6.9.7-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainerPATCH 131/250 net: stmmac: No need to calculate speed divider when offload is disabled
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaolei Wang <[email protected]>
[ Upstream commit b8c43360f6e424131fa81d3ba8792ad8ff25a09e ]
commit be27b8965297 ("net: stmmac: replace priv->speed with the portTransmitRate from the tc-cbs parameters") introduced a problem. When deleting, it prompts "Invalid portTransmitRate 0 (idleSlope - sendSlope)" and exits. Add judgment on cbs.enable. Only when offload is enabled, speed divider needs to be calculated.
--- .../net/ethernet/stmicro/stmmac/stmmac_tc.c | 40 ++++++++++--------- 1 file changed, 22 insertions(+), 18 deletions(-)
drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c +22 -18
@@ -358,24 +358,28 @@ static int tc_setup_cbs(struct stmmac_priv *priv, port_transmit_rate_kbps = qopt->idleslope - qopt->sendslope; -/* Port Transmit Rate and Speed Divider */ -switch (div_s64 (port_transmit_rate_kbps,1000 )) { -case SPEED_10000 : -case SPEED_5000 : - ptr =32 ; -break ; -case SPEED_2500 : -case SPEED_1000 : - ptr =8 ; -break ; -case SPEED_100 : - ptr =4 ; -break ; -default : -netdev_err (priv->dev, -"Invalid portTransmitRate %lld (idleSlope - sendSlope)\n" , - port_transmit_rate_kbps); -return -EINVAL ; +if (qopt->enable) { +/* Port Transmit Rate and Speed Divider */ +switch (div_s64 (port_transmit_rate_kbps,1000 )) { +case SPEED_10000 : +case SPEED_5000 : + ptr =32 ; +break ; +case SPEED_2500 : +case SPEED_1000 : + ptr =8 ; +break ; +case SPEED_100 : + ptr =4 ; +break ; +default : +netdev_err (priv->dev, +"Invalid portTransmitRate %lld (idleSlope - sendSlope)\n" , + port_transmit_rate_kbps); +return -EINVAL ; + } + }else { + ptr =0 ; } mode_to_use = priv->plat->tx_queues_cfg[queue].mode_to_use;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 132/250 virtio_net: checksum offloading handling fix
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heng Qi <[email protected]>
[ Upstream commit 604141c036e1b636e2a71cf6e1aa09d1e45f40c2 ]
In virtio spec 0.95, VIRTIO_NET_F_GUEST_CSUM was designed to handle partially checksummed packets, and the validation of fully checksummed packets by the device is independent of VIRTIO_NET_F_GUEST_CSUM negotiation. However, the specification erroneously stated:
"If VIRTIO_NET_F_GUEST_CSUM is not negotiated, the device MUST set flags
to zero and SHOULD supply a fully checksummed packet to the driver."
This statement is inaccurate because even without VIRTIO_NET_F_GUEST_CSUM negotiation, the device can still set the VIRTIO_NET_HDR_F_DATA_VALID flag. Essentially, the device can facilitate the validation of these packets' checksums - a process known as RX checksum offloading - removing the need for the driver to do so.
This scenario is currently not implemented in the driver and requires correction. The necessary specification correction[1] has been made and approved in the virtio TC vote.
[1] https://lists.oasis-open.org/archives/virtio-comment/202401/msg00011.html
--- drivers/net/virtio_net.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/net/virtio_net.c +10 -2
@@ -4698,8 +4698,16 @@ static int virtnet_probe(struct virtio_device *vdev) dev->features |= dev->hw_features &NETIF_F_ALL_TSO ;/* (!csum && gso) case will be fixed by register_netdev() */ } -if (virtio_has_feature (vdev,VIRTIO_NET_F_GUEST_CSUM )) - dev->features |=NETIF_F_RXCSUM ; + +/* 1. With VIRTIO_NET_F_GUEST_CSUM negotiation, the driver doesn't +* need to calculate checksums for partially checksummed packets, +* as they're considered valid by the upper layer. +* 2. Without VIRTIO_NET_F_GUEST_CSUM negotiation, the driver only +* receives fully checksummed packets. The device may assist in +* validating these packets' checksums, so the driver won't have to. +*/ + dev->features |=NETIF_F_RXCSUM ; +if (virtio_has_feature (vdev,VIRTIO_NET_F_GUEST_TSO4 ) ||virtio_has_feature (vdev,VIRTIO_NET_F_GUEST_TSO6 )) dev->features |=NETIF_F_GRO_HW ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 133/250 virtio_net: fixing XDP for fully checksummed packets handling
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heng Qi <[email protected]>
[ Upstream commit 703eec1b242276f2d97d98f04790ddad319ddde4 ]
The XDP program can't correctly handle partially checksummed packets, but works fine with fully checksummed packets. If the device has already validated fully checksummed packets, then the driver doesn't need to re-validate them, saving CPU resources.
Additionally, the driver does not drop all partially checksummed packets when VIRTIO_NET_F_GUEST_CSUM is not negotiated. This is not a bug, as the driver has always done this.
--- drivers/net/virtio_net.c | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-)
drivers/net/virtio_net.c +19 -1
@@ -1225,6 +1225,10 @@ static struct sk_buff *receive_small_xdp(struct net_device *dev,if (unlikely (hdr->hdr.gso_type)) goto err_xdp; +/* Partially checksummed packets must be dropped. */ +if (unlikely (hdr->hdr.flags &VIRTIO_NET_HDR_F_NEEDS_CSUM )) + goto err_xdp; + buflen =SKB_DATA_ALIGN (GOOD_PACKET_LEN + headroom) +SKB_DATA_ALIGN (sizeof (struct skb_shared_info ));
@@ -1542,6 +1546,10 @@ static void *mergeable_xdp_get_buf(struct virtnet_info *vi,if (unlikely (hdr->hdr.gso_type))return NULL ; +/* Partially checksummed packets must be dropped. */ +if (unlikely (hdr->hdr.flags &VIRTIO_NET_HDR_F_NEEDS_CSUM )) +return NULL ; +/* Now XDP core assumes frag size is PAGE_SIZE, but buffers * with headroom may add hole in truesize, which * make their length exceed PAGE_SIZE. So we disabled the
@@ -1808,6 +1816,7 @@ static void receive_buf(struct virtnet_info *vi, struct receive_queue *rq,struct net_device *dev = vi->dev;struct sk_buff *skb;struct virtio_net_common_hdr *hdr; +u8 flags;if (unlikely (len < vi->hdr_len +ETH_HLEN )) {pr_debug ("%s: short packet %i\n" , dev->name, len);
@@ -1816,6 +1825,15 @@ static void receive_buf(struct virtnet_info *vi, struct receive_queue *rq,return ; } +/* 1. Save the flags early, as the XDP program might overwrite them. +* These flags ensure packets marked as VIRTIO_NET_HDR_F_DATA_VALID +* stay valid after XDP processing. +* 2. XDP doesn't work with partially checksummed packets (refer to +* virtnet_xdp_set()), so packets marked as +* VIRTIO_NET_HDR_F_NEEDS_CSUM get dropped during XDP processing. +*/ + flags = ((struct virtio_net_common_hdr *)buf)->hdr.flags; +if (vi->mergeable_rx_bufs) skb =receive_mergeable (dev, vi, rq, buf, ctx, len, xdp_xmit, stats);
@@ -1831,7 +1849,7 @@ static void receive_buf(struct virtnet_info *vi, struct receive_queue *rq,if (dev->features &NETIF_F_RXHASH && vi->has_rss_hash_report)virtio_skb_set_hash (&hdr->hash_v1_hdr, skb); -if (hdr->hdr.flags &VIRTIO_NET_HDR_F_DATA_VALID ) +if (flags &VIRTIO_NET_HDR_F_DATA_VALID ) skb->ip_summed =CHECKSUM_UNNECESSARY ; if (virtio_net_hdr_to_skb(skb, &hdr->hdr,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 134/250 octeontx2-pf: Add error handling to VLAN unoffload handling
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Horman <[email protected]>
[ Upstream commit b95a4afe2defd6f46891985f9436a568cd35a31c ]
otx2_sq_append_skb makes used of __vlan_hwaccel_push_inside() to unoffload VLANs - push them from skb meta data into skb data. However, it omitts a check for __vlan_hwaccel_push_inside() returning NULL.
Found by inspection based on [1] and [2].
Compile tested only.
[1] Re: [PATCH net-next v1] net: stmmac: Enable TSO on VLANs
https://lore.kernel.org/all/[email protected]/ [2] Re: [PATCH net-next v2] net: stmmac: Enable TSO on VLANs https://lore.kernel.org/all/CANn89i+11L5=tKsa7V7Aeyxaj6nYGRwy35PAbCRYJ73G+b25sg@mail.gmail.com/
--- drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c +4 -1
@@ -1171,8 +1171,11 @@ bool otx2_sq_append_skb(struct net_device *netdev, struct otx2_snd_queue *sq,if (skb_shinfo (skb)->gso_size && !is_hw_tso_supported (pfvf, skb)) {/* Insert vlan tag before giving pkt to tso */ -if (skb_vlan_tag_present (skb)) +if (skb_vlan_tag_present (skb)) { skb =__vlan_hwaccel_push_inside (skb); +if (!skb) +return true; + }otx2_sq_append_tso (pfvf, sq, skb, qidx);return true; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 135/250 octeontx2-pf: Fix linking objects into multiple modules
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geetha sowjanya <[email protected]>
[ Upstream commit 1062d03827b78614259b3b4b992deb27ee6aa84d ]
This patch fixes the below build warning messages that are caused due to linking same files to multiple modules by exporting the required symbols.
"scripts/Makefile.build:244: drivers/net/ethernet/marvell/octeontx2/nic/Makefile:
otx2_devlink.o is added to multiple modules: rvu_nicpf rvu_nicvf
scripts/Makefile.build:244: drivers/net/ethernet/marvell/octeontx2/nic/Makefile:
otx2_dcbnl.o is added to multiple modules: rvu_nicpf rvu_nicvf"
--- drivers/net/ethernet/marvell/octeontx2/nic/Makefile | 3 +-- drivers/net/ethernet/marvell/octeontx2/nic/otx2_dcbnl.c | 7 +++++++ drivers/net/ethernet/marvell/octeontx2/nic/otx2_devlink.c | 2 ++ 3 files changed, 10 insertions(+), 2 deletions(-)
drivers/net/ethernet/marvell/octeontx2/nic/Makefile +1 -2
@@ -9,10 +9,9 @@ obj-$(CONFIG_OCTEONTX2_VF) += rvu_nicvf.o otx2_ptp.o rvu_nicpf-y := otx2_pf.o otx2_common.o otx2_txrx.o otx2_ethtool.o \ otx2_flows.o otx2_tc.o cn10k.o otx2_dmac_flt.o \ otx2_devlink.o qos_sq.o qos.o -rvu_nicvf-y := otx2_vf.o otx2_devlink.o +rvu_nicvf-y := otx2_vf.o rvu_nicpf-$(CONFIG_DCB) += otx2_dcbnl.o -rvu_nicvf-$(CONFIG_DCB) += otx2_dcbnl.o rvu_nicpf-$(CONFIG_MACSEC) += cn10k_macsec.o ccflags-y += -I$(srctree)/drivers/net/ethernet/marvell/octeontx2/af
drivers/net/ethernet/marvell/octeontx2/nic/otx2_dcbnl.c +7 -0
@@ -54,6 +54,7 @@ int otx2_pfc_txschq_config(struct otx2_nic *pfvf)return 0 ; } +EXPORT_SYMBOL (otx2_pfc_txschq_config);static int otx2_pfc_txschq_alloc_one (struct otx2_nic *pfvf,u8 prio) {
@@ -122,6 +123,7 @@ int otx2_pfc_txschq_alloc(struct otx2_nic *pfvf)return 0 ; } +EXPORT_SYMBOL (otx2_pfc_txschq_alloc);static int otx2_pfc_txschq_stop_one (struct otx2_nic *pfvf,u8 prio) {
@@ -260,6 +262,7 @@ int otx2_pfc_txschq_update(struct otx2_nic *pfvf)return 0 ; } +EXPORT_SYMBOL (otx2_pfc_txschq_update);int otx2_pfc_txschq_stop (struct otx2_nic *pfvf) {
@@ -282,6 +285,7 @@ int otx2_pfc_txschq_stop(struct otx2_nic *pfvf)return 0 ; } +EXPORT_SYMBOL (otx2_pfc_txschq_stop);int otx2_config_priority_flow_ctrl (struct otx2_nic *pfvf) {
@@ -321,6 +325,7 @@ int otx2_config_priority_flow_ctrl(struct otx2_nic *pfvf)mutex_unlock (&pfvf->mbox.lock);return err; } +EXPORT_SYMBOL (otx2_config_priority_flow_ctrl);void otx2_update_bpid_in_rqctx (struct otx2_nic *pfvf,int vlan_prio,int qidx,bool pfc_enable)
@@ -385,6 +390,7 @@ void otx2_update_bpid_in_rqctx(struct otx2_nic *pfvf, int vlan_prio, int qidx,"Updating BPIDs in CQ and Aura contexts of RQ%d failed with err %d\n" , qidx, err); } +EXPORT_SYMBOL (otx2_update_bpid_in_rqctx);static int otx2_dcbnl_ieee_getpfc (struct net_device *dev,struct ieee_pfc *pfc) {
@@ -472,3 +478,4 @@ int otx2_dcbnl_set_ops(struct net_device *dev)return 0 ; } +EXPORT_SYMBOL (otx2_dcbnl_set_ops);
drivers/net/ethernet/marvell/octeontx2/nic/otx2_devlink.c +2 -0
@@ -112,6 +112,7 @@ int otx2_register_dl(struct otx2_nic *pfvf)devlink_free (dl);return err; } +EXPORT_SYMBOL (otx2_register_dl);void otx2_unregister_dl (struct otx2_nic *pfvf) {
@@ -123,3 +124,4 @@ void otx2_unregister_dl(struct otx2_nic *pfvf) ARRAY_SIZE(otx2_dl_params));devlink_free (dl); } +EXPORT_SYMBOL (otx2_unregister_dl);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 136/250 netfilter: ipset: Fix suspicious rcu_dereference_protected()
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jozsef Kadlecsik <[email protected]>
[ Upstream commit 8ecd06277a7664f4ef018abae3abd3451d64e7a6 ]
When destroying all sets, we are either in pernet exit phase or are executing a "destroy all sets command" from userspace. The latter was taken into account in ip_set_dereference() (nfnetlink mutex is held), but the former was not. The patch adds the required check to rcu_dereference_protected() in ip_set_dereference().
--- net/netfilter/ipset/ip_set_core.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
net/netfilter/ipset/ip_set_core.c +6 -5
@@ -53,12 +53,13 @@ MODULE_DESCRIPTION("core IP set support");MODULE_ALIAS_NFNL_SUBSYS (NFNL_SUBSYS_IPSET );/* When the nfnl mutex or ip_set_ref_lock is held: */ -#define ip_set_dereference (p) \ - rcu_dereference_protected(p, \ +#define ip_set_dereference (inst) \ + rcu_dereference_protected((inst)->ip_set_list, \ lockdep_nfnl_is_held(NFNL_SUBSYS_IPSET) || \ - lockdep_is_held(&ip_set_ref_lock)) + lockdep_is_held(&ip_set_ref_lock) || \ + (inst)->is_deleted)#define ip_set (inst, id) \ - ip_set_dereference((inst)->ip_set_list)[id] + ip_set_dereference(inst)[id]#define ip_set_ref_netlink (inst,id) \ rcu_dereference_raw((inst)->ip_set_list)[id]#define ip_set_dereference_nfnl (p) \
@@ -1133,7 +1134,7 @@ static int ip_set_create(struct sk_buff *skb, const struct nfnl_info *info,if (!list) goto cleanup;/* nfnl mutex is held, both lists are valid */ - tmp =ip_set_dereference (inst->ip_set_list); + tmp =ip_set_dereference (inst);memcpy (list, tmp,sizeof (struct ip_set *) * inst->ip_set_max);rcu_assign_pointer (inst->ip_set_list, list);/* Make sure all current packets have passed through */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 137/250 seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianguo Wu <[email protected]>
[ Upstream commit 9a3bc8d16e0aacd65c31aaf23a2bced3288a7779 ]
input_action_end_dx4() and input_action_end_dx6() are called NF_HOOK() for PREROUTING hook, in PREROUTING hook, we should passing a valid indev, and a NULL outdev to NF_HOOK(), otherwise may trigger a NULL pointer dereference, as below:
[74830.647293] BUG: kernel NULL pointer dereference, address: 0000000000000090
[74830.655633] #PF: supervisor read access in kernel mode
[74830.657888] #PF: error_code(0x0000) - not-present page
[74830.659500] PGD 0 P4D 0
[74830.660450] Oops: 0000 [#1] PREEMPT SMP PTI
...
[74830.664953] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
[74830.666569] RIP: 0010:rpfilter_mt+0x44/0x15e [ipt_rpfilter]
...
[74830.689725] Call Trace:
[74830.690402] <IRQ>
[74830.690953] ? show_trace_log_lvl+0x1c4/0x2df
[74830.692020] ? show_trace_log_lvl+0x1c4/0x2df
[74830.693095] ? ipt_do_table+0x286/0x710 [ip_tables]
[74830.694275] ? __die_body.cold+0x8/0xd
[74830.695205] ? page_fault_oops+0xac/0x140
[74830.696244] ? exc_page_fault+0x62/0x150
[74830.697225] ? asm_exc_page_fault+0x22/0x30
[74830.698344] ? rpfilter_mt+0x44/0x15e [ipt_rpfilter]
[74830.699540] ipt_do_table+0x286/0x710 [ip_tables]
[74830.700758] ? ip6_route_input+0x19d/0x240
[74830.701752] nf_hook_slow+0x3f/0xb0
[74830.702678] input_action_end_dx4+0x19b/0x1e0
[74830.703735] ? input_action_end_t+0xe0/0xe0
[74830.704734] seg6_local_input_core+0x2d/0x60
[74830.705782] lwtunnel_input+0x5b/0xb0
[74830.706690] __netif_receive_skb_one_core+0x63/0xa0
[74830.707825] process_backlog+0x99/0x140
[74830.709538] __napi_poll+0x2c/0x160
[74830.710673] net_rx_action+0x296/0x350
[74830.711860] __do_softirq+0xcb/0x2ac
[74830.713049] do_softirq+0x63/0x90input_action_end_dx4() passing a NULL indev to NF_HOOK(), and finally trigger a NULL dereference in rpfilter_mt()->rpfilter_is_loopback():
static bool
rpfilter_is_loopback(const struct sk_buff *skb,
const struct net_device *in)
{
// in is NULL
return skb->pkt_type == PACKET_LOOPBACK ||
in->flags & IFF_LOOPBACK;
}--- net/ipv6/seg6_local.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
net/ipv6/seg6_local.c +4 -4
@@ -941,8 +941,8 @@ static int input_action_end_dx6(struct sk_buff *skb,if (static_branch_unlikely (&nf_hooks_lwtunnel_enabled))return NF_HOOK (NFPROTO_IPV6 ,NF_INET_PRE_ROUTING , -dev_net (skb->dev),NULL , skb,NULL , -skb_dst (skb)->dev, input_action_end_dx6_finish); +dev_net (skb->dev),NULL , skb, skb->dev, +NULL , input_action_end_dx6_finish);return input_action_end_dx6_finish (dev_net (skb->dev),NULL , skb); drop:
@@ -991,8 +991,8 @@ static int input_action_end_dx4(struct sk_buff *skb,if (static_branch_unlikely (&nf_hooks_lwtunnel_enabled))return NF_HOOK (NFPROTO_IPV4 ,NF_INET_PRE_ROUTING , -dev_net (skb->dev),NULL , skb,NULL , -skb_dst (skb)->dev, input_action_end_dx4_finish); +dev_net (skb->dev),NULL , skb, skb->dev, +NULL , input_action_end_dx4_finish);return input_action_end_dx4_finish (dev_net (skb->dev),NULL , skb); drop:
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 138/250 netfilter: move the sysctl nf_hooks_lwtunnel into the netfilter core
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianguo Wu <[email protected]>
[ Upstream commit a2225e0250c5fa397dcebf6ce65a9f05a114e0cf ]
Currently, the sysctl net.netfilter.nf_hooks_lwtunnel depends on the nf_conntrack module, but the nf_conntrack module is not always loaded. Therefore, accessing net.netfilter.nf_hooks_lwtunnel may have an error.
Move sysctl nf_hooks_lwtunnel into the netfilter core.
--- include/net/netns/netfilter.h | 3 + net/netfilter/core.c | 13 +++++- net/netfilter/nf_conntrack_standalone.c | 15 ------- net/netfilter/nf_hooks_lwtunnel.c | 67 ++++++++++++++++++++++++++++++++ net/netfilter/nf_internals.h | 6 ++ 5 files changed, 87 insertions(+), 17 deletions(-)
include/net/netns/netfilter.h +3 -0
@@ -15,6 +15,9 @@ struct netns_nf {const struct nf_logger __rcu *nf_loggers[NFPROTO_NUMPROTO ];#ifdef CONFIG_SYSCTL struct ctl_table_header *nf_log_dir_header; +#ifdef CONFIG_LWTUNNEL +struct ctl_table_header *nf_lwtnl_dir_header; +#endif #endif struct nf_hook_entries __rcu *hooks_ipv4[NF_INET_NUMHOOKS ];struct nf_hook_entries __rcu *hooks_ipv6[NF_INET_NUMHOOKS ];
net/netfilter/core.c +11 -2
@@ -815,12 +815,21 @@ int __init netfilter_init(void)if (ret <0 ) goto err; +#ifdef CONFIG_LWTUNNEL + ret =netfilter_lwtunnel_init (); +if (ret <0 ) + goto err_lwtunnel_pernet; +#endif ret =netfilter_log_init ();if (ret <0 ) - goto err_pernet; + goto err_log_pernet;return 0 ; -err_pernet: +err_log_pernet: +#ifdef CONFIG_LWTUNNEL +netfilter_lwtunnel_fini (); +err_lwtunnel_pernet: +#endifunregister_pernet_subsys (&netfilter_net_ops); err:return ret;
net/netfilter/nf_conntrack_standalone.c +0 -15
@@ -22,9 +22,6 @@#include <net/netfilter/nf_conntrack_acct.h> #include <net/netfilter/nf_conntrack_zones.h> #include <net/netfilter/nf_conntrack_timestamp.h> -#ifdef CONFIG_LWTUNNEL -#include <net/netfilter/nf_hooks_lwtunnel.h> -#endif #include <linux/rculist_nulls.h> static bool enable_hooks__read_mostly ;
@@ -612,9 +609,6 @@ enum nf_ct_sysctl_index {NF_SYSCTL_CT_PROTO_TIMEOUT_GRE ,NF_SYSCTL_CT_PROTO_TIMEOUT_GRE_STREAM , #endif -#ifdef CONFIG_LWTUNNEL -NF_SYSCTL_CT_LWTUNNEL , -#endif __NF_SYSCTL_CT_LAST_SYSCTL, };
@@ -948,15 +942,6 @@ static struct ctl_table nf_ct_sysctl_tab .proc_handler = proc_dointvec_jiffies, },#endif -#ifdef CONFIG_LWTUNNEL - [NF_SYSCTL_CT_LWTUNNEL] = { - .procname = "nf_hooks_lwtunnel", - .data = NULL, - .maxlen = sizeof(int), - .mode = 0644, - .proc_handler = nf_hooks_lwtunnel_sysctl_handler, - }, -#endif {} };
net/netfilter/nf_hooks_lwtunnel.c +67 -0
77 lines not on this page · raw message
net/netfilter/nf_internals.h +6 -0
@@ -29,6 +29,12 @@ void nf_queue_nf_hook_drop(struct net *n/* nf_log.c */ int __init netfilter_log_init (void ); +#ifdef CONFIG_LWTUNNEL +/* nf_hooks_lwtunnel.c */ +int __init netfilter_lwtunnel_init (void ); +void netfilter_lwtunnel_fini (void ); +#endif +/* core.c */ void nf_hook_entries_delete_raw (struct nf_hook_entries __rcu **pp,const struct nf_hook_ops *reg);
Greg Kroah-Hartman
maintainerPATCH 139/250 ice: Fix VSI list rule with ICE_SW_LKUP_LAST type
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marcin Szycik <[email protected]>
[ Upstream commit 74382aebc9035470ec4c789bdb0d09d8c14f261e ]
Adding/updating VSI list rule, as well as allocating/freeing VSI list resource are called several times with type ICE_SW_LKUP_LAST, which fails because ice_update_vsi_list_rule() and ice_aq_alloc_free_vsi_list() consider it invalid. Allow calling these functions with ICE_SW_LKUP_LAST.
This fixes at least one issue in switchdev mode, where the same rule with different action cannot be added, e.g.:
tc filter add dev $PF1 ingress protocol arp prio 0 flower skip_sw \
dst_mac ff:ff:ff:ff:ff:ff action mirred egress redirect dev $VF1_PR
tc filter add dev $PF1 ingress protocol arp prio 0 flower skip_sw \
dst_mac ff:ff:ff:ff:ff:ff action mirred egress redirect dev $VF2_PR
--- drivers/net/ethernet/intel/ice/ice_switch.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/ethernet/intel/ice/ice_switch.c +4 -2
@@ -1825,7 +1825,8 @@ ice_aq_alloc_free_vsi_list(struct ice_hw *hw, u16 *vsi_list_id, lkup_type ==ICE_SW_LKUP_ETHERTYPE_MAC || lkup_type ==ICE_SW_LKUP_PROMISC || lkup_type ==ICE_SW_LKUP_PROMISC_VLAN || - lkup_type == ICE_SW_LKUP_DFLT) { + lkup_type ==ICE_SW_LKUP_DFLT || + lkup_type == ICE_SW_LKUP_LAST) { sw_buf->res_type = cpu_to_le16(ICE_AQC_RES_TYPE_VSI_LIST_REP); } else if (lkup_type == ICE_SW_LKUP_VLAN) {if (opc == ice_aqc_opc_alloc_res)
@@ -2759,7 +2760,8 @@ ice_update_vsi_list_rule(struct ice_hw *hw, u16 *vsi_handle_arr, u16 num_vsi, lkup_type ==ICE_SW_LKUP_ETHERTYPE_MAC || lkup_type ==ICE_SW_LKUP_PROMISC || lkup_type ==ICE_SW_LKUP_PROMISC_VLAN || - lkup_type == ICE_SW_LKUP_DFLT) + lkup_type ==ICE_SW_LKUP_DFLT || + lkup_type == ICE_SW_LKUP_LAST) rule_type = remove ? ICE_AQC_SW_RULES_T_VSI_LIST_CLEAR :ICE_AQC_SW_RULES_T_VSI_LIST_SET ; else if (lkup_type == ICE_SW_LKUP_VLAN)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 140/250 bnxt_en: Restore PTP tx_avail count in case of skb_pad() error
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavan Chebbi <[email protected]>
[ Upstream commit 1e7962114c10957fe4d10a15eb714578a394e90b ]
The current code only restores PTP tx_avail count when we get DMA mapping errors. Fix it so that the PTP tx_avail count will be restored for both DMA mapping errors and skb_pad() errors. Otherwise PTP TX timestamp will not be available after a PTP packet hits the skb_pad() error.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +2 -3
@@ -730,9 +730,6 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev)return NETDEV_TX_OK ; tx_dma_error: -if (BNXT_TX_PTP_IS_SET (lflags)) -atomic_inc (&bp->ptp_cfg->tx_avail); - last_frag = i;/* start back at beginning and unmap skb */
@@ -754,6 +751,8 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) tx_free:dev_kfree_skb_any (skb); tx_kick_pending: +if (BNXT_TX_PTP_IS_SET (lflags)) +atomic_inc (&bp->ptp_cfg->tx_avail);if (txr->kick_pending)bnxt_txr_db_kick (bp, txr, txr->tx_prod); txr->tx_buf_ring[txr->tx_prod].skb =NULL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 141/250 net: usb: rtl8150 fix unintiatilzed variables in rtl8150_get_link_ksettings
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
[ Upstream commit fba383985354e83474f95f36d7c65feb75dba19d ]
This functions retrieves values by passing a pointer. As the function that retrieves them can fail before touching the pointers, the variables must be initialized.
--- drivers/net/usb/rtl8150.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/usb/rtl8150.c +2 -1
@@ -778,7 +778,8 @@ static int rtl8150_get_link_ksettings(struct net_device *netdev, struct ethtool_link_ksettings *ecmd) {rtl8150_t *dev =netdev_priv (netdev); -short lpa, bmcr; +short lpa =0 ; +short bmcr =0 ;u32 supported; supported = (SUPPORTED_10baseT_Half |
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 142/250 RDMA/bnxt_re: Fix the max msix vectors macro
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Selvin Xavier <[email protected]>
[ Upstream commit 056620da899527c14cf36e5019a0decaf4cf0f79 ]
bnxt_re no longer decide the number of MSI-x vectors used by itself. Its decided by bnxt_en now. So when bnxt_en changes this value, system crash is seen.
Depend on the max value reported by bnxt_en instead of using the its own macros.
--- drivers/infiniband/hw/bnxt_re/bnxt_re.h | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/infiniband/hw/bnxt_re/bnxt_re.h +1 -3
@@ -107,8 +107,6 @@ struct bnxt_re_gsi_context {struct bnxt_re_sqp_entries *sqp_tbl; }; -#define BNXT_RE_MIN_MSIX 2 -#define BNXT_RE_MAX_MSIX 9#define BNXT_RE_AEQ_IDX 0#define BNXT_RE_NQ_IDX 1#define BNXT_RE_GEN_P5_MAX_VF 64
@@ -168,7 +166,7 @@ struct bnxt_re_dev {struct bnxt_qplib_rcfw rcfw;/* NQ */ -struct bnxt_qplib_nq nq[BNXT_RE_MAX_MSIX ]; +struct bnxt_qplib_nq nq[BNXT_MAX_ROCE_MSIX ];/* Device Resources */ struct bnxt_qplib_dev_attr dev_attr;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 143/250 arm64: dts: freescale: imx8mm-verdin: Fix GPU speed
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joao Paulo Goncalves <[email protected]>
[ Upstream commit 08f0fa5d6aa9488f752eb5410e32636f143b3d8e ]
The GPU clock was reduced on iMX8MM SOC device tree to prevent boards that don't support GPU overdrive from being out of specification. However, this caused a regression in GPU speed for the Verdin iMX8MM, which does support GPU overdrive. This patch fixes this by enabling overdrive mode in the SOM dtsi.
--- arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi +1 -0
@@ -6,6 +6,7 @@ #include <dt-bindings/phy/phy-imx8-pcie.h> #include <dt-bindings/pwm/pwm.h> #include "imx8mm.dtsi" +#include "imx8mm-overdrive.dtsi" / { chosen {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 144/250 phy: qcom-qmp: qserdes-txrx: Add missing registers offsets
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abel Vesa <[email protected]>
[ Upstream commit 5314e84c33e7ad61df5203df540626ac59f9dcd9 ]
Currently, the x1e80100 uses pure V6 register offsets for DP part of the combo PHY. This hasn't been an issue because external DP is not yet enabled on any of the boards yet. But in order to enabled it, all these new V6 N4 register offsets are needed. So add them.
--- .../phy/qualcomm/phy-qcom-qmp-qserdes-txrx-v6_n4.h | 13 +++++++++++++ 1 file changed, 13 insertions(+)
drivers/phy/qualcomm/phy-qcom-qmp-qserdes-txrx-v6_n4.h +13 -0
@@ -6,11 +6,24 @@#ifndef QCOM_PHY_QMP_QSERDES_TXRX_V6_N4_H_ #define QCOM_PHY_QMP_QSERDES_TXRX_V6_N4_H_ +#define QSERDES_V6_N4_TX_CLKBUF_ENABLE 0x08 +#define QSERDES_V6_N4_TX_TX_EMP_POST1_LVL 0x0c +#define QSERDES_V6_N4_TX_TX_DRV_LVL 0x14 +#define QSERDES_V6_N4_TX_RESET_TSYNC_EN 0x1c +#define QSERDES_V6_N4_TX_PRE_STALL_LDO_BOOST_EN 0x20#define QSERDES_V6_N4_TX_RES_CODE_LANE_OFFSET_TX 0x30#define QSERDES_V6_N4_TX_RES_CODE_LANE_OFFSET_RX 0x34 +#define QSERDES_V6_N4_TX_TRANSCEIVER_BIAS_EN 0x48 +#define QSERDES_V6_N4_TX_HIGHZ_DRVR_EN 0x4c +#define QSERDES_V6_N4_TX_TX_POL_INV 0x50 +#define QSERDES_V6_N4_TX_PARRATE_REC_DETECT_IDLE_EN 0x54#define QSERDES_V6_N4_TX_LANE_MODE_1 0x78#define QSERDES_V6_N4_TX_LANE_MODE_2 0x7c#define QSERDES_V6_N4_TX_LANE_MODE_3 0x80 +#define QSERDES_V6_N4_TX_TRAN_DRVR_EMP_EN 0xac +#define QSERDES_V6_N4_TX_TX_BAND 0xd8 +#define QSERDES_V6_N4_TX_INTERFACE_SELECT 0xe4 +#define QSERDES_V6_N4_TX_VMODE_CTRL1 0xb0#define QSERDES_V6_N4_RX_UCDR_FO_GAIN_RATE2 0x8#define QSERDES_V6_N4_RX_UCDR_SO_GAIN_RATE2 0x18
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 145/250 phy: qcom-qmp: pcs: Add missing v6 N4 register offsets
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abel Vesa <[email protected]>
[ Upstream commit 99bf89626335bbec71d8461f0faec88551440850 ]
The new X1E80100 SoC bumps up the HW version of QMP phy to v6 N4 for combo USB and DP PHY. Currently, the X1E80100 uses the pure V6 PCS register offsets, which are different. Add the offsets so the mentioned platform can be fixed later on. Add the new PCS offsets in a dedicated header file.
--- drivers/phy/qualcomm/phy-qcom-qmp-pcs-v6-n4.h | 32 +++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 drivers/phy/qualcomm/phy-qcom-qmp-pcs-v6-n4.h
drivers/phy/qualcomm/phy-qcom-qmp-pcs-v6-n4.h new file +32 -0
@@ -0,0 +1,32 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* +* Copyright (c) 2023, Linaro Limited +*/ + +#ifndef QCOM_PHY_QMP_PCS_V6_N4_H_ +#define QCOM_PHY_QMP_PCS_V6_N4_H_ + +/* Only for QMP V6 N4 PHY - USB/PCIe PCS registers */ +#define QPHY_V6_N4_PCS_SW_RESET 0x000 +#define QPHY_V6_N4_PCS_PCS_STATUS1 0x014 +#define QPHY_V6_N4_PCS_POWER_DOWN_CONTROL 0x040 +#define QPHY_V6_N4_PCS_START_CONTROL 0x044 +#define QPHY_V6_N4_PCS_POWER_STATE_CONFIG1 0x090 +#define QPHY_V6_N4_PCS_LOCK_DETECT_CONFIG1 0x0c4 +#define QPHY_V6_N4_PCS_LOCK_DETECT_CONFIG2 0x0c8 +#define QPHY_V6_N4_PCS_LOCK_DETECT_CONFIG3 0x0cc +#define QPHY_V6_N4_PCS_LOCK_DETECT_CONFIG6 0x0d8 +#define QPHY_V6_N4_PCS_REFGEN_REQ_CONFIG1 0x0dc +#define QPHY_V6_N4_PCS_RX_SIGDET_LVL 0x188 +#define QPHY_V6_N4_PCS_RCVR_DTCT_DLY_P1U2_L 0x190 +#define QPHY_V6_N4_PCS_RCVR_DTCT_DLY_P1U2_H 0x194 +#define QPHY_V6_N4_PCS_RATE_SLEW_CNTRL1 0x198 +#define QPHY_V6_N4_PCS_RX_CONFIG 0x1b0 +#define QPHY_V6_N4_PCS_ALIGN_DETECT_CONFIG1 0x1c0 +#define QPHY_V6_N4_PCS_ALIGN_DETECT_CONFIG2 0x1c4 +#define QPHY_V6_N4_PCS_PCS_TX_RX_CONFIG 0x1d0 +#define QPHY_V6_N4_PCS_EQ_CONFIG1 0x1dc +#define QPHY_V6_N4_PCS_EQ_CONFIG2 0x1e0 +#define QPHY_V6_N4_PCS_EQ_CONFIG5 0x1ec + +#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 146/250 phy: qcom: qmp-combo: Switch from V6 to V6 N4 register offsets
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abel Vesa <[email protected]>
[ Upstream commit 163c1a356a847ab4767200fd4a45b3f8e4ddc900 ]
Currently, none of the X1E80100 supported boards upstream have enabled DP. As for USB, the reason it is not broken when it's obvious that the offsets are wrong is because the only difference with respect to USB is the difference in register name. The V6 uses QPHY_V6_PCS_CDR_RESET_TIME while V6 N4 uses QPHY_V6_N4_PCS_RX_CONFIG. Now, in order for the DP to work, the DP serdes tables need to be added as they have different values for V6 N4 when compared to V6 ones, even though they use the same V6 offsets. While at it, switch swing and pre-emphasis tables to V6 as well.
--- drivers/phy/qualcomm/phy-qcom-qmp-combo.c | 189 ++++++++++++++++++---- drivers/phy/qualcomm/phy-qcom-qmp.h | 2 + 2 files changed, 162 insertions(+), 29 deletions(-)
drivers/phy/qualcomm/phy-qcom-qmp-combo.c +160 -29
@@ -187,6 +187,31 @@ static const unsigned int qmp_v6_usb3phy_regs_layout[QPHY_LAYOUT_SIZE] = { [QPHY_TX_TRANSCEIVER_BIAS_EN] = QSERDES_V6_TX_TRANSCEIVER_BIAS_EN, }; +static const unsigned int qmp_v6_n4_usb3phy_regs_layout[QPHY_LAYOUT_SIZE ] = { + [QPHY_SW_RESET ] =QPHY_V6_N4_PCS_SW_RESET , + [QPHY_START_CTRL ] =QPHY_V6_N4_PCS_START_CONTROL , + [QPHY_PCS_STATUS ] =QPHY_V6_N4_PCS_PCS_STATUS1 , + [QPHY_PCS_POWER_DOWN_CONTROL ] =QPHY_V6_N4_PCS_POWER_DOWN_CONTROL , + +/* In PCS_USB */ + [QPHY_PCS_AUTONOMOUS_MODE_CTRL ] =QPHY_V6_PCS_USB3_AUTONOMOUS_MODE_CTRL , + [QPHY_PCS_LFPS_RXTERM_IRQ_CLEAR ] =QPHY_V6_PCS_USB3_LFPS_RXTERM_IRQ_CLEAR , + + [QPHY_COM_RESETSM_CNTRL ] =QSERDES_V6_COM_RESETSM_CNTRL , + [QPHY_COM_C_READY_STATUS ] =QSERDES_V6_COM_C_READY_STATUS , + [QPHY_COM_CMN_STATUS ] =QSERDES_V6_COM_CMN_STATUS , + [QPHY_COM_BIAS_EN_CLKBUFLR_EN ] =QSERDES_V6_COM_PLL_BIAS_EN_CLK_BUFLR_EN , + + [QPHY_DP_PHY_STATUS ] =QSERDES_V6_DP_PHY_STATUS , + [QPHY_DP_PHY_VCO_DIV ] =QSERDES_V6_DP_PHY_VCO_DIV , + + [QPHY_TX_TX_POL_INV ] =QSERDES_V6_N4_TX_TX_POL_INV , + [QPHY_TX_TX_DRV_LVL ] =QSERDES_V6_N4_TX_TX_DRV_LVL , + [QPHY_TX_TX_EMP_POST1_LVL ] =QSERDES_V6_N4_TX_TX_EMP_POST1_LVL , + [QPHY_TX_HIGHZ_DRVR_EN ] =QSERDES_V6_N4_TX_HIGHZ_DRVR_EN , + [QPHY_TX_TRANSCEIVER_BIAS_EN ] =QSERDES_V6_N4_TX_TRANSCEIVER_BIAS_EN , +}; +static const struct qmp_phy_init_tbl qmp_v3_usb3_serdes_tbl[] = {QMP_PHY_INIT_CFG (QSERDES_V3_COM_PLL_IVCO ,0x07 ),QMP_PHY_INIT_CFG (QSERDES_V3_COM_SYSCLK_EN_SEL ,0x14 ),
@@ -997,6 +1022,31 @@ static const struct qmp_phy_init_tbl qmp_v6_dp_serdes_tbl[] = { QMP_PHY_INIT_CFG(QSERDES_V6_COM_CORE_CLK_EN, 0x0f), }; +static const struct qmp_phy_init_tbl qmp_v6_n4_dp_serdes_tbl[] = { +QMP_PHY_INIT_CFG (QSERDES_V6_COM_SVS_MODE_CLK_SEL ,0x15 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_SYSCLK_EN_SEL ,0x3b ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_SYS_CLK_CTRL ,0x02 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_CLK_ENABLE1 ,0x0c ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_SYSCLK_BUF_ENABLE ,0x06 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_CLK_SELECT ,0x30 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_PLL_IVCO ,0x07 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_PLL_CCTRL_MODE0 ,0x36 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_PLL_RCTRL_MODE0 ,0x16 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_CP_CTRL_MODE0 ,0x06 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_DEC_START_MODE0 ,0x34 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_DIV_FRAC_START1_MODE0 ,0x00 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_DIV_FRAC_START2_MODE0 ,0xc0 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_CMN_CONFIG_1 ,0x12 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_INTEGLOOP_GAIN0_MODE0 ,0x3f ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_INTEGLOOP_GAIN1_MODE0 ,0x00 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_VCO_TUNE_MAP ,0x00 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_BG_TIMER ,0x0a ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_PLL_CORE_CLK_DIV_MODE0 ,0x14 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_VCO_TUNE_CTRL ,0x00 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_PLL_BIAS_EN_CLK_BUFLR_EN ,0x17 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_CORE_CLK_EN ,0x0f ), +}; +static const struct qmp_phy_init_tbl qmp_v6_dp_tx_tbl[] = {QMP_PHY_INIT_CFG (QSERDES_V6_TX_VMODE_CTRL1 ,0x40 ),QMP_PHY_INIT_CFG (QSERDES_V6_TX_PRE_STALL_LDO_BOOST_EN ,0x30 ),
@@ -1011,6 +1061,19 @@ static const struct qmp_phy_init_tbl qmp_v6_dp_tx_tbl[] = { QMP_PHY_INIT_CFG(QSERDES_V6_TX_TX_BAND, 0x4), }; +static const struct qmp_phy_init_tbl qmp_v6_n4_dp_tx_tbl[] = { +QMP_PHY_INIT_CFG (QSERDES_V6_N4_TX_VMODE_CTRL1 ,0x40 ), +QMP_PHY_INIT_CFG (QSERDES_V6_N4_TX_PRE_STALL_LDO_BOOST_EN ,0x00 ), +QMP_PHY_INIT_CFG (QSERDES_V6_N4_TX_INTERFACE_SELECT ,0xff ), +QMP_PHY_INIT_CFG (QSERDES_V6_N4_TX_CLKBUF_ENABLE ,0x0f ), +QMP_PHY_INIT_CFG (QSERDES_V6_N4_TX_RESET_TSYNC_EN ,0x03 ), +QMP_PHY_INIT_CFG (QSERDES_V6_N4_TX_TRAN_DRVR_EMP_EN ,0x0f ), +QMP_PHY_INIT_CFG (QSERDES_V6_N4_TX_PARRATE_REC_DETECT_IDLE_EN ,0x00 ), +QMP_PHY_INIT_CFG (QSERDES_V6_N4_TX_RES_CODE_LANE_OFFSET_TX ,0x11 ), +QMP_PHY_INIT_CFG (QSERDES_V6_N4_TX_RES_CODE_LANE_OFFSET_RX ,0x11 ), +QMP_PHY_INIT_CFG (QSERDES_V6_N4_TX_TX_BAND ,0x1 ), +}; +static const struct qmp_phy_init_tbl qmp_v6_dp_serdes_tbl_rbr[] = {QMP_PHY_INIT_CFG (QSERDES_V6_COM_HSCLK_SEL_1 ,0x05 ),QMP_PHY_INIT_CFG (QSERDES_V6_COM_DEC_START_MODE0 ,0x34 ),
@@ -1059,6 +1122,74 @@ static const struct qmp_phy_init_tbl qmp_v6_dp_serdes_tbl_hbr3[] = { QMP_PHY_INIT_CFG(QSERDES_V6_COM_BIN_VCOCAL_CMP_CODE2_MODE0, 0x0c), }; +static const struct qmp_phy_init_tbl qmp_v6_n4_dp_serdes_tbl_rbr[] = { +QMP_PHY_INIT_CFG (QSERDES_V6_COM_HSCLK_SEL_1 ,0x05 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_DEC_START_MODE0 ,0x34 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_LOCK_CMP_EN ,0x04 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_DIV_FRAC_START3_MODE0 ,0x0b ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_LOCK_CMP1_MODE0 ,0x37 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_LOCK_CMP2_MODE0 ,0x04 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_BIN_VCOCAL_CMP_CODE1_MODE0 ,0x71 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_BIN_VCOCAL_CMP_CODE2_MODE0 ,0x0c ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_SSC_EN_CENTER ,0x01 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_SSC_ADJ_PER1 ,0x00 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_SSC_PER1 ,0x6b ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_SSC_PER2 ,0x02 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_SSC_STEP_SIZE1_MODE0 ,0x92 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_SSC_STEP_SIZE2_MODE0 ,0x01 ), +}; + +static const struct qmp_phy_init_tbl qmp_v6_n4_dp_serdes_tbl_hbr[] = { +QMP_PHY_INIT_CFG (QSERDES_V6_COM_HSCLK_SEL_1 ,0x03 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_DEC_START_MODE0 ,0x34 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_LOCK_CMP_EN ,0x08 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_DIV_FRAC_START3_MODE0 ,0x0b ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_LOCK_CMP1_MODE0 ,0x07 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_LOCK_CMP2_MODE0 ,0x07 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_BIN_VCOCAL_CMP_CODE1_MODE0 ,0x71 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_BIN_VCOCAL_CMP_CODE2_MODE0 ,0x0c ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_SSC_EN_CENTER ,0x01 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_SSC_ADJ_PER1 ,0x00 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_SSC_PER1 ,0x6b ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_SSC_PER2 ,0x02 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_SSC_STEP_SIZE1_MODE0 ,0x92 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_SSC_STEP_SIZE2_MODE0 ,0x01 ), +}; + +static const struct qmp_phy_init_tbl qmp_v6_n4_dp_serdes_tbl_hbr2[] = { +QMP_PHY_INIT_CFG (QSERDES_V6_COM_HSCLK_SEL_1 ,0x01 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_DEC_START_MODE0 ,0x46 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_LOCK_CMP_EN ,0x08 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_DIV_FRAC_START3_MODE0 ,0x05 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_LOCK_CMP1_MODE0 ,0x0f ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_LOCK_CMP2_MODE0 ,0x0e ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_BIN_VCOCAL_CMP_CODE1_MODE0 ,0x97 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_BIN_VCOCAL_CMP_CODE2_MODE0 ,0x10 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_SSC_EN_CENTER ,0x01 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_SSC_ADJ_PER1 ,0x00 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_SSC_PER1 ,0x6b ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_SSC_PER2 ,0x02 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_SSC_STEP_SIZE1_MODE0 ,0x18 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_SSC_STEP_SIZE2_MODE0 ,0x02 ), +}; + +static const struct qmp_phy_init_tbl qmp_v6_n4_dp_serdes_tbl_hbr3[] = { +QMP_PHY_INIT_CFG (QSERDES_V6_COM_HSCLK_SEL_1 ,0x00 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_DEC_START_MODE0 ,0x34 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_LOCK_CMP_EN ,0x08 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_DIV_FRAC_START3_MODE0 ,0x0b ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_LOCK_CMP1_MODE0 ,0x17 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_LOCK_CMP2_MODE0 ,0x15 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_BIN_VCOCAL_CMP_CODE1_MODE0 ,0x71 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_BIN_VCOCAL_CMP_CODE2_MODE0 ,0x0c ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_SSC_EN_CENTER ,0x01 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_SSC_ADJ_PER1 ,0x00 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_SSC_PER1 ,0x6b ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_SSC_PER2 ,0x02 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_SSC_STEP_SIZE1_MODE0 ,0x92 ), +QMP_PHY_INIT_CFG (QSERDES_V6_COM_SSC_STEP_SIZE2_MODE0 ,0x01 ), +}; +static const struct qmp_phy_init_tbl sc8280xp_usb43dp_serdes_tbl[] = {QMP_PHY_INIT_CFG (QSERDES_V5_COM_SSC_EN_CENTER ,0x01 ),QMP_PHY_INIT_CFG (QSERDES_V5_COM_SSC_PER1 ,0x31 ),
@@ -1273,20 +1404,20 @@ static const struct qmp_phy_init_tbl x1e80100_usb43dp_rx_tbl[] = { };static const struct qmp_phy_init_tbl x1e80100_usb43dp_pcs_tbl[] = { -QMP_PHY_INIT_CFG (QPHY_V6_PCS_RCVR_DTCT_DLY_P1U2_L ,0xe7 ), -QMP_PHY_INIT_CFG (QPHY_V6_PCS_RCVR_DTCT_DLY_P1U2_H ,0x03 ), -QMP_PHY_INIT_CFG (QPHY_V6_PCS_LOCK_DETECT_CONFIG1 ,0xc4 ), -QMP_PHY_INIT_CFG (QPHY_V6_PCS_LOCK_DETECT_CONFIG2 ,0x89 ), -QMP_PHY_INIT_CFG (QPHY_V6_PCS_LOCK_DETECT_CONFIG3 ,0x20 ), -QMP_PHY_INIT_CFG (QPHY_V6_PCS_LOCK_DETECT_CONFIG6 ,0x13 ), -QMP_PHY_INIT_CFG (QPHY_V6_PCS_REFGEN_REQ_CONFIG1 ,0x21 ), -QMP_PHY_INIT_CFG (QPHY_V6_PCS_RX_SIGDET_LVL ,0x55 ), -QMP_PHY_INIT_CFG (QPHY_V6_PCS_CDR_RESET_TIME ,0x0a ), -QMP_PHY_INIT_CFG (QPHY_V6_PCS_ALIGN_DETECT_CONFIG1 ,0xd4 ), -QMP_PHY_INIT_CFG (QPHY_V6_PCS_ALIGN_DETECT_CONFIG2 ,0x30 ), -QMP_PHY_INIT_CFG (QPHY_V6_PCS_PCS_TX_RX_CONFIG ,0x0c ), -QMP_PHY_INIT_CFG (QPHY_V6_PCS_EQ_CONFIG1 ,0x4b ), -QMP_PHY_INIT_CFG (QPHY_V6_PCS_EQ_CONFIG5 ,0x10 ), +QMP_PHY_INIT_CFG (QPHY_V6_N4_PCS_RCVR_DTCT_DLY_P1U2_L ,0xe7 ), +QMP_PHY_INIT_CFG (QPHY_V6_N4_PCS_RCVR_DTCT_DLY_P1U2_H ,0x03 ), +QMP_PHY_INIT_CFG (QPHY_V6_N4_PCS_LOCK_DETECT_CONFIG1 ,0xc4 ), +QMP_PHY_INIT_CFG (QPHY_V6_N4_PCS_LOCK_DETECT_CONFIG2 ,0x89 ), +QMP_PHY_INIT_CFG (QPHY_V6_N4_PCS_LOCK_DETECT_CONFIG3 ,0x20 ), +QMP_PHY_INIT_CFG (QPHY_V6_N4_PCS_LOCK_DETECT_CONFIG6 ,0x13 ), +QMP_PHY_INIT_CFG (QPHY_V6_N4_PCS_REFGEN_REQ_CONFIG1 ,0x21 ), +QMP_PHY_INIT_CFG (QPHY_V6_N4_PCS_RX_SIGDET_LVL ,0x55 ), +QMP_PHY_INIT_CFG (QPHY_V6_N4_PCS_RX_CONFIG ,0x0a ), +QMP_PHY_INIT_CFG (QPHY_V6_N4_PCS_ALIGN_DETECT_CONFIG1 ,0xd4 ), +QMP_PHY_INIT_CFG (QPHY_V6_N4_PCS_ALIGN_DETECT_CONFIG2 ,0x30 ), +QMP_PHY_INIT_CFG (QPHY_V6_N4_PCS_PCS_TX_RX_CONFIG ,0x0c ), +QMP_PHY_INIT_CFG (QPHY_V6_N4_PCS_EQ_CONFIG1 ,0x4b ), +QMP_PHY_INIT_CFG (QPHY_V6_N4_PCS_EQ_CONFIG5 ,0x10 ), };static const struct qmp_phy_init_tbl x1e80100_usb43dp_pcs_usb_tbl[] = {
@@ -1794,22 +1925,22 @@ static const struct qmp_phy_cfg x1e80100_usb3dpphy_cfg = { .pcs_usb_tbl = x1e80100_usb43dp_pcs_usb_tbl, .pcs_usb_tbl_num = ARRAY_SIZE(x1e80100_usb43dp_pcs_usb_tbl), - .dp_serdes_tbl = qmp_v6_dp_serdes_tbl, - .dp_serdes_tbl_num = ARRAY_SIZE(qmp_v6_dp_serdes_tbl), - .dp_tx_tbl = qmp_v6_dp_tx_tbl, - .dp_tx_tbl_num = ARRAY_SIZE(qmp_v6_dp_tx_tbl), + .dp_serdes_tbl = qmp_v6_n4_dp_serdes_tbl, + .dp_serdes_tbl_num = ARRAY_SIZE(qmp_v6_n4_dp_serdes_tbl), + .dp_tx_tbl = qmp_v6_n4_dp_tx_tbl, + .dp_tx_tbl_num = ARRAY_SIZE(qmp_v6_n4_dp_tx_tbl), - .serdes_tbl_rbr = qmp_v6_dp_serdes_tbl_rbr, - .serdes_tbl_rbr_num = ARRAY_SIZE(qmp_v6_dp_serdes_tbl_rbr), - .serdes_tbl_hbr = qmp_v6_dp_serdes_tbl_hbr, - .serdes_tbl_hbr_num = ARRAY_SIZE(qmp_v6_dp_serdes_tbl_hbr), - .serdes_tbl_hbr2 = qmp_v6_dp_serdes_tbl_hbr2, - .serdes_tbl_hbr2_num = ARRAY_SIZE(qmp_v6_dp_serdes_tbl_hbr2), - .serdes_tbl_hbr3 = qmp_v6_dp_serdes_tbl_hbr3, - .serdes_tbl_hbr3_num = ARRAY_SIZE(qmp_v6_dp_serdes_tbl_hbr3), + .serdes_tbl_rbr = qmp_v6_n4_dp_serdes_tbl_rbr, + .serdes_tbl_rbr_num = ARRAY_SIZE(qmp_v6_n4_dp_serdes_tbl_rbr), + .serdes_tbl_hbr = qmp_v6_n4_dp_serdes_tbl_hbr, + .serdes_tbl_hbr_num = ARRAY_SIZE(qmp_v6_n4_dp_serdes_tbl_hbr), + .serdes_tbl_hbr2 = qmp_v6_n4_dp_serdes_tbl_hbr2, + .serdes_tbl_hbr2_num = ARRAY_SIZE(qmp_v6_n4_dp_serdes_tbl_hbr2), + .serdes_tbl_hbr3 = qmp_v6_n4_dp_serdes_tbl_hbr3, + .serdes_tbl_hbr3_num = ARRAY_SIZE(qmp_v6_n4_dp_serdes_tbl_hbr3), - .swing_hbr_rbr = &qmp_dp_v5_voltage_swing_hbr_rbr, - .pre_emphasis_hbr_rbr = &qmp_dp_v5_pre_emphasis_hbr_rbr, + .swing_hbr_rbr = &qmp_dp_v6_voltage_swing_hbr_rbr, + .pre_emphasis_hbr_rbr = &qmp_dp_v6_pre_emphasis_hbr_rbr, .swing_hbr3_hbr2 = &qmp_dp_v5_voltage_swing_hbr3_hbr2, .pre_emphasis_hbr3_hbr2 = &qmp_dp_v5_pre_emphasis_hbr3_hbr2,
@@ -1822,7 +1953,7 @@ static const struct qmp_phy_cfg x1e80100_usb3dpphy_cfg = { .num_resets = ARRAY_SIZE(msm8996_usb3phy_reset_l), .vreg_list = qmp_phy_vreg_l, .num_vregs = ARRAY_SIZE(qmp_phy_vreg_l), - .regs = qmp_v45_usb3phy_regs_layout, + .regs = qmp_v6_n4_usb3phy_regs_layout, };static const struct qmp_phy_cfg sm6350_usb3dpphy_cfg = {
drivers/phy/qualcomm/phy-qcom-qmp.h +2 -0
@@ -46,6 +46,8 @@#include "phy-qcom-qmp-pcs-v6.h" +#include "phy-qcom-qmp-pcs-v6-n4.h" +#include "phy-qcom-qmp-pcs-v6_20.h" #include "phy-qcom-qmp-pcs-v7.h"
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 147/250 powerpc/crypto: Add generated P8 asm to .gitignore
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Lynch <[email protected]>
[ Upstream commit 2b85b7fb1376481f7d4c2cf92e5da942f06b2547 ]
Looks like drivers/crypto/vmx/.gitignore should have been merged into arch/powerpc/crypto/.gitignore as part of commit 109303336a0c ("crypto: vmx - Move to arch/powerpc/crypto") so that all generated asm files are ignored.
--- arch/powerpc/crypto/.gitignore | 2 ++ 1 file changed, 2 insertions(+)
arch/powerpc/crypto/.gitignore +2 -0
@@ -1,3 +1,5 @@ # SPDX-License-Identifier: GPL-2.0-only aesp10-ppc.S +aesp8-ppc.S ghashp10-ppc.S +ghashp8-ppc.S
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 148/250 spi: cs42l43: Correct SPI root clock speed
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <[email protected]>
[ Upstream commit 4eecb644b8b82f5279a348f6ebe77e3d6e5b1b05 ]
The root clock is actually 49.152MHz not 40MHz, as it is derived from the primary audio clock, update the driver to match. This error can cause the actual clock rate to be higher than the requested clock rate on the SPI bus.
--- drivers/spi/spi-cs42l43.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-cs42l43.c +1 -1
@@ -21,7 +21,7 @@#include <linux/units.h> #define CS42L43_FIFO_SIZE 16 -#define CS42L43_SPI_ROOT_HZ (40 * HZ_PER_MHZ) +#define CS42L43_SPI_ROOT_HZ 49152000#define CS42L43_SPI_MAX_LENGTH 65532enum cs42l43_spi_cmd {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 149/250 RDMA/rxe: Fix responder length checking for UD request packets
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Honggang LI <[email protected]>
[ Upstream commit f67ac0061c7614c1548963d3ef1ee1606efd8636 ]
According to the IBA specification:
If a UD request packet is detected with an invalid length, the request shall be an invalid request and it shall be silently dropped by the responder. The responder then waits for a new request packet.
commit 689c5421bfe0 ("RDMA/rxe: Fix incorrect responder length checking") defers responder length check for UD QPs in function copy_data. But it introduces a regression issue for UD QPs.
When the packet size is too large to fit in the receive buffer. copy_data will return error code -EINVAL. Then send_data_in will return RESPST_ERR_MALFORMED_WQE. UD QP will transfer into ERROR state.
--- drivers/infiniband/sw/rxe/rxe_resp.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
drivers/infiniband/sw/rxe/rxe_resp.c +13 -0
@@ -354,6 +354,19 @@ static enum resp_states rxe_resp_check_length(struct rxe_qp *qp,* receive buffer later. For rmda operations additional * length checks are performed in check_rkey. */ +if ((qp_type (qp) ==IB_QPT_GSI ) || (qp_type (qp) ==IB_QPT_UD )) { +unsigned int payload =payload_size (pkt); +unsigned int recv_buffer_len =0 ; +int i; + +for (i =0 ; i < qp->resp.wqe->dma.num_sge; i++) + recv_buffer_len += qp->resp.wqe->dma.sge[i].length; +if (payload +40 > recv_buffer_len) { +rxe_dbg_qp (qp,"The receive buffer is too small for this UD packet.\n" ); +return RESPST_ERR_LENGTH ; + } + } +if (pkt->mask &RXE_PAYLOAD_MASK && ((qp_type (qp) ==IB_QPT_RC ) || (qp_type (qp) ==IB_QPT_UC ))) {unsigned int mtu = qp->mtu;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 150/250 regulator: core: Fix modpost error "regulator_get_regmap" undefined
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <[email protected]>
[ Upstream commit 3f60497c658d2072714d097a177612d34b34aa3d ]
Fix the modpost error "regulator_get_regmap" undefined by adding export symbol.
--- drivers/regulator/core.c | 1 + 1 file changed, 1 insertion(+)
drivers/regulator/core.c +1 -0
@@ -3347,6 +3347,7 @@ struct regmap *regulator_get_regmap(struct regulator *regulator)return map ? map :ERR_PTR (-EOPNOTSUPP ); } +EXPORT_SYMBOL_GPL (regulator_get_regmap);/** * regulator_get_hardware_vsel_register - get the HW voltage selector register
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 151/250 dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li RongQing <[email protected]>
[ Upstream commit e3215deca4520773cd2b155bed164c12365149a7 ]
Use list_for_each_entry_safe() to allow iterating through the list and deleting the entry in the iteration process. The descriptor is freed via idxd_desc_complete() and there's a slight chance may cause issue for the list iterator when the descriptor is reused by another thread without it being deleted from the list.
--- drivers/dma/idxd/irq.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/dma/idxd/irq.c +3 -1
@@ -611,11 +611,13 @@ static void irq_process_work_list(struct idxd_irq_entry *irq_entry)spin_unlock (&irq_entry->list_lock); -list_for_each_entry (desc, &flist, list) { +list_for_each_entry_safe (desc, n, &flist, list) {/* * Check against the original status as ABORT is software defined * and 0xff, which DSA_COMP_STATUS_MASK can mask out. */ +list_del (&desc->list); +if (unlikely (desc->completion->status ==IDXD_COMP_DESC_ABORT )) {idxd_desc_complete (desc,IDXD_COMPLETE_ABORT , true);continue ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 152/250 dmaengine: ti: k3-udma-glue: Fix of_k3_udma_glue_parse_chn_by_id()
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Siddharth Vadapalli <[email protected]>
[ Upstream commit ba27e9d2207784da748b19170a2e56bd7770bd81 ]
The of_k3_udma_glue_parse_chn_by_id() helper function erroneously invokes "of_node_put()" on the "udmax_np" device-node passed to it, without having incremented its reference count at any point. Fix it.
--- drivers/dma/ti/k3-udma-glue.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/dma/ti/k3-udma-glue.c +1 -4
@@ -200,12 +200,9 @@ of_k3_udma_glue_parse_chn_by_id(struct device_node *udmax_np, struct k3_udma_glu ret =of_k3_udma_glue_parse (udmax_np, common);if (ret) - goto out_put_spec; +return ret; ret =of_k3_udma_glue_parse_chn_common (common, thread_id, tx_chn); - -out_put_spec: -of_node_put (udmax_np);return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 153/250 dmaengine: ioatdma: Fix leaking on version mismatch
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Shubin <[email protected]>
[ Upstream commit 1b11b4ef6bd68591dcaf8423c7d05e794e6aec6f ]
Fix leaking ioatdma_device if I/OAT version is less than IOAT_VER_3_0.
--- drivers/dma/ioat/init.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-)
drivers/dma/ioat/init.c +10 -7
@@ -1350,6 +1350,7 @@ static int ioat_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)void __iomem *const *iomap;struct device *dev = &pdev->dev;struct ioatdma_device *device; +u8 version;int err; err =pcim_enable_device (pdev);
@@ -1363,6 +1364,10 @@ static int ioat_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)if (!iomap)return -ENOMEM ; + version =readb (iomap[IOAT_MMIO_BAR ] +IOAT_VER_OFFSET ); +if (version <IOAT_VER_3_0 ) +return -ENODEV ; + err =dma_set_mask_and_coherent (&pdev->dev,DMA_BIT_MASK (64 ));if (err)return err;
@@ -1373,16 +1378,14 @@ static int ioat_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)pci_set_master (pdev);pci_set_drvdata (pdev, device); - device->version =readb (device->reg_base +IOAT_VER_OFFSET ); + device->version = version;if (device->version >=IOAT_VER_3_4 ) ioat_dca_enabled =0 ; -if (device->version >=IOAT_VER_3_0 ) { -if (is_skx_ioat (pdev)) - device->version =IOAT_VER_3_2 ; - err =ioat3_dma_probe (device, ioat_dca_enabled); - }else -return -ENODEV ; +if (is_skx_ioat (pdev)) + device->version =IOAT_VER_3_2 ; + + err =ioat3_dma_probe (device, ioat_dca_enabled);if (err) {dev_err (dev,"Intel(R) I/OAT DMA Engine init failed\n" );return -ENODEV ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 154/250 dmaengine: ioatdma: Fix error path in ioat3_dma_probe()
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Shubin <[email protected]>
[ Upstream commit f0dc9fda2e0ee9e01496c2f5aca3a831131fad79 ]
Make sure we are disabling interrupts and destroying DMA pool if pcie_capability_read/write_word() call failed.
--- drivers/dma/ioat/init.c | 33 +++++++++++++++------------------ 1 file changed, 15 insertions(+), 18 deletions(-)
drivers/dma/ioat/init.c +15 -18
@@ -534,18 +534,6 @@ static int ioat_probe(struct ioatdma_device *ioat_dma)return err; } -static int ioat_register (struct ioatdma_device *ioat_dma) -{ -int err =dma_async_device_register (&ioat_dma->dma_dev); - -if (err) { -ioat_disable_interrupts (ioat_dma); -dma_pool_destroy (ioat_dma->completion_pool); - } - -return err; -} -static void ioat_dma_remove (struct ioatdma_device *ioat_dma) {struct dma_device *dma = &ioat_dma->dma_dev;
@@ -1181,9 +1169,9 @@ static int ioat3_dma_probe(struct ioatdma_device *ioat_dma, int dca) ioat_chan->reg_base + IOAT_DCACTRL_OFFSET); } - err =ioat_register (ioat_dma); + err =dma_async_device_register (&ioat_dma->dma_dev);if (err) -return err; + goto err_disable_interrupts;ioat_kobject_add (ioat_dma, &ioat_ktype);
@@ -1192,20 +1180,29 @@ static int ioat3_dma_probe(struct ioatdma_device *ioat_dma, int dca)/* disable relaxed ordering */ err =pcie_capability_read_word (pdev,PCI_EXP_DEVCTL , &val16); -if (err) -return pcibios_err_to_errno (err); +if (err) { + err =pcibios_err_to_errno (err); + goto err_disable_interrupts; + }/* clear relaxed ordering enable */ val16 &= ~PCI_EXP_DEVCTL_RELAX_EN ; err =pcie_capability_write_word (pdev,PCI_EXP_DEVCTL , val16); -if (err) -return pcibios_err_to_errno (err); +if (err) { + err =pcibios_err_to_errno (err); + goto err_disable_interrupts; + }if (ioat_dma->cap &IOAT_CAP_DPS )writeb (ioat_pending_level +1 , ioat_dma->reg_base +IOAT_PREFETCH_LIMIT_OFFSET );return 0 ; + +err_disable_interrupts: +ioat_disable_interrupts (ioat_dma); +dma_pool_destroy (ioat_dma->completion_pool); +return err; }static void ioat_shutdown (struct pci_dev *pdev)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 155/250 dmaengine: ioatdma: Fix kmemleak in ioat_pci_probe()
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Shubin <[email protected]>
[ Upstream commit 29b7cd255f3628e0d65be33a939d8b5bba10aa62 ]
If probing fails we end up with leaking ioatdma_device and each allocated channel.
Following kmemleak easy to reproduce by injecting an error in ioat_alloc_chan_resources() when doing ioat_dma_self_test().
unreferenced object 0xffff888014ad5800 (size 1024): [..]
[<ffffffff827692ca>] kmemleak_alloc+0x4a/0x80
[<ffffffff81430600>] kmalloc_trace+0x270/0x2f0
[<ffffffffa000b7d1>] ioat_pci_probe+0xc1/0x1c0 [ioatdma][..]
repeated for each ioatdma channel:
unreferenced object 0xffff8880148e5c00 (size 512): [..]
[<ffffffff827692ca>] kmemleak_alloc+0x4a/0x80
[<ffffffff81430600>] kmalloc_trace+0x270/0x2f0
[<ffffffffa0009641>] ioat_enumerate_channels+0x101/0x2d0 [ioatdma]
[<ffffffffa000b266>] ioat3_dma_probe+0x4d6/0x970 [ioatdma]
[<ffffffffa000b891>] ioat_pci_probe+0x181/0x1c0 [ioatdma][..]
--- drivers/dma/ioat/init.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/dma/ioat/init.c +4 -0
@@ -1347,6 +1347,7 @@ static int ioat_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)void __iomem *const *iomap;struct device *dev = &pdev->dev;struct ioatdma_device *device; +unsigned int i;u8 version;int err;
@@ -1384,6 +1385,9 @@ static int ioat_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) err =ioat3_dma_probe (device, ioat_dca_enabled);if (err) { +for (i =0 ; i <IOAT_MAX_CHANS ; i++) +kfree (device->idx[i]); +kfree (device);dev_err (dev,"Intel(R) I/OAT DMA Engine init failed\n" );return -ENODEV ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 156/250 dmaengine: fsl-edma: avoid linking both modules
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit fa555b5026d0bf1ba7c9e645ff75e2725a982631 ]
Kbuild does not support having a source file compiled multiple times and linked into distinct modules, or built-in and modular at the same time. For fs-edma, there are two common components that are linked into the fsl-edma.ko for Arm and PowerPC, plus the mcf-edma.ko module on Coldfire. This violates the rule for compile-testing:
scripts/Makefile.build:236: drivers/dma/Makefile: fsl-edma-common.o is added to multiple modules: fsl-edma mcf-edma scripts/Makefile.build:236: drivers/dma/Makefile: fsl-edma-trace.o is added to multiple modules: fsl-edma mcf-edma
I tried splitting out the common parts into a separate modules, but that adds back the complexity that a cleanup patch removed, and it gets harder with the addition of the tracepoints.
As a minimal workaround, address it at the Kconfig level, by disallowing the broken configurations.
--- drivers/dma/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/dma/Kconfig +1 -1
@@ -394,7 +394,7 @@ config LS2X_APB_DMA config MCF_EDMA tristate "Freescale eDMA engine support, ColdFire mcf5441x SoCs" - depends on M5441x || COMPILE_TEST + depends on M5441x || (COMPILE_TEST && FSL_EDMA=n) select DMA_ENGINE select DMA_VIRTUAL_CHANNELS help
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 157/250 dmaengine: ioatdma: Fix missing kmem_cache_destroy()
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Shubin <[email protected]>
[ Upstream commit 5422145d0b749ad554ada772133b9b20f9fb0ec8 ]
Fix missing kmem_cache_destroy() for ioat_sed_cache in ioat_exit_module().
Noticed via:
``` modprobe ioatdma rmmod ioatdma modprobe ioatdma debugfs: Directory 'ioat_sed_ent' with parent 'slab' already present! ```
--- drivers/dma/ioat/init.c | 1 + 1 file changed, 1 insertion(+)
drivers/dma/ioat/init.c +1 -0
@@ -1449,6 +1449,7 @@ module_init(ioat_init_module); static void __exit ioat_exit_module(void) {pci_unregister_driver (&ioat_pci_driver); +kmem_cache_destroy (ioat_sed_cache);kmem_cache_destroy (ioat_cache); }module_exit (ioat_exit_module);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 158/250 regulator: bd71815: fix ramp values
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kalle Niemi <[email protected]>
[ Upstream commit 4cac29b846f38d5f0654cdfff5c5bfc37305081c ]
Ramp values are inverted. This caused wrong values written to register when ramp values were defined in device tree.
Invert values in table to fix this.
--- drivers/regulator/bd71815-regulator.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/regulator/bd71815-regulator.c +1 -1
@@ -256,7 +256,7 @@ static int buck12_set_hw_dvs_levels(struct device_node *np,* 10: 2.50mV/usec 10mV 4uS * 11: 1.25mV/usec 10mV 8uS */ -static const unsigned int bd7181x_ramp_table[] = {1250 ,2500 ,5000 ,10000 }; +static const unsigned int bd7181x_ramp_table[] = {10000 ,5000 ,2500 ,1250 };static int bd7181x_led_set_current_limit (struct regulator_dev *rdev,int min_uA,int max_uA)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 159/250 thermal/drivers/mediatek/lvts_thermal: Return error in case of invalid efuse data
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julien Panis <[email protected]>
[ Upstream commit 72cacd06e47d86d89b0e7179fbc9eb3a0f39cd93 ]
This patch prevents from registering thermal entries and letting the driver misbehave if efuse data is invalid. A device is not properly calibrated if the golden temperature is zero.
--- drivers/thermal/mediatek/lvts_thermal.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/thermal/mediatek/lvts_thermal.c +5 -1
@@ -740,7 +740,11 @@ static int lvts_golden_temp_init(struct device *dev, u32 *value, int temp_offset gt = (*value) >>24 ; -if (gt && gt <LVTS_GOLDEN_TEMP_MAX ) +/* A zero value for gt means that device has invalid efuse data */ +if (!gt) +return -ENODATA ; + +if (gt <LVTS_GOLDEN_TEMP_MAX ) golden_temp = gt; golden_temp_offset = golden_temp *500 + temp_offset;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 160/250 arm64: dts: imx8mp: Fix TC9595 input clock on DH i.MX8M Plus DHCOM SoM
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
[ Upstream commit c03984d43a9dd9282da54ccf275419f666029452 ]
The IMX8MP_CLK_CLKOUT2 supplies the TC9595 bridge with 13 MHz reference clock. The IMX8MP_CLK_CLKOUT2 is supplied from IMX8MP_AUDIO_PLL2_OUT. The IMX8MP_CLK_CLKOUT2 operates only as a power-of-two divider, and the current 156 MHz is not power-of-two divisible to achieve 13 MHz.
To achieve 13 MHz output from IMX8MP_CLK_CLKOUT2, set IMX8MP_AUDIO_PLL2_OUT to 208 MHz, because 208 MHz / 16 = 13 MHz.
--- arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi +1 -1
@@ -254,7 +254,7 @@ <&clk IMX8MP_CLK_CLKOUT2>, <&clk IMX8MP_AUDIO_PLL2_OUT>; assigned-clock-parents = <&clk IMX8MP_AUDIO_PLL2_OUT>; - assigned-clock-rates = <13000000>, <13000000>, <156000000>; + assigned-clock-rates = <13000000>, <13000000>, <208000000>; reset-gpios = <&gpio4 1 GPIO_ACTIVE_HIGH>; status = "disabled";
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 161/250 arm: dts: imx53-qsb-hdmi: Disable panel instead of deleting node
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liu Ying <[email protected]>
[ Upstream commit bcdea3e81ea51c9e89e3b11aac2612e1b4330bee ]
We cannot use /delete-node/ directive to delete a node in a DT overlay. The node won't be deleted effectively. Instead, set the node's status property to "disabled" to achieve something similar.
--- arch/arm/boot/dts/nxp/imx/imx53-qsb-common.dtsi | 2 +- arch/arm/boot/dts/nxp/imx/imx53-qsb-hdmi.dtso | 6 ++++-- 2 files changed, 5 insertions(+), 3 deletions(-)
arch/arm/boot/dts/nxp/imx/imx53-qsb-common.dtsi +1 -1
@@ -85,7 +85,7 @@ }; }; - panel { + panel_dpi: panel { compatible = "sii,43wvf1g"; pinctrl-names = "default"; pinctrl-0 = <&pinctrl_display_power>;
arch/arm/boot/dts/nxp/imx/imx53-qsb-hdmi.dtso +4 -2
@@ -10,8 +10,6 @@ /plugin/; &{/} { - /delete-node/ panel; - hdmi: connector-hdmi { compatible = "hdmi-connector"; label = "hdmi";
@@ -82,6 +80,10 @@ }; }; +&panel_dpi { + status = "disabled"; +}; + &tve { status = "disabled"; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 162/250 arm64: dts: freescale: imx8mp-venice-gw73xx-2x: fix BT shutdown GPIO
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Harvey <[email protected]>
[ Upstream commit e1b4622efbe7ad09c9a902365a993f68c270c453 ]
Fix the invalid BT shutdown GPIO (gpio1_io3 not gpio4_io16)
--- arch/arm64/boot/dts/freescale/imx8mp-venice-gw73xx.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/freescale/imx8mp-venice-gw73xx.dtsi +1 -1
@@ -183,7 +183,7 @@ bluetooth { compatible = "brcm,bcm4330-bt"; - shutdown-gpios = <&gpio4 16 GPIO_ACTIVE_HIGH>; + shutdown-gpios = <&gpio1 3 GPIO_ACTIVE_HIGH>; }; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 163/250 arm64: dts: imx93-11x11-evk: Remove the no-sdio property
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <[email protected]>
[ Upstream commit a5d400b6439ac734a5c0dbb641e26a38736abc17 ]
The usdhc2 port is connected to the microSD slot. The presence of the 'no-sdio' property prevents Wifi SDIO cards, such as CMP9010-X-EVB [1] to be detected.
Remove the 'no-sdio' property so that SDIO cards could also work.
--- arch/arm64/boot/dts/freescale/imx93-11x11-evk.dts | 1 - 1 file changed, 1 deletion(-)
arch/arm64/boot/dts/freescale/imx93-11x11-evk.dts +0 -1
@@ -175,7 +175,6 @@ vmmc-supply = <®_usdhc2_vmmc>; bus-width = <4>; status = "okay"; - no-sdio; no-mmc; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 164/250 arm64: dts: freescale: imx8mm-verdin: enable hysteresis on slow input pin
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Krummenacher <[email protected]>
[ Upstream commit 67cc6125fb39902169707cb6277f010e56d4a40a ]
SODIMM 17 can be used as an edge triggered interrupt supplied from an off board source.
Enable hysteresis on the pinmuxing to increase immunity against noise on the signal.
--- arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi +1 -1
@@ -930,7 +930,7 @@ /* Verdin GPIO_9_DSI (pulled-up as active-low) */ pinctrl_gpio_9_dsi: gpio9dsigrp { fsl,pins = - <MX8MM_IOMUXC_NAND_RE_B_GPIO3_IO15 0x146>; /* SODIMM 17 */ + <MX8MM_IOMUXC_NAND_RE_B_GPIO3_IO15 0x1c6>; /* SODIMM 17 */ }; /* Verdin GPIO_10_DSI (pulled-up as active-low) */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 165/250 ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine."
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raju Rangoju <[email protected]>
[ Upstream commit a83e1385b780d41307433ddbc86e3c528db031f0 ]
Undo the modifications made in commit d410ee5109a1 ("ACPICA: avoid "Info: mapping multiple BARs. Your kernel is fine.""). The initial purpose of this commit was to stop memory mappings for operation regions from overlapping page boundaries, as it can trigger warnings if different page attributes are present.
However, it was found that when this situation arises, mapping continues until the boundary's end, but there is still an attempt to read/write the entire length of the map, leading to a NULL pointer deference. For example, if a four-byte mapping request is made but only one byte is mapped because it hits the current page boundary's end, a four-byte read/write attempt is still made, resulting in a NULL pointer deference.
Instead, map the entire length, as the ACPI specification does not mandate that it must be within the same page boundary. It is permissible for it to be mapped across different regions.
--- drivers/acpi/acpica/exregion.c | 23 ++--------------------- 1 file changed, 2 insertions(+), 21 deletions(-)
drivers/acpi/acpica/exregion.c +2 -21
@@ -44,7 +44,6 @@ acpi_ex_system_memory_space_handler(u32 function,struct acpi_mem_mapping *mm = mem_info->cur_mm;u32 length;acpi_size map_length; -acpi_size page_boundary_map_length;#ifdef ACPI_MISALIGNMENT_NOT_SUPPORTED u32 remainder;#endif
@@ -138,26 +137,8 @@ acpi_ex_system_memory_space_handler(u32 function, map_length = (acpi_size) ((mem_info->address + mem_info->length) - address); -/* -* If mapping the entire remaining portion of the region will cross -* a page boundary, just map up to the page boundary, do not cross. -* On some systems, crossing a page boundary while mapping regions -* can cause warnings if the pages have different attributes -* due to resource management. -* -* This has the added benefit of constraining a single mapping to -* one page, which is similar to the original code that used a 4k -* maximum window. -*/ - page_boundary_map_length = (acpi_size) - (ACPI_ROUND_UP (address,ACPI_DEFAULT_PAGE_SIZE ) - address); -if (page_boundary_map_length ==0 ) { - page_boundary_map_length =ACPI_DEFAULT_PAGE_SIZE ; - } - -if (map_length > page_boundary_map_length) { - map_length = page_boundary_map_length; - } +if (map_length >ACPI_DEFAULT_PAGE_SIZE ) + map_length =ACPI_DEFAULT_PAGE_SIZE ;/* Create a new mapping starting at the address given */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 166/250 ACPI: scan: Ignore camera graph port nodes on all Dell Tiger, Alder and Raptor Lake models
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit c7be64355fccfe7d4727681e32fce07113e40af1 ]
Dell laptops with IPU6 camera (the Tiger Lake, Alder Lake and Raptor Lake generations) have broken ACPI MIPI DISCO information (this results from an OEM attempt to make Linux work by supplying it with custom data in the ACPI tables which has never been supported in the mainline).
Instead of adding a lot of DMI quirks for this, check for Dell platforms based on the processor generations in question and drop the ACPI graph port nodes, likely to be created with the help of invalid data, on all of them.
--- drivers/acpi/internal.h | 4 ++++ drivers/acpi/mipi-disco-img.c | 28 +++++++++++++++++++--------- 2 files changed, 23 insertions(+), 9 deletions(-)
drivers/acpi/internal.h +4 -0
@@ -301,6 +301,10 @@ void acpi_mipi_check_crs_csi2(acpi_handle handle);void acpi_mipi_scan_crs_csi2 (void );void acpi_mipi_init_crs_csi2_swnodes (void );void acpi_mipi_crs_csi2_cleanup (void ); +#ifdef CONFIG_X86 bool acpi_graph_ignore_port (acpi_handle handle); +#else +static inline bool acpi_graph_ignore_port (acpi_handle handle) {return false; } +#endif #endif /* _ACPI_INTERNAL_H_ */
drivers/acpi/mipi-disco-img.c +19 -9
@@ -725,14 +725,20 @@ void acpi_mipi_crs_csi2_cleanup(void)acpi_mipi_del_crs_csi2 (csi2); } -static const struct dmi_system_id dmi_ignore_port_nodes[] = { - { - .matches = { -DMI_EXACT_MATCH (DMI_SYS_VENDOR ,"Dell Inc." ), -DMI_EXACT_MATCH (DMI_PRODUCT_NAME ,"XPS 9315" ), - }, - }, - { } +#ifdef CONFIG_X86 +#include <asm/cpu_device_id.h> +#include <asm/intel-family.h> + +/* CPU matches for Dell generations with broken ACPI MIPI DISCO info */ +static const struct x86_cpu_id dell_broken_mipi_disco_cpu_gens[] = { +X86_MATCH_INTEL_FAM6_MODEL (TIGERLAKE ,NULL ), +X86_MATCH_INTEL_FAM6_MODEL (TIGERLAKE_L ,NULL ), +X86_MATCH_INTEL_FAM6_MODEL (ALDERLAKE ,NULL ), +X86_MATCH_INTEL_FAM6_MODEL (ALDERLAKE_L ,NULL ), +X86_MATCH_INTEL_FAM6_MODEL (RAPTORLAKE ,NULL ), +X86_MATCH_INTEL_FAM6_MODEL (RAPTORLAKE_P ,NULL ), +X86_MATCH_INTEL_FAM6_MODEL (RAPTORLAKE_S ,NULL ), + {} };static const char *strnext (const char *s1,const char *s2)
@@ -761,7 +767,10 @@ bool acpi_graph_ignore_port(acpi_handle handle)static bool dmi_tested, ignore_port;if (!dmi_tested) { - ignore_port =dmi_first_match (dmi_ignore_port_nodes); +if (dmi_name_in_vendors ("Dell Inc." ) && +x86_match_cpu (dell_broken_mipi_disco_cpu_gens)) + ignore_port = true; + dmi_tested = true; }
@@ -794,3 +803,4 @@ bool acpi_graph_ignore_port(acpi_handle handle)kfree (orig_path); return false; } +#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 167/250 spi: Fix SPI slave probe failure
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amit Kumar Mahapatra <[email protected]>
[ Upstream commit 2c1b7bbe253986619fa5623a13055316e730e746 ]
While adding a SPI device, the SPI core ensures that multiple logical CS doesn't map to the same physical CS. For example, spi->chip_select[0] != spi->chip_select[1] and so forth. However, unlike the SPI master, the SPI slave doesn't have the list of chip selects, this leads to probe failure when the SPI controller is configured as slave. Update the __spi_add_device() function to perform this check only if the SPI controller is configured as master.
--- drivers/spi/spi.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/spi/spi.c +6 -4
@@ -685,10 +685,12 @@ static int __spi_add_device(struct spi_device *spi)* Make sure that multiple logical CS doesn't map to the same physical CS. * For example, spi->chip_select[0] != spi->chip_select[1] and so on. */ -for (idx =0 ; idx <SPI_CS_CNT_MAX ; idx++) { - status =spi_dev_check_cs (dev, spi, idx, spi, idx +1 ); -if (status) -return status; +if (!spi_controller_is_target (ctlr)) { +for (idx =0 ; idx <SPI_CS_CNT_MAX ; idx++) { + status =spi_dev_check_cs (dev, spi, idx, spi, idx +1 ); +if (status) +return status; + } }/* Set the bus ID string */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 168/250 x86/resctrl: Dont try to free nonexistent RMIDs
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Martin <[email protected]>
[ Upstream commit 739c9765793e5794578a64aab293c58607f1826a ]
Commit
6791e0ea3071 ("x86/resctrl: Access per-rmid structures by index")
adds logic to map individual monitoring groups into a global index space used for tracking allocated RMIDs.
Attempts to free the default RMID are ignored in free_rmid(), and this works fine on x86.
With arm64 MPAM, there is a latent bug here however: on platforms with no monitors exposed through resctrl, each control group still gets a different monitoring group ID as seen by the hardware, since the CLOSID always forms part of the monitoring group ID.
This means that when removing a control group, the code may try to free this group's default monitoring group RMID for real. If there are no monitors however, the RMID tracking table rmid_ptrs[] would be a waste of memory and is never allocated, leading to a splat when free_rmid() tries to dereference the table.
One option would be to treat RMID 0 as special for every CLOSID, but this would be ugly since bookkeeping still needs to be done for these monitoring group IDs when there are monitors present in the hardware.
Instead, add a gating check of resctrl_arch_mon_capable() in free_rmid(), and just do nothing if the hardware doesn't have monitors.
This fix mirrors the gating checks already present in mkdir_rdt_prepare_rmid_alloc() and elsewhere.
No functional change on x86.
[ bp: Massage commit message. ]
--- arch/x86/kernel/cpu/resctrl/monitor.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/x86/kernel/cpu/resctrl/monitor.c +2 -1
@@ -508,7 +508,8 @@ void free_rmid(u32 closid, u32 rmid)* allows architectures that ignore the closid parameter to avoid an * unnecessary check. */ -if (idx ==resctrl_arch_rmid_idx_encode (RESCTRL_RESERVED_CLOSID , +if (!resctrl_arch_mon_capable () || + idx ==resctrl_arch_rmid_idx_encode (RESCTRL_RESERVED_CLOSID ,RESCTRL_RESERVED_RMID ))return ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 169/250 spi: spi-imx: imx51: revert burst length calculation back to bits_per_word
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
[ Upstream commit df75470b317b46affbe1f5f8f006b34175be9789 ]
The patch 15a6af94a277 ("spi: Increase imx51 ecspi burst length based on transfer length") increased the burst length calculation in mx51_ecspi_prepare_transfer() to be based on the transfer length.
This breaks HW CS + SPI_CS_WORD support which was added in 6e95b23a5b2d ("spi: imx: Implement support for CS_WORD") and transfers with bits-per-word != 8, 16, 32.
SPI_CS_WORD means the CS should be toggled after each word. The implementation in the imx-spi driver relies on the fact that the HW CS is toggled automatically by the controller after each burst length number of bits. Setting the burst length to the number of bits of the _whole_ message breaks this use case.
Further the patch 15a6af94a277 ("spi: Increase imx51 ecspi burst length based on transfer length") claims to optimize the transfers. But even without this patch, on modern spi-imx controllers with "dynamic_burst = true" (imx51, imx6 and newer), the transfers are already optimized, i.e. the burst length is dynamically adjusted in spi_imx_push() to avoid the pause between the SPI bursts. This has been confirmed by a scope measurement on an imx6d.
Subsequent Patches tried to fix these and other problems:
- 5f66db08cbd3 ("spi: imx: Take in account bits per word instead of assuming 8-bits")
- e9b220aeacf1 ("spi: spi-imx: correctly configure burst length when using dma")
- c712c05e46c8 ("spi: imx: fix the burst length at DMA mode and CPU mode")
- cf6d79a0f576 ("spi: spi-imx: fix off-by-one in mx51 CPU mode burst length")
but the HW CS + SPI_CS_WORD use case is still broken.
To fix the problems revert the burst size calculation in mx51_ecspi_prepare_transfer() back to the original form, before 15a6af94a277 ("spi: Increase imx51 ecspi burst length based on transfer length") was applied.
--- drivers/spi/spi-imx.c | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-)
drivers/spi/spi-imx.c +2 -12
@@ -660,18 +660,8 @@ static int mx51_ecspi_prepare_transfer(struct spi_imx_data *spi_imx, ctrl |= (spi_imx->target_burst *8 -1 ) <<MX51_ECSPI_CTRL_BL_OFFSET ; else { -if (spi_imx->usedma) { - ctrl |= (spi_imx->bits_per_word -1 ) - <<MX51_ECSPI_CTRL_BL_OFFSET ; - }else { -if (spi_imx->count >=MX51_ECSPI_CTRL_MAX_BURST ) - ctrl |= (MX51_ECSPI_CTRL_MAX_BURST *BITS_PER_BYTE -1 ) - <<MX51_ECSPI_CTRL_BL_OFFSET ; -else - ctrl |= (spi_imx->count /DIV_ROUND_UP (spi_imx->bits_per_word, -BITS_PER_BYTE ) * spi_imx->bits_per_word -1 ) - <<MX51_ECSPI_CTRL_BL_OFFSET ; - } + ctrl |= (spi_imx->bits_per_word -1 ) + <<MX51_ECSPI_CTRL_BL_OFFSET ; }/* set clock speed */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 170/250 drm/xe/vf: Dont touch GuC irq registers if using memory irqs
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Wajdeczko <[email protected]>
[ Upstream commit d21d44dbdde83c4a8553c95de1853e63e88d7954 ]
On platforms where VFs are using memory based interrupts, we missed invalid access to no longer existing interrupt registers, as we keep them marked with XE_REG_OPTION_VF. To fix that just either setup memirq vectors in GuC or enable legacy interrupts.
--- drivers/gpu/drm/xe/xe_guc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/xe/xe_guc.c +2 -2
@@ -643,8 +643,6 @@ int xe_guc_enable_communication(struct xe_guc *guc)struct xe_device *xe =guc_to_xe (guc);int err; -guc_enable_irq (guc); -if (IS_SRIOV_VF (xe) &&xe_device_has_memirq (xe)) {struct xe_gt *gt =guc_to_gt (guc);struct xe_tile *tile =gt_to_tile (gt);
@@ -652,6 +650,8 @@ int xe_guc_enable_communication(struct xe_guc *guc) err =xe_memirq_init_guc (&tile->sriov.vf.memirq, guc);if (err)return err; + }else { +guc_enable_irq (guc); } xe_mmio_rmw32(guc_to_gt(guc), PMINTRMSK,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 171/250 io_uring/rsrc: fix incorrect assignment of iter->nr_segs in io_import_fixed
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chenliang Li <[email protected]>
[ Upstream commit a23800f08a60787dfbf2b87b2e6ed411cb629859 ]
In io_import_fixed when advancing the iter within the first bvec, the iter->nr_segs is set to bvec->bv_len. nr_segs should be the number of bvecs, plus we don't need to adjust it here, so just remove it.
--- io_uring/rsrc.c | 1 - 1 file changed, 1 deletion(-)
io_uring/rsrc.c +0 -1
@@ -1105,7 +1105,6 @@ int io_import_fixed(int ddir, struct iov_iter *iter,* branch doesn't expect non PAGE_SIZE'd chunks. */ iter->bvec = bvec; - iter->nr_segs = bvec->bv_len; iter->count -= offset; iter->iov_offset = offset; }else {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 172/250 firmware: psci: Fix return value from psci_system_suspend()
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <[email protected]>
[ Upstream commit e7c3696d4692e8046d25f6e63f983e934e12f2c5 ]
Currently we return the value from invoke_psci_fn() directly as return value from psci_system_suspend(). It is wrong to send the PSCI interface return value directly. psci_to_linux_errno() provide the mapping from PSCI return value to the one that can be returned to the callers within the kernel.
Use psci_to_linux_errno() to convert and return the correct value from psci_system_suspend().
--- drivers/firmware/psci/psci.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/firmware/psci/psci.c +3 -1
@@ -497,10 +497,12 @@ int psci_cpu_suspend_enter(u32 state)static int psci_system_suspend (unsigned long unused) { +int err;phys_addr_t pa_cpu_resume =__pa_symbol (cpu_resume); - return invoke_psci_fn(PSCI_FN_NATIVE(1_0, SYSTEM_SUSPEND), + err = invoke_psci_fn(PSCI_FN_NATIVE(1_0, SYSTEM_SUSPEND), pa_cpu_resume,0 ,0 ); +return psci_to_linux_errno (err); }static int psci_system_suspend_enter (suspend_state_t state)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 173/250 LoongArch: Only allow OBJTOOL & ORC unwinder if toolchain supports -mthin-add-sub
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xi Ruoyao <[email protected]>
[ Upstream commit 120dd4118e58dbda2ddb1dcf55f3c56cdfe8cee0 ]
GAS <= 2.41 does not support generating R_LARCH_{32,64}_PCREL for "label - ." and it generates R_LARCH_{ADD,SUB}{32,64} pairs instead. Objtool cannot handle R_LARCH_{ADD,SUB}{32,64} pair in __jump_table (static key implementation) and etc. so it will produce some warnings. This is causing the kernel CI systems to complain everywhere.
For GAS we can check if -mthin-add-sub option is available to know if R_LARCH_{32,64}_PCREL are supported.
For Clang, we require Clang >= 18 and Clang >= 17 already supports R_LARCH_{32,64}_PCREL. But unfortunately Clang has some other issues, so we disable objtool for Clang at present.
Note that __jump_table here is not generated by the compiler, so -fno-jump-table is completely irrelevant for this issue.
--- arch/loongarch/Kconfig | 5 ++++- arch/loongarch/Kconfig.debug | 1 + 2 files changed, 5 insertions(+), 1 deletion(-)
arch/loongarch/Kconfig +4 -1
@@ -138,7 +138,7 @@ config LOONGARCH select HAVE_LIVEPATCH select HAVE_MOD_ARCH_SPECIFIC select HAVE_NMI - select HAVE_OBJTOOL if AS_HAS_EXPLICIT_RELOCS + select HAVE_OBJTOOL if AS_HAS_EXPLICIT_RELOCS && AS_HAS_THIN_ADD_SUB && !CC_IS_CLANG select HAVE_PCI select HAVE_PERF_EVENTS select HAVE_PERF_REGS
@@ -257,6 +257,9 @@ config AS_HAS_EXPLICIT_RELOCS config AS_HAS_FCSR_CLASS def_bool $(as-instr,movfcsr2gr \$t0$(comma)\$fcsr0) +config AS_HAS_THIN_ADD_SUB + def_bool $(cc-option,-Wa$(comma)-mthin-add-sub) + config AS_HAS_LSX_EXTENSION def_bool $(as-instr,vld \$vr0$(comma)\$a0$(comma)0)
arch/loongarch/Kconfig.debug +1 -0
@@ -28,6 +28,7 @@ config UNWINDER_PROLOGUE config UNWINDER_ORC bool "ORC unwinder" + depends on HAVE_OBJTOOL select OBJTOOL help This option enables the ORC (Oops Rewind Capability) unwinder for
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 174/250 RDMA/mlx5: Fix unwind flow as part of mlx5_ib_stage_init_init
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yishai Hadas <[email protected]>
[ Upstream commit 81497c148b7a2e4a4fbda93aee585439f7323e2e ]
Fix unwind flow as part of mlx5_ib_stage_init_init to use the correct goto upon an error.
--- drivers/infiniband/hw/mlx5/main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/infiniband/hw/mlx5/main.c +2 -2
@@ -3760,10 +3760,10 @@ static int mlx5_ib_stage_init_init(struct mlx5_ib_dev *dev)spin_lock_init (&dev->dm.lock); dev->dm.dev = mdev;return 0 ; -err: -mlx5r_macsec_dealloc_gids (dev); err_mp:mlx5_ib_cleanup_multiport_master (dev); +err: +mlx5r_macsec_dealloc_gids (dev);return err; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 175/250 RDMA/mlx5: Add check for srq max_sge attribute
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patrisious Haddad <[email protected]>
[ Upstream commit 36ab7ada64caf08f10ee5a114d39964d1f91e81d ]
max_sge attribute is passed by the user, and is inserted and used unchecked, so verify that the value doesn't exceed maximum allowed value before using it.
--- drivers/infiniband/hw/mlx5/srq.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
drivers/infiniband/hw/mlx5/srq.c +8 -5
@@ -199,17 +199,20 @@ int mlx5_ib_create_srq(struct ib_srq *ib_srq,int err;struct mlx5_srq_attr in = {};__u32 max_srq_wqes =1 <<MLX5_CAP_GEN (dev->mdev, log_max_srq_sz); +__u32 max_sge_sz =MLX5_CAP_GEN (dev->mdev, max_wqe_sz_rq) / +sizeof (struct mlx5_wqe_data_seg );if (init_attr->srq_type !=IB_SRQT_BASIC && init_attr->srq_type !=IB_SRQT_XRC && init_attr->srq_type !=IB_SRQT_TM )return -EOPNOTSUPP ; -/* Sanity check SRQ size before proceeding */ -if (init_attr->attr.max_wr >= max_srq_wqes) { -mlx5_ib_dbg (dev,"max_wr %d, cap %d\n" , - init_attr->attr.max_wr, - max_srq_wqes); +/* Sanity check SRQ and sge size before proceeding */ +if (init_attr->attr.max_wr >= max_srq_wqes || + init_attr->attr.max_sge > max_sge_sz) { +mlx5_ib_dbg (dev,"max_wr %d,wr_cap %d,max_sge %d, sge_cap:%d\n" , + init_attr->attr.max_wr, max_srq_wqes, + init_attr->attr.max_sge, max_sge_sz);return -EINVAL ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 176/250 RDMA/mana_ib: Ignore optional access flags for MRs
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Taranov <[email protected]>
[ Upstream commit 82a5cc783d49b86afd2f60e297ecd85223c39f88 ]
Ignore optional ib_access_flags when an MR is created.
--- drivers/infiniband/hw/mana/mr.c | 1 + 1 file changed, 1 insertion(+)
drivers/infiniband/hw/mana/mr.c +1 -0
@@ -112,6 +112,7 @@ struct ib_mr *mana_ib_reg_user_mr(struct ib_pd *ibpd, u64 start, u64 length,"start 0x%llx, iova 0x%llx length 0x%llx access_flags 0x%x" , start, iova, length, access_flags); + access_flags &= ~IB_ACCESS_OPTIONAL ;if (access_flags & ~VALID_MR_FLAGS )return ERR_PTR (-EINVAL );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 177/250 ACPI: EC: Evaluate orphan _REG under EC device
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
commit 0e6b6dedf16800df0ff73ffe2bb5066514db29c2 upstream.
After starting to install the EC address space handler at the ACPI namespace root, if there is an "orphan" _REG method in the EC device's scope, it will not be evaluated any more. This breaks EC operation regions on some systems, like Asus gu605.
To address this, use a wrapper around an existing ACPICA function to look for an "orphan" _REG method in the EC device scope and evaluate it if present.
--- drivers/acpi/acpica/acevents.h | 4 +++ drivers/acpi/acpica/evregion.c | 6 ---- drivers/acpi/acpica/evxfregn.c | 54 +++++++++++++++++++++++++++++++++++++++++ drivers/acpi/ec.c | 3 ++ include/acpi/acpixf.h | 4 +++ 5 files changed, 66 insertions(+), 5 deletions(-)
drivers/acpi/acpica/acevents.h +4 -0
@@ -191,6 +191,10 @@ void acpi_ev_execute_reg_methods(struct acpi_namespace_node *node, acpi_adr_space_type space_id, u32 function); +void +acpi_ev_execute_orphan_reg_method (struct acpi_namespace_node *node, +acpi_adr_space_type space_id); +acpi_status acpi_ev_execute_reg_method (union acpi_operand_object *region_obj,u32 function);
drivers/acpi/acpica/evregion.c +1 -5
@@ -20,10 +20,6 @@ extern u8 acpi_gbl_default_address_space/* Local prototypes */ -static void -acpi_ev_execute_orphan_reg_method (struct acpi_namespace_node *device_node, -acpi_adr_space_type space_id); -static acpi_status acpi_ev_reg_run (acpi_handle obj_handle,u32 level,void *context,void **return_value);
@@ -818,7 +814,7 @@ acpi_ev_reg_run(acpi_handle obj_handle,* ******************************************************************************/ -static void +void acpi_ev_execute_orphan_reg_method (struct acpi_namespace_node *device_node,acpi_adr_space_type space_id) {
drivers/acpi/acpica/evxfregn.c +54 -0
57 lines not on this page · raw message
drivers/acpi/ec.c +3 -0
@@ -1502,6 +1502,9 @@ static int ec_install_handlers(struct acif (call_reg && !test_bit (EC_FLAGS_EC_REG_CALLED , &ec->flags)) {acpi_execute_reg_methods (scope_handle,ACPI_ADR_SPACE_EC ); +if (scope_handle != ec->handle) +acpi_execute_orphan_reg_method (ec->handle,ACPI_ADR_SPACE_EC ); +set_bit (EC_FLAGS_EC_REG_CALLED , &ec->flags); }
include/acpi/acpixf.h +4 -0
@@ -663,6 +663,10 @@ ACPI_EXTERNAL_RETURN_STATUS(acpi_status acpi_adr_space_type space_id)) ACPI_EXTERNAL_RETURN_STATUS(acpi_status + acpi_execute_orphan_reg_method(acpi_handle device, + acpi_adr_space_type + space_id)) +ACPI_EXTERNAL_RETURN_STATUS(acpi_status acpi_remove_address_space_handler(acpi_handle device, acpi_adr_space_type
Greg Kroah-Hartman
maintainerPATCH 178/250 ext4: avoid overflow when setting values via sysfs
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
commit 9e8e819f8f272c4e5dcd0bd6c7450e36481ed139 upstream.
When setting values of type unsigned int through sysfs, we use kstrtoul() to parse it and then truncate part of it as the final set value, when the set value is greater than UINT_MAX, the set value will not match what we see because of the truncation. As follows:
$ echo 4294967296 > /sys/fs/ext4/sda/mb_max_linear_groups
$ cat /sys/fs/ext4/sda/mb_max_linear_groups
0So we use kstrtouint() to parse the attr_pointer_ui type to avoid the inconsistency described above. In addition, a judgment is added to avoid setting s_resv_clusters less than 0.
--- fs/ext4/sysfs.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
fs/ext4/sysfs.c +6 -5
@@ -104,7 +104,7 @@ static ssize_t reserved_clusters_store(sint ret; ret =kstrtoull (skip_spaces (buf),0 , &val); -if (ret || val >= clusters) +if (ret || val >= clusters || (s64 )val <0 )return -EINVAL ;atomic64_set (&sbi->s_resv_clusters, val);
@@ -451,7 +451,8 @@ static ssize_t ext4_attr_store(struct ko s_kobj); struct ext4_attr *a = container_of(attr, struct ext4_attr, attr);void *ptr =calc_ptr (a, sbi); -unsigned long t; +unsigned int t; +unsigned long lt;int ret;switch (a->attr_id) {
@@ -460,7 +461,7 @@ static ssize_t ext4_attr_store(struct kocase attr_pointer_ui:if (!ptr)return 0 ; - ret =kstrtoul (skip_spaces (buf),0 , &t); + ret =kstrtouint (skip_spaces (buf),0 , &t);if (ret)return ret;if (a->attr_ptr == ptr_ext4_super_block_offset)
@@ -471,10 +472,10 @@ static ssize_t ext4_attr_store(struct kocase attr_pointer_ul:if (!ptr)return 0 ; - ret =kstrtoul (skip_spaces (buf),0 , &t); + ret =kstrtoul (skip_spaces (buf),0 , <);if (ret)return ret; - *((unsigned long *) ptr) = t; + *((unsigned long *) ptr) = lt;return len;case attr_inode_readahead:return inode_readahead_blks_store (sbi, buf, len);
Greg Kroah-Hartman
maintainerPATCH 179/250 ext4: fix slab-out-of-bounds in ext4_mb_find_good_group_avg_frag_lists()
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
commit 13df4d44a3aaabe61cd01d277b6ee23ead2a5206 upstream.
We can trigger a slab-out-of-bounds with the following commands:
mkfs.ext4 -F /dev/$disk 10G
mount /dev/$disk /tmp/test
echo 2147483647 > /sys/fs/ext4/$disk/mb_group_prealloc
echo test > /tmp/test/file && sync==================================================================
BUG: KASAN: slab-out-of-bounds in ext4_mb_find_good_group_avg_frag_lists+0x8a/0x200 [ext4] Read of size 8 at addr ffff888121b9d0f0 by task kworker/u2:0/11 CPU: 0 PID: 11 Comm: kworker/u2:0 Tainted: GL 6.7.0-next-20240118 #521 Call Trace: dump_stack_lvl+0x2c/0x50 kasan_report+0xb6/0xf0 ext4_mb_find_good_group_avg_frag_lists+0x8a/0x200 [ext4] ext4_mb_regular_allocator+0x19e9/0x2370 [ext4] ext4_mb_new_blocks+0x88a/0x1370 [ext4] ext4_ext_map_blocks+0x14f7/0x2390 [ext4] ext4_map_blocks+0x569/0xea0 [ext4] ext4_do_writepages+0x10f6/0x1bc0 [ext4]
[...]
==================================================================
The flow of issue triggering is as follows:
// Set s_mb_group_prealloc to 2147483647 via sysfs ext4_mb_new_blocks
ext4_mb_normalize_request
ext4_mb_normalize_group_request
ac->ac_g_ex.fe_len = EXT4_SB(sb)->s_mb_group_prealloc
ext4_mb_regular_allocator
ext4_mb_choose_next_group
ext4_mb_choose_next_group_best_avail
mb_avg_fragment_size_order
order = fls(len) - 2 = 29
ext4_mb_find_good_group_avg_frag_lists
frag_list = &sbi->s_mb_avg_fragment_size[order]
if (list_empty(frag_list)) // Trigger SOOB!At 4k block size, the length of the s_mb_avg_fragment_size list is 14, but an oversized s_mb_group_prealloc is set, causing slab-out-of-bounds to be triggered by an attempt to access an element at index 29.
Add a new attr_id attr_clusters_in_group with values in the range [0, sbi->s_clusters_per_group] and declare mb_group_prealloc as that type to fix the issue. In addition avoid returning an order from mb_avg_fragment_size_order() greater than MB_NUM_ORDERS(sb) and reduce some useless loops.
--- fs/ext4/mballoc.c | 4 ++++ fs/ext4/sysfs.c | 13 ++++++++++++- 2 files changed, 16 insertions(+), 1 deletion(-)
fs/ext4/mballoc.c +4 -0
@@ -831,6 +831,8 @@ static int mb_avg_fragment_size_order(streturn 0 ;if (order ==MB_NUM_ORDERS (sb)) order--; +if (WARN_ON_ONCE (order >MB_NUM_ORDERS (sb))) + order =MB_NUM_ORDERS (sb) -1 ;return order; }
@@ -1008,6 +1010,8 @@ static void ext4_mb_choose_next_group_be* goal length. */ order =fls (ac->ac_g_ex.fe_len) -1 ; +if (WARN_ON_ONCE (order -1 >MB_NUM_ORDERS (ac->ac_sb))) + order =MB_NUM_ORDERS (ac->ac_sb); min_order = order - sbi->s_mb_best_avail_max_trim_order;if (min_order <0 ) min_order =0 ;
fs/ext4/sysfs.c +12 -1
@@ -29,6 +29,7 @@ typedef enum { attr_trigger_test_error, attr_first_error_time, attr_last_error_time, + attr_clusters_in_group, attr_feature, attr_pointer_ui, attr_pointer_ul,
@@ -207,13 +208,14 @@ EXT4_ATTR_FUNC(sra_exceeded_retry_limit,EXT4_ATTR_OFFSET (inode_readahead_blks,0644 , inode_readahead, ext4_sb_info, s_inode_readahead_blks); +EXT4_ATTR_OFFSET (mb_group_prealloc,0644 , clusters_in_group, + ext4_sb_info, s_mb_group_prealloc);EXT4_RW_ATTR_SBI_UI (inode_goal, s_inode_goal);EXT4_RW_ATTR_SBI_UI (mb_stats, s_mb_stats);EXT4_RW_ATTR_SBI_UI (mb_max_to_scan, s_mb_max_to_scan);EXT4_RW_ATTR_SBI_UI (mb_min_to_scan, s_mb_min_to_scan);EXT4_RW_ATTR_SBI_UI (mb_order2_req, s_mb_order2_reqs);EXT4_RW_ATTR_SBI_UI (mb_stream_req, s_mb_stream_request); -EXT4_RW_ATTR_SBI_UI (mb_group_prealloc, s_mb_group_prealloc);EXT4_RW_ATTR_SBI_UI (mb_max_linear_groups, s_mb_max_linear_groups);EXT4_RW_ATTR_SBI_UI (extent_max_zeroout_kb, s_extent_max_zeroout_kb);EXT4_ATTR (trigger_fs_error,0200 , trigger_test_error);
@@ -392,6 +394,7 @@ static ssize_t ext4_attr_show(struct kob (unsigned long long ) percpu_counter_sum(&sbi->s_sra_exceeded_retry_limit));case attr_inode_readahead: +case attr_clusters_in_group:case attr_pointer_ui:if (!ptr)return 0 ;
@@ -469,6 +472,14 @@ static ssize_t ext4_attr_store(struct koelse *((unsigned int *) ptr) = t;return len; +case attr_clusters_in_group: + ret =kstrtouint (skip_spaces (buf),0 , &t); +if (ret) +return ret; +if (t > sbi->s_clusters_per_group) +return -EINVAL ; + *((unsigned int *) ptr) = t; +return len;case attr_pointer_ul:if (!ptr)return 0 ;
Greg Kroah-Hartman
maintainerPATCH 180/250 net: phy: dp83tg720: wake up PHYs in managed mode
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleksij Rempel <[email protected]>
commit cd6f12e173df44a20c2ac2ac110007dc14968088 upstream.
In case this PHY is bootstrapped for managed mode, we need to manually wake it. Otherwise no link will be detected.
--- drivers/net/phy/dp83tg720.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-)
drivers/net/phy/dp83tg720.c +15 -3
@@ -17,6 +17,11 @@#define DP83TG720S_PHY_RESET 0x1f#define DP83TG720S_HW_RESET BIT(15) +#define DP83TG720S_LPS_CFG3 0x18c +/* Power modes are documented as bit fields but used as values */ +/* Power Mode 0 is Normal mode */ +#define DP83TG720S_LPS_CFG3_PWR_MODE_0 BIT(0) +#define DP83TG720S_RGMII_DELAY_CTRL 0x602/* In RGMII mode, Enable or disable the internal delay for RXD */ #define DP83TG720S_RGMII_RX_CLK_SEL BIT(1)
@@ -154,10 +159,17 @@ static int dp83tg720_config_init(struct phy_device *phydev)*/ usleep_range (1000 ,2000 ); -if (phy_interface_is_rgmii (phydev)) -return dp83tg720_config_rgmii_delay (phydev); +if (phy_interface_is_rgmii (phydev)) { + ret =dp83tg720_config_rgmii_delay (phydev); +if (ret) +return ret; + } -return 0 ; +/* In case the PHY is bootstrapped in managed mode, we need to +* wake it. +*/ +return phy_write_mmd (phydev,MDIO_MMD_VEND2 ,DP83TG720S_LPS_CFG3 , +DP83TG720S_LPS_CFG3_PWR_MODE_0 ); }static struct phy_driver dp83tg720_driver[] = {
Signature · 1 line
2.45.2
Greg Kroah-Hartman
maintainerPATCH 181/250 net: stmmac: Assign configured channel value to EXTTS event
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleksij Rempel <[email protected]>
commit 8851346912a1fa33e7a5966fe51f07313b274627 upstream.
Assign the configured channel value to the EXTTS event in the timestamp interrupt handler. Without assigning the correct channel, applications like ts2phc will refuse to accept the event, resulting in errors such as:
...
ts2phc[656.834]: config item end1.ts2phc.pin_index is 0 ts2phc[656.834]: config item end1.ts2phc.channel is 3 ts2phc[656.834]: config item end1.ts2phc.extts_polarity is 2 ts2phc[656.834]: config item end1.ts2phc.extts_correction is 0
...
ts2phc[656.862]: extts on unexpected channel ts2phc[658.141]: extts on unexpected channel ts2phc[659.140]: extts on unexpected channel
--- drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c +5 -1
@@ -218,6 +218,7 @@ static void timestamp_interrupt(struct s {u32 num_snapshot, ts_status, tsync_int;struct ptp_clock_event event; +u32 acr_value, channel;unsigned long flags;u64 ptp_time;int i;
@@ -243,12 +244,15 @@ static void timestamp_interrupt(struct s num_snapshot = (ts_status &GMAC_TIMESTAMP_ATSNS_MASK ) >>GMAC_TIMESTAMP_ATSNS_SHIFT ; + acr_value =readl (priv->ptpaddr +PTP_ACR ); + channel =ilog2 (FIELD_GET (PTP_ACR_MASK , acr_value)); +for (i =0 ; i < num_snapshot; i++) {read_lock_irqsave (&priv->ptp_lock, flags);get_ptptime (priv->ptpaddr, &ptp_time);read_unlock_irqrestore (&priv->ptp_lock, flags); event.type =PTP_CLOCK_EXTTS ; - event.index =0 ; + event.index = channel; event.timestamp = ptp_time;ptp_clock_event (priv->ptp_clock, &event); }
Greg Kroah-Hartman
maintainerPATCH 182/250 net: usb: ax88179_178a: improve reset check
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jose Ignacio Tornos Martinez <[email protected]>
commit 7be4cb7189f747b4e5b6977d0e4387bde3204e62 upstream.
After ecf848eb934b ("net: usb: ax88179_178a: fix link status when link is set to down/up") to not reset from usbnet_open after the reset from usbnet_probe at initialization stage to speed up this, some issues have been reported.
It seems to happen that if the initialization is slower, and some time passes between the probe operation and the open operation, the second reset from open is necessary too to have the device working. The reason is that if there is no activity with the phy, this is "disconnected".
In order to improve this, the solution is to detect when the phy is "disconnected", and we can use the phy status register for this. So we will only reset the device from reset operation in this situation, that is, only if necessary.
The same bahavior is happening when the device is stopped (link set to down) and later is restarted (link set to up), so if the phy keeps working we only need to enable the mac again, but if enough time passes between the device stop and restart, reset is necessary, and we can detect the situation checking the phy status register too.
--- drivers/net/usb/ax88179_178a.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-)
drivers/net/usb/ax88179_178a.c +13 -5
@@ -174,7 +174,6 @@ struct ax88179_data {u32 wol_supported;u32 wolopts;u8 disconnecting; -u8 initialized; };struct ax88179_int_data {
@@ -1676,12 +1675,21 @@ static int ax88179_reset(struct usbnet *static int ax88179_net_reset (struct usbnet *dev) { -struct ax88179_data *ax179_data = dev->driver_priv; +u16 tmp16; -if (ax179_data->initialized) +ax88179_read_cmd (dev,AX_ACCESS_PHY ,AX88179_PHY_ID ,GMII_PHY_PHYSR , +2 , &tmp16); +if (tmp16) { +ax88179_read_cmd (dev,AX_ACCESS_MAC ,AX_MEDIUM_STATUS_MODE , +2 ,2 , &tmp16); +if (!(tmp16 &AX_MEDIUM_RECEIVE_EN )) { + tmp16 |=AX_MEDIUM_RECEIVE_EN ; +ax88179_write_cmd (dev,AX_ACCESS_MAC ,AX_MEDIUM_STATUS_MODE , +2 ,2 , &tmp16); + } + }else {ax88179_reset (dev); -else - ax179_data->initialized =1 ; + }return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 183/250 net: phy: dp83tg720: get master/slave configuration in link down state
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleksij Rempel <[email protected]>
commit 40a64cc9679540ff7c46ecc51178b07d42abbb1c upstream.
Get master/slave configuration for initial system start with the link in down state. This ensures ethtool shows current configuration. Also fixes link reconfiguration with ethtool while in down state, preventing ethtool from displaying outdated configuration.
Even though dp83tg720_config_init() is executed periodically as long as the link is in admin up state but no carrier is detected, this is not sufficient for the link in admin down state where dp83tg720_read_status() is not periodically executed. To cover this case, we need an extra read role configuration in dp83tg720_config_aneg().
--- drivers/net/phy/dp83tg720.c | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-)
drivers/net/phy/dp83tg720.c +21 -3
@@ -36,11 +36,20 @@static int dp83tg720_config_aneg (struct phy_device *phydev) { +int ret; +/* Autoneg is not supported and this PHY supports only one speed. * We need to care only about master/slave configuration if it was * changed by user. */ -return genphy_c45_pma_baset1_setup_master_slave (phydev); + ret =genphy_c45_pma_baset1_setup_master_slave (phydev); +if (ret) +return ret; + +/* Re-read role configuration to make changes visible even if +* the link is in administrative down state. +*/ +return genphy_c45_pma_baset1_read_master_slave (phydev); }static int dp83tg720_read_status (struct phy_device *phydev)
@@ -69,6 +78,8 @@ static int dp83tg720_read_status(struct phy_device *phydev)return ret;/* After HW reset we need to restore master/slave configuration. +* genphy_c45_pma_baset1_read_master_slave() call will be done +* by the dp83tg720_config_aneg() function. */ ret =dp83tg720_config_aneg (phydev);if (ret)
@@ -168,8 +179,15 @@ static int dp83tg720_config_init(struct phy_device *phydev)/* In case the PHY is bootstrapped in managed mode, we need to * wake it. */ -return phy_write_mmd (phydev,MDIO_MMD_VEND2 ,DP83TG720S_LPS_CFG3 , -DP83TG720S_LPS_CFG3_PWR_MODE_0 ); + ret =phy_write_mmd (phydev,MDIO_MMD_VEND2 ,DP83TG720S_LPS_CFG3 , +DP83TG720S_LPS_CFG3_PWR_MODE_0 ); +if (ret) +return ret; + +/* Make role configuration visible for ethtool on init and after +* rest. +*/ +return genphy_c45_pma_baset1_read_master_slave (phydev); }static struct phy_driver dp83tg720_driver[] = {
Signature · 1 line
2.45.2
Greg Kroah-Hartman
maintainerPATCH 184/250 net: do not leave a dangling sk pointer, when socket creation fails
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ignat Korchagin <[email protected]>
commit 6cd4a78d962bebbaf8beb7d2ead3f34120e3f7b2 upstream.
It is possible to trigger a use-after-free by:
* attaching an fentry probe to __sock_release() and the probe calling the bpf_get_socket_cookie() helper
* running traceroute -I 1.1.1.1 on a freshly booted VM
A KASAN enabled kernel will log something like below (decoded and stripped):
==================================================================
BUG: KASAN: slab-use-after-free in __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29) Read of size 8 at addr ffff888007110dd8 by task traceroute/299 CPU: 2 PID: 299 Comm: traceroute Tainted: G E 6.10.0-rc2+ #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:117 (discriminator 1)) print_report (mm/kasan/report.c:378 mm/kasan/report.c:488) ? __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29) kasan_report (mm/kasan/report.c:603) ? __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29) kasan_check_range (mm/kasan/generic.c:183 mm/kasan/generic.c:189) __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29) bpf_get_socket_ptr_cookie (./arch/x86/include/asm/preempt.h:94 ./include/linux/sock_diag.h:42 net/core/filter.c:5094 net/core/filter.c:5092) bpf_prog_875642cf11f1d139___sock_release+0x6e/0x8e bpf_trampoline_6442506592+0x47/0xaf __sock_release (net/socket.c:652) __sock_create (net/socket.c:1601) ... Allocated by task 299 on cpu 2 at 78.328492s: kasan_save_stack (mm/kasan/common.c:48) kasan_save_track (mm/kasan/common.c:68) __kasan_slab_alloc (mm/kasan/common.c:312 mm/kasan/common.c:338) kmem_cache_alloc_noprof (mm/slub.c:3941 mm/slub.c:4000 mm/slub.c:4007)
sk_prot_alloc (net/core/sock.c:2075)sk_alloc (net/core/sock.c:2134)inet_create (net/ipv4/af_inet.c:327 net/ipv4/af_inet.c:252) __sock_create (net/socket.c:1572)__sys_socket (net/socket.c:1660 net/socket.c:1644 net/socket.c:1706) __x64_sys_socket (net/socket.c:1718)do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
Freed by task 299 on cpu 2 at 78.328502s:
kasan_save_stack (mm/kasan/common.c:48)kasan_save_track (mm/kasan/common.c:68)kasan_save_free_info (mm/kasan/generic.c:582)poison_slab_object (mm/kasan/common.c:242)__kasan_slab_free (mm/kasan/common.c:256)
kmem_cache_free (mm/slub.c:4437 mm/slub.c:4511) __sk_destruct (net/core/sock.c:2117 net/core/sock.c:2208) inet_create (net/ipv4/af_inet.c:397 net/ipv4/af_inet.c:252)
__sock_create (net/socket.c:1572)__sys_socket (net/socket.c:1660 net/socket.c:1644 net/socket.c:1706) __x64_sys_socket (net/socket.c:1718)do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
Fix this by clearing the struct socket reference in sk_common_release() to cover all protocol families create functions, which may already attached the reference to the sk object with sock_init_data().
--- net/core/sock.c | 3 +++ 1 file changed, 3 insertions(+)
net/core/sock.c +3 -0
@@ -3743,6 +3743,9 @@ void sk_common_release(struct sock *sk) sk->sk_prot->unhash (sk); +if (sk->sk_socket) + sk->sk_socket->sk =NULL ; +/* * In this point socket cannot receive new packets, but it is possible * that some packets are in flight because some CPU runs receiver and
Greg Kroah-Hartman
maintainerPATCH 185/250 btrfs: retry block group reclaim without infinite loop
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Burkov <[email protected]>
commit 4eb4e85c4f818491efc67e9373aa16b123c3f522 upstream.
If inc_block_group_ro systematically fails (e.g. due to ETXTBUSY from swap) or btrfs_relocate_chunk systematically fails (from lack of space), then this worker becomes an infinite loop.
At the very least, this strands the cleaner thread, but can also result in hung tasks/RCU stalls on PREEMPT_NONE kernels and if the reclaim_bgs_lock mutex is not contended.
I believe the best long term fix is to manage reclaim via work queue, where we queue up a relocation on the triggering condition and re-queue on failure. In the meantime, this is an easy fix to apply to avoid the immediate pain.
--- fs/btrfs/block-group.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
fs/btrfs/block-group.c +9 -2
@@ -1785,6 +1785,7 @@ void btrfs_reclaim_bgs_work(struct work_ container_of(work, struct btrfs_fs_info, reclaim_bgs_work);struct btrfs_block_group *bg;struct btrfs_space_info *space_info; +LIST_HEAD (retry_list);if (!test_bit (BTRFS_FS_OPEN , &fs_info->flags))return ;
@@ -1921,8 +1922,11 @@ void btrfs_reclaim_bgs_work(struct work_ } next: -if (ret) -btrfs_mark_bg_to_reclaim (bg); +if (ret) { +/* Refcount held by the reclaim_bgs list after splice. */ +btrfs_get_block_group (bg); +list_add_tail (&bg->bg_list, &retry_list); + }btrfs_put_block_group (bg);mutex_unlock (&fs_info->reclaim_bgs_lock);
@@ -1942,6 +1946,9 @@ next:spin_unlock (&fs_info->unused_bgs_lock);mutex_unlock (&fs_info->reclaim_bgs_lock); end: +spin_lock (&fs_info->unused_bgs_lock); +list_splice_tail (&retry_list, &fs_info->reclaim_bgs); +spin_unlock (&fs_info->unused_bgs_lock);btrfs_exclop_finish (fs_info);sb_end_write (fs_info->sb); }
Greg Kroah-Hartman
maintainerPATCH 186/250 scsi: ufs: core: Free memory allocated for model before reinit
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joel Slebodnick <[email protected]>
commit 135c6eb27a85c8b261a2cc1f5093abcda6ee9010 upstream.
Under the conditions that a device is to be reinitialized within ufshcd_probe_hba(), the device must first be fully reset.
Resetting the device should include freeing U8 model (member of dev_info) but does not, and this causes a memory leak. ufs_put_device_desc() is responsible for freeing model.
unreferenced object 0xffff3f63008bee60 (size 32):
comm "kworker/u33:1", pid 60, jiffies 4294892642 hex dump (first 32 bytes):
54 48 47 4a 46 47 54 30 54 32 35 42 41 5a 5a 41 THGJFGT0T25BAZZA
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc ed7ff1a9):
[<ffffb86705f1243c>] kmemleak_alloc+0x34/0x40
[<ffffb8670511cee4>] __kmalloc_noprof+0x1e4/0x2fc
[<ffffb86705c247fc>] ufshcd_read_string_desc+0x94/0x190
[<ffffb86705c26854>] ufshcd_device_init+0x480/0xdf8
[<ffffb86705c27b68>] ufshcd_probe_hba+0x3c/0x404
[<ffffb86705c29264>] ufshcd_async_scan+0x40/0x370
[<ffffb86704f43e9c>] async_run_entry_fn+0x34/0xe0
[<ffffb86704f34638>] process_one_work+0x154/0x298
[<ffffb86704f34a74>] worker_thread+0x2f8/0x408
[<ffffb86704f3cfa4>] kthread+0x114/0x118
[<ffffb86704e955a0>] ret_from_fork+0x10/0x20--- drivers/ufs/core/ufshcd.c | 1 + 1 file changed, 1 insertion(+)
drivers/ufs/core/ufshcd.c +1 -0
@@ -8972,6 +8972,7 @@ static int ufshcd_probe_hba(struct ufs_h (hba->quirks & UFSHCD_QUIRK_REINIT_AFTER_MAX_GEAR_SWITCH)) {/* Reset the device and controller before doing reinit */ ufshcd_device_reset (hba); +ufs_put_device_desc (hba);ufshcd_hba_stop (hba);ufshcd_vops_reinit_notify (hba); ret =ufshcd_hba_enable (hba);
Greg Kroah-Hartman
maintainerPATCH 187/250 cifs: fix typo in module parameter enable_gcm_256
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steve French <[email protected]>
commit 8bf0287528da1992c5e49d757b99ad6bbc34b522 upstream.
enable_gcm_256 (which allows the server to require the strongest encryption) is enabled by default, but the modinfo description incorrectly showed it disabled by default. Fix the typo.
--- fs/smb/client/cifsfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/smb/client/cifsfs.c +1 -1
@@ -134,7 +134,7 @@ module_param(enable_oplocks, bool, 0644)MODULE_PARM_DESC (enable_oplocks,"Enable or disable oplocks. Default: y/Y/1" );module_param (enable_gcm_256, bool,0644 ); -MODULE_PARM_DESC (enable_gcm_256,"Enable requesting strongest (256 bit) GCM encryption. Default: n/N/0" ); +MODULE_PARM_DESC (enable_gcm_256,"Enable requesting strongest (256 bit) GCM encryption. Default: y/Y/0" );module_param (require_gcm_256, bool,0644 );MODULE_PARM_DESC (require_gcm_256,"Require strongest (256 bit) GCM encryption. Default: n/N/0" );
Greg Kroah-Hartman
maintainerPATCH 188/250 LoongArch: Fix watchpoint setting error
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Li <[email protected]>
commit f63a47b34b140ed1ca39d7e4bd4f1cdc617fc316 upstream.
In the current code, when debugging the following code using gdb, "invalid argument ..." message will be displayed.
lihui@bogon:~$ cat test.c
#include <stdio.h>
int a = 0;
int main()
{
a = 1;
return 0;
}
lihui@bogon:~$ gcc -g test.c -o test
lihui@bogon:~$ gdb test
...
(gdb) watch a
Hardware watchpoint 1: a
(gdb) r
...
Invalid argument setting hardware debug registersThere are mainly two types of issues.
1. Some incorrect judgment condition existed in user_watch_state argument parsing, causing -EINVAL to be returned.
When setting up a watchpoint, gdb uses the ptrace interface, ptrace(PTRACE_SETREGSET, tid, NT_LOONGARCH_HW_WATCH, (void *) &iov)). Register values in user_watch_state as follows:
addr[0] = 0x0, mask[0] = 0x0, ctrl[0] = 0x0 addr[1] = 0x0, mask[1] = 0x0, ctrl[1] = 0x0 addr[2] = 0x0, mask[2] = 0x0, ctrl[2] = 0x0 addr[3] = 0x0, mask[3] = 0x0, ctrl[3] = 0x0 addr[4] = 0x0, mask[4] = 0x0, ctrl[4] = 0x0 addr[5] = 0x0, mask[5] = 0x0, ctrl[5] = 0x0 addr[6] = 0x0, mask[6] = 0x0, ctrl[6] = 0x0 addr[7] = 0x12000803c, mask[7] = 0x0, ctrl[7] = 0x610
In arch_bp_generic_fields(), return -EINVAL when ctrl.len is LOONGARCH_BREAKPOINT_LEN_8(0b00). So delete the incorrect judgment here.
In ptrace_hbp_fill_attr_ctrl(), when note_type is NT_LOONGARCH_HW_WATCH and ctrl[0] == 0x0, if ((type & HW_BREAKPOINT_RW) != type) will return -EINVAL. Here ctrl.type should be set based on note_type, and unnecessary judgments can be removed.
2. The watchpoint argument was not set correctly due to unnecessary offset and alignment_mask.
Modify ptrace_hbp_fill_attr_ctrl() and hw_breakpoint_arch_parse(), which ensure the watchpont argument is set correctly.
All changes according to the LoongArch Reference Manual:
https://loongson.github.io/LoongArch-Documentation/LoongArch-Vol1-EN.html#control-and-status-registers-related-to-watchpoints
--- arch/loongarch/include/asm/hw_breakpoint.h | 2 - arch/loongarch/kernel/hw_breakpoint.c | 19 ++++------------- arch/loongarch/kernel/ptrace.c | 32 +++++++++++++---------------- 3 files changed, 21 insertions(+), 32 deletions(-)
arch/loongarch/include/asm/hw_breakpoint.h +1 -1
@@ -101,7 +101,7 @@ struct perf_event;struct perf_event_attr ;extern int arch_bp_generic_fields (struct arch_hw_breakpoint_ctrl ctrl, -int *gen_len,int *gen_type,int *offset); +int *gen_len,int *gen_type);extern int arch_check_bp_in_kernelspace (struct arch_hw_breakpoint *hw); extern int hw_breakpoint_arch_parse(struct perf_event *bp, const struct perf_event_attr *attr,
arch/loongarch/kernel/hw_breakpoint.c +5 -14
@@ -283,7 +283,7 @@ int arch_check_bp_in_kernelspace(struct* to generic breakpoint descriptions. */ int arch_bp_generic_fields (struct arch_hw_breakpoint_ctrl ctrl, -int *gen_len,int *gen_type,int *offset) +int *gen_len,int *gen_type) {/* Type */ switch (ctrl.type) {
@@ -303,11 +303,6 @@ int arch_bp_generic_fields(struct arch_hreturn -EINVAL ; } -if (!ctrl.len) -return -EINVAL ; - - *offset =__ffs (ctrl.len); -/* Len */ switch (ctrl.len) {case LOONGARCH_BREAKPOINT_LEN_1 :
@@ -386,21 +381,17 @@ int hw_breakpoint_arch_parse(struct perf struct arch_hw_breakpoint *hw) {int ret; -u64 alignment_mask, offset; +u64 alignment_mask;/* Build the arch_hw_breakpoint. */ ret =arch_build_bp_info (bp, attr, hw);if (ret)return ret; -if (hw->ctrl.type !=LOONGARCH_BREAKPOINT_EXECUTE ) - alignment_mask =0x7 ; -else +if (hw->ctrl.type ==LOONGARCH_BREAKPOINT_EXECUTE ) { alignment_mask =0x3 ; - offset = hw->address & alignment_mask; - - hw->address &= ~alignment_mask; - hw->ctrl.len <<= offset; + hw->address &= ~alignment_mask; + }return 0 ; }
arch/loongarch/kernel/ptrace.c +15 -17
@@ -494,28 +494,14 @@ static int ptrace_hbp_fill_attr_ctrl(unsstruct arch_hw_breakpoint_ctrl ctrl, struct perf_event_attr *attr) { - int err, len, type, offset; + int err, len, type; - err =arch_bp_generic_fields (ctrl, &len, &type, &offset); + err =arch_bp_generic_fields (ctrl, &len, &type);if (err)return err; -switch (note_type) { -case NT_LOONGARCH_HW_BREAK : -if ((type &HW_BREAKPOINT_X ) != type) -return -EINVAL ; -break ; -case NT_LOONGARCH_HW_WATCH : -if ((type &HW_BREAKPOINT_RW ) != type) -return -EINVAL ; -break ; -default : -return -EINVAL ; - } - attr->bp_len = len; attr->bp_type = type; - attr->bp_addr += offset;return 0 ; }
@@ -609,7 +595,19 @@ static int ptrace_hbp_set_ctrl(unsignedreturn PTR_ERR (bp); attr = bp->attr; -decode_ctrl_reg (uctrl, &ctrl); + +switch (note_type) { +case NT_LOONGARCH_HW_BREAK : + ctrl.type =LOONGARCH_BREAKPOINT_EXECUTE ; + ctrl.len =LOONGARCH_BREAKPOINT_LEN_4 ; +break ; +case NT_LOONGARCH_HW_WATCH : +decode_ctrl_reg (uctrl, &ctrl); +break ; +default : +return -EINVAL ; + } + err =ptrace_hbp_fill_attr_ctrl (note_type, ctrl, &attr);if (err)return err;
Greg Kroah-Hartman
maintainerPATCH 189/250 LoongArch: Trigger user-space watchpoints correctly
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Li <[email protected]>
commit c8e57ab0995c5b443d3c81c8a36b588776dcd0c3 upstream.
In the current code, gdb can set the watchpoint successfully through ptrace interface, but watchpoint will not be triggered.
When debugging the following code using gdb.
lihui@bogon:~$ cat test.c
#include <stdio.h>
int a = 0;
int main()
{
a = 1;
printf("a = %d\n", a);
return 0;
}
lihui@bogon:~$ gcc -g test.c -o test
lihui@bogon:~$ gdb test
...
(gdb) watch a
...
(gdb) r
...
a = 1
[Inferior 1 (process 4650) exited normally]No watchpoints were triggered, the root causes are:
1. Kernel uses perf_event and hw_breakpoint framework to control watchpoint, but the perf_event corresponding to watchpoint is not enabled. So it needs to be enabled according to MWPnCFG3 or FWPnCFG3 PLV bit field in ptrace_hbp_set_ctrl(), and privilege is set according to the monitored addr in hw_breakpoint_control(). Furthermore, add a judgment in ptrace_hbp_set_addr() to ensure kernel-space addr cannot be monitored in user mode.
2. The global enable control for all watchpoints is the WE bit of CSR.CRMD, and hardware sets the value to 0 when an exception is triggered. When the ERTN instruction is executed to return, the hardware restores the value of the PWE field of CSR.PRMD here. So, before a thread containing watchpoints be scheduled, the PWE field of CSR.PRMD needs to be set to 1. Add this modification in hw_breakpoint_control().
All changes according to the LoongArch Reference Manual:
https://loongson.github.io/LoongArch-Documentation/LoongArch-Vol1-EN.html#control-and-status-registers-related-to-watchpoints
https://loongson.github.io/LoongArch-Documentation/LoongArch-Vol1-EN.html#basic-control-and-status-registers
With this patch:
lihui@bogon:~$ gdb test ... (gdb) watch a Hardware watchpoint 1: a (gdb) r ... Hardware watchpoint 1: a
Old value = 0
New value = 1
main () at test.c:6
6 printf("a = %d\n", a);
(gdb) c
Continuing.
a = 1
[Inferior 1 (process 775) exited normally]
--- arch/loongarch/include/asm/hw_breakpoint.h | 2 ++ arch/loongarch/kernel/hw_breakpoint.c | 20 +++++++++++++++++--- arch/loongarch/kernel/ptrace.c | 15 ++++++++++++--- 3 files changed, 31 insertions(+), 6 deletions(-)
arch/loongarch/include/asm/hw_breakpoint.h +2 -0
@@ -75,6 +75,8 @@ do { \#define CSR_MWPC_NUM 0x3f#define CTRL_PLV_ENABLE 0x1e +#define CTRL_PLV0_ENABLE 0x02 +#define CTRL_PLV3_ENABLE 0x10#define MWPnCFG3_LoadEn 8#define MWPnCFG3_StoreEn 9
arch/loongarch/kernel/hw_breakpoint.c +17 -3
@@ -174,11 +174,21 @@ void flush_ptrace_hw_breakpoint(struct tstatic int hw_breakpoint_control (struct perf_event *bp,enum hw_breakpoint_ops ops) { -u32 ctrl; +u32 ctrl, privilege;int i, max_slots, enable; +struct pt_regs *regs;struct perf_event **slots;struct arch_hw_breakpoint *info =counter_arch_bp (bp); +if (arch_check_bp_in_kernelspace (info)) + privilege =CTRL_PLV0_ENABLE ; +else + privilege =CTRL_PLV3_ENABLE ; + +/* Whether bp belongs to a task. */ +if (bp->hw.target) + regs =task_pt_regs (bp->hw.target); +if (info->ctrl.type ==LOONGARCH_BREAKPOINT_EXECUTE ) {/* Breakpoint */ slots =this_cpu_ptr (bp_on_reg);
@@ -204,13 +214,15 @@ static int hw_breakpoint_control(structwrite_wb_reg (CSR_CFG_ASID , i,0 ,0 );write_wb_reg (CSR_CFG_ASID , i,1 ,0 );if (info->ctrl.type ==LOONGARCH_BREAKPOINT_EXECUTE ) { -write_wb_reg (CSR_CFG_CTRL , i,0 ,CTRL_PLV_ENABLE ); +write_wb_reg (CSR_CFG_CTRL , i,0 , privilege); }else { ctrl =encode_ctrl_reg (info->ctrl); -write_wb_reg (CSR_CFG_CTRL , i,1 , ctrl |CTRL_PLV_ENABLE ); +write_wb_reg (CSR_CFG_CTRL , i,1 , ctrl | privilege); } enable =csr_read64 (LOONGARCH_CSR_CRMD );csr_write64 (CSR_CRMD_WE | enable,LOONGARCH_CSR_CRMD ); +if (bp->hw.target) + regs->csr_prmd |=CSR_PRMD_PWE ;break ;case HW_BREAKPOINT_UNINSTALL :/* Reset the FWPnCFG/MWPnCFG 1~4 register. */
@@ -222,6 +234,8 @@ static int hw_breakpoint_control(structwrite_wb_reg (CSR_CFG_CTRL , i,1 ,0 );write_wb_reg (CSR_CFG_ASID , i,0 ,0 );write_wb_reg (CSR_CFG_ASID , i,1 ,0 ); +if (bp->hw.target) + regs->csr_prmd &= ~CSR_PRMD_PWE ;break ; }
arch/loongarch/kernel/ptrace.c +12 -3
@@ -608,9 +608,14 @@ static int ptrace_hbp_set_ctrl(unsignedreturn -EINVAL ; } - err =ptrace_hbp_fill_attr_ctrl (note_type, ctrl, &attr); -if (err) -return err; +if (uctrl &CTRL_PLV_ENABLE ) { + err =ptrace_hbp_fill_attr_ctrl (note_type, ctrl, &attr); +if (err) +return err; + attr.disabled =0 ; + }else { + attr.disabled =1 ; + }return modify_user_hw_breakpoint (bp, &attr); }
@@ -641,6 +646,10 @@ static int ptrace_hbp_set_addr(unsignedstruct perf_event *bp;struct perf_event_attr attr; +/* Kernel-space address cannot be monitored by user-space */ +if ((unsigned long )addr >=XKPRANGE ) +return -EINVAL ; + bp =ptrace_hbp_get_initialised_bp (note_type, tsk, idx);if (IS_ERR (bp))return PTR_ERR (bp);
Greg Kroah-Hartman
maintainerPATCH 190/250 LoongArch: Fix multiple hardware watchpoint issues
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Li <[email protected]>
commit 3eb2a8b23598e90fda43abb0f23cb267bd5018ba upstream.
In the current code, if multiple hardware breakpoints/watchpoints in a user-space thread, some of them will not be triggered.
When debugging the following code using gdb.
lihui@bogon:~$ cat test.c
#include <stdio.h>
int a = 0;
int main()
{
printf("start test\n");
a = 1;
printf("a = %d\n", a);
printf("end test\n");
return 0;
}
lihui@bogon:~$ gcc -g test.c -o test
lihui@bogon:~$ gdb test
...
(gdb) start
...
Temporary breakpoint 1, main () at test.c:5
5 printf("start test\n");
(gdb) watch a
Hardware watchpoint 2: a
(gdb) hbreak 8
Hardware assisted breakpoint 3 at 0x1200006ec: file test.c, line 8.
(gdb) c
Continuing.
start test
a = 1Breakpoint 3, main () at test.c:8
8 printf("end test\n");
...
The first hardware watchpoint is not triggered, the root causes are:
1. In hw_breakpoint_control(), The FWPnCFG1.2.4/MWPnCFG1.2.4 register settings are not distinguished. They should be set based on hardware watchpoint functions (fetch or load/store operations).
2. In breakpoint_handler() and watchpoint_handler(), it doesn't identify which watchpoint is triggered. So, all watchpoint-related perf_event callbacks are called and siginfo is sent to the user space. This will cause user-space unable to determine which watchpoint is triggered. The kernel need to identity which watchpoint is triggered via MWPS/ FWPS registers, and then call the corresponding perf event callbacks to report siginfo to the user-space.
Modify the relevant code to solve above issues.
All changes according to the LoongArch Reference Manual:
https://loongson.github.io/LoongArch-Documentation/LoongArch-Vol1-EN.html#control-and-status-registers-related-to-watchpoints
With this patch:
lihui@bogon:~$ gdb test
...
(gdb) start
...
Temporary breakpoint 1, main () at test.c:5
5 printf("start test\n");
(gdb) watch a
Hardware watchpoint 2: a
(gdb) hbreak 8
Hardware assisted breakpoint 3 at 0x1200006ec: file test.c, line 8.
(gdb) c
Continuing.
start testHardware watchpoint 2: a
Old value = 0
New value = 1
main () at test.c:7
7 printf("a = %d\n", a);
(gdb) c
Continuing.
a = 1
Breakpoint 3, main () at test.c:8
8 printf("end test\n");
(gdb) c
Continuing.
end test
[Inferior 1 (process 778) exited normally]
--- arch/loongarch/kernel/hw_breakpoint.c | 57 +++++++++++++++++++--------------- 1 file changed, 33 insertions(+), 24 deletions(-)
arch/loongarch/kernel/hw_breakpoint.c +33 -24
@@ -207,15 +207,15 @@ static int hw_breakpoint_control(structswitch (ops) {case HW_BREAKPOINT_INSTALL :/* Set the FWPnCFG/MWPnCFG 1~4 register. */ -write_wb_reg (CSR_CFG_ADDR , i,0 , info->address); -write_wb_reg (CSR_CFG_ADDR , i,1 , info->address); -write_wb_reg (CSR_CFG_MASK , i,0 , info->mask); -write_wb_reg (CSR_CFG_MASK , i,1 , info->mask); -write_wb_reg (CSR_CFG_ASID , i,0 ,0 ); -write_wb_reg (CSR_CFG_ASID , i,1 ,0 );if (info->ctrl.type ==LOONGARCH_BREAKPOINT_EXECUTE ) { +write_wb_reg (CSR_CFG_ADDR , i,0 , info->address); +write_wb_reg (CSR_CFG_MASK , i,0 , info->mask); +write_wb_reg (CSR_CFG_ASID , i,0 ,0 );write_wb_reg (CSR_CFG_CTRL , i,0 , privilege); }else { +write_wb_reg (CSR_CFG_ADDR , i,1 , info->address); +write_wb_reg (CSR_CFG_MASK , i,1 , info->mask); +write_wb_reg (CSR_CFG_ASID , i,1 ,0 ); ctrl =encode_ctrl_reg (info->ctrl);write_wb_reg (CSR_CFG_CTRL , i,1 , ctrl | privilege); }
@@ -226,14 +226,17 @@ static int hw_breakpoint_control(structbreak ;case HW_BREAKPOINT_UNINSTALL :/* Reset the FWPnCFG/MWPnCFG 1~4 register. */ -write_wb_reg (CSR_CFG_ADDR , i,0 ,0 ); -write_wb_reg (CSR_CFG_ADDR , i,1 ,0 ); -write_wb_reg (CSR_CFG_MASK , i,0 ,0 ); -write_wb_reg (CSR_CFG_MASK , i,1 ,0 ); -write_wb_reg (CSR_CFG_CTRL , i,0 ,0 ); -write_wb_reg (CSR_CFG_CTRL , i,1 ,0 ); -write_wb_reg (CSR_CFG_ASID , i,0 ,0 ); -write_wb_reg (CSR_CFG_ASID , i,1 ,0 ); +if (info->ctrl.type ==LOONGARCH_BREAKPOINT_EXECUTE ) { +write_wb_reg (CSR_CFG_ADDR , i,0 ,0 ); +write_wb_reg (CSR_CFG_MASK , i,0 ,0 ); +write_wb_reg (CSR_CFG_CTRL , i,0 ,0 ); +write_wb_reg (CSR_CFG_ASID , i,0 ,0 ); + }else { +write_wb_reg (CSR_CFG_ADDR , i,1 ,0 ); +write_wb_reg (CSR_CFG_MASK , i,1 ,0 ); +write_wb_reg (CSR_CFG_CTRL , i,1 ,0 ); +write_wb_reg (CSR_CFG_ASID , i,1 ,0 ); + }if (bp->hw.target) regs->csr_prmd &= ~CSR_PRMD_PWE ;break ;
@@ -476,12 +479,15 @@ void breakpoint_handler(struct pt_regs * slots =this_cpu_ptr (bp_on_reg);for (i =0 ; i < boot_cpu_data.watch_ireg_count; ++i) { - bp = slots[i]; -if (bp ==NULL ) -continue ; -perf_bp_event (bp, regs); +if ((csr_read32 (LOONGARCH_CSR_FWPS ) & (0x1 << i))) { + bp = slots[i]; +if (bp ==NULL ) +continue ; +perf_bp_event (bp, regs); +csr_write32 (0x1 << i,LOONGARCH_CSR_FWPS ); +update_bp_registers (regs,0 ,0 ); + } } -update_bp_registers (regs,0 ,0 ); }NOKPROBE_SYMBOL (breakpoint_handler);
@@ -493,12 +499,15 @@ void watchpoint_handler(struct pt_regs * slots =this_cpu_ptr (wp_on_reg);for (i =0 ; i < boot_cpu_data.watch_dreg_count; ++i) { - wp = slots[i]; -if (wp ==NULL ) -continue ; -perf_bp_event (wp, regs); +if ((csr_read32 (LOONGARCH_CSR_MWPS ) & (0x1 << i))) { + wp = slots[i]; +if (wp ==NULL ) +continue ; +perf_bp_event (wp, regs); +csr_write32 (0x1 << i,LOONGARCH_CSR_MWPS ); +update_bp_registers (regs,0 ,1 ); + } } -update_bp_registers (regs,0 ,1 ); }NOKPROBE_SYMBOL (watchpoint_handler);
Greg Kroah-Hartman
maintainerPATCH 191/250 KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <[email protected]>
commit 49f683b41f28918df3e51ddc0d928cb2e934ccdb upstream.
Use {READ,WRITE}_ONCE() to access kvm->last_boosted_vcpu to ensure the loads and stores are atomic. In the extremely unlikely scenario the compiler tears the stores, it's theoretically possible for KVM to attempt to get a vCPU using an out-of-bounds index, e.g. if the write is split into multiple 8-bit stores, and is paired with a 32-bit load on a VM with 257 vCPUs:
CPU0 CPU1 last_boosted_vcpu = 0xff;
(last_boosted_vcpu = 0x100)
last_boosted_vcpu[15:8] = 0x01;
i = (last_boosted_vcpu = 0x1ff)
last_boosted_vcpu[7:0] = 0x00;vcpu = kvm->vcpu_array[0x1ff];
As detected by KCSAN:
BUG: KCSAN: data-race in kvm_vcpu_on_spin [kvm] / kvm_vcpu_on_spin [kvm]
write to 0xffffc90025a92344 of 4 bytes by task 4340 on cpu 16:
kvm_vcpu_on_spin (arch/x86/kvm/../../../virt/kvm/kvm_main.c:4112) kvm handle_pause (arch/x86/kvm/vmx/vmx.c:5929) kvm_intel vmx_handle_exit (arch/x86/kvm/vmx/vmx.c:?
arch/x86/kvm/vmx/vmx.c:6606) kvm_intel vcpu_run (arch/x86/kvm/x86.c:11107 arch/x86/kvm/x86.c:11211) kvm kvm_arch_vcpu_ioctl_run (arch/x86/kvm/x86.c:?) kvm kvm_vcpu_ioctl (arch/x86/kvm/../../../virt/kvm/kvm_main.c:?) kvm __se_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:904 fs/ioctl.c:890) __x64_sys_ioctl (fs/ioctl.c:890) x64_sys_call (arch/x86/entry/syscall_64.c:33) do_syscall_64 (arch/x86/entry/common.c:?) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
read to 0xffffc90025a92344 of 4 bytes by task 4342 on cpu 4:
kvm_vcpu_on_spin (arch/x86/kvm/../../../virt/kvm/kvm_main.c:4069) kvm handle_pause (arch/x86/kvm/vmx/vmx.c:5929) kvm_intel vmx_handle_exit (arch/x86/kvm/vmx/vmx.c:?
arch/x86/kvm/vmx/vmx.c:6606) kvm_intel vcpu_run (arch/x86/kvm/x86.c:11107 arch/x86/kvm/x86.c:11211) kvm kvm_arch_vcpu_ioctl_run (arch/x86/kvm/x86.c:?) kvm kvm_vcpu_ioctl (arch/x86/kvm/../../../virt/kvm/kvm_main.c:?) kvm __se_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:904 fs/ioctl.c:890) __x64_sys_ioctl (fs/ioctl.c:890) x64_sys_call (arch/x86/entry/syscall_64.c:33) do_syscall_64 (arch/x86/entry/common.c:?) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
value changed: 0x00000012 -> 0x00000000
--- virt/kvm/kvm_main.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
virt/kvm/kvm_main.c +3 -2
@@ -4066,12 +4066,13 @@ void kvm_vcpu_on_spin(struct kvm_vcpu *m {struct kvm *kvm = me->kvm;struct kvm_vcpu *vcpu; -int last_boosted_vcpu = me->kvm->last_boosted_vcpu; +int last_boosted_vcpu;unsigned long i;int yielded =0 ;int try =3 ;int pass; + last_boosted_vcpu =READ_ONCE (kvm->last_boosted_vcpu);kvm_vcpu_set_in_spin_loop (me, true);/* * We boost the priority of a VCPU that is runnable but not
@@ -4109,7 +4110,7 @@ void kvm_vcpu_on_spin(struct kvm_vcpu *m yielded =kvm_vcpu_yield_to (vcpu);if (yielded >0 ) { - kvm->last_boosted_vcpu = i; +WRITE_ONCE (kvm->last_boosted_vcpu, i);break ; }else if (yielded <0 ) { try--;
Greg Kroah-Hartman
maintainerPATCH 192/250 KVM: arm64: Disassociate vcpus from redistributor region on teardown
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <[email protected]>
commit 0d92e4a7ffd5c42b9fa864692f82476c0bf8bcc8 upstream.
When tearing down a redistributor region, make sure we don't have any dangling pointer to that region stored in a vcpu.
--- arch/arm64/kvm/vgic/vgic-init.c | 2 +- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 15 +++++++++++++-- arch/arm64/kvm/vgic/vgic.h | 2 +- 3 files changed, 15 insertions(+), 4 deletions(-)
arch/arm64/kvm/vgic/vgic-init.c +1 -1
@@ -355,7 +355,7 @@ static void kvm_vgic_dist_destroy(structif (dist->vgic_model ==KVM_DEV_TYPE_ARM_VGIC_V3 ) {list_for_each_entry_safe (rdreg, next, &dist->rd_regions, list) -vgic_v3_free_redist_region (rdreg); +vgic_v3_free_redist_region (kvm, rdreg);INIT_LIST_HEAD (&dist->rd_regions); }else { dist->vgic_cpu_base =VGIC_ADDR_UNDEF ;
arch/arm64/kvm/vgic/vgic-mmio-v3.c +13 -2
@@ -919,8 +919,19 @@ free:return ret; } -void vgic_v3_free_redist_region (struct vgic_redist_region *rdreg) +void vgic_v3_free_redist_region (struct kvm *kvm,struct vgic_redist_region *rdreg) { +struct kvm_vcpu *vcpu; +unsigned long c; + +lockdep_assert_held (&kvm->arch.config_lock); + +/* Garbage collect the region */ +kvm_for_each_vcpu (c, vcpu, kvm) { +if (vcpu->arch.vgic_cpu.rdreg == rdreg) + vcpu->arch.vgic_cpu.rdreg =NULL ; + } +list_del (&rdreg->list);kfree (rdreg); }
@@ -945,7 +956,7 @@ int vgic_v3_set_redist_base(struct kvm *mutex_lock (&kvm->arch.config_lock); rdreg =vgic_v3_rdist_region_from_index (kvm, index); -vgic_v3_free_redist_region (rdreg); +vgic_v3_free_redist_region (kvm, rdreg);mutex_unlock (&kvm->arch.config_lock);return ret; }
arch/arm64/kvm/vgic/vgic.h +1 -1
@@ -317,7 +317,7 @@ vgic_v3_rd_region_size(struct kvm *kvm,struct vgic_redist_region *vgic_v3_rdist_region_from_index (struct kvm *kvm,u32 index); -void vgic_v3_free_redist_region (struct vgic_redist_region *rdreg); +void vgic_v3_free_redist_region (struct kvm *kvm,struct vgic_redist_region *rdreg);bool vgic_v3_rdist_overlap (struct kvm *kvm,gpa_t base,size_t size);
Greg Kroah-Hartman
maintainerPATCH 193/250 KVM: x86: Always sync PIR to IRR prior to scanning I/O APIC routes
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit f3ced000a2df53f4b12849e121769045a81a3b22 upstream.
Sync pending posted interrupts to the IRR prior to re-scanning I/O APIC routes, irrespective of whether the I/O APIC is emulated by userspace or by KVM. If a level-triggered interrupt routed through the I/O APIC is pending or in-service for a vCPU, KVM needs to intercept EOIs on said vCPU even if the vCPU isn't the destination for the new routing, e.g. if servicing an interrupt using the old routing races with I/O APIC reconfiguration.
Commit fceb3a36c29a ("KVM: x86: ioapic: Fix level-triggered EOI and userspace I/OAPIC reconfigure race") fixed the common cases, but kvm_apic_pending_eoi() only checks if an interrupt is in the local APIC's IRR or ISR, i.e. misses the uncommon case where an interrupt is pending in the PIR.
Failure to intercept EOI can manifest as guest hangs with Windows 11 if the guest uses the RTC as its timekeeping source, e.g. if the VMM doesn't expose a more modern form of time to the guest.
Message-ID: <[email protected]>
--- arch/x86/kvm/x86.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
arch/x86/kvm/x86.c +4 -5
@@ -10677,13 +10677,12 @@ static void vcpu_scan_ioapic(struct kvm_bitmap_zero (vcpu->arch.ioapic_handled_vectors,256 ); +static_call_cond (kvm_x86_sync_pir_to_irr)(vcpu); +if (irqchip_split (vcpu->kvm))kvm_scan_ioapic_routes (vcpu, vcpu->arch.ioapic_handled_vectors); -else { -static_call_cond (kvm_x86_sync_pir_to_irr)(vcpu); -if (ioapic_in_kernel (vcpu->kvm)) -kvm_ioapic_scan_entry (vcpu, vcpu->arch.ioapic_handled_vectors); - } +else if (ioapic_in_kernel (vcpu->kvm)) +kvm_ioapic_scan_entry (vcpu, vcpu->arch.ioapic_handled_vectors);if (is_guest_mode (vcpu)) vcpu->arch.load_eoi_exitmap_pending = true;
Greg Kroah-Hartman
maintainerPATCH 194/250 RDMA/rxe: Fix data copy for IB_SEND_INLINE
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Honggang LI <[email protected]>
commit 03fa18a992d5626fd7bf3557a52e826bf8b326b3 upstream.
For RDMA Send and Write with IB_SEND_INLINE, the memory buffers specified in sge list will be placed inline in the Send Request.
The data should be copied by CPU from the virtual addresses of corresponding sge list DMA addresses.
--- drivers/infiniband/sw/rxe/rxe_verbs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/sw/rxe/rxe_verbs.c +1 -1
@@ -812,7 +812,7 @@ static void copy_inline_data_to_wqe(struint i;for (i =0 ; i < ibwr->num_sge; i++, sge++) { -memcpy (p,ib_virt_dma_to_page (sge->addr), sge->length); +memcpy (p,ib_virt_dma_to_ptr (sge->addr), sge->length); p += sge->length; } }
Greg Kroah-Hartman
maintainerPATCH 195/250 RDMA/mlx5: Remove extra unlock on error path
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gunthorpe <[email protected]>
commit c1eb2512596fb3542357bb6c34c286f5e0374538 upstream.
The below commit lifted the locking out of this function but left this error path unlock behind resulting in unbalanced locking. Remove the missed unlock too.
--- drivers/infiniband/hw/mlx5/mr.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/infiniband/hw/mlx5/mr.c +1 -3
@@ -641,10 +641,8 @@ static int mlx5_cache_ent_insert(struct new = &((*new)->rb_left);if (cmp <0 ) new = &((*new)->rb_right); -if (cmp ==0 ) { -mutex_unlock (&cache->rb_lock); +if (cmp ==0 )return -EEXIST ; - } }/* Add new node and rebalance tree. */
Greg Kroah-Hartman
maintainerPATCH 196/250 RDMA/mlx5: Follow rb_key.ats when creating new mkeys
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gunthorpe <[email protected]>
commit f637040c3339a2ed8c12d65ad03f9552386e2fe7 upstream.
When a cache ent already exists but doesn't have any mkeys in it the cache will automatically create a new one based on the specification in the ent->rb_key.
ent->ats was missed when creating the new key and so ma_translation_mode was not being set even though the ent requires it.
--- drivers/infiniband/hw/mlx5/mr.c | 1 + 1 file changed, 1 insertion(+)
drivers/infiniband/hw/mlx5/mr.c +1 -0
@@ -246,6 +246,7 @@ static void set_cache_mkc(struct mlx5_caMLX5_SET (mkc, mkc, access_mode_1_0, ent->rb_key.access_mode &0x3 );MLX5_SET (mkc, mkc, access_mode_4_2, (ent->rb_key.access_mode >>2 ) &0x7 ); +MLX5_SET (mkc, mkc, ma_translation_mode, !!ent->rb_key.ats); MLX5_SET(mkc, mkc, translations_octword_size, get_mkc_octo_size(ent->rb_key.access_mode,
Greg Kroah-Hartman
maintainerPATCH 197/250 RDMA/mlx5: Ensure created mkeys always have a populated rb_key
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gunthorpe <[email protected]>
commit 2e4c02fdecf2f6f55cefe48cb82d93fa4f8e2204 upstream.
cachable and mmkey.rb_key together are used by mlx5_revoke_mr() to put the MR/mkey back into the cache. In all cases they should be set correctly.
alloc_cacheable_mr() was setting cachable but not filling rb_key, resulting in cache_ent_find_and_store() bucketing them all into a 0 length entry.
implicit_get_child_mr()/mlx5_ib_alloc_implicit_mr() failed to set cachable or rb_key at all, so the cache was not working at all for implicit ODP.
--- drivers/infiniband/hw/mlx5/mr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/infiniband/hw/mlx5/mr.c +2 -1
@@ -718,6 +718,8 @@ static struct mlx5_ib_mr *_mlx5_mr_cache } mr->mmkey.cache_ent = ent; mr->mmkey.type =MLX5_MKEY_MR ; + mr->mmkey.rb_key = ent->rb_key; + mr->mmkey.cacheable = true;init_waitqueue_head (&mr->mmkey.wait);return mr; }
@@ -1168,7 +1170,6 @@ static struct mlx5_ib_mr *alloc_cacheabl mr->ibmr.pd = pd; mr->umem = umem; mr->page_shift =order_base_2 (page_size); - mr->mmkey.cacheable = true;set_mr_fields (dev, mr, umem->length, access_flags, iova);return mr;
Greg Kroah-Hartman
maintainerPATCH 198/250 ovl: fix encoding fid for lower only root
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <[email protected]>
commit 004b8d1491b4bcbb7da1a3206d1e7e66822d47c6 upstream.
ovl_check_encode_origin() should return a positive number if the lower dentry is to be encoded, zero otherwise. If there's no upper layer at all (read-only overlay), then it obviously needs to return positive.
This was broken by commit 16aac5ad1fa9 ("ovl: support encoding non-decodable file handles"), which didn't take the lower-only configuration into account.
Fix by checking the no-upper-layer case up-front.
--- fs/overlayfs/export.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
fs/overlayfs/export.c +5 -1
@@ -181,6 +181,10 @@ static int ovl_check_encode_origin(strucstruct ovl_fs *ofs =OVL_FS (dentry->d_sb);bool decodable = ofs->config.nfs_export; +/* No upper layer? */ +if (!ovl_upper_mnt (ofs)) +return 1 ; +/* Lower file handle for non-upper non-decodable */ if (!ovl_dentry_upper (dentry) && !decodable)return 1 ;
@@ -209,7 +213,7 @@ static int ovl_check_encode_origin(struc* ovl_connect_layer() will try to make origin's layer "connected" by * copying up a "connectable" ancestor. */ -if (d_is_dir (dentry) &&ovl_upper_mnt (ofs) && decodable) +if (d_is_dir (dentry) && decodable)return ovl_connect_layer (dentry);/* Lower file handle for indexed and non-upper dir/non-dir */
Greg Kroah-Hartman
maintainerPATCH 199/250 wifi: mac80211: fix monitor channel with chanctx emulation
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
commit 0d9c2beed116e623ac30810d382bd67163650f98 upstream.
After the channel context emulation, there were reports that changing the monitor channel no longer works. This is because those drivers don't have WANT_MONITOR_VIF, so the setting the channel always exits out quickly.
Fix this by always allocating the virtual monitor sdata, and simply not telling the driver about it unless it wanted to. This way, we have an interface/sdata to bind the chanctx to, and the emulation can work correctly.
--- net/mac80211/driver-ops.c | 17 +++++++++++++++++ net/mac80211/iface.c | 21 +++++++++------------ net/mac80211/util.c | 2 +- 3 files changed, 27 insertions(+), 13 deletions(-)
net/mac80211/driver-ops.c +17 -0
@@ -311,6 +311,18 @@ int drv_assign_vif_chanctx(struct ieee80might_sleep ();lockdep_assert_wiphy (local->hw.wiphy); +/* +* We should perhaps push emulate chanctx down and only +* make it call ->config() when the chanctx is actually +* assigned here (and unassigned below), but that's yet +* another change to all drivers to add assign/unassign +* emulation callbacks. Maybe later. +*/ +if (sdata->vif.type ==NL80211_IFTYPE_MONITOR && + local->emulate_chanctx && + !ieee80211_hw_check (&local->hw,WANT_MONITOR_VIF )) +return 0 ; +if (!check_sdata_in_driver (sdata))return -EIO ;
@@ -338,6 +350,11 @@ void drv_unassign_vif_chanctx(struct ieemight_sleep ();lockdep_assert_wiphy (local->hw.wiphy); +if (sdata->vif.type ==NL80211_IFTYPE_MONITOR && + local->emulate_chanctx && + !ieee80211_hw_check (&local->hw,WANT_MONITOR_VIF )) +return ; +if (!check_sdata_in_driver (sdata))return ;
net/mac80211/iface.c +9 -12
@@ -1122,9 +1122,6 @@ int ieee80211_add_virtual_monitor(structstruct ieee80211_sub_if_data *sdata;int ret; -if (!ieee80211_hw_check (&local->hw,WANT_MONITOR_VIF )) -return 0 ; -ASSERT_RTNL ();lockdep_assert_wiphy (local->hw.wiphy);
@@ -1146,11 +1143,13 @@ int ieee80211_add_virtual_monitor(structieee80211_set_default_queues (sdata); - ret =drv_add_interface (local, sdata); -if (WARN_ON (ret)) { -/* ok .. stupid driver, it asked for this! */ -kfree (sdata); -return ret; +if (ieee80211_hw_check (&local->hw,WANT_MONITOR_VIF )) { + ret =drv_add_interface (local, sdata); +if (WARN_ON (ret)) { +/* ok .. stupid driver, it asked for this! */ +kfree (sdata); +return ret; + } }set_bit (SDATA_STATE_RUNNING , &sdata->state);
@@ -1188,9 +1187,6 @@ void ieee80211_del_virtual_monitor(struc {struct ieee80211_sub_if_data *sdata; -if (!ieee80211_hw_check (&local->hw,WANT_MONITOR_VIF )) -return ; -ASSERT_RTNL ();lockdep_assert_wiphy (local->hw.wiphy);
@@ -1210,7 +1206,8 @@ void ieee80211_del_virtual_monitor(strucieee80211_link_release_channel (&sdata->deflink); -drv_remove_interface (local, sdata); +if (ieee80211_hw_check (&local->hw,WANT_MONITOR_VIF )) +drv_remove_interface (local, sdata);kfree (sdata); }
net/mac80211/util.c +1 -1
@@ -1841,7 +1841,7 @@ int ieee80211_reconfig(struct ieee80211_/* add interfaces */ sdata =wiphy_dereference (local->hw.wiphy, local->monitor_sdata); -if (sdata) { +if (sdata &&ieee80211_hw_check (&local->hw,WANT_MONITOR_VIF )) {/* in HW restart it exists already */ WARN_ON (local->resuming); res =drv_add_interface (local, sdata);
Greg Kroah-Hartman
maintainerPATCH 200/250 ALSA: hda/realtek: fix mute/micmute LEDs dont work for ProBook 445/465 G11.
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Chi <[email protected]>
commit ea5f8c4cffcd8a6b62b3a3bd5008275218c9d02a upstream.
HP ProBook 445/465 G11 needs ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF quirk to make mic-mute/audio-mute working.
--- sound/pci/hda/patch_realtek.c | 4 ++++ 1 file changed, 4 insertions(+)
sound/pci/hda/patch_realtek.c +4 -0
@@ -10183,6 +10183,10 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x103c ,0x8c70 ,"HP EliteBook 835 G11" ,ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED ),SND_PCI_QUIRK (0x103c ,0x8c71 ,"HP EliteBook 845 G11" ,ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED ),SND_PCI_QUIRK (0x103c ,0x8c72 ,"HP EliteBook 865 G11" ,ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED ), +SND_PCI_QUIRK (0x103c ,0x8c7b ,"HP ProBook 445 G11" ,ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF ), +SND_PCI_QUIRK (0x103c ,0x8c7c ,"HP ProBook 445 G11" ,ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF ), +SND_PCI_QUIRK (0x103c ,0x8c7d ,"HP ProBook 465 G11" ,ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF ), +SND_PCI_QUIRK (0x103c ,0x8c7e ,"HP ProBook 465 G11" ,ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF ),SND_PCI_QUIRK (0x103c ,0x8c89 ,"HP ProBook 460 G11" ,ALC236_FIXUP_HP_GPIO_LED ),SND_PCI_QUIRK (0x103c ,0x8c8a ,"HP EliteBook 630" ,ALC236_FIXUP_HP_GPIO_LED ), SND_PCI_QUIRK(0x103c, 0x8c8c, "HP EliteBook 660", ALC236_FIXUP_HP_GPIO_LED),
Greg Kroah-Hartman
maintainerPATCH 201/250 ALSA: hda/realtek: Limit mic boost on N14AP7
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edson Juliano Drosdeck <[email protected]>
commit 86a433862912f52597263aa224a9ed82bcd533bf upstream.
The internal mic boost on the N14AP7 is too high. Fix this by applying the ALC269_FIXUP_LIMIT_INT_MIC_BOOST fixup to the machine to limit the gain.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -10572,6 +10572,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x1b7d ,0xa831 ,"Ordissimo EVE2 " ,ALC269VB_FIXUP_ORDISSIMO_EVE2 ),/* Also known as Malata PC-B1303 */ SND_PCI_QUIRK (0x1c06 ,0x2013 ,"Lemote A1802" ,ALC269_FIXUP_LEMOTE_A1802 ),SND_PCI_QUIRK (0x1c06 ,0x2015 ,"Lemote A190X" ,ALC269_FIXUP_LEMOTE_A190X ), +SND_PCI_QUIRK (0x1c6c ,0x122a ,"Positivo N14AP7" ,ALC269_FIXUP_LIMIT_INT_MIC_BOOST ),SND_PCI_QUIRK (0x1c6c ,0x1251 ,"Positivo N14KP6-TG" ,ALC288_FIXUP_DELL1_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1d05 ,0x1132 ,"TongFang PHxTxX1" ,ALC256_FIXUP_SET_COEF_DEFAULTS ), SND_PCI_QUIRK(0x1d05, 0x1096, "TongFang GMxMRxx", ALC269_FIXUP_NO_SHUTUP),
Greg Kroah-Hartman
maintainerPATCH 202/250 ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14AHP9
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Caño <[email protected]>
commit ad22051afdad962b6012f3823d0ed1a735935386 upstream.
Lenovo Yoga Pro 7 14AHP9 (PCI SSID 17aa:3891) seems requiring a similar workaround like Yoga 9 model and Yoga 7 Pro 14APH8 for the bass speaker.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -10518,6 +10518,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x17aa ,0x3882 ,"Lenovo Yoga Pro 7 14APH8" ,ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN ),SND_PCI_QUIRK (0x17aa ,0x3884 ,"Y780 YG DUAL" ,ALC287_FIXUP_TAS2781_I2C ),SND_PCI_QUIRK (0x17aa ,0x3886 ,"Y780 VECO DUAL" ,ALC287_FIXUP_TAS2781_I2C ), +SND_PCI_QUIRK (0x17aa ,0x3891 ,"Lenovo Yoga Pro 7 14AHP9" ,ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN ),SND_PCI_QUIRK (0x17aa ,0x38a7 ,"Y780P AMD YG dual" ,ALC287_FIXUP_TAS2781_I2C ),SND_PCI_QUIRK (0x17aa ,0x38a8 ,"Y780P AMD VECO dual" ,ALC287_FIXUP_TAS2781_I2C ), SND_PCI_QUIRK(0x17aa, 0x38a9, "Thinkbook 16P", ALC287_FIXUP_MG_RTKC_CSAMP_CS35L41_I2C_THINKPAD),
Greg Kroah-Hartman
maintainerPATCH 203/250 drm/i915/mso: using joiner is not possible with eDP MSO
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jani Nikula <[email protected]>
commit 49cc17967be95d64606d5684416ee51eec35e84a upstream.
It's not possible to use the joiner at the same time with eDP MSO. When a panel needs MSO, it's not optional, so MSO trumps joiner.
v3: Only change intel_dp_has_joiner(), leave debugfs alone (Ville)
--- drivers/gpu/drm/i915/display/intel_dp.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/i915/display/intel_dp.c +4 -0
@@ -431,6 +431,10 @@ bool intel_dp_can_bigjoiner(struct intelstruct intel_encoder *encoder = &intel_dig_port->base;struct drm_i915_private *dev_priv =to_i915 (encoder->base.dev); +/* eDP MSO is not compatible with joiner */ +if (intel_dp->mso_link_count) +return false; +return DISPLAY_VER (dev_priv) >=12 || (DISPLAY_VER (dev_priv) ==11 && encoder->port !=PORT_A );
Greg Kroah-Hartman
maintainerPATCH 204/250 drm/radeon: fix UBSAN warning in kv_dpm.c
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit a498df5421fd737d11bfd152428ba6b1c8538321 upstream.
Adds bounds check for sumo_vid_mapping_entry.
--- drivers/gpu/drm/radeon/sumo_dpm.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/radeon/sumo_dpm.c +2 -0
@@ -1619,6 +1619,8 @@ void sumo_construct_vid_mapping_table(stfor (i =0 ; i <SUMO_MAX_HARDWARE_POWERLEVELS ; i++) {if (table[i].ulSupportedSCLK !=0 ) { +if (table[i].usVoltageIndex >=SUMO_MAX_NUMBER_VOLTAGES ) +continue ; vid_mapping_table->entries[table[i].usVoltageIndex].vid_7bit = table[i].usVoltageID; vid_mapping_table->entries[table[i].usVoltageIndex].vid_2bit =
Greg Kroah-Hartman
maintainerPATCH 205/250 drm/amdgpu: fix UBSAN warning in kv_dpm.c
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit f0d576f840153392d04b2d52cf3adab8f62e8cb6 upstream.
Adds bounds check for sumo_vid_mapping_entry.
--- drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c +2 -0
@@ -164,6 +164,8 @@ static void sumo_construct_vid_mapping_tfor (i =0 ; i <SUMO_MAX_HARDWARE_POWERLEVELS ; i++) {if (table[i].ulSupportedSCLK !=0 ) { +if (table[i].usVoltageIndex >=SUMO_MAX_NUMBER_VOLTAGES ) +continue ; vid_mapping_table->entries[table[i].usVoltageIndex].vid_7bit = table[i].usVoltageID; vid_mapping_table->entries[table[i].usVoltageIndex].vid_2bit =
Greg Kroah-Hartman
maintainerPATCH 206/250 drm/amdgpu: fix locking scope when flushing tlb
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yunxiang Li <[email protected]>
commit 84801d4f1e4fbd2c44dddecaec9099bdff100a42 upstream.
Which method is used to flush tlb does not depend on whether a reset is in progress or not. We should skip flush altogether if the GPU will get reset. So put both path under reset_domain read lock.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 70 ++++++++++++++++---------------- 1 file changed, 36 insertions(+), 34 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c +36 -34
@@ -684,12 +684,17 @@ int amdgpu_gmc_flush_gpu_tlb_pasid(strucstruct amdgpu_ring *ring = &adev->gfx.kiq[inst].ring;struct amdgpu_kiq *kiq = &adev->gfx.kiq[inst];unsigned int ndw; -signed long r; +int r;uint32_t seq; -if (!adev->gmc.flush_pasid_uses_kiq || !ring->sched.ready || - !down_read_trylock (&adev->reset_domain->sem)) { +/* +* A GPU reset should flush all TLBs anyway, so no need to do +* this while one is ongoing. +*/ +if (!down_read_trylock (&adev->reset_domain->sem)) +return 0 ; +if (!adev->gmc.flush_pasid_uses_kiq || !ring->sched.ready) {if (adev->gmc.flush_tlb_needs_extra_type_2) adev->gmc.gmc_funcs->flush_gpu_tlb_pasid(adev, pasid, 2, all_hub,
@@ -703,43 +708,40 @@ int amdgpu_gmc_flush_gpu_tlb_pasid(struc adev->gmc.gmc_funcs->flush_gpu_tlb_pasid (adev, pasid, flush_type, all_hub, inst); -return 0 ; - } + r =0 ; + }else { +/* 2 dwords flush + 8 dwords fence */ + ndw = kiq->pmf->invalidate_tlbs_size +8 ; -/* 2 dwords flush + 8 dwords fence */ - ndw = kiq->pmf->invalidate_tlbs_size +8 ; +if (adev->gmc.flush_tlb_needs_extra_type_2) + ndw += kiq->pmf->invalidate_tlbs_size; -if (adev->gmc.flush_tlb_needs_extra_type_2) - ndw += kiq->pmf->invalidate_tlbs_size; +if (adev->gmc.flush_tlb_needs_extra_type_0) + ndw += kiq->pmf->invalidate_tlbs_size; -if (adev->gmc.flush_tlb_needs_extra_type_0) - ndw += kiq->pmf->invalidate_tlbs_size; +spin_lock (&adev->gfx.kiq[inst].ring_lock); +amdgpu_ring_alloc (ring, ndw); +if (adev->gmc.flush_tlb_needs_extra_type_2) + kiq->pmf->kiq_invalidate_tlbs (ring, pasid,2 , all_hub); -spin_lock (&adev->gfx.kiq[inst].ring_lock); -amdgpu_ring_alloc (ring, ndw); -if (adev->gmc.flush_tlb_needs_extra_type_2) - kiq->pmf->kiq_invalidate_tlbs (ring, pasid,2 , all_hub); - -if (flush_type ==2 && adev->gmc.flush_tlb_needs_extra_type_0) - kiq->pmf->kiq_invalidate_tlbs (ring, pasid,0 , all_hub); - - kiq->pmf->kiq_invalidate_tlbs (ring, pasid, flush_type, all_hub); - r =amdgpu_fence_emit_polling (ring, &seq,MAX_KIQ_REG_WAIT ); -if (r) { -amdgpu_ring_undo (ring); -spin_unlock (&adev->gfx.kiq[inst].ring_lock); - goto error_unlock_reset; - } +if (flush_type ==2 && adev->gmc.flush_tlb_needs_extra_type_0) + kiq->pmf->kiq_invalidate_tlbs (ring, pasid,0 , all_hub); -amdgpu_ring_commit (ring); -spin_unlock (&adev->gfx.kiq[inst].ring_lock); - r =amdgpu_fence_wait_polling (ring, seq, usec_timeout); -if (r <1 ) { -dev_err (adev->dev,"wait for kiq fence error: %ld.\n" , r); - r = -ETIME ; - goto error_unlock_reset; + kiq->pmf->kiq_invalidate_tlbs (ring, pasid, flush_type, all_hub); + r =amdgpu_fence_emit_polling (ring, &seq,MAX_KIQ_REG_WAIT ); +if (r) { +amdgpu_ring_undo (ring); +spin_unlock (&adev->gfx.kiq[inst].ring_lock); + goto error_unlock_reset; + } + +amdgpu_ring_commit (ring); +spin_unlock (&adev->gfx.kiq[inst].ring_lock); +if (amdgpu_fence_wait_polling (ring, seq, usec_timeout) <1 ) { +dev_err (adev->dev,"timeout waiting for kiq fence\n" ); + r = -ETIME ; + } } - r =0 ; error_unlock_reset:up_read (&adev->reset_domain->sem);
Greg Kroah-Hartman
maintainerPATCH 207/250 drm/amd/display: Remove redundant idle optimization check
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roman Li <[email protected]>
commit e2654a4453ba3dac9baacf9980d841d84e15b869 upstream.
[Why]
Disable idle optimization for each atomic commit is unnecessary, and can lead to a potential race condition.
[How]
Remove idle optimization check from amdgpu_dm_atomic_commit_tail()
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 --- 1 file changed, 3 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +0 -3
@@ -9149,9 +9149,6 @@ static void amdgpu_dm_atomic_commit_tailtrace_amdgpu_dm_atomic_commit_tail_begin (state); -if (dm->dc->caps.ips_support && dm->dc->idle_optimizations_allowed) -dc_allow_idle_optimizations (dm->dc, false); -drm_atomic_helper_update_legacy_modeset_state (dev, state);drm_dp_mst_atomic_wait_for_dependencies (state);
Greg Kroah-Hartman
maintainerPATCH 208/250 drm/amd/display: Attempt to avoid empty TUs when endpoint is DPIA
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Strauss <[email protected]>
commit c03d770c0b014a3007a5874bf6b3c3e64d32aaac upstream.
[WHY]
Empty SST TUs are illegal to transmit over a USB4 DP tunnel. Current policy is to configure stream encoder to pack 2 pixels per pclk even when ODM combine is not in use, allowing seamless dynamic ODM reconfiguration. However, in extreme edge cases where average pixel count per TU is less than 2, this can lead to unexpected empty TU generation during compliance testing. For example, VIC 1 with a 1xHBR3 link configuration will average 1.98 pix/TU.
[HOW]
Calculate average pixel count per TU, and block 2 pixels per clock if endpoint is a DPIA tunnel and pixel clock is low enough that we will never require 2:1 ODM combine.
--- drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c | 72 ++++++++++++++++ drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.h | 2 drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_init.c | 2 3 files changed, 75 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c +72 -0
@@ -1373,3 +1373,75 @@ void dcn35_set_static_screen_control(strset_static_screen_control (pipe_ctx[i]->stream_res.tg, triggers, params->num_frames); } + +static bool should_avoid_empty_tu (struct pipe_ctx *pipe_ctx) +{ +/* Calculate average pixel count per TU, return false if under ~2.00 to +* avoid empty TUs. This is only required for DPIA tunneling as empty TUs +* are legal to generate for native DP links. Assume TU size 64 as there +* is currently no scenario where it's reprogrammed from HW default. +* MTPs have no such limitation, so this does not affect MST use cases. +*/ +unsigned int pix_clk_mhz; +unsigned int symclk_mhz; +unsigned int avg_pix_per_tu_x1000; +unsigned int tu_size_bytes =64 ; +struct dc_crtc_timing *timing = &pipe_ctx->stream->timing; +struct dc_link_settings *link_settings = &pipe_ctx->link_config.dp_link_settings; +const struct dc *dc = pipe_ctx->stream->link->dc; + +if (pipe_ctx->stream->link->ep_type !=DISPLAY_ENDPOINT_USB4_DPIA ) +return false; + +// Not necessary for MST configurations +if (pipe_ctx->stream->signal ==SIGNAL_TYPE_DISPLAY_PORT_MST ) +return false; + + pix_clk_mhz = timing->pix_clk_100hz /10000 ; + +// If this is true, can't block due to dynamic ODM +if (pix_clk_mhz > dc->clk_mgr->bw_params->clk_table.entries[0 ].dispclk_mhz) +return false; + +switch (link_settings->link_rate) { +case LINK_RATE_LOW : + symclk_mhz =162 ; +break ; +case LINK_RATE_HIGH : + symclk_mhz =270 ; +break ; +case LINK_RATE_HIGH2 : + symclk_mhz =540 ; +break ; +case LINK_RATE_HIGH3 : + symclk_mhz =810 ; +break ; +default : +// We shouldn't be tunneling any other rates, something is wrong +ASSERT (0 ); +return false; + } + + avg_pix_per_tu_x1000 = (1000 * pix_clk_mhz * tu_size_bytes) + / (symclk_mhz * link_settings->lane_count); + +// Add small empirically-decided margin to account for potential jitter +return (avg_pix_per_tu_x1000 <2020 ); +} + +bool dcn35_is_dp_dig_pixel_rate_div_policy (struct pipe_ctx *pipe_ctx) +{ +struct dc *dc = pipe_ctx->stream->ctx->dc; + +if (!is_h_timing_divisible_by_2 (pipe_ctx->stream)) +return false; + +if (should_avoid_empty_tu (pipe_ctx)) +return false; + +if (dc_is_dp_signal (pipe_ctx->stream->signal) && !dc->link_srv->dp_is_128b_132b_signal (pipe_ctx) && + dc->debug.enable_dp_dig_pixel_rate_div_policy) +return true; + +return false; +}
drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.h +2 -0
@@ -93,4 +93,6 @@ void dcn35_set_drr(struct pipe_ctx **pipvoid dcn35_set_static_screen_control (struct pipe_ctx **pipe_ctx,int num_pipes,const struct dc_static_screen_params *params); +bool dcn35_is_dp_dig_pixel_rate_div_policy (struct pipe_ctx *pipe_ctx); +#endif /* __DC_HWSS_DCN35_H__ */
drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_init.c +1 -1
@@ -158,7 +158,7 @@ static const struct hwseq_private_funcs .setup_hpo_hw_control = dcn35_setup_hpo_hw_control, .calculate_dccg_k1_k2_values = dcn32_calculate_dccg_k1_k2_values, .set_pixels_per_cycle = dcn32_set_pixels_per_cycle, - .is_dp_dig_pixel_rate_div_policy = dcn32_is_dp_dig_pixel_rate_div_policy, + .is_dp_dig_pixel_rate_div_policy = dcn35_is_dp_dig_pixel_rate_div_policy, .dsc_pg_control = dcn35_dsc_pg_control, .dsc_pg_status = dcn32_dsc_pg_status, .enable_plane = dcn35_enable_plane,
Greg Kroah-Hartman
maintainerPATCH 209/250 dt-bindings: dma: fsl-edma: fix dma-channels constraints
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
commit 1345a13f18370ad9e5bc98995959a27f9bd71464 upstream.
dma-channels is a number, not a list. Apply proper constraints on the actual number.
--- Documentation/devicetree/bindings/dma/fsl,edma.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
Documentation/devicetree/bindings/dma/fsl,edma.yaml +2 -2
@@ -48,8 +48,8 @@ properties: - 3 dma-channels: - minItems: 1 - maxItems: 64 + minimum: 1 + maximum: 64 clocks: minItems: 1
Greg Kroah-Hartman
maintainerPATCH 210/250 ocfs2: fix NULL pointer dereference in ocfs2_journal_dirty()
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joseph Qi <[email protected]>
commit 58f7e1e2c9e72c7974054c64c3abeac81c11f822 upstream.
bdev->bd_super has been removed and commit 8887b94d9322 change the usage from bdev->bd_super to b_assoc_map->host->i_sb. This introduces the following NULL pointer dereference in ocfs2_journal_dirty() since b_assoc_map is still not initialized. This can be easily reproduced by running xfstests generic/186, which simulate no more credits.
[ 134.351592] BUG: kernel NULL pointer dereference, address: 0000000000000000 ... [ 134.355341] RIP: 0010:ocfs2_journal_dirty+0x14f/0x160 [ocfs2] ... [ 134.365071] Call Trace: [ 134.365312] <TASK> [ 134.365524] ? __die_body+0x1e/0x60 [ 134.365868] ? page_fault_oops+0x13d/0x4f0 [ 134.366265] ? __pfx_bit_wait_io+0x10/0x10 [ 134.366659] ? schedule+0x27/0xb0 [ 134.366981] ? exc_page_fault+0x6a/0x140 [ 134.367356] ? asm_exc_page_fault+0x26/0x30 [ 134.367762] ? ocfs2_journal_dirty+0x14f/0x160 [ocfs2] [ 134.368305] ? ocfs2_journal_dirty+0x13d/0x160 [ocfs2] [ 134.368837] ocfs2_create_new_meta_bhs.isra.51+0x139/0x2e0 [ocfs2] [ 134.369454] ocfs2_grow_tree+0x688/0x8a0 [ocfs2] [ 134.369927] ocfs2_split_and_insert.isra.67+0x35c/0x4a0 [ocfs2] [ 134.370521] ocfs2_split_extent+0x314/0x4d0 [ocfs2] [ 134.371019] ocfs2_change_extent_flag+0x174/0x410 [ocfs2] [ 134.371566] ocfs2_add_refcount_flag+0x3fa/0x630 [ocfs2] [ 134.372117] ocfs2_reflink_remap_extent+0x21b/0x4c0 [ocfs2] [ 134.372994] ? inode_update_timestamps+0x4a/0x120 [ 134.373692] ? __pfx_ocfs2_journal_access_di+0x10/0x10 [ocfs2] [ 134.374545] ? __pfx_ocfs2_journal_access_di+0x10/0x10 [ocfs2] [ 134.375393] ocfs2_reflink_remap_blocks+0xe4/0x4e0 [ocfs2] [ 134.376197] ocfs2_remap_file_range+0x1de/0x390 [ocfs2] [ 134.376971] ? security_file_permission+0x29/0x50 [ 134.377644] vfs_clone_file_range+0xfe/0x320 [ 134.378268] ioctl_file_clone+0x45/0xa0 [ 134.378853] do_vfs_ioctl+0x457/0x990 [ 134.379422] __x64_sys_ioctl+0x6e/0xd0 [ 134.379987] do_syscall_64+0x5d/0x170 [ 134.380550] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 134.381231] RIP: 0033:0x7fa4926397cb [ 134.381786] Code: 73 01 c3 48 8b 0d bd 56 38 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 8d 56 38 00 f7 d8 64 89 01 48 [ 134.383930] RSP: 002b:00007ffc2b39f7b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 134.384854] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007fa4926397cb [ 134.385734] RDX: 00007ffc2b39f7f0 RSI: 000000004020940d RDI: 0000000000000003 [ 134.386606] RBP: 0000000000000000 R08: 00111a82a4f015bb R09: 00007fa494221000 [ 134.387476] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 134.388342] R13: 0000000000f10000 R14: 0000558e844e2ac8 R15: 0000000000f10000 [ 134.389207] </TASK>
Fix it by only aborting transaction and journal in ocfs2_journal_dirty() now, and leave ocfs2_abort() later when detecting an aborted handle, e.g. start next transaction. Also log the handle details in this case.
--- fs/ocfs2/journal.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
fs/ocfs2/journal.c +6 -4
@@ -778,13 +778,15 @@ void ocfs2_journal_dirty(handle_t *handlif (!is_handle_aborted (handle)) {journal_t *journal = handle->h_transaction->t_journal; -mlog (ML_ERROR ,"jbd2_journal_dirty_metadata failed. " -"Aborting transaction and journal.\n" ); +mlog (ML_ERROR ,"jbd2_journal_dirty_metadata failed: " +"handle type %u started at line %u, credits %u/%u " +"errcode %d. Aborting transaction and journal.\n" , + handle->h_type, handle->h_line_no, + handle->h_requested_credits, +jbd2_handle_buffer_credits (handle), status); handle->h_err = status;jbd2_journal_abort_handle (handle);jbd2_journal_abort (journal, status); -ocfs2_abort (bh->b_assoc_map->host->i_sb, -"Journal already aborted.\n" ); } } }
Greg Kroah-Hartman
maintainerPATCH 211/250 ocfs2: fix NULL pointer dereference in ocfs2_abort_trigger()
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joseph Qi <[email protected]>
commit 685d03c3795378fca6a1b3d43581f7f1a3fc095f upstream.
bdev->bd_super has been removed and commit 8887b94d9322 change the usage from bdev->bd_super to b_assoc_map->host->i_sb. Since ocfs2 hasn't set bh->b_assoc_map, it will trigger NULL pointer dereference when calling into ocfs2_abort_trigger().
Actually this was pointed out in history, see commit 74e364ad1b13. But I've made a mistake when reviewing commit 8887b94d9322 and then re-introduce this regression.
Since we cannot revive bdev in buffer head, so fix this issue by initializing all types of ocfs2 triggers when fill super, and then get the specific ocfs2 trigger from ocfs2_caching_info when access journal.
--- fs/ocfs2/journal.c | 190 +++++++++++++++++++++++++++++------------------------ fs/ocfs2/ocfs2.h | 27 +++++++ fs/ocfs2/super.c | 4 - 3 files changed, 135 insertions(+), 86 deletions(-)
fs/ocfs2/journal.c +105 -85
@@ -479,12 +479,6 @@ bail:return status; } - -struct ocfs2_triggers { -struct jbd2_buffer_trigger_type ot_triggers; -int ot_offset; -}; -static inline struct ocfs2_triggers *to_ocfs2_trigger (struct jbd2_buffer_trigger_type *triggers) { return container_of(triggers, struct ocfs2_triggers, ot_triggers);
@@ -548,85 +542,76 @@ static void ocfs2_db_frozen_trigger(strustatic void ocfs2_abort_trigger (struct jbd2_buffer_trigger_type *triggers,struct buffer_head *bh) { +struct ocfs2_triggers *ot =to_ocfs2_trigger (triggers); +mlog (ML_ERROR ,"ocfs2_abort_trigger called by JBD2. bh = 0x%lx, " "bh->b_blocknr = %llu\n" , (unsigned long )bh, (unsigned long long )bh->b_blocknr); -ocfs2_error (bh->b_assoc_map->host->i_sb, +ocfs2_error (ot->sb,"JBD2 has aborted our journal, ocfs2 cannot continue\n" ); } -static struct ocfs2_triggers di_triggers = { - .ot_triggers = { - .t_frozen = ocfs2_frozen_trigger, - .t_abort = ocfs2_abort_trigger, - }, - .ot_offset = offsetof(struct ocfs2_dinode , i_check), -}; - -static struct ocfs2_triggers eb_triggers = { - .ot_triggers = { - .t_frozen = ocfs2_frozen_trigger, - .t_abort = ocfs2_abort_trigger, - }, - .ot_offset = offsetof(struct ocfs2_extent_block , h_check), -}; - -static struct ocfs2_triggers rb_triggers = { - .ot_triggers = { - .t_frozen = ocfs2_frozen_trigger, - .t_abort = ocfs2_abort_trigger, - }, - .ot_offset = offsetof(struct ocfs2_refcount_block , rf_check), -}; - -static struct ocfs2_triggers gd_triggers = { - .ot_triggers = { - .t_frozen = ocfs2_frozen_trigger, - .t_abort = ocfs2_abort_trigger, - }, - .ot_offset = offsetof(struct ocfs2_group_desc , bg_check), -}; - -static struct ocfs2_triggers db_triggers = { - .ot_triggers = { - .t_frozen = ocfs2_db_frozen_trigger, - .t_abort = ocfs2_abort_trigger, - }, -}; - -static struct ocfs2_triggers xb_triggers = { - .ot_triggers = { - .t_frozen = ocfs2_frozen_trigger, - .t_abort = ocfs2_abort_trigger, - }, - .ot_offset = offsetof(struct ocfs2_xattr_block , xb_check), -}; - -static struct ocfs2_triggers dq_triggers = { - .ot_triggers = { - .t_frozen = ocfs2_dq_frozen_trigger, - .t_abort = ocfs2_abort_trigger, - }, -}; - -static struct ocfs2_triggers dr_triggers = { - .ot_triggers = { - .t_frozen = ocfs2_frozen_trigger, - .t_abort = ocfs2_abort_trigger, - }, - .ot_offset = offsetof(struct ocfs2_dx_root_block , dr_check), -}; - -static struct ocfs2_triggers dl_triggers = { - .ot_triggers = { - .t_frozen = ocfs2_frozen_trigger, - .t_abort = ocfs2_abort_trigger, - }, - .ot_offset = offsetof(struct ocfs2_dx_leaf , dl_check), -}; +static void ocfs2_setup_csum_triggers (struct super_block *sb, +enum ocfs2_journal_trigger_type type, +struct ocfs2_triggers *ot) +{ +BUG_ON (type >=OCFS2_JOURNAL_TRIGGER_COUNT ); + +switch (type) { +case OCFS2_JTR_DI : + ot->ot_triggers.t_frozen = ocfs2_frozen_trigger; + ot->ot_offset = offsetof(struct ocfs2_dinode , i_check); +break ; +case OCFS2_JTR_EB : + ot->ot_triggers.t_frozen = ocfs2_frozen_trigger; + ot->ot_offset = offsetof(struct ocfs2_extent_block , h_check); +break ; +case OCFS2_JTR_RB : + ot->ot_triggers.t_frozen = ocfs2_frozen_trigger; + ot->ot_offset = offsetof(struct ocfs2_refcount_block , rf_check); +break ; +case OCFS2_JTR_GD : + ot->ot_triggers.t_frozen = ocfs2_frozen_trigger; + ot->ot_offset = offsetof(struct ocfs2_group_desc , bg_check); +break ; +case OCFS2_JTR_DB : + ot->ot_triggers.t_frozen = ocfs2_db_frozen_trigger; +break ; +case OCFS2_JTR_XB : + ot->ot_triggers.t_frozen = ocfs2_frozen_trigger; + ot->ot_offset = offsetof(struct ocfs2_xattr_block , xb_check); +break ; +case OCFS2_JTR_DQ : + ot->ot_triggers.t_frozen = ocfs2_dq_frozen_trigger; +break ; +case OCFS2_JTR_DR : + ot->ot_triggers.t_frozen = ocfs2_frozen_trigger; + ot->ot_offset = offsetof(struct ocfs2_dx_root_block , dr_check); +break ; +case OCFS2_JTR_DL : + ot->ot_triggers.t_frozen = ocfs2_frozen_trigger; + ot->ot_offset = offsetof(struct ocfs2_dx_leaf , dl_check); +break ; +case OCFS2_JTR_NONE : +/* To make compiler happy... */ +return ; + } + + ot->ot_triggers.t_abort = ocfs2_abort_trigger; + ot->sb = sb; +} + +void ocfs2_initialize_journal_triggers (struct super_block *sb, +struct ocfs2_triggers triggers[]) +{ +enum ocfs2_journal_trigger_type type; + +for (type =OCFS2_JTR_DI ; type <OCFS2_JOURNAL_TRIGGER_COUNT ; type++) +ocfs2_setup_csum_triggers (sb, type, &triggers[type]); +} static int __ocfs2_journal_access(handle_t *handle, struct ocfs2_caching_info *ci,
@@ -708,56 +693,91 @@ static int __ocfs2_journal_access(handleint ocfs2_journal_access_di (handle_t *handle,struct ocfs2_caching_info *ci,struct buffer_head *bh,int type) { -return __ocfs2_journal_access (handle, ci, bh, &di_triggers, type); +struct ocfs2_super *osb =OCFS2_SB (ocfs2_metadata_cache_get_super (ci)); + +return __ocfs2_journal_access (handle, ci, bh, + &osb->s_journal_triggers[OCFS2_JTR_DI ], + type); }int ocfs2_journal_access_eb (handle_t *handle,struct ocfs2_caching_info *ci,struct buffer_head *bh,int type) { -return __ocfs2_journal_access (handle, ci, bh, &eb_triggers, type); +struct ocfs2_super *osb =OCFS2_SB (ocfs2_metadata_cache_get_super (ci)); + +return __ocfs2_journal_access (handle, ci, bh, + &osb->s_journal_triggers[OCFS2_JTR_EB ], + type); }int ocfs2_journal_access_rb (handle_t *handle,struct ocfs2_caching_info *ci,struct buffer_head *bh,int type) { -return __ocfs2_journal_access (handle, ci, bh, &rb_triggers, +struct ocfs2_super *osb =OCFS2_SB (ocfs2_metadata_cache_get_super (ci)); + +return __ocfs2_journal_access (handle, ci, bh, + &osb->s_journal_triggers[OCFS2_JTR_RB ], type); }int ocfs2_journal_access_gd (handle_t *handle,struct ocfs2_caching_info *ci,struct buffer_head *bh,int type) { -return __ocfs2_journal_access (handle, ci, bh, &gd_triggers, type); +struct ocfs2_super *osb =OCFS2_SB (ocfs2_metadata_cache_get_super (ci)); + +return __ocfs2_journal_access (handle, ci, bh, + &osb->s_journal_triggers[OCFS2_JTR_GD ], + type); }int ocfs2_journal_access_db (handle_t *handle,struct ocfs2_caching_info *ci,struct buffer_head *bh,int type) { -return __ocfs2_journal_access (handle, ci, bh, &db_triggers, type); +struct ocfs2_super *osb =OCFS2_SB (ocfs2_metadata_cache_get_super (ci)); + +return __ocfs2_journal_access (handle, ci, bh, + &osb->s_journal_triggers[OCFS2_JTR_DB ], + type); }int ocfs2_journal_access_xb (handle_t *handle,struct ocfs2_caching_info *ci,struct buffer_head *bh,int type) { -return __ocfs2_journal_access (handle, ci, bh, &xb_triggers, type); +struct ocfs2_super *osb =OCFS2_SB (ocfs2_metadata_cache_get_super (ci)); + +return __ocfs2_journal_access (handle, ci, bh, + &osb->s_journal_triggers[OCFS2_JTR_XB ], + type); }int ocfs2_journal_access_dq (handle_t *handle,struct ocfs2_caching_info *ci,struct buffer_head *bh,int type) { -return __ocfs2_journal_access (handle, ci, bh, &dq_triggers, type); +struct ocfs2_super *osb =OCFS2_SB (ocfs2_metadata_cache_get_super (ci)); + +return __ocfs2_journal_access (handle, ci, bh, + &osb->s_journal_triggers[OCFS2_JTR_DQ ], + type); }int ocfs2_journal_access_dr (handle_t *handle,struct ocfs2_caching_info *ci,struct buffer_head *bh,int type) { -return __ocfs2_journal_access (handle, ci, bh, &dr_triggers, type); +struct ocfs2_super *osb =OCFS2_SB (ocfs2_metadata_cache_get_super (ci)); + +return __ocfs2_journal_access (handle, ci, bh, + &osb->s_journal_triggers[OCFS2_JTR_DR ], + type); }int ocfs2_journal_access_dl (handle_t *handle,struct ocfs2_caching_info *ci,struct buffer_head *bh,int type) { -return __ocfs2_journal_access (handle, ci, bh, &dl_triggers, type); +struct ocfs2_super *osb =OCFS2_SB (ocfs2_metadata_cache_get_super (ci)); + +return __ocfs2_journal_access (handle, ci, bh, + &osb->s_journal_triggers[OCFS2_JTR_DL ], + type); } int ocfs2_journal_access(handle_t *handle, struct ocfs2_caching_info *ci,
fs/ocfs2/ocfs2.h +27 -0
@@ -284,6 +284,30 @@ enum ocfs2_mount_options#define OCFS2_OSB_ERROR_FS 0x0004#define OCFS2_DEFAULT_ATIME_QUANTUM 60 +struct ocfs2_triggers { +struct jbd2_buffer_trigger_type ot_triggers; +int ot_offset; +struct super_block *sb; +}; + +enum ocfs2_journal_trigger_type { +OCFS2_JTR_DI , +OCFS2_JTR_EB , +OCFS2_JTR_RB , +OCFS2_JTR_GD , +OCFS2_JTR_DB , +OCFS2_JTR_XB , +OCFS2_JTR_DQ , +OCFS2_JTR_DR , +OCFS2_JTR_DL , +OCFS2_JTR_NONE /* This must be the last entry */ +}; + +#define OCFS2_JOURNAL_TRIGGER_COUNT OCFS2_JTR_NONE + +void ocfs2_initialize_journal_triggers (struct super_block *sb, +struct ocfs2_triggers triggers[]); +struct ocfs2_journal ;struct ocfs2_slot_info ;struct ocfs2_recovery_map ;
@@ -351,6 +375,9 @@ struct ocfs2_superstruct ocfs2_journal *journal;unsigned long osb_commit_interval; +/* Journal triggers for checksum */ +struct ocfs2_triggers s_journal_triggers[OCFS2_JOURNAL_TRIGGER_COUNT ]; +struct delayed_work la_enable_wq;/*
fs/ocfs2/super.c +3 -1
@@ -1075,9 +1075,11 @@ static int ocfs2_fill_super(struct superdebugfs_create_file ("fs_state" ,S_IFREG |S_IRUSR , osb->osb_debug_root, osb, &ocfs2_osb_debug_fops); -if (ocfs2_meta_ecc (osb)) +if (ocfs2_meta_ecc (osb)) { +ocfs2_initialize_journal_triggers (sb, osb->s_journal_triggers);ocfs2_blockcheck_stats_debugfs_install ( &osb->osb_ecc_stats, osb->osb_debug_root); + } status =ocfs2_mount_volume (sb);if (status <0 )
Greg Kroah-Hartman
maintainerPATCH 212/250 scsi: core: Introduce the BLIST_SKIP_IO_HINTS flag
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
commit 633aeefafc9c2a07a76a62be6aac1d73c3e3defa upstream.
Prepare for skipping the IO Advice Hints Grouping mode page for USB storage devices.
--- drivers/scsi/sd.c | 4 ++++ include/scsi/scsi_devinfo.h | 4 +++- 2 files changed, 7 insertions(+), 1 deletion(-)
drivers/scsi/sd.c +4 -0
@@ -63,6 +63,7 @@#include <scsi/scsi_cmnd.h> #include <scsi/scsi_dbg.h> #include <scsi/scsi_device.h> +#include <scsi/scsi_devinfo.h> #include <scsi/scsi_driver.h> #include <scsi/scsi_eh.h> #include <scsi/scsi_host.h>
@@ -3125,6 +3126,9 @@ static void sd_read_io_hints(struct scsistruct scsi_mode_data data;int res; +if (sdp->sdev_bflags &BLIST_SKIP_IO_HINTS ) +return ; + res =scsi_mode_sense (sdp,/*dbd=*/ 0x8 ,/*modepage=*/ 0x0a ,/*subpage=*/ 0x05 , buffer,SD_BUF_SIZE ,SD_TIMEOUT , sdkp->max_retries, &data, &sshdr);
include/scsi/scsi_devinfo.h +3 -1
@@ -69,8 +69,10 @@#define BLIST_RETRY_ITF ((__force blist_flags_t)(1ULL << 32))/* Always retry ABORTED_COMMAND with ASC 0xc1 */ #define BLIST_RETRY_ASC_C1 ((__force blist_flags_t)(1ULL << 33)) +/* Do not query the IO Advice Hints Grouping mode page */ +#define BLIST_SKIP_IO_HINTS ((__force blist_flags_t)(1ULL << 34)) -#define __BLIST_LAST_USED BLIST_RETRY_ASC_C1 +#define __BLIST_LAST_USED BLIST_SKIP_IO_HINTS#define __BLIST_HIGH_UNUSED (~(__BLIST_LAST_USED | \ (__force blist_flags_t) \
Greg Kroah-Hartman
maintainerPATCH 213/250 scsi: usb: uas: Do not query the IO Advice Hints Grouping mode page for USB/UAS devices
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
commit 57619f3cdeb5ae9f4252833b0ed600e9f81da722 upstream.
Recently it was reported that the following USB storage devices are unusable with Linux kernel 6.9:
* Kingston DataTraveler G2
* Garmin FR35
This is because attempting to read the IO Advice Hints Grouping mode page causes these devices to reset. Hence do not read the IO Advice Hints Grouping mode page from USB/UAS storage devices.
--- drivers/usb/storage/scsiglue.c | 6 ++++++ drivers/usb/storage/uas.c | 7 +++++++ 2 files changed, 13 insertions(+)
drivers/usb/storage/scsiglue.c +6 -0
@@ -86,6 +86,12 @@ static int slave_alloc (struct scsi_deviif (us->protocol ==USB_PR_BULK && us->max_lun >0 ) sdev->sdev_bflags |=BLIST_FORCELUN ; +/* +* Some USB storage devices reset if the IO advice hints grouping mode +* page is queried. Hence skip that mode page. +*/ + sdev->sdev_bflags |=BLIST_SKIP_IO_HINTS ; +return 0 ; }
drivers/usb/storage/uas.c +7 -0
@@ -21,6 +21,7 @@#include <scsi/scsi.h> #include <scsi/scsi_eh.h> #include <scsi/scsi_dbg.h> +#include <scsi/scsi_devinfo.h> #include <scsi/scsi_cmnd.h> #include <scsi/scsi_device.h> #include <scsi/scsi_host.h>
@@ -820,6 +821,12 @@ static int uas_slave_alloc(struct scsi_dstruct uas_dev_info *devinfo = (struct uas_dev_info *)sdev->host->hostdata; +/* +* Some USB storage devices reset if the IO advice hints grouping mode +* page is queried. Hence skip that mode page. +*/ + sdev->sdev_bflags |=BLIST_SKIP_IO_HINTS ; + sdev->hostdata = devinfo;/*
Greg Kroah-Hartman
maintainerPATCH 214/250 ata: ahci: Do not enable LPM if no LPM states are supported by the HBA
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <[email protected]>
commit fa997b0576c9df635ee363406f5e014dba0f9264 upstream.
LPM consists of HIPM (host initiated power management) and DIPM (device initiated power management).
ata_eh_set_lpm() will only enable HIPM if both the HBA and the device supports it.
However, DIPM will be enabled as long as the device supports it. The HBA will later reject the device's request to enter a power state that it does not support (Slumber/Partial/DevSleep) (DevSleep is never initiated by the device).
For a HBA that doesn't support any LPM states, simply don't set a LPM policy such that all the HIPM/DIPM probing/enabling will be skipped.
Not enabling HIPM or DIPM in the first place is safer than relying on the device following the AHCI specification and respecting the NAK. (There are comments in the code that some devices misbehave when receiving a NAK.)
Performing this check in ahci_update_initial_lpm_policy() also has the advantage that a HBA that doesn't support any LPM states will take the exact same code paths as a port that is external/hot plug capable.
Side note: the port in ata_port_dbg() has not been given a unique id yet, but this is not overly important as the debug print is disabled unless explicitly enabled using dynamic debug. A follow-up series will make sure that the unique id assignment will be done earlier. For now, the important thing is that the function returns before setting the LPM policy.
--- drivers/ata/ahci.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/ata/ahci.c +8 -0
@@ -1735,6 +1735,14 @@ static void ahci_update_initial_lpm_policy(struct ata_port *ap)if (ap->pflags &ATA_PFLAG_EXTERNAL )return ; +/* If no LPM states are supported by the HBA, do not bother with LPM */ +if ((ap->host->flags &ATA_HOST_NO_PART ) && + (ap->host->flags &ATA_HOST_NO_SSC ) && + (ap->host->flags &ATA_HOST_NO_DEVSLP )) { +ata_port_dbg (ap,"no LPM states supported, not enabling LPM\n" ); +return ; + } +/* user modified policy via module param */ if (mobile_lpm_policy !=-1 ) { policy = mobile_lpm_policy;
Signature · 1 line
2.45.2
Greg Kroah-Hartman
maintainerPATCH 215/250 dmaengine: xilinx: xdma: Fix data synchronisation in xdma_channel_isr()
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Louis Chauvet <[email protected]>
commit 462237d2d93fc9e9221d1cf9f773954d27da83c0 upstream.
Requests the vchan lock before using xdma->stop_request.
--- drivers/dma/xilinx/xdma.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/dma/xilinx/xdma.c +2 -2
@@ -885,11 +885,11 @@ static irqreturn_t xdma_channel_isr(int irq, void *dev_id)u32 st;bool repeat_tx; +spin_lock (&xchan->vchan.lock); +if (xchan->stop_requested)complete (&xchan->last_interrupt); -spin_lock (&xchan->vchan.lock); -/* get submitted request */ vd =vchan_next_desc (&xchan->vchan);if (!vd)
Signature · 1 line
2.45.2
Greg Kroah-Hartman
maintainerPATCH 216/250 net/tcp_ao: Dont leak ao_info on error-path
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Safonov <[email protected]>
commit f9ae848904289ddb16c7c9e4553ed4c64300de49 upstream.
It seems I introduced it together with TCP_AO_CMDF_AO_REQUIRED, on version 5 [1] of TCP-AO patches. Quite frustrative that having all these selftests that I've written, running kmemtest & kcov was always in todo.
[1]: https://lore.kernel.org/netdev/[email protected]/
--- net/ipv4/tcp_ao.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/ipv4/tcp_ao.c +4 -2
@@ -1968,8 +1968,10 @@ static int tcp_ao_info_cmd(struct sock *sk, unsigned short int family, first = true; } -if (cmd.ao_required &&tcp_ao_required_verify (sk)) -return -EKEYREJECTED ; +if (cmd.ao_required &&tcp_ao_required_verify (sk)) { + err = -EKEYREJECTED ; + goto out; + }/* For sockets in TCP_CLOSED it's possible set keys that aren't * matching the future peer (address/port/VRF/etc),
Signature · 1 line
2.45.2
Greg Kroah-Hartman
maintainerPATCH 217/250 gcov: add support for GCC 14
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Oberparleiter <[email protected]>
commit c1558bc57b8e5b4da5d821537cd30e2e660861d8 upstream.
Using gcov on kernels compiled with GCC 14 results in truncated 16-byte long .gcda files with no usable data. To fix this, update GCOV_COUNTERS to match the value defined by GCC 14.
Tested with GCC versions 14.1.0 and 13.2.0.
--- kernel/gcov/gcc_4_7.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
kernel/gcov/gcc_4_7.c +3 -1
@@ -18,7 +18,9 @@#include <linux/mm.h> #include "gcov.h" -#if (__GNUC__ >=10 ) +#if (__GNUC__ >=14 ) +#define GCOV_COUNTERS 9 +#elif (__GNUC__ >=10 )#define GCOV_COUNTERS 8#elif (__GNUC__ >=7 )#define GCOV_COUNTERS 9
Greg Kroah-Hartman
maintainerPATCH 218/250 kcov: dont lose track of remote references during softirqs
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Nogikh <[email protected]>
commit 01c8f9806bde438ca1c8cbbc439f0a14a6694f6c upstream.
In kcov_remote_start()/kcov_remote_stop(), we swap the previous KCOV metadata of the current task into a per-CPU variable. However, the kcov_mode_enabled(mode) check is not sufficient in the case of remote KCOV
coverage: current->kcov_mode always remains KCOV_MODE_DISABLED for remote KCOV objects.
If the original task that has invoked the KCOV_REMOTE_ENABLE ioctl happens to get interrupted and kcov_remote_start() is called, it ultimately leads to kcov_remote_stop() NOT restoring the original KCOV reference. So when the task exits, all registered remote KCOV handles remain active forever.
The most uncomfortable effect (at least for syzkaller) is that the bug prevents the reuse of the same /sys/kernel/debug/kcov descriptor. If we obtain it in the parent process and then e.g. drop some capabilities and continuously fork to execute individual programs, at some point current->kcov of the forked process is lost, kcov_task_exit() takes no action, and all KCOV_REMOTE_ENABLE ioctls calls from subsequent forks fail.
And, yes, the efficiency is also affected if we keep on losing remote kcov objects.
a) kcov_remote_map keeps on growing forever.
b) (If I'm not mistaken), we're also not freeing the memory referenced by kcov->area.
Fix it by introducing a special kcov_mode that is assigned to the task that owns a KCOV remote object. It makes kcov_mode_enabled() return true and yet does not trigger coverage collection in __sanitizer_cov_trace_pc() and write_comp_data().
--- include/linux/kcov.h | 2 ++ kernel/kcov.c | 1 + 2 files changed, 3 insertions(+)
include/linux/kcov.h +2 -0
@@ -21,6 +21,8 @@ enum kcov_mode {KCOV_MODE_TRACE_PC =2 ,/* Collecting comparison operands mode. */ KCOV_MODE_TRACE_CMP =3 , +/* The process owns a KCOV remote reference. */ + KCOV_MODE_REMOTE = 4, };#define KCOV_IN_CTXSW (1 << 30)
kernel/kcov.c +1 -0
@@ -631,6 +631,7 @@ static int kcov_ioctl_locked(struct kcovreturn -EINVAL ; kcov->mode = mode; t->kcov = kcov; + t->kcov_mode =KCOV_MODE_REMOTE ; kcov->t = t; kcov->remote = true; kcov->remote_size = remote_arg->area_size;
Greg Kroah-Hartman
maintainerPATCH 219/250 efi/x86: Free EFI memory map only when installing a new one.
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <[email protected]>
commit 75dde792d6f6c2d0af50278bd374bf0c512fe196 upstream.
The logic in __efi_memmap_init() is shared between two different execution flows:
- mapping the EFI memory map early or late into the kernel VA space, so that its entries can be accessed;
- the x86 specific cloning of the EFI memory map in order to insert new entries that are created as a result of making a memory reservation via a call to efi_mem_reserve().
In the former case, the underlying memory containing the kernel's view of the EFI memory map (which may be heavily modified by the kernel itself on x86) is not modified at all, and the only thing that changes is the virtual mapping of this memory, which is different between early and late boot.
In the latter case, an entirely new allocation is created that carries a new, updated version of the kernel's view of the EFI memory map. When installing this new version, the old version will no longer be referenced, and if the memory was allocated by the kernel, it will leak unless it gets freed.
The logic that implements this freeing currently lives on the code path that is shared between these two use cases, but it should only apply to the latter. So move it to the correct spot.
While at it, drop the dummy definition for non-x86 architectures, as that is no longer needed.
--- arch/x86/include/asm/efi.h | 1 - arch/x86/platform/efi/memmap.c | 12 +++++++++++- drivers/firmware/efi/memmap.c | 9 --------- 3 files changed, 11 insertions(+), 11 deletions(-)
arch/x86/include/asm/efi.h +0 -1
@@ -401,7 +401,6 @@ extern int __init efi_memmap_alloc(unsig struct efi_memory_map_data *data);extern void __efi_memmap_free (u64 phys,unsigned long size,unsigned long flags); -#define __efi_memmap_free __efi_memmap_freeextern int __init efi_memmap_install (struct efi_memory_map_data *data); extern int __init efi_memmap_split_count(efi_memory_desc_t *md,
arch/x86/platform/efi/memmap.c +11 -1
@@ -92,12 +92,22 @@ int __init efi_memmap_alloc(unsigned int*/ int __init efi_memmap_install (struct efi_memory_map_data *data) { +unsigned long size = efi.memmap.desc_size * efi.memmap.nr_map; +unsigned long flags = efi.memmap.flags; +u64 phys = efi.memmap.phys_map; +int ret; +efi_memmap_unmap ();if (efi_enabled (EFI_PARAVIRT ))return 0 ; -return __efi_memmap_init (data); + ret =__efi_memmap_init (data); +if (ret) +return ret; + +__efi_memmap_free (phys, size, flags); +return 0 ; }/**
drivers/firmware/efi/memmap.c +0 -9
@@ -15,10 +15,6 @@#include <asm/early_ioremap.h> #include <asm/efi.h> -#ifndef __efi_memmap_free -#define __efi_memmap_free (phys, size, flags) do { } while (0) -#endif -/** * __efi_memmap_init - Common code for mapping the EFI memory map * @data: EFI memory map data
@@ -51,11 +47,6 @@ int __init __efi_memmap_init(struct efi_return -ENOMEM ; } -if (efi.memmap.flags & (EFI_MEMMAP_MEMBLOCK |EFI_MEMMAP_SLAB )) -__efi_memmap_free (efi.memmap.phys_map, - efi.memmap.desc_size * efi.memmap.nr_map, - efi.memmap.flags); - map.phys_map = data->phys_map; map.nr_map = data->size / data->desc_size; map.map_end = map.map + data->size;
Greg Kroah-Hartman
maintainerPATCH 220/250 serial: 8250_dw: Revert "Move definitions to the shared header"
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
commit 2c94512055f362dd789e0f87b8566feeddec83c9 upstream.
This reverts commit d9666dfb314e1ffd6eb9c3c4243fe3e094c047a7.
The container of the struct dw8250_port_data is private to the actual driver. In particular, 8250_lpss and 8250_dw use different data types that are assigned to the UART port private_data. Hence, it must not be used outside the specific driver.
Fix the mistake made in the past by moving the respective definitions to the specific driver.
--- drivers/tty/serial/8250/8250_dw.c | 27 +++++++++++++++++++++++++++ drivers/tty/serial/8250/8250_dwlib.h | 32 -------------------------------- 2 files changed, 27 insertions(+), 32 deletions(-)
drivers/tty/serial/8250/8250_dw.c +27 -0
@@ -57,6 +57,33 @@#define DW_UART_QUIRK_APMC0D08 BIT(4)#define DW_UART_QUIRK_CPR_VALUE BIT(5) +struct dw8250_platform_data { +u8 usr_reg; +u32 cpr_value; +unsigned int quirks; +}; + +struct dw8250_data { +struct dw8250_port_data data; +const struct dw8250_platform_data *pdata; + +int msr_mask_on; +int msr_mask_off; +struct clk *clk; +struct clk *pclk; +struct notifier_block clk_notifier; +struct work_struct clk_work; +struct reset_control *rst; + +unsigned int skip_autocfg:1 ; +unsigned int uart_16550_compatible:1 ; +}; + +static inline struct dw8250_data *to_dw8250_data (struct dw8250_port_data *data) +{ + return container_of(data, struct dw8250_data, data); +} +static inline struct dw8250_data *clk_to_dw8250_data (struct notifier_block *nb) { return container_of(nb, struct dw8250_data, clk_notifier);
drivers/tty/serial/8250/8250_dwlib.h +0 -32
@@ -2,15 +2,10 @@/* Synopsys DesignWare 8250 library header file. */ #include <linux/io.h> -#include <linux/notifier.h> #include <linux/types.h> -#include <linux/workqueue.h> #include "8250.h" -struct clk ; -struct reset_control ; -struct dw8250_port_data {/* Port properties */ int line;
@@ -26,36 +21,9 @@ struct dw8250_port_data {bool hw_rs485_support; }; -struct dw8250_platform_data { -u8 usr_reg; -u32 cpr_value; -unsigned int quirks; -}; - -struct dw8250_data { -struct dw8250_port_data data; -const struct dw8250_platform_data *pdata; - -int msr_mask_on; -int msr_mask_off; -struct clk *clk; -struct clk *pclk; -struct notifier_block clk_notifier; -struct work_struct clk_work; -struct reset_control *rst; - -unsigned int skip_autocfg:1 ; -unsigned int uart_16550_compatible:1 ; -}; -void dw8250_do_set_termios (struct uart_port *p,struct ktermios *termios,const struct ktermios *old);void dw8250_setup_port (struct uart_port *p); -static inline struct dw8250_data *to_dw8250_data (struct dw8250_port_data *data) -{ - return container_of(data, struct dw8250_data, data); -} -static inline u32 dw8250_readl_ext (struct uart_port *p,int offset) {if (p->iotype ==UPIO_MEM32BE )
Greg Kroah-Hartman
maintainerPATCH 221/250 MIPS: mipsmtregs: Fix target register for MFTC0
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiaxun Yang <[email protected]>
commit 4a3e37b3caea817199757a0b13aa53dd7c9376c8 upstream.
Target register of mftc0 should be __res instead of $1, this is a leftover from old .insn code.
--- arch/mips/include/asm/mipsmtregs.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/include/asm/mipsmtregs.h +1 -1
@@ -322,7 +322,7 @@ static inline void ehb(void)" .set push \n" \" .set " MIPS_ISA_LEVEL " \n" \ _ASM_SET_MFTC0 \ - " mftc0 $1, " #rt ", " #sel " \n" \ + " mftc0 %0, " #rt ", " #sel " \n" \ _ASM_UNSET_MFTC0 \ " .set pop \n" \ : "=r" (__res)); \
Signature · 1 line
2.45.2
Greg Kroah-Hartman
maintainerPATCH 222/250 mm: mmap: allow for the maximum number of bits for randomizing mmap_base by default
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael Aquini <[email protected]>
commit 3afb76a66b5559a7b595155803ce23801558a7a9 upstream.
An ASLR regression was noticed [1] and tracked down to file-mapped areas being backed by THP in recent kernels. The 21-bit alignment constraint for such mappings reduces the entropy for randomizing the placement of 64-bit library mappings and breaks ASLR completely for 32-bit libraries.
The reported issue is easily addressed by increasing vm.mmap_rnd_bits and vm.mmap_rnd_compat_bits. This patch just provides a simple way to set ARCH_MMAP_RND_BITS and ARCH_MMAP_RND_COMPAT_BITS to their maximum values allowed by the architecture at build time.
[1] https://zolutal.github.io/aslrnt/
--- arch/Kconfig | 12 ++++++++++++ 1 file changed, 12 insertions(+)
arch/Kconfig +12 -0
@@ -1029,10 +1029,21 @@ config ARCH_MMAP_RND_BITS_MAX config ARCH_MMAP_RND_BITS_DEFAULT int +config FORCE_MAX_MMAP_RND_BITS + bool "Force maximum number of bits to use for ASLR of mmap base address" + default y if !64BIT + help + ARCH_MMAP_RND_BITS and ARCH_MMAP_RND_COMPAT_BITS represent the number + of bits to use for ASLR and if no custom value is assigned (EXPERT) + then the architecture's lower bound (minimum) value is assumed. + This toggle changes that default assumption to assume the arch upper + bound (maximum) value instead. + config ARCH_MMAP_RND_BITS int "Number of bits to use for ASLR of mmap base address" if EXPERT range ARCH_MMAP_RND_BITS_MIN ARCH_MMAP_RND_BITS_MAX default ARCH_MMAP_RND_BITS_DEFAULT if ARCH_MMAP_RND_BITS_DEFAULT + default ARCH_MMAP_RND_BITS_MAX if FORCE_MAX_MMAP_RND_BITS default ARCH_MMAP_RND_BITS_MIN depends on HAVE_ARCH_MMAP_RND_BITS help
@@ -1067,6 +1078,7 @@ config ARCH_MMAP_RND_COMPAT_BITS int "Number of bits to use for ASLR of mmap base address for compatible applications" if EXPERT range ARCH_MMAP_RND_COMPAT_BITS_MIN ARCH_MMAP_RND_COMPAT_BITS_MAX default ARCH_MMAP_RND_COMPAT_BITS_DEFAULT if ARCH_MMAP_RND_COMPAT_BITS_DEFAULT + default ARCH_MMAP_RND_COMPAT_BITS_MAX if FORCE_MAX_MMAP_RND_BITS default ARCH_MMAP_RND_COMPAT_BITS_MIN depends on HAVE_ARCH_MMAP_RND_COMPAT_BITS help
Greg Kroah-Hartman
maintainerPATCH 223/250 mm: huge_memory: fix misused mapping_large_folio_support() for anon folios
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ran Xiaokai <[email protected]>
commit 6a50c9b512f7734bc356f4bd47885a6f7c98491a upstream.
When I did a large folios split test, a WARNING "[ 5059.122759][ T166] Cannot split file folio to non-0 order" was triggered. But the test cases are only for anonmous folios. while mapping_large_folio_support() is only reasonable for page cache folios.
In split_huge_page_to_list_to_order(), the folio passed to mapping_large_folio_support() maybe anonmous folio. The folio_test_anon() check is missing. So the split of the anonmous THP is failed. This is also the same for shmem_mapping(). We'd better add a check for both. But the shmem_mapping() in __split_huge_page() is not involved, as for anonmous folios, the end parameter is set to -1, so (head[i].index >= end) is always false. shmem_mapping() is not called.
Also add a VM_WARN_ON_ONCE() in mapping_large_folio_support() for anon mapping, So we can detect the wrong use more easily.
THP folios maybe exist in the pagecache even the file system doesn't support large folio, it is because when CONFIG_TRANSPARENT_HUGEPAGE is enabled, khugepaged will try to collapse read-only file-backed pages to THP. But the mapping does not actually support multi order large folios properly.
Using /sys/kernel/debug/split_huge_pages to verify this, with this patch, large anon THP is successfully split and the warning is ceased.
--- include/linux/pagemap.h | 4 ++++ mm/huge_memory.c | 28 +++++++++++++++++----------- 2 files changed, 21 insertions(+), 11 deletions(-)
include/linux/pagemap.h +4 -0
@@ -379,6 +379,10 @@ static inline void mapping_set_large_fol*/ static inline bool mapping_large_folio_support (struct address_space *mapping) { +/* AS_LARGE_FOLIO_SUPPORT is only reasonable for pagecache folios */ +VM_WARN_ONCE ((unsigned long )mapping &PAGE_MAPPING_ANON , +"Anonymous mapping always supports large folio" ); +return IS_ENABLED (CONFIG_TRANSPARENT_HUGEPAGE ) &&test_bit (AS_LARGE_FOLIO_SUPPORT , &mapping->flags); }
mm/huge_memory.c +17 -11
@@ -3058,30 +3058,36 @@ int split_huge_page_to_list_to_order(strif (new_order >=folio_order (folio))return -EINVAL ; -/* Cannot split anonymous THP to order-1 */ -if (new_order ==1 &&folio_test_anon (folio)) { -VM_WARN_ONCE (1 ,"Cannot split to order-1 folio" ); -return -EINVAL ; - } - -if (new_order) { -/* Only swapping a whole PMD-mapped folio is supported */ -if (folio_test_swapcache (folio)) +if (folio_test_anon (folio)) { +/* order-1 is not supported for anonymous THP. */ +if (new_order ==1 ) { +VM_WARN_ONCE (1 ,"Cannot split to order-1 folio" );return -EINVAL ; + } + }else if (new_order) {/* Split shmem folio to non-zero order not supported */ if (shmem_mapping (folio->mapping)) {VM_WARN_ONCE (1 ,"Cannot split shmem folio to non-0 order" );return -EINVAL ; } -/* No split if the file system does not support large folio */ -if (!mapping_large_folio_support (folio->mapping)) { +/* +* No split if the file system does not support large folio. +* Note that we might still have THPs in such mappings due to +* CONFIG_READ_ONLY_THP_FOR_FS. But in that case, the mapping +* does not actually support large folios properly. +*/ +if (IS_ENABLED (CONFIG_READ_ONLY_THP_FOR_FS ) && + !mapping_large_folio_support (folio->mapping)) {VM_WARN_ONCE (1 ,"Cannot split file folio to non-0 order" );return -EINVAL ; } } +/* Only swapping a whole PMD-mapped folio is supported */ +if (folio_test_swapcache (folio) && new_order) +return -EINVAL ; is_hzp =is_huge_zero_page (&folio->page);if (is_hzp) {
Greg Kroah-Hartman
maintainerPATCH 224/250 mm: shmem: fix getting incorrect lruvec when replacing a shmem folio
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baolin Wang <[email protected]>
commit 9094b4a1c76cfe84b906cc152bab34d4ba26fa5c upstream.
When testing shmem swapin, I encountered the warning below on my machine. The reason is that replacing an old shmem folio with a new one causes mem_cgroup_migrate() to clear the old folio's memcg data. As a result, the old folio cannot get the correct memcg's lruvec needed to remove itself from the LRU list when it is being freed. This could lead to possible serious problems, such as LRU list crashes due to holding the wrong LRU lock, and incorrect LRU statistics.
To fix this issue, we can fallback to use the mem_cgroup_replace_folio() to replace the old shmem folio.
[ 5241.100311] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5d9960 [ 5241.100317] head: order:4 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 5241.100319] flags: 0x17fffe0000040068(uptodate|lru|head|swapbacked|node=0|zone=2|lastcpupid=0x3ffff) [ 5241.100323] raw: 17fffe0000040068 fffffdffd6687948 fffffdffd69ae008 0000000000000000 [ 5241.100325] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 5241.100326] head: 17fffe0000040068 fffffdffd6687948 fffffdffd69ae008 0000000000000000 [ 5241.100327] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 5241.100328] head: 17fffe0000000204 fffffdffd6665801 ffffffffffffffff 0000000000000000 [ 5241.100329] head: 0000000a00000010 0000000000000000 00000000ffffffff 0000000000000000 [ 5241.100330] page dumped because: VM_WARN_ON_ONCE_FOLIO(!memcg && !mem_cgroup_disabled()) [ 5241.100338] ------------[ cut here ]------------ [ 5241.100339] WARNING: CPU: 19 PID: 78402 at include/linux/memcontrol.h:775 folio_lruvec_lock_irqsave+0x140/0x150 [...] [ 5241.100374] pc : folio_lruvec_lock_irqsave+0x140/0x150 [ 5241.100375] lr : folio_lruvec_lock_irqsave+0x138/0x150 [ 5241.100376] sp : ffff80008b38b930 [...] [ 5241.100398] Call trace: [ 5241.100399] folio_lruvec_lock_irqsave+0x140/0x150 [ 5241.100401] __page_cache_release+0x90/0x300 [ 5241.100404] __folio_put+0x50/0x108 [ 5241.100406] shmem_replace_folio+0x1b4/0x240 [ 5241.100409] shmem_swapin_folio+0x314/0x528 [ 5241.100411] shmem_get_folio_gfp+0x3b4/0x930 [ 5241.100412] shmem_fault+0x74/0x160 [ 5241.100414] __do_fault+0x40/0x218 [ 5241.100417] do_shared_fault+0x34/0x1b0 [ 5241.100419] do_fault+0x40/0x168 [ 5241.100420] handle_pte_fault+0x80/0x228 [ 5241.100422] __handle_mm_fault+0x1c4/0x440 [ 5241.100424] handle_mm_fault+0x60/0x1f0 [ 5241.100426] do_page_fault+0x120/0x488 [ 5241.100429] do_translation_fault+0x4c/0x68 [ 5241.100431] do_mem_abort+0x48/0xa0 [ 5241.100434] el0_da+0x38/0xc0 [ 5241.100436] el0t_64_sync_handler+0x68/0xc0 [ 5241.100437] el0t_64_sync+0x14c/0x150 [ 5241.100439] ---[ end trace 0000000000000000 ]---
--- mm/memcontrol.c | 3 +-- mm/shmem.c | 2 +- 2 files changed, 2 insertions(+), 3 deletions(-)
mm/memcontrol.c +1 -2
@@ -7531,8 +7531,7 @@ void __mem_cgroup_uncharge_folios(struct* @new: Replacement folio. * * Charge @new as a replacement folio for @old. @old will -* be uncharged upon free. This is only used by the page cache -* (in replace_page_cache_folio()). +* be uncharged upon free. * * Both folios must be locked, @new->mapping must be set up. */
mm/shmem.c +1 -1
@@ -1786,7 +1786,7 @@ static int shmem_replace_folio(struct foxa_lock_irq (&swap_mapping->i_pages); error =shmem_replace_entry (swap_mapping, swap_index, old, new);if (!error) { -mem_cgroup_migrate (old, new); +mem_cgroup_replace_folio (old, new);__lruvec_stat_mod_folio (new,NR_FILE_PAGES ,1 );__lruvec_stat_mod_folio (new,NR_SHMEM ,1 );__lruvec_stat_mod_folio (old,NR_FILE_PAGES ,-1 );
Greg Kroah-Hartman
maintainerPATCH 225/250 selftests: mptcp: userspace_pm: fixed subtest names
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit e874557fce1b6023efafd523aee0c347bf7f1694 upstream.
It is important to have fixed (sub)test names in TAP, because these names are used to identify them. If they are not fixed, tracking cannot be done.
Some subtests from the userspace_pm selftest were using random numbers in their names: the client and server address IDs from $RANDOM, and the client port number randomly picked by the kernel when creating the connection. These values have been replaced by 'client' and 'server'
words: that's even more helpful than showing random numbers. Note that the addresses IDs are incremented and decremented in the test: +1 or -1 are then displayed in these cases.
Not to loose info that can be useful for debugging in case of issues, these random numbers are now displayed at the beginning of the test.
--- tools/testing/selftests/net/mptcp/userspace_pm.sh | 46 +++++++++++++--------- 1 file changed, 28 insertions(+), 18 deletions(-)
tools/testing/selftests/net/mptcp/userspace_pm.sh +28 -18
@@ -160,10 +160,12 @@ make_connection() local is_v6=$1 local app_port=$app4_port local connect_addr="10.0.1.1" + local client_addr="10.0.1.2" local listen_addr="0.0.0.0" if [ "$is_v6" = "v6" ] then connect_addr="dead:beef:1::1" + client_addr="dead:beef:1::2" listen_addr="::" app_port=$app6_port else
@@ -206,6 +208,7 @@ make_connection() [ "$server_serverside" = 1 ] then test_pass + print_title "Connection info: ${client_addr}:${client_port} -> ${connect_addr}:${app_port}" else test_fail "Expected tokens (c:${client_token} - s:${server_token}) and server (c:${client_serverside} - s:${server_serverside})" mptcp_lib_result_print_all_tap
@@ -297,7 +300,7 @@ test_announce() ip netns exec "$ns2"\ ./pm_nl_ctl ann 10.0.2.2 token "$client4_token" id $client_addr_id dev\ ns2eth1 - print_test "ADD_ADDR id:${client_addr_id} 10.0.2.2 (ns2) => ns1, reuse port" + print_test "ADD_ADDR id:client 10.0.2.2 (ns2) => ns1, reuse port" sleep 0.5 verify_announce_event $server_evts $ANNOUNCED $server4_token "10.0.2.2" $client_addr_id \ "$client4_port"
@@ -306,7 +309,7 @@ test_announce() :>"$server_evts" ip netns exec "$ns2" ./pm_nl_ctl ann\ dead:beef:2::2 token "$client6_token" id $client_addr_id dev ns2eth1 - print_test "ADD_ADDR6 id:${client_addr_id} dead:beef:2::2 (ns2) => ns1, reuse port" + print_test "ADD_ADDR6 id:client dead:beef:2::2 (ns2) => ns1, reuse port" sleep 0.5 verify_announce_event "$server_evts" "$ANNOUNCED" "$server6_token" "dead:beef:2::2"\ "$client_addr_id" "$client6_port" "v6"
@@ -316,7 +319,7 @@ test_announce() client_addr_id=$((client_addr_id+1)) ip netns exec "$ns2" ./pm_nl_ctl ann 10.0.2.2 token "$client4_token" id\ $client_addr_id dev ns2eth1 port $new4_port - print_test "ADD_ADDR id:${client_addr_id} 10.0.2.2 (ns2) => ns1, new port" + print_test "ADD_ADDR id:client+1 10.0.2.2 (ns2) => ns1, new port" sleep 0.5 verify_announce_event "$server_evts" "$ANNOUNCED" "$server4_token" "10.0.2.2"\ "$client_addr_id" "$new4_port"
@@ -327,7 +330,7 @@ test_announce() # ADD_ADDR from the server to client machine reusing the subflow port ip netns exec "$ns1" ./pm_nl_ctl ann 10.0.2.1 token "$server4_token" id\ $server_addr_id dev ns1eth2 - print_test "ADD_ADDR id:${server_addr_id} 10.0.2.1 (ns1) => ns2, reuse port" + print_test "ADD_ADDR id:server 10.0.2.1 (ns1) => ns2, reuse port" sleep 0.5 verify_announce_event "$client_evts" "$ANNOUNCED" "$client4_token" "10.0.2.1"\ "$server_addr_id" "$app4_port"
@@ -336,7 +339,7 @@ test_announce() :>"$client_evts" ip netns exec "$ns1" ./pm_nl_ctl ann dead:beef:2::1 token "$server6_token" id\ $server_addr_id dev ns1eth2 - print_test "ADD_ADDR6 id:${server_addr_id} dead:beef:2::1 (ns1) => ns2, reuse port" + print_test "ADD_ADDR6 id:server dead:beef:2::1 (ns1) => ns2, reuse port" sleep 0.5 verify_announce_event "$client_evts" "$ANNOUNCED" "$client6_token" "dead:beef:2::1"\ "$server_addr_id" "$app6_port" "v6"
@@ -346,7 +349,7 @@ test_announce() server_addr_id=$((server_addr_id+1)) ip netns exec "$ns1" ./pm_nl_ctl ann 10.0.2.1 token "$server4_token" id\ $server_addr_id dev ns1eth2 port $new4_port - print_test "ADD_ADDR id:${server_addr_id} 10.0.2.1 (ns1) => ns2, new port" + print_test "ADD_ADDR id:server+1 10.0.2.1 (ns1) => ns2, new port" sleep 0.5 verify_announce_event "$client_evts" "$ANNOUNCED" "$client4_token" "10.0.2.1"\ "$server_addr_id" "$new4_port"
@@ -380,7 +383,7 @@ test_remove() local invalid_token=$(( client4_token - 1 )) ip netns exec "$ns2" ./pm_nl_ctl rem token $invalid_token id\ $client_addr_id > /dev/null 2>&1 - print_test "RM_ADDR id:${client_addr_id} ns2 => ns1, invalid token" + print_test "RM_ADDR id:client ns2 => ns1, invalid token" local type type=$(mptcp_lib_evts_get_info type "$server_evts") if [ "$type" = "" ]
@@ -394,7 +397,7 @@ test_remove() local invalid_id=$(( client_addr_id + 1 )) ip netns exec "$ns2" ./pm_nl_ctl rem token "$client4_token" id\ $invalid_id > /dev/null 2>&1 - print_test "RM_ADDR id:${invalid_id} ns2 => ns1, invalid id" + print_test "RM_ADDR id:client+1 ns2 => ns1, invalid id" type=$(mptcp_lib_evts_get_info type "$server_evts") if [ "$type" = "" ] then
@@ -407,7 +410,7 @@ test_remove() :>"$server_evts" ip netns exec "$ns2" ./pm_nl_ctl rem token "$client4_token" id\ $client_addr_id - print_test "RM_ADDR id:${client_addr_id} ns2 => ns1" + print_test "RM_ADDR id:client ns2 => ns1" sleep 0.5 verify_remove_event "$server_evts" "$REMOVED" "$server4_token" "$client_addr_id"
@@ -416,7 +419,7 @@ test_remove() client_addr_id=$(( client_addr_id - 1 )) ip netns exec "$ns2" ./pm_nl_ctl rem token "$client4_token" id\ $client_addr_id - print_test "RM_ADDR id:${client_addr_id} ns2 => ns1" + print_test "RM_ADDR id:client-1 ns2 => ns1" sleep 0.5 verify_remove_event "$server_evts" "$REMOVED" "$server4_token" "$client_addr_id"
@@ -424,7 +427,7 @@ test_remove() :>"$server_evts" ip netns exec "$ns2" ./pm_nl_ctl rem token "$client6_token" id\ $client_addr_id - print_test "RM_ADDR6 id:${client_addr_id} ns2 => ns1" + print_test "RM_ADDR6 id:client-1 ns2 => ns1" sleep 0.5 verify_remove_event "$server_evts" "$REMOVED" "$server6_token" "$client_addr_id"
@@ -434,7 +437,7 @@ test_remove() # RM_ADDR from the server to client machine ip netns exec "$ns1" ./pm_nl_ctl rem token "$server4_token" id\ $server_addr_id - print_test "RM_ADDR id:${server_addr_id} ns1 => ns2" + print_test "RM_ADDR id:server ns1 => ns2" sleep 0.5 verify_remove_event "$client_evts" "$REMOVED" "$client4_token" "$server_addr_id"
@@ -443,7 +446,7 @@ test_remove() server_addr_id=$(( server_addr_id - 1 )) ip netns exec "$ns1" ./pm_nl_ctl rem token "$server4_token" id\ $server_addr_id - print_test "RM_ADDR id:${server_addr_id} ns1 => ns2" + print_test "RM_ADDR id:server-1 ns1 => ns2" sleep 0.5 verify_remove_event "$client_evts" "$REMOVED" "$client4_token" "$server_addr_id"
@@ -451,7 +454,7 @@ test_remove() :>"$client_evts" ip netns exec "$ns1" ./pm_nl_ctl rem token "$server6_token" id\ $server_addr_id - print_test "RM_ADDR6 id:${server_addr_id} ns1 => ns2" + print_test "RM_ADDR6 id:server-1 ns1 => ns2" sleep 0.5 verify_remove_event "$client_evts" "$REMOVED" "$client6_token" "$server_addr_id" }
@@ -479,8 +482,14 @@ verify_subflow_events() local locid local remid local info + local e_dport_txt - info="${e_saddr} (${e_from}) => ${e_daddr}:${e_dport} (${e_to})" + # only display the fixed ports + if [ "${e_dport}" -ge "${app4_port}" ] && [ "${e_dport}" -le "${app6_port}" ]; then + e_dport_txt=":${e_dport}" + fi + + info="${e_saddr} (${e_from}) => ${e_daddr}${e_dport_txt} (${e_to})" if [ "$e_type" = "$SUB_ESTABLISHED" ] then
@@ -766,7 +775,7 @@ test_subflows_v4_v6_mix() :>"$client_evts" ip netns exec "$ns1" ./pm_nl_ctl ann 10.0.2.1 token "$server6_token" id\ $server_addr_id dev ns1eth2 - print_test "ADD_ADDR4 id:${server_addr_id} 10.0.2.1 (ns1) => ns2, reuse port" + print_test "ADD_ADDR4 id:server 10.0.2.1 (ns1) => ns2, reuse port" sleep 0.5 verify_announce_event "$client_evts" "$ANNOUNCED" "$client6_token" "10.0.2.1"\ "$server_addr_id" "$app6_port"
@@ -861,7 +870,7 @@ test_listener() local listener_pid=$! sleep 0.5 - print_test "CREATE_LISTENER 10.0.2.2:$client4_port" + print_test "CREATE_LISTENER 10.0.2.2 (client port)" verify_listener_events $client_evts $LISTENER_CREATED $AF_INET 10.0.2.2 $client4_port # ADD_ADDR from client to server machine reusing the subflow port
@@ -878,13 +887,14 @@ test_listener() mptcp_lib_kill_wait $listener_pid sleep 0.5 - print_test "CLOSE_LISTENER 10.0.2.2:$client4_port" + print_test "CLOSE_LISTENER 10.0.2.2 (client port)" verify_listener_events $client_evts $LISTENER_CLOSED $AF_INET 10.0.2.2 $client4_port } print_title "Make connections" make_connection make_connection "v6" +print_title "Will be using address IDs ${client_addr_id} (client) and ${server_addr_id} (server)" test_announce test_remove
Greg Kroah-Hartman
maintainerPATCH 226/250 tcp: clear tp->retrans_stamp in tcp_rcv_fastopen_synack()
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
commit 9e046bb111f13461d3f9331e24e974324245140e upstream.
Some applications were reporting ETIMEDOUT errors on apparently good looking flows, according to packet dumps.
We were able to root cause the issue to an accidental setting of tp->retrans_stamp in the following scenario:
- client sends TFO SYN with data.
- server has TFO disabled, ACKs only SYN but not payload.
- client receives SYNACK covering only SYN.
- tcp_ack() eats SYN and sets tp->retrans_stamp to 0.
- tcp_rcv_fastopen_synack() calls tcp_xmit_retransmit_queue() to retransmit TFO payload w/o SYN, sets tp->retrans_stamp to "now", but we are not in any loss recovery state.
- TFO payload is ACKed.
- we are not in any loss recovery state, and don't see any dupacks, so we don't get to any code path that clears tp->retrans_stamp.
- tp->retrans_stamp stays non-zero for the lifetime of the connection.
- after first RTO, tcp_clamp_rto_to_user_timeout() clamps second RTO to 1 jiffy due to bogus tp->retrans_stamp.
- on clamped RTO with non-zero icsk_retransmits, retransmits_timed_out() sets start_ts from tp->retrans_stamp from TFO payload retransmit hours/days ago, and computes bogus long elapsed time for loss recovery, and suffers ETIMEDOUT early.
--- net/ipv4/tcp_input.c | 1 + 1 file changed, 1 insertion(+)
net/ipv4/tcp_input.c +1 -0
@@ -6289,6 +6289,7 @@ static bool tcp_rcv_fastopen_synack(struskb_rbtree_walk_from (data)tcp_mark_skb_lost (sk, data);tcp_xmit_retransmit_queue (sk); + tp->retrans_stamp =0 ;NET_INC_STATS (sock_net (sk),LINUX_MIB_TCPFASTOPENACTIVEFAIL );return true;
Greg Kroah-Hartman
maintainerPATCH 227/250 mm/page_table_check: fix crash on ZONE_DEVICE
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Xu <[email protected]>
commit 8bb592c2eca8fd2bc06db7d80b38da18da4a2f43 upstream.
Not all pages may apply to pgtable check. One example is ZONE_DEVICE
pages: they map PFNs directly, and they don't allocate page_ext at all even if there's struct page around. One may reference devm_memremap_pages().
When both ZONE_DEVICE and page-table-check enabled, then try to map some dax memories, one can trigger kernel bug constantly now when the kernel was trying to inject some pfn maps on the dax device:
kernel BUG at mm/page_table_check.c:55!
While it's pretty legal to use set_pxx_at() for ZONE_DEVICE pages for page fault resolutions, skip all the checks if page_ext doesn't even exist in pgtable checker, which applies to ZONE_DEVICE but maybe more.
--- mm/page_table_check.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
mm/page_table_check.c +10 -1
@@ -71,6 +71,9 @@ static void page_table_check_clear(unsig page =pfn_to_page (pfn); page_ext =page_ext_get (page); +if (!page_ext) +return ; +BUG_ON (PageSlab (page)); anon =PageAnon (page);
@@ -108,6 +111,9 @@ static void page_table_check_set(unsigne page =pfn_to_page (pfn); page_ext =page_ext_get (page); +if (!page_ext) +return ; +BUG_ON (PageSlab (page)); anon =PageAnon (page);
@@ -138,7 +144,10 @@ void __page_table_check_zero(struct pageBUG_ON (PageSlab (page)); page_ext =page_ext_get (page); -BUG_ON (!page_ext); + +if (!page_ext) +return ; +for (i =0 ; i < (1ul << order); i++) {struct page_table_check *ptc =get_page_table_check (page_ext);
Greg Kroah-Hartman
maintainerPATCH 228/250 ima: Avoid blocking in RCU read-side critical section
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: GUO Zihua <[email protected]>
commit 9a95c5bfbf02a0a7f5983280fe284a0ff0836c34 upstream.
A panic happens in ima_match_policy:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000010
PGD 42f873067 P4D 0
Oops: 0000 [#1] SMP NOPTI
CPU: 5 PID: 1286325 Comm: kubeletmonit.sh
Kdump: loaded Tainted: P
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS 0.0.0 02/06/2015
RIP: 0010:ima_match_policy+0x84/0x450
Code: 49 89 fc 41 89 cf 31 ed 89 44 24 14 eb 1c 44 39
7b 18 74 26 41 83 ff 05 74 20 48 8b 1b 48 3b 1d
f2 b9 f4 00 0f 84 9c 01 00 00 <44> 85 73 10 74 ea
44 8b 6b 14 41 f6 c5 01 75 d4 41 f6 c5 02 74 0f
RSP: 0018:ff71570009e07a80 EFLAGS: 00010207
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000200
RDX: ffffffffad8dc7c0 RSI: 0000000024924925 RDI: ff3e27850dea2000
RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffffabfce739
R10: ff3e27810cc42400 R11: 0000000000000000 R12: ff3e2781825ef970
R13: 00000000ff3e2785 R14: 000000000000000c R15: 0000000000000001
FS: 00007f5195b51740(0000)
GS:ff3e278b12d40000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000010 CR3: 0000000626d24002 CR4: 0000000000361ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
ima_get_action+0x22/0x30
process_measurement+0xb0/0x830
? page_add_file_rmap+0x15/0x170
? alloc_set_pte+0x269/0x4c0
? prep_new_page+0x81/0x140
? simple_xattr_get+0x75/0xa0
? selinux_file_open+0x9d/0xf0
ima_file_check+0x64/0x90
path_openat+0x571/0x1720
do_filp_open+0x9b/0x110
? page_counter_try_charge+0x57/0xc0
? files_cgroup_alloc_fd+0x38/0x60
? __alloc_fd+0xd4/0x250
? do_sys_open+0x1bd/0x250
do_sys_open+0x1bd/0x250
do_syscall_64+0x5d/0x1d0
entry_SYSCALL_64_after_hwframe+0x65/0xcaCommit c7423dbdbc9e ("ima: Handle -ESTALE returned by ima_filter_rule_match()") introduced call to ima_lsm_copy_rule within a RCU read-side critical section which contains kmalloc with GFP_KERNEL. This implies a possible sleep and violates limitations of RCU read-side critical sections on non-PREEMPT systems.
Sleeping within RCU read-side critical section might cause synchronize_rcu() returning early and break RCU protection, allowing a UAF to happen.
The root cause of this issue could be described as follows:
| Thread A | Thread B | | |ima_match_policy | | | rcu_read_lock | |ima_lsm_update_rule | | | synchronize_rcu | | | | kmalloc(GFP_KERNEL)| | | sleep | ==> synchronize_rcu returns early | kfree(entry) | | | | entry = entry->next|
==> UAF happens and entry now becomes NULL (or could be anything).
| | entry->action |
==> Accessing entry might cause panic.
To fix this issue, we are converting all kmalloc that is called within RCU read-side critical section to use GFP_ATOMIC.
--- include/linux/lsm_hook_defs.h | 2 +- include/linux/security.h | 5 +++-- kernel/auditfilter.c | 5 +++-- security/apparmor/audit.c | 6 +++--- security/apparmor/include/audit.h | 2 +- security/integrity/ima/ima.h | 2 +- security/integrity/ima/ima_policy.c | 15 +++++++++------ security/security.c | 6 ++++-- security/selinux/include/audit.h | 4 +++- security/selinux/ss/services.c | 5 +++-- security/smack/smack_lsm.c | 4 +++- 11 files changed, 34 insertions(+), 22 deletions(-)
include/linux/lsm_hook_defs.h +1 -1
@@ -412,7 +412,7 @@ LSM_HOOK(void, LSM_RET_VOID, key_post_cr#ifdef CONFIG_AUDIT LSM_HOOK(int, 0, audit_rule_init, u32 field, u32 op, char *rulestr, - void **lsmrule) + void **lsmrule, gfp_t gfp) LSM_HOOK(int, 0, audit_rule_known, struct audit_krule *krule) LSM_HOOK(int, 0, audit_rule_match, u32 secid, u32 field, u32 op, void *lsmrule)LSM_HOOK (void,LSM_RET_VOID , audit_rule_free, void *lsmrule)
include/linux/security.h +3 -2
@@ -2048,7 +2048,8 @@ static inline void security_key_post_cre#ifdef CONFIG_AUDIT #ifdef CONFIG_SECURITY -int security_audit_rule_init (u32 field,u32 op,char *rulestr,void **lsmrule); +int security_audit_rule_init (u32 field,u32 op,char *rulestr,void **lsmrule, +gfp_t gfp);int security_audit_rule_known (struct audit_krule *krule);int security_audit_rule_match (u32 secid,u32 field,u32 op,void *lsmrule);void security_audit_rule_free (void *lsmrule);
@@ -2056,7 +2057,7 @@ void security_audit_rule_free(void *lsmr#else static inline int security_audit_rule_init (u32 field,u32 op,char *rulestr, -void **lsmrule) +void **lsmrule,gfp_t gfp) {return 0 ; }
kernel/auditfilter.c +3 -2
@@ -529,7 +529,8 @@ static struct audit_entry *audit_data_to entry->rule.buflen += f_val; f->lsm_str = str; err =security_audit_rule_init (f->type, f->op, str, - (void **)&f->lsm_rule); + (void **)&f->lsm_rule, +GFP_KERNEL );/* Keep currently invalid fields around in case they * become valid after a policy reload. */ if (err == -EINVAL ) {
@@ -799,7 +800,7 @@ static inline int audit_dupe_lsm_field(s/* our own (refreshed) copy of lsm_rule */ ret =security_audit_rule_init (df->type, df->op, df->lsm_str, - (void **)&df->lsm_rule); + (void **)&df->lsm_rule,GFP_KERNEL );/* Keep currently invalid fields around in case they * become valid after a policy reload. */ if (ret == -EINVAL ) {
security/apparmor/audit.c +3 -3
@@ -217,7 +217,7 @@ void aa_audit_rule_free(void *vrule) } } -int aa_audit_rule_init (u32 field,u32 op,char *rulestr,void **vrule) +int aa_audit_rule_init (u32 field,u32 op,char *rulestr,void **vrule,gfp_t gfp) {struct aa_audit_rule *rule;
@@ -230,14 +230,14 @@ int aa_audit_rule_init(u32 field, u32 opreturn -EINVAL ; } - rule =kzalloc (sizeof (struct aa_audit_rule ),GFP_KERNEL ); + rule =kzalloc (sizeof (struct aa_audit_rule ), gfp);if (!rule)return -ENOMEM ;/* Currently rules are treated as coming from the root ns */ rule->label =aa_label_parse (&root_ns->unconfined->label, rulestr, -GFP_KERNEL , true, false); + gfp, true, false);if (IS_ERR (rule->label)) {int err =PTR_ERR (rule->label);aa_audit_rule_free (rule);
security/apparmor/include/audit.h +1 -1
@@ -200,7 +200,7 @@ static inline int complain_error(int err }void aa_audit_rule_free (void *vrule); -int aa_audit_rule_init (u32 field,u32 op,char *rulestr,void **vrule); +int aa_audit_rule_init (u32 field,u32 op,char *rulestr,void **vrule,gfp_t gfp);int aa_audit_rule_known (struct audit_krule *rule);int aa_audit_rule_match (u32 sid,u32 field,u32 op,void *vrule);
security/integrity/ima/ima.h +1 -1
@@ -540,7 +540,7 @@ static inline void ima_free_modsig(struc#else static inline int ima_filter_rule_init (u32 field,u32 op,char *rulestr, -void **lsmrule) +void **lsmrule,gfp_t gfp) {return -EINVAL ; }
security/integrity/ima/ima_policy.c +9 -6
@@ -401,7 +401,8 @@ static void ima_free_rule(struct ima_rulkfree (entry); } -static struct ima_rule_entry *ima_lsm_copy_rule (struct ima_rule_entry *entry) +static struct ima_rule_entry *ima_lsm_copy_rule (struct ima_rule_entry *entry, +gfp_t gfp) {struct ima_rule_entry *nentry;int i;
@@ -410,7 +411,7 @@ static struct ima_rule_entry *ima_lsm_co* Immutable elements are copied over as pointers and data; only * lsm rules can change */ - nentry =kmemdup (entry,sizeof (*nentry),GFP_KERNEL ); + nentry =kmemdup (entry,sizeof (*nentry), gfp);if (!nentry)return NULL ;
@@ -425,7 +426,8 @@ static struct ima_rule_entry *ima_lsm_coima_filter_rule_init (nentry->lsm[i].type, Audit_equal, nentry->lsm[i].args_p, - &nentry->lsm[i].rule); + &nentry->lsm[i].rule, + gfp);if (!nentry->lsm[i].rule)pr_warn ("rule for LSM \'%s\' is undefined\n" , nentry->lsm[i].args_p);
@@ -438,7 +440,7 @@ static int ima_lsm_update_rule(struct imint i;struct ima_rule_entry *nentry; - nentry =ima_lsm_copy_rule (entry); + nentry =ima_lsm_copy_rule (entry,GFP_KERNEL );if (!nentry)return -ENOMEM ;
@@ -664,7 +666,7 @@ retry: }if (rc == -ESTALE && !rule_reinitialized) { - lsm_rule =ima_lsm_copy_rule (rule); + lsm_rule =ima_lsm_copy_rule (rule,GFP_ATOMIC );if (lsm_rule) { rule_reinitialized = true; goto retry;
@@ -1140,7 +1142,8 @@ static int ima_lsm_rule_init(struct ima_ entry->lsm[lsm_rule].type = audit_type; result =ima_filter_rule_init (entry->lsm[lsm_rule].type, Audit_equal, entry->lsm[lsm_rule].args_p, - &entry->lsm[lsm_rule].rule); + &entry->lsm[lsm_rule].rule, +GFP_KERNEL );if (!entry->lsm[lsm_rule].rule) {pr_warn ("rule for LSM \'%s\' is undefined\n" , entry->lsm[lsm_rule].args_p);
security/security.c +4 -2
@@ -5331,15 +5331,17 @@ void security_key_post_create_or_update(* @op: rule operator * @rulestr: rule context * @lsmrule: receive buffer for audit rule struct +* @gfp: GFP flag used for kmalloc * * Allocate and initialize an LSM audit rule structure. * * Return: Return 0 if @lsmrule has been successfully set, -EINVAL in case of * an invalid rule. */ -int security_audit_rule_init (u32 field,u32 op,char *rulestr,void **lsmrule) +int security_audit_rule_init (u32 field,u32 op,char *rulestr,void **lsmrule, +gfp_t gfp) { -return call_int_hook (audit_rule_init, field, op, rulestr, lsmrule); +return call_int_hook (audit_rule_init, field, op, rulestr, lsmrule, gfp); }/**
security/selinux/include/audit.h +3 -1
@@ -21,12 +21,14 @@* @op: the operator the rule uses * @rulestr: the text "target" of the rule * @rule: pointer to the new rule structure returned via this +* @gfp: GFP flag used for kmalloc * * Returns 0 if successful, -errno if not. On success, the rule structure * will be allocated internally. The caller must free this structure with * selinux_audit_rule_free() after use. */ -int selinux_audit_rule_init (u32 field,u32 op,char *rulestr,void **rule); +int selinux_audit_rule_init (u32 field,u32 op,char *rulestr,void **rule, +gfp_t gfp);/** * selinux_audit_rule_free - free an selinux audit rule structure.
security/selinux/ss/services.c +3 -2
@@ -3508,7 +3508,8 @@ void selinux_audit_rule_free(void *vrule } } -int selinux_audit_rule_init (u32 field,u32 op,char *rulestr,void **vrule) +int selinux_audit_rule_init (u32 field,u32 op,char *rulestr,void **vrule, +gfp_t gfp) {struct selinux_state *state = &selinux_state;struct selinux_policy *policy;
@@ -3549,7 +3550,7 @@ int selinux_audit_rule_init(u32 field, ureturn -EINVAL ; } - tmprule =kzalloc (sizeof (struct selinux_audit_rule ),GFP_KERNEL ); + tmprule =kzalloc (sizeof (struct selinux_audit_rule ), gfp);if (!tmprule)return -ENOMEM ;context_init (&tmprule->au_ctxt);
security/smack/smack_lsm.c +3 -1
@@ -4692,11 +4692,13 @@ static int smack_post_notification(const* @op: required testing operator (=, !=, >, <, ...) * @rulestr: smack label to be audited * @vrule: pointer to save our own audit rule representation +* @gfp: type of the memory for the allocation * * Prepare to audit cases where (@field @op @rulestr) is true. * The label to be audited is created if necessay. */ -static int smack_audit_rule_init (u32 field,u32 op,char *rulestr,void **vrule) +static int smack_audit_rule_init (u32 field,u32 op,char *rulestr,void **vrule, +gfp_t gfp) {struct smack_known *skp;char **rule = (char **)vrule;
Greg Kroah-Hartman
maintainerPATCH 229/250 i2c: ocores: set IACK bit after core is enabled
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Grygorii Tertychnyi <[email protected]>
commit 5a72477273066b5b357801ab2d315ef14949d402 upstream.
Setting IACK bit when core is disabled does not clear the "Interrupt Flag" bit in the status register, and the interrupt remains pending.
Sometimes it causes failure for the very first message transfer, that is usually a device probe.
Hence, set IACK bit after core is enabled to clear pending interrupt.
--- drivers/i2c/busses/i2c-ocores.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i2c/busses/i2c-ocores.c +1 -1
@@ -442,8 +442,8 @@ static int ocores_init(struct device *deoc_setreg (i2c,OCI2C_PREHIGH , prescale >>8 );/* Init the device */ -oc_setreg (i2c,OCI2C_CMD ,OCI2C_CMD_IACK );oc_setreg (i2c,OCI2C_CONTROL , ctrl |OCI2C_CTRL_EN ); +oc_setreg (i2c,OCI2C_CMD ,OCI2C_CMD_IACK );return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 230/250 dt-bindings: i2c: atmel,at91sam: correct path to i2c-controller schema
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
commit d4e001ffeccfc128c715057e866f301ac9b95728 upstream.
The referenced i2c-controller.yaml schema is provided by dtschema package (outside of Linux kernel), so use full path to reference it.
--- Documentation/devicetree/bindings/i2c/atmel,at91sam-i2c.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Documentation/devicetree/bindings/i2c/atmel,at91sam-i2c.yaml +1 -1
@@ -77,7 +77,7 @@ required: - clocks allOf: - - $ref: i2c-controller.yaml + - $ref: /schemas/i2c/i2c-controller.yaml# - if: properties: compatible:
Greg Kroah-Hartman
maintainerPATCH 231/250 virt: guest_memfd: fix reference leak on hwpoisoned page
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Bonzini <[email protected]>
commit c31745d2c508796a0996c88bf2e55f552d513f65 upstream.
If kvm_gmem_get_pfn() detects an hwpoisoned page, it returns -EHWPOISON but it does not put back the reference that kvm_gmem_get_folio() had grabbed. Add the forgotten folio_put().
--- virt/kvm/guest_memfd.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
virt/kvm/guest_memfd.c +3 -2
@@ -510,8 +510,10 @@ int kvm_gmem_get_pfn(struct kvm *kvm, struct kvm_memory_slot *slot, }if (folio_test_hwpoison (folio)) { +folio_unlock (folio); +folio_put (folio); r = -EHWPOISON ; - goto out_unlock; + goto out_fput; } page =folio_file_page (folio, index);
@@ -522,7 +524,6 @@ int kvm_gmem_get_pfn(struct kvm *kvm, struct kvm_memory_slot *slot, r =0 ; -out_unlock:folio_unlock (folio); out_fput:fput (file);
Signature · 1 line
2.45.2
Greg Kroah-Hartman
maintainerPATCH 232/250 dt-bindings: i2c: google,cros-ec-i2c-tunnel: correct path to i2c-controller schema
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
commit 5c8cfd592bb7632200b4edac8f2c7ec892ed9d81 upstream.
The referenced i2c-controller.yaml schema is provided by dtschema package (outside of Linux kernel), so use full path to reference it.
--- Documentation/devicetree/bindings/i2c/google,cros-ec-i2c-tunnel.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Documentation/devicetree/bindings/i2c/google,cros-ec-i2c-tunnel.yaml +1 -1
@@ -21,7 +21,7 @@ description: | google,cros-ec-spi or google,cros-ec-i2c. allOf: - - $ref: i2c-controller.yaml# + - $ref: /schemas/i2c/i2c-controller.yaml# properties: compatible:
Greg Kroah-Hartman
maintainerPATCH 233/250 thermal: int340x: processor_thermal: Support shared interrupts
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <[email protected]>
commit 096597cfe4ea08b1830e775436d76d7c9d6d3037 upstream.
On some systems the processor thermal device interrupt is shared with other PCI devices. In this case return IRQ_NONE from the interrupt handler when the interrupt is not for the processor thermal device.
--- .../intel/int340x_thermal/processor_thermal_device_pci.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/thermal/intel/int340x_thermal/processor_thermal_device_pci.c +2 -1
@@ -150,7 +150,7 @@ static irqreturn_t proc_thermal_irq_handler(int irq, void *devid) {struct proc_thermal_pci *pci_info = devid;struct proc_thermal_device *proc_priv; -int ret =IRQ_HANDLED ; +int ret =IRQ_NONE ;u32 status; proc_priv = pci_info->proc_priv;
@@ -175,6 +175,7 @@ static irqreturn_t proc_thermal_irq_handler(int irq, void *devid)/* Disable enable interrupt flag */ proc_thermal_mmio_write (pci_info,PROC_THERMAL_MMIO_INT_ENABLE_0 ,0 );pkg_thermal_schedule_work (&pci_info->work); + ret =IRQ_HANDLED ; }pci_write_config_byte (pci_info->pdev,0xdc ,0x01 );
Signature · 1 line
2.45.2
Greg Kroah-Hartman
maintainerPATCH 234/250 spi: stm32: qspi: Fix dual flash mode sanity test in stm32_qspi_setup()
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patrice Chotard <[email protected]>
commit c2bd0791c5f02e964402624dfff45ca8995f5397 upstream.
Misplaced parenthesis make test of mode wrong in case mode is equal to SPI_TX_OCTAL or SPI_RX_OCTAL.
Simplify this sanity test, if one of this bit is set, property cs-gpio must be present in DT.
--- drivers/spi/spi-stm32-qspi.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
drivers/spi/spi-stm32-qspi.c +4 -6
@@ -653,9 +653,7 @@ static int stm32_qspi_setup(struct spi_dreturn -EINVAL ; mode = spi->mode & (SPI_TX_OCTAL |SPI_RX_OCTAL ); -if ((mode ==SPI_TX_OCTAL || mode ==SPI_RX_OCTAL ) || - ((mode == (SPI_TX_OCTAL |SPI_RX_OCTAL )) && -gpiod_count (qspi->dev,"cs" ) == -ENOENT )) { +if (mode &&gpiod_count (qspi->dev,"cs" ) == -ENOENT ) {dev_err (qspi->dev,"spi-rx-bus-width\\/spi-tx-bus-width\\/cs-gpios\n" );dev_err (qspi->dev,"configuration not supported\n" );
@@ -676,10 +674,10 @@ static int stm32_qspi_setup(struct spi_d qspi->cr_reg =CR_APMS |3 <<CR_FTHRES_SHIFT |CR_SSHIFT |CR_EN ;/* -* Dual flash mode is only enable in case SPI_TX_OCTAL and SPI_TX_OCTAL -* are both set in spi->mode and "cs-gpios" properties is found in DT +* Dual flash mode is only enable in case SPI_TX_OCTAL or SPI_RX_OCTAL +* is set in spi->mode and "cs-gpios" properties is found in DT */ -if (mode == (SPI_TX_OCTAL |SPI_RX_OCTAL )) { +if (mode) { qspi->cr_reg |=CR_DFM ;dev_dbg (qspi->dev,"Dual flash mode enable" ); }
Greg Kroah-Hartman
maintainerPATCH 235/250 arm64: dts: imx8qm-mek: fix gpio number for reg_usdhc2_vmmc
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Li <[email protected]>
commit dfd239a039b3581ca25f932e66b6e2c2bf77c798 upstream.
The gpio in "reg_usdhc2_vmmc" should be 7 instead of 19.
--- arch/arm64/boot/dts/freescale/imx8qm-mek.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/freescale/imx8qm-mek.dts +1 -1
@@ -36,7 +36,7 @@ regulator-name = "SD1_SPWR"; regulator-min-microvolt = <3000000>; regulator-max-microvolt = <3000000>; - gpio = <&lsio_gpio4 19 GPIO_ACTIVE_HIGH>; + gpio = <&lsio_gpio4 7 GPIO_ACTIVE_HIGH>; enable-active-high; }; };
Greg Kroah-Hartman
maintainerPATCH 236/250 thermal: core: Change PM notifier priority to the minimum
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
commit 494c7d055081da066424706b28faa9a4c719d852 upstream.
It is reported that commit 5a5efdaffda5 ("thermal: core: Resume thermal zones asynchronously") causes battery data in sysfs on Thinkpad P1 Gen2 to become invalid after a resume from S3 (and it is necessary to reboot the machine to restore correct battery data). Some investigation into the problem indicated that it happened because, after the commit in question, the ACPI battery PM notifier ran in parallel with thermal_zone_device_resume() for one of the thermal zones which apparently confused the platform firmware on the affected system.
While the exact reason for the firmware confusion remains unclear, it is arguably not particularly relevant, and the expected behavior of the affected system can be restored by making the thermal PM notifier run at the lowest priority which avoids interference between work items spawned by it and the other PM notifiers (that will run before those work items now).
--- drivers/thermal/thermal_core.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/thermal/thermal_core.c +6 -0
@@ -1633,6 +1633,12 @@ static int thermal_pm_notify(struct notistatic struct notifier_block thermal_pm_nb = { .notifier_call = thermal_pm_notify, +/* +* Run at the lowest priority to avoid interference between the thermal +* zone resume work items spawned by thermal_pm_notify() and the other +* PM notifiers. +*/ + .priority =INT_MIN , };static int __init thermal_init (void )
Greg Kroah-Hartman
maintainerPATCH 237/250 spi: stm32: qspi: Clamp stm32_qspi_get_mode() output to CCR_BUSWIDTH_4
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patrice Chotard <[email protected]>
commit 63deee52811b2f84ed2da55ad47252f0e8145d62 upstream.
In case usage of OCTAL mode, buswidth parameter can take the value 8. As return value of stm32_qspi_get_mode() is used to configure fields of CCR registers that are 2 bits only (fields IMODE, ADMODE, ADSIZE,
DMODE), clamp return value of stm32_qspi_get_mode() to 4.
--- drivers/spi/spi-stm32-qspi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-stm32-qspi.c +1 -1
@@ -349,7 +349,7 @@ static int stm32_qspi_wait_poll_status(sstatic int stm32_qspi_get_mode (u8 buswidth) { -if (buswidth ==4 ) +if (buswidth >=4 )return CCR_BUSWIDTH_4 ;return buswidth;
Greg Kroah-Hartman
maintainerPATCH 238/250 drm/xe: Use ordered WQ for G2H handler
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Brost <[email protected]>
[ Upstream commit 2d9c72f676e6f79a021b74c6c1c88235e7d5b722 ]
System work queues are shared, use a dedicated work queue for G2H processing to avoid G2H processing getting block behind system tasks.
--- drivers/gpu/drm/xe/xe_guc_ct.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/xe/xe_guc_ct.c +4 -0
@@ -146,6 +146,10 @@ int xe_guc_ct_init(struct xe_guc_ct *ct)xe_assert (xe, !(guc_ct_size () %PAGE_SIZE )); + ct->g2h_wq =alloc_ordered_workqueue ("xe-g2h-wq" ,0 ); +if (!ct->g2h_wq) +return -ENOMEM ; + ct->g2h_wq =alloc_ordered_workqueue ("xe-g2h-wq" ,0 );if (!ct->g2h_wq)return -ENOMEM ;
Signature · 1 line
2.43.0
Re: [PATCH 6.9 238/250] drm/xe: Use ordered WQ for G2H handler
Quoted 1 line · Greg Kroah-Hartman
6.9-stable review patch. If anyone has any objections, please let me know.
Please drop this patch.
Same as:
https://lore.kernel.org/stable/2024061946-salvaging-tying-a320@gregkh/raw
Quoted 42 lines
------------------
From: Matthew Brost <[email protected]>
[ Upstream commit
2d9c72f676e6f79a021b74c6c1c88235e7d5b722]System work queues are shared, use a dedicated work queue for G2H processing to avoid G2H processing getting block behind system tasks.
Fixes dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")Cc <[email protected]>Signed-off-by Matthew Brost <[email protected]>Reviewed-by Francois Dugast <[email protected]>(cherry picked from commit 50aec9665e0babd62b9eee4e613d9a1ef8d2b7de)Signed-off-by Thomas Hellström <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- drivers/gpu/drm/xe/xe_guc_ct.c | 4 ++++ 1 file changed, 4 insertions(+)drivers/gpu/drm/xe/xe_guc_ct.c +4
-0@@ -146,6 +146,10 @@ int xe_guc_ct_init(struct xe_guc_ct *ct)xe_assert (xe, !(guc_ct_size () %PAGE_SIZE )); + ct->g2h_wq =alloc_ordered_workqueue ("xe-g2h-wq" ,0 ); +if (!ct->g2h_wq) +return -ENOMEM ; + ct->g2h_wq =alloc_ordered_workqueue ("xe-g2h-wq" ,0 );if (!ct->g2h_wq)return -ENOMEM ;Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerRe: [PATCH 6.9 238/250] drm/xe: Use ordered WQ for G2H handler
Quoted 8 lines · Rodrigo Vivi
Quoted 1 line · Greg Kroah-Hartman
6.9-stable review patch. If anyone has any objections, please let me know.
Please drop this patch.
Same as:
https://lore.kernel.org/stable/2024061946-salvaging-tying-a320@gregkh/raw
Now dropped.
Greg Kroah-Hartman
maintainerPATCH 239/250 nbd: Improve the documentation of the locking assumptions
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
[ Upstream commit 2a6751e052ab4789630bc889c814037068723bc1 ]
Document locking assumptions with lockdep_assert_held() instead of source code comments. The advantage of lockdep_assert_held() is that it is verified at runtime if lockdep is enabled in the kernel config.
Stable-dep-of: e56d4b633fff ("nbd: Fix signal handling")
--- drivers/block/nbd.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/block/nbd.c +5 -1
@@ -588,7 +588,6 @@ static inline int was_interrupted(int result)return result == -ERESTARTSYS || result == -EINTR ; } -/* always call with the tx_lock held */ static int nbd_send_cmd (struct nbd_device *nbd,struct nbd_cmd *cmd,int index) {struct request *req =blk_mq_rq_from_pdu (cmd);
@@ -605,6 +604,9 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index)u32 nbd_cmd_flags =0 ;int sent = nsock->sent, skip =0 ; +lockdep_assert_held (&cmd->lock); +lockdep_assert_held (&nsock->tx_lock); +iov_iter_kvec (&from,ITER_SOURCE , &iov,1 ,sizeof (request)); type =req_to_nbd_cmd_type (req);
@@ -1015,6 +1017,8 @@ static int nbd_handle_cmd(struct nbd_cmd *cmd, int index)struct nbd_sock *nsock;int ret; +lockdep_assert_held (&cmd->lock); + config =nbd_get_config_unlocked (nbd);if (!config) { dev_err_ratelimited(disk_to_dev(nbd->disk),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 240/250 nbd: Fix signal handling
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
[ Upstream commit e56d4b633fffea9510db468085bed0799cba4ecd ]
Both nbd_send_cmd() and nbd_handle_cmd() return either a negative error number or a positive blk_status_t value. nbd_queue_rq() converts these return values into a blk_status_t value. There is a bug in the conversion
code: if nbd_send_cmd() returns BLK_STS_RESOURCE, nbd_queue_rq() should return BLK_STS_RESOURCE instead of BLK_STS_OK. Fix this, move the conversion code into nbd_handle_cmd() and fix the remaining sparse warnings.
This patch fixes the following sparse warnings:
drivers/block/nbd.c:673:32: warning: incorrect type in return expression (different base types)drivers/block/nbd.c:673:32: expected intdrivers/block/nbd.c:673:32: got restricted blk_status_t [usertype]drivers/block/nbd.c:714:48: warning: incorrect type in return expression (different base types)drivers/block/nbd.c:714:48: expected intdrivers/block/nbd.c:714:48: got restricted blk_status_t [usertype]drivers/block/nbd.c:1120:21: warning: incorrect type in assignment (different base types)drivers/block/nbd.c:1120:21: expected int [assigned] retdrivers/block/nbd.c:1120:21: got restricted blk_status_t [usertype]drivers/block/nbd.c:1125:16: warning: incorrect type in return expression (different base types)drivers/block/nbd.c:1125:16: expected restricted blk_status_tdrivers/block/nbd.c:1125:16: got int [assigned] ret
--- drivers/block/nbd.c | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-)
drivers/block/nbd.c +14 -14
@@ -588,6 +588,10 @@ static inline int was_interrupted(int result)return result == -ERESTARTSYS || result == -EINTR ; } +/* +* Returns BLK_STS_RESOURCE if the caller should retry after a delay. Returns +* -EAGAIN if the caller should requeue @cmd. Returns -EIO if sending failed. +*/ static int nbd_send_cmd (struct nbd_device *nbd,struct nbd_cmd *cmd,int index) {struct request *req =blk_mq_rq_from_pdu (cmd);
@@ -671,7 +675,7 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index) nsock->sent = sent; }set_bit (NBD_CMD_REQUEUED , &cmd->flags); -return BLK_STS_RESOURCE ; +return (__force int )BLK_STS_RESOURCE ; }dev_err_ratelimited (disk_to_dev (nbd->disk),"Send control failed (result %d)\n" , result);
@@ -712,7 +716,7 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index) nsock->pending = req; nsock->sent = sent;set_bit (NBD_CMD_REQUEUED , &cmd->flags); -return BLK_STS_RESOURCE ; +return (__force int )BLK_STS_RESOURCE ; } dev_err(disk_to_dev(nbd->disk), "Send data failed (result %d)\n",
@@ -1009,7 +1013,7 @@ static int wait_for_reconnect(struct nbd_device *nbd)return !test_bit (NBD_RT_DISCONNECTED , &config->runtime_flags); } -static int nbd_handle_cmd (struct nbd_cmd *cmd,int index) +static blk_status_t nbd_handle_cmd (struct nbd_cmd *cmd,int index) {struct request *req =blk_mq_rq_from_pdu (cmd);struct nbd_device *nbd = cmd->nbd;
@@ -1023,14 +1027,14 @@ static int nbd_handle_cmd(struct nbd_cmd *cmd, int index)if (!config) {dev_err_ratelimited (disk_to_dev (nbd->disk),"Socks array is empty\n" ); -return -EINVAL ; +return BLK_STS_IOERR ; }if (index >= config->num_connections) {dev_err_ratelimited (disk_to_dev (nbd->disk),"Attempted send on invalid socket\n" );nbd_config_put (nbd); -return -EINVAL ; +return BLK_STS_IOERR ; } cmd->status =BLK_STS_OK ; again:
@@ -1053,7 +1057,7 @@ static int nbd_handle_cmd(struct nbd_cmd *cmd, int index)*/ sock_shutdown (nbd);nbd_config_put (nbd); -return -EIO ; +return BLK_STS_IOERR ; } goto again; }
@@ -1066,7 +1070,7 @@ static int nbd_handle_cmd(struct nbd_cmd *cmd, int index)blk_mq_start_request (req);if (unlikely (nsock->pending && nsock->pending != req)) {nbd_requeue_cmd (cmd); - ret =0 ; + ret =BLK_STS_OK ; goto out; }/*
@@ -1085,19 +1089,19 @@ static int nbd_handle_cmd(struct nbd_cmd *cmd, int index) "Request send failed, requeueing\n");nbd_mark_nsock_dead (nbd, nsock,1 );nbd_requeue_cmd (cmd); - ret =0 ; + ret =BLK_STS_OK ; } out:mutex_unlock (&nsock->tx_lock);nbd_config_put (nbd); -return ret; +return ret <0 ?BLK_STS_IOERR : (__force blk_status_t )ret; }static blk_status_t nbd_queue_rq (struct blk_mq_hw_ctx *hctx,const struct blk_mq_queue_data *bd) {struct nbd_cmd *cmd =blk_mq_rq_to_pdu (bd->rq); -int ret; +blk_status_t ret;/* * Since we look at the bio's to send the request over the network we
@@ -1117,10 +1121,6 @@ static blk_status_t nbd_queue_rq(struct blk_mq_hw_ctx *hctx,* appropriate. */ ret =nbd_handle_cmd (cmd, hctx->queue_num); -if (ret <0 ) - ret =BLK_STS_IOERR ; -else if (!ret) - ret =BLK_STS_OK ;mutex_unlock (&cmd->lock);return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 241/250 tracing: Add MODULE_DESCRIPTION() to preemptirq_delay_test
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Johnson <[email protected]>
[ Upstream commit 23748e3e0fbfe471eff5ce439921629f6a427828 ]
Fix the 'make W=1' warning:
WARNING: modpost: missing MODULE_DESCRIPTION() in kernel/trace/preemptirq_delay_test.o
--- kernel/trace/preemptirq_delay_test.c | 1 + 1 file changed, 1 insertion(+)
kernel/trace/preemptirq_delay_test.c +1 -0
@@ -215,4 +215,5 @@ static void __exit preemptirq_delay_exit(void) module_init(preemptirq_delay_init) module_exit(preemptirq_delay_exit) +MODULE_DESCRIPTION("Preempt / IRQ disable delay thread to test latency tracers");MODULE_LICENSE ("GPL v2" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 242/250 x86/cpu/vfm: Add new macros to work with (vendor/family/model) values
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Luck <[email protected]>
[ Upstream commit e6dfdc2e89a0adedf455814c91b977d6a584cc88 ]
To avoid adding a slew of new macros for each new Intel CPU family switch over from providing CPU model number #defines to a new scheme that encodes vendor, family, and model in a single number.
[ bp: s/casted/cast/g ]
Stable-dep-of: 93022482b294 ("x86/cpu: Fix x86_match_cpu() to match just X86_VENDOR_INTEL")
--- arch/x86/include/asm/cpu_device_id.h | 93 ++++++++++++++++++++++++++++ 1 file changed, 93 insertions(+)
arch/x86/include/asm/cpu_device_id.h +93 -0
@@ -2,6 +2,39 @@#ifndef _ASM_X86_CPU_DEVICE_ID#define _ASM_X86_CPU_DEVICE_ID +/* +* Can't use <linux/bitfield.h> because it generates expressions that +* cannot be used in structure initializers. Bitfield construction +* here must match the union in struct cpuinfo_86: +* union { +* struct { +* __u8 x86_model; +* __u8 x86; +* __u8 x86_vendor; +* __u8 x86_reserved; +* }; +* __u32 x86_vfm; +* }; +*/ +#define VFM_MODEL_BIT 0 +#define VFM_FAMILY_BIT 8 +#define VFM_VENDOR_BIT 16 +#define VFM_RSVD_BIT 24 + +#define VFM_MODEL_MASK GENMASK(VFM_FAMILY_BIT - 1, VFM_MODEL_BIT) +#define VFM_FAMILY_MASK GENMASK(VFM_VENDOR_BIT - 1, VFM_FAMILY_BIT) +#define VFM_VENDOR_MASK GENMASK(VFM_RSVD_BIT - 1, VFM_VENDOR_BIT) + +#define VFM_MODEL (vfm) (((vfm) & VFM_MODEL_MASK) >> VFM_MODEL_BIT) +#define VFM_FAMILY (vfm) (((vfm) & VFM_FAMILY_MASK) >> VFM_FAMILY_BIT) +#define VFM_VENDOR (vfm) (((vfm) & VFM_VENDOR_MASK) >> VFM_VENDOR_BIT) + +#define VFM_MAKE (_vendor, _family, _model) ( \ + ((_model) << VFM_MODEL_BIT) | \ + ((_family) << VFM_FAMILY_BIT) | \ + ((_vendor) << VFM_VENDOR_BIT) \ +) +/* * Declare drivers belonging to specific x86 CPUs * Similar in spirit to pci_device_id and related PCI functions
@@ -49,6 +82,16 @@ .driver_data = (unsigned long) _data \ } +#define X86_MATCH_VENDORID_FAM_MODEL_STEPPINGS_FEATURE (_vendor, _family, _model, \ + _steppings, _feature, _data) { \ + .vendor = _vendor, \ + .family = _family, \ + .model = _model, \ + .steppings = _steppings, \ + .feature = _feature, \ + .driver_data = (unsigned long) _data \ +} +/** * X86_MATCH_VENDOR_FAM_MODEL_FEATURE - Macro for CPU matching * @_vendor: The vendor name, e.g. INTEL, AMD, HYGON, ..., ANY
@@ -164,6 +207,56 @@ X86_MATCH_VENDOR_FAM_MODEL_STEPPINGS_FEATURE(INTEL, 6, INTEL_FAM6_##model, \ steppings,X86_FEATURE_ANY , data) +/** +* X86_MATCH_VFM - Match encoded vendor/family/model +* @vfm: Encoded 8-bits each for vendor, family, model +* @data: Driver specific data or NULL. The internal storage +* format is unsigned long. The supplied value, pointer +* etc. is cast to unsigned long internally. +* +* Stepping and feature are set to wildcards + */ +#define X86_MATCH_VFM (vfm, data) \ + X86_MATCH_VENDORID_FAM_MODEL_STEPPINGS_FEATURE( \ + VFM_VENDOR(vfm), \ + VFM_FAMILY(vfm), \ + VFM_MODEL(vfm), \ + X86_STEPPING_ANY, X86_FEATURE_ANY, data) + +/** +* X86_MATCH_VFM_STEPPINGS - Match encoded vendor/family/model/stepping +* @vfm: Encoded 8-bits each for vendor, family, model +* @steppings: Bitmask of steppings to match +* @data: Driver specific data or NULL. The internal storage +* format is unsigned long. The supplied value, pointer +* etc. is cast to unsigned long internally. +* +* feature is set to wildcard +*/ +#define X86_MATCH_VFM_STEPPINGS (vfm, steppings, data) \ + X86_MATCH_VENDORID_FAM_MODEL_STEPPINGS_FEATURE( \ + VFM_VENDOR(vfm), \ + VFM_FAMILY(vfm), \ + VFM_MODEL(vfm), \ + steppings, X86_FEATURE_ANY, data) + +/** +* X86_MATCH_VFM_FEATURE - Match encoded vendor/family/model/feature +* @vfm: Encoded 8-bits each for vendor, family, model +* @feature: A X86_FEATURE bit +* @data: Driver specific data or NULL. The internal storage +* format is unsigned long. The supplied value, pointer +* etc. is cast to unsigned long internally. +* +* Steppings is set to wildcard +*/ +#define X86_MATCH_VFM_FEATURE (vfm, feature, data) \ + X86_MATCH_VENDORID_FAM_MODEL_STEPPINGS_FEATURE( \ + VFM_VENDOR(vfm), \ + VFM_FAMILY(vfm), \ + VFM_MODEL(vfm), \ + X86_STEPPING_ANY, feature, data) +/* * Match specific microcode revisions. *
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 243/250 x86/cpu: Fix x86_match_cpu() to match just X86_VENDOR_INTEL
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Luck <[email protected]>
[ Upstream commit 93022482b2948a9a7e9b5a2bb685f2e1cb4c3348 ]
Code in v6.9 arch/x86/kernel/smpboot.c was changed by commit
4db64279bc2b ("x86/cpu: Switch to new Intel CPU model defines") from:
static const struct x86_cpu_id intel_cod_cpu[] = {
X86_MATCH_INTEL_FAM6_MODEL(HASWELL_X, 0), /* COD */
X86_MATCH_INTEL_FAM6_MODEL(BROADWELL_X, 0), /* COD */
X86_MATCH_INTEL_FAM6_MODEL(ANY, 1), /* SNC */ <--- 443
{}
};
static bool match_llc(struct cpuinfo_x86 *c, struct cpuinfo_x86 *o)
{
const struct x86_cpu_id *id = x86_match_cpu(intel_cod_cpu);to:
static const struct x86_cpu_id intel_cod_cpu[] = {
X86_MATCH_VFM(INTEL_HASWELL_X, 0), /* COD */
X86_MATCH_VFM(INTEL_BROADWELL_X, 0), /* COD */
X86_MATCH_VFM(INTEL_ANY, 1), /* SNC */
{}
};
static bool match_llc(struct cpuinfo_x86 *c, struct cpuinfo_x86 *o)
{
const struct x86_cpu_id *id = x86_match_cpu(intel_cod_cpu);On an Intel CPU with SNC enabled this code previously matched the rule on line 443 to avoid printing messages about insane cache configuration. The new code did not match any rules.
Expanding the macros for the intel_cod_cpu[] array shows that the old is equivalent to:
static const struct x86_cpu_id intel_cod_cpu[] = {
[0] = { .vendor = 0, .family = 6, .model = 0x3F, .steppings = 0, .feature = 0, .driver_data = 0 },
[1] = { .vendor = 0, .family = 6, .model = 0x4F, .steppings = 0, .feature = 0, .driver_data = 0 },
[2] = { .vendor = 0, .family = 6, .model = 0x00, .steppings = 0, .feature = 0, .driver_data = 1 },
[3] = { .vendor = 0, .family = 0, .model = 0x00, .steppings = 0, .feature = 0, .driver_data = 0 } }
while the new code expands to:
static const struct x86_cpu_id intel_cod_cpu[] = {
[0] = { .vendor = 0, .family = 6, .model = 0x3F, .steppings = 0, .feature = 0, .driver_data = 0 },
[1] = { .vendor = 0, .family = 6, .model = 0x4F, .steppings = 0, .feature = 0, .driver_data = 0 },
[2] = { .vendor = 0, .family = 0, .model = 0x00, .steppings = 0, .feature = 0, .driver_data = 1 },
[3] = { .vendor = 0, .family = 0, .model = 0x00, .steppings = 0, .feature = 0, .driver_data = 0 } }
Looking at the code for x86_match_cpu():
const struct x86_cpu_id *x86_match_cpu(const struct x86_cpu_id *match)
{
const struct x86_cpu_id *m;
struct cpuinfo_x86 *c = &boot_cpu_data; for (m = match;
m->vendor | m->family | m->model | m->steppings | m->feature;
m++) {
...
}
return NULL;it is clear that there was no match because the ANY entry in the table (array index 2) is now the loop termination condition (all of vendor, family, model, steppings, and feature are zero).
So this code was working before because the "ANY" check was looking for any Intel CPU in family 6. But fails now because the family is a wild card. So the root cause is that x86_match_cpu() has never been able to match on a rule with just X86_VENDOR_INTEL and all other fields set to wildcards.
Add a new flags field to struct x86_cpu_id that has a bit set to indicate that this entry in the array is valid. Update X86_MATCH*() macros to set that bit. Change the end-marker check in x86_match_cpu() to just check the flags field for this bit.
Backporter notes: The commit in Fixes is really the one that is broken:
you can't have m->vendor as part of the loop termination conditional in x86_match_cpu() because it can happen - as it has happened above
- that that whole conditional is 0 albeit vendor == 0 is a valid case
- X86_VENDOR_INTEL is 0.
However, the only case where the above happens is the SNC check added by 4db64279bc2b1 so you only need this fix if you have backported that other commit
4db64279bc2b ("x86/cpu: Switch to new Intel CPU model defines")
--- arch/x86/include/asm/cpu_device_id.h | 5 +++++ arch/x86/kernel/cpu/match.c | 4 +--- include/linux/mod_devicetable.h | 2 ++ 3 files changed, 8 insertions(+), 3 deletions(-)
arch/x86/include/asm/cpu_device_id.h +5 -0
@@ -53,6 +53,9 @@#define X86_CENTAUR_FAM6_C7_D 0xd#define X86_CENTAUR_FAM6_NANO 0xf +/* x86_cpu_id::flags */ +#define X86_CPU_ID_FLAG_ENTRY_VALID BIT(0) +#define X86_STEPPINGS (mins, maxs) GENMASK(maxs, mins)/** * X86_MATCH_VENDOR_FAM_MODEL_STEPPINGS_FEATURE - Base macro for CPU matching
@@ -79,6 +82,7 @@ .model = _model, \ .steppings = _steppings, \ .feature = _feature, \ + .flags = X86_CPU_ID_FLAG_ENTRY_VALID, \ .driver_data = (unsigned long) _data \ }
@@ -89,6 +93,7 @@ .model = _model, \ .steppings = _steppings, \ .feature = _feature, \ + .flags = X86_CPU_ID_FLAG_ENTRY_VALID, \ .driver_data = (unsigned long) _data \ }
arch/x86/kernel/cpu/match.c +1 -3
@@ -39,9 +39,7 @@ const struct x86_cpu_id *x86_match_cpu(const struct x86_cpu_id *match)const struct x86_cpu_id *m;struct cpuinfo_x86 *c = &boot_cpu_data; -for (m = match; - m->vendor | m->family | m->model | m->steppings | m->feature; - m++) { +for (m = match; m->flags &X86_CPU_ID_FLAG_ENTRY_VALID ; m++) {if (m->vendor !=X86_VENDOR_ANY && c->x86_vendor != m->vendor)continue ;if (m->family !=X86_FAMILY_ANY && c->x86 != m->family)
include/linux/mod_devicetable.h +2 -0
@@ -690,6 +690,8 @@ struct x86_cpu_id {__u16 model;__u16 steppings;__u16 feature;/* bit index */ +/* Solely for kernel-internal use: DO NOT EXPORT to userspace! */ +__u16 flags;kernel_ulong_t driver_data; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 244/250 drm/amd/display: revert Exit idle optimizations before HDCP execution
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Leung <[email protected]>
commit f2703a3596a279b0be6eeed4c500bdbaa8dc3ce4 upstream.
why and how:
causes black screen on PNP on DCN 3.5
This reverts commit f30a3bea92bd ("drm/amd/display: Exit idle optimizations before HDCP execution")
--- drivers/gpu/drm/amd/display/modules/hdcp/hdcp.c | 10 ---------- drivers/gpu/drm/amd/display/modules/inc/mod_hdcp.h | 8 -------- 2 files changed, 18 deletions(-)
drivers/gpu/drm/amd/display/modules/hdcp/hdcp.c +0 -10
@@ -88,14 +88,6 @@ static uint8_t is_cp_desired_hdcp2(struc !hdcp->connection.is_hdcp2_revoked; } -static void exit_idle_optimizations (struct mod_hdcp *hdcp) -{ -struct mod_hdcp_dm *dm = &hdcp->config.dm; - -if (dm->funcs.exit_idle_optimizations) - dm->funcs.exit_idle_optimizations (dm->handle); -} -static enum mod_hdcp_status execution (struct mod_hdcp *hdcp,struct mod_hdcp_event_context *event_ctx,union mod_hdcp_transition_input *input)
@@ -551,8 +543,6 @@ enum mod_hdcp_status mod_hdcp_process_evmemset (&event_ctx,0 ,sizeof (struct mod_hdcp_event_context )); event_ctx.event = event; -exit_idle_optimizations (hdcp); -/* execute and transition */ exec_status =execution (hdcp, &event_ctx, &hdcp->auth.trans_input); trans_status = transition(
drivers/gpu/drm/amd/display/modules/inc/mod_hdcp.h +0 -8
@@ -156,13 +156,6 @@ struct mod_hdcp_ddc { } funcs; }; -struct mod_hdcp_dm { -void *handle; -struct { -void (*exit_idle_optimizations)(void *handle); - } funcs; -}; -struct mod_hdcp_psp {void *handle;void *funcs;
@@ -279,7 +272,6 @@ struct mod_hdcp_display_query {struct mod_hdcp_config {struct mod_hdcp_psp psp;struct mod_hdcp_ddc ddc; -struct mod_hdcp_dm dm;uint8_t index; };
Greg Kroah-Hartman
maintainerPATCH 245/250 wifi: ath12k: check M3 buffer size as well whey trying to reuse it
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baochen Qiang <[email protected]>
commit 05090ae82f44570fefddb4e1be1d7e5770d6de40 upstream.
Currently in recovery/resume cases, we do not free M3 buffer but instead will reuse it. This is done by checking m3_mem->vaddr: if it is not NULL we believe M3 buffer is ready and go ahead to reuse it.
Note that m3_mem->size is not checked. This is safe for now because currently M3 reuse logic only gets executed in recovery/resume cases and the size keeps unchanged in either of them.
However ideally the size should be checked as well, to make the code safer. So add the check there. Now if that check fails, free old M3 buffer and reallocate a new one.
Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30
--- drivers/net/wireless/ath/ath12k/qmi.c | 36 +++++++++++++++++++--------------- 1 file changed, 21 insertions(+), 15 deletions(-)
drivers/net/wireless/ath/ath12k/qmi.c +21 -15
@@ -2685,6 +2685,19 @@ out:return ret; } +static void ath12k_qmi_m3_free (struct ath12k_base *ab) +{ +struct m3_mem_region *m3_mem = &ab->qmi.m3_mem; + +if (!m3_mem->vaddr) +return ; + +dma_free_coherent (ab->dev, m3_mem->size, + m3_mem->vaddr, m3_mem->paddr); + m3_mem->vaddr =NULL ; + m3_mem->size =0 ; +} +static int ath12k_qmi_m3_load (struct ath12k_base *ab) {struct m3_mem_region *m3_mem = &ab->qmi.m3_mem;
@@ -2715,8 +2728,14 @@ static int ath12k_qmi_m3_load(struct ath m3_len = fw->size; } -if (m3_mem->vaddr) - goto skip_m3_alloc; +/* In recovery/resume cases, M3 buffer is not freed, try to reuse that */ +if (m3_mem->vaddr) { +if (m3_mem->size >= m3_len) + goto skip_m3_alloc; + +/* Old buffer is too small, free and reallocate */ +ath12k_qmi_m3_free (ab); + } m3_mem->vaddr = dma_alloc_coherent(ab->dev, m3_len, &m3_mem->paddr,
@@ -2740,19 +2759,6 @@ out:return ret; } -static void ath12k_qmi_m3_free (struct ath12k_base *ab) -{ -struct m3_mem_region *m3_mem = &ab->qmi.m3_mem; - -if (!m3_mem->vaddr) -return ; - -dma_free_coherent (ab->dev, m3_mem->size, - m3_mem->vaddr, m3_mem->paddr); - m3_mem->vaddr =NULL ; - m3_mem->size =0 ; -} -static int ath12k_qmi_wlanfw_m3_info_send (struct ath12k_base *ab) {struct m3_mem_region *m3_mem = &ab->qmi.m3_mem;
Greg Kroah-Hartman
maintainerPATCH 246/250 ASoC: Intel: sof-sdw: really remove FOUR_SPEAKER quirk
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre-Louis Bossart <[email protected]>
commit 0bab4cfd7c1560095e29919e2ebe01783b9096dc upstream.
Two independent GitHub PRs let to the addition of one quirk after it was removed..
--- sound/soc/intel/boards/sof_sdw.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
sound/soc/intel/boards/sof_sdw.c +1 -2
@@ -436,8 +436,7 @@ static const struct dmi_system_id sof_sdDMI_EXACT_MATCH (DMI_PRODUCT_SKU ,"0C0F" ) }, .driver_data = (void *)(SOF_SDW_TGL_HDMI | -RT711_JD2 | - SOF_SDW_FOUR_SPK), + RT711_JD2), }, { .callback = sof_sdw_quirk_cb,
Greg Kroah-Hartman
maintainerPATCH 247/250 net/sched: unregister lockdep keys in qdisc_create/qdisc_alloc error path
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Davide Caratti <[email protected]>
commit 86735b57c905e775f05de995df35379366b72168 upstream.
Naresh and Eric report several errors (corrupted elements in the dynamic key hash list), when running tdc.py or syzbot. The error path of qdisc_alloc() and qdisc_create() frees the qdisc memory, but it forgets to unregister the lockdep key, thus causing use-after-free like the following one:
==================================================================
BUG: KASAN: slab-use-after-free in lockdep_register_key+0x5f2/0x700 Read of size 8 at addr ffff88811236f2a8 by task ip/7925 CPU: 26 PID: 7925 Comm: ip Kdump: loaded Not tainted 6.9.0-rc2+ #648 Hardware name: Supermicro SYS-6027R-72RF/X9DRH-7TF/7F/iTF/iF, BIOS 3.0 07/26/2013 Call Trace: <TASK> dump_stack_lvl+0x7c/0xc0 print_report+0xc9/0x610 kasan_report+0x89/0xc0 lockdep_register_key+0x5f2/0x700 qdisc_alloc+0x21d/0xb60 qdisc_create_dflt+0x63/0x3c0 attach_one_default_qdisc.constprop.37+0x8e/0x170 dev_activate+0x4bd/0xc30 __dev_open+0x275/0x380 __dev_change_flags+0x3f1/0x570 dev_change_flags+0x7c/0x160 do_setlink+0x1ea1/0x34b0 __rtnl_newlink+0x8c9/0x1510 rtnl_newlink+0x61/0x90 rtnetlink_rcv_msg+0x2f0/0xbc0 netlink_rcv_skb+0x120/0x380 netlink_unicast+0x420/0x630 netlink_sendmsg+0x732/0xbc0 __sock_sendmsg+0x1ea/0x280 ____sys_sendmsg+0x5a9/0x990 ___sys_sendmsg+0xf1/0x180 __sys_sendmsg+0xd3/0x180 do_syscall_64+0x96/0x180 entry_SYSCALL_64_after_hwframe+0x71/0x79 RIP: 0033:0x7f9503f4fa07 Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 RSP: 002b:00007fff6c729068 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 000000006630c681 RCX: 00007f9503f4fa07 RDX: 0000000000000000 RSI: 00007fff6c7290d0 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000078 R10: 000000000000009b R11: 0000000000000246 R12: 0000000000000001 R13: 00007fff6c729180 R14: 0000000000000000 R15: 000055bf67dd9040 </TASK> Allocated by task 7745: kasan_save_stack+0x1c/0x40 kasan_save_track+0x10/0x30 __kasan_kmalloc+0x7b/0x90 __kmalloc_node+0x1ff/0x460 qdisc_alloc+0xae/0xb60 qdisc_create+0xdd/0xfb0 tc_modify_qdisc+0x37e/0x1960 rtnetlink_rcv_msg+0x2f0/0xbc0 netlink_rcv_skb+0x120/0x380 netlink_unicast+0x420/0x630 netlink_sendmsg+0x732/0xbc0 __sock_sendmsg+0x1ea/0x280 ____sys_sendmsg+0x5a9/0x990 ___sys_sendmsg+0xf1/0x180 __sys_sendmsg+0xd3/0x180 do_syscall_64+0x96/0x180 entry_SYSCALL_64_after_hwframe+0x71/0x79 Freed by task 7745: kasan_save_stack+0x1c/0x40 kasan_save_track+0x10/0x30 kasan_save_free_info+0x36/0x60 __kasan_slab_free+0xfe/0x180 kfree+0x113/0x380 qdisc_create+0xafb/0xfb0 tc_modify_qdisc+0x37e/0x1960 rtnetlink_rcv_msg+0x2f0/0xbc0 netlink_rcv_skb+0x120/0x380 netlink_unicast+0x420/0x630 netlink_sendmsg+0x732/0xbc0 __sock_sendmsg+0x1ea/0x280 ____sys_sendmsg+0x5a9/0x990 ___sys_sendmsg+0xf1/0x180 __sys_sendmsg+0xd3/0x180 do_syscall_64+0x96/0x180 entry_SYSCALL_64_after_hwframe+0x71/0x79
Fix this ensuring that lockdep_unregister_key() is called before the qdisc struct is freed, also in the error path of qdisc_create() and qdisc_alloc().
--- net/sched/sch_api.c | 1 + net/sched/sch_generic.c | 1 + 2 files changed, 2 insertions(+)
net/sched/sch_api.c +1 -0
@@ -1389,6 +1389,7 @@ err_out4: ops->destroy (sch);qdisc_put_stab (rtnl_dereference (sch->stab)); err_out3: +lockdep_unregister_key (&sch->root_lock_key);netdev_put (dev, &sch->dev_tracker);qdisc_free (sch); err_out2:
net/sched/sch_generic.c +1 -0
@@ -983,6 +983,7 @@ struct Qdisc *qdisc_alloc(struct netdev_return sch; errout1: +lockdep_unregister_key (&sch->root_lock_key);kfree (sch); errout:return ERR_PTR (err);
Greg Kroah-Hartman
maintainerPATCH 248/250 kprobe/ftrace: fix build error due to bad function definition
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <[email protected]>
commit 4b377b4868ef17b040065bd468668c707d2477a5 upstream.
Commit 1a7d0890dd4a ("kprobe/ftrace: bail out if ftrace was killed") introduced a bad K&R function definition, which we haven't accepted in a long long time.
Gcc seems to let it slide, but clang notices with the appropriate error:
kernel/kprobes.c:1140:24: error: a function declaration without a prototype is deprecated in all >
1140 | void kprobe_ftrace_kill()
| ^
| voidbut this commit was apparently never in linux-next before it was sent upstream, so it didn't get the appropriate build test coverage.
--- kernel/kprobes.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/kprobes.c +1 -1
@@ -1138,7 +1138,7 @@ static int disarm_kprobe_ftrace(struct k ipmodify ? &kprobe_ipmodify_enabled : &kprobe_ftrace_enabled); } -void kprobe_ftrace_kill () +void kprobe_ftrace_kill (void ) { kprobe_ftrace_disabled = true; }
Greg Kroah-Hartman
maintainerPATCH 249/250 hid: asus: asus_report_fixup: fix potential read out of bounds
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Ballance <[email protected]>
commit 89e1ee118d6f0ee6bd6e80d8fe08839875daa241 upstream.
syzbot reported a potential read out of bounds in asus_report_fixup.
this patch adds checks so that a read out of bounds will not occur
--- drivers/hid/hid-asus.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/hid/hid-asus.c +2 -2
@@ -1235,8 +1235,8 @@ static __u8 *asus_report_fixup(struct hi }/* match many more n-key devices */ -if (drvdata->quirks &QUIRK_ROG_NKEY_KEYBOARD ) { -for (int i =0 ; i < *rsize +1 ; i++) { +if (drvdata->quirks &QUIRK_ROG_NKEY_KEYBOARD && *rsize >15 ) { +for (int i =0 ; i < *rsize -15 ; i++) {/* offset to the count from 0x5a report part always 14 */ if (rdesc[i] ==0x85 && rdesc[i +1 ] ==0x5a && rdesc[i +14 ] ==0x95 && rdesc[i +15 ] ==0x05 ) {
Greg Kroah-Hartman
maintainerPATCH 250/250 Revert "mm: mmap: allow for the maximum number of bits for randomizing mmap_base by default"
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <[email protected]>
commit 14d7c92f8df9c0964ae6f8b813c1b3ac38120825 upstream.
This reverts commit 3afb76a66b5559a7b595155803ce23801558a7a9.
This was a wrongheaded workaround for an issue that had already been fixed much better by commit 4ef9ad19e176 ("mm: huge_memory: don't force huge page alignment on 32 bit").
Asking users questions at kernel compile time that they can't make sense of is not a viable strategy. And the fact that even the kernel VM maintainers apparently didn't catch that this "fix" is not a fix any more pretty much proves the point that people can't be expected to understand the implications of the question.
It may well be the case that we could improve things further, and that __thp_get_unmapped_area() should take the mapping randomization into account even for 64-bit kernels. Maybe we should not be so eager to use THP mappings.
But in no case should this be a kernel config option.
--- arch/Kconfig | 12 ------------ 1 file changed, 12 deletions(-)
arch/Kconfig +0 -12
@@ -1029,21 +1029,10 @@ config ARCH_MMAP_RND_BITS_MAX config ARCH_MMAP_RND_BITS_DEFAULT int -config FORCE_MAX_MMAP_RND_BITS - bool "Force maximum number of bits to use for ASLR of mmap base address" - default y if !64BIT - help - ARCH_MMAP_RND_BITS and ARCH_MMAP_RND_COMPAT_BITS represent the number - of bits to use for ASLR and if no custom value is assigned (EXPERT) - then the architecture's lower bound (minimum) value is assumed. - This toggle changes that default assumption to assume the arch upper - bound (maximum) value instead. - config ARCH_MMAP_RND_BITS int "Number of bits to use for ASLR of mmap base address" if EXPERT range ARCH_MMAP_RND_BITS_MIN ARCH_MMAP_RND_BITS_MAX default ARCH_MMAP_RND_BITS_DEFAULT if ARCH_MMAP_RND_BITS_DEFAULT - default ARCH_MMAP_RND_BITS_MAX if FORCE_MAX_MMAP_RND_BITS default ARCH_MMAP_RND_BITS_MIN depends on HAVE_ARCH_MMAP_RND_BITS help
@@ -1078,7 +1067,6 @@ config ARCH_MMAP_RND_COMPAT_BITS int "Number of bits to use for ASLR of mmap base address for compatible applications" if EXPERT range ARCH_MMAP_RND_COMPAT_BITS_MIN ARCH_MMAP_RND_COMPAT_BITS_MAX default ARCH_MMAP_RND_COMPAT_BITS_DEFAULT if ARCH_MMAP_RND_COMPAT_BITS_DEFAULT - default ARCH_MMAP_RND_COMPAT_BITS_MAX if FORCE_MAX_MMAP_RND_BITS default ARCH_MMAP_RND_COMPAT_BITS_MIN depends on HAVE_ARCH_MMAP_RND_COMPAT_BITS help
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.9.7 release. There are 250 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 27 Jun 2024 08:54:55 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.9.7-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.9.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:
Signature · 1 line
Florian
Am 25.06.2024 um 11:29 schrieb Greg Kroah-Hartman:
Quoted 4 lines
This is the start of the stable review cycle for the 6.9.7 release. There are 250 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Builds, boots and works fine w/o regressions on my 2-socket Ivy Bridge Xeon E5-2697 v2 server. Up and running and compiling 6.1.96-rc1 under it now...
Beste Grüße,
Peter Schneider
Signature · 8 lines
Climb the mountain not to plant your flag, but to embrace the challenge, enjoy the air and behold the view. Climb it so you can see the world, not so the world can see you. -- David McCullough Jr. OpenPGP: 0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244 Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc https://keys.mailvelope.com/pks/lookup?op=get&[email protected] https://keys.mailvelope.com/pks/lookup?op=get&[email protected]
Hello,
Quoted 5 lines · On Tue, 25 Jun 2024 11:29:18 +0200 Greg Kroah-Hartman…
This is the start of the stable review cycle for the 6.9.7 release. There are 250 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 8 lines
Responses should be made by Thu, 27 Jun 2024 08:54:55 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.9.7-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.9.y
and the diffstat can be found below.
This rc kernel passes DAMON functionality test[1] on my test machine. Attaching the test results summary below. Please note that I retrieved the kernel from linux-stable-rc tree[2].
[1] https://github.com/awslabs/damon-tests/tree/next/corr
[2] 681fedcb9fc6 ("Linux 6.9.7-rc1")
Thanks,
SJ
[...]
---
ok 6 selftests: damon: debugfs_duplicate_context_creation.sh
ok 7 selftests: damon: debugfs_rm_non_contexts.sh
ok 8 selftests: damon: debugfs_target_ids_read_before_terminate_race.sh ok 9 selftests: damon: debugfs_target_ids_pid_leak.sh
ok 10 selftests: damon: sysfs.sh
ok 11 selftests: damon: sysfs_update_removed_scheme_dir.sh
ok 12 selftests: damon: sysfs_update_schemes_tried_regions_hang.py ok 13 selftests: damon: sysfs_update_schemes_tried_regions_wss_estimation.py ok 14 selftests: damon: damos_quota.py
ok 15 selftests: damon: damos_apply_interval.py
ok 16 selftests: damon: reclaim.sh
ok 17 selftests: damon: lru_sort.sh
ok 1 selftests: damon-tests: kunit.sh
ok 2 selftests: damon-tests: huge_count_read_write.sh
ok 3 selftests: damon-tests: buffer_overflow.sh
ok 4 selftests: damon-tests: rm_contexts.sh
ok 5 selftests: damon-tests: record_null_deref.sh
ok 6 selftests: damon-tests: dbgfs_target_ids_read_before_terminate_race.sh ok 7 selftests: damon-tests: dbgfs_target_ids_pid_leak.sh
ok 8 selftests: damon-tests: damo_tests.sh
ok 9 selftests: damon-tests: masim-record.sh
ok 10 selftests: damon-tests: build_i386.sh
ok 11 selftests: damon-tests: build_arm64.sh
ok 12 selftests: damon-tests: build_m68k.sh
ok 13 selftests: damon-tests: build_i386_idle_flag.sh
ok 14 selftests: damon-tests: build_i386_highpte.sh
ok 15 selftests: damon-tests: build_nomemcg.sh
[33m
[92mPASS [39m
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.9.7 release. There are 250 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.9.7 release. There are 250 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 27 Jun 2024 08:54:55 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.9.7-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.9.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.9.7 release. There are 250 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 27 Jun 2024 08:54:55 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.9.7-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.9.y
and the diffstat can be found below.thanks,
greg k-h
Tested rc1 against the Fedora build system (aarch64, ppc64le, s390x, x86_64), and boot tested x86_64. No regressions noted.
Quoted 5 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.9.7 release. There are 250 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Successfully compiled and installed the kernel on my computer (Acer Aspire E15, Intel Core i3 Haswell). No noticeable regressions.
Signature · 1 line
An old man doll... just what I always wanted! - Clara
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.9.7 release. There are 250 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 27 Jun 2024 08:54:55 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.9.7-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.9.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v6.9:
10 builds: 10 pass, 0 fail
26 boots: 26 pass, 0 fail
116 tests: 116 pass, 0 failLinux version: 6.9.7-rc1-g681fedcb9fc6
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra194-p3509-0000+p3668-0000,
tegra20-ventana, tegra210-p2371-2180,
tegra210-p3450-0000, tegra30-cardhu-a04Jon
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.9.7 release. There are 250 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 9 lines
This is the start of the stable review cycle for the 6.9.7 release. There are 250 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 27 Jun 2024 08:54:55 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.9.7-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.9.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my x86_64 and ARM64 test systems. No errors or regressions.
Thanks.
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.9.7 release. There are 250 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 27 Jun 2024 08:54:55 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.9.7-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.9.y
and the diffstat can be found below.thanks,
greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.9.7 release. There are 250 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 27 Jun 2024 08:54:55 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.9.7-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.9.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
## Build
* kernel: 6.9.7-rc1
* git: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* git commit: 681fedcb9fc66c0647e2ddc9824e0c0179a8b1b8
* git describe: v6.9.6-251-g681fedcb9fc6
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.9.y/build/v6.9.6-251-g681fedcb9fc6
## Test Regressions (compared to v6.9.5-282-g93f303762da5)
## Metric Regressions (compared to v6.9.5-282-g93f303762da5)
## Test Fixes (compared to v6.9.5-282-g93f303762da5)
## Metric Fixes (compared to v6.9.5-282-g93f303762da5)
## Test result summary
total: 238338, pass: 205834, fail: 4198, skip: 28306, xfail: 0
## Build Summary
* arc: 5 total, 5 passed, 0 failed
* arm: 127 total, 127 passed, 0 failed
* arm64: 37 total, 37 passed, 0 failed
* i386: 27 total, 27 passed, 0 failed
* mips: 24 total, 24 passed, 0 failed
* parisc: 3 total, 3 passed, 0 failed
* powerpc: 34 total, 34 passed, 0 failed
* riscv: 17 total, 17 passed, 0 failed
* s390: 12 total, 12 passed, 0 failed
* sh: 10 total, 10 passed, 0 failed
* sparc: 6 total, 6 passed, 0 failed
* x86_64: 31 total, 31 passed, 0 failed
## Test suites summary
* boot
* kselftest-arm64
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-efivarfs
* kselftest-exec
* kselftest-filesystems
* kselftest-filesystems-binderfs
* kselftest-filesystems-epoll
* kselftest-firmware
* kselftest-fpu
* kselftest-ftrace
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-kcmp
* kselftest-kvm
* kselftest-livepatch
* kselftest-membarrier
* kselftest-memfd
* kselftest-mincore
* kselftest-mqueue
* kselftest-net
* kselftest-net-mptcp
* kselftest-openat2
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-tc-testing
* kselftest-timers
* kselftest-timesync-off
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user_events
* kselftest-vDSO
* kselftest-watchdog
* kselftest-x86
* kunit
* kvm-unit-tests
* libgpiod
* libhugetlbfs
* log-parser-boot
* log-parser-test
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-cpuhotplug
* ltp-crypto
* ltp-cve
* ltp-dio
* ltp-fcntl-locktests
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-hugetlb
* ltp-ipc
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-pty
* ltp-sched
* ltp-smoke
* ltp-smoketest
* ltp-syscalls
* ltp-tracing
* perf
* rcutorture
--
Linaro LKFT
https://lkft.linaro.org
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.9.7 release. There are 250 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 27 Jun 2024 08:54:55 +0000. Anything received after that time might be too late.
No regressions found on WSL (x86 and arm64).
Built, booted, and reviewed dmesg.
Thank you. :)
Hi!
Quoted 4 lines
This is the start of the stable review cycle for the 6.9.7 release. There are 250 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
CIP testing did not find any problems on 6.9.7:
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/tree/linux-6.9.y
6.6, 5.4 pass our testing, too:
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/tree/linux-6.6.y
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/tree/linux-5.4.y
I expect 5.15 will be ok, too.
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/tree/linux-5.15.y
Best regards,
Pavel
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Erika Unter HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany