6.11.3-rc1 review
Subsystems (4)
Greg Kroah-Hartman
maintainerPATCH 224/558 drm/amd/display: Handle null stream_status in planes_changed_for_existing_stream
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <[email protected]>
[ Upstream commit 8141f21b941710ecebe49220b69822cab3abd23d ]
This commit adds a null check for 'stream_status' in the function 'planes_changed_for_existing_stream'. Previously, the code assumed 'stream_status' could be null, but did not handle the case where it was actually null. This could lead to a null pointer dereference.
Reported by smatch:drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_resource.c:3784 planes_changed_for_existing_stream() error: we previously assumed 'stream_status' could be null (see line 3774)
--- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/core/dc_resource.c +3 -1
@@ -3771,8 +3771,10 @@ static bool planes_changed_for_existing_stream(struct dc_state *context, } } -if (!stream_status) +if (!stream_status) {ASSERT (0 ); +return false; + }for (i =0 ; i < set_count; i++)if (set[i].stream == stream)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 225/558 drm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <[email protected]>
[ Upstream commit 62ed6f0f198da04e884062264df308277628004f ]
This commit adds a null check for the set_output_gamma function pointer in the dcn20_set_output_transfer_func function. Previously, set_output_gamma was being checked for null at line 1030, but then it was being dereferenced without any null check at line 1048. This could potentially lead to a null pointer dereference error if set_output_gamma is null.
To fix this, we now ensure that set_output_gamma is not null before dereferencing it. We do this by adding a null check for set_output_gamma before the call to set_output_gamma at line 1048.
--- drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c +2 -1
@@ -1044,7 +1044,8 @@ bool dcn20_set_output_transfer_func(struct dc *dc, struct pipe_ctx *pipe_ctx,/* * if above if is not executed then 'params' equal to 0 and set in bypass */ - mpc->funcs->set_output_gamma (mpc, mpcc_id, params); +if (mpc->funcs->set_output_gamma) + mpc->funcs->set_output_gamma (mpc, mpcc_id, params);return true; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 226/558 drm/amd/display: Add NULL check for function pointer in dcn401_set_output_transfer_func
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <[email protected]>
[ Upstream commit dd340acd42c24a3f28dd22fae6bf38662334264c ]
This commit adds a null check for the set_output_gamma function pointer in the dcn401_set_output_transfer_func function. Previously, set_output_gamma was being checked for null, but then it was being dereferenced without any null check. This could lead to a null pointer dereference if set_output_gamma is null.
To fix this, we now ensure that set_output_gamma is not null before dereferencing it. We do this by adding a null check for set_output_gamma before the call to set_output_gamma.
--- drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c +3 -1
@@ -748,7 +748,9 @@ bool dcn401_set_output_transfer_func(struct dc *dc, } } - mpc->funcs->set_output_gamma (mpc, mpcc_id, params); +if (mpc->funcs->set_output_gamma) + mpc->funcs->set_output_gamma (mpc, mpcc_id, params); +return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 227/558 drm/amd/display: Add NULL check for function pointer in dcn32_set_output_transfer_func
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <[email protected]>
[ Upstream commit 28574b08c70e56d34d6f6379326a860b96749051 ]
This commit adds a null check for the set_output_gamma function pointer in the dcn32_set_output_transfer_func function. Previously, set_output_gamma was being checked for null, but then it was being dereferenced without any null check. This could lead to a null pointer dereference if set_output_gamma is null.
To fix this, we now ensure that set_output_gamma is not null before dereferencing it. We do this by adding a null check for set_output_gamma before the call to set_output_gamma.
--- drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c +3 -1
@@ -582,7 +582,9 @@ bool dcn32_set_output_transfer_func(struct dc *dc, } } - mpc->funcs->set_output_gamma (mpc, mpcc_id, params); +if (mpc->funcs->set_output_gamma) + mpc->funcs->set_output_gamma (mpc, mpcc_id, params); +return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 228/558 drm/amd/display: fix a UBSAN warning in DML2.1
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aurabindo Pillai <[email protected]>
[ Upstream commit eaf3adb8faab611ba57594fa915893fc93a7788c ]
When programming phantom pipe, since cursor_width is explicity set to 0, this causes calculation logic to trigger overflow for an unsigned int triggering the kernel's UBSAN check as below:
[ 40.962845] UBSAN: shift-out-of-bounds in /tmp/amd.EfpumTkO/amd/amdgpu/../display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c:3312:34 [ 40.962849] shift exponent 4294967170 is too large for 32-bit type 'unsigned int' [ 40.962852] CPU: 1 PID: 1670 Comm: gnome-shell Tainted: G W OE 6.5.0-41-generic #41~22.04.2-Ubuntu [ 40.962854] Hardware name: Gigabyte Technology Co., Ltd. X670E AORUS PRO X/X670E AORUS PRO X, BIOS F21 01/10/2024 [ 40.962856] Call Trace: [ 40.962857] <TASK> [ 40.962860] dump_stack_lvl+0x48/0x70 [ 40.962870] dump_stack+0x10/0x20 [ 40.962872] __ubsan_handle_shift_out_of_bounds+0x1ac/0x360 [ 40.962878] calculate_cursor_req_attributes.cold+0x1b/0x28 [amdgpu] [ 40.963099] dml_core_mode_support+0x6b91/0x16bc0 [amdgpu] [ 40.963327] ? srso_alias_return_thunk+0x5/0x7f [ 40.963331] ? CalculateWatermarksMALLUseAndDRAMSpeedChangeSupport+0x18b8/0x2790 [amdgpu] [ 40.963534] ? srso_alias_return_thunk+0x5/0x7f [ 40.963536] ? dml_core_mode_support+0xb3db/0x16bc0 [amdgpu] [ 40.963730] dml2_core_calcs_mode_support_ex+0x2c/0x90 [amdgpu] [ 40.963906] ? srso_alias_return_thunk+0x5/0x7f [ 40.963909] ? dml2_core_calcs_mode_support_ex+0x2c/0x90 [amdgpu] [ 40.964078] core_dcn4_mode_support+0x72/0xbf0 [amdgpu] [ 40.964247] dml2_top_optimization_perform_optimization_phase+0x1d3/0x2a0 [amdgpu] [ 40.964420] dml2_build_mode_programming+0x23d/0x750 [amdgpu] [ 40.964587] dml21_validate+0x274/0x770 [amdgpu] [ 40.964761] ? srso_alias_return_thunk+0x5/0x7f [ 40.964763] ? resource_append_dpp_pipes_for_plane_composition+0x27c/0x3b0 [amdgpu] [ 40.964942] dml2_validate+0x504/0x750 [amdgpu] [ 40.965117] ? dml21_copy+0x95/0xb0 [amdgpu] [ 40.965291] ? srso_alias_return_thunk+0x5/0x7f [ 40.965295] dcn401_validate_bandwidth+0x4e/0x70 [amdgpu] [ 40.965491] update_planes_and_stream_state+0x38d/0x5c0 [amdgpu] [ 40.965672] update_planes_and_stream_v3+0x52/0x1e0 [amdgpu] [ 40.965845] ? srso_alias_return_thunk+0x5/0x7f [ 40.965849] dc_update_planes_and_stream+0x71/0xb0 [amdgpu]
Fix this by adding a guard for checking cursor width before triggering the size calculation.
--- .../src/dml2_core/dml2_core_dcn4_calcs.c | 93 ++++++++++--------- 1 file changed, 49 insertions(+), 44 deletions(-)
drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c +49 -44
@@ -7231,10 +7231,9 @@ static bool dml_core_mode_support(struct dml2_core_calcs_mode_support_ex *in_out/* Cursor Support Check */ mode_lib->ms.support.CursorSupport = true;for (k =0 ; k < mode_lib->ms.num_active_planes; k++) { -if (display_cfg->plane_descriptors[k].cursor.cursor_width >0.0 ) { -if (display_cfg->plane_descriptors[k].cursor.cursor_bpp ==64 && mode_lib->ip.cursor_64bpp_support == false) { +if (display_cfg->plane_descriptors[k].cursor.num_cursors >0 ) { +if (display_cfg->plane_descriptors[k].cursor.cursor_bpp ==64 && mode_lib->ip.cursor_64bpp_support == false) mode_lib->ms.support.CursorSupport = false; - } } }
@@ -8091,27 +8090,31 @@ static bool dml_core_mode_support(struct dml2_core_calcs_mode_support_ex *in_outfor (k =0 ; k < mode_lib->ms.num_active_planes; ++k) {double line_time_us = (double )display_cfg->stream_descriptors[display_cfg->plane_descriptors[k].stream_index].timing.h_total / ((double )display_cfg->stream_descriptors[display_cfg->plane_descriptors[k].stream_index].timing.pixel_clock_khz /1000 );bool cursor_not_enough_urgent_latency_hiding =0 ; -calculate_cursor_req_attributes ( - display_cfg->plane_descriptors[k].cursor.cursor_width, - display_cfg->plane_descriptors[k].cursor.cursor_bpp, -// output - &s->cursor_lines_per_chunk[k], - &s->cursor_bytes_per_line[k], - &s->cursor_bytes_per_chunk[k], - &s->cursor_bytes[k]); - -calculate_cursor_urgent_burst_factor ( - mode_lib->ip.cursor_buffer_size, - display_cfg->plane_descriptors[k].cursor.cursor_width, - s->cursor_bytes_per_chunk[k], - s->cursor_lines_per_chunk[k], - line_time_us, - mode_lib->ms.UrgLatency, +if (display_cfg->plane_descriptors[k].cursor.num_cursors >0 ) { +calculate_cursor_req_attributes ( + display_cfg->plane_descriptors[k].cursor.cursor_width, + display_cfg->plane_descriptors[k].cursor.cursor_bpp, + +// output + &s->cursor_lines_per_chunk[k], + &s->cursor_bytes_per_line[k], + &s->cursor_bytes_per_chunk[k], + &s->cursor_bytes[k]); + +calculate_cursor_urgent_burst_factor ( + mode_lib->ip.cursor_buffer_size, + display_cfg->plane_descriptors[k].cursor.cursor_width, + s->cursor_bytes_per_chunk[k], + s->cursor_lines_per_chunk[k], + line_time_us, + mode_lib->ms.UrgLatency, + +// output + &mode_lib->ms.UrgentBurstFactorCursor[k], + &cursor_not_enough_urgent_latency_hiding); + } -// output - &mode_lib->ms.UrgentBurstFactorCursor[k], - &cursor_not_enough_urgent_latency_hiding); mode_lib->ms.UrgentBurstFactorCursorPre[k] = mode_lib->ms.UrgentBurstFactorCursor[k];#ifdef __DML_VBA_DEBUG__
@@ -10592,31 +10595,33 @@ static bool dml_core_mode_programming(struct dml2_core_calcs_mode_programming_exfor (k =0 ; k < s->num_active_planes; ++k) {bool cursor_not_enough_urgent_latency_hiding =0 ; -double line_time_us; +double line_time_us =0.0 ; -calculate_cursor_req_attributes ( - display_cfg->plane_descriptors[k].cursor.cursor_width, - display_cfg->plane_descriptors[k].cursor.cursor_bpp, + line_time_us = display_cfg->stream_descriptors[display_cfg->plane_descriptors[k].stream_index].timing.h_total / + ((double )display_cfg->stream_descriptors[display_cfg->plane_descriptors[k].stream_index].timing.pixel_clock_khz /1000 ); +if (display_cfg->plane_descriptors[k].cursor.num_cursors >0 ) { +calculate_cursor_req_attributes ( + display_cfg->plane_descriptors[k].cursor.cursor_width, + display_cfg->plane_descriptors[k].cursor.cursor_bpp, -// output - &s->cursor_lines_per_chunk[k], - &s->cursor_bytes_per_line[k], - &s->cursor_bytes_per_chunk[k], - &s->cursor_bytes[k]); - - line_time_us = display_cfg->stream_descriptors[display_cfg->plane_descriptors[k].stream_index].timing.h_total / ((double )display_cfg->stream_descriptors[display_cfg->plane_descriptors[k].stream_index].timing.pixel_clock_khz /1000 ); - -calculate_cursor_urgent_burst_factor ( - mode_lib->ip.cursor_buffer_size, - display_cfg->plane_descriptors[k].cursor.cursor_width, - s->cursor_bytes_per_chunk[k], - s->cursor_lines_per_chunk[k], - line_time_us, - mode_lib->mp.UrgentLatency, +// output + &s->cursor_lines_per_chunk[k], + &s->cursor_bytes_per_line[k], + &s->cursor_bytes_per_chunk[k], + &s->cursor_bytes[k]); + +calculate_cursor_urgent_burst_factor ( + mode_lib->ip.cursor_buffer_size, + display_cfg->plane_descriptors[k].cursor.cursor_width, + s->cursor_bytes_per_chunk[k], + s->cursor_lines_per_chunk[k], + line_time_us, + mode_lib->mp.UrgentLatency, -// output - &mode_lib->mp.UrgentBurstFactorCursor[k], - &cursor_not_enough_urgent_latency_hiding); +// output + &mode_lib->mp.UrgentBurstFactorCursor[k], + &cursor_not_enough_urgent_latency_hiding); + } mode_lib->mp.UrgentBurstFactorCursorPre[k] = mode_lib->mp.UrgentBurstFactorCursor[k]; CalculateUrgentBurstFactor(
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 229/558 drm/amd/display: Add null check for afb in amdgpu_dm_update_cursor (v2)
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <[email protected]>
[ Upstream commit 0fe20258b4989b9112b5e9470df33a0939403fd4 ]
This commit adds a null check for the 'afb' variable in the amdgpu_dm_update_cursor function. Previously, 'afb' was assumed to be null at line 8388, but was used later in the code without a null check. This could potentially lead to a null pointer dereference.
Changes since v1:
- Moved the null check for 'afb' to the line where 'afb' is used. (Alex)
Fixes the below:drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm.c:8433 amdgpu_dm_update_cursor()
error: we previously assumed 'afb' could be null (see line 8388)
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +2 -1
@@ -8795,7 +8795,8 @@ static void amdgpu_dm_update_cursor(struct drm_plane *plane, adev->dm.dc->caps.color.dpp.gamma_corr) attributes.attribute_flags.bits.ENABLE_CURSOR_DEGAMMA =1 ; - attributes.pitch = afb->base.pitches[0 ] / afb->base.format->cpp[0 ]; +if (afb) + attributes.pitch = afb->base.pitches[0 ] / afb->base.format->cpp[0 ]; if (crtc_state->stream) { if (!dc_stream_set_cursor_attributes(crtc_state->stream,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 230/558 drm/amd/display: Check null pointers before using dc->clk_mgr
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit 95d9e0803e51d5a24276b7643b244c7477daf463 ]
[WHY & HOW]dc->clk_mgr is null checked previously in the same function, indicating it might be null.
Passing "dc" to "dc->hwss.apply_idle_power_optimizations", which dereferences null "dc->clk_mgr". (The function pointer resolves to "dcn35_apply_idle_power_optimizations".)
This fixes 1 FORWARD_NULL issue reported by Coverity.
--- drivers/gpu/drm/amd/display/dc/core/dc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/core/dc.c +2 -1
@@ -5383,7 +5383,8 @@ void dc_allow_idle_optimizations_internal(struct dc *dc, bool allow, char constif (allow == dc->idle_optimizations_allowed)return ; -if (dc->hwss.apply_idle_power_optimizations && dc->hwss.apply_idle_power_optimizations (dc, allow)) +if (dc->hwss.apply_idle_power_optimizations && dc->clk_mgr !=NULL && + dc->hwss.apply_idle_power_optimizations (dc, allow)) dc->idle_optimizations_allowed = allow; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 231/558 drm/amd/display: Check null pointer before try to access it
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rodrigo Siqueira <[email protected]>
[ Upstream commit 1b686053c06ffb9f4524b288110cf2a831ff7a25 ]
[why & how]
Change the order of the pipe_ctx->plane_state check to ensure that plane_state is not null before accessing it.
--- .../gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c +8 -3
@@ -1931,6 +1931,11 @@ static void dcn20_program_pipe( (pipe_ctx->plane_state && pipe_ctx->plane_state->update_flags.bits.hdr_mult)) hws->funcs.set_hdr_multiplier(pipe_ctx); +if ((pipe_ctx->plane_state && pipe_ctx->plane_state->update_flags.bits.hdr_mult) || + pipe_ctx->update_flags.bits.enable) + hws->funcs.set_hdr_multiplier (pipe_ctx); + +if (hws->funcs.populate_mcm_luts) {if (pipe_ctx->plane_state) { hws->funcs.populate_mcm_luts(dc, pipe_ctx, pipe_ctx->plane_state->mcm_luts,
@@ -1938,13 +1943,13 @@ static void dcn20_program_pipe( pipe_ctx->plane_state->lut_bank_a = !pipe_ctx->plane_state->lut_bank_a; } } -if (pipe_ctx->update_flags.bits.enable || - (pipe_ctx->plane_state && +if ((pipe_ctx->plane_state && pipe_ctx->plane_state->update_flags.bits.in_transfer_func_change) || (pipe_ctx->plane_state && pipe_ctx->plane_state->update_flags.bits.gamma_change) || (pipe_ctx->plane_state && - pipe_ctx->plane_state->update_flags.bits.lut_3d)) + pipe_ctx->plane_state->update_flags.bits.lut_3d) || + pipe_ctx->update_flags.bits.enable) hws->funcs.set_input_transfer_func (dc, pipe_ctx, pipe_ctx->plane_state);/* dcn10_translate_regamma_to_hw_format takes 750us to finish
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 232/558 drm/amd/display: Add null check for afb in amdgpu_dm_plane_handle_cursor_update (v2)
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <[email protected]>
[ Upstream commit cd9e9e0852d501f169aa3bb34e4b413d2eb48c37 ]
This commit adds a null check for the 'afb' variable in the amdgpu_dm_plane_handle_cursor_update function. Previously, 'afb' was assumed to be null, but was used later in the code without a null check. This could potentially lead to a null pointer dereference.
Changes since v1:
- Moved the null check for 'afb' to the line where 'afb' is used. (Alex)
Fixes the below:drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_plane.c:1298 amdgpu_dm_plane_handle_cursor_update() error: we previously assumed 'afb' could be null (see line 1252)
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c +2 -1
@@ -1377,7 +1377,8 @@ void amdgpu_dm_plane_handle_cursor_update(struct drm_plane *plane, adev->dm.dc->caps.color.dpp.gamma_corr) attributes.attribute_flags.bits.ENABLE_CURSOR_DEGAMMA =1 ; - attributes.pitch = afb->base.pitches[0 ] / afb->base.format->cpp[0 ]; +if (afb) + attributes.pitch = afb->base.pitches[0 ] / afb->base.format->cpp[0 ];if (crtc_state->stream) {mutex_lock (&adev->dm.dc_lock);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 233/558 drm/xe: Name and document Wa_14019789679
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Roper <[email protected]>
[ Upstream commit 1d734a3e5d6bb266f52eaf2b1400c5d3f1875a54 ]
Early in the development of Xe we identified an issue with SVG state handling on DG2 and MTL (and later on Xe2 as well). In commit 72ac304769dd ("drm/xe: Emit SVG state on RCS during driver load on DG2 and MTL") and commit fb24b858a20d ("drm/xe/xe2: Update SVG state handling") we implemented our own workaround to prevent SVG state from leaking from context A to context B in cases where context B never issues a specific state setting.
The hardware teams have now created official workaround Wa_14019789679 to cover this issue. The workaround description only requires emitting 3DSTATE_MESH_CONTROL, since they believe that's the only SVG instruction that would potentially remain unset by a context B, but still cause notable issues if unwanted values were inherited from context A. However since we already have a more extensive implementation that emits the entire SVG state and prevents _any_ SVG state from unintentionally leaking, we'll stick with our existing implementation just to be safe.
--- drivers/gpu/drm/xe/xe_lrc.c | 35 +++++++++++++++++++++--------- drivers/gpu/drm/xe/xe_wa_oob.rules | 2 ++ 2 files changed, 27 insertions(+), 10 deletions(-)
drivers/gpu/drm/xe/xe_lrc.c +25 -10
@@ -5,6 +5,8 @@#include "xe_lrc.h" +#include <generated/xe_wa_oob.h> +#include <linux/ascii85.h> #include "instructions/xe_mi_commands.h"
@@ -24,6 +26,7 @@#include "xe_memirq.h" #include "xe_sriov.h" #include "xe_vm.h" +#include "xe_wa.h" #define LRC_VALID BIT_ULL(0)#define LRC_PRIVILEGE BIT_ULL(8)
@@ -1581,19 +1584,31 @@ void xe_lrc_emit_hwe_state_instructions(struct xe_exec_queue *q, struct xe_bb *bint state_table_size =0 ;/* -* At the moment we only need to emit non-register state for the RCS -* engine. +* Wa_14019789679 +* +* If the driver doesn't explicitly emit the SVG instructions while +* setting up the default LRC, the context switch will write 0's +* (noops) into the LRC memory rather than the expected instruction +* headers. Application contexts start out as a copy of the default +* LRC, and if they also do not emit specific settings for some SVG +* state, then on context restore they'll unintentionally inherit +* whatever state setting the previous context had programmed into the +* hardware (i.e., the lack of a 3DSTATE_* instruction in the LRC will +* prevent the hardware from resetting that state back to any specific +* value). +* +* The official workaround only requires emitting 3DSTATE_MESH_CONTROL +* since that's a specific state setting that can easily cause GPU +* hangs if unintentionally inherited. However to be safe we'll +* continue to emit all of the SVG state since it's best not to leak +* any of the state between contexts, even if that leakage is harmless. */ -if (q->hwe->class !=XE_ENGINE_CLASS_RENDER ) -return ; - -switch (GRAPHICS_VERx100 (xe)) { -case 1255 : - case 1270 ... 2004: +if (XE_WA (gt,14019789679 ) && q->hwe->class ==XE_ENGINE_CLASS_RENDER ) { state_table = xe_hpg_svg_state; state_table_size =ARRAY_SIZE (xe_hpg_svg_state); -break ; -default : + } + +if (!state_table) {xe_gt_dbg (gt,"No non-register state to emit on graphics ver %d.%02d\n" ,GRAPHICS_VER (xe),GRAPHICS_VERx100 (xe) %100 );return ;
drivers/gpu/drm/xe/xe_wa_oob.rules +2 -0
@@ -30,3 +30,5 @@ 22019338487 MEDIA_VERSION(2000) GRAPHICS_VERSION(2001) 16023588340 GRAPHICS_VERSION(2001) +14019789679 GRAPHICS_VERSION(1255) + GRAPHICS_VERSION_RANGE(1270, 2004)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 234/558 drm/amd/display: fix double free issue during amdgpu module unload
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Huang <[email protected]>
[ Upstream commit 20b5a8f9f4670a8503aa9fa95ca632e77c6bf55d ]
Flexible endpoints use DIGs from available inflexible endpoints, so only the encoders of inflexible links need to be freed. Otherwise, a double free issue may occur when unloading the amdgpu module.
[ 279.190523] RIP: 0010:__slab_free+0x152/0x2f0 [ 279.190577] Call Trace: [ 279.190580] <TASK> [ 279.190582] ? show_regs+0x69/0x80 [ 279.190590] ? die+0x3b/0x90 [ 279.190595] ? do_trap+0xc8/0xe0 [ 279.190601] ? do_error_trap+0x73/0xa0 [ 279.190605] ? __slab_free+0x152/0x2f0 [ 279.190609] ? exc_invalid_op+0x56/0x70 [ 279.190616] ? __slab_free+0x152/0x2f0 [ 279.190642] ? asm_exc_invalid_op+0x1f/0x30 [ 279.190648] ? dcn10_link_encoder_destroy+0x19/0x30 [amdgpu] [ 279.191096] ? __slab_free+0x152/0x2f0 [ 279.191102] ? dcn10_link_encoder_destroy+0x19/0x30 [amdgpu] [ 279.191469] kfree+0x260/0x2b0 [ 279.191474] dcn10_link_encoder_destroy+0x19/0x30 [amdgpu] [ 279.191821] link_destroy+0xd7/0x130 [amdgpu] [ 279.192248] dc_destruct+0x90/0x270 [amdgpu] [ 279.192666] dc_destroy+0x19/0x40 [amdgpu] [ 279.193020] amdgpu_dm_fini+0x16e/0x200 [amdgpu] [ 279.193432] dm_hw_fini+0x26/0x40 [amdgpu] [ 279.193795] amdgpu_device_fini_hw+0x24c/0x400 [amdgpu] [ 279.194108] amdgpu_driver_unload_kms+0x4f/0x70 [amdgpu] [ 279.194436] amdgpu_pci_remove+0x40/0x80 [amdgpu] [ 279.194632] pci_device_remove+0x3a/0xa0 [ 279.194638] device_remove+0x40/0x70 [ 279.194642] device_release_driver_internal+0x1ad/0x210 [ 279.194647] driver_detach+0x4e/0xa0 [ 279.194650] bus_remove_driver+0x6f/0xf0 [ 279.194653] driver_unregister+0x33/0x60 [ 279.194657] pci_unregister_driver+0x44/0x90 [ 279.194662] amdgpu_exit+0x19/0x1f0 [amdgpu] [ 279.194939] __do_sys_delete_module.isra.0+0x198/0x2f0 [ 279.194946] __x64_sys_delete_module+0x16/0x20 [ 279.194950] do_syscall_64+0x58/0x120 [ 279.194954] entry_SYSCALL_64_after_hwframe+0x6e/0x76 [ 279.194980] </TASK>
--- drivers/gpu/drm/amd/display/dc/link/link_factory.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/link/link_factory.c +1 -1
@@ -385,7 +385,7 @@ static void link_destruct(struct dc_link *link)if (link->panel_cntl) link->panel_cntl->funcs->destroy (&link->panel_cntl); -if (link->link_enc) { +if (link->link_enc && !link->is_dig_mapping_flexible) {/* Update link encoder resource tracking variables. These are used for * the dynamic assignment of link encoders to streams. Virtual links * are not assigned encoder resources on creation.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 235/558 drm/amdgpu: add list empty check to avoid null pointer issue
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Wang <[email protected]>
[ Upstream commit 4416377ae1fdc41a90b665943152ccd7ff61d3c5 ]
Add list empty check to avoid null pointer issues in some corner cases.
- list_for_each_entry_safe()
--- drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c +10 -0
@@ -80,6 +80,9 @@ static void aca_banks_release(struct aca_banks *banks) {struct aca_bank_node *node, *tmp; +if (list_empty (&banks->list)) +return ; +list_for_each_entry_safe (node, tmp, &banks->list, node) {list_del (&node->node);kvfree (node);
@@ -562,9 +565,13 @@ static void aca_error_fini(struct aca_error *aerr)struct aca_bank_error *bank_error, *tmp;mutex_lock (&aerr->lock); +if (list_empty (&aerr->list)) + goto out_unlock; +list_for_each_entry_safe (bank_error, tmp, &aerr->list, node)aca_bank_error_remove (aerr, bank_error); +out_unlock:mutex_destroy (&aerr->lock); }
@@ -680,6 +687,9 @@ static void aca_manager_fini(struct aca_handle_manager *mgr) {struct aca_handle *handle, *tmp; +if (list_empty (&mgr->list)) +return ; +list_for_each_entry_safe (handle, tmp, &mgr->list, node)amdgpu_aca_remove_handle (handle); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 236/558 jfs: UBSAN: shift-out-of-bounds in dbFindBits
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Remington Brasga <[email protected]>
[ Upstream commit b0b2fc815e514221f01384f39fbfbff65d897e1c ]
Fix issue with UBSAN throwing shift-out-of-bounds warning.
--- fs/jfs/jfs_dmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/jfs/jfs_dmap.c +1 -1
@@ -3022,7 +3022,7 @@ static int dbFindBits(u32 word, int l2nb)/* scan the word for nb free bits at nb alignments. */ -for (bitno =0 ; mask !=0 ; bitno += nb, mask >>= nb) { +for (bitno =0 ; mask !=0 ; bitno += nb, mask = (mask >> nb)) {if ((mask & word) == mask)break ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 237/558 jfs: Fix uaf in dbFreeBits
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
[ Upstream commit d6c1b3599b2feb5c7291f5ac3a36e5fa7cedb234 ]
[syzbot reported]
==================================================================
BUG: KASAN: slab-use-after-free in __mutex_lock_common kernel/locking/mutex.c:587 [inline] BUG: KASAN: slab-use-after-free in __mutex_lock+0xfe/0xd70 kernel/locking/mutex.c:752 Read of size 8 at addr ffff8880229254b0 by task syz-executor357/5216 CPU: 0 UID: 0 PID: 5216 Comm: syz-executor357 Not tainted 6.11.0-rc3-syzkaller-00156-gd7a5aa4b3c00 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 __mutex_lock_common kernel/locking/mutex.c:587 [inline] __mutex_lock+0xfe/0xd70 kernel/locking/mutex.c:752 dbFreeBits+0x7ea/0xd90 fs/jfs/jfs_dmap.c:2390 dbFreeDmap fs/jfs/jfs_dmap.c:2089 [inline] dbFree+0x35b/0x680 fs/jfs/jfs_dmap.c:409 dbDiscardAG+0x8a9/0xa20 fs/jfs/jfs_dmap.c:1650 jfs_ioc_trim+0x433/0x670 fs/jfs/jfs_discard.c:100 jfs_ioctl+0x2d0/0x3e0 fs/jfs/ioctl.c:131 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 Freed by task 5218: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object+0xe0/0x150 mm/kasan/common.c:240 __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2252 [inline] slab_free mm/slub.c:4473 [inline] kfree+0x149/0x360 mm/slub.c:4594 dbUnmount+0x11d/0x190 fs/jfs/jfs_dmap.c:278 jfs_mount_rw+0x4ac/0x6a0 fs/jfs/jfs_mount.c:247 jfs_remount+0x3d1/0x6b0 fs/jfs/super.c:454 reconfigure_super+0x445/0x880 fs/super.c:1083 vfs_cmd_reconfigure fs/fsopen.c:263 [inline] vfs_fsconfig_locked fs/fsopen.c:292 [inline] __do_sys_fsconfig fs/fsopen.c:473 [inline] __se_sys_fsconfig+0xb6e/0xf80 fs/fsopen.c:345 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f
[Analysis]
There are two paths (dbUnmount and jfs_ioc_trim) that generate race condition when accessing bmap, which leads to the occurrence of uaf.
Use the lock s_umount to synchronize them, in order to avoid uaf caused by race condition.
--- fs/jfs/jfs_discard.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
fs/jfs/jfs_discard.c +9 -2
@@ -65,7 +65,7 @@ void jfs_issue_discard(struct inode *ip, u64 blkno, u64 nblocks)int jfs_ioc_trim (struct inode *ip,struct fstrim_range *range) {struct inode *ipbmap =JFS_SBI (ip->i_sb)->ipbmap; -struct bmap *bmp =JFS_SBI (ip->i_sb)->bmap; +struct bmap *bmp;struct super_block *sb = ipbmap->i_sb;int agno, agno_end;u64 start, end, minlen;
@@ -83,10 +83,15 @@ int jfs_ioc_trim(struct inode *ip, struct fstrim_range *range)if (minlen ==0 ) minlen =1 ; +down_read (&sb->s_umount); + bmp =JFS_SBI (ip->i_sb)->bmap; +if (minlen > bmp->db_agsize || start >= bmp->db_mapsize || - range->len < sb->s_blocksize) + range->len < sb->s_blocksize) { +up_read (&sb->s_umount);return -EINVAL ; + }if (end >= bmp->db_mapsize) end = bmp->db_mapsize -1 ;
@@ -100,6 +105,8 @@ int jfs_ioc_trim(struct inode *ip, struct fstrim_range *range) trimmed +=dbDiscardAG (ip, agno, minlen); agno++; } + +up_read (&sb->s_umount); range->len = trimmed << sb->s_blocksize_bits;return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 238/558 jfs: check if leafidx greater than num leaves per dmap tree
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
[ Upstream commit d64ff0d2306713ff084d4b09f84ed1a8c75ecc32 ]
syzbot report a out of bounds in dbSplit, it because dmt_leafidx greater than num leaves per dmap tree, add a checking for dmt_leafidx in dbFindLeaf.
Shaggy:
Modified sanity check to apply to control pages as well as leaf pages.
--- fs/jfs/jfs_dmap.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/jfs/jfs_dmap.c +4 -1
@@ -2944,9 +2944,10 @@ static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl)static int dbFindLeaf (dmtree_t *tp,int l2nb,int *leafidx,bool is_ctl) {int ti, n =0 , k, x =0 ; -int max_size; +int max_size, max_idx; max_size = is_ctl ?CTLTREESIZE :TREESIZE ; + max_idx = is_ctl ?LPERCTL :LPERDMAP ;/* first check the root of the tree to see if there is * sufficient free space.
@@ -2978,6 +2979,8 @@ static int dbFindLeaf(dmtree_t *tp, int l2nb, int *leafidx, bool is_ctl)*/ assert (n <4 ); } +if (le32_to_cpu (tp->dmt_leafidx) >= max_idx) +return -ENOSPC ;/* set the return to the leftmost leaf describing sufficient * free space.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 239/558 scsi: smartpqi: correct stream detection
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mahesh Rajashekhara <[email protected]>
[ Upstream commit 4c76114932d1d6fad2e72823e7898a3c960cf2a7 ]
Correct stream detection by initializing the structure pqi_scsi_dev_raid_map_data to 0s.
When the OS issues SCSI READ commands, the driver erroneously considers them as SCSI WRITES. If they are identified as sequential IOs, the driver then submits those requests via the RAID path instead of the AIO path.
The 'is_write' flag might be set for SCSI READ commands also. The driver may interpret SCSI READ commands as SCSI WRITE commands, resulting in IOs being submitted through the RAID path.
Note: This does not cause data corruption.
--- drivers/scsi/smartpqi/smartpqi_init.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/smartpqi/smartpqi_init.c +1 -1
@@ -5917,7 +5917,7 @@ static bool pqi_is_parity_write_stream(struct pqi_ctrl_info *ctrl_info,int rc;struct pqi_scsi_dev *device;struct pqi_stream_data *pqi_stream_data; -struct pqi_scsi_dev_raid_map_data rmd; +struct pqi_scsi_dev_raid_map_data rmd = {0 };if (!ctrl_info->enable_stream_detection)return false;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 240/558 scsi: smartpqi: add new controller PCI IDs
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Strahan <[email protected]>
[ Upstream commit dbc39b84540f746cc814e69b21e53e6d3e12329a ]
All PCI ID entries in Hex.
Add new cisco pci ids:
VID / DID / SVID / SDID
---- ---- ---- ----
9005 028f 1137 02fe
9005 028f 1137 02ff
9005 028f 1137 0300Add new h3c pci ids:
VID / DID / SVID / SDID
---- ---- ---- ----
9005 028f 193d 0462
9005 028f 193d 8462Add new ieit pci ids:
VID / DID / SVID / SDID
---- ---- ---- ----
9005 028f 1ff9 00a3--- drivers/scsi/smartpqi/smartpqi_init.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+)
drivers/scsi/smartpqi/smartpqi_init.c +24 -0
@@ -9428,6 +9428,10 @@ static const struct pci_device_id pqi_pci_id_table[] = {PCI_DEVICE_SUB (PCI_VENDOR_ID_ADAPTEC2 ,0x028f ,0x152d ,0x8a37 ) }, + { +PCI_DEVICE_SUB (PCI_VENDOR_ID_ADAPTEC2 ,0x028f , +0x193d ,0x0462 ) + }, {PCI_DEVICE_SUB (PCI_VENDOR_ID_ADAPTEC2 ,0x028f ,0x193d ,0x1104 )
@@ -9468,6 +9472,10 @@ static const struct pci_device_id pqi_pci_id_table[] = {PCI_DEVICE_SUB (PCI_VENDOR_ID_ADAPTEC2 ,0x028f ,0x193d ,0x8461 ) }, + { +PCI_DEVICE_SUB (PCI_VENDOR_ID_ADAPTEC2 ,0x028f , +0x193d ,0x8462 ) + }, {PCI_DEVICE_SUB (PCI_VENDOR_ID_ADAPTEC2 ,0x028f ,0x193d ,0xc460 )
@@ -10176,6 +10184,18 @@ static const struct pci_device_id pqi_pci_id_table[] = {PCI_DEVICE_SUB (PCI_VENDOR_ID_ADAPTEC2 ,0x028f ,0x1137 ,0x02fa ) }, + { +PCI_DEVICE_SUB (PCI_VENDOR_ID_ADAPTEC2 ,0x028f , +0x1137 ,0x02fe ) + }, + { +PCI_DEVICE_SUB (PCI_VENDOR_ID_ADAPTEC2 ,0x028f , +0x1137 ,0x02ff ) + }, + { +PCI_DEVICE_SUB (PCI_VENDOR_ID_ADAPTEC2 ,0x028f , +0x1137 ,0x0300 ) + }, {PCI_DEVICE_SUB (PCI_VENDOR_ID_ADAPTEC2 ,0x028f ,0x1ff9 ,0x0045 )
@@ -10352,6 +10372,10 @@ static const struct pci_device_id pqi_pci_id_table[] = {PCI_DEVICE_SUB (PCI_VENDOR_ID_ADAPTEC2 ,0x028f ,0x1f51 ,0x1045 ) }, + { +PCI_DEVICE_SUB (PCI_VENDOR_ID_ADAPTEC2 ,0x028f , +0x1ff9 ,0x00a3 ) + }, {PCI_DEVICE_SUB (PCI_VENDOR_ID_ADAPTEC2 ,0x028f ,PCI_ANY_ID ,PCI_ANY_ID )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 241/558 drm/msm/adreno: Assign msm_gpu->pdev earlier to avoid nullptrs
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit 16007768551d5bfe53426645401435ca8d2ef54f ]
There are some cases, such as the one uncovered by Commit 46d4efcccc68 ("drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting fails") where
msm_gpu_cleanup() : platform_set_drvdata(gpu->pdev, NULL);
is called on gpu->pdev == NULL, as the GPU device has not been fully initialized yet.
Turns out that there's more than just the aforementioned path that causes this to happen (e.g. the case when there's speedbin data in the catalog, but opp-supported-hw is missing in DT).
Assigning msm_gpu->pdev earlier seems like the least painful solution to this, therefore do so.
Patchwork: https://patchwork.freedesktop.org/patch/602742/
--- drivers/gpu/drm/msm/adreno/adreno_gpu.c | 1 + drivers/gpu/drm/msm/msm_gpu.c | 1 - 2 files changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/msm/adreno/adreno_gpu.c +1 -0
@@ -1083,6 +1083,7 @@ int adreno_gpu_init(struct drm_device *drm, struct platform_device *pdev, adreno_gpu->chip_id = config->chip_id; gpu->allow_relocs = config->info->family <ADRENO_6XX_GEN1 ; + gpu->pdev = pdev;/* Only handle the core clock when GMU is not in use (or is absent). */ if (adreno_has_gmu_wrapper(adreno_gpu) ||
drivers/gpu/drm/msm/msm_gpu.c +0 -1
@@ -931,7 +931,6 @@ int msm_gpu_init(struct drm_device *drm, struct platform_device *pdev,if (IS_ERR (gpu->gpu_cx)) gpu->gpu_cx =NULL ; - gpu->pdev = pdev;platform_set_drvdata (pdev, &gpu->adreno_smmu);msm_devfreq_init (gpu);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 242/558 jfs: Fix uninit-value access of new_ea in ea_buffer
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Mengmeng <[email protected]>
[ Upstream commit 2b59ffad47db1c46af25ccad157bb3b25147c35c ]
syzbot reports that lzo1x_1_do_compress is using uninit-value:
=====================================================
BUG: KMSAN: uninit-value in lzo1x_1_do_compress+0x19f9/0x2510 lib/lzo/lzo1x_compress.c:178
...
Uninit was stored to memory at:
ea_put fs/jfs/xattr.c:639 [inline]
...
Local variable ea_buf created at:
__jfs_setxattr+0x5d/0x1ae0 fs/jfs/xattr.c:662 __jfs_xattr_set+0xe6/0x1f0 fs/jfs/xattr.c:934
=====================================================
The reason is ea_buf->new_ea is not initialized properly.
Fix this by using memset to empty its content at the beginning in ea_get().
--- fs/jfs/xattr.c | 2 ++ 1 file changed, 2 insertions(+)
fs/jfs/xattr.c +2 -0
@@ -434,6 +434,8 @@ static int ea_get(struct inode *inode, struct ea_buffer *ea_buf, int min_size)int rc;int quota_allocation =0 ; +memset (&ea_buf->new_ea,0 ,sizeof (ea_buf->new_ea)); +/* When fsck.jfs clears a bad ea, it doesn't clear the size */ if (ji->ea.flag ==0 ) ea_size =0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 243/558 drm/amdgpu: add raven1 gfxoff quirk
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Liu <[email protected]>
[ Upstream commit 0126c0ae11e8b52ecfde9d1b174ee2f32d6c3a5d ]
Fix screen corruption with openkylin.
--- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +2 -0
@@ -1301,6 +1301,8 @@ static const struct amdgpu_gfxoff_quirk amdgpu_gfxoff_quirk_list[] = { { 0x1002, 0x15dd, 0x1002, 0x15dd, 0xc6 },/* Apple MacBook Pro (15-inch, 2019) Radeon Pro Vega 20 4 GB */ { 0x1002, 0x69af, 0x106b, 0x019a, 0xc0 }, +/* https://bbs.openkylin.top/t/topic/171497 */ + { 0x1002, 0x15d8, 0x19e5, 0x3e14, 0xc2 }, { 0, 0, 0, 0, 0 }, };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 244/558 drm/amdgpu: enable gfxoff quirk on HP 705G4
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Liu <[email protected]>
[ Upstream commit 2c7795e245d993bcba2f716a8c93a5891ef910c9 ]
Enabling gfxoff quirk results in perfectly usable graphical user interface on HP 705G4 DM with R5 2400G.
Without the quirk, X server is completely unusable as every few seconds there is gpu reset due to ring gfx timeout.
--- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +2 -0
@@ -1303,6 +1303,8 @@ static const struct amdgpu_gfxoff_quirk amdgpu_gfxoff_quirk_list[] = { { 0x1002, 0x69af, 0x106b, 0x019a, 0xc0 },/* https://bbs.openkylin.top/t/topic/171497 */ { 0x1002, 0x15d8, 0x19e5, 0x3e14, 0xc2 }, +/* HP 705G4 DM with R5 2400G */ + { 0x1002, 0x15dd, 0x103c, 0x8464, 0xd6 }, { 0, 0, 0, 0, 0 }, };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 245/558 drm/amdkfd: Fix resource leak in criu restore queue
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Zhang <[email protected]>
[ Upstream commit aa47fe8d3595365a935921a90d00bc33ee374728 ]
To avoid memory leaks, release q_extra_data when exiting the restore queue.
v2: Correct the proto (Alex)
--- drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c +1 -0
@@ -988,6 +988,7 @@ int kfd_criu_restore_queue(struct kfd_process *p,pr_debug ("Queue id %d was restored successfully\n" , queue_id);kfree (q_data); +kfree (q_extra_data);return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 246/558 HID: multitouch: Add support for Thinkpad X12 Gen 2 Kbd Portfolio
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vishnu Sankar <[email protected]>
[ Upstream commit 65b72ea91a257a5f0cb5a26b01194d3dd4b85298 ]
This applies similar quirks used by previous generation device, so that Trackpoint and buttons on the touchpad works. New USB KBD PID 0x61AE for Thinkpad X12 Tab is added.
--- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-multitouch.c | 6 ++++++ 2 files changed, 7 insertions(+)
drivers/hid/hid-ids.h +1 -0
@@ -794,6 +794,7 @@#define USB_DEVICE_ID_LENOVO_X1_TAB 0x60a3#define USB_DEVICE_ID_LENOVO_X1_TAB3 0x60b5#define USB_DEVICE_ID_LENOVO_X12_TAB 0x60fe +#define USB_DEVICE_ID_LENOVO_X12_TAB2 0x61ae#define USB_DEVICE_ID_LENOVO_OPTICAL_USB_MOUSE_600E 0x600e#define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_608D 0x608d#define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_6019 0x6019
drivers/hid/hid-multitouch.c +6 -0
@@ -2113,6 +2113,12 @@ static const struct hid_device_id mt_devices[] = { USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_X12_TAB) }, +/* Lenovo X12 TAB Gen 2 */ + { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU, +HID_DEVICE (BUS_USB ,HID_GROUP_MULTITOUCH_WIN_8 , +USB_VENDOR_ID_LENOVO , + USB_DEVICE_ID_LENOVO_X12_TAB2) }, + /* Logitech devices */ { .driver_data = MT_CLS_NSMU, HID_DEVICE(BUS_BLUETOOTH, HID_GROUP_MULTITOUCH_WIN_8,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 247/558 platform/x86: touchscreen_dmi: add nanote-next quirk
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ckath <[email protected]>
[ Upstream commit c11619af35bae5884029bd14170c3e4b55ddf6f3 ]
Add touschscreen info for the nanote next (UMPC-03-SR).
After checking with multiple owners the DMI info really is this generic.
--- drivers/platform/x86/touchscreen_dmi.c | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+)
drivers/platform/x86/touchscreen_dmi.c +26 -0
@@ -840,6 +840,21 @@ static const struct ts_dmi_data rwc_nanote_p8_data = { .properties = rwc_nanote_p8_props, }; +static const struct property_entry rwc_nanote_next_props[] = { +PROPERTY_ENTRY_U32 ("touchscreen-min-x" ,5 ), +PROPERTY_ENTRY_U32 ("touchscreen-min-y" ,5 ), +PROPERTY_ENTRY_U32 ("touchscreen-size-x" ,1785 ), +PROPERTY_ENTRY_U32 ("touchscreen-size-y" ,1145 ), +PROPERTY_ENTRY_BOOL ("touchscreen-inverted-y" ), +PROPERTY_ENTRY_STRING ("firmware-name" ,"gsl1680-rwc-nanote-next.fw" ), + { } +}; + +static const struct ts_dmi_data rwc_nanote_next_data = { + .acpi_name ="MSSL1680:00" , + .properties = rwc_nanote_next_props, +}; +static const struct property_entry schneider_sct101ctm_props[] = {PROPERTY_ENTRY_U32 ("touchscreen-size-x" ,1715 ),PROPERTY_ENTRY_U32 ("touchscreen-size-y" ,1140 ),
@@ -1589,6 +1604,17 @@ const struct dmi_system_id touchscreen_dmi_table[] = {DMI_MATCH (DMI_PRODUCT_SKU ,"0001" ) }, }, + { +/* RWC NANOTE NEXT */ + .driver_data = (void *)&rwc_nanote_next_data, + .matches = { +DMI_MATCH (DMI_PRODUCT_NAME ,"To be filled by O.E.M." ), +DMI_MATCH (DMI_BOARD_NAME ,"To be filled by O.E.M." ), +DMI_MATCH (DMI_BOARD_VENDOR ,"To be filled by O.E.M." ), +/* Above matches are too generic, add bios-version match */ + DMI_MATCH(DMI_BIOS_VERSION, "S8A70R100-V005"), + }, + }, {/* Schneider SCT101CTM */ .driver_data = (void *)&schneider_sct101ctm_data,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 248/558 platform/x86/amd: pmf: Add quirk for TUF Gaming A14
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: aln8 <[email protected]>
[ Upstream commit 06369503d644068abd9e90918c6611274d94c126 ]
The ASUS TUF Gaming A14 has the same issue as the ROG Zephyrus G14 where it advertises SPS support but doesn't use it.
--- drivers/platform/x86/amd/pmf/pmf-quirks.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/platform/x86/amd/pmf/pmf-quirks.c +8 -0
@@ -37,6 +37,14 @@ static const struct dmi_system_id fwbug_list[] = { }, .driver_data = &quirk_no_sps_bug, }, + { + .ident = "ASUS TUF Gaming A14", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_PRODUCT_NAME, "FA401W"), + }, + .driver_data = &quirk_no_sps_bug, + }, {} };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 249/558 drm/xe: Add timeout to preempt fences
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Brost <[email protected]>
[ Upstream commit 627c961d672d3304564455ba471f5e4405170eec ]
To adhere to dma fencing rules that fences must signal within a reasonable amount of time, add a 5 second timeout to preempt fences. If this timeout occurs, kill the associated VM as this fatal to the VM.
v2:
- Add comment for smp_wmb (Checkpatch)
- Fix kernel doc typo (Inspection)
- Add comment for killed check (Niranjana)
v3:
- Drop smp_wmb (Matthew Auld)
- Don't take vm->lock in preempt fence worker (Matthew Auld)
- Drop RB given changes to patch
v4:
- Add WRITE/READ_ONCE (Niranjana)
- Don't export xe_vm_kill (Niranjana)
--- drivers/gpu/drm/xe/xe_exec_queue_types.h | 6 ++-- drivers/gpu/drm/xe/xe_execlist.c | 3 +- drivers/gpu/drm/xe/xe_guc_submit.c | 39 ++++++++++++++++++++---- drivers/gpu/drm/xe/xe_preempt_fence.c | 12 ++++++-- drivers/gpu/drm/xe/xe_vm.c | 12 +++++++- 5 files changed, 59 insertions(+), 13 deletions(-)
drivers/gpu/drm/xe/xe_exec_queue_types.h +4 -2
@@ -169,9 +169,11 @@ struct xe_exec_queue_ops {int (*suspend)(struct xe_exec_queue *q);/** * @suspend_wait: Wait for an exec queue to suspend executing, should be -* call after suspend. +* call after suspend. In dma-fencing path thus must return within a +* reasonable amount of time. -ETIME return shall indicate an error +* waiting for suspend resulting in associated VM getting killed. */ -void (*suspend_wait)(struct xe_exec_queue *q); +int (*suspend_wait)(struct xe_exec_queue *q);/** * @resume: Resume exec queue execution, exec queue must be in a suspended * state and dma fence returned from most recent suspend call must be
drivers/gpu/drm/xe/xe_execlist.c +2 -1
@@ -422,10 +422,11 @@ static int execlist_exec_queue_suspend(struct xe_exec_queue *q)return 0 ; } -static void execlist_exec_queue_suspend_wait (struct xe_exec_queue *q) +static int execlist_exec_queue_suspend_wait (struct xe_exec_queue *q) {/* NIY */ +return 0 ; }static void execlist_exec_queue_resume (struct xe_exec_queue *q)
drivers/gpu/drm/xe/xe_guc_submit.c +33 -6
@@ -1318,6 +1318,15 @@ static void __guc_exec_queue_process_msg_set_sched_props(struct xe_sched_msg *mskfree (msg); } +static void __suspend_fence_signal (struct xe_exec_queue *q) +{ +if (!q->guc->suspend_pending) +return ; + +WRITE_ONCE (q->guc->suspend_pending, false); +wake_up (&q->guc->suspend_wait); +} +static void suspend_fence_signal (struct xe_exec_queue *q) {struct xe_guc *guc =exec_queue_to_guc (q);
@@ -1327,9 +1336,7 @@ static void suspend_fence_signal(struct xe_exec_queue *q) guc_read_stopped(guc));xe_assert (xe, q->guc->suspend_pending); - q->guc->suspend_pending = false; -smp_wmb (); -wake_up (&q->guc->suspend_wait); +__suspend_fence_signal (q); }static void __guc_exec_queue_process_msg_suspend (struct xe_sched_msg *msg)
@@ -1486,6 +1493,7 @@ static void guc_exec_queue_kill(struct xe_exec_queue *q) {trace_xe_exec_queue_kill (q);set_exec_queue_killed (q); +__suspend_fence_signal (q);xe_guc_exec_queue_trigger_cleanup (q); }
@@ -1584,12 +1592,31 @@ static int guc_exec_queue_suspend(struct xe_exec_queue *q)return 0 ; } -static void guc_exec_queue_suspend_wait (struct xe_exec_queue *q) +static int guc_exec_queue_suspend_wait (struct xe_exec_queue *q) {struct xe_guc *guc =exec_queue_to_guc (q); +int ret; + +/* +* Likely don't need to check exec_queue_killed() as we clear +* suspend_pending upon kill but to be paranoid but races in which +* suspend_pending is set after kill also check kill here. +*/ + ret =wait_event_timeout (q->guc->suspend_wait, + !READ_ONCE (q->guc->suspend_pending) || +exec_queue_killed (q) || +guc_read_stopped (guc), +HZ *5 ); -wait_event (q->guc->suspend_wait, !q->guc->suspend_pending || -guc_read_stopped (guc)); +if (!ret) { +xe_gt_warn (guc_to_gt (guc), +"Suspend fence, guc_id=%d, failed to respond" , + q->guc->id); +/* XXX: Trigger GT reset? */ +return -ETIME ; + } + +return 0 ; }static void guc_exec_queue_resume (struct xe_exec_queue *q)
drivers/gpu/drm/xe/xe_preempt_fence.c +9 -3
@@ -17,10 +17,16 @@ static void preempt_fence_work_func(struct work_struct *w)container_of (w,typeof (*pfence), preempt_work);struct xe_exec_queue *q = pfence->q; -if (pfence->error) +if (pfence->error) {dma_fence_set_error (&pfence->base, pfence->error); -else - q->ops->suspend_wait (q); + }else if (!q->ops->reset_status (q)) { +int err = q->ops->suspend_wait (q); + +if (err) +dma_fence_set_error (&pfence->base, err); + }else { +dma_fence_set_error (&pfence->base, -ENOENT ); + }dma_fence_signal (&pfence->base);/*
drivers/gpu/drm/xe/xe_vm.c +11 -1
@@ -133,8 +133,10 @@ static int wait_for_existing_preempt_fences(struct xe_vm *vm)if (q->lr.pfence) {long timeout =dma_fence_wait (q->lr.pfence, false); -if (timeout <0 ) +/* Only -ETIME on fence indicates VM needs to be killed */ +if (timeout <0 || q->lr.pfence->error == -ETIME )return -ETIME ; +dma_fence_put (q->lr.pfence); q->lr.pfence =NULL ; }
@@ -311,6 +313,14 @@ int __xe_vm_userptr_needs_repin(struct xe_vm *vm)#define XE_VM_REBIND_RETRY_TIMEOUT_MS 1000 +/* +* xe_vm_kill() - VM Kill +* @vm: The VM. +* @unlocked: Flag indicates the VM's dma-resv is not held +* +* Kill the VM by setting banned flag indicated VM is no longer available for +* use. If in preempt fence mode, also kill all exec queue attached to the VM. +*/ static void xe_vm_kill (struct xe_vm *vm,bool unlocked) {struct xe_exec_queue *q;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 250/558 drm/xe/fbdev: Limit the usage of stolen for LNL+
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uma Shankar <[email protected]>
[ Upstream commit 775d0adc01a55fe0458139330415d86bb3533efe ]
As per recommendation in the workarounds:WA_22019338487
There is an issue with accessing Stolen memory pages due a hardware limitation. Limit the usage of stolen memory for fbdev for LNL+. Don't use BIOS FB from stolen on LNL+ and assign the same from system memory.
v2: Corrected the WA Number, limited WA to LNL and
Adopted XE_WA framework as suggested by Lucas and Matt.
v3: Introduced the waxxx_display to implement display side
of WA changes on Lunarlake. Used xe_root_mmio_gt and avoid the for loop (Suggested by Lucas)
v4: Fixed some nits (Luca)
--- drivers/gpu/drm/xe/display/intel_fbdev_fb.c | 6 +++++- drivers/gpu/drm/xe/display/xe_plane_initial.c | 6 ++++++ drivers/gpu/drm/xe/xe_wa_oob.rules | 1 + 3 files changed, 12 insertions(+), 1 deletion(-)
drivers/gpu/drm/xe/display/intel_fbdev_fb.c +5 -1
@@ -10,6 +10,9 @@#include "xe_bo.h" #include "xe_gt.h" #include "xe_ttm_stolen_mgr.h" +#include "xe_wa.h" + +#include <generated/xe_wa_oob.h> struct intel_framebuffer *intel_fbdev_fb_alloc (struct drm_fb_helper *helper,struct drm_fb_helper_surface_size *sizes)
@@ -37,7 +40,7 @@ struct intel_framebuffer *intel_fbdev_fb_alloc(struct drm_fb_helper *helper, size =PAGE_ALIGN (size); obj =ERR_PTR (-ENODEV ); -if (!IS_DGFX (xe)) { + if (!IS_DGFX(xe) && !XE_WA(xe_root_mmio_gt(xe), 22019338487_display)) { obj = xe_bo_create_pin_map(xe, xe_device_get_root_tile(xe), NULL, size, ttm_bo_type_kernel, XE_BO_FLAG_SCANOUT |
@@ -48,6 +51,7 @@ struct intel_framebuffer *intel_fbdev_fb_alloc(struct drm_fb_helper *helper,else drm_info (&xe->drm,"Allocated fbdev into stolen failed: %li\n" ,PTR_ERR (obj)); } +if (IS_ERR (obj)) { obj = xe_bo_create_pin_map(xe, xe_device_get_root_tile(xe), NULL, size, ttm_bo_type_kernel, XE_BO_FLAG_SCANOUT |
drivers/gpu/drm/xe/display/xe_plane_initial.c +6 -0
@@ -18,6 +18,9 @@#include "intel_frontbuffer.h" #include "intel_plane_initial.h" #include "xe_bo.h" +#include "xe_wa.h" + +#include <generated/xe_wa_oob.h> static bool intel_reuse_initial_plane_obj(struct intel_crtc *this,
@@ -104,6 +107,9 @@ initial_plane_bo(struct xe_device *xe, phys_base = base; flags |=XE_BO_FLAG_STOLEN ; + if (XE_WA(xe_root_mmio_gt(xe), 22019338487_display)) +return NULL ; +/* * If the FB is too big, just don't use it since fbdev is not very * important and we should probably use that space with FBC or other
drivers/gpu/drm/xe/xe_wa_oob.rules +1 -0
@@ -29,6 +29,7 @@ 13011645652 GRAPHICS_VERSION(2004) 22019338487 MEDIA_VERSION(2000) GRAPHICS_VERSION(2001) +22019338487_display PLATFORM(LUNARLAKE) 16023588340 GRAPHICS_VERSION(2001) 14019789679 GRAPHICS_VERSION(1255) GRAPHICS_VERSION_RANGE(1270, 2004)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 251/558 drm/stm: ltdc: reset plane transparency after plane disable
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yannick Fertre <[email protected]>
[ Upstream commit 02fa62d41c8abff945bae5bfc3ddcf4721496aca ]
The plane's opacity should be reseted while the plane is disabled. It prevents from seeing a possible global or layer background color set earlier.
--- drivers/gpu/drm/stm/ltdc.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/stm/ltdc.c +3 -0
@@ -1513,6 +1513,9 @@ static void ltdc_plane_atomic_disable(struct drm_plane *plane,/* Disable layer */ regmap_write_bits (ldev->regmap,LTDC_L1CR + lofs,LXCR_LEN |LXCR_CLUTEN |LXCR_HMEN ,0 ); +/* Reset the layer transparency to hide any related background color */ +regmap_write_bits (ldev->regmap,LTDC_L1CACR + lofs,LXCACR_CONSTA ,0x00 ); +/* Commit shadow registers = update plane at next vblank */ if (ldev->caps.plane_reg_shadow) regmap_write_bits(ldev->regmap, LTDC_L1RCR + lofs,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 252/558 drm/amd/display: Initialize denominators default to 1
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit b995c0a6de6c74656a0c39cd57a0626351b13e3c ]
[WHAT & HOW]
Variables used as denominators and maybe not assigned to other values, should not be 0. Change their default to 1 so they are never 0.
This fixes 10 DIVIDE_BY_ZERO issues reported by Coverity.
--- .../gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c | 2 +- drivers/gpu/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c | 2 +- .../display/dc/dml2/dml21/src/dml2_core/dml2_core_shared.c | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c +1 -1
@@ -78,7 +78,7 @@ static void calculate_ttu_cursor(struct display_mode_lib *mode_lib,static unsigned int get_bytes_per_element (enum source_format_class source_format,bool is_chroma) { -unsigned int ret_val =0 ; +unsigned int ret_val =1 ;if (source_format == dm_444_16) {if (!is_chroma)
drivers/gpu/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c +1 -1
@@ -39,7 +39,7 @@static unsigned int get_bytes_per_element (enum source_format_class source_format,bool is_chroma) { -unsigned int ret_val =0 ; +unsigned int ret_val =1 ;if (source_format == dm_444_16) {if (!is_chroma)
drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_shared.c +2 -2
@@ -9386,8 +9386,8 @@ static void CalculateVMGroupAndRequestTimes(double TimePerVMRequestVBlank[], double TimePerVMRequestFlip[]) { - unsigned int num_group_per_lower_vm_stage = 0; -unsigned int num_req_per_lower_vm_stage =0 ; + unsigned int num_group_per_lower_vm_stage = 1; +unsigned int num_req_per_lower_vm_stage =1 ;#ifdef __DML_VBA_DEBUG__dml2_printf ("DML::%s: NumberOfActiveSurfaces = %u\n" , __func__, NumberOfActiveSurfaces);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 253/558 drm/amd/display: Check null-initialized variables
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit 367cd9ceba1933b63bc1d87d967baf6d9fd241d2 ]
[WHAT & HOW]drr_timing and subvp_pipe are initialized to null and they are not always assigned new values. It is necessary to check for null before dereferencing.
This fixes 2 FORWARD_NULL issues reported by Coverity.
--- drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c +4 -3
@@ -871,8 +871,9 @@ static bool subvp_drr_schedulable(struct dc *dc, struct dc_state *context)* for VBLANK: (VACTIVE region of the SubVP pipe can fit the MALL prefetch, VBLANK frame time, * and the max of (VBLANK blanking time, MALL region)). */ -if (stretched_drr_us < (1 / (double )drr_timing->min_refresh_in_uhz) *1000000 *1000000 && - subvp_active_us - prefetch_us - stretched_drr_us - max_vblank_mallregion >0 ) +if (drr_timing && + stretched_drr_us < (1 / (double )drr_timing->min_refresh_in_uhz) *1000000 *1000000 && + subvp_active_us - prefetch_us - stretched_drr_us - max_vblank_mallregion >0 ) schedulable = true;return schedulable;
@@ -937,7 +938,7 @@ static bool subvp_vblank_schedulable(struct dc *dc, struct dc_state *context)if (!subvp_pipe && pipe_mall_type ==SUBVP_MAIN ) subvp_pipe = pipe; } -if (found) { +if (found && subvp_pipe) { phantom_stream =dc_state_get_paired_subvp_stream (context, subvp_pipe->stream); main_timing = &subvp_pipe->stream->timing; phantom_timing = &phantom_stream->timing;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 254/558 drm/amd/display: Check phantom_stream before it is used
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit 3718a619a8c0a53152e76bb6769b6c414e1e83f4 ]
dcn32_enable_phantom_stream can return null, so returned value must be checked before used.
This fixes 1 NULL_RETURNS issue reported by Coverity.
--- drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c +3 -0
@@ -1720,6 +1720,9 @@ void dcn32_add_phantom_pipes(struct dc *dc, struct dc_state *context,// be a valid candidate for SubVP (i.e. has a plane, stream, doesn't // already have phantom pipe assigned, etc.) by previous checks. phantom_stream =dcn32_enable_phantom_stream (dc, context, pipes, pipe_cnt, index); +if (!phantom_stream) +return ; +dcn32_enable_phantom_plane (dc, context, phantom_stream, index);for (i =0 ; i < dc->res_pool->pipe_count; i++) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 255/558 drm/amd/display: Check stream before comparing them
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit 35ff747c86767937ee1e0ca987545b7eed7a0810 ]
[WHAT & HOW]amdgpu_dm can pass a null stream to dc_is_stream_unchanged. It is necessary to check for null before dereferencing them.
This fixes 1 FORWARD_NULL issue reported by Coverity.
--- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/display/dc/core/dc_resource.c +2 -0
@@ -3241,6 +3241,8 @@ static bool are_stream_backends_same(bool dc_is_stream_unchanged (struct dc_stream_state *old_stream,struct dc_stream_state *stream) { +if (!old_stream || !stream) +return false;if (!are_stream_backends_same (old_stream, stream))return false;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 256/558 drm/amd/display: Deallocate DML memory if allocation fails
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Park <[email protected]>
[ Upstream commit 892abca6877a96c9123bb1c010cafccdf8ca1b75 ]
[Why]
When DC state create DML memory allocation fails, memory is not deallocated subsequently, resulting in uninitialized structure that is not NULL.
[How]
Deallocate memory if DML memory allocation fails.
--- drivers/gpu/drm/amd/display/dc/core/dc_state.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/core/dc_state.c +8 -2
@@ -211,10 +211,16 @@ struct dc_state *dc_state_create(struct dc *dc, struct dc_state_create_params *p#ifdef CONFIG_DRM_AMD_DC_FP if (dc->debug.using_dml2) { dml2_opt->use_clock_dc_limits = false; -dml2_create (dc, dml2_opt, &state->bw_ctx.dml2); +if (!dml2_create (dc, dml2_opt, &state->bw_ctx.dml2)) { +dc_state_release (state); +return NULL ; + } dml2_opt->use_clock_dc_limits = true; -dml2_create (dc, dml2_opt, &state->bw_ctx.dml2_dc_power_source); +if (!dml2_create (dc, dml2_opt, &state->bw_ctx.dml2_dc_power_source)) { +dc_state_release (state); +return NULL ; + } }#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 257/558 drm/amd/display: Increase array size of dummy_boolean
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit 6d64d39486197083497a01b39e23f2f8474b35d3 ]
[WHY]dml2_core_shared_mode_support and dml_core_mode_support access the third element of dummy_boolean, i.e. hw_debug5 = &s->dummy_boolean[2], when dummy_boolean has size of 2. Any assignment to hw_debug5 causes an OVERRUN.
[HOW]
Increase dummy_boolean's array size to 3.
This fixes 2 OVERRUN issues reported by Coverity.
--- .../dc/dml2/dml21/src/dml2_core/dml2_core_shared_types.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_shared_types.h +1 -1
@@ -865,7 +865,7 @@ struct dml2_core_calcs_mode_support_locals {unsigned int dpte_row_bytes_per_row_l[DML2_MAX_PLANES ];unsigned int dpte_row_bytes_per_row_c[DML2_MAX_PLANES ]; -bool dummy_boolean[2 ]; +bool dummy_boolean[3 ];unsigned int dummy_integer[3 ];unsigned int dummy_integer_array[36 ][DML2_MAX_PLANES ];enum dml2_odm_mode dummy_odm_mode[DML2_MAX_PLANES ];
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 258/558 drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <[email protected]>
[ Upstream commit bc50b614d59990747dd5aeced9ec22f9258991ff ]
This commit addresses a potential index out of bounds issue in the cm3_helper_translate_curve_to_degamma_hw_format function in the DCN30 color management module. The issue could occur when the index 'i' exceeds the number of transfer function points (TRANSFER_FUNC_POINTS).
The fix adds a check to ensure 'i' is within bounds before accessing the transfer function points. If 'i' is out of bounds, the function returns false to indicate an error.
Reported by smatch:drivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:338 cm3_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.red' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:339 cm3_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.green' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:340 cm3_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.blue' 1025 <= s32max
--- drivers/gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c +2 -0
@@ -335,6 +335,8 @@ bool cm3_helper_translate_curve_to_degamma_hw_format( i += increment) {if (j == hw_points -1 )break ; +if (i >=TRANSFER_FUNC_POINTS ) +return false; rgb_resulted[j].red = output_tf->tf_pts.red[i]; rgb_resulted[j].green = output_tf->tf_pts.green[i]; rgb_resulted[j].blue = output_tf->tf_pts.blue[i];
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 259/558 drm/amd/display: Fix index out of bounds in degamma hardware format translation
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <[email protected]>
[ Upstream commit b7e99058eb2e86aabd7a10761e76cae33d22b49f ]
Fixes index out of bounds issue in cm_helper_translate_curve_to_degamma_hw_format function. The issue could occur when the index 'i' exceeds the number of transfer function points (TRANSFER_FUNC_POINTS).
The fix adds a check to ensure 'i' is within bounds before accessing the transfer function points. If 'i' is out of bounds the function returns false to indicate an error.
Reported by smatch:drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:594 cm_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.red' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:595 cm_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.green' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:596 cm_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.blue' 1025 <= s32max
--- drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c +2 -0
@@ -591,6 +591,8 @@ bool cm_helper_translate_curve_to_degamma_hw_format( i += increment) {if (j == hw_points -1 )break ; +if (i >=TRANSFER_FUNC_POINTS ) +return false; rgb_resulted[j].red = output_tf->tf_pts.red[i]; rgb_resulted[j].green = output_tf->tf_pts.green[i]; rgb_resulted[j].blue = output_tf->tf_pts.blue[i];
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 260/558 drm/amd/display: Implement bounds check for stream encoder creation in DCN401
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <[email protected]>
[ Upstream commit bdf606810210e8e07a0cdf1af3c467291363b295 ]
'stream_enc_regs' array is an array of dcn10_stream_enc_registers structures. The array is initialized with four elements, corresponding to the four calls to stream_enc_regs() in the array initializer. This means that valid indices for this array are 0, 1, 2, and 3.
The error message 'stream_enc_regs' 4 <= 5 below, is indicating that there is an attempt to access this array with an index of 5, which is out of bounds. This could lead to undefined behavior
Here, eng_id is used as an index to access the stream_enc_regs array. If eng_id is 5, this would result in an out-of-bounds access on the stream_enc_regs array.
Thus fixing Buffer overflow error in dcn401_stream_encoder_create
Found by smatch:drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn401/dcn401_resource.c:1209 dcn401_stream_encoder_create() error: buffer overflow 'stream_enc_regs' 4 <= 5
--- .../gpu/drm/amd/display/dc/resource/dcn401/dcn401_resource.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/resource/dcn401/dcn401_resource.c +1 -1
@@ -1188,7 +1188,7 @@ static struct stream_encoder *dcn401_stream_encoder_create( vpg =dcn401_vpg_create (ctx, vpg_inst); afmt =dcn401_afmt_create (ctx, afmt_inst); -if (!enc1 || !vpg || !afmt) { +if (!enc1 || !vpg || !afmt || eng_id >=ARRAY_SIZE (stream_enc_regs)) {kfree (enc1);kfree (vpg);kfree (afmt);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 261/558 drm/amd/display: Fix index out of bounds in DCN30 color transformation
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <[email protected]>
[ Upstream commit d81873f9e715b72d4f8d391c8eb243946f784dfc ]
This commit addresses a potential index out of bounds issue in the cm3_helper_translate_curve_to_hw_format function in the DCN30 color management module. The issue could occur when the index 'i' exceeds the number of transfer function points (TRANSFER_FUNC_POINTS).
The fix adds a check to ensure 'i' is within bounds before accessing the transfer function points. If 'i' is out of bounds, the function returns false to indicate an error.
drivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:180 cm3_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.red' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:181 cm3_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.green' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:182 cm3_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.blue' 1025 <= s32max
--- drivers/gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c +2 -0
@@ -177,6 +177,8 @@ bool cm3_helper_translate_curve_to_hw_format( i += increment) {if (j == hw_points)break ; +if (i >=TRANSFER_FUNC_POINTS ) +return false; rgb_resulted[j].red = output_tf->tf_pts.red[i]; rgb_resulted[j].green = output_tf->tf_pts.green[i]; rgb_resulted[j].blue = output_tf->tf_pts.blue[i];
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 262/558 drm/amdgpu/gfx12: properly handle error ints on all pipes
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit 39879321769cc2d9a690725959ef76af92a38ac1 ]
Need to handle the interrupt enables for all pipes.
v2: fix indexing (Jessie)
--- drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 130 ++++++++++++++++++++----- 1 file changed, 106 insertions(+), 24 deletions(-)
drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c +106 -24
@@ -1690,26 +1690,68 @@ static void gfx_v12_0_constants_init(struct amdgpu_device *adev)gfx_v12_0_init_compute_vmid (adev); } +static u32 gfx_v12_0_get_cpg_int_cntl (struct amdgpu_device *adev, +int me,int pipe) +{ +if (me !=0 ) +return 0 ; + +switch (pipe) { +case 0 : +return SOC15_REG_OFFSET (GC ,0 , regCP_INT_CNTL_RING0); +default : +return 0 ; + } +} + +static u32 gfx_v12_0_get_cpc_int_cntl (struct amdgpu_device *adev, +int me,int pipe) +{ +/* +* amdgpu controls only the first MEC. That's why this function only +* handles the setting of interrupts for this specific MEC. All other +* pipes' interrupts are set by amdkfd. +*/ +if (me !=1 ) +return 0 ; + +switch (pipe) { +case 0 : +return SOC15_REG_OFFSET (GC ,0 , regCP_ME1_PIPE0_INT_CNTL); +case 1 : +return SOC15_REG_OFFSET (GC ,0 , regCP_ME1_PIPE1_INT_CNTL); +default : +return 0 ; + } +} +static void gfx_v12_0_enable_gui_idle_interrupt (struct amdgpu_device *adev, -bool enable) +bool enable) { -u32 tmp; +u32 tmp, cp_int_cntl_reg; +int i, j;if (amdgpu_sriov_vf (adev))return ; - tmp =RREG32_SOC15 (GC ,0 , regCP_INT_CNTL_RING0); - - tmp =REG_SET_FIELD (tmp,CP_INT_CNTL_RING0 ,CNTX_BUSY_INT_ENABLE , - enable ?1 :0 ); - tmp =REG_SET_FIELD (tmp,CP_INT_CNTL_RING0 ,CNTX_EMPTY_INT_ENABLE , - enable ?1 :0 ); - tmp =REG_SET_FIELD (tmp,CP_INT_CNTL_RING0 ,CMP_BUSY_INT_ENABLE , - enable ?1 :0 ); - tmp =REG_SET_FIELD (tmp,CP_INT_CNTL_RING0 ,GFX_IDLE_INT_ENABLE , - enable ?1 :0 ); - -WREG32_SOC15 (GC ,0 , regCP_INT_CNTL_RING0, tmp); +for (i =0 ; i < adev->gfx.me.num_me; i++) { +for (j =0 ; j < adev->gfx.me.num_pipe_per_me; j++) { + cp_int_cntl_reg =gfx_v12_0_get_cpg_int_cntl (adev, i, j); + +if (cp_int_cntl_reg) { + tmp =RREG32_SOC15_IP (GC , cp_int_cntl_reg); + tmp =REG_SET_FIELD (tmp,CP_INT_CNTL_RING0 ,CNTX_BUSY_INT_ENABLE , + enable ?1 :0 ); + tmp =REG_SET_FIELD (tmp,CP_INT_CNTL_RING0 ,CNTX_EMPTY_INT_ENABLE , + enable ?1 :0 ); + tmp =REG_SET_FIELD (tmp,CP_INT_CNTL_RING0 ,CMP_BUSY_INT_ENABLE , + enable ?1 :0 ); + tmp =REG_SET_FIELD (tmp,CP_INT_CNTL_RING0 ,GFX_IDLE_INT_ENABLE , + enable ?1 :0 ); +WREG32_SOC15_IP (GC , cp_int_cntl_reg, tmp); + } + } + } }static int gfx_v12_0_init_csb (struct amdgpu_device *adev)
@@ -4755,15 +4797,42 @@ static int gfx_v12_0_eop_irq(struct amdgpu_device *adev,static int gfx_v12_0_set_priv_reg_fault_state (struct amdgpu_device *adev,struct amdgpu_irq_src *source, -unsigned type, +unsigned int type,enum amdgpu_interrupt_state state) { +u32 cp_int_cntl_reg, cp_int_cntl; +int i, j; +switch (state) {case AMDGPU_IRQ_STATE_DISABLE :case AMDGPU_IRQ_STATE_ENABLE : -WREG32_FIELD15_PREREG (GC ,0 ,CP_INT_CNTL_RING0 , -PRIV_REG_INT_ENABLE , - state ==AMDGPU_IRQ_STATE_ENABLE ?1 :0 ); +for (i =0 ; i < adev->gfx.me.num_me; i++) { +for (j =0 ; j < adev->gfx.me.num_pipe_per_me; j++) { + cp_int_cntl_reg =gfx_v12_0_get_cpg_int_cntl (adev, i, j); + +if (cp_int_cntl_reg) { + cp_int_cntl =RREG32_SOC15_IP (GC , cp_int_cntl_reg); + cp_int_cntl =REG_SET_FIELD (cp_int_cntl,CP_INT_CNTL_RING0 , +PRIV_REG_INT_ENABLE , + state ==AMDGPU_IRQ_STATE_ENABLE ?1 :0 ); +WREG32_SOC15_IP (GC , cp_int_cntl_reg, cp_int_cntl); + } + } + } +for (i =0 ; i < adev->gfx.mec.num_mec; i++) { +for (j =0 ; j < adev->gfx.mec.num_pipe_per_mec; j++) { +/* MECs start at 1 */ + cp_int_cntl_reg =gfx_v12_0_get_cpc_int_cntl (adev, i +1 , j); + +if (cp_int_cntl_reg) { + cp_int_cntl =RREG32_SOC15_IP (GC , cp_int_cntl_reg); + cp_int_cntl =REG_SET_FIELD (cp_int_cntl,CP_ME1_PIPE0_INT_CNTL , +PRIV_REG_INT_ENABLE , + state ==AMDGPU_IRQ_STATE_ENABLE ?1 :0 ); +WREG32_SOC15_IP (GC , cp_int_cntl_reg, cp_int_cntl); + } + } + }break ;default :break ;
@@ -4774,15 +4843,28 @@ static int gfx_v12_0_set_priv_reg_fault_state(struct amdgpu_device *adev,static int gfx_v12_0_set_priv_inst_fault_state (struct amdgpu_device *adev,struct amdgpu_irq_src *source, -unsigned type, +unsigned int type,enum amdgpu_interrupt_state state) { +u32 cp_int_cntl_reg, cp_int_cntl; +int i, j; +switch (state) {case AMDGPU_IRQ_STATE_DISABLE :case AMDGPU_IRQ_STATE_ENABLE : -WREG32_FIELD15_PREREG (GC ,0 ,CP_INT_CNTL_RING0 , -PRIV_INSTR_INT_ENABLE , - state ==AMDGPU_IRQ_STATE_ENABLE ?1 :0 ); +for (i =0 ; i < adev->gfx.me.num_me; i++) { +for (j =0 ; j < adev->gfx.me.num_pipe_per_me; j++) { + cp_int_cntl_reg =gfx_v12_0_get_cpg_int_cntl (adev, i, j); + +if (cp_int_cntl_reg) { + cp_int_cntl =RREG32_SOC15_IP (GC , cp_int_cntl_reg); + cp_int_cntl =REG_SET_FIELD (cp_int_cntl,CP_INT_CNTL_RING0 , +PRIV_INSTR_INT_ENABLE , + state ==AMDGPU_IRQ_STATE_ENABLE ?1 :0 ); +WREG32_SOC15_IP (GC , cp_int_cntl_reg, cp_int_cntl); + } + } + }break ;default :break ;
@@ -4806,8 +4888,8 @@ static void gfx_v12_0_handle_priv_fault(struct amdgpu_device *adev,case 0 :for (i =0 ; i < adev->gfx.num_gfx_rings; i++) { ring = &adev->gfx.gfx_ring[i]; -/* we only enabled 1 gfx queue per pipe for now */ -if (ring->me == me_id && ring->pipe == pipe_id) +if (ring->me == me_id && ring->pipe == pipe_id && + ring->queue == queue_id)drm_sched_fault (&ring->sched); }break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 263/558 drm/amdgpu/gfx9: properly handle error ints on all pipes
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit 48695573d2feaf42812c1ad54e01caff0d1c2d71 ]
Need to handle the interrupt enables for all pipes.
--- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 44 +++++++++++++++++++++- drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 50 +++++++++++++++++++++++-- 2 files changed, 89 insertions(+), 5 deletions(-)
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +43 -1
@@ -2638,7 +2638,7 @@ static void gfx_v9_0_enable_gui_idle_interrupt(struct amdgpu_device *adev, tmp =REG_SET_FIELD (tmp,CP_INT_CNTL_RING0 ,CNTX_BUSY_INT_ENABLE , enable ?1 :0 ); tmp =REG_SET_FIELD (tmp,CP_INT_CNTL_RING0 ,CNTX_EMPTY_INT_ENABLE , enable ?1 :0 ); tmp =REG_SET_FIELD (tmp,CP_INT_CNTL_RING0 ,CMP_BUSY_INT_ENABLE , enable ?1 :0 ); -if (adev->gfx.num_gfx_rings) +if (adev->gfx.num_gfx_rings) tmp =REG_SET_FIELD (tmp,CP_INT_CNTL_RING0 ,GFX_IDLE_INT_ENABLE , enable ?1 :0 );WREG32_SOC15 (GC ,0 , mmCP_INT_CNTL_RING0, tmp);
@@ -5933,17 +5933,59 @@ static void gfx_v9_0_set_compute_eop_interrupt_state(struct amdgpu_device *adev, } } +static u32 gfx_v9_0_get_cpc_int_cntl (struct amdgpu_device *adev, +int me,int pipe) +{ +/* +* amdgpu controls only the first MEC. That's why this function only +* handles the setting of interrupts for this specific MEC. All other +* pipes' interrupts are set by amdkfd. +*/ +if (me !=1 ) +return 0 ; + +switch (pipe) { +case 0 : +return SOC15_REG_OFFSET (GC ,0 , mmCP_ME1_PIPE0_INT_CNTL); +case 1 : +return SOC15_REG_OFFSET (GC ,0 , mmCP_ME1_PIPE1_INT_CNTL); +case 2 : +return SOC15_REG_OFFSET (GC ,0 , mmCP_ME1_PIPE2_INT_CNTL); +case 3 : +return SOC15_REG_OFFSET (GC ,0 , mmCP_ME1_PIPE3_INT_CNTL); +default : +return 0 ; + } +} +static int gfx_v9_0_set_priv_reg_fault_state (struct amdgpu_device *adev,struct amdgpu_irq_src *source,unsigned type,enum amdgpu_interrupt_state state) { +u32 cp_int_cntl_reg, cp_int_cntl; +int i, j; +switch (state) {case AMDGPU_IRQ_STATE_DISABLE :case AMDGPU_IRQ_STATE_ENABLE :WREG32_FIELD15 (GC ,0 ,CP_INT_CNTL_RING0 ,PRIV_REG_INT_ENABLE , state ==AMDGPU_IRQ_STATE_ENABLE ?1 :0 ); +for (i =0 ; i < adev->gfx.mec.num_mec; i++) { +for (j =0 ; j < adev->gfx.mec.num_pipe_per_mec; j++) { +/* MECs start at 1 */ + cp_int_cntl_reg =gfx_v9_0_get_cpc_int_cntl (adev, i +1 , j); + +if (cp_int_cntl_reg) { + cp_int_cntl =RREG32_SOC15_IP (GC , cp_int_cntl_reg); + cp_int_cntl =REG_SET_FIELD (cp_int_cntl,CP_ME1_PIPE0_INT_CNTL , +PRIV_REG_INT_ENABLE , + state ==AMDGPU_IRQ_STATE_ENABLE ?1 :0 ); +WREG32_SOC15_IP (GC , cp_int_cntl_reg, cp_int_cntl); + } + } + }break ;default :break ;
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c +46 -4
67 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 264/558 drm/amd/display: Fix possible overflow in integer multiplication
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit 3f96f545f877ac59d0c967f52d760b4b2b3b9a47 ]
[WHAT & HOW]
Integer multiplies integer may overflow in context that expects an expression of unsigned long long (64 bits). This can be fixed by casting integer to unsigned long long to force 64 bits results.
This fixes 2 OVERFLOW_BEFORE_WIDEN issues reported by Coverity.
--- .../amd/display/dc/resource/dcn32/dcn32_resource_helpers.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource_helpers.c +2 -2
@@ -663,7 +663,7 @@ bool dcn32_subvp_drr_admissable(struct dc *dc, struct dc_state *context) subvp_disallow |=disallow_subvp_in_active_plus_blank (pipe); refresh_rate = (pipe->stream->timing.pix_clk_100hz * (uint64_t )100 + - pipe->stream->timing.v_total * pipe->stream->timing.h_total - (uint64_t )1 ); + pipe->stream->timing.v_total * (unsigned long long )pipe->stream->timing.h_total - (uint64_t )1 ); refresh_rate =div_u64 (refresh_rate, pipe->stream->timing.v_total); refresh_rate =div_u64 (refresh_rate, pipe->stream->timing.h_total); }
@@ -724,7 +724,7 @@ bool dcn32_subvp_vblank_admissable(struct dc *dc, struct dc_state *context, int subvp_disallow |=disallow_subvp_in_active_plus_blank (pipe); refresh_rate = (pipe->stream->timing.pix_clk_100hz * (uint64_t )100 + - pipe->stream->timing.v_total * pipe->stream->timing.h_total - (uint64_t )1 ); + pipe->stream->timing.v_total * (unsigned long long )pipe->stream->timing.h_total - (uint64_t )1 ); refresh_rate =div_u64 (refresh_rate, pipe->stream->timing.v_total); refresh_rate =div_u64 (refresh_rate, pipe->stream->timing.h_total); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 265/558 drm/amd/display: Check stream_status before it is used
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit 58a8ee96f84d2c21abb85ad8c22d2bbdf59bd7a9 ]
[WHAT & HOW]dc_state_get_stream_status can return null, and therefore null must be checked before stream_status is used.
This fixes 1 NULL_RETURNS issue reported by Coverity.
--- drivers/gpu/drm/amd/display/dc/core/dc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/core/dc.c +1 -1
@@ -3739,7 +3739,7 @@ static void commit_planes_for_stream_fast(struct dc *dc, surface_count, stream, context); - }else { + }else if (stream_status) { build_dmub_cmd_list(dc, srf_updates, surface_count,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 266/558 drm/amd/display: Avoid overflow assignment in link_dp_cts
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit a15268787b79fd183dd526cc16bec9af4f4e49a1 ]
sampling_rate is an uint8_t but is assigned an unsigned int, and thus it can overflow. As a result, sampling_rate is changed to uint32_t.
Similarly, LINK_QUAL_PATTERN_SET has a size of 2 bits, and it should only be assigned to a value less or equal than 4.
This fixes 2 INTEGER_OVERFLOW issues reported by Coverity.
--- drivers/gpu/drm/amd/display/dc/dc_dp_types.h | 2 +- drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c | 3 ++- drivers/gpu/drm/amd/display/include/dpcd_defs.h | 1 + 3 files changed, 4 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/dc_dp_types.h +1 -1
@@ -727,7 +727,7 @@ struct dp_audio_test_data_flags {struct dp_audio_test_data {struct dp_audio_test_data_flags flags; -uint8_t sampling_rate; +uint32_t sampling_rate;uint8_t channel_count;uint8_t pattern_type;uint8_t pattern_period[8 ];
drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c +2 -1
@@ -775,7 +775,8 @@ bool dp_set_test_pattern(core_link_read_dpcd (link,DP_TRAINING_PATTERN_SET , &training_pattern.raw,sizeof (training_pattern)); - training_pattern.v1_3.LINK_QUAL_PATTERN_SET = pattern; +if (pattern <=PHY_TEST_PATTERN_END_DP11 ) + training_pattern.v1_3.LINK_QUAL_PATTERN_SET = pattern;core_link_write_dpcd (link,DP_TRAINING_PATTERN_SET , &training_pattern.raw,sizeof (training_pattern));
drivers/gpu/drm/amd/display/include/dpcd_defs.h +1 -0
@@ -76,6 +76,7 @@ enum dpcd_phy_test_patterns {PHY_TEST_PATTERN_D10_2 ,PHY_TEST_PATTERN_SYMBOL_ERROR ,PHY_TEST_PATTERN_PRBS7 , +PHY_TEST_PATTERN_END_DP11 =PHY_TEST_PATTERN_PRBS7 ,PHY_TEST_PATTERN_80BIT_CUSTOM ,/* For DP1.2 only */ PHY_TEST_PATTERN_CP2520_1 , PHY_TEST_PATTERN_CP2520_2,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 267/558 drm/amd/display: Initialize get_bytes_per_elements default to 1
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit 4067f4fa0423a89fb19a30b57231b384d77d2610 ]
Variables, used as denominators and maybe not assigned to other values, should not be 0. bytes_per_element_y & bytes_per_element_c are initialized by get_bytes_per_element() which should never return 0.
This fixes 10 DIVIDE_BY_ZERO issues reported by Coverity.
--- .../gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20v2.c | 2 +- .../gpu/drm/amd/display/dc/dml/dcn21/display_rq_dlg_calc_21.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20v2.c +1 -1
@@ -78,7 +78,7 @@ static void calculate_ttu_cursor(struct display_mode_lib *mode_lib,static unsigned int get_bytes_per_element (enum source_format_class source_format,bool is_chroma) { -unsigned int ret_val =0 ; +unsigned int ret_val =1 ;if (source_format == dm_444_16) {if (!is_chroma)
drivers/gpu/drm/amd/display/dc/dml/dcn21/display_rq_dlg_calc_21.c +1 -1
@@ -53,7 +53,7 @@ static void calculate_ttu_cursor(static unsigned int get_bytes_per_element (enum source_format_class source_format,bool is_chroma) { -unsigned int ret_val =0 ; +unsigned int ret_val =1 ;if (source_format == dm_444_16) {if (!is_chroma)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 268/558 drm/printer: Allow NULL data in devcoredump printer
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Brost <[email protected]>
[ Upstream commit 53369581dc0c68a5700ed51e1660f44c4b2bb524 ]
We want to determine the size of the devcoredump before writing it out. To that end, we will run the devcoredump printer with NULL data to get the size, alloc data based on the generated offset, then run the devcorecump again with a valid data pointer to print. This necessitates not writing data to the data pointer on the initial pass, when it is NULL.
v5:
- Better commit message (Jonathan)
- Add kerenl doc with examples (Jani)
--- drivers/gpu/drm/drm_print.c | 13 +++++---- include/drm/drm_print.h | 54 ++++++++++++++++++++++++++++++++++++- 2 files changed, 61 insertions(+), 6 deletions(-)
drivers/gpu/drm/drm_print.c +8 -5
@@ -100,8 +100,9 @@ void __drm_puts_coredump(struct drm_printer *p, const char *str) copy = iterator->remain;/* Copy out the bit of the string that we need */ -memcpy (iterator->data, - str + (iterator->start - iterator->offset), copy); +if (iterator->data) +memcpy (iterator->data, + str + (iterator->start - iterator->offset), copy); iterator->offset = iterator->start + copy; iterator->remain -= copy;
@@ -110,7 +111,8 @@ void __drm_puts_coredump(struct drm_printer *p, const char *str) len =min_t (ssize_t,strlen (str), iterator->remain); -memcpy (iterator->data + pos, str, len); +if (iterator->data) +memcpy (iterator->data + pos, str, len); iterator->offset += len; iterator->remain -= len;
@@ -140,8 +142,9 @@ void __drm_printfn_coredump(struct drm_printer *p, struct va_format *vaf)if ((iterator->offset >= iterator->start) && (len < iterator->remain)) {ssize_t pos = iterator->offset - iterator->start; -snprintf (((char *) iterator->data) + pos, - iterator->remain,"%pV" , vaf); +if (iterator->data) +snprintf (((char *) iterator->data) + pos, + iterator->remain,"%pV" , vaf); iterator->offset += len; iterator->remain -= len;
include/drm/drm_print.h +53 -1
66 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 269/558 perf,x86: avoid missing caller address in stack traces captured in uprobe
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrii Nakryiko <[email protected]>
[ Upstream commit cfa7f3d2c526c224a6271cc78a4a27a0de06f4f0 ]
When tracing user functions with uprobe functionality, it's common to install the probe (e.g., a BPF program) at the first instruction of the function. This is often going to be push %rbp instruction in function preamble, which means that within that function frame pointer hasn't been established yet. This leads to consistently missing an actual caller of the traced function, because perf_callchain_user() only records current IP (capturing traced function) and then following frame pointer chain (which would be caller's frame, containing the address of caller's caller).
So when we have target_1 -> target_2 -> target_3 call chain and we are tracing an entry to target_3, captured stack trace will report target_1 -> target_3 call chain, which is wrong and confusing.
This patch proposes a x86-64-specific heuristic to detect push %rbp (push %ebp on 32-bit architecture) instruction being traced. Given entire kernel implementation of user space stack trace capturing works under assumption that user space code was compiled with frame pointer register (%rbp/%ebp) preservation, it seems pretty reasonable to use this instruction as a strong indicator that this is the entry to the function. In that case, return address is still pointed to by %rsp/%esp, so we fetch it and add to stack trace before proceeding to unwind the rest using frame pointer-based logic.
We also check for endbr64 (for 64-bit modes) as another common pattern for function entry, as suggested by Josh Poimboeuf. Even if we get this wrong sometimes for uprobes attached not at the function entry, it's OK because stack trace will still be overall meaningful, just with one extra bogus entry. If we don't detect this, we end up with guaranteed to be missing caller function entry in the stack trace, which is worse overall.
--- arch/x86/events/core.c | 63 +++++++++++++++++++++++++++++++++++++++++ include/linux/uprobes.h | 2 ++ kernel/events/uprobes.c | 2 ++ 3 files changed, 67 insertions(+)
arch/x86/events/core.c +63 -0
@@ -41,6 +41,8 @@#include <asm/desc.h> #include <asm/ldt.h> #include <asm/unwind.h> +#include <asm/uprobes.h> +#include <asm/ibt.h> #include "perf_event.h"
@@ -2816,6 +2818,46 @@ static unsigned long get_segment_base(unsigned int segment)return get_desc_base (desc); } +#ifdef CONFIG_UPROBES +/* +* Heuristic-based check if uprobe is installed at the function entry. +* +* Under assumption of user code being compiled with frame pointers, +* `push %rbp/%ebp` is a good indicator that we indeed are. +* +* Similarly, `endbr64` (assuming 64-bit mode) is also a common pattern. +* If we get this wrong, captured stack trace might have one extra bogus +* entry, but the rest of stack trace will still be meaningful. +*/ +static bool is_uprobe_at_func_entry (struct pt_regs *regs) +{ +struct arch_uprobe *auprobe; + +if (!current->utask) +return false; + + auprobe = current->utask->auprobe; +if (!auprobe) +return false; + +/* push %rbp/%ebp */ +if (auprobe->insn[0 ] ==0x55 ) +return true; + +/* endbr64 (64-bit only) */ +if (user_64bit_mode (regs) &&is_endbr (*(u32 *)auprobe->insn)) +return true; + +return false; +} + +#else +static bool is_uprobe_at_func_entry (struct pt_regs *regs) +{ +return false; +} +#endif /* CONFIG_UPROBES */ +#ifdef CONFIG_IA32_EMULATION #include <linux/compat.h>
@@ -2827,6 +2869,7 @@ perf_callchain_user32(struct pt_regs *regs, struct perf_callchain_entry_ctx *entunsigned long ss_base, cs_base;struct stack_frame_ia32 frame;const struct stack_frame_ia32 __user *fp; +u32 ret_addr;if (user_64bit_mode (regs))return 0 ;
@@ -2836,6 +2879,12 @@ perf_callchain_user32(struct pt_regs *regs, struct perf_callchain_entry_ctx *ent fp =compat_ptr (ss_base + regs->bp);pagefault_disable (); + +/* see perf_callchain_user() below for why we do this */ +if (is_uprobe_at_func_entry (regs) && + !get_user (ret_addr, (const u32 __user *)regs->sp)) +perf_callchain_store (entry, ret_addr); +while (entry->nr < entry->max_stack) {if (!valid_user_frame (fp,sizeof (frame)))break ;
@@ -2864,6 +2913,7 @@ perf_callchain_user(struct perf_callchain_entry_ctx *entry, struct pt_regs *regs {struct stack_frame frame;const struct stack_frame __user *fp; +unsigned long ret_addr;if (perf_guest_state ()) {/* TODO: We don't support guest os callchain now */
@@ -2887,6 +2937,19 @@ perf_callchain_user(struct perf_callchain_entry_ctx *entry, struct pt_regs *regsreturn ;pagefault_disable (); + +/* +* If we are called from uprobe handler, and we are indeed at the very +* entry to user function (which is normally a `push %rbp` instruction, +* under assumption of application being compiled with frame pointers), +* we should read return address from *regs->sp before proceeding +* to follow frame pointers, otherwise we'll skip immediate caller +* as %rbp is not yet setup. +*/ +if (is_uprobe_at_func_entry (regs) && + !get_user (ret_addr, (const unsigned long __user *)regs->sp)) +perf_callchain_store (entry, ret_addr); +while (entry->nr < entry->max_stack) {if (!valid_user_frame (fp,sizeof (frame)))break ;
include/linux/uprobes.h +2 -0
@@ -76,6 +76,8 @@ struct uprobe_task {struct uprobe *active_uprobe;unsigned long xol_vaddr; +struct arch_uprobe *auprobe; +struct return_instance *return_instances;unsigned int depth; };
kernel/events/uprobes.c +2 -0
@@ -2081,6 +2081,7 @@ static void handler_chain(struct uprobe *uprobe, struct pt_regs *regs)bool need_prep = false;/* prepare return uprobe, when needed */ down_read (&uprobe->register_rwsem); + current->utask->auprobe = &uprobe->arch;for (uc = uprobe->consumers; uc; uc = uc->next) {int rc =0 ;
@@ -2095,6 +2096,7 @@ static void handler_chain(struct uprobe *uprobe, struct pt_regs *regs) remove &= rc; } + current->utask->auprobe =NULL ;if (need_prep && !remove)prepare_uretprobe (uprobe, regs);/* put bp at return */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 270/558 scsi: aacraid: Rearrange order of struct aac_srb_unit
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit 6e5860b0ad4934baee8c7a202c02033b2631bb44 ]
struct aac_srb_unit contains struct aac_srb, which contains struct sgmap, which ends in a (currently) "fake" (1-element) flexible array. Converting this to a flexible array is needed so that runtime bounds checking won't think the array is fixed size (i.e. under CONFIG_FORTIFY_SOURCE=y and/or CONFIG_UBSAN_BOUNDS=y), as other parts of aacraid use struct sgmap as a flexible array.
It is not legal to have a flexible array in the middle of a structure, so it either needs to be split up or rearranged so that it is at the end of the structure. Luckily, struct aac_srb_unit, which is exclusively consumed/updated by aac_send_safw_bmic_cmd(), does not depend on member ordering.
The values set in the on-stack struct aac_srb_unit instance "srbu" by the only two callers, aac_issue_safw_bmic_identify() and aac_get_safw_ciss_luns(), do not contain anything in srbu.srb.sgmap.sg, and they both implicitly initialize srbu.srb.sgmap.count to 0 during memset(). For example:
memset(&srbu, 0, sizeof(struct aac_srb_unit));
srbcmd = &srbu.srb;
srbcmd->flags = cpu_to_le32(SRB_DataIn);
srbcmd->cdb[0] = CISS_REPORT_PHYSICAL_LUNS;
srbcmd->cdb[1] = 2; /* extended reporting */
srbcmd->cdb[8] = (u8)(datasize >> 8);
srbcmd->cdb[9] = (u8)(datasize);
rcode = aac_send_safw_bmic_cmd(dev, &srbu, phys_luns, datasize);During aac_send_safw_bmic_cmd(), a separate srb is mapped into DMA, and has srbu.srb copied into it:
srb = fib_data(fibptr);
memcpy(srb, &srbu->srb, sizeof(struct aac_srb));Only then is srb.sgmap.count written and srb->sg populated:
srb->count = cpu_to_le32(xfer_len);
sg64 = (struct sgmap64 *)&srb->sg;
sg64->count = cpu_to_le32(1);
sg64->sg[0].addr[1] = cpu_to_le32(upper_32_bits(addr));
sg64->sg[0].addr[0] = cpu_to_le32(lower_32_bits(addr));
sg64->sg[0].count = cpu_to_le32(xfer_len);But this is happening in the DMA memory, not in srbu.srb. An attempt to copy the changes back to srbu does happen:
/*
* Copy the updated data for other dumping or other usage if
* needed
*/
memcpy(&srbu->srb, srb, sizeof(struct aac_srb));But this was never correct: the sg64 (3 u32s) overlap of srb.sg (2 u32s) always meant that srbu.srb would have held truncated information and any attempt to walk srbu.srb.sg.sg based on the value of srbu.srb.sg.count would result in attempting to parse past the end of srbu.srb.sg.sg[0] into srbu.srb_reply.
After getting a reply from hardware, the reply is copied into srbu.srb_reply:
srb_reply = (struct aac_srb_reply *)fib_data(fibptr);
memcpy(&srbu->srb_reply, srb_reply, sizeof(struct aac_srb_reply));This has always been fixed-size, so there's no issue here. It is worth noting that the two callers _never check_ srbu contents -- neither srbu.srb nor srbu.srb_reply is examined. (They depend on the mapped xfer_buf instead.)
Therefore, the ordering of members in struct aac_srb_unit does not matter, and the flexible array member can moved to the end.
(Additionally, the two memcpy()s that update srbu could be entirely removed as they are never consumed, but I left that as-is.)
--- drivers/scsi/aacraid/aacraid.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/aacraid/aacraid.h +1 -1
@@ -2029,8 +2029,8 @@ struct aac_srb_reply };struct aac_srb_unit { -struct aac_srb srb;struct aac_srb_reply srb_reply; +struct aac_srb srb; };/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 271/558 scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit 2be1d4f11944cd6283cb97268b3e17c4424945ca ]
When the HBA is undergoing a reset or is handling an errata event, NULL ptr dereference crashes may occur in routines such as lpfc_sli_flush_io_rings(), lpfc_dev_loss_tmo_callbk(), or lpfc_abort_handler().
Add NULL ptr checks before dereferencing hdwq pointers that may have been freed due to operations colliding with a reset or errata event handler.
--- drivers/scsi/lpfc/lpfc_hbadisc.c | 3 ++- drivers/scsi/lpfc/lpfc_scsi.c | 13 +++++++++++-- drivers/scsi/lpfc/lpfc_sli.c | 11 +++++++++++ 3 files changed, 24 insertions(+), 3 deletions(-)
drivers/scsi/lpfc/lpfc_hbadisc.c +2 -1
@@ -175,7 +175,8 @@ lpfc_dev_loss_tmo_callbk(struct fc_rport *rport) ndlp->nlp_state, ndlp->fc4_xpt_flags);/* Don't schedule a worker thread event if the vport is going down. */ -if (test_bit (FC_UNLOADING , &vport->load_flag)) { +if (test_bit (FC_UNLOADING , &vport->load_flag) || + !test_bit (HBA_SETUP , &phba->hba_flag)) {spin_lock_irqsave (&ndlp->lock, iflags); ndlp->rport =NULL ;
drivers/scsi/lpfc/lpfc_scsi.c +11 -2
@@ -5555,11 +5555,20 @@ lpfc_abort_handler(struct scsi_cmnd *cmnd) iocb = &lpfc_cmd->cur_iocbq;if (phba->sli_rev ==LPFC_SLI_REV4 ) { - pring_s4 = phba->sli4_hba.hdwq[iocb->hba_wqidx].io_wq->pring; -if (!pring_s4) { +/* if the io_wq & pring are gone, the port was reset. */ +if (!phba->sli4_hba.hdwq[iocb->hba_wqidx].io_wq || + !phba->sli4_hba.hdwq[iocb->hba_wqidx].io_wq->pring) { +lpfc_printf_vlog (vport,KERN_WARNING ,LOG_FCP , +"2877 SCSI Layer I/O Abort Request " +"IO CMPL Status x%x ID %d LUN %llu " +"HBA_SETUP %d\n" ,FAILED , + cmnd->device->id, + (u64 )cmnd->device->lun, +test_bit (HBA_SETUP , &phba->hba_flag)); ret =FAILED ; goto out_unlock_hba; } + pring_s4 = phba->sli4_hba.hdwq[iocb->hba_wqidx].io_wq->pring;spin_lock (&pring_s4->ring_lock); }/* the command is in process of being cancelled */
drivers/scsi/lpfc/lpfc_sli.c +11 -0
@@ -4687,6 +4687,17 @@ lpfc_sli_flush_io_rings(struct lpfc_hba *phba)/* Look on all the FCP Rings for the iotag */ if (phba->sli_rev >=LPFC_SLI_REV4 ) {for (i =0 ; i < phba->cfg_hdw_queue; i++) { +if (!phba->sli4_hba.hdwq || + !phba->sli4_hba.hdwq[i].io_wq) { +lpfc_printf_log (phba,KERN_ERR ,LOG_SLI , +"7777 hdwq's deleted %lx " +"%lx %x %x\n" , + phba->pport->load_flag, + phba->hba_flag, + phba->link_state, + phba->sli.sli_flag); +return ; + } pring = phba->sli4_hba.hdwq[i].io_wq->pring;spin_lock_irq (&pring->ring_lock);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 272/558 scsi: lpfc: Fix unsolicited FLOGI kref imbalance when in direct attached topology
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit b5c18c9dd138733c16893613345af44deadcf05e ]
In direct attached topology, certain target vendors that are quick to issue FLOGI followed by a cable pull for more than dev_loss_tmo may result in a kref imbalance for the remote port ndlp object.
Add an nlp_get when the defer_flogi_acc flag is set. This is expected to balance the nlp_put in the defer_flogi_acc clause in the lpfc_issue_els_flogi() routine. Because we need to retain the ndlp ptr, reorganize all of the defer_flogi_acc information into one lpfc_defer_flogi_acc struct.
--- drivers/scsi/lpfc/lpfc.h | 12 ++++++--- drivers/scsi/lpfc/lpfc_els.c | 46 +++++++++++++++++++------------- drivers/scsi/lpfc/lpfc_hbadisc.c | 11 ++++++-- 3 files changed, 46 insertions(+), 23 deletions(-)
drivers/scsi/lpfc/lpfc.h +9 -3
@@ -306,6 +306,14 @@ struct lpfc_stats {struct lpfc_hba ; +/* Data structure to keep withheld FLOGI_ACC information */ +struct lpfc_defer_flogi_acc { +bool flag; +u16 rx_id; +u16 ox_id; +struct lpfc_nodelist *ndlp; + +};#define LPFC_VMID_TIMER 300/* timer interval in seconds */
@@ -1430,9 +1438,7 @@ struct lpfc_hba {uint16_t vlan_id;struct list_head fcf_conn_rec_list; -bool defer_flogi_acc_flag; -uint16_t defer_flogi_acc_rx_id; -uint16_t defer_flogi_acc_ox_id; +struct lpfc_defer_flogi_acc defer_flogi_acc;spinlock_t ct_ev_lock;/* synchronize access to ct_ev_waiters */ struct list_head ct_ev_waiters;
drivers/scsi/lpfc/lpfc_els.c +28 -18
96 lines not on this page · raw message
drivers/scsi/lpfc/lpfc_hbadisc.c +9 -2
@@ -1255,7 +1255,14 @@ lpfc_linkdown(struct lpfc_hba *phba)lpfc_scsi_dev_block (phba); offline =pci_channel_offline (phba->pcidev); - phba->defer_flogi_acc_flag = false; +/* Decrement the held ndlp if there is a deferred flogi acc */ +if (phba->defer_flogi_acc.flag) { +if (phba->defer_flogi_acc.ndlp) { +lpfc_nlp_put (phba->defer_flogi_acc.ndlp); + phba->defer_flogi_acc.ndlp =NULL ; + } + } + phba->defer_flogi_acc.flag = false;/* Clear external loopback plug detected flag */ phba->link_flag &= ~LS_EXTERNAL_LOOPBACK ;
@@ -1377,7 +1384,7 @@ lpfc_linkup_port(struct lpfc_vport *vport) (vport != phba->pport))return ; -if (phba->defer_flogi_acc_flag) { +if (phba->defer_flogi_acc.flag) {clear_bit (FC_ABORT_DISCOVERY , &vport->fc_flag);clear_bit (FC_RSCN_MODE , &vport->fc_flag);clear_bit (FC_NLP_MORE , &vport->fc_flag);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 273/558 scsi: lpfc: Update PRLO handling in direct attached topology
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit 1f0f7679ad8942f810b0f19ee9cf098c3502d66a ]
A kref imbalance occurs when handling an unsolicited PRLO in direct attached topology.
Rework PRLO rcv handling when in MAPPED state. Save the state that we were handling a PRLO by setting nlp_last_elscmd to ELS_CMD_PRLO. Then in the lpfc_cmpl_els_logo_acc() completion routine, manually restart discovery. By issuing the PLOGI, which nlp_gets, before nlp_put at the end of the lpfc_cmpl_els_logo_acc() routine, we are saving us from a final nlp_put. And, we are still allowing the unreg_rpi to happen.
--- drivers/scsi/lpfc/lpfc_els.c | 27 ++++++++++++++++----------- drivers/scsi/lpfc/lpfc_nportdisc.c | 22 ++++++++++++++++++++-- 2 files changed, 36 insertions(+), 13 deletions(-)
drivers/scsi/lpfc/lpfc_els.c +16 -11
@@ -5244,9 +5244,10 @@ lpfc_cmpl_els_logo_acc(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,/* ACC to LOGO completes to NPort <nlp_DID> */ lpfc_printf_vlog (vport,KERN_INFO ,LOG_ELS ,"0109 ACC to LOGO completes to NPort x%x refcnt %d " -"Data: x%x x%x x%x\n" , - ndlp->nlp_DID,kref_read (&ndlp->kref), ndlp->nlp_flag, - ndlp->nlp_state, ndlp->nlp_rpi); +"last els x%x Data: x%x x%x x%x\n" , + ndlp->nlp_DID,kref_read (&ndlp->kref), + ndlp->nlp_last_elscmd, ndlp->nlp_flag, ndlp->nlp_state, + ndlp->nlp_rpi);/* This clause allows the LOGO ACC to complete and free resources * for the Fabric Domain Controller. It does deliberately skip
@@ -5258,18 +5259,22 @@ lpfc_cmpl_els_logo_acc(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, goto out;if (ndlp->nlp_state ==NLP_STE_NPR_NODE ) { -/* If PLOGI is being retried, PLOGI completion will cleanup the -* node. The NLP_NPR_2B_DISC flag needs to be retained to make -* progress on nodes discovered from last RSCN. -*/ -if ((ndlp->nlp_flag &NLP_DELAY_TMO ) && - (ndlp->nlp_last_elscmd ==ELS_CMD_PLOGI )) - goto out; -if (ndlp->nlp_flag &NLP_RPI_REGISTERED )lpfc_unreg_rpi (vport, ndlp); +/* If came from PRLO, then PRLO_ACC is done. +* Start rediscovery now. +*/ +if (ndlp->nlp_last_elscmd ==ELS_CMD_PRLO ) { +spin_lock_irq (&ndlp->lock); + ndlp->nlp_flag |=NLP_NPR_2B_DISC ; +spin_unlock_irq (&ndlp->lock); + ndlp->nlp_prev_state = ndlp->nlp_state; +lpfc_nlp_set_state (vport, ndlp,NLP_STE_PLOGI_ISSUE ); +lpfc_issue_els_plogi (vport, ndlp->nlp_DID,0 ); + } } + out:/* * The driver received a LOGO from the rport and has ACK'd it.
drivers/scsi/lpfc/lpfc_nportdisc.c +20 -2
@@ -2652,8 +2652,26 @@ lpfc_rcv_prlo_mapped_node(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,/* flush the target */ lpfc_sli_abort_iocb (vport, ndlp->nlp_sid,0 ,LPFC_CTX_TGT ); -/* Treat like rcv logo */ -lpfc_rcv_logo (vport, ndlp, cmdiocb,ELS_CMD_PRLO ); +/* Send PRLO_ACC */ +spin_lock_irq (&ndlp->lock); + ndlp->nlp_flag |=NLP_LOGO_ACC ; +spin_unlock_irq (&ndlp->lock); +lpfc_els_rsp_acc (vport,ELS_CMD_PRLO , cmdiocb, ndlp,NULL ); + +/* Save ELS_CMD_PRLO as the last elscmd and then set to NPR. +* lpfc_cmpl_els_logo_acc is expected to restart discovery. +*/ + ndlp->nlp_last_elscmd =ELS_CMD_PRLO ; + ndlp->nlp_prev_state = ndlp->nlp_state; + +lpfc_printf_vlog (vport,KERN_INFO ,LOG_NODE |LOG_ELS |LOG_DISCOVERY , +"3422 DID x%06x nflag x%x lastels x%x ref cnt %u\n" , + ndlp->nlp_DID, ndlp->nlp_flag, + ndlp->nlp_last_elscmd, +kref_read (&ndlp->kref)); + +lpfc_nlp_set_state (vport, ndlp,NLP_STE_NPR_NODE ); +return ndlp->nlp_state; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 274/558 drm/amd/display: Force enable 3DLUT DMA check for dcn401 in DML
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dillon Varone <[email protected]>
[ Upstream commit b8dc6ca028d9a39196a3a066b9ef2d4a5eca475d ]
[WHY]
Currently TR0 (trip 0) is not properly budgeting for urgent latency in DML2.1. This results in overly aggressive prefetch schedules that are vulnerable to request return jitter, resulting in severe underflow at the start of the frame.
[HOW]
Forcing 3DLUT DMA check to enable causes urgent latency to be budgeted properly into the prefetch schedule, avoiding the vulnerability.
--- .../amd/display/dc/dml2/dml21/dml21_translation_helper.c | 6 ++++-- drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.h | 1 + .../drm/amd/display/dc/resource/dcn401/dcn401_resource.c | 1 + 3 files changed, 6 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/dml2/dml21/dml21_translation_helper.c +4 -2
@@ -827,6 +827,7 @@ static void populate_dml21_plane_config_from_plane_state(struct dml2_context *dmif (plane_state->mcm_luts.lut3d_data.lut3d_src ==DC_CM2_TRANSFER_FUNC_SOURCE_VIDMEM ) { plane->tdlut.setup_for_tdlut = true; +switch (plane_state->mcm_luts.lut3d_data.gpu_mem_params.layout) {case DC_CM2_GPU_MEM_LAYOUT_3D_SWIZZLE_LINEAR_RGB :case DC_CM2_GPU_MEM_LAYOUT_3D_SWIZZLE_LINEAR_BGR :
@@ -836,6 +837,7 @@ static void populate_dml21_plane_config_from_plane_state(struct dml2_context *dm plane->tdlut.tdlut_addressing_mode = dml2_tdlut_simple_linear;break ; } +switch (plane_state->mcm_luts.lut3d_data.gpu_mem_params.size) {case DC_CM2_GPU_MEM_SIZE_171717 : plane->tdlut.tdlut_width_mode = dml2_tdlut_width_17_cube;
@@ -844,8 +846,8 @@ static void populate_dml21_plane_config_from_plane_state(struct dml2_context *dm//plane->tdlut.tdlut_width_mode = dml2_tdlut_width_flatten; // dml2_tdlut_width_flatten undefined break ; } - }else - plane->tdlut.setup_for_tdlut = false; + } + plane->tdlut.setup_for_tdlut |= dml_ctx->config.force_tdlut_enable; plane->dynamic_meta_data.enable = false; plane->dynamic_meta_data.lines_before_active_required =0 ;
drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.h +1 -0
@@ -236,6 +236,7 @@ struct dml2_configuration_options {bool use_clock_dc_limits;bool gpuvm_enable; +bool force_tdlut_enable;struct dml2_soc_bb *bb_from_dmub; };
drivers/gpu/drm/amd/display/dc/resource/dcn401/dcn401_resource.c +1 -0
@@ -2099,6 +2099,7 @@ static bool dcn401_resource_construct( dc->dml2_options.use_native_soc_bb_construction = true; dc->dml2_options.minimize_dispclk_using_odm = true; dc->dml2_options.map_dc_pipes_with_callbacks = true; + dc->dml2_options.force_tdlut_enable = true;resource_init_common_dml2_callbacks (dc, &dc->dml2_options); dc->dml2_options.callbacks.can_support_mclk_switch_using_fw_based_vblank_stretch = &dcn30_can_support_mclk_switch_using_fw_based_vblank_stretch;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 275/558 drm/amdgpu: fix unchecked return value warning for amdgpu_gfx
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Huang <[email protected]>
[ Upstream commit c0277b9d7c2ee9ee5dbc948548984f0fbb861301 ]
This resolves the unchecded return value warning reported by Coverity.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c +14 -4
@@ -882,8 +882,11 @@ int amdgpu_gfx_ras_late_init(struct amdgpu_device *adev, struct ras_common_if *rint r;if (amdgpu_ras_is_supported (adev, ras_block->block)) { -if (!amdgpu_persistent_edc_harvesting_supported (adev)) -amdgpu_ras_reset_error_status (adev,AMDGPU_RAS_BLOCK__GFX ); +if (!amdgpu_persistent_edc_harvesting_supported (adev)) { + r =amdgpu_ras_reset_error_status (adev,AMDGPU_RAS_BLOCK__GFX ); +if (r) +return r; + } r =amdgpu_ras_block_late_init (adev, ras_block);if (r)
@@ -1027,7 +1030,10 @@ uint32_t amdgpu_kiq_rreg(struct amdgpu_device *adev, uint32_t reg, uint32_t xcc_pr_err ("critical bug! too many kiq readers\n" ); goto failed_unlock; } -amdgpu_ring_alloc (ring,32 ); + r =amdgpu_ring_alloc (ring,32 ); +if (r) + goto failed_unlock; +amdgpu_ring_emit_rreg (ring, reg, reg_val_offs); r =amdgpu_fence_emit_polling (ring, &seq,MAX_KIQ_REG_WAIT );if (r)
@@ -1093,7 +1099,10 @@ void amdgpu_kiq_wreg(struct amdgpu_device *adev, uint32_t reg, uint32_t v, uint3 }spin_lock_irqsave (&kiq->ring_lock, flags); -amdgpu_ring_alloc (ring,32 ); + r =amdgpu_ring_alloc (ring,32 ); +if (r) + goto failed_unlock; +amdgpu_ring_emit_wreg (ring, reg, v); r =amdgpu_fence_emit_polling (ring, &seq,MAX_KIQ_REG_WAIT );if (r)
@@ -1129,6 +1138,7 @@ void amdgpu_kiq_wreg(struct amdgpu_device *adev, uint32_t reg, uint32_t v, uint3 failed_undo:amdgpu_ring_undo (ring); +failed_unlock:spin_unlock_irqrestore (&kiq->ring_lock, flags); failed_kiq_write:dev_err (adev->dev,"failed to write reg:%x\n" , reg);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 276/558 drm/amdgpu: fix unchecked return value warning for amdgpu_atombios
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Huang <[email protected]>
[ Upstream commit 92549780e32718d64a6d08bbbb3c6fffecb541c7 ]
This resolves the unchecded return value warning reported by Coverity.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | 35 ++++++++++++-------- 1 file changed, 21 insertions(+), 14 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c +21 -14
@@ -1018,8 +1018,9 @@ int amdgpu_atombios_get_clock_dividers(struct amdgpu_device *adev,if (clock_type ==COMPUTE_ENGINE_PLL_PARAM ) { args.v3.ulClockParams =cpu_to_le32 ((clock_type <<24 ) | clock); -amdgpu_atom_execute_table (adev->mode_info.atom_context, index, (uint32_t *)&args, -sizeof (args)); +if (amdgpu_atom_execute_table (adev->mode_info.atom_context, + index, (uint32_t *)&args,sizeof (args))) +return -EINVAL ; dividers->post_div = args.v3.ucPostDiv; dividers->enable_post_div = (args.v3.ucCntlFlag &
@@ -1039,8 +1040,9 @@ int amdgpu_atombios_get_clock_dividers(struct amdgpu_device *adev,if (strobe_mode) args.v5.ucInputFlag =ATOM_PLL_INPUT_FLAG_PLL_STROBE_MODE_EN ; -amdgpu_atom_execute_table (adev->mode_info.atom_context, index, (uint32_t *)&args, -sizeof (args)); +if (amdgpu_atom_execute_table (adev->mode_info.atom_context, + index, (uint32_t *)&args,sizeof (args))) +return -EINVAL ; dividers->post_div = args.v5.ucPostDiv; dividers->enable_post_div = (args.v5.ucCntlFlag &
@@ -1058,8 +1060,9 @@ int amdgpu_atombios_get_clock_dividers(struct amdgpu_device *adev,/* fusion */ args.v4.ulClock =cpu_to_le32 (clock);/* 10 khz */ -amdgpu_atom_execute_table (adev->mode_info.atom_context, index, (uint32_t *)&args, -sizeof (args)); +if (amdgpu_atom_execute_table (adev->mode_info.atom_context, + index, (uint32_t *)&args,sizeof (args))) +return -EINVAL ; dividers->post_divider = dividers->post_div = args.v4.ucPostDiv; dividers->real_clock =le32_to_cpu (args.v4.ulClock);
@@ -1070,8 +1073,9 @@ int amdgpu_atombios_get_clock_dividers(struct amdgpu_device *adev, args.v6_in.ulClock.ulComputeClockFlag = clock_type; args.v6_in.ulClock.ulClockFreq =cpu_to_le32 (clock);/* 10 khz */ -amdgpu_atom_execute_table (adev->mode_info.atom_context, index, (uint32_t *)&args, -sizeof (args)); +if (amdgpu_atom_execute_table (adev->mode_info.atom_context, + index, (uint32_t *)&args,sizeof (args))) +return -EINVAL ; dividers->whole_fb_div =le16_to_cpu (args.v6_out.ulFbDiv.usFbDiv); dividers->frac_fb_div =le16_to_cpu (args.v6_out.ulFbDiv.usFbDivFrac);
@@ -1113,8 +1117,9 @@ int amdgpu_atombios_get_memory_pll_dividers(struct amdgpu_device *adev,if (strobe_mode) args.ucInputFlag |=MPLL_INPUT_FLAG_STROBE_MODE_EN ; -amdgpu_atom_execute_table (adev->mode_info.atom_context, index, (uint32_t *)&args, -sizeof (args)); +if (amdgpu_atom_execute_table (adev->mode_info.atom_context, + index, (uint32_t *)&args,sizeof (args))) +return -EINVAL ; mpll_param->clkfrac =le16_to_cpu (args.ulFbDiv.usFbDivFrac); mpll_param->clkf =le16_to_cpu (args.ulFbDiv.usFbDiv);
@@ -1211,8 +1216,9 @@ int amdgpu_atombios_get_max_vddc(struct amdgpu_device *adev, u8 voltage_type, args.v2.ucVoltageMode =0 ; args.v2.usVoltageLevel =0 ; -amdgpu_atom_execute_table (adev->mode_info.atom_context, index, (uint32_t *)&args, -sizeof (args)); +if (amdgpu_atom_execute_table (adev->mode_info.atom_context, + index, (uint32_t *)&args,sizeof (args))) +return -EINVAL ; *voltage =le16_to_cpu (args.v2.usVoltageLevel);break ;
@@ -1221,8 +1227,9 @@ int amdgpu_atombios_get_max_vddc(struct amdgpu_device *adev, u8 voltage_type, args.v3.ucVoltageMode =ATOM_GET_VOLTAGE_LEVEL ; args.v3.usVoltageLevel =cpu_to_le16 (voltage_id); -amdgpu_atom_execute_table (adev->mode_info.atom_context, index, (uint32_t *)&args, -sizeof (args)); +if (amdgpu_atom_execute_table (adev->mode_info.atom_context, + index, (uint32_t *)&args,sizeof (args))) +return -EINVAL ; *voltage =le16_to_cpu (args.v3.usVoltageLevel);break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 277/558 perf: Fix event_function_call() locking
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
[ Upstream commit 558abc7e3f895049faa46b08656be4c60dc6e9fd ]
All the event_function/@func call context already uses perf_ctx_lock() except for the !ctx->is_active case. Make it all consistent.
--- kernel/events/core.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
kernel/events/core.c +5 -4
@@ -263,6 +263,7 @@ static int event_function(void *info)static void event_function_call (struct perf_event *event,event_f func,void *data) {struct perf_event_context *ctx = event->ctx; +struct perf_cpu_context *cpuctx =this_cpu_ptr (&perf_cpu_context);struct task_struct *task =READ_ONCE (ctx->task);/* verified in event_function */ struct event_function_struct efs = { .event = event,
@@ -291,22 +292,22 @@ static void event_function_call(struct perf_event *event, event_f func, void *daif (!task_function_call (task, event_function, &efs))return ; -raw_spin_lock_irq (&ctx->lock); +perf_ctx_lock (cpuctx, ctx);/* * Reload the task pointer, it might have been changed by * a concurrent perf_event_context_sched_out(). */ task = ctx->task;if (task ==TASK_TOMBSTONE ) { -raw_spin_unlock_irq (&ctx->lock); +perf_ctx_unlock (cpuctx, ctx);return ; }if (ctx->is_active) { -raw_spin_unlock_irq (&ctx->lock); +perf_ctx_unlock (cpuctx, ctx); goto again; }func (event,NULL , ctx, data); -raw_spin_unlock_irq (&ctx->lock); +perf_ctx_unlock (cpuctx, ctx); }/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 278/558 scsi: NCR5380: Initialize buffer for MSG IN and STATUS transfers
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Finn Thain <[email protected]>
[ Upstream commit 1c71065df2df693d208dd32758171c1dece66341 ]
Following an incomplete transfer in MSG IN phase, the driver would not notice the problem and would make use of invalid data. Initialize 'tmp' appropriately and bail out if no message was received. For STATUS phase, preserve the existing status code unless a new value was transferred.
--- drivers/scsi/NCR5380.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/scsi/NCR5380.c +4 -0
@@ -1807,8 +1807,11 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance)return ;case PHASE_MSGIN : len =1 ; + tmp =0xff ; data = &tmp;NCR5380_transfer_pio (instance, &phase, &len, &data,0 ); +if (tmp ==0xff ) +break ; ncmd->message = tmp;switch (tmp) {
@@ -1996,6 +1999,7 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance)break ;case PHASE_STATIN : len =1 ; + tmp = ncmd->status; data = &tmp;NCR5380_transfer_pio (instance, &phase, &len, &data,0 ); ncmd->status = tmp;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 279/558 drm/radeon/r100: Handle unknown family in r100_cp_init_microcode()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit c6dbab46324b1742b50dc2fb5c1fee2c28129439 ]
With -Werror:
In function ‘r100_cp_init_microcode’,
inlined from ‘r100_cp_init’ at drivers/gpu/drm/radeon/r100.c:1136:7:
include/linux/printk.h:465:44: error: ‘%s’ directive argument is null [-Werror=format-overflow=]
465 | #define printk(fmt, ...) printk_index_wrap(_printk, fmt, ##__VA_ARGS__)
| ^
include/linux/printk.h:437:17: note: in definition of macro ‘printk_index_wrap’
437 | _p_func(_fmt, ##__VA_ARGS__); \
| ^~~~~~~
include/linux/printk.h:508:9: note: in expansion of macro ‘printk’
508 | printk(KERN_ERR pr_fmt(fmt), ##__VA_ARGS__)
| ^~~~~~
drivers/gpu/drm/radeon/r100.c:1062:17: note: in expansion of macro ‘pr_err’
1062 | pr_err("radeon_cp: Failed to load firmware \"%s\"\n", fw_name);
| ^~~~~~Fix this by converting the if/else if/... construct into a proper switch() statement with a default to handle the error case.
As a bonus, the generated code is ca. 100 bytes smaller (with gcc 11.4.0 targeting arm32).
--- drivers/gpu/drm/radeon/r100.c | 70 ++++++++++++++++++++++------------- 1 file changed, 45 insertions(+), 25 deletions(-)
drivers/gpu/drm/radeon/r100.c +45 -25
@@ -1016,45 +1016,65 @@ static int r100_cp_init_microcode(struct radeon_device *rdev)DRM_DEBUG_KMS ("\n" ); -if ((rdev->family ==CHIP_R100 ) || (rdev->family ==CHIP_RV100 ) || - (rdev->family ==CHIP_RV200 ) || (rdev->family ==CHIP_RS100 ) || - (rdev->family ==CHIP_RS200 )) { +switch (rdev->family) { +case CHIP_R100 : +case CHIP_RV100 : +case CHIP_RV200 : +case CHIP_RS100 : +case CHIP_RS200 :DRM_INFO ("Loading R100 Microcode\n" ); fw_name =FIRMWARE_R100 ; - }else if ((rdev->family ==CHIP_R200 ) || - (rdev->family ==CHIP_RV250 ) || - (rdev->family ==CHIP_RV280 ) || - (rdev->family ==CHIP_RS300 )) { +break ; + +case CHIP_R200 : +case CHIP_RV250 : +case CHIP_RV280 : +case CHIP_RS300 :DRM_INFO ("Loading R200 Microcode\n" ); fw_name =FIRMWARE_R200 ; - }else if ((rdev->family ==CHIP_R300 ) || - (rdev->family ==CHIP_R350 ) || - (rdev->family ==CHIP_RV350 ) || - (rdev->family ==CHIP_RV380 ) || - (rdev->family ==CHIP_RS400 ) || - (rdev->family ==CHIP_RS480 )) { +break ; + +case CHIP_R300 : +case CHIP_R350 : +case CHIP_RV350 : +case CHIP_RV380 : +case CHIP_RS400 : +case CHIP_RS480 :DRM_INFO ("Loading R300 Microcode\n" ); fw_name =FIRMWARE_R300 ; - }else if ((rdev->family ==CHIP_R420 ) || - (rdev->family ==CHIP_R423 ) || - (rdev->family ==CHIP_RV410 )) { +break ; + +case CHIP_R420 : +case CHIP_R423 : +case CHIP_RV410 :DRM_INFO ("Loading R400 Microcode\n" ); fw_name =FIRMWARE_R420 ; - }else if ((rdev->family ==CHIP_RS690 ) || - (rdev->family ==CHIP_RS740 )) { +break ; + +case CHIP_RS690 : +case CHIP_RS740 :DRM_INFO ("Loading RS690/RS740 Microcode\n" ); fw_name =FIRMWARE_RS690 ; - }else if (rdev->family ==CHIP_RS600 ) { +break ; + +case CHIP_RS600 :DRM_INFO ("Loading RS600 Microcode\n" ); fw_name =FIRMWARE_RS600 ; - }else if ((rdev->family ==CHIP_RV515 ) || - (rdev->family ==CHIP_R520 ) || - (rdev->family ==CHIP_RV530 ) || - (rdev->family ==CHIP_R580 ) || - (rdev->family ==CHIP_RV560 ) || - (rdev->family ==CHIP_RV570 )) { +break ; + +case CHIP_RV515 : +case CHIP_R520 : +case CHIP_RV530 : +case CHIP_R580 : +case CHIP_RV560 : +case CHIP_RV570 :DRM_INFO ("Loading R500 Microcode\n" ); fw_name =FIRMWARE_R520 ; +break ; + +default : +DRM_ERROR ("Unsupported Radeon family %u\n" , rdev->family); +return -EINVAL ; } err =request_firmware (&rdev->me_fw, fw_name, rdev->dev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 280/558 drm/amd/display: Unlock Pipes Based On DET Allocation
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Austin Zheng <[email protected]>
[ Upstream commit 4af0d8ebf74ccbb60d33fdd410891283dd6cb109 ]
[Why]
DML21 does not allocate DET evenly between pipes. May result in underflow when unlocking the pipes as DET could be overallocated.
