6.6.50-rc1 review
Greg Kroah-Hartman
maintainercover 6.6.50-rc1 review
This is the start of the stable review cycle for the 6.6.50 release. There are 132 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 07 Sep 2024 09:36:50 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.50-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.6.50-rc1
Manivannan Sadhasivam <[email protected]>
scsi: ufs: qcom: Add UFSHCD_QUIRK_BROKEN_LSDBS_CAP for SM8550 SoC
Richard Fitzgerald <[email protected]>
i2c: Use IS_REACHABLE() for substituting empty ACPI functions
Breno Leitao <[email protected]>
virtio_net: Fix napi_skb_cache_put warning
Ricardo Ribalda <[email protected]>
media: uvcvideo: Enforce alignment of frame and interval
Alex Hung <[email protected]>
drm/amd/display: Skip wbscl_set_scaler_filter if filter is null
Alex Hung <[email protected]>
drm/amd/display: Check BIOS images before it is used
Wenjing Liu <[email protected]>
drm/amd/display: use preferred link settings for dp signal only
Wayne Lin <[email protected]>
drm/amd/display: Correct the defined value for AMDGPU_DMUB_NOTIFICATION_MAX
winstang <[email protected]>
drm/amd/display: added NULL check at start of dc_validate_stream
Nicholas Kazlauskas <[email protected]>
drm/amd/display: Don't use fsleep for PSR exit waits on dmub replay
Yunxiang Li <[email protected]>
drm/amdgpu: add lock in kfd_process_dequeue_from_device
Yunxiang Li <[email protected]>
drm/amdgpu: add lock in amdgpu_gart_invalidate_tlb
Yunxiang Li <[email protected]>
drm/amdgpu: add skip_hw_access checks for sriov
Christoph Hellwig <[email protected]>
block: remove the blk_flush_integrity call in blk_integrity_unregister
Julien Stephan <[email protected]>
driver: iio: add missing checks on iio_info's callback access
Chao Yu <[email protected]>
f2fs: fix to do sanity check on blocks for inline_data inode
Johannes Berg <[email protected]>
wifi: cfg80211: make hash table duplicates more survivable
Yazen Ghannam <[email protected]>
hwmon: (k10temp) Check return value of amd_smn_read()
Olivier Dautricourt <[email protected]>
dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor
Olivier Dautricourt <[email protected]>
dmaengine: altera-msgdma: use irq variant of spin_lock/unlock while invoking callbacks
Marek Vasut <[email protected]>
drm/bridge: tc358767: Check if fully initialized before signalling HPD event via IRQ
Andreas Gruenbacher <[email protected]>
gfs2: Revert "Add quota_change type"
Maxime Méré <[email protected]>
crypto: stm32/cryp - call finalize with bh disabled
Haoran Liu <[email protected]>
drm/meson: plane: Add error handling
Dragos Tatulea <[email protected]>
net/mlx5e: SHAMPO, Fix incorrect page release
Ben Walsh <[email protected]>
platform/chrome: cros_ec_lpc: MEC access can use an AML mutex
Casey Schaufler <[email protected]>
smack: tcp: ipv4, fix incorrect labeling
Andy Shevchenko <[email protected]>
regmap: spi: Fix potential off-by-one when calculating reserved size
Jesse Zhang <[email protected]>
drm/amdgu: fix Unintentional integer overflow for mall size
Jason Xing <[email protected]>
net: remove NULL-pointer net parameter in ip_metrics_convert
Amir Goldstein <[email protected]>
fsnotify: clear PARENT_WATCHED flags lazily
Abhishek Pandit-Subedi <[email protected]>
usb: typec: ucsi: Fix null pointer dereference in trace
Simon Holesch <[email protected]>
usbip: Don't submit special requests twice
Sakari Ailus <[email protected]>
media: v4l2-cci: Always assign *val
Frederic Weisbecker <[email protected]>
rcu/nocb: Remove buggy bypass lock contention mitigation
Ken Sloat <[email protected]>
pwm: xilinx: Fix u32 overflow issue in 32-bit width PWM mode.
Shannon Nelson <[email protected]>
ionic: fix potential irq name truncation
Michael Margolin <[email protected]>
RDMA/efa: Properly handle unexpected AQ completions
Chris Lew <[email protected]>
soc: qcom: smem: Add qcom_smem_bust_hwspin_lock_by_host()
Richard Maina <[email protected]>
hwspinlock: Introduce hwspin_lock_bust()
Johannes Berg <[email protected]>
wifi: mac80211: check ieee80211_bss_info_change_notify() against MLD
Aleksandr Mishin <[email protected]>
PCI: al: Check IORESOURCE_BUS existence during probe
Jagadeesh Kona <[email protected]>
cpufreq: scmi: Avoid overflow of target_freq in fast switch
Shahar S Matityahu <[email protected]>
wifi: iwlwifi: remove fw_running op
Tao Zhou <[email protected]>
drm/amdgpu: update type of buf size to u32 for eeprom functions
Xiaogang Chen <[email protected]>
drm/kfd: Correct pinned buffer handling at kfd restore and validate process
Zong-Zhe Yang <[email protected]>
wifi: rtw89: ser: avoid multiple deinit on same CAM
Jesse Zhang <[email protected]>
drm/amd/pm: check negtive return for table entries
Jesse Zhang <[email protected]>
drm/amdgpu: the warning dereferencing obj for nbio_v7_4
Jesse Zhang <[email protected]>
drm/amd/pm: check specific index for smu13
Jesse Zhang <[email protected]>
drm/amd/pm: check specific index for aldebaran
Jesse Zhang <[email protected]>
drm/amdgpu: fix the waring dereferencing hive
Jesse Zhang <[email protected]>
drm/amdgpu: fix dereference after null check
Jesse Zhang <[email protected]>
drm/amdgpu: Fix the warning division or modulo by zero
Ma Jun <[email protected]>
drm/amdgpu/pm: Check input value for CUSTOM profile mode setting on legacy SOCs
Jeff Johnson <[email protected]>
wifi: ath11k: initialize 'ret' in ath11k_qmi_load_file_target_mem()
Jeff Johnson <[email protected]>
wifi: ath12k: initialize 'ret' in ath12k_qmi_load_file_target_mem()
Leesoo Ahn <[email protected]>
apparmor: fix possible NULL pointer dereference
Michael Chen <[email protected]>
drm/amdkfd: Reconcile the definition and use of oem_id in struct kfd_topology_device
Tim Huang <[email protected]>
drm/amdgpu: fix mc_data out-of-bounds read warning
Tim Huang <[email protected]>
drm/amdgpu: fix ucode out-of-bounds read warning
Ma Jun <[email protected]>
drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number
Lin.Cao <[email protected]>
drm/amdkfd: Check debug trap enable before write dbg_ev_file
Ma Jun <[email protected]>
drm/amdgpu: Fix out-of-bounds write warning
Ma Jun <[email protected]>
drm/amdgpu: Fix the uninitialized variable warning
Ma Jun <[email protected]>
drm/amdgpu/pm: Fix uninitialized variable agc_btc_response
Ma Jun <[email protected]>
drm/amdgpu/pm: Fix uninitialized variable warning for smu10
Tim Huang <[email protected]>
drm/amd/pm: fix uninitialized variable warnings for vangogh_ppt
Asad Kamal <[email protected]>
drm/amd/amdgpu: Check tbo resource pointer
Hersen Wu <[email protected]>
drm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box
Hersen Wu <[email protected]>
drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration
Alex Hung <[email protected]>
drm/amd/display: Ensure index calculation will not overflow
Hersen Wu <[email protected]>
drm/amd/display: Fix Coverity INTEGER_OVERFLOW within decide_fallback_link_setting_max_bw_policy
Alex Hung <[email protected]>
drm/amd/display: Spinlock before reading event
Hersen Wu <[email protected]>
drm/amd/display: Fix Coverity INTEGER_OVERFLOW within dal_gpio_service_create
Hersen Wu <[email protected]>
drm/amd/display: Fix Coverity INTERGER_OVERFLOW within construct_integrated_info
Alex Hung <[email protected]>
drm/amd/display: Check msg_id before processing transcation
Alex Hung <[email protected]>
drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[]
Hersen Wu <[email protected]>
drm/amd/display: Add array index check for hdcp ddc access
Alex Hung <[email protected]>
drm/amd/display: Check index for aux_rd_interval before using
Hersen Wu <[email protected]>
drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6
Alex Hung <[email protected]>
drm/amd/display: Check gpio_id before used as array index
Zhigang Luo <[email protected]>
drm/amdgpu: avoid reading vf2pf info size from FB
Tim Huang <[email protected]>
drm/amd/pm: fix uninitialized variable warnings for vega10_hwmgr
Jesse Zhang <[email protected]>
drm/amd/pm: fix the Out-of-bounds read warning
Jesse Zhang <[email protected]>
drm/amd/pm: Fix negative array index read
Jesse Zhang <[email protected]>
drm/amd/pm: fix warning using uninitialized value of max_vid_step
Tim Huang <[email protected]>
drm/amd/pm: fix uninitialized variable warning for smu8_hwmgr
Jesse Zhang <[email protected]>
drm/amd/pm: fix uninitialized variable warning
Ma Jun <[email protected]>
drm/amdgpu/pm: Check the return value of smum_send_msg_to_smc
Tim Huang <[email protected]>
drm/amdgpu: fix overflowed array index read warning
Alvin Lee <[email protected]>
drm/amd/display: Assign linear_pitch_alignment even for VM
Ma Jun <[email protected]>
drm/amdgpu: Fix uninitialized variable warning in amdgpu_afmt_acr
Matthieu Baerts (NGI0) <[email protected]>
mptcp: pr_debug: add missing \n at the end
Matthieu Baerts (NGI0) <[email protected]>
mptcp: avoid duplicated SUB_CLOSED events
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: stop transfer when check is done (part 2.2)
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: disable get and dump addr checks
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: test for flush/re-add endpoints
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: check re-re-adding ID 0 signal
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: validate event numbers
Geliang Tang <[email protected]>
selftests: mptcp: add mptcp_lib_events helper
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: check re-adding init endp with != id
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: check re-using ID of unused ADD_ADDR
Paolo Abeni <[email protected]>
selftests: mptcp: add explicit test case for remove/readd
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: cannot rm sf if closed
Geliang Tang <[email protected]>
selftests: mptcp: declare event macros in mptcp_lib
Geliang Tang <[email protected]>
selftests: mptcp: userspace pm get addr tests
Geliang Tang <[email protected]>
selftests: mptcp: dump userspace addrs list
Geliang Tang <[email protected]>
selftests: mptcp: userspace pm create id 0 subflow
Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: fix RM_ADDR ID for the initial subflow
Geliang Tang <[email protected]>
mptcp: make pm_remove_addrs_and_subflows static
Zhang Yi <[email protected]>
ASoC: codecs: ES8326: button detect issue
Krzysztof Stępniak <[email protected]>
ASoC: amd: yc: Support mic on Lenovo Thinkpad E14 Gen 6
ZHANG Yuntian <[email protected]>
net: usb: qmi_wwan: add MeiG Smart SRM825L
Rik van Riel <[email protected]>
dma-debug: avoid deadlock between dma debug vs printk and netconsole
Richard Fitzgerald <[email protected]>
i2c: Fix conditional for substituting empty ACPI functions
Devyn Liu <[email protected]>
spi: hisi-kunpeng: Add validation for the minimum value of speed_hz
Bruno Ancona <[email protected]>
ASoC: amd: yc: Support mic on HP 14-em0002la
Paulo Alcantara <[email protected]>
smb: client: fix FSCTL_GET_REPARSE_POINT against NetApp
Yevgeny Kliteynik <[email protected]>
net/mlx5: DR, Fix 'stack guard page was hit' error in dr_rule
Takashi Iwai <[email protected]>
ALSA: seq: ump: Explicitly reset RPN with Null RPN
Takashi Iwai <[email protected]>
ALSA: seq: ump: Transmit RPN/NRPN message at each MSB/LSB data reception
Takashi Iwai <[email protected]>
ALSA: seq: ump: Use the common RPN/bank conversion context
Takashi Iwai <[email protected]>
ALSA: ump: Explicitly reset RPN with Null RPN
Takashi Iwai <[email protected]>
ALSA: ump: Transmit RPN/NRPN message at each MSB/LSB data reception
Takashi Iwai <[email protected]>
ALSA: hda/conexant: Mute speakers at suspend / shutdown
Takashi Iwai <[email protected]>
ALSA: hda/generic: Add a helper to mute speakers at suspend/shutdown
Qu Wenruo <[email protected]>
btrfs: tree-checker: validate dref root and objectid
Peter Wang <[email protected]>
scsi: ufs: core: Bypass quick recovery if force reset is needed
Kyoungrul Kim <[email protected]>
scsi: ufs: core: Check LSDBS cap when !mcq
Philip Mueller <[email protected]>
drm: panel-orientation-quirks: Add quirk for OrangePi Neo
Qiuxu Zhuo <[email protected]>
drm/fb-helper: Don't schedule_work() to flush frame buffer during panic()
-------------
Diffstat:
Documentation/locking/hwspinlock.rst | 11 + Makefile | 4 +- block/blk-integrity.c | 2 - drivers/base/regmap/regmap-spi.c | 3 +- drivers/cpufreq/scmi-cpufreq.c | 4 +- drivers/crypto/stm32/stm32-cryp.c | 6 +- drivers/dma/altera-msgdma.c | 9 +- drivers/gpu/drm/amd/amdgpu/amdgpu_afmt.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 9 +- drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 5 +- drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_eeprom.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_eeprom.h | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 5 +- drivers/gpu/drm/amd/amdgpu/amdgpu_securedisplay.c | 4 + drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 11 +- drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c | 6 + drivers/gpu/drm/amd/amdgpu/df_v1_7.c | 2 + drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_crat.h | 2 - drivers/gpu/drm/amd/amdkfd/kfd_debug.c | 4 +- .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 9 +- drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 3 +- drivers/gpu/drm/amd/amdkfd/kfd_topology.h | 5 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 19 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 2 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | 18 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 7 +- .../drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c | 3 +- drivers/gpu/drm/amd/display/dc/core/dc.c | 1 + drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 3 + drivers/gpu/drm/amd/display/dc/dce/dmub_replay.c | 3 +- .../gpu/drm/amd/display/dc/dcn20/dcn20_dwb_scl.c | 3 + .../gpu/drm/amd/display/dc/dml/calcs/dcn_calcs.c | 7 +- .../gpu/drm/amd/display/dc/dml/dcn302/dcn302_fpu.c | 10 + .../gpu/drm/amd/display/dc/dml/dcn303/dcn303_fpu.c | 10 + .../gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 10 + .../gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c | 10 + .../gpu/drm/amd/display/dc/dml/display_mode_vba.c | 7 +- drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c | 17 +- drivers/gpu/drm/amd/display/dc/hdcp/hdcp_msg.c | 17 +- .../display/dc/link/protocols/link_dp_capability.c | 26 +- .../display/dc/link/protocols/link_dp_training.c | 4 +- .../gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c | 28 +- drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c | 2 +- drivers/gpu/drm/amd/pm/powerplay/hwmgr/pp_psm.c | 13 +- .../gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c | 5 +- .../gpu/drm/amd/pm/powerplay/hwmgr/smu10_hwmgr.c | 29 +- .../gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 2 +- .../gpu/drm/amd/pm/powerplay/hwmgr/smu8_hwmgr.c | 15 +- .../gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | 60 +++- .../gpu/drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c | 20 +- .../gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c | 31 ++- .../drm/amd/pm/powerplay/smumgr/vega10_smumgr.c | 6 +- drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c | 27 +- drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c | 14 + drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c | 3 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c | 2 + drivers/gpu/drm/bridge/tc358767.c | 2 +- drivers/gpu/drm/drm_fb_helper.c | 11 + drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 + drivers/gpu/drm/meson/meson_plane.c | 17 +- drivers/hwmon/k10temp.c | 36 ++- drivers/hwspinlock/hwspinlock_core.c | 28 ++ drivers/hwspinlock/hwspinlock_internal.h | 3 + drivers/iio/industrialio-core.c | 7 +- drivers/iio/industrialio-event.c | 9 + drivers/iio/inkern.c | 32 ++- drivers/infiniband/hw/efa/efa_com.c | 30 +- drivers/media/usb/uvc/uvc_driver.c | 18 +- drivers/media/v4l2-core/v4l2-cci.c | 9 + drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 3 +- .../ethernet/mellanox/mlx5/core/steering/dr_rule.c | 2 +- drivers/net/ethernet/pensando/ionic/ionic_lif.c | 2 +- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/virtio_net.c | 8 +- drivers/net/wireless/ath/ath11k/qmi.c | 2 +- drivers/net/wireless/ath/ath12k/qmi.c | 2 +- drivers/net/wireless/intel/iwlwifi/fw/debugfs.c | 3 +- drivers/net/wireless/intel/iwlwifi/fw/runtime.h | 1 - drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 6 - drivers/net/wireless/realtek/rtw89/ser.c | 8 +- drivers/pci/controller/dwc/pcie-al.c | 16 +- drivers/platform/chrome/cros_ec_lpc_mec.c | 76 +++++- drivers/platform/chrome/cros_ec_lpc_mec.h | 11 + drivers/soc/qcom/smem.c | 26 ++ drivers/spi/spi-hisi-kunpeng.c | 1 + drivers/ufs/core/ufshcd.c | 19 +- drivers/ufs/host/ufs-qcom.c | 6 +- drivers/usb/typec/ucsi/ucsi.h | 2 +- drivers/usb/usbip/stub_rx.c | 77 ++++-- fs/btrfs/tree-checker.c | 47 ++++ fs/f2fs/f2fs.h | 2 +- fs/f2fs/inline.c | 20 +- fs/f2fs/inode.c | 2 +- fs/gfs2/quota.c | 19 +- fs/gfs2/util.c | 6 +- fs/notify/fsnotify.c | 31 ++- fs/notify/fsnotify.h | 2 +- fs/notify/mark.c | 32 ++- fs/smb/client/smb2inode.c | 6 +- include/clocksource/timer-xilinx.h | 2 +- include/linux/fsnotify_backend.h | 8 +- include/linux/hwspinlock.h | 6 + include/linux/i2c.h | 2 +- include/linux/soc/qcom/smem.h | 2 + include/net/ip.h | 3 +- include/net/tcp.h | 2 +- include/sound/ump_convert.h | 1 + include/ufs/ufshcd.h | 1 + include/ufs/ufshci.h | 1 + kernel/dma/debug.c | 5 +- kernel/rcu/tree.h | 1 - kernel/rcu/tree_nocb.h | 32 +-- net/ipv4/fib_semantics.c | 5 +- net/ipv4/metrics.c | 8 +- net/ipv4/tcp_cong.c | 11 +- net/ipv6/route.c | 2 +- net/mac80211/main.c | 3 +- net/mptcp/fastopen.c | 4 +- net/mptcp/options.c | 50 ++-- net/mptcp/pm.c | 28 +- net/mptcp/pm_netlink.c | 52 ++-- net/mptcp/protocol.c | 58 ++-- net/mptcp/protocol.h | 9 +- net/mptcp/sched.c | 4 +- net/mptcp/sockopt.c | 4 +- net/mptcp/subflow.c | 48 ++-- net/wireless/scan.c | 46 +++- security/apparmor/apparmorfs.c | 4 + security/smack/smack_lsm.c | 2 +- sound/core/seq/seq_ports.h | 14 +- sound/core/seq/seq_ump_convert.c | 97 ++++--- sound/core/ump_convert.c | 60 ++-- sound/pci/hda/hda_generic.c | 63 +++++ sound/pci/hda/hda_generic.h | 1 + sound/pci/hda/patch_conexant.c | 2 + sound/soc/amd/yc/acp6x-mach.c | 14 + sound/soc/codecs/es8326.c | 2 + tools/testing/selftests/net/mptcp/mptcp_join.sh | 304 +++++++++++++++++++-- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 38 +++ tools/testing/selftests/net/mptcp/userspace_pm.sh | 30 +- 146 files changed, 1669 insertions(+), 574 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/132 drm/fb-helper: Dont schedule_work() to flush frame buffer during panic()
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiuxu Zhuo <[email protected]>
[ Upstream commit 833cd3e9ad8360785b6c23c82dd3856df00732d9 ]
Sometimes the system [1] hangs on x86 I/O machine checks. However, the expected behavior is to reboot the system, as the machine check handler ultimately triggers a panic(), initiating a reboot in the last step.
The root cause is that sometimes the panic() is blocked when drm_fb_helper_damage() invoking schedule_work() to flush the frame buffer. This occurs during the process of flushing all messages to the frame buffer driver as shown in the following call trace:
Machine check occurs [2]:
panic()
console_flush_on_panic()
console_flush_all()
console_emit_next_record()
con->write()
vt_console_print()
hide_cursor()
vc->vc_sw->con_cursor()
fbcon_cursor()
ops->cursor()
bit_cursor()
soft_cursor()
info->fbops->fb_imageblit()
drm_fbdev_generic_defio_imageblit()
drm_fb_helper_damage_area()
drm_fb_helper_damage()
schedule_work() // <--- blocked here
...
emergency_restart() // wasn't invoked, so no reboot.During panic(), except the panic CPU, all the other CPUs are stopped. In schedule_work(), the panic CPU requires the lock of worker_pool to queue the work on that pool, while the lock may have been token by some other stopped CPU. So schedule_work() is blocked.
Additionally, during a panic(), since there is no opportunity to execute any scheduled work, it's safe to fix this issue by skipping schedule_work() on 'oops_in_progress' in drm_fb_helper_damage().
[1] Enable the kernel option CONFIG_FRAMEBUFFER_CONSOLE, CONFIG_DRM_FBDEV_EMULATION, and boot with the 'console=tty0' kernel command line parameter.
[2] Set 'panic_timeout' to a non-zero value before calling panic().
--- drivers/gpu/drm/drm_fb_helper.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/gpu/drm/drm_fb_helper.c +11 -0
@@ -631,6 +631,17 @@ static void drm_fb_helper_add_damage_clip(struct drm_fb_helper *helper, u32 x, ustatic void drm_fb_helper_damage (struct drm_fb_helper *helper,u32 x,u32 y,u32 width,u32 height) { +/* +* This function may be invoked by panic() to flush the frame +* buffer, where all CPUs except the panic CPU are stopped. +* During the following schedule_work(), the panic CPU needs +* the worker_pool lock, which might be held by a stopped CPU, +* causing schedule_work() and panic() to block. Return early on +* oops_in_progress to prevent this blocking. +*/ +if (oops_in_progress) +return ; +drm_fb_helper_add_damage_clip (helper, x, y, width, height);schedule_work (&helper->damage_work);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 2/132 drm: panel-orientation-quirks: Add quirk for OrangePi Neo
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philip Mueller <[email protected]>
[ Upstream commit d60c429610a14560085d98fa6f4cdb43040ca8f0 ]
This adds a DMI orientation quirk for the OrangePi Neo Linux Gaming Handheld.
--- drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/gpu/drm/drm_panel_orientation_quirks.c +6 -0
@@ -414,6 +414,12 @@ static const struct dmi_system_id orientation_data[] = { DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "ONE XPLAYER"), }, .driver_data = (void *)&lcd1600x2560_leftside_up, + }, { /* OrangePi Neo */ + .matches = { +DMI_EXACT_MATCH (DMI_SYS_VENDOR ,"OrangePi" ), + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "NEO-01"), + }, + .driver_data = (void *)&lcd1200x1920_rightside_up, }, { /* Samsung GalaxyBook 10.6 */ .matches = { DMI_EXACT_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 3/132 scsi: ufs: core: Check LSDBS cap when !mcq
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kyoungrul Kim <[email protected]>
[ Upstream commit 0c60eb0cc320fffbb8b10329d276af14f6f5e6bf ]
If the user sets use_mcq_mode to 0, the host will try to activate the LSDB mode unconditionally even when the LSDBS of device HCI cap is 1. This makes commands time out and causes device probing to fail.
To prevent that problem, check the LSDBS cap when MCQ is not supported.
--- drivers/ufs/core/ufshcd.c | 16 ++++++++++++++++ include/ufs/ufshcd.h | 1 + include/ufs/ufshci.h | 1 + 3 files changed, 18 insertions(+)
drivers/ufs/core/ufshcd.c +16 -0
@@ -2281,7 +2281,17 @@ static inline int ufshcd_hba_capabilities(struct ufs_hba *hba)return err; } +/* +* The UFSHCI 3.0 specification does not define MCQ_SUPPORT and +* LSDB_SUPPORT, but [31:29] as reserved bits with reset value 0s, which +* means we can simply read values regardless of version. +*/ hba->mcq_sup =FIELD_GET (MASK_MCQ_SUPPORT , hba->capabilities); +/* +* 0h: legacy single doorbell support is available +* 1h: indicate that legacy single doorbell support has been removed +*/ + hba->lsdb_sup = !FIELD_GET (MASK_LSDB_SUPPORT , hba->capabilities);if (!hba->mcq_sup)return 0 ;
@@ -10386,6 +10396,12 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq) }if (!is_mcq_supported (hba)) { +if (!hba->lsdb_sup) { +dev_err (hba->dev,"%s: failed to initialize (legacy doorbell mode not supported)\n" , + __func__); + err = -EINVAL ; + goto out_disable; + } err =scsi_add_host (host, hba->dev);if (err) {dev_err (hba->dev,"scsi_add_host failed\n" );
include/ufs/ufshcd.h +1 -0
@@ -1064,6 +1064,7 @@ struct ufs_hba {bool ext_iid_sup;bool scsi_host_added;bool mcq_sup; +bool lsdb_sup;bool mcq_enabled;struct ufshcd_res_info res[RES_MAX ];void __iomem *mcq_base;
include/ufs/ufshci.h +1 -0
@@ -75,6 +75,7 @@ enum {MASK_OUT_OF_ORDER_DATA_DELIVERY_SUPPORT =0x02000000 ,MASK_UIC_DME_TEST_MODE_SUPPORT =0x04000000 ,MASK_CRYPTO_SUPPORT =0x10000000 , +MASK_LSDB_SUPPORT =0x20000000 , MASK_MCQ_SUPPORT = 0x40000000, };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 4/132 scsi: ufs: core: Bypass quick recovery if force reset is needed
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Wang <[email protected]>
[ Upstream commit 022587d8aec3da1d1698ddae9fb8cfe35f3ad49c ]
If force_reset is true, bypass quick recovery. This will shorten error recovery time.
--- drivers/ufs/core/ufshcd.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/ufs/core/ufshcd.c +2 -1
@@ -6467,7 +6467,8 @@ static void ufshcd_err_handler(struct work_struct *work)if (ufshcd_err_handling_should_stop (hba)) goto skip_err_handling; -if (hba->dev_quirks &UFS_DEVICE_QUIRK_RECOVERY_FROM_DL_NAC_ERRORS ) { +if ((hba->dev_quirks &UFS_DEVICE_QUIRK_RECOVERY_FROM_DL_NAC_ERRORS ) && + !hba->force_reset) {bool ret;spin_unlock_irqrestore (hba->host->host_lock, flags);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 5/132 btrfs: tree-checker: validate dref root and objectid
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qu Wenruo <[email protected]>
[ Upstream commit f333a3c7e8323499aa65038e77fe8f3199d4e283 ]
[CORRUPTION]
There is a bug report that btrfs flips RO due to a corruption in the extent tree, the involved dumps looks like this:
item 188 key (402811572224 168 4096) itemoff 14598 itemsize 79
extent refs 3 gen 3678544 flags 1
ref#0: extent data backref root 13835058055282163977 objectid 281473384125923 offset 81432576 count 1 ref#1: shared data backref parent 1947073626112 count 1
ref#2: shared data backref parent 1156030103552 count 1
BTRFS critical (device vdc1: state EA): unable to find ref byte nr 402811572224 parent 0 root 265 owner 28703026 offset 81432576 slot 189 BTRFS error (device vdc1: state EA): failed to run delayed ref for logical 402811572224 num_bytes 4096 type 178 action 2 ref_mod 1: -2
[CAUSE]
The corrupted entry is ref#0 of item 188.
The root number 13835058055282163977 is beyond the upper limit for root items (the current limit is 1 << 48), and the objectid also looks suspicious.
Only the offset and count is correct.
[ENHANCEMENT]
Although it's still unknown why we have such many bytes corrupted randomly, we can still enhance the tree-checker for data backrefs by:
- Validate the root value
For now there should only be 3 types of roots can have data backref:
* subvolume trees
* data reloc trees
* root tree
Only for v1 space cache
- validate the objectid value
The objectid should be a valid inode number.
Hopefully we can catch such problem in the future with the new checkers.
--- fs/btrfs/tree-checker.c | 47 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 47 insertions(+)
fs/btrfs/tree-checker.c +47 -0
@@ -1266,6 +1266,19 @@ static void extent_err(const struct extent_buffer *eb, int slot,va_end (args); } +static bool is_valid_dref_root (u64 rootid) +{ +/* +* The following tree root objectids are allowed to have a data backref: +* - subvolume trees +* - data reloc tree +* - tree root +* For v1 space cache +*/ +return is_fstree (rootid) || rootid ==BTRFS_DATA_RELOC_TREE_OBJECTID || + rootid ==BTRFS_ROOT_TREE_OBJECTID ; +} +static int check_extent_item (struct extent_buffer *leaf,struct btrfs_key *key,int slot,struct btrfs_key *prev_key)
@@ -1418,6 +1431,8 @@ static int check_extent_item(struct extent_buffer *leaf,struct btrfs_extent_data_ref *dref;struct btrfs_shared_data_ref *sref;u64 seq; +u64 dref_root; +u64 dref_objectid;u64 dref_offset;u64 inline_offset;u8 inline_type;
@@ -1461,11 +1476,26 @@ static int check_extent_item(struct extent_buffer *leaf,*/ case BTRFS_EXTENT_DATA_REF_KEY : dref = (struct btrfs_extent_data_ref *)(&iref->offset); + dref_root =btrfs_extent_data_ref_root (leaf, dref); + dref_objectid =btrfs_extent_data_ref_objectid (leaf, dref); dref_offset =btrfs_extent_data_ref_offset (leaf, dref); seq =hash_extent_data_ref (btrfs_extent_data_ref_root (leaf, dref),btrfs_extent_data_ref_objectid (leaf, dref),btrfs_extent_data_ref_offset (leaf, dref)); +if (unlikely (!is_valid_dref_root (dref_root))) { +extent_err (leaf, slot, +"invalid data ref root value %llu" , + dref_root); +return -EUCLEAN ; + } +if (unlikely (dref_objectid <BTRFS_FIRST_FREE_OBJECTID || + dref_objectid >BTRFS_LAST_FREE_OBJECTID )) { +extent_err (leaf, slot, +"invalid data ref objectid value %llu" , + dref_root); +return -EUCLEAN ; + }if (unlikely (!IS_ALIGNED (dref_offset, fs_info->sectorsize))) { extent_err(leaf, slot,
@@ -1601,6 +1631,8 @@ static int check_extent_data_ref(struct extent_buffer *leaf,return -EUCLEAN ; }for (; ptr < end; ptr +=sizeof (*dref)) { +u64 root; +u64 objectid;u64 offset;/*
@@ -1608,7 +1640,22 @@ static int check_extent_data_ref(struct extent_buffer *leaf,* overflow from the leaf due to hash collisions. */ dref = (struct btrfs_extent_data_ref *)ptr; + root =btrfs_extent_data_ref_root (leaf, dref); + objectid =btrfs_extent_data_ref_objectid (leaf, dref); offset =btrfs_extent_data_ref_offset (leaf, dref); +if (unlikely (!is_valid_dref_root (root))) { +extent_err (leaf, slot, +"invalid extent data backref root value %llu" , + root); +return -EUCLEAN ; + } +if (unlikely (objectid <BTRFS_FIRST_FREE_OBJECTID || + objectid >BTRFS_LAST_FREE_OBJECTID )) { +extent_err (leaf, slot, +"invalid extent data backref objectid value %llu" , + root); +return -EUCLEAN ; + }if (unlikely (!IS_ALIGNED (offset, leaf->fs_info->sectorsize))) { extent_err(leaf, slot, "invalid extent data backref offset, have %llu expect aligned to %u",
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 6/132 ALSA: hda/generic: Add a helper to mute speakers at suspend/shutdown
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 6cd23b26b348fa52c88e1adf9c0e48d68e13f95e ]
Some devices indicate click noises at suspend or shutdown when the speakers are unmuted. This patch adds a helper, snd_hda_gen_shutup_speakers(), to work around it. The new function is supposed to be called at suspend or shutdown by the codec driver, and it mutes the speakers.
The mute status isn't cached, hence the original mute state will be restored at resume again.
--- sound/pci/hda/hda_generic.c | 63 +++++++++++++++++++++++++++++++++++++ sound/pci/hda/hda_generic.h | 1 + 2 files changed, 64 insertions(+)
sound/pci/hda/hda_generic.c +63 -0
@@ -4956,6 +4956,69 @@ void snd_hda_gen_stream_pm(struct hda_codec *codec, hda_nid_t nid, bool on) }EXPORT_SYMBOL_GPL (snd_hda_gen_stream_pm); +/* forcibly mute the speaker output without caching; return true if updated */ +static bool force_mute_output_path (struct hda_codec *codec,hda_nid_t nid) +{ +if (!nid) +return false; +if (!nid_has_mute (codec, nid,HDA_OUTPUT )) +return false;/* no mute, skip */ +if (snd_hda_codec_amp_read (codec, nid,0 ,HDA_OUTPUT ,0 ) & +snd_hda_codec_amp_read (codec, nid,1 ,HDA_OUTPUT ,0 ) & +HDA_AMP_MUTE ) +return false;/* both channels already muted, skip */ + +/* direct amp update without caching */ +snd_hda_codec_write (codec, nid,0 ,AC_VERB_SET_AMP_GAIN_MUTE , +AC_AMP_SET_OUTPUT |AC_AMP_SET_LEFT | +AC_AMP_SET_RIGHT |HDA_AMP_MUTE ); +return true; +} + +/** +* snd_hda_gen_shutup_speakers - Forcibly mute the speaker outputs +* @codec: the HDA codec +* +* Forcibly mute the speaker outputs, to be called at suspend or shutdown. +* +* The mute state done by this function isn't cached, hence the original state +* will be restored at resume. +* +* Return true if the mute state has been changed. +*/ +bool snd_hda_gen_shutup_speakers (struct hda_codec *codec) +{ +struct hda_gen_spec *spec = codec->spec; +const int *paths; +const struct nid_path *path; +int i, p, num_paths; +bool updated = false; + +/* if already powered off, do nothing */ +if (!snd_hdac_is_power_on (&codec->core)) +return false; + +if (spec->autocfg.line_out_type ==AUTO_PIN_SPEAKER_OUT ) { + paths = spec->out_paths; + num_paths = spec->autocfg.line_outs; + }else { + paths = spec->speaker_paths; + num_paths = spec->autocfg.speaker_outs; + } + +for (i =0 ; i < num_paths; i++) { + path =snd_hda_get_path_from_idx (codec, paths[i]); +if (!path) +continue ; +for (p =0 ; p < path->depth; p++) +if (force_mute_output_path (codec, path->path[p])) + updated = true; + } + +return updated; +} +EXPORT_SYMBOL_GPL (snd_hda_gen_shutup_speakers); +/** * snd_hda_gen_parse_auto_config - Parse the given BIOS configuration and * set up the hda_gen_spec
sound/pci/hda/hda_generic.h +1 -0
@@ -355,5 +355,6 @@ int snd_hda_gen_add_mute_led_cdev(struct hda_codec *codec,int snd_hda_gen_add_micmute_led_cdev (struct hda_codec *codec,int (*callback)(struct led_classdev *,enum led_brightness )); +bool snd_hda_gen_shutup_speakers (struct hda_codec *codec);#endif /* __SOUND_HDA_GENERIC_H */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 7/132 ALSA: hda/conexant: Mute speakers at suspend / shutdown
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 4f61c8fe35202702426cfc0003e15116a01ba885 ]
Use the new helper to mute speakers at suspend / shutdown for avoiding click noises.
--- sound/pci/hda/patch_conexant.c | 2 ++ 1 file changed, 2 insertions(+)
sound/pci/hda/patch_conexant.c +2 -0
@@ -205,6 +205,8 @@ static void cx_auto_shutdown(struct hda_codec *codec) {struct conexant_spec *spec = codec->spec; +snd_hda_gen_shutup_speakers (codec); +/* Turn the problematic codec into D3 to avoid spurious noises from the internal speaker during (and after) reboot */ cx_auto_turn_eapd (codec, spec->num_eapds, spec->eapds, false);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 8/132 ALSA: ump: Transmit RPN/NRPN message at each MSB/LSB data reception
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit e6ce8a28c768dbbad3f818db286cd0f4c7a921a8 ]
The UMP 1.1 spec says that an RPN/NRPN should be sent when one of the following occurs:
* a CC 38 is received
* a subsequent CC 6 is received
* a CC 98, 99, 100, and 101 is received, indicating the last RPN/NRPN message has ended and a new one has started
That said, we should send a partial data even if it's not fully filled. Let's change the UMP conversion helper code to follow that rule.
--- include/sound/ump_convert.h | 1 + sound/core/ump_convert.c | 49 ++++++++++++++++++++++++------------- 2 files changed, 33 insertions(+), 17 deletions(-)
include/sound/ump_convert.h +1 -0
@@ -13,6 +13,7 @@ struct ump_cvt_to_ump_bank {unsigned char cc_nrpn_msb, cc_nrpn_lsb;unsigned char cc_data_msb, cc_data_lsb;unsigned char cc_bank_msb, cc_bank_lsb; +bool cc_data_msb_set, cc_data_lsb_set; };/* context for converting from MIDI1 byte stream to UMP packet */
sound/core/ump_convert.c +32 -17
99 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 9/132 ALSA: ump: Explicitly reset RPN with Null RPN
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 50a6dd19dca9446475f023eaa652016bfe5b1cbe ]
RPN with 127:127 is treated as a Null RPN, just to reset the parameters, and it's not translated to MIDI2. Although the current code can work as is in most cases, better to implement the RPN reset explicitly for Null message.
--- sound/core/ump_convert.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-)
sound/core/ump_convert.c +14 -5
@@ -287,6 +287,15 @@ static int cvt_legacy_system_to_ump(struct ump_cvt_to_ump *cvt,return 4 ; } +static void reset_rpn (struct ump_cvt_to_ump_bank *cc) +{ + cc->rpn_set =0 ; + cc->nrpn_set =0 ; + cc->cc_rpn_msb = cc->cc_rpn_lsb =0 ; + cc->cc_data_msb = cc->cc_data_lsb =0 ; + cc->cc_data_msb_set = cc->cc_data_lsb_set =0 ; +} +static int fill_rpn (struct ump_cvt_to_ump_bank *cc,union snd_ump_midi2_msg *midi2,bool flush)
@@ -312,11 +321,7 @@ static int fill_rpn(struct ump_cvt_to_ump_bank *cc, midi2->rpn.data =upscale_14_to_32bit ((cc->cc_data_msb <<7 ) | cc->cc_data_lsb); - cc->rpn_set =0 ; - cc->nrpn_set =0 ; - cc->cc_rpn_msb = cc->cc_rpn_lsb =0 ; - cc->cc_data_msb = cc->cc_data_lsb =0 ; - cc->cc_data_msb_set = cc->cc_data_lsb_set =0 ; +reset_rpn (cc);return 1 ; }
@@ -374,11 +379,15 @@ static int cvt_legacy_cmd_to_ump(struct ump_cvt_to_ump *cvt, ret =fill_rpn (cc, midi2, true); cc->rpn_set =1 ; cc->cc_rpn_msb = buf[2 ]; +if (cc->cc_rpn_msb ==0x7f && cc->cc_rpn_lsb ==0x7f ) +reset_rpn (cc);return ret;case UMP_CC_RPN_LSB : ret =fill_rpn (cc, midi2, true); cc->rpn_set =1 ; cc->cc_rpn_lsb = buf[2 ]; +if (cc->cc_rpn_msb ==0x7f && cc->cc_rpn_lsb ==0x7f ) +reset_rpn (cc);return ret;case UMP_CC_NRPN_MSB : ret =fill_rpn (cc, midi2, true);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 10/132 ALSA: seq: ump: Use the common RPN/bank conversion context
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit a683030606fa5ff8b722a5e28839d19288011ede ]
The UMP core conversion helper API already defines the context needed to record the bank and RPN/NRPN values, and we can simply re-use the same struct instead of re-defining the same content as a different name.
