ctx_wa(struct intel_engine_cs *engine,if (engine->class !=RENDER_CLASS ) goto done; -if (IS_GFX_GT_IP_RANGE (engine->gt,IP_VER (12 ,70 ),IP_VER (12 ,71 ))) +if (IS_GFX_GT_IP_RANGE (engine->gt,IP_VER (12 ,70 ),IP_VER (12 ,74 )))xelpg_ctx_workarounds_init (engine, wal);else if (IS_PONTEVECCHIO (i915)) ;/* noop; none at this time */
@@ -1638,7 +1643,7 @@ pvc_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal)static void xelpg_gt_workarounds_init (struct intel_gt *gt,struct i915_wa_list *wal) { -/* Wa_14018778641 / Wa_18018781329 */ +/* Wa_14018575942 / Wa_18018781329 */ wa_mcr_write_or (wal,COMP_MOD_CTRL ,FORCE_MISS_FTLB );/* Wa_22016670082 */
@@ -1688,7 +1693,7 @@ xelpmp_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal)*/ static void gt_tuning_settings (struct intel_gt *gt,struct i915_wa_list *wal) { -if (IS_GFX_GT_IP_RANGE (gt,IP_VER (12 ,70 ),IP_VER (12 ,71 ))) { +if (IS_GFX_GT_IP_RANGE (gt,IP_VER (12 ,70 ),IP_VER (12 ,74 ))) {wa_mcr_write_or (wal,XEHP_L3SCQREG7 ,BLEND_FILL_CACHING_OPT_DIS );wa_mcr_write_or (wal,XEHP_SQCM ,EN_32B_ACCESS ); }
@@ -1721,7 +1726,7 @@ gt_init_workarounds(struct intel_gt *gt, struct i915_wa_list *wal)return ; } -if (IS_GFX_GT_IP_RANGE (gt,IP_VER (12 ,70 ),IP_VER (12 ,71 ))) +if (IS_GFX_GT_IP_RANGE (gt,IP_VER (12 ,70 ),IP_VER (12 ,74 )))xelpg_gt_workarounds_init (gt, wal);else if (IS_PONTEVECCHIO (i915))pvc_gt_workarounds_init (gt, wal);
@@ -2194,7 +2199,7 @@ void intel_engine_init_whitelist(struct intel_engine_cs *engine)if (engine->gt->type ==GT_MEDIA ) ;/* none yet */ -else if (IS_GFX_GT_IP_RANGE (engine->gt,IP_VER (12 ,70 ),IP_VER (12 ,71 ))) +else if (IS_GFX_GT_IP_RANGE (engine->gt,IP_VER (12 ,70 ),IP_VER (12 ,74 )))xelpg_whitelist_build (engine);else if (IS_PONTEVECCHIO (i915))pvc_whitelist_build (engine);
@@ -2801,7 +2806,7 @@ add_render_compute_tuning_settings(struct intel_gt *gt, {struct drm_i915_private *i915 = gt->i915; -if (IS_GFX_GT_IP_RANGE (gt,IP_VER (12 ,70 ),IP_VER (12 ,71 )) ||IS_DG2 (i915)) +if (IS_GFX_GT_IP_RANGE (gt,IP_VER (12 ,70 ),IP_VER (12 ,74 )) ||IS_DG2 (i915))wa_mcr_write_clr_set (wal,RT_CTRL ,STACKID_CTRL ,STACKID_CTRL_512 );/*
@@ -2854,7 +2859,8 @@ general_render_compute_wa_init(struct intel_engine_cs *engine, struct i915_wa_li }if (IS_GFX_GT_IP_STEP (gt,IP_VER (12 ,70 ),STEP_B0 ,STEP_FOREVER ) || -IS_GFX_GT_IP_STEP (gt,IP_VER (12 ,71 ),STEP_B0 ,STEP_FOREVER )) +IS_GFX_GT_IP_STEP (gt,IP_VER (12 ,71 ),STEP_B0 ,STEP_FOREVER ) || +IS_GFX_GT_IP_RANGE (gt,IP_VER (12 ,74 ),IP_VER (12 ,74 )))/* Wa_14017856879 */ wa_mcr_masked_en (wal,GEN9_ROW_CHICKEN3 ,MTL_DISABLE_FIX_FOR_EOT_FLUSH );
drivers/gpu/drm/i915/i915_perf.c +1 -1
@@ -3258,7 +3258,7 @@ u32 i915_perf_oa_timestamp_frequency(struct drm_i915_private *i915)struct intel_gt *gt =to_gt (i915);/* Wa_18013179988 */ -if (IS_DG2 (i915) ||IS_GFX_GT_IP_RANGE (gt,IP_VER (12 ,70 ),IP_VER (12 ,71 ))) { +if (IS_DG2 (i915) ||IS_GFX_GT_IP_RANGE (gt,IP_VER (12 ,70 ),IP_VER (12 ,74 ))) {intel_wakeref_t wakeref;u32 reg, shift;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 50/252 drm/i915/mtl: Update workaround 14018575942
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejas Upadhyay <[email protected]>
[ Upstream commit 186bce682772e7346bf7ced5325b5f4ff050ccfb ]
Applying WA 14018575942 only on Compute engine has impact on some apps like chrome. Updating this WA to apply on Render engine as well as it is helping with performance on Chrome.
Note: There is no concern from media team thus not applying WA on media engines. We will revisit if any issues reported from media team.
V2(Matt):
- Use correct WA number
--- drivers/gpu/drm/i915/gt/intel_workarounds.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/i915/gt/intel_workarounds.c +1 -0
@@ -1644,6 +1644,7 @@ static void xelpg_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal) {/* Wa_14018575942 / Wa_18018781329 */ +wa_mcr_write_or (wal, RENDER_MOD_CTRL, FORCE_MISS_FTLB);wa_mcr_write_or (wal,COMP_MOD_CTRL ,FORCE_MISS_FTLB );/* Wa_22016670082 */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 51/252 dm integrity: fix out-of-range warning
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 8e91c2342351e0f5ef6c0a704384a7f6fc70c3b2 ]
Depending on the value of CONFIG_HZ, clang complains about a pointless comparison:
drivers/md/dm-integrity.c:4085:12: error: result of comparison of
constant 42949672950 with expression of type 'unsigned int' is always false [-Werror,-Wtautological-constant-out-of-range-compare] if (val >= (uint64_t)UINT_MAX * 1000 / HZ) {
As the check remains useful for other configurations, shut up the warning by adding a second type cast to uint64_t.
--- drivers/md/dm-integrity.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/md/dm-integrity.c +1 -1
@@ -4231,7 +4231,7 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned int argc, char **argv }else if (sscanf (opt_string,"sectors_per_bit:%llu%c" , &llval, &dummy) ==1 ) { log2_sectors_per_bitmap_bit = !llval ?0 :__ilog2_u64 (llval); }else if (sscanf (opt_string,"bitmap_flush_interval:%u%c" , &val, &dummy) ==1 ) { -if (val >= (uint64_t )UINT_MAX *1000 /HZ ) { +if ((uint64_t )val >= (uint64_t )UINT_MAX *1000 /HZ ) { r = -EINVAL ; ti->error ="Invalid bitmap_flush_interval argument" ; goto bad;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 52/252 mm/treewide: replace pud_large() with pud_leaf()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Xu <[email protected]>
[ Upstream commit 0a845e0f6348ccfa2dcc8c450ffd1c9ffe8c4add ]
pud_large() is always defined as pud_leaf(). Merge their usages. Chose pud_leaf() because pud_leaf() is a global API, while pud_large() is not.
Stable-dep-of: c567f2948f57 ("Revert "x86/mm/ident_map: Use gbpages only where full GB page should be mapped."")
--- arch/powerpc/mm/book3s64/pgtable.c | 2 +- arch/s390/boot/vmem.c | 2 +- arch/s390/include/asm/pgtable.h | 4 ++-- arch/s390/mm/gmap.c | 2 +- arch/s390/mm/hugetlbpage.c | 4 ++-- arch/s390/mm/pageattr.c | 2 +- arch/s390/mm/pgtable.c | 2 +- arch/s390/mm/vmem.c | 6 +++--- arch/sparc/mm/init_64.c | 2 +- arch/x86/kvm/mmu/mmu.c | 2 +- arch/x86/mm/fault.c | 4 ++-- arch/x86/mm/ident_map.c | 2 +- arch/x86/mm/init_64.c | 4 ++-- arch/x86/mm/kasan_init_64.c | 2 +- arch/x86/mm/mem_encrypt_identity.c | 2 +- arch/x86/mm/pat/set_memory.c | 6 +++--- arch/x86/mm/pgtable.c | 2 +- arch/x86/mm/pti.c | 2 +- arch/x86/power/hibernate.c | 2 +- arch/x86/xen/mmu_pv.c | 4 ++-- 20 files changed, 29 insertions(+), 29 deletions(-)
arch/powerpc/mm/book3s64/pgtable.c +1 -1
@@ -130,7 +130,7 @@ void set_pud_at(struct mm_struct *mm, unsigned long addr,WARN_ON (pte_hw_valid (pud_pte (*pudp)));assert_spin_locked (pud_lockptr (mm, pudp)); -WARN_ON (!(pud_large (pud))); +WARN_ON (!(pud_leaf (pud)));#endif trace_hugepage_set_pud (addr,pud_val (pud));return set_pte_at (mm, addr,pudp_ptep (pudp),pud_pte (pud));
arch/s390/boot/vmem.c +1 -1
@@ -360,7 +360,7 @@ static void pgtable_pud_populate(p4d_t *p4d, unsigned long addr, unsigned long e } pmd =boot_crst_alloc (_SEGMENT_ENTRY_EMPTY);pud_populate (&init_mm, pud, pmd); - }else if (pud_large (*pud)) { + }else if (pud_leaf (*pud)) {continue ; }pgtable_pmd_populate (pud, addr, next, mode);
arch/s390/include/asm/pgtable.h +2 -2
@@ -729,7 +729,7 @@ static inline int pud_bad(pud_t pud) {unsigned long type =pud_val (pud) & _REGION_ENTRY_TYPE_MASK; -if (type > _REGION_ENTRY_TYPE_R3 ||pud_large (pud)) +if (type > _REGION_ENTRY_TYPE_R3 ||pud_leaf (pud))return 1 ;if (type < _REGION_ENTRY_TYPE_R3)return 0 ;
@@ -1396,7 +1396,7 @@ static inline unsigned long pud_deref(pud_t pud)unsigned long origin_mask; origin_mask = _REGION_ENTRY_ORIGIN; -if (pud_large (pud)) +if (pud_leaf (pud)) origin_mask = _REGION3_ENTRY_ORIGIN_LARGE;return (unsigned long )__va (pud_val (pud) & origin_mask); }
arch/s390/mm/gmap.c +1 -1
@@ -596,7 +596,7 @@ int __gmap_link(struct gmap *gmap, unsigned long gaddr, unsigned long vmaddr) pud =pud_offset (p4d, vmaddr);VM_BUG_ON (pud_none (*pud));/* large puds cannot yet be handled */ -if (pud_large (*pud)) +if (pud_leaf (*pud))return -EFAULT ; pmd =pmd_offset (pud, vmaddr);VM_BUG_ON (pmd_none (*pmd));
arch/s390/mm/hugetlbpage.c +2 -2
@@ -224,7 +224,7 @@ pte_t *huge_pte_offset(struct mm_struct *mm,if (p4d_present (*p4dp)) { pudp =pud_offset (p4dp, addr);if (pud_present (*pudp)) { -if (pud_large (*pudp)) +if (pud_leaf (*pudp))return (pte_t *) pudp; pmdp =pmd_offset (pudp, addr); }
@@ -240,7 +240,7 @@ int pmd_huge(pmd_t pmd)int pud_huge (pud_t pud) { -return pud_large (pud); +return pud_leaf (pud); }bool __init arch_hugetlb_valid_size (unsigned long size)
arch/s390/mm/pageattr.c +1 -1
@@ -274,7 +274,7 @@ static int walk_pud_level(p4d_t *p4d, unsigned long addr, unsigned long end,if (pud_none (*pudp))return -EINVAL ; next =pud_addr_end (addr, end); -if (pud_large (*pudp)) { +if (pud_leaf (*pudp)) { need_split = !!(flags &SET_MEMORY_4K ); need_split |= !!(addr & ~PUD_MASK ); need_split |= !!(addr +PUD_SIZE > next);
arch/s390/mm/pgtable.c +1 -1
@@ -479,7 +479,7 @@ static int pmd_lookup(struct mm_struct *mm, unsigned long addr, pmd_t **pmdp)return -ENOENT ;/* Large PUDs are not supported yet. */ -if (pud_large (*pud)) +if (pud_leaf (*pud))return -EFAULT ; *pmdp =pmd_offset (pud, addr);
arch/s390/mm/vmem.c +3 -3
@@ -322,7 +322,7 @@ static int modify_pud_table(p4d_t *p4d, unsigned long addr, unsigned long end,if (!add) {if (pud_none (*pud))continue ; -if (pud_large (*pud)) { +if (pud_leaf (*pud)) {if (IS_ALIGNED (addr,PUD_SIZE ) &&IS_ALIGNED (next,PUD_SIZE )) {pud_clear (pud);
@@ -343,7 +343,7 @@ static int modify_pud_table(p4d_t *p4d, unsigned long addr, unsigned long end,if (!pmd) goto out;pud_populate (&init_mm, pud, pmd); - }else if (pud_large (*pud)) { + }else if (pud_leaf (*pud)) {continue ; } ret =modify_pmd_table (pud, addr, next, add, direct);
@@ -586,7 +586,7 @@ pte_t *vmem_get_alloc_pte(unsigned long addr, bool alloc)if (!pmd) goto out;pud_populate (&init_mm, pud, pmd); - }else if (WARN_ON_ONCE (pud_large (*pud))) { + }else if (WARN_ON_ONCE (pud_leaf (*pud))) { goto out; } pmd =pmd_offset (pud, addr);
arch/sparc/mm/init_64.c +1 -1
@@ -1665,7 +1665,7 @@ bool kern_addr_valid(unsigned long addr)if (pud_none (*pud))return false; -if (pud_large (*pud)) +if (pud_leaf (*pud))return pfn_valid (pud_pfn (*pud)); pmd =pmd_offset (pud, addr);
arch/x86/kvm/mmu/mmu.c +1 -1
@@ -3120,7 +3120,7 @@ static int host_pfn_mapping_level(struct kvm *kvm, gfn_t gfn,if (pud_none (pud) || !pud_present (pud)) goto out; -if (pud_large (pud)) { +if (pud_leaf (pud)) { level =PG_LEVEL_1G ; goto out; }
arch/x86/mm/fault.c +2 -2
@@ -376,7 +376,7 @@ static void dump_pagetable(unsigned long address) goto bad;pr_cont ("PUD %lx " ,pud_val (*pud)); -if (!pud_present (*pud) ||pud_large (*pud)) +if (!pud_present (*pud) ||pud_leaf (*pud)) goto out; pmd =pmd_offset (pud, address);
@@ -1037,7 +1037,7 @@ spurious_kernel_fault(unsigned long error_code, unsigned long address)if (!pud_present (*pud))return 0 ; -if (pud_large (*pud)) +if (pud_leaf (*pud))return spurious_kernel_fault_check (error_code, (pte_t *) pud); pmd =pmd_offset (pud, address);
arch/x86/mm/ident_map.c +1 -1
@@ -33,7 +33,7 @@ static int ident_pud_init(struct x86_mapping_info *info, pud_t *pud_page, next = end;/* if this is already a gbpage, this portion is already mapped */ -if (pud_large (*pud)) +if (pud_leaf (*pud))continue ;/* Is using a gbpage allowed? */
arch/x86/mm/init_64.c +2 -2
@@ -617,7 +617,7 @@ phys_pud_init(pud_t *pud_page, unsigned long paddr, unsigned long paddr_end, }if (!pud_none (*pud)) { -if (!pud_large (*pud)) { +if (!pud_leaf (*pud)) { pmd =pmd_offset (pud,0 ); paddr_last = phys_pmd_init(pmd, paddr, paddr_end,
@@ -1163,7 +1163,7 @@ remove_pud_table(pud_t *pud_start, unsigned long addr, unsigned long end,if (!pud_present (*pud))continue ; -if (pud_large (*pud) && +if (pud_leaf (*pud) &&IS_ALIGNED (addr,PUD_SIZE ) &&IS_ALIGNED (next,PUD_SIZE )) {spin_lock (&init_mm.page_table_lock);
arch/x86/mm/kasan_init_64.c +1 -1
@@ -115,7 +115,7 @@ static void __init kasan_populate_p4d(p4d_t *p4d, unsigned long addr, pud =pud_offset (p4d, addr);do { next =pud_addr_end (addr, end); -if (!pud_large (*pud)) +if (!pud_leaf (*pud))kasan_populate_pud (pud, addr, next, nid); }while (pud++, addr = next, addr != end); }
arch/x86/mm/mem_encrypt_identity.c +1 -1
@@ -144,7 +144,7 @@ static pud_t __init *sme_prepare_pgd(struct sme_populate_pgd_data *ppd)set_pud (pud,__pud (PUD_FLAGS |__pa (pmd))); } -if (pud_large (*pud)) +if (pud_leaf (*pud))return NULL ;return pud;
arch/x86/mm/pat/set_memory.c +3 -3
@@ -684,7 +684,7 @@ pte_t *lookup_address_in_pgd(pgd_t *pgd, unsigned long address,return NULL ; *level =PG_LEVEL_1G ; -if (pud_large (*pud) || !pud_present (*pud)) +if (pud_leaf (*pud) || !pud_present (*pud))return (pte_t *)pud; pmd =pmd_offset (pud, address);
@@ -743,7 +743,7 @@ pmd_t *lookup_pmd_address(unsigned long address)return NULL ; pud =pud_offset (p4d, address); -if (pud_none (*pud) ||pud_large (*pud) || !pud_present (*pud)) +if (pud_none (*pud) ||pud_leaf (*pud) || !pud_present (*pud))return NULL ;return pmd_offset (pud, address);
@@ -1274,7 +1274,7 @@ static void unmap_pud_range(p4d_t *p4d, unsigned long start, unsigned long end)*/ while (end - start >=PUD_SIZE ) { -if (pud_large (*pud)) +if (pud_leaf (*pud))pud_clear (pud);else unmap_pmd_range (pud, start, start +PUD_SIZE );
arch/x86/mm/pgtable.c +1 -1
@@ -774,7 +774,7 @@ int pmd_set_huge(pmd_t *pmd, phys_addr_t addr, pgprot_t prot)*/ int pud_clear_huge (pud_t *pud) { -if (pud_large (*pud)) { +if (pud_leaf (*pud)) {pud_clear (pud);return 1 ; }
arch/x86/mm/pti.c +1 -1
@@ -217,7 +217,7 @@ static pmd_t *pti_user_pagetable_walk_pmd(unsigned long address) pud =pud_offset (p4d, address);/* The user page tables do not use large mappings: */ -if (pud_large (*pud)) { +if (pud_leaf (*pud)) {WARN_ON (1 );return NULL ; }
arch/x86/power/hibernate.c +1 -1
@@ -170,7 +170,7 @@ int relocate_restore_code(void) goto out; } pud =pud_offset (p4d, relocated_restore_code); -if (pud_large (*pud)) { +if (pud_leaf (*pud)) {set_pud (pud,__pud (pud_val (*pud) & ~_PAGE_NX)); goto out; }
arch/x86/xen/mmu_pv.c +2 -2
@@ -1082,7 +1082,7 @@ static void __init xen_cleanmfnmap_pud(pud_t *pud, bool unpin)pmd_t *pmd_tbl;int i; -if (pud_large (*pud)) { +if (pud_leaf (*pud)) { pa =pud_val (*pud) &PHYSICAL_PAGE_MASK ;xen_free_ro_pages (pa,PUD_SIZE );return ;
@@ -1863,7 +1863,7 @@ static phys_addr_t __init xen_early_virt_to_phys(unsigned long vaddr)if (!pud_present (pud))return 0 ; pa =pud_val (pud) &PTE_PFN_MASK ; -if (pud_large (pud)) +if (pud_leaf (pud))return pa + (vaddr & ~PUD_MASK ); pmd = native_make_pmd(xen_read_phys_ulong(pa + pmd_index(vaddr) *
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 53/252 Revert "x86/mm/ident_map: Use gbpages only where full GB page should be mapped."
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ingo Molnar <[email protected]>
[ Upstream commit c567f2948f57bdc03ed03403ae0234085f376b7d ]
This reverts commit d794734c9bbfe22f86686dc2909c25f5ffe1a572.
While the original change tries to fix a bug, it also unintentionally broke existing systems, see the regressions reported at:
https://lore.kernel.org/all/[email protected]/
Since d794734c9bbf was also marked for -stable, let's back it out before causing more damage.
Note that due to another upstream change the revert was not 100% automatic:
0a845e0f6348 mm/treewide: replace pud_large() with pud_leaf()
--- arch/x86/mm/ident_map.c | 23 +++++------------------ 1 file changed, 5 insertions(+), 18 deletions(-)
arch/x86/mm/ident_map.c +5 -18
@@ -26,31 +26,18 @@ static int ident_pud_init(struct x86_mapping_info *info, pud_t *pud_page,for (; addr < end; addr = next) {pud_t *pud = pud_page +pud_index (addr);pmd_t *pmd; -bool use_gbpage; next = (addr &PUD_MASK ) +PUD_SIZE ;if (next > end) next = end; -/* if this is already a gbpage, this portion is already mapped */ -if (pud_leaf (*pud)) -continue ; - -/* Is using a gbpage allowed? */ - use_gbpage = info->direct_gbpages; - -/* Don't use gbpage if it maps more than the requested region. */ -/* at the begining: */ - use_gbpage &= ((addr & ~PUD_MASK ) ==0 ); -/* ... or at the end: */ - use_gbpage &= ((next & ~PUD_MASK ) ==0 ); - -/* Never overwrite existing mappings */ - use_gbpage &= !pud_present (*pud); - -if (use_gbpage) { +if (info->direct_gbpages) {pud_t pudval; +if (pud_present (*pud)) +continue ; + + addr &=PUD_MASK ; pudval =__pud ((addr - info->offset) | info->page_flag);set_pud (pud, pudval);continue ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 54/252 btrfs: ensure fiemap doesnt race with writes when FIEMAP_FLAG_SYNC is given
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit 418b09027743d9a9fb39116bed46a192f868a3c3 ]
When FIEMAP_FLAG_SYNC is given to fiemap the expectation is that that are no concurrent writes and we get a stable view of the inode's extent layout.
When the flag is given we flush all IO (and wait for ordered extents to complete) and then lock the inode in shared mode, however that leaves open the possibility that a write might happen right after the flushing and before locking the inode. So fix this by flushing again after locking the inode - we leave the initial flushing before locking the inode to avoid holding the lock and blocking other RO operations while waiting for IO and ordered extents to complete. The second flushing while holding the inode's lock will most of the time do nothing or very little since the time window for new writes to have happened is small.
Stable-dep-of: 978b63f7464a ("btrfs: fix race when detecting delalloc ranges during fiemap")
--- fs/btrfs/extent_io.c | 21 ++++++++------------- fs/btrfs/inode.c | 22 +++++++++++++++++++++- 2 files changed, 29 insertions(+), 14 deletions(-)
fs/btrfs/extent_io.c +8 -13
@@ -2953,17 +2953,15 @@ int extent_fiemap(struct btrfs_inode *inode, struct fiemap_extent_info *fieinfo, range_end =round_up (start + len, sectorsize); prev_extent_end = range_start; -btrfs_inode_lock (inode,BTRFS_ILOCK_SHARED ); - ret =fiemap_find_last_extent_offset (inode, path, &last_extent_end);if (ret <0 ) - goto out_unlock; + goto out;btrfs_release_path (path); path->reada =READA_FORWARD ; ret =fiemap_search_slot (inode, path, range_start);if (ret <0 ) { - goto out_unlock; + goto out; }else if (ret >0 ) {/* * No file extent item found, but we may have delalloc between
@@ -3010,7 +3008,7 @@ int extent_fiemap(struct btrfs_inode *inode, struct fiemap_extent_info *fieinfo, backref_ctx,0 ,0 ,0 , prev_extent_end, hole_end);if (ret <0 ) { - goto out_unlock; + goto out; }else if (ret >0 ) {/* fiemap_fill_next_extent() told us to stop. */ stopped = true;
@@ -3066,7 +3064,7 @@ int extent_fiemap(struct btrfs_inode *inode, struct fiemap_extent_info *fieinfo, extent_gen, backref_ctx);if (ret <0 ) - goto out_unlock; + goto out;else if (ret >0 ) flags |=FIEMAP_EXTENT_SHARED ; }
@@ -3077,7 +3075,7 @@ int extent_fiemap(struct btrfs_inode *inode, struct fiemap_extent_info *fieinfo, }if (ret <0 ) { - goto out_unlock; + goto out; }else if (ret >0 ) {/* fiemap_fill_next_extent() told us to stop. */ stopped = true;
@@ -3088,12 +3086,12 @@ int extent_fiemap(struct btrfs_inode *inode, struct fiemap_extent_info *fieinfo, next_item:if (fatal_signal_pending (current)) { ret = -EINTR ; - goto out_unlock; + goto out; } ret =fiemap_next_leaf_item (inode, path);if (ret <0 ) { - goto out_unlock; + goto out; }else if (ret >0 ) {/* No more file extent items for this inode. */ break ;
@@ -3117,7 +3115,7 @@ int extent_fiemap(struct btrfs_inode *inode, struct fiemap_extent_info *fieinfo, &delalloc_cached_state, backref_ctx, 0, 0, 0, prev_extent_end, range_end - 1);if (ret <0 ) - goto out_unlock; + goto out; prev_extent_end = range_end; }
@@ -3155,9 +3153,6 @@ int extent_fiemap(struct btrfs_inode *inode, struct fiemap_extent_info *fieinfo, } ret =emit_last_fiemap_cache (fieinfo, &cache); - -out_unlock: -btrfs_inode_unlock (inode,BTRFS_ILOCK_SHARED ); out:free_extent_state (delalloc_cached_state);btrfs_free_backref_share_ctx (backref_ctx);
fs/btrfs/inode.c +21 -1
@@ -7813,6 +7813,7 @@ struct iomap_dio *btrfs_dio_write(struct kiocb *iocb, struct iov_iter *iter,static int btrfs_fiemap (struct inode *inode,struct fiemap_extent_info *fieinfo,u64 start,u64 len) { +struct btrfs_inode *btrfs_inode =BTRFS_I (inode);int ret; ret =fiemap_prep (inode, fieinfo, start, &len,0 );
@@ -7838,7 +7839,26 @@ static int btrfs_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,return ret; } -return extent_fiemap (BTRFS_I (inode), fieinfo, start, len); +btrfs_inode_lock (btrfs_inode,BTRFS_ILOCK_SHARED ); + +/* +* We did an initial flush to avoid holding the inode's lock while +* triggering writeback and waiting for the completion of IO and ordered +* extents. Now after we locked the inode we do it again, because it's +* possible a new write may have happened in between those two steps. +*/ +if (fieinfo->fi_flags &FIEMAP_FLAG_SYNC ) { + ret =btrfs_wait_ordered_range (inode,0 ,LLONG_MAX ); +if (ret) { +btrfs_inode_unlock (btrfs_inode,BTRFS_ILOCK_SHARED ); +return ret; + } + } + + ret =extent_fiemap (btrfs_inode, fieinfo, start, len); +btrfs_inode_unlock (btrfs_inode,BTRFS_ILOCK_SHARED ); + +return ret; } static int btrfs_writepages(struct address_space *mapping,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 55/252 btrfs: fix race when detecting delalloc ranges during fiemap
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit 978b63f7464abcfd364a6c95f734282c50f3decf ]
For fiemap we recently stopped locking the target extent range for the whole duration of the fiemap call, in order to avoid a deadlock in a scenario where the fiemap buffer happens to be a memory mapped range of the same file. This use case is very unlikely to be useful in practice but it may be triggered by fuzz testing (syzbot, etc).
This however introduced a race that makes us miss delalloc ranges for file regions that are currently holes, so the caller of fiemap will not be aware that there's data for some file regions. This can be quite serious for some use cases - for example in coreutils versions before 9.0, the cp program used fiemap to detect holes and data in the source file, copying only regions with data (extents or delalloc) from the source file to the destination file in order to preserve holes (see the documentation for its --sparse command line option). This means that if cp was used with a source file that had delalloc in a hole, the destination file could end up without that data, which is effectively a data loss issue, if it happened to hit the race described below.
The race happens like this:
1) Fiemap is called, without the FIEMAP_FLAG_SYNC flag, for a file that has delalloc in the file range [64M, 65M[, which is currently a hole;
2) Fiemap locks the inode in shared mode, then starts iterating the inode's subvolume tree searching for file extent items, without having the whole fiemap target range locked in the inode's io tree - the change introduced recently by commit b0ad381fa769 ("btrfs: fix deadlock with fiemap and extent locking"). It only locks ranges in the io tree when it finds a hole or prealloc extent since that commit;
3) Note that fiemap clones each leaf before using it, and this is to avoid deadlocks when locking a file range in the inode's io tree and the fiemap buffer is memory mapped to some file, because writing to the page with btrfs_page_mkwrite() will wait on any ordered extent for the page's range and the ordered extent needs to lock the range and may need to modify the same leaf, therefore leading to a deadlock on the leaf;
4) While iterating the file extent items in the cloned leaf before finding the hole in the range [64M, 65M[, the delalloc in that range is flushed and its ordered extent completes - meaning the corresponding file extent item is in the inode's subvolume tree, but not present in the cloned leaf that fiemap is iterating over;
5) When fiemap finds the hole in the [64M, 65M[ range by seeing the gap in the cloned leaf (or a file extent item with disk_bytenr == 0 in case the NO_HOLES feature is not enabled), it will lock that file range in the inode's io tree and then search for delalloc by checking for the EXTENT_DELALLOC bit in the io tree for that range and ordered extents (with btrfs_find_delalloc_in_range()). But it finds nothing since the delalloc in that range was already flushed and the ordered extent completed and is gone - as a result fiemap will not report that there's delalloc or an extent for the range [64M, 65M[, so user space will be mislead into thinking that there's a hole in that range.
This could actually be sporadically triggered with test case generic/094 from fstests, which reports a missing extent/delalloc range like this:
# generic/094 2s ... - output mismatch (see /home/fdmanana/git/hub/xfstests/results//generic/094.out.bad)
# --- tests/generic/094.out 2020-06-10 19:29:03.830519425 +0100 # +++ /home/fdmanana/git/hub/xfstests/results//generic/094.out.bad 2024-02-28 11:00:00.381071525 +0000 # @@ -1,3 +1,9 @@ # QA output created by 094 # fiemap run with sync # fiemap run without sync # +ERROR: couldn't find extent at 7 # +map is 'HHDDHPPDPHPH' # +logical: [ 5.. 6] phys: 301517.. 301518 flags: 0x800 tot: 2 # +logical: [ 8.. 8] phys: 301520.. 301520 flags: 0x800 tot: 1 # ... # (Run 'diff -u /home/fdmanana/git/hub/xfstests/tests/generic/094.out /home/fdmanana/git/hub/xfstests/results//generic/094.out.bad' to see the entire diff)
So in order to fix this, while still avoiding deadlocks in the case where the fiemap buffer is memory mapped to the same file, change fiemap to work like the following:
1) Always lock the whole range in the inode's io tree before starting to iterate the inode's subvolume tree searching for file extent items, just like we did before commit b0ad381fa769 ("btrfs: fix deadlock with fiemap and extent locking");
2) Now instead of writing to the fiemap buffer every time we have an extent to report, write instead to a temporary buffer (1 page), and when that buffer becomes full, stop iterating the file extent items, unlock the range in the io tree, release the search path, submit all the entries kept in that buffer to the fiemap buffer, and then resume the search for file extent items after locking again the remainder of the range in the io tree.
The buffer having a size of a page, allows for 146 entries in a system with 4K pages. This is a large enough value to have a good performance by avoiding too many restarts of the search for file extent items. In other words this preserves the huge performance gains made in the last two years to fiemap, while avoiding the deadlocks in case the fiemap buffer is memory mapped to the same file (useless in practice, but possible and exercised by fuzz testing and syzbot).
--- fs/btrfs/extent_io.c | 221 +++++++++++++++++++++++++++++++------------ 1 file changed, 160 insertions(+), 61 deletions(-)
fs/btrfs/extent_io.c +160 -61
@@ -2410,12 +2410,65 @@ int try_release_extent_mapping(struct page *page, gfp_t mask)return try_release_extent_state (tree, page, mask); } +struct btrfs_fiemap_entry { +u64 offset; +u64 phys; +u64 len; +u32 flags; +}; +/* -* To cache previous fiemap extent +* Indicate the caller of emit_fiemap_extent() that it needs to unlock the file +* range from the inode's io tree, unlock the subvolume tree search path, flush +* the fiemap cache and relock the file range and research the subvolume tree. +* The value here is something negative that can't be confused with a valid +* errno value and different from 1 because that's also a return value from +* fiemap_fill_next_extent() and also it's often used to mean some btree search +* did not find a key, so make it some distinct negative value. +*/ +#define BTRFS_FIEMAP_FLUSH_CACHE (-(MAX_ERRNO + 1)) + +/* +* Used to: +* +* - Cache the next entry to be emitted to the fiemap buffer, so that we can +* merge extents that are contiguous and can be grouped as a single one; * -* Will be used for merging fiemap extent +* - Store extents ready to be written to the fiemap buffer in an intermediary +* buffer. This intermediary buffer is to ensure that in case the fiemap +* buffer is memory mapped to the fiemap target file, we don't deadlock +* during btrfs_page_mkwrite(). This is because during fiemap we are locking +* an extent range in order to prevent races with delalloc flushing and +* ordered extent completion, which is needed in order to reliably detect +* delalloc in holes and prealloc extents. And this can lead to a deadlock +* if the fiemap buffer is memory mapped to the file we are running fiemap +* against (a silly, useless in practice scenario, but possible) because +* btrfs_page_mkwrite() will try to lock the same extent range. */ struct fiemap_cache { +/* An array of ready fiemap entries. */ +struct btrfs_fiemap_entry *entries; +/* Number of entries in the entries array. */ +int entries_size; +/* Index of the next entry in the entries array to write to. */ +int entries_pos; +/* +* Once the entries array is full, this indicates what's the offset for +* the next file extent item we must search for in the inode's subvolume +* tree after unlocking the extent range in the inode's io tree and +* releasing the search path. +*/ +u64 next_search_offset; +/* +* This matches struct fiemap_extent_info::fi_mapped_extents, we use it +* to count ourselves emitted extents and stop instead of relying on +* fiemap_fill_next_extent() because we buffer ready fiemap entries at +* the @entries array, and we want to stop as soon as we hit the max +* amount of extents to map, not just to save time but also to make the +* logic at extent_fiemap() simpler. +*/ +unsigned int extents_mapped; +/* Fields for the cached extent (unsubmitted, not ready, extent). */ u64 offset;u64 phys;u64 len;
@@ -2423,6 +2476,28 @@ struct fiemap_cache {bool cached; }; +static int flush_fiemap_cache (struct fiemap_extent_info *fieinfo, +struct fiemap_cache *cache) +{ +for (int i =0 ; i < cache->entries_pos; i++) { +struct btrfs_fiemap_entry *entry = &cache->entries[i]; +int ret; + + ret =fiemap_fill_next_extent (fieinfo, entry->offset, + entry->phys, entry->len, + entry->flags); +/* +* Ignore 1 (reached max entries) because we keep track of that +* ourselves in emit_fiemap_extent(). +*/ +if (ret <0 ) +return ret; + } + cache->entries_pos =0 ; + +return 0 ; +} +/* * Helper to submit fiemap extent. *
@@ -2437,8 +2512,8 @@ static int emit_fiemap_extent(struct fiemap_extent_info *fieinfo,struct fiemap_cache *cache, u64 offset, u64 phys, u64 len, u32 flags) { + struct btrfs_fiemap_entry *entry;u64 cache_end; -int ret =0 ;/* Set at the end of extent_fiemap(). */ ASSERT ((flags &FIEMAP_EXTENT_LAST ) ==0 );
@@ -2451,7 +2526,9 @@ static int emit_fiemap_extent(struct fiemap_extent_info *fieinfo,* find an extent that starts at an offset behind the end offset of the * previous extent we processed. This happens if fiemap is called * without FIEMAP_FLAG_SYNC and there are ordered extents completing -* while we call btrfs_next_leaf() (through fiemap_next_leaf_item()). +* after we had to unlock the file range, release the search path, emit +* the fiemap extents stored in the buffer (cache->entries array) and +* the lock the remainder of the range and re-search the btree. * * For example we are in leaf X processing its last item, which is the * file extent item for file range [512K, 1M[, and after
@@ -2564,11 +2641,35 @@ static int emit_fiemap_extent(struct fiemap_extent_info *fieinfo, emit:/* Not mergeable, need to submit cached one */ - ret =fiemap_fill_next_extent (fieinfo, cache->offset, cache->phys, - cache->len, cache->flags); - cache->cached = false; -if (ret) -return ret; + +if (cache->entries_pos == cache->entries_size) { +/* +* We will need to research for the end offset of the last +* stored extent and not from the current offset, because after +* unlocking the range and releasing the path, if there's a hole +* between that end offset and this current offset, a new extent +* may have been inserted due to a new write, so we don't want +* to miss it. +*/ + entry = &cache->entries[cache->entries_size -1 ]; + cache->next_search_offset = entry->offset + entry->len; + cache->cached = false; + +return BTRFS_FIEMAP_FLUSH_CACHE ; + } + + entry = &cache->entries[cache->entries_pos]; + entry->offset = cache->offset; + entry->phys = cache->phys; + entry->len = cache->len; + entry->flags = cache->flags; + cache->entries_pos++; + cache->extents_mapped++; + +if (cache->extents_mapped == fieinfo->fi_extents_max) { + cache->cached = false; +return 1 ; + } assign: cache->cached = true; cache->offset = offset;
@@ -2694,8 +2795,8 @@ static int fiemap_search_slot(struct btrfs_inode *inode, struct btrfs_path *path* neighbour leaf). * We also need the private clone because holding a read lock on an * extent buffer of the subvolume's b+tree will make lockdep unhappy -* when we call fiemap_fill_next_extent(), because that may cause a page -* fault when filling the user space buffer with fiemap data. +* when we check if extents are shared, as backref walking may need to +* lock the same leaf we are processing. */ clone =btrfs_clone_extent_buffer (path->nodes[0 ]);if (!clone)
@@ -2735,34 +2836,16 @@ static int fiemap_process_hole(struct btrfs_inode *inode,* it beyond i_size. */ while (cur_offset < end && cur_offset < i_size) { -struct extent_state *cached_state =NULL ;u64 delalloc_start;u64 delalloc_end;u64 prealloc_start; -u64 lockstart; -u64 lockend;u64 prealloc_len =0 ;bool delalloc; - lockstart =round_down (cur_offset, inode->root->fs_info->sectorsize); - lockend =round_up (end, inode->root->fs_info->sectorsize); - -/* -* We are only locking for the delalloc range because that's the -* only thing that can change here. With fiemap we have a lock -* on the inode, so no buffered or direct writes can happen. -* -* However mmaps and normal page writeback will cause this to -* change arbitrarily. We have to lock the extent lock here to -* make sure that nobody messes with the tree while we're doing -* btrfs_find_delalloc_in_range. -*/ -lock_extent (&inode->io_tree, lockstart, lockend, &cached_state); delalloc =btrfs_find_delalloc_in_range (inode, cur_offset, end, delalloc_cached_state, &delalloc_start, &delalloc_end); -unlock_extent (&inode->io_tree, lockstart, lockend, &cached_state);if (!delalloc)break ;
@@ -2930,6 +3013,7 @@ int extent_fiemap(struct btrfs_inode *inode, struct fiemap_extent_info *fieinfo, u64 start, u64 len) {const u64 ino =btrfs_ino (inode); +struct extent_state *cached_state =NULL ;struct extent_state *delalloc_cached_state =NULL ;struct btrfs_path *path;struct fiemap_cache cache = {0 };
@@ -2942,26 +3026,33 @@ int extent_fiemap(struct btrfs_inode *inode, struct fiemap_extent_info *fieinfo,bool stopped = false;int ret; + cache.entries_size =PAGE_SIZE /sizeof (struct btrfs_fiemap_entry ); + cache.entries =kmalloc_array (cache.entries_size, +sizeof (struct btrfs_fiemap_entry ), +GFP_KERNEL ); backref_ctx =btrfs_alloc_backref_share_check_ctx (); path =btrfs_alloc_path (); -if (!backref_ctx || !path) { +if (!cache.entries || !backref_ctx || !path) { ret = -ENOMEM ; goto out; } +restart: range_start =round_down (start, sectorsize); range_end =round_up (start + len, sectorsize); prev_extent_end = range_start; +lock_extent (&inode->io_tree, range_start, range_end, &cached_state); + ret =fiemap_find_last_extent_offset (inode, path, &last_extent_end);if (ret <0 ) - goto out; + goto out_unlock;btrfs_release_path (path); path->reada =READA_FORWARD ; ret =fiemap_search_slot (inode, path, range_start);if (ret <0 ) { - goto out; + goto out_unlock; }else if (ret >0 ) {/* * No file extent item found, but we may have delalloc between
@@ -3008,7 +3099,7 @@ int extent_fiemap(struct btrfs_inode *inode, struct fiemap_extent_info *fieinfo, backref_ctx,0 ,0 ,0 , prev_extent_end, hole_end);if (ret <0 ) { - goto out; + goto out_unlock; }else if (ret >0 ) {/* fiemap_fill_next_extent() told us to stop. */ stopped = true;
@@ -3064,7 +3155,7 @@ int extent_fiemap(struct btrfs_inode *inode, struct fiemap_extent_info *fieinfo, extent_gen, backref_ctx);if (ret <0 ) - goto out; + goto out_unlock;else if (ret >0 ) flags |=FIEMAP_EXTENT_SHARED ; }
@@ -3075,9 +3166,9 @@ int extent_fiemap(struct btrfs_inode *inode, struct fiemap_extent_info *fieinfo, }if (ret <0 ) { - goto out; + goto out_unlock; }else if (ret >0 ) { -/* fiemap_fill_next_extent() told us to stop. */ +/* emit_fiemap_extent() told us to stop. */ stopped = true;break ; }
@@ -3086,12 +3177,12 @@ int extent_fiemap(struct btrfs_inode *inode, struct fiemap_extent_info *fieinfo, next_item:if (fatal_signal_pending (current)) { ret = -EINTR ; - goto out; + goto out_unlock; } ret =fiemap_next_leaf_item (inode, path);if (ret <0 ) { - goto out; + goto out_unlock; }else if (ret >0 ) {/* No more file extent items for this inode. */ break ;
@@ -3100,22 +3191,12 @@ int extent_fiemap(struct btrfs_inode *inode, struct fiemap_extent_info *fieinfo, } check_eof_delalloc: -/* -* Release (and free) the path before emitting any final entries to -* fiemap_fill_next_extent() to keep lockdep happy. This is because -* once we find no more file extent items exist, we may have a -* non-cloned leaf, and fiemap_fill_next_extent() can trigger page -* faults when copying data to the user space buffer. -*/ -btrfs_free_path (path); - path =NULL ; -if (!stopped && prev_extent_end < range_end) { ret =fiemap_process_hole (inode, fieinfo, &cache, &delalloc_cached_state, backref_ctx,0 ,0 ,0 , prev_extent_end, range_end -1 );if (ret <0 ) - goto out; + goto out_unlock; prev_extent_end = range_end; }
@@ -3123,28 +3204,16 @@ int extent_fiemap(struct btrfs_inode *inode, struct fiemap_extent_info *fieinfo,const u64 i_size =i_size_read (&inode->vfs_inode);if (prev_extent_end < i_size) { -struct extent_state *cached_state =NULL ;u64 delalloc_start;u64 delalloc_end; -u64 lockstart; -u64 lockend;bool delalloc; - lockstart =round_down (prev_extent_end, sectorsize); - lockend =round_up (i_size, sectorsize); - -/* -* See the comment in fiemap_process_hole as to why -* we're doing the locking here. -*/ -lock_extent (&inode->io_tree, lockstart, lockend, &cached_state); delalloc =btrfs_find_delalloc_in_range (inode, prev_extent_end, i_size -1 , &delalloc_cached_state, &delalloc_start, &delalloc_end); -unlock_extent (&inode->io_tree, lockstart, lockend, &cached_state);if (!delalloc) cache.flags |=FIEMAP_EXTENT_LAST ; }else {
@@ -3152,9 +3221,39 @@ int extent_fiemap(struct btrfs_inode *inode, struct fiemap_extent_info *fieinfo, } } +out_unlock: +unlock_extent (&inode->io_tree, range_start, range_end, &cached_state); + +if (ret ==BTRFS_FIEMAP_FLUSH_CACHE ) { +btrfs_release_path (path); + ret =flush_fiemap_cache (fieinfo, &cache); +if (ret) + goto out; + len -= cache.next_search_offset - start; + start = cache.next_search_offset; + goto restart; + }else if (ret <0 ) { + goto out; + } + +/* +* Must free the path before emitting to the fiemap buffer because we +* may have a non-cloned leaf and if the fiemap buffer is memory mapped +* to a file, a write into it (through btrfs_page_mkwrite()) may trigger +* waiting for an ordered extent that in order to complete needs to +* modify that leaf, therefore leading to a deadlock. +*/ +btrfs_free_path (path); + path =NULL ; + + ret =flush_fiemap_cache (fieinfo, &cache); +if (ret) + goto out; + ret =emit_last_fiemap_cache (fieinfo, &cache); out:free_extent_state (delalloc_cached_state); +kfree (cache.entries);btrfs_free_backref_share_ctx (backref_ctx);btrfs_free_path (path);return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 56/252 x86/CPU/AMD: Add ZenX generations flags
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov (AMD) <[email protected]>
[ Upstream commit 30fa92832f405d5ac9f263e99f62445fa3084008 ]
Add X86_FEATURE flags for each Zen generation. They should be used from now on instead of checking f/m/s.
Stable-dep-of: c7b2edd8377b ("perf/x86/amd/core: Update and fix stalled-cycles-* events for Zen 2 and later")
--- arch/x86/include/asm/cpufeatures.h | 5 ++- arch/x86/kernel/cpu/amd.c | 70 +++++++++++++++++++++++++++++- 2 files changed, 72 insertions(+), 3 deletions(-)
arch/x86/include/asm/cpufeatures.h +4 -1
@@ -218,7 +218,7 @@#define X86_FEATURE_IBRS ( 7*32+25)/* Indirect Branch Restricted Speculation */ #define X86_FEATURE_IBPB ( 7*32+26)/* Indirect Branch Prediction Barrier */ #define X86_FEATURE_STIBP ( 7*32+27)/* Single Thread Indirect Branch Predictors */ -#define X86_FEATURE_ZEN (7*32+28)/* "" CPU based on Zen microarchitecture */ +#define X86_FEATURE_ZEN ( 7*32+28)/* "" CPU based on Zen microarchitecture */ #define X86_FEATURE_L1TF_PTEINV ( 7*32+29)/* "" L1TF workaround PTE inversion */ #define X86_FEATURE_IBRS_ENHANCED ( 7*32+30)/* Enhanced IBRS */ #define X86_FEATURE_MSR_IA32_FEAT_CTL ( 7*32+31)/* "" MSR IA32_FEAT_CTL configured */
@@ -312,6 +312,9 @@#define X86_FEATURE_SRSO_ALIAS (11*32+25)/* "" AMD BTB untrain RETs through aliasing */ #define X86_FEATURE_IBPB_ON_VMEXIT (11*32+26)/* "" Issue an IBPB only on VMEXIT */ #define X86_FEATURE_APIC_MSRS_FENCE (11*32+27)/* "" IA32_TSC_DEADLINE and X2APIC MSRs need fencing */ +#define X86_FEATURE_ZEN2 (11*32+28)/* "" CPU based on Zen2 microarchitecture */ +#define X86_FEATURE_ZEN3 (11*32+29)/* "" CPU based on Zen3 microarchitecture */ +#define X86_FEATURE_ZEN4 (11*32+30)/* "" CPU based on Zen4 microarchitecture */ /* Intel-defined CPU features, CPUID level 0x00000007:1 (EAX), word 12 */ #define X86_FEATURE_AVX_VNNI (12*32+ 4)/* AVX VNNI instructions */
arch/x86/kernel/cpu/amd.c +68 -2
94 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 57/252 x86/CPU/AMD: Carve out the erratum 1386 fix
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov (AMD) <[email protected]>
[ Upstream commit a7c32a1ae9ee43abfe884f5af376877c4301d166 ]
Call it on the affected CPU generations.
No functional changes.
Stable-dep-of: c7b2edd8377b ("perf/x86/amd/core: Update and fix stalled-cycles-* events for Zen 2 and later")
--- arch/x86/kernel/cpu/amd.c | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-)
arch/x86/kernel/cpu/amd.c +15 -9
@@ -988,6 +988,19 @@ static void init_amd_bd(struct cpuinfo_x86 *c)clear_rdrand_cpuid_bit (c); } +static void fix_erratum_1386 (struct cpuinfo_x86 *c) +{ +/* +* Work around Erratum 1386. The XSAVES instruction malfunctions in +* certain circumstances on Zen1/2 uarch, and not all parts have had +* updated microcode at the time of writing (March 2023). +* +* Affected parts all have no supervisor XSAVE states, meaning that +* the XSAVEC instruction (which works fine) is equivalent. +*/ +clear_cpu_cap (c,X86_FEATURE_XSAVES ); +} +void init_spectral_chicken (struct cpuinfo_x86 *c) {#ifdef CONFIG_CPU_UNRET_ENTRY
@@ -1008,15 +1021,6 @@ void init_spectral_chicken(struct cpuinfo_x86 *c) } }#endif -/* -* Work around Erratum 1386. The XSAVES instruction malfunctions in -* certain circumstances on Zen1/2 uarch, and not all parts have had -* updated microcode at the time of writing (March 2023). -* -* Affected parts all have no supervisor XSAVE states, meaning that -* the XSAVEC instruction (which works fine) is equivalent. -*/ -clear_cpu_cap (c,X86_FEATURE_XSAVES ); }static void init_amd_zn (struct cpuinfo_x86 *c)
@@ -1085,10 +1089,12 @@ static void zenbleed_check(struct cpuinfo_x86 *c)static void init_amd_zen (struct cpuinfo_x86 *c) { +fix_erratum_1386 (c); }static void init_amd_zen2 (struct cpuinfo_x86 *c) { +fix_erratum_1386 (c); }static void init_amd_zen3 (struct cpuinfo_x86 *c)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 58/252 x86/CPU/AMD: Move erratum 1076 fix into the Zen1 init function
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov (AMD) <[email protected]>
[ Upstream commit 0da91912fc150d6d321b15e648bead202ced1a27 ]
No functional changes.
Stable-dep-of: c7b2edd8377b ("perf/x86/amd/core: Update and fix stalled-cycles-* events for Zen 2 and later")
--- arch/x86/kernel/cpu/amd.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
arch/x86/kernel/cpu/amd.c +5 -5
@@ -1028,6 +1028,11 @@ static void init_amd_zn(struct cpuinfo_x86 *c)#ifdef CONFIG_NUMA node_reclaim_distance =32 ;#endif +} + +static void init_amd_zen (struct cpuinfo_x86 *c) +{ +fix_erratum_1386 (c);/* Fix up CPUID bits, but only if not virtualised. */ if (!cpu_has (c,X86_FEATURE_HYPERVISOR )) {
@@ -1087,11 +1092,6 @@ static void zenbleed_check(struct cpuinfo_x86 *c) } } -static void init_amd_zen (struct cpuinfo_x86 *c) -{ -fix_erratum_1386 (c); -} -static void init_amd_zen2 (struct cpuinfo_x86 *c) {fix_erratum_1386 (c);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 59/252 x86/CPU/AMD: Move Zenbleed check to the Zen2 init function
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov (AMD) <[email protected]>
[ Upstream commit f69759be251dce722942594fbc62e53a40822a82 ]
Prefix it properly so that it is clear which generation it is dealing with.
No functional changes.
Stable-dep-of: c7b2edd8377b ("perf/x86/amd/core: Update and fix stalled-cycles-* events for Zen 2 and later")
--- arch/x86/kernel/cpu/amd.c | 16 +++------------- 1 file changed, 3 insertions(+), 13 deletions(-)
arch/x86/kernel/cpu/amd.c +3 -13
@@ -70,12 +70,6 @@ static const int amd_erratum_383[] =static const int amd_erratum_1054[] =AMD_LEGACY_ERRATUM (AMD_MODEL_RANGE (0x17 ,0 ,0 ,0x2f ,0xf )); -static const int amd_zenbleed[] = -AMD_LEGACY_ERRATUM (AMD_MODEL_RANGE (0x17 ,0x30 ,0x0 ,0x4f ,0xf ), -AMD_MODEL_RANGE (0x17 ,0x60 ,0x0 ,0x7f ,0xf ), -AMD_MODEL_RANGE (0x17 ,0x90 ,0x0 ,0x91 ,0xf ), -AMD_MODEL_RANGE (0x17 ,0xa0 ,0x0 ,0xaf ,0xf )); -static const int amd_div0[] =AMD_LEGACY_ERRATUM (AMD_MODEL_RANGE (0x17 ,0x00 ,0x0 ,0x2f ,0xf ),AMD_MODEL_RANGE (0x17 ,0x50 ,0x0 ,0x5f ,0xf ));
@@ -1073,11 +1067,8 @@ static bool cpu_has_zenbleed_microcode(void)return true; } -static void zenbleed_check (struct cpuinfo_x86 *c) +static void zen2_zenbleed_check (struct cpuinfo_x86 *c) { -if (!cpu_has_amd_erratum (c, amd_zenbleed)) -return ; -if (cpu_has (c,X86_FEATURE_HYPERVISOR ))return ;
@@ -1095,6 +1086,7 @@ static void zenbleed_check(struct cpuinfo_x86 *c)static void init_amd_zen2 (struct cpuinfo_x86 *c) {fix_erratum_1386 (c); +zen2_zenbleed_check (c); }static void init_amd_zen3 (struct cpuinfo_x86 *c)
@@ -1219,8 +1211,6 @@ static void init_amd(struct cpuinfo_x86 *c) cpu_has(c, X86_FEATURE_AUTOIBRS))WARN_ON_ONCE (msr_set_bit (MSR_EFER , _EFER_AUTOIBRS)); -zenbleed_check (c); -if (cpu_has_amd_erratum (c, amd_div0)) {pr_notice_once ("AMD Zen1 DIV0 bug detected. Disable SMT for full protection.\n" );setup_force_cpu_bug (X86_BUG_DIV0 );
@@ -1385,7 +1375,7 @@ static void zenbleed_check_cpu(void *unused) {struct cpuinfo_x86 *c = &cpu_data (smp_processor_id ()); -zenbleed_check (c); +zen2_zenbleed_check (c); }void amd_check_microcode (void )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 60/252 x86/CPU/AMD: Move the DIV0 bug detection to the Zen1 init function
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov (AMD) <[email protected]>
[ Upstream commit bfff3c6692ce64fa9d86eb829d18229c307a0855 ]
No functional changes.
Stable-dep-of: c7b2edd8377b ("perf/x86/amd/core: Update and fix stalled-cycles-* events for Zen 2 and later")
--- arch/x86/kernel/cpu/amd.c | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-)
arch/x86/kernel/cpu/amd.c +3 -9
@@ -70,10 +70,6 @@ static const int amd_erratum_383[] =static const int amd_erratum_1054[] =AMD_LEGACY_ERRATUM (AMD_MODEL_RANGE (0x17 ,0 ,0 ,0x2f ,0xf )); -static const int amd_div0[] = -AMD_LEGACY_ERRATUM (AMD_MODEL_RANGE (0x17 ,0x00 ,0x0 ,0x2f ,0xf ), -AMD_MODEL_RANGE (0x17 ,0x50 ,0x0 ,0x5f ,0xf )); -static const int amd_erratum_1485[] =AMD_LEGACY_ERRATUM (AMD_MODEL_RANGE (0x19 ,0x10 ,0x0 ,0x1f ,0xf ),AMD_MODEL_RANGE (0x19 ,0x60 ,0x0 ,0xaf ,0xf ));
@@ -1043,6 +1039,9 @@ static void init_amd_zen(struct cpuinfo_x86 *c)if (c->x86 ==0x19 && !cpu_has (c,X86_FEATURE_BTC_NO ))set_cpu_cap (c,X86_FEATURE_BTC_NO ); } + +pr_notice_once ("AMD Zen1 DIV0 bug detected. Disable SMT for full protection.\n" ); +setup_force_cpu_bug (X86_BUG_DIV0 ); }static bool cpu_has_zenbleed_microcode (void )
@@ -1211,11 +1210,6 @@ static void init_amd(struct cpuinfo_x86 *c) cpu_has(c, X86_FEATURE_AUTOIBRS))WARN_ON_ONCE (msr_set_bit (MSR_EFER , _EFER_AUTOIBRS)); -if (cpu_has_amd_erratum (c, amd_div0)) { -pr_notice_once ("AMD Zen1 DIV0 bug detected. Disable SMT for full protection.\n" ); -setup_force_cpu_bug (X86_BUG_DIV0 ); - } -if (!cpu_has (c,X86_FEATURE_HYPERVISOR ) &&cpu_has_amd_erratum (c, amd_erratum_1485))msr_set_bit (MSR_ZEN4_BP_CFG ,MSR_ZEN4_BP_CFG_SHARED_BTB_FIX_BIT );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 61/252 x86/CPU/AMD: Get rid of amd_erratum_1054[]
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov (AMD) <[email protected]>
[ Upstream commit 54c33e23f75d5c9925495231c57d3319336722ef ]
No functional changes.
Stable-dep-of: c7b2edd8377b ("perf/x86/amd/core: Update and fix stalled-cycles-* events for Zen 2 and later")
--- arch/x86/kernel/cpu/amd.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
arch/x86/kernel/cpu/amd.c +1 -5
@@ -66,10 +66,6 @@ static const int amd_erratum_400[] =static const int amd_erratum_383[] =AMD_OSVW_ERRATUM (3 ,AMD_MODEL_RANGE (0x10 ,0 ,0 ,0xff ,0xf )); -/* #1054: Instructions Retired Performance Counter May Be Inaccurate */ -static const int amd_erratum_1054[] = -AMD_LEGACY_ERRATUM (AMD_MODEL_RANGE (0x17 ,0 ,0 ,0x2f ,0xf )); -static const int amd_erratum_1485[] =AMD_LEGACY_ERRATUM (AMD_MODEL_RANGE (0x19 ,0x10 ,0x0 ,0x1f ,0xf ),AMD_MODEL_RANGE (0x19 ,0x60 ,0x0 ,0xaf ,0xf ));
@@ -1194,7 +1190,7 @@ static void init_amd(struct cpuinfo_x86 *c)* Counter May Be Inaccurate". */ if (cpu_has (c,X86_FEATURE_IRPERF ) && - !cpu_has_amd_erratum (c, amd_erratum_1054)) + (boot_cpu_has (X86_FEATURE_ZEN ) && c->x86_model >0x2f ))msr_set_bit (MSR_K7_HWCR ,MSR_K7_HWCR_IRPERF_EN_BIT );check_null_seg_clears_base (c);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 62/252 x86/CPU/AMD: Add X86_FEATURE_ZEN1
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov (AMD) <[email protected]>
[ Upstream commit 232afb557835d6f6859c73bf610bad308c96b131 ]
Add a synthetic feature flag specifically for first generation Zen machines. There's need to have a generic flag for all Zen generations so make X86_FEATURE_ZEN be that flag.
Stable-dep-of: c7b2edd8377b ("perf/x86/amd/core: Update and fix stalled-cycles-* events for Zen 2 and later")
--- arch/x86/include/asm/cpufeatures.h | 3 ++- arch/x86/kernel/cpu/amd.c | 11 ++++++----- tools/arch/x86/include/asm/cpufeatures.h | 2 +- 3 files changed, 9 insertions(+), 7 deletions(-)
arch/x86/include/asm/cpufeatures.h +2 -1
@@ -218,7 +218,7 @@#define X86_FEATURE_IBRS ( 7*32+25)/* Indirect Branch Restricted Speculation */ #define X86_FEATURE_IBPB ( 7*32+26)/* Indirect Branch Prediction Barrier */ #define X86_FEATURE_STIBP ( 7*32+27)/* Single Thread Indirect Branch Predictors */ -#define X86_FEATURE_ZEN ( 7*32+28)/* "" CPU based on Zen microarchitecture */ +#define X86_FEATURE_ZEN ( 7*32+28)/* "" Generic flag for all Zen and newer */ #define X86_FEATURE_L1TF_PTEINV ( 7*32+29)/* "" L1TF workaround PTE inversion */ #define X86_FEATURE_IBRS_ENHANCED ( 7*32+30)/* Enhanced IBRS */ #define X86_FEATURE_MSR_IA32_FEAT_CTL ( 7*32+31)/* "" MSR IA32_FEAT_CTL configured */
@@ -315,6 +315,7 @@#define X86_FEATURE_ZEN2 (11*32+28)/* "" CPU based on Zen2 microarchitecture */ #define X86_FEATURE_ZEN3 (11*32+29)/* "" CPU based on Zen3 microarchitecture */ #define X86_FEATURE_ZEN4 (11*32+30)/* "" CPU based on Zen4 microarchitecture */ +#define X86_FEATURE_ZEN1 (11*32+31)/* "" CPU based on Zen1 microarchitecture */ /* Intel-defined CPU features, CPUID level 0x00000007:1 (EAX), word 12 */ #define X86_FEATURE_AVX_VNNI (12*32+ 4)/* AVX VNNI instructions */
arch/x86/kernel/cpu/amd.c +6 -5
@@ -613,7 +613,7 @@ static void bsp_init_amd(struct cpuinfo_x86 *c)switch (c->x86_model) { case 0x00 ... 0x2f: case 0x50 ... 0x5f: -setup_force_cpu_cap (X86_FEATURE_ZEN ); +setup_force_cpu_cap (X86_FEATURE_ZEN1 );break ; case 0x30 ... 0x4f: case 0x60 ... 0x7f:
@@ -1011,12 +1011,13 @@ void init_spectral_chicken(struct cpuinfo_x86 *c)static void init_amd_zn (struct cpuinfo_x86 *c) { +setup_force_cpu_cap (X86_FEATURE_ZEN );#ifdef CONFIG_NUMA node_reclaim_distance =32 ;#endif } -static void init_amd_zen (struct cpuinfo_x86 *c) +static void init_amd_zen1 (struct cpuinfo_x86 *c) {fix_erratum_1386 (c);
@@ -1130,8 +1131,8 @@ static void init_amd(struct cpuinfo_x86 *c)case 0x19 :init_amd_zn (c);break ; } -if (boot_cpu_has (X86_FEATURE_ZEN )) -init_amd_zen (c); +if (boot_cpu_has (X86_FEATURE_ZEN1 )) +init_amd_zen1 (c);else if (boot_cpu_has (X86_FEATURE_ZEN2 ))init_amd_zen2 (c);else if (boot_cpu_has (X86_FEATURE_ZEN3 ))
@@ -1190,7 +1191,7 @@ static void init_amd(struct cpuinfo_x86 *c)* Counter May Be Inaccurate". */ if (cpu_has (c,X86_FEATURE_IRPERF ) && - (boot_cpu_has (X86_FEATURE_ZEN ) && c->x86_model >0x2f )) + (boot_cpu_has (X86_FEATURE_ZEN1 ) && c->x86_model >0x2f ))msr_set_bit (MSR_K7_HWCR ,MSR_K7_HWCR_IRPERF_EN_BIT );check_null_seg_clears_base (c);
tools/arch/x86/include/asm/cpufeatures.h +1 -1
@@ -219,7 +219,7 @@#define X86_FEATURE_IBRS ( 7*32+25)/* Indirect Branch Restricted Speculation */ #define X86_FEATURE_IBPB ( 7*32+26)/* Indirect Branch Prediction Barrier */ #define X86_FEATURE_STIBP ( 7*32+27)/* Single Thread Indirect Branch Predictors */ -#define X86_FEATURE_ZEN (7*32+28)/* "" CPU based on Zen microarchitecture */ +#define X86_FEATURE_ZEN ( 7*32+28)/* "" Generic flag for all Zen and newer */ #define X86_FEATURE_L1TF_PTEINV ( 7*32+29)/* "" L1TF workaround PTE inversion */ #define X86_FEATURE_IBRS_ENHANCED ( 7*32+30)/* Enhanced IBRS */ #define X86_FEATURE_MSR_IA32_FEAT_CTL ( 7*32+31)/* "" MSR IA32_FEAT_CTL configured */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 63/252 perf/x86/amd/core: Update and fix stalled-cycles-* events for Zen 2 and later
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sandipan Das <[email protected]>
[ Upstream commit c7b2edd8377be983442c1344cb940cd2ac21b601 ]
AMD processors based on Zen 2 and later microarchitectures do not support PMCx087 (instruction pipe stalls) which is used as the backing event for "stalled-cycles-frontend" and "stalled-cycles-backend".
Use PMCx0A9 (cycles where micro-op queue is empty) instead to count frontend stalls and remove the entry for backend stalls since there is no direct replacement.
--- arch/x86/events/amd/core.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-)
arch/x86/events/amd/core.c +17 -3
@@ -250,7 +250,7 @@ static const u64 amd_perfmon_event_map[PERF_COUNT_HW_MAX] =/* * AMD Performance Monitor Family 17h and later: */ -static const u64 amd_f17h_perfmon_event_map[PERF_COUNT_HW_MAX ] = +static const u64 amd_zen1_perfmon_event_map[PERF_COUNT_HW_MAX ] = { [PERF_COUNT_HW_CPU_CYCLES ] =0x0076 , [PERF_COUNT_HW_INSTRUCTIONS ] =0x00c0 ,
@@ -262,10 +262,24 @@ static const u64 amd_f17h_perfmon_event_map[PERF_COUNT_HW_MAX] = [PERF_COUNT_HW_STALLED_CYCLES_BACKEND] = 0x0187, }; +static const u64 amd_zen2_perfmon_event_map[PERF_COUNT_HW_MAX ] = +{ + [PERF_COUNT_HW_CPU_CYCLES ] =0x0076 , + [PERF_COUNT_HW_INSTRUCTIONS ] =0x00c0 , + [PERF_COUNT_HW_CACHE_REFERENCES ] =0xff60 , + [PERF_COUNT_HW_CACHE_MISSES ] =0x0964 , + [PERF_COUNT_HW_BRANCH_INSTRUCTIONS ] =0x00c2 , + [PERF_COUNT_HW_BRANCH_MISSES ] =0x00c3 , + [PERF_COUNT_HW_STALLED_CYCLES_FRONTEND ] =0x00a9 , +}; +static u64 amd_pmu_event_map (int hw_event) { -if (boot_cpu_data.x86 >=0x17 ) -return amd_f17h_perfmon_event_map[hw_event]; +if (cpu_feature_enabled (X86_FEATURE_ZEN2 ) || boot_cpu_data.x86 >=0x19 ) +return amd_zen2_perfmon_event_map[hw_event]; + +if (cpu_feature_enabled (X86_FEATURE_ZEN1 )) +return amd_zen1_perfmon_event_map[hw_event];return amd_perfmon_event_map[hw_event]; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 64/252 x86/cpufeatures: Add new word for scattered features
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sandipan Das <[email protected]>
[ Upstream commit 7f274e609f3d5f45c22b1dd59053f6764458b492 ]
Add a new word for scattered features because all free bits among the existing Linux-defined auxiliary flags have been exhausted.
Stable-dep-of: 598c2fafc06f ("perf/x86/amd/lbr: Use freeze based on availability")
--- arch/x86/include/asm/cpufeature.h | 6 ++++-- arch/x86/include/asm/cpufeatures.h | 2 +- arch/x86/include/asm/disabled-features.h | 3 ++- arch/x86/include/asm/required-features.h | 3 ++- 4 files changed, 9 insertions(+), 5 deletions(-)
arch/x86/include/asm/cpufeature.h +4 -2
@@ -91,8 +91,9 @@ extern const char * const x86_bug_flags[NBUGINTS*32]; CHECK_BIT_IN_MASK_WORD(REQUIRED_MASK, 18, feature_bit) || \ CHECK_BIT_IN_MASK_WORD(REQUIRED_MASK, 19, feature_bit) || \ CHECK_BIT_IN_MASK_WORD(REQUIRED_MASK, 20, feature_bit) || \ + CHECK_BIT_IN_MASK_WORD(REQUIRED_MASK, 21, feature_bit) || \ REQUIRED_MASK_CHECK || \ - BUILD_BUG_ON_ZERO(NCAPINTS != 21)) + BUILD_BUG_ON_ZERO(NCAPINTS != 22))#define DISABLED_MASK_BIT_SET (feature_bit) \ ( CHECK_BIT_IN_MASK_WORD(DISABLED_MASK, 0, feature_bit) || \
@@ -116,8 +117,9 @@ extern const char * const x86_bug_flags[NBUGINTS*32]; CHECK_BIT_IN_MASK_WORD(DISABLED_MASK, 18, feature_bit) || \ CHECK_BIT_IN_MASK_WORD(DISABLED_MASK, 19, feature_bit) || \ CHECK_BIT_IN_MASK_WORD(DISABLED_MASK, 20, feature_bit) || \ + CHECK_BIT_IN_MASK_WORD(DISABLED_MASK, 21, feature_bit) || \ DISABLED_MASK_CHECK || \ - BUILD_BUG_ON_ZERO(NCAPINTS != 21)) + BUILD_BUG_ON_ZERO(NCAPINTS != 22))#define cpu_has (c, bit) \ (__builtin_constant_p(bit) && REQUIRED_MASK_BIT_SET(bit) ? 1 : \
arch/x86/include/asm/cpufeatures.h +1 -1
@@ -13,7 +13,7 @@/* * Defines x86 CPU feature bits */ -#define NCAPINTS 21/* N 32-bit words worth of info */ +#define NCAPINTS 22/* N 32-bit words worth of info */ #define NBUGINTS 2/* N 32-bit bug flags */ /*
arch/x86/include/asm/disabled-features.h +2 -1
@@ -143,6 +143,7 @@#define DISABLED_MASK18 (DISABLE_IBT)#define DISABLED_MASK19 0#define DISABLED_MASK20 0 -#define DISABLED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 21) +#define DISABLED_MASK21 0 +#define DISABLED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 22)#endif /* _ASM_X86_DISABLED_FEATURES_H */
arch/x86/include/asm/required-features.h +2 -1
@@ -99,6 +99,7 @@#define REQUIRED_MASK18 0#define REQUIRED_MASK19 0#define REQUIRED_MASK20 0 -#define REQUIRED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 21) +#define REQUIRED_MASK21 0 +#define REQUIRED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 22)#endif /* _ASM_X86_REQUIRED_FEATURES_H */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 65/252 perf/x86/amd/lbr: Use freeze based on availability
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sandipan Das <[email protected]>
[ Upstream commit 598c2fafc06fe5c56a1a415fb7b544b31453d637 ]
Currently, the LBR code assumes that LBR Freeze is supported on all processors when X86_FEATURE_AMD_LBR_V2 is available i.e. CPUID leaf 0x80000022[EAX] bit 1 is set. This is incorrect as the availability of the feature is additionally dependent on CPUID leaf 0x80000022[EAX] bit 2 being set, which may not be set for all Zen 4 processors.
Define a new feature bit for LBR and PMC freeze and set the freeze enable bit (FLBRI) in DebugCtl (MSR 0x1d9) conditionally.
It should still be possible to use LBR without freeze for profile-guided optimization of user programs by using an user-only branch filter during profiling. When the user-only filter is enabled, branches are no longer recorded after the transition to CPL 0 upon PMI arrival. When branch entries are read in the PMI handler, the branch stack does not change.
E.g.
$ perf record -j any,u -e ex_ret_brn_tkn ./workload
Since the feature bit is visible under flags in /proc/cpuinfo, it can be used to determine the feasibility of use-cases which require LBR Freeze to be supported by the hardware such as profile-guided optimization of kernels.
--- arch/x86/events/amd/core.c | 4 ++-- arch/x86/events/amd/lbr.c | 16 ++++++++++------ arch/x86/include/asm/cpufeatures.h | 8 ++++++++ arch/x86/kernel/cpu/scattered.c | 1 + 4 files changed, 21 insertions(+), 8 deletions(-)
arch/x86/events/amd/core.c +2 -2
@@ -918,8 +918,8 @@ static int amd_pmu_v2_handle_irq(struct pt_regs *regs)if (!status) goto done; -/* Read branch records before unfreezing */ -if (status &GLOBAL_STATUS_LBRS_FROZEN ) { +/* Read branch records */ +if (x86_pmu.lbr_nr) {amd_pmu_lbr_read (); status &= ~GLOBAL_STATUS_LBRS_FROZEN ; }
arch/x86/events/amd/lbr.c +10 -6
@@ -400,10 +400,12 @@ void amd_pmu_lbr_enable_all(void)wrmsrl (MSR_AMD64_LBR_SELECT , lbr_select); } -rdmsrl (MSR_IA32_DEBUGCTLMSR , dbg_ctl); -rdmsrl (MSR_AMD_DBG_EXTN_CFG , dbg_extn_cfg); +if (cpu_feature_enabled (X86_FEATURE_AMD_LBR_PMC_FREEZE )) { +rdmsrl (MSR_IA32_DEBUGCTLMSR , dbg_ctl); +wrmsrl (MSR_IA32_DEBUGCTLMSR , dbg_ctl |DEBUGCTLMSR_FREEZE_LBRS_ON_PMI ); + } -wrmsrl (MSR_IA32_DEBUGCTLMSR , dbg_ctl |DEBUGCTLMSR_FREEZE_LBRS_ON_PMI ); +rdmsrl (MSR_AMD_DBG_EXTN_CFG , dbg_extn_cfg);wrmsrl (MSR_AMD_DBG_EXTN_CFG , dbg_extn_cfg |DBG_EXTN_CFG_LBRV2EN ); }
@@ -416,10 +418,12 @@ void amd_pmu_lbr_disable_all(void)return ;rdmsrl (MSR_AMD_DBG_EXTN_CFG , dbg_extn_cfg); -rdmsrl (MSR_IA32_DEBUGCTLMSR , dbg_ctl); -wrmsrl (MSR_AMD_DBG_EXTN_CFG , dbg_extn_cfg & ~DBG_EXTN_CFG_LBRV2EN ); -wrmsrl (MSR_IA32_DEBUGCTLMSR , dbg_ctl & ~DEBUGCTLMSR_FREEZE_LBRS_ON_PMI ); + +if (cpu_feature_enabled (X86_FEATURE_AMD_LBR_PMC_FREEZE )) { +rdmsrl (MSR_IA32_DEBUGCTLMSR , dbg_ctl); +wrmsrl (MSR_IA32_DEBUGCTLMSR , dbg_ctl & ~DEBUGCTLMSR_FREEZE_LBRS_ON_PMI ); + } }__init int amd_pmu_lbr_init (void )
arch/x86/include/asm/cpufeatures.h +8 -0
@@ -456,6 +456,14 @@#define X86_FEATURE_IBPB_BRTYPE (20*32+28)/* "" MSR_PRED_CMD[IBPB] flushes all branch type predictions */ #define X86_FEATURE_SRSO_NO (20*32+29)/* "" CPU is not affected by SRSO */ +/* +* Extended auxiliary flags: Linux defined - for features scattered in various +* CPUID levels like 0x80000022, etc. +* +* Reuse free bits when adding new feature flags! +*/ +#define X86_FEATURE_AMD_LBR_PMC_FREEZE (21*32+ 0)/* AMD LBR and PMC Freeze */ +/* * BUG word(s) */
arch/x86/kernel/cpu/scattered.c +1 -0
@@ -49,6 +49,7 @@ static const struct cpuid_bit cpuid_bits[] = { { X86_FEATURE_BMEC, CPUID_EBX, 3, 0x80000020, 0 }, { X86_FEATURE_PERFMON_V2, CPUID_EAX, 0, 0x80000022, 0 }, { X86_FEATURE_AMD_LBR_V2, CPUID_EAX, 1, 0x80000022, 0 }, + { X86_FEATURE_AMD_LBR_PMC_FREEZE, CPUID_EAX, 2, 0x80000022, 0 }, { 0, 0, 0, 0, 0 } };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 66/252 modpost: Optimize symbol search from linear to binary search
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jack Brennen <[email protected]>
[ Upstream commit 4074532758c5c367d3fcb8d124150824a254659d ]
Modify modpost to use binary search for converting addresses back into symbol references. Previously it used linear search.
This change saves a few seconds of wall time for defconfig builds, but can save several minutes on allyesconfigs.
Before:
$ make LLVM=1 -j128 allyesconfig vmlinux -s KCFLAGS="-Wno-error" $ time scripts/mod/modpost -M -m -a -N -o vmlinux.symvers vmlinux.o 198.38user 1.27system 3:19.71elapsed
After:
$ make LLVM=1 -j128 allyesconfig vmlinux -s KCFLAGS="-Wno-error" $ time scripts/mod/modpost -M -m -a -N -o vmlinux.symvers vmlinux.o 11.91user 0.85system 0:12.78elapsed
Stable-dep-of: 1102f9f85bf6 ("modpost: do not make find_tosym() return NULL")
--- scripts/mod/Makefile | 4 +- scripts/mod/modpost.c | 70 ++------------ scripts/mod/modpost.h | 25 +++++ scripts/mod/symsearch.c | 199 ++++++++++++++++++++++++++++++++++++++++ 4 files changed, 232 insertions(+), 66 deletions(-) create mode 100644 scripts/mod/symsearch.c
scripts/mod/Makefile +2 -2
@@ -5,7 +5,7 @@ CFLAGS_REMOVE_empty.o += $(CC_FLAGS_LTO) hostprogs-always-y += modpost mk_elfconfig always-y += empty.o -modpost-objs := modpost.o file2alias.o sumversion.o +modpost-objs := modpost.o file2alias.o sumversion.o symsearch.o devicetable-offsets-file := devicetable-offsets.h
@@ -16,7 +16,7 @@ targets += $(devicetable-offsets-file) devicetable-offsets.s # dependencies on generated files need to be listed explicitly -$(obj)/modpost.o $(obj)/file2alias.o $(obj)/sumversion.o: $(obj)/elfconfig.h +$(obj)/modpost.o $(obj)/file2alias.o $(obj)/sumversion.o $(obj)/symsearch.o: $(obj)/elfconfig.h $(obj)/file2alias.o: $(obj)/$(devicetable-offsets-file) quiet_cmd_elfconfig = MKELF $@
scripts/mod/modpost.c +6 -64
102 lines not on this page · raw message
scripts/mod/modpost.h +25 -0
@@ -10,6 +10,7 @@#include <fcntl.h> #include <unistd.h> #include <elf.h> +#include "../../include/linux/module_symbol.h" #include "list.h" #include "elfconfig.h"
@@ -128,6 +129,8 @@ struct elf_info {* take shndx from symtab_shndx_start[N] instead */ Elf32_Word *symtab_shndx_start;Elf32_Word *symtab_shndx_stop; + +struct symsearch *symsearch; };/* Accessor for sym->st_shndx, hides ugliness of "64k sections" */
@@ -154,6 +157,28 @@ static inline unsigned int get_secindex(const struct elf_info *info,return index; } +/* +* If there's no name there, ignore it; likewise, ignore it if it's +* one of the magic symbols emitted used by current tools. +* +* Internal symbols created by tools should be ignored by modpost. +*/ +static inline int is_valid_name (struct elf_info *elf,Elf_Sym *sym) +{ +const char *name = elf->strtab + sym->st_name; + +if (!name || !strlen (name)) +return 0 ; +return !is_mapping_symbol (name); +} + +/* symsearch.c */ +void symsearch_init (struct elf_info *elf); +void symsearch_finish (struct elf_info *elf); +Elf_Sym *symsearch_find_nearest (struct elf_info *elf,Elf_Addr addr, +unsigned int secndx,bool allow_negative, +Elf_Addr min_distance); +/* file2alias.c */ void handle_moddevtable (struct module *mod,struct elf_info *info,Elf_Sym *sym,const char *symname);
scripts/mod/symsearch.c new file +199 -0
199 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 67/252 modpost: do not make find_tosym() return NULL
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masahiro Yamada <[email protected]>
[ Upstream commit 1102f9f85bf66b1a7bd6a40afb40efbbe05dfc05 ]
As mentioned in commit 397586506c3d ("modpost: Add '.ltext' and '.ltext.*' to TEXT_SECTIONS"), modpost can result in a segmentation fault due to a NULL pointer dereference in default_mismatch_handler().
find_tosym() can return the original symbol pointer instead of NULL if a better one is not found.
This fixes the reported segmentation fault.
--- scripts/mod/modpost.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
scripts/mod/modpost.c +5 -2
@@ -1052,6 +1052,8 @@ static Elf_Sym *find_fromsym(struct elf_info *elf, Elf_Addr addr,static Elf_Sym *find_tosym (struct elf_info *elf,Elf_Addr addr,Elf_Sym *sym) { +Elf_Sym *new_sym; +/* If the supplied symbol has a valid name, return it */ if (is_valid_name (elf, sym))return sym;
@@ -1060,8 +1062,9 @@ static Elf_Sym *find_tosym(struct elf_info *elf, Elf_Addr addr, Elf_Sym *sym)* Strive to find a better symbol name, but the resulting name may not * match the symbol referenced in the original code. */ -return symsearch_find_nearest (elf, addr,get_secindex (elf, sym), - true,20 ); + new_sym =symsearch_find_nearest (elf, addr,get_secindex (elf, sym), + true,20 ); +return new_sym ? new_sym : sym; }static bool is_executable_section (struct elf_info *elf,unsigned int secndx)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 68/252 gpio: cdev: sanitize the label before requesting the interrupt
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <[email protected]>
commit b34490879baa847d16fc529c8ea6e6d34f004b38 upstream.
When an interrupt is requested, a procfs directory is created under "/proc/irq/<irqnum>/<label>" where <label> is the string passed to one of the request_irq() variants.
What follows is that the string must not contain the "/" character or the procfs mkdir operation will fail. We don't have such constraints for GPIO consumer labels which are used verbatim as interrupt labels for GPIO irqs. We must therefore sanitize the consumer string before requesting the interrupt.
Let's replace all "/" with ":".
--- drivers/gpio/gpiolib-cdev.c | 38 ++++++++++++++++++++++++++++++++------ 1 file changed, 32 insertions(+), 6 deletions(-)
drivers/gpio/gpiolib-cdev.c +32 -6
@@ -1010,10 +1010,20 @@ static u32 gpio_v2_line_config_debounce_return 0 ; } +static inline char *make_irq_label (const char *orig) +{ +return kstrdup_and_replace (orig,'/' ,':' ,GFP_KERNEL ); +} + +static inline void free_irq_label (const char *label) +{ +kfree (label); +} +static void edge_detector_stop (struct line *line) {if (line->irq) { -free_irq (line->irq, line); +free_irq_label (free_irq (line->irq, line)); line->irq =0 ; }
@@ -1038,6 +1048,7 @@ static int edge_detector_setup(struct liunsigned long irqflags =0 ;u64 eflags;int irq, ret; +char *label; eflags = edflags &GPIO_V2_LINE_EDGE_FLAGS ;if (eflags && !kfifo_initialized (&line->req->events)) {
@@ -1074,11 +1085,17 @@ static int edge_detector_setup(struct li IRQF_TRIGGER_RISING :IRQF_TRIGGER_FALLING ; irqflags |=IRQF_ONESHOT ; + label =make_irq_label (line->req->label); +if (!label) +return -ENOMEM ; +/* Request a thread to read the events */ ret =request_threaded_irq (irq, edge_irq_handler, edge_irq_thread, - irqflags, line->req->label, line); -if (ret) + irqflags, label, line); +if (ret) { +free_irq_label (label);return ret; + } line->irq = irq;return 0 ;
@@ -1943,7 +1960,7 @@ static void lineevent_free(struct lineevblocking_notifier_chain_unregister (&le->gdev->device_notifier, &le->device_unregistered_nb);if (le->irq) -free_irq (le->irq, le); +free_irq_label (free_irq (le->irq, le));if (le->desc)gpiod_free (le->desc);kfree (le->label);
@@ -2091,6 +2108,7 @@ static int lineevent_create(struct gpio_int fd;int ret;int irq, irqflags =0 ; +char *label;if (copy_from_user (&eventreq, ip,sizeof (eventreq)))return -EFAULT ;
@@ -2175,15 +2193,23 @@ static int lineevent_create(struct gpio_if (ret) goto out_free_le; + label =make_irq_label (le->label); +if (!label) { + ret = -ENOMEM ; + goto out_free_le; + } +/* Request a thread to read the events */ ret =request_threaded_irq (irq, lineevent_irq_handler, lineevent_irq_thread, irqflags, - le->label, + label, le); -if (ret) +if (ret) { +free_irq_label (label); goto out_free_le; + } le->irq = irq;
Greg Kroah-Hartman
maintainerPATCH 69/252 RISC-V: KVM: Fix APLIC setipnum_le/be write emulation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anup Patel <[email protected]>
commit d8dd9f113e16bef3b29c9dcceb584a6f144f55e4 upstream.
The writes to setipnum_le/be register for APLIC in MSI-mode have special consideration for level-triggered interrupts as-per the section "4.9.2 Special consideration for level-sensitive interrupt sources" of the RISC-V AIA specification.
Particularly, the below text from the RISC-V AIA specification defines the behaviour of writes to setipnum_le/be register for level-triggered interrupts:
"A second option is for the interrupt service routine to write the APLIC’s source identity number for the interrupt to the domain’s setipnum register just before exiting. This will cause the interrupt’s pending bit to be set to one again if the source is still asserting an interrupt, but not if the source is not asserting an interrupt."
Fix setipnum_le/be write emulation for in-kernel APLIC by implementing the above behaviour in aplic_write_pending() function.
--- arch/riscv/kvm/aia_aplic.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-)
arch/riscv/kvm/aia_aplic.c +13 -3
@@ -137,11 +137,21 @@ static void aplic_write_pending(struct aplic *aplic, u32 irq, bool pending)raw_spin_lock_irqsave (&irqd->lock, flags); sm = irqd->sourcecfg &APLIC_SOURCECFG_SM_MASK ; -if (!pending && - ((sm ==APLIC_SOURCECFG_SM_LEVEL_HIGH ) || - (sm ==APLIC_SOURCECFG_SM_LEVEL_LOW ))) +if (sm ==APLIC_SOURCECFG_SM_INACTIVE ) goto skip_write_pending; +if (sm ==APLIC_SOURCECFG_SM_LEVEL_HIGH || + sm ==APLIC_SOURCECFG_SM_LEVEL_LOW ) { +if (!pending) + goto skip_write_pending; +if ((irqd->state &APLIC_IRQ_STATE_INPUT ) && + sm ==APLIC_SOURCECFG_SM_LEVEL_LOW ) + goto skip_write_pending; +if (!(irqd->state &APLIC_IRQ_STATE_INPUT ) && + sm ==APLIC_SOURCECFG_SM_LEVEL_HIGH ) + goto skip_write_pending; + } +if (pending) irqd->state |=APLIC_IRQ_STATE_PENDING ;else
Signature · 1 line
2.44.0
Greg Kroah-Hartman
maintainerPATCH 70/252 RISC-V: KVM: Fix APLIC in_clrip[x] read emulation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anup Patel <[email protected]>
commit 8e936e98718f005c986be0bfa1ee6b355acf96be upstream.
The reads to APLIC in_clrip[x] registers returns rectified input values of the interrupt sources.
A rectified input value of an interrupt source is defined by the section "4.5.2 Source configurations (sourcecfg[1]–sourcecfg[1023])" of the RISC-V AIA specification as:
rectified input value = (incoming wire value) XOR (source is inverted)
Update the riscv_aplic_input() implementation to match the above.
--- arch/riscv/kvm/aia_aplic.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-)
arch/riscv/kvm/aia_aplic.c +18 -3
@@ -197,16 +197,31 @@ static void aplic_write_enabled(struct aplic *aplic, u32 irq, bool enabled)static bool aplic_read_input (struct aplic *aplic,u32 irq) { -bool ret; -unsigned long flags; +u32 sourcecfg, sm, raw_input, irq_inverted;struct aplic_irq *irqd; +unsigned long flags; +bool ret = false;if (!irq || aplic->nr_irqs <= irq)return false; irqd = &aplic->irqs[irq];raw_spin_lock_irqsave (&irqd->lock, flags); - ret = (irqd->state &APLIC_IRQ_STATE_INPUT ) ? true : false; + + sourcecfg = irqd->sourcecfg; +if (sourcecfg &APLIC_SOURCECFG_D ) + goto skip; + + sm = sourcecfg &APLIC_SOURCECFG_SM_MASK ; +if (sm ==APLIC_SOURCECFG_SM_INACTIVE ) + goto skip; + + raw_input = (irqd->state &APLIC_IRQ_STATE_INPUT ) ?1 :0 ; + irq_inverted = (sm ==APLIC_SOURCECFG_SM_LEVEL_LOW || + sm ==APLIC_SOURCECFG_SM_EDGE_FALL ) ?1 :0 ; + ret = !!(raw_input ^ irq_inverted); + +skip:raw_spin_unlock_irqrestore (&irqd->lock, flags);return ret;
Signature · 1 line
2.44.0
Greg Kroah-Hartman
maintainerPATCH 71/252 KVM: arm64: Fix host-programmed guest events in nVHE
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Upton <[email protected]>
commit e89c928bedd77d181edc2df01cb6672184775140 upstream.
Programming PMU events in the host that count during guest execution is a feature supported by perf, e.g.
perf stat -e cpu_cycles:G ./lkvm run
While this works for VHE, the guest/host event bitmaps are not carried through to the hypervisor in the nVHE configuration. Make kvm_pmu_update_vcpu_events() conditional on whether or not _hardware_ supports PMUv3 rather than if the vCPU as vPMU enabled.
--- include/kvm/arm_pmu.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/kvm/arm_pmu.h +1 -1
@@ -86,7 +86,7 @@ void kvm_vcpu_pmu_resync_el0(void);*/ #define kvm_pmu_update_vcpu_events (vcpu) \ do { \ - if (!has_vhe() && kvm_vcpu_has_pmu(vcpu)) \ + if (!has_vhe() && kvm_arm_support_pmu_v3()) \ vcpu->arch.pmu.events = *kvm_get_pmu_events(); \ } while (0)
Greg Kroah-Hartman
maintainerPATCH 72/252 selinux: avoid dereference of garbage after mount failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Göttsche <[email protected]>
commit 37801a36b4d68892ce807264f784d818f8d0d39b upstream.
In case kern_mount() fails and returns an error pointer return in the error branch instead of continuing and dereferencing the error pointer.
While on it drop the never read static variable selinuxfs_mount.
--- security/selinux/selinuxfs.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
security/selinux/selinuxfs.c +7 -5
@@ -2135,7 +2135,6 @@ static struct file_system_type sel_fs_ty .kill_sb = sel_kill_sb, }; -static struct vfsmount *selinuxfs_mount__ro_after_init ;struct path selinux_null__ro_after_init ;static int __init init_sel_fs (void )
@@ -2157,18 +2156,21 @@ static int __init init_sel_fs(void)return err; } - selinux_null.mnt = selinuxfs_mount =kern_mount (&sel_fs_type); -if (IS_ERR (selinuxfs_mount)) { + selinux_null.mnt =kern_mount (&sel_fs_type); +if (IS_ERR (selinux_null.mnt)) {pr_err ("selinuxfs: could not mount!\n" ); - err =PTR_ERR (selinuxfs_mount); - selinuxfs_mount =NULL ; + err =PTR_ERR (selinux_null.mnt); + selinux_null.mnt =NULL ; +return err; } + selinux_null.dentry =d_hash_and_lookup (selinux_null.mnt->mnt_root, &null_name);if (IS_ERR (selinux_null.dentry)) {pr_err ("selinuxfs: could not lookup null!\n" ); err =PTR_ERR (selinux_null.dentry); selinux_null.dentry =NULL ; +return err; }return err;
Greg Kroah-Hartman
maintainerPATCH 73/252 r8169: fix issue caused by buggy BIOS on certain boards with RTL8168d
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiner Kallweit <[email protected]>
commit 5d872c9f46bd2ea3524af3c2420a364a13667135 upstream.
On some boards with this chip version the BIOS is buggy and misses to reset the PHY page selector. This results in the PHY ID read accessing registers on a different page, returning a more or less random value. Fix this by resetting the page selector first.
--- drivers/net/ethernet/realtek/r8169_main.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/net/ethernet/realtek/r8169_main.c +9 -0
@@ -5055,6 +5055,15 @@ static int r8169_mdio_register(struct rtstruct mii_bus *new_bus;int ret; +/* On some boards with this chip version the BIOS is buggy and misses +* to reset the PHY page selector. This results in the PHY ID read +* accessing registers on a different page, returning a more or +* less random value. Fix this by resetting the page selector first. +*/ +if (tp->mac_version ==RTL_GIGA_MAC_VER_25 || + tp->mac_version ==RTL_GIGA_MAC_VER_26 ) +r8169_mdio_write (tp,0x1f ,0 ); + new_bus =devm_mdiobus_alloc (&pdev->dev);if (!new_bus)return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 74/252 x86/cpufeatures: Add CPUID_LNX_5 to track recently added Linux-defined word
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit 8cb4a9a82b21623dbb4b3051dd30d98356cf95bc upstream.
Add CPUID_LNX_5 to track cpufeatures' word 21, and add the appropriate compile-time assert in KVM to prevent direct lookups on the features in CPUID_LNX_5. KVM uses X86_FEATURE_* flags to manage guest CPUID, and so must translate features that are scattered by Linux from the Linux-defined bit to the hardware-defined bit, i.e. should never try to directly access scattered features in guest CPUID.
Opportunistically add NR_CPUID_WORDS to enum cpuid_leafs, along with a compile-time assert in KVM's CPUID infrastructure to ensure that future additions update cpuid_leafs along with NCAPINTS.
No functional change intended.
--- arch/x86/include/asm/cpufeature.h | 2 ++ arch/x86/kvm/reverse_cpuid.h | 2 ++ 2 files changed, 4 insertions(+)
arch/x86/include/asm/cpufeature.h +2 -0
@@ -33,6 +33,8 @@ enum cpuid_leafsCPUID_7_EDX ,CPUID_8000_001F_EAX ,CPUID_8000_0021_EAX , +CPUID_LNX_5 , + NR_CPUID_WORDS, };#define X86_CAP_FMT_NUM "%d:%d"
arch/x86/kvm/reverse_cpuid.h +2 -0
@@ -102,10 +102,12 @@ static const struct cpuid_reg reverse_cp*/ static __always_inline void reverse_cpuid_check(unsigned int x86_leaf) { +BUILD_BUG_ON (NR_CPUID_WORDS !=NCAPINTS );BUILD_BUG_ON (x86_leaf ==CPUID_LNX_1 );BUILD_BUG_ON (x86_leaf ==CPUID_LNX_2 );BUILD_BUG_ON (x86_leaf ==CPUID_LNX_3 );BUILD_BUG_ON (x86_leaf ==CPUID_LNX_4 ); +BUILD_BUG_ON (x86_leaf ==CPUID_LNX_5 );BUILD_BUG_ON (x86_leaf >=ARRAY_SIZE (reverse_cpuid));BUILD_BUG_ON (reverse_cpuid[x86_leaf].function ==0 ); }
Greg Kroah-Hartman
maintainerPATCH 76/252 Revert "Bluetooth: hci_qca: Set BDA quirk bit if fwnode exists in DT"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 4790a73ace86f3d165bbedba898e0758e6e1b82d upstream.
This reverts commit 7dcd3e014aa7faeeaf4047190b22d8a19a0db696.
Qualcomm Bluetooth controllers like WCN6855 do not have persistent storage for the Bluetooth address and must therefore start as unconfigured to allow the user to set a valid address unless one has been provided by the boot firmware in the devicetree.
A recent change snuck into v6.8-rc7 and incorrectly started marking the default (non-unique) address as valid. This specifically also breaks the Bluetooth setup for some user of the Lenovo ThinkPad X13s.
Note that this is the second time Qualcomm breaks the driver this way and that this was fixed last year by commit 6945795bc81a ("Bluetooth:
fix use-bdaddr-property quirk"), which also has some further details.
--- drivers/bluetooth/hci_qca.c | 13 +------------ 1 file changed, 1 insertion(+), 12 deletions(-)
drivers/bluetooth/hci_qca.c +1 -12
@@ -7,7 +7,6 @@* * Copyright (C) 2007 Texas Instruments, Inc. * Copyright (c) 2010, 2012, 2018 The Linux Foundation. All rights reserved. -* Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved. * * Acknowledgements: * This file is based on hci_ll.c, which was...
@@ -1882,17 +1881,7 @@ retry:case QCA_WCN6750 :case QCA_WCN6855 :case QCA_WCN7850 : - -/* Set BDA quirk bit for reading BDA value from fwnode property -* only if that property exist in DT. -*/ -if (fwnode_property_present (dev_fwnode (hdev->dev.parent),"local-bd-address" )) { -set_bit (HCI_QUIRK_USE_BDADDR_PROPERTY , &hdev->quirks); -bt_dev_info (hdev,"setting quirk bit to read BDA from fwnode later" ); - }else { -bt_dev_dbg (hdev,"local-bd-address` is not present in the devicetree so not setting quirk bit for BDA" ); - } - +set_bit (HCI_QUIRK_USE_BDADDR_PROPERTY , &hdev->quirks);hci_set_aosp_capable (hdev); ret =qca_read_soc_version (hdev, &ver, soc_type);
Greg Kroah-Hartman
maintainerPATCH 77/252 arm64: dts: qcom: sc7180-trogdor: mark bluetooth address as broken
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit e12e28009e584c8f8363439f6a928ec86278a106 upstream.
Several Qualcomm Bluetooth controllers lack persistent storage for the device address and instead one can be provided by the boot firmware using the 'local-bd-address' devicetree property.
The Bluetooth bindings clearly states that the address should be specified in little-endian order, but due to a long-standing bug in the Qualcomm driver which reversed the address some boot firmware has been providing the address in big-endian order instead.
The boot firmware in SC7180 Trogdor Chromebooks is known to be affected so mark the 'local-bd-address' property as broken to maintain backwards compatibility with older firmware when fixing the underlying driver bug.
Note that ChromeOS always updates the kernel and devicetree in lockstep so that there is no need to handle backwards compatibility with older devicetrees.
--- arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi +2 -0
@@ -970,6 +970,8 @@ ap_spi_fp: &spi10 { vddrf-supply = <&pp1300_l2c>; vddch0-supply = <&pp3300_l10c>; max-speed = <3200000>; + + qcom,local-bd-address-broken; }; };
Greg Kroah-Hartman
maintainerPATCH 78/252 Bluetooth: qca: fix device-address endianness
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 77f45cca8bc55d00520a192f5a7715133591c83e upstream.
The WCN6855 firmware on the Lenovo ThinkPad X13s expects the Bluetooth device address in big-endian order when setting it using the EDL_WRITE_BD_ADDR_OPCODE command.
Presumably, this is the case for all non-ROME devices which all use the EDL_WRITE_BD_ADDR_OPCODE command for this (unlike the ROME devices which use a different command and expect the address in little-endian order).
Reverse the little-endian address before setting it to make sure that the address can be configured using tools like btmgmt or using the 'local-bd-address' devicetree property.
Note that this can potentially break systems with boot firmware which has started relying on the broken behaviour and is incorrectly passing the address via devicetree in big-endian order.
The only device affected by this should be the WCN3991 used in some Chromebooks. As ChromeOS updates the kernel and devicetree in lockstep, the new 'qcom,local-bd-address-broken' property can be used to determine if the firmware is buggy so that the underlying driver bug can be fixed without breaking backwards compatibility.
Set the HCI_QUIRK_BDADDR_PROPERTY_BROKEN quirk for such platforms so that the address is reversed when parsing the address property.
--- drivers/bluetooth/btqca.c | 8 ++++++-- drivers/bluetooth/hci_qca.c | 10 ++++++++++ 2 files changed, 16 insertions(+), 2 deletions(-)
drivers/bluetooth/btqca.c +6 -2
@@ -758,11 +758,15 @@ EXPORT_SYMBOL_GPL(qca_uart_setup);int qca_set_bdaddr (struct hci_dev *hdev,const bdaddr_t *bdaddr) { +bdaddr_t bdaddr_swapped;struct sk_buff *skb;int err; - skb =__hci_cmd_sync_ev (hdev,EDL_WRITE_BD_ADDR_OPCODE ,6 , bdaddr, -HCI_EV_VENDOR ,HCI_INIT_TIMEOUT ); +baswap (&bdaddr_swapped, bdaddr); + + skb =__hci_cmd_sync_ev (hdev,EDL_WRITE_BD_ADDR_OPCODE ,6 , + &bdaddr_swapped,HCI_EV_VENDOR , +HCI_INIT_TIMEOUT );if (IS_ERR (skb)) { err =PTR_ERR (skb);bt_dev_err (hdev,"QCA Change address cmd failed (%d)" , err);
drivers/bluetooth/hci_qca.c +10 -0
@@ -225,6 +225,7 @@ struct qca_serdev {struct qca_power *bt_power;u32 init_speed;u32 oper_speed; +bool bdaddr_property_broken;const char *firmware_name; };
@@ -1824,6 +1825,7 @@ static int qca_setup(struct hci_uart *huconst char *firmware_name =qca_get_firmware_name (hu);int ret;struct qca_btsoc_version ver; +struct qca_serdev *qcadev;const char *soc_name; ret =qca_check_speeds (hu);
@@ -1882,6 +1884,11 @@ retry:case QCA_WCN6855 :case QCA_WCN7850 :set_bit (HCI_QUIRK_USE_BDADDR_PROPERTY , &hdev->quirks); + + qcadev =serdev_device_get_drvdata (hu->serdev); +if (qcadev->bdaddr_property_broken) +set_bit (HCI_QUIRK_BDADDR_PROPERTY_BROKEN , &hdev->quirks); +hci_set_aosp_capable (hdev); ret =qca_read_soc_version (hdev, &ver, soc_type);
@@ -2253,6 +2260,9 @@ static int qca_serdev_probe(struct serdeif (!qcadev->oper_speed)BT_DBG ("UART will pick default operating speed" ); + qcadev->bdaddr_property_broken =device_property_read_bool (&serdev->dev, +"qcom,local-bd-address-broken" ); +if (data) qcadev->btsoc_type = data->soc_type;else
Greg Kroah-Hartman
maintainerPATCH 79/252 Bluetooth: add quirk for broken address properties
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 39646f29b100566451d37abc4cc8cdd583756dfe upstream.
Some Bluetooth controllers lack persistent storage for the device address and instead one can be provided by the boot firmware using the 'local-bd-address' devicetree property.
The Bluetooth devicetree bindings clearly states that the address should be specified in little-endian order, but due to a long-standing bug in the Qualcomm driver which reversed the address some boot firmware has been providing the address in big-endian order instead.
Add a new quirk that can be set on platforms with broken firmware and use it to reverse the address when parsing the property so that the underlying driver bug can be fixed.
--- include/net/bluetooth/hci.h | 9 +++++++++ net/bluetooth/hci_sync.c | 5 ++++- 2 files changed, 13 insertions(+), 1 deletion(-)
include/net/bluetooth/hci.h +9 -0
@@ -176,6 +176,15 @@ enum {*/ HCI_QUIRK_USE_BDADDR_PROPERTY , +/* When this quirk is set, the Bluetooth Device Address provided by +* the 'local-bd-address' fwnode property is incorrectly specified in +* big-endian order. +* +* This quirk can be set before hci_register_dev is called or +* during the hdev->setup vendor callback. +*/ + HCI_QUIRK_BDADDR_PROPERTY_BROKEN, +/* When this quirk is set, the duplicate filtering during * scanning is based on Bluetooth devices addresses. To allow * RSSI based updates, restart scanning if needed.
net/bluetooth/hci_sync.c +4 -1
@@ -3292,7 +3292,10 @@ static void hci_dev_get_bd_addr_from_proif (ret <0 || !bacmp (&ba,BDADDR_ANY ))return ; -bacpy (&hdev->public_addr, &ba); +if (test_bit (HCI_QUIRK_BDADDR_PROPERTY_BROKEN , &hdev->quirks)) +baswap (&hdev->public_addr, &ba); +else +bacpy (&hdev->public_addr, &ba); }struct hci_init_stage {
Greg Kroah-Hartman
maintainerPATCH 80/252 Bluetooth: hci_event: set the conn encrypted before conn establishes
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Wang <[email protected]>
commit c569242cd49287d53b73a94233db40097d838535 upstream.
We have a BT headset (Lenovo Thinkplus XT99), the pairing and connecting has no problem, once this headset is paired, bluez will remember this device and will auto re-connect it whenever the device is powered on. The auto re-connecting works well with Windows and Android, but with Linux, it always fails. Through debugging, we found at the rfcomm connection stage, the bluetooth stack reports "Connection refused - security block (0x0003)".
For this device, the re-connecting negotiation process is different from other BT headsets, it sends the Link_KEY_REQUEST command before the CONNECT_REQUEST completes, and it doesn't send ENCRYPT_CHANGE command during the negotiation. When the device sends the "connect complete" to hci, the ev->encr_mode is 1.
So here in the conn_complete_evt(), if ev->encr_mode is 1, link type is ACL and HCI_CONN_ENCRYPT is not set, we set HCI_CONN_ENCRYPT to this conn, and update conn->enc_key_size accordingly.
After this change, this BT headset could re-connect with Linux successfully. This is the btmon log after applying the patch, after receiving the "Connect Complete" with "Encryption: Enabled", will send the command to read encryption key size:
Quoted 1 line
HCI Event: Connect Request (
0x04) plen 10
Address: 8C:3C:AA:D8:11:67 (OUI 8C-3C-AA)
Class: 0x240404
Major class: Audio/Video (headset, speaker, stereo, video, vcr) Minor class: Wearable Headset Device
Rendering (Printing, Speaker)
Audio (Speaker, Microphone, Headset)
Link type: ACL (0x01)
...
Quoted 1 line
HCI Event: Link Key Request (
0x17) plen 6
Address: 8C:3C:AA:D8:11:67 (OUI 8C-3C-AA)
< HCI Command: Link Key Request Reply (0x01|0x000b) plen 22
Address: 8C:3C:AA:D8:11:67 (OUI 8C-3C-AA)
Link key: ${32-hex-digits-key}...
Quoted 1 line
HCI Event: Connect Complete (
0x03) plen 11
Status: Success (0x00)
Handle: 256
Address: 8C:3C:AA:D8:11:67 (OUI 8C-3C-AA)
Link type: ACL (0x01)
Encryption: Enabled (0x01)
< HCI Command: Read Encryption Key... (0x05|0x0008) plen 2
Handle: 256
< ACL Data TX: Handle 256 flags 0x00 dlen 10
L2CAP: Information Request (0x0a) ident 1 len 2
Type: Extended features supported (0x0002)Quoted 1 line
HCI Event: Command Complete (
0x0e) plen 7
Read Encryption Key Size (0x05|0x0008) ncmd 1
Status: Success (0x00)
Handle: 256
Key size: 16--- net/bluetooth/hci_event.c | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+)
net/bluetooth/hci_event.c +25 -0
@@ -3219,6 +3219,31 @@ static void hci_conn_complete_evt(structif (test_bit (HCI_ENCRYPT , &hdev->flags))set_bit (HCI_CONN_ENCRYPT , &conn->flags); +/* "Link key request" completed ahead of "connect request" completes */ +if (ev->encr_mode ==1 && !test_bit (HCI_CONN_ENCRYPT , &conn->flags) && + ev->link_type ==ACL_LINK ) { +struct link_key *key; +struct hci_cp_read_enc_key_size cp; + + key =hci_find_link_key (hdev, &ev->bdaddr); +if (key) { +set_bit (HCI_CONN_ENCRYPT , &conn->flags); + +if (!(hdev->commands[20 ] &0x10 )) { + conn->enc_key_size =HCI_LINK_KEY_SIZE ; + }else { + cp.handle =cpu_to_le16 (conn->handle); +if (hci_send_cmd (hdev,HCI_OP_READ_ENC_KEY_SIZE , +sizeof (cp), &cp)) { +bt_dev_err (hdev,"sending read key size failed" ); + conn->enc_key_size =HCI_LINK_KEY_SIZE ; + } + } + +hci_encrypt_cfm (conn, ev->status); + } + } +/* Get remote features */ if (conn->type ==ACL_LINK ) {struct hci_cp_read_remote_features cp;
Greg Kroah-Hartman
maintainerPATCH 81/252 Bluetooth: Fix TOCTOU in HCI debugfs implementation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bastien Nocera <[email protected]>
commit 7835fcfd132eb88b87e8eb901f88436f63ab60f7 upstream.
struct hci_dev members conn_info_max_age, conn_info_min_age, le_conn_max_interval, le_conn_min_interval, le_adv_max_interval, and le_adv_min_interval can be modified from the HCI core code, as well through debugfs.
The debugfs implementation, that's only available to privileged users, will check for boundaries, making sure that the minimum value being set is strictly above the maximum value that already exists, and vice-versa.
However, as both minimum and maximum values can be changed concurrently to us modifying them, we need to make sure that the value we check is the value we end up using.
For example, with ->conn_info_max_age set to 10, conn_info_min_age_set() gets called from vfs handlers to set conn_info_min_age to 8.
In conn_info_min_age_set(), this goes through:
if (val == 0 || val > hdev->conn_info_max_age) return -EINVAL;
Concurrently, conn_info_max_age_set() gets called to set to set the conn_info_max_age to 7:
if (val == 0 || val > hdev->conn_info_max_age) return -EINVAL;
That check will also pass because we used the old value (10) for conn_info_max_age.
After those checks that both passed, the struct hci_dev access is mutex-locked, disabling concurrent access, but that does not matter because the invalid value checks both passed, and we'll end up with conn_info_min_age = 8 and conn_info_max_age = 7
To fix this problem, we need to lock the structure access before so the check and assignment are not interrupted.
This fix was originally devised by the BassCheck[1] team, and considered the problem to be an atomicity one. This isn't the case as there aren't any concerns about the variable changing while we check it, but rather after we check it parallel to another change.
This patch fixes CVE-2024-24858 and CVE-2024-24857.
[1] https://sites.google.com/view/basscheck/
--- net/bluetooth/hci_debugfs.c | 48 +++++++++++++++++++++++++++++--------------- 1 file changed, 32 insertions(+), 16 deletions(-)
net/bluetooth/hci_debugfs.c +32 -16
@@ -218,10 +218,12 @@ static int conn_info_min_age_set(void *d {struct hci_dev *hdev = data; -if (val ==0 || val > hdev->conn_info_max_age) +hci_dev_lock (hdev); +if (val ==0 || val > hdev->conn_info_max_age) { +hci_dev_unlock (hdev);return -EINVAL ; + } -hci_dev_lock (hdev); hdev->conn_info_min_age = val;hci_dev_unlock (hdev);
@@ -246,10 +248,12 @@ static int conn_info_max_age_set(void *d {struct hci_dev *hdev = data; -if (val ==0 || val < hdev->conn_info_min_age) +hci_dev_lock (hdev); +if (val ==0 || val < hdev->conn_info_min_age) { +hci_dev_unlock (hdev);return -EINVAL ; + } -hci_dev_lock (hdev); hdev->conn_info_max_age = val;hci_dev_unlock (hdev);
@@ -567,10 +571,12 @@ static int sniff_min_interval_set(void * {struct hci_dev *hdev = data; -if (val ==0 || val %2 || val > hdev->sniff_max_interval) +hci_dev_lock (hdev); +if (val ==0 || val %2 || val > hdev->sniff_max_interval) { +hci_dev_unlock (hdev);return -EINVAL ; + } -hci_dev_lock (hdev); hdev->sniff_min_interval = val;hci_dev_unlock (hdev);
@@ -595,10 +601,12 @@ static int sniff_max_interval_set(void * {struct hci_dev *hdev = data; -if (val ==0 || val %2 || val < hdev->sniff_min_interval) +hci_dev_lock (hdev); +if (val ==0 || val %2 || val < hdev->sniff_min_interval) { +hci_dev_unlock (hdev);return -EINVAL ; + } -hci_dev_lock (hdev); hdev->sniff_max_interval = val;hci_dev_unlock (hdev);
@@ -850,10 +858,12 @@ static int conn_min_interval_set(void *d {struct hci_dev *hdev = data; -if (val <0x0006 || val >0x0c80 || val > hdev->le_conn_max_interval) +hci_dev_lock (hdev); +if (val <0x0006 || val >0x0c80 || val > hdev->le_conn_max_interval) { +hci_dev_unlock (hdev);return -EINVAL ; + } -hci_dev_lock (hdev); hdev->le_conn_min_interval = val;hci_dev_unlock (hdev);
@@ -878,10 +888,12 @@ static int conn_max_interval_set(void *d {struct hci_dev *hdev = data; -if (val <0x0006 || val >0x0c80 || val < hdev->le_conn_min_interval) +hci_dev_lock (hdev); +if (val <0x0006 || val >0x0c80 || val < hdev->le_conn_min_interval) { +hci_dev_unlock (hdev);return -EINVAL ; + } -hci_dev_lock (hdev); hdev->le_conn_max_interval = val;hci_dev_unlock (hdev);
@@ -990,10 +1002,12 @@ static int adv_min_interval_set(void *da {struct hci_dev *hdev = data; -if (val <0x0020 || val >0x4000 || val > hdev->le_adv_max_interval) +hci_dev_lock (hdev); +if (val <0x0020 || val >0x4000 || val > hdev->le_adv_max_interval) { +hci_dev_unlock (hdev);return -EINVAL ; + } -hci_dev_lock (hdev); hdev->le_adv_min_interval = val;hci_dev_unlock (hdev);
@@ -1018,10 +1032,12 @@ static int adv_max_interval_set(void *da {struct hci_dev *hdev = data; -if (val <0x0020 || val >0x4000 || val < hdev->le_adv_min_interval) +hci_dev_lock (hdev); +if (val <0x0020 || val >0x4000 || val < hdev->le_adv_min_interval) { +hci_dev_unlock (hdev);return -EINVAL ; + } -hci_dev_lock (hdev); hdev->le_adv_max_interval = val;hci_dev_unlock (hdev);
Greg Kroah-Hartman
maintainerPATCH 82/252 netfilter: nf_tables: release batch on table validation from abort path
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
commit a45e6889575c2067d3c0212b6bc1022891e65b91 upstream.
Unlike early commit path stage which triggers a call to abort, an explicit release of the batch is required on abort, otherwise mutex is released and commit_list remains in place.
Add WARN_ON_ONCE to ensure commit_list is empty from the abort path before releasing the mutex.
After this patch, commit_list is always assumed to be empty before grabbing the mutex, therefore
03c1f1ef1584 ("netfilter: Cleanup nft_net->module_list from nf_tables_exit_net()")
only needs to release the pending modules for registration.
--- net/netfilter/nf_tables_api.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
net/netfilter/nf_tables_api.c +10 -5
@@ -10326,10 +10326,11 @@ static int __nf_tables_abort(struct netstruct nft_trans *trans, *next;LIST_HEAD (set_update_list);struct nft_trans_elem *te; +int err =0 ;if (action ==NFNL_ABORT_VALIDATE &&nf_tables_validate (net) <0 ) -return -EAGAIN ; + err = -EAGAIN ;list_for_each_entry_safe_reverse (trans, next, &nft_net->commit_list, list) {
@@ -10522,7 +10523,7 @@ static int __nf_tables_abort(struct netelse nf_tables_module_autoload_cleanup (net); -return 0 ; +return err; } static int nf_tables_abort(struct net *net, struct sk_buff *skb,
@@ -10535,6 +10536,9 @@ static int nf_tables_abort(struct net *n gc_seq =nft_gc_seq_begin (nft_net); ret =__nf_tables_abort (net, action);nft_gc_seq_end (nft_net, gc_seq); + +WARN_ON_ONCE (!list_empty (&nft_net->commit_list)); +mutex_unlock (&nft_net->commit_mutex);return ret;
@@ -11335,9 +11339,10 @@ static void __net_exit nf_tables_exit_ne gc_seq =nft_gc_seq_begin (nft_net); -if (!list_empty (&nft_net->commit_list) || - !list_empty (&nft_net->module_list)) -__nf_tables_abort (net,NFNL_ABORT_NONE ); +WARN_ON_ONCE (!list_empty (&nft_net->commit_list)); + +if (!list_empty (&nft_net->module_list)) +nf_tables_module_autoload_cleanup (net);__nft_release_tables (net);
Greg Kroah-Hartman
maintainerPATCH 83/252 netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
commit 0d459e2ffb541841714839e8228b845458ed3b27 upstream.
The commit mutex should not be released during the critical section between nft_gc_seq_begin() and nft_gc_seq_end(), otherwise, async GC worker could collect expired objects and get the released commit lock within the same GC sequence.
nf_tables_module_autoload() temporarily releases the mutex to load module dependencies, then it goes back to replay the transaction again. Move it at the end of the abort phase after nft_gc_seq_end() is called.
--- net/netfilter/nf_tables_api.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
net/netfilter/nf_tables_api.c +8 -5
@@ -10518,11 +10518,6 @@ static int __nf_tables_abort(struct netnf_tables_abort_release (trans); } -if (action ==NFNL_ABORT_AUTOLOAD ) -nf_tables_module_autoload (net); -else -nf_tables_module_autoload_cleanup (net); -return err; }
@@ -10539,6 +10534,14 @@ static int nf_tables_abort(struct net *nWARN_ON_ONCE (!list_empty (&nft_net->commit_list)); +/* module autoload needs to happen after GC sequence update because it +* temporarily releases and grabs mutex again. +*/ +if (action ==NFNL_ABORT_AUTOLOAD ) +nf_tables_module_autoload (net); +else +nf_tables_module_autoload_cleanup (net); +mutex_unlock (&nft_net->commit_mutex);return ret;
Greg Kroah-Hartman
maintainerPATCH 84/252 selftests: mptcp: join: fix dev in check_endpoint
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geliang Tang <[email protected]>
commit 40061817d95bce6dd5634a61a65cd5922e6ccc92 upstream.
There's a bug in pm_nl_check_endpoint(), 'dev' didn't be parsed correctly. If calling it in the 2nd test of endpoint_tests() too, it fails with an error like this:
creation [FAIL] expected '10.0.2.2 id 2 subflow dev dev' \
found '10.0.2.2 id 2 subflow dev ns2eth2'
The reason is '$2' should be set to 'dev', not '$1'. This patch fixes it.
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
tools/testing/selftests/net/mptcp/mptcp_join.sh +3 -1
@@ -796,7 +796,7 @@ pm_nl_check_endpoint() [ -n "$_flags" ]; flags="flags $_flags" shift elif [ $1 = "dev" ]; then - [ -n "$2" ]; dev="dev $1" + [ -n "$2" ]; dev="dev $2" shift elif [ $1 = "id" ]; then _id=$2
@@ -3507,6 +3507,8 @@ endpoint_tests() local tests_pid=$! wait_mpj $ns2 + pm_nl_check_endpoint "creation" \ + $ns2 10.0.2.2 id 2 flags subflow dev ns2eth2 chk_subflow_nr "before delete" 2 chk_mptcp_info subflows 1 subflows 1
Greg Kroah-Hartman
maintainerPATCH 85/252 xen-netfront: Add missing skb_mark_for_recycle
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesper Dangaard Brouer <[email protected]>
commit 037965402a010898d34f4e35327d22c0a95cd51f upstream.
Notice that skb_mark_for_recycle() is introduced later than fixes tag in commit 6a5bcd84e886 ("page_pool: Allow drivers to hint on SKB recycling").
It is believed that fixes tag were missing a call to page_pool_release_page() between v5.9 to v5.14, after which is should have used skb_mark_for_recycle(). Since v6.6 the call page_pool_release_page() were removed (in commit 535b9c61bdef ("net: page_pool: hide page_pool_release_page()") and remaining callers converted (in commit 6bfef2ec0172 ("Merge branch 'net-page_pool-remove-page_pool_release_page'")).
This leak became visible in v6.8 via commit dba1b8a7ab68 ("mm/page_pool: catch page_pool memory leaks").
--- drivers/net/xen-netfront.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/xen-netfront.c +1 -0
@@ -285,6 +285,7 @@ static struct sk_buff *xennet_alloc_one_return NULL ; }skb_add_rx_frag (skb,0 , page,0 ,0 ,PAGE_SIZE ); +skb_mark_for_recycle (skb);/* Align ip header to a 16 bytes boundary */ skb_reserve (skb,NET_IP_ALIGN );
Greg Kroah-Hartman
maintainerPATCH 86/252 net/rds: fix possible cp null dereference
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mahmoud Adam <[email protected]>
commit 62fc3357e079a07a22465b9b6ef71bb6ea75ee4b upstream.
cp might be null, calling cp->cp_conn would produce null dereference
[Simon Horman adds:]
Analysis:
* cp is a parameter of __rds_rdma_map and is not reassigned.
* The following call-sites pass a NULL cp argument to __rds_rdma_map()
- rds_get_mr()
- rds_get_mr_for_dest
* Prior to the code above, the following assumes that cp may be NULL (which is indicative, but could itself be unnecessary)
trans_private = rs->rs_transport->get_mr( sg, nents, rs, &mr->r_key, cp ? cp->cp_conn : NULL, args->vec.addr, args->vec.bytes, need_odp ? ODP_ZEROBASED : ODP_NOT_NEEDED);
* The code modified by this patch is guarded by IS_ERR(trans_private), where trans_private is assigned as per the previous point in this analysis.
The only implementation of get_mr that I could locate is rds_ib_get_mr() which can return an ERR_PTR if the conn (4th) argument is NULL.
* ret is set to PTR_ERR(trans_private).
rds_ib_get_mr can return ERR_PTR(-ENODEV) if the conn (4th) argument is NULL. Thus ret may be -ENODEV in which case the code in question will execute.
Conclusion:
* cp may be NULL at the point where this patch adds a check; this patch does seem to address a possible bug
--- net/rds/rdma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/rds/rdma.c +1 -1
@@ -302,7 +302,7 @@ static int __rds_rdma_map(struct rds_soc } ret =PTR_ERR (trans_private);/* Trigger connection so that its ready for the next retry */ -if (ret == -ENODEV ) +if (ret == -ENODEV && cp)rds_conn_connect_if_down (cp->cp_conn); goto out; }
Greg Kroah-Hartman
maintainerPATCH 87/252 net: usb: ax88179_178a: avoid the interface always configured as random address
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jose Ignacio Tornos Martinez <[email protected]>
commit 2e91bb99b9d4f756e92e83c4453f894dda220f09 upstream.
After the commit d2689b6a86b9 ("net: usb: ax88179_178a: avoid two consecutive device resets"), reset is not executed from bind operation and mac address is not read from the device registers or the devicetree at that moment. Since the check to configure if the assigned mac address is random or not for the interface, happens after the bind operation from usbnet_probe, the interface keeps configured as random address, although the address is correctly read and set during open operation (the only reset now).
In order to keep only one reset for the device and to avoid the interface always configured as random address, after reset, configure correctly the suitable field from the driver, if the mac address is read successfully from the device registers or the devicetree. Take into account if a locally administered address (random) was previously stored.
--- drivers/net/usb/ax88179_178a.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/usb/ax88179_178a.c +2 -0
@@ -1273,6 +1273,8 @@ static void ax88179_get_mac_addr(structif (is_valid_ether_addr (mac)) {eth_hw_addr_set (dev->net, mac); +if (!is_local_ether_addr (mac)) + dev->net->addr_assign_type =NET_ADDR_PERM ; }else {netdev_info (dev->net,"invalid MAC address, using random\n" );eth_hw_addr_random (dev->net);
Greg Kroah-Hartman
maintainerPATCH 88/252 net: mana: Fix Rx DMA datasize and skb_over_panic
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haiyang Zhang <[email protected]>
commit c0de6ab920aafb56feab56058e46b688e694a246 upstream.
mana_get_rxbuf_cfg() aligns the RX buffer's DMA datasize to be multiple of 64. So a packet slightly bigger than mtu+14, say 1536, can be received and cause skb_over_panic.
Sample dmesg:
[ 5325.237162] skbuff: skb_over_panic: text:ffffffffc043277a len:1536 put:1536 head:ff1100018b517000 data:ff1100018b517100 tail:0x700 end:0x6ea dev:<NULL> [ 5325.243689] ------------[ cut here ]------------ [ 5325.245748] kernel BUG at net/core/skbuff.c:192! [ 5325.247838] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI [ 5325.258374] RIP: 0010:skb_panic+0x4f/0x60 [ 5325.302941] Call Trace: [ 5325.304389] <IRQ> [ 5325.315794] ? skb_panic+0x4f/0x60 [ 5325.317457] ? asm_exc_invalid_op+0x1f/0x30 [ 5325.319490] ? skb_panic+0x4f/0x60 [ 5325.321161] skb_put+0x4e/0x50 [ 5325.322670] mana_poll+0x6fa/0xb50 [mana] [ 5325.324578] __napi_poll+0x33/0x1e0 [ 5325.326328] net_rx_action+0x12e/0x280
As discussed internally, this alignment is not necessary. To fix this bug, remove it from the code. So oversized packets will be marked as CQE_RX_TRUNCATED by NIC, and dropped.
--- drivers/net/ethernet/microsoft/mana/mana_en.c | 2 +- include/net/mana/mana.h | 1 - 2 files changed, 1 insertion(+), 2 deletions(-)
drivers/net/ethernet/microsoft/mana/mana_en.c +1 -1
@@ -601,7 +601,7 @@ static void mana_get_rxbuf_cfg(int mtu, *alloc_size = mtu +MANA_RXBUF_PAD + *headroom; - *datasize =ALIGN (mtu +ETH_HLEN ,MANA_RX_DATA_ALIGN ); + *datasize = mtu +ETH_HLEN ; }static int mana_pre_alloc_rxbufs (struct mana_port_context *mpc,int new_mtu)
include/net/mana/mana.h +0 -1
@@ -39,7 +39,6 @@ enum TRI_STATE {#define COMP_ENTRY_SIZE 64#define RX_BUFFERS_PER_QUEUE 512 -#define MANA_RX_DATA_ALIGN 64#define MAX_SEND_BUFFERS_PER_QUEUE 256
Greg Kroah-Hartman
maintainerPATCH 89/252 vsock/virtio: fix packet delivery to tap device
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marco Pinna <[email protected]>
commit b32a09ea7c38849ff925489a6bf5bd8914bc45df upstream.
Commit 82dfb540aeb2 ("VSOCK: Add virtio vsock vsockmon hooks") added virtio_transport_deliver_tap_pkt() for handing packets to the vsockmon device. However, in virtio_transport_send_pkt_work(), the function is called before actually sending the packet (i.e. before placing it in the virtqueue with virtqueue_add_sgs() and checking whether it returned successfully).
Queuing the packet in the virtqueue can fail even multiple times. However, in virtio_transport_deliver_tap_pkt() we deliver the packet to the monitoring tap interface only the first time we call it. This certainly avoids seeing the same packet replicated multiple times in the monitoring interface, but it can show the packet sent with the wrong timestamp or even before we succeed to queue it in the virtqueue.
Move virtio_transport_deliver_tap_pkt() after calling virtqueue_add_sgs() and making sure it returned successfully.
--- net/vmw_vsock/virtio_transport.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/vmw_vsock/virtio_transport.c +2 -1
@@ -109,7 +109,6 @@ virtio_transport_send_pkt_work(struct woif (!skb)break ; -virtio_transport_deliver_tap_pkt (skb); reply =virtio_vsock_skb_reply (skb);sg_init_one (&hdr,virtio_vsock_hdr (skb),sizeof (*virtio_vsock_hdr (skb)));
@@ -128,6 +127,8 @@ virtio_transport_send_pkt_work(struct wobreak ; } +virtio_transport_deliver_tap_pkt (skb); +if (reply) {struct virtqueue *rx_vq = vsock->vqs[VSOCK_VQ_RX ];int val;
Greg Kroah-Hartman
maintainerPATCH 90/252 x86/srso: Improve i-cache locality for alias mitigation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <[email protected]>
Commit aa730cff0c26244e88066b5b461a9f5fbac13823 upstream.
Move srso_alias_return_thunk() to the same section as srso_alias_safe_ret() so they can share a cache line.
--- arch/x86/lib/retpoline.S | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
arch/x86/lib/retpoline.S +2 -3
@@ -177,15 +177,14 @@ SYM_START(srso_alias_safe_ret, SYM_L_GLO int3 SYM_FUNC_END(srso_alias_safe_ret) - .section .text..__x86.return_thunk - -SYM_CODE_START(srso_alias_return_thunk) +SYM_CODE_START_NOALIGN(srso_alias_return_thunk) UNWIND_HINT_FUNC ANNOTATE_NOENDBR call srso_alias_safe_ret ud2 SYM_CODE_END(srso_alias_return_thunk) + .section .text..__x86.return_thunk /* * Some generic notes on the untraining sequences: *
Greg Kroah-Hartman
maintainerPATCH 91/252 x86/srso: Disentangle rethunk-dependent options
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <[email protected]>
Commit 34a3cae7474c6e6f4a85aad4a7b8191b8b35cdcd upstream.
CONFIG_RETHUNK, CONFIG_CPU_UNRET_ENTRY and CONFIG_CPU_SRSO are all tangled up. De-spaghettify the code a bit.
Some of the rethunk-related code has been shuffled around within the '.text..__x86.return_thunk' section, but otherwise there are no functional changes. srso_alias_untrain_ret() and srso_alias_safe_ret() ((which are very address-sensitive) haven't moved.
--- arch/x86/include/asm/nospec-branch.h | 25 +++-- arch/x86/kernel/cpu/bugs.c | 5 - arch/x86/kernel/vmlinux.lds.S | 7 - arch/x86/lib/retpoline.S | 158 +++++++++++++++++++---------------- 4 files changed, 109 insertions(+), 86 deletions(-)
arch/x86/include/asm/nospec-branch.h +18 -7
@@ -289,19 +289,17 @@* where we have a stack but before any RET instruction. */ .macro UNTRAIN_RET -#if defined(CONFIG_CPU_UNRET_ENTRY ) || defined(CONFIG_CPU_IBPB_ENTRY ) || \ - defined(CONFIG_CALL_DEPTH_TRACKING ) || defined(CONFIG_CPU_SRSO ) +#if defined(CONFIG_RETHUNK ) || defined(CONFIG_CPU_IBPB_ENTRY )VALIDATE_UNRET_END ALTERNATIVE_3 "", \ CALL_UNTRAIN_RET, X86_FEATURE_UNRET, \ "call entry_ibpb", X86_FEATURE_ENTRY_IBPB, \ - __stringify(RESET_CALL_DEPTH), X86_FEATURE_CALL_DEPTH + __stringify(RESET_CALL_DEPTH), X86_FEATURE_CALL_DEPTH #endif .endm .macro UNTRAIN_RET_VM -#if defined(CONFIG_CPU_UNRET_ENTRY ) || defined(CONFIG_CPU_IBPB_ENTRY ) || \ - defined(CONFIG_CALL_DEPTH_TRACKING ) || defined(CONFIG_CPU_SRSO ) +#if defined(CONFIG_RETHUNK ) || defined(CONFIG_CPU_IBPB_ENTRY )VALIDATE_UNRET_END ALTERNATIVE_3 "", \ CALL_UNTRAIN_RET, X86_FEATURE_UNRET, \
@@ -311,8 +309,7 @@ .endm .macro UNTRAIN_RET_FROM_CALL -#if defined(CONFIG_CPU_UNRET_ENTRY ) || defined(CONFIG_CPU_IBPB_ENTRY ) || \ - defined(CONFIG_CALL_DEPTH_TRACKING ) || defined(CONFIG_CPU_SRSO ) +#if defined(CONFIG_RETHUNK ) || defined(CONFIG_CPU_IBPB_ENTRY )VALIDATE_UNRET_END ALTERNATIVE_3 "", \ CALL_UNTRAIN_RET, X86_FEATURE_UNRET, \
@@ -359,6 +356,20 @@ extern void __x86_return_thunk(void);static inline void __x86_return_thunk (void ) {}#endif +#ifdef CONFIG_CPU_UNRET_ENTRY +extern void retbleed_return_thunk (void ); +#else +static inline void retbleed_return_thunk (void ) {} +#endif + +#ifdef CONFIG_CPU_SRSO +extern void srso_return_thunk (void ); +extern void srso_alias_return_thunk (void ); +#else +static inline void srso_return_thunk (void ) {} +static inline void srso_alias_return_thunk (void ) {} +#endif +extern void retbleed_return_thunk (void );extern void srso_return_thunk (void );extern void srso_alias_return_thunk (void );
arch/x86/kernel/cpu/bugs.c +2 -3
@@ -63,7 +63,7 @@ EXPORT_SYMBOL_GPL(x86_pred_cmd);static DEFINE_MUTEX (spec_ctrl_mutex); -void (*x86_return_thunk)(void )__ro_after_init = &__x86_return_thunk; +void (*x86_return_thunk)(void )__ro_after_init = __x86_return_thunk;/* Update SPEC_CTRL MSR and its cached copy unconditionally */ static void update_spec_ctrl (u64 val)
@@ -1108,8 +1108,7 @@ do_cmd_auto:setup_force_cpu_cap (X86_FEATURE_RETHUNK );setup_force_cpu_cap (X86_FEATURE_UNRET ); -if (IS_ENABLED (CONFIG_RETHUNK )) - x86_return_thunk = retbleed_return_thunk; + x86_return_thunk = retbleed_return_thunk;if (boot_cpu_data.x86_vendor !=X86_VENDOR_AMD && boot_cpu_data.x86_vendor !=X86_VENDOR_HYGON )
arch/x86/kernel/vmlinux.lds.S +2 -5
@@ -139,10 +139,7 @@ SECTIONS STATIC_CALL_TEXT ALIGN_ENTRY_TEXT_BEGIN -#ifdef CONFIG_CPU_SRSO *(.text..__x86.rethunk_untrain) -#endif - ENTRY_TEXT #ifdef CONFIG_CPU_SRSO
@@ -520,12 +517,12 @@ INIT_PER_CPU(irq_stack_backing_store); "fixed_percpu_data is not at start of per-cpu area"); #endif -#ifdef CONFIG_RETHUNK +#ifdef CONFIG_CPU_UNRET_ENTRY . = ASSERT((retbleed_return_thunk & 0x3f) == 0, "retbleed_return_thunk not cacheline-aligned"); -. = ASSERT((srso_safe_ret & 0x3f) == 0, "srso_safe_ret not cacheline-aligned"); #endif #ifdef CONFIG_CPU_SRSO +. = ASSERT((srso_safe_ret & 0x3f) == 0, "srso_safe_ret not cacheline-aligned"); /* * GNU ld cannot do XOR until 2.41. * https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=f6f78318fca803c4907fb8d7f6ded8295f1947b1
arch/x86/lib/retpoline.S +87 -71
201 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 92/252 x86/nospec: Refactor UNTRAIN_RET[_*]
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <[email protected]>
Commit e8efc0800b8b5045ba8c0d1256bfbb47e92e192a upstream.
Factor out the UNTRAIN_RET[_*] common bits into a helper macro.
--- arch/x86/include/asm/nospec-branch.h | 31 ++++++++++--------------------- 1 file changed, 10 insertions(+), 21 deletions(-)
arch/x86/include/asm/nospec-branch.h +10 -21
@@ -288,35 +288,24 @@* As such, this must be placed after every *SWITCH_TO_KERNEL_CR3 at a point * where we have a stack but before any RET instruction. */ -.macro UNTRAIN_RET +.macro __UNTRAIN_RET ibpb_feature, call_depth_insns#if defined(CONFIG_RETHUNK ) || defined(CONFIG_CPU_IBPB_ENTRY )VALIDATE_UNRET_END ALTERNATIVE_3 "", \ CALL_UNTRAIN_RET, X86_FEATURE_UNRET, \ - "call entry_ibpb", X86_FEATURE_ENTRY_IBPB, \ - __stringify(RESET_CALL_DEPTH), X86_FEATURE_CALL_DEPTH + "call entry_ibpb", \ibpb_feature, \ + __stringify(\call_depth_insns), X86_FEATURE_CALL_DEPTH #endif .endm -.macro UNTRAIN_RET_VM -#if defined(CONFIG_RETHUNK) || defined(CONFIG_CPU_IBPB_ENTRY) - VALIDATE_UNRET_END - ALTERNATIVE_3 "", \ - CALL_UNTRAIN_RET, X86_FEATURE_UNRET, \ - "call entry_ibpb", X86_FEATURE_IBPB_ON_VMEXIT, \ - __stringify(RESET_CALL_DEPTH), X86_FEATURE_CALL_DEPTH -#endif -.endm +#define UNTRAIN_RET \ + __UNTRAIN_RET X86_FEATURE_ENTRY_IBPB, __stringify(RESET_CALL_DEPTH) -.macro UNTRAIN_RET_FROM_CALL -#if defined(CONFIG_RETHUNK) || defined(CONFIG_CPU_IBPB_ENTRY) - VALIDATE_UNRET_END - ALTERNATIVE_3 "", \ - CALL_UNTRAIN_RET, X86_FEATURE_UNRET, \ - "call entry_ibpb", X86_FEATURE_ENTRY_IBPB, \ - __stringify(RESET_CALL_DEPTH_FROM_CALL), X86_FEATURE_CALL_DEPTH -#endif -.endm +#define UNTRAIN_RET_VM \ + __UNTRAIN_RET X86_FEATURE_IBPB_ON_VMEXIT, __stringify(RESET_CALL_DEPTH) + +#define UNTRAIN_RET_FROM_CALL \ + __UNTRAIN_RET X86_FEATURE_ENTRY_IBPB, __stringify(RESET_CALL_DEPTH_FROM_CALL) .macro CALL_DEPTH_ACCOUNT
Greg Kroah-Hartman
maintainerPATCH 93/252 x86/bugs: Fix the SRSO mitigation on Zen3/4
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Borislav Petkov (AMD)" <[email protected]>
Commit 4535e1a4174c4111d92c5a9a21e542d232e0fcaa upstream.
The original version of the mitigation would patch in the calls to the untraining routines directly. That is, the alternative() in UNTRAIN_RET will patch in the CALL to srso_alias_untrain_ret() directly.
However, even if commit e7c25c441e9e ("x86/cpu: Cleanup the untrain mess") meant well in trying to clean up the situation, due to micro- architectural reasons, the untraining routine srso_alias_untrain_ret() must be the target of a CALL instruction and not of a JMP instruction as it is done now.
Reshuffle the alternative macros to accomplish that.
--- arch/x86/include/asm/asm-prototypes.h | 1 + arch/x86/include/asm/nospec-branch.h | 21 ++++++++++++++++----- arch/x86/lib/retpoline.S | 10 +++++----- 3 files changed, 22 insertions(+), 10 deletions(-)
arch/x86/include/asm/asm-prototypes.h +1 -0
@@ -13,6 +13,7 @@#include <asm/preempt.h> #include <asm/asm.h> #include <asm/gsseg.h> +#include <asm/nospec-branch.h> #ifndef CONFIG_X86_CMPXCHG64 extern void cmpxchg8b_emu (void );
arch/x86/include/asm/nospec-branch.h +16 -5
@@ -271,11 +271,20 @@ .Lskip_rsb_\@: .endm +/* + * The CALL to srso_alias_untrain_ret() must be patched in directly at + * the spot where untraining must be done, ie., srso_alias_untrain_ret() + * must be the target of a CALL instruction instead of indirectly + * jumping to a wrapper which then calls it. Therefore, this macro is + * called outside of __UNTRAIN_RET below, for the time being, before the + * kernel can support nested alternatives with arbitrary nesting. + */ +.macro CALL_UNTRAIN_RET#if defined(CONFIG_CPU_UNRET_ENTRY ) || defined(CONFIG_CPU_SRSO ) -#define CALL_UNTRAIN_RET "call entry_untrain_ret" -#else -#define CALL_UNTRAIN_RET "" +ALTERNATIVE_2 "" ,"call entry_untrain_ret" ,X86_FEATURE_UNRET , \ +"call srso_alias_untrain_ret" ,X86_FEATURE_SRSO_ALIAS #endif +.endm/* * Mitigate RETBleed for AMD/Hygon Zen uarch. Requires KERNEL CR3 because the
@@ -291,8 +300,8 @@ .macro __UNTRAIN_RET ibpb_feature, call_depth_insns#if defined(CONFIG_RETHUNK ) || defined(CONFIG_CPU_IBPB_ENTRY )VALIDATE_UNRET_END - ALTERNATIVE_3 "", \ -CALL_UNTRAIN_RET ,X86_FEATURE_UNRET , \ + CALL_UNTRAIN_RET +ALTERNATIVE_2 "" , \ "call entry_ibpb", \ibpb_feature, \ __stringify(\call_depth_insns), X86_FEATURE_CALL_DEPTH#endif
@@ -351,6 +360,8 @@ extern void retbleed_return_thunk(void);static inline void retbleed_return_thunk (void ) {}#endif +extern void srso_alias_untrain_ret (void ); +#ifdef CONFIG_CPU_SRSO extern void srso_return_thunk (void );extern void srso_alias_return_thunk (void );
arch/x86/lib/retpoline.S +5 -5
@@ -218,10 +218,12 @@ SYM_CODE_START(srso_return_thunk) SYM_CODE_END(srso_return_thunk) #define JMP_SRSO_UNTRAIN_RET "jmp srso_untrain_ret" -#define JMP_SRSO_ALIAS_UNTRAIN_RET "jmp srso_alias_untrain_ret" #else /* !CONFIG_CPU_SRSO */ #define JMP_SRSO_UNTRAIN_RET "ud2" -#define JMP_SRSO_ALIAS_UNTRAIN_RET "ud2" +/* Dummy for the alternative in CALL_UNTRAIN_RET. */ +SYM_CODE_START(srso_alias_untrain_ret) + RET +SYM_FUNC_END(srso_alias_untrain_ret) #endif /* CONFIG_CPU_SRSO */ #ifdef CONFIG_CPU_UNRET_ENTRY
@@ -314,9 +316,7 @@ __EXPORT_THUNK(retbleed_untrain_ret) #if defined(CONFIG_CPU_UNRET_ENTRY) || defined(CONFIG_CPU_SRSO) SYM_FUNC_START(entry_untrain_ret) - ALTERNATIVE_2 JMP_RETBLEED_UNTRAIN_RET, \ - JMP_SRSO_UNTRAIN_RET, X86_FEATURE_SRSO, \ - JMP_SRSO_ALIAS_UNTRAIN_RET, X86_FEATURE_SRSO_ALIAS + ALTERNATIVE JMP_RETBLEED_UNTRAIN_RET, JMP_SRSO_UNTRAIN_RET, X86_FEATURE_SRSO SYM_FUNC_END(entry_untrain_ret) __EXPORT_THUNK(entry_untrain_ret)
Greg Kroah-Hartman
maintainerPATCH 94/252 netfilter: nf_tables: reject new basechain after table flag update
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
commit 994209ddf4f430946f6247616b2e33d179243769 upstream.
When dormant flag is toggled, hooks are disabled in the commit phase by iterating over current chains in table (existing and new).
The following configuration allows for an inconsistent state:
add table x
add chain x y { type filter hook input priority 0; } add table x { flags dormant; }
add chain x w { type filter hook input priority 1; }
which triggers the following warning when trying to unregister chain w which is already unregistered.
[ 127.322252] WARNING: CPU: 7 PID: 1211 at net/netfilter/core.c:50 1 __nf_unregister_net_hook+0x21a/0x260 [...] [ 127.322519] Call Trace: [ 127.322521] <TASK> [ 127.322524] ? __warn+0x9f/0x1a0 [ 127.322531] ? __nf_unregister_net_hook+0x21a/0x260 [ 127.322537] ? report_bug+0x1b1/0x1e0 [ 127.322545] ? handle_bug+0x3c/0x70 [ 127.322552] ? exc_invalid_op+0x17/0x40 [ 127.322556] ? asm_exc_invalid_op+0x1a/0x20 [ 127.322563] ? kasan_save_free_info+0x3b/0x60 [ 127.322570] ? __nf_unregister_net_hook+0x6a/0x260 [ 127.322577] ? __nf_unregister_net_hook+0x21a/0x260 [ 127.322583] ? __nf_unregister_net_hook+0x6a/0x260 [ 127.322590] ? __nf_tables_unregister_hook+0x8a/0xe0 [nf_tables] [ 127.322655] nft_table_disable+0x75/0xf0 [nf_tables] [ 127.322717] nf_tables_commit+0x2571/0x2620 [nf_tables]
--- net/netfilter/nf_tables_api.c | 3 +++ 1 file changed, 3 insertions(+)
net/netfilter/nf_tables_api.c +3 -0
@@ -2439,6 +2439,9 @@ static int nf_tables_addchain(struct nftstruct nft_stats __percpu *stats =NULL ;struct nft_chain_hook hook = {}; +if (table->flags & __NFT_TABLE_F_UPDATE) +return -EINVAL ; +if (flags &NFT_CHAIN_BINDING )return -EOPNOTSUPP ;
Greg Kroah-Hartman
maintainerPATCH 95/252 netfilter: nf_tables: flush pending destroy work before exit_net release
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
commit 24cea9677025e0de419989ecb692acd4bb34cac2 upstream.
Similar to 2c9f0293280e ("netfilter: nf_tables: flush pending destroy work before netlink notifier") to address a race between exit_net and the destroy workqueue.
The trace below shows an element to be released via destroy workqueue while exit_net path (triggered via module removal) has already released the set that is used in such transaction.
[ 1360.547789] BUG: KASAN: slab-use-after-free in nf_tables_trans_destroy_work+0x3f5/0x590 [nf_tables] [ 1360.547861] Read of size 8 at addr ffff888140500cc0 by task kworker/4:1/152465 [ 1360.547870] CPU: 4 PID: 152465 Comm: kworker/4:1 Not tainted 6.8.0+ #359 [ 1360.547882] Workqueue: events nf_tables_trans_destroy_work [nf_tables] [ 1360.547984] Call Trace: [ 1360.547991] <TASK> [ 1360.547998] dump_stack_lvl+0x53/0x70 [ 1360.548014] print_report+0xc4/0x610 [ 1360.548026] ? __virt_addr_valid+0xba/0x160 [ 1360.548040] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 1360.548054] ? nf_tables_trans_destroy_work+0x3f5/0x590 [nf_tables] [ 1360.548176] kasan_report+0xae/0xe0 [ 1360.548189] ? nf_tables_trans_destroy_work+0x3f5/0x590 [nf_tables] [ 1360.548312] nf_tables_trans_destroy_work+0x3f5/0x590 [nf_tables] [ 1360.548447] ? __pfx_nf_tables_trans_destroy_work+0x10/0x10 [nf_tables] [ 1360.548577] ? _raw_spin_unlock_irq+0x18/0x30 [ 1360.548591] process_one_work+0x2f1/0x670 [ 1360.548610] worker_thread+0x4d3/0x760 [ 1360.548627] ? __pfx_worker_thread+0x10/0x10 [ 1360.548640] kthread+0x16b/0x1b0 [ 1360.548653] ? __pfx_kthread+0x10/0x10 [ 1360.548665] ret_from_fork+0x2f/0x50 [ 1360.548679] ? __pfx_kthread+0x10/0x10 [ 1360.548690] ret_from_fork_asm+0x1a/0x30 [ 1360.548707] </TASK>
[ 1360.548719] Allocated by task 192061: [ 1360.548726] kasan_save_stack+0x20/0x40 [ 1360.548739] kasan_save_track+0x14/0x30 [ 1360.548750] __kasan_kmalloc+0x8f/0xa0 [ 1360.548760] __kmalloc_node+0x1f1/0x450 [ 1360.548771] nf_tables_newset+0x10c7/0x1b50 [nf_tables] [ 1360.548883] nfnetlink_rcv_batch+0xbc4/0xdc0 [nfnetlink] [ 1360.548909] nfnetlink_rcv+0x1a8/0x1e0 [nfnetlink] [ 1360.548927] netlink_unicast+0x367/0x4f0 [ 1360.548935] netlink_sendmsg+0x34b/0x610 [ 1360.548944] ____sys_sendmsg+0x4d4/0x510 [ 1360.548953] ___sys_sendmsg+0xc9/0x120 [ 1360.548961] __sys_sendmsg+0xbe/0x140 [ 1360.548971] do_syscall_64+0x55/0x120 [ 1360.548982] entry_SYSCALL_64_after_hwframe+0x55/0x5d
[ 1360.548994] Freed by task 192222: [ 1360.548999] kasan_save_stack+0x20/0x40 [ 1360.549009] kasan_save_track+0x14/0x30 [ 1360.549019] kasan_save_free_info+0x3b/0x60 [ 1360.549028] poison_slab_object+0x100/0x180 [ 1360.549036] __kasan_slab_free+0x14/0x30 [ 1360.549042] kfree+0xb6/0x260 [ 1360.549049] __nft_release_table+0x473/0x6a0 [nf_tables] [ 1360.549131] nf_tables_exit_net+0x170/0x240 [nf_tables] [ 1360.549221] ops_exit_list+0x50/0xa0 [ 1360.549229] free_exit_list+0x101/0x140 [ 1360.549236] unregister_pernet_operations+0x107/0x160 [ 1360.549245] unregister_pernet_subsys+0x1c/0x30 [ 1360.549254] nf_tables_module_exit+0x43/0x80 [nf_tables] [ 1360.549345] __do_sys_delete_module+0x253/0x370 [ 1360.549352] do_syscall_64+0x55/0x120 [ 1360.549360] entry_SYSCALL_64_after_hwframe+0x55/0x5d
(gdb) list *__nft_release_table+0x4730x1e033 is in __nft_release_table (net/netfilter/nf_tables_api.c:11354).
11349 list_for_each_entry_safe(flowtable, nf, &table->flowtables, list) {
11350 list_del(&flowtable->list);
11351 nft_use_dec(&table->use);
11352 nf_tables_flowtable_destroy(flowtable);
11353 }
11354 list_for_each_entry_safe(set, ns, &table->sets, list) {
11355 list_del(&set->list);
11356 nft_use_dec(&table->use);
11357 if (set->flags & (NFT_SET_MAP | NFT_SET_OBJECT))11358 nft_map_deactivate(&ctx, set);
(gdb)
[ 1360.549372] Last potentially related work creation: [ 1360.549376] kasan_save_stack+0x20/0x40 [ 1360.549384] __kasan_record_aux_stack+0x9b/0xb0 [ 1360.549392] __queue_work+0x3fb/0x780 [ 1360.549399] queue_work_on+0x4f/0x60 [ 1360.549407] nft_rhash_remove+0x33b/0x340 [nf_tables] [ 1360.549516] nf_tables_commit+0x1c6a/0x2620 [nf_tables] [ 1360.549625] nfnetlink_rcv_batch+0x728/0xdc0 [nfnetlink] [ 1360.549647] nfnetlink_rcv+0x1a8/0x1e0 [nfnetlink] [ 1360.549671] netlink_unicast+0x367/0x4f0 [ 1360.549680] netlink_sendmsg+0x34b/0x610 [ 1360.549690] ____sys_sendmsg+0x4d4/0x510 [ 1360.549697] ___sys_sendmsg+0xc9/0x120 [ 1360.549706] __sys_sendmsg+0xbe/0x140 [ 1360.549715] do_syscall_64+0x55/0x120 [ 1360.549725] entry_SYSCALL_64_after_hwframe+0x55/0x5d
--- net/netfilter/nf_tables_api.c | 1 + 1 file changed, 1 insertion(+)
net/netfilter/nf_tables_api.c +1 -0
@@ -11440,6 +11440,7 @@ static void __exit nf_tables_module_exitunregister_netdevice_notifier (&nf_tables_flowtable_notifier);nft_chain_filter_fini ();nft_chain_route_fini (); +nf_tables_trans_destroy_flush_work ();unregister_pernet_subsys (&nf_tables_net_ops);cancel_work_sync (&trans_gc_work);cancel_work_sync (&trans_destroy_work);
Greg Kroah-Hartman
maintainerPATCH 96/252 netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ziyang Xuan <[email protected]>
commit 24225011d81b471acc0e1e315b7d9905459a6304 upstream.
nft_unregister_flowtable_type() within nf_flow_inet_module_exit() can concurrent with __nft_flowtable_type_get() within nf_tables_newflowtable(). And thhere is not any protection when iterate over nf_tables_flowtables list in __nft_flowtable_type_get(). Therefore, there is pertential data-race of nf_tables_flowtables list entry.
Use list_for_each_entry_rcu() to iterate over nf_tables_flowtables list in __nft_flowtable_type_get(), and use rcu_read_lock() in the caller nft_flowtable_type_get() to protect the entire type query process.
--- net/netfilter/nf_tables_api.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
net/netfilter/nf_tables_api.c +7 -2
@@ -8167,11 +8167,12 @@ static int nft_flowtable_parse_hook(consreturn err; } +/* call under rcu_read_lock */ static const struct nf_flowtable_type *__nft_flowtable_type_get (u8 family) {const struct nf_flowtable_type *type; -list_for_each_entry (type, &nf_tables_flowtables, list) { +list_for_each_entry_rcu (type, &nf_tables_flowtables, list) {if (family == type->family)return type; }
@@ -8183,9 +8184,13 @@ nft_flowtable_type_get(struct net *net, {const struct nf_flowtable_type *type; +rcu_read_lock (); type =__nft_flowtable_type_get (family); -if (type !=NULL &&try_module_get (type->owner)) +if (type !=NULL &&try_module_get (type->owner)) { +rcu_read_unlock ();return type; + } +rcu_read_unlock ();lockdep_nfnl_nft_mutex_not_held ();#ifdef CONFIG_MODULES
Greg Kroah-Hartman
maintainerPATCH 97/252 netfilter: nf_tables: discard table flag update with pending basechain deletion
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
commit 1bc83a019bbe268be3526406245ec28c2458a518 upstream.
Hook unregistration is deferred to the commit phase, same occurs with hook updates triggered by the table dormant flag. When both commands are combined, this results in deleting a basechain while leaving its hook still registered in the core.
--- net/netfilter/nf_tables_api.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
net/netfilter/nf_tables_api.c +5 -4
@@ -1209,10 +1209,11 @@ static bool nft_table_pending_update(conreturn true;list_for_each_entry (trans, &nft_net->commit_list, list) { -if ((trans->msg_type ==NFT_MSG_NEWCHAIN || - trans->msg_type ==NFT_MSG_DELCHAIN ) && - trans->ctx.table == ctx->table && -nft_trans_chain_update (trans)) +if (trans->ctx.table == ctx->table && + ((trans->msg_type ==NFT_MSG_NEWCHAIN && +nft_trans_chain_update (trans)) || + (trans->msg_type ==NFT_MSG_DELCHAIN && +nft_is_base_chain (trans->ctx.chain))))return true; }
Greg Kroah-Hartman
maintainerPATCH 98/252 netfilter: validate user input for expected length
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
commit 0c83842df40f86e529db6842231154772c20edcc upstream.
I got multiple syzbot reports showing old bugs exposed by BPF after commit 20f2505fb436 ("bpf: Try to avoid kzalloc in cgroup/{s,g}etsockopt")
setsockopt() @optlen argument should be taken into account before copying data.
BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline] BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline] BUG: KASAN: slab-out-of-bounds in do_replace net/ipv4/netfilter/ip_tables.c:1111 [inline] BUG: KASAN: slab-out-of-bounds in do_ipt_set_ctl+0x902/0x3dd0 net/ipv4/netfilter/ip_tables.c:1627 Read of size 96 at addr ffff88802cd73da0 by task syz-executor.4/7238 CPU: 1 PID: 7238 Comm: syz-executor.4 Not tainted 6.9.0-rc2-next-20240403-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189 __asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105 copy_from_sockptr_offset include/linux/sockptr.h:49 [inline] copy_from_sockptr include/linux/sockptr.h:55 [inline] do_replace net/ipv4/netfilter/ip_tables.c:1111 [inline] do_ipt_set_ctl+0x902/0x3dd0 net/ipv4/netfilter/ip_tables.c:1627 nf_setsockopt+0x295/0x2c0 net/netfilter/nf_sockopt.c:101 do_sock_setsockopt+0x3af/0x720 net/socket.c:2311 __sys_setsockopt+0x1ae/0x250 net/socket.c:2334 __do_sys_setsockopt net/socket.c:2343 [inline] __se_sys_setsockopt net/socket.c:2340 [inline] __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x72/0x7a RIP: 0033:0x7fd22067dde9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd21f9ff0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 00007fd2207abf80 RCX: 00007fd22067dde9 RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 00007fd2206ca47a R08: 0000000000000001 R09: 0000000000000000 R10: 0000000020000880 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007fd2207abf80 R15: 00007ffd2d0170d8 </TASK> Allocated by task 7238: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:370 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387 kasan_kmalloc include/linux/kasan.h:211 [inline] __do_kmalloc_node mm/slub.c:4069 [inline] __kmalloc_noprof+0x200/0x410 mm/slub.c:4082 kmalloc_noprof include/linux/slab.h:664 [inline] __cgroup_bpf_run_filter_setsockopt+0xd47/0x1050 kernel/bpf/cgroup.c:1869 do_sock_setsockopt+0x6b4/0x720 net/socket.c:2293 __sys_setsockopt+0x1ae/0x250 net/socket.c:2334 __do_sys_setsockopt net/socket.c:2343 [inline] __se_sys_setsockopt net/socket.c:2340 [inline] __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x72/0x7a The buggy address belongs to the object at ffff88802cd73da0 which belongs to the cache kmalloc-8 of size 8
The buggy address is located 0 bytes inside of
allocated 1-byte region [ffff88802cd73da0, ffff88802cd73da1)
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88802cd73020 pfn:0x2cd73
flags: 0xfff80000000000(node=0|zone=1|lastcpupid=0xfff)
page_type: 0xffffefff(slab)
raw: 00fff80000000000 ffff888015041280 dead000000000100 dead000000000122
raw: ffff88802cd73020 000000008080007f 00000001ffffefff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 5103, tgid 2119833701 (syz-executor.4), ts 5103, free_ts 70804600828
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1490
prep_new_page mm/page_alloc.c:1498 [inline]
get_page_from_freelist+0x2e7e/0x2f40 mm/page_alloc.c:3454
__alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4712
__alloc_pages_node_noprof include/linux/gfp.h:244 [inline]
alloc_pages_node_noprof include/linux/gfp.h:271 [inline]
alloc_slab_page+0x5f/0x120 mm/slub.c:2249
allocate_slab+0x5a/0x2e0 mm/slub.c:2412
new_slab mm/slub.c:2465 [inline]
___slab_alloc+0xcd1/0x14b0 mm/slub.c:3615
__slab_alloc+0x58/0xa0 mm/slub.c:3705
__slab_alloc_node mm/slub.c:3758 [inline]
slab_alloc_node mm/slub.c:3936 [inline]
__do_kmalloc_node mm/slub.c:4068 [inline]
kmalloc_node_track_caller_noprof+0x286/0x450 mm/slub.c:4089
kstrdup+0x3a/0x80 mm/util.c:62
device_rename+0xb5/0x1b0 drivers/base/core.c:4558
dev_change_name+0x275/0x860 net/core/dev.c:1232
do_setlink+0xa4b/0x41f0 net/core/rtnetlink.c:2864
__rtnl_newlink net/core/rtnetlink.c:3680 [inline]
rtnl_newlink+0x180b/0x20a0 net/core/rtnetlink.c:3727
rtnetlink_rcv_msg+0x89b/0x10d0 net/core/rtnetlink.c:6594
netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2559
netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]
netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1361
page last free pid 5146 tgid 5146 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1110 [inline]
free_unref_page+0xd3c/0xec0 mm/page_alloc.c:2617
discard_slab mm/slub.c:2511 [inline]
__put_partials+0xeb/0x130 mm/slub.c:2980
put_cpu_partial+0x17c/0x250 mm/slub.c:3055
__slab_free+0x2ea/0x3d0 mm/slub.c:4254
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x9e/0x140 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x14f/0x170 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x23/0x80 mm/kasan/common.c:322
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slub.c:3888 [inline]
slab_alloc_node mm/slub.c:3948 [inline]
__do_kmalloc_node mm/slub.c:4068 [inline]
__kmalloc_node_noprof+0x1d7/0x450 mm/slub.c:4076
kmalloc_node_noprof include/linux/slab.h:681 [inline]
kvmalloc_node_noprof+0x72/0x190 mm/util.c:634
bucket_table_alloc lib/rhashtable.c:186 [inline]
rhashtable_rehash_alloc+0x9e/0x290 lib/rhashtable.c:367
rht_deferred_worker+0x4e1/0x2440 lib/rhashtable.c:427
process_one_work kernel/workqueue.c:3218 [inline]
process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3299
worker_thread+0x86d/0xd70 kernel/workqueue.c:3380
kthread+0x2f0/0x390 kernel/kthread.c:388
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
Memory state around the buggy address:
ffff88802cd73c80: 07 fc fc fc 05 fc fc fc 05 fc fc fc fa fc fc fc
ffff88802cd73d00: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc
>ffff88802cd73d80: fa fc fc fc 01 fc fc fc fa fc fc fc fa fc fc fc
^
ffff88802cd73e00: fa fc fc fc fa fc fc fc 05 fc fc fc 07 fc fc fc
ffff88802cd73e80: 07 fc fc fc 07 fc fc fc 07 fc fc fc 07 fc fc fc--- net/bridge/netfilter/ebtables.c | 6 ++++++ net/ipv4/netfilter/arp_tables.c | 4 ++++ net/ipv4/netfilter/ip_tables.c | 4 ++++ net/ipv6/netfilter/ip6_tables.c | 4 ++++ 4 files changed, 18 insertions(+)
net/bridge/netfilter/ebtables.c +6 -0
@@ -1111,6 +1111,8 @@ static int do_replace(struct net *net, sstruct ebt_table_info *newinfo;struct ebt_replace tmp; +if (len <sizeof (tmp)) +return -EINVAL ;if (copy_from_sockptr (&tmp, arg,sizeof (tmp)) !=0 )return -EFAULT ;
@@ -1423,6 +1425,8 @@ static int update_counters(struct net *n {struct ebt_replace hlp; +if (len <sizeof (hlp)) +return -EINVAL ;if (copy_from_sockptr (&hlp, arg,sizeof (hlp)))return -EFAULT ;
@@ -2352,6 +2356,8 @@ static int compat_update_counters(struct {struct compat_ebt_replace hlp; +if (len <sizeof (hlp)) +return -EINVAL ;if (copy_from_sockptr (&hlp, arg,sizeof (hlp)))return -EFAULT ;
net/ipv4/netfilter/arp_tables.c +4 -0
@@ -956,6 +956,8 @@ static int do_replace(struct net *net, svoid *loc_cpu_entry;struct arpt_entry *iter; +if (len <sizeof (tmp)) +return -EINVAL ;if (copy_from_sockptr (&tmp, arg,sizeof (tmp)) !=0 )return -EFAULT ;
@@ -1254,6 +1256,8 @@ static int compat_do_replace(struct netvoid *loc_cpu_entry;struct arpt_entry *iter; +if (len <sizeof (tmp)) +return -EINVAL ;if (copy_from_sockptr (&tmp, arg,sizeof (tmp)) !=0 )return -EFAULT ;
net/ipv4/netfilter/ip_tables.c +4 -0
@@ -1108,6 +1108,8 @@ do_replace(struct net *net, sockptr_t arvoid *loc_cpu_entry;struct ipt_entry *iter; +if (len <sizeof (tmp)) +return -EINVAL ;if (copy_from_sockptr (&tmp, arg,sizeof (tmp)) !=0 )return -EFAULT ;
@@ -1492,6 +1494,8 @@ compat_do_replace(struct net *net, sockpvoid *loc_cpu_entry;struct ipt_entry *iter; +if (len <sizeof (tmp)) +return -EINVAL ;if (copy_from_sockptr (&tmp, arg,sizeof (tmp)) !=0 )return -EFAULT ;
net/ipv6/netfilter/ip6_tables.c +4 -0
@@ -1125,6 +1125,8 @@ do_replace(struct net *net, sockptr_t arvoid *loc_cpu_entry;struct ip6t_entry *iter; +if (len <sizeof (tmp)) +return -EINVAL ;if (copy_from_sockptr (&tmp, arg,sizeof (tmp)) !=0 )return -EFAULT ;
@@ -1501,6 +1503,8 @@ compat_do_replace(struct net *net, sockpvoid *loc_cpu_entry;struct ip6t_entry *iter; +if (len <sizeof (tmp)) +return -EINVAL ;if (copy_from_sockptr (&tmp, arg,sizeof (tmp)) !=0 )return -EFAULT ;
Greg Kroah-Hartman
maintainerPATCH 99/252 vboxsf: Avoid an spurious warning if load_nls_xxx() fails
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
commit de3f64b738af57e2732b91a0774facc675b75b54 upstream.
If an load_nls_xxx() function fails a few lines above, the 'sbi->bdi_id' is still 0.
So, in the error handling path, we will call ida_simple_remove(..., 0) which is not allocated yet.
In order to prevent a spurious "ida_free called for id=0 which is not allocated." message, tweak the error handling path and add a new label.
--- fs/vboxsf/super.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/vboxsf/super.c +2 -1
@@ -151,7 +151,7 @@ static int vboxsf_fill_super(struct supeif (!sbi->nls) {vbg_err ("vboxsf: Count not load '%s' nls\n" , nls_name); err = -EINVAL ; - goto fail_free; + goto fail_destroy_idr; } }
@@ -224,6 +224,7 @@ fail_free:ida_simple_remove (&vboxsf_bdi_ida, sbi->bdi_id);if (sbi->nls)unload_nls (sbi->nls); +fail_destroy_idr:idr_destroy (&sbi->ino_idr);kfree (sbi);return err;
Greg Kroah-Hartman
maintainerPATCH 100/252 bpf, sockmap: Prevent lock inversion deadlock in map delete elem
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Sitnicki <[email protected]>
commit ff91059932401894e6c86341915615c5eb0eca48 upstream.
syzkaller started using corpuses where a BPF tracing program deletes elements from a sockmap/sockhash map. Because BPF tracing programs can be invoked from any interrupt context, locks taken during a map_delete_elem operation must be hardirq-safe. Otherwise a deadlock due to lock inversion is possible, as reported by lockdep:
CPU0 CPU1
---- ----
lock(&htab->buckets[i].lock);
local_irq_disable();
lock(&host->lock);
lock(&htab->buckets[i].lock);
<Interrupt>
lock(&host->lock);Locks in sockmap are hardirq-unsafe by design. We expects elements to be deleted from sockmap/sockhash only in task (normal) context with interrupts enabled, or in softirq context.
Detect when map_delete_elem operation is invoked from a context which is _not_ hardirq-unsafe, that is interrupts are disabled, and bail out with an error.
Note that map updates are not affected by this issue. BPF verifier does not allow updating sockmap/sockhash from a BPF tracing program today.
--- net/core/sock_map.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/core/sock_map.c +6 -0
@@ -411,6 +411,9 @@ static int __sock_map_delete(struct bpf_struct sock *sk;int err =0 ; +if (irqs_disabled ()) +return -EOPNOTSUPP ;/* locks here are hardirq-unsafe */ +spin_lock_bh (&stab->lock); sk = *psk;if (!sk_test || sk_test == sk)
@@ -933,6 +936,9 @@ static long sock_hash_delete_elem(structstruct bpf_shtab_elem *elem;int ret = -ENOENT ; +if (irqs_disabled ()) +return -EOPNOTSUPP ;/* locks here are hardirq-unsafe */ + hash =sock_hash_bucket_hash (key, key_size); bucket =sock_hash_select_bucket (htab, hash);
Greg Kroah-Hartman
maintainerPATCH 101/252 x86/retpoline: Do the necessary fixup to the Zen3/4 srso return thunk for !SRSO
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov (AMD) <[email protected]>
commit 0e110732473e14d6520e49d75d2c88ef7d46fe67 upstream.
The srso_alias_untrain_ret() dummy thunk in the !CONFIG_MITIGATION_SRSO case is there only for the altenative in CALL_UNTRAIN_RET to have a symbol to resolve.
However, testing with kernels which don't have CONFIG_MITIGATION_SRSO enabled, leads to the warning in patch_return() to fire:
missing return thunk: srso_alias_untrain_ret+0x0/0x10-0x0: eb 0e 66 66 2e
WARNING: CPU: 0 PID: 0 at arch/x86/kernel/alternative.c:826 apply_returns (arch/x86/kernel/alternative.c:826
Put in a plain "ret" there so that gcc doesn't put a return thunk in in its place which special and gets checked.
In addition:
ERROR: modpost: "srso_alias_untrain_ret" [arch/x86/kvm/kvm-amd.ko] undefined! make[2]: *** [scripts/Makefile.modpost:145: Module.symvers] Chyba 1 make[1]: *** [/usr/src/linux-6.8.3/Makefile:1873: modpost] Chyba 2
make: *** [Makefile:240: __sub-make] Chyba 2
since !SRSO builds would use the dummy return thunk as reported by [email protected], https://bugzilla.kernel.org/show_bug.cgi?id=218679.
--- arch/x86/lib/retpoline.S | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
arch/x86/lib/retpoline.S +4 -1
@@ -222,8 +222,11 @@ SYM_CODE_END(srso_return_thunk) #define JMP_SRSO_UNTRAIN_RET "ud2" /* Dummy for the alternative in CALL_UNTRAIN_RET. */ SYM_CODE_START(srso_alias_untrain_ret) - RET + ANNOTATE_UNRET_SAFE + ret + int3 SYM_FUNC_END(srso_alias_untrain_ret) +__EXPORT_THUNK(srso_alias_untrain_ret) #endif /* CONFIG_CPU_SRSO */ #ifdef CONFIG_CPU_UNRET_ENTRY
Greg Kroah-Hartman
maintainerPATCH 102/252 KVM: arm64: Ensure target address is granule-aligned for range TLBI
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <[email protected]>
commit 4c36a156738887c1edd78589fe192d757989bcde upstream.
When zapping a table entry in stage2_try_break_pte(), we issue range TLB invalidation for the region that was mapped by the table. However, we neglect to align the base address down to the granule size and so if we ended up reaching the table entry via a misaligned address then we will accidentally skip invalidation for some prefix of the affected address range.
Align 'ctx->addr' down to the granule size when performing TLB invalidation for an unmapped table in stage2_try_break_pte().
--- arch/arm64/kvm/hyp/pgtable.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
arch/arm64/kvm/hyp/pgtable.c +7 -4
@@ -805,12 +805,15 @@ static bool stage2_try_break_pte(const s* Perform the appropriate TLB invalidation based on the * evicted pte value (if any). */ -if (kvm_pte_table (ctx->old, ctx->level)) -kvm_tlb_flush_vmid_range (mmu, ctx->addr, -kvm_granule_size (ctx->level)); -else if (kvm_pte_valid (ctx->old)) +if (kvm_pte_table (ctx->old, ctx->level)) { +u64 size =kvm_granule_size (ctx->level); +u64 addr =ALIGN_DOWN (ctx->addr, size); + +kvm_tlb_flush_vmid_range (mmu, addr, size); + }else if (kvm_pte_valid (ctx->old)) {kvm_call_hyp (__kvm_tlb_flush_vmid_ipa, mmu, ctx->addr, ctx->level); + } }if (stage2_pte_is_counted (ctx->old))
Greg Kroah-Hartman
maintainerPATCH 103/252 net/sched: act_skbmod: prevent kernel-infoleak
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
commit d313eb8b77557a6d5855f42d2234bd592c7b50dd upstream.
syzbot found that tcf_skbmod_dump() was copying four bytes from kernel stack to user space [1].
The issue here is that 'struct tc_skbmod' has a four bytes hole.
We need to clear the structure before filling fields.
[1]
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline] BUG: KMSAN: kernel-infoleak in copy_to_user_iter lib/iov_iter.c:24 [inline] BUG: KMSAN: kernel-infoleak in iterate_ubuf include/linux/iov_iter.h:29 [inline] BUG: KMSAN: kernel-infoleak in iterate_and_advance2 include/linux/iov_iter.h:245 [inline] BUG: KMSAN: kernel-infoleak in iterate_and_advance include/linux/iov_iter.h:271 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x366/0x2520 lib/iov_iter.c:185 instrument_copy_to_user include/linux/instrumented.h:114 [inline] copy_to_user_iter lib/iov_iter.c:24 [inline] iterate_ubuf include/linux/iov_iter.h:29 [inline] iterate_and_advance2 include/linux/iov_iter.h:245 [inline] iterate_and_advance include/linux/iov_iter.h:271 [inline] _copy_to_iter+0x366/0x2520 lib/iov_iter.c:185 copy_to_iter include/linux/uio.h:196 [inline] simple_copy_to_iter net/core/datagram.c:532 [inline] __skb_datagram_iter+0x185/0x1000 net/core/datagram.c:420 skb_copy_datagram_iter+0x5c/0x200 net/core/datagram.c:546 skb_copy_datagram_msg include/linux/skbuff.h:4050 [inline] netlink_recvmsg+0x432/0x1610 net/netlink/af_netlink.c:1962 sock_recvmsg_nosec net/socket.c:1046 [inline] sock_recvmsg+0x2c4/0x340 net/socket.c:1068 __sys_recvfrom+0x35a/0x5f0 net/socket.c:2242 __do_sys_recvfrom net/socket.c:2260 [inline] __se_sys_recvfrom net/socket.c:2256 [inline] __x64_sys_recvfrom+0x126/0x1d0 net/socket.c:2256 do_syscall_64+0xd5/0x1f0 entry_SYSCALL_64_after_hwframe+0x6d/0x75
Uninit was stored to memory at:
pskb_expand_head+0x30f/0x19d0 net/core/skbuff.c:2253 netlink_trim+0x2c2/0x330 net/netlink/af_netlink.c:1317 netlink_unicast+0x9f/0x1260 net/netlink/af_netlink.c:1351 nlmsg_unicast include/net/netlink.h:1144 [inline] nlmsg_notify+0x21d/0x2f0 net/netlink/af_netlink.c:2610 rtnetlink_send+0x73/0x90 net/core/rtnetlink.c:741 rtnetlink_maybe_send include/linux/rtnetlink.h:17 [inline] tcf_add_notify net/sched/act_api.c:2048 [inline] tcf_action_add net/sched/act_api.c:2071 [inline] tc_ctl_action+0x146e/0x19d0 net/sched/act_api.c:2119 rtnetlink_rcv_msg+0x1737/0x1900 net/core/rtnetlink.c:6595 netlink_rcv_skb+0x375/0x650 net/netlink/af_netlink.c:2559 rtnetlink_rcv+0x34/0x40 net/core/rtnetlink.c:6613 netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline] netlink_unicast+0xf4c/0x1260 net/netlink/af_netlink.c:1361 netlink_sendmsg+0x10df/0x11f0 net/netlink/af_netlink.c:1905 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:745 ____sys_sendmsg+0x877/0xb60 net/socket.c:2584 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638 __sys_sendmsg net/socket.c:2667 [inline] __do_sys_sendmsg net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline] __x64_sys_sendmsg+0x307/0x4a0 net/socket.c:2674 do_syscall_64+0xd5/0x1f0 entry_SYSCALL_64_after_hwframe+0x6d/0x75
Uninit was stored to memory at:
__nla_put lib/nlattr.c:1041 [inline] nla_put+0x1c6/0x230 lib/nlattr.c:1099 tcf_skbmod_dump+0x23f/0xc20 net/sched/act_skbmod.c:256 tcf_action_dump_old net/sched/act_api.c:1191 [inline] tcf_action_dump_1+0x85e/0x970 net/sched/act_api.c:1227 tcf_action_dump+0x1fd/0x460 net/sched/act_api.c:1251 tca_get_fill+0x519/0x7a0 net/sched/act_api.c:1628 tcf_add_notify_msg net/sched/act_api.c:2023 [inline] tcf_add_notify net/sched/act_api.c:2042 [inline] tcf_action_add net/sched/act_api.c:2071 [inline] tc_ctl_action+0x1365/0x19d0 net/sched/act_api.c:2119 rtnetlink_rcv_msg+0x1737/0x1900 net/core/rtnetlink.c:6595 netlink_rcv_skb+0x375/0x650 net/netlink/af_netlink.c:2559 rtnetlink_rcv+0x34/0x40 net/core/rtnetlink.c:6613 netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline] netlink_unicast+0xf4c/0x1260 net/netlink/af_netlink.c:1361 netlink_sendmsg+0x10df/0x11f0 net/netlink/af_netlink.c:1905 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:745 ____sys_sendmsg+0x877/0xb60 net/socket.c:2584 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638 __sys_sendmsg net/socket.c:2667 [inline] __do_sys_sendmsg net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline] __x64_sys_sendmsg+0x307/0x4a0 net/socket.c:2674 do_syscall_64+0xd5/0x1f0 entry_SYSCALL_64_after_hwframe+0x6d/0x75
Local variable opt created at:
tcf_skbmod_dump+0x9d/0xc20 net/sched/act_skbmod.c:244 tcf_action_dump_old net/sched/act_api.c:1191 [inline] tcf_action_dump_1+0x85e/0x970 net/sched/act_api.c:1227
Bytes 188-191 of 248 are uninitialized Memory access of size 248 starts at ffff888117697680 Data copied to user address 00007ffe56d855f0
--- net/sched/act_skbmod.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
net/sched/act_skbmod.c +5 -5
@@ -241,13 +241,13 @@ static int tcf_skbmod_dump(struct sk_bufstruct tcf_skbmod *d =to_skbmod (a);unsigned char *b =skb_tail_pointer (skb);struct tcf_skbmod_params *p; -struct tc_skbmod opt = { - .index = d->tcf_index, - .refcnt =refcount_read (&d->tcf_refcnt) - ref, - .bindcnt =atomic_read (&d->tcf_bindcnt) - bind, - }; +struct tc_skbmod opt;struct tcf_t t; +memset (&opt,0 ,sizeof (opt)); + opt.index = d->tcf_index; + opt.refcnt =refcount_read (&d->tcf_refcnt) - ref, + opt.bindcnt =atomic_read (&d->tcf_bindcnt) - bind;spin_lock_bh (&d->tcf_lock); opt.action = d->tcf_action; p = rcu_dereference_protected(d->skbmod_p,
Greg Kroah-Hartman
maintainerPATCH 104/252 net: dsa: sja1105: Fix parameters order in sja1110_pcs_mdio_write_c45()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
commit c120209bce34c49dcaba32f15679574327d09f63 upstream.
The definition and declaration of sja1110_pcs_mdio_write_c45() don't have parameters in the same order.
Knowing that sja1110_pcs_mdio_write_c45() is used as a function pointer in 'sja1105_info' structure with .pcs_mdio_write_c45, and that we have:
int (*pcs_mdio_write_c45)(struct mii_bus *bus, int phy, int mmd,
int reg, u16 val);
it is likely that the definition is the one to change.
Found with cppcheck, funcArgOrderDifferent.
--- drivers/net/dsa/sja1105/sja1105_mdio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/dsa/sja1105/sja1105_mdio.c +1 -1
@@ -94,7 +94,7 @@ int sja1110_pcs_mdio_read_c45(struct miireturn tmp &0xffff ; } -int sja1110_pcs_mdio_write_c45 (struct mii_bus *bus,int phy,int reg,int mmd, +int sja1110_pcs_mdio_write_c45 (struct mii_bus *bus,int phy,int mmd,int reg,u16 val) {struct sja1105_mdio_private *mdio_priv = bus->priv;
Greg Kroah-Hartman
maintainerPATCH 105/252 net/sched: fix lockdep splat in qdisc_tree_reduce_backlog()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
commit 7eb322360b0266481e560d1807ee79e0cef5742b upstream.
qdisc_tree_reduce_backlog() is called with the qdisc lock held, not RTNL.
We must use qdisc_lookup_rcu() instead of qdisc_lookup()
syzbot reported:
WARNING: suspicious RCU usage
6.1.74-syzkaller #0 Not tainted
-----------------------------net/sched/sch_api.c:305 suspicious rcu_dereference_protected() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
3 locks held by udevd/1142:
#0: ffffffff87c729a0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:306 [inline] #0: ffffffff87c729a0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:747 [inline] #0: ffffffff87c729a0 (rcu_read_lock){....}-{1:2}, at: net_tx_action+0x64a/0x970 net/core/dev.c:5282 #1: ffff888171861108 (&sch->q.lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:350 [inline] #1: ffff888171861108 (&sch->q.lock){+.-.}-{2:2}, at: net_tx_action+0x754/0x970 net/core/dev.c:5297 #2: ffffffff87c729a0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:306 [inline] #2: ffffffff87c729a0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:747 [inline] #2: ffffffff87c729a0 (rcu_read_lock){....}-{1:2}, at: qdisc_tree_reduce_backlog+0x84/0x580 net/sched/sch_api.c:792
stack backtrace: CPU: 1 PID: 1142 Comm: udevd Not tainted 6.1.74-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 Call Trace: <TASK> [<ffffffff85b85f14>] __dump_stack lib/dump_stack.c:88 [inline] [<ffffffff85b85f14>] dump_stack_lvl+0x1b1/0x28f lib/dump_stack.c:106 [<ffffffff85b86007>] dump_stack+0x15/0x1e lib/dump_stack.c:113 [<ffffffff81802299>] lockdep_rcu_suspicious+0x1b9/0x260 kernel/locking/lockdep.c:6592 [<ffffffff84f0054c>] qdisc_lookup+0xac/0x6f0 net/sched/sch_api.c:305 [<ffffffff84f037c3>] qdisc_tree_reduce_backlog+0x243/0x580 net/sched/sch_api.c:811 [<ffffffff84f5b78c>] pfifo_tail_enqueue+0x32c/0x4b0 net/sched/sch_fifo.c:51 [<ffffffff84fbcf63>] qdisc_enqueue include/net/sch_generic.h:833 [inline] [<ffffffff84fbcf63>] netem_dequeue+0xeb3/0x15d0 net/sched/sch_netem.c:723 [<ffffffff84eecab9>] dequeue_skb net/sched/sch_generic.c:292 [inline] [<ffffffff84eecab9>] qdisc_restart net/sched/sch_generic.c:397 [inline] [<ffffffff84eecab9>] __qdisc_run+0x249/0x1e60 net/sched/sch_generic.c:415 [<ffffffff84d7aa96>] qdisc_run+0xd6/0x260 include/net/pkt_sched.h:125 [<ffffffff84d85d29>] net_tx_action+0x7c9/0x970 net/core/dev.c:5313 [<ffffffff85e002bd>] __do_softirq+0x2bd/0x9bd kernel/softirq.c:616 [<ffffffff81568bca>] invoke_softirq kernel/softirq.c:447 [inline] [<ffffffff81568bca>] __irq_exit_rcu+0xca/0x230 kernel/softirq.c:700 [<ffffffff81568ae9>] irq_exit_rcu+0x9/0x20 kernel/softirq.c:712 [<ffffffff85b89f52>] sysvec_apic_timer_interrupt+0x42/0x90 arch/x86/kernel/apic/apic.c:1107 [<ffffffff85c00ccb>] asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:656
--- net/sched/sch_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sched/sch_api.c +1 -1
@@ -809,7 +809,7 @@ void qdisc_tree_reduce_backlog(struct Qd notify = !sch->q.qlen && !WARN_ON_ONCE (!n && !qdisc_is_offloaded);/* TODO: perform the search on a per txq basis */ - sch =qdisc_lookup (qdisc_dev (sch),TC_H_MAJ (parentid)); + sch =qdisc_lookup_rcu (qdisc_dev (sch),TC_H_MAJ (parentid));if (sch ==NULL ) {WARN_ON_ONCE (parentid !=TC_H_ROOT );break ;
Greg Kroah-Hartman
maintainerPATCH 106/252 net: stmmac: fix rx queue priority assignment
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Piotr Wejman <[email protected]>
commit b3da86d432b7cd65b025a11f68613e333d2483db upstream.
The driver should ensure that same priority is not mapped to multiple rx queues. From DesignWare Cores Ethernet Quality-of-Service Databook, section 17.1.29 MAC_RxQ_Ctrl2:
"[...]The software must ensure that the content of this field is mutually exclusive to the PSRQ fields for other queues, that is, the same priority is not mapped to multiple Rx queues[...]"
Previously rx_queue_priority() function was:
- clearing all priorities from a queue
- adding new priorities to that queue
After this patch it will:
- first assign new priorities to a queue
- then remove those priorities from all other queues
- keep other priorities previously assigned to that queue
--- drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 40 +++++++++++++++----- drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 38 +++++++++++++++---- 2 files changed, 62 insertions(+), 16 deletions(-)
drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c +31 -9
@@ -92,19 +92,41 @@ static void dwmac4_rx_queue_priority(str u32 prio, u32 queue) { void __iomem *ioaddr = hw->pcsr; -u32 base_register; -u32 value; +u32 clear_mask =0 ; +u32 ctrl2, ctrl3; +int i; - base_register = (queue <4 ) ?GMAC_RXQ_CTRL2 :GMAC_RXQ_CTRL3 ; -if (queue >=4 ) - queue -=4 ; + ctrl2 =readl (ioaddr +GMAC_RXQ_CTRL2 ); + ctrl3 =readl (ioaddr +GMAC_RXQ_CTRL3 ); + +/* The software must ensure that the same priority +* is not mapped to multiple Rx queues +*/ +for (i =0 ; i <4 ; i++) + clear_mask |= ((prio <<GMAC_RXQCTRL_PSRQX_SHIFT (i)) & +GMAC_RXQCTRL_PSRQX_MASK (i)); - value =readl (ioaddr + base_register); + ctrl2 &= ~clear_mask; + ctrl3 &= ~clear_mask; - value &= ~GMAC_RXQCTRL_PSRQX_MASK (queue); - value |= (prio <<GMAC_RXQCTRL_PSRQX_SHIFT (queue)) & +/* First assign new priorities to a queue, then +* clear them from others queues +*/ +if (queue <4 ) { + ctrl2 |= (prio <<GMAC_RXQCTRL_PSRQX_SHIFT (queue)) &GMAC_RXQCTRL_PSRQX_MASK (queue); -writel (value, ioaddr + base_register); + +writel (ctrl2, ioaddr +GMAC_RXQ_CTRL2 ); +writel (ctrl3, ioaddr +GMAC_RXQ_CTRL3 ); + }else { + queue -=4 ; + + ctrl3 |= (prio <<GMAC_RXQCTRL_PSRQX_SHIFT (queue)) & +GMAC_RXQCTRL_PSRQX_MASK (queue); + +writel (ctrl3, ioaddr +GMAC_RXQ_CTRL3 ); +writel (ctrl2, ioaddr +GMAC_RXQ_CTRL2 ); + } } static void dwmac4_tx_queue_priority(struct mac_device_info *hw,
drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c +31 -7
@@ -105,17 +105,41 @@ static void dwxgmac2_rx_queue_prio(struc u32 queue) {void __iomem *ioaddr = hw->pcsr; -u32 value, reg; +u32 clear_mask =0 ; +u32 ctrl2, ctrl3; +int i; - reg = (queue <4 ) ?XGMAC_RXQ_CTRL2 :XGMAC_RXQ_CTRL3 ; -if (queue >=4 ) + ctrl2 =readl (ioaddr +XGMAC_RXQ_CTRL2 ); + ctrl3 =readl (ioaddr +XGMAC_RXQ_CTRL3 ); + +/* The software must ensure that the same priority +* is not mapped to multiple Rx queues +*/ +for (i =0 ; i <4 ; i++) + clear_mask |= ((prio <<XGMAC_PSRQ_SHIFT (i)) & +XGMAC_PSRQ (i)); + + ctrl2 &= ~clear_mask; + ctrl3 &= ~clear_mask; + +/* First assign new priorities to a queue, then +* clear them from others queues +*/ +if (queue <4 ) { + ctrl2 |= (prio <<XGMAC_PSRQ_SHIFT (queue)) & +XGMAC_PSRQ (queue); + +writel (ctrl2, ioaddr +XGMAC_RXQ_CTRL2 ); +writel (ctrl3, ioaddr +XGMAC_RXQ_CTRL3 ); + }else { queue -=4 ; - value =readl (ioaddr + reg); - value &= ~XGMAC_PSRQ (queue); - value |= (prio <<XGMAC_PSRQ_SHIFT (queue)) &XGMAC_PSRQ (queue); + ctrl3 |= (prio <<XGMAC_PSRQ_SHIFT (queue)) & +XGMAC_PSRQ (queue); -writel (value, ioaddr + reg); +writel (ctrl3, ioaddr +XGMAC_RXQ_CTRL3 ); +writel (ctrl2, ioaddr +XGMAC_RXQ_CTRL2 ); + } } static void dwxgmac2_tx_queue_prio(struct mac_device_info *hw, u32 prio,
Greg Kroah-Hartman
maintainerPATCH 107/252 net: phy: micrel: lan8814: Fix when enabling/disabling 1-step timestamping
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Horatiu Vultur <[email protected]>
commit de99e1ea3a35f23ff83a31d6b08f43d27b2c6345 upstream.
There are 2 issues with the blamed commit.
1. When the phy is initialized, it would enable the disabled of UDPv4 checksums. The UDPv6 checksum is already enabled by default. So when 1-step is configured then it would clear these flags.
2. After the 1-step is configured, then if 2-step is configured then the 1-step would be still configured because it is not clearing the flag. So the sync frames will still have origin timestamps set.
Fix this by reading first the value of the register and then just change bit 12 as this one determines if the timestamp needs to be inserted in the frame, without changing any other bits.
--- drivers/net/phy/micrel.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/net/phy/micrel.c +8 -2
@@ -2388,6 +2388,7 @@ static int lan8814_hwtstamp(struct mii_tstruct hwtstamp_config config;int txcfg =0 , rxcfg =0 ;int pkt_ts_enable; +int tx_mod;if (copy_from_user (&config, ifr->ifr_data,sizeof (config)))return -EFAULT ;
@@ -2437,9 +2438,14 @@ static int lan8814_hwtstamp(struct mii_tlanphy_write_page_reg (ptp_priv->phydev,5 ,PTP_RX_TIMESTAMP_EN , pkt_ts_enable);lanphy_write_page_reg (ptp_priv->phydev,5 ,PTP_TX_TIMESTAMP_EN , pkt_ts_enable); -if (ptp_priv->hwts_tx_type ==HWTSTAMP_TX_ONESTEP_SYNC ) + tx_mod =lanphy_read_page_reg (ptp_priv->phydev,5 ,PTP_TX_MOD ); +if (ptp_priv->hwts_tx_type ==HWTSTAMP_TX_ONESTEP_SYNC ) {lanphy_write_page_reg (ptp_priv->phydev,5 ,PTP_TX_MOD , -PTP_TX_MOD_TX_PTP_SYNC_TS_INSERT_ ); + tx_mod |PTP_TX_MOD_TX_PTP_SYNC_TS_INSERT_ ); + }else if (ptp_priv->hwts_tx_type ==HWTSTAMP_TX_ON ) { +lanphy_write_page_reg (ptp_priv->phydev,5 ,PTP_TX_MOD , + tx_mod & ~PTP_TX_MOD_TX_PTP_SYNC_TS_INSERT_ ); + }if (config.rx_filter !=HWTSTAMP_FILTER_NONE )lan8814_config_ts_intr (ptp_priv->phydev, true);
Greg Kroah-Hartman
maintainerPATCH 108/252 net: txgbe: fix i2c dev name cannot match clkdev
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Duanqiang Wen <[email protected]>
commit c644920ce9220d83e070f575a4df711741c07f07 upstream.
txgbe clkdev shortened clk_name, so i2c_dev info_name also need to shorten. Otherwise, i2c_dev cannot initialize clock.
--- drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c +5 -3
@@ -20,6 +20,8 @@#include "txgbe_phy.h" #include "txgbe_hw.h" +#define TXGBE_I2C_CLK_DEV_NAME "i2c_dw" +static int txgbe_swnodes_register (struct txgbe *txgbe) {struct txgbe_nodes *nodes = &txgbe->nodes;
@@ -551,8 +553,8 @@ static int txgbe_clock_register(struct tchar clk_name[32 ];struct clk *clk; -snprintf (clk_name,sizeof (clk_name),"i2c_dw.%d" , -pci_dev_id (pdev)); +snprintf (clk_name,sizeof (clk_name),"%s.%d" , +TXGBE_I2C_CLK_DEV_NAME ,pci_dev_id (pdev)); clk =clk_register_fixed_rate (NULL , clk_name,NULL ,0 ,156250000 );if (IS_ERR (clk))
@@ -614,7 +616,7 @@ static int txgbe_i2c_register(struct txg info.parent = &pdev->dev; info.fwnode =software_node_fwnode (txgbe->nodes.group[SWNODE_I2C ]); - info.name ="i2c_designware" ; + info.name =TXGBE_I2C_CLK_DEV_NAME ; info.id =pci_dev_id (pdev); info.res = &DEFINE_RES_IRQ (pdev->irq);
Greg Kroah-Hartman
maintainerPATCH 109/252 net: fec: Set mac_managed_pm during probe
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Fang <[email protected]>
commit cbc17e7802f5de37c7c262204baadfad3f7f99e5 upstream.
Setting mac_managed_pm during interface up is too late.
In situations where the link is not brought up yet and the system suspends the regular PHY power management will run. Since the FEC ETHEREN control bit is cleared (automatically) on suspend the controller is off in resume. When the regular PHY power management resume path runs in this context it will write to the MII_DATA register but nothing will be transmitted on the MDIO bus.
This can be observed by the following log:
fec 5b040000.ethernet eth0: MDIO read timeout
Microchip LAN87xx T1 5b040000.ethernet-1:04: PM: dpm_run_callback(): mdio_bus_phy_resume+0x0/0xc8 returns -110
Microchip LAN87xx T1 5b040000.ethernet-1:04: PM: failed to resume: error -110The data written will however remain in the MII_DATA register.
When the link later is set to administrative up it will trigger a call to fec_restart() which will restore the MII_SPEED register. This triggers the quirk explained in f166f890c8f0 ("net: ethernet: fec: Replace interrupt driven MDIO with polled IO") causing an extra MII_EVENT.
This extra event desynchronizes all the MDIO register reads, causing them to complete too early. Leading all reads to read as 0 because fec_enet_mdio_wait() returns too early.
When a Microchip LAN8700R PHY is connected to the FEC, the 0 reads causes the PHY to be initialized incorrectly and the PHY will not transmit any ethernet signal in this state. It cannot be brought out of this state without a power cycle of the PHY.
--- drivers/net/ethernet/freescale/fec_main.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
drivers/net/ethernet/freescale/fec_main.c +9 -2
@@ -2381,8 +2381,6 @@ static int fec_enet_mii_probe(struct net fep->link =0 ; fep->full_duplex =0 ; - phy_dev->mac_managed_pm = true; -phy_attached_info (phy_dev);return 0 ;
@@ -2394,10 +2392,12 @@ static int fec_enet_mii_init(struct platstruct net_device *ndev =platform_get_drvdata (pdev);struct fec_enet_private *fep =netdev_priv (ndev);bool suppress_preamble = false; +struct phy_device *phydev;struct device_node *node;int err = -ENXIO ;u32 mii_speed, holdtime;u32 bus_freq; +int addr;/* * The i.MX28 dual fec interfaces are not equal.
@@ -2511,6 +2511,13 @@ static int fec_enet_mii_init(struct plat goto err_out_free_mdiobus;of_node_put (node); +/* find all the PHY devices on the bus and set mac_managed_pm to true */ +for (addr =0 ; addr <PHY_MAX_ADDR ; addr++) { + phydev =mdiobus_get_phy (fep->mii_bus, addr); +if (phydev) + phydev->mac_managed_pm = true; + } + mii_cnt++;/* save fec0 mii_bus */
Greg Kroah-Hartman
maintainerPATCH 110/252 net: phy: micrel: Fix potential null pointer dereference
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Mishin <[email protected]>
commit 96c155943a703f0655c0c4cab540f67055960e91 upstream.
In lan8814_get_sig_rx() and lan8814_get_sig_tx() ptp_parse_header() may return NULL as ptp_header due to abnormal packet type or corrupted packet. Fix this bug by adding ptp_header check.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/net/phy/micrel.c | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-)
drivers/net/phy/micrel.c +16 -5
@@ -2503,7 +2503,7 @@ static void lan8814_txtstamp(struct mii_ } } -static void lan8814_get_sig_rx (struct sk_buff *skb,u16 *sig) +static bool lan8814_get_sig_rx (struct sk_buff *skb,u16 *sig) {struct ptp_header *ptp_header;u32 type;
@@ -2513,7 +2513,11 @@ static void lan8814_get_sig_rx(struct sk ptp_header =ptp_parse_header (skb, type);skb_pull_inline (skb,ETH_HLEN ); +if (!ptp_header) +return false; + *sig = (__force u16)(ntohs (ptp_header->sequence_id)); +return true; } static bool lan8814_match_rx_skb(struct kszphy_ptp_priv *ptp_priv,
@@ -2525,7 +2529,8 @@ static bool lan8814_match_rx_skb(structbool ret = false;u16 skb_sig; -lan8814_get_sig_rx (skb, &skb_sig); +if (!lan8814_get_sig_rx (skb, &skb_sig)) +return ret;/* Iterate over all RX timestamps and match it with the received skbs */ spin_lock_irqsave (&ptp_priv->rx_ts_lock, flags);
@@ -2805,7 +2810,7 @@ static int lan8814_ptpci_adjfine(structreturn 0 ; } -static void lan8814_get_sig_tx (struct sk_buff *skb,u16 *sig) +static bool lan8814_get_sig_tx (struct sk_buff *skb,u16 *sig) {struct ptp_header *ptp_header;u32 type;
@@ -2813,7 +2818,11 @@ static void lan8814_get_sig_tx(struct sk type =ptp_classify_raw (skb); ptp_header =ptp_parse_header (skb, type); +if (!ptp_header) +return false; + *sig = (__force u16)(ntohs (ptp_header->sequence_id)); +return true; } static void lan8814_match_tx_skb(struct kszphy_ptp_priv *ptp_priv,
@@ -2827,7 +2836,8 @@ static void lan8814_match_tx_skb(structspin_lock_irqsave (&ptp_priv->tx_queue.lock, flags); skb_queue_walk_safe(&ptp_priv->tx_queue, skb, skb_tmp) { -lan8814_get_sig_tx (skb, &skb_sig); +if (!lan8814_get_sig_tx (skb, &skb_sig)) +continue ;if (memcmp (&skb_sig, &seq_id,sizeof (seq_id)))continue ;
@@ -2881,7 +2891,8 @@ static bool lan8814_match_skb(struct kszspin_lock_irqsave (&ptp_priv->rx_queue.lock, flags); skb_queue_walk_safe(&ptp_priv->rx_queue, skb, skb_tmp) { -lan8814_get_sig_rx (skb, &skb_sig); +if (!lan8814_get_sig_rx (skb, &skb_sig)) +continue ;if (memcmp (&skb_sig, &rx_ts->seq_id,sizeof (rx_ts->seq_id)))continue ;
Greg Kroah-Hartman
maintainerPATCH 111/252 net: dsa: mv88e6xxx: fix usable ports on 88e6020
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Krummsdorf <[email protected]>
commit 625aefac340f45a4fc60908da763f437599a0d6f upstream.
The switch has 4 ports with 2 internal PHYs, but ports are numbered up to 6, with ports 0, 1, 5 and 6 being usable.
--- drivers/net/dsa/mv88e6xxx/chip.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/net/dsa/mv88e6xxx/chip.c +5 -1
@@ -5386,8 +5386,12 @@ static const struct mv88e6xxx_info mv88e .family = MV88E6XXX_FAMILY_6250, .name = "Marvell 88E6020", .num_databases = 64, - .num_ports = 4, +/* Ports 2-4 are not routed to pins +* => usable ports 0, 1, 5, 6 +*/ + .num_ports = 7, .num_internal_phys = 2, + .invalid_port_mask = BIT(2) | BIT(3) | BIT(4), .max_vid = 4095, .port_base_addr = 0x8, .phy_base_addr = 0x0,
Greg Kroah-Hartman
maintainerPATCH 112/252 selftests: net: gro fwd: update vxlan GRO test expectations
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antoine Tenart <[email protected]>
commit 0fb101be97ca27850c5ecdbd1269423ce4d1f607 upstream.
UDP tunnel packets can't be GRO in-between their endpoints as this causes different issues. The UDP GRO fwd vxlan tests were relying on this and their expectations have to be fixed.
We keep both vxlan tests and expected no GRO from happening. The vxlan UDP GRO bench test was removed as it's not providing any valuable information now.
--- tools/testing/selftests/net/udpgro_fwd.sh | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-)
tools/testing/selftests/net/udpgro_fwd.sh +2 -8
@@ -241,7 +241,7 @@ for family in 4 6; do create_vxlan_pair ip netns exec $NS_DST ethtool -K veth$DST rx-gro-list on - run_test "GRO frag list over UDP tunnel" $OL_NET$DST 1 1 + run_test "GRO frag list over UDP tunnel" $OL_NET$DST 10 10 cleanup # use NAT to circumvent GRO FWD check
@@ -254,13 +254,7 @@ for family in 4 6; do # load arp cache before running the test to reduce the amount of # stray traffic on top of the UDP tunnel ip netns exec $NS_SRC $PING -q -c 1 $OL_NET$DST_NAT >/dev/null - run_test "GRO fwd over UDP tunnel" $OL_NET$DST_NAT 1 1 $OL_NET$DST - cleanup - - create_vxlan_pair - run_bench "UDP tunnel fwd perf" $OL_NET$DST - ip netns exec $NS_DST ethtool -K veth$DST rx-udp-gro-forwarding on - run_bench "UDP tunnel GRO fwd perf" $OL_NET$DST + run_test "GRO fwd over UDP tunnel" $OL_NET$DST_NAT 10 10 $OL_NET$DST cleanup done
Greg Kroah-Hartman
maintainerPATCH 113/252 gro: fix ownership transfer
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antoine Tenart <[email protected]>
commit ed4cccef64c1d0d5b91e69f7a8a6697c3a865486 upstream.
If packets are GROed with fraglist they might be segmented later on and continue their journey in the stack. In skb_segment_list those skbs can be reused as-is. This is an issue as their destructor was removed in skb_gro_receive_list but not the reference to their socket, and then they can't be orphaned. Fix this by also removing the reference to the socket.
For example this could be observed,
kernel BUG at include/linux/skbuff.h:3131! (skb_orphan)
RIP: 0010:ip6_rcv_core+0x11bc/0x19a0 Call Trace: ipv6_list_rcv+0x250/0x3f0 __netif_receive_skb_list_core+0x49d/0x8f0 netif_receive_skb_list_internal+0x634/0xd40 napi_complete_done+0x1d2/0x7d0 gro_cell_poll+0x118/0x1f0
A similar construction is found in skb_gro_receive, apply the same change there.
--- net/core/gro.c | 3 ++- net/ipv4/udp_offload.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-)
net/core/gro.c +2 -1
@@ -195,8 +195,9 @@ int skb_gro_receive(struct sk_buff *p, s } merge: -/* sk owenrship - if any - completely transferred to the aggregated packet */ +/* sk ownership - if any - completely transferred to the aggregated packet */ skb->destructor =NULL ; + skb->sk =NULL ; delta_truesize = skb->truesize;if (offset > headlen) {unsigned int eat = offset - headlen;
net/ipv4/udp_offload.c +2 -1
@@ -449,8 +449,9 @@ static int skb_gro_receive_list(struct sNAPI_GRO_CB (p)->count++; p->data_len += skb->len; -/* sk owenrship - if any - completely transferred to the aggregated packet */ +/* sk ownership - if any - completely transferred to the aggregated packet */ skb->destructor =NULL ; + skb->sk =NULL ; p->truesize += skb->truesize; p->len += skb->len;