5.10.219-rc1 review
Subsystems (4)
Greg Kroah-Hartman
maintainercover 5.10.219-rc1 review
This is the start of the stable review cycle for the 5.10.219 release. There are 317 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 15 Jun 2024 11:31:50 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.219-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.10.219-rc1
Chengchang Tang <[email protected]>
RDMA/hns: Fix CQ and QP cache affinity
Yangyang Li <[email protected]>
RDMA/hns: Use mutex instead of spinlock for ida allocation
Chao Yu <[email protected]>
f2fs: compress: fix compression chksum
Neil Armstrong <[email protected]>
scsi: ufs: ufs-qcom: Clear qunipro_g4_sel for HW major version > 5
Anna Schumaker <[email protected]>
NFS: Fix READ_PLUS when server doesn't support OP_READ_PLUS
Sergey Shtylyov <[email protected]>
nfs: fix undefined behavior in nfs_block_bits()
Harald Freudenberger <[email protected]>
s390/ap: Fix crash in AP internal function modify_bitmap()
Baokun Li <[email protected]>
ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find()
Mike Gilbert <[email protected]>
sparc: move struct termio to asm/termios.h
Eric Dumazet <[email protected]>
net: fix __dst_negative_advice() race
Daniel Thompson <[email protected]>
kdb: Use format-specifiers rather than memset() for padding in kdb_read()
Daniel Thompson <[email protected]>
kdb: Merge identical case statements in kdb_read()
Daniel Thompson <[email protected]>
kdb: Fix console handling when editing and tab-completing commands
Daniel Thompson <[email protected]>
kdb: Use format-strings rather than '\0' injection in kdb_read()
Daniel Thompson <[email protected]>
kdb: Fix buffer overflow during tab-complete
Judith Mendez <[email protected]>
watchdog: rti_wdt: Set min_hw_heartbeat_ms to accommodate a safety margin
Sam Ravnborg <[email protected]>
sparc64: Fix number of online CPUs
Alexander Shishkin <[email protected]>
intel_th: pci: Add Meteor Lake-S CPU support
Nikita Zhandarovich <[email protected]>
net/9p: fix uninit-value in p9_client_rpc()
xu xin <[email protected]>
net/ipv6: Fix route deleting failure when metric equals 0
Herbert Xu <[email protected]>
crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak
Vitaly Chikunov <[email protected]>
crypto: ecrdsa - Fix module auto-load on add_key
Marc Zyngier <[email protected]>
KVM: arm64: Allow AArch32 PSTATE.M to be restored as System mode
Cai Xinchen <[email protected]>
fbdev: savage: Handle err return when savagefb_check_var failed
Hans de Goede <[email protected]>
mmc: sdhci-acpi: Disable write protect detection on Toshiba WT10-A
Hans de Goede <[email protected]>
mmc: sdhci-acpi: Fix Lenovo Yoga Tablet 2 Pro 1380 sdcard slot not working
Hans de Goede <[email protected]>
mmc: sdhci-acpi: Sort DMI quirks alphabetically
Hans de Goede <[email protected]>
mmc: core: Add mmc_gpiod_set_cd_config() function
Hans Verkuil <[email protected]>
media: v4l2-core: hold videodev_lock until dev reg, finishes
Nathan Chancellor <[email protected]>
media: mxl5xx: Move xpt structures off stack
Hans Verkuil <[email protected]>
media: mc: mark the media devnode as registered from the, start
Yang Xiwen <[email protected]>
arm64: dts: hi3798cv200: fix the size of GICR
Bitterblue Smith <[email protected]>
wifi: rtlwifi: rtl8192de: Fix endianness issue in RX path
Bitterblue Smith <[email protected]>
wifi: rtlwifi: rtl8192de: Fix low speed with WPA3-SAE
Bitterblue Smith <[email protected]>
wifi: rtl8xxxu: Fix the TX power of RTL8192CU, RTL8723AU
Yu Kuai <[email protected]>
md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING
Johan Hovold <[email protected]>
arm64: dts: qcom: qcs404: fix bluetooth device address
Krzysztof Kozlowski <[email protected]>
arm64: tegra: Correct Tegra132 I2C alias
Christoffer Sandberg <[email protected]>
ACPI: resource: Do IRQ override on TongFang GXxHRXx and GMxHGxx
Sergey Shtylyov <[email protected]>
ata: pata_legacy: make legacy_exit() work again
Bob Zhou <[email protected]>
drm/amdgpu: add error handle to avoid out-of-bounds
Zheyu Ma <[email protected]>
media: lgdt3306a: Add a check against null-pointer-def
Chao Yu <[email protected]>
f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode()
Ziyang Xuan <[email protected]>
netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: restrict tunnel object to NFPROTO_NETDEV
Linus Torvalds <[email protected]>
x86/mm: Remove broken vsyscall emulation code from the page fault code
Daniel Borkmann <[email protected]>
vxlan: Fix regression when dropping packets due to invalid src addresses
Ryusuke Konishi <[email protected]>
nilfs2: fix use-after-free of timer for log writer thread
Marc Dionne <[email protected]>
afs: Don't cross .backup mountpoint from backup volume
Ming Lei <[email protected]>
io_uring: fail NOP if non-zero op flags is passed in
Jorge Ramirez-Ortiz <[email protected]>
mmc: core: Do not force a retune before RPMB switch
Carlos Llamas <[email protected]>
binder: fix max_thread type inconsistency
Chuck Lever <[email protected]>
SUNRPC: Fix loop termination condition in gss_free_in_token_pages()
Hans Verkuil <[email protected]>
media: cec: core: add adap_nb_transmit_canceled() callback
Dongli Zhang <[email protected]>
genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline
Takashi Iwai <[email protected]>
ALSA: timer: Set lower bound of start tick time
Guenter Roeck <[email protected]>
hwmon: (shtc1) Fix property misspelling
Christophe Leroy <[email protected]>
powerpc/uaccess: Use asm goto for get_user when compiler supports it
Yue Haibing <[email protected]>
ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outboundUwe Kleine-König <[email protected]>
spi: stm32: Don't warn about spurious interrupts
Masahiro Yamada <[email protected]>
kconfig: fix comparison to constant symbols, 'm', 'n'
Florian Westphal <[email protected]>
netfilter: tproxy: bail out if IP has been disabled on the device
Xiaolei Wang <[email protected]>
net:fec: Add fec_enet_deinit()
Jakub Sitnicki <[email protected]>
bpf: Allow delete from sockmap/sockhash only if update is allowed
Parthiban Veerasooran <[email protected]>
net: usb: smsc95xx: fix changing LED_SEL bit value updated from EEPROM
Roded Zats <[email protected]>
enic: Validate length of nl attributes in enic_set_vf_port
Friedrich Vock <[email protected]>
bpf: Fix potential integer overflow in resolve_btfids
Tetsuo Handa <[email protected]>
dma-buf/sw-sync: don't enable IRQ from sync_print_obj()
Carolina Jubran <[email protected]>
net/mlx5e: Use rx_missed_errors instead of rx_dropped for reporting buffer exhaustion
Sagi Grimberg <[email protected]>
nvmet: fix ns enable/disable possible hang
Andy Shevchenko <[email protected]>
spi: Don't mark message DMA mapped when no transfer in it is
Pablo Neira Ayuso <[email protected]>
netfilter: nft_payload: restore vlan q-in-q match support
Eric Dumazet <[email protected]>
netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu()
Ryosuke Yasuoka <[email protected]>
nfc: nci: Fix handling of zero-length payload packets in nci_rx_work()
Tetsuo Handa <[email protected]>
nfc: nci: Fix kcov check in nci_rx_work()
Dae R. Jeong <[email protected]>
tls: fix missing memory barrier in tls_init
Wei Fang <[email protected]>
net: fec: avoid lock evasion when reading pps_enable
Matthew Bystrin <[email protected]>
riscv: stacktrace: fixed walk_stackframe()
Guo Ren <[email protected]>
riscv: stacktrace: Make walk_stackframe cross pt_regs frame
Kefeng Wang <[email protected]>
riscv: Cleanup stacktrace
Jiri Pirko <[email protected]>
virtio: delete vq in vp_find_vqs_msix() when request_irq() fails
Jiangfeng Xiao <[email protected]>
arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY
Aaron Conole <[email protected]>
openvswitch: Set the skbuff pkt_type for proper pmtud support.
Kuniyuki Iwashima <[email protected]>
tcp: Fix shift-out-of-bounds in dctcp_update_alpha().
Sagi Grimberg <[email protected]>
params: lift param_set_uint_minmax to common code
Hangbin Liu <[email protected]>
ipv6: sr: fix memleak in seg6_hmac_init_algo
Dan Aloni <[email protected]>
rpcrdma: fix handling for RDMA_CM_EVENT_DEVICE_REMOVAL
Dan Aloni <[email protected]>
sunrpc: fix NFSACL RPC retry on soft mount
Shenghao Ding <[email protected]>
ASoC: tas2552: Add TX path for capturing AUDIO-OUT data
Ryosuke Yasuoka <[email protected]>
nfc: nci: Fix uninit-value in nci_rx_work
Masahiro Yamada <[email protected]>
x86/kconfig: Select ARCH_WANT_FRAME_POINTERS again when UNWINDER_FRAME_POINTER=y
Matti Vaittinen <[email protected]>
regulator: bd71828: Don't overwrite runtime voltages
Zhu Yanjun <[email protected]>
null_blk: Fix the WARNING: modpost: missing MODULE_DESCRIPTION()
Hans Verkuil <[email protected]>
media: cec: core: avoid confusing "transmit timed out" message
Hans Verkuil <[email protected]>
media: cec: core: avoid recursive cec_claim_log_addrs
Hans Verkuil <[email protected]>
media: cec-adap.c: drop activate_cnt, use state info instead
Hans Verkuil <[email protected]>
media: cec: use call_op and check for !unregistered
Hans Verkuil <[email protected]>
media: cec: correctly pass on reply results
Hans Verkuil <[email protected]>
media: cec: abort if the current transmit was canceled
Hans Verkuil <[email protected]>
media: cec: call enable_adap on s_log_addrs
Hans Verkuil <[email protected]>
media: cec: fix a deadlock situation
Hans Verkuil <[email protected]>
media: core headers: fix kernel-doc warnings
Hans Verkuil <[email protected]>
media: cec: cec-api: add locking in cec_release()
Hans Verkuil <[email protected]>
media: cec: cec-adap: always cancel work in cec_transmit_msg_fh
Tiwei Bie <[email protected]>
um: Fix the -Wmissing-prototypes warning for __switch_mm
Shrikanth Hegde <[email protected]>
powerpc/pseries: Add failure related checks for h_get_mpp and h_get_ppp
Dongliang Mu <[email protected]>
media: flexcop-usb: fix sanity check of bNumEndpoints
Johan Hovold <[email protected]>
media: flexcop-usb: clean up endpoint sanity checks
Azeem Shaikh <[email protected]>
scsi: qla2xxx: Replace all non-returning strlcpy() with strscpy()
Dan Carpenter <[email protected]>
media: stk1160: fix bounds checking in stk1160_copy_video()
Michael Walle <[email protected]>
drm/bridge: tc358775: fix support for jeida-18 and jeida-24
Johannes Berg <[email protected]>
um: vector: fix bpfflash parameter evaluation
Roberto Sassu <[email protected]>
um: Add winch to winch_handlers before registering winch IRQ
Duoming Zhou <[email protected]>
um: Fix return value in ubd_init()
Marijn Suijten <[email protected]>
drm/msm/dpu: Always flush the slave INTF on the CTL
Fenglin Wu <[email protected]>
Input: pm8xxx-vibrator - correct VIB_MAX_LEVELS calculation
Judith Mendez <[email protected]>
mmc: sdhci_am654: Fix ITAPDLY for HS400 timing
Judith Mendez <[email protected]>
mmc: sdhci_am654: Add ITAPDLYSEL in sdhci_j721e_4bit_set_clock
Judith Mendez <[email protected]>
mmc: sdhci_am654: Add OTAP/ITAP delay enable
Vignesh Raghavendra <[email protected]>
mmc: sdhci_am654: Drop lookup for deprecated ti,otap-del-sel
Judith Mendez <[email protected]>
mmc: sdhci_am654: Write ITAPDLY for DDR52 timing
Judith Mendez <[email protected]>
mmc: sdhci_am654: Add tuning algorithm for delay chain
Karel Balej <[email protected]>
Input: ioc3kbd - add device table
Uwe Kleine-König <[email protected]>
Input: ioc3kbd - convert to platform remove callback returning void
Arnd Bergmann <[email protected]>
Input: ims-pcu - fix printf string overflow
Alexander Egorenkov <[email protected]>
s390/ipl: Fix incorrect initialization of nvme dump block
Alexander Egorenkov <[email protected]>
s390/ipl: Fix incorrect initialization of len fields in nvme reipl block
Ian Rogers <[email protected]>
perf stat: Don't display metric header for non-leader uncore events
Ian Rogers <[email protected]>
libsubcmd: Fix parse-options memory leak
Wolfram Sang <[email protected]>
serial: sh-sci: protect invalidating RXDMA on shutdown
Chao Yu <[email protected]>
f2fs: compress: don't allow unaligned truncation on released compress inode
Chao Yu <[email protected]>
f2fs: fix to release node block count in error path of f2fs_new_node_page()
Chao Yu <[email protected]>
f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock
Ian Rogers <[email protected]>
perf report: Avoid SEGV in report__setup_sample_type()
Ian Rogers <[email protected]>
perf ui browser: Avoid SEGV on title
Kuppuswamy Sathyanarayanan <[email protected]>
PCI/EDR: Align EDR_PORT_LOCATE_DSM with PCI Firmware r3.3
Kuppuswamy Sathyanarayanan <[email protected]>
PCI/EDR: Align EDR_PORT_DPC_ENABLE_DSM with PCI Firmware r3.3
Randy Dunlap <[email protected]>
extcon: max8997: select IRQ_DOMAIN instead of depending on it
Ian Rogers <[email protected]>
perf ui browser: Don't save pointer to stack memory
Ian Rogers <[email protected]>
perf ui: Update use of pthread mutex
yaowenbin <[email protected]>
perf top: Fix TUI exit screen refresh race condition
He Zhe <[email protected]>
perf bench internals inject-build-id: Fix trap divide when collecting just one DSO
Huai-Yuan Liu <[email protected]>
ppdev: Add an error check in register_device
Christophe JAILLET <[email protected]>
ppdev: Remove usage of the deprecated ida_simple_xx() API
Dan Carpenter <[email protected]>
stm class: Fix a double free in stm_register_device()
Chris Wulff <[email protected]>
usb: gadget: u_audio: Clear uac pointer when freed.
Miklos Szeredi <[email protected]>
ovl: remove upper umask handling from ovl_create_upper()
Adrian Hunter <[email protected]>
perf intel-pt: Fix unassigned instruction op (discovered by MemorySanitizer)
Michal Simek <[email protected]>
microblaze: Remove early printk call from cpuinfo-static.c
Michal Simek <[email protected]>
microblaze: Remove gcc flag for non existing early_printk.c file
Marco Pagani <[email protected]>
fpga: region: add owner module and take its refcount
Russ Weight <[email protected]>
fpga: region: Use standard dev_release for class driver
Mauro Carvalho Chehab <[email protected]>
docs: driver-api: fpga: avoid using UTF-8 chars
Russ Weight <[email protected]>
fpga: region: Rename dev to parent for parent device
Tom Rix <[email protected]>
fpga: region: change FPGA indirect article to an
Thomas Haemmerle <[email protected]>
iio: pressure: dps310: support negative temperature values
Chao Yu <[email protected]>
f2fs: fix to check pinfile flag in f2fs_move_file_range()
Chao Yu <[email protected]>
f2fs: fix to relocate check condition in f2fs_fallocate()
Jinyoung CHOI <[email protected]>
f2fs: fix typos in comments
Jaegeuk Kim <[email protected]>
f2fs: do not allow partial truncation on pinned file
Chao Yu <[email protected]>
f2fs: fix to force keeping write barrier for strict fsync mode
Chao Yu <[email protected]>
f2fs: add cp_error check in f2fs_write_compressed_pages
Chao Yu <[email protected]>
f2fs: compress: fix to relocate check condition in f2fs_{release,reserve}_compress_blocks()
Jaegeuk Kim <[email protected]>
f2fs: introduce FI_COMPRESS_RELEASED instead of using IMMUTABLE bit
Chao Yu <[email protected]>
f2fs: compress: remove unneeded preallocation
Chao Yu <[email protected]>
f2fs: compress: clean up parameter of __f2fs_cluster_blocks()
Daeho Jeong <[email protected]>
f2fs: add compress_mode mount option
Chao Yu <[email protected]>
f2fs: compress: support chksum
Hugo Villeneuve <[email protected]>
serial: sc16is7xx: add proper sched.h include for sched_set_fifo()
Arnd Bergmann <[email protected]>
greybus: arche-ctrl: move device table to its right location
Andy Shevchenko <[email protected]>
serial: max3100: Fix bitwise types
Andy Shevchenko <[email protected]>
serial: max3100: Update uart_driver_registered on driver removal
Andy Shevchenko <[email protected]>
serial: max3100: Lock port->lock when calling uart_handle_cts_change()
Arnd Bergmann <[email protected]>
firmware: dmi-id: add a release callback function
Chen Ni <[email protected]>
dmaengine: idma64: Add check for dma_set_max_seg_size
Pierre-Louis Bossart <[email protected]>
soundwire: cadence: fix invalid PDI offset
Namhyung Kim <[email protected]>
perf annotate: Get rid of duplicate --group option item
Martin Liška <[email protected]>
perf annotate: Add --demangle and --demangle-kernel
Chao Yu <[email protected]>
f2fs: fix to wait on page writeback in __clone_blkaddrs()
Rui Miguel Silva <[email protected]>
greybus: lights: check return of get_channel_from_mode
Arnaldo Carvalho de Melo <[email protected]>
perf probe: Add missing libgen.h header needed for using basename()
Ian Rogers <[email protected]>
perf record: Delete session after stopping sideband thread
Arnaldo Carvalho de Melo <[email protected]>
perf evlist: Use the right prefix for 'struct evlist' sideband thread methods
Vitalii Bursov <[email protected]>
sched/fair: Allow disabling sched_balance_newidle with sched_relax_domain_level
Eric Dumazet <[email protected]>
af_packet: do not call packet_read_pending() from tpacket_destruct_skb()
Eric Dumazet <[email protected]>
netrom: fix possible dead-lock in nr_rt_ioctl()
Chris Lew <[email protected]>
net: qrtr: ns: Fix module refcnt
Qinglang Miao <[email protected]>
net: qrtr: fix null-ptr-deref in qrtr_ns_remove
Leon Romanovsky <[email protected]>
RDMA/IPoIB: Fix format truncation compilation errors
Edward Liaw <[email protected]>
selftests/kcmp: remove unused open mode
Gautam Menghani <[email protected]>
selftests/kcmp: Make the test output consistent and clear
Chuck Lever <[email protected]>
SUNRPC: Fix gss_free_in_token_pages()
Dan Carpenter <[email protected]>
ext4: fix potential unnitialized variable
Kemeng Shi <[email protected]>
ext4: remove unused parameter from ext4_mb_new_blocks_simple()
Kemeng Shi <[email protected]>
ext4: try all groups in ext4_mb_new_blocks_simple
Kemeng Shi <[email protected]>
ext4: fix unit mismatch in ext4_mb_new_blocks_simple
Kemeng Shi <[email protected]>
ext4: simplify calculation of blkoff in ext4_mb_new_blocks_simple
Aleksandr Aprelkov <[email protected]>
sunrpc: removed redundant procp check
Jan Kara <[email protected]>
ext4: avoid excessive credit estimate in ext4_tmpfile()
Adrian Hunter <[email protected]>
x86/insn: Fix PUSH instruction in x86 instruction decoder opcode map
Marc Gonzalez <[email protected]>
clk: qcom: mmcc-msm8998: fix venus clock issue
Chengchang Tang <[email protected]>
RDMA/hns: Modify the print level of CQE error
Chengchang Tang <[email protected]>
RDMA/hns: Use complete parentheses in macros
Zhengchao Shao <[email protected]>
RDMA/hns: Fix return value in hns_roce_map_mr_sg
Wenpeng Liang <[email protected]>
RDMA/hns: Fix incorrect symbol types
Yangyang Li <[email protected]>
RDMA/hns: Create QP with selected QPN for bank load balance
Xi Wang <[email protected]>
RDMA/hns: Refactor the hns_roce_buf allocation flow
Dmitry Baryshkov <[email protected]>
drm/mipi-dsi: use correct return type for the DSC functions
Marek Vasut <[email protected]>
drm/panel: simple: Add missing Innolux G121X1-L03 format, flags, connector
Nícolas F. R. A. Prado <[email protected]>
drm/bridge: tc358775: Don't log an error when DSI host can't be found
Nícolas F. R. A. Prado <[email protected]>
drm/bridge: lt9611: Don't log an error when DSI host can't be found
Steven Rostedt <[email protected]>
ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value
Aleksandr Mishin <[email protected]>
drm: vc4: Fix possible null pointer dereference
Huai-Yuan Liu <[email protected]>
drm/arm/malidp: fix a possible null pointer dereference
Zhipeng Lu <[email protected]>
media: atomisp: ssh_css: Fix a null-pointer dereference in load_video_binaries
Randy Dunlap <[email protected]>
fbdev: sh7760fb: allow modular build
Aleksandr Mishin <[email protected]>
drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference
Ricardo Ribalda <[email protected]>
media: radio-shark2: Avoid led_names truncations
Aleksandr Burakov <[email protected]>
media: ngene: Add dvb_ca_en50221_init return value check
Arnd Bergmann <[email protected]>
fbdev: sisfb: hide unused variables
Arnd Bergmann <[email protected]>
powerpc/fsl-soc: hide unused const variable
Justin Green <[email protected]>
drm/mediatek: Add 0 size check to mtk_drm_gem_obj
Christian Hewitt <[email protected]>
drm/meson: vclk: fix calculation of 59.94 fractional rates
Arnd Bergmann <[email protected]>
fbdev: shmobile: fix snprintf truncation
Maxim Korotkov <[email protected]>
mtd: rawnand: hynix: fixed typo
Cezary Rojewski <[email protected]>
ASoC: Intel: Disable route checks for Skylake boards
Pierre-Louis Bossart <[email protected]>
ASoC: soc-acpi: add helper to identify parent driver.
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Fix potential index out of bounds in color transformation function
Akiva Goldberger <[email protected]>
net/mlx5: Discard command completions in internal error
Hangbin Liu <[email protected]>
ipv6: sr: fix invalid unregister error path
Hangbin Liu <[email protected]>
ipv6: sr: fix incorrect unregister order
Hangbin Liu <[email protected]>
ipv6: sr: add missing seg6_local_exit
Ilya Maximets <[email protected]>
net: openvswitch: fix overwriting ct original tuple for ICMPv6
Eric Dumazet <[email protected]>
net: usb: smsc95xx: stop lying about skb->truesize
Breno Leitao <[email protected]>
af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg
Linus Walleij <[email protected]>
net: ethernet: cortina: Locking fixes
Jakub Kicinski <[email protected]>
eth: sungem: remove .ndo_poll_controller to avoid deadlocks
gaoxingwang <[email protected]>
net: ipv6: fix wrong start position when receive hop-by-hop fragment
Finn Thain <[email protected]>
m68k: mac: Fix reboot hang on Mac IIci
Michael Schmitz <[email protected]>
m68k: Fix spinlock race in kernel thread creation
Eric Dumazet <[email protected]>
net: usb: sr9700: stop lying about skb->truesize
Eric Dumazet <[email protected]>
usb: aqc111: stop lying about skb->truesize
Dan Carpenter <[email protected]>
wifi: mwl8k: initialize cmd->addr[] properly
Bui Quang Minh <[email protected]>
scsi: qedf: Ensure the copied buf is NUL terminated
Bui Quang Minh <[email protected]>
scsi: bfa: Ensure the copied buf is NUL terminated
Chen Ni <[email protected]>
HID: intel-ish-hid: ipc: Add check for pci_alloc_irq_vectors
John Hubbard <[email protected]>
selftests/binderfs: use the Makefile's rules, not Make's implicit rules
Guenter Roeck <[email protected]>
Revert "sh: Handle calling csum_partial with misaligned data"
Geert Uytterhoeven <[email protected]>
sh: kprobes: Merge arch_copy_kprobe() into arch_prepare_kprobe()
Nikita Zhandarovich <[email protected]>
wifi: ar5523: enable proper endpoint verification
Nikita Zhandarovich <[email protected]>
wifi: carl9170: add a proper sanity check for endpoints
Finn Thain <[email protected]>
macintosh/via-macii: Fix "BUG: sleeping function called from invalid context"
Eric Dumazet <[email protected]>
net: give more chances to rcu in netdev_wait_allrefs_any()
Eric Dumazet <[email protected]>
tcp: avoid premature drops in tcp_add_backlog()
Dmitry Baryshkov <[email protected]>
wifi: ath10k: populate board data for WCN3990
Su Hui <[email protected]>
wifi: ath10k: Fix an error code problem in ath10k_dbg_sta_write_peer_debug_trigger()
Ard Biesheuvel <[email protected]>
x86/purgatory: Switch to the position-independent small code model
Yuri Karpov <[email protected]>
scsi: hpsa: Fix allocation size for Scsi_Host private data
Xingui Yang <[email protected]>
scsi: libsas: Fix the failure of adding phy with zero-address to port
Gabriel Krisman Bertazi <[email protected]>
udp: Avoid call to compute_score on multiple sites
Lorenz Bauer <[email protected]>
net: remove duplicate reuseport_lookup functions
Lorenz Bauer <[email protected]>
net: export inet_lookup_reuseport and inet6_lookup_reuseport
Viresh Kumar <[email protected]>
cpufreq: exit() callback is optional
Rafael J. Wysocki <[email protected]>
cpufreq: Rearrange locking in cpufreq_remove_dev()
Rafael J. Wysocki <[email protected]>
cpufreq: Split cpufreq_offline()
Rafael J. Wysocki <[email protected]>
cpufreq: Reorganize checks in cpufreq_offline()
Geliang Tang <[email protected]>
selftests/bpf: Fix umount cgroup2 error in test_sockmap
Andreas Gruenbacher <[email protected]>
gfs2: Fix "ignore unlock failures after withdraw"
Arnd Bergmann <[email protected]>
ACPI: disable -Wstringop-truncation
Zenghui Yu <[email protected]>
irqchip/loongson-pch-msi: Fix off-by-one on allocation error path
Zenghui Yu <[email protected]>
irqchip/alpine-msi: Fix off-by-one in allocation error path
Andrew Halaney <[email protected]>
scsi: ufs: core: Perform read back after disabling UIC_COMMAND_COMPL
Andrew Halaney <[email protected]>
scsi: ufs: core: Perform read back after disabling interrupts
Andrew Halaney <[email protected]>
scsi: ufs: cdns-pltfrm: Perform read back after writing HCLKDIV
Andrew Halaney <[email protected]>
scsi: ufs: qcom: Perform read back after writing CGC enable
Andrew Halaney <[email protected]>
scsi: ufs: qcom: Perform read back after writing unipro mode
Abel Vesa <[email protected]>
scsi: ufs: ufs-qcom: Clear qunipro_g4_sel for HW version major 5
Manivannan Sadhasivam <[email protected]>
scsi: ufs: ufs-qcom: Fix the Qcom register name for offset 0xD0
Andrew Halaney <[email protected]>
scsi: ufs: qcom: Perform read back after writing REG_UFS_SYS1CLK_1US
Ziqi Chen <[email protected]>
scsi: ufs-qcom: Fix ufs RST_n spec violation
Andrew Halaney <[email protected]>
scsi: ufs: qcom: Perform read back after writing reset bit
Arnd Bergmann <[email protected]>
qed: avoid truncating work queue length
Guixiong Wei <[email protected]>
x86/boot: Ignore relocations in .notes sections in walk_relocs() too
Baochen Qiang <[email protected]>
wifi: ath10k: poll service ready message before failing
Yu Kuai <[email protected]>
md: fix resync softlockup when bitmap size is less than array size
Zhu Yanjun <[email protected]>
null_blk: Fix missing mutex_destroy() at module removal
Chun-Kuang Hu <[email protected]>
soc: mediatek: cmdq: Fix typo of CMDQ_JUMP_RELATIVE
Ilya Denisyev <[email protected]>
jffs2: prevent xattr node from overflowing the eraseblock
Peter Oberparleiter <[email protected]>
s390/cio: fix tracepoint subchannel type field
Eric Biggers <[email protected]>
crypto: x86/sha256-avx2 - add missing vzeroupper
Eric Biggers <[email protected]>
crypto: x86/nh-avx2 - add missing vzeroupper
Arnd Bergmann <[email protected]>
crypto: ccp - drop platform ifdef checks
Al Viro <[email protected]>
parisc: add missing export of __cmpxchg_u8()
Arnd Bergmann <[email protected]>
nilfs2: fix out-of-range warning
Brian Kubisiak <[email protected]>
ecryptfs: Fix buffer size for tag 66 packet
Laurent Pinchart <[email protected]>
firmware: raspberrypi: Use correct device for DMA mappings
Aleksandr Mishin <[email protected]>
crypto: bcm - Fix pointer arithmetic
Eric Sandeen <[email protected]>
openpromfs: finish conversion to the new mount API
Nilay Shroff <[email protected]>
nvme: find numa distance only if controller has valid numa id
Lancelot SIX <[email protected]>
drm/amdkfd: Flush the process wq before creating a kfd_process
Pierre-Louis Bossart <[email protected]>
ASoC: da7219-aad: fix usage of device_get_named_child_node()
Jack Yu <[email protected]>
ASoC: rt715: add vendor clear control register
Krzysztof Kozlowski <[email protected]>
regulator: vqmmc-ipq4019: fix module autoloading
Derek Fang <[email protected]>
ASoC: dt-bindings: rt5645: add cbj sleeve gpio property
Derek Fang <[email protected]>
ASoC: rt5645: Fix the electric noise due to the CBJ contacts floating
Joshua Ashton <[email protected]>
drm/amd/display: Set color_mgmt_changed to true on unsuspend
Daniele Palmas <[email protected]>
net: usb: qmi_wwan: add Telit FN920C04 compositions
Igor Artemiev <[email protected]>
wifi: cfg80211: fix the order of arguments for trace events of the tx_rx_evt class
Takashi Iwai <[email protected]>
ALSA: core: Fix NULL module pointer assignment at card init
Ryusuke Konishi <[email protected]>
nilfs2: fix potential hang in nilfs_detach_log_writer()
Ryusuke Konishi <[email protected]>
nilfs2: fix unexpected freezing of nilfs_segctor_sync()
Thorsten Blum <[email protected]>
net: smc91x: Fix m68k kernel compilation for ColdFire CPU
Petr Pavlu <[email protected]>
ring-buffer: Fix a race between readers and resize checks
Ken Milmore <[email protected]>
r8169: Fix possible ring buffer corruption on fragmented Tx packets.
Dan Carpenter <[email protected]>
speakup: Fix sizeof() vs ARRAY_SIZE() bug
Daniel Starke <[email protected]>
tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
Daniel J Blueman <[email protected]>
x86/tsc: Trust initial offset in architectural TSC-adjust MSRs
-------------
Diffstat:
Documentation/devicetree/bindings/sound/rt5645.txt | 6 + Documentation/driver-api/fpga/fpga-bridge.rst | 10 +- Documentation/driver-api/fpga/fpga-mgr.rst | 12 +- Documentation/driver-api/fpga/fpga-programming.rst | 8 +- Documentation/driver-api/fpga/fpga-region.rst | 35 ++- Documentation/filesystems/f2fs.rst | 36 +++ Makefile | 4 +- arch/arm64/boot/dts/hisilicon/hi3798cv200.dtsi | 2 +- arch/arm64/boot/dts/nvidia/tegra132-norrin.dts | 4 +- arch/arm64/boot/dts/nvidia/tegra132.dtsi | 2 +- arch/arm64/boot/dts/qcom/qcs404-evb.dtsi | 2 +- arch/arm64/include/asm/asm-bug.h | 1 + arch/arm64/kvm/guest.c | 1 + arch/m68k/kernel/entry.S | 4 +- arch/m68k/mac/misc.c | 36 +-- arch/microblaze/kernel/Makefile | 1 - arch/microblaze/kernel/cpu/cpuinfo-static.c | 2 +- arch/parisc/kernel/parisc_ksyms.c | 1 + arch/powerpc/include/asm/hvcall.h | 2 +- arch/powerpc/include/asm/uaccess.h | 55 ++++ arch/powerpc/platforms/pseries/lpar.c | 6 +- arch/powerpc/platforms/pseries/lparcfg.c | 6 +- arch/powerpc/sysdev/fsl_msi.c | 2 + arch/riscv/include/asm/stacktrace.h | 17 ++ arch/riscv/kernel/entry.S | 3 +- arch/riscv/kernel/perf_callchain.c | 10 +- arch/riscv/kernel/stacktrace.c | 36 ++- arch/s390/kernel/ipl.c | 10 +- arch/sh/kernel/kprobes.c | 7 +- arch/sh/lib/checksum.S | 67 ++--- arch/sparc/include/asm/smp_64.h | 2 - arch/sparc/include/uapi/asm/termbits.h | 10 - arch/sparc/include/uapi/asm/termios.h | 9 + arch/sparc/kernel/prom_64.c | 4 +- arch/sparc/kernel/setup_64.c | 1 - arch/sparc/kernel/smp_64.c | 14 - arch/um/drivers/line.c | 14 +- arch/um/drivers/ubd_kern.c | 4 +- arch/um/drivers/vector_kern.c | 2 +- arch/um/include/asm/mmu.h | 2 - arch/um/include/shared/skas/mm_id.h | 2 + arch/x86/Kconfig.debug | 5 +- arch/x86/crypto/nh-avx2-x86_64.S | 1 + arch/x86/crypto/sha256-avx2-asm.S | 1 + arch/x86/entry/vsyscall/vsyscall_64.c | 28 +- arch/x86/include/asm/processor.h | 1 - arch/x86/kernel/apic/vector.c | 9 +- arch/x86/kernel/tsc_sync.c | 6 +- arch/x86/lib/x86-opcode-map.txt | 2 +- arch/x86/mm/fault.c | 27 +- arch/x86/purgatory/Makefile | 3 +- arch/x86/tools/relocs.c | 9 + crypto/ecrdsa.c | 1 + drivers/accessibility/speakup/main.c | 2 +- drivers/acpi/acpica/Makefile | 1 + drivers/acpi/resource.c | 12 + drivers/android/binder.c | 4 +- drivers/ata/pata_legacy.c | 8 +- drivers/block/null_blk/main.c | 3 + drivers/char/ppdev.c | 21 +- drivers/clk/qcom/mmcc-msm8998.c | 8 + drivers/cpufreq/cpufreq.c | 85 +++--- drivers/crypto/bcm/spu2.c | 2 +- drivers/crypto/ccp/sp-platform.c | 14 +- drivers/crypto/qat/qat_common/adf_aer.c | 19 +- drivers/dma-buf/sync_debug.c | 4 +- drivers/dma/idma64.c | 4 +- drivers/extcon/Kconfig | 3 +- drivers/firmware/dmi-id.c | 7 +- drivers/firmware/raspberrypi.c | 7 +- drivers/fpga/dfl-fme-region.c | 17 +- drivers/fpga/dfl.c | 12 +- drivers/fpga/fpga-region.c | 145 +++++----- drivers/fpga/of-fpga-region.c | 10 +- drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 3 + drivers/gpu/drm/amd/amdkfd/kfd_process.c | 8 + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 + .../gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c | 5 + drivers/gpu/drm/arm/malidp_mw.c | 5 +- .../gpu/drm/bridge/cadence/cdns-mhdp8546-core.c | 3 + drivers/gpu/drm/bridge/lontium-lt9611.c | 6 +- drivers/gpu/drm/bridge/tc358775.c | 27 +- drivers/gpu/drm/drm_mipi_dsi.c | 6 +- drivers/gpu/drm/mediatek/mtk_drm_gem.c | 3 + drivers/gpu/drm/meson/meson_vclk.c | 6 +- .../gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c | 3 - drivers/gpu/drm/panel/panel-simple.c | 3 + drivers/gpu/drm/vc4/vc4_hdmi.c | 2 + drivers/hid/intel-ish-hid/ipc/pci-ish.c | 5 + drivers/hwmon/shtc1.c | 2 +- drivers/hwtracing/intel_th/pci.c | 5 + drivers/hwtracing/stm/core.c | 11 +- drivers/iio/pressure/dps310.c | 11 +- drivers/infiniband/hw/hns/hns_roce_alloc.c | 128 +++++---- drivers/infiniband/hw/hns/hns_roce_cmd.c | 10 +- drivers/infiniband/hw/hns/hns_roce_cmd.h | 2 +- drivers/infiniband/hw/hns/hns_roce_common.h | 14 +- drivers/infiniband/hw/hns/hns_roce_db.c | 8 +- drivers/infiniband/hw/hns/hns_roce_device.h | 115 ++++---- drivers/infiniband/hw/hns/hns_roce_hem.h | 12 +- drivers/infiniband/hw/hns/hns_roce_hw_v1.c | 8 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 35 +-- drivers/infiniband/hw/hns/hns_roce_main.c | 2 +- drivers/infiniband/hw/hns/hns_roce_mr.c | 65 ++--- drivers/infiniband/hw/hns/hns_roce_qp.c | 129 +++++++-- drivers/infiniband/ulp/ipoib/ipoib_vlan.c | 8 +- drivers/input/misc/ims-pcu.c | 4 +- drivers/input/misc/pm8xxx-vibrator.c | 7 +- drivers/input/serio/ioc3kbd.c | 13 +- drivers/irqchip/irq-alpine-msi.c | 2 +- drivers/irqchip/irq-loongson-pch-msi.c | 2 +- drivers/macintosh/via-macii.c | 11 +- drivers/md/md-bitmap.c | 6 +- drivers/md/raid5.c | 15 +- drivers/media/cec/core/cec-adap.c | 291 +++++++++++++-------- drivers/media/cec/core/cec-api.c | 31 +-- drivers/media/cec/core/cec-core.c | 7 +- drivers/media/cec/core/cec-pin-priv.h | 11 + drivers/media/cec/core/cec-pin.c | 23 +- drivers/media/cec/core/cec-priv.h | 10 + drivers/media/dvb-frontends/lgdt3306a.c | 5 + drivers/media/dvb-frontends/mxl5xx.c | 22 +- drivers/media/mc/mc-devnode.c | 5 +- drivers/media/pci/ngene/ngene-core.c | 4 +- drivers/media/radio/radio-shark2.c | 2 +- drivers/media/usb/b2c2/flexcop-usb.c | 12 +- drivers/media/usb/stk1160/stk1160-video.c | 20 +- drivers/media/v4l2-core/v4l2-dev.c | 3 + drivers/mmc/core/host.c | 3 +- drivers/mmc/core/slot-gpio.c | 20 ++ drivers/mmc/host/sdhci-acpi.c | 48 +++- drivers/mmc/host/sdhci_am654.c | 205 ++++++++++----- drivers/mtd/nand/raw/nand_hynix.c | 2 +- drivers/net/ethernet/cisco/enic/enic_main.c | 12 + drivers/net/ethernet/cortina/gemini.c | 12 +- drivers/net/ethernet/freescale/fec_main.c | 10 + drivers/net/ethernet/freescale/fec_ptp.c | 14 +- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 3 + drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 2 +- drivers/net/ethernet/qlogic/qed/qed_main.c | 9 +- drivers/net/ethernet/realtek/r8169_main.c | 3 +- drivers/net/ethernet/smsc/smc91x.h | 4 +- drivers/net/ethernet/sun/sungem.c | 14 - drivers/net/ipvlan/ipvlan_core.c | 4 +- drivers/net/usb/aqc111.c | 8 +- drivers/net/usb/qmi_wwan.c | 3 + drivers/net/usb/smsc95xx.c | 26 +- drivers/net/usb/sr9700.c | 10 +- drivers/net/vxlan/vxlan_core.c | 4 - drivers/net/wireless/ath/ar5523/ar5523.c | 14 + drivers/net/wireless/ath/ath10k/core.c | 3 + drivers/net/wireless/ath/ath10k/debugfs_sta.c | 2 +- drivers/net/wireless/ath/ath10k/hw.h | 1 + drivers/net/wireless/ath/ath10k/targaddrs.h | 3 + drivers/net/wireless/ath/ath10k/wmi.c | 26 +- drivers/net/wireless/ath/carl9170/usb.c | 32 +++ drivers/net/wireless/marvell/mwl8k.c | 2 +- .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 26 +- .../net/wireless/realtek/rtlwifi/rtl8192de/trx.c | 21 +- .../net/wireless/realtek/rtlwifi/rtl8192de/trx.h | 79 ++---- drivers/nvme/host/multipath.c | 3 +- drivers/nvme/target/configfs.c | 8 + drivers/pci/pcie/edr.c | 28 +- drivers/regulator/bd71828-regulator.c | 58 +--- drivers/regulator/vqmmc-ipq4019-regulator.c | 1 + drivers/s390/cio/trace.h | 2 +- drivers/s390/crypto/ap_bus.c | 2 +- drivers/scsi/bfa/bfad_debugfs.c | 4 +- drivers/scsi/hpsa.c | 2 +- drivers/scsi/libsas/sas_expander.c | 3 +- drivers/scsi/qedf/qedf_debugfs.c | 2 +- drivers/scsi/qla2xxx/qla_init.c | 8 +- drivers/scsi/qla2xxx/qla_mr.c | 20 +- drivers/scsi/ufs/cdns-pltfrm.c | 2 +- drivers/scsi/ufs/ufs-qcom.c | 31 ++- drivers/scsi/ufs/ufs-qcom.h | 21 +- drivers/scsi/ufs/ufshcd.c | 4 +- drivers/soc/mediatek/mtk-cmdq-helper.c | 5 +- drivers/soundwire/cadence_master.c | 2 +- drivers/spi/spi-stm32.c | 2 +- drivers/spi/spi.c | 4 + drivers/staging/greybus/arche-apb-ctrl.c | 1 + drivers/staging/greybus/arche-platform.c | 9 +- drivers/staging/greybus/light.c | 8 +- drivers/staging/media/atomisp/pci/sh_css.c | 1 + drivers/tty/n_gsm.c | 8 +- drivers/tty/serial/max3100.c | 22 +- drivers/tty/serial/sc16is7xx.c | 2 +- drivers/tty/serial/sh-sci.c | 5 + drivers/usb/gadget/function/u_audio.c | 2 + drivers/video/fbdev/Kconfig | 4 +- drivers/video/fbdev/savage/savagefb_driver.c | 5 +- drivers/video/fbdev/sh_mobile_lcdcfb.c | 2 +- drivers/video/fbdev/sis/init301.c | 3 +- drivers/virtio/virtio_pci_common.c | 4 +- drivers/watchdog/rti_wdt.c | 34 ++- fs/afs/mntpt.c | 5 + fs/ecryptfs/keystore.c | 4 +- fs/ext4/mballoc.c | 134 +++++----- fs/ext4/namei.c | 2 +- fs/ext4/xattr.c | 4 +- fs/f2fs/checkpoint.c | 4 +- fs/f2fs/compress.c | 91 +++---- fs/f2fs/data.c | 10 +- fs/f2fs/extent_cache.c | 4 +- fs/f2fs/f2fs.h | 52 +++- fs/f2fs/file.c | 86 ++++-- fs/f2fs/inode.c | 9 + fs/f2fs/namei.c | 2 +- fs/f2fs/node.c | 2 +- fs/f2fs/segment.c | 4 +- fs/f2fs/super.c | 32 +++ fs/gfs2/glock.c | 4 +- fs/gfs2/util.c | 1 - fs/jffs2/xattr.c | 3 + fs/nfs/internal.h | 4 +- fs/nfs/nfs4proc.c | 2 +- fs/nilfs2/ioctl.c | 2 +- fs/nilfs2/segment.c | 63 ++++- fs/openpromfs/inode.c | 8 +- fs/overlayfs/dir.c | 3 - include/drm/drm_mipi_dsi.h | 6 +- include/linux/f2fs_fs.h | 3 +- include/linux/fpga/fpga-region.h | 43 ++- include/linux/mmc/slot-gpio.h | 1 + include/linux/moduleparam.h | 2 + include/media/cec.h | 26 +- include/media/v4l2-h264.h | 6 +- include/media/v4l2-jpeg.h | 2 + include/net/dst_ops.h | 2 +- include/net/inet6_hashtables.h | 16 ++ include/net/inet_hashtables.h | 18 +- include/net/netfilter/nf_tables.h | 2 + include/net/sock.h | 13 +- include/sound/soc-acpi.h | 6 + include/trace/events/asoc.h | 2 + include/uapi/linux/cec.h | 3 +- include/uapi/linux/v4l2-subdev.h | 12 +- include/uapi/linux/videodev2.h | 15 +- io_uring/io_uring.c | 2 + kernel/bpf/verifier.c | 10 +- kernel/cgroup/cpuset.c | 2 +- kernel/debug/kdb/kdb_io.c | 99 ++++--- kernel/irq/cpuhotplug.c | 16 +- kernel/params.c | 18 ++ kernel/sched/topology.c | 2 +- kernel/trace/ring_buffer.c | 9 + net/9p/client.c | 2 + net/core/dev.c | 3 +- net/ipv4/inet_hashtables.c | 29 +- net/ipv4/netfilter/nf_tproxy_ipv4.c | 2 + net/ipv4/route.c | 22 +- net/ipv4/tcp_dctcp.c | 13 +- net/ipv4/tcp_ipv4.c | 13 +- net/ipv4/udp.c | 55 ++-- net/ipv6/inet6_hashtables.c | 27 +- net/ipv6/reassembly.c | 2 +- net/ipv6/route.c | 34 +-- net/ipv6/seg6.c | 5 +- net/ipv6/seg6_hmac.c | 42 ++- net/ipv6/udp.c | 61 +++-- net/netfilter/nf_tables_api.c | 22 +- net/netfilter/nfnetlink_queue.c | 2 + net/netfilter/nft_payload.c | 23 +- net/netfilter/nft_tunnel.c | 1 + net/netrom/nr_route.c | 19 +- net/nfc/nci/core.c | 17 +- net/openvswitch/actions.c | 6 + net/openvswitch/flow.c | 3 +- net/packet/af_packet.c | 3 +- net/qrtr/af_qrtr.c | 16 +- net/qrtr/ns.c | 34 ++- net/qrtr/qrtr.h | 2 +- net/sunrpc/auth_gss/svcauth_gss.c | 12 +- net/sunrpc/clnt.c | 1 + net/sunrpc/svc.c | 2 - net/sunrpc/xprtrdma/verbs.c | 6 +- net/sunrpc/xprtsock.c | 18 -- net/tls/tls_main.c | 10 +- net/unix/af_unix.c | 2 +- net/wireless/trace.h | 4 +- net/xfrm/xfrm_policy.c | 11 +- scripts/kconfig/symbol.c | 6 +- sound/core/init.c | 2 +- sound/core/timer.c | 10 + sound/soc/codecs/da7219-aad.c | 6 +- sound/soc/codecs/rt5645.c | 25 ++ sound/soc/codecs/rt715-sdw.c | 1 + sound/soc/codecs/tas2552.c | 15 +- sound/soc/intel/boards/bxt_da7219_max98357a.c | 1 + sound/soc/intel/boards/bxt_rt298.c | 1 + sound/soc/intel/boards/glk_rt5682_max98357a.c | 2 + sound/soc/intel/boards/kbl_da7219_max98357a.c | 1 + sound/soc/intel/boards/kbl_da7219_max98927.c | 4 + sound/soc/intel/boards/kbl_rt5660.c | 1 + sound/soc/intel/boards/kbl_rt5663_max98927.c | 2 + .../soc/intel/boards/kbl_rt5663_rt5514_max98927.c | 1 + sound/soc/intel/boards/skl_hda_dsp_generic.c | 2 + sound/soc/intel/boards/skl_nau88l25_max98357a.c | 1 + sound/soc/intel/boards/skl_rt286.c | 1 + tools/arch/x86/lib/x86-opcode-map.txt | 2 +- tools/bpf/resolve_btfids/main.c | 2 +- tools/lib/subcmd/parse-options.c | 8 +- tools/perf/Documentation/perf-annotate.txt | 7 + tools/perf/bench/inject-buildid.c | 2 +- tools/perf/builtin-annotate.c | 6 +- tools/perf/builtin-record.c | 8 +- tools/perf/builtin-report.c | 2 +- tools/perf/builtin-top.c | 4 +- tools/perf/ui/browser.c | 26 +- tools/perf/ui/browser.h | 2 +- tools/perf/ui/browsers/annotate.c | 2 +- tools/perf/ui/setup.c | 5 +- tools/perf/ui/tui/helpline.c | 5 +- tools/perf/ui/tui/progress.c | 8 +- tools/perf/ui/tui/setup.c | 12 +- tools/perf/ui/tui/util.c | 18 +- tools/perf/ui/ui.h | 4 +- tools/perf/util/bpf-event.c | 2 +- tools/perf/util/evlist.h | 11 +- .../perf/util/intel-pt-decoder/intel-pt-decoder.c | 2 + tools/perf/util/intel-pt.c | 2 + tools/perf/util/probe-event.c | 1 + tools/perf/util/sideband_evlist.c | 8 +- tools/perf/util/stat-display.c | 3 + tools/testing/selftests/bpf/test_sockmap.c | 2 +- .../selftests/filesystems/binderfs/Makefile | 2 - tools/testing/selftests/kcmp/kcmp_test.c | 8 +- 328 files changed, 2834 insertions(+), 1844 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/317 x86/tsc: Trust initial offset in architectural TSC-adjust MSRs
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel J Blueman <[email protected]>
commit 455f9075f14484f358b3c1d6845b4a438de198a7 upstream.
When the BIOS configures the architectural TSC-adjust MSRs on secondary sockets to correct a constant inter-chassis offset, after Linux brings the cores online, the TSC sync check later resets the core-local MSR to 0, triggering HPET fallback and leading to performance loss.
Fix this by unconditionally using the initial adjust values read from the MSRs. Trusting the initial offsets in this architectural mechanism is a better approach than special-casing workarounds for specific platforms.
--- arch/x86/kernel/tsc_sync.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
arch/x86/kernel/tsc_sync.c +2 -4
@@ -192,11 +192,9 @@ bool tsc_store_and_check_tsc_adjust(bool cur->warned = false;/* -* If a non-zero TSC value for socket 0 may be valid then the default -* adjusted value cannot assumed to be zero either. +* The default adjust value cannot be assumed to be zero on any socket. */ -if (tsc_async_resets) - cur->adjusted = bootval; + cur->adjusted = bootval;/* * Check whether this CPU is the first in a package to come up. In
Greg Kroah-Hartman
maintainerPATCH 2/317 tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Starke <[email protected]>
commit 47388e807f85948eefc403a8a5fdc5b406a65d5a upstream.
Assuming the following:
- side A configures the n_gsm in basic option mode
- side B sends the header of a basic option mode frame with data length 1
- side A switches to advanced option mode
- side B sends 2 data bytes which exceeds gsm->len
Reason: gsm->len is not used in advanced option mode.
- side A switches to basic option mode
- side B keeps sending until gsm0_receive() writes past gsm->buf
Reason: Neither gsm->state nor gsm->len have been reset after reconfiguration.
Fix this by changing gsm->count to gsm->len comparison from equal to less than. Also add upper limit checks against the constant MAX_MRU in gsm0_receive() and gsm1_receive() to harden against memory corruption of gsm->len and gsm->mru.
All other checks remain as we still need to limit the data according to the user configuration and actual payload size.
--- drivers/tty/n_gsm.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/tty/n_gsm.c +6 -2
@@ -2082,8 +2082,12 @@ static void gsm0_receive(struct gsm_muxbreak ;case GSM_DATA :/* Data */ gsm->buf[gsm->count++] = c; -if (gsm->count == gsm->len) +if (gsm->count >=MAX_MRU ) { + gsm->bad_size++; + gsm->state =GSM_SEARCH ; + }else if (gsm->count >= gsm->len) { gsm->state =GSM_FCS ; + }break ;case GSM_FCS :/* FCS follows the packet */ gsm->received_fcs = c;
@@ -2176,7 +2180,7 @@ static void gsm1_receive(struct gsm_mux gsm->state =GSM_DATA ;break ;case GSM_DATA :/* Data */ -if (gsm->count > gsm->mru) {/* Allow one for the FCS */ +if (gsm->count > gsm->mru || gsm->count >MAX_MRU ) {/* Allow one for the FCS */ gsm->state =GSM_OVERRUN ; gsm->bad_size++; }else
Greg Kroah-Hartman
maintainerPATCH 3/317 speakup: Fix sizeof() vs ARRAY_SIZE() bug
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit 008ab3c53bc4f0b2f20013c8f6c204a3203d0b8b upstream.
The "buf" pointer is an array of u16 values. This code should be using ARRAY_SIZE() (which is 256) instead of sizeof() (which is 512), otherwise it can the still got out of bounds.
--- drivers/accessibility/speakup/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/accessibility/speakup/main.c +1 -1
@@ -576,7 +576,7 @@ static u_long get_word(struct vc_data *v } attr_ch =get_char (vc, (u_short *)tmp_pos, &spk_attr); buf[cnt++] = attr_ch; -while (tmpx < vc->vc_cols -1 && cnt <sizeof (buf) -1 ) { +while (tmpx < vc->vc_cols -1 && cnt <ARRAY_SIZE (buf) -1 ) { tmp_pos +=2 ; tmpx++; ch =get_char (vc, (u_short *)tmp_pos, &temp);
Greg Kroah-Hartman
maintainerPATCH 4/317 r8169: Fix possible ring buffer corruption on fragmented Tx packets.
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ken Milmore <[email protected]>
commit c71e3a5cffd5309d7f84444df03d5b72600cc417 upstream.
An issue was found on the RTL8125b when transmitting small fragmented packets, whereby invalid entries were inserted into the transmit ring buffer, subsequently leading to calls to dma_unmap_single() with a null address.
This was caused by rtl8169_start_xmit() not noticing changes to nr_frags which may occur when small packets are padded (to work around hardware quirks) in rtl8169_tso_csum_v2().
To fix this, postpone inspecting nr_frags until after any padding has been applied.
--- drivers/net/ethernet/realtek/r8169_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/realtek/r8169_main.c +2 -1
@@ -4279,11 +4279,11 @@ static void rtl8169_doorbell(struct rtl8static netdev_tx_t rtl8169_start_xmit (struct sk_buff *skb,struct net_device *dev) { -unsigned int frags =skb_shinfo (skb)->nr_frags;struct rtl8169_private *tp =netdev_priv (dev);unsigned int entry = tp->cur_tx %NUM_TX_DESC ;struct TxDesc *txd_first, *txd_last;bool stop_queue, door_bell; +unsigned int frags;u32 opts[2 ]; txd_first = tp->TxDescArray + entry;
@@ -4309,6 +4309,7 @@ static netdev_tx_t rtl8169_start_xmit(st entry, false))) goto err_dma_0; + frags =skb_shinfo (skb)->nr_frags;if (frags) {if (rtl8169_xmit_frags (tp, skb, opts, entry)) goto err_dma_1;
Re: [PATCH 5.10 004/317] r8169: Fix possible ring buffer corruption on fragmented Tx packets.
Quoted 1 line · Greg Kroah-Hartman
5.10-stable review patch. If anyone has any objections, please let me know.
The patch is cleanly applied to 5.10, but it leads to uninit value access in rtl_tx_slots_avail().
unsigned int frags;
u32 opts[2];
txd_first = tp->TxDescArray + entry;
if (unlikely(!rtl_tx_slots_avail(tp, frags))) {
^^^^^ - USE OF UNINIT VALUE
if (net_ratelimit())
netdev_err(dev, "BUG! Tx Ring full when queue awake!\n");
goto err_stop_0;
}
opts[1] = rtl8169_tx_vlan_tag(skb);
opts[0] = 0;
if (!rtl_chip_supports_csum_v2(tp))
rtl8169_tso_csum_v1(skb, opts);
else if (!rtl8169_tso_csum_v2(tp, skb, opts))
goto err_dma_0;
if (unlikely(rtl8169_tx_map(tp, opts, skb_headlen(skb), skb->data,
entry, false)))
goto err_dma_0;
txd_first = tp->TxDescArray + entry;
frags = skb_shinfo(skb)->nr_frags;
^^^^^^ - INITIALIZATION IS HERE AFTER THE PATCHThere is no such problem in upstream because rtl_tx_slots_avail() has no nr_frags argument there.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--
Alexey Khoroshilov
Linux Verification Center, ISPRAS
Re: [PATCH 5.10 004/317] r8169: Fix possible ring buffer corruption on fragmented Tx packets.
Quoted 40 lines · Alexey Khoroshilov
Quoted 1 line · Greg Kroah-Hartman
5.10-stable review patch. If anyone has any objections, please let me know.
The patch is cleanly applied to 5.10, but it leads to uninit value access in
rtl_tx_slots_avail().unsigned int frags; u32 opts[2]; txd_first = tp->TxDescArray + entry; if (unlikely(!rtl_tx_slots_avail(tp, frags))) { ^^^^^ - USE OF UNINIT VALUE if (net_ratelimit()) netdev_err(dev, "BUG! Tx Ring full when queue awake!\n"); goto err_stop_0; } opts[1] = rtl8169_tx_vlan_tag(skb); opts[0] = 0; if (!rtl_chip_supports_csum_v2(tp)) rtl8169_tso_csum_v1(skb, opts); else if (!rtl8169_tso_csum_v2(tp, skb, opts)) goto err_dma_0; if (unlikely(rtl8169_tx_map(tp, opts, skb_headlen(skb), skb->data, entry, false))) goto err_dma_0; txd_first = tp->TxDescArray + entry; frags = skb_shinfo(skb)->nr_frags; ^^^^^^ - INITIALIZATION IS HERE AFTER THE PATCHThere is no such problem in upstream because
rtl_tx_slots_avail()has nonr_fragsargument there.
Quoted 5 lines
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--
Alexey Khoroshilov
Linux Verification Center, ISPRAS
Looks like the frags argument was removed in commit 83c317d7b36bb (r8169: remove nr_frags argument from rtl_tx_slots_avail), which first appears in linux-5.11.
I dare say it would be safe to replace
if (unlikely(!rtl_tx_slots_avail(tp, frags))) {
with
if (unlikely(!rtl_tx_slots_avail(tp, MAX_SKB_FRAGS))) {
Best wait for Heiner to confirm though.
Re: [PATCH 5.10 004/317] r8169: Fix possible ring buffer corruption on fragmented Tx packets.
Quoted 47 lines · Ken Milmore
Quoted 40 lines · Alexey Khoroshilov
Quoted 1 line · Greg Kroah-Hartman
5.10-stable review patch. If anyone has any objections, please let me know.
The patch is cleanly applied to 5.10, but it leads to uninit value access in
rtl_tx_slots_avail().unsigned int frags; u32 opts[2]; txd_first = tp->TxDescArray + entry; if (unlikely(!rtl_tx_slots_avail(tp, frags))) { ^^^^^ - USE OF UNINIT VALUE if (net_ratelimit()) netdev_err(dev, "BUG! Tx Ring full when queue awake!\n"); goto err_stop_0; } opts[1] = rtl8169_tx_vlan_tag(skb); opts[0] = 0; if (!rtl_chip_supports_csum_v2(tp)) rtl8169_tso_csum_v1(skb, opts); else if (!rtl8169_tso_csum_v2(tp, skb, opts)) goto err_dma_0; if (unlikely(rtl8169_tx_map(tp, opts, skb_headlen(skb), skb->data, entry, false))) goto err_dma_0; txd_first = tp->TxDescArray + entry; frags = skb_shinfo(skb)->nr_frags; ^^^^^^ - INITIALIZATION IS HERE AFTER THE PATCHThere is no such problem in upstream because
rtl_tx_slots_avail()has nonr_fragsargument there.Quoted 5 lines
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--
Alexey Khoroshilov
Linux Verification Center, ISPRAS
Quoted 8 lines
Looks like the frags argument was removed in commit
83c317d7b36bb(r8169: removenr_fragsargument fromrtl_tx_slots_avail), which first appears in linux-5.11.I dare say it would be safe to replace
if (unlikely(!rtl_tx_slots_avail(tp, frags))) {
with
if (unlikely(!rtl_tx_slots_avail(tp, MAX_SKB_FRAGS))) {Best wait for Heiner to confirm though.
Further to this, I have tested the following amended patch to 5.10 on the RTL8125b and it works without problems:
drivers/net/ethernet/realtek/r8169_main.c +3 -2
@@ -4279,16 +4279,16 @@ static void rtl8169_doorbell(struct rtl8169_private *tp)static netdev_tx_t rtl8169_start_xmit (struct sk_buff *skb,struct net_device *dev) { -unsigned int frags =skb_shinfo (skb)->nr_frags;struct rtl8169_private *tp =netdev_priv (dev);unsigned int entry = tp->cur_tx %NUM_TX_DESC ;struct TxDesc *txd_first, *txd_last;bool stop_queue, door_bell; +unsigned int frags;u32 opts[2 ]; txd_first = tp->TxDescArray + entry; -if (unlikely (!rtl_tx_slots_avail (tp, frags))) { +if (unlikely (!rtl_tx_slots_avail (tp,MAX_SKB_FRAGS ))) {if (net_ratelimit ())netdev_err (dev,"BUG! Tx Ring full when queue awake!\n" ); goto err_stop_0;
@@ -4309,6 +4309,7 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb, entry, false))) goto err_dma_0; + frags =skb_shinfo (skb)->nr_frags;if (frags) {if (rtl8169_xmit_frags (tp, skb, opts, entry)) goto err_dma_1;
An alternative to this amendment would be to apply 83c317d7b36bb as a prerequisite, but that does not apply cleanly to 5.10 without some massaging.
Because of these complications, I would suggest it may be safest to omit this patch from 5.10 for now.
Greg Kroah-Hartman
maintainerRe: [PATCH 5.10 004/317] r8169: Fix possible ring buffer corruption on fragmented Tx packets.
In reply to Ken MilmoreQuoted 47 lines · Ken Milmore
Quoted 40 lines · Alexey Khoroshilov
Quoted 1 line · Greg Kroah-Hartman
5.10-stable review patch. If anyone has any objections, please let me know.
The patch is cleanly applied to 5.10, but it leads to uninit value access in
rtl_tx_slots_avail().unsigned int frags; u32 opts[2]; txd_first = tp->TxDescArray + entry; if (unlikely(!rtl_tx_slots_avail(tp, frags))) { ^^^^^ - USE OF UNINIT VALUE if (net_ratelimit()) netdev_err(dev, "BUG! Tx Ring full when queue awake!\n"); goto err_stop_0; } opts[1] = rtl8169_tx_vlan_tag(skb); opts[0] = 0; if (!rtl_chip_supports_csum_v2(tp)) rtl8169_tso_csum_v1(skb, opts); else if (!rtl8169_tso_csum_v2(tp, skb, opts)) goto err_dma_0; if (unlikely(rtl8169_tx_map(tp, opts, skb_headlen(skb), skb->data, entry, false))) goto err_dma_0; txd_first = tp->TxDescArray + entry; frags = skb_shinfo(skb)->nr_frags; ^^^^^^ - INITIALIZATION IS HERE AFTER THE PATCHThere is no such problem in upstream because
rtl_tx_slots_avail()has nonr_fragsargument there.Quoted 5 lines
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--
Alexey Khoroshilov
Linux Verification Center, ISPRAS
Quoted 8 lines
Looks like the frags argument was removed in commit
83c317d7b36bb(r8169: removenr_fragsargument fromrtl_tx_slots_avail), which first appears in linux-5.11.I dare say it would be safe to replace
if (unlikely(!rtl_tx_slots_avail(tp, frags))) {
with
if (unlikely(!rtl_tx_slots_avail(tp, MAX_SKB_FRAGS))) {Best wait for Heiner to confirm though.
I'll just drop this commit for now, thanks.
greg k-h
Greg Kroah-Hartman
maintainerPATCH 5/317 ring-buffer: Fix a race between readers and resize checks
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Pavlu <[email protected]>
commit c2274b908db05529980ec056359fae916939fdaa upstream.
The reader code in rb_get_reader_page() swaps a new reader page into the ring buffer by doing cmpxchg on old->list.prev->next to point it to the new page. Following that, if the operation is successful, old->list.next->prev gets updated too. This means the underlying doubly-linked list is temporarily inconsistent, page->prev->next or page->next->prev might not be equal back to page for some page in the ring buffer.
The resize operation in ring_buffer_resize() can be invoked in parallel. It calls rb_check_pages() which can detect the described inconsistency and stop further tracing:
[ 190.271762] ------------[ cut here ]------------ [ 190.271771] WARNING: CPU: 1 PID: 6186 at kernel/trace/ring_buffer.c:1467 rb_check_pages.isra.0+0x6a/0xa0 [ 190.271789] Modules linked in: [...] [ 190.271991] Unloaded tainted modules: intel_uncore_frequency(E):1 skx_edac(E):1 [ 190.272002] CPU: 1 PID: 6186 Comm: cmd.sh Kdump: loaded Tainted: G E 6.9.0-rc6-default #5 158d3e1e6d0b091c34c3b96bfd99a1c58306d79f [ 190.272011] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552c-rebuilt.opensuse.org 04/01/2014 [ 190.272015] RIP: 0010:rb_check_pages.isra.0+0x6a/0xa0 [ 190.272023] Code: [...] [ 190.272028] RSP: 0018:ffff9c37463abb70 EFLAGS: 00010206 [ 190.272034] RAX: ffff8eba04b6cb80 RBX: 0000000000000007 RCX: ffff8eba01f13d80 [ 190.272038] RDX: ffff8eba01f130c0 RSI: ffff8eba04b6cd00 RDI: ffff8eba0004c700 [ 190.272042] RBP: ffff8eba0004c700 R08: 0000000000010002 R09: 0000000000000000 [ 190.272045] R10: 00000000ffff7f52 R11: ffff8eba7f600000 R12: ffff8eba0004c720 [ 190.272049] R13: ffff8eba00223a00 R14: 0000000000000008 R15: ffff8eba067a8000 [ 190.272053] FS: 00007f1bd64752c0(0000) GS:ffff8eba7f680000(0000) knlGS:0000000000000000 [ 190.272057] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 190.272061] CR2: 00007f1bd6662590 CR3: 000000010291e001 CR4: 0000000000370ef0 [ 190.272070] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 190.272073] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 190.272077] Call Trace: [ 190.272098] <TASK> [ 190.272189] ring_buffer_resize+0x2ab/0x460 [ 190.272199] __tracing_resize_ring_buffer.part.0+0x23/0xa0 [ 190.272206] tracing_resize_ring_buffer+0x65/0x90 [ 190.272216] tracing_entries_write+0x74/0xc0 [ 190.272225] vfs_write+0xf5/0x420 [ 190.272248] ksys_write+0x67/0xe0 [ 190.272256] do_syscall_64+0x82/0x170 [ 190.272363] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 190.272373] RIP: 0033:0x7f1bd657d263 [ 190.272381] Code: [...] [ 190.272385] RSP: 002b:00007ffe72b643f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 190.272391] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f1bd657d263 [ 190.272395] RDX: 0000000000000002 RSI: 0000555a6eb538e0 RDI: 0000000000000001 [ 190.272398] RBP: 0000555a6eb538e0 R08: 000000000000000a R09: 0000000000000000 [ 190.272401] R10: 0000555a6eb55190 R11: 0000000000000246 R12: 00007f1bd6662500 [ 190.272404] R13: 0000000000000002 R14: 00007f1bd6667c00 R15: 0000000000000002 [ 190.272412] </TASK> [ 190.272414] ---[ end trace 0000000000000000 ]---
Note that ring_buffer_resize() calls rb_check_pages() only if the parent trace_buffer has recording disabled. Recent commit d78ab792705c ("tracing: Stop current tracer when resizing buffer") causes that it is now always the case which makes it more likely to experience this issue.
The window to hit this race is nonetheless very small. To help reproducing it, one can add a delay loop in rb_get_reader_page():
ret = rb_head_page_replace(reader, cpu_buffer->reader_page); if (!ret)
goto spin;
for (unsigned i = 0; i < 1U << 26; i++) /* inserted delay loop */
__asm__ __volatile__ ("" : : : "memory");
rb_list_head(reader->list.next)->prev = &cpu_buffer->reader_page->list;
.. and then run the following commands on the target system:
echo 1 > /sys/kernel/tracing/events/sched/sched_switch/enable while true; do
echo 16 > /sys/kernel/tracing/buffer_size_kb; sleep 0.1 echo 8 > /sys/kernel/tracing/buffer_size_kb; sleep 0.1
done &
while true; do
for i in /sys/kernel/tracing/per_cpu/*; do
timeout 0.1 cat $i/trace_pipe; sleep 0.2
done
done
To fix the problem, make sure ring_buffer_resize() doesn't invoke rb_check_pages() concurrently with a reader operating on the same ring_buffer_per_cpu by taking its cpu_buffer->reader_lock.
--- kernel/trace/ring_buffer.c | 9 +++++++++ 1 file changed, 9 insertions(+)
kernel/trace/ring_buffer.c +9 -0
@@ -1498,6 +1498,11 @@ static int rb_check_bpage(struct ring_bu* * As a safety measure we check to make sure the data pages have not * been corrupted. +* +* Callers of this function need to guarantee that the list of pages doesn't get +* modified during the check. In particular, if it's possible that the function +* is invoked with concurrent readers which can swap in a new reader page then +* the caller should take cpu_buffer->reader_lock. */ static int rb_check_pages (struct ring_buffer_per_cpu *cpu_buffer) {
@@ -2222,8 +2227,12 @@ int ring_buffer_resize(struct trace_buff*/ synchronize_rcu ();for_each_buffer_cpu (buffer, cpu) { +unsigned long flags; + cpu_buffer = buffer->buffers[cpu]; +raw_spin_lock_irqsave (&cpu_buffer->reader_lock, flags);rb_check_pages (cpu_buffer); +raw_spin_unlock_irqrestore (&cpu_buffer->reader_lock, flags); }atomic_dec (&buffer->record_disabled); }
Greg Kroah-Hartman
maintainerPATCH 6/317 net: smc91x: Fix m68k kernel compilation for ColdFire CPU
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <[email protected]>
commit 5eefb477d21a26183bc3499aeefa991198315a2d upstream.
Compiling the m68k kernel with support for the ColdFire CPU family fails with the following error:
In file included from drivers/net/ethernet/smsc/smc91x.c:80:drivers/net/ethernet/smsc/smc91x.c: In function ‘smc_reset’:drivers/net/ethernet/smsc/smc91x.h:160:40: error: implicit declaration of function ‘_swapw’; did you mean ‘swap’? [-Werror=implicit-function-declaration]
160 | #define SMC_outw(lp, v, a, r) writew(_swapw(v), (a) + (r))
| ^~~~~~drivers/net/ethernet/smsc/smc91x.h:904:25: note: in expansion of macro ‘SMC_outw’
904 | SMC_outw(lp, x, ioaddr, BANK_SELECT); \
| ^~~~~~~~
drivers/net/ethernet/smsc/smc91x.c:250:9: note: in expansion of macro ‘SMC_SELECT_BANK’
250 | SMC_SELECT_BANK(lp, 2);
| ^~~~~~~~~~~~~~~cc1: some warnings being treated as errors
The function _swapw() was removed in commit d97cf70af097 ("m68k: use asm-generic/io.h for non-MMU io access functions"), but is still used in drivers/net/ethernet/smsc/smc91x.h.
Use ioread16be() and iowrite16be() to resolve the error.
--- drivers/net/ethernet/smsc/smc91x.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/smsc/smc91x.h +2 -2
@@ -175,8 +175,8 @@ static inline void mcf_outsw(void *a, unwritew (*wp++, a); } -#define SMC_inw (a, r) _swapw(readw((a) + (r))) -#define SMC_outw (lp, v, a, r) writew(_swapw(v), (a) + (r)) +#define SMC_inw (a, r) ioread16be((a) + (r)) +#define SMC_outw (lp, v, a, r) iowrite16be(v, (a) + (r))#define SMC_insw (a, r, p, l) mcf_insw(a + r, p, l)#define SMC_outsw (a, r, p, l) mcf_outsw(a + r, p, l)
Greg Kroah-Hartman
maintainerPATCH 7/317 nilfs2: fix unexpected freezing of nilfs_segctor_sync()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <[email protected]>
commit 936184eadd82906992ff1f5ab3aada70cce44cee upstream.
A potential and reproducible race issue has been identified where nilfs_segctor_sync() would block even after the log writer thread writes a checkpoint, unless there is an interrupt or other trigger to resume log writing.
This turned out to be because, depending on the execution timing of the log writer thread running in parallel, the log writer thread may skip responding to nilfs_segctor_sync(), which causes a call to schedule() waiting for completion within nilfs_segctor_sync() to lose the opportunity to wake up.
The reason why waking up the task waiting in nilfs_segctor_sync() may be skipped is that updating the request generation issued using a shared sequence counter and adding an wait queue entry to the request wait queue to the log writer, are not done atomically. There is a possibility that log writing and request completion notification by nilfs_segctor_wakeup() may occur between the two operations, and in that case, the wait queue entry is not yet visible to nilfs_segctor_wakeup() and the wake-up of nilfs_segctor_sync() will be carried over until the next request occurs.
Fix this issue by performing these two operations simultaneously within the lock section of sc_state_lock. Also, following the memory barrier guidelines for event waiting loops, move the call to set_current_state() in the same location into the event waiting loop to ensure that a memory barrier is inserted just before the event condition determination.
--- fs/nilfs2/segment.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-)
fs/nilfs2/segment.c +13 -4
@@ -2212,19 +2212,28 @@ static int nilfs_segctor_sync(struct nilstruct nilfs_segctor_wait_request wait_req;int err =0 ; -spin_lock (&sci->sc_state_lock);init_wait (&wait_req.wq); wait_req.err =0 ;atomic_set (&wait_req.done,0 ); +init_waitqueue_entry (&wait_req.wq, current); + +/* +* To prevent a race issue where completion notifications from the +* log writer thread are missed, increment the request sequence count +* "sc_seq_request" and insert a wait queue entry using the current +* sequence number into the "sc_wait_request" queue at the same time +* within the lock section of "sc_state_lock". +*/ +spin_lock (&sci->sc_state_lock); wait_req.seq = ++sci->sc_seq_request; +add_wait_queue (&sci->sc_wait_request, &wait_req.wq);spin_unlock (&sci->sc_state_lock); -init_waitqueue_entry (&wait_req.wq, current); -add_wait_queue (&sci->sc_wait_request, &wait_req.wq); -set_current_state (TASK_INTERRUPTIBLE );wake_up (&sci->sc_wait_daemon);for (;;) { +set_current_state (TASK_INTERRUPTIBLE ); +if (atomic_read (&wait_req.done)) { err = wait_req.err;break ;
Greg Kroah-Hartman
maintainerPATCH 8/317 nilfs2: fix potential hang in nilfs_detach_log_writer()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <[email protected]>
commit eb85dace897c5986bc2f36b3c783c6abb8a4292e upstream.
Syzbot has reported a potential hang in nilfs_detach_log_writer() called during nilfs2 unmount.
Analysis revealed that this is because nilfs_segctor_sync(), which synchronizes with the log writer thread, can be called after nilfs_segctor_destroy() terminates that thread, as shown in the call trace below:
nilfs_detach_log_writer
nilfs_segctor_destroy
nilfs_segctor_kill_thread --> Shut down log writer thread
flush_work
nilfs_iput_work_func
nilfs_dispose_list
iput
nilfs_evict_inode
nilfs_transaction_commit
nilfs_construct_segment (if inode needs sync)
nilfs_segctor_sync --> Attempt to synchronize with
log writer thread
*** DEADLOCK ***Fix this issue by changing nilfs_segctor_sync() so that the log writer thread returns normally without synchronizing after it terminates, and by forcing tasks that are already waiting to complete once after the thread terminates.
The skipped inode metadata flushout will then be processed together in the subsequent cleanup work in nilfs_segctor_destroy().
--- fs/nilfs2/segment.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-)
fs/nilfs2/segment.c +18 -3
@@ -2234,6 +2234,14 @@ static int nilfs_segctor_sync(struct nilfor (;;) {set_current_state (TASK_INTERRUPTIBLE ); +/* +* Synchronize only while the log writer thread is alive. +* Leave flushing out after the log writer thread exits to +* the cleanup work in nilfs_segctor_destroy(). +*/ +if (!sci->sc_task) +break ; +if (atomic_read (&wait_req.done)) { err = wait_req.err;break ;
@@ -2249,7 +2257,7 @@ static int nilfs_segctor_sync(struct nilreturn err; } -static void nilfs_segctor_wakeup (struct nilfs_sc_info *sci,int err) +static void nilfs_segctor_wakeup (struct nilfs_sc_info *sci,int err,bool force) {struct nilfs_segctor_wait_request *wrq, *n;unsigned long flags;
@@ -2257,7 +2265,7 @@ static void nilfs_segctor_wakeup(structspin_lock_irqsave (&sci->sc_wait_request.lock, flags);list_for_each_entry_safe (wrq, n, &sci->sc_wait_request.head, wq.entry) {if (!atomic_read (&wrq->done) && -nilfs_cnt32_ge (sci->sc_seq_done, wrq->seq)) { + (force ||nilfs_cnt32_ge (sci->sc_seq_done, wrq->seq))) { wrq->err = err;atomic_set (&wrq->done,1 ); }
@@ -2397,7 +2405,7 @@ static void nilfs_segctor_notify(structif (mode ==SC_LSEG_SR ) { sci->sc_state &= ~NILFS_SEGCTOR_COMMIT ; sci->sc_seq_done = sci->sc_seq_accepted; -nilfs_segctor_wakeup (sci, err); +nilfs_segctor_wakeup (sci, err, false); sci->sc_flush_request =0 ; }else {if (mode ==SC_FLUSH_FILE )
@@ -2779,6 +2787,13 @@ static void nilfs_segctor_destroy(struct || sci->sc_seq_request != sci->sc_seq_done);spin_unlock (&sci->sc_state_lock); +/* +* Forcibly wake up tasks waiting in nilfs_segctor_sync(), which can +* be called from delayed iput() via nilfs_evict_inode() and can race +* with the above log writer thread termination. +*/ +nilfs_segctor_wakeup (sci,0 , true); +if (flush_work (&sci->sc_iput_work)) flag = true;
Greg Kroah-Hartman
maintainerPATCH 9/317 ALSA: core: Fix NULL module pointer assignment at card init
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 39381fe7394e5eafac76e7e9367e7351138a29c1 upstream.
The commit 81033c6b584b ("ALSA: core: Warn on empty module") introduced a WARN_ON() for a NULL module pointer passed at snd_card object creation, and it also wraps the code around it with '#ifdef MODULE'. This works in most cases, but the devils are always in details. "MODULE" is defined when the target code (i.e. the sound core) is built as a module; but this doesn't mean that the caller is also built-in or not. Namely, when only the sound core is built-in (CONFIG_SND=y) while the driver is a module (CONFIG_SND_USB_AUDIO=m), the passed module pointer is ignored even if it's non-NULL, and card->module remains as NULL. This would result in the missing module reference up/down at the device open/close, leading to a race with the code execution after the module removal.
For addressing the bug, move the assignment of card->module again out of ifdef. The WARN_ON() is still wrapped with ifdef because the module can be really NULL when all sound drivers are built-in.
Note that we keep 'ifdef MODULE' for WARN_ON(), otherwise it would lead to a false-positive NULL module check. Admittedly it won't catch perfectly, i.e. no check is performed when CONFIG_SND=y. But, it's no real problem as it's only for debugging, and the condition is pretty rare.
--- sound/core/init.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/core/init.c +1 -1
@@ -206,8 +206,8 @@ int snd_card_new(struct device *parent, card->number = idx;#ifdef MODULE WARN_ON (!module); - card->module = module;#endif + card->module = module;INIT_LIST_HEAD (&card->devices);init_rwsem (&card->controls_rwsem);rwlock_init (&card->ctl_files_rwlock);
Greg Kroah-Hartman
maintainerPATCH 10/317 wifi: cfg80211: fix the order of arguments for trace events of the tx_rx_evt class
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Igor Artemiev <[email protected]>
[ Upstream commit 9ef369973cd2c97cce3388d2c0c7e3c056656e8a ]
The declarations of the tx_rx_evt class and the rdev_set_antenna event use the wrong order of arguments in the TP_ARGS macro.
Fix the order of arguments in the TP_ARGS macro.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- net/wireless/trace.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/wireless/trace.h +2 -2
@@ -1660,7 +1660,7 @@ TRACE_EVENT(rdev_return_void_tx_rx, DECLARE_EVENT_CLASS(tx_rx_evt, TP_PROTO(struct wiphy *wiphy, u32 tx, u32 rx), - TP_ARGS(wiphy, rx, tx), + TP_ARGS(wiphy, tx, rx), TP_STRUCT__entry( WIPHY_ENTRY __field(u32, tx)
@@ -1677,7 +1677,7 @@ DECLARE_EVENT_CLASS(tx_rx_evt,DEFINE_EVENT (tx_rx_evt, rdev_set_antenna, TP_PROTO(struct wiphy *wiphy, u32 tx, u32 rx), -TP_ARGS (wiphy, rx, tx) +TP_ARGS (wiphy, tx, rx) ); DECLARE_EVENT_CLASS(wiphy_netdev_id_evt,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 11/317 net: usb: qmi_wwan: add Telit FN920C04 compositions
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniele Palmas <[email protected]>
[ Upstream commit 0b8fe5bd73249dc20be2e88a12041f8920797b59 ]
Add the following Telit FN920C04 compositions:
0x10a0: rmnet + tty (AT/NMEA) + tty (AT) + tty (diag)
T: Bus=03 Lev=01 Prnt=03 Port=06 Cnt=01 Dev#= 5 Spd=480 MxCh= 0 D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10a0 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FN920 S: SerialNumber=92c4c4d8 C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10a4: rmnet + tty (AT) + tty (AT) + tty (diag)
T: Bus=03 Lev=01 Prnt=03 Port=06 Cnt=01 Dev#= 8 Spd=480 MxCh= 0 D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10a4 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FN920 S: SerialNumber=92c4c4d8 C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10a9: rmnet + tty (AT) + tty (diag) + DPL (data packet logging) + adb
T: Bus=03 Lev=01 Prnt=03 Port=06 Cnt=01 Dev#= 9 Spd=480 MxCh= 0 D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10a9 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FN920 S: SerialNumber=92c4c4d8 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/net/usb/qmi_wwan.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/usb/qmi_wwan.c +3 -0
@@ -1301,6 +1301,9 @@ static const struct usb_device_id products[] = { {QMI_QUIRK_SET_DTR(0x1bc7, 0x1060, 2)}, /* Telit LN920 */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1070, 2)}, /* Telit FN990 */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1080, 2)}, /* Telit FE990 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x10a0, 0)}, /* Telit FN920C04 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x10a4, 0)}, /* Telit FN920C04 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x10a9, 0)}, /* Telit FN920C04 */ {QMI_FIXED_INTF(0x1bc7, 0x1100, 3)}, /* Telit ME910 */ {QMI_FIXED_INTF(0x1bc7, 0x1101, 3)}, /* Telit ME910 dual modem */ {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 12/317 drm/amd/display: Set color_mgmt_changed to true on unsuspend
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Ashton <[email protected]>
[ Upstream commit 2eb9dd497a698dc384c0dd3e0311d541eb2e13dd ]
Otherwise we can end up with a frame on unsuspend where color management is not applied when userspace has not committed themselves.
Fixes re-applying color management on Steam Deck/Gamescope on S3 resume.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +1 -0
@@ -2099,6 +2099,7 @@ static int dm_resume(void *handle)dc_stream_release (dm_new_crtc_state->stream); dm_new_crtc_state->stream =NULL ; } + dm_new_crtc_state->base.color_mgmt_changed = true; }for_each_new_plane_in_state (dm->cached_state, plane, new_plane_state, i) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 13/317 ASoC: rt5645: Fix the electric noise due to the CBJ contacts floating
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Derek Fang <[email protected]>
[ Upstream commit 103abab975087e1f01b76fcb54c91dbb65dbc249 ]
The codec leaves tie combo jack's sleeve/ring2 to floating status default. It would cause electric noise while connecting the active speaker jack during boot or shutdown.
This patch requests a gpio to control the additional jack circuit to tie the contacts to the ground or floating.
--- sound/soc/codecs/rt5645.c | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+)
sound/soc/codecs/rt5645.c +25 -0
@@ -414,6 +414,7 @@ struct rt5645_priv {struct regmap *regmap;struct i2c_client *i2c;struct gpio_desc *gpiod_hp_det; +struct gpio_desc *gpiod_cbj_sleeve;struct snd_soc_jack *hp_jack;struct snd_soc_jack *mic_jack;struct snd_soc_jack *btn_jack;
@@ -3169,6 +3170,9 @@ static int rt5645_jack_detect(struct snd_soc_component *component, int jack_inseregmap_update_bits (rt5645->regmap,RT5645_IN1_CTRL2 ,RT5645_CBJ_MN_JD ,0 ); +if (rt5645->gpiod_cbj_sleeve) +gpiod_set_value (rt5645->gpiod_cbj_sleeve,1 ); +msleep (600 );regmap_read (rt5645->regmap,RT5645_IN1_CTRL3 , &val); val &=0x7 ;
@@ -3185,6 +3189,8 @@ static int rt5645_jack_detect(struct snd_soc_component *component, int jack_insesnd_soc_dapm_disable_pin (dapm,"Mic Det Power" );snd_soc_dapm_sync (dapm); rt5645->jack_type =SND_JACK_HEADPHONE ; +if (rt5645->gpiod_cbj_sleeve) +gpiod_set_value (rt5645->gpiod_cbj_sleeve,0 ); }if (rt5645->pdata.level_trigger_irq) regmap_update_bits(rt5645->regmap, RT5645_IRQ_CTRL2,
@@ -3210,6 +3216,9 @@ static int rt5645_jack_detect(struct snd_soc_component *component, int jack_inseif (rt5645->pdata.level_trigger_irq)regmap_update_bits (rt5645->regmap,RT5645_IRQ_CTRL2 ,RT5645_JD_1_1_MASK ,RT5645_JD_1_1_INV ); + +if (rt5645->gpiod_cbj_sleeve) +gpiod_set_value (rt5645->gpiod_cbj_sleeve,0 ); }return rt5645->jack_type;
@@ -3882,6 +3891,16 @@ static int rt5645_i2c_probe(struct i2c_client *i2c,return ret; } + rt5645->gpiod_cbj_sleeve =devm_gpiod_get_optional (&i2c->dev,"cbj-sleeve" , +GPIOD_OUT_LOW ); + +if (IS_ERR (rt5645->gpiod_cbj_sleeve)) { + ret =PTR_ERR (rt5645->gpiod_cbj_sleeve); +dev_info (&i2c->dev,"failed to initialize gpiod, ret=%d\n" , ret); +if (ret != -ENOENT ) +return ret; + } +for (i =0 ; i <ARRAY_SIZE (rt5645->supplies); i++) rt5645->supplies[i].supply = rt5645_supply_names[i];
@@ -4125,6 +4144,9 @@ static int rt5645_i2c_remove(struct i2c_client *i2c)cancel_delayed_work_sync (&rt5645->jack_detect_work);cancel_delayed_work_sync (&rt5645->rcclock_work); +if (rt5645->gpiod_cbj_sleeve) +gpiod_set_value (rt5645->gpiod_cbj_sleeve,0 ); +regulator_bulk_disable (ARRAY_SIZE (rt5645->supplies), rt5645->supplies);return 0 ;
@@ -4142,6 +4164,9 @@ static void rt5645_i2c_shutdown(struct i2c_client *i2c) 0);msleep (20 );regmap_write (rt5645->regmap,RT5645_RESET ,0 ); + +if (rt5645->gpiod_cbj_sleeve) +gpiod_set_value (rt5645->gpiod_cbj_sleeve,0 ); }static struct i2c_driver rt5645_i2c_driver = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 14/317 ASoC: dt-bindings: rt5645: add cbj sleeve gpio property
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Derek Fang <[email protected]>
[ Upstream commit 306b38e3fa727d22454a148a364123709e356600 ]
Add an optional gpio property to control external CBJ circuits to avoid some electric noise caused by sleeve/ring2 contacts floating.
--- Documentation/devicetree/bindings/sound/rt5645.txt | 6 ++++++ 1 file changed, 6 insertions(+)
Documentation/devicetree/bindings/sound/rt5645.txt +6 -0
@@ -20,6 +20,11 @@ Optional properties: a GPIO spec for the external headphone detect pin. If jd-mode = 0, we will get the JD status by getting the value of hp-detect-gpios. +- cbj-sleeve-gpios: + a GPIO spec to control the external combo jack circuit to tie the sleeve/ring2 + contacts to the ground or floating. It could avoid some electric noise from the + active speaker jacks. + - realtek,in2-differential Boolean. Indicate MIC2 input are differential, rather than single-ended.
@@ -68,6 +73,7 @@ codec: rt5650@1a { compatible = "realtek,rt5650"; reg = <0x1a>; hp-detect-gpios = <&gpio 19 0>; + cbj-sleeve-gpios = <&gpio 20 0>; interrupt-parent = <&gpio>; interrupts = <7 IRQ_TYPE_EDGE_FALLING>; realtek,dmic-en = "true";
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 15/317 regulator: vqmmc-ipq4019: fix module autoloading
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 68adb581a39ae63a0ed082c47f01fbbe515efa0e ]
Add MODULE_DEVICE_TABLE(), so the module could be properly autoloaded based on the alias from of_device_id table.
--- drivers/regulator/vqmmc-ipq4019-regulator.c | 1 + 1 file changed, 1 insertion(+)
drivers/regulator/vqmmc-ipq4019-regulator.c +1 -0
@@ -86,6 +86,7 @@ static const struct of_device_id regulator_ipq4019_of_match[] = { { .compatible = "qcom,vqmmc-ipq4019-regulator", }, {}, }; +MODULE_DEVICE_TABLE (of, regulator_ipq4019_of_match);static struct platform_driver ipq4019_regulator_driver = { .probe = ipq4019_regulator_probe,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 16/317 ASoC: rt715: add vendor clear control register
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jack Yu <[email protected]>
[ Upstream commit cebfbc89ae2552dbb58cd9b8206a5c8e0e6301e9 ]
Add vendor clear control register in readable register's callback function. This prevents an access failure reported in Intel CI tests.
--- sound/soc/codecs/rt715-sdw.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/codecs/rt715-sdw.c +1 -0
@@ -110,6 +110,7 @@ static bool rt715_readable_register(struct device *dev, unsigned int reg)case 0x839d :case 0x83a7 :case 0x83a9 : +case 0x752001 :case 0x752039 :return true;default :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 17/317 ASoC: da7219-aad: fix usage of device_get_named_child_node()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre-Louis Bossart <[email protected]>
[ Upstream commit e8a6a5ad73acbafd98e8fd3f0cbf6e379771bb76 ]
The documentation for device_get_named_child_node() mentions this important point:
"
The caller is responsible for calling fwnode_handle_put() on the returned fwnode pointer.
"
Add fwnode_handle_put() to avoid a leaked reference.
--- sound/soc/codecs/da7219-aad.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
sound/soc/codecs/da7219-aad.c +5 -1
@@ -629,8 +629,10 @@ static struct da7219_aad_pdata *da7219_aad_fw_to_pdata(struct device *dev)return NULL ; aad_pdata =devm_kzalloc (dev,sizeof (*aad_pdata),GFP_KERNEL ); -if (!aad_pdata) +if (!aad_pdata) { +fwnode_handle_put (aad_np);return NULL ; + } aad_pdata->irq = i2c->irq;
@@ -705,6 +707,8 @@ static struct da7219_aad_pdata *da7219_aad_fw_to_pdata(struct device *dev)else aad_pdata->adc_1bit_rpt =DA7219_AAD_ADC_1BIT_RPT_1 ; +fwnode_handle_put (aad_np); +return aad_pdata; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 18/317 drm/amdkfd: Flush the process wq before creating a kfd_process
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lancelot SIX <[email protected]>
[ Upstream commit f5b9053398e70a0c10aa9cb4dd5910ab6bc457c5 ]
There is a race condition when re-creating a kfd_process for a process. This has been observed when a process under the debugger executes exec(3). In this scenario:
- The process executes exec.
- This will eventually release the process's mm, which will cause the kfd_process object associated with the process to be freed (kfd_process_free_notifier decrements the reference count to the kfd_process to 0). This causes kfd_process_ref_release to enqueue kfd_process_wq_release to the kfd_process_wq.
- The debugger receives the PTRACE_EVENT_EXEC notification, and tries to re-enable AMDGPU traps (KFD_IOC_DBG_TRAP_ENABLE).
- When handling this request, KFD tries to re-create a kfd_process. This eventually calls kfd_create_process and kobject_init_and_add.
At this point the call to kobject_init_and_add can fail because the old kfd_process.kobj has not been freed yet by kfd_process_wq_release.
This patch proposes to avoid this race by making sure to drain kfd_process_wq before creating a new kfd_process object. This way, we know that any cleanup task is done executing when we reach kobject_init_and_add.
--- drivers/gpu/drm/amd/amdkfd/kfd_process.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/gpu/drm/amd/amdkfd/kfd_process.c +8 -0
@@ -766,6 +766,14 @@ struct kfd_process *kfd_create_process(struct file *filep)if (process) {pr_debug ("Process already found\n" ); }else { +/* If the process just called exec(3), it is possible that the +* cleanup of the kfd_process (following the release of the mm +* of the old process image) is still in the cleanup work queue. +* Make sure to drain any job before trying to recreate any +* resource for this process. +*/ +flush_workqueue (kfd_process_wq); + process =create_process (thread);if (IS_ERR (process)) goto out;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 19/317 nvme: find numa distance only if controller has valid numa id
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nilay Shroff <[email protected]>
[ Upstream commit 863fe60ed27f2c85172654a63c5b827e72c8b2e6 ]
On system where native nvme multipath is configured and iopolicy is set to numa but the nvme controller numa node id is undefined or -1 (NUMA_NO_NODE) then avoid calculating node distance for finding optimal io path. In such case we may access numa distance table with invalid index and that may potentially refer to incorrect memory. So this patch ensures that if the nvme controller numa node id is -1 then instead of calculating node distance for finding optimal io path, we set the numa node distance of such controller to default 10 (LOCAL_DISTANCE).
--- drivers/nvme/host/multipath.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/nvme/host/multipath.c +2 -1
@@ -168,7 +168,8 @@ static struct nvme_ns *__nvme_find_path(struct nvme_ns_head *head, int node)if (nvme_path_is_disabled (ns))continue ; -if (READ_ONCE (head->subsys->iopolicy) ==NVME_IOPOLICY_NUMA ) +if (ns->ctrl->numa_node !=NUMA_NO_NODE && +READ_ONCE (head->subsys->iopolicy) ==NVME_IOPOLICY_NUMA ) distance =node_distance (node, ns->ctrl->numa_node);else distance =LOCAL_DISTANCE ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 20/317 openpromfs: finish conversion to the new mount API
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Sandeen <[email protected]>
[ Upstream commit 8f27829974b025d4df2e78894105d75e3bf349f0 ]
The original mount API conversion inexplicably left out the change from ->remount_fs to ->reconfigure; do that now.
--- fs/openpromfs/inode.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
fs/openpromfs/inode.c +4 -4
@@ -362,10 +362,10 @@ static struct inode *openprom_iget(struct super_block *sb, ino_t ino)return inode; } -static int openprom_remount (struct super_block *sb,int *flags,char *data) +static int openpromfs_reconfigure (struct fs_context *fc) { -sync_filesystem (sb); - *flags |=SB_NOATIME ; +sync_filesystem (fc->root->d_sb); + fc->sb_flags |=SB_NOATIME ;return 0 ; }
@@ -373,7 +373,6 @@ static const struct super_operations openprom_sops = { .alloc_inode = openprom_alloc_inode, .free_inode = openprom_free_inode, .statfs = simple_statfs, - .remount_fs = openprom_remount, };static int openprom_fill_super (struct super_block *s,struct fs_context *fc)
@@ -417,6 +416,7 @@ static int openpromfs_get_tree(struct fs_context *fc)static const struct fs_context_operations openpromfs_context_ops = { .get_tree = openpromfs_get_tree, + .reconfigure = openpromfs_reconfigure, };static int openpromfs_init_fs_context (struct fs_context *fc)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 21/317 crypto: bcm - Fix pointer arithmetic
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Mishin <[email protected]>
[ Upstream commit 2b3460cbf454c6b03d7429e9ffc4fe09322eb1a9 ]
In spu2_dump_omd() value of ptr is increased by ciph_key_len instead of hash_iv_len which could lead to going beyond the buffer boundaries.
Fix this bug by changing ciph_key_len to hash_iv_len.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/crypto/bcm/spu2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/bcm/spu2.c +1 -1
@@ -495,7 +495,7 @@ static void spu2_dump_omd(u8 *omd, u16 hash_key_len, u16 ciph_key_len,if (hash_iv_len) {packet_log (" Hash IV Length %u bytes\n" , hash_iv_len);packet_dump (" hash IV: " , ptr, hash_iv_len); - ptr += ciph_key_len; + ptr += hash_iv_len; }if (ciph_iv_len) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 22/317 firmware: raspberrypi: Use correct device for DMA mappings
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laurent Pinchart <[email protected]>
[ Upstream commit df518a0ae1b982a4dcf2235464016c0c4576a34d ]
The buffer used to transfer data over the mailbox interface is mapped using the client's device. This is incorrect, as the device performing the DMA transfer is the mailbox itself. Fix it by using the mailbox controller device instead.
This requires including the mailbox_controller.h header to dereference the mbox_chan and mbox_controller structures. The header is not meant to be included by clients. This could be fixed by extending the client API with a function to access the controller's device.
--- drivers/firmware/raspberrypi.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/firmware/raspberrypi.c +4 -3
@@ -9,6 +9,7 @@#include <linux/dma-mapping.h> #include <linux/kref.h> #include <linux/mailbox_client.h> +#include <linux/mailbox_controller.h> #include <linux/module.h> #include <linux/of_platform.h> #include <linux/platform_device.h>
@@ -96,8 +97,8 @@ int rpi_firmware_property_list(struct rpi_firmware *fw,if (size &3 )return -EINVAL ; - buf =dma_alloc_coherent (fw->cl.dev,PAGE_ALIGN (size), &bus_addr, -GFP_ATOMIC ); + buf =dma_alloc_coherent (fw->chan->mbox->dev,PAGE_ALIGN (size), + &bus_addr,GFP_ATOMIC );if (!buf)return -ENOMEM ;
@@ -125,7 +126,7 @@ int rpi_firmware_property_list(struct rpi_firmware *fw, ret = -EINVAL ; } -dma_free_coherent (fw->cl.dev,PAGE_ALIGN (size), buf, bus_addr); +dma_free_coherent (fw->chan->mbox->dev,PAGE_ALIGN (size), buf, bus_addr);return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 23/317 ecryptfs: Fix buffer size for tag 66 packet
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Kubisiak <[email protected]>
[ Upstream commit 85a6a1aff08ec9f5b929d345d066e2830e8818e5 ]
The 'TAG 66 Packet Format' description is missing the cipher code and checksum fields that are packed into the message packet. As a result, the buffer allocated for the packet is 3 bytes too small and write_tag_66_packet() will write up to 3 bytes past the end of the buffer.
Fix this by increasing the size of the allocation so the whole packet will always fit in the buffer.
This fixes the below kasan slab-out-of-bounds bug:
BUG: KASAN: slab-out-of-bounds in ecryptfs_generate_key_packet_set+0x7d6/0xde0 Write of size 1 at addr ffff88800afbb2a5 by task touch/181 CPU: 0 PID: 181 Comm: touch Not tainted 6.6.13-gnu #1 4c9534092be820851bb687b82d1f92a426598dc6 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2/GNU Guix 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x4c/0x70 print_report+0xc5/0x610 ? ecryptfs_generate_key_packet_set+0x7d6/0xde0 ? kasan_complete_mode_report_info+0x44/0x210 ? ecryptfs_generate_key_packet_set+0x7d6/0xde0 kasan_report+0xc2/0x110 ? ecryptfs_generate_key_packet_set+0x7d6/0xde0 __asan_store1+0x62/0x80 ecryptfs_generate_key_packet_set+0x7d6/0xde0 ? __pfx_ecryptfs_generate_key_packet_set+0x10/0x10 ? __alloc_pages+0x2e2/0x540 ? __pfx_ovl_open+0x10/0x10 [overlay 30837f11141636a8e1793533a02e6e2e885dad1d] ? dentry_open+0x8f/0xd0 ecryptfs_write_metadata+0x30a/0x550 ? __pfx_ecryptfs_write_metadata+0x10/0x10 ? ecryptfs_get_lower_file+0x6b/0x190 ecryptfs_initialize_file+0x77/0x150 ecryptfs_create+0x1c2/0x2f0 path_openat+0x17cf/0x1ba0 ? __pfx_path_openat+0x10/0x10 do_filp_open+0x15e/0x290 ? __pfx_do_filp_open+0x10/0x10 ? __kasan_check_write+0x18/0x30 ? _raw_spin_lock+0x86/0xf0 ? __pfx__raw_spin_lock+0x10/0x10 ? __kasan_check_write+0x18/0x30 ? alloc_fd+0xf4/0x330 do_sys_openat2+0x122/0x160 ? __pfx_do_sys_openat2+0x10/0x10 __x64_sys_openat+0xef/0x170 ? __pfx___x64_sys_openat+0x10/0x10 do_syscall_64+0x60/0xd0 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 RIP: 0033:0x7f00a703fd67 Code: 25 00 00 41 00 3d 00 00 41 00 74 37 64 8b 04 25 18 00 00 00 85 c0 75 5b 44 89 e2 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 85 00 00 00 48 83 c4 68 5d 41 5c c3 0f 1f RSP: 002b:00007ffc088e30b0 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007ffc088e3368 RCX: 00007f00a703fd67 RDX: 0000000000000941 RSI: 00007ffc088e48d7 RDI: 00000000ffffff9c RBP: 00007ffc088e48d7 R08: 0000000000000001 R09: 0000000000000000 R10: 00000000000001b6 R11: 0000000000000246 R12: 0000000000000941 R13: 0000000000000000 R14: 00007ffc088e48d7 R15: 00007f00a7180040 </TASK> Allocated by task 181: kasan_save_stack+0x2f/0x60 kasan_set_track+0x29/0x40 kasan_save_alloc_info+0x25/0x40 __kasan_kmalloc+0xc5/0xd0 __kmalloc+0x66/0x160 ecryptfs_generate_key_packet_set+0x6d2/0xde0 ecryptfs_write_metadata+0x30a/0x550 ecryptfs_initialize_file+0x77/0x150 ecryptfs_create+0x1c2/0x2f0 path_openat+0x17cf/0x1ba0 do_filp_open+0x15e/0x290 do_sys_openat2+0x122/0x160 __x64_sys_openat+0xef/0x170 do_syscall_64+0x60/0xd0 entry_SYSCALL_64_after_hwframe+0x6e/0xd8
--- fs/ecryptfs/keystore.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/ecryptfs/keystore.c +3 -1
@@ -300,9 +300,11 @@ write_tag_66_packet(char *signature, u8 cipher_code,* | Key Identifier Size | 1 or 2 bytes | * | Key Identifier | arbitrary | * | File Encryption Key Size | 1 or 2 bytes | +* | Cipher Code | 1 byte | * | File Encryption Key | arbitrary | +* | Checksum | 2 bytes | */ - data_len = (5 +ECRYPTFS_SIG_SIZE_HEX + crypt_stat->key_size); + data_len = (8 +ECRYPTFS_SIG_SIZE_HEX + crypt_stat->key_size); *packet =kmalloc (data_len,GFP_KERNEL ); message = *packet;if (!message) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 24/317 nilfs2: fix out-of-range warning
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit c473bcdd80d4ab2ae79a7a509a6712818366e32a ]
clang-14 points out that v_size is always smaller than a 64KB page size if that is configured by the CPU architecture:
fs/nilfs2/ioctl.c:63:19: error: result of comparison of constant 65536 with expression of type '__u16' (aka 'unsigned short') is always false [-Werror,-Wtautological-constant-out-of-range-compare]
if (argv->v_size > PAGE_SIZE)
~~~~~~~~~~~~ ^ ~~~~~~~~~This is ok, so just shut up that warning with a cast.
--- fs/nilfs2/ioctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nilfs2/ioctl.c +1 -1
@@ -59,7 +59,7 @@ static int nilfs_ioctl_wrap_copy(struct the_nilfs *nilfs,if (argv->v_nmembs ==0 )return 0 ; -if (argv->v_size >PAGE_SIZE ) +if ((size_t )argv->v_size >PAGE_SIZE )return -EINVAL ;/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 25/317 parisc: add missing export of __cmpxchg_u8()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit c57e5dccb06decf3cb6c272ab138c033727149b5 ]
__cmpxchg_u8() had been added (initially) for the sake of drivers/phy/ti/phy-tusb1210.c; the thing is, that drivers is modular, so we need an export
--- arch/parisc/kernel/parisc_ksyms.c | 1 + 1 file changed, 1 insertion(+)
arch/parisc/kernel/parisc_ksyms.c +1 -0
@@ -21,6 +21,7 @@ EXPORT_SYMBOL(memset);#include <linux/atomic.h> EXPORT_SYMBOL (__xchg8);EXPORT_SYMBOL (__xchg32); +EXPORT_SYMBOL (__cmpxchg_u8);EXPORT_SYMBOL (__cmpxchg_u32);EXPORT_SYMBOL (__cmpxchg_u64);#ifdef CONFIG_SMP
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 26/317 crypto: ccp - drop platform ifdef checks
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 42c2d7d02977ef09d434b1f5b354f5bc6c1027ab ]
When both ACPI and OF are disabled, the dev_vdata variable is unused:
drivers/crypto/ccp/sp-platform.c:33:34: error: unused variable 'dev_vdata' [-Werror,-Wunused-const-variable]
This is not a useful configuration, and there is not much point in saving a few bytes when only one of the two is enabled, so just remove all these ifdef checks and rely on of_match_node() and acpi_match_device() returning NULL when these subsystems are disabled.
--- drivers/crypto/ccp/sp-platform.c | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-)
drivers/crypto/ccp/sp-platform.c +2 -12
@@ -39,44 +39,38 @@ static const struct sp_dev_vdata dev_vdata[] = { }, }; -#ifdef CONFIG_ACPI static const struct acpi_device_id sp_acpi_match[] = { {"AMDI0C00" , (kernel_ulong_t)&dev_vdata[0 ] }, { }, };MODULE_DEVICE_TABLE (acpi, sp_acpi_match); -#endif -#ifdef CONFIG_OF static const struct of_device_id sp_of_match[] = { { .compatible ="amd,ccp-seattle-v1a" , .data = (const void *)&dev_vdata[0 ] }, { }, };MODULE_DEVICE_TABLE (of, sp_of_match); -#endif static struct sp_dev_vdata *sp_get_of_version (struct platform_device *pdev) { -#ifdef CONFIG_OF const struct of_device_id *match; match =of_match_node (sp_of_match, pdev->dev.of_node);if (match && match->data)return (struct sp_dev_vdata *)match->data; -#endif +return NULL ; }static struct sp_dev_vdata *sp_get_acpi_version (struct platform_device *pdev) { -#ifdef CONFIG_ACPI const struct acpi_device_id *match; match =acpi_match_device (sp_acpi_match, &pdev->dev);if (match && match->driver_data)return (struct sp_dev_vdata *)match->driver_data; -#endif +return NULL ; }
@@ -222,12 +216,8 @@ static int sp_platform_resume(struct platform_device *pdev)static struct platform_driver sp_platform_driver = { .driver = { .name ="ccp" , -#ifdef CONFIG_ACPI .acpi_match_table = sp_acpi_match, -#endif -#ifdef CONFIG_OF .of_match_table = sp_of_match, -#endif }, .probe = sp_platform_probe, .remove = sp_platform_remove,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 27/317 crypto: x86/nh-avx2 - add missing vzeroupper
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
[ Upstream commit 4ad096cca942959871d8ff73826d30f81f856f6e ]
Since nh_avx2() uses ymm registers, execute vzeroupper before returning from it. This is necessary to avoid reducing the performance of SSE code.
--- arch/x86/crypto/nh-avx2-x86_64.S | 1 + 1 file changed, 1 insertion(+)
arch/x86/crypto/nh-avx2-x86_64.S +1 -0
@@ -153,5 +153,6 @@ SYM_FUNC_START(nh_avx2) vpaddq T1, T0, T0 vpaddq T4, T0, T0 vmovdqu T0, (HASH) + vzeroupper RET SYM_FUNC_END(nh_avx2)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 28/317 crypto: x86/sha256-avx2 - add missing vzeroupper
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
[ Upstream commit 57ce8a4e162599cf9adafef1f29763160a8e5564 ]
Since sha256_transform_rorx() uses ymm registers, execute vzeroupper before returning from it. This is necessary to avoid reducing the performance of SSE code.
--- arch/x86/crypto/sha256-avx2-asm.S | 1 + 1 file changed, 1 insertion(+)
arch/x86/crypto/sha256-avx2-asm.S +1 -0
@@ -711,6 +711,7 @@ done_hash: popq %r13 popq %r12 popq %rbx + vzeroupper RET SYM_FUNC_END(sha256_transform_rorx)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 29/317 s390/cio: fix tracepoint subchannel type field
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Oberparleiter <[email protected]>
[ Upstream commit 8692a24d0fae19f674d51726d179ad04ba95d958 ]
The subchannel-type field "st" of s390_cio_stsch and s390_cio_msch tracepoints is incorrectly filled with the subchannel-enabled SCHIB value "ena". Fix this by assigning the correct value.
--- drivers/s390/cio/trace.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/s390/cio/trace.h +1 -1
@@ -50,7 +50,7 @@ DECLARE_EVENT_CLASS(s390_class_schib, __entry->devno = schib->pmcw.dev; __entry->schib = *schib; __entry->pmcw_ena = schib->pmcw.ena; - __entry->pmcw_st = schib->pmcw.ena; + __entry->pmcw_st = schib->pmcw.st; __entry->pmcw_dnv = schib->pmcw.dnv; __entry->pmcw_dev = schib->pmcw.dev; __entry->pmcw_lpm = schib->pmcw.lpm;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 30/317 jffs2: prevent xattr node from overflowing the eraseblock
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Denisyev <[email protected]>
[ Upstream commit c6854e5a267c28300ff045480b5a7ee7f6f1d913 ]
Add a check to make sure that the requested xattr node size is no larger than the eraseblock minus the cleanmarker.
Unlike the usual inode nodes, the xattr nodes aren't split into parts and spread across multiple eraseblocks, which means that a xattr node must not occupy more than one eraseblock. If the requested xattr value is too large, the xattr node can spill onto the next eraseblock, overwriting the nodes and causing errors such as:
jffs2: argh. node added in wrong place at 0x0000b050(2)
jffs2: nextblock 0x0000a000, expected at 0000b00c
jffs2: error: (823) do_verify_xattr_datum: node CRC failed at 0x01e050, read=0xfc892c93, calc=0x000000
jffs2: notice: (823) jffs2_get_inode_nodes: Node header CRC failed at 0x01e00c. {848f,2fc4,0fef511f,59a3d171}
jffs2: Node at 0x0000000c with length 0x00001044 would run over the end of the erase block
jffs2: Perhaps the file system was created with the wrong erase size?
jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000010: 0x1044 instead
This breaks the filesystem and can lead to KASAN crashes such as:
BUG: KASAN: slab-out-of-bounds in jffs2_sum_add_kvec+0x125e/0x15d0 Read of size 4 at addr ffff88802c31e914 by task repro/830 CPU: 0 PID: 830 Comm: repro Not tainted 6.9.0-rc3+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0xc6/0x120 print_report+0xc4/0x620 ? __virt_addr_valid+0x308/0x5b0 kasan_report+0xc1/0xf0 ? jffs2_sum_add_kvec+0x125e/0x15d0 ? jffs2_sum_add_kvec+0x125e/0x15d0 jffs2_sum_add_kvec+0x125e/0x15d0 jffs2_flash_direct_writev+0xa8/0xd0 jffs2_flash_writev+0x9c9/0xef0 ? __x64_sys_setxattr+0xc4/0x160 ? do_syscall_64+0x69/0x140 ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [...]
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
--- fs/jffs2/xattr.c | 3 +++ 1 file changed, 3 insertions(+)
fs/jffs2/xattr.c +3 -0
@@ -1111,6 +1111,9 @@ int do_jffs2_setxattr(struct inode *inode, int xprefix, const char *xname,return rc; request =PAD (sizeof (struct jffs2_raw_xattr ) +strlen (xname) +1 + size); +if (request > c->sector_size - c->cleanmarker_size) +return -ERANGE ; + rc =jffs2_reserve_space (c, request, &length,ALLOC_NORMAL ,JFFS2_SUMMARY_XATTR_SIZE );if (rc) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 31/317 soc: mediatek: cmdq: Fix typo of CMDQ_JUMP_RELATIVE
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chun-Kuang Hu <[email protected]>
[ Upstream commit ed4d5ab179b9f0a60da87c650a31f1816db9b4b4 ]
For cmdq jump command, offset 0 means relative jump and offset 1 means absolute jump. cmdq_pkt_jump() is absolute jump, so fix the typo of CMDQ_JUMP_RELATIVE in cmdq_pkt_jump().
--- drivers/soc/mediatek/mtk-cmdq-helper.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/soc/mediatek/mtk-cmdq-helper.c +3 -2
@@ -13,7 +13,8 @@#define CMDQ_POLL_ENABLE_MASK BIT(0)#define CMDQ_EOC_IRQ_EN BIT(0)#define CMDQ_REG_TYPE 1 -#define CMDQ_JUMP_RELATIVE 1 +#define CMDQ_JUMP_RELATIVE 0 +#define CMDQ_JUMP_ABSOLUTE 1 struct cmdq_instruction { union {
@@ -414,7 +415,7 @@ int cmdq_pkt_jump(struct cmdq_pkt *pkt, dma_addr_t addr)struct cmdq_instruction inst = {}; inst.op =CMDQ_CODE_JUMP ; - inst.offset =CMDQ_JUMP_RELATIVE ; + inst.offset =CMDQ_JUMP_ABSOLUTE ; inst.value = addr >>cmdq_get_shift_pa (((struct cmdq_client *)pkt->cl)->chan);return cmdq_pkt_append_command (pkt, inst);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 32/317 null_blk: Fix missing mutex_destroy() at module removal
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhu Yanjun <[email protected]>
[ Upstream commit 07d1b99825f40f9c0d93e6b99d79a08d0717bac1 ]
When a mutex lock is not used any more, the function mutex_destroy should be called to mark the mutex lock uninitialized.
--- drivers/block/null_blk/main.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/block/null_blk/main.c +2 -0
@@ -2032,6 +2032,8 @@ static void __exit null_exit(void)if (g_queue_mode ==NULL_Q_MQ && shared_tags)blk_mq_free_tag_set (&tag_set); + +mutex_destroy (&lock); }module_init (null_init);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 33/317 md: fix resync softlockup when bitmap size is less than array size
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <[email protected]>
[ Upstream commit f0e729af2eb6bee9eb58c4df1087f14ebaefe26b ]
Is is reported that for dm-raid10, lvextend + lvchange --syncaction will trigger following softlockup:
kernel:watchdog: BUG: soft lockup - CPU#3 stuck for 26s! [mdX_resync:6976]
CPU: 7 PID: 3588 Comm: mdX_resync Kdump: loaded Not tainted 6.9.0-rc4-next-20240419 #1 RIP: 0010:_raw_spin_unlock_irq+0x13/0x30 Call Trace: <TASK> md_bitmap_start_sync+0x6b/0xf0 raid10_sync_request+0x25c/0x1b40 [raid10] md_do_sync+0x64b/0x1020 md_thread+0xa7/0x170 kthread+0xcf/0x100 ret_from_fork+0x30/0x50 ret_from_fork_asm+0x1a/0x30
And the detailed process is as follows:
md_do_sync
j = mddev->resync_min
while (j < max_sectors)
sectors = raid10_sync_request(mddev, j, &skipped)
if (!md_bitmap_start_sync(..., &sync_blocks))
// md_bitmap_start_sync set sync_blocks to 0
return sync_blocks + sectors_skippe; // sectors = 0;
j += sectors;
// j never change
Root cause is that commit 301867b1c168 ("md/raid10: check slab-out-of-bounds in md_bitmap_get_counter") return early from md_bitmap_get_counter(), without setting returned blocks.
Fix this problem by always set returned blocks from md_bitmap_get_counter"(), as it used to be.
Noted that this patch just fix the softlockup problem in kernel, the case that bitmap size doesn't match array size still need to be fixed.
--- drivers/md/md-bitmap.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/md/md-bitmap.c +3 -3
@@ -1355,7 +1355,7 @@ __acquires(bitmap->lock)sector_t chunk = offset >> bitmap->chunkshift;unsigned long page = chunk >>PAGE_COUNTER_SHIFT ;unsigned long pageoff = (chunk &PAGE_COUNTER_MASK ) <<COUNTER_BYTE_SHIFT ; -sector_t csize; +sector_t csize = ((sector_t )1 ) << bitmap->chunkshift;int err;if (page >= bitmap->pages) {
@@ -1364,6 +1364,7 @@ __acquires(bitmap->lock)* End-of-device while looking for a whole page or * user set a huge number to sysfs bitmap_set_bits. */ + *blocks = csize - (offset & (csize -1 ));return NULL ; } err =md_bitmap_checkpage (bitmap, page, create,0 );
@@ -1372,8 +1373,7 @@ __acquires(bitmap->lock) bitmap->bp[page].map == NULL) csize = ((sector_t )1 ) << (bitmap->chunkshift +PAGE_COUNTER_SHIFT ); - else - csize = ((sector_t )1 ) << bitmap->chunkshift; + *blocks = csize - (offset & (csize -1 ));if (err <0 )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 34/317 wifi: ath10k: poll service ready message before failing
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baochen Qiang <[email protected]>
[ Upstream commit e57b7d62a1b2f496caf0beba81cec3c90fad80d5 ]
Currently host relies on CE interrupts to get notified that the service ready message is ready. This results in timeout issue if the interrupt is not fired, due to some unknown reasons. See below logs:
[76321.937866] ath10k_pci 0000:02:00.0: wmi service ready event not received ... [76322.016738] ath10k_pci 0000:02:00.0: Could not init core: -110
And finally it causes WLAN interface bring up failure.
Change to give it one more chance here by polling CE rings, before failing directly.
Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00157-QCARMSWPZ-1
--- drivers/net/wireless/ath/ath10k/wmi.c | 26 +++++++++++++++++++++++--- 1 file changed, 23 insertions(+), 3 deletions(-)
drivers/net/wireless/ath/ath10k/wmi.c +23 -3
@@ -1762,12 +1762,32 @@ void ath10k_wmi_put_wmi_channel(struct ath10k *ar, struct wmi_channel *ch,int ath10k_wmi_wait_for_service_ready (struct ath10k *ar) { -unsigned long time_left; +unsigned long time_left, i; time_left =wait_for_completion_timeout (&ar->wmi.service_ready,WMI_SERVICE_READY_TIMEOUT_HZ ); -if (!time_left) -return -ETIMEDOUT ; +if (!time_left) { +/* Sometimes the PCI HIF doesn't receive interrupt +* for the service ready message even if the buffer +* was completed. PCIe sniffer shows that it's +* because the corresponding CE ring doesn't fires +* it. Workaround here by polling CE rings once. +*/ +ath10k_warn (ar,"failed to receive service ready completion, polling..\n" ); + +for (i =0 ; i <CE_COUNT ; i++) +ath10k_hif_send_complete_check (ar, i,1 ); + + time_left =wait_for_completion_timeout (&ar->wmi.service_ready, +WMI_SERVICE_READY_TIMEOUT_HZ ); +if (!time_left) { +ath10k_warn (ar,"polling timed out\n" ); +return -ETIMEDOUT ; + } + +ath10k_warn (ar,"service ready completion received, continuing normally\n" ); + } +return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 35/317 x86/boot: Ignore relocations in .notes sections in walk_relocs() too
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guixiong Wei <[email protected]>
[ Upstream commit 76e9762d66373354b45c33b60e9a53ef2a3c5ff2 ]
Commit:
aaa8736370db ("x86, relocs: Ignore relocations in .notes section")
... only started ignoring the .notes sections in print_absolute_relocs(), but the same logic should also by applied in walk_relocs() to avoid such relocations.
[ mingo: Fixed various typos in the changelog, removed extra curly braces from the code. ]
--- arch/x86/tools/relocs.c | 9 +++++++++ 1 file changed, 9 insertions(+)
arch/x86/tools/relocs.c +9 -0
@@ -689,6 +689,15 @@ static void walk_relocs(int (*process)(struct section *sec, Elf_Rel *rel,if (!(sec_applies->shdr.sh_flags &SHF_ALLOC )) {continue ; } + +/* +* Do not perform relocations in .notes sections; any +* values there are meant for pre-boot consumption (e.g. +* startup_xen). +*/ +if (sec_applies->shdr.sh_type ==SHT_NOTE ) +continue ; + sh_symtab = sec_symtab->symtab; sym_strtab = sec_symtab->link->strtab;for (j =0 ; j < sec->shdr.sh_size/sizeof (Elf_Rel); j++) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 36/317 qed: avoid truncating work queue length
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 954fd908f177604d4cce77e2a88cc50b29bad5ff ]
clang complains that the temporary string for the name passed into alloc_workqueue() is too short for its contents:
drivers/net/ethernet/qlogic/qed/qed_main.c:1218:3: error: 'snprintf' will always be truncated; specified size is 16, but format string expands to at least 18 [-Werror,-Wformat-truncation]
There is no need for a temporary buffer, and the actual name of a workqueue is 32 bytes (WQ_NAME_LEN), so just use the interface as intended to avoid the truncation.
--- drivers/net/ethernet/qlogic/qed/qed_main.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
drivers/net/ethernet/qlogic/qed/qed_main.c +4 -5
@@ -1234,7 +1234,6 @@ static void qed_slowpath_task(struct work_struct *work)static int qed_slowpath_wq_start (struct qed_dev *cdev) {struct qed_hwfn *hwfn; -char name[NAME_SIZE ];int i;if (IS_VF (cdev))
@@ -1243,11 +1242,11 @@ static int qed_slowpath_wq_start(struct qed_dev *cdev)for_each_hwfn (cdev, i) { hwfn = &cdev->hwfns[i]; -snprintf (name,NAME_SIZE ,"slowpath-%02x:%02x.%02x" , - cdev->pdev->bus->number, -PCI_SLOT (cdev->pdev->devfn), hwfn->abs_pf_id); + hwfn->slowpath_wq =alloc_workqueue ("slowpath-%02x:%02x.%02x" , +0 ,0 , cdev->pdev->bus->number, +PCI_SLOT (cdev->pdev->devfn), + hwfn->abs_pf_id); - hwfn->slowpath_wq =alloc_workqueue (name,0 ,0 );if (!hwfn->slowpath_wq) {DP_NOTICE (hwfn,"Cannot create slowpath workqueue\n" );return -ENOMEM ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 37/317 scsi: ufs: qcom: Perform read back after writing reset bit
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Halaney <[email protected]>
[ Upstream commit c4d28e06b0c94636f6e35d003fa9ebac0a94e1ae ]
Currently, the reset bit for the UFS provided reset controller (used by its phy) is written to, and then a mb() happens to try and ensure that hit the device. Immediately afterwards a usleep_range() occurs.
mb() ensures that the write completes, but completion doesn't mean that it isn't stored in a buffer somewhere. The recommendation for ensuring this bit has taken effect on the device is to perform a read back to force it to make it all the way to the device. This is documented in device-io.rst and a talk by Will Deacon on this can be seen over here:
https://youtu.be/i6DayghhA8Q?si=MiyxB5cKJXSaoc01&t=1678
Let's do that to ensure the bit hits the device. By doing so and guaranteeing the ordering against the immediately following usleep_range(), the mb() can safely be removed.
--- drivers/scsi/ufs/ufs-qcom.h | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/scsi/ufs/ufs-qcom.h +6 -6
@@ -156,10 +156,10 @@ static inline void ufs_qcom_assert_reset(struct ufs_hba *hba) 1 << OFFSET_UFS_PHY_SOFT_RESET, REG_UFS_CFG1);/* -* Make sure assertion of ufs phy reset is written to -* register before returning +* Dummy read to ensure the write takes effect before doing any sort +* of delay */ -mb (); +ufshcd_readl (hba,REG_UFS_CFG1 ); }static inline void ufs_qcom_deassert_reset (struct ufs_hba *hba)
@@ -168,10 +168,10 @@ static inline void ufs_qcom_deassert_reset(struct ufs_hba *hba) 0 << OFFSET_UFS_PHY_SOFT_RESET, REG_UFS_CFG1);/* -* Make sure de-assertion of ufs phy reset is written to -* register before returning +* Dummy read to ensure the write takes effect before doing any sort +* of delay */ -mb (); +ufshcd_readl (hba,REG_UFS_CFG1 ); }/* Host controller hardware version: major.minor.step */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 38/317 scsi: ufs-qcom: Fix ufs RST_n spec violation
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ziqi Chen <[email protected]>
[ Upstream commit b61d0414136853fc38898829cde837ce5d691a9a ]
According to the spec (JESD220E chapter 7.2), while powering off/on the ufs device, RST_n signal should be between VSS(Ground) and VCCQ/VCCQ2.
Stable-dep-of: a862fafa263a ("scsi: ufs: qcom: Perform read back after writing REG_UFS_SYS1CLK_1US")
--- drivers/scsi/ufs/ufs-qcom.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-)
drivers/scsi/ufs/ufs-qcom.c +16 -2
@@ -578,6 +578,17 @@ static int ufs_qcom_link_startup_notify(struct ufs_hba *hba,return err; } +static void ufs_qcom_device_reset_ctrl (struct ufs_hba *hba,bool asserted) +{ +struct ufs_qcom_host *host =ufshcd_get_variant (hba); + +/* reset gpio is optional */ +if (!host->device_reset) +return ; + +gpiod_set_value_cansleep (host->device_reset, asserted); +} +static int ufs_qcom_suspend (struct ufs_hba *hba,enum ufs_pm_op pm_op) {struct ufs_qcom_host *host =ufshcd_get_variant (hba);
@@ -592,6 +603,9 @@ static int ufs_qcom_suspend(struct ufs_hba *hba, enum ufs_pm_op pm_op)ufs_qcom_disable_lane_clks (host);phy_power_off (phy); +/* reset the connected UFS device during power down */ +ufs_qcom_device_reset_ctrl (hba, true); + }else if (!ufs_qcom_is_link_active (hba)) {ufs_qcom_disable_lane_clks (host); }
@@ -1441,10 +1455,10 @@ static int ufs_qcom_device_reset(struct ufs_hba *hba)* The UFS device shall detect reset pulses of 1us, sleep for 10us to * be on the safe side. */ -gpiod_set_value_cansleep (host->device_reset,1 ); +ufs_qcom_device_reset_ctrl (hba, true);usleep_range (10 ,15 ); -gpiod_set_value_cansleep (host->device_reset,0 ); +ufs_qcom_device_reset_ctrl (hba, false);usleep_range (10 ,15 );return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 39/317 scsi: ufs: qcom: Perform read back after writing REG_UFS_SYS1CLK_1US
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Halaney <[email protected]>
[ Upstream commit a862fafa263aea0f427d51aca6ff7fd9eeaaa8bd ]
Currently after writing to REG_UFS_SYS1CLK_1US a mb() is used to ensure that write has gone through to the device.
mb() ensures that the write completes, but completion doesn't mean that it isn't stored in a buffer somewhere. The recommendation for ensuring this bit has taken effect on the device is to perform a read back to force it to make it all the way to the device. This is documented in device-io.rst and a talk by Will Deacon on this can be seen over here:
https://youtu.be/i6DayghhA8Q?si=MiyxB5cKJXSaoc01&t=1678
Let's do that to ensure the bit hits the device. Because the mb()'s purpose wasn't to add extra ordering (on top of the ordering guaranteed by writel()/readl()), it can safely be removed.
--- drivers/scsi/ufs/ufs-qcom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/ufs/ufs-qcom.c +1 -1
@@ -449,7 +449,7 @@ static int ufs_qcom_cfg_timers(struct ufs_hba *hba, u32 gear,* make sure above write gets applied before we return from * this function. */ -mb (); +ufshcd_readl (hba,REG_UFS_SYS1CLK_1US ); }if (ufs_qcom_cap_qunipro (host))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 40/317 scsi: ufs: ufs-qcom: Fix the Qcom register name for offset 0xD0
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manivannan Sadhasivam <[email protected]>
[ Upstream commit 7959587f3284bf163e4f1baff3c6fa71fc6a55b1 ]
On newer UFS revisions, the register at offset 0xD0 is called, REG_UFS_PARAM0. Since the existing register, RETRY_TIMER_REG is not used anywhere, it is safe to use the new name.
Stable-dep-of: 823150ecf04f ("scsi: ufs: qcom: Perform read back after writing unipro mode")
--- drivers/scsi/ufs/ufs-qcom.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/scsi/ufs/ufs-qcom.h +2 -1
@@ -46,7 +46,8 @@ enum {REG_UFS_TX_SYMBOL_CLK_NS_US =0xC4 ,REG_UFS_LOCAL_PORT_ID_REG =0xC8 ,REG_UFS_PA_ERR_CODE =0xCC , -REG_UFS_RETRY_TIMER_REG =0xD0 , +/* On older UFS revisions, this register is called "RETRY_TIMER_REG" */ +REG_UFS_PARAM0 =0xD0 ,REG_UFS_PA_LINK_STARTUP_TIMER =0xD8 ,REG_UFS_CFG1 =0xDC , REG_UFS_CFG2 = 0xE0,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 41/317 scsi: ufs: ufs-qcom: Clear qunipro_g4_sel for HW version major 5
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abel Vesa <[email protected]>
[ Upstream commit 9c02aa24bf404a39ec509d9f50539056b9b128f7 ]
On SM8550, depending on the Qunipro, we can run with G5 or G4. For now, when the major version is 5 or above, we go with G5. Therefore, we need to specifically tell UFS HC that.
Stable-dep-of: 823150ecf04f ("scsi: ufs: qcom: Perform read back after writing unipro mode")
--- drivers/scsi/ufs/ufs-qcom.c | 8 ++++++-- drivers/scsi/ufs/ufs-qcom.h | 6 +++++- 2 files changed, 11 insertions(+), 3 deletions(-)
drivers/scsi/ufs/ufs-qcom.c +6 -2
@@ -242,6 +242,10 @@ static void ufs_qcom_select_unipro_mode(struct ufs_qcom_host *host)ufshcd_rmwl (host->hba,QUNIPRO_SEL ,ufs_qcom_cap_qunipro (host) ?QUNIPRO_SEL :0 ,REG_UFS_CFG1 ); + +if (host->hw_ver.major ==0x05 ) +ufshcd_rmwl (host->hba,QUNIPRO_G4_SEL ,0 ,REG_UFS_CFG0 ); +/* make sure above configuration is applied before we return */ mb (); }
@@ -515,9 +519,9 @@ static int ufs_qcom_cfg_timers(struct ufs_hba *hba, u32 gear,mb (); } -if (update_link_startup_timer) { +if (update_link_startup_timer && host->hw_ver.major !=0x5 ) {ufshcd_writel (hba, ((core_clk_rate /MSEC_PER_SEC ) *100 ), -REG_UFS_PA_LINK_STARTUP_TIMER ); +REG_UFS_CFG0 );/* * make sure that this configuration is applied before * we return
drivers/scsi/ufs/ufs-qcom.h +5 -1
@@ -48,7 +48,8 @@ enum {REG_UFS_PA_ERR_CODE =0xCC ,/* On older UFS revisions, this register is called "RETRY_TIMER_REG" */ REG_UFS_PARAM0 =0xD0 , -REG_UFS_PA_LINK_STARTUP_TIMER =0xD8 , +/* On older UFS revisions, this register is called "REG_UFS_PA_LINK_STARTUP_TIMER" */ +REG_UFS_CFG0 =0xD8 ,REG_UFS_CFG1 =0xDC ,REG_UFS_CFG2 =0xE0 , REG_UFS_HW_VERSION = 0xE4,
@@ -86,6 +87,9 @@ enum {#define UFS_CNTLR_2_x_x_VEN_REGS_OFFSET (x) (0x000 + x)#define UFS_CNTLR_3_x_x_VEN_REGS_OFFSET (x) (0x400 + x) +/* bit definitions for REG_UFS_CFG0 register */ +#define QUNIPRO_G4_SEL BIT(5) +/* bit definitions for REG_UFS_CFG1 register */ #define QUNIPRO_SEL 0x1#define UTP_DBG_RAMS_EN 0x20000
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 42/317 scsi: ufs: qcom: Perform read back after writing unipro mode
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Halaney <[email protected]>
[ Upstream commit 823150ecf04f958213cf3bf162187cd1a91c885c ]
Currently, the QUNIPRO_SEL bit is written to and then an mb() is used to ensure that completes before continuing.
mb() ensures that the write completes, but completion doesn't mean that it isn't stored in a buffer somewhere. The recommendation for ensuring this bit has taken effect on the device is to perform a read back to force it to make it all the way to the device. This is documented in device-io.rst and a talk by Will Deacon on this can be seen over here:
https://youtu.be/i6DayghhA8Q?si=MiyxB5cKJXSaoc01&t=1678
But, there's really no reason to even ensure completion before continuing. The only requirement here is that this write is ordered to this endpoint (which readl()/writel() guarantees already). For that reason the mb() can be dropped altogether without anything forcing completion.
--- drivers/scsi/ufs/ufs-qcom.c | 3 --- 1 file changed, 3 deletions(-)
drivers/scsi/ufs/ufs-qcom.c +0 -3
@@ -245,9 +245,6 @@ static void ufs_qcom_select_unipro_mode(struct ufs_qcom_host *host)if (host->hw_ver.major ==0x05 )ufshcd_rmwl (host->hba,QUNIPRO_G4_SEL ,0 ,REG_UFS_CFG0 ); - -/* make sure above configuration is applied before we return */ -mb (); }/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 43/317 scsi: ufs: qcom: Perform read back after writing CGC enable
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Halaney <[email protected]>
[ Upstream commit d9488511b3ac7eb48a91bc5eded7027525525e03 ]
Currently, the CGC enable bit is written and then an mb() is used to ensure that completes before continuing.
mb() ensures that the write completes, but completion doesn't mean that it isn't stored in a buffer somewhere. The recommendation for ensuring this bit has taken effect on the device is to perform a read back to force it to make it all the way to the device. This is documented in device-io.rst and a talk by Will Deacon on this can be seen over here:
https://youtu.be/i6DayghhA8Q?si=MiyxB5cKJXSaoc01&t=1678
Let's do that to ensure the bit hits the device. Because the mb()'s purpose wasn't to add extra ordering (on top of the ordering guaranteed by writel()/readl()), it can safely be removed.
--- drivers/scsi/ufs/ufs-qcom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/ufs/ufs-qcom.c +1 -1
@@ -353,7 +353,7 @@ static void ufs_qcom_enable_hw_clk_gating(struct ufs_hba *hba) REG_UFS_CFG2);/* Ensure that HW clock gating is enabled before next operations */ -mb (); +ufshcd_readl (hba,REG_UFS_CFG2 ); } static int ufs_qcom_hce_enable_notify(struct ufs_hba *hba,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 44/317 scsi: ufs: cdns-pltfrm: Perform read back after writing HCLKDIV
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Halaney <[email protected]>
[ Upstream commit b715c55daf598aac8fa339048e4ca8a0916b332e ]
Currently, HCLKDIV is written to and then completed with an mb().
mb() ensures that the write completes, but completion doesn't mean that it isn't stored in a buffer somewhere. The recommendation for ensuring this bit has taken effect on the device is to perform a read back to force it to make it all the way to the device. This is documented in device-io.rst and a talk by Will Deacon on this can be seen over here:
https://youtu.be/i6DayghhA8Q?si=MiyxB5cKJXSaoc01&t=1678
Let's do that to ensure the bit hits the device. Because the mb()'s purpose wasn't to add extra ordering (on top of the ordering guaranteed by writel()/readl()), it can safely be removed.
--- drivers/scsi/ufs/cdns-pltfrm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/ufs/cdns-pltfrm.c +1 -1
@@ -135,7 +135,7 @@ static int cdns_ufs_set_hclkdiv(struct ufs_hba *hba)* Make sure the register was updated, * UniPro layer will not work with an incorrect value. */ -mb (); +ufshcd_readl (hba,CDNS_UFS_REG_HCLKDIV );return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 45/317 scsi: ufs: core: Perform read back after disabling interrupts
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Halaney <[email protected]>
[ Upstream commit e4a628877119bd40164a651d20321247b6f94a8b ]
Currently, interrupts are cleared and disabled prior to registering the interrupt. An mb() is used to complete the clear/disable writes before the interrupt is registered.
mb() ensures that the write completes, but completion doesn't mean that it isn't stored in a buffer somewhere. The recommendation for ensuring these bits have taken effect on the device is to perform a read back to force it to make it all the way to the device. This is documented in device-io.rst and a talk by Will Deacon on this can be seen over here:
https://youtu.be/i6DayghhA8Q?si=MiyxB5cKJXSaoc01&t=1678
Let's do that to ensure these bits hit the device. Because the mb()'s purpose wasn't to add extra ordering (on top of the ordering guaranteed by writel()/readl()), it can safely be removed.
--- drivers/scsi/ufs/ufshcd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/ufs/ufshcd.c +1 -1
@@ -9193,7 +9193,7 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq)* Make sure that UFS interrupts are disabled and any pending interrupt * status is cleared before registering UFS interrupt handler. */ -mb (); +ufshcd_readl (hba,REG_INTERRUPT_ENABLE );/* IRQ registration */ err =devm_request_irq (dev, irq, ufshcd_intr,IRQF_SHARED ,UFSHCD , hba);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 46/317 scsi: ufs: core: Perform read back after disabling UIC_COMMAND_COMPL
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Halaney <[email protected]>
[ Upstream commit 4bf3855497b60765ca03b983d064b25e99b97657 ]
Currently, the UIC_COMMAND_COMPL interrupt is disabled and a wmb() is used to complete the register write before any following writes.
wmb() ensures the writes complete in that order, but completion doesn't mean that it isn't stored in a buffer somewhere. The recommendation for ensuring this bit has taken effect on the device is to perform a read back to force it to make it all the way to the device. This is documented in device-io.rst and a talk by Will Deacon on this can be seen over here:
https://youtu.be/i6DayghhA8Q?si=MiyxB5cKJXSaoc01&t=1678
Let's do that to ensure the bit hits the device. Because the wmb()'s purpose wasn't to add extra ordering (on top of the ordering guaranteed by writel()/readl()), it can safely be removed.
--- drivers/scsi/ufs/ufshcd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/ufs/ufshcd.c +1 -1
@@ -3819,7 +3819,7 @@ static int ufshcd_uic_pwr_ctrl(struct ufs_hba *hba, struct uic_command *cmd)* Make sure UIC command completion interrupt is disabled before * issuing UIC command. */ -wmb (); +ufshcd_readl (hba,REG_INTERRUPT_ENABLE ); reenable_intr = true; } ret =__ufshcd_send_uic_cmd (hba, cmd, false);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 47/317 irqchip/alpine-msi: Fix off-by-one in allocation error path
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zenghui Yu <[email protected]>
[ Upstream commit ff3669a71afa06208de58d6bea1cc49d5e3fcbd1 ]
When alpine_msix_gic_domain_alloc() fails, there is an off-by-one in the number of interrupts to be freed.
Fix it by passing the number of successfully allocated interrupts, instead of the relative index of the last allocated one.
--- drivers/irqchip/irq-alpine-msi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/irqchip/irq-alpine-msi.c +1 -1
@@ -165,7 +165,7 @@ static int alpine_msix_middle_domain_alloc(struct irq_domain *domain,return 0 ; err_sgi: -irq_domain_free_irqs_parent (domain, virq, i -1 ); +irq_domain_free_irqs_parent (domain, virq, i);alpine_msix_free_sgi (priv, sgi, nr_irqs);return err; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 48/317 irqchip/loongson-pch-msi: Fix off-by-one on allocation error path
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zenghui Yu <[email protected]>
[ Upstream commit b327708798809328f21da8dc14cc8883d1e8a4b3 ]
When pch_msi_parent_domain_alloc() returns an error, there is an off-by-one in the number of interrupts to be freed.
Fix it by passing the number of successfully allocated interrupts, instead of the relative index of the last allocated one.
--- drivers/irqchip/irq-loongson-pch-msi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/irqchip/irq-loongson-pch-msi.c +1 -1
@@ -132,7 +132,7 @@ static int pch_msi_middle_domain_alloc(struct irq_domain *domain, err_hwirq:pch_msi_free_hwirq (priv, hwirq, nr_irqs); -irq_domain_free_irqs_parent (domain, virq, i -1 ); +irq_domain_free_irqs_parent (domain, virq, i);return err; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 49/317 ACPI: disable -Wstringop-truncation
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit a3403d304708f60565582d60af4316289d0316a0 ]
gcc -Wstringop-truncation warns about copying a string that results in a missing nul termination:
drivers/acpi/acpica/tbfind.c: In function 'acpi_tb_find_table':drivers/acpi/acpica/tbfind.c:60:9: error: 'strncpy' specified bound 6 equals destination size [-Werror=stringop-truncation]
60 | strncpy(header.oem_id, oem_id, ACPI_OEM_ID_SIZE);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/acpi/acpica/tbfind.c:61:9: error: 'strncpy' specified bound 8 equals destination size [-Werror=stringop-truncation]
61 | strncpy(header.oem_table_id, oem_table_id, ACPI_OEM_TABLE_ID_SIZE);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~The code works as intended, and the warning could be addressed by using a memcpy(), but turning the warning off for this file works equally well and may be easier to merge.
--- drivers/acpi/acpica/Makefile | 1 + 1 file changed, 1 insertion(+)
drivers/acpi/acpica/Makefile +1 -0
@@ -5,6 +5,7 @@ ccflags-y := -D_LINUX -DBUILDING_ACPICA ccflags-$(CONFIG_ACPI_DEBUG) += -DACPI_DEBUG_OUTPUT +CFLAGS_tbfind.o += $(call cc-disable-warning, stringop-truncation) # use acpi.o to put all files here into acpi.o modparam namespace obj-y += acpi.o
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 50/317 gfs2: Fix "ignore unlock failures after withdraw"
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Gruenbacher <[email protected]>
[ Upstream commit 5d9231111966b6c5a65016d58dcbeab91055bc91 ]
Commit 3e11e53041502 tries to suppress dlm_lock() lock conversion errors that occur when the lockspace has already been released.
It does that by setting and checking the SDF_SKIP_DLM_UNLOCK flag. This conflicts with the intended meaning of the SDF_SKIP_DLM_UNLOCK flag, so check whether the lockspace is still allocated instead.
(Given the current DLM API, checking for this kind of error after the fact seems easier that than to make sure that the lockspace is still allocated before calling dlm_lock(). Changing the DLM API so that users maintain the lockspace references themselves would be an option.)
--- fs/gfs2/glock.c | 4 +++- fs/gfs2/util.c | 1 - 2 files changed, 3 insertions(+), 2 deletions(-)
fs/gfs2/glock.c +3 -1
@@ -691,11 +691,13 @@ __acquires(&gl->gl_lockref.lock) }if (sdp->sd_lockstruct.ls_ops->lm_lock) { +struct lm_lockstruct *ls = &sdp->sd_lockstruct; +/* lock_dlm */ ret = sdp->sd_lockstruct.ls_ops->lm_lock (gl, target, lck_flags);if (ret == -EINVAL && gl->gl_target ==LM_ST_UNLOCKED && target ==LM_ST_UNLOCKED && -test_bit (SDF_SKIP_DLM_UNLOCK , &sdp->sd_flags)) { +test_bit (DFL_UNMOUNT , &ls->ls_recover_flags)) {finish_xmote (gl, target);gfs2_glock_queue_work (gl,0 ); }else if (ret) {
fs/gfs2/util.c +0 -1
@@ -348,7 +348,6 @@ int gfs2_withdraw(struct gfs2_sbd *sdp)fs_err (sdp,"telling LM to unmount\n" ); lm->lm_unmount (sdp); } -set_bit (SDF_SKIP_DLM_UNLOCK , &sdp->sd_flags);fs_err (sdp,"File system withdrawn\n" );dump_stack ();clear_bit (SDF_WITHDRAW_IN_PROG , &sdp->sd_flags);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 51/317 selftests/bpf: Fix umount cgroup2 error in test_sockmap
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geliang Tang <[email protected]>
[ Upstream commit d75142dbeb2bd1587b9cc19f841578f541275a64 ]
This patch fixes the following "umount cgroup2" error in test_sockmap.c:
(cgroup_helpers.c:353: errno: Device or resource busy) umount cgroup2
Cgroup fd cg_fd should be closed before cleanup_cgroup_environment().
--- tools/testing/selftests/bpf/test_sockmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/bpf/test_sockmap.c +1 -1
@@ -2014,9 +2014,9 @@ int main(int argc, char **argv)free (options.whitelist);if (options.blacklist)free (options.blacklist); +close (cg_fd);if (cg_created)cleanup_cgroup_environment (); -close (cg_fd);return err; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 52/317 cpufreq: Reorganize checks in cpufreq_offline()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit e1e962c5b9edbc628a335bcdbd010331a12d3e5b ]
Notice that cpufreq_offline() only needs to check policy_is_inactive() once and rearrange the code in there to make that happen.
No expected functional impact.
Stable-dep-of: b8f85833c057 ("cpufreq: exit() callback is optional")
--- drivers/cpufreq/cpufreq.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-)
drivers/cpufreq/cpufreq.c +12 -12
@@ -1573,24 +1573,18 @@ static int cpufreq_offline(unsigned int cpu) }down_write (&policy->rwsem); +if (has_target ())cpufreq_stop_governor (policy);cpumask_clear_cpu (cpu, policy->cpus); -if (policy_is_inactive (policy)) { -if (has_target ()) -strncpy (policy->last_governor, policy->governor->name, -CPUFREQ_NAME_LEN ); -else - policy->last_policy = policy->policy; - }else if (cpu == policy->cpu) { -/* Nominate new CPU */ - policy->cpu =cpumask_any (policy->cpus); - } - -/* Start governor again for active policy */ if (!policy_is_inactive (policy)) { +/* Nominate a new CPU if necessary. */ +if (cpu == policy->cpu) + policy->cpu =cpumask_any (policy->cpus); + +/* Start the governor again for the active policy. */ if (has_target ()) { ret =cpufreq_start_governor (policy);if (ret)
@@ -1600,6 +1594,12 @@ static int cpufreq_offline(unsigned int cpu) goto unlock; } +if (has_target ()) +strncpy (policy->last_governor, policy->governor->name, +CPUFREQ_NAME_LEN ); +else + policy->last_policy = policy->policy; +if (cpufreq_thermal_control_enabled (cpufreq_driver)) {cpufreq_cooling_unregister (policy->cdev); policy->cdev =NULL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 53/317 cpufreq: Split cpufreq_offline()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit fddd8f86dff4a24742a7f0322ccbb34c6c1c9850 ]
Split the "core" part running under the policy rwsem out of cpufreq_offline() to allow the locking in cpufreq_remove_dev() to be rearranged more easily.
As a side-effect this eliminates the unlock label that's not needed any more.
No expected functional impact.
Stable-dep-of: b8f85833c057 ("cpufreq: exit() callback is optional")
--- drivers/cpufreq/cpufreq.c | 33 +++++++++++++++++++-------------- 1 file changed, 19 insertions(+), 14 deletions(-)
drivers/cpufreq/cpufreq.c +19 -14
@@ -1559,21 +1559,10 @@ static int cpufreq_add_dev(struct device *dev, struct subsys_interface *sif)return 0 ; } -static int cpufreq_offline (unsigned int cpu) +static void __cpufreq_offline (unsigned int cpu,struct cpufreq_policy *policy) { -struct cpufreq_policy *policy;int ret; -pr_debug ("%s: unregistering CPU %u\n" , __func__, cpu); - - policy =cpufreq_cpu_get_raw (cpu); -if (!policy) { -pr_debug ("%s: No cpu_data found\n" , __func__); -return 0 ; - } - -down_write (&policy->rwsem); -if (has_target ())cpufreq_stop_governor (policy);
@@ -1591,7 +1580,7 @@ static int cpufreq_offline(unsigned int cpu)pr_err ("%s: Failed to start governor\n" , __func__); } - goto unlock; +return ; }if (has_target ())
@@ -1621,8 +1610,24 @@ static int cpufreq_offline(unsigned int cpu) cpufreq_driver->exit (policy); policy->freq_table =NULL ; } +} + +static int cpufreq_offline (unsigned int cpu) +{ +struct cpufreq_policy *policy; + +pr_debug ("%s: unregistering CPU %u\n" , __func__, cpu); + + policy =cpufreq_cpu_get_raw (cpu); +if (!policy) { +pr_debug ("%s: No cpu_data found\n" , __func__); +return 0 ; + } + +down_write (&policy->rwsem); + +__cpufreq_offline (cpu, policy); -unlock:up_write (&policy->rwsem);return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 54/317 cpufreq: Rearrange locking in cpufreq_remove_dev()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit f339f3541701d824a0256ad4bf14c26ceb6d79c3 ]
Currently, cpufreq_remove_dev() invokes the ->exit() driver callback without holding the policy rwsem which is inconsistent with what happens if ->exit() is invoked directly from cpufreq_offline().
It also manipulates the real_cpus mask and removes the CPU device symlink without holding the policy rwsem, but cpufreq_offline() holds the rwsem around the modifications thereof.
For consistency, modify cpufreq_remove_dev() to hold the policy rwsem until the ->exit() callback has been called (or it has been determined that it is not necessary to call it).
Stable-dep-of: b8f85833c057 ("cpufreq: exit() callback is optional")
--- drivers/cpufreq/cpufreq.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-)
drivers/cpufreq/cpufreq.c +14 -7
@@ -1645,19 +1645,26 @@ static void cpufreq_remove_dev(struct device *dev, struct subsys_interface *sif)if (!policy)return ; +down_write (&policy->rwsem); +if (cpu_online (cpu)) -cpufreq_offline (cpu); +__cpufreq_offline (cpu, policy);cpumask_clear_cpu (cpu, policy->real_cpus);remove_cpu_dev_symlink (policy, dev); -if (cpumask_empty (policy->real_cpus)) { -/* We did light-weight exit earlier, do full tear down now */ -if (cpufreq_driver->offline) - cpufreq_driver->exit (policy); - -cpufreq_policy_free (policy); +if (!cpumask_empty (policy->real_cpus)) { +up_write (&policy->rwsem); +return ; } + +/* We did light-weight exit earlier, do full tear down now */ +if (cpufreq_driver->offline) + cpufreq_driver->exit (policy); + +up_write (&policy->rwsem); + +cpufreq_policy_free (policy); }/**
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 55/317 cpufreq: exit() callback is optional
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viresh Kumar <[email protected]>
[ Upstream commit b8f85833c05730d631576008daaa34096bc7f3ce ]
The exit() callback is optional and shouldn't be called without checking a valid pointer first.
Also, we must clear freq_table pointer even if the exit() callback isn't present.
--- drivers/cpufreq/cpufreq.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
drivers/cpufreq/cpufreq.c +7 -4
@@ -1606,10 +1606,13 @@ static void __cpufreq_offline(unsigned int cpu, struct cpufreq_policy *policy)*/ if (cpufreq_driver->offline) { cpufreq_driver->offline (policy); - }else if (cpufreq_driver->exit) { - cpufreq_driver->exit (policy); - policy->freq_table =NULL ; +return ; } + +if (cpufreq_driver->exit) + cpufreq_driver->exit (policy); + + policy->freq_table =NULL ; }static int cpufreq_offline (unsigned int cpu)
@@ -1659,7 +1662,7 @@ static void cpufreq_remove_dev(struct device *dev, struct subsys_interface *sif) }/* We did light-weight exit earlier, do full tear down now */ -if (cpufreq_driver->offline) +if (cpufreq_driver->offline && cpufreq_driver->exit) cpufreq_driver->exit (policy);up_write (&policy->rwsem);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 56/317 net: export inet_lookup_reuseport and inet6_lookup_reuseport
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenz Bauer <[email protected]>
[ Upstream commit ce796e60b3b196b61fcc565df195443cbb846ef0 ]
Rename the existing reuseport helpers for IPv4 and IPv6 so that they can be invoked in the follow up commit. Export them so that building DCCP and IPv6 as a module works.
No change in functionality.
Stable-dep-of: 50aee97d1511 ("udp: Avoid call to compute_score on multiple sites")
--- include/net/inet6_hashtables.h | 7 +++++++ include/net/inet_hashtables.h | 5 +++++ net/ipv4/inet_hashtables.c | 15 ++++++++------- net/ipv6/inet6_hashtables.c | 19 ++++++++++--------- 4 files changed, 30 insertions(+), 16 deletions(-)
include/net/inet6_hashtables.h +7 -0
@@ -48,6 +48,13 @@ struct sock *__inet6_lookup_established(struct net *net, const u16 hnum, const int dif, const int sdif); +struct sock *inet6_lookup_reuseport (struct net *net,struct sock *sk, +struct sk_buff *skb,int doff, +const struct in6_addr *saddr, +__be16 sport, +const struct in6_addr *daddr, +unsigned short hnum); + struct sock *inet6_lookup_listener(struct net *net, struct inet_hashinfo *hashinfo, struct sk_buff *skb, int doff,
include/net/inet_hashtables.h +5 -0
@@ -313,6 +313,11 @@ struct sock *__inet_lookup_established(struct net *net, const __be32 daddr, const u16 hnum, const int dif, const int sdif); +struct sock *inet_lookup_reuseport (struct net *net,struct sock *sk, +struct sk_buff *skb,int doff, +__be32 saddr,__be16 sport, +__be32 daddr,unsigned short hnum); +static inline struct sock * inet_lookup_established(struct net *net, struct inet_hashinfo *hashinfo, const __be32 saddr, const __be16 sport,
net/ipv4/inet_hashtables.c +8 -7
@@ -252,10 +252,10 @@ static inline int compute_score(struct sock *sk, struct net *net,return score; } -static inline struct sock *lookup_reuseport (struct net *net,struct sock *sk, -struct sk_buff *skb,int doff, -__be32 saddr,__be16 sport, -__be32 daddr,unsigned short hnum) +struct sock *inet_lookup_reuseport (struct net *net,struct sock *sk, +struct sk_buff *skb,int doff, +__be32 saddr,__be16 sport, +__be32 daddr,unsigned short hnum) {struct sock *reuse_sk =NULL ;u32 phash;
@@ -266,6 +266,7 @@ static inline struct sock *lookup_reuseport(struct net *net, struct sock *sk, }return reuse_sk; } +EXPORT_SYMBOL_GPL (inet_lookup_reuseport);/* * Here are some nice properties to exploit here. The BSD API
@@ -290,8 +291,8 @@ static struct sock *inet_lhash2_lookup(struct net *net, sk = (struct sock *)icsk; score =compute_score (sk, net, hnum, daddr, dif, sdif);if (score > hiscore) { - result =lookup_reuseport (net, sk, skb, doff, - saddr, sport, daddr, hnum); + result =inet_lookup_reuseport (net, sk, skb, doff, + saddr, sport, daddr, hnum);if (result)return result;
@@ -320,7 +321,7 @@ static inline struct sock *inet_lookup_run_bpf(struct net *net,if (no_reuseport ||IS_ERR_OR_NULL (sk))return sk; - reuse_sk =lookup_reuseport (net, sk, skb, doff, saddr, sport, daddr, hnum); + reuse_sk =inet_lookup_reuseport (net, sk, skb, doff, saddr, sport, daddr, hnum);if (reuse_sk) sk = reuse_sk;return sk;
net/ipv6/inet6_hashtables.c +10 -9
@@ -113,12 +113,12 @@ static inline int compute_score(struct sock *sk, struct net *net,return score; } -static inline struct sock *lookup_reuseport (struct net *net,struct sock *sk, -struct sk_buff *skb,int doff, -const struct in6_addr *saddr, -__be16 sport, -const struct in6_addr *daddr, -unsigned short hnum) +struct sock *inet6_lookup_reuseport (struct net *net,struct sock *sk, +struct sk_buff *skb,int doff, +const struct in6_addr *saddr, +__be16 sport, +const struct in6_addr *daddr, +unsigned short hnum) {struct sock *reuse_sk =NULL ;u32 phash;
@@ -129,6 +129,7 @@ static inline struct sock *lookup_reuseport(struct net *net, struct sock *sk, }return reuse_sk; } +EXPORT_SYMBOL_GPL (inet6_lookup_reuseport);/* called with rcu_read_lock() */ static struct sock *inet6_lhash2_lookup(struct net *net,
@@ -146,8 +147,8 @@ static struct sock *inet6_lhash2_lookup(struct net *net, sk = (struct sock *)icsk; score =compute_score (sk, net, hnum, daddr, dif, sdif);if (score > hiscore) { - result =lookup_reuseport (net, sk, skb, doff, - saddr, sport, daddr, hnum); + result =inet6_lookup_reuseport (net, sk, skb, doff, + saddr, sport, daddr, hnum);if (result)return result;
@@ -178,7 +179,7 @@ static inline struct sock *inet6_lookup_run_bpf(struct net *net,if (no_reuseport ||IS_ERR_OR_NULL (sk))return sk; - reuse_sk =lookup_reuseport (net, sk, skb, doff, saddr, sport, daddr, hnum); + reuse_sk =inet6_lookup_reuseport (net, sk, skb, doff, saddr, sport, daddr, hnum);if (reuse_sk) sk = reuse_sk;return sk;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 57/317 net: remove duplicate reuseport_lookup functions
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenz Bauer <[email protected]>
[ Upstream commit 0f495f7617229772403e683033abc473f0f0553c ]
There are currently four copies of reuseport_lookup: one each for (TCP, UDP)x(IPv4, IPv6). This forces us to duplicate all callers of those functions as well. This is already the case for sk_lookup helpers (inet,inet6,udp4,udp6)_lookup_run_bpf.
There are two differences between the reuseport_lookup helpers:
1. They call different hash functions depending on protocol
2. UDP reuseport_lookup checks that sk_state != TCP_ESTABLISHED
Move the check for sk_state into the caller and use the INDIRECT_CALL infrastructure to cut down the helpers to one per IP version.
Stable-dep-of: 50aee97d1511 ("udp: Avoid call to compute_score on multiple sites")
--- include/net/inet6_hashtables.h | 11 ++++++++- include/net/inet_hashtables.h | 15 ++++++++----- net/ipv4/inet_hashtables.c | 20 +++++++++++------ net/ipv4/udp.c | 34 +++++++++++----------------- net/ipv6/inet6_hashtables.c | 14 ++++++++---- net/ipv6/udp.c | 41 +++++++++++++--------------------- 6 files changed, 72 insertions(+), 63 deletions(-)
include/net/inet6_hashtables.h +10 -1
@@ -48,12 +48,21 @@ struct sock *__inet6_lookup_established(struct net *net, const u16 hnum, const int dif, const int sdif); +typedef u32 (inet6_ehashfn_t )(const struct net *net, +const struct in6_addr *laddr,const u16 lport, +const struct in6_addr *faddr,const __be16 fport); + +inet6_ehashfn_t inet6_ehashfn; + +INDIRECT_CALLABLE_DECLARE(inet6_ehashfn_t udp6_ehashfn); +struct sock *inet6_lookup_reuseport (struct net *net,struct sock *sk,struct sk_buff *skb,int doff,const struct in6_addr *saddr,__be16 sport,const struct in6_addr *daddr, -unsigned short hnum); +unsigned short hnum, +inet6_ehashfn_t *ehashfn); struct sock *inet6_lookup_listener(struct net *net, struct inet_hashinfo *hashinfo,
include/net/inet_hashtables.h +10 -5
@@ -313,10 +313,19 @@ struct sock *__inet_lookup_established(struct net *net, const __be32 daddr, const u16 hnum, const int dif, const int sdif); +typedef u32 (inet_ehashfn_t )(const struct net *net, +const __be32 laddr,const __u16 lport, +const __be32 faddr,const __be16 fport); + +inet_ehashfn_t inet_ehashfn; + +INDIRECT_CALLABLE_DECLARE(inet_ehashfn_t udp_ehashfn); +struct sock *inet_lookup_reuseport (struct net *net,struct sock *sk,struct sk_buff *skb,int doff,__be32 saddr,__be16 sport, -__be32 daddr,unsigned short hnum); +__be32 daddr,unsigned short hnum, +inet_ehashfn_t *ehashfn);static inline struct sock * inet_lookup_established(struct net *net, struct inet_hashinfo *hashinfo,
@@ -387,10 +396,6 @@ static inline struct sock *__inet_lookup_skb(struct inet_hashinfo *hashinfo, refcounted); } -u32 inet6_ehashfn (const struct net *net, -const struct in6_addr *laddr,const u16 lport, -const struct in6_addr *faddr,const __be16 fport); -static inline void sk_daddr_set (struct sock *sk,__be32 addr) { sk->sk_daddr = addr;/* alias of inet_daddr */
net/ipv4/inet_hashtables.c +13 -7
@@ -28,9 +28,9 @@#include <net/tcp.h> #include <net/sock_reuseport.h> -static u32 inet_ehashfn (const struct net *net,const __be32 laddr, -const __u16 lport,const __be32 faddr, -const __be16 fport) +u32 inet_ehashfn (const struct net *net,const __be32 laddr, +const __u16 lport,const __be32 faddr, +const __be16 fport) {static u32 inet_ehash_secret__read_mostly ;
@@ -39,6 +39,7 @@ static u32 inet_ehashfn(const struct net *net, const __be32 laddr,return __inet_ehashfn (laddr, lport, faddr, fport, inet_ehash_secret +net_hash_mix (net)); } +EXPORT_SYMBOL_GPL (inet_ehashfn);/* This function handles inet_sock, but also timewait and request sockets * for IPv4/IPv6.
@@ -252,16 +253,20 @@ static inline int compute_score(struct sock *sk, struct net *net,return score; } +INDIRECT_CALLABLE_DECLARE(inet_ehashfn_t udp_ehashfn); +struct sock *inet_lookup_reuseport (struct net *net,struct sock *sk,struct sk_buff *skb,int doff,__be32 saddr,__be16 sport, -__be32 daddr,unsigned short hnum) +__be32 daddr,unsigned short hnum, +inet_ehashfn_t *ehashfn) {struct sock *reuse_sk =NULL ;u32 phash;if (sk->sk_reuseport) { - phash =inet_ehashfn (net, daddr, hnum, saddr, sport); + phash =INDIRECT_CALL_2 (ehashfn, udp_ehashfn, inet_ehashfn, + net, daddr, hnum, saddr, sport); reuse_sk =reuseport_select_sock (sk, phash, skb, doff); }return reuse_sk;
@@ -292,7 +297,7 @@ static struct sock *inet_lhash2_lookup(struct net *net, score =compute_score (sk, net, hnum, daddr, dif, sdif);if (score > hiscore) { result =inet_lookup_reuseport (net, sk, skb, doff, - saddr, sport, daddr, hnum); + saddr, sport, daddr, hnum, inet_ehashfn);if (result)return result;
@@ -321,7 +326,8 @@ static inline struct sock *inet_lookup_run_bpf(struct net *net,if (no_reuseport ||IS_ERR_OR_NULL (sk))return sk; - reuse_sk =inet_lookup_reuseport (net, sk, skb, doff, saddr, sport, daddr, hnum); + reuse_sk =inet_lookup_reuseport (net, sk, skb, doff, saddr, sport, daddr, hnum, + inet_ehashfn);if (reuse_sk) sk = reuse_sk;return sk;
net/ipv4/udp.c +13 -21
@@ -398,9 +398,9 @@ static int compute_score(struct sock *sk, struct net *net,return score; } -static u32 udp_ehashfn (const struct net *net,const __be32 laddr, -const __u16 lport,const __be32 faddr, -const __be16 fport) +INDIRECT_CALLABLE_SCOPE +u32 udp_ehashfn(const struct net *net, const __be32 laddr, const __u16 lport, +const __be32 faddr,const __be16 fport) {static u32 udp_ehash_secret__read_mostly ;
@@ -410,22 +410,6 @@ static u32 udp_ehashfn(const struct net *net, const __be32 laddr, udp_ehash_secret + net_hash_mix(net)); } -static struct sock *lookup_reuseport (struct net *net,struct sock *sk, -struct sk_buff *skb, -__be32 saddr,__be16 sport, -__be32 daddr,unsigned short hnum) -{ -struct sock *reuse_sk =NULL ; -u32 hash; - -if (sk->sk_reuseport && sk->sk_state !=TCP_ESTABLISHED ) { - hash =udp_ehashfn (net, daddr, hnum, saddr, sport); - reuse_sk =reuseport_select_sock (sk, hash, skb, -sizeof (struct udphdr )); - } -return reuse_sk; -} -/* called with rcu_read_lock() */ static struct sock *udp4_lib_lookup2(struct net *net, __be32 saddr, __be16 sport,
@@ -444,7 +428,14 @@ static struct sock *udp4_lib_lookup2(struct net *net, daddr, hnum, dif, sdif);if (score > badness) { badness = score; - result =lookup_reuseport (net, sk, skb, saddr, sport, daddr, hnum); + +if (sk->sk_state ==TCP_ESTABLISHED ) { + result = sk; +continue ; + } + + result =inet_lookup_reuseport (net, sk, skb,sizeof (struct udphdr ), + saddr, sport, daddr, hnum, udp_ehashfn);if (!result) { result = sk;continue ;
@@ -483,7 +474,8 @@ static struct sock *udp4_lookup_run_bpf(struct net *net,if (no_reuseport ||IS_ERR_OR_NULL (sk))return sk; - reuse_sk =lookup_reuseport (net, sk, skb, saddr, sport, daddr, hnum); + reuse_sk =inet_lookup_reuseport (net, sk, skb,sizeof (struct udphdr ), + saddr, sport, daddr, hnum, udp_ehashfn);if (reuse_sk) sk = reuse_sk;return sk;
net/ipv6/inet6_hashtables.c +10 -4
@@ -41,6 +41,7 @@ u32 inet6_ehashfn(const struct net *net,return __inet6_ehashfn (lhash, lport, fhash, fport, inet6_ehash_secret +net_hash_mix (net)); } +EXPORT_SYMBOL_GPL (inet6_ehashfn);/* * Sockets in TCP_CLOSE state are _always_ taken out of the hash, so
@@ -113,18 +114,22 @@ static inline int compute_score(struct sock *sk, struct net *net,return score; } +INDIRECT_CALLABLE_DECLARE(inet6_ehashfn_t udp6_ehashfn); +struct sock *inet6_lookup_reuseport (struct net *net,struct sock *sk,struct sk_buff *skb,int doff,const struct in6_addr *saddr,__be16 sport,const struct in6_addr *daddr, -unsigned short hnum) +unsigned short hnum, +inet6_ehashfn_t *ehashfn) {struct sock *reuse_sk =NULL ;u32 phash;if (sk->sk_reuseport) { - phash =inet6_ehashfn (net, daddr, hnum, saddr, sport); + phash =INDIRECT_CALL_INET (ehashfn, udp6_ehashfn, inet6_ehashfn, + net, daddr, hnum, saddr, sport); reuse_sk =reuseport_select_sock (sk, phash, skb, doff); }return reuse_sk;
@@ -148,7 +153,7 @@ static struct sock *inet6_lhash2_lookup(struct net *net, score =compute_score (sk, net, hnum, daddr, dif, sdif);if (score > hiscore) { result =inet6_lookup_reuseport (net, sk, skb, doff, - saddr, sport, daddr, hnum); + saddr, sport, daddr, hnum, inet6_ehashfn);if (result)return result;
@@ -179,7 +184,8 @@ static inline struct sock *inet6_lookup_run_bpf(struct net *net,if (no_reuseport ||IS_ERR_OR_NULL (sk))return sk; - reuse_sk =inet6_lookup_reuseport (net, sk, skb, doff, saddr, sport, daddr, hnum); + reuse_sk =inet6_lookup_reuseport (net, sk, skb, doff, + saddr, sport, daddr, hnum, inet6_ehashfn);if (reuse_sk) sk = reuse_sk;return sk;
net/ipv6/udp.c +16 -25
65 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 58/317 udp: Avoid call to compute_score on multiple sites
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabriel Krisman Bertazi <[email protected]>
[ Upstream commit 50aee97d15113b95a68848db1f0cb2a6c09f753a ]
We've observed a 7-12% performance regression in iperf3 UDP ipv4 and ipv6 tests with multiple sockets on Zen3 cpus, which we traced back to commit f0ea27e7bfe1 ("udp: re-score reuseport groups when connected sockets are present"). The failing tests were those that would spawn UDP sockets per-cpu on systems that have a high number of cpus.
Unsurprisingly, it is not caused by the extra re-scoring of the reused socket, but due to the compiler no longer inlining compute_score, once it has the extra call site in udp4_lib_lookup2. This is augmented by the "Safe RET" mitigation for SRSO, needed in our Zen3 cpus.
We could just explicitly inline it, but compute_score() is quite a large function, around 300b. Inlining in two sites would almost double udp4_lib_lookup2, which is a silly thing to do just to workaround a mitigation. Instead, this patch shuffles the code a bit to avoid the multiple calls to compute_score. Since it is a static function used in one spot, the compiler can safely fold it in, as it did before, without increasing the text size.
With this patch applied I ran my original iperf3 testcases. The failing cases all looked like this (ipv4):
iperf3 -c 127.0.0.1 --udp -4 -f K -b $R -l 8920 -t 30 -i 5 -P 64 -O 2
where $R is either 1G/10G/0 (max, unlimited). I ran 3 times each. baseline is v6.9-rc3. harmean == harmonic mean; CV == coefficient of variation.
ipv4:
1G 10G MAX
HARMEAN (CV) HARMEAN (CV) HARMEAN (CV)
baseline 1743852.66(0.0208) 1725933.02(0.0167) 1705203.78(0.0386) patched 1968727.61(0.0035) 1962283.22(0.0195) 1923853.50(0.0256)
ipv6:
1G 10G MAX
HARMEAN (CV) HARMEAN (CV) HARMEAN (CV)
baseline 1729020.03(0.0028) 1691704.49(0.0243) 1692251.34(0.0083) patched 1900422.19(0.0067) 1900968.01(0.0067) 1568532.72(0.1519)
This restores the performance we had before the change above with this benchmark. We obviously don't expect any real impact when mitigations are disabled, but just to be sure it also doesn't regresses:
mitigations=off ipv4:
1G 10G MAX
HARMEAN (CV) HARMEAN (CV) HARMEAN (CV)
baseline 3230279.97(0.0066) 3229320.91(0.0060) 2605693.19(0.0697) patched 3242802.36(0.0073) 3239310.71(0.0035) 2502427.19(0.0882)
--- net/ipv4/udp.c | 21 ++++++++++++++++----- net/ipv6/udp.c | 20 ++++++++++++++++---- 2 files changed, 32 insertions(+), 9 deletions(-)
net/ipv4/udp.c +16 -5
@@ -420,15 +420,21 @@ static struct sock *udp4_lib_lookup2(struct net *net, {struct sock *sk, *result;int score, badness; +bool need_rescore; result =NULL ; badness =0 ;udp_portaddr_for_each_entry_rcu (sk, &hslot2->head) { - score =compute_score (sk, net, saddr, sport, - daddr, hnum, dif, sdif); + need_rescore = false; +rescore: + score =compute_score (need_rescore ? result : sk, net, saddr, + sport, daddr, hnum, dif, sdif);if (score > badness) { badness = score; +if (need_rescore) +continue ; +if (sk->sk_state ==TCP_ESTABLISHED ) { result = sk;continue ;
@@ -449,9 +455,14 @@ static struct sock *udp4_lib_lookup2(struct net *net,if (IS_ERR (result))continue ; - badness =compute_score (result, net, saddr, sport, - daddr, hnum, dif, sdif); - +/* compute_score is too long of a function to be +* inlined, and calling it again here yields +* measureable overhead for some +* workloads. Work around it by jumping +* backwards to rescore 'result'. +*/ + need_rescore = true; + goto rescore; } }return result;
net/ipv6/udp.c +16 -4
@@ -165,15 +165,21 @@ static struct sock *udp6_lib_lookup2(struct net *net, {struct sock *sk, *result;int score, badness; +bool need_rescore; result =NULL ; badness =-1 ;udp_portaddr_for_each_entry_rcu (sk, &hslot2->head) { - score =compute_score (sk, net, saddr, sport, - daddr, hnum, dif, sdif); + need_rescore = false; +rescore: + score =compute_score (need_rescore ? result : sk, net, saddr, + sport, daddr, hnum, dif, sdif);if (score > badness) { badness = score; +if (need_rescore) +continue ; +if (sk->sk_state ==TCP_ESTABLISHED ) { result = sk;continue ;
@@ -194,8 +200,14 @@ static struct sock *udp6_lib_lookup2(struct net *net,if (IS_ERR (result))continue ; - badness =compute_score (sk, net, saddr, sport, - daddr, hnum, dif, sdif); +/* compute_score is too long of a function to be +* inlined, and calling it again here yields +* measureable overhead for some +* workloads. Work around it by jumping +* backwards to rescore 'result'. +*/ + need_rescore = true; + goto rescore; } }return result;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 59/317 scsi: libsas: Fix the failure of adding phy with zero-address to port
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xingui Yang <[email protected]>
[ Upstream commit 06036a0a5db34642c5dbe22021a767141f010b7a ]
As of commit 7d1d86518118 ("[SCSI] libsas: fix false positive 'device attached' conditions"), reset the phy->entacted_sas_addr address to a zero-address when the link rate is less than 1.5G.
Currently we find that when a new device is attached, and the link rate is less than 1.5G, but the device type is not NO_DEVICE, for example: the link rate is SAS_PHY_RESET_IN_PROGRESS and the device type is stp. After setting the phy->entacted_sas_addr address to the zero address, the port will continue to be created for the phy with the zero-address, and other phys with the zero-address will be tried to be added to the new port:
[562240.051197] sas: ex 500e004aaaaaaa1f phy19:U:0 attached: 0000000000000000 (no device) // phy19 is deleted but still on the parent port's phy_list [562240.062536] sas: ex 500e004aaaaaaa1f phy0 new device attached [562240.062616] sas: ex 500e004aaaaaaa1f phy00:U:5 attached: 0000000000000000 (stp) [562240.062680] port-7:7:0: trying to add phy phy-7:7:19 fails: it's already part of another port
Therefore, it should be the same as sas_get_phy_attached_dev(). Only when device_type is SAS_PHY_UNUSED, sas_address is set to the 0 address.
--- drivers/scsi/libsas/sas_expander.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/scsi/libsas/sas_expander.c +1 -2
@@ -256,8 +256,7 @@ static void sas_set_ex_phy(struct domain_device *dev, int phy_id, void *rsp)/* help some expanders that fail to zero sas_address in the 'no * device' case */ -if (phy->attached_dev_type ==SAS_PHY_UNUSED || - phy->linkrate <SAS_LINK_RATE_1_5_GBPS ) +if (phy->attached_dev_type ==SAS_PHY_UNUSED )memset (phy->attached_sas_addr,0 ,SAS_ADDR_SIZE );else memcpy (phy->attached_sas_addr, dr->attached_sas_addr,SAS_ADDR_SIZE );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 60/317 scsi: hpsa: Fix allocation size for Scsi_Host private data
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuri Karpov <[email protected]>
[ Upstream commit 504e2bed5d50610c1836046c0c195b0a6dba9c72 ]
struct Scsi_Host private data contains pointer to struct ctlr_info.
Restore allocation of only 8 bytes to store pointer in struct Scsi_Host private data area.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/scsi/hpsa.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/hpsa.c +1 -1
@@ -5834,7 +5834,7 @@ static int hpsa_scsi_host_alloc(struct ctlr_info *h) {struct Scsi_Host *sh; - sh =scsi_host_alloc (&hpsa_driver_template,sizeof (struct ctlr_info )); + sh =scsi_host_alloc (&hpsa_driver_template,sizeof (struct ctlr_info *));if (sh ==NULL ) {dev_err (&h->pdev->dev,"scsi_host_alloc failed\n" );return -ENOMEM ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 61/317 x86/purgatory: Switch to the position-independent small code model
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <[email protected]>
[ Upstream commit cba786af84a0f9716204e09f518ce3b7ada8555e ]
On x86, the ordinary, position dependent small and kernel code models only support placement of the executable in 32-bit addressable memory, due to the use of 32-bit signed immediates to generate references to global variables. For the kernel, this implies that all global variables must reside in the top 2 GiB of the kernel virtual address space, where the implicit address bits 63:32 are equal to sign bit 31.
This means the kernel code model is not suitable for other bare metal executables such as the kexec purgatory, which can be placed arbitrarily in the physical address space, where its address may no longer be representable as a sign extended 32-bit quantity. For this reason, commit
e16c2983fba0 ("x86/purgatory: Change compiler flags from -mcmodel=kernel to -mcmodel=large to fix kexec relocation errors")
switched to the large code model, which uses 64-bit immediates for all symbol references, including function calls, in order to avoid relying on any assumptions regarding proximity of symbols in the final executable.
The large code model is rarely used, clunky and the least likely to operate in a similar fashion when comparing GCC and Clang, so it is best avoided. This is especially true now that Clang 18 has started to emit executable code in two separate sections (.text and .ltext), which triggers an issue in the kexec loading code at runtime.
The SUSE bugzilla fixes tag points to gcc 13 having issues with the large model too and that perhaps the large model should simply not be used at all.
Instead, use the position independent small code model, which makes no assumptions about placement but only about proximity, where all referenced symbols must be within -/+ 2 GiB, i.e., in range for a RIP-relative reference. Use hidden visibility to suppress the use of a GOT, which carries absolute addresses that are not covered by static ELF relocations, and is therefore incompatible with the kexec loader's relocation logic.
[ bp: Massage commit message. ]
--- arch/x86/purgatory/Makefile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/x86/purgatory/Makefile +2 -1
@@ -37,7 +37,8 @@ KCOV_INSTRUMENT := n # make up the standalone purgatory.ro PURGATORY_CFLAGS_REMOVE := -mcmodel=kernel -PURGATORY_CFLAGS := -mcmodel=large -ffreestanding -fno-zero-initialized-in-bss -g0 +PURGATORY_CFLAGS := -mcmodel=small -ffreestanding -fno-zero-initialized-in-bss -g0 +PURGATORY_CFLAGS += -fpic -fvisibility=hidden PURGATORY_CFLAGS += $(DISABLE_STACKLEAK_PLUGIN) -DDISABLE_BRANCH_PROFILING PURGATORY_CFLAGS += -fno-stack-protector
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 62/317 wifi: ath10k: Fix an error code problem in ath10k_dbg_sta_write_peer_debug_trigger()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <[email protected]>
[ Upstream commit c511a9c12674d246916bb16c479d496b76983193 ]
Clang Static Checker (scan-build) warns:
drivers/net/wireless/ath/ath10k/debugfs_sta.c:line 429, column 3 Value stored to 'ret' is never read.
Return 'ret' rather than 'count' when 'ret' stores an error code.
--- drivers/net/wireless/ath/ath10k/debugfs_sta.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ath/ath10k/debugfs_sta.c +1 -1
@@ -438,7 +438,7 @@ ath10k_dbg_sta_write_peer_debug_trigger(struct file *file, } out:mutex_unlock (&ar->conf_mutex); -return count; +return ret ?: count; }static const struct file_operations fops_peer_debug_trigger = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 63/317 wifi: ath10k: populate board data for WCN3990
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit f1f1b5b055c9f27a2f90fd0f0521f5920e9b3c18 ]
Specify board data size (and board.bin filename) for the WCN3990 platform.
--- drivers/net/wireless/ath/ath10k/core.c | 3 +++ drivers/net/wireless/ath/ath10k/hw.h | 1 + drivers/net/wireless/ath/ath10k/targaddrs.h | 3 +++ 3 files changed, 7 insertions(+)
drivers/net/wireless/ath/ath10k/core.c +3 -0
@@ -625,6 +625,9 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = { .max_spatial_stream = 4, .fw = { .dir = WCN3990_HW_1_0_FW_DIR, + .board = WCN3990_HW_1_0_BOARD_DATA_FILE, + .board_size = WCN3990_BOARD_DATA_SZ, + .board_ext_size = WCN3990_BOARD_EXT_DATA_SZ, }, .sw_decrypt_mcast_mgmt = true, .hw_ops = &wcn3990_ops,
drivers/net/wireless/ath/ath10k/hw.h +1 -0
@@ -132,6 +132,7 @@ enum qca9377_chip_id_rev {/* WCN3990 1.0 definitions */ #define WCN3990_HW_1_0_DEV_VERSION ATH10K_HW_WCN3990#define WCN3990_HW_1_0_FW_DIR ATH10K_FW_DIR "/WCN3990/hw1.0" +#define WCN3990_HW_1_0_BOARD_DATA_FILE "board.bin"#define ATH10K_FW_FILE_BASE "firmware"#define ATH10K_FW_API_MAX 6
drivers/net/wireless/ath/ath10k/targaddrs.h +3 -0
@@ -491,4 +491,7 @@ struct host_interest {#define QCA4019_BOARD_DATA_SZ 12064#define QCA4019_BOARD_EXT_DATA_SZ 0 +#define WCN3990_BOARD_DATA_SZ 26328 +#define WCN3990_BOARD_EXT_DATA_SZ 0 +#endif /* __TARGADDRS_H__ */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 64/317 tcp: avoid premature drops in tcp_add_backlog()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit ec00ed472bdb7d0af840da68c8c11bff9f4d9caa ]
While testing TCP performance with latest trees,
I saw suspect SOCKET_BACKLOG drops.
tcp_add_backlog() computes its limit with :
limit = (u32)READ_ONCE(sk->sk_rcvbuf) +
(u32)(READ_ONCE(sk->sk_sndbuf) >> 1);
limit += 64 * 1024;This does not take into account that sk->sk_backlog.len is reset only at the very end of __release_sock().
Both sk->sk_backlog.len and sk->sk_rmem_alloc could reach sk_rcvbuf in normal conditions.
We should double sk->sk_rcvbuf contribution in the formula to absorb bubbles in the backlog, which happen more often for very fast flows.
This change maintains decent protection against abuses.
--- net/ipv4/tcp_ipv4.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
net/ipv4/tcp_ipv4.c +11 -2
@@ -1787,7 +1787,7 @@ int tcp_v4_early_demux(struct sk_buff *skb)bool tcp_add_backlog (struct sock *sk,struct sk_buff *skb) { -u32 limit, tail_gso_size, tail_gso_segs; +u32 tail_gso_size, tail_gso_segs;struct skb_shared_info *shinfo;const struct tcphdr *th;struct tcphdr *thtail;
@@ -1796,6 +1796,7 @@ bool tcp_add_backlog(struct sock *sk, struct sk_buff *skb)bool fragstolen;u32 gso_segs;u32 gso_size; +u64 limit;int delta;/* In case all data was pulled from skb frags (in __pskb_pull_tail()),
@@ -1891,7 +1892,13 @@ bool tcp_add_backlog(struct sock *sk, struct sk_buff *skb)__skb_push (skb, hdrlen); no_coalesce: - limit = (u32 )READ_ONCE (sk->sk_rcvbuf) + (u32)(READ_ONCE (sk->sk_sndbuf) >>1 ); +/* sk->sk_backlog.len is reset only at the end of __release_sock(). +* Both sk->sk_backlog.len and sk->sk_rmem_alloc could reach +* sk_rcvbuf in normal conditions. +*/ + limit = ((u64 )READ_ONCE (sk->sk_rcvbuf)) <<1 ; + + limit += ((u32 )READ_ONCE (sk->sk_sndbuf)) >>1 ;/* Only socket owner can try to collapse/prune rx queues * to reduce memory overhead, so add a little headroom here.
@@ -1899,6 +1906,8 @@ bool tcp_add_backlog(struct sock *sk, struct sk_buff *skb)*/ limit +=64 *1024 ; + limit =min_t (u64, limit,UINT_MAX ); +if (unlikely (sk_add_backlog (sk, skb, limit))) {bh_unlock_sock (sk);__NET_INC_STATS (sock_net (sk),LINUX_MIB_TCPBACKLOGDROP );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 65/317 net: give more chances to rcu in netdev_wait_allrefs_any()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit cd42ba1c8ac9deb9032add6adf491110e7442040 ]
This came while reviewing commit c4e86b4363ac ("net: add two more call_rcu_hurry()").
Paolo asked if adding one synchronize_rcu() would help.
While synchronize_rcu() does not help, making sure to call rcu_barrier() before msleep(wait) is definitely helping to make sure lazy call_rcu() are completed.
Instead of waiting ~100 seconds in my tests, the ref_tracker splats occurs one time only, and netdev_wait_allrefs_any() latency is reduced to the strict minimum.
Ideally we should audit our call_rcu() users to make sure no refcount (or cascading call_rcu()) is held too long, because rcu_barrier() is quite expensive.
--- net/core/dev.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/core/dev.c +2 -1
@@ -10217,8 +10217,9 @@ static void netdev_wait_allrefs(struct net_device *dev) rebroadcast_time = jiffies; } +rcu_barrier (); +if (!wait) { -rcu_barrier (); wait =WAIT_REFS_MIN_MSECS ; }else {msleep (wait);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 66/317 macintosh/via-macii: Fix "BUG: sleeping function called from invalid context"
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Finn Thain <[email protected]>
[ Upstream commit d301a71c76ee4c384b4e03cdc320a55f5cf1df05 ]
The via-macii ADB driver calls request_irq() after disabling hard interrupts. But disabling interrupts isn't necessary here because the VIA shift register interrupt was masked during VIA1 initialization.
--- drivers/macintosh/via-macii.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-)
drivers/macintosh/via-macii.c +3 -8
@@ -142,24 +142,19 @@ static int macii_probe(void)/* Initialize the driver */ static int macii_init (void ) { -unsigned long flags;int err; -local_irq_save (flags); - err =macii_init_via ();if (err) - goto out; +return err; err =request_irq (IRQ_MAC_ADB , macii_interrupt,0 ,"ADB" , macii_interrupt);if (err) - goto out; +return err; macii_state = idle; -out: -local_irq_restore (flags); -return err; +return 0 ; }/* initialize the hardware */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 67/317 wifi: carl9170: add a proper sanity check for endpoints
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <[email protected]>
[ Upstream commit b6dd09b3dac89b45d1ea3e3bd035a3859c0369a0 ]
Syzkaller reports [1] hitting a warning which is caused by presence of a wrong endpoint type at the URB sumbitting stage. While there was a check for a specific 4th endpoint, since it can switch types between bulk and interrupt, other endpoints are trusted implicitly. Similar warning is triggered in a couple of other syzbot issues [2].
Fix the issue by doing a comprehensive check of all endpoints taking into account difference between high- and full-speed configuration.
[1] Syzkaller report:
...
WARNING: CPU: 0 PID: 4721 at drivers/usb/core/urb.c:504 usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 ... Call Trace: <TASK> carl9170_usb_send_rx_irq_urb+0x273/0x340 drivers/net/wireless/ath/carl9170/usb.c:504 carl9170_usb_init_device drivers/net/wireless/ath/carl9170/usb.c:939 [inline] carl9170_usb_firmware_finish drivers/net/wireless/ath/carl9170/usb.c:999 [inline] carl9170_usb_firmware_step2+0x175/0x240 drivers/net/wireless/ath/carl9170/usb.c:1028 request_firmware_work_func+0x130/0x240 drivers/base/firmware_loader/main.c:1107 process_one_work+0x9bf/0x1710 kernel/workqueue.c:2289 worker_thread+0x669/0x1090 kernel/workqueue.c:2436 kthread+0x2e8/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 </TASK>
[2] Related syzkaller crashes:
--- drivers/net/wireless/ath/carl9170/usb.c | 32 +++++++++++++++++++++++++ 1 file changed, 32 insertions(+)
drivers/net/wireless/ath/carl9170/usb.c +32 -0
@@ -1069,6 +1069,38 @@ static int carl9170_usb_probe(struct usb_interface *intf, ar->usb_ep_cmd_is_bulk = true; } +/* Verify that all expected endpoints are present */ +if (ar->usb_ep_cmd_is_bulk) { +u8 bulk_ep_addr[] = { +AR9170_USB_EP_RX |USB_DIR_IN , +AR9170_USB_EP_TX |USB_DIR_OUT , +AR9170_USB_EP_CMD |USB_DIR_OUT , +0 }; +u8 int_ep_addr[] = { +AR9170_USB_EP_IRQ |USB_DIR_IN , +0 }; +if (!usb_check_bulk_endpoints (intf, bulk_ep_addr) || + !usb_check_int_endpoints (intf, int_ep_addr)) + err = -ENODEV ; + }else { +u8 bulk_ep_addr[] = { +AR9170_USB_EP_RX |USB_DIR_IN , +AR9170_USB_EP_TX |USB_DIR_OUT , +0 }; +u8 int_ep_addr[] = { +AR9170_USB_EP_IRQ |USB_DIR_IN , +AR9170_USB_EP_CMD |USB_DIR_OUT , +0 }; +if (!usb_check_bulk_endpoints (intf, bulk_ep_addr) || + !usb_check_int_endpoints (intf, int_ep_addr)) + err = -ENODEV ; + } + +if (err) { +carl9170_free (ar); +return err; + } +usb_set_intfdata (intf, ar);SET_IEEE80211_DEV (ar->hw, &intf->dev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 68/317 wifi: ar5523: enable proper endpoint verification
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <[email protected]>
[ Upstream commit e120b6388d7d88635d67dcae6483f39c37111850 ]
Syzkaller reports [1] hitting a warning about an endpoint in use not having an expected type to it.
Fix the issue by checking for the existence of all proper endpoints with their according types intact.
Sadly, this patch has not been tested on real hardware.
[1] Syzkaller report:
------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 0 PID: 3643 at drivers/usb/core/urb.c:504 usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 ... Call Trace: <TASK> ar5523_cmd+0x41b/0x780 drivers/net/wireless/ath/ar5523/ar5523.c:275 ar5523_cmd_read drivers/net/wireless/ath/ar5523/ar5523.c:302 [inline] ar5523_host_available drivers/net/wireless/ath/ar5523/ar5523.c:1376 [inline] ar5523_probe+0x14b0/0x1d10 drivers/net/wireless/ath/ar5523/ar5523.c:1655 usb_probe_interface+0x30f/0x7f0 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:560 [inline] really_probe+0x249/0xb90 drivers/base/dd.c:639 __driver_probe_device+0x1df/0x4d0 drivers/base/dd.c:778 driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:808 __device_attach_driver+0x1d4/0x2e0 drivers/base/dd.c:936 bus_for_each_drv+0x163/0x1e0 drivers/base/bus.c:427 __device_attach+0x1e4/0x530 drivers/base/dd.c:1008 bus_probe_device+0x1e8/0x2a0 drivers/base/bus.c:487 device_add+0xbd9/0x1e90 drivers/base/core.c:3517 usb_set_configuration+0x101d/0x1900 drivers/usb/core/message.c:2170 usb_generic_driver_probe+0xbe/0x100 drivers/usb/core/generic.c:238 usb_probe_device+0xd8/0x2c0 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:560 [inline] really_probe+0x249/0xb90 drivers/base/dd.c:639 __driver_probe_device+0x1df/0x4d0 drivers/base/dd.c:778 driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:808 __device_attach_driver+0x1d4/0x2e0 drivers/base/dd.c:936 bus_for_each_drv+0x163/0x1e0 drivers/base/bus.c:427 __device_attach+0x1e4/0x530 drivers/base/dd.c:1008 bus_probe_device+0x1e8/0x2a0 drivers/base/bus.c:487 device_add+0xbd9/0x1e90 drivers/base/core.c:3517 usb_new_device.cold+0x685/0x10ad drivers/usb/core/hub.c:2573 hub_port_connect drivers/usb/core/hub.c:5353 [inline] hub_port_connect_change drivers/usb/core/hub.c:5497 [inline] port_event drivers/usb/core/hub.c:5653 [inline] hub_event+0x26cb/0x45d0 drivers/usb/core/hub.c:5735 process_one_work+0x9bf/0x1710 kernel/workqueue.c:2289 worker_thread+0x669/0x1090 kernel/workqueue.c:2436 kthread+0x2e8/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 </TASK>
--- drivers/net/wireless/ath/ar5523/ar5523.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/net/wireless/ath/ar5523/ar5523.c +14 -0
@@ -1590,6 +1590,20 @@ static int ar5523_probe(struct usb_interface *intf,struct ar5523 *ar;int error = -ENOMEM ; +static const u8 bulk_ep_addr[] = { +AR5523_CMD_TX_PIPE |USB_DIR_OUT , +AR5523_DATA_TX_PIPE |USB_DIR_OUT , +AR5523_CMD_RX_PIPE |USB_DIR_IN , +AR5523_DATA_RX_PIPE |USB_DIR_IN , +0 }; + +if (!usb_check_bulk_endpoints (intf, bulk_ep_addr)) { +dev_err (&dev->dev, +"Could not find all expected endpoints\n" ); + error = -ENODEV ; + goto out; + } +/* * Load firmware if the device requires it. This will return * -ENXIO on success and we'll get called back afer the usb
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 69/317 sh: kprobes: Merge arch_copy_kprobe() into arch_prepare_kprobe()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit 1422ae080b66134fe192082d9b721ab7bd93fcc5 ]
arch/sh/kernel/kprobes.c:52:16: warning: no previous prototype for 'arch_copy_kprobe' [-Wmissing-prototypes]
Although SH kprobes support was only merged in v2.6.28, it missed the earlier removal of the arch_copy_kprobe() callback in v2.6.15.
Based on the powerpc part of commit 49a2a1b83ba6fa40 ("[PATCH] kprobes:
changed from using spinlock to mutex").
--- arch/sh/kernel/kprobes.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-)
arch/sh/kernel/kprobes.c +1 -6
@@ -44,17 +44,12 @@ int __kprobes arch_prepare_kprobe(struct kprobe *p)if (OPCODE_RTE (opcode))return -EFAULT ;/* Bad breakpoint */ +memcpy (p->ainsn.insn, p->addr,MAX_INSN_SIZE *sizeof (kprobe_opcode_t)); p->opcode = opcode;return 0 ; } -void __kprobes arch_copy_kprobe (struct kprobe *p) -{ -memcpy (p->ainsn.insn, p->addr,MAX_INSN_SIZE *sizeof (kprobe_opcode_t)); - p->opcode = *p->addr; -} -void __kprobes arch_arm_kprobe (struct kprobe *p) { *p->addr =BREAKPOINT_INSTRUCTION ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 70/317 Revert "sh: Handle calling csum_partial with misaligned data"
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
[ Upstream commit b5319c96292ff877f6b58d349acf0a9dc8d3b454 ]
This reverts commit cadc4e1a2b4d20d0cc0e81f2c6ba0588775e54e5.
Commit cadc4e1a2b4d ("sh: Handle calling csum_partial with misaligned data") causes bad checksum calculations on unaligned data. Reverting it fixes the problem.
# Subtest: checksum
# module: checksum_kunit
1..5
# test_csum_fixed_random_inputs: ASSERTION FAILED at lib/checksum_kunit.c:500 Expected ( u64)result == ( u64)expec, but
( u64)result == 53378 (0xd082)
( u64)expec == 33488 (0x82d0)
# test_csum_fixed_random_inputs: pass:0 fail:1 skip:0 total:1 not ok 1 test_csum_fixed_random_inputs
# test_csum_all_carry_inputs: ASSERTION FAILED at lib/checksum_kunit.c:525 Expected ( u64)result == ( u64)expec, but
( u64)result == 65281 (0xff01)
( u64)expec == 65280 (0xff00)
# test_csum_all_carry_inputs: pass:0 fail:1 skip:0 total:1
not ok 2 test_csum_all_carry_inputs
# test_csum_no_carry_inputs: ASSERTION FAILED at lib/checksum_kunit.c:573 Expected ( u64)result == ( u64)expec, but
( u64)result == 65535 (0xffff)
( u64)expec == 65534 (0xfffe)
# test_csum_no_carry_inputs: pass:0 fail:1 skip:0 total:1
not ok 3 test_csum_no_carry_inputs
# test_ip_fast_csum: pass:1 fail:0 skip:0 total:1
ok 4 test_ip_fast_csum
# test_csum_ipv6_magic: pass:1 fail:0 skip:0 total:1
ok 5 test_csum_ipv6_magic
# checksum: pass:2 fail:3 skip:0 total:5
# Totals: pass:2 fail:3 skip:0 total:5
not ok 22 checksum
--- arch/sh/lib/checksum.S | 67 ++++++++++++------------------------------ 1 file changed, 18 insertions(+), 49 deletions(-)
arch/sh/lib/checksum.S +18 -49
@@ -33,7 +33,8 @@ */ /* - * asmlinkage __wsum csum_partial(const void *buf, int len, __wsum sum); + * unsigned int csum_partial(const unsigned char *buf, int len, + * unsigned int sum); */ .text
@@ -45,31 +46,11 @@ ENTRY(csum_partial) * Fortunately, it is easy to convert 2-byte alignment to 4-byte * alignment for the unrolled loop. */ + mov r5, r1 mov r4, r0 - tst #3, r0 ! Check alignment. - bt/s 2f ! Jump if alignment is ok. - mov r4, r7 ! Keep a copy to check for alignment + tst #2, r0 ! Check alignment. + bt 2f ! Jump if alignment is ok. ! - tst #1, r0 ! Check alignment. - bt 21f ! Jump if alignment is boundary of 2bytes. - - ! buf is odd - tst r5, r5 - add #-1, r5 - bt 9f - mov.b @r4+, r0 - extu.b r0, r0 - addc r0, r6 ! t=0 from previous tst - mov r6, r0 - shll8 r6 - shlr16 r0 - shlr8 r0 - or r0, r6 - mov r4, r0 - tst #2, r0 - bt 2f -21: - ! buf is 2 byte aligned (len could be 0) add #-2, r5 ! Alignment uses up two bytes. cmp/pz r5 ! bt/s 1f ! Jump if we had at least two bytes.
@@ -77,17 +58,16 @@ ENTRY(csum_partial) bra 6f add #2, r5 ! r5 was < 2. Deal with it. 1: + mov r5, r1 ! Save new len for later use. mov.w @r4+, r0 extu.w r0, r0 addc r0, r6 bf 2f add #1, r6 2: - ! buf is 4 byte aligned (len could be 0) - mov r5, r1 mov #-5, r0 - shld r0, r1 - tst r1, r1 + shld r0, r5 + tst r5, r5 bt/s 4f ! if it's =0, go to 4f clrt .align 2
@@ -109,31 +89,30 @@ ENTRY(csum_partial) addc r0, r6 addc r2, r6 movt r0 - dt r1 + dt r5 bf/s 3b cmp/eq #1, r0 - ! here, we know r1==0 - addc r1, r6 ! add carry to r6 + ! here, we know r5==0 + addc r5, r6 ! add carry to r6 4: - mov r5, r0 + mov r1, r0 and #0x1c, r0 tst r0, r0 - bt 6f - ! 4 bytes or more remaining - mov r0, r1 - shlr2 r1 + bt/s 6f + mov r0, r5 + shlr2 r5 mov #0, r2 5: addc r2, r6 mov.l @r4+, r2 movt r0 - dt r1 + dt r5 bf/s 5b cmp/eq #1, r0 addc r2, r6 - addc r1, r6 ! r1==0 here, so it means add carry-bit + addc r5, r6 ! r5==0 here, so it means add carry-bit 6: - ! 3 bytes or less remaining + mov r1, r5 mov #3, r0 and r0, r5 tst r5, r5
@@ -159,16 +138,6 @@ ENTRY(csum_partial) mov #0, r0 addc r0, r6 9: - ! Check if the buffer was misaligned, if so realign sum - mov r7, r0 - tst #1, r0 - bt 10f - mov r6, r0 - shll8 r6 - shlr16 r0 - shlr8 r0 - or r0, r6 -10: rts mov r6, r0
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 71/317 selftests/binderfs: use the Makefiles rules, not Makes implicit rules
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Hubbard <[email protected]>
[ Upstream commit 019baf635eb6ffe8d6c1343f81788f02a7e0ed98 ]
First of all, in order to build with clang at all, one must first apply Valentin Obst's build fix for LLVM [1]. Once that is done, then when building with clang, via:
make LLVM=1 -C tools/testing/selftests
...the following error occurs:
clang: error: cannot specify -o when generating multiple output files
This is because clang, unlike gcc, won't accept invocations of this form:
clang file1.c header2.h
While trying to fix this, I noticed that:
a) selftests/lib.mk already avoids the problem, and
b) The binderfs Makefile indavertently bypasses the selftests/lib.mk build system, and quitely uses Make's implicit build rules for .c files instead.
The Makefile attempts to set up both a dependency and a source file, neither of which was needed, because lib.mk is able to automatically handle both. This line:
binderfs_test: binderfs_test.c
...causes Make's implicit rules to run, which builds binderfs_test without ever looking at lib.mk.
Fix this by simply deleting the "binderfs_test:" Makefile target and letting lib.mk handle it instead.
[1] https://lore.kernel.org/all/20240329-selftests-libmk-llvm-rfc-v1-1-2f9ed7d1c49f@valentinobst.de/
--- tools/testing/selftests/filesystems/binderfs/Makefile | 2 -- 1 file changed, 2 deletions(-)
tools/testing/selftests/filesystems/binderfs/Makefile +0 -2
@@ -3,6 +3,4 @@ CFLAGS += -I../../../../../usr/include/ -pthread TEST_GEN_PROGS := binderfs_test -binderfs_test: binderfs_test.c ../../kselftest.h ../../kselftest_harness.h - include ../../lib.mk
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 72/317 HID: intel-ish-hid: ipc: Add check for pci_alloc_irq_vectors
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ni <[email protected]>
[ Upstream commit 6baa4524027fd64d7ca524e1717c88c91a354b93 ]
Add a check for the return value of pci_alloc_irq_vectors() and return error if it fails.
--- drivers/hid/intel-ish-hid/ipc/pci-ish.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/hid/intel-ish-hid/ipc/pci-ish.c +5 -0
@@ -164,6 +164,11 @@ static int ish_probe(struct pci_dev *pdev, const struct pci_device_id *ent)/* request and enable interrupt */ ret =pci_alloc_irq_vectors (pdev,1 ,1 ,PCI_IRQ_ALL_TYPES ); +if (ret <0 ) { +dev_err (dev,"ISH: Failed to allocate IRQ vectors\n" ); +return ret; + } +if (!pdev->msi_enabled && !pdev->msix_enabled) irq_flag =IRQF_SHARED ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 73/317 scsi: bfa: Ensure the copied buf is NUL terminated
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bui Quang Minh <[email protected]>
[ Upstream commit 13d0cecb4626fae67c00c84d3c7851f6b62f7df3 ]
Currently, we allocate a nbytes-sized kernel buffer and copy nbytes from userspace to that buffer. Later, we use sscanf on this buffer but we don't ensure that the string is terminated inside the buffer, this can lead to OOB read when using sscanf. Fix this issue by using memdup_user_nul instead of memdup_user.
--- drivers/scsi/bfa/bfad_debugfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/scsi/bfa/bfad_debugfs.c +2 -2
@@ -250,7 +250,7 @@ bfad_debugfs_write_regrd(struct file *file, const char __user *buf,unsigned long flags;void *kern_buf; - kern_buf =memdup_user (buf, nbytes); + kern_buf =memdup_user_nul (buf, nbytes);if (IS_ERR (kern_buf))return PTR_ERR (kern_buf);
@@ -317,7 +317,7 @@ bfad_debugfs_write_regwr(struct file *file, const char __user *buf,unsigned long flags;void *kern_buf; - kern_buf =memdup_user (buf, nbytes); + kern_buf =memdup_user_nul (buf, nbytes);if (IS_ERR (kern_buf))return PTR_ERR (kern_buf);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 74/317 scsi: qedf: Ensure the copied buf is NUL terminated
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bui Quang Minh <[email protected]>
[ Upstream commit d0184a375ee797eb657d74861ba0935b6e405c62 ]
Currently, we allocate a count-sized kernel buffer and copy count from userspace to that buffer. Later, we use kstrtouint on this buffer but we don't ensure that the string is terminated inside the buffer, this can lead to OOB read when using kstrtouint. Fix this issue by using memdup_user_nul instead of memdup_user.
--- drivers/scsi/qedf/qedf_debugfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/qedf/qedf_debugfs.c +1 -1
@@ -170,7 +170,7 @@ qedf_dbg_debug_cmd_write(struct file *filp, const char __user *buffer,if (!count || *ppos)return 0 ; - kern_buf =memdup_user (buffer, count); + kern_buf =memdup_user_nul (buffer, count);if (IS_ERR (kern_buf))return PTR_ERR (kern_buf);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 75/317 wifi: mwl8k: initialize cmd->addr[] properly
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 1d60eabb82694e58543e2b6366dae3e7465892a5 ]
This loop is supposed to copy the mac address to cmd->addr but the i++ increment is missing so it copies everything to cmd->addr[0] and only the last address is recorded.
--- drivers/net/wireless/marvell/mwl8k.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/marvell/mwl8k.c +1 -1
@@ -2714,7 +2714,7 @@ __mwl8k_cmd_mac_multicast_adr(struct ieee80211_hw *hw, int allmulti, cmd->action |=cpu_to_le16 (MWL8K_ENABLE_RX_MULTICAST ); cmd->numaddr =cpu_to_le16 (mc_count);netdev_hw_addr_list_for_each (ha, mc_list) { -memcpy (cmd->addr[i], ha->addr,ETH_ALEN ); +memcpy (cmd->addr[i++], ha->addr,ETH_ALEN ); } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 76/317 usb: aqc111: stop lying about skb->truesize
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 9aad6e45c4e7d16b2bb7c3794154b828fb4384b4 ]
Some usb drivers try to set small skb->truesize and break core networking stacks.
I replace one skb_clone() by an allocation of a fresh and small skb, to get minimally sized skbs, like we did in commit 1e2c61172342 ("net: cdc_ncm: reduce skb truesize in rx path") and 4ce62d5b2f7a ("net: usb: ax88179_178a:
stop lying about skb->truesize")
--- drivers/net/usb/aqc111.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
drivers/net/usb/aqc111.c +3 -5
@@ -1141,17 +1141,15 @@ static int aqc111_rx_fixup(struct usbnet *dev, struct sk_buff *skb)continue ; } -/* Clone SKB */ - new_skb =skb_clone (skb,GFP_ATOMIC ); + new_skb =netdev_alloc_skb_ip_align (dev->net, pkt_len);if (!new_skb) goto err; - new_skb->len = pkt_len; +skb_put (new_skb, pkt_len); +memcpy (new_skb->data, skb->data, pkt_len);skb_pull (new_skb,AQ_RX_HW_PAD ); -skb_set_tail_pointer (new_skb, new_skb->len); - new_skb->truesize =SKB_TRUESIZE (new_skb->len);if (aqc111_data->rx_checksum)aqc111_rx_checksum (new_skb, pkt_desc);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 77/317 net: usb: sr9700: stop lying about skb->truesize
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 05417aa9c0c038da2464a0c504b9d4f99814a23b ]
Some usb drivers set small skb->truesize and break core networking stacks.
In this patch, I removed one of the skb->truesize override.
I also replaced one skb_clone() by an allocation of a fresh and small skb, to get minimally sized skbs, like we did in commit 1e2c61172342 ("net: cdc_ncm: reduce skb truesize in rx path") and 4ce62d5b2f7a ("net: usb: ax88179_178a:
stop lying about skb->truesize")
--- drivers/net/usb/sr9700.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-)
drivers/net/usb/sr9700.c +3 -7
@@ -418,19 +418,15 @@ static int sr9700_rx_fixup(struct usbnet *dev, struct sk_buff *skb)skb_pull (skb,3 ); skb->len = len;skb_set_tail_pointer (skb, len); - skb->truesize = len +sizeof (struct sk_buff );return 2 ; } -/* skb_clone is used for address align */ - sr_skb =skb_clone (skb,GFP_ATOMIC ); + sr_skb =netdev_alloc_skb_ip_align (dev->net, len);if (!sr_skb)return 0 ; - sr_skb->len = len; - sr_skb->data = skb->data +3 ; -skb_set_tail_pointer (sr_skb, len); - sr_skb->truesize = len +sizeof (struct sk_buff ); +skb_put (sr_skb, len); +memcpy (sr_skb->data, skb->data +3 , len);usbnet_skb_return (dev, sr_skb);skb_pull (skb, len +SR_RX_OVERHEAD );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 78/317 m68k: Fix spinlock race in kernel thread creation
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Schmitz <[email protected]>
[ Upstream commit da89ce46f02470ef08f0f580755d14d547da59ed ]
Context switching does take care to retain the correct lock owner across the switch from 'prev' to 'next' tasks. This does rely on interrupts remaining disabled for the entire duration of the switch.
This condition is guaranteed for normal process creation and context switching between already running processes, because both 'prev' and 'next' already have interrupts disabled in their saved copies of the status register.
The situation is different for newly created kernel threads. The status register is set to PS_S in copy_thread(), which does leave the IPL at 0. Upon restoring the 'next' thread's status register in switch_to() aka resume(), interrupts then become enabled prematurely. resume() then returns via ret_from_kernel_thread() and schedule_tail() where run queue lock is released (see finish_task_switch() and finish_lock_switch()).
A timer interrupt calling scheduler_tick() before the lock is released in finish_task_switch() will find the lock already taken, with the current task as lock owner. This causes a spinlock recursion warning as reported by Guenter Roeck.
As far as I can ascertain, this race has been opened in commit 533e6903bea0 ("m68k: split ret_from_fork(), simplify kernel_thread()") but I haven't done a detailed study of kernel history so it may well predate that commit.
Interrupts cannot be disabled in the saved status register copy for kernel threads (init will complain about interrupts disabled when finally starting user space). Disable interrupts temporarily when switching the tasks' register sets in resume().
Note that a simple oriw 0x700,%sr after restoring sr is not enough here
- this leaves enough of a race for the 'spinlock recursion' warning to still be observed.
Tested on ARAnyM and qemu (Quadra 800 emulation).
--- arch/m68k/kernel/entry.S | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/m68k/kernel/entry.S +3 -1
@@ -432,7 +432,9 @@ resume: movec %a0,%dfc /* restore status register */ - movew %a1@(TASK_THREAD+THREAD_SR),%sr + movew %a1@(TASK_THREAD+THREAD_SR),%d0 + oriw #0x0700,%d0 + movew %d0,%sr rts
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 79/317 m68k: mac: Fix reboot hang on Mac IIci
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Finn Thain <[email protected]>
[ Upstream commit 265a3b322df9a973ff1fc63da70af456ab6ae1d6 ]
Calling mac_reset() on a Mac IIci does reset the system, but what follows is a POST failure that requires a manual reset to resolve. Avoid that by using the 68030 asm implementation instead of the C implementation.
Apparently the SE/30 has a similar problem as it has used the asm implementation since before git. This patch extends that solution to other systems with a similar ROM.
After this patch, the only systems still using the C implementation are 68040 systems where adb_type is either MAC_ADB_IOP or MAC_ADB_II. This implies a 1 MiB Quadra ROM.
This now includes the Quadra 900/950, which previously fell through to the "should never get here" catch-all.
--- arch/m68k/mac/misc.c | 36 ++++++++++++++++++------------------ 1 file changed, 18 insertions(+), 18 deletions(-)
arch/m68k/mac/misc.c +18 -18
@@ -452,30 +452,18 @@ void mac_poweroff(void)void mac_reset (void ) { -if (macintosh_config->adb_type ==MAC_ADB_II && - macintosh_config->ident !=MAC_MODEL_SE30 ) { -/* need ROMBASE in booter */ -/* indeed, plus need to MAP THE ROM !! */ - -if (mac_bi_data.rombase ==0 ) - mac_bi_data.rombase =0x40800000 ; - -/* works on some */ - rom_reset = (void *) (mac_bi_data.rombase +0xa ); - -local_irq_disable (); -rom_reset ();#ifdef CONFIG_ADB_CUDA - }else if (macintosh_config->adb_type ==MAC_ADB_EGRET || - macintosh_config->adb_type ==MAC_ADB_CUDA ) { +if (macintosh_config->adb_type ==MAC_ADB_EGRET || + macintosh_config->adb_type ==MAC_ADB_CUDA ) {cuda_restart (); + } else#endif #ifdef CONFIG_ADB_PMU - }else if (macintosh_config->adb_type ==MAC_ADB_PB2 ) { +if (macintosh_config->adb_type ==MAC_ADB_PB2 ) {pmu_restart (); + } else#endif - }else if (CPU_IS_030 ) { - +if (CPU_IS_030 ) {/* 030-specific reset routine. The idea is general, but the * specific registers to reset are '030-specific. Until I * have a non-030 machine, I can't test anything else.
@@ -523,6 +511,18 @@ void mac_reset(void) "jmp %/a0@\n\t" /* jump to the reset vector */ ".chip 68k" : : "r" (offset), "a" (rombase) : "a0"); + }else { +/* need ROMBASE in booter */ +/* indeed, plus need to MAP THE ROM !! */ + +if (mac_bi_data.rombase ==0 ) + mac_bi_data.rombase =0x40800000 ; + +/* works on some */ + rom_reset = (void *)(mac_bi_data.rombase +0xa ); + +local_irq_disable (); +rom_reset (); }/* should never get here */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 80/317 net: ipv6: fix wrong start position when receive hop-by-hop fragment
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: gaoxingwang <[email protected]>
[ Upstream commit 1cd354fe1e4864eeaff62f66ee513080ec946f20 ]
In IPv6, ipv6_rcv_core will parse the hop-by-hop type extension header and increase skb->transport_header by one extension header length. But if there are more other extension headers like fragment header at this time, the skb->transport_header points to the second extension header, not the transport layer header or the first extension header.
This will result in the start and nexthdrp variable not pointing to the same position in ipv6frag_thdr_trunced,
and ipv6_skip_exthdr returning incorrect offset and frag_off.Sometimes,the length of the last sharded packet is smaller than the calculated incorrect offset, resulting in packet loss. We can use network header to offset and calculate the correct position to solve this problem.
--- net/ipv6/reassembly.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv6/reassembly.c +1 -1
@@ -363,7 +363,7 @@ static int ipv6_frag_rcv(struct sk_buff *skb)* the source of the fragment, with the Pointer field set to zero. */ nexthdr = hdr->nexthdr; -if (ipv6frag_thdr_truncated (skb,skb_transport_offset (skb), &nexthdr)) { +if (ipv6frag_thdr_truncated (skb,skb_network_offset (skb) +sizeof (struct ipv6hdr ), &nexthdr)) {__IP6_INC_STATS (net,__in6_dev_get_safely (skb->dev),IPSTATS_MIB_INHDRERRORS );icmpv6_param_prob (skb,ICMPV6_HDR_INCOMP ,0 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 81/317 eth: sungem: remove .ndo_poll_controller to avoid deadlocks
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit ac0a230f719b02432d8c7eba7615ebd691da86f4 ]
Erhard reports netpoll warnings from sungem:
netpoll_send_skb_on_dev(): eth0 enabled interrupts in poll (gem_start_xmit+0x0/0x398)
WARNING: CPU: 1 PID: 1 at net/core/netpoll.c:370 netpoll_send_skb+0x1fc/0x20c
gem_poll_controller() disables interrupts, which may sleep. We can't sleep in netpoll, it has interrupts disabled completely. Strangely, gem_poll_controller() doesn't even poll the completions, and instead acts as if an interrupt has fired so it just schedules NAPI and exits. None of this has been necessary for years, since netpoll invokes NAPI directly.
--- drivers/net/ethernet/sun/sungem.c | 14 -------------- 1 file changed, 14 deletions(-)
drivers/net/ethernet/sun/sungem.c +0 -14
@@ -949,17 +949,6 @@ static irqreturn_t gem_interrupt(int irq, void *dev_id)return IRQ_HANDLED ; } -#ifdef CONFIG_NET_POLL_CONTROLLER -static void gem_poll_controller (struct net_device *dev) -{ -struct gem *gp =netdev_priv (dev); - -disable_irq (gp->pdev->irq); -gem_interrupt (gp->pdev->irq, dev); -enable_irq (gp->pdev->irq); -} -#endif -static void gem_tx_timeout (struct net_device *dev,unsigned int txqueue) {struct gem *gp =netdev_priv (dev);
@@ -2836,9 +2825,6 @@ static const struct net_device_ops gem_netdev_ops = { .ndo_change_mtu = gem_change_mtu, .ndo_validate_addr = eth_validate_addr, .ndo_set_mac_address = gem_set_mac_address, -#ifdef CONFIG_NET_POLL_CONTROLLER - .ndo_poll_controller = gem_poll_controller, -#endif };static int gem_init_one (struct pci_dev *pdev,const struct pci_device_id *ent)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 82/317 net: ethernet: cortina: Locking fixes
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <[email protected]>
[ Upstream commit 812552808f7ff71133fc59768cdc253c5b8ca1bf ]
This fixes a probably long standing problem in the Cortina Gemini ethernet driver: there are some paths in the code where the IRQ registers are written without taking the proper locks.
--- drivers/net/ethernet/cortina/gemini.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/net/ethernet/cortina/gemini.c +10 -2
@@ -1109,10 +1109,13 @@ static void gmac_tx_irq_enable(struct net_device *netdev, {struct gemini_ethernet_port *port =netdev_priv (netdev);struct gemini_ethernet *geth = port->geth; +unsigned long flags;u32 val, mask;netdev_dbg (netdev,"%s device %d\n" , __func__, netdev->dev_id); +spin_lock_irqsave (&geth->irq_lock, flags); + mask =GMAC0_IRQ0_TXQ0_INTS << (6 * netdev->dev_id + txq);if (en)
@@ -1121,6 +1124,8 @@ static void gmac_tx_irq_enable(struct net_device *netdev, val =readl (geth->base +GLOBAL_INTERRUPT_ENABLE_0_REG ); val = en ? val | mask : val & ~mask;writel (val, geth->base +GLOBAL_INTERRUPT_ENABLE_0_REG ); + +spin_unlock_irqrestore (&geth->irq_lock, flags); }static void gmac_tx_irq (struct net_device *netdev,unsigned int txq_num)
@@ -1427,15 +1432,19 @@ static unsigned int gmac_rx(struct net_device *netdev, unsigned int budget)union gmac_rxdesc_3 word3;struct page *page =NULL ;unsigned int page_offs; +unsigned long flags;unsigned short r, w;union dma_rwptr rw;dma_addr_t mapping;int frag_nr =0 ; +spin_lock_irqsave (&geth->irq_lock, flags); rw.bits32 =readl (ptr_reg);/* Reset interrupt as all packages until here are taken into account */ writel (DEFAULT_Q0_INT_BIT << netdev->dev_id, geth->base +GLOBAL_INTERRUPT_STATUS_1_REG ); +spin_unlock_irqrestore (&geth->irq_lock, flags); + r = rw.bits.rptr; w = rw.bits.wptr;
@@ -1738,10 +1747,9 @@ static irqreturn_t gmac_irq(int irq, void *data)gmac_update_hw_stats (netdev);if (val & (GMAC0_RX_OVERRUN_INT_BIT << (netdev->dev_id *8 ))) { +spin_lock (&geth->irq_lock);writel (GMAC0_RXDERR_INT_BIT << (netdev->dev_id *8 ), geth->base +GLOBAL_INTERRUPT_STATUS_4_REG ); - -spin_lock (&geth->irq_lock);u64_stats_update_begin (&port->ir_stats_syncp); ++port->stats.rx_fifo_errors;u64_stats_update_end (&port->ir_stats_syncp);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 83/317 af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <[email protected]>
[ Upstream commit 540bf24fba16b88c1b3b9353927204b4f1074e25 ]
A data-race condition has been identified in af_unix. In one data path, the write function unix_release_sock() atomically writes to sk->sk_shutdown using WRITE_ONCE. However, on the reader side, unix_stream_sendmsg() does not read it atomically. Consequently, this issue is causing the following KCSAN splat to occur:
BUG: KCSAN: data-race in unix_release_sock / unix_stream_sendmsg
write (marked) to 0xffff88867256ddbb of 1 bytes by task 7270 on cpu 28: unix_release_sock (net/unix/af_unix.c:640) unix_release (net/unix/af_unix.c:1050) sock_close (net/socket.c:659 net/socket.c:1421) __fput (fs/file_table.c:422) __fput_sync (fs/file_table.c:508) __se_sys_close (fs/open.c:1559 fs/open.c:1541) __x64_sys_close (fs/open.c:1541) x64_sys_call (arch/x86/entry/syscall_64.c:33) do_syscall_64 (arch/x86/entry/common.c:?) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) read to 0xffff88867256ddbb of 1 bytes by task 989 on cpu 14: unix_stream_sendmsg (net/unix/af_unix.c:2273) __sock_sendmsg (net/socket.c:730 net/socket.c:745) ____sys_sendmsg (net/socket.c:2584) __sys_sendmmsg (net/socket.c:2638 net/socket.c:2724) __x64_sys_sendmmsg (net/socket.c:2753 net/socket.c:2750 net/socket.c:2750) x64_sys_call (arch/x86/entry/syscall_64.c:33) do_syscall_64 (arch/x86/entry/common.c:?) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) value changed: 0x01 -> 0x03
The line numbers are related to commit dd5a440a31fa ("Linux 6.9-rc7").
Commit e1d09c2c2f57 ("af_unix: Fix data races around sk->sk_shutdown.") addressed a comparable issue in the past regarding sk->sk_shutdown. However, it overlooked resolving this particular data path. This patch only offending unix_stream_sendmsg() function, since the other reads seem to be protected by unix_state_lock() as discussed in
--- net/unix/af_unix.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/unix/af_unix.c +1 -1
@@ -1918,7 +1918,7 @@ static int unix_stream_sendmsg(struct socket *sock, struct msghdr *msg, goto out_err; } -if (sk->sk_shutdown &SEND_SHUTDOWN ) +if (READ_ONCE (sk->sk_shutdown) &SEND_SHUTDOWN ) goto pipe_err;while (sent < len) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 84/317 net: usb: smsc95xx: stop lying about skb->truesize
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit d50729f1d60bca822ef6d9c1a5fb28d486bd7593 ]
Some usb drivers try to set small skb->truesize and break core networking stacks.
In this patch, I removed one of the skb->truesize override.
I also replaced one skb_clone() by an allocation of a fresh and small skb, to get minimally sized skbs, like we did in commit 1e2c61172342 ("net: cdc_ncm: reduce skb truesize in rx path") and 4ce62d5b2f7a ("net: usb: ax88179_178a:
stop lying about skb->truesize")
v3: also fix a sparse error ( https://lore.kernel.org/oe-kbuild-all/[email protected]/ )
v2: leave the skb_trim() game because smsc95xx_rx_csum_offload()
needs the csum part. (Jakub)
While we are it, use get_unaligned() in smsc95xx_rx_csum_offload().
--- drivers/net/usb/smsc95xx.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-)
drivers/net/usb/smsc95xx.c +7 -8
@@ -1801,9 +1801,11 @@ static int smsc95xx_reset_resume(struct usb_interface *intf)static void smsc95xx_rx_csum_offload (struct sk_buff *skb) { - skb->csum = *(u16 *)(skb_tail_pointer (skb) -2 ); +u16 *csum_ptr = (u16 *)(skb_tail_pointer (skb) -2 ); + + skb->csum = (__force __wsum )get_unaligned (csum_ptr); skb->ip_summed =CHECKSUM_COMPLETE ; -skb_trim (skb, skb->len -2 ); +skb_trim (skb, skb->len -2 );/* remove csum */ }static int smsc95xx_rx_fixup (struct usbnet *dev,struct sk_buff *skb)
@@ -1861,25 +1863,22 @@ static int smsc95xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb)if (dev->net->features &NETIF_F_RXCSUM )smsc95xx_rx_csum_offload (skb);skb_trim (skb, skb->len -4 );/* remove fcs */ - skb->truesize = size +sizeof (struct sk_buff );return 1 ; } - ax_skb =skb_clone (skb,GFP_ATOMIC ); + ax_skb =netdev_alloc_skb_ip_align (dev->net, size);if (unlikely (!ax_skb)) {netdev_warn (dev->net,"Error allocating skb\n" );return 0 ; } - ax_skb->len = size; - ax_skb->data = packet; -skb_set_tail_pointer (ax_skb, size); +skb_put (ax_skb, size); +memcpy (ax_skb->data, packet, size);if (dev->net->features &NETIF_F_RXCSUM )smsc95xx_rx_csum_offload (ax_skb);skb_trim (ax_skb, ax_skb->len -4 );/* remove fcs */ - ax_skb->truesize = size +sizeof (struct sk_buff );usbnet_skb_return (dev, ax_skb); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 85/317 net: openvswitch: fix overwriting ct original tuple for ICMPv6
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Maximets <[email protected]>
[ Upstream commit 7c988176b6c16c516474f6fceebe0f055af5eb56 ]
OVS_PACKET_CMD_EXECUTE has 3 main attributes:
- OVS_PACKET_ATTR_KEY - Packet metadata in a netlink format.
- OVS_PACKET_ATTR_PACKET - Binary packet content.
- OVS_PACKET_ATTR_ACTIONS - Actions to execute on the packet.
OVS_PACKET_ATTR_KEY is parsed first to populate sw_flow_key structure with the metadata like conntrack state, input port, recirculation id, etc. Then the packet itself gets parsed to populate the rest of the keys from the packet headers.
Whenever the packet parsing code starts parsing the ICMPv6 header, it first zeroes out fields in the key corresponding to Neighbor Discovery information even if it is not an ND packet.
It is an 'ipv6.nd' field. However, the 'ipv6' is a union that shares the space between 'nd' and 'ct_orig' that holds the original tuple conntrack metadata parsed from the OVS_PACKET_ATTR_KEY.
ND packets should not normally have conntrack state, so it's fine to share the space, but normal ICMPv6 Echo packets or maybe other types of ICMPv6 can have the state attached and it should not be overwritten.
The issue results in all but the last 4 bytes of the destination address being wiped from the original conntrack tuple leading to incorrect packet matching and potentially executing wrong actions in case this packet recirculates within the datapath or goes back to userspace.
ND fields should not be accessed in non-ND packets, so not clearing them should be fine. Executing memset() only for actual ND packets to avoid the issue.
Initializing the whole thing before parsing is needed because ND packet may not contain all the options.
The issue only affects the OVS_PACKET_CMD_EXECUTE path and doesn't affect packets entering OVS datapath from network interfaces, because in this case CT metadata is populated from skb after the packet is already parsed.
--- net/openvswitch/flow.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/openvswitch/flow.c +2 -1
@@ -412,7 +412,6 @@ static int parse_icmpv6(struct sk_buff *skb, struct sw_flow_key *key,*/ key->tp.src =htons (icmp->icmp6_type); key->tp.dst =htons (icmp->icmp6_code); -memset (&key->ipv6.nd,0 ,sizeof (key->ipv6.nd)); if (icmp->icmp6_code == 0 && (icmp->icmp6_type == NDISC_NEIGHBOUR_SOLICITATION ||
@@ -421,6 +420,8 @@ static int parse_icmpv6(struct sk_buff *skb, struct sw_flow_key *key,struct nd_msg *nd;int offset; +memset (&key->ipv6.nd,0 ,sizeof (key->ipv6.nd)); +/* In order to process neighbor discovery options, we need the * entire packet. */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 86/317 ipv6: sr: add missing seg6_local_exit
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <[email protected]>
[ Upstream commit 3321687e321307629c71b664225b861ebf3e5753 ]
Currently, we only call seg6_local_exit() in seg6_init() if seg6_local_init() failed. But forgot to call it in seg6_exit().
--- net/ipv6/seg6.c | 1 + 1 file changed, 1 insertion(+)
net/ipv6/seg6.c +1 -0
@@ -503,6 +503,7 @@ void seg6_exit(void)seg6_hmac_exit ();#endif #ifdef CONFIG_IPV6_SEG6_LWTUNNEL +seg6_local_exit ();seg6_iptunnel_exit ();#endif unregister_pernet_subsys (&ip6_segments_ops);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 87/317 ipv6: sr: fix incorrect unregister order
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <[email protected]>
[ Upstream commit 6e370a771d2985107e82d0f6174381c1acb49c20 ]
Commit 5559cea2d5aa ("ipv6: sr: fix possible use-after-free and null-ptr-deref") changed the register order in seg6_init(). But the unregister order in seg6_exit() is not updated.
--- net/ipv6/seg6.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv6/seg6.c +1 -1
@@ -506,6 +506,6 @@ void seg6_exit(void)seg6_local_exit ();seg6_iptunnel_exit ();#endif -unregister_pernet_subsys (&ip6_segments_ops);genl_unregister_family (&seg6_genl_family); +unregister_pernet_subsys (&ip6_segments_ops); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 88/317 ipv6: sr: fix invalid unregister error path
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <[email protected]>
[ Upstream commit 160e9d2752181fcf18c662e74022d77d3164cd45 ]
The error path of seg6_init() is wrong in case CONFIG_IPV6_SEG6_LWTUNNEL is not defined. In that case if seg6_hmac_init() fails, the genl_unregister_family() isn't called.
This issue exist since commit 46738b1317e1 ("ipv6: sr: add option to control lwtunnel support"), and commit 5559cea2d5aa ("ipv6: sr: fix possible use-after-free and null-ptr-deref") replaced unregister_pernet_subsys() with genl_unregister_family() in this error path.
--- net/ipv6/seg6.c | 2 ++ 1 file changed, 2 insertions(+)
net/ipv6/seg6.c +2 -0
@@ -490,6 +490,8 @@ int __init seg6_init(void)#endif #ifdef CONFIG_IPV6_SEG6_LWTUNNEL out_unregister_genl: +#endif +#if IS_ENABLED (CONFIG_IPV6_SEG6_LWTUNNEL ) ||IS_ENABLED (CONFIG_IPV6_SEG6_HMAC )genl_unregister_family (&seg6_genl_family);#endif out_unregister_pernet:
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 89/317 net/mlx5: Discard command completions in internal error
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akiva Goldberger <[email protected]>
[ Upstream commit db9b31aa9bc56ff0d15b78f7e827d61c4a096e40 ]
Fix use after free when FW completion arrives while device is in internal error state. Avoid calling completion handler in this case, since the device will flush the command interface and trigger all completions manually.
Kernel log:
------------[ cut here ]------------ refcount_t: underflow; use-after-free. ... RIP: 0010:refcount_warn_saturate+0xd8/0xe0 ... Call Trace: <IRQ> ? __warn+0x79/0x120 ? refcount_warn_saturate+0xd8/0xe0 ? report_bug+0x17c/0x190 ? handle_bug+0x3c/0x60 ? exc_invalid_op+0x14/0x70 ? asm_exc_invalid_op+0x16/0x20 ? refcount_warn_saturate+0xd8/0xe0 cmd_ent_put+0x13b/0x160 [mlx5_core] mlx5_cmd_comp_handler+0x5f9/0x670 [mlx5_core] cmd_comp_notifier+0x1f/0x30 [mlx5_core] notifier_call_chain+0x35/0xb0 atomic_notifier_call_chain+0x16/0x20 mlx5_eq_async_int+0xf6/0x290 [mlx5_core] notifier_call_chain+0x35/0xb0 atomic_notifier_call_chain+0x16/0x20 irq_int_handler+0x19/0x30 [mlx5_core] __handle_irq_event_percpu+0x4b/0x160 handle_irq_event+0x2e/0x80 handle_edge_irq+0x98/0x230 __common_interrupt+0x3b/0xa0 common_interrupt+0x7b/0xa0 </IRQ> <TASK> asm_common_interrupt+0x22/0x40
--- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/cmd.c +3 -0
@@ -1523,6 +1523,9 @@ static int cmd_comp_notifier(struct notifier_block *nb, dev = container_of(cmd, struct mlx5_core_dev, cmd); eqe = data; +if (dev->state ==MLX5_DEVICE_STATE_INTERNAL_ERROR ) +return NOTIFY_DONE ; +mlx5_cmd_comp_handler (dev,be32_to_cpu (eqe->data.cmd.vector), false);return NOTIFY_OK ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 90/317 drm/amd/display: Fix potential index out of bounds in color transformation function
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <[email protected]>
[ Upstream commit 63ae548f1054a0b71678d0349c7dc9628ddd42ca ]
Fixes index out of bounds issue in the color transformation function. The issue could occur when the index 'i' exceeds the number of transfer function points (TRANSFER_FUNC_POINTS).
The fix adds a check to ensure 'i' is within bounds before accessing the transfer function points. If 'i' is out of bounds, an error message is logged and the function returns false to indicate an error.
Reported by smatch:drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:405 cm_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.red' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:406 cm_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.green' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:407 cm_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.blue' 1025 <= s32max
--- drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c +5 -0
@@ -379,6 +379,11 @@ bool cm_helper_translate_curve_to_hw_format( i += increment) {if (j == hw_points -1 )break ; +if (i >=TRANSFER_FUNC_POINTS ) { +DC_LOG_ERROR ("Index out of bounds: i=%d, TRANSFER_FUNC_POINTS=%d\n" , + i,TRANSFER_FUNC_POINTS ); +return false; + } rgb_resulted[j].red = output_tf->tf_pts.red[i]; rgb_resulted[j].green = output_tf->tf_pts.green[i]; rgb_resulted[j].blue = output_tf->tf_pts.blue[i];
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 91/317 ASoC: soc-acpi: add helper to identify parent driver.
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre-Louis Bossart <[email protected]>
[ Upstream commit 644eebdbbf1154c995d6319c133d7d5b898c5ed2 ]
Intel machine drivers are used by parent platform drivers based on closed-source firmware (Atom/SST and catpt) and SOF-based ones.
In some cases for ACPI-based platforms, the behavior of machine drivers needs to be modified depending on the parent type, typically for card names and power management.
An initial solution based on passing a boolean flag as a platform device parameter was tested earlier. Since it looked overkill, this patch suggests instead a simple string comparison to identify an SOF parent device/driver.
Stable-dep-of: 0cb3b7fd530b ("ASoC: Intel: Disable route checks for Skylake boards")
--- include/sound/soc-acpi.h | 6 ++++++ 1 file changed, 6 insertions(+)
include/sound/soc-acpi.h +6 -0
@@ -171,4 +171,10 @@ struct snd_soc_acpi_codecs { u8 codecs[SND_SOC_ACPI_MAX_CODECS][ACPI_ID_LEN]; }; +static inline bool snd_soc_acpi_sof_parent (struct device *dev) +{ +return dev->parent && dev->parent->driver && dev->parent->driver->name && + !strcmp (dev->parent->driver->name,"sof-audio-acpi" ); +} +#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 92/317 ASoC: Intel: Disable route checks for Skylake boards
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cezary Rojewski <[email protected]>
[ Upstream commit 0cb3b7fd530b8c107443218ce6db5cb6e7b5dbe1 ]
Topology files that are propagated to the world and utilized by the skylake-driver carry shortcomings in their SectionGraphs.
Since commit daa480bde6b3 ("ASoC: soc-core: tidyup for snd_soc_dapm_add_routes()") route checks are no longer permissive. Probe failures for Intel boards have been partially addressed by commit a22ae72b86a4 ("ASoC: soc-core: disable route checks for legacy devices") and its follow up but only skl_nau88l25_ssm4567.c is patched. Fix the problem for the rest of the boards.
--- sound/soc/intel/boards/bxt_da7219_max98357a.c | 1 + sound/soc/intel/boards/bxt_rt298.c | 1 + sound/soc/intel/boards/glk_rt5682_max98357a.c | 2 ++ sound/soc/intel/boards/kbl_da7219_max98357a.c | 1 + sound/soc/intel/boards/kbl_da7219_max98927.c | 4 ++++ sound/soc/intel/boards/kbl_rt5660.c | 1 + sound/soc/intel/boards/kbl_rt5663_max98927.c | 2 ++ sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c | 1 + sound/soc/intel/boards/skl_hda_dsp_generic.c | 2 ++ sound/soc/intel/boards/skl_nau88l25_max98357a.c | 1 + sound/soc/intel/boards/skl_rt286.c | 1 + 11 files changed, 17 insertions(+)
sound/soc/intel/boards/bxt_da7219_max98357a.c +1 -0
@@ -750,6 +750,7 @@ static struct snd_soc_card broxton_audio_card = { .dapm_routes = audio_map, .num_dapm_routes = ARRAY_SIZE(audio_map), .fully_routed = true, + .disable_route_checks = true, .late_probe = bxt_card_late_probe, };
sound/soc/intel/boards/bxt_rt298.c +1 -0
@@ -575,6 +575,7 @@ static struct snd_soc_card broxton_rt298 = { .dapm_routes = broxton_rt298_map, .num_dapm_routes = ARRAY_SIZE(broxton_rt298_map), .fully_routed = true, + .disable_route_checks = true, .late_probe = bxt_card_late_probe, };
sound/soc/intel/boards/glk_rt5682_max98357a.c +2 -0
@@ -603,6 +603,8 @@ static int geminilake_audio_probe(struct platform_device *pdev) card = &glk_audio_card_rt5682_m98357a; card->dev = &pdev->dev;snd_soc_card_set_drvdata (card, ctx); +if (!snd_soc_acpi_sof_parent (&pdev->dev)) + card->disable_route_checks = true;/* override plaform name, if required */ mach = pdev->dev.platform_data;
sound/soc/intel/boards/kbl_da7219_max98357a.c +1 -0
@@ -571,6 +571,7 @@ static struct snd_soc_card kabylake_audio_card_da7219_m98357a = { .dapm_routes = kabylake_map, .num_dapm_routes = ARRAY_SIZE(kabylake_map), .fully_routed = true, + .disable_route_checks = true, .late_probe = kabylake_card_late_probe, };
sound/soc/intel/boards/kbl_da7219_max98927.c +4 -0
@@ -1016,6 +1016,7 @@ static struct snd_soc_card kbl_audio_card_da7219_m98927 = { .codec_conf = max98927_codec_conf, .num_configs = ARRAY_SIZE(max98927_codec_conf), .fully_routed = true, + .disable_route_checks = true, .late_probe = kabylake_card_late_probe, };
@@ -1034,6 +1035,7 @@ static struct snd_soc_card kbl_audio_card_max98927 = { .codec_conf = max98927_codec_conf, .num_configs = ARRAY_SIZE(max98927_codec_conf), .fully_routed = true, + .disable_route_checks = true, .late_probe = kabylake_card_late_probe, };
@@ -1051,6 +1053,7 @@ static struct snd_soc_card kbl_audio_card_da7219_m98373 = { .codec_conf = max98373_codec_conf, .num_configs = ARRAY_SIZE(max98373_codec_conf), .fully_routed = true, + .disable_route_checks = true, .late_probe = kabylake_card_late_probe, };
@@ -1068,6 +1071,7 @@ static struct snd_soc_card kbl_audio_card_max98373 = { .codec_conf = max98373_codec_conf, .num_configs = ARRAY_SIZE(max98373_codec_conf), .fully_routed = true, + .disable_route_checks = true, .late_probe = kabylake_card_late_probe, };
sound/soc/intel/boards/kbl_rt5660.c +1 -0
@@ -519,6 +519,7 @@ static struct snd_soc_card kabylake_audio_card_rt5660 = { .dapm_routes = kabylake_rt5660_map, .num_dapm_routes = ARRAY_SIZE(kabylake_rt5660_map), .fully_routed = true, + .disable_route_checks = true, .late_probe = kabylake_card_late_probe, };
sound/soc/intel/boards/kbl_rt5663_max98927.c +2 -0
@@ -948,6 +948,7 @@ static struct snd_soc_card kabylake_audio_card_rt5663_m98927 = { .codec_conf = max98927_codec_conf, .num_configs = ARRAY_SIZE(max98927_codec_conf), .fully_routed = true, + .disable_route_checks = true, .late_probe = kabylake_card_late_probe, };
@@ -964,6 +965,7 @@ static struct snd_soc_card kabylake_audio_card_rt5663 = { .dapm_routes = kabylake_5663_map, .num_dapm_routes = ARRAY_SIZE(kabylake_5663_map), .fully_routed = true, + .disable_route_checks = true, .late_probe = kabylake_card_late_probe, };
sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c +1 -0
@@ -779,6 +779,7 @@ static struct snd_soc_card kabylake_audio_card = { .codec_conf = max98927_codec_conf, .num_configs = ARRAY_SIZE(max98927_codec_conf), .fully_routed = true, + .disable_route_checks = true, .late_probe = kabylake_card_late_probe, };
sound/soc/intel/boards/skl_hda_dsp_generic.c +2 -0
@@ -229,6 +229,8 @@ static int skl_hda_audio_probe(struct platform_device *pdev) ctx->common_hdmi_codec_drv = mach->mach_params.common_hdmi_codec_drv; hda_soc_card.dev = &pdev->dev; +if (!snd_soc_acpi_sof_parent (&pdev->dev)) + hda_soc_card.disable_route_checks = true;if (mach->mach_params.dmic_num >0 ) { snprintf(hda_soc_components, sizeof(hda_soc_components),
sound/soc/intel/boards/skl_nau88l25_max98357a.c +1 -0
@@ -643,6 +643,7 @@ static struct snd_soc_card skylake_audio_card = { .dapm_routes = skylake_map, .num_dapm_routes = ARRAY_SIZE(skylake_map), .fully_routed = true, + .disable_route_checks = true, .late_probe = skylake_card_late_probe, };
sound/soc/intel/boards/skl_rt286.c +1 -0
@@ -524,6 +524,7 @@ static struct snd_soc_card skylake_rt286 = { .dapm_routes = skylake_rt286_map, .num_dapm_routes = ARRAY_SIZE(skylake_rt286_map), .fully_routed = true, + .disable_route_checks = true, .late_probe = skylake_card_late_probe, };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 93/317 mtd: rawnand: hynix: fixed typo
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxim Korotkov <[email protected]>
[ Upstream commit 6819db94e1cd3ce24a432f3616cd563ed0c4eaba ]
The function hynix_nand_rr_init() should probably return an error code. Judging by the usage, it seems that the return code is passed up the call stack.
Right now, it always returns 0 and the function hynix_nand_cleanup() in hynix_nand_init() has never been called.
Found by RASU JSC and Linux Verification Center (linuxtesting.org)
--- drivers/mtd/nand/raw/nand_hynix.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/nand/raw/nand_hynix.c +1 -1
@@ -402,7 +402,7 @@ static int hynix_nand_rr_init(struct nand_chip *chip)if (ret)pr_warn ("failed to initialize read-retry infrastructure" ); -return 0 ; +return ret; } static void hynix_nand_extract_oobsize(struct nand_chip *chip,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 94/317 fbdev: shmobile: fix snprintf truncation
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 26c8cfb9d1e4b252336d23dd5127a8cbed414a32 ]
The name of the overlay does not fit into the fixed-length field:
drivers/video/fbdev/sh_mobile_lcdcfb.c:1577:2: error: 'snprintf' will always be truncated; specified size is 16, but format string expands to at least 25
Make it short enough by changing the string.
--- drivers/video/fbdev/sh_mobile_lcdcfb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/video/fbdev/sh_mobile_lcdcfb.c +1 -1
@@ -1580,7 +1580,7 @@ sh_mobile_lcdc_overlay_fb_init(struct sh_mobile_lcdc_overlay *ovl)*/ info->fix = sh_mobile_lcdc_overlay_fix;snprintf (info->fix.id,sizeof (info->fix.id), -"SH Mobile LCDC Overlay %u" , ovl->index); +"SHMobile ovl %u" , ovl->index); info->fix.smem_start = ovl->dma_handle; info->fix.smem_len = ovl->fb_size; info->fix.line_length = ovl->pitch;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 95/317 drm/meson: vclk: fix calculation of 59.94 fractional rates
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Hewitt <[email protected]>
[ Upstream commit bfbc68e4d8695497f858a45a142665e22a512ea3 ]
Playing 4K media with 59.94 fractional rate (typically VP9) causes the screen to lose sync with the following error reported in the system log:
[ 89.610280] Fatal Error, invalid HDMI vclk freq 593406
Modetest shows the following:
3840x2160 59.94 3840 4016 4104 4400 2160 2168 2178 2250 593407 flags: xxxx, xxxx, drm calculated value -------------------------------------^
Change the fractional rate calculation to stop DIV_ROUND_CLOSEST rounding down which results in vclk freq failing to match correctly.
--- drivers/gpu/drm/meson/meson_vclk.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/meson/meson_vclk.c +3 -3
@@ -790,13 +790,13 @@ meson_vclk_vic_supported_freq(struct meson_drm *priv, unsigned int phy_freq, FREQ_1000_1001(params[i].pixel_freq));DRM_DEBUG_DRIVER ("i = %d phy_freq = %d alt = %d\n" , i, params[i].phy_freq, -FREQ_1000_1001 (params[i].phy_freq/10 )*10 ); +FREQ_1000_1001 (params[i].phy_freq/1000 )*1000 );/* Match strict frequency */ if (phy_freq == params[i].phy_freq && vclk_freq == params[i].vclk_freq)return MODE_OK ;/* Match 1000/1001 variant */ -if (phy_freq == (FREQ_1000_1001 (params[i].phy_freq/10 )*10 ) && +if (phy_freq == (FREQ_1000_1001 (params[i].phy_freq/1000 )*1000 ) && vclk_freq ==FREQ_1000_1001 (params[i].vclk_freq))return MODE_OK ; }
@@ -1070,7 +1070,7 @@ void meson_vclk_setup(struct meson_drm *priv, unsigned int target,for (freq =0 ; params[freq].pixel_freq ; ++freq) {if ((phy_freq == params[freq].phy_freq || - phy_freq ==FREQ_1000_1001 (params[freq].phy_freq/10 )*10 ) && + phy_freq ==FREQ_1000_1001 (params[freq].phy_freq/1000 )*1000 ) && (vclk_freq == params[freq].vclk_freq || vclk_freq ==FREQ_1000_1001 (params[freq].vclk_freq))) {if (vclk_freq != params[freq].vclk_freq)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 96/317 drm/mediatek: Add 0 size check to mtk_drm_gem_obj
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Green <[email protected]>
[ Upstream commit 1e4350095e8ab2577ee05f8c3b044e661b5af9a0 ]
Add a check to mtk_drm_gem_init if we attempt to allocate a GEM object of 0 bytes. Currently, no such check exists and the kernel will panic if a userspace application attempts to allocate a 0x0 GBM buffer.
Tested by attempting to allocate a 0x0 GBM buffer on an MT8188 and verifying that we now return EINVAL.
--- drivers/gpu/drm/mediatek/mtk_drm_gem.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/mediatek/mtk_drm_gem.c +3 -0
@@ -21,6 +21,9 @@ static struct mtk_drm_gem_obj *mtk_drm_gem_init(struct drm_device *dev, size =round_up (size,PAGE_SIZE ); +if (size ==0 ) +return ERR_PTR (-EINVAL ); + mtk_gem_obj =kzalloc (sizeof (*mtk_gem_obj),GFP_KERNEL );if (!mtk_gem_obj)return ERR_PTR (-ENOMEM );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 97/317 powerpc/fsl-soc: hide unused const variable
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 01acaf3aa75e1641442cc23d8fe0a7bb4226efb1 ]
vmpic_msi_feature is only used conditionally, which triggers a rare -Werror=unused-const-variable= warning with gcc:
arch/powerpc/sysdev/fsl_msi.c:567:37: error: 'vmpic_msi_feature' defined but not used [-Werror=unused-const-variable=]
567 | static const struct fsl_msi_feature vmpic_msi_feature =
Hide this one in the same #ifdef as the reference so we can turn on the warning by default.
--- arch/powerpc/sysdev/fsl_msi.c | 2 ++ 1 file changed, 2 insertions(+)
arch/powerpc/sysdev/fsl_msi.c +2 -0
@@ -573,10 +573,12 @@ static const struct fsl_msi_feature ipic_msi_feature = { .msiir_offset = 0x38, }; +#ifdef CONFIG_EPAPR_PARAVIRT static const struct fsl_msi_feature vmpic_msi_feature = { .fsl_pic_ip =FSL_PIC_IP_VMPIC , .msiir_offset =0 , }; +#endif static const struct of_device_id fsl_of_msi_ids[] = { {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 98/317 fbdev: sisfb: hide unused variables
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 688cf598665851b9e8cb5083ff1d208ce43d10ff ]
Building with W=1 shows that a couple of variables in this driver are only used in certain configurations:
drivers/video/fbdev/sis/init301.c:239:28: error: 'SiS_Part2CLVX_6' defined but not used [-Werror=unused-const-variable=]
239 | static const unsigned char SiS_Part2CLVX_6[] = { /* 1080i */
| ^~~~~~~~~~~~~~~
drivers/video/fbdev/sis/init301.c:230:28: error: 'SiS_Part2CLVX_5' defined but not used [-Werror=unused-const-variable=]
230 | static const unsigned char SiS_Part2CLVX_5[] = { /* 750p */
| ^~~~~~~~~~~~~~~
drivers/video/fbdev/sis/init301.c:211:28: error: 'SiS_Part2CLVX_4' defined but not used [-Werror=unused-const-variable=]
211 | static const unsigned char SiS_Part2CLVX_4[] = { /* PAL */
| ^~~~~~~~~~~~~~~
drivers/video/fbdev/sis/init301.c:192:28: error: 'SiS_Part2CLVX_3' defined but not used [-Werror=unused-const-variable=]
192 | static const unsigned char SiS_Part2CLVX_3[] = { /* NTSC, 525i, 525p */
| ^~~~~~~~~~~~~~~
drivers/video/fbdev/sis/init301.c:184:28: error: 'SiS_Part2CLVX_2' defined but not used [-Werror=unused-const-variable=]
184 | static const unsigned char SiS_Part2CLVX_2[] = {
| ^~~~~~~~~~~~~~~
drivers/video/fbdev/sis/init301.c:176:28: error: 'SiS_Part2CLVX_1' defined but not used [-Werror=unused-const-variable=]
176 | static const unsigned char SiS_Part2CLVX_1[] = {
| ^~~~~~~~~~~~~~~This started showing up after the definitions were moved into the source file from the header, which was not flagged by the compiler. Move the definition into the appropriate #ifdef block that already exists next to them.
--- drivers/video/fbdev/sis/init301.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/video/fbdev/sis/init301.c +1 -2
@@ -172,7 +172,7 @@ static const unsigned char SiS_HiTVGroup3_2[] = { };/* 301C / 302ELV extended Part2 TV registers (4 tap scaler) */ - +#ifdef CONFIG_FB_SIS_315 static const unsigned char SiS_Part2CLVX_1[] = {0x00 ,0x00 , 0x00,0x20,0x00,0x00,0x7F,0x20,0x02,0x7F,0x7D,0x20,0x04,0x7F,0x7D,0x1F,0x06,0x7E,
@@ -245,7 +245,6 @@ static const unsigned char SiS_Part2CLVX_6[] = { /* 1080i */ 0xFF,0xFF, }; -#ifdef CONFIG_FB_SIS_315 /* 661 et al LCD data structure (2.03.00) */ static const unsigned char SiS_LCDStruct661[] = {/* 1024x768 */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 99/317 media: ngene: Add dvb_ca_en50221_init return value check
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Burakov <[email protected]>
[ Upstream commit 9bb1fd7eddcab2d28cfc11eb20f1029154dac718 ]
The return value of dvb_ca_en50221_init() is not checked here that may cause undefined behavior in case of nonzero value return.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/media/pci/ngene/ngene-core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/media/pci/ngene/ngene-core.c +3 -1
@@ -1488,7 +1488,9 @@ static int init_channel(struct ngene_channel *chan) }if (dev->ci.en && (io &NGENE_IO_TSOUT )) { -dvb_ca_en50221_init (adapter, dev->ci.en,0 ,1 ); + ret =dvb_ca_en50221_init (adapter, dev->ci.en,0 ,1 ); +if (ret !=0 ) + goto err;set_transfer (chan,1 ); chan->dev->channel[2 ].DataFormatFlags =DF_SWAP32 ;set_transfer (&chan->dev->channel[2 ],1 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 100/317 media: radio-shark2: Avoid led_names truncations
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <[email protected]>
[ Upstream commit 1820e16a3019b6258e6009d34432946a6ddd0a90 ]
Increase the size of led_names so it can fit any valid v4l2 device name.
Fixes:drivers/media/radio/radio-shark2.c:197:17: warning: ‘%s’ directive output may be truncated writing up to 35 bytes into a region of size 32 [-Wformat-truncation=]
--- drivers/media/radio/radio-shark2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/radio/radio-shark2.c +1 -1
@@ -62,7 +62,7 @@ struct shark_device {#ifdef SHARK_USE_LEDS struct work_struct led_work;struct led_classdev leds[NO_LEDS ]; -char led_names[NO_LEDS ][32 ]; +char led_names[NO_LEDS ][64 ];atomic_t brightness[NO_LEDS ];unsigned long brightness_new;#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 101/317 drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Mishin <[email protected]>
[ Upstream commit 935a92a1c400285545198ca2800a4c6c519c650a ]
In cdns_mhdp_atomic_enable(), the return value of drm_mode_duplicate() is assigned to mhdp_state->current_mode, and there is a dereference of it in drm_mode_set_name(), which will lead to a NULL pointer dereference on failure of drm_mode_duplicate().
Fix this bug add a check of mhdp_state->current_mode.
--- drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c +3 -0
@@ -1978,6 +1978,9 @@ static void cdns_mhdp_atomic_enable(struct drm_bridge *bridge, mhdp_state =to_cdns_mhdp_bridge_state (new_state); mhdp_state->current_mode =drm_mode_duplicate (bridge->dev, mode); +if (!mhdp_state->current_mode) +return ; +drm_mode_set_name (mhdp_state->current_mode);dev_dbg (mhdp->dev,"%s: Enabling mode %s\n" , __func__, mode->name);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 102/317 fbdev: sh7760fb: allow modular build
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <[email protected]>
[ Upstream commit 51084f89d687e14d96278241e5200cde4b0985c7 ]
There is no reason to prohibit sh7760fb from being built as a loadable module as suggested by Geert, so change the config symbol from bool to tristate to allow that and change the FB dependency as needed.
--- drivers/video/fbdev/Kconfig | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/video/fbdev/Kconfig +2 -2
@@ -2013,8 +2013,8 @@ config FB_COBALT depends on FB && MIPS_COBALT config FB_SH7760 - bool "SH7760/SH7763/SH7720/SH7721 LCDC support" - depends on FB=y && (CPU_SUBTYPE_SH7760 || CPU_SUBTYPE_SH7763 \ + tristate "SH7760/SH7763/SH7720/SH7721 LCDC support" + depends on FB && (CPU_SUBTYPE_SH7760 || CPU_SUBTYPE_SH7763 \ || CPU_SUBTYPE_SH7720 || CPU_SUBTYPE_SH7721) select FB_CFB_FILLRECT select FB_CFB_COPYAREA
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 103/317 media: atomisp: ssh_css: Fix a null-pointer dereference in load_video_binaries
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhipeng Lu <[email protected]>
[ Upstream commit 3b621e9e9e148c0928ab109ac3d4b81487469acb ]
The allocation failure of mycs->yuv_scaler_binary in load_video_binaries() is followed with a dereference of mycs->yuv_scaler_binary after the following call chain:
sh_css_pipe_load_binaries()
|-> load_video_binaries(mycs->yuv_scaler_binary == NULL)
|
|-> sh_css_pipe_unload_binaries()
|-> unload_video_binaries()In unload_video_binaries(), it calls to ia_css_binary_unload with argument &pipe->pipe_settings.video.yuv_scaler_binary[i], which refers to the same memory slot as mycs->yuv_scaler_binary. Thus, a null-pointer dereference is triggered.
--- drivers/staging/media/atomisp/pci/sh_css.c | 1 + 1 file changed, 1 insertion(+)
drivers/staging/media/atomisp/pci/sh_css.c +1 -0
@@ -5477,6 +5477,7 @@ static int load_video_binaries(struct ia_css_pipe *pipe) mycs->yuv_scaler_binary =kzalloc (cas_scaler_descr.num_stage *sizeof (struct ia_css_binary ),GFP_KERNEL );if (!mycs->yuv_scaler_binary) { + mycs->num_yuv_scaler =0 ; err = -ENOMEM ;return err; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 104/317 drm/arm/malidp: fix a possible null pointer dereference
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huai-Yuan Liu <[email protected]>
[ Upstream commit a1f95aede6285dba6dd036d907196f35ae3a11ea ]
In malidp_mw_connector_reset, new memory is allocated with kzalloc, but no check is performed. In order to prevent null pointer dereferencing, ensure that mw_state is checked before calling __drm_atomic_helper_connector_reset.
--- drivers/gpu/drm/arm/malidp_mw.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/gpu/drm/arm/malidp_mw.c +4 -1
@@ -70,7 +70,10 @@ static void malidp_mw_connector_reset(struct drm_connector *connector)__drm_atomic_helper_connector_destroy_state (connector->state);kfree (connector->state); -__drm_atomic_helper_connector_reset (connector, &mw_state->base); + connector->state =NULL ; + +if (mw_state) +__drm_atomic_helper_connector_reset (connector, &mw_state->base); } static enum drm_connector_status
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 105/317 drm: vc4: Fix possible null pointer dereference
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Mishin <[email protected]>
[ Upstream commit c534b63bede6cb987c2946ed4d0b0013a52c5ba7 ]
In vc4_hdmi_audio_init() of_get_address() may return
NULL which is later dereferenced. Fix this bug by adding NULL check.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/gpu/drm/vc4/vc4_hdmi.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/vc4/vc4_hdmi.c +2 -0
@@ -1253,6 +1253,8 @@ static int vc4_hdmi_audio_init(struct vc4_hdmi *vc4_hdmi) index =1 ; addr =of_get_address (dev->of_node, index,NULL ,NULL ); +if (!addr) +return -EINVAL ; vc4_hdmi->audio.dma_data.addr =be32_to_cpup (addr) + mai_data->offset; vc4_hdmi->audio.dma_data.addr_width =DMA_SLAVE_BUSWIDTH_4_BYTES ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 106/317 ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <[email protected]>
[ Upstream commit 58300f8d6a48e58d1843199be743f819e2791ea3 ]
The string SND_SOC_DAPM_DIR_OUT is printed in the snd_soc_dapm_path trace event instead of its value:
(((REC->path_dir) == SND_SOC_DAPM_DIR_OUT) ? "->" : "<-")
User space cannot parse this, as it has no idea what SND_SOC_DAPM_DIR_OUT is. Use TRACE_DEFINE_ENUM() to convert it to its value:
(((REC->path_dir) == 1) ? "->" : "<-")
So that user space tools, such as perf and trace-cmd, can parse it correctly.
--- include/trace/events/asoc.h | 2 ++ 1 file changed, 2 insertions(+)
include/trace/events/asoc.h +2 -0
@@ -11,6 +11,8 @@#define DAPM_DIRECT "(direct)"#define DAPM_ARROW (dir) (((dir) == SND_SOC_DAPM_DIR_OUT) ? "->" : "<-") +TRACE_DEFINE_ENUM (SND_SOC_DAPM_DIR_OUT ); +struct snd_soc_jack ;struct snd_soc_card ;struct snd_soc_dapm_widget ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 107/317 drm/bridge: lt9611: Dont log an error when DSI host cant be found
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nícolas F. R. A. Prado <[email protected]>
[ Upstream commit cd0a2c6a081ff67007323725b9ff07d9934b1ed8 ]
Given that failing to find a DSI host causes the driver to defer probe, make use of dev_err_probe() to log the reason. This makes the defer probe reason available and avoids alerting userspace about something that is not necessarily an error.
--- drivers/gpu/drm/bridge/lontium-lt9611.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/gpu/drm/bridge/lontium-lt9611.c +2 -4
@@ -766,10 +766,8 @@ static struct mipi_dsi_device *lt9611_attach_dsi(struct lt9611 *lt9611,int ret; host =of_find_mipi_dsi_host_by_node (dsi_node); -if (!host) { -dev_err (lt9611->dev,"failed to find dsi host\n" ); -return ERR_PTR (-EPROBE_DEFER ); - } +if (!host) +return ERR_PTR (dev_err_probe (lt9611->dev, -EPROBE_DEFER ,"failed to find dsi host\n" )); dsi =mipi_dsi_device_register_full (host, &info);if (IS_ERR (dsi)) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 108/317 drm/bridge: tc358775: Dont log an error when DSI host cant be found
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nícolas F. R. A. Prado <[email protected]>
[ Upstream commit 272377aa0e3dddeec3f568c8bb9d12c7a79d8ef5 ]
Given that failing to find a DSI host causes the driver to defer probe, make use of dev_err_probe() to log the reason. This makes the defer probe reason available and avoids alerting userspace about something that is not necessarily an error.
--- drivers/gpu/drm/bridge/tc358775.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/gpu/drm/bridge/tc358775.c +2 -4
@@ -605,10 +605,8 @@ static int tc_bridge_attach(struct drm_bridge *bridge, }; host =of_find_mipi_dsi_host_by_node (tc->host_node); -if (!host) { -dev_err (dev,"failed to find dsi host\n" ); -return -EPROBE_DEFER ; - } +if (!host) +return dev_err_probe (dev, -EPROBE_DEFER ,"failed to find dsi host\n" ); dsi =mipi_dsi_device_register_full (host, &info);if (IS_ERR (dsi)) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 109/317 drm/panel: simple: Add missing Innolux G121X1-L03 format, flags, connector
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
[ Upstream commit 11ac72d033b9f577e8ba0c7a41d1c312bb232593 ]
The .bpc = 6 implies .bus_format = MEDIA_BUS_FMT_RGB666_1X7X3_SPWG , add the missing bus_format. Add missing connector type and bus_flags as well.
Documentation [1] 1.4 GENERAL SPECIFICATI0NS indicates this panel is capable of both RGB 18bit/24bit panel, the current configuration uses 18bit mode, .bus_format = MEDIA_BUS_FMT_RGB666_1X7X3_SPWG , .bpc = 6.
Support for the 24bit mode would require another entry in panel-simple with .bus_format = MEDIA_BUS_FMT_RGB666_1X7X4_SPWG and .bpc = 8, which is out of scope of this fix.
[1] https://www.distec.de/fileadmin/pdf/produkte/TFT-Displays/Innolux/G121X1-L03_Datasheet.pdf
--- drivers/gpu/drm/panel/panel-simple.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/panel/panel-simple.c +3 -0
@@ -2235,6 +2235,9 @@ static const struct panel_desc innolux_g121x1_l03 = { .unprepare = 200, .disable = 400, }, + .bus_format = MEDIA_BUS_FMT_RGB666_1X7X3_SPWG, + .bus_flags = DRM_BUS_FLAG_DE_HIGH, + .connector_type = DRM_MODE_CONNECTOR_LVDS, };/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 110/317 drm/mipi-dsi: use correct return type for the DSC functions
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit de1c705c50326acaceaf1f02bc5bf6f267c572bd ]
The functions mipi_dsi_compression_mode() and mipi_dsi_picture_parameter_set() return 0-or-error rather than a buffer size. Follow example of other similar MIPI DSI functions and use int return type instead of size_t.
--- drivers/gpu/drm/drm_mipi_dsi.c | 6 +++--- include/drm/drm_mipi_dsi.h | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-)
drivers/gpu/drm/drm_mipi_dsi.c +3 -3
@@ -572,7 +572,7 @@ EXPORT_SYMBOL(mipi_dsi_set_maximum_return_packet_size);* * Return: 0 on success or a negative error code on failure. */ -ssize_t mipi_dsi_compression_mode (struct mipi_dsi_device *dsi,bool enable) +int mipi_dsi_compression_mode (struct mipi_dsi_device *dsi,bool enable) {/* Note: Needs updating for non-default PPS or algorithm */ u8 tx[2 ] = { enable <<0 ,0 };
@@ -597,8 +597,8 @@ EXPORT_SYMBOL(mipi_dsi_compression_mode);* * Return: 0 on success or a negative error code on failure. */ -ssize_t mipi_dsi_picture_parameter_set (struct mipi_dsi_device *dsi, -const struct drm_dsc_picture_parameter_set *pps) +int mipi_dsi_picture_parameter_set (struct mipi_dsi_device *dsi, +const struct drm_dsc_picture_parameter_set *pps) {struct mipi_dsi_msg msg = { .channel = dsi->channel,
include/drm/drm_mipi_dsi.h +3 -3
@@ -231,9 +231,9 @@ int mipi_dsi_shutdown_peripheral(struct mipi_dsi_device *dsi);int mipi_dsi_turn_on_peripheral (struct mipi_dsi_device *dsi);int mipi_dsi_set_maximum_return_packet_size (struct mipi_dsi_device *dsi,u16 value); -ssize_t mipi_dsi_compression_mode (struct mipi_dsi_device *dsi,bool enable); -ssize_t mipi_dsi_picture_parameter_set (struct mipi_dsi_device *dsi, -const struct drm_dsc_picture_parameter_set *pps); +int mipi_dsi_compression_mode (struct mipi_dsi_device *dsi,bool enable); +int mipi_dsi_picture_parameter_set (struct mipi_dsi_device *dsi, +const struct drm_dsc_picture_parameter_set *pps);ssize_t mipi_dsi_generic_write (struct mipi_dsi_device *dsi,const void *payload,size_t size);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 111/317 RDMA/hns: Refactor the hns_roce_buf allocation flow
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xi Wang <[email protected]>
[ Upstream commit 6f6e2dcbb82b9b2ea304fe32635789fedd4e9868 ]
Add a group of flags to control the 'struct hns_roce_buf' allocation flow, this is used to support the caller running in atomic context.
Stable-dep-of: 203b70fda634 ("RDMA/hns: Fix return value in hns_roce_map_mr_sg")
--- drivers/infiniband/hw/hns/hns_roce_alloc.c | 128 +++++++++++--------- drivers/infiniband/hw/hns/hns_roce_device.h | 51 ++++---- drivers/infiniband/hw/hns/hns_roce_mr.c | 39 ++---- 3 files changed, 113 insertions(+), 105 deletions(-)
drivers/infiniband/hw/hns/hns_roce_alloc.c +74 -54
@@ -159,76 +159,96 @@ void hns_roce_bitmap_cleanup(struct hns_roce_bitmap *bitmap)void hns_roce_buf_free (struct hns_roce_dev *hr_dev,struct hns_roce_buf *buf) { -struct device *dev = hr_dev->dev; -u32 size = buf->size; -int i; +struct hns_roce_buf_list *trunks; +u32 i; -if (size ==0 ) +if (!buf)return ; - buf->size =0 ; + trunks = buf->trunk_list; +if (trunks) { + buf->trunk_list =NULL ; +for (i =0 ; i < buf->ntrunks; i++) +dma_free_coherent (hr_dev->dev,1 << buf->trunk_shift, + trunks[i].buf, trunks[i].map); -if (hns_roce_buf_is_direct (buf)) { -dma_free_coherent (dev, size, buf->direct.buf, buf->direct.map); - }else { -for (i =0 ; i < buf->npages; ++i) -if (buf->page_list[i].buf) -dma_free_coherent (dev,1 << buf->page_shift, - buf->page_list[i].buf, - buf->page_list[i].map); -kfree (buf->page_list); - buf->page_list =NULL ; +kfree (trunks); } + +kfree (buf); } -int hns_roce_buf_alloc (struct hns_roce_dev *hr_dev,u32 size,u32 max_direct, -struct hns_roce_buf *buf,u32 page_shift) +/* +* Allocate the dma buffer for storing ROCEE table entries +* +* @size: required size +* @page_shift: the unit size in a continuous dma address range +* @flags: HNS_ROCE_BUF_ flags to control the allocation flow. +*/ +struct hns_roce_buf *hns_roce_buf_alloc (struct hns_roce_dev *hr_dev,u32 size, +u32 page_shift,u32 flags) { -struct hns_roce_buf_list *buf_list; -struct device *dev = hr_dev->dev; -u32 page_size; -int i; +u32 trunk_size, page_size, alloced_size; +struct hns_roce_buf_list *trunks; +struct hns_roce_buf *buf; +gfp_t gfp_flags; +u32 ntrunk, i;/* The minimum shift of the page accessed by hw is HNS_HW_PAGE_SHIFT */ - buf->page_shift =max_t (int,HNS_HW_PAGE_SHIFT , page_shift); +if (WARN_ON (page_shift <HNS_HW_PAGE_SHIFT )) +return ERR_PTR (-EINVAL ); + + gfp_flags = (flags &HNS_ROCE_BUF_NOSLEEP ) ?GFP_ATOMIC :GFP_KERNEL ; + buf =kzalloc (sizeof (*buf), gfp_flags); +if (!buf) +return ERR_PTR (-ENOMEM ); + buf->page_shift = page_shift; page_size =1 << buf->page_shift; - buf->npages =DIV_ROUND_UP (size, page_size); - -/* required size is not bigger than one trunk size */ -if (size <= max_direct) { - buf->page_list =NULL ; - buf->direct.buf =dma_alloc_coherent (dev, size, - &buf->direct.map, -GFP_KERNEL ); -if (!buf->direct.buf) -return -ENOMEM ; + +/* Calc the trunk size and num by required size and page_shift */ +if (flags &HNS_ROCE_BUF_DIRECT ) { + buf->trunk_shift =ilog2 (ALIGN (size,PAGE_SIZE )); + ntrunk =1 ; }else { - buf_list =kcalloc (buf->npages,sizeof (*buf_list),GFP_KERNEL ); -if (!buf_list) -return -ENOMEM ; - -for (i =0 ; i < buf->npages; i++) { - buf_list[i].buf =dma_alloc_coherent (dev, page_size, - &buf_list[i].map, -GFP_KERNEL ); -if (!buf_list[i].buf) -break ; - } + buf->trunk_shift =ilog2 (ALIGN (page_size,PAGE_SIZE )); + ntrunk =DIV_ROUND_UP (size,1 << buf->trunk_shift); + } -if (i != buf->npages && i >0 ) { -while (i-- >0 ) -dma_free_coherent (dev, page_size, - buf_list[i].buf, - buf_list[i].map); -kfree (buf_list); -return -ENOMEM ; - } - buf->page_list = buf_list; + trunks =kcalloc (ntrunk,sizeof (*trunks), gfp_flags); +if (!trunks) { +kfree (buf); +return ERR_PTR (-ENOMEM ); } - buf->size = size; -return 0 ; + trunk_size =1 << buf->trunk_shift; + alloced_size =0 ; +for (i =0 ; i < ntrunk; i++) { + trunks[i].buf =dma_alloc_coherent (hr_dev->dev, trunk_size, + &trunks[i].map, gfp_flags); +if (!trunks[i].buf) +break ; + + alloced_size += trunk_size; + } + + buf->ntrunks = i; + +/* In nofail mode, it's only failed when the alloced size is 0 */ +if ((flags &HNS_ROCE_BUF_NOFAIL ) ? i ==0 : i != ntrunk) { +for (i =0 ; i < buf->ntrunks; i++) +dma_free_coherent (hr_dev->dev, trunk_size, + trunks[i].buf, trunks[i].map); + +kfree (trunks); +kfree (buf); +return ERR_PTR (-ENOMEM ); + } + + buf->npages =DIV_ROUND_UP (alloced_size, page_size); + buf->trunk_list = trunks; + +return buf; } int hns_roce_get_kmem_bufs(struct hns_roce_dev *hr_dev, dma_addr_t *bufs,
drivers/infiniband/hw/hns/hns_roce_device.h +26 -25
83 lines not on this page · raw message
drivers/infiniband/hw/hns/hns_roce_mr.c +13 -26
@@ -694,15 +694,6 @@ static inline size_t mtr_bufs_size(struct hns_roce_buf_attr *attr)return size; } -static inline size_t mtr_kmem_direct_size (bool is_direct,size_t alloc_size, -unsigned int page_shift) -{ -if (is_direct) -return ALIGN (alloc_size,1 << page_shift); -else -return HNS_HW_DIRECT_PAGE_COUNT << page_shift; -} -/* * check the given pages in continuous address space * Returns 0 on success, or the error page num.
@@ -731,7 +722,6 @@ static void mtr_free_bufs(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr)/* release kernel buffers */ if (mtr->kmem) {hns_roce_buf_free (hr_dev, mtr->kmem); -kfree (mtr->kmem); mtr->kmem =NULL ; } }
@@ -743,13 +733,12 @@ static int mtr_alloc_bufs(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr,struct ib_device *ibdev = &hr_dev->ib_dev;unsigned int best_pg_shift;int all_pg_count =0 ; -size_t direct_size;size_t total_size;int ret; total_size =mtr_bufs_size (buf_attr);if (total_size <1 ) { -ibdev_err (ibdev,"Failed to check mtr size\n" ); +ibdev_err (ibdev,"failed to check mtr size\n." );return -EINVAL ; }
@@ -761,7 +750,7 @@ static int mtr_alloc_bufs(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr, mtr->umem =ib_umem_get (ibdev, user_addr, total_size, buf_attr->user_access);if (IS_ERR_OR_NULL (mtr->umem)) { -ibdev_err (ibdev,"Failed to get umem, ret %ld\n" , +ibdev_err (ibdev,"failed to get umem, ret = %ld.\n" ,PTR_ERR (mtr->umem));return -ENOMEM ; }
@@ -779,19 +768,16 @@ static int mtr_alloc_bufs(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr, ret =0 ; }else { mtr->umem =NULL ; - mtr->kmem =kzalloc (sizeof (*mtr->kmem),GFP_KERNEL ); -if (!mtr->kmem) { -ibdev_err (ibdev,"Failed to alloc kmem\n" ); -return -ENOMEM ; - } - direct_size =mtr_kmem_direct_size (is_direct, total_size, - buf_attr->page_shift); - ret =hns_roce_buf_alloc (hr_dev, total_size, direct_size, - mtr->kmem, buf_attr->page_shift); -if (ret) { -ibdev_err (ibdev,"Failed to alloc kmem, ret %d\n" , ret); - goto err_alloc_mem; + mtr->kmem = +hns_roce_buf_alloc (hr_dev, total_size, + buf_attr->page_shift, + is_direct ?HNS_ROCE_BUF_DIRECT :0 ); +if (IS_ERR (mtr->kmem)) { +ibdev_err (ibdev,"failed to alloc kmem, ret = %ld.\n" , +PTR_ERR (mtr->kmem)); +return PTR_ERR (mtr->kmem); } + best_pg_shift = buf_attr->page_shift; all_pg_count = mtr->kmem->npages; }
@@ -799,7 +785,8 @@ static int mtr_alloc_bufs(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr,/* must bigger than minimum hardware page shift */ if (best_pg_shift <HNS_HW_PAGE_SHIFT || all_pg_count <1 ) { ret = -EINVAL ; -ibdev_err (ibdev,"Failed to check mtr page shift %d count %d\n" , +ibdev_err (ibdev, +"failed to check mtr, page shift = %u count = %d.\n" , best_pg_shift, all_pg_count); goto err_alloc_mem; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 112/317 RDMA/hns: Create QP with selected QPN for bank load balance
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yangyang Li <[email protected]>
[ Upstream commit 71586dd2001087e89e344e2c7dcee6b4a53bb6de ]
In order to improve performance by balancing the load between different banks of cache, the QPC cache is desigend to choose one of 8 banks according to lower 3 bits of QPN. The hns driver needs to count the number of QP on each bank and then assigns the QP being created to the bank with the minimum load first.
Stable-dep-of: 203b70fda634 ("RDMA/hns: Fix return value in hns_roce_map_mr_sg")
--- drivers/infiniband/hw/hns/hns_roce_device.h | 15 ++- drivers/infiniband/hw/hns/hns_roce_qp.c | 100 ++++++++++++++++---- 2 files changed, 96 insertions(+), 19 deletions(-)
drivers/infiniband/hw/hns/hns_roce_device.h +13 -2
@@ -115,6 +115,8 @@#define HNS_ROCE_IDX_QUE_ENTRY_SZ 4#define SRQ_DB_REG 0x230 +#define HNS_ROCE_QP_BANK_NUM 8 +/* The chip implementation of the consumer index is calculated * according to twice the actual EQ depth */
@@ -520,13 +522,22 @@ struct hns_roce_uar_table {struct hns_roce_bitmap bitmap; }; +struct hns_roce_bank { +struct ida ida; +u32 inuse;/* Number of IDs allocated */ +u32 min;/* Lowest ID to allocate. */ +u32 max;/* Highest ID to allocate. */ +u32 next;/* Next ID to allocate. */ +}; +struct hns_roce_qp_table { -struct hns_roce_bitmap bitmap;struct hns_roce_hem_table qp_table;struct hns_roce_hem_table irrl_table;struct hns_roce_hem_table trrl_table;struct hns_roce_hem_table sccc_table;struct mutex scc_mutex; +struct hns_roce_bank bank[HNS_ROCE_QP_BANK_NUM ]; +spinlock_t bank_lock; };struct hns_roce_cq_table {
@@ -776,7 +787,7 @@ struct hns_roce_caps {u32 max_rq_sg;u32 max_extend_sg;int num_qps; -int reserved_qps; +u32 reserved_qps;int num_qpc_timer;int num_cqc_timer;int num_srqs;
drivers/infiniband/hw/hns/hns_roce_qp.c +83 -17
148 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 113/317 RDMA/hns: Fix incorrect symbol types
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenpeng Liang <[email protected]>
[ Upstream commit dcdc366acf8ffc29f091a09e08b4e46caa0a0f21 ]
Types of some fields, variables and parameters of some functions should be unsigned.
Stable-dep-of: 203b70fda634 ("RDMA/hns: Fix return value in hns_roce_map_mr_sg")
--- drivers/infiniband/hw/hns/hns_roce_cmd.c | 10 ++-- drivers/infiniband/hw/hns/hns_roce_cmd.h | 2 +- drivers/infiniband/hw/hns/hns_roce_common.h | 14 +++--- drivers/infiniband/hw/hns/hns_roce_db.c | 8 ++-- drivers/infiniband/hw/hns/hns_roce_device.h | 53 +++++++++++---------- drivers/infiniband/hw/hns/hns_roce_hw_v1.c | 8 ++-- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 30 ++++++------ drivers/infiniband/hw/hns/hns_roce_main.c | 2 +- drivers/infiniband/hw/hns/hns_roce_mr.c | 11 ++--- drivers/infiniband/hw/hns/hns_roce_qp.c | 8 ++-- 10 files changed, 73 insertions(+), 73 deletions(-)
drivers/infiniband/hw/hns/hns_roce_cmd.c +5 -5
@@ -60,7 +60,7 @@ static int hns_roce_cmd_mbox_post_hw(struct hns_roce_dev *hr_dev, u64 in_param,static int __hns_roce_cmd_mbox_poll (struct hns_roce_dev *hr_dev,u64 in_param,u64 out_param,unsigned long in_modifier,u8 op_modifier,u16 op, -unsigned long timeout) +unsigned int timeout) {struct device *dev = hr_dev->dev;int ret;
@@ -78,7 +78,7 @@ static int __hns_roce_cmd_mbox_poll(struct hns_roce_dev *hr_dev, u64 in_param,static int hns_roce_cmd_mbox_poll (struct hns_roce_dev *hr_dev,u64 in_param,u64 out_param,unsigned long in_modifier, -u8 op_modifier,u16 op,unsigned long timeout) +u8 op_modifier,u16 op,unsigned int timeout) {int ret;
@@ -108,7 +108,7 @@ void hns_roce_cmd_event(struct hns_roce_dev *hr_dev, u16 token, u8 status,static int __hns_roce_cmd_mbox_wait (struct hns_roce_dev *hr_dev,u64 in_param,u64 out_param,unsigned long in_modifier,u8 op_modifier,u16 op, -unsigned long timeout) +unsigned int timeout) {struct hns_roce_cmdq *cmd = &hr_dev->cmd;struct hns_roce_cmd_context *context;
@@ -159,7 +159,7 @@ static int __hns_roce_cmd_mbox_wait(struct hns_roce_dev *hr_dev, u64 in_param,static int hns_roce_cmd_mbox_wait (struct hns_roce_dev *hr_dev,u64 in_param,u64 out_param,unsigned long in_modifier, -u8 op_modifier,u16 op,unsigned long timeout) +u8 op_modifier,u16 op,unsigned int timeout) {int ret;
@@ -173,7 +173,7 @@ static int hns_roce_cmd_mbox_wait(struct hns_roce_dev *hr_dev, u64 in_param,int hns_roce_cmd_mbox (struct hns_roce_dev *hr_dev,u64 in_param,u64 out_param,unsigned long in_modifier,u8 op_modifier,u16 op, -unsigned long timeout) +unsigned int timeout) {int ret;
drivers/infiniband/hw/hns/hns_roce_cmd.h +1 -1
@@ -141,7 +141,7 @@ enum {int hns_roce_cmd_mbox (struct hns_roce_dev *hr_dev,u64 in_param,u64 out_param,unsigned long in_modifier,u8 op_modifier,u16 op, -unsigned long timeout); +unsigned int timeout);struct hns_roce_cmd_mailbox *hns_roce_alloc_cmd_mailbox (struct hns_roce_dev *hr_dev);
drivers/infiniband/hw/hns/hns_roce_common.h +7 -7
@@ -38,19 +38,19 @@#define roce_raw_write (value, addr) \ __raw_writel((__force u32)cpu_to_le32(value), (addr)) -#define roce_get_field (origin, mask, shift) \ - (((le32_to_cpu(origin)) & (mask)) >> (shift)) +#define roce_get_field (origin, mask, shift) \ + ((le32_to_cpu(origin) & (mask)) >> (u32)(shift))#define roce_get_bit (origin, shift) \ roce_get_field((origin), (1ul << (shift)), (shift)) -#define roce_set_field (origin, mask, shift, val) \ - do { \ - (origin) &= ~cpu_to_le32(mask); \ - (origin) |= cpu_to_le32(((u32)(val) << (shift)) & (mask)); \ +#define roce_set_field (origin, mask, shift, val) \ + do { \ + (origin) &= ~cpu_to_le32(mask); \ + (origin) |= cpu_to_le32(((u32)(val) << (u32)(shift)) & (mask)); \ } while (0) -#define roce_set_bit (origin, shift, val) \ +#define roce_set_bit (origin, shift, val) \ roce_set_field((origin), (1ul << (shift)), (shift), (val))#define ROCEE_GLB_CFG_ROCEE_DB_SQ_MODE_S 3
drivers/infiniband/hw/hns/hns_roce_db.c +4 -4
@@ -95,8 +95,8 @@ static struct hns_roce_db_pgdir *hns_roce_alloc_db_pgdir(static int hns_roce_alloc_db_from_pgdir (struct hns_roce_db_pgdir *pgdir,struct hns_roce_db *db,int order) { -int o; -int i; +unsigned long o; +unsigned long i;for (o = order; o <=1 ; ++o) { i =find_first_bit (pgdir->bits[o],HNS_ROCE_DB_PER_PAGE >> o);
@@ -154,8 +154,8 @@ int hns_roce_alloc_db(struct hns_roce_dev *hr_dev, struct hns_roce_db *db,void hns_roce_free_db (struct hns_roce_dev *hr_dev,struct hns_roce_db *db) { -int o; -int i; +unsigned long o; +unsigned long i;mutex_lock (&hr_dev->pgdir_mutex);
drivers/infiniband/hw/hns/hns_roce_device.h +27 -26
160 lines not on this page · raw message
drivers/infiniband/hw/hns/hns_roce_hw_v1.c +4 -4
@@ -288,7 +288,7 @@ static int hns_roce_v1_post_send(struct ib_qp *ibqp, ret = -EINVAL ; *bad_wr = wr;dev_err (dev,"inline len(1-%d)=%d, illegal" , - ctrl->msg_length, +le32_to_cpu (ctrl->msg_length), hr_dev->caps.max_sq_inline); goto out; }
@@ -1715,7 +1715,7 @@ static int hns_roce_v1_post_mbox(struct hns_roce_dev *hr_dev, u64 in_param, }static int hns_roce_v1_chk_mbox (struct hns_roce_dev *hr_dev, -unsigned long timeout) +unsigned int timeout) {u8 __iomem *hcr = hr_dev->reg_base +ROCEE_MB1_REG ;unsigned long end;
@@ -3674,10 +3674,10 @@ static int hns_roce_v1_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata)return 0 ; } -static void set_eq_cons_index_v1 (struct hns_roce_eq *eq,int req_not) +static void set_eq_cons_index_v1 (struct hns_roce_eq *eq,u32 req_not) {roce_raw_write ((eq->cons_index &HNS_ROCE_V1_CONS_IDX_M ) | - (req_not << eq->log_entries), eq->doorbell); + (req_not << eq->log_entries), eq->doorbell); } static void hns_roce_v1_wq_catas_err_handle(struct hns_roce_dev *hr_dev,
drivers/infiniband/hw/hns/hns_roce_hw_v2.c +15 -15
@@ -650,7 +650,7 @@ static int hns_roce_v2_post_send(struct ib_qp *ibqp,unsigned int sge_idx;unsigned int wqe_idx;void *wqe =NULL ; -int nreq; +u32 nreq;int ret;spin_lock_irqsave (&qp->sq.lock, flags);
@@ -828,7 +828,7 @@ static void *get_srq_wqe(struct hns_roce_srq *srq, int n)return hns_roce_buf_offset (srq->buf_mtr.kmem, n << srq->wqe_shift); } -static void *get_idx_buf (struct hns_roce_idx_que *idx_que,int n) +static void *get_idx_buf (struct hns_roce_idx_que *idx_que,unsigned int n) {return hns_roce_buf_offset (idx_que->mtr.kmem, n << idx_que->entry_shift);
@@ -869,12 +869,12 @@ static int hns_roce_v2_post_srq_recv(struct ib_srq *ibsrq,struct hns_roce_v2_wqe_data_seg *dseg;struct hns_roce_v2_db srq_db;unsigned long flags; +unsigned int ind;__le32 *srq_idx;int ret =0 ;int wqe_idx;void *wqe;int nreq; -int ind;int i;spin_lock_irqsave (&srq->lock, flags);
@@ -1128,7 +1128,7 @@ static void hns_roce_cmq_init_regs(struct hns_roce_dev *hr_dev, bool ring_type)roce_write (hr_dev,ROCEE_TX_CMQ_BASEADDR_H_REG ,upper_32_bits (dma));roce_write (hr_dev,ROCEE_TX_CMQ_DEPTH_REG , - ring->desc_num >>HNS_ROCE_CMQ_DESC_NUM_S ); + (u32 )ring->desc_num >>HNS_ROCE_CMQ_DESC_NUM_S );roce_write (hr_dev,ROCEE_TX_CMQ_HEAD_REG ,0 );roce_write (hr_dev,ROCEE_TX_CMQ_TAIL_REG ,0 ); }else {
@@ -1136,7 +1136,7 @@ static void hns_roce_cmq_init_regs(struct hns_roce_dev *hr_dev, bool ring_type)roce_write (hr_dev,ROCEE_RX_CMQ_BASEADDR_H_REG ,upper_32_bits (dma));roce_write (hr_dev,ROCEE_RX_CMQ_DEPTH_REG , - ring->desc_num >>HNS_ROCE_CMQ_DESC_NUM_S ); + (u32 )ring->desc_num >>HNS_ROCE_CMQ_DESC_NUM_S );roce_write (hr_dev,ROCEE_RX_CMQ_HEAD_REG ,0 );roce_write (hr_dev,ROCEE_RX_CMQ_TAIL_REG ,0 ); }
@@ -1907,8 +1907,8 @@ static void set_default_caps(struct hns_roce_dev *hr_dev) } } -static void calc_pg_sz (int obj_num,int obj_size,int hop_num,int ctx_bt_num, -int *buf_page_size,int *bt_page_size,u32 hem_type) +static void calc_pg_sz (u32 obj_num,u32 obj_size,u32 hop_num,u32 ctx_bt_num, +u32 *buf_page_size,u32 *bt_page_size,u32 hem_type) {u64 obj_per_chunk;u64 bt_chunk_size =PAGE_SIZE ;
@@ -2382,10 +2382,10 @@ static int hns_roce_init_link_table(struct hns_roce_dev *hr_dev,u32 buf_chk_sz;dma_addr_t t;int func_num =1 ; -int pg_num_a; -int pg_num_b; -int pg_num; -int size; +u32 pg_num_a; +u32 pg_num_b; +u32 pg_num; +u32 size;int i;switch (type) {
@@ -2549,7 +2549,7 @@ static int hns_roce_query_mbox_status(struct hns_roce_dev *hr_dev)struct hns_roce_cmq_desc desc;struct hns_roce_mbox_status *mb_st = (struct hns_roce_mbox_status *)desc.data; -enum hns_roce_cmd_return_status status; +int status;hns_roce_cmq_setup_basic_desc (&desc,HNS_ROCE_OPC_QUERY_MB_ST , true);
@@ -2620,7 +2620,7 @@ static int hns_roce_v2_post_mbox(struct hns_roce_dev *hr_dev, u64 in_param, }static int hns_roce_v2_chk_mbox (struct hns_roce_dev *hr_dev, -unsigned long timeout) +unsigned int timeout) {struct device *dev = hr_dev->dev;unsigned long end;
@@ -2970,7 +2970,7 @@ static void *get_cqe_v2(struct hns_roce_cq *hr_cq, int n)return hns_roce_buf_offset (hr_cq->mtr.kmem, n * hr_cq->cqe_size); } -static void *get_sw_cqe_v2 (struct hns_roce_cq *hr_cq,int n) +static void *get_sw_cqe_v2 (struct hns_roce_cq *hr_cq,unsigned int n) {struct hns_roce_v2_cqe *cqe =get_cqe_v2 (hr_cq, n & hr_cq->ib_cq.cqe);
@@ -3314,7 +3314,7 @@ static int hns_roce_v2_poll_one(struct hns_roce_cq *hr_cq,int is_send;u16 wqe_ctr;u32 opcode; -int qpn; +u32 qpn;int ret;/* Find cqe according to consumer index */
drivers/infiniband/hw/hns/hns_roce_main.c +1 -1
@@ -53,7 +53,7 @@* GID[0][0], GID[1][0],.....GID[N - 1][0], * And so on */ -int hns_get_gid_index (struct hns_roce_dev *hr_dev,u8 port,int gid_index) +u8 hns_get_gid_index (struct hns_roce_dev *hr_dev,u8 port,int gid_index) {return gid_index * hr_dev->caps.num_ports + port; }
drivers/infiniband/hw/hns/hns_roce_mr.c +5 -6
@@ -508,7 +508,7 @@ int hns_roce_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg, int sg_nents,ibdev_err (ibdev,"failed to map sg mtr, ret = %d.\n" , ret); ret =0 ; }else { - mr->pbl_mtr.hem_cfg.buf_pg_shift =ilog2 (ibmr->page_size); + mr->pbl_mtr.hem_cfg.buf_pg_shift = (u32 )ilog2 (ibmr->page_size); ret = mr->npages; }
@@ -827,12 +827,12 @@ static int mtr_get_pages(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr, }int hns_roce_mtr_map (struct hns_roce_dev *hr_dev,struct hns_roce_mtr *mtr, -dma_addr_t *pages,int page_cnt) +dma_addr_t *pages,unsigned int page_cnt) {struct ib_device *ibdev = &hr_dev->ib_dev;struct hns_roce_buf_region *r; +unsigned int i;int err; -int i;/* * Only use the first page address as root ba when hopnum is 0, this
@@ -869,13 +869,12 @@ int hns_roce_mtr_find(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr, int offset, u64 *mtt_buf, int mtt_max, u64 *base_addr) { struct hns_roce_hem_cfg *cfg = &mtr->hem_cfg; +int mtt_count, left;int start_index; -int mtt_count;int total =0 ;__le64 *mtts; -int npage; +u32 npage;u64 addr; -int left;if (!mtt_buf || mtt_max <1 ) goto done;
drivers/infiniband/hw/hns/hns_roce_qp.c +4 -4
@@ -1318,22 +1318,22 @@ static inline void *get_wqe(struct hns_roce_qp *hr_qp, int offset)return hns_roce_buf_offset (hr_qp->mtr.kmem, offset); } -void *hns_roce_get_recv_wqe (struct hns_roce_qp *hr_qp,int n) +void *hns_roce_get_recv_wqe (struct hns_roce_qp *hr_qp,unsigned int n) {return get_wqe (hr_qp, hr_qp->rq.offset + (n << hr_qp->rq.wqe_shift)); } -void *hns_roce_get_send_wqe (struct hns_roce_qp *hr_qp,int n) +void *hns_roce_get_send_wqe (struct hns_roce_qp *hr_qp,unsigned int n) {return get_wqe (hr_qp, hr_qp->sq.offset + (n << hr_qp->sq.wqe_shift)); } -void *hns_roce_get_extend_sge (struct hns_roce_qp *hr_qp,int n) +void *hns_roce_get_extend_sge (struct hns_roce_qp *hr_qp,unsigned int n) {return get_wqe (hr_qp, hr_qp->sge.offset + (n << hr_qp->sge.sge_shift)); } -bool hns_roce_wq_overflow (struct hns_roce_wq *hr_wq,int nreq, +bool hns_roce_wq_overflow (struct hns_roce_wq *hr_wq,u32 nreq,struct ib_cq *ib_cq) {struct hns_roce_cq *hr_cq;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 114/317 RDMA/hns: Fix return value in hns_roce_map_mr_sg
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhengchao Shao <[email protected]>
[ Upstream commit 203b70fda63425a4eb29f03f9074859afe821a39 ]
As described in the ib_map_mr_sg function comment, it returns the number of sg elements that were mapped to the memory region. However, hns_roce_map_mr_sg returns the number of pages required for mapping the DMA area. Fix it.
--- drivers/infiniband/hw/hns/hns_roce_mr.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-)
drivers/infiniband/hw/hns/hns_roce_mr.c +7 -8
@@ -484,18 +484,18 @@ int hns_roce_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg, int sg_nents,struct ib_device *ibdev = &hr_dev->ib_dev;struct hns_roce_mr *mr =to_hr_mr (ibmr);struct hns_roce_mtr *mtr = &mr->pbl_mtr; -int ret =0 ; +int ret, sg_num =0 ; mr->npages =0 ; mr->page_list =kvcalloc (mr->pbl_mtr.hem_cfg.buf_pg_count,sizeof (dma_addr_t),GFP_KERNEL );if (!mr->page_list) -return ret; +return sg_num; - ret =ib_sg_to_pages (ibmr, sg, sg_nents, sg_offset, hns_roce_set_page); -if (ret <1 ) { + sg_num =ib_sg_to_pages (ibmr, sg, sg_nents, sg_offset, hns_roce_set_page); +if (sg_num <1 ) {ibdev_err (ibdev,"failed to store sg pages %u %u, cnt = %d.\n" , - mr->npages, mr->pbl_mtr.hem_cfg.buf_pg_count, ret); + mr->npages, mr->pbl_mtr.hem_cfg.buf_pg_count, sg_num); goto err_page_list; }
@@ -506,17 +506,16 @@ int hns_roce_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg, int sg_nents, ret =hns_roce_mtr_map (hr_dev, mtr, mr->page_list, mr->npages);if (ret) {ibdev_err (ibdev,"failed to map sg mtr, ret = %d.\n" , ret); - ret =0 ; + sg_num =0 ; }else { mr->pbl_mtr.hem_cfg.buf_pg_shift = (u32 )ilog2 (ibmr->page_size); - ret = mr->npages; } err_page_list:kvfree (mr->page_list); mr->page_list =NULL ; -return ret; +return sg_num; } static void hns_roce_mw_free(struct hns_roce_dev *hr_dev,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 115/317 RDMA/hns: Use complete parentheses in macros
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengchang Tang <[email protected]>
[ Upstream commit 4125269bb9b22e1d8cdf4412c81be8074dbc61ca ]
Use complete parentheses to ensure that macro expansion does not produce unexpected results.
--- drivers/infiniband/hw/hns/hns_roce_hem.h | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/infiniband/hw/hns/hns_roce_hem.h +6 -6
@@ -60,16 +60,16 @@ enum { (sizeof(struct scatterlist) + sizeof(void *)))#define check_whether_bt_num_3 (type, hop_num) \ - (type < HEM_TYPE_MTT && hop_num == 2) + ((type) < HEM_TYPE_MTT && (hop_num) == 2)#define check_whether_bt_num_2 (type, hop_num) \ - ((type < HEM_TYPE_MTT && hop_num == 1) || \ - (type >= HEM_TYPE_MTT && hop_num == 2)) + (((type) < HEM_TYPE_MTT && (hop_num) == 1) || \ + ((type) >= HEM_TYPE_MTT && (hop_num) == 2))#define check_whether_bt_num_1 (type, hop_num) \ - ((type < HEM_TYPE_MTT && hop_num == HNS_ROCE_HOP_NUM_0) || \ - (type >= HEM_TYPE_MTT && hop_num == 1) || \ - (type >= HEM_TYPE_MTT && hop_num == HNS_ROCE_HOP_NUM_0)) + (((type) < HEM_TYPE_MTT && (hop_num) == HNS_ROCE_HOP_NUM_0) || \ + ((type) >= HEM_TYPE_MTT && (hop_num) == 1) || \ + ((type) >= HEM_TYPE_MTT && (hop_num) == HNS_ROCE_HOP_NUM_0))struct hns_roce_hem_chunk {struct list_head list;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 116/317 RDMA/hns: Modify the print level of CQE error
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengchang Tang <[email protected]>
[ Upstream commit 349e859952285ab9689779fb46de163f13f18f43 ]
Too much print may lead to a panic in kernel. Change ibdev_err() to ibdev_err_ratelimited(), and change the printing level of cqe dump to debug level.
--- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/infiniband/hw/hns/hns_roce_hw_v2.c +3 -2
@@ -3278,8 +3278,9 @@ static void get_cqe_status(struct hns_roce_dev *hr_dev, struct hns_roce_qp *qp, wc->status == IB_WC_WR_FLUSH_ERR))return ; -ibdev_err (&hr_dev->ib_dev,"error cqe status 0x%x:\n" , cqe_status); -print_hex_dump (KERN_ERR ,"" ,DUMP_PREFIX_NONE ,16 ,4 , cqe, +ibdev_err_ratelimited (&hr_dev->ib_dev,"error cqe status 0x%x:\n" , + cqe_status); +print_hex_dump (KERN_DEBUG ,"" ,DUMP_PREFIX_NONE ,16 ,4 , cqe, cq->cqe_size, false);/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 117/317 clk: qcom: mmcc-msm8998: fix venus clock issue
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Gonzalez <[email protected]>
[ Upstream commit e20ae5ae9f0c843aded4f06f3d1cab7384789e92 ]
Right now, msm8998 video decoder (venus) is non-functional:
$ time mpv --hwdec=v4l2m2m-copy --vd-lavc-software-fallback=no --vo=null --no-audio --untimed --length=30 --quiet demo-480.webm
(+) Video --vid=1 (*) (vp9 854x480 29.970fps)
Audio --aid=1 --alang=eng (*) (opus 2ch 48000Hz)
[ffmpeg/video] vp9_v4l2m2m: output VIDIOC_REQBUFS failed: Connection timed out
[ffmpeg/video] vp9_v4l2m2m: no v4l2 output context's buffers
[ffmpeg/video] vp9_v4l2m2m: can't configure decoder
Could not open codec.
Software decoding fallback is disabled.
Exiting... (Quit)Bryan O'Donoghue suggested the proper fix:
- Set required register offsets in venus GDSC structs.
- Set HW_CTRL flag.
$ time mpv --hwdec=v4l2m2m-copy --vd-lavc-software-fallback=no --vo=null --no-audio --untimed --length=30 --quiet demo-480.webm
(+) Video --vid=1 (*) (vp9 854x480 29.970fps)
Audio --aid=1 --alang=eng (*) (opus 2ch 48000Hz)
[ffmpeg/video] vp9_v4l2m2m: VIDIOC_G_FMT ioctl
[ffmpeg/video] vp9_v4l2m2m: VIDIOC_G_FMT ioctl
...
Using hardware decoding (v4l2m2m-copy).
VO: [null] 854x480 nv12
Exiting... (End of file)
real 0m3.315s
user 0m1.277s
sys 0m0.453sNOTES:
GDSC = Globally Distributed Switch Controller
Use same code as mmcc-msm8996 with:
s/venus_gdsc/video_top_gdsc/
s/venus_core0_gdsc/video_subcore0_gdsc/
s/venus_core1_gdsc/video_subcore1_gdsc/
https://git.codelinaro.org/clo/la/kernel/msm-4.4/-/blob/caf_migration/kernel.lnx.4.4.r38-rel/include/dt-bindings/clock/msm-clocks-hwio-8996.h
https://git.codelinaro.org/clo/la/kernel/msm-4.4/-/blob/caf_migration/kernel.lnx.4.4.r38-rel/include/dt-bindings/clock/msm-clocks-hwio-8998.h
0x1024 = MMSS_VIDEO GDSCR (undocumented)0x1028 = MMSS_VIDEO_CORE_CBCR0x1030 = MMSS_VIDEO_AHB_CBCR0x1034 = MMSS_VIDEO_AXI_CBCR0x1038 = MMSS_VIDEO_MAXI_CBCR0x1040 = MMSS_VIDEO_SUBCORE0 GDSCR (undocumented)0x1044 = MMSS_VIDEO_SUBCORE1 GDSCR (undocumented)0x1048 = MMSS_VIDEO_SUBCORE0_CBCR0x104c = MMSS_VIDEO_SUBCORE1_CBCR
--- drivers/clk/qcom/mmcc-msm8998.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/clk/qcom/mmcc-msm8998.c +8 -0
@@ -2587,6 +2587,8 @@ static struct clk_hw *mmcc_msm8998_hws[] = {static struct gdsc video_top_gdsc = { .gdscr =0x1024 , + .cxcs = (unsigned int []){0x1028 ,0x1034 ,0x1038 }, + .cxc_count =3 , .pd = { .name ="video_top" , },
@@ -2595,20 +2597,26 @@ static struct gdsc video_top_gdsc = {static struct gdsc video_subcore0_gdsc = { .gdscr =0x1040 , + .cxcs = (unsigned int []){0x1048 }, + .cxc_count =1 , .pd = { .name ="video_subcore0" , }, .parent = &video_top_gdsc.pd, .pwrsts =PWRSTS_OFF_ON , + .flags =HW_CTRL , };static struct gdsc video_subcore1_gdsc = { .gdscr =0x1044 , + .cxcs = (unsigned int []){0x104c }, + .cxc_count =1 , .pd = { .name ="video_subcore1" , }, .parent = &video_top_gdsc.pd, .pwrsts =PWRSTS_OFF_ON , + .flags =HW_CTRL , };static struct gdsc mdss_gdsc = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 118/317 x86/insn: Fix PUSH instruction in x86 instruction decoder opcode map
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
[ Upstream commit 59162e0c11d7257cde15f907d19fefe26da66692 ]
The x86 instruction decoder is used not only for decoding kernel instructions. It is also used by perf uprobes (user space probes) and by perf tools Intel Processor Trace decoding. Consequently, it needs to support instructions executed by user space also.
Opcode 0x68 PUSH instruction is currently defined as 64-bit operand size only i.e. (d64). That was based on Intel SDM Opcode Map. However that is contradicted by the Instruction Set Reference section for PUSH in the same manual.
Remove 64-bit operand size only annotation from opcode 0x68 PUSH instruction.
Example:
$ cat pushw.s
.global _start
.text
_start:
pushw $0x1234
mov $0x1,%eax # system call number (sys_exit)
int $0x80
$ as -o pushw.o pushw.s
$ ld -s -o pushw pushw.o
$ objdump -d pushw | tail -4
0000000000401000 <.text>:
401000: 66 68 34 12 pushw $0x1234
401004: b8 01 00 00 00 mov $0x1,%eax
401009: cd 80 int $0x80
$ perf record -e intel_pt//u ./pushw
[ perf record: Woken up 1 times to write data ]
[ perf record: Captured and wrote 0.014 MB perf.data ]Before:
$ perf script --insn-trace=disasm
Warning:
1 instruction trace errors
pushw 10349 [000] 10586.869237014: 401000 [unknown] (/home/ahunter/git/misc/rtit-tests/pushw) pushw $0x1234
pushw 10349 [000] 10586.869237014: 401006 [unknown] (/home/ahunter/git/misc/rtit-tests/pushw) addb %al, (%rax)
pushw 10349 [000] 10586.869237014: 401008 [unknown] (/home/ahunter/git/misc/rtit-tests/pushw) addb %cl, %ch
pushw 10349 [000] 10586.869237014: 40100a [unknown] (/home/ahunter/git/misc/rtit-tests/pushw) addb $0x2e, (%rax)
instruction trace error type 1 time 10586.869237224 cpu 0 pid 10349 tid 10349 ip 0x40100d code 6: Trace doesn't match instructionAfter:
$ perf script --insn-trace=disasm
pushw 10349 [000] 10586.869237014: 401000 [unknown] (./pushw) pushw $0x1234
pushw 10349 [000] 10586.869237014: 401004 [unknown] (./pushw) movl $1, %eax--- arch/x86/lib/x86-opcode-map.txt | 2 +- tools/arch/x86/lib/x86-opcode-map.txt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
arch/x86/lib/x86-opcode-map.txt +1 -1
@@ -148,7 +148,7 @@ AVXcode: 65: SEG=GS (Prefix) 66: Operand-Size (Prefix) 67: Address-Size (Prefix) -68: PUSH Iz (d64) +68: PUSH Iz 69: IMUL Gv,Ev,Iz 6a: PUSH Ib (d64) 6b: IMUL Gv,Ev,Ib
tools/arch/x86/lib/x86-opcode-map.txt +1 -1
@@ -148,7 +148,7 @@ AVXcode: 65: SEG=GS (Prefix) 66: Operand-Size (Prefix) 67: Address-Size (Prefix) -68: PUSH Iz (d64) +68: PUSH Iz 69: IMUL Gv,Ev,Iz 6a: PUSH Ib (d64) 6b: IMUL Gv,Ev,Ib
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 119/317 ext4: avoid excessive credit estimate in ext4_tmpfile()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
[ Upstream commit 35a1f12f0ca857fee1d7a04ef52cbd5f1f84de13 ]
A user with minimum journal size (1024 blocks these days) complained about the following error triggered by generic/697 test in ext4_tmpfile():
run fstests generic/697 at 2024-02-28 05:34:46
JBD2: vfstest wants too many credits credits:260 rsv_credits:0 max:256 EXT4-fs error (device loop0) in __ext4_new_inode:1083: error 28
Indeed the credit estimate in ext4_tmpfile() is huge. EXT4_MAXQUOTAS_INIT_BLOCKS() is 219, then 10 credits from ext4_tmpfile() itself and then ext4_xattr_credits_for_new_inode() adds more credits needed for security attributes and ACLs. Now the EXT4_MAXQUOTAS_INIT_BLOCKS() is in fact unnecessary because we've already initialized quotas with dquot_init() shortly before and so EXT4_MAXQUOTAS_TRANS_BLOCKS() is enough (which boils down to 3 credits).
--- fs/ext4/namei.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ext4/namei.c +1 -1
@@ -2748,7 +2748,7 @@ static int ext4_tmpfile(struct inode *dir, struct dentry *dentry, umode_t mode) inode =ext4_new_inode_start_handle (dir, mode,NULL ,0 ,NULL ,EXT4_HT_DIR , -EXT4_MAXQUOTAS_INIT_BLOCKS (dir->i_sb) + +EXT4_MAXQUOTAS_TRANS_BLOCKS (dir->i_sb) +4 +EXT4_XATTR_TRANS_BLOCKS ); handle =ext4_journal_current_handle (); err =PTR_ERR (inode);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 120/317 sunrpc: removed redundant procp check
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Aprelkov <[email protected]>
[ Upstream commit a576f36971ab4097b6aa76433532aa1fb5ee2d3b ]
since vs_proc pointer is dereferenced before getting it's address there's no need to check for NULL.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- net/sunrpc/svc.c | 2 -- 1 file changed, 2 deletions(-)
net/sunrpc/svc.c +0 -2
@@ -1248,8 +1248,6 @@ svc_generic_init_request(struct svc_rqst *rqstp,if (rqstp->rq_proc >= versp->vs_nproc) goto err_bad_proc; rqstp->rq_procinfo = procp = &versp->vs_proc[rqstp->rq_proc]; -if (!procp) - goto err_bad_proc;/* Initialize storage for argp and resp */ memset (rqstp->rq_argp,0 , procp->pc_argsize);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 121/317 ext4: simplify calculation of blkoff in ext4_mb_new_blocks_simple
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kemeng Shi <[email protected]>
[ Upstream commit 253cacb0de89235673ad5889d61f275a73dbee79 ]
We try to allocate a block from goal in ext4_mb_new_blocks_simple. We only need get blkoff in first group with goal and set blkoff to 0 for the rest groups.
Stable-dep-of: 3f4830abd236 ("ext4: fix potential unnitialized variable")
--- fs/ext4/mballoc.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
fs/ext4/mballoc.c +2 -3
@@ -5371,9 +5371,6 @@ static ext4_fsblk_t ext4_mb_new_blocks_simple(handle_t *handle,return 0 ; } -ext4_get_group_no_and_offset (sb, -max (ext4_group_first_block_no (sb, group), goal), -NULL , &blkoff);while (1 ) { i =mb_find_next_zero_bit (bitmap_bh->b_data, max, blkoff);
@@ -5388,6 +5385,8 @@ static ext4_fsblk_t ext4_mb_new_blocks_simple(handle_t *handle,brelse (bitmap_bh);if (i < max)break ; + + blkoff =0 ; }if (group >=ext4_get_groups_count (sb) || i >= max) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 122/317 ext4: fix unit mismatch in ext4_mb_new_blocks_simple
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kemeng Shi <[email protected]>
[ Upstream commit 497885f72d930305d8e61b6b616b22b4da1adf90 ]
The "i" returned from mb_find_next_zero_bit is in cluster unit and we need offset "block" corresponding to "i" in block unit. Convert "i" to block unit to fix the unit mismatch.
Stable-dep-of: 3f4830abd236 ("ext4: fix potential unnitialized variable")
--- fs/ext4/mballoc.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
fs/ext4/mballoc.c +4 -2
@@ -5349,6 +5349,7 @@ static ext4_fsblk_t ext4_mb_new_blocks_simple(handle_t *handle, {struct buffer_head *bitmap_bh;struct super_block *sb = ar->inode->i_sb; +struct ext4_sb_info *sbi =EXT4_SB (sb);ext4_group_t group;ext4_grpblk_t blkoff;ext4_grpblk_t max =EXT4_CLUSTERS_PER_GROUP (sb);
@@ -5377,7 +5378,8 @@ static ext4_fsblk_t ext4_mb_new_blocks_simple(handle_t *handle,if (i >= max)break ;if (ext4_fc_replay_check_excluded (sb, -ext4_group_first_block_no (sb, group) + i)) { +ext4_group_first_block_no (sb, group) + +EXT4_C2B (sbi, i))) { blkoff = i +1 ; }else break ;
@@ -5394,7 +5396,7 @@ static ext4_fsblk_t ext4_mb_new_blocks_simple(handle_t *handle,return 0 ; } - block =ext4_group_first_block_no (sb, group) + i; + block =ext4_group_first_block_no (sb, group) +EXT4_C2B (sbi, i);ext4_mb_mark_bb (sb, block,1 ,1 ); ar->len =1 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 123/317 ext4: try all groups in ext4_mb_new_blocks_simple
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kemeng Shi <[email protected]>
[ Upstream commit 19a043bb1fd1b5cb2652ca33536c55e6c0a70df0 ]
ext4_mb_new_blocks_simple ignores the group before goal, so it will fail if free blocks reside in group before goal. Try all groups to avoid unexpected failure.
Search finishes either if any free block is found or if no available blocks are found. Simpliy check "i >= max" to distinguish the above cases.
Stable-dep-of: 3f4830abd236 ("ext4: fix potential unnitialized variable")
--- fs/ext4/mballoc.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
fs/ext4/mballoc.c +6 -3
@@ -5350,7 +5350,7 @@ static ext4_fsblk_t ext4_mb_new_blocks_simple(handle_t *handle,struct buffer_head *bitmap_bh;struct super_block *sb = ar->inode->i_sb;struct ext4_sb_info *sbi =EXT4_SB (sb); -ext4_group_t group; +ext4_group_t group, nr;ext4_grpblk_t blkoff;ext4_grpblk_t max =EXT4_CLUSTERS_PER_GROUP (sb);ext4_grpblk_t i =0 ;
@@ -5364,7 +5364,7 @@ static ext4_fsblk_t ext4_mb_new_blocks_simple(handle_t *handle, ar->len =0 ;ext4_get_group_no_and_offset (sb, goal, &group, &blkoff); -for (; group <ext4_get_groups_count (sb); group++) { +for (nr =ext4_get_groups_count (sb); nr >0 ; nr--) { bitmap_bh =ext4_read_block_bitmap (sb, group);if (IS_ERR (bitmap_bh)) { *errp =PTR_ERR (bitmap_bh);
@@ -5388,10 +5388,13 @@ static ext4_fsblk_t ext4_mb_new_blocks_simple(handle_t *handle,if (i < max)break ; +if (++group >=ext4_get_groups_count (sb)) + group =0 ; + blkoff =0 ; } -if (group >=ext4_get_groups_count (sb) || i >= max) { +if (i >= max) { *errp = -ENOSPC ;return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 124/317 ext4: remove unused parameter from ext4_mb_new_blocks_simple()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kemeng Shi <[email protected]>
[ Upstream commit ad78b5efe4246e5deba8d44a6ed172b8a00d3113 ]
Two cleanups for ext4_mb_new_blocks_simple:
Remove unused parameter handle of ext4_mb_new_blocks_simple. Move ext4_mb_new_blocks_simple definition before ext4_mb_new_blocks to remove unnecessary forward declaration of ext4_mb_new_blocks_simple.
Stable-dep-of: 3f4830abd236 ("ext4: fix potential unnitialized variable")
--- fs/ext4/mballoc.c | 137 +++++++++++++++++++++++----------------------- 1 file changed, 67 insertions(+), 70 deletions(-)
fs/ext4/mballoc.c +67 -70
@@ -5083,8 +5083,72 @@ static bool ext4_mb_discard_preallocations_should_retry(struct super_block *sb,return ret; } -static ext4_fsblk_t ext4_mb_new_blocks_simple (handle_t *handle, -struct ext4_allocation_request *ar,int *errp); +/* +* Simple allocator for Ext4 fast commit replay path. It searches for blocks +* linearly starting at the goal block and also excludes the blocks which +* are going to be in use after fast commit replay. +*/ +static ext4_fsblk_t +ext4_mb_new_blocks_simple (struct ext4_allocation_request *ar,int *errp) +{ +struct buffer_head *bitmap_bh; +struct super_block *sb = ar->inode->i_sb; +struct ext4_sb_info *sbi =EXT4_SB (sb); +ext4_group_t group, nr; +ext4_grpblk_t blkoff; +ext4_grpblk_t max =EXT4_CLUSTERS_PER_GROUP (sb); +ext4_grpblk_t i =0 ; +ext4_fsblk_t goal, block; +struct ext4_super_block *es =EXT4_SB (sb)->s_es; + + goal = ar->goal; +if (goal <le32_to_cpu (es->s_first_data_block) || + goal >=ext4_blocks_count (es)) + goal =le32_to_cpu (es->s_first_data_block); + + ar->len =0 ; +ext4_get_group_no_and_offset (sb, goal, &group, &blkoff); +for (nr =ext4_get_groups_count (sb); nr >0 ; nr--) { + bitmap_bh =ext4_read_block_bitmap (sb, group); +if (IS_ERR (bitmap_bh)) { + *errp =PTR_ERR (bitmap_bh); +pr_warn ("Failed to read block bitmap\n" ); +return 0 ; + } + +while (1 ) { + i =mb_find_next_zero_bit (bitmap_bh->b_data, max, + blkoff); +if (i >= max) +break ; +if (ext4_fc_replay_check_excluded (sb, +ext4_group_first_block_no (sb, group) + +EXT4_C2B (sbi, i))) { + blkoff = i +1 ; + }else +break ; + } +brelse (bitmap_bh); +if (i < max) +break ; + +if (++group >=ext4_get_groups_count (sb)) + group =0 ; + + blkoff =0 ; + } + +if (i >= max) { + *errp = -ENOSPC ; +return 0 ; + } + + block =ext4_group_first_block_no (sb, group) +EXT4_C2B (sbi, i); +ext4_mb_mark_bb (sb, block,1 ,1 ); + ar->len =1 ; + +return block; +}/* * Main entry point into mballoc to allocate blocks
@@ -5109,7 +5173,7 @@ ext4_fsblk_t ext4_mb_new_blocks(handle_t *handle,trace_ext4_request_blocks (ar);if (sbi->s_mount_state &EXT4_FC_REPLAY ) -return ext4_mb_new_blocks_simple (handle, ar, errp); +return ext4_mb_new_blocks_simple (ar, errp);/* Allow to use superuser reservation for quota file */ if (ext4_is_quota_file (ar->inode))
@@ -5339,73 +5403,6 @@ ext4_mb_free_metadata(handle_t *handle, struct ext4_buddy *e4b,return 0 ; } -/* -* Simple allocator for Ext4 fast commit replay path. It searches for blocks -* linearly starting at the goal block and also excludes the blocks which -* are going to be in use after fast commit replay. -*/ -static ext4_fsblk_t ext4_mb_new_blocks_simple (handle_t *handle, -struct ext4_allocation_request *ar,int *errp) -{ -struct buffer_head *bitmap_bh; -struct super_block *sb = ar->inode->i_sb; -struct ext4_sb_info *sbi =EXT4_SB (sb); -ext4_group_t group, nr; -ext4_grpblk_t blkoff; -ext4_grpblk_t max =EXT4_CLUSTERS_PER_GROUP (sb); -ext4_grpblk_t i =0 ; -ext4_fsblk_t goal, block; -struct ext4_super_block *es =EXT4_SB (sb)->s_es; - - goal = ar->goal; -if (goal <le32_to_cpu (es->s_first_data_block) || - goal >=ext4_blocks_count (es)) - goal =le32_to_cpu (es->s_first_data_block); - - ar->len =0 ; -ext4_get_group_no_and_offset (sb, goal, &group, &blkoff); -for (nr =ext4_get_groups_count (sb); nr >0 ; nr--) { - bitmap_bh =ext4_read_block_bitmap (sb, group); -if (IS_ERR (bitmap_bh)) { - *errp =PTR_ERR (bitmap_bh); -pr_warn ("Failed to read block bitmap\n" ); -return 0 ; - } - -while (1 ) { - i =mb_find_next_zero_bit (bitmap_bh->b_data, max, - blkoff); -if (i >= max) -break ; -if (ext4_fc_replay_check_excluded (sb, -ext4_group_first_block_no (sb, group) + -EXT4_C2B (sbi, i))) { - blkoff = i +1 ; - }else -break ; - } -brelse (bitmap_bh); -if (i < max) -break ; - -if (++group >=ext4_get_groups_count (sb)) - group =0 ; - - blkoff =0 ; - } - -if (i >= max) { - *errp = -ENOSPC ; -return 0 ; - } - - block =ext4_group_first_block_no (sb, group) +EXT4_C2B (sbi, i); -ext4_mb_mark_bb (sb, block,1 ,1 ); - ar->len =1 ; - -return block; -} -static void ext4_free_blocks_simple (struct inode *inode,ext4_fsblk_t block,unsigned long count) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 125/317 ext4: fix potential unnitialized variable
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 3f4830abd236d0428e50451e1ecb62e14c365e9b ]
Smatch complains "err" can be uninitialized in the caller.
fs/ext4/indirect.c:349 ext4_alloc_branch()
error: uninitialized symbol 'err'.
Set the error to zero on the success path.
--- fs/ext4/mballoc.c | 1 + 1 file changed, 1 insertion(+)
fs/ext4/mballoc.c +1 -0
@@ -5147,6 +5147,7 @@ ext4_mb_new_blocks_simple(struct ext4_allocation_request *ar, int *errp)ext4_mb_mark_bb (sb, block,1 ,1 ); ar->len =1 ; + *errp =0 ;return block; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 126/317 SUNRPC: Fix gss_free_in_token_pages()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit bafa6b4d95d97877baa61883ff90f7e374427fae ]
Dan Carpenter says:
Quoted 19 lines
Commit
5866efa8cbfb("SUNRPC: Fixsvcauth_gss_proxy_init()") from Oct 24, 2019 (linux-next), leads to the following Smatch static checker warning:net/sunrpc/auth_gss/svcauth_gss.c:1039 gss_free_in_token_pages() warn: iterator 'i' not incremented
net/sunrpc/auth_gss/svcauth_gss.c1034 static void gss_free_in_token_pages(struct gssp_in_token *in_token) 1035 { 1036 u32 inlen; 1037 int i; 1038 --> 1039 i = 0; 1040 inlen = in_token->page_len; 1041 while (inlen) { 1042 if (in_token->pages[i]) 1043 put_page(in_token->pages[i]); ^
Quoted 8 lines
This puts page zero over and over.
1044 inlen -= inlen > PAGE_SIZE ? PAGE_SIZE : inlen; 1045 } 1046 1047 kfree(in_token->pages); 1048 in_token->pages = NULL; 1049 }
Based on the way that the ->pages[] array is constructed in gss_read_proxy_verf(), we know that once the loop encounters a NULL page pointer, the remaining array elements must also be NULL.
--- net/sunrpc/auth_gss/svcauth_gss.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-)
net/sunrpc/auth_gss/svcauth_gss.c +2 -8
@@ -1126,17 +1126,11 @@ gss_read_verf(struct rpc_gss_wire_cred *gc,static void gss_free_in_token_pages (struct gssp_in_token *in_token) { -u32 inlen;int i; i =0 ; - inlen = in_token->page_len; -while (inlen) { -if (in_token->pages[i]) -put_page (in_token->pages[i]); - inlen -= inlen >PAGE_SIZE ?PAGE_SIZE : inlen; - } - +while (in_token->pages[i]) +put_page (in_token->pages[i++]);kfree (in_token->pages); in_token->pages =NULL ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 127/317 selftests/kcmp: Make the test output consistent and clear
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gautam Menghani <[email protected]>
[ Upstream commit ff682226a353d88ffa5db9c2a9b945066776311e ]
Make the output format of this test consistent. Currently the output is as follows:
+TAP version 13
+1..1
+# selftests: kcmp: kcmp_test
+# pid1: 45814 pid2: 45815 FD: 1 FILES: 1 VM: 2 FS: 1 SIGHAND: 2
+ IO: 0 SYSVSEM: 0 INV: -1
+# PASS: 0 returned as expected
+# PASS: 0 returned as expected
+# PASS: 0 returned as expected
+# # Planned tests != run tests (0 != 3)
+# # Totals: pass:3 fail:0 xfail:0 xpass:0 skip:0 error:0
+# # Planned tests != run tests (0 != 3)
+# # Totals: pass:3 fail:0 xfail:0 xpass:0 skip:0 error:0
+# # Totals: pass:0 fail:0 xfail:0 xpass:0 skip:0 error:0 +ok 1 selftests: kcmp: kcmp_test
With this patch applied the output is as follows:
+TAP version 13
+1..1
+# selftests: kcmp: kcmp_test
+# TAP version 13
+# 1..3
+# pid1: 46330 pid2: 46331 FD: 1 FILES: 2 VM: 2 FS: 2 SIGHAND: 1
+ IO: 0 SYSVSEM: 0 INV: -1
+# PASS: 0 returned as expected
+# PASS: 0 returned as expected
+# PASS: 0 returned as expected
+# # Totals: pass:3 fail:0 xfail:0 xpass:0 skip:0 error:0 +ok 1 selftests: kcmp: kcmp_test
Stable-dep-of: eb59a5811371 ("selftests/kcmp: remove unused open mode")
--- tools/testing/selftests/kcmp/kcmp_test.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
tools/testing/selftests/kcmp/kcmp_test.c +4 -2
@@ -88,6 +88,9 @@ int main(int argc, char **argv)int pid2 =getpid ();int ret; +ksft_print_header (); +ksft_set_plan (3 ); + fd2 =open (kpath,O_RDWR ,0644 );if (fd2 <0 ) {perror ("Can't open file" );
@@ -152,7 +155,6 @@ int main(int argc, char **argv)ksft_inc_pass_cnt (); } -ksft_print_cnts ();if (ret)ksft_exit_fail ();
@@ -162,5 +164,5 @@ int main(int argc, char **argv)waitpid (pid2, &status,P_ALL ); -return ksft_exit_pass (); +return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 128/317 selftests/kcmp: remove unused open mode
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Liaw <[email protected]>
[ Upstream commit eb59a58113717df04b8a8229befd8ab1e5dbf86e ]
Android bionic warns that open modes are ignored if O_CREAT or O_TMPFILE aren't specified. The permissions for the file are set above:
fd1 = open(kpath, O_RDWR | O_CREAT | O_TRUNC, 0644);
--- tools/testing/selftests/kcmp/kcmp_test.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/kcmp/kcmp_test.c +1 -1
@@ -91,7 +91,7 @@ int main(int argc, char **argv)ksft_print_header ();ksft_set_plan (3 ); - fd2 =open (kpath,O_RDWR ,0644 ); + fd2 =open (kpath,O_RDWR );if (fd2 <0 ) {perror ("Can't open file" );ksft_exit_fail ();
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 129/317 RDMA/IPoIB: Fix format truncation compilation errors
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <[email protected]>
[ Upstream commit 49ca2b2ef3d003402584c68ae7b3055ba72e750a ]
Truncate the device name to store IPoIB VLAN name.
[leonro@5b4e8fba4ddd kernel]$ make -s -j 20 allmodconfig [leonro@5b4e8fba4ddd kernel]$ make -s -j 20 W=1 drivers/infiniband/ulp/ipoib/ drivers/infiniband/ulp/ipoib/ipoib_vlan.c: In function ‘ipoib_vlan_add’:drivers/infiniband/ulp/ipoib/ipoib_vlan.c:187:52: error: ‘%04x’ directive output may be truncated writing 4 bytes into a region of size between 0 and 15 [-Werror=format-truncation=]
187 | snprintf(intf_name, sizeof(intf_name), "%s.%04x",
| ^~~~drivers/infiniband/ulp/ipoib/ipoib_vlan.c:187:48: note: directive argument in the range [0, 65535]
187 | snprintf(intf_name, sizeof(intf_name), "%s.%04x",
| ^~~~~~~~~drivers/infiniband/ulp/ipoib/ipoib_vlan.c:187:9: note: ‘snprintf’ output between 6 and 21 bytes into a destination of size 16
187 | snprintf(intf_name, sizeof(intf_name), "%s.%04x",
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
188 | ppriv->dev->name, pkey);
| ~~~~~~~~~~~~~~~~~~~~~~~cc1: all warnings being treated as errors
make[6]: *** [scripts/Makefile.build:244: drivers/infiniband/ulp/ipoib/ipoib_vlan.o] Error 1 make[6]: *** Waiting for unfinished jobs....
--- drivers/infiniband/ulp/ipoib/ipoib_vlan.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/infiniband/ulp/ipoib/ipoib_vlan.c +6 -2
@@ -185,8 +185,12 @@ int ipoib_vlan_add(struct net_device *pdev, unsigned short pkey) ppriv =ipoib_priv (pdev); -snprintf (intf_name,sizeof (intf_name),"%s.%04x" , - ppriv->dev->name, pkey); +/* If you increase IFNAMSIZ, update snprintf below +* to allow longer names. +*/ +BUILD_BUG_ON (IFNAMSIZ !=16 ); +snprintf (intf_name,sizeof (intf_name),"%.10s.%04x" , ppriv->dev->name, + pkey); ndev =ipoib_intf_alloc (ppriv->ca, ppriv->port, intf_name);if (IS_ERR (ndev)) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 130/317 net: qrtr: fix null-ptr-deref in qrtr_ns_remove
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qinglang Miao <[email protected]>
[ Upstream commit 4beb17e553b49c3dd74505c9f361e756aaae653e ]
A null-ptr-deref bug is reported by Hulk Robot like this:
--------------
KASAN: null-ptr-deref in range [0x0000000000000128-0x000000000000012f] Call Trace: qrtr_ns_remove+0x22/0x40 [ns] qrtr_proto_fini+0xa/0x31 [qrtr] __x64_sys_delete_module+0x337/0x4e0 do_syscall_64+0x34/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x468ded --------------
When qrtr_ns_init fails in qrtr_proto_init, qrtr_ns_remove which would be called later on would raise a null-ptr-deref because qrtr_ns.workqueue has been destroyed.
Fix it by making qrtr_ns_init have a return value and adding a check in qrtr_proto_init.
Stable-dep-of: fd76e5ccc48f ("net: qrtr: ns: Fix module refcnt")
--- net/qrtr/af_qrtr.c | 16 +++++++++++----- net/qrtr/ns.c | 7 ++++--- net/qrtr/qrtr.h | 2 +- 3 files changed, 16 insertions(+), 9 deletions(-)
net/qrtr/af_qrtr.c +11 -5
@@ -1279,13 +1279,19 @@ static int __init qrtr_proto_init(void)return rc; rc =sock_register (&qrtr_family); -if (rc) { -proto_unregister (&qrtr_proto); -return rc; - } +if (rc) + goto err_proto; -qrtr_ns_init (); + rc =qrtr_ns_init (); +if (rc) + goto err_sock; +return 0 ; + +err_sock: +sock_unregister (qrtr_family.family); +err_proto: +proto_unregister (&qrtr_proto);return rc; }postcore_initcall (qrtr_proto_init);
net/qrtr/ns.c +4 -3
@@ -771,7 +771,7 @@ static void qrtr_ns_data_ready(struct sock *sk)queue_work (qrtr_ns.workqueue, &qrtr_ns.work); } -void qrtr_ns_init (void ) +int qrtr_ns_init (void ) {struct sockaddr_qrtr sq;int ret;
@@ -782,7 +782,7 @@ void qrtr_ns_init(void) ret =sock_create_kern (&init_net,AF_QIPCRTR ,SOCK_DGRAM ,PF_QIPCRTR , &qrtr_ns.sock);if (ret <0 ) -return ; +return ret; ret =kernel_getsockname (qrtr_ns.sock, (struct sockaddr *)&sq);if (ret <0 ) {
@@ -815,12 +815,13 @@ void qrtr_ns_init(void)if (ret <0 ) goto err_wq; -return ; +return 0 ; err_wq:destroy_workqueue (qrtr_ns.workqueue); err_sock:sock_release (qrtr_ns.sock); +return ret; }EXPORT_SYMBOL_GPL (qrtr_ns_init);
net/qrtr/qrtr.h +1 -1
@@ -29,7 +29,7 @@ void qrtr_endpoint_unregister(struct qrtr_endpoint *ep);int qrtr_endpoint_post (struct qrtr_endpoint *ep,const void *data,size_t len); -void qrtr_ns_init (void ); +int qrtr_ns_init (void );void qrtr_ns_remove (void );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 131/317 net: qrtr: ns: Fix module refcnt
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Lew <[email protected]>
[ Upstream commit fd76e5ccc48f9f54eb44909dd7c0b924005f1582 ]
The qrtr protocol core logic and the qrtr nameservice are combined into a single module. Neither the core logic or nameservice provide much functionality by themselves; combining the two into a single module also prevents any possible issues that may stem from client modules loading inbetween qrtr and the ns.
Creating a socket takes two references to the module that owns the socket protocol. Since the ns needs to create the control socket, this creates a scenario where there are always two references to the qrtr module. This prevents the execution of 'rmmod' for qrtr.
To resolve this, forcefully put the module refcount for the socket opened by the nameservice.
--- net/qrtr/ns.c | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+)
net/qrtr/ns.c +27 -0
@@ -815,6 +815,24 @@ int qrtr_ns_init(void)if (ret <0 ) goto err_wq; +/* As the qrtr ns socket owner and creator is the same module, we have +* to decrease the qrtr module reference count to guarantee that it +* remains zero after the ns socket is created, otherwise, executing +* "rmmod" command is unable to make the qrtr module deleted after the +* qrtr module is inserted successfully. +* +* However, the reference count is increased twice in +* sock_create_kern(): one is to increase the reference count of owner +* of qrtr socket's proto_ops struct; another is to increment the +* reference count of owner of qrtr proto struct. Therefore, we must +* decrement the module reference count twice to ensure that it keeps +* zero after server's listening socket is created. Of course, we +* must bump the module reference count twice as well before the socket +* is closed. +*/ +module_put (qrtr_ns.sock->ops->owner); +module_put (qrtr_ns.sock->sk->sk_prot_creator->owner); +return 0 ; err_wq:
@@ -829,6 +847,15 @@ void qrtr_ns_remove(void) {cancel_work_sync (&qrtr_ns.work);destroy_workqueue (qrtr_ns.workqueue); + +/* sock_release() expects the two references that were put during +* qrtr_ns_init(). This function is only called during module remove, +* so try_stop_module() has already set the refcnt to 0. Use +* __module_get() instead of try_module_get() to successfully take two +* references. +*/ +__module_get (qrtr_ns.sock->ops->owner); +__module_get (qrtr_ns.sock->sk->sk_prot_creator->owner);sock_release (qrtr_ns.sock); }EXPORT_SYMBOL_GPL (qrtr_ns_remove);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 132/317 netrom: fix possible dead-lock in nr_rt_ioctl()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit e03e7f20ebf7e1611d40d1fdc1bde900fd3335f6 ]
syzbot loves netrom, and found a possible deadlock in nr_rt_ioctl [1]
Make sure we always acquire nr_node_list_lock before nr_node_lock(nr_node)
[1]
WARNING: possible circular locking dependency detected 6.9.0-rc7-syzkaller-02147-g654de42f3fc6 #0 Not tainted
------------------------------------------------------
syz-executor350/5129 is trying to acquire lock:
ffff8880186e2070 (&nr_node->node_lock){+...}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline] ffff8880186e2070 (&nr_node->node_lock){+...}-{2:2}, at: nr_node_lock include/net/netrom.h:152 [inline] ffff8880186e2070 (&nr_node->node_lock){+...}-{2:2}, at: nr_dec_obs net/netrom/nr_route.c:464 [inline] ffff8880186e2070 (&nr_node->node_lock){+...}-{2:2}, at: nr_rt_ioctl+0x1bb/0x1090 net/netrom/nr_route.c:697
but task is already holding lock:
ffffffff8f7053b8 (nr_node_list_lock){+...}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline] ffffffff8f7053b8 (nr_node_list_lock){+...}-{2:2}, at: nr_dec_obs net/netrom/nr_route.c:462 [inline] ffffffff8f7053b8 (nr_node_list_lock){+...}-{2:2}, at: nr_rt_ioctl+0x10a/0x1090 net/netrom/nr_route.c:697
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (nr_node_list_lock){+...}-{2:2}:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:356 [inline]
nr_remove_node net/netrom/nr_route.c:299 [inline]
nr_del_node+0x4b4/0x820 net/netrom/nr_route.c:355
nr_rt_ioctl+0xa95/0x1090 net/netrom/nr_route.c:683
sock_do_ioctl+0x158/0x460 net/socket.c:1222
sock_ioctl+0x629/0x8e0 net/socket.c:1341
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:904 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:890
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f-> #0 (&nr_node->node_lock){+...}-{2:2}:
check_prev_add kernel/locking/lockdep.c:3134 [inline]
check_prevs_add kernel/locking/lockdep.c:3253 [inline]
validate_chain+0x18cb/0x58e0 kernel/locking/lockdep.c:3869
__lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:356 [inline]
nr_node_lock include/net/netrom.h:152 [inline]
nr_dec_obs net/netrom/nr_route.c:464 [inline]
nr_rt_ioctl+0x1bb/0x1090 net/netrom/nr_route.c:697
sock_do_ioctl+0x158/0x460 net/socket.c:1222
sock_ioctl+0x629/0x8e0 net/socket.c:1341
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:904 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:890
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7fother info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(nr_node_list_lock);
lock(&nr_node->node_lock);
lock(nr_node_list_lock); lock(&nr_node->node_lock);
*** DEADLOCK ***
1 lock held by syz-executor350/5129:
#0: ffffffff8f7053b8 (nr_node_list_lock){+...}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline] #0: ffffffff8f7053b8 (nr_node_list_lock){+...}-{2:2}, at: nr_dec_obs net/netrom/nr_route.c:462 [inline] #0: ffffffff8f7053b8 (nr_node_list_lock){+...}-{2:2}, at: nr_rt_ioctl+0x10a/0x1090 net/netrom/nr_route.c:697
stack backtrace: CPU: 0 PID: 5129 Comm: syz-executor350 Not tainted 6.9.0-rc7-syzkaller-02147-g654de42f3fc6 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2187 check_prev_add kernel/locking/lockdep.c:3134 [inline] check_prevs_add kernel/locking/lockdep.c:3253 [inline] validate_chain+0x18cb/0x58e0 kernel/locking/lockdep.c:3869 __lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] nr_node_lock include/net/netrom.h:152 [inline] nr_dec_obs net/netrom/nr_route.c:464 [inline] nr_rt_ioctl+0x1bb/0x1090 net/netrom/nr_route.c:697 sock_do_ioctl+0x158/0x460 net/socket.c:1222 sock_ioctl+0x629/0x8e0 net/socket.c:1341 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:904 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:890 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f
--- net/netrom/nr_route.c | 19 +++++++------------ 1 file changed, 7 insertions(+), 12 deletions(-)
net/netrom/nr_route.c +7 -12
@@ -284,22 +284,14 @@ static int __must_check nr_add_node(ax25_address *nr, const char *mnemonic,return 0 ; } -static inline void __nr_remove_node (struct nr_node *nr_node) +static void nr_remove_node_locked (struct nr_node *nr_node) { +lockdep_assert_held (&nr_node_list_lock); +hlist_del_init (&nr_node->node_node);nr_node_put (nr_node); } -#define nr_remove_node_locked (__node) \ - __nr_remove_node(__node) - -static void nr_remove_node (struct nr_node *nr_node) -{ -spin_lock_bh (&nr_node_list_lock); -__nr_remove_node (nr_node); -spin_unlock_bh (&nr_node_list_lock); -} -static inline void __nr_remove_neigh (struct nr_neigh *nr_neigh) {hlist_del_init (&nr_neigh->neigh_node);
@@ -338,6 +330,7 @@ static int nr_del_node(ax25_address *callsign, ax25_address *neighbour, struct nreturn -EINVAL ; } +spin_lock_bh (&nr_node_list_lock);nr_node_lock (nr_node);for (i =0 ; i < nr_node->count; i++) {if (nr_node->routes[i].neighbour == nr_neigh) {
@@ -351,7 +344,7 @@ static int nr_del_node(ax25_address *callsign, ax25_address *neighbour, struct n nr_node->count--;if (nr_node->count ==0 ) { -nr_remove_node (nr_node); +nr_remove_node_locked (nr_node); }else {switch (i) {case 0 :
@@ -365,12 +358,14 @@ static int nr_del_node(ax25_address *callsign, ax25_address *neighbour, struct nnr_node_put (nr_node); }nr_node_unlock (nr_node); +spin_unlock_bh (&nr_node_list_lock);return 0 ; } }nr_neigh_put (nr_neigh);nr_node_unlock (nr_node); +spin_unlock_bh (&nr_node_list_lock);nr_node_put (nr_node);return -EINVAL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 133/317 af_packet: do not call packet_read_pending() from tpacket_destruct_skb()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 581073f626e387d3e7eed55c48c8495584ead7ba ]
trafgen performance considerably sank on hosts with many cores after the blamed commit.
packet_read_pending() is very expensive, and calling it in af_packet fast path defeats Daniel intent in commit b013840810c2 ("packet: use percpu mmap tx frame pending refcount")
tpacket_destruct_skb() makes room for one packet, we can immediately wakeup a producer, no need to completely drain the tx ring.
--- net/packet/af_packet.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
net/packet/af_packet.c +1 -2
@@ -2487,8 +2487,7 @@ static void tpacket_destruct_skb(struct sk_buff *skb) ts =__packet_set_timestamp (po, ph, skb);__packet_set_status (po, ph,TP_STATUS_AVAILABLE | ts); -if (!packet_read_pending (&po->tx_ring)) -complete (&po->skb_completion); +complete (&po->skb_completion); }sock_wfree (skb);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 134/317 sched/fair: Allow disabling sched_balance_newidle with sched_relax_domain_level
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vitalii Bursov <[email protected]>
[ Upstream commit a1fd0b9d751f840df23ef0e75b691fc00cfd4743 ]
Change relax_domain_level checks so that it would be possible to include or exclude all domains from newidle balancing.
This matches the behavior described in the documentation:
-1 no request. use system default or follow request of others. 0 no search. 1 search siblings (hyperthreads in a core).
"2" enables levels 0 and 1, level_max excludes the last (level_max) level, and level_max+1 includes all levels.
--- kernel/cgroup/cpuset.c | 2 +- kernel/sched/topology.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
kernel/cgroup/cpuset.c +1 -1
@@ -1901,7 +1901,7 @@ bool current_cpuset_is_being_rebound(void)static int update_relax_domain_level (struct cpuset *cs,s64 val) {#ifdef CONFIG_SMP -if (val <-1 || val >= sched_domain_level_max) +if (val <-1 || val > sched_domain_level_max +1 )return -EINVAL ;#endif
kernel/sched/topology.c +1 -1
@@ -1217,7 +1217,7 @@ static void set_domain_attribute(struct sched_domain *sd, }else request = attr->relax_domain_level; -if (sd->level > request) { +if (sd->level >= request) {/* Turn off idle balance on this domain: */ sd->flags &= ~(SD_BALANCE_WAKE |SD_BALANCE_NEWIDLE ); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 135/317 perf evlist: Use the right prefix for struct evlist sideband thread methods
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <[email protected]>
[ Upstream commit 08c83997ca87f9e162563a59ea43eabadc9e4231 ]
perf_evlist__ is for 'struct perf_evlist' methods, in tools/lib/perf/, go on completing this split.
Stable-dep-of: 88ce0106a1f6 ("perf record: Delete session after stopping sideband thread")
--- tools/perf/builtin-record.c | 4 ++-- tools/perf/builtin-top.c | 4 ++-- tools/perf/util/bpf-event.c | 2 +- tools/perf/util/evlist.h | 11 ++++------- tools/perf/util/sideband_evlist.c | 8 ++++---- 5 files changed, 13 insertions(+), 16 deletions(-)
tools/perf/builtin-record.c +2 -2
@@ -1548,7 +1548,7 @@ static int record__setup_sb_evlist(struct record *rec) } }#endif -if (perf_evlist__start_sb_thread (rec->sb_evlist, &rec->opts.target)) { +if (evlist__start_sb_thread (rec->sb_evlist, &rec->opts.target)) {pr_debug ("Couldn't start the BPF side band thread:\nBPF programs starting from now on won't be annotatable\n" ); opts->no_bpf_event = true; }
@@ -2066,7 +2066,7 @@ static int __cmd_record(struct record *rec, int argc, const char **argv)perf_session__delete (session);if (!opts->no_bpf_event) -perf_evlist__stop_sb_thread (rec->sb_evlist); +evlist__stop_sb_thread (rec->sb_evlist);return status; }
tools/perf/builtin-top.c +2 -2
@@ -1763,7 +1763,7 @@ int cmd_top(int argc, const char **argv) }#endif -if (perf_evlist__start_sb_thread (top.sb_evlist, target)) { +if (evlist__start_sb_thread (top.sb_evlist, target)) {pr_debug ("Couldn't start the BPF side band thread:\nBPF programs starting from now on won't be annotatable\n" ); opts->no_bpf_event = true; }
@@ -1771,7 +1771,7 @@ int cmd_top(int argc, const char **argv) status =__cmd_top (&top);if (!opts->no_bpf_event) -perf_evlist__stop_sb_thread (top.sb_evlist); +evlist__stop_sb_thread (top.sb_evlist); out_delete_evlist:evlist__delete (top.evlist);
tools/perf/util/bpf-event.c +1 -1
@@ -530,7 +530,7 @@ int evlist__add_bpf_sb_event(struct evlist *evlist, struct perf_env *env)*/ attr.wakeup_watermark =1 ; -return perf_evlist__add_sb_event (evlist, &attr, bpf_event__sb_cb, env); +return evlist__add_sb_event (evlist, &attr, bpf_event__sb_cb, env); } void __bpf_event__print_bpf_prog_info(struct bpf_prog_info *info,
tools/perf/util/evlist.h +4 -7
@@ -112,14 +112,11 @@ int __evlist__add_default_attrs(struct evlist *evlist,int evlist__add_dummy (struct evlist *evlist); -int perf_evlist__add_sb_event (struct evlist *evlist, -struct perf_event_attr *attr, -evsel__sb_cb_t cb, -void *data); +int evlist__add_sb_event (struct evlist *evlist,struct perf_event_attr *attr, +evsel__sb_cb_t cb,void *data);void evlist__set_cb (struct evlist *evlist,evsel__sb_cb_t cb,void *data); -int perf_evlist__start_sb_thread (struct evlist *evlist, -struct target *target); -void perf_evlist__stop_sb_thread (struct evlist *evlist); +int evlist__start_sb_thread (struct evlist *evlist,struct target *target); +void evlist__stop_sb_thread (struct evlist *evlist);int evlist__add_newtp (struct evlist *evlist,const char *sys,const char *name,void *handler);
tools/perf/util/sideband_evlist.c +4 -4
@@ -12,8 +12,8 @@#include <sched.h> #include <stdbool.h> -int perf_evlist__add_sb_event (struct evlist *evlist,struct perf_event_attr *attr, -evsel__sb_cb_t cb,void *data) +int evlist__add_sb_event (struct evlist *evlist,struct perf_event_attr *attr, +evsel__sb_cb_t cb,void *data) {struct evsel *evsel;
@@ -94,7 +94,7 @@ void evlist__set_cb(struct evlist *evlist, evsel__sb_cb_t cb, void *data) } } -int perf_evlist__start_sb_thread (struct evlist *evlist,struct target *target) +int evlist__start_sb_thread (struct evlist *evlist,struct target *target) {struct evsel *counter;
@@ -138,7 +138,7 @@ int perf_evlist__start_sb_thread(struct evlist *evlist, struct target *target)return -1 ; } -void perf_evlist__stop_sb_thread (struct evlist *evlist) +void evlist__stop_sb_thread (struct evlist *evlist) {if (!evlist)return ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 136/317 perf record: Delete session after stopping sideband thread
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 88ce0106a1f603bf360cb397e8fe293f8298fabb ]
The session has a header in it which contains a perf env with bpf_progs. The bpf_progs are accessed by the sideband thread and so the sideband thread must be stopped before the session is deleted, to avoid a use after free. This error was detected by AddressSanitizer in the following:
==2054673==ERROR: AddressSanitizer: heap-use-after-free on address 0x61d000161e00 at pc 0x55769289de54 bp 0x7f9df36d4ab0 sp 0x7f9df36d4aa8 READ of size 8 at 0x61d000161e00 thread T1
#0 0x55769289de53 in __perf_env__insert_bpf_prog_info util/env.c:42
#1 0x55769289dbb1 in perf_env__insert_bpf_prog_info util/env.c:29
#2 0x557692bbae29 in perf_env__add_bpf_info util/bpf-event.c:483
#3 0x557692bbb01a in bpf_event__sb_cb util/bpf-event.c:512
#4 0x5576928b75f4 in perf_evlist__poll_thread util/sideband_evlist.c:68
#5 0x7f9df96a63eb in start_thread nptl/pthread_create.c:444
#6 0x7f9df9726a4b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81 0x61d000161e00 is located 384 bytes inside of 2136-byte region [0x61d000161c80,0x61d0001624d8) freed by thread T0 here:
#0 0x7f9dfa6d7288 in __interceptor_free libsanitizer/asan/asan_malloc_linux.cpp:52
#1 0x557692978d50 in perf_session__delete util/session.c:319
#2 0x557692673959 in __cmd_record tools/perf/builtin-record.c:2884
#3 0x55769267a9f0 in cmd_record tools/perf/builtin-record.c:4259
#4 0x55769286710c in run_builtin tools/perf/perf.c:349
#5 0x557692867678 in handle_internal_command tools/perf/perf.c:402
#6 0x557692867a40 in run_argv tools/perf/perf.c:446
#7 0x557692867fae in main tools/perf/perf.c:562
#8 0x7f9df96456c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58--- tools/perf/builtin-record.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/perf/builtin-record.c +2 -2
@@ -2063,10 +2063,10 @@ static int __cmd_record(struct record *rec, int argc, const char **argv)close (done_fd);#endif zstd_fini (&session->zstd_data); -perf_session__delete (session); -if (!opts->no_bpf_event)evlist__stop_sb_thread (rec->sb_evlist); + +perf_session__delete (session);return status; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 137/317 perf probe: Add missing libgen.h header needed for using basename()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <[email protected]>
[ Upstream commit 581037151910126a7934e369e4b6ac70eda9a703 ]
This prototype is obtained indirectly, by luck, from some other header in probe-event.c in most systems, but recently exploded on alpine:edge:
8 13.39 alpine:edge : FAIL gcc version 13.2.1 20240309 (Alpine 13.2.1_git20240309)
util/probe-event.c: In function 'convert_exec_to_group':
util/probe-event.c:225:16: error: implicit declaration of function 'basename' [-Werror=implicit-function-declaration]
225 | ptr1 = basename(exec_copy);
| ^~~~~~~~
util/probe-event.c:225:14: error: assignment to 'char *' from 'int' makes pointer from integer without a cast [-Werror=int-conversion]
225 | ptr1 = basename(exec_copy);
| ^
cc1: all warnings being treated as errors
make[3]: *** [/git/perf-6.8.0/tools/build/Makefile.build:158: util] Error 2
Fix it by adding the libgen.h header where basename() is prototyped.
--- tools/perf/util/probe-event.c | 1 + 1 file changed, 1 insertion(+)
tools/perf/util/probe-event.c +1 -0
@@ -11,6 +11,7 @@#include <sys/stat.h> #include <fcntl.h> #include <errno.h> +#include <libgen.h> #include <stdio.h> #include <unistd.h> #include <stdlib.h>
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 138/317 greybus: lights: check return of get_channel_from_mode
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rui Miguel Silva <[email protected]>
[ Upstream commit a1ba19a1ae7cd1e324685ded4ab563e78fe68648 ]
If channel for the given node is not found we return null from get_channel_from_mode. Make sure we validate the return pointer before using it in two of the missing places.
This was originally reported in [0]:
Found by Linux Verification Center (linuxtesting.org) with SVACE.
[0] https://lore.kernel.org/all/[email protected]
--- drivers/staging/greybus/light.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/staging/greybus/light.c +7 -1
@@ -147,6 +147,9 @@ static int __gb_lights_flash_brightness_set(struct gb_channel *channel) channel =get_channel_from_mode (channel->light,GB_CHANNEL_MODE_TORCH ); +if (!channel) +return -EINVAL ; +/* For not flash we need to convert brightness to intensity */ intensity = channel->intensity_uA.min + (channel->intensity_uA.step * channel->led->brightness);
@@ -550,7 +553,10 @@ static int gb_lights_light_v4l2_register(struct gb_light *light) } channel_flash =get_channel_from_mode (light,GB_CHANNEL_MODE_FLASH ); -WARN_ON (!channel_flash); +if (!channel_flash) { +dev_err (dev,"failed to get flash channel from mode\n" ); +return -EINVAL ; + } fled = &channel_flash->fled;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 139/317 f2fs: fix to wait on page writeback in __clone_blkaddrs()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit d3876e34e7e789e2cbdd782360fef2a777391082 ]
In below race condition, dst page may become writeback status in __clone_blkaddrs(), it needs to wait writeback before update, fix it.
Thread A GC Thread
- f2fs_move_file_range
- filemap_write_and_wait_range(dst)
- gc_data_segment
- f2fs_down_write(dst)
- move_data_page
- set_page_writeback(dst_page)
- f2fs_submit_page_write
- f2fs_up_write(dst)
- f2fs_down_write(dst)
- __exchange_data_block
- __clone_blkaddrs
- f2fs_get_new_data_page
- memcpy_page
--- fs/f2fs/file.c | 2 ++ 1 file changed, 2 insertions(+)
fs/f2fs/file.c +2 -0
@@ -1253,6 +1253,8 @@ static int __clone_blkaddrs(struct inode *src_inode, struct inode *dst_inode,f2fs_put_page (psrc,1 );return PTR_ERR (pdst); } +f2fs_wait_on_page_writeback (pdst,DATA , true, true); +f2fs_copy_page (psrc, pdst);set_page_dirty (pdst);f2fs_put_page (pdst,1 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 140/317 perf annotate: Add --demangle and --demangle-kernel
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Liška <[email protected]>
[ Upstream commit 3406ac5347dbf64ab9f7b137ed25a18493f5ea2d ]
'perf annotate' supports --symbol but it's impossible to filter a C++ symbol. With --no-demangle one can filter easily by mangled function name.
Stable-dep-of: 374af9f1f06b ("perf annotate: Get rid of duplicate --group option item")
--- tools/perf/Documentation/perf-annotate.txt | 7 +++++++ tools/perf/builtin-annotate.c | 4 ++++ 2 files changed, 11 insertions(+)
tools/perf/Documentation/perf-annotate.txt +7 -0
@@ -124,6 +124,13 @@ OPTIONS --group:: Show event group information together +--demangle:: + Demangle symbol names to human readable form. It's enabled by default, + disable with --no-demangle. + +--demangle-kernel:: + Demangle kernel symbol names to human readable form (for C++ kernels). + --percent-type:: Set annotation percent type from following choices: global-period, local-period, global-hits, local-hits
tools/perf/builtin-annotate.c +4 -0
@@ -538,6 +538,10 @@ int cmd_annotate(int argc, const char **argv) "Strip first N entries of source file path name in programs (with --prefix)"),OPT_STRING (0 ,"objdump" , &annotate.opts.objdump_path,"path" ,"objdump binary to use for disassembly and annotations" ), +OPT_BOOLEAN (0 ,"demangle" , &symbol_conf.demangle, +"Enable symbol demangling" ), +OPT_BOOLEAN (0 ,"demangle-kernel" , &symbol_conf.demangle_kernel, +"Enable kernel symbol demangling" ),OPT_BOOLEAN (0 ,"group" , &symbol_conf.event_group,"Show event group information together" ), OPT_BOOLEAN(0, "show-total-period", &symbol_conf.show_total_period,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 141/317 perf annotate: Get rid of duplicate --group option item
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namhyung Kim <[email protected]>
[ Upstream commit 374af9f1f06b5e991c810d2e4983d6f58df32136 ]
The options array in cmd_annotate() has duplicate --group options. It only needs one and let's get rid of the other.
$ perf annotate -h 2>&1 | grep group
--group Show event group information together
--group Show event group information together--- tools/perf/builtin-annotate.c | 2 -- 1 file changed, 2 deletions(-)
tools/perf/builtin-annotate.c +0 -2
@@ -542,8 +542,6 @@ int cmd_annotate(int argc, const char **argv) "Enable symbol demangling"),OPT_BOOLEAN (0 ,"demangle-kernel" , &symbol_conf.demangle_kernel,"Enable kernel symbol demangling" ), -OPT_BOOLEAN (0 ,"group" , &symbol_conf.event_group, -"Show event group information together" ),OPT_BOOLEAN (0 ,"show-total-period" , &symbol_conf.show_total_period,"Show a column with the sum of periods" ), OPT_BOOLEAN('n', "show-nr-samples", &symbol_conf.show_nr_samples,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 142/317 soundwire: cadence: fix invalid PDI offset
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre-Louis Bossart <[email protected]>
[ Upstream commit 8ee1b439b1540ae543149b15a2a61b9dff937d91 ]
For some reason, we add an offset to the PDI, presumably to skip the PDI0 and PDI1 which are reserved for BPT.
This code is however completely wrong and leads to an out-of-bounds access. We were just lucky so far since we used only a couple of PDIs and remained within the PDI array bounds.
A Fixes: tag is not provided since there are no known platforms where the out-of-bounds would be accessed, and the initial code had problems as well.
A follow-up patch completely removes this useless offset.
--- drivers/soundwire/cadence_master.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/soundwire/cadence_master.c +1 -1
@@ -1698,7 +1698,7 @@ struct sdw_cdns_pdi *sdw_cdns_alloc_pdi(struct sdw_cdns *cdns,/* check if we found a PDI, else find in bi-directional */ if (!pdi) - pdi =cdns_find_pdi (cdns,2 , stream->num_bd, stream->bd, + pdi =cdns_find_pdi (cdns,0 , stream->num_bd, stream->bd, dai_id);if (pdi) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 143/317 dmaengine: idma64: Add check for dma_set_max_seg_size
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ni <[email protected]>
[ Upstream commit 2b1c1cf08a0addb6df42f16b37133dc7a351de29 ]
As the possible failure of the dma_set_max_seg_size(), it should be better to check the return value of the dma_set_max_seg_size().
--- drivers/dma/idma64.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/dma/idma64.c +3 -1
@@ -594,7 +594,9 @@ static int idma64_probe(struct idma64_chip *chip) idma64->dma.dev = chip->sysdev; -dma_set_max_seg_size (idma64->dma.dev,IDMA64C_CTLH_BLOCK_TS_MASK ); + ret =dma_set_max_seg_size (idma64->dma.dev,IDMA64C_CTLH_BLOCK_TS_MASK ); +if (ret) +return ret; ret =dma_async_device_register (&idma64->dma);if (ret)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 144/317 firmware: dmi-id: add a release callback function
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit cf770af5645a41a753c55a053fa1237105b0964a ]
dmi_class uses kfree() as the .release function, but that now causes a warning with clang-16 as it violates control flow integrity (KCFI) rules:
drivers/firmware/dmi-id.c:174:17: error: cast from 'void (*)(const void *)' to 'void (*)(struct device *)' converts to incompatible function type [-Werror,-Wcast-function-type-strict]
174 | .dev_release = (void(*)(struct device *)) kfree,
Add an explicit function to call kfree() instead.
--- drivers/firmware/dmi-id.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/firmware/dmi-id.c +6 -1
@@ -164,9 +164,14 @@ static int dmi_dev_uevent(struct device *dev, struct kobj_uevent_env *env)return 0 ; } +static void dmi_dev_release (struct device *dev) +{ +kfree (dev); +} +static struct class dmi_class = { .name ="dmi" , - .dev_release = (void (*)(struct device *)) kfree, + .dev_release = dmi_dev_release, .dev_uevent = dmi_dev_uevent, };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 145/317 serial: max3100: Lock port->lock when calling uart_handle_cts_change()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 77ab53371a2066fdf9b895246505f5ef5a4b5d47 ]
uart_handle_cts_change() has to be called with port lock taken, Since we run it in a separate work, the lock may not be taken at the time of running. Make sure that it's taken by explicitly doing that. Without it we got a splat:
WARNING: CPU: 0 PID: 10 at drivers/tty/serial/serial_core.c:3491 uart_handle_cts_change+0xa6/0xb0 ... Workqueue: max3100-0 max3100_work [max3100] RIP: 0010:uart_handle_cts_change+0xa6/0xb0 ... max3100_handlerx+0xc5/0x110 [max3100] max3100_work+0x12a/0x340 [max3100]
--- drivers/tty/serial/max3100.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
drivers/tty/serial/max3100.c +12 -1
@@ -213,7 +213,7 @@ static int max3100_sr(struct max3100_port *s, u16 tx, u16 *rx)return 0 ; } -static int max3100_handlerx (struct max3100_port *s,u16 rx) +static int max3100_handlerx_unlocked (struct max3100_port *s,u16 rx) {unsigned int ch, flg, status =0 ;int ret =0 , cts;
@@ -253,6 +253,17 @@ static int max3100_handlerx(struct max3100_port *s, u16 rx)return ret; } +static int max3100_handlerx (struct max3100_port *s,u16 rx) +{ +unsigned long flags; +int ret; + +uart_port_lock_irqsave (&s->port, &flags); + ret =max3100_handlerx_unlocked (s, rx); +uart_port_unlock_irqrestore (&s->port, flags); +return ret; +} +static void max3100_work (struct work_struct *w) { struct max3100_port *s = container_of(w, struct max3100_port, work);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 146/317 serial: max3100: Update uart_driver_registered on driver removal
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 712a1fcb38dc7cac6da63ee79a88708fbf9c45ec ]
The removal of the last MAX3100 device triggers the removal of the driver. However, code doesn't update the respective global variable and after insmod — rmmod — insmod cycle the kernel oopses:
max3100 spi-PRP0001:01: max3100_probe: adding port 0
BUG: kernel NULL pointer dereference, address: 0000000000000408 ... RIP: 0010:serial_core_register_port+0xa0/0x840 ... max3100_probe+0x1b6/0x280 [max3100] spi_probe+0x8d/0xb0
Update the actual state so next time UART driver will be registered again.
Hugo also noticed, that the error path in the probe also affected by having the variable set, and not cleared. Instead of clearing it move the assignment after the successfull uart_register_driver() call.
--- drivers/tty/serial/max3100.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/tty/serial/max3100.c +3 -1
@@ -754,13 +754,14 @@ static int max3100_probe(struct spi_device *spi)mutex_lock (&max3100s_lock);if (!uart_driver_registered) { - uart_driver_registered =1 ; retval =uart_register_driver (&max3100_uart_driver);if (retval) {printk (KERN_ERR "Couldn't register max3100 uart driver\n" );mutex_unlock (&max3100s_lock);return retval; } + + uart_driver_registered =1 ; }for (i =0 ; i <MAX_MAX3100 ; i++)
@@ -846,6 +847,7 @@ static int max3100_remove(struct spi_device *spi) }pr_debug ("removing max3100 driver\n" );uart_unregister_driver (&max3100_uart_driver); + uart_driver_registered =0 ;mutex_unlock (&max3100s_lock);return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 147/317 serial: max3100: Fix bitwise types
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit e60955dbecb97f080848a57524827e2db29c70fd ]
Sparse is not happy about misuse of bitwise types:
.../max3100.c:194:13: warning: incorrect type in assignment (different base types)
.../max3100.c:194:13: expected unsigned short [addressable] [usertype] etx
.../max3100.c:194:13: got restricted __be16 [usertype]
.../max3100.c:202:15: warning: cast to restricted __be16
Fix this by choosing proper types for the respective variables.
--- drivers/tty/serial/max3100.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/tty/serial/max3100.c +4 -1
@@ -45,6 +45,9 @@#include <linux/freezer.h> #include <linux/tty.h> #include <linux/tty_flip.h> +#include <linux/types.h> + +#include <asm/unaligned.h> #include <linux/serial_max3100.h>
@@ -191,7 +194,7 @@ static void max3100_timeout(struct timer_list *t)static int max3100_sr (struct max3100_port *s,u16 tx,u16 *rx) {struct spi_message message; -u16 etx, erx; +__be16 etx, erx;int status;struct spi_transfer tran = { .tx_buf = &etx,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 148/317 greybus: arche-ctrl: move device table to its right location
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 6a0b8c0da8d8d418cde6894a104cf74e6098ddfa ]
The arche-ctrl has two platform drivers and three of_device_id tables, but one table is only used for the the module loader, while the other two seem to be associated with their drivers.
This leads to a W=1 warning when the driver is built-in:
drivers/staging/greybus/arche-platform.c:623:34: error: 'arche_combined_id' defined but not used [-Werror=unused-const-variable=]
623 | static const struct of_device_id arche_combined_id[] = {
Drop the extra table and register both tables that are actually used as the ones for the module loader instead.
--- drivers/staging/greybus/arche-apb-ctrl.c | 1 + drivers/staging/greybus/arche-platform.c | 9 +-------- 2 files changed, 2 insertions(+), 8 deletions(-)
drivers/staging/greybus/arche-apb-ctrl.c +1 -0
@@ -468,6 +468,7 @@ static const struct of_device_id arche_apb_ctrl_of_match[] = { { .compatible = "usbffff,2", }, { }, }; +MODULE_DEVICE_TABLE (of, arche_apb_ctrl_of_match);static struct platform_driver arche_apb_ctrl_device_driver = { .probe = arche_apb_ctrl_probe,
drivers/staging/greybus/arche-platform.c +1 -8
@@ -622,14 +622,7 @@ static const struct of_device_id arche_platform_of_match[] = { { .compatible = "google,arche-platform", }, { }, }; - -static const struct of_device_id arche_combined_id[] = { -/* Use PID/VID of SVC device */ - { .compatible ="google,arche-platform" , }, - { .compatible ="usbffff,2" , }, - { }, -}; -MODULE_DEVICE_TABLE (of, arche_combined_id); +MODULE_DEVICE_TABLE (of, arche_platform_of_match);static struct platform_driver arche_platform_device_driver = { .probe = arche_platform_probe,
Signature · 1 line
2.43.0