6.8.10-rc1 review
Subsystems (7)
Greg Kroah-Hartman
maintainercover 6.8.10-rc1 review
This is the start of the stable review cycle for the 6.8.10 release. There are 336 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 16 May 2024 10:09:32 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.8.10-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.8.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.8.10-rc1
Johan Hovold <[email protected]>
Bluetooth: qca: fix firmware check error path
Johan Hovold <[email protected]>
Bluetooth: qca: fix info leak when fetching fw build id
Johan Hovold <[email protected]>
Bluetooth: qca: fix info leak when fetching board id
Johan Hovold <[email protected]>
Bluetooth: qca: generalise device address check
Johan Hovold <[email protected]>
Bluetooth: qca: fix NVM configuration parsing
Johan Hovold <[email protected]>
Bluetooth: qca: add missing firmware sanity checks
Johan Hovold <[email protected]>
Bluetooth: qca: fix wcn3991 device address check
Johan Hovold <[email protected]>
Bluetooth: qca: fix invalid device address check
Steven Rostedt (Google) <[email protected]>
eventfs: Do not treat events directory different than other directories
Steven Rostedt (Google) <[email protected]>
eventfs: Do not differentiate the toplevel events directory
Steven Rostedt (Google) <[email protected]>
tracefs: Still use mount point as default permissions for instances
Steven Rostedt (Google) <[email protected]>
tracefs: Reset permissions on remount if permissions are options
Namjae Jeon <[email protected]>
ksmbd: do not grant v2 lease if parent lease key and epoch are not set
Namjae Jeon <[email protected]>
ksmbd: avoid to send duplicate lease break notifications
Namjae Jeon <[email protected]>
ksmbd: off ipv6only for both ipv4/ipv6 binding
Conor Dooley <[email protected]>
spi: microchip-core-qspi: fix setting spi bus clock rate
Johan Hovold <[email protected]>
regulator: core: fix debugfs creation regression
Sean Anderson <[email protected]>
nvme-pci: Add quirk for broken MSIs
Ryan Roberts <[email protected]>
fs/proc/task_mmu: fix uffd-wp confusion in pagemap_scan_pmd_entry()
Ryan Roberts <[email protected]>
fs/proc/task_mmu: fix loss of young/dirty bits during pagemap scan
Vasant Hegde <[email protected]>
iommu/amd: Enhance def_domain_type to handle untrusted device
Peter Xu <[email protected]>
mm/userfaultfd: reset ptes when close() for wr-protected ones
Kefeng Wang <[email protected]>
mm: use memalloc_nofs_save() in page_cache_ra_order()
Michael Ellerman <[email protected]>
selftests/mm: fix powerpc ARCH check
Thomas Gleixner <[email protected]>
x86/apic: Don't access the APIC when disabling x2APIC
Thomas Weißschuh <[email protected]>
misc/pvpanic-pci: register attributes via pci_driver
Lakshmi Yadlapati <[email protected]>
hwmon: (pmbus/ucd9000) Increase delay from 250 to 500us
Thadeu Lima de Souza Cascardo <[email protected]>
net: fix out-of-bounds access in ops_init
Jason Gunthorpe <[email protected]>
iommu/arm-smmu: Use the correct type in nvidia_smmu_context_fault()
Volodymyr Babchuk <[email protected]>
arm64: dts: qcom: sa8155p-adp: fix SDHC2 CD pin configuration
Hersen Wu <[email protected]>
drm/amd/display: Fix incorrect DSC instance for MST
George Shen <[email protected]>
drm/amd/display: Handle Y carry-over in VCP X.Y calculation
Karthikeyan Ramasubramanian <[email protected]>
drm/i915/bios: Fix parsing backlight BDB data
Andi Shyti <[email protected]>
drm/i915/gt: Automate CCS Mode setting during engine resets
Chaitanya Kumar Borah <[email protected]>
drm/i915/audio: Fix audio time stamp programming for DP
Lyude Paul <[email protected]>
drm/nouveau/gsp: Use the sg allocator for level 2 of radix3
Nicholas Kazlauskas <[email protected]>
drm/amd/display: Fix idle optimization checks for multi-display and dual eDP
Matt Coster <[email protected]>
drm/imagination: Ensure PVR_MIPS_PT_PAGE_COUNT is never zero
Zack Rusin <[email protected]>
drm/vmwgfx: Fix invalid reads in fence signaled events
Ian Forbes <[email protected]>
drm/vmwgfx: Fix Legacy Display Unit
Zack Rusin <[email protected]>
drm/ttm: Print the memory decryption status just once
Alex Deucher <[email protected]>
drm/amdkfd: don't allow mapping the MMIO HDP page with large pages
Dave Airlie <[email protected]>
Revert "drm/nouveau/firmware: Fix SG_DEBUG error with nvkm_firmware_ctor()"
Lyude Paul <[email protected]>
drm/nouveau/firmware: Fix SG_DEBUG error with nvkm_firmware_ctor()
Alexander Usyskin <[email protected]>
mei: me: add lunar lake point M DID
Frank Oltmanns <[email protected]>
clk: sunxi-ng: a64: Set minimum and maximum rate for PLL-MIPI
Frank Oltmanns <[email protected]>
clk: sunxi-ng: common: Support minimum and maximum rate
Marek Szyprowski <[email protected]>
clk: samsung: Revert "clk: Use device_get_match_data()"
Viken Dadhaniya <[email protected]>
slimbus: qcom-ngd-ctrl: Add timeout for wait operation
Jim Cromie <[email protected]>
dyndbg: fix old BUG_ON in >control parser
Joao Paulo Goncalves <[email protected]>
ASoC: ti: davinci-mcasp: Fix race condition during probe
Sameer Pujar <[email protected]>
ASoC: tegra: Fix DSPK 16-bit playback
Doug Berger <[email protected]>
net: bcmgenet: synchronize UMAC_CMD access
Doug Berger <[email protected]>
net: bcmgenet: synchronize use of bcmgenet_set_rx_mode()
Doug Berger <[email protected]>
net: bcmgenet: synchronize EXT_RGMII_OOB_CTRL access
Max Filippov <[email protected]>
xtensa: fix MAKE_PC_FROM_RA second argument
Paolo Abeni <[email protected]>
tipc: fix UAF in error path
Vitaly Lifshits <[email protected]>
e1000e: change usleep_range to udelay in PHY mdic access
Alexander Potapenko <[email protected]>
kmsan: compiler_types: declare __no_sanitize_or_inline
Hans de Goede <[email protected]>
iio: accel: mxc4005: Reset chip on probe() and resume()
Hans de Goede <[email protected]>
iio: accel: mxc4005: Interrupt handling fixes
Vasileios Amoiridis <[email protected]>
iio: pressure: Fixes SPI support for BMP3xx devices
Vasileios Amoiridis <[email protected]>
iio: pressure: Fixes BME280 SPI driver data
Ramona Gradinariu <[email protected]>
iio:imu: adis16475: Fix sync mode setting
Javier Carrasco <[email protected]>
dt-bindings: iio: health: maxim,max30102: fix compatible check
Sven Schnelle <[email protected]>
workqueue: Fix selection of wake_cpu in kick_pool()
Gregory Detal <[email protected]>
mptcp: only allow set existing scheduler for net.mptcp.scheduler
Paolo Abeni <[email protected]>
mptcp: ensure snd_nxt is properly initialized on connect
Dan Carpenter <[email protected]>
mm/slab: make __free(kfree) accept error pointers
Liam R. Howlett <[email protected]>
maple_tree: fix mas_empty_area_rev() null pointer dereference
Josef Bacik <[email protected]>
btrfs: make sure that WRITTEN is set on all metadata blocks
Qu Wenruo <[email protected]>
btrfs: qgroup: do not check qgroup inherit if qgroup is disabled
Qu Wenruo <[email protected]>
btrfs: set correct ram_bytes when splitting ordered extent
Dominique Martinet <[email protected]>
btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks()
Nicolas Bouchinet <[email protected]>
mm/slub: avoid zeroing outside-object freepointer for single free
Takashi Sakamoto <[email protected]>
firewire: ohci: fulfill timestamp for some local asynchronous transaction
Takashi Iwai <[email protected]>
ALSA: hda/realtek: Fix conflicting PCI SSID 17aa:386f for Lenovo Legion models
Aman Dhoot <[email protected]>
ALSA: hda/realtek: Fix mute led of HP Laptop 15-da3001TU
Badhri Jagan Sridharan <[email protected]>
usb: typec: tcpm: Check for port partner validity before consuming it
Amit Sunil Dhamne <[email protected]>
usb: typec: tcpm: unregister existing source caps before re-registration
RD Babiera <[email protected]>
usb: typec: tcpm: clear pd_event queue in PORT_RESET
Thinh Nguyen <[email protected]>
usb: dwc3: core: Prevent phy suspend during init
Thinh Nguyen <[email protected]>
usb: xhci-plat: Don't include xhci.h
Chris Wulff <[email protected]>
usb: gadget: f_fs: Fix a race condition when processing setup packets.
Wesley Cheng <[email protected]>
usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete
Ivan Avdeev <[email protected]>
usb: gadget: uvc: use correct buffer size when parsing configfs lists
Peter Korsgaard <[email protected]>
usb: gadget: composite: fix OS descriptors w_value logic
Alan Stern <[email protected]>
USB: core: Fix access violation during port device removal
Guenter Roeck <[email protected]>
usb: ohci: Prevent missed ohci interrupts
Alan Stern <[email protected]>
usb: Fix regression caused by invalid ep0 maxpacket in virtual SuperSpeed device
Christian A. Ehrhardt <[email protected]>
usb: typec: ucsi: Fix connector check on init
Christian A. Ehrhardt <[email protected]>
usb: typec: ucsi: Check for notifications after init
Linus Torvalds <[email protected]>
Reapply "drm/qxl: simplify qxl_fence_wait"
Thanassis Avgerinos <[email protected]>
firewire: nosy: ensure user_length is taken into account when fetching packet contents
Christian König <[email protected]>
drm/amdgpu: once more fix the call oder in amdgpu_ttm_move() v2
Michel Dänzer <[email protected]>
drm/amdgpu: Fix comparison in amdgpu_res_cpu_visible
Gabe Teeger <[email protected]>
drm/amd/display: Atom Integrated System Info v2_2 for DCN35
Kent Gibson <[email protected]>
gpiolib: cdev: fix uninitialised kfifo
Zhongqiu Han <[email protected]>
gpiolib: cdev: Fix use after free in lineinfo_changed_notify
Mario Limonciello <[email protected]>
dm/amd/pm: Fix problems with reboot/shutdown for some SMU 13.0.4/13.0.11 users
Douglas Anderson <[email protected]>
drm/connector: Add \n to message about demoting connector force-probes
Jerome Brunet <[email protected]>
drm/meson: dw-hdmi: add bandgap setting for g12
Jerome Brunet <[email protected]>
drm/meson: dw-hdmi: power up phy on device init
Steffen Bätz <[email protected]>
net: dsa: mv88e6xxx: add phylink_get_caps for the mv88e6320/21 family
Yonglong Liu <[email protected]>
net: hns3: fix kernel crash when devlink reload during initialization
Yonglong Liu <[email protected]>
net: hns3: fix port vlan filter not disabled issue
Peiyang Wang <[email protected]>
net: hns3: use appropriate barrier function after setting a bit value
Peiyang Wang <[email protected]>
net: hns3: release PTP resources if pf initialization failed
Peiyang Wang <[email protected]>
net: hns3: change type of numa_node_mask as nodemask_t
Jian Shen <[email protected]>
net: hns3: direct return when receive a unknown mailbox message
Peiyang Wang <[email protected]>
net: hns3: using user configure after hardware reset
Wen Gu <[email protected]>
net/smc: fix neighbour and rtable leak in smc_ib_find_route()
Eric Dumazet <[email protected]>
ipv6: prevent NULL dereference in ip6_output()
Eric Dumazet <[email protected]>
ipv6: annotate data-races around cnf.disable_ipv6
Lukasz Majewski <[email protected]>
hsr: Simplify code for announcing HSR nodes timer setup
Eric Dumazet <[email protected]>
net-sysfs: convert dev->operstate reads to lockless ones
Eric Dumazet <[email protected]>
ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()
Daniel Golle <[email protected]>
dt-bindings: net: mediatek: remove wrongly added clocks and SerDes
David Howells <[email protected]>
rxrpc: Only transmit one ACK per jumbo packet received
David Howells <[email protected]>
rxrpc: Fix congestion control algorithm
David Howells <[email protected]>
rxrpc: Fix the names of the fields in the ACK trailer struct
Ido Schimmel <[email protected]>
selftests: test_bridge_neigh_suppress.sh: Fix failures due to duplicate MAC
Shigeru Yoshida <[email protected]>
ipv6: Fix potential uninit-value access in __ip6_make_skb()
Felix Fietkau <[email protected]>
net: bridge: fix corrupted ethernet header on multicast-to-unicast
Tetsuo Handa <[email protected]>
nfc: nci: Fix kcov check in nci_rx_work()
Donald Hunter <[email protected]>
netlink: specs: Add missing bridge linkinfo attrs
Eric Dumazet <[email protected]>
phonet: fix rtm_phonet_notify() skb allocation
Aleksa Savic <[email protected]>
hwmon: (corsair-cpro) Protect ccp->wait_input_report with a spinlock
Aleksa Savic <[email protected]>
hwmon: (corsair-cpro) Use complete_all() instead of complete() in ccp_raw_event()
Aleksa Savic <[email protected]>
hwmon: (corsair-cpro) Use a separate buffer for sending commands
Roded Zats <[email protected]>
rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
Marek Vasut <[email protected]>
net: ks8851: Queue RX packets in IRQ handler instead of disabling BHs
Duoming Zhou <[email protected]>
Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout
Sungwoo Kim <[email protected]>
Bluetooth: HCI: Fix potential null-ptr-deref
Chen-Yu Tsai <[email protected]>
arm64: dts: mediatek: mt8183-pico6: Fix bluetooth node
Sungwoo Kim <[email protected]>
Bluetooth: msft: fix slab-use-after-free in msft_do_close()
Duoming Zhou <[email protected]>
Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout
Kuniyuki Iwashima <[email protected]>
tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().
Eric Dumazet <[email protected]>
tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets
Boy.Wu <[email protected]>
ARM: 9381/1: kasan: clear stale stack poison
Paul Davey <[email protected]>
xfrm: Preserve vlan tags for transport mode software GRO
Al Viro <[email protected]>
qibfs: fix dentry leak
Olga Kornievskaia <[email protected]>
SUNRPC: add a missing rpc_stat for TCP TLS
Li Nan <[email protected]>
blk-iocost: do not WARN if iocg was already offlined
Vanillan Wang <[email protected]>
net:usb:qmi_wwan: support Rolling modules
Alex Deucher <[email protected]>
drm/radeon: silence UBSAN warning (v3)
Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Add Granite Rapids-D to HPM CPU list
Mario Limonciello <[email protected]>
platform/x86/amd: pmf: Decrease error message to debug
Lyude Paul <[email protected]>
drm/nouveau/dp: Don't probe eDP ports twice harder
Krzysztof Kozlowski <[email protected]>
gpio: lpc32xx: fix module autoloading
Joakim Sindholt <[email protected]>
fs/9p: drop inodes immediately on non-.L too
Eric Van Hensbergen <[email protected]>
fs/9p: remove erroneous nlink init from legacy stat2inode
Stephen Boyd <[email protected]>
clk: Don't hold prepare_lock when calling kref_put()
Andy Shevchenko <[email protected]>
gpio: crystalcove: Use -ENOTSUPP consistently
Andy Shevchenko <[email protected]>
gpio: wcove: Use -ENOTSUPP consistently
Michael Ellerman <[email protected]>
powerpc/crypto/chacha-p10: Fix failure on non Power10
Jeff Layton <[email protected]>
9p: explicitly deny setlease attempts
Joakim Sindholt <[email protected]>
fs/9p: fix the cache always being enabled on files with qid flags
Joakim Sindholt <[email protected]>
fs/9p: translate O_TRUNC into OTRUNC
Joakim Sindholt <[email protected]>
fs/9p: only translate RWX permissions for plain 9P2000
Krzysztof Kozlowski <[email protected]>
iommu: mtk: fix module autoloading
Steve French <[email protected]>
smb3: fix broken reconnect when password changing on the server by allowing password rotation
Ashutosh Dixit <[email protected]>
drm/xe: Label RING_CONTEXT_CONTROL as masked
Himal Prasad Ghimiray <[email protected]>
drm/xe/xe_migrate: Cast to output precision before multiplying operands
Michael Kelley <[email protected]>
Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted
Rick Edgecombe <[email protected]>
uio_hv_generic: Don't free decrypted memory
Rick Edgecombe <[email protected]>
hv_netvsc: Don't free decrypted memory
Rick Edgecombe <[email protected]>
Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl
Rick Edgecombe <[email protected]>
Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails
John Stultz <[email protected]>
selftests: timers: Fix valid-adjtimex signed left-shift undefined behavior
Zhigang Luo <[email protected]>
amd/amdkfd: sync all devices to wait all processes being evicted
Lijo Lazar <[email protected]>
drm/amdgpu: Fix VCN allocation in CPX partition
Kenneth Feng <[email protected]>
drm/amd/pm: fix the high voltage issue after unload
Alex Hung <[email protected]>
drm/amd/display: Skip on writeback when it's not applicable
Tao Zhou <[email protected]>
drm/amdgpu: implement IRQ_STATE_ENABLE for SDMA v4.4.2
Yifan Zhang <[email protected]>
drm/amdgpu: add smu 14.0.1 discovery support
Li Ma <[email protected]>
drm/amd/display: add DCN 351 version for microcode load
Lijo Lazar <[email protected]>
drm/amdgpu: Refine IB schedule error logging
Eric Dumazet <[email protected]>
nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies
Eric Dumazet <[email protected]>
net: add copy_safe_from_sockptr() helper
Justin Ernst <[email protected]>
tools/power/turbostat: Fix uncore frequency file string
Jiaxun Yang <[email protected]>
MIPS: scall: Save thread_info.syscall unconditionally on entry
Thierry Reding <[email protected]>
gpu: host1x: Do not setup DMA for virtual devices
Bernhard Rosenkränzer <[email protected]>
platform/x86: acer-wmi: Add support for Acer PH18-71
Jacek Lawrynowicz <[email protected]>
accel/ivpu: Fix missed error message after VPU rename
Wachowski, Karol <[email protected]>
accel/ivpu: Improve clarity of MMU error messages
Jacek Lawrynowicz <[email protected]>
accel/ivpu: Remove d3hot_after_power_off WA
Rik van Riel <[email protected]>
blk-iocost: avoid out of bounds shift
Xiang Chen <[email protected]>
scsi: hisi_sas: Handle the NCQ error returned by D2H frame
Maurizio Lombardi <[email protected]>
scsi: target: Fix SELinux error when systemd-modules loads the target module
Kees Cook <[email protected]>
nouveau/gsp: Avoid addressing beyond end of rpc->entries
Wei Yang <[email protected]>
memblock tests: fix undefined reference to `BIT'
Wei Yang <[email protected]>
memblock tests: fix undefined reference to `panic'
Wei Yang <[email protected]>
memblock tests: fix undefined reference to `early_pfn_to_nid'
Boris Burkov <[email protected]>
btrfs: always clear PERTRANS metadata during commit
Boris Burkov <[email protected]>
btrfs: make btrfs_clear_delalloc_extent() free delalloc reserve
Len Brown <[email protected]>
tools/power turbostat: Fix warning upon failed /dev/cpu_dma_latency read
Patryk Wlazlyn <[email protected]>
tools/power turbostat: Print ucode revision only if valid
Len Brown <[email protected]>
tools/power turbostat: Expand probe_intel_uncore_frequency()
Chen Yu <[email protected]>
tools/power turbostat: Do not print negative LPI residency
Peng Liu <[email protected]>
tools/power turbostat: Fix Bzy_MHz documentation typo
Wyes Karny <[email protected]>
tools/power turbostat: Increase the limit for fd opened
Doug Smythies <[email protected]>
tools/power turbostat: Fix added raw MSR output
Adam Goldman <[email protected]>
firewire: ohci: mask bus reset interrupts between ISR and bottom half
Chen Ni <[email protected]>
ata: sata_gemini: Check clk_enable() result
Jeff Layton <[email protected]>
vboxsf: explicitly deny setlease attempts
Phil Elwell <[email protected]>
net: bcmgenet: Reset RBUF on first open
Zhang Yi <[email protected]>
ASoC: codecs: ES8326: modify clock table
Zhang Yi <[email protected]>
ASoC: codecs: ES8326: Solve error interruption issue
Li Nan <[email protected]>
block: fix overflow in blk_ioctl_discard()
Takashi Iwai <[email protected]>
ALSA: line6: Zero-initialize message buffers
Peter Wang <[email protected]>
scsi: ufs: core: Fix MCQ mode dev command timeout
Yihang Li <[email protected]>
scsi: libsas: Align SMP request allocation to ARCH_DMA_MINALIGN
Peter Wang <[email protected]>
scsi: ufs: core: WLUN suspend dev/link state error recovery
Uwe Kleine-König <[email protected]>
OSS: dmasound/paula: Mark driver struct with __refdata to prevent section mismatch
André Apitzsch <[email protected]>
regulator: tps65132: Add of_match table
Peter Ujfalusi <[email protected]>
ASoC: SOF: Intel: hda-dsp: Skip IMR boot on ACE platforms in case of S3 suspend
Borislav Petkov (AMD) <[email protected]>
kbuild: Disable KCSAN for autogenerated *.mod.c intermediaries
Mark Rutland <[email protected]>
selftests/ftrace: Fix event filter target_func selection
Andrei Matei <[email protected]>
bpf: Check bloom filter map value size
Jonathan Kim <[email protected]>
drm/amdkfd: range check cp bad op exception interrupts
Mukul Joshi <[email protected]>
drm/amdkfd: Check cgroup when returning DMABuf info
Anand Jain <[email protected]>
btrfs: return accurate error code on open failure in open_fs_devices()
Saurav Kashyap <[email protected]>
scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload
Shin'ichiro Kawasaki <[email protected]>
scsi: mpi3mr: Avoid memcpy field-spanning write WARNING
Lucas De Marchi <[email protected]>
drm/xe: Fix END redefinition
linke li <[email protected]>
net: mark racy access on sk->sk_rcvbuf
Benjamin Berg <[email protected]>
wifi: iwlwifi: mvm: guard against invalid STA ID on removal
Johannes Berg <[email protected]>
wifi: iwlwifi: read txq->read_ptr under lock
Johannes Berg <[email protected]>
wifi: mac80211: fix prep_connection error path
Igor Artemiev <[email protected]>
wifi: cfg80211: fix rdev_dump_mpp() arguments order
Jeff Johnson <[email protected]>
wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc
Eric Van Hensbergen <[email protected]>
fs/9p: fix uninitialized values during inode evict
Andrew Price <[email protected]>
gfs2: Fix invalid metadata access in punch_hole
Justin Tee <[email protected]>
scsi: lpfc: Use a dedicated lock for ras_fwlog state
Justin Tee <[email protected]>
scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()
Justin Tee <[email protected]>
scsi: lpfc: Replace hbalock with ndlp lock in lpfc_nvme_unregister_port()
Justin Tee <[email protected]>
scsi: lpfc: Update lpfc_ramp_down_queue_handler() logic
Justin Tee <[email protected]>
scsi: lpfc: Remove IRQF_ONESHOT flag from threaded IRQ handling
Justin Tee <[email protected]>
scsi: lpfc: Move NPIV's transport unregistration to after resource clean up
Rohit Ner <[email protected]>
scsi: ufs: core: Fix MCQ MAC configuration
Conor Dooley <[email protected]>
firmware: microchip: don't unconditionally print validation success
Yuezhang Mo <[email protected]>
exfat: fix timing of synchronizing bitmap and inode
Oliver Upton <[email protected]>
KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr()
Will Deacon <[email protected]>
swiotlb: initialise restricted pool list_head when SWIOTLB_DYNAMIC=y
Shubhrajyoti Datta <[email protected]>
EDAC/versal: Do not log total error counts
Gaurav Batra <[email protected]>
powerpc/pseries/iommu: LPAR panics during boot up with a frozen PE
Nayna Jain <[email protected]>
powerpc/pseries: make max polling consistent for longer H_CALLs
Jernej Skrabec <[email protected]>
clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change
Adam Skladowski <[email protected]>
clk: qcom: smd-rpm: Restore msm8976 num_clk
Lucas De Marchi <[email protected]>
drm/xe/display: Fix ADL-N detection
Richard Gobert <[email protected]>
net: gro: add flush check in udp_gro_receive_segment
Richard Gobert <[email protected]>
net: gro: fix udp bad offset in socket lookup by adding {inner_}network_offset to napi_gro_cb
Shigeru Yoshida <[email protected]>
ipv4: Fix uninit-value access in __ip_make_skb()
Andy Shevchenko <[email protected]>
drm/panel: ili9341: Use predefined error codes
Andy Shevchenko <[email protected]>
drm/panel: ili9341: Respect deferred probe
Andy Shevchenko <[email protected]>
drm/panel: ili9341: Correct use of device property APIs
Alexandra Winter <[email protected]>
s390/qeth: Fix kernel panic after setting hsuid
Guillaume Nault <[email protected]>
vxlan: Pull inner IP header in vxlan_rcv().
Xin Long <[email protected]>
tipc: fix a possible memleak in tipc_buf_append
Jeffrey Altman <[email protected]>
rxrpc: Clients must accept conn from any address
Felix Fietkau <[email protected]>
net: core: reject skb_copy(_expand) for fraglist GSO skbs
Felix Fietkau <[email protected]>
net: bridge: fix multicast-to-unicast with fraglist GSO
Mans Rullgard <[email protected]>
spi: fix null pointer dereference within spi_sync
Shashank Sharma <[email protected]>
drm/amdgpu: fix doorbell regression
Marek Behún <[email protected]>
net: dsa: mv88e6xxx: Fix number of databases for 88E6141 / 88E6341
Sebastian Andrzej Siewior <[email protected]>
cxgb4: Properly lock TX queue for the selftest.
Bui Quang Minh <[email protected]>
s390/cio: Ensure the copied buf is NUL terminated
Pierre-Louis Bossart <[email protected]>
ALSA: hda: intel-sdw-acpi: fix usage of device_get_named_child_node()
Jerome Brunet <[email protected]>
ASoC: meson: cards: select SND_DYNAMIC_MINORS
Jerome Brunet <[email protected]>
ASoC: meson: axg-tdm-interface: manage formatters in trigger
Jerome Brunet <[email protected]>
ASoC: meson: axg-card: make links nonatomic
Jerome Brunet <[email protected]>
ASoC: meson: axg-fifo: use threaded irq to check periods
Jerome Brunet <[email protected]>
ASoC: meson: axg-fifo: use FIELD helpers
Guillaume Nault <[email protected]>
vxlan: Add missing VNI filter counter update in arp_reduce().
Guillaume Nault <[email protected]>
vxlan: Fix racy device stats updates.
Asbjørn Sloth Tønnesen <[email protected]>
net: qede: use return from qede_parse_actions()
Asbjørn Sloth Tønnesen <[email protected]>
net: qede: use return from qede_parse_flow_attr() for flow_spec
Asbjørn Sloth Tønnesen <[email protected]>
net: qede: use return from qede_parse_flow_attr() for flower
Asbjørn Sloth Tønnesen <[email protected]>
net: qede: sanitize 'rc' in qede_add_tc_flower_fltr()
Oswald Buddenhagen <[email protected]>
ALSA: emu10k1: fix E-MU dock initialization
Oswald Buddenhagen <[email protected]>
ALSA: emu10k1: move the whole GPIO event handling to the workqueue
Oswald Buddenhagen <[email protected]>
ALSA: emu10k1: factor out snd_emu1010_load_dock_firmware()
Oswald Buddenhagen <[email protected]>
ALSA: emu10k1: fix E-MU card dock presence monitoring
David Howells <[email protected]>
Fix a potential infinite loop in extract_user_to_sg()
Jens Remus <[email protected]>
s390/vdso: Add CFI for RA register to asm macro vdso_func
Rafael J. Wysocki <[email protected]>
thermal/debugfs: Prevent use-after-free from occurring after cdev removal
David Bauer <[email protected]>
net l2tp: drop flow hash on forward
Kuniyuki Iwashima <[email protected]>
nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().Rafael J. Wysocki <[email protected]>
thermal/debugfs: Fix two locking issues with thermal zone debug
Rafael J. Wysocki <[email protected]>
thermal/debugfs: Free all thermal zone debug memory on zone removal
Bui Quang Minh <[email protected]>
octeontx2-af: avoid off-by-one read from userspace
Bui Quang Minh <[email protected]>
bna: ensure the copied buf is NUL terminated
Bui Quang Minh <[email protected]>
ice: ensure the copied buf is NUL terminated
Chen Yu <[email protected]>
efi/unaccepted: touch soft lockup during memory accept
Toke Høiland-Jørgensen <[email protected]>
xdp: use flags field to disambiguate broadcast redirect
Puranjay Mohan <[email protected]>
arm32, bpf: Reimplement sign-extension mov instruction
Claudio Imbrenda <[email protected]>
s390/mm: Fix clearing storage keys for huge pages
Claudio Imbrenda <[email protected]>
s390/mm: Fix storage key clearing for guest huge pages
Srinivas Kandagatla <[email protected]>
ASoC: codecs: wsa881x: set clk_stop_mode1 flag
Amadeusz Sławiński <[email protected]>
ASoC: Intel: avs: Set name of control as in topology
Xu Kuohai <[email protected]>
riscv, bpf: Fix incorrect runtime stats
Xu Kuohai <[email protected]>
bpf, arm64: Fix incorrect runtime stats
Devyn Liu <[email protected]>
spi: hisi-kunpeng: Delete the dump interface of data registers in debugfs
David Lechner <[email protected]>
spi: axi-spi-engine: fix version format string
David Lechner <[email protected]>
spi: axi-spi-engine: use common AXI macros
Anton Protopopov <[email protected]>
bpf: Fix a verifier verbose message
Yi Zhang <[email protected]>
nvme: fix warn output about shared namespaces without CONFIG_NVME_MULTIPATH
Pierre-Louis Bossart <[email protected]>
ASoC: SOF: Intel: add default firmware library path for LNL
Richard Fitzgerald <[email protected]>
regmap: Add regmap_read_bypassed()
Jason Xing <[email protected]>
bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue
Andrii Nakryiko <[email protected]>
bpf, kconfig: Fix DEBUG_INFO_BTF_MODULES Kconfig definition
Matti Vaittinen <[email protected]>
regulator: change devm_regulator_get_enable_optional() stub to return Ok
Matti Vaittinen <[email protected]>
regulator: change stubbed devm_regulator_get_enable to return Ok
AngeloGioacchino Del Regno <[email protected]>
regulator: mt6360: De-capitalize devicetree regulator subnodes
Chuck Lever <[email protected]>
NFSD: Fix nfsd4_encode_fattr4() crasher
Dai Ngo <[email protected]>
NFSD: add support for CB_GETATTR callback
Josef Bacik <[email protected]>
nfsd: make all of the nfsd stats per-network namespace
Josef Bacik <[email protected]>
nfsd: expose /proc/net/sunrpc/nfsd in net namespaces
Josef Bacik <[email protected]>
nfsd: rename NFSD_NET_* to NFSD_STATS_*
Zeng Heng <[email protected]>
pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
AngeloGioacchino Del Regno <[email protected]>
power: supply: mt6360_charger: Fix of_match for usb-otg-vbus regulator
Arnd Bergmann <[email protected]>
power: rt9455: hide unused rt9455_boost_voltage_values
Hans de Goede <[email protected]>
pinctrl: baytrail: Fix selecting gpio pinctrl state
Kuniyuki Iwashima <[email protected]>
nfs: Handle error of rpc_proc_register() in nfs_net_init().
Josef Bacik <[email protected]>
nfs: make the rpc_stat per net namespace
Josef Bacik <[email protected]>
nfs: expose /proc/net/sunrpc/nfs in net namespaces
Josef Bacik <[email protected]>
sunrpc: add a struct rpc_stats arg to rpc_create_args
Chen-Yu Tsai <[email protected]>
pinctrl: mediatek: paris: Rework support for PIN_CONFIG_{INPUT,OUTPUT}_ENABLE
Chen-Yu Tsai <[email protected]>
pinctrl: mediatek: paris: Fix PIN_CONFIG_INPUT_SCHMITT_ENABLE readback
Dan Carpenter <[email protected]>
pinctrl: core: delete incorrect free in pinctrl_enable()
Jan Dakinevich <[email protected]>
pinctrl/meson: fix typo in PDM's pin name
Billy Tsai <[email protected]>
pinctrl: pinctrl-aspeed-g6: Fix register offset for pinconf of GPIOR-T
Johannes Berg <[email protected]>
wifi: nl80211: don't free NULL coalescing rule
Benno Lossin <[email protected]>
rust: macros: fix soundness issue in module! macro
Thomas Bertschinger <[email protected]>
rust: module: place generated init_module() function in .init.text
-------------
Diffstat:
.../bindings/iio/health/maxim,max30102.yaml | 2 +- .../devicetree/bindings/net/mediatek,net.yaml | 22 +-- Documentation/netlink/specs/rt_link.yaml | 6 + Makefile | 4 +- arch/arm/kernel/sleep.S | 4 + arch/arm/net/bpf_jit_32.c | 56 +++++-- .../dts/mediatek/mt8183-kukui-jacuzzi-pico6.dts | 3 +- arch/arm64/boot/dts/qcom/sa8155p-adp.dts | 30 ++-- arch/arm64/kvm/vgic/vgic-kvm-device.c | 8 +- arch/arm64/net/bpf_jit_comp.c | 6 +- arch/mips/include/asm/ptrace.h | 2 +- arch/mips/kernel/asm-offsets.c | 1 + arch/mips/kernel/ptrace.c | 15 +- arch/mips/kernel/scall32-o32.S | 23 +-- arch/mips/kernel/scall64-n32.S | 3 +- arch/mips/kernel/scall64-n64.S | 3 +- arch/mips/kernel/scall64-o32.S | 33 ++-- arch/powerpc/crypto/chacha-p10-glue.c | 8 +- arch/powerpc/include/asm/plpks.h | 5 +- arch/powerpc/platforms/pseries/iommu.c | 8 + arch/powerpc/platforms/pseries/plpks.c | 10 +- arch/riscv/net/bpf_jit_comp64.c | 6 +- arch/s390/include/asm/dwarf.h | 1 + arch/s390/kernel/vdso64/vdso_user_wrapper.S | 2 + arch/s390/mm/gmap.c | 2 +- arch/s390/mm/hugetlbpage.c | 2 +- arch/x86/kernel/apic/apic.c | 16 +- arch/xtensa/include/asm/processor.h | 8 +- arch/xtensa/include/asm/ptrace.h | 2 +- arch/xtensa/kernel/process.c | 5 +- arch/xtensa/kernel/stacktrace.c | 3 +- block/blk-iocost.c | 14 +- block/ioctl.c | 5 +- drivers/accel/ivpu/ivpu_drv.c | 20 +-- drivers/accel/ivpu/ivpu_drv.h | 3 +- drivers/accel/ivpu/ivpu_hw_37xx.c | 4 +- drivers/accel/ivpu/ivpu_mmu.c | 8 +- drivers/accel/ivpu/ivpu_pm.c | 9 +- drivers/ata/sata_gemini.c | 5 +- drivers/base/regmap/regmap.c | 37 +++++ drivers/bluetooth/btqca.c | 140 ++++++++++++++-- drivers/bluetooth/btqca.h | 3 +- drivers/bluetooth/hci_qca.c | 2 - drivers/clk/clk.c | 12 +- drivers/clk/qcom/clk-smd-rpm.c | 1 + drivers/clk/samsung/clk-exynos-clkout.c | 13 +- drivers/clk/sunxi-ng/ccu-sun50i-a64.c | 2 + drivers/clk/sunxi-ng/ccu-sun50i-h6.c | 19 ++- drivers/clk/sunxi-ng/ccu_common.c | 19 +++ drivers/clk/sunxi-ng/ccu_common.h | 3 + drivers/edac/versal_edac.c | 4 +- drivers/firewire/nosy.c | 6 +- drivers/firewire/ohci.c | 14 +- drivers/firmware/efi/unaccepted_memory.c | 4 + drivers/firmware/microchip/mpfs-auto-update.c | 2 + drivers/gpio/gpio-crystalcove.c | 2 +- drivers/gpio/gpio-lpc32xx.c | 1 + drivers/gpio/gpio-wcove.c | 2 +- drivers/gpio/gpiolib-cdev.c | 16 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 26 +-- drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 7 +- drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 14 +- drivers/gpu/drm/amd/amdgpu/amdgpu_object.h | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 56 ++++--- drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c | 15 +- drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c | 16 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 11 +- drivers/gpu/drm/amd/amdkfd/kfd_device.c | 17 +- drivers/gpu/drm/amd/amdkfd/kfd_int_process_v10.c | 3 +- drivers/gpu/drm/amd/amdkfd/kfd_int_process_v11.c | 3 +- drivers/gpu/drm/amd/amdkfd/kfd_int_process_v9.c | 3 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 15 +- .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 48 ++++-- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 1 + .../display/dc/dcn31/dcn31_hpo_dp_link_encoder.c | 6 + .../drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c | 33 +++- drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 27 ++- drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h | 1 + .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 8 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_4_ppt.c | 2 +- drivers/gpu/drm/drm_connector.c | 2 +- drivers/gpu/drm/i915/display/intel_audio.c | 113 +------------ drivers/gpu/drm/i915/display/intel_bios.c | 19 +-- drivers/gpu/drm/i915/display/intel_vbt_defs.h | 5 - drivers/gpu/drm/i915/gt/intel_gt_ccs_mode.c | 6 +- drivers/gpu/drm/i915/gt/intel_gt_ccs_mode.h | 2 +- drivers/gpu/drm/i915/gt/intel_workarounds.c | 4 +- drivers/gpu/drm/imagination/pvr_fw_mips.h | 5 +- drivers/gpu/drm/meson/meson_dw_hdmi.c | 70 ++++---- drivers/gpu/drm/nouveau/include/nvkm/subdev/gsp.h | 4 +- drivers/gpu/drm/nouveau/nouveau_dp.c | 13 +- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c | 81 +++++---- drivers/gpu/drm/panel/Kconfig | 2 +- drivers/gpu/drm/panel/panel-ilitek-ili9341.c | 13 +- drivers/gpu/drm/qxl/qxl_release.c | 50 +----- drivers/gpu/drm/radeon/pptable.h | 10 +- drivers/gpu/drm/ttm/ttm_tt.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_bo.c | 1 + drivers/gpu/drm/vmwgfx/vmwgfx_fence.c | 2 +- drivers/gpu/drm/xe/compat-i915-headers/i915_drv.h | 3 +- drivers/gpu/drm/xe/regs/xe_engine_regs.h | 2 +- drivers/gpu/drm/xe/xe_lrc.c | 25 ++- drivers/gpu/drm/xe/xe_migrate.c | 8 +- drivers/gpu/host1x/bus.c | 8 - drivers/hv/channel.c | 29 +++- drivers/hv/connection.c | 29 +++- drivers/hwmon/corsair-cpro.c | 43 +++-- drivers/hwmon/pmbus/ucd9000.c | 6 +- drivers/iio/accel/mxc4005.c | 92 +++++++++- drivers/iio/imu/adis16475.c | 4 +- drivers/iio/pressure/bmp280-core.c | 1 + drivers/iio/pressure/bmp280-spi.c | 13 +- drivers/iio/pressure/bmp280.h | 1 + drivers/infiniband/hw/qib/qib_fs.c | 1 + drivers/iommu/amd/iommu.c | 4 + drivers/iommu/arm/arm-smmu/arm-smmu-nvidia.c | 4 +- drivers/iommu/mtk_iommu.c | 1 + drivers/iommu/mtk_iommu_v1.c | 1 + drivers/misc/mei/hw-me-regs.h | 2 + drivers/misc/mei/pci-me.c | 2 + drivers/misc/pvpanic/pvpanic-pci.c | 4 +- drivers/net/dsa/mv88e6xxx/chip.c | 20 ++- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 32 +++- drivers/net/ethernet/broadcom/genet/bcmgenet.h | 4 +- drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c | 8 +- drivers/net/ethernet/broadcom/genet/bcmmii.c | 6 +- drivers/net/ethernet/brocade/bna/bnad_debugfs.c | 4 +- drivers/net/ethernet/chelsio/cxgb4/sge.c | 6 +- drivers/net/ethernet/hisilicon/hns3/hnae3.h | 2 +- .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 52 +++--- .../ethernet/hisilicon/hns3/hns3pf/hclge_main.h | 5 +- .../net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 7 +- .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 20 +-- .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h | 2 +- drivers/net/ethernet/intel/e1000e/phy.c | 8 +- drivers/net/ethernet/intel/ice/ice_debugfs.c | 8 +- .../ethernet/marvell/octeontx2/af/rvu_debugfs.c | 4 +- drivers/net/ethernet/micrel/ks8851_common.c | 16 +- drivers/net/ethernet/qlogic/qede/qede_filter.c | 14 +- drivers/net/hyperv/netvsc.c | 7 +- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/vxlan/vxlan_core.c | 49 ++++-- drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c | 7 +- drivers/net/wireless/intel/iwlwifi/queue/tx.c | 2 +- drivers/nvme/host/core.c | 2 +- drivers/nvme/host/nvme.h | 5 + drivers/nvme/host/pci.c | 14 +- drivers/pinctrl/aspeed/pinctrl-aspeed-g6.c | 34 ++-- drivers/pinctrl/core.c | 8 +- drivers/pinctrl/devicetree.c | 10 +- drivers/pinctrl/intel/pinctrl-baytrail.c | 74 +++++---- drivers/pinctrl/intel/pinctrl-intel.h | 4 + drivers/pinctrl/mediatek/pinctrl-paris.c | 40 ++--- drivers/pinctrl/meson/pinctrl-meson-a1.c | 6 +- drivers/platform/x86/acer-wmi.c | 9 + drivers/platform/x86/amd/pmf/acpi.c | 2 +- .../x86/intel/speed_select_if/isst_if_common.c | 1 + drivers/power/supply/mt6360_charger.c | 2 +- drivers/power/supply/rt9455_charger.c | 2 + drivers/regulator/core.c | 27 +-- drivers/regulator/mt6360-regulator.c | 32 ++-- drivers/regulator/tps65132-regulator.c | 7 + drivers/s390/cio/cio_inject.c | 2 +- drivers/s390/net/qeth_core_main.c | 69 ++++---- drivers/scsi/bnx2fc/bnx2fc_tgt.c | 2 - drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 10 +- drivers/scsi/libsas/sas_expander.c | 2 +- drivers/scsi/lpfc/lpfc.h | 2 +- drivers/scsi/lpfc/lpfc_attr.c | 4 +- drivers/scsi/lpfc/lpfc_bsg.c | 20 +-- drivers/scsi/lpfc/lpfc_debugfs.c | 12 +- drivers/scsi/lpfc/lpfc_els.c | 20 +-- drivers/scsi/lpfc/lpfc_hbadisc.c | 5 +- drivers/scsi/lpfc/lpfc_init.c | 5 +- drivers/scsi/lpfc/lpfc_nvme.c | 4 +- drivers/scsi/lpfc/lpfc_scsi.c | 13 +- drivers/scsi/lpfc/lpfc_sli.c | 34 ++-- drivers/scsi/lpfc/lpfc_vport.c | 8 +- drivers/scsi/mpi3mr/mpi3mr_app.c | 2 +- drivers/slimbus/qcom-ngd-ctrl.c | 6 +- drivers/spi/spi-axi-spi-engine.c | 19 +-- drivers/spi/spi-hisi-kunpeng.c | 2 - drivers/spi/spi-microchip-core-qspi.c | 1 + drivers/spi/spi.c | 1 + drivers/target/target_core_configfs.c | 12 ++ drivers/thermal/thermal_debugfs.c | 59 +++++-- drivers/ufs/core/ufs-mcq.c | 2 +- drivers/ufs/core/ufshcd.c | 9 +- drivers/uio/uio_hv_generic.c | 12 +- drivers/usb/core/hub.c | 5 +- drivers/usb/core/port.c | 8 +- drivers/usb/dwc3/core.c | 90 +++++----- drivers/usb/dwc3/core.h | 1 + drivers/usb/dwc3/gadget.c | 2 + drivers/usb/dwc3/host.c | 27 +++ drivers/usb/gadget/composite.c | 6 +- drivers/usb/gadget/function/f_fs.c | 9 +- drivers/usb/gadget/function/uvc_configfs.c | 4 +- drivers/usb/host/ohci-hcd.c | 8 + drivers/usb/host/xhci-plat.h | 4 +- drivers/usb/host/xhci-rzv2m.c | 1 + drivers/usb/typec/tcpm/tcpm.c | 36 +++- drivers/usb/typec/ucsi/ucsi.c | 12 +- fs/9p/fid.h | 3 - fs/9p/vfs_file.c | 2 + fs/9p/vfs_inode.c | 23 ++- fs/9p/vfs_super.c | 1 + fs/btrfs/inode.c | 2 +- fs/btrfs/ordered-data.c | 1 + fs/btrfs/qgroup.c | 2 + fs/btrfs/transaction.c | 2 +- fs/btrfs/tree-checker.c | 30 ++-- fs/btrfs/tree-checker.h | 1 + fs/btrfs/volumes.c | 18 +- fs/exfat/file.c | 9 +- fs/gfs2/bmap.c | 5 +- fs/nfs/client.c | 5 +- fs/nfs/inode.c | 13 +- fs/nfs/internal.h | 2 - fs/nfs/netns.h | 2 + fs/nfsd/cache.h | 2 - fs/nfsd/netns.h | 21 ++- fs/nfsd/nfs4callback.c | 97 ++++++++++- fs/nfsd/nfs4proc.c | 6 +- fs/nfsd/nfs4state.c | 3 +- fs/nfsd/nfs4xdr.c | 2 +- fs/nfsd/nfscache.c | 40 +---- fs/nfsd/nfsctl.c | 14 +- fs/nfsd/nfsfh.c | 3 +- fs/nfsd/state.h | 14 ++ fs/nfsd/stats.c | 43 ++--- fs/nfsd/stats.h | 62 +++---- fs/nfsd/vfs.c | 6 +- fs/nfsd/xdr4cb.h | 18 ++ fs/proc/task_mmu.c | 24 +-- fs/smb/client/cifsglob.h | 1 + fs/smb/client/connect.c | 8 + fs/smb/client/fs_context.c | 21 +++ fs/smb/client/fs_context.h | 2 + fs/smb/client/misc.c | 1 + fs/smb/client/smb2pdu.c | 11 ++ fs/smb/server/oplock.c | 35 ++-- fs/smb/server/transport_tcp.c | 4 + fs/tracefs/event_inode.c | 74 +++++---- fs/tracefs/inode.c | 92 +++++++++- fs/tracefs/internal.h | 14 +- fs/userfaultfd.c | 4 + fs/vboxsf/file.c | 1 + include/linux/compiler_types.h | 11 ++ include/linux/dma-fence.h | 7 - include/linux/gfp_types.h | 2 + include/linux/hyperv.h | 1 + include/linux/regmap.h | 8 + include/linux/regulator/consumer.h | 4 +- include/linux/skbuff.h | 15 ++ include/linux/skmsg.h | 2 + include/linux/slab.h | 4 +- include/linux/sockptr.h | 25 +++ include/linux/sunrpc/clnt.h | 1 + include/net/gro.h | 9 + include/net/xfrm.h | 3 + include/sound/emu10k1.h | 3 +- include/trace/events/rxrpc.h | 2 +- include/uapi/linux/kfd_ioctl.h | 17 +- include/uapi/scsi/scsi_bsg_mpi3mr.h | 2 +- kernel/bpf/bloom_filter.c | 13 ++ kernel/bpf/verifier.c | 3 +- kernel/dma/swiotlb.c | 1 + kernel/workqueue.c | 8 +- lib/Kconfig.debug | 5 +- lib/dynamic_debug.c | 6 +- lib/maple_tree.c | 16 +- lib/scatterlist.c | 2 +- mm/readahead.c | 4 + mm/slub.c | 52 +++--- net/8021q/vlan_core.c | 2 + net/bluetooth/hci_core.c | 3 +- net/bluetooth/hci_event.c | 2 + net/bluetooth/l2cap_core.c | 3 + net/bluetooth/msft.c | 2 +- net/bluetooth/msft.h | 4 +- net/bluetooth/sco.c | 4 + net/bridge/br_forward.c | 9 +- net/bridge/br_netlink.c | 3 +- net/core/filter.c | 42 +++-- net/core/gro.c | 1 + net/core/link_watch.c | 4 +- net/core/net-sysfs.c | 4 +- net/core/net_namespace.c | 13 +- net/core/rtnetlink.c | 6 +- net/core/skbuff.c | 27 ++- net/core/skmsg.c | 5 +- net/core/sock.c | 4 +- net/hsr/hsr_device.c | 31 ++-- net/ipv4/af_inet.c | 1 + net/ipv4/ip_output.c | 2 +- net/ipv4/raw.c | 3 + net/ipv4/tcp.c | 4 +- net/ipv4/tcp_input.c | 2 + net/ipv4/tcp_ipv4.c | 8 +- net/ipv4/tcp_output.c | 4 +- net/ipv4/udp.c | 3 +- net/ipv4/udp_offload.c | 15 +- net/ipv4/xfrm4_input.c | 6 +- net/ipv6/addrconf.c | 11 +- net/ipv6/fib6_rules.c | 6 +- net/ipv6/ip6_input.c | 4 +- net/ipv6/ip6_offload.c | 1 + net/ipv6/ip6_output.c | 4 +- net/ipv6/udp.c | 3 +- net/ipv6/udp_offload.c | 3 +- net/ipv6/xfrm6_input.c | 6 +- net/l2tp/l2tp_eth.c | 3 + net/mac80211/ieee80211_i.h | 4 +- net/mac80211/mlme.c | 5 +- net/mptcp/ctrl.c | 39 ++++- net/mptcp/protocol.c | 3 + net/nfc/llcp_sock.c | 12 +- net/nfc/nci/core.c | 1 + net/nsh/nsh.c | 14 +- net/phonet/pn_netlink.c | 2 +- net/rxrpc/ar-internal.h | 2 +- net/rxrpc/call_object.c | 7 +- net/rxrpc/conn_event.c | 16 +- net/rxrpc/conn_object.c | 9 +- net/rxrpc/input.c | 71 +++++--- net/rxrpc/output.c | 14 +- net/rxrpc/protocol.h | 6 +- net/smc/smc_ib.c | 19 ++- net/sunrpc/clnt.c | 5 +- net/sunrpc/xprtsock.c | 1 + net/tipc/msg.c | 8 +- net/wireless/nl80211.c | 2 + net/wireless/trace.h | 2 +- net/xfrm/xfrm_input.c | 8 + rust/macros/module.rs | 185 +++++++++++++-------- scripts/Makefile.modfinal | 2 +- sound/hda/intel-sdw-acpi.c | 2 + sound/oss/dmasound/dmasound_paula.c | 8 +- sound/pci/emu10k1/emu10k1.c | 3 +- sound/pci/emu10k1/emu10k1_main.c | 139 +++++++++------- sound/pci/hda/patch_realtek.c | 25 ++- sound/soc/codecs/es8326.c | 30 ++-- sound/soc/codecs/es8326.h | 2 +- sound/soc/codecs/wsa881x.c | 1 + sound/soc/intel/avs/topology.c | 2 + sound/soc/meson/Kconfig | 1 + sound/soc/meson/axg-card.c | 1 + sound/soc/meson/axg-fifo.c | 56 ++++--- sound/soc/meson/axg-fifo.h | 12 +- sound/soc/meson/axg-frddr.c | 5 +- sound/soc/meson/axg-tdm-interface.c | 34 ++-- sound/soc/meson/axg-toddr.c | 22 ++- sound/soc/sof/intel/hda-dsp.c | 20 ++- sound/soc/sof/intel/pci-lnl.c | 3 + sound/soc/tegra/tegra186_dspk.c | 7 +- sound/soc/ti/davinci-mcasp.c | 12 +- sound/usb/line6/driver.c | 6 +- tools/include/linux/kernel.h | 1 + tools/include/linux/mm.h | 5 + tools/include/linux/panic.h | 19 +++ tools/power/x86/turbostat/turbostat.8 | 2 +- tools/power/x86/turbostat/turbostat.c | 163 +++++++++++++----- .../selftests/bpf/prog_tests/bloom_filter_map.c | 6 + .../ftrace/test.d/filter/event-filter-function.tc | 2 +- tools/testing/selftests/mm/Makefile | 6 +- .../selftests/net/test_bridge_neigh_suppress.sh | 14 +- tools/testing/selftests/timers/valid-adjtimex.c | 73 ++++---- 369 files changed, 3269 insertions(+), 1864 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/336 rust: module: place generated init_module() function in .init.text
6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Bertschinger <[email protected]>
[ Upstream commit 1b6170ff7a203a5e8354f19b7839fe8b897a9c0d ]
Currently Rust kernel modules have their init code placed in the .text section of the .ko file. I don't think this causes any real problems for Rust modules as long as all code called during initialization lives in .text.
However, if a Rust init_module() function (that lives in .text) calls a function marked with __init (in C) or #[link_section = ".init.text"] (in Rust), then a warning is generated by modpost because that function lives in .init.text. For example:
WARNING: modpost: fs/bcachefs/bcachefs: section mismatch in reference: init_module+0x6 (section: .text) -> _RNvXCsj7d3tFpT5JS_15bcachefs_moduleNtB2_8BcachefsNtCsjDtqRIL3JAG_6kernel6Module4init (section: .init.text)
I ran into this while experimenting with converting the bcachefs kernel module from C to Rust. The module's init(), written in Rust, calls C functions like bch2_vfs_init() which are placed in .init.text.
This patch places the macro-generated init_module() Rust function in the .init.text section. It also marks init_module() as unsafe--now it may not be called after module initialization completes because it may be freed already.
Note that this is not enough on its own to actually get all the module initialization code in that section. The module author must still add the #[link_section = ".init.text"] attribute to the Rust init() in the impl kernel::Module block in order to then call __init functions. However, this patch enables module authors do so, when previously it would not be possible (without warnings).
Stable-dep-of: 7044dcff8301 ("rust: macros: fix soundness issue in module! macro")
--- rust/macros/module.rs | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
rust/macros/module.rs +6 -1
@@ -222,10 +222,15 @@ pub(crate) fn module(ts: TokenStream) -> TokenStream { }};// Loadable modules need to export the `{{init,cleanup}}_module` identifiers. +/// # Safety +/// +/// This function must not be called after module initialization, because it may be +/// freed after that completes. #[cfg( MODULE )] #[doc(hidden)] #[no_mangle] - pub extern \"C\" fn init_module() -> core::ffi::c_int {{ + #[link_section = \".init.text\"] + pub unsafe extern \"C\" fn init_module() -> core::ffi::c_int {{ __init() }}
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 2/336 rust: macros: fix soundness issue in `module!` macro
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benno Lossin <[email protected]>
[ Upstream commit 7044dcff8301b29269016ebd17df27c4736140d2 ]
The module! macro creates glue code that are called by C to initialize the Rust modules using the Module::init function. Part of this glue code are the local functions __init and __exit that are used to initialize/destroy the Rust module.
These functions are safe and also visible to the Rust mod in which the module! macro is invoked. This means that they can be called by other safe Rust code. But since they contain unsafe blocks that rely on only being called at the right time, this is a soundness issue.
Wrap these generated functions inside of two private modules, this guarantees that the public functions cannot be called from the outside. Make the safe functions unsafe and add SAFETY comments.
[ Moved THIS_MODULE out of the private-in-private modules since it
should remain public, as Dirk Behme noticed [1]. Capitalized comments, avoided newline in non-list SAFETY comments and reworded to add Reported-by and newline. ]
--- rust/macros/module.rs | 190 +++++++++++++++++++++++++----------------- 1 file changed, 115 insertions(+), 75 deletions(-)
rust/macros/module.rs +115 -75
@@ -199,17 +199,6 @@ pub(crate) fn module(ts: TokenStream) -> TokenStream {/// Used by the printing macros, e.g. [`info!`]. const __LOG_PREFIX: &[u8] = b\"{name}\\0\"; -/// The \"Rust loadable module\" mark. -// -// This may be best done another way later on, e.g. as a new modinfo -// key or a new section. For the moment, keep it simple. -#[cfg( MODULE )] -#[doc(hidden)] -#[used] -static __IS_RUST_MODULE: () = (); - -static mut __MOD:Option <{type_}> =None ; -// SAFETY: `__this_module` is constructed by the kernel at load time and will not be // freed until the module is unloaded. #[cfg( MODULE )]
@@ -221,81 +210,132 @@ pub(crate) fn module(ts: TokenStream) -> TokenStream { kernel::ThisModule ::from_ptr (core::ptr::null_mut ()) }}; -// Loadable modules need to export the `{{init,cleanup}}_module` identifiers. -/// # Safety -/// -/// This function must not be called after module initialization, because it may be -/// freed after that completes. -#[cfg( MODULE )] -#[doc(hidden)] -#[no_mangle] - #[link_section = \".init.text\"] - pub unsafe extern \"C\" fn init_module() -> core::ffi::c_int {{ - __init() - }} - - #[cfg(MODULE)] - #[doc(hidden)] - #[no_mangle] - pub extern \"C\" fn cleanup_module() {{ - __exit() - }} +// Double nested modules, since then nobody can access the public items inside. + mod __module_init {{ + mod __module_init {{ +use super ::super ::{type_}; + +/// The \"Rust loadable module\" mark. +// +// This may be best done another way later on, e.g. as a new modinfo +// key or a new section. For the moment, keep it simple. +#[cfg( MODULE )] +#[doc(hidden)] +#[used] +static __IS_RUST_MODULE: () = (); + +static mut __MOD:Option <{type_}> =None ; + +// Loadable modules need to export the `{{init,cleanup}}_module` identifiers. +/// # Safety +/// +/// This function must not be called after module initialization, because it may be +/// freed after that completes. +#[cfg( MODULE )] +#[doc(hidden)] +#[no_mangle] + #[link_section = \".init.text\"] + pub unsafe extern \"C\" fn init_module() -> core::ffi::c_int {{ + // SAFETY: This function is inaccessible to the outside due to the double + // module wrapping it. It is called exactly once by the C side via its + // unique name. + unsafe {{ __init() }} + }} - // Built-in modules are initialized through an initcall pointer - // and the identifiers need to be unique. - #[cfg(not(MODULE))] - #[cfg(not(CONFIG_HAVE_ARCH_PREL32_RELOCATIONS))] - #[doc(hidden)] - #[link_section = \"{initcall_section}\"] - #[used] - pub static __{name}_initcall: extern \"C\" fn() -> core::ffi::c_int = __{name}_init; + #[cfg(MODULE)] + #[doc(hidden)] + #[no_mangle] + pub extern \"C\" fn cleanup_module() {{ + // SAFETY: + // - This function is inaccessible to the outside due to the double + // module wrapping it. It is called exactly once by the C side via its + // unique name, + // - furthermore it is only called after `init_module` has returned `0` + // (which delegates to `__init`). + unsafe {{ __exit() }} + }} - #[cfg(not(MODULE))] - #[cfg(CONFIG_HAVE_ARCH_PREL32_RELOCATIONS)] - core::arch::global_asm!( - r#\".section \"{initcall_section}\", \"a\" - __{name}_initcall: - .long __{name}_init - . - .previous - \"# - ); + // Built-in modules are initialized through an initcall pointer + // and the identifiers need to be unique. + #[cfg(not(MODULE))] + #[cfg(not(CONFIG_HAVE_ARCH_PREL32_RELOCATIONS))] + #[doc(hidden)] + #[link_section = \"{initcall_section}\"] + #[used] + pub static __{name}_initcall: extern \"C\" fn() -> core::ffi::c_int = __{name}_init; + + #[cfg(not(MODULE))] + #[cfg(CONFIG_HAVE_ARCH_PREL32_RELOCATIONS)] + core::arch::global_asm!( + r#\".section \"{initcall_section}\", \"a\" + __{name}_initcall: + .long __{name}_init - . + .previous + \"# + ); + + #[cfg(not(MODULE))] + #[doc(hidden)] + #[no_mangle] + pub extern \"C\" fn __{name}_init() -> core::ffi::c_int {{ + // SAFETY: This function is inaccessible to the outside due to the double + // module wrapping it. It is called exactly once by the C side via its + // placement above in the initcall section. + unsafe {{ __init() }} + }} - #[cfg(not(MODULE))] - #[doc(hidden)] - #[no_mangle] - pub extern \"C\" fn __{name}_init() -> core::ffi::c_int {{ - __init() - }} + #[cfg(not(MODULE))] + #[doc(hidden)] + #[no_mangle] + pub extern \"C\" fn __{name}_exit() {{ + // SAFETY: + // - This function is inaccessible to the outside due to the double + // module wrapping it. It is called exactly once by the C side via its + // unique name, + // - furthermore it is only called after `__{name}_init` has returned `0` + // (which delegates to `__init`). + unsafe {{ __exit() }} + }} - #[cfg(not(MODULE))] - #[doc(hidden)] - #[no_mangle] - pub extern \"C\" fn __{name}_exit() {{ - __exit() - }} + /// # Safety + /// + /// This function must only be called once. + unsafe fn __init() -> core::ffi::c_int {{ + match <{type_} as kernel::Module>::init(&super::super::THIS_MODULE) {{ + Ok(m) => {{ + // SAFETY: No data race, since `__MOD` can only be accessed by this + // module and there only `__init` and `__exit` access it. These + // functions are only called once and `__exit` cannot be called + // before or during `__init`. + unsafe {{ + __MOD = Some(m); + }} + return 0; + }} + Err(e) => {{ + return e.to_errno(); + }} + }} + }} - fn __init() -> core::ffi::c_int {{ - match <{type_} as kernel::Module>::init(&THIS_MODULE) {{ - Ok(m) => {{ + /// # Safety + /// + /// This function must + /// - only be called once, + /// - be called after `__init` has been called and returned `0`. + unsafe fn __exit() {{ + // SAFETY: No data race, since `__MOD` can only be accessed by this module + // and there only `__init` and `__exit` access it. These functions are only + // called once and `__init` was already called. unsafe {{ - __MOD = Some(m); + // Invokes `drop()` on `__MOD`, which should be used for cleanup. + __MOD = None; }} - return 0; - }} - Err(e) => {{ - return e.to_errno(); }} - }} - }} - fn __exit() {{ - unsafe {{ - // Invokes `drop()` on `__MOD`, which should be used for cleanup. - __MOD = None; + {modinfo} }} }} - - {modinfo} ", type_ = info.type_, name = info.name,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 3/336 wifi: nl80211: dont free NULL coalescing rule
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 801ea33ae82d6a9d954074fbcf8ea9d18f1543a7 ]
If the parsing fails, we can dereference a NULL pointer here.
--- net/wireless/nl80211.c | 2 ++ 1 file changed, 2 insertions(+)
net/wireless/nl80211.c +2 -0
@@ -14092,6 +14092,8 @@ static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info) error:for (i =0 ; i < new_coalesce.n_rules; i++) { tmp_rule = &new_coalesce.rules[i]; +if (!tmp_rule) +continue ;for (j =0 ; j < tmp_rule->n_patterns; j++)kfree (tmp_rule->patterns[j].mask);kfree (tmp_rule->patterns);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 4/336 pinctrl: pinctrl-aspeed-g6: Fix register offset for pinconf of GPIOR-T
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Billy Tsai <[email protected]>
[ Upstream commit c10cd03d69403fa0f00be8631bd4cb4690440ebd ]
The register offset to disable the internal pull-down of GPIOR~T is 0x630 instead of 0x620, as specified in the Ast2600 datasheet v15 The datasheet can download from the official Aspeed website.
Message-ID: <[email protected]>
--- drivers/pinctrl/aspeed/pinctrl-aspeed-g6.c | 34 +++++++++++----------- 1 file changed, 17 insertions(+), 17 deletions(-)
drivers/pinctrl/aspeed/pinctrl-aspeed-g6.c +17 -17
@@ -43,7 +43,7 @@#define SCU614 0x614/* Disable GPIO Internal Pull-Down #1 */ #define SCU618 0x618/* Disable GPIO Internal Pull-Down #2 */ #define SCU61C 0x61c/* Disable GPIO Internal Pull-Down #3 */ -#define SCU620 0x620/* Disable GPIO Internal Pull-Down #4 */ +#define SCU630 0x630/* Disable GPIO Internal Pull-Down #4 */ #define SCU634 0x634/* Disable GPIO Internal Pull-Down #5 */ #define SCU638 0x638/* Disable GPIO Internal Pull-Down #6 */ #define SCU690 0x690/* Multi-function Pin Control #24 */
@@ -2495,38 +2495,38 @@ static struct aspeed_pin_config aspeed_g6_configs[] = {ASPEED_PULL_DOWN_PINCONF (D14 ,SCU61C ,0 ),/* GPIOS7 */ -ASPEED_PULL_DOWN_PINCONF (T24 ,SCU620 ,23 ), +ASPEED_PULL_DOWN_PINCONF (T24 ,SCU630 ,23 ),/* GPIOS6 */ -ASPEED_PULL_DOWN_PINCONF (P23 ,SCU620 ,22 ), +ASPEED_PULL_DOWN_PINCONF (P23 ,SCU630 ,22 ),/* GPIOS5 */ -ASPEED_PULL_DOWN_PINCONF (P24 ,SCU620 ,21 ), +ASPEED_PULL_DOWN_PINCONF (P24 ,SCU630 ,21 ),/* GPIOS4 */ -ASPEED_PULL_DOWN_PINCONF (R26 ,SCU620 ,20 ), +ASPEED_PULL_DOWN_PINCONF (R26 ,SCU630 ,20 ),/* GPIOS3*/ -ASPEED_PULL_DOWN_PINCONF (R24 ,SCU620 ,19 ), +ASPEED_PULL_DOWN_PINCONF (R24 ,SCU630 ,19 ),/* GPIOS2 */ -ASPEED_PULL_DOWN_PINCONF (T26 ,SCU620 ,18 ), +ASPEED_PULL_DOWN_PINCONF (T26 ,SCU630 ,18 ),/* GPIOS1 */ -ASPEED_PULL_DOWN_PINCONF (T25 ,SCU620 ,17 ), +ASPEED_PULL_DOWN_PINCONF (T25 ,SCU630 ,17 ),/* GPIOS0 */ -ASPEED_PULL_DOWN_PINCONF (R23 ,SCU620 ,16 ), +ASPEED_PULL_DOWN_PINCONF (R23 ,SCU630 ,16 ),/* GPIOR7 */ -ASPEED_PULL_DOWN_PINCONF (U26 ,SCU620 ,15 ), +ASPEED_PULL_DOWN_PINCONF (U26 ,SCU630 ,15 ),/* GPIOR6 */ -ASPEED_PULL_DOWN_PINCONF (W26 ,SCU620 ,14 ), +ASPEED_PULL_DOWN_PINCONF (W26 ,SCU630 ,14 ),/* GPIOR5 */ -ASPEED_PULL_DOWN_PINCONF (T23 ,SCU620 ,13 ), +ASPEED_PULL_DOWN_PINCONF (T23 ,SCU630 ,13 ),/* GPIOR4 */ -ASPEED_PULL_DOWN_PINCONF (U25 ,SCU620 ,12 ), +ASPEED_PULL_DOWN_PINCONF (U25 ,SCU630 ,12 ),/* GPIOR3*/ -ASPEED_PULL_DOWN_PINCONF (V26 ,SCU620 ,11 ), +ASPEED_PULL_DOWN_PINCONF (V26 ,SCU630 ,11 ),/* GPIOR2 */ -ASPEED_PULL_DOWN_PINCONF (V24 ,SCU620 ,10 ), +ASPEED_PULL_DOWN_PINCONF (V24 ,SCU630 ,10 ),/* GPIOR1 */ -ASPEED_PULL_DOWN_PINCONF (U24 ,SCU620 ,9 ), +ASPEED_PULL_DOWN_PINCONF (U24 ,SCU630 ,9 ),/* GPIOR0 */ -ASPEED_PULL_DOWN_PINCONF (V25 ,SCU620 ,8 ), +ASPEED_PULL_DOWN_PINCONF (V25 ,SCU630 ,8 ),/* GPIOX7 */ ASPEED_PULL_DOWN_PINCONF(AB10, SCU634, 31),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 5/336 pinctrl/meson: fix typo in PDMs pin name
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Dakinevich <[email protected]>
[ Upstream commit 368a90e651faeeb7049a876599cf2b0d74954796 ]
Other pins have _a or _x suffix, but this one doesn't have any. Most likely this is a typo.
Message-ID: <[email protected]>
--- drivers/pinctrl/meson/pinctrl-meson-a1.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/pinctrl/meson/pinctrl-meson-a1.c +3 -3
@@ -250,7 +250,7 @@ static const unsigned int pdm_dclk_x_pins[] = { GPIOX_10 };static const unsigned int pdm_din2_a_pins[] = {GPIOA_6 };static const unsigned int pdm_din1_a_pins[] = {GPIOA_7 };static const unsigned int pdm_din0_a_pins[] = {GPIOA_8 }; -static const unsigned int pdm_dclk_pins[] = {GPIOA_9 }; +static const unsigned int pdm_dclk_a_pins[] = {GPIOA_9 };/* gen_clk */ static const unsigned int gen_clk_x_pins[] = {GPIOX_7 };
@@ -591,7 +591,7 @@ static struct meson_pmx_group meson_a1_periphs_groups[] = {GROUP (pdm_din2_a,3 ),GROUP (pdm_din1_a,3 ),GROUP (pdm_din0_a,3 ), -GROUP (pdm_dclk,3 ), +GROUP (pdm_dclk_a,3 ),GROUP (pwm_c_a,3 ), GROUP(pwm_b_a, 3),
@@ -755,7 +755,7 @@ static const char * const spi_a_groups[] = {static const char *const pdm_groups[] = {"pdm_din0_x" ,"pdm_din1_x" ,"pdm_din2_x" ,"pdm_dclk_x" ,"pdm_din2_a" , -"pdm_din1_a" ,"pdm_din0_a" ,"pdm_dclk" , +"pdm_din1_a" ,"pdm_din0_a" ,"pdm_dclk_a" , };static const char *const gen_clk_groups[] = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 6/336 pinctrl: core: delete incorrect free in pinctrl_enable()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 5038a66dad0199de60e5671603ea6623eb9e5c79 ]
The "pctldev" struct is allocated in devm_pinctrl_register_and_init(). It's a devm_ managed pointer that is freed by devm_pinctrl_dev_release(), so freeing it in pinctrl_enable() will lead to a double free.
The devm_pinctrl_dev_release() function frees the pindescs and destroys the mutex as well.
Message-ID: <[email protected]>
--- drivers/pinctrl/core.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-)
drivers/pinctrl/core.c +1 -7
@@ -2120,13 +2120,7 @@ int pinctrl_enable(struct pinctrl_dev *pctldev) error =pinctrl_claim_hogs (pctldev);if (error) { -dev_err (pctldev->dev,"could not claim hogs: %i\n" , - error); -pinctrl_free_pindescs (pctldev, pctldev->desc->pins, - pctldev->desc->npins); -mutex_destroy (&pctldev->mutex); -kfree (pctldev); - +dev_err (pctldev->dev,"could not claim hogs: %i\n" , error);return error; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 7/336 pinctrl: mediatek: paris: Fix PIN_CONFIG_INPUT_SCHMITT_ENABLE readback
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <[email protected]>
[ Upstream commit 08f66a8edd08f6f7cfa769c81634b29a2b123908 ]
In the generic pin config library, readback of some options are handled differently compared to the setting of those options: the argument value is used to convey enable/disable of an option in the set path, but success or -EINVAL is used to convey if an option is enabled or disabled in the debugfs readback path.
PIN_CONFIG_INPUT_SCHMITT_ENABLE is one such option. Fix the readback of the option in the mediatek-paris library, so that the debugfs dump is not showing "input schmitt enabled" for pins that don't have it enabled.
Message-ID: <[email protected]>
--- drivers/pinctrl/mediatek/pinctrl-paris.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/pinctrl/mediatek/pinctrl-paris.c +2 -0
@@ -193,6 +193,8 @@ static int mtk_pinconf_get(struct pinctrl_dev *pctldev, } err =mtk_hw_get_value (hw, desc,PINCTRL_PIN_REG_SMT , &ret); +if (!ret) + err = -EINVAL ;break ;case PIN_CONFIG_DRIVE_STRENGTH :if (!hw->soc->drive_get)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 8/336 pinctrl: mediatek: paris: Rework support for PIN_CONFIG_{INPUT,OUTPUT}_ENABLE
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <[email protected]>
[ Upstream commit c5d3b64c568a344e998830e0e94a7c04e372f89b ]
There is a misinterpretation of some of the PIN_CONFIG_* options in this driver library. PIN_CONFIG_OUTPUT_ENABLE should refer to a buffer or switch in the output direction of the electrical path. The MediaTek hardware does not have such a thing. The driver incorrectly maps this option to the GPIO function's direction.
Likewise, PIN_CONFIG_INPUT_ENABLE should refer to a buffer or switch in the input direction. The hardware does have such a mechanism, and is mapped to the IES bit. The driver however sets the direction in addition to the IES bit, which is incorrect. On readback, the IES bit isn't even considered.
Ironically, the driver does not support readback for PIN_CONFIG_OUTPUT, while its readback of PIN_CONFIG_{INPUT,OUTPUT}_ENABLE is what it should be doing for PIN_CONFIG_OUTPUT.
Rework support for these three options, so that PIN_CONFIG_OUTPUT_ENABLE is completely removed, PIN_CONFIG_INPUT_ENABLE is only linked to the IES bit, and PIN_CONFIG_OUTPUT is linked to the GPIO function's direction and output level.
Message-ID: <[email protected]>
--- drivers/pinctrl/mediatek/pinctrl-paris.c | 38 +++++++----------------- 1 file changed, 11 insertions(+), 27 deletions(-)
drivers/pinctrl/mediatek/pinctrl-paris.c +11 -27
@@ -165,20 +165,21 @@ static int mtk_pinconf_get(struct pinctrl_dev *pctldev, err =mtk_hw_get_value (hw, desc,PINCTRL_PIN_REG_SR , &ret);break ;case PIN_CONFIG_INPUT_ENABLE : -case PIN_CONFIG_OUTPUT_ENABLE : + err =mtk_hw_get_value (hw, desc,PINCTRL_PIN_REG_IES , &ret); +if (!ret) + err = -EINVAL ; +break ; +case PIN_CONFIG_OUTPUT : err =mtk_hw_get_value (hw, desc,PINCTRL_PIN_REG_DIR , &ret);if (err)break ; -/* CONFIG Current direction return value -* ------------- ----------------- ---------------------- -* OUTPUT_ENABLE output 1 (= HW value) -* input 0 (= HW value) -* INPUT_ENABLE output 0 (= reverse HW value) -* input 1 (= reverse HW value) -*/ -if (param ==PIN_CONFIG_INPUT_ENABLE ) - ret = !ret; +if (!ret) { + err = -EINVAL ; +break ; + } + + err =mtk_hw_get_value (hw, desc,PINCTRL_PIN_REG_DO , &ret);break ;case PIN_CONFIG_INPUT_SCHMITT_ENABLE : err =mtk_hw_get_value (hw, desc,PINCTRL_PIN_REG_DIR , &ret);
@@ -283,26 +284,9 @@ static int mtk_pinconf_set(struct pinctrl_dev *pctldev, unsigned int pin,break ; err = hw->soc->bias_set_combo (hw, desc,0 , arg);break ; -case PIN_CONFIG_OUTPUT_ENABLE : - err =mtk_hw_set_value (hw, desc,PINCTRL_PIN_REG_SMT , -MTK_DISABLE ); -/* Keep set direction to consider the case that a GPIO pin -* does not have SMT control -*/ -if (err != -ENOTSUPP ) -break ; - - err =mtk_hw_set_value (hw, desc,PINCTRL_PIN_REG_DIR , -MTK_OUTPUT ); -break ;case PIN_CONFIG_INPUT_ENABLE :/* regard all non-zero value as enable */ err =mtk_hw_set_value (hw, desc,PINCTRL_PIN_REG_IES , !!arg); -if (err) -break ; - - err =mtk_hw_set_value (hw, desc,PINCTRL_PIN_REG_DIR , -MTK_INPUT );break ;case PIN_CONFIG_SLEW_RATE :/* regard all non-zero value as enable */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 9/336 sunrpc: add a struct rpc_stats arg to rpc_create_args
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <[email protected]>
[ Upstream commit 2057a48d0dd00c6a2a94ded7df2bf1d3f2a4a0da ]
We want to be able to have our rpc stats handled in a per network namespace manner, so add an option to rpc_create_args to specify a different rpc_stats struct instead of using the one on the rpc_program.
Stable-dep-of: 24457f1be29f ("nfs: Handle error of rpc_proc_register() in nfs_net_init().")
--- include/linux/sunrpc/clnt.h | 1 + net/sunrpc/clnt.c | 5 ++++- 2 files changed, 5 insertions(+), 1 deletion(-)
include/linux/sunrpc/clnt.h +1 -0
@@ -139,6 +139,7 @@ struct rpc_create_args {const char *servername;const char *nodename;const struct rpc_program *program; +struct rpc_stat *stats;u32 prognumber;/* overrides program->number */ u32 version;rpc_authflavor_t authflavor;
net/sunrpc/clnt.c +4 -1
@@ -405,7 +405,7 @@ static struct rpc_clnt * rpc_new_client(const struct rpc_create_args *args, clnt->cl_maxproc = version->nrprocs; clnt->cl_prog = args->prognumber ? : program->number; clnt->cl_vers = version->number; - clnt->cl_stats = program->stats; + clnt->cl_stats = args->stats ? : program->stats; clnt->cl_metrics =rpc_alloc_iostats (clnt);rpc_init_pipe_dir_head (&clnt->cl_pipedir_objects); err = -ENOMEM ;
@@ -691,6 +691,7 @@ struct rpc_clnt *rpc_clone_client(struct rpc_clnt *clnt) .version = clnt->cl_vers, .authflavor = clnt->cl_auth->au_flavor, .cred = clnt->cl_cred, + .stats = clnt->cl_stats, };return __rpc_clone_client (&args, clnt); }
@@ -713,6 +714,7 @@ rpc_clone_client_set_auth(struct rpc_clnt *clnt, rpc_authflavor_t flavor) .version = clnt->cl_vers, .authflavor = flavor, .cred = clnt->cl_cred, + .stats = clnt->cl_stats, };return __rpc_clone_client (&args, clnt); }
@@ -1068,6 +1070,7 @@ struct rpc_clnt *rpc_bind_new_program(struct rpc_clnt *old, .version = vers, .authflavor = old->cl_auth->au_flavor, .cred = old->cl_cred, + .stats = old->cl_stats, };struct rpc_clnt *clnt;int err;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 10/336 nfs: expose /proc/net/sunrpc/nfs in net namespaces
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <[email protected]>
[ Upstream commit d47151b79e3220e72ae323b8b8e9d6da20dc884e ]
We're using nfs mounts inside of containers in production and noticed that the nfs stats are not exposed in /proc. This is a problem for us as we use these stats for monitoring, and have to do this awkward bind mount from the main host into the container in order to get to these states.
Add the rpc_proc_register call to the pernet operations entry and exit points so these stats can be exposed inside of network namespaces.
Stable-dep-of: 24457f1be29f ("nfs: Handle error of rpc_proc_register() in nfs_net_init().")
--- fs/nfs/inode.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
fs/nfs/inode.c +2 -4
@@ -2427,11 +2427,13 @@ EXPORT_SYMBOL_GPL(nfs_net_id);static int nfs_net_init (struct net *net) {nfs_clients_init (net); +rpc_proc_register (net, &nfs_rpcstat);return nfs_fs_proc_net_init (net); }static void nfs_net_exit (struct net *net) { +rpc_proc_unregister (net,"nfs" );nfs_fs_proc_net_exit (net);nfs_clients_exit (net); }
@@ -2486,15 +2488,12 @@ static int __init init_nfs_fs(void)if (err) goto out1; -rpc_proc_register (&init_net, &nfs_rpcstat); - err =register_nfs_fs ();if (err) goto out0;return 0 ; out0: -rpc_proc_unregister (&init_net,"nfs" );nfs_destroy_directcache (); out1:nfs_destroy_writepagecache ();
@@ -2524,7 +2523,6 @@ static void __exit exit_nfs_fs(void)nfs_destroy_inodecache ();nfs_destroy_nfspagecache ();unregister_pernet_subsys (&nfs_net_ops); -rpc_proc_unregister (&init_net,"nfs" );unregister_nfs_fs ();nfs_fs_proc_exit ();nfsiod_stop ();
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 11/336 nfs: make the rpc_stat per net namespace
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <[email protected]>
[ Upstream commit 1548036ef1204df65ca5a16e8b199c858cb80075 ]
Now that we're exposing the rpc stats on a per-network namespace basis, move this struct into struct nfs_net and use that to make sure only the per-network namespace stats are exposed.
Stable-dep-of: 24457f1be29f ("nfs: Handle error of rpc_proc_register() in nfs_net_init().")
--- fs/nfs/client.c | 5 ++++- fs/nfs/inode.c | 4 +++- fs/nfs/internal.h | 2 -- fs/nfs/netns.h | 2 ++ 4 files changed, 9 insertions(+), 4 deletions(-)
fs/nfs/client.c +4 -1
@@ -73,7 +73,6 @@ const struct rpc_program nfs_program = { .number = NFS_PROGRAM, .nrvers = ARRAY_SIZE(nfs_version), .version = nfs_version, - .stats = &nfs_rpcstat, .pipe_dir_name = NFS_PIPE_DIRNAME, };
@@ -502,6 +501,7 @@ int nfs_create_rpc_client(struct nfs_client *clp,const struct nfs_client_initdata *cl_init, rpc_authflavor_t flavor) { + struct nfs_net *nn = net_generic(clp->cl_net, nfs_net_id);struct rpc_clnt *clnt =NULL ; struct rpc_create_args args = { .net = clp->cl_net,
@@ -513,6 +513,7 @@ int nfs_create_rpc_client(struct nfs_client *clp, .servername = clp->cl_hostname, .nodename = cl_init->nodename, .program = &nfs_program, + .stats = &nn->rpcstats, .version = clp->rpc_ops->version, .authflavor = flavor, .cred = cl_init->cred,
@@ -1182,6 +1183,8 @@ void nfs_clients_init(struct net *net)#endif spin_lock_init (&nn->nfs_client_lock); nn->boot_time =ktime_get_real (); +memset (&nn->rpcstats,0 ,sizeof (nn->rpcstats)); + nn->rpcstats.program = &nfs_program;nfs_netns_sysfs_setup (nn, net); }
fs/nfs/inode.c +3 -1
@@ -2426,8 +2426,10 @@ EXPORT_SYMBOL_GPL(nfs_net_id);static int nfs_net_init (struct net *net) { +struct nfs_net *nn =net_generic (net, nfs_net_id); +nfs_clients_init (net); -rpc_proc_register (net, &nfs_rpcstat); +rpc_proc_register (net, &nn->rpcstats);return nfs_fs_proc_net_init (net); }
fs/nfs/internal.h +0 -2
@@ -449,8 +449,6 @@ int nfs_try_get_tree(struct fs_context *);int nfs_get_tree_common (struct fs_context *);void nfs_kill_super (struct super_block *); -extern struct rpc_stat nfs_rpcstat; -extern int __init register_nfs_fs (void ); extern void __exit unregister_nfs_fs(void);extern bool nfs_sb_active (struct super_block *sb);
fs/nfs/netns.h +2 -0
@@ -9,6 +9,7 @@#include <linux/nfs4.h> #include <net/net_namespace.h> #include <net/netns/generic.h> +#include <linux/sunrpc/stats.h> struct bl_dev_msg {int32_t status;
@@ -34,6 +35,7 @@ struct nfs_net {struct nfs_netns_client *nfs_client;spinlock_t nfs_client_lock;ktime_t boot_time; +struct rpc_stat rpcstats;#ifdef CONFIG_PROC_FS struct proc_dir_entry *proc_nfsfs;#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 12/336 nfs: Handle error of rpc_proc_register() in nfs_net_init().
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 24457f1be29f1e7042e50a7749f5c2dde8c433c8 ]
syzkaller reported a warning [0] triggered while destroying immature netns.
rpc_proc_register() was called in init_nfs_fs(), but its error has been ignored since at least the initial commit 1da177e4c3f4 ("Linux-2.6.12-rc2").
Recently, commit d47151b79e32 ("nfs: expose /proc/net/sunrpc/nfs in net namespaces") converted the procfs to per-netns and made the problem more visible.
Even when rpc_proc_register() fails, nfs_net_init() could succeed, and thus nfs_net_exit() will be called while destroying the netns.
Then, remove_proc_entry() will be called for non-existing proc directory and trigger the warning below.
Let's handle the error of rpc_proc_register() properly in nfs_net_init().
[0]:
name 'nfs'
WARNING: CPU: 1 PID: 1710 at fs/proc/generic.c:711 remove_proc_entry+0x1bb/0x2d0 fs/proc/generic.c:711 Modules linked in: CPU: 1 PID: 1710 Comm: syz-executor.2 Not tainted 6.8.0-12822-gcd51db110a7e #12 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:remove_proc_entry+0x1bb/0x2d0 fs/proc/generic.c:711 Code: 41 5d 41 5e c3 e8 85 09 b5 ff 48 c7 c7 88 58 64 86 e8 09 0e 71 02 e8 74 09 b5 ff 4c 89 e6 48 c7 c7 de 1b 80 84 e8 c5 ad 97 ff <0f> 0b eb b1 e8 5c 09 b5 ff 48 c7 c7 88 58 64 86 e8 e0 0d 71 02 eb RSP: 0018:ffffc9000c6d7ce0 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff8880422b8b00 RCX: ffffffff8110503c RDX: ffff888030652f00 RSI: ffffffff81105045 RDI: 0000000000000001 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: ffffffff81bb62cb R12: ffffffff84807ffc R13: ffff88804ad6fcc0 R14: ffffffff84807ffc R15: ffffffff85741ff8 FS: 00007f30cfba8640(0000) GS:ffff88807dd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ff51afe8000 CR3: 000000005a60a005 CR4: 0000000000770ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> rpc_proc_unregister+0x64/0x70 net/sunrpc/stats.c:310 nfs_net_exit+0x1c/0x30 fs/nfs/inode.c:2438 ops_exit_list+0x62/0xb0 net/core/net_namespace.c:170 setup_net+0x46c/0x660 net/core/net_namespace.c:372 copy_net_ns+0x244/0x590 net/core/net_namespace.c:505 create_new_namespaces+0x2ed/0x770 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0xae/0x160 kernel/nsproxy.c:228 ksys_unshare+0x342/0x760 kernel/fork.c:3322 __do_sys_unshare kernel/fork.c:3393 [inline] __se_sys_unshare kernel/fork.c:3391 [inline] __x64_sys_unshare+0x1f/0x30 kernel/fork.c:3391 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x4f/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x46/0x4e RIP: 0033:0x7f30d0febe5d Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 9f 1b 00 f7 d8 64 89 01 48 RSP: 002b:00007f30cfba7cc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 RAX: ffffffffffffffda RBX: 00000000004bbf80 RCX: 00007f30d0febe5d RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000006c020600 RBP: 00000000004bbf80 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 R13: 000000000000000b R14: 00007f30d104c530 R15: 0000000000000000 </TASK>
--- fs/nfs/inode.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
fs/nfs/inode.c +6 -1
@@ -2429,7 +2429,12 @@ static int nfs_net_init(struct net *net)struct nfs_net *nn =net_generic (net, nfs_net_id);nfs_clients_init (net); -rpc_proc_register (net, &nn->rpcstats); + +if (!rpc_proc_register (net, &nn->rpcstats)) { +nfs_clients_exit (net); +return -ENOMEM ; + } +return nfs_fs_proc_net_init (net); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 13/336 pinctrl: baytrail: Fix selecting gpio pinctrl state
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit fed6d9a8e6a60ecf6506d0ea004040fbaa109927 ]
For all the "score" pin-groups all the intel_pingroup-s to select the non GPIO function are re-used for byt_score_gpio_groups[].
But this is incorrect since a pin-group includes the mode setting, which for the non GPIO functions generally is 1, where as to select the GPIO function mode must be set to 0.
So the GPIO function needs separate intel_pingroup-s with their own mode value of 0.
Add a new PIN_GROUP_GPIO macro which adds a foo_gpio entry to each pin-group defined this way and update byt_score_gpio_groups[] to point to the new foo_gpio entries.
The "sus" usb_oc_grp usb_ulpi_grp and pcu_spi_grp pin-groups are special because these have a non 0 mode value to select the GPIO functions and these already have matching foo_gpio pin-groups, leave these are unchanged.
The pmu_clk "sus" groups added in commit 2f46d7f7e959 ("pinctrl: baytrail:
Add pinconf group + function for the pmu_clk") do need to use the new PIN_GROUP_GPIO macro.
--- drivers/pinctrl/intel/pinctrl-baytrail.c | 74 ++++++++++++------------ drivers/pinctrl/intel/pinctrl-intel.h | 4 ++ 2 files changed, 42 insertions(+), 36 deletions(-)
drivers/pinctrl/intel/pinctrl-baytrail.c +38 -36
@@ -278,33 +278,33 @@ static const unsigned int byt_score_plt_clk5_pins[] = { 101 };static const unsigned int byt_score_smbus_pins[] = {51 ,52 ,53 };static const struct intel_pingroup byt_score_groups[] = { -PIN_GROUP ("uart1_grp" , byt_score_uart1_pins,1 ), -PIN_GROUP ("uart2_grp" , byt_score_uart2_pins,1 ), -PIN_GROUP ("pwm0_grp" , byt_score_pwm0_pins,1 ), -PIN_GROUP ("pwm1_grp" , byt_score_pwm1_pins,1 ), -PIN_GROUP ("ssp2_grp" , byt_score_ssp2_pins,1 ), -PIN_GROUP ("sio_spi_grp" , byt_score_sio_spi_pins,1 ), -PIN_GROUP ("i2c5_grp" , byt_score_i2c5_pins,1 ), -PIN_GROUP ("i2c6_grp" , byt_score_i2c6_pins,1 ), -PIN_GROUP ("i2c4_grp" , byt_score_i2c4_pins,1 ), -PIN_GROUP ("i2c3_grp" , byt_score_i2c3_pins,1 ), -PIN_GROUP ("i2c2_grp" , byt_score_i2c2_pins,1 ), -PIN_GROUP ("i2c1_grp" , byt_score_i2c1_pins,1 ), -PIN_GROUP ("i2c0_grp" , byt_score_i2c0_pins,1 ), -PIN_GROUP ("ssp0_grp" , byt_score_ssp0_pins,1 ), -PIN_GROUP ("ssp1_grp" , byt_score_ssp1_pins,1 ), -PIN_GROUP ("sdcard_grp" , byt_score_sdcard_pins, byt_score_sdcard_mux_values), -PIN_GROUP ("sdio_grp" , byt_score_sdio_pins,1 ), -PIN_GROUP ("emmc_grp" , byt_score_emmc_pins,1 ), -PIN_GROUP ("lpc_grp" , byt_score_ilb_lpc_pins,1 ), -PIN_GROUP ("sata_grp" , byt_score_sata_pins,1 ), -PIN_GROUP ("plt_clk0_grp" , byt_score_plt_clk0_pins,1 ), -PIN_GROUP ("plt_clk1_grp" , byt_score_plt_clk1_pins,1 ), -PIN_GROUP ("plt_clk2_grp" , byt_score_plt_clk2_pins,1 ), -PIN_GROUP ("plt_clk3_grp" , byt_score_plt_clk3_pins,1 ), -PIN_GROUP ("plt_clk4_grp" , byt_score_plt_clk4_pins,1 ), -PIN_GROUP ("plt_clk5_grp" , byt_score_plt_clk5_pins,1 ), -PIN_GROUP ("smbus_grp" , byt_score_smbus_pins,1 ), +PIN_GROUP_GPIO ("uart1_grp" , byt_score_uart1_pins,1 ), +PIN_GROUP_GPIO ("uart2_grp" , byt_score_uart2_pins,1 ), +PIN_GROUP_GPIO ("pwm0_grp" , byt_score_pwm0_pins,1 ), +PIN_GROUP_GPIO ("pwm1_grp" , byt_score_pwm1_pins,1 ), +PIN_GROUP_GPIO ("ssp2_grp" , byt_score_ssp2_pins,1 ), +PIN_GROUP_GPIO ("sio_spi_grp" , byt_score_sio_spi_pins,1 ), +PIN_GROUP_GPIO ("i2c5_grp" , byt_score_i2c5_pins,1 ), +PIN_GROUP_GPIO ("i2c6_grp" , byt_score_i2c6_pins,1 ), +PIN_GROUP_GPIO ("i2c4_grp" , byt_score_i2c4_pins,1 ), +PIN_GROUP_GPIO ("i2c3_grp" , byt_score_i2c3_pins,1 ), +PIN_GROUP_GPIO ("i2c2_grp" , byt_score_i2c2_pins,1 ), +PIN_GROUP_GPIO ("i2c1_grp" , byt_score_i2c1_pins,1 ), +PIN_GROUP_GPIO ("i2c0_grp" , byt_score_i2c0_pins,1 ), +PIN_GROUP_GPIO ("ssp0_grp" , byt_score_ssp0_pins,1 ), +PIN_GROUP_GPIO ("ssp1_grp" , byt_score_ssp1_pins,1 ), +PIN_GROUP_GPIO ("sdcard_grp" , byt_score_sdcard_pins, byt_score_sdcard_mux_values), +PIN_GROUP_GPIO ("sdio_grp" , byt_score_sdio_pins,1 ), +PIN_GROUP_GPIO ("emmc_grp" , byt_score_emmc_pins,1 ), +PIN_GROUP_GPIO ("lpc_grp" , byt_score_ilb_lpc_pins,1 ), +PIN_GROUP_GPIO ("sata_grp" , byt_score_sata_pins,1 ), +PIN_GROUP_GPIO ("plt_clk0_grp" , byt_score_plt_clk0_pins,1 ), +PIN_GROUP_GPIO ("plt_clk1_grp" , byt_score_plt_clk1_pins,1 ), +PIN_GROUP_GPIO ("plt_clk2_grp" , byt_score_plt_clk2_pins,1 ), +PIN_GROUP_GPIO ("plt_clk3_grp" , byt_score_plt_clk3_pins,1 ), +PIN_GROUP_GPIO ("plt_clk4_grp" , byt_score_plt_clk4_pins,1 ), +PIN_GROUP_GPIO ("plt_clk5_grp" , byt_score_plt_clk5_pins,1 ), +PIN_GROUP_GPIO ("smbus_grp" , byt_score_smbus_pins,1 ), };static const char *const byt_score_uart_groups[] = {
@@ -332,12 +332,14 @@ static const char * const byt_score_plt_clk_groups[] = { };static const char *const byt_score_smbus_groups[] = {"smbus_grp" };static const char *const byt_score_gpio_groups[] = { -"uart1_grp" ,"uart2_grp" ,"pwm0_grp" ,"pwm1_grp" ,"ssp0_grp" , -"ssp1_grp" ,"ssp2_grp" ,"sio_spi_grp" ,"i2c0_grp" ,"i2c1_grp" , -"i2c2_grp" ,"i2c3_grp" ,"i2c4_grp" ,"i2c5_grp" ,"i2c6_grp" , -"sdcard_grp" ,"sdio_grp" ,"emmc_grp" ,"lpc_grp" ,"sata_grp" , -"plt_clk0_grp" ,"plt_clk1_grp" ,"plt_clk2_grp" ,"plt_clk3_grp" , -"plt_clk4_grp" ,"plt_clk5_grp" ,"smbus_grp" , +"uart1_grp_gpio" ,"uart2_grp_gpio" ,"pwm0_grp_gpio" , +"pwm1_grp_gpio" ,"ssp0_grp_gpio" ,"ssp1_grp_gpio" ,"ssp2_grp_gpio" , +"sio_spi_grp_gpio" ,"i2c0_grp_gpio" ,"i2c1_grp_gpio" ,"i2c2_grp_gpio" , +"i2c3_grp_gpio" ,"i2c4_grp_gpio" ,"i2c5_grp_gpio" ,"i2c6_grp_gpio" , +"sdcard_grp_gpio" ,"sdio_grp_gpio" ,"emmc_grp_gpio" ,"lpc_grp_gpio" , +"sata_grp_gpio" ,"plt_clk0_grp_gpio" ,"plt_clk1_grp_gpio" , +"plt_clk2_grp_gpio" ,"plt_clk3_grp_gpio" ,"plt_clk4_grp_gpio" , +"plt_clk5_grp_gpio" ,"smbus_grp_gpio" , };static const struct intel_function byt_score_functions[] = {
@@ -456,8 +458,8 @@ static const struct intel_pingroup byt_sus_groups[] = {PIN_GROUP ("usb_oc_grp_gpio" , byt_sus_usb_over_current_pins, byt_sus_usb_over_current_gpio_mode_values),PIN_GROUP ("usb_ulpi_grp_gpio" , byt_sus_usb_ulpi_pins, byt_sus_usb_ulpi_gpio_mode_values),PIN_GROUP ("pcu_spi_grp_gpio" , byt_sus_pcu_spi_pins, byt_sus_pcu_spi_gpio_mode_values), -PIN_GROUP ("pmu_clk1_grp" , byt_sus_pmu_clk1_pins,1 ), - PIN_GROUP("pmu_clk2_grp", byt_sus_pmu_clk2_pins, 1), +PIN_GROUP_GPIO ("pmu_clk1_grp" , byt_sus_pmu_clk1_pins,1 ), + PIN_GROUP_GPIO("pmu_clk2_grp", byt_sus_pmu_clk2_pins, 1), }; static const char * const byt_sus_usb_groups[] = {
@@ -469,7 +471,7 @@ static const char * const byt_sus_pmu_clk_groups[] = { };static const char *const byt_sus_gpio_groups[] = {"usb_oc_grp_gpio" ,"usb_ulpi_grp_gpio" ,"pcu_spi_grp_gpio" , -"pmu_clk1_grp" ,"pmu_clk2_grp" , +"pmu_clk1_grp_gpio" ,"pmu_clk2_grp_gpio" , };static const struct intel_function byt_sus_functions[] = {
drivers/pinctrl/intel/pinctrl-intel.h +4 -0
@@ -179,6 +179,10 @@ struct intel_community { .modes = __builtin_choose_expr(__builtin_constant_p((m)), NULL, (m)), \ } +#define PIN_GROUP_GPIO (n, p, m) \ + PIN_GROUP(n, p, m), \ + PIN_GROUP(n "_gpio", p, 0) +#define FUNCTION (n, g) \ { \ .func = PINCTRL_PINFUNCTION((n), (g), ARRAY_SIZE(g)), \
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 14/336 power: rt9455: hide unused rt9455_boost_voltage_values
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 452d8950db3e839aba1bb13bc5378f4bac11fa04 ]
The rt9455_boost_voltage_values[] array is only used when USB PHY support is enabled, causing a W=1 warning otherwise:
drivers/power/supply/rt9455_charger.c:200:18: error: 'rt9455_boost_voltage_values' defined but not used [-Werror=unused-const-variable=]
Enclose the definition in the same #ifdef as the references to it.
--- drivers/power/supply/rt9455_charger.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/power/supply/rt9455_charger.c +2 -0
@@ -192,6 +192,7 @@ static const int rt9455_voreg_values[] = { 4450000, 4450000, 4450000, 4450000, 4450000, 4450000, 4450000, 4450000 }; +#if IS_ENABLED (CONFIG_USB_PHY )/* * When the charger is in boost mode, REG02[7:2] represent boost output * voltage.
@@ -207,6 +208,7 @@ static const int rt9455_boost_voltage_values[] = {5600000 ,5600000 ,5600000 ,5600000 ,5600000 ,5600000 ,5600000 ,5600000 , 5600000, 5600000, 5600000, 5600000, 5600000, 5600000, 5600000, 5600000, }; +#endif /* REG07[3:0] (VMREG) in uV */ static const int rt9455_vmreg_values[] = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 15/336 power: supply: mt6360_charger: Fix of_match for usb-otg-vbus regulator
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <[email protected]>
[ Upstream commit 1e0fb113646182e073539db96016b00cfeb18ecc ]
The of_match shall correspond to the name of the regulator subnode, or the deprecated regulator-compatible property must be used:
failing to do so, the regulator won't probe (and the driver will as well not probe).
Since the devicetree binding for this driver is actually correct and wants DTs to use the "usb-otg-vbus-regulator" subnode name, fix this driver by aligning the of_match string to what the DT binding wants.
--- drivers/power/supply/mt6360_charger.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/power/supply/mt6360_charger.c +1 -1
@@ -588,7 +588,7 @@ static const struct regulator_ops mt6360_chg_otg_ops = { };static const struct regulator_desc mt6360_otg_rdesc = { - .of_match ="usb-otg-vbus" , + .of_match ="usb-otg-vbus-regulator" , .name ="usb-otg-vbus" , .ops = &mt6360_chg_otg_ops, .owner =THIS_MODULE ,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 16/336 pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zeng Heng <[email protected]>
[ Upstream commit a0cedbcc8852d6c77b00634b81e41f17f29d9404 ]
If we fail to allocate propname buffer, we need to drop the reference count we just took. Because the pinctrl_dt_free_maps() includes the droping operation, here we call it directly.
Message-ID: <[email protected]>
--- drivers/pinctrl/devicetree.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/pinctrl/devicetree.c +6 -4
@@ -220,14 +220,16 @@ int pinctrl_dt_to_map(struct pinctrl *p, struct pinctrl_dev *pctldev)for (state =0 ; ; state++) {/* Retrieve the pinctrl-* property */ propname =kasprintf (GFP_KERNEL ,"pinctrl-%d" , state); -if (!propname) -return -ENOMEM ; +if (!propname) { + ret = -ENOMEM ; + goto err; + } prop =of_find_property (np, propname, &size);kfree (propname);if (!prop) {if (state ==0 ) { -of_node_put (np); -return -ENODEV ; + ret = -ENODEV ; + goto err; }break ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 17/336 nfsd: rename NFSD_NET_* to NFSD_STATS_*
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <[email protected]>
[ Upstream commit d98416cc2154053950610bb6880911e3dcbdf8c5 ]
We're going to merge the stats all into per network namespace in subsequent patches, rename these nn counters to be consistent with the rest of the stats.
Stable-dep-of: 18180a4550d0 ("NFSD: Fix nfsd4_encode_fattr4() crasher")
--- fs/nfsd/netns.h | 4 ++-- fs/nfsd/nfscache.c | 4 ++-- fs/nfsd/stats.h | 6 +++--- 3 files changed, 7 insertions(+), 7 deletions(-)
fs/nfsd/netns.h +2 -2
@@ -26,9 +26,9 @@ struct nfsd4_client_tracking_ops;enum {/* cache misses due only to checksum comparison failures */ -NFSD_NET_PAYLOAD_MISSES , +NFSD_STATS_PAYLOAD_MISSES ,/* amount of memory (in bytes) currently consumed by the DRC */ -NFSD_NET_DRC_MEM_USAGE , +NFSD_STATS_DRC_MEM_USAGE ,NFSD_NET_COUNTERS_NUM };
fs/nfsd/nfscache.c +2 -2
@@ -687,7 +687,7 @@ int nfsd_reply_cache_stats_show(struct seq_file *m, void *v) atomic_read(&nn->num_drc_entries));seq_printf (m,"hash buckets: %u\n" ,1 << nn->maskbits);seq_printf (m,"mem usage: %lld\n" , -percpu_counter_sum_positive (&nn->counter[NFSD_NET_DRC_MEM_USAGE ])); +percpu_counter_sum_positive (&nn->counter[NFSD_STATS_DRC_MEM_USAGE ]));seq_printf (m,"cache hits: %lld\n" ,percpu_counter_sum_positive (&nfsdstats.counter[NFSD_STATS_RC_HITS ])); seq_printf(m, "cache misses: %lld\n",
@@ -695,7 +695,7 @@ int nfsd_reply_cache_stats_show(struct seq_file *m, void *v)seq_printf (m,"not cached: %lld\n" ,percpu_counter_sum_positive (&nfsdstats.counter[NFSD_STATS_RC_NOCACHE ]));seq_printf (m,"payload misses: %lld\n" , -percpu_counter_sum_positive (&nn->counter[NFSD_NET_PAYLOAD_MISSES ])); +percpu_counter_sum_positive (&nn->counter[NFSD_STATS_PAYLOAD_MISSES ]));seq_printf (m,"longest chain len: %u\n" , nn->longest_chain);seq_printf (m,"cachesize at longest: %u\n" , nn->longest_chain_cachesize);return 0 ;
fs/nfsd/stats.h +3 -3
@@ -81,17 +81,17 @@ static inline void nfsd_stats_io_write_add(struct svc_export *exp, s64 amount)static inline void nfsd_stats_payload_misses_inc (struct nfsd_net *nn) { -percpu_counter_inc (&nn->counter[NFSD_NET_PAYLOAD_MISSES ]); +percpu_counter_inc (&nn->counter[NFSD_STATS_PAYLOAD_MISSES ]); }static inline void nfsd_stats_drc_mem_usage_add (struct nfsd_net *nn,s64 amount) { -percpu_counter_add (&nn->counter[NFSD_NET_DRC_MEM_USAGE ], amount); +percpu_counter_add (&nn->counter[NFSD_STATS_DRC_MEM_USAGE ], amount); }static inline void nfsd_stats_drc_mem_usage_sub (struct nfsd_net *nn,s64 amount) { -percpu_counter_sub (&nn->counter[NFSD_NET_DRC_MEM_USAGE ], amount); +percpu_counter_sub (&nn->counter[NFSD_STATS_DRC_MEM_USAGE ], amount); }#ifdef CONFIG_NFSD_V4
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 18/336 nfsd: expose /proc/net/sunrpc/nfsd in net namespaces
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <[email protected]>
[ Upstream commit 93483ac5fec62cc1de166051b219d953bb5e4ef4 ]
We are running nfsd servers inside of containers with their own network namespace, and we want to monitor these services using the stats found in /proc. However these are not exposed in the proc inside of the container, so we have to bind mount the host /proc into our containers to get at this information.
Separate out the stat counters init and the proc registration, and move the proc registration into the pernet operations entry and exit points so that these stats can be exposed inside of network namespaces.
This is an intermediate step, this just exposes the global counters in the network namespace. Subsequent patches will move these counters into the per-network namespace container.
Stable-dep-of: 18180a4550d0 ("NFSD: Fix nfsd4_encode_fattr4() crasher")
--- fs/nfsd/nfsctl.c | 8 +++++--- fs/nfsd/stats.c | 21 ++++++--------------- fs/nfsd/stats.h | 6 ++++-- 3 files changed, 15 insertions(+), 20 deletions(-)
fs/nfsd/nfsctl.c +5 -3
@@ -1679,6 +1679,7 @@ static __net_init int nfsd_net_init(struct net *net)nfsd4_init_leases_net (nn);get_random_bytes (&nn->siphash_key,sizeof (nn->siphash_key));seqlock_init (&nn->writeverf_lock); +nfsd_proc_stat_init (net);return 0 ;
@@ -1699,6 +1700,7 @@ static __net_exit void nfsd_net_exit(struct net *net) {struct nfsd_net *nn =net_generic (net, nfsd_net_id); +nfsd_proc_stat_shutdown (net);nfsd_net_reply_cache_destroy (nn);nfsd_idmap_shutdown (net);nfsd_export_shutdown (net);
@@ -1722,7 +1724,7 @@ static int __init init_nfsd(void) retval =nfsd4_init_pnfs ();if (retval) goto out_free_slabs; - retval =nfsd_stat_init ();/* Statistics */ + retval =nfsd_stat_counters_init ();/* Statistics */ if (retval) goto out_free_pnfs; retval =nfsd_drc_slab_create ();
@@ -1762,7 +1764,7 @@ static int __init init_nfsd(void)nfsd_lockd_shutdown ();nfsd_drc_slab_free (); out_free_stat: -nfsd_stat_shutdown (); +nfsd_stat_counters_destroy (); out_free_pnfs:nfsd4_exit_pnfs (); out_free_slabs:
@@ -1780,7 +1782,7 @@ static void __exit exit_nfsd(void)nfsd_drc_slab_free ();remove_proc_entry ("fs/nfs/exports" ,NULL );remove_proc_entry ("fs/nfs" ,NULL ); -nfsd_stat_shutdown (); +nfsd_stat_counters_destroy ();nfsd_lockd_shutdown ();nfsd4_free_slabs ();nfsd4_exit_pnfs ();
fs/nfsd/stats.c +6 -15
@@ -108,31 +108,22 @@ void nfsd_percpu_counters_destroy(struct percpu_counter counters[], int num)percpu_counter_destroy (&counters[i]); } -static int nfsd_stat_counters_init (void ) +int nfsd_stat_counters_init (void ) {return nfsd_percpu_counters_init (nfsdstats.counter,NFSD_STATS_COUNTERS_NUM ); } -static void nfsd_stat_counters_destroy (void ) +void nfsd_stat_counters_destroy (void ) {nfsd_percpu_counters_destroy (nfsdstats.counter,NFSD_STATS_COUNTERS_NUM ); } -int nfsd_stat_init (void ) +void nfsd_proc_stat_init (struct net *net) { -int err; - - err =nfsd_stat_counters_init (); -if (err) -return err; - -svc_proc_register (&init_net, &nfsd_svcstats, &nfsd_proc_ops); - -return 0 ; +svc_proc_register (net, &nfsd_svcstats, &nfsd_proc_ops); } -void nfsd_stat_shutdown (void ) +void nfsd_proc_stat_shutdown (struct net *net) { -nfsd_stat_counters_destroy (); -svc_proc_unregister (&init_net,"nfsd" ); +svc_proc_unregister (net,"nfsd" ); }
fs/nfsd/stats.h +4 -2
@@ -40,8 +40,10 @@ extern struct svc_stat nfsd_svcstats;int nfsd_percpu_counters_init (struct percpu_counter *counters,int num);void nfsd_percpu_counters_reset (struct percpu_counter *counters,int num);void nfsd_percpu_counters_destroy (struct percpu_counter *counters,int num); -int nfsd_stat_init (void ); -void nfsd_stat_shutdown (void ); +int nfsd_stat_counters_init (void ); +void nfsd_stat_counters_destroy (void ); +void nfsd_proc_stat_init (struct net *net); +void nfsd_proc_stat_shutdown (struct net *net);static inline void nfsd_stats_rc_hits_inc (void ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 19/336 nfsd: make all of the nfsd stats per-network namespace
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <[email protected]>
[ Upstream commit 4b14885411f74b2b0ce0eb2b39d0fffe54e5ca0d ]
We have a global set of counters that we modify for all of the nfsd operations, but now that we're exposing these stats across all network namespaces we need to make the stats also be per-network namespace. We already have some caching stats that are per-network namespace, so move these definitions into the same counter and then adjust all the helpers and users of these stats to provide the appropriate nfsd_net struct so that the stats are maintained for the per-network namespace objects.
Stable-dep-of: 18180a4550d0 ("NFSD: Fix nfsd4_encode_fattr4() crasher")
--- fs/nfsd/cache.h | 2 -- fs/nfsd/netns.h | 17 ++++++++++++-- fs/nfsd/nfs4proc.c | 6 ++--- fs/nfsd/nfs4state.c | 3 ++- fs/nfsd/nfscache.c | 36 ++++++------------------------ fs/nfsd/nfsctl.c | 12 +++------- fs/nfsd/nfsfh.c | 3 ++- fs/nfsd/stats.c | 26 ++++++++++++---------- fs/nfsd/stats.h | 54 ++++++++++++++++----------------------------- fs/nfsd/vfs.c | 6 +++-- 10 files changed, 69 insertions(+), 96 deletions(-)
fs/nfsd/cache.h +0 -2
@@ -80,8 +80,6 @@ enum {int nfsd_drc_slab_create (void );void nfsd_drc_slab_free (void ); -int nfsd_net_reply_cache_init (struct nfsd_net *nn); -void nfsd_net_reply_cache_destroy (struct nfsd_net *nn);int nfsd_reply_cache_init (struct nfsd_net *);void nfsd_reply_cache_shutdown (struct nfsd_net *); int nfsd_cache_lookup(struct svc_rqst *rqstp, unsigned int start,
fs/nfsd/netns.h +15 -2
@@ -11,6 +11,7 @@#include <net/net_namespace.h> #include <net/netns/generic.h> #include <linux/filelock.h> +#include <linux/nfs4.h> #include <linux/percpu_counter.h> #include <linux/siphash.h>
@@ -29,7 +30,19 @@ enum {NFSD_STATS_PAYLOAD_MISSES ,/* amount of memory (in bytes) currently consumed by the DRC */ NFSD_STATS_DRC_MEM_USAGE , - NFSD_NET_COUNTERS_NUM +NFSD_STATS_RC_HITS ,/* repcache hits */ +NFSD_STATS_RC_MISSES ,/* repcache misses */ +NFSD_STATS_RC_NOCACHE ,/* uncached reqs */ +NFSD_STATS_FH_STALE ,/* FH stale error */ +NFSD_STATS_IO_READ ,/* bytes returned to read requests */ +NFSD_STATS_IO_WRITE ,/* bytes passed in write requests */ +#ifdef CONFIG_NFSD_V4 +NFSD_STATS_FIRST_NFS4_OP ,/* count of individual nfsv4 operations */ +NFSD_STATS_LAST_NFS4_OP =NFSD_STATS_FIRST_NFS4_OP +LAST_NFS4_OP , +#define NFSD_STATS_NFS4_OP(op) (NFSD_STATS_FIRST_NFS4_OP + (op)) +NFSD_STATS_WDELEG_GETATTR ,/* count of getattr conflict with wdeleg */ +#endif +NFSD_STATS_COUNTERS_NUM };/*
@@ -164,7 +177,7 @@ struct nfsd_net {atomic_t num_drc_entries;/* Per-netns stats counters */ -struct percpu_counter counter[NFSD_NET_COUNTERS_NUM ]; +struct percpu_counter counter[NFSD_STATS_COUNTERS_NUM ];/* longest hash chain seen */ unsigned int longest_chain;
fs/nfsd/nfs4proc.c +3 -3
@@ -2490,10 +2490,10 @@ nfsd4_proc_null(struct svc_rqst *rqstp)return rpc_success; } -static inline void nfsd4_increment_op_stats (u32 opnum) +static inline void nfsd4_increment_op_stats (struct nfsd_net *nn,u32 opnum) {if (opnum >=FIRST_NFS4_OP && opnum <=LAST_NFS4_OP ) -percpu_counter_inc (&nfsdstats.counter[NFSD_STATS_NFS4_OP (opnum)]); +percpu_counter_inc (&nn->counter[NFSD_STATS_NFS4_OP (opnum)]); }static const struct nfsd4_operation nfsd4_ops[];
@@ -2768,7 +2768,7 @@ nfsd4_proc_compound(struct svc_rqst *rqstp) status, nfsd4_op_name(op->opnum));nfsd4_cstate_clear_replay (cstate); -nfsd4_increment_op_stats (op->opnum); +nfsd4_increment_op_stats (nn, op->opnum); }fh_put (current_fh);
fs/nfsd/nfs4state.c +2 -1
@@ -8447,6 +8447,7 @@ __be32 nfsd4_deleg_getattr_conflict(struct svc_rqst *rqstp, struct inode *inode) { __be32 status; +struct nfsd_net *nn =net_generic (SVC_NET (rqstp), nfsd_net_id);struct file_lock_context *ctx;struct file_lock *fl;struct nfs4_delegation *dp;
@@ -8476,7 +8477,7 @@ nfsd4_deleg_getattr_conflict(struct svc_rqst *rqstp, struct inode *inode) } break_lease:spin_unlock (&ctx->flc_lock); -nfsd_stats_wdeleg_getattr_inc (); +nfsd_stats_wdeleg_getattr_inc (nn); status =nfserrno (nfsd_open_break_lease (inode,NFSD_MAY_READ ));if (status != nfserr_jukebox || !nfsd_wait_for_delegreturn (rqstp, inode))
fs/nfsd/nfscache.c +7 -29
@@ -176,27 +176,6 @@ void nfsd_drc_slab_free(void)kmem_cache_destroy (drc_slab); } -/** -* nfsd_net_reply_cache_init - per net namespace reply cache set-up -* @nn: nfsd_net being initialized -* -* Returns zero on succes; otherwise a negative errno is returned. -*/ -int nfsd_net_reply_cache_init (struct nfsd_net *nn) -{ -return nfsd_percpu_counters_init (nn->counter,NFSD_NET_COUNTERS_NUM ); -} - -/** -* nfsd_net_reply_cache_destroy - per net namespace reply cache tear-down -* @nn: nfsd_net being freed -* -*/ -void nfsd_net_reply_cache_destroy (struct nfsd_net *nn) -{ -nfsd_percpu_counters_destroy (nn->counter,NFSD_NET_COUNTERS_NUM ); -} -int nfsd_reply_cache_init (struct nfsd_net *nn) {unsigned int hashsize;
@@ -501,7 +480,7 @@ nfsd_cache_insert(struct nfsd_drc_bucket *b, struct nfsd_cacherep *key,int nfsd_cache_lookup (struct svc_rqst *rqstp,unsigned int start,unsigned int len,struct nfsd_cacherep **cacherep) { -struct nfsd_net *nn; +struct nfsd_net *nn =net_generic (SVC_NET (rqstp), nfsd_net_id);struct nfsd_cacherep *rp, *found;__wsum csum;struct nfsd_drc_bucket *b;
@@ -510,7 +489,7 @@ int nfsd_cache_lookup(struct svc_rqst *rqstp, unsigned int start,int rtn =RC_DOIT ;if (type ==RC_NOCACHE ) { -nfsd_stats_rc_nocache_inc (); +nfsd_stats_rc_nocache_inc (nn); goto out; }
@@ -520,7 +499,6 @@ int nfsd_cache_lookup(struct svc_rqst *rqstp, unsigned int start,* Since the common case is a cache miss followed by an insert, * preallocate an entry. */ - nn =net_generic (SVC_NET (rqstp), nfsd_net_id); rp =nfsd_cacherep_alloc (rqstp, csum, nn);if (!rp) goto out;
@@ -537,7 +515,7 @@ int nfsd_cache_lookup(struct svc_rqst *rqstp, unsigned int start,nfsd_cacherep_dispose (&dispose); -nfsd_stats_rc_misses_inc (); +nfsd_stats_rc_misses_inc (nn);atomic_inc (&nn->num_drc_entries);nfsd_stats_drc_mem_usage_add (nn,sizeof (*rp)); goto out;
@@ -545,7 +523,7 @@ int nfsd_cache_lookup(struct svc_rqst *rqstp, unsigned int start, found_entry:/* We found a matching entry which is either in progress or done. */ nfsd_reply_cache_free_locked (NULL , rp, nn); -nfsd_stats_rc_hits_inc (); +nfsd_stats_rc_hits_inc (nn); rtn =RC_DROPIT ; rp = found;
@@ -689,11 +667,11 @@ int nfsd_reply_cache_stats_show(struct seq_file *m, void *v)seq_printf (m,"mem usage: %lld\n" ,percpu_counter_sum_positive (&nn->counter[NFSD_STATS_DRC_MEM_USAGE ]));seq_printf (m,"cache hits: %lld\n" , -percpu_counter_sum_positive (&nfsdstats.counter[NFSD_STATS_RC_HITS ])); +percpu_counter_sum_positive (&nn->counter[NFSD_STATS_RC_HITS ]));seq_printf (m,"cache misses: %lld\n" , -percpu_counter_sum_positive (&nfsdstats.counter[NFSD_STATS_RC_MISSES ])); +percpu_counter_sum_positive (&nn->counter[NFSD_STATS_RC_MISSES ]));seq_printf (m,"not cached: %lld\n" , -percpu_counter_sum_positive (&nfsdstats.counter[NFSD_STATS_RC_NOCACHE ])); +percpu_counter_sum_positive (&nn->counter[NFSD_STATS_RC_NOCACHE ]));seq_printf (m,"payload misses: %lld\n" ,percpu_counter_sum_positive (&nn->counter[NFSD_STATS_PAYLOAD_MISSES ]));seq_printf (m,"longest chain len: %u\n" , nn->longest_chain);
fs/nfsd/nfsctl.c +3 -9
@@ -1671,7 +1671,7 @@ static __net_init int nfsd_net_init(struct net *net) retval =nfsd_idmap_init (net);if (retval) goto out_idmap_error; - retval =nfsd_net_reply_cache_init (nn); + retval =nfsd_stat_counters_init (nn);if (retval) goto out_repcache_error; nn->nfsd_versions =NULL ;
@@ -1701,7 +1701,7 @@ static __net_exit void nfsd_net_exit(struct net *net)struct nfsd_net *nn =net_generic (net, nfsd_net_id);nfsd_proc_stat_shutdown (net); -nfsd_net_reply_cache_destroy (nn); +nfsd_stat_counters_destroy (nn);nfsd_idmap_shutdown (net);nfsd_export_shutdown (net);nfsd_netns_free_versions (nn);
@@ -1724,12 +1724,9 @@ static int __init init_nfsd(void) retval =nfsd4_init_pnfs ();if (retval) goto out_free_slabs; - retval =nfsd_stat_counters_init ();/* Statistics */ -if (retval) - goto out_free_pnfs; retval =nfsd_drc_slab_create ();if (retval) - goto out_free_stat; + goto out_free_pnfs;nfsd_lockd_init ();/* lockd->nfsd callbacks */ retval =create_proc_exports_entry ();if (retval)
@@ -1763,8 +1760,6 @@ static int __init init_nfsd(void) out_free_lockd:nfsd_lockd_shutdown ();nfsd_drc_slab_free (); -out_free_stat: -nfsd_stat_counters_destroy (); out_free_pnfs:nfsd4_exit_pnfs (); out_free_slabs:
@@ -1782,7 +1777,6 @@ static void __exit exit_nfsd(void)nfsd_drc_slab_free ();remove_proc_entry ("fs/nfs/exports" ,NULL );remove_proc_entry ("fs/nfs" ,NULL ); -nfsd_stat_counters_destroy ();nfsd_lockd_shutdown ();nfsd4_free_slabs ();nfsd4_exit_pnfs ();
fs/nfsd/nfsfh.c +2 -1
@@ -327,6 +327,7 @@ static __be32 nfsd_set_fh_dentry(struct svc_rqst *rqstp, struct svc_fh *fhp)__be32 fh_verify (struct svc_rqst *rqstp,struct svc_fh *fhp,umode_t type,int access) { +struct nfsd_net *nn =net_generic (SVC_NET (rqstp), nfsd_net_id);struct svc_export *exp =NULL ;struct dentry *dentry;__be32 error;
@@ -395,7 +396,7 @@ fh_verify(struct svc_rqst *rqstp, struct svc_fh *fhp, umode_t type, int access) out:trace_nfsd_fh_verify_err (rqstp, fhp, type, access, error);if (error == nfserr_stale) -nfsd_stats_fh_stale_inc (exp); +nfsd_stats_fh_stale_inc (nn, exp);return error; }
fs/nfsd/stats.c +14 -12
@@ -34,15 +34,17 @@ struct svc_stat nfsd_svcstats = {static int nfsd_show (struct seq_file *seq,void *v) { +struct net *net =pde_data (file_inode (seq->file)); +struct nfsd_net *nn =net_generic (net, nfsd_net_id);int i;seq_printf (seq,"rc %lld %lld %lld\nfh %lld 0 0 0 0\nio %lld %lld\n" , -percpu_counter_sum_positive (&nfsdstats.counter[NFSD_STATS_RC_HITS ]), -percpu_counter_sum_positive (&nfsdstats.counter[NFSD_STATS_RC_MISSES ]), -percpu_counter_sum_positive (&nfsdstats.counter[NFSD_STATS_RC_NOCACHE ]), -percpu_counter_sum_positive (&nfsdstats.counter[NFSD_STATS_FH_STALE ]), -percpu_counter_sum_positive (&nfsdstats.counter[NFSD_STATS_IO_READ ]), -percpu_counter_sum_positive (&nfsdstats.counter[NFSD_STATS_IO_WRITE ])); +percpu_counter_sum_positive (&nn->counter[NFSD_STATS_RC_HITS ]), +percpu_counter_sum_positive (&nn->counter[NFSD_STATS_RC_MISSES ]), +percpu_counter_sum_positive (&nn->counter[NFSD_STATS_RC_NOCACHE ]), +percpu_counter_sum_positive (&nn->counter[NFSD_STATS_FH_STALE ]), +percpu_counter_sum_positive (&nn->counter[NFSD_STATS_IO_READ ]), +percpu_counter_sum_positive (&nn->counter[NFSD_STATS_IO_WRITE ]));/* thread usage: */ seq_printf (seq,"th %u 0" ,atomic_read (&nfsdstats.th_cnt));
@@ -63,10 +65,10 @@ static int nfsd_show(struct seq_file *seq, void *v)seq_printf (seq,"proc4ops %u" ,LAST_NFS4_OP +1 );for (i =0 ; i <=LAST_NFS4_OP ; i++) {seq_printf (seq," %lld" , -percpu_counter_sum_positive (&nfsdstats.counter[NFSD_STATS_NFS4_OP (i)])); +percpu_counter_sum_positive (&nn->counter[NFSD_STATS_NFS4_OP (i)])); }seq_printf (seq,"\nwdeleg_getattr %lld" , -percpu_counter_sum_positive (&nfsdstats.counter[NFSD_STATS_WDELEG_GETATTR ])); +percpu_counter_sum_positive (&nn->counter[NFSD_STATS_WDELEG_GETATTR ]));seq_putc (seq,'\n' );#endif
@@ -108,14 +110,14 @@ void nfsd_percpu_counters_destroy(struct percpu_counter counters[], int num)percpu_counter_destroy (&counters[i]); } -int nfsd_stat_counters_init (void ) +int nfsd_stat_counters_init (struct nfsd_net *nn) { -return nfsd_percpu_counters_init (nfsdstats.counter,NFSD_STATS_COUNTERS_NUM ); +return nfsd_percpu_counters_init (nn->counter,NFSD_STATS_COUNTERS_NUM ); } -void nfsd_stat_counters_destroy (void ) +void nfsd_stat_counters_destroy (struct nfsd_net *nn) { -nfsd_percpu_counters_destroy (nfsdstats.counter,NFSD_STATS_COUNTERS_NUM ); +nfsd_percpu_counters_destroy (nn->counter,NFSD_STATS_COUNTERS_NUM ); }void nfsd_proc_stat_init (struct net *net)
fs/nfsd/stats.h +19 -35
97 lines not on this page · raw message
fs/nfsd/vfs.c +4 -2
@@ -1002,7 +1002,9 @@ static __be32 nfsd_finish_read(struct svc_rqst *rqstp, struct svc_fh *fhp, unsigned long *count, u32 *eof, ssize_t host_err) { if (host_err >= 0) { - nfsd_stats_io_read_add(fhp->fh_export, host_err); + struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id); + +nfsd_stats_io_read_add (nn, fhp->fh_export, host_err); *eof =nfsd_eof_on_read (file, offset, host_err, *count); *count = host_err;fsnotify_access (file);
@@ -1185,7 +1187,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct nfsd_file *nf, goto out_nfserr; } *cnt = host_err; -nfsd_stats_io_write_add (exp, *cnt); +nfsd_stats_io_write_add (nn, exp, *cnt);fsnotify_modify (file); host_err =filemap_check_wb_err (file->f_mapping, since);if (host_err <0 )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 20/336 NFSD: add support for CB_GETATTR callback
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dai Ngo <[email protected]>
[ Upstream commit 6487a13b5c6bee2ca3fc931f8ad28c8ae887a41f ]
Includes:
. CB_GETATTR proc for nfs4_cb_procedures[]
. XDR encoding and decoding function for CB_GETATTR request/reply . add nfs4_cb_fattr to nfs4_delegation for sending CB_GETATTR
and store file attributes from client's reply.
Stable-dep-of: 18180a4550d0 ("NFSD: Fix nfsd4_encode_fattr4() crasher")
--- fs/nfsd/nfs4callback.c | 97 +++++++++++++++++++++++++++++++++++++++++- fs/nfsd/state.h | 14 ++++++ fs/nfsd/xdr4cb.h | 18 ++++++++ 3 files changed, 128 insertions(+), 1 deletion(-)
fs/nfsd/nfs4callback.c +96 -1
@@ -85,7 +85,21 @@ static void encode_uint32(struct xdr_stream *xdr, u32 n)static void encode_bitmap4 (struct xdr_stream *xdr,const __u32 *bitmap,size_t len) { -WARN_ON_ONCE (xdr_stream_encode_uint32_array (xdr, bitmap, len) <0 ); +xdr_stream_encode_uint32_array (xdr, bitmap, len); +} + +static int decode_cb_fattr4 (struct xdr_stream *xdr,uint32_t *bitmap, +struct nfs4_cb_fattr *fattr) +{ + fattr->ncf_cb_change =0 ; + fattr->ncf_cb_fsize =0 ; +if (bitmap[0 ] &FATTR4_WORD0_CHANGE ) +if (xdr_stream_decode_u64 (xdr, &fattr->ncf_cb_change) <0 ) +return -NFSERR_BAD_XDR ; +if (bitmap[0 ] &FATTR4_WORD0_SIZE ) +if (xdr_stream_decode_u64 (xdr, &fattr->ncf_cb_fsize) <0 ) +return -NFSERR_BAD_XDR ; +return 0 ; }static void encode_nfs_cb_opnum4 (struct xdr_stream *xdr,enum nfs_cb_opnum4 op)
@@ -333,6 +347,30 @@ encode_cb_recallany4args(struct xdr_stream *xdr, hdr->nops++; } +/* +* CB_GETATTR4args +* struct CB_GETATTR4args { +* nfs_fh4 fh; +* bitmap4 attr_request; +* }; +* +* The size and change attributes are the only one +* guaranteed to be serviced by the client. +*/ +static void +encode_cb_getattr4args (struct xdr_stream *xdr,struct nfs4_cb_compound_hdr *hdr, +struct nfs4_cb_fattr *fattr) +{ +struct nfs4_delegation *dp = + container_of(fattr, struct nfs4_delegation, dl_cb_fattr); +struct knfsd_fh *fh = &dp->dl_stid.sc_file->fi_fhandle; + +encode_nfs_cb_opnum4 (xdr,OP_CB_GETATTR ); +encode_nfs_fh4 (xdr, fh); +encode_bitmap4 (xdr, fattr->ncf_cb_bmap,ARRAY_SIZE (fattr->ncf_cb_bmap)); + hdr->nops++; +} +/* * CB_SEQUENCE4args *
@@ -468,6 +506,26 @@ static void nfs4_xdr_enc_cb_null(struct rpc_rqst *req, struct xdr_stream *xdr,xdr_reserve_space (xdr,0 ); } +/* +* 20.1. Operation 3: CB_GETATTR - Get Attributes +*/ +static void nfs4_xdr_enc_cb_getattr (struct rpc_rqst *req, +struct xdr_stream *xdr,const void *data) +{ +const struct nfsd4_callback *cb = data; +struct nfs4_cb_fattr *ncf = + container_of(cb, struct nfs4_cb_fattr, ncf_getattr); +struct nfs4_cb_compound_hdr hdr = { + .ident = cb->cb_clp->cl_cb_ident, + .minorversion = cb->cb_clp->cl_minorversion, + }; + +encode_cb_compound4args (xdr, &hdr); +encode_cb_sequence4args (xdr, cb, &hdr); +encode_cb_getattr4args (xdr, &hdr, ncf); +encode_cb_nops (&hdr); +} +/* * 20.2. Operation 4: CB_RECALL - Recall a Delegation */
@@ -523,6 +581,42 @@ static int nfs4_xdr_dec_cb_null(struct rpc_rqst *req, struct xdr_stream *xdr,return 0 ; } +/* +* 20.1. Operation 3: CB_GETATTR - Get Attributes +*/ +static int nfs4_xdr_dec_cb_getattr (struct rpc_rqst *rqstp, +struct xdr_stream *xdr, +void *data) +{ +struct nfsd4_callback *cb = data; +struct nfs4_cb_compound_hdr hdr; +int status; +u32 bitmap[3 ] = {0 }; +u32 attrlen; +struct nfs4_cb_fattr *ncf = + container_of(cb, struct nfs4_cb_fattr, ncf_getattr); + + status =decode_cb_compound4res (xdr, &hdr); +if (unlikely (status)) +return status; + + status =decode_cb_sequence4res (xdr, cb); +if (unlikely (status || cb->cb_seq_status)) +return status; + + status =decode_cb_op_status (xdr,OP_CB_GETATTR , &cb->cb_status); +if (status) +return status; +if (xdr_stream_decode_uint32_array (xdr, bitmap,3 ) <0 ) +return -NFSERR_BAD_XDR ; +if (xdr_stream_decode_u32 (xdr, &attrlen) <0 ) +return -NFSERR_BAD_XDR ; +if (attrlen > (sizeof (ncf->ncf_cb_change) +sizeof (ncf->ncf_cb_fsize))) +return -NFSERR_BAD_XDR ; + status =decode_cb_fattr4 (xdr, bitmap, ncf); +return status; +} +/* * 20.2. Operation 4: CB_RECALL - Recall a Delegation */
@@ -831,6 +925,7 @@ static const struct rpc_procinfo nfs4_cb_procedures[] = {PROC (CB_NOTIFY_LOCK ,COMPOUND , cb_notify_lock, cb_notify_lock),PROC (CB_OFFLOAD ,COMPOUND , cb_offload, cb_offload),PROC (CB_RECALL_ANY ,COMPOUND , cb_recall_any, cb_recall_any), + PROC(CB_GETATTR, COMPOUND, cb_getattr, cb_getattr), };static unsigned int nfs4_cb_counts[ARRAY_SIZE (nfs4_cb_procedures)];
fs/nfsd/state.h +14 -0
@@ -117,6 +117,16 @@ struct nfs4_cpntf_state {time64_t cpntf_time;/* last time stateid used */ }; +struct nfs4_cb_fattr { +struct nfsd4_callback ncf_getattr; +u32 ncf_cb_status; +u32 ncf_cb_bmap[1 ]; + +/* from CB_GETATTR reply */ +u64 ncf_cb_change; +u64 ncf_cb_fsize; +}; +/* * Represents a delegation stateid. The nfs4_client holds references to these * and they are put when it is being destroyed or when the delegation is
@@ -150,6 +160,9 @@ struct nfs4_delegation {int dl_retries;struct nfsd4_callback dl_recall;bool dl_recalled; + +/* for CB_GETATTR */ +struct nfs4_cb_fattr dl_cb_fattr; };#define cb_to_delegation (cb) \
@@ -640,6 +653,7 @@ enum nfsd4_cb_op {NFSPROC4_CLNT_CB_SEQUENCE ,NFSPROC4_CLNT_CB_NOTIFY_LOCK ,NFSPROC4_CLNT_CB_RECALL_ANY , + NFSPROC4_CLNT_CB_GETATTR, };/* Returns true iff a is later than b: */
fs/nfsd/xdr4cb.h +18 -0
@@ -54,3 +54,21 @@#define NFS4_dec_cb_recall_any_sz (cb_compound_dec_hdr_sz + \ cb_sequence_dec_sz + \ op_dec_sz) + +/* +* 1: CB_GETATTR opcode (32-bit) +* N: file_handle +* 1: number of entry in attribute array (32-bit) +* 1: entry 0 in attribute array (32-bit) +*/ +#define NFS4_enc_cb_getattr_sz (cb_compound_enc_hdr_sz + \ + cb_sequence_enc_sz + \ + 1 + enc_nfs4_fh_sz + 1 + 1) +/* +* 4: fattr_bitmap_maxsz +* 1: attribute array len +* 2: change attr (64-bit) +* 2: size (64-bit) +*/ +#define NFS4_dec_cb_getattr_sz (cb_compound_dec_hdr_sz + \ + cb_sequence_dec_sz + 4 + 1 + 2 + 2 + op_dec_sz)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 21/336 NFSD: Fix nfsd4_encode_fattr4() crasher
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit 18180a4550d08be4eb0387fe83f02f703f92d4e7 ]
Ensure that args.acl is initialized early. It is used in an unconditional call to kfree() on the way out of nfsd4_encode_fattr4().
--- fs/nfsd/nfs4xdr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfsd/nfs4xdr.c +1 -1
@@ -3513,6 +3513,7 @@ nfsd4_encode_fattr4(struct svc_rqst *rqstp, struct xdr_stream *xdr, args.exp = exp; args.dentry = dentry; args.ignore_crossmnt = (ignore_crossmnt !=0 ); + args.acl =NULL ;/* * Make a local copy of the attribute bitmap that can be modified.
@@ -3567,7 +3568,6 @@ nfsd4_encode_fattr4(struct svc_rqst *rqstp, struct xdr_stream *xdr, }else args.fhp = fhp; - args.acl =NULL ;if (attrmask[0 ] &FATTR4_WORD0_ACL ) { err =nfsd4_get_nfs4_acl (rqstp, dentry, &args.acl);if (err == -EOPNOTSUPP )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 22/336 regulator: mt6360: De-capitalize devicetree regulator subnodes
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <[email protected]>
[ Upstream commit d3cf8a17498dd9104c04ad28eeac3ef3339f9f9f ]
The MT6360 regulator binding, the example in the MT6360 mfd binding, and the devicetree users of those bindings are rightfully declaring MT6360 regulator subnodes with non-capital names, and luckily without using the deprecated regulator-compatible property.
With this driver declaring capitalized BUCKx/LDOx as of_match string for the node names, obviously no regulator gets probed: fix that by changing the MT6360_REGULATOR_DESC macro to add a "match" parameter which gets assigned to the of_match.
--- drivers/regulator/mt6360-regulator.c | 32 +++++++++++++++++----------- 1 file changed, 20 insertions(+), 12 deletions(-)
drivers/regulator/mt6360-regulator.c +20 -12
@@ -319,15 +319,15 @@ static unsigned int mt6360_regulator_of_map_mode(unsigned int hw_mode) } } -#define MT6360_REGULATOR_DESC (_name, _sname, ereg, emask, vreg, vmask, \ - mreg, mmask, streg, stmask, vranges, \ - vcnts, offon_delay, irq_tbls) \ +#define MT6360_REGULATOR_DESC (match, _name, _sname, ereg, emask, vreg, \ + vmask, mreg, mmask, streg, stmask, \ + vranges, vcnts, offon_delay, irq_tbls) \ { \ .desc = { \ .name = #_name, \ .supply_name = #_sname, \ .id = MT6360_REGULATOR_##_name, \ - .of_match = of_match_ptr(#_name), \ + .of_match = of_match_ptr(match), \ .regulators_node = of_match_ptr("regulator"), \ .of_map_mode = mt6360_regulator_of_map_mode, \ .owner = THIS_MODULE, \
@@ -351,21 +351,29 @@ static unsigned int mt6360_regulator_of_map_mode(unsigned int hw_mode) }static const struct mt6360_regulator_desc mt6360_regulator_descs[] = { -MT6360_REGULATOR_DESC (BUCK1 ,BUCK1_VIN ,0x117 ,0x40 ,0x110 ,0xff ,0x117 ,0x30 ,0x117 ,0x04 , +MT6360_REGULATOR_DESC ("buck1" ,BUCK1 ,BUCK1_VIN , +0x117 ,0x40 ,0x110 ,0xff ,0x117 ,0x30 ,0x117 ,0x04 , buck_vout_ranges,256 ,0 , buck1_irq_tbls), -MT6360_REGULATOR_DESC (BUCK2 ,BUCK2_VIN ,0x127 ,0x40 ,0x120 ,0xff ,0x127 ,0x30 ,0x127 ,0x04 , +MT6360_REGULATOR_DESC ("buck2" ,BUCK2 ,BUCK2_VIN , +0x127 ,0x40 ,0x120 ,0xff ,0x127 ,0x30 ,0x127 ,0x04 , buck_vout_ranges,256 ,0 , buck2_irq_tbls), -MT6360_REGULATOR_DESC (LDO6 ,LDO_VIN3 ,0x137 ,0x40 ,0x13B ,0xff ,0x137 ,0x30 ,0x137 ,0x04 , +MT6360_REGULATOR_DESC ("ldo6" ,LDO6 ,LDO_VIN3 , +0x137 ,0x40 ,0x13B ,0xff ,0x137 ,0x30 ,0x137 ,0x04 , ldo_vout_ranges1,256 ,0 , ldo6_irq_tbls), -MT6360_REGULATOR_DESC (LDO7 ,LDO_VIN3 ,0x131 ,0x40 ,0x135 ,0xff ,0x131 ,0x30 ,0x131 ,0x04 , +MT6360_REGULATOR_DESC ("ldo7" ,LDO7 ,LDO_VIN3 , +0x131 ,0x40 ,0x135 ,0xff ,0x131 ,0x30 ,0x131 ,0x04 , ldo_vout_ranges1,256 ,0 , ldo7_irq_tbls), -MT6360_REGULATOR_DESC (LDO1 ,LDO_VIN1 ,0x217 ,0x40 ,0x21B ,0xff ,0x217 ,0x30 ,0x217 ,0x04 , +MT6360_REGULATOR_DESC ("ldo1" ,LDO1 ,LDO_VIN1 , +0x217 ,0x40 ,0x21B ,0xff ,0x217 ,0x30 ,0x217 ,0x04 , ldo_vout_ranges2,256 ,0 , ldo1_irq_tbls), -MT6360_REGULATOR_DESC (LDO2 ,LDO_VIN1 ,0x211 ,0x40 ,0x215 ,0xff ,0x211 ,0x30 ,0x211 ,0x04 , +MT6360_REGULATOR_DESC ("ldo2" ,LDO2 ,LDO_VIN1 , +0x211 ,0x40 ,0x215 ,0xff ,0x211 ,0x30 ,0x211 ,0x04 , ldo_vout_ranges2,256 ,0 , ldo2_irq_tbls), -MT6360_REGULATOR_DESC (LDO3 ,LDO_VIN1 ,0x205 ,0x40 ,0x209 ,0xff ,0x205 ,0x30 ,0x205 ,0x04 , +MT6360_REGULATOR_DESC ("ldo3" ,LDO3 ,LDO_VIN1 , +0x205 ,0x40 ,0x209 ,0xff ,0x205 ,0x30 ,0x205 ,0x04 , ldo_vout_ranges2,256 ,100 , ldo3_irq_tbls), -MT6360_REGULATOR_DESC (LDO5 ,LDO_VIN2 ,0x20B ,0x40 ,0x20F ,0x7f ,0x20B ,0x30 ,0x20B ,0x04 , +MT6360_REGULATOR_DESC ("ldo5" ,LDO5 ,LDO_VIN2 , +0x20B ,0x40 ,0x20F ,0x7f ,0x20B ,0x30 ,0x20B ,0x04 , ldo_vout_ranges3,128 ,100 , ldo5_irq_tbls), };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 23/336 regulator: change stubbed devm_regulator_get_enable to return Ok
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matti Vaittinen <[email protected]>
[ Upstream commit 96e20adc43c4f81e9163a5188cee75a6dd393e09 ]
The devm_regulator_get_enable() should be a 'call and forget' API, meaning, when it is used to enable the regulators, the API does not provide a handle to do any further control of the regulators. It gives no real benefit to return an error from the stub if CONFIG_REGULATOR is not set.
On the contrary, returning and error is causing problems to drivers when hardware is such it works out just fine with no regulator control. Returning an error forces drivers to specifically handle the case where CONFIG_REGULATOR is not set, making the mere existence of the stub questionalble. Furthermore, the stub of the regulator_enable() seems to be returning Ok.
Change the stub implementation for the devm_regulator_get_enable() to return Ok so drivers do not separately handle the case where the CONFIG_REGULATOR is not set.
--- include/linux/regulator/consumer.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/regulator/consumer.h +1 -1
@@ -320,7 +320,7 @@ devm_regulator_get_exclusive(struct device *dev, const char *id)static inline int devm_regulator_get_enable (struct device *dev,const char *id) { -return -ENODEV ; +return 0 ; } static inline int devm_regulator_get_enable_optional(struct device *dev,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 24/336 regulator: change devm_regulator_get_enable_optional() stub to return Ok
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matti Vaittinen <[email protected]>
[ Upstream commit ff33132605c1a0acea59e4c523cb7c6fabe856b2 ]
The devm_regulator_get_enable_optional() should be a 'call and forget' API, meaning, when it is used to enable the regulators, the API does not provide a handle to do any further control of the regulators. It gives no real benefit to return an error from the stub if CONFIG_REGULATOR is not set.
On the contrary, returning an error is causing problems to drivers when hardware is such it works out just fine with no regulator control. Returning an error forces drivers to specifically handle the case where CONFIG_REGULATOR is not set, making the mere existence of the stub questionalble.
Change the stub implementation for the devm_regulator_get_enable_optional() to return Ok so drivers do not separately handle the case where the CONFIG_REGULATOR is not set.
--- include/linux/regulator/consumer.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/regulator/consumer.h +1 -1
@@ -326,7 +326,7 @@ static inline int devm_regulator_get_enable(struct device *dev, const char *id)static inline int devm_regulator_get_enable_optional (struct device *dev,const char *id) { -return -ENODEV ; +return 0 ; } static inline struct regulator *__must_check
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 25/336 bpf, kconfig: Fix DEBUG_INFO_BTF_MODULES Kconfig definition
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrii Nakryiko <[email protected]>
[ Upstream commit 229087f6f1dc2d0c38feba805770f28529980ec0 ]
Turns out that due to CONFIG_DEBUG_INFO_BTF_MODULES not having an explicitly specified "menu item name" in Kconfig, it's basically impossible to turn it off (see [0]).
This patch fixes the issue by defining menu name for CONFIG_DEBUG_INFO_BTF_MODULES, which makes it actually adjustable and independent of CONFIG_DEBUG_INFO_BTF, in the sense that one can have DEBUG_INFO_BTF=y and DEBUG_INFO_BTF_MODULES=n.
We still keep it as defaulting to Y, of course.
--- lib/Kconfig.debug | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
lib/Kconfig.debug +3 -2
@@ -375,7 +375,7 @@ config DEBUG_INFO_SPLIT Incompatible with older versions of ccache. config DEBUG_INFO_BTF - bool "Generate BTF typeinfo" + bool "Generate BTF type information" depends on !DEBUG_INFO_SPLIT && !DEBUG_INFO_REDUCED depends on !GCC_PLUGIN_RANDSTRUCT || COMPILE_TEST depends on BPF_SYSCALL
@@ -408,7 +408,8 @@ config PAHOLE_HAS_LANG_EXCLUDE using DEBUG_INFO_BTF_MODULES. config DEBUG_INFO_BTF_MODULES - def_bool y + bool "Generate BTF type information for kernel modules" + default y depends on DEBUG_INFO_BTF && MODULES && PAHOLE_HAS_SPLIT_BTF help Generate compact split BTF type information for kernel modules.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 26/336 bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Xing <[email protected]>
[ Upstream commit 6648e613226e18897231ab5e42ffc29e63fa3365 ]
Fix NULL pointer data-races in sk_psock_skb_ingress_enqueue() which syzbot reported [1].
[1]
BUG: KCSAN: data-race in sk_psock_drop / sk_psock_skb_ingress_enqueue
write to 0xffff88814b3278b8 of 8 bytes by task 10724 on cpu 1:
sk_psock_stop_verdict net/core/skmsg.c:1257 [inline] sk_psock_drop+0x13e/0x1f0 net/core/skmsg.c:843 sk_psock_put include/linux/skmsg.h:459 [inline] sock_map_close+0x1a7/0x260 net/core/sock_map.c:1648 unix_release+0x4b/0x80 net/unix/af_unix.c:1048 __sock_release net/socket.c:659 [inline] sock_close+0x68/0x150 net/socket.c:1421 __fput+0x2c1/0x660 fs/file_table.c:422 __fput_sync+0x44/0x60 fs/file_table.c:507 __do_sys_close fs/open.c:1556 [inline] __se_sys_close+0x101/0x1b0 fs/open.c:1541 __x64_sys_close+0x1f/0x30 fs/open.c:1541 do_syscall_64+0xd3/0x1d0 entry_SYSCALL_64_after_hwframe+0x6d/0x75
read to 0xffff88814b3278b8 of 8 bytes by task 10713 on cpu 0:
sk_psock_data_ready include/linux/skmsg.h:464 [inline] sk_psock_skb_ingress_enqueue+0x32d/0x390 net/core/skmsg.c:555 sk_psock_skb_ingress_self+0x185/0x1e0 net/core/skmsg.c:606 sk_psock_verdict_apply net/core/skmsg.c:1008 [inline] sk_psock_verdict_recv+0x3e4/0x4a0 net/core/skmsg.c:1202 unix_read_skb net/unix/af_unix.c:2546 [inline] unix_stream_read_skb+0x9e/0xf0 net/unix/af_unix.c:2682 sk_psock_verdict_data_ready+0x77/0x220 net/core/skmsg.c:1223 unix_stream_sendmsg+0x527/0x860 net/unix/af_unix.c:2339 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x140/0x180 net/socket.c:745 ____sys_sendmsg+0x312/0x410 net/socket.c:2584 ___sys_sendmsg net/socket.c:2638 [inline] __sys_sendmsg+0x1e9/0x280 net/socket.c:2667 __do_sys_sendmsg net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline] __x64_sys_sendmsg+0x46/0x50 net/socket.c:2674 do_syscall_64+0xd3/0x1d0 entry_SYSCALL_64_after_hwframe+0x6d/0x75
value changed: 0xffffffff83d7feb0 -> 0x0000000000000000
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 10713 Comm: syz-executor.4 Tainted: G W 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
Prior to this, commit 4cd12c6065df ("bpf, sockmap: Fix NULL pointer dereference in sk_psock_verdict_data_ready()") fixed one NULL pointer similarly due to no protection of saved_data_ready. Here is another different caller causing the same issue because of the same reason. So we should protect it with sk_callback_lock read lock because the writer side in the sk_psock_drop() uses "write_lock_bh(&sk->sk_callback_lock);".
To avoid errors that could happen in future, I move those two pairs of lock into the sk_psock_data_ready(), which is suggested by John Fastabend.
--- include/linux/skmsg.h | 2 ++ net/core/skmsg.c | 5 +---- 2 files changed, 3 insertions(+), 4 deletions(-)
include/linux/skmsg.h +2 -0
@@ -461,10 +461,12 @@ static inline void sk_psock_put(struct sock *sk, struct sk_psock *psock)static inline void sk_psock_data_ready (struct sock *sk,struct sk_psock *psock) { +read_lock_bh (&sk->sk_callback_lock);if (psock->saved_data_ready) psock->saved_data_ready (sk);else sk->sk_data_ready (sk); +read_unlock_bh (&sk->sk_callback_lock); } static inline void psock_set_prog(struct bpf_prog **pprog,
net/core/skmsg.c +1 -4
@@ -1226,11 +1226,8 @@ static void sk_psock_verdict_data_ready(struct sock *sk)rcu_read_lock (); psock =sk_psock (sk); -if (psock) { -read_lock_bh (&sk->sk_callback_lock); +if (psock)sk_psock_data_ready (sk, psock); -read_unlock_bh (&sk->sk_callback_lock); - }rcu_read_unlock (); } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 27/336 regmap: Add regmap_read_bypassed()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Fitzgerald <[email protected]>
[ Upstream commit 70ee853eec5693fefd8348a2b049d9cb83362e58 ]
Add a regmap_read_bypassed() to allow reads from the hardware registers while the regmap is in cache-only mode.
A typical use for this is to keep the cache in cache-only mode until the hardware has reached a valid state, but one or more status registers must be polled to determine when this state is reached.
For example, firmware download on the cs35l56 can take several seconds if there are multiple amps sharing limited bus bandwidth. This is too long to block in probe() so it is done as a background task. The device must be soft-reset to reboot the firmware and during this time the registers are not accessible, so the cache should be in cache-only. But the driver must poll a register to detect when reboot has completed.
--- drivers/base/regmap/regmap.c | 37 ++++++++++++++++++++++++++++++++++++ include/linux/regmap.h | 8 ++++++++ 2 files changed, 45 insertions(+)
drivers/base/regmap/regmap.c +37 -0
@@ -2836,6 +2836,43 @@ int regmap_read(struct regmap *map, unsigned int reg, unsigned int *val) }EXPORT_SYMBOL_GPL (regmap_read); +/** +* regmap_read_bypassed() - Read a value from a single register direct +* from the device, bypassing the cache +* +* @map: Register map to read from +* @reg: Register to be read from +* @val: Pointer to store read value +* +* A value of zero will be returned on success, a negative errno will +* be returned in error cases. +*/ +int regmap_read_bypassed (struct regmap *map,unsigned int reg,unsigned int *val) +{ +int ret; +bool bypass, cache_only; + +if (!IS_ALIGNED (reg, map->reg_stride)) +return -EINVAL ; + + map->lock (map->lock_arg); + + bypass = map->cache_bypass; + cache_only = map->cache_only; + map->cache_bypass = true; + map->cache_only = false; + + ret =_regmap_read (map, reg, val); + + map->cache_bypass = bypass; + map->cache_only = cache_only; + + map->unlock (map->lock_arg); + +return ret; +} +EXPORT_SYMBOL_GPL (regmap_read_bypassed); +/** * regmap_raw_read() - Read raw data from the device *
include/linux/regmap.h +8 -0
@@ -1225,6 +1225,7 @@ int regmap_multi_reg_write_bypassed(struct regmap *map,int regmap_raw_write_async (struct regmap *map,unsigned int reg,const void *val,size_t val_len);int regmap_read (struct regmap *map,unsigned int reg,unsigned int *val); +int regmap_read_bypassed (struct regmap *map,unsigned int reg,unsigned int *val);int regmap_raw_read (struct regmap *map,unsigned int reg,void *val,size_t val_len); int regmap_noinc_read(struct regmap *map, unsigned int reg,
@@ -1734,6 +1735,13 @@ static inline int regmap_read(struct regmap *map, unsigned int reg,return -EINVAL ; } +static inline int regmap_read_bypassed (struct regmap *map,unsigned int reg, +unsigned int *val) +{ +WARN_ONCE (1 ,"regmap API is disabled" ); +return -EINVAL ; +} +static inline int regmap_raw_read (struct regmap *map,unsigned int reg,void *val,size_t val_len) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 28/336 ASoC: SOF: Intel: add default firmware library path for LNL
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre-Louis Bossart <[email protected]>
[ Upstream commit 305539a25a1c9929b058381aac6104bd939c0fee ]
The commit cd6f2a2e6346 ("ASoC: SOF: Intel: Set the default firmware library path for IPC4") added the default_lib_path field for all platforms, but this was missed when LunarLake was later introduced.
--- sound/soc/sof/intel/pci-lnl.c | 3 +++ 1 file changed, 3 insertions(+)
sound/soc/sof/intel/pci-lnl.c +3 -0
@@ -35,6 +35,9 @@ static const struct sof_dev_desc lnl_desc = { .default_fw_path = { [SOF_IPC_TYPE_4] = "intel/sof-ipc4/lnl", }, + .default_lib_path = { + [SOF_IPC_TYPE_4] = "intel/sof-ipc4-lib/lnl", + }, .default_tplg_path = { [SOF_IPC_TYPE_4] = "intel/sof-ipc4-tplg", },
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 29/336 nvme: fix warn output about shared namespaces without CONFIG_NVME_MULTIPATH
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yi Zhang <[email protected]>
[ Upstream commit 0bc2e80b9be51712b19e919db5abc97a418f8292 ]
Move the stray '.' that is currently at the end of the line after newline '\n' to before newline character which is the right position.
--- drivers/nvme/host/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nvme/host/core.c +1 -1
@@ -3630,7 +3630,7 @@ static int nvme_init_ns_head(struct nvme_ns *ns, struct nvme_ns_info *info)"Found shared namespace %d, but multipathing not supported.\n" , info->nsid);dev_warn_once (ctrl->device, -"Support for shared namespaces without CONFIG_NVME_MULTIPATH is deprecated and will be removed in Linux 6.0\n." ); +"Support for shared namespaces without CONFIG_NVME_MULTIPATH is deprecated and will be removed in Linux 6.0.\n" ); } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 30/336 bpf: Fix a verifier verbose message
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anton Protopopov <[email protected]>
[ Upstream commit 37eacb9f6e89fb399a79e952bc9c78eb3e16290e ]
Long ago a map file descriptor in a pseudo ldimm64 instruction could only be present as an immediate value insn[0].imm, and thus this value was used in a verbose verifier message printed when the file descriptor wasn't valid. Since addition of BPF_PSEUDO_MAP_IDX_VALUE/BPF_PSEUDO_MAP_IDX the insn[0].imm field can also contain an index pointing to the file descriptor in the attr.fd_array array. However, if the file descriptor is invalid, the verifier still prints the verbose message containing value of insn[0].imm. Patch the verifier message to always print the actual file descriptor value.
--- kernel/bpf/verifier.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
kernel/bpf/verifier.c +1 -2
@@ -18040,8 +18040,7 @@ static int resolve_pseudo_ldimm64(struct bpf_verifier_env *env) f =fdget (fd); map =__bpf_map_get (f);if (IS_ERR (map)) { -verbose (env,"fd %d is not pointing to valid bpf_map\n" , - insn[0 ].imm); +verbose (env,"fd %d is not pointing to valid bpf_map\n" , fd);return PTR_ERR (map); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 31/336 spi: axi-spi-engine: use common AXI macros
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <[email protected]>
[ Upstream commit 88c2b56c2690061121cad03f0f551db465287575 ]
This avoid duplicating the same macros in multiple drivers by reusing the common AXI macros for the version register.
Stable-dep-of: 0064db9ce4aa ("spi: axi-spi-engine: fix version format string")
--- drivers/spi/spi-axi-spi-engine.c | 17 ++++++----------- 1 file changed, 6 insertions(+), 11 deletions(-)
drivers/spi/spi-axi-spi-engine.c +6 -11
@@ -6,6 +6,7 @@*/ #include <linux/clk.h> +#include <linux/fpga/adi-axi-common.h> #include <linux/idr.h> #include <linux/interrupt.h> #include <linux/io.h>
@@ -15,12 +16,6 @@#include <linux/spi/spi.h> #include <linux/timer.h> -#define SPI_ENGINE_VERSION_MAJOR (x) ((x >> 16) & 0xff) -#define SPI_ENGINE_VERSION_MINOR (x) ((x >> 8) & 0xff) -#define SPI_ENGINE_VERSION_PATCH (x) (x & 0xff) - -#define SPI_ENGINE_REG_VERSION 0x00 -#define SPI_ENGINE_REG_RESET 0x40#define SPI_ENGINE_REG_INT_ENABLE 0x80
@@ -661,12 +656,12 @@ static int spi_engine_probe(struct platform_device *pdev)if (IS_ERR (spi_engine->base))return PTR_ERR (spi_engine->base); - version =readl (spi_engine->base +SPI_ENGINE_REG_VERSION ); -if (SPI_ENGINE_VERSION_MAJOR (version) !=1 ) { + version =readl (spi_engine->base +ADI_AXI_REG_VERSION ); +if (ADI_AXI_PCORE_VER_MAJOR (version) !=1 ) {dev_err (&pdev->dev,"Unsupported peripheral version %u.%u.%c\n" , -SPI_ENGINE_VERSION_MAJOR (version), -SPI_ENGINE_VERSION_MINOR (version), -SPI_ENGINE_VERSION_PATCH (version)); +ADI_AXI_PCORE_VER_MAJOR (version), +ADI_AXI_PCORE_VER_MINOR (version), +ADI_AXI_PCORE_VER_PATCH (version));return -ENODEV ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 32/336 spi: axi-spi-engine: fix version format string
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <[email protected]>
[ Upstream commit 0064db9ce4aa7cc794e6f4aed60dee0f94fc9bcf ]
The version format string in the AXI SPI Engine driver was probably intended to print the version number in the same format as the DT compatible string (e.g. 1.00.a). However, the version just uses semantic versioning so formatting the patch number as a character is not correct and would result in printing control characters for patch numbers less than 32.
--- drivers/spi/spi-axi-spi-engine.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-axi-spi-engine.c +1 -1
@@ -658,7 +658,7 @@ static int spi_engine_probe(struct platform_device *pdev) version =readl (spi_engine->base +ADI_AXI_REG_VERSION );if (ADI_AXI_PCORE_VER_MAJOR (version) !=1 ) { -dev_err (&pdev->dev,"Unsupported peripheral version %u.%u.%c\n" , +dev_err (&pdev->dev,"Unsupported peripheral version %u.%u.%u\n" ,ADI_AXI_PCORE_VER_MAJOR (version),ADI_AXI_PCORE_VER_MINOR (version),ADI_AXI_PCORE_VER_PATCH (version));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 33/336 spi: hisi-kunpeng: Delete the dump interface of data registers in debugfs
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Devyn Liu <[email protected]>
[ Upstream commit 7430764f5a85d30314aeef2d5438dff1fb0b1d68 ]
Due to the reading of FIFO during the dump of data registers in debugfs, if SPI transmission is in progress, it will be affected and may result in transmission failure. Therefore, the dump interface of data registers in debugfs is removed.
--- drivers/spi/spi-hisi-kunpeng.c | 2 -- 1 file changed, 2 deletions(-)
drivers/spi/spi-hisi-kunpeng.c +0 -2
@@ -151,8 +151,6 @@ static const struct debugfs_reg32 hisi_spi_regs[] = {HISI_SPI_DBGFS_REG ("ENR" ,HISI_SPI_ENR ),HISI_SPI_DBGFS_REG ("FIFOC" ,HISI_SPI_FIFOC ),HISI_SPI_DBGFS_REG ("IMR" ,HISI_SPI_IMR ), -HISI_SPI_DBGFS_REG ("DIN" ,HISI_SPI_DIN ), -HISI_SPI_DBGFS_REG ("DOUT" ,HISI_SPI_DOUT ),HISI_SPI_DBGFS_REG ("SR" ,HISI_SPI_SR ),HISI_SPI_DBGFS_REG ("RISR" ,HISI_SPI_RISR ), HISI_SPI_DBGFS_REG("ISR", HISI_SPI_ISR),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 34/336 bpf, arm64: Fix incorrect runtime stats
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Kuohai <[email protected]>
[ Upstream commit dc7d7447b56bcc9cf79a9c22e4edad200a298e4c ]
When __bpf_prog_enter() returns zero, the arm64 register x20 that stores prog start time is not assigned to zero, causing incorrect runtime stats.
To fix it, assign the return value of bpf_prog_enter() to x20 register immediately upon its return.
--- arch/arm64/net/bpf_jit_comp.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/arm64/net/bpf_jit_comp.c +3 -3
@@ -1738,15 +1738,15 @@ static void invoke_bpf_prog(struct jit_ctx *ctx, struct bpf_tramp_link *l,emit_call (enter_prog, ctx); +/* save return value to callee saved register x20 */ +emit (A64_MOV (1 ,A64_R (20 ),A64_R (0 )), ctx); +/* if (__bpf_prog_enter(prog) == 0) * goto skip_exec_of_prog; */ branch = ctx->image + ctx->idx;emit (A64_NOP , ctx); -/* save return value to callee saved register x20 */ -emit (A64_MOV (1 ,A64_R (20 ),A64_R (0 )), ctx); -emit (A64_ADD_I (1 ,A64_R (0 ),A64_SP , args_off), ctx);if (!p->jited)emit_addr_mov_i64 (A64_R (1 ), (const u64 )p->insnsi, ctx);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 35/336 riscv, bpf: Fix incorrect runtime stats
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Kuohai <[email protected]>
[ Upstream commit 10541b374aa05c8118cc6a529a615882e53f261b ]
When __bpf_prog_enter() returns zero, the s1 register is not set to zero, resulting in incorrect runtime stats. Fix it by setting s1 immediately upon the return of __bpf_prog_enter().
--- arch/riscv/net/bpf_jit_comp64.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/riscv/net/bpf_jit_comp64.c +3 -3
@@ -740,6 +740,9 @@ static int invoke_bpf_prog(struct bpf_tramp_link *l, int args_off, int retval_ofif (ret)return ret; +/* store prog start time */ +emit_mv (RV_REG_S1 ,RV_REG_A0 , ctx); +/* if (__bpf_prog_enter(prog) == 0) * goto skip_exec_of_prog; */
@@ -747,9 +750,6 @@ static int invoke_bpf_prog(struct bpf_tramp_link *l, int args_off, int retval_of/* nop reserved for conditional jump */ emit (rv_nop (), ctx); -/* store prog start time */ -emit_mv (RV_REG_S1 ,RV_REG_A0 , ctx); -/* arg1: &args_off */ emit_addi (RV_REG_A0 ,RV_REG_FP , -args_off, ctx);if (!p->jited)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 36/336 ASoC: Intel: avs: Set name of control as in topology
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amadeusz Sławiński <[email protected]>
[ Upstream commit 4cbb5050bffc49c716381ea2ecb07306dd46f83a ]
When creating controls attached to widgets, there are a lot of rules if they get their name prefixed with widget name or not. Due to that controls ended up with weirdly looking names like "ssp0_fe DSP Volume", while topology set it to "DSP Volume".
Fix this by setting no_wname_in_kcontrol_name to true in avs topology widgets which disables unwanted behaviour.
--- sound/soc/intel/avs/topology.c | 2 ++ 1 file changed, 2 insertions(+)
sound/soc/intel/avs/topology.c +2 -0
@@ -1458,6 +1458,8 @@ static int avs_widget_load(struct snd_soc_component *comp, int index,if (!le32_to_cpu (dw->priv.size))return 0 ; + w->no_wname_in_kcontrol_name = true; +if (w->ignore_suspend && !AVS_S0IX_SUPPORTED ) {dev_info_once (comp->dev,"Device does not support S0IX, check BIOS settings\n" ); w->ignore_suspend = false;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 37/336 ASoC: codecs: wsa881x: set clk_stop_mode1 flag
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Kandagatla <[email protected]>
[ Upstream commit 32ac501957e5f68fe0e4bf88fb4db75cfb8f6566 ]
WSA881x codecs do not retain the state while clock is stopped, so mark this with clk_stop_mode1 flag.
--- sound/soc/codecs/wsa881x.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/codecs/wsa881x.c +1 -0
@@ -1155,6 +1155,7 @@ static int wsa881x_probe(struct sdw_slave *pdev, pdev->prop.sink_ports =GENMASK (WSA881X_MAX_SWR_PORTS ,0 ); pdev->prop.sink_dpn_prop = wsa_sink_dpn_prop; pdev->prop.scp_int1_mask =SDW_SCP_INT1_BUS_CLASH |SDW_SCP_INT1_PARITY ; + pdev->prop.clk_stop_mode1 = true;gpiod_direction_output (wsa881x->sd_n, !wsa881x->sd_n_val); wsa881x->regmap =devm_regmap_init_sdw (pdev, &wsa881x_regmap_config);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 38/336 s390/mm: Fix storage key clearing for guest huge pages
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudio Imbrenda <[email protected]>
[ Upstream commit 843c3280686fc1a83d89ee1e0b5599c9f6b09d0c ]
The function __storage_key_init_range() expects the end address to be the first byte outside the range to be initialized. I.e. end - start should be the size of the area to be initialized.
The current code works because __storage_key_init_range() will still loop over every page in the range, but it is slower than using sske_frame().
--- arch/s390/mm/gmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/s390/mm/gmap.c +1 -1
@@ -2659,7 +2659,7 @@ static int __s390_enable_skey_hugetlb(pte_t *pte, unsigned long addr,return 0 ; start =pmd_val (*pmd) &HPAGE_MASK ; - end = start +HPAGE_SIZE -1 ; + end = start +HPAGE_SIZE ;__storage_key_init_range (start, end);set_bit (PG_arch_1, &page->flags);cond_resched ();
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 39/336 s390/mm: Fix clearing storage keys for huge pages
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudio Imbrenda <[email protected]>
[ Upstream commit 412050af2ea39407fe43324b0be4ab641530ce88 ]
The function __storage_key_init_range() expects the end address to be the first byte outside the range to be initialized. I.e. end - start should be the size of the area to be initialized.
The current code works because __storage_key_init_range() will still loop over every page in the range, but it is slower than using sske_frame().
--- arch/s390/mm/hugetlbpage.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/s390/mm/hugetlbpage.c +1 -1
@@ -139,7 +139,7 @@ static void clear_huge_pte_skeys(struct mm_struct *mm, unsigned long rste) }if (!test_and_set_bit (PG_arch_1, &page->flags)) -__storage_key_init_range (paddr, paddr + size -1 ); +__storage_key_init_range (paddr, paddr + size); } void __set_huge_pte_at(struct mm_struct *mm, unsigned long addr,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 40/336 arm32, bpf: Reimplement sign-extension mov instruction
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Puranjay Mohan <[email protected]>
[ Upstream commit c6f48506ba30c722dd9d89aa6a40eb1926277dff ]
The current implementation of the mov instruction with sign extension has the following problems:
1. It clobbers the source register if it is not stacked because it sign extends the source and then moves it to the destination.
2. If the dst_reg is stacked, the current code doesn't write the value back in case of 64-bit mov.
3. There is room for improvement by emitting fewer instructions.
The steps for fixing this and the instructions emitted by the JIT are explained below with examples in all combinations:
Case A: offset == 32:
=====================
Case A.1: src and dst are stacked registers:
--------------------------------------------
1. Load src_lo into tmp_lo
2. Store tmp_lo into dst_lo
3. Sign extend tmp_lo into tmp_hi
4. Store tmp_hi to dst_hi
Example: r3 = (s32)r3
r3 is a stacked register
ldr r6, [r11, #-16] // Load r3_lo into tmp_lo
// str to dst_lo is not emitted because src_lo == dst_lo
asr r7, r6, #31 // Sign extend tmp_lo into tmp_hi
str r7, [r11, #-12] // Store tmp_hi into r3_hi
Case A.2: src is stacked but dst is not:
----------------------------------------
1. Load src_lo into dst_lo
2. Sign extend dst_lo into dst_hi
Example: r6 = (s32)r3
r6 maps to {ARM_R5, ARM_R4} and r3 is stacked
ldr r4, [r11, #-16] // Load r3_lo into r6_lo
asr r5, r4, #31 // Sign extend r6_lo into r6_hi
Case A.3: src is not stacked but dst is stacked:
------------------------------------------------
1. Store src_lo into dst_lo
2. Sign extend src_lo into tmp_hi
3. Store tmp_hi to dst_hi
Example: r3 = (s32)r6
r3 is stacked and r6 maps to {ARM_R5, ARM_R4}
str r4, [r11, #-16] // Store r6_lo to r3_lo
asr r7, r4, #31 // Sign extend r6_lo into tmp_hi
str r7, [r11, #-12] // Store tmp_hi to dest_hi
Case A.4: Both src and dst are not stacked:
-------------------------------------------
1. Mov src_lo into dst_lo
2. Sign extend src_lo into dst_hi
Example: (bf) r6 = (s32)r6
r6 maps to {ARM_R5, ARM_R4}
// Mov not emitted because dst == src
asr r5, r4, #31 // Sign extend r6_lo into r6_hiCase B: offset != 32:
=====================
Case B.1: src and dst are stacked registers:
--------------------------------------------
1. Load src_lo into tmp_lo
2. Sign extend tmp_lo according to offset.
3. Store tmp_lo into dst_lo
4. Sign extend tmp_lo into tmp_hi
5. Store tmp_hi to dst_hi
Example: r9 = (s8)r3
r9 and r3 are both stacked registers
ldr r6, [r11, #-16] // Load r3_lo into tmp_lo
lsl r6, r6, #24 // Sign extend tmp_lo
asr r6, r6, #24 // ..
str r6, [r11, #-56] // Store tmp_lo to r9_lo
asr r7, r6, #31 // Sign extend tmp_lo to tmp_hi
str r7, [r11, #-52] // Store tmp_hi to r9_hi
Case B.2: src is stacked but dst is not:
----------------------------------------
1. Load src_lo into dst_lo
2. Sign extend dst_lo according to offset.
3. Sign extend tmp_lo into dst_hi
Example: r6 = (s8)r3
r6 maps to {ARM_R5, ARM_R4} and r3 is stacked
ldr r4, [r11, #-16] // Load r3_lo to r6_lo
lsl r4, r4, #24 // Sign extend r6_lo
asr r4, r4, #24 // ..
asr r5, r4, #31 // Sign extend r6_lo into r6_hi Case B.3: src is not stacked but dst is stacked:
------------------------------------------------
1. Sign extend src_lo into tmp_lo according to offset.
2. Store tmp_lo into dst_lo.
3. Sign extend src_lo into tmp_hi.
4. Store tmp_hi to dst_hi.
Example: r3 = (s8)r1
r3 is stacked and r1 maps to {ARM_R3, ARM_R2}
lsl r6, r2, #24 // Sign extend r1_lo to tmp_lo
asr r6, r6, #24 // ..
str r6, [r11, #-16] // Store tmp_lo to r3_lo
asr r7, r6, #31 // Sign extend tmp_lo to tmp_hi
str r7, [r11, #-12] // Store tmp_hi to r3_hi Case B.4: Both src and dst are not stacked:
-------------------------------------------
1. Sign extend src_lo into dst_lo according to offset.
2. Sign extend dst_lo into dst_hi.
Example: r6 = (s8)r1
r6 maps to {ARM_R5, ARM_R4} and r1 maps to {ARM_R3, ARM_R2}
lsl r4, r2, #24 // Sign extend r1_lo to r6_lo
asr r4, r4, #24 // ..
asr r5, r4, #31 // Sign extend r6_lo to r6_hi--- arch/arm/net/bpf_jit_32.c | 56 ++++++++++++++++++++++++++++++--------- 1 file changed, 43 insertions(+), 13 deletions(-)
arch/arm/net/bpf_jit_32.c +43 -13
@@ -871,16 +871,11 @@ static inline void emit_a32_alu_r64(const bool is64, const s8 dst[], }/* dst = src (4 bytes)*/ -static inline void emit_a32_mov_r (const s8 dst,const s8 src,const u8 off, -struct jit_ctx *ctx) { +static inline void emit_a32_mov_r (const s8 dst,const s8 src,struct jit_ctx *ctx) {const s8 *tmp = bpf2a32[TMP_REG_1 ];s8 rt; rt =arm_bpf_get_reg32 (src, tmp[0 ], ctx); -if (off && off !=32 ) { -emit (ARM_LSL_I (rt, rt,32 - off), ctx); -emit (ARM_ASR_I (rt, rt,32 - off), ctx); - }arm_bpf_put_reg32 (dst, rt, ctx); }
@@ -889,15 +884,15 @@ static inline void emit_a32_mov_r64(const bool is64, const s8 dst[],const s8 src[], struct jit_ctx *ctx) { if (!is64) { - emit_a32_mov_r(dst_lo, src_lo, 0, ctx); +emit_a32_mov_r (dst_lo ,src_lo ,ctx );if (!ctx->prog->aux->verifier_zext)/* Zero out high 4 bytes */ emit_a32_mov_i (dst_hi,0 , ctx); } else if (__LINUX_ARM_ARCH__ < 6 && ctx->cpu_architecture < CPU_ARCH_ARMv5TE) {/* complete 8 byte move */ -emit_a32_mov_r (dst_lo, src_lo,0 , ctx); -emit_a32_mov_r (dst_hi, src_hi,0 , ctx); +emit_a32_mov_r (dst_lo, src_lo, ctx); +emit_a32_mov_r (dst_hi, src_hi, ctx); }else if (is_stacked (src_lo) &&is_stacked (dst_lo)) {const u8 *tmp = bpf2a32[TMP_REG_1 ];
@@ -917,17 +912,52 @@ static inline void emit_a32_mov_r64(const bool is64, const s8 dst[],static inline void emit_a32_movsx_r64 (const bool is64,const u8 off,const s8 dst[],const s8 src[],struct jit_ctx *ctx) {const s8 *tmp = bpf2a32[TMP_REG_1 ]; -const s8 *rt; +s8 rs; +s8 rd; - rt =arm_bpf_get_reg64 (dst, tmp, ctx); +if (is_stacked (dst_lo)) + rd = tmp[1 ]; +else + rd = dst_lo; + rs =arm_bpf_get_reg32 (src_lo, rd, ctx); +/* rs may be one of src[1], dst[1], or tmp[1] */ + +/* Sign extend rs if needed. If off == 32, lower 32-bits of src are moved to dst and sign +* extension only happens in the upper 64 bits. +*/ +if (off !=32 ) { +/* Sign extend rs into rd */ +emit (ARM_LSL_I (rd, rs,32 - off), ctx); +emit (ARM_ASR_I (rd, rd,32 - off), ctx); + }else { + rd = rs; + } + +/* Write rd to dst_lo +* +* Optimization: +* Assume: +* 1. dst == src and stacked. +* 2. off == 32 +* +* In this case src_lo was loaded into rd(tmp[1]) but rd was not sign extended as off==32. +* So, we don't need to write rd back to dst_lo as they have the same value. +* This saves us one str instruction. +*/ +if (dst_lo != src_lo || off !=32 ) +arm_bpf_put_reg32 (dst_lo, rd, ctx); -emit_a32_mov_r (dst_lo, src_lo, off, ctx);if (!is64) {if (!ctx->prog->aux->verifier_zext)/* Zero out high 4 bytes */ emit_a32_mov_i (dst_hi,0 , ctx); }else { -emit (ARM_ASR_I (rt[0 ], rt[1 ],31 ), ctx); +if (is_stacked (dst_hi)) { +emit (ARM_ASR_I (tmp[0 ], rd,31 ), ctx); +arm_bpf_put_reg32 (dst_hi, tmp[0 ], ctx); + }else { +emit (ARM_ASR_I (dst_hi, rd,31 ), ctx); + } } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 41/336 xdp: use flags field to disambiguate broadcast redirect
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toke Høiland-Jørgensen <[email protected]>
[ Upstream commit 5bcf0dcbf9066348058b88a510c57f70f384c92c ]
When redirecting a packet using XDP, the bpf_redirect_map() helper will set up the redirect destination information in struct bpf_redirect_info (using the __bpf_xdp_redirect_map() helper function), and the xdp_do_redirect() function will read this information after the XDP program returns and pass the frame on to the right redirect destination.
When using the BPF_F_BROADCAST flag to do multicast redirect to a whole map, __bpf_xdp_redirect_map() sets the 'map' pointer in struct bpf_redirect_info to point to the destination map to be broadcast. And xdp_do_redirect() reacts to the value of this map pointer to decide whether it's dealing with a broadcast or a single-value redirect. However, if the destination map is being destroyed before xdp_do_redirect() is called, the map pointer will be cleared out (by bpf_clear_redirect_map()) without waiting for any XDP programs to stop running. This causes xdp_do_redirect() to think that the redirect was to a single target, but the target pointer is also NULL (since broadcast redirects don't have a single target), so this causes a crash when a NULL pointer is passed to dev_map_enqueue().
To fix this, change xdp_do_redirect() to react directly to the presence of the BPF_F_BROADCAST flag in the 'flags' value in struct bpf_redirect_info to disambiguate between a single-target and a broadcast redirect. And only read the 'map' pointer if the broadcast flag is set, aborting if that has been cleared out in the meantime. This prevents the crash, while keeping the atomic (cmpxchg-based) clearing of the map pointer itself, and without adding any more checks in the non-broadcast fast path.
--- net/core/filter.c | 42 ++++++++++++++++++++++++++++++++---------- 1 file changed, 32 insertions(+), 10 deletions(-)
net/core/filter.c +32 -10
@@ -4360,10 +4360,12 @@ static __always_inline int __xdp_do_redirect_frame(struct bpf_redirect_info *ri,enum bpf_map_type map_type = ri->map_type;void *fwd = ri->tgt_value;u32 map_id = ri->map_id; +u32 flags = ri->flags;struct bpf_map *map;int err; ri->map_id =0 ;/* Valid map id idr range: [1,INT_MAX[ */ + ri->flags =0 ; ri->map_type =BPF_MAP_TYPE_UNSPEC ;if (unlikely (!xdpf)) {
@@ -4375,11 +4377,20 @@ static __always_inline int __xdp_do_redirect_frame(struct bpf_redirect_info *ri,case BPF_MAP_TYPE_DEVMAP : fallthrough;case BPF_MAP_TYPE_DEVMAP_HASH : - map =READ_ONCE (ri->map); -if (unlikely (map)) { +if (unlikely (flags &BPF_F_BROADCAST )) { + map =READ_ONCE (ri->map); + +/* The map pointer is cleared when the map is being torn +* down by bpf_clear_redirect_map() +*/ +if (unlikely (!map)) { + err = -ENOENT ; +break ; + } +WRITE_ONCE (ri->map,NULL ); err =dev_map_enqueue_multi (xdpf, dev, map, - ri->flags &BPF_F_EXCLUDE_INGRESS ); + flags &BPF_F_EXCLUDE_INGRESS ); }else { err =dev_map_enqueue (fwd, xdpf, dev); }
@@ -4442,9 +4453,9 @@ EXPORT_SYMBOL_GPL(xdp_do_redirect_frame);static int xdp_do_generic_redirect_map (struct net_device *dev,struct sk_buff *skb,struct xdp_buff *xdp, -struct bpf_prog *xdp_prog, -void *fwd, -enum bpf_map_type map_type,u32 map_id) +struct bpf_prog *xdp_prog,void *fwd, +enum bpf_map_type map_type,u32 map_id, +u32 flags) {struct bpf_redirect_info *ri =this_cpu_ptr (&bpf_redirect_info);struct bpf_map *map;
@@ -4454,11 +4465,20 @@ static int xdp_do_generic_redirect_map(struct net_device *dev,case BPF_MAP_TYPE_DEVMAP : fallthrough;case BPF_MAP_TYPE_DEVMAP_HASH : - map =READ_ONCE (ri->map); -if (unlikely (map)) { +if (unlikely (flags &BPF_F_BROADCAST )) { + map =READ_ONCE (ri->map); + +/* The map pointer is cleared when the map is being torn +* down by bpf_clear_redirect_map() +*/ +if (unlikely (!map)) { + err = -ENOENT ; +break ; + } +WRITE_ONCE (ri->map,NULL ); err =dev_map_redirect_multi (dev, skb, xdp_prog, map, - ri->flags &BPF_F_EXCLUDE_INGRESS ); + flags &BPF_F_EXCLUDE_INGRESS ); }else { err =dev_map_generic_redirect (fwd, skb, xdp_prog); }
@@ -4495,9 +4515,11 @@ int xdp_do_generic_redirect(struct net_device *dev, struct sk_buff *skb,enum bpf_map_type map_type = ri->map_type;void *fwd = ri->tgt_value;u32 map_id = ri->map_id; +u32 flags = ri->flags;int err; ri->map_id =0 ;/* Valid map id idr range: [1,INT_MAX[ */ + ri->flags =0 ; ri->map_type =BPF_MAP_TYPE_UNSPEC ;if (map_type ==BPF_MAP_TYPE_UNSPEC && map_id ==INT_MAX ) {
@@ -4517,7 +4539,7 @@ int xdp_do_generic_redirect(struct net_device *dev, struct sk_buff *skb,return 0 ; } -return xdp_do_generic_redirect_map (dev, skb, xdp, xdp_prog, fwd, map_type, map_id); +return xdp_do_generic_redirect_map (dev, skb, xdp, xdp_prog, fwd, map_type, map_id, flags); err:_trace_xdp_redirect_err (dev, xdp_prog, ri->tgt_index, err);return err;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 42/336 efi/unaccepted: touch soft lockup during memory accept
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Yu <[email protected]>
[ Upstream commit 1c5a1627f48105cbab81d25ec2f72232bfaa8185 ]
Commit 50e782a86c98 ("efi/unaccepted: Fix soft lockups caused by parallel memory acceptance") has released the spinlock so other CPUs can do memory acceptance in parallel and not triggers softlockup on other CPUs.
However the softlock up was intermittent shown up if the memory of the TD guest is large, and the timeout of softlockup is set to 1 second:
RIP: 0010:_raw_spin_unlock_irqrestore Call Trace: ? __hrtimer_run_queues <IRQ> ? hrtimer_interrupt ? watchdog_timer_fn ? __sysvec_apic_timer_interrupt ? __pfx_watchdog_timer_fn ? sysvec_apic_timer_interrupt </IRQ> ? __hrtimer_run_queues <TASK> ? hrtimer_interrupt ? asm_sysvec_apic_timer_interrupt ? _raw_spin_unlock_irqrestore ? __sysvec_apic_timer_interrupt ? sysvec_apic_timer_interrupt accept_memory try_to_accept_memory do_huge_pmd_anonymous_page get_page_from_freelist __handle_mm_fault __alloc_pages __folio_alloc ? __tdx_hypercall handle_mm_fault vma_alloc_folio do_user_addr_fault do_huge_pmd_anonymous_page exc_page_fault ? __do_huge_pmd_anonymous_page asm_exc_page_fault __handle_mm_fault
When the local irq is enabled at the end of accept_memory(), the softlockup detects that the watchdog on single CPU has not been fed for a while. That is to say, even other CPUs will not be blocked by spinlock, the current CPU might be stunk with local irq disabled for a while, which hurts not only nmi watchdog but also softlockup.
Chao Gao pointed out that the memory accept could be time costly and there was similar report before. Thus to avoid any softlocup detection during this stage, give the softlockup a flag to skip the timeout check at the end of accept_memory(), by invoking touch_softlockup_watchdog().
--- drivers/firmware/efi/unaccepted_memory.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/firmware/efi/unaccepted_memory.c +4 -0
@@ -4,6 +4,7 @@#include <linux/memblock.h> #include <linux/spinlock.h> #include <linux/crash_dump.h> +#include <linux/nmi.h> #include <asm/unaccepted_memory.h> /* Protects unaccepted memory bitmap and accepting_list */
@@ -149,6 +150,9 @@ void accept_memory(phys_addr_t start, phys_addr_t end) }list_del (&range.list); + +touch_softlockup_watchdog (); +spin_unlock_irqrestore (&unaccepted_memory_lock, flags); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 43/336 ice: ensure the copied buf is NUL terminated
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bui Quang Minh <[email protected]>
[ Upstream commit 666854ea9cad844f75a068f32812a2d78004914a ]
Currently, we allocate a count-sized kernel buffer and copy count bytes from userspace to that buffer. Later, we use sscanf on this buffer but we don't ensure that the string is terminated inside the buffer, this can lead to OOB read when using sscanf. Fix this issue by using memdup_user_nul instead of memdup_user.
--- drivers/net/ethernet/intel/ice/ice_debugfs.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/net/ethernet/intel/ice/ice_debugfs.c +4 -4
@@ -174,7 +174,7 @@ ice_debugfs_module_write(struct file *filp, const char __user *buf,if (*ppos !=0 || count >8 )return -EINVAL ; - cmd_buf =memdup_user (buf, count); + cmd_buf =memdup_user_nul (buf, count);if (IS_ERR (cmd_buf))return PTR_ERR (cmd_buf);
@@ -260,7 +260,7 @@ ice_debugfs_nr_messages_write(struct file *filp, const char __user *buf,if (*ppos !=0 || count >4 )return -EINVAL ; - cmd_buf =memdup_user (buf, count); + cmd_buf =memdup_user_nul (buf, count);if (IS_ERR (cmd_buf))return PTR_ERR (cmd_buf);
@@ -335,7 +335,7 @@ ice_debugfs_enable_write(struct file *filp, const char __user *buf,if (*ppos !=0 || count >2 )return -EINVAL ; - cmd_buf =memdup_user (buf, count); + cmd_buf =memdup_user_nul (buf, count);if (IS_ERR (cmd_buf))return PTR_ERR (cmd_buf);
@@ -431,7 +431,7 @@ ice_debugfs_log_size_write(struct file *filp, const char __user *buf,if (*ppos !=0 || count >5 )return -EINVAL ; - cmd_buf =memdup_user (buf, count); + cmd_buf =memdup_user_nul (buf, count);if (IS_ERR (cmd_buf))return PTR_ERR (cmd_buf);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 44/336 bna: ensure the copied buf is NUL terminated
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bui Quang Minh <[email protected]>
[ Upstream commit 8c34096c7fdf272fd4c0c37fe411cd2e3ed0ee9f ]
Currently, we allocate a nbytes-sized kernel buffer and copy nbytes from userspace to that buffer. Later, we use sscanf on this buffer but we don't ensure that the string is terminated inside the buffer, this can lead to OOB read when using sscanf. Fix this issue by using memdup_user_nul instead of memdup_user.
--- drivers/net/ethernet/brocade/bna/bnad_debugfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/brocade/bna/bnad_debugfs.c +2 -2
@@ -312,7 +312,7 @@ bnad_debugfs_write_regrd(struct file *file, const char __user *buf,void *kern_buf;/* Copy the user space buf */ - kern_buf =memdup_user (buf, nbytes); + kern_buf =memdup_user_nul (buf, nbytes);if (IS_ERR (kern_buf))return PTR_ERR (kern_buf);
@@ -372,7 +372,7 @@ bnad_debugfs_write_regwr(struct file *file, const char __user *buf,void *kern_buf;/* Copy the user space buf */ - kern_buf =memdup_user (buf, nbytes); + kern_buf =memdup_user_nul (buf, nbytes);if (IS_ERR (kern_buf))return PTR_ERR (kern_buf);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 45/336 octeontx2-af: avoid off-by-one read from userspace
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bui Quang Minh <[email protected]>
[ Upstream commit f299ee709fb45036454ca11e90cb2810fe771878 ]
We try to access count + 1 byte from userspace with memdup_user(buffer, count + 1). However, the userspace only provides buffer of count bytes and only these count bytes are verified to be okay to access. To ensure the copied buffer is NUL terminated, we use memdup_user_nul instead.
--- drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c +1 -3
@@ -999,12 +999,10 @@ static ssize_t rvu_dbg_qsize_write(struct file *filp,u16 pcifunc;int ret, lf; - cmd_buf =memdup_user (buffer, count +1 ); + cmd_buf =memdup_user_nul (buffer, count);if (IS_ERR (cmd_buf))return -ENOMEM ; - cmd_buf[count] ='\0' ; - cmd_buf_tmp =strchr (cmd_buf,'\n' );if (cmd_buf_tmp) { *cmd_buf_tmp ='\0' ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 46/336 thermal/debugfs: Free all thermal zone debug memory on zone removal
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit 72c1afffa4c645fe0e0f1c03e5f34395ed65b5f4 ]
Because thermal_debug_tz_remove() does not free all memory allocated for thermal zone diagnostics, some of that memory becomes unreachable after freeing the thermal zone's struct thermal_debugfs object.
Address this by making thermal_debug_tz_remove() free all of the memory in question.
--- drivers/thermal/thermal_debugfs.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
drivers/thermal/thermal_debugfs.c +13 -0
@@ -826,15 +826,28 @@ void thermal_debug_tz_add(struct thermal_zone_device *tz)void thermal_debug_tz_remove (struct thermal_zone_device *tz) {struct thermal_debugfs *thermal_dbg = tz->debugfs; +struct tz_episode *tze, *tmp; +struct tz_debugfs *tz_dbg; +int *trips_crossed;if (!thermal_dbg)return ; + tz_dbg = &thermal_dbg->tz_dbg; +mutex_lock (&thermal_dbg->lock); + trips_crossed = tz_dbg->trips_crossed; + +list_for_each_entry_safe (tze, tmp, &tz_dbg->tz_episodes, node) { +list_del (&tze->node); +kfree (tze); + } + tz->debugfs =NULL ;mutex_unlock (&thermal_dbg->lock);thermal_debugfs_remove_id (thermal_dbg); +kfree (trips_crossed); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 47/336 thermal/debugfs: Fix two locking issues with thermal zone debug
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit c7f7c37271787a7f77d7eedc132b0b419a76b4c8 ]
With the current thermal zone locking arrangement in the debugfs code, user space can open the "mitigations" file for a thermal zone before the zone's debugfs pointer is set which will result in a NULL pointer dereference in tze_seq_start().
Moreover, thermal_debug_tz_remove() is not called under the thermal zone lock, so it can run in parallel with the other functions accessing the thermal zone's struct thermal_debugfs object. Then, it may clear tz->debugfs after one of those functions has checked it and the struct thermal_debugfs object may be freed prematurely.
To address the first problem, pass a pointer to the thermal zone's struct thermal_debugfs object to debugfs_create_file() in thermal_debug_tz_add() and make tze_seq_start(), tze_seq_next(), tze_seq_stop(), and tze_seq_show() retrieve it from s->private instead of a pointer to the thermal zone object. This will ensure that tz_debugfs will be valid across the "mitigations" file accesses until thermal_debugfs_remove_id() called by thermal_debug_tz_remove() removes that file.
To address the second problem, use tz->lock in thermal_debug_tz_remove() around the tz->debugfs value check (in case the same thermal zone is removed at the same time in two different threads) and its reset to NULL.
--- drivers/thermal/thermal_debugfs.c | 34 ++++++++++++++++++++----------- 1 file changed, 22 insertions(+), 12 deletions(-)
drivers/thermal/thermal_debugfs.c +22 -12
@@ -139,11 +139,13 @@ struct tz_episode {* we keep track of the current position in the history array. * * @tz_episodes: a list of thermal mitigation episodes +* @tz: thermal zone this object belongs to * @trips_crossed: an array of trip points crossed by id * @nr_trips: the number of trip points currently being crossed */ struct tz_debugfs {struct list_head tz_episodes; +struct thermal_zone_device *tz;int *trips_crossed;int nr_trips; };
@@ -716,8 +718,7 @@ void thermal_debug_update_temp(struct thermal_zone_device *tz)static void *tze_seq_start (struct seq_file *s,loff_t *pos) { -struct thermal_zone_device *tz = s->private; -struct thermal_debugfs *thermal_dbg = tz->debugfs; +struct thermal_debugfs *thermal_dbg = s->private;struct tz_debugfs *tz_dbg = &thermal_dbg->tz_dbg;mutex_lock (&thermal_dbg->lock);
@@ -727,8 +728,7 @@ static void *tze_seq_start(struct seq_file *s, loff_t *pos)static void *tze_seq_next (struct seq_file *s,void *v,loff_t *pos) { -struct thermal_zone_device *tz = s->private; -struct thermal_debugfs *thermal_dbg = tz->debugfs; +struct thermal_debugfs *thermal_dbg = s->private;struct tz_debugfs *tz_dbg = &thermal_dbg->tz_dbg;return seq_list_next (v, &tz_dbg->tz_episodes, pos);
@@ -736,15 +736,15 @@ static void *tze_seq_next(struct seq_file *s, void *v, loff_t *pos)static void tze_seq_stop (struct seq_file *s,void *v) { -struct thermal_zone_device *tz = s->private; -struct thermal_debugfs *thermal_dbg = tz->debugfs; +struct thermal_debugfs *thermal_dbg = s->private;mutex_unlock (&thermal_dbg->lock); }static int tze_seq_show (struct seq_file *s,void *v) { -struct thermal_zone_device *tz = s->private; +struct thermal_debugfs *thermal_dbg = s->private; +struct thermal_zone_device *tz = thermal_dbg->tz_dbg.tz;struct thermal_trip *trip;struct tz_episode *tze;const char *type;
@@ -810,6 +810,8 @@ void thermal_debug_tz_add(struct thermal_zone_device *tz) tz_dbg = &thermal_dbg->tz_dbg; + tz_dbg->tz = tz; + tz_dbg->trips_crossed =kzalloc (sizeof (int ) * tz->num_trips,GFP_KERNEL );if (!tz_dbg->trips_crossed) {thermal_debugfs_remove_id (thermal_dbg);
@@ -818,20 +820,30 @@ void thermal_debug_tz_add(struct thermal_zone_device *tz)INIT_LIST_HEAD (&tz_dbg->tz_episodes); -debugfs_create_file ("mitigations" ,0400 , thermal_dbg->d_top, tz, &tze_fops); +debugfs_create_file ("mitigations" ,0400 , thermal_dbg->d_top, + thermal_dbg, &tze_fops); tz->debugfs = thermal_dbg; }void thermal_debug_tz_remove (struct thermal_zone_device *tz) { -struct thermal_debugfs *thermal_dbg = tz->debugfs; +struct thermal_debugfs *thermal_dbg;struct tz_episode *tze, *tmp;struct tz_debugfs *tz_dbg;int *trips_crossed; -if (!thermal_dbg) +mutex_lock (&tz->lock); + + thermal_dbg = tz->debugfs; +if (!thermal_dbg) { +mutex_unlock (&tz->lock);return ; + } + + tz->debugfs =NULL ; + +mutex_unlock (&tz->lock); tz_dbg = &thermal_dbg->tz_dbg;
@@ -844,8 +856,6 @@ void thermal_debug_tz_remove(struct thermal_zone_device *tz)kfree (tze); } - tz->debugfs =NULL ; -mutex_unlock (&thermal_dbg->lock);thermal_debugfs_remove_id (thermal_dbg);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 48/336 nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 4b911a9690d72641879ea6d13cce1de31d346d79 ]
syzbot triggered various splats (see [0] and links) by a crafted GSO packet of VIRTIO_NET_HDR_GSO_UDP layering the following protocols:
ETH_P_8021AD + ETH_P_NSH + ETH_P_IPV6 + IPPROTO_UDP
NSH can encapsulate IPv4, IPv6, Ethernet, NSH, and MPLS. As the inner protocol can be Ethernet, NSH GSO handler, nsh_gso_segment(), calls skb_mac_gso_segment() to invoke inner protocol GSO handlers.
nsh_gso_segment() does the following for the original skb before calling skb_mac_gso_segment()
1. reset skb->network_header
2. save the original skb->{mac_heaeder,mac_len} in a local variable
3. pull the NSH header
4. resets skb->mac_header
5. set up skb->mac_len and skb->protocol for the inner protocol.
and does the following for the segmented skb
6. set ntohs(ETH_P_NSH) to skb->protocol
7. push the NSH header
8. restore skb->mac_header
9. set skb->mac_header + mac_len to skb->network_header
10. restore skb->mac_len
There are two problems in 6-7 and 8-9.
(a)
After 6 & 7, skb->data points to the NSH header, so the outer header (ETH_P_8021AD in this case) is stripped when skb is sent out of netdev.
Also, if NSH is encapsulated by NSH + Ethernet (so NSH-Ethernet-NSH), skb_pull() in the first nsh_gso_segment() will make skb->data point to the middle of the outer NSH or Ethernet header because the Ethernet header is not pulled by the second nsh_gso_segment().
(b)
While restoring skb->{mac_header,network_header} in 8 & 9, nsh_gso_segment() does not assume that the data in the linear buffer is shifted.
However, udp6_ufo_fragment() could shift the data and change skb->mac_header accordingly as demonstrated by syzbot.
If this happens, even the restored skb->mac_header points to the middle of the outer header.
It seems nsh_gso_segment() has never worked with outer headers so far.
At the end of nsh_gso_segment(), the outer header must be restored for the segmented skb, instead of the NSH header.
To do that, let's calculate the outer header position relatively from the inner header and set skb->{data,mac_header,protocol} properly.
[0]:
BUG: KMSAN: uninit-value in ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:524 [inline] BUG: KMSAN: uninit-value in ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline] BUG: KMSAN: uninit-value in ipvlan_queue_xmit+0xf44/0x16b0 drivers/net/ipvlan/ipvlan_core.c:668 ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:524 [inline] ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline] ipvlan_queue_xmit+0xf44/0x16b0 drivers/net/ipvlan/ipvlan_core.c:668 ipvlan_start_xmit+0x5c/0x1a0 drivers/net/ipvlan/ipvlan_main.c:222 __netdev_start_xmit include/linux/netdevice.h:4989 [inline] netdev_start_xmit include/linux/netdevice.h:5003 [inline] xmit_one net/core/dev.c:3547 [inline] dev_hard_start_xmit+0x244/0xa10 net/core/dev.c:3563 __dev_queue_xmit+0x33ed/0x51c0 net/core/dev.c:4351 dev_queue_xmit include/linux/netdevice.h:3171 [inline] packet_xmit+0x9c/0x6b0 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3081 [inline] packet_sendmsg+0x8aef/0x9f10 net/packet/af_packet.c:3113 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] __sys_sendto+0x735/0xa10 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b
Uninit was created at:
slab_post_alloc_hook mm/slub.c:3819 [inline] slab_alloc_node mm/slub.c:3860 [inline] __do_kmalloc_node mm/slub.c:3980 [inline] __kmalloc_node_track_caller+0x705/0x1000 mm/slub.c:4001 kmalloc_reserve+0x249/0x4a0 net/core/skbuff.c:582 __alloc_skb+0x352/0x790 net/core/skbuff.c:651 skb_segment+0x20aa/0x7080 net/core/skbuff.c:4647 udp6_ufo_fragment+0xcab/0x1150 net/ipv6/udp_offload.c:109 ipv6_gso_segment+0x14be/0x2ca0 net/ipv6/ip6_offload.c:152 skb_mac_gso_segment+0x3e8/0x760 net/core/gso.c:53 nsh_gso_segment+0x6f4/0xf70 net/nsh/nsh.c:108 skb_mac_gso_segment+0x3e8/0x760 net/core/gso.c:53 __skb_gso_segment+0x4b0/0x730 net/core/gso.c:124 skb_gso_segment include/net/gso.h:83 [inline] validate_xmit_skb+0x107f/0x1930 net/core/dev.c:3628 __dev_queue_xmit+0x1f28/0x51c0 net/core/dev.c:4343 dev_queue_xmit include/linux/netdevice.h:3171 [inline] packet_xmit+0x9c/0x6b0 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3081 [inline] packet_sendmsg+0x8aef/0x9f10 net/packet/af_packet.c:3113 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] __sys_sendto+0x735/0xa10 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b CPU: 1 PID: 5101 Comm: syz-executor421 Not tainted 6.8.0-rc5-syzkaller-00297-gf2e367d6ad3b #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
--- net/nsh/nsh.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
net/nsh/nsh.c +8 -6
@@ -77,13 +77,15 @@ EXPORT_SYMBOL_GPL(nsh_pop);static struct sk_buff *nsh_gso_segment (struct sk_buff *skb,netdev_features_t features) { +unsigned int outer_hlen, mac_len, nsh_len;struct sk_buff *segs =ERR_PTR (-EINVAL );u16 mac_offset = skb->mac_header; -unsigned int nsh_len, mac_len; -__be16 proto; +__be16 outer_proto, proto;skb_reset_network_header (skb); + outer_proto = skb->protocol; + outer_hlen =skb_mac_header_len (skb); mac_len = skb->mac_len;if (unlikely (!pskb_may_pull (skb,NSH_BASE_HDR_LEN )))
@@ -113,10 +115,10 @@ static struct sk_buff *nsh_gso_segment(struct sk_buff *skb, }for (skb = segs; skb; skb = skb->next) { - skb->protocol =htons (ETH_P_NSH ); -__skb_push (skb, nsh_len); - skb->mac_header = mac_offset; - skb->network_header = skb->mac_header + mac_len; + skb->protocol = outer_proto; +__skb_push (skb, nsh_len + outer_hlen); +skb_reset_mac_header (skb); +skb_set_network_header (skb, outer_hlen); skb->mac_len = mac_len; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 49/336 net l2tp: drop flow hash on forward
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Bauer <[email protected]>
[ Upstream commit 42f853b42899d9b445763b55c3c8adc72be0f0e1 ]
Drop the flow-hash of the skb when forwarding to the L2TP netdev.
This avoids the L2TP qdisc from using the flow-hash from the outer packet, which is identical for every flow within the tunnel.
This does not affect every platform but is specific for the ethernet driver. It depends on the platform including L4 information in the flow-hash.
One such example is the Mediatek Filogic MT798x family of networking processors.
--- net/l2tp/l2tp_eth.c | 3 +++ 1 file changed, 3 insertions(+)
net/l2tp/l2tp_eth.c +3 -0
@@ -127,6 +127,9 @@ static void l2tp_eth_dev_recv(struct l2tp_session *session, struct sk_buff *skb,/* checksums verified by L2TP */ skb->ip_summed =CHECKSUM_NONE ; +/* drop outer flow-hash */ +skb_clear_hash (skb); +skb_dst_drop (skb);nf_reset_ct (skb);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 50/336 thermal/debugfs: Prevent use-after-free from occurring after cdev removal
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit d351eb0ab04c3e8109895fc33250cebbce9c11da ]
Since thermal_debug_cdev_remove() does not run under cdev->lock, it can run in parallel with thermal_debug_cdev_state_update() and it may free the struct thermal_debugfs object used by the latter after it has been checked against NULL.
If that happens, thermal_debug_cdev_state_update() will access memory that has been freed already causing the kernel to crash.
Address this by using cdev->lock in thermal_debug_cdev_remove() around the cdev->debugfs value check (in case the same cdev is removed at the same time in two different threads) and its reset to NULL.
--- drivers/thermal/thermal_debugfs.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
drivers/thermal/thermal_debugfs.c +11 -3
@@ -505,15 +505,23 @@ void thermal_debug_cdev_add(struct thermal_cooling_device *cdev)*/ void thermal_debug_cdev_remove (struct thermal_cooling_device *cdev) { -struct thermal_debugfs *thermal_dbg = cdev->debugfs; +struct thermal_debugfs *thermal_dbg; -if (!thermal_dbg) +mutex_lock (&cdev->lock); + + thermal_dbg = cdev->debugfs; +if (!thermal_dbg) { +mutex_unlock (&cdev->lock);return ; + } + + cdev->debugfs =NULL ; + +mutex_unlock (&cdev->lock);mutex_lock (&thermal_dbg->lock);thermal_debugfs_cdev_clear (&thermal_dbg->cdev_dbg); - cdev->debugfs =NULL ;mutex_unlock (&thermal_dbg->lock);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 51/336 s390/vdso: Add CFI for RA register to asm macro vdso_func
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Remus <[email protected]>
[ Upstream commit b961ec10b9f9719987470236feb50c967db5a652 ]
The return-address (RA) register r14 is specified as volatile in the s390x ELF ABI [1]. Nevertheless proper CFI directives must be provided for an unwinder to restore the return address, if the RA register value is changed from its value at function entry, as it is the case.
[1]: s390x ELF ABI, https://github.com/IBM/s390x-abi/releases
--- arch/s390/include/asm/dwarf.h | 1 + arch/s390/kernel/vdso64/vdso_user_wrapper.S | 2 ++ 2 files changed, 3 insertions(+)
arch/s390/include/asm/dwarf.h +1 -0
@@ -9,6 +9,7 @@#define CFI_DEF_CFA_OFFSET .cfi_def_cfa_offset#define CFI_ADJUST_CFA_OFFSET .cfi_adjust_cfa_offset#define CFI_RESTORE .cfi_restore +#define CFI_REL_OFFSET .cfi_rel_offset#ifdef CONFIG_AS_CFI_VAL_OFFSET #define CFI_VAL_OFFSET .cfi_val_offset
arch/s390/kernel/vdso64/vdso_user_wrapper.S +2 -0
@@ -24,8 +24,10 @@ __kernel_\func: CFI_DEF_CFA_OFFSET (STACK_FRAME_OVERHEAD + WRAPPER_FRAME_SIZE) CFI_VAL_OFFSET 15, -STACK_FRAME_OVERHEAD stg %r14,STACK_FRAME_OVERHEAD(%r15) + CFI_REL_OFFSET 14, STACK_FRAME_OVERHEAD brasl %r14,__s390_vdso_\func lg %r14,STACK_FRAME_OVERHEAD(%r15) + CFI_RESTORE 14 aghi %r15,WRAPPER_FRAME_SIZE CFI_DEF_CFA_OFFSET STACK_FRAME_OVERHEAD CFI_RESTORE 15
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 52/336 Fix a potential infinite loop in extract_user_to_sg()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
[ Upstream commit 6a30653b604aaad1bf0f2e74b068ceb8b6fc7aea ]
Fix extract_user_to_sg() so that it will break out of the loop if iov_iter_extract_pages() returns 0 rather than looping around forever.
[Note that I've included two fixes lines as the function got moved to a different file and renamed]
--- lib/scatterlist.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
lib/scatterlist.c +1 -1
@@ -1124,7 +1124,7 @@ static ssize_t extract_user_to_sg(struct iov_iter *iter, do { res = iov_iter_extract_pages(iter, &pages, maxsize, sg_max, extraction_flags, &off); - if (res < 0) + if (res <= 0) goto failed; len = res;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 53/336 ALSA: emu10k1: fix E-MU card dock presence monitoring
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oswald Buddenhagen <[email protected]>
[ Upstream commit 398321d7531963b95841865eb371fe65c44c6921 ]
While there are two separate IRQ status bits for dock attach and detach, the hardware appears to mix them up more or less randomly, making them useless for tracking what actually happened. It is much safer to check the dock status separately and proceed based on that, as the old polling code did.
Note that the code assumes that only the dock can be hot-plugged - if other option card bits changed, the logic would break.
Message-ID: <[email protected]>
--- sound/pci/emu10k1/emu10k1_main.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-)
sound/pci/emu10k1/emu10k1_main.c +10 -7
@@ -778,6 +778,11 @@ static void emu1010_firmware_work(struct work_struct *work)msleep (10 );/* Unmute all. Default is muted after a firmware load */ snd_emu1010_fpga_write (emu,EMU_HANA_UNMUTE ,EMU_UNMUTE ); + }else if (!(reg &EMU_HANA_OPTION_DOCK_ONLINE )) { +/* Audio Dock removed */ +dev_info (emu->card->dev,"emu1010: Audio Dock detached\n" ); +/* The hardware auto-mutes all, so we unmute again */ +snd_emu1010_fpga_write (emu,EMU_HANA_UNMUTE ,EMU_UNMUTE ); } }
@@ -810,14 +815,12 @@ static void emu1010_interrupt(struct snd_emu10k1 *emu)u32 sts;snd_emu1010_fpga_read (emu,EMU_HANA_IRQ_STATUS , &sts); -if (sts &EMU_HANA_IRQ_DOCK_LOST ) { -/* Audio Dock removed */ -dev_info (emu->card->dev,"emu1010: Audio Dock detached\n" ); -/* The hardware auto-mutes all, so we unmute again */ -snd_emu1010_fpga_write (emu,EMU_HANA_UNMUTE ,EMU_UNMUTE ); - }else if (sts &EMU_HANA_IRQ_DOCK ) { + +// The distinction of the IRQ status bits is unreliable, +// so we dispatch later based on option card status. +if (sts & (EMU_HANA_IRQ_DOCK |EMU_HANA_IRQ_DOCK_LOST ))schedule_work (&emu->emu1010.firmware_work); - } +if (sts &EMU_HANA_IRQ_WCLK_CHANGED )schedule_work (&emu->emu1010.clock_work); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 54/336 ALSA: emu10k1: factor out snd_emu1010_load_dock_firmware()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oswald Buddenhagen <[email protected]>
[ Upstream commit 28deafd0fbdc45cc9c63bd7dd4efc35137958862 ]
Pulled out of the next patch to improve its legibility.
As the function is now available, call it directly from snd_emu10k1_emu1010_init(), thus making the MicroDock firmware loading synchronous - there isn't really a reason not to. Note that this does not affect the AudioDocks of rev1 cards, as these have no independent power supplies, and thus come up only a while after the main card is initialized.
As a drive-by, adjust the priorities of two messages to better reflect their impact.
Message-ID: <[email protected]>
Stable-dep-of: f848337cd801 ("ALSA: emu10k1: move the whole GPIO event handling to the workqueue")
--- sound/pci/emu10k1/emu10k1_main.c | 66 +++++++++++++++++--------------- 1 file changed, 36 insertions(+), 30 deletions(-)
sound/pci/emu10k1/emu10k1_main.c +36 -30
@@ -732,11 +732,43 @@ static int snd_emu1010_load_firmware(struct snd_emu10k1 *emu, int dock,return snd_emu1010_load_firmware_entry (emu, *fw); } +static void snd_emu1010_load_dock_firmware (struct snd_emu10k1 *emu) +{ +u32 tmp, tmp2; +int err; + +dev_info (emu->card->dev,"emu1010: Loading Audio Dock Firmware\n" ); +/* Return to Audio Dock programming mode */ +snd_emu1010_fpga_write (emu,EMU_HANA_FPGA_CONFIG , +EMU_HANA_FPGA_CONFIG_AUDIODOCK ); + err =snd_emu1010_load_firmware (emu,1 , &emu->dock_fw); +if (err <0 ) +return ; +snd_emu1010_fpga_write (emu,EMU_HANA_FPGA_CONFIG ,0 ); + +snd_emu1010_fpga_read (emu,EMU_HANA_ID , &tmp); +dev_dbg (emu->card->dev,"emu1010: EMU_HANA+DOCK_ID = 0x%x\n" , tmp); +if ((tmp &0x1f ) !=0x15 ) { +/* FPGA failed to be programmed */ +dev_err (emu->card->dev, +"emu1010: Loading Audio Dock Firmware failed, reg = 0x%x\n" , + tmp); +return ; + } +dev_info (emu->card->dev,"emu1010: Audio Dock Firmware loaded\n" ); + +snd_emu1010_fpga_read (emu,EMU_DOCK_MAJOR_REV , &tmp); +snd_emu1010_fpga_read (emu,EMU_DOCK_MINOR_REV , &tmp2); +dev_info (emu->card->dev,"Audio Dock ver: %u.%u\n" , tmp, tmp2); + +/* Allow DLL to settle, to sync clocking between 1010 and Dock */ +msleep (10 ); +} +static void emu1010_firmware_work (struct work_struct *work) {struct snd_emu10k1 *emu; -u32 tmp, tmp2, reg; -int err; +u32 reg; emu = container_of(work, struct snd_emu10k1, emu1010.firmware_work);
@@ -749,33 +781,7 @@ static void emu1010_firmware_work(struct work_struct *work)snd_emu1010_fpga_read (emu,EMU_HANA_OPTION_CARDS , ®);/* OPTIONS: Which cards are attached to the EMU */ if (reg &EMU_HANA_OPTION_DOCK_OFFLINE ) {/* Audio Dock attached */ -/* Return to Audio Dock programming mode */ -dev_info (emu->card->dev, -"emu1010: Loading Audio Dock Firmware\n" ); -snd_emu1010_fpga_write (emu,EMU_HANA_FPGA_CONFIG , -EMU_HANA_FPGA_CONFIG_AUDIODOCK ); - err =snd_emu1010_load_firmware (emu,1 , &emu->dock_fw); -if (err <0 ) -return ; -snd_emu1010_fpga_write (emu,EMU_HANA_FPGA_CONFIG ,0 ); -snd_emu1010_fpga_read (emu,EMU_HANA_ID , &tmp); -dev_info (emu->card->dev, -"emu1010: EMU_HANA+DOCK_ID = 0x%x\n" , tmp); -if ((tmp &0x1f ) !=0x15 ) { -/* FPGA failed to be programmed */ -dev_info (emu->card->dev, -"emu1010: Loading Audio Dock Firmware file failed, reg = 0x%x\n" , - tmp); -return ; - } -dev_info (emu->card->dev, -"emu1010: Audio Dock Firmware loaded\n" ); -snd_emu1010_fpga_read (emu,EMU_DOCK_MAJOR_REV , &tmp); -snd_emu1010_fpga_read (emu,EMU_DOCK_MINOR_REV , &tmp2); -dev_info (emu->card->dev,"Audio Dock ver: %u.%u\n" , tmp, tmp2); -/* Sync clocking between 1010 and Dock */ -/* Allow DLL to settle */ -msleep (10 ); +snd_emu1010_load_dock_firmware (emu);/* Unmute all. Default is muted after a firmware load */ snd_emu1010_fpga_write (emu,EMU_HANA_UNMUTE ,EMU_UNMUTE ); }else if (!(reg &EMU_HANA_OPTION_DOCK_ONLINE )) {
@@ -892,7 +898,7 @@ static int snd_emu10k1_emu1010_init(struct snd_emu10k1 *emu)snd_emu1010_fpga_read (emu,EMU_HANA_OPTION_CARDS , ®);dev_info (emu->card->dev,"emu1010: Card options = 0x%x\n" , reg);if (reg &EMU_HANA_OPTION_DOCK_OFFLINE ) -schedule_work (&emu->emu1010.firmware_work); +snd_emu1010_load_dock_firmware (emu);if (emu->card_capabilities->no_adat) { emu->emu1010.optical_in =0 ;/* IN_SPDIF */ emu->emu1010.optical_out =0 ;/* OUT_SPDIF */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 55/336 ALSA: emu10k1: move the whole GPIO event handling to the workqueue
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oswald Buddenhagen <[email protected]>
[ Upstream commit f848337cd801c7106a4ec0d61765771dab2a5909 ]
The actual event processing was already done by workqueue items. We can move the event dispatching there as well, rather than doing it already in the interrupt handler callback.
This change has a rather profound "side effect" on the reliability of the FPGA programming: once we enter programming mode, we must not issue any snd_emu1010_fpga_{read,write}() calls until we're done, as these would badly mess up the programming protocol. But exactly that would happen when trying to program the dock, as that triggers GPIO interrupts as a side effect. This is mitigated by deferring the actual interrupt handling, as workqueue items are not re-entrant.
To avoid scheduling the dispatcher on non-events, we now explicitly ignore GPIO IRQs triggered by "uninteresting" pins, which happens a lot as a side effect of calling snd_emu1010_fpga_{read,write}().
Message-ID: <[email protected]>
--- include/sound/emu10k1.h | 3 +- sound/pci/emu10k1/emu10k1.c | 3 +- sound/pci/emu10k1/emu10k1_main.c | 56 ++++++++++++++++---------------- 3 files changed, 30 insertions(+), 32 deletions(-)
include/sound/emu10k1.h +1 -2
@@ -1684,8 +1684,7 @@ struct snd_emu1010 {unsigned int clock_fallback;unsigned int optical_in;/* 0:SPDIF, 1:ADAT */ unsigned int optical_out;/* 0:SPDIF, 1:ADAT */ -struct work_struct firmware_work; -struct work_struct clock_work; +struct work_struct work; };struct snd_emu10k1 {
sound/pci/emu10k1/emu10k1.c +1 -2
@@ -189,8 +189,7 @@ static int snd_emu10k1_suspend(struct device *dev) emu->suspend =1 ; -cancel_work_sync (&emu->emu1010.firmware_work); -cancel_work_sync (&emu->emu1010.clock_work); +cancel_work_sync (&emu->emu1010.work);snd_ac97_suspend (emu->ac97);
sound/pci/emu10k1/emu10k1_main.c +28 -28
102 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 56/336 ALSA: emu10k1: fix E-MU dock initialization
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oswald Buddenhagen <[email protected]>
[ Upstream commit e8289fd3fa65d60cf04dab6f7845eda352c04ea6 ]
A side effect of making the dock monitoring interrupt-driven was that we'd be very quick to program a freshly connected dock. However, for unclear reasons, the dock does not work when we do that - despite the FPGA netlist upload going just fine. We work around this by adding a delay before programming the dock; for safety, the value is several times as much as was determined empirically.
Note that a badly timed dock hot-plug would have triggered the problem even before the referenced commit - but now it would happen 100% instead of about 3% of the time, thus making it impossible to work around by re-plugging.
Message-ID: <[email protected]>
--- sound/pci/emu10k1/emu10k1_main.c | 6 ++++++ 1 file changed, 6 insertions(+)
sound/pci/emu10k1/emu10k1_main.c +6 -0
@@ -737,6 +737,12 @@ static void snd_emu1010_load_dock_firmware(struct snd_emu10k1 *emu)u32 tmp, tmp2;int err; +// The docking events clearly arrive prematurely - while the +// Dock's FPGA seems to be successfully programmed, the Dock +// fails to initialize subsequently if we don't give it some +// time to "warm up" here. +msleep (200 ); +dev_info (emu->card->dev,"emu1010: Loading Audio Dock Firmware\n" );/* Return to Audio Dock programming mode */ snd_emu1010_fpga_write(emu, EMU_HANA_FPGA_CONFIG,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 57/336 net: qede: sanitize rc in qede_add_tc_flower_fltr()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Asbjørn Sloth Tønnesen <[email protected]>
[ Upstream commit e25714466abd9d96901b15efddf82c60a38abd86 ]
Explicitly set 'rc' (return code), before jumping to the unlock and return path.
By not having any code depend on that 'rc' remains at it's initial value of -EINVAL, then we can re-use 'rc' for the return code of function calls in subsequent patches.
Only compile tested.
Stable-dep-of: fcee2065a178 ("net: qede: use return from qede_parse_flow_attr() for flower")
--- drivers/net/ethernet/qlogic/qede/qede_filter.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/net/ethernet/qlogic/qede/qede_filter.c +8 -3
@@ -1868,8 +1868,8 @@ int qede_add_tc_flower_fltr(struct qede_dev *edev, __be16 proto, struct flow_cls_offload *f) {struct qede_arfs_fltr_node *n; -int min_hlen, rc = -EINVAL ;struct qede_arfs_tuple t; +int min_hlen, rc;__qede_lock (edev);
@@ -1879,8 +1879,10 @@ int qede_add_tc_flower_fltr(struct qede_dev *edev, __be16 proto, }/* parse flower attribute and prepare filter */ -if (qede_parse_flow_attr (edev, proto, f->rule, &t)) +if (qede_parse_flow_attr (edev, proto, f->rule, &t)) { + rc = -EINVAL ; goto unlock; + }/* Validate profile mode and number of filters */ if ((edev->arfs->filter_count && edev->arfs->mode != t.mode) ||
@@ -1888,12 +1890,15 @@ int qede_add_tc_flower_fltr(struct qede_dev *edev, __be16 proto,DP_NOTICE (edev,"Filter configuration invalidated, filter mode=0x%x, configured mode=0x%x, filter count=0x%x\n" , t.mode, edev->arfs->mode, edev->arfs->filter_count); + rc = -EINVAL ; goto unlock; }/* parse tc actions and get the vf_id */ -if (qede_parse_actions (edev, &f->rule->action, f->common.extack)) +if (qede_parse_actions (edev, &f->rule->action, f->common.extack)) { + rc = -EINVAL ; goto unlock; + }if (qede_flow_find_fltr (edev, &t)) { rc = -EEXIST ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 58/336 net: qede: use return from qede_parse_flow_attr() for flower
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Asbjørn Sloth Tønnesen <[email protected]>
[ Upstream commit fcee2065a178f78be6fd516302830378b17dba3d ]
In qede_add_tc_flower_fltr(), when callingqede_parse_flow_attr() then the return code
was only used for a non-zero check, and then-EINVAL was returned.
qede_parse_flow_attr() can currently fail with:
* -EINVAL
* -EOPNOTSUPP
* -EPROTONOSUPPORT
This patch changes the code to use the actual
return code, not just return -EINVAL.
The blaimed commit introduced these functions.
Only compile tested.
--- drivers/net/ethernet/qlogic/qede/qede_filter.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/net/ethernet/qlogic/qede/qede_filter.c +2 -3
@@ -1879,10 +1879,9 @@ int qede_add_tc_flower_fltr(struct qede_dev *edev, __be16 proto, }/* parse flower attribute and prepare filter */ -if (qede_parse_flow_attr (edev, proto, f->rule, &t)) { - rc = -EINVAL ; + rc =qede_parse_flow_attr (edev, proto, f->rule, &t); +if (rc) goto unlock; - }/* Validate profile mode and number of filters */ if ((edev->arfs->filter_count && edev->arfs->mode != t.mode) ||
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 59/336 net: qede: use return from qede_parse_flow_attr() for flow_spec
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Asbjørn Sloth Tønnesen <[email protected]>
[ Upstream commit 27b44414a34b108c5a37cd5b4894f606061d86e7 ]
In qede_flow_spec_to_rule(), when callingqede_parse_flow_attr() then the return code
was only used for a non-zero check, and then-EINVAL was returned.
qede_parse_flow_attr() can currently fail with:
* -EINVAL
* -EOPNOTSUPP
* -EPROTONOSUPPORT
This patch changes the code to use the actual
return code, not just return -EINVAL.
The blaimed commit introduced qede_flow_spec_to_rule(), and this call to qede_parse_flow_attr(), it looks like it just duplicated how it was already used.
Only compile tested.
--- drivers/net/ethernet/qlogic/qede/qede_filter.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/net/ethernet/qlogic/qede/qede_filter.c +2 -3
@@ -2002,10 +2002,9 @@ static int qede_flow_spec_to_rule(struct qede_dev *edev,if (IS_ERR (flow))return PTR_ERR (flow); -if (qede_parse_flow_attr (edev, proto, flow->rule, t)) { - err = -EINVAL ; + err =qede_parse_flow_attr (edev, proto, flow->rule, t); +if (err) goto err_out; - }/* Make sure location is valid and filter isn't already set */ err = qede_flow_spec_validate(edev, &flow->rule->action, t,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 60/336 net: qede: use return from qede_parse_actions()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Asbjørn Sloth Tønnesen <[email protected]>
[ Upstream commit f26f719a36e56381a1f4230e5364e7ad4d485888 ]
When calling qede_parse_actions() then the
return code was only used for a non-zero check,
and then -EINVAL was returned.
qede_parse_actions() can currently fail with:
* -EINVAL
* -EOPNOTSUPP
This patch changes the code to use the actual
return code, not just return -EINVAL.
The blaimed commit broke the implicit assumption
that only -EINVAL would ever be returned.
Only compile tested.
--- drivers/net/ethernet/qlogic/qede/qede_filter.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/net/ethernet/qlogic/qede/qede_filter.c +2 -3
@@ -1894,10 +1894,9 @@ int qede_add_tc_flower_fltr(struct qede_dev *edev, __be16 proto, }/* parse tc actions and get the vf_id */ -if (qede_parse_actions (edev, &f->rule->action, f->common.extack)) { - rc = -EINVAL ; + rc =qede_parse_actions (edev, &f->rule->action, f->common.extack); +if (rc) goto unlock; - }if (qede_flow_find_fltr (edev, &t)) { rc = -EEXIST ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 61/336 vxlan: Fix racy device stats updates.
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Nault <[email protected]>
[ Upstream commit 6dee402daba4eb8677a9438ebdcd8fe90ddd4326 ]
VXLAN devices update their stats locklessly. Therefore these counters should either be stored in per-cpu data structures or the updates should be done using atomic increments.
Since the net_device_core_stats infrastructure is already used in vxlan_rcv(), use it for the other rx_dropped and tx_dropped counter updates. Update the other counters atomically using DEV_STATS_INC().
--- drivers/net/vxlan/vxlan_core.c | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-)
drivers/net/vxlan/vxlan_core.c +14 -14
@@ -1766,8 +1766,8 @@ static int vxlan_rcv(struct sock *sk, struct sk_buff *skb)skb_reset_network_header (skb);if (!vxlan_ecn_decapsulate (vs, oiph, skb)) { - ++vxlan->dev->stats.rx_frame_errors; - ++vxlan->dev->stats.rx_errors; +DEV_STATS_INC (vxlan->dev, rx_frame_errors); +DEV_STATS_INC (vxlan->dev, rx_errors);vxlan_vnifilter_count (vxlan, vni, vninode,VXLAN_VNI_STATS_RX_ERRORS ,0 ); goto drop;
@@ -1837,7 +1837,7 @@ static int arp_reduce(struct net_device *dev, struct sk_buff *skb, __be32 vni) goto out;if (!pskb_may_pull (skb,arp_hdr_len (dev))) { - dev->stats.tx_dropped++; +dev_core_stats_tx_dropped_inc (dev); goto out; } parp =arp_hdr (skb);
@@ -1893,7 +1893,7 @@ static int arp_reduce(struct net_device *dev, struct sk_buff *skb, __be32 vni) reply->pkt_type =PACKET_HOST ;if (netif_rx (reply) ==NET_RX_DROP ) { - dev->stats.rx_dropped++; +dev_core_stats_rx_dropped_inc (dev);vxlan_vnifilter_count (vxlan, vni,NULL ,VXLAN_VNI_STATS_RX_DROPS ,0 ); }
@@ -2052,7 +2052,7 @@ static int neigh_reduce(struct net_device *dev, struct sk_buff *skb, __be32 vni) goto out;if (netif_rx (reply) ==NET_RX_DROP ) { - dev->stats.rx_dropped++; +dev_core_stats_rx_dropped_inc (dev);vxlan_vnifilter_count (vxlan, vni,NULL ,VXLAN_VNI_STATS_RX_DROPS ,0 ); }
@@ -2263,7 +2263,7 @@ static void vxlan_encap_bypass(struct sk_buff *skb, struct vxlan_dev *src_vxlan, len); }else { drop: - dev->stats.rx_dropped++; +dev_core_stats_rx_dropped_inc (dev);vxlan_vnifilter_count (dst_vxlan, vni,NULL ,VXLAN_VNI_STATS_RX_DROPS ,0 ); }
@@ -2295,7 +2295,7 @@ static int encap_bypass_if_local(struct sk_buff *skb, struct net_device *dev, addr_family, dst_port, vxlan->cfg.flags);if (!dst_vxlan) { - dev->stats.tx_errors++; +DEV_STATS_INC (dev, tx_errors);vxlan_vnifilter_count (vxlan, vni,NULL ,VXLAN_VNI_STATS_TX_ERRORS ,0 );kfree_skb (skb);
@@ -2559,7 +2559,7 @@ void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,return ; drop: - dev->stats.tx_dropped++; +dev_core_stats_tx_dropped_inc (dev);vxlan_vnifilter_count (vxlan, vni,NULL ,VXLAN_VNI_STATS_TX_DROPS ,0 );dev_kfree_skb (skb);return ;
@@ -2567,11 +2567,11 @@ void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev, tx_error:rcu_read_unlock ();if (err == -ELOOP ) - dev->stats.collisions++; +DEV_STATS_INC (dev, collisions);else if (err == -ENETUNREACH ) - dev->stats.tx_carrier_errors++; +DEV_STATS_INC (dev, tx_carrier_errors);dst_release (ndst); - dev->stats.tx_errors++; +DEV_STATS_INC (dev, tx_errors);vxlan_vnifilter_count (vxlan, vni,NULL ,VXLAN_VNI_STATS_TX_ERRORS ,0 );kfree_skb (skb); }
@@ -2604,7 +2604,7 @@ static void vxlan_xmit_nh(struct sk_buff *skb, struct net_device *dev,return ; drop: - dev->stats.tx_dropped++; +dev_core_stats_tx_dropped_inc (dev);vxlan_vnifilter_count (netdev_priv (dev), vni,NULL ,VXLAN_VNI_STATS_TX_DROPS ,0 );dev_kfree_skb (skb);
@@ -2642,7 +2642,7 @@ static netdev_tx_t vxlan_xmit_nhid(struct sk_buff *skb, struct net_device *dev,return NETDEV_TX_OK ; drop: - dev->stats.tx_dropped++; +dev_core_stats_tx_dropped_inc (dev);vxlan_vnifilter_count (netdev_priv (dev), vni,NULL ,VXLAN_VNI_STATS_TX_DROPS ,0 );dev_kfree_skb (skb);
@@ -2739,7 +2739,7 @@ static netdev_tx_t vxlan_xmit(struct sk_buff *skb, struct net_device *dev) !is_multicast_ether_addr(eth->h_dest))vxlan_fdb_miss (vxlan, eth->h_dest); - dev->stats.tx_dropped++; +dev_core_stats_tx_dropped_inc (dev);vxlan_vnifilter_count (vxlan, vni,NULL ,VXLAN_VNI_STATS_TX_DROPS ,0 );kfree_skb (skb);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 62/336 vxlan: Add missing VNI filter counter update in arp_reduce().
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Nault <[email protected]>
[ Upstream commit b22ea4ef4c3438817fcb604255b55b0058ed8c64 ]
VXLAN stores per-VNI statistics using vxlan_vnifilter_count(). These statistics were not updated when arp_reduce() failed its pskb_may_pull() call.
Use vxlan_vnifilter_count() to update the VNI counter when that happens.
--- drivers/net/vxlan/vxlan_core.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/vxlan/vxlan_core.c +2 -0
@@ -1838,6 +1838,8 @@ static int arp_reduce(struct net_device *dev, struct sk_buff *skb, __be32 vni)if (!pskb_may_pull (skb,arp_hdr_len (dev))) {dev_core_stats_tx_dropped_inc (dev); +vxlan_vnifilter_count (vxlan, vni,NULL , +VXLAN_VNI_STATS_TX_DROPS ,0 ); goto out; } parp =arp_hdr (skb);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 63/336 ASoC: meson: axg-fifo: use FIELD helpers
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <[email protected]>
[ Upstream commit 9e6f39535c794adea6ba802a52c722d193c28124 ]
Use FIELD_GET() and FIELD_PREP() helpers instead of doing it manually.
Stable-dep-of: b11d26660dff ("ASoC: meson: axg-fifo: use threaded irq to check periods")
--- sound/soc/meson/axg-fifo.c | 25 +++++++++++++------------ sound/soc/meson/axg-fifo.h | 12 +++++------- sound/soc/meson/axg-frddr.c | 5 +++-- sound/soc/meson/axg-toddr.c | 22 ++++++++++------------ 4 files changed, 31 insertions(+), 33 deletions(-)
sound/soc/meson/axg-fifo.c +13 -12
@@ -3,6 +3,7 @@// Copyright (c) 2018 BayLibre, SAS. // Author: Jerome Brunet <[email protected]> +#include <linux/bitfield.h> #include <linux/clk.h> #include <linux/of_irq.h> #include <linux/of_platform.h>
@@ -145,8 +146,8 @@ int axg_fifo_pcm_hw_params(struct snd_soc_component *component,/* Enable irq if necessary */ irq_en = runtime->no_period_wakeup ?0 :FIFO_INT_COUNT_REPEAT ;regmap_update_bits (fifo->map,FIFO_CTRL0 , -CTRL0_INT_EN (FIFO_INT_COUNT_REPEAT ), -CTRL0_INT_EN (irq_en)); +CTRL0_INT_EN , +FIELD_PREP (CTRL0_INT_EN , irq_en));return 0 ; }
@@ -176,9 +177,9 @@ int axg_fifo_pcm_hw_free(struct snd_soc_component *component, {struct axg_fifo *fifo =axg_fifo_data (ss); -/* Disable the block count irq */ +/* Disable irqs */ regmap_update_bits (fifo->map,FIFO_CTRL0 , -CTRL0_INT_EN (FIFO_INT_COUNT_REPEAT ),0 ); +CTRL0_INT_EN ,0 );return 0 ; }
@@ -187,13 +188,13 @@ EXPORT_SYMBOL_GPL(axg_fifo_pcm_hw_free);static void axg_fifo_ack_irq (struct axg_fifo *fifo,u8 mask) {regmap_update_bits (fifo->map,FIFO_CTRL1 , -CTRL1_INT_CLR (FIFO_INT_MASK ), -CTRL1_INT_CLR (mask)); +CTRL1_INT_CLR , +FIELD_PREP (CTRL1_INT_CLR , mask));/* Clear must also be cleared */ regmap_update_bits (fifo->map,FIFO_CTRL1 , -CTRL1_INT_CLR (FIFO_INT_MASK ), -0 ); +CTRL1_INT_CLR , +FIELD_PREP (CTRL1_INT_CLR ,0 )); }static irqreturn_t axg_fifo_pcm_irq_block (int irq,void *dev_id)
@@ -204,7 +205,7 @@ static irqreturn_t axg_fifo_pcm_irq_block(int irq, void *dev_id)regmap_read (fifo->map,FIFO_STATUS1 , &status); - status =STATUS1_INT_STS (status) &FIFO_INT_MASK ; + status =FIELD_GET (STATUS1_INT_STS , status);if (status &FIFO_INT_COUNT_REPEAT )snd_pcm_period_elapsed (ss);else
@@ -254,15 +255,15 @@ int axg_fifo_pcm_open(struct snd_soc_component *component,/* Setup status2 so it reports the memory pointer */ regmap_update_bits (fifo->map,FIFO_CTRL1 , -CTRL1_STATUS2_SEL_MASK , -CTRL1_STATUS2_SEL (STATUS2_SEL_DDR_READ )); +CTRL1_STATUS2_SEL , +FIELD_PREP (CTRL1_STATUS2_SEL ,STATUS2_SEL_DDR_READ ));/* Make sure the dma is initially disabled */ __dma_enable (fifo, false);/* Disable irqs until params are ready */ regmap_update_bits (fifo->map,FIFO_CTRL0 , -CTRL0_INT_EN (FIFO_INT_MASK ),0 ); +CTRL0_INT_EN ,0 );/* Clear any pending interrupt */ axg_fifo_ack_irq (fifo,FIFO_INT_MASK );
sound/soc/meson/axg-fifo.h +5 -7
@@ -42,21 +42,19 @@ struct snd_soc_pcm_runtime;#define FIFO_CTRL0 0x00#define CTRL0_DMA_EN BIT(31) -#define CTRL0_INT_EN (x) ((x) << 16) +#define CTRL0_INT_EN GENMASK(23, 16)#define CTRL0_SEL_MASK GENMASK(2, 0)#define CTRL0_SEL_SHIFT 0#define FIFO_CTRL1 0x04 -#define CTRL1_INT_CLR (x) ((x) << 0) -#define CTRL1_STATUS2_SEL_MASK GENMASK(11, 8) -#define CTRL1_STATUS2_SEL (x) ((x) << 8) +#define CTRL1_INT_CLR GENMASK(7, 0) +#define CTRL1_STATUS2_SEL GENMASK(11, 8)#define STATUS2_SEL_DDR_READ 0 -#define CTRL1_FRDDR_DEPTH_MASK GENMASK(31, 24) -#define CTRL1_FRDDR_DEPTH (x) ((x) << 24) +#define CTRL1_FRDDR_DEPTH GENMASK(31, 24)#define FIFO_START_ADDR 0x08#define FIFO_FINISH_ADDR 0x0c#define FIFO_INT_ADDR 0x10#define FIFO_STATUS1 0x14 -#define STATUS1_INT_STS (x) ((x) << 0) +#define STATUS1_INT_STS GENMASK(7, 0)#define FIFO_STATUS2 0x18#define FIFO_INIT_ADDR 0x24#define FIFO_CTRL2 0x28
sound/soc/meson/axg-frddr.c +3 -2
@@ -7,6 +7,7 @@* This driver implements the frontend playback DAI of AXG and G12A based SoCs */ +#include <linux/bitfield.h> #include <linux/clk.h> #include <linux/regmap.h> #include <linux/module.h>
@@ -59,8 +60,8 @@ static int axg_frddr_dai_hw_params(struct snd_pcm_substream *substream,/* Trim the FIFO depth if the period is small to improve latency */ depth =min (period, fifo->depth); val = (depth /AXG_FIFO_BURST ) -1 ; -regmap_update_bits (fifo->map,FIFO_CTRL1 ,CTRL1_FRDDR_DEPTH_MASK , -CTRL1_FRDDR_DEPTH (val)); +regmap_update_bits (fifo->map,FIFO_CTRL1 ,CTRL1_FRDDR_DEPTH , +FIELD_PREP (CTRL1_FRDDR_DEPTH , val));return 0 ; }
sound/soc/meson/axg-toddr.c +10 -12
@@ -5,6 +5,7 @@/* This driver implements the frontend capture DAI of AXG based SoCs */ +#include <linux/bitfield.h> #include <linux/clk.h> #include <linux/regmap.h> #include <linux/module.h>
@@ -19,12 +20,9 @@#define CTRL0_TODDR_EXT_SIGNED BIT(29)#define CTRL0_TODDR_PP_MODE BIT(28)#define CTRL0_TODDR_SYNC_CH BIT(27) -#define CTRL0_TODDR_TYPE_MASK GENMASK(15, 13) -#define CTRL0_TODDR_TYPE (x) ((x) << 13) -#define CTRL0_TODDR_MSB_POS_MASK GENMASK(12, 8) -#define CTRL0_TODDR_MSB_POS (x) ((x) << 8) -#define CTRL0_TODDR_LSB_POS_MASK GENMASK(7, 3) -#define CTRL0_TODDR_LSB_POS (x) ((x) << 3) +#define CTRL0_TODDR_TYPE GENMASK(15, 13) +#define CTRL0_TODDR_MSB_POS GENMASK(12, 8) +#define CTRL0_TODDR_LSB_POS GENMASK(7, 3)#define CTRL1_TODDR_FORCE_FINISH BIT(25)#define CTRL1_SEL_SHIFT 28
@@ -76,12 +74,12 @@ static int axg_toddr_dai_hw_params(struct snd_pcm_substream *substream, width =params_width (params);regmap_update_bits (fifo->map,FIFO_CTRL0 , -CTRL0_TODDR_TYPE_MASK | -CTRL0_TODDR_MSB_POS_MASK | -CTRL0_TODDR_LSB_POS_MASK , -CTRL0_TODDR_TYPE (type) | -CTRL0_TODDR_MSB_POS (TODDR_MSB_POS ) | -CTRL0_TODDR_LSB_POS (TODDR_MSB_POS - (width -1 ))); +CTRL0_TODDR_TYPE | +CTRL0_TODDR_MSB_POS | +CTRL0_TODDR_LSB_POS , +FIELD_PREP (CTRL0_TODDR_TYPE , type) | +FIELD_PREP (CTRL0_TODDR_MSB_POS ,TODDR_MSB_POS ) | +FIELD_PREP (CTRL0_TODDR_LSB_POS ,TODDR_MSB_POS - (width -1 )));return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 64/336 ASoC: meson: axg-fifo: use threaded irq to check periods
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <[email protected]>
[ Upstream commit b11d26660dff8d7430892008616452dc8e5fb0f3 ]
With the AXG audio subsystem, there is a possible random channel shift on TDM capture, when the slot number per lane is more than 2, and there is more than one lane used.
The problem has been there since the introduction of the axg audio support but such scenario is pretty uncommon. This is why there is no loud complains about the problem.
Solving the problem require to make the links non-atomic and use the trigger() callback to start FEs and BEs in the appropriate order.
This was tried in the past and reverted because it caused the block irq to sleep while atomic. However, instead of reverting, the solution is to call snd_pcm_period_elapsed() in a non atomic context.
Use the bottom half of a threaded IRQ to do so.
--- sound/soc/meson/axg-fifo.c | 29 +++++++++++++++++++---------- 1 file changed, 19 insertions(+), 10 deletions(-)
sound/soc/meson/axg-fifo.c +19 -10
@@ -204,18 +204,26 @@ static irqreturn_t axg_fifo_pcm_irq_block(int irq, void *dev_id)unsigned int status;regmap_read (fifo->map,FIFO_STATUS1 , &status); - status =FIELD_GET (STATUS1_INT_STS , status); +axg_fifo_ack_irq (fifo, status); + +/* Use the thread to call period elapsed on nonatomic links */ if (status &FIFO_INT_COUNT_REPEAT ) -snd_pcm_period_elapsed (ss); -else -dev_dbg (axg_fifo_dev (ss),"unexpected irq - STS 0x%02x\n" , - status); +return IRQ_WAKE_THREAD ; -/* Ack irqs */ -axg_fifo_ack_irq (fifo, status); +dev_dbg (axg_fifo_dev (ss),"unexpected irq - STS 0x%02x\n" , + status); + +return IRQ_NONE ; +} + +static irqreturn_t axg_fifo_pcm_irq_block_thread (int irq,void *dev_id) +{ +struct snd_pcm_substream *ss = dev_id; + +snd_pcm_period_elapsed (ss); -return IRQ_RETVAL (status); +return IRQ_HANDLED ; } int axg_fifo_pcm_open(struct snd_soc_component *component,
@@ -243,8 +251,9 @@ int axg_fifo_pcm_open(struct snd_soc_component *component,if (ret)return ret; - ret =request_irq (fifo->irq, axg_fifo_pcm_irq_block,0 , -dev_name (dev), ss); + ret =request_threaded_irq (fifo->irq, axg_fifo_pcm_irq_block, + axg_fifo_pcm_irq_block_thread, +IRQF_ONESHOT ,dev_name (dev), ss);if (ret)return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 65/336 ASoC: meson: axg-card: make links nonatomic
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <[email protected]>
[ Upstream commit dcba52ace7d4c12e2c8c273eff55ea03a84c8baf ]
Non atomic operations need to be performed in the trigger callback of the TDM interfaces. Those are BEs but what matters is the nonatomic flag of the FE in the DPCM context. Just set nonatomic for everything so, at least, what is done is clear.
--- sound/soc/meson/axg-card.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/meson/axg-card.c +1 -0
@@ -318,6 +318,7 @@ static int axg_card_add_link(struct snd_soc_card *card, struct device_node *np, dai_link->cpus = cpu; dai_link->num_cpus =1 ; + dai_link->nonatomic = true; ret =meson_card_parse_dai (card, np, dai_link->cpus);if (ret)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 66/336 ASoC: meson: axg-tdm-interface: manage formatters in trigger
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <[email protected]>
[ Upstream commit f949ed458ad15a00d41b37c745ebadaef171aaae ]
So far, the formatters have been reset/enabled using the .prepare() callback. This was done in this callback because walking the formatters use a mutex. A mutex is used because formatter handling require dealing possibly slow clock operation.
With the support of non-atomic, .trigger() callback may be used which also allows to properly enable and disable formatters on start but also pause/resume.
This solve a random shift on TDMIN as well repeated samples on for TDMOUT.
--- sound/soc/meson/axg-tdm-interface.c | 34 ++++++++++++++++------------- 1 file changed, 19 insertions(+), 15 deletions(-)
sound/soc/meson/axg-tdm-interface.c +19 -15
@@ -349,26 +349,31 @@ static int axg_tdm_iface_hw_params(struct snd_pcm_substream *substream,return 0 ; } -static int axg_tdm_iface_hw_free (struct snd_pcm_substream *substream, +static int axg_tdm_iface_trigger (struct snd_pcm_substream *substream, +int cmd,struct snd_soc_dai *dai) { -struct axg_tdm_stream *ts =snd_soc_dai_get_dma_data (dai, substream); +struct axg_tdm_stream *ts = +snd_soc_dai_get_dma_data (dai, substream); -/* Stop all attached formatters */ -axg_tdm_stream_stop (ts); +switch (cmd) { +case SNDRV_PCM_TRIGGER_START : +case SNDRV_PCM_TRIGGER_RESUME : +case SNDRV_PCM_TRIGGER_PAUSE_RELEASE : +axg_tdm_stream_start (ts); +break ; +case SNDRV_PCM_TRIGGER_SUSPEND : +case SNDRV_PCM_TRIGGER_PAUSE_PUSH : +case SNDRV_PCM_TRIGGER_STOP : +axg_tdm_stream_stop (ts); +break ; +default : +return -EINVAL ; + }return 0 ; } -static int axg_tdm_iface_prepare (struct snd_pcm_substream *substream, -struct snd_soc_dai *dai) -{ -struct axg_tdm_stream *ts =snd_soc_dai_get_dma_data (dai, substream); - -/* Force all attached formatters to update */ -return axg_tdm_stream_reset (ts); -} -static int axg_tdm_iface_remove_dai (struct snd_soc_dai *dai) {int stream;
@@ -412,8 +417,7 @@ static const struct snd_soc_dai_ops axg_tdm_iface_ops = { .set_fmt = axg_tdm_iface_set_fmt, .startup = axg_tdm_iface_startup, .hw_params = axg_tdm_iface_hw_params, - .prepare = axg_tdm_iface_prepare, - .hw_free = axg_tdm_iface_hw_free, + .trigger = axg_tdm_iface_trigger, };/* TDM Backend DAIs */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 67/336 ASoC: meson: cards: select SND_DYNAMIC_MINORS
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <[email protected]>
[ Upstream commit 6db26f9ea4edd8a17d39ab3c20111e3ccd704aef ]
Amlogic sound cards do create a lot of pcm interfaces, possibly more than
8. Some pcm interfaces are internal (like DPCM backends and c2c) and not exposed to userspace.
Those interfaces still increase the number passed to snd_find_free_minor(), which eventually exceeds 8 causing -EBUSY error on card registration if CONFIG_SND_DYNAMIC_MINORS=n and the interface is exposed to userspace.
select CONFIG_SND_DYNAMIC_MINORS for Amlogic cards to avoid the problem.
--- sound/soc/meson/Kconfig | 1 + 1 file changed, 1 insertion(+)
sound/soc/meson/Kconfig +1 -0
@@ -99,6 +99,7 @@ config SND_MESON_AXG_PDM config SND_MESON_CARD_UTILS tristate + select SND_DYNAMIC_MINORS config SND_MESON_CODEC_GLUE tristate
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 68/336 ALSA: hda: intel-sdw-acpi: fix usage of device_get_named_child_node()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre-Louis Bossart <[email protected]>
[ Upstream commit c158cf914713efc3bcdc25680c7156c48c12ef6a ]
The documentation for device_get_named_child_node() mentions this important point:
"
The caller is responsible for calling fwnode_handle_put() on the returned fwnode pointer.
"
Add fwnode_handle_put() to avoid a leaked reference.
Message-ID: <[email protected]>
--- sound/hda/intel-sdw-acpi.c | 2 ++ 1 file changed, 2 insertions(+)
sound/hda/intel-sdw-acpi.c +2 -0
@@ -41,6 +41,8 @@ static bool is_link_enabled(struct fwnode_handle *fw_node, u8 idx)"intel-quirk-mask" , &quirk_mask); +fwnode_handle_put (link); +if (quirk_mask &SDW_INTEL_QUIRK_MASK_BUS_DISABLE )return false;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 69/336 s390/cio: Ensure the copied buf is NUL terminated
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bui Quang Minh <[email protected]>
[ Upstream commit da7c622cddd4fe36be69ca61e8c42e43cde94784 ]
Currently, we allocate a lbuf-sized kernel buffer and copy lbuf from userspace to that buffer. Later, we use scanf on this buffer but we don't ensure that the string is terminated inside the buffer, this can lead to OOB read when using scanf. Fix this issue by using memdup_user_nul instead.
--- drivers/s390/cio/cio_inject.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/s390/cio/cio_inject.c +1 -1
@@ -95,7 +95,7 @@ static ssize_t crw_inject_write(struct file *file, const char __user *buf,return -EINVAL ; } - buffer =vmemdup_user (buf, lbuf); + buffer =memdup_user_nul (buf, lbuf);if (IS_ERR (buffer))return -ENOMEM ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 70/336 cxgb4: Properly lock TX queue for the selftest.
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <[email protected]>
[ Upstream commit 9067eccdd7849dd120d5495dbd5a686fa6ed2c1a ]
The selftest for the driver sends a dummy packet and checks if the packet will be received properly as it should be. The regular TX path and the selftest can use the same network queue so locking is required and was missing in the selftest path. This was addressed in the commit cited below.
Unfortunately locking the TX queue requires BH to be disabled which is not the case in selftest path which is invoked in process context. Lockdep should be complaining about this.
Use __netif_tx_lock_bh() for TX queue locking.
--- drivers/net/ethernet/chelsio/cxgb4/sge.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/ethernet/chelsio/cxgb4/sge.c +3 -3
@@ -2684,12 +2684,12 @@ int cxgb4_selftest_lb_pkt(struct net_device *netdev) lb->loopback =1 ; q = &adap->sge.ethtxq[pi->first_qset]; -__netif_tx_lock (q->txq,smp_processor_id ()); +__netif_tx_lock_bh (q->txq);reclaim_completed_tx (adap, &q->q,-1 , true); credits =txq_avail (&q->q) - ndesc;if (unlikely (credits <0 )) { -__netif_tx_unlock (q->txq); +__netif_tx_unlock_bh (q->txq);return -ENOMEM ; }
@@ -2724,7 +2724,7 @@ int cxgb4_selftest_lb_pkt(struct net_device *netdev)init_completion (&lb->completion);txq_advance (&q->q, ndesc);cxgb4_ring_tx_db (adap, &q->q, ndesc); -__netif_tx_unlock (q->txq); +__netif_tx_unlock_bh (q->txq);/* wait for the pkt to return */ ret =wait_for_completion_timeout (&lb->completion,10 *HZ );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 71/336 net: dsa: mv88e6xxx: Fix number of databases for 88E6141 / 88E6341
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Behún <[email protected]>
[ Upstream commit b9a61c20179fda7bdfe2c1210aa72451991ab81a ]
The Topaz family (88E6141 and 88E6341) only support 256 Forwarding Information Tables.
--- drivers/net/dsa/mv88e6xxx/chip.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/dsa/mv88e6xxx/chip.c +2 -2
@@ -5702,7 +5702,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = { .prod_num = MV88E6XXX_PORT_SWITCH_ID_PROD_6141, .family = MV88E6XXX_FAMILY_6341, .name = "Marvell 88E6141", - .num_databases = 4096, + .num_databases = 256, .num_macs = 2048, .num_ports = 6, .num_internal_phys = 5,
@@ -6161,7 +6161,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = { .prod_num = MV88E6XXX_PORT_SWITCH_ID_PROD_6341, .family = MV88E6XXX_FAMILY_6341, .name = "Marvell 88E6341", - .num_databases = 4096, + .num_databases = 256, .num_macs = 2048, .num_internal_phys = 5, .num_ports = 6,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 72/336 drm/amdgpu: fix doorbell regression
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shashank Sharma <[email protected]>
[ Upstream commit 705d0480e6ae5a73ca3a9c04316d0678e19a46ed ]
This patch adds a missed handling of PL domain doorbell while handling VRAM faults.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +1 -1
@@ -424,7 +424,7 @@ bool amdgpu_res_cpu_visible(struct amdgpu_device *adev,return false;if (res->mem_type ==TTM_PL_SYSTEM || res->mem_type ==TTM_PL_TT || - res->mem_type ==AMDGPU_PL_PREEMPT ) + res->mem_type ==AMDGPU_PL_PREEMPT || res->mem_type ==AMDGPU_PL_DOORBELL )return true;if (res->mem_type !=TTM_PL_VRAM )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 73/336 spi: fix null pointer dereference within spi_sync
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mans Rullgard <[email protected]>
[ Upstream commit 4756fa529b2f12b7cb8f21fe229b0f6f47190829 ]
If spi_sync() is called with the non-empty queue and the same spi_message is then reused, the complete callback for the message remains set while the context is cleared, leading to a null pointer dereference when the callback is invoked from spi_finalize_current_message().
With function inlining disabled, the call stack might look like this:
_raw_spin_lock_irqsave from complete_with_flags+0x18/0x58 complete_with_flags from spi_complete+0x8/0xc
spi_complete from spi_finalize_current_message+0xec/0x184 spi_finalize_current_message from spi_transfer_one_message+0x2a8/0x474 spi_transfer_one_message from __spi_pump_transfer_message+0x104/0x230 __spi_pump_transfer_message from __spi_transfer_message_noqueue+0x30/0xc4 __spi_transfer_message_noqueue from __spi_sync+0x204/0x248 __spi_sync from spi_sync+0x24/0x3c
spi_sync from mcp251xfd_regmap_crc_read+0x124/0x28c [mcp251xfd] mcp251xfd_regmap_crc_read [mcp251xfd] from _regmap_raw_read+0xf8/0x154 _regmap_raw_read from _regmap_bus_read+0x44/0x70
_regmap_bus_read from _regmap_read+0x60/0xd8
_regmap_read from regmap_read+0x3c/0x5c
regmap_read from mcp251xfd_alloc_can_err_skb+0x1c/0x54 [mcp251xfd] mcp251xfd_alloc_can_err_skb [mcp251xfd] from mcp251xfd_irq+0x194/0xe70 [mcp251xfd] mcp251xfd_irq [mcp251xfd] from irq_thread_fn+0x1c/0x78
irq_thread_fn from irq_thread+0x118/0x1f4
irq_thread from kthread+0xd8/0xf4
kthread from ret_from_fork+0x14/0x28
Fix this by also setting message->complete to NULL when the transfer is complete.
--- drivers/spi/spi.c | 1 + 1 file changed, 1 insertion(+)
drivers/spi/spi.c +1 -0
@@ -4431,6 +4431,7 @@ static int __spi_sync(struct spi_device *spi, struct spi_message *message)wait_for_completion (&done); status = message->status; } + message->complete =NULL ; message->context =NULL ;return status;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 74/336 net: bridge: fix multicast-to-unicast with fraglist GSO
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <[email protected]>
[ Upstream commit 59c878cbcdd80ed39315573b3511d0acfd3501b5 ]
Calling skb_copy on a SKB_GSO_FRAGLIST skb is not valid, since it returns an invalid linearized skb. This code only needs to change the ethernet header, so pskb_copy is the right function to call here.
--- net/bridge/br_forward.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/bridge/br_forward.c +1 -1
@@ -266,7 +266,7 @@ static void maybe_deliver_addr(struct net_bridge_port *p, struct sk_buff *skb,if (skb->dev == p->dev &ðer_addr_equal (src, addr))return ; - skb =skb_copy (skb,GFP_ATOMIC ); + skb =pskb_copy (skb,GFP_ATOMIC );if (!skb) {DEV_STATS_INC (dev, tx_dropped);return ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 75/336 net: core: reject skb_copy(_expand) for fraglist GSO skbs
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <[email protected]>
[ Upstream commit d091e579b864fa790dd6a0cd537a22c383126681 ]
SKB_GSO_FRAGLIST skbs must not be linearized, otherwise they become invalid. Return NULL if such an skb is passed to skb_copy or skb_copy_expand, in order to prevent a crash on a potential later call to skb_gso_segment.
--- net/core/skbuff.c | 27 +++++++++++++++++++-------- 1 file changed, 19 insertions(+), 8 deletions(-)
net/core/skbuff.c +19 -8
@@ -2014,11 +2014,17 @@ static inline int skb_alloc_rx_flag(const struct sk_buff *skb)struct sk_buff *skb_copy (const struct sk_buff *skb,gfp_t gfp_mask) { -int headerlen =skb_headroom (skb); -unsigned int size =skb_end_offset (skb) + skb->data_len; -struct sk_buff *n =__alloc_skb (size, gfp_mask, -skb_alloc_rx_flag (skb),NUMA_NO_NODE ); +struct sk_buff *n; +unsigned int size; +int headerlen; + +if (WARN_ON_ONCE (skb_shinfo (skb)->gso_type &SKB_GSO_FRAGLIST )) +return NULL ; + headerlen =skb_headroom (skb); + size =skb_end_offset (skb) + skb->data_len; + n =__alloc_skb (size, gfp_mask, +skb_alloc_rx_flag (skb),NUMA_NO_NODE );if (!n)return NULL ;
@@ -2346,12 +2352,17 @@ struct sk_buff *skb_copy_expand(const struct sk_buff *skb,/* * Allocate the copy buffer */ -struct sk_buff *n =__alloc_skb (newheadroom + skb->len + newtailroom, - gfp_mask,skb_alloc_rx_flag (skb), -NUMA_NO_NODE ); -int oldheadroom =skb_headroom (skb);int head_copy_len, head_copy_off; +struct sk_buff *n; +int oldheadroom; + +if (WARN_ON_ONCE (skb_shinfo (skb)->gso_type &SKB_GSO_FRAGLIST )) +return NULL ; + oldheadroom =skb_headroom (skb); + n =__alloc_skb (newheadroom + skb->len + newtailroom, + gfp_mask,skb_alloc_rx_flag (skb), +NUMA_NO_NODE );if (!n)return NULL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 76/336 rxrpc: Clients must accept conn from any address
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeffrey Altman <[email protected]>
[ Upstream commit 8953285d7bd63c12b007432a9b4587fa2fad49fb ]
The find connection logic of Transarc's Rx was modified in the mid-1990s to support multi-homed servers which might send a response packet from an address other than the destination address in the received packet. The rules for accepting a packet by an Rx initiator (RX_CLIENT_CONNECTION) were altered to permit acceptance of a packet from any address provided that the port number was unchanged and all of the connection identifiers matched (Epoch, CID, SecurityClass, ...).
This change applies the same rules to the Linux implementation which makes it consistent with IBM AFS 3.6, Arla, OpenAFS and AuriStorFS.
--- net/rxrpc/conn_object.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-)
net/rxrpc/conn_object.c +2 -7
@@ -118,18 +118,13 @@ struct rxrpc_connection *rxrpc_find_client_connection_rcu(struct rxrpc_local *loswitch (srx->transport.family) {case AF_INET :if (peer->srx.transport.sin.sin_port != - srx->transport.sin.sin_port || - peer->srx.transport.sin.sin_addr.s_addr != - srx->transport.sin.sin_addr.s_addr) + srx->transport.sin.sin_port) goto not_found;break ;#ifdef CONFIG_AF_RXRPC_IPV6 case AF_INET6 :if (peer->srx.transport.sin6.sin6_port != - srx->transport.sin6.sin6_port || -memcmp (&peer->srx.transport.sin6.sin6_addr, - &srx->transport.sin6.sin6_addr, -sizeof (struct in6_addr )) !=0 ) + srx->transport.sin6.sin6_port) goto not_found;break ;#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 77/336 tipc: fix a possible memleak in tipc_buf_append
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit 97bf6f81b29a8efaf5d0983251a7450e5794370d ]
__skb_linearize() doesn't free the skb when it fails, so move '*buf = NULL' after __skb_linearize(), so that the skb can be freed on the err path.
--- net/tipc/msg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/tipc/msg.c +1 -1
@@ -142,9 +142,9 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf)if (fragid ==FIRST_FRAGMENT ) {if (unlikely (head)) goto err; - *buf =NULL ;if (skb_has_frag_list (frag) &&__skb_linearize (frag)) goto err; + *buf =NULL ; frag =skb_unshare (frag,GFP_ATOMIC );if (unlikely (!frag)) goto err;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 78/336 vxlan: Pull inner IP header in vxlan_rcv().
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Nault <[email protected]>
[ Upstream commit f7789419137b18e3847d0cc41afd788c3c00663d ]
Ensure the inner IP header is part of skb's linear data before reading its ECN bits. Otherwise we might read garbage.
One symptom is the system erroneously logging errors like "vxlan: non-ECT from xxx.xxx.xxx.xxx with TOS=xxxx".
Similar bugs have been fixed in geneve, ip_tunnel and ip6_tunnel (see commit 1ca1ba465e55 ("geneve: make sure to pull inner header in geneve_rx()") for example). So let's reuse the same code structure for consistency. Maybe we'll can add a common helper in the future.
--- drivers/net/vxlan/vxlan_core.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-)
drivers/net/vxlan/vxlan_core.c +18 -1
@@ -1674,6 +1674,7 @@ static int vxlan_rcv(struct sock *sk, struct sk_buff *skb)bool raw_proto = false;void *oiph;__be32 vni =0 ; +int nh;/* Need UDP and VXLAN header to be present */ if (!pskb_may_pull (skb,VXLAN_HLEN ))
@@ -1762,9 +1763,25 @@ static int vxlan_rcv(struct sock *sk, struct sk_buff *skb) skb->pkt_type =PACKET_HOST ; } - oiph =skb_network_header (skb); +/* Save offset of outer header relative to skb->head, +* because we are going to reset the network header to the inner header +* and might change skb->head. +*/ + nh =skb_network_header (skb) - skb->head; +skb_reset_network_header (skb); +if (!pskb_inet_may_pull (skb)) { +DEV_STATS_INC (vxlan->dev, rx_length_errors); +DEV_STATS_INC (vxlan->dev, rx_errors); +vxlan_vnifilter_count (vxlan, vni, vninode, +VXLAN_VNI_STATS_RX_ERRORS ,0 ); + goto drop; + } + +/* Get the outer header. */ + oiph = skb->head + nh; +if (!vxlan_ecn_decapsulate (vs, oiph, skb)) {DEV_STATS_INC (vxlan->dev, rx_frame_errors);DEV_STATS_INC (vxlan->dev, rx_errors);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 79/336 s390/qeth: Fix kernel panic after setting hsuid
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandra Winter <[email protected]>
[ Upstream commit 8a2e4d37afb8500b276e5ee903dee06f50ab0494 ]
Symptom:
When the hsuid attribute is set for the first time on an IQD Layer3 device while the corresponding network interface is already UP, the kernel will try to execute a napi function pointer that is NULL.
Example:
---------------------------------------------------------------------------
[ 2057.572696] illegal operation: 0001 ilc:1 [#1] SMP
[ 2057.572702] Modules linked in: af_iucv qeth_l3 zfcp scsi_transport_fc sunrpc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6
nft_reject nft_ct nf_tables_set nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables libcrc32c nfnetlink ghash_s390 prng xts aes_s390 des_s390 de
s_generic sha3_512_s390 sha3_256_s390 sha512_s390 vfio_ccw vfio_mdev mdev vfio_iommu_type1 eadm_sch vfio ext4 mbcache jbd2 qeth_l2 bridge stp llc dasd_eckd_mod qeth dasd_mod
qdio ccwgroup pkey zcrypt
[ 2057.572739] CPU: 6 PID: 60182 Comm: stress_client Kdump: loaded Not tainted 4.18.0-541.el8.s390x #1
[ 2057.572742] Hardware name: IBM 3931 A01 704 (LPAR)
[ 2057.572744] Krnl PSW : 0704f00180000000 0000000000000002 (0x2)
[ 2057.572748] R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:3 PM:0 RI:0 EA:3
[ 2057.572751] Krnl GPRS: 0000000000000004 0000000000000000 00000000a3b008d8 0000000000000000
[ 2057.572754] 00000000a3b008d8 cb923a29c779abc5 0000000000000000 00000000814cfd80
[ 2057.572756] 000000000000012c 0000000000000000 00000000a3b008d8 00000000a3b008d8
[ 2057.572758] 00000000bab6d500 00000000814cfd80 0000000091317e46 00000000814cfc68
[ 2057.572762] Krnl Code:#0000000000000000: 0000 illegal
>0000000000000002: 0000 illegal
0000000000000004: 0000 illegal
0000000000000006: 0000 illegal
0000000000000008: 0000 illegal
000000000000000a: 0000 illegal
000000000000000c: 0000 illegal
000000000000000e: 0000 illegal
[ 2057.572800] Call Trace:
[ 2057.572801] ([<00000000ec639700>] 0xec639700)
[ 2057.572803] [<00000000913183e2>] net_rx_action+0x2ba/0x398
[ 2057.572809] [<0000000091515f76>] __do_softirq+0x11e/0x3a0
[ 2057.572813] [<0000000090ce160c>] do_softirq_own_stack+0x3c/0x58
[ 2057.572817] ([<0000000090d2cbd6>] do_softirq.part.1+0x56/0x60)
[ 2057.572822] [<0000000090d2cc60>] __local_bh_enable_ip+0x80/0x98
[ 2057.572825] [<0000000091314706>] __dev_queue_xmit+0x2be/0xd70
[ 2057.572827] [<000003ff803dd6d6>] afiucv_hs_send+0x24e/0x300 [af_iucv]
[ 2057.572830] [<000003ff803dd88a>] iucv_send_ctrl+0x102/0x138 [af_iucv]
[ 2057.572833] [<000003ff803de72a>] iucv_sock_connect+0x37a/0x468 [af_iucv]
[ 2057.572835] [<00000000912e7e90>] __sys_connect+0xa0/0xd8
[ 2057.572839] [<00000000912e9580>] sys_socketcall+0x228/0x348
[ 2057.572841] [<0000000091514e1a>] system_call+0x2a6/0x2c8
[ 2057.572843] Last Breaking-Event-Address:
[ 2057.572844] [<0000000091317e44>] __napi_poll+0x4c/0x1d8
[ 2057.572846]
[ 2057.572847] Kernel panic - not syncing: Fatal exception in interrupt-------------------------------------------------------------------------------------------
Analysis:
There is one napi structure per out_q: card->qdio.out_qs[i].napi The napi.poll functions are set during qeth_open().
Since
commit 1cfef80d4c2b ("s390/qeth: Don't call dev_close/dev_open (DOWN/UP)") qeth_set_offline()/qeth_set_online() no longer call dev_close()/ dev_open(). So if qeth_free_qdio_queues() cleared card->qdio.out_qs[i].napi.poll while the network interface was UP and the card was offline, they are not set again.
Reproduction:
chzdev -e $devno layer2=0
ip link set dev $network_interface up
echo 0 > /sys/bus/ccwgroup/devices/0.0.$devno/online
echo foo > /sys/bus/ccwgroup/devices/0.0.$devno/hsuid
echo 1 > /sys/bus/ccwgroup/devices/0.0.$devno/online
-> Crash (can be enforced e.g. by af_iucv connect(), ip link down/up, ...)
Note that a Completion Queue (CQ) is only enabled or disabled, when hsuid is set for the first time or when it is removed.
Workarounds:
- Set hsuid before setting the device online for the first time or
- Use chzdev -d $devno; chzdev $devno hsuid=xxx; chzdev -e $devno; to set hsuid on an existing device. (this will remove and recreate the network interface)
Fix:
There is no need to free the output queues when a completion queue is added or removed.card->qdio.state now indicates whether the inbound buffer pool and the outbound queues are allocated.card->qdio.c_q indicates whether a CQ is allocated.
--- drivers/s390/net/qeth_core_main.c | 61 ++++++++++++++----------------- 1 file changed, 27 insertions(+), 34 deletions(-)
drivers/s390/net/qeth_core_main.c +27 -34
@@ -364,30 +364,33 @@ static int qeth_cq_init(struct qeth_card *card)return rc; } +static void qeth_free_cq (struct qeth_card *card) +{ +if (card->qdio.c_q) { +qeth_free_qdio_queue (card->qdio.c_q); + card->qdio.c_q =NULL ; + } +} +static int qeth_alloc_cq (struct qeth_card *card) {if (card->options.cq ==QETH_CQ_ENABLED ) {QETH_CARD_TEXT (card,2 ,"cqon" ); - card->qdio.c_q =qeth_alloc_qdio_queue ();if (!card->qdio.c_q) { -dev_err (&card->gdev->dev,"Failed to create completion queue\n" ); -return -ENOMEM ; + card->qdio.c_q =qeth_alloc_qdio_queue (); +if (!card->qdio.c_q) { +dev_err (&card->gdev->dev, +"Failed to create completion queue\n" ); +return -ENOMEM ; + } } }else {QETH_CARD_TEXT (card,2 ,"nocq" ); - card->qdio.c_q =NULL ; +qeth_free_cq (card); }return 0 ; } -static void qeth_free_cq (struct qeth_card *card) -{ -if (card->qdio.c_q) { -qeth_free_qdio_queue (card->qdio.c_q); - card->qdio.c_q =NULL ; - } -} -static enum iucv_tx_notify qeth_compute_cq_notification (int sbalf15,int delayed) {
@@ -2628,6 +2631,10 @@ static int qeth_alloc_qdio_queues(struct qeth_card *card)QETH_CARD_TEXT (card,2 ,"allcqdbf" ); +/* completion */ +if (qeth_alloc_cq (card)) + goto out_err; +if (atomic_cmpxchg (&card->qdio.state,QETH_QDIO_UNINITIALIZED ,QETH_QDIO_ALLOCATED ) !=QETH_QDIO_UNINITIALIZED )return 0 ;
@@ -2663,10 +2670,6 @@ static int qeth_alloc_qdio_queues(struct qeth_card *card) queue->priority =QETH_QIB_PQUE_PRIO_DEFAULT ; } -/* completion */ -if (qeth_alloc_cq (card)) - goto out_freeoutq; -return 0 ; out_freeoutq:
@@ -2677,6 +2680,8 @@ static int qeth_alloc_qdio_queues(struct qeth_card *card)qeth_free_buffer_pool (card); out_buffer_pool:atomic_set (&card->qdio.state,QETH_QDIO_UNINITIALIZED ); +qeth_free_cq (card); +out_err:return -ENOMEM ; }
@@ -2684,11 +2689,12 @@ static void qeth_free_qdio_queues(struct qeth_card *card) {int i, j; +qeth_free_cq (card); +if (atomic_xchg (&card->qdio.state,QETH_QDIO_UNINITIALIZED ) ==QETH_QDIO_UNINITIALIZED )return ; -qeth_free_cq (card);for (j =0 ; j <QDIO_MAX_BUFFERS_PER_Q ; ++j) {if (card->qdio.in_q->bufs[j].rx_skb) {consume_skb (card->qdio.in_q->bufs[j].rx_skb);
@@ -3742,24 +3748,11 @@ static void qeth_qdio_poll(struct ccw_device *cdev, unsigned long card_ptr)int qeth_configure_cq (struct qeth_card *card,enum qeth_cq cq) { -int rc; - -if (card->options.cq ==QETH_CQ_NOTAVAILABLE ) { - rc =-1 ; - goto out; - }else { -if (card->options.cq == cq) { - rc =0 ; - goto out; - } - -qeth_free_qdio_queues (card); - card->options.cq = cq; - rc =0 ; - } -out: -return rc; +if (card->options.cq ==QETH_CQ_NOTAVAILABLE ) +return -1 ; + card->options.cq = cq; +return 0 ; }EXPORT_SYMBOL_GPL (qeth_configure_cq);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 80/336 drm/panel: ili9341: Correct use of device property APIs
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit d43cd48ef1791801c61a54fade4a88d294dedf77 ]
It seems driver missed the point of proper use of device property APIs. Correct this by updating headers and calls respectively.
--- drivers/gpu/drm/panel/Kconfig | 2 +- drivers/gpu/drm/panel/panel-ilitek-ili9341.c | 5 +++-- 2 files changed, 4 insertions(+), 3 deletions(-)
drivers/gpu/drm/panel/Kconfig +1 -1
@@ -184,7 +184,7 @@ config DRM_PANEL_ILITEK_IL9322 config DRM_PANEL_ILITEK_ILI9341 tristate "Ilitek ILI9341 240x320 QVGA panels" - depends on OF && SPI + depends on SPI select DRM_KMS_HELPER select DRM_GEM_DMA_HELPER depends on BACKLIGHT_CLASS_DEVICE
drivers/gpu/drm/panel/panel-ilitek-ili9341.c +3 -2
@@ -22,8 +22,9 @@#include <linux/bitops.h> #include <linux/delay.h> #include <linux/gpio/consumer.h> +#include <linux/mod_devicetable.h> #include <linux/module.h> -#include <linux/of.h> +#include <linux/property.h> #include <linux/regulator/consumer.h> #include <linux/spi/spi.h>
@@ -691,7 +692,7 @@ static int ili9341_dpi_probe(struct spi_device *spi, struct gpio_desc *dc,* Every new incarnation of this display must have a unique * data entry for the system in this driver. */ - ili->conf =of_device_get_match_data (dev); + ili->conf =device_get_match_data (dev);if (!ili->conf) {dev_err (dev,"missing device configuration\n" );return -ENODEV ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 81/336 drm/panel: ili9341: Respect deferred probe
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 740fc1e0509be3f7e2207e89125b06119ed62943 ]
GPIO controller might not be available when driver is being probed. There are plenty of reasons why, one of which is deferred probe.
Since GPIOs are optional, return any error code we got to the upper layer, including deferred probe. With that in mind, use dev_err_probe() in order to avoid spamming the logs.
--- drivers/gpu/drm/panel/panel-ilitek-ili9341.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/panel/panel-ilitek-ili9341.c +2 -2
@@ -715,11 +715,11 @@ static int ili9341_probe(struct spi_device *spi) reset =devm_gpiod_get_optional (dev,"reset" ,GPIOD_OUT_HIGH );if (IS_ERR (reset)) -dev_err (dev,"Failed to get gpio 'reset'\n" ); +return dev_err_probe (dev,PTR_ERR (reset),"Failed to get gpio 'reset'\n" ); dc =devm_gpiod_get_optional (dev,"dc" ,GPIOD_OUT_LOW );if (IS_ERR (dc)) -dev_err (dev,"Failed to get gpio 'dc'\n" ); +return dev_err_probe (dev,PTR_ERR (dc),"Failed to get gpio 'dc'\n" );if (!strcmp (id->name,"sf-tc240t-9370-t" ))return ili9341_dpi_probe (spi, dc, reset);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 82/336 drm/panel: ili9341: Use predefined error codes
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit da85f0aaa9f21999753b01d45c0343f885a8f905 ]
In one case the -1 is returned which is quite confusing code for the wrong device ID, in another the ret is returning instead of plain 0 that also confusing as readed may ask the possible meaning of positive codes, which are never the case there. Convert both to use explicit predefined error codes to make it clear what's going on there.
--- drivers/gpu/drm/panel/panel-ilitek-ili9341.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/panel/panel-ilitek-ili9341.c +2 -2
@@ -422,7 +422,7 @@ static int ili9341_dpi_prepare(struct drm_panel *panel)ili9341_dpi_init (ili); -return ret; +return 0 ; }static int ili9341_dpi_enable (struct drm_panel *panel)
@@ -726,7 +726,7 @@ static int ili9341_probe(struct spi_device *spi)else if (!strcmp (id->name,"yx240qv29" ))return ili9341_dbi_probe (spi, dc, reset); -return -1 ; +return -ENODEV ; }static void ili9341_remove (struct spi_device *spi)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 83/336 ipv4: Fix uninit-value access in __ip_make_skb()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shigeru Yoshida <[email protected]>
[ Upstream commit fc1092f51567277509563800a3c56732070b6aa4 ]
KMSAN reported uninit-value access in __ip_make_skb() [1]. __ip_make_skb() tests HDRINCL to know if the skb has icmphdr. However, HDRINCL can cause a race condition. If calling setsockopt(2) with IP_HDRINCL changes HDRINCL while __ip_make_skb() is running, the function will access icmphdr in the skb even if it is not included. This causes the issue reported by KMSAN.
Check FLOWI_FLAG_KNOWN_NH on fl4->flowi4_flags instead of testing HDRINCL on the socket.
Also, fl4->fl4_icmp_type and fl4->fl4_icmp_code are not initialized. These are union in struct flowi4 and are implicitly initialized by flowi4_init_output(), but we should not rely on specific union layout.
Initialize these explicitly in raw_sendmsg().
[1]
BUG: KMSAN: uninit-value in __ip_make_skb+0x2b74/0x2d20 net/ipv4/ip_output.c:1481 __ip_make_skb+0x2b74/0x2d20 net/ipv4/ip_output.c:1481 ip_finish_skb include/net/ip.h:243 [inline] ip_push_pending_frames+0x4c/0x5c0 net/ipv4/ip_output.c:1508 raw_sendmsg+0x2381/0x2690 net/ipv4/raw.c:654 inet_sendmsg+0x27b/0x2a0 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x274/0x3c0 net/socket.c:745 __sys_sendto+0x62c/0x7b0 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x130/0x200 net/socket.c:2199 do_syscall_64+0xd8/0x1f0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x6d/0x75
Uninit was created at:
slab_post_alloc_hook mm/slub.c:3804 [inline] slab_alloc_node mm/slub.c:3845 [inline] kmem_cache_alloc_node+0x5f6/0xc50 mm/slub.c:3888 kmalloc_reserve+0x13c/0x4a0 net/core/skbuff.c:577 __alloc_skb+0x35a/0x7c0 net/core/skbuff.c:668 alloc_skb include/linux/skbuff.h:1318 [inline] __ip_append_data+0x49ab/0x68c0 net/ipv4/ip_output.c:1128 ip_append_data+0x1e7/0x260 net/ipv4/ip_output.c:1365 raw_sendmsg+0x22b1/0x2690 net/ipv4/raw.c:648 inet_sendmsg+0x27b/0x2a0 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x274/0x3c0 net/socket.c:745 __sys_sendto+0x62c/0x7b0 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x130/0x200 net/socket.c:2199 do_syscall_64+0xd8/0x1f0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x6d/0x75 CPU: 1 PID: 15709 Comm: syz-executor.7 Not tainted 6.8.0-11567-gb3603fcb79b1 #25 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-1.fc39 04/01/2014
--- net/ipv4/ip_output.c | 2 +- net/ipv4/raw.c | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-)
net/ipv4/ip_output.c +1 -1
@@ -1473,7 +1473,7 @@ struct sk_buff *__ip_make_skb(struct sock *sk,* by icmp_hdr(skb)->type. */ if (sk->sk_type ==SOCK_RAW && - !inet_test_bit (HDRINCL , sk)) + !(fl4->flowi4_flags &FLOWI_FLAG_KNOWN_NH )) icmp_type = fl4->fl4_icmp_type;else icmp_type =icmp_hdr (skb)->type;
net/ipv4/raw.c +3 -0
@@ -605,6 +605,9 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) (hdrincl ?FLOWI_FLAG_KNOWN_NH :0 ), daddr, saddr, 0, 0, sk->sk_uid); + fl4.fl4_icmp_type =0 ; + fl4.fl4_icmp_code =0 ; +if (!hdrincl) { rfv.msg = msg; rfv.hlen =0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 84/336 net: gro: fix udp bad offset in socket lookup by adding {inner_}network_offset to napi_gro_cb
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Gobert <[email protected]>
[ Upstream commit 5ef31ea5d053a8f493a772ebad3f3ce82c35d845 ]
Commits a602456 ("udp: Add GRO functions to UDP socket") and 57c67ff ("udp:
additional GRO support") introduce incorrect usage of {ip,ipv6}_hdr in the complete phase of gro. The functions always return skb->network_header, which in the case of encapsulated packets at the gro complete phase, is always set to the innermost L3 of the packet. That means that calling {ip,ipv6}_hdr for skbs which completed the GRO receive phase (both in gro_list and *_gro_complete) when parsing an encapsulated packet's _outer_ L3/L4 may return an unexpected value.
This incorrect usage leads to a bug in GRO's UDP socket lookup. udp{4,6}_lib_lookup_skb functions use ip_hdr/ipv6_hdr respectively. These *_hdr functions return network_header which will point to the innermost L3, resulting in the wrong offset being used in __udp{4,6}_lib_lookup with encapsulated packets.
This patch adds network_offset and inner_network_offset to napi_gro_cb, and makes sure both are set correctly.
To fix the issue, network_offsets union is used inside napi_gro_cb, in which both the outer and the inner network offsets are saved.
Reproduction example:
Endpoint configuration example (fou + local address bind)
# ip fou add port 6666 ipproto 4
# ip link add name tun1 type ipip remote 2.2.2.1 local 2.2.2.2 encap fou encap-dport 5555 encap-sport 6666 mode ipip
# ip link set tun1 up
# ip a add 1.1.1.2/24 dev tun1Netperf TCP_STREAM result on net-next before patch is applied:
net-next main, GRO enabled:
$ netperf -H 1.1.1.2 -t TCP_STREAM -l 5
Recv Send Send
Socket Socket Message Elapsed
Size Size Size Time Throughput
bytes bytes bytes secs. 10^6bits/sec131072 16384 16384 5.28 2.37
net-next main, GRO disabled:
$ netperf -H 1.1.1.2 -t TCP_STREAM -l 5
Recv Send Send
Socket Socket Message Elapsed
Size Size Size Time Throughput
bytes bytes bytes secs. 10^6bits/sec131072 16384 16384 5.01 2745.06
patch applied, GRO enabled:
$ netperf -H 1.1.1.2 -t TCP_STREAM -l 5
Recv Send Send
Socket Socket Message Elapsed
Size Size Size Time Throughput
bytes bytes bytes secs. 10^6bits/sec131072 16384 16384 5.01 2877.38
--- include/net/gro.h | 9 +++++++++ net/8021q/vlan_core.c | 2 ++ net/core/gro.c | 1 + net/ipv4/af_inet.c | 1 + net/ipv4/udp.c | 3 ++- net/ipv4/udp_offload.c | 3 ++- net/ipv6/ip6_offload.c | 1 + net/ipv6/udp.c | 3 ++- net/ipv6/udp_offload.c | 3 ++- 9 files changed, 22 insertions(+), 4 deletions(-)
include/net/gro.h +9 -0
@@ -86,6 +86,15 @@ struct napi_gro_cb {/* used to support CHECKSUM_COMPLETE for tunneling protocols */ __wsum csum; + +/* L3 offsets */ +union { +struct { +u16 network_offset; +u16 inner_network_offset; + }; +u16 network_offsets[2 ]; + }; };#define NAPI_GRO_CB (skb) ((struct napi_gro_cb *)(skb)->cb)
net/8021q/vlan_core.c +2 -0
@@ -478,6 +478,8 @@ static struct sk_buff *vlan_gro_receive(struct list_head *head,if (unlikely (!vhdr)) goto out; +NAPI_GRO_CB (skb)->network_offsets[NAPI_GRO_CB (skb)->encap_mark] = hlen; + type = vhdr->h_vlan_encapsulated_proto; ptype =gro_find_receive_by_type (type);
net/core/gro.c +1 -0
@@ -373,6 +373,7 @@ static inline void skb_gro_reset_offset(struct sk_buff *skb, u32 nhoff)const struct skb_shared_info *pinfo =skb_shinfo (skb);const skb_frag_t *frag0 = &pinfo->frags[0 ]; +NAPI_GRO_CB (skb)->network_offset =0 ;NAPI_GRO_CB (skb)->data_offset =0 ;NAPI_GRO_CB (skb)->frag0 =NULL ;NAPI_GRO_CB (skb)->frag0_len =0 ;
net/ipv4/af_inet.c +1 -0
@@ -1571,6 +1571,7 @@ struct sk_buff *inet_gro_receive(struct list_head *head, struct sk_buff *skb)/* The above will be needed by the transport layer if there is one * immediately following this IP hdr. */ +NAPI_GRO_CB (skb)->inner_network_offset = off;/* Note : No need to call skb_gro_postpull_rcsum() here, * as we already checked checksum over ipv4 header was 0
net/ipv4/udp.c +2 -1
@@ -534,7 +534,8 @@ static inline struct sock *__udp4_lib_lookup_skb(struct sk_buff *skb,struct sock *udp4_lib_lookup_skb (const struct sk_buff *skb,__be16 sport,__be16 dport) { -const struct iphdr *iph =ip_hdr (skb); +const u16 offset =NAPI_GRO_CB (skb)->network_offsets[skb->encapsulation]; +const struct iphdr *iph = (struct iphdr *)(skb->data + offset);struct net *net =dev_net (skb->dev);int iif, sdif;
net/ipv4/udp_offload.c +2 -1
@@ -718,7 +718,8 @@ EXPORT_SYMBOL(udp_gro_complete); INDIRECT_CALLABLE_SCOPE int udp4_gro_complete(struct sk_buff *skb, int nhoff) { -const struct iphdr *iph =ip_hdr (skb); +const u16 offset =NAPI_GRO_CB (skb)->network_offsets[skb->encapsulation]; +const struct iphdr *iph = (struct iphdr *)(skb->data + offset);struct udphdr *uh = (struct udphdr *)(skb->data + nhoff);/* do fraglist only if there is no outer UDP encap (or we already processed it) */
net/ipv6/ip6_offload.c +1 -0
@@ -237,6 +237,7 @@ INDIRECT_CALLABLE_SCOPE struct sk_buff *ipv6_gro_receive(struct list_head *head, goto out;skb_set_network_header (skb, off); +NAPI_GRO_CB (skb)->inner_network_offset = off; flush +=ntohs (iph->payload_len) != skb->len - hlen;
net/ipv6/udp.c +2 -1
@@ -275,7 +275,8 @@ static struct sock *__udp6_lib_lookup_skb(struct sk_buff *skb,struct sock *udp6_lib_lookup_skb (const struct sk_buff *skb,__be16 sport,__be16 dport) { -const struct ipv6hdr *iph =ipv6_hdr (skb); +const u16 offset =NAPI_GRO_CB (skb)->network_offsets[skb->encapsulation]; +const struct ipv6hdr *iph = (struct ipv6hdr *)(skb->data + offset);struct net *net =dev_net (skb->dev);int iif, sdif;
net/ipv6/udp_offload.c +2 -1
@@ -164,7 +164,8 @@ struct sk_buff *udp6_gro_receive(struct list_head *head, struct sk_buff *skb) INDIRECT_CALLABLE_SCOPE int udp6_gro_complete(struct sk_buff *skb, int nhoff) { -const struct ipv6hdr *ipv6h =ipv6_hdr (skb); +const u16 offset =NAPI_GRO_CB (skb)->network_offsets[skb->encapsulation]; +const struct ipv6hdr *ipv6h = (struct ipv6hdr *)(skb->data + offset);struct udphdr *uh = (struct udphdr *)(skb->data + nhoff);/* do fraglist only if there is no outer UDP encap (or we already processed it) */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 85/336 net: gro: add flush check in udp_gro_receive_segment
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Gobert <[email protected]>
[ Upstream commit 5babae777c61aa8a8679d59d3cdc54165ad96d42 ]
GRO-GSO path is supposed to be transparent and as such L3 flush checks are relevant to all UDP flows merging in GRO. This patch uses the same logic and code from tcp_gro_receive, terminating merge if flush is non zero.
--- net/ipv4/udp_offload.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
net/ipv4/udp_offload.c +11 -1
@@ -471,6 +471,7 @@ static struct sk_buff *udp_gro_receive_segment(struct list_head *head,struct sk_buff *p;unsigned int ulen;int ret =0 ; +int flush;/* requires non zero csum, for symmetry with GSO */ if (!uh->check) {
@@ -504,13 +505,22 @@ static struct sk_buff *udp_gro_receive_segment(struct list_head *head,return p; } + flush =NAPI_GRO_CB (p)->flush; + +if (NAPI_GRO_CB (p)->flush_id !=1 || +NAPI_GRO_CB (p)->count !=1 || + !NAPI_GRO_CB (p)->is_atomic) + flush |=NAPI_GRO_CB (p)->flush_id; +else +NAPI_GRO_CB (p)->is_atomic = false; +/* Terminate the flow on len mismatch or if it grow "too much". * Under small packet flood GRO count could elsewhere grow a lot * leading to excessive truesize values. * On len mismatch merge the first packet shorter than gso_size, * otherwise complete the GRO packet. */ -if (ulen >ntohs (uh2->len)) { +if (ulen >ntohs (uh2->len) || flush) { pp = p; }else {if (NAPI_GRO_CB (skb)->is_flist) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 86/336 drm/xe/display: Fix ADL-N detection
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lucas De Marchi <[email protected]>
[ Upstream commit df04b152fca2d46e75fbb74ed79299bc420bc9e6 ]
Contrary to i915, in xe ADL-N is kept as a different platform, not a subplatform of ADL-P. Since the display side doesn't need to differentiate between P and N, i.e. IS_ALDERLAKE_P_N() is never called, just fixup the compat header to check for both P and N.
Moving ADL-N to be a subplatform would be more complex as the firmware loading in xe only handles platforms, not subplatforms, as going forward the direction is to check on IP version rather than platforms/subplatforms.
Fix warning when initializing display:
xe 0000:00:02.0: [drm:intel_pch_type [xe]] Found Alder Lake PCH ------------[ cut here ]------------ xe 0000:00:02.0: drm_WARN_ON(!((dev_priv)->info.platform == XE_ALDERLAKE_S) && !((dev_priv)->info.platform == XE_ALDERLAKE_P))
And wrong paths being taken on the display side.
--- drivers/gpu/drm/xe/compat-i915-headers/i915_drv.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/xe/compat-i915-headers/i915_drv.h +2 -1
@@ -84,7 +84,8 @@ static inline struct drm_i915_private *kdev_to_i915(struct device *kdev)#define IS_ROCKETLAKE (dev_priv) IS_PLATFORM(dev_priv, XE_ROCKETLAKE)#define IS_DG1 (dev_priv) IS_PLATFORM(dev_priv, XE_DG1)#define IS_ALDERLAKE_S (dev_priv) IS_PLATFORM(dev_priv, XE_ALDERLAKE_S) -#define IS_ALDERLAKE_P (dev_priv) IS_PLATFORM(dev_priv, XE_ALDERLAKE_P) +#define IS_ALDERLAKE_P (dev_priv) (IS_PLATFORM(dev_priv, XE_ALDERLAKE_P) || \ + IS_PLATFORM(dev_priv, XE_ALDERLAKE_N))#define IS_XEHPSDV (dev_priv) (dev_priv && 0)#define IS_DG2 (dev_priv) IS_PLATFORM(dev_priv, XE_DG2)#define IS_PONTEVECCHIO (dev_priv) IS_PLATFORM(dev_priv, XE_PVC)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 87/336 clk: qcom: smd-rpm: Restore msm8976 num_clk
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adam Skladowski <[email protected]>
[ Upstream commit 0d4ce2458cd7d1d66a5ee2f3c036592fb663d5bc ]
During rework somehow msm8976 num_clk got removed, restore it.
--- drivers/clk/qcom/clk-smd-rpm.c | 1 + 1 file changed, 1 insertion(+)
drivers/clk/qcom/clk-smd-rpm.c +1 -0
@@ -768,6 +768,7 @@ static struct clk_smd_rpm *msm8976_clks[] = {static const struct rpm_smd_clk_desc rpm_clk_msm8976 = { .clks = msm8976_clks, + .num_clks =ARRAY_SIZE (msm8976_clks), .icc_clks = bimc_pcnoc_snoc_smmnoc_icc_clks, .num_icc_clks =ARRAY_SIZE (bimc_pcnoc_snoc_smmnoc_icc_clks), };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 88/336 clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jernej Skrabec <[email protected]>
[ Upstream commit 7e91ed763dc07437777bd012af7a2bd4493731ff ]
While PLL CPUX clock rate change when CPU is running from it works in vast majority of cases, now and then it causes instability. This leads to system crashes and other undefined behaviour. After a lot of testing (30+ hours) while also doing a lot of frequency switches, we can't observe any instability issues anymore when doing reparenting to stable clock like 24 MHz oscillator.
--- drivers/clk/sunxi-ng/ccu-sun50i-h6.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-)
drivers/clk/sunxi-ng/ccu-sun50i-h6.c +17 -2
@@ -1181,11 +1181,18 @@ static const u32 usb2_clk_regs[] = { SUN50I_H6_USB3_CLK_REG, }; +static struct ccu_mux_nb sun50i_h6_cpu_nb = { + .common = &cpux_clk.common, + .cm = &cpux_clk.mux, + .delay_us =1 , + .bypass_index =0 ,/* index of 24 MHz oscillator */ +}; +static int sun50i_h6_ccu_probe (struct platform_device *pdev) {void __iomem *reg; +int i, ret;u32 val; -int i; reg =devm_platform_ioremap_resource (pdev,0 );if (IS_ERR (reg))
@@ -1252,7 +1259,15 @@ static int sun50i_h6_ccu_probe(struct platform_device *pdev) val |=BIT (24 );writel (val, reg +SUN50I_H6_HDMI_CEC_CLK_REG ); -return devm_sunxi_ccu_probe (&pdev->dev, reg, &sun50i_h6_ccu_desc); + ret =devm_sunxi_ccu_probe (&pdev->dev, reg, &sun50i_h6_ccu_desc); +if (ret) +return ret; + +/* Reparent CPU during PLL CPUX rate changes */ +ccu_mux_notifier_register (pll_cpux_clk.common.hw.clk, + &sun50i_h6_cpu_nb); + +return 0 ; }static const struct of_device_id sun50i_h6_ccu_ids[] = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 89/336 powerpc/pseries: make max polling consistent for longer H_CALLs
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nayna Jain <[email protected]>
[ Upstream commit 784354349d2c988590c63a5a001ca37b2a6d4da1 ]
Currently, plpks_confirm_object_flushed() function polls for 5msec in total instead of 5sec.
Keep max polling time consistent for all the H_CALLs, which take longer than expected, to be 5sec. Also, make use of fsleep() everywhere to insert delay.
--- arch/powerpc/include/asm/plpks.h | 5 ++--- arch/powerpc/platforms/pseries/plpks.c | 10 +++++----- 2 files changed, 7 insertions(+), 8 deletions(-)
arch/powerpc/include/asm/plpks.h +2 -3
@@ -44,9 +44,8 @@#define PLPKS_MAX_DATA_SIZE 4000// Timeouts for PLPKS operations -#define PLPKS_MAX_TIMEOUT 5000 // msec -#define PLPKS_FLUSH_SLEEP 10 // msec -#define PLPKS_FLUSH_SLEEP_RANGE 400 +#define PLPKS_MAX_TIMEOUT (5 * USEC_PER_SEC) +#define PLPKS_FLUSH_SLEEP 10000 // usecstruct plpks_var {char *component;
arch/powerpc/platforms/pseries/plpks.c +5 -5
@@ -415,8 +415,7 @@ static int plpks_confirm_object_flushed(struct label *label,break ; } -usleep_range (PLPKS_FLUSH_SLEEP , -PLPKS_FLUSH_SLEEP +PLPKS_FLUSH_SLEEP_RANGE ); +fsleep (PLPKS_FLUSH_SLEEP ); timeout = timeout +PLPKS_FLUSH_SLEEP ; }while (timeout <PLPKS_MAX_TIMEOUT );
@@ -464,9 +463,10 @@ int plpks_signed_update_var(struct plpks_var *var, u64 flags) continuetoken = retbuf[0 ];if (pseries_status_to_err (rc) == -EBUSY ) { -int delay_ms =get_longbusy_msecs (rc); -mdelay (delay_ms); - timeout += delay_ms; +int delay_us =get_longbusy_msecs (rc) *1000 ; + +fsleep (delay_us); + timeout += delay_us; } rc =pseries_status_to_err (rc); }while (rc == -EBUSY && timeout <PLPKS_MAX_TIMEOUT );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 90/336 powerpc/pseries/iommu: LPAR panics during boot up with a frozen PE
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gaurav Batra <[email protected]>
[ Upstream commit 49a940dbdc3107fecd5e6d3063dc07128177e058 ]
At the time of LPAR boot up, partition firmware provides Open Firmware property ibm,dma-window for the PE. This property is provided on the PCI bus the PE is attached to.
There are execptions where the partition firmware might not provide this property for the PE at the time of LPAR boot up. One of the scenario is where the firmware has frozen the PE due to some error condition. This PE is frozen for 24 hours or unless the whole system is reinitialized.
Within this time frame, if the LPAR is booted, the frozen PE will be presented to the LPAR but ibm,dma-window property could be missing.
Today, under these circumstances, the LPAR oopses with NULL pointer dereference, when configuring the PCI bus the PE is attached to.
BUG: Kernel NULL pointer dereference on read at 0x000000c8
Faulting instruction address: 0xc0000000001024c0
Oops: Kernel access of bad area, sig: 7 [#1]
LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries
Modules linked in:
Supported: Yes
CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.4.0-150600.9-default #1
Hardware name: IBM,9043-MRX POWER10 (raw) 0x800200 0xf000006 of:IBM,FW1060.00 (NM1060_023) hv:phyp pSeries
NIP: c0000000001024c0 LR: c0000000001024b0 CTR: c000000000102450
REGS: c0000000037db5c0 TRAP: 0300 Not tainted (6.4.0-150600.9-default)
MSR: 8000000002009033 <SF,VEC,EE,ME,IR,DR,RI,LE> CR: 28000822 XER: 00000000
CFAR: c00000000010254c DAR: 00000000000000c8 DSISR: 00080000 IRQMASK: 0
...
NIP [c0000000001024c0] pci_dma_bus_setup_pSeriesLP+0x70/0x2a0
LR [c0000000001024b0] pci_dma_bus_setup_pSeriesLP+0x60/0x2a0
Call Trace:
pci_dma_bus_setup_pSeriesLP+0x60/0x2a0 (unreliable)
pcibios_setup_bus_self+0x1c0/0x370
__of_scan_bus+0x2f8/0x330
pcibios_scan_phb+0x280/0x3d0
pcibios_init+0x88/0x12c
do_one_initcall+0x60/0x320
kernel_init_freeable+0x344/0x3e4
kernel_init+0x34/0x1d0
ret_from_kernel_user_thread+0x14/0x1c--- arch/powerpc/platforms/pseries/iommu.c | 8 ++++++++ 1 file changed, 8 insertions(+)
arch/powerpc/platforms/pseries/iommu.c +8 -0
@@ -786,8 +786,16 @@ static void pci_dma_bus_setup_pSeriesLP(struct pci_bus *bus)* parent bus. During reboot, there will be ibm,dma-window property to * define DMA window. For kdump, there will at least be default window or DDW * or both. +* There is an exception to the above. In case the PE goes into frozen +* state, firmware may not provide ibm,dma-window property at the time +* of LPAR boot up. */ +if (!pdn) { +pr_debug (" no ibm,dma-window property !\n" ); +return ; + } + ppci =PCI_DN (pdn); pr_debug(" parent is %pOF, iommu_table: 0x%p\n",
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 91/336 EDAC/versal: Do not log total error counts
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shubhrajyoti Datta <[email protected]>
[ Upstream commit 1a24733e80771d8eef656e515306a560519856a9 ]
When logging errors, the driver currently logs the total error count. However, it should log the current error only. Fix it.
[ bp: Rewrite text. ]
--- drivers/edac/versal_edac.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/edac/versal_edac.c +2 -2
@@ -423,7 +423,7 @@ static void handle_error(struct mem_ctl_info *mci, struct ecc_status *stat) convert_to_physical(priv, pinf), pinf.burstpos);edac_mc_handle_error (HW_EVENT_ERR_CORRECTED , mci, - priv->ce_cnt,0 ,0 ,0 ,0 ,0 ,-1 , +1 ,0 ,0 ,0 ,0 ,0 ,-1 , priv->message,"" ); }
@@ -436,7 +436,7 @@ static void handle_error(struct mem_ctl_info *mci, struct ecc_status *stat) convert_to_physical(priv, pinf), pinf.burstpos);edac_mc_handle_error (HW_EVENT_ERR_UNCORRECTED , mci, - priv->ue_cnt,0 ,0 ,0 ,0 ,0 ,-1 , +1 ,0 ,0 ,0 ,0 ,0 ,-1 , priv->message,"" ); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 92/336 swiotlb: initialise restricted pool list_head when SWIOTLB_DYNAMIC=y
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <[email protected]>
[ Upstream commit 75961ffb5cb3e5196f19cae7683f35cc88b50800 ]
Using restricted DMA pools (CONFIG_DMA_RESTRICTED_POOL=y) in conjunction with dynamic SWIOTLB (CONFIG_SWIOTLB_DYNAMIC=y) leads to the following crash when initialising the restricted pools at boot-time:
| Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 | Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP | pc : rmem_swiotlb_device_init+0xfc/0x1ec | lr : rmem_swiotlb_device_init+0xf0/0x1ec | Call trace: | rmem_swiotlb_device_init+0xfc/0x1ec | of_reserved_mem_device_init_by_idx+0x18c/0x238 | of_dma_configure_id+0x31c/0x33c | platform_dma_configure+0x34/0x80
faddr2line reveals that the crash is in the list validation code:
include/linux/list.h:83
include/linux/rculist.h:79
include/linux/rculist.h:106
kernel/dma/swiotlb.c:306
kernel/dma/swiotlb.c:1695
because add_mem_pool() is trying to list_add_rcu() to a NULL 'mem->pools'.
Fix the crash by initialising the 'mem->pools' list_head in rmem_swiotlb_device_init() before calling add_mem_pool().
--- kernel/dma/swiotlb.c | 1 + 1 file changed, 1 insertion(+)
kernel/dma/swiotlb.c +1 -0
@@ -1717,6 +1717,7 @@ static int rmem_swiotlb_device_init(struct reserved_mem *rmem, mem->for_alloc = true;#ifdef CONFIG_SWIOTLB_DYNAMIC spin_lock_init (&mem->lock); +INIT_LIST_HEAD_RCU (&mem->pools);#endif add_mem_pool (mem, pool);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 93/336 KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Upton <[email protected]>
[ Upstream commit 6ddb4f372fc63210034b903d96ebbeb3c7195adb ]
vgic_v2_parse_attr() is responsible for finding the vCPU that matches the user-provided CPUID, which (of course) may not be valid. If the ID is invalid, kvm_get_vcpu_by_id() returns NULL, which isn't handled gracefully.
Similar to the GICv3 uaccess flow, check that kvm_get_vcpu_by_id() actually returns something and fail the ioctl if not.
--- arch/arm64/kvm/vgic/vgic-kvm-device.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/arm64/kvm/vgic/vgic-kvm-device.c +4 -4
@@ -338,12 +338,12 @@ int kvm_register_vgic_device(unsigned long type)int vgic_v2_parse_attr (struct kvm_device *dev,struct kvm_device_attr *attr,struct vgic_reg_attr *reg_attr) { -int cpuid; +int cpuid =FIELD_GET (KVM_DEV_ARM_VGIC_CPUID_MASK , attr->attr); - cpuid =FIELD_GET (KVM_DEV_ARM_VGIC_CPUID_MASK , attr->attr); - - reg_attr->vcpu =kvm_get_vcpu_by_id (dev->kvm, cpuid); reg_attr->addr = attr->attr &KVM_DEV_ARM_VGIC_OFFSET_MASK ; + reg_attr->vcpu =kvm_get_vcpu_by_id (dev->kvm, cpuid); +if (!reg_attr->vcpu) +return -EINVAL ;return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 94/336 exfat: fix timing of synchronizing bitmap and inode
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuezhang Mo <[email protected]>
[ Upstream commit d7ed5232f0f16181506373d73e711190d5e0c868 ]
Commit(f55c096f62f1 exfat: do not zero the extended part) changed the timing of synchronizing bitmap and inode in exfat_cont_expand(). The change caused xfstests generic/013 to fail if 'dirsync' or 'sync' is enabled. So this commit restores the timing.
--- fs/exfat/file.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
fs/exfat/file.c +3 -4
@@ -51,7 +51,7 @@ static int exfat_cont_expand(struct inode *inode, loff_t size) clu.flags = ei->flags; ret =exfat_alloc_cluster (inode, new_num_clusters - num_clusters, - &clu,IS_DIRSYNC (inode)); + &clu,inode_needs_sync (inode));if (ret)return ret;
@@ -77,12 +77,11 @@ static int exfat_cont_expand(struct inode *inode, loff_t size) ei->i_size_aligned =round_up (size, sb->s_blocksize); ei->i_size_ondisk = ei->i_size_aligned; inode->i_blocks =round_up (size, sbi->cluster_size) >>9 ; +mark_inode_dirty (inode); -if (IS_DIRSYNC (inode)) +if (IS_SYNC (inode))return write_inode_now (inode,1 ); -mark_inode_dirty (inode); -return 0 ; free_clu:
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 95/336 firmware: microchip: dont unconditionally print validation success
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Conor Dooley <[email protected]>
[ Upstream commit 6e3b7e862ea4e4ff1be1d153ae07dfe150ed8896 ]
If validation fails, both prints are made. Skip the success one in the failure case.
--- drivers/firmware/microchip/mpfs-auto-update.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/firmware/microchip/mpfs-auto-update.c +2 -0
@@ -206,10 +206,12 @@ static int mpfs_auto_update_verify_image(struct fw_upload *fw_uploader)if (ret | response->resp_status) {dev_warn (priv->dev,"Verification of Upgrade Image failed!\n" ); ret = ret ? ret : -EBADMSG ; + goto free_message; }dev_info (priv->dev,"Verification of Upgrade Image passed!\n" ); +free_message:devm_kfree (priv->dev, message); free_response:devm_kfree (priv->dev, response);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 96/336 scsi: ufs: core: Fix MCQ MAC configuration
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rohit Ner <[email protected]>
[ Upstream commit 767712f91de76abd22a45184e6e3440120b8bfce ]
As per JEDEC Standard No. 223E Section 5.9.2, the max # active commands value programmed by the host sw in MCQConfig.MAC should be one less than the actual value.
--- drivers/ufs/core/ufs-mcq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/ufs/core/ufs-mcq.c +1 -1
@@ -94,7 +94,7 @@ void ufshcd_mcq_config_mac(struct ufs_hba *hba, u32 max_active_cmds) val =ufshcd_readl (hba,REG_UFS_MCQ_CFG ); val &= ~MCQ_CFG_MAC_MASK ; - val |=FIELD_PREP (MCQ_CFG_MAC_MASK , max_active_cmds); + val |=FIELD_PREP (MCQ_CFG_MAC_MASK , max_active_cmds -1 );ufshcd_writel (hba, val,REG_UFS_MCQ_CFG ); }EXPORT_SYMBOL_GPL (ufshcd_mcq_config_mac);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 97/336 scsi: lpfc: Move NPIVs transport unregistration to after resource clean up
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit 4ddf01f2f1504fa08b766e8cfeec558e9f8eef6c ]
There are cases after NPIV deletion where the fabric switch still believes the NPIV is logged into the fabric. This occurs when a vport is unregistered before the Remove All DA_ID CT and LOGO ELS are sent to the fabric.
Currently fc_remove_host(), which calls dev_loss_tmo for all D_IDs including the fabric D_ID, removes the last ndlp reference and frees the ndlp rport object. This sometimes causes the race condition where the final DA_ID and LOGO are skipped from being sent to the fabric switch.
Fix by moving the fc_remove_host() and scsi_remove_host() calls after DA_ID and LOGO are sent.
--- drivers/scsi/lpfc/lpfc_vport.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/scsi/lpfc/lpfc_vport.c +4 -4
@@ -683,10 +683,6 @@ lpfc_vport_delete(struct fc_vport *fc_vport)lpfc_free_sysfs_attr (vport);lpfc_debugfs_terminate (vport); -/* Remove FC host to break driver binding. */ -fc_remove_host (shost); -scsi_remove_host (shost); -/* Send the DA_ID and Fabric LOGO to cleanup Nameserver entries. */ ndlp =lpfc_findnode_did (vport, Fabric_DID);if (!ndlp)
@@ -730,6 +726,10 @@ lpfc_vport_delete(struct fc_vport *fc_vport) skip_logo: +/* Remove FC host to break driver binding. */ +fc_remove_host (shost); +scsi_remove_host (shost); +lpfc_cleanup (vport);/* Remove scsi host now. The nodes are cleaned up. */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 98/336 scsi: lpfc: Remove IRQF_ONESHOT flag from threaded IRQ handling
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit 4623713e7ade46bfc63a3eade836f566ccbcd771 ]
IRQF_ONESHOT is found to mask HBA generated interrupts when thread_fn is running. As a result, some EQEs/CQEs miss timely processing resulting in SCSI layer attempts to abort commands due to io_timeout. Abort CQEs are also not processed leading to the observations of hangs and spam of "0748 abort handler timed out waiting for aborting I/O" log messages.
Remove the IRQF_ONESHOT flag. The cmpxchg and xchg atomic operations on lpfc_queue->queue_claimed already protect potential parallel access to an EQ/CQ should the thread_fn get interrupted by the primary irq handler.
--- drivers/scsi/lpfc/lpfc_init.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/lpfc/lpfc_init.c +1 -1
@@ -13047,7 +13047,7 @@ lpfc_sli4_enable_msix(struct lpfc_hba *phba) rc =request_threaded_irq (eqhdl->irq, &lpfc_sli4_hba_intr_handler, &lpfc_sli4_hba_intr_handler_th, -IRQF_ONESHOT , name, eqhdl); +0 , name, eqhdl);if (rc) {lpfc_printf_log (phba,KERN_WARNING ,LOG_INIT , "0486 MSI-X fast-path (%d) "
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 99/336 scsi: lpfc: Update lpfc_ramp_down_queue_handler() logic
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit bb011631435c705cdeddca68d5c85fd40a4320f9 ]
Typically when an out of resource CQE status is detected, the lpfc_ramp_down_queue_handler() logic is called to help reduce I/O load by reducing an sdev's queue_depth.
However, the current lpfc_rampdown_queue_depth() logic does not help reduce queue_depth. num_cmd_success is never updated and is always zero, which means new_queue_depth will always be set to sdev->queue_depth. So, new_queue_depth = sdev->queue_depth - new_queue_depth always sets new_queue_depth to zero. And, scsi_change_queue_depth(sdev, 0) is essentially a no-op.
Change the lpfc_ramp_down_queue_handler() logic to set new_queue_depth equal to sdev->queue_depth subtracted from number of times num_rsrc_err was incremented. If num_rsrc_err is >= sdev->queue_depth, then set new_queue_depth equal to 1. Eventually, the frequency of Good_Status frames will signal SCSI upper layer to auto increase the queue_depth back to the driver default of 64 via scsi_handle_queue_ramp_up().
--- drivers/scsi/lpfc/lpfc.h | 1 - drivers/scsi/lpfc/lpfc_scsi.c | 13 ++++--------- 2 files changed, 4 insertions(+), 10 deletions(-)
drivers/scsi/lpfc/lpfc.h +0 -1
@@ -1325,7 +1325,6 @@ struct lpfc_hba {struct timer_list fabric_block_timer;unsigned long bit_flags;atomic_t num_rsrc_err; -atomic_t num_cmd_success;unsigned long last_rsrc_error_time;unsigned long last_ramp_down_time;#ifdef CONFIG_SCSI_LPFC_DEBUG_FS
drivers/scsi/lpfc/lpfc_scsi.c +4 -9
@@ -167,11 +167,10 @@ lpfc_ramp_down_queue_handler(struct lpfc_hba *phba)struct Scsi_Host *shost;struct scsi_device *sdev;unsigned long new_queue_depth; -unsigned long num_rsrc_err, num_cmd_success; +unsigned long num_rsrc_err;int i; num_rsrc_err =atomic_read (&phba->num_rsrc_err); - num_cmd_success =atomic_read (&phba->num_cmd_success);/* * The error and success command counters are global per
@@ -186,20 +185,16 @@ lpfc_ramp_down_queue_handler(struct lpfc_hba *phba)for (i =0 ; i <= phba->max_vports && vports[i] !=NULL ; i++) { shost =lpfc_shost_from_vport (vports[i]);shost_for_each_device (sdev, shost) { - new_queue_depth = - sdev->queue_depth * num_rsrc_err / - (num_rsrc_err + num_cmd_success); -if (!new_queue_depth) - new_queue_depth = sdev->queue_depth -1 ; +if (num_rsrc_err >= sdev->queue_depth) + new_queue_depth =1 ;else new_queue_depth = sdev->queue_depth - - new_queue_depth; + num_rsrc_err;scsi_change_queue_depth (sdev, new_queue_depth); } }lpfc_destroy_vport_work_array (phba, vports);atomic_set (&phba->num_rsrc_err,0 ); -atomic_set (&phba->num_cmd_success,0 ); }/**
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 100/336 scsi: lpfc: Replace hbalock with ndlp lock in lpfc_nvme_unregister_port()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit d11272be497e48a8e8f980470eb6b70e92eed0ce ]
The ndlp object update in lpfc_nvme_unregister_port() should be protected by the ndlp lock rather than hbalock.
--- drivers/scsi/lpfc/lpfc_nvme.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/scsi/lpfc/lpfc_nvme.c +2 -2
@@ -2616,9 +2616,9 @@ lpfc_nvme_unregister_port(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp)/* No concern about the role change on the nvme remoteport. * The transport will update it. */ -spin_lock_irq (&vport->phba->hbalock); +spin_lock_irq (&ndlp->lock); ndlp->fc4_xpt_flags |=NVME_XPT_UNREG_WAIT ; -spin_unlock_irq (&vport->phba->hbalock); +spin_unlock_irq (&ndlp->lock);/* Don't let the host nvme transport keep sending keep-alives * on this remoteport. Vport is unloading, no recovery. The
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 101/336 scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit ded20192dff31c91cef2a04f7e20e60e9bb887d3 ]
lpfc_worker_wake_up() calls the lpfc_work_done() routine, which takes the hbalock. Thus, lpfc_worker_wake_up() should not be called while holding the hbalock to avoid potential deadlock.
--- drivers/scsi/lpfc/lpfc_els.c | 20 ++++++++++---------- drivers/scsi/lpfc/lpfc_hbadisc.c | 5 ++--- drivers/scsi/lpfc/lpfc_sli.c | 14 +++++++------- 3 files changed, 19 insertions(+), 20 deletions(-)
drivers/scsi/lpfc/lpfc_els.c +10 -10
@@ -4462,23 +4462,23 @@ lpfc_els_retry_delay(struct timer_list *t)unsigned long flags;struct lpfc_work_evt *evtp = &ndlp->els_retry_evt; +/* Hold a node reference for outstanding queued work */ +if (!lpfc_nlp_get (ndlp)) +return ; +spin_lock_irqsave (&phba->hbalock, flags);if (!list_empty (&evtp->evt_listp)) {spin_unlock_irqrestore (&phba->hbalock, flags); +lpfc_nlp_put (ndlp);return ; } -/* We need to hold the node by incrementing the reference -* count until the queued work is done -*/ - evtp->evt_arg1 =lpfc_nlp_get (ndlp); -if (evtp->evt_arg1) { - evtp->evt =LPFC_EVT_ELS_RETRY ; -list_add_tail (&evtp->evt_listp, &phba->work_list); -lpfc_worker_wake_up (phba); - } + evtp->evt_arg1 = ndlp; + evtp->evt =LPFC_EVT_ELS_RETRY ; +list_add_tail (&evtp->evt_listp, &phba->work_list);spin_unlock_irqrestore (&phba->hbalock, flags); -return ; + +lpfc_worker_wake_up (phba); }/**
drivers/scsi/lpfc/lpfc_hbadisc.c +2 -3
@@ -257,7 +257,9 @@ lpfc_dev_loss_tmo_callbk(struct fc_rport *rport)if (evtp->evt_arg1) { evtp->evt =LPFC_EVT_DEV_LOSS ;list_add_tail (&evtp->evt_listp, &phba->work_list); +spin_unlock_irqrestore (&phba->hbalock, iflags);lpfc_worker_wake_up (phba); +return ; }spin_unlock_irqrestore (&phba->hbalock, iflags); }else {
@@ -275,10 +277,7 @@ lpfc_dev_loss_tmo_callbk(struct fc_rport *rport)lpfc_disc_state_machine (vport, ndlp,NULL ,NLP_EVT_DEVICE_RM ); } - } - -return ; }/**
drivers/scsi/lpfc/lpfc_sli.c +7 -7
@@ -1217,9 +1217,9 @@ lpfc_set_rrq_active(struct lpfc_hba *phba, struct lpfc_nodelist *ndlp, empty =list_empty (&phba->active_rrq_list);list_add_tail (&rrq->list, &phba->active_rrq_list); phba->hba_flag |=HBA_RRQ_ACTIVE ; +spin_unlock_irqrestore (&phba->hbalock, iflags);if (empty)lpfc_worker_wake_up (phba); -spin_unlock_irqrestore (&phba->hbalock, iflags);return 0 ; out:spin_unlock_irqrestore (&phba->hbalock, iflags);
@@ -11373,18 +11373,18 @@ lpfc_sli_post_recovery_event(struct lpfc_hba *phba,unsigned long iflags;struct lpfc_work_evt *evtp = &ndlp->recovery_evt; +/* Hold a node reference for outstanding queued work */ +if (!lpfc_nlp_get (ndlp)) +return ; +spin_lock_irqsave (&phba->hbalock, iflags);if (!list_empty (&evtp->evt_listp)) {spin_unlock_irqrestore (&phba->hbalock, iflags); +lpfc_nlp_put (ndlp);return ; } -/* Incrementing the reference count until the queued work is done. */ - evtp->evt_arg1 =lpfc_nlp_get (ndlp); -if (!evtp->evt_arg1) { -spin_unlock_irqrestore (&phba->hbalock, iflags); -return ; - } + evtp->evt_arg1 = ndlp; evtp->evt =LPFC_EVT_RECOVER_PORT ;list_add_tail (&evtp->evt_listp, &phba->work_list);spin_unlock_irqrestore (&phba->hbalock, iflags);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 102/336 scsi: lpfc: Use a dedicated lock for ras_fwlog state
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit f733a76ea0a9a84aee4ac41b81fad4d610ecbd8e ]
To reduce usage of and contention for hbalock, a separate dedicated lock is used to protect ras_fwlog state.
--- drivers/scsi/lpfc/lpfc.h | 1 + drivers/scsi/lpfc/lpfc_attr.c | 4 ++-- drivers/scsi/lpfc/lpfc_bsg.c | 20 ++++++++++---------- drivers/scsi/lpfc/lpfc_debugfs.c | 12 ++++++------ drivers/scsi/lpfc/lpfc_init.c | 3 +++ drivers/scsi/lpfc/lpfc_sli.c | 20 ++++++++++---------- 6 files changed, 32 insertions(+), 28 deletions(-)
drivers/scsi/lpfc/lpfc.h +1 -0
@@ -1429,6 +1429,7 @@ struct lpfc_hba {struct timer_list inactive_vmid_poll;/* RAS Support */ +spinlock_t ras_fwlog_lock;/* do not take while holding another lock */ struct lpfc_ras_fwlog ras_fwlog;uint32_t iocb_cnt;
drivers/scsi/lpfc/lpfc_attr.c +2 -2
@@ -5864,9 +5864,9 @@ lpfc_ras_fwlog_buffsize_set(struct lpfc_hba *phba, uint val)if (phba->cfg_ras_fwlog_func !=PCI_FUNC (phba->pcidev->devfn))return -EINVAL ; -spin_lock_irq (&phba->hbalock); +spin_lock_irq (&phba->ras_fwlog_lock); state = phba->ras_fwlog.state; -spin_unlock_irq (&phba->hbalock); +spin_unlock_irq (&phba->ras_fwlog_lock);if (state ==REG_INPROGRESS ) { lpfc_printf_log(phba, KERN_ERR, LOG_SLI, "6147 RAS Logging "
drivers/scsi/lpfc/lpfc_bsg.c +10 -10
@@ -5070,12 +5070,12 @@ lpfc_bsg_get_ras_config(struct bsg_job *job) bsg_reply->reply_data.vendor_reply.vendor_rsp;/* Current logging state */ -spin_lock_irq (&phba->hbalock); +spin_lock_irq (&phba->ras_fwlog_lock);if (ras_fwlog->state ==ACTIVE ) ras_reply->state =LPFC_RASLOG_STATE_RUNNING ;else ras_reply->state =LPFC_RASLOG_STATE_STOPPED ; -spin_unlock_irq (&phba->hbalock); +spin_unlock_irq (&phba->ras_fwlog_lock); ras_reply->log_level = phba->ras_fwlog.fw_loglevel; ras_reply->log_buff_sz = phba->cfg_ras_fwlog_buffsize;
@@ -5132,13 +5132,13 @@ lpfc_bsg_set_ras_config(struct bsg_job *job)if (action ==LPFC_RASACTION_STOP_LOGGING ) {/* Check if already disabled */ -spin_lock_irq (&phba->hbalock); +spin_lock_irq (&phba->ras_fwlog_lock);if (ras_fwlog->state !=ACTIVE ) { -spin_unlock_irq (&phba->hbalock); +spin_unlock_irq (&phba->ras_fwlog_lock); rc = -ESRCH ; goto ras_job_error; } -spin_unlock_irq (&phba->hbalock); +spin_unlock_irq (&phba->ras_fwlog_lock);/* Disable logging */ lpfc_ras_stop_fwlog (phba);
@@ -5149,10 +5149,10 @@ lpfc_bsg_set_ras_config(struct bsg_job *job)* FW-logging with new log-level. Return status * "Logging already Running" to caller. **/ -spin_lock_irq (&phba->hbalock); +spin_lock_irq (&phba->ras_fwlog_lock);if (ras_fwlog->state !=INACTIVE ) action_status = -EINPROGRESS ; -spin_unlock_irq (&phba->hbalock); +spin_unlock_irq (&phba->ras_fwlog_lock);/* Enable logging */ rc = lpfc_sli4_ras_fwlog_init(phba, log_level,
@@ -5268,13 +5268,13 @@ lpfc_bsg_get_ras_fwlog(struct bsg_job *job) goto ras_job_error;/* Logging to be stopped before reading */ -spin_lock_irq (&phba->hbalock); +spin_lock_irq (&phba->ras_fwlog_lock);if (ras_fwlog->state ==ACTIVE ) { -spin_unlock_irq (&phba->hbalock); +spin_unlock_irq (&phba->ras_fwlog_lock); rc = -EINPROGRESS ; goto ras_job_error; } -spin_unlock_irq (&phba->hbalock); +spin_unlock_irq (&phba->ras_fwlog_lock);if (job->request_len < sizeof(struct fc_bsg_request) +
drivers/scsi/lpfc/lpfc_debugfs.c +6 -6
@@ -2196,12 +2196,12 @@ static int lpfc_debugfs_ras_log_data(struct lpfc_hba *phba,memset (buffer,0 , size); -spin_lock_irq (&phba->hbalock); +spin_lock_irq (&phba->ras_fwlog_lock);if (phba->ras_fwlog.state !=ACTIVE ) { -spin_unlock_irq (&phba->hbalock); +spin_unlock_irq (&phba->ras_fwlog_lock);return -EINVAL ; } -spin_unlock_irq (&phba->hbalock); +spin_unlock_irq (&phba->ras_fwlog_lock);list_for_each_entry_safe (dmabuf, next, &phba->ras_fwlog.fwlog_buff_list, list) {
@@ -2252,13 +2252,13 @@ lpfc_debugfs_ras_log_open(struct inode *inode, struct file *file)int size;int rc = -ENOMEM ; -spin_lock_irq (&phba->hbalock); +spin_lock_irq (&phba->ras_fwlog_lock);if (phba->ras_fwlog.state !=ACTIVE ) { -spin_unlock_irq (&phba->hbalock); +spin_unlock_irq (&phba->ras_fwlog_lock); rc = -EINVAL ; goto out; } -spin_unlock_irq (&phba->hbalock); +spin_unlock_irq (&phba->ras_fwlog_lock);if (check_mul_overflow (LPFC_RAS_MIN_BUFF_POST_SIZE , phba->cfg_ras_fwlog_buffsize, &size))
drivers/scsi/lpfc/lpfc_init.c +3 -0
@@ -7698,6 +7698,9 @@ lpfc_setup_driver_resource_phase1(struct lpfc_hba *phba) "NVME" : " "), (phba->nvmet_support ? "NVMET" : " ")); +/* ras_fwlog state */ +spin_lock_init (&phba->ras_fwlog_lock); +/* Initialize the IO buffer list used by driver for SLI3 SCSI */ spin_lock_init (&phba->scsi_buf_list_get_lock);INIT_LIST_HEAD (&phba->lpfc_scsi_buf_list_get);
drivers/scsi/lpfc/lpfc_sli.c +10 -10
@@ -6849,9 +6849,9 @@ lpfc_ras_stop_fwlog(struct lpfc_hba *phba) {struct lpfc_ras_fwlog *ras_fwlog = &phba->ras_fwlog; -spin_lock_irq (&phba->hbalock); +spin_lock_irq (&phba->ras_fwlog_lock); ras_fwlog->state =INACTIVE ; -spin_unlock_irq (&phba->hbalock); +spin_unlock_irq (&phba->ras_fwlog_lock);/* Disable FW logging to host memory */ writel(LPFC_CTL_PDEV_CTL_DDL_RAS,
@@ -6894,9 +6894,9 @@ lpfc_sli4_ras_dma_free(struct lpfc_hba *phba) ras_fwlog->lwpd.virt =NULL ; } -spin_lock_irq (&phba->hbalock); +spin_lock_irq (&phba->ras_fwlog_lock); ras_fwlog->state =INACTIVE ; -spin_unlock_irq (&phba->hbalock); +spin_unlock_irq (&phba->ras_fwlog_lock); }/**
@@ -6998,9 +6998,9 @@ lpfc_sli4_ras_mbox_cmpl(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb) goto disable_ras; } -spin_lock_irq (&phba->hbalock); +spin_lock_irq (&phba->ras_fwlog_lock); ras_fwlog->state =ACTIVE ; -spin_unlock_irq (&phba->hbalock); +spin_unlock_irq (&phba->ras_fwlog_lock);mempool_free (pmb, phba->mbox_mem_pool);return ;
@@ -7032,9 +7032,9 @@ lpfc_sli4_ras_fwlog_init(struct lpfc_hba *phba,uint32_t len =0 , fwlog_buffsize, fwlog_entry_count;int rc =0 ; -spin_lock_irq (&phba->hbalock); +spin_lock_irq (&phba->ras_fwlog_lock); ras_fwlog->state =INACTIVE ; -spin_unlock_irq (&phba->hbalock); +spin_unlock_irq (&phba->ras_fwlog_lock); fwlog_buffsize = (LPFC_RAS_MIN_BUFF_POST_SIZE * phba->cfg_ras_fwlog_buffsize);
@@ -7095,9 +7095,9 @@ lpfc_sli4_ras_fwlog_init(struct lpfc_hba *phba, mbx_fwlog->u.request.lwpd.addr_lo =putPaddrLow (ras_fwlog->lwpd.phys); mbx_fwlog->u.request.lwpd.addr_hi =putPaddrHigh (ras_fwlog->lwpd.phys); -spin_lock_irq (&phba->hbalock); +spin_lock_irq (&phba->ras_fwlog_lock); ras_fwlog->state =REG_INPROGRESS ; -spin_unlock_irq (&phba->hbalock); +spin_unlock_irq (&phba->ras_fwlog_lock); mbox->vport = phba->pport; mbox->mbox_cmpl = lpfc_sli4_ras_mbox_cmpl;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 103/336 gfs2: Fix invalid metadata access in punch_hole
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Price <[email protected]>
[ Upstream commit c95346ac918c5badf51b9a7ac58a26d3bd5bb224 ]
In punch_hole(), when the offset lies in the final block for a given height, there is no hole to punch, but the maximum size check fails to detect that. Consequently, punch_hole() will try to punch a hole beyond the end of the metadata and fail. Fix the maximum size check.
--- fs/gfs2/bmap.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
fs/gfs2/bmap.c +3 -2
@@ -1718,7 +1718,8 @@ static int punch_hole(struct gfs2_inode *ip, u64 offset, u64 length)struct buffer_head *dibh, *bh;struct gfs2_holder rd_gh;unsigned int bsize_shift = sdp->sd_sb.sb_bsize_shift; -u64 lblock = (offset + (1 << bsize_shift) -1 ) >> bsize_shift; +unsigned int bsize =1 << bsize_shift; +u64 lblock = (offset + bsize -1 ) >> bsize_shift;__u16 start_list[GFS2_MAX_META_HEIGHT ];__u16 __end_list[GFS2_MAX_META_HEIGHT ], *end_list =NULL ;unsigned int start_aligned, end_aligned;
@@ -1729,7 +1730,7 @@ static int punch_hole(struct gfs2_inode *ip, u64 offset, u64 length)u64 prev_bnr =0 ;__be64 *start, *end; -if (offset >= maxsize) { +if (offset + bsize -1 >= maxsize) {/* * The starting point lies beyond the allocated metadata; * there are no blocks to deallocate.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 104/336 fs/9p: fix uninitialized values during inode evict
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Van Hensbergen <[email protected]>
[ Upstream commit 6630036b7c228f57c7893ee0403e92c2db2cd21d ]
If an iget fails due to not being able to retrieve information from the server then the inode structure is only partially initialized. When the inode gets evicted, references to uninitialized structures (like fscache cookies) were being made.
This patch checks for a bad_inode before doing anything other than clearing the inode from the cache. Since the inode is bad, it shouldn't have any state associated with it that needs to be written back (and there really isn't a way to complete those anyways).
--- fs/9p/vfs_inode.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
fs/9p/vfs_inode.c +10 -6
@@ -371,17 +371,21 @@ void v9fs_evict_inode(struct inode *inode)struct v9fs_inode __maybe_unused *v9inode =V9FS_I (inode);__le32 __maybe_unused version; -truncate_inode_pages_final (&inode->i_data); +if (!is_bad_inode (inode)) { +truncate_inode_pages_final (&inode->i_data); - version =cpu_to_le32 (v9inode->qid.version); -netfs_clear_inode_writeback (inode, &version); + version =cpu_to_le32 (v9inode->qid.version); +netfs_clear_inode_writeback (inode, &version); -clear_inode (inode); -filemap_fdatawrite (&inode->i_data); +clear_inode (inode); +filemap_fdatawrite (&inode->i_data);#ifdef CONFIG_9P_FSCACHE -fscache_relinquish_cookie (v9fs_inode_cookie (v9inode), false); +if (v9fs_inode_cookie (v9inode)) +fscache_relinquish_cookie (v9fs_inode_cookie (v9inode), false);#endif + }else +clear_inode (inode); }static int v9fs_test_inode (struct inode *inode,void *data)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 105/336 wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Johnson <[email protected]>
[ Upstream commit 774f8841f55d7ac4044c79812691649da203584a ]
Running kernel-doc on ieee80211_i.h flagged the following:net/mac80211/ieee80211_i.h:145: warning: expecting prototype for enum ieee80211_corrupt_data_flags. Prototype was for enum ieee80211_bss_corrupt_data_flags instead net/mac80211/ieee80211_i.h:162: warning: expecting prototype for enum ieee80211_valid_data_flags. Prototype was for enum ieee80211_bss_valid_data_flags instead
Fix these warnings.
--- net/mac80211/ieee80211_i.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/mac80211/ieee80211_i.h +2 -2
@@ -131,7 +131,7 @@ struct ieee80211_bss { };/** -* enum ieee80211_corrupt_data_flags - BSS data corruption flags +* enum ieee80211_bss_corrupt_data_flags - BSS data corruption flags * @IEEE80211_BSS_CORRUPT_BEACON: last beacon frame received was corrupted * @IEEE80211_BSS_CORRUPT_PROBE_RESP: last probe response received was corrupted *
@@ -144,7 +144,7 @@ enum ieee80211_bss_corrupt_data_flags { };/** -* enum ieee80211_valid_data_flags - BSS valid data flags +* enum ieee80211_bss_valid_data_flags - BSS valid data flags * @IEEE80211_BSS_VALID_WMM: WMM/UAPSD data was gathered from non-corrupt IE * @IEEE80211_BSS_VALID_RATES: Supported rates were gathered from non-corrupt IE * @IEEE80211_BSS_VALID_ERP: ERP flag was gathered from non-corrupt IE
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 106/336 wifi: cfg80211: fix rdev_dump_mpp() arguments order
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Igor Artemiev <[email protected]>
[ Upstream commit ec50f3114e55406a1aad24b7dfaa1c3f4336d8eb ]
Fix the order of arguments in the TP_ARGS macro
for the rdev_dump_mpp tracepoint event.
Found by Linux Verification Center (linuxtesting.org).
--- net/wireless/trace.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/wireless/trace.h +1 -1
@@ -1013,7 +1013,7 @@ TRACE_EVENT(rdev_get_mpp, TRACE_EVENT(rdev_dump_mpp, TP_PROTO(struct wiphy *wiphy, struct net_device *netdev, int _idx, u8 *dst, u8 *mpp), - TP_ARGS(wiphy, netdev, _idx, mpp, dst), + TP_ARGS(wiphy, netdev, _idx, dst, mpp), TP_STRUCT__entry( WIPHY_ENTRY NETDEV_ENTRY
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 107/336 wifi: mac80211: fix prep_connection error path
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 2e6bd24339a6ff04413b2e49c0f2672d6f0edfa5 ]
If prep_channel fails in prep_connection, the code releases the deflink's chanctx, which is wrong since we may be using a different link. It's already wrong to even do that always though, since we might still have the station. Remove it only if prep_channel succeeded and later updates fail.
--- net/mac80211/mlme.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
net/mac80211/mlme.c +3 -2
@@ -7294,7 +7294,7 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,sdata_info (sdata,"failed to insert STA entry for the AP (error %d)\n" , err); - goto out_err; + goto out_release_chan; } }else WARN_ON_ONCE (!ether_addr_equal (link->u.mgd.bssid, cbss->bssid));
@@ -7305,8 +7305,9 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,return 0 ; +out_release_chan: +ieee80211_link_release_channel (link); out_err: -ieee80211_link_release_channel (&sdata->deflink);ieee80211_vif_set_links (sdata,0 ,0 );return err; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 108/336 wifi: iwlwifi: read txq->read_ptr under lock
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit c2ace6300600c634553657785dfe5ea0ed688ac2 ]
If we read txq->read_ptr without lock, we can read the same value twice, then obtain the lock, and reclaim from there to two different places, but crucially reclaim the same entry twice, resulting in the WARN_ONCE() a little later. Fix that by reading txq->read_ptr under lock.
--- drivers/net/wireless/intel/iwlwifi/queue/tx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/queue/tx.c +1 -1
@@ -1588,9 +1588,9 @@ void iwl_txq_reclaim(struct iwl_trans *trans, int txq_id, int ssn,return ; tfd_num =iwl_txq_get_cmd_index (txq, ssn); - read_ptr =iwl_txq_get_cmd_index (txq, txq->read_ptr);spin_lock_bh (&txq->lock); + read_ptr =iwl_txq_get_cmd_index (txq, txq->read_ptr);if (!test_bit (txq_id, trans->txqs.queue_used)) { IWL_DEBUG_TX_QUEUES(trans, "Q %d inactive - ignoring idx %d\n",
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 109/336 wifi: iwlwifi: mvm: guard against invalid STA ID on removal
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Berg <[email protected]>
[ Upstream commit 17f64517bf5c26af56b6c3566273aad6646c3c4f ]
Guard against invalid station IDs in iwl_mvm_mld_rm_sta_id as that would result in out-of-bounds array accesses. This prevents issues should the driver get into a bad state during error handling.
--- drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c +6 -1
@@ -855,10 +855,15 @@ int iwl_mvm_mld_rm_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif,int iwl_mvm_mld_rm_sta_id (struct iwl_mvm *mvm,u8 sta_id) { -int ret =iwl_mvm_mld_rm_sta_from_fw (mvm, sta_id); +int ret;lockdep_assert_held (&mvm->mutex); +if (WARN_ON (sta_id ==IWL_MVM_INVALID_STA )) +return 0 ; + + ret =iwl_mvm_mld_rm_sta_from_fw (mvm, sta_id); +RCU_INIT_POINTER (mvm->fw_id_to_mac_id[sta_id],NULL );RCU_INIT_POINTER (mvm->fw_id_to_link_sta[sta_id],NULL );return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 110/336 net: mark racy access on sk->sk_rcvbuf
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: linke li <[email protected]>
[ Upstream commit c2deb2e971f5d9aca941ef13ee05566979e337a4 ]
sk->sk_rcvbuf in __sock_queue_rcv_skb() and __sk_receive_skb() can be changed by other threads. Mark this as benign using READ_ONCE().
This patch is aimed at reducing the number of benign races reported by KCSAN in order to focus future debugging effort on harmful races.
--- net/core/sock.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/core/sock.c +2 -2
@@ -482,7 +482,7 @@ int __sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)unsigned long flags;struct sk_buff_head *list = &sk->sk_receive_queue; -if (atomic_read (&sk->sk_rmem_alloc) >= sk->sk_rcvbuf) { +if (atomic_read (&sk->sk_rmem_alloc) >=READ_ONCE (sk->sk_rcvbuf)) {atomic_inc (&sk->sk_drops);trace_sock_rcvqueue_full (sk, skb);return -ENOMEM ;
@@ -552,7 +552,7 @@ int __sk_receive_skb(struct sock *sk, struct sk_buff *skb, skb->dev =NULL ; -if (sk_rcvqueues_full (sk, sk->sk_rcvbuf)) { +if (sk_rcvqueues_full (sk,READ_ONCE (sk->sk_rcvbuf))) {atomic_inc (&sk->sk_drops); goto discard_and_relse; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 111/336 drm/xe: Fix END redefinition
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lucas De Marchi <[email protected]>
[ Upstream commit 0d8cf0c924732a045273c6aca6900a340ac88529 ]
mips declares an END macro in its headers so it can't be used without namespace in a driver like xe.
Instead of coming up with a longer name, just remove the macro and replace its use with 0 since it's still clear what that means:set_offsets() was already using that implicitly when checking the data variable.
--- drivers/gpu/drm/xe/xe_lrc.c | 20 +++++++++----------- 1 file changed, 9 insertions(+), 11 deletions(-)
drivers/gpu/drm/xe/xe_lrc.c +9 -11
@@ -95,7 +95,6 @@ static void set_offsets(u32 *regs,#define REG16 (x) \ (((x) >> 9) | BIT(7) | BUILD_BUG_ON_ZERO(x >= 0x10000)), \ (((x) >> 2) & 0x7f) -#define END 0 {const u32 base = hwe->mmio_base;
@@ -166,7 +165,7 @@ static const u8 gen12_xcs_offsets[] = {REG16 (0x274 ),REG16 (0x270 ), -END +0 }; static const u8 dg2_xcs_offsets[] = {
@@ -200,7 +199,7 @@ static const u8 dg2_xcs_offsets[] = {REG16 (0x274 ),REG16 (0x270 ), -END +0 }; static const u8 gen12_rcs_offsets[] = {
@@ -296,7 +295,7 @@ static const u8 gen12_rcs_offsets[] = {REG (0x084 ),NOP (1 ), -END +0 }; static const u8 xehp_rcs_offsets[] = {
@@ -337,7 +336,7 @@ static const u8 xehp_rcs_offsets[] = {LRI (1 ,0 ),REG (0x0c8 ), -END +0 }; static const u8 dg2_rcs_offsets[] = {
@@ -380,7 +379,7 @@ static const u8 dg2_rcs_offsets[] = {LRI (1 ,0 ),REG (0x0c8 ), -END +0 }; static const u8 mtl_rcs_offsets[] = {
@@ -423,7 +422,7 @@ static const u8 mtl_rcs_offsets[] = {LRI (1 ,0 ),REG (0x0c8 ), - END + 0 };#define XE2_CTX_COMMON \
@@ -469,7 +468,7 @@ static const u8 xe2_rcs_offsets[] = {LRI (1 ,0 ),/* [0x47] */ REG (0x0c8 ),/* [0x48] R_PWR_CLK_STATE */ -END +0 }; static const u8 xe2_bcs_offsets[] = {
@@ -480,16 +479,15 @@ static const u8 xe2_bcs_offsets[] = {REG16 (0x200 ),/* [0x42] BCS_SWCTRL */ REG16 (0x204 ),/* [0x44] BLIT_CCTL */ - END + 0 };static const u8 xe2_xcs_offsets[] = {XE2_CTX_COMMON , -END +0 }; -#undef END#undef REG16#undef REG#undef LRI
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 112/336 scsi: mpi3mr: Avoid memcpy field-spanning write WARNING
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shin'ichiro Kawasaki <[email protected]>
[ Upstream commit 429846b4b6ce9853e0d803a2357bb2e55083adf0 ]
When the "storcli2 show" command is executed for eHBA-9600, mpi3mr driver prints this WARNING message:
memcpy: detected field-spanning write (size 128) of single field "bsg_reply_buf->reply_buf" at drivers/scsi/mpi3mr/mpi3mr_app.c:1658 (size 1)
WARNING: CPU: 0 PID: 12760 at drivers/scsi/mpi3mr/mpi3mr_app.c:1658 mpi3mr_bsg_request+0x6b12/0x7f10 [mpi3mr]
The cause of the WARN is 128 bytes memcpy to the 1 byte size array "__u8 replay_buf[1]" in the struct mpi3mr_bsg_in_reply_buf. The array is intended to be a flexible length array, so the WARN is a false positive.
To suppress the WARN, remove the constant number '1' from the array declaration and clarify that it has flexible length. Also, adjust the memory allocation size to match the change.
--- drivers/scsi/mpi3mr/mpi3mr_app.c | 2 +- include/uapi/scsi/scsi_bsg_mpi3mr.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/scsi/mpi3mr/mpi3mr_app.c +1 -1
@@ -1644,7 +1644,7 @@ static long mpi3mr_bsg_process_mpt_cmds(struct bsg_job *job)if ((mpirep_offset !=0xFF ) && drv_bufs[mpirep_offset].bsg_buf_len) { drv_buf_iter = &drv_bufs[mpirep_offset]; - drv_buf_iter->kern_buf_len = (sizeof (*bsg_reply_buf) -1 + + drv_buf_iter->kern_buf_len = (sizeof (*bsg_reply_buf) + mrioc->reply_sz); bsg_reply_buf =kzalloc (drv_buf_iter->kern_buf_len,GFP_KERNEL );
include/uapi/scsi/scsi_bsg_mpi3mr.h +1 -1
@@ -382,7 +382,7 @@ struct mpi3mr_bsg_in_reply_buf {__u8 mpi_reply_type;__u8 rsvd1;__u16 rsvd2; -__u8 reply_buf[1 ]; +__u8 reply_buf[]; };/**
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 113/336 scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saurav Kashyap <[email protected]>
[ Upstream commit c214ed2a4dda35b308b0b28eed804d7ae66401f9 ]
The session resources are used by FW and driver when session is offloaded, once session is uploaded these resources are not used. The lock is not required as these fields won't be used any longer. The offload and upload calls are sequential, hence lock is not required.
This will suppress following BUG_ON():
[ 449.843143] ------------[ cut here ]------------ [ 449.848302] kernel BUG at mm/vmalloc.c:2727! [ 449.853072] invalid opcode: 0000 [#1] PREEMPT SMP PTI [ 449.858712] CPU: 5 PID: 1996 Comm: kworker/u24:2 Not tainted 5.14.0-118.el9.x86_64 #1 Rebooting. [ 449.867454] Hardware name: Dell Inc. PowerEdge R730/0WCJNT, BIOS 2.3.4 11/08/2016 [ 449.876966] Workqueue: fc_rport_eq fc_rport_work [libfc] [ 449.882910] RIP: 0010:vunmap+0x2e/0x30 [ 449.887098] Code: 00 65 8b 05 14 a2 f0 4a a9 00 ff ff 00 75 1b 55 48 89 fd e8 34 36 79 00 48 85 ed 74 0b 48 89 ef 31 f6 5d e9 14 fc ff ff 5d c3 <0f> 0b 0f 1f 44 00 00 41 57 41 56 49 89 ce 41 55 49 89 fd 41 54 41 [ 449.908054] RSP: 0018:ffffb83d878b3d68 EFLAGS: 00010206 [ 449.913887] RAX: 0000000080000201 RBX: ffff8f4355133550 RCX: 000000000d400005 [ 449.921843] RDX: 0000000000000001 RSI: 0000000000001000 RDI: ffffb83da53f5000 [ 449.929808] RBP: ffff8f4ac6675800 R08: ffffb83d878b3d30 R09: 00000000000efbdf [ 449.937774] R10: 0000000000000003 R11: ffff8f434573e000 R12: 0000000000001000 [ 449.945736] R13: 0000000000001000 R14: ffffb83da53f5000 R15: ffff8f43d4ea3ae0 [ 449.953701] FS: 0000000000000000(0000) GS:ffff8f529fc80000(0000) knlGS:0000000000000000 [ 449.962732] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 449.969138] CR2: 00007f8cf993e150 CR3: 0000000efbe10003 CR4: 00000000003706e0 [ 449.977102] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 449.985065] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 449.993028] Call Trace: [ 449.995756] __iommu_dma_free+0x96/0x100 [ 450.000139] bnx2fc_free_session_resc+0x67/0x240 [bnx2fc] [ 450.006171] bnx2fc_upload_session+0xce/0x100 [bnx2fc] [ 450.011910] bnx2fc_rport_event_handler+0x9f/0x240 [bnx2fc] [ 450.018136] fc_rport_work+0x103/0x5b0 [libfc] [ 450.023103] process_one_work+0x1e8/0x3c0 [ 450.027581] worker_thread+0x50/0x3b0 [ 450.031669] ? rescuer_thread+0x370/0x370 [ 450.036143] kthread+0x149/0x170 [ 450.039744] ? set_kthread_struct+0x40/0x40 [ 450.044411] ret_from_fork+0x22/0x30 [ 450.048404] Modules linked in: vfat msdos fat xfs nfs_layout_nfsv41_files rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver dm_service_time qedf qed crc8 bnx2fc libfcoe libfc scsi_transport_fc intel_rapl_msr intel_rapl_common x86_pkg_temp_thermal intel_powerclamp dcdbas rapl intel_cstate intel_uncore mei_me pcspkr mei ipmi_ssif lpc_ich ipmi_si fuse zram ext4 mbcache jbd2 loop nfsv3 nfs_acl nfs lockd grace fscache netfs irdma ice sd_mod t10_pi sg ib_uverbs ib_core 8021q garp mrp stp llc mgag200 i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt mxm_wmi fb_sys_fops cec crct10dif_pclmul ahci crc32_pclmul bnx2x drm ghash_clmulni_intel libahci rfkill i40e libata megaraid_sas mdio wmi sunrpc lrw dm_crypt dm_round_robin dm_multipath dm_snapshot dm_bufio dm_mirror dm_region_hash dm_log dm_zero dm_mod linear raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx raid6_pq libcrc32c crc32c_intel raid1 raid0 iscsi_ibft squashfs be2iscsi bnx2i cnic uio cxgb4i cxgb4 tls [ 450.048497] libcxgbi libcxgb qla4xxx iscsi_boot_sysfs iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi edd ipmi_devintf ipmi_msghandler [ 450.159753] ---[ end trace 712de2c57c64abc8 ]---
--- drivers/scsi/bnx2fc/bnx2fc_tgt.c | 2 -- 1 file changed, 2 deletions(-)
drivers/scsi/bnx2fc/bnx2fc_tgt.c +0 -2
@@ -833,7 +833,6 @@ static void bnx2fc_free_session_resc(struct bnx2fc_hba *hba,BNX2FC_TGT_DBG (tgt,"Freeing up session resources\n" ); -spin_lock_bh (&tgt->cq_lock); ctx_base_ptr = tgt->ctx_base; tgt->ctx_base =NULL ;
@@ -889,7 +888,6 @@ static void bnx2fc_free_session_resc(struct bnx2fc_hba *hba, tgt->sq, tgt->sq_dma); tgt->sq =NULL ; } -spin_unlock_bh (&tgt->cq_lock);if (ctx_base_ptr)iounmap (ctx_base_ptr);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 114/336 btrfs: return accurate error code on open failure in open_fs_devices()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anand Jain <[email protected]>
[ Upstream commit 2f1aeab9fca1a5f583be1add175d1ee95c213cfa ]
When attempting to exclusive open a device which has no exclusive open permission, such as a physical device associated with the flakey dm device, the open operation will fail, resulting in a mount failure.
In this particular scenario, we erroneously return -EINVAL instead of the correct error code provided by the bdev_open_by_path() function, which is -EBUSY.
Fix this, by returning error code from the bdev_open_by_path() function. With this correction, the mount error message will align with that of ext4 and xfs.
--- fs/btrfs/volumes.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-)
fs/btrfs/volumes.c +12 -5
@@ -1182,23 +1182,30 @@ static int open_fs_devices(struct btrfs_fs_devices *fs_devices,struct btrfs_device *device;struct btrfs_device *latest_dev =NULL ;struct btrfs_device *tmp_device; +int ret =0 ;list_for_each_entry_safe (device, tmp_device, &fs_devices->devices, dev_list) { -int ret; +int ret2; - ret =btrfs_open_one_device (fs_devices, device, flags, holder); -if (ret ==0 && + ret2 =btrfs_open_one_device (fs_devices, device, flags, holder); +if (ret2 ==0 && (!latest_dev || device->generation > latest_dev->generation)) { latest_dev = device; - }else if (ret == -ENODATA ) { + }else if (ret2 == -ENODATA ) { fs_devices->num_devices--;list_del (&device->dev_list);btrfs_free_device (device); } +if (ret ==0 && ret2 !=0 ) + ret = ret2; } -if (fs_devices->open_devices ==0 ) + +if (fs_devices->open_devices ==0 ) { +if (ret) +return ret;return -EINVAL ; + } fs_devices->opened =1 ; fs_devices->latest_dev = latest_dev;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 115/336 drm/amdkfd: Check cgroup when returning DMABuf info
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mukul Joshi <[email protected]>
[ Upstream commit 9d7993a7ab9651afd5fb295a4992e511b2b727aa ]
Check cgroup permissions when returning DMA-buf info and based on cgroup info return the GPU id of the GPU that have access to the BO.
--- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdkfd/kfd_chardev.c +2 -2
@@ -1522,7 +1522,7 @@ static int kfd_ioctl_get_dmabuf_info(struct file *filep,/* Find a KFD GPU device that supports the get_dmabuf_info query */ for (i =0 ;kfd_topology_enum_kfd_devices (i, &dev) ==0 ; i++) -if (dev) +if (dev && !kfd_devcgroup_check_permission (dev))break ;if (!dev)return -EINVAL ;
@@ -1544,7 +1544,7 @@ static int kfd_ioctl_get_dmabuf_info(struct file *filep,if (xcp_id >=0 ) args->gpu_id = dmabuf_adev->kfd.dev->nodes[xcp_id]->id;else - args->gpu_id = dmabuf_adev->kfd.dev->nodes[0 ]->id; + args->gpu_id = dev->id; args->flags = flags;/* Copy metadata buffer to user mode */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 116/336 drm/amdkfd: range check cp bad op exception interrupts
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Kim <[email protected]>
[ Upstream commit 0cac183b98d8a8c692c98e8dba37df15a9e9210d ]
Due to a CP interrupt bug, bad packet garbage exception codes are raised. Do a range check so that the debugger and runtime do not receive garbage codes.
Update the user api to guard exception code type checking as well.
--- .../gpu/drm/amd/amdkfd/kfd_int_process_v10.c | 3 ++- .../gpu/drm/amd/amdkfd/kfd_int_process_v11.c | 3 ++- drivers/gpu/drm/amd/amdkfd/kfd_int_process_v9.c | 3 ++- include/uapi/linux/kfd_ioctl.h | 17 ++++++++++++++--- 4 files changed, 20 insertions(+), 6 deletions(-)
drivers/gpu/drm/amd/amdkfd/kfd_int_process_v10.c +2 -1
@@ -336,7 +336,8 @@ static void event_interrupt_wq_v10(struct kfd_node *dev,break ; }kfd_signal_event_interrupt (pasid, context_id0 &0x7fffff ,23 ); - }else if (source_id ==SOC15_INTSRC_CP_BAD_OPCODE ) { + }else if (source_id ==SOC15_INTSRC_CP_BAD_OPCODE && +KFD_DBG_EC_TYPE_IS_PACKET (KFD_DEBUG_CP_BAD_OP_ECODE (context_id0))) { kfd_set_dbg_ev_from_interrupt(dev, pasid, KFD_DEBUG_DOORBELL_ID(context_id0), KFD_EC_MASK(KFD_DEBUG_CP_BAD_OP_ECODE(context_id0)),
drivers/gpu/drm/amd/amdkfd/kfd_int_process_v11.c +2 -1
@@ -325,7 +325,8 @@ static void event_interrupt_wq_v11(struct kfd_node *dev,/* CP */ if (source_id ==SOC15_INTSRC_CP_END_OF_PIPE )kfd_signal_event_interrupt (pasid, context_id0,32 ); -else if (source_id ==SOC15_INTSRC_CP_BAD_OPCODE ) +else if (source_id ==SOC15_INTSRC_CP_BAD_OPCODE && +KFD_DBG_EC_TYPE_IS_PACKET (KFD_CTXID0_CP_BAD_OP_ECODE (context_id0))) kfd_set_dbg_ev_from_interrupt(dev, pasid, KFD_CTXID0_DOORBELL_ID(context_id0), KFD_EC_MASK(KFD_CTXID0_CP_BAD_OP_ECODE(context_id0)),
drivers/gpu/drm/amd/amdkfd/kfd_int_process_v9.c +2 -1
@@ -385,7 +385,8 @@ static void event_interrupt_wq_v9(struct kfd_node *dev,break ; }kfd_signal_event_interrupt (pasid, sq_int_data,24 ); - }else if (source_id ==SOC15_INTSRC_CP_BAD_OPCODE ) { + }else if (source_id ==SOC15_INTSRC_CP_BAD_OPCODE && +KFD_DBG_EC_TYPE_IS_PACKET (KFD_DEBUG_CP_BAD_OP_ECODE (context_id0))) { kfd_set_dbg_ev_from_interrupt(dev, pasid, KFD_DEBUG_DOORBELL_ID(context_id0), KFD_EC_MASK(KFD_DEBUG_CP_BAD_OP_ECODE(context_id0)),
include/uapi/linux/kfd_ioctl.h +14 -3
@@ -912,14 +912,25 @@ enum kfd_dbg_trap_exception_code { KFD_EC_MASK(EC_DEVICE_NEW))#define KFD_EC_MASK_PROCESS (KFD_EC_MASK(EC_PROCESS_RUNTIME) | \ KFD_EC_MASK(EC_PROCESS_DEVICE_REMOVE)) +#define KFD_EC_MASK_PACKET (KFD_EC_MASK(EC_QUEUE_PACKET_DISPATCH_DIM_INVALID) | \ + KFD_EC_MASK(EC_QUEUE_PACKET_DISPATCH_GROUP_SEGMENT_SIZE_INVALID) | \ + KFD_EC_MASK(EC_QUEUE_PACKET_DISPATCH_CODE_INVALID) | \ + KFD_EC_MASK(EC_QUEUE_PACKET_RESERVED) | \ + KFD_EC_MASK(EC_QUEUE_PACKET_UNSUPPORTED) | \ + KFD_EC_MASK(EC_QUEUE_PACKET_DISPATCH_WORK_GROUP_SIZE_INVALID) | \ + KFD_EC_MASK(EC_QUEUE_PACKET_DISPATCH_REGISTER_INVALID) | \ + KFD_EC_MASK(EC_QUEUE_PACKET_VENDOR_UNSUPPORTED))/* Checks for exception code types for KFD search */ +#define KFD_DBG_EC_IS_VALID (ecode) (ecode > EC_NONE && ecode < EC_MAX)#define KFD_DBG_EC_TYPE_IS_QUEUE (ecode) \ - (!!(KFD_EC_MASK(ecode) & KFD_EC_MASK_QUEUE)) + (KFD_DBG_EC_IS_VALID(ecode) && !!(KFD_EC_MASK(ecode) & KFD_EC_MASK_QUEUE))#define KFD_DBG_EC_TYPE_IS_DEVICE (ecode) \ - (!!(KFD_EC_MASK(ecode) & KFD_EC_MASK_DEVICE)) + (KFD_DBG_EC_IS_VALID(ecode) && !!(KFD_EC_MASK(ecode) & KFD_EC_MASK_DEVICE))#define KFD_DBG_EC_TYPE_IS_PROCESS (ecode) \ - (!!(KFD_EC_MASK(ecode) & KFD_EC_MASK_PROCESS)) + (KFD_DBG_EC_IS_VALID(ecode) && !!(KFD_EC_MASK(ecode) & KFD_EC_MASK_PROCESS)) +#define KFD_DBG_EC_TYPE_IS_PACKET (ecode) \ + (KFD_DBG_EC_IS_VALID(ecode) && !!(KFD_EC_MASK(ecode) & KFD_EC_MASK_PACKET))/* Runtime enable states */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 117/336 bpf: Check bloom filter map value size
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrei Matei <[email protected]>
[ Upstream commit a8d89feba7e54e691ca7c4efc2a6264fa83f3687 ]
This patch adds a missing check to bloom filter creating, rejecting values above KMALLOC_MAX_SIZE. This brings the bloom map in line with many other map types.
The lack of this protection can cause kernel crashes for value sizes that overflow int's. Such a crash was caught by syzkaller. The next patch adds more guard-rails at a lower level.
--- kernel/bpf/bloom_filter.c | 13 +++++++++++++ .../selftests/bpf/prog_tests/bloom_filter_map.c | 6 ++++++ 2 files changed, 19 insertions(+)
kernel/bpf/bloom_filter.c +13 -0
@@ -80,6 +80,18 @@ static int bloom_map_get_next_key(struct bpf_map *map, void *key, void *next_keyreturn -EOPNOTSUPP ; } +/* Called from syscall */ +static int bloom_map_alloc_check (union bpf_attr *attr) +{ +if (attr->value_size >KMALLOC_MAX_SIZE ) +/* if value_size is bigger, the user space won't be able to +* access the elements. +*/ +return -E2BIG ; + +return 0 ; +} +static struct bpf_map *bloom_map_alloc (union bpf_attr *attr) {u32 bitset_bytes, bitset_mask, nr_hash_funcs, nr_bits;
@@ -191,6 +203,7 @@ static u64 bloom_map_mem_usage(const struct bpf_map *map) BTF_ID_LIST_SINGLE(bpf_bloom_map_btf_ids, struct, bpf_bloom_filter)const struct bpf_map_ops bloom_filter_map_ops = { .map_meta_equal = bpf_map_meta_equal, + .map_alloc_check = bloom_map_alloc_check, .map_alloc = bloom_map_alloc, .map_free = bloom_map_free, .map_get_next_key = bloom_map_get_next_key,
tools/testing/selftests/bpf/prog_tests/bloom_filter_map.c +6 -0
@@ -2,6 +2,7 @@/* Copyright (c) 2021 Facebook */ #include <sys/syscall.h> +#include <limits.h> #include <test_progs.h> #include "bloom_filter_map.skel.h"
@@ -21,6 +22,11 @@ static void test_fail_cases(void)if (!ASSERT_LT (fd,0 ,"bpf_map_create bloom filter invalid value size 0" ))close (fd); +/* Invalid value size: too big */ + fd =bpf_map_create (BPF_MAP_TYPE_BLOOM_FILTER ,NULL ,0 ,INT32_MAX ,100 ,NULL ); +if (!ASSERT_LT (fd,0 ,"bpf_map_create bloom filter invalid value too large" )) +close (fd); +/* Invalid max entries size */ fd =bpf_map_create (BPF_MAP_TYPE_BLOOM_FILTER ,NULL ,0 ,sizeof (value),0 ,NULL );if (!ASSERT_LT (fd,0 ,"bpf_map_create bloom filter invalid max entries size" ))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 118/336 selftests/ftrace: Fix event filter target_func selection
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <[email protected]>
[ Upstream commit 8ecab2e64572f1aecdfc5a8feae748abda6e3347 ]
The event filter function test has been failing in our internal test farm:
| # not ok 33 event filter function - test event filtering on functions
Running the test in verbose mode indicates that this is because the test erroneously determines that kmem_cache_free() is the most common caller of kmem_cache_free():
# # + cut -d: -f3 trace
# # + sed s/call_site=([^+]*)+0x.*/1/
# # + sort
# # + uniq -c
# # + sort
# # + tail -n 1
# # + sed s/^[ 0-9]*//
# # + target_func=kmem_cache_free
... and as kmem_cache_free() doesn't call itself, setting this as the filter function for kmem_cache_free() results in no hits, and consequently the test fails:
# # + grep kmem_cache_free trace
# # + grep kmem_cache_free
# # + wc -l
# # + hitcnt=0
# # + grep kmem_cache_free trace
# # + grep -v kmem_cache_free
# # + wc -l
# # + misscnt=0
# # + [ 0 -eq 0 ]
# # + exit_fail
This seems to be because the system in question has tasks with ':' in their name (which a number of kernel worker threads have). These show up in the trace, e.g.
test:.sh-1299 [004] ..... 2886.040608: kmem_cache_free: call_site=putname+0xa4/0xc8 ptr=000000000f4d22f4 name=names_cache
... and so when we try to extact the call_site with:
cut -d: -f3 trace | sed 's/call_site=\([^+]*\)+0x.*/\1/'
... the 'cut' command will extrace the column containing 'kmem_cache_free' rather than the column containing 'call_site=...', and the 'sed' command will leave this unchanged. Consequently, the test will decide to use 'kmem_cache_free' as the filter function, resulting in the failure seen above.
Fix this by matching the 'call_site=<func>' part specifically to extract the function name.
--- .../selftests/ftrace/test.d/filter/event-filter-function.tc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/ftrace/test.d/filter/event-filter-function.tc +1 -1
@@ -24,7 +24,7 @@ echo 0 > events/enable echo "Get the most frequently calling function" sample_events -target_func=`cut -d: -f3 trace | sed 's/call_site=\([^+]*\)+0x.*/\1/' | sort | uniq -c | sort | tail -n 1 | sed 's/^[ 0-9]*//'` +target_func=`cat trace | grep -o 'call_site=\([^+]*\)' | sed 's/call_site=//' | sort | uniq -c | sort | tail -n 1 | sed 's/^[ 0-9]*//'` if [ -z "$target_func" ]; then exit_fail fi
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 119/336 kbuild: Disable KCSAN for autogenerated *.mod.c intermediaries
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov (AMD) <[email protected]>
[ Upstream commit 54babdc0343fff2f32dfaafaaa9e42c4db278204 ]
When KCSAN and CONSTRUCTORS are enabled, one can trigger the
"Unpatched return thunk in use. This should not happen!"
catch-all warning.
Usually, when objtool runs on the .o objects, it does generate a section .return_sites which contains all offsets in the objects to the return thunks of the functions present there. Those return thunks then get patched at runtime by the alternatives.
KCSAN and CONSTRUCTORS add this to the object file's .text.startup section:
-------------------
Disassembly of section .text.startup:
...
0000000000000010 <_sub_I_00099_0>:
10: f3 0f 1e fa endbr64
14: e8 00 00 00 00 call 19 <_sub_I_00099_0+0x9>
15: R_X86_64_PLT32 __tsan_init-0x4
19: e9 00 00 00 00 jmp 1e <__UNIQUE_ID___addressable_cryptd_alloc_aead349+0x6>
1a: R_X86_64_PLT32 __x86_return_thunk-0x4-------------------
which, if it is built as a module goes through the intermediary stage of creating a <module>.mod.c file which, when translated, receives a second constructor:
-------------------
Disassembly of section .text.startup:
0000000000000010 <_sub_I_00099_0>:
10: f3 0f 1e fa endbr64
14: e8 00 00 00 00 call 19 <_sub_I_00099_0+0x9>
15: R_X86_64_PLT32 __tsan_init-0x4
19: e9 00 00 00 00 jmp 1e <_sub_I_00099_0+0xe>
1a: R_X86_64_PLT32 __x86_return_thunk-0x4...
0000000000000030 <_sub_I_00099_0>:
30: f3 0f 1e fa endbr64
34: e8 00 00 00 00 call 39 <_sub_I_00099_0+0x9>
35: R_X86_64_PLT32 __tsan_init-0x4
39: e9 00 00 00 00 jmp 3e <__ksymtab_cryptd_alloc_ahash+0x2>
3a: R_X86_64_PLT32 __x86_return_thunk-0x4-------------------
in the .ko file.
Objtool has run already so that second constructor's return thunk cannot be added to the .return_sites section and thus the return thunk remains unpatched and the warning rightfully fires.
Drop KCSAN flags from the mod.c generation stage as those constructors do not contain data races one would be interested about.
Debugged together with David Kaplan <[email protected]> and Nikolay Borisov <[email protected]>.
--- scripts/Makefile.modfinal | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
scripts/Makefile.modfinal +1 -1
@@ -23,7 +23,7 @@ modname = $(notdir $(@:.mod.o=)) part-of-module = y quiet_cmd_cc_o_c = CC [M] $@ - cmd_cc_o_c = $(CC) $(filter-out $(CC_FLAGS_CFI) $(CFLAGS_GCOV), $(c_flags)) -c -o $@ $< + cmd_cc_o_c = $(CC) $(filter-out $(CC_FLAGS_CFI) $(CFLAGS_GCOV) $(CFLAGS_KCSAN), $(c_flags)) -c -o $@ $< %.mod.o: %.mod.c FORCE $(call if_changed_dep,cc_o_c)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 120/336 ASoC: SOF: Intel: hda-dsp: Skip IMR boot on ACE platforms in case of S3 suspend
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <[email protected]>
[ Upstream commit c61115b37ff964d63191dbf4a058f481daabdf57 ]
SoCs with ACE architecture are tailored to use s2idle instead deep (S3) suspend state and the IMR content is lost when the system is forced to enter even to S3.
When waking up from S3 state the IMR boot will fail as the content is lost. Set the skip_imr_boot flag to make sure that we don't try IMR in this case.
--- sound/soc/sof/intel/hda-dsp.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-)
sound/soc/sof/intel/hda-dsp.c +15 -5
@@ -681,17 +681,27 @@ static int hda_suspend(struct snd_sof_dev *sdev, bool runtime_suspend)struct sof_intel_hda_dev *hda = sdev->pdata->hw_pdata;const struct sof_intel_dsp_desc *chip = hda->desc;struct hdac_bus *bus =sof_to_bus (sdev); +bool imr_lost = false;int ret, j;/* -* The memory used for IMR boot loses its content in deeper than S3 state -* We must not try IMR boot on next power up (as it will fail). -* +* The memory used for IMR boot loses its content in deeper than S3 +* state on CAVS platforms. +* On ACE platforms due to the system architecture the IMR content is +* lost at S3 state already, they are tailored for s2idle use. +* We must not try IMR boot on next power up in these cases as it will +* fail. +*/ +if (sdev->system_suspend_target >SOF_SUSPEND_S3 || + (chip->hw_ip_version >=SOF_INTEL_ACE_1_0 && + sdev->system_suspend_target ==SOF_SUSPEND_S3 )) + imr_lost = true; + +/* * In case of firmware crash or boot failure set the skip_imr_boot to true * as well in order to try to re-load the firmware to do a 'cold' boot. */ -if (sdev->system_suspend_target >SOF_SUSPEND_S3 || - sdev->fw_state ==SOF_FW_CRASHED || +if (imr_lost || sdev->fw_state ==SOF_FW_CRASHED || sdev->fw_state ==SOF_FW_BOOT_FAILED ) hda->skip_imr_boot = true;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 121/336 regulator: tps65132: Add of_match table
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: André Apitzsch <[email protected]>
[ Upstream commit a469158eaf8f4b10263b417856d923dfa38ae96d ]
Add of_match table for "ti,tps65132" compatible string. This fixes automatic driver loading when using device-tree, and if built as a module like major linux distributions do.
--- drivers/regulator/tps65132-regulator.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/regulator/tps65132-regulator.c +7 -0
@@ -267,10 +267,17 @@ static const struct i2c_device_id tps65132_id[] = { };MODULE_DEVICE_TABLE (i2c, tps65132_id); +static const struct of_device_id __maybe_unused tps65132_of_match[] = { + { .compatible ="ti,tps65132" }, + {}, +}; +MODULE_DEVICE_TABLE (of, tps65132_of_match); +static struct i2c_driver tps65132_i2c_driver = { .driver = { .name ="tps65132" , .probe_type =PROBE_PREFER_ASYNCHRONOUS , + .of_match_table =of_match_ptr (tps65132_of_match), }, .probe = tps65132_probe, .id_table = tps65132_id,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 122/336 OSS: dmasound/paula: Mark driver struct with __refdata to prevent section mismatch
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
[ Upstream commit 755795cd3da053b0565085d9950c44d7b6cba5c4 ]
As described in the added code comment, a reference to .exit.text is ok for drivers registered via module_platform_driver_probe(). Make this explicit to prevent the following section mismatch warning
WARNING: modpost: sound/oss/dmasound/dmasound_paula: section mismatch in reference: amiga_audio_driver+0x8 (section: .data) -> amiga_audio_remove (section: .exit.text)
that triggers on an allmodconfig W=1 build.
Message-ID: <c216a129aa88f3af5c56fe6612a472f7a882f048.1711748999.git.u.kleine-koenig@pengutronix.de>
--- sound/oss/dmasound/dmasound_paula.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
sound/oss/dmasound/dmasound_paula.c +7 -1
@@ -725,7 +725,13 @@ static void __exit amiga_audio_remove(struct platform_device *pdev)dmasound_deinit (); } -static struct platform_driver amiga_audio_driver = { +/* +* amiga_audio_remove() lives in .exit.text. For drivers registered via +* module_platform_driver_probe() this is ok because they cannot get unbound at +* runtime. So mark the driver struct with __refdata to prevent modpost +* triggering a section mismatch warning. +*/ +static struct platform_driver amiga_audio_driver__refdata = { .remove_new =__exit_p (amiga_audio_remove), .driver = { .name ="amiga-audio" ,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 123/336 scsi: ufs: core: WLUN suspend dev/link state error recovery
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Wang <[email protected]>
[ Upstream commit 6bc5e70b1c792b31b497e48b4668a9a2909aca0d ]
When wl suspend error occurs, for example BKOP or SSU timeout, the host triggers an error handler and returns -EBUSY to break the wl suspend process. However, it is possible for the runtime PM to enter wl suspend again before the error handler has finished, and return -EINVAL because the device is in an error state. To address this, ensure that the rumtime PM waits for the error handler to finish, or trigger the error handler in such cases, because returning -EINVAL can cause the I/O to hang.
--- drivers/ufs/core/ufshcd.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/ufs/core/ufshcd.c +4 -1
@@ -9745,7 +9745,10 @@ static int __ufshcd_wl_suspend(struct ufs_hba *hba, enum ufs_pm_op pm_op)/* UFS device & link must be active before we enter in this function */ if (!ufshcd_is_ufs_dev_active (hba) || !ufshcd_is_link_active (hba)) { - ret = -EINVAL ; +/* Wait err handler finish or trigger err recovery */ +if (!ufshcd_eh_in_progress (hba)) +ufshcd_force_error_recovery (hba); + ret = -EBUSY ; goto enable_scaling; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 124/336 scsi: libsas: Align SMP request allocation to ARCH_DMA_MINALIGN
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yihang Li <[email protected]>
[ Upstream commit e675a4fd6d1f8990d3bed5dada3d20edfa000423 ]
This series [1] reduced the kmalloc() minimum alignment on arm64 to 8 bytes (from 128). In libsas, this will cause SMP requests to be 8-byte aligned through kmalloc() allocation. However, for hisi_sas hardware, all command addresses must be 16-byte-aligned. Otherwise, the commands fail to be executed.
ARCH_DMA_MINALIGN represents the minimum (static) alignment for safe DMA operations, so use ARCH_DMA_MINALIGN as the alignment for SMP request.
--- drivers/scsi/libsas/sas_expander.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/libsas/sas_expander.c +1 -1
@@ -135,7 +135,7 @@ static int smp_execute_task(struct domain_device *dev, void *req, int req_size,static inline void *alloc_smp_req (int size) { -u8 *p =kzalloc (size,GFP_KERNEL ); +u8 *p =kzalloc (ALIGN (size,ARCH_DMA_MINALIGN ),GFP_KERNEL );if (p) p[0 ] =SMP_REQUEST ;return p;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 125/336 scsi: ufs: core: Fix MCQ mode dev command timeout
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Wang <[email protected]>
[ Upstream commit 2a26a11e9c258b14be6fd98f8a85f20ac1fff66e ]
When a dev command times out in MCQ mode, a successfully cleared command should cause a retry. However, because we currently return 0, the caller considers the command a success which causes the following error to be
logged: "Invalid offset 0x0 in descriptor IDN 0x9, length 0x0".
Retry if clearing the command was successful.
--- drivers/ufs/core/ufshcd.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/ufs/core/ufshcd.c +3 -1
@@ -3172,7 +3172,9 @@ static int ufshcd_wait_for_dev_cmd(struct ufs_hba *hba,/* MCQ mode */ if (is_mcq_enabled (hba)) { - err =ufshcd_clear_cmd (hba, lrbp->task_tag); +/* successfully cleared the command, retry if needed */ +if (ufshcd_clear_cmd (hba, lrbp->task_tag) ==0 ) + err = -EAGAIN ; hba->dev_cmd.complete =NULL ;return err; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 126/336 ALSA: line6: Zero-initialize message buffers
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit c4e51e424e2c772ce1836912a8b0b87cd61bc9d5 ]
For shutting up spurious KMSAN uninit-value warnings, just replace kmalloc() calls with kzalloc() for the buffers used for communications. There should be no real issue with the original code, but it's still better to cover.
Message-ID: <[email protected]>
--- sound/usb/line6/driver.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
sound/usb/line6/driver.c +3 -3
@@ -202,7 +202,7 @@ int line6_send_raw_message_async(struct usb_line6 *line6, const char *buffer,struct urb *urb;/* create message: */ - msg =kmalloc (sizeof (struct message ),GFP_ATOMIC ); + msg =kzalloc (sizeof (struct message ),GFP_ATOMIC );if (msg ==NULL )return -ENOMEM ;
@@ -688,7 +688,7 @@ static int line6_init_cap_control(struct usb_line6 *line6)int ret;/* initialize USB buffers: */ - line6->buffer_listen =kmalloc (LINE6_BUFSIZE_LISTEN ,GFP_KERNEL ); + line6->buffer_listen =kzalloc (LINE6_BUFSIZE_LISTEN ,GFP_KERNEL );if (!line6->buffer_listen)return -ENOMEM ;
@@ -697,7 +697,7 @@ static int line6_init_cap_control(struct usb_line6 *line6)return -ENOMEM ;if (line6->properties->capabilities &LINE6_CAP_CONTROL_MIDI ) { - line6->buffer_message =kmalloc (LINE6_MIDI_MESSAGE_MAXLEN ,GFP_KERNEL ); + line6->buffer_message =kzalloc (LINE6_MIDI_MESSAGE_MAXLEN ,GFP_KERNEL );if (!line6->buffer_message)return -ENOMEM ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 127/336 block: fix overflow in blk_ioctl_discard()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Nan <[email protected]>
[ Upstream commit 22d24a544b0d49bbcbd61c8c0eaf77d3c9297155 ]
There is no check for overflow of 'start + len' in blk_ioctl_discard(). Hung task occurs if submit an discard ioctl with the following param:
start = 0x80000000000ff000, len = 0x8000000000fff000;
Add the overflow validation now.
--- block/ioctl.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
block/ioctl.c +3 -2
@@ -89,7 +89,7 @@ static int blk_ioctl_discard(struct block_device *bdev, blk_mode_t mode, unsigned long arg) {uint64_t range[2 ]; -uint64_t start, len; +uint64_t start, len, end;struct inode *inode = bdev->bd_inode;int err;
@@ -110,7 +110,8 @@ static int blk_ioctl_discard(struct block_device *bdev, blk_mode_t mode,if (len &511 )return -EINVAL ; -if (start + len >bdev_nr_bytes (bdev)) +if (check_add_overflow (start, len, &end) || + end >bdev_nr_bytes (bdev))return -EINVAL ;filemap_invalidate_lock (inode->i_mapping);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 128/336 ASoC: codecs: ES8326: Solve error interruption issue
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Yi <[email protected]>
[ Upstream commit 8a655cee6c9d4588570ad0cb099c5660f9a44a12 ]
We got an error report about headphone type detection and button detection. We fixed the headphone type detection error by adjusting the debounce timer configuration. And we fixed the button detection error by disabling the button detection feature when the headphone are unplugged and enabling it when headphone are plugged in.
--- sound/soc/codecs/es8326.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
sound/soc/codecs/es8326.c +5 -3
@@ -757,6 +757,7 @@ static void es8326_jack_detect_handler(struct work_struct *work)regmap_update_bits (es8326->regmap,ES8326_HPDET_TYPE ,0x03 ,0x01 );regmap_write (es8326->regmap,ES8326_SYS_BIAS ,0x0a );regmap_update_bits (es8326->regmap,ES8326_HP_DRIVER_REF ,0x0f ,0x03 ); +regmap_write (es8326->regmap,ES8326_INT_SOURCE ,ES8326_INT_SRC_PIN9 );/* * Inverted HPJACK_POL bit to trigger one IRQ to double check HP Removal event */
@@ -779,6 +780,8 @@ static void es8326_jack_detect_handler(struct work_struct *work)* set auto-check mode, then restart jack_detect_work after 400ms. * Don't report jack status. */ +regmap_write (es8326->regmap,ES8326_INT_SOURCE , + (ES8326_INT_SRC_PIN9 |ES8326_INT_SRC_BUTTON ));regmap_update_bits (es8326->regmap,ES8326_HPDET_TYPE ,0x03 ,0x01 );es8326_enable_micbias (es8326->component);usleep_range (50000 ,70000 );
@@ -901,7 +904,7 @@ static int es8326_resume(struct snd_soc_component *component)regmap_write (es8326->regmap,ES8326_VMIDSEL ,0x0E );regmap_write (es8326->regmap,ES8326_ANA_LP ,0xf0 );usleep_range (10000 ,15000 ); -regmap_write (es8326->regmap,ES8326_HPJACK_TIMER ,0xe9 ); +regmap_write (es8326->regmap,ES8326_HPJACK_TIMER ,0xd9 );regmap_write (es8326->regmap,ES8326_ANA_MICBIAS ,0xcb );/* set headphone default type and detect pin */ regmap_write (es8326->regmap,ES8326_HPDET_TYPE ,0x83 );
@@ -952,8 +955,7 @@ static int es8326_resume(struct snd_soc_component *component)es8326_enable_micbias (es8326->component);usleep_range (50000 ,70000 );regmap_update_bits (es8326->regmap,ES8326_HPDET_TYPE ,0x03 ,0x00 ); -regmap_write (es8326->regmap,ES8326_INT_SOURCE , - (ES8326_INT_SRC_PIN9 |ES8326_INT_SRC_BUTTON )); +regmap_write (es8326->regmap,ES8326_INT_SOURCE ,ES8326_INT_SRC_PIN9 );regmap_write (es8326->regmap,ES8326_INTOUT_IO , es8326->interrupt_clk); regmap_write(es8326->regmap, ES8326_SDINOUT1_IO,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 129/336 ASoC: codecs: ES8326: modify clock table
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Yi <[email protected]>
[ Upstream commit 4581468d071b64a2e3c2ae333fff82dc0391a306 ]
We got a digital microphone feature issue. And we fixed it by modifying the clock table. Also, we changed the marco ES8326_CLK_ON declaration
--- sound/soc/codecs/es8326.c | 22 +++++++++++----------- sound/soc/codecs/es8326.h | 2 +- 2 files changed, 12 insertions(+), 12 deletions(-)
sound/soc/codecs/es8326.c +11 -11
@@ -326,9 +326,9 @@ static const struct _coeff_div coeff_div_v3[] = { {125, 48000, 6000000, 0x04, 0x04, 0x1F, 0x2D, 0x8A, 0x0A, 0x27, 0x27}, {128, 8000, 1024000, 0x60, 0x00, 0x05, 0x75, 0x8A, 0x1B, 0x1F, 0x7F}, - {128, 16000, 2048000, 0x20, 0x00, 0x31, 0x35, 0x8A, 0x1B, 0x1F, 0x3F}, - {128, 44100, 5644800, 0xE0, 0x00, 0x01, 0x2D, 0xCA, 0x0A, 0x1F, 0x1F}, - {128, 48000, 6144000, 0xE0, 0x00, 0x01, 0x2D, 0xCA, 0x0A, 0x1F, 0x1F}, + {128, 16000, 2048000, 0x20, 0x00, 0x31, 0x35, 0x08, 0x19, 0x1F, 0x3F}, + {128, 44100, 5644800, 0xE0, 0x00, 0x01, 0x2D, 0x48, 0x08, 0x1F, 0x1F}, + {128, 48000, 6144000, 0xE0, 0x00, 0x01, 0x2D, 0x48, 0x08, 0x1F, 0x1F}, {144, 8000, 1152000, 0x20, 0x00, 0x03, 0x35, 0x8A, 0x1B, 0x23, 0x47}, {144, 16000, 2304000, 0x20, 0x00, 0x11, 0x35, 0x8A, 0x1B, 0x23, 0x47}, {192, 8000, 1536000, 0x60, 0x02, 0x0D, 0x75, 0x8A, 0x1B, 0x1F, 0x7F},
@@ -337,10 +337,10 @@ static const struct _coeff_div coeff_div_v3[] = { {200, 48000, 9600000, 0x04, 0x04, 0x0F, 0x2D, 0xCA, 0x0A, 0x1F, 0x1F}, {250, 48000, 12000000, 0x04, 0x04, 0x0F, 0x2D, 0xCA, 0x0A, 0x27, 0x27}, - {256, 8000, 2048000, 0x60, 0x00, 0x31, 0x35, 0x8A, 0x1B, 0x1F, 0x7F}, - {256, 16000, 4096000, 0x20, 0x00, 0x01, 0x35, 0x8A, 0x1B, 0x1F, 0x3F}, - {256, 44100, 11289600, 0xE0, 0x00, 0x30, 0x2D, 0xCA, 0x0A, 0x1F, 0x1F}, - {256, 48000, 12288000, 0xE0, 0x00, 0x30, 0x2D, 0xCA, 0x0A, 0x1F, 0x1F}, + {256, 8000, 2048000, 0x60, 0x00, 0x31, 0x35, 0x08, 0x19, 0x1F, 0x7F}, + {256, 16000, 4096000, 0x20, 0x00, 0x01, 0x35, 0x08, 0x19, 0x1F, 0x3F}, + {256, 44100, 11289600, 0xE0, 0x01, 0x01, 0x2D, 0x48, 0x08, 0x1F, 0x1F}, + {256, 48000, 12288000, 0xE0, 0x01, 0x01, 0x2D, 0x48, 0x08, 0x1F, 0x1F}, {288, 8000, 2304000, 0x20, 0x00, 0x01, 0x35, 0x8A, 0x1B, 0x23, 0x47}, {384, 8000, 3072000, 0x60, 0x02, 0x05, 0x75, 0x8A, 0x1B, 0x1F, 0x7F}, {384, 16000, 6144000, 0x20, 0x02, 0x03, 0x35, 0x8A, 0x1B, 0x1F, 0x3F},
@@ -349,10 +349,10 @@ static const struct _coeff_div coeff_div_v3[] = { {400, 48000, 19200000, 0xE4, 0x04, 0x35, 0x6d, 0xCA, 0x0A, 0x1F, 0x1F}, {500, 48000, 24000000, 0xF8, 0x04, 0x3F, 0x6D, 0xCA, 0x0A, 0x1F, 0x1F}, - {512, 8000, 4096000, 0x60, 0x00, 0x01, 0x35, 0x8A, 0x1B, 0x1F, 0x7F}, - {512, 16000, 8192000, 0x20, 0x00, 0x30, 0x35, 0x8A, 0x1B, 0x1F, 0x3F}, - {512, 44100, 22579200, 0xE0, 0x00, 0x00, 0x2D, 0xCA, 0x0A, 0x1F, 0x1F}, - {512, 48000, 24576000, 0xE0, 0x00, 0x00, 0x2D, 0xCA, 0x0A, 0x1F, 0x1F}, + {512, 8000, 4096000, 0x60, 0x00, 0x01, 0x08, 0x19, 0x1B, 0x1F, 0x7F}, + {512, 16000, 8192000, 0x20, 0x00, 0x30, 0x35, 0x08, 0x19, 0x1F, 0x3F}, + {512, 44100, 22579200, 0xE0, 0x00, 0x00, 0x2D, 0x48, 0x08, 0x1F, 0x1F}, + {512, 48000, 24576000, 0xE0, 0x00, 0x00, 0x2D, 0x48, 0x08, 0x1F, 0x1F}, {768, 8000, 6144000, 0x60, 0x02, 0x11, 0x35, 0x8A, 0x1B, 0x1F, 0x7F}, {768, 16000, 12288000, 0x20, 0x02, 0x01, 0x35, 0x8A, 0x1B, 0x1F, 0x3F}, {768, 32000, 24576000, 0xE0, 0x02, 0x30, 0x2D, 0xCA, 0x0A, 0x1F, 0x1F},
sound/soc/codecs/es8326.h +1 -1
@@ -101,7 +101,7 @@#define ES8326_MUTE (3 << 0)/* ES8326_CLK_CTL */ -#define ES8326_CLK_ON (0x7e << 0) +#define ES8326_CLK_ON (0x7f << 0)#define ES8326_CLK_OFF (0 << 0)/* ES8326_CLK_INV */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 130/336 net: bcmgenet: Reset RBUF on first open
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phil Elwell <[email protected]>
[ Upstream commit 0a6380cb4c6b5c1d6dad226ba3130f9090f0ccea ]
If the RBUF logic is not reset when the kernel starts then there may be some data left over from any network boot loader. If the 64-byte packet headers are enabled then this can be fatal.
Extend bcmgenet_dma_disable to do perform the reset, but not when called from bcmgenet_resume in order to preserve a wake packet.
N.B. This different handling of resume is just based on a hunch - why else wouldn't one reset the RBUF as well as the TBUF? If this isn't the case then it's easy to change the patch to make the RBUF reset unconditional.
See: https://github.com/raspberrypi/linux/issues/3850
See: https://github.com/raspberrypi/firmware/issues/1882
--- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
drivers/net/ethernet/broadcom/genet/bcmgenet.c +12 -4
@@ -3282,7 +3282,7 @@ static void bcmgenet_get_hw_addr(struct bcmgenet_priv *priv, }/* Returns a reusable dma control register value */ -static u32 bcmgenet_dma_disable (struct bcmgenet_priv *priv) +static u32 bcmgenet_dma_disable (struct bcmgenet_priv *priv,bool flush_rx) {unsigned int i;u32 reg;
@@ -3307,6 +3307,14 @@ static u32 bcmgenet_dma_disable(struct bcmgenet_priv *priv)udelay (10 );bcmgenet_umac_writel (priv,0 ,UMAC_TX_FLUSH ); +if (flush_rx) { + reg =bcmgenet_rbuf_ctrl_get (priv); +bcmgenet_rbuf_ctrl_set (priv, reg |BIT (0 )); +udelay (10 ); +bcmgenet_rbuf_ctrl_set (priv, reg); +udelay (10 ); + } +return dma_ctrl; }
@@ -3370,8 +3378,8 @@ static int bcmgenet_open(struct net_device *dev)bcmgenet_set_hw_addr (priv, dev->dev_addr); -/* Disable RX/TX DMA and flush TX queues */ - dma_ctrl =bcmgenet_dma_disable (priv); +/* Disable RX/TX DMA and flush TX and RX queues */ + dma_ctrl =bcmgenet_dma_disable (priv, true);/* Reinitialize TDMA and RDMA and SW housekeeping */ ret =bcmgenet_init_dma (priv);
@@ -4237,7 +4245,7 @@ static int bcmgenet_resume(struct device *d)bcmgenet_hfb_create_rxnfc_filter (priv, rule);/* Disable RX/TX DMA and flush TX queues */ - dma_ctrl =bcmgenet_dma_disable (priv); + dma_ctrl =bcmgenet_dma_disable (priv, false);/* Reinitialize TDMA and RDMA and SW housekeeping */ ret =bcmgenet_init_dma (priv);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 131/336 vboxsf: explicitly deny setlease attempts
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <[email protected]>
[ Upstream commit 1ece2c43b88660ddbdf8ecb772e9c41ed9cda3dd ]
vboxsf does not break leases on its own, so it can't properly handle the case where the hypervisor changes the data. Don't allow file leases on vboxsf.
--- fs/vboxsf/file.c | 1 + 1 file changed, 1 insertion(+)
fs/vboxsf/file.c +1 -0
@@ -218,6 +218,7 @@ const struct file_operations vboxsf_reg_fops = { .release = vboxsf_file_release, .fsync = noop_fsync, .splice_read = filemap_splice_read, + .setlease = simple_nosetlease, };const struct inode_operations vboxsf_reg_iops = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 132/336 ata: sata_gemini: Check clk_enable() result
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ni <[email protected]>
[ Upstream commit e85006ae7430aef780cc4f0849692e266a102ec0 ]
The call to clk_enable() in gemini_sata_start_bridge() can fail. Add a check to detect such failure.
--- drivers/ata/sata_gemini.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/ata/sata_gemini.c +4 -1
@@ -200,7 +200,10 @@ int gemini_sata_start_bridge(struct sata_gemini *sg, unsigned int bridge) pclk = sg->sata0_pclk; else pclk = sg->sata1_pclk; -clk_enable (pclk); + ret =clk_enable (pclk); +if (ret) +return ret; +msleep (10 );/* Do not keep clocking a bridge that is not online */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 133/336 firewire: ohci: mask bus reset interrupts between ISR and bottom half
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adam Goldman <[email protected]>
[ Upstream commit 752e3c53de0fa3b7d817a83050b6699b8e9c6ec9 ]
In the FireWire OHCI interrupt handler, if a bus reset interrupt has occurred, mask bus reset interrupts until bus_reset_work has serviced and cleared the interrupt.
Normally, we always leave bus reset interrupts masked. We infer the bus reset from the self-ID interrupt that happens shortly thereafter. A scenario where we unmask bus reset interrupts was introduced in 2008 in a007bb857e0b26f5d8b73c2ff90782d9c0972620: If OHCI_PARAM_DEBUG_BUSRESETS (8) is set in the debug parameter bitmask, we will unmask bus reset interrupts so we can log them.
irq_handler logs the bus reset interrupt. However, we can't clear the bus reset event flag in irq_handler, because we won't service the event until later. irq_handler exits with the event flag still set. If the corresponding interrupt is still unmasked, the first bus reset will usually freeze the system due to irq_handler being called again each time it exits. This freeze can be reproduced by loading firewire_ohci with "modprobe firewire_ohci debug=-1" (to enable all debugging output). Apparently there are also some cases where bus_reset_work will get called soon enough to clear the event, and operation will continue normally.
This freeze was first reported a few months after a007bb85 was committed, but until now it was never fixed. The debug level could safely be set to -1 through sysfs after the module was loaded, but this would be ineffectual in logging bus reset interrupts since they were only unmasked during initialization.
irq_handler will now leave the event flag set but mask bus reset interrupts, so irq_handler won't be called again and there will be no freeze. If OHCI_PARAM_DEBUG_BUSRESETS is enabled, bus_reset_work will unmask the interrupt after servicing the event, so future interrupts will be caught as desired.
As a side effect to this change, OHCI_PARAM_DEBUG_BUSRESETS can now be enabled through sysfs in addition to during initial module loading. However, when enabled through sysfs, logging of bus reset interrupts will be effective only starting with the second bus reset, after bus_reset_work has executed.
--- drivers/firewire/ohci.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/firewire/ohci.c +5 -1
@@ -2060,6 +2060,8 @@ static void bus_reset_work(struct work_struct *work) ohci->generation = generation;reg_write (ohci, OHCI1394_IntEventClear, OHCI1394_busReset); +if (param_debug &OHCI_PARAM_DEBUG_BUSRESETS ) +reg_write (ohci, OHCI1394_IntMaskSet, OHCI1394_busReset);if (ohci->quirks &QUIRK_RESET_PACKET ) ohci->request_generation = generation;
@@ -2125,12 +2127,14 @@ static irqreturn_t irq_handler(int irq, void *data)return IRQ_NONE ;/* -* busReset and postedWriteErr must not be cleared yet +* busReset and postedWriteErr events must not be cleared yet * (OHCI 1.1 clauses 7.2.3.2 and 13.2.8.1) */ reg_write (ohci, OHCI1394_IntEventClear, event & ~(OHCI1394_busReset | OHCI1394_postedWriteErr));log_irqs (ohci, event); +if (event & OHCI1394_busReset) +reg_write (ohci, OHCI1394_IntMaskClear, OHCI1394_busReset);if (event & OHCI1394_selfIDComplete)queue_work (selfid_workqueue, &ohci->bus_reset_work);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 134/336 tools/power turbostat: Fix added raw MSR output
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Doug Smythies <[email protected]>
[ Upstream commit e5f4e68eed85fa8495d78cd966eecc2b27bb9e53 ]
When using --Summary mode, added MSRs in raw mode always print zeros. Print the actual register contents.
Example, with patch:
note the added column:
--add msr0x64f,u32,package,raw,REASON
Where:
0x64F is MSR_CORE_PERF_LIMIT_REASONS
Busy% Bzy_MHz PkgTmp PkgWatt CorWatt REASON 0.00 4800 35 1.42 0.76 0x00000000 0.00 4801 34 1.42 0.76 0x00000000 80.08 4531 66 108.17 107.52 0x08000000 98.69 4530 66 133.21 132.54 0x08000000 99.28 4505 66 128.26 127.60 0x0c000400 99.65 4486 68 124.91 124.25 0x0c000400 99.63 4483 68 124.90 124.25 0x0c000400 79.34 4481 41 99.80 99.13 0x0c000000 0.00 4801 41 1.40 0.73 0x0c000000
Where, for the test processor (i5-10600K):
PKG Limit #1: 125.000 Watts, 8.000000 sec
MSR bit 26 = log; bit 10 = status
PKG Limit #2: 136.000 Watts, 0.002441 sec
MSR bit 27 = log; bit 11 = status
Example, without patch:
Busy% Bzy_MHz PkgTmp PkgWatt CorWatt REASON 0.01 4800 35 1.43 0.77 0x00000000 0.00 4801 35 1.39 0.73 0x00000000 83.49 4531 66 112.71 112.06 0x00000000 98.69 4530 68 133.35 132.69 0x00000000 99.31 4500 67 127.96 127.30 0x00000000 99.63 4483 69 124.91 124.25 0x00000000 99.61 4481 69 124.90 124.25 0x00000000 99.61 4481 71 124.92 124.25 0x00000000 59.35 4479 42 75.03 74.37 0x00000000 0.00 4800 42 1.39 0.73 0x00000000 0.00 4801 42 1.42 0.76 0x00000000
c000000
[lenb: simplified patch to apply only to package scope]
--- tools/power/x86/turbostat/turbostat.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
tools/power/x86/turbostat/turbostat.c +4 -3
@@ -2444,9 +2444,10 @@ int sum_counters(struct thread_data *t, struct core_data *c, struct pkg_data *p) average.packages.rapl_dram_perf_status += p->rapl_dram_perf_status;for (i =0 , mp = sys.pp; mp; i++, mp = mp->next) { -if (mp->format ==FORMAT_RAW ) -continue ; - average.packages.counter[i] += p->counter[i]; +if ((mp->format ==FORMAT_RAW ) && (topo.num_packages ==0 )) + average.packages.counter[i] = p->counter[i]; +else + average.packages.counter[i] += p->counter[i]; }return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 135/336 tools/power turbostat: Increase the limit for fd opened
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wyes Karny <[email protected]>
[ Upstream commit 3ac1d14d0583a2de75d49a5234d767e2590384dd ]
When running turbostat, a system with 512 cpus reaches the limit for maximum number of file descriptors that can be opened. To solve this problem, the limit is raised to 2^15, which is a large enough number.
Below data is collected from AMD server systems while running turbostat:
|-----------+-------------------------------| | # of cpus | # of opened fds for turbostat | |-----------+-------------------------------| | 128 | 260 | |-----------+-------------------------------| | 192 | 388 | |-----------+-------------------------------| | 512 | 1028 | |-----------+-------------------------------|
So, the new max limit would be sufficient up to 2^14 cpus (but this also depends on how many counters are enabled).
--- tools/power/x86/turbostat/turbostat.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+)
tools/power/x86/turbostat/turbostat.c +21 -0
@@ -53,6 +53,8 @@#define NAME_BYTES 20#define PATH_BYTES 128 +#define MAX_NOFILE 0x8000 +enum counter_scope {SCOPE_CPU ,SCOPE_CORE ,SCOPE_PACKAGE };enum counter_type {COUNTER_ITEMS ,COUNTER_CYCLES ,COUNTER_SECONDS ,COUNTER_USEC };enum counter_format {FORMAT_RAW ,FORMAT_DELTA ,FORMAT_PERCENT };
@@ -6705,6 +6707,22 @@ void cmdline(int argc, char **argv) } } +void set_rlimit (void ) +{ +struct rlimit limit; + +if (getrlimit (RLIMIT_NOFILE , &limit) <0 ) +err (1 ,"Failed to get rlimit" ); + +if (limit.rlim_max <MAX_NOFILE ) + limit.rlim_max =MAX_NOFILE ; +if (limit.rlim_cur <MAX_NOFILE ) + limit.rlim_cur =MAX_NOFILE ; + +if (setrlimit (RLIMIT_NOFILE , &limit) <0 ) +err (1 ,"Failed to set rlimit" ); +} +int main (int argc,char **argv) {int fd, ret;
@@ -6730,6 +6748,9 @@ int main(int argc, char **argv)probe_sysfs (); +if (!getuid ()) +set_rlimit (); +turbostat_init ();msr_sum_record ();
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 136/336 tools/power turbostat: Fix Bzy_MHz documentation typo
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Liu <[email protected]>
[ Upstream commit 0b13410b52c4636aacb6964a4253a797c0fa0d16 ]
The code calculates Bzy_MHz by multiplying TSC_delta * APERF_delta/MPERF_delta The man page erroneously showed that TSC_delta was divided.
--- tools/power/x86/turbostat/turbostat.8 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/power/x86/turbostat/turbostat.8 +1 -1
@@ -370,7 +370,7 @@ below the processor's base frequency. Busy% = MPERF_delta/TSC_delta -Bzy_MHz = TSC_delta/APERF_delta/MPERF_delta/measurement_interval +Bzy_MHz = TSC_delta*APERF_delta/MPERF_delta/measurement_interval Note that these calculations depend on TSC_delta, so they are not reliable during intervals when TSC_MHz is not running at the base frequency.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 137/336 tools/power turbostat: Do not print negative LPI residency
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Yu <[email protected]>
[ Upstream commit 227ed18f456a68bbb69807294a9089208663a6d3 ]
turbostat prints the abnormal SYS%LPI across suspend-to-idle:
SYS%LPI = 114479815993277.50
This is reproduced by:
Run a freeze cycle, e.g. "sleepgraph -m freeze -rtcwake 15". Then do a reboot. After boot up, launch the suspend-idle-idle and check the SYS%LPI field.
The slp_so residence counter is in LPIT table, and BIOS does not clears this register across reset. The PMC expects the OS to calculate the LPI residency based on the delta. However, there is an firmware issue that the LPIT gets cleared to 0 during the second suspend to idle after the reboot, which brings negative delta value.
[lenb: updated to print "neg" upon this BIOS failure]
--- tools/power/x86/turbostat/turbostat.c | 30 +++++++++++++++++++-------- 1 file changed, 21 insertions(+), 9 deletions(-)
tools/power/x86/turbostat/turbostat.c +21 -9
@@ -991,8 +991,8 @@ struct pkg_data {unsigned long long pc8;unsigned long long pc9;unsigned long long pc10; -unsigned long long cpu_lpi; -unsigned long long sys_lpi; +long long cpu_lpi; +long long sys_lpi;unsigned long long pkg_wtd_core_c0;unsigned long long pkg_any_core_c0;unsigned long long pkg_any_gfxe_c0;
@@ -1978,12 +1978,22 @@ int format_counters(struct thread_data *t, struct core_data *c, struct pkg_dataif (DO_BIC (BIC_Pkgpc10)) outp +=sprintf (outp,"%s%.2f" , (printed++ ? delim :"" ),100.0 * p->pc10 / tsc); -if (DO_BIC (BIC_CPU_LPI )) - outp += -sprintf (outp,"%s%.2f" , (printed++ ? delim :"" ),100.0 * p->cpu_lpi /1000000.0 / interval_float); -if (DO_BIC (BIC_SYS_LPI )) - outp += -sprintf (outp,"%s%.2f" , (printed++ ? delim :"" ),100.0 * p->sys_lpi /1000000.0 / interval_float); +if (DO_BIC (BIC_CPU_LPI )) { +if (p->cpu_lpi >=0 ) + outp += +sprintf (outp,"%s%.2f" , (printed++ ? delim :"" ), +100.0 * p->cpu_lpi /1000000.0 / interval_float); +else + outp +=sprintf (outp,"%s(neg)" , (printed++ ? delim :"" )); + } +if (DO_BIC (BIC_SYS_LPI )) { +if (p->sys_lpi >=0 ) + outp += +sprintf (outp,"%s%.2f" , (printed++ ? delim :"" ), +100.0 * p->sys_lpi /1000000.0 / interval_float); +else + outp +=sprintf (outp,"%s(neg)" , (printed++ ? delim :"" )); + }if (DO_BIC (BIC_PkgWatt)) outp +=
@@ -3832,7 +3842,8 @@ void re_initialize(void) {free_all_buffers ();setup_all_buffers (false); -fprintf (outf,"turbostat: re-initialized with num_cpus %d, allowed_cpus %d\n" , topo.num_cpus, topo.allowed_cpus); +fprintf (outf,"turbostat: re-initialized with num_cpus %d, allowed_cpus %d\n" , topo.num_cpus, + topo.allowed_cpus); }void set_max_cpu_num (void )
@@ -6145,6 +6156,7 @@ void topology_update(void) topo.allowed_packages =0 ;for_all_cpus (update_topo,ODD_COUNTERS ); } +void setup_all_buffers (bool startup) {topology_probe (startup);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 138/336 tools/power turbostat: Expand probe_intel_uncore_frequency()
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Len Brown <[email protected]>
[ Upstream commit bb6181fa6bc942aac3f7f2fa8e3831952a2ef118 ]
Print current frequency along with the current (and initial) limits
Probe and print uncore config also for machines using the new cluster API
--- tools/power/x86/turbostat/turbostat.c | 84 ++++++++++++++++++++------- 1 file changed, 63 insertions(+), 21 deletions(-)
tools/power/x86/turbostat/turbostat.c +63 -21
@@ -4581,20 +4581,15 @@ static void dump_sysfs_file(char *path)static void probe_intel_uncore_frequency (void ) {int i, j; -char path[128 ]; +char path[256 ];if (!genuine_intel)return ; -if (access ("/sys/devices/system/cpu/intel_uncore_frequency/package_00_die_00" ,R_OK )) -return ; - -/* Cluster level sysfs not supported yet. */ -if (!access ("/sys/devices/system/cpu/intel_uncore_frequency/uncore00" ,R_OK )) -return ; +if (access ("/sys/devices/system/cpu/intel_uncore_frequency/package_00_die_00/current_freq_khz" ,R_OK )) + goto probe_cluster; -if (!access ("/sys/devices/system/cpu/intel_uncore_frequency/package_00_die_00/current_freq_khz" ,R_OK )) -BIC_PRESENT (BIC_UNCORE_MHZ ); +BIC_PRESENT (BIC_UNCORE_MHZ );if (quiet)return ;
@@ -4602,26 +4597,73 @@ static void probe_intel_uncore_frequency(void)for (i =0 ; i < topo.num_packages; ++i) {for (j =0 ; j < topo.num_die; ++j) {int k, l; +char path_base[128 ]; + +sprintf (path_base,"/sys/devices/system/cpu/intel_uncore_frequency/package_%02d_die_%02d" , i, + j); -sprintf (path,"/sys/devices/system/cpu/intel_uncore_frequency/package_0%d_die_0%d/min_freq_khz" , - i, j); +sprintf (path,"%s/min_freq_khz" , path_base); k =read_sysfs_int (path); -sprintf (path,"/sys/devices/system/cpu/intel_uncore_frequency/package_0%d_die_0%d/max_freq_khz" , - i, j); +sprintf (path,"%s/max_freq_khz" , path_base); l =read_sysfs_int (path); -fprintf (outf,"Uncore Frequency pkg%d die%d: %d - %d MHz " , i, j, k /1000 , l /1000 ); +fprintf (outf,"Uncore Frequency package%d die%d: %d - %d MHz " , i, j, k /1000 , l /1000 ); -sprintf (path, -"/sys/devices/system/cpu/intel_uncore_frequency/package_0%d_die_0%d/initial_min_freq_khz" , - i, j); +sprintf (path,"%s/initial_min_freq_khz" , path_base); k =read_sysfs_int (path); -sprintf (path, -"/sys/devices/system/cpu/intel_uncore_frequency/package_0%d_die_0%d/initial_max_freq_khz" , - i, j); +sprintf (path,"%s/initial_max_freq_khz" , path_base); l =read_sysfs_int (path); -fprintf (outf,"(%d - %d MHz)\n" , k /1000 , l /1000 ); +fprintf (outf,"(%d - %d MHz)" , k /1000 , l /1000 ); + +sprintf (path,"%s/current_freq_khz" , path_base); + k =read_sysfs_int (path); +fprintf (outf," %d MHz\n" , k /1000 ); } } +return ; + +probe_cluster: +if (access ("/sys/devices/system/cpu/intel_uncore_frequency/uncore00/current_freq_khz" ,R_OK )) +return ; + +if (quiet) +return ; + +for (i =0 ;; ++i) { +int k, l; +char path_base[128 ]; +int package_id, domain_id, cluster_id; + +sprintf (path_base,"/sys/devices/system/cpu/intel_uncore_frequency/uncore%02d" , i); + +if (access (path_base,R_OK )) +break ; + +sprintf (path,"%s/package_id" , path_base); + package_id =read_sysfs_int (path); + +sprintf (path,"%s/domain_id" , path_base); + domain_id =read_sysfs_int (path); + +sprintf (path,"%s/fabric_cluster_id" , path_base); + cluster_id =read_sysfs_int (path); + +sprintf (path,"%s/min_freq_khz" , path_base); + k =read_sysfs_int (path); +sprintf (path,"%s/max_freq_khz" , path_base); + l =read_sysfs_int (path); +fprintf (outf,"Uncore Frequency package%d domain%d cluster%d: %d - %d MHz " , package_id, domain_id, + cluster_id, k /1000 , l /1000 ); + +sprintf (path,"%s/initial_min_freq_khz" , path_base); + k =read_sysfs_int (path); +sprintf (path,"%s/initial_max_freq_khz" , path_base); + l =read_sysfs_int (path); +fprintf (outf,"(%d - %d MHz)" , k /1000 , l /1000 ); + +sprintf (path,"%s/current_freq_khz" , path_base); + k =read_sysfs_int (path); +fprintf (outf," %d MHz\n" , k /1000 ); + } }static void probe_graphics (void )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 139/336 tools/power turbostat: Print ucode revision only if valid
In reply to Greg Kroah-Hartman6.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patryk Wlazlyn <[email protected]>
[ Upstream commit fb5ceca046efc84f69fcf9779a013f8a0e63bbff ]
If the MSR read were to fail, turbostat would print "microcode 0x0"
--- tools/power/x86/turbostat/turbostat.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
tools/power/x86/turbostat/turbostat.c +9 -3
@@ -5679,6 +5679,7 @@ void process_cpuid()unsigned int eax, ebx, ecx, edx;unsigned int fms, family, model, stepping, ecx_flags, edx_flags;unsigned long long ucode_patch =0 ; +bool ucode_patch_valid = false; eax = ebx = ecx = edx =0 ;
@@ -5708,6 +5709,8 @@ void process_cpuid()if (get_msr (sched_getcpu (),MSR_IA32_UCODE_REV , &ucode_patch))warnx ("get_msr(UCODE)" ); +else + ucode_patch_valid = true;/* * check max extended function levels of CPUID.
@@ -5718,9 +5721,12 @@ void process_cpuid()__cpuid (0x80000000 , max_extended_level, ebx, ecx, edx);if (!quiet) { -fprintf (outf,"CPUID(1): family:model:stepping 0x%x:%x:%x (%d:%d:%d) microcode 0x%x\n" , - family, model, stepping, family, model, stepping, - (unsigned int )((ucode_patch >>32 ) &0xFFFFFFFF )); +fprintf (outf,"CPUID(1): family:model:stepping 0x%x:%x:%x (%d:%d:%d)" , + family, model, stepping, family, model, stepping); +if (ucode_patch_valid) +fprintf (outf," microcode 0x%x" , (unsigned int )((ucode_patch >>32 ) &0xFFFFFFFF )); +fputc ('\n' , outf); +fprintf (outf,"CPUID(0x80000000): max_extended_levels: 0x%x\n" , max_extended_level); fprintf(outf, "CPUID(1): %s %s %s %s %s %s %s %s %s %s\n", ecx_flags & (1 << 0) ? "SSE3" : "-",
Signature · 1 line
2.43.0