[How]
1. Unlock pipes that have a decreased amount of DET allocation
2. Wait for the double buffer to be updated.
3. Unlock the remaining pipes.
--- .../gpu/drm/amd/display/dc/core/dc_resource.c | 28 ++++++ .../display/dc/hubbub/dcn401/dcn401_hubbub.c | 23 +++++ .../amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 91 +++++++++++++++++++ .../amd/display/dc/hwss/dcn401/dcn401_hwseq.h | 2 + .../amd/display/dc/hwss/dcn401/dcn401_init.c | 2 +- .../gpu/drm/amd/display/dc/inc/hw/dchubbub.h | 1 + drivers/gpu/drm/amd/display/dc/inc/resource.h | 5 + 7 files changed, 151 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/core/dc_resource.c +28 -0
@@ -5275,3 +5275,31 @@ void resource_init_common_dml2_callbacks(struct dc *dc, struct dml2_configuratio dml2_options->svp_pstate.callbacks.remove_phantom_streams_and_planes = &dc_state_remove_phantom_streams_and_planes; dml2_options->svp_pstate.callbacks.release_phantom_streams_and_planes = &dc_state_release_phantom_streams_and_planes; } + +/* Returns number of DET segments allocated for a given OTG_MASTER pipe */ +int resource_calculate_det_for_stream (struct dc_state *state,struct pipe_ctx *otg_master) +{ +struct pipe_ctx *opp_heads[MAX_PIPES ]; +struct pipe_ctx *dpp_pipes[MAX_PIPES ]; + +int dpp_count =0 ; +int det_segments =0 ; + +if (!otg_master->stream) +return 0 ; + +int slice_count =resource_get_opp_heads_for_otg_master (otg_master, + &state->res_ctx, opp_heads); + +for (int slice_idx =0 ; slice_idx < slice_count; slice_idx++) { +if (opp_heads[slice_idx]->plane_state) { + dpp_count =resource_get_dpp_pipes_for_opp_head ( + opp_heads[slice_idx], + &state->res_ctx, + dpp_pipes); +for (int dpp_idx =0 ; dpp_idx < dpp_count; dpp_idx++) + det_segments += dpp_pipes[dpp_idx]->hubp_regs.det_size; + } + } +return det_segments; +}
drivers/gpu/drm/amd/display/dc/hubbub/dcn401/dcn401_hubbub.c +23 -0
@@ -1170,6 +1170,28 @@ static void dcn401_program_compbuf_segments(struct hubbub *hubbub, unsigned comp } } +static void dcn401_wait_for_det_update (struct hubbub *hubbub,int hubp_inst) +{ +struct dcn20_hubbub *hubbub2 =TO_DCN20_HUBBUB (hubbub); + +switch (hubp_inst) { +case 0 : +REG_WAIT (DCHUBBUB_DET0_CTRL ,DET0_SIZE_CURRENT , hubbub2->det0_size,1 ,100000 );/* 1 vupdate at 10hz */ +break ; +case 1 : +REG_WAIT (DCHUBBUB_DET1_CTRL ,DET1_SIZE_CURRENT , hubbub2->det1_size,1 ,100000 ); +break ; +case 2 : +REG_WAIT (DCHUBBUB_DET2_CTRL ,DET2_SIZE_CURRENT , hubbub2->det2_size,1 ,100000 ); +break ; +case 3 : +REG_WAIT (DCHUBBUB_DET3_CTRL ,DET3_SIZE_CURRENT , hubbub2->det3_size,1 ,100000 ); +break ; +default : +break ; + } +} +static const struct hubbub_funcs hubbub4_01_funcs = { .update_dchub = hubbub2_update_dchub, .init_dchub_sys_ctx = hubbub3_init_dchub_sys_ctx,
@@ -1192,6 +1214,7 @@ static const struct hubbub_funcs hubbub4_01_funcs = { .set_request_limit = hubbub32_set_request_limit, .program_det_segments = dcn401_program_det_segments, .program_compbuf_segments = dcn401_program_compbuf_segments, + .wait_for_det_update = dcn401_wait_for_det_update, }; void hubbub401_construct(struct dcn20_hubbub *hubbub2,
drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c +91 -0
94 lines not on this page · raw message
drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.h +2 -0
@@ -81,4 +81,6 @@ void dcn401_hardware_release(struct dc *dc);void dcn401_update_odm (struct dc *dc,struct dc_state *context,struct pipe_ctx *otg_master);void adjust_hotspot_between_slices_for_2x_magnify (uint32_t cursor_width,struct dc_cursor_position *pos_cpy); +void dcn401_wait_for_det_buffer_update (struct dc *dc,struct dc_state *context,struct pipe_ctx *otg_master); +void dcn401_interdependent_update_lock (struct dc *dc,struct dc_state *context,bool lock);#endif /* __DC_HWSS_DCN401_H__ */
drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_init.c +1 -1
@@ -38,7 +38,7 @@ static const struct hw_sequencer_funcs dcn401_funcs = { .disable_audio_stream = dce110_disable_audio_stream, .disable_plane = dcn20_disable_plane, .pipe_control_lock = dcn20_pipe_control_lock, - .interdependent_update_lock = dcn32_interdependent_update_lock, + .interdependent_update_lock = dcn401_interdependent_update_lock, .cursor_lock = dcn10_cursor_lock, .prepare_bandwidth = dcn401_prepare_bandwidth, .optimize_bandwidth = dcn401_optimize_bandwidth,
drivers/gpu/drm/amd/display/dc/inc/hw/dchubbub.h +1 -0
@@ -227,6 +227,7 @@ struct hubbub_funcs {void (*get_mall_en)(struct hubbub *hubbub,unsigned int *mall_in_use);void (*program_det_segments)(struct hubbub *hubbub,int hubp_inst,unsigned det_buffer_size_seg);void (*program_compbuf_segments)(struct hubbub *hubbub,unsigned compbuf_size_seg,bool safe_to_increase); +void (*wait_for_det_update)(struct hubbub *hubbub,int hubp_inst); };struct hubbub {
drivers/gpu/drm/amd/display/dc/inc/resource.h +5 -0
@@ -639,4 +639,9 @@ struct dscl_prog_data *resource_get_dscl_prog_data(struct pipe_ctx *pipe_ctx);* @dml2_options: struct to hold callbacks */ void resource_init_common_dml2_callbacks (struct dc *dc,struct dml2_configuration_options *dml2_options); + +/* +*Calculate total DET allocated for all pipes for a given OTG_MASTER pipe +*/ +int resource_calculate_det_for_stream (struct dc_state *state,struct pipe_ctx *otg_master);#endif /* DRIVERS_GPU_DRM_AMD_DC_DEV_DC_INC_RESOURCE_H_ */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 281/558 drm/amdgpu: fix ptr check warning in gfx9 ip_dump
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sunil Khatri <[email protected]>
[ Upstream commit 07f4f9c00ec545dfa6251a44a09d2c48a76e7ee5 ]
Change if (ptr == NULL) to if (!ptr) for a better format and fix the warning.
--- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +2 -2
@@ -2133,7 +2133,7 @@ static void gfx_v9_0_alloc_ip_dump(struct amdgpu_device *adev)uint32_t inst; ptr =kcalloc (reg_count,sizeof (uint32_t ),GFP_KERNEL ); -if (ptr ==NULL ) { +if (!ptr) {DRM_ERROR ("Failed to allocate memory for GFX IP Dump\n" ); adev->gfx.ip_dump_core =NULL ; }else {
@@ -2146,7 +2146,7 @@ static void gfx_v9_0_alloc_ip_dump(struct amdgpu_device *adev) adev->gfx.mec.num_queue_per_pipe; ptr =kcalloc (reg_count * inst,sizeof (uint32_t ),GFP_KERNEL ); -if (ptr ==NULL ) { +if (!ptr) {DRM_ERROR ("Failed to allocate memory for Compute Queues IP Dump\n" ); adev->gfx.ip_dump_compute_queues =NULL ; }else {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 282/558 drm/amdgpu: fix ptr check warning in gfx10 ip_dump
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sunil Khatri <[email protected]>
[ Upstream commit 98df5a7732e3b78bf8824d2938a8865a45cfc113 ]
Change condition, if (ptr == NULL) to if (!ptr) for a better format and fix the warning.
--- drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +3 -3
@@ -4649,7 +4649,7 @@ static void gfx_v10_0_alloc_ip_dump(struct amdgpu_device *adev)uint32_t inst; ptr =kcalloc (reg_count,sizeof (uint32_t ),GFP_KERNEL ); -if (ptr ==NULL ) { +if (!ptr) {DRM_ERROR ("Failed to allocate memory for GFX IP Dump\n" ); adev->gfx.ip_dump_core =NULL ; }else {
@@ -4662,7 +4662,7 @@ static void gfx_v10_0_alloc_ip_dump(struct amdgpu_device *adev) adev->gfx.mec.num_queue_per_pipe; ptr =kcalloc (reg_count * inst,sizeof (uint32_t ),GFP_KERNEL ); -if (ptr ==NULL ) { +if (!ptr) {DRM_ERROR ("Failed to allocate memory for Compute Queues IP Dump\n" ); adev->gfx.ip_dump_compute_queues =NULL ; }else {
@@ -4675,7 +4675,7 @@ static void gfx_v10_0_alloc_ip_dump(struct amdgpu_device *adev) adev->gfx.me.num_queue_per_pipe; ptr =kcalloc (reg_count * inst,sizeof (uint32_t ),GFP_KERNEL ); -if (ptr ==NULL ) { +if (!ptr) {DRM_ERROR ("Failed to allocate memory for GFX Queues IP Dump\n" ); adev->gfx.ip_dump_gfx_queues =NULL ; }else {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 283/558 drm/amdgpu: fix ptr check warning in gfx11 ip_dump
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sunil Khatri <[email protected]>
[ Upstream commit bd15f805cdc503ac229a14f5fe21db12e6e7f84a ]
Change condition, if (ptr == NULL) to if (!ptr) for a better format and fix the warning.
--- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c +3 -3
@@ -1484,7 +1484,7 @@ static void gfx_v11_0_alloc_ip_dump(struct amdgpu_device *adev)uint32_t inst; ptr =kcalloc (reg_count,sizeof (uint32_t ),GFP_KERNEL ); -if (ptr ==NULL ) { +if (!ptr) {DRM_ERROR ("Failed to allocate memory for GFX IP Dump\n" ); adev->gfx.ip_dump_core =NULL ; }else {
@@ -1497,7 +1497,7 @@ static void gfx_v11_0_alloc_ip_dump(struct amdgpu_device *adev) adev->gfx.mec.num_queue_per_pipe; ptr =kcalloc (reg_count * inst,sizeof (uint32_t ),GFP_KERNEL ); -if (ptr ==NULL ) { +if (!ptr) {DRM_ERROR ("Failed to allocate memory for Compute Queues IP Dump\n" ); adev->gfx.ip_dump_compute_queues =NULL ; }else {
@@ -1510,7 +1510,7 @@ static void gfx_v11_0_alloc_ip_dump(struct amdgpu_device *adev) adev->gfx.me.num_queue_per_pipe; ptr =kcalloc (reg_count * inst,sizeof (uint32_t ),GFP_KERNEL ); -if (ptr ==NULL ) { +if (!ptr) {DRM_ERROR ("Failed to allocate memory for GFX Queues IP Dump\n" ); adev->gfx.ip_dump_gfx_queues =NULL ; }else {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 284/558 drm/amdgpu: Block MMR_READ IOCTL in reset
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Victor Skvortsov <[email protected]>
[ Upstream commit 9e823f307074c0f82b5f6044943b0086e3079bed ]
Register access from userspace should be blocked until reset is complete.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 43 ++++++++++++++++++------- 1 file changed, 31 insertions(+), 12 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +31 -12
@@ -43,6 +43,7 @@#include "amdgpu_gem.h" #include "amdgpu_display.h" #include "amdgpu_ras.h" +#include "amdgpu_reset.h" #include "amd_pcie.h" void amdgpu_unregister_gpu_instance (struct amdgpu_device *adev)
@@ -778,6 +779,7 @@ int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp) ? -EFAULT :0 ; }case AMDGPU_INFO_READ_MMR_REG : { +int ret =0 ;unsigned int n, alloc_size;uint32_t *regs; unsigned int se_num = (info->read_mmr_reg.instance >>
@@ -787,24 +789,37 @@ int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp) AMDGPU_INFO_MMR_SH_INDEX_SHIFT) &AMDGPU_INFO_MMR_SH_INDEX_MASK ; +if (!down_read_trylock (&adev->reset_domain->sem)) +return -ENOENT ; +/* set full masks if the userspace set all bits * in the bitfields */ -if (se_num ==AMDGPU_INFO_MMR_SE_INDEX_MASK ) +if (se_num ==AMDGPU_INFO_MMR_SE_INDEX_MASK ) { se_num =0xffffffff ; -else if (se_num >=AMDGPU_GFX_MAX_SE ) -return -EINVAL ; -if (sh_num ==AMDGPU_INFO_MMR_SH_INDEX_MASK ) + }else if (se_num >=AMDGPU_GFX_MAX_SE ) { + ret = -EINVAL ; + goto out; + } + +if (sh_num ==AMDGPU_INFO_MMR_SH_INDEX_MASK ) { sh_num =0xffffffff ; -else if (sh_num >=AMDGPU_GFX_MAX_SH_PER_SE ) -return -EINVAL ; + }else if (sh_num >=AMDGPU_GFX_MAX_SH_PER_SE ) { + ret = -EINVAL ; + goto out; + } -if (info->read_mmr_reg.count >128 ) -return -EINVAL ; +if (info->read_mmr_reg.count >128 ) { + ret = -EINVAL ; + goto out; + } regs =kmalloc_array (info->read_mmr_reg.count,sizeof (*regs),GFP_KERNEL ); -if (!regs) -return -ENOMEM ; +if (!regs) { + ret = -ENOMEM ; + goto out; + } + alloc_size = info->read_mmr_reg.count *sizeof (*regs);amdgpu_gfx_off_ctrl (adev, false);
@@ -816,13 +831,17 @@ int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp) info->read_mmr_reg.dword_offset + i);kfree (regs);amdgpu_gfx_off_ctrl (adev, true); -return -EFAULT ; + ret = -EFAULT ; + goto out; } }amdgpu_gfx_off_ctrl (adev, true); n =copy_to_user (out, regs,min (size, alloc_size));kfree (regs); -return n ? -EFAULT :0 ; + ret = (n ? -EFAULT :0 ); +out: +up_read (&adev->reset_domain->sem); +return ret; }case AMDGPU_INFO_DEV_INFO : {struct drm_amdgpu_info_device *dev_info;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 285/558 drm/amdgpu/gfx9: use rlc safe mode for soft recovery
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit 3ec2ad7c34c412bd9264cd1ff235d0812be90e82 ]
Protect the MMIO access with safe mode.
--- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +2 -0
@@ -5862,7 +5862,9 @@ static void gfx_v9_0_ring_soft_recovery(struct amdgpu_ring *ring, unsigned vmid) value =REG_SET_FIELD (value,SQ_CMD ,MODE ,0x01 ); value =REG_SET_FIELD (value,SQ_CMD ,CHECK_VMID ,1 ); value =REG_SET_FIELD (value,SQ_CMD ,VM_ID , vmid); +amdgpu_gfx_rlc_enter_safe_mode (adev,0 );WREG32_SOC15 (GC ,0 , mmSQ_CMD, value); +amdgpu_gfx_rlc_exit_safe_mode (adev,0 ); } static void gfx_v9_0_set_gfx_eop_interrupt_state(struct amdgpu_device *adev,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 286/558 drm/amdgpu/gfx11: enter safe mode before touching CP_INT_CNTL
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit b5be054c585110b2c5c1b180136800e8c41c7bb4 ]
Need to enter safe mode before touching GC MMIO.
--- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c +2 -2
@@ -4707,6 +4707,8 @@ static int gfx_v11_0_soft_reset(void *handle)int r, i, j, k;struct amdgpu_device *adev = (struct amdgpu_device *)handle; +gfx_v11_0_set_safe_mode (adev,0 ); + tmp =RREG32_SOC15 (GC ,0 , regCP_INT_CNTL); tmp =REG_SET_FIELD (tmp,CP_INT_CNTL ,CMP_BUSY_INT_ENABLE ,0 ); tmp =REG_SET_FIELD (tmp,CP_INT_CNTL ,CNTX_BUSY_INT_ENABLE ,0 );
@@ -4714,8 +4716,6 @@ static int gfx_v11_0_soft_reset(void *handle) tmp =REG_SET_FIELD (tmp,CP_INT_CNTL ,GFX_IDLE_INT_ENABLE ,0 );WREG32_SOC15 (GC ,0 , regCP_INT_CNTL, tmp); -gfx_v11_0_set_safe_mode (adev,0 ); -mutex_lock (&adev->srbm_mutex);for (i =0 ; i < adev->gfx.mec.num_mec; ++i) {for (j =0 ; j < adev->gfx.mec.num_queue_per_pipe; j++) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 287/558 drm/xe: Use topology to determine page fault queue size
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stuart Summers <[email protected]>
[ Upstream commit 3338e4f90c143cf32f77d64f464cb7f2c2d24700 ]
Currently the page fault queue size is hard coded. However the hardware supports faulting for each EU and each CS. For some applications running on hardware with a large number of EUs and CSs, this can result in an overflow of the page fault queue.
Add a small calculation to determine the page fault queue size based on the number of EUs and CSs in the platform as detmined by fuses.
--- drivers/gpu/drm/xe/xe_gt_pagefault.c | 54 +++++++++++++++++++++------- drivers/gpu/drm/xe/xe_gt_types.h | 9 +++-- 2 files changed, 49 insertions(+), 14 deletions(-)
drivers/gpu/drm/xe/xe_gt_pagefault.c +42 -12
@@ -287,7 +287,7 @@ static bool get_pagefault(struct pf_queue *pf_queue, struct pagefault *pf)PFD_VIRTUAL_ADDR_LO_SHIFT ; pf_queue->tail = (pf_queue->tail +PF_MSG_LEN_DW ) % -PF_QUEUE_NUM_DW ; + pf_queue->num_dw; ret = true; }spin_unlock_irq (&pf_queue->lock);
@@ -299,7 +299,8 @@ static bool pf_queue_full(struct pf_queue *pf_queue) {lockdep_assert_held (&pf_queue->lock); -return CIRC_SPACE (pf_queue->head, pf_queue->tail,PF_QUEUE_NUM_DW ) <= +return CIRC_SPACE (pf_queue->head, pf_queue->tail, + pf_queue->num_dw) <=PF_MSG_LEN_DW ; }
@@ -312,22 +313,23 @@ int xe_guc_pagefault_handler(struct xe_guc *guc, u32 *msg, u32 len)u32 asid;bool full; -/* -* The below logic doesn't work unless PF_QUEUE_NUM_DW % PF_MSG_LEN_DW == 0 -*/ -BUILD_BUG_ON (PF_QUEUE_NUM_DW %PF_MSG_LEN_DW ); -if (unlikely (len !=PF_MSG_LEN_DW ))return -EPROTO ; asid =FIELD_GET (PFD_ASID , msg[1 ]); pf_queue = gt->usm.pf_queue + (asid %NUM_PF_QUEUE ); +/* +* The below logic doesn't work unless PF_QUEUE_NUM_DW % PF_MSG_LEN_DW == 0 +*/ +xe_gt_assert (gt, !(pf_queue->num_dw %PF_MSG_LEN_DW )); +spin_lock_irqsave (&pf_queue->lock, flags); full =pf_queue_full (pf_queue);if (!full) {memcpy (pf_queue->data + pf_queue->head, msg, len *sizeof (u32)); - pf_queue->head = (pf_queue->head + len) %PF_QUEUE_NUM_DW ; + pf_queue->head = (pf_queue->head + len) % + pf_queue->num_dw;queue_work (gt->usm.pf_wq, &pf_queue->worker); }else {drm_warn (&xe->drm,"PF Queue full, shouldn't be possible" );
@@ -386,26 +388,54 @@ static void pagefault_fini(void *arg) {struct xe_gt *gt = arg;struct xe_device *xe =gt_to_xe (gt); +int i;if (!xe->info.has_usm)return ;destroy_workqueue (gt->usm.acc_wq);destroy_workqueue (gt->usm.pf_wq); + +for (i =0 ; i <NUM_PF_QUEUE ; ++i) +kfree (gt->usm.pf_queue[i].data); +} + +static int xe_alloc_pf_queue (struct xe_gt *gt,struct pf_queue *pf_queue) +{ +xe_dss_mask_t all_dss; +int num_dss, num_eus; + +bitmap_or (all_dss, gt->fuse_topo.g_dss_mask, gt->fuse_topo.c_dss_mask, +XE_MAX_DSS_FUSE_BITS ); + + num_dss =bitmap_weight (all_dss,XE_MAX_DSS_FUSE_BITS ); + num_eus =bitmap_weight (gt->fuse_topo.eu_mask_per_dss, +XE_MAX_EU_FUSE_BITS ) * num_dss; + +/* user can issue separate page faults per EU and per CS */ + pf_queue->num_dw = + (num_eus +XE_NUM_HW_ENGINES ) *PF_MSG_LEN_DW ; + + pf_queue->gt = gt; + pf_queue->data =kzalloc (pf_queue->num_dw,GFP_KERNEL ); +spin_lock_init (&pf_queue->lock); +INIT_WORK (&pf_queue->worker, pf_queue_work_func); + +return 0 ; }int xe_gt_pagefault_init (struct xe_gt *gt) {struct xe_device *xe =gt_to_xe (gt); -int i; +int i, ret =0 ;if (!xe->info.has_usm)return 0 ;for (i =0 ; i <NUM_PF_QUEUE ; ++i) { - gt->usm.pf_queue[i].gt = gt; -spin_lock_init (>->usm.pf_queue[i].lock); -INIT_WORK (>->usm.pf_queue[i].worker, pf_queue_work_func); + ret =xe_alloc_pf_queue (gt, >->usm.pf_queue[i]); +if (ret) +return ret; }for (i =0 ; i <NUM_ACC_QUEUE ; ++i) { gt->usm.acc_queue[i].gt = gt;
drivers/gpu/drm/xe/xe_gt_types.h +7 -2
@@ -233,9 +233,14 @@ struct xe_gt {struct pf_queue {/** @usm.pf_queue.gt: back pointer to GT */ struct xe_gt *gt; -#define PF_QUEUE_NUM_DW 128/** @usm.pf_queue.data: data in the page fault queue */ -u32 data[PF_QUEUE_NUM_DW ]; +u32 *data; +/** +* @usm.pf_queue.num_dw: number of DWORDS in the page +* fault queue. Dynamically calculated based on the number +* of compute resources available. +*/ +u32 num_dw;/** * @usm.pf_queue.tail: tail pointer in DWs for page fault queue, * moved by worker which processes faults (consumer).
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 288/558 drm/amd/pm: ensure the fw_info is not null before using it
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Huang <[email protected]>
[ Upstream commit 186fb12e7a7b038c2710ceb2fb74068f1b5d55a4 ]
This resolves the dereference null return value warning reported by Coverity.
--- drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c +2 -0
@@ -1183,6 +1183,8 @@ static int init_overdrive_limits(struct pp_hwmgr *hwmgr, fw_info =smu_atom_get_data_table (hwmgr->adev,GetIndexIntoMasterTable (DATA , FirmwareInfo), &size, &frev, &crev); +PP_ASSERT_WITH_CODE (fw_info !=NULL , +"Missing firmware info!" , return -EINVAL );if ((fw_info->ucTableFormatRevision ==1 ) && (le16_to_cpu (fw_info->usStructureSize) >=sizeof (ATOM_FIRMWARE_INFO_V1_4 )))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 289/558 drm/amdkfd: Check int source id for utcl2 poison event
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hawking Zhang <[email protected]>
[ Upstream commit db6341a9168d2a24ded526277eeab29724d76e9d ]
Traditional utcl2 fault_status polling does not work in SRIOV environment. The polling of fault status register from guest side will be dropped by hardware.
Driver should switch to check utcl2 interrupt source id to identify utcl2 poison event. It is set to 1 when poisoned data interrupts are signaled.
v2: drop the unused local variable (Tao)
--- .../gpu/drm/amd/amdkfd/kfd_int_process_v9.c | 18 +----------------- drivers/gpu/drm/amd/amdkfd/soc15_int.h | 1 + 2 files changed, 2 insertions(+), 17 deletions(-)
drivers/gpu/drm/amd/amdkfd/kfd_int_process_v9.c +1 -17
@@ -431,25 +431,9 @@ static void event_interrupt_wq_v9(struct kfd_node *dev, client_id == SOC15_IH_CLIENTID_UTCL2) {struct kfd_vm_fault_info info = {0 };uint16_t ring_id =SOC15_RING_ID_FROM_IH_ENTRY (ih_ring_entry); -uint32_t node_id =SOC15_NODEID_FROM_IH_ENTRY (ih_ring_entry); -uint32_t vmid_type =SOC15_VMID_TYPE_FROM_IH_ENTRY (ih_ring_entry); -int hub_inst =0 ;struct kfd_hsa_memory_exception_data exception_data; -/* gfxhub */ -if (!vmid_type && dev->adev->gfx.funcs->ih_node_to_logical_xcc) { - hub_inst = dev->adev->gfx.funcs->ih_node_to_logical_xcc (dev->adev, - node_id); -if (hub_inst <0 ) - hub_inst =0 ; - } - -/* mmhub */ -if (vmid_type && client_id ==SOC15_IH_CLIENTID_VMC ) - hub_inst = node_id /4 ; - -if (amdgpu_amdkfd_ras_query_utcl2_poison_status (dev->adev, - hub_inst, vmid_type)) { +if (source_id ==SOC15_INTSRC_VMC_UTCL2_POISON ) {event_interrupt_poison_consumption_v9 (dev, pasid, client_id);return ; }
drivers/gpu/drm/amd/amdkfd/soc15_int.h +1 -0
@@ -29,6 +29,7 @@#define SOC15_INTSRC_CP_BAD_OPCODE 183#define SOC15_INTSRC_SQ_INTERRUPT_MSG 239#define SOC15_INTSRC_VMC_FAULT 0 +#define SOC15_INTSRC_VMC_UTCL2_POISON 1#define SOC15_INTSRC_SDMA_TRAP 224#define SOC15_INTSRC_SDMA_ECC 220#define SOC21_INTSRC_SDMA_TRAP 49
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 290/558 drm/xe: Drop warn on xe_guc_pc_gucrc_disable in guc pc fini
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Brost <[email protected]>
[ Upstream commit a323782567812ee925e9b7926445532c7afe331b ]
Not a big deal if CT is down as driver is unloading, no need to warn.
--- drivers/gpu/drm/xe/xe_guc_pc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/xe/xe_guc_pc.c +1 -1
@@ -1042,7 +1042,7 @@ static void xe_guc_pc_fini_hw(void *arg)return ;XE_WARN_ON (xe_force_wake_get (gt_to_fw (pc_to_gt (pc)),XE_FORCEWAKE_ALL )); -XE_WARN_ON (xe_guc_pc_gucrc_disable (pc)); +xe_guc_pc_gucrc_disable (pc);XE_WARN_ON (xe_guc_pc_stop (pc));/* Bind requested freq to mert_freq_cap before unload */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 291/558 of/irq: Refer to actual buffer size in of_irq_parse_one()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit 39ab331ab5d377a18fbf5a0e0b228205edfcc7f4 ]
Replace two open-coded calculations of the buffer size by invocations of sizeof() on the buffer itself, to make sure the code will always use the actual buffer size.
--- drivers/of/irq.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/of/irq.c +2 -2
@@ -357,8 +357,8 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar addr =of_get_property (device,"reg" , &addr_len);/* Prevent out-of-bounds read in case of longer interrupt parent address size */ -if (addr_len > (3 *sizeof (__be32))) - addr_len =3 *sizeof (__be32); +if (addr_len >sizeof (addr_buf)) + addr_len =sizeof (addr_buf);if (addr)memcpy (addr_buf, addr, addr_len);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 292/558 drm/amd/display: guard write a 0 post_divider value to HW
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ahmed, Muhammad <[email protected]>
[ Upstream commit 5d666496c24129edeb2bcb500498b87cc64e7f07 ]
[why]post_divider_value should not be 0.
--- drivers/gpu/drm/amd/display/dc/dccg/dcn35/dcn35_dccg.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dccg/dcn35/dcn35_dccg.c +2 -1
@@ -47,7 +47,8 @@ static void dccg35_trigger_dio_fifo_resync(struct dccg *dccg)uint32_t dispclk_rdivider_value =0 ;REG_GET (DENTIST_DISPCLK_CNTL ,DENTIST_DISPCLK_RDIVIDER , &dispclk_rdivider_value); -REG_UPDATE (DENTIST_DISPCLK_CNTL ,DENTIST_DISPCLK_WDIVIDER , dispclk_rdivider_value); +if (dispclk_rdivider_value !=0 ) +REG_UPDATE (DENTIST_DISPCLK_CNTL ,DENTIST_DISPCLK_WDIVIDER , dispclk_rdivider_value); } static void dcn35_set_dppclk_enable(struct dccg *dccg,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 293/558 powerpc/pseries: Use correct data types from pseries_hp_errorlog struct
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haren Myneni <[email protected]>
[ Upstream commit b76e0d4215b6b622127ebcceaa7f603313ceaec4 ]
_be32 type is defined for some elements in pseries_hp_errorlog struct but also used them u32 after be32_to_cpu() conversion.
Example: In handle_dlpar_errorlog() hp_elog->_drc_u.drc_index = be32_to_cpu(hp_elog->_drc_u.drc_index);
And later assigned to u32 typedlpar_cpu() - u32 drc_index = hp_elog->_drc_u.drc_index;
This incorrect usage is giving the following warnings and the patch resolve these warnings with the correct assignment.
arch/powerpc/platforms/pseries/dlpar.c:398:53: sparse: sparse:
incorrect type in argument 1 (different base types) @@ expected unsigned int [usertype] drc_index @@
got restricted __be32 [usertype] drc_index @@
...arch/powerpc/platforms/pseries/dlpar.c:418:43: sparse: sparse:
incorrect type in assignment (different base types) @@ expected restricted __be32 [usertype] drc_count @@ got unsigned int [usertype] @@
v3:
- Fix warnings from using incorrect data types in pseries_hp_errorlog struct
v2:
- Remove pr_info() and TODO comments
- Update more information in the commit logs
--- arch/powerpc/platforms/pseries/dlpar.c | 17 ----------------- arch/powerpc/platforms/pseries/hotplug-cpu.c | 2 +- arch/powerpc/platforms/pseries/hotplug-memory.c | 16 ++++++++-------- arch/powerpc/platforms/pseries/pmem.c | 2 +- 4 files changed, 10 insertions(+), 27 deletions(-)
arch/powerpc/platforms/pseries/dlpar.c +0 -17
@@ -334,23 +334,6 @@ int handle_dlpar_errorlog(struct pseries_hp_errorlog *hp_elog) {int rc; -/* pseries error logs are in BE format, convert to cpu type */ -switch (hp_elog->id_type) { -case PSERIES_HP_ELOG_ID_DRC_COUNT : - hp_elog->_drc_u.drc_count = -be32_to_cpu (hp_elog->_drc_u.drc_count); -break ; -case PSERIES_HP_ELOG_ID_DRC_INDEX : - hp_elog->_drc_u.drc_index = -be32_to_cpu (hp_elog->_drc_u.drc_index); -break ; -case PSERIES_HP_ELOG_ID_DRC_IC : - hp_elog->_drc_u.ic.count = -be32_to_cpu (hp_elog->_drc_u.ic.count); - hp_elog->_drc_u.ic.index = -be32_to_cpu (hp_elog->_drc_u.ic.index); - } -switch (hp_elog->resource) {case PSERIES_HP_ELOG_RESOURCE_MEM : rc =dlpar_memory (hp_elog);
arch/powerpc/platforms/pseries/hotplug-cpu.c +1 -1
@@ -757,7 +757,7 @@ int dlpar_cpu(struct pseries_hp_errorlog *hp_elog)u32 drc_index;int rc; - drc_index = hp_elog->_drc_u.drc_index; + drc_index =be32_to_cpu (hp_elog->_drc_u.drc_index);lock_device_hotplug ();
arch/powerpc/platforms/pseries/hotplug-memory.c +8 -8
@@ -817,16 +817,16 @@ int dlpar_memory(struct pseries_hp_errorlog *hp_elog)case PSERIES_HP_ELOG_ACTION_ADD :switch (hp_elog->id_type) {case PSERIES_HP_ELOG_ID_DRC_COUNT : - count = hp_elog->_drc_u.drc_count; + count =be32_to_cpu (hp_elog->_drc_u.drc_count); rc =dlpar_memory_add_by_count (count);break ;case PSERIES_HP_ELOG_ID_DRC_INDEX : - drc_index = hp_elog->_drc_u.drc_index; + drc_index =be32_to_cpu (hp_elog->_drc_u.drc_index); rc =dlpar_memory_add_by_index (drc_index);break ;case PSERIES_HP_ELOG_ID_DRC_IC : - count = hp_elog->_drc_u.ic.count; - drc_index = hp_elog->_drc_u.ic.index; + count =be32_to_cpu (hp_elog->_drc_u.ic.count); + drc_index =be32_to_cpu (hp_elog->_drc_u.ic.index); rc =dlpar_memory_add_by_ic (count, drc_index);break ;default :
@@ -838,16 +838,16 @@ int dlpar_memory(struct pseries_hp_errorlog *hp_elog)case PSERIES_HP_ELOG_ACTION_REMOVE :switch (hp_elog->id_type) {case PSERIES_HP_ELOG_ID_DRC_COUNT : - count = hp_elog->_drc_u.drc_count; + count =be32_to_cpu (hp_elog->_drc_u.drc_count); rc =dlpar_memory_remove_by_count (count);break ;case PSERIES_HP_ELOG_ID_DRC_INDEX : - drc_index = hp_elog->_drc_u.drc_index; + drc_index =be32_to_cpu (hp_elog->_drc_u.drc_index); rc =dlpar_memory_remove_by_index (drc_index);break ;case PSERIES_HP_ELOG_ID_DRC_IC : - count = hp_elog->_drc_u.ic.count; - drc_index = hp_elog->_drc_u.ic.index; + count =be32_to_cpu (hp_elog->_drc_u.ic.count); + drc_index =be32_to_cpu (hp_elog->_drc_u.ic.index); rc =dlpar_memory_remove_by_ic (count, drc_index);break ;default :
arch/powerpc/platforms/pseries/pmem.c +1 -1
@@ -121,7 +121,7 @@ int dlpar_hp_pmem(struct pseries_hp_errorlog *hp_elog)return -EINVAL ; } - drc_index = hp_elog->_drc_u.drc_index; + drc_index =be32_to_cpu (hp_elog->_drc_u.drc_index);lock_device_hotplug ();
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 294/558 ovl: fsync after metadata copy-up
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amir Goldstein <[email protected]>
[ Upstream commit 7d6899fb69d25e1bc6f4700b7c1d92e6b608593d ]
For upper filesystems which do not use strict ordering of persisting metadata changes (e.g. ubifs), when overlayfs file is modified for the first time, copy up will create a copy of the lower file and its parent directories in the upper layer. Permission lost of the new upper parent directory was observed during power-cut stress test.
Fix by moving the fsync call to after metadata copy to make sure that the metadata copied up directory and files persists to disk before renaming from tmp to final destination.
With metacopy enabled, this change will hurt performance of workloads such as chown -R, so we keep the legacy behavior of fsync only on copyup of data.
--- fs/overlayfs/copy_up.c | 43 ++++++++++++++++++++++++++++++++++++++---- 1 file changed, 39 insertions(+), 4 deletions(-)
fs/overlayfs/copy_up.c +39 -4
@@ -243,8 +243,24 @@ static int ovl_verify_area(loff_t pos, loff_t pos2, loff_t len, loff_t totlen)return 0 ; } +static int ovl_sync_file (struct path *path) +{ +struct file *new_file; +int err; + + new_file =ovl_path_open (path,O_LARGEFILE |O_RDONLY ); +if (IS_ERR (new_file)) +return PTR_ERR (new_file); + + err =vfs_fsync (new_file,0 ); +fput (new_file); + +return err; +} +static int ovl_copy_up_file (struct ovl_fs *ofs,struct dentry *dentry, -struct file *new_file,loff_t len) +struct file *new_file,loff_t len, +bool datasync) {struct path datapath;struct file *old_file;
@@ -342,7 +358,8 @@ static int ovl_copy_up_file(struct ovl_fs *ofs, struct dentry *dentry, len -= bytes; } -if (!error &&ovl_should_sync (ofs)) +/* call fsync once, either now or later along with metadata */ +if (!error &&ovl_should_sync (ofs) && datasync) error =vfs_fsync (new_file,0 ); out_fput:fput (old_file);
@@ -574,6 +591,7 @@ struct ovl_copy_up_ctx {bool indexed;bool metacopy;bool metacopy_digest; +bool metadata_fsync; };static int ovl_link_up (struct ovl_copy_up_ctx *c)
@@ -634,7 +652,8 @@ static int ovl_copy_up_data(struct ovl_copy_up_ctx *c, const struct path *temp)if (IS_ERR (new_file))return PTR_ERR (new_file); - err =ovl_copy_up_file (ofs, c->dentry, new_file, c->stat.size); + err =ovl_copy_up_file (ofs, c->dentry, new_file, c->stat.size, + !c->metadata_fsync);fput (new_file);return err;
@@ -701,6 +720,10 @@ static int ovl_copy_up_metadata(struct ovl_copy_up_ctx *c, struct dentry *temp) err =ovl_set_attr (ofs, temp, &c->stat);inode_unlock (temp->d_inode); +/* fsync metadata before moving it into upper dir */ +if (!err &&ovl_should_sync (ofs) && c->metadata_fsync) + err =ovl_sync_file (&upperpath); +return err; }
@@ -860,7 +883,8 @@ static int ovl_copy_up_tmpfile(struct ovl_copy_up_ctx *c) temp = tmpfile->f_path.dentry;if (!c->metacopy && c->stat.size) { - err =ovl_copy_up_file (ofs, c->dentry, tmpfile, c->stat.size); + err =ovl_copy_up_file (ofs, c->dentry, tmpfile, c->stat.size, + !c->metadata_fsync);if (err) goto out_fput; }
@@ -1135,6 +1159,17 @@ static int ovl_copy_up_one(struct dentry *parent, struct dentry *dentry, !kgid_has_mapping(current_user_ns(), ctx.stat.gid))return -EOVERFLOW ; +/* +* With metacopy disabled, we fsync after final metadata copyup, for +* both regular files and directories to get atomic copyup semantics +* on filesystems that do not use strict metadata ordering (e.g. ubifs). +* +* With metacopy enabled we want to avoid fsync on all meta copyup +* that will hurt performance of workloads such as chown -R, so we +* only fsync on data copyup as legacy behavior. +*/ + ctx.metadata_fsync = !OVL_FS (dentry->d_sb)->config.metacopy && + (S_ISREG (ctx.stat.mode) ||S_ISDIR (ctx.stat.mode)); ctx.metacopy =ovl_need_meta_copy_up (dentry, ctx.stat.mode, flags);if (parent) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 295/558 drm/amdgpu/gfx12: use rlc safe mode for soft recovery
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit 21818f39beda2e843199e5d8d9e3f9e43c8080a3 ]
Protect the MMIO access with safe mode.
--- drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c +2 -0
@@ -4613,7 +4613,9 @@ static void gfx_v12_0_ring_soft_recovery(struct amdgpu_ring *ring, value =REG_SET_FIELD (value,SQ_CMD ,MODE ,0x01 ); value =REG_SET_FIELD (value,SQ_CMD ,CHECK_VMID ,1 ); value =REG_SET_FIELD (value,SQ_CMD ,VM_ID , vmid); +amdgpu_gfx_rlc_enter_safe_mode (adev,0 );WREG32_SOC15 (GC ,0 , regSQ_CMD, value); +amdgpu_gfx_rlc_exit_safe_mode (adev,0 ); } static void
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 296/558 drm/amdgpu/gfx11: use rlc safe mode for soft recovery
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit 3f2d35c325534c1b7ac5072173f0dc7ca969dec2 ]
Protect the MMIO access with safe mode.
--- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c +2 -0
@@ -6008,7 +6008,9 @@ static void gfx_v11_0_ring_soft_recovery(struct amdgpu_ring *ring, value =REG_SET_FIELD (value,SQ_CMD ,MODE ,0x01 ); value =REG_SET_FIELD (value,SQ_CMD ,CHECK_VMID ,1 ); value =REG_SET_FIELD (value,SQ_CMD ,VM_ID , vmid); +amdgpu_gfx_rlc_enter_safe_mode (adev,0 );WREG32_SOC15 (GC ,0 , regSQ_CMD, value); +amdgpu_gfx_rlc_exit_safe_mode (adev,0 ); } static void
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 297/558 drm/amdgpu/gfx10: use rlc safe mode for soft recovery
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit ead60e9c4e29c8574cae1be4fe3af1d9a978fb0f ]
Protect the MMIO access with safe mode.
--- drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +2 -0
@@ -8889,7 +8889,9 @@ static void gfx_v10_0_ring_soft_recovery(struct amdgpu_ring *ring, value =REG_SET_FIELD (value,SQ_CMD ,MODE ,0x01 ); value =REG_SET_FIELD (value,SQ_CMD ,CHECK_VMID ,1 ); value =REG_SET_FIELD (value,SQ_CMD ,VM_ID , vmid); +amdgpu_gfx_rlc_enter_safe_mode (adev,0 );WREG32_SOC15 (GC ,0 , mmSQ_CMD, value); +amdgpu_gfx_rlc_exit_safe_mode (adev,0 ); } static void
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 298/558 platform/x86: lenovo-ymc: Ignore the 0x0 state
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gergo Koteles <[email protected]>
[ Upstream commit d9dca215708d32e7f88ac0591fbb187cbf368adb ]
While booting, Lenovo 14ARB7 reports 'lenovo-ymc: Unknown key 0 pressed' warning. This is caused by lenovo_ymc_probe() calling lenovo_ymc_notify() at probe time to get the initial tablet-mode-switch state and the key-code lenovo_ymc_notify() reads from the firmware is not initialized at probe time yet on the Lenovo 14ARB7.
The hardware/firmware does an ACPI notify on the WMI device itself when it initializes the tablet-mode-switch state later on.
Add 0x0 YMC state to the sparse keymap to silence the warning.
--- drivers/platform/x86/lenovo-ymc.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/platform/x86/lenovo-ymc.c +2 -0
@@ -43,6 +43,8 @@ struct lenovo_ymc_private { };static const struct key_entry lenovo_ymc_keymap[] = { +/* Ignore the uninitialized state */ + {KE_IGNORE ,0x00 },/* Laptop */ {KE_SW ,0x01 , { .sw = {SW_TABLET_MODE ,0 } } },/* Tablet */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 299/558 tools/hv: Add memory allocation check in hv_fcopy_start
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhu Jun <[email protected]>
[ Upstream commit 94e86b174d103d941b4afc4f016af8af9e5352fa ]
Added error handling for memory allocation failures of file_name and path_name.
Message-ID: <[email protected]>
--- tools/hv/hv_fcopy_uio_daemon.c | 7 +++++++ 1 file changed, 7 insertions(+)
tools/hv/hv_fcopy_uio_daemon.c +7 -0
@@ -296,6 +296,13 @@ static int hv_fcopy_start(struct hv_start_fcopy *smsg_in) file_name = (char *)malloc (file_size *sizeof (char )); path_name = (char *)malloc (path_size *sizeof (char )); +if (!file_name || !path_name) { +free (file_name); +free (path_name); +syslog (LOG_ERR ,"Can't allocate memory for file name and/or path name" ); +return HV_E_FAIL ; + } +wcstoutf8 (file_name, (__u16 *)in_file_name, file_size);wcstoutf8 (path_name, (__u16 *)in_path_name, path_size);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 300/558 HID: i2c-hid: ensure various commands do not interfere with each other
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
[ Upstream commit b4ed18a3d56eabd18cfd9841ff05111e3cfbe8f9 ]
i2c-hid uses 2 shared buffers: command and "raw" input buffer for sending requests to peripherals and read data from peripherals when executing variety of commands. Such commands include reading of HID registers, requesting particular power mode, getting and setting reports and so on. Because all such requests use the same 2 buffers they should not execute simultaneously.
Fix this by introducing "cmd_lock" mutex and acquire it whenever we needs to access ihid->cmdbuf or idid->rawbuf.
--- drivers/hid/i2c-hid/i2c-hid-core.c | 42 +++++++++++++++++++----------- 1 file changed, 27 insertions(+), 15 deletions(-)
drivers/hid/i2c-hid/i2c-hid-core.c +27 -15
@@ -105,6 +105,7 @@ struct i2c_hid {wait_queue_head_t wait;/* For waiting the interrupt */ +struct mutex cmd_lock;/* protects cmdbuf and rawbuf */ struct mutex reset_lock;struct i2chid_ops *ops;
@@ -220,6 +221,8 @@ static int i2c_hid_xfer(struct i2c_hid *ihid,static int i2c_hid_read_register (struct i2c_hid *ihid,__le16 reg,void *buf,size_t len) { +guard (mutex)(&ihid->cmd_lock); + *(__le16 *)ihid->cmdbuf = reg;return i2c_hid_xfer (ihid, ihid->cmdbuf,sizeof (__le16), buf, len);
@@ -252,6 +255,8 @@ static int i2c_hid_get_report(struct i2c_hid *ihid,i2c_hid_dbg (ihid,"%s\n" , __func__); +guard (mutex)(&ihid->cmd_lock); +/* Command register goes first */ *(__le16 *)ihid->cmdbuf = ihid->hdesc.wCommandRegister; length +=sizeof (__le16);
@@ -342,6 +347,8 @@ static int i2c_hid_set_or_send_report(struct i2c_hid *ihid,if (!do_set &&le16_to_cpu (ihid->hdesc.wMaxOutputLength) ==0 )return -ENOSYS ; +guard (mutex)(&ihid->cmd_lock); +if (do_set) {/* Command register goes first */ *(__le16 *)ihid->cmdbuf = ihid->hdesc.wCommandRegister;
@@ -384,6 +391,8 @@ static int i2c_hid_set_power_command(struct i2c_hid *ihid, int power_state) {size_t length; +guard (mutex)(&ihid->cmd_lock); +/* SET_POWER uses command register */ *(__le16 *)ihid->cmdbuf = ihid->hdesc.wCommandRegister; length =sizeof (__le16);
@@ -440,25 +449,27 @@ static int i2c_hid_start_hwreset(struct i2c_hid *ihid)if (ret)return ret; -/* Prepare reset command. Command register goes first. */ - *(__le16 *)ihid->cmdbuf = ihid->hdesc.wCommandRegister; - length +=sizeof (__le16); -/* Next is RESET command itself */ - length +=i2c_hid_encode_command (ihid->cmdbuf + length, -I2C_HID_OPCODE_RESET ,0 ,0 ); + scoped_guard(mutex, &ihid->cmd_lock) { +/* Prepare reset command. Command register goes first. */ + *(__le16 *)ihid->cmdbuf = ihid->hdesc.wCommandRegister; + length +=sizeof (__le16); +/* Next is RESET command itself */ + length +=i2c_hid_encode_command (ihid->cmdbuf + length, +I2C_HID_OPCODE_RESET ,0 ,0 ); -set_bit (I2C_HID_RESET_PENDING , &ihid->flags); +set_bit (I2C_HID_RESET_PENDING , &ihid->flags); - ret =i2c_hid_xfer (ihid, ihid->cmdbuf, length,NULL ,0 ); -if (ret) { -dev_err (&ihid->client->dev, -"failed to reset device: %d\n" , ret); - goto err_clear_reset; - } + ret =i2c_hid_xfer (ihid, ihid->cmdbuf, length,NULL ,0 ); +if (ret) { +dev_err (&ihid->client->dev, +"failed to reset device: %d\n" , ret); +break ; + } -return 0 ; +return 0 ; + } -err_clear_reset: +/* Clean up if sending reset command failed */ clear_bit (I2C_HID_RESET_PENDING , &ihid->flags);i2c_hid_set_power (ihid,I2C_HID_PWR_SLEEP );return ret;
@@ -1200,6 +1211,7 @@ int i2c_hid_core_probe(struct i2c_client *client, struct i2chid_ops *ops, ihid->is_panel_follower =drm_is_panel_follower (&client->dev);init_waitqueue_head (&ihid->wait); +mutex_init (&ihid->cmd_lock);mutex_init (&ihid->reset_lock);INIT_WORK (&ihid->panel_follower_prepare_work, ihid_core_panel_prepare_work);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 301/558 ksmbd: add refcnt to ksmbd_conn struct
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
[ Upstream commit ee426bfb9d09b29987369b897fe9b6485ac2be27 ]
When sending an oplock break request, opinfo->conn is used, But freed ->conn can be used on multichannel.
This patch add a reference count to the ksmbd_conn struct so that it can be freed when it is no longer used.
--- fs/smb/server/connection.c | 4 ++- fs/smb/server/connection.h | 1 + fs/smb/server/oplock.c | 55 +++++++++++--------------------------- fs/smb/server/vfs_cache.c | 3 +++ 4 files changed, 23 insertions(+), 40 deletions(-)
fs/smb/server/connection.c +3 -1
@@ -39,7 +39,8 @@ void ksmbd_conn_free(struct ksmbd_conn *conn)xa_destroy (&conn->sessions);kvfree (conn->request_buf);kfree (conn->preauth_info); -kfree (conn); +if (atomic_dec_and_test (&conn->refcnt)) +kfree (conn); }/**
@@ -68,6 +69,7 @@ struct ksmbd_conn *ksmbd_conn_alloc(void) conn->um =NULL ;atomic_set (&conn->req_running,0 );atomic_set (&conn->r_count,0 ); +atomic_set (&conn->refcnt,1 ); conn->total_credits =1 ; conn->outstanding_credits =0 ;
fs/smb/server/connection.h +1 -0
@@ -106,6 +106,7 @@ struct ksmbd_conn {bool signing_negotiated;__le16 signing_algorithm;bool binding; +atomic_t refcnt; };struct ksmbd_conn_ops {
fs/smb/server/oplock.c +16 -39
148 lines not on this page · raw message
fs/smb/server/vfs_cache.c +3 -0
@@ -863,6 +863,8 @@ static bool session_fd_check(struct ksmbd_tree_connect *tcon,list_for_each_entry_rcu (op, &ci->m_op_list, op_entry) {if (op->conn != conn)continue ; +if (op->conn &&atomic_dec_and_test (&op->conn->refcnt)) +kfree (op->conn); op->conn =NULL ; }up_write (&ci->m_lock);
@@ -965,6 +967,7 @@ int ksmbd_reopen_durable_fd(struct ksmbd_work *work, struct ksmbd_file *fp)if (op->conn)continue ; op->conn = fp->conn; +atomic_inc (&op->conn->refcnt); }up_write (&ci->m_lock);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 302/558 platform/mellanox: mlxbf-pmc: fix lockdep warning
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Capitulino <[email protected]>
[ Upstream commit 305790dd91057a3f7497c9d128614a4f8486b62b ]
It seems the mlxbf-pmc driver is missing initializing sysfs attributes which causes the warning below when CONFIG_LOCKDEP and CONFIG_DEBUG_LOCK_ALLOC are enabled. This commit fixes it.
[ 155.380843] BUG: key ffff470f45dfa6d8 has not been registered! [ 155.386749] ------------[ cut here ]------------ [ 155.391361] DEBUG_LOCKS_WARN_ON(1) [ 155.391381] WARNING: CPU: 4 PID: 1828 at kernel/locking/lockdep.c:4894 lockdep_init_map_type+0x1d0/0x288 [ 155.404254] Modules linked in: mlxbf_pmc(+) xfs libcrc32c mmc_block mlx5_core crct10dif_ce mlxfw ghash_ce virtio_net tls net_failover sha2 _ce failover psample sha256_arm64 dw_mmc_bluefield pci_hyperv_intf sha1_ce dw_mmc_pltfm sbsa_gwdt dw_mmc micrel mmc_core nfit i2c_mlxbf pwr_m lxbf gpio_generic libnvdimm mlxbf_tmfifo mlxbf_gige dm_mirror dm_region_hash dm_log dm_mod [ 155.436786] CPU: 4 UID: 0 PID: 1828 Comm: modprobe Kdump: loaded Not tainted 6.11.0-rc7-rep1+ #1 [ 155.445562] Hardware name: https://www.mellanox.com BlueField SoC/BlueField SoC, BIOS 4.8.0.13249 Aug 7 2024 [ 155.455463] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 155.462413] pc : lockdep_init_map_type+0x1d0/0x288 [ 155.467196] lr : lockdep_init_map_type+0x1d0/0x288 [ 155.471976] sp : ffff80008a1734e0 [ 155.475279] x29: ffff80008a1734e0 x28: ffff470f45df0240 x27: 00000000ffffee4b [ 155.482406] x26: 00000000000011b4 x25: 0000000000000000 x24: 0000000000000000 [ 155.489532] x23: ffff470f45dfa6d8 x22: 0000000000000000 x21: ffffd54ef6bea000 [ 155.496659] x20: ffff470f45dfa6d8 x19: ffff470f49cdc638 x18: ffffffffffffffff [ 155.503784] x17: 2f30303a31444642 x16: ffffd54ef48a65e8 x15: ffff80010a172fe7 [ 155.510911] x14: 0000000000000000 x13: 284e4f5f4e524157 x12: 5f534b434f4c5f47 [ 155.518037] x11: 0000000000000001 x10: 0000000000000001 x9 : ffffd54ef3f48a14 [ 155.525163] x8 : 00000000000bffe8 x7 : c0000000ffff7fff x6 : 00000000002bffa8 [ 155.532289] x5 : ffff4712bdcb6088 x4 : 0000000000000000 x3 : 0000000000000027 [ 155.539416] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff470f43e5be00 [ 155.546542] Call trace: [ 155.548976] lockdep_init_map_type+0x1d0/0x288 [ 155.553410] __kernfs_create_file+0x80/0x138 [ 155.557673] sysfs_add_file_mode_ns+0x94/0x150 [ 155.562106] create_files+0xb0/0x248 [ 155.565672] internal_create_group+0x10c/0x328 [ 155.570105] internal_create_groups.part.0+0x50/0xc8 [ 155.575060] sysfs_create_groups+0x20/0x38 [ 155.579146] device_add_attrs+0x1b8/0x228 [ 155.583146] device_add+0x2a4/0x690 [ 155.586625] device_register+0x24/0x38 [ 155.590362] __hwmon_device_register+0x1e0/0x3c8 [ 155.594969] devm_hwmon_device_register_with_groups+0x78/0xe0 [ 155.600703] mlxbf_pmc_probe+0x224/0x3a0 [mlxbf_pmc] [ 155.605669] platform_probe+0x6c/0xe0 [ 155.609320] really_probe+0xc4/0x398 [ 155.612887] __driver_probe_device+0x80/0x168 [ 155.617233] driver_probe_device+0x44/0x120 [ 155.621405] __driver_attach+0xf4/0x200 [ 155.625230] bus_for_each_dev+0x7c/0xe8 [ 155.629055] driver_attach+0x28/0x38 [ 155.632619] bus_add_driver+0x110/0x238 [ 155.636445] driver_register+0x64/0x128 [ 155.640270] __platform_driver_register+0x2c/0x40 [ 155.644965] pmc_driver_init+0x24/0xff8 [mlxbf_pmc] [ 155.649833] do_one_initcall+0x70/0x3d0 [ 155.653660] do_init_module+0x64/0x220 [ 155.657400] load_module+0x628/0x6a8 [ 155.660964] init_module_from_file+0x8c/0xd8 [ 155.665222] idempotent_init_module+0x194/0x290 [ 155.669742] __arm64_sys_finit_module+0x6c/0xd8 [ 155.674261] invoke_syscall.constprop.0+0x74/0xd0 [ 155.678957] do_el0_svc+0xb4/0xd0 [ 155.682262] el0_svc+0x5c/0x248 [ 155.685394] el0t_64_sync_handler+0x134/0x150 [ 155.689739] el0t_64_sync+0x17c/0x180 [ 155.693390] irq event stamp: 6407 [ 155.696693] hardirqs last enabled at (6407): [<ffffd54ef3f48564>] console_unlock+0x154/0x1b8 [ 155.705207] hardirqs last disabled at (6406): [<ffffd54ef3f485ac>] console_unlock+0x19c/0x1b8 [ 155.713719] softirqs last enabled at (6404): [<ffffd54ef3e9740c>] handle_softirqs+0x4f4/0x518 [ 155.722320] softirqs last disabled at (6395): [<ffffd54ef3df0160>] __do_softirq+0x18/0x20 [ 155.730484] ---[ end trace 0000000000000000 ]---
--- drivers/platform/mellanox/mlxbf-pmc.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/platform/mellanox/mlxbf-pmc.c +5 -0
@@ -1774,6 +1774,7 @@ static int mlxbf_pmc_init_perftype_counter(struct device *dev, unsigned int blk_/* "event_list" sysfs to list events supported by the block */ attr = &pmc->block[blk_num].attr_event_list; +sysfs_attr_init (&attr->dev_attr.attr); attr->dev_attr.attr.mode =0444 ; attr->dev_attr.show = mlxbf_pmc_event_list_show; attr->nr = blk_num;
@@ -1787,6 +1788,7 @@ static int mlxbf_pmc_init_perftype_counter(struct device *dev, unsigned int blk_if (strstr (pmc->block_name[blk_num],"l3cache" ) || ((pmc->block[blk_num].type ==MLXBF_PMC_TYPE_CRSPACE ))) { attr = &pmc->block[blk_num].attr_enable; +sysfs_attr_init (&attr->dev_attr.attr); attr->dev_attr.attr.mode =0644 ; attr->dev_attr.show = mlxbf_pmc_enable_show; attr->dev_attr.store = mlxbf_pmc_enable_store;
@@ -1814,6 +1816,7 @@ static int mlxbf_pmc_init_perftype_counter(struct device *dev, unsigned int blk_/* "eventX" and "counterX" sysfs to program and read counter values */ for (j =0 ; j < pmc->block[blk_num].counters; ++j) { attr = &pmc->block[blk_num].attr_counter[j]; +sysfs_attr_init (&attr->dev_attr.attr); attr->dev_attr.attr.mode =0644 ; attr->dev_attr.show = mlxbf_pmc_counter_show; attr->dev_attr.store = mlxbf_pmc_counter_store;
@@ -1826,6 +1829,7 @@ static int mlxbf_pmc_init_perftype_counter(struct device *dev, unsigned int blk_ attr =NULL ; attr = &pmc->block[blk_num].attr_event[j]; +sysfs_attr_init (&attr->dev_attr.attr); attr->dev_attr.attr.mode =0644 ; attr->dev_attr.show = mlxbf_pmc_event_show; attr->dev_attr.store = mlxbf_pmc_event_store;
@@ -1861,6 +1865,7 @@ static int mlxbf_pmc_init_perftype_reg(struct device *dev, unsigned int blk_num)while (count >0 ) { --count; attr = &pmc->block[blk_num].attr_event[count]; +sysfs_attr_init (&attr->dev_attr.attr); attr->dev_attr.attr.mode =0644 ; attr->dev_attr.show = mlxbf_pmc_counter_show; attr->dev_attr.store = mlxbf_pmc_counter_store;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 303/558 platform/x86: x86-android-tablets: Adjust Xiaomi Pad 2 bottom bezel touch buttons LED
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit df40a23cc34c200cfde559eda7ca540f3ae7bd9e ]
The "input-events" LED trigger used to turn on the backlight LEDs had to be rewritten to use led_trigger_register_simple() + led_trigger_event() to fix a serious locking issue.
This means it no longer supports using blink_brightness to set a per LED brightness for the trigger and it no longer sets LED_CORE_SUSPENDRESUME.
Adjust the MiPad 2 bottom bezel touch buttons LED class device to match:
1. Make LED_FULL the maximum brightness to fix the LED brightness being very low when on.
2. Set flags = LED_CORE_SUSPENDRESUME.
--- drivers/platform/x86/x86-android-tablets/other.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/platform/x86/x86-android-tablets/other.c +5 -5
@@ -670,7 +670,7 @@ static const struct software_node *ktd2026_node_group[] = {* is controlled by the "pwm_soc_lpss_2" PWM output. */ #define XIAOMI_MIPAD2_LED_PERIOD_NS 19200 -#define XIAOMI_MIPAD2_LED_DEFAULT_DUTY 6000/* From Android kernel */ +#define XIAOMI_MIPAD2_LED_MAX_DUTY_NS 6000/* From Android kernel */ static struct pwm_device *xiaomi_mipad2_led_pwm;
@@ -679,7 +679,7 @@ static int xiaomi_mipad2_brightness_set(struct led_classdev *led_cdev, {struct pwm_state state = { .period =XIAOMI_MIPAD2_LED_PERIOD_NS , - .duty_cycle = val, + .duty_cycle =XIAOMI_MIPAD2_LED_MAX_DUTY_NS * val /LED_FULL ,/* Always set PWM enabled to avoid the pin floating */ .enabled = true, };
@@ -701,11 +701,11 @@ static int __init xiaomi_mipad2_init(struct device *dev)return -ENOMEM ; led_cdev->name ="mipad2:white:touch-buttons-backlight" ; - led_cdev->max_brightness =XIAOMI_MIPAD2_LED_PERIOD_NS ; -/* "input-events" trigger uses blink_brightness */ - led_cdev->blink_brightness =XIAOMI_MIPAD2_LED_DEFAULT_DUTY ; + led_cdev->max_brightness =LED_FULL ; led_cdev->default_trigger ="input-events" ; led_cdev->brightness_set_blocking = xiaomi_mipad2_brightness_set; +/* Turn LED off during suspend */ + led_cdev->flags =LED_CORE_SUSPENDRESUME ; ret =devm_led_classdev_register (dev, led_cdev);if (ret)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 304/558 ext4: filesystems without casefold feature cannot be mounted with siphash
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lizhi Xu <[email protected]>
[ Upstream commit 985b67cd86392310d9e9326de941c22fc9340eec ]
When mounting the ext4 filesystem, if the default hash version is set to DX_HASH_SIPHASH but the casefold feature is not set, exit the mounting.
--- fs/ext4/super.c | 7 +++++++ 1 file changed, 7 insertions(+)
fs/ext4/super.c +7 -0
@@ -3582,6 +3582,13 @@ int ext4_feature_set_ok(struct super_block *sb, int readonly) "mounted without CONFIG_UNICODE");return 0 ; } +if (EXT4_SB (sb)->s_es->s_def_hash_version ==DX_HASH_SIPHASH && + !ext4_has_feature_casefold (sb)) { +ext4_msg (sb,KERN_ERR , +"Filesystem without casefold feature cannot be " +"mounted with siphash" ); +return 0 ; + }if (readonly)return 1 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 305/558 ext4: dont set SB_RDONLY after filesystem errors
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
[ Upstream commit d3476f3dad4ad68ae5f6b008ea6591d1520da5d8 ]
When the filesystem is mounted with errors=remount-ro, we were setting SB_RDONLY flag to stop all filesystem modifications. We knew this misses proper locking (sb->s_umount) and does not go through proper filesystem remount procedure but it has been the way this worked since early ext2 days and it was good enough for catastrophic situation damage mitigation. Recently, syzbot has found a way (see link) to trigger warnings in filesystem freezing because the code got confused by SB_RDONLY changing under its hands. Since these days we set EXT4_FLAGS_SHUTDOWN on the superblock which is enough to stop all filesystem modifications, modifying SB_RDONLY shouldn't be needed. So stop doing that.
--- fs/ext4/super.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
fs/ext4/super.c +5 -4
@@ -735,11 +735,12 @@ static void ext4_handle_error(struct super_block *sb, bool force_ro, int error,ext4_msg (sb,KERN_CRIT ,"Remounting filesystem read-only" );/* -* Make sure updated value of ->s_mount_flags will be visible before -* ->s_flags update +* EXT4_FLAGS_SHUTDOWN was set which stops all filesystem +* modifications. We don't set SB_RDONLY because that requires +* sb->s_umount semaphore and setting it without proper remount +* procedure is confusing code such as freeze_super() leading to +* deadlocks and other problems. */ -smp_wmb (); - sb->s_flags |=SB_RDONLY ; }static void update_super_work (struct work_struct *work)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 306/558 bpf: Make the pointer returned by iter next method valid
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juntong Deng <[email protected]>
[ Upstream commit 4cc8c50c9abcb2646a7a4fcef3cea5dcb30c06cf ]
Currently we cannot pass the pointer returned by iter next method as argument to KF_TRUSTED_ARGS or KF_RCU kfuncs, because the pointer returned by iter next method is not "valid".
This patch sets the pointer returned by iter next method to be valid.
This is based on the fact that if the iterator is implemented correctly, then the pointer returned from the iter next method should be valid.
This does not make NULL pointer valid. If the iter next method has KF_RET_NULL flag, then the verifier will ask the ebpf program to check NULL pointer.
KF_RCU_PROTECTED iterator is a special case, the pointer returned by iter next method should only be valid within RCU critical section, so it should be with MEM_RCU, not PTR_TRUSTED.
Another special case is bpf_iter_num_next, which returns a pointer with base type PTR_TO_MEM. PTR_TO_MEM should not be combined with type flag PTR_TRUSTED (PTR_TO_MEM already means the pointer is valid).
The pointer returned by iter next method of other types of iterators is with PTR_TRUSTED.
In addition, this patch adds get_iter_from_state to help us get the current iterator from the current state.
--- kernel/bpf/verifier.c | 26 ++++++++++++++++++++++---- 1 file changed, 22 insertions(+), 4 deletions(-)
kernel/bpf/verifier.c +22 -4
@@ -8029,6 +8029,15 @@ static int widen_imprecise_scalars(struct bpf_verifier_env *env,return 0 ; } +static struct bpf_reg_state *get_iter_from_state (struct bpf_verifier_state *cur_st, +struct bpf_kfunc_call_arg_meta *meta) +{ +int iter_frameno = meta->iter.frameno; +int iter_spi = meta->iter.spi; + +return &cur_st->frame[iter_frameno]->stack[iter_spi].spilled_ptr; +} +/* process_iter_next_call() is called when verifier gets to iterator's next * "method" (e.g., bpf_iter_num_next() for numbers iterator) call. We'll refer * to it as just "iter_next()" in comments below.
@@ -8113,12 +8122,10 @@ static int process_iter_next_call(struct bpf_verifier_env *env, int insn_idx,struct bpf_verifier_state *cur_st = env->cur_state, *queued_st, *prev_st;struct bpf_func_state *cur_fr = cur_st->frame[cur_st->curframe], *queued_fr;struct bpf_reg_state *cur_iter, *queued_iter; -int iter_frameno = meta->iter.frameno; -int iter_spi = meta->iter.spi;BTF_TYPE_EMIT (struct bpf_iter ); - cur_iter = &env->cur_state->frame[iter_frameno]->stack[iter_spi].spilled_ptr; + cur_iter =get_iter_from_state (cur_st, meta);if (cur_iter->iter.state !=BPF_ITER_STATE_ACTIVE && cur_iter->iter.state !=BPF_ITER_STATE_DRAINED ) {
@@ -8146,7 +8153,7 @@ static int process_iter_next_call(struct bpf_verifier_env *env, int insn_idx,if (!queued_st)return -ENOMEM ; - queued_iter = &queued_st->frame[iter_frameno]->stack[iter_spi].spilled_ptr; + queued_iter =get_iter_from_state (queued_st, meta); queued_iter->iter.state =BPF_ITER_STATE_ACTIVE ; queued_iter->iter.depth++;if (prev_st)
@@ -12692,6 +12699,17 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn, regs[BPF_REG_0 ].btf = desc_btf; regs[BPF_REG_0 ].type =PTR_TO_BTF_ID ; regs[BPF_REG_0 ].btf_id = ptr_type_id; + +if (is_iter_next_kfunc (&meta)) { +struct bpf_reg_state *cur_iter; + + cur_iter =get_iter_from_state (env->cur_state, &meta); + +if (cur_iter->type &MEM_RCU )/* KF_RCU_PROTECTED */ + regs[BPF_REG_0 ].type |=MEM_RCU ; +else + regs[BPF_REG_0 ].type |=PTR_TRUSTED ; + } }if (is_kfunc_ret_null (&meta)) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 307/558 ext4: ext4_search_dir should return a proper error
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thadeu Lima de Souza Cascardo <[email protected]>
[ Upstream commit cd69f8f9de280e331c9e6ff689ced0a688a9ce8f ]
ext4_search_dir currently returns -1 in case of a failure, while it returns 0 when the name is not found. In such failure cases, it should return an error code instead.
This becomes even more important when ext4_find_inline_entry returns an error code as well in the next commit.
-EFSCORRUPTED seems appropriate as such error code as these failures would be caused by unexpected record lengths and is in line with other instances of ext4_check_dir_entry failures.
In the case of ext4_dx_find_entry, the current use of ERR_BAD_DX_DIR was left as is to reduce the risk of regressions.
--- fs/ext4/namei.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
fs/ext4/namei.c +7 -5
@@ -1482,7 +1482,7 @@ static bool ext4_match(struct inode *parent, }/* -* Returns 0 if not found, -1 on failure, and 1 on success +* Returns 0 if not found, -EFSCORRUPTED on failure, and 1 on success */ int ext4_search_dir(struct buffer_head *bh, char *search_buf, int buf_size, struct inode *dir, struct ext4_filename *fname,
@@ -1503,7 +1503,7 @@ int ext4_search_dir(struct buffer_head *bh, char *search_buf, int buf_size,* a full check */ if (ext4_check_dir_entry (dir,NULL , de, bh, search_buf, buf_size, offset)) -return -1 ; +return -EFSCORRUPTED ; *res_dir = de;return 1 ; }
@@ -1511,7 +1511,7 @@ int ext4_search_dir(struct buffer_head *bh, char *search_buf, int buf_size, de_len =ext4_rec_len_from_disk (de->rec_len, dir->i_sb->s_blocksize);if (de_len <=0 ) -return -1 ; +return -EFSCORRUPTED ; offset += de_len; de = (struct ext4_dir_entry_2 *) ((char *) de + de_len); }
@@ -1663,8 +1663,10 @@ static struct buffer_head *__ext4_find_entry(struct inode *dir, goto cleanup_and_exit; }else {brelse (bh); -if (i <0 ) +if (i <0 ) { + ret =ERR_PTR (i); goto cleanup_and_exit; + } } next:if (++block >= nblocks)
@@ -1758,7 +1760,7 @@ static struct buffer_head * ext4_dx_find_entry(struct inode *dir,if (retval ==1 ) goto success;brelse (bh); -if (retval ==-1 ) { +if (retval <0 ) { bh =ERR_PTR (ERR_BAD_DX_DIR ); goto errout; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 308/558 ext4: avoid use-after-free in ext4_ext_show_leaf()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
[ Upstream commit 4e2524ba2ca5f54bdbb9e5153bea00421ef653f5 ]
In ext4_find_extent(), path may be freed by error or be reallocated, so using a previously saved *ppath may have been freed and thus may trigger use-after-free, as follows:
ext4_split_extent
path = *ppath;
ext4_split_extent_at(ppath)
path = ext4_find_extent(ppath)
ext4_split_extent_at(ppath)
// ext4_find_extent fails to free path
// but zeroout succeeds ext4_ext_show_leaf(inode, path)
eh = path[depth].p_hdr
// path use-after-free !!!
Similar to ext4_split_extent_at(), we use *ppath directly as an input to ext4_ext_show_leaf(). Fix a spelling error by the way.
Same problem in ext4_ext_handle_unwritten_extents(). Since 'path' is only used in ext4_ext_show_leaf(), remove 'path' and use *ppath directly.
This issue is triggered only when EXT_DEBUG is defined and therefore does not affect functionality.
--- fs/ext4/extents.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
fs/ext4/extents.c +4 -5
@@ -3287,7 +3287,7 @@ static int ext4_split_extent_at(handle_t *handle, }/* -* ext4_split_extents() splits an extent and mark extent which is covered +* ext4_split_extent() splits an extent and mark extent which is covered * by @map as split_flags indicates * * It may result in splitting the extent into multiple extents (up to three)
@@ -3363,7 +3363,7 @@ static int ext4_split_extent(handle_t *handle, goto out; } -ext4_ext_show_leaf (inode, path); +ext4_ext_show_leaf (inode, *ppath); out:return err ? err : allocated; }
@@ -3828,14 +3828,13 @@ ext4_ext_handle_unwritten_extents(handle_t *handle, struct inode *inode, struct ext4_ext_path **ppath, int flags, unsigned int allocated, ext4_fsblk_t newblock) { - struct ext4_ext_path __maybe_unused *path = *ppath; int ret = 0;int err =0 ;ext_debug (inode,"logical block %llu, max_blocks %u, flags 0x%x, allocated %u\n" , (unsigned long long )map->m_lblk, map->m_len, flags, allocated); -ext4_ext_show_leaf (inode, path); +ext4_ext_show_leaf (inode, *ppath);/* * When writing into unwritten space, we should not fail to
@@ -3932,7 +3931,7 @@ ext4_ext_handle_unwritten_extents(handle_t *handle, struct inode *inode,if (allocated > map->m_len) allocated = map->m_len; map->m_len = allocated; -ext4_ext_show_leaf (inode, path); +ext4_ext_show_leaf (inode, *ppath); out2:return err ? err : allocated; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 309/558 ext4: fix i_data_sem unlock order in ext4_ind_migrate()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Artem Sadovnikov <[email protected]>
[ Upstream commit cc749e61c011c255d81b192a822db650c68b313f ]
Fuzzing reports a possible deadlock in jbd2_log_wait_commit.
This issue is triggered when an EXT4_IOC_MIGRATE ioctl is set to require synchronous updates because the file descriptor is opened with O_SYNC. This can lead to the jbd2_journal_stop() function calling jbd2_might_wait_for_commit(), potentially causing a deadlock if the EXT4_IOC_MIGRATE call races with a write(2) system call.
This problem only arises when CONFIG_PROVE_LOCKING is enabled. In this case, the jbd2_might_wait_for_commit macro locks jbd2_handle in the jbd2_journal_stop function while i_data_sem is locked. This triggers lockdep because the jbd2_journal_start function might also lock the same jbd2_handle simultaneously.
Found by Linux Verification Center (linuxtesting.org) with syzkaller.
Rule: add
--- fs/ext4/migrate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ext4/migrate.c +1 -1
@@ -663,8 +663,8 @@ int ext4_ind_migrate(struct inode *inode)if (unlikely (ret2 && !ret)) ret = ret2; errout: -ext4_journal_stop (handle);up_write (&EXT4_I (inode)->i_data_sem); +ext4_journal_stop (handle); out_unlock:ext4_writepages_up_write (inode->i_sb, alloc_ctx);return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 310/558 bpftool: Fix undefined behavior caused by shifting into the sign bit
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuan-Wei Chiu <[email protected]>
[ Upstream commit 4cdc0e4ce5e893bc92255f5f734d983012f2bc2e ]
Replace shifts of '1' with '1U' in bitwise operations within __show_dev_tc_bpf() to prevent undefined behavior caused by shifting into the sign bit of a signed integer. By using '1U', the operations are explicitly performed on unsigned integers, avoiding potential integer overflow or sign-related issues.
--- tools/bpf/bpftool/net.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
tools/bpf/bpftool/net.c +4 -4
@@ -482,9 +482,9 @@ static void __show_dev_tc_bpf(const struct ip_devname_ifindex *dev,if (prog_flags[i] || json_output) {NET_START_ARRAY ("prog_flags" ,"%s " );for (j =0 ; prog_flags[i] && j <32 ; j++) { -if (!(prog_flags[i] & (1 << j))) +if (!(prog_flags[i] & (1U << j)))continue ; -NET_DUMP_UINT_ONLY (1 << j); +NET_DUMP_UINT_ONLY (1U << j); }NET_END_ARRAY ("" ); }
@@ -493,9 +493,9 @@ static void __show_dev_tc_bpf(const struct ip_devname_ifindex *dev,if (link_flags[i] || json_output) {NET_START_ARRAY ("link_flags" ,"%s " );for (j =0 ; link_flags[i] && j <32 ; j++) { -if (!(link_flags[i] & (1 << j))) +if (!(link_flags[i] & (1U << j)))continue ; -NET_DUMP_UINT_ONLY (1 << j); +NET_DUMP_UINT_ONLY (1U << j); }NET_END_ARRAY ("" ); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 311/558 iomap: handle a post-direct I/O invalidate race in iomap_write_delalloc_release
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit 7a9d43eace888a0ee6095035997bb138425844d3 ]
When direct I/O completions invalidates the page cache it holds neither the i_rwsem nor the invalidate_lock so it can be racing with iomap_write_delalloc_release. If the search for the end of the region that contains data returns the start offset we hit such a race and just need to look for the end of the newly created hole instead.
--- fs/iomap/buffered-io.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
fs/iomap/buffered-io.c +9 -1
@@ -1241,7 +1241,15 @@ static int iomap_write_delalloc_release(struct inode *inode, error = data_end; goto out_unlock; } -WARN_ON_ONCE (data_end <= start_byte); + +/* +* If we race with post-direct I/O invalidation of the page cache, +* there might be no data left at start_byte. +*/ +if (data_end == start_byte) +continue ; + +WARN_ON_ONCE (data_end < start_byte);WARN_ON_ONCE (data_end > scan_end_byte); error = iomap_write_delalloc_scan(inode, &punch_start_byte,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 312/558 bpftool: Fix undefined behavior in qsort(NULL, 0, ...)
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuan-Wei Chiu <[email protected]>
[ Upstream commit f04e2ad394e2755d0bb2d858ecb5598718bf00d5 ]
When netfilter has no entry to display, qsort is called with qsort(NULL, 0, ...). This results in undefined behavior, as UBSan reports:
net.c:827:2: runtime error: null pointer passed as argument 1, which is declared to never be null
Although the C standard does not explicitly state whether calling qsort with a NULL pointer when the size is 0 constitutes undefined behavior, Section 7.1.4 of the C standard (Use of library functions) mentions:
"Each of the following statements applies unless explicitly stated otherwise in the detailed descriptions that follow: If an argument to a function has an invalid value (such as a value outside the domain of the function, or a pointer outside the address space of the program, or a null pointer, or a pointer to non-modifiable storage when the corresponding parameter is not const-qualified) or a type (after promotion) not expected by a function with variable number of arguments, the behavior is undefined."
To avoid this, add an early return when nf_link_info is NULL to prevent calling qsort with a NULL pointer.
--- tools/bpf/bpftool/net.c | 3 +++ 1 file changed, 3 insertions(+)
tools/bpf/bpftool/net.c +3 -0
@@ -824,6 +824,9 @@ static void show_link_netfilter(void) nf_link_count++; } +if (!nf_link_info) +return ; +qsort (nf_link_info, nf_link_count,sizeof (*nf_link_info), netfilter_link_compar);for (id =0 ; id < nf_link_count; id++) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 313/558 bpf: Fix a sdiv overflow issue
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yonghong Song <[email protected]>
[ Upstream commit 7dd34d7b7dcf9309fc6224caf4dd5b35bedddcb7 ]
Zac Ecob reported a problem where a bpf program may cause kernel crash due to the following error:
Oops: divide error: 0000 [#1] PREEMPT SMP KASAN PTI
The failure is due to the below signed divide:
LLONG_MIN/-1 where LLONG_MIN equals to -9,223,372,036,854,775,808.
LLONG_MIN/-1 is supposed to give a positive number 9,223,372,036,854,775,808, but it is impossible since for 64-bit system, the maximum positive number is 9,223,372,036,854,775,807. On x86_64, LLONG_MIN/-1 will cause a kernel exception. On arm64, the result for LLONG_MIN/-1 is LLONG_MIN.
Further investigation found all the following sdiv/smod cases may trigger an exception when bpf program is running on x86_64 platform:
- LLONG_MIN/-1 for 64bit operation
- INT_MIN/-1 for 32bit operation
- LLONG_MIN%-1 for 64bit operation
- INT_MIN%-1 for 32bit operation
where -1 can be an immediate or in a register.
On arm64, there are no exceptions:
- LLONG_MIN/-1 = LLONG_MIN
- INT_MIN/-1 = INT_MIN
- LLONG_MIN%-1 = 0
- INT_MIN%-1 = 0
where -1 can be an immediate or in a register.
Insn patching is needed to handle the above cases and the patched codes produced results aligned with above arm64 result. The below are pseudo codes to handle sdiv/smod exceptions including both divisor -1 and divisor 0 and the divisor is stored in a register.
sdiv:
tmp = rX
tmp += 1 /* [-1, 0] -> [0, 1]
if tmp >(unsigned) 1 goto L2
if tmp == 0 goto L1
rY = 0
L1:
rY = -rY;
goto L3 L2:
rY /= rX
L3:
smod:
tmp = rX
tmp += 1 /* [-1, 0] -> [0, 1]
if tmp >(unsigned) 1 goto L1
if tmp == 1 (is64 ? goto L2 : goto L3)
rY = 0;
goto L2 L1:
rY %= rX
L2:
goto L4 // only when !is64
L3:
wY = wY // only when !is64
L4:
--- kernel/bpf/verifier.c | 93 +++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 89 insertions(+), 4 deletions(-)
kernel/bpf/verifier.c +89 -4
@@ -19953,13 +19953,46 @@ static int do_misc_fixups(struct bpf_verifier_env *env)/* Convert BPF_CLASS(insn->code) == BPF_ALU64 to 32-bit ALU */ insn->code =BPF_ALU |BPF_OP (insn->code) |BPF_SRC (insn->code); -/* Make divide-by-zero exceptions impossible. */ +/* Make sdiv/smod divide-by-minus-one exceptions impossible. */ +if ((insn->code == (BPF_ALU64 |BPF_MOD |BPF_K ) || + insn->code == (BPF_ALU64 |BPF_DIV |BPF_K ) || + insn->code == (BPF_ALU |BPF_MOD |BPF_K ) || + insn->code == (BPF_ALU |BPF_DIV |BPF_K )) && + insn->off ==1 && insn->imm ==-1 ) { +bool is64 =BPF_CLASS (insn->code) ==BPF_ALU64 ; +bool isdiv =BPF_OP (insn->code) ==BPF_DIV ; +struct bpf_insn *patchlet; +struct bpf_insn chk_and_sdiv[] = { +BPF_RAW_INSN ((is64 ?BPF_ALU64 :BPF_ALU ) | +BPF_NEG |BPF_K , insn->dst_reg, +0 ,0 ,0 ), + }; +struct bpf_insn chk_and_smod[] = { +BPF_MOV32_IMM (insn->dst_reg,0 ), + }; + + patchlet = isdiv ? chk_and_sdiv : chk_and_smod; + cnt = isdiv ?ARRAY_SIZE (chk_and_sdiv) :ARRAY_SIZE (chk_and_smod); + + new_prog =bpf_patch_insn_data (env, i + delta, patchlet, cnt); +if (!new_prog) +return -ENOMEM ; + + delta += cnt -1 ; + env->prog = prog = new_prog; + insn = new_prog->insnsi + i + delta; + goto next_insn; + } + +/* Make divide-by-zero and divide-by-minus-one exceptions impossible. */ if (insn->code == (BPF_ALU64 |BPF_MOD |BPF_X ) || insn->code == (BPF_ALU64 |BPF_DIV |BPF_X ) || insn->code == (BPF_ALU |BPF_MOD |BPF_X ) || insn->code == (BPF_ALU |BPF_DIV |BPF_X )) {bool is64 =BPF_CLASS (insn->code) ==BPF_ALU64 ;bool isdiv =BPF_OP (insn->code) ==BPF_DIV ; +bool is_sdiv = isdiv && insn->off ==1 ; +bool is_smod = !isdiv && insn->off ==1 ;struct bpf_insn *patchlet;struct bpf_insn chk_and_div[] = {/* [R,W]x div 0 -> 0 */
@@ -19979,10 +20012,62 @@ static int do_misc_fixups(struct bpf_verifier_env *env)BPF_JMP_IMM (BPF_JA ,0 ,0 ,1 ), BPF_MOV32_REG(insn->dst_reg, insn->dst_reg), }; +struct bpf_insn chk_and_sdiv[] = { +/* [R,W]x sdiv 0 -> 0 +* LLONG_MIN sdiv -1 -> LLONG_MIN +* INT_MIN sdiv -1 -> INT_MIN +*/ +BPF_MOV64_REG (BPF_REG_AX , insn->src_reg), +BPF_RAW_INSN ((is64 ?BPF_ALU64 :BPF_ALU ) | +BPF_ADD |BPF_K ,BPF_REG_AX , +0 ,0 ,1 ), +BPF_RAW_INSN ((is64 ?BPF_JMP :BPF_JMP32 ) | +BPF_JGT |BPF_K ,BPF_REG_AX , +0 ,4 ,1 ), +BPF_RAW_INSN ((is64 ?BPF_JMP :BPF_JMP32 ) | +BPF_JEQ |BPF_K ,BPF_REG_AX , +0 ,1 ,0 ), +BPF_RAW_INSN ((is64 ?BPF_ALU64 :BPF_ALU ) | +BPF_MOV |BPF_K , insn->dst_reg, +0 ,0 ,0 ), +/* BPF_NEG(LLONG_MIN) == -LLONG_MIN == LLONG_MIN */ +BPF_RAW_INSN ((is64 ?BPF_ALU64 :BPF_ALU ) | +BPF_NEG |BPF_K , insn->dst_reg, +0 ,0 ,0 ), +BPF_JMP_IMM (BPF_JA ,0 ,0 ,1 ), + *insn, + }; +struct bpf_insn chk_and_smod[] = { +/* [R,W]x mod 0 -> [R,W]x */ +/* [R,W]x mod -1 -> 0 */ +BPF_MOV64_REG (BPF_REG_AX , insn->src_reg), +BPF_RAW_INSN ((is64 ?BPF_ALU64 :BPF_ALU ) | +BPF_ADD |BPF_K ,BPF_REG_AX , +0 ,0 ,1 ), +BPF_RAW_INSN ((is64 ?BPF_JMP :BPF_JMP32 ) | +BPF_JGT |BPF_K ,BPF_REG_AX , +0 ,3 ,1 ), +BPF_RAW_INSN ((is64 ?BPF_JMP :BPF_JMP32 ) | +BPF_JEQ |BPF_K ,BPF_REG_AX , +0 ,3 + (is64 ?0 :1 ),1 ), +BPF_MOV32_IMM (insn->dst_reg,0 ), +BPF_JMP_IMM (BPF_JA ,0 ,0 ,1 ), + *insn, +BPF_JMP_IMM (BPF_JA ,0 ,0 ,1 ), +BPF_MOV32_REG (insn->dst_reg, insn->dst_reg), + }; - patchlet = isdiv ? chk_and_div : chk_and_mod; - cnt = isdiv ?ARRAY_SIZE (chk_and_div) : -ARRAY_SIZE (chk_and_mod) - (is64 ?2 :0 ); +if (is_sdiv) { + patchlet = chk_and_sdiv; + cnt =ARRAY_SIZE (chk_and_sdiv); + }else if (is_smod) { + patchlet = chk_and_smod; + cnt =ARRAY_SIZE (chk_and_smod) - (is64 ?2 :0 ); + }else { + patchlet = isdiv ? chk_and_div : chk_and_mod; + cnt = isdiv ?ARRAY_SIZE (chk_and_div) : +ARRAY_SIZE (chk_and_mod) - (is64 ?2 :0 ); + } new_prog =bpf_patch_insn_data (env, i + delta, patchlet, cnt);if (!new_prog)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 314/558 EINJ, CXL: Fix CXL device SBDF calculation
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Cheatham <[email protected]>
[ Upstream commit ee1e3c46ed19c096be22472c728fa7f68b1352c4 ]
The SBDF of the target CXL 2.0 compliant root port is required to inject a CXL protocol error as per ACPI 6.5. The SBDF given has to be in the following format:
31 24 23 16 15 11 10 8 7 0
+-------------------------------------------------+ | segment | bus | device | function | reserved | +-------------------------------------------------+
The SBDF calculated in cxl_dport_get_sbdf() doesn't account for the reserved bits currently, causing the wrong SBDF to be used. Fix said calculation to properly shift the SBDF.
Without this fix, error injection into CXL 2.0 root ports through the CXL debugfs interface (<debugfs>/cxl) is broken. Injection through the legacy interface (<debugfs>/apei/einj/) will still work because the SBDF is manually provided by the user.
--- drivers/acpi/apei/einj-cxl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/apei/einj-cxl.c +1 -1
@@ -63,7 +63,7 @@ static int cxl_dport_get_sbdf(struct pci_dev *dport_dev, u64 *sbdf) seg = bridge->domain_nr; bus = pbus->number; - *sbdf = (seg <<24 ) | (bus <<16 ) | dport_dev->devfn; + *sbdf = (seg <<24 ) | (bus <<16 ) | (dport_dev->devfn <<8 );return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 315/558 spi: spi-imx: Fix pm_runtime_set_suspended() with runtime pm enabled
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit b6e05ba0844139dde138625906015c974c86aa93 ]
It is not valid to call pm_runtime_set_suspended() for devices with runtime PM enabled because it returns -EAGAIN if it is enabled already and working. So, call pm_runtime_disable() before to fix it.
--- drivers/spi/spi-imx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-imx.c +1 -1
@@ -1865,8 +1865,8 @@ static int spi_imx_probe(struct platform_device *pdev)spi_imx_sdma_exit (spi_imx); out_runtime_pm_put:pm_runtime_dont_use_autosuspend (spi_imx->dev); -pm_runtime_set_suspended (&pdev->dev);pm_runtime_disable (spi_imx->dev); +pm_runtime_set_suspended (&pdev->dev);clk_disable_unprepare (spi_imx->clk_ipg); out_put_per:
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 316/558 spi: spi-cadence: Fix pm_runtime_set_suspended() with runtime pm enabled
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 67d4a70faa662df07451e83db1546d3ca0695e08 ]
It is not valid to call pm_runtime_set_suspended() for devices with runtime PM enabled because it returns -EAGAIN if it is enabled already and working. So, call pm_runtime_disable() before to fix it.
--- drivers/spi/spi-cadence.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/spi/spi-cadence.c +2 -2
@@ -678,8 +678,8 @@ static int cdns_spi_probe(struct platform_device *pdev) clk_dis_all:if (!spi_controller_is_target (ctlr)) { -pm_runtime_set_suspended (&pdev->dev);pm_runtime_disable (&pdev->dev); +pm_runtime_set_suspended (&pdev->dev); } remove_ctlr:spi_controller_put (ctlr);
@@ -701,8 +701,8 @@ static void cdns_spi_remove(struct platform_device *pdev)cdns_spi_write (xspi,CDNS_SPI_ER ,CDNS_SPI_ER_DISABLE ); -pm_runtime_set_suspended (&pdev->dev);pm_runtime_disable (&pdev->dev); +pm_runtime_set_suspended (&pdev->dev);spi_unregister_controller (ctlr); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 317/558 spi: spi-cadence: Fix missing spi_controller_is_target() check
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 3eae4a916fc0eb6f85b5d399e10335dbd24dd765 ]
The spi_controller_is_target() check is missing for pm_runtime_disable() in cdns_spi_remove(), add it.
--- drivers/spi/spi-cadence.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/spi/spi-cadence.c +4 -2
@@ -701,8 +701,10 @@ static void cdns_spi_remove(struct platform_device *pdev)cdns_spi_write (xspi,CDNS_SPI_ER ,CDNS_SPI_ER_DISABLE ); -pm_runtime_disable (&pdev->dev); -pm_runtime_set_suspended (&pdev->dev); +if (!spi_controller_is_target (ctlr)) { +pm_runtime_disable (&pdev->dev); +pm_runtime_set_suspended (&pdev->dev); + }spi_unregister_controller (ctlr); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 318/558 selftest: hid: add missing run-hid-tools-tests.sh
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yun Lu <[email protected]>
[ Upstream commit 160c826b4dd0d570f0f51cf002cb49bda807e9f5 ]
HID test cases run tests using the run-hid-tools-tests.sh script. When installed with "make install", the run-hid-tools-tests.sh script will not be copied over, resulting in the following error message.
make -C tools/testing/selftests/ TARGETS=hid install \ INSTALL_PATH=$KSFT_INSTALL_PATH
cd $KSFT_INSTALL_PATH
./run_kselftest.sh -c hid
selftests: hid: hid-core.sh
bash: ./run-hid-tools-tests.sh: No such file or directory
Add the run-hid-tools-tests.sh script to the TEST_FILES in the Makefile for it to be installed.
--- tools/testing/selftests/hid/Makefile | 2 ++ 1 file changed, 2 insertions(+)
tools/testing/selftests/hid/Makefile +2 -0
@@ -17,6 +17,8 @@ TEST_PROGS += hid-tablet.sh TEST_PROGS += hid-usb_crash.sh TEST_PROGS += hid-wacom.sh +TEST_FILES := run-hid-tools-tests.sh + CXX ?= $(CROSS_COMPILE)g++ HOSTPKG_CONFIG := pkg-config
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 319/558 spi: s3c64xx: fix timeout counters in flush_fifo
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Dooks <[email protected]>
[ Upstream commit 68a16708d2503b6303d67abd43801e2ca40c208d ]
In the s3c64xx_flush_fifo() code, the loops counter is post-decremented in the do { } while(test && loops--) condition. This means the loops is left at the unsigned equivalent of -1 if the loop times out. The test after will never pass as if tests for loops == 0.
--- drivers/spi/spi-s3c64xx.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/spi/spi-s3c64xx.c +2 -2
@@ -245,7 +245,7 @@ static void s3c64xx_flush_fifo(struct s3c64xx_spi_driver_data *sdd) loops =msecs_to_loops (1 );do { val =readl (regs +S3C64XX_SPI_STATUS ); - }while (TX_FIFO_LVL (val, sdd) && loops--); + }while (TX_FIFO_LVL (val, sdd) && --loops);if (loops ==0 )dev_warn (&sdd->pdev->dev,"Timed out flushing TX FIFO\n" );
@@ -258,7 +258,7 @@ static void s3c64xx_flush_fifo(struct s3c64xx_spi_driver_data *sdd)readl (regs +S3C64XX_SPI_RX_DATA ); else break; - }while (loops--); + }while (--loops);if (loops ==0 )dev_warn (&sdd->pdev->dev,"Timed out flushing RX FIFO\n" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 320/558 kselftest/devices/probe: Fix SyntaxWarning in regex strings for Python3
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alessandro Zanni <[email protected]>
[ Upstream commit a19008256d05e726f29f43c6a307e45482c082c3 ]
Insert raw strings to prevent Python3 from interpreting string literals as Unicode strings and "\d" as invalid escaped sequence.
Fix the warnings:
tools/testing/selftests/devices/probe/test_discoverable_devices.py:48:
SyntaxWarning: invalid escape sequence '\d' usb_controller_sysfs_dir = "usb[\d]+"
tools/testing/selftests/devices/probe/test_discoverable_devices.py: 94:
SyntaxWarning: invalid escape sequence '\d' re_usb_version = re.compile("PRODUCT=.*/(\d)/.*")
--- .../selftests/devices/probe/test_discoverable_devices.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/testing/selftests/devices/probe/test_discoverable_devices.py +2 -2
@@ -45,7 +45,7 @@ def find_pci_controller_dirs(): def find_usb_controller_dirs(): - usb_controller_sysfs_dir = "usb[\d]+" + usb_controller_sysfs_dir = r"usb[\d]+" dir_regex = re.compile(usb_controller_sysfs_dir) for d in os.scandir(sysfs_usb_devices):
@@ -91,7 +91,7 @@ def get_acpi_uid(sysfs_dev_dir): def get_usb_version(sysfs_dev_dir): - re_usb_version = re.compile("PRODUCT=.*/(\d)/.*") + re_usb_version = re.compile(r"PRODUCT=.*/(\d)/.*") with open(os.path.join(sysfs_dev_dir, "uevent")) as f: return int(re_usb_version.search(f.read()).group(1))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 321/558 selftests: breakpoints: use remaining time to check if suspend succeed
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yifei Liu <[email protected]>
[ Upstream commit c66be905cda24fb782b91053b196bd2e966f95b7 ]
step_after_suspend_test fails with device busy error while writing to /sys/power/state to start suspend. The test believes it failed to enter suspend state with
$ sudo ./step_after_suspend_test TAP version 13 Bail out! Failed to enter Suspend state
However, in the kernel message, I indeed see the system get suspended and then wake up later.
[611172.033108] PM: suspend entry (s2idle) [611172.044940] Filesystems sync: 0.006 seconds [611172.052254] Freezing user space processes [611172.059319] Freezing user space processes completed (elapsed 0.001 seconds) [611172.067920] OOM killer disabled. [611172.072465] Freezing remaining freezable tasks [611172.080332] Freezing remaining freezable tasks completed (elapsed 0.001 seconds) [611172.089724] printk: Suspending console(s) (use no_console_suspend to debug) [611172.117126] serial 00:03: disabled some other hardware get reconnected [611203.136277] OOM killer enabled. [611203.140637] Restarting tasks ... [611203.141135] usb 1-8.1: USB disconnect, device number 7 [611203.141755] done. [611203.155268] random: crng reseeded on system resumption [611203.162059] PM: suspend exit
After investigation, I noticed that for the code block if (write(power_state_fd, "mem", strlen("mem")) != strlen("mem"))
ksft_exit_fail_msg("Failed to enter Suspend state\n");The write will return -1 and errno is set to 16 (device busy). It should be caused by the write function is not successfully returned before the system suspend and the return value get messed when waking up. As a result, It may be better to check the time passed of those few instructions to determine whether the suspend is executed correctly for it is pretty hard to execute those few lines for 5 seconds.
The timer to wake up the system is set to expire after 5 seconds and no re-arm. If the timer remaining time is 0 second and 0 nano secomd, it means the timer expired and wake the system up. Otherwise, the system could be considered to enter the suspend state failed if there is any remaining time.
After appling this patch, the test would not fail for it believes the system does not go to suspend by mistake. It now could continue to the rest part of the test after suspend.
--- .../testing/selftests/breakpoints/step_after_suspend_test.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
tools/testing/selftests/breakpoints/step_after_suspend_test.c +4 -1
@@ -152,7 +152,10 @@ void suspend(void)if (err <0 )ksft_exit_fail_msg ("timerfd_settime() failed\n" ); -if (write (power_state_fd,"mem" ,strlen ("mem" )) !=strlen ("mem" )) +system ("(echo mem > /sys/power/state) 2> /dev/null" ); + +timerfd_gettime (timerfd, &spec); +if (spec.it_value.tv_sec !=0 || spec.it_value.tv_nsec !=0 )ksft_exit_fail_msg ("Failed to enter Suspend state\n" );close (timerfd);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 322/558 accel/ivpu: Add missing MODULE_FIRMWARE metadata
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander F. Lent <[email protected]>
[ Upstream commit 58b5618ba80a5e5a8d531a70eae12070e5bd713f ]
Modules that load firmware from various paths at runtime must declare those paths at compile time, via the MODULE_FIRMWARE macro, so that the firmware paths are included in the module's metadata.
The accel/ivpu driver loads firmware but lacks this metadata, preventing dracut from correctly locating firmware files. Fix it.
--- drivers/accel/ivpu/ivpu_fw.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/accel/ivpu/ivpu_fw.c +4 -0
@@ -60,6 +60,10 @@ static struct { { IVPU_HW_IP_40XX, "intel/vpu/vpu_40xx_v0.0.bin" }, }; +/* Production fw_names from the table above */ +MODULE_FIRMWARE ("intel/vpu/vpu_37xx_v0.0.bin" ); +MODULE_FIRMWARE ("intel/vpu/vpu_40xx_v0.0.bin" ); +static int ivpu_fw_request (struct ivpu_device *vdev) {int ret = -ENOENT ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 323/558 spi: rpc-if: Add missing MODULE_DEVICE_TABLE
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <[email protected]>
[ Upstream commit 0880f669436028c5499901e5acd8f4b4ea0e0c6a ]
Add missing MODULE_DEVICE_TABLE definition for automatic loading of the driver when it is built as a module.
--- drivers/spi/spi-rpc-if.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/spi/spi-rpc-if.c +7 -0
@@ -198,9 +198,16 @@ static int __maybe_unused rpcif_spi_resume(struct device *dev) static SIMPLE_DEV_PM_OPS(rpcif_spi_pm_ops, rpcif_spi_suspend, rpcif_spi_resume); +static const struct platform_device_id rpc_if_spi_id_table[] = { + { .name ="rpc-if-spi" }, + {/* sentinel */ } +}; +MODULE_DEVICE_TABLE (platform, rpc_if_spi_id_table); +static struct platform_driver rpcif_spi_driver = { .probe = rpcif_spi_probe, .remove_new = rpcif_spi_remove, + .id_table = rpc_if_spi_id_table, .driver = { .name ="rpc-if-spi" , #ifdef CONFIG_PM_SLEEP
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 324/558 ALSA: control: Fix power_ref lock order for compat code, too
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit a1066453b5e49a28523f3ecbbfe4e06c6a29561c ]
In the previous change for swapping the power_ref and controls_rwsem lock order, the code path for the compat layer was forgotten. This patch covers the remaining code.
--- sound/core/control_compat.c | 45 ++++++++++++++++++++++++++++++------- 1 file changed, 37 insertions(+), 8 deletions(-)
sound/core/control_compat.c +37 -8
@@ -79,6 +79,7 @@ struct snd_ctl_elem_info32 {static int snd_ctl_elem_info_compat (struct snd_ctl_file *ctl,struct snd_ctl_elem_info32 __user *data32) { +struct snd_card *card = ctl->card; struct snd_ctl_elem_info *data __free(kfree) = NULL;int err;
@@ -95,7 +96,11 @@ static int snd_ctl_elem_info_compat(struct snd_ctl_file *ctl,if (get_user (data->value.enumerated.item, &data32->value.enumerated.item))return -EFAULT ; + err =snd_power_ref_and_wait (card); +if (err <0 ) +return err; err =snd_ctl_elem_info (ctl, data); +snd_power_unref (card);if (err <0 )return err;/* restore info to 32bit */
@@ -175,10 +180,7 @@ static int get_ctl_type(struct snd_card *card, struct snd_ctl_elem_id *id,if (info ==NULL )return -ENOMEM ; info->id = *id; - err =snd_power_ref_and_wait (card); -if (!err) - err = kctl->info (kctl, info); -snd_power_unref (card); + err = kctl->info (kctl, info);if (err >=0 ) { err = info->type; *countp = info->count;
@@ -275,8 +277,8 @@ static int copy_ctl_value_to_user(void __user *userdata,return 0 ; } -static int ctl_elem_read_user (struct snd_card *card, -void __user *userdata,void __user *valuep) +static int __ctl_elem_read_user (struct snd_card *card, +void __user *userdata,void __user *valuep) { struct snd_ctl_elem_value *data __free(kfree) = NULL;int err, type, count;
@@ -296,8 +298,21 @@ static int ctl_elem_read_user(struct snd_card *card,return copy_ctl_value_to_user (userdata, valuep, data, type, count); } -static int ctl_elem_write_user (struct snd_ctl_file *file, -void __user *userdata,void __user *valuep) +static int ctl_elem_read_user (struct snd_card *card, +void __user *userdata,void __user *valuep) +{ +int err; + + err =snd_power_ref_and_wait (card); +if (err <0 ) +return err; + err =__ctl_elem_read_user (card, userdata, valuep); +snd_power_unref (card); +return err; +} + +static int __ctl_elem_write_user (struct snd_ctl_file *file, +void __user *userdata,void __user *valuep) { struct snd_ctl_elem_value *data __free(kfree) = NULL;struct snd_card *card = file->card;
@@ -318,6 +333,20 @@ static int ctl_elem_write_user(struct snd_ctl_file *file,return copy_ctl_value_to_user (userdata, valuep, data, type, count); } +static int ctl_elem_write_user (struct snd_ctl_file *file, +void __user *userdata,void __user *valuep) +{ +struct snd_card *card = file->card; +int err; + + err =snd_power_ref_and_wait (card); +if (err <0 ) +return err; + err =__ctl_elem_write_user (file, userdata, valuep); +snd_power_unref (card); +return err; +} +static int snd_ctl_elem_read_user_compat (struct snd_card *card,struct snd_ctl_elem_value32 __user *data32) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 325/558 perf callchain: Fix stitch LBR memory leaks
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 599c19397b17d197fc1184bbc950f163a292efc9 ]
The 'struct callchain_cursor_node' has a 'struct map_symbol' whose maps and map members are reference counted. Ensure these values use a _get routine to increment the reference counts and use map_symbol__exit() to release the reference counts.
Do similar for 'struct thread's prev_lbr_cursor, but save the size of the prev_lbr_cursor array so that it may be iterated.
Ensure that when stitch_nodes are placed on the free list the map_symbols are exited.
Fix resolve_lbr_callchain_sample() by replacing list_replace_init() to list_splice_init(), so the whole list is moved and nodes aren't leaked.
A reproduction of the memory leaks is possible with a leak sanitizer build in the perf report command of:
``` $ perf record -e cycles --call-graph lbr perf test -w thloop $ perf report --stitch-lbr ```
--- tools/perf/util/machine.c | 17 +++++++++++++++-- tools/perf/util/thread.c | 4 ++++ tools/perf/util/thread.h | 1 + 3 files changed, 20 insertions(+), 2 deletions(-)
tools/perf/util/machine.c +15 -2
@@ -2270,8 +2270,12 @@ static void save_lbr_cursor_node(struct thread *thread, cursor->curr = cursor->first; else cursor->curr = cursor->curr->next; + +map_symbol__exit (&lbr_stitch->prev_lbr_cursor[idx].ms);memcpy (&lbr_stitch->prev_lbr_cursor[idx], cursor->curr,sizeof (struct callchain_cursor_node )); + lbr_stitch->prev_lbr_cursor[idx].ms.maps =maps__get (cursor->curr->ms.maps); + lbr_stitch->prev_lbr_cursor[idx].ms.map =map__get (cursor->curr->ms.map); lbr_stitch->prev_lbr_cursor[idx].valid = true; cursor->pos++;
@@ -2482,6 +2486,9 @@ static bool has_stitched_lbr(struct thread *thread,memcpy (&stitch_node->cursor, &lbr_stitch->prev_lbr_cursor[i],sizeof (struct callchain_cursor_node )); + stitch_node->cursor.ms.maps =maps__get (lbr_stitch->prev_lbr_cursor[i].ms.maps); + stitch_node->cursor.ms.map =map__get (lbr_stitch->prev_lbr_cursor[i].ms.map); +if (callee)list_add (&stitch_node->node, &lbr_stitch->lists);else
@@ -2505,6 +2512,8 @@ static bool alloc_lbr_stitch(struct thread *thread, unsigned int max_lbr)if (!thread__lbr_stitch (thread)->prev_lbr_cursor) goto free_lbr_stitch; +thread__lbr_stitch (thread)->prev_lbr_cursor_size = max_lbr +1 ; +INIT_LIST_HEAD (&thread__lbr_stitch (thread)->lists);INIT_LIST_HEAD (&thread__lbr_stitch (thread)->free_lists);
@@ -2560,8 +2569,12 @@ static int resolve_lbr_callchain_sample(struct thread *thread, max_lbr, callee);if (!stitched_lbr && !list_empty (&lbr_stitch->lists)) { -list_replace_init (&lbr_stitch->lists, - &lbr_stitch->free_lists); +struct stitch_list *stitch_node; + +list_for_each_entry (stitch_node, &lbr_stitch->lists, node) +map_symbol__exit (&stitch_node->cursor.ms); + +list_splice_init (&lbr_stitch->lists, &lbr_stitch->free_lists); }memcpy (&lbr_stitch->prev_sample, sample,sizeof (*sample)); }
tools/perf/util/thread.c +4 -0
@@ -476,6 +476,7 @@ void thread__free_stitch_list(struct thread *thread)return ;list_for_each_entry_safe (pos, tmp, &lbr_stitch->lists, node) { +map_symbol__exit (&pos->cursor.ms);list_del_init (&pos->node);free (pos); }
@@ -485,6 +486,9 @@ void thread__free_stitch_list(struct thread *thread)free (pos); } +for (unsigned int i =0 ; i < lbr_stitch->prev_lbr_cursor_size; i++) +map_symbol__exit (&lbr_stitch->prev_lbr_cursor[i].ms); +zfree (&lbr_stitch->prev_lbr_cursor);free (thread__lbr_stitch (thread));thread__set_lbr_stitch (thread,NULL );
tools/perf/util/thread.h +1 -0
@@ -26,6 +26,7 @@ struct lbr_stitch {struct list_head free_lists;struct perf_sample prev_sample;struct callchain_cursor_node *prev_lbr_cursor; +unsigned int prev_lbr_cursor_size; };DECLARE_RC_STRUCT (thread) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 326/558 perf: Really fix event_function_call() locking
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namhyung Kim <[email protected]>
[ Upstream commit fe826cc2654e8561b64246325e6a51b62bf2488c ]
Commit 558abc7e3f89 ("perf: Fix event_function_call() locking") lost IRQ disabling by mistake.
--- kernel/events/core.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
kernel/events/core.c +8 -5
@@ -263,8 +263,8 @@ static int event_function(void *info)static void event_function_call (struct perf_event *event,event_f func,void *data) {struct perf_event_context *ctx = event->ctx; -struct perf_cpu_context *cpuctx =this_cpu_ptr (&perf_cpu_context);struct task_struct *task =READ_ONCE (ctx->task);/* verified in event_function */ +struct perf_cpu_context *cpuctx;struct event_function_struct efs = { .event = event, .func = func,
@@ -292,22 +292,25 @@ static void event_function_call(struct perf_event *event, event_f func, void *daif (!task_function_call (task, event_function, &efs))return ; +local_irq_disable (); + cpuctx =this_cpu_ptr (&perf_cpu_context);perf_ctx_lock (cpuctx, ctx);/* * Reload the task pointer, it might have been changed by * a concurrent perf_event_context_sched_out(). */ task = ctx->task; -if (task ==TASK_TOMBSTONE ) { -perf_ctx_unlock (cpuctx, ctx); -return ; - } +if (task ==TASK_TOMBSTONE ) + goto unlock;if (ctx->is_active) {perf_ctx_unlock (cpuctx, ctx); +local_irq_enable (); goto again; }func (event,NULL , ctx, data); +unlock:perf_ctx_unlock (cpuctx, ctx); +local_irq_enable (); }/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 327/558 drm/xe: fixup xe_alloc_pf_queue
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Auld <[email protected]>
[ Upstream commit 321d6b4b9cbe3dd0bc99937d5e5b4d730b5b5798 ]
kzalloc expects number of bytes, therefore we should convert the number of dw into bytes, otherwise we are likely just accessing beyond the array causing all kinds of carnage. Also fixup the error handling while we are here.
v2:
- Prefer kcalloc (dim)
--- drivers/gpu/drm/xe/xe_gt_pagefault.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/gpu/drm/xe/xe_gt_pagefault.c +4 -1
@@ -417,7 +417,10 @@ static int xe_alloc_pf_queue(struct xe_gt *gt, struct pf_queue *pf_queue) (num_eus +XE_NUM_HW_ENGINES ) *PF_MSG_LEN_DW ; pf_queue->gt = gt; - pf_queue->data =kzalloc (pf_queue->num_dw,GFP_KERNEL ); + pf_queue->data =kcalloc (pf_queue->num_dw,sizeof (u32),GFP_KERNEL ); +if (!pf_queue->data) +return -ENOMEM ; +spin_lock_init (&pf_queue->lock);INIT_WORK (&pf_queue->worker, pf_queue_work_func);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 328/558 drm/xe: Fix memory leak on xe_alloc_pf_queue failure
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nirmoy Das <[email protected]>
[ Upstream commit c5f728de696caa35481fd84202dfbc9fecc18e0b ]
Simplify memory unwinding on error also fixing current memory leak that can happen on error.
v2: use devm_kcalloc(Matt A)
--- drivers/gpu/drm/xe/xe_gt_pagefault.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
drivers/gpu/drm/xe/xe_gt_pagefault.c +3 -5
@@ -388,20 +388,17 @@ static void pagefault_fini(void *arg) {struct xe_gt *gt = arg;struct xe_device *xe =gt_to_xe (gt); -int i;if (!xe->info.has_usm)return ;destroy_workqueue (gt->usm.acc_wq);destroy_workqueue (gt->usm.pf_wq); - -for (i =0 ; i <NUM_PF_QUEUE ; ++i) -kfree (gt->usm.pf_queue[i].data); }static int xe_alloc_pf_queue (struct xe_gt *gt,struct pf_queue *pf_queue) { +struct xe_device *xe =gt_to_xe (gt);xe_dss_mask_t all_dss;int num_dss, num_eus;
@@ -417,7 +414,8 @@ static int xe_alloc_pf_queue(struct xe_gt *gt, struct pf_queue *pf_queue) (num_eus +XE_NUM_HW_ENGINES ) *PF_MSG_LEN_DW ; pf_queue->gt = gt; - pf_queue->data =kcalloc (pf_queue->num_dw,sizeof (u32),GFP_KERNEL ); + pf_queue->data =devm_kcalloc (xe->drm.dev, pf_queue->num_dw, +sizeof (u32),GFP_KERNEL );if (!pf_queue->data)return -ENOMEM ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 329/558 selftests: vDSO: fix vDSO name for powerpc
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit 59eb856c3ed9b3552befd240c0c339f22eed3fa1 ]
Following error occurs when running vdso_test_correctness on powerpc:
~ # ./vdso_test_correctness
[WARN] failed to find vDSO
[SKIP] No vDSO, so skipping clock_gettime() tests
[SKIP] No vDSO, so skipping clock_gettime64() tests
[RUN] Testing getcpu...
[OK] CPU 0: syscall: cpu 0, node 0
On powerpc, vDSO is neither called linux-vdso.so.1 nor linux-gate.so.1 but linux-vdso32.so.1 or linux-vdso64.so.1.
Also search those two names before giving up.
--- tools/testing/selftests/vDSO/vdso_test_correctness.c | 6 ++++++ 1 file changed, 6 insertions(+)
tools/testing/selftests/vDSO/vdso_test_correctness.c +6 -0
@@ -114,6 +114,12 @@ static void fill_function_pointers()if (!vdso) vdso =dlopen ("linux-gate.so.1" ,RTLD_LAZY |RTLD_LOCAL |RTLD_NOLOAD ); +if (!vdso) + vdso =dlopen ("linux-vdso32.so.1" , +RTLD_LAZY |RTLD_LOCAL |RTLD_NOLOAD ); +if (!vdso) + vdso =dlopen ("linux-vdso64.so.1" , +RTLD_LAZY |RTLD_LOCAL |RTLD_NOLOAD );if (!vdso) {printf ("[WARN]\tfailed to find vDSO\n" );return ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 330/558 selftests: vDSO: fix vdso_config for powerpc
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit 7d297c419b08eafa69ce27243ee9bbecab4fcaa4 ]
Running vdso_test_correctness on powerpc64 gives the following warning:
~ # ./vdso_test_correctness
Warning: failed to find clock_gettime64 in vDSO
This is because vdso_test_correctness was built with VDSO_32BIT defined.
__powerpc__ macro is defined on both powerpc32 and powerpc64 so __powerpc64__ needs to be checked first in vdso_config.h
--- tools/testing/selftests/vDSO/vdso_config.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
tools/testing/selftests/vDSO/vdso_config.h +3 -3
@@ -18,13 +18,13 @@#elif defined(__aarch64__)#define VDSO_VERSION 3#define VDSO_NAMES 0 -#elif defined(__powerpc__) +#elif defined(__powerpc64__)#define VDSO_VERSION 1#define VDSO_NAMES 0 -#define VDSO_32BIT 1 -#elif defined(__powerpc64__) +#elif defined(__powerpc__)#define VDSO_VERSION 1#define VDSO_NAMES 0 +#define VDSO_32BIT 1#elif defined (__s390__)#define VDSO_VERSION 2#define VDSO_NAMES 0
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 331/558 selftests: vDSO: fix vDSO symbols lookup for powerpc64
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit ba83b3239e657469709d15dcea5f9b65bf9dbf34 ]
On powerpc64, following tests fail locating vDSO functions:
~ # ./vdso_test_abi
TAP version 13
1..16
# [vDSO kselftest] VDSO_VERSION: LINUX_2.6.15 # Couldn't find __kernel_gettimeofday
ok 1 # SKIP __kernel_gettimeofday
# clock_id: CLOCK_REALTIME
# Couldn't find __kernel_clock_gettime
ok 2 # SKIP __kernel_clock_gettime CLOCK_REALTIME # Couldn't find __kernel_clock_getres
ok 3 # SKIP __kernel_clock_getres CLOCK_REALTIME
...
# Couldn't find __kernel_time
ok 16 # SKIP __kernel_time
# Totals: pass:0 fail:0 xfail:0 xpass:0 skip:16 error:0
~ # ./vdso_test_getrandom
__kernel_getrandom is missing!
~ # ./vdso_test_gettimeofday
Could not find __kernel_gettimeofday
~ # ./vdso_test_getcpu
Could not find __kernel_getcpu
On powerpc64, as shown below by readelf, vDSO functions symbols have type NOTYPE, so also accept that type when looking for symbols.
$ powerpc64-linux-gnu-readelf -a arch/powerpc/kernel/vdso/vdso64.so.dbg ELF Header: Magic: 7f 45 4c 46 02 02 01 00 00 00 00 00 00 00 00 00 Class: ELF64 Data: 2's complement, big endian Version: 1 (current) OS/ABI: UNIX - System V ABI Version: 0 Type: DYN (Shared object file) Machine: PowerPC64 Version: 0x1 ...
Symbol table '.dynsym' contains 12 entries:
Num: Value Size Type Bind Vis Ndx Name
0: 0000000000000000 0 NOTYPE LOCAL DEFAULT UND
1: 0000000000000524 84 NOTYPE GLOBAL DEFAULT 8 __[...]@@LINUX_2.6.15
2: 00000000000005f0 36 NOTYPE GLOBAL DEFAULT 8 __[...]@@LINUX_2.6.15
3: 0000000000000578 68 NOTYPE GLOBAL DEFAULT 8 __[...]@@LINUX_2.6.15
4: 0000000000000000 0 OBJECT GLOBAL DEFAULT ABS LINUX_2.6.15
5: 00000000000006c0 48 NOTYPE GLOBAL DEFAULT 8 __[...]@@LINUX_2.6.15
6: 0000000000000614 172 NOTYPE GLOBAL DEFAULT 8 __[...]@@LINUX_2.6.15
7: 00000000000006f0 84 NOTYPE GLOBAL DEFAULT 8 __[...]@@LINUX_2.6.15
8: 000000000000047c 84 NOTYPE GLOBAL DEFAULT 8 __[...]@@LINUX_2.6.15
9: 0000000000000454 12 NOTYPE GLOBAL DEFAULT 8 __[...]@@LINUX_2.6.15
10: 00000000000004d0 84 NOTYPE GLOBAL DEFAULT 8 __[...]@@LINUX_2.6.15
11: 00000000000005bc 52 NOTYPE GLOBAL DEFAULT 8 __[...]@@LINUX_2.6.15Symbol table '.symtab' contains 56 entries:
Num: Value Size Type Bind Vis Ndx Name
...
45: 0000000000000000 0 OBJECT GLOBAL DEFAULT ABS LINUX_2.6.15
46: 00000000000006c0 48 NOTYPE GLOBAL DEFAULT 8 __kernel_getcpu
47: 0000000000000524 84 NOTYPE GLOBAL DEFAULT 8 __kernel_clock_getres
48: 00000000000005f0 36 NOTYPE GLOBAL DEFAULT 8 __kernel_get_tbfreq
49: 000000000000047c 84 NOTYPE GLOBAL DEFAULT 8 __kernel_gettimeofday
50: 0000000000000614 172 NOTYPE GLOBAL DEFAULT 8 __kernel_sync_dicache
51: 00000000000006f0 84 NOTYPE GLOBAL DEFAULT 8 __kernel_getrandom
52: 0000000000000454 12 NOTYPE GLOBAL DEFAULT 8 __kernel_sigtram[...]
53: 0000000000000578 68 NOTYPE GLOBAL DEFAULT 8 __kernel_time
54: 00000000000004d0 84 NOTYPE GLOBAL DEFAULT 8 __kernel_clock_g[...]
55: 00000000000005bc 52 NOTYPE GLOBAL DEFAULT 8 __kernel_get_sys[...]--- tools/testing/selftests/vDSO/parse_vdso.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
tools/testing/selftests/vDSO/parse_vdso.c +2 -1
@@ -216,7 +216,8 @@ void *vdso_sym(const char *version, const char *name)ELF (Sym) *sym = &vdso_info.symtab[chain];/* Check for a defined global or weak function w/ right name. */ -if (ELF64_ST_TYPE (sym->st_info) !=STT_FUNC ) +if (ELF64_ST_TYPE (sym->st_info) !=STT_FUNC && +ELF64_ST_TYPE (sym->st_info) !=STT_NOTYPE )continue ;if (ELF64_ST_BIND (sym->st_info) !=STB_GLOBAL &&ELF64_ST_BIND (sym->st_info) !=STB_WEAK )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 332/558 ext4: fix error message when rejecting the default hash
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabriel Krisman Bertazi <[email protected]>
[ Upstream commit a2187431c395cdfbf144e3536f25468c64fc7cfa ]
Commit 985b67cd8639 ("ext4: filesystems without casefold feature cannot be mounted with siphash") properly rejects volumes where s_def_hash_version is set to DX_HASH_SIPHASH, but the check and the error message should not look into casefold setup - a filesystem should never have DX_HASH_SIPHASH as the default hash. Fix it and, since we are there, move the check to ext4_hash_info_init.
be mounted with siphash")
--- fs/ext4/ext4.h | 1 + fs/ext4/super.c | 27 +++++++++++++++++---------- 2 files changed, 18 insertions(+), 10 deletions(-)
fs/ext4/ext4.h +1 -0
@@ -2462,6 +2462,7 @@ static inline __le16 ext4_rec_len_to_disk(unsigned len, unsigned blocksize)#define DX_HASH_HALF_MD4_UNSIGNED 4#define DX_HASH_TEA_UNSIGNED 5#define DX_HASH_SIPHASH 6 +#define DX_HASH_LAST DX_HASH_SIPHASHstatic inline u32 ext4_chksum (struct ext4_sb_info *sbi,u32 crc,const void *address,unsigned int length)
fs/ext4/super.c +17 -10
@@ -3583,13 +3583,6 @@ int ext4_feature_set_ok(struct super_block *sb, int readonly) "mounted without CONFIG_UNICODE");return 0 ; } -if (EXT4_SB (sb)->s_es->s_def_hash_version ==DX_HASH_SIPHASH && - !ext4_has_feature_casefold (sb)) { -ext4_msg (sb,KERN_ERR , -"Filesystem without casefold feature cannot be " -"mounted with siphash" ); -return 0 ; - }if (readonly)return 1 ;
@@ -5095,16 +5088,27 @@ static int ext4_load_super(struct super_block *sb, ext4_fsblk_t *lsb,return ret; } -static void ext4_hash_info_init (struct super_block *sb) +static int ext4_hash_info_init (struct super_block *sb) {struct ext4_sb_info *sbi =EXT4_SB (sb);struct ext4_super_block *es = sbi->s_es;unsigned int i; + sbi->s_def_hash_version = es->s_def_hash_version; + +if (sbi->s_def_hash_version >DX_HASH_LAST ) { +ext4_msg (sb,KERN_ERR , +"Invalid default hash set in the superblock" ); +return -EINVAL ; + }else if (sbi->s_def_hash_version ==DX_HASH_SIPHASH ) { +ext4_msg (sb,KERN_ERR , +"SIPHASH is not a valid default hash value" ); +return -EINVAL ; + } +for (i =0 ; i <4 ; i++) sbi->s_hash_seed[i] =le32_to_cpu (es->s_hash_seed[i]); - sbi->s_def_hash_version = es->s_def_hash_version;if (ext4_has_feature_dir_index (sb)) { i =le32_to_cpu (es->s_flags);if (i &EXT2_FLAGS_UNSIGNED_HASH )
@@ -5122,6 +5126,7 @@ static void ext4_hash_info_init(struct super_block *sb)#endif } } +return 0 ; }static int ext4_block_group_meta_init (struct super_block *sb,int silent)
@@ -5269,7 +5274,9 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb)if (err) goto failed_mount; -ext4_hash_info_init (sb); + err =ext4_hash_info_init (sb); +if (err) + goto failed_mount; err =ext4_handle_clustersize (sb);if (err)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 333/558 selftests/mm: fix charge_reserved_hugetlb.sh test
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Hildenbrand <[email protected]>
[ Upstream commit c41a701d18efe6b8aa402efab16edbaba50c9548 ]
Currently, running the charge_reserved_hugetlb.sh selftest we can sometimes observe something like:
$ ./charge_reserved_hugetlb.sh -cgroup-v2 ... write_result is 0 After write: hugetlb_usage=0 reserved_usage=10485760 killing write_to_hugetlbfs Received 2. Deleting the memory Detach failure: Invalid argument umount: /mnt/huge: target is busy.
Both cases are issues in the test.
While the unmount error seems to be racy, it will make the test fail:
$ ./run_vmtests.sh -t hugetlb ... # [FAIL] not ok 10 charge_reserved_hugetlb.sh -cgroup-v2 # exit=32
The issue is that we are not waiting for the write_to_hugetlbfs process to quit. So it might still have a hugetlbfs file open, about which umount is not happy. Fix that by making "killall" wait for the process to quit.
The other error ("Detach failure: Invalid argument") does not seem to result in a test error, but is misleading. Turns out write_to_hugetlbfs.c unconditionally tries to cleanup using shmdt(), even when we only mmap()'ed a hugetlb file. Even worse, shmaddr is never even set for the SHM case. Fix that as well.
With this change it seems to work as expected.
--- .../selftests/mm/charge_reserved_hugetlb.sh | 2 +- .../testing/selftests/mm/write_to_hugetlbfs.c | 21 +++++++++++-------- 2 files changed, 13 insertions(+), 10 deletions(-)
tools/testing/selftests/mm/charge_reserved_hugetlb.sh +1 -1
@@ -254,7 +254,7 @@ function cleanup_hugetlb_memory() { local cgroup="$1" if [[ "$(pgrep -f write_to_hugetlbfs)" != "" ]]; then echo killing write_to_hugetlbfs - killall -2 write_to_hugetlbfs + killall -2 --wait write_to_hugetlbfs wait_for_hugetlb_memory_to_get_depleted $cgroup fi set -e
tools/testing/selftests/mm/write_to_hugetlbfs.c +12 -9
@@ -28,7 +28,7 @@ enum method {/* Global variables. */ static const char *self; -static char *shmaddr; +static int *shmaddr;static int shmid;/*
@@ -47,15 +47,17 @@ void sig_handler(int signo) {printf ("Received %d.\n" , signo);if (signo ==SIGINT ) { -printf ("Deleting the memory\n" ); -if (shmdt ((const void *)shmaddr) !=0 ) { -perror ("Detach failure" ); +if (shmaddr) { +printf ("Deleting the memory\n" ); +if (shmdt ((const void *)shmaddr) !=0 ) { +perror ("Detach failure" ); +shmctl (shmid,IPC_RMID ,NULL ); +exit (4 ); + } +shmctl (shmid,IPC_RMID ,NULL ); -exit (4 ); +printf ("Done deleting the memory\n" ); } - -shmctl (shmid,IPC_RMID ,NULL ); -printf ("Done deleting the memory\n" ); }exit (2 ); }
@@ -211,7 +213,8 @@ int main(int argc, char **argv)shmctl (shmid,IPC_RMID ,NULL );exit (2 ); } -printf ("shmaddr: %p\n" , ptr); + shmaddr = ptr; +printf ("shmaddr: %p\n" , shmaddr);break ;default :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 334/558 nvme-tcp: fix link failure for TCP auth
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 2d5a333e09c388189238291577e443221baacba0 ]
The nvme fabric driver calls the nvme_tls_key_lookup() function from nvmf_parse_key() when the keyring is enabled, but this is broken in a configuration with CONFIG_NVME_FABRICS=y and CONFIG_NVME_TCP=m because this leads to the function definition being in a loadable module:
x86_64-linux-ld: vmlinux.o: in function `nvmf_parse_key':
fabrics.c:(.text+0xb1bdec): undefined reference to `nvme_tls_key_lookup'
Move the 'select' up to CONFIG_NVME_FABRICS itself to force this part to be built-in as well if needed.
--- drivers/nvme/host/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nvme/host/Kconfig +1 -1
@@ -41,6 +41,7 @@ config NVME_HWMON config NVME_FABRICS select NVME_CORE + select NVME_KEYRING if NVME_TCP_TLS tristate config NVME_RDMA
@@ -94,7 +95,6 @@ config NVME_TCP config NVME_TCP_TLS bool "NVMe over Fabrics TCP TLS encryption support" depends on NVME_TCP - select NVME_KEYRING select NET_HANDSHAKE select KEYS help
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 335/558 f2fs: add write priority option based on zone UFS
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liao Yuanhong <[email protected]>
[ Upstream commit 8444ce524947daf441546b5b3a0c418706dade35 ]
Currently, we are using a mix of traditional UFS and zone UFS to support some functionalities that cannot be achieved on zone UFS alone. However, there are some issues with this approach. There exists a significant performance difference between traditional UFS and zone UFS. Under normal usage, we prioritize writes to zone UFS. However, in critical conditions (such as when the entire UFS is almost full), we cannot determine whether data will be written to traditional UFS or zone UFS. This can lead to significant performance fluctuations, which is not conducive to development and testing. To address this, we have added an option zlu_io_enable under sys with the following three modes:
1) zlu_io_enable == 0:Normal mode, prioritize writing to zone UFS;
2) zlu_io_enable == 1:Zone UFS only mode, only allow writing to zone UFS;
3) zlu_io_enable == 2:Traditional UFS priority mode, prioritize writing to traditional UFS.
Stable-dep-of: 65a6ce4726c2 ("f2fs: fix to don't panic system for no free segment fault injection")
--- Documentation/ABI/testing/sysfs-fs-f2fs | 14 ++++++++++++++ fs/f2fs/f2fs.h | 8 ++++++++ fs/f2fs/segment.c | 25 ++++++++++++++++++++++++- fs/f2fs/super.c | 1 + fs/f2fs/sysfs.c | 11 +++++++++++ 5 files changed, 58 insertions(+), 1 deletion(-)
Documentation/ABI/testing/sysfs-fs-f2fs +14 -0
@@ -763,3 +763,17 @@ Date: November 2023 Contact: "Chao Yu" <[email protected]> Description: It controls to enable/disable IO aware feature for background discard. By default, the value is 1 which indicates IO aware is on. + +What: /sys/fs/f2fs/<disk>/blkzone_alloc_policy +Date: July 2024 +Contact: "Yuanhong Liao" <[email protected]> +Description: The zone UFS we are currently using consists of two parts: + conventional zones and sequential zones. It can be used to control which part + to prioritize for writes, with a default value of 0. + + ======================== ========================================= + value description + blkzone_alloc_policy = 0 Prioritize writing to sequential zones + blkzone_alloc_policy = 1 Only allow writing to sequential zones + blkzone_alloc_policy = 2 Prioritize writing to conventional zones + ======================== =========================================
fs/f2fs/f2fs.h +8 -0
@@ -134,6 +134,12 @@ typedef u32 nid_t;#define COMPRESS_EXT_NUM 16 +enum blkzone_allocation_policy { +BLKZONE_ALLOC_PRIOR_SEQ ,/* Prioritize writing to sequential zones */ +BLKZONE_ALLOC_ONLY_SEQ ,/* Only allow writing to sequential zones */ +BLKZONE_ALLOC_PRIOR_CONV ,/* Prioritize writing to conventional zones */ +}; +/* * An implementation of an rwsem that is explicitly unfair to readers. This * prevents priority inversion when a low-priority reader acquires the read lock
@@ -1563,6 +1569,8 @@ struct f2fs_sb_info {#ifdef CONFIG_BLK_DEV_ZONED unsigned int blocks_per_blkz;/* F2FS blocks per zone */ unsigned int max_open_zones;/* max open zone resources of the zoned device */ +/* For adjust the priority writing position of data in zone UFS */ +unsigned int blkzone_alloc_policy;#endif /* for node-related operations */
fs/f2fs/segment.c +24 -1
@@ -2701,17 +2701,40 @@ static int get_new_segment(struct f2fs_sb_info *sbi, goto got_it; } +#ifdef CONFIG_BLK_DEV_ZONED /* * If we format f2fs on zoned storage, let's try to get pinned sections * from beginning of the storage, which should be a conventional one. */ if (f2fs_sb_has_blkzoned (sbi)) { - segno = pinning ?0 :max (first_zoned_segno (sbi), *newseg); +/* Prioritize writing to conventional zones */ +if (sbi->blkzone_alloc_policy ==BLKZONE_ALLOC_PRIOR_CONV || pinning) + segno =0 ; +else + segno =max (first_zoned_segno (sbi), *newseg); hint =GET_SEC_FROM_SEG (sbi, segno); } +#endif find_other_zone: secno =find_next_zero_bit (free_i->free_secmap,MAIN_SECS (sbi), hint); + +#ifdef CONFIG_BLK_DEV_ZONED +if (secno >=MAIN_SECS (sbi) &&f2fs_sb_has_blkzoned (sbi)) { +/* Write only to sequential zones */ +if (sbi->blkzone_alloc_policy ==BLKZONE_ALLOC_ONLY_SEQ ) { + hint =GET_SEC_FROM_SEG (sbi,first_zoned_segno (sbi)); + secno =find_next_zero_bit (free_i->free_secmap,MAIN_SECS (sbi), hint); + }else + secno =find_first_zero_bit (free_i->free_secmap, +MAIN_SECS (sbi)); +if (secno >=MAIN_SECS (sbi)) { + ret = -ENOSPC ; + goto out_unlock; + } + } +#endif +if (secno >=MAIN_SECS (sbi)) { secno =find_first_zero_bit (free_i->free_secmap,MAIN_SECS (sbi));
fs/f2fs/super.c +1 -0
@@ -4221,6 +4221,7 @@ static int f2fs_scan_devices(struct f2fs_sb_info *sbi) sbi->aligned_blksize = true;#ifdef CONFIG_BLK_DEV_ZONED sbi->max_open_zones =UINT_MAX ; + sbi->blkzone_alloc_policy =BLKZONE_ALLOC_PRIOR_SEQ ;#endif for (i =0 ; i < max_devices; i++) {
fs/f2fs/sysfs.c +11 -0
@@ -627,6 +627,15 @@ static ssize_t __sbi_store(struct f2fs_attr *a, }#endif +#ifdef CONFIG_BLK_DEV_ZONED +if (!strcmp (a->attr.name,"blkzone_alloc_policy" )) { +if (t <BLKZONE_ALLOC_PRIOR_SEQ || t >BLKZONE_ALLOC_PRIOR_CONV ) +return -EINVAL ; + sbi->blkzone_alloc_policy = t; +return count; + } +#endif +#ifdef CONFIG_F2FS_FS_COMPRESSION if (!strcmp (a->attr.name,"compr_written_block" ) || !strcmp (a->attr.name,"compr_saved_block" )) {
@@ -1033,6 +1042,7 @@ F2FS_SBI_GENERAL_RW_ATTR(warm_data_age_threshold);F2FS_SBI_GENERAL_RW_ATTR (last_age_weight);#ifdef CONFIG_BLK_DEV_ZONED F2FS_SBI_GENERAL_RO_ATTR (unusable_blocks_per_sec); +F2FS_SBI_GENERAL_RW_ATTR (blkzone_alloc_policy);#endif /* STAT_INFO ATTR */
@@ -1187,6 +1197,7 @@ static struct attribute *f2fs_attrs[] = {#endif #ifdef CONFIG_BLK_DEV_ZONED ATTR_LIST(unusable_blocks_per_sec), + ATTR_LIST(blkzone_alloc_policy),#endif #ifdef CONFIG_F2FS_FS_COMPRESSION ATTR_LIST(compr_written_block),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 336/558 f2fs: fix to dont panic system for no free segment fault injection
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit 65a6ce4726c27b45600303f06496fef46d00b57f ]
f2fs: fix to don't panic system for no free segment fault injection
syzbot reports a f2fs bug as below:
F2FS-fs (loop0): inject no free segment in get_new_segment of __allocate_new_segment+0x1ce/0x940 fs/f2fs/segment.c:3167 F2FS-fs (loop0): Stopped filesystem due to reason: 7
------------[ cut here ]------------ kernel BUG at fs/f2fs/segment.c:2748! CPU: 0 UID: 0 PID: 5109 Comm: syz-executor304 Not tainted 6.11.0-rc6-syzkaller-00363-g89f5e14d05b4 #0 RIP: 0010:get_new_segment fs/f2fs/segment.c:2748 [inline] RIP: 0010:new_curseg+0x1f61/0x1f70 fs/f2fs/segment.c:2836 Call Trace: __allocate_new_segment+0x1ce/0x940 fs/f2fs/segment.c:3167 f2fs_allocate_new_section fs/f2fs/segment.c:3181 [inline] f2fs_allocate_pinning_section+0xfa/0x4e0 fs/f2fs/segment.c:3195 f2fs_expand_inode_data+0x5d6/0xbb0 fs/f2fs/file.c:1799 f2fs_fallocate+0x448/0x960 fs/f2fs/file.c:1903 vfs_fallocate+0x553/0x6c0 fs/open.c:334 do_vfs_ioctl+0x2592/0x2e50 fs/ioctl.c:886 __do_sys_ioctl fs/ioctl.c:905 [inline] __se_sys_ioctl+0x81/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0010:get_new_segment fs/f2fs/segment.c:2748 [inline] RIP: 0010:new_curseg+0x1f61/0x1f70 fs/f2fs/segment.c:2836
The root cause is when we inject no free segment fault into f2fs, we should not panic system, fix it.
--- fs/f2fs/segment.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
fs/f2fs/segment.c +3 -3
@@ -2730,6 +2730,7 @@ static int get_new_segment(struct f2fs_sb_info *sbi, MAIN_SECS(sbi));if (secno >=MAIN_SECS (sbi)) { ret = -ENOSPC ; +f2fs_bug_on (sbi,1 ); goto out_unlock; } }
@@ -2740,6 +2741,7 @@ static int get_new_segment(struct f2fs_sb_info *sbi, MAIN_SECS(sbi));if (secno >=MAIN_SECS (sbi)) { ret = -ENOSPC ; +f2fs_bug_on (sbi,1 ); goto out_unlock; } }
@@ -2781,10 +2783,8 @@ static int get_new_segment(struct f2fs_sb_info *sbi, out_unlock:spin_unlock (&free_i->segmap_lock); -if (ret == -ENOSPC ) { +if (ret == -ENOSPC )f2fs_stop_checkpoint (sbi, false,STOP_CP_REASON_NO_SEGMENT ); -f2fs_bug_on (sbi,1 ); - }return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 337/558 powerpc/vdso: Fix VDSO data access when running in a non-root time namespace
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit c73049389e58c01e2e3bbfae900c8daeee177191 ]
When running in a non-root time namespace, the global VDSO data page is replaced by a dedicated namespace data page and the global data page is mapped next to it. Detailed explanations can be found at commit 660fd04f9317 ("lib/vdso: Prepare for time namespace support").
When it happens, __kernel_get_syscall_map and __kernel_get_tbfreq and __kernel_sync_dicache don't work anymore because they read 0 instead of the data they need.
To address that, clock_mode has to be read. When it is set to VDSO_CLOCKMODE_TIMENS, it means it is a dedicated namespace data page and the global data is located on the following page.
Add a macro called get_realdatapage which reads clock_mode and add PAGE_SIZE to the pointer provided by get_datapage macro when clock_mode is equal to VDSO_CLOCKMODE_TIMENS. Use this new macro instead of get_datapage macro except for time functions as they handle it internally.
--- arch/powerpc/include/asm/vdso_datapage.h | 15 +++++++++++++++ arch/powerpc/kernel/asm-offsets.c | 2 ++ arch/powerpc/kernel/vdso/cacheflush.S | 2 +- arch/powerpc/kernel/vdso/datapage.S | 4 ++-- 4 files changed, 20 insertions(+), 3 deletions(-)
arch/powerpc/include/asm/vdso_datapage.h +15 -0
@@ -111,6 +111,21 @@ extern struct vdso_arch_data *vdso_data; addi \ptr, \ptr, (_vdso_datapage - 999b)@l .endm +#include <asm/asm-offsets.h> +#include <asm/page.h> + +.macro get_realdatapage ptr scratch + get_datapage \ptr +#ifdef CONFIG_TIME_NS + lwz \scratch, VDSO_CLOCKMODE_OFFSET(\ptr) + xoris \scratch, \scratch, VDSO_CLOCKMODE_TIMENS@h + xori \scratch, \scratch, VDSO_CLOCKMODE_TIMENS@l + cntlzw \scratch, \scratch + rlwinm \scratch, \scratch, PAGE_SHIFT - 5, 1 << PAGE_SHIFT + add \ptr, \ptr, \scratch +#endif +.endm + #endif /* __ASSEMBLY__ */ #endif /* __KERNEL__ */
arch/powerpc/kernel/asm-offsets.c +2 -0
@@ -346,6 +346,8 @@ int main(void)#else OFFSET (CFG_SYSCALL_MAP32 , vdso_arch_data, syscall_map);#endif +OFFSET (VDSO_CLOCKMODE_OFFSET , vdso_arch_data, data[0 ].clock_mode); +DEFINE (VDSO_CLOCKMODE_TIMENS ,VDSO_CLOCKMODE_TIMENS );#ifdef CONFIG_BUG DEFINE (BUG_ENTRY_SIZE ,sizeof (struct bug_entry ));
arch/powerpc/kernel/vdso/cacheflush.S +1 -1
@@ -30,7 +30,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_COHERENT_ICACHE) #ifdef CONFIG_PPC64 mflr r12 .cfi_register lr,r12 - get_datapage r10 + get_realdatapage r10, r11 mtlr r12 .cfi_restore lr #endif
arch/powerpc/kernel/vdso/datapage.S +2 -2
@@ -28,7 +28,7 @@ V_FUNCTION_BEGIN(__kernel_get_syscall_map) mflr r12 .cfi_register lr,r12 mr. r4,r3 - get_datapage r3 + get_realdatapage r3, r11 mtlr r12 #ifdef __powerpc64__ addi r3,r3,CFG_SYSCALL_MAP64
@@ -52,7 +52,7 @@ V_FUNCTION_BEGIN(__kernel_get_tbfreq) .cfi_startproc mflr r12 .cfi_register lr,r12 - get_datapage r3 + get_realdatapage r3, r11 #ifndef __powerpc64__ lwz r4,(CFG_TB_TICKS_PER_SEC + 4)(r3) #endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 338/558 selftests: vDSO: fix ELF hash table entry size for s390x
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Remus <[email protected]>
[ Upstream commit 14be4e6f35221c4731b004553ecf7cbc6dc1d2d8 ]
The vDSO self tests fail on s390x for a vDSO linked with the GNU linker ld as follows:
# ./vdso_test_gettimeofday Floating point exception (core dumped)
On s390x the ELF hash table entries are 64 bits instead of 32 bits in size (see Glibc sysdeps/unix/sysv/linux/s390/bits/elfclass.h).
--- tools/testing/selftests/vDSO/parse_vdso.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
tools/testing/selftests/vDSO/parse_vdso.c +10 -4
@@ -36,6 +36,12 @@#define ELF_BITS_XFORM (bits, x) ELF_BITS_XFORM2(bits, x)#define ELF (x) ELF_BITS_XFORM(ELF_BITS, x) +#ifdef __s390x__ +#define ELF_HASH_ENTRY ELF(Xword) +#else +#define ELF_HASH_ENTRY ELF(Word) +#endif + static struct vdso_info { bool valid;
@@ -47,8 +53,8 @@ static struct vdso_info/* Symbol table */ ELF (Sym) *symtab;const char *symstrings; -ELF (Word) *bucket, *chain; -ELF (Word) nbucket, nchain; +ELF_HASH_ENTRY *bucket, *chain; +ELF_HASH_ENTRY nbucket, nchain;/* Version table */ ELF (Versym) *versym;
@@ -115,7 +121,7 @@ void vdso_init_from_sysinfo_ehdr(uintptr_t base)/* * Fish out the useful bits of the dynamic table. */ -ELF (Word) *hash =0 ; +ELF_HASH_ENTRY *hash =0 ; vdso_info.symstrings =0 ; vdso_info.symtab =0 ; vdso_info.versym =0 ;
@@ -133,7 +139,7 @@ void vdso_init_from_sysinfo_ehdr(uintptr_t base) + vdso_info.load_offset);break ;case DT_HASH : - hash = (ELF (Word) *) + hash = (ELF_HASH_ENTRY *) ((uintptr_t )dyn[i].d_un.d_ptr + vdso_info.load_offset);break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 339/558 selftests: vDSO: fix vdso_config for s390
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <[email protected]>
[ Upstream commit a6e23fb8d3c0e3904da70beaf5d7e840a983c97f ]
Running vdso_test_correctness on s390x (aka s390 64 bit) emits a warning:
Warning: failed to find clock_gettime64 in vDSO
This is caused by the "#elif defined (__s390__)" check in vdso_config.h which the defines VDSO_32BIT.
If __s390x__ is defined also __s390__ is defined. Therefore the correct check must make sure that only __s390__ is defined.
Therefore add the missing !defined(__s390x__). Also use common __s390x__ define instead of __s390X__.
--- tools/testing/selftests/vDSO/vdso_config.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/testing/selftests/vDSO/vdso_config.h +2 -2
@@ -25,11 +25,11 @@#define VDSO_VERSION 1#define VDSO_NAMES 0#define VDSO_32BIT 1 -#elif defined (__s390__) +#elif defined (__s390__) && !defined(__s390x__)#define VDSO_VERSION 2#define VDSO_NAMES 0#define VDSO_32BIT 1 -#elif defined (__s390X__) +#elif defined (__s390x__)#define VDSO_VERSION 2#define VDSO_NAMES 0#elif defined(__mips__)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 340/558 f2fs: make BG GC more aggressive for zoned devices
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daeho Jeong <[email protected]>
[ Upstream commit 5062b5bed4323275f2f89bc185c6a28d62cfcfd5 ]
Since we don't have any GC on device side for zoned devices, need more aggressive BG GC. So, tune the parameters for that.
Stable-dep-of: 5cc69a27abfa ("f2fs: forcibly migrate to secure space for zoned device file pinning")
--- fs/f2fs/f2fs.h | 20 ++++++++++++++++++-- fs/f2fs/gc.c | 25 +++++++++++++++++++++---- fs/f2fs/gc.h | 21 +++++++++++++++++++++ fs/f2fs/super.c | 5 +++++ 4 files changed, 65 insertions(+), 6 deletions(-)
fs/f2fs/f2fs.h +18 -2
@@ -2870,13 +2870,26 @@ static inline bool is_inflight_io(struct f2fs_sb_info *sbi, int type)return false; } +static inline bool is_inflight_read_io (struct f2fs_sb_info *sbi) +{ +return get_pages (sbi,F2FS_RD_DATA ) ||get_pages (sbi,F2FS_DIO_READ ); +} +static inline bool is_idle (struct f2fs_sb_info *sbi,int type) { +bool zoned_gc = (type ==GC_TIME && +F2FS_HAS_FEATURE (sbi,F2FS_FEATURE_BLKZONED )); +if (sbi->gc_mode ==GC_URGENT_HIGH )return true; -if (is_inflight_io (sbi, type)) -return false; +if (zoned_gc) { +if (is_inflight_read_io (sbi)) +return false; + }else { +if (is_inflight_io (sbi, type)) +return false; + }if (sbi->gc_mode ==GC_URGENT_MID )return true;
@@ -2885,6 +2898,9 @@ static inline bool is_idle(struct f2fs_sb_info *sbi, int type) (type == DISCARD_TIME || type == GC_TIME))return true; +if (zoned_gc) +return true; +return f2fs_time_over (sbi, type); }
fs/f2fs/gc.c +21 -4
@@ -116,7 +116,17 @@ static int gc_thread_func(void *data) goto next; } -if (has_enough_invalid_blocks (sbi)) +if (f2fs_sb_has_blkzoned (sbi)) { +if (has_enough_free_blocks (sbi,LIMIT_NO_ZONED_GC )) { + wait_ms = gc_th->no_gc_sleep_time; +f2fs_up_write (&sbi->gc_lock); + goto next; + } +if (wait_ms == gc_th->no_gc_sleep_time) + wait_ms = gc_th->max_sleep_time; + } + +if (need_to_boost_gc (sbi))decrease_sleep_time (gc_th, &wait_ms);else increase_sleep_time (gc_th, &wait_ms);
@@ -179,9 +189,16 @@ int f2fs_start_gc_thread(struct f2fs_sb_info *sbi)return -ENOMEM ; gc_th->urgent_sleep_time =DEF_GC_THREAD_URGENT_SLEEP_TIME ; - gc_th->min_sleep_time =DEF_GC_THREAD_MIN_SLEEP_TIME ; - gc_th->max_sleep_time =DEF_GC_THREAD_MAX_SLEEP_TIME ; - gc_th->no_gc_sleep_time =DEF_GC_THREAD_NOGC_SLEEP_TIME ; + +if (f2fs_sb_has_blkzoned (sbi)) { + gc_th->min_sleep_time =DEF_GC_THREAD_MIN_SLEEP_TIME_ZONED ; + gc_th->max_sleep_time =DEF_GC_THREAD_MAX_SLEEP_TIME_ZONED ; + gc_th->no_gc_sleep_time =DEF_GC_THREAD_NOGC_SLEEP_TIME_ZONED ; + }else { + gc_th->min_sleep_time =DEF_GC_THREAD_MIN_SLEEP_TIME ; + gc_th->max_sleep_time =DEF_GC_THREAD_MAX_SLEEP_TIME ; + gc_th->no_gc_sleep_time =DEF_GC_THREAD_NOGC_SLEEP_TIME ; + } gc_th->gc_wake = false;
fs/f2fs/gc.h +21 -0
@@ -15,6 +15,11 @@#define DEF_GC_THREAD_MAX_SLEEP_TIME 60000#define DEF_GC_THREAD_NOGC_SLEEP_TIME 300000/* wait 5 min */ +/* GC sleep parameters for zoned deivces */ +#define DEF_GC_THREAD_MIN_SLEEP_TIME_ZONED 10 +#define DEF_GC_THREAD_MAX_SLEEP_TIME_ZONED 20 +#define DEF_GC_THREAD_NOGC_SLEEP_TIME_ZONED 60000 +/* choose candidates from sections which has age of more than 7 days */ #define DEF_GC_THREAD_AGE_THRESHOLD (60 * 60 * 24 * 7)#define DEF_GC_THREAD_CANDIDATE_RATIO 20/* select 20% oldest sections as candidates */
@@ -25,6 +30,9 @@#define LIMIT_INVALID_BLOCK 40/* percentage over total user space */ #define LIMIT_FREE_BLOCK 40/* percentage over invalid + free space */ +#define LIMIT_NO_ZONED_GC 60/* percentage over total user space of no gc for zoned devices */ +#define LIMIT_BOOST_ZONED_GC 25/* percentage over total user space of boosted gc for zoned devices */ +#define DEF_GC_FAILED_PINNED_FILES 2048#define MAX_GC_FAILED_PINNED_FILES USHRT_MAX
@@ -152,6 +160,12 @@ static inline void decrease_sleep_time(struct f2fs_gc_kthread *gc_th, *wait -= min_time; } +static inline bool has_enough_free_blocks (struct f2fs_sb_info *sbi, +unsigned int limit_perc) +{ +return free_sections (sbi) > ((sbi->total_sections * limit_perc) /100 ); +} +static inline bool has_enough_invalid_blocks (struct f2fs_sb_info *sbi) {block_t user_block_count = sbi->user_block_count;
@@ -167,3 +181,10 @@ static inline bool has_enough_invalid_blocks(struct f2fs_sb_info *sbi)free_user_blocks (sbi) < limit_free_user_blocks(invalid_user_blocks)); } + +static inline bool need_to_boost_gc (struct f2fs_sb_info *sbi) +{ +if (f2fs_sb_has_blkzoned (sbi)) +return !has_enough_free_blocks (sbi,LIMIT_BOOST_ZONED_GC ); +return has_enough_invalid_blocks (sbi); +}
fs/f2fs/super.c +5 -0
@@ -707,6 +707,11 @@ static int parse_options(struct super_block *sb, char *options, bool is_remount)if (!strcmp (name,"on" )) {F2FS_OPTION (sbi).bggc_mode =BGGC_MODE_ON ; }else if (!strcmp (name,"off" )) { +if (f2fs_sb_has_blkzoned (sbi)) { +f2fs_warn (sbi,"zoned devices need bggc" ); +kfree (name); +return -EINVAL ; + }F2FS_OPTION (sbi).bggc_mode =BGGC_MODE_OFF ; }else if (!strcmp (name,"sync" )) {F2FS_OPTION (sbi).bggc_mode =BGGC_MODE_SYNC ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 341/558 f2fs: introduce migration_window_granularity
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daeho Jeong <[email protected]>
[ Upstream commit 8c890c4c60342719526520133fb1b6f69f196ab8 ]
We can control the scanning window granularity for GC migration. For more frequent scanning and GC on zoned devices, we need a fine grained control knob for it.
Stable-dep-of: 5cc69a27abfa ("f2fs: forcibly migrate to secure space for zoned device file pinning")
--- Documentation/ABI/testing/sysfs-fs-f2fs | 8 +++++++ fs/f2fs/f2fs.h | 2 ++ fs/f2fs/gc.c | 31 +++++++++++++++++-------- fs/f2fs/gc.h | 1 + fs/f2fs/super.c | 2 ++ fs/f2fs/sysfs.c | 7 ++++++ 6 files changed, 41 insertions(+), 10 deletions(-)
Documentation/ABI/testing/sysfs-fs-f2fs +8 -0
@@ -777,3 +777,11 @@ Description: The zone UFS we are currently using consists of two parts: blkzone_alloc_policy = 1 Only allow writing to sequential zones blkzone_alloc_policy = 2 Prioritize writing to conventional zones ======================== ========================================= + +What: /sys/fs/f2fs/<disk>/migration_window_granularity +Date: September 2024 +Contact: "Daeho Jeong" <[email protected]> +Description: Controls migration window granularity of garbage collection on large + section. it can control the scanning window granularity for GC migration + in a unit of segment, while migration_granularity controls the number + of segments which can be migrated at the same turn.
fs/f2fs/f2fs.h +2 -0
@@ -1697,6 +1697,8 @@ struct f2fs_sb_info {unsigned int max_victim_search;/* migration granularity of garbage collection, unit: segment */ unsigned int migration_granularity; +/* migration window granularity of garbage collection, unit: segment */ +unsigned int migration_window_granularity;/* * for stat information.
fs/f2fs/gc.c +21 -10
@@ -1708,24 +1708,34 @@ static int do_garbage_collect(struct f2fs_sb_info *sbi,struct blk_plug plug;unsigned int segno = start_segno;unsigned int end_segno = start_segno +SEGS_PER_SEC (sbi); +unsigned int sec_end_segno;int seg_freed =0 , migrated =0 ;unsigned char type =IS_DATASEG (get_seg_entry (sbi, segno)->type) ?SUM_TYPE_DATA :SUM_TYPE_NODE ;unsigned char data_type = (type ==SUM_TYPE_DATA ) ?DATA :NODE ;int submitted =0 ; -if (__is_large_section (sbi)) - end_segno =rounddown (end_segno,SEGS_PER_SEC (sbi)); +if (__is_large_section (sbi)) { + sec_end_segno =rounddown (end_segno,SEGS_PER_SEC (sbi)); -/* -* zone-capacity can be less than zone-size in zoned devices, -* resulting in less than expected usable segments in the zone, -* calculate the end segno in the zone which can be garbage collected -*/ -if (f2fs_sb_has_blkzoned (sbi)) - end_segno -=SEGS_PER_SEC (sbi) - +/* +* zone-capacity can be less than zone-size in zoned devices, +* resulting in less than expected usable segments in the zone, +* calculate the end segno in the zone which can be garbage +* collected +*/ +if (f2fs_sb_has_blkzoned (sbi)) + sec_end_segno -=SEGS_PER_SEC (sbi) -f2fs_usable_segs_in_sec (sbi, segno); +if (gc_type ==BG_GC ) + end_segno = start_segno + + sbi->migration_window_granularity; + +if (end_segno > sec_end_segno) + end_segno = sec_end_segno; + } +sanity_check_seg_type (sbi,get_seg_entry (sbi, segno)->type);/* readahead multi ssa blocks those have contiguous address */
@@ -1803,7 +1813,8 @@ static int do_garbage_collect(struct f2fs_sb_info *sbi,if (__is_large_section (sbi)) sbi->next_victim_seg[gc_type] = - (segno +1 < end_segno) ? segno +1 :NULL_SEGNO ; + (segno +1 < sec_end_segno) ? + segno +1 :NULL_SEGNO ; skip:f2fs_put_page (sum_page,0 ); }
fs/f2fs/gc.h +1 -0
@@ -32,6 +32,7 @@#define LIMIT_NO_ZONED_GC 60/* percentage over total user space of no gc for zoned devices */ #define LIMIT_BOOST_ZONED_GC 25/* percentage over total user space of boosted gc for zoned devices */ +#define DEF_MIGRATION_WINDOW_GRANULARITY_ZONED 3#define DEF_GC_FAILED_PINNED_FILES 2048#define MAX_GC_FAILED_PINNED_FILES USHRT_MAX
fs/f2fs/super.c +2 -0
@@ -3791,6 +3791,8 @@ static void init_sb_info(struct f2fs_sb_info *sbi) sbi->next_victim_seg[FG_GC ] =NULL_SEGNO ; sbi->max_victim_search =DEF_MAX_VICTIM_SEARCH ; sbi->migration_granularity =SEGS_PER_SEC (sbi); + sbi->migration_window_granularity =f2fs_sb_has_blkzoned (sbi) ? +DEF_MIGRATION_WINDOW_GRANULARITY_ZONED :SEGS_PER_SEC (sbi); sbi->seq_file_ra_mul =MIN_RA_MUL ; sbi->max_fragment_chunk =DEF_FRAGMENT_SIZE ; sbi->max_fragment_hole =DEF_FRAGMENT_SIZE ;
fs/f2fs/sysfs.c +7 -0
@@ -561,6 +561,11 @@ static ssize_t __sbi_store(struct f2fs_attr *a,return -EINVAL ; } +if (!strcmp (a->attr.name,"migration_window_granularity" )) { +if (t ==0 || t >SEGS_PER_SEC (sbi)) +return -EINVAL ; + } +if (!strcmp (a->attr.name,"gc_urgent" )) {if (t ==0 ) { sbi->gc_mode =GC_NORMAL ;
@@ -1010,6 +1015,7 @@ F2FS_SBI_RW_ATTR(gc_pin_file_thresh, gc_pin_file_threshold);F2FS_SBI_RW_ATTR (gc_reclaimed_segments, gc_reclaimed_segs);F2FS_SBI_GENERAL_RW_ATTR (max_victim_search);F2FS_SBI_GENERAL_RW_ATTR (migration_granularity); +F2FS_SBI_GENERAL_RW_ATTR (migration_window_granularity);F2FS_SBI_GENERAL_RW_ATTR (dir_level);#ifdef CONFIG_F2FS_IOSTAT F2FS_SBI_GENERAL_RW_ATTR (iostat_enable);
@@ -1150,6 +1156,7 @@ static struct attribute *f2fs_attrs[] = {ATTR_LIST (min_ssr_sections),ATTR_LIST (max_victim_search),ATTR_LIST (migration_granularity), +ATTR_LIST (migration_window_granularity),ATTR_LIST (dir_level),ATTR_LIST (ram_thresh), ATTR_LIST(ra_nid_pages),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 342/558 f2fs: increase BG GC migration window granularity when boosted for zoned devices
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daeho Jeong <[email protected]>
[ Upstream commit 2223fe652f759649ae1d520e47e5f06727c0acbd ]
Need bigger BG GC migration window granularity when free section is running low.
Stable-dep-of: 5cc69a27abfa ("f2fs: forcibly migrate to secure space for zoned device file pinning")
--- fs/f2fs/gc.c | 12 ++++++++++-- fs/f2fs/gc.h | 1 + 2 files changed, 11 insertions(+), 2 deletions(-)
fs/f2fs/gc.c +10 -2
@@ -1728,10 +1728,18 @@ static int do_garbage_collect(struct f2fs_sb_info *sbi, sec_end_segno -=SEGS_PER_SEC (sbi) -f2fs_usable_segs_in_sec (sbi, segno); -if (gc_type ==BG_GC ) - end_segno = start_segno + +if (gc_type ==BG_GC ) { +unsigned int window_granularity = sbi->migration_window_granularity; +if (f2fs_sb_has_blkzoned (sbi) && + !has_enough_free_blocks (sbi, +LIMIT_BOOST_ZONED_GC )) + window_granularity *=BOOST_GC_MULTIPLE ; + + end_segno = start_segno + window_granularity; + } +if (end_segno > sec_end_segno) end_segno = sec_end_segno; }
fs/f2fs/gc.h +1 -0
@@ -33,6 +33,7 @@#define LIMIT_NO_ZONED_GC 60/* percentage over total user space of no gc for zoned devices */ #define LIMIT_BOOST_ZONED_GC 25/* percentage over total user space of boosted gc for zoned devices */ #define DEF_MIGRATION_WINDOW_GRANULARITY_ZONED 3 +#define BOOST_GC_MULTIPLE 5#define DEF_GC_FAILED_PINNED_FILES 2048#define MAX_GC_FAILED_PINNED_FILES USHRT_MAX
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 343/558 f2fs: do FG_GC when GC boosting is required for zoned devices
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daeho Jeong <[email protected]>
[ Upstream commit 9748c2ddea4a3f46a498bff4cf2bf9a5629e3f8b ]
Under low free section count, we need to use FG_GC instead of BG_GC to recover free sections.
Stable-dep-of: 5cc69a27abfa ("f2fs: forcibly migrate to secure space for zoned device file pinning")
--- fs/f2fs/f2fs.h | 1 + fs/f2fs/gc.c | 24 +++++++++++++++++------- 2 files changed, 18 insertions(+), 7 deletions(-)
fs/f2fs/f2fs.h +1 -0
@@ -1301,6 +1301,7 @@ struct f2fs_gc_control {bool no_bg_gc;/* check the space and stop bg_gc */ bool should_migrate_blocks;/* should migrate blocks */ bool err_gc_skipped;/* return EAGAIN if GC skipped */ +bool one_time;/* require one time GC in one migration unit */ unsigned int nr_free_secs;/* # of free sections to do GC */ };
fs/f2fs/gc.c +17 -7
@@ -81,6 +81,8 @@ static int gc_thread_func(void *data)continue ; } + gc_control.one_time = false; +/* * [GC triggering condition] * 0. GC is not conducted currently.
@@ -126,15 +128,19 @@ static int gc_thread_func(void *data) wait_ms = gc_th->max_sleep_time; } -if (need_to_boost_gc (sbi)) +if (need_to_boost_gc (sbi)) {decrease_sleep_time (gc_th, &wait_ms); -else +if (f2fs_sb_has_blkzoned (sbi)) + gc_control.one_time = true; + }else {increase_sleep_time (gc_th, &wait_ms); + } do_gc:stat_inc_gc_call_count (sbi, foreground ?FOREGROUND :BACKGROUND ); - sync_mode =F2FS_OPTION (sbi).bggc_mode ==BGGC_MODE_SYNC ; + sync_mode = (F2FS_OPTION (sbi).bggc_mode ==BGGC_MODE_SYNC ) || + gc_control.one_time;/* foreground GC was been triggered via f2fs_balance_fs() */ if (foreground)
@@ -1701,7 +1707,7 @@ static int __get_victim(struct f2fs_sb_info *sbi, unsigned int *victim,static int do_garbage_collect (struct f2fs_sb_info *sbi,unsigned int start_segno,struct gc_inode_list *gc_list,int gc_type, -bool force_migrate) +bool force_migrate,bool one_time) {struct page *sum_page;struct f2fs_summary_block *sum;
@@ -1728,7 +1734,7 @@ static int do_garbage_collect(struct f2fs_sb_info *sbi, sec_end_segno -=SEGS_PER_SEC (sbi) -f2fs_usable_segs_in_sec (sbi, segno); -if (gc_type ==BG_GC ) { +if (gc_type ==BG_GC || one_time) {unsigned int window_granularity = sbi->migration_window_granularity;
@@ -1911,7 +1917,8 @@ int f2fs_gc(struct f2fs_sb_info *sbi, struct f2fs_gc_control *gc_control) } seg_freed =do_garbage_collect (sbi, segno, &gc_list, gc_type, - gc_control->should_migrate_blocks); + gc_control->should_migrate_blocks, + gc_control->one_time);if (seg_freed <0 ) goto stop;
@@ -1922,6 +1929,9 @@ int f2fs_gc(struct f2fs_sb_info *sbi, struct f2fs_gc_control *gc_control) total_sec_freed++; } +if (gc_control->one_time) + goto stop; +if (gc_type ==FG_GC ) { sbi->cur_victim_sec =NULL_SEGNO ;
@@ -2047,7 +2057,7 @@ int f2fs_gc_range(struct f2fs_sb_info *sbi, };do_garbage_collect (sbi, segno, &gc_list,FG_GC , - dry_run_sections ==0 ); + dry_run_sections ==0 , false);put_gc_inode (&gc_list);if (!dry_run &&get_valid_blocks (sbi, segno, true))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 344/558 f2fs: forcibly migrate to secure space for zoned device file pinning
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daeho Jeong <[email protected]>
[ Upstream commit 5cc69a27abfa91abbb39fc584f82d6c867b60f47 ]
We need to migrate data blocks even though it is full to secure space for zoned device file pinning.
--- fs/f2fs/gc.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
fs/f2fs/gc.c +1 -2
@@ -2056,8 +2056,7 @@ int f2fs_gc_range(struct f2fs_sb_info *sbi, .iroot = RADIX_TREE_INIT(gc_list.iroot, GFP_NOFS), }; -do_garbage_collect (sbi, segno, &gc_list,FG_GC , - dry_run_sections ==0 , false); +do_garbage_collect (sbi, segno, &gc_list,FG_GC , true, false);put_gc_inode (&gc_list);if (!dry_run &&get_valid_blocks (sbi, segno, true))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 345/558 Revert "ALSA: hda: Conditionally use snooping for AMD HDMI"
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 3f7f36a4559ef78a6418c5f0447fbfbdcf671956 upstream.
This reverts commit 478689b5990deb626a0b3f1ebf165979914d6be4.
The fix seems leading to regressions for other systems. Also, the way to check the presence of IOMMU via get_dma_ops() isn't reliable and it's no longer applicable for 6.12. After all, it's no right fix, so let's revert it at first.
To be noted, the PCM buffer allocation has been changed to try the continuous pages at first since 6.12, so the problem could be already addressed without this hackish workaround.
--- sound/pci/hda/hda_controller.h | 2 +- sound/pci/hda/hda_intel.c | 10 +--------- 2 files changed, 2 insertions(+), 10 deletions(-)
sound/pci/hda/hda_controller.h +1 -1
@@ -28,7 +28,7 @@#else #define AZX_DCAPS_I915_COMPONENT 0/* NOP */ #endif -#define AZX_DCAPS_AMD_ALLOC_FIX (1 << 14)/* AMD allocation workaround */ +/* 14 unused */ #define AZX_DCAPS_CTX_WORKAROUND (1 << 15)/* X-Fi workaround */ #define AZX_DCAPS_POSFIX_LPIB (1 << 16)/* Use LPIB as default */ #define AZX_DCAPS_AMD_WORKAROUND (1 << 17)/* AMD-specific workaround */
sound/pci/hda/hda_intel.c +1 -9
@@ -40,7 +40,6 @@#ifdef CONFIG_X86 /* for snoop control */ -#include <linux/dma-map-ops.h> #include <asm/set_memory.h> #include <asm/cpufeature.h> #endif
@@ -307,7 +306,7 @@ enum {/* quirks for ATI HDMI with snoop off */ #define AZX_DCAPS_PRESET_ATI_HDMI_NS \ - (AZX_DCAPS_PRESET_ATI_HDMI | AZX_DCAPS_AMD_ALLOC_FIX) + (AZX_DCAPS_PRESET_ATI_HDMI | AZX_DCAPS_SNOOP_OFF)/* quirks for AMD SB */ #define AZX_DCAPS_PRESET_AMD_SB \
@@ -1703,13 +1702,6 @@ static void azx_check_snoop_available(stif (chip->driver_caps &AZX_DCAPS_SNOOP_OFF ) snoop = false; -#ifdef CONFIG_X86 -/* check the presence of DMA ops (i.e. IOMMU), disable snoop conditionally */ -if ((chip->driver_caps &AZX_DCAPS_AMD_ALLOC_FIX ) && - !get_dma_ops (chip->card->dev)) - snoop = false; -#endif - chip->snoop = snoop;if (!snoop) {dev_info (chip->card->dev,"Force to non-snoop mode\n" );
Greg Kroah-Hartman
maintainerPATCH 346/558 platform/x86: x86-android-tablets: Fix use after free on platform_device_register() errors
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
commit 2fae3129c0c08e72b1fe93e61fd8fd203252094a upstream.
x86_android_tablet_remove() frees the pdevs[] array, so it should not be used after calling x86_android_tablet_remove().
When platform_device_register() fails, store the pdevs[x] PTR_ERR() value into the local ret variable before calling x86_android_tablet_remove() to avoid using pdevs[] after it has been freed.
--- drivers/platform/x86/x86-android-tablets/core.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/platform/x86/x86-android-tablets/core.c +4 -2
@@ -390,8 +390,9 @@ static __init int x86_android_tablet_profor (i =0 ; i < pdev_count; i++) { pdevs[i] =platform_device_register_full (&dev_info->pdev_info[i]);if (IS_ERR (pdevs[i])) { + ret =PTR_ERR (pdevs[i]);x86_android_tablet_remove (pdev); -return PTR_ERR (pdevs[i]); +return ret; } }
@@ -443,8 +444,9 @@ static __init int x86_android_tablet_proPLATFORM_DEVID_AUTO , &pdata, sizeof(pdata));if (IS_ERR (pdevs[pdev_count])) { + ret =PTR_ERR (pdevs[pdev_count]);x86_android_tablet_remove (pdev); -return PTR_ERR (pdevs[pdev_count]); +return ret; } pdev_count++; }
Greg Kroah-Hartman
maintainerPATCH 347/558 platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zach Wade <[email protected]>
commit 7d59ac07ccb58f8f604f8057db63b8efcebeb3de upstream.
Attaching SST PCI device to VM causes "BUG: KASAN: slab-out-of-bounds". kasan report:
[ 19.411889] ================================================================== [ 19.413702] BUG: KASAN: slab-out-of-bounds in _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common] [ 19.415634] Read of size 8 at addr ffff888829e65200 by task cpuhp/16/113 [ 19.417368] [ 19.418627] CPU: 16 PID: 113 Comm: cpuhp/16 Tainted: G E 6.9.0 #10 [ 19.420435] Hardware name: VMware, Inc. VMware20,1/440BX Desktop Reference Platform, BIOS VMW201.00V.20192059.B64.2207280713 07/28/2022 [ 19.422687] Call Trace: [ 19.424091] <TASK> [ 19.425448] dump_stack_lvl+0x5d/0x80 [ 19.426963] ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common] [ 19.428694] print_report+0x19d/0x52e [ 19.430206] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 19.431837] ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common] [ 19.433539] kasan_report+0xf0/0x170 [ 19.435019] ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common] [ 19.436709] _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common] [ 19.438379] ? __pfx_sched_clock_cpu+0x10/0x10 [ 19.439910] isst_if_cpu_online+0x406/0x58f [isst_if_common] [ 19.441573] ? __pfx_isst_if_cpu_online+0x10/0x10 [isst_if_common] [ 19.443263] ? ttwu_queue_wakelist+0x2c1/0x360 [ 19.444797] cpuhp_invoke_callback+0x221/0xec0 [ 19.446337] cpuhp_thread_fun+0x21b/0x610 [ 19.447814] ? __pfx_cpuhp_thread_fun+0x10/0x10 [ 19.449354] smpboot_thread_fn+0x2e7/0x6e0 [ 19.450859] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 19.452405] kthread+0x29c/0x350 [ 19.453817] ? __pfx_kthread+0x10/0x10 [ 19.455253] ret_from_fork+0x31/0x70 [ 19.456685] ? __pfx_kthread+0x10/0x10 [ 19.458114] ret_from_fork_asm+0x1a/0x30 [ 19.459573] </TASK> [ 19.460853] [ 19.462055] Allocated by task 1198: [ 19.463410] kasan_save_stack+0x30/0x50 [ 19.464788] kasan_save_track+0x14/0x30 [ 19.466139] __kasan_kmalloc+0xaa/0xb0 [ 19.467465] __kmalloc+0x1cd/0x470 [ 19.468748] isst_if_cdev_register+0x1da/0x350 [isst_if_common] [ 19.470233] isst_if_mbox_init+0x108/0xff0 [isst_if_mbox_msr] [ 19.471670] do_one_initcall+0xa4/0x380 [ 19.472903] do_init_module+0x238/0x760 [ 19.474105] load_module+0x5239/0x6f00 [ 19.475285] init_module_from_file+0xd1/0x130 [ 19.476506] idempotent_init_module+0x23b/0x650 [ 19.477725] __x64_sys_finit_module+0xbe/0x130 [ 19.476506] idempotent_init_module+0x23b/0x650 [ 19.477725] __x64_sys_finit_module+0xbe/0x130 [ 19.478920] do_syscall_64+0x82/0x160 [ 19.480036] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 19.481292] [ 19.482205] The buggy address belongs to the object at ffff888829e65000 which belongs to the cache kmalloc-512 of size 512 [ 19.484818] The buggy address is located 0 bytes to the right of allocated 512-byte region [ffff888829e65000, ffff888829e65200) [ 19.487447] [ 19.488328] The buggy address belongs to the physical page: [ 19.489569] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888829e60c00 pfn:0x829e60 [ 19.491140] head: order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 19.492466] anon flags: 0x57ffffc0000840(slab|head|node=1|zone=2|lastcpupid=0x1fffff) [ 19.493914] page_type: 0xffffffff() [ 19.494988] raw: 0057ffffc0000840 ffff88810004cc80 0000000000000000 0000000000000001 [ 19.496451] raw: ffff888829e60c00 0000000080200018 00000001ffffffff 0000000000000000 [ 19.497906] head: 0057ffffc0000840 ffff88810004cc80 0000000000000000 0000000000000001 [ 19.499379] head: ffff888829e60c00 0000000080200018 00000001ffffffff 0000000000000000 [ 19.500844] head: 0057ffffc0000003 ffffea0020a79801 ffffea0020a79848 00000000ffffffff [ 19.502316] head: 0000000800000000 0000000000000000 00000000ffffffff 0000000000000000 [ 19.503784] page dumped because: kasan: bad access detected [ 19.505058] [ 19.505970] Memory state around the buggy address: [ 19.507172] ffff888829e65100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 19.508599] ffff888829e65180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 19.510013] >ffff888829e65200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.510014] ^ [ 19.510016] ffff888829e65280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.510018] ffff888829e65300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.515367] ==================================================================
The reason for this error is physical_package_ids assigned by VMware VMM are not continuous and have gaps. This will cause value returned by topology_physical_package_id() to be more than topology_max_packages().
Here the allocation uses topology_max_packages(). The call to topology_max_packages() returns maximum logical package ID not physical ID. Hence use topology_logical_package_id() instead of topology_physical_package_id().
--- drivers/platform/x86/intel/speed_select_if/isst_if_common.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/platform/x86/intel/speed_select_if/isst_if_common.c +3 -1
@@ -316,7 +316,9 @@ static struct pci_dev *_isst_if_get_pci_ cpu >= nr_cpu_ids || cpu >= num_possible_cpus())return NULL ; - pkg_id =topology_physical_package_id (cpu); + pkg_id =topology_logical_package_id (cpu); +if (pkg_id >=topology_max_packages ()) +return NULL ; bus_number = isst_cpu_info[cpu].bus_info[bus_no];if (bus_number <0 )
Greg Kroah-Hartman
maintainerPATCH 348/558 KVM: arm64: Fix kvm_has_feat*() handling of negative features
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <[email protected]>
commit a1d402abf8e3ff1d821e88993fc5331784fac0da upstream.
Oliver reports that the kvm_has_feat() helper is not behaviing as expected for negative feature. On investigation, the main issue seems to be caused by the following construct:
#define get_idreg_field(kvm, id, fld) \
(id##_##fld##_SIGNED ? \ get_idreg_field_signed(kvm, id, fld) : \ get_idreg_field_unsigned(kvm, id, fld))
where one side of the expression evaluates as something signed, and the other as something unsigned. In retrospect, this is totally braindead, as the compiler converts this into an unsigned expression. When compared to something that is 0, the test is simply elided.
Epic fail. Similar issue exists in the expand_field_sign() macro.
The correct way to handle this is to chose between signed and unsigned comparisons, so that both sides of the ternary expression are of the same type (bool).
In order to keep the code readable (sort of), we introduce new comparison primitives taking an operator as a parameter, and rewrite the kvm_has_feat*() helpers in terms of these primitives.
--- arch/arm64/include/asm/kvm_host.h | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-)
arch/arm64/include/asm/kvm_host.h +13 -12
@@ -1423,11 +1423,6 @@ void kvm_set_vm_id_reg(struct kvm *kvm, sign_extend64(__val, id##_##fld##_WIDTH - 1); \ }) -#define expand_field_sign (id, fld, val) \ - (id##_##fld##_SIGNED ? \ - __expand_field_sign_signed(id, fld, val) : \ - __expand_field_sign_unsigned(id, fld, val)) -#define get_idreg_field_unsigned (kvm, id, fld) \ ({ \ u64 __val = kvm_read_vm_id_reg((kvm), SYS_##id); \
@@ -1443,20 +1438,26 @@ void kvm_set_vm_id_reg(struct kvm *kvm,#define get_idreg_field_enum (kvm, id, fld) \ get_idreg_field_unsigned(kvm, id, fld) -#define get_idreg_field (kvm, id, fld) \ +#define kvm_cmp_feat_signed (kvm, id, fld, op, limit) \ + (get_idreg_field_signed((kvm), id, fld) op __expand_field_sign_signed(id, fld, limit)) + +#define kvm_cmp_feat_unsigned (kvm, id, fld, op, limit) \ + (get_idreg_field_unsigned((kvm), id, fld) op __expand_field_sign_unsigned(id, fld, limit)) + +#define kvm_cmp_feat (kvm, id, fld, op, limit) \ (id##_##fld##_SIGNED ? \ - get_idreg_field_signed(kvm, id, fld) : \ - get_idreg_field_unsigned(kvm, id, fld)) + kvm_cmp_feat_signed(kvm, id, fld, op, limit) : \ + kvm_cmp_feat_unsigned(kvm, id, fld, op, limit))#define kvm_has_feat (kvm, id, fld, limit) \ - (get_idreg_field((kvm), id, fld) >= expand_field_sign(id, fld, limit)) + kvm_cmp_feat(kvm, id, fld, >=, limit)#define kvm_has_feat_enum (kvm, id, fld, val) \ - (get_idreg_field_unsigned((kvm), id, fld) == __expand_field_sign_unsigned(id, fld, val)) + kvm_cmp_feat_unsigned(kvm, id, fld, ==, val)#define kvm_has_feat_range (kvm, id, fld, min, max) \ - (get_idreg_field((kvm), id, fld) >= expand_field_sign(id, fld, min) && \ - get_idreg_field((kvm), id, fld) <= expand_field_sign(id, fld, max)) + (kvm_cmp_feat(kvm, id, fld, >=, min) && \ + kvm_cmp_feat(kvm, id, fld, <=, max))/* Check for a given level of PAuth support */ #define kvm_has_pauth (k, l) \
Greg Kroah-Hartman
maintainerPATCH 349/558 i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
commit 048bbbdbf85e5e00258dfb12f5e368f908801d7b upstream.
In case there is any sort of clock controller attached to this I2C bus controller, for example Versaclock or even an AIC32x4 I2C codec, then an I2C transfer triggered from the clock controller clk_ops .prepare callback may trigger a deadlock on drivers/clk/clk.c prepare_lock mutex.
This is because the clock controller first grabs the prepare_lock mutex and then performs the prepare operation, including its I2C access. The I2C access resumes this I2C bus controller via .runtime_resume callback, which calls clk_prepare_enable(), which attempts to grab the prepare_lock mutex again and deadlocks.
Since the clock are already prepared since probe() and unprepared in remove(), use simple clk_enable()/clk_disable() calls to enable and disable the clock on runtime suspend and resume, to avoid hitting the prepare_lock mutex.
--- drivers/i2c/busses/i2c-stm32f7.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/i2c/busses/i2c-stm32f7.c +3 -3
@@ -2395,7 +2395,7 @@ static int __maybe_unused stm32f7_i2c_rustruct stm32f7_i2c_dev *i2c_dev =dev_get_drvdata (dev);if (!stm32f7_i2c_is_slave_registered (i2c_dev)) -clk_disable_unprepare (i2c_dev->clk); +clk_disable (i2c_dev->clk);return 0 ; }
@@ -2406,9 +2406,9 @@ static int __maybe_unused stm32f7_i2c_ruint ret;if (!stm32f7_i2c_is_slave_registered (i2c_dev)) { - ret =clk_prepare_enable (i2c_dev->clk); + ret =clk_enable (i2c_dev->clk);if (ret) { -dev_err (dev,"failed to prepare_enable clock\n" ); +dev_err (dev,"failed to enable clock\n" );return ret; } }
Greg Kroah-Hartman
maintainerPATCH 350/558 i2c: qcom-geni: Use IRQF_NO_AUTOEN flag in request_irq()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
commit e2c85d85a05f16af2223fcc0195ff50a7938b372 upstream.
disable_irq() after request_irq() still has a time gap in which interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will disable IRQ auto-enable when request IRQ.
--- drivers/i2c/busses/i2c-qcom-geni.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/i2c/busses/i2c-qcom-geni.c +1 -3
@@ -818,15 +818,13 @@ static int geni_i2c_probe(struct platforinit_completion (&gi2c->done);spin_lock_init (&gi2c->lock);platform_set_drvdata (pdev, gi2c); - ret =devm_request_irq (dev, gi2c->irq, geni_i2c_irq,0 , + ret =devm_request_irq (dev, gi2c->irq, geni_i2c_irq,IRQF_NO_AUTOEN ,dev_name (dev), gi2c);if (ret) {dev_err (dev,"Request_irq failed:%d: err:%d\n" , gi2c->irq, ret);return ret; } -/* Disable the interrupt so that the system can enter low-power mode */ -disable_irq (gi2c->irq);i2c_set_adapdata (&gi2c->adap, gi2c); gi2c->adap.dev.parent = dev; gi2c->adap.dev.of_node = dev->of_node;
Greg Kroah-Hartman
maintainerPATCH 351/558 i2c: xiic: Wait for TX empty to avoid missed TX NAKs
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robert Hancock <[email protected]>
commit 521da1e9225450bd323db5fa5bca942b1dc485b7 upstream.
Frequently an I2C write will be followed by a read, such as a register address write followed by a read of the register value. In this driver, when the TX FIFO half empty interrupt was raised and it was determined that there was enough space in the TX FIFO to send the following read command, it would do so without waiting for the TX FIFO to actually empty.
Unfortunately it appears that in some cases this can result in a NAK that was raised by the target device on the write, such as due to an unsupported register address, being ignored and the subsequent read being done anyway. This can potentially put the I2C bus into an invalid state and/or result in invalid read data being processed.
To avoid this, once a message has been fully written to the TX FIFO, wait for the TX FIFO empty interrupt before moving on to the next message, to ensure NAKs are handled properly.
--- drivers/i2c/busses/i2c-xiic.c | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-)
drivers/i2c/busses/i2c-xiic.c +9 -10
@@ -772,14 +772,17 @@ static irqreturn_t xiic_process(int irq, goto out; } -xiic_fill_tx_fifo (i2c); - -/* current message sent and there is space in the fifo */ -if (!xiic_tx_space (i2c) &&xiic_tx_fifo_space (i2c) >=2 ) { +if (xiic_tx_space (i2c)) { +xiic_fill_tx_fifo (i2c); + }else { +/* current message fully written */ dev_dbg (i2c->adap.dev.parent,"%s end of message sent, nmsgs: %d\n" , __func__, i2c->nmsgs); -if (i2c->nmsgs >1 ) { +/* Don't move onto the next message until the TX FIFO empties, +* to ensure that a NAK is not missed. +*/ +if (i2c->nmsgs >1 && (pend &XIIC_INTR_TX_EMPTY_MASK )) { i2c->nmsgs--; i2c->tx_msg++; xfer_more =1 ;
@@ -790,11 +793,7 @@ static irqreturn_t xiic_process(int irq,"%s Got TX IRQ but no more to do...\n" , __func__); } - }else if (!xiic_tx_space (i2c) && (i2c->nmsgs ==1 )) -/* current frame is sent and is last, -* make sure to disable tx half -*/ -xiic_irq_dis (i2c,XIIC_INTR_TX_HALF_MASK ); + } }if (pend &XIIC_INTR_BNB_MASK ) {
Greg Kroah-Hartman
maintainerPATCH 352/558 media: i2c: ar0521: Use cansleep version of gpiod_set_value()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Shiyan <[email protected]>
commit bee1aed819a8cda47927436685d216906ed17f62 upstream.
If we use GPIO reset from I2C port expander, we must use *_cansleep() variant of GPIO functions.
This was not done in ar0521_power_on()/ar0521_power_off() functions. Let's fix that.
------------[ cut here ]------------ WARNING: CPU: 0 PID: 11 at drivers/gpio/gpiolib.c:3496 gpiod_set_value+0x74/0x7c Modules linked in: CPU: 0 PID: 11 Comm: kworker/u16:0 Not tainted 6.10.0 #53 Hardware name: Diasom DS-RK3568-SOM-EVB (DT) Workqueue: events_unbound deferred_probe_work_func pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : gpiod_set_value+0x74/0x7c lr : ar0521_power_on+0xcc/0x290
sp : ffffff8001d7ab70
x29: ffffff8001d7ab70 x28: ffffff80027dcc90 x27: ffffff8003c82000
x26: ffffff8003ca9250 x25: ffffffc080a39c60 x24: ffffff8003ca9088
x23: ffffff8002402720 x22: ffffff8003ca9080 x21: ffffff8003ca9088
x20: 0000000000000000 x19: ffffff8001eb2a00 x18: ffffff80efeeac80
x17: 756d2d6332692f30 x16: 0000000000000000 x15: 0000000000000000
x14: ffffff8001d91d40 x13: 0000000000000016 x12: ffffffc080e98930
x11: ffffff8001eb2880 x10: 0000000000000890 x9 : ffffff8001d7a9f0 x8 : ffffff8001d92570 x7 : ffffff80efeeac80 x6 : 000000003fc6e780 x5 : ffffff8001d91c80 x4 : 0000000000000002 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000001
Call trace: gpiod_set_value+0x74/0x7c ar0521_power_on+0xcc/0x290
...
--- drivers/media/i2c/ar0521.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/media/i2c/ar0521.c +3 -2
@@ -844,7 +844,8 @@ static int ar0521_power_off(struct devicclk_disable_unprepare (sensor->extclk);if (sensor->reset_gpio) -gpiod_set_value (sensor->reset_gpio,1 );/* assert RESET signal */ +/* assert RESET signal */ +gpiod_set_value_cansleep (sensor->reset_gpio,1 );for (i =ARRAY_SIZE (ar0521_supply_names) -1 ; i >=0 ; i--) {if (sensor->supplies[i])
@@ -878,7 +879,7 @@ static int ar0521_power_on(struct deviceif (sensor->reset_gpio)/* deassert RESET signal */ -gpiod_set_value (sensor->reset_gpio,0 ); +gpiod_set_value_cansleep (sensor->reset_gpio,0 );usleep_range (4500 ,5000 );/* min 45000 clocks */ for (cnt =0 ; cnt <ARRAY_SIZE (initial_regs); cnt++) {
Greg Kroah-Hartman
maintainerPATCH 353/558 i2c: core: Lock address during client device instantiation
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiner Kallweit <[email protected]>
commit 8d3cefaf659265aa82b0373a563fdb9d16a2b947 upstream.
Krzysztof reported an issue [0] which is caused by parallel attempts to instantiate the same I2C client device. This can happen if driver supports auto-detection, but certain devices are also instantiated explicitly.
The original change isn't actually wrong, it just revealed that I2C core isn't prepared yet to handle this scenario.
Calls to i2c_new_client_device() can be nested, therefore we can't use a simple mutex here. Parallel instantiation of devices at different addresses is ok, so we just have to prevent parallel instantiation at the same address. We can use a bitmap with one bit per 7-bit I2C client address, and atomic bit operations to set/check/clear bits.
Now a parallel attempt to instantiate a device at the same address will result in -EBUSY being returned, avoiding the "sysfs: cannot create duplicate filename" splash.
Note: This patch version includes small cosmetic changes to the Tested-by
version, only functional change is that address locking is supported for slave addresses too.
[0] https://lore.kernel.org/linux-i2c/[email protected]/T/#m12706546e8e2414d8f1a0dc61c53393f731685cc
--- drivers/i2c/i2c-core-base.c | 28 ++++++++++++++++++++++++++++ include/linux/i2c.h | 3 +++ 2 files changed, 31 insertions(+)
drivers/i2c/i2c-core-base.c +28 -0
@@ -915,6 +915,27 @@ int i2c_dev_irq_from_resources(const strreturn 0 ; } +/* +* Serialize device instantiation in case it can be instantiated explicitly +* and by auto-detection +*/ +static int i2c_lock_addr (struct i2c_adapter *adap,unsigned short addr, +unsigned short flags) +{ +if (!(flags &I2C_CLIENT_TEN ) && +test_and_set_bit (addr, adap->addrs_in_instantiation)) +return -EBUSY ; + +return 0 ; +} + +static void i2c_unlock_addr (struct i2c_adapter *adap,unsigned short addr, +unsigned short flags) +{ +if (!(flags &I2C_CLIENT_TEN )) +clear_bit (addr, adap->addrs_in_instantiation); +} +/** * i2c_new_client_device - instantiate an i2c device * @adap: the adapter managing the device
@@ -962,6 +983,10 @@ i2c_new_client_device(struct i2c_adapter goto out_err_silent; } + status =i2c_lock_addr (adap, client->addr, client->flags); +if (status) + goto out_err_silent; +/* Check for address business */ status =i2c_check_addr_busy (adap,i2c_encode_flags_to_addr (client));if (status)
@@ -993,6 +1018,8 @@ i2c_new_client_device(struct i2c_adapterdev_dbg (&adap->dev,"client [%s] registered with bus id %s\n" , client->name,dev_name (&client->dev)); +i2c_unlock_addr (adap, client->addr, client->flags); +return client; out_remove_swnode:
@@ -1004,6 +1031,7 @@ out_err:dev_err (&adap->dev,"Failed to register i2c client %s at 0x%02x (%d)\n" , client->name, client->addr, status); +i2c_unlock_addr (adap, client->addr, client->flags); out_err_silent:if (need_put)put_device (&client->dev);
include/linux/i2c.h +3 -0
@@ -761,6 +761,9 @@ struct i2c_adapter {struct regulator *bus_regulator;struct dentry *debugfs; + +/* 7bit address space */ +DECLARE_BITMAP (addrs_in_instantiation,1 <<7 ); };#define to_i2c_adapter (d) container_of(d, struct i2c_adapter, dev)
Greg Kroah-Hartman
maintainerPATCH 354/558 i2c: xiic: Fix pm_runtime_set_suspended() with runtime pm enabled
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
commit 0c8d604dea437b69a861479b413d629bc9b3da70 upstream.
It is not valid to call pm_runtime_set_suspended() for devices with runtime PM enabled because it returns -EAGAIN if it is enabled already and working. So, call pm_runtime_disable() before to fix it.
--- drivers/i2c/busses/i2c-xiic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i2c/busses/i2c-xiic.c +1 -1
@@ -1337,8 +1337,8 @@ static int xiic_i2c_probe(struct platforreturn 0 ; err_pm_disable: -pm_runtime_set_suspended (&pdev->dev);pm_runtime_disable (&pdev->dev); +pm_runtime_set_suspended (&pdev->dev);return ret; }
Greg Kroah-Hartman
maintainerPATCH 355/558 i2c: designware: fix controller is holding SCL low while ENABLE bit is disabled
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kimriver Liu <[email protected]>
commit 5d69d5a00f80488ddcb4dee7d1374a0709398178 upstream.
It was observed that issuing the ABORT bit (IC_ENABLE[1]) will not work when IC_ENABLE is already disabled.
Check if the ENABLE bit (IC_ENABLE[0]) is disabled when the controller is holding SCL low. If the ENABLE bit is disabled, the software needs to enable it before trying to issue the ABORT bit. otherwise, the controller ignores any write to ABORT bit.
These kernel logs show up whenever an I2C transaction is attempted after this failure.i2c_designware e95e0000.i2c: timeout waiting for bus ready i2c_designware e95e0000.i2c: timeout in disabling adapter
The patch fixes the issue where the controller cannot be disabled while SCL is held low if the ENABLE bit is already disabled.
--- drivers/i2c/busses/i2c-designware-common.c | 14 ++++++++++ drivers/i2c/busses/i2c-designware-core.h | 1 drivers/i2c/busses/i2c-designware-master.c | 38 +++++++++++++++++++++++++++++ 3 files changed, 53 insertions(+)
drivers/i2c/busses/i2c-designware-common.c +14 -0
@@ -441,6 +441,7 @@ err_release_lock:void __i2c_dw_disable (struct dw_i2c_dev *dev) { +struct i2c_timings *t = &dev->timings;unsigned int raw_intr_stats;unsigned int enable;int timeout =100 ;
@@ -453,6 +454,19 @@ void __i2c_dw_disable(struct dw_i2c_dev abort_needed = raw_intr_stats &DW_IC_INTR_MST_ON_HOLD ;if (abort_needed) { +if (!(enable &DW_IC_ENABLE_ENABLE )) { +regmap_write (dev->map,DW_IC_ENABLE ,DW_IC_ENABLE_ENABLE ); +/* +* Wait 10 times the signaling period of the highest I2C +* transfer supported by the driver (for 400KHz this is +* 25us) to ensure the I2C ENABLE bit is already set +* as described in the DesignWare I2C databook. +*/ +fsleep (DIV_ROUND_CLOSEST_ULL (10 *MICRO , t->bus_freq_hz)); +/* Set ENABLE bit before setting ABORT */ + enable |=DW_IC_ENABLE_ENABLE ; + } +regmap_write (dev->map,DW_IC_ENABLE , enable |DW_IC_ENABLE_ABORT ); ret = regmap_read_poll_timeout(dev->map, DW_IC_ENABLE, enable, !(enable & DW_IC_ENABLE_ABORT), 10,
drivers/i2c/busses/i2c-designware-core.h +1 -0
@@ -109,6 +109,7 @@ DW_IC_INTR_RX_UNDER | \ DW_IC_INTR_RD_REQ) +#define DW_IC_ENABLE_ENABLE BIT(0)#define DW_IC_ENABLE_ABORT BIT(1)#define DW_IC_STATUS_ACTIVITY BIT(0)
drivers/i2c/busses/i2c-designware-master.c +38 -0
@@ -253,6 +253,34 @@ static void i2c_dw_xfer_init(struct dw_i__i2c_dw_write_intr_mask (dev,DW_IC_INTR_MASTER_MASK ); } +/* +* This function waits for the controller to be idle before disabling I2C +* When the controller is not in the IDLE state, the MST_ACTIVITY bit +* (IC_STATUS[5]) is set. +* +* Values: +* 0x1 (ACTIVE): Controller not idle +* 0x0 (IDLE): Controller is idle +* +* The function is called after completing the current transfer. +* +* Returns: +* False when the controller is in the IDLE state. +* True when the controller is in the ACTIVE state. +*/ +static bool i2c_dw_is_controller_active (struct dw_i2c_dev *dev) +{ +u32 status; + +regmap_read (dev->map,DW_IC_STATUS , &status); +if (!(status &DW_IC_STATUS_MASTER_ACTIVITY )) +return false; + +return regmap_read_poll_timeout (dev->map,DW_IC_STATUS , status, + !(status &DW_IC_STATUS_MASTER_ACTIVITY ), +1100 ,20000 ) !=0 ; +} +static int i2c_dw_check_stopbit (struct dw_i2c_dev *dev) {u32 val;
@@ -789,6 +817,16 @@ i2c_dw_xfer(struct i2c_adapter *adap, st }/* +* This happens rarely (~1:500) and is hard to reproduce. Debug trace +* showed that IC_STATUS had value of 0x23 when STOP_DET occurred, +* if disable IC_ENABLE.ENABLE immediately that can result in +* IC_RAW_INTR_STAT.MASTER_ON_HOLD holding SCL low. Check if +* controller is still ACTIVE before disabling I2C. +*/ +if (i2c_dw_is_controller_active (dev)) +dev_err (dev->dev,"controller active\n" ); + +/* * We must disable the adapter before returning and signaling the end * of the current transfer. Otherwise the hardware might continue * generating interrupts which in turn causes a race condition with
Greg Kroah-Hartman
maintainerPATCH 356/558 i2c: synquacer: Deal with optional PCLK correctly
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <[email protected]>
commit f2990f8630531a99cad4dc5c44cb2a11ded42492 upstream.
ACPI boot does not provide clocks and regulators, but instead, provides the PCLK rate directly, and enables the clock in firmware. So deal gracefully with this.
--- drivers/i2c/busses/i2c-synquacer.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/i2c/busses/i2c-synquacer.c +3 -2
@@ -550,12 +550,13 @@ static int synquacer_i2c_probe(struct pldevice_property_read_u32 (&pdev->dev,"socionext,pclk-rate" , &i2c->pclkrate); - pclk =devm_clk_get_enabled (&pdev->dev,"pclk" ); + pclk =devm_clk_get_optional_enabled (&pdev->dev,"pclk" );if (IS_ERR (pclk))return dev_err_probe (&pdev->dev,PTR_ERR (pclk),"failed to get and enable clock\n" ); - i2c->pclkrate =clk_get_rate (pclk); +if (pclk) + i2c->pclkrate =clk_get_rate (pclk);if (i2c->pclkrate <SYNQUACER_I2C_MIN_CLK_RATE || i2c->pclkrate >SYNQUACER_I2C_MAX_CLK_RATE )
Greg Kroah-Hartman
maintainerPATCH 357/558 rust: sync: require `T: Sync` for `LockedBy::access`
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alice Ryhl <[email protected]>
commit a8ee30f45d5d57467ddb7877ed6914d0eba0af7f upstream.
The LockedBy::access method only requires a shared reference to the owner, so if we have shared access to the LockedBy from several threads at once, then two threads could call access in parallel and both obtain a shared reference to the inner value. Thus, require that T: Sync when calling the access method.
An alternative is to require T: Sync in the impl Sync for LockedBy. This patch does not choose that approach as it gives up the ability to use LockedBy with !Sync types, which is okay as long as you only use access_mut.
--- rust/kernel/sync/locked_by.rs | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-)
rust/kernel/sync/locked_by.rs +14 -4
@@ -83,8 +83,12 @@ pub struct LockedBy<T: ?Sized, U: ?Sized// SAFETY: `LockedBy` can be transferred across thread boundaries iff the data it protects can. unsafe impl <T : ?Sized +Send ,U : ?Sized >Send for LockedBy <T ,U > {} -// SAFETY: `LockedBy` serialises the interior mutability it provides, so it is `Sync` as long as the -// data it protects is `Send`. +// SAFETY: If `T` is not `Sync`, then parallel shared access to this `LockedBy` allows you to use +// `access_mut` to hand out `&mut T` on one thread at the time. The requirement that `T: Send` is +// sufficient to allow that. +// +// If `T` is `Sync`, then the `access` method also becomes available, which allows you to obtain +// several `&T` from several threads at once. However, this is okay as `T` is `Sync`. unsafe impl <T : ?Sized +Send ,U : ?Sized >Sync for LockedBy <T ,U > {}impl <T ,U >LockedBy <T ,U > {
@@ -118,7 +122,10 @@ impl<T: ?Sized, U> LockedBy<T, U> {/// /// Panics if `owner` is different from the data protected by the lock used in /// [`new`](LockedBy::new). -pub fn access <'a>(&'a self, owner: &'aU ) -> &'aT { +pub fn access <'a>(&'a self, owner: &'aU ) -> &'aT +where +T :Sync , + {build_assert! (size_of ::<U >() >0 ,"`U` cannot be a ZST because `owner` wouldn't be unique"
@@ -127,7 +134,10 @@ impl<T: ?Sized, U> LockedBy<T, U> {panic! ("mismatched owners" ); } -// SAFETY: `owner` is evidence that the owner is locked. +// SAFETY: `owner` is evidence that there are only shared references to the owner for the +// duration of 'a, so it's not possible to use `Self::access_mut` to obtain a mutable +// reference to the inner value that aliases with this shared reference. The type is `Sync` +// so there are no other requirements. unsafe { &*self.data.get () } }
Greg Kroah-Hartman
maintainerPATCH 358/558 ovl: fail if trusted xattrs are needed but caller lacks permission
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Baynton <[email protected]>
commit 6c4a5f96450415735c31ed70ff354f0ee5cbf67b upstream.
Some overlayfs features require permission to read/write trusted.* xattrs. These include redirect_dir, verity, metacopy, and data-only layers. This patch adds additional validations at mount time to stop overlays from mounting in certain cases where the resulting mount would not function according to the user's expectations because they lack permission to access trusted.* xattrs (for example, not global root.)
Similar checks in ovl_make_workdir() that disable features instead of failing are still relevant and used in cases where the resulting mount can still work "reasonably well." Generally, if the feature was enabled through kernel config or module option, any mount that worked before will still work the same; this applies to redirect_dir and metacopy. The user must explicitly request these features in order to generate a mount failure. Verity and data-only layers on the other hand must be explictly requested and have no "reasonable" disabled or degraded alternative, so mounts attempting either always fail.
"lower data-only dirs require metacopy support" moved down in case userxattr is set, which disables metacopy.
--- fs/overlayfs/params.c | 38 +++++++++++++++++++++++++++++++++----- 1 file changed, 33 insertions(+), 5 deletions(-)
fs/overlayfs/params.c +33 -5
@@ -755,11 +755,6 @@ int ovl_fs_params_verify(const struct ov {struct ovl_opt_set set = ctx->set; -if (ctx->nr_data >0 && !config->metacopy) { -pr_err ("lower data-only dirs require metacopy support.\n" ); -return -EINVAL ; - } -/* Workdir/index are useless in non-upper mount */ if (!config->upperdir) {if (config->workdir) {
@@ -911,6 +906,39 @@ int ovl_fs_params_verify(const struct ov config->metacopy = false; } +/* +* Fail if we don't have trusted xattr capability and a feature was +* explicitly requested that requires them. +*/ +if (!config->userxattr && !capable (CAP_SYS_ADMIN )) { +if (set.redirect && + config->redirect_mode !=OVL_REDIRECT_NOFOLLOW ) { +pr_err ("redirect_dir requires permission to access trusted xattrs\n" ); +return -EPERM ; + } +if (config->metacopy && set.metacopy) { +pr_err ("metacopy requires permission to access trusted xattrs\n" ); +return -EPERM ; + } +if (config->verity_mode) { +pr_err ("verity requires permission to access trusted xattrs\n" ); +return -EPERM ; + } +if (ctx->nr_data >0 ) { +pr_err ("lower data-only dirs require permission to access trusted xattrs\n" ); +return -EPERM ; + } +/* +* Other xattr-dependent features should be disabled without +* great disturbance to the user in ovl_make_workdir(). +*/ + } + +if (ctx->nr_data >0 && !config->metacopy) { +pr_err ("lower data-only dirs require metacopy support.\n" ); +return -EINVAL ; + } +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 359/558 firmware: tegra: bpmp: Drop unused mbox_client_to_bpmp()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
commit 9c3a62c20f7fb00294a4237e287254456ba8a48b upstream.
mbox_client_to_bpmp() is not used, W=1 builds:
drivers/firmware/tegra/bpmp.c:28:1: error: unused function 'mbox_client_to_bpmp' [-Werror,-Wunused-function]
--- drivers/firmware/tegra/bpmp.c | 6 ------ 1 file changed, 6 deletions(-)
drivers/firmware/tegra/bpmp.c +0 -6
@@ -24,12 +24,6 @@#define MSG_RING BIT(1)#define TAG_SZ 32 -static inline struct tegra_bpmp * -mbox_client_to_bpmp (struct mbox_client *client) -{ - return container_of(client, struct tegra_bpmp, mbox.client); -} -static inline const struct tegra_bpmp_ops *channel_to_ops (struct tegra_bpmp_channel *channel) {
Greg Kroah-Hartman
maintainerPATCH 360/558 memory: tegra186-emc: drop unused to_tegra186_emc()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
commit 67dd9e861add38755a7c5d29e25dd0f6cb4116ab upstream.
to_tegra186_emc() is not used, W=1 builds:
tegra186-emc.c:38:36: error: unused function 'to_tegra186_emc' [-Werror,-Wunused-function]
--- drivers/memory/tegra/tegra186-emc.c | 5 ----- 1 file changed, 5 deletions(-)
drivers/memory/tegra/tegra186-emc.c +0 -5
@@ -35,11 +35,6 @@ struct tegra186_emc {struct icc_provider provider; }; -static inline struct tegra186_emc *to_tegra186_emc (struct icc_provider *provider) -{ - return container_of(provider, struct tegra186_emc, provider); -} -/* * debugfs interface *
Greg Kroah-Hartman
maintainerPATCH 361/558 dt-bindings: clock: exynos7885: Fix duplicated binding
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Virag <[email protected]>
commit abf3a3ea9acb5c886c8729191a670744ecd42024 upstream.
The numbering in Exynos7885's FSYS CMU bindings has 4 duplicated by accident, with the rest of the bindings continuing with 5.
Fix this by moving CLK_MOUT_FSYS_USB30DRD_USER to the end as 11.
Since CLK_MOUT_FSYS_USB30DRD_USER is not used in any device tree as of now, and there are no other clocks affected (maybe apart from CLK_MOUT_FSYS_MMC_SDIO_USER which the number was shared with, also not used in a device tree), this is the least impactful way to solve this problem.
--- include/dt-bindings/clock/exynos7885.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/dt-bindings/clock/exynos7885.h +1 -1
@@ -136,12 +136,12 @@#define CLK_MOUT_FSYS_MMC_CARD_USER 2#define CLK_MOUT_FSYS_MMC_EMBD_USER 3#define CLK_MOUT_FSYS_MMC_SDIO_USER 4 -#define CLK_MOUT_FSYS_USB30DRD_USER 4#define CLK_GOUT_MMC_CARD_ACLK 5#define CLK_GOUT_MMC_CARD_SDCLKIN 6#define CLK_GOUT_MMC_EMBD_ACLK 7#define CLK_GOUT_MMC_EMBD_SDCLKIN 8#define CLK_GOUT_MMC_SDIO_ACLK 9#define CLK_GOUT_MMC_SDIO_SDCLKIN 10 +#define CLK_MOUT_FSYS_USB30DRD_USER 11#endif /* _DT_BINDINGS_CLOCK_EXYNOS_7885_H */
Greg Kroah-Hartman
maintainerPATCH 362/558 spi: bcm63xx: Fix module autoloading
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
commit 909f34f2462a99bf876f64c5c61c653213e32fce upstream.
Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based on the alias from platform_device_id table.
--- drivers/spi/spi-bcm63xx.c | 1 + 1 file changed, 1 insertion(+)
drivers/spi/spi-bcm63xx.c +1 -0
@@ -466,6 +466,7 @@ static const struct platform_device_id b { }, }; +MODULE_DEVICE_TABLE (platform, bcm63xx_spi_dev_match);static const struct of_device_id bcm63xx_spi_of_match[] = { { .compatible ="brcm,bcm6348-spi" , .data = &bcm6348_spi_reg_offsets },
Greg Kroah-Hartman
maintainerPATCH 363/558 spi: bcm63xx: Fix missing pm_runtime_disable()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
commit 265697288ec2160ca84707565d6641d46f69b0ff upstream.
The pm_runtime_disable() is missing in the remove function, fix it by using devm_pm_runtime_enable(), so the pm_runtime_disable() in the probe error path can also be removed.
--- drivers/spi/spi-bcm63xx.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/spi/spi-bcm63xx.c +4 -4
@@ -584,13 +584,15 @@ static int bcm63xx_spi_probe(struct platbcm_spi_writeb (bs,SPI_INTR_CLEAR_ALL ,SPI_INT_STATUS ); -pm_runtime_enable (&pdev->dev); + ret =devm_pm_runtime_enable (&pdev->dev); +if (ret) + goto out_clk_disable;/* register and we are done */ ret =devm_spi_register_controller (dev, host);if (ret) {dev_err (dev,"spi register failed\n" ); - goto out_pm_disable; + goto out_clk_disable; } dev_info(dev, "at %pr (irq %d, FIFOs size %d)\n",
@@ -598,8 +600,6 @@ static int bcm63xx_spi_probe(struct platreturn 0 ; -out_pm_disable: -pm_runtime_disable (&pdev->dev); out_clk_disable:clk_disable_unprepare (clk); out_err:
Greg Kroah-Hartman
maintainerPATCH 364/558 power: supply: hwmon: Fix missing temp1_max_alarm attribute
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
commit e50a57d16f897e45de1112eb6478577b197fab52 upstream.
Temp channel 0 aka temp1 can have a temp1_max_alarm attribute for power_supply devices which have a POWER_SUPPLY_PROP_TEMP_ALERT_MAX property.
HWMON_T_MAX_ALARM was missing from power_supply_hwmon_info for temp channel 0, causing the hwmon temp1_max_alarm attribute to be missing from such power_supply devices.
Add this to power_supply_hwmon_info to fix this.
--- drivers/power/supply/power_supply_hwmon.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/power/supply/power_supply_hwmon.c +2 -1
@@ -318,7 +318,8 @@ static const struct hwmon_channel_info *HWMON_T_INPUT |HWMON_T_MAX |HWMON_T_MIN | -HWMON_T_MIN_ALARM , +HWMON_T_MIN_ALARM | +HWMON_T_MAX_ALARM ,HWMON_T_LABEL | HWMON_T_INPUT |
Greg Kroah-Hartman
maintainerPATCH 365/558 mm, slub: avoid zeroing kmalloc redzone
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <[email protected]>
commit 59090e479ac78ae18facd4c58eb332562a23020e upstream.
Since commit 946fa0dbf2d8 ("mm/slub: extend redzone check to extra allocated kmalloc space than requested"), setting orig_size treats the wasted space (object_size - orig_size) as a redzone. However with init_on_free=1 we clear the full object->size, including the redzone.
Additionally we clear the object metadata, including the stored orig_size, making it zero, which makes check_object() treat the whole object as a redzone.
These issues lead to the following BUG report with "slub_debug=FUZ init_on_free=1":
[ 0.000000] ============================================================================= [ 0.000000] BUG kmalloc-8 (Not tainted): kmalloc Redzone overwritten [ 0.000000] ----------------------------------------------------------------------------- [ 0.000000] [ 0.000000] 0xffff000010032858-0xffff00001003285f @offset=2136. First byte 0x0 instead of 0xcc [ 0.000000] FIX kmalloc-8: Restoring kmalloc Redzone 0xffff000010032858-0xffff00001003285f=0xcc [ 0.000000] Slab 0xfffffdffc0400c80 objects=36 used=23 fp=0xffff000010032a18 flags=0x3fffe0000000200(workingset|node=0|zone=0|lastcpupid=0x1ffff) [ 0.000000] Object 0xffff000010032858 @offset=2136 fp=0xffff0000100328c8 [ 0.000000] [ 0.000000] Redzone ffff000010032850: cc cc cc cc cc cc cc cc ........ [ 0.000000] Object ffff000010032858: cc cc cc cc cc cc cc cc ........ [ 0.000000] Redzone ffff000010032860: cc cc cc cc cc cc cc cc ........ [ 0.000000] Padding ffff0000100328b4: 00 00 00 00 00 00 00 00 00 00 00 00 ............ [ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.11.0-rc3-next-20240814-00004-g61844c55c3f4 #144 [ 0.000000] Hardware name: NXP i.MX95 19X19 board (DT) [ 0.000000] Call trace: [ 0.000000] dump_backtrace+0x90/0xe8 [ 0.000000] show_stack+0x18/0x24 [ 0.000000] dump_stack_lvl+0x74/0x8c [ 0.000000] dump_stack+0x18/0x24 [ 0.000000] print_trailer+0x150/0x218 [ 0.000000] check_object+0xe4/0x454 [ 0.000000] free_to_partial_list+0x2f8/0x5ec
To address the issue, use orig_size to clear the used area. And restore the value of orig_size after clear the remaining area.
When CONFIG_SLUB_DEBUG not defined, (get_orig_size()' directly returns s->object_size. So when using memset to init the area, the size can simply be orig_size, as orig_size returns object_size when CONFIG_SLUB_DEBUG not enabled. And orig_size can never be bigger than object_size.
--- mm/slub.c | 100 ++++++++++++++++++++++++++++++++------------------------------ 1 file changed, 53 insertions(+), 47 deletions(-)
mm/slub.c +53 -47
@@ -756,6 +756,50 @@ static inline bool slab_update_freelist(return false; } +/* +* kmalloc caches has fixed sizes (mostly power of 2), and kmalloc() API +* family will round up the real request size to these fixed ones, so +* there could be an extra area than what is requested. Save the original +* request size in the meta data area, for better debug and sanity check. +*/ +static inline void set_orig_size (struct kmem_cache *s, +void *object,unsigned int orig_size) +{ +void *p =kasan_reset_tag (object); +unsigned int kasan_meta_size; + +if (!slub_debug_orig_size (s)) +return ; + +/* +* KASAN can save its free meta data inside of the object at offset 0. +* If this meta data size is larger than 'orig_size', it will overlap +* the data redzone in [orig_size+1, object_size]. Thus, we adjust +* 'orig_size' to be as at least as big as KASAN's meta data. +*/ + kasan_meta_size =kasan_metadata_size (s, true); +if (kasan_meta_size > orig_size) + orig_size = kasan_meta_size; + + p +=get_info_end (s); + p +=sizeof (struct track ) *2 ; + + *(unsigned int *)p = orig_size; +} + +static inline unsigned int get_orig_size (struct kmem_cache *s,void *object) +{ +void *p =kasan_reset_tag (object); + +if (!slub_debug_orig_size (s)) +return s->object_size; + + p +=get_info_end (s); + p +=sizeof (struct track ) *2 ; + +return *(unsigned int *)p; +} +#ifdef CONFIG_SLUB_DEBUG static unsigned long object_map[BITS_TO_LONGS (MAX_OBJS_PER_PAGE )];static DEFINE_SPINLOCK (object_map_lock);
@@ -985,50 +1029,6 @@ static void print_slab_info(const struct &slab->__page_flags); } -/* -* kmalloc caches has fixed sizes (mostly power of 2), and kmalloc() API -* family will round up the real request size to these fixed ones, so -* there could be an extra area than what is requested. Save the original -* request size in the meta data area, for better debug and sanity check. -*/ -static inline void set_orig_size (struct kmem_cache *s, -void *object,unsigned int orig_size) -{ -void *p =kasan_reset_tag (object); -unsigned int kasan_meta_size; - -if (!slub_debug_orig_size (s)) -return ; - -/* -* KASAN can save its free meta data inside of the object at offset 0. -* If this meta data size is larger than 'orig_size', it will overlap -* the data redzone in [orig_size+1, object_size]. Thus, we adjust -* 'orig_size' to be as at least as big as KASAN's meta data. -*/ - kasan_meta_size =kasan_metadata_size (s, true); -if (kasan_meta_size > orig_size) - orig_size = kasan_meta_size; - - p +=get_info_end (s); - p +=sizeof (struct track ) *2 ; - - *(unsigned int *)p = orig_size; -} - -static inline unsigned int get_orig_size (struct kmem_cache *s,void *object) -{ -void *p =kasan_reset_tag (object); - -if (!slub_debug_orig_size (s)) -return s->object_size; - - p +=get_info_end (s); - p +=sizeof (struct track ) *2 ; - -return *(unsigned int *)p; -} -void skip_orig_size_check (struct kmem_cache *s,const void *object) {set_orig_size (s, (void *)object, s->object_size);
@@ -1894,7 +1894,6 @@ static inline void inc_slabs_node(struct int objects) {}static inline void dec_slabs_node (struct kmem_cache *s,int node,int objects) {} -#ifndef CONFIG_SLUB_TINY static bool freelist_corrupted (struct kmem_cache *s,struct slab *slab,void **freelist,void *nextfree)
@@ -2243,14 +2242,21 @@ bool slab_free_hook(struct kmem_cache *s*/ if (unlikely (init)) {int rsize; -unsigned int inuse; +unsigned int inuse, orig_size; inuse =get_info_end (s); + orig_size =get_orig_size (s, x);if (!kasan_has_integrated_init ()) -memset (kasan_reset_tag (x),0 , s->object_size); +memset (kasan_reset_tag (x),0 , orig_size); rsize = (s->flags &SLAB_RED_ZONE ) ? s->red_left_pad :0 ;memset ((char *)kasan_reset_tag (x) + inuse,0 , s->size - inuse - rsize); +/* +* Restore orig_size, otherwize kmalloc redzone overwritten +* would be reported +*/ +set_orig_size (s, x, orig_size); + }/* KASAN might put x into memory quarantine, delaying its reuse. */ return !kasan_slab_free (s, x, init);
Greg Kroah-Hartman
maintainerPATCH 366/558 power: supply: Drop use_cnt check from power_supply_property_is_writeable()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
commit 78f281e5bdeb6476fab97a2c3fcece1094b42aaf upstream.
power_supply_property_is_writeable() gets called from the is_visible() callback for the sysfs attributes of power_supply class devices and for the sysfs attributes of power_supply core instantiated hwmon class devices.
These sysfs attributes get registered by the device_add() respectively power_supply_add_hwmon_sysfs() calls in power_supply_register().
use_cnt gets initialized to 0 and is incremented only after these calls. So when power_supply_property_is_writeable() gets called it always return -ENODEV because of use_cnt == 0.
This causes all the attributes to have permissions of 444 even those which should be writable. This used to be a problem only for hwmon sysfs attributes but since commit be6299c6e55e ("power: supply: sysfs: use power_supply_property_is_writeable()") this now also impacts power_supply class sysfs attributes.
--- drivers/power/supply/power_supply_core.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
drivers/power/supply/power_supply_core.c +1 -5
@@ -1232,11 +1232,7 @@ EXPORT_SYMBOL_GPL(power_supply_set_propeint power_supply_property_is_writeable (struct power_supply *psy,enum power_supply_property psp) { -if (atomic_read (&psy->use_cnt) <=0 || - !psy->desc->property_is_writeable) -return -ENODEV ; - -return psy->desc->property_is_writeable (psy, psp); +return psy->desc->property_is_writeable && psy->desc->property_is_writeable (psy, psp); }EXPORT_SYMBOL_GPL (power_supply_property_is_writeable);