--- sound/core/seq/seq_ports.h | 14 ++------------ sound/core/seq/seq_ump_convert.c | 10 +++++----- 2 files changed, 7 insertions(+), 17 deletions(-)
sound/core/seq/seq_ports.h +2 -12
@@ -7,6 +7,7 @@#define __SND_SEQ_PORTS_H#include <sound/seq_kernel.h> +#include <sound/ump_convert.h> #include "seq_lock.h" /* list of 'exported' ports */
@@ -42,17 +43,6 @@ struct snd_seq_port_subs_info {int (*close)(void *private_data,struct snd_seq_port_subscribe *info); }; -/* context for converting from legacy control event to UMP packet */ -struct snd_seq_ump_midi2_bank { -bool rpn_set; -bool nrpn_set; -bool bank_set; -unsigned char cc_rpn_msb, cc_rpn_lsb; -unsigned char cc_nrpn_msb, cc_nrpn_lsb; -unsigned char cc_data_msb, cc_data_lsb; -unsigned char cc_bank_msb, cc_bank_lsb; -}; -struct snd_seq_client_port {struct snd_seq_addr addr;/* client/port number */
@@ -88,7 +78,7 @@ struct snd_seq_client_port {unsigned char ump_group;#if IS_ENABLED (CONFIG_SND_SEQ_UMP ) -struct snd_seq_ump_midi2_bank midi2_bank[16 ];/* per channel */ +struct ump_cvt_to_ump_bank midi2_bank[16 ];/* per channel */ #endif };
sound/core/seq/seq_ump_convert.c +5 -5
@@ -368,7 +368,7 @@ static int cvt_ump_midi1_to_midi2(struct snd_seq_client *dest,struct snd_seq_ump_event ev_cvt;const union snd_ump_midi1_msg *midi1 = (const union snd_ump_midi1_msg *)event->ump;union snd_ump_midi2_msg *midi2 = (union snd_ump_midi2_msg *)ev_cvt.ump; -struct snd_seq_ump_midi2_bank *cc; +struct ump_cvt_to_ump_bank *cc; ev_cvt = *event;memset (&ev_cvt.ump,0 ,sizeof (ev_cvt.ump));
@@ -790,7 +790,7 @@ static int paf_ev_to_ump_midi2(const struct snd_seq_event *event, }/* set up the MIDI2 RPN/NRPN packet data from the parsed info */ -static void fill_rpn (struct snd_seq_ump_midi2_bank *cc, +static void fill_rpn (struct ump_cvt_to_ump_bank *cc,union snd_ump_midi2_msg *data,unsigned char channel) {
@@ -822,7 +822,7 @@ static int cc_ev_to_ump_midi2(const struct snd_seq_event *event,unsigned char channel = event->data.control.channel &0x0f ;unsigned char index = event->data.control.param &0x7f ;unsigned char val = event->data.control.value &0x7f ; -struct snd_seq_ump_midi2_bank *cc = &dest_port->midi2_bank[channel]; +struct ump_cvt_to_ump_bank *cc = &dest_port->midi2_bank[channel];/* process special CC's (bank/rpn/nrpn) */ switch (index) {
@@ -887,7 +887,7 @@ static int pgm_ev_to_ump_midi2(const struct snd_seq_event *event, unsigned char status) {unsigned char channel = event->data.control.channel &0x0f ; -struct snd_seq_ump_midi2_bank *cc = &dest_port->midi2_bank[channel]; +struct ump_cvt_to_ump_bank *cc = &dest_port->midi2_bank[channel]; data->pg.status = status; data->pg.channel = channel;
@@ -924,7 +924,7 @@ static int ctrl14_ev_to_ump_midi2(const struct snd_seq_event *event, {unsigned char channel = event->data.control.channel &0x0f ;unsigned char index = event->data.control.param &0x7f ; -struct snd_seq_ump_midi2_bank *cc = &dest_port->midi2_bank[channel]; +struct ump_cvt_to_ump_bank *cc = &dest_port->midi2_bank[channel];unsigned char msb, lsb; msb = (event->data.control.value >>7 ) &0x7f ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 11/132 ALSA: seq: ump: Transmit RPN/NRPN message at each MSB/LSB data reception
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit a4ff92ff0bdd731eca9f0b50b1cbb5aba89be4b2 ]
Just like the core UMP conversion helper, we need to deal with the partially-filled RPN/NRPN data in the sequencer UMP converter as well.
--- sound/core/seq/seq_ump_convert.c | 74 +++++++++++++++++++------------- 1 file changed, 44 insertions(+), 30 deletions(-)
sound/core/seq/seq_ump_convert.c +44 -30
@@ -790,27 +790,39 @@ static int paf_ev_to_ump_midi2(const struct snd_seq_event *event, }/* set up the MIDI2 RPN/NRPN packet data from the parsed info */ -static void fill_rpn (struct ump_cvt_to_ump_bank *cc, -union snd_ump_midi2_msg *data, -unsigned char channel) +static int fill_rpn (struct ump_cvt_to_ump_bank *cc, +union snd_ump_midi2_msg *data, +unsigned char channel, +bool flush) { +if (!(cc->cc_data_lsb_set || cc->cc_data_msb_set)) +return 0 ;// skip +/* when not flushing, wait for complete data set */ +if (!flush && (!cc->cc_data_lsb_set || !cc->cc_data_msb_set)) +return 0 ;// skip +if (cc->rpn_set) { data->rpn.status =UMP_MSG_STATUS_RPN ; data->rpn.bank = cc->cc_rpn_msb; data->rpn.index = cc->cc_rpn_lsb; - cc->rpn_set =0 ; - cc->cc_rpn_msb = cc->cc_rpn_lsb =0 ; - }else { + }else if (cc->nrpn_set) { data->rpn.status =UMP_MSG_STATUS_NRPN ; data->rpn.bank = cc->cc_nrpn_msb; data->rpn.index = cc->cc_nrpn_lsb; - cc->nrpn_set =0 ; - cc->cc_nrpn_msb = cc->cc_nrpn_lsb =0 ; + }else { +return 0 ;// skip } + data->rpn.data =upscale_14_to_32bit ((cc->cc_data_msb <<7 ) | cc->cc_data_lsb); data->rpn.channel = channel; + + cc->rpn_set =0 ; + cc->nrpn_set =0 ; + cc->cc_rpn_msb = cc->cc_rpn_lsb =0 ; cc->cc_data_msb = cc->cc_data_lsb =0 ; + cc->cc_data_msb_set = cc->cc_data_lsb_set =0 ; +return 1 ; }/* convert CC event to MIDI 2.0 UMP */
@@ -823,28 +835,34 @@ static int cc_ev_to_ump_midi2(const struct snd_seq_event *event,unsigned char index = event->data.control.param &0x7f ;unsigned char val = event->data.control.value &0x7f ;struct ump_cvt_to_ump_bank *cc = &dest_port->midi2_bank[channel]; +int ret;/* process special CC's (bank/rpn/nrpn) */ switch (index) {case UMP_CC_RPN_MSB : + ret =fill_rpn (cc, data, channel, true); cc->rpn_set =1 ; cc->cc_rpn_msb = val; -return 0 ;// skip +return ret;case UMP_CC_RPN_LSB : + ret =fill_rpn (cc, data, channel, true); cc->rpn_set =1 ; cc->cc_rpn_lsb = val; -return 0 ;// skip +return ret;case UMP_CC_NRPN_MSB : + ret =fill_rpn (cc, data, channel, true); cc->nrpn_set =1 ; cc->cc_nrpn_msb = val; -return 0 ;// skip +return ret;case UMP_CC_NRPN_LSB : + ret =fill_rpn (cc, data, channel, true); cc->nrpn_set =1 ; cc->cc_nrpn_lsb = val; -return 0 ;// skip +return ret;case UMP_CC_DATA : + cc->cc_data_msb_set =1 ; cc->cc_data_msb = val; -return 0 ;// skip +return fill_rpn (cc, data, channel, false);case UMP_CC_BANK_SELECT : cc->bank_set =1 ; cc->cc_bank_msb = val;
@@ -854,11 +872,9 @@ static int cc_ev_to_ump_midi2(const struct snd_seq_event *event, cc->cc_bank_lsb = val;return 0 ;// skip case UMP_CC_DATA_LSB : + cc->cc_data_lsb_set =1 ; cc->cc_data_lsb = val; -if (!(cc->rpn_set || cc->nrpn_set)) -return 0 ;// skip -fill_rpn (cc, data, channel); -return 1 ; +return fill_rpn (cc, data, channel, false); } data->cc.status = status;
@@ -926,6 +942,7 @@ static int ctrl14_ev_to_ump_midi2(const struct snd_seq_event *event,unsigned char index = event->data.control.param &0x7f ;struct ump_cvt_to_ump_bank *cc = &dest_port->midi2_bank[channel];unsigned char msb, lsb; +int ret; msb = (event->data.control.value >>7 ) &0x7f ; lsb = event->data.control.value &0x7f ;
@@ -939,28 +956,25 @@ static int ctrl14_ev_to_ump_midi2(const struct snd_seq_event *event, cc->cc_bank_lsb = lsb;return 0 ;// skip case UMP_CC_RPN_MSB : - cc->cc_rpn_msb = msb; - fallthrough;case UMP_CC_RPN_LSB : - cc->rpn_set =1 ; + ret =fill_rpn (cc, data, channel, true); + cc->cc_rpn_msb = msb; cc->cc_rpn_lsb = lsb; -return 0 ;// skip + cc->rpn_set =1 ; +return ret;case UMP_CC_NRPN_MSB : - cc->cc_nrpn_msb = msb; - fallthrough;case UMP_CC_NRPN_LSB : + ret =fill_rpn (cc, data, channel, true); + cc->cc_nrpn_msb = msb; cc->nrpn_set =1 ; cc->cc_nrpn_lsb = lsb; -return 0 ;// skip +return ret;case UMP_CC_DATA : - cc->cc_data_msb = msb; - fallthrough;case UMP_CC_DATA_LSB : + cc->cc_data_msb_set = cc->cc_data_lsb_set =1 ; + cc->cc_data_msb = msb; cc->cc_data_lsb = lsb; -if (!(cc->rpn_set || cc->nrpn_set)) -return 0 ;// skip -fill_rpn (cc, data, channel); -return 1 ; +return fill_rpn (cc, data, channel, false); } data->cc.status =UMP_MSG_STATUS_CC ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 12/132 ALSA: seq: ump: Explicitly reset RPN with Null RPN
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 98ea612dd1150adb61cd2a0e93875e1cc77e6b87 ]
RPN with 127:127 is treated as a Null RPN, just to reset the parameters, and it's not translated to MIDI2. Although the current code can work as is in most cases, better to implement the RPN reset explicitly for Null message.
--- sound/core/seq/seq_ump_convert.c | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-)
sound/core/seq/seq_ump_convert.c +16 -5
@@ -789,6 +789,15 @@ static int paf_ev_to_ump_midi2(const struct snd_seq_event *event,return 1 ; } +static void reset_rpn (struct ump_cvt_to_ump_bank *cc) +{ + cc->rpn_set =0 ; + cc->nrpn_set =0 ; + cc->cc_rpn_msb = cc->cc_rpn_lsb =0 ; + cc->cc_data_msb = cc->cc_data_lsb =0 ; + cc->cc_data_msb_set = cc->cc_data_lsb_set =0 ; +} +/* set up the MIDI2 RPN/NRPN packet data from the parsed info */ static int fill_rpn(struct ump_cvt_to_ump_bank *cc, union snd_ump_midi2_msg *data,
@@ -817,11 +826,7 @@ static int fill_rpn(struct ump_cvt_to_ump_bank *cc, cc->cc_data_lsb); data->rpn.channel = channel; - cc->rpn_set =0 ; - cc->nrpn_set =0 ; - cc->cc_rpn_msb = cc->cc_rpn_lsb =0 ; - cc->cc_data_msb = cc->cc_data_lsb =0 ; - cc->cc_data_msb_set = cc->cc_data_lsb_set =0 ; +reset_rpn (cc);return 1 ; }
@@ -843,11 +848,15 @@ static int cc_ev_to_ump_midi2(const struct snd_seq_event *event, ret =fill_rpn (cc, data, channel, true); cc->rpn_set =1 ; cc->cc_rpn_msb = val; +if (cc->cc_rpn_msb ==0x7f && cc->cc_rpn_lsb ==0x7f ) +reset_rpn (cc);return ret;case UMP_CC_RPN_LSB : ret =fill_rpn (cc, data, channel, true); cc->rpn_set =1 ; cc->cc_rpn_lsb = val; +if (cc->cc_rpn_msb ==0x7f && cc->cc_rpn_lsb ==0x7f ) +reset_rpn (cc);return ret;case UMP_CC_NRPN_MSB : ret =fill_rpn (cc, data, channel, true);
@@ -961,6 +970,8 @@ static int ctrl14_ev_to_ump_midi2(const struct snd_seq_event *event, cc->cc_rpn_msb = msb; cc->cc_rpn_lsb = lsb; cc->rpn_set =1 ; +if (cc->cc_rpn_msb ==0x7f && cc->cc_rpn_lsb ==0x7f ) +reset_rpn (cc);return ret;case UMP_CC_NRPN_MSB :case UMP_CC_NRPN_LSB :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 13/132 net/mlx5: DR, Fix stack guard page was hit error in dr_rule
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yevgeny Kliteynik <[email protected]>
[ Upstream commit 94a3ad6c081381fa9ee523781789802b4ed00faf ]
This patch reduces the size of hw_ste_arr_optimized array that is allocated on stack from 640 bytes (5 match STEs + 5 action STES) to 448 bytes (2 match STEs + 5 action STES).
This fixes the 'stack guard page was hit' issue, while still fitting majority of the usecases (up to 2 match STEs).
--- drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c +1 -1
@@ -7,7 +7,7 @@/* don't try to optimize STE allocation if the stack is too constaraining */ #define DR_RULE_MAX_STES_OPTIMIZED 0#else -#define DR_RULE_MAX_STES_OPTIMIZED 5 +#define DR_RULE_MAX_STES_OPTIMIZED 2#endif #define DR_RULE_MAX_STE_CHAIN_OPTIMIZED (DR_RULE_MAX_STES_OPTIMIZED + DR_ACTION_MAX_STES)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 14/132 smb: client: fix FSCTL_GET_REPARSE_POINT against NetApp
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Alcantara <[email protected]>
[ Upstream commit ddecea00f87f0c46e9c8339a7c89fb2ff891521a ]
NetApp server requires the file to be open with FILE_READ_EA access in order to support FSCTL_GET_REPARSE_POINT, otherwise it will return STATUS_INVALID_DEVICE_REQUEST. It doesn't make any sense because there's no requirement for FILE_READ_EA bit to be set nor STATUS_INVALID_DEVICE_REQUEST being used for something other than "unsupported reparse points" in MS-FSA.
To fix it and improve compatibility, set FILE_READ_EA & SYNCHRONIZE bits to match what Windows client currently does.
--- fs/smb/client/smb2inode.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
fs/smb/client/smb2inode.c +4 -2
@@ -950,7 +950,8 @@ int smb2_query_path_info(const unsigned int xid, cmds[num_cmds++] =SMB2_OP_GET_REPARSE ; oparms =CIFS_OPARMS (cifs_sb, tcon, full_path, -FILE_READ_ATTRIBUTES |FILE_READ_EA , +FILE_READ_ATTRIBUTES | +FILE_READ_EA |SYNCHRONIZE ,FILE_OPEN , create_options |OPEN_REPARSE_POINT ,ACL_NO_MODE );cifs_get_readable_path (tcon, full_path, &cfile);
@@ -1258,7 +1259,8 @@ int smb2_query_reparse_point(const unsigned int xid,cifs_dbg (FYI ,"%s: path: %s\n" , __func__, full_path);cifs_get_readable_path (tcon, full_path, &cfile); - oparms =CIFS_OPARMS (cifs_sb, tcon, full_path,FILE_READ_ATTRIBUTES , + oparms =CIFS_OPARMS (cifs_sb, tcon, full_path, +FILE_READ_ATTRIBUTES |FILE_READ_EA |SYNCHRONIZE ,FILE_OPEN ,OPEN_REPARSE_POINT ,ACL_NO_MODE ); rc = smb2_compound_op(xid, tcon, cifs_sb, full_path, &oparms, &in_iov,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 15/132 ASoC: amd: yc: Support mic on HP 14-em0002la
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bruno Ancona <[email protected]>
[ Upstream commit c118478665f467e57d06b2354de65974b246b82b ]
Add support for the internal microphone for HP 14-em0002la laptop using a quirk entry.
--- sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ 1 file changed, 7 insertions(+)
sound/soc/amd/yc/acp6x-mach.c +7 -0
@@ -430,6 +430,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { DMI_MATCH(DMI_BOARD_NAME, "8A3E"), } }, + { + .driver_data = &acp6x_card, + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"HP" ), + DMI_MATCH(DMI_BOARD_NAME, "8B27"), + } + }, { .driver_data = &acp6x_card, .matches = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 16/132 spi: hisi-kunpeng: Add validation for the minimum value of speed_hz
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Devyn Liu <[email protected]>
[ Upstream commit c3c4f22b7c814a6ee485ce294065836f8ede30fa ]
The speed specified by the user is used to calculate the clk_div based on the max_speed_hz in hisi_calc_effective_speed. A very low speed value can lead to a clk_div larger than the variable range. Avoid this by setting the min_speed_hz so that such a small speed value is rejected. __spi_validate() in spi.c will return -EINVAL for the specified speed_hz lower than min_speed_hz.
--- drivers/spi/spi-hisi-kunpeng.c | 1 + 1 file changed, 1 insertion(+)
drivers/spi/spi-hisi-kunpeng.c +1 -0
@@ -495,6 +495,7 @@ static int hisi_spi_probe(struct platform_device *pdev) host->transfer_one = hisi_spi_transfer_one; host->handle_err = hisi_spi_handle_err; host->dev.fwnode = dev->fwnode; + host->min_speed_hz =DIV_ROUND_UP (host->max_speed_hz,CLK_DIV_MAX );hisi_spi_hw_init (hs);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 17/132 i2c: Fix conditional for substituting empty ACPI functions
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Fitzgerald <[email protected]>
[ Upstream commit f17c06c6608ad4ecd2ccf321753fb511812d821b ]
Add IS_ENABLED(CONFIG_I2C) to the conditional around a bunch of ACPI functions.
The conditional around these functions depended only on CONFIG_ACPI. But the functions are implemented in I2C core, so are only present if CONFIG_I2C is enabled.
--- include/linux/i2c.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/i2c.h +1 -1
@@ -1033,7 +1033,7 @@ static inline int of_i2c_get_board_info(struct device *dev,struct acpi_resource ;struct acpi_resource_i2c_serialbus ; -#if IS_ENABLED (CONFIG_ACPI ) +#if IS_ENABLED (CONFIG_ACPI ) &&IS_ENABLED (CONFIG_I2C )bool i2c_acpi_get_i2c_resource (struct acpi_resource *ares,struct acpi_resource_i2c_serialbus **i2c);int i2c_acpi_client_count (struct acpi_device *adev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 18/132 dma-debug: avoid deadlock between dma debug vs printk and netconsole
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rik van Riel <[email protected]>
[ Upstream commit bd44ca3de49cc1badcff7a96010fa2c64f04868c ]
Currently the dma debugging code can end up indirectly calling printk under the radix_lock. This happens when a radix tree node allocation fails.
This is a problem because the printk code, when used together with netconsole, can end up inside the dma debugging code while trying to transmit a message over netcons.
This creates the possibility of either a circular deadlock on the same CPU, with that CPU trying to grab the radix_lock twice, or an ABBA deadlock between different CPUs, where one CPU grabs the console lock first and then waits for the radix_lock, while the other CPU is holding the radix_lock and is waiting for the console lock.
The trace captured by lockdep is of the ABBA variant.
-> #2 (&dma_entry_hash[i].lock){-.-.}-{2:2}:
_raw_spin_lock_irqsave+0x5a/0x90
debug_dma_map_page+0x79/0x180
dma_map_page_attrs+0x1d2/0x2f0
bnxt_start_xmit+0x8c6/0x1540
netpoll_start_xmit+0x13f/0x180
netpoll_send_skb+0x20d/0x320
netpoll_send_udp+0x453/0x4a0
write_ext_msg+0x1b9/0x460
console_flush_all+0x2ff/0x5a0
console_unlock+0x55/0x180
vprintk_emit+0x2e3/0x3c0
devkmsg_emit+0x5a/0x80
devkmsg_write+0xfd/0x180
do_iter_readv_writev+0x164/0x1b0
vfs_writev+0xf9/0x2b0
do_writev+0x6d/0x110
do_syscall_64+0x80/0x150
entry_SYSCALL_64_after_hwframe+0x4b/0x53-> #0 (console_owner){-.-.}-{0:0}:
__lock_acquire+0x15d1/0x31a0
lock_acquire+0xe8/0x290
console_flush_all+0x2ea/0x5a0
console_unlock+0x55/0x180
vprintk_emit+0x2e3/0x3c0
_printk+0x59/0x80
warn_alloc+0x122/0x1b0
__alloc_pages_slowpath+0x1101/0x1120
__alloc_pages+0x1eb/0x2c0
alloc_slab_page+0x5f/0x150
new_slab+0x2dc/0x4e0
___slab_alloc+0xdcb/0x1390
kmem_cache_alloc+0x23d/0x360
radix_tree_node_alloc+0x3c/0xf0
radix_tree_insert+0xf5/0x230
add_dma_entry+0xe9/0x360
dma_map_page_attrs+0x1d2/0x2f0
__bnxt_alloc_rx_frag+0x147/0x180
bnxt_alloc_rx_data+0x79/0x160
bnxt_rx_skb+0x29/0xc0
bnxt_rx_pkt+0xe22/0x1570
__bnxt_poll_work+0x101/0x390
bnxt_poll+0x7e/0x320
__napi_poll+0x29/0x160
net_rx_action+0x1e0/0x3e0
handle_softirqs+0x190/0x510
run_ksoftirqd+0x4e/0x90
smpboot_thread_fn+0x1a8/0x270
kthread+0x102/0x120
ret_from_fork+0x2f/0x40
ret_from_fork_asm+0x11/0x20This bug is more likely than it seems, because when one CPU has run out of memory, chances are the other has too.
The good news is, this bug is hidden behind the CONFIG_DMA_API_DEBUG, so not many users are likely to trigger it.
--- kernel/dma/debug.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
kernel/dma/debug.c +4 -1
@@ -415,8 +415,11 @@ static unsigned long long phys_addr(struct dma_debug_entry *entry)* dma_active_cacheline entry to track per event. dma_map_sg(), on the * other hand, consumes a single dma_debug_entry, but inserts 'nents' * entries into the tree. +* +* Use __GFP_NOWARN because the printk from an OOM, to netconsole, could end +* up right back in the DMA debugging code, leading to a deadlock. */ -static RADIX_TREE(dma_active_cacheline, GFP_ATOMIC); +static RADIX_TREE(dma_active_cacheline, GFP_ATOMIC | __GFP_NOWARN);static DEFINE_SPINLOCK (radix_lock);#define ACTIVE_CACHELINE_MAX_OVERLAP ((1 << RADIX_TREE_MAX_TAGS) - 1)#define CACHELINE_PER_PAGE_SHIFT (PAGE_SHIFT - L1_CACHE_SHIFT)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 19/132 net: usb: qmi_wwan: add MeiG Smart SRM825L
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: ZHANG Yuntian <[email protected]>
[ Upstream commit 1ca645a2f74a4290527ae27130c8611391b07dbf ]
Add support for MeiG Smart SRM825L which is based on Qualcomm 315 chip.
T: Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0 D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 P: Vendor=2dee ProdID=4d22 Rev= 4.14 S: Manufacturer=MEIG S: Product=LTE-A Module S: SerialNumber=6f345e48 C:* #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=896mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=05(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=88(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
--- drivers/net/usb/qmi_wwan.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/usb/qmi_wwan.c +1 -0
@@ -1438,6 +1438,7 @@ static const struct usb_device_id products[] = { {QMI_QUIRK_SET_DTR(0x1546, 0x1312, 4)}, /* u-blox LARA-R6 01B */ {QMI_QUIRK_SET_DTR(0x1546, 0x1342, 4)}, /* u-blox LARA-L6 */ {QMI_QUIRK_SET_DTR(0x33f8, 0x0104, 4)}, /* Rolling RW101 RMNET */ + {QMI_FIXED_INTF(0x2dee, 0x4d22, 5)}, /* MeiG Smart SRM825L *//* 4. Gobi 1000 devices */ {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)}, /* Acer Gobi Modem Device */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 20/132 ASoC: amd: yc: Support mic on Lenovo Thinkpad E14 Gen 6
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Stępniak <[email protected]>
[ Upstream commit 23a58b782f864951485d7a0018549729e007cb43 ]
Lenovo Thinkpad E14 Gen 6 (model type 21M3)
needs a quirk entry for internal mic to work.
--- sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ 1 file changed, 7 insertions(+)
sound/soc/amd/yc/acp6x-mach.c +7 -0
@@ -220,6 +220,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { DMI_MATCH(DMI_PRODUCT_NAME, "21J6"), } }, + { + .driver_data = &acp6x_card, + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"LENOVO" ), + DMI_MATCH(DMI_PRODUCT_NAME, "21M3"), + } + }, { .driver_data = &acp6x_card, .matches = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 21/132 ASoC: codecs: ES8326: button detect issue
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Yi <[email protected]>
[ Upstream commit 4684a2df9c5b3fc914377127faf2515aa9049093 ]
We find that we need to set snd_jack_types to 0. If not, there will be a probability of button detection errors
--- sound/soc/codecs/es8326.c | 2 ++ 1 file changed, 2 insertions(+)
sound/soc/codecs/es8326.c +2 -0
@@ -617,6 +617,8 @@ static void es8326_jack_detect_handler(struct work_struct *work)es8326_disable_micbias (es8326->component);if (es8326->jack->status &SND_JACK_HEADPHONE ) {dev_dbg (comp->dev,"Report hp remove event\n" ); +snd_soc_jack_report (es8326->jack,0 , +SND_JACK_BTN_0 |SND_JACK_BTN_1 |SND_JACK_BTN_2 );snd_soc_jack_report (es8326->jack,0 ,SND_JACK_HEADSET );/* mute adc when mic path switch */ regmap_write (es8326->regmap,ES8326_ADC_SCALE ,0x33 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 22/132 mptcp: make pm_remove_addrs_and_subflows static
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geliang Tang <[email protected]>
[ Upstream commit e38b117d7f3b4a5d810f6d0069ad0f643e503796 ]
mptcp_pm_remove_addrs_and_subflows() is only used in pm_netlink.c, it's no longer used in pm_userspace.c any more since the commit 8b1c94da1e48 ("mptcp: only send RM_ADDR in nl_cmd_remove"). So this patch changes it to a static function.
Stable-dep-of: 87b5896f3f78 ("mptcp: pm: fix RM_ADDR ID for the initial subflow")
--- net/mptcp/pm_netlink.c | 4 ++-- net/mptcp/protocol.h | 2 -- 2 files changed, 2 insertions(+), 4 deletions(-)
net/mptcp/pm_netlink.c +2 -2
@@ -1701,8 +1701,8 @@ void mptcp_pm_remove_addrs(struct mptcp_sock *msk, struct list_head *rm_list) } } -void mptcp_pm_remove_addrs_and_subflows (struct mptcp_sock *msk, -struct list_head *rm_list) +static void mptcp_pm_remove_addrs_and_subflows (struct mptcp_sock *msk, +struct list_head *rm_list) {struct mptcp_rm_list alist = { .nr =0 }, slist = { .nr =0 };struct mptcp_pm_addr_entry *entry;
net/mptcp/protocol.h +0 -2
@@ -948,8 +948,6 @@ int mptcp_pm_announce_addr(struct mptcp_sock *msk, bool echo);int mptcp_pm_remove_addr (struct mptcp_sock *msk,const struct mptcp_rm_list *rm_list);void mptcp_pm_remove_addrs (struct mptcp_sock *msk,struct list_head *rm_list); -void mptcp_pm_remove_addrs_and_subflows (struct mptcp_sock *msk, -struct list_head *rm_list);void mptcp_free_local_addr_list (struct mptcp_sock *msk);int mptcp_nl_cmd_announce (struct sk_buff *skb,struct genl_info *info);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 23/132 mptcp: pm: fix RM_ADDR ID for the initial subflow
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
[ Upstream commit 87b5896f3f7848130095656739b05881904e2697 ]
The initial subflow has a special local ID: 0. When an endpoint is being deleted, it is then important to check if its address is not linked to the initial subflow to send the right ID.
If there was an endpoint linked to the initial subflow, msk's mpc_endpoint_id field will be set. We can then use this info when an endpoint is being removed to see if it is linked to the initial subflow.
So now, the correct IDs are passed to mptcp_pm_nl_rm_addr_or_subflow(), it is no longer needed to use mptcp_local_id_match().
--- net/mptcp/pm_netlink.c | 28 +++++++++++++++------------- 1 file changed, 15 insertions(+), 13 deletions(-)
net/mptcp/pm_netlink.c +15 -13
@@ -826,11 +826,6 @@ int mptcp_pm_nl_mp_prio_send_ack(struct mptcp_sock *msk,return -EINVAL ; } -static bool mptcp_local_id_match (const struct mptcp_sock *msk,u8 local_id,u8 id) -{ -return local_id == id || (!local_id && msk->mpc_endpoint_id == id); -} -static void mptcp_pm_nl_rm_addr_or_subflow (struct mptcp_sock *msk,const struct mptcp_rm_list *rm_list,enum linux_mptcp_mib_field rm_type)
@@ -867,7 +862,7 @@ static void mptcp_pm_nl_rm_addr_or_subflow(struct mptcp_sock *msk,continue ;if (rm_type ==MPTCP_MIB_RMADDR && remote_id != rm_id)continue ; -if (rm_type ==MPTCP_MIB_RMSUBFLOW && !mptcp_local_id_match (msk, id, rm_id)) +if (rm_type ==MPTCP_MIB_RMSUBFLOW && id != rm_id)continue ; pr_debug(" -> %s rm_list_ids[%d]=%u local_id=%u remote_id=%u mpc_id=%u",
@@ -1506,6 +1501,12 @@ static bool remove_anno_list_by_saddr(struct mptcp_sock *msk,return false; } +static u8 mptcp_endp_get_local_id (struct mptcp_sock *msk, +const struct mptcp_addr_info *addr) +{ +return msk->mpc_endpoint_id == addr->id ?0 : addr->id; +} +static bool mptcp_pm_remove_anno_addr (struct mptcp_sock *msk,const struct mptcp_addr_info *addr,bool force)
@@ -1513,7 +1514,7 @@ static bool mptcp_pm_remove_anno_addr(struct mptcp_sock *msk,struct mptcp_rm_list list = { .nr =0 };bool ret; - list.ids[list.nr++] = addr->id; + list.ids[list.nr++] =mptcp_endp_get_local_id (msk, addr); ret =remove_anno_list_by_saddr (msk, addr);if (ret || force) {
@@ -1540,14 +1541,12 @@ static int mptcp_nl_remove_subflow_and_signal_addr(struct net *net, const struct mptcp_pm_addr_entry *entry) {const struct mptcp_addr_info *addr = &entry->addr; -struct mptcp_rm_list list = { .nr =0 }; +struct mptcp_rm_list list = { .nr =1 };long s_slot =0 , s_num =0 ;struct mptcp_sock *msk;pr_debug ("remove_id=%d" , addr->id); - list.ids[list.nr++] = addr->id; -while ((msk =mptcp_token_iter_next (net, &s_slot, &s_num)) !=NULL ) {struct sock *sk = (struct sock *)msk;bool remove_subflow;
@@ -1565,6 +1564,7 @@ static int mptcp_nl_remove_subflow_and_signal_addr(struct net *net,mptcp_pm_remove_anno_addr (msk, addr, remove_subflow && !(entry->flags &MPTCP_PM_ADDR_FLAG_IMPLICIT )); + list.ids[0 ] =mptcp_endp_get_local_id (msk, addr);if (remove_subflow) {spin_lock_bh (&msk->pm.lock);mptcp_pm_nl_rm_subflow_received (msk, &list);
@@ -1673,6 +1673,7 @@ static int mptcp_nl_cmd_del_addr(struct sk_buff *skb, struct genl_info *info)return ret; } +/* Called from the userspace PM only */ void mptcp_pm_remove_addrs (struct mptcp_sock *msk,struct list_head *rm_list) {struct mptcp_rm_list alist = { .nr =0 };
@@ -1701,6 +1702,7 @@ void mptcp_pm_remove_addrs(struct mptcp_sock *msk, struct list_head *rm_list) } } +/* Called from the in-kernel PM only */ static void mptcp_pm_remove_addrs_and_subflows (struct mptcp_sock *msk,struct list_head *rm_list) {
@@ -1710,11 +1712,11 @@ static void mptcp_pm_remove_addrs_and_subflows(struct mptcp_sock *msk,list_for_each_entry (entry, rm_list, list) {if (slist.nr <MPTCP_RM_IDS_MAX &&lookup_subflow_by_saddr (&msk->conn_list, &entry->addr)) - slist.ids[slist.nr++] = entry->addr.id; + slist.ids[slist.nr++] =mptcp_endp_get_local_id (msk, &entry->addr);if (alist.nr <MPTCP_RM_IDS_MAX &&remove_anno_list_by_saddr (msk, &entry->addr)) - alist.ids[alist.nr++] = entry->addr.id; + alist.ids[alist.nr++] =mptcp_endp_get_local_id (msk, &entry->addr); }spin_lock_bh (&msk->pm.lock);
@@ -2002,7 +2004,7 @@ static void mptcp_pm_nl_fullmesh(struct mptcp_sock *msk, {struct mptcp_rm_list list = { .nr =0 }; - list.ids[list.nr++] = addr->id; + list.ids[list.nr++] =mptcp_endp_get_local_id (msk, addr);spin_lock_bh (&msk->pm.lock);mptcp_pm_nl_rm_subflow_received (msk, &list);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 24/132 selftests: mptcp: userspace pm create id 0 subflow
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geliang Tang <[email protected]>
[ Upstream commit b2e2248f365a7ef0687fe048c335fe1a32f98b36 ]
This patch adds a selftest to create id 0 subflow. Pass id 0 to the helper userspace_pm_add_sf() to create id 0 subflow. chk_mptcp_info shows one subflow but chk_subflows_total shows two subflows in each namespace.
Stable-dep-of: e93681afcb96 ("selftests: mptcp: join: cannot rm sf if closed")
--- .../testing/selftests/net/mptcp/mptcp_join.sh | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+)
tools/testing/selftests/net/mptcp/mptcp_join.sh +19 -0
@@ -3545,6 +3545,25 @@ userspace_tests() kill_events_pids mptcp_lib_kill_wait $tests_pid fi + + # userspace pm create id 0 subflow + if reset_with_events "userspace pm create id 0 subflow" && + continue_if mptcp_lib_has_file '/proc/sys/net/mptcp/pm_type'; then + set_userspace_pm $ns2 + pm_nl_set_limits $ns1 0 1 + speed=5 \ + run_tests $ns1 $ns2 10.0.1.1 & + local tests_pid=$! + wait_mpj $ns2 + chk_mptcp_info subflows 0 subflows 0 + chk_subflows_total 1 1 + userspace_pm_add_sf $ns2 10.0.3.2 0 + chk_join_nr 1 1 1 + chk_mptcp_info subflows 1 subflows 1 + chk_subflows_total 2 2 + kill_events_pids + wait $tests_pid + fi } endpoint_tests()
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 25/132 selftests: mptcp: dump userspace addrs list
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geliang Tang <[email protected]>
[ Upstream commit 38f027fca1b724c6814fff4b8ad16b59c14a3e2a ]
This patch adds a new helper userspace_pm_dump() to dump addresses for the userspace PM. Use this helper to check whether an ID 0 subflow is listed in the output of dump command after creating an ID 0 subflow in "userspace pm create id 0 subflow" test. Dump userspace PM addresses list in "userspace pm add & remove address" test and in "userspace pm create destroy subflow" test.
Stable-dep-of: e93681afcb96 ("selftests: mptcp: join: cannot rm sf if closed")
--- .../testing/selftests/net/mptcp/mptcp_join.sh | 61 +++++++++++++++++++ 1 file changed, 61 insertions(+)
tools/testing/selftests/net/mptcp/mptcp_join.sh +61 -0
@@ -21,6 +21,7 @@ cinfail="" cinsent="" tmpfile="" cout="" +err="" capout="" ns1="" ns2=""
@@ -187,6 +188,7 @@ init() { cin=$(mktemp) cinsent=$(mktemp) cout=$(mktemp) + err=$(mktemp) evts_ns1=$(mktemp) evts_ns2=$(mktemp)
@@ -202,6 +204,7 @@ cleanup() rm -f "$sin" "$sout" "$cinsent" "$cinfail" rm -f "$tmpfile" rm -rf $evts_ns1 $evts_ns2 + rm -f "$err" cleanup_partial }
@@ -3422,6 +3425,50 @@ userspace_pm_rm_sf() wait_rm_sf $1 "${cnt}" } +check_output() +{ + local cmd="$1" + local expected="$2" + local msg="$3" + local rc=0 + + mptcp_lib_check_output "${err}" "${cmd}" "${expected}" || rc=${?} + if [ ${rc} -eq 2 ]; then + fail_test "fail to check output # error ${rc}" + elif [ ${rc} -eq 0 ]; then + print_ok + elif [ ${rc} -eq 1 ]; then + fail_test "fail to check output # different output" + fi +} + +# $1: ns +userspace_pm_dump() +{ + local evts=$evts_ns1 + local tk + + [ "$1" == "$ns2" ] && evts=$evts_ns2 + tk=$(mptcp_lib_evts_get_info token "$evts") + + ip netns exec $1 ./pm_nl_ctl dump token $tk +} + +userspace_pm_chk_dump_addr() +{ + local ns="${1}" + local exp="${2}" + local check="${3}" + + print_check "dump addrs ${check}" + + if mptcp_lib_kallsyms_has "mptcp_userspace_pm_dump_addr$"; then + check_output "userspace_pm_dump ${ns}" "${exp}" + else + print_skip + fi +} + userspace_tests() { # userspace pm type prevents add_addr
@@ -3513,10 +3560,16 @@ userspace_tests() chk_mptcp_info subflows 2 subflows 2 chk_subflows_total 3 3 chk_mptcp_info add_addr_signal 2 add_addr_accepted 2 + userspace_pm_chk_dump_addr "${ns1}" \ + $'id 10 flags signal 10.0.2.1\nid 20 flags signal 10.0.3.1' \ + "signal" userspace_pm_rm_addr $ns1 10 userspace_pm_rm_sf $ns1 "::ffff:10.0.2.1" $SUB_ESTABLISHED + userspace_pm_chk_dump_addr "${ns1}" \ + "id 20 flags signal 10.0.3.1" "after rm_addr 10" userspace_pm_rm_addr $ns1 20 userspace_pm_rm_sf $ns1 10.0.3.1 $SUB_ESTABLISHED + userspace_pm_chk_dump_addr "${ns1}" "" "after rm_addr 20" chk_rm_nr 2 2 invert chk_mptcp_info subflows 0 subflows 0 chk_subflows_total 1 1
@@ -3537,8 +3590,14 @@ userspace_tests() chk_join_nr 1 1 1 chk_mptcp_info subflows 1 subflows 1 chk_subflows_total 2 2 + userspace_pm_chk_dump_addr "${ns2}" \ + "id 20 flags subflow 10.0.3.2" \ + "subflow" userspace_pm_rm_addr $ns2 20 userspace_pm_rm_sf $ns2 10.0.3.2 $SUB_ESTABLISHED + userspace_pm_chk_dump_addr "${ns2}" \ + "" \ + "after rm_addr 20" chk_rm_nr 1 1 chk_mptcp_info subflows 0 subflows 0 chk_subflows_total 1 1
@@ -3558,6 +3617,8 @@ userspace_tests() chk_mptcp_info subflows 0 subflows 0 chk_subflows_total 1 1 userspace_pm_add_sf $ns2 10.0.3.2 0 + userspace_pm_chk_dump_addr "${ns2}" \ + "id 0 flags subflow 10.0.3.2" "id 0 subflow" chk_join_nr 1 1 1 chk_mptcp_info subflows 1 subflows 1 chk_subflows_total 2 2
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 26/132 selftests: mptcp: userspace pm get addr tests
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geliang Tang <[email protected]>
[ Upstream commit 4cc5cc7ca052c816e20ed0cbc160299b454cbb75 ]
This patch adds a new helper userspace_pm_get_addr() in mptcp_join.sh. In it, parse the token value from the output of 'pm_nl_ctl events', then pass it to pm_nl_ctl get_addr command. Use this helper in userspace pm dump tests.
Stable-dep-of: e93681afcb96 ("selftests: mptcp: join: cannot rm sf if closed")
--- .../testing/selftests/net/mptcp/mptcp_join.sh | 30 +++++++++++++++++++ 1 file changed, 30 insertions(+)
tools/testing/selftests/net/mptcp/mptcp_join.sh +30 -0
@@ -3454,6 +3454,18 @@ userspace_pm_dump() ip netns exec $1 ./pm_nl_ctl dump token $tk } +# $1: ns ; $2: id +userspace_pm_get_addr() +{ + local evts=$evts_ns1 + local tk + + [ "$1" == "$ns2" ] && evts=$evts_ns2 + tk=$(mptcp_lib_evts_get_info token "$evts") + + ip netns exec $1 ./pm_nl_ctl get $2 token $tk +} + userspace_pm_chk_dump_addr() { local ns="${1}"
@@ -3469,6 +3481,21 @@ userspace_pm_chk_dump_addr() fi } +userspace_pm_chk_get_addr() +{ + local ns="${1}" + local id="${2}" + local exp="${3}" + + print_check "get id ${id} addr" + + if mptcp_lib_kallsyms_has "mptcp_userspace_pm_get_addr$"; then + check_output "userspace_pm_get_addr ${ns} ${id}" "${exp}" + else + print_skip + fi +} + userspace_tests() { # userspace pm type prevents add_addr
@@ -3563,6 +3590,8 @@ userspace_tests() userspace_pm_chk_dump_addr "${ns1}" \ $'id 10 flags signal 10.0.2.1\nid 20 flags signal 10.0.3.1' \ "signal" + userspace_pm_chk_get_addr "${ns1}" "10" "id 10 flags signal 10.0.2.1" + userspace_pm_chk_get_addr "${ns1}" "20" "id 20 flags signal 10.0.3.1" userspace_pm_rm_addr $ns1 10 userspace_pm_rm_sf $ns1 "::ffff:10.0.2.1" $SUB_ESTABLISHED userspace_pm_chk_dump_addr "${ns1}" \
@@ -3593,6 +3622,7 @@ userspace_tests() userspace_pm_chk_dump_addr "${ns2}" \ "id 20 flags subflow 10.0.3.2" \ "subflow" + userspace_pm_chk_get_addr "${ns2}" "20" "id 20 flags subflow 10.0.3.2" userspace_pm_rm_addr $ns2 20 userspace_pm_rm_sf $ns2 10.0.3.2 $SUB_ESTABLISHED userspace_pm_chk_dump_addr "${ns2}" \
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 27/132 selftests: mptcp: declare event macros in mptcp_lib
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geliang Tang <[email protected]>
[ Upstream commit 23a0485d1c0491a3044026263cf9a0acd33d30a2 ]
MPTCP event macros (SUB_ESTABLISHED, LISTENER_CREATED, LISTENER_CLOSED), and the protocol family macros (AF_INET, AF_INET6) are defined in both mptcp_join.sh and userspace_pm.sh. In order not to duplicate code, this patch declares them all in mptcp_lib.sh with MPTCP_LIB_ prefixs.
Stable-dep-of: e93681afcb96 ("selftests: mptcp: join: cannot rm sf if closed")
--- .../testing/selftests/net/mptcp/mptcp_join.sh | 23 ++++++++----------- .../testing/selftests/net/mptcp/mptcp_lib.sh | 11 +++++++++ .../selftests/net/mptcp/userspace_pm.sh | 18 +++++++-------- 3 files changed, 29 insertions(+), 23 deletions(-)
tools/testing/selftests/net/mptcp/mptcp_join.sh +9 -14
@@ -2894,13 +2894,6 @@ backup_tests() fi } -SUB_ESTABLISHED=10 # MPTCP_EVENT_SUB_ESTABLISHED -LISTENER_CREATED=15 #MPTCP_EVENT_LISTENER_CREATED -LISTENER_CLOSED=16 #MPTCP_EVENT_LISTENER_CLOSED - -AF_INET=2 -AF_INET6=10 - verify_listener_events() { local evt=$1
@@ -2914,9 +2907,9 @@ verify_listener_events() local sport local name - if [ $e_type = $LISTENER_CREATED ]; then + if [ $e_type = $MPTCP_LIB_EVENT_LISTENER_CREATED ]; then name="LISTENER_CREATED" - elif [ $e_type = $LISTENER_CLOSED ]; then + elif [ $e_type = $MPTCP_LIB_EVENT_LISTENER_CLOSED ]; then name="LISTENER_CLOSED " else name="$e_type"
@@ -2983,8 +2976,10 @@ add_addr_ports_tests() chk_add_nr 1 1 1 chk_rm_nr 1 1 invert - verify_listener_events $evts_ns1 $LISTENER_CREATED $AF_INET 10.0.2.1 10100 - verify_listener_events $evts_ns1 $LISTENER_CLOSED $AF_INET 10.0.2.1 10100 + verify_listener_events $evts_ns1 $MPTCP_LIB_EVENT_LISTENER_CREATED \ + $MPTCP_LIB_AF_INET 10.0.2.1 10100 + verify_listener_events $evts_ns1 $MPTCP_LIB_EVENT_LISTENER_CLOSED \ + $MPTCP_LIB_AF_INET 10.0.2.1 10100 kill_events_pids fi
@@ -3593,11 +3588,11 @@ userspace_tests() userspace_pm_chk_get_addr "${ns1}" "10" "id 10 flags signal 10.0.2.1" userspace_pm_chk_get_addr "${ns1}" "20" "id 20 flags signal 10.0.3.1" userspace_pm_rm_addr $ns1 10 - userspace_pm_rm_sf $ns1 "::ffff:10.0.2.1" $SUB_ESTABLISHED + userspace_pm_rm_sf $ns1 "::ffff:10.0.2.1" $MPTCP_LIB_EVENT_SUB_ESTABLISHED userspace_pm_chk_dump_addr "${ns1}" \ "id 20 flags signal 10.0.3.1" "after rm_addr 10" userspace_pm_rm_addr $ns1 20 - userspace_pm_rm_sf $ns1 10.0.3.1 $SUB_ESTABLISHED + userspace_pm_rm_sf $ns1 10.0.3.1 $MPTCP_LIB_EVENT_SUB_ESTABLISHED userspace_pm_chk_dump_addr "${ns1}" "" "after rm_addr 20" chk_rm_nr 2 2 invert chk_mptcp_info subflows 0 subflows 0
@@ -3624,7 +3619,7 @@ userspace_tests() "subflow" userspace_pm_chk_get_addr "${ns2}" "20" "id 20 flags subflow 10.0.3.2" userspace_pm_rm_addr $ns2 20 - userspace_pm_rm_sf $ns2 10.0.3.2 $SUB_ESTABLISHED + userspace_pm_rm_sf $ns2 10.0.3.2 $MPTCP_LIB_EVENT_SUB_ESTABLISHED userspace_pm_chk_dump_addr "${ns2}" \ "" \ "after rm_addr 20"
tools/testing/selftests/net/mptcp/mptcp_lib.sh +11 -0
@@ -8,6 +8,17 @@ readonly KSFT_SKIP=4 # shellcheck disable=SC2155 # declare and assign separately readonly KSFT_TEST="${MPTCP_LIB_KSFT_TEST:-$(basename "${0}" .sh)}" +# These variables are used in some selftests, read-only +declare -rx MPTCP_LIB_EVENT_ANNOUNCED=6 # MPTCP_EVENT_ANNOUNCED +declare -rx MPTCP_LIB_EVENT_REMOVED=7 # MPTCP_EVENT_REMOVED +declare -rx MPTCP_LIB_EVENT_SUB_ESTABLISHED=10 # MPTCP_EVENT_SUB_ESTABLISHED +declare -rx MPTCP_LIB_EVENT_SUB_CLOSED=11 # MPTCP_EVENT_SUB_CLOSED +declare -rx MPTCP_LIB_EVENT_LISTENER_CREATED=15 # MPTCP_EVENT_LISTENER_CREATED +declare -rx MPTCP_LIB_EVENT_LISTENER_CLOSED=16 # MPTCP_EVENT_LISTENER_CLOSED + +declare -rx MPTCP_LIB_AF_INET=2 +declare -rx MPTCP_LIB_AF_INET6=10 + MPTCP_LIB_SUBTESTS=() # only if supported (or forced) and not disabled, see no-color.org
tools/testing/selftests/net/mptcp/userspace_pm.sh +9 -9
@@ -23,15 +23,15 @@ if ! ip -Version &> /dev/null; then exit ${KSFT_SKIP} fi -ANNOUNCED=6 # MPTCP_EVENT_ANNOUNCED -REMOVED=7 # MPTCP_EVENT_REMOVED -SUB_ESTABLISHED=10 # MPTCP_EVENT_SUB_ESTABLISHED -SUB_CLOSED=11 # MPTCP_EVENT_SUB_CLOSED -LISTENER_CREATED=15 #MPTCP_EVENT_LISTENER_CREATED -LISTENER_CLOSED=16 #MPTCP_EVENT_LISTENER_CLOSED - -AF_INET=2 -AF_INET6=10 +ANNOUNCED=${MPTCP_LIB_EVENT_ANNOUNCED} +REMOVED=${MPTCP_LIB_EVENT_REMOVED} +SUB_ESTABLISHED=${MPTCP_LIB_EVENT_SUB_ESTABLISHED} +SUB_CLOSED=${MPTCP_LIB_EVENT_SUB_CLOSED} +LISTENER_CREATED=${MPTCP_LIB_EVENT_LISTENER_CREATED} +LISTENER_CLOSED=${MPTCP_LIB_EVENT_LISTENER_CLOSED} + +AF_INET=${MPTCP_LIB_AF_INET} +AF_INET6=${MPTCP_LIB_AF_INET6} file="" server_evts=""
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 28/132 selftests: mptcp: join: cannot rm sf if closed
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
[ Upstream commit e93681afcb96864ec26c3b2ce94008ce93577373 ]
Thanks to the previous commit, the MPTCP subflows are now closed on both directions even when only the MPTCP path-manager of one peer asks for their closure.
In the two tests modified here -- "userspace pm add & remove address" and "userspace pm create destroy subflow" -- one peer is controlled by the userspace PM, and the other one by the in-kernel PM. When the userspace PM sends a RM_ADDR notification, the in-kernel PM will automatically react by closing all subflows using this address. Now, thanks to the previous commit, the subflows are properly closed on both directions, the userspace PM can then no longer closes the same subflows if they are already closed. Before, it was OK to do that, because the subflows were still half-opened, still OK to send a RM_ADDR.
In other words, thanks to the previous commit closing the subflows, an error will be returned to the userspace if it tries to close a subflow that has already been closed. So no need to run this command, which mean that the linked counters will then not be incremented.
These tests are then no longer sending both a RM_ADDR, then closing the linked subflow just after. The test with the userspace PM on the server side is now removing one subflow linked to one address, then sending a RM_ADDR for another address. The test with the userspace PM on the client side is now only removing the subflow that was previously created.
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-)
tools/testing/selftests/net/mptcp/mptcp_join.sh +4 -7
@@ -3587,14 +3587,12 @@ userspace_tests() "signal" userspace_pm_chk_get_addr "${ns1}" "10" "id 10 flags signal 10.0.2.1" userspace_pm_chk_get_addr "${ns1}" "20" "id 20 flags signal 10.0.3.1" - userspace_pm_rm_addr $ns1 10 userspace_pm_rm_sf $ns1 "::ffff:10.0.2.1" $MPTCP_LIB_EVENT_SUB_ESTABLISHED userspace_pm_chk_dump_addr "${ns1}" \ - "id 20 flags signal 10.0.3.1" "after rm_addr 10" + "id 20 flags signal 10.0.3.1" "after rm_sf 10" userspace_pm_rm_addr $ns1 20 - userspace_pm_rm_sf $ns1 10.0.3.1 $MPTCP_LIB_EVENT_SUB_ESTABLISHED userspace_pm_chk_dump_addr "${ns1}" "" "after rm_addr 20" - chk_rm_nr 2 2 invert + chk_rm_nr 1 1 invert chk_mptcp_info subflows 0 subflows 0 chk_subflows_total 1 1 kill_events_pids
@@ -3618,12 +3616,11 @@ userspace_tests() "id 20 flags subflow 10.0.3.2" \ "subflow" userspace_pm_chk_get_addr "${ns2}" "20" "id 20 flags subflow 10.0.3.2" - userspace_pm_rm_addr $ns2 20 userspace_pm_rm_sf $ns2 10.0.3.2 $MPTCP_LIB_EVENT_SUB_ESTABLISHED userspace_pm_chk_dump_addr "${ns2}" \ "" \ - "after rm_addr 20" - chk_rm_nr 1 1 + "after rm_sf 20" + chk_rm_nr 0 1 chk_mptcp_info subflows 0 subflows 0 chk_subflows_total 1 1 kill_events_pids
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 29/132 selftests: mptcp: add explicit test case for remove/readd
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
[ Upstream commit b5e2fb832f48bc01d937a053e0550a1465a2f05d ]
Delete and re-create a signal endpoint and ensure that the PM actually deletes and re-create the subflow.
Stable-dep-of: 1c2326fcae4f ("selftests: mptcp: join: check re-adding init endp with != id")
--- .../testing/selftests/net/mptcp/mptcp_join.sh | 29 +++++++++++++++++++ 1 file changed, 29 insertions(+)
tools/testing/selftests/net/mptcp/mptcp_join.sh +29 -0
@@ -3734,6 +3734,35 @@ endpoint_tests() chk_join_nr 6 6 6 chk_rm_nr 4 4 fi + + # remove and re-add + if reset "delete re-add signal" && + mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then + pm_nl_set_limits $ns1 1 1 + pm_nl_set_limits $ns2 1 1 + pm_nl_add_endpoint $ns1 10.0.2.1 id 1 flags signal + test_linkfail=4 speed=20 \ + run_tests $ns1 $ns2 10.0.1.1 & + local tests_pid=$! + + wait_mpj $ns2 + pm_nl_check_endpoint "creation" \ + $ns1 10.0.2.1 id 1 flags signal + chk_subflow_nr "before delete" 2 + chk_mptcp_info subflows 1 subflows 1 + + pm_nl_del_endpoint $ns1 1 10.0.2.1 + sleep 0.5 + chk_subflow_nr "after delete" 1 + chk_mptcp_info subflows 0 subflows 0 + + pm_nl_add_endpoint $ns1 10.0.2.1 flags signal + wait_mpj $ns2 + chk_subflow_nr "after re-add" 2 + chk_mptcp_info subflows 1 subflows 1 + mptcp_lib_kill_wait $tests_pid + fi + } # [$1: error message]
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 30/132 selftests: mptcp: join: check re-using ID of unused ADD_ADDR
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
[ Upstream commit a13d5aad4dd9a309eecdc33cfd75045bd5f376a3 ]
This test extends "delete re-add signal" to validate the previous commit. An extra address is announced by the server, but this address cannot be used by the client. The result is that no subflow will be established to this address.
Later, the server will delete this extra endpoint, and set a new one, with a valid address, but re-using the same ID. Before the previous commit, the server would not have been able to announce this new address.
While at it, extra checks have been added to validate the expected numbers of MPJ, ADD_ADDR and RM_ADDR.
The 'Fixes' tag here below is the same as the one from the previous
commit: this patch here is not fixing anything wrong in the selftests, but it validates the previous fix for an issue introduced by this commit ID.
Stable-dep-of: 1c2326fcae4f ("selftests: mptcp: join: check re-adding init endp with != id")
--- .../testing/selftests/net/mptcp/mptcp_join.sh | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-)
tools/testing/selftests/net/mptcp/mptcp_join.sh +13 -5
@@ -3738,9 +3738,11 @@ endpoint_tests() # remove and re-add if reset "delete re-add signal" && mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then - pm_nl_set_limits $ns1 1 1 - pm_nl_set_limits $ns2 1 1 + pm_nl_set_limits $ns1 0 2 + pm_nl_set_limits $ns2 2 2 pm_nl_add_endpoint $ns1 10.0.2.1 id 1 flags signal + # broadcast IP: no packet for this address will be received on ns1 + pm_nl_add_endpoint $ns1 224.0.0.1 id 2 flags signal test_linkfail=4 speed=20 \ run_tests $ns1 $ns2 10.0.1.1 & local tests_pid=$!
@@ -3752,15 +3754,21 @@ endpoint_tests() chk_mptcp_info subflows 1 subflows 1 pm_nl_del_endpoint $ns1 1 10.0.2.1 + pm_nl_del_endpoint $ns1 2 224.0.0.1 sleep 0.5 chk_subflow_nr "after delete" 1 chk_mptcp_info subflows 0 subflows 0 - pm_nl_add_endpoint $ns1 10.0.2.1 flags signal + pm_nl_add_endpoint $ns1 10.0.2.1 id 1 flags signal + pm_nl_add_endpoint $ns1 10.0.3.1 id 2 flags signal wait_mpj $ns2 - chk_subflow_nr "after re-add" 2 - chk_mptcp_info subflows 1 subflows 1 + chk_subflow_nr "after re-add" 3 + chk_mptcp_info subflows 2 subflows 2 mptcp_lib_kill_wait $tests_pid + + chk_join_nr 3 3 3 + chk_add_nr 4 4 + chk_rm_nr 2 1 invert fi }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 31/132 selftests: mptcp: join: check re-adding init endp with != id
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
[ Upstream commit 1c2326fcae4f0c5de8ad0d734ced43a8e5f17dac ]
The initial subflow has a special local ID: 0. It is specific per connection.
When a global endpoint is deleted and re-added later, it can have a different ID, but the kernel should still use the ID 0 if it corresponds to the initial address.
This test validates this behaviour: the endpoint linked to the initial subflow is removed, and re-added with a different ID.
Note that removing the initial subflow will not decrement the 'subflows' counters, which corresponds to the *additional* subflows. On the other hand, when the same endpoint is re-added, it will increment this counter, as it will be seen as an additional subflow this time.
The 'Fixes' tag here below is the same as the one from the previous
commit: this patch here is not fixing anything wrong in the selftests, but it validates the previous fix for an issue introduced by this commit ID.
--- .../testing/selftests/net/mptcp/mptcp_join.sh | 21 ++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-)
tools/testing/selftests/net/mptcp/mptcp_join.sh +16 -5
@@ -3738,11 +3738,12 @@ endpoint_tests() # remove and re-add if reset "delete re-add signal" && mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then - pm_nl_set_limits $ns1 0 2 - pm_nl_set_limits $ns2 2 2 + pm_nl_set_limits $ns1 0 3 + pm_nl_set_limits $ns2 3 3 pm_nl_add_endpoint $ns1 10.0.2.1 id 1 flags signal # broadcast IP: no packet for this address will be received on ns1 pm_nl_add_endpoint $ns1 224.0.0.1 id 2 flags signal + pm_nl_add_endpoint $ns1 10.0.1.1 id 42 flags signal test_linkfail=4 speed=20 \ run_tests $ns1 $ns2 10.0.1.1 & local tests_pid=$!
@@ -3764,11 +3765,21 @@ endpoint_tests() wait_mpj $ns2 chk_subflow_nr "after re-add" 3 chk_mptcp_info subflows 2 subflows 2 + + pm_nl_del_endpoint $ns1 42 10.0.1.1 + sleep 0.5 + chk_subflow_nr "after delete ID 0" 2 + chk_mptcp_info subflows 2 subflows 2 + + pm_nl_add_endpoint $ns1 10.0.1.1 id 99 flags signal + wait_mpj $ns2 + chk_subflow_nr "after re-add" 3 + chk_mptcp_info subflows 3 subflows 3 mptcp_lib_kill_wait $tests_pid - chk_join_nr 3 3 3 - chk_add_nr 4 4 - chk_rm_nr 2 1 invert + chk_join_nr 4 4 4 + chk_add_nr 5 5 + chk_rm_nr 3 2 invert fi }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 32/132 selftests: mptcp: add mptcp_lib_events helper
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geliang Tang <[email protected]>
commit 35bc143a8514ee72b2e9d6b8b385468608b93a53 upstream.
To avoid duplicated code in different MPTCP selftests, we can add and use helpers defined in mptcp_lib.sh.
This patch unifies "pm_nl_ctl events" related code in userspace_pm.sh and mptcp_join.sh into a helper mptcp_lib_events(). Define it in mptcp_lib.sh and use it in both scripts.
Note that mptcp_lib_kill_wait is now call before starting 'events' for mptcp_join.sh as well, but that's fine: each test is started from a new netns, so there will not be any existing pid there, and nothing is done when mptcp_lib_kill_wait is called with 0.
Stable-dep-of: 20ccc7c5f7a3 ("selftests: mptcp: join: validate event numbers") [ Conflicts in mptcp_lib.sh, because the context is different at the end
of the file, where the new helper is supposed to go. The new helper has simply be added at the end. ]
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 10 ++++------ tools/testing/selftests/net/mptcp/mptcp_lib.sh | 12 ++++++++++++ tools/testing/selftests/net/mptcp/userspace_pm.sh | 14 ++------------ 3 files changed, 18 insertions(+), 18 deletions(-)
tools/testing/selftests/net/mptcp/mptcp_join.sh +4 -6
@@ -468,12 +468,8 @@ reset_with_events() { reset "${1}" || return 1 - :> "$evts_ns1" - :> "$evts_ns2" - ip netns exec $ns1 ./pm_nl_ctl events >> "$evts_ns1" 2>&1 & - evts_ns1_pid=$! - ip netns exec $ns2 ./pm_nl_ctl events >> "$evts_ns2" 2>&1 & - evts_ns2_pid=$! + mptcp_lib_events "${ns1}" "${evts_ns1}" evts_ns1_pid + mptcp_lib_events "${ns2}" "${evts_ns2}" evts_ns2_pid } reset_with_tcp_filter()
@@ -672,7 +668,9 @@ wait_mpj() kill_events_pids() { mptcp_lib_kill_wait $evts_ns1_pid + evts_ns1_pid=0 mptcp_lib_kill_wait $evts_ns2_pid + evts_ns2_pid=0 } pm_nl_set_limits()
tools/testing/selftests/net/mptcp/mptcp_lib.sh +12 -0
@@ -258,3 +258,15 @@ mptcp_lib_get_counter() { echo "${count}" } + +mptcp_lib_events() { + local ns="${1}" + local evts="${2}" + declare -n pid="${3}" + + :>"${evts}" + + mptcp_lib_kill_wait "${pid:-0}" + ip netns exec "${ns}" ./pm_nl_ctl events >> "${evts}" 2>&1 & + pid=$! +}
tools/testing/selftests/net/mptcp/userspace_pm.sh +2 -12
@@ -201,21 +201,11 @@ make_connection() if [ -z "$client_evts" ]; then client_evts=$(mktemp) fi - :>"$client_evts" - if [ $client_evts_pid -ne 0 ]; then - mptcp_lib_kill_wait $client_evts_pid - fi - ip netns exec "$ns2" ./pm_nl_ctl events >> "$client_evts" 2>&1 & - client_evts_pid=$! + mptcp_lib_events "${ns2}" "${client_evts}" client_evts_pid if [ -z "$server_evts" ]; then server_evts=$(mktemp) fi - :>"$server_evts" - if [ $server_evts_pid -ne 0 ]; then - mptcp_lib_kill_wait $server_evts_pid - fi - ip netns exec "$ns1" ./pm_nl_ctl events >> "$server_evts" 2>&1 & - server_evts_pid=$! + mptcp_lib_events "${ns1}" "${server_evts}" server_evts_pid sleep 0.5 # Run the server
Greg Kroah-Hartman
maintainerPATCH 33/132 selftests: mptcp: join: validate event numbers
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Matthieu Baerts (NGI0)" <[email protected]>
commit 20ccc7c5f7a3aa48092441a4b182f9f40418392e upstream.
This test extends "delete and re-add" and "delete re-add signal" to validate the previous commit: the number of MPTCP events are checked to make sure there are no duplicated or unexpected ones.
A new helper has been introduced to easily check these events. The missing events have been added to the lib.
The 'Fixes' tag here below is the same as the one from the previous
commit: this patch here is not fixing anything wrong in the selftests, but it validates the previous fix for an issue introduced by this commit ID.
[ Conflicts in mptcp_join.sh and mptcp_lib.sh, due to commit
38f027fca1b7 ("selftests: mptcp: dump userspace addrs list") -- linked to a new feature, not backportable to stable -- and commit 23a0485d1c04 ("selftests: mptcp: declare event macros in mptcp_lib") -- depending on the previous one -- not in this version. The conflicts in mptcp_join.sh were in the context, because a new helper had to be added after others that are not in this version. The conflicts in mptcp_lib.sh were due to the fact the other MPTCP_LIB_EVENT_* constants were not present. They have all been added in this version to ease future backports if any. ]
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 74 +++++++++++++++++++++++- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 15 ++++ 2 files changed, 86 insertions(+), 3 deletions(-)
tools/testing/selftests/net/mptcp/mptcp_join.sh +71 -3
@@ -464,12 +464,17 @@ reset_with_fail() fi } +start_events() +{ + mptcp_lib_events "${ns1}" "${evts_ns1}" evts_ns1_pid + mptcp_lib_events "${ns2}" "${evts_ns2}" evts_ns2_pid +} + reset_with_events() { reset "${1}" || return 1 - mptcp_lib_events "${ns1}" "${evts_ns1}" evts_ns1_pid - mptcp_lib_events "${ns2}" "${evts_ns2}" evts_ns2_pid + start_events } reset_with_tcp_filter()
@@ -3489,6 +3494,36 @@ userspace_pm_chk_get_addr() fi } +# $1: ns ; $2: event type ; $3: count +chk_evt_nr() +{ + local ns=${1} + local evt_name="${2}" + local exp="${3}" + + local evts="${evts_ns1}" + local evt="${!evt_name}" + local count + + evt_name="${evt_name:16}" # without MPTCP_LIB_EVENT_ + [ "${ns}" == "ns2" ] && evts="${evts_ns2}" + + print_check "event ${ns} ${evt_name} (${exp})" + + if [[ "${evt_name}" = "LISTENER_"* ]] && + ! mptcp_lib_kallsyms_has "mptcp_event_pm_listener$"; then + print_skip "event not supported" + return + fi + + count=$(grep -cw "type:${evt}" "${evts}") + if [ "${count}" != "${exp}" ]; then + fail_test "got ${count} events, expected ${exp}" + else + print_ok + fi +} + userspace_tests() { # userspace pm type prevents add_addr
@@ -3678,6 +3713,7 @@ endpoint_tests() if reset_with_tcp_filter "delete and re-add" ns2 10.0.3.2 REJECT OUTPUT && mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then + start_events pm_nl_set_limits $ns1 0 3 pm_nl_set_limits $ns2 0 3 pm_nl_add_endpoint $ns2 10.0.1.2 id 1 dev ns2eth1 flags subflow
@@ -3729,12 +3765,28 @@ endpoint_tests() mptcp_lib_kill_wait $tests_pid + kill_events_pids + chk_evt_nr ns1 MPTCP_LIB_EVENT_LISTENER_CREATED 1 + chk_evt_nr ns1 MPTCP_LIB_EVENT_CREATED 1 + chk_evt_nr ns1 MPTCP_LIB_EVENT_ESTABLISHED 1 + chk_evt_nr ns1 MPTCP_LIB_EVENT_ANNOUNCED 0 + chk_evt_nr ns1 MPTCP_LIB_EVENT_REMOVED 4 + chk_evt_nr ns1 MPTCP_LIB_EVENT_SUB_ESTABLISHED 6 + chk_evt_nr ns1 MPTCP_LIB_EVENT_SUB_CLOSED 4 + + chk_evt_nr ns2 MPTCP_LIB_EVENT_CREATED 1 + chk_evt_nr ns2 MPTCP_LIB_EVENT_ESTABLISHED 1 + chk_evt_nr ns2 MPTCP_LIB_EVENT_ANNOUNCED 0 + chk_evt_nr ns2 MPTCP_LIB_EVENT_REMOVED 0 + chk_evt_nr ns2 MPTCP_LIB_EVENT_SUB_ESTABLISHED 6 + chk_evt_nr ns2 MPTCP_LIB_EVENT_SUB_CLOSED 5 # one has been closed before estab + chk_join_nr 6 6 6 chk_rm_nr 4 4 fi # remove and re-add - if reset "delete re-add signal" && + if reset_with_events "delete re-add signal" && mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then pm_nl_set_limits $ns1 0 3 pm_nl_set_limits $ns2 3 3
@@ -3775,6 +3827,22 @@ endpoint_tests() chk_mptcp_info subflows 3 subflows 3 mptcp_lib_kill_wait $tests_pid + kill_events_pids + chk_evt_nr ns1 MPTCP_LIB_EVENT_LISTENER_CREATED 1 + chk_evt_nr ns1 MPTCP_LIB_EVENT_CREATED 1 + chk_evt_nr ns1 MPTCP_LIB_EVENT_ESTABLISHED 1 + chk_evt_nr ns1 MPTCP_LIB_EVENT_ANNOUNCED 0 + chk_evt_nr ns1 MPTCP_LIB_EVENT_REMOVED 0 + chk_evt_nr ns1 MPTCP_LIB_EVENT_SUB_ESTABLISHED 4 + chk_evt_nr ns1 MPTCP_LIB_EVENT_SUB_CLOSED 2 + + chk_evt_nr ns2 MPTCP_LIB_EVENT_CREATED 1 + chk_evt_nr ns2 MPTCP_LIB_EVENT_ESTABLISHED 1 + chk_evt_nr ns2 MPTCP_LIB_EVENT_ANNOUNCED 5 + chk_evt_nr ns2 MPTCP_LIB_EVENT_REMOVED 3 + chk_evt_nr ns2 MPTCP_LIB_EVENT_SUB_ESTABLISHED 4 + chk_evt_nr ns2 MPTCP_LIB_EVENT_SUB_CLOSED 2 + chk_join_nr 4 4 4 chk_add_nr 5 5 chk_rm_nr 3 2 invert
tools/testing/selftests/net/mptcp/mptcp_lib.sh +15 -0
@@ -19,6 +19,21 @@ declare -rx MPTCP_LIB_EVENT_LISTENER_CLO declare -rx MPTCP_LIB_AF_INET=2 declare -rx MPTCP_LIB_AF_INET6=10 +# These variables are used in some selftests, read-only +declare -rx MPTCP_LIB_EVENT_CREATED=1 # MPTCP_EVENT_CREATED +declare -rx MPTCP_LIB_EVENT_ESTABLISHED=2 # MPTCP_EVENT_ESTABLISHED +declare -rx MPTCP_LIB_EVENT_CLOSED=3 # MPTCP_EVENT_CLOSED +declare -rx MPTCP_LIB_EVENT_ANNOUNCED=6 # MPTCP_EVENT_ANNOUNCED +declare -rx MPTCP_LIB_EVENT_REMOVED=7 # MPTCP_EVENT_REMOVED +declare -rx MPTCP_LIB_EVENT_SUB_ESTABLISHED=10 # MPTCP_EVENT_SUB_ESTABLISHED +declare -rx MPTCP_LIB_EVENT_SUB_CLOSED=11 # MPTCP_EVENT_SUB_CLOSED +declare -rx MPTCP_LIB_EVENT_SUB_PRIORITY=13 # MPTCP_EVENT_SUB_PRIORITY +declare -rx MPTCP_LIB_EVENT_LISTENER_CREATED=15 # MPTCP_EVENT_LISTENER_CREATED +declare -rx MPTCP_LIB_EVENT_LISTENER_CLOSED=16 # MPTCP_EVENT_LISTENER_CLOSED + +declare -rx MPTCP_LIB_AF_INET=2 +declare -rx MPTCP_LIB_AF_INET6=10 + MPTCP_LIB_SUBTESTS=() # only if supported (or forced) and not disabled, see no-color.org
Greg Kroah-Hartman
maintainerPATCH 34/132 selftests: mptcp: join: check re-re-adding ID 0 signal
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Matthieu Baerts (NGI0)" <[email protected]>
commit f18fa2abf81099d822d842a107f8c9889c86043c upstream.
This test extends "delete re-add signal" to validate the previous
commit: when the 'signal' endpoint linked to the initial subflow (ID 0) is re-added multiple times, it will re-send the ADD_ADDR with id 0. The client should still be able to re-create this subflow, even if the add_addr_accepted limit has been reached as this special address is not considered as a new address.
The 'Fixes' tag here below is the same as the one from the previous
commit: this patch here is not fixing anything wrong in the selftests, but it validates the previous fix for an issue introduced by this commit ID.
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 34 +++++++++++++++--------- 1 file changed, 22 insertions(+), 12 deletions(-)
tools/testing/selftests/net/mptcp/mptcp_join.sh +22 -12
@@ -3794,7 +3794,7 @@ endpoint_tests() # broadcast IP: no packet for this address will be received on ns1 pm_nl_add_endpoint $ns1 224.0.0.1 id 2 flags signal pm_nl_add_endpoint $ns1 10.0.1.1 id 42 flags signal - test_linkfail=4 speed=20 \ + test_linkfail=4 speed=5 \ run_tests $ns1 $ns2 10.0.1.1 & local tests_pid=$!
@@ -3823,7 +3823,17 @@ endpoint_tests() pm_nl_add_endpoint $ns1 10.0.1.1 id 99 flags signal wait_mpj $ns2 - chk_subflow_nr "after re-add" 3 + chk_subflow_nr "after re-add ID 0" 3 + chk_mptcp_info subflows 3 subflows 3 + + pm_nl_del_endpoint $ns1 99 10.0.1.1 + sleep 0.5 + chk_subflow_nr "after re-delete ID 0" 2 + chk_mptcp_info subflows 2 subflows 2 + + pm_nl_add_endpoint $ns1 10.0.1.1 id 88 flags signal + wait_mpj $ns2 + chk_subflow_nr "after re-re-add ID 0" 3 chk_mptcp_info subflows 3 subflows 3 mptcp_lib_kill_wait $tests_pid
@@ -3833,19 +3843,19 @@ endpoint_tests() chk_evt_nr ns1 MPTCP_LIB_EVENT_ESTABLISHED 1 chk_evt_nr ns1 MPTCP_LIB_EVENT_ANNOUNCED 0 chk_evt_nr ns1 MPTCP_LIB_EVENT_REMOVED 0 - chk_evt_nr ns1 MPTCP_LIB_EVENT_SUB_ESTABLISHED 4 - chk_evt_nr ns1 MPTCP_LIB_EVENT_SUB_CLOSED 2 + chk_evt_nr ns1 MPTCP_LIB_EVENT_SUB_ESTABLISHED 5 + chk_evt_nr ns1 MPTCP_LIB_EVENT_SUB_CLOSED 3 chk_evt_nr ns2 MPTCP_LIB_EVENT_CREATED 1 chk_evt_nr ns2 MPTCP_LIB_EVENT_ESTABLISHED 1 - chk_evt_nr ns2 MPTCP_LIB_EVENT_ANNOUNCED 5 - chk_evt_nr ns2 MPTCP_LIB_EVENT_REMOVED 3 - chk_evt_nr ns2 MPTCP_LIB_EVENT_SUB_ESTABLISHED 4 - chk_evt_nr ns2 MPTCP_LIB_EVENT_SUB_CLOSED 2 - - chk_join_nr 4 4 4 - chk_add_nr 5 5 - chk_rm_nr 3 2 invert + chk_evt_nr ns2 MPTCP_LIB_EVENT_ANNOUNCED 6 + chk_evt_nr ns2 MPTCP_LIB_EVENT_REMOVED 4 + chk_evt_nr ns2 MPTCP_LIB_EVENT_SUB_ESTABLISHED 5 + chk_evt_nr ns2 MPTCP_LIB_EVENT_SUB_CLOSED 3 + + chk_join_nr 5 5 5 + chk_add_nr 6 6 + chk_rm_nr 4 3 invert fi }
Greg Kroah-Hartman
maintainerPATCH 35/132 selftests: mptcp: join: test for flush/re-add endpoints
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit e06959e9eebdfea4654390f53b65cff57691872e upstream.
After having flushed endpoints that didn't cause the creation of new subflows, it is important to check endpoints can be re-created, re-using previously used IDs.
Before the previous commit, the client would not have been able to re-create the subflow that was previously rejected.
The 'Fixes' tag here below is the same as the one from the previous
commit: this patch here is not fixing anything wrong in the selftests, but it validates the previous fix for an issue introduced by this commit ID.
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 30 ++++++++++++++++++++++++ 1 file changed, 30 insertions(+)
tools/testing/selftests/net/mptcp/mptcp_join.sh +30 -0
@@ -3858,6 +3858,36 @@ endpoint_tests() chk_rm_nr 4 3 invert fi + # flush and re-add + if reset_with_tcp_filter "flush re-add" ns2 10.0.3.2 REJECT OUTPUT && + mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then + pm_nl_set_limits $ns1 0 2 + pm_nl_set_limits $ns2 1 2 + # broadcast IP: no packet for this address will be received on ns1 + pm_nl_add_endpoint $ns1 224.0.0.1 id 2 flags signal + pm_nl_add_endpoint $ns2 10.0.3.2 id 3 flags subflow + test_linkfail=4 speed=20 \ + run_tests $ns1 $ns2 10.0.1.1 & + local tests_pid=$! + + wait_attempt_fail $ns2 + chk_subflow_nr "before flush" 1 + chk_mptcp_info subflows 0 subflows 0 + + pm_nl_flush_endpoint $ns2 + pm_nl_flush_endpoint $ns1 + wait_rm_addr $ns2 0 + ip netns exec "${ns2}" ${iptables} -D OUTPUT -s "10.0.3.2" -p tcp -j REJECT + pm_nl_add_endpoint $ns2 10.0.3.2 id 3 flags subflow + wait_mpj $ns2 + pm_nl_add_endpoint $ns1 10.0.3.1 id 2 flags signal + wait_mpj $ns2 + mptcp_lib_kill_wait $tests_pid + + chk_join_nr 2 2 2 + chk_add_nr 2 2 + chk_rm_nr 1 0 invert + fi } # [$1: error message]
Greg Kroah-Hartman
maintainerPATCH 36/132 selftests: mptcp: join: disable get and dump addr checks
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Matthieu Baerts (NGI0)" <[email protected]>
These new checks have been recently queued to v6.6 [1] with the backport of commit 38f027fca1b7 ("selftests: mptcp: dump userspace addrs list"), and commit 4cc5cc7ca052 ("selftests: mptcp: userspace pm get addr tests").
On v6.6, these checks will simply print 'skip', because the associated features are not available in this version. That's fine, except that the MPTCP CI sets the SELFTESTS_MPTCP_LIB_EXPECT_ALL_FEATURES=1 env var, which will force these subtests to fail when using the selftests from v6.6 on a v6.6 kernel, because the feature is not available.
To ease the backports (and possible future ones), I suggest to keep the recent backports, but skip calling mptcp_lib_kallsyms_has() not to have the CIs setting this env var complaining about the associated features not being available.
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/testing/selftests/net/mptcp/mptcp_join.sh +2 -2
@@ -3472,7 +3472,7 @@ userspace_pm_chk_dump_addr() print_check "dump addrs ${check}" - if mptcp_lib_kallsyms_has "mptcp_userspace_pm_dump_addr$"; then + if false && mptcp_lib_kallsyms_has "mptcp_userspace_pm_dump_addr$"; then check_output "userspace_pm_dump ${ns}" "${exp}" else print_skip
@@ -3487,7 +3487,7 @@ userspace_pm_chk_get_addr() print_check "get id ${id} addr" - if mptcp_lib_kallsyms_has "mptcp_userspace_pm_get_addr$"; then + if false && mptcp_lib_kallsyms_has "mptcp_userspace_pm_get_addr$"; then check_output "userspace_pm_get_addr ${ns} ${id}" "${exp}" else print_skip
Greg Kroah-Hartman
maintainerPATCH 37/132 selftests: mptcp: join: stop transfer when check is done (part 2.2)
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Matthieu Baerts (NGI0)" <[email protected]>
Use mptcp_lib_kill_wait in "userspace pm create id 0 subflow" subtest.
This new test has recently been queued to v6.6 [1] with the backport of commit b2e2248f365a ("selftests: mptcp: userspace pm create id 0 subflow").
The modification here was part of commit 04b57c9e096a ("selftests:
mptcp: join: stop transfer when check is done (part 2)") that has been backported to v6.6 a few months ago -- see commit 358f02b84fbb ("selftests: mptcp: join: stop transfer when check is done (part 2)") -- but it was not modifying this subtest as it was not present in v6.6.
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/net/mptcp/mptcp_join.sh +1 -1
@@ -3678,7 +3678,7 @@ userspace_tests() chk_mptcp_info subflows 1 subflows 1 chk_subflows_total 2 2 kill_events_pids - wait $tests_pid + mptcp_lib_kill_wait $tests_pid fi }
Greg Kroah-Hartman
maintainerPATCH 38/132 mptcp: avoid duplicated SUB_CLOSED events
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Matthieu Baerts (NGI0)" <[email protected]>
commit d82809b6c5f2676b382f77a5cbeb1a5d91ed2235 upstream.
The initial subflow might have already been closed, but still in the connection list. When the worker is instructed to close the subflows that have been marked as closed, it might then try to close the initial subflow again.
A consequence of that is that the SUB_CLOSED event can be seen twice:
# ip mptcp endpoint 1.1.1.1 id 1 subflow dev eth0 2.2.2.2 id 2 subflow dev eth1
# ip mptcp monitor & [ CREATED] remid=0 locid=0 saddr4=1.1.1.1 daddr4=9.9.9.9 [ ESTABLISHED] remid=0 locid=0 saddr4=1.1.1.1 daddr4=9.9.9.9 [ SF_ESTABLISHED] remid=0 locid=2 saddr4=2.2.2.2 daddr4=9.9.9.9
# ip mptcp endpoint delete id 1 [ SF_CLOSED] remid=0 locid=0 saddr4=1.1.1.1 daddr4=9.9.9.9 [ SF_CLOSED] remid=0 locid=0 saddr4=1.1.1.1 daddr4=9.9.9.9
The first one is coming from mptcp_pm_nl_rm_subflow_received(), and the second one from __mptcp_close_subflow().
To avoid doing the post-closed processing twice, the subflow is now marked as closed the first time.
Note that it is not enough to check if we are dealing with the first subflow and check its sk_state: the subflow might have been reset or closed before calling mptcp_close_ssk().
[ Conflict in protocol.h due to commit f1f26512a9bf ("mptcp: use plain
bool instead of custom binary enum") and more that are not in this version, because they modify the context and the size of __unused. The conflict is easy to resolve, by not modifying data_avail type. ]
--- net/mptcp/protocol.c | 6 ++++++ net/mptcp/protocol.h | 3 ++- 2 files changed, 8 insertions(+), 1 deletion(-)
net/mptcp/protocol.c +6 -0
@@ -2471,6 +2471,12 @@ out:void mptcp_close_ssk (struct sock *sk,struct sock *ssk,struct mptcp_subflow_context *subflow) { +/* The first subflow can already be closed and still in the list */ +if (subflow->close_event_done) +return ; + + subflow->close_event_done = true; +if (sk->sk_state ==TCP_ESTABLISHED )mptcp_event (MPTCP_EVENT_SUB_CLOSED ,mptcp_sk (sk), ssk,GFP_KERNEL );
net/mptcp/protocol.h +2 -1
@@ -500,7 +500,8 @@ struct mptcp_subflow_context { stale : 1, /* unable to snd/rcv data, do not use for xmit */ valid_csum_seen : 1, /* at least one csum validated */ is_mptfo : 1, /* subflow is doing TFO */ - __unused : 10; + close_event_done : 1, /* has done the post-closed part */ + __unused : 9;enum mptcp_data_avail data_avail;bool scheduled;u32 remote_nonce;
Greg Kroah-Hartman
maintainerPATCH 39/132 mptcp: pr_debug: add missing \n at the end
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Matthieu Baerts (NGI0)" <[email protected]>
commit cb41b195e634d3f1ecfcd845314e64fd4bb3c7aa upstream.
pr_debug() have been added in various places in MPTCP code to help developers to debug some situations. With the dynamic debug feature, it is easy to enable all or some of them, and asks users to reproduce issues with extra debug.
Many of these pr_debug() don't end with a new line, while no 'pr_cont()' are used in MPTCP code. So the goal was not to display multiple debug messages on one line: they were then not missing the '\n' on purpose. Not having the new line at the end causes these messages to be printed with a delay, when something else needs to be printed. This issue is not visible when many messages need to be printed, but it is annoying and confusing when only specific messages are expected, e.g.
# echo "func mptcp_pm_add_addr_echoed +fmp" \
> /sys/kernel/debug/dynamic_debug/control
# ./mptcp_join.sh "signal address"; \
echo "$(awk '{print $1}' /proc/uptime) - end"; \
sleep 5s; \
echo "$(awk '{print $1}' /proc/uptime) - restart"; \
./mptcp_join.sh "signal address"
013 signal address
(...)
10.75 - end
15.76 - restart
013 signal address
[ 10.367935] mptcp:mptcp_pm_add_addr_echoed: MPTCP: msk=(...)
(...) => a delay of 5 seconds: printed with a 10.36 ts, but after 'restart'
which was printed at the 15.76 ts.
The 'Fixes' tag here below points to the first pr_debug() used without '\n' in net/mptcp. This patch could be split in many small ones, with different Fixes tag, but it doesn't seem worth it, because it is easy to re-generate this patch with this simple 'sed' command:
git grep -l pr_debug -- net/mptcp |
xargs sed -i "s/\(pr_debug(\".*[^n]\)\(\"[,)]\)/\1\\\n\2/g"
So in case of conflicts, simply drop the modifications, and launch this command.
[ As mentioned above, conflicts were expected, and resolved by using the
'sed' command which is visible above. ]
--- net/mptcp/fastopen.c | 4 +-- net/mptcp/options.c | 50 +++++++++++++++++++++++------------------------ net/mptcp/pm.c | 28 +++++++++++++------------- net/mptcp/pm_netlink.c | 20 +++++++++--------- net/mptcp/protocol.c | 52 ++++++++++++++++++++++++------------------------- net/mptcp/protocol.h | 4 +-- net/mptcp/sched.c | 4 +-- net/mptcp/sockopt.c | 4 +-- net/mptcp/subflow.c | 48 ++++++++++++++++++++++----------------------- 9 files changed, 107 insertions(+), 107 deletions(-)
net/mptcp/fastopen.c +2 -2
@@ -68,12 +68,12 @@ void __mptcp_fastopen_gen_msk_ackseq(str skb =skb_peek_tail (&sk->sk_receive_queue);if (skb) {WARN_ON_ONCE (MPTCP_SKB_CB (skb)->end_seq); -pr_debug ("msk %p moving seq %llx -> %llx end_seq %llx -> %llx" , sk, +pr_debug ("msk %p moving seq %llx -> %llx end_seq %llx -> %llx\n" , sk,MPTCP_SKB_CB (skb)->map_seq,MPTCP_SKB_CB (skb)->map_seq + msk->ack_seq,MPTCP_SKB_CB (skb)->end_seq,MPTCP_SKB_CB (skb)->end_seq + msk->ack_seq);MPTCP_SKB_CB (skb)->map_seq += msk->ack_seq;MPTCP_SKB_CB (skb)->end_seq += msk->ack_seq; } -pr_debug ("msk=%p ack_seq=%llx" , msk, msk->ack_seq); +pr_debug ("msk=%p ack_seq=%llx\n" , msk, msk->ack_seq); }
net/mptcp/options.c +25 -25
198 lines not on this page · raw message
net/mptcp/pm.c +14 -14
@@ -20,7 +20,7 @@ int mptcp_pm_announce_addr(struct mptcp_ {u8 add_addr =READ_ONCE (msk->pm.addr_signal); -pr_debug ("msk=%p, local_id=%d, echo=%d" , msk, addr->id, echo); +pr_debug ("msk=%p, local_id=%d, echo=%d\n" , msk, addr->id, echo);lockdep_assert_held (&msk->pm.lock);
@@ -46,7 +46,7 @@ int mptcp_pm_remove_addr(struct mptcp_so {u8 rm_addr =READ_ONCE (msk->pm.addr_signal); -pr_debug ("msk=%p, rm_list_nr=%d" , msk, rm_list->nr); +pr_debug ("msk=%p, rm_list_nr=%d\n" , msk, rm_list->nr);if (rm_addr) { MPTCP_ADD_STATS(sock_net((struct sock *)msk),
@@ -67,7 +67,7 @@ void mptcp_pm_new_connection(struct mptc {struct mptcp_pm_data *pm = &msk->pm; -pr_debug ("msk=%p, token=%u side=%d" , msk, msk->token, server_side); +pr_debug ("msk=%p, token=%u side=%d\n" , msk, msk->token, server_side);WRITE_ONCE (pm->server_side, server_side);mptcp_event (MPTCP_EVENT_CREATED , msk, ssk,GFP_ATOMIC );
@@ -91,7 +91,7 @@ bool mptcp_pm_allow_new_subflow(struct m subflows_max =mptcp_pm_get_subflows_max (msk); -pr_debug ("msk=%p subflows=%d max=%d allow=%d" , msk, pm->subflows, +pr_debug ("msk=%p subflows=%d max=%d allow=%d\n" , msk, pm->subflows, subflows_max,READ_ONCE (pm->accept_subflow));/* try to avoid acquiring the lock below */
@@ -115,7 +115,7 @@ bool mptcp_pm_allow_new_subflow(struct mstatic bool mptcp_pm_schedule_work (struct mptcp_sock *msk,enum mptcp_pm_status new_status) { -pr_debug ("msk=%p status=%x new=%lx" , msk, msk->pm.status, +pr_debug ("msk=%p status=%x new=%lx\n" , msk, msk->pm.status,BIT (new_status));if (msk->pm.status &BIT (new_status))return false;
@@ -130,7 +130,7 @@ void mptcp_pm_fully_established(struct mstruct mptcp_pm_data *pm = &msk->pm;bool announce = false; -pr_debug ("msk=%p" , msk); +pr_debug ("msk=%p\n" , msk);spin_lock_bh (&pm->lock);
@@ -154,14 +154,14 @@ void mptcp_pm_fully_established(struct mvoid mptcp_pm_connection_closed (struct mptcp_sock *msk) { -pr_debug ("msk=%p" , msk); +pr_debug ("msk=%p\n" , msk); }void mptcp_pm_subflow_established (struct mptcp_sock *msk) {struct mptcp_pm_data *pm = &msk->pm; -pr_debug ("msk=%p" , msk); +pr_debug ("msk=%p\n" , msk);if (!READ_ONCE (pm->work_pending))return ;
@@ -213,7 +213,7 @@ void mptcp_pm_add_addr_received(const ststruct mptcp_sock *msk =mptcp_sk (subflow->conn);struct mptcp_pm_data *pm = &msk->pm; -pr_debug ("msk=%p remote_id=%d accept=%d" , msk, addr->id, +pr_debug ("msk=%p remote_id=%d accept=%d\n" , msk, addr->id,READ_ONCE (pm->accept_addr));mptcp_event_addr_announced (ssk, addr);
@@ -246,7 +246,7 @@ void mptcp_pm_add_addr_echoed(struct mpt {struct mptcp_pm_data *pm = &msk->pm; -pr_debug ("msk=%p" , msk); +pr_debug ("msk=%p\n" , msk);spin_lock_bh (&pm->lock);
@@ -270,7 +270,7 @@ void mptcp_pm_rm_addr_received(struct mpstruct mptcp_pm_data *pm = &msk->pm;u8 i; -pr_debug ("msk=%p remote_ids_nr=%d" , msk, rm_list->nr); +pr_debug ("msk=%p remote_ids_nr=%d\n" , msk, rm_list->nr);for (i =0 ; i < rm_list->nr; i++)mptcp_event_addr_removed (msk, rm_list->ids[i]);
@@ -302,19 +302,19 @@ void mptcp_pm_mp_fail_received(struct sostruct mptcp_subflow_context *subflow =mptcp_subflow_ctx (sk);struct mptcp_sock *msk =mptcp_sk (subflow->conn); -pr_debug ("fail_seq=%llu" , fail_seq); +pr_debug ("fail_seq=%llu\n" , fail_seq);if (!READ_ONCE (msk->allow_infinite_fallback))return ;if (!subflow->fail_tout) { -pr_debug ("send MP_FAIL response and infinite map" ); +pr_debug ("send MP_FAIL response and infinite map\n" ); subflow->send_mp_fail =1 ; subflow->send_infinite_map =1 ;tcp_send_ack (sk); }else { -pr_debug ("MP_FAIL response received" ); +pr_debug ("MP_FAIL response received\n" );WRITE_ONCE (subflow->fail_tout,0 ); } }
net/mptcp/pm_netlink.c +10 -10
@@ -295,7 +295,7 @@ static void mptcp_pm_add_timer(struct tistruct mptcp_sock *msk = entry->sock;struct sock *sk = (struct sock *)msk; -pr_debug ("msk=%p" , msk); +pr_debug ("msk=%p\n" , msk);if (!msk)return ;
@@ -314,7 +314,7 @@ static void mptcp_pm_add_timer(struct tispin_lock_bh (&msk->pm.lock);if (!mptcp_pm_should_add_signal_addr (msk)) { -pr_debug ("retransmit ADD_ADDR id=%d" , entry->addr.id); +pr_debug ("retransmit ADD_ADDR id=%d\n" , entry->addr.id);mptcp_pm_announce_addr (msk, &entry->addr, false);mptcp_pm_add_addr_send_ack (msk); entry->retrans_times++;
@@ -395,7 +395,7 @@ void mptcp_pm_free_anno_list(struct mptcstruct sock *sk = (struct sock *)msk;LIST_HEAD (free_list); -pr_debug ("msk=%p" , msk); +pr_debug ("msk=%p\n" , msk);spin_lock_bh (&msk->pm.lock);list_splice_init (&msk->pm.anno_list, &free_list);
@@ -481,7 +481,7 @@ static void __mptcp_pm_send_ack(struct mstruct sock *ssk =mptcp_subflow_tcp_sock (subflow);bool slow; -pr_debug ("send ack for %s" , +pr_debug ("send ack for %s\n" , prio ?"mp_prio" : (mptcp_pm_should_add_signal (msk) ?"add_addr" :"rm_addr" )); slow =lock_sock_fast (ssk);
@@ -730,7 +730,7 @@ static void mptcp_pm_nl_add_addr_receive add_addr_accept_max =mptcp_pm_get_add_addr_accept_max (msk); subflows_max =mptcp_pm_get_subflows_max (msk); -pr_debug ("accepted %d:%d remote family %d" , +pr_debug ("accepted %d:%d remote family %d\n" , msk->pm.add_addr_accepted, add_addr_accept_max, msk->pm.remote.family);
@@ -803,7 +803,7 @@ int mptcp_pm_nl_mp_prio_send_ack(struct {struct mptcp_subflow_context *subflow; -pr_debug ("bkup=%d" , bkup); +pr_debug ("bkup=%d\n" , bkup);mptcp_for_each_subflow (msk, subflow) {struct sock *ssk =mptcp_subflow_tcp_sock (subflow);
@@ -834,7 +834,7 @@ static void mptcp_pm_nl_rm_addr_or_subflstruct sock *sk = (struct sock *)msk;u8 i; -pr_debug ("%s rm_list_nr %d" , +pr_debug ("%s rm_list_nr %d\n" , rm_type ==MPTCP_MIB_RMADDR ?"address" :"subflow" , rm_list->nr);msk_owned_by_me (msk);
@@ -865,7 +865,7 @@ static void mptcp_pm_nl_rm_addr_or_subflif (rm_type ==MPTCP_MIB_RMSUBFLOW && id != rm_id)continue ; -pr_debug (" -> %s rm_list_ids[%d]=%u local_id=%u remote_id=%u mpc_id=%u" , +pr_debug (" -> %s rm_list_ids[%d]=%u local_id=%u remote_id=%u mpc_id=%u\n" , rm_type ==MPTCP_MIB_RMADDR ?"address" :"subflow" , i, rm_id, id, remote_id, msk->mpc_endpoint_id);spin_unlock_bh (&msk->pm.lock);
@@ -922,7 +922,7 @@ void mptcp_pm_nl_work(struct mptcp_sockspin_lock_bh (&msk->pm.lock); -pr_debug ("msk=%p status=%x" , msk, pm->status); +pr_debug ("msk=%p status=%x\n" , msk, pm->status);if (pm->status &BIT (MPTCP_PM_ADD_ADDR_RECEIVED )) { pm->status &= ~BIT (MPTCP_PM_ADD_ADDR_RECEIVED );mptcp_pm_nl_add_addr_received (msk);
@@ -1545,7 +1545,7 @@ static int mptcp_nl_remove_subflow_and_slong s_slot =0 , s_num =0 ;struct mptcp_sock *msk; -pr_debug ("remove_id=%d" , addr->id); +pr_debug ("remove_id=%d\n" , addr->id);while ((msk =mptcp_token_iter_next (net, &s_slot, &s_num)) !=NULL ) {struct sock *sk = (struct sock *)msk;
net/mptcp/protocol.c +26 -26
206 lines not on this page · raw message
net/mptcp/protocol.h +2 -2
@@ -1092,7 +1092,7 @@ static inline bool mptcp_check_fallback(static inline void __mptcp_do_fallback (struct mptcp_sock *msk) {if (test_bit (MPTCP_FALLBACK_DONE , &msk->flags)) { -pr_debug ("TCP fallback already done (msk=%p)" , msk); +pr_debug ("TCP fallback already done (msk=%p)\n" , msk);return ; }set_bit (MPTCP_FALLBACK_DONE , &msk->flags);
@@ -1119,7 +1119,7 @@ static inline void mptcp_do_fallback(str } } -#define pr_fallback (a) pr_debug("%s:fallback to TCP (msk=%p)", __func__, a) +#define pr_fallback (a) pr_debug("%s:fallback to TCP (msk=%p)\n", __func__, a)static inline bool mptcp_check_infinite_map (struct sk_buff *skb) {
net/mptcp/sched.c +2 -2
@@ -64,7 +64,7 @@ int mptcp_register_scheduler(struct mptclist_add_tail_rcu (&sched->list, &mptcp_sched_list);spin_unlock (&mptcp_sched_list_lock); -pr_debug ("%s registered" , sched->name); +pr_debug ("%s registered\n" , sched->name);return 0 ; }
@@ -96,7 +96,7 @@ int mptcp_init_sched(struct mptcp_sock *if (msk->sched->init) msk->sched->init (msk); -pr_debug ("sched=%s" , msk->sched->name); +pr_debug ("sched=%s\n" , msk->sched->name);return 0 ; }
net/mptcp/sockopt.c +2 -2
@@ -858,7 +858,7 @@ int mptcp_setsockopt(struct sock *sk, instruct mptcp_sock *msk =mptcp_sk (sk);struct sock *ssk; -pr_debug ("msk=%p" , msk); +pr_debug ("msk=%p\n" , msk);if (level ==SOL_SOCKET )return mptcp_setsockopt_sol_socket (msk, optname, optval, optlen);
@@ -1416,7 +1416,7 @@ int mptcp_getsockopt(struct sock *sk, instruct mptcp_sock *msk =mptcp_sk (sk);struct sock *ssk; -pr_debug ("msk=%p" , msk); +pr_debug ("msk=%p\n" , msk);/* @@ the meaning of setsockopt() when the socket is connected and * there are multiple subflows is not yet defined. It is up to the
net/mptcp/subflow.c +24 -24
192 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 40/132 drm/amdgpu: Fix uninitialized variable warning in amdgpu_afmt_acr
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Jun <[email protected]>
[ Upstream commit c0d6bd3cd209419cc46ac49562bef1db65d90e70 ]
Assign value to clock to fix the warning below:
"Using uninitialized value res. Field res.clock is uninitialized"
--- drivers/gpu/drm/amd/amdgpu/amdgpu_afmt.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_afmt.c +1 -0
@@ -100,6 +100,7 @@ struct amdgpu_afmt_acr amdgpu_afmt_acr(uint32_t clock)amdgpu_afmt_calc_cts (clock, &res.cts_32khz, &res.n_32khz,32000 );amdgpu_afmt_calc_cts (clock, &res.cts_44_1khz, &res.n_44_1khz,44100 );amdgpu_afmt_calc_cts (clock, &res.cts_48khz, &res.n_48khz,48000 ); + res.clock = clock;return res; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 41/132 drm/amd/display: Assign linear_pitch_alignment even for VM
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alvin Lee <[email protected]>
[ Upstream commit 984debc133efa05e62f5aa1a7a1dd8ca0ef041f4 ]
[Description]
Assign linear_pitch_alignment so we don't cause a divide by 0 error in VM environments
--- drivers/gpu/drm/amd/display/dc/core/dc.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/amd/display/dc/core/dc.c +1 -0
@@ -1298,6 +1298,7 @@ struct dc *dc_create(const struct dc_init_data *init_params)return NULL ;if (init_params->dce_environment ==DCE_ENV_VIRTUAL_HW ) { + dc->caps.linear_pitch_alignment =64 ;if (!dc_construct_ctx (dc, init_params)) goto destruct_dc; }else {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 42/132 drm/amdgpu: fix overflowed array index read warning
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Huang <[email protected]>
[ Upstream commit ebbc2ada5c636a6a63d8316a3408753768f5aa9f ]
Clear overflowed array index read warning by cast operation.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c +2 -1
@@ -469,8 +469,9 @@ static ssize_t amdgpu_debugfs_ring_read(struct file *f, char __user *buf, size_t size, loff_t *pos) { struct amdgpu_ring *ring = file_inode(f)->i_private; -int r, i;uint32_t value, result, early[3 ]; +loff_t i; +int r;if (*pos &3 || size &3 )return -EINVAL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 43/132 drm/amdgpu/pm: Check the return value of smum_send_msg_to_smc
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Jun <[email protected]>
[ Upstream commit 579f0c21baec9e7506b6bb3f60f0a9b6d07693b4 ]
Check the return value of smum_send_msg_to_smc, otherwise we might use an uninitialized variable "now"
--- drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu10_hwmgr.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu10_hwmgr.c +6 -2
@@ -1036,7 +1036,9 @@ static int smu10_print_clock_levels(struct pp_hwmgr *hwmgr,switch (type) {case PP_SCLK : -smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetGfxclkFrequency, &now); + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetGfxclkFrequency, &now); +if (ret) +return ret;/* driver only know min/max gfx_clk, Add level 1 for all other gfx clks */ if (now == data->gfx_max_freq_limit/100 )
@@ -1057,7 +1059,9 @@ static int smu10_print_clock_levels(struct pp_hwmgr *hwmgr, i == 2 ? "*" : "");break ;case PP_MCLK : -smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetFclkFrequency, &now); + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetFclkFrequency, &now); +if (ret) +return ret;for (i =0 ; i < mclk_table->count; i++) size += sprintf(buf + size, "%d: %uMhz %s\n",
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 44/132 drm/amd/pm: fix uninitialized variable warning
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Zhang <[email protected]>
[ Upstream commit 7c836905520703dbc8b938993b6d4d718bc739f3 ]
Check the return of function smum_send_msg_to_smc as it may fail to initialize the variable.
--- drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c +1 -1
@@ -99,7 +99,7 @@ static void pp_swctf_delayed_work_handler(struct work_struct *work)struct amdgpu_device *adev = hwmgr->adev;struct amdgpu_dpm_thermal *range = &adev->pm.dpm.thermal; -uint32_t gpu_temperature, size; +uint32_t gpu_temperature, size =sizeof (gpu_temperature);int ret;/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 45/132 drm/amd/pm: fix uninitialized variable warning for smu8_hwmgr
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Huang <[email protected]>
[ Upstream commit 86df36b934640866eb249a4488abb148b985a0d9 ]
Clear warnings that using uninitialized value level when fails to get the value from SMU.
--- .../gpu/drm/amd/pm/powerplay/hwmgr/smu8_hwmgr.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu8_hwmgr.c +12 -3
@@ -584,6 +584,7 @@ static int smu8_init_uvd_limit(struct pp_hwmgr *hwmgr) hwmgr->dyn_state.uvd_clock_voltage_dependency_table;unsigned long clock =0 ;uint32_t level; +int ret;if (NULL == table || table->count <=0 )return -EINVAL ;
@@ -591,7 +592,9 @@ static int smu8_init_uvd_limit(struct pp_hwmgr *hwmgr) data->uvd_dpm.soft_min_clk =0 ; data->uvd_dpm.hard_min_clk =0 ; -smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetMaxUvdLevel, &level); + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetMaxUvdLevel, &level); +if (ret) +return ret;if (level < table->count) clock = table->entries[level].vclk;
@@ -611,6 +614,7 @@ static int smu8_init_vce_limit(struct pp_hwmgr *hwmgr) hwmgr->dyn_state.vce_clock_voltage_dependency_table;unsigned long clock =0 ;uint32_t level; +int ret;if (NULL == table || table->count <=0 )return -EINVAL ;
@@ -618,7 +622,9 @@ static int smu8_init_vce_limit(struct pp_hwmgr *hwmgr) data->vce_dpm.soft_min_clk =0 ; data->vce_dpm.hard_min_clk =0 ; -smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetMaxEclkLevel, &level); + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetMaxEclkLevel, &level); +if (ret) +return ret;if (level < table->count) clock = table->entries[level].ecclk;
@@ -638,6 +644,7 @@ static int smu8_init_acp_limit(struct pp_hwmgr *hwmgr) hwmgr->dyn_state.acp_clock_voltage_dependency_table;unsigned long clock =0 ;uint32_t level; +int ret;if (NULL == table || table->count <=0 )return -EINVAL ;
@@ -645,7 +652,9 @@ static int smu8_init_acp_limit(struct pp_hwmgr *hwmgr) data->acp_dpm.soft_min_clk =0 ; data->acp_dpm.hard_min_clk =0 ; -smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetMaxAclkLevel, &level); + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetMaxAclkLevel, &level); +if (ret) +return ret;if (level < table->count) clock = table->entries[level].acpclk;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 46/132 drm/amd/pm: fix warning using uninitialized value of max_vid_step
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Zhang <[email protected]>
[ Upstream commit 17e3bea65cdc453695b2fe4ff26d25d17f5339e9 ]
Check the return of pp_atomfwctrl_get_Voltage_table_v4 as it may fail to initialize max_vid_step
V2: change the check condition (Tim Huang)
--- drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c +4 -1
@@ -2571,8 +2571,11 @@ static int vega10_init_smc_table(struct pp_hwmgr *hwmgr) } } -pp_atomfwctrl_get_voltage_table_v4 (hwmgr,VOLTAGE_TYPE_VDDC , + result =pp_atomfwctrl_get_voltage_table_v4 (hwmgr,VOLTAGE_TYPE_VDDC ,VOLTAGE_OBJ_SVID2 , &voltage_table); +PP_ASSERT_WITH_CODE (!result, +"Failed to get voltage table!" , + return result); pp_table->MaxVidStep = voltage_table.max_vid_step; pp_table->GfxDpmVoltageMode =
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 47/132 drm/amd/pm: Fix negative array index read
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Zhang <[email protected]>
[ Upstream commit c8c19ebf7c0b202a6a2d37a52ca112432723db5f ]
Avoid using the negative values
for clk_idex as an index into an array pptable->DpmDescriptor.
V2: fix clk_index return check (Tim Huang)
--- .../gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c | 27 ++++++++++++++----- 1 file changed, 21 insertions(+), 6 deletions(-)
drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c +21 -6
@@ -1222,19 +1222,22 @@ static int navi10_get_current_clk_freq_by_table(struct smu_context *smu, value); } -static bool navi10_is_support_fine_grained_dpm (struct smu_context *smu,enum smu_clk_type clk_type) +static int navi10_is_support_fine_grained_dpm (struct smu_context *smu,enum smu_clk_type clk_type) {PPTable_t *pptable = smu->smu_table.driver_pptable;DpmDescriptor_t *dpm_desc =NULL ; -uint32_t clk_index =0 ; +int clk_index =0 ; clk_index =smu_cmn_to_asic_specific_index (smu,CMN2ASIC_MAPPING_CLK , clk_type); +if (clk_index <0 ) +return clk_index; + dpm_desc = &pptable->DpmDescriptor[clk_index];/* 0 - Fine grained DPM, 1 - Discrete DPM */ -return dpm_desc->SnapToDiscrete ==0 ; +return dpm_desc->SnapToDiscrete ==0 ?1 :0 ; }static inline bool navi10_od_feature_is_supported (struct smu_11_0_overdrive_table *od_table,enum SMU_11_0_ODFEATURE_CAP cap)
@@ -1290,7 +1293,11 @@ static int navi10_emit_clk_levels(struct smu_context *smu,if (ret)return ret; -if (!navi10_is_support_fine_grained_dpm (smu, clk_type)) { + ret =navi10_is_support_fine_grained_dpm (smu, clk_type); +if (ret <0 ) +return ret; + +if (!ret) {for (i =0 ; i < count; i++) { ret =smu_v11_0_get_dpm_freq_by_index (smu, clk_type, i, &value);
@@ -1499,7 +1506,11 @@ static int navi10_print_clk_levels(struct smu_context *smu,if (ret)return size; -if (!navi10_is_support_fine_grained_dpm (smu, clk_type)) { + ret =navi10_is_support_fine_grained_dpm (smu, clk_type); +if (ret <0 ) +return ret; + +if (!ret) {for (i =0 ; i < count; i++) { ret =smu_v11_0_get_dpm_freq_by_index (smu, clk_type, i, &value);if (ret)
@@ -1668,7 +1679,11 @@ static int navi10_force_clk_levels(struct smu_context *smu,case SMU_UCLK :case SMU_FCLK :/* There is only 2 levels for fine grained DPM */ -if (navi10_is_support_fine_grained_dpm (smu, clk_type)) { + ret =navi10_is_support_fine_grained_dpm (smu, clk_type); +if (ret <0 ) +return ret; + +if (ret) { soft_max_level = (soft_max_level >=1 ?1 :0 ); soft_min_level = (soft_min_level >=1 ?1 :0 ); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 48/132 drm/amd/pm: fix the Out-of-bounds read warning
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Zhang <[email protected]>
[ Upstream commit 12c6967428a099bbba9dfd247bb4322a984fcc0b ]
using index i - 1U may beyond element index for mc_data[] when i = 0.
--- drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c +3 -2
@@ -73,8 +73,9 @@ static int atomctrl_retrieve_ac_timing( j++; }else if ((table->mc_reg_address[i].uc_pre_reg_data &LOW_NIBBLE_MASK ) ==DATA_EQU_PREV ) { - table->mc_reg_table_entry[num_ranges].mc_data[i] = - table->mc_reg_table_entry[num_ranges].mc_data[i-1 ]; +if (i) + table->mc_reg_table_entry[num_ranges].mc_data[i] = + table->mc_reg_table_entry[num_ranges].mc_data[i-1 ]; } } num_ranges++;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 49/132 drm/amd/pm: fix uninitialized variable warnings for vega10_hwmgr
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Huang <[email protected]>
[ Upstream commit 5fa7d540d95d97ddc021a74583f6b3da4df9c93a ]
Clear warnings that using uninitialized variable when fails to get the valid value from SMU.
--- .../drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | 46 ++++++++++++++----- .../amd/pm/powerplay/smumgr/vega10_smumgr.c | 6 ++- 2 files changed, 39 insertions(+), 13 deletions(-)
drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c +34 -12
@@ -354,13 +354,13 @@ static int vega10_odn_initial_default_setting(struct pp_hwmgr *hwmgr)return 0 ; } -static void vega10_init_dpm_defaults (struct pp_hwmgr *hwmgr) +static int vega10_init_dpm_defaults (struct pp_hwmgr *hwmgr) {struct vega10_hwmgr *data = hwmgr->backend; -int i;uint32_t sub_vendor_id, hw_revision;uint32_t top32, bottom32;struct amdgpu_device *adev = hwmgr->adev; +int ret, i;vega10_initialize_power_tune_defaults (hwmgr);
@@ -485,9 +485,12 @@ static void vega10_init_dpm_defaults(struct pp_hwmgr *hwmgr)if (data->registry_data.vr0hot_enabled) data->smu_features[GNLD_VR0HOT ].supported = true; -smum_send_msg_to_smc (hwmgr, + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetSmuVersion, &hwmgr->smu_version); +if (ret) +return ret; +/* ACG firmware has major version 5 */ if ((hwmgr->smu_version &0xff000000 ) ==0x5000000 ) data->smu_features[GNLD_ACG ].supported = true;
@@ -505,10 +508,16 @@ static void vega10_init_dpm_defaults(struct pp_hwmgr *hwmgr) data->smu_features[GNLD_PCC_LIMIT ].supported = true;/* Get the SN to turn into a Unique ID */ -smum_send_msg_to_smc (hwmgr, PPSMC_MSG_ReadSerialNumTop32, &top32); -smum_send_msg_to_smc (hwmgr, PPSMC_MSG_ReadSerialNumBottom32, &bottom32); + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_ReadSerialNumTop32, &top32); +if (ret) +return ret; + + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_ReadSerialNumBottom32, &bottom32); +if (ret) +return ret; adev->unique_id = ((uint64_t )bottom32 <<32 ) | top32; +return 0 ; }#ifdef PPLIB_VEGA10_EVV_SUPPORT
@@ -882,7 +891,9 @@ static int vega10_hwmgr_backend_init(struct pp_hwmgr *hwmgr)vega10_set_features_platform_caps (hwmgr); -vega10_init_dpm_defaults (hwmgr); + result =vega10_init_dpm_defaults (hwmgr); +if (result) +return result;#ifdef PPLIB_VEGA10_EVV_SUPPORT /* Get leakage voltage based on leakage ID. */
@@ -3913,11 +3924,14 @@ static int vega10_get_gpu_power(struct pp_hwmgr *hwmgr, uint32_t *query) {uint32_t value; +int ret;if (!query)return -EINVAL ; -smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetCurrPkgPwr, &value); + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetCurrPkgPwr, &value); +if (ret) +return ret;/* SMC returning actual watts, keep consistent with legacy asics, low 8 bit as 8 fractional bits */ *query = value <<8 ;
@@ -4813,14 +4827,16 @@ static int vega10_print_clock_levels(struct pp_hwmgr *hwmgr,uint32_t gen_speed, lane_width, current_gen_speed, current_lane_width;PPTable_t *pptable = &(data->smc_state_table.pp_table); -int i, now, size =0 , count =0 ; +int i, ret, now, size =0 , count =0 ;switch (type) {case PP_SCLK :if (data->registry_data.sclk_dpm_key_disabled)break ; -smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetCurrentGfxclkIndex, &now); + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetCurrentGfxclkIndex, &now); +if (ret) +break ;if (hwmgr->pp_one_vf && (hwmgr->dpm_level ==AMD_DPM_FORCED_LEVEL_PROFILE_PEAK ))
@@ -4836,7 +4852,9 @@ static int vega10_print_clock_levels(struct pp_hwmgr *hwmgr,if (data->registry_data.mclk_dpm_key_disabled)break ; -smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetCurrentUclkIndex, &now); + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetCurrentUclkIndex, &now); +if (ret) +break ;for (i =0 ; i < mclk_table->count; i++) size += sprintf(buf + size, "%d: %uMhz %s\n",
@@ -4847,7 +4865,9 @@ static int vega10_print_clock_levels(struct pp_hwmgr *hwmgr,if (data->registry_data.socclk_dpm_key_disabled)break ; -smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetCurrentSocclkIndex, &now); + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetCurrentSocclkIndex, &now); +if (ret) +break ;for (i =0 ; i < soc_table->count; i++) size += sprintf(buf + size, "%d: %uMhz %s\n",
@@ -4858,8 +4878,10 @@ static int vega10_print_clock_levels(struct pp_hwmgr *hwmgr,if (data->registry_data.dcefclk_dpm_key_disabled)break ; -smum_send_msg_to_smc_with_parameter (hwmgr, + ret =smum_send_msg_to_smc_with_parameter (hwmgr, PPSMC_MSG_GetClockFreqMHz,CLK_DCEFCLK , &now); +if (ret) +break ;for (i =0 ; i < dcef_table->count; i++) size += sprintf(buf + size, "%d: %uMhz %s\n",
drivers/gpu/drm/amd/pm/powerplay/smumgr/vega10_smumgr.c +5 -1
@@ -130,13 +130,17 @@ int vega10_get_enabled_smc_features(struct pp_hwmgr *hwmgr, uint64_t *features_enabled) {uint32_t enabled_features; +int ret;if (features_enabled ==NULL )return -EINVAL ; -smum_send_msg_to_smc (hwmgr, + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetEnabledSmuFeatures, &enabled_features); +if (ret) +return ret; + *features_enabled = enabled_features;return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 50/132 drm/amdgpu: avoid reading vf2pf info size from FB
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhigang Luo <[email protected]>
[ Upstream commit 3bcc0ee14768d886cedff65da72d83d375a31a56 ]
VF can't access FB when host is doing mode1 reset. Using sizeof to get vf2pf info size, instead of reading it from vf2pf header stored in FB.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c +1 -1
@@ -615,7 +615,7 @@ static int amdgpu_virt_write_vf2pf_data(struct amdgpu_device *adev) vf2pf_info->dummy_page_addr = (uint64_t )adev->dummy_page_addr; vf2pf_info->checksum =amd_sriov_msg_checksum ( - vf2pf_info, vf2pf_info->header.size,0 ,0 ); + vf2pf_info,sizeof (*vf2pf_info),0 ,0 );return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 51/132 drm/amd/display: Check gpio_id before used as array index
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit 2a5626eeb3b5eec7a36886f9556113dd93ec8ed6 ]
[WHY & HOW]GPIO_ID_UNKNOWN (-1) is not a valid value for array index and therefore should be checked in advance.
This fixes 5 OVERRUN issues reported by Coverity.
--- drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c +11 -2
@@ -239,6 +239,9 @@ static bool is_pin_busy( enum gpio_id id, uint32_t en) { +if (id ==GPIO_ID_UNKNOWN ) +return false; +return service->busyness[id][en]; }
@@ -247,6 +250,9 @@ static void set_pin_busy( enum gpio_id id, uint32_t en) { +if (id ==GPIO_ID_UNKNOWN ) +return ; + service->busyness[id][en] = true; }
@@ -255,6 +261,9 @@ static void set_pin_free( enum gpio_id id, uint32_t en) { +if (id ==GPIO_ID_UNKNOWN ) +return ; + service->busyness[id][en] = false; }
@@ -263,7 +272,7 @@ enum gpio_result dal_gpio_service_lock( enum gpio_id id, uint32_t en) { -if (!service->busyness[id]) { +if (id !=GPIO_ID_UNKNOWN && !service->busyness[id]) {ASSERT_CRITICAL (false);return GPIO_RESULT_OPEN_FAILED ; }
@@ -277,7 +286,7 @@ enum gpio_result dal_gpio_service_unlock( enum gpio_id id, uint32_t en) { -if (!service->busyness[id]) { +if (id !=GPIO_ID_UNKNOWN && !service->busyness[id]) {ASSERT_CRITICAL (false);return GPIO_RESULT_OPEN_FAILED ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 52/132 drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hersen Wu <[email protected]>
[ Upstream commit 84723eb6068c50610c5c0893980d230d7afa2105 ]
[Why]
Coverity reports OVERRUN warning. Should abort amdgpu_dm initialize.
[How]
Return failure to amdgpu_dm_init.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +4 -1
@@ -4357,7 +4357,10 @@ static int amdgpu_dm_initialize_drm_device(struct amdgpu_device *adev)/* There is one primary plane per CRTC */ primary_planes = dm->dc->caps.max_streams; -ASSERT (primary_planes <=AMDGPU_MAX_PLANES ); +if (primary_planes >AMDGPU_MAX_PLANES ) { +DRM_ERROR ("DM: Plane nums out of 6 planes\n" ); +return -EINVAL ; + }/* * Initialize primary planes, implicit planes for legacy IOCTLS.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 53/132 drm/amd/display: Check index for aux_rd_interval before using
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit 9ba2ea6337b4f159aecb177555a6a81da92d302e ]
aux_rd_interval has size of 7 and should be checked.
This fixes 3 OVERRUN and 1 INTEGER_OVERFLOW issues reported by Coverity.
--- .../gpu/drm/amd/display/dc/link/protocols/link_dp_training.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c +2 -2
@@ -914,10 +914,10 @@ static enum dc_status configure_lttpr_mode_non_transparent(/* Driver does not need to train the first hop. Skip DPCD read and clear * AUX_RD_INTERVAL for DPTX-to-DPIA hop. */ -if (link->ep_type ==DISPLAY_ENDPOINT_USB4_DPIA ) +if (link->ep_type ==DISPLAY_ENDPOINT_USB4_DPIA && repeater_cnt >0 && repeater_cnt <MAX_REPEATER_CNT ) link->dpcd_caps.lttpr_caps.aux_rd_interval[--repeater_cnt] =0 ; -for (repeater_id = repeater_cnt; repeater_id >0 ; repeater_id--) { +for (repeater_id = repeater_cnt; repeater_id >0 && repeater_id <MAX_REPEATER_CNT ; repeater_id--) { aux_interval_address =DP_TRAINING_AUX_RD_INTERVAL_PHY_REPEATER1 + ((DP_REPEATER_CONFIGURATION_AND_STATUS_SIZE ) * (repeater_id -1 )); core_link_read_dpcd(
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 54/132 drm/amd/display: Add array index check for hdcp ddc access
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hersen Wu <[email protected]>
[ Upstream commit 4e70c0f5251c25885c31ee84a31f99a01f7cf50e ]
[Why]
Coverity reports OVERRUN warning. Do not check if array index valid.
[How]
Check msg_id valid and valid array index.
--- .../drm/amd/display/modules/hdcp/hdcp_ddc.c | 28 ++++++++++++++++--- 1 file changed, 24 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c +24 -4
@@ -156,11 +156,16 @@ static enum mod_hdcp_status read(struct mod_hdcp *hdcp,uint32_t cur_size =0 ;uint32_t data_offset =0 ; -if (msg_id ==MOD_HDCP_MESSAGE_ID_INVALID ) { +if (msg_id ==MOD_HDCP_MESSAGE_ID_INVALID || + msg_id >=MOD_HDCP_MESSAGE_ID_MAX )return MOD_HDCP_STATUS_DDC_FAILURE ; - }if (is_dp_hdcp (hdcp)) { +int num_dpcd_addrs =sizeof (hdcp_dpcd_addrs) / +sizeof (hdcp_dpcd_addrs[0 ]); +if (msg_id >= num_dpcd_addrs) +return MOD_HDCP_STATUS_DDC_FAILURE ; +while (buf_len >0 ) { cur_size =MIN (buf_len,HDCP_MAX_AUX_TRANSACTION_SIZE ); success = hdcp->config.ddc.funcs.read_dpcd(hdcp->config.ddc.handle,
@@ -175,6 +180,11 @@ static enum mod_hdcp_status read(struct mod_hdcp *hdcp, data_offset += cur_size; } }else { +int num_i2c_offsets =sizeof (hdcp_i2c_offsets) / +sizeof (hdcp_i2c_offsets[0 ]); +if (msg_id >= num_i2c_offsets) +return MOD_HDCP_STATUS_DDC_FAILURE ; + success = hdcp->config.ddc.funcs.read_i2c( hdcp->config.ddc.handle, HDCP_I2C_ADDR,
@@ -219,11 +229,16 @@ static enum mod_hdcp_status write(struct mod_hdcp *hdcp,uint32_t cur_size =0 ;uint32_t data_offset =0 ; -if (msg_id ==MOD_HDCP_MESSAGE_ID_INVALID ) { +if (msg_id ==MOD_HDCP_MESSAGE_ID_INVALID || + msg_id >=MOD_HDCP_MESSAGE_ID_MAX )return MOD_HDCP_STATUS_DDC_FAILURE ; - }if (is_dp_hdcp (hdcp)) { +int num_dpcd_addrs =sizeof (hdcp_dpcd_addrs) / +sizeof (hdcp_dpcd_addrs[0 ]); +if (msg_id >= num_dpcd_addrs) +return MOD_HDCP_STATUS_DDC_FAILURE ; +while (buf_len >0 ) { cur_size =MIN (buf_len,HDCP_MAX_AUX_TRANSACTION_SIZE ); success = hdcp->config.ddc.funcs.write_dpcd(
@@ -239,6 +254,11 @@ static enum mod_hdcp_status write(struct mod_hdcp *hdcp, data_offset += cur_size; } }else { +int num_i2c_offsets =sizeof (hdcp_i2c_offsets) / +sizeof (hdcp_i2c_offsets[0 ]); +if (msg_id >= num_i2c_offsets) +return MOD_HDCP_STATUS_DDC_FAILURE ; + hdcp->buf[0 ] = hdcp_i2c_offsets[msg_id];memmove (&hdcp->buf[1 ], buf, buf_len); success = hdcp->config.ddc.funcs.write_i2c(
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 55/132 drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[]
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit b38a4815f79b87efb196cd5121579fc51e29a7fb ]
[WHY & HOW]num_valid_sets needs to be checked to avoid a negative index when accessing reader_wm_sets[num_valid_sets - 1].
This fixes an OVERRUN issue reported by Coverity.
--- drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c +2 -1
@@ -484,7 +484,8 @@ static void build_watermark_ranges(struct clk_bw_params *bw_params, struct pp_sm ranges->reader_wm_sets[num_valid_sets].max_fill_clk_mhz =PP_SMU_WM_SET_RANGE_CLK_UNCONSTRAINED_MAX ;/* Modify previous watermark range to cover up to max */ - ranges->reader_wm_sets[num_valid_sets -1 ].max_fill_clk_mhz =PP_SMU_WM_SET_RANGE_CLK_UNCONSTRAINED_MAX ; +if (num_valid_sets >0 ) + ranges->reader_wm_sets[num_valid_sets -1 ].max_fill_clk_mhz =PP_SMU_WM_SET_RANGE_CLK_UNCONSTRAINED_MAX ; } num_valid_sets++; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 56/132 drm/amd/display: Check msg_id before processing transcation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit fa71face755e27dc44bc296416ebdf2c67163316 ]
[WHY & HOW]HDCP_MESSAGE_ID_INVALID (-1) is not a valid msg_id nor is it a valid array index, and it needs checking before used.
This fixes 4 OVERRUN issues reported by Coverity.
--- drivers/gpu/drm/amd/display/dc/hdcp/hdcp_msg.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/hdcp/hdcp_msg.c +15 -2
@@ -130,13 +130,21 @@ static bool hdmi_14_process_transaction(const uint8_t hdcp_i2c_addr_link_primary =0x3a ;/* 0x74 >> 1*/ const uint8_t hdcp_i2c_addr_link_secondary =0x3b ;/* 0x76 >> 1*/ struct i2c_command i2c_command; -uint8_t offset = hdcp_i2c_offsets[message_info->msg_id]; +uint8_t offset;struct i2c_payload i2c_payloads[] = { - { true,0 ,1 , &offset }, + { true,0 ,1 ,0 },/* actual hdcp payload, will be filled later, zeroed for now*/ {0 } }; +if (message_info->msg_id ==HDCP_MESSAGE_ID_INVALID ) { +DC_LOG_ERROR ("%s: Invalid message_info msg_id - %d\n" , __func__, message_info->msg_id); +return false; + } + + offset = hdcp_i2c_offsets[message_info->msg_id]; + i2c_payloads[0 ].data = &offset; +switch (message_info->link) {case HDCP_LINK_SECONDARY : i2c_payloads[0 ].address = hdcp_i2c_addr_link_secondary;
@@ -310,6 +318,11 @@ static bool dp_11_process_transaction( struct dc_link *link, struct hdcp_protection_message *message_info) { +if (message_info->msg_id ==HDCP_MESSAGE_ID_INVALID ) { +DC_LOG_ERROR ("%s: Invalid message_info msg_id - %d\n" , __func__, message_info->msg_id); +return false; + } + return dpcd_access_helper( link, message_info->length,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 57/132 drm/amd/display: Fix Coverity INTERGER_OVERFLOW within construct_integrated_info
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hersen Wu <[email protected]>
[ Upstream commit 176abbcc71952e23009a6ed194fd203b99646884 ]
[Why]
For substrcation, coverity reports integer overflow warning message when variable type is uint32_t.
[How]
Change varaible type to int32_t.
--- drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | 4 ++-- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 7 +++++-- 2 files changed, 7 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/display/dc/bios/bios_parser.c +2 -2
@@ -2552,8 +2552,8 @@ static enum bp_result construct_integrated_info(/* Sort voltage table from low to high*/ if (result ==BP_RESULT_OK ) { -uint32_t i; -uint32_t j; +int32_t i; +int32_t j;for (i =1 ; i <NUMBER_OF_DISP_CLK_VOLTAGE ; ++i) {for (j = i; j >0 ; --j) {
drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c +5 -2
@@ -2935,8 +2935,11 @@ static enum bp_result construct_integrated_info(struct atom_common_table_header *header;struct atom_data_revision revision; -uint32_t i; -uint32_t j; +int32_t i; +int32_t j; + +if (!info) +return result;if (info &&DATA_TABLES (integratedsysteminfo)) { header = GET_IMAGE(struct atom_common_table_header,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 58/132 drm/amd/display: Fix Coverity INTEGER_OVERFLOW within dal_gpio_service_create
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hersen Wu <[email protected]>
[ Upstream commit c6077aa66fa230d12f37fef01161ef080d13b726 ]
[Why]
For subtraction, coverity reports integer overflow warning message when variable type is uint32_t.
[How]
Change variable type to int32_t.
--- drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c +2 -2
@@ -56,7 +56,7 @@ struct gpio_service *dal_gpio_service_create( struct dc_context *ctx) {struct gpio_service *service; -uint32_t index_of_id; +int32_t index_of_id; service =kzalloc (sizeof (struct gpio_service ),GFP_KERNEL );
@@ -112,7 +112,7 @@ struct gpio_service *dal_gpio_service_create(return service; failure_2: -while (index_of_id) { +while (index_of_id >0 ) { --index_of_id;kfree (service->busyness[index_of_id]); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 59/132 drm/amd/display: Spinlock before reading event
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit ae13c8a5cff92015b9a3eb7cee65ebc75859487f ]
[WHY & HOW]
A read of acrtc_attach->base.state->event was not locked so moving it inside the spinlock.
This fixes a LOCK_EVASION issue reported by Coverity.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +6 -8
@@ -8286,15 +8286,13 @@ static void amdgpu_dm_commit_planes(struct drm_atomic_state *state, bundle->stream_update.vrr_infopacket = &acrtc_state->stream->vrr_infopacket; } - }else if (cursor_update && acrtc_state->active_planes >0 && - acrtc_attach->base.state->event) { -drm_crtc_vblank_get (pcrtc); - + }else if (cursor_update && acrtc_state->active_planes >0 ) {spin_lock_irqsave (&pcrtc->dev->event_lock, flags); - - acrtc_attach->event = acrtc_attach->base.state->event; - acrtc_attach->base.state->event =NULL ; - +if (acrtc_attach->base.state->event) { +drm_crtc_vblank_get (pcrtc); + acrtc_attach->event = acrtc_attach->base.state->event; + acrtc_attach->base.state->event =NULL ; + }spin_unlock_irqrestore (&pcrtc->dev->event_lock, flags); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 60/132 drm/amd/display: Fix Coverity INTEGER_OVERFLOW within decide_fallback_link_setting_max_bw_policy
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hersen Wu <[email protected]>
[ Upstream commit 83c0c8361347cf43937348e8ca0a487679c003ae ]
[Why]
For addtion (uint8_t) variable + constant 1, coverity generates message below:
Truncation due to cast operation on "cur_idx + 1" from 32 to 8 bits.
Then Coverity assume result is 32 bits value be saved into 8 bits variable. When result is used as index to access array, Coverity suspects index invalid.
[How]
Change varaible type to uint32_t.
--- .../gpu/drm/amd/display/dc/link/protocols/link_dp_capability.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_capability.c +1 -1
@@ -528,7 +528,7 @@ static bool decide_fallback_link_setting_max_bw_policy(struct dc_link_settings *cur, enum link_training_result training_result) { - uint8_t cur_idx = 0, next_idx; + uint32_t cur_idx = 0, next_idx;bool found = false;if (training_result ==LINK_TRAINING_ABORT )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 61/132 drm/amd/display: Ensure index calculation will not overflow
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit 8e2734bf444767fed787305ccdcb36a2be5301a2 ]
[WHY & HOW]
Make sure vmid0p72_idx, vnom0p8_idx and vmax0p9_idx calculation will never overflow and exceess array size.
This fixes 3 OVERRUN and 1 INTEGER_OVERFLOW issues reported by Coverity.
--- drivers/gpu/drm/amd/display/dc/dml/calcs/dcn_calcs.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/display/dc/dml/calcs/dcn_calcs.c +3 -4
@@ -1453,10 +1453,9 @@ void dcn_bw_update_from_pplib_fclks(ASSERT (fclks->num_levels); vmin0p65_idx =0 ; - vmid0p72_idx = fclks->num_levels - - (fclks->num_levels >2 ?3 : (fclks->num_levels >1 ?2 :1 )); - vnom0p8_idx = fclks->num_levels - (fclks->num_levels >1 ?2 :1 ); - vmax0p9_idx = fclks->num_levels -1 ; + vmid0p72_idx = fclks->num_levels >2 ? fclks->num_levels -3 :0 ; + vnom0p8_idx = fclks->num_levels >1 ? fclks->num_levels -2 :0 ; + vmax0p9_idx = fclks->num_levels >0 ? fclks->num_levels -1 :0 ; dc->dcn_soc->fabric_and_dram_bandwidth_vmin0p65 =32 * (fclks->data[vmin0p65_idx].clocks_in_khz /1000.0 ) /1000.0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 62/132 drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hersen Wu <[email protected]>
[ Upstream commit a54f7e866cc73a4cb71b8b24bb568ba35c8969df ]
[Why]
Coverity reports Memory - illegal accesses.
[How]
Skip inactive planes.
--- drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.c +6 -1
@@ -1099,8 +1099,13 @@ void ModeSupportAndSystemConfiguration(struct display_mode_lib *mode_lib)// Total Available Pipes Support Check for (k =0 ; k < mode_lib->vba.NumberOfActivePlanes; ++k) { - total_pipes += mode_lib->vba.DPPPerPlane[k]; pipe_idx =get_pipe_idx (mode_lib, k); +if (pipe_idx ==-1 ) { +ASSERT (0 ); +continue ;// skip inactive planes + } + total_pipes += mode_lib->vba.DPPPerPlane[k]; +if (mode_lib->vba.cache_pipes[pipe_idx].clks_cfg.dppclk_mhz >0.0 ) mode_lib->vba.DPPCLK[k] = mode_lib->vba.cache_pipes[pipe_idx].clks_cfg.dppclk_mhz;else
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 63/132 drm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hersen Wu <[email protected]>
[ Upstream commit 188fd1616ec43033cedbe343b6579e9921e2d898 ]
[Why]
Coverity reports OVERRUN warning. soc.num_states could be 40. But array range of bw_params->clk_table.entries is 8.
[How]
Assert if soc.num_states greater than 8.
--- drivers/gpu/drm/amd/display/dc/dml/dcn302/dcn302_fpu.c | 10 ++++++++++ drivers/gpu/drm/amd/display/dc/dml/dcn303/dcn303_fpu.c | 10 ++++++++++ drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 10 ++++++++++ drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c | 10 ++++++++++ 4 files changed, 40 insertions(+)
drivers/gpu/drm/amd/display/dc/dml/dcn302/dcn302_fpu.c +10 -0
@@ -304,6 +304,16 @@ void dcn302_fpu_update_bw_bounding_box(struct dc *dc, struct clk_bw_params *bw_p dram_speed_mts[num_states++] = bw_params->clk_table.entries[j++].memclk_mhz *16 ; } +/* bw_params->clk_table.entries[MAX_NUM_DPM_LVL]. +* MAX_NUM_DPM_LVL is 8. +* dcn3_02_soc.clock_limits[DC__VOLTAGE_STATES]. +* DC__VOLTAGE_STATES is 40. +*/ +if (num_states >MAX_NUM_DPM_LVL ) { +ASSERT (0 ); +return ; + } + dcn3_02_soc.num_states = num_states;for (i =0 ; i < dcn3_02_soc.num_states; i++) { dcn3_02_soc.clock_limits[i].state = i;
drivers/gpu/drm/amd/display/dc/dml/dcn303/dcn303_fpu.c +10 -0
@@ -299,6 +299,16 @@ void dcn303_fpu_update_bw_bounding_box(struct dc *dc, struct clk_bw_params *bw_p dram_speed_mts[num_states++] = bw_params->clk_table.entries[j++].memclk_mhz *16 ; } +/* bw_params->clk_table.entries[MAX_NUM_DPM_LVL]. +* MAX_NUM_DPM_LVL is 8. +* dcn3_02_soc.clock_limits[DC__VOLTAGE_STATES]. +* DC__VOLTAGE_STATES is 40. +*/ +if (num_states >MAX_NUM_DPM_LVL ) { +ASSERT (0 ); +return ; + } + dcn3_03_soc.num_states = num_states;for (i =0 ; i < dcn3_03_soc.num_states; i++) { dcn3_03_soc.clock_limits[i].state = i;
drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c +10 -0
@@ -2885,6 +2885,16 @@ void dcn32_update_bw_bounding_box_fpu(struct dc *dc, struct clk_bw_params *bw_pa dram_speed_mts[num_states++] = bw_params->clk_table.entries[j++].memclk_mhz *16 ; } +/* bw_params->clk_table.entries[MAX_NUM_DPM_LVL]. +* MAX_NUM_DPM_LVL is 8. +* dcn3_02_soc.clock_limits[DC__VOLTAGE_STATES]. +* DC__VOLTAGE_STATES is 40. +*/ +if (num_states >MAX_NUM_DPM_LVL ) { +ASSERT (0 ); +return ; + } + dcn3_2_soc.num_states = num_states;for (i =0 ; i < dcn3_2_soc.num_states; i++) { dcn3_2_soc.clock_limits[i].state = i;
drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c +10 -0
@@ -789,6 +789,16 @@ void dcn321_update_bw_bounding_box_fpu(struct dc *dc, struct clk_bw_params *bw_p dram_speed_mts[num_states++] = bw_params->clk_table.entries[j++].memclk_mhz *16 ; } +/* bw_params->clk_table.entries[MAX_NUM_DPM_LVL]. +* MAX_NUM_DPM_LVL is 8. +* dcn3_02_soc.clock_limits[DC__VOLTAGE_STATES]. +* DC__VOLTAGE_STATES is 40. +*/ +if (num_states >MAX_NUM_DPM_LVL ) { +ASSERT (0 ); +return ; + } + dcn3_21_soc.num_states = num_states;for (i =0 ; i < dcn3_21_soc.num_states; i++) { dcn3_21_soc.clock_limits[i].state = i;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 64/132 drm/amd/amdgpu: Check tbo resource pointer
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Asad Kamal <[email protected]>
[ Upstream commit 6cd2b872643bb29bba01a8ac739138db7bd79007 ]
Validate tbo resource pointer, skip if NULL
--- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +2 -1
@@ -4480,7 +4480,8 @@ static int amdgpu_device_recover_vram(struct amdgpu_device *adev) shadow = vmbo->shadow;/* No need to recover an evicted BO */ -if (shadow->tbo.resource->mem_type !=TTM_PL_TT || +if (!shadow->tbo.resource || + shadow->tbo.resource->mem_type !=TTM_PL_TT || shadow->tbo.resource->start ==AMDGPU_BO_INVALID_OFFSET || shadow->parent->tbo.resource->mem_type !=TTM_PL_VRAM )continue ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 65/132 drm/amd/pm: fix uninitialized variable warnings for vangogh_ppt
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Huang <[email protected]>
[ Upstream commit b2871de6961d24d421839fbfa4aa3008ec9170d5 ]
1. Fix a issue that using uninitialized mask to get the ultimate frequency.
2. Check return of smu_cmn_send_smc_msg_with_param to avoid using uninitialized variable residency.
--- drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c +14 -0
@@ -1009,6 +1009,18 @@ static int vangogh_get_dpm_ultimate_freq(struct smu_context *smu, } }if (min) { + ret =vangogh_get_profiling_clk_mask (smu, +AMD_DPM_FORCED_LEVEL_PROFILE_MIN_MCLK , +NULL , +NULL , + &mclk_mask, + &fclk_mask, + &soc_mask); +if (ret) + goto failed; + + vclk_mask = dclk_mask =0 ; +switch (clk_type) {case SMU_UCLK :case SMU_MCLK :
@@ -2481,6 +2493,8 @@ static u32 vangogh_set_gfxoff_residency(struct smu_context *smu, bool start) ret =smu_cmn_send_smc_msg_with_param (smu, SMU_MSG_LogGfxOffResidency, start, &residency); +if (ret) +return ret;if (!start) adev->gfx.gfx_off_residency = residency;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 66/132 drm/amdgpu/pm: Fix uninitialized variable warning for smu10
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Jun <[email protected]>
[ Upstream commit 336c8f558d596699d3d9814a45600139b2f23f27 ]
Check return value of smum_send_msg_to_smc to fix uninitialized variable varning
--- .../drm/amd/pm/powerplay/hwmgr/smu10_hwmgr.c | 21 +++++++++++++---- .../drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c | 20 ++++++++++++---- .../drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c | 23 ++++++++++++++----- 3 files changed, 48 insertions(+), 16 deletions(-)
drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu10_hwmgr.c +16 -5
@@ -1554,7 +1554,10 @@ static int smu10_set_fine_grain_clk_vol(struct pp_hwmgr *hwmgr, }if (input[0 ] ==0 ) { -smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetMinGfxclkFrequency, &min_freq); + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetMinGfxclkFrequency, &min_freq); +if (ret) +return ret; +if (input[1 ] < min_freq) {pr_err ("Fine grain setting minimum sclk (%ld) MHz is less than the minimum allowed (%d) MHz\n" , input[1 ], min_freq);
@@ -1562,7 +1565,10 @@ static int smu10_set_fine_grain_clk_vol(struct pp_hwmgr *hwmgr, } smu10_data->gfx_actual_soft_min_freq = input[1 ]; }else if (input[0 ] ==1 ) { -smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetMaxGfxclkFrequency, &max_freq); + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetMaxGfxclkFrequency, &max_freq); +if (ret) +return ret; +if (input[1 ] > max_freq) {pr_err ("Fine grain setting maximum sclk (%ld) MHz is greater than the maximum allowed (%d) MHz\n" , input[1 ], max_freq);
@@ -1577,10 +1583,15 @@ static int smu10_set_fine_grain_clk_vol(struct pp_hwmgr *hwmgr,pr_err ("Input parameter number not correct\n" );return -EINVAL ; } -smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetMinGfxclkFrequency, &min_freq); -smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetMaxGfxclkFrequency, &max_freq); - + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetMinGfxclkFrequency, &min_freq); +if (ret) +return ret; smu10_data->gfx_actual_soft_min_freq = min_freq; + + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetMaxGfxclkFrequency, &max_freq); +if (ret) +return ret; + smu10_data->gfx_actual_soft_max_freq = max_freq; }else if (type ==PP_OD_COMMIT_DPM_TABLE ) {if (size !=0 ) {
drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c +15 -5
@@ -293,12 +293,12 @@ static int vega12_set_features_platform_caps(struct pp_hwmgr *hwmgr)return 0 ; } -static void vega12_init_dpm_defaults (struct pp_hwmgr *hwmgr) +static int vega12_init_dpm_defaults (struct pp_hwmgr *hwmgr) {struct vega12_hwmgr *data = (struct vega12_hwmgr *)(hwmgr->backend);struct amdgpu_device *adev = hwmgr->adev;uint32_t top32, bottom32; -int i; +int i, ret; data->smu_features[GNLD_DPM_PREFETCHER ].smu_feature_id =FEATURE_DPM_PREFETCHER_BIT ;
@@ -364,10 +364,16 @@ static void vega12_init_dpm_defaults(struct pp_hwmgr *hwmgr) }/* Get the SN to turn into a Unique ID */ -smum_send_msg_to_smc (hwmgr, PPSMC_MSG_ReadSerialNumTop32, &top32); -smum_send_msg_to_smc (hwmgr, PPSMC_MSG_ReadSerialNumBottom32, &bottom32); + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_ReadSerialNumTop32, &top32); +if (ret) +return ret; + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_ReadSerialNumBottom32, &bottom32); +if (ret) +return ret; adev->unique_id = ((uint64_t )bottom32 <<32 ) | top32; + +return 0 ; }static int vega12_set_private_data_based_on_pptable (struct pp_hwmgr *hwmgr)
@@ -410,7 +416,11 @@ static int vega12_hwmgr_backend_init(struct pp_hwmgr *hwmgr)vega12_set_features_platform_caps (hwmgr); -vega12_init_dpm_defaults (hwmgr); + result =vega12_init_dpm_defaults (hwmgr); +if (result) { +pr_err ("%s failed\n" , __func__); +return result; + }/* Parse pptable data read from VBIOS */ vega12_set_private_data_based_on_pptable (hwmgr);
drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c +17 -6
@@ -328,12 +328,12 @@ static int vega20_set_features_platform_caps(struct pp_hwmgr *hwmgr)return 0 ; } -static void vega20_init_dpm_defaults (struct pp_hwmgr *hwmgr) +static int vega20_init_dpm_defaults (struct pp_hwmgr *hwmgr) {struct vega20_hwmgr *data = (struct vega20_hwmgr *)(hwmgr->backend);struct amdgpu_device *adev = hwmgr->adev;uint32_t top32, bottom32; -int i; +int i, ret; data->smu_features[GNLD_DPM_PREFETCHER ].smu_feature_id =FEATURE_DPM_PREFETCHER_BIT ;
@@ -404,10 +404,17 @@ static void vega20_init_dpm_defaults(struct pp_hwmgr *hwmgr) }/* Get the SN to turn into a Unique ID */ -smum_send_msg_to_smc (hwmgr, PPSMC_MSG_ReadSerialNumTop32, &top32); -smum_send_msg_to_smc (hwmgr, PPSMC_MSG_ReadSerialNumBottom32, &bottom32); + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_ReadSerialNumTop32, &top32); +if (ret) +return ret; + + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_ReadSerialNumBottom32, &bottom32); +if (ret) +return ret; adev->unique_id = ((uint64_t )bottom32 <<32 ) | top32; + +return 0 ; }static int vega20_set_private_data_based_on_pptable (struct pp_hwmgr *hwmgr)
@@ -427,6 +434,7 @@ static int vega20_hwmgr_backend_init(struct pp_hwmgr *hwmgr) {struct vega20_hwmgr *data;struct amdgpu_device *adev = hwmgr->adev; +int result; data =kzalloc (sizeof (struct vega20_hwmgr ),GFP_KERNEL );if (data ==NULL )
@@ -452,8 +460,11 @@ static int vega20_hwmgr_backend_init(struct pp_hwmgr *hwmgr)vega20_set_features_platform_caps (hwmgr); -vega20_init_dpm_defaults (hwmgr); - + result =vega20_init_dpm_defaults (hwmgr); +if (result) { +pr_err ("%s failed\n" , __func__); +return result; + }/* Parse pptable data read from VBIOS */ vega20_set_private_data_based_on_pptable (hwmgr);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 67/132 drm/amdgpu/pm: Fix uninitialized variable agc_btc_response
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Jun <[email protected]>
[ Upstream commit df4409d8a04dd39d7f2aa0c5f528a56b99eaaa13 ]
Assign an default value to agc_btc_response in failed case
--- drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c +7 -2
@@ -2361,15 +2361,20 @@ static int vega10_acg_enable(struct pp_hwmgr *hwmgr) {struct vega10_hwmgr *data = hwmgr->backend;uint32_t agc_btc_response; +int ret;if (data->smu_features[GNLD_ACG ].supported) {if (0 ==vega10_enable_smc_features (hwmgr, true, data->smu_features[GNLD_DPM_PREFETCHER ].smu_feature_bitmap)) data->smu_features[GNLD_DPM_PREFETCHER ].enabled = true; -smum_send_msg_to_smc (hwmgr, PPSMC_MSG_InitializeAcg,NULL ); + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_InitializeAcg,NULL ); +if (ret) +return ret; -smum_send_msg_to_smc (hwmgr, PPSMC_MSG_RunAcgBtc, &agc_btc_response); + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_RunAcgBtc, &agc_btc_response); +if (ret) + agc_btc_response =0 ;if (1 == agc_btc_response) {if (1 == data->acg_loop_state)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 68/132 drm/amdgpu: Fix the uninitialized variable warning
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Jun <[email protected]>
[ Upstream commit 7e39d7ec35883a168343ea02f40e260e176c6c63 ]
Check the user input and phy_id value range to fix "Using uninitialized value phy_id"
--- drivers/gpu/drm/amd/amdgpu/amdgpu_securedisplay.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_securedisplay.c +4 -0
@@ -135,6 +135,10 @@ static ssize_t amdgpu_securedisplay_debugfs_write(struct file *f, const char __umutex_unlock (&psp->securedisplay_context.mutex);break ;case 2 : +if (size <3 || phy_id >=TA_SECUREDISPLAY_MAX_PHY ) { +dev_err (adev->dev,"Invalid input: %s\n" , str); +return -EINVAL ; + }mutex_lock (&psp->securedisplay_context.mutex);psp_prep_securedisplay_cmd_buf (psp, &securedisplay_cmd,TA_SECUREDISPLAY_COMMAND__SEND_ROI_CRC );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 69/132 drm/amdgpu: Fix out-of-bounds write warning
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Jun <[email protected]>
[ Upstream commit be1684930f5262a622d40ce7a6f1423530d87f89 ]
Check the ring type value to fix the out-of-bounds write warning
--- drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c +1 -1
@@ -352,7 +352,7 @@ int amdgpu_ring_init(struct amdgpu_device *adev, struct amdgpu_ring *ring, ring->max_dw = max_dw; ring->hw_prio = hw_prio; -if (!ring->no_scheduler) { +if (!ring->no_scheduler && ring->funcs->type <AMDGPU_HW_IP_NUM ) { hw_ip = ring->funcs->type; num_sched = &adev->gpu_sched[hw_ip][hw_prio].num_scheds; adev->gpu_sched[hw_ip][hw_prio].sched[(*num_sched)++] =
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 70/132 drm/amdkfd: Check debug trap enable before write dbg_ev_file
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lin.Cao <[email protected]>
[ Upstream commit 547033b593063eb85bfdf9b25a5f1b8fd1911be2 ]
In interrupt context, write dbg_ev_file will be run by work queue. It will cause write dbg_ev_file execution after debug_trap_disable, which will cause NULL pointer access.
v2: cancel work "debug_event_workarea" before set dbg_ev_file as NULL.
--- drivers/gpu/drm/amd/amdkfd/kfd_debug.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdkfd/kfd_debug.c +3 -1
@@ -103,7 +103,8 @@ void debug_event_write_work_handler(struct work_struct *work) struct kfd_process, debug_event_workarea); -kernel_write (process->dbg_ev_file, &write_data,1 , &pos); +if (process->debug_trap_enabled && process->dbg_ev_file) +kernel_write (process->dbg_ev_file, &write_data,1 , &pos); }/* update process/device/queue exception status, write to descriptor
@@ -645,6 +646,7 @@ int kfd_dbg_trap_disable(struct kfd_process *target)else if (target->runtime_info.runtime_state !=DEBUG_RUNTIME_STATE_DISABLED ) target->runtime_info.runtime_state =DEBUG_RUNTIME_STATE_ENABLED ; +cancel_work_sync (&target->debug_event_workarea);fput (target->dbg_ev_file); target->dbg_ev_file =NULL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 71/132 drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Jun <[email protected]>
[ Upstream commit d768394fa99467bcf2703bde74ddc96eeb0b71fa ]
Check the fb_channel_number range to avoid the array out-of-bounds read error
--- drivers/gpu/drm/amd/amdgpu/df_v1_7.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/amdgpu/df_v1_7.c +2 -0
@@ -70,6 +70,8 @@ static u32 df_v1_7_get_hbm_channel_number(struct amdgpu_device *adev)int fb_channel_number; fb_channel_number = adev->df.funcs->get_fb_channel_number (adev); +if (fb_channel_number >=ARRAY_SIZE (df_v1_7_channel_number)) + fb_channel_number =0 ;return df_v1_7_channel_number[fb_channel_number]; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 72/132 drm/amdgpu: fix ucode out-of-bounds read warning
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Huang <[email protected]>
[ Upstream commit 8944acd0f9db33e17f387fdc75d33bb473d7936f ]
Clear warning that read ucode[] may out-of-bounds.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c +3 -0
@@ -213,6 +213,9 @@ static int amdgpu_cgs_get_firmware_info(struct cgs_device *cgs_device,struct amdgpu_firmware_info *ucode; id =fw_type_convert (cgs_device, type); +if (id >=AMDGPU_UCODE_ID_MAXIMUM ) +return -EINVAL ; + ucode = &adev->firmware.ucode[id];if (ucode->fw ==NULL )return -EINVAL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 73/132 drm/amdgpu: fix mc_data out-of-bounds read warning
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Huang <[email protected]>
[ Upstream commit 51dfc0a4d609fe700750a62f41447f01b8c9ea50 ]
Clear warning that read mc_data[i-1] may out-of-bounds.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c +2 -0
@@ -1476,6 +1476,8 @@ int amdgpu_atombios_init_mc_reg_table(struct amdgpu_device *adev, (u32 )le32_to_cpu (*((u32 *)reg_data + j)); j++; }else if ((reg_table->mc_reg_address[i].pre_reg_data &LOW_NIBBLE_MASK ) ==DATA_EQU_PREV ) { +if (i ==0 ) +continue ; reg_table->mc_reg_table_entry[num_ranges].mc_data[i] = reg_table->mc_reg_table_entry[num_ranges].mc_data[i -1 ]; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 74/132 drm/amdkfd: Reconcile the definition and use of oem_id in struct kfd_topology_device
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Chen <[email protected]>
[ Upstream commit 10f624ef239bd136cdcc5bbc626157a57b938a31 ]
Currently oem_id is defined as uint8_t[6] and casted to uint64_t* in some use case. This would lead code scanner to complain about access beyond. Re-define it in union to enforce 8-byte size and alignment to avoid potential issue.
--- drivers/gpu/drm/amd/amdkfd/kfd_crat.h | 2 -- drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 3 +-- drivers/gpu/drm/amd/amdkfd/kfd_topology.h | 5 ++++- 3 files changed, 5 insertions(+), 5 deletions(-)
drivers/gpu/drm/amd/amdkfd/kfd_crat.h +0 -2
@@ -42,8 +42,6 @@#define CRAT_OEMTABLEID_LENGTH 8#define CRAT_RESERVED_LENGTH 6 -#define CRAT_OEMID_64BIT_MASK ((1ULL << (CRAT_OEMID_LENGTH * 8)) - 1) -/* Compute Unit flags */ #define COMPUTE_UNIT_CPU (1 << 0)/* Create Virtual CRAT for CPU */ #define COMPUTE_UNIT_GPU (1 << 1)/* Create Virtual CRAT for GPU */
drivers/gpu/drm/amd/amdkfd/kfd_topology.c +1 -2
@@ -958,8 +958,7 @@ static void kfd_update_system_properties(void) dev =list_last_entry (&topology_device_list, struct kfd_topology_device, list);if (dev) { - sys_props.platform_id = - (*((uint64_t *)dev->oem_id)) &CRAT_OEMID_64BIT_MASK ; + sys_props.platform_id = dev->oem_id64; sys_props.platform_oem = *((uint64_t *)dev->oem_table_id); sys_props.platform_rev = dev->oem_revision; }
drivers/gpu/drm/amd/amdkfd/kfd_topology.h +4 -1
@@ -154,7 +154,10 @@ struct kfd_topology_device {struct attribute attr_gpuid;struct attribute attr_name;struct attribute attr_props; -uint8_t oem_id[CRAT_OEMID_LENGTH ]; +union { +uint8_t oem_id[CRAT_OEMID_LENGTH ]; +uint64_t oem_id64; + };uint8_t oem_table_id[CRAT_OEMTABLEID_LENGTH ];uint32_t oem_revision; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 75/132 apparmor: fix possible NULL pointer dereference
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leesoo Ahn <[email protected]>
[ Upstream commit 3dd384108d53834002be5630132ad5c3f32166ad ]
profile->parent->dents[AAFS_PROF_DIR] could be NULL only if its parent is made from __create_missing_ancestors(..) and 'ent->old' is NULL in aa_replace_profiles(..).
In that case, it must return an error code and the code, -ENOENT represents its state that the path of its parent is not existed yet.
BUG: kernel NULL pointer dereference, address: 0000000000000030 PGD 0 P4D 0 PREEMPT SMP PTI CPU: 4 PID: 3362 Comm: apparmor_parser Not tainted 6.8.0-24-generic #24 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 RIP: 0010:aafs_create.constprop.0+0x7f/0x130 Code: 4c 63 e0 48 83 c4 18 4c 89 e0 5b 41 5c 41 5d 41 5e 41 5f 5d 31 d2 31 c9 31 f6 31 ff 45 31 c0 45 31 c9 45 31 d2 c3 cc cc cc cc <4d> 8b 55 30 4d 8d ba a0 00 00 00 4c 89 55 c0 4c 89 ff e8 7a 6a ae RSP: 0018:ffffc9000b2c7c98 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 00000000000041ed RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000b2c7cd8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff82baac10 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 00007be9f22cf740(0000) GS:ffff88817bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000030 CR3: 0000000134b08000 CR4: 00000000000006f0 Call Trace: <TASK> ? show_regs+0x6d/0x80 ? __die+0x24/0x80 ? page_fault_oops+0x99/0x1b0 ? kernelmode_fixup_or_oops+0xb2/0x140 ? __bad_area_nosemaphore+0x1a5/0x2c0 ? find_vma+0x34/0x60 ? bad_area_nosemaphore+0x16/0x30 ? do_user_addr_fault+0x2a2/0x6b0 ? exc_page_fault+0x83/0x1b0 ? asm_exc_page_fault+0x27/0x30 ? aafs_create.constprop.0+0x7f/0x130 ? aafs_create.constprop.0+0x51/0x130 __aafs_profile_mkdir+0x3d6/0x480 aa_replace_profiles+0x83f/0x1270 policy_update+0xe3/0x180 profile_load+0xbc/0x150 ? rw_verify_area+0x47/0x140 vfs_write+0x100/0x480 ? __x64_sys_openat+0x55/0xa0 ? syscall_exit_to_user_mode+0x86/0x260 ksys_write+0x73/0x100 __x64_sys_write+0x19/0x30 x64_sys_call+0x7e/0x25c0 do_syscall_64+0x7f/0x180 entry_SYSCALL_64_after_hwframe+0x78/0x80 RIP: 0033:0x7be9f211c574 Code: c7 00 16 00 00 00 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 80 3d d5 ea 0e 00 00 74 13 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 55 48 89 e5 48 83 ec 20 48 89 RSP: 002b:00007ffd26f2b8c8 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00005d504415e200 RCX: 00007be9f211c574 RDX: 0000000000001fc1 RSI: 00005d504418bc80 RDI: 0000000000000004 RBP: 0000000000001fc1 R08: 0000000000001fc1 R09: 0000000080000000 R10: 0000000000000000 R11: 0000000000000202 R12: 00005d504418bc80 R13: 0000000000000004 R14: 00007ffd26f2b9b0 R15: 00007ffd26f2ba30 </TASK> Modules linked in: snd_seq_dummy snd_hrtimer qrtr snd_hda_codec_generic snd_hda_intel snd_intel_dspcfg snd_intel_sdw_acpi snd_hda_codec snd_hda_core snd_hwdep snd_pcm snd_seq_midi snd_seq_midi_event snd_rawmidi snd_seq snd_seq_device i2c_i801 snd_timer i2c_smbus qxl snd soundcore drm_ttm_helper lpc_ich ttm joydev input_leds serio_raw mac_hid binfmt_misc msr parport_pc ppdev lp parport efi_pstore nfnetlink dmi_sysfs qemu_fw_cfg ip_tables x_tables autofs4 hid_generic usbhid hid ahci libahci psmouse virtio_rng xhci_pci xhci_pci_renesas CR2: 0000000000000030 ---[ end trace 0000000000000000 ]--- RIP: 0010:aafs_create.constprop.0+0x7f/0x130 Code: 4c 63 e0 48 83 c4 18 4c 89 e0 5b 41 5c 41 5d 41 5e 41 5f 5d 31 d2 31 c9 31 f6 31 ff 45 31 c0 45 31 c9 45 31 d2 c3 cc cc cc cc <4d> 8b 55 30 4d 8d ba a0 00 00 00 4c 89 55 c0 4c 89 ff e8 7a 6a ae RSP: 0018:ffffc9000b2c7c98 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 00000000000041ed RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000b2c7cd8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff82baac10 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 00007be9f22cf740(0000) GS:ffff88817bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000030 CR3: 0000000134b08000 CR4: 00000000000006f0
--- security/apparmor/apparmorfs.c | 4 ++++ 1 file changed, 4 insertions(+)
security/apparmor/apparmorfs.c +4 -0
@@ -1698,6 +1698,10 @@ int __aafs_profile_mkdir(struct aa_profile *profile, struct dentry *parent)struct aa_profile *p; p =aa_deref_parent (profile); dent =prof_dir (p); +if (!dent) { + error = -ENOENT ; + goto fail2; + }/* adding to parent that previously didn't have children */ dent =aafs_create_dir ("profiles" , dent);if (IS_ERR (dent))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 76/132 wifi: ath12k: initialize ret in ath12k_qmi_load_file_target_mem()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Johnson <[email protected]>
[ Upstream commit bb0b0a6b96e6de854cb1e349e17bd0e8bf421a59 ]
smatch flagged the following issue:
drivers/net/wireless/ath/ath12k/qmi.c:2619 ath12k_qmi_load_file_target_mem() error: uninitialized symbol 'ret'.
The reality is that 'ret' is initialized in every path through ath12k_qmi_load_file_target_mem() except one, the case where the input 'len' is 0, and hence the "while (remaining)" loop is never entered. But to make sure this case is also handled, add an initializer to the declaration of 'ret'.
No functional changes, compile tested only.
--- drivers/net/wireless/ath/ath12k/qmi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ath/ath12k/qmi.c +1 -1
@@ -2312,7 +2312,7 @@ static int ath12k_qmi_load_file_target_mem(struct ath12k_base *ab,struct qmi_wlanfw_bdf_download_resp_msg_v01 resp;struct qmi_txn txn = {};const u8 *temp = data; -int ret; +int ret =0 ;u32 remaining = len; req =kzalloc (sizeof (*req),GFP_KERNEL );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 77/132 wifi: ath11k: initialize ret in ath11k_qmi_load_file_target_mem()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Johnson <[email protected]>
[ Upstream commit 199f149e97dc7be80e5eed4b232529c1d1aa8055 ]
smatch flagged the following issue:
drivers/net/wireless/ath/ath11k/qmi.c:2401 ath11k_qmi_load_file_target_mem() error: uninitialized symbol 'ret'.
The reality is that 'ret' is initialized in every path through ath11k_qmi_load_file_target_mem() except one, the case where the input 'len' is 0, and hence the "while (remaining)" loop is never entered. But to make sure this case is also handled, add an initializer to the declaration of 'ret'.
No functional changes, compile tested only.
--- drivers/net/wireless/ath/ath11k/qmi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ath/ath11k/qmi.c +1 -1
@@ -2293,7 +2293,7 @@ static int ath11k_qmi_load_file_target_mem(struct ath11k_base *ab,struct qmi_txn txn;const u8 *temp = data;void __iomem *bdf_addr =NULL ; -int ret; +int ret =0 ;u32 remaining = len; req =kzalloc (sizeof (*req),GFP_KERNEL );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 78/132 drm/amdgpu/pm: Check input value for CUSTOM profile mode setting on legacy SOCs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Jun <[email protected]>
[ Upstream commit df0a9bd92fbbd3fcafcb2bce6463c9228a3e6868 ]
Check the input value for CUSTOM profile mode setting on legacy SOCs. Otherwise we may use uninitalized value of input[]
--- drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 2 +- drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c | 8 ++++++-- 2 files changed, 7 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c +1 -1
@@ -5641,7 +5641,7 @@ static int smu7_set_power_profile_mode(struct pp_hwmgr *hwmgr, long *input, uint mode = input[size];switch (mode) {case PP_SMC_POWER_PROFILE_CUSTOM : -if (size <8 && size !=0 ) +if (size !=8 && size !=0 )return -EINVAL ;/* If only CUSTOM is passed in, use the saved values. Check * that we actually have a CUSTOM profile by ensuring that
drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c +6 -2
@@ -4102,9 +4102,11 @@ static int vega20_set_power_profile_mode(struct pp_hwmgr *hwmgr, long *input, uiif (power_profile_mode ==PP_SMC_POWER_PROFILE_CUSTOM ) {struct vega20_hwmgr *data = (struct vega20_hwmgr *)(hwmgr->backend); -if (size ==0 && !data->is_custom_profile_set) + +if (size !=10 && size !=0 )return -EINVAL ; -if (size <10 && size !=0 ) + +if (size ==0 && !data->is_custom_profile_set)return -EINVAL ; result = vega20_get_activity_monitor_coeff(hwmgr,
@@ -4166,6 +4168,8 @@ static int vega20_set_power_profile_mode(struct pp_hwmgr *hwmgr, long *input, ui activity_monitor.Fclk_PD_Data_error_coeff = input[8 ]; activity_monitor.Fclk_PD_Data_error_rate_coeff = input[9 ];break ; +default : +return -EINVAL ; } result = vega20_set_activity_monitor_coeff(hwmgr,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 79/132 drm/amdgpu: Fix the warning division or modulo by zero
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Zhang <[email protected]>
[ Upstream commit 1a00f2ac82d6bc6689388c7edcd2a4bd82664f3c ]
Checks the partition mode and returns an error for an invalid mode.
--- drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c +6 -0
@@ -500,6 +500,12 @@ static int aqua_vanjaram_switch_partition_mode(struct amdgpu_xcp_mgr *xcp_mgr,if (mode ==AMDGPU_AUTO_COMPUTE_PARTITION_MODE ) { mode =__aqua_vanjaram_get_auto_mode (xcp_mgr); +if (mode ==AMDGPU_UNKNOWN_COMPUTE_PARTITION_MODE ) { +dev_err (adev->dev, +"Invalid config, no compatible compute partition mode found, available memory partitions: %d" , + adev->gmc.num_mem_partitions); +return -EINVAL ; + } }else if (!__aqua_vanjaram_is_valid_mode (xcp_mgr, mode)) { dev_err(adev->dev, "Invalid compute partition mode requested, requested: %s, available memory partitions: %d",
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 80/132 drm/amdgpu: fix dereference after null check
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Zhang <[email protected]>
[ Upstream commit b1f7810b05d1950350ac2e06992982974343e441 ]
check the pointer hive before use.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +1 -1
@@ -5236,7 +5236,7 @@ int amdgpu_device_gpu_recover(struct amdgpu_device *adev,* to put adev in the 1st position. */ INIT_LIST_HEAD (&device_list); -if (!amdgpu_sriov_vf (adev) && (adev->gmc.xgmi.num_physical_nodes >1 )) { +if (!amdgpu_sriov_vf (adev) && (adev->gmc.xgmi.num_physical_nodes >1 ) && hive) {list_for_each_entry (tmp_adev, &hive->device_list, gmc.xgmi.head) {list_add_tail (&tmp_adev->reset_list, &device_list);if (gpu_reset_for_dev_remove && adev->shutdown)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 81/132 drm/amdgpu: fix the waring dereferencing hive
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Zhang <[email protected]>
[ Upstream commit 1940708ccf5aff76de4e0b399f99267c93a89193 ]
Check the amdgpu_hive_info *hive that maybe is NULL.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +3 -0
@@ -1336,6 +1336,9 @@ static void psp_xgmi_reflect_topology_info(struct psp_context *psp,uint8_t dst_num_links = node_info.num_links; hive =amdgpu_get_xgmi_hive (psp->adev); +if (WARN_ON (!hive)) +return ; +list_for_each_entry (mirror_adev, &hive->device_list, gmc.xgmi.head) {struct psp_xgmi_topology_info *mirror_top_info;int j;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 82/132 drm/amd/pm: check specific index for aldebaran
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Zhang <[email protected]>
[ Upstream commit 0ce8ef2639c112ae203c985b758389e378630aac ]
Check for specific indexes that may be invalid values.
--- drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c +2 -1
@@ -1931,7 +1931,8 @@ static int aldebaran_mode2_reset(struct smu_context *smu) index =smu_cmn_to_asic_specific_index (smu,CMN2ASIC_MAPPING_MSG , SMU_MSG_GfxDeviceDriverReset); - +if (index <0 ) +return -EINVAL ;mutex_lock (&smu->message_lock);if (smu_version >=0x00441400 ) { ret =smu_cmn_send_msg_without_waiting (smu, (uint16_t )index,SMU_RESET_MODE_2 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 83/132 drm/amd/pm: check specific index for smu13
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Zhang <[email protected]>
[ Upstream commit a3ac9d1c9751f00026c2d98b802ec8a98626c3ed ]
Check for specific indexes that may be invalid values.
--- drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c +2 -0
@@ -2058,6 +2058,8 @@ static int smu_v13_0_6_mode2_reset(struct smu_context *smu) index =smu_cmn_to_asic_specific_index (smu,CMN2ASIC_MAPPING_MSG , SMU_MSG_GfxDeviceDriverReset); +if (index <0 ) +return index;mutex_lock (&smu->message_lock);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 84/132 drm/amdgpu: the warning dereferencing obj for nbio_v7_4
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Zhang <[email protected]>
[ Upstream commit d190b459b2a4304307c3468ed97477b808381011 ]
if ras_manager obj null, don't print NBIO err data
--- drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c +1 -1
@@ -384,7 +384,7 @@ static void nbio_v7_4_handle_ras_controller_intr_no_bifring(struct amdgpu_deviceelse WREG32_SOC15 (NBIO ,0 , mmBIF_DOORBELL_INT_CNTL, bif_doorbell_intr_cntl); -if (!ras->disable_ras_err_cnt_harvest) { +if (ras && !ras->disable_ras_err_cnt_harvest && obj) {/* * clear error status after ras_controller_intr * according to hw team and count ue number
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 85/132 drm/amd/pm: check negtive return for table entries
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Zhang <[email protected]>
[ Upstream commit f76059fe14395b37ba8d997eb0381b1b9e80a939 ]
Function hwmgr->hwmgr_func->get_num_of_pp_table_entries(hwmgr) returns a negative number
--- drivers/gpu/drm/amd/pm/powerplay/hwmgr/pp_psm.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
drivers/gpu/drm/amd/pm/powerplay/hwmgr/pp_psm.c +8 -5
@@ -30,9 +30,8 @@ int psm_init_power_state_table(struct pp_hwmgr *hwmgr) {int result;unsigned int i; -unsigned int table_entries;struct pp_power_state *state; -int size; +int size, table_entries;if (hwmgr->hwmgr_func->get_num_of_pp_table_entries ==NULL )return 0 ;
@@ -40,15 +39,19 @@ int psm_init_power_state_table(struct pp_hwmgr *hwmgr)if (hwmgr->hwmgr_func->get_power_state_size ==NULL )return 0 ; - hwmgr->num_ps = table_entries = hwmgr->hwmgr_func->get_num_of_pp_table_entries (hwmgr); + table_entries = hwmgr->hwmgr_func->get_num_of_pp_table_entries (hwmgr); - hwmgr->ps_size = size = hwmgr->hwmgr_func->get_power_state_size (hwmgr) + + size = hwmgr->hwmgr_func->get_power_state_size (hwmgr) +sizeof (struct pp_power_state ); -if (table_entries ==0 || size ==0 ) { +if (table_entries <=0 || size ==0 ) {pr_warn ("Please check whether power state management is supported on this asic\n" ); + hwmgr->num_ps =0 ; + hwmgr->ps_size =0 ;return 0 ; } + hwmgr->num_ps = table_entries; + hwmgr->ps_size = size; hwmgr->ps =kcalloc (table_entries, size,GFP_KERNEL );if (hwmgr->ps ==NULL )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 86/132 wifi: rtw89: ser: avoid multiple deinit on same CAM
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zong-Zhe Yang <[email protected]>
[ Upstream commit cea4066588308fa932b6b03486c608efff1d761c ]
We did deinit CAM in STA iteration in VIF loop. But, the STA iteration missed to restrict the target VIF. So, if there are multiple VIFs, we would deinit a CAM multiple times. Now, fix it.
--- drivers/net/wireless/realtek/rtw89/ser.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/net/wireless/realtek/rtw89/ser.c +6 -2
@@ -308,9 +308,13 @@ static void ser_reset_vif(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif)static void ser_sta_deinit_cam_iter (void *data,struct ieee80211_sta *sta) { -struct rtw89_vif *rtwvif = (struct rtw89_vif *)data; -struct rtw89_dev *rtwdev = rtwvif->rtwdev; +struct rtw89_vif *target_rtwvif = (struct rtw89_vif *)data;struct rtw89_sta *rtwsta = (struct rtw89_sta *)sta->drv_priv; +struct rtw89_vif *rtwvif = rtwsta->rtwvif; +struct rtw89_dev *rtwdev = rtwvif->rtwdev; + +if (rtwvif != target_rtwvif) +return ;if (rtwvif->net_type ==RTW89_NET_TYPE_AP_MODE || sta->tdls)rtw89_cam_deinit_addr_cam (rtwdev, &rtwsta->addr_cam);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 87/132 drm/kfd: Correct pinned buffer handling at kfd restore and validate process
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaogang Chen <[email protected]>
[ Upstream commit f326d7cc745683f53052b84382bd10567b45cd5d ]
This reverts commit 8a774fe912ff ("drm/amdgpu: avoid restore process run into dead loop") since buffer got pinned is not related whether it needs mapping
And skip buffer validation at kfd driver if the buffer has been pinned.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c +5 -4
@@ -407,6 +407,10 @@ static int amdgpu_amdkfd_bo_validate(struct amdgpu_bo *bo, uint32_t domain, "Called with userptr BO"))return -EINVAL ; +/* bo has been pinned, not need validate it */ +if (bo->tbo.pin_count) +return 0 ; +amdgpu_bo_placement_from_domain (bo, domain); ret =ttm_bo_validate (&bo->tbo, &bo->placement, &ctx);
@@ -2631,7 +2635,7 @@ static int confirm_valid_user_pages_locked(struct amdkfd_process_info *process_i/* keep mem without hmm range at userptr_inval_list */ if (!mem->range) -continue ; +continue ;/* Only check mem with hmm range associated */ valid = amdgpu_ttm_tt_get_user_pages_done(
@@ -2848,9 +2852,6 @@ int amdgpu_amdkfd_gpuvm_restore_process_bos(void *info, struct dma_fence **ef)if (!attachment->is_mapped)continue ; -if (attachment->bo_va->base.bo->tbo.pin_count) -continue ; -kfd_mem_dmaunmap_attachment (mem, attachment); ret =update_gpuvm_pte (mem, attachment, &sync_obj);if (ret) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 88/132 drm/amdgpu: update type of buf size to u32 for eeprom functions
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tao Zhou <[email protected]>
[ Upstream commit 2aadb520bfacec12527effce3566f8df55e5d08e ]
Avoid overflow issue.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_eeprom.c | 6 +++--- drivers/gpu/drm/amd/amdgpu/amdgpu_eeprom.h | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_eeprom.c +3 -3
@@ -179,7 +179,7 @@ static int __amdgpu_eeprom_xfer(struct i2c_adapter *i2c_adap, u32 eeprom_addr,* Returns the number of bytes read/written; -errno on error. */ static int amdgpu_eeprom_xfer (struct i2c_adapter *i2c_adap,u32 eeprom_addr, -u8 *eeprom_buf,u16 buf_size,bool read) +u8 *eeprom_buf,u32 buf_size,bool read) {const struct i2c_adapter_quirks *quirks = i2c_adap->quirks;u16 limit;
@@ -225,7 +225,7 @@ static int amdgpu_eeprom_xfer(struct i2c_adapter *i2c_adap, u32 eeprom_addr,int amdgpu_eeprom_read (struct i2c_adapter *i2c_adap,u32 eeprom_addr,u8 *eeprom_buf, -u16 bytes) +u32 bytes) {return amdgpu_eeprom_xfer (i2c_adap, eeprom_addr, eeprom_buf, bytes, true);
@@ -233,7 +233,7 @@ int amdgpu_eeprom_read(struct i2c_adapter *i2c_adap,int amdgpu_eeprom_write (struct i2c_adapter *i2c_adap,u32 eeprom_addr,u8 *eeprom_buf, -u16 bytes) +u32 bytes) {return amdgpu_eeprom_xfer (i2c_adap, eeprom_addr, eeprom_buf, bytes, false);
drivers/gpu/drm/amd/amdgpu/amdgpu_eeprom.h +2 -2
@@ -28,10 +28,10 @@int amdgpu_eeprom_read (struct i2c_adapter *i2c_adap,u32 eeprom_addr,u8 *eeprom_buf, -u16 bytes); +u32 bytes);int amdgpu_eeprom_write (struct i2c_adapter *i2c_adap,u32 eeprom_addr,u8 *eeprom_buf, -u16 bytes); +u32 bytes);#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 89/132 wifi: iwlwifi: remove fw_running op
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shahar S Matityahu <[email protected]>
[ Upstream commit 37733bffda3285d18bd1d72c14b3a1cf39c56a5e ]
fw_running assumes that memory can be retrieved only after alive. This assumption is no longer true as we support dump before alive. To avoid invalid access to the NIC, check that STATUS_DEVICE_ENABLED bit in trans status is set before dumping instead of the prior check.
--- drivers/net/wireless/intel/iwlwifi/fw/debugfs.c | 3 +-- drivers/net/wireless/intel/iwlwifi/fw/runtime.h | 1 - drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 6 ------ 3 files changed, 1 insertion(+), 9 deletions(-)
drivers/net/wireless/intel/iwlwifi/fw/debugfs.c +1 -2
@@ -230,8 +230,7 @@ static ssize_t iwl_dbgfs_send_hcmd_write(struct iwl_fw_runtime *fwrt, char *buf, .data = { NULL, }, }; -if (fwrt->ops && fwrt->ops->fw_running && - !fwrt->ops->fw_running (fwrt->ops_ctx)) +if (!iwl_trans_fw_running (fwrt->trans))return -EIO ;if (count < header_size +1 || count >1024 *4 )
drivers/net/wireless/intel/iwlwifi/fw/runtime.h +0 -1
@@ -18,7 +18,6 @@struct iwl_fw_runtime_ops {void (*dump_start)(void *ctx);void (*dump_end)(void *ctx); -bool (*fw_running)(void *ctx);int (*send_hcmd)(void *ctx,struct iwl_host_cmd *host_cmd);bool (*d3_debug_enable)(void *ctx); };
drivers/net/wireless/intel/iwlwifi/mvm/ops.c +0 -6
@@ -702,11 +702,6 @@ static void iwl_mvm_fwrt_dump_end(void *ctx)mutex_unlock (&mvm->mutex); } -static bool iwl_mvm_fwrt_fw_running (void *ctx) -{ -return iwl_mvm_firmware_running (ctx); -} -static int iwl_mvm_fwrt_send_hcmd (void *ctx,struct iwl_host_cmd *host_cmd) {struct iwl_mvm *mvm = (struct iwl_mvm *)ctx;
@@ -727,7 +722,6 @@ static bool iwl_mvm_d3_debug_enable(void *ctx)static const struct iwl_fw_runtime_ops iwl_mvm_fwrt_ops = { .dump_start = iwl_mvm_fwrt_dump_start, .dump_end = iwl_mvm_fwrt_dump_end, - .fw_running = iwl_mvm_fwrt_fw_running, .send_hcmd = iwl_mvm_fwrt_send_hcmd, .d3_debug_enable = iwl_mvm_d3_debug_enable, };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 90/132 cpufreq: scmi: Avoid overflow of target_freq in fast switch
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jagadeesh Kona <[email protected]>
[ Upstream commit 074cffb5020ddcaa5fafcc55655e5da6ebe8c831 ]
Conversion of target_freq to HZ in scmi_cpufreq_fast_switch() can lead to overflow if the multiplied result is greater than UINT_MAX, since type of target_freq is unsigned int. Avoid this overflow by assigning target_freq to unsigned long variable for converting it to HZ.
--- drivers/cpufreq/scmi-cpufreq.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/cpufreq/scmi-cpufreq.c +2 -2
@@ -62,9 +62,9 @@ static unsigned int scmi_cpufreq_fast_switch(struct cpufreq_policy *policy, unsigned int target_freq) {struct scmi_data *priv = policy->driver_data; +unsigned long freq = target_freq; -if (!perf_ops->freq_set (ph, priv->domain_id, - target_freq *1000 , true)) +if (!perf_ops->freq_set (ph, priv->domain_id, freq *1000 , true))return target_freq;return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 91/132 PCI: al: Check IORESOURCE_BUS existence during probe
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Mishin <[email protected]>
[ Upstream commit a9927c2cac6e9831361e43a14d91277818154e6a ]
If IORESOURCE_BUS is not provided in Device Tree it will be fabricated in of_pci_parse_bus_range(), so NULL pointer dereference should not happen here.
But that's hard to verify, so check for NULL anyway.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/pci/controller/dwc/pcie-al.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-)
drivers/pci/controller/dwc/pcie-al.c +13 -3
@@ -242,18 +242,24 @@ static struct pci_ops al_child_pci_ops = { .write = pci_generic_config_write, }; -static void al_pcie_config_prepare (struct al_pcie *pcie) +static int al_pcie_config_prepare (struct al_pcie *pcie) {struct al_pcie_target_bus_cfg *target_bus_cfg;struct dw_pcie_rp *pp = &pcie->pci->pp;unsigned int ecam_bus_mask; +struct resource_entry *ft;u32 cfg_control_offset; +struct resource *bus;u8 subordinate_bus;u8 secondary_bus;u32 cfg_control;u32 reg; -struct resource *bus =resource_list_first_type (&pp->bridge->windows,IORESOURCE_BUS )->res; + ft =resource_list_first_type (&pp->bridge->windows,IORESOURCE_BUS ); +if (!ft) +return -ENODEV ; + + bus = ft->res; target_bus_cfg = &pcie->target_bus_cfg; ecam_bus_mask = (pcie->ecam_size >>PCIE_ECAM_BUS_SHIFT ) -1 ;
@@ -287,6 +293,8 @@ static void al_pcie_config_prepare(struct al_pcie *pcie)FIELD_PREP (CFG_CONTROL_SEC_BUS_MASK , secondary_bus);al_pcie_controller_writel (pcie, cfg_control_offset, reg); + +return 0 ; }static int al_pcie_host_init (struct dw_pcie_rp *pp)
@@ -305,7 +313,9 @@ static int al_pcie_host_init(struct dw_pcie_rp *pp)if (rc)return rc; -al_pcie_config_prepare (pcie); + rc =al_pcie_config_prepare (pcie); +if (rc) +return rc;return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 92/132 wifi: mac80211: check ieee80211_bss_info_change_notify() against MLD
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit a0ca76e5b7d550fcd74753d5fdaaf23f1a9bfdb4 ]
It's not valid to call ieee80211_bss_info_change_notify() with an sdata that's an MLD, remove the FIXME comment (it's not true) and add a warning.
--- net/mac80211/main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/mac80211/main.c +2 -1
@@ -215,6 +215,8 @@ void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,might_sleep (); +WARN_ON_ONCE (ieee80211_vif_is_mld (&sdata->vif)); +if (!changed || sdata->vif.type ==NL80211_IFTYPE_AP_VLAN )return ;
@@ -247,7 +249,6 @@ void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,if (changed & ~BSS_CHANGED_VIF_CFG_FLAGS ) {u64 ch = changed & ~BSS_CHANGED_VIF_CFG_FLAGS ; -/* FIXME: should be for each link */ trace_drv_link_info_changed (local, sdata, &sdata->vif.bss_conf, changed);if (local->ops->link_info_changed)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 93/132 hwspinlock: Introduce hwspin_lock_bust()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Maina <[email protected]>
[ Upstream commit 7c327d56597d8de1680cf24e956b704270d3d84a ]
When a remoteproc crashes or goes down unexpectedly this can result in a state where locks held by the remoteproc will remain locked possibly resulting in deadlock. This new API hwspin_lock_bust() allows hwspinlock implementers to define a bust operation for freeing previously acquired hwspinlocks after verifying ownership of the acquired lock.
--- Documentation/locking/hwspinlock.rst | 11 ++++++++++ drivers/hwspinlock/hwspinlock_core.c | 28 ++++++++++++++++++++++++ drivers/hwspinlock/hwspinlock_internal.h | 3 +++ include/linux/hwspinlock.h | 6 +++++ 4 files changed, 48 insertions(+)
Documentation/locking/hwspinlock.rst +11 -0
@@ -85,6 +85,17 @@ is already free). Should be called from a process context (might sleep). +:: + + int hwspin_lock_bust(struct hwspinlock *hwlock, unsigned int id); + +After verifying the owner of the hwspinlock, release a previously acquired +hwspinlock; returns 0 on success, or an appropriate error code on failure +(e.g. -EOPNOTSUPP if the bust operation is not defined for the specific +hwspinlock). + +Should be called from a process context (might sleep). + :: int hwspin_lock_timeout(struct hwspinlock *hwlock, unsigned int timeout);
drivers/hwspinlock/hwspinlock_core.c +28 -0
@@ -302,6 +302,34 @@ void __hwspin_unlock(struct hwspinlock *hwlock, int mode, unsigned long *flags) }EXPORT_SYMBOL_GPL (__hwspin_unlock); +/** +* hwspin_lock_bust() - bust a specific hwspinlock +* @hwlock: a previously-acquired hwspinlock which we want to bust +* @id: identifier of the remote lock holder, if applicable +* +* This function will bust a hwspinlock that was previously acquired as +* long as the current owner of the lock matches the id given by the caller. +* +* Context: Process context. +* +* Returns: 0 on success, or -EINVAL if the hwspinlock does not exist, or +* the bust operation fails, and -EOPNOTSUPP if the bust operation is not +* defined for the hwspinlock. +*/ +int hwspin_lock_bust (struct hwspinlock *hwlock,unsigned int id) +{ +if (WARN_ON (!hwlock)) +return -EINVAL ; + +if (!hwlock->bank->ops->bust) { +pr_err ("bust operation not defined\n" ); +return -EOPNOTSUPP ; + } + +return hwlock->bank->ops->bust (hwlock, id); +} +EXPORT_SYMBOL_GPL (hwspin_lock_bust); +/** * of_hwspin_lock_simple_xlate - translate hwlock_spec to return a lock id * @bank: the hwspinlock device bank
drivers/hwspinlock/hwspinlock_internal.h +3 -0
@@ -21,6 +21,8 @@ struct hwspinlock_device;* @trylock: make a single attempt to take the lock. returns 0 on * failure and true on success. may _not_ sleep. * @unlock: release the lock. always succeed. may _not_ sleep. +* @bust: optional, platform-specific bust handler, called by hwspinlock +* core to bust a specific lock. * @relax: optional, platform-specific relax handler, called by hwspinlock * core while spinning on a lock, between two successive * invocations of @trylock. may _not_ sleep.
@@ -28,6 +30,7 @@ struct hwspinlock_device;struct hwspinlock_ops {int (*trylock)(struct hwspinlock *lock);void (*unlock)(struct hwspinlock *lock); +int (*bust)(struct hwspinlock *lock,unsigned int id);void (*relax)(struct hwspinlock *lock); };
include/linux/hwspinlock.h +6 -0
@@ -68,6 +68,7 @@ int __hwspin_lock_timeout(struct hwspinlock *, unsigned int, int,int __hwspin_trylock (struct hwspinlock *,int ,unsigned long *);void __hwspin_unlock (struct hwspinlock *,int ,unsigned long *);int of_hwspin_lock_get_id_byname (struct device_node *np,const char *name); +int hwspin_lock_bust (struct hwspinlock *hwlock,unsigned int id);int devm_hwspin_lock_free (struct device *dev,struct hwspinlock *hwlock);struct hwspinlock *devm_hwspin_lock_request (struct device *dev); struct hwspinlock *devm_hwspin_lock_request_specific(struct device *dev,
@@ -127,6 +128,11 @@ void __hwspin_unlock(struct hwspinlock *hwlock, int mode, unsigned long *flags) { } +static inline int hwspin_lock_bust (struct hwspinlock *hwlock,unsigned int id) +{ +return 0 ; +} +static inline int of_hwspin_lock_get_id (struct device_node *np,int index) {return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 94/132 soc: qcom: smem: Add qcom_smem_bust_hwspin_lock_by_host()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Lew <[email protected]>
[ Upstream commit 2e3f0d693875db698891ffe89a18121bda5b95b8 ]
Add qcom_smem_bust_hwspin_lock_by_host to enable remoteproc to bust the hwspin_lock owned by smem. In the event the remoteproc crashes unexpectedly, the remoteproc driver can invoke this API to try and bust the hwspin_lock and release the lock if still held by the remoteproc device.
--- drivers/soc/qcom/smem.c | 26 ++++++++++++++++++++++++++ include/linux/soc/qcom/smem.h | 2 ++ 2 files changed, 28 insertions(+)
drivers/soc/qcom/smem.c +26 -0
@@ -359,6 +359,32 @@ static struct qcom_smem *__smem;/* Timeout (ms) for the trylock of remote spinlocks */ #define HWSPINLOCK_TIMEOUT 1000 +/* The qcom hwspinlock id is always plus one from the smem host id */ +#define SMEM_HOST_ID_TO_HWSPINLOCK_ID (__x) ((__x) + 1) + +/** +* qcom_smem_bust_hwspin_lock_by_host() - bust the smem hwspinlock for a host +* @host: remote processor id +* +* Busts the hwspin_lock for the given smem host id. This helper is intended +* for remoteproc drivers that manage remoteprocs with an equivalent smem +* driver instance in the remote firmware. Drivers can force a release of the +* smem hwspin_lock if the rproc unexpectedly goes into a bad state. +* +* Context: Process context. +* +* Returns: 0 on success, otherwise negative errno. +*/ +int qcom_smem_bust_hwspin_lock_by_host (unsigned int host) +{ +/* This function is for remote procs, so ignore SMEM_HOST_APPS */ +if (host ==SMEM_HOST_APPS || host >=SMEM_HOST_COUNT ) +return -EINVAL ; + +return hwspin_lock_bust (__smem->hwlock,SMEM_HOST_ID_TO_HWSPINLOCK_ID (host)); +} +EXPORT_SYMBOL_GPL (qcom_smem_bust_hwspin_lock_by_host); +/** * qcom_smem_is_available() - Check if SMEM is available *
include/linux/soc/qcom/smem.h +2 -0
@@ -14,4 +14,6 @@ phys_addr_t qcom_smem_virt_to_phys(void *p);int qcom_smem_get_soc_id (u32 *id); +int qcom_smem_bust_hwspin_lock_by_host (unsigned int host); +#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 95/132 RDMA/efa: Properly handle unexpected AQ completions
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Margolin <[email protected]>
[ Upstream commit 2d0e7ba468eae365f3c4bc9266679e1f8dd405f0 ]
Do not try to handle admin command completion if it has an unexpected command id and print a relevant error message.
--- drivers/infiniband/hw/efa/efa_com.c | 30 ++++++++++++++++------------- 1 file changed, 17 insertions(+), 13 deletions(-)
drivers/infiniband/hw/efa/efa_com.c +17 -13
@@ -1,6 +1,6 @@// SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause /* -* Copyright 2018-2021 Amazon.com, Inc. or its affiliates. All rights reserved. +* Copyright 2018-2024 Amazon.com, Inc. or its affiliates. All rights reserved. */ #include "efa_com.h"
@@ -406,8 +406,8 @@ static struct efa_comp_ctx *efa_com_submit_admin_cmd(struct efa_com_admin_queuereturn comp_ctx; } -static void efa_com_handle_single_admin_completion (struct efa_com_admin_queue *aq, -struct efa_admin_acq_entry *cqe) +static int efa_com_handle_single_admin_completion (struct efa_com_admin_queue *aq, +struct efa_admin_acq_entry *cqe) {struct efa_comp_ctx *comp_ctx;u16 cmd_id;
@@ -416,11 +416,11 @@ static void efa_com_handle_single_admin_completion(struct efa_com_admin_queue *a EFA_ADMIN_ACQ_COMMON_DESC_COMMAND_ID); comp_ctx =efa_com_get_comp_ctx (aq, cmd_id, false); -if (!comp_ctx) { +if (comp_ctx->status !=EFA_CMD_SUBMITTED ) {ibdev_err (aq->efa_dev, -"comp_ctx is NULL. Changing the admin queue running state\n" ); -clear_bit (EFA_AQ_STATE_RUNNING_BIT , &aq->state); -return ; +"Received completion with unexpected command id[%d], sq producer: %d, sq consumer: %d, cq consumer: %d\n" , + cmd_id, aq->sq.pc, aq->sq.cc, aq->cq.cc); +return -EINVAL ; } comp_ctx->status =EFA_CMD_COMPLETED ;
@@ -428,14 +428,17 @@ static void efa_com_handle_single_admin_completion(struct efa_com_admin_queue *aif (!test_bit (EFA_AQ_STATE_POLLING_BIT , &aq->state))complete (&comp_ctx->wait_event); + +return 0 ; }static void efa_com_handle_admin_completion (struct efa_com_admin_queue *aq) {struct efa_admin_acq_entry *cqe;u16 queue_size_mask; -u16 comp_num =0 ; +u16 comp_cmds =0 ;u8 phase; +int err;u16 ci; queue_size_mask = aq->depth -1 ;
@@ -453,10 +456,12 @@ static void efa_com_handle_admin_completion(struct efa_com_admin_queue *aq)* phase bit was validated */ dma_rmb (); -efa_com_handle_single_admin_completion (aq, cqe); + err =efa_com_handle_single_admin_completion (aq, cqe); +if (!err) + comp_cmds++; + aq->cq.cc++; ci++; - comp_num++;if (ci == aq->depth) { ci =0 ; phase = !phase;
@@ -465,10 +470,9 @@ static void efa_com_handle_admin_completion(struct efa_com_admin_queue *aq) cqe = &aq->cq.entries[ci]; } - aq->cq.cc += comp_num; aq->cq.phase = phase; - aq->sq.cc += comp_num; -atomic64_add (comp_num, &aq->stats.completed_cmd); + aq->sq.cc += comp_cmds; +atomic64_add (comp_cmds, &aq->stats.completed_cmd); }static int efa_com_comp_status_to_errno (u8 comp_status)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 96/132 ionic: fix potential irq name truncation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shannon Nelson <[email protected]>
[ Upstream commit 3eb76e71b16e8ba5277bf97617aef51f5e64dbe4 ]
Address a warning about potential string truncation based on the string buffer sizes. We can add some hints to the string format specifier to set limits on the resulting possible string to squelch the complaints.
--- drivers/net/ethernet/pensando/ionic/ionic_lif.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/pensando/ionic/ionic_lif.c +1 -1
@@ -234,7 +234,7 @@ static int ionic_request_irq(struct ionic_lif *lif, struct ionic_qcq *qcq) name =dev_name (dev);snprintf (intr->name,sizeof (intr->name), -"%s-%s-%s" ,IONIC_DRV_NAME , name, q->name); +"%.5s-%.16s-%.8s" ,IONIC_DRV_NAME , name, q->name);return devm_request_irq (dev, intr->vector, ionic_isr,0 , intr->name, &qcq->napi);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 97/132 pwm: xilinx: Fix u32 overflow issue in 32-bit width PWM mode.
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ken Sloat <[email protected]>
[ Upstream commit 56f45266df67aa0f5b2a6881c8c4d16dbfff6b7d ]
This timer HW supports 8, 16 and 32-bit timer widths. This driver currently uses a u32 to store the max possible value of the timer. However, statements perform addition of 2 in xilinx_pwm_apply() when calculating the period_cycles and duty_cycles values. Since priv->max is a u32, this will result in an overflow to 1 which will not only be incorrect but fail on range comparison. This results in making it impossible to set the PWM in this timer mode.
There are two obvious solutions to the current problem:
1. Cast each instance where overflow occurs to u64.
2. Change priv->max from a u32 to a u64.
Solution #1 requires more code modifications, and leaves opportunity to introduce similar overflows if other math statements are added in the future. These may also go undetected if running in non 32-bit timer modes.
Solution #2 is the much smaller and cleaner approach and thus the chosen method in this patch.
This was tested on a Zynq UltraScale+ with multiple instances of the PWM IP.
--- include/clocksource/timer-xilinx.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/clocksource/timer-xilinx.h +1 -1
@@ -41,7 +41,7 @@ struct regmap;struct xilinx_timer_priv {struct regmap *map;struct clk *clk; -u32 max; +u64 max; };/**
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 98/132 rcu/nocb: Remove buggy bypass lock contention mitigation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frederic Weisbecker <[email protected]>
[ Upstream commit e4f78057291608f6968a6789c5ebb3bde7d95504 ]
The bypass lock contention mitigation assumes there can be at most 2 contenders on the bypass lock, following this scheme:
1) One kthread takes the bypass lock
2) Another one spins on it and increment the contended counter
3) A third one (a bypass enqueuer) sees the contended counter on and busy loops waiting on it to decrement.
However this assumption is wrong. There can be only one CPU to find the lock contended because call_rcu() (the bypass enqueuer) is the only bypass lock acquire site that may not already hold the NOCB lock beforehand, all the other sites must first contend on the NOCB lock. Therefore step 2) is impossible.
The other problem is that the mitigation assumes that contenders all belong to the same rdp CPU, which is also impossible for a raw spinlock. In theory the warning could trigger if the enqueuer holds the bypass lock and another CPU flushes the bypass queue concurrently but this is prevented from all flush users:
1) NOCB kthreads only flush if they successfully _tried_ to lock the bypass lock. So no contention management here.
2) Flush on callbacks migration happen remotely when the CPU is offline. No concurrency against bypass enqueue.
3) Flush on deoffloading happen either locally with IRQs disabled or remotely when the CPU is not yet online. No concurrency against bypass enqueue.
4) Flush on barrier entrain happen either locally with IRQs disabled or remotely when the CPU is offline. No concurrency against bypass enqueue.
For those reasons, the bypass lock contention mitigation isn't needed and is even wrong. Remove it but keep the warning reporting a contended bypass lock on a remote CPU, to keep unexpected contention awareness.
--- kernel/rcu/tree.h | 1 - kernel/rcu/tree_nocb.h | 32 ++++++-------------------------- 2 files changed, 6 insertions(+), 27 deletions(-)
kernel/rcu/tree.h +0 -1
@@ -224,7 +224,6 @@ struct rcu_data {struct swait_queue_head nocb_state_wq;/* For offloading state changes */ struct task_struct *nocb_gp_kthread;raw_spinlock_t nocb_lock;/* Guard following pair of fields. */ -atomic_t nocb_lock_contended;/* Contention experienced. */ int nocb_defer_wakeup;/* Defer wakeup of nocb_kthread. */ struct timer_list nocb_timer;/* Enforce finite deferral. */ unsigned long nocb_gp_adv_time;/* Last call_rcu() CB adv (jiffies). */
kernel/rcu/tree_nocb.h +6 -26
@@ -91,8 +91,7 @@ module_param(nocb_nobypass_lim_per_jiffy, int, 0);/* * Acquire the specified rcu_data structure's ->nocb_bypass_lock. If the -* lock isn't immediately available, increment ->nocb_lock_contended to -* flag the contention. +* lock isn't immediately available, perform minimal sanity check. */ static void rcu_nocb_bypass_lock(struct rcu_data *rdp) __acquires(&rdp->nocb_bypass_lock)
@@ -100,29 +99,12 @@ static void rcu_nocb_bypass_lock(struct rcu_data *rdp)lockdep_assert_irqs_disabled ();if (raw_spin_trylock (&rdp->nocb_bypass_lock))return ; -atomic_inc (&rdp->nocb_lock_contended); +/* +* Contention expected only when local enqueue collide with +* remote flush from kthreads. +*/ WARN_ON_ONCE (smp_processor_id () != rdp->cpu); -smp_mb__after_atomic ();/* atomic_inc() before lock. */ raw_spin_lock (&rdp->nocb_bypass_lock); -smp_mb__before_atomic ();/* atomic_dec() after lock. */ -atomic_dec (&rdp->nocb_lock_contended); -} - -/* -* Spinwait until the specified rcu_data structure's ->nocb_lock is -* not contended. Please note that this is extremely special-purpose, -* relying on the fact that at most two kthreads and one CPU contend for -* this lock, and also that the two kthreads are guaranteed to have frequent -* grace-period-duration time intervals between successive acquisitions -* of the lock. This allows us to use an extremely simple throttling -* mechanism, and further to apply it only to the CPU doing floods of -* call_rcu() invocations. Don't try this at home! -*/ -static void rcu_nocb_wait_contended (struct rcu_data *rdp) -{ -WARN_ON_ONCE (smp_processor_id () != rdp->cpu); -while (WARN_ON_ONCE (atomic_read (&rdp->nocb_lock_contended))) -cpu_relax (); }/*
@@ -510,7 +492,6 @@ static bool rcu_nocb_try_bypass(struct rcu_data *rdp, struct rcu_head *rhp, }// We need to use the bypass. -rcu_nocb_wait_contended (rdp);rcu_nocb_bypass_lock (rdp); ncbs =rcu_cblist_n_cbs (&rdp->nocb_bypass);rcu_segcblist_inc_len (&rdp->cblist);/* Must precede enqueue. */
@@ -1668,12 +1649,11 @@ static void show_rcu_nocb_state(struct rcu_data *rdp)sprintf (bufw,"%ld" , rsclp->gp_seq[RCU_WAIT_TAIL ]);sprintf (bufr,"%ld" , rsclp->gp_seq[RCU_NEXT_READY_TAIL ]); - pr_info(" CB %d^%d->%d %c%c%c%c%c%c F%ld L%ld C%d %c%c%s%c%s%c%c q%ld %c CPU %d%s\n", + pr_info(" CB %d^%d->%d %c%c%c%c%c F%ld L%ld C%d %c%c%s%c%s%c%c q%ld %c CPU %d%s\n", rdp->cpu, rdp->nocb_gp_rdp->cpu, nocb_next_rdp ? nocb_next_rdp->cpu : -1, "kK"[!!rdp->nocb_cb_kthread], "bB"[raw_spin_is_locked(&rdp->nocb_bypass_lock)], - "cC"[!!atomic_read(&rdp->nocb_lock_contended)], "lL"[raw_spin_is_locked(&rdp->nocb_lock)], "sS"[!!rdp->nocb_cb_sleep], ".W"[swait_active(&rdp->nocb_cb_wq)],
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 99/132 media: v4l2-cci: Always assign *val
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <[email protected]>
[ Upstream commit 7417b1b1f36cc214dc458e717278a27a912d3b51 ]
Always assign *val to 0 in cci_read(). This has the benefit of not requiring initialisation of the variables data is read to using cci_read(). Once smatch is fixed, it could catch the use of uninitialised reads.
--- drivers/media/v4l2-core/v4l2-cci.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/media/v4l2-core/v4l2-cci.c +9 -0
@@ -23,6 +23,15 @@ int cci_read(struct regmap *map, u32 reg, u64 *val, int *err)u8 buf[8 ];int ret; +/* +* TODO: Fix smatch. Assign *val to 0 here in order to avoid +* failing a smatch check on caller when the caller proceeds to +* read *val without initialising it on caller's side. *val is set +* to a valid value whenever this function returns 0 but smatch +* can't figure that out currently. +*/ + *val =0 ; +if (err && *err)return *err;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 100/132 usbip: Dont submit special requests twice
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Holesch <[email protected]>
[ Upstream commit 8b6b386f9aa936ed0c190446c71cf59d4a507690 ]
Skip submitting URBs, when identical requests were already sent in tweak_special_requests(). Instead call the completion handler directly to return the result of the URB.
Even though submitting those requests twice should be harmless, there are USB devices that react poorly to some duplicated requests.
One example is the ChipIdea controller implementation in U-Boot: The second SET_CONFIGURATION request makes U-Boot disable and re-enable all endpoints. Re-enabling an endpoint in the ChipIdea controller, however, was broken until U-Boot commit b272c8792502 ("usb: ci: Fix gadget reinit").
--- drivers/usb/usbip/stub_rx.c | 77 ++++++++++++++++++++++++------------- 1 file changed, 50 insertions(+), 27 deletions(-)
drivers/usb/usbip/stub_rx.c +50 -27
@@ -144,53 +144,62 @@ static int tweak_set_configuration_cmd(struct urb *urb)if (err && err != -ENODEV )dev_err (&sdev->udev->dev,"can't set config #%d, error %d\n" , config, err); -return 0 ; +return err; }static int tweak_reset_device_cmd (struct urb *urb) {struct stub_priv *priv = (struct stub_priv *) urb->context;struct stub_device *sdev = priv->sdev; +int err;dev_info (&urb->dev->dev,"usb_queue_reset_device\n" ); -if (usb_lock_device_for_reset (sdev->udev,NULL ) <0 ) { + err =usb_lock_device_for_reset (sdev->udev,NULL ); +if (err <0 ) {dev_err (&urb->dev->dev,"could not obtain lock to reset device\n" ); -return 0 ; +return err; } -usb_reset_device (sdev->udev); + err =usb_reset_device (sdev->udev);usb_unlock_device (sdev->udev); -return 0 ; +return err; }/* * clear_halt, set_interface, and set_configuration require special tricks. +* Returns 1 if request was tweaked, 0 otherwise. */ -static void tweak_special_requests (struct urb *urb) +static int tweak_special_requests (struct urb *urb) { +int err; +if (!urb || !urb->setup_packet) -return ; +return 0 ;if (usb_pipetype (urb->pipe) !=PIPE_CONTROL ) -return ; +return 0 ;if (is_clear_halt_cmd (urb))/* tweak clear_halt */ -tweak_clear_halt_cmd (urb); + err =tweak_clear_halt_cmd (urb);else if (is_set_interface_cmd (urb))/* tweak set_interface */ -tweak_set_interface_cmd (urb); + err =tweak_set_interface_cmd (urb);else if (is_set_configuration_cmd (urb))/* tweak set_configuration */ -tweak_set_configuration_cmd (urb); + err =tweak_set_configuration_cmd (urb);else if (is_reset_device_cmd (urb)) -tweak_reset_device_cmd (urb); -else + err =tweak_reset_device_cmd (urb); +else {usbip_dbg_stub_rx ("no need to tweak\n" ); +return 0 ; + } + +return !err; }/*
@@ -468,6 +477,7 @@ static void stub_recv_cmd_submit(struct stub_device *sdev,int support_sg =1 ;int np =0 ;int ret, i; +int is_tweaked;if (pipe ==-1 )return ;
@@ -580,8 +590,11 @@ static void stub_recv_cmd_submit(struct stub_device *sdev, priv->urbs[i]->pipe = pipe; priv->urbs[i]->complete = stub_complete; -/* no need to submit an intercepted request, but harmless? */ -tweak_special_requests (priv->urbs[i]); +/* +* all URBs belong to a single PDU, so a global is_tweaked flag is +* enough +*/ + is_tweaked =tweak_special_requests (priv->urbs[i]);masking_bogus_flags (priv->urbs[i]); }
@@ -594,22 +607,32 @@ static void stub_recv_cmd_submit(struct stub_device *sdev,/* urb is now ready to submit */ for (i =0 ; i < priv->num_urbs; i++) { - ret =usb_submit_urb (priv->urbs[i],GFP_KERNEL ); +if (!is_tweaked) { + ret =usb_submit_urb (priv->urbs[i],GFP_KERNEL ); -if (ret ==0 ) -usbip_dbg_stub_rx ("submit urb ok, seqnum %u\n" , - pdu->base.seqnum); -else { -dev_err (&udev->dev,"submit_urb error, %d\n" , ret); -usbip_dump_header (pdu); -usbip_dump_urb (priv->urbs[i]); +if (ret ==0 ) +usbip_dbg_stub_rx ("submit urb ok, seqnum %u\n" , + pdu->base.seqnum); +else { +dev_err (&udev->dev,"submit_urb error, %d\n" , ret); +usbip_dump_header (pdu); +usbip_dump_urb (priv->urbs[i]); +/* +* Pessimistic. +* This connection will be discarded. +*/ +usbip_event_add (ud,SDEV_EVENT_ERROR_SUBMIT ); +break ; + } + }else {/* -* Pessimistic. -* This connection will be discarded. +* An identical URB was already submitted in +* tweak_special_requests(). Skip submitting this URB to not +* duplicate the request. */ -usbip_event_add (ud,SDEV_EVENT_ERROR_SUBMIT ); -break ; + priv->urbs[i]->status =0 ; +stub_complete (priv->urbs[i]); } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 101/132 usb: typec: ucsi: Fix null pointer dereference in trace
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abhishek Pandit-Subedi <[email protected]>
[ Upstream commit 99516f76db48e1a9d54cdfed63c1babcee4e71a5 ]
ucsi_register_altmode checks IS_ERR for the alt pointer and treats NULL as valid. When CONFIG_TYPEC_DP_ALTMODE is not enabled, ucsi_register_displayport returns NULL which causes a NULL pointer dereference in trace. Rather than return NULL, call typec_port_register_altmode to register DisplayPort alternate mode as a non-controllable mode when CONFIG_TYPEC_DP_ALTMODE is not enabled.
--- drivers/usb/typec/ucsi/ucsi.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/typec/ucsi/ucsi.h +1 -1
@@ -404,7 +404,7 @@ ucsi_register_displayport(struct ucsi_connector *con, bool override, int offset, struct typec_altmode_desc *desc) { - return NULL; + return typec_port_register_altmode(con->port, desc); } static inline void
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 102/132 fsnotify: clear PARENT_WATCHED flags lazily
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amir Goldstein <[email protected]>
[ Upstream commit 172e422ffea20a89bfdc672741c1aad6fbb5044e ]
In some setups directories can have many (usually negative) dentries. Hence __fsnotify_update_child_dentry_flags() function can take a significant amount of time. Since the bulk of this function happens under inode->i_lock this causes a significant contention on the lock when we remove the watch from the directory as the __fsnotify_update_child_dentry_flags() call from fsnotify_recalc_mask() races with __fsnotify_update_child_dentry_flags() calls from __fsnotify_parent() happening on children. This can lead upto softlockup reports reported by users.
Fix the problem by calling fsnotify_update_children_dentry_flags() to set PARENT_WATCHED flags only when parent starts watching children.
When parent stops watching children, clear false positive PARENT_WATCHED flags lazily in __fsnotify_parent() for each accessed child.
--- fs/notify/fsnotify.c | 31 +++++++++++++++++++++---------- fs/notify/fsnotify.h | 2 +- fs/notify/mark.c | 32 +++++++++++++++++++++++++++++--- include/linux/fsnotify_backend.h | 8 +++++--- 4 files changed, 56 insertions(+), 17 deletions(-)
fs/notify/fsnotify.c +21 -10
@@ -103,17 +103,13 @@ void fsnotify_sb_delete(struct super_block *sb)* parent cares. Thus when an event happens on a child it can quickly tell * if there is a need to find a parent and send the event to the parent. */ -void __fsnotify_update_child_dentry_flags (struct inode *inode) +void fsnotify_set_children_dentry_flags (struct inode *inode) {struct dentry *alias; -int watched;if (!S_ISDIR (inode->i_mode))return ; -/* determine if the children should tell inode about their events */ - watched =fsnotify_inode_watches_children (inode); -spin_lock (&inode->i_lock);/* run all of the dentries associated with this inode. Since this is a * directory, there damn well better only be one item on this list */
@@ -129,10 +125,7 @@ void __fsnotify_update_child_dentry_flags(struct inode *inode)continue ;spin_lock_nested (&child->d_lock,DENTRY_D_LOCK_NESTED ); -if (watched) - child->d_flags |=DCACHE_FSNOTIFY_PARENT_WATCHED ; -else - child->d_flags &= ~DCACHE_FSNOTIFY_PARENT_WATCHED ; + child->d_flags |=DCACHE_FSNOTIFY_PARENT_WATCHED ;spin_unlock (&child->d_lock); }spin_unlock (&alias->d_lock);
@@ -140,6 +133,24 @@ void __fsnotify_update_child_dentry_flags(struct inode *inode)spin_unlock (&inode->i_lock); } +/* +* Lazily clear false positive PARENT_WATCHED flag for child whose parent had +* stopped watching children. +*/ +static void fsnotify_clear_child_dentry_flag (struct inode *pinode, +struct dentry *dentry) +{ +spin_lock (&dentry->d_lock); +/* +* d_lock is a sufficient barrier to prevent observing a non-watched +* parent state from before the fsnotify_set_children_dentry_flags() +* or fsnotify_update_flags() call that had set PARENT_WATCHED. +*/ +if (!fsnotify_inode_watches_children (pinode)) + dentry->d_flags &= ~DCACHE_FSNOTIFY_PARENT_WATCHED ; +spin_unlock (&dentry->d_lock); +} +/* Are inode/sb/mount interested in parent and name info with this event? */ static bool fsnotify_event_needs_parent (struct inode *inode,struct mount *mnt,__u32 mask)
@@ -208,7 +219,7 @@ int __fsnotify_parent(struct dentry *dentry, __u32 mask, const void *data, p_inode = parent->d_inode; p_mask =fsnotify_inode_watches_children (p_inode);if (unlikely (parent_watched && !p_mask)) -__fsnotify_update_child_dentry_flags (p_inode); +fsnotify_clear_child_dentry_flag (p_inode, dentry);/* * Include parent/name in notification either if some notification
fs/notify/fsnotify.h +1 -1
@@ -74,7 +74,7 @@ static inline void fsnotify_clear_marks_by_sb(struct super_block *sb)* update the dentry->d_flags of all of inode's children to indicate if inode cares * about events that happen to its children. */ -extern void __fsnotify_update_child_dentry_flags (struct inode *inode); +extern void fsnotify_set_children_dentry_flags (struct inode *inode);extern struct kmem_cache *fsnotify_mark_connector_cachep;
fs/notify/mark.c +29 -3
@@ -176,6 +176,24 @@ static void *__fsnotify_recalc_mask(struct fsnotify_mark_connector *conn)return fsnotify_update_iref (conn, want_iref); } +static bool fsnotify_conn_watches_children ( +struct fsnotify_mark_connector *conn) +{ +if (conn->type !=FSNOTIFY_OBJ_TYPE_INODE ) +return false; + +return fsnotify_inode_watches_children (fsnotify_conn_inode (conn)); +} + +static void fsnotify_conn_set_children_dentry_flags ( +struct fsnotify_mark_connector *conn) +{ +if (conn->type !=FSNOTIFY_OBJ_TYPE_INODE ) +return ; + +fsnotify_set_children_dentry_flags (fsnotify_conn_inode (conn)); +} +/* * Calculate mask of events for a list of marks. The caller must make sure * connector and connector->obj cannot disappear under us. Callers achieve
@@ -184,15 +202,23 @@ static void *__fsnotify_recalc_mask(struct fsnotify_mark_connector *conn)*/ void fsnotify_recalc_mask (struct fsnotify_mark_connector *conn) { +bool update_children; +if (!conn)return ;spin_lock (&conn->lock); + update_children = !fsnotify_conn_watches_children (conn);__fsnotify_recalc_mask (conn); + update_children &=fsnotify_conn_watches_children (conn);spin_unlock (&conn->lock); -if (conn->type ==FSNOTIFY_OBJ_TYPE_INODE ) -__fsnotify_update_child_dentry_flags ( -fsnotify_conn_inode (conn)); +/* +* Set children's PARENT_WATCHED flags only if parent started watching. +* When parent stops watching, we clear false positive PARENT_WATCHED +* flags lazily in __fsnotify_parent(). +*/ +if (update_children) +fsnotify_conn_set_children_dentry_flags (conn); }/* Free all connectors queued for freeing once SRCU period ends */
include/linux/fsnotify_backend.h +5 -3
@@ -563,12 +563,14 @@ static inline __u32 fsnotify_parent_needed_mask(__u32 mask)static inline int fsnotify_inode_watches_children (struct inode *inode) { +__u32 parent_mask =READ_ONCE (inode->i_fsnotify_mask); +/* FS_EVENT_ON_CHILD is set if the inode may care */ -if (!(inode->i_fsnotify_mask &FS_EVENT_ON_CHILD )) +if (!(parent_mask &FS_EVENT_ON_CHILD ))return 0 ;/* this inode might care about child events, does it care about the * specific set of events that can happen on a child? */ -return inode->i_fsnotify_mask &FS_EVENTS_POSS_ON_CHILD ; +return parent_mask &FS_EVENTS_POSS_ON_CHILD ; }/*
@@ -582,7 +584,7 @@ static inline void fsnotify_update_flags(struct dentry *dentry)/* * Serialisation of setting PARENT_WATCHED on the dentries is provided * by d_lock. If inotify_inode_watched changes after we have taken -* d_lock, the following __fsnotify_update_child_dentry_flags call will +* d_lock, the following fsnotify_set_children_dentry_flags call will * find our entry, so it will spin until we complete here, and update * us with the new state. */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 103/132 net: remove NULL-pointer net parameter in ip_metrics_convert
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Xing <[email protected]>
[ Upstream commit 61e2bbafb00e4b9a5de45e6448a7b6b818658576 ]
When I was doing some experiments, I found that when using the first parameter, namely, struct net, in ip_metrics_convert() always triggers NULL pointer crash. Then I digged into this part, realizing that we can remove this one due to its uselessness.
--- include/net/ip.h | 3 +-- include/net/tcp.h | 2 +- net/ipv4/fib_semantics.c | 5 ++--- net/ipv4/metrics.c | 8 ++++---- net/ipv4/tcp_cong.c | 11 +++++------ net/ipv6/route.c | 2 +- 6 files changed, 14 insertions(+), 17 deletions(-)
include/net/ip.h +1 -2
@@ -497,8 +497,7 @@ static inline unsigned int ip_skb_dst_mtu(struct sock *sk,return mtu -lwtunnel_headroom (skb_dst (skb)->lwtstate, mtu); } -struct dst_metrics *ip_fib_metrics_init (struct net *net,struct nlattr *fc_mx, -int fc_mx_len, +struct dst_metrics *ip_fib_metrics_init (struct nlattr *fc_mx,int fc_mx_len,struct netlink_ext_ack *extack);static inline void ip_fib_metrics_put (struct dst_metrics *fib_metrics) {
include/net/tcp.h +1 -1
@@ -1140,7 +1140,7 @@ extern struct tcp_congestion_ops tcp_reno;struct tcp_congestion_ops *tcp_ca_find (const char *name);struct tcp_congestion_ops *tcp_ca_find_key (u32 key); -u32 tcp_ca_get_key_by_name (struct net *net,const char *name,bool *ecn_ca); +u32 tcp_ca_get_key_by_name (const char *name,bool *ecn_ca);#ifdef CONFIG_INET char *tcp_ca_get_name_by_key (u32 key,char *buffer);#else
net/ipv4/fib_semantics.c +2 -3
@@ -1030,7 +1030,7 @@ bool fib_metrics_match(struct fib_config *cfg, struct fib_info *fi)bool ecn_ca = false;nla_strscpy (tmp, nla,sizeof (tmp)); - val =tcp_ca_get_key_by_name (fi->fib_net, tmp, &ecn_ca); + val =tcp_ca_get_key_by_name (tmp, &ecn_ca); }else {if (nla_len (nla) !=sizeof (u32))return false;
@@ -1459,8 +1459,7 @@ struct fib_info *fib_create_info(struct fib_config *cfg, fi =kzalloc (struct_size (fi, fib_nh, nhs),GFP_KERNEL );if (!fi) goto failure; - fi->fib_metrics =ip_fib_metrics_init (fi->fib_net, cfg->fc_mx, - cfg->fc_mx_len, extack); + fi->fib_metrics =ip_fib_metrics_init (cfg->fc_mx, cfg->fc_mx_len, extack);if (IS_ERR (fi->fib_metrics)) { err =PTR_ERR (fi->fib_metrics);kfree (fi);
net/ipv4/metrics.c +4 -4
@@ -7,7 +7,7 @@#include <net/net_namespace.h> #include <net/tcp.h> -static int ip_metrics_convert (struct net *net,struct nlattr *fc_mx, +static int ip_metrics_convert (struct nlattr *fc_mx,int fc_mx_len,u32 *metrics,struct netlink_ext_ack *extack) {
@@ -31,7 +31,7 @@ static int ip_metrics_convert(struct net *net, struct nlattr *fc_mx,char tmp[TCP_CA_NAME_MAX ];nla_strscpy (tmp, nla,sizeof (tmp)); - val =tcp_ca_get_key_by_name (net, tmp, &ecn_ca); + val =tcp_ca_get_key_by_name (tmp, &ecn_ca);if (val ==TCP_CA_UNSPEC ) {NL_SET_ERR_MSG (extack,"Unknown tcp congestion algorithm" );return -EINVAL ;
@@ -63,7 +63,7 @@ static int ip_metrics_convert(struct net *net, struct nlattr *fc_mx,return 0 ; } -struct dst_metrics *ip_fib_metrics_init (struct net *net,struct nlattr *fc_mx, +struct dst_metrics *ip_fib_metrics_init (struct nlattr *fc_mx,int fc_mx_len,struct netlink_ext_ack *extack) {
@@ -77,7 +77,7 @@ struct dst_metrics *ip_fib_metrics_init(struct net *net, struct nlattr *fc_mx,if (unlikely (!fib_metrics))return ERR_PTR (-ENOMEM ); - err =ip_metrics_convert (net, fc_mx, fc_mx_len, fib_metrics->metrics, + err =ip_metrics_convert (fc_mx, fc_mx_len, fib_metrics->metrics, extack);if (!err) {refcount_set (&fib_metrics->refcnt,1 );
net/ipv4/tcp_cong.c +5 -6
@@ -46,8 +46,7 @@ void tcp_set_ca_state(struct sock *sk, const u8 ca_state) }/* Must be called with rcu lock held */ -static struct tcp_congestion_ops *tcp_ca_find_autoload (struct net *net, -const char *name) +static struct tcp_congestion_ops *tcp_ca_find_autoload (const char *name) {struct tcp_congestion_ops *ca =tcp_ca_find (name);
@@ -182,7 +181,7 @@ int tcp_update_congestion_control(struct tcp_congestion_ops *ca, struct tcp_congreturn ret; } -u32 tcp_ca_get_key_by_name (struct net *net,const char *name,bool *ecn_ca) +u32 tcp_ca_get_key_by_name (const char *name,bool *ecn_ca) {const struct tcp_congestion_ops *ca;u32 key =TCP_CA_UNSPEC ;
@@ -190,7 +189,7 @@ u32 tcp_ca_get_key_by_name(struct net *net, const char *name, bool *ecn_ca)might_sleep ();rcu_read_lock (); - ca =tcp_ca_find_autoload (net, name); + ca =tcp_ca_find_autoload (name);if (ca) { key = ca->key; *ecn_ca = ca->flags &TCP_CONG_NEEDS_ECN ;
@@ -287,7 +286,7 @@ int tcp_set_default_congestion_control(struct net *net, const char *name)int ret;rcu_read_lock (); - ca =tcp_ca_find_autoload (net, name); + ca =tcp_ca_find_autoload (name);if (!ca) { ret = -ENOENT ; }else if (!bpf_try_module_get (ca, ca->owner)) {
@@ -425,7 +424,7 @@ int tcp_set_congestion_control(struct sock *sk, const char *name, bool load,if (!load) ca =tcp_ca_find (name);else - ca =tcp_ca_find_autoload (sock_net (sk), name); + ca =tcp_ca_find_autoload (name);/* No change asking for existing value */ if (ca == icsk->icsk_ca_ops) {
net/ipv6/route.c +1 -1
@@ -3754,7 +3754,7 @@ static struct fib6_info *ip6_route_info_create(struct fib6_config *cfg,if (!rt) goto out; - rt->fib6_metrics =ip_fib_metrics_init (net, cfg->fc_mx, cfg->fc_mx_len, + rt->fib6_metrics =ip_fib_metrics_init (cfg->fc_mx, cfg->fc_mx_len, extack);if (IS_ERR (rt->fib6_metrics)) { err =PTR_ERR (rt->fib6_metrics);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 104/132 drm/amdgu: fix Unintentional integer overflow for mall size
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Zhang <[email protected]>
[ Upstream commit c09d2eff81a997c169e0cacacd6b60c5e3aa33f2 ]
Potentially overflowing expression mall_size_per_umc * adev->gmc.num_umc with type unsigned int (32 bits, unsigned) is evaluated using 32-bit arithmetic,and then used in a context that expects an expression of type u64 (64 bits, unsigned).
--- drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c +1 -1
@@ -1550,7 +1550,7 @@ static int amdgpu_discovery_get_mall_info(struct amdgpu_device *adev)break ;case 2 : mall_size_per_umc =le32_to_cpu (mall_info->v2.mall_size_per_umc); - adev->gmc.mall_size = mall_size_per_umc * adev->gmc.num_umc; + adev->gmc.mall_size = (uint64_t )mall_size_per_umc * adev->gmc.num_umc;break ;default : dev_err(adev->dev,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 105/132 regmap: spi: Fix potential off-by-one when calculating reserved size
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit d4ea1d504d2701ba04412f98dc00d45a104c52ab ]
If we ever meet a hardware that uses weird register bits and padding, we may end up in off-by-one error since x/8 + y/8 might not be equal to (x + y)/8 in some cases.
bits pad x/8+y/8 (x+y)/8 4..7 0..3 0 0 // x + y from 4 up to 7 4..7 4..7 0 1 // x + y from 8 up to 11 4..7 8..11 1 1 // x + y from 12 up to 15 8..15 0..7 1 1 // x + y from 8 up to 15 8..15 8..15 2 2 // x + y from 16 up to 23
Fix this by using (x+y)/8.
--- drivers/base/regmap/regmap-spi.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/base/regmap/regmap-spi.c +1 -2
@@ -122,8 +122,7 @@ static const struct regmap_bus *regmap_get_spi_bus(struct spi_device *spi,return ERR_PTR (-ENOMEM ); max_msg_size =spi_max_message_size (spi); - reg_reserve_size = config->reg_bits /BITS_PER_BYTE - + config->pad_bits /BITS_PER_BYTE ; + reg_reserve_size = (config->reg_bits + config->pad_bits) /BITS_PER_BYTE ;if (max_size + reg_reserve_size > max_msg_size) max_size -= reg_reserve_size;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 106/132 smack: tcp: ipv4, fix incorrect labeling
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Casey Schaufler <[email protected]>
[ Upstream commit 2fe209d0ad2e2729f7e22b9b31a86cc3ff0db550 ]
Currently, Smack mirrors the label of incoming tcp/ipv4 connections:
when a label 'foo' connects to a label 'bar' with tcp/ipv4, 'foo' always gets 'foo' in returned ipv4 packets. So,
1) returned packets are incorrectly labeled ('foo' instead of 'bar')
2) 'bar' can write to 'foo' without being authorized to write.
Here is a scenario how to see this:
* Take two machines, let's call them C and S,
with active Smack in the default state
(no settings, no rules, no labeled hosts, only builtin labels)
* At S, add Smack rule 'foo bar w'
(labels 'foo' and 'bar' are instantiated at S at this moment)
* At S, at label 'bar', launch a program
that listens for incoming tcp/ipv4 connections
* From C, at label 'foo', connect to the listener at S. (label 'foo' is instantiated at C at this moment) Connection succeedes and works.
* Send some data in both directions.
* Collect network traffic of this connection.
All packets in both directions are labeled with the CIPSO of the label 'foo'. Hence, label 'bar' writes to 'foo' without being authorized, and even without ever being known at C.
If anybody cares: exactly the same happens with DCCP.
This behavior 1st manifested in release 2.6.29.4 (see Fixes below) and it looks unintentional. At least, no explanation was provided.
I changed returned packes label into the 'bar', to bring it into line with the Smack documentation claims.
--- security/smack/smack_lsm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
security/smack/smack_lsm.c +1 -1
@@ -4354,7 +4354,7 @@ static int smack_inet_conn_request(const struct sock *sk, struct sk_buff *skb,rcu_read_unlock ();if (hskp ==NULL ) - rc =netlbl_req_setattr (req, &skp->smk_netlabel); + rc =netlbl_req_setattr (req, &ssp->smk_out->smk_netlabel);else netlbl_req_delattr (req);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 107/132 platform/chrome: cros_ec_lpc: MEC access can use an AML mutex
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Walsh <[email protected]>
[ Upstream commit 60c7df66450e3a7821a8d68496c20c95de6a15c5 ]
Framework Laptops have ACPI code which accesses the MEC memory. It uses an AML mutex to prevent concurrent access. But the cros_ec_lpc driver was not aware of this mutex. The ACPI code and LPC driver both attempted to talk to the EC at the same time, messing up communication with the EC.
Allow the LPC driver MEC code to find and use the AML mutex.
--- drivers/platform/chrome/cros_ec_lpc_mec.c | 76 ++++++++++++++++++++++- drivers/platform/chrome/cros_ec_lpc_mec.h | 11 ++++ 2 files changed, 85 insertions(+), 2 deletions(-)
drivers/platform/chrome/cros_ec_lpc_mec.c +74 -2
@@ -10,13 +10,65 @@#include "cros_ec_lpc_mec.h" +#define ACPI_LOCK_DELAY_MS 500 +/* * This mutex must be held while accessing the EMI unit. We can't rely on the * EC mutex because memmap data may be accessed without it being held. */ static DEFINE_MUTEX (io_mutex); +/* +* An alternative mutex to be used when the ACPI AML code may also +* access memmap data. When set, this mutex is used in preference to +* io_mutex. +*/ +static acpi_handle aml_mutex; +static u16 mec_emi_base, mec_emi_end; +/** +* cros_ec_lpc_mec_lock() - Acquire mutex for EMI +* +* @return: Negative error code, or zero for success +*/ +static int cros_ec_lpc_mec_lock (void ) +{ +bool success; + +if (!aml_mutex) { +mutex_lock (&io_mutex); +return 0 ; + } + + success =ACPI_SUCCESS (acpi_acquire_mutex (aml_mutex, +NULL ,ACPI_LOCK_DELAY_MS )); +if (!success) +return -EBUSY ; + +return 0 ; +} + +/** +* cros_ec_lpc_mec_unlock() - Release mutex for EMI +* +* @return: Negative error code, or zero for success +*/ +static int cros_ec_lpc_mec_unlock (void ) +{ +bool success; + +if (!aml_mutex) { +mutex_unlock (&io_mutex); +return 0 ; + } + + success =ACPI_SUCCESS (acpi_release_mutex (aml_mutex,NULL )); +if (!success) +return -EBUSY ; + +return 0 ; +} +/** * cros_ec_lpc_mec_emi_write_address() - Initialize EMI at a given address. *
@@ -77,6 +129,7 @@ u8 cros_ec_lpc_io_bytes_mec(enum cros_ec_lpc_mec_io_type io_type,int io_addr;u8 sum =0 ;enum cros_ec_lpc_mec_emi_access_mode access, new_access; +int ret;/* Return checksum of 0 if window is not initialized */ WARN_ON (mec_emi_base ==0 || mec_emi_end ==0 );
@@ -92,7 +145,9 @@ u8 cros_ec_lpc_io_bytes_mec(enum cros_ec_lpc_mec_io_type io_type,else access =ACCESS_TYPE_LONG_AUTO_INCREMENT ; -mutex_lock (&io_mutex); + ret =cros_ec_lpc_mec_lock (); +if (ret) +return ret;/* Initialize I/O at desired address */ cros_ec_lpc_mec_emi_write_address (offset, access);
@@ -134,7 +189,9 @@ u8 cros_ec_lpc_io_bytes_mec(enum cros_ec_lpc_mec_io_type io_type, } done: -mutex_unlock (&io_mutex); + ret =cros_ec_lpc_mec_unlock (); +if (ret) +return ret;return sum; }
@@ -146,3 +203,18 @@ void cros_ec_lpc_mec_init(unsigned int base, unsigned int end) mec_emi_end = end; }EXPORT_SYMBOL (cros_ec_lpc_mec_init); + +int cros_ec_lpc_mec_acpi_mutex (struct acpi_device *adev,const char *pathname) +{ +int status; + +if (!adev) +return -ENOENT ; + + status =acpi_get_handle (adev->handle, pathname, &aml_mutex); +if (ACPI_FAILURE (status)) +return -ENOENT ; + +return 0 ; +} +EXPORT_SYMBOL (cros_ec_lpc_mec_acpi_mutex);
drivers/platform/chrome/cros_ec_lpc_mec.h +11 -0
@@ -8,6 +8,8 @@#ifndef __CROS_EC_LPC_MEC_H#define __CROS_EC_LPC_MEC_H +#include <linux/acpi.h> +enum cros_ec_lpc_mec_emi_access_mode {/* 8-bit access */ ACCESS_TYPE_BYTE = 0x0,
@@ -45,6 +47,15 @@ enum cros_ec_lpc_mec_io_type {*/ void cros_ec_lpc_mec_init (unsigned int base,unsigned int end); +/** +* cros_ec_lpc_mec_acpi_mutex() - Find and set ACPI mutex for MEC +* +* @adev: Parent ACPI device +* @pathname: Name of AML mutex +* @return: Negative error code, or zero for success +*/ +int cros_ec_lpc_mec_acpi_mutex (struct acpi_device *adev,const char *pathname); +/** * cros_ec_lpc_mec_in_range() - Determine if addresses are in MEC EMI range. *
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 108/132 net/mlx5e: SHAMPO, Fix incorrect page release
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dragos Tatulea <[email protected]>
[ Upstream commit 70bd03b89f20b9bbe51a7f73c4950565a17a45f7 ]
Under the following conditions:
1) No skb created yet
2) header_size == 0 (no SHAMPO header)
3) header_index + 1 % MLX5E_SHAMPO_WQ_HEADER_PER_PAGE == 0 (this is the last page fragment of a SHAMPO header page)
a new skb is formed with a page that is NOT a SHAMPO header page (it is a regular data page). Further down in the same function (mlx5e_handle_rx_cqe_mpwrq_shampo()), a SHAMPO header page from header_index is released. This is wrong and it leads to SHAMPO header pages being released more than once.
--- drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +2 -1
@@ -2369,7 +2369,8 @@ static void mlx5e_handle_rx_cqe_mpwrq_shampo(struct mlx5e_rq *rq, struct mlx5_cqif (flush)mlx5e_shampo_flush_skb (rq, cqe, match); free_hd_entry: -mlx5e_free_rx_shampo_hd_entry (rq, header_index); +if (likely (head_size)) +mlx5e_free_rx_shampo_hd_entry (rq, header_index); mpwrq_cqe_out:if (likely (wi->consumed_strides < rq->mpwqe.num_strides))return ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 109/132 drm/meson: plane: Add error handling
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoran Liu <[email protected]>
[ Upstream commit 3c28b239620e249b68beeca17f429e317fa6b8d4 ]
This patch adds robust error handling to the meson_plane_create function in drivers/gpu/drm/meson/meson_plane.c. The function previously lacked proper handling for potential failure scenarios of the drm_universal_plane_init call.
--- drivers/gpu/drm/meson/meson_plane.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-)
drivers/gpu/drm/meson/meson_plane.c +11 -6
@@ -534,6 +534,7 @@ int meson_plane_create(struct meson_drm *priv)struct meson_plane *meson_plane;struct drm_plane *plane;const uint64_t *format_modifiers = format_modifiers_default; +int ret; meson_plane =devm_kzalloc (priv->drm->dev,sizeof (*meson_plane),GFP_KERNEL );
@@ -548,12 +549,16 @@ int meson_plane_create(struct meson_drm *priv)else if (meson_vpu_is_compatible (priv,VPU_COMPATIBLE_G12A )) format_modifiers = format_modifiers_afbc_g12a; -drm_universal_plane_init (priv->drm, plane,0xFF , - &meson_plane_funcs, - supported_drm_formats, -ARRAY_SIZE (supported_drm_formats), - format_modifiers, -DRM_PLANE_TYPE_PRIMARY ,"meson_primary_plane" ); + ret =drm_universal_plane_init (priv->drm, plane,0xFF , + &meson_plane_funcs, + supported_drm_formats, +ARRAY_SIZE (supported_drm_formats), + format_modifiers, +DRM_PLANE_TYPE_PRIMARY ,"meson_primary_plane" ); +if (ret) { +devm_kfree (priv->drm->dev, meson_plane); +return ret; + }drm_plane_helper_add (plane, &meson_plane_helper_funcs);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 110/132 crypto: stm32/cryp - call finalize with bh disabled
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxime Méré <[email protected]>
[ Upstream commit 56ddb9aa3b324c2d9645b5a7343e46010cf3f6ce ]
The finalize operation in interrupt mode produce a produces a spinlock recursion warning. The reason is the fact that BH must be disabled during this process.
--- drivers/crypto/stm32/stm32-cryp.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/crypto/stm32/stm32-cryp.c +5 -1
@@ -11,6 +11,7 @@#include <crypto/internal/des.h> #include <crypto/internal/skcipher.h> #include <crypto/scatterwalk.h> +#include <linux/bottom_half.h> #include <linux/clk.h> #include <linux/delay.h> #include <linux/err.h>
@@ -1665,8 +1666,11 @@ static irqreturn_t stm32_cryp_irq_thread(int irq, void *arg) it_mask &= ~IMSCR_OUT ;stm32_cryp_write (cryp, cryp->caps->imsc, it_mask); -if (!cryp->payload_in && !cryp->header_in && !cryp->payload_out) +if (!cryp->payload_in && !cryp->header_in && !cryp->payload_out) { +local_bh_disable ();stm32_cryp_finish_req (cryp,0 ); +local_bh_enable (); + }return IRQ_HANDLED ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 111/132 gfs2: Revert "Add quota_change type"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Gruenbacher <[email protected]>
[ Upstream commit ec4b5200c8af9ce021399d3192b3379c089396c3 ]
Commit 432928c93779 ("gfs2: Add quota_change type") makes the incorrect assertion that function do_qc() should behave differently in the two contexts it is used in, but that isn't actually true. In all cases, do_qc() grabs a "reference" when it starts using a slot in the per-node quota changes file, and it releases that "reference" when no more residual changes remain. Revert that broken commit.
There are some remaining issues with function do_qc() which are addressed in the next commit.
This reverts commit 432928c9377959684c748a9bc6553ed2d3c2ea4f.
--- fs/gfs2/quota.c | 19 +++++++------------ fs/gfs2/util.c | 6 +++--- 2 files changed, 10 insertions(+), 15 deletions(-)
fs/gfs2/quota.c +7 -12
@@ -75,9 +75,6 @@#define GFS2_QD_HASH_SIZE BIT(GFS2_QD_HASH_SHIFT)#define GFS2_QD_HASH_MASK (GFS2_QD_HASH_SIZE - 1) -#define QC_CHANGE 0 -#define QC_SYNC 1 -/* Lock order: qd_lock -> bucket lock -> qd->lockref.lock -> lru lock */ /* -> sd_bitmap_lock */ static DEFINE_SPINLOCK (qd_lock);
@@ -697,7 +694,7 @@ static int sort_qd(const void *a, const void *b)return 0 ; } -static void do_qc (struct gfs2_quota_data *qd,s64 change,int qc_type) +static void do_qc (struct gfs2_quota_data *qd,s64 change) {struct gfs2_sbd *sdp = qd->qd_sbd;struct gfs2_inode *ip =GFS2_I (sdp->sd_qc_inode);
@@ -722,18 +719,16 @@ static void do_qc(struct gfs2_quota_data *qd, s64 change, int qc_type) qd->qd_change = x;spin_unlock (&qd_lock); -if (qc_type ==QC_CHANGE ) { -if (!test_and_set_bit (QDF_CHANGE , &qd->qd_flags)) { -qd_hold (qd); -slot_hold (qd); - } - }else { +if (!x) {gfs2_assert_warn (sdp,test_bit (QDF_CHANGE , &qd->qd_flags));clear_bit (QDF_CHANGE , &qd->qd_flags); qc->qc_flags =0 ; qc->qc_id =0 ;slot_put (qd);qd_put (qd); + }else if (!test_and_set_bit (QDF_CHANGE , &qd->qd_flags)) { +qd_hold (qd); +slot_hold (qd); }if (change <0 )/* Reset quiet flag if we freed some blocks */
@@ -978,7 +973,7 @@ static int do_sync(unsigned int num_qd, struct gfs2_quota_data **qda)if (error) goto out_end_trans; -do_qc (qd, -qd->qd_change_sync,QC_SYNC ); +do_qc (qd, -qd->qd_change_sync);set_bit (QDF_REFRESH , &qd->qd_flags); }
@@ -1300,7 +1295,7 @@ void gfs2_quota_change(struct gfs2_inode *ip, s64 change,if (qid_eq (qd->qd_id,make_kqid_uid (uid)) ||qid_eq (qd->qd_id,make_kqid_gid (gid))) { -do_qc (qd, change,QC_CHANGE ); +do_qc (qd, change); } } }
fs/gfs2/util.c +3 -3
@@ -99,12 +99,12 @@ int check_journal_clean(struct gfs2_sbd *sdp, struct gfs2_jdesc *jd,*/ int gfs2_freeze_lock_shared (struct gfs2_sbd *sdp) { +int flags =LM_FLAG_NOEXP |GL_EXACT ;int error; - error =gfs2_glock_nq_init (sdp->sd_freeze_gl,LM_ST_SHARED , -LM_FLAG_NOEXP |GL_EXACT , + error =gfs2_glock_nq_init (sdp->sd_freeze_gl,LM_ST_SHARED , flags, &sdp->sd_freeze_gh); -if (error) +if (error && error !=GLR_TRYFAILED )fs_err (sdp,"can't lock the freeze glock: %d\n" , error);return error; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 112/132 drm/bridge: tc358767: Check if fully initialized before signalling HPD event via IRQ
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
[ Upstream commit 162e48cb1d84c2c966b649b8ac5c9d4f75f6d44f ]
Make sure the connector is fully initialized before signalling any HPD events via drm_kms_helper_hotplug_event(), otherwise this may lead to NULL pointer dereference.
--- drivers/gpu/drm/bridge/tc358767.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/bridge/tc358767.c +1 -1
@@ -2034,7 +2034,7 @@ static irqreturn_t tc_irq_handler(int irq, void *arg)dev_err (tc->dev,"syserr %x\n" , stat); } -if (tc->hpd_pin >=0 && tc->bridge.dev) { +if (tc->hpd_pin >=0 && tc->bridge.dev && tc->aux.drm_dev) {/* * H is triggered when the GPIO goes high. *
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 113/132 dmaengine: altera-msgdma: use irq variant of spin_lock/unlock while invoking callbacks
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olivier Dautricourt <[email protected]>
[ Upstream commit 261d3a85d959841821ca0d69f9d7b0d4087661c4 ]
As we first take the lock with spin_lock_irqsave in msgdma_tasklet, Lockdep might complain about this. Inspired by commit 9558cf4ad07e ("dmaengine: zynqmp_dma: fix lockdep warning in tasklet")
--- drivers/dma/altera-msgdma.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/dma/altera-msgdma.c +3 -2
@@ -583,6 +583,7 @@ static void msgdma_issue_pending(struct dma_chan *chan)static void msgdma_chan_desc_cleanup (struct msgdma_device *mdev) {struct msgdma_sw_desc *desc, *next; +unsigned long irqflags;list_for_each_entry_safe (desc, next, &mdev->done_list, node) {struct dmaengine_desc_callback cb;
@@ -591,9 +592,9 @@ static void msgdma_chan_desc_cleanup(struct msgdma_device *mdev)dmaengine_desc_get_callback (&desc->async_tx, &cb);if (dmaengine_desc_callback_valid (&cb)) { -spin_unlock (&mdev->lock); +spin_unlock_irqrestore (&mdev->lock, irqflags);dmaengine_desc_callback_invoke (&cb,NULL ); -spin_lock (&mdev->lock); +spin_lock_irqsave (&mdev->lock, irqflags); }/* Run any dependencies, then free the descriptor */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 114/132 dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olivier Dautricourt <[email protected]>
[ Upstream commit 54e4ada1a4206f878e345ae01cf37347d803d1b1 ]
Remove list_del call in msgdma_chan_desc_cleanup, this should be the role of msgdma_free_descriptor. In consequence replace list_add_tail with list_move_tail in msgdma_free_descriptor.
This fixes the path:
msgdma_free_chan_resources -> msgdma_free_descriptors -> msgdma_free_desc_list -> msgdma_free_descriptor
which does not correctly free the descriptors as first nodes were not removed from the list.
--- drivers/dma/altera-msgdma.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/dma/altera-msgdma.c +1 -3
@@ -233,7 +233,7 @@ static void msgdma_free_descriptor(struct msgdma_device *mdev,struct msgdma_sw_desc *child, *next; mdev->desc_free_cnt++; -list_add_tail (&desc->node, &mdev->free_list); +list_move_tail (&desc->node, &mdev->free_list);list_for_each_entry_safe (child, next, &desc->tx_list, node) { mdev->desc_free_cnt++;list_move_tail (&child->node, &mdev->free_list);
@@ -588,8 +588,6 @@ static void msgdma_chan_desc_cleanup(struct msgdma_device *mdev)list_for_each_entry_safe (desc, next, &mdev->done_list, node) {struct dmaengine_desc_callback cb; -list_del (&desc->node); -dmaengine_desc_get_callback (&desc->async_tx, &cb);if (dmaengine_desc_callback_valid (&cb)) {spin_unlock_irqrestore (&mdev->lock, irqflags);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 115/132 hwmon: (k10temp) Check return value of amd_smn_read()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yazen Ghannam <[email protected]>
[ Upstream commit c2d79cc5455c891de6c93e1e0c73d806e299c54f ]
Check the return value of amd_smn_read() before saving a value. This ensures invalid values aren't saved or used.
There are three cases here with slightly different behavior:
1) read_tempreg_nb_zen():
This is a function pointer which does not include a return code. In this case, set the register value to 0 on failure. This enforces Read-as-Zero behavior.
2) k10temp_read_temp():
This function does have return codes, so return the error code from the failed register read. Continued operation is not necessary, since there is no valid data from the register. Furthermore, if the register value was set to 0, then the following operation would underflow.
3) k10temp_get_ccd_support():
This function reads the same register from multiple CCD instances in a loop. And a bitmask is formed if a specific bit is set in each register instance. The loop should continue on a failed register read, skipping the bit check.
--- drivers/hwmon/k10temp.c | 36 +++++++++++++++++++++++++++--------- 1 file changed, 27 insertions(+), 9 deletions(-)
drivers/hwmon/k10temp.c +27 -9
@@ -153,8 +153,9 @@ static void read_tempreg_nb_f15(struct pci_dev *pdev, u32 *regval)static void read_tempreg_nb_zen (struct pci_dev *pdev,u32 *regval) { -amd_smn_read (amd_pci_dev_to_node_id (pdev), -ZEN_REPORTED_TEMP_CTRL_BASE , regval); +if (amd_smn_read (amd_pci_dev_to_node_id (pdev), +ZEN_REPORTED_TEMP_CTRL_BASE , regval)) + *regval =0 ; }static long get_raw_temp (struct k10temp_data *data)
@@ -205,6 +206,7 @@ static int k10temp_read_temp(struct device *dev, u32 attr, int channel, long *val) {struct k10temp_data *data =dev_get_drvdata (dev); +int ret = -EOPNOTSUPP ;u32 regval;switch (attr) {
@@ -221,13 +223,17 @@ static int k10temp_read_temp(struct device *dev, u32 attr, int channel, *val =0 ;break ; case 2 ... 13: /* Tccd{1-12} */ -amd_smn_read (amd_pci_dev_to_node_id (data->pdev), -ZEN_CCD_TEMP (data->ccd_offset, channel -2 ), - ®val); + ret =amd_smn_read (amd_pci_dev_to_node_id (data->pdev), +ZEN_CCD_TEMP (data->ccd_offset, channel -2 ), + ®val); + +if (ret) +return ret; + *val = (regval &ZEN_CCD_TEMP_MASK ) *125 -49000 ;break ;default : -return -EOPNOTSUPP ; +return ret; }break ;case hwmon_temp_max:
@@ -243,7 +249,7 @@ static int k10temp_read_temp(struct device *dev, u32 attr, int channel, - ((regval >> 24) & 0xf)) * 500 + 52000;break ;default : -return -EOPNOTSUPP ; +return ret; }return 0 ; }
@@ -381,8 +387,20 @@ static void k10temp_get_ccd_support(struct pci_dev *pdev,int i;for (i =0 ; i < limit; i++) { -amd_smn_read (amd_pci_dev_to_node_id (pdev), -ZEN_CCD_TEMP (data->ccd_offset, i), ®val); +/* +* Ignore inaccessible CCDs. +* +* Some systems will return a register value of 0, and the TEMP_VALID +* bit check below will naturally fail. +* +* Other systems will return a PCI_ERROR_RESPONSE (0xFFFFFFFF) for +* the register value. And this will incorrectly pass the TEMP_VALID +* bit check. +*/ +if (amd_smn_read (amd_pci_dev_to_node_id (pdev), +ZEN_CCD_TEMP (data->ccd_offset, i), ®val)) +continue ; +if (regval &ZEN_CCD_TEMP_VALID ) data->show_temp |=BIT (TCCD_BIT (i)); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 116/132 wifi: cfg80211: make hash table duplicates more survivable
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 7f12e26a194d0043441f870708093d9c2c3bad7d ]
Jiazi Li reported that they occasionally see hash table duplicates as evidenced by the WARN_ON() in rb_insert_bss() in this code. It isn't clear how that happens, nor have I been able to reproduce it, but if it does happen, the kernel crashes later, when it tries to unhash the entry that's now not hashed.
Try to make this situation more survivable by removing the BSS from the list(s) as well, that way it's fully leaked here (as had been the intent in the hash insert error path), and no longer reachable through the list(s) so it shouldn't be unhashed again later.
--- net/wireless/scan.c | 46 +++++++++++++++++++++++++++++++++------------ 1 file changed, 34 insertions(+), 12 deletions(-)
net/wireless/scan.c +34 -12
@@ -1562,7 +1562,7 @@ struct cfg80211_bss *cfg80211_get_bss(struct wiphy *wiphy, }EXPORT_SYMBOL (cfg80211_get_bss); -static void rb_insert_bss (struct cfg80211_registered_device *rdev, +static bool rb_insert_bss (struct cfg80211_registered_device *rdev,struct cfg80211_internal_bss *bss) {struct rb_node **p = &rdev->bss_tree.rb_node;
@@ -1578,7 +1578,7 @@ static void rb_insert_bss(struct cfg80211_registered_device *rdev,if (WARN_ON (!cmp)) {/* will sort of leak this BSS */ -return ; +return false; }if (cmp <0 )
@@ -1589,6 +1589,7 @@ static void rb_insert_bss(struct cfg80211_registered_device *rdev,rb_link_node (&bss->rbn, parent, p);rb_insert_color (&bss->rbn, &rdev->bss_tree); +return true; } static struct cfg80211_internal_bss *
@@ -1615,6 +1616,34 @@ rb_find_bss(struct cfg80211_registered_device *rdev,return NULL ; } +static void cfg80211_insert_bss (struct cfg80211_registered_device *rdev, +struct cfg80211_internal_bss *bss) +{ +lockdep_assert_held (&rdev->bss_lock); + +if (!rb_insert_bss (rdev, bss)) +return ; +list_add_tail (&bss->list, &rdev->bss_list); + rdev->bss_entries++; +} + +static void cfg80211_rehash_bss (struct cfg80211_registered_device *rdev, +struct cfg80211_internal_bss *bss) +{ +lockdep_assert_held (&rdev->bss_lock); + +rb_erase (&bss->rbn, &rdev->bss_tree); +if (!rb_insert_bss (rdev, bss)) { +list_del (&bss->list); +if (!list_empty (&bss->hidden_list)) +list_del_init (&bss->hidden_list); +if (!list_empty (&bss->pub.nontrans_list)) +list_del_init (&bss->pub.nontrans_list); + rdev->bss_entries--; + } + rdev->bss_generation++; +} +static bool cfg80211_combine_bsses (struct cfg80211_registered_device *rdev,struct cfg80211_internal_bss *new) {
@@ -1876,9 +1905,7 @@ __cfg80211_bss_update(struct cfg80211_registered_device *rdev,bss_ref_get (rdev,bss_from_pub (tmp->pub.transmitted_bss)); } -list_add_tail (&new->list, &rdev->bss_list); - rdev->bss_entries++; -rb_insert_bss (rdev, new); +cfg80211_insert_bss (rdev, new); found = new; }
@@ -3111,19 +3138,14 @@ void cfg80211_update_assoc_bss_entry(struct wireless_dev *wdev,if (!WARN_ON (!__cfg80211_unlink_bss (rdev, new))) rdev->bss_generation++; } - -rb_erase (&cbss->rbn, &rdev->bss_tree); -rb_insert_bss (rdev, cbss); - rdev->bss_generation++; +cfg80211_rehash_bss (rdev, cbss);list_for_each_entry_safe (nontrans_bss, tmp, &cbss->pub.nontrans_list, nontrans_list) { bss =bss_from_pub (nontrans_bss); bss->pub.channel = chan; -rb_erase (&bss->rbn, &rdev->bss_tree); -rb_insert_bss (rdev, bss); - rdev->bss_generation++; +cfg80211_rehash_bss (rdev, bss); } done:
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 117/132 f2fs: fix to do sanity check on blocks for inline_data inode
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit c240c87bcd44a1a2375fc8ef8c645d1f1fe76466 ]
inode can be fuzzed, so it can has F2FS_INLINE_DATA flag and valid i_blocks/i_nid value, this patch supports to do extra sanity check to detect such corrupted state.
--- fs/f2fs/f2fs.h | 2 +- fs/f2fs/inline.c | 20 +++++++++++++++++++- fs/f2fs/inode.c | 2 +- 3 files changed, 21 insertions(+), 3 deletions(-)
fs/f2fs/f2fs.h +1 -1
@@ -4148,7 +4148,7 @@ extern struct kmem_cache *f2fs_inode_entry_slab;* inline.c */ bool f2fs_may_inline_data (struct inode *inode); -bool f2fs_sanity_check_inline_data (struct inode *inode); +bool f2fs_sanity_check_inline_data (struct inode *inode,struct page *ipage);bool f2fs_may_inline_dentry (struct inode *inode);void f2fs_do_read_inline_data (struct page *page,struct page *ipage); void f2fs_truncate_inline_inode(struct inode *inode,
fs/f2fs/inline.c +19 -1
@@ -33,11 +33,29 @@ bool f2fs_may_inline_data(struct inode *inode)return !f2fs_post_read_required (inode); } -bool f2fs_sanity_check_inline_data (struct inode *inode) +static bool inode_has_blocks (struct inode *inode,struct page *ipage) +{ +struct f2fs_inode *ri =F2FS_INODE (ipage); +int i; + +if (F2FS_HAS_BLOCKS (inode)) +return true; + +for (i =0 ; i <DEF_NIDS_PER_INODE ; i++) { +if (ri->i_nid[i]) +return true; + } +return false; +} + +bool f2fs_sanity_check_inline_data (struct inode *inode,struct page *ipage) {if (!f2fs_has_inline_data (inode))return false; +if (inode_has_blocks (inode, ipage)) +return false; +if (!support_inline_data (inode))return true;
fs/f2fs/inode.c +1 -1
@@ -346,7 +346,7 @@ static bool sanity_check_inode(struct inode *inode, struct page *node_page) } } -if (f2fs_sanity_check_inline_data (inode)) { +if (f2fs_sanity_check_inline_data (inode, node_page)) {f2fs_warn (sbi,"%s: inode (ino=%lx, mode=%u) should not have inline_data, run fsck to fix" , __func__, inode->i_ino, inode->i_mode);return false;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 118/132 driver: iio: add missing checks on iio_infos callback access
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julien Stephan <[email protected]>
[ Upstream commit c4ec8dedca961db056ec85cb7ca8c9f7e2e92252 ]
Some callbacks from iio_info structure are accessed without any check, so if a driver doesn't implement them trying to access the corresponding sysfs entries produce a kernel oops such as:
[ 2203.527791] Unable to handle kernel NULL pointer dereference at virtual address 00000000 when execute [...] [ 2203.783416] Call trace: [ 2203.783429] iio_read_channel_info_avail from dev_attr_show+0x18/0x48 [ 2203.789807] dev_attr_show from sysfs_kf_seq_show+0x90/0x120 [ 2203.794181] sysfs_kf_seq_show from seq_read_iter+0xd0/0x4e4 [ 2203.798555] seq_read_iter from vfs_read+0x238/0x2a0 [ 2203.802236] vfs_read from ksys_read+0xa4/0xd4 [ 2203.805385] ksys_read from ret_fast_syscall+0x0/0x54 [ 2203.809135] Exception stack(0xe0badfa8 to 0xe0badff0) [ 2203.812880] dfa0: 00000003 b6f10f80 00000003 b6eab000 00020000 00000000 [ 2203.819746] dfc0: 00000003 b6f10f80 7ff00000 00000003 00000003 00000000 00020000 00000000 [ 2203.826619] dfe0: b6e1bc88 bed80958 b6e1bc94 b6e1bcb0 [ 2203.830363] Code: bad PC value [ 2203.832695] ---[ end trace 0000000000000000 ]---
--- drivers/iio/industrialio-core.c | 7 ++++++- drivers/iio/industrialio-event.c | 9 +++++++++ drivers/iio/inkern.c | 32 ++++++++++++++++++++++---------- 3 files changed, 37 insertions(+), 11 deletions(-)
drivers/iio/industrialio-core.c +6 -1
@@ -752,9 +752,11 @@ static ssize_t iio_read_channel_info(struct device *dev,INDIO_MAX_RAW_ELEMENTS , vals, &val_len, this_attr->address); - else + else if (indio_dev->info->read_raw) ret = indio_dev->info->read_raw (indio_dev, this_attr->c, &vals[0 ], &vals[1 ], this_attr->address); + else + return -EINVAL;if (ret <0 )return ret;
@@ -836,6 +838,9 @@ static ssize_t iio_read_channel_info_avail(struct device *dev,int length;int type; +if (!indio_dev->info->read_avail) +return -EINVAL ; + ret = indio_dev->info->read_avail (indio_dev, this_attr->c, &vals, &type, &length, this_attr->address);
drivers/iio/industrialio-event.c +9 -0
@@ -285,6 +285,9 @@ static ssize_t iio_ev_state_store(struct device *dev,if (ret <0 )return ret; +if (!indio_dev->info->write_event_config) +return -EINVAL ; + ret = indio_dev->info->write_event_config (indio_dev, this_attr->c,iio_ev_attr_type (this_attr),iio_ev_attr_dir (this_attr), val);
@@ -300,6 +303,9 @@ static ssize_t iio_ev_state_show(struct device *dev,struct iio_dev_attr *this_attr =to_iio_dev_attr (attr);int val; +if (!indio_dev->info->read_event_config) +return -EINVAL ; + val = indio_dev->info->read_event_config (indio_dev, this_attr->c,iio_ev_attr_type (this_attr),iio_ev_attr_dir (this_attr));
@@ -318,6 +324,9 @@ static ssize_t iio_ev_value_show(struct device *dev,int val, val2, val_arr[2 ];int ret; +if (!indio_dev->info->read_event_value) +return -EINVAL ; + ret = indio_dev->info->read_event_value(indio_dev, this_attr->c, iio_ev_attr_type(this_attr), iio_ev_attr_dir(this_attr), iio_ev_attr_info(this_attr),
drivers/iio/inkern.c +22 -10
@@ -562,6 +562,7 @@ EXPORT_SYMBOL_GPL(devm_iio_channel_get_all);static int iio_channel_read (struct iio_channel *chan,int *val,int *val2,enum iio_chan_info_enum info) { +const struct iio_info *iio_info = chan->indio_dev->info;int unused;int vals[INDIO_MAX_RAW_ELEMENTS ];int ret;
@@ -573,15 +574,18 @@ static int iio_channel_read(struct iio_channel *chan, int *val, int *val2,if (!iio_channel_has_info (chan->channel, info))return -EINVAL ; -if (chan->indio_dev->info->read_raw_multi) { - ret = chan->indio_dev->info->read_raw_multi (chan->indio_dev, - chan->channel,INDIO_MAX_RAW_ELEMENTS , - vals, &val_len, info); +if (iio_info->read_raw_multi) { + ret = iio_info->read_raw_multi (chan->indio_dev, + chan->channel, +INDIO_MAX_RAW_ELEMENTS , + vals, &val_len, info); *val = vals[0 ]; *val2 = vals[1 ]; + }else if (iio_info->read_raw) { + ret = iio_info->read_raw (chan->indio_dev, + chan->channel, val, val2, info); }else { - ret = chan->indio_dev->info->read_raw (chan->indio_dev, - chan->channel, val, val2, info); +return -EINVAL ; }return ret;
@@ -801,11 +805,15 @@ static int iio_channel_read_avail(struct iio_channel *chan, const int **vals, int *type, int *length, enum iio_chan_info_enum info) { + const struct iio_info *iio_info = chan->indio_dev->info; +if (!iio_channel_has_available (chan->channel, info))return -EINVAL ; -return chan->indio_dev->info->read_avail (chan->indio_dev, chan->channel, - vals, type, length, info); +if (iio_info->read_avail) +return iio_info->read_avail (chan->indio_dev, chan->channel, + vals, type, length, info); +return -EINVAL ; } int iio_read_avail_channel_attribute(struct iio_channel *chan,
@@ -995,8 +1003,12 @@ EXPORT_SYMBOL_GPL(iio_get_channel_type);static int iio_channel_write (struct iio_channel *chan,int val,int val2,enum iio_chan_info_enum info) { -return chan->indio_dev->info->write_raw (chan->indio_dev, - chan->channel, val, val2, info); +const struct iio_info *iio_info = chan->indio_dev->info; + +if (iio_info->write_raw) +return iio_info->write_raw (chan->indio_dev, + chan->channel, val, val2, info); +return -EINVAL ; } int iio_write_channel_attribute(struct iio_channel *chan, int val, int val2,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 119/132 block: remove the blk_flush_integrity call in blk_integrity_unregister
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit e8bc14d116aeac8f0f133ec8d249acf4e0658da7 ]
Now that there are no indirect calls for PI processing there is no way to dereference a NULL pointer here. Additionally drivers now always freeze the queue (or in case of stacking drivers use their internal equivalent) around changing the integrity profile.
This is effectively a revert of commit 3df49967f6f1 ("block: flush the integrity workqueue in blk_integrity_unregister").
--- block/blk-integrity.c | 2 -- 1 file changed, 2 deletions(-)
block/blk-integrity.c +0 -2
@@ -396,8 +396,6 @@ void blk_integrity_unregister(struct gendisk *disk)if (!bi->profile)return ; -/* ensure all bios are off the integrity workqueue */ -blk_flush_integrity ();blk_queue_flag_clear (QUEUE_FLAG_STABLE_WRITES , disk->queue);memset (bi,0 ,sizeof (*bi)); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 120/132 drm/amdgpu: add skip_hw_access checks for sriov
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yunxiang Li <[email protected]>
[ Upstream commit b3948ad1ac582f560e1f3aeaecf384619921c48d ]
Accessing registers via host is missing the check for skip_hw_access and the lockdep check that comes with it.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c +9 -0
@@ -998,6 +998,9 @@ static u32 amdgpu_virt_rlcg_reg_rw(struct amdgpu_device *adev, u32 offset, u32 vreturn 0 ; } +if (amdgpu_device_skip_hw_access (adev)) +return 0 ; + reg_access_ctrl = &adev->gfx.rlc.reg_access_ctrl[xcc_id]; scratch_reg0 = (void __iomem *)adev->rmmio +4 * reg_access_ctrl->scratch_reg0; scratch_reg1 = (void __iomem *)adev->rmmio +4 * reg_access_ctrl->scratch_reg1;
@@ -1073,6 +1076,9 @@ void amdgpu_sriov_wreg(struct amdgpu_device *adev, {u32 rlcg_flag; +if (amdgpu_device_skip_hw_access (adev)) +return ; +if (!amdgpu_sriov_runtime (adev) &&amdgpu_virt_get_rlcg_reg_access_flag (adev, acc_flags, hwip, true, &rlcg_flag)) {amdgpu_virt_rlcg_reg_rw (adev, offset, value, rlcg_flag, xcc_id);
@@ -1090,6 +1096,9 @@ u32 amdgpu_sriov_rreg(struct amdgpu_device *adev, {u32 rlcg_flag; +if (amdgpu_device_skip_hw_access (adev)) +return 0 ; +if (!amdgpu_sriov_runtime (adev) &&amdgpu_virt_get_rlcg_reg_access_flag (adev, acc_flags, hwip, false, &rlcg_flag))return amdgpu_virt_rlcg_reg_rw (adev, offset,0 , rlcg_flag, xcc_id);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 121/132 drm/amdgpu: add lock in amdgpu_gart_invalidate_tlb
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yunxiang Li <[email protected]>
[ Upstream commit 18f2525d31401e5142db95ff3a6ec0f4147be818 ]
We need to take the reset domain lock before flush hdp. We can't put the lock inside amdgpu_device_flush_hdp itself because it is used during reset where we already take the write side lock.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c +5 -1
@@ -34,6 +34,7 @@#include <asm/set_memory.h> #endif #include "amdgpu.h" +#include "amdgpu_reset.h" #include <drm/drm_drv.h> #include <drm/ttm/ttm_tt.h>
@@ -400,7 +401,10 @@ void amdgpu_gart_invalidate_tlb(struct amdgpu_device *adev)return ;mb (); -amdgpu_device_flush_hdp (adev,NULL ); +if (down_read_trylock (&adev->reset_domain->sem)) { +amdgpu_device_flush_hdp (adev,NULL ); +up_read (&adev->reset_domain->sem); + }for_each_set_bit (i, adev->vmhubs_mask,AMDGPU_MAX_VMHUBS )amdgpu_gmc_flush_gpu_tlb (adev,0 , i,0 ); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 122/132 drm/amdgpu: add lock in kfd_process_dequeue_from_device
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yunxiang Li <[email protected]>
[ Upstream commit d225960c2330e102370815367b877baaf8bb8b5d ]
We need to take the reset domain lock before talking to MES. While in this case we can take the lock inside the mes helper. We can't do so for most other mes helpers since they are used during reset. So for consistency sake we add the lock here.
--- drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c +7 -2
@@ -28,6 +28,7 @@#include "kfd_priv.h" #include "kfd_kernel_queue.h" #include "amdgpu_amdkfd.h" +#include "amdgpu_reset.h" static inline struct process_queue_node *get_queue_by_qid (struct process_queue_manager *pqm,unsigned int qid)
@@ -87,8 +88,12 @@ void kfd_process_dequeue_from_device(struct kfd_process_device *pdd)return ; dev->dqm->ops.process_termination (dev->dqm, &pdd->qpd); -if (dev->kfd->shared_resources.enable_mes) -amdgpu_mes_flush_shader_debugger (dev->adev, pdd->proc_ctx_gpu_addr); +if (dev->kfd->shared_resources.enable_mes && +down_read_trylock (&dev->adev->reset_domain->sem)) { +amdgpu_mes_flush_shader_debugger (dev->adev, + pdd->proc_ctx_gpu_addr); +up_read (&dev->adev->reset_domain->sem); + } pdd->already_dequeued = true; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 123/132 drm/amd/display: Dont use fsleep for PSR exit waits on dmub replay
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Kazlauskas <[email protected]>
[ Upstream commit b5236da757adc75d7e52c69bdc233d29249a0d0c ]
[Why]
These functions can be called from high IRQ levels and the OS will hang if it tries to use a usleep_highres or a msleep.
[How]
Replace the flseep with a udelay for dmub_replay_enable.
--- drivers/gpu/drm/amd/display/dc/dce/dmub_replay.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dce/dmub_replay.c +2 -1
@@ -102,7 +102,8 @@ static void dmub_replay_enable(struct dmub_replay *dmub, bool enable, bool wait,break ; } -fsleep (500 ); +/* must *not* be fsleep - this can be called from high irq levels */ +udelay (500 ); }/* assert if max retry hit */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 124/132 drm/amd/display: added NULL check at start of dc_validate_stream
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: winstang <[email protected]>
[ Upstream commit 26c56049cc4f1705b498df013949427692a4b0d5 ]
[Why]
prevent invalid memory access
[How]
check if dc and stream are NULL
--- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/amd/display/dc/core/dc_resource.c +3 -0
@@ -3927,6 +3927,9 @@ void resource_build_bit_depth_reduction_params(struct dc_stream_state *stream,enum dc_status dc_validate_stream (struct dc *dc,struct dc_stream_state *stream) { +if (dc ==NULL || stream ==NULL ) +return DC_ERROR_UNEXPECTED ; +struct dc_link *link = stream->link;struct timing_generator *tg = dc->res_pool->timing_generators[0 ];enum dc_status res =DC_OK ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 125/132 drm/amd/display: Correct the defined value for AMDGPU_DMUB_NOTIFICATION_MAX
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wayne Lin <[email protected]>
[ Upstream commit ad28d7c3d989fc5689581664653879d664da76f0 ]
[Why & How]
It actually exposes '6' types in enum dmub_notification_type. Not 5. Using smaller number to create array dmub_callback & dmub_thread_offload has potential to access item out of array bound. Fix it.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h +1 -1
@@ -49,7 +49,7 @@#define AMDGPU_DM_MAX_NUM_EDP 2 -#define AMDGPU_DMUB_NOTIFICATION_MAX 5 +#define AMDGPU_DMUB_NOTIFICATION_MAX 6#define HDMI_AMD_VENDOR_SPECIFIC_DATA_BLOCK_IEEE_REGISTRATION_ID 0x00001A#define AMD_VSDB_VERSION_3_FEATURECAP_REPLAYMODE 0x40
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 126/132 drm/amd/display: use preferred link settings for dp signal only
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenjing Liu <[email protected]>
[ Upstream commit abf34ca465f5cd182b07701d3f3d369c0fc04723 ]
[why]
We set preferred link settings for virtual signal. However we don't support virtual signal for UHBR link rate. If preferred is set to UHBR link rate, we will allow virtual signal with UHBR link rate which causes system crashes.
--- .../dc/link/protocols/link_dp_capability.c | 24 ++++++++----------- 1 file changed, 10 insertions(+), 14 deletions(-)
drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_capability.c +10 -14
@@ -908,21 +908,17 @@ bool link_decide_link_settings(struct dc_stream_state *stream,memset (link_setting,0 ,sizeof (*link_setting)); -/* if preferred is specified through AMDDP, use it, if it's enough -* to drive the mode -*/ -if (link->preferred_link_setting.lane_count != -LANE_COUNT_UNKNOWN && - link->preferred_link_setting.link_rate != -LINK_RATE_UNKNOWN ) { +if (dc_is_dp_signal (stream->signal) && + link->preferred_link_setting.lane_count !=LANE_COUNT_UNKNOWN && + link->preferred_link_setting.link_rate !=LINK_RATE_UNKNOWN ) { +/* if preferred is specified through AMDDP, use it, if it's enough +* to drive the mode +*/ *link_setting = link->preferred_link_setting; -return true; - } - -/* MST doesn't perform link training for now -* TODO: add MST specific link training routine -*/ -if (stream->signal ==SIGNAL_TYPE_DISPLAY_PORT_MST ) { + }else if (stream->signal ==SIGNAL_TYPE_DISPLAY_PORT_MST ) { +/* MST doesn't perform link training for now +* TODO: add MST specific link training routine +*/ decide_mst_link_settings (link, link_setting); }else if (link->connector_signal ==SIGNAL_TYPE_EDP ) {/* enable edp link optimization for DSC eDP case */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 127/132 drm/amd/display: Check BIOS images before it is used
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit 8b0ddf19cca2a352b2a7e01d99d3ba949a99c84c ]
BIOS images may fail to load and null checks are added before they are used.
This fixes 6 NULL_RETURNS issues reported by Coverity.
--- drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/gpu/drm/amd/display/dc/bios/bios_parser.c +14 -0
@@ -667,6 +667,9 @@ static enum bp_result get_ss_info_v3_1( ss_table_header_include = ((ATOM_ASIC_INTERNAL_SS_INFO_V3 *)bios_get_image (&bp->base,DATA_TABLES (ASIC_InternalSS_Info),struct_size (ss_table_header_include, asSpreadSpectrum,1 ))); +if (!ss_table_header_include) +return BP_RESULT_UNSUPPORTED ; + table_size = (le16_to_cpu (ss_table_header_include->sHeader.usStructureSize) -sizeof (ATOM_COMMON_TABLE_HEADER ))
@@ -1036,6 +1039,8 @@ static enum bp_result get_ss_info_from_internal_ss_info_tbl_V2_1( &bp->base,DATA_TABLES (ASIC_InternalSS_Info), struct_size(header, asSpreadSpectrum, 1))); +if (!header) +return result;memset (info,0 ,sizeof (struct spread_spectrum_info ));
@@ -1109,6 +1114,8 @@ static enum bp_result get_ss_info_from_ss_info_table(get_atom_data_table_revision (header, &revision); tbl =GET_IMAGE (ATOM_SPREAD_SPECTRUM_INFO ,DATA_TABLES (SS_Info)); +if (!tbl) +return result;if (1 != revision.major ||2 > revision.minor)return result;
@@ -1636,6 +1643,8 @@ static uint32_t get_ss_entry_number_from_ss_info_tbl( tbl =GET_IMAGE (ATOM_SPREAD_SPECTRUM_INFO ,DATA_TABLES (SS_Info)); +if (!tbl) +return number;if (1 != revision.major ||2 > revision.minor)return number;
@@ -1718,6 +1727,8 @@ static uint32_t get_ss_entry_number_from_internal_ss_info_tbl_v2_1( &bp->base,DATA_TABLES (ASIC_InternalSS_Info), struct_size(header_include, asSpreadSpectrum, 1))); +if (!header_include) +return 0 ; size = (le16_to_cpu (header_include->sHeader.usStructureSize) -sizeof (ATOM_COMMON_TABLE_HEADER ))
@@ -1756,6 +1767,9 @@ static uint32_t get_ss_entry_number_from_internal_ss_info_tbl_V3_1( header_include = ((ATOM_ASIC_INTERNAL_SS_INFO_V3 *)bios_get_image (&bp->base,DATA_TABLES (ASIC_InternalSS_Info),struct_size (header_include, asSpreadSpectrum,1 ))); +if (!header_include) +return number; + size = (le16_to_cpu (header_include->sHeader.usStructureSize) -sizeof (ATOM_COMMON_TABLE_HEADER )) /sizeof (ATOM_ASIC_SS_ASSIGNMENT_V3 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 128/132 drm/amd/display: Skip wbscl_set_scaler_filter if filter is null
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit c4d31653c03b90e51515b1380115d1aedad925dd ]
Callers can pass null in filter (i.e. from returned from the function wbscl_get_filter_coeffs_16p) and a null check is added to ensure that is not the case.
This fixes 4 NULL_RETURNS issues reported by Coverity.
--- drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dwb_scl.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dwb_scl.c +3 -0
@@ -690,6 +690,9 @@ static void wbscl_set_scaler_filter(int pair;uint16_t odd_coef, even_coef; +if (!filter) +return ; +for (phase =0 ; phase < (NUM_PHASES /2 +1 ); phase++) {for (pair =0 ; pair < tap_pairs; pair++) { even_coef = filter[phase * taps +2 * pair];
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 129/132 media: uvcvideo: Enforce alignment of frame and interval
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <[email protected]>
[ Upstream commit c8931ef55bd325052ec496f242aea7f6de47dc9c ]
Struct uvc_frame and interval (u32*) are packaged together on streaming->formats on a single contiguous allocation.
Right now they are allocated right after uvc_format, without taking into consideration their required alignment.
This is working fine because both structures have a field with a pointer, but it will stop working when the sizeof() of any of those structs is not a multiple of the sizeof(void*).
Enforce that alignment during the allocation.
--- drivers/media/usb/uvc/uvc_driver.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-)
drivers/media/usb/uvc/uvc_driver.c +14 -4
@@ -687,16 +687,26 @@ static int uvc_parse_streaming(struct uvc_device *dev, goto error; } - size = nformats *sizeof (*format) + nframes *sizeof (*frame) +/* +* Allocate memory for the formats, the frames and the intervals, +* plus any required padding to guarantee that everything has the +* correct alignment. +*/ + size = nformats *sizeof (*format); + size = ALIGN(size, __alignof__(*frame)) + nframes * sizeof(*frame); + size = ALIGN(size, __alignof__(*interval)) + nintervals *sizeof (*interval); + format =kzalloc (size,GFP_KERNEL ); -if (format ==NULL ) { +if (!format) { ret = -ENOMEM ; goto error; } - frame = (struct uvc_frame *)&format[nformats]; - interval = (u32 *)&frame[nframes]; + frame = (void *)format + nformats *sizeof (*format); + frame = PTR_ALIGN(frame, __alignof__(*frame)); + interval = (void *)frame + nframes *sizeof (*frame); + interval = PTR_ALIGN(interval, __alignof__(*interval)); streaming->formats = format; streaming->nformats =0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 130/132 virtio_net: Fix napi_skb_cache_put warning
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <[email protected]>
commit f8321fa75102246d7415a6af441872f6637c93ab upstream.
After the commit bdacf3e34945 ("net: Use nested-BH locking for napi_alloc_cache.") was merged, the following warning began to appear:
WARNING: CPU: 5 PID: 1 at net/core/skbuff.c:1451 napi_skb_cache_put+0x82/0x4b0 __warn+0x12f/0x340 napi_skb_cache_put+0x82/0x4b0 napi_skb_cache_put+0x82/0x4b0 report_bug+0x165/0x370 handle_bug+0x3d/0x80 exc_invalid_op+0x1a/0x50 asm_exc_invalid_op+0x1a/0x20 __free_old_xmit+0x1c8/0x510 napi_skb_cache_put+0x82/0x4b0 __free_old_xmit+0x1c8/0x510 __free_old_xmit+0x1c8/0x510 __pfx___free_old_xmit+0x10/0x10
The issue arises because virtio is assuming it's running in NAPI context even when it's not, such as in the netpoll case.
To resolve this, modify virtnet_poll_tx() to only set NAPI when budget is available. Same for virtnet_poll_cleantx(), which always assumed that it was in a NAPI context.
--- drivers/net/virtio_net.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/net/virtio_net.c +4 -4
@@ -2140,7 +2140,7 @@ static int virtnet_receive(struct receivreturn packets; } -static void virtnet_poll_cleantx (struct receive_queue *rq) +static void virtnet_poll_cleantx (struct receive_queue *rq,int budget) {struct virtnet_info *vi = rq->vq->vdev->priv;unsigned int index =vq2rxq (rq->vq);
@@ -2158,7 +2158,7 @@ static void virtnet_poll_cleantx(structdo {virtqueue_disable_cb (sq->vq); -free_old_xmit_skbs (sq, true); +free_old_xmit_skbs (sq, !!budget); }while (unlikely (!virtqueue_enable_cb_delayed (sq->vq)));if (sq->vq->num_free >=2 +MAX_SKB_FRAGS )
@@ -2177,7 +2177,7 @@ static int virtnet_poll(struct napi_struunsigned int received;unsigned int xdp_xmit =0 ; -virtnet_poll_cleantx (rq); +virtnet_poll_cleantx (rq, budget); received =virtnet_receive (rq, budget, &xdp_xmit);
@@ -2280,7 +2280,7 @@ static int virtnet_poll_tx(struct napi_s txq =netdev_get_tx_queue (vi->dev, index);__netif_tx_lock (txq,raw_smp_processor_id ());virtqueue_disable_cb (sq->vq); -free_old_xmit_skbs (sq, true); +free_old_xmit_skbs (sq, !!budget);if (sq->vq->num_free >=2 +MAX_SKB_FRAGS )netif_tx_wake_queue (txq);
Greg Kroah-Hartman
maintainerPATCH 131/132 i2c: Use IS_REACHABLE() for substituting empty ACPI functions
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Fitzgerald <[email protected]>
commit 71833e79a42178d8a50b5081c98c78ace9325628 upstream.
Replace IS_ENABLED() with IS_REACHABLE() to substitute empty stubs for:
i2c_acpi_get_i2c_resource()
i2c_acpi_client_count()
i2c_acpi_find_bus_speed()
i2c_acpi_new_device_by_fwnode()
i2c_adapter *i2c_acpi_find_adapter_by_handle()
i2c_acpi_waive_d0_probe()commit f17c06c6608a ("i2c: Fix conditional for substituting empty ACPI functions") partially fixed this conditional to depend on CONFIG_I2C, but used IS_ENABLED(), which is wrong since CONFIG_I2C is tristate.
CONFIG_ACPI is boolean but let's also change it to use IS_REACHABLE() to future-proof it against becoming tristate.
Somehow despite testing various combinations of CONFIG_I2C and CONFIG_ACPI we missed the combination CONFIG_I2C=m, CONFIG_ACPI=y.
--- include/linux/i2c.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/i2c.h +1 -1
@@ -1033,7 +1033,7 @@ static inline int of_i2c_get_board_info(struct acpi_resource ;struct acpi_resource_i2c_serialbus ; -#if IS_ENABLED (CONFIG_ACPI ) &&IS_ENABLED (CONFIG_I2C ) +#if IS_REACHABLE (CONFIG_ACPI ) &&IS_REACHABLE (CONFIG_I2C )bool i2c_acpi_get_i2c_resource (struct acpi_resource *ares,struct acpi_resource_i2c_serialbus **i2c);int i2c_acpi_client_count (struct acpi_device *adev);
Greg Kroah-Hartman
maintainerPATCH 132/132 scsi: ufs: qcom: Add UFSHCD_QUIRK_BROKEN_LSDBS_CAP for SM8550 SoC
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manivannan Sadhasivam <[email protected]>
commit ea593e028a9cc523557b4084a61d87ae69e2f270 upstream.
SM8550 SoC has the UFSHCI 4.0 compliant UFS controller and only supports legacy single doorbell mode without MCQ. But due to a hardware bug, it reports 1 in the 'Legacy Queue & Single Doorbell Support (LSDBS)' field of the Controller Capabilities register. This field is supposed to read as 0 if legacy single doorbell mode is supported and 1 otherwise.
Starting with commit 0c60eb0cc320 ("scsi: ufs: core: Check LSDBS cap when !mcq"), ufshcd driver is now relying on the LSDBS field to decide when to use the legacy doorbell mode if MCQ is not supported. And this ends up breaking UFS on SM8550:
ufshcd-qcom 1d84000.ufs: ufshcd_init: failed to initialize (legacy doorbell mode not supported) ufshcd-qcom 1d84000.ufs: error -EINVAL: Initialization failed with error -22
So use the UFSHCD_QUIRK_BROKEN_LSDBS_CAP quirk for SM8550 SoC so that the ufshcd driver could use legacy doorbell mode correctly.
--- drivers/ufs/host/ufs-qcom.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/ufs/host/ufs-qcom.c +5 -1
@@ -1038,6 +1038,9 @@ static void ufs_qcom_advertise_quirks(stif (host->hw_ver.major >0x3 ) hba->quirks |=UFSHCD_QUIRK_REINIT_AFTER_MAX_GEAR_SWITCH ; + +if (of_device_is_compatible (hba->dev->of_node,"qcom,sm8550-ufshc" )) + hba->quirks |=UFSHCD_QUIRK_BROKEN_LSDBS_CAP ; }static void ufs_qcom_set_caps (struct ufs_hba *hba)
@@ -1931,7 +1934,8 @@ static int ufs_qcom_remove(struct platfo }static const struct of_device_id ufs_qcom_of_match[]__maybe_unused = { - { .compatible ="qcom,ufshc" }, + { .compatible ="qcom,ufshc" }, + { .compatible ="qcom,sm8550-ufshc" }, {}, };MODULE_DEVICE_TABLE (of, ufs_qcom_of_match);
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.50 release. There are 132 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 07 Sep 2024 09:36:50 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.50-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.6.y
and the diffstat can be found below.thanks,
greg k-h
The following build errors noticed while building arm64 defconfigs with toolchains gcc-13 and clang-19 on stable-rc linux-6.6.y and linux-6.10.y
First seen on today builds v6.6.49-133-g18327dd4281a
GOOD: 8723d70ba720be0b854d252a378ac45c0a6db8a7
BAD: 18327dd4281aaea9d7639a33a52a7ec57c97f942
Build errors:
-------drivers/ufs/host/ufs-qcom.c: In function 'ufs_qcom_advertise_quirks':drivers/ufs/host/ufs-qcom.c:1043:32: error:
'UFSHCD_QUIRK_BROKEN_LSDBS_CAP' undeclared (first use in this function); did you mean 'UFSHCD_QUIRK_BROKEN_UIC_CMD'?
1043 | hba->quirks |= UFSHCD_QUIRK_BROKEN_LSDBS_CAP;
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| UFSHCD_QUIRK_BROKEN_UIC_CMDBuild log link,
---------
- https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.6.y/build/v6.6.49-133-g18327dd4281a/testrun/25035737/suite/build/test/gcc-13-defconfig/log
metadata:
------
config: https://storage.tuxsuite.com/public/linaro/lkft/builds/2leCGwTPT1TApOAJ20gB0VL84XW/config
download_url:
https://storage.tuxsuite.com/public/linaro/lkft/builds/2leCGwTPT1TApOAJ20gB0VL84XW/
git_describe: v6.6.49-133-g18327dd4281a
git_repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git_sha: 18327dd4281aaea9d7639a33a52a7ec57c97f942
arch: arm64
config: defconfig
toolchain: gcc-13 and clang-19
--
Linaro LKFT
https://lkft.linaro.org
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.50 release. There are 132 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 07 Sep 2024 09:36:50 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.50-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.6.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah