6.6.57-rc1 review
Subsystems (4)
Greg Kroah-Hartman
maintainercover 6.6.57-rc1 review
This is the start of the stable review cycle for the 6.6.57 release. There are 213 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 16 Oct 2024 14:09:57 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.57-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.6.57-rc1
Johan Hovold <[email protected]>
scsi: Revert "scsi: sd: Do not repeat the starting disk message"
Vitaly Lifshits <[email protected]>
e1000e: fix force smbus during suspend flow
Linus Walleij <[email protected]>
net: ethernet: cortina: Restore TSO support
Patrick Roy <[email protected]>
secretmem: disable memfd_secret() if arch cannot set direct map
Alexander Gordeev <[email protected]>
fs/proc/kcore.c: allow translation of physical memory addresses
Frederic Weisbecker <[email protected]>
kthread: unpark only parked kthread
Luca Stefani <[email protected]>
btrfs: split remaining space to discard in chunks
Mathieu Desnoyers <[email protected]>
selftests/rseq: Fix mm_cid test failure
Donet Tom <[email protected]>
selftests/mm: fix incorrect buffer->mirror size in hmm2 double_map test
Zhang Rui <[email protected]>
powercap: intel_rapl_tpmi: Fix bogus register reading
Yonatan Maman <[email protected]>
nouveau/dmem: Fix vulnerability in migrate_to_ram upon copy error
Kun(llfl) <[email protected]>
device-dax: correct pgoff align in dax_set_mapping()
Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: do not remove closing subflows
Paolo Abeni <[email protected]>
mptcp: handle consistently DSS corruption
Christian Marangi <[email protected]>
net: phy: Remove LED entry from LEDs list on unregister
Anatolij Gustschin <[email protected]>
net: dsa: lan9303: ensure chip reset and wait for READY status
Anastasia Kovaleva <[email protected]>
net: Fix an unsafe loop on the list
Ignat Korchagin <[email protected]>
net: explicitly clear the sk pointer, when pf->create fails
Niklas Cassel <[email protected]>
ata: libata: avoid superfluous disk spin down + spin up during hibernation
Matthieu Baerts (NGI0) <[email protected]>
mptcp: fallback when MPTCP opts are dropped after 1st data
Avri Altman <[email protected]>
scsi: ufs: Use pre-calculated offsets in ufshcd_init_lrb()
Daniel Palmer <[email protected]>
scsi: wd33c93: Don't use stale scsi_pointer value
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync
Jani Nikula <[email protected]>
drm/i915/hdcp: fix connector refcounting
Maíra Canal <[email protected]>
drm/vc4: Stop the active perfmon before being destroyed
Maíra Canal <[email protected]>
drm/v3d: Stop the active perfmon before being destroyed
SurajSonawane2415 <[email protected]>
hid: intel-ish-hid: Fix uninitialized variable 'rv' in ish_fw_xfer_direct_dma
John Keeping <[email protected]>
usb: gadget: core: force synchronous registration
Icenowy Zheng <[email protected]>
usb: storage: ignore bogus device raised by JieLi BR21 USB sound chip
Jose Alberto Reguero <[email protected]>
usb: xhci: Fix problem with xhci resume from suspend
Selvarasu Ganesan <[email protected]>
usb: dwc3: core: Stop processing of pending events if controller is halted
Oliver Neukum <[email protected]>
Revert "usb: yurex: Replace snprintf() with the safer scnprintf() variant"
Wade Wang <[email protected]>
HID: plantronics: Workaround for an unexcepted opposite volume key
He Lugang <[email protected]>
HID: multitouch: Add support for lenovo Y9000P Touchpad
Basavaraj Natikar <[email protected]>
HID: amd_sfh: Switch to device-managed dmam_alloc_coherent()
Javier Carrasco <[email protected]>
hwmon: (adt7470) Add missing dependency on REGMAP_I2C
Javier Carrasco <[email protected]>
hwmon: (adm9240) Add missing dependency on REGMAP_I2C
Javier Carrasco <[email protected]>
hwmon: (mc34vr500) Add missing dependency on REGMAP_I2C
Guenter Roeck <[email protected]>
hwmon: (tmp513) Add missing dependency on REGMAP_I2C
Peter Colberg <[email protected]>
hwmon: intel-m10-bmc-hwmon: relabel Columbiaville to CVL Die Temperature
Kenton Groombridge <[email protected]>
wifi: mac80211: Avoid address calculations via out of bounds array indexing
Luke D. Jones <[email protected]>
hid-asus: add ROG Ally X prod ID to quirk list
Luke D. Jones <[email protected]>
HID: asus: add ROG Z13 lightbar
Luke D. Jones <[email protected]>
HID: asus: add ROG Ally N-Key ID and keycodes
Kai-Heng Feng <[email protected]>
HID: i2c-hid: Skip SET_POWER SLEEP for Cirque touchpad on system suspend
Hans de Goede <[email protected]>
HID: i2c-hid: Renumber I2C_HID_QUIRK_ defines
Hans de Goede <[email protected]>
HID: i2c-hid: Remove I2C_HID_QUIRK_SET_PWR_WAKEUP_DEV quirk
Johannes Roith <[email protected]>
HID: mcp2200: added driver for GPIOs of MCP2200
Frederic Weisbecker <[email protected]>
rcu/nocb: Fix rcuog wake-up from offline softirq
Frederic Weisbecker <[email protected]>
rcu/nocb: Make IRQs disablement symmetric
Eric Dumazet <[email protected]>
slip: make slhc_remember() more robust against malicious packets
Eric Dumazet <[email protected]>
ppp: fix ppp_async_encode() illegal access
Kuniyuki Iwashima <[email protected]>
phonet: Handle error of rtnl_register_module().
Eric Dumazet <[email protected]>
phonet: no longer hold RTNL in route_dumpit()
Kuniyuki Iwashima <[email protected]>
mpls: Handle error of rtnl_register_module().
Eric Dumazet <[email protected]>
mpls: no longer hold RTNL in mpls_netconf_dump_devconf()
Eric Dumazet <[email protected]>
rtnetlink: add RTNL_FLAG_DUMP_UNLOCKED flag
Eric Dumazet <[email protected]>
rtnetlink: change nlk->cb_mutex role
Kuniyuki Iwashima <[email protected]>
mctp: Handle error of rtnl_register_module().
Kuniyuki Iwashima <[email protected]>
bridge: Handle error of rtnl_register_module().
Kuniyuki Iwashima <[email protected]>
vxlan: Handle error of rtnl_register_module().
Kuniyuki Iwashima <[email protected]>
rtnetlink: Add bulk registration helpers for rtnetlink message handlers.
Eric Dumazet <[email protected]>
net: do not delay dst_entries_add() in dst_release()
Florian Westphal <[email protected]>
netfilter: fib: check correct rtable in vrf setups
Florian Westphal <[email protected]>
netfilter: xtables: avoid NFPROTO_UNSPEC where needed
Xin Long <[email protected]>
sctp: ensure sk_state is set to CLOSED if hashing fails in sctp_listen_start
Filipe Manana <[email protected]>
btrfs: zoned: fix missing RCU locking in error message when loading zone info
Rosen Penev <[email protected]>
net: ibm: emac: mal: fix wrong goto
Eric Dumazet <[email protected]>
net/sched: accept TCA_STAB only for root qdisc
Vitaly Lifshits <[email protected]>
e1000e: change I219 (19) devices to ADP
Mohamed Khalfella <[email protected]>
igb: Do not bring the device up after non-fatal error
Aleksandr Loktionov <[email protected]>
i40e: Fix macvlan leak by synchronizing access to mac_filter_hash
Wojciech Drewek <[email protected]>
ice: Flush FDB entries before reset
Michal Swiatkowski <[email protected]>
ice: rename switchdev to eswitch
Marcin Szycik <[email protected]>
ice: Fix netif_is_ice() in Safe Mode
Zhang Rui <[email protected]>
powercap: intel_rapl_tpmi: Ignore minor version change
Srinivas Pandruvada <[email protected]>
platform/x86/intel/tpmi: Add defines to get version information
Billy Tsai <[email protected]>
gpio: aspeed: Use devm_clk api to manage clock source
Billy Tsai <[email protected]>
gpio: aspeed: Add the flush write to ensure the write complete.
Yonatan Maman <[email protected]>
nouveau/dmem: Fix privileged error in copy engine channel
Ben Skeggs <[email protected]>
drm/nouveau: pass cli to nouveau_channel_new() instead of drm+device
Jonas Gorski <[email protected]>
net: dsa: b53: fix jumbo frames on 10/100 ports
Jonas Gorski <[email protected]>
net: dsa: b53: allow lower MTUs on BCM5325/5365
Jonas Gorski <[email protected]>
net: dsa: b53: fix max MTU for BCM5325/BCM5365
Jonas Gorski <[email protected]>
net: dsa: b53: fix max MTU for 1g switches
Jonas Gorski <[email protected]>
net: dsa: b53: fix jumbo frame mtu check
Christophe JAILLET <[email protected]>
net: ethernet: adi: adin1110: Fix some error handling path in adin1110_read_fifo()
Jakub Kicinski <[email protected]>
Revert "net: stmmac: set PP_FLAG_DMA_SYNC_DEV only if XDP is enabled"
Zhang Rui <[email protected]>
thermal: intel: int340x: processor: Fix warning during module unload
Srinivas Pandruvada <[email protected]>
thermal: int340x: processor_thermal: Set feature mask before proc_thermal_add
Christophe JAILLET <[email protected]>
net: phy: bcm84881: Fix some error handling paths
Luiz Augusto von Dentz <[email protected]>
Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change
Kacper Ludwinski <[email protected]>
selftests: net: no_forwarding: fix VID for $swp2 in one_bridge_two_pvids() test
Andy Roulin <[email protected]>
netfilter: br_netfilter: fix panic with metadata_dst skb
David Howells <[email protected]>
rxrpc: Fix uninitialised variable in rxrpc_send_data()
Neal Cardwell <[email protected]>
tcp: fix TFO SYN_RECV to not zero retrans_stamp with retransmits out
Aananth V <[email protected]>
tcp: new TCP_INFO stats for RTO events
Neal Cardwell <[email protected]>
tcp: fix tcp_enter_recovery() to zero retrans_stamp when it's safe
Neal Cardwell <[email protected]>
tcp: fix to allow timestamp undo if no retransmits were sent
Ingo van Lil <[email protected]>
net: phy: dp83869: fix memory corruption when enabling fiber
Yanjun Zhang <[email protected]>
NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies()
Dan Carpenter <[email protected]>
SUNRPC: Fix integer overflow in decode_rc_list()
Dave Ertman <[email protected]>
ice: fix VLAN replay after reset
Michal Swiatkowski <[email protected]>
ice: set correct dst VSI in only LAN filters
Chuck Lever <[email protected]>
NFSD: Mark filecache "down" if init fails
Shyam Sundar S K <[email protected]>
x86/amd_nb: Add new PCI IDs for AMD family 1Ah model 60h
Shyam Sundar S K <[email protected]>
x86/amd_nb: Add new PCI IDs for AMD family 0x1a
Andrey Shumilin <[email protected]>
fbdev: sisfb: Fix strbuf array overflow
Enzo Matsumiya <[email protected]>
smb: client: fix UAF in async decryption
Qianqiang Liu <[email protected]>
fbcon: Fix a NULL pointer dereference issue in fbcon_putcs
Alex Hung <[email protected]>
drm/amd/display: Check null pointer before dereferencing se
Justin Tee <[email protected]>
scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance
Justin Tee <[email protected]>
scsi: lpfc: Add ELS_RSP cmd to the list of WQEs to flush in lpfc_els_flush_cmd()
Zijun Hu <[email protected]>
driver core: bus: Return -EIO instead of 0 when show/store invalid bus attribute
Zijun Hu <[email protected]>
driver core: bus: Fix double free in driver API bus_register()
Riyan Dhiman <[email protected]>
staging: vme_user: added bound check to geoid
Zhu Jun <[email protected]>
tools/iio: Add memory allocation failure check for trigger_name
Philip Chen <[email protected]>
virtio_pmem: Check device status before requesting flush
Simon Horman <[email protected]>
netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n
Florian Westphal <[email protected]>
netfilter: nf_nat: don't try nat source port reallocation for reverse dir clash
Wentao Guan <[email protected]>
LoongArch: Fix memleak in pci_acpi_scan_root()
Ruffalo Lavoisier <[email protected]>
comedi: ni_routing: tools: Check when the file could not be opened
Shawn Shao <[email protected]>
usb: dwc2: Adjust the timing of USB Driver Interrupt Registration in the Crashkernel Scenario
Xu Yang <[email protected]>
usb: chipidea: udc: enable suspend interrupt after usb reset
Wadim Egorov <[email protected]>
usb: typec: tipd: Free IRQ only if it was requested before
Jiri Slaby (SUSE) <[email protected]>
serial: protect uart_port_dtr_rts() in uart_shutdown() too
Peng Fan <[email protected]>
clk: imx: Remove CLK_SET_PARENT_GATE for DRAM mux for i.MX7D
Peng Fan <[email protected]>
remoteproc: imx_rproc: Use imx specific hook for find_loaded_rsc_table
Yunke Cao <[email protected]>
media: videobuf2-core: clear memory related fields in __vb2_plane_dmabuf_put()
Ying Sun <[email protected]>
riscv/kexec_file: Fix relocation type R_RISCV_ADD16 and R_RISCV_SUB16 unknown
Pierre-Louis Bossart <[email protected]>
soundwire: cadence: re-check Peripheral status with delayed_work
Michael Guralnik <[email protected]>
RDMA/mlx5: Enforce umem boundaries for explicit ODP page faults
Jisheng Zhang <[email protected]>
riscv: avoid Imbalance in RAS
Hans de Goede <[email protected]>
mfd: intel_soc_pmic_chtwc: Make Lenovo Yoga Tab 3 X90F DMI match less strict
Kaixin Wang <[email protected]>
ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition
Jens Axboe <[email protected]>
io_uring: check if we need to reschedule during overflow flush
Palmer Dabbelt <[email protected]>
RISC-V: Don't have MAX_PHYSMEM_BITS exceed phys_addr_t
Kaixin Wang <[email protected]>
i3c: master: cdns: Fix use after free vulnerability in cdns_i3c_master Driver Due to Race Condition
Alex Williamson <[email protected]>
PCI: Mark Creative Labs EMU20k2 INTx masking as broken
Hans de Goede <[email protected]>
i2c: i801: Use a different adapter-name for IDF adapters
Subramanian Ananthanarayanan <[email protected]>
PCI: Add ACS quirk for Qualcomm SA8775P
Krzysztof Kozlowski <[email protected]>
clk: bcm: bcm53573: fix OF node leak in init
Md Haris Iqbal <[email protected]>
RDMA/rtrs-srv: Avoid null pointer deref during path establishment
WangYuli <[email protected]>
PCI: Add function 0 DMA alias quirk for Glenfly Arise chip
Pierre-Louis Bossart <[email protected]>
soundwire: intel_bus_common: enable interrupts before exiting reset
Saravanan Vajravel <[email protected]>
RDMA/mad: Improve handling of timed out WRs of mad agent
Daniel Jordan <[email protected]>
ktest.pl: Avoid false positives with grub2 skip regex
Xu Kuohai <[email protected]>
bpf: Prevent tail call between progs attached to different hooks
Heiko Carstens <[email protected]>
s390/traps: Handle early warnings gracefully
Thomas Richter <[email protected]>
s390/cpum_sf: Remove WARN_ON_ONCE statements
Wojciech Gładysz <[email protected]>
ext4: nested locking for xattr inode
Jan Kara <[email protected]>
ext4: don't set SB_RDONLY after filesystem errors
Yonghong Song <[email protected]>
bpf, x64: Fix a jit convergence issue
Gerald Schaefer <[email protected]>
s390/mm: Add cond_resched() to cmm_alloc/free_pages()
Heiko Carstens <[email protected]>
s390/facility: Disable compile time optimization for decompressor code
Heiko Carstens <[email protected]>
s390/boot: Compile all files with the same march flag
Tao Chen <[email protected]>
bpf: Check percpu map value size first
Daniel Borkmann <[email protected]>
selftests/bpf: Fix ARG_PTR_TO_LONG {half-,}uninitialized test
Mathias Krause <[email protected]>
Input: synaptics-rmi4 - fix UAF of IRQ domain on driver removal
Andrey Skvortsov <[email protected]>
zram: don't free statically defined names
Sergey Senozhatsky <[email protected]>
zram: free secondary algorithms names
Diogo Jahchan Koike <[email protected]>
ntfs3: Change to non-blocking allocation in ntfs_d_hash
Michael S. Tsirkin <[email protected]>
virtio_console: fix misc probe bugs
Konstantin Komarov <[email protected]>
fs/ntfs3: Refactor enum_rstbl to suppress static checker
Konstantin Komarov <[email protected]>
fs/ntfs3: Fix sparse warning in ni_fiemap
Konstantin Komarov <[email protected]>
fs/ntfs3: Do not call file_modified if collapse range failed
Alex Hung <[email protected]>
drm/amd/display: Revert "Check HDCP returned status"
Wenjing Liu <[email protected]>
drm/amd/display: Remove a redundant check in authenticated_dp
Paul Menzel <[email protected]>
lib/build_OID_registry: avoid non-destructive substitution for Perl < 5.13.2 compat
Randy Dunlap <[email protected]>
jbd2: fix kernel-doc for j_transaction_overhead_buffers
Luiz Augusto von Dentz <[email protected]>
Bluetooth: Fix usage of __hci_cmd_sync_status
Benjamin Poirier <[email protected]>
selftests: Introduce Makefile variable to list shared bash scripts
Benjamin Poirier <[email protected]>
selftests: net: Remove executable bits from library scripts
Aditya Gupta <[email protected]>
libsubcmd: Don't free the usage string
Yang Jihong <[email protected]>
perf sched: Move curr_pid and cpu_last_switched initialization to perf_sched__{lat|map|replay}()
Yang Jihong <[email protected]>
perf sched: Move curr_thread initialization to perf_sched__map()
Yang Jihong <[email protected]>
perf sched: Fix memory leak in perf_sched__map()
Yang Jihong <[email protected]>
perf sched: Move start_work_mutex and work_done_wait_mutex initialization to perf_sched__replay()
Masami Hiramatsu (Google) <[email protected]>
bootconfig: Fix the kerneldoc of _xbc_exit()
Hui Wang <[email protected]>
e1000e: move force SMBUS near the end of enable_ulp function
Tony Nguyen <[email protected]>
i40e: Include types.h to some headers
Ivan Vecera <[email protected]>
i40e: Fix ST code value for Clause 45
Damien Le Moal <[email protected]>
scsi: sd: Do not repeat the starting disk message
Damien Le Moal <[email protected]>
scsi: Remove scsi device no_start_on_resume flag
Gergo Koteles <[email protected]>
ASoC: tas2781: mark dvc_tlv with __maybe_unused
Damien Le Moal <[email protected]>
ata: ahci: Add mask_port_map module parameter
Carlos Song <[email protected]>
spi: spi-fsl-lpspi: remove redundant spi_controller_put call
Charlie Jenkins <[email protected]>
riscv: cpufeature: Fix thead vector hwcap removal
Steven Rostedt (Google) <[email protected]>
tracing: Have saved_cmdlines arrays all in one allocation
Xiubo Li <[email protected]>
libceph: init the cursor when preparing sparse read in msgr2
Shannon Nelson <[email protected]>
pds_core: no health-thread in VF path
Geoff Levand <[email protected]>
Revert "powerpc/ps3_defconfig: Disable PPC64_BIG_ENDIAN_ELF_ABI_V2"
Manivannan Sadhasivam <[email protected]>
bus: mhi: ep: Do not allocate memory for MHI objects from DMA zone
Manivannan Sadhasivam <[email protected]>
bus: mhi: ep: Add support for async DMA read operation
Manivannan Sadhasivam <[email protected]>
bus: mhi: ep: Add support for async DMA write operation
Manivannan Sadhasivam <[email protected]>
bus: mhi: ep: Introduce async read/write callbacks
Manivannan Sadhasivam <[email protected]>
bus: mhi: ep: Rename read_from_host() and write_to_host() APIs
Rob Clark <[email protected]>
drm/crtc: fix uninitialized variable use even harder
Jean-Loïc Charroud <[email protected]>
ALSA: hda/realtek: cs35l41: Fix device ID / model name
Jean-Loïc Charroud <[email protected]>
ALSA: hda/realtek: cs35l41: Fix order and duplicates in quirks table
Steven Rostedt (Google) <[email protected]>
tracing: Remove precision vsnprintf() check from print event
Cong Yang <[email protected]>
drm/panel: boe-tv101wum-nl6: Fine tune Himax83102-j02 panel HFP and HBP (again)
Linus Walleij <[email protected]>
net: ethernet: cortina: Drop TSO support
Song Shuai <[email protected]>
riscv: Remove SHADOW_OVERFLOW_STACK_SIZE macro
Andreas Gruenbacher <[email protected]>
gfs2: Revert "ignore negated quota changes"
Andreas Gruenbacher <[email protected]>
gfs2: qd_check_sync cleanups
Andreas Gruenbacher <[email protected]>
gfs2: Revert "introduce qd_bh_get_or_undo"
Abel Vesa <[email protected]>
phy: qualcomm: eusb2-repeater: Rework init to drop redundant zero-out loop
Konrad Dybcio <[email protected]>
phy: qualcomm: phy-qcom-eusb2-repeater: Add tuning overrides
Richard Fitzgerald <[email protected]>
ASoC: cs35l56: Load tunings for the correct speaker models
Bjorn Helgaas <[email protected]>
Revert "PCI/MSI: Provide stubs for IMS functions"
Wei Fang <[email protected]>
net: fec: don't save PTP state if PTP is unsupported
Gabriel Krisman Bertazi <[email protected]>
unicode: Don't special case ignorable code points
-------------
Diffstat:
Documentation/dev-tools/kselftest.rst | 12 + Makefile | 4 +- arch/loongarch/pci/acpi.c | 1 + arch/powerpc/configs/ps3_defconfig | 1 - arch/riscv/include/asm/sbi.h | 2 + arch/riscv/include/asm/sparsemem.h | 2 +- arch/riscv/include/asm/thread_info.h | 1 - arch/riscv/kernel/cpu.c | 40 +- arch/riscv/kernel/cpufeature.c | 8 +- arch/riscv/kernel/elf_kexec.c | 6 + arch/riscv/kernel/entry.S | 4 +- arch/s390/boot/Makefile | 19 +- arch/s390/include/asm/facility.h | 6 +- arch/s390/include/asm/io.h | 2 + arch/s390/kernel/early.c | 17 +- arch/s390/kernel/perf_cpum_sf.c | 12 +- arch/s390/mm/cmm.c | 18 +- arch/x86/kernel/amd_nb.c | 4 + arch/x86/net/bpf_jit_comp.c | 54 +- drivers/ata/ahci.c | 85 + drivers/ata/libata-eh.c | 18 +- drivers/base/bus.c | 8 +- drivers/block/zram/zram_drv.c | 7 + drivers/bus/mhi/ep/internal.h | 1 + drivers/bus/mhi/ep/main.c | 248 +- drivers/bus/mhi/ep/ring.c | 8 +- drivers/char/virtio_console.c | 18 +- drivers/clk/bcm/clk-bcm53573-ilp.c | 2 +- drivers/clk/imx/clk-imx7d.c | 4 +- .../drivers/ni_routing/tools/convert_c_to_py.c | 5 + drivers/dax/device.c | 2 +- drivers/gpio/gpio-aspeed.c | 4 +- drivers/gpu/drm/amd/display/dc/core/dc.c | 2 +- .../drm/amd/display/modules/hdcp/hdcp1_execution.c | 27 +- drivers/gpu/drm/drm_crtc.c | 1 + drivers/gpu/drm/i915/display/intel_hdcp.c | 10 +- drivers/gpu/drm/nouveau/dispnv04/crtc.c | 2 +- drivers/gpu/drm/nouveau/nouveau_abi16.c | 2 +- drivers/gpu/drm/nouveau/nouveau_bo.c | 2 +- drivers/gpu/drm/nouveau/nouveau_chan.c | 21 +- drivers/gpu/drm/nouveau/nouveau_chan.h | 3 +- drivers/gpu/drm/nouveau/nouveau_dmem.c | 2 +- drivers/gpu/drm/nouveau/nouveau_drm.c | 4 +- drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c | 8 +- drivers/gpu/drm/v3d/v3d_perfmon.c | 9 +- drivers/gpu/drm/vc4/vc4_perfmon.c | 7 +- drivers/hid/Kconfig | 9 + drivers/hid/Makefile | 1 + drivers/hid/amd-sfh-hid/amd_sfh_client.c | 14 +- drivers/hid/hid-asus.c | 14 +- drivers/hid/hid-ids.h | 10 + drivers/hid/hid-mcp2200.c | 392 ++ drivers/hid/hid-multitouch.c | 8 +- drivers/hid/hid-plantronics.c | 23 + drivers/hid/i2c-hid/i2c-hid-core.c | 22 +- drivers/hid/intel-ish-hid/ishtp-fw-loader.c | 2 +- drivers/hwmon/Kconfig | 4 + drivers/hwmon/intel-m10-bmc-hwmon.c | 2 +- drivers/hwmon/k10temp.c | 1 + drivers/i2c/busses/i2c-i801.c | 9 +- drivers/i3c/master/i3c-master-cdns.c | 1 + drivers/infiniband/core/mad.c | 14 +- drivers/infiniband/hw/mlx5/odp.c | 25 +- drivers/infiniband/ulp/rtrs/rtrs-srv.c | 13 +- drivers/input/rmi4/rmi_driver.c | 6 +- drivers/media/common/videobuf2/videobuf2-core.c | 8 +- drivers/mfd/intel_soc_pmic_chtwc.c | 1 - drivers/net/dsa/b53/b53_common.c | 17 +- drivers/net/dsa/lan9303-core.c | 29 + drivers/net/ethernet/adi/adin1110.c | 4 +- drivers/net/ethernet/amd/pds_core/main.c | 6 + drivers/net/ethernet/cortina/gemini.c | 32 +- drivers/net/ethernet/freescale/fec_main.c | 6 +- drivers/net/ethernet/ibm/emac/mal.c | 2 +- drivers/net/ethernet/intel/e1000e/hw.h | 4 +- drivers/net/ethernet/intel/e1000e/ich8lan.c | 55 + drivers/net/ethernet/intel/e1000e/netdev.c | 22 +- drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h | 1 + drivers/net/ethernet/intel/i40e/i40e_diag.h | 1 + drivers/net/ethernet/intel/i40e/i40e_main.c | 1 + drivers/net/ethernet/intel/i40e/i40e_register.h | 2 +- drivers/net/ethernet/intel/i40e/i40e_type.h | 4 +- drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 2 + drivers/net/ethernet/intel/ice/ice.h | 6 +- drivers/net/ethernet/intel/ice/ice_eswitch.c | 63 +- drivers/net/ethernet/intel/ice/ice_eswitch_br.c | 17 +- drivers/net/ethernet/intel/ice/ice_eswitch_br.h | 1 + drivers/net/ethernet/intel/ice/ice_main.c | 27 +- drivers/net/ethernet/intel/ice/ice_switch.c | 2 - drivers/net/ethernet/intel/ice/ice_tc_lib.c | 15 +- drivers/net/ethernet/intel/igb/igb_main.c | 4 + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +- drivers/net/phy/bcm84881.c | 4 +- drivers/net/phy/dp83869.c | 1 - drivers/net/phy/phy_device.c | 5 +- drivers/net/ppp/ppp_async.c | 2 +- drivers/net/slip/slhc.c | 57 +- drivers/net/vxlan/vxlan_core.c | 6 +- drivers/net/vxlan/vxlan_private.h | 2 +- drivers/net/vxlan/vxlan_vnifilter.c | 19 +- drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 1 + drivers/nvdimm/nd_virtio.c | 9 + drivers/pci/endpoint/functions/pci-epf-mhi.c | 8 +- drivers/pci/quirks.c | 8 + drivers/phy/qualcomm/phy-qcom-eusb2-repeater.c | 145 +- drivers/powercap/intel_rapl_tpmi.c | 19 +- drivers/remoteproc/imx_rproc.c | 13 +- drivers/scsi/lpfc/lpfc_ct.c | 12 + drivers/scsi/lpfc/lpfc_disc.h | 7 + drivers/scsi/lpfc/lpfc_els.c | 7 +- drivers/scsi/lpfc/lpfc_vport.c | 43 +- drivers/scsi/sd.c | 9 +- drivers/scsi/wd33c93.c | 2 +- drivers/soundwire/cadence_master.c | 39 +- drivers/soundwire/cadence_master.h | 5 + drivers/soundwire/intel.h | 2 + drivers/soundwire/intel_auxdevice.c | 1 + drivers/soundwire/intel_bus_common.c | 35 +- drivers/spi/spi-fsl-lpspi.c | 14 +- drivers/staging/vme_user/vme_fake.c | 6 + drivers/staging/vme_user/vme_tsi148.c | 6 + .../int340x_thermal/processor_thermal_device_pci.c | 23 +- drivers/tty/serial/serial_core.c | 16 +- drivers/ufs/core/ufshcd.c | 5 +- drivers/usb/chipidea/udc.c | 8 +- drivers/usb/dwc2/platform.c | 26 +- drivers/usb/dwc3/core.c | 22 +- drivers/usb/dwc3/core.h | 4 - drivers/usb/dwc3/gadget.c | 11 - drivers/usb/gadget/udc/core.c | 1 + drivers/usb/host/xhci-pci.c | 5 + drivers/usb/misc/yurex.c | 19 +- drivers/usb/storage/unusual_devs.h | 11 + drivers/usb/typec/tipd/core.c | 2 + drivers/video/fbdev/core/fbcon.c | 2 + drivers/video/fbdev/sis/sis_main.c | 2 +- fs/btrfs/extent-tree.c | 19 +- fs/btrfs/volumes.h | 6 + fs/btrfs/zoned.c | 2 +- fs/ext4/super.c | 9 +- fs/ext4/xattr.c | 4 +- fs/gfs2/quota.c | 59 +- fs/nfs/callback_xdr.c | 2 + fs/nfs/client.c | 1 + fs/nfs/nfs42proc.c | 2 +- fs/nfs/nfs4state.c | 2 +- fs/nfsd/filecache.c | 4 +- fs/ntfs3/file.c | 4 +- fs/ntfs3/frecord.c | 21 +- fs/ntfs3/fslog.c | 19 +- fs/ntfs3/namei.c | 4 +- fs/proc/kcore.c | 36 +- fs/smb/client/smb2ops.c | 47 +- fs/smb/client/smb2pdu.c | 6 + fs/unicode/mkutf8data.c | 70 - fs/unicode/utf8data.c_shipped | 6703 ++++++++++---------- include/linux/bpf.h | 1 + include/linux/intel_tpmi.h | 6 + include/linux/jbd2.h | 2 +- include/linux/mhi_ep.h | 21 +- include/linux/netlink.h | 2 + include/linux/nfs_fs_sb.h | 1 + include/linux/pci.h | 34 +- include/linux/pci_ids.h | 4 + include/linux/tcp.h | 8 + include/net/mctp.h | 2 +- include/net/rtnetlink.h | 18 + include/net/sch_generic.h | 1 - include/net/sock.h | 2 + include/scsi/scsi_device.h | 1 - include/sound/cs35l56.h | 1 + include/sound/tas2781-tlv.h | 2 +- include/uapi/linux/tcp.h | 12 + io_uring/io_uring.c | 15 + kernel/bpf/arraymap.c | 3 + kernel/bpf/core.c | 21 +- kernel/bpf/hashtab.c | 3 + kernel/kthread.c | 2 + kernel/rcu/tree.c | 9 +- kernel/rcu/tree_nocb.h | 28 +- kernel/trace/trace.c | 18 +- kernel/trace/trace_output.c | 6 +- lib/bootconfig.c | 3 +- lib/build_OID_registry | 4 +- mm/secretmem.c | 4 +- net/bluetooth/hci_conn.c | 3 + net/bluetooth/hci_core.c | 27 +- net/bluetooth/rfcomm/sock.c | 2 - net/bridge/br_netfilter_hooks.c | 5 + net/bridge/br_netlink.c | 6 +- net/bridge/br_private.h | 5 +- net/bridge/br_vlan.c | 19 +- net/ceph/messenger_v2.c | 3 + net/core/dst.c | 17 +- net/core/rtnetlink.c | 31 + net/ipv4/netfilter/nf_reject_ipv4.c | 10 +- net/ipv4/netfilter/nft_fib_ipv4.c | 4 +- net/ipv4/tcp.c | 9 + net/ipv4/tcp_input.c | 57 +- net/ipv4/tcp_minisocks.c | 4 + net/ipv4/tcp_timer.c | 17 +- net/ipv6/netfilter/nf_reject_ipv6.c | 5 +- net/ipv6/netfilter/nft_fib_ipv6.c | 5 +- net/mac80211/scan.c | 17 +- net/mctp/af_mctp.c | 6 +- net/mctp/device.c | 32 +- net/mctp/neigh.c | 29 +- net/mctp/route.c | 33 +- net/mpls/af_mpls.c | 87 +- net/mptcp/mib.c | 2 + net/mptcp/mib.h | 2 + net/mptcp/pm_netlink.c | 3 +- net/mptcp/protocol.c | 24 +- net/mptcp/subflow.c | 6 +- net/netfilter/nf_nat_core.c | 120 +- net/netfilter/xt_CHECKSUM.c | 33 +- net/netfilter/xt_CLASSIFY.c | 16 +- net/netfilter/xt_CONNSECMARK.c | 36 +- net/netfilter/xt_CT.c | 148 +- net/netfilter/xt_IDLETIMER.c | 59 +- net/netfilter/xt_LED.c | 39 +- net/netfilter/xt_NFLOG.c | 36 +- net/netfilter/xt_RATEEST.c | 39 +- net/netfilter/xt_SECMARK.c | 27 +- net/netfilter/xt_TRACE.c | 35 +- net/netfilter/xt_addrtype.c | 15 +- net/netfilter/xt_cluster.c | 33 +- net/netfilter/xt_connbytes.c | 4 +- net/netfilter/xt_connlimit.c | 39 +- net/netfilter/xt_connmark.c | 28 +- net/netfilter/xt_mark.c | 42 +- net/netlink/af_netlink.c | 38 +- net/netlink/af_netlink.h | 5 +- net/phonet/pn_netlink.c | 43 +- net/rxrpc/sendmsg.c | 10 +- net/sched/sch_api.c | 7 +- net/sctp/socket.c | 18 +- net/socket.c | 7 +- sound/pci/hda/hda_intel.c | 2 +- sound/pci/hda/patch_realtek.c | 7 +- sound/soc/codecs/cs35l56-shared.c | 36 + sound/soc/codecs/cs35l56.c | 32 +- sound/soc/codecs/cs35l56.h | 1 + tools/iio/iio_generic_buffer.c | 4 + tools/lib/subcmd/parse-options.c | 8 +- tools/perf/builtin-kmem.c | 2 + tools/perf/builtin-kvm.c | 3 + tools/perf/builtin-kwork.c | 3 + tools/perf/builtin-lock.c | 3 + tools/perf/builtin-mem.c | 3 + tools/perf/builtin-sched.c | 164 +- tools/testing/ktest/ktest.pl | 2 +- tools/testing/selftests/Makefile | 7 +- .../testing/selftests/bpf/progs/verifier_int_ptr.c | 5 +- tools/testing/selftests/lib.mk | 19 + tools/testing/selftests/mm/hmm-tests.c | 2 +- .../selftests/net/forwarding/no_forwarding.sh | 2 +- tools/testing/selftests/net/setup_loopback.sh | 0 tools/testing/selftests/rseq/rseq.c | 110 +- tools/testing/selftests/rseq/rseq.h | 10 +- 260 files changed, 6581 insertions(+), 4716 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/213 unicode: Dont special case ignorable code points
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabriel Krisman Bertazi <[email protected]>
commit 5c26d2f1d3f5e4be3e196526bead29ecb139cf91 upstream.
We don't need to handle them separately. Instead, just let them decompose/casefold to themselves.
--- fs/unicode/mkutf8data.c | 70 fs/unicode/utf8data.c_shipped | 6703 ++++++++++++++++++++---------------------- 2 files changed, 3346 insertions(+), 3427 deletions(-)
fs/unicode/mkutf8data.c +0 -70
@@ -2230,75 +2230,6 @@ static void nfdicf_init(void)file_fail (fold_name); } -static void ignore_init (void ) -{ -FILE *file; -unsigned int unichar; -unsigned int first; -unsigned int last; -unsigned int *um; -int count; -int ret; - -if (verbose >0 ) -printf ("Parsing %s\n" , prop_name); - file =fopen (prop_name,"r" ); -if (!file) -open_fail (prop_name, errno); -assert (file); - count =0 ; -while (fgets (line,LINESIZE , file)) { - ret =sscanf (line,"%X..%X ; %s # " , &first, &last, buf0); -if (ret ==3 ) { -if (strcmp (buf0,"Default_Ignorable_Code_Point" )) -continue ; -if (!utf32valid (first) || !utf32valid (last)) -line_fail (prop_name, line); -for (unichar = first; unichar <= last; unichar++) { -free (unicode_data[unichar].utf32nfdi); - um =malloc (sizeof (unsigned int )); - *um =0 ; - unicode_data[unichar].utf32nfdi = um; -free (unicode_data[unichar].utf32nfdicf); - um =malloc (sizeof (unsigned int )); - *um =0 ; - unicode_data[unichar].utf32nfdicf = um; - count++; - } -if (verbose >1 ) -printf (" %X..%X Default_Ignorable_Code_Point\n" , - first, last); -continue ; - } - ret =sscanf (line,"%X ; %s # " , &unichar, buf0); -if (ret ==2 ) { -if (strcmp (buf0,"Default_Ignorable_Code_Point" )) -continue ; -if (!utf32valid (unichar)) -line_fail (prop_name, line); -free (unicode_data[unichar].utf32nfdi); - um =malloc (sizeof (unsigned int )); - *um =0 ; - unicode_data[unichar].utf32nfdi = um; -free (unicode_data[unichar].utf32nfdicf); - um =malloc (sizeof (unsigned int )); - *um =0 ; - unicode_data[unichar].utf32nfdicf = um; -if (verbose >1 ) -printf (" %X Default_Ignorable_Code_Point\n" , - unichar); - count++; -continue ; - } - } -fclose (file); - -if (verbose >0 ) -printf ("Found %d entries\n" , count); -if (count ==0 ) -file_fail (prop_name); -} -static void corrections_init (void ) {FILE *file;
@@ -3410,7 +3341,6 @@ int main(int argc, char *argv[])ccc_init ();nfdi_init ();nfdicf_init (); -ignore_init ();corrections_init ();hangul_decompose ();nfdi_decompose ();
fs/unicode/utf8data.c_shipped +3346 -3357
2,918 lines not on this page · raw message
The rest of this diff is not shown. View the raw message.
Part of the diff is not shown here. View the raw message.
Greg Kroah-Hartman
maintainerPATCH 2/213 net: fec: dont save PTP state if PTP is unsupported
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Fang <[email protected]>
commit 6be063071a457767ee229db13f019c2ec03bfe44 upstream.
Some platforms (such as i.MX25 and i.MX27) do not support PTP, so on these platforms fec_ptp_init() is not called and the related members in fep are not initialized. However, fec_ptp_save_state() is called unconditionally, which causes the kernel to panic. Therefore, add a condition so that fec_ptp_save_state() is not called if PTP is not supported.
--- drivers/net/ethernet/freescale/fec_main.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/ethernet/freescale/fec_main.c +4 -2
@@ -1058,7 +1058,8 @@ fec_restart(struct net_device *ndev)u32 rcntl =OPT_FRAME_SIZE |0x04 ;u32 ecntl =FEC_ECR_ETHEREN ; -fec_ptp_save_state (fep); +if (fep->bufdesc_ex) +fec_ptp_save_state (fep);/* Whack a reset. We should wait for this. * For i.MX6SX SOC, enet use AXI bus, we use disable MAC
@@ -1321,7 +1322,8 @@ fec_stop(struct net_device *ndev)netdev_err (ndev,"Graceful transmit stop did not complete!\n" ); } -fec_ptp_save_state (fep); +if (fep->bufdesc_ex) +fec_ptp_save_state (fep);/* Whack a reset. We should wait for this. * For i.MX6SX SOC, enet use AXI bus, we use disable MAC
Greg Kroah-Hartman
maintainerPATCH 3/213 Revert "PCI/MSI: Provide stubs for IMS functions"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjorn Helgaas <[email protected]>
[ Upstream commit 372c669271bff736c5bc275c982d8d1b4f1f147c ]
This reverts commit 41efa431244f6498833ff8ee8dde28c4924c5479.
IMS (Interrupt Message Store) support appeared in v6.2, but there are no users yet.
Remove it for now. We can add it back when a user comes along. If this is re-added later, this could be squashed with these commits:
0194425af0c8 ("PCI/MSI: Provide IMS (Interrupt Message Store) support") c9e5bea27383 ("PCI/MSI: Provide pci_ims_alloc/free_irq()")
which added the non-stub implementations.
--- include/linux/pci.h | 34 ++++++++-------------------------- 1 file changed, 8 insertions(+), 26 deletions(-)
include/linux/pci.h +8 -26
@@ -1630,8 +1630,6 @@ struct msix_entry {u16 entry;/* Driver uses to specify entry, OS writes */ }; -struct msi_domain_template ; -#ifdef CONFIG_PCI_MSI int pci_msi_vec_count (struct pci_dev *dev);void pci_disable_msi (struct pci_dev *dev);
@@ -1664,11 +1662,6 @@ void pci_msix_free_irq(struct pci_dev *pdev, struct msi_map map);void pci_free_irq_vectors (struct pci_dev *dev);int pci_irq_vector (struct pci_dev *dev,unsigned int nr);const struct cpumask *pci_irq_get_affinity (struct pci_dev *pdev,int vec); -bool pci_create_ims_domain (struct pci_dev *pdev,const struct msi_domain_template *template, -unsigned int hwsize,void *data); -struct msi_map pci_ims_alloc_irq (struct pci_dev *pdev,union msi_instance_cookie *icookie, -const struct irq_affinity_desc *affdesc); -void pci_ims_free_irq (struct pci_dev *pdev,struct msi_map map);#else static inline int pci_msi_vec_count (struct pci_dev *dev) {return -ENOSYS ; }
@@ -1732,25 +1725,6 @@ static inline const struct cpumask *pci_irq_get_affinity(struct pci_dev *pdev, {return cpu_possible_mask; } - -static inline bool pci_create_ims_domain (struct pci_dev *pdev, -const struct msi_domain_template *template, -unsigned int hwsize,void *data) -{return false; } - -static inline struct msi_map pci_ims_alloc_irq (struct pci_dev *pdev, -union msi_instance_cookie *icookie, -const struct irq_affinity_desc *affdesc) -{ -struct msi_map map = { .index = -ENOSYS , }; - -return map; -} - -static inline void pci_ims_free_irq (struct pci_dev *pdev,struct msi_map map) -{ -} -#endif /**
@@ -2667,6 +2641,14 @@ static inline bool pci_is_thunderbolt_attached(struct pci_dev *pdev)void pci_uevent_ers (struct pci_dev *pdev,enum pci_ers_result err_type);#endif +struct msi_domain_template ; + +bool pci_create_ims_domain (struct pci_dev *pdev,const struct msi_domain_template *template, +unsigned int hwsize,void *data); +struct msi_map pci_ims_alloc_irq (struct pci_dev *pdev,union msi_instance_cookie *icookie, +const struct irq_affinity_desc *affdesc); +void pci_ims_free_irq (struct pci_dev *pdev,struct msi_map map); +#include <linux/dma-mapping.h> #define pci_printk(level, pdev, fmt, arg...) \
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 4/213 ASoC: cs35l56: Load tunings for the correct speaker models
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Fitzgerald <[email protected]>
[ Upstream commit 245eeff18d7a37693815250ae15979ce98c3d190 ]
If the "spk-id-gpios" property is present it points to GPIOs whose value must be used to select the correct bin file to match the speakers.
Some manufacturers use multiple sources of speakers, which need different tunings for best performance. On these models the type of speaker fitted is indicated by the values of one or more GPIOs. The number formed by the GPIOs identifies the tuning required.
The speaker ID must be used in combination with the subsystem ID (either from PCI SSID or cirrus,firmware-uid property), because the GPIOs can only indicate variants of a specific model.
--- include/sound/cs35l56.h | 1 + sound/soc/codecs/cs35l56-shared.c | 36 +++++++++++++++++++++++++++++++ sound/soc/codecs/cs35l56.c | 32 ++++++++++++++++++++++----- sound/soc/codecs/cs35l56.h | 1 + 4 files changed, 65 insertions(+), 5 deletions(-)
include/sound/cs35l56.h +1 -0
@@ -287,6 +287,7 @@ int cs35l56_runtime_suspend_common(struct cs35l56_base *cs35l56_base);int cs35l56_runtime_resume_common (struct cs35l56_base *cs35l56_base,bool is_soundwire);void cs35l56_init_cs_dsp (struct cs35l56_base *cs35l56_base,struct cs_dsp *cs_dsp);int cs35l56_hw_init (struct cs35l56_base *cs35l56_base); +int cs35l56_get_speaker_id (struct cs35l56_base *cs35l56_base);int cs35l56_get_bclk_freq_id (unsigned int freq);void cs35l56_fill_supply_names (struct regulator_bulk_data *data);
sound/soc/codecs/cs35l56-shared.c +36 -0
@@ -5,6 +5,7 @@// Copyright (C) 2023 Cirrus Logic, Inc. and // Cirrus Logic International Semiconductor Ltd. +#include <linux/gpio/consumer.h> #include <linux/regmap.h> #include <linux/regulator/consumer.h> #include <linux/types.h>
@@ -695,6 +696,41 @@ int cs35l56_hw_init(struct cs35l56_base *cs35l56_base) }EXPORT_SYMBOL_NS_GPL (cs35l56_hw_init,SND_SOC_CS35L56_SHARED ); +int cs35l56_get_speaker_id (struct cs35l56_base *cs35l56_base) +{ +struct gpio_descs *descs; +int speaker_id; +int i, ret; + +/* Read the speaker type qualifier from the motherboard GPIOs */ + descs =gpiod_get_array_optional (cs35l56_base->dev,"spk-id" ,GPIOD_IN ); +if (!descs) { +return -ENOENT ; + }else if (IS_ERR (descs)) { + ret =PTR_ERR (descs); +return dev_err_probe (cs35l56_base->dev, ret,"Failed to get spk-id-gpios\n" ); + } + + speaker_id =0 ; +for (i =0 ; i < descs->ndescs; i++) { + ret =gpiod_get_value_cansleep (descs->desc[i]); +if (ret <0 ) { +dev_err_probe (cs35l56_base->dev, ret,"Failed to read spk-id[%d]\n" , i); + goto err; + } + + speaker_id |= (ret << i); + } + +dev_dbg (cs35l56_base->dev,"Speaker ID = %d\n" , speaker_id); + ret = speaker_id; +err: +gpiod_put_array (descs); + +return ret; +} +EXPORT_SYMBOL_NS_GPL (cs35l56_get_speaker_id,SND_SOC_CS35L56_SHARED ); +static const u32 cs35l56_bclk_valid_for_pll_freq_table[] = { [0x0C ] =128000 , [0x0F ] =256000 ,
sound/soc/codecs/cs35l56.c +27 -5
@@ -941,10 +941,19 @@ static int cs35l56_component_probe(struct snd_soc_component *component)if (!cs35l56->dsp.system_name && (snd_soc_card_get_pci_ssid (component->card, &vendor, &device) ==0 )) { - cs35l56->dsp.system_name =devm_kasprintf (cs35l56->base.dev, -GFP_KERNEL , -"%04x%04x" , - vendor, device); +/* Append a speaker qualifier if there is a speaker ID */ +if (cs35l56->speaker_id >=0 ) { + cs35l56->dsp.system_name =devm_kasprintf (cs35l56->base.dev, +GFP_KERNEL , +"%04x%04x-spkid%d" , + vendor, device, + cs35l56->speaker_id); + }else { + cs35l56->dsp.system_name =devm_kasprintf (cs35l56->base.dev, +GFP_KERNEL , +"%04x%04x" , + vendor, device); + }if (!cs35l56->dsp.system_name)return -ENOMEM ; }
@@ -1230,7 +1239,13 @@ static int cs35l56_get_firmware_uid(struct cs35l56_private *cs35l56)if (ret <0 )return 0 ; - cs35l56->dsp.system_name =devm_kstrdup (dev, prop,GFP_KERNEL ); +/* Append a speaker qualifier if there is a speaker ID */ +if (cs35l56->speaker_id >=0 ) + cs35l56->dsp.system_name =devm_kasprintf (dev,GFP_KERNEL ,"%s-spkid%d" , + prop, cs35l56->speaker_id); +else + cs35l56->dsp.system_name =devm_kstrdup (dev, prop,GFP_KERNEL ); +if (cs35l56->dsp.system_name ==NULL )return -ENOMEM ;
@@ -1245,6 +1260,7 @@ int cs35l56_common_probe(struct cs35l56_private *cs35l56)init_completion (&cs35l56->init_completion);mutex_init (&cs35l56->base.irq_lock); + cs35l56->speaker_id = -ENOENT ;dev_set_drvdata (cs35l56->base.dev, cs35l56);
@@ -1281,6 +1297,12 @@ int cs35l56_common_probe(struct cs35l56_private *cs35l56)gpiod_set_value_cansleep (cs35l56->base.reset_gpio,1 ); } + ret =cs35l56_get_speaker_id (&cs35l56->base); +if ((ret <0 ) && (ret != -ENOENT )) + goto err; + + cs35l56->speaker_id = ret; + ret =cs35l56_get_firmware_uid (cs35l56);if (ret !=0 ) goto err;
sound/soc/codecs/cs35l56.h +1 -0
@@ -44,6 +44,7 @@ struct cs35l56_private {bool sdw_attached;struct completion init_completion; +int speaker_id;u32 rx_mask;u32 tx_mask;u8 asp_slot_width;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 5/213 phy: qualcomm: phy-qcom-eusb2-repeater: Add tuning overrides
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit 56156a76e765d32009fee058697c591194d0829f ]
There are devices in the wild, like the Sony Xperia 1 V that *require* different tuning than the base design for USB to work.
Add support for overriding the necessary tuning values.
Stable-dep-of: 734550d60cdf ("phy: qualcomm: eusb2-repeater: Rework init to drop redundant zero-out loop")
--- drivers/phy/qualcomm/phy-qcom-eusb2-repeater.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-)
drivers/phy/qualcomm/phy-qcom-eusb2-repeater.c +16 -1
@@ -142,7 +142,9 @@ static int eusb2_repeater_init(struct phy *phy) {struct reg_field *regfields = eusb2_repeater_tune_reg_fields;struct eusb2_repeater *rptr =phy_get_drvdata (phy); -const u32 *init_tbl = rptr->cfg->init_tbl; +struct device_node *np = rptr->dev->of_node; +u32 init_tbl[F_NUM_TUNE_FIELDS ] = {0 }; +u8 override;u32 val;int ret;int i;
@@ -163,6 +165,19 @@ static int eusb2_repeater_init(struct phy *phy)regmap_field_update_bits (rptr->regs[i], mask,0 ); } } +memcpy (init_tbl, rptr->cfg->init_tbl,sizeof (init_tbl)); + +if (!of_property_read_u8 (np,"qcom,tune-usb2-amplitude" , &override)) + init_tbl[F_TUNE_IUSB2 ] = override; + +if (!of_property_read_u8 (np,"qcom,tune-usb2-disc-thres" , &override)) + init_tbl[F_TUNE_HSDISC ] = override; + +if (!of_property_read_u8 (np,"qcom,tune-usb2-preem" , &override)) + init_tbl[F_TUNE_USB2_PREEM ] = override; + +for (i =0 ; i <F_NUM_TUNE_FIELDS ; i++) +regmap_field_update_bits (rptr->regs[i], init_tbl[i], init_tbl[i]); ret =regmap_field_read_poll_timeout (rptr->regs[F_RPTR_STATUS ], val, val &RPTR_OK ,10 ,5 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 6/213 phy: qualcomm: eusb2-repeater: Rework init to drop redundant zero-out loop
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abel Vesa <[email protected]>
[ Upstream commit 734550d60cdf634299f0eac7f7fe15763ed990bb ]
Instead of incrementing the base of the global reg fields, which renders the second instance of the repeater broken due to wrong offsets, use regmap with base and offset. As for zeroing out the rest of the tuning regs, avoid looping though the table and just use the table as is, as it is already zero initialized.
--- .../phy/qualcomm/phy-qcom-eusb2-repeater.c | 166 +++++++----------- 1 file changed, 62 insertions(+), 104 deletions(-)
drivers/phy/qualcomm/phy-qcom-eusb2-repeater.c +62 -104
@@ -37,56 +37,28 @@#define EUSB2_TUNE_EUSB_EQU 0x5A#define EUSB2_TUNE_EUSB_HS_COMP_CUR 0x5B -#define QCOM_EUSB2_REPEATER_INIT_CFG (r, v) \ - { \ - .reg = r, \ - .val = v, \ - } - -enum reg_fields { -F_TUNE_EUSB_HS_COMP_CUR , -F_TUNE_EUSB_EQU , -F_TUNE_EUSB_SLEW , -F_TUNE_USB2_HS_COMP_CUR , -F_TUNE_USB2_PREEM , -F_TUNE_USB2_EQU , -F_TUNE_USB2_SLEW , -F_TUNE_SQUELCH_U , -F_TUNE_HSDISC , -F_TUNE_RES_FSDIF , -F_TUNE_IUSB2 , -F_TUNE_USB2_CROSSOVER , -F_NUM_TUNE_FIELDS , - -F_FORCE_VAL_5 =F_NUM_TUNE_FIELDS , -F_FORCE_EN_5 , - -F_EN_CTL1 , - -F_RPTR_STATUS , -F_NUM_FIELDS , -}; - -static struct reg_field eusb2_repeater_tune_reg_fields[F_NUM_FIELDS ] = { - [F_TUNE_EUSB_HS_COMP_CUR ] =REG_FIELD (EUSB2_TUNE_EUSB_HS_COMP_CUR ,0 ,1 ), - [F_TUNE_EUSB_EQU ] =REG_FIELD (EUSB2_TUNE_EUSB_EQU ,0 ,1 ), - [F_TUNE_EUSB_SLEW ] =REG_FIELD (EUSB2_TUNE_EUSB_SLEW ,0 ,1 ), - [F_TUNE_USB2_HS_COMP_CUR ] =REG_FIELD (EUSB2_TUNE_USB2_HS_COMP_CUR ,0 ,1 ), - [F_TUNE_USB2_PREEM ] =REG_FIELD (EUSB2_TUNE_USB2_PREEM ,0 ,2 ), - [F_TUNE_USB2_EQU ] =REG_FIELD (EUSB2_TUNE_USB2_EQU ,0 ,1 ), - [F_TUNE_USB2_SLEW ] =REG_FIELD (EUSB2_TUNE_USB2_SLEW ,0 ,1 ), - [F_TUNE_SQUELCH_U ] =REG_FIELD (EUSB2_TUNE_SQUELCH_U ,0 ,2 ), - [F_TUNE_HSDISC ] =REG_FIELD (EUSB2_TUNE_HSDISC ,0 ,2 ), - [F_TUNE_RES_FSDIF ] =REG_FIELD (EUSB2_TUNE_RES_FSDIF ,0 ,2 ), - [F_TUNE_IUSB2 ] =REG_FIELD (EUSB2_TUNE_IUSB2 ,0 ,3 ), - [F_TUNE_USB2_CROSSOVER ] =REG_FIELD (EUSB2_TUNE_USB2_CROSSOVER ,0 ,2 ), - - [F_FORCE_VAL_5 ] =REG_FIELD (EUSB2_FORCE_VAL_5 ,0 ,7 ), - [F_FORCE_EN_5 ] =REG_FIELD (EUSB2_FORCE_EN_5 ,0 ,7 ), - - [F_EN_CTL1 ] =REG_FIELD (EUSB2_EN_CTL1 ,0 ,7 ), - - [F_RPTR_STATUS ] =REG_FIELD (EUSB2_RPTR_STATUS ,0 ,7 ), +enum eusb2_reg_layout { +TUNE_EUSB_HS_COMP_CUR , +TUNE_EUSB_EQU , +TUNE_EUSB_SLEW , +TUNE_USB2_HS_COMP_CUR , +TUNE_USB2_PREEM , +TUNE_USB2_EQU , +TUNE_USB2_SLEW , +TUNE_SQUELCH_U , +TUNE_HSDISC , +TUNE_RES_FSDIF , +TUNE_IUSB2 , +TUNE_USB2_CROSSOVER , +NUM_TUNE_FIELDS , + +FORCE_VAL_5 =NUM_TUNE_FIELDS , +FORCE_EN_5 , + +EN_CTL1 , + +RPTR_STATUS , +LAYOUT_SIZE , };struct eusb2_repeater_cfg {
@@ -98,10 +70,11 @@ struct eusb2_repeater_cfg {struct eusb2_repeater {struct device *dev; -struct regmap_field *regs[F_NUM_FIELDS ]; +struct regmap *regmap;struct phy *phy;struct regulator_bulk_data *vregs;const struct eusb2_repeater_cfg *cfg; +u32 base;enum phy_mode mode; };
@@ -109,10 +82,10 @@ static const char * const pm8550b_vreg_l[] = { "vdd18", "vdd3", }; -static const u32 pm8550b_init_tbl[F_NUM_TUNE_FIELDS ] = { - [F_TUNE_IUSB2 ] =0x8 , - [F_TUNE_SQUELCH_U ] =0x3 , - [F_TUNE_USB2_PREEM ] =0x5 , +static const u32 pm8550b_init_tbl[NUM_TUNE_FIELDS ] = { + [TUNE_IUSB2 ] =0x8 , + [TUNE_SQUELCH_U ] =0x3 , + [TUNE_USB2_PREEM ] =0x5 , };static const struct eusb2_repeater_cfg pm8550b_eusb2_cfg = {
@@ -140,47 +113,42 @@ static int eusb2_repeater_init_vregs(struct eusb2_repeater *rptr)static int eusb2_repeater_init (struct phy *phy) { -struct reg_field *regfields = eusb2_repeater_tune_reg_fields;struct eusb2_repeater *rptr =phy_get_drvdata (phy);struct device_node *np = rptr->dev->of_node; -u32 init_tbl[F_NUM_TUNE_FIELDS ] = {0 }; -u8 override; +struct regmap *regmap = rptr->regmap; +const u32 *init_tbl = rptr->cfg->init_tbl; +u8 tune_usb2_preem = init_tbl[TUNE_USB2_PREEM ]; +u8 tune_hsdisc = init_tbl[TUNE_HSDISC ]; +u8 tune_iusb2 = init_tbl[TUNE_IUSB2 ]; +u32 base = rptr->base;u32 val;int ret; -int i; + +of_property_read_u8 (np,"qcom,tune-usb2-amplitude" , &tune_iusb2); +of_property_read_u8 (np,"qcom,tune-usb2-disc-thres" , &tune_hsdisc); +of_property_read_u8 (np,"qcom,tune-usb2-preem" , &tune_usb2_preem); ret =regulator_bulk_enable (rptr->cfg->num_vregs, rptr->vregs);if (ret)return ret; -regmap_field_update_bits (rptr->regs[F_EN_CTL1 ],EUSB2_RPTR_EN ,EUSB2_RPTR_EN ); +regmap_write (regmap, base +EUSB2_EN_CTL1 ,EUSB2_RPTR_EN ); -for (i =0 ; i <F_NUM_TUNE_FIELDS ; i++) { -if (init_tbl[i]) { -regmap_field_update_bits (rptr->regs[i], init_tbl[i], init_tbl[i]); - }else { -/* Write 0 if there's no value set */ -u32 mask =GENMASK (regfields[i].msb, regfields[i].lsb); - -regmap_field_update_bits (rptr->regs[i], mask,0 ); - } - } -memcpy (init_tbl, rptr->cfg->init_tbl,sizeof (init_tbl)); +regmap_write (regmap, base +EUSB2_TUNE_EUSB_HS_COMP_CUR , init_tbl[TUNE_EUSB_HS_COMP_CUR ]); +regmap_write (regmap, base +EUSB2_TUNE_EUSB_EQU , init_tbl[TUNE_EUSB_EQU ]); +regmap_write (regmap, base +EUSB2_TUNE_EUSB_SLEW , init_tbl[TUNE_EUSB_SLEW ]); +regmap_write (regmap, base +EUSB2_TUNE_USB2_HS_COMP_CUR , init_tbl[TUNE_USB2_HS_COMP_CUR ]); +regmap_write (regmap, base +EUSB2_TUNE_USB2_EQU , init_tbl[TUNE_USB2_EQU ]); +regmap_write (regmap, base +EUSB2_TUNE_USB2_SLEW , init_tbl[TUNE_USB2_SLEW ]); +regmap_write (regmap, base +EUSB2_TUNE_SQUELCH_U , init_tbl[TUNE_SQUELCH_U ]); +regmap_write (regmap, base +EUSB2_TUNE_RES_FSDIF , init_tbl[TUNE_RES_FSDIF ]); +regmap_write (regmap, base +EUSB2_TUNE_USB2_CROSSOVER , init_tbl[TUNE_USB2_CROSSOVER ]); -if (!of_property_read_u8 (np,"qcom,tune-usb2-amplitude" , &override)) - init_tbl[F_TUNE_IUSB2 ] = override; +regmap_write (regmap, base +EUSB2_TUNE_USB2_PREEM , tune_usb2_preem); +regmap_write (regmap, base +EUSB2_TUNE_HSDISC , tune_hsdisc); +regmap_write (regmap, base +EUSB2_TUNE_IUSB2 , tune_iusb2); -if (!of_property_read_u8 (np,"qcom,tune-usb2-disc-thres" , &override)) - init_tbl[F_TUNE_HSDISC ] = override; - -if (!of_property_read_u8 (np,"qcom,tune-usb2-preem" , &override)) - init_tbl[F_TUNE_USB2_PREEM ] = override; - -for (i =0 ; i <F_NUM_TUNE_FIELDS ; i++) -regmap_field_update_bits (rptr->regs[i], init_tbl[i], init_tbl[i]); - - ret =regmap_field_read_poll_timeout (rptr->regs[F_RPTR_STATUS ], - val, val &RPTR_OK ,10 ,5 ); + ret =regmap_read_poll_timeout (regmap, base +EUSB2_RPTR_STATUS , val, val &RPTR_OK ,10 ,5 );if (ret)dev_err (rptr->dev,"initialization timed-out\n" );
@@ -191,6 +159,8 @@ static int eusb2_repeater_set_mode(struct phy *phy, enum phy_mode mode, int submode) {struct eusb2_repeater *rptr =phy_get_drvdata (phy); +struct regmap *regmap = rptr->regmap; +u32 base = rptr->base;switch (mode) {case PHY_MODE_USB_HOST :
@@ -199,10 +169,8 @@ static int eusb2_repeater_set_mode(struct phy *phy,* per eUSB 1.2 Spec. Below implement software workaround until * PHY and controller is fixing seen observation. */ -regmap_field_update_bits (rptr->regs[F_FORCE_EN_5 ], -F_CLK_19P2M_EN ,F_CLK_19P2M_EN ); -regmap_field_update_bits (rptr->regs[F_FORCE_VAL_5 ], -V_CLK_19P2M_EN ,V_CLK_19P2M_EN ); +regmap_write (regmap, base +EUSB2_FORCE_EN_5 ,F_CLK_19P2M_EN ); +regmap_write (regmap, base +EUSB2_FORCE_VAL_5 ,V_CLK_19P2M_EN );break ;case PHY_MODE_USB_DEVICE :/*
@@ -211,10 +179,8 @@ static int eusb2_repeater_set_mode(struct phy *phy,* repeater doesn't clear previous value due to shared * regulators (say host <-> device mode switch). */ -regmap_field_update_bits (rptr->regs[F_FORCE_EN_5 ], -F_CLK_19P2M_EN ,0 ); -regmap_field_update_bits (rptr->regs[F_FORCE_VAL_5 ], -V_CLK_19P2M_EN ,0 ); +regmap_write (regmap, base +EUSB2_FORCE_EN_5 ,0 ); +regmap_write (regmap, base +EUSB2_FORCE_VAL_5 ,0 );break ;default :return -EINVAL ;
@@ -243,9 +209,8 @@ static int eusb2_repeater_probe(struct platform_device *pdev)struct device *dev = &pdev->dev;struct phy_provider *phy_provider;struct device_node *np = dev->of_node; -struct regmap *regmap; -int i, ret;u32 res; +int ret; rptr =devm_kzalloc (dev,sizeof (*rptr),GFP_KERNEL );if (!rptr)
@@ -258,22 +223,15 @@ static int eusb2_repeater_probe(struct platform_device *pdev)if (!rptr->cfg)return -EINVAL ; - regmap =dev_get_regmap (dev->parent,NULL ); -if (!regmap) + rptr->regmap =dev_get_regmap (dev->parent,NULL ); +if (!rptr->regmap)return -ENODEV ; ret =of_property_read_u32 (np,"reg" , &res);if (ret <0 )return ret; -for (i =0 ; i <F_NUM_FIELDS ; i++) - eusb2_repeater_tune_reg_fields[i].reg += res; - - ret =devm_regmap_field_bulk_alloc (dev, regmap, rptr->regs, - eusb2_repeater_tune_reg_fields, -F_NUM_FIELDS ); -if (ret) -return ret; + rptr->base = res; ret =eusb2_repeater_init_vregs (rptr);if (ret <0 ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 7/213 gfs2: Revert "introduce qd_bh_get_or_undo"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Gruenbacher <[email protected]>
[ Upstream commit 2aedfe847b4d91eabee11a44c27244055cef4eb3 ]
The qd_bh_get_or_undo() helper introduced by that commit doesn't improve the code much, so revert it and clean things up in a more useful way in the next commit.
This reverts commit 7dbc6ae60dd7089d8ed42892b6a66c138f0aa7a0.
Stable-dep-of: 4b4b6374dc61 ("gfs2: Revert "ignore negated quota changes"")
--- fs/gfs2/quota.c | 36 +++++++++++++++++------------------- 1 file changed, 17 insertions(+), 19 deletions(-)
fs/gfs2/quota.c +17 -19
@@ -475,20 +475,6 @@ static int qd_check_sync(struct gfs2_sbd *sdp, struct gfs2_quota_data *qd,return 1 ; } -static int qd_bh_get_or_undo (struct gfs2_sbd *sdp,struct gfs2_quota_data *qd) -{ -int error; - - error =bh_get (qd); -if (!error) -return 0 ; - -clear_bit (QDF_LOCKED , &qd->qd_flags); -slot_put (qd); -qd_put (qd); -return error; -} -static int qd_fish (struct gfs2_sbd *sdp,struct gfs2_quota_data **qdp) {struct gfs2_quota_data *qd =NULL , *iter;
@@ -511,12 +497,17 @@ static int qd_fish(struct gfs2_sbd *sdp, struct gfs2_quota_data **qdp)spin_unlock (&qd_lock);if (qd) { - error =qd_bh_get_or_undo (sdp, qd); -if (error) + error =bh_get (qd); +if (error) { +clear_bit (QDF_LOCKED , &qd->qd_flags); +slot_put (qd); +qd_put (qd);return error; - *qdp = qd; + } } + *qdp = qd; +return 0 ; }
@@ -1171,8 +1162,15 @@ void gfs2_quota_unlock(struct gfs2_inode *ip)if (!found)continue ; -if (!qd_bh_get_or_undo (sdp, qd)) - qda[count++] = qd; +gfs2_assert_warn (sdp, qd->qd_change_sync); +if (bh_get (qd)) { +clear_bit (QDF_LOCKED , &qd->qd_flags); +slot_put (qd); +qd_put (qd); +continue ; + } + + qda[count++] = qd; }if (count) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 8/213 gfs2: qd_check_sync cleanups
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Gruenbacher <[email protected]>
[ Upstream commit 59ebc33201237bf38e5adca3794716100660c5b4 ]
Rename qd_check_sync() to qd_grab_sync() and make it return a bool. Turn the sync_gen pointer into a regular u64 and pass in U64_MAX instead of a NULL pointer when sync generation checking isn't needed.
Introduce a new qd_ungrab_sync() helper for undoing the effects of qd_grab_sync() if the subsequent bh_get() on the qd object fails.
Stable-dep-of: 4b4b6374dc61 ("gfs2: Revert "ignore negated quota changes"")
--- fs/gfs2/quota.c | 40 ++++++++++++++++++++++------------------ 1 file changed, 22 insertions(+), 18 deletions(-)
fs/gfs2/quota.c +22 -18
@@ -446,13 +446,13 @@ static void bh_put(struct gfs2_quota_data *qd)mutex_unlock (&sdp->sd_quota_mutex); } -static int qd_check_sync (struct gfs2_sbd *sdp,struct gfs2_quota_data *qd, -u64 *sync_gen) +static bool qd_grab_sync (struct gfs2_sbd *sdp,struct gfs2_quota_data *qd, +u64 sync_gen) {if (test_bit (QDF_LOCKED , &qd->qd_flags) || !test_bit (QDF_CHANGE , &qd->qd_flags) || - (sync_gen && (qd->qd_sync_gen >= *sync_gen))) -return 0 ; + qd->qd_sync_gen >= sync_gen) +return false;/* * If qd_change is 0 it means a pending quota change was negated.
@@ -462,17 +462,24 @@ static int qd_check_sync(struct gfs2_sbd *sdp, struct gfs2_quota_data *qd,if (!qd->qd_change &&test_and_clear_bit (QDF_CHANGE , &qd->qd_flags)) {slot_put (qd);qd_put (qd); -return 0 ; +return false; }if (!lockref_get_not_dead (&qd->qd_lockref)) -return 0 ; +return false;list_move_tail (&qd->qd_list, &sdp->sd_quota_list);set_bit (QDF_LOCKED , &qd->qd_flags); qd->qd_change_sync = qd->qd_change;slot_hold (qd); -return 1 ; +return true; +} + +static void qd_ungrab_sync (struct gfs2_quota_data *qd) +{ +clear_bit (QDF_LOCKED , &qd->qd_flags); +slot_put (qd); +qd_put (qd); }static int qd_fish (struct gfs2_sbd *sdp,struct gfs2_quota_data **qdp)
@@ -488,7 +495,7 @@ static int qd_fish(struct gfs2_sbd *sdp, struct gfs2_quota_data **qdp)spin_lock (&qd_lock);list_for_each_entry (iter, &sdp->sd_quota_list, qd_list) { -if (qd_check_sync (sdp, iter, &sdp->sd_quota_sync_gen)) { +if (qd_grab_sync (sdp, iter, sdp->sd_quota_sync_gen)) { qd = iter;break ; }
@@ -499,9 +506,7 @@ static int qd_fish(struct gfs2_sbd *sdp, struct gfs2_quota_data **qdp)if (qd) { error =bh_get (qd);if (error) { -clear_bit (QDF_LOCKED , &qd->qd_flags); -slot_put (qd); -qd_put (qd); +qd_ungrab_sync (qd);return error; } }
@@ -1139,7 +1144,6 @@ void gfs2_quota_unlock(struct gfs2_inode *ip)struct gfs2_quota_data *qda[2 *GFS2_MAXQUOTAS ];unsigned int count =0 ;u32 x; -int found;if (!test_and_clear_bit (GIF_QD_LOCKED , &ip->i_flags))return ;
@@ -1147,6 +1151,7 @@ void gfs2_quota_unlock(struct gfs2_inode *ip)for (x =0 ; x < ip->i_qadata->qa_qd_num; x++) {struct gfs2_quota_data *qd;bool sync; +int error; qd = ip->i_qadata->qa_qd[x]; sync =need_sync (qd);
@@ -1156,17 +1161,16 @@ void gfs2_quota_unlock(struct gfs2_inode *ip)continue ;spin_lock (&qd_lock); - found =qd_check_sync (sdp, qd,NULL ); + sync =qd_grab_sync (sdp, qd,U64_MAX );spin_unlock (&qd_lock); -if (!found) +if (!sync)continue ;gfs2_assert_warn (sdp, qd->qd_change_sync); -if (bh_get (qd)) { -clear_bit (QDF_LOCKED , &qd->qd_flags); -slot_put (qd); -qd_put (qd); + error =bh_get (qd); +if (error) { +qd_ungrab_sync (qd);continue ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 9/213 gfs2: Revert "ignore negated quota changes"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Gruenbacher <[email protected]>
[ Upstream commit 4b4b6374dc6134849f2bdca81fa2945b6ed6d9fc ]
Commit 4c6a08125f22 ("gfs2: ignore negated quota changes") skips quota changes with qd_change == 0 instead of writing them back, which leaves behind non-zero qd_change values in the affected slots. The kernel then assumes that those slots are unused, while the qd_change values on disk indicate that they are indeed still in use. The next time the filesystem is mounted, those invalid slots are read in from disk, which will cause inconsistencies.
Revert that commit to avoid filesystem corruption.
This reverts commit 4c6a08125f2249531ec01783a5f4317d7342add5.
--- fs/gfs2/quota.c | 11 ----------- 1 file changed, 11 deletions(-)
fs/gfs2/quota.c +0 -11
@@ -454,17 +454,6 @@ static bool qd_grab_sync(struct gfs2_sbd *sdp, struct gfs2_quota_data *qd, qd->qd_sync_gen >= sync_gen)return false; -/* -* If qd_change is 0 it means a pending quota change was negated. -* We should not sync it, but we still have a qd reference and slot -* reference taken by gfs2_quota_change -> do_qc that need to be put. -*/ -if (!qd->qd_change &&test_and_clear_bit (QDF_CHANGE , &qd->qd_flags)) { -slot_put (qd); -qd_put (qd); -return false; - } -if (!lockref_get_not_dead (&qd->qd_lockref))return false;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 10/213 riscv: Remove SHADOW_OVERFLOW_STACK_SIZE macro
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Song Shuai <[email protected]>
[ Upstream commit a7565f4d068b2e60f95c3223c3167c40b8fe83ae ]
The commit be97d0db5f44 ("riscv: VMAP_STACK overflow detection thread-safe") got rid of shadow_stack, so SHADOW_OVERFLOW_STACK_SIZE should be removed too.
--- arch/riscv/include/asm/thread_info.h | 1 - 1 file changed, 1 deletion(-)
arch/riscv/include/asm/thread_info.h +0 -1
@@ -33,7 +33,6 @@#define THREAD_SHIFT (PAGE_SHIFT + THREAD_SIZE_ORDER)#define OVERFLOW_STACK_SIZE SZ_4K -#define SHADOW_OVERFLOW_STACK_SIZE (1024)#define IRQ_STACK_SIZE THREAD_SIZE
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 11/213 net: ethernet: cortina: Drop TSO support
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <[email protected]>
[ Upstream commit ac631873c9e7a50d2a8de457cfc4b9f86666403e ]
The recent change to allow large frames without hardware checksumming slotted in software checksumming in the driver if hardware could not do it.
This will however upset TSO (TCP Segment Offloading). Typical error dumps includes this:
skb len=2961 headroom=222 headlen=66 tailroom=0
(...)
WARNING: CPU: 0 PID: 956 at net/core/dev.c:3259 skb_warn_bad_offload+0x7c/0x108
gemini-ethernet-port: caps=(0x0000010000154813, 0x00002007ffdd7889)
And the packets do not go through.
The TSO implementation is bogus: a TSO enabled driver must propagate the skb_shinfo(skb)->gso_size value to the TSO engine on the NIC.
Drop the size check and TSO offloading features for now: this needs to be fixed up properly.
After this ethernet works fine on Gemini devices with a direct connected PHY such as D-Link DNS-313.
Also tested to still be working with a DSA switch using the Gemini ethernet as conduit interface.
--- drivers/net/ethernet/cortina/gemini.c | 15 ++------------- 1 file changed, 2 insertions(+), 13 deletions(-)
drivers/net/ethernet/cortina/gemini.c +2 -13
@@ -79,8 +79,7 @@ MODULE_PARM_DESC(debug, "Debug level (0=none,...,16=all)");#define GMAC0_IRQ4_8 (GMAC0_MIB_INT_BIT | GMAC0_RX_OVERRUN_INT_BIT)#define GMAC_OFFLOAD_FEATURES (NETIF_F_SG | NETIF_F_IP_CSUM | \ - NETIF_F_IPV6_CSUM | NETIF_F_RXCSUM | \ - NETIF_F_TSO | NETIF_F_TSO_ECN | NETIF_F_TSO6) + NETIF_F_IPV6_CSUM | NETIF_F_RXCSUM)/** * struct gmac_queue_page - page buffer per-page info
@@ -1148,23 +1147,13 @@ static int gmac_map_tx_bufs(struct net_device *netdev, struct sk_buff *skb,struct gmac_txdesc *txd;skb_frag_t *skb_frag;dma_addr_t mapping; -unsigned short mtu;void *buffer;int ret; - mtu =ETH_HLEN ; - mtu += netdev->mtu; -if (skb->protocol ==htons (ETH_P_8021Q )) - mtu +=VLAN_HLEN ; - +/* TODO: implement proper TSO using MTU in word3 */ word1 = skb->len; word3 =SOF_BIT ; -if (word1 > mtu) { - word1 |=TSS_MTU_ENABLE_BIT ; - word3 |= mtu; - } -if (skb->len >=ETH_FRAME_LEN ) {/* Hardware offloaded checksumming isn't working on frames * bigger than 1514 bytes. A hypothesis about this is that the
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 12/213 drm/panel: boe-tv101wum-nl6: Fine tune Himax83102-j02 panel HFP and HBP (again)
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cong Yang <[email protected]>
[ Upstream commit 9dfc46c87cdc8f5a42a71de247a744a6b8188980 ]
The current measured frame rate is 59.95Hz, which does not meet the requirements of touch-stylus and stylus cannot work normally. After adjustment, the actual measurement is 60.001Hz. Now this panel looks like it's only used by me on the MTK platform, so let's change this set of parameters.
[ dianders: Added "(again") to subject and fixed the "Fixes" line ]
--- drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c +4 -4
@@ -2112,11 +2112,11 @@ static const struct panel_desc starry_qfh032011_53g_desc = { };static const struct drm_display_mode starry_himax83102_j02_default_mode = { - .clock =162850 , + .clock =162680 , .hdisplay =1200 , - .hsync_start =1200 +50 , - .hsync_end =1200 +50 +20 , - .htotal =1200 +50 +20 +50 , + .hsync_start =1200 +60 , + .hsync_end =1200 +60 +20 , + .htotal =1200 +60 +20 +40 , .vdisplay =1920 , .vsync_start =1920 +116 , .vsync_end =1920 +116 +8 ,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 13/213 tracing: Remove precision vsnprintf() check from print event
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt (Google) <[email protected]>
[ Upstream commit 5efd3e2aef91d2d812290dcb25b2058e6f3f532c ]
This reverts 60be76eeabb3d ("tracing: Add size check when printing trace_marker output"). The only reason the precision check was added was because of a bug that miscalculated the write size of the string into the ring buffer and it truncated it removing the terminating nul byte. On reading the trace it crashed the kernel. But this was due to the bug in the code that happened during development and should never happen in practice. If anything, the precision can hide bugs where the string in the ring buffer isn't nul terminated and it will not be checked.
--- kernel/trace/trace_output.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
kernel/trace/trace_output.c +2 -4
@@ -1587,12 +1587,11 @@ static enum print_line_t trace_print_print(struct trace_iterator *iter, {struct print_entry *field;struct trace_seq *s = &iter->seq; -int max = iter->ent_size - offsetof(struct print_entry , buf);trace_assign_type (field, iter->ent);seq_print_ip_sym (s, field->ip, flags); -trace_seq_printf (s,": %.*s" , max, field->buf); +trace_seq_printf (s,": %s" , field->buf);return trace_handle_return (s); }
@@ -1601,11 +1600,10 @@ static enum print_line_t trace_print_raw(struct trace_iterator *iter, int flags, struct trace_event *event) {struct print_entry *field; -int max = iter->ent_size - offsetof(struct print_entry , buf);trace_assign_type (field, iter->ent); -trace_seq_printf (&iter->seq,"# %lx %.*s" , field->ip, max, field->buf); +trace_seq_printf (&iter->seq,"# %lx %s" , field->ip, field->buf);return trace_handle_return (&iter->seq); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 14/213 ALSA: hda/realtek: cs35l41: Fix order and duplicates in quirks table
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean-Loïc Charroud <[email protected]>
[ Upstream commit 852d432a14dbcd34e15a3a3910c5c6869a6d1929 ]
Move entry {0x1043, 0x16a3, "ASUS UX3402VA"} following device ID order. Remove duplicate entry for device {0x1043, 0x1f62, "ASUS UX7602ZM"}.
--- sound/pci/hda/patch_realtek.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
sound/pci/hda/patch_realtek.c +1 -2
@@ -10053,6 +10053,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x1043 ,0x1662 ,"ASUS GV301QH" ,ALC294_FIXUP_ASUS_DUAL_SPK ),SND_PCI_QUIRK (0x1043 ,0x1663 ,"ASUS GU603ZV" ,ALC285_FIXUP_ASUS_HEADSET_MIC ),SND_PCI_QUIRK (0x1043 ,0x1683 ,"ASUS UM3402YAR" ,ALC287_FIXUP_CS35L41_I2C_2 ), +SND_PCI_QUIRK (0x1043 ,0x16a3 ,"ASUS UX3402VA" ,ALC245_FIXUP_CS35L41_SPI_2 ),SND_PCI_QUIRK (0x1043 ,0x16b2 ,"ASUS GU603" ,ALC289_FIXUP_ASUS_GA401 ),SND_PCI_QUIRK (0x1043 ,0x16e3 ,"ASUS UX50" ,ALC269_FIXUP_STEREO_DMIC ), SND_PCI_QUIRK(0x1043, 0x1740, "ASUS UX430UA", ALC295_FIXUP_ASUS_DACS),
@@ -10090,8 +10091,6 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x1043 ,0x1d4e ,"ASUS TM420" ,ALC256_FIXUP_ASUS_HPE ),SND_PCI_QUIRK (0x1043 ,0x1da2 ,"ASUS UP6502ZA/ZD" ,ALC245_FIXUP_CS35L41_SPI_2 ),SND_PCI_QUIRK (0x1043 ,0x1e02 ,"ASUS UX3402ZA" ,ALC245_FIXUP_CS35L41_SPI_2 ), -SND_PCI_QUIRK (0x1043 ,0x16a3 ,"ASUS UX3402VA" ,ALC245_FIXUP_CS35L41_SPI_2 ), -SND_PCI_QUIRK (0x1043 ,0x1f62 ,"ASUS UX7602ZM" ,ALC245_FIXUP_CS35L41_SPI_2 ),SND_PCI_QUIRK (0x1043 ,0x1e11 ,"ASUS Zephyrus G15" ,ALC289_FIXUP_ASUS_GA502 ),SND_PCI_QUIRK (0x1043 ,0x1e12 ,"ASUS UM6702RA/RC" ,ALC287_FIXUP_CS35L41_I2C_2 ), SND_PCI_QUIRK(0x1043, 0x1e51, "ASUS Zephyrus M15", ALC294_FIXUP_ASUS_GU502_PINS),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 15/213 ALSA: hda/realtek: cs35l41: Fix device ID / model name
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean-Loïc Charroud <[email protected]>
[ Upstream commit b91050448897663b60b6d15525c8c3ecae28a368 ]
The patch 51d976079976c800ef19ed1b542602fcf63f0edb ("ALSA: hda/realtek:
Add quirks for ASUS Zenbook 2022 Models") modified the entry 1043:1e2e from "ASUS UM3402" to "ASUS UM6702RA/RC" and added another entry for "ASUS UM3402" with 104e:1ee2.
The first entry was correct, while the new one corresponds to model "ASUS UM6702RA/RC"
Fix the model names for both devices.
--- sound/pci/hda/patch_realtek.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/pci/hda/patch_realtek.c +2 -2
@@ -10092,11 +10092,11 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x1043 ,0x1da2 ,"ASUS UP6502ZA/ZD" ,ALC245_FIXUP_CS35L41_SPI_2 ),SND_PCI_QUIRK (0x1043 ,0x1e02 ,"ASUS UX3402ZA" ,ALC245_FIXUP_CS35L41_SPI_2 ),SND_PCI_QUIRK (0x1043 ,0x1e11 ,"ASUS Zephyrus G15" ,ALC289_FIXUP_ASUS_GA502 ), -SND_PCI_QUIRK (0x1043 ,0x1e12 ,"ASUS UM6702RA/RC" ,ALC287_FIXUP_CS35L41_I2C_2 ), +SND_PCI_QUIRK (0x1043 ,0x1e12 ,"ASUS UM3402" ,ALC287_FIXUP_CS35L41_I2C_2 ),SND_PCI_QUIRK (0x1043 ,0x1e51 ,"ASUS Zephyrus M15" ,ALC294_FIXUP_ASUS_GU502_PINS ),SND_PCI_QUIRK (0x1043 ,0x1e5e ,"ASUS ROG Strix G513" ,ALC294_FIXUP_ASUS_G513_PINS ),SND_PCI_QUIRK (0x1043 ,0x1e8e ,"ASUS Zephyrus G15" ,ALC289_FIXUP_ASUS_GA401 ), -SND_PCI_QUIRK (0x1043 ,0x1ee2 ,"ASUS UM3402" ,ALC287_FIXUP_CS35L41_I2C_2 ), +SND_PCI_QUIRK (0x1043 ,0x1ee2 ,"ASUS UM6702RA/RC" ,ALC287_FIXUP_CS35L41_I2C_2 ),SND_PCI_QUIRK (0x1043 ,0x1c52 ,"ASUS Zephyrus G15 2022" ,ALC289_FIXUP_ASUS_GA401 ),SND_PCI_QUIRK (0x1043 ,0x1f11 ,"ASUS Zephyrus G14" ,ALC289_FIXUP_ASUS_GA401 ), SND_PCI_QUIRK(0x1043, 0x1f12, "ASUS UM5302", ALC287_FIXUP_CS35L41_I2C_2),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 16/213 drm/crtc: fix uninitialized variable use even harder
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Clark <[email protected]>
[ Upstream commit b6802b61a9d0e99dcfa6fff7c50db7c48a9623d3 ]
DRM_MODESET_LOCK_ALL_BEGIN() has a hidden trap-door (aka retry loop), which means we can't rely too much on variable initializers.
--- drivers/gpu/drm/drm_crtc.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/drm_crtc.c +1 -0
@@ -904,6 +904,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, connector_set =NULL ; fb =NULL ; mode =NULL ; + num_connectors =0 ;DRM_MODESET_LOCK_ALL_END (dev, ctx, ret);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 17/213 bus: mhi: ep: Rename read_from_host() and write_to_host() APIs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manivannan Sadhasivam <[email protected]>
[ Upstream commit 927105244f8bc48e6841826a5644c6a961e03b5d ]
In the preparation for adding async API support, let's rename the existing APIs to read_sync() and write_sync() to make it explicit that these APIs are used for synchronous read/write.
Stable-dep-of: c7d0b2db5bc5 ("bus: mhi: ep: Do not allocate memory for MHI objects from DMA zone")
--- drivers/bus/mhi/ep/main.c | 4 ++-- drivers/bus/mhi/ep/ring.c | 8 ++++---- drivers/pci/endpoint/functions/pci-epf-mhi.c | 8 ++++---- include/linux/mhi_ep.h | 8 ++++---- 4 files changed, 14 insertions(+), 14 deletions(-)
drivers/bus/mhi/ep/main.c +2 -2
@@ -361,7 +361,7 @@ static int mhi_ep_read_channel(struct mhi_ep_cntrl *mhi_cntrl, buf_info.size = tr_len;dev_dbg (dev,"Reading %zd bytes from channel (%u)\n" , tr_len, ring->ch_id); - ret = mhi_cntrl->read_from_host (mhi_cntrl, &buf_info); + ret = mhi_cntrl->read_sync (mhi_cntrl, &buf_info);if (ret <0 ) {dev_err (&mhi_chan->mhi_dev->dev,"Error reading from channel\n" );return ret;
@@ -523,7 +523,7 @@ int mhi_ep_queue_skb(struct mhi_ep_device *mhi_dev, struct sk_buff *skb) buf_info.size = tr_len;dev_dbg (dev,"Writing %zd bytes to channel (%u)\n" , tr_len, ring->ch_id); - ret = mhi_cntrl->write_to_host (mhi_cntrl, &buf_info); + ret = mhi_cntrl->write_sync (mhi_cntrl, &buf_info);if (ret <0 ) {dev_err (dev,"Error writing to the channel\n" ); goto err_exit;
drivers/bus/mhi/ep/ring.c +4 -4
@@ -48,7 +48,7 @@ static int __mhi_ep_cache_ring(struct mhi_ep_ring *ring, size_t end) buf_info.host_addr = ring->rbase + (start *sizeof (struct mhi_ring_element )); buf_info.dev_addr = &ring->ring_cache[start]; - ret = mhi_cntrl->read_from_host (mhi_cntrl, &buf_info); + ret = mhi_cntrl->read_sync (mhi_cntrl, &buf_info);if (ret <0 )return ret; }else {
@@ -56,7 +56,7 @@ static int __mhi_ep_cache_ring(struct mhi_ep_ring *ring, size_t end) buf_info.host_addr = ring->rbase + (start *sizeof (struct mhi_ring_element )); buf_info.dev_addr = &ring->ring_cache[start]; - ret = mhi_cntrl->read_from_host (mhi_cntrl, &buf_info); + ret = mhi_cntrl->read_sync (mhi_cntrl, &buf_info);if (ret <0 )return ret;
@@ -65,7 +65,7 @@ static int __mhi_ep_cache_ring(struct mhi_ep_ring *ring, size_t end) buf_info.dev_addr = &ring->ring_cache[0 ]; buf_info.size = end *sizeof (struct mhi_ring_element ); - ret = mhi_cntrl->read_from_host (mhi_cntrl, &buf_info); + ret = mhi_cntrl->read_sync (mhi_cntrl, &buf_info);if (ret <0 )return ret; }
@@ -143,7 +143,7 @@ int mhi_ep_ring_add_element(struct mhi_ep_ring *ring, struct mhi_ring_element *e buf_info.dev_addr = el; buf_info.size =sizeof (*el); -return mhi_cntrl->write_to_host (mhi_cntrl, &buf_info); +return mhi_cntrl->write_sync (mhi_cntrl, &buf_info); }void mhi_ep_ring_init (struct mhi_ep_ring *ring,enum mhi_ep_ring_type type,u32 id)
drivers/pci/endpoint/functions/pci-epf-mhi.c +4 -4
@@ -536,11 +536,11 @@ static int pci_epf_mhi_link_up(struct pci_epf *epf) mhi_cntrl->alloc_map = pci_epf_mhi_alloc_map; mhi_cntrl->unmap_free = pci_epf_mhi_unmap_free;if (info->flags &MHI_EPF_USE_DMA ) { - mhi_cntrl->read_from_host = pci_epf_mhi_edma_read; - mhi_cntrl->write_to_host = pci_epf_mhi_edma_write; + mhi_cntrl->read_sync = pci_epf_mhi_edma_read; + mhi_cntrl->write_sync = pci_epf_mhi_edma_write; }else { - mhi_cntrl->read_from_host = pci_epf_mhi_iatu_read; - mhi_cntrl->write_to_host = pci_epf_mhi_iatu_write; + mhi_cntrl->read_sync = pci_epf_mhi_iatu_read; + mhi_cntrl->write_sync = pci_epf_mhi_iatu_write; }/* Register the MHI EP controller */
include/linux/mhi_ep.h +4 -4
@@ -94,8 +94,8 @@ struct mhi_ep_buf_info {* @raise_irq: CB function for raising IRQ to the host * @alloc_map: CB function for allocating memory in endpoint for storing host context and mapping it * @unmap_free: CB function to unmap and free the allocated memory in endpoint for storing host context -* @read_from_host: CB function for reading from host memory from endpoint -* @write_to_host: CB function for writing to host memory from endpoint +* @read_sync: CB function for reading from host memory synchronously +* @write_sync: CB function for writing to host memory synchronously * @mhi_state: MHI Endpoint state * @max_chan: Maximum channels supported by the endpoint controller * @mru: MRU (Maximum Receive Unit) value of the endpoint controller
@@ -149,8 +149,8 @@ struct mhi_ep_cntrl { void __iomem **virt, size_t size);void (*unmap_free)(struct mhi_ep_cntrl *mhi_cntrl,u64 pci_addr,phys_addr_t phys,void __iomem *virt,size_t size); -int (*read_from_host)(struct mhi_ep_cntrl *mhi_cntrl,struct mhi_ep_buf_info *buf_info); -int (*write_to_host)(struct mhi_ep_cntrl *mhi_cntrl,struct mhi_ep_buf_info *buf_info); +int (*read_sync)(struct mhi_ep_cntrl *mhi_cntrl,struct mhi_ep_buf_info *buf_info); +int (*write_sync)(struct mhi_ep_cntrl *mhi_cntrl,struct mhi_ep_buf_info *buf_info);enum mhi_state mhi_state;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 18/213 bus: mhi: ep: Introduce async read/write callbacks
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manivannan Sadhasivam <[email protected]>
[ Upstream commit 8b786ed8fb089e347af21d13ba5677325fcd4cd8 ]
These callbacks can be implemented by the controller drivers to perform async read/write operation that increases the throughput.
For aiding the async operation, a completion callback is also introduced.
Stable-dep-of: c7d0b2db5bc5 ("bus: mhi: ep: Do not allocate memory for MHI objects from DMA zone")
--- include/linux/mhi_ep.h | 9 +++++++++ 1 file changed, 9 insertions(+)
include/linux/mhi_ep.h +9 -0
@@ -54,11 +54,16 @@ struct mhi_ep_db_info {* @dev_addr: Address of the buffer in endpoint * @host_addr: Address of the bufffer in host * @size: Size of the buffer +* @cb: Callback to be executed by controller drivers after transfer completion (async) +* @cb_buf: Opaque buffer to be passed to the callback */ struct mhi_ep_buf_info {void *dev_addr;u64 host_addr;size_t size; + +void (*cb)(struct mhi_ep_buf_info *buf_info); +void *cb_buf; };/**
@@ -96,6 +101,8 @@ struct mhi_ep_buf_info {* @unmap_free: CB function to unmap and free the allocated memory in endpoint for storing host context * @read_sync: CB function for reading from host memory synchronously * @write_sync: CB function for writing to host memory synchronously +* @read_async: CB function for reading from host memory asynchronously +* @write_async: CB function for writing to host memory asynchronously * @mhi_state: MHI Endpoint state * @max_chan: Maximum channels supported by the endpoint controller * @mru: MRU (Maximum Receive Unit) value of the endpoint controller
@@ -151,6 +158,8 @@ struct mhi_ep_cntrl { void __iomem *virt, size_t size);int (*read_sync)(struct mhi_ep_cntrl *mhi_cntrl,struct mhi_ep_buf_info *buf_info);int (*write_sync)(struct mhi_ep_cntrl *mhi_cntrl,struct mhi_ep_buf_info *buf_info); +int (*read_async)(struct mhi_ep_cntrl *mhi_cntrl,struct mhi_ep_buf_info *buf_info); +int (*write_async)(struct mhi_ep_cntrl *mhi_cntrl,struct mhi_ep_buf_info *buf_info);enum mhi_state mhi_state;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 19/213 bus: mhi: ep: Add support for async DMA write operation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manivannan Sadhasivam <[email protected]>
[ Upstream commit ee08acb58fe47fc3bc2c137965985cdb1df40b35 ]
In order to optimize the data transfer, let's use the async DMA operation for writing (queuing) data to the host.
In the async path, the completion event for the transfer ring will only be sent to the host when the controller driver notifies the MHI stack of the actual transfer completion using the callback (mhi_ep_skb_completion) supplied in "struct mhi_ep_buf_info".
Also to accommodate the async operation, the transfer ring read offset (ring->rd_offset) is cached in the "struct mhi_ep_chan" and updated locally to let the stack queue further ring items to the controller driver. But the actual read offset of the transfer ring will only be updated in the completion callback.
Stable-dep-of: c7d0b2db5bc5 ("bus: mhi: ep: Do not allocate memory for MHI objects from DMA zone")
--- drivers/bus/mhi/ep/internal.h | 1 + drivers/bus/mhi/ep/main.c | 74 +++++++++++++++++++++++++---------- include/linux/mhi_ep.h | 4 ++ 3 files changed, 59 insertions(+), 20 deletions(-)
drivers/bus/mhi/ep/internal.h +1 -0
@@ -159,6 +159,7 @@ struct mhi_ep_chan {void (*xfer_cb)(struct mhi_ep_device *mhi_dev,struct mhi_result *result);enum mhi_ch_state state;enum dma_data_direction dir; +size_t rd_offset;u64 tre_loc;u32 tre_size;u32 tre_bytes_left;
drivers/bus/mhi/ep/main.c +54 -20
146 lines not on this page · raw message
include/linux/mhi_ep.h +4 -0
@@ -51,16 +51,20 @@ struct mhi_ep_db_info {/** * struct mhi_ep_buf_info - MHI Endpoint transfer buffer info +* @mhi_dev: MHI device associated with this buffer * @dev_addr: Address of the buffer in endpoint * @host_addr: Address of the bufffer in host * @size: Size of the buffer +* @code: Transfer completion code * @cb: Callback to be executed by controller drivers after transfer completion (async) * @cb_buf: Opaque buffer to be passed to the callback */ struct mhi_ep_buf_info { +struct mhi_ep_device *mhi_dev;void *dev_addr;u64 host_addr;size_t size; +int code;void (*cb)(struct mhi_ep_buf_info *buf_info);void *cb_buf;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 20/213 bus: mhi: ep: Add support for async DMA read operation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manivannan Sadhasivam <[email protected]>
[ Upstream commit 2547beb00ddb40e55b773970622421d978f71473 ]
As like the async DMA write operation, let's add support for async DMA read operation. In the async path, the data will be read from the transfer ring continuously and when the controller driver notifies the stack using the completion callback (mhi_ep_read_completion), then the client driver will be notified with the read data and the completion event will be sent to the host for the respective ring element (if requested by the host).
Stable-dep-of: c7d0b2db5bc5 ("bus: mhi: ep: Do not allocate memory for MHI objects from DMA zone")
--- drivers/bus/mhi/ep/main.c | 162 +++++++++++++++++++++----------------- 1 file changed, 89 insertions(+), 73 deletions(-)
drivers/bus/mhi/ep/main.c +89 -73
@@ -318,17 +318,81 @@ bool mhi_ep_queue_is_empty(struct mhi_ep_device *mhi_dev, enum dma_data_directio }EXPORT_SYMBOL_GPL (mhi_ep_queue_is_empty); +static void mhi_ep_read_completion (struct mhi_ep_buf_info *buf_info) +{ +struct mhi_ep_device *mhi_dev = buf_info->mhi_dev; +struct mhi_ep_cntrl *mhi_cntrl = mhi_dev->mhi_cntrl; +struct mhi_ep_chan *mhi_chan = mhi_dev->ul_chan; +struct mhi_ep_ring *ring = &mhi_cntrl->mhi_chan[mhi_chan->chan].ring; +struct mhi_ring_element *el = &ring->ring_cache[ring->rd_offset]; +struct mhi_result result = {}; +int ret; + +if (mhi_chan->xfer_cb) { + result.buf_addr = buf_info->cb_buf; + result.dir = mhi_chan->dir; + result.bytes_xferd = buf_info->size; + + mhi_chan->xfer_cb (mhi_dev, &result); + } + +/* +* The host will split the data packet into multiple TREs if it can't fit +* the packet in a single TRE. In that case, CHAIN flag will be set by the +* host for all TREs except the last one. +*/ +if (buf_info->code !=MHI_EV_CC_OVERFLOW ) { +if (MHI_TRE_DATA_GET_CHAIN (el)) { +/* +* IEOB (Interrupt on End of Block) flag will be set by the host if +* it expects the completion event for all TREs of a TD. +*/ +if (MHI_TRE_DATA_GET_IEOB (el)) { + ret =mhi_ep_send_completion_event (mhi_cntrl, ring, el, +MHI_TRE_DATA_GET_LEN (el), +MHI_EV_CC_EOB ); +if (ret <0 ) { +dev_err (&mhi_chan->mhi_dev->dev, +"Error sending transfer compl. event\n" ); + goto err_free_tre_buf; + } + } + }else { +/* +* IEOT (Interrupt on End of Transfer) flag will be set by the host +* for the last TRE of the TD and expects the completion event for +* the same. +*/ +if (MHI_TRE_DATA_GET_IEOT (el)) { + ret =mhi_ep_send_completion_event (mhi_cntrl, ring, el, +MHI_TRE_DATA_GET_LEN (el), +MHI_EV_CC_EOT ); +if (ret <0 ) { +dev_err (&mhi_chan->mhi_dev->dev, +"Error sending transfer compl. event\n" ); + goto err_free_tre_buf; + } + } + } + } + +mhi_ep_ring_inc_index (ring); + +err_free_tre_buf: +kmem_cache_free (mhi_cntrl->tre_buf_cache, buf_info->cb_buf); +} +static int mhi_ep_read_channel (struct mhi_ep_cntrl *mhi_cntrl, -struct mhi_ep_ring *ring, -struct mhi_result *result, -u32 len) +struct mhi_ep_ring *ring) {struct mhi_ep_chan *mhi_chan = &mhi_cntrl->mhi_chan[ring->ch_id];struct device *dev = &mhi_cntrl->mhi_dev->dev;size_t tr_len, read_offset, write_offset;struct mhi_ep_buf_info buf_info = {}; +u32 len =MHI_EP_DEFAULT_MTU ;struct mhi_ring_element *el;bool tr_done = false; +void *buf_addr;u32 buf_left;int ret;
@@ -358,83 +422,50 @@ static int mhi_ep_read_channel(struct mhi_ep_cntrl *mhi_cntrl, read_offset = mhi_chan->tre_size - mhi_chan->tre_bytes_left; write_offset = len - buf_left; + buf_addr =kmem_cache_zalloc (mhi_cntrl->tre_buf_cache,GFP_KERNEL |GFP_DMA ); +if (!buf_addr) +return -ENOMEM ; + buf_info.host_addr = mhi_chan->tre_loc + read_offset; - buf_info.dev_addr = result->buf_addr + write_offset; + buf_info.dev_addr = buf_addr + write_offset; buf_info.size = tr_len; + buf_info.cb = mhi_ep_read_completion; + buf_info.cb_buf = buf_addr; + buf_info.mhi_dev = mhi_chan->mhi_dev; + +if (mhi_chan->tre_bytes_left - tr_len) + buf_info.code =MHI_EV_CC_OVERFLOW ;dev_dbg (dev,"Reading %zd bytes from channel (%u)\n" , tr_len, ring->ch_id); - ret = mhi_cntrl->read_sync (mhi_cntrl, &buf_info); + ret = mhi_cntrl->read_async (mhi_cntrl, &buf_info);if (ret <0 ) {dev_err (&mhi_chan->mhi_dev->dev,"Error reading from channel\n" ); -return ret; + goto err_free_buf_addr; } buf_left -= tr_len; mhi_chan->tre_bytes_left -= tr_len; -/* -* Once the TRE (Transfer Ring Element) of a TD (Transfer Descriptor) has been -* read completely: -* -* 1. Send completion event to the host based on the flags set in TRE. -* 2. Increment the local read offset of the transfer ring. -*/ if (!mhi_chan->tre_bytes_left) { -/* -* The host will split the data packet into multiple TREs if it can't fit -* the packet in a single TRE. In that case, CHAIN flag will be set by the -* host for all TREs except the last one. -*/ -if (MHI_TRE_DATA_GET_CHAIN (el)) { -/* -* IEOB (Interrupt on End of Block) flag will be set by the host if -* it expects the completion event for all TREs of a TD. -*/ -if (MHI_TRE_DATA_GET_IEOB (el)) { - ret =mhi_ep_send_completion_event (mhi_cntrl, ring, el, -MHI_TRE_DATA_GET_LEN (el), -MHI_EV_CC_EOB ); -if (ret <0 ) { -dev_err (&mhi_chan->mhi_dev->dev, -"Error sending transfer compl. event\n" ); -return ret; - } - } - }else { -/* -* IEOT (Interrupt on End of Transfer) flag will be set by the host -* for the last TRE of the TD and expects the completion event for -* the same. -*/ -if (MHI_TRE_DATA_GET_IEOT (el)) { - ret =mhi_ep_send_completion_event (mhi_cntrl, ring, el, -MHI_TRE_DATA_GET_LEN (el), -MHI_EV_CC_EOT ); -if (ret <0 ) { -dev_err (&mhi_chan->mhi_dev->dev, -"Error sending transfer compl. event\n" ); -return ret; - } - } - +if (MHI_TRE_DATA_GET_IEOT (el)) tr_done = true; - } mhi_chan->rd_offset = (mhi_chan->rd_offset +1 ) % ring->ring_size; -mhi_ep_ring_inc_index (ring); } - - result->bytes_xferd += tr_len; }while (buf_left && !tr_done);return 0 ; + +err_free_buf_addr: +kmem_cache_free (mhi_cntrl->tre_buf_cache, buf_addr); + +return ret; } -static int mhi_ep_process_ch_ring (struct mhi_ep_ring *ring,struct mhi_ring_element *el) +static int mhi_ep_process_ch_ring (struct mhi_ep_ring *ring) {struct mhi_ep_cntrl *mhi_cntrl = ring->mhi_cntrl;struct mhi_result result = {}; -u32 len =MHI_EP_DEFAULT_MTU ;struct mhi_ep_chan *mhi_chan;int ret;
@@ -455,27 +486,15 @@ static int mhi_ep_process_ch_ring(struct mhi_ep_ring *ring, struct mhi_ring_elem mhi_chan->xfer_cb (mhi_chan->mhi_dev, &result); }else {/* UL channel */ - result.buf_addr =kmem_cache_zalloc (mhi_cntrl->tre_buf_cache,GFP_KERNEL |GFP_DMA ); -if (!result.buf_addr) -return -ENOMEM ; -do { - ret =mhi_ep_read_channel (mhi_cntrl, ring, &result, len); + ret =mhi_ep_read_channel (mhi_cntrl, ring);if (ret <0 ) {dev_err (&mhi_chan->mhi_dev->dev,"Failed to read channel\n" ); -kmem_cache_free (mhi_cntrl->tre_buf_cache, result.buf_addr);return ret; } - result.dir = mhi_chan->dir; - mhi_chan->xfer_cb (mhi_chan->mhi_dev, &result); - result.bytes_xferd =0 ; -memset (result.buf_addr,0 , len); -/* Read until the ring becomes empty */ }while (!mhi_ep_queue_is_empty (mhi_chan->mhi_dev,DMA_TO_DEVICE )); - -kmem_cache_free (mhi_cntrl->tre_buf_cache, result.buf_addr); }return 0 ;
@@ -781,7 +800,6 @@ static void mhi_ep_ch_ring_worker(struct work_struct *work) struct mhi_ep_cntrl *mhi_cntrl = container_of(work, struct mhi_ep_cntrl, ch_ring_work);struct device *dev = &mhi_cntrl->mhi_dev->dev;struct mhi_ep_ring_item *itr, *tmp; -struct mhi_ring_element *el;struct mhi_ep_ring *ring;struct mhi_ep_chan *chan;unsigned long flags;
@@ -826,10 +844,8 @@ static void mhi_ep_ch_ring_worker(struct work_struct *work)continue ; } - el = &ring->ring_cache[ring->rd_offset]; -dev_dbg (dev,"Processing the ring for channel (%u)\n" , ring->ch_id); - ret =mhi_ep_process_ch_ring (ring, el); + ret =mhi_ep_process_ch_ring (ring);if (ret) {dev_err (dev,"Error processing ring for channel (%u): %d\n" , ring->ch_id, ret);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 21/213 bus: mhi: ep: Do not allocate memory for MHI objects from DMA zone
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manivannan Sadhasivam <[email protected]>
[ Upstream commit c7d0b2db5bc5e8c0fdc67b3c8f463c3dfec92f77 ]
MHI endpoint stack accidentally started allocating memory for objects from DMA zone since commit 62210a26cd4f ("bus: mhi: ep: Use slab allocator where applicable"). But there is no real need to allocate memory from this naturally limited DMA zone. This also causes the MHI endpoint stack to run out of memory while doing high bandwidth transfers.
So let's switch over to normal memory.
--- drivers/bus/mhi/ep/main.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/bus/mhi/ep/main.c +7 -7
@@ -74,7 +74,7 @@ static int mhi_ep_send_completion_event(struct mhi_ep_cntrl *mhi_cntrl, struct mstruct mhi_ring_element *event;int ret; - event =kmem_cache_zalloc (mhi_cntrl->ev_ring_el_cache,GFP_KERNEL |GFP_DMA ); + event =kmem_cache_zalloc (mhi_cntrl->ev_ring_el_cache,GFP_KERNEL );if (!event)return -ENOMEM ;
@@ -93,7 +93,7 @@ int mhi_ep_send_state_change_event(struct mhi_ep_cntrl *mhi_cntrl, enum mhi_statstruct mhi_ring_element *event;int ret; - event =kmem_cache_zalloc (mhi_cntrl->ev_ring_el_cache,GFP_KERNEL |GFP_DMA ); + event =kmem_cache_zalloc (mhi_cntrl->ev_ring_el_cache,GFP_KERNEL );if (!event)return -ENOMEM ;
@@ -111,7 +111,7 @@ int mhi_ep_send_ee_event(struct mhi_ep_cntrl *mhi_cntrl, enum mhi_ee_type exec_estruct mhi_ring_element *event;int ret; - event =kmem_cache_zalloc (mhi_cntrl->ev_ring_el_cache,GFP_KERNEL |GFP_DMA ); + event =kmem_cache_zalloc (mhi_cntrl->ev_ring_el_cache,GFP_KERNEL );if (!event)return -ENOMEM ;
@@ -130,7 +130,7 @@ static int mhi_ep_send_cmd_comp_event(struct mhi_ep_cntrl *mhi_cntrl, enum mhi_estruct mhi_ring_element *event;int ret; - event =kmem_cache_zalloc (mhi_cntrl->ev_ring_el_cache,GFP_KERNEL |GFP_DMA ); + event =kmem_cache_zalloc (mhi_cntrl->ev_ring_el_cache,GFP_KERNEL );if (!event)return -ENOMEM ;
@@ -422,7 +422,7 @@ static int mhi_ep_read_channel(struct mhi_ep_cntrl *mhi_cntrl, read_offset = mhi_chan->tre_size - mhi_chan->tre_bytes_left; write_offset = len - buf_left; - buf_addr =kmem_cache_zalloc (mhi_cntrl->tre_buf_cache,GFP_KERNEL |GFP_DMA ); + buf_addr =kmem_cache_zalloc (mhi_cntrl->tre_buf_cache,GFP_KERNEL );if (!buf_addr)return -ENOMEM ;
@@ -1460,14 +1460,14 @@ int mhi_ep_register_controller(struct mhi_ep_cntrl *mhi_cntrl, mhi_cntrl->ev_ring_el_cache =kmem_cache_create ("mhi_ep_event_ring_el" ,sizeof (struct mhi_ring_element ),0 , -SLAB_CACHE_DMA ,NULL ); +0 ,NULL );if (!mhi_cntrl->ev_ring_el_cache) { ret = -ENOMEM ; goto err_free_cmd; } mhi_cntrl->tre_buf_cache =kmem_cache_create ("mhi_ep_tre_buf" ,MHI_EP_DEFAULT_MTU ,0 , -SLAB_CACHE_DMA ,NULL ); +0 ,NULL );if (!mhi_cntrl->tre_buf_cache) { ret = -ENOMEM ; goto err_destroy_ev_ring_el_cache;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 22/213 Revert "powerpc/ps3_defconfig: Disable PPC64_BIG_ENDIAN_ELF_ABI_V2"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geoff Levand <[email protected]>
[ Upstream commit 914d081ead115f7ba685ab57f977716bdd09c894 ]
This reverts commit 482b718a84f08b6fc84879c3e90cc57dba11c115.
The preceding commits by Nicholas Piggin enable PS3 support for ELFv2, so there's no need to disable it for PS3 anymore.
--- arch/powerpc/configs/ps3_defconfig | 1 - 1 file changed, 1 deletion(-)
arch/powerpc/configs/ps3_defconfig +0 -1
@@ -24,7 +24,6 @@ CONFIG_PS3_VRAM=m CONFIG_PS3_LPM=m # CONFIG_PPC_OF_BOOT_TRAMPOLINE is not set CONFIG_KEXEC=y -# CONFIG_PPC64_BIG_ENDIAN_ELF_ABI_V2 is not set CONFIG_PPC_4K_PAGES=y CONFIG_SCHED_SMT=y CONFIG_PM=y
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 23/213 pds_core: no health-thread in VF path
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shannon Nelson <[email protected]>
[ Upstream commit 3e36031cc0540ca97b615cbb940331892cbd3d21 ]
The VFs don't run the health thread, so don't try to stop or restart the non-existent timer or work item.
--- drivers/net/ethernet/amd/pds_core/main.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/ethernet/amd/pds_core/main.c +6 -0
@@ -451,6 +451,9 @@ static void pdsc_remove(struct pci_dev *pdev)static void pdsc_stop_health_thread (struct pdsc *pdsc) { +if (pdsc->pdev->is_virtfn) +return ; +timer_shutdown_sync (&pdsc->wdtimer);if (pdsc->health_work.func)cancel_work_sync (&pdsc->health_work);
@@ -458,6 +461,9 @@ static void pdsc_stop_health_thread(struct pdsc *pdsc)static void pdsc_restart_health_thread (struct pdsc *pdsc) { +if (pdsc->pdev->is_virtfn) +return ; +timer_setup (&pdsc->wdtimer, pdsc_wdtimer_cb,0 );mod_timer (&pdsc->wdtimer, jiffies +1 ); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 24/213 libceph: init the cursor when preparing sparse read in msgr2
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiubo Li <[email protected]>
[ Upstream commit 321e3c3de53c7530cd518219d01f04e7e32a9d23 ]
The cursor is no longer initialized in the OSD client, causing the sparse read state machine to fall into an infinite loop. The cursor should be initialized in IN_S_PREPARE_SPARSE_DATA state.
[ idryomov: use msg instead of con->in_msg, changelog ]
--- net/ceph/messenger_v2.c | 3 +++ 1 file changed, 3 insertions(+)
net/ceph/messenger_v2.c +3 -0
@@ -2038,6 +2038,9 @@ static int prepare_sparse_read_data(struct ceph_connection *con)if (!con_secure (con)) con->in_data_crc =-1 ; +ceph_msg_data_cursor_init (&con->v2.in_cursor, msg, + msg->sparse_read_total); +reset_in_kvecs (con); con->v2.in_state =IN_S_PREPARE_SPARSE_DATA_CONT ; con->v2.data_len_remain =data_len (msg);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 25/213 tracing: Have saved_cmdlines arrays all in one allocation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt (Google) <[email protected]>
[ Upstream commit 0b18c852cc6fb8284ac0ab97e3e840974a6a8a64 ]
The saved_cmdlines have three arrays for mapping PIDs to COMMs:
- map_pid_to_cmdline[]
- map_cmdline_to_pid[]
- saved_cmdlines
The map_pid_to_cmdline[] is PID_MAX_DEFAULT in size and holds the index into the other arrays. The map_cmdline_to_pid[] is a mapping back to the full pid as it can be larger than PID_MAX_DEFAULT. And the saved_cmdlines[] just holds the COMMs associated to the pids.
Currently the map_pid_to_cmdline[] and saved_cmdlines[] are allocated together (in reality the saved_cmdlines is just in the memory of the rounding of the allocation of the structure as it is always allocated in powers of two). The map_cmdline_to_pid[] array is allocated separately.
Since the rounding to a power of two is rather large (it allows for 8000 elements in saved_cmdlines), also include the map_cmdline_to_pid[] array. (This drops it to 6000 by default, which is still plenty for most use cases). This saves even more memory as the map_cmdline_to_pid[] array doesn't need to be allocated.
--- kernel/trace/trace.c | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-)
kernel/trace/trace.c +8 -10
@@ -2316,6 +2316,10 @@ struct saved_cmdlines_buffer { };static struct saved_cmdlines_buffer *savedcmd; +/* Holds the size of a cmdline and pid element */ +#define SAVED_CMDLINE_MAP_ELEMENT_SIZE (s) \ + (TASK_COMM_LEN + sizeof((s)->map_cmdline_to_pid[0])) +static inline char *get_saved_cmdlines (int idx) {return &savedcmd->saved_cmdlines[idx *TASK_COMM_LEN ];
@@ -2330,7 +2334,6 @@ static void free_saved_cmdlines_buffer(struct saved_cmdlines_buffer *s) {int order =get_order (sizeof (*s) + s->cmdline_num *TASK_COMM_LEN ); -kfree (s->map_cmdline_to_pid);kmemleak_free (s);free_pages ((unsigned long )s, order); }
@@ -2343,7 +2346,7 @@ static struct saved_cmdlines_buffer *allocate_cmdlines_buffer(unsigned int val)int order;/* Figure out how much is needed to hold the given number of cmdlines */ - orig_size =sizeof (*s) + val *TASK_COMM_LEN ; + orig_size =sizeof (*s) + val *SAVED_CMDLINE_MAP_ELEMENT_SIZE (s); order =get_order (orig_size); size =1 << (order +PAGE_SHIFT ); page =alloc_pages (GFP_KERNEL , order);
@@ -2355,16 +2358,11 @@ static struct saved_cmdlines_buffer *allocate_cmdlines_buffer(unsigned int val)memset (s,0 ,sizeof (*s));/* Round up to actual allocation */ - val = (size -sizeof (*s)) /TASK_COMM_LEN ; + val = (size -sizeof (*s)) /SAVED_CMDLINE_MAP_ELEMENT_SIZE (s); s->cmdline_num = val; - s->map_cmdline_to_pid =kmalloc_array (val, -sizeof (*s->map_cmdline_to_pid), -GFP_KERNEL ); -if (!s->map_cmdline_to_pid) { -free_saved_cmdlines_buffer (s); -return NULL ; - } +/* Place map_cmdline_to_pid array right after saved_cmdlines */ + s->map_cmdline_to_pid = (unsigned *)&s->saved_cmdlines[val *TASK_COMM_LEN ]; s->cmdline_idx =0 ; memset(&s->map_pid_to_cmdline, NO_CMDLINE_MAP,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 26/213 riscv: cpufeature: Fix thead vector hwcap removal
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charlie Jenkins <[email protected]>
[ Upstream commit e482eab4d1eb31031eff2b6afb71776483101979 ]
The riscv_cpuinfo struct that contains mvendorid and marchid is not populated until all harts are booted which happens after the DT parsing. Use the mvendorid/marchid from the boot hart to determine if the DT contains an invalid V.
--- arch/riscv/include/asm/sbi.h | 2 ++ arch/riscv/kernel/cpu.c | 40 ++++++++++++++++++++++++++++++---- arch/riscv/kernel/cpufeature.c | 8 +++++-- 3 files changed, 44 insertions(+), 6 deletions(-)
arch/riscv/include/asm/sbi.h +2 -0
@@ -327,6 +327,8 @@ static inline int sbi_remote_fence_i(const struct cpumask *cpu_mask) { return -1static inline void sbi_init (void ) {}#endif /* CONFIG_RISCV_SBI */ +unsigned long riscv_get_mvendorid (void ); +unsigned long riscv_get_marchid (void );unsigned long riscv_cached_mvendorid (unsigned int cpu_id);unsigned long riscv_cached_marchid (unsigned int cpu_id);unsigned long riscv_cached_mimpid (unsigned int cpu_id);
arch/riscv/kernel/cpu.c +36 -4
@@ -139,6 +139,34 @@ int riscv_of_parent_hartid(struct device_node *node, unsigned long *hartid)return -1 ; } +unsigned long __init riscv_get_marchid (void ) +{ +struct riscv_cpuinfo *ci =this_cpu_ptr (&riscv_cpuinfo); + +#if IS_ENABLED (CONFIG_RISCV_SBI ) + ci->marchid =sbi_spec_is_0_1 () ?0 :sbi_get_marchid (); +#elif IS_ENABLED (CONFIG_RISCV_M_MODE ) + ci->marchid =csr_read (CSR_MARCHID ); +#else + ci->marchid =0 ; +#endif +return ci->marchid; +} + +unsigned long __init riscv_get_mvendorid (void ) +{ +struct riscv_cpuinfo *ci =this_cpu_ptr (&riscv_cpuinfo); + +#if IS_ENABLED (CONFIG_RISCV_SBI ) + ci->mvendorid =sbi_spec_is_0_1 () ?0 :sbi_get_mvendorid (); +#elif IS_ENABLED (CONFIG_RISCV_M_MODE ) + ci->mvendorid =csr_read (CSR_MVENDORID ); +#else + ci->mvendorid =0 ; +#endif +return ci->mvendorid; +} + DEFINE_PER_CPU(struct riscv_cpuinfo, riscv_cpuinfo);unsigned long riscv_cached_mvendorid (unsigned int cpu_id)
@@ -170,12 +198,16 @@ static int riscv_cpuinfo_starting(unsigned int cpu)struct riscv_cpuinfo *ci =this_cpu_ptr (&riscv_cpuinfo);#if IS_ENABLED (CONFIG_RISCV_SBI ) - ci->mvendorid =sbi_spec_is_0_1 () ?0 :sbi_get_mvendorid (); - ci->marchid =sbi_spec_is_0_1 () ?0 :sbi_get_marchid (); +if (!ci->mvendorid) + ci->mvendorid =sbi_spec_is_0_1 () ?0 :sbi_get_mvendorid (); +if (!ci->marchid) + ci->marchid =sbi_spec_is_0_1 () ?0 :sbi_get_marchid (); ci->mimpid =sbi_spec_is_0_1 () ?0 :sbi_get_mimpid ();#elif IS_ENABLED (CONFIG_RISCV_M_MODE ) - ci->mvendorid =csr_read (CSR_MVENDORID ); - ci->marchid =csr_read (CSR_MARCHID ); +if (!ci->mvendorid) + ci->mvendorid =csr_read (CSR_MVENDORID ); +if (!ci->marchid) + ci->marchid =csr_read (CSR_MARCHID ); ci->mimpid =csr_read (CSR_MIMPID );#else ci->mvendorid =0 ;
arch/riscv/kernel/cpufeature.c +6 -2
@@ -351,6 +351,8 @@ static void __init riscv_fill_hwcap_from_isa_string(unsigned long *isa2hwcap)struct acpi_table_header *rhct;acpi_status status;unsigned int cpu; +u64 boot_vendorid; +u64 boot_archid;if (!acpi_disabled) { status =acpi_get_table (ACPI_SIG_RHCT ,0 , &rhct);
@@ -358,6 +360,9 @@ static void __init riscv_fill_hwcap_from_isa_string(unsigned long *isa2hwcap)return ; } + boot_vendorid =riscv_get_mvendorid (); + boot_archid =riscv_get_marchid (); +for_each_possible_cpu (cpu) {struct riscv_isainfo *isainfo = &hart_isa[cpu];unsigned long this_hwcap =0 ;
@@ -405,8 +410,7 @@ static void __init riscv_fill_hwcap_from_isa_string(unsigned long *isa2hwcap)* CPU cores with the ratified spec will contain non-zero * marchid. */ -if (acpi_disabled &&riscv_cached_mvendorid (cpu) ==THEAD_VENDOR_ID && -riscv_cached_marchid (cpu) ==0x0 ) { +if (acpi_disabled && boot_vendorid ==THEAD_VENDOR_ID && boot_archid ==0x0 ) { this_hwcap &= ~isa2hwcap[RISCV_ISA_EXT_v];clear_bit (RISCV_ISA_EXT_v, isainfo->isa); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 27/213 spi: spi-fsl-lpspi: remove redundant spi_controller_put call
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Song <[email protected]>
[ Upstream commit bff892acf79cec531da6cb21c50980a584ce1476 ]
devm_spi_alloc_controller will allocate an SPI controller and automatically release a reference on it when dev is unbound from its driver. It doesn't need to call spi_controller_put explicitly to put the reference when lpspi driver failed initialization.
--- drivers/spi/spi-fsl-lpspi.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-)
drivers/spi/spi-fsl-lpspi.c +6 -8
@@ -881,39 +881,39 @@ static int fsl_lpspi_probe(struct platform_device *pdev) fsl_lpspi->base =devm_platform_get_and_ioremap_resource (pdev,0 , &res);if (IS_ERR (fsl_lpspi->base)) { ret =PTR_ERR (fsl_lpspi->base); - goto out_controller_put; +return ret; } fsl_lpspi->base_phys = res->start; irq =platform_get_irq (pdev,0 );if (irq <0 ) { ret = irq; - goto out_controller_put; +return ret; } ret =devm_request_irq (&pdev->dev, irq, fsl_lpspi_isr,0 ,dev_name (&pdev->dev), fsl_lpspi);if (ret) {dev_err (&pdev->dev,"can't get irq%d: %d\n" , irq, ret); - goto out_controller_put; +return ret; } fsl_lpspi->clk_per =devm_clk_get (&pdev->dev,"per" );if (IS_ERR (fsl_lpspi->clk_per)) { ret =PTR_ERR (fsl_lpspi->clk_per); - goto out_controller_put; +return ret; } fsl_lpspi->clk_ipg =devm_clk_get (&pdev->dev,"ipg" );if (IS_ERR (fsl_lpspi->clk_ipg)) { ret =PTR_ERR (fsl_lpspi->clk_ipg); - goto out_controller_put; +return ret; }/* enable the clock */ ret =fsl_lpspi_init_rpm (fsl_lpspi);if (ret) - goto out_controller_put; +return ret; ret =pm_runtime_get_sync (fsl_lpspi->dev);if (ret <0 ) {
@@ -974,8 +974,6 @@ static int fsl_lpspi_probe(struct platform_device *pdev)pm_runtime_dont_use_autosuspend (fsl_lpspi->dev);pm_runtime_put_sync (fsl_lpspi->dev);pm_runtime_disable (fsl_lpspi->dev); -out_controller_put: -spi_controller_put (controller);return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 28/213 ata: ahci: Add mask_port_map module parameter
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
[ Upstream commit 24cfd86433c920188ac3f02df8aba6bc4c792f4b ]
Commits 0077a504e1a4 ("ahci: asm1166: correct count of reported ports") and 9815e3961754 ("ahci: asm1064: correct count of reported ports") attempted to limit the ports of the ASM1166 and ASM1064 AHCI controllers to avoid long boot times caused by the fact that these adapters report a port map larger than the number of physical ports. The excess ports are "virtual" to hide port multiplier devices and probing these ports takes time. However, these commits caused a regression for users that do use PMP devices, as the ATA devices connected to the PMP cannot be scanned. These commits have thus been reverted by commit 6cd8adc3e18 ("ahci: asm1064: asm1166: don't limit reported ports") to allow the discovery of devices connected through a port multiplier. But this revert re-introduced the long boot times for users that do not use a port multiplier setup.
This patch adds the mask_port_map ahci module parameter to allow users to manually specify port map masks for controllers. In the case of the ASMedia 1166 and 1064 controllers, users that do not have port multiplier devices can mask the excess virtual ports exposed by the controller to speedup port scanning, thus reducing boot time.
The mask_port_map parameter accepts 2 different formats:
- mask_port_map=<mask>
This applies the same mask to all AHCI controllers present in the system. This format is convenient for small systems that have only a single AHCI controller.
- mask_port_map=<pci_dev>=<mask>,<pci_dev>=mask,...
This applies the specified masks only to the PCI device listed. The <pci_dev> field is a regular PCI device ID (domain:bus:dev.func). This ID can be seen following "ahci" in the kernel messages. E.g. for "ahci 0000:01:00.0: 2/2 ports implemented (port mask 0x3)", the <pci_dev> field is "0000:01:00.0".
When used, the function ahci_save_initial_config() indicates that a port map mask was applied with the message "masking port_map ...". E.g.: without a mask:
modprobe ahci
dmesg | grep ahci
...
ahci 0000:00:17.0: AHCI vers 0001.0301, 32 command slots, 6 Gbps, SATA mode ahci 0000:00:17.0: (0000:00:17.0) 8/8 ports implemented (port mask 0xff)
With a mask:
modprobe ahci mask_port_map=0000:00:17.0=0x1
dmesg | grep ahci
...
ahci 0000:00:17.0: masking port_map 0xff -> 0x1
ahci 0000:00:17.0: AHCI vers 0001.0301, 32 command slots, 6 Gbps, SATA mode ahci 0000:00:17.0: (0000:00:17.0) 1/8 ports implemented (port mask 0x1)
--- drivers/ata/ahci.c | 85 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 85 insertions(+)
drivers/ata/ahci.c +85 -0
@@ -667,6 +667,87 @@ static int mobile_lpm_policy = -1;module_param (mobile_lpm_policy, int,0644 );MODULE_PARM_DESC (mobile_lpm_policy,"Default LPM policy for mobile chipsets" ); +static char *ahci_mask_port_map; +module_param_named (mask_port_map, ahci_mask_port_map, charp,0444 ); +MODULE_PARM_DESC (mask_port_map, +"32-bits port map masks to ignore controllers ports. " +"Valid values are: " +"\"<mask>\" to apply the same mask to all AHCI controller " +"devices, and \"<pci_dev>=<mask>,<pci_dev>=<mask>,...\" to " +"specify different masks for the controllers specified, " +"where <pci_dev> is the PCI ID of an AHCI controller in the " +"form \"domain:bus:dev.func\"" ); + +static void ahci_apply_port_map_mask (struct device *dev, +struct ahci_host_priv *hpriv,char *mask_s) +{ +unsigned int mask; + +if (kstrtouint (mask_s,0 , &mask)) { +dev_err (dev,"Invalid port map mask\n" ); +return ; + } + + hpriv->mask_port_map = mask; +} + +static void ahci_get_port_map_mask (struct device *dev, +struct ahci_host_priv *hpriv) +{ +char *param, *end, *str, *mask_s; +char *name; + +if (!strlen (ahci_mask_port_map)) +return ; + + str =kstrdup (ahci_mask_port_map,GFP_KERNEL ); +if (!str) +return ; + +/* Handle single mask case */ +if (!strchr (str,'=' )) { +ahci_apply_port_map_mask (dev, hpriv, str); + goto free; + } + +/* +* Mask list case: parse the parameter to apply the mask only if +* the device name matches. +*/ + param = str; + end = param +strlen (param); +while (param && param < end && *param) { + name = param; + param =strchr (name,'=' ); +if (!param) +break ; + + *param ='\0' ; + param++; +if (param >= end) +break ; + +if (strcmp (dev_name (dev), name) !=0 ) { + param =strchr (param,',' ); +if (param) + param++; +continue ; + } + + mask_s = param; + param =strchr (mask_s,',' ); +if (param) { + *param ='\0' ; + param++; + } + +ahci_apply_port_map_mask (dev, hpriv, mask_s); + } + +free: +kfree (str); +} +static void ahci_pci_save_initial_config (struct pci_dev *pdev,struct ahci_host_priv *hpriv) {
@@ -689,6 +770,10 @@ static void ahci_pci_save_initial_config(struct pci_dev *pdev, "Disabling your PATA port. Use the boot option 'ahci.marvell_enable=0' to avoid this.\n"); } +/* Handle port map masks passed as module parameter. */ +if (ahci_mask_port_map) +ahci_get_port_map_mask (&pdev->dev, hpriv); +ahci_save_initial_config (&pdev->dev, hpriv); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 29/213 ASoC: tas2781: mark dvc_tlv with __maybe_unused
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gergo Koteles <[email protected]>
[ Upstream commit 831ec5e3538e989c7995137b5c5c661991a09504 ]
Since we put dvc_tlv static variable to a header file it's copied to each module that includes the header. But not all of them are actually used it.
Fix this W=1 build warning:
include/sound/tas2781-tlv.h:18:35: warning: 'dvc_tlv' defined but not used [-Wunused-const-variable=]
Message-ID: <0e461545a2a6e9b6152985143e50526322e5f76b.1711665731.git.soyer@irl.hu>
--- include/sound/tas2781-tlv.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/sound/tas2781-tlv.h +1 -1
@@ -15,7 +15,7 @@#ifndef __TAS2781_TLV_H__#define __TAS2781_TLV_H__ -static const DECLARE_TLV_DB_SCALE(dvc_tlv, -10000, 100, 0); +static const __maybe_unused DECLARE_TLV_DB_SCALE(dvc_tlv, -10000, 100, 0); static const DECLARE_TLV_DB_SCALE(amp_vol_tlv, 1100, 50, 0);#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 30/213 scsi: Remove scsi device no_start_on_resume flag
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
[ Upstream commit c4367ac83805a2322268c9736cd8ef9124063424 ]
The scsi device flag no_start_on_resume is not set by any scsi low level driver. Remove it. This reverts the changes introduced by commit 0a8589055936 ("ata,scsi: do not issue START STOP UNIT on resume").
Stable-dep-of: 7a6bbc2829d4 ("scsi: sd: Do not repeat the starting disk message")
--- drivers/scsi/sd.c | 9 +++------ include/scsi/scsi_device.h | 1 - 2 files changed, 3 insertions(+), 7 deletions(-)
drivers/scsi/sd.c +3 -6
@@ -3968,7 +3968,7 @@ static int sd_resume(struct device *dev)static int sd_resume_common (struct device *dev,bool runtime) {struct scsi_disk *sdkp =dev_get_drvdata (dev); -int ret =0 ; +int ret;if (!sdkp)/* E.g.: runtime resume at the start of sd_probe() */ return 0 ;
@@ -3978,11 +3978,8 @@ static int sd_resume_common(struct device *dev, bool runtime)return 0 ; } -if (!sdkp->device->no_start_on_resume) { -sd_printk (KERN_NOTICE , sdkp,"Starting disk\n" ); - ret =sd_start_stop_device (sdkp,1 ); - } - +sd_printk (KERN_NOTICE , sdkp,"Starting disk\n" ); + ret =sd_start_stop_device (sdkp,1 );if (!ret) {sd_resume (dev); sdkp->suspended = false;
include/scsi/scsi_device.h +0 -1
@@ -216,7 +216,6 @@ struct scsi_device { unsigned use_192_bytes_for_3f:1; /* ask for 192 bytes from page 0x3f */ unsigned no_start_on_add:1; /* do not issue start on add */ unsigned allow_restart:1; /* issue START_UNIT in error handler */ - unsigned no_start_on_resume:1; /* Do not issue START_STOP_UNIT on resume */ unsigned start_stop_pwr_cond:1; /* Set power cond. in START_STOP_UNIT */ unsigned no_uld_attach:1; /* disable connecting to upper level drivers */ unsigned select_no_atn:1;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 31/213 scsi: sd: Do not repeat the starting disk message
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
[ Upstream commit 7a6bbc2829d4ab592c7e440a6f6f5deb3cd95db4 ]
The SCSI disk message "Starting disk" to signal resuming of a suspended disk is printed in both sd_resume() and sd_resume_common() which results in this message being printed twice when resuming from e.g. autosuspend:
$ echo 5000 > /sys/block/sda/device/power/autosuspend_delay_ms $ echo auto > /sys/block/sda/device/power/control
[ 4962.438293] sd 0:0:0:0: [sda] Synchronizing SCSI cache [ 4962.501121] sd 0:0:0:0: [sda] Stopping disk
$ echo on > /sys/block/sda/device/power/control
[ 4972.805851] sd 0:0:0:0: [sda] Starting disk [ 4980.558806] sd 0:0:0:0: [sda] Starting disk
Fix this double print by removing the call to sd_printk() from sd_resume() and moving the call to sd_printk() in sd_resume_common() earlier in the function, before the check using sd_do_start_stop(). Doing so, the message is printed once regardless if sd_resume_common() actually executes sd_start_stop_device() (i.e. SCSI device case) or not (libsas and libata managed ATA devices case).
--- drivers/scsi/sd.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/scsi/sd.c +2 -3
@@ -3955,8 +3955,6 @@ static int sd_resume(struct device *dev) {struct scsi_disk *sdkp =dev_get_drvdata (dev); -sd_printk (KERN_NOTICE , sdkp,"Starting disk\n" ); -if (opal_unlock_from_suspend (sdkp->opal_dev)) {sd_printk (KERN_NOTICE , sdkp,"OPAL unlock failed\n" );return -EIO ;
@@ -3973,12 +3971,13 @@ static int sd_resume_common(struct device *dev, bool runtime)if (!sdkp)/* E.g.: runtime resume at the start of sd_probe() */ return 0 ; +sd_printk (KERN_NOTICE , sdkp,"Starting disk\n" ); +if (!sd_do_start_stop (sdkp->device, runtime)) { sdkp->suspended = false;return 0 ; } -sd_printk (KERN_NOTICE , sdkp,"Starting disk\n" ); ret =sd_start_stop_device (sdkp,1 );if (!ret) {sd_resume (dev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 32/213 i40e: Fix ST code value for Clause 45
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Vecera <[email protected]>
[ Upstream commit 9b3daf2b0443eeba23c3888059342aec920dfd53 ]
ST code value for clause 45 that has been changed by commit 8196b5fd6c73 ("i40e: Refactor I40E_MDIO_CLAUSE* macros") is currently wrong.
The mentioned commit refactored ..MDIO_CLAUSE??_STCODE_MASK so their value is the same for both clauses. The value is correct for clause 22 but not for clause 45.
Fix the issue by adding a parameter to I40E_GLGEN_MSCA_STCODE_MASK macro that specifies required value.
--- drivers/net/ethernet/intel/i40e/i40e_register.h | 2 +- drivers/net/ethernet/intel/i40e/i40e_type.h | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-)
drivers/net/ethernet/intel/i40e/i40e_register.h +1 -1
@@ -204,7 +204,7 @@#define I40E_GLGEN_MSCA_OPCODE_SHIFT 26#define I40E_GLGEN_MSCA_OPCODE_MASK (_i) I40E_MASK(_i, I40E_GLGEN_MSCA_OPCODE_SHIFT)#define I40E_GLGEN_MSCA_STCODE_SHIFT 28 -#define I40E_GLGEN_MSCA_STCODE_MASK I40E_MASK(0x1, I40E_GLGEN_MSCA_STCODE_SHIFT) +#define I40E_GLGEN_MSCA_STCODE_MASK (_i) I40E_MASK(_i, I40E_GLGEN_MSCA_STCODE_SHIFT)#define I40E_GLGEN_MSCA_MDICMD_SHIFT 30#define I40E_GLGEN_MSCA_MDICMD_MASK I40E_MASK(0x1, I40E_GLGEN_MSCA_MDICMD_SHIFT)#define I40E_GLGEN_MSCA_MDIINPROGEN_SHIFT 31
drivers/net/ethernet/intel/i40e/i40e_type.h +2 -2
@@ -40,11 +40,11 @@ typedef void (*I40E_ADMINQ_CALLBACK)(struct i40e_hw *, struct i40e_aq_desc *);#define I40E_QTX_CTL_VM_QUEUE 0x1#define I40E_QTX_CTL_PF_QUEUE 0x2 -#define I40E_MDIO_CLAUSE22_STCODE_MASK I40E_GLGEN_MSCA_STCODE_MASK +#define I40E_MDIO_CLAUSE22_STCODE_MASK I40E_GLGEN_MSCA_STCODE_MASK(1)#define I40E_MDIO_CLAUSE22_OPCODE_WRITE_MASK I40E_GLGEN_MSCA_OPCODE_MASK(1)#define I40E_MDIO_CLAUSE22_OPCODE_READ_MASK I40E_GLGEN_MSCA_OPCODE_MASK(2) -#define I40E_MDIO_CLAUSE45_STCODE_MASK I40E_GLGEN_MSCA_STCODE_MASK +#define I40E_MDIO_CLAUSE45_STCODE_MASK I40E_GLGEN_MSCA_STCODE_MASK(0)#define I40E_MDIO_CLAUSE45_OPCODE_ADDRESS_MASK I40E_GLGEN_MSCA_OPCODE_MASK(0)#define I40E_MDIO_CLAUSE45_OPCODE_WRITE_MASK I40E_GLGEN_MSCA_OPCODE_MASK(1)#define I40E_MDIO_CLAUSE45_OPCODE_READ_MASK I40E_GLGEN_MSCA_OPCODE_MASK(3)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 33/213 i40e: Include types.h to some headers
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Nguyen <[email protected]>
[ Upstream commit 9cfd3b502153810b66ac0ce47f1fba682228f2d2 ]
Commit 56df345917c0 ("i40e: Remove circular header dependencies and fix headers") redistributed a number of includes from one large header file to the locations they were needed. In some environments, types.h is not included and causing compile issues. The driver should not rely on implicit inclusion from other locations; explicitly include it to these files.
Snippet of issue. Entire log can be seen through the Closes: link.
In file included from drivers/net/ethernet/intel/i40e/i40e_diag.h:7,
from drivers/net/ethernet/intel/i40e/i40e_diag.c:4:
drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h:33:9: error: unknown type name '__le16'
33 | __le16 flags;
| ^~~~~~
drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h:34:9: error: unknown type name '__le16'
34 | __le16 opcode;
| ^~~~~~
...
drivers/net/ethernet/intel/i40e/i40e_diag.h:22:9: error: unknown type name 'u32'
22 | u32 elements; /* number of elements if array */
| ^~~drivers/net/ethernet/intel/i40e/i40e_diag.h:23:9: error: unknown type name 'u32'
23 | u32 stride; /* bytes between each element */
--- drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h | 1 + drivers/net/ethernet/intel/i40e/i40e_diag.h | 1 + 2 files changed, 2 insertions(+)
drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h +1 -0
@@ -5,6 +5,7 @@#define _I40E_ADMINQ_CMD_H_#include <linux/bits.h> +#include <linux/types.h> /* This header file defines the i40e Admin Queue commands and is shared between * i40e Firmware and Software.
drivers/net/ethernet/intel/i40e/i40e_diag.h +1 -0
@@ -4,6 +4,7 @@#ifndef _I40E_DIAG_H_#define _I40E_DIAG_H_ +#include <linux/types.h> #include "i40e_adminq_cmd.h" /* forward-declare the HW struct for the compiler */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 34/213 e1000e: move force SMBUS near the end of enable_ulp function
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Wang <[email protected]>
[ Upstream commit bfd546a552e140b0a4c8a21527c39d6d21addb28 ]
The commit 861e8086029e ("e1000e: move force SMBUS from enable ulp function to avoid PHY loss issue") introduces a regression on PCH_MTP_I219_LM18 (PCIID: 0x8086550A). Without the referred commit, the ethernet works well after suspend and resume, but after applying the commit, the ethernet couldn't work anymore after the resume and the dmesg shows that the NIC link changes to 10Mbps (1000Mbps originally):
[ 43.305084] e1000e 0000:00:1f.6 enp0s31f6: NIC Link is Up 10 Mbps Full Duplex, Flow Control: Rx/Tx
Without the commit, the force SMBUS code will not be executed if "return 0" or "goto out" is executed in the enable_ulp(), and in my case, the "goto out" is executed since FWSM_FW_VALID is set. But after applying the commit, the force SMBUS code will be ran unconditionally.
Here move the force SMBUS code back to enable_ulp() and put it immediately ahead of hw->phy.ops.release(hw), this could allow the longest settling time as possible for interface in this function and doesn't change the original code logic.
The issue was found on a Lenovo laptop with the ethernet hw as below:
00:1f.6 Ethernet controller [0200]: Intel Corporation Device [8086:550a] (rev 20).
And this patch is verified (cable plug and unplug, system suspend and resume) on Lenovo laptops with ethernet hw: [8086:550a], [8086:550b], [8086:15bb], [8086:15be], [8086:1a1f], [8086:1a1c] and [8086:0dc7].
--- drivers/net/ethernet/intel/e1000e/ich8lan.c | 22 +++++++++++++++++++++ drivers/net/ethernet/intel/e1000e/netdev.c | 18 ----------------- 2 files changed, 22 insertions(+), 18 deletions(-)
drivers/net/ethernet/intel/e1000e/ich8lan.c +22 -0
@@ -1225,6 +1225,28 @@ s32 e1000_enable_ulp_lpt_lp(struct e1000_hw *hw, bool to_sx) } release: +/* Switching PHY interface always returns MDI error +* so disable retry mechanism to avoid wasting time +*/ +e1000e_disable_phy_retry (hw); + +/* Force SMBus mode in PHY */ + ret_val =e1000_read_phy_reg_hv_locked (hw,CV_SMB_CTRL , &phy_reg); +if (ret_val) { +e1000e_enable_phy_retry (hw); + hw->phy.ops.release (hw); + goto out; + } + phy_reg |=CV_SMB_CTRL_FORCE_SMBUS ; +e1000_write_phy_reg_hv_locked (hw,CV_SMB_CTRL , phy_reