6.8.8-rc1 review
Subsystems (4)
Greg Kroah-Hartman
maintainercover 6.8.8-rc1 review
This is the start of the stable review cycle for the 6.8.8 release. There are 158 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 25 Apr 2024 21:38:28 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.8.8-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.8.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.8.8-rc1
Namjae Jeon <[email protected]>
ksmbd: common: use struct_group_attr instead of struct_group for network_open_info
Marios Makassikis <[email protected]>
ksmbd: clear RENAME_NOREPLACE before calling vfs_rename
Namjae Jeon <[email protected]>
ksmbd: validate request buffer size in smb2_allocate_rsp_buf()
Namjae Jeon <[email protected]>
ksmbd: fix slab-out-of-bounds in smb2_allocate_rsp_buf
Arınç ÜNAL <[email protected]>
net: dsa: mt7530: fix enabling EEE on MT7531 switch on all boards
Arınç ÜNAL <[email protected]>
net: dsa: mt7530: fix improper frames on all 25MHz and 40MHz XTAL MT7530
Miaohe Lin <[email protected]>
fork: defer linking file vma until vma is fully initialized
Jeongjun Park <[email protected]>
nilfs2: fix OOB in nilfs_set_de_type
Phillip Lougher <[email protected]>
Squashfs: check the inode number is not the invalid value of zero
Qiang Zhang <[email protected]>
bootconfig: use memblock_free_late to free xbc memory to buddy
Dave Airlie <[email protected]>
nouveau: fix instmem race condition around ptr stores
Zack Rusin <[email protected]>
drm/vmwgfx: Fix crtc's atomic check conditional
Zack Rusin <[email protected]>
drm/vmwgfx: Sort primary plane formats by order of preference
Zack Rusin <[email protected]>
drm/vmwgfx: Fix prime import/export
Maarten Lankhorst <[email protected]>
drm/xe: Fix bo leak in intel_fb_bo_framebuffer_init
Christian König <[email protected]>
drm/ttm: stop pooling cached NUMA pages v2
Christian König <[email protected]>
drm/amdgpu: remove invalid resource->start check v2
Felix Kuehling <[email protected]>
drm/amdkfd: Fix memory leak in create_process failure
xinhui pan <[email protected]>
drm/amdgpu: validate the parameters of bo mapping operations more clearly
Danny Lin <[email protected]>
fuse: fix leaked ENOSYS error on first statx call
Sumanth Korikkar <[email protected]>
mm/shmem: inline shmem_is_huge() for disabled transparent hugepages
Miaohe Lin <[email protected]>
mm/memory-failure: fix deadlock when hugetlb_optimize_vmemmap is enabled
Oscar Salvador <[email protected]>
mm,swapops: update check in is_pfn_swap_entry for hwpoison entries
Peter Xu <[email protected]>
mm/userfaultfd: allow hugetlb change protection upon poison entry
David Hildenbrand <[email protected]>
mm/madvise: make MADV_POPULATE_(READ|WRITE) handle VM_FAULT_RETRY properly
Yuntao Wang <[email protected]>
init/main.c: Fix potential static_command_line memory overflow
Yaxiong Tian <[email protected]>
arm64: hibernate: Fix level3 translation fault in swsusp_save()
Ard Biesheuvel <[email protected]>
arm64/head: Disable MMU at EL2 before clearing HCR_EL2.E2H
David Matlack <[email protected]>
KVM: x86/mmu: Write-protect L2 SPTEs in TDP MMU when clearing dirty status
Rick Edgecombe <[email protected]>
KVM: x86/mmu: x86: Don't overflow lpage_info when checking attributes
Sandipan Das <[email protected]>
KVM: x86/pmu: Do not mask LVTPC when handling a PMI on AMD platforms
Sean Christopherson <[email protected]>
KVM: x86/pmu: Disable support for adaptive PEBS
Sean Christopherson <[email protected]>
KVM: x86: Snapshot if a vCPU's vendor model is AMD vs. Intel compatible
Mathieu Desnoyers <[email protected]>
sched: Add missing memory barrier in switch_mm_cid
Alan Stern <[email protected]>
fs: sysfs: Fix reference leak in sysfs_break_active_protection()
Samuel Thibault <[email protected]>
speakup: Avoid crash on very long word
Alexander Usyskin <[email protected]>
mei: me: disable RPL-S on SPS and IGN firmwares
Sakari Ailus <[email protected]>
mei: vsc: Unregister interrupt handler for system suspend
Kyle Tso <[email protected]>
usb: typec: tcpm: Correct the PDO counting in pd_set
Norihiko Hama <[email protected]>
usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error
Kai-Heng Feng <[email protected]>
usb: Disable USB3 LPM at shutdown
Minas Harutyunyan <[email protected]>
usb: dwc2: host: Fix dereference issue in DDMA completion flow.
Sakari Ailus <[email protected]>
Revert "mei: vsc: Call wake_up() in the threaded IRQ handler"
Greg Kroah-Hartman <[email protected]>
Revert "usb: cdc-wdm: close race between read and workqueue"
Daniele Palmas <[email protected]>
USB: serial: option: add Telit FN920C04 rmnet compositions
Vanillan Wang <[email protected]>
USB: serial: option: add Rolling RW101-GL and RW135-GL support
Jerry Meng <[email protected]>
USB: serial: option: support Quectel EM060K sub-models
Coia Prant <[email protected]>
USB: serial: option: add Lonsung U8300/U9300 product
Chuanhong Guo <[email protected]>
USB: serial: option: add support for Fibocom FM650/FG650
bolan wang <[email protected]>
USB: serial: option: add Fibocom FM135-GL variants
Tony Lindgren <[email protected]>
serial: core: Fix missing shutdown and startup for serial base port
Andy Shevchenko <[email protected]>
serial: core: Clearing the circular buffer before NULLifying it
Tony Lindgren <[email protected]>
serial: core: Fix regression when runtime PM is not enabled
Uwe Kleine-König <[email protected]>
serial: stm32: Reset .throttled state in .startup()
Uwe Kleine-König <[email protected]>
serial: stm32: Return IRQ_NONE in the ISR if no handling happend
Hans de Goede <[email protected]>
serial: 8250_dw: Revert: Do not reclock if already at correct rate
Finn Thain <[email protected]>
serial/pmac_zilog: Remove flawed mitigation for rx irq flood
Emil Kronborg <[email protected]>
serial: mxs-auart: add spinlock around changing cts state
Nikita Zhandarovich <[email protected]>
comedi: vmk80xx: fix incomplete endpoint checking
Mika Westerberg <[email protected]>
thunderbolt: Do not create DisplayPort tunnels on adapters of the same router
Gil Fine <[email protected]>
thunderbolt: Fix wake configurations after device unplug
Gil Fine <[email protected]>
thunderbolt: Avoid notify PM core about runtime PM resume
Carlos Llamas <[email protected]>
binder: check offset alignment in binder_get_object()
Ricky Wu <[email protected]>
misc: rtsx: Fix rts5264 driver status incorrect when card removed
Fabio Estevam <[email protected]>
usb: misc: onboard_usb_hub: Disable the USB hub clock on failure
Ai Chao <[email protected]>
ALSA: hda/realtek - Enable audio jacks of Haier Boyue G42 with ALC269VC
Mauro Carvalho Chehab <[email protected]>
ALSA: hda/realtek: Add quirks for Huawei Matebook D14 NBLB-WAX9N
Shenghao Ding <[email protected]>
ALSA: hda/tas2781: Add new vendor_id and subsystem_id to support ThinkPad ICE-1
Shenghao Ding <[email protected]>
ALSA: hda/tas2781: correct the register for pow calibrated data
Takashi Iwai <[email protected]>
ALSA: seq: ump: Fix conversion from MIDI2 to MIDI1 UMP messages
Shay Drory <[email protected]>
net/mlx5: E-switch, store eswitch pointer before registering devlink_param
Christoph Hellwig <[email protected]>
block: propagate partition scanning errors to the BLKRRPART ioctl
Eric Biggers <[email protected]>
x86/cpufeatures: Fix dependencies for GFNI, VAES, and VPCLMULQDQ
Josh Poimboeuf <[email protected]>
x86/bugs: Fix BHI retpoline check
Nathan Lynch <[email protected]>
selftests/powerpc/papr-vpd: Fix missing variable initialization
Daniel Golle <[email protected]>
clk: mediatek: mt7988-infracfg: fix clocks for 2nd PCIe port
Pin-yen Lin <[email protected]>
clk: mediatek: Do a runtime PM get on controllers during probe
Stephen Boyd <[email protected]>
clk: Get runtime PM before walking tree for clk_summary
Stephen Boyd <[email protected]>
clk: Get runtime PM before walking tree during disable_unused
Stephen Boyd <[email protected]>
clk: Initialize struct clk_core kref earlier
Stephen Boyd <[email protected]>
clk: Remove prepare_lock hold assertion in __clk_release()
Mike Tipton <[email protected]>
interconnect: Don't access req_list while it's being manipulated
Konrad Dybcio <[email protected]>
interconnect: qcom: x1e80100: Remove inexistent ACV_PERF BCM
Mario Limonciello <[email protected]>
platform/x86/amd/pmc: Extend Framework 13 quirk to more BIOSes
Rafael J. Wysocki <[email protected]>
thermal/debugfs: Add missing count increment to thermal_debug_tz_trip_up()
Huayu Zhang <[email protected]>
ALSA: hda/realtek: Fix volumn control of ThinkBook 16P Gen4
Alex Deucher <[email protected]>
drm/radeon: make -fstrict-flex-arrays=3 happy
Dmitry Baryshkov <[email protected]>
drm/panel: visionox-rm69299: don't unregister DSI device
Sanath S <[email protected]>
thunderbolt: Reset topology created by the boot firmware
Sanath S <[email protected]>
thunderbolt: Make tb_switch_reset() support Thunderbolt 2, 3 and USB4 routers
Sanath S <[email protected]>
thunderbolt: Introduce tb_path_deactivate_hop()
Sanath S <[email protected]>
thunderbolt: Introduce tb_port_reset()
Lokesh Gidra <[email protected]>
userfaultfd: change src_folio after ensuring it's unpinned in UFFDIO_MOVE
Maíra Canal <[email protected]>
drm/v3d: Don't increment enabled_ns twice
Mikhail Kobuk <[email protected]>
drm: nv04: Fix out of bounds access
Muhammad Usama Anjum <[email protected]>
iommufd: Add config needed for iommufd_fail_nth
Jason Gunthorpe <[email protected]>
iommufd: Add missing IOMMUFD_DRIVER kconfig for the selftest
Peter Oberparleiter <[email protected]>
s390/cio: fix race condition during online processing
Peter Oberparleiter <[email protected]>
s390/qdio: handle deferred cc1
Namhyung Kim <[email protected]>
perf lock contention: Add a missing NULL check
Namhyung Kim <[email protected]>
perf annotate: Make sure to call symbol__annotate2() in TUI
Michael Guralnik <[email protected]>
RDMA/mlx5: Fix port number for counter query in multi-port configuration
Mark Zhang <[email protected]>
RDMA/cm: Print the old state when cm_destroy_id gets timeout
Yanjun.Zhu <[email protected]>
RDMA/rxe: Fix the problem "mutex_destroy missing"
Vasily Gorbik <[email protected]>
NFSD: fix endianness issue in nfsd4_encode_fattr4
Siddharth Vadapalli <[email protected]>
net: ethernet: ti: am65-cpsw-nuss: cleanup DMA Channels before using them
Paul Barker <[email protected]>
net: ravb: Allow RX loop to move past DMA mapping errors
Paul Barker <[email protected]>
net: ravb: Count packets instead of descriptors in R-Car RX path
Niklas Söderlund <[email protected]>
ravb: Group descriptor types used in Rx ring
Felix Fietkau <[email protected]>
net: ethernet: mtk_eth_soc: fix WED + wifi reset
Eric Dumazet <[email protected]>
net/sched: Fix mirred deadlock on device recursion
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: fix memleak in map from abort path
Andy Shevchenko <[email protected]>
gpiolib: swnode: Remove wrong header inclusion
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: restore set elements when delete set fails
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: missing iterator type in lookup walk
Gerd Bayer <[email protected]>
s390/ism: Properly fix receive message buffer allocation
Arınç ÜNAL <[email protected]>
net: dsa: mt7530: fix port mirroring for MT7988 SoC switch
Arınç ÜNAL <[email protected]>
net: dsa: mt7530: fix mirroring frames received on local port
Lei Chen <[email protected]>
tun: limit printing rate when illegal packet received by tun dev
Marcin Szycik <[email protected]>
ice: Fix checking for unsupported keys on non-tunnel device
Michal Swiatkowski <[email protected]>
ice: tc: allow zero flags in parsing tc flower
Michal Swiatkowski <[email protected]>
ice: tc: check src_vsi in case of traffic from VF
Serge Semin <[email protected]>
net: stmmac: Fix IP-cores specific MAC capabilities
Serge Semin <[email protected]>
net: stmmac: Fix max-speed being ignored on queue re-init
Serge Semin <[email protected]>
net: stmmac: Apply half-duplex-less constraint for DW QoS Eth only
Dmitry Safonov <[email protected]>
selftests/tcp_ao: Printing fixes to confirm with format-security
Dmitry Safonov <[email protected]>
selftests/tcp_ao: Fix fscanf() call for format-security
Dmitry Safonov <[email protected]>
selftests/tcp_ao: Zero-init tcp_ao_info_opt
Dmitry Safonov <[email protected]>
selftests/tcp_ao: Make RST tests less flaky
Asbjørn Sloth Tønnesen <[email protected]>
octeontx2-pf: fix FLOW_DIS_IS_FRAGMENT implementation
Yuri Benditovich <[email protected]>
net: change maximum number of UDP segments to 128
Carolina Jubran <[email protected]>
net/mlx5e: Prevent deadlock while disabling aRFS
Shay Drory <[email protected]>
net/mlx5: Restore mistakenly dropped parts in register devlink flow
Shay Drory <[email protected]>
net/mlx5: Lag, restore buckets number to default after hash LAG deactivation
Asbjørn Sloth Tønnesen <[email protected]>
net: sparx5: flower: fix fragment flags handling
Kuniyuki Iwashima <[email protected]>
af_unix: Don't peek OOB data without MSG_OOB.
Kuniyuki Iwashima <[email protected]>
af_unix: Call manage_oob() for every skb in unix_stream_read_generic().
Pablo Neira Ayuso <[email protected]>
netfilter: flowtable: incorrect pppoe tuple
Pablo Neira Ayuso <[email protected]>
netfilter: flowtable: validate pppoe header
Florian Westphal <[email protected]>
netfilter: nft_set_pipapo: do not free live element
Pablo Neira Ayuso <[email protected]>
netfilter: nft_set_pipapo: walk over current view on netlink dump
Florian Westphal <[email protected]>
netfilter: nft_set_pipapo: constify lookup fn args where possible
Pablo Neira Ayuso <[email protected]>
netfilter: br_netfilter: skip conntrack input hook for promisc packets
Ziyang Xuan <[email protected]>
netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()
Ziyang Xuan <[email protected]>
netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
Manivannan Sadhasivam <[email protected]>
scsi: ufs: qcom: Add missing interconnect bandwidth values for Gear 5
Heiner Kallweit <[email protected]>
r8169: add missing conditional compiling for call to r8169_remove_leds
Heiner Kallweit <[email protected]>
r8169: fix LED-related deadlock on module removal
Naohiro Aota <[email protected]>
btrfs: zoned: do not flag ZEROOUT on non-dirty extent buffer
Qu Wenruo <[email protected]>
btrfs: do not wait for short bulk allocation
Jose Ignacio Tornos Martinez <[email protected]>
net: usb: ax88179_178a: avoid writing the mac address before first reading
Bart Van Assche <[email protected]>
scsi: core: Fix handling of SCMD_FAIL_IF_RECOVERING
Jason A. Donenfeld <[email protected]>
random: handle creditable entropy from atomic process context
Yuanhe Shu <[email protected]>
selftests/ftrace: Limit length in subsystem-enable tests
Steven Rostedt (Google) <[email protected]>
SUNRPC: Fix rpcgss_context trace event acceptor field
Jason A. Donenfeld <[email protected]>
Revert "vmgenid: emit uevent when VMGENID updates"
Ville Syrjälä <[email protected]>
drm/i915/cdclk: Fix voltage_level programming edge case
Alexey Izbyshev <[email protected]>
io_uring: Fix io_cqring_wait() not restoring sigmask on get_timespec64() failure
-------------
Diffstat:
Makefile | 4 +- arch/arm64/kernel/head.S | 5 + arch/arm64/mm/pageattr.c | 3 - arch/x86/include/asm/barrier.h | 3 + arch/x86/include/asm/kvm_host.h | 1 + arch/x86/kernel/cpu/bugs.c | 11 +- arch/x86/kernel/cpu/cpuid-deps.c | 6 +- arch/x86/kvm/cpuid.c | 1 + arch/x86/kvm/cpuid.h | 10 ++ arch/x86/kvm/lapic.c | 3 +- arch/x86/kvm/mmu/mmu.c | 5 +- arch/x86/kvm/mmu/tdp_mmu.c | 21 ++- arch/x86/kvm/vmx/vmx.c | 24 ++- arch/x86/kvm/x86.c | 2 +- block/bdev.c | 29 ++-- block/ioctl.c | 3 +- drivers/accessibility/speakup/main.c | 2 +- drivers/android/binder.c | 4 +- drivers/char/random.c | 10 +- drivers/clk/clk.c | 161 ++++++++++++++---- drivers/clk/mediatek/clk-mt7988-infracfg.c | 2 +- drivers/clk/mediatek/clk-mtk.c | 15 ++ drivers/comedi/drivers/vmk80xx.c | 35 ++-- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 4 - drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 72 ++++++--- drivers/gpu/drm/amd/amdkfd/kfd_process.c | 4 +- drivers/gpu/drm/i915/display/intel_cdclk.c | 37 +++-- drivers/gpu/drm/nouveau/nouveau_bios.c | 13 +- drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv50.c | 7 +- drivers/gpu/drm/panel/panel-visionox-rm69299.c | 2 - drivers/gpu/drm/radeon/radeon_atombios.c | 8 +- drivers/gpu/drm/ttm/ttm_pool.c | 38 +++-- drivers/gpu/drm/v3d/v3d_irq.c | 4 - drivers/gpu/drm/vmwgfx/vmwgfx_blit.c | 35 +++- drivers/gpu/drm/vmwgfx/vmwgfx_bo.c | 7 +- drivers/gpu/drm/vmwgfx/vmwgfx_bo.h | 2 + drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 1 + drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 3 + drivers/gpu/drm/vmwgfx/vmwgfx_gem.c | 32 ++++ drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 11 +- drivers/gpu/drm/vmwgfx/vmwgfx_kms.h | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_prime.c | 15 +- drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c | 44 +++-- drivers/gpu/drm/xe/display/intel_fb_bo.c | 8 +- drivers/infiniband/core/cm.c | 11 +- drivers/infiniband/hw/mlx5/mad.c | 3 +- drivers/infiniband/sw/rxe/rxe.c | 2 + drivers/interconnect/core.c | 8 + drivers/interconnect/qcom/x1e80100.c | 26 --- drivers/iommu/iommufd/Kconfig | 1 + drivers/misc/cardreader/rtsx_pcr.c | 2 +- drivers/misc/mei/pci-me.c | 2 +- drivers/misc/mei/platform-vsc.c | 17 +- drivers/misc/mei/vsc-tp.c | 84 +++++++--- drivers/misc/mei/vsc-tp.h | 3 + drivers/net/dsa/mt7530.c | 38 +++-- drivers/net/dsa/mt7530.h | 5 + drivers/net/ethernet/intel/ice/ice_tc_lib.c | 15 +- .../net/ethernet/marvell/octeontx2/nic/otx2_tc.c | 7 +- drivers/net/ethernet/mediatek/mtk_wed.c | 6 +- drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c | 27 ++-- drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 9 +- .../ethernet/mellanox/mlx5/core/eswitch_offloads.c | 4 + drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c | 4 +- drivers/net/ethernet/mellanox/mlx5/core/main.c | 5 +- .../ethernet/mellanox/mlx5/core/sf/dev/driver.c | 1 - .../ethernet/microchip/sparx5/sparx5_tc_flower.c | 61 ++++--- drivers/net/ethernet/realtek/r8169.h | 4 +- drivers/net/ethernet/realtek/r8169_leds.c | 23 ++- drivers/net/ethernet/realtek/r8169_main.c | 7 +- drivers/net/ethernet/renesas/ravb.h | 6 +- drivers/net/ethernet/renesas/ravb_main.c | 93 ++++++----- drivers/net/ethernet/stmicro/stmmac/common.h | 1 + drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 2 + .../net/ethernet/stmicro/stmmac/dwmac1000_core.c | 2 + .../net/ethernet/stmicro/stmmac/dwmac100_core.c | 2 + drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 7 +- .../net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 18 +-- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 29 ++-- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 18 +++ drivers/net/tun.c | 18 ++- drivers/net/usb/ax88179_178a.c | 4 +- drivers/platform/x86/amd/pmc/pmc-quirks.c | 9 ++ drivers/s390/cio/device.c | 13 +- drivers/s390/cio/qdio_main.c | 28 +++- drivers/s390/net/ism_drv.c | 37 +++-- drivers/scsi/scsi_lib.c | 7 +- drivers/thermal/thermal_debugfs.c | 1 + drivers/thunderbolt/domain.c | 5 +- drivers/thunderbolt/icm.c | 2 +- drivers/thunderbolt/lc.c | 45 ++++++ drivers/thunderbolt/nhi.c | 19 ++- drivers/thunderbolt/path.c | 13 ++ drivers/thunderbolt/switch.c | 180 ++++++++++++++++++--- drivers/thunderbolt/tb.c | 36 +++-- drivers/thunderbolt/tb.h | 10 +- drivers/thunderbolt/tb_regs.h | 6 + drivers/thunderbolt/usb4.c | 52 +++++- drivers/tty/serial/8250/8250_dw.c | 6 +- drivers/tty/serial/mxs-auart.c | 8 +- drivers/tty/serial/pmac_zilog.c | 14 -- drivers/tty/serial/serial_base.h | 4 + drivers/tty/serial/serial_core.c | 23 ++- drivers/tty/serial/serial_port.c | 34 ++++ drivers/tty/serial/stm32-usart.c | 13 +- drivers/ufs/host/ufs-qcom.c | 8 +- drivers/usb/class/cdc-wdm.c | 6 +- drivers/usb/core/port.c | 4 +- drivers/usb/dwc2/hcd_ddma.c | 4 +- drivers/usb/gadget/function/f_ncm.c | 4 +- drivers/usb/misc/onboard_usb_hub.c | 6 +- drivers/usb/serial/option.c | 40 +++++ drivers/usb/typec/tcpm/tcpm.c | 4 +- drivers/virt/vmgenid.c | 2 - fs/btrfs/extent_io.c | 20 +-- fs/fuse/dir.c | 1 + fs/nfsd/nfs4xdr.c | 47 +++--- fs/nilfs2/dir.c | 2 +- fs/smb/common/smb2pdu.h | 2 +- fs/smb/server/server.c | 13 +- fs/smb/server/smb2pdu.c | 4 + fs/smb/server/vfs.c | 5 + fs/squashfs/inode.c | 5 +- fs/sysfs/file.c | 2 + include/asm-generic/barrier.h | 8 + include/linux/blkdev.h | 2 + include/linux/bootconfig.h | 7 +- include/linux/gpio/property.h | 1 - include/linux/shmem_fs.h | 9 ++ include/linux/swapops.h | 65 ++++---- include/linux/udp.h | 2 +- include/net/netfilter/nf_flow_table.h | 12 +- include/net/netfilter/nf_tables.h | 14 ++ include/net/sch_generic.h | 1 + include/trace/events/rpcgss.h | 4 +- init/main.c | 2 + io_uring/io_uring.c | 26 +-- kernel/fork.c | 33 ++-- kernel/sched/sched.h | 20 ++- lib/bootconfig.c | 19 ++- mm/gup.c | 54 ++++--- mm/huge_memory.c | 6 +- mm/hugetlb.c | 10 +- mm/internal.h | 10 +- mm/madvise.c | 17 +- mm/memory-failure.c | 18 ++- mm/shmem.c | 6 - net/bridge/br_input.c | 15 +- net/bridge/br_netfilter_hooks.c | 6 + net/bridge/br_private.h | 1 + net/bridge/netfilter/nf_conntrack_bridge.c | 14 +- net/core/dev.c | 6 + net/netfilter/nf_flow_table_inet.c | 3 +- net/netfilter/nf_flow_table_ip.c | 10 +- net/netfilter/nf_tables_api.c | 82 ++++++++-- net/netfilter/nft_lookup.c | 1 + net/netfilter/nft_set_bitmap.c | 4 +- net/netfilter/nft_set_hash.c | 8 +- net/netfilter/nft_set_pipapo.c | 43 ++--- net/netfilter/nft_set_pipapo.h | 6 +- net/netfilter/nft_set_pipapo_avx2.c | 59 ++++--- net/netfilter/nft_set_rbtree.c | 4 +- net/sched/sch_generic.c | 1 + net/unix/af_unix.c | 12 +- sound/core/seq/seq_ump_convert.c | 2 +- sound/pci/hda/patch_realtek.c | 7 +- sound/pci/hda/tas2781_hda_i2c.c | 4 +- tools/perf/ui/browsers/annotate.c | 2 +- tools/perf/util/annotate.c | 3 + tools/perf/util/bpf_skel/lock_contention.bpf.c | 5 +- .../ftrace/test.d/event/subsystem-enable.tc | 6 +- tools/testing/selftests/iommu/config | 2 + tools/testing/selftests/net/tcp_ao/lib/proc.c | 2 +- tools/testing/selftests/net/tcp_ao/lib/setup.c | 12 +- tools/testing/selftests/net/tcp_ao/rst.c | 23 +-- .../selftests/net/tcp_ao/setsockopt-closed.c | 2 +- tools/testing/selftests/net/udpgso.c | 2 +- .../testing/selftests/powerpc/papr_vpd/papr_vpd.c | 2 +- 178 files changed, 1898 insertions(+), 827 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/158 io_uring: Fix io_cqring_wait() not restoring sigmask on get_timespec64() failure
6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Izbyshev <[email protected]>
Commit 978e5c19dfefc271e5550efba92fcef0d3f62864 upstream.
This bug was introduced in commit 950e79dd7313 ("io_uring: minor io_cqring_wait() optimization"), which was made in preparation for adc8682ec690 ("io_uring: Add support for napi_busy_poll"). The latter got reverted in cb3182167325 ("Revert "io_uring: Add support for napi_busy_poll""), so simply undo the former as well.
--- io_uring/io_uring.c | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-)
io_uring/io_uring.c +13 -13
@@ -2610,19 +2610,6 @@ static int io_cqring_wait(struct io_ringif (__io_cqring_events_user (ctx) >= min_events)return 0 ; -if (sig) { -#ifdef CONFIG_COMPAT -if (in_compat_syscall ()) - ret =set_compat_user_sigmask ((const compat_sigset_t __user *)sig, - sigsz); - else -#endif - ret =set_user_sigmask (sig, sigsz); - -if (ret) -return ret; - } -init_waitqueue_func_entry (&iowq.wq, io_wake_function); iowq.wq.private = current;INIT_LIST_HEAD (&iowq.wq.entry);
@@ -2639,6 +2626,19 @@ static int io_cqring_wait(struct io_ring iowq.timeout =ktime_add_ns (timespec64_to_ktime (ts),ktime_get_ns ()); } +if (sig) { +#ifdef CONFIG_COMPAT +if (in_compat_syscall ()) + ret =set_compat_user_sigmask ((const compat_sigset_t __user *)sig, + sigsz); + else +#endif + ret =set_user_sigmask (sig, sigsz); + +if (ret) +return ret; + } +trace_io_uring_cqring_wait (ctx, min_events); do { int nr_wait = (int) iowq.cq_tail - READ_ONCE(ctx->rings->cq.tail);
Greg Kroah-Hartman
maintainerPATCH 2/158 drm/i915/cdclk: Fix voltage_level programming edge case
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ville Syrjälä <[email protected]>
[ Upstream commit 6154cc9177ccea00c89ce0bf93352e474b819ff2 ]
Currently we only consider the relationship of the old and new CDCLK frequencies when determining whether to do the repgramming from intel_set_cdclk_pre_plane_update() or intel_set_cdclk_post_plane_update().
It is technically possible to have a situation where the CDCLK frequency is decreasing, but the voltage_level is increasing due a DDI port. In this case we should bump the voltage level already in intel_set_cdclk_pre_plane_update() (so that the voltage_level will have been increased by the time the port gets enabled), while leaving the CDCLK frequency unchanged (as active planes/etc. may still depend on it). We can then reduce the CDCLK frequency to its final value from intel_set_cdclk_post_plane_update().
In order to handle that correctly we shall construct a suitable amalgam of the old and new cdclk states in intel_set_cdclk_pre_plane_update().
And we can simply call intel_set_cdclk() unconditionally in both places as it will not do anything if nothing actually changes vs. the current hw state.
v2: Handle cdclk_state->disable_pipes
v3: Only synchronize the cd2x update against the pipe's vblank
when the cdclk frequency is changing during the current commit phase (Gustavo)
--- drivers/gpu/drm/i915/display/intel_cdclk.c | 37 ++++++++++++++++------ 1 file changed, 27 insertions(+), 10 deletions(-)
drivers/gpu/drm/i915/display/intel_cdclk.c +27 -10
@@ -2512,7 +2512,8 @@ intel_set_cdclk_pre_plane_update(struct intel_atomic_state *state)intel_atomic_get_old_cdclk_state (state);const struct intel_cdclk_state *new_cdclk_state =intel_atomic_get_new_cdclk_state (state); -enum pipe pipe = new_cdclk_state->pipe; +struct intel_cdclk_config cdclk_config; +enum pipe pipe;if (!intel_cdclk_changed (&old_cdclk_state->actual, &new_cdclk_state->actual))
@@ -2521,12 +2522,25 @@ intel_set_cdclk_pre_plane_update(struct intel_atomic_state *state)if (IS_DG2 (i915))intel_cdclk_pcode_pre_notify (state); -if (new_cdclk_state->disable_pipes || - old_cdclk_state->actual.cdclk <= new_cdclk_state->actual.cdclk) { -drm_WARN_ON (&i915->drm, !new_cdclk_state->base.changed); +if (new_cdclk_state->disable_pipes) { + cdclk_config = new_cdclk_state->actual; + pipe =INVALID_PIPE ; + }else { +if (new_cdclk_state->actual.cdclk >= old_cdclk_state->actual.cdclk) { + cdclk_config = new_cdclk_state->actual; + pipe = new_cdclk_state->pipe; + }else { + cdclk_config = old_cdclk_state->actual; + pipe =INVALID_PIPE ; + } -intel_set_cdclk (i915, &new_cdclk_state->actual, pipe); + cdclk_config.voltage_level =max (new_cdclk_state->actual.voltage_level, + old_cdclk_state->actual.voltage_level); } + +drm_WARN_ON (&i915->drm, !new_cdclk_state->base.changed); + +intel_set_cdclk (i915, &cdclk_config, pipe); }/**
@@ -2544,7 +2558,7 @@ intel_set_cdclk_post_plane_update(struct intel_atomic_state *state)intel_atomic_get_old_cdclk_state (state);const struct intel_cdclk_state *new_cdclk_state =intel_atomic_get_new_cdclk_state (state); -enum pipe pipe = new_cdclk_state->pipe; +enum pipe pipe;if (!intel_cdclk_changed (&old_cdclk_state->actual, &new_cdclk_state->actual))
@@ -2554,11 +2568,14 @@ intel_set_cdclk_post_plane_update(struct intel_atomic_state *state)intel_cdclk_pcode_post_notify (state);if (!new_cdclk_state->disable_pipes && - old_cdclk_state->actual.cdclk > new_cdclk_state->actual.cdclk) { -drm_WARN_ON (&i915->drm, !new_cdclk_state->base.changed); + new_cdclk_state->actual.cdclk < old_cdclk_state->actual.cdclk) + pipe = new_cdclk_state->pipe; +else + pipe =INVALID_PIPE ; -intel_set_cdclk (i915, &new_cdclk_state->actual, pipe); - } +drm_WARN_ON (&i915->drm, !new_cdclk_state->base.changed); + +intel_set_cdclk (i915, &new_cdclk_state->actual, pipe); }static int intel_pixel_rate_to_cdclk (const struct intel_crtc_state *crtc_state)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 3/158 Revert "vmgenid: emit uevent when VMGENID updates"
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason A. Donenfeld <[email protected]>
commit 3aadf100f93d80815685493d60cd8cab206403df upstream.
This reverts commit ad6bcdad2b6724e113f191a12f859a9e8456b26d. I had nak'd it, and Greg said on the thread that it links that he wasn't going to take it either, especially since it's not his code or his tree, but then, seemingly accidentally, it got pushed up some months later, in what looks like a mistake, with no further discussion in the linked thread. So revert it, since it's clearly not intended.
--- drivers/virt/vmgenid.c | 2 -- 1 file changed, 2 deletions(-)
drivers/virt/vmgenid.c +0 -2
@@ -68,7 +68,6 @@ static int vmgenid_add(struct acpi_device *device)static void vmgenid_notify (struct acpi_device *device,u32 event) {struct vmgenid_state *state =acpi_driver_data (device); -char *envp[] = {"NEW_VMGENID=1" ,NULL };u8 old_id[VMGENID_SIZE ];memcpy (old_id, state->this_id,sizeof (old_id));
@@ -76,7 +75,6 @@ static void vmgenid_notify(struct acpi_device *device, u32 event)if (!memcmp (old_id, state->this_id,sizeof (old_id)))return ;add_vmfork_randomness (state->this_id,sizeof (state->this_id)); -kobject_uevent_env (&device->dev.kobj,KOBJ_CHANGE , envp); }static const struct acpi_device_id vmgenid_ids[] = {
Signature · 1 line
2.44.0
Greg Kroah-Hartman
maintainerPATCH 4/158 SUNRPC: Fix rpcgss_context trace event acceptor field
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt (Google) <[email protected]>
commit a4833e3abae132d613ce7da0e0c9a9465d1681fa upstream.
The rpcgss_context trace event acceptor field is a dynamically sized string that records the "data" parameter. But this parameter is also dependent on the "len" field to determine the size of the data.
It needs to use __string_len() helper macro where the length can be passed in. It also incorrectly uses strncpy() to save it instead of __assign_str(). As these macros can change, it is not wise to open code them in trace events.
As of commit c759e609030c ("tracing: Remove __assign_str_len()"), __assign_str() can be used for both __string() and __string_len() fields. Before that commit, __assign_str_len() is required to be used. This needs to be noted for backporting. (In actuality, commit c1fa617caeb0 ("tracing:
Rework __assign_str() and __string() to not duplicate getting the string") is the commit that makes __string_str_len() obsolete).
--- include/trace/events/rpcgss.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/trace/events/rpcgss.h +2 -2
@@ -609,7 +609,7 @@ TRACE_EVENT(rpcgss_context, __field(unsigned int, timeout) __field(u32, window_size) __field(int, len) - __string(acceptor, data) + __string_len(acceptor, data, len) ), TP_fast_assign(
@@ -618,7 +618,7 @@ TRACE_EVENT(rpcgss_context, __entry->timeout = timeout; __entry->window_size = window_size; __entry->len = len; -strncpy (__get_str (acceptor), data, len); +__assign_str (acceptor, data); ), TP_printk("win_size=%u expiry=%lu now=%lu timeout=%u acceptor=%.*s",
Greg Kroah-Hartman
maintainerPATCH 5/158 selftests/ftrace: Limit length in subsystem-enable tests
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuanhe Shu <[email protected]>
commit 1a4ea83a6e67f1415a1f17c1af5e9c814c882bb5 upstream.
While sched* events being traced and sched* events continuously happen, "[xx] event tracing - enable/disable with subsystem level files" would not stop as on some slower systems it seems to take forever. Select the first 100 lines of output would be enough to judge whether there are more than 3 types of sched events.
--- tools/testing/selftests/ftrace/test.d/event/subsystem-enable.tc | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
tools/testing/selftests/ftrace/test.d/event/subsystem-enable.tc +3 -3
@@ -18,7 +18,7 @@ echo 'sched:*' > set_event yield -count=`cat trace | grep -v ^# | awk '{ print $5 }' | sort -u | wc -l` +count=`head -n 100 trace | grep -v ^# | awk '{ print $5 }' | sort -u | wc -l` if [ $count -lt 3 ]; then fail "at least fork, exec and exit events should be recorded" fi
@@ -29,7 +29,7 @@ echo 1 > events/sched/enable yield -count=`cat trace | grep -v ^# | awk '{ print $5 }' | sort -u | wc -l` +count=`head -n 100 trace | grep -v ^# | awk '{ print $5 }' | sort -u | wc -l` if [ $count -lt 3 ]; then fail "at least fork, exec and exit events should be recorded" fi
@@ -40,7 +40,7 @@ echo 0 > events/sched/enable yield -count=`cat trace | grep -v ^# | awk '{ print $5 }' | sort -u | wc -l` +count=`head -n 100 trace | grep -v ^# | awk '{ print $5 }' | sort -u | wc -l` if [ $count -ne 0 ]; then fail "any of scheduler events should not be recorded" fi
Greg Kroah-Hartman
maintainerPATCH 6/158 random: handle creditable entropy from atomic process context
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason A. Donenfeld <[email protected]>
commit e871abcda3b67d0820b4182ebe93435624e9c6a4 upstream.
The entropy accounting changes a static key when the RNG has initialized, since it only ever initializes once. Static key changes, however, cannot be made from atomic context, so depending on where the last creditable entropy comes from, the static key change might need to be deferred to a worker.
Previously the code used the execute_in_process_context() helper function, which accounts for whether or not the caller is in_interrupt(). However, that doesn't account for the case where the caller is actually in process context but is holding a spinlock.
This turned out to be the case with input_handle_event() in drivers/input/input.c contributing entropy:
[<ffffffd613025ba0>] die+0xa8/0x2fc [<ffffffd613027428>] bug_handler+0x44/0xec [<ffffffd613016964>] brk_handler+0x90/0x144 [<ffffffd613041e58>] do_debug_exception+0xa0/0x148 [<ffffffd61400c208>] el1_dbg+0x60/0x7c [<ffffffd61400c000>] el1h_64_sync_handler+0x38/0x90 [<ffffffd613011294>] el1h_64_sync+0x64/0x6c [<ffffffd613102d88>] __might_resched+0x1fc/0x2e8 [<ffffffd613102b54>] __might_sleep+0x44/0x7c [<ffffffd6130b6eac>] cpus_read_lock+0x1c/0xec [<ffffffd6132c2820>] static_key_enable+0x14/0x38 [<ffffffd61400ac08>] crng_set_ready+0x14/0x28 [<ffffffd6130df4dc>] execute_in_process_context+0xb8/0xf8 [<ffffffd61400ab30>] _credit_init_bits+0x118/0x1dc [<ffffffd6138580c8>] add_timer_randomness+0x264/0x270 [<ffffffd613857e54>] add_input_randomness+0x38/0x48 [<ffffffd613a80f94>] input_handle_event+0x2b8/0x490 [<ffffffd613a81310>] input_event+0x6c/0x98
According to Guoyong, it's not really possible to refactor the various drivers to never hold a spinlock there. And in_atomic() isn't reliable.
So, rather than trying to be too fancy, just punt the change in the static key to a workqueue always. There's basically no drawback of doing this, as the code already needed to account for the static key not changing immediately, and given that it's just an optimization, there's not exactly a hurry to change the static key right away, so deferal is fine.
--- drivers/char/random.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/char/random.c +5 -5
@@ -702,7 +702,7 @@ static void extract_entropy(void *buf, sstatic void __cold _credit_init_bits (size_t bits) { -static struct execute_work set_ready; + static DECLARE_WORK(set_ready, crng_set_ready);unsigned int new, orig, add;unsigned long flags;
@@ -718,8 +718,8 @@ static void __cold _credit_init_bits(sizif (orig <POOL_READY_BITS && new >=POOL_READY_BITS ) {crng_reseed (NULL );/* Sets crng_init to CRNG_READY under base_crng.lock. */ -if (static_key_initialized) -execute_in_process_context (crng_set_ready, &set_ready); +if (static_key_initialized && system_unbound_wq) +queue_work (system_unbound_wq, &set_ready);atomic_notifier_call_chain (&random_ready_notifier,0 ,NULL );wake_up_interruptible (&crng_init_wait);kill_fasync (&fasync,SIGIO ,POLL_IN );
@@ -890,8 +890,8 @@ void __init random_init(void)/* * If we were initialized by the cpu or bootloader before jump labels -* are initialized, then we should enable the static branch here, where -* it's guaranteed that jump labels have been initialized. +* or workqueues are initialized, then we should enable the static +* branch here, where it's guaranteed that these have been initialized. */ if (!static_branch_likely (&crng_is_ready) && crng_init >=CRNG_READY )crng_set_ready (NULL );
Greg Kroah-Hartman
maintainerPATCH 7/158 scsi: core: Fix handling of SCMD_FAIL_IF_RECOVERING
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
commit ca91259b775f6fd98ae5d23bb4eec101d468ba8d upstream.
There is code in the SCSI core that sets the SCMD_FAIL_IF_RECOVERING flag but there is no code that clears this flag. Instead of only clearing SCMD_INITIALIZED in scsi_end_request(), clear all flags. It is never necessary to preserve any command flags inside scsi_end_request().
--- drivers/scsi/scsi_lib.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/scsi/scsi_lib.c +3 -4
@@ -543,10 +543,9 @@ static bool scsi_end_request(struct requif (blk_queue_add_random (q))add_disk_randomness (req->q->disk); -if (!blk_rq_is_passthrough (req)) { -WARN_ON_ONCE (!(cmd->flags &SCMD_INITIALIZED )); - cmd->flags &= ~SCMD_INITIALIZED ; - } +WARN_ON_ONCE (!blk_rq_is_passthrough (req) && + !(cmd->flags &SCMD_INITIALIZED )); + cmd->flags =0 ;/* * Calling rcu_barrier() is not necessary here because the
Greg Kroah-Hartman
maintainerPATCH 8/158 net: usb: ax88179_178a: avoid writing the mac address before first reading
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jose Ignacio Tornos Martinez <[email protected]>
commit 56f78615bcb1c3ba58a5d9911bad3d9185cf141b upstream.
After the commit d2689b6a86b9 ("net: usb: ax88179_178a: avoid two consecutive device resets"), reset operation, in which the default mac address from the device is read, is not executed from bind operation and the random address, that is pregenerated just in case, is direclty written the first time in the device, so the default one from the device is not even read. This writing is not dangerous because is volatile and the default mac address is not missed.
In order to avoid this and keep the simplification to have only one reset and reduce the delays, restore the reset from bind operation and remove the reset that is commanded from open operation. The behavior is the same but everything is ready for usbnet_probe.
Tested with ASIX AX88179 USB Gigabit Ethernet devices. Restore the old behavior for the rest of possible devices because I don't have the hardware to test.
--- drivers/net/usb/ax88179_178a.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/usb/ax88179_178a.c +2 -2
@@ -1317,6 +1317,8 @@ static int ax88179_bind(struct usbnet *dnetif_set_tso_max_size (dev->net,16384 ); +ax88179_reset (dev); +return 0 ; }
@@ -1695,7 +1697,6 @@ static const struct driver_info ax88179_ .unbind = ax88179_unbind, .status = ax88179_status, .link_reset = ax88179_link_reset, - .reset = ax88179_reset, .stop = ax88179_stop, .flags = FLAG_ETHER | FLAG_FRAMING_AX, .rx_fixup = ax88179_rx_fixup,
@@ -1708,7 +1709,6 @@ static const struct driver_info ax88178a .unbind = ax88179_unbind, .status = ax88179_status, .link_reset = ax88179_link_reset, - .reset = ax88179_reset, .stop = ax88179_stop, .flags = FLAG_ETHER | FLAG_FRAMING_AX, .rx_fixup = ax88179_rx_fixup,
Greg Kroah-Hartman
maintainerPATCH 9/158 btrfs: do not wait for short bulk allocation
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qu Wenruo <[email protected]>
commit 1db7959aacd905e6487d0478ac01d89f86eb1e51 upstream.
[BUG]
There is a recent report that when memory pressure is high (including cached pages), btrfs can spend most of its time on memory allocation in btrfs_alloc_page_array() for compressed read/write.
[CAUSE]
For btrfs_alloc_page_array() we always go alloc_pages_bulk_array(), and even if the bulk allocation failed (fell back to single page allocation) we still retry but with extra memalloc_retry_wait().
If the bulk alloc only returned one page a time, we would spend a lot of time on the retry wait.
The behavior was introduced in commit 395cb57e8560 ("btrfs: wait between incomplete batch memory allocations").
[FIX]
Although the commit mentioned that other filesystems do the wait, it's not the case at least nowadays.
All the mainlined filesystems only call memalloc_retry_wait() if they failed to allocate any page (not only for bulk allocation). If there is any progress, they won't call memalloc_retry_wait() at all.
For example, xfs_buf_alloc_pages() would only call memalloc_retry_wait() if there is no allocation progress at all, and the call is not for metadata readahead.
So I don't believe we should call memalloc_retry_wait() unconditionally for short allocation.
Call memalloc_retry_wait() if it fails to allocate any page for tree block allocation (which goes with __GFP_NOFAIL and may not need the special handling anyway), and reduce the latency for btrfs_alloc_page_array().
--- fs/btrfs/extent_io.c | 18 ++++-------------- 1 file changed, 4 insertions(+), 14 deletions(-)
fs/btrfs/extent_io.c +4 -14
@@ -692,31 +692,21 @@ static void end_bbio_data_read(struct btint btrfs_alloc_page_array (unsigned int nr_pages,struct page **page_array,gfp_t extra_gfp) { +const gfp_t gfp =GFP_NOFS | extra_gfp;unsigned int allocated;for (allocated =0 ; allocated < nr_pages;) {unsigned int last = allocated; - allocated =alloc_pages_bulk_array (GFP_NOFS | extra_gfp, - nr_pages, page_array); - -if (allocated == nr_pages) -return 0 ; - -/* -* During this iteration, no page could be allocated, even -* though alloc_pages_bulk_array() falls back to alloc_page() -* if it could not bulk-allocate. So we must be out of memory. -*/ -if (allocated == last) { + allocated =alloc_pages_bulk_array (gfp, nr_pages, page_array); +if (unlikely (allocated == last)) { +/* No progress, fail and do cleanup. */ for (int i =0 ; i < allocated; i++) {__free_page (page_array[i]); page_array[i] =NULL ; }return -ENOMEM ; } - -memalloc_retry_wait (GFP_NOFS ); }return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 10/158 btrfs: zoned: do not flag ZEROOUT on non-dirty extent buffer
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naohiro Aota <[email protected]>
commit 68879386180c0efd5a11e800b0525a01068c9457 upstream.
Btrfs clears the content of an extent buffer marked as EXTENT_BUFFER_ZONED_ZEROOUT before the bio submission. This mechanism is introduced to prevent a write hole of an extent buffer, which is once allocated, marked dirty, but turns out unnecessary and cleaned up within one transaction operation.
Currently, btrfs_clear_buffer_dirty() marks the extent buffer as EXTENT_BUFFER_ZONED_ZEROOUT, and skips the entry function. If this call happens while the buffer is under IO (with the WRITEBACK flag set, without the DIRTY flag), we can add the ZEROOUT flag and clear the buffer's content just before a bio submission. As a result:
1) it can lead to adding faulty delayed reference item which leads to a FS corrupted (EUCLEAN) error, and
2) it writes out cleared tree node on disk
The former issue is previously discussed in [1]. The corruption happens when it runs a delayed reference update. So, on-disk data is safe.
The latter one can reach on-disk data. But, as that node is already processed by btrfs_clear_buffer_dirty(), that will be invalidated in the next transaction commit anyway. So, the chance of hitting the corruption is relatively small.
Anyway, we should skip flagging ZEROOUT on a non-DIRTY extent buffer, to keep the content under IO intact.
--- fs/btrfs/extent_io.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/extent_io.c +1 -1
@@ -4130,7 +4130,7 @@ void btrfs_clear_buffer_dirty(struct btr* The actual zeroout of the buffer will happen later in * btree_csum_one_bio. */ -if (btrfs_is_zoned (fs_info)) { +if (btrfs_is_zoned (fs_info) &&test_bit (EXTENT_BUFFER_DIRTY , &eb->bflags)) {set_bit (EXTENT_BUFFER_ZONED_ZEROOUT , &eb->bflags);return ; }
Greg Kroah-Hartman
maintainerPATCH 11/158 r8169: fix LED-related deadlock on module removal
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiner Kallweit <[email protected]>
commit 19fa4f2a85d777a8052e869c1b892a2f7556569d upstream.
Binding devm_led_classdev_register() to the netdev is problematic because on module removal we get a RTNL-related deadlock. Fix this by avoiding the device-managed LED functions.
Note: We can safely call led_classdev_unregister() for a LED even if registering it failed, because led_classdev_unregister() detects this and is a no-op in this case.
--- drivers/net/ethernet/realtek/r8169.h | 4 +++- drivers/net/ethernet/realtek/r8169_leds.c | 23 +++++++++++++++++------ drivers/net/ethernet/realtek/r8169_main.c | 6 +++++- 3 files changed, 25 insertions(+), 8 deletions(-)
drivers/net/ethernet/realtek/r8169.h +3 -1
@@ -72,6 +72,7 @@ enum mac_version { };struct rtl8169_private ; +struct r8169_led_classdev ;void r8169_apply_firmware (struct rtl8169_private *tp);u16 rtl8168h_2_get_adc_bias_ioffset (struct rtl8169_private *tp);
@@ -83,4 +84,5 @@ void r8169_get_led_name(struct rtl8169_p char *buf, int buf_len);int rtl8168_get_led_mode (struct rtl8169_private *tp);int rtl8168_led_mod_ctrl (struct rtl8169_private *tp,u16 mask,u16 val); -void rtl8168_init_leds (struct net_device *ndev); +struct r8169_led_classdev *rtl8168_init_leds (struct net_device *ndev); +void r8169_remove_leds (struct r8169_led_classdev *leds);
drivers/net/ethernet/realtek/r8169_leds.c +17 -6
@@ -138,20 +138,31 @@ static void rtl8168_setup_ldev(struct r8 led_cdev->hw_control_get_device = r8169_led_hw_control_get_device;/* ignore errors */ -devm_led_classdev_register (&ndev->dev, led_cdev); +led_classdev_register (&ndev->dev, led_cdev); } -void rtl8168_init_leds (struct net_device *ndev) +struct r8169_led_classdev *rtl8168_init_leds (struct net_device *ndev) { -/* bind resource mgmt to netdev */ -struct device *dev = &ndev->dev;struct r8169_led_classdev *leds;int i; - leds =devm_kcalloc (dev,RTL8168_NUM_LEDS ,sizeof (*leds),GFP_KERNEL ); + leds =kcalloc (RTL8168_NUM_LEDS +1 ,sizeof (*leds),GFP_KERNEL );if (!leds) -return ; +return NULL ;for (i =0 ; i <RTL8168_NUM_LEDS ; i++)rtl8168_setup_ldev (leds + i, ndev, i); + +return leds; +} + +void r8169_remove_leds (struct r8169_led_classdev *leds) +{ +if (!leds) +return ; + +for (struct r8169_led_classdev *l = leds; l->ndev; l++) +led_classdev_unregister (&l->led); + +kfree (leds); }
drivers/net/ethernet/realtek/r8169_main.c +5 -1
@@ -634,6 +634,8 @@ struct rtl8169_private {const char *fw_name;struct rtl_fw *rtl_fw; +struct r8169_led_classdev *leds; +u32 ocp_base; };
@@ -4930,6 +4932,8 @@ static void rtl_remove_one(struct pci_decancel_work_sync (&tp->wk.work); +r8169_remove_leds (tp->leds); +unregister_netdev (tp->dev);if (tp->dash_type !=RTL_DASH_NONE )
@@ -5391,7 +5395,7 @@ static int rtl_init_one(struct pci_dev *if (IS_ENABLED (CONFIG_R8169_LEDS ) && tp->mac_version >RTL_GIGA_MAC_VER_06 && tp->mac_version <RTL_GIGA_MAC_VER_61 ) -rtl8168_init_leds (dev); + tp->leds =rtl8168_init_leds (dev);netdev_info (dev,"%s, %pM, XID %03x, IRQ %d\n" , rtl_chip_infos[chipset].name, dev->dev_addr, xid, tp->irq);
Greg Kroah-Hartman
maintainerPATCH 12/158 r8169: add missing conditional compiling for call to r8169_remove_leds
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiner Kallweit <[email protected]>
commit 97e176fcbbf3c0f2bd410c9b241177c051f57176 upstream.
Add missing dependency on CONFIG_R8169_LEDS. As-is a link error occurs if config option CONFIG_R8169_LEDS isn't enabled.
--- drivers/net/ethernet/realtek/r8169_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/realtek/r8169_main.c +2 -1
@@ -4932,7 +4932,8 @@ static void rtl_remove_one(struct pci_decancel_work_sync (&tp->wk.work); -r8169_remove_leds (tp->leds); +if (IS_ENABLED (CONFIG_R8169_LEDS )) +r8169_remove_leds (tp->leds);unregister_netdev (tp->dev);
Greg Kroah-Hartman
maintainerPATCH 13/158 scsi: ufs: qcom: Add missing interconnect bandwidth values for Gear 5
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manivannan Sadhasivam <[email protected]>
[ Upstream commit 8db8f6ce556af60ca9a9fd5e826d369ded70fcc7 ]
These entries are necessary to scale the interconnect bandwidth while operating in Gear 5.
--- drivers/ufs/host/ufs-qcom.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/ufs/host/ufs-qcom.c +7 -1
@@ -47,7 +47,7 @@ enum { TSTBUS_MAX, }; -#define QCOM_UFS_MAX_GEAR 4 +#define QCOM_UFS_MAX_GEAR 5#define QCOM_UFS_MAX_LANE 2enum {
@@ -67,26 +67,32 @@ static const struct __ufs_qcom_bw_table { [MODE_PWM][UFS_PWM_G2][UFS_LANE_1] = { 1844, 1000 }, [MODE_PWM][UFS_PWM_G3][UFS_LANE_1] = { 3688, 1000 }, [MODE_PWM][UFS_PWM_G4][UFS_LANE_1] = { 7376, 1000 }, + [MODE_PWM][UFS_PWM_G5][UFS_LANE_1] = { 14752, 1000 }, [MODE_PWM][UFS_PWM_G1][UFS_LANE_2] = { 1844, 1000 }, [MODE_PWM][UFS_PWM_G2][UFS_LANE_2] = { 3688, 1000 }, [MODE_PWM][UFS_PWM_G3][UFS_LANE_2] = { 7376, 1000 }, [MODE_PWM][UFS_PWM_G4][UFS_LANE_2] = { 14752, 1000 }, + [MODE_PWM][UFS_PWM_G5][UFS_LANE_2] = { 29504, 1000 }, [MODE_HS_RA][UFS_HS_G1][UFS_LANE_1] = { 127796, 1000 }, [MODE_HS_RA][UFS_HS_G2][UFS_LANE_1] = { 255591, 1000 }, [MODE_HS_RA][UFS_HS_G3][UFS_LANE_1] = { 1492582, 102400 }, [MODE_HS_RA][UFS_HS_G4][UFS_LANE_1] = { 2915200, 204800 }, + [MODE_HS_RA][UFS_HS_G5][UFS_LANE_1] = { 5836800, 409600 }, [MODE_HS_RA][UFS_HS_G1][UFS_LANE_2] = { 255591, 1000 }, [MODE_HS_RA][UFS_HS_G2][UFS_LANE_2] = { 511181, 1000 }, [MODE_HS_RA][UFS_HS_G3][UFS_LANE_2] = { 1492582, 204800 }, [MODE_HS_RA][UFS_HS_G4][UFS_LANE_2] = { 2915200, 409600 }, + [MODE_HS_RA][UFS_HS_G5][UFS_LANE_2] = { 5836800, 819200 }, [MODE_HS_RB][UFS_HS_G1][UFS_LANE_1] = { 149422, 1000 }, [MODE_HS_RB][UFS_HS_G2][UFS_LANE_1] = { 298189, 1000 }, [MODE_HS_RB][UFS_HS_G3][UFS_LANE_1] = { 1492582, 102400 }, [MODE_HS_RB][UFS_HS_G4][UFS_LANE_1] = { 2915200, 204800 }, + [MODE_HS_RB][UFS_HS_G5][UFS_LANE_1] = { 5836800, 409600 }, [MODE_HS_RB][UFS_HS_G1][UFS_LANE_2] = { 298189, 1000 }, [MODE_HS_RB][UFS_HS_G2][UFS_LANE_2] = { 596378, 1000 }, [MODE_HS_RB][UFS_HS_G3][UFS_LANE_2] = { 1492582, 204800 }, [MODE_HS_RB][UFS_HS_G4][UFS_LANE_2] = { 2915200, 409600 }, + [MODE_HS_RB][UFS_HS_G5][UFS_LANE_2] = { 5836800, 819200 }, [MODE_MAX][0][0] = { 7643136, 307200 }, };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 14/158 netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ziyang Xuan <[email protected]>
[ Upstream commit f969eb84ce482331a991079ab7a5c4dc3b7f89bf ]
nft_unregister_expr() can concurrent with __nft_expr_type_get(), and there is not any protection when iterate over nf_tables_expressions list in __nft_expr_type_get(). Therefore, there is potential data-race of nf_tables_expressions list entry.
Use list_for_each_entry_rcu() to iterate over nf_tables_expressions list in __nft_expr_type_get(), and use rcu_read_lock() in the caller nft_expr_type_get() to protect the entire type query process.
--- net/netfilter/nf_tables_api.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
net/netfilter/nf_tables_api.c +6 -2
@@ -3048,7 +3048,7 @@ static const struct nft_expr_type *__nft_expr_type_get(u8 family, {const struct nft_expr_type *type, *candidate =NULL ; -list_for_each_entry (type, &nf_tables_expressions, list) { +list_for_each_entry_rcu (type, &nf_tables_expressions, list) {if (!nla_strcmp (nla, type->name)) {if (!type->family && !candidate) candidate = type;
@@ -3080,9 +3080,13 @@ static const struct nft_expr_type *nft_expr_type_get(struct net *net,if (nla ==NULL )return ERR_PTR (-EINVAL ); +rcu_read_lock (); type =__nft_expr_type_get (family, nla); -if (type !=NULL &&try_module_get (type->owner)) +if (type !=NULL &&try_module_get (type->owner)) { +rcu_read_unlock ();return type; + } +rcu_read_unlock ();lockdep_nfnl_nft_mutex_not_held ();#ifdef CONFIG_MODULES
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 15/158 netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ziyang Xuan <[email protected]>
[ Upstream commit d78d867dcea69c328db30df665be5be7d0148484 ]
nft_unregister_obj() can concurrent with __nft_obj_type_get(), and there is not any protection when iterate over nf_tables_objects list in __nft_obj_type_get(). Therefore, there is potential data-race of nf_tables_objects list entry.
Use list_for_each_entry_rcu() to iterate over nf_tables_objects list in __nft_obj_type_get(), and use rcu_read_lock() in the caller nft_obj_type_get() to protect the entire type query process.
--- net/netfilter/nf_tables_api.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
net/netfilter/nf_tables_api.c +6 -2
@@ -7607,7 +7607,7 @@ static const struct nft_object_type *__nft_obj_type_get(u32 objtype, u8 family) {const struct nft_object_type *type; -list_for_each_entry (type, &nf_tables_objects, list) { +list_for_each_entry_rcu (type, &nf_tables_objects, list) {if (type->family !=NFPROTO_UNSPEC && type->family != family)continue ;
@@ -7623,9 +7623,13 @@ nft_obj_type_get(struct net *net, u32 objtype, u8 family) {const struct nft_object_type *type; +rcu_read_lock (); type =__nft_obj_type_get (objtype, family); -if (type !=NULL &&try_module_get (type->owner)) +if (type !=NULL &&try_module_get (type->owner)) { +rcu_read_unlock ();return type; + } +rcu_read_unlock ();lockdep_nfnl_nft_mutex_not_held ();#ifdef CONFIG_MODULES
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 16/158 netfilter: br_netfilter: skip conntrack input hook for promisc packets
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 751de2012eafa4d46d8081056761fa0e9cc8a178 ]
For historical reasons, when bridge device is in promisc mode, packets that are directed to the taps follow bridge input hook path. This patch adds a workaround to reset conntrack for these packets.
Jianbo Liu reports warning splats in their test infrastructure where cloned packets reach the br_netfilter input hook to confirm the conntrack object.
Scratch one bit from BR_INPUT_SKB_CB to annotate that this packet has reached the input hook because it is passed up to the bridge device to reach the taps.
[ 57.571874] WARNING: CPU: 1 PID: 0 at net/bridge/br_netfilter_hooks.c:616 br_nf_local_in+0x157/0x180 [br_netfilter] [ 57.572749] Modules linked in: xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat xt_addrtype xt_conntrack nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry overlay rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_isc si ib_umad rdma_cm ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core mlx5ctl mlx5_core [ 57.575158] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.8.0+ #19 [ 57.575700] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 57.576662] RIP: 0010:br_nf_local_in+0x157/0x180 [br_netfilter] [ 57.577195] Code: fe ff ff 41 bd 04 00 00 00 be 04 00 00 00 e9 4a ff ff ff be 04 00 00 00 48 89 ef e8 f3 a9 3c e1 66 83 ad b4 00 00 00 04 eb 91 <0f> 0b e9 f1 fe ff ff 0f 0b e9 df fe ff ff 48 89 df e8 b3 53 47 e1 [ 57.578722] RSP: 0018:ffff88885f845a08 EFLAGS: 00010202 [ 57.579207] RAX: 0000000000000002 RBX: ffff88812dfe8000 RCX: 0000000000000000 [ 57.579830] RDX: ffff88885f845a60 RSI: ffff8881022dc300 RDI: 0000000000000000 [ 57.580454] RBP: ffff88885f845a60 R08: 0000000000000001 R09: 0000000000000003 [ 57.581076] R10: 00000000ffff1300 R11: 0000000000000002 R12: 0000000000000000 [ 57.581695] R13: ffff8881047ffe00 R14: ffff888108dbee00 R15: ffff88814519b800 [ 57.582313] FS: 0000000000000000(0000) GS:ffff88885f840000(0000) knlGS:0000000000000000 [ 57.583040] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 57.583564] CR2: 000000c4206aa000 CR3: 0000000103847001 CR4: 0000000000370eb0 [ 57.584194] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 57.584820] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 57.585440] Call Trace: [ 57.585721] <IRQ> [ 57.585976] ? __warn+0x7d/0x130 [ 57.586323] ? br_nf_local_in+0x157/0x180 [br_netfilter] [ 57.586811] ? report_bug+0xf1/0x1c0 [ 57.587177] ? handle_bug+0x3f/0x70 [ 57.587539] ? exc_invalid_op+0x13/0x60 [ 57.587929] ? asm_exc_invalid_op+0x16/0x20 [ 57.588336] ? br_nf_local_in+0x157/0x180 [br_netfilter] [ 57.588825] nf_hook_slow+0x3d/0xd0 [ 57.589188] ? br_handle_vlan+0x4b/0x110 [ 57.589579] br_pass_frame_up+0xfc/0x150 [ 57.589970] ? br_port_flags_change+0x40/0x40 [ 57.590396] br_handle_frame_finish+0x346/0x5e0 [ 57.590837] ? ipt_do_table+0x32e/0x430 [ 57.591221] ? br_handle_local_finish+0x20/0x20 [ 57.591656] br_nf_hook_thresh+0x4b/0xf0 [br_netfilter] [ 57.592286] ? br_handle_local_finish+0x20/0x20 [ 57.592802] br_nf_pre_routing_finish+0x178/0x480 [br_netfilter] [ 57.593348] ? br_handle_local_finish+0x20/0x20 [ 57.593782] ? nf_nat_ipv4_pre_routing+0x25/0x60 [nf_nat] [ 57.594279] br_nf_pre_routing+0x24c/0x550 [br_netfilter] [ 57.594780] ? br_nf_hook_thresh+0xf0/0xf0 [br_netfilter] [ 57.595280] br_handle_frame+0x1f3/0x3d0 [ 57.595676] ? br_handle_local_finish+0x20/0x20 [ 57.596118] ? br_handle_frame_finish+0x5e0/0x5e0 [ 57.596566] __netif_receive_skb_core+0x25b/0xfc0 [ 57.597017] ? __napi_build_skb+0x37/0x40 [ 57.597418] __netif_receive_skb_list_core+0xfb/0x220
--- net/bridge/br_input.c | 15 +++++++++++---- net/bridge/br_netfilter_hooks.c | 6 ++++++ net/bridge/br_private.h | 1 + net/bridge/netfilter/nf_conntrack_bridge.c | 14 ++++++++++---- 4 files changed, 28 insertions(+), 8 deletions(-)
net/bridge/br_input.c +11 -4
@@ -30,7 +30,7 @@ br_netif_receive_skb(struct net *net, struct sock *sk, struct sk_buff *skb)return netif_receive_skb (skb); } -static int br_pass_frame_up (struct sk_buff *skb) +static int br_pass_frame_up (struct sk_buff *skb,bool promisc) {struct net_device *indev, *brdev =BR_INPUT_SKB_CB (skb)->brdev;struct net_bridge *br =netdev_priv (brdev);
@@ -65,6 +65,8 @@ static int br_pass_frame_up(struct sk_buff *skb)br_multicast_count (br,NULL , skb,br_multicast_igmp_type (skb),BR_MCAST_DIR_TX ); +BR_INPUT_SKB_CB (skb)->promisc = promisc; +return NF_HOOK (NFPROTO_BRIDGE ,NF_BR_LOCAL_IN ,dev_net (indev),NULL , skb, indev,NULL , br_netif_receive_skb);
@@ -82,6 +84,7 @@ int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skbstruct net_bridge_mcast *brmctx;struct net_bridge_vlan *vlan;struct net_bridge *br; +bool promisc;u16 vid =0 ;u8 state;
@@ -137,7 +140,9 @@ int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skbif (p->flags &BR_LEARNING )br_fdb_update (br, p,eth_hdr (skb)->h_source, vid,0 ); - local_rcv = !!(br->dev->flags &IFF_PROMISC ); + promisc = !!(br->dev->flags &IFF_PROMISC ); + local_rcv = promisc; +if (is_multicast_ether_addr (eth_hdr (skb)->h_dest)) {/* by definition the broadcast is also a multicast address */ if (is_broadcast_ether_addr (eth_hdr (skb)->h_dest)) {
@@ -200,7 +205,7 @@ int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skbunsigned long now = jiffies;if (test_bit (BR_FDB_LOCAL , &dst->flags)) -return br_pass_frame_up (skb); +return br_pass_frame_up (skb, false);if (now != dst->used) dst->used = now;
@@ -213,7 +218,7 @@ int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb }if (local_rcv) -return br_pass_frame_up (skb); +return br_pass_frame_up (skb, promisc); out:return 0 ;
@@ -386,6 +391,8 @@ static rx_handler_result_t br_handle_frame(struct sk_buff **pskb) goto forward; } +BR_INPUT_SKB_CB (skb)->promisc = false; +/* The else clause should be hit when nf_hook(): * - returns < 0 (drop/error) * - returns = 0 (stolen/nf_queue)
net/bridge/br_netfilter_hooks.c +6 -0
@@ -600,11 +600,17 @@ static unsigned int br_nf_local_in(void *priv,struct sk_buff *skb, const struct nf_hook_state *state) { + bool promisc = BR_INPUT_SKB_CB(skb)->promisc;struct nf_conntrack *nfct =skb_nfct (skb);const struct nf_ct_hook *ct_hook;struct nf_conn *ct;int ret; +if (promisc) { +nf_reset_ct (skb); +return NF_ACCEPT ; + } +if (!nfct || skb->pkt_type ==PACKET_HOST )return NF_ACCEPT ;
net/bridge/br_private.h +1 -0
@@ -589,6 +589,7 @@ struct br_input_skb_cb {#endif u8 proxyarp_replied:1; u8 src_port_isolated:1; + u8 promisc:1;#ifdef CONFIG_BRIDGE_VLAN_FILTERING u8 vlan_filtered:1;#endif
net/bridge/netfilter/nf_conntrack_bridge.c +10 -4
@@ -294,18 +294,24 @@ static unsigned int nf_ct_bridge_pre(void *priv, struct sk_buff *skb,static unsigned int nf_ct_bridge_in (void *priv,struct sk_buff *skb,const struct nf_hook_state *state) { -enum ip_conntrack_info ctinfo; +bool promisc =BR_INPUT_SKB_CB (skb)->promisc; +struct nf_conntrack *nfct =skb_nfct (skb);struct nf_conn *ct; -if (skb->pkt_type ==PACKET_HOST ) +if (promisc) { +nf_reset_ct (skb); +return NF_ACCEPT ; + } + +if (!nfct || skb->pkt_type ==PACKET_HOST )return NF_ACCEPT ;/* nf_conntrack_confirm() cannot handle concurrent clones, * this happens for broad/multicast frames with e.g. macvlan on top * of the bridge device. */ - ct =nf_ct_get (skb, &ctinfo); -if (!ct ||nf_ct_is_confirmed (ct) ||nf_ct_is_template (ct)) + ct = container_of(nfct, struct nf_conn, ct_general); +if (nf_ct_is_confirmed (ct) ||nf_ct_is_template (ct))return NF_ACCEPT ;/* let inet prerouting call conntrack again */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 17/158 netfilter: nft_set_pipapo: constify lookup fn args where possible
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit f04df573faf90bb828a2241b650598c02c074323 ]
Those get called from packet path, content must not be modified. No functional changes intended.
Stable-dep-of: 29b359cf6d95 ("netfilter: nft_set_pipapo: walk over current view on netlink dump")
--- net/netfilter/nft_set_pipapo.c | 18 +++++---- net/netfilter/nft_set_pipapo.h | 6 +-- net/netfilter/nft_set_pipapo_avx2.c | 59 +++++++++++++++++------------ 3 files changed, 48 insertions(+), 35 deletions(-)
net/netfilter/nft_set_pipapo.c +10 -8
@@ -360,7 +360,7 @@* Return: -1 on no match, bit position on 'match_only', 0 otherwise. */ int pipapo_refill (unsigned long *map,int len,int rules,unsigned long *dst, -union nft_pipapo_map_bucket *mt,bool match_only) +const union nft_pipapo_map_bucket *mt,bool match_only) {unsigned long bitset;int k, ret =-1 ;
@@ -412,9 +412,9 @@ bool nft_pipapo_lookup(const struct net *net, const struct nft_set *set,struct nft_pipapo_scratch *scratch;unsigned long *res_map, *fill_map;u8 genmask =nft_genmask_cur (net); +const struct nft_pipapo_match *m; +const struct nft_pipapo_field *f;const u8 *rp = (const u8 *)key; -struct nft_pipapo_match *m; -struct nft_pipapo_field *f;bool map_index;int i;
@@ -519,11 +519,13 @@ static struct nft_pipapo_elem *pipapo_get(const struct net *net, {struct nft_pipapo_elem *ret =ERR_PTR (-ENOENT );struct nft_pipapo *priv =nft_set_priv (set); -struct nft_pipapo_match *m = priv->clone;unsigned long *res_map, *fill_map =NULL ; -struct nft_pipapo_field *f; +const struct nft_pipapo_match *m; +const struct nft_pipapo_field *f;int i; + m = priv->clone; + res_map =kmalloc_array (m->bsize_max,sizeof (*res_map),GFP_ATOMIC );if (!res_map) { ret =ERR_PTR (-ENOMEM );
@@ -1597,7 +1599,7 @@ static void pipapo_gc(struct nft_set *set, struct nft_pipapo_match *m)while ((rules_f0 =pipapo_rules_same_key (m->f, first_rule))) {union nft_pipapo_map_bucket rulemap[NFT_PIPAPO_MAX_FIELDS ]; -struct nft_pipapo_field *f; +const struct nft_pipapo_field *f;int i, start, rules_fx; start = first_rule;
@@ -2039,8 +2041,8 @@ static void nft_pipapo_walk(const struct nft_ctx *ctx, struct nft_set *set, {struct nft_pipapo *priv =nft_set_priv (set);struct net *net =read_pnet (&set->net); -struct nft_pipapo_match *m; -struct nft_pipapo_field *f; +const struct nft_pipapo_match *m; +const struct nft_pipapo_field *f;int i, r;rcu_read_lock ();
net/netfilter/nft_set_pipapo.h +3 -3
@@ -187,7 +187,7 @@ struct nft_pipapo_elem { };int pipapo_refill (unsigned long *map,int len,int rules,unsigned long *dst, -union nft_pipapo_map_bucket *mt,bool match_only); +const union nft_pipapo_map_bucket *mt,bool match_only);/** * pipapo_and_field_buckets_4bit() - Intersect 4-bit buckets
@@ -195,7 +195,7 @@ int pipapo_refill(unsigned long *map, int len, int rules, unsigned long *dst,* @dst: Area to store result * @data: Input data selecting table buckets */ -static inline void pipapo_and_field_buckets_4bit (struct nft_pipapo_field *f, +static inline void pipapo_and_field_buckets_4bit (const struct nft_pipapo_field *f,unsigned long *dst,const u8 *data) {
@@ -223,7 +223,7 @@ static inline void pipapo_and_field_buckets_4bit(struct nft_pipapo_field *f,* @dst: Area to store result * @data: Input data selecting table buckets */ -static inline void pipapo_and_field_buckets_8bit (struct nft_pipapo_field *f, +static inline void pipapo_and_field_buckets_8bit (const struct nft_pipapo_field *f,unsigned long *dst,const u8 *data) {
net/netfilter/nft_set_pipapo_avx2.c +35 -24
132 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 18/158 netfilter: nft_set_pipapo: walk over current view on netlink dump
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 29b359cf6d95fd60730533f7f10464e95bd17c73 ]
The generation mask can be updated while netlink dump is in progress. The pipapo set backend walk iterator cannot rely on it to infer what view of the datastructure is to be used. Add notation to specify if user wants to read/update the set.
Based on patch from Florian Westphal.
--- include/net/netfilter/nf_tables.h | 14 ++++++++++++++ net/netfilter/nf_tables_api.c | 6 ++++++ net/netfilter/nft_set_pipapo.c | 5 +++-- 3 files changed, 23 insertions(+), 2 deletions(-)
include/net/netfilter/nf_tables.h +14 -0
@@ -307,9 +307,23 @@ static inline void *nft_elem_priv_cast(const struct nft_elem_priv *priv)return (void *)priv; } + +/** +* enum nft_iter_type - nftables set iterator type +* +* @NFT_ITER_READ: read-only iteration over set elements +* @NFT_ITER_UPDATE: iteration under mutex to update set element state +*/ +enum nft_iter_type { +NFT_ITER_UNSPEC , +NFT_ITER_READ , +NFT_ITER_UPDATE , +}; +struct nft_set ;struct nft_set_iter {u8 genmask; +enum nft_iter_type type:8 ;unsigned int count;unsigned int skip;int err;
net/netfilter/nf_tables_api.c +6 -0
@@ -626,6 +626,7 @@ static void nft_map_deactivate(const struct nft_ctx *ctx, struct nft_set *set) {struct nft_set_iter iter = { .genmask =nft_genmask_next (ctx->net), + .type =NFT_ITER_UPDATE , .fn = nft_mapelem_deactivate, };
@@ -5441,6 +5442,7 @@ int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set, } iter.genmask =nft_genmask_next (ctx->net); + iter.type =NFT_ITER_UPDATE ; iter.skip =0 ; iter.count =0 ; iter.err =0 ;
@@ -5514,6 +5516,7 @@ static void nft_map_activate(const struct nft_ctx *ctx, struct nft_set *set) {struct nft_set_iter iter = { .genmask =nft_genmask_next (ctx->net), + .type =NFT_ITER_UPDATE , .fn = nft_mapelem_activate, };
@@ -5888,6 +5891,7 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb) args.skb = skb; args.reset = dump_ctx->reset; args.iter.genmask =nft_genmask_cur (net); + args.iter.type =NFT_ITER_READ ; args.iter.skip = cb->args[0 ]; args.iter.count =0 ; args.iter.err =0 ;
@@ -7372,6 +7376,7 @@ static int nft_set_flush(struct nft_ctx *ctx, struct nft_set *set, u8 genmask) {struct nft_set_iter iter = { .genmask = genmask, + .type =NFT_ITER_UPDATE , .fn = nft_setelem_flush, };
@@ -10871,6 +10876,7 @@ static int nf_tables_check_loops(const struct nft_ctx *ctx,continue ; iter.genmask =nft_genmask_next (ctx->net); + iter.type =NFT_ITER_UPDATE ; iter.skip =0 ; iter.count =0 ; iter.err =0 ;
net/netfilter/nft_set_pipapo.c +3 -2
@@ -2040,13 +2040,14 @@ static void nft_pipapo_walk(const struct nft_ctx *ctx, struct nft_set *set, struct nft_set_iter *iter) {struct nft_pipapo *priv =nft_set_priv (set); -struct net *net =read_pnet (&set->net);const struct nft_pipapo_match *m;const struct nft_pipapo_field *f;int i, r; +WARN_ON_ONCE (iter->type ==NFT_ITER_UNSPEC ); +rcu_read_lock (); -if (iter->genmask ==nft_genmask_cur (net)) +if (iter->type ==NFT_ITER_READ ) m =rcu_dereference (priv->match);else m = priv->clone;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 19/158 netfilter: nft_set_pipapo: do not free live element
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 3cfc9ec039af60dbd8965ae085b2c2ccdcfbe1cc ]
Pablo reports a crash with large batches of elements with a back-to-back add/remove pattern. Quoting Pablo:
add_elem("00000000") timeout 100 ms
...
add_elem("0000000X") timeout 100 ms
del_elem("0000000X") <---------------- delete one that was just added
...
add_elem("00005000") timeout 100 ms
1) nft_pipapo_remove() removes element 0000000X
Then, KASAN shows a splat.
Looking at the remove function there is a chance that we will drop a rule that maps to a non-deactivated element.
Removal happens in two steps, first we do a lookup for key k and return the to-be-removed element and mark it as inactive in the next generation. Then, in a second step, the element gets removed from the set/map.
The _remove function does not work correctly if we have more than one element that share the same key.
This can happen if we insert an element into a set when the set already holds an element with same key, but the element mapping to the existing key has timed out or is not active in the next generation.
In such case its possible that removal will unmap the wrong element. If this happens, we will leak the non-deactivated element, it becomes unreachable.
The element that got deactivated (and will be freed later) will remain reachable in the set data structure, this can result in a crash when such an element is retrieved during lookup (stale pointer).
Add a check that the fully matching key does in fact map to the element that we have marked as inactive in the deactivation step.
If not, we need to continue searching.
Add a bug/warn trap at the end of the function as well, the remove function must not ever be called with an invisible/unreachable/non-existent element.
v2: avoid uneeded temporary variable (Stefano)
--- net/netfilter/nft_set_pipapo.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
net/netfilter/nft_set_pipapo.c +9 -5
@@ -2002,6 +2002,8 @@ static void nft_pipapo_remove(const struct net *net, const struct nft_set *set, rules_fx = rules_f0;nft_pipapo_for_each_field (f, i, m) { +bool last = i == m->field_count -1 ; +if (!pipapo_match_field (f, start, rules_fx, match_start, match_end))break ;
@@ -2014,16 +2016,18 @@ static void nft_pipapo_remove(const struct net *net, const struct nft_set *set, match_start +=NFT_PIPAPO_GROUPS_PADDED_SIZE (f); match_end +=NFT_PIPAPO_GROUPS_PADDED_SIZE (f); - } -if (i == m->field_count) { - priv->dirty = true; -pipapo_drop (m, rulemap); -return ; +if (last && f->mt[rulemap[i].to].e == e) { + priv->dirty = true; +pipapo_drop (m, rulemap); +return ; + } } first_rule += rules_f0; } + +WARN_ON_ONCE (1 );/* elem_priv not found */ }/**
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 20/158 netfilter: flowtable: validate pppoe header
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 87b3593bed1868b2d9fe096c01bcdf0ea86cbebf ]
Ensure there is sufficient room to access the protocol field of the PPPoe header. Validate it once before the flowtable lookup, then use a helper function to access protocol field.
--- include/net/netfilter/nf_flow_table.h | 12 +++++++++++- net/netfilter/nf_flow_table_inet.c | 3 ++- net/netfilter/nf_flow_table_ip.c | 8 +++++--- 3 files changed, 18 insertions(+), 5 deletions(-)
include/net/netfilter/nf_flow_table.h +11 -1
@@ -336,7 +336,7 @@ int nf_flow_rule_route_ipv6(struct net *net, struct flow_offload *flow,int nf_flow_table_offload_init (void );void nf_flow_table_offload_exit (void ); -static inline __be16 nf_flow_pppoe_proto (const struct sk_buff *skb) +static inline __be16 __nf_flow_pppoe_proto (const struct sk_buff *skb) {__be16 proto;
@@ -352,6 +352,16 @@ static inline __be16 nf_flow_pppoe_proto(const struct sk_buff *skb)return 0 ; } +static inline bool nf_flow_pppoe_proto (struct sk_buff *skb,__be16 *inner_proto) +{ +if (!pskb_may_pull (skb,PPPOE_SES_HLEN )) +return false; + + *inner_proto =__nf_flow_pppoe_proto (skb); + +return true; +} +#define NF_FLOW_TABLE_STAT_INC (net, count) __this_cpu_inc((net)->ft.stat->count)#define NF_FLOW_TABLE_STAT_DEC (net, count) __this_cpu_dec((net)->ft.stat->count)#define NF_FLOW_TABLE_STAT_INC_ATOMIC (net, count) \
net/netfilter/nf_flow_table_inet.c +2 -1
@@ -21,7 +21,8 @@ nf_flow_offload_inet_hook(void *priv, struct sk_buff *skb, proto = veth->h_vlan_encapsulated_proto;break ;case htons (ETH_P_PPP_SES ): - proto =nf_flow_pppoe_proto (skb); +if (!nf_flow_pppoe_proto (skb, &proto)) +return NF_ACCEPT ;break ;default : proto = skb->protocol;
net/netfilter/nf_flow_table_ip.c +5 -3
@@ -273,10 +273,11 @@ static unsigned int nf_flow_xmit_xfrm(struct sk_buff *skb,return NF_STOLEN ; } -static bool nf_flow_skb_encap_protocol (const struct sk_buff *skb,__be16 proto, +static bool nf_flow_skb_encap_protocol (struct sk_buff *skb,__be16 proto,u32 *offset) {struct vlan_ethhdr *veth; +__be16 inner_proto;switch (skb->protocol) {case htons (ETH_P_8021Q ):
@@ -287,7 +288,8 @@ static bool nf_flow_skb_encap_protocol(const struct sk_buff *skb, __be16 proto, }break ;case htons (ETH_P_PPP_SES ): -if (nf_flow_pppoe_proto (skb) == proto) { +if (nf_flow_pppoe_proto (skb, &inner_proto) && + inner_proto == proto) { *offset +=PPPOE_SES_HLEN ;return true; }
@@ -316,7 +318,7 @@ static void nf_flow_encap_pop(struct sk_buff *skb,skb_reset_network_header (skb);break ;case htons (ETH_P_PPP_SES ): - skb->protocol =nf_flow_pppoe_proto (skb); + skb->protocol =__nf_flow_pppoe_proto (skb);skb_pull (skb,PPPOE_SES_HLEN );skb_reset_network_header (skb);break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 21/158 netfilter: flowtable: incorrect pppoe tuple
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 6db5dc7b351b9569940cd1cf445e237c42cd6d27 ]
pppoe traffic reaching ingress path does not match the flowtable entry because the pppoe header is expected to be at the network header offset. This bug causes a mismatch in the flow table lookup, so pppoe packets enter the classical forwarding path.
--- net/netfilter/nf_flow_table_ip.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/nf_flow_table_ip.c +1 -1
@@ -157,7 +157,7 @@ static void nf_flow_tuple_encap(struct sk_buff *skb, tuple->encap[i].proto = skb->protocol;break ;case htons (ETH_P_PPP_SES ): - phdr = (struct pppoe_hdr *)skb_mac_header (skb); + phdr = (struct pppoe_hdr *)skb_network_header (skb); tuple->encap[i].id =ntohs (phdr->sid); tuple->encap[i].proto = skb->protocol;break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 22/158 af_unix: Call manage_oob() for every skb in unix_stream_read_generic().
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 283454c8a123072e5c386a5a2b5fc576aa455b6f ]
When we call recv() for AF_UNIX socket, we first peek one skb and calls manage_oob() to check if the skb is sent with MSG_OOB.
However, when we fetch the next (and the following) skb, manage_oob() is not called now, leading a wrong behaviour.
Let's say a socket send()s "hello" with MSG_OOB and the peer tries to recv() 5 bytes with MSG_PEEK. Here, we should get only "hell" without 'o', but actually not:
Quoted 3 lines
Quoted 3 lines
Quoted 3 lines
from socket import *
c1, c2 =socketpair(AF_UNIX, SOCK_STREAM)c1.send(b'hello', MSG_OOB)
5
Quoted 1 line
Quoted 1 line
Quoted 1 line
c2.recv(5, MSG_PEEK)
b'hello'
The first skb fills 4 bytes, and the next skb is peeked but not properly checked by manage_oob().
Let's move up the again label to call manage_oob() for evry skb.
With this patch:
Quoted 3 lines
Quoted 3 lines
Quoted 3 lines
from socket import *
c1, c2 =socketpair(AF_UNIX, SOCK_STREAM)c1.send(b'hello', MSG_OOB)
5
Quoted 1 line
Quoted 1 line
Quoted 1 line
c2.recv(5, MSG_PEEK)
b'hell'
--- net/unix/af_unix.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/unix/af_unix.c +1 -1
@@ -2680,6 +2680,7 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state, last = skb =skb_peek (&sk->sk_receive_queue); last_len = last ? last->len :0 ; +again:#if IS_ENABLED (CONFIG_AF_UNIX_OOB )if (skb) { skb =manage_oob (skb, sk, flags, copied);
@@ -2691,7 +2692,6 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state, } }#endif -again:if (skb ==NULL ) {if (copied >= target) goto unlock;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 23/158 af_unix: Dont peek OOB data without MSG_OOB.
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 22dd70eb2c3d754862964377a75abafd3167346b ]
Currently, we can read OOB data without MSG_OOB by using MSG_PEEK when OOB data is sitting on the front row, which is apparently wrong.
Quoted 3 lines
Quoted 3 lines
Quoted 3 lines
from socket import *
c1, c2 =socketpair(AF_UNIX, SOCK_STREAM)c1.send(b'a', MSG_OOB)
1
Quoted 1 line
Quoted 1 line
Quoted 1 line
c2.recv(1, MSG_PEEK | MSG_DONTWAIT)
b'a'
If manage_oob() is called when no data has been copied, we only check if the socket enables SO_OOBINLINE or MSG_PEEK is not used. Otherwise, the skb is returned as is.
However, here we should return NULL if MSG_PEEK is set and no data has been copied.
Also, in such a case, we should not jump to the redo label because we will be caught in the loop and hog the CPU until normal data comes in.
Then, we need to handle skb == NULL case with the if-clause below the manage_oob() block.
With this patch:
Quoted 3 lines
Quoted 3 lines
Quoted 3 lines
from socket import *
c1, c2 =socketpair(AF_UNIX, SOCK_STREAM)c1.send(b'a', MSG_OOB)
1
Quoted 1 line
Quoted 1 line
Quoted 1 line
c2.recv(1, MSG_PEEK | MSG_DONTWAIT)
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
BlockingIOError: [Errno 11] Resource temporarily unavailable
--- net/unix/af_unix.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
net/unix/af_unix.c +5 -5
@@ -2602,7 +2602,9 @@ static struct sk_buff *manage_oob(struct sk_buff *skb, struct sock *sk,WRITE_ONCE (u->oob_skb,NULL );consume_skb (skb); } - }else if (!(flags &MSG_PEEK )) { + }else if (flags &MSG_PEEK ) { + skb =NULL ; + }else {skb_unlink (skb, &sk->sk_receive_queue);WRITE_ONCE (u->oob_skb,NULL );if (!WARN_ON_ONCE (skb_unref (skb)))
@@ -2684,11 +2686,9 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state,#if IS_ENABLED (CONFIG_AF_UNIX_OOB )if (skb) { skb =manage_oob (skb, sk, flags, copied); -if (!skb) { +if (!skb && copied) {unix_state_unlock (sk); -if (copied) -break ; - goto redo; +break ; } }#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 24/158 net: sparx5: flower: fix fragment flags handling
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Asbjørn Sloth Tønnesen <[email protected]>
[ Upstream commit 68aba00483c7c4102429bcdfdece7289a8ab5c8e ]
I noticed that only 3 out of the 4 input bits were used, mt.key->flags & FLOW_DIS_IS_FRAGMENT was never checked.
In order to avoid a complicated maze, I converted it to use a 16 byte mapping table.
As shown in the table below the old heuristics doesn't always do the right thing, ie. when FLOW_DIS_IS_FRAGMENT=1/1 then it used to only match follow-up fragment packets.
Here are all the combinations, and their resulting new/old VCAP key/mask filter:
/- FLOW_DIS_IS_FRAGMENT (key/mask)
| /- FLOW_DIS_FIRST_FRAG (key/mask) | | /-- new VCAP fragment (key/mask) v v v v- old VCAP fragment (key/mask)
0/0 0/0 -/- -/- impossible (due to entry cond. on mask) 0/0 0/1 -/- 0/3 !! invalid (can't match non-fragment + follow-up frag) 0/0 1/0 -/- -/- impossible (key > mask) 0/0 1/1 1/3 1/3 first fragment
0/1 0/0 0/3 3/3 !! not fragmented 0/1 0/1 0/3 3/3 !! not fragmented (+ not first fragment) 0/1 1/0 -/- -/- impossible (key > mask) 0/1 1/1 -/- 1/3 !! invalid (non-fragment and first frag)
1/0 0/0 -/- -/- impossible (key > mask) 1/0 0/1 -/- -/- impossible (key > mask) 1/0 1/0 -/- -/- impossible (key > mask) 1/0 1/1 -/- -/- impossible (key > mask)
1/1 0/0 1/1 3/3 !! some fragment 1/1 0/1 3/3 3/3 follow-up fragment 1/1 1/0 -/- -/- impossible (key > mask) 1/1 1/1 1/3 1/3 first fragment
In the datasheet the VCAP fragment values are documented as:
0 = no fragment
1 = initial fragment
2 = suspicious fragment
3 = valid follow-up fragment
Result: 3 combinations match the old behavior,
3 combinations have been corrected,
2 combinations are now invalid, and fail, 8 combinations are impossible.
It should now be aligned with how FLOW_DIS_IS_FRAGMENT and FLOW_DIS_FIRST_FRAG is set in __skb_flow_dissect() in net/core/flow_dissector.c
Since the VCAP fragment values are not a bitfield, we have to ignore the suspicious fragment value, eg. when matching on any kind of fragment with FLOW_DIS_IS_FRAGMENT=1/1.
Only compile tested, and logic tested in userspace, as I unfortunately don't have access to this switch chip (yet).
--- .../microchip/sparx5/sparx5_tc_flower.c | 61 ++++++++++++------- 1 file changed, 40 insertions(+), 21 deletions(-)
drivers/net/ethernet/microchip/sparx5/sparx5_tc_flower.c +40 -21
@@ -36,6 +36,27 @@ struct sparx5_tc_flower_template {u16 l3_proto;/* protocol specified in the template */ }; +/* SparX-5 VCAP fragment types: +* 0 = no fragment, 1 = initial fragment, +* 2 = suspicious fragment, 3 = valid follow-up fragment +*/ +enum {/* key / mask */ +FRAG_NOT =0x03 ,/* 0 / 3 */ +FRAG_SOME =0x11 ,/* 1 / 1 */ +FRAG_FIRST =0x13 ,/* 1 / 3 */ +FRAG_LATER =0x33 ,/* 3 / 3 */ +FRAG_INVAL =0xff ,/* invalid */ +}; + +/* Flower fragment flag to VCAP fragment type mapping */ +static const u8 sparx5_vcap_frag_map[4 ][4 ] = {/* is_frag */ + {FRAG_INVAL ,FRAG_INVAL ,FRAG_INVAL ,FRAG_FIRST },/* 0/0 */ + {FRAG_NOT ,FRAG_NOT ,FRAG_INVAL ,FRAG_INVAL },/* 0/1 */ + {FRAG_INVAL ,FRAG_INVAL ,FRAG_INVAL ,FRAG_INVAL },/* 1/0 */ + {FRAG_SOME ,FRAG_LATER ,FRAG_INVAL ,FRAG_FIRST }/* 1/1 */ +/* 0/0 0/1 1/0 1/1 <-- first_frag */ +}; +static int sparx5_tc_flower_es0_tpid (struct vcap_tc_flower_parse_usage *st) {
@@ -145,29 +166,27 @@ sparx5_tc_flower_handler_control_usage(struct vcap_tc_flower_parse_usage *st)flow_rule_match_control (st->frule, &mt);if (mt.mask->flags) { -if (mt.mask->flags &FLOW_DIS_FIRST_FRAG ) { -if (mt.key->flags &FLOW_DIS_FIRST_FRAG ) { - value =1 ;/* initial fragment */ - mask =0x3 ; - }else { -if (mt.mask->flags &FLOW_DIS_IS_FRAGMENT ) { - value =3 ;/* follow up fragment */ - mask =0x3 ; - }else { - value =0 ;/* no fragment */ - mask =0x3 ; - } - } - }else { -if (mt.mask->flags &FLOW_DIS_IS_FRAGMENT ) { - value =3 ;/* follow up fragment */ - mask =0x3 ; - }else { - value =0 ;/* no fragment */ - mask =0x3 ; - } +u8 is_frag_key = !!(mt.key->flags &FLOW_DIS_IS_FRAGMENT ); +u8 is_frag_mask = !!(mt.mask->flags &FLOW_DIS_IS_FRAGMENT ); +u8 is_frag_idx = (is_frag_key <<1 ) | is_frag_mask; + +u8 first_frag_key = !!(mt.key->flags &FLOW_DIS_FIRST_FRAG ); +u8 first_frag_mask = !!(mt.mask->flags &FLOW_DIS_FIRST_FRAG ); +u8 first_frag_idx = (first_frag_key <<1 ) | first_frag_mask; + +/* Lookup verdict based on the 2 + 2 input bits */ +u8 vdt = sparx5_vcap_frag_map[is_frag_idx][first_frag_idx]; + +if (vdt ==FRAG_INVAL ) { +NL_SET_ERR_MSG_MOD (st->fco->common.extack, +"Match on invalid fragment flag combination" ); +return -EINVAL ; } +/* Extract VCAP fragment key and mask from verdict */ + value = (vdt >>4 ) &0x3 ; + mask = vdt &0x3 ; + err =vcap_rule_add_key_u32 (st->vrule,VCAP_KF_L3_FRAGMENT_TYPE , value, mask);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 25/158 net/mlx5: Lag, restore buckets number to default after hash LAG deactivation
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shay Drory <[email protected]>
[ Upstream commit 37cc10da3a50e6d0cb9808a90b7da9b4868794dd ]
The cited patch introduces the concept of buckets in LAG in hash mode. However, the patch doesn't clear the number of buckets in the LAG deactivation. This results in using the wrong number of buckets in case user create a hash mode LAG and afterwards create a non-hash mode LAG.
Hence, restore buckets number to default after hash mode LAG deactivation.
--- drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c +3 -1
@@ -703,8 +703,10 @@ int mlx5_deactivate_lag(struct mlx5_lag *ldev)return err; } -if (test_bit (MLX5_LAG_MODE_FLAG_HASH_BASED , &flags)) +if (test_bit (MLX5_LAG_MODE_FLAG_HASH_BASED , &flags)) {mlx5_lag_port_sel_destroy (ldev); + ldev->buckets =1 ; + }if (mlx5_lag_has_drop_rule (ldev))mlx5_lag_drop_rule_cleanup (ldev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 26/158 net/mlx5: Restore mistakenly dropped parts in register devlink flow
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shay Drory <[email protected]>
[ Upstream commit bf729988303a27833a86acb561f42b9a3cc12728 ]
Code parts from cited commit were mistakenly dropped while rebasing before submission. Add them here.
--- drivers/net/ethernet/mellanox/mlx5/core/main.c | 5 ++++- drivers/net/ethernet/mellanox/mlx5/core/sf/dev/driver.c | 1 - 2 files changed, 4 insertions(+), 2 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/main.c +4 -1
@@ -1699,12 +1699,15 @@ int mlx5_init_one_light(struct mlx5_core_dev *dev) err =mlx5_devlink_params_register (priv_to_devlink (dev));if (err) {mlx5_core_warn (dev,"mlx5_devlink_param_reg err = %d\n" , err); - goto query_hca_caps_err; + goto params_reg_err; }devl_unlock (devlink);return 0 ; +params_reg_err: +devl_unregister (devlink); +devl_unlock (devlink); query_hca_caps_err:devl_unregister (devlink);devl_unlock (devlink);
drivers/net/ethernet/mellanox/mlx5/core/sf/dev/driver.c +0 -1
@@ -75,7 +75,6 @@ static int mlx5_sf_dev_probe(struct auxiliary_device *adev, const struct auxilia goto peer_devlink_set_err; } -devlink_register (devlink);return 0 ; peer_devlink_set_err:
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 27/158 net/mlx5e: Prevent deadlock while disabling aRFS
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carolina Jubran <[email protected]>
[ Upstream commit fef965764cf562f28afb997b626fc7c3cec99693 ]
When disabling aRFS under the priv->state_lock, any scheduled aRFS works are canceled using the cancel_work_sync function, which waits for the work to end if it has already started. However, while waiting for the work handler, the handler will try to acquire the state_lock which is already acquired.
The worker acquires the lock to delete the rules if the state is down, which is not the worker's responsibility since disabling aRFS deletes the rules.
Add an aRFS state variable, which indicates whether the aRFS is enabled and prevent adding rules when the aRFS is disabled.
Kernel log:
======================================================
WARNING: possible circular locking dependency detected
6.7.0-rc4_net_next_mlx5_5483eb2 #1 Tainted: G I
------------------------------------------------------
ethtool/386089 is trying to acquire lock:ffff88810f21ce68 ((work_completion)(&rule->arfs_work)){+.+.}-{0:0}, at: __flush_work+0x74/0x4e0
but task is already holding lock:ffff8884a1808cc0 (&priv->state_lock){+.+.}-{3:3}, at: mlx5e_ethtool_set_channels+0x53/0x200 [mlx5_core]
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (&priv->state_lock){+.+.}-{3:3}:
__mutex_lock+0x80/0xc90
arfs_handle_work+0x4b/0x3b0 [mlx5_core]
process_one_work+0x1dc/0x4a0
worker_thread+0x1bf/0x3c0
kthread+0xd7/0x100
ret_from_fork+0x2d/0x50
ret_from_fork_asm+0x11/0x20-> #0 ((work_completion)(&rule->arfs_work)){+.+.}-{0:0}:
__lock_acquire+0x17b4/0x2c80
lock_acquire+0xd0/0x2b0
__flush_work+0x7a/0x4e0
__cancel_work_timer+0x131/0x1c0
arfs_del_rules+0x143/0x1e0 [mlx5_core]
mlx5e_arfs_disable+0x1b/0x30 [mlx5_core]
mlx5e_ethtool_set_channels+0xcb/0x200 [mlx5_core]
ethnl_set_channels+0x28f/0x3b0
ethnl_default_set_doit+0xec/0x240
genl_family_rcv_msg_doit+0xd0/0x120
genl_rcv_msg+0x188/0x2c0
netlink_rcv_skb+0x54/0x100
genl_rcv+0x24/0x40
netlink_unicast+0x1a1/0x270
netlink_sendmsg+0x214/0x460
__sock_sendmsg+0x38/0x60
__sys_sendto+0x113/0x170
__x64_sys_sendto+0x20/0x30
do_syscall_64+0x40/0xe0
entry_SYSCALL_64_after_hwframe+0x46/0x4eother info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&priv->state_lock);
lock((work_completion)(&rule->arfs_work));
lock(&priv->state_lock);lock((work_completion)(&rule->arfs_work));
*** DEADLOCK ***
3 locks held by ethtool/386089:
#0: ffffffff82ea7210 (cb_lock){++++}-{3:3}, at: genl_rcv+0x15/0x40
#1: ffffffff82e94c88 (rtnl_mutex){+.+.}-{3:3}, at: ethnl_default_set_doit+0xd3/0x240
#2: ffff8884a1808cc0 (&priv->state_lock){+.+.}-{3:3}, at: mlx5e_ethtool_set_channels+0x53/0x200 [mlx5_core]
stack backtrace: CPU: 15 PID: 386089 Comm: ethtool Tainted: G I 6.7.0-rc4_net_next_mlx5_5483eb2 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x60/0xa0 check_noncircular+0x144/0x160 __lock_acquire+0x17b4/0x2c80 lock_acquire+0xd0/0x2b0 ? __flush_work+0x74/0x4e0 ? save_trace+0x3e/0x360 ? __flush_work+0x74/0x4e0 __flush_work+0x7a/0x4e0 ? __flush_work+0x74/0x4e0 ? __lock_acquire+0xa78/0x2c80 ? lock_acquire+0xd0/0x2b0 ? mark_held_locks+0x49/0x70 __cancel_work_timer+0x131/0x1c0 ? mark_held_locks+0x49/0x70 arfs_del_rules+0x143/0x1e0 [mlx5_core] mlx5e_arfs_disable+0x1b/0x30 [mlx5_core] mlx5e_ethtool_set_channels+0xcb/0x200 [mlx5_core] ethnl_set_channels+0x28f/0x3b0 ethnl_default_set_doit+0xec/0x240 genl_family_rcv_msg_doit+0xd0/0x120 genl_rcv_msg+0x188/0x2c0 ? ethnl_ops_begin+0xb0/0xb0 ? genl_family_rcv_msg_dumpit+0xf0/0xf0 netlink_rcv_skb+0x54/0x100 genl_rcv+0x24/0x40 netlink_unicast+0x1a1/0x270 netlink_sendmsg+0x214/0x460 __sock_sendmsg+0x38/0x60 __sys_sendto+0x113/0x170 ? do_user_addr_fault+0x53f/0x8f0 __x64_sys_sendto+0x20/0x30 do_syscall_64+0x40/0xe0 entry_SYSCALL_64_after_hwframe+0x46/0x4e </TASK>
--- .../net/ethernet/mellanox/mlx5/core/en_arfs.c | 27 +++++++++++-------- 1 file changed, 16 insertions(+), 11 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c +16 -11
@@ -45,6 +45,10 @@ struct arfs_table {struct hlist_head rules_hash[ARFS_HASH_SIZE ]; }; +enum { +MLX5E_ARFS_STATE_ENABLED , +}; +enum arfs_type {ARFS_IPV4_TCP ,ARFS_IPV6_TCP ,
@@ -59,6 +63,7 @@ struct mlx5e_arfs_tables {spinlock_t arfs_lock;int last_filter_id;struct workqueue_struct *wq; +unsigned long state; };struct arfs_tuple {
@@ -169,6 +174,8 @@ int mlx5e_arfs_enable(struct mlx5e_flow_steering *fs)return err; } } +set_bit (MLX5E_ARFS_STATE_ENABLED , &arfs->state); +return 0 ; }
@@ -454,6 +461,8 @@ static void arfs_del_rules(struct mlx5e_flow_steering *fs)int i;int j; +clear_bit (MLX5E_ARFS_STATE_ENABLED , &arfs->state); +spin_lock_bh (&arfs->arfs_lock);mlx5e_for_each_arfs_rule (rule, htmp, arfs->arfs_tables, i, j) {hlist_del_init (&rule->hlist);
@@ -626,17 +635,8 @@ static void arfs_handle_work(struct work_struct *work)struct mlx5_flow_handle *rule; arfs =mlx5e_fs_get_arfs (priv->fs); -mutex_lock (&priv->state_lock); -if (!test_bit (MLX5E_STATE_OPENED , &priv->state)) { -spin_lock_bh (&arfs->arfs_lock); -hlist_del (&arfs_rule->hlist); -spin_unlock_bh (&arfs->arfs_lock); - -mutex_unlock (&priv->state_lock); -kfree (arfs_rule); - goto out; - } -mutex_unlock (&priv->state_lock); +if (!test_bit (MLX5E_ARFS_STATE_ENABLED , &arfs->state)) +return ;if (!arfs_rule->rule) { rule =arfs_add_rule (priv, arfs_rule);
@@ -752,6 +752,11 @@ int mlx5e_rx_flow_steer(struct net_device *dev, const struct sk_buff *skb,return -EPROTONOSUPPORT ;spin_lock_bh (&arfs->arfs_lock); +if (!test_bit (MLX5E_ARFS_STATE_ENABLED , &arfs->state)) { +spin_unlock_bh (&arfs->arfs_lock); +return -EPERM ; + } + arfs_rule =arfs_find_rule (arfs_t, &fk);if (arfs_rule) {if (arfs_rule->rxq == rxq_index ||work_busy (&arfs_rule->arfs_work)) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 28/158 net: change maximum number of UDP segments to 128
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuri Benditovich <[email protected]>
[ Upstream commit 1382e3b6a3500c245e5278c66d210c02926f804f ]
The commit fc8b2a619469
("net: more strict VIRTIO_NET_HDR_GSO_UDP_L4 validation") adds check of potential number of UDP segments vs UDP_MAX_SEGMENTS in linux/virtio_net.h.
After this change certification test of USO guest-to-guest transmit on Windows driver for virtio-net device fails, for example with packet size of ~64K and mss of 536 bytes. In general the USO should not be more restrictive than TSO. Indeed, in case of unreasonably small mss a lot of segments can cause queue overflow and packet loss on the destination. Limit of 128 segments is good for any practical purpose, with minimal meaningful mss of 536 the maximal UDP packet will be divided to ~120 segments.
The number of segments for UDP packets is validated vs UDP_MAX_SEGMENTS also in udp.c (v4,v6), this does not affect quest-to-guest path but does affect packets sent to host, for example.
It is important to mention that UDP_MAX_SEGMENTS is kernel-only define and not available to user mode socket applications. In order to request MSS smaller than MTU the applications just uses setsockopt with SOL_UDP and UDP_SEGMENT and there is no limitations on socket API level.
--- include/linux/udp.h | 2 +- tools/testing/selftests/net/udpgso.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
include/linux/udp.h +1 -1
@@ -105,7 +105,7 @@ struct udp_sock {#define udp_assign_bit (nr, sk, val) \ assign_bit(UDP_FLAGS_##nr, &udp_sk(sk)->udp_flags, val) -#define UDP_MAX_SEGMENTS (1 << 6UL) +#define UDP_MAX_SEGMENTS (1 << 7UL)#define udp_sk (ptr) container_of_const(ptr, struct udp_sock, inet.sk)
tools/testing/selftests/net/udpgso.c +1 -1
@@ -34,7 +34,7 @@#endif #ifndef UDP_MAX_SEGMENTS -#define UDP_MAX_SEGMENTS (1 << 6UL) +#define UDP_MAX_SEGMENTS (1 << 7UL)#endif #define CONST_MTU_TEST 1500
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 29/158 octeontx2-pf: fix FLOW_DIS_IS_FRAGMENT implementation
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Asbjørn Sloth Tønnesen <[email protected]>
[ Upstream commit 75ce9506ee3dc66648a7d74ab3b0acfa364d6d43 ]
Upon reviewing the flower control flags handling in this driver, I notice that the key wasn't being used, only the mask.
Ie. tc flower ... ip_flags nofrag was hardware
offloaded as ... ip_flags frag.
Only compile tested, no access to HW.
--- drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c +5 -2
@@ -688,6 +688,7 @@ static int otx2_tc_prepare_flow(struct otx2_nic *nic, struct otx2_tc_flow *node,if (flow_rule_match_key (rule,FLOW_DISSECTOR_KEY_CONTROL )) {struct flow_match_control match; +u32 val;flow_rule_match_control (rule, &match);if (match.mask->flags &FLOW_DIS_FIRST_FRAG ) {
@@ -696,12 +697,14 @@ static int otx2_tc_prepare_flow(struct otx2_nic *nic, struct otx2_tc_flow *node, }if (match.mask->flags &FLOW_DIS_IS_FRAGMENT ) { + val = match.key->flags &FLOW_DIS_IS_FRAGMENT ;if (ntohs (flow_spec->etype) ==ETH_P_IP ) { - flow_spec->ip_flag =IPV4_FLAG_MORE ; + flow_spec->ip_flag = val ?IPV4_FLAG_MORE :0 ; flow_mask->ip_flag =IPV4_FLAG_MORE ; req->features |=BIT_ULL (NPC_IPFRAG_IPV4 ); }else if (ntohs (flow_spec->etype) ==ETH_P_IPV6 ) { - flow_spec->next_header =IPPROTO_FRAGMENT ; + flow_spec->next_header = val ? +IPPROTO_FRAGMENT :0 ; flow_mask->next_header =0xff ; req->features |=BIT_ULL (NPC_IPFRAG_IPV6 ); }else {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 30/158 selftests/tcp_ao: Make RST tests less flaky
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Safonov <[email protected]>
[ Upstream commit 4225dfa4535f219b03ae14147d9c6e7e82ec8df4 ]
Currently, "active reset" cases are flaky, because select() is called for 3 sockets, while only 2 are expected to receive RST. The idea of the third socket was to get into request_sock_queue, but the test mistakenly attempted to connect() after the listener socket was shut down.
Repair this test, it's important to check the different kernel code-paths for signing RST TCP-AO segments.
--- tools/testing/selftests/net/tcp_ao/rst.c | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-)
tools/testing/selftests/net/tcp_ao/rst.c +13 -10
@@ -256,8 +256,6 @@ static int test_wait_fds(int sk[], size_t nr, bool is_writable[],static void test_client_active_rst (unsigned int port) { -/* one in queue, another accept()ed */ -unsigned int wait_for = backlog +2 ;int i, sk[3 ], err;bool is_writable[ARRAY_SIZE (sk)] = {false};unsigned int last =ARRAY_SIZE (sk) -1 ;
@@ -275,16 +273,20 @@ static void test_client_active_rst(unsigned int port)for (i =0 ; i < last; i++) { err =_test_connect_socket (sk[i], this_ip_dest, port, (i ==0 ) ?TEST_TIMEOUT_SEC :-1 ); -if (err <0 )test_error ("failed to connect()" ); } -synchronize_threads ();/* 2: connection accept()ed, another queued */ - err =test_wait_fds (sk, last, is_writable, wait_for,TEST_TIMEOUT_SEC ); +synchronize_threads ();/* 2: two connections: one accept()ed, another queued */ + err =test_wait_fds (sk, last, is_writable, last,TEST_TIMEOUT_SEC );if (err <0 )test_error ("test_wait_fds(): %d" , err); +/* async connect() with third sk to get into request_sock_queue */ + err =_test_connect_socket (sk[last], this_ip_dest, port,-1 ); +if (err <0 ) +test_error ("failed to connect()" ); +synchronize_threads ();/* 3: close listen socket */ if (test_client_verify (sk[0 ], packet_sz, quota / packet_sz,TEST_TIMEOUT_SEC ))test_fail ("Failed to send data on connected socket" );
@@ -292,13 +294,14 @@ static void test_client_active_rst(unsigned int port)test_ok ("Verified established tcp connection" );synchronize_threads ();/* 4: finishing up */ - err =_test_connect_socket (sk[last], this_ip_dest, port,-1 ); -if (err <0 ) -test_error ("failed to connect()" );synchronize_threads ();/* 5: closed active sk */ - err =test_wait_fds (sk,ARRAY_SIZE (sk),NULL , - wait_for,TEST_TIMEOUT_SEC ); +/* +* Wait for 2 connections: one accepted, another in the accept queue, +* the one in request_sock_queue won't get fully established, so +* doesn't receive an active RST, see inet_csk_listen_stop(). +*/ + err =test_wait_fds (sk, last,NULL , last,TEST_TIMEOUT_SEC );if (err <0 )test_error ("select(): %d" , err);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 31/158 selftests/tcp_ao: Zero-init tcp_ao_info_opt
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Safonov <[email protected]>
[ Upstream commit b089b3bead532419cdcbd8e4e0a3e23c49d11573 ]
The structure is on the stack and has to be zero-initialized as the kernel checks for:
Quoted 2 lines
if (in.reserved != 0 || in.reserved2 != 0) return -EINVAL;
--- tools/testing/selftests/net/tcp_ao/setsockopt-closed.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/net/tcp_ao/setsockopt-closed.c +1 -1
@@ -21,7 +21,7 @@ static void make_listen(int sk)static void test_vefify_ao_info (int sk,struct tcp_ao_info_opt *info,const char *tst) { -struct tcp_ao_info_opt tmp; +struct tcp_ao_info_opt tmp = {};socklen_t len =sizeof (tmp);if (getsockopt (sk,IPPROTO_TCP ,TCP_AO_INFO , &tmp, &len))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 32/158 selftests/tcp_ao: Fix fscanf() call for format-security
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Safonov <[email protected]>
[ Upstream commit beb78cd1329d039d73487ca05633d1b92e1ab2ea ]
On my new laptop with packages from nixos-unstable, gcc 12.3.0 produces:
Quoted 5 lines
lib/proc.c: In function ‘netstat_read_type’:lib/proc.c:89:9: error: format not a string literal and no format arguments [-Werror=format-security]89 | if (fscanf(fnetstat, type->header_name) == EOF) | ^~cc1: some warnings being treated as errors
Here the selftests lib parses header name, while expectes non-space word ending with a column.
--- tools/testing/selftests/net/tcp_ao/lib/proc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/net/tcp_ao/lib/proc.c +1 -1
@@ -86,7 +86,7 @@ static void netstat_read_type(FILE *fnetstat, struct netstat **dest, char *line) pos =strchr (line,' ' ) +1 ; -if (fscanf (fnetstat, type->header_name) ==EOF ) +if (fscanf (fnetstat,"%[^ :]" , type->header_name) ==EOF )test_error ("fscanf(%s)" , type->header_name);if (fread (&tmp,1 ,1 , fnetstat) !=1 || tmp !=':' )test_error ("Unexpected netstat format (%c)" , tmp);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 33/158 selftests/tcp_ao: Printing fixes to confirm with format-security
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Safonov <[email protected]>
[ Upstream commit b476c93654d748c13624f7c7d0ba191c56a8092e ]
On my new laptop with packages from nixos-unstable, gcc 12.3.0 produces
Quoted 24 lines
lib/setup.c: In function ‘__test_msg’:lib/setup.c:20:9: error: format not a string literal and no format arguments [-Werror=format-security]20 | ksft_print_msg(buf); | ^~~~~~~~~~~~~~ lib/setup.c: In function ‘__test_ok’: lib/setup.c:26:9: error: format not a string literal and no format arguments [-Werror=format-security] 26 | ksft_test_result_pass(buf); | ^~~~~~~~~~~~~~~~~~~~~ lib/setup.c: In function ‘__test_fail’: lib/setup.c:32:9: error: format not a string literal and no format arguments [-Werror=format-security] 32 | ksft_test_result_fail(buf); | ^~~~~~~~~~~~~~~~~~~~~ lib/setup.c: In function ‘__test_xfail’: lib/setup.c:38:9: error: format not a string literal and no format arguments [-Werror=format-security] 38 | ksft_test_result_xfail(buf); | ^~~~~~~~~~~~~~~~~~~~~~ lib/setup.c: In function ‘__test_error’: lib/setup.c:44:9: error: format not a string literal and no format arguments [-Werror=format-security] 44 | ksft_test_result_error(buf); | ^~~~~~~~~~~~~~~~~~~~~~ lib/setup.c: In function ‘__test_skip’: lib/setup.c:50:9: error: format not a string literal and no format arguments [-Werror=format-security] 50 | ksft_test_result_skip(buf); | ^~~~~~~~~~~~~~~~~~~~~
Quoted 1 line
cc1: some warnings being treated as errors
As the buffer was already pre-printed into, print it as a string rather than a format-string.
--- tools/testing/selftests/net/tcp_ao/lib/setup.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
tools/testing/selftests/net/tcp_ao/lib/setup.c +6 -6
@@ -17,37 +17,37 @@ static pthread_mutex_t ksft_print_lock = PTHREAD_MUTEX_INITIALIZER;void __test_msg (const char *buf) {pthread_mutex_lock (&ksft_print_lock); -ksft_print_msg (buf); +ksft_print_msg ("%s" , buf);pthread_mutex_unlock (&ksft_print_lock); }void __test_ok (const char *buf) {pthread_mutex_lock (&ksft_print_lock); -ksft_test_result_pass (buf); +ksft_test_result_pass ("%s" , buf);pthread_mutex_unlock (&ksft_print_lock); }void __test_fail (const char *buf) {pthread_mutex_lock (&ksft_print_lock); -ksft_test_result_fail (buf); +ksft_test_result_fail ("%s" , buf);pthread_mutex_unlock (&ksft_print_lock); }void __test_xfail (const char *buf) {pthread_mutex_lock (&ksft_print_lock); -ksft_test_result_xfail (buf); +ksft_test_result_xfail ("%s" , buf);pthread_mutex_unlock (&ksft_print_lock); }void __test_error (const char *buf) {pthread_mutex_lock (&ksft_print_lock); -ksft_test_result_error (buf); +ksft_test_result_error ("%s" , buf);pthread_mutex_unlock (&ksft_print_lock); }void __test_skip (const char *buf) {pthread_mutex_lock (&ksft_print_lock); -ksft_test_result_skip (buf); +ksft_test_result_skip ("%s" , buf);pthread_mutex_unlock (&ksft_print_lock); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 34/158 net: stmmac: Apply half-duplex-less constraint for DW QoS Eth only
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Serge Semin <[email protected]>
[ Upstream commit 0ebd96f5da4410c0cb8fc75e44f1009530b2f90b ]
There are three DW MAC IP-cores which can have the multiple Tx/Rx queues enabled:
DW GMAC v3.7+ with AV feature,
DW QoS Eth v4.x/v5.x,
DW XGMAC/XLGMAC
Based on the respective HW databooks, only the DW QoS Eth IP-core doesn't support the half-duplex link mode in case if more than one queues enabled:
"In multiple queue/channel configurations, for half-duplex operation, enable only the Q0/CH0 on Tx and Rx. For single queue/channel in full-duplex operation, any queue/channel can be enabled."
The rest of the IP-cores don't have such constraint. Thus in order to have the constraint applied for the DW QoS Eth MACs only, let's move the it' implementation to the respective MAC-capabilities getter and make sure the getter is called in the queues re-init procedure.
--- .../net/ethernet/stmicro/stmmac/dwmac4_core.c | 7 +++++++ .../net/ethernet/stmicro/stmmac/stmmac_main.c | 19 +++---------------- 2 files changed, 10 insertions(+), 16 deletions(-)
drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c +7 -0
@@ -71,6 +71,13 @@ static void dwmac4_core_init(struct mac_device_info *hw,static void dwmac4_phylink_get_caps (struct stmmac_priv *priv) { priv->phylink_config.mac_capabilities |=MAC_2500FD ; + +if (priv->plat->tx_queues_to_use >1 ) + priv->phylink_config.mac_capabilities &= + ~(MAC_10HD |MAC_100HD |MAC_1000HD ); +else + priv->phylink_config.mac_capabilities |= + (MAC_10HD |MAC_100HD |MAC_1000HD ); } static void dwmac4_rx_queue_enable(struct mac_device_info *hw,
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +3 -16
@@ -1198,17 +1198,6 @@ static int stmmac_init_phy(struct net_device *dev)return ret; } -static void stmmac_set_half_duplex (struct stmmac_priv *priv) -{ -/* Half-Duplex can only work with single tx queue */ -if (priv->plat->tx_queues_to_use >1 ) - priv->phylink_config.mac_capabilities &= - ~(MAC_10HD |MAC_100HD |MAC_1000HD ); -else - priv->phylink_config.mac_capabilities |= - (MAC_10HD |MAC_100HD |MAC_1000HD ); -} -static int stmmac_phy_setup (struct stmmac_priv *priv) {struct stmmac_mdio_bus_data *mdio_bus_data;
@@ -1237,10 +1226,7 @@ static int stmmac_phy_setup(struct stmmac_priv *priv) priv->phylink_config.supported_interfaces); priv->phylink_config.mac_capabilities =MAC_ASYM_PAUSE |MAC_SYM_PAUSE | -MAC_10FD |MAC_100FD | -MAC_1000FD ; - -stmmac_set_half_duplex (priv); +MAC_10 |MAC_100 |MAC_1000 ;/* Get the MAC specific capabilities */ stmmac_mac_phylink_get_caps (priv);
@@ -7299,7 +7285,8 @@ int stmmac_reinit_queues(struct net_device *dev, u32 rx_cnt, u32 tx_cnt) priv->rss.table[i] =ethtool_rxfh_indir_default (i, rx_cnt); -stmmac_set_half_duplex (priv); +stmmac_mac_phylink_get_caps (priv); +stmmac_napi_add (dev);if (netif_running (dev))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 35/158 net: stmmac: Fix max-speed being ignored on queue re-init
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Serge Semin <[email protected]>
[ Upstream commit 59c3d6ca6cbded6c6599e975b42a9d6a27fcbaf2 ]
It's possible to have the maximum link speed being artificially limited on the platform-specific basis. It's done either by setting up the plat_stmmacenet_data::max_speed field or by specifying the "max-speed" DT-property. In such cases it's required that any specific MAC-capabilities re-initializations would take the limit into account. In particular the link speed capabilities may change during the number of active Tx/Rx queues re-initialization. But the currently implemented procedure doesn't take the speed limit into account.
Fix that by calling phylink_limit_mac_speed() in the stmmac_reinit_queues() method if the speed limitation was required in the same way as it's done in the stmmac_phy_setup() function.
--- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +5 -0
@@ -7272,6 +7272,7 @@ int stmmac_reinit_queues(struct net_device *dev, u32 rx_cnt, u32 tx_cnt) {struct stmmac_priv *priv =netdev_priv (dev);int ret =0 , i; +int max_speed;if (netif_running (dev))stmmac_release (dev);
@@ -7287,6 +7288,10 @@ int stmmac_reinit_queues(struct net_device *dev, u32 rx_cnt, u32 tx_cnt)stmmac_mac_phylink_get_caps (priv); + max_speed = priv->plat->max_speed; +if (max_speed) +phylink_limit_mac_speed (&priv->phylink_config, max_speed); +stmmac_napi_add (dev);if (netif_running (dev))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 36/158 net: stmmac: Fix IP-cores specific MAC capabilities
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Serge Semin <[email protected]>
[ Upstream commit 9cb54af214a7cdc91577ec083e5569f2ce2c86d8 ]
Here is the list of the MAC capabilities specific to the particular DW MAC IP-cores currently supported by the driver:
DW MAC100: MAC_ASYM_PAUSE | MAC_SYM_PAUSE |
MAC_10 | MAC_100
DW GMAC: MAC_ASYM_PAUSE | MAC_SYM_PAUSE |
MAC_10 | MAC_100 | MAC_1000
Allwinner sun8i MAC: MAC_ASYM_PAUSE | MAC_SYM_PAUSE |
MAC_10 | MAC_100 | MAC_1000
DW QoS Eth: MAC_ASYM_PAUSE | MAC_SYM_PAUSE |
MAC_10 | MAC_100 | MAC_1000 | MAC_2500FD
if there is more than 1 active Tx/Rx queues:
MAC_ASYM_PAUSE | MAC_SYM_PAUSE |
MAC_10FD | MAC_100FD | MAC_1000FD | MAC_2500FDDW XGMAC: MAC_ASYM_PAUSE | MAC_SYM_PAUSE |
MAC_1000FD | MAC_2500FD | MAC_5000FD | MAC_10000FD
DW XLGMAC: MAC_ASYM_PAUSE | MAC_SYM_PAUSE |
MAC_1000FD | MAC_2500FD | MAC_5000FD | MAC_10000FD |
MAC_25000FD | MAC_40000FD | MAC_50000FD | MAC_100000FDAs you can see there are only two common capabilities:MAC_ASYM_PAUSE | MAC_SYM_PAUSE.
Meanwhile what is currently implemented defines 10/100/1000 link speeds for all IP-cores, which is definitely incorrect for DW MAC100, DW XGMAC and DW XLGMAC devices.
Seeing the flow-control is implemented as a callback for each MAC IP-core (see dwmac100_flow_ctrl(), dwmac1000_flow_ctrl(), sun8i_dwmac_flow_ctrl(), etc) and since the MAC-specific setup() method is supposed to be called for each available DW MAC-based device, the capabilities initialization can be freely moved to these setup() functions, thus correctly setting up the MAC-capabilities for each IP-core (including the Allwinner Sun8i). A new stmmac_link::caps field was specifically introduced for that so to have all link-specific info preserved in a single structure.
Note the suggested change fixes three earlier commits at a time. The commit 5b0d7d7da64b ("net: stmmac: Add the missing speeds that XGMAC supports") permitted the 10-100 link speeds and 1G half-duplex mode for DW XGMAC IP-core even though it doesn't support them. The commit df7699c70c1b ("net: stmmac: Do not cut down 1G modes") incorrectly added the MAC1000 capability to the DW MAC100 IP-core. Similarly to the DW XGMAC the commit 8a880936e902 ("net: stmmac: Add XLGMII support") incorrectly permitted the 10-100 link speeds and 1G half-duplex mode for DW XLGMAC IP-core.
--- drivers/net/ethernet/stmicro/stmmac/common.h | 1 + .../net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 2 ++ .../ethernet/stmicro/stmmac/dwmac1000_core.c | 2 ++ .../ethernet/stmicro/stmmac/dwmac100_core.c | 2 ++ .../net/ethernet/stmicro/stmmac/dwmac4_core.c | 10 ++++------ .../ethernet/stmicro/stmmac/dwxgmac2_core.c | 18 ++++++++---------- .../net/ethernet/stmicro/stmmac/stmmac_main.c | 7 ++++--- 7 files changed, 23 insertions(+), 19 deletions(-)
drivers/net/ethernet/stmicro/stmmac/common.h +1 -0
@@ -550,6 +550,7 @@ extern const struct stmmac_hwtimestamp stmmac_ptp;extern const struct stmmac_mode_ops dwmac4_ring_mode_ops;struct mac_link { +u32 caps;u32 speed_mask;u32 speed10;u32 speed100;
drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c +2 -0
@@ -1096,6 +1096,8 @@ static struct mac_device_info *sun8i_dwmac_setup(void *ppriv) priv->dev->priv_flags |=IFF_UNICAST_FLT ; + mac->link.caps =MAC_ASYM_PAUSE |MAC_SYM_PAUSE | +MAC_10 |MAC_100 |MAC_1000 ;/* The loopback bit seems to be re-set when link change * Simply mask it each time * Speed 10/100/1000 are set in BIT(2)/BIT(3)
drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c +2 -0
@@ -539,6 +539,8 @@ int dwmac1000_setup(struct stmmac_priv *priv)if (mac->multicast_filter_bins) mac->mcast_bits_log2 =ilog2 (mac->multicast_filter_bins); + mac->link.caps =MAC_ASYM_PAUSE |MAC_SYM_PAUSE | +MAC_10 |MAC_100 |MAC_1000 ; mac->link.duplex =GMAC_CONTROL_DM ; mac->link.speed10 =GMAC_CONTROL_PS ; mac->link.speed100 =GMAC_CONTROL_PS |GMAC_CONTROL_FES ;
drivers/net/ethernet/stmicro/stmmac/dwmac100_core.c +2 -0
@@ -175,6 +175,8 @@ int dwmac100_setup(struct stmmac_priv *priv)dev_info (priv->device,"\tDWMAC100\n" ); mac->pcsr = priv->ioaddr; + mac->link.caps =MAC_ASYM_PAUSE |MAC_SYM_PAUSE | +MAC_10 |MAC_100 ; mac->link.duplex =MAC_CONTROL_F ; mac->link.speed10 =0 ; mac->link.speed100 =0 ;
drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c +4 -6
@@ -70,14 +70,10 @@ static void dwmac4_core_init(struct mac_device_info *hw,static void dwmac4_phylink_get_caps (struct stmmac_priv *priv) { - priv->phylink_config.mac_capabilities |=MAC_2500FD ; -if (priv->plat->tx_queues_to_use >1 ) - priv->phylink_config.mac_capabilities &= - ~(MAC_10HD |MAC_100HD |MAC_1000HD ); + priv->hw->link.caps &= ~(MAC_10HD |MAC_100HD |MAC_1000HD );else - priv->phylink_config.mac_capabilities |= - (MAC_10HD |MAC_100HD |MAC_1000HD ); + priv->hw->link.caps |= (MAC_10HD |MAC_100HD |MAC_1000HD ); } static void dwmac4_rx_queue_enable(struct mac_device_info *hw,
@@ -1385,6 +1381,8 @@ int dwmac4_setup(struct stmmac_priv *priv)if (mac->multicast_filter_bins) mac->mcast_bits_log2 =ilog2 (mac->multicast_filter_bins); + mac->link.caps =MAC_ASYM_PAUSE |MAC_SYM_PAUSE | +MAC_10 |MAC_100 |MAC_1000 |MAC_2500FD ; mac->link.duplex =GMAC_CONFIG_DM ; mac->link.speed10 =GMAC_CONFIG_PS ; mac->link.speed100 =GMAC_CONFIG_FES |GMAC_CONFIG_PS ;
drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c +8 -10
@@ -47,14 +47,6 @@ static void dwxgmac2_core_init(struct mac_device_info *hw,writel (XGMAC_INT_DEFAULT_EN , ioaddr +XGMAC_INT_EN ); } -static void xgmac_phylink_get_caps (struct stmmac_priv *priv) -{ - priv->phylink_config.mac_capabilities |=MAC_2500FD |MAC_5000FD | -MAC_10000FD |MAC_25000FD | -MAC_40000FD |MAC_50000FD | -MAC_100000FD ; -} -static void dwxgmac2_set_mac (void __iomem *ioaddr,bool enable) {u32 tx =readl (ioaddr +XGMAC_TX_CONFIG );
@@ -1540,7 +1532,6 @@ static void dwxgmac3_fpe_configure(void __iomem *ioaddr, struct stmmac_fpe_cfg *const struct stmmac_ops dwxgmac210_ops = { .core_init = dwxgmac2_core_init, - .phylink_get_caps = xgmac_phylink_get_caps, .set_mac = dwxgmac2_set_mac, .rx_ipc = dwxgmac2_rx_ipc, .rx_queue_enable = dwxgmac2_rx_queue_enable,
@@ -1601,7 +1592,6 @@ static void dwxlgmac2_rx_queue_enable(struct mac_device_info *hw, u8 mode,const struct stmmac_ops dwxlgmac2_ops = { .core_init = dwxgmac2_core_init, - .phylink_get_caps = xgmac_phylink_get_caps, .set_mac = dwxgmac2_set_mac, .rx_ipc = dwxgmac2_rx_ipc, .rx_queue_enable = dwxlgmac2_rx_queue_enable,
@@ -1661,6 +1651,9 @@ int dwxgmac2_setup(struct stmmac_priv *priv)if (mac->multicast_filter_bins) mac->mcast_bits_log2 =ilog2 (mac->multicast_filter_bins); + mac->link.caps =MAC_ASYM_PAUSE |MAC_SYM_PAUSE | +MAC_1000FD |MAC_2500FD |MAC_5000FD | +MAC_10000FD ; mac->link.duplex =0 ; mac->link.speed10 =XGMAC_CONFIG_SS_10_MII ; mac->link.speed100 =XGMAC_CONFIG_SS_100_MII ;
@@ -1698,6 +1691,11 @@ int dwxlgmac2_setup(struct stmmac_priv *priv)if (mac->multicast_filter_bins) mac->mcast_bits_log2 =ilog2 (mac->multicast_filter_bins); + mac->link.caps =MAC_ASYM_PAUSE |MAC_SYM_PAUSE | +MAC_1000FD |MAC_2500FD |MAC_5000FD | +MAC_10000FD |MAC_25000FD | +MAC_40000FD |MAC_50000FD | +MAC_100000FD ; mac->link.duplex =0 ; mac->link.speed1000 =XLGMAC_CONFIG_SS_1000 ; mac->link.speed2500 =XLGMAC_CONFIG_SS_2500 ;
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +4 -3
@@ -1225,12 +1225,11 @@ static int stmmac_phy_setup(struct stmmac_priv *priv)xpcs_get_interfaces (priv->hw->xpcs, priv->phylink_config.supported_interfaces); - priv->phylink_config.mac_capabilities =MAC_ASYM_PAUSE |MAC_SYM_PAUSE | -MAC_10 |MAC_100 |MAC_1000 ; -/* Get the MAC specific capabilities */ stmmac_mac_phylink_get_caps (priv); + priv->phylink_config.mac_capabilities = priv->hw->link.caps; + max_speed = priv->plat->max_speed;if (max_speed)phylink_limit_mac_speed (&priv->phylink_config, max_speed);
@@ -7288,6 +7287,8 @@ int stmmac_reinit_queues(struct net_device *dev, u32 rx_cnt, u32 tx_cnt)stmmac_mac_phylink_get_caps (priv); + priv->phylink_config.mac_capabilities = priv->hw->link.caps; + max_speed = priv->plat->max_speed;if (max_speed)phylink_limit_mac_speed (&priv->phylink_config, max_speed);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 37/158 ice: tc: check src_vsi in case of traffic from VF
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Swiatkowski <[email protected]>
[ Upstream commit 428051600cb4e5a61d81aba3f8009b6c4f5e7582 ]
In case of traffic going from the VF (so ingress for port representor) source VSI should be consider during packet classification. It is needed for hardware to not match packets from different ports with filters added on other port.
It is only for "from VF" traffic, because other traffic direction doesn't have source VSI.
Set correct ::src_vsi in rule_info to pass it to the hardware filter.
For example this rule should drop only ipv4 packets from eth10, not from the others VF PRs. It is needed to check source VSI in this case. $tc filter add dev eth10 ingress protocol ip flower skip_sw action drop
--- drivers/net/ethernet/intel/ice/ice_tc_lib.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/net/ethernet/intel/ice/ice_tc_lib.c +8 -0
@@ -28,6 +28,8 @@ ice_tc_count_lkups(u32 flags, struct ice_tc_flower_lyr_2_4_hdrs *headers,* - ICE_TC_FLWR_FIELD_VLAN_TPID (present if specified) * - Tunnel flag (present if tunnel) */ +if (fltr->direction ==ICE_ESWITCH_FLTR_EGRESS ) + lkups_cnt++;if (flags &ICE_TC_FLWR_FIELD_TENANT_ID ) lkups_cnt++;
@@ -363,6 +365,11 @@ ice_tc_fill_rules(struct ice_hw *hw, u32 flags,/* Always add direction metadata */ ice_rule_add_direction_metadata (&list[ICE_TC_METADATA_LKUP_IDX ]); +if (tc_fltr->direction ==ICE_ESWITCH_FLTR_EGRESS ) { +ice_rule_add_src_vsi_metadata (&list[i]); + i++; + } + rule_info->tun_type =ice_sw_type_from_tunnel (tc_fltr->tunnel_type);if (tc_fltr->tunnel_type !=TNL_LAST ) { i =ice_tc_fill_tunnel_outer (flags, tc_fltr, list, i);
@@ -820,6 +827,7 @@ ice_eswitch_add_tc_fltr(struct ice_vsi *vsi, struct ice_tc_flower_fltr *fltr)/* specify the cookie as filter_rule_id */ rule_info.fltr_rule_id = fltr->cookie; + rule_info.src_vsi = vsi->idx; ret =ice_add_adv_rule (hw, list, lkups_cnt, &rule_info, &rule_added);if (ret == -EEXIST ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 38/158 ice: tc: allow zero flags in parsing tc flower
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Swiatkowski <[email protected]>
[ Upstream commit 73278715725a8347032acf233082ca4eb31e6a56 ]
The check for flags is done to not pass empty lookups to adding switch rule functions. Since metadata is always added to lookups there is no need to check against the flag.
It is also fixing the problem with such rule:
$ tc filter add dev gtp_dev ingress protocol ip prio 0 flower \ enc_dst_port 2123 action drop Switch block in case of GTP can't parse the destination port, because it should always be set to GTP specific value. The same with ethertype. The result is that there is no other matching criteria than GTP tunnel. In this case flags is 0, rule can't be added only because of defensive check against flags.
--- drivers/net/ethernet/intel/ice/ice_tc_lib.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/intel/ice/ice_tc_lib.c +1 -1
@@ -779,7 +779,7 @@ ice_eswitch_add_tc_fltr(struct ice_vsi *vsi, struct ice_tc_flower_fltr *fltr)int ret;int i; -if (!flags || (flags &ICE_TC_FLWR_FIELD_ENC_SRC_L4_PORT )) { +if (flags &ICE_TC_FLWR_FIELD_ENC_SRC_L4_PORT ) {NL_SET_ERR_MSG_MOD (fltr->extack,"Unsupported encap field(s)" );return -EOPNOTSUPP ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 39/158 ice: Fix checking for unsupported keys on non-tunnel device
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marcin Szycik <[email protected]>
[ Upstream commit 2cca35f5dd78b9f8297c879c5db5ab137c5d86c3 ]
Add missing FLOW_DISSECTOR_KEY_ENC_* checks to TC flower filter parsing. Without these checks, it would be possible to add filters with tunnel options on non-tunnel devices. enc_* options are only valid for tunnel devices.
Example:
devlink dev eswitch set $PF1_PCI mode switchdev
echo 1 > /sys/class/net/$PF1/device/sriov_numvfs
tc qdisc add dev $VF1_PR ingress
ethtool -K $PF1 hw-tc-offload on
tc filter add dev $VF1_PR ingress flower enc_ttl 12 skip_sw action drop
--- drivers/net/ethernet/intel/ice/ice_tc_lib.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/ice/ice_tc_lib.c +4 -1
@@ -1489,7 +1489,10 @@ ice_parse_cls_flower(struct net_device *filter_dev, struct ice_vsi *vsi, (BIT_ULL(FLOW_DISSECTOR_KEY_ENC_IPV4_ADDRS) | BIT_ULL(FLOW_DISSECTOR_KEY_ENC_IPV6_ADDRS) | BIT_ULL(FLOW_DISSECTOR_KEY_ENC_KEYID) | - BIT_ULL(FLOW_DISSECTOR_KEY_ENC_PORTS))) { + BIT_ULL(FLOW_DISSECTOR_KEY_ENC_PORTS) | + BIT_ULL(FLOW_DISSECTOR_KEY_ENC_IP) | + BIT_ULL(FLOW_DISSECTOR_KEY_ENC_OPTS) | + BIT_ULL(FLOW_DISSECTOR_KEY_ENC_CONTROL))) { NL_SET_ERR_MSG_MOD(fltr->extack, "Tunnel key used, but device isn't a tunnel"); return -EOPNOTSUPP; } else {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 40/158 tun: limit printing rate when illegal packet received by tun dev
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lei Chen <[email protected]>
[ Upstream commit f8bbc07ac535593139c875ffa19af924b1084540 ]
vhost_worker will call tun call backs to receive packets. If too many illegal packets arrives, tun_do_read will keep dumping packet contents. When console is enabled, it will costs much more cpu time to dump packet and soft lockup will be detected.
net_ratelimit mechanism can be used to limit the dumping rate.
PID: 33036 TASK: ffff949da6f20000 CPU: 23 COMMAND: "vhost-32980"
#0 [fffffe00003fce50] crash_nmi_callback at ffffffff89249253 #1 [fffffe00003fce58] nmi_handle at ffffffff89225fa3 #2 [fffffe00003fceb0] default_do_nmi at ffffffff8922642e #3 [fffffe00003fced0] do_nmi at ffffffff8922660d #4 [fffffe00003fcef0] end_repeat_nmi at ffffffff89c01663
[exception RIP: io_serial_in+20]
RIP: ffffffff89792594 RSP: ffffa655314979e8 RFLAGS: 00000002
RAX: ffffffff89792500 RBX: ffffffff8af428a0 RCX: 0000000000000000
RDX: 00000000000003fd RSI: 0000000000000005 RDI: ffffffff8af428a0
RBP: 0000000000002710 R8: 0000000000000004 R9: 000000000000000f
R10: 0000000000000000 R11: ffffffff8acbf64f R12: 0000000000000020
R13: ffffffff8acbf698 R14: 0000000000000058 R15: 0000000000000000
ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 #5 [ffffa655314979e8] io_serial_in at ffffffff89792594
#6 [ffffa655314979e8] wait_for_xmitr at ffffffff89793470 #7 [ffffa65531497a08] serial8250_console_putchar at ffffffff897934f6 #8 [ffffa65531497a20] uart_console_write at ffffffff8978b605 #9 [ffffa65531497a48] serial8250_console_write at ffffffff89796558 #10 [ffffa65531497ac8] console_unlock at ffffffff89316124 #11 [ffffa65531497b10] vprintk_emit at ffffffff89317c07 #12 [ffffa65531497b68] printk at ffffffff89318306
#13 [ffffa65531497bc8] print_hex_dump at ffffffff89650765 #14 [ffffa65531497ca8] tun_do_read at ffffffffc0b06c27 [tun] #15 [ffffa65531497d38] tun_recvmsg at ffffffffc0b06e34 [tun] #16 [ffffa65531497d68] handle_rx at ffffffffc0c5d682 [vhost_net] #17 [ffffa65531497ed0] vhost_worker at ffffffffc0c644dc [vhost] #18 [ffffa65531497f10] kthread at ffffffff892d2e72
#19 [ffffa65531497f50] ret_from_fork at ffffffff89c0022f
--- drivers/net/tun.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-)
drivers/net/tun.c +10 -8
@@ -2132,14 +2132,16 @@ static ssize_t tun_put_user(struct tun_struct *tun, tun_is_little_endian(tun), true, vlan_hlen)) {struct skb_shared_info *sinfo =skb_shinfo (skb); -pr_err ("unexpected GSO type: " -"0x%x, gso_size %d, hdr_len %d\n" , - sinfo->gso_type,tun16_to_cpu (tun, gso.gso_size), -tun16_to_cpu (tun, gso.hdr_len)); -print_hex_dump (KERN_ERR ,"tun: " , -DUMP_PREFIX_NONE , -16 ,1 , skb->head, -min ((int )tun16_to_cpu (tun, gso.hdr_len),64 ), true); + +if (net_ratelimit ()) { +netdev_err (tun->dev,"unexpected GSO type: 0x%x, gso_size %d, hdr_len %d\n" , + sinfo->gso_type,tun16_to_cpu (tun, gso.gso_size), +tun16_to_cpu (tun, gso.hdr_len)); +print_hex_dump (KERN_ERR ,"tun: " , +DUMP_PREFIX_NONE , +16 ,1 , skb->head, +min ((int )tun16_to_cpu (tun, gso.hdr_len),64 ), true); + }WARN_ON_ONCE (1 );return -EINVAL ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 41/158 net: dsa: mt7530: fix mirroring frames received on local port
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arınç ÜNAL <[email protected]>
[ Upstream commit d59cf049c8378677053703e724808836f180888e ]
This switch intellectual property provides a bit on the ARL global control register which controls allowing mirroring frames which are received on the local port (monitor port). This bit is unset after reset.
This ability must be enabled to fully support the port mirroring feature on this switch intellectual property.
Therefore, this patch fixes the traffic not being reflected on a port, which would be configured like below:
tc qdisc add dev swp0 clsact
tc filter add dev swp0 ingress matchall skip_sw \
action mirred egress mirror dev swp0
As a side note, this configuration provides the hairpinning feature for a single port.
--- drivers/net/dsa/mt7530.c | 6 ++++++ drivers/net/dsa/mt7530.h | 4 ++++ 2 files changed, 10 insertions(+)
drivers/net/dsa/mt7530.c +6 -0
@@ -2517,6 +2517,9 @@ mt7530_setup(struct dsa_switch *ds) PVC_EG_TAG(MT7530_VLAN_EG_CONSISTENT)); } +/* Allow mirroring frames received on the local port (monitor port). */ +mt7530_set (priv,MT753X_AGC ,LOCAL_EN ); +/* Setup VLAN ID 0 for VLAN-unaware bridges */ ret =mt7530_setup_vlan0 (priv);if (ret)
@@ -2625,6 +2628,9 @@ mt7531_setup_common(struct dsa_switch *ds) PVC_EG_TAG(MT7530_VLAN_EG_CONSISTENT)); } +/* Allow mirroring frames received on the local port (monitor port). */ +mt7530_set (priv,MT753X_AGC ,LOCAL_EN ); +/* Flush the FDB table */ ret =mt7530_fdb_cmd (priv,MT7530_FDB_FLUSH ,NULL );if (ret <0 )
drivers/net/dsa/mt7530.h +4 -0
@@ -32,6 +32,10 @@ enum mt753x_id {#define SYSC_REG_RSTCTRL 0x34#define RESET_MCM BIT(2) +/* Register for ARL global control */ +#define MT753X_AGC 0xc +#define LOCAL_EN BIT(7) +/* Registers to mac forward control for unknown frames */ #define MT7530_MFC 0x10#define BC_FFP (x) (((x) & 0xff) << 24)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 42/158 net: dsa: mt7530: fix port mirroring for MT7988 SoC switch
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arınç ÜNAL <[email protected]>
[ Upstream commit 2c606d138518cc69f09c35929abc414a99e3a28f ]
The "MT7988A Wi-Fi 7 Generation Router Platform: Datasheet (Open Version) v0.1" document shows bits 16 to 18 as the MIRROR_PORT field of the CPU forward control register. Currently, the MT7530 DSA subdriver configures bits 0 to 2 of the CPU forward control register which breaks the port mirroring feature for the MT7988 SoC switch.
Fix this by using the MT7531_MIRROR_PORT_GET() and MT7531_MIRROR_PORT_SET() macros which utilise the correct bits.
--- drivers/net/dsa/mt7530.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/net/dsa/mt7530.c +6 -4
@@ -1947,14 +1947,16 @@ mt7530_port_vlan_del(struct dsa_switch *ds, int port,static int mt753x_mirror_port_get (unsigned int id,u32 val) { -return (id ==ID_MT7531 ) ?MT7531_MIRROR_PORT_GET (val) : -MIRROR_PORT (val); +return (id ==ID_MT7531 || id ==ID_MT7988 ) ? +MT7531_MIRROR_PORT_GET (val) : +MIRROR_PORT (val); }static int mt753x_mirror_port_set (unsigned int id,u32 val) { -return (id ==ID_MT7531 ) ?MT7531_MIRROR_PORT_SET (val) : -MIRROR_PORT (val); +return (id ==ID_MT7531 || id ==ID_MT7988 ) ? +MT7531_MIRROR_PORT_SET (val) : +MIRROR_PORT (val); } static int mt753x_port_mirror_add(struct dsa_switch *ds, int port,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 43/158 s390/ism: Properly fix receive message buffer allocation
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gerd Bayer <[email protected]>
[ Upstream commit 83781384a96b95e2b6403d3c8a002b2c89031770 ]
Since [1], dma_alloc_coherent() does not accept requests for GFP_COMP anymore, even on archs that may be able to fulfill this. Functionality that relied on the receive buffer being a compound page broke at that point:
The SMC-D protocol, that utilizes the ism device driver, passes receive buffers to the splice processor in a struct splice_pipe_desc with a single entry list of struct pages. As the buffer is no longer a compound page, the splice processor now rejects requests to handle more than a page worth of data.
Replace dma_alloc_coherent() and allocate a buffer with folio_alloc and create a DMA map for it with dma_map_page(). Since only receive buffers on ISM devices use DMA, qualify the mapping as FROM_DEVICE. Since ISM devices are available on arch s390, only, and on that arch all DMA is coherent, there is no need to introduce and export some kind of dma_sync_to_cpu() method to be called by the SMC-D protocol layer.
Analogously, replace dma_free_coherent by a two step dma_unmap_page, then folio_put to free the receive buffer.
[1] https://lore.kernel.org/all/[email protected]/
--- drivers/s390/net/ism_drv.c | 37 ++++++++++++++++++++++++++++--------- 1 file changed, 28 insertions(+), 9 deletions(-)
drivers/s390/net/ism_drv.c +28 -9
@@ -292,13 +292,16 @@ static int ism_read_local_gid(struct ism_dev *ism)static void ism_free_dmb (struct ism_dev *ism,struct ism_dmb *dmb) {clear_bit (dmb->sba_idx, ism->sba_bitmap); -dma_free_coherent (&ism->pdev->dev, dmb->dmb_len, - dmb->cpu_addr, dmb->dma_addr); +dma_unmap_page (&ism->pdev->dev, dmb->dma_addr, dmb->dmb_len, +DMA_FROM_DEVICE ); +folio_put (virt_to_folio (dmb->cpu_addr)); }static int ism_alloc_dmb (struct ism_dev *ism,struct ism_dmb *dmb) { +struct folio *folio;unsigned long bit; +int rc;if (PAGE_ALIGN (dmb->dmb_len) >dma_get_max_seg_size (&ism->pdev->dev))return -EINVAL ;
@@ -315,14 +318,30 @@ static int ism_alloc_dmb(struct ism_dev *ism, struct ism_dmb *dmb) test_and_set_bit(dmb->sba_idx, ism->sba_bitmap)) return -EINVAL; - dmb->cpu_addr =dma_alloc_coherent (&ism->pdev->dev, dmb->dmb_len, - &dmb->dma_addr, -GFP_KERNEL | __GFP_NOWARN | - __GFP_NOMEMALLOC | __GFP_NORETRY); -if (!dmb->cpu_addr) -clear_bit (dmb->sba_idx, ism->sba_bitmap); + folio =folio_alloc (GFP_KERNEL | __GFP_NOWARN | __GFP_NOMEMALLOC | + __GFP_NORETRY,get_order (dmb->dmb_len)); -return dmb->cpu_addr ?0 : -ENOMEM ; +if (!folio) { + rc = -ENOMEM ; + goto out_bit; + } + + dmb->cpu_addr =folio_address (folio); + dmb->dma_addr =dma_map_page (&ism->pdev->dev, +virt_to_page (dmb->cpu_addr),0 , + dmb->dmb_len,DMA_FROM_DEVICE ); +if (dma_mapping_error (&ism->pdev->dev, dmb->dma_addr)) { + rc = -ENOMEM ; + goto out_free; + } + +return 0 ; + +out_free: +kfree (dmb->cpu_addr); +out_bit: +clear_bit (dmb->sba_idx, ism->sba_bitmap); +return rc; } int ism_register_dmb(struct ism_dev *ism, struct ism_dmb *dmb,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 44/158 netfilter: nf_tables: missing iterator type in lookup walk
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit efefd4f00c967d00ad7abe092554ffbb70c1a793 ]
Add missing decorator type to lookup expression and tighten WARN_ON_ONCE check in pipapo to spot earlier that this is unset.
--- net/netfilter/nft_lookup.c | 1 + net/netfilter/nft_set_pipapo.c | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-)
net/netfilter/nft_lookup.c +1 -0
@@ -216,6 +216,7 @@ static int nft_lookup_validate(const struct nft_ctx *ctx,return 0 ; iter.genmask =nft_genmask_next (ctx->net); + iter.type =NFT_ITER_UPDATE ; iter.skip =0 ; iter.count =0 ; iter.err =0 ;
net/netfilter/nft_set_pipapo.c +2 -1
@@ -2048,7 +2048,8 @@ static void nft_pipapo_walk(const struct nft_ctx *ctx, struct nft_set *set,const struct nft_pipapo_field *f;int i, r; -WARN_ON_ONCE (iter->type ==NFT_ITER_UNSPEC ); +WARN_ON_ONCE (iter->type !=NFT_ITER_READ && + iter->type !=NFT_ITER_UPDATE );rcu_read_lock ();if (iter->type ==NFT_ITER_READ )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 45/158 netfilter: nf_tables: restore set elements when delete set fails
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit e79b47a8615d42c68aaeb68971593333667382ed ]
Quoted 1 line
From abort path,
nft_mapelem_activate()needs to restore refcounters to
the original state. Currently, it uses the set->ops->walk() to iterate over these set elements. The existing set iterator skips inactive elements in the next generation, this does not work from the abort path to restore the original state since it has to skip active elements instead (not inactive ones).
This patch moves the check for inactive elements to the set iterator callback, then it reverses the logic for the .activate case which needs to skip active elements.
Toggle next generation bit for elements when delete set command is invoked and call nft_clear() from .activate (abort) path to restore the next generation bit.
The splat below shows an object in mappings memleak:
[43929.457523] ------------[ cut here ]------------ [43929.457532] WARNING: CPU: 0 PID: 1139 at include/net/netfilter/nf_tables.h:1237 nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables] [...] [43929.458014] RIP: 0010:nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables] [43929.458076] Code: 83 f8 01 77 ab 49 8d 7c 24 08 e8 37 5e d0 de 49 8b 6c 24 08 48 8d 7d 50 e8 e9 5c d0 de 8b 45 50 8d 50 ff 89 55 50 85 c0 75 86 <0f> 0b eb 82 0f 0b eb b3 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 [43929.458081] RSP: 0018:ffff888140f9f4b0 EFLAGS: 00010246 [43929.458086] RAX: 0000000000000000 RBX: ffff8881434f5288 RCX: dffffc0000000000 [43929.458090] RDX: 00000000ffffffff RSI: ffffffffa26d28a7 RDI: ffff88810ecc9550 [43929.458093] RBP: ffff88810ecc9500 R08: 0000000000000001 R09: ffffed10281f3e8f [43929.458096] R10: 0000000000000003 R11: ffff0000ffff0000 R12: ffff8881434f52a0 [43929.458100] R13: ffff888140f9f5f4 R14: ffff888151c7a800 R15: 0000000000000002 [43929.458103] FS: 00007f0c687c4740(0000) GS:ffff888390800000(0000) knlGS:0000000000000000 [43929.458107] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [43929.458111] CR2: 00007f58dbe5b008 CR3: 0000000123602005 CR4: 00000000001706f0 [43929.458114] Call Trace: [43929.458118] <TASK> [43929.458121] ? __warn+0x9f/0x1a0 [43929.458127] ? nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables] [43929.458188] ? report_bug+0x1b1/0x1e0 [43929.458196] ? handle_bug+0x3c/0x70 [43929.458200] ? exc_invalid_op+0x17/0x40 [43929.458211] ? nft_setelem_data_deactivate+0xd7/0xf0 [nf_tables] [43929.458271] ? nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables] [43929.458332] nft_mapelem_deactivate+0x24/0x30 [nf_tables] [43929.458392] nft_rhash_walk+0xdd/0x180 [nf_tables] [43929.458453] ? __pfx_nft_rhash_walk+0x10/0x10 [nf_tables] [43929.458512] ? rb_insert_color+0x2e/0x280 [43929.458520] nft_map_deactivate+0xdc/0x1e0 [nf_tables] [43929.458582] ? __pfx_nft_map_deactivate+0x10/0x10 [nf_tables] [43929.458642] ? __pfx_nft_mapelem_deactivate+0x10/0x10 [nf_tables] [43929.458701] ? __rcu_read_unlock+0x46/0x70 [43929.458709] nft_delset+0xff/0x110 [nf_tables] [43929.458769] nft_flush_table+0x16f/0x460 [nf_tables] [43929.458830] nf_tables_deltable+0x501/0x580 [nf_tables]
--- net/netfilter/nf_tables_api.c | 44 ++++++++++++++++++++++++++++++---- net/netfilter/nft_set_bitmap.c | 4 +--- net/netfilter/nft_set_hash.c | 8 ++----- net/netfilter/nft_set_pipapo.c | 5 +--- net/netfilter/nft_set_rbtree.c | 4 +--- 5 files changed, 45 insertions(+), 20 deletions(-)
net/netfilter/nf_tables_api.c +40 -4
@@ -594,6 +594,12 @@ static int nft_mapelem_deactivate(const struct nft_ctx *ctx,const struct nft_set_iter *iter, struct nft_elem_priv *elem_priv) { + struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv); + +if (!nft_set_elem_active (ext, iter->genmask)) +return 0 ; + +nft_set_elem_change_active (ctx->net, set, ext);nft_setelem_data_deactivate (ctx->net, set, elem_priv);return 0 ;
@@ -617,6 +623,7 @@ static void nft_map_catchall_deactivate(const struct nft_ctx *ctx,if (!nft_set_elem_active (ext, genmask))continue ; +nft_set_elem_change_active (ctx->net, set, ext);nft_setelem_data_deactivate (ctx->net, set, catchall->elem);break ; }
@@ -3868,6 +3875,9 @@ int nft_setelem_validate(const struct nft_ctx *ctx, struct nft_set *set,const struct nft_data *data;int err; +if (!nft_set_elem_active (ext, iter->genmask)) +return 0 ; +if (nft_set_ext_exists (ext,NFT_SET_EXT_FLAGS ) && *nft_set_ext_flags (ext) &NFT_SET_ELEM_INTERVAL_END )return 0 ;
@@ -3891,17 +3901,20 @@ int nft_setelem_validate(const struct nft_ctx *ctx, struct nft_set *set,int nft_set_catchall_validate (const struct nft_ctx *ctx,struct nft_set *set) { -u8 genmask =nft_genmask_next (ctx->net); +struct nft_set_iter dummy_iter = { + .genmask =nft_genmask_next (ctx->net), + };struct nft_set_elem_catchall *catchall; +struct nft_set_ext *ext;int ret =0 ;list_for_each_entry_rcu (catchall, &set->catchall_list, list) { ext =nft_set_elem_ext (set, catchall->elem); -if (!nft_set_elem_active (ext, genmask)) +if (!nft_set_elem_active (ext, dummy_iter.genmask))continue ; - ret =nft_setelem_validate (ctx, set,NULL , catchall->elem); + ret =nft_setelem_validate (ctx, set, &dummy_iter, catchall->elem);if (ret <0 )return ret; }
@@ -5398,6 +5411,11 @@ static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx,const struct nft_set_iter *iter, struct nft_elem_priv *elem_priv) { + const struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv); + +if (!nft_set_elem_active (ext, iter->genmask)) +return 0 ; +return nft_setelem_data_validate (ctx, set, elem_priv); }
@@ -5490,6 +5508,13 @@ static int nft_mapelem_activate(const struct nft_ctx *ctx,const struct nft_set_iter *iter, struct nft_elem_priv *elem_priv) { + struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv); + +/* called from abort path, reverse check to undo changes. */ +if (nft_set_elem_active (ext, iter->genmask)) +return 0 ; + +nft_clear (ctx->net, ext);nft_setelem_data_activate (ctx->net, set, elem_priv);return 0 ;
@@ -5507,6 +5532,7 @@ static void nft_map_catchall_activate(const struct nft_ctx *ctx,if (!nft_set_elem_active (ext, genmask))continue ; +nft_clear (ctx->net, ext);nft_setelem_data_activate (ctx->net, set, catchall->elem);break ; }
@@ -5781,6 +5807,9 @@ static int nf_tables_dump_setelem(const struct nft_ctx *ctx,const struct nft_set_ext *ext =nft_set_elem_ext (set, elem_priv);struct nft_set_dump_args *args; +if (!nft_set_elem_active (ext, iter->genmask)) +return 0 ; +if (nft_set_elem_expired (ext) ||nft_set_elem_is_dead (ext))return 0 ;
@@ -6631,7 +6660,7 @@ static void nft_setelem_activate(struct net *net, struct nft_set *set,struct nft_set_ext *ext =nft_set_elem_ext (set, elem_priv);if (nft_setelem_is_catchall (set, elem_priv)) { -nft_set_elem_change_active (net, set, ext); +nft_clear (net, ext); }else { set->ops->activate (net, set, elem_priv); }
@@ -7313,8 +7342,12 @@ static int nft_setelem_flush(const struct nft_ctx *ctx,const struct nft_set_iter *iter, struct nft_elem_priv *elem_priv) { + const struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);struct nft_trans *trans; +if (!nft_set_elem_active (ext, iter->genmask)) +return 0 ; + trans =nft_trans_alloc_gfp (ctx,NFT_MSG_DELSETELEM ,sizeof (struct nft_trans_elem ),GFP_ATOMIC );if (!trans)
@@ -10792,6 +10825,9 @@ static int nf_tables_loop_check_setelem(const struct nft_ctx *ctx, {const struct nft_set_ext *ext =nft_set_elem_ext (set, elem_priv); +if (!nft_set_elem_active (ext, iter->genmask)) +return 0 ; +if (nft_set_ext_exists (ext,NFT_SET_EXT_FLAGS ) && *nft_set_ext_flags (ext) &NFT_SET_ELEM_INTERVAL_END )return 0 ;
net/netfilter/nft_set_bitmap.c +1 -3
@@ -172,7 +172,7 @@ static void nft_bitmap_activate(const struct net *net,nft_bitmap_location (set,nft_set_ext_key (&be->ext), &idx, &off);/* Enter 11 state. */ priv->bitmap[idx] |= (genmask << off); -nft_set_elem_change_active (net, set, &be->ext); +nft_clear (net, &be->ext); } static void nft_bitmap_flush(const struct net *net,
@@ -222,8 +222,6 @@ static void nft_bitmap_walk(const struct nft_ctx *ctx,list_for_each_entry_rcu (be, &priv->list, head) {if (iter->count < iter->skip) goto cont; -if (!nft_set_elem_active (&be->ext, iter->genmask)) - goto cont; iter->err = iter->fn (ctx, set, iter, &be->priv);
net/netfilter/nft_set_hash.c +2 -6
@@ -199,7 +199,7 @@ static void nft_rhash_activate(const struct net *net, const struct nft_set *set, {struct nft_rhash_elem *he =nft_elem_priv_cast (elem_priv); -nft_set_elem_change_active (net, set, &he->ext); +nft_clear (net, &he->ext); } static void nft_rhash_flush(const struct net *net,
@@ -286,8 +286,6 @@ static void nft_rhash_walk(const struct nft_ctx *ctx, struct nft_set *set,if (iter->count < iter->skip) goto cont; -if (!nft_set_elem_active (&he->ext, iter->genmask)) - goto cont; iter->err = iter->fn (ctx, set, iter, &he->priv);if (iter->err <0 )
@@ -599,7 +597,7 @@ static void nft_hash_activate(const struct net *net, const struct nft_set *set, {struct nft_hash_elem *he =nft_elem_priv_cast (elem_priv); -nft_set_elem_change_active (net, set, &he->ext); +nft_clear (net, &he->ext); } static void nft_hash_flush(const struct net *net,
@@ -652,8 +650,6 @@ static void nft_hash_walk(const struct nft_ctx *ctx, struct nft_set *set,hlist_for_each_entry_rcu (he, &priv->table[i], node) {if (iter->count < iter->skip) goto cont; -if (!nft_set_elem_active (&he->ext, iter->genmask)) - goto cont; iter->err = iter->fn (ctx, set, iter, &he->priv);if (iter->err <0 )
net/netfilter/nft_set_pipapo.c +1 -4
@@ -1773,7 +1773,7 @@ static void nft_pipapo_activate(const struct net *net, {struct nft_pipapo_elem *e =nft_elem_priv_cast (elem_priv); -nft_set_elem_change_active (net, set, &e->ext); +nft_clear (net, &e->ext); }/**
@@ -2074,9 +2074,6 @@ static void nft_pipapo_walk(const struct nft_ctx *ctx, struct nft_set *set, e = f->mt[r].e; -if (!nft_set_elem_active (&e->ext, iter->genmask)) - goto cont; - iter->err = iter->fn (ctx, set, iter, &e->priv);if (iter->err <0 ) goto out;
net/netfilter/nft_set_rbtree.c +1 -3
@@ -532,7 +532,7 @@ static void nft_rbtree_activate(const struct net *net, {struct nft_rbtree_elem *rbe =nft_elem_priv_cast (elem_priv); -nft_set_elem_change_active (net, set, &rbe->ext); +nft_clear (net, &rbe->ext); } static void nft_rbtree_flush(const struct net *net,
@@ -600,8 +600,6 @@ static void nft_rbtree_walk(const struct nft_ctx *ctx,if (iter->count < iter->skip) goto cont; -if (!nft_set_elem_active (&rbe->ext, iter->genmask)) - goto cont; iter->err = iter->fn (ctx, set, iter, &rbe->priv);if (iter->err <0 ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 46/158 gpiolib: swnode: Remove wrong header inclusion
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 69ffed4b62523bbc85511f150500329d28aba356 ]
The flags in the software node properties are supposed to be the GPIO lookup flags, which are provided by gpio/machine.h, as the software nodes are the kernel internal thing and doesn't need to rely to any of ABIs.
--- include/linux/gpio/property.h | 1 - 1 file changed, 1 deletion(-)
include/linux/gpio/property.h +0 -1
@@ -2,7 +2,6 @@#ifndef __LINUX_GPIO_PROPERTY_H#define __LINUX_GPIO_PROPERTY_H -#include <dt-bindings/gpio/gpio.h> /* for GPIO_* flags */ #include <linux/property.h> #define PROPERTY_ENTRY_GPIO (_name_, _chip_node_, _idx_, _flags_) \
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 47/158 netfilter: nf_tables: fix memleak in map from abort path
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 86a1471d7cde792941109b93b558b5dc078b9ee9 ]
The delete set command does not rely on the transaction object for element removal, therefore, a combination of delete element + delete set from the abort path could result in restoring twice the refcount of the mapping.
Check for inactive element in the next generation for the delete element command in the abort path, skip restoring state if next generation bit has been already cleared. This is similar to the activate logic using the set walk iterator.
[ 6170.286929] ------------[ cut here ]------------ [ 6170.286939] WARNING: CPU: 6 PID: 790302 at net/netfilter/nf_tables_api.c:2086 nf_tables_chain_destroy+0x1f7/0x220 [nf_tables] [ 6170.287071] Modules linked in: [...] [ 6170.287633] CPU: 6 PID: 790302 Comm: kworker/6:2 Not tainted 6.9.0-rc3+ #365 [ 6170.287768] RIP: 0010:nf_tables_chain_destroy+0x1f7/0x220 [nf_tables] [ 6170.287886] Code: df 48 8d 7d 58 e8 69 2e 3b df 48 8b 7d 58 e8 80 1b 37 df 48 8d 7d 68 e8 57 2e 3b df 48 8b 7d 68 e8 6e 1b 37 df 48 89 ef eb c4 <0f> 0b 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 0f [ 6170.287895] RSP: 0018:ffff888134b8fd08 EFLAGS: 00010202 [ 6170.287904] RAX: 0000000000000001 RBX: ffff888125bffb28 RCX: dffffc0000000000 [ 6170.287912] RDX: 0000000000000003 RSI: ffffffffa20298ab RDI: ffff88811ebe4750 [ 6170.287919] RBP: ffff88811ebe4700 R08: ffff88838e812650 R09: fffffbfff0623a55 [ 6170.287926] R10: ffffffff8311d2af R11: 0000000000000001 R12: ffff888125bffb10 [ 6170.287933] R13: ffff888125bffb10 R14: dead000000000122 R15: dead000000000100 [ 6170.287940] FS: 0000000000000000(0000) GS:ffff888390b00000(0000) knlGS:0000000000000000 [ 6170.287948] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 6170.287955] CR2: 00007fd31fc00710 CR3: 0000000133f60004 CR4: 00000000001706f0 [ 6170.287962] Call Trace: [ 6170.287967] <TASK> [ 6170.287973] ? __warn+0x9f/0x1a0 [ 6170.287986] ? nf_tables_chain_destroy+0x1f7/0x220 [nf_tables] [ 6170.288092] ? report_bug+0x1b1/0x1e0 [ 6170.287986] ? nf_tables_chain_destroy+0x1f7/0x220 [nf_tables] [ 6170.288092] ? report_bug+0x1b1/0x1e0 [ 6170.288104] ? handle_bug+0x3c/0x70 [ 6170.288112] ? exc_invalid_op+0x17/0x40 [ 6170.288120] ? asm_exc_invalid_op+0x1a/0x20 [ 6170.288132] ? nf_tables_chain_destroy+0x2b/0x220 [nf_tables] [ 6170.288243] ? nf_tables_chain_destroy+0x1f7/0x220 [nf_tables] [ 6170.288366] ? nf_tables_chain_destroy+0x2b/0x220 [nf_tables] [ 6170.288483] nf_tables_trans_destroy_work+0x588/0x590 [nf_tables]
--- net/netfilter/nf_tables_api.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-)
net/netfilter/nf_tables_api.c +14 -2
@@ -7219,6 +7219,16 @@ void nft_data_hold(const struct nft_data *data, enum nft_data_types type) } } +static int nft_setelem_active_next (const struct net *net, +const struct nft_set *set, +struct nft_elem_priv *elem_priv) +{ +const struct nft_set_ext *ext =nft_set_elem_ext (set, elem_priv); +u8 genmask =nft_genmask_next (net); + +return nft_set_elem_active (ext, genmask); +} +static void nft_setelem_data_activate (const struct net *net,const struct nft_set *set,struct nft_elem_priv *elem_priv)
@@ -10636,8 +10646,10 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)case NFT_MSG_DESTROYSETELEM : te = (struct nft_trans_elem *)trans->data; -nft_setelem_data_activate (net, te->set, te->elem_priv); -nft_setelem_activate (net, te->set, te->elem_priv); +if (!nft_setelem_active_next (net, te->set, te->elem_priv)) { +nft_setelem_data_activate (net, te->set, te->elem_priv); +nft_setelem_activate (net, te->set, te->elem_priv); + }if (!nft_setelem_is_catchall (te->set, te->elem_priv)) te->set->ndeact--;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 48/158 net/sched: Fix mirred deadlock on device recursion
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 0f022d32c3eca477fbf79a205243a6123ed0fe11 ]
When the mirred action is used on a classful egress qdisc and a packet is mirrored or redirected to self we hit a qdisc lock deadlock. See trace below.
[..... other info removed for brevity....]
[ 82.890906]
[ 82.890906] ============================================
[ 82.890906] WARNING: possible recursive locking detected
[ 82.890906] 6.8.0-05205-g77fadd89fe2d-dirty #213 Tainted: G W
[ 82.890906] --------------------------------------------
[ 82.890906] ping/418 is trying to acquire lock:
[ 82.890906] ffff888006994110 (&sch->q.lock){+.-.}-{3:3}, at:
__dev_queue_xmit+0x1778/0x3550
[ 82.890906]
[ 82.890906] but task is already holding lock:
[ 82.890906] ffff888006994110 (&sch->q.lock){+.-.}-{3:3}, at:
__dev_queue_xmit+0x1778/0x3550
[ 82.890906]
[ 82.890906] other info that might help us debug this:
[ 82.890906] Possible unsafe locking scenario:
[ 82.890906]
[ 82.890906] CPU0
[ 82.890906] ----
[ 82.890906] lock(&sch->q.lock);
[ 82.890906] lock(&sch->q.lock);
[ 82.890906]
[ 82.890906] *** DEADLOCK ***
[ 82.890906][..... other info removed for brevity....]
Example setup (eth0->eth0) to recreate
tc qdisc add dev eth0 root handle 1: htb default 30 tc filter add dev eth0 handle 1: protocol ip prio 2 matchall \
action mirred egress redirect dev eth0
Another example(eth0->eth1->eth0) to recreate
tc qdisc add dev eth0 root handle 1: htb default 30 tc filter add dev eth0 handle 1: protocol ip prio 2 matchall \
action mirred egress redirect dev eth1
tc qdisc add dev eth1 root handle 1: htb default 30 tc filter add dev eth1 handle 1: protocol ip prio 2 matchall \
action mirred egress redirect dev eth0
We fix this by adding an owner field (CPU id) to struct Qdisc set after root qdisc is entered. When the softirq enters it a second time, if the qdisc owner is the same CPU, the packet is dropped to break the loop.
--- include/net/sch_generic.h | 1 + net/core/dev.c | 6 ++++++ net/sched/sch_generic.c | 1 + 3 files changed, 8 insertions(+)
include/net/sch_generic.h +1 -0
@@ -117,6 +117,7 @@ struct Qdisc {struct qdisc_skb_head q;struct gnet_stats_basic_sync bstats;struct gnet_stats_queue qstats; +int owner;unsigned long state;unsigned long state2;/* must be written under qdisc spinlock */ struct Qdisc *next_sched;
net/core/dev.c +6 -0
@@ -3791,6 +3791,10 @@ static inline int __dev_xmit_skb(struct sk_buff *skb, struct Qdisc *q,return rc; } +if (unlikely (READ_ONCE (q->owner) ==smp_processor_id ())) { +kfree_skb_reason (skb,SKB_DROP_REASON_TC_RECLASSIFY_LOOP ); +return NET_XMIT_DROP ; + }/* * Heuristic to force contended enqueues to serialize on a * separate lock before trying to get qdisc main lock.
@@ -3830,7 +3834,9 @@ static inline int __dev_xmit_skb(struct sk_buff *skb, struct Qdisc *q,qdisc_run_end (q); rc =NET_XMIT_SUCCESS ; }else { +WRITE_ONCE (q->owner,smp_processor_id ()); rc =dev_qdisc_enqueue (skb, q, &to_free, txq); +WRITE_ONCE (q->owner,-1 );if (qdisc_run_begin (q)) {if (unlikely (contended)) {spin_unlock (&q->busylock);
net/sched/sch_generic.c +1 -0
@@ -973,6 +973,7 @@ struct Qdisc *qdisc_alloc(struct netdev_queue *dev_queue, sch->enqueue = ops->enqueue; sch->dequeue = ops->dequeue; sch->dev_queue = dev_queue; + sch->owner =-1 ;netdev_hold (dev, &sch->dev_tracker,GFP_KERNEL );refcount_set (&sch->refcnt,1 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 49/158 net: ethernet: mtk_eth_soc: fix WED + wifi reset
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <[email protected]>
[ Upstream commit 94667949ec3bbb2218c46ad0a0e7274c8832e494 ]
The WLAN + WED reset sequence relies on being able to receive interrupts from the card, in order to synchronize individual steps with the firmware. When WED is stopped, leave interrupts running and rely on the driver turning off unwanted ones.
WED DMA also needs to be disabled before resetting.
--- drivers/net/ethernet/mediatek/mtk_wed.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
drivers/net/ethernet/mediatek/mtk_wed.c +1 -5
@@ -1074,13 +1074,13 @@ mtk_wed_dma_disable(struct mtk_wed_device *dev)static void mtk_wed_stop (struct mtk_wed_device *dev) { +mtk_wed_dma_disable (dev);mtk_wed_set_ext_int (dev, false);wed_w32 (dev,MTK_WED_WPDMA_INT_TRIGGER ,0 );wed_w32 (dev,MTK_WED_WDMA_INT_TRIGGER ,0 );wdma_w32 (dev,MTK_WDMA_INT_MASK ,0 );wdma_w32 (dev,MTK_WDMA_INT_GRP2 ,0 ); -wed_w32 (dev,MTK_WED_WPDMA_INT_MASK ,0 );if (!mtk_wed_get_rx_capa (dev))return ;
@@ -1093,7 +1093,6 @@ static void mtk_wed_deinit(struct mtk_wed_device *dev) {mtk_wed_stop (dev); -mtk_wed_dma_disable (dev); wed_clr(dev, MTK_WED_CTRL, MTK_WED_CTRL_WDMA_INT_AGENT_EN |
@@ -2605,9 +2604,6 @@ mtk_wed_irq_get(struct mtk_wed_device *dev, u32 mask)static void mtk_wed_irq_set_mask (struct mtk_wed_device *dev,u32 mask) { -if (!dev->running) -return ; -mtk_wed_set_ext_int (dev, !!mask);wed_w32 (dev,MTK_WED_INT_MASK , mask); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 50/158 ravb: Group descriptor types used in Rx ring
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Söderlund <[email protected]>
[ Upstream commit 4123c3fbf8632e5c553222bf1c10b3a3e0a8dc06 ]
The Rx ring can either be made up of normal or extended descriptors, not a mix of the two at the same time. Make this explicit by grouping the two variables in a rx_ring union.
The extension of the storage for more than one queue of normal descriptors from a single to NUM_RX_QUEUE queues have no practical effect. But aids in making the code readable as the code that uses it already piggyback on other members of struct ravb_private that are arrays of max length NUM_RX_QUEUE, e.g. rx_desc_dma. This will also make further refactoring easier.
While at it, rename the normal descriptor Rx ring to make it clear it's not strictly related to the GbEthernet E-MAC IP found in RZ/G2L, normal descriptors could be used on R-Car SoCs too.
Stable-dep-of: def52db470df ("net: ravb: Count packets instead of descriptors in R-Car RX path")
--- drivers/net/ethernet/renesas/ravb.h | 6 ++- drivers/net/ethernet/renesas/ravb_main.c | 57 ++++++++++++------------ 2 files changed, 33 insertions(+), 30 deletions(-)
drivers/net/ethernet/renesas/ravb.h +4 -2
@@ -1060,8 +1060,10 @@ struct ravb_private {struct ravb_desc *desc_bat;dma_addr_t rx_desc_dma[NUM_RX_QUEUE ];dma_addr_t tx_desc_dma[NUM_TX_QUEUE ]; -struct ravb_rx_desc *gbeth_rx_ring; -struct ravb_ex_rx_desc *rx_ring[NUM_RX_QUEUE ]; +union { +struct ravb_rx_desc *desc; +struct ravb_ex_rx_desc *ex_desc; + } rx_ring[NUM_RX_QUEUE ];struct ravb_tx_desc *tx_ring[NUM_TX_QUEUE ];void *tx_align[NUM_TX_QUEUE ];struct sk_buff *rx_1st_skb;
drivers/net/ethernet/renesas/ravb_main.c +29 -28
165 lines not on this page · raw message
Signature · 1 line
2.43.0
Re: [PATCH 6.8 050/158] ravb: Group descriptor types used in Rx ring
Quoted 23 lines · Greg Kroah-Hartman
6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Söderlund <[email protected]>
[ Upstream commit
4123c3fbf8632e5c553222bf1c10b3a3e0a8dc06]The Rx ring can either be made up of normal or extended descriptors, not a mix of the two at the same time. Make this explicit by grouping the two variables in a
rx_ringunion.The extension of the storage for more than one queue of normal descriptors from a single to
NUM_RX_QUEUEqueues have no practical effect. But aids in making the code readable as the code that uses it already piggyback on other members of structravb_privatethat are arrays of max lengthNUM_RX_QUEUE, e.g.rx_desc_dma. This will also make further refactoring easier.While at it, rename the normal descriptor Rx ring to make it clear it's not strictly related to the GbEthernet E-MAC IP found in RZ/G2L, normal descriptors could be used on R-Car SoCs too.
Quoted 5 lines
Signed-off-by Niklas Söderlund <[email protected]>Reviewed-by Paul Barker <[email protected]>Reviewed-by Sergey Shtylyov <[email protected]>Signed-off-by David S. Miller <[email protected]>Stable-dep-of:
def52db470df("net: ravb: Count packets instead of descriptors in R-Car RX path")
I still highly doubt that this patch is really necessary in -stable.
This patch shouldn't depend on it...
Quoted 1 line
Signed-off-by Sasha Levin <[email protected]>
[...]
MBR, Sergey
Greg Kroah-Hartman
maintainerPATCH 51/158 net: ravb: Count packets instead of descriptors in R-Car RX path
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Barker <[email protected]>
[ Upstream commit def52db470df28d6f43cacbd21137f03b9502073 ]
The units of "work done" in the RX path should be packets instead of descriptors.
Descriptors which are used by the hardware to record error conditions or are empty in the case of a DMA mapping error should not count towards our RX work budget.
Also make the limit variable unsigned as it can never be negative.
--- drivers/net/ethernet/renesas/ravb_main.c | 21 ++++++++------------- 1 file changed, 8 insertions(+), 13 deletions(-)
drivers/net/ethernet/renesas/ravb_main.c +8 -13
@@ -895,29 +895,24 @@ static bool ravb_rx_rcar(struct net_device *ndev, int *quota, int q)struct ravb_private *priv =netdev_priv (ndev);const struct ravb_hw_info *info = priv->info;int entry = priv->cur_rx[q] % priv->num_rx_ring[q]; -int boguscnt = (priv->dirty_rx[q] + priv->num_rx_ring[q]) - - priv->cur_rx[q];struct net_device_stats *stats = &priv->stats[q];struct ravb_ex_rx_desc *desc; +unsigned int limit, i;struct sk_buff *skb;dma_addr_t dma_addr;struct timespec64 ts; +int rx_packets =0 ;u8 desc_status;u16 pkt_len; -int limit; - boguscnt =min (boguscnt, *quota); - limit = boguscnt; + limit = priv->dirty_rx[q] + priv->num_rx_ring[q] - priv->cur_rx[q]; desc = &priv->rx_ring[q].ex_desc[entry]; -while (desc->die_dt !=DT_FEMPTY ) { +for (i =0 ; i < limit && rx_packets < *quota && desc->die_dt !=DT_FEMPTY ; i++) {/* Descriptor type must be checked before all other reads */ dma_rmb (); desc_status = desc->msc; pkt_len =le16_to_cpu (desc->ds_cc) &RX_DS ; -if (--boguscnt <0 ) -break ; -/* We use 0-byte descriptors to mark the DMA mapping errors */ if (!pkt_len)continue ;
@@ -963,7 +958,7 @@ static bool ravb_rx_rcar(struct net_device *ndev, int *quota, int q)if (ndev->features &NETIF_F_RXCSUM )ravb_rx_csum (skb);napi_gro_receive (&priv->napi[q], skb); - stats->rx_packets++; + rx_packets++; stats->rx_bytes += pkt_len; }
@@ -999,9 +994,9 @@ static bool ravb_rx_rcar(struct net_device *ndev, int *quota, int q) desc->die_dt =DT_FEMPTY ; } - *quota -= limit - (++boguscnt); - -return boguscnt <=0 ; + stats->rx_packets += rx_packets; + *quota -= rx_packets; +return *quota ==0 ; }/* Packet receive function for Ethernet AVB */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 52/158 net: ravb: Allow RX loop to move past DMA mapping errors
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Barker <[email protected]>
[ Upstream commit a892493a343494bd6bab9d098593932077ff3c43 ]
The RX loops in ravb_rx_gbeth() and ravb_rx_rcar() skip to the next loop iteration if a zero-length descriptor is seen (indicating a DMA mapping error). However, the current RX descriptor index priv->cur_rx[q] was incremented at the end of the loop and so would not be incremented when we skip to the next loop iteration. This would cause the loop to keep seeing the same zero-length descriptor instead of moving on to the next descriptor.
As the loop counter i still increments, the loop would eventually terminate so there is no risk of being stuck here forever - but we should still fix this to avoid wasting cycles.
To fix this, the RX descriptor index is incremented at the top of the loop, in the for statement itself. The assignments of entry and desc are brought into the loop to avoid the need for duplication.
--- drivers/net/ethernet/renesas/ravb_main.c | 25 ++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-)
drivers/net/ethernet/renesas/ravb_main.c +13 -12
@@ -781,12 +781,15 @@ static bool ravb_rx_gbeth(struct net_device *ndev, int *quota, int q)int limit;int i; - entry = priv->cur_rx[q] % priv->num_rx_ring[q]; limit = priv->dirty_rx[q] + priv->num_rx_ring[q] - priv->cur_rx[q]; stats = &priv->stats[q]; - desc = &priv->rx_ring[q].desc[entry]; -for (i =0 ; i < limit && rx_packets < *quota && desc->die_dt !=DT_FEMPTY ; i++) { +for (i =0 ; i < limit; i++, priv->cur_rx[q]++) { + entry = priv->cur_rx[q] % priv->num_rx_ring[q]; + desc = &priv->rx_ring[q].desc[entry]; +if (rx_packets == *quota || desc->die_dt ==DT_FEMPTY ) +break ; +/* Descriptor type must be checked before all other reads */ dma_rmb (); desc_status = desc->msc;
@@ -850,9 +853,6 @@ static bool ravb_rx_gbeth(struct net_device *ndev, int *quota, int q)break ; } } - - entry = (++priv->cur_rx[q]) % priv->num_rx_ring[q]; - desc = &priv->rx_ring[q].desc[entry]; }/* Refill the RX ring buffers. */
@@ -894,7 +894,6 @@ static bool ravb_rx_rcar(struct net_device *ndev, int *quota, int q) {struct ravb_private *priv =netdev_priv (ndev);const struct ravb_hw_info *info = priv->info; -int entry = priv->cur_rx[q] % priv->num_rx_ring[q];struct net_device_stats *stats = &priv->stats[q];struct ravb_ex_rx_desc *desc;unsigned int limit, i;
@@ -904,10 +903,15 @@ static bool ravb_rx_rcar(struct net_device *ndev, int *quota, int q)int rx_packets =0 ;u8 desc_status;u16 pkt_len; +int entry; limit = priv->dirty_rx[q] + priv->num_rx_ring[q] - priv->cur_rx[q]; - desc = &priv->rx_ring[q].ex_desc[entry]; -for (i =0 ; i < limit && rx_packets < *quota && desc->die_dt !=DT_FEMPTY ; i++) { +for (i =0 ; i < limit; i++, priv->cur_rx[q]++) { + entry = priv->cur_rx[q] % priv->num_rx_ring[q]; + desc = &priv->rx_ring[q].ex_desc[entry]; +if (rx_packets == *quota || desc->die_dt ==DT_FEMPTY ) +break ; +/* Descriptor type must be checked before all other reads */ dma_rmb (); desc_status = desc->msc;
@@ -961,9 +965,6 @@ static bool ravb_rx_rcar(struct net_device *ndev, int *quota, int q) rx_packets++; stats->rx_bytes += pkt_len; } - - entry = (++priv->cur_rx[q]) % priv->num_rx_ring[q]; - desc = &priv->rx_ring[q].ex_desc[entry]; }/* Refill the RX ring buffers. */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 53/158 net: ethernet: ti: am65-cpsw-nuss: cleanup DMA Channels before using them
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Siddharth Vadapalli <[email protected]>
[ Upstream commit c24cd679b075b0e953ea167b0aa2b2d59e4eba7f ]
The TX and RX DMA Channels used by the driver to exchange data with CPSW are not guaranteed to be in a clean state during driver initialization. The Bootloader could have used the same DMA Channels without cleaning them up in the event of failure. Thus, reset and disable the DMA Channels to ensure that they are in a clean state before using them.
--- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
drivers/net/ethernet/ti/am65-cpsw-nuss.c +18 -0
@@ -2793,6 +2793,8 @@ static void am65_cpsw_unregister_devlink(struct am65_cpsw_common *common)static int am65_cpsw_nuss_register_ndevs (struct am65_cpsw_common *common) { +struct am65_cpsw_rx_chn *rx_chan = &common->rx_chns; +struct am65_cpsw_tx_chn *tx_chan = common->tx_chns;struct device *dev = common->dev;struct am65_cpsw_port *port;int ret =0 , i;
@@ -2805,6 +2807,22 @@ static int am65_cpsw_nuss_register_ndevs(struct am65_cpsw_common *common)if (ret)return ret; +/* The DMA Channels are not guaranteed to be in a clean state. +* Reset and disable them to ensure that they are back to the +* clean state and ready to be used. +*/ +for (i =0 ; i < common->tx_ch_num; i++) { +k3_udma_glue_reset_tx_chn (tx_chan[i].tx_chn, &tx_chan[i], + am65_cpsw_nuss_tx_cleanup); +k3_udma_glue_disable_tx_chn (tx_chan[i].tx_chn); + } + +for (i =0 ; i <AM65_CPSW_MAX_RX_FLOWS ; i++) +k3_udma_glue_reset_rx_chn (rx_chan->rx_chn, i, rx_chan, + am65_cpsw_nuss_rx_cleanup, !!i); + +k3_udma_glue_disable_rx_chn (rx_chan->rx_chn); + ret =am65_cpsw_nuss_register_devlink (common);if (ret)return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 54/158 NFSD: fix endianness issue in nfsd4_encode_fattr4
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasily Gorbik <[email protected]>
[ Upstream commit f488138b526715c6d2568d7329c4477911be4210 ]
The nfs4 mount fails with EIO on 64-bit big endian architectures since v6.7. The issue arises from employing a union in the nfsd4_encode_fattr4() function to overlay a 32-bit array with a 64-bit values based bitmap, which does not function as intended. Address the endianness issue by utilizing bitmap_from_arr32() to copy 32-bit attribute masks into a bitmap in an endianness-agnostic manner.
--- fs/nfsd/nfs4xdr.c | 47 +++++++++++++++++++++++------------------------ 1 file changed, 23 insertions(+), 24 deletions(-)
fs/nfsd/nfs4xdr.c +23 -24
@@ -3490,11 +3490,13 @@ nfsd4_encode_fattr4(struct svc_rqst *rqstp, struct xdr_stream *xdr, struct dentry *dentry, const u32 *bmval, int ignore_crossmnt) { +DECLARE_BITMAP (attr_bitmap ,ARRAY_SIZE (nfsd4_enc_fattr4_encode_ops ));struct nfsd4_fattr_args args;struct svc_fh *tempfh =NULL ;int starting_len = xdr->buf->len;__be32 *attrlen_p, status;int attrlen_offset; +u32 attrmask[3 ];int err;struct nfsd4_compoundres *resp = rqstp->rq_resp;u32 minorversion = resp->cstate.minorversion;
@@ -3502,10 +3504,6 @@ nfsd4_encode_fattr4(struct svc_rqst *rqstp, struct xdr_stream *xdr, .mnt = exp->ex_path.mnt, .dentry = dentry, }; -union { -u32 attrmask[3 ]; -unsigned long mask[2 ]; - } u;unsigned long bit;WARN_ON_ONCE (bmval[1 ] &NFSD_WRITEONLY_ATTRS_WORD1 );
@@ -3519,20 +3517,19 @@ nfsd4_encode_fattr4(struct svc_rqst *rqstp, struct xdr_stream *xdr,/* * Make a local copy of the attribute bitmap that can be modified. */ -memset (&u,0 ,sizeof (u)); - u.attrmask[0 ] = bmval[0 ]; - u.attrmask[1 ] = bmval[1 ]; - u.attrmask[2 ] = bmval[2 ]; + attrmask[0 ] = bmval[0 ]; + attrmask[1 ] = bmval[1 ]; + attrmask[2 ] = bmval[2 ]; args.rdattr_err =0 ;if (exp->ex_fslocs.migrated) { - status =fattr_handle_absent_fs (&u.attrmask[0 ], &u.attrmask[1 ], - &u.attrmask[2 ], &args.rdattr_err); + status =fattr_handle_absent_fs (&attrmask[0 ], &attrmask[1 ], + &attrmask[2 ], &args.rdattr_err);if (status) goto out; } args.size =0 ; -if (u.attrmask[0 ] & (FATTR4_WORD0_CHANGE |FATTR4_WORD0_SIZE )) { +if (attrmask[0 ] & (FATTR4_WORD0_CHANGE |FATTR4_WORD0_SIZE )) { status =nfsd4_deleg_getattr_conflict (rqstp,d_inode (dentry));if (status) goto out;
@@ -3547,16 +3544,16 @@ nfsd4_encode_fattr4(struct svc_rqst *rqstp, struct xdr_stream *xdr,if (!(args.stat.result_mask &STATX_BTIME ))/* underlying FS does not offer btime so we can't share it */ - u.attrmask[1 ] &= ~FATTR4_WORD1_TIME_CREATE ; -if ((u.attrmask[0 ] & (FATTR4_WORD0_FILES_AVAIL |FATTR4_WORD0_FILES_FREE | + attrmask[1 ] &= ~FATTR4_WORD1_TIME_CREATE ; +if ((attrmask[0 ] & (FATTR4_WORD0_FILES_AVAIL |FATTR4_WORD0_FILES_FREE |FATTR4_WORD0_FILES_TOTAL |FATTR4_WORD0_MAXNAME )) || - (u.attrmask[1 ] & (FATTR4_WORD1_SPACE_AVAIL |FATTR4_WORD1_SPACE_FREE | + (attrmask[1 ] & (FATTR4_WORD1_SPACE_AVAIL |FATTR4_WORD1_SPACE_FREE |FATTR4_WORD1_SPACE_TOTAL ))) { err =vfs_statfs (&path, &args.statfs);if (err) goto out_nfserr; } -if ((u.attrmask[0 ] & (FATTR4_WORD0_FILEHANDLE |FATTR4_WORD0_FSID )) && +if ((attrmask[0 ] & (FATTR4_WORD0_FILEHANDLE |FATTR4_WORD0_FSID )) && !fhp) { tempfh =kmalloc (sizeof (struct svc_fh ),GFP_KERNEL ); status = nfserr_jukebox;
@@ -3571,10 +3568,10 @@ nfsd4_encode_fattr4(struct svc_rqst *rqstp, struct xdr_stream *xdr, args.fhp = fhp; args.acl =NULL ; -if (u.attrmask[0 ] &FATTR4_WORD0_ACL ) { +if (attrmask[0 ] &FATTR4_WORD0_ACL ) { err =nfsd4_get_nfs4_acl (rqstp, dentry, &args.acl);if (err == -EOPNOTSUPP ) - u.attrmask[0 ] &= ~FATTR4_WORD0_ACL ; + attrmask[0 ] &= ~FATTR4_WORD0_ACL ;else if (err == -EINVAL ) { status = nfserr_attrnotsupp; goto out;
@@ -3586,17 +3583,17 @@ nfsd4_encode_fattr4(struct svc_rqst *rqstp, struct xdr_stream *xdr,#ifdef CONFIG_NFSD_V4_SECURITY_LABEL args.context =NULL ; -if ((u.attrmask[2 ] &FATTR4_WORD2_SECURITY_LABEL ) || - u.attrmask[0 ] &FATTR4_WORD0_SUPPORTED_ATTRS ) { +if ((attrmask[2 ] &FATTR4_WORD2_SECURITY_LABEL ) || + attrmask[0 ] &FATTR4_WORD0_SUPPORTED_ATTRS ) {if (exp->ex_flags &NFSEXP_SECURITY_LABEL ) err =security_inode_getsecctx (d_inode (dentry), &args.context, &args.contextlen);else err = -EOPNOTSUPP ; args.contextsupport = (err ==0 ); -if (u.attrmask[2 ] &FATTR4_WORD2_SECURITY_LABEL ) { +if (attrmask[2 ] &FATTR4_WORD2_SECURITY_LABEL ) {if (err == -EOPNOTSUPP ) - u.attrmask[2 ] &= ~FATTR4_WORD2_SECURITY_LABEL ; + attrmask[2 ] &= ~FATTR4_WORD2_SECURITY_LABEL ;else if (err) goto out_nfserr; }
@@ -3604,8 +3601,8 @@ nfsd4_encode_fattr4(struct svc_rqst *rqstp, struct xdr_stream *xdr,#endif /* CONFIG_NFSD_V4_SECURITY_LABEL */ /* attrmask */ - status =nfsd4_encode_bitmap4 (xdr, u.attrmask[0 ], - u.attrmask[1 ], u.attrmask[2 ]); + status =nfsd4_encode_bitmap4 (xdr, attrmask[0 ], attrmask[1 ], + attrmask[2 ]);if (status) goto out;
@@ -3614,7 +3611,9 @@ nfsd4_encode_fattr4(struct svc_rqst *rqstp, struct xdr_stream *xdr, attrlen_p =xdr_reserve_space (xdr,XDR_UNIT );if (!attrlen_p) goto out_resource; -for_each_set_bit (bit, (const unsigned long *)&u.mask, +bitmap_from_arr32 (attr_bitmap, attrmask, +ARRAY_SIZE (nfsd4_enc_fattr4_encode_ops)); +for_each_set_bit (bit, attr_bitmap,ARRAY_SIZE (nfsd4_enc_fattr4_encode_ops)) { status = nfsd4_enc_fattr4_encode_ops[bit](xdr, &args);if (status != nfs_ok)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 55/158 RDMA/rxe: Fix the problem "mutex_destroy missing"
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yanjun.Zhu <[email protected]>
[ Upstream commit 481047d7e8391d3842ae59025806531cdad710d9 ]
When a mutex lock is not used any more, the function mutex_destroy should be called to mark the mutex lock uninitialized.
--- drivers/infiniband/sw/rxe/rxe.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/infiniband/sw/rxe/rxe.c +2 -0
@@ -33,6 +33,8 @@ void rxe_dealloc(struct ib_device *ib_dev)if (rxe->tfm)crypto_free_shash (rxe->tfm); + +mutex_destroy (&rxe->usdev_lock); }/* initialize rxe device parameters */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 56/158 RDMA/cm: Print the old state when cm_destroy_id gets timeout
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Zhang <[email protected]>
[ Upstream commit b68e1acb5834ed1a2ad42d9d002815a8bae7c0b6 ]
The old state is helpful for debugging, as the current state is always IB_CM_IDLE when timeout happens.
--- drivers/infiniband/core/cm.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
drivers/infiniband/core/cm.c +7 -4
@@ -1026,23 +1026,26 @@ static void cm_reset_to_idle(struct cm_id_private *cm_id_priv) } } -static noinline void cm_destroy_id_wait_timeout(struct ib_cm_id *cm_id) +static noinline void cm_destroy_id_wait_timeout(struct ib_cm_id *cm_id, +enum ib_cm_state old_state) {struct cm_id_private *cm_id_priv; cm_id_priv = container_of(cm_id, struct cm_id_private, id); -pr_err ("%s: cm_id=%p timed out. state=%d refcnt=%d\n" , __func__, - cm_id, cm_id->state,refcount_read (&cm_id_priv->refcount)); +pr_err ("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n" , __func__, + cm_id, old_state, cm_id->state,refcount_read (&cm_id_priv->refcount)); }static void cm_destroy_id (struct ib_cm_id *cm_id,int err) {struct cm_id_private *cm_id_priv; +enum ib_cm_state old_state;struct cm_work *work;int ret; cm_id_priv = container_of(cm_id, struct cm_id_private, id);spin_lock_irq (&cm_id_priv->lock); + old_state = cm_id->state; retest:switch (cm_id->state) {case IB_CM_LISTEN :
@@ -1151,7 +1154,7 @@ static void cm_destroy_id(struct ib_cm_id *cm_id, int err)msecs_to_jiffies ( CM_DESTROY_ID_WAIT_TIMEOUT));if (!ret)/* timeout happened */ -cm_destroy_id_wait_timeout (cm_id); +cm_destroy_id_wait_timeout (cm_id, old_state); }while (!ret);while ((work =cm_dequeue_work (cm_id_priv)) !=NULL )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 57/158 RDMA/mlx5: Fix port number for counter query in multi-port configuration
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Guralnik <[email protected]>
[ Upstream commit be121ffb384f53e966ee7299ffccc6eeb61bc73d ]
Set the correct port when querying PPCNT in multi-port configuration. Distinguish between cases where switchdev mode was enabled to multi-port configuration and don't overwrite the queried port to 1 in multi-port case.
--- drivers/infiniband/hw/mlx5/mad.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/infiniband/hw/mlx5/mad.c +2 -1
@@ -188,7 +188,8 @@ static int process_pma_cmd(struct mlx5_ib_dev *dev, u32 port_num, mdev = dev->mdev; mdev_port_num =1 ; } -if (MLX5_CAP_GEN (dev->mdev, num_ports) ==1 ) { +if (MLX5_CAP_GEN (dev->mdev, num_ports) ==1 && + !mlx5_core_mp_enabled (mdev)) {/* set local port to one for Function-Per-Port HCA. */ mdev = dev->mdev; mdev_port_num =1 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 58/158 perf annotate: Make sure to call symbol__annotate2() in TUI
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namhyung Kim <[email protected]>
[ Upstream commit 2b8dbf69ec60faf6c7db49e57d7f316409ccec92 ]
The symbol__annotate2() initializes some data structures needed by TUI. It has a logic to prevent calling it multiple times by checking if it has the annotated source. But data type profiling uses a different code (symbol__annotate) to allocate the annotated lines in advance. So TUI missed to call symbol__annotate2() when it shows the annotation browser.
Make symbol__annotate() reentrant and handle that situation properly. This fixes a crash in the annotation browser started by perf report in TUI like below.
$ perf report -s type,sym --tui # and press 'a' key and then move down
--- tools/perf/ui/browsers/annotate.c | 2 +- tools/perf/util/annotate.c | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-)
tools/perf/ui/browsers/annotate.c +1 -1
@@ -970,7 +970,7 @@ int symbol__tui_annotate(struct map_symbol *ms, struct evsel *evsel,if (dso->annotate_warned)return -1 ; -if (not_annotated) { +if (not_annotated || !sym->annotate2) { err =symbol__annotate2 (ms, evsel, &browser.arch);if (err) {char msg[BUFSIZ ];
tools/perf/util/annotate.c +3 -0
@@ -2435,6 +2435,9 @@ int symbol__annotate(struct map_symbol *ms, struct evsel *evsel,if (parch) *parch = arch; +if (!list_empty (¬es->src->source)) +return 0 ; + args.arch = arch; args.ms = *ms;if (annotate_opts.full_addr)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 59/158 perf lock contention: Add a missing NULL check
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namhyung Kim <[email protected]>
[ Upstream commit f3408580bac8ce5cd76e7391e529c0a22e7c7eb2 ]
I got a report for a failure in BPF verifier on a recent kernel with perf lock contention command. It checks task->sighand->siglock without checking if sighand is NULL or not. Let's add one.
; if (&curr->sighand->siglock == (void *)lock)
265: (79) r1 = *(u64 *)(r0 +2624) ; frame1: R0_w=trusted_ptr_task_struct(off=0,imm=0)
; R1_w=rcu_ptr_or_null_sighand_struct(off=0,imm=0)
266: (b7) r2 = 0 ; frame1: R2_w=0
267: (0f) r1 += r2
R1 pointer arithmetic on rcu_ptr_or_null_ prohibited, null-check it first
processed 164 insns (limit 1000000) max_states_per_insn 1 total_states 15 peak_states 15 mark_read 5 -- END PROG LOAD LOG --
libbpf: prog 'contention_end': failed to load: -13
libbpf: failed to load object 'lock_contention_bpf'
libbpf: failed to load BPF skeleton 'lock_contention_bpf': -13
Failed to load lock-contention BPF skeleton
lock contention BPF setup failed
lock contention did not detect any lock contention
--- tools/perf/util/bpf_skel/lock_contention.bpf.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
tools/perf/util/bpf_skel/lock_contention.bpf.c +4 -1
@@ -289,6 +289,7 @@ static inline __u32 check_lock_type(__u64 lock, __u32 flags)struct task_struct *curr;struct mm_struct___old *mm_old;struct mm_struct___new *mm_new; +struct sighand_struct *sighand;switch (flags) {case LCB_F_READ :/* rwsem */
@@ -310,7 +311,9 @@ static inline __u32 check_lock_type(__u64 lock, __u32 flags)break ;case LCB_F_SPIN :/* spinlock */ curr =bpf_get_current_task_btf (); -if (&curr->sighand->siglock == (void *)lock) + sighand = curr->sighand; + +if (sighand && &sighand->siglock == (void *)lock)return LCD_F_SIGHAND_LOCK ;break ;default :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 60/158 s390/qdio: handle deferred cc1
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Oberparleiter <[email protected]>
[ Upstream commit 607638faf2ff1cede37458111496e7cc6c977f6f ]
A deferred condition code 1 response indicates that I/O was not started and should be retried. The current QDIO implementation handles a cc1 response as I/O error, resulting in a failed QDIO setup. This can happen for example when a path verification request arrives at the same time as QDIO setup I/O is started.
Fix this by retrying the QDIO setup I/O when a cc1 response is received.
Note that since
commit 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers") commit 5ef1dc40ffa6 ("s390/cio: fix invalid -EBUSY on ccw_device_start")
deferred cc1 responses are much more likely to occur. See the commit message of the latter for more background information.
--- drivers/s390/cio/qdio_main.c | 28 +++++++++++++++++++++++----- 1 file changed, 23 insertions(+), 5 deletions(-)
drivers/s390/cio/qdio_main.c +23 -5
@@ -722,8 +722,8 @@ static void qdio_handle_activate_check(struct qdio_irq *irq_ptr,lgr_info_log (); } -static void qdio_establish_handle_irq (struct qdio_irq *irq_ptr,int cstat, -int dstat) +static int qdio_establish_handle_irq (struct qdio_irq *irq_ptr,int cstat, +int dstat,int dcc) {DBF_DEV_EVENT (DBF_INFO , irq_ptr,"qest irq" );
@@ -731,15 +731,18 @@ static void qdio_establish_handle_irq(struct qdio_irq *irq_ptr, int cstat, goto error;if (dstat & ~(DEV_STAT_DEV_END |DEV_STAT_CHN_END )) goto error; +if (dcc ==1 ) +return -EAGAIN ;if (!(dstat &DEV_STAT_DEV_END )) goto error;qdio_set_state (irq_ptr,QDIO_IRQ_STATE_ESTABLISHED ); -return ; +return 0 ; error:DBF_ERROR ("%4x EQ:error" , irq_ptr->schid.sch_no);DBF_ERROR ("ds: %2x cs:%2x" , dstat, cstat);qdio_set_state (irq_ptr,QDIO_IRQ_STATE_ERR ); +return -EIO ; }/* qdio interrupt handler */
@@ -748,7 +751,7 @@ void qdio_int_handler(struct ccw_device *cdev, unsigned long intparm, {struct qdio_irq *irq_ptr = cdev->private->qdio_data;struct subchannel_id schid; -int cstat, dstat; +int cstat, dstat, rc, dcc;if (!intparm || !irq_ptr) {ccw_device_get_schid (cdev, &schid);
@@ -768,10 +771,12 @@ void qdio_int_handler(struct ccw_device *cdev, unsigned long intparm,qdio_irq_check_sense (irq_ptr, irb); cstat = irb->scsw.cmd.cstat; dstat = irb->scsw.cmd.dstat; + dcc =scsw_cmd_is_valid_cc (&irb->scsw) ? irb->scsw.cmd.cc :0 ; + rc =0 ;switch (irq_ptr->state) {case QDIO_IRQ_STATE_INACTIVE : -qdio_establish_handle_irq (irq_ptr, cstat, dstat); + rc =qdio_establish_handle_irq (irq_ptr, cstat, dstat, dcc);break ;case QDIO_IRQ_STATE_CLEANUP :qdio_set_state (irq_ptr,QDIO_IRQ_STATE_INACTIVE );
@@ -785,12 +790,25 @@ void qdio_int_handler(struct ccw_device *cdev, unsigned long intparm,if (cstat || dstat)qdio_handle_activate_check (irq_ptr, intparm, cstat, dstat); +else if (dcc ==1 ) + rc = -EAGAIN ;break ;case QDIO_IRQ_STATE_STOPPED :break ;default :WARN_ON_ONCE (1 ); } + +if (rc == -EAGAIN ) { +DBF_DEV_EVENT (DBF_INFO , irq_ptr,"qint retry" ); + rc =ccw_device_start (cdev, irq_ptr->ccw, intparm,0 ,0 ); +if (!rc) +return ; +DBF_ERROR ("%4x RETRY ERR" , irq_ptr->schid.sch_no); +DBF_ERROR ("rc:%4x" , rc); +qdio_set_state (irq_ptr,QDIO_IRQ_STATE_ERR ); + } +wake_up (&cdev->private->wait_q); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 61/158 s390/cio: fix race condition during online processing
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Oberparleiter <[email protected]>
[ Upstream commit 2d8527f2f911fab84aec04df4788c0c23af3df48 ]
A race condition exists in ccw_device_set_online() that can cause the online process to fail, leaving the affected device in an inconsistent state. As a result, subsequent attempts to set that device online fail with return code ENODEV.
The problem occurs when a path verification request arrives after a wait for final device state completed, but before the result state is evaluated.
Fix this by ensuring that the CCW-device lock is held between determining final state and checking result state.
Note that since:
commit 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers")
path verification requests are much more likely to occur during boot, resulting in an increased chance of this race condition occurring.
--- drivers/s390/cio/device.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
drivers/s390/cio/device.c +8 -5
@@ -363,10 +363,8 @@ int ccw_device_set_online(struct ccw_device *cdev)spin_lock_irq (cdev->ccwlock); ret =ccw_device_online (cdev); -spin_unlock_irq (cdev->ccwlock); -if (ret ==0 ) -wait_event (cdev->private->wait_q,dev_fsm_final_state (cdev)); -else { +if (ret) { +spin_unlock_irq (cdev->ccwlock); CIO_MSG_EVENT(0, "ccw_device_online returned %d, " "device 0.%x.%04x\n", ret, cdev->private->dev_id.ssid,
@@ -375,7 +373,12 @@ int ccw_device_set_online(struct ccw_device *cdev)put_device (&cdev->dev);return ret; } -spin_lock_irq (cdev->ccwlock); +/* Wait until a final state is reached */ +while (!dev_fsm_final_state (cdev)) { +spin_unlock_irq (cdev->ccwlock); +wait_event (cdev->private->wait_q,dev_fsm_final_state (cdev)); +spin_lock_irq (cdev->ccwlock); + }/* Check if online processing was successful */ if ((cdev->private->state !=DEV_STATE_ONLINE ) && (cdev->private->state !=DEV_STATE_W4SENSE )) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 62/158 iommufd: Add missing IOMMUFD_DRIVER kconfig for the selftest
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gunthorpe <[email protected]>
[ Upstream commit 8541323285994528ad5be2c1bdc759e6c83b936e ]
Some kconfigs don't automatically include this symbol which results in sub functions for some of the dirty tracking related things that are non-functional. Thus the test suite will fail. select IOMMUFD_DRIVER in the IOMMUFD_TEST kconfig to fix it.
--- drivers/iommu/iommufd/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/iommu/iommufd/Kconfig +1 -0
@@ -37,6 +37,7 @@ config IOMMUFD_TEST depends on DEBUG_KERNEL depends on FAULT_INJECTION depends on RUNTIME_TESTING_MENU + select IOMMUFD_DRIVER default n help This is dangerous, do not enable unless running
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 63/158 iommufd: Add config needed for iommufd_fail_nth
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Usama Anjum <[email protected]>
[ Upstream commit 2760c51b8040d7cffedc337939e7475a17cc4b19 ]
Add FAULT_INJECTION_DEBUG_FS and FAILSLAB configurations to the kconfig fragment for the iommfd selftests. These kconfigs are needed by the iommufd_fail_nth test.
--- tools/testing/selftests/iommu/config | 2 ++ 1 file changed, 2 insertions(+)
tools/testing/selftests/iommu/config +2 -0
@@ -1,3 +1,5 @@ CONFIG_IOMMUFD=y +CONFIG_FAULT_INJECTION_DEBUG_FS=y CONFIG_FAULT_INJECTION=y CONFIG_IOMMUFD_TEST=y +CONFIG_FAILSLAB=y
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 64/158 drm: nv04: Fix out of bounds access
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikhail Kobuk <[email protected]>
[ Upstream commit cf92bb778eda7830e79452c6917efa8474a30c1e ]
When Output Resource (dcb->or) value is assigned in fabricate_dcb_output(), there may be out of bounds access to dac_users array in case dcb->or is zero because ffs(dcb->or) is used as index there.
The 'or' argument of fabricate_dcb_output() must be interpreted as a number of bit to set, not value.
Utilize macros from 'enum nouveau_or' in calls instead of hardcoding.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/gpu/drm/nouveau/nouveau_bios.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
drivers/gpu/drm/nouveau/nouveau_bios.c +7 -6
@@ -23,6 +23,7 @@*/ #include "nouveau_drv.h" +#include "nouveau_bios.h" #include "nouveau_reg.h" #include "dispnv04/hw.h" #include "nouveau_encoder.h"
@@ -1677,7 +1678,7 @@ apply_dcb_encoder_quirks(struct drm_device *dev, int idx, u32 *conn, u32 *conf)*/ if (nv_match_device (dev,0x0201 ,0x1462 ,0x8851 )) {if (*conn ==0xf2005014 && *conf ==0xffffffff ) { -fabricate_dcb_output (dcb,DCB_OUTPUT_TMDS ,1 ,1 ,1 ); +fabricate_dcb_output (dcb,DCB_OUTPUT_TMDS ,1 ,1 ,DCB_OUTPUT_B );return false; } }
@@ -1763,26 +1764,26 @@ fabricate_dcb_encoder_table(struct drm_device *dev, struct nvbios *bios)#ifdef __powerpc__/* Apple iMac G4 NV17 */ if (of_machine_is_compatible ("PowerMac4,5" )) { -fabricate_dcb_output (dcb,DCB_OUTPUT_TMDS ,0 , all_heads,1 ); -fabricate_dcb_output (dcb,DCB_OUTPUT_ANALOG ,1 , all_heads,2 ); +fabricate_dcb_output (dcb,DCB_OUTPUT_TMDS ,0 , all_heads,DCB_OUTPUT_B ); +fabricate_dcb_output (dcb,DCB_OUTPUT_ANALOG ,1 , all_heads,DCB_OUTPUT_C );return ; }#endif /* Make up some sane defaults */ fabricate_dcb_output (dcb,DCB_OUTPUT_ANALOG , - bios->legacy.i2c_indices.crt,1 ,1 ); + bios->legacy.i2c_indices.crt,1 ,DCB_OUTPUT_B );if (nv04_tv_identify (dev, bios->legacy.i2c_indices.tv) >=0 )fabricate_dcb_output (dcb,DCB_OUTPUT_TV , bios->legacy.i2c_indices.tv, - all_heads,0 ); + all_heads,DCB_OUTPUT_A );else if (bios->tmds.output0_script_ptr || bios->tmds.output1_script_ptr)fabricate_dcb_output (dcb,DCB_OUTPUT_TMDS , bios->legacy.i2c_indices.panel, - all_heads,1 ); + all_heads,DCB_OUTPUT_B ); } static int
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 65/158 drm/v3d: Dont increment `enabled_ns` twice
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maíra Canal <[email protected]>
[ Upstream commit 35f4f8c9fc972248055096d63b782060e473311b ]
The commit 509433d8146c ("drm/v3d: Expose the total GPU usage stats on sysfs") introduced the calculation of global GPU stats. For the regards, it used the already existing infrastructure provided by commit 09a93cc4f7d1 ("drm/v3d:
Implement show_fdinfo() callback for GPU usage stats"). While adding global GPU stats calculation ability, the author forgot to delete the existing one.
Currently, the value of enabled_ns is incremented twice by the end of the job, when it should be added just once. Therefore, delete the leftovers from commit 509433d8146c ("drm/v3d: Expose the total GPU usage stats on sysfs").
--- drivers/gpu/drm/v3d/v3d_irq.c | 4 ---- 1 file changed, 4 deletions(-)
drivers/gpu/drm/v3d/v3d_irq.c +0 -4
@@ -105,7 +105,6 @@ v3d_irq(int irq, void *arg)struct v3d_file_priv *file = v3d->bin_job->base.file->driver_priv;u64 runtime =local_clock () - file->start_ns[V3D_BIN ]; - file->enabled_ns[V3D_BIN ] +=local_clock () - file->start_ns[V3D_BIN ]; file->jobs_sent[V3D_BIN ]++; v3d->queue[V3D_BIN ].jobs_sent++;
@@ -126,7 +125,6 @@ v3d_irq(int irq, void *arg)struct v3d_file_priv *file = v3d->render_job->base.file->driver_priv;u64 runtime =local_clock () - file->start_ns[V3D_RENDER ]; - file->enabled_ns[V3D_RENDER ] +=local_clock () - file->start_ns[V3D_RENDER ]; file->jobs_sent[V3D_RENDER ]++; v3d->queue[V3D_RENDER ].jobs_sent++;
@@ -147,7 +145,6 @@ v3d_irq(int irq, void *arg)struct v3d_file_priv *file = v3d->csd_job->base.file->driver_priv;u64 runtime =local_clock () - file->start_ns[V3D_CSD ]; - file->enabled_ns[V3D_CSD ] +=local_clock () - file->start_ns[V3D_CSD ]; file->jobs_sent[V3D_CSD ]++; v3d->queue[V3D_CSD ].jobs_sent++;
@@ -195,7 +192,6 @@ v3d_hub_irq(int irq, void *arg)struct v3d_file_priv *file = v3d->tfu_job->base.file->driver_priv;u64 runtime =local_clock () - file->start_ns[V3D_TFU ]; - file->enabled_ns[V3D_TFU ] +=local_clock () - file->start_ns[V3D_TFU ]; file->jobs_sent[V3D_TFU ]++; v3d->queue[V3D_TFU ].jobs_sent++;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 66/158 userfaultfd: change src_folio after ensuring its unpinned in UFFDIO_MOVE
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lokesh Gidra <[email protected]>
commit c0205eaf3af9f5db14d4b5ee4abacf4a583c3c50 upstream.
Commit d7a08838ab74 ("mm: userfaultfd: fix unexpected change to src_folio when UFFDIO_MOVE fails") moved the src_folio->{mapping, index} changing to after clearing the page-table and ensuring that it's not pinned. This avoids failure of swapout+migration and possibly memory corruption.
However, the commit missed fixing it in the huge-page case.
--- mm/huge_memory.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
mm/huge_memory.c +3 -3
@@ -2244,9 +2244,6 @@ int move_pages_huge_pmd(struct mm_struct goto unlock_ptls; } -folio_move_anon_rmap (src_folio, dst_vma); -WRITE_ONCE (src_folio->index,linear_page_index (dst_vma, dst_addr)); - src_pmdval =pmdp_huge_clear_flush (src_vma, src_addr, src_pmd);/* Folio got pinned from under us. Put it back and fail the move. */ if (folio_maybe_dma_pinned (src_folio)) {
@@ -2255,6 +2252,9 @@ int move_pages_huge_pmd(struct mm_struct goto unlock_ptls; } +folio_move_anon_rmap (src_folio, dst_vma); +WRITE_ONCE (src_folio->index,linear_page_index (dst_vma, dst_addr)); + _dst_pmd =mk_huge_pmd (&src_folio->page, dst_vma->vm_page_prot);/* Follow mremap() behavior and treat the entry dirty after the move */ _dst_pmd =pmd_mkwrite (pmd_mkdirty (_dst_pmd), dst_vma);
Greg Kroah-Hartman
maintainerPATCH 67/158 thunderbolt: Introduce tb_port_reset()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanath S <[email protected]>
commit 01da6b99d49f60b1edead44e33569b1a2e9f49b7 upstream.
Introduce a function that issues Downstream Port Reset to a USB4 port. This supports Thunderbolt 2, 3 and USB4 routers.
--- drivers/thunderbolt/lc.c | 45 ++++++++++++++++++++++++++++++++++++++++++ drivers/thunderbolt/switch.c | 7 ++++++ drivers/thunderbolt/tb.h | 2 + drivers/thunderbolt/tb_regs.h | 4 +++ drivers/thunderbolt/usb4.c | 39 ++++++++++++++++++++++++++++++++++++ 5 files changed, 97 insertions(+)
drivers/thunderbolt/lc.c +45 -0
@@ -6,6 +6,8 @@* Author: Mika Westerberg <[email protected]> */ +#include <linux/delay.h> +#include "tb.h" /**
@@ -45,6 +47,49 @@ static int find_port_lc_cap(struct tb_poreturn sw->cap_lc + start + phys * size; } +/** +* tb_lc_reset_port() - Trigger downstream port reset through LC +* @port: Port that is reset +* +* Triggers downstream port reset through link controller registers. +* Returns %0 in case of success negative errno otherwise. Only supports +* non-USB4 routers with link controller (that's Thunderbolt 2 and +* Thunderbolt 3). +*/ +int tb_lc_reset_port (struct tb_port *port) +{ +struct tb_switch *sw = port->sw; +int cap, ret; +u32 mode; + +if (sw->generation <2 ) +return -EINVAL ; + + cap =find_port_lc_cap (port); +if (cap <0 ) +return cap; + + ret =tb_sw_read (sw, &mode,TB_CFG_SWITCH , cap +TB_LC_PORT_MODE ,1 ); +if (ret) +return ret; + + mode |=TB_LC_PORT_MODE_DPR ; + + ret =tb_sw_write (sw, &mode,TB_CFG_SWITCH , cap +TB_LC_PORT_MODE ,1 ); +if (ret) +return ret; + +fsleep (10000 ); + + ret =tb_sw_read (sw, &mode,TB_CFG_SWITCH , cap +TB_LC_PORT_MODE ,1 ); +if (ret) +return ret; + + mode &= ~TB_LC_PORT_MODE_DPR ; + +return tb_sw_write (sw, &mode,TB_CFG_SWITCH , cap +TB_LC_PORT_MODE ,1 ); +} +static int tb_lc_set_port_configured (struct tb_port *port,bool configured) {bool upstream =tb_is_upstream_port (port);
drivers/thunderbolt/switch.c +7 -0
@@ -676,6 +676,13 @@ int tb_port_disable(struct tb_port *portreturn __tb_port_enable (port, false); } +static int tb_port_reset (struct tb_port *port) +{ +if (tb_switch_is_usb4 (port->sw)) +return port->cap_usb4 ?usb4_port_reset (port) :0 ; +return tb_lc_reset_port (port); +} +/* * tb_init_port() - initialize a port *
drivers/thunderbolt/tb.h +2 -0
@@ -1173,6 +1173,7 @@ int tb_drom_read(struct tb_switch *sw);int tb_drom_read_uid_only (struct tb_switch *sw,u64 *uid);int tb_lc_read_uuid (struct tb_switch *sw,u32 *uuid); +int tb_lc_reset_port (struct tb_port *port);int tb_lc_configure_port (struct tb_port *port);void tb_lc_unconfigure_port (struct tb_port *port);int tb_lc_configure_xdomain (struct tb_port *port);
@@ -1305,6 +1306,7 @@ void usb4_switch_remove_ports(struct tb_int usb4_port_unlock (struct tb_port *port);int usb4_port_hotplug_enable (struct tb_port *port); +int usb4_port_reset (struct tb_port *port);int usb4_port_configure (struct tb_port *port);void usb4_port_unconfigure (struct tb_port *port);int usb4_port_configure_xdomain (struct tb_port *port,struct tb_xdomain *xd);
drivers/thunderbolt/tb_regs.h +4 -0
@@ -389,6 +389,7 @@ struct tb_regs_port_header {#define PORT_CS_18_CSA BIT(22)#define PORT_CS_18_TIP BIT(24)#define PORT_CS_19 0x13 +#define PORT_CS_19_DPR BIT(0)#define PORT_CS_19_PC BIT(3)#define PORT_CS_19_PID BIT(4)#define PORT_CS_19_WOC BIT(16)
@@ -584,6 +585,9 @@ struct tb_regs_hop {#define TB_LC_POWER 0x740/* Link controller registers */ +#define TB_LC_PORT_MODE 0x26 +#define TB_LC_PORT_MODE_DPR BIT(0) +#define TB_LC_CS_42 0x2a#define TB_LC_CS_42_USB_PLUGGED BIT(31)
drivers/thunderbolt/usb4.c +39 -0
@@ -1113,6 +1113,45 @@ int usb4_port_hotplug_enable(struct tb_preturn tb_port_write (port, &val,TB_CFG_PORT ,ADP_CS_5 ,1 ); } +/** +* usb4_port_reset() - Issue downstream port reset +* @port: USB4 port to reset +* +* Issues downstream port reset to @port. +*/ +int usb4_port_reset (struct tb_port *port) +{ +int ret; +u32 val; + +if (!port->cap_usb4) +return -EINVAL ; + + ret =tb_port_read (port, &val,TB_CFG_PORT , + port->cap_usb4 +PORT_CS_19 ,1 ); +if (ret) +return ret; + + val |=PORT_CS_19_DPR ; + + ret =tb_port_write (port, &val,TB_CFG_PORT , + port->cap_usb4 +PORT_CS_19 ,1 ); +if (ret) +return ret; + +fsleep (10000 ); + + ret =tb_port_read (port, &val,TB_CFG_PORT , + port->cap_usb4 +PORT_CS_19 ,1 ); +if (ret) +return ret; + + val &= ~PORT_CS_19_DPR ; + +return tb_port_write (port, &val,TB_CFG_PORT , + port->cap_usb4 +PORT_CS_19 ,1 ); +} +static int usb4_port_set_configured (struct tb_port *port,bool configured) {int ret;
Greg Kroah-Hartman
maintainerPATCH 68/158 thunderbolt: Introduce tb_path_deactivate_hop()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanath S <[email protected]>
commit b35c1d7b11da8c08b14147bbe87c2c92f7a83f8b upstream.
This function can be used to clear path config space of an adapter. Make it available for other files in this driver.
--- drivers/thunderbolt/path.c | 13 +++++++++++++ drivers/thunderbolt/tb.h | 1 + 2 files changed, 14 insertions(+)
drivers/thunderbolt/path.c +13 -0
@@ -446,6 +446,19 @@ static int __tb_path_deactivate_hop(strureturn -ETIMEDOUT ; } +/** +* tb_path_deactivate_hop() - Deactivate one path in path config space +* @port: Lane or protocol adapter +* @hop_index: HopID of the path to be cleared +* +* This deactivates or clears a single path config space entry at +* @hop_index. Returns %0 in success and negative errno otherwise. +*/ +int tb_path_deactivate_hop (struct tb_port *port,int hop_index) +{ +return __tb_path_deactivate_hop (port, hop_index, true); +} +static void __tb_path_deactivate_hops (struct tb_path *path,int first_hop) {int i, res;
drivers/thunderbolt/tb.h +1 -0
@@ -1154,6 +1154,7 @@ struct tb_path *tb_path_alloc(struct tbvoid tb_path_free (struct tb_path *path);int tb_path_activate (struct tb_path *path);void tb_path_deactivate (struct tb_path *path); +int tb_path_deactivate_hop (struct tb_port *port,int hop_index);bool tb_path_is_invalid (struct tb_path *path);bool tb_path_port_on_path (const struct tb_path *path,const struct tb_port *port);
Greg Kroah-Hartman
maintainerPATCH 69/158 thunderbolt: Make tb_switch_reset() support Thunderbolt 2, 3 and USB4 routers
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanath S <[email protected]>
commit ec8162b3f0683ae08a21f20517cf49272b07ee0b upstream.
Currently tb_switch_reset() only did something for Thunderbolt 1 devices. Expand this to support all generations, including USB4, and both host and device routers.
--- drivers/thunderbolt/switch.c | 123 +++++++++++++++++++++++++++++++++++++----- drivers/thunderbolt/tb_regs.h | 2 2 files changed, 111 insertions(+), 14 deletions(-)
drivers/thunderbolt/switch.c +109 -14
@@ -1541,29 +1541,124 @@ static void tb_dump_switch(const struct regs->__unknown1, regs->__unknown4); } +static int tb_switch_reset_host (struct tb_switch *sw) +{ +if (sw->generation >1 ) { +struct tb_port *port; + +tb_switch_for_each_port (sw, port) { +int i, ret; + +/* +* For lane adapters we issue downstream port +* reset and clear up path config spaces. +* +* For protocol adapters we disable the path and +* clear path config space one by one (from 8 to +* Max Input HopID of the adapter). +*/ +if (tb_port_is_null (port) && !tb_is_upstream_port (port)) { + ret =tb_port_reset (port); +if (ret) +return ret; + }else if (tb_port_is_usb3_down (port) || +tb_port_is_usb3_up (port)) { +tb_usb3_port_enable (port, false); + }else if (tb_port_is_dpin (port) || +tb_port_is_dpout (port)) { +tb_dp_port_enable (port, false); + }else if (tb_port_is_pcie_down (port) || +tb_port_is_pcie_up (port)) { +tb_pci_port_enable (port, false); + }else { +continue ; + } + +/* Cleanup path config space of protocol adapter */ +for (i =TB_PATH_MIN_HOPID ; + i <= port->config.max_in_hop_id; i++) { + ret =tb_path_deactivate_hop (port, i); +if (ret) +return ret; + } + } + }else { +struct tb_cfg_result res; + +/* Thunderbolt 1 uses the "reset" config space packet */ + res.err =tb_sw_write (sw, ((u32 *) &sw->config) +2 , +TB_CFG_SWITCH ,2 ,2 ); +if (res.err) +return res.err; + res =tb_cfg_reset (sw->tb->ctl,tb_route (sw)); +if (res.err >0 ) +return -EIO ; +else if (res.err <0 ) +return res.err; + } + +return 0 ; +} + +static int tb_switch_reset_device (struct tb_switch *sw) +{ +return tb_port_reset (tb_switch_downstream_port (sw)); +} + +static bool tb_switch_enumerated (struct tb_switch *sw) +{ +u32 val; +int ret; + +/* +* Read directly from the hardware because we use this also +* during system sleep where sw->config.enabled is already set +* by us. +*/ + ret =tb_sw_read (sw, &val,TB_CFG_SWITCH ,ROUTER_CS_3 ,1 ); +if (ret) +return false; + +return !!(val &ROUTER_CS_3_V ); +} +/** -* tb_switch_reset() - reconfigure route, enable and send TB_CFG_PKG_RESET -* @sw: Switch to reset +* tb_switch_reset() - Perform reset to the router +* @sw: Router to reset +* +* Issues reset to the router @sw. Can be used for any router. For host +* routers, resets all the downstream ports and cleans up path config +* spaces accordingly. For device routers issues downstream port reset +* through the parent router, so as side effect there will be unplug +* soon after this is finished. +* +* If the router is not enumerated does nothing. * -* Return: Returns 0 on success or an error code on failure. +* Returns %0 on success or negative errno in case of failure. */ int tb_switch_reset (struct tb_switch *sw) { -struct tb_cfg_result res; +int ret; -if (sw->generation >1 ) +/* +* We cannot access the port config spaces unless the router is +* already enumerated. If the router is not enumerated it is +* equal to being reset so we can skip that here. +*/ +if (!tb_switch_enumerated (sw))return 0 ; -tb_sw_dbg (sw,"resetting switch\n" ); +tb_sw_dbg (sw,"resetting\n" ); + +if (tb_route (sw)) + ret =tb_switch_reset_device (sw); +else + ret =tb_switch_reset_host (sw); + +if (ret) +tb_sw_warn (sw,"failed to reset\n" ); - res.err =tb_sw_write (sw, ((u32 *) &sw->config) +2 , -TB_CFG_SWITCH ,2 ,2 ); -if (res.err) -return res.err; - res =tb_cfg_reset (sw->tb->ctl,tb_route (sw)); -if (res.err >0 ) -return -EIO ; -return res.err; +return ret; }/**
drivers/thunderbolt/tb_regs.h +2 -0
@@ -194,6 +194,8 @@ struct tb_regs_switch_header {#define USB4_VERSION_MAJOR_MASK GENMASK(7, 5)#define ROUTER_CS_1 0x01 +#define ROUTER_CS_3 0x03 +#define ROUTER_CS_3_V BIT(31)#define ROUTER_CS_4 0x04/* Used with the router cmuv field */ #define ROUTER_CS_4_CMUV_V1 0x10
Greg Kroah-Hartman
maintainerPATCH 70/158 thunderbolt: Reset topology created by the boot firmware
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanath S <[email protected]>
commit 59a54c5f3dbde00b8ad30aef27fe35b1fe07bf5c upstream.
Boot firmware (typically BIOS) might have created tunnels of its own. The tunnel configuration that it does might be sub-optimal. For instance it may only support HBR2 monitors so the DisplayPort tunnels it created may limit Linux graphics drivers. In addition there is an issue on some AMD based systems where the BIOS does not allocate enough PCIe resources for future topology extension. By resetting the USB4 topology the PCIe links will be reset as well allowing Linux to re-allocate.
This aligns the behavior with Windows Connection Manager.
We already issued host router reset for USB4 v2 routers, now extend it to USB4 v1 routers as well. For pre-USB4 (that's Apple systems) we leave it as is and continue to discover the existing tunnels.
--- drivers/thunderbolt/domain.c | 5 +++-- drivers/thunderbolt/icm.c | 2 +- drivers/thunderbolt/nhi.c | 19 +++++++++++++------ drivers/thunderbolt/tb.c | 26 +++++++++++++++++++------- drivers/thunderbolt/tb.h | 4 ++-- 5 files changed, 38 insertions(+), 18 deletions(-)
drivers/thunderbolt/domain.c +3 -2
@@ -423,6 +423,7 @@ err_free:/** * tb_domain_add() - Add domain to the system * @tb: Domain to add +* @reset: Issue reset to the host router * * Starts the domain and adds it to the system. Hotplugging devices will * work after this has been returned successfully. In order to remove
@@ -431,7 +432,7 @@ err_free:* * Return: %0 in case of success and negative errno in case of error */ -int tb_domain_add (struct tb *tb) +int tb_domain_add (struct tb *tb,bool reset) {int ret;
@@ -460,7 +461,7 @@ int tb_domain_add(struct tb *tb)/* Start the domain */ if (tb->cm_ops->start) { - ret = tb->cm_ops->start (tb); + ret = tb->cm_ops->start (tb, reset);if (ret) goto err_domain_del; }
drivers/thunderbolt/icm.c +1 -1
@@ -2144,7 +2144,7 @@ static int icm_runtime_resume(struct tbreturn 0 ; } -static int icm_start (struct tb *tb) +static int icm_start (struct tb *tb,bool not_used) {struct icm *icm =tb_priv (tb);int ret;
drivers/thunderbolt/nhi.c +13 -6
@@ -1221,7 +1221,7 @@ static void nhi_check_iommu(struct tb_nh str_enabled_disabled(port_ok)); } -static void nhi_reset (struct tb_nhi *nhi) +static bool nhi_reset (struct tb_nhi *nhi) {ktime_t timeout;u32 val;
@@ -1229,11 +1229,11 @@ static void nhi_reset(struct tb_nhi *nhi val =ioread32 (nhi->iobase +REG_CAPS );/* Reset only v2 and later routers */ if (FIELD_GET (REG_CAPS_VERSION_MASK , val) <REG_CAPS_VERSION_2 ) -return ; +return false;if (!host_reset) {dev_dbg (&nhi->pdev->dev,"skipping host router reset\n" ); -return ; +return false; }iowrite32 (REG_RESET_HRR , nhi->iobase +REG_RESET );
@@ -1244,12 +1244,14 @@ static void nhi_reset(struct tb_nhi *nhi val =ioread32 (nhi->iobase +REG_RESET );if (!(val ®_RESET_HRR )) {dev_warn (&nhi->pdev->dev,"host router reset successful\n" ); -return ; +return true; }usleep_range (10 ,20 ); }while (ktime_before (ktime_get (), timeout));dev_warn (&nhi->pdev->dev,"timeout resetting host router\n" ); + +return false; }static int nhi_init_msi (struct tb_nhi *nhi)
@@ -1331,6 +1333,7 @@ static int nhi_probe(struct pci_dev *pdestruct device *dev = &pdev->dev;struct tb_nhi *nhi;struct tb *tb; +bool reset;int res;if (!nhi_imr_valid (pdev))
@@ -1365,7 +1368,11 @@ static int nhi_probe(struct pci_dev *pdenhi_check_quirks (nhi);nhi_check_iommu (nhi); -nhi_reset (nhi); +/* +* Only USB4 v2 hosts support host reset so if we already did +* that then don't do it again when the domain is initialized. +*/ + reset =nhi_reset (nhi) ? false : host_reset; res =nhi_init_msi (nhi);if (res)
@@ -1392,7 +1399,7 @@ static int nhi_probe(struct pci_dev *pdedev_dbg (dev,"NHI initialized, starting thunderbolt\n" ); - res =tb_domain_add (tb); + res =tb_domain_add (tb, reset);if (res) {/* * At this point the RX/TX rings might already have been
drivers/thunderbolt/tb.c +19 -7
@@ -2628,7 +2628,7 @@ static int tb_scan_finalize_switch(strucreturn 0 ; } -static int tb_start (struct tb *tb) +static int tb_start (struct tb *tb,bool reset) {struct tb_cm *tcm =tb_priv (tb);int ret;
@@ -2669,12 +2669,24 @@ static int tb_start(struct tb *tb)tb_switch_tmu_configure (tb->root_switch,TB_SWITCH_TMU_MODE_LOWRES );/* Enable TMU if it is off */ tb_switch_tmu_enable (tb->root_switch); -/* Full scan to discover devices added before the driver was loaded. */ -tb_scan_switch (tb->root_switch); -/* Find out tunnels created by the boot firmware */ -tb_discover_tunnels (tb); -/* Add DP resources from the DP tunnels created by the boot firmware */ -tb_discover_dp_resources (tb); + +/* +* Boot firmware might have created tunnels of its own. Since we +* cannot be sure they are usable for us, tear them down and +* reset the ports to handle it as new hotplug for USB4 v1 +* routers (for USB4 v2 and beyond we already do host reset). +*/ +if (reset &&usb4_switch_version (tb->root_switch) ==1 ) { +tb_switch_reset (tb->root_switch); + }else { +/* Full scan to discover devices added before the driver was loaded. */ +tb_scan_switch (tb->root_switch); +/* Find out tunnels created by the boot firmware */ +tb_discover_tunnels (tb); +/* Add DP resources from the DP tunnels created by the boot firmware */ +tb_discover_dp_resources (tb); + } +/* * If the boot firmware did not create USB 3.x tunnels create them * now for the whole topology.
drivers/thunderbolt/tb.h +2 -2
@@ -487,7 +487,7 @@ struct tb_path {*/ struct tb_cm_ops {int (*driver_ready)(struct tb *tb); -int (*start)(struct tb *tb); +int (*start)(struct tb *tb,bool reset);void (*stop)(struct tb *tb);int (*suspend_noirq)(struct tb *tb);int (*resume_noirq)(struct tb *tb);
@@ -750,7 +750,7 @@ int tb_xdomain_init(void);void tb_xdomain_exit (void );struct tb *tb_domain_alloc (struct tb_nhi *nhi,int timeout_msec,size_t privsize); -int tb_domain_add (struct tb *tb); +int tb_domain_add (struct tb *tb,bool reset);void tb_domain_remove (struct tb *tb);int tb_domain_suspend_noirq (struct tb *tb);int tb_domain_resume_noirq (struct tb *tb);
Greg Kroah-Hartman
maintainerPATCH 71/158 drm/panel: visionox-rm69299: dont unregister DSI device
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 9e4d3f4f34455abbaa9930bf6b7575a5cd081496 ]
The DSI device for the panel was registered by the DSI host, so it is an error to unregister it from the panel driver. Drop the call to mipi_dsi_device_unregister().
--- drivers/gpu/drm/panel/panel-visionox-rm69299.c | 2 -- 1 file changed, 2 deletions(-)
drivers/gpu/drm/panel/panel-visionox-rm69299.c +0 -2
@@ -253,8 +253,6 @@ static void visionox_rm69299_remove(struct mipi_dsi_device *dsi)struct visionox_rm69299 *ctx =mipi_dsi_get_drvdata (dsi);mipi_dsi_detach (ctx->dsi); -mipi_dsi_device_unregister (ctx->dsi); -drm_panel_remove (&ctx->panel); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 72/158 drm/radeon: make -fstrict-flex-arrays=3 happy
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit 0ba753bc7e79e49556e81b0d09b2de1aa558553b ]
The driver parses a union where the layout up through the first array is the same, however, the array has different sizes depending on the elements in the union. Be explicit to fix the UBSAN checker.
--- drivers/gpu/drm/radeon/radeon_atombios.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/gpu/drm/radeon/radeon_atombios.c +6 -2
@@ -923,8 +923,12 @@ bool radeon_get_atom_connector_info_from_supported_devices_table(struct max_device =ATOM_MAX_SUPPORTED_DEVICE_INFO ;for (i =0 ; i < max_device; i++) { -ATOM_CONNECTOR_INFO_I2C ci = - supported_devices->info.asConnInfo[i]; +ATOM_CONNECTOR_INFO_I2C ci; + +if (frev >1 ) + ci = supported_devices->info_2d1.asConnInfo[i]; +else + ci = supported_devices->info.asConnInfo[i]; bios_connectors[i].valid = false;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 73/158 ALSA: hda/realtek: Fix volumn control of ThinkBook 16P Gen4
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huayu Zhang <[email protected]>
[ Upstream commit dca5f4dfa925b51becee65031869e917e6229620 ]
change HDA & AMP configuration from ALC287_FIXUP_CS35L41_I2C_2 to ALC287_FIXUP_MG_RTKC_CSAMP_CS35L41_I2C_THINKPAD for ThinkBook 16P Gen4 models to fix volumn control issue (cannot fully mute).
Message-ID: <[email protected]>
--- sound/pci/hda/patch_realtek.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/pci/hda/patch_realtek.c +2 -2
@@ -10381,8 +10381,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x17aa ,0x3886 ,"Y780 VECO DUAL" ,ALC287_FIXUP_TAS2781_I2C ),SND_PCI_QUIRK (0x17aa ,0x38a7 ,"Y780P AMD YG dual" ,ALC287_FIXUP_TAS2781_I2C ),SND_PCI_QUIRK (0x17aa ,0x38a8 ,"Y780P AMD VECO dual" ,ALC287_FIXUP_TAS2781_I2C ), -SND_PCI_QUIRK (0x17aa ,0x38a9 ,"Thinkbook 16P" ,ALC287_FIXUP_CS35L41_I2C_2 ), -SND_PCI_QUIRK (0x17aa ,0x38ab ,"Thinkbook 16P" ,ALC287_FIXUP_CS35L41_I2C_2 ), +SND_PCI_QUIRK (0x17aa ,0x38a9 ,"Thinkbook 16P" ,ALC287_FIXUP_MG_RTKC_CSAMP_CS35L41_I2C_THINKPAD ), +SND_PCI_QUIRK (0x17aa ,0x38ab ,"Thinkbook 16P" ,ALC287_FIXUP_MG_RTKC_CSAMP_CS35L41_I2C_THINKPAD ),SND_PCI_QUIRK (0x17aa ,0x38b4 ,"Legion Slim 7 16IRH8" ,ALC287_FIXUP_CS35L41_I2C_2 ),SND_PCI_QUIRK (0x17aa ,0x38b5 ,"Legion Slim 7 16IRH8" ,ALC287_FIXUP_CS35L41_I2C_2 ), SND_PCI_QUIRK(0x17aa, 0x38b6, "Legion Slim 7 16APH8", ALC287_FIXUP_CS35L41_I2C_2),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 74/158 thermal/debugfs: Add missing count increment to thermal_debug_tz_trip_up()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit b552f63cd43735048bbe9bfbb7a9dcfce166fbdd ]
The count field in struct trip_stats, representing the number of times the zone temperature was above the trip point, needs to be incremented in thermal_debug_tz_trip_up(), for two reasons.
First, if a trip point is crossed on the way up for the first time, thermal_debug_update_temp() called from update_temperature() does not see it because it has not been added to trips_crossed[] array in the thermal zone's struct tz_debugfs object yet. Therefore, when thermal_debug_tz_trip_up() is called after that, the trip point's count value is 0, and the attempt to divide by it during the average temperature computation leads to a divide error which causes the kernel to crash. Setting the count to 1 before the division by incrementing it fixes this problem.
Second, if a trip point is crossed on the way up, but it has been crossed on the way up already before, its count value needs to be incremented to make a record of the fact that the zone temperature is above the trip now. Without doing that, if the mitigations applied after crossing the trip cause the zone temperature to drop below its threshold, the count will not be updated for this episode at all and the average temperature in the trip statistics record will be somewhat higher than it should be.
--- drivers/thermal/thermal_debugfs.c | 1 + 1 file changed, 1 insertion(+)
drivers/thermal/thermal_debugfs.c +1 -0
@@ -616,6 +616,7 @@ void thermal_debug_tz_trip_up(struct thermal_zone_device *tz, tze->trip_stats[trip_id].timestamp = now; tze->trip_stats[trip_id].max =max (tze->trip_stats[trip_id].max, temperature); tze->trip_stats[trip_id].min =min (tze->trip_stats[trip_id].min, temperature); + tze->trip_stats[trip_id].count++; tze->trip_stats[trip_id].avg = tze->trip_stats[trip_id].avg + (temperature - tze->trip_stats[trip_id].avg) / tze->trip_stats[trip_id].count;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 75/158 platform/x86/amd/pmc: Extend Framework 13 quirk to more BIOSes
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
[ Upstream commit f609e7b1b49e4d15cf107d2069673ee63860c398 ]
BIOS 03.05 still hasn't fixed the spurious IRQ1 issue. As it's still being worked on there is still a possibility that it won't need to apply to future BIOS releases.
Add a quirk for BIOS 03.05 as well.
--- drivers/platform/x86/amd/pmc/pmc-quirks.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/platform/x86/amd/pmc/pmc-quirks.c +9 -0
@@ -208,6 +208,15 @@ static const struct dmi_system_id fwbug_list[] = { DMI_MATCH(DMI_BIOS_VERSION, "03.03"), } }, + { + .ident = "Framework Laptop 13 (Phoenix)", + .driver_data = &quirk_spurious_8042, + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Framework"), + DMI_MATCH(DMI_PRODUCT_NAME, "Laptop 13 (AMD Ryzen 7040Series)"), + DMI_MATCH(DMI_BIOS_VERSION, "03.05"), + } + }, {} };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 76/158 interconnect: qcom: x1e80100: Remove inexistent ACV_PERF BCM
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit 59097a2a5ecadb0f025232c665fd11c8ae1e1f58 ]
Booting the kernel on X1E results in a message like:
[ 2.561524] qnoc-x1e80100 interconnect-0: ACV_PERF could not find RPMh address
And indeed, taking a look at cmd-db, no such BCM exists. Remove it.
--- drivers/interconnect/qcom/x1e80100.c | 26 -------------------------- 1 file changed, 26 deletions(-)
drivers/interconnect/qcom/x1e80100.c +0 -26
@@ -116,15 +116,6 @@ static struct qcom_icc_node xm_sdc2 = { .links = { X1E80100_SLAVE_A2NOC_SNOC }, }; -static struct qcom_icc_node ddr_perf_mode_master = { - .name ="ddr_perf_mode_master" , - .id =X1E80100_MASTER_DDR_PERF_MODE , - .channels =1 , - .buswidth =4 , - .num_links =1 , - .links = {X1E80100_SLAVE_DDR_PERF_MODE }, -}; -static struct qcom_icc_node qup0_core_master = { .name ="qup0_core_master" , .id = X1E80100_MASTER_QUP_CORE_0,
@@ -832,14 +823,6 @@ static struct qcom_icc_node qns_a2noc_snoc = { .links = { X1E80100_MASTER_A2NOC_SNOC }, }; -static struct qcom_icc_node ddr_perf_mode_slave = { - .name ="ddr_perf_mode_slave" , - .id =X1E80100_SLAVE_DDR_PERF_MODE , - .channels =1 , - .buswidth =4 , - .num_links =0 , -}; -static struct qcom_icc_node qup0_core_slave = { .name ="qup0_core_slave" , .id = X1E80100_SLAVE_QUP_CORE_0,
@@ -1591,12 +1574,6 @@ static struct qcom_icc_bcm bcm_acv = { .nodes = { &ebi }, }; -static struct qcom_icc_bcm bcm_acv_perf = { - .name ="ACV_PERF" , - .num_nodes =1 , - .nodes = { &ddr_perf_mode_slave }, -}; -static struct qcom_icc_bcm bcm_ce0 = { .name ="CE0" , .num_nodes = 1,
@@ -1863,18 +1840,15 @@ static const struct qcom_icc_desc x1e80100_aggre2_noc = { };static struct qcom_icc_bcm *const clk_virt_bcms[] = { - &bcm_acv_perf, &bcm_qup0, &bcm_qup1, &bcm_qup2, };static struct qcom_icc_node *const clk_virt_nodes[] = { - [MASTER_DDR_PERF_MODE ] = &ddr_perf_mode_master, [MASTER_QUP_CORE_0 ] = &qup0_core_master, [MASTER_QUP_CORE_1 ] = &qup1_core_master, [MASTER_QUP_CORE_2 ] = &qup2_core_master, - [SLAVE_DDR_PERF_MODE ] = &ddr_perf_mode_slave, [SLAVE_QUP_CORE_0 ] = &qup0_core_slave, [SLAVE_QUP_CORE_1 ] = &qup1_core_slave, [SLAVE_QUP_CORE_2 ] = &qup2_core_slave,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 77/158 interconnect: Dont access req_list while its being manipulated
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Tipton <[email protected]>
[ Upstream commit de1bf25b6d771abdb52d43546cf57ad775fb68a1 ]
The icc_lock mutex was split into separate icc_lock and icc_bw_lock mutexes in [1] to avoid lockdep splats. However, this didn't adequately protect access to icc_node::req_list.
The icc_set_bw() function will eventually iterate over req_list while only holding icc_bw_lock, but req_list can be modified while only holding icc_lock. This causes races between icc_set_bw(), of_icc_get(), and icc_put().
Example A:
CPU0 CPU1
---- ----
icc_set_bw(path_a)
mutex_lock(&icc_bw_lock);
icc_put(path_b)
mutex_lock(&icc_lock);
aggregate_requests()
hlist_for_each_entry(r, ...
hlist_del(...
<r = invalid pointer>Example B:
CPU0 CPU1
---- ----
icc_set_bw(path_a)
mutex_lock(&icc_bw_lock);
path_b = of_icc_get()
of_icc_get_by_index()
mutex_lock(&icc_lock);
path_find()
path_init()
aggregate_requests()
hlist_for_each_entry(r, ...
hlist_add_head(...
<r = invalid pointer>Fix this by ensuring icc_bw_lock is always held before manipulating icc_node::req_list. The additional places icc_bw_lock is held don't perform any memory allocations, so we should still be safe from the original lockdep splats that motivated the separate locks.
[1] commit af42269c3523 ("interconnect: Fix locking for runpm vs reclaim")
--- drivers/interconnect/core.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/interconnect/core.c +8 -0
@@ -176,6 +176,8 @@ static struct icc_path *path_init(struct device *dev, struct icc_node *dst, path->num_nodes = num_nodes; +mutex_lock (&icc_bw_lock); +for (i = num_nodes -1 ; i >=0 ; i--) { node->provider->users++;hlist_add_head (&path->reqs[i].req_node, &node->req_list);
@@ -186,6 +188,8 @@ static struct icc_path *path_init(struct device *dev, struct icc_node *dst, node = node->reverse; } +mutex_unlock (&icc_bw_lock); +return path; }
@@ -792,12 +796,16 @@ void icc_put(struct icc_path *path)pr_err ("%s: error (%d)\n" , __func__, ret);mutex_lock (&icc_lock); +mutex_lock (&icc_bw_lock); +for (i =0 ; i < path->num_nodes; i++) { node = path->reqs[i].node;hlist_del (&path->reqs[i].req_node);if (!WARN_ON (!node->provider->users)) node->provider->users--; } + +mutex_unlock (&icc_bw_lock);mutex_unlock (&icc_lock);kfree_const (path->name);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 78/158 clk: Remove prepare_lock hold assertion in __clk_release()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Boyd <[email protected]>
[ Upstream commit 8358a76cfb47c9a5af627a0c4e7168aa14fa25f6 ]
Removing this assertion lets us move the kref_put() call outside the prepare_lock section. We don't need to hold the prepare_lock here to free memory and destroy the clk_core structure. We've already unlinked the clk from the clk tree and by the time the release function runs nothing holds a reference to the clk_core anymore so anything with the pointer can't access the memory that's being freed anyway. Way back in commit 496eadf821c2 ("clk: Use lockdep asserts to find missing hold of prepare_lock") we didn't need to have this assertion either.
--- drivers/clk/clk.c | 2 -- 1 file changed, 2 deletions(-)
drivers/clk/clk.c +0 -2
@@ -4356,8 +4356,6 @@ static void __clk_release(struct kref *ref) { struct clk_core *core = container_of(ref, struct clk_core, ref); -lockdep_assert_held (&prepare_lock); -clk_core_free_parent_map (core);kfree_const (core->name);kfree (core);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 79/158 clk: Initialize struct clk_core kref earlier
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Boyd <[email protected]>
[ Upstream commit 9d05ae531c2cff20d5d527f04e28d28e04379929 ]
Initialize this kref once we allocate memory for the struct clk_core so that we can reuse the release function to free any memory associated with the structure. This mostly consolidates code, but also clarifies that the kref lifetime exists once the container structure (struct clk_core) is allocated instead of leaving it in a half-baked state for most of __clk_core_init().
Stable-dep-of: e581cf5d2162 ("clk: Get runtime PM before walking tree during disable_unused")
--- drivers/clk/clk.c | 28 +++++++++++++--------------- 1 file changed, 13 insertions(+), 15 deletions(-)
drivers/clk/clk.c +13 -15
@@ -3962,8 +3962,6 @@ static int __clk_core_init(struct clk_core *core) }clk_core_reparent_orphans_nolock (); - -kref_init (&core->ref); out:clk_pm_runtime_put (core); unlock:
@@ -4192,6 +4190,16 @@ static void clk_core_free_parent_map(struct clk_core *core)kfree (core->parents); } +/* Free memory allocated for a struct clk_core */ +static void __clk_release (struct kref *ref) +{ + struct clk_core *core = container_of(ref, struct clk_core, ref); + +clk_core_free_parent_map (core); +kfree_const (core->name); +kfree (core); +} +static struct clk *__clk_register (struct device *dev,struct device_node *np,struct clk_hw *hw) {
@@ -4212,6 +4220,8 @@ __clk_register(struct device *dev, struct device_node *np, struct clk_hw *hw) goto fail_out; } +kref_init (&core->ref); + core->name =kstrdup_const (init->name,GFP_KERNEL );if (!core->name) { ret = -ENOMEM ;
@@ -4266,12 +4276,10 @@ __clk_register(struct device *dev, struct device_node *np, struct clk_hw *hw) hw->clk =NULL ; fail_create_clk: -clk_core_free_parent_map (core); fail_parents: fail_ops: -kfree_const (core->name); fail_name: -kfree (core); +kref_put (&core->ref, __clk_release); fail_out:return ERR_PTR (ret); }
@@ -4351,16 +4359,6 @@ int of_clk_hw_register(struct device_node *node, struct clk_hw *hw) }EXPORT_SYMBOL_GPL (of_clk_hw_register); -/* Free memory allocated for a clock. */ -static void __clk_release (struct kref *ref) -{ - struct clk_core *core = container_of(ref, struct clk_core, ref); - -clk_core_free_parent_map (core); -kfree_const (core->name); -kfree (core); -} -/* * Empty clk_ops for unregistered clocks. These are used temporarily * after clk_unregister() was called on a clock and until last clock
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 80/158 clk: Get runtime PM before walking tree during disable_unused
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Boyd <[email protected]>
[ Upstream commit e581cf5d216289ef292d1a4036d53ce90e122469 ]
Doug reported [1] the following hung task:
INFO: task swapper/0:1 blocked for more than 122 seconds.
Not tainted 5.15.149-21875-gf795ebc40eb8 #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:swapper/0 state:D stack: 0 pid: 1 ppid: 0 flags:0x00000008
Call trace:
__switch_to+0xf4/0x1f4
__schedule+0x418/0xb80
schedule+0x5c/0x10c
rpm_resume+0xe0/0x52c
rpm_resume+0x178/0x52c
__pm_runtime_resume+0x58/0x98
clk_pm_runtime_get+0x30/0xb0
clk_disable_unused_subtree+0x58/0x208
clk_disable_unused_subtree+0x38/0x208
clk_disable_unused_subtree+0x38/0x208
clk_disable_unused_subtree+0x38/0x208
clk_disable_unused_subtree+0x38/0x208
clk_disable_unused+0x4c/0xe4
do_one_initcall+0xcc/0x2d8
do_initcall_level+0xa4/0x148
do_initcalls+0x5c/0x9c
do_basic_setup+0x24/0x30
kernel_init_freeable+0xec/0x164
kernel_init+0x28/0x120
ret_from_fork+0x10/0x20
INFO: task kworker/u16:0:9 blocked for more than 122 seconds.
Not tainted 5.15.149-21875-gf795ebc40eb8 #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u16:0 state:D stack: 0 pid: 9 ppid: 2 flags:0x00000008
Workqueue: events_unbound deferred_probe_work_func
Call trace:
__switch_to+0xf4/0x1f4
__schedule+0x418/0xb80
schedule+0x5c/0x10c
schedule_preempt_disabled+0x2c/0x48
__mutex_lock+0x238/0x488
__mutex_lock_slowpath+0x1c/0x28
mutex_lock+0x50/0x74
clk_prepare_lock+0x7c/0x9c
clk_core_prepare_lock+0x20/0x44
clk_prepare+0x24/0x30
clk_bulk_prepare+0x40/0xb0
mdss_runtime_resume+0x54/0x1c8
pm_generic_runtime_resume+0x30/0x44
__genpd_runtime_resume+0x68/0x7c
genpd_runtime_resume+0x108/0x1f4
__rpm_callback+0x84/0x144
rpm_callback+0x30/0x88
rpm_resume+0x1f4/0x52c
rpm_resume+0x178/0x52c
__pm_runtime_resume+0x58/0x98
__device_attach+0xe0/0x170
device_initial_probe+0x1c/0x28
bus_probe_device+0x3c/0x9c
device_add+0x644/0x814
mipi_dsi_device_register_full+0xe4/0x170
devm_mipi_dsi_device_register_full+0x28/0x70
ti_sn_bridge_probe+0x1dc/0x2c0
auxiliary_bus_probe+0x4c/0x94
really_probe+0xcc/0x2c8
__driver_probe_device+0xa8/0x130
driver_probe_device+0x48/0x110
__device_attach_driver+0xa4/0xcc
bus_for_each_drv+0x8c/0xd8
__device_attach+0xf8/0x170
device_initial_probe+0x1c/0x28
bus_probe_device+0x3c/0x9c
deferred_probe_work_func+0x9c/0xd8
process_one_work+0x148/0x518
worker_thread+0x138/0x350
kthread+0x138/0x1e0
ret_from_fork+0x10/0x20The first thread is walking the clk tree and calling clk_pm_runtime_get() to power on devices required to read the clk hardware via struct clk_ops::is_enabled(). This thread holds the clk prepare_lock, and is trying to runtime PM resume a device, when it finds that the device is in the process of resuming so the thread schedule()s away waiting for the device to finish resuming before continuing. The second thread is runtime PM resuming the same device, but the runtime resume callback is calling clk_prepare(), trying to grab the prepare_lock waiting on the first thread.
This is a classic ABBA deadlock. To properly fix the deadlock, we must never runtime PM resume or suspend a device with the clk prepare_lock held. Actually doing that is near impossible today because the global prepare_lock would have to be dropped in the middle of the tree, the device runtime PM resumed/suspended, and then the prepare_lock grabbed again to ensure consistency of the clk tree topology. If anything changes with the clk tree in the meantime, we've lost and will need to start the operation all over again.
Luckily, most of the time we're simply incrementing or decrementing the runtime PM count on an active device, so we don't have the chance to schedule away with the prepare_lock held. Let's fix this immediate problem that can be triggered more easily by simply booting on Qualcomm sc7180.
Introduce a list of clk_core structures that have been registered, or are in the process of being registered, that require runtime PM to operate. Iterate this list and call clk_pm_runtime_get() on each of them without holding the prepare_lock during clk_disable_unused(). This way we can be certain that the runtime PM state of the devices will be active and resumed so we can't schedule away while walking the clk tree with the prepare_lock held. Similarly, call clk_pm_runtime_put() without the prepare_lock held to properly drop the runtime PM reference. We remove the calls to clk_pm_runtime_{get,put}() in this path because they're superfluous now that we know the devices are runtime resumed.
--- drivers/clk/clk.c | 117 +++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 105 insertions(+), 12 deletions(-)
drivers/clk/clk.c +105 -12
@@ -37,6 +37,10 @@ static HLIST_HEAD(clk_root_list);static HLIST_HEAD (clk_orphan_list);static LIST_HEAD (clk_notifier_list); +/* List of registered clks that use runtime PM */ +static HLIST_HEAD (clk_rpm_list); +static DEFINE_MUTEX (clk_rpm_list_lock); +static const struct hlist_head *all_lists[] = { &clk_root_list, &clk_orphan_list,
@@ -59,6 +63,7 @@ struct clk_core {struct clk_hw *hw;struct module *owner;struct device *dev; +struct hlist_node rpm_node;struct device_node *of_node;struct clk_core *parent;struct clk_parent_map *parents;
@@ -122,6 +127,89 @@ static void clk_pm_runtime_put(struct clk_core *core)pm_runtime_put_sync (core->dev); } +/** +* clk_pm_runtime_get_all() - Runtime "get" all clk provider devices +* +* Call clk_pm_runtime_get() on all runtime PM enabled clks in the clk tree so +* that disabling unused clks avoids a deadlock where a device is runtime PM +* resuming/suspending and the runtime PM callback is trying to grab the +* prepare_lock for something like clk_prepare_enable() while +* clk_disable_unused_subtree() holds the prepare_lock and is trying to runtime +* PM resume/suspend the device as well. +* +* Context: Acquires the 'clk_rpm_list_lock' and returns with the lock held on +* success. Otherwise the lock is released on failure. +* +* Return: 0 on success, negative errno otherwise. +*/ +static int clk_pm_runtime_get_all (void ) +{ +int ret; +struct clk_core *core, *failed; + +/* +* Grab the list lock to prevent any new clks from being registered +* or unregistered until clk_pm_runtime_put_all(). +*/ +mutex_lock (&clk_rpm_list_lock); + +/* +* Runtime PM "get" all the devices that are needed for the clks +* currently registered. Do this without holding the prepare_lock, to +* avoid the deadlock. +*/ +hlist_for_each_entry (core, &clk_rpm_list, rpm_node) { + ret =clk_pm_runtime_get (core); +if (ret) { + failed = core; +pr_err ("clk: Failed to runtime PM get '%s' for clk '%s'\n" , +dev_name (failed->dev), failed->name); + goto err; + } + } + +return 0 ; + +err: +hlist_for_each_entry (core, &clk_rpm_list, rpm_node) { +if (core == failed) +break ; + +clk_pm_runtime_put (core); + } +mutex_unlock (&clk_rpm_list_lock); + +return ret; +} + +/** +* clk_pm_runtime_put_all() - Runtime "put" all clk provider devices +* +* Put the runtime PM references taken in clk_pm_runtime_get_all() and release +* the 'clk_rpm_list_lock'. +*/ +static void clk_pm_runtime_put_all (void ) +{ +struct clk_core *core; + +hlist_for_each_entry (core, &clk_rpm_list, rpm_node) +clk_pm_runtime_put (core); +mutex_unlock (&clk_rpm_list_lock); +} + +static void clk_pm_runtime_init (struct clk_core *core) +{ +struct device *dev = core->dev; + +if (dev &&pm_runtime_enabled (dev)) { + core->rpm_enabled = true; + +mutex_lock (&clk_rpm_list_lock); +hlist_add_head (&core->rpm_node, &clk_rpm_list); +mutex_unlock (&clk_rpm_list_lock); + } +} +/*** locking ***/ static void clk_prepare_lock (void ) {
@@ -1362,9 +1450,6 @@ static void __init clk_unprepare_unused_subtree(struct clk_core *core)if (core->flags &CLK_IGNORE_UNUSED )return ; -if (clk_pm_runtime_get (core)) -return ; -if (clk_core_is_prepared (core)) {trace_clk_unprepare (core);if (core->ops->unprepare_unused)
@@ -1373,8 +1458,6 @@ static void __init clk_unprepare_unused_subtree(struct clk_core *core) core->ops->unprepare (core->hw);trace_clk_unprepare_complete (core); } - -clk_pm_runtime_put (core); }static void __init clk_disable_unused_subtree (struct clk_core *core)
@@ -1390,9 +1473,6 @@ static void __init clk_disable_unused_subtree(struct clk_core *core)if (core->flags &CLK_OPS_PARENT_ENABLE )clk_core_prepare_enable (core->parent); -if (clk_pm_runtime_get (core)) - goto unprepare_out; - flags =clk_enable_lock ();if (core->enable_count)
@@ -1417,8 +1497,6 @@ static void __init clk_disable_unused_subtree(struct clk_core *core) unlock_out:clk_enable_unlock (flags); -clk_pm_runtime_put (core); -unprepare_out:if (core->flags &CLK_OPS_PARENT_ENABLE )clk_core_disable_unprepare (core->parent); }
@@ -1434,6 +1512,7 @@ __setup("clk_ignore_unused", clk_ignore_unused_setup);static int __init clk_disable_unused (void ) {struct clk_core *core; +int ret;if (clk_ignore_unused) {pr_warn ("clk: Not disabling unused clocks\n" );
@@ -1442,6 +1521,13 @@ static int __init clk_disable_unused(void)pr_info ("clk: Disabling unused clocks\n" ); + ret =clk_pm_runtime_get_all (); +if (ret) +return ret; +/* +* Grab the prepare lock to keep the clk topology stable while iterating +* over clks. +*/ clk_prepare_lock ();hlist_for_each_entry (core, &clk_root_list, child_node)
@@ -1458,6 +1544,8 @@ static int __init clk_disable_unused(void)clk_prepare_unlock (); +clk_pm_runtime_put_all (); +return 0 ; }late_initcall_sync (clk_disable_unused);
@@ -4195,6 +4283,12 @@ static void __clk_release(struct kref *ref) { struct clk_core *core = container_of(ref, struct clk_core, ref); +if (core->rpm_enabled) { +mutex_lock (&clk_rpm_list_lock); +hlist_del (&core->rpm_node); +mutex_unlock (&clk_rpm_list_lock); + } +clk_core_free_parent_map (core);kfree_const (core->name);kfree (core);
@@ -4234,9 +4328,8 @@ __clk_register(struct device *dev, struct device_node *np, struct clk_hw *hw) } core->ops = init->ops; -if (dev &&pm_runtime_enabled (dev)) - core->rpm_enabled = true; core->dev = dev; +clk_pm_runtime_init (core); core->of_node = np;if (dev && dev->driver) core->owner = dev->driver->owner;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 81/158 clk: Get runtime PM before walking tree for clk_summary
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Boyd <[email protected]>
[ Upstream commit 9d1e795f754db1ac3344528b7af0b17b8146f321 ]
Similar to the previous commit, we should make sure that all devices are runtime resumed before printing the clk_summary through debugfs. Failure to do so would result in a deadlock if the thread is resuming a device to print clk state and that device is also runtime resuming in another thread, e.g the screen is turning on and the display driver is starting up. We remove the calls to clk_pm_runtime_{get,put}() in this path because they're superfluous now that we know the devices are runtime resumed. This also squashes a bug where the return value of clk_pm_runtime_get() wasn't checked, leading to an RPM count underflow on error paths.
--- drivers/clk/clk.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
drivers/clk/clk.c +12 -2
@@ -3321,9 +3321,7 @@ static void clk_summary_show_subtree(struct seq_file *s, struct clk_core *c, {struct clk_core *child; -clk_pm_runtime_get (c);clk_summary_show_one (s, c, level); -clk_pm_runtime_put (c);hlist_for_each_entry (child, &c->children, child_node)clk_summary_show_subtree (s, child, level +1 );
@@ -3333,11 +3331,15 @@ static int clk_summary_show(struct seq_file *s, void *data) {struct clk_core *c;struct hlist_head **lists = s->private; +int ret;seq_puts (s," enable prepare protect duty hardware connection\n" );seq_puts (s," clock count count count rate accuracy phase cycle enable consumer id\n" );seq_puts (s,"---------------------------------------------------------------------------------------------------------------------------------------------\n" ); + ret =clk_pm_runtime_get_all (); +if (ret) +return ret;clk_prepare_lock ();
@@ -3346,6 +3348,7 @@ static int clk_summary_show(struct seq_file *s, void *data)clk_summary_show_subtree (s, c,0 );clk_prepare_unlock (); +clk_pm_runtime_put_all ();return 0 ; }
@@ -3393,8 +3396,14 @@ static int clk_dump_show(struct seq_file *s, void *data)struct clk_core *c;bool first_node = true;struct hlist_head **lists = s->private; +int ret; + + ret =clk_pm_runtime_get_all (); +if (ret) +return ret;seq_putc (s,'{' ); +clk_prepare_lock ();for (; *lists; lists++) {
@@ -3407,6 +3416,7 @@ static int clk_dump_show(struct seq_file *s, void *data) }clk_prepare_unlock (); +clk_pm_runtime_put_all ();seq_puts (s,"}\n" );return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 82/158 clk: mediatek: Do a runtime PM get on controllers during probe
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pin-yen Lin <[email protected]>
[ Upstream commit 2f7b1d8b5505efb0057cd1ab85fca206063ea4c3 ]
mt8183-mfgcfg has a mutual dependency with genpd during the probing stage, which leads to a deadlock in the following call stack:
CPU0: genpd_lock --> clk_prepare_lockgenpd_power_off_work_fn()
genpd_lock()
generic_pm_domain::power_off()
clk_unprepare()
clk_prepare_lock()
CPU1: clk_prepare_lock --> genpd_lockclk_register()
__clk_core_init()
clk_prepare_lock()
clk_pm_runtime_get()
genpd_lock()
Do a runtime PM get at the probe function to make sure clk_register() won't acquire the genpd lock. Instead of only modifying mt8183-mfgcfg, do this on all mediatek clock controller probings because we don't believe this would cause any regression.
Verified on MT8183 and MT8192 Chromebooks.
--- drivers/clk/mediatek/clk-mtk.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
drivers/clk/mediatek/clk-mtk.c +15 -0
@@ -13,6 +13,7 @@#include <linux/of.h> #include <linux/of_address.h> #include <linux/platform_device.h> +#include <linux/pm_runtime.h> #include <linux/slab.h> #include "clk-mtk.h"
@@ -494,6 +495,16 @@ static int __mtk_clk_simple_probe(struct platform_device *pdev,return IS_ERR (base) ?PTR_ERR (base) : -ENOMEM ; } + +devm_pm_runtime_enable (&pdev->dev); +/* +* Do a pm_runtime_resume_and_get() to workaround a possible +* deadlock between clk_register() and the genpd framework. +*/ + r =pm_runtime_resume_and_get (&pdev->dev); +if (r) +return r; +/* Calculate how many clk_hw_onecell_data entries to allocate */ num_clks = mcd->num_clks + mcd->num_composite_clks; num_clks += mcd->num_fixed_clks + mcd->num_factor_clks;
@@ -574,6 +585,8 @@ static int __mtk_clk_simple_probe(struct platform_device *pdev, goto unregister_clks; } +pm_runtime_put (&pdev->dev); +return r; unregister_clks:
@@ -604,6 +617,8 @@ static int __mtk_clk_simple_probe(struct platform_device *pdev, free_base:if (mcd->shared_io && base)iounmap (base); + +pm_runtime_put (&pdev->dev);return r; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 83/158 clk: mediatek: mt7988-infracfg: fix clocks for 2nd PCIe port
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Golle <[email protected]>
[ Upstream commit d3e8a91a848a5941e3c31ecebd6b2612b37e01a6 ]
Due to what seems to be an undocumented oddity in MediaTek's MT7988 SoC design the CLK_INFRA_PCIE_PERI_26M_CK_P2 clock requires CLK_INFRA_PCIE_PERI_26M_CK_P3 to be enabled.
This currently leads to PCIe port 2 not working in Linux.
Reflect the apparent relationship in the clk driver to make sure PCIe port 2 of the MT7988 SoC works.
--- drivers/clk/mediatek/clk-mt7988-infracfg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/mediatek/clk-mt7988-infracfg.c +1 -1
@@ -152,7 +152,7 @@ static const struct mtk_gate infra_clks[] = {GATE_INFRA0 (CLK_INFRA_PCIE_PERI_26M_CK_P1 ,"infra_pcie_peri_ck_26m_ck_p1" ,"csw_infra_f26m_sel" ,8 ),GATE_INFRA0 (CLK_INFRA_PCIE_PERI_26M_CK_P2 ,"infra_pcie_peri_ck_26m_ck_p2" , -"csw_infra_f26m_sel" ,9 ), +"infra_pcie_peri_ck_26m_ck_p3" ,9 ),GATE_INFRA0 (CLK_INFRA_PCIE_PERI_26M_CK_P3 ,"infra_pcie_peri_ck_26m_ck_p3" , "csw_infra_f26m_sel", 10),/* INFRA1 */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 84/158 selftests/powerpc/papr-vpd: Fix missing variable initialization
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Lynch <[email protected]>
[ Upstream commit 210cfef579260ed6c3b700e7baeae51a5e183f43 ]
The "close handle without consuming VPD" testcase has inconsistent results because it fails to initialize the location code object it passes to ioctl() to create a VPD handle. Initialize the location code to the empty string as intended.
--- tools/testing/selftests/powerpc/papr_vpd/papr_vpd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/powerpc/papr_vpd/papr_vpd.c +1 -1
@@ -154,7 +154,7 @@ static int dev_papr_vpd_null_handle(void)static int papr_vpd_close_handle_without_reading (void ) {const int devfd =open (DEVPATH ,O_RDONLY ); -struct papr_location_code lc; +struct papr_location_code lc = { .str ="" , };int fd; SKIP_IF_MSG(devfd < 0 && errno == ENOENT,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 85/158 x86/bugs: Fix BHI retpoline check
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <[email protected]>
[ Upstream commit 69129794d94c544810e68b2b4eaa7e44063f9bf2 ]
Confusingly, X86_FEATURE_RETPOLINE doesn't mean retpolines are enabled, as it also includes the original "AMD retpoline" which isn't a retpoline at all.
Also replace cpu_feature_enabled() with boot_cpu_has() because this is before alternatives are patched and cpu_feature_enabled()'s fallback path is slower than plain old boot_cpu_has().
--- arch/x86/kernel/cpu/bugs.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
arch/x86/kernel/cpu/bugs.c +7 -4
@@ -1651,7 +1651,8 @@ static void __init bhi_select_mitigation(void)return ;/* Retpoline mitigates against BHI unless the CPU has RRSBA behavior */ -if (cpu_feature_enabled (X86_FEATURE_RETPOLINE )) { +if (boot_cpu_has (X86_FEATURE_RETPOLINE ) && + !boot_cpu_has (X86_FEATURE_RETPOLINE_LFENCE )) {spec_ctrl_disable_kernel_rrsba ();if (rrsba_disabled)return ;
@@ -2803,11 +2804,13 @@ static const char *spectre_bhi_state(void) {if (!boot_cpu_has_bug (X86_BUG_BHI ))return "; BHI: Not affected" ; -else if (boot_cpu_has (X86_FEATURE_CLEAR_BHB_HW )) +else if (boot_cpu_has (X86_FEATURE_CLEAR_BHB_HW ))return "; BHI: BHI_DIS_S" ; -else if (boot_cpu_has (X86_FEATURE_CLEAR_BHB_LOOP )) +else if (boot_cpu_has (X86_FEATURE_CLEAR_BHB_LOOP ))return "; BHI: SW loop, KVM: SW loop" ; -else if (boot_cpu_has (X86_FEATURE_RETPOLINE ) && rrsba_disabled) +else if (boot_cpu_has (X86_FEATURE_RETPOLINE ) && + !boot_cpu_has (X86_FEATURE_RETPOLINE_LFENCE ) && + rrsba_disabled)return "; BHI: Retpoline" ;else if (boot_cpu_has (X86_FEATURE_CLEAR_BHB_LOOP_ON_VMEXIT ))return "; BHI: Vulnerable, KVM: SW loop" ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 86/158 x86/cpufeatures: Fix dependencies for GFNI, VAES, and VPCLMULQDQ
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
[ Upstream commit 9543f6e26634537997b6e909c20911b7bf4876de ]
Fix cpuid_deps[] to list the correct dependencies for GFNI, VAES, and VPCLMULQDQ. These features don't depend on AVX512, and there exist CPUs that support these features but not AVX512. GFNI actually doesn't even depend on AVX.
This prevents GFNI from being unnecessarily disabled if AVX is disabled to mitigate the GDS vulnerability.
This also prevents all three features from being unnecessarily disabled if AVX512VL (or its dependency AVX512F) were to be disabled, but it looks like there isn't any case where this happens anyway.
--- arch/x86/kernel/cpu/cpuid-deps.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/x86/kernel/cpu/cpuid-deps.c +3 -3
@@ -44,7 +44,10 @@ static const struct cpuid_dep cpuid_deps[] = { { X86_FEATURE_F16C, X86_FEATURE_XMM2, }, { X86_FEATURE_AES, X86_FEATURE_XMM2 }, { X86_FEATURE_SHA_NI, X86_FEATURE_XMM2 }, + { X86_FEATURE_GFNI, X86_FEATURE_XMM2 }, { X86_FEATURE_FMA, X86_FEATURE_AVX }, + { X86_FEATURE_VAES, X86_FEATURE_AVX }, + { X86_FEATURE_VPCLMULQDQ, X86_FEATURE_AVX }, { X86_FEATURE_AVX2, X86_FEATURE_AVX, }, { X86_FEATURE_AVX512F, X86_FEATURE_AVX, }, { X86_FEATURE_AVX512IFMA, X86_FEATURE_AVX512F },
@@ -56,9 +59,6 @@ static const struct cpuid_dep cpuid_deps[] = { { X86_FEATURE_AVX512VL, X86_FEATURE_AVX512F }, { X86_FEATURE_AVX512VBMI, X86_FEATURE_AVX512F }, { X86_FEATURE_AVX512_VBMI2, X86_FEATURE_AVX512VL }, - { X86_FEATURE_GFNI, X86_FEATURE_AVX512VL }, - { X86_FEATURE_VAES, X86_FEATURE_AVX512VL }, - { X86_FEATURE_VPCLMULQDQ, X86_FEATURE_AVX512VL }, { X86_FEATURE_AVX512_VNNI, X86_FEATURE_AVX512VL }, { X86_FEATURE_AVX512_BITALG, X86_FEATURE_AVX512VL }, { X86_FEATURE_AVX512_4VNNIW, X86_FEATURE_AVX512F },
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 87/158 block: propagate partition scanning errors to the BLKRRPART ioctl
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit 752863bddacab6b5c5164b1df8c8b2e3a175ee28 ]
Commit 4601b4b130de ("block: reopen the device in blkdev_reread_part") lost the propagation of I/O errors from the low-level read of the partition table to the user space caller of the BLKRRPART.
Apparently some user space relies on, so restore the propagation. This isn't exactly pretty as other block device open calls explicitly do not are about these errors, so add a new BLK_OPEN_STRICT_SCAN to opt into the error propagation.
--- block/bdev.c | 29 +++++++++++++++++++---------- block/ioctl.c | 3 ++- include/linux/blkdev.h | 2 ++ 3 files changed, 23 insertions(+), 11 deletions(-)
block/bdev.c +19 -10
@@ -639,6 +639,14 @@ static void blkdev_flush_mapping(struct block_device *bdev)bdev_write_inode (bdev); } +static void blkdev_put_whole (struct block_device *bdev) +{ +if (atomic_dec_and_test (&bdev->bd_openers)) +blkdev_flush_mapping (bdev); +if (bdev->bd_disk->fops->release) + bdev->bd_disk->fops->release (bdev->bd_disk); +} +static int blkdev_get_whole (struct block_device *bdev,blk_mode_t mode) {struct gendisk *disk = bdev->bd_disk;
@@ -657,20 +665,21 @@ static int blkdev_get_whole(struct block_device *bdev, blk_mode_t mode)if (!atomic_read (&bdev->bd_openers))set_init_blocksize (bdev); -if (test_bit (GD_NEED_PART_SCAN , &disk->state)) -bdev_disk_changed (disk, false);atomic_inc (&bdev->bd_openers); +if (test_bit (GD_NEED_PART_SCAN , &disk->state)) { +/* +* Only return scanning errors if we are called from contexts +* that explicitly want them, e.g. the BLKRRPART ioctl. +*/ + ret =bdev_disk_changed (disk, false); +if (ret && (mode &BLK_OPEN_STRICT_SCAN )) { +blkdev_put_whole (bdev); +return ret; + } + }return 0 ; } -static void blkdev_put_whole (struct block_device *bdev) -{ -if (atomic_dec_and_test (&bdev->bd_openers)) -blkdev_flush_mapping (bdev); -if (bdev->bd_disk->fops->release) - bdev->bd_disk->fops->release (bdev->bd_disk); -} -static int blkdev_get_part (struct block_device *part,blk_mode_t mode) {struct gendisk *disk = part->bd_disk;
block/ioctl.c +2 -1
@@ -556,7 +556,8 @@ static int blkdev_common_ioctl(struct block_device *bdev, blk_mode_t mode,return -EACCES ;if (bdev_is_partition (bdev))return -EINVAL ; -return disk_scan_partitions (bdev->bd_disk, mode); +return disk_scan_partitions (bdev->bd_disk, + mode |BLK_OPEN_STRICT_SCAN );case BLKTRACESTART :case BLKTRACESTOP :case BLKTRACETEARDOWN :
include/linux/blkdev.h +2 -0
@@ -126,6 +126,8 @@ typedef unsigned int __bitwise blk_mode_t;#define BLK_OPEN_WRITE_IOCTL ((__force blk_mode_t)(1 << 4))/* open is exclusive wrt all other BLK_OPEN_WRITE opens to the device */ #define BLK_OPEN_RESTRICT_WRITES ((__force blk_mode_t)(1 << 5)) +/* return partition scanning errors */ +#define BLK_OPEN_STRICT_SCAN ((__force blk_mode_t)(1 << 6))struct gendisk {/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 88/158 net/mlx5: E-switch, store eswitch pointer before registering devlink_param
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shay Drory <[email protected]>
[ Upstream commit 0553e753ea9ee724acaf6b3dfc7354702af83567 ]
Next patch will move devlink register to be first. Therefore, whenever mlx5 will register a param, the user will be notified.
In order to notify the user, devlink is using the get() callback of the param. Hence, resources that are being used by the get() callback must be set before the devlink param is registered.
Therefore, store eswitch pointer inside mdev before registering the param.
--- drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 9 +++------ .../net/ethernet/mellanox/mlx5/core/eswitch_offloads.c | 4 ++++ 2 files changed, 7 insertions(+), 6 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/eswitch.c +3 -6
@@ -1868,6 +1868,7 @@ int mlx5_eswitch_init(struct mlx5_core_dev *dev)if (err) goto abort; + dev->priv.eswitch = esw; err =esw_offloads_init (esw);if (err) goto reps_err;
@@ -1892,11 +1893,6 @@ int mlx5_eswitch_init(struct mlx5_core_dev *dev) esw->offloads.encap =DEVLINK_ESWITCH_ENCAP_MODE_BASIC ; else esw->offloads.encap = DEVLINK_ESWITCH_ENCAP_MODE_NONE; -if (MLX5_ESWITCH_MANAGER (dev) && -mlx5_esw_vport_match_metadata_supported (esw)) - esw->flags |=MLX5_ESWITCH_VPORT_MATCH_METADATA ; - - dev->priv.eswitch = esw;BLOCKING_INIT_NOTIFIER_HEAD (&esw->n_head); esw_info(dev,
@@ -1908,6 +1904,7 @@ int mlx5_eswitch_init(struct mlx5_core_dev *dev) reps_err:mlx5_esw_vports_cleanup (esw); + dev->priv.eswitch =NULL ; abort:if (esw->work_queue)destroy_workqueue (esw->work_queue);
@@ -1926,7 +1923,6 @@ void mlx5_eswitch_cleanup(struct mlx5_eswitch *esw)esw_info (esw->dev,"cleanup\n" ); - esw->dev->priv.eswitch =NULL ;destroy_workqueue (esw->work_queue);WARN_ON (refcount_read (&esw->qos.refcnt));mutex_destroy (&esw->state_lock);
@@ -1937,6 +1933,7 @@ void mlx5_eswitch_cleanup(struct mlx5_eswitch *esw)mutex_destroy (&esw->offloads.encap_tbl_lock);mutex_destroy (&esw->offloads.decap_tbl_lock);esw_offloads_cleanup (esw); + esw->dev->priv.eswitch =NULL ;mlx5_esw_vports_cleanup (esw);debugfs_remove_recursive (esw->debugfs_root); devl_params_unregister(priv_to_devlink(esw->dev), mlx5_eswitch_params,
drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +4 -0
@@ -2476,6 +2476,10 @@ int esw_offloads_init(struct mlx5_eswitch *esw)if (err)return err; +if (MLX5_ESWITCH_MANAGER (esw->dev) && +mlx5_esw_vport_match_metadata_supported (esw)) + esw->flags |=MLX5_ESWITCH_VPORT_MATCH_METADATA ; + err =devl_params_register (priv_to_devlink (esw->dev), esw_devlink_params,ARRAY_SIZE (esw_devlink_params));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 89/158 ALSA: seq: ump: Fix conversion from MIDI2 to MIDI1 UMP messages
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit f25f17dc5c6a5e3f2014d44635f0c0db45224efe upstream.
The conversion from MIDI2 to MIDI1 UMP messages had a leftover artifact (superfluous bit shift), and this resulted in the bogus type check, leading to empty outputs. Let's fix it.
Message-ID: <[email protected]>
--- sound/core/seq/seq_ump_convert.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/core/seq/seq_ump_convert.c +1 -1
@@ -428,7 +428,7 @@ static int cvt_ump_midi2_to_midi1(struct midi1->note.group = midi2->note.group; midi1->note.status = midi2->note.status; midi1->note.channel = midi2->note.channel; -switch (midi2->note.status <<4 ) { +switch (midi2->note.status) {case UMP_MSG_STATUS_NOTE_ON :case UMP_MSG_STATUS_NOTE_OFF : midi1->note.note = midi2->note.note;
Greg Kroah-Hartman
maintainerPATCH 90/158 ALSA: hda/tas2781: correct the register for pow calibrated data
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shenghao Ding <[email protected]>
commit 0b6f0ff01a4a8c1b66c600263465976d57dcc1a3 upstream.
Calibrated data was written into an incorrect register, which cause speaker protection sometimes malfuctions
Message-ID: <[email protected]>
--- sound/pci/hda/tas2781_hda_i2c.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/pci/hda/tas2781_hda_i2c.c +2 -2
@@ -501,10 +501,10 @@ static int tas2563_save_calibration(strustatic void tas2781_apply_calib (struct tasdevice_priv *tas_priv) {static const unsigned char page_array[CALIB_MAX ] = { -0x17 ,0x18 ,0x18 ,0x0d ,0x18 +0x17 ,0x18 ,0x18 ,0x13 ,0x18 , };static const unsigned char rgno_array[CALIB_MAX ] = { -0x74 ,0x0c ,0x14 ,0x3c ,0x7c +0x74 ,0x0c ,0x14 ,0x70 ,0x7c , };unsigned char *data;int i, j, rc;
Greg Kroah-Hartman
maintainerPATCH 91/158 ALSA: hda/tas2781: Add new vendor_id and subsystem_id to support ThinkPad ICE-1
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shenghao Ding <[email protected]>
commit f74ab0c5e5947bcb3a400ab73d837974e76fad23 upstream.
Add new vendor_id and subsystem_id to support new Lenovo laptop ThinkPad ICE-1
Message-ID: <[email protected]>
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -10320,6 +10320,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x17aa ,0x222e ,"Thinkpad" ,ALC298_FIXUP_TPT470_DOCK ),SND_PCI_QUIRK (0x17aa ,0x2231 ,"Thinkpad T560" ,ALC292_FIXUP_TPT460 ),SND_PCI_QUIRK (0x17aa ,0x2233 ,"Thinkpad" ,ALC292_FIXUP_TPT460 ), +SND_PCI_QUIRK (0x17aa ,0x2234 ,"Thinkpad ICE-1" ,ALC287_FIXUP_TAS2781_I2C ),SND_PCI_QUIRK (0x17aa ,0x2245 ,"Thinkpad T470" ,ALC298_FIXUP_TPT470_DOCK ),SND_PCI_QUIRK (0x17aa ,0x2246 ,"Thinkpad" ,ALC298_FIXUP_TPT470_DOCK ), SND_PCI_QUIRK(0x17aa, 0x2247, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
Greg Kroah-Hartman
maintainerPATCH 92/158 ALSA: hda/realtek: Add quirks for Huawei Matebook D14 NBLB-WAX9N
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mauro Carvalho Chehab <[email protected]>
commit 7caf3daaaf0436fe370834c72c667a97d3671d1a upstream.
The headset mic requires a fixup to be properly detected/used.
As a reference, this specific model from 2021 reports the following devices:
https://alsa-project.org/db/?f=1a5ddeb0b151db8fe051407f5bb1c075b7dd3e4a
Message-ID: <b92a9e49fb504eec8416bcc6882a52de89450102.1713370457.git.mchehab@kernel.org>
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -10215,6 +10215,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x1462 ,0xb120 ,"MSI Cubi MS-B120" ,ALC283_FIXUP_HEADSET_MIC ),SND_PCI_QUIRK (0x1462 ,0xb171 ,"Cubi N 8GL (MS-B171)" ,ALC283_FIXUP_HEADSET_MIC ),SND_PCI_QUIRK (0x152d ,0x1082 ,"Quanta NL3" ,ALC269_FIXUP_LIFEBOOK ), +SND_PCI_QUIRK (0x152d ,0x1262 ,"Huawei NBLB-WAX9N" ,ALC2XX_FIXUP_HEADSET_MIC ),SND_PCI_QUIRK (0x1558 ,0x0353 ,"Clevo V35[05]SN[CDE]Q" ,ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1558 ,0x1323 ,"Clevo N130ZU" ,ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE ), SND_PCI_QUIRK(0x1558, 0x1325, "Clevo N15[01][CW]U", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
Greg Kroah-Hartman
maintainerPATCH 93/158 ALSA: hda/realtek - Enable audio jacks of Haier Boyue G42 with ALC269VC
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ai Chao <[email protected]>
commit 7ee5faad0f8c3ad86c8cfc2f6aac91d2ba29790f upstream.
The Haier Boyue G42 with ALC269VC cannot detect the MIC of headset, the line out and internal speaker until ALC269VC_FIXUP_ACER_VCOPPERBOX_PINS quirk applied.
Message-ID: <[email protected]>
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -10444,6 +10444,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x1d05 ,0x115c ,"TongFang GMxTGxx" ,ALC269_FIXUP_NO_SHUTUP ),SND_PCI_QUIRK (0x1d05 ,0x121b ,"TongFang GMxAGxx" ,ALC269_FIXUP_NO_SHUTUP ),SND_PCI_QUIRK (0x1d05 ,0x1387 ,"TongFang GMxIXxx" ,ALC2XX_FIXUP_HEADSET_MIC ), +SND_PCI_QUIRK (0x1d17 ,0x3288 ,"Haier Boyue G42" ,ALC269VC_FIXUP_ACER_VCOPPERBOX_PINS ),SND_PCI_QUIRK (0x1d72 ,0x1602 ,"RedmiBook" ,ALC255_FIXUP_XIAOMI_HEADSET_MIC ),SND_PCI_QUIRK (0x1d72 ,0x1701 ,"XiaomiNotebook Pro" ,ALC298_FIXUP_DELL1_MIC_NO_PRESENCE ), SND_PCI_QUIRK(0x1d72, 0x1901, "RedmiBook 14", ALC256_FIXUP_ASUS_HEADSET_MIC),
Greg Kroah-Hartman
maintainerPATCH 94/158 usb: misc: onboard_usb_hub: Disable the USB hub clock on failure
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <[email protected]>
commit 34b990e9bb54d20b9675ca9483be8668eed374d8 upstream.
In case regulator_bulk_enable() fails, the previously enabled USB hub clock should be disabled.
Fix it accordingly.
--- drivers/usb/misc/onboard_usb_hub.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/usb/misc/onboard_usb_hub.c +5 -1
@@ -78,7 +78,7 @@ static int onboard_hub_power_on(struct onboard_hub *hub) err =regulator_bulk_enable (hub->pdata->num_supplies, hub->supplies);if (err) {dev_err (hub->dev,"failed to enable supplies: %pe\n" ,ERR_PTR (err)); -return err; + goto disable_clk; }fsleep (hub->pdata->reset_us);
@@ -87,6 +87,10 @@ static int onboard_hub_power_on(struct onboard_hub *hub) hub->is_powered_on = true;return 0 ; + +disable_clk: +clk_disable_unprepare (hub->clk); +return err; }static int onboard_hub_power_off (struct onboard_hub *hub)
Signature · 1 line
2.44.0
Greg Kroah-Hartman
maintainerPATCH 95/158 misc: rtsx: Fix rts5264 driver status incorrect when card removed
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricky Wu <[email protected]>
commit 26ac2df47d4c58f17210b7a59037e40f7eca693e upstream.
rts5264 driver not clean express link error and set EXTRA_CAPS_SD_EXPRESS capability back when card removed
--- drivers/misc/cardreader/rtsx_pcr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/misc/cardreader/rtsx_pcr.c +1 -1
@@ -1002,7 +1002,7 @@ static irqreturn_t rtsx_pci_isr(int irq, void *dev_id) }else { pcr->card_removed |=SD_EXIST ; pcr->card_inserted &= ~SD_EXIST ; -if (PCI_PID (pcr) ==PID_5261 ) { +if ((PCI_PID (pcr) ==PID_5261 ) || (PCI_PID (pcr) ==PID_5264 )) {rtsx_pci_write_register (pcr,RTS5261_FW_STATUS ,RTS5261_EXPRESS_LINK_FAIL_MASK ,0 ); pcr->extra_caps |=EXTRA_CAPS_SD_EXPRESS ;
Signature · 1 line
2.44.0
Greg Kroah-Hartman
maintainerPATCH 96/158 binder: check offset alignment in binder_get_object()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <[email protected]>
commit aaef73821a3b0194a01bd23ca77774f704a04d40 upstream.
Commit 6d98eb95b450 ("binder: avoid potential data leakage when copying txn") introduced changes to how binder objects are copied. In doing so, it unintentionally removed an offset alignment check done through calls to binder_alloc_copy_from_buffer() -> check_buffer().
These calls were replaced in binder_get_object() with copy_from_user(), so now an explicit offset alignment check is needed here. This avoids later complications when unwinding the objects gets harder.
It is worth noting this check existed prior to commit 7a67a39320df ("binder: add function to copy binder object from buffer"), likely removed due to redundancy at the time.
--- drivers/android/binder.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/android/binder.c +3 -1
@@ -1708,8 +1708,10 @@ static size_t binder_get_object(struct bsize_t object_size =0 ; read_size =min_t (size_t,sizeof (*object), buffer->data_size - offset); -if (offset > buffer->data_size || read_size <sizeof (*hdr)) +if (offset > buffer->data_size || read_size <sizeof (*hdr) || + !IS_ALIGNED (offset,sizeof (u32)))return 0 ; +if (u) {if (copy_from_user (object, u + offset, read_size))return 0 ;
Greg Kroah-Hartman
maintainerPATCH 97/158 thunderbolt: Avoid notify PM core about runtime PM resume
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gil Fine <[email protected]>
commit dcd12acaf384c30437fa5a9a1f71df06fc9835fd upstream.
Currently we notify PM core about occurred wakes after any resume. This is not actually needed after resume from runtime suspend. Hence, notify PM core about occurred wakes only after resume from system sleep. Also, if the wake occurred in USB4 router upstream port, we don't notify the PM core about it since it is not actually needed and can cause unexpected autowake (e.g. if /sys/power/wakeup_count is used).
While there add the missing kernel-doc for tb_switch_resume().
--- drivers/thunderbolt/switch.c | 27 +++++++++++++++++++++++++-- drivers/thunderbolt/tb.c | 4 ++-- drivers/thunderbolt/tb.h | 3 ++- drivers/thunderbolt/usb4.c | 13 +++++++------ 4 files changed, 36 insertions(+), 11 deletions(-)
drivers/thunderbolt/switch.c +25 -2
@@ -3441,7 +3441,26 @@ static int tb_switch_set_wake(struct tb_return tb_lc_set_wake (sw, flags); } -int tb_switch_resume (struct tb_switch *sw) +static void tb_switch_check_wakes (struct tb_switch *sw) +{ +if (device_may_wakeup (&sw->dev)) { +if (tb_switch_is_usb4 (sw)) +usb4_switch_check_wakes (sw); + } +} + +/** +* tb_switch_resume() - Resume a switch after sleep +* @sw: Switch to resume +* @runtime: Is this resume from runtime suspend or system sleep +* +* Resumes and re-enumerates router (and all its children), if still plugged +* after suspend. Don't enumerate device router whose UID was changed during +* suspend. If this is resume from system sleep, notifies PM core about the +* wakes occurred during suspend. Disables all wakes, except USB4 wake of +* upstream port for USB4 routers that shall be always enabled. +*/ +int tb_switch_resume (struct tb_switch *sw,bool runtime) {struct tb_port *port;int err;
@@ -3490,6 +3509,9 @@ int tb_switch_resume(struct tb_switch *sif (err)return err; +if (!runtime) +tb_switch_check_wakes (sw); +/* Disable wakes */ tb_switch_set_wake (sw,0 );
@@ -3519,7 +3541,8 @@ int tb_switch_resume(struct tb_switch *s*/ if (tb_port_unlock (port))tb_port_warn (port,"failed to unlock port\n" ); -if (port->remote &&tb_switch_resume (port->remote->sw)) { +if (port->remote && +tb_switch_resume (port->remote->sw, runtime)) {tb_port_warn (port,"lost during suspend, disconnecting\n" );tb_sw_set_unplugged (port->remote->sw);
drivers/thunderbolt/tb.c +2 -2
@@ -2760,7 +2760,7 @@ static int tb_resume_noirq(struct tb *tb/* remove any pci devices the firmware might have setup */ tb_switch_reset (tb->root_switch); -tb_switch_resume (tb->root_switch); +tb_switch_resume (tb->root_switch, false);tb_free_invalid_tunnels (tb);tb_free_unplugged_children (tb->root_switch);tb_restore_children (tb->root_switch);
@@ -2886,7 +2886,7 @@ static int tb_runtime_resume(struct tb *struct tb_tunnel *tunnel, *n;mutex_lock (&tb->lock); -tb_switch_resume (tb->root_switch); +tb_switch_resume (tb->root_switch, true);tb_free_invalid_tunnels (tb);tb_restore_children (tb->root_switch);list_for_each_entry_safe (tunnel, n, &tcm->tunnel_list, list)
drivers/thunderbolt/tb.h +2 -1
@@ -817,7 +817,7 @@ int tb_switch_configuration_valid(structint tb_switch_add (struct tb_switch *sw);void tb_switch_remove (struct tb_switch *sw);void tb_switch_suspend (struct tb_switch *sw,bool runtime); -int tb_switch_resume (struct tb_switch *sw); +int tb_switch_resume (struct tb_switch *sw,bool runtime);int tb_switch_reset (struct tb_switch *sw);int tb_switch_wait_for_bit (struct tb_switch *sw,u32 offset,u32 bit,u32 value,int timeout_msec);
@@ -1278,6 +1278,7 @@ static inline bool tb_switch_is_usb4(conreturn usb4_switch_version (sw) >0 ; } +void usb4_switch_check_wakes (struct tb_switch *sw);int usb4_switch_setup (struct tb_switch *sw);int usb4_switch_configuration_valid (struct tb_switch *sw);int usb4_switch_read_uid (struct tb_switch *sw,u64 *uid);
drivers/thunderbolt/usb4.c +7 -6
@@ -155,7 +155,13 @@ static inline int usb4_switch_op_data(st tx_dwords, rx_data, rx_dwords); } -static void usb4_switch_check_wakes (struct tb_switch *sw) +/** +* usb4_switch_check_wakes() - Check for wakes and notify PM core about them +* @sw: Router whose wakes to check +* +* Checks wakes occurred during suspend and notify the PM core about them. +*/ +void usb4_switch_check_wakes (struct tb_switch *sw) {bool wakeup_usb4 = false;struct usb4_port *usb4;
@@ -163,9 +169,6 @@ static void usb4_switch_check_wakes(strubool wakeup = false;u32 val; -if (!device_may_wakeup (&sw->dev)) -return ; -if (tb_route (sw)) {if (tb_sw_read (sw, &val,TB_CFG_SWITCH ,ROUTER_CS_6 ,1 ))return ;
@@ -244,8 +247,6 @@ int usb4_switch_setup(struct tb_switch *u32 val =0 ;int ret; -usb4_switch_check_wakes (sw); -if (!tb_route (sw))return 0 ;
Greg Kroah-Hartman
maintainerPATCH 98/158 thunderbolt: Fix wake configurations after device unplug
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gil Fine <[email protected]>
commit c38fa07dc69f0b9e6f43ecab96dc7861a70c827c upstream.
Currently we don't configure correctly the wake events after unplug of device router. What can happen is that the downstream ports of host router will be configured to wake on: USB4-wake and wake-on-disconnect, but not on wake-on-connect. This may cause the later plugged device not to wake the domain and fail in enumeration. Fix this by clearing downstream port's "USB4 Port is Configured" bit, after unplug of a device router.
--- drivers/thunderbolt/switch.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-)
drivers/thunderbolt/switch.c +14 -7
@@ -3180,22 +3180,29 @@ void tb_switch_unconfigure_link(struct t {struct tb_port *up, *down; -if (sw->is_unplugged) -return ;if (!tb_route (sw) ||tb_switch_is_icm (sw))return ; +/* +* Unconfigure downstream port so that wake-on-connect can be +* configured after router unplug. No need to unconfigure upstream port +* since its router is unplugged. +*/ up =tb_upstream_port (sw); -if (tb_switch_is_usb4 (up->sw)) -usb4_port_unconfigure (up); -else -tb_lc_unconfigure_port (up); - down = up->remote;if (tb_switch_is_usb4 (down->sw))usb4_port_unconfigure (down);else tb_lc_unconfigure_port (down); + +if (sw->is_unplugged) +return ; + + up =tb_upstream_port (sw); +if (tb_switch_is_usb4 (up->sw)) +usb4_port_unconfigure (up); +else +tb_lc_unconfigure_port (up); }static void tb_switch_credits_init (struct tb_switch *sw)
Greg Kroah-Hartman
maintainerPATCH 99/158 thunderbolt: Do not create DisplayPort tunnels on adapters of the same router
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mika Westerberg <[email protected]>
commit c032cdd48b29549e8283c2fea99e7d91ddefebf7 upstream.
Probably due to a firmware bug Dell TB16 dock announces that one of its DisplayPort adapters is actually DP IN. Now this is possible and used with some external GPUs but not likely in this case as we are dealing with a dock. Anyways the problem is that the driver tries to create a DisplayPort tunnel between adapters of the same router which then shows to user that there is no picture on the display (because there are no available DP OUT adapters on the dock anymore).
Fix this by not creating DisplayPort tunnels between adapters that are on the same router.
--- drivers/thunderbolt/tb.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/thunderbolt/tb.c +6 -0
@@ -1717,6 +1717,12 @@ static struct tb_port *tb_find_dp_out(stcontinue ; } +/* Needs to be on different routers */ +if (in->sw == port->sw) { +tb_port_dbg (port,"skipping DP OUT on same router\n" ); +continue ; + } +tb_port_dbg (port,"DP OUT available\n" );/*
Greg Kroah-Hartman
maintainerPATCH 100/158 comedi: vmk80xx: fix incomplete endpoint checking
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <[email protected]>
commit d1718530e3f640b7d5f0050e725216eab57a85d8 upstream.
While vmk80xx does have endpoint checking implemented, some things can fall through the cracks. Depending on the hardware model, URBs can have either bulk or interrupt type, and current version of vmk80xx_find_usb_endpoints() function does not take that fully into account. While this warning does not seem to be too harmful, at the very least it will crash systems with 'panic_on_warn' set on them.
Fix the issue found by Syzkaller [1] by somewhat simplifying the endpoint checking process with usb_find_common_endpoints() and ensuring that only expected endpoint types are present.
This patch has not been tested on real hardware.
[1] Syzkaller report:
usb 1-1: BOGUS urb xfer, pipe 1 != type 3
WARNING: CPU: 0 PID: 781 at drivers/usb/core/urb.c:504 usb_submit_urb+0xc4e/0x18c0 drivers/usb/core/urb.c:503 ... Call Trace: <TASK> usb_start_wait_urb+0x113/0x520 drivers/usb/core/message.c:59 vmk80xx_reset_device drivers/comedi/drivers/vmk80xx.c:227 [inline] vmk80xx_auto_attach+0xa1c/0x1a40 drivers/comedi/drivers/vmk80xx.c:818 comedi_auto_config+0x238/0x380 drivers/comedi/drivers.c:1067 usb_probe_interface+0x5cd/0xb00 drivers/usb/core/driver.c:399
...
Similar issue also found by Syzkaller:
--- drivers/comedi/drivers/vmk80xx.c | 35 ++++++++++++----------------------- 1 file changed, 12 insertions(+), 23 deletions(-)
drivers/comedi/drivers/vmk80xx.c +12 -23
@@ -641,33 +641,22 @@ static int vmk80xx_find_usb_endpoints(ststruct vmk80xx_private *devpriv = dev->private;struct usb_interface *intf =comedi_to_usb_interface (dev);struct usb_host_interface *iface_desc = intf->cur_altsetting; -struct usb_endpoint_descriptor *ep_desc; -int i; +struct usb_endpoint_descriptor *ep_rx_desc, *ep_tx_desc; +int ret; -if (iface_desc->desc.bNumEndpoints !=2 ) -return -ENODEV ; - -for (i =0 ; i < iface_desc->desc.bNumEndpoints; i++) { - ep_desc = &iface_desc->endpoint[i].desc; - -if (usb_endpoint_is_int_in (ep_desc) || -usb_endpoint_is_bulk_in (ep_desc)) { -if (!devpriv->ep_rx) - devpriv->ep_rx = ep_desc; -continue ; - } +if (devpriv->model ==VMK8061_MODEL ) + ret =usb_find_common_endpoints (iface_desc, &ep_rx_desc, + &ep_tx_desc,NULL ,NULL ); +else + ret =usb_find_common_endpoints (iface_desc,NULL ,NULL , + &ep_rx_desc, &ep_tx_desc); -if (usb_endpoint_is_int_out (ep_desc) || -usb_endpoint_is_bulk_out (ep_desc)) { -if (!devpriv->ep_tx) - devpriv->ep_tx = ep_desc; -continue ; - } - } - -if (!devpriv->ep_rx || !devpriv->ep_tx) +if (ret)return -ENODEV ; + devpriv->ep_rx = ep_rx_desc; + devpriv->ep_tx = ep_tx_desc; +if (!usb_endpoint_maxp (devpriv->ep_rx) || !usb_endpoint_maxp (devpriv->ep_tx))return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 101/158 serial: mxs-auart: add spinlock around changing cts state
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emil Kronborg <[email protected]>
commit 54c4ec5f8c471b7c1137a1f769648549c423c026 upstream.
The uart_handle_cts_change() function in serial_core expects the caller to hold uport->lock. For example, I have seen the below kernel splat, when the Bluetooth driver is loaded on an i.MX28 board.
[ 85.119255] ------------[ cut here ]------------
[ 85.124413] WARNING: CPU: 0 PID: 27 at /drivers/tty/serial/serial_core.c:3453 uart_handle_cts_change+0xb4/0xec
[ 85.134694] Modules linked in: hci_uart bluetooth ecdh_generic ecc wlcore_sdio configfs
[ 85.143314] CPU: 0 PID: 27 Comm: kworker/u3:0 Not tainted 6.6.3-00021-gd62a2f068f92 #1
[ 85.151396] Hardware name: Freescale MXS (Device Tree)
[ 85.156679] Workqueue: hci0 hci_power_on [bluetooth]
(...)
[ 85.191765] uart_handle_cts_change from mxs_auart_irq_handle+0x380/0x3f4
[ 85.198787] mxs_auart_irq_handle from __handle_irq_event_percpu+0x88/0x210
(...)--- drivers/tty/serial/mxs-auart.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/tty/serial/mxs-auart.c +6 -2
@@ -1086,11 +1086,13 @@ static void mxs_auart_set_ldisc(struct ustatic irqreturn_t mxs_auart_irq_handle (int irq,void *context) { -u32 istat; +u32 istat, stat;struct mxs_auart_port *s = context;u32 mctrl_temp = s->mctrl_prev; -u32 stat =mxs_read (s,REG_STAT ); +uart_port_lock (&s->port); + + stat =mxs_read (s,REG_STAT ); istat =mxs_read (s,REG_INTR );/* ack irq */
@@ -1126,6 +1128,8 @@ static irqreturn_t mxs_auart_irq_handle( istat &= ~AUART_INTR_TXIS ; } +uart_port_unlock (&s->port); +return IRQ_HANDLED ; }
Greg Kroah-Hartman
maintainerPATCH 102/158 serial/pmac_zilog: Remove flawed mitigation for rx irq flood
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Finn Thain <[email protected]>
commit 1be3226445362bfbf461c92a5bcdb1723f2e4907 upstream.
The mitigation was intended to stop the irq completely. That may be better than a hard lock-up but it turns out that you get a crash anyway if you're using pmac_zilog as a serial console:
ttyPZ0: pmz: rx irq flood !
BUG: spinlock recursion on CPU#0, swapper/0
That's because the pr_err() call in pmz_receive_chars() results in pmz_console_write() attempting to lock a spinlock already locked in pmz_interrupt(). With CONFIG_DEBUG_SPINLOCK=y, this produces a fatal BUG splat. The spinlock in question is the one in struct uart_port.
Even when it's not fatal, the serial port rx function ceases to work. Also, the iteration limit doesn't play nicely with QEMU, as can be seen in the bug report linked below.
A web search for other reports of the error message "pmz: rx irq flood" didn't produce anything. So I don't think this code is needed any more. Remove it.
--- drivers/tty/serial/pmac_zilog.c | 14 -------------- 1 file changed, 14 deletions(-)
drivers/tty/serial/pmac_zilog.c +0 -14
@@ -210,7 +210,6 @@ static bool pmz_receive_chars(struct uar {struct tty_port *port;unsigned char ch, r1, drop, flag; -int loops =0 ;/* Sanity check, make sure the old bug is no longer happening */ if (uap->port.state ==NULL ) {
@@ -291,25 +290,12 @@ static bool pmz_receive_chars(struct uarif (r1 & Rx_OVR)tty_insert_flip_char (port,0 ,TTY_OVERRUN ); next_char: -/* We can get stuck in an infinite loop getting char 0 when the -* line is in a wrong HW state, we break that here. -* When that happens, I disable the receive side of the driver. -* Note that what I've been experiencing is a real irq loop where -* I'm getting flooded regardless of the actual port speed. -* Something strange is going on with the HW -*/ -if ((++loops) >1000 ) - goto flood; ch =read_zsreg (uap,R0 );if (!(ch & Rx_CH_AV))break ; }return true; - flood: -pmz_interrupt_control (uap,0 ); -pmz_error ("pmz: rx irq flood !\n" ); -return true; }static void pmz_status_handle (struct uart_pmac_port *uap)
Greg Kroah-Hartman
maintainerPATCH 103/158 serial: 8250_dw: Revert: Do not reclock if already at correct rate
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
commit 7dfae6cbadc1ac99e38ad19fb08810b31ff167be upstream.
Commit e5d6bd25f93d ("serial: 8250_dw: Do not reclock if already at correct rate") breaks the dw UARTs on Intel Bay Trail (BYT) and Cherry Trail (CHT) SoCs.
Before this change the RTL8732BS Bluetooth HCI which is found connected over the dw UART on both BYT and CHT boards works properly:
Bluetooth: hci0: RTL: examining hci_ver=06 hci_rev=000b lmp_ver=06 lmp_subver=8723
Bluetooth: hci0: RTL: rom_version status=0 version=1
Bluetooth: hci0: RTL: loading rtl_bt/rtl8723bs_fw.bin
Bluetooth: hci0: RTL: loading rtl_bt/rtl8723bs_config-OBDA8723.bin
Bluetooth: hci0: RTL: cfg_sz 64, total sz 24508
Bluetooth: hci0: RTL: fw version 0x365d462e
where as after this change probing it fails:
Bluetooth: hci0: RTL: examining hci_ver=06 hci_rev=000b lmp_ver=06 lmp_subver=8723
Bluetooth: hci0: RTL: rom_version status=0 version=1
Bluetooth: hci0: RTL: loading rtl_bt/rtl8723bs_fw.bin
Bluetooth: hci0: RTL: loading rtl_bt/rtl8723bs_config-OBDA8723.bin
Bluetooth: hci0: RTL: cfg_sz 64, total sz 24508
Bluetooth: hci0: command 0xfc20 tx timeout
Bluetooth: hci0: RTL: download fw command failed (-110)
Revert the changes to fix this regression.
--- drivers/tty/serial/8250/8250_dw.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/tty/serial/8250/8250_dw.c +3 -3
@@ -357,9 +357,9 @@ static void dw8250_set_termios(struct ualong rate;int ret; +clk_disable_unprepare (d->clk); rate =clk_round_rate (d->clk, newrate); -if (rate >0 && p->uartclk != rate) { -clk_disable_unprepare (d->clk); +if (rate >0 ) {/* * Note that any clock-notifer worker will block in * serial8250_update_uartclk() until we are done.
@@ -367,8 +367,8 @@ static void dw8250_set_termios(struct ua ret =clk_set_rate (d->clk, newrate);if (!ret) p->uartclk = rate; -clk_prepare_enable (d->clk); } +clk_prepare_enable (d->clk);dw8250_do_set_termios (p, termios, old); }
Greg Kroah-Hartman
maintainerPATCH 104/158 serial: stm32: Return IRQ_NONE in the ISR if no handling happend
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
commit 13c785323b36b845300b256d0e5963c3727667d7 upstream.
If there is a stuck irq that the handler doesn't address, returning IRQ_HANDLED unconditionally makes it impossible for the irq core to detect the problem and disable the irq. So only return IRQ_HANDLED if an event was handled.
A stuck irq is still problematic, but with this change at least it only makes the UART nonfunctional instead of occupying the (usually only) CPU by 100% and so stall the whole machine.
--- drivers/tty/serial/stm32-usart.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/tty/serial/stm32-usart.c +10 -2
@@ -857,6 +857,7 @@ static irqreturn_t stm32_usart_interruptconst struct stm32_usart_offsets *ofs = &stm32_port->info->ofs;u32 sr;unsigned int size; +irqreturn_t ret =IRQ_NONE ; sr =readl_relaxed (port->membase + ofs->isr);
@@ -865,11 +866,14 @@ static irqreturn_t stm32_usart_interrupt (sr & USART_SR_TC)) {stm32_usart_tc_interrupt_disable (port);stm32_usart_rs485_rts_disable (port); + ret =IRQ_HANDLED ; } -if ((sr &USART_SR_RTOF ) && ofs->icr !=UNDEF_REG ) +if ((sr &USART_SR_RTOF ) && ofs->icr !=UNDEF_REG ) {writel_relaxed (USART_ICR_RTOCF , port->membase + ofs->icr); + ret =IRQ_HANDLED ; + }if ((sr &USART_SR_WUF ) && ofs->icr !=UNDEF_REG ) {/* Clear wake up flag and disable wake up interrupt */
@@ -878,6 +882,7 @@ static irqreturn_t stm32_usart_interruptstm32_usart_clr_bits (port, ofs->cr3,USART_CR3_WUFIE );if (irqd_is_wakeup_set (irq_get_irq_data (port->irq)))pm_wakeup_event (tport->tty->dev,0 ); + ret =IRQ_HANDLED ; }/*
@@ -892,6 +897,7 @@ static irqreturn_t stm32_usart_interruptuart_unlock_and_check_sysrq (port);if (size)tty_flip_buffer_push (tport); + ret =IRQ_HANDLED ; } }
@@ -899,6 +905,7 @@ static irqreturn_t stm32_usart_interruptuart_port_lock (port);stm32_usart_transmit_chars (port);uart_port_unlock (port); + ret =IRQ_HANDLED ; }/* Receiver timeout irq for DMA RX */
@@ -908,9 +915,10 @@ static irqreturn_t stm32_usart_interruptuart_unlock_and_check_sysrq (port);if (size)tty_flip_buffer_push (tport); + ret =IRQ_HANDLED ; } -return IRQ_HANDLED ; +return ret; }static void stm32_usart_set_mctrl (struct uart_port *port,unsigned int mctrl)
Greg Kroah-Hartman
maintainerPATCH 105/158 serial: stm32: Reset .throttled state in .startup()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
commit ea2624b5b829b8f93c0dce25721d835969b34faf upstream.
When an UART is opened that still has .throttled set from a previous open, the RX interrupt is enabled but the irq handler doesn't consider it. This easily results in a stuck irq with the effect to occupy the CPU in a tight loop.
So reset the throttle state in .startup() to ensure that RX irqs are handled.
--- drivers/tty/serial/stm32-usart.c | 1 + 1 file changed, 1 insertion(+)
drivers/tty/serial/stm32-usart.c +1 -0
@@ -1088,6 +1088,7 @@ static int stm32_usart_startup(struct ua val |=USART_CR2_SWAP ;writel_relaxed (val, port->membase + ofs->cr2); } + stm32_port->throttled = false;/* RX FIFO Flush */ if (ofs->rqr !=UNDEF_REG )
Greg Kroah-Hartman
maintainerPATCH 106/158 serial: core: Fix regression when runtime PM is not enabled
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Lindgren <[email protected]>
commit 5555980571cc744cd99b6455e3e388b54519db8f upstream.
Commit 45a3a8ef8129 ("serial: core: Revert checks for tx runtime PM state") caused a regression for Sun Ultra 60 for the sunsab driver as reported by Nick Bowler <[email protected]>.
We need to add back the check runtime PM enabled state for serial port controller device, I wrongly assumed earlier we could just remove it.
--- drivers/tty/serial/serial_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/serial/serial_core.c +1 -1
@@ -156,7 +156,7 @@ static void __uart_start(struct uart_state *state)* enabled, serial_port_runtime_resume() calls start_tx() again * after enabling the device. */ -if (pm_runtime_active (&port_dev->dev)) +if (!pm_runtime_enabled (port->dev) ||pm_runtime_active (&port_dev->dev)) port->ops->start_tx (port);pm_runtime_mark_last_busy (&port_dev->dev);pm_runtime_put_autosuspend (&port_dev->dev);
Signature · 1 line
2.44.0
Greg Kroah-Hartman
maintainerPATCH 107/158 serial: core: Clearing the circular buffer before NULLifying it
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
commit 9cf7ea2eeb745213dc2a04103e426b960e807940 upstream.
The circular buffer is NULLified in uart_tty_port_shutdown() under the spin lock. However, the PM or other timer based callbacks may still trigger after this event without knowning that buffer pointer is not valid. Since the serial code is a bit inconsistent in checking the buffer state (some rely on the head-tail positions, some on the buffer pointer), it's better to have both aligned, i.e. buffer pointer to be NULL and head-tail possitions to be the same, meaning it's empty. This will prevent asynchronous calls to dereference NULL pointer as reported recently in 8250 case:
BUG: kernel NULL pointer dereference, address: 00000cf5 Workqueue: pm pm_runtime_work EIP: serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809) ... ? serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809) __start_tx (drivers/tty/serial/8250/8250_port.c:1551) serial8250_start_tx (drivers/tty/serial/8250/8250_port.c:1654) serial_port_runtime_suspend (include/linux/serial_core.h:667 drivers/tty/serial/serial_port.c:63) __rpm_callback (drivers/base/power/runtime.c:393) ? serial_port_remove (drivers/tty/serial/serial_port.c:50) rpm_suspend (drivers/base/power/runtime.c:447)
The proposed change will prevent ->start_tx() to be called during suspend on shut down port.
--- drivers/tty/serial/serial_core.c | 1 + 1 file changed, 1 insertion(+)
drivers/tty/serial/serial_core.c +1 -0
@@ -1788,6 +1788,7 @@ static void uart_tty_port_shutdown(struc* Free the transmit buffer. */ uart_port_lock_irq (uport); +uart_circ_clear (&state->xmit); buf = state->xmit.buf; state->xmit.buf =NULL ;uart_port_unlock_irq (uport);
Greg Kroah-Hartman
maintainerPATCH 108/158 serial: core: Fix missing shutdown and startup for serial base port
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Lindgren <[email protected]>
commit 1aa4ad4eb695bac1b0a7ba542a16d6833c9c8dd8 upstream.
We are seeing start_tx being called after port shutdown as noted by Jiri. This happens because we are missing the startup and shutdown related functions for the serial base port.
Let's fix the issue by adding startup and shutdown functions for the serial base port to block tx flushing for the serial base port when the port is not in use.
--- drivers/tty/serial/serial_base.h | 4 ++++ drivers/tty/serial/serial_core.c | 20 +++++++++++++++++--- drivers/tty/serial/serial_port.c | 34 ++++++++++++++++++++++++++++++++++ 3 files changed, 55 insertions(+), 3 deletions(-)
drivers/tty/serial/serial_base.h +4 -0
@@ -22,6 +22,7 @@ struct serial_ctrl_device {struct serial_port_device {struct device dev;struct uart_port *port; +unsigned int tx_enabled:1 ; };int serial_base_ctrl_init (void );
@@ -30,6 +31,9 @@ void serial_base_ctrl_exit(void);int serial_base_port_init (void );void serial_base_port_exit (void ); +void serial_base_port_startup (struct uart_port *port); +void serial_base_port_shutdown (struct uart_port *port); +int serial_base_driver_register (struct device_driver *driver);void serial_base_driver_unregister (struct device_driver *driver);
drivers/tty/serial/serial_core.c +17 -3
@@ -323,16 +323,26 @@ static int uart_startup(struct tty_struc bool init_hw) {struct tty_port *port = &state->port; +struct uart_port *uport;int retval;if (tty_port_initialized (port)) -return 0 ; + goto out_base_port_startup; retval =uart_port_startup (tty, state, init_hw); -if (retval) +if (retval) {set_bit (TTY_IO_ERROR , &tty->flags); +return retval; + } -return retval; +out_base_port_startup: + uport =uart_port_check (state); +if (!uport) +return -EIO ; + +serial_base_port_startup (uport); + +return 0 ; }/*
@@ -355,6 +365,9 @@ static void uart_shutdown(struct tty_strif (tty)set_bit (TTY_IO_ERROR , &tty->flags); +if (uport) +serial_base_port_shutdown (uport); +if (tty_port_initialized (port)) {tty_port_set_initialized (port, false);
@@ -1775,6 +1788,7 @@ static void uart_tty_port_shutdown(struc uport->ops->stop_rx (uport);uart_port_unlock_irq (uport); +serial_base_port_shutdown (uport);uart_port_shutdown (port);/*
drivers/tty/serial/serial_port.c +34 -0
@@ -36,8 +36,12 @@ static int serial_port_runtime_resume(st/* Flush any pending TX for the port */ uart_port_lock_irqsave (port, &flags); +if (!port_dev->tx_enabled) + goto unlock;if (__serial_port_busy (port)) port->ops->start_tx (port); + +unlock:uart_port_unlock_irqrestore (port, flags); out:
@@ -57,6 +61,11 @@ static int serial_port_runtime_suspend(sreturn 0 ;uart_port_lock_irqsave (port, &flags); +if (!port_dev->tx_enabled) { +uart_port_unlock_irqrestore (port, flags); +return 0 ; + } + busy =__serial_port_busy (port);if (busy) port->ops->start_tx (port);
@@ -68,6 +77,31 @@ static int serial_port_runtime_suspend(sreturn busy ? -EBUSY :0 ; } +static void serial_base_port_set_tx (struct uart_port *port, +struct serial_port_device *port_dev, +bool enabled) +{ +unsigned long flags; + +uart_port_lock_irqsave (port, &flags); + port_dev->tx_enabled = enabled; +uart_port_unlock_irqrestore (port, flags); +} + +void serial_base_port_startup (struct uart_port *port) +{ +struct serial_port_device *port_dev = port->port_dev; + +serial_base_port_set_tx (port, port_dev, true); +} + +void serial_base_port_shutdown (struct uart_port *port) +{ +struct serial_port_device *port_dev = port->port_dev; + +serial_base_port_set_tx (port, port_dev, false); +} + static DEFINE_RUNTIME_DEV_PM_OPS(serial_port_pm, serial_port_runtime_suspend, serial_port_runtime_resume, NULL);
Greg Kroah-Hartman
maintainerPATCH 109/158 USB: serial: option: add Fibocom FM135-GL variants
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: bolan wang <[email protected]>
commit 356952b13af5b2c338df1e06889fd1b5e12cbbf4 upstream.
Update the USB serial option driver support for the Fibocom FM135-GL LTE modules.
- VID:PID 2cb7:0115, FM135-GL for laptop debug M.2 cards(with MBIM interface for /Linux/Chrome OS)
0x0115: mbim, diag, at, pipe
Here are the outputs of usb-devices:
T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 16 Spd=480 MxCh= 0 D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=2cb7 ProdID=0115 Rev=05.15 S: Manufacturer=Fibocom Wireless Inc. S: Product=Fibocom Module S: SerialNumber=12345678 C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/option.c +2 -0
@@ -2272,6 +2272,8 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0xff, 0x30) }, /* Fibocom FG150 Diag */ { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0, 0) }, /* Fibocom FG150 AT */ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0111, 0xff) }, /* Fibocom FM160 (MBIM mode) */ + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0115, 0xff), /* Fibocom FM135 (laptop MBIM) */ + .driver_info = RSVD(5) }, { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a0, 0xff) }, /* Fibocom NL668-AM/NL652-EU (laptop MBIM) */ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a2, 0xff) }, /* Fibocom FM101-GL (laptop MBIM) */ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a3, 0xff) }, /* Fibocom FM101-GL (laptop MBIM) */
Greg Kroah-Hartman
maintainerPATCH 110/158 USB: serial: option: add support for Fibocom FM650/FG650
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuanhong Guo <[email protected]>
commit fb1f4584b1215e8c209f6b3a4028ed8351a0e961 upstream.
Fibocom FM650/FG650 are 5G modems with ECM/NCM/RNDIS/MBIM modes. This patch adds support to all 4 modes.
In all 4 modes, the first serial port is the AT console while the other 3 appear to be diagnostic interfaces for dumping modem logs.
usb-devices output for all modes:
ECM:
T: Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 5 Spd=5000 MxCh= 0 D: Ver= 3.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 P: Vendor=2cb7 ProdID=0a04 Rev=04.04 S: Manufacturer=Fibocom Wireless Inc. S: Product=FG650 Module S: SerialNumber=0123456789ABCDEF C: #Ifs= 5 Cfg#= 1 Atr=c0 MxPwr=504mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
NCM:
T: Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 6 Spd=5000 MxCh= 0 D: Ver= 3.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 P: Vendor=2cb7 ProdID=0a05 Rev=04.04 S: Manufacturer=Fibocom Wireless Inc. S: Product=FG650 Module S: SerialNumber=0123456789ABCDEF C: #Ifs= 6 Cfg#= 1 Atr=c0 MxPwr=504mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0d Prot=00 Driver=cdc_ncm E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=01 Driver=cdc_ncm E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
RNDIS:
T: Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 4 Spd=5000 MxCh= 0 D: Ver= 3.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 P: Vendor=2cb7 ProdID=0a06 Rev=04.04 S: Manufacturer=Fibocom Wireless Inc. S: Product=FG650 Module S: SerialNumber=0123456789ABCDEF C: #Ifs= 6 Cfg#= 1 Atr=c0 MxPwr=504mA I: If#= 0 Alt= 0 #EPs= 1 Cls=e0(wlcon) Sub=01 Prot=03 Driver=rndis_host E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
MBIM:
T: Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 7 Spd=5000 MxCh= 0 D: Ver= 3.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 P: Vendor=2cb7 ProdID=0a07 Rev=04.04 S: Manufacturer=Fibocom Wireless Inc. S: Product=FG650 Module S: SerialNumber=0123456789ABCDEF C: #Ifs= 6 Cfg#= 1 Atr=c0 MxPwr=504mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
--- drivers/usb/serial/option.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/serial/option.c +4 -0
@@ -2279,6 +2279,10 @@ static const struct usb_device_id option { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a3, 0xff) }, /* Fibocom FM101-GL (laptop MBIM) */ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a4, 0xff), /* Fibocom FM101-GL (laptop MBIM) */ .driver_info = RSVD(4) }, + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0a04, 0xff) }, /* Fibocom FM650-CN (ECM mode) */ + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0a05, 0xff) }, /* Fibocom FM650-CN (NCM mode) */ + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0a06, 0xff) }, /* Fibocom FM650-CN (RNDIS mode) */ + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0a07, 0xff) }, /* Fibocom FM650-CN (MBIM mode) */ { USB_DEVICE_INTERFACE_CLASS(0x2df3, 0x9d03, 0xff) }, /* LongSung M5710 */ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 RNDIS */ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 MBIM */
Greg Kroah-Hartman
maintainerPATCH 111/158 USB: serial: option: add Lonsung U8300/U9300 product
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Coia Prant <[email protected]>
commit cf16ffa17c398434a77b8a373e69287c95b60de2 upstream.
Update the USB serial option driver to support Longsung U8300/U9300.
For U8300
Interface 4 is used by for QMI interface in stock firmware of U8300, the router which uses U8300 modem.
Interface 5 is used by for ADB interface in stock firmware of U8300, the router which uses U8300 modem.
Interface mapping is:
0: unknown (Debug), 1: AT (Modem), 2: AT, 3: PPP (NDIS / Pipe), 4: QMI, 5: ADB
T: Bus=05 Lev=01 Prnt=03 Port=02 Cnt=01 Dev#= 4 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1c9e ProdID=9b05 Rev=03.18 S: Manufacturer=Android S: Product=Android C: #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8a(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
For U9300
Interface 1 is used by for ADB interface in stock firmware of U9300, the router which uses U9300 modem.
Interface 4 is used by for QMI interface in stock firmware of U9300, the router which uses U9300 modem.
Interface mapping is:
0: ADB, 1: AT (Modem), 2: AT, 3: PPP (NDIS / Pipe), 4: QMI
Note: Interface 3 of some models of the U9300 series can send AT commands.
T: Bus=05 Lev=01 Prnt=05 Port=04 Cnt=01 Dev#= 6 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1c9e ProdID=9b3c Rev=03.18 S: Manufacturer=Android S: Product=Android C: #Ifs= 5 Cfg#= 1 Atr=80 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
Tested successfully using Modem Manager on U9300.
Tested successfully AT commands using If=1, If=2 and If=3 on U9300.
--- drivers/usb/serial/option.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/serial/option.c +4 -0
@@ -2052,6 +2052,10 @@ static const struct usb_device_id option .driver_info = RSVD(3) }, { USB_DEVICE_INTERFACE_CLASS(LONGCHEER_VENDOR_ID, 0x9803, 0xff), .driver_info = RSVD(4) }, + { USB_DEVICE(LONGCHEER_VENDOR_ID, 0x9b05), /* Longsung U8300 */ + .driver_info = RSVD(4) | RSVD(5) }, + { USB_DEVICE(LONGCHEER_VENDOR_ID, 0x9b3c), /* Longsung U9300 */ + .driver_info = RSVD(0) | RSVD(4) }, { USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) }, { USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) }, { USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) },
Greg Kroah-Hartman
maintainerPATCH 112/158 USB: serial: option: support Quectel EM060K sub-models
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerry Meng <[email protected]>
commit c840244aba7ad2b83ed904378b36bd6aef25511c upstream.
EM060K_129, EM060K_12a, EM060K_12b and EM0060K_12c are EM060K's sub-models, having the same name "Quectel EM060K-GL" and the same interface layout.
MBIM + GNSS + DIAG + NMEA + AT + QDSS + DPL
T: Bus=03 Lev=01 Prnt=01 Port=01 Cnt=02 Dev#= 8 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=0129 Rev= 5.04 S: Manufacturer=Quectel S: Product=Quectel EM060K-GL S: SerialNumber=f6fa08b6 C:* #Ifs= 8 Cfg#= 1 Atr=a0 MxPwr=500mA A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00 I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 6 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none)
E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none)
E: Ad=8f(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
drivers/usb/serial/option.c +16 -0
@@ -255,6 +255,10 @@ static void option_instat_callback(struc#define QUECTEL_PRODUCT_EM061K_LMS 0x0124#define QUECTEL_PRODUCT_EC25 0x0125#define QUECTEL_PRODUCT_EM060K_128 0x0128 +#define QUECTEL_PRODUCT_EM060K_129 0x0129 +#define QUECTEL_PRODUCT_EM060K_12a 0x012a +#define QUECTEL_PRODUCT_EM060K_12b 0x012b +#define QUECTEL_PRODUCT_EM060K_12c 0x012c#define QUECTEL_PRODUCT_EG91 0x0191#define QUECTEL_PRODUCT_EG95 0x0195#define QUECTEL_PRODUCT_BG96 0x0296
@@ -1218,6 +1222,18 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_128, 0xff, 0xff, 0x30) }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_128, 0xff, 0x00, 0x40) }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_128, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_129, 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_129, 0xff, 0x00, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_129, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12a, 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12a, 0xff, 0x00, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12a, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12b, 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12b, 0xff, 0x00, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12b, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12c, 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12c, 0xff, 0x00, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12c, 0xff, 0xff, 0x40) }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LCN, 0xff, 0xff, 0x30) }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LCN, 0xff, 0x00, 0x40) }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LCN, 0xff, 0xff, 0x40) },
Greg Kroah-Hartman
maintainerPATCH 113/158 USB: serial: option: add Rolling RW101-GL and RW135-GL support
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vanillan Wang <[email protected]>
commit 311f97a4c7c22a01f8897bddf00428dfd0668e79 upstream.
Update the USB serial option driver support for the Rolling LTE modules.
- VID:PID 33f8:01a2, RW101-GL for laptop debug M.2 cards(with MBIM interface for /Linux/Chrome OS)0x01a2: mbim, diag, at, pipe
- VID:PID 33f8:01a3, RW101-GL for laptop debug M.2 cards(with MBIM interface for /Linux/Chrome OS)0x01a3: mbim, pipe
- VID:PID 33f8:01a4, RW101-GL for laptop debug M.2 cards(with MBIM interface for /Linux/Chrome OS)0x01a4: mbim, diag, at, pipe
- VID:PID 33f8:0104, RW101-GL for laptop debug M.2 cards(with RMNET interface for /Linux/Chrome OS)0x0104: RMNET, diag, at, pipe
- VID:PID 33f8:0115, RW135-GL for laptop debug M.2 cards(with MBIM interface for /Linux/Chrome OS)0x0115: MBIM, diag, at, pipe
Here are the outputs of usb-devices:
T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 5 Spd=480 MxCh= 0 D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=33f8 ProdID=01a2 Rev=05.15 S: Manufacturer=Rolling Wireless S.a.r.l. S: Product=Rolling Module S: SerialNumber=12345678 C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 8 Spd=480 MxCh= 0 D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=33f8 ProdID=01a3 Rev=05.15 S: Manufacturer=Rolling Wireless S.a.r.l. S: Product=Rolling Module S: SerialNumber=12345678 C: #Ifs= 3 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 17 Spd=480 MxCh= 0 D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=33f8 ProdID=01a4 Rev=05.15 S: Manufacturer=Rolling Wireless S.a.r.l. S: Product=Rolling Module S: SerialNumber=12345678 C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
T: Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0 D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 P: Vendor=33f8 ProdID=0104 Rev=05.04 S: Manufacturer=Rolling Wireless S.a.r.l. S: Product=Rolling Module S: SerialNumber=ba2eb033 C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=896mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=88(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs E: Ad=05(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=89(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 16 Spd=480 MxCh= 0 D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=33f8 ProdID=0115 Rev=05.15 S: Manufacturer=Rolling Wireless S.a.r.l. S: Product=Rolling Module S: SerialNumber=12345678 C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/usb/serial/option.c +8 -0
@@ -2307,6 +2307,14 @@ static const struct usb_device_id option { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 RNDIS */ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 MBIM */ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) }, /* GosunCn GM500 ECM/NCM */ + { USB_DEVICE(0x33f8, 0x0104), /* Rolling RW101-GL (laptop RMNET) */ + .driver_info = RSVD(4) | RSVD(5) }, + { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a2, 0xff) }, /* Rolling RW101-GL (laptop MBIM) */ + { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a3, 0xff) }, /* Rolling RW101-GL (laptop MBIM) */ + { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a4, 0xff), /* Rolling RW101-GL (laptop MBIM) */ + .driver_info = RSVD(4) }, + { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0115, 0xff), /* Rolling RW135-GL (laptop MBIM) */ + .driver_info = RSVD(5) }, { USB_DEVICE_AND_INTERFACE_INFO(OPPO_VENDOR_ID, OPPO_PRODUCT_R11, 0xff, 0xff, 0x30) }, { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x30) }, { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x40) },
Greg Kroah-Hartman
maintainerPATCH 114/158 USB: serial: option: add Telit FN920C04 rmnet compositions
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniele Palmas <[email protected]>
commit 582ee2f9d268d302595db3e36b985e5cbb93284d upstream.
Add the following Telit FN920C04 compositions:
0x10a0: rmnet + tty (AT/NMEA) + tty (AT) + tty (diag)
T: Bus=03 Lev=01 Prnt=03 Port=06 Cnt=01 Dev#= 5 Spd=480 MxCh= 0 D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10a0 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FN920 S: SerialNumber=92c4c4d8 C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10a4: rmnet + tty (AT) + tty (AT) + tty (diag)
T: Bus=03 Lev=01 Prnt=03 Port=06 Cnt=01 Dev#= 8 Spd=480 MxCh= 0 D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10a4 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FN920 S: SerialNumber=92c4c4d8 C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10a9: rmnet + tty (AT) + tty (diag) + DPL (data packet logging) + adb
T: Bus=03 Lev=01 Prnt=03 Port=06 Cnt=01 Dev#= 9 Spd=480 MxCh= 0 D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10a9 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FN920 S: SerialNumber=92c4c4d8 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/usb/serial/option.c +6 -0
@@ -1376,6 +1376,12 @@ static const struct usb_device_id option .driver_info = NCTRL(2) | RSVD(3) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1083, 0xff), /* Telit FE990 (ECM) */ .driver_info = NCTRL(0) | RSVD(1) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a0, 0xff), /* Telit FN20C04 (rmnet) */ + .driver_info = RSVD(0) | NCTRL(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a4, 0xff), /* Telit FN20C04 (rmnet) */ + .driver_info = RSVD(0) | NCTRL(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a9, 0xff), /* Telit FN20C04 (rmnet) */ + .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910), .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM),
Greg Kroah-Hartman
maintainerPATCH 115/158 Revert "usb: cdc-wdm: close race between read and workqueue"
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit 1607830dadeefc407e4956336d9fcd9e9defd810 upstream.
This reverts commit 339f83612f3a569b194680768b22bf113c26a29d.
It has been found to cause problems in a number of Chromebook devices, so revert the change until it can be brought back in a safe way.
--- drivers/usb/class/cdc-wdm.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
drivers/usb/class/cdc-wdm.c +1 -5
@@ -485,7 +485,6 @@ out_free_mem:static int service_outstanding_interrupt (struct wdm_device *desc) {int rv =0 ; -int used;/* submit read urb only if the device is waiting for it */ if (!desc->resp_count || !--desc->resp_count)
@@ -500,10 +499,7 @@ static int service_outstanding_interrupt goto out; } - used =test_and_set_bit (WDM_RESPONDING , &desc->flags); -if (used) - goto out; - +set_bit (WDM_RESPONDING , &desc->flags);spin_unlock_irq (&desc->iuspin); rv =usb_submit_urb (desc->response,GFP_KERNEL );spin_lock_irq (&desc->iuspin);
Greg Kroah-Hartman
maintainerPATCH 116/158 Revert "mei: vsc: Call wake_up() in the threaded IRQ handler"
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <[email protected]>
commit e3dc66d998d2b0c2734db9ca1d6c94c97349529a upstream.
This reverts commit 058a38acba15fd8e7b262ec6e17c4204cb15f984.
It's not necessary to avoid a spinlock, a sleeping lock on PREEMPT_RT, in an interrupt handler as the interrupt handler itself would be called in a process context if PREEMPT_RT is enabled. So revert the patch.
--- drivers/misc/mei/vsc-tp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/misc/mei/vsc-tp.c +2 -2
@@ -419,6 +419,8 @@ static irqreturn_t vsc_tp_isr(int irq, vatomic_inc (&tp->assert_cnt); +wake_up (&tp->xfer_wait); +return IRQ_WAKE_THREAD ; }
@@ -426,8 +428,6 @@ static irqreturn_t vsc_tp_thread_isr(int {struct vsc_tp *tp = data; -wake_up (&tp->xfer_wait); -if (tp->event_notify) tp->event_notify (tp->event_notify_context);
Greg Kroah-Hartman
maintainerPATCH 117/158 usb: dwc2: host: Fix dereference issue in DDMA completion flow.
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Minas Harutyunyan <[email protected]>
commit eed04fa96c48790c1cce73c8a248e9d460b088f8 upstream.
Fixed variable dereference issue in DDMA completion flow.
--- drivers/usb/dwc2/hcd_ddma.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/dwc2/hcd_ddma.c +3 -1
@@ -867,13 +867,15 @@ static int dwc2_cmpl_host_isoc_dma_desc(struct dwc2_dma_desc *dma_desc;struct dwc2_hcd_iso_packet_desc *frame_desc;u16 frame_desc_idx; -struct urb *usb_urb = qtd->urb->priv; +struct urb *usb_urb;u16 remain =0 ;int rc =0 ;if (!qtd->urb)return -EINVAL ; + usb_urb = qtd->urb->priv; + dma_sync_single_for_cpu(hsotg->dev, qh->desc_list_dma + (idx * sizeof(struct dwc2_dma_desc)), sizeof(struct dwc2_dma_desc),
Greg Kroah-Hartman
maintainerPATCH 118/158 usb: Disable USB3 LPM at shutdown
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kai-Heng Feng <[email protected]>
commit d920a2ed8620be04a3301e1a9c2b7cc1de65f19d upstream.
SanDisks USB3 storage may disapper after system reboot:
usb usb2-port3: link state changexhci_hcd 0000:00:14.0: clear port3 link state change, portsc: 0x2c0 usb usb2-port3: do warm reset, port onlyxhci_hcd 0000:00:14.0: xhci_hub_status_data: stopping usb2 port polling xhci_hcd 0000:00:14.0: Get port status 2-3 read: 0x2b0, return 0x2b0 usb usb2-port3: not warm reset yet, waiting 50msxhci_hcd 0000:00:14.0: Get port status 2-3 read: 0x2f0, return 0x2f0 usb usb2-port3: not warm reset yet, waiting 200ms
...xhci_hcd 0000:00:14.0: Get port status 2-3 read: 0x6802c0, return 0x7002c0 usb usb2-port3: not warm reset yet, waiting 200msxhci_hcd 0000:00:14.0: clear port3 reset change, portsc: 0x4802c0 xhci_hcd 0000:00:14.0: clear port3 warm(BH) reset change, portsc: 0x4002c0 xhci_hcd 0000:00:14.0: clear port3 link state change, portsc: 0x2c0 xhci_hcd 0000:00:14.0: Get port status 2-3 read: 0x2c0, return 0x2c0 usb usb2-port3: not enabled, trying warm reset again...
This is due to the USB device still cause port change event after xHCI is shuted down:
xhci_hcd 0000:38:00.0: // Setting command ring address to 0xffffe001 xhci_hcd 0000:38:00.0: xhci_resume: starting usb3 port polling. xhci_hcd 0000:38:00.0: xhci_hub_status_data: stopping usb4 port polling xhci_hcd 0000:38:00.0: xhci_hub_status_data: stopping usb3 port polling xhci_hcd 0000:38:00.0: hcd_pci_runtime_resume: 0xhci_hcd 0000:38:00.0: xhci_shutdown: stopping usb3 port polling. xhci_hcd 0000:38:00.0: // Halt the HCxhci_hcd 0000:38:00.0: xhci_shutdown completed - status = 1 xhci_hcd 0000:00:14.0: xhci_shutdown: stopping usb1 port polling. xhci_hcd 0000:00:14.0: // Halt the HCxhci_hcd 0000:00:14.0: xhci_shutdown completed - status = 1 xhci_hcd 0000:00:14.0: Get port status 2-3 read: 0x1203, return 0x203 xhci_hcd 0000:00:14.0: set port reset, actual port 2-3 status = 0x1311 xhci_hcd 0000:00:14.0: Get port status 2-3 read: 0x201203, return 0x100203 xhci_hcd 0000:00:14.0: clear port3 reset change, portsc: 0x1203 xhci_hcd 0000:00:14.0: clear port3 warm(BH) reset change, portsc: 0x1203 xhci_hcd 0000:00:14.0: clear port3 link state change, portsc: 0x1203 xhci_hcd 0000:00:14.0: clear port3 connect change, portsc: 0x1203 xhci_hcd 0000:00:14.0: Get port status 2-3 read: 0x1203, return 0x203 usb 2-3: device not accepting address 2, error -108xhci_hcd 0000:00:14.0: xHCI dying or halted, can't queue_command xhci_hcd 0000:00:14.0: Set port 2-3 link state, portsc: 0x1203, write 0x11261 xhci_hcd 0000:00:14.0: Get port status 2-3 read: 0x1263, return 0x263 xhci_hcd 0000:00:14.0: set port reset, actual port 2-3 status = 0x1271 xhci_hcd 0000:00:14.0: Get port status 2-3 read: 0x12b1, return 0x2b1 usb usb2-port3: not reset yet, waiting 60ms
ACPI: PM: Preparing to enter system sleep state S5xhci_hcd 0000:00:14.0: Get port status 2-3 read: 0x12f1, return 0x2f1 usb usb2-port3: not reset yet, waiting 200ms
reboot: Restarting system
The port change event is caused by LPM transition, so disabling LPM at shutdown to make sure the device is in U0 for warmboot.
--- drivers/usb/core/port.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/core/port.c +3 -1
@@ -448,8 +448,10 @@ static void usb_port_shutdown(struct dev {struct usb_port *port_dev =to_usb_port (dev); -if (port_dev->child) +if (port_dev->child) {usb_disable_usb2_hardware_lpm (port_dev->child); +usb_unlocked_disable_lpm (port_dev->child); + } }static const struct dev_pm_ops usb_port_pm_ops = {
Greg Kroah-Hartman
maintainerPATCH 119/158 usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Norihiko Hama <[email protected]>
commit 6334b8e4553cc69f51e383c9de545082213d785e upstream.
When ncm function is working and then stop usb0 interface for link down, eth_stop() is called. At this piont, accidentally if usb transport error should happen in usb_ep_enable(), 'in_ep' and/or 'out_ep' may not be enabled.
After that, ncm_disable() is called to disable for ncm unbind but gether_disconnect() is never called since 'in_ep' is not enabled.
As the result, ncm object is released in ncm unbind but 'dev->port_usb' associated to 'ncm->port' is not NULL.
And when ncm bind again to recover netdev, ncm object is reallocated but usb0 interface is already associated to previous released ncm object.
Therefore, once usb0 interface is up and eth_start_xmit() is called, released ncm object is dereferrenced and it might cause use-after-free memory.
[function unlink via configfs]
usb0: eth_stop dev->port_usb=ffffff9b179c3200
--> error happens in usb_ep_enable().
NCM: ncm_disable: ncm=ffffff9b179c3200
--> no gether_disconnect() since ncm->port.in_ep->enabled is false.
NCM: ncm_unbind: ncm unbind ncm=ffffff9b179c3200
NCM: ncm_free: ncm free ncm=ffffff9b179c3200 <-- released ncm
[function link via configfs]
NCM: ncm_alloc: ncm alloc ncm=ffffff9ac4f8a000
NCM: ncm_bind: ncm bind ncm=ffffff9ac4f8a000
NCM: ncm_set_alt: ncm=ffffff9ac4f8a000 alt=0
usb0: eth_open dev->port_usb=ffffff9b179c3200 <-- previous released ncm
usb0: eth_start dev->port_usb=ffffff9b179c3200 <-- eth_start_xmit()
--> dev->wrap()
Unable to handle kernel paging request at virtual address dead00000000014f
This patch addresses the issue by checking if 'ncm->netdev' is not NULL at ncm_disable() to call gether_disconnect() to deassociate 'dev->port_usb'. It's more reasonable to check 'ncm->netdev' to call gether_connect/disconnect rather than check 'ncm->port.in_ep->enabled' since it might not be enabled but the gether connection might be established.
--- drivers/usb/gadget/function/f_ncm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/usb/gadget/function/f_ncm.c +2 -2
@@ -878,7 +878,7 @@ static int ncm_set_alt(struct usb_functiif (alt >1 ) goto fail; -if (ncm->port.in_ep->enabled) { +if (ncm->netdev) {DBG (cdev,"reset ncm\n" ); ncm->netdev =NULL ;gether_disconnect (&ncm->port);
@@ -1367,7 +1367,7 @@ static void ncm_disable(struct usb_functDBG (cdev,"ncm deactivated\n" ); -if (ncm->port.in_ep->enabled) { +if (ncm->netdev) { ncm->netdev =NULL ;gether_disconnect (&ncm->port); }
Greg Kroah-Hartman
maintainerPATCH 120/158 usb: typec: tcpm: Correct the PDO counting in pd_set
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kyle Tso <[email protected]>
commit c4128304c2169b4664ed6fb6200f228cead2ab70 upstream.
Off-by-one errors happen because nr_snk_pdo and nr_src_pdo are incorrectly added one. The index of the loop is equal to the number of PDOs to be updated when leaving the loop and it doesn't need to be added one.
When doing the power negotiation, TCPM relies on the "nr_snk_pdo" as the size of the local sink PDO array to match the Source capabilities of the partner port. If the off-by-one overflow occurs, a wrong RDO might be sent and unexpected power transfer might happen such as over voltage or over current (than expected).
"nr_src_pdo" is used to set the Rp level when the port is in Source role. It is also the array size of the local Source capabilities when filling up the buffer which will be sent as the Source PDOs (such as in Power Negotiation). If the off-by-one overflow occurs, a wrong Rp level might be set and wrong Source PDOs will be sent to the partner port. This could potentially cause over current or port resets.
--- drivers/usb/typec/tcpm/tcpm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/usb/typec/tcpm/tcpm.c +2 -2
@@ -6111,14 +6111,14 @@ static int tcpm_pd_set(struct typec_portif (data->sink_desc.pdo[0 ]) {for (i =0 ; i <PDO_MAX_OBJECTS && data->sink_desc.pdo[i]; i++) port->snk_pdo[i] = data->sink_desc.pdo[i]; - port->nr_snk_pdo = i +1 ; + port->nr_snk_pdo = i; port->operating_snk_mw = data->operating_snk_mw; }if (data->source_desc.pdo[0 ]) {for (i =0 ; i <PDO_MAX_OBJECTS && data->source_desc.pdo[i]; i++) port->src_pdo[i] = data->source_desc.pdo[i]; - port->nr_src_pdo = i +1 ; + port->nr_src_pdo = i; }switch (port->state) {
Greg Kroah-Hartman
maintainerPATCH 121/158 mei: vsc: Unregister interrupt handler for system suspend
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <[email protected]>
commit f6085a96c97387154be7eaebd1a5420eb3cd55dc upstream.
Unregister the MEI VSC interrupt handler before system suspend and re-register it at system resume time. This mirrors implementation of other MEI devices.
This patch fixes the bug that causes continuous stream of MEI VSC errors after system resume.
--- drivers/misc/mei/platform-vsc.c | 17 +++++++- drivers/misc/mei/vsc-tp.c | 84 ++++++++++++++++++++++++++++------------ drivers/misc/mei/vsc-tp.h | 3 + 3 files changed, 78 insertions(+), 26 deletions(-)
drivers/misc/mei/platform-vsc.c +16 -1
@@ -402,25 +402,40 @@ static int mei_vsc_remove(struct platforstatic int mei_vsc_suspend (struct device *dev) {struct mei_device *mei_dev =dev_get_drvdata (dev); +struct mei_vsc_hw *hw =mei_dev_to_vsc_hw (mei_dev);mei_stop (mei_dev); +mei_disable_interrupts (mei_dev); + +vsc_tp_free_irq (hw->tp); +return 0 ; }static int mei_vsc_resume (struct device *dev) {struct mei_device *mei_dev =dev_get_drvdata (dev); +struct mei_vsc_hw *hw =mei_dev_to_vsc_hw (mei_dev);int ret; - ret =mei_restart (mei_dev); + ret =vsc_tp_request_irq (hw->tp);if (ret)return ret; + ret =mei_restart (mei_dev); +if (ret) + goto err_free; +/* start timer if stopped in suspend */ schedule_delayed_work (&mei_dev->timer_work,HZ );return 0 ; + +err_free: +vsc_tp_free_irq (hw->tp); + +return ret; } static DEFINE_SIMPLE_DEV_PM_OPS(mei_vsc_pm_ops, mei_vsc_suspend, mei_vsc_resume);
drivers/misc/mei/vsc-tp.c +59 -25
120 lines not on this page · raw message
drivers/misc/mei/vsc-tp.h +3 -0
@@ -37,6 +37,9 @@ int vsc_tp_xfer(struct vsc_tp *tp, u8 cmint vsc_tp_register_event_cb (struct vsc_tp *tp,vsc_tp_event_cb_t event_cb,void *context); +int vsc_tp_request_irq (struct vsc_tp *tp); +void vsc_tp_free_irq (struct vsc_tp *tp); +void vsc_tp_intr_enable (struct vsc_tp *tp);void vsc_tp_intr_disable (struct vsc_tp *tp);void vsc_tp_intr_synchronize (struct vsc_tp *tp);
Greg Kroah-Hartman
maintainerPATCH 122/158 mei: me: disable RPL-S on SPS and IGN firmwares
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Usyskin <[email protected]>
commit 0dc04112bee6fdd6eb847ccb32214703022c0269 upstream.
Extend the quirk to disable MEI interface on Intel PCH Ignition (IGN) and SPS firmwares for RPL-S devices. These firmwares do not support the MEI protocol.
--- drivers/misc/mei/pci-me.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/misc/mei/pci-me.c +1 -1
@@ -116,7 +116,7 @@ static const struct pci_device_id mei_me {MEI_PCI_DEVICE(MEI_DEV_ID_ADP_P, MEI_ME_PCH15_CFG)}, {MEI_PCI_DEVICE(MEI_DEV_ID_ADP_N, MEI_ME_PCH15_CFG)}, - {MEI_PCI_DEVICE(MEI_DEV_ID_RPL_S, MEI_ME_PCH15_CFG)}, + {MEI_PCI_DEVICE(MEI_DEV_ID_RPL_S, MEI_ME_PCH15_SPS_CFG)}, {MEI_PCI_DEVICE(MEI_DEV_ID_MTL_M, MEI_ME_PCH15_CFG)}, {MEI_PCI_DEVICE(MEI_DEV_ID_ARL_S, MEI_ME_PCH15_CFG)},
Greg Kroah-Hartman
maintainerPATCH 123/158 speakup: Avoid crash on very long word
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Thibault <[email protected]>
commit c8d2f34ea96ea3bce6ba2535f867f0d4ee3b22e1 upstream.
In case a console is set up really large and contains a really long word (> 256 characters), we have to stop before the length of the word buffer.
--- drivers/accessibility/speakup/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/accessibility/speakup/main.c +1 -1
@@ -574,7 +574,7 @@ static u_long get_word(struct vc_data *v } attr_ch =get_char (vc, (u_short *)tmp_pos, &spk_attr); buf[cnt++] = attr_ch; -while (tmpx < vc->vc_cols -1 ) { +while (tmpx < vc->vc_cols -1 && cnt <sizeof (buf) -1 ) { tmp_pos +=2 ; tmpx++; ch =get_char (vc, (u_short *)tmp_pos, &temp);
Greg Kroah-Hartman
maintainerPATCH 124/158 fs: sysfs: Fix reference leak in sysfs_break_active_protection()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit a90bca2228c0646fc29a72689d308e5fe03e6d78 upstream.
The sysfs_break_active_protection() routine has an obvious reference leak in its error path. If the call to kernfs_find_and_get() fails then kn will be NULL, so the companion sysfs_unbreak_active_protection() routine won't get called (and would only cause an access violation by trying to dereference kn->parent if it was called). As a result, the reference to kobj acquired at the start of the function will never be released.
Fix the leak by adding an explicit kobject_put() call when kn is NULL.
--- fs/sysfs/file.c | 2 ++ 1 file changed, 2 insertions(+)
fs/sysfs/file.c +2 -0
@@ -463,6 +463,8 @@ struct kernfs_node *sysfs_break_active_p kn =kernfs_find_and_get (kobj->sd, attr->name);if (kn)kernfs_break_active_protection (kn); +else +kobject_put (kobj);return kn; }EXPORT_SYMBOL_GPL (sysfs_break_active_protection);
Greg Kroah-Hartman
maintainerPATCH 125/158 sched: Add missing memory barrier in switch_mm_cid
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathieu Desnoyers <[email protected]>
commit fe90f3967bdb3e13f133e5f44025e15f943a99c5 upstream.
Many architectures' switch_mm() (e.g. arm64) do not have an smp_mb() which the core scheduler code has depended upon since commit:
commit 223baf9d17f25 ("sched: Fix performance regression introduced by mm_cid")
If switch_mm() doesn't call smp_mb(), sched_mm_cid_remote_clear() can unset the actively used cid when it fails to observe active task after it sets lazy_put.
There *is* a memory barrier between storing to rq->curr and _return to userspace_ (as required by membarrier), but the rseq mm_cid has stricter
requirements: the barrier needs to be issued between store to rq->curr and switch_mm_cid(), which happens earlier than:
- spin_unlock(),
- switch_to().
So it's fine when the architecture switch_mm() happens to have that barrier already, but less so when the architecture only provides the full barrier in switch_to() or spin_unlock().
It is a bug in the rseq switch_mm_cid() implementation. All architectures that don't have memory barriers in switch_mm(), but rather have the full barrier either in finish_lock_switch() or switch_to() have them too late for the needs of switch_mm_cid().
Introduce a new smp_mb__after_switch_mm(), defined as smp_mb() in the generic barrier.h header, and use it in switch_mm_cid() for scheduler transitions where switch_mm() is expected to provide a memory barrier.
Architectures can override smp_mb__after_switch_mm() if their switch_mm() implementation provides an implicit memory barrier. Override it with a no-op on x86 which implicitly provide this memory barrier by writing to CR3.
--- arch/x86/include/asm/barrier.h | 3 +++ include/asm-generic/barrier.h | 8 ++++++++ kernel/sched/sched.h | 20 ++++++++++++++------ 3 files changed, 25 insertions(+), 6 deletions(-)
arch/x86/include/asm/barrier.h +3 -0
@@ -79,6 +79,9 @@ do { \#define __smp_mb__before_atomic () do { } while (0)#define __smp_mb__after_atomic () do { } while (0) +/* Writing to CR3 provides a full memory barrier in switch_mm(). */ +#define smp_mb__after_switch_mm () do { } while (0) +#include <asm-generic/barrier.h> #endif /* _ASM_X86_BARRIER_H */
include/asm-generic/barrier.h +8 -0
@@ -296,5 +296,13 @@ do { \#define io_stop_wc () do { } while (0)#endif +/* +* Architectures that guarantee an implicit smp_mb() in switch_mm() +* can override smp_mb__after_switch_mm. +*/ +#ifndef smp_mb__after_switch_mm +# define smp_mb__after_switch_mm () smp_mb() +#endif +#endif /* !__ASSEMBLY__ */ #endif /* __ASM_GENERIC_BARRIER_H */
kernel/sched/sched.h +14 -6
@@ -79,6 +79,8 @@# include <asm/paravirt_api_clock.h> #endif +#include <asm/barrier.h> +#include "cpupri.h" #include "cpudeadline.h"
@@ -3445,13 +3447,19 @@ static inline void switch_mm_cid(struct* between rq->curr store and load of {prev,next}->mm->pcpu_cid[cpu]. * Provide it here. */ -if (!prev->mm)// from kernel +if (!prev->mm) {// from kernel smp_mb (); -/* -* user -> user transition guarantees a memory barrier through -* switch_mm() when current->mm changes. If current->mm is -* unchanged, no barrier is needed. -*/ + }else {// from user +/* +* user->user transition relies on an implicit +* memory barrier in switch_mm() when +* current->mm changes. If the architecture +* switch_mm() does not have an implicit memory +* barrier, it is emitted here. If current->mm +* is unchanged, no barrier is needed. +*/ +smp_mb__after_switch_mm (); + } }if (prev->mm_cid_active) {mm_cid_snapshot_time (rq, prev->mm);
Greg Kroah-Hartman
maintainerPATCH 126/158 KVM: x86: Snapshot if a vCPUs vendor model is AMD vs. Intel compatible
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit fd706c9b1674e2858766bfbf7430534c2b26fbef upstream.
Add kvm_vcpu_arch.is_amd_compatible to cache if a vCPU's vendor model is compatible with AMD, i.e. if the vCPU vendor is AMD or Hygon, along with helpers to check if a vCPU is compatible AMD vs. Intel. To handle Intel vs. AMD behavior related to masking the LVTPC entry, KVM will need to check for vendor compatibility on every PMI injection, i.e. querying for AMD will soon be a moderately hot path.
Note! This subtly (or maybe not-so-subtly) makes "Intel compatible" KVM's default behavior, both if userspace omits (or never sets) CPUID 0x0 and if userspace sets a completely unknown vendor. One could argue that KVM should treat such vCPUs as not being compatible with Intel *or* AMD, but that would add useless complexity to KVM.
KVM needs to do *something* in the face of vendor specific behavior, and so unless KVM conjured up a magic third option, choosing to treat unknown vendors as neither Intel nor AMD means that checks on AMD compatibility would yield Intel behavior, and checks for Intel compatibility would yield AMD behavior. And that's far worse as it would effectively yield random behavior depending on whether KVM checked for AMD vs. Intel vs. !AMD vs. !Intel. And practically speaking, all x86 CPUs follow either Intel or AMD architecture, i.e. "supporting" an unknown third architecture adds no value.
Deliberately don't convert any of the existing guest_cpuid_is_intel() checks, as the Intel side of things is messier due to some flows explicitly checking for exactly vendor==Intel, versus some flows assuming anything that isn't "AMD compatible" gets Intel behavior. The Intel code will be cleaned up in the future.
Message-ID: <[email protected]>
--- arch/x86/include/asm/kvm_host.h | 1 + arch/x86/kvm/cpuid.c | 1 + arch/x86/kvm/cpuid.h | 10 ++++++++++ arch/x86/kvm/mmu/mmu.c | 2 +- arch/x86/kvm/x86.c | 2 +- 5 files changed, 14 insertions(+), 2 deletions(-)
arch/x86/include/asm/kvm_host.h +1 -0
@@ -854,6 +854,7 @@ struct kvm_vcpu_arch {int cpuid_nent;struct kvm_cpuid_entry2 *cpuid_entries;struct kvm_hypervisor_cpuid kvm_cpuid; +bool is_amd_compatible;/* * FIXME: Drop this macro and use KVM_NR_GOVERNED_FEATURES directly
arch/x86/kvm/cpuid.c +1 -0
@@ -366,6 +366,7 @@ static void kvm_vcpu_after_set_cpuid(strkvm_update_pv_runtime (vcpu); + vcpu->arch.is_amd_compatible =guest_cpuid_is_amd_or_hygon (vcpu); vcpu->arch.maxphyaddr =cpuid_query_maxphyaddr (vcpu); vcpu->arch.reserved_gpa_bits =kvm_vcpu_reserved_gpa_bits_raw (vcpu);
arch/x86/kvm/cpuid.h +10 -0
@@ -120,6 +120,16 @@ static inline bool guest_cpuid_is_intel(return best &&is_guest_vendor_intel (best->ebx, best->ecx, best->edx); } +static inline bool guest_cpuid_is_amd_compatible (struct kvm_vcpu *vcpu) +{ +return vcpu->arch.is_amd_compatible; +} + +static inline bool guest_cpuid_is_intel_compatible (struct kvm_vcpu *vcpu) +{ +return !guest_cpuid_is_amd_compatible (vcpu); +} +static inline int guest_cpuid_family (struct kvm_vcpu *vcpu) {struct kvm_cpuid_entry2 *best;
arch/x86/kvm/mmu/mmu.c +1 -1
@@ -4922,7 +4922,7 @@ static void reset_guest_rsvds_bits_mask( context->cpu_role.base.level,is_efer_nx (context),guest_can_use (vcpu,X86_FEATURE_GBPAGES ),is_cr4_pse (context), - guest_cpuid_is_amd_or_hygon(vcpu)); + guest_cpuid_is_amd_compatible(vcpu)); } static void __reset_rsvds_bits_mask_ept(struct rsvd_bits_validate *rsvd_check,
arch/x86/kvm/x86.c +1 -1
@@ -3422,7 +3422,7 @@ static bool is_mci_status_msr(u32 msr)static bool can_set_mci_status (struct kvm_vcpu *vcpu) {/* McStatusWrEn enabled? */ -if (guest_cpuid_is_amd_or_hygon (vcpu)) +if (guest_cpuid_is_amd_compatible (vcpu))return !!(vcpu->arch.msr_hwcr &BIT_ULL (18 ));return false;
Greg Kroah-Hartman
maintainerPATCH 127/158 KVM: x86/pmu: Disable support for adaptive PEBS
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit 9e985cbf2942a1bb8fcef9adc2a17d90fd7ca8ee upstream.
Drop support for virtualizing adaptive PEBS, as KVM's implementation is architecturally broken without an obvious/easy path forward, and because exposing adaptive PEBS can leak host LBRs to the guest, i.e. can leak host kernel addresses to the guest.
Bug #1 is that KVM doesn't account for the upper 32 bits of IA32_FIXED_CTR_CTRL when (re)programming fixed counters, e.g fixed_ctrl_field() drops the upper bits, reprogram_fixed_counters() stores local variables as u8s and truncates the upper bits too, etc.
Bug #2 is that, because KVM _always_ sets precise_ip to a non-zero value for PEBS events, perf will _always_ generate an adaptive record, even if the guest requested a basic record. Note, KVM will also enable adaptive PEBS in individual *counter*, even if adaptive PEBS isn't exposed to the guest, but this is benign as MSR_PEBS_DATA_CFG is guaranteed to be zero, i.e. the guest will only ever see Basic records.
Bug #3 is in perf. intel_pmu_disable_fixed() doesn't clear the upper bits either, i.e. leaves ICL_FIXED_0_ADAPTIVE set, and intel_pmu_enable_fixed() effectively doesn't clear ICL_FIXED_0_ADAPTIVE either. I.e. perf _always_ enables ADAPTIVE counters, regardless of what KVM requests.
Bug #4 is that adaptive PEBS *might* effectively bypass event filters set by the host, as "Updated Memory Access Info Group" records information that might be disallowed by userspace via KVM_SET_PMU_EVENT_FILTER.
Bug #5 is that KVM doesn't ensure LBR MSRs hold guest values (or at least zeros) when entering a vCPU with adaptive PEBS, which allows the guest to read host LBRs, i.e. host RIPs/addresses, by enabling "LBR Entries" records.
Disable adaptive PEBS support as an immediate fix due to the severity of the LBR leak in particular, and because fixing all of the bugs will be non-trivial, e.g. not suitable for backporting to stable kernels.
Note! This will break live migration, but trying to make KVM play nice with live migration would be quite complicated, wouldn't be guaranteed to work (i.e. KVM might still kill/confuse the guest), and it's not clear that there are any publicly available VMMs that support adaptive PEBS, let alone live migrate VMs that support adaptive PEBS, e.g. QEMU doesn't support PEBS in any capacity.
--- arch/x86/kvm/vmx/vmx.c | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-)
arch/x86/kvm/vmx/vmx.c +22 -2
@@ -7857,8 +7857,28 @@ static u64 vmx_get_perf_capabilities(voiif (vmx_pebs_supported ()) { perf_cap |= host_perf_cap &PERF_CAP_PEBS_MASK ; -if ((perf_cap &PERF_CAP_PEBS_FORMAT ) <4 ) - perf_cap &= ~PERF_CAP_PEBS_BASELINE ; + +/* +* Disallow adaptive PEBS as it is functionally broken, can be +* used by the guest to read *host* LBRs, and can be used to +* bypass userspace event filters. To correctly and safely +* support adaptive PEBS, KVM needs to: +* +* 1. Account for the ADAPTIVE flag when (re)programming fixed +* counters. +* +* 2. Gain support from perf (or take direct control of counter +* programming) to support events without adaptive PEBS +* enabled for the hardware counter. +* +* 3. Ensure LBR MSRs cannot hold host data on VM-Entry with +* adaptive PEBS enabled and MSR_PEBS_DATA_CFG.LBRS=1. +* +* 4. Document which PMU events are effectively exposed to the +* guest via adaptive PEBS, and make adaptive PEBS mutually +* exclusive with KVM_SET_PMU_EVENT_FILTER if necessary. +*/ + perf_cap &= ~PERF_CAP_PEBS_BASELINE ; }return perf_cap;
Greg Kroah-Hartman
maintainerPATCH 128/158 KVM: x86/pmu: Do not mask LVTPC when handling a PMI on AMD platforms
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sandipan Das <[email protected]>
commit 49ff3b4aec51e3abfc9369997cc603319b02af9a upstream.
On AMD and Hygon platforms, the local APIC does not automatically set the mask bit of the LVTPC register when handling a PMI and there is no need to clear it in the kernel's PMI handler.
For guests, the mask bit is currently set by kvm_apic_local_deliver() and unless it is cleared by the guest kernel's PMI handler, PMIs stop arriving and break use-cases like sampling with perf record.
This does not affect non-PerfMonV2 guests because PMIs are handled in the guest kernel by x86_pmu_handle_irq() which always clears the LVTPC mask bit irrespective of the vendor.
Before:
$ perf record -e cycles:u true [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.001 MB perf.data (1 samples) ]
After:
$ perf record -e cycles:u true [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.002 MB perf.data (19 samples) ]
Message-ID: <[email protected]>
--- arch/x86/kvm/lapic.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/x86/kvm/lapic.c +2 -1
@@ -2771,7 +2771,8 @@ int kvm_apic_local_deliver(struct kvm_la trig_mode = reg &APIC_LVT_LEVEL_TRIGGER ; r =__apic_accept_irq (apic, mode, vector,1 , trig_mode,NULL ); -if (r && lvt_type ==APIC_LVTPC ) +if (r && lvt_type ==APIC_LVTPC && +guest_cpuid_is_intel_compatible (apic->vcpu))kvm_lapic_set_reg (apic,APIC_LVTPC , reg |APIC_LVT_MASKED );return r; }
Greg Kroah-Hartman
maintainerPATCH 129/158 KVM: x86/mmu: x86: Dont overflow lpage_info when checking attributes
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rick Edgecombe <[email protected]>
commit 992b54bd083c5bee24ff7cc35991388ab08598c4 upstream.
Fix KVM_SET_MEMORY_ATTRIBUTES to not overflow lpage_info array and trigger KASAN splat, as seen in the private_mem_conversions_test selftest.
When memory attributes are set on a GFN range, that range will have specific properties applied to the TDP. A huge page cannot be used when the attributes are inconsistent, so they are disabled for those the specific huge pages. For internal KVM reasons, huge pages are also not allowed to span adjacent memslots regardless of whether the backing memory could be mapped as huge.
What GFNs support which huge page sizes is tracked by an array of arrays 'lpage_info' on the memslot, of ‘kvm_lpage_info’ structs. Each index of lpage_info contains a vmalloc allocated array of these for a specific supported page size. The kvm_lpage_info denotes whether a specific huge page (GFN and page size) on the memslot is supported. These arrays include indices for unaligned head and tail huge pages.
Preventing huge pages from spanning adjacent memslot is covered by incrementing the count in head and tail kvm_lpage_info when the memslot is allocated, but disallowing huge pages for memory that has mixed attributes has to be done in a more complicated way. During the KVM_SET_MEMORY_ATTRIBUTES ioctl KVM updates lpage_info for each memslot in the range that has mismatched attributes. KVM does this a memslot at a time, and marks a special bit, KVM_LPAGE_MIXED_FLAG, in the kvm_lpage_info for any huge page. This bit is essentially a permanently elevated count. So huge pages will not be mapped for the GFN at that page size if the count is elevated in either case: a huge head or tail page unaligned to the memslot or if KVM_LPAGE_MIXED_FLAG is set because it has mixed attributes.
To determine whether a huge page has consistent attributes, the KVM_SET_MEMORY_ATTRIBUTES operation checks an xarray to make sure it consistently has the incoming attribute. Since level - 1 huge pages are aligned to level huge pages, it employs an optimization. As long as the level - 1 huge pages are checked first, it can just check these and assume that if each level - 1 huge page contained within the level sized huge page is not mixed, then the level size huge page is not mixed. This optimization happens in the helper hugepage_has_attrs().
Unfortunately, although the kvm_lpage_info array representing page size 'level' will contain an entry for an unaligned tail page of size level, the array for level - 1 will not contain an entry for each GFN at page size level. The level - 1 array will only contain an index for any unaligned region covered by level - 1 huge page size, which can be a smaller region. So this causes the optimization to overflow the level - 1 kvm_lpage_info and perform a vmalloc out of bounds read.
In some cases of head and tail pages where an overflow could happen, callers skip the operation completely as KVM_LPAGE_MIXED_FLAG is not required to prevent huge pages as discussed earlier. But for memslots that are smaller than the 1GB page size, it does call hugepage_has_attrs(). In this case the huge page is both the head and tail page. The issue can be observed simply by compiling the kernel with CONFIG_KASAN_VMALLOC and running the selftest “private_mem_conversions_test”, which produces the output like the following:
BUG: KASAN: vmalloc-out-of-bounds in hugepage_has_attrs+0x7e/0x110 Read of size 4 at addr ffffc900000a3008 by task private_mem_con/169 Call Trace: dump_stack_lvl print_report ? __virt_addr_valid ? hugepage_has_attrs ? hugepage_has_attrs kasan_report ? hugepage_has_attrs hugepage_has_attrs kvm_arch_post_set_memory_attributes kvm_vm_ioctl
It is a little ambiguous whether the unaligned head page (in the bug case also the tail page) should be expected to have KVM_LPAGE_MIXED_FLAG set. It is not functionally required, as the unaligned head/tail pages will already have their kvm_lpage_info count incremented. The comments imply not setting it on unaligned head pages is intentional, so fix the callers to skip trying to set KVM_LPAGE_MIXED_FLAG in this case, and in doing so not call hugepage_has_attrs().
--- arch/x86/kvm/mmu/mmu.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/x86/kvm/mmu/mmu.c +2 -1
@@ -7388,7 +7388,8 @@ bool kvm_arch_post_set_memory_attributes* by the memslot, KVM can't use a hugepage due to the * misaligned address regardless of memory attributes. */ -if (gfn >= slot->base_gfn) { +if (gfn >= slot->base_gfn && + gfn + nr_pages <= slot->base_gfn + slot->npages) {if (hugepage_has_attrs (kvm, slot, gfn, level, attrs))hugepage_clear_mixed (slot, gfn, level);else
Greg Kroah-Hartman
maintainerPATCH 130/158 KVM: x86/mmu: Write-protect L2 SPTEs in TDP MMU when clearing dirty status
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Matlack <[email protected]>
commit 2673dfb591a359c75080dd5af3da484b89320d22 upstream.
Check kvm_mmu_page_ad_need_write_protect() when deciding whether to write-protect or clear D-bits on TDP MMU SPTEs, so that the TDP MMU accounts for any role-specific reasons for disabling D-bit dirty logging.
Specifically, TDP MMU SPTEs must be write-protected when the TDP MMU is being used to run an L2 (i.e. L1 has disabled EPT) and PML is enabled. KVM always disables PML when running L2, even when L1 and L2 GPAs are in the some domain, so failing to write-protect TDP MMU SPTEs will cause writes made by L2 to not be reflected in the dirty log.
--- arch/x86/kvm/mmu/tdp_mmu.c | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-)
arch/x86/kvm/mmu/tdp_mmu.c +16 -5
@@ -1498,6 +1498,16 @@ void kvm_tdp_mmu_try_split_huge_pages(st } } +static bool tdp_mmu_need_write_protect (struct kvm_mmu_page *sp) +{ +/* +* All TDP MMU shadow pages share the same role as their root, aside +* from level, so it is valid to key off any shadow page to determine if +* write protection is needed for an entire tree. +*/ +return kvm_mmu_page_ad_need_write_protect (sp) || !kvm_ad_enabled (); +} +/* * Clear the dirty status of all the SPTEs mapping GFNs in the memslot. If * AD bits are enabled, this will involve clearing the dirty bit on each SPTE.
@@ -1508,7 +1518,8 @@ void kvm_tdp_mmu_try_split_huge_pages(ststatic bool clear_dirty_gfn_range (struct kvm *kvm,struct kvm_mmu_page *root,gfn_t start,gfn_t end) { -u64 dbit =kvm_ad_enabled () ? shadow_dirty_mask :PT_WRITABLE_MASK ; +const u64 dbit =tdp_mmu_need_write_protect (root) ?PT_WRITABLE_MASK : + shadow_dirty_mask;struct tdp_iter iter;bool spte_set = false;
@@ -1523,7 +1534,7 @@ retry:if (tdp_mmu_iter_cond_resched (kvm, &iter, false, true))continue ; -KVM_MMU_WARN_ON (kvm_ad_enabled () && +KVM_MMU_WARN_ON (dbit == shadow_dirty_mask &&spte_ad_need_write_protect (iter.old_spte));if (!(iter.old_spte & dbit))
@@ -1570,8 +1581,8 @@ bool kvm_tdp_mmu_clear_dirty_slot(structstatic void clear_dirty_pt_masked (struct kvm *kvm,struct kvm_mmu_page *root,gfn_t gfn,unsigned long mask,bool wrprot) { -u64 dbit = (wrprot || !kvm_ad_enabled ()) ?PT_WRITABLE_MASK : - shadow_dirty_mask; +const u64 dbit = (wrprot ||tdp_mmu_need_write_protect (root)) ?PT_WRITABLE_MASK : + shadow_dirty_mask;struct tdp_iter iter;lockdep_assert_held_write (&kvm->mmu_lock);
@@ -1583,7 +1594,7 @@ static void clear_dirty_pt_masked(structif (!mask)break ; -KVM_MMU_WARN_ON (kvm_ad_enabled () && +KVM_MMU_WARN_ON (dbit == shadow_dirty_mask &&spte_ad_need_write_protect (iter.old_spte)); if (iter.level > PG_LEVEL_4K ||
Greg Kroah-Hartman
maintainerPATCH 131/158 arm64/head: Disable MMU at EL2 before clearing HCR_EL2.E2H
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <[email protected]>
commit 34e526cb7d46726b2ae5f83f2892d00ebb088509 upstream.
Even though the boot protocol stipulates otherwise, an exception has been made for the EFI stub, and entering the core kernel with the MMU enabled is permitted. This allows a substantial amount of cache maintenance to be elided, wich is significant when fast boot times are critical (e.g., for booting micro-VMs)
Once the initial ID map has been populated, the MMU is disabled as part of the logic sequence that puts all system registers into a known state. Any code that needs to execute within the window where the MMU is off is cleaned to the PoC explicitly, which includes all of HYP text when entering at EL2.
However, the current sequence of initializing the EL2 system registers is not safe: HCR_EL2 is set to its nVHE initial state before SCTLR_EL2 is reprogrammed, and this means that a VHE-to-nVHE switch may occur while the MMU is enabled. This switch causes some system registers as well as page table descriptors to be interpreted in a different way, potentially resulting in spurious exceptions relating to MMU translation.
So disable the MMU explicitly first when entering in EL2 with the MMU and caches enabled.
--- arch/arm64/kernel/head.S | 5 +++++ 1 file changed, 5 insertions(+)
arch/arm64/kernel/head.S +5 -0
@@ -569,6 +569,11 @@ SYM_INNER_LABEL(init_el2, SYM_L_LOCAL) adr_l x1, __hyp_text_end adr_l x2, dcache_clean_poc blr x2 + + mov_q x0, INIT_SCTLR_EL2_MMU_OFF + pre_disable_mmu_workaround + msr sctlr_el2, x0 + isb 0: mov_q x0, HCR_HOST_NVHE_FLAGS msr hcr_el2, x0
Greg Kroah-Hartman
maintainerPATCH 132/158 arm64: hibernate: Fix level3 translation fault in swsusp_save()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yaxiong Tian <[email protected]>
commit 50449ca66cc5a8cbc64749cf4b9f3d3fc5f4b457 upstream.
On arm64 machines, swsusp_save() faults if it attempts to access MEMBLOCK_NOMAP memory ranges. This can be reproduced in QEMU using UEFI when booting with rodata=off debug_pagealloc=off and CONFIG_KFENCE=n:
Unable to handle kernel paging request at virtual address ffffff8000000000
Mem abort info:
ESR = 0x0000000096000007
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x07: level 3 translation fault
Data abort info:
ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000
CM = 0, WnR = 0, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
swapper pgtable: 4k pages, 39-bit VAs, pgdp=00000000eeb0b000
[ffffff8000000000] pgd=180000217fff9803, p4d=180000217fff9803, pud=180000217fff9803, pmd=180000217fff8803, pte=0000000000000000
Internal error: Oops: 0000000096000007 [#1] SMP
Internal error: Oops: 0000000096000007 [#1] SMP
Modules linked in: xt_multiport ipt_REJECT nf_reject_ipv4 xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c iptable_filter bpfilter rfkill at803x snd_hda_codec_hdmi snd_hda_intel snd_intel_dspcfg dwmac_generic stmmac_platform snd_hda_codec stmmac joydev pcs_xpcs snd_hda_core phylink ppdev lp parport ramoops reed_solomon ip_tables x_tables nls_iso8859_1 vfat multipath linear amdgpu amdxcp drm_exec gpu_sched drm_buddy hid_generic usbhid hid radeon video drm_suballoc_helper drm_ttm_helper ttm i2c_algo_bit drm_display_helper cec drm_kms_helper drm
CPU: 0 PID: 3663 Comm: systemd-sleep Not tainted 6.6.2+ #76
Source Version: 4e22ed63a0a48e7a7cff9b98b7806d8d4add7dc0
Hardware name: Greatwall GW-XXXXXX-XXX/GW-XXXXXX-XXX, BIOS KunLun BIOS V4.0 01/19/2021
pstate: 600003c5 (nZCv DAIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : swsusp_save+0x280/0x538
lr : swsusp_save+0x280/0x538
sp : ffffffa034a3fa40
x29: ffffffa034a3fa40 x28: ffffff8000001000 x27: 0000000000000000
x26: ffffff8001400000 x25: ffffffc08113e248 x24: 0000000000000000
x23: 0000000000080000 x22: ffffffc08113e280 x21: 00000000000c69f2
x20: ffffff8000000000 x19: ffffffc081ae2500 x18: 0000000000000000
x17: 6666662074736420 x16: 3030303030303030 x15: 3038666666666666
x14: 0000000000000b69 x13: ffffff9f89088530 x12: 00000000ffffffea
x11: 00000000ffff7fff x10: 00000000ffff7fff x9 : ffffffc08193f0d0
x8 : 00000000000bffe8 x7 : c0000000ffff7fff x6 : 0000000000000001
x5 : ffffffa0fff09dc8 x4 : 0000000000000000 x3 : 0000000000000027
x2 : 0000000000000000 x1 : 0000000000000000 x0 : 000000000000004e
Call trace:
swsusp_save+0x280/0x538
swsusp_arch_suspend+0x148/0x190
hibernation_snapshot+0x240/0x39c
hibernate+0xc4/0x378
state_store+0xf0/0x10c
kobj_attr_store+0x14/0x24The reason is swsusp_save() -> copy_data_pages() -> page_is_saveable() -> kernel_page_present() assuming that a page is always present when can_set_direct_map() is false (all of rodata_full, debug_pagealloc_enabled() and arm64_kfence_can_set_direct_map() false), irrespective of the MEMBLOCK_NOMAP ranges. Such MEMBLOCK_NOMAP regions should not be saved during hibernation.
This problem was introduced by changes to the pfn_valid() logic in commit a7d9f306ba70 ("arm64: drop pfn_valid_within() and simplify pfn_valid()").
Similar to other architectures, drop the !can_set_direct_map() check in kernel_page_present() so that page_is_savable() skips such pages.
--- arch/arm64/mm/pageattr.c | 3 --- 1 file changed, 3 deletions(-)
arch/arm64/mm/pageattr.c +0 -3
@@ -219,9 +219,6 @@ bool kernel_page_present(struct page *papte_t *ptep;unsigned long addr = (unsigned long )page_address (page); -if (!can_set_direct_map ()) -return true; - pgdp =pgd_offset_k (addr);if (pgd_none (READ_ONCE (*pgdp)))return false;
Greg Kroah-Hartman
maintainerPATCH 133/158 init/main.c: Fix potential static_command_line memory overflow
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuntao Wang <[email protected]>
commit 46dad3c1e57897ab9228332f03e1c14798d2d3b9 upstream.
We allocate memory of size 'xlen + strlen(boot_command_line) + 1' for static_command_line, but the strings copied into static_command_line are extra_command_line and command_line, rather than extra_command_line and boot_command_line.
When strlen(command_line) > strlen(boot_command_line), static_command_line will overflow.
This patch just recovers strlen(command_line) which was miss-consolidated with strlen(boot_command_line) in the commit f5c7310ac73e ("init/main: add checks for the return value of memblock_alloc*()")
--- init/main.c | 2 ++ 1 file changed, 2 insertions(+)
init/main.c +2 -0
@@ -635,6 +635,8 @@ static void __init setup_command_line(chif (!saved_command_line)panic ("%s: Failed to allocate %zu bytes\n" , __func__, len + ilen); + len = xlen +strlen (command_line) +1 ; + static_command_line =memblock_alloc (len,SMP_CACHE_BYTES );if (!static_command_line)panic ("%s: Failed to allocate %zu bytes\n" , __func__, len);
Greg Kroah-Hartman
maintainerPATCH 134/158 mm/madvise: make MADV_POPULATE_(READ|WRITE) handle VM_FAULT_RETRY properly
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Hildenbrand <[email protected]>
commit 631426ba1d45a8672b177ee85ad4cabe760dd131 upstream.
Darrick reports that in some cases where pread() would fail with -EIO and mmap()+access would generate a SIGBUS signal, MADV_POPULATE_READ / MADV_POPULATE_WRITE will keep retrying forever and not fail with -EFAULT.
While the madvise() call can be interrupted by a signal, this is not the desired behavior. MADV_POPULATE_READ / MADV_POPULATE_WRITE should behave like page faults in that case: fail and not retry forever.
A reproducer can be found at [1].
The reason is that __get_user_pages(), as called by faultin_vma_page_range(), will not handle VM_FAULT_RETRY in a proper way:
it will simply return 0 when VM_FAULT_RETRY happened, making madvise_populate()->faultin_vma_page_range() retry again and again, never setting FOLL_TRIED->FAULT_FLAG_TRIED for __get_user_pages().
__get_user_pages_locked() does what we want, but duplicating that logic in faultin_vma_page_range() feels wrong.
So let's use __get_user_pages_locked() instead, that will detect VM_FAULT_RETRY and set FOLL_TRIED when retrying, making the fault handler return VM_FAULT_SIGBUS (VM_FAULT_ERROR) at some point, propagating -EFAULT from faultin_page() to __get_user_pages(), all the way to madvise_populate().
But, there is an issue: __get_user_pages_locked() will end up re-taking the MM lock and then __get_user_pages() will do another VMA lookup. In the meantime, the VMA layout could have changed and we'd fail with different error codes than we'd want to.
As __get_user_pages() will currently do a new VMA lookup either way, let it do the VMA handling in a different way, controlled by a new FOLL_MADV_POPULATE flag, effectively moving these checks from madvise_populate() + faultin_page_range() in there.
With this change, Darricks reproducer properly fails with -EFAULT, as documented for MADV_POPULATE_READ / MADV_POPULATE_WRITE.
[1] https://lore.kernel.org/all/20240313171936.GN1927156@frogsfrogsfrogs/
--- mm/gup.c | 54 ++++++++++++++++++++++++++++++++---------------------- mm/internal.h | 10 ++++++---- mm/madvise.c | 17 ++--------------- 3 files changed, 40 insertions(+), 41 deletions(-)
mm/gup.c +32 -22
@@ -1206,6 +1206,22 @@ static long __get_user_pages(struct mm_s/* first iteration or cross vma bound */ if (!vma || start >= vma->vm_end) { +/* +* MADV_POPULATE_(READ|WRITE) wants to handle VMA +* lookups+error reporting differently. +*/ +if (gup_flags &FOLL_MADV_POPULATE ) { + vma =vma_lookup (mm, start); +if (!vma) { + ret = -ENOMEM ; + goto out; + } +if (check_vma_flags (vma, gup_flags)) { + ret = -EINVAL ; + goto out; + } + goto retry; + } vma =gup_vma_lookup (mm, start);if (!vma &&in_gate_area (mm, start)) { ret = get_gate_page(mm, start & PAGE_MASK,
@@ -1683,35 +1699,35 @@ long populate_vma_page_range(struct vm_a }/* -* faultin_vma_page_range() - populate (prefault) page tables inside the -* given VMA range readable/writable +* faultin_page_range() - populate (prefault) page tables inside the +* given range readable/writable * * This takes care of mlocking the pages, too, if VM_LOCKED is set. * -* @vma: target vma +* @mm: the mm to populate page tables in * @start: start address * @end: end address * @write: whether to prefault readable or writable * @locked: whether the mmap_lock is still held * -* Returns either number of processed pages in the vma, or a negative error -* code on error (see __get_user_pages()). +* Returns either number of processed pages in the MM, or a negative error +* code on error (see __get_user_pages()). Note that this function reports +* errors related to VMAs, such as incompatible mappings, as expected by +* MADV_POPULATE_(READ|WRITE). * -* vma->vm_mm->mmap_lock must be held. The range must be page-aligned and -* covered by the VMA. If it's released, *@locked will be set to 0. +* The range must be page-aligned. +* +* mm->mmap_lock must be held. If it's released, *@locked will be set to 0. */ -long faultin_vma_page_range (struct vm_area_struct *vma,unsigned long start, -unsigned long end,bool write,int *locked) +long faultin_page_range (struct mm_struct *mm,unsigned long start, +unsigned long end,bool write,int *locked) { -struct mm_struct *mm = vma->vm_mm;unsigned long nr_pages = (end - start) /PAGE_SIZE ;int gup_flags;long ret;VM_BUG_ON (!PAGE_ALIGNED (start));VM_BUG_ON (!PAGE_ALIGNED (end)); -VM_BUG_ON_VMA (start < vma->vm_start, vma); -VM_BUG_ON_VMA (end > vma->vm_end, vma);mmap_assert_locked (mm);/*
@@ -1723,19 +1739,13 @@ long faultin_vma_page_range(struct vm_ar* a poisoned page. * !FOLL_FORCE: Require proper access permissions. */ - gup_flags =FOLL_TOUCH |FOLL_HWPOISON |FOLL_UNLOCKABLE ; + gup_flags =FOLL_TOUCH |FOLL_HWPOISON |FOLL_UNLOCKABLE | +FOLL_MADV_POPULATE ;if (write) gup_flags |=FOLL_WRITE ; -/* -* We want to report -EINVAL instead of -EFAULT for any permission -* problems or incompatible mappings. -*/ -if (check_vma_flags (vma, gup_flags)) -return -EINVAL ; - - ret =__get_user_pages (mm, start, nr_pages, gup_flags, -NULL , locked); + ret =__get_user_pages_locked (mm, start, nr_pages,NULL , locked, + gup_flags);lru_add_drain ();return ret; }
mm/internal.h +6 -4
@@ -590,9 +590,8 @@ struct anon_vma *folio_anon_vma(struct fvoid unmap_mapping_folio (struct folio *folio);extern long populate_vma_page_range (struct vm_area_struct *vma,unsigned long start,unsigned long end,int *locked); -extern long faultin_vma_page_range (struct vm_area_struct *vma, -unsigned long start,unsigned long end, -bool write,int *locked); +extern long faultin_page_range (struct mm_struct *mm,unsigned long start, +unsigned long end,bool write,int *locked);extern bool mlock_future_ok (struct mm_struct *mm,unsigned long flags,unsigned long bytes);
@@ -1031,10 +1030,13 @@ enum {FOLL_FAST_ONLY =1 <<20 ,/* allow unlocking the mmap lock */ FOLL_UNLOCKABLE =1 <<21 , +/* VMA lookup+checks compatible with MADV_POPULATE_(READ|WRITE) */ + FOLL_MADV_POPULATE = 1 << 22, };#define INTERNAL_GUP_FLAGS (FOLL_TOUCH | FOLL_TRIED | FOLL_REMOTE | FOLL_PIN | \ - FOLL_FAST_ONLY | FOLL_UNLOCKABLE) + FOLL_FAST_ONLY | FOLL_UNLOCKABLE | \ + FOLL_MADV_POPULATE)/* * Indicates for which pages that are write-protected in the page table,
mm/madvise.c +2 -15
@@ -908,27 +908,14 @@ static long madvise_populate(struct vm_a {const bool write = behavior ==MADV_POPULATE_WRITE ;struct mm_struct *mm = vma->vm_mm; -unsigned long tmp_end;int locked =1 ;long pages; *prev = vma;while (start < end) { -/* -* We might have temporarily dropped the lock. For example, -* our VMA might have been split. -*/ -if (!vma || start >= vma->vm_end) { - vma =vma_lookup (mm, start); -if (!vma) -return -ENOMEM ; - } - - tmp_end = min_t(unsigned long, end, vma->vm_end);/* Populate (prefault) page tables readable/writable. */ - pages =faultin_vma_page_range (vma, start, tmp_end, write, - &locked); + pages =faultin_page_range (mm, start, end, write, &locked);if (!locked) {mmap_read_lock (mm); locked =1 ;
@@ -949,7 +936,7 @@ static long madvise_populate(struct vm_apr_warn_once ("%s: unhandled return value: %ld\n" , __func__, pages); fallthrough; -case -ENOMEM : +case -ENOMEM :/* No VMA or out of memory. */ return -ENOMEM ; } }
Greg Kroah-Hartman
maintainerPATCH 135/158 mm/userfaultfd: allow hugetlb change protection upon poison entry
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Xu <[email protected]>
commit c5977c95dff182d6ee06f4d6f60bcb0284912969 upstream.
After UFFDIO_POISON, there can be two kinds of hugetlb pte markers, either the POISON one or UFFD_WP one.
Allow change protection to run on a poisoned marker just like !hugetlb cases, ignoring the marker irrelevant of the permission.
Here the two bits are mutual exclusive. For example, when install a poisoned entry it must not be UFFD_WP already (by checking pte_none() before such install). And it also means if UFFD_WP is set there must have no POISON bit set. It makes sense because UFFD_WP is a bit to reflect permission, and permissions do not apply if the pte is poisoned and destined to sigbus.
So here we simply check uffd_wp bit set first, do nothing otherwise.
Attach the Fixes to UFFDIO_POISON work, as before that it should not be possible to have poison entry for hugetlb (e.g., hugetlb doesn't do swap, so no chance of swapin errors).
--- mm/hugetlb.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
mm/hugetlb.c +7 -3
@@ -6943,9 +6943,13 @@ long hugetlb_change_protection(struct vmif (!pte_same (pte, newpte))set_huge_pte_at (mm, address, ptep, newpte, psize); }else if (unlikely (is_pte_marker (pte))) { -/* No other markers apply for now. */ -WARN_ON_ONCE (!pte_marker_uffd_wp (pte)); -if (uffd_wp_resolve) +/* +* Do nothing on a poison marker; page is +* corrupted, permissons do not apply. Here +* pte_marker_uffd_wp()==true implies !poison +* because they're mutual exclusive. +*/ +if (pte_marker_uffd_wp (pte) && uffd_wp_resolve)/* Safe to modify directly (non-present->none). */ huge_pte_clear (mm, address, ptep, psize); }else if (!huge_pte_none (pte)) {
Greg Kroah-Hartman
maintainerPATCH 136/158 mm,swapops: update check in is_pfn_swap_entry for hwpoison entries
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oscar Salvador <[email protected]>
commit 07a57a338adb6ec9e766d6a6790f76527f45ceb5 upstream.
Tony reported that the Machine check recovery was broken in v6.9-rc1, as he was hitting a VM_BUG_ON when injecting uncorrectable memory errors to DRAM.
After some more digging and debugging on his side, he realized that this went back to v6.1, with the introduction of 'commit 0d206b5d2e0d ("mm/swap: add swp_offset_pfn() to fetch PFN from swap entry")'. That commit, among other things, introduced swp_offset_pfn(), replacing hwpoison_entry_to_pfn() in its favour.
The patch also introduced a VM_BUG_ON() check for is_pfn_swap_entry(), but is_pfn_swap_entry() never got updated to cover hwpoison entries, which means that we would hit the VM_BUG_ON whenever we would call swp_offset_pfn() for such entries on environments with CONFIG_DEBUG_VM set. Fix this by updating the check to cover hwpoison entries as well, and update the comment while we are it.
--- include/linux/swapops.h | 65 ++++++++++++++++++++++++------------------------ 1 file changed, 33 insertions(+), 32 deletions(-)
include/linux/swapops.h +33 -32
@@ -390,6 +390,35 @@ static inline bool is_migration_entry_di }#endif /* CONFIG_MIGRATION */ +#ifdef CONFIG_MEMORY_FAILURE + +/* +* Support for hardware poisoned pages +*/ +static inline swp_entry_t make_hwpoison_entry (struct page *page) +{ +BUG_ON (!PageLocked (page)); +return swp_entry (SWP_HWPOISON ,page_to_pfn (page)); +} + +static inline int is_hwpoison_entry (swp_entry_t entry) +{ +return swp_type (entry) ==SWP_HWPOISON ; +} + +#else + +static inline swp_entry_t make_hwpoison_entry (struct page *page) +{ +return swp_entry (0 ,0 ); +} + +static inline int is_hwpoison_entry (swp_entry_t swp) +{ +return 0 ; +} +#endif +typedef unsigned long pte_marker ;#define PTE_MARKER_UFFD_WP BIT(0)
@@ -470,8 +499,9 @@ static inline struct page *pfn_swap_entr/* * A pfn swap entry is a special type of swap entry that always has a pfn stored -* in the swap offset. They are used to represent unaddressable device memory -* and to restrict access to a page undergoing migration. +* in the swap offset. They can either be used to represent unaddressable device +* memory, to restrict access to a page undergoing migration or to represent a +* pfn which has been hwpoisoned and unmapped. */ static inline bool is_pfn_swap_entry (swp_entry_t entry) {
@@ -479,7 +509,7 @@ static inline bool is_pfn_swap_entry(swpBUILD_BUG_ON (SWP_TYPE_SHIFT <SWP_PFN_BITS );return is_migration_entry (entry) ||is_device_private_entry (entry) || -is_device_exclusive_entry (entry); +is_device_exclusive_entry (entry) ||is_hwpoison_entry (entry); }struct page_vma_mapped_walk ;
@@ -548,35 +578,6 @@ static inline int is_pmd_migration_entry }#endif /* CONFIG_ARCH_ENABLE_THP_MIGRATION */ -#ifdef CONFIG_MEMORY_FAILURE - -/* -* Support for hardware poisoned pages -*/ -static inline swp_entry_t make_hwpoison_entry (struct page *page) -{ -BUG_ON (!PageLocked (page)); -return swp_entry (SWP_HWPOISON ,page_to_pfn (page)); -} - -static inline int is_hwpoison_entry (swp_entry_t entry) -{ -return swp_type (entry) ==SWP_HWPOISON ; -} - -#else - -static inline swp_entry_t make_hwpoison_entry (struct page *page) -{ -return swp_entry (0 ,0 ); -} - -static inline int is_hwpoison_entry (swp_entry_t swp) -{ -return 0 ; -} -#endif -static inline int non_swap_entry (swp_entry_t entry) {return swp_type (entry) >=MAX_SWAPFILES ;
Greg Kroah-Hartman
maintainerPATCH 137/158 mm/memory-failure: fix deadlock when hugetlb_optimize_vmemmap is enabled
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaohe Lin <[email protected]>
commit 1983184c22dd84a4d95a71e5c6775c2638557dc7 upstream.
When I did hard offline test with hugetlb pages, below deadlock occurs:
======================================================
WARNING: possible circular locking dependency detected 6.8.0-11409-gf6cef5f8c37f #1 Not tainted
------------------------------------------------------
bash/46904 is trying to acquire lock:ffffffffabe68910 (cpu_hotplug_lock){++++}-{0:0}, at: static_key_slow_dec+0x16/0x60
but task is already holding lock:ffffffffabf92ea8 (pcp_batch_high_lock){+.+.}-{3:3}, at: zone_pcp_disable+0x16/0x40
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (pcp_batch_high_lock){+.+.}-{3:3}:
__mutex_lock+0x6c/0x770
page_alloc_cpu_online+0x3c/0x70
cpuhp_invoke_callback+0x397/0x5f0
__cpuhp_invoke_callback_range+0x71/0xe0
_cpu_up+0xeb/0x210
cpu_up+0x91/0xe0
cpuhp_bringup_mask+0x49/0xb0
bringup_nonboot_cpus+0xb7/0xe0
smp_init+0x25/0xa0
kernel_init_freeable+0x15f/0x3e0
kernel_init+0x15/0x1b0
ret_from_fork+0x2f/0x50
ret_from_fork_asm+0x1a/0x30-> #0 (cpu_hotplug_lock){++++}-{0:0}:
__lock_acquire+0x1298/0x1cd0
lock_acquire+0xc0/0x2b0
cpus_read_lock+0x2a/0xc0
static_key_slow_dec+0x16/0x60
__hugetlb_vmemmap_restore_folio+0x1b9/0x200
dissolve_free_huge_page+0x211/0x260
__page_handle_poison+0x45/0xc0
memory_failure+0x65e/0xc70
hard_offline_page_store+0x55/0xa0
kernfs_fop_write_iter+0x12c/0x1d0
vfs_write+0x387/0x550
ksys_write+0x64/0xe0
do_syscall_64+0xca/0x1e0
entry_SYSCALL_64_after_hwframe+0x6d/0x75other info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(pcp_batch_high_lock);
lock(cpu_hotplug_lock);
lock(pcp_batch_high_lock); rlock(cpu_hotplug_lock);
*** DEADLOCK ***
5 locks held by bash/46904:
#0: ffff98f6c3bb23f0 (sb_writers#5){.+.+}-{0:0}, at: ksys_write+0x64/0xe0 #1: ffff98f6c328e488 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0xf8/0x1d0 #2: ffff98ef83b31890 (kn->active#113){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x100/0x1d0 #3: ffffffffabf9db48 (mf_mutex){+.+.}-{3:3}, at: memory_failure+0x44/0xc70 #4: ffffffffabf92ea8 (pcp_batch_high_lock){+.+.}-{3:3}, at: zone_pcp_disable+0x16/0x40
stack backtrace: CPU: 10 PID: 46904 Comm: bash Kdump: loaded Not tainted 6.8.0-11409-gf6cef5f8c37f #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x68/0xa0 check_noncircular+0x129/0x140 __lock_acquire+0x1298/0x1cd0 lock_acquire+0xc0/0x2b0 cpus_read_lock+0x2a/0xc0 static_key_slow_dec+0x16/0x60 __hugetlb_vmemmap_restore_folio+0x1b9/0x200 dissolve_free_huge_page+0x211/0x260 __page_handle_poison+0x45/0xc0 memory_failure+0x65e/0xc70 hard_offline_page_store+0x55/0xa0 kernfs_fop_write_iter+0x12c/0x1d0 vfs_write+0x387/0x550 ksys_write+0x64/0xe0 do_syscall_64+0xca/0x1e0 entry_SYSCALL_64_after_hwframe+0x6d/0x75 RIP: 0033:0x7fc862314887 Code: 10 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24 RSP: 002b:00007fff19311268 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 000000000000000c RCX: 00007fc862314887 RDX: 000000000000000c RSI: 000056405645fe10 RDI: 0000000000000001 RBP: 000056405645fe10 R08: 00007fc8623d1460 R09: 000000007fffffff R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000000c R13: 00007fc86241b780 R14: 00007fc862417600 R15: 00007fc862416a00
In short, below scene breaks the lock dependency chain:
memory_failure
__page_handle_poison
zone_pcp_disable -- lock(pcp_batch_high_lock)
dissolve_free_huge_page
__hugetlb_vmemmap_restore_folio
static_key_slow_dec
cpus_read_lock -- rlock(cpu_hotplug_lock)
Fix this by calling drain_all_pages() instead.
This issue won't occur until commit a6b40850c442 ("mm: hugetlb: replace hugetlb_free_vmemmap_enabled with a static_key"). As it introduced rlock(cpu_hotplug_lock) in dissolve_free_huge_page() code path while lock(pcp_batch_high_lock) is already in the __page_handle_poison().
--- mm/memory-failure.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-)
mm/memory-failure.c +15 -3
@@ -154,11 +154,23 @@ static int __page_handle_poison(struct p {int ret; -zone_pcp_disable (page_zone (page)); +/* +* zone_pcp_disable() can't be used here. It will +* hold pcp_batch_high_lock and dissolve_free_huge_page() might hold +* cpu_hotplug_lock via static_key_slow_dec() when hugetlb vmemmap +* optimization is enabled. This will break current lock dependency +* chain and leads to deadlock. +* Disabling pcp before dissolving the page was a deterministic +* approach because we made sure that those pages cannot end up in any +* PCP list. Draining PCP lists expels those pages to the buddy system, +* but nothing guarantees that those pages do not get back to a PCP +* queue if we need to refill those. +*/ ret =dissolve_free_huge_page (page); -if (!ret) +if (!ret) { +drain_all_pages (page_zone (page)); ret =take_page_off_buddy (page); -zone_pcp_enable (page_zone (page)); + }return ret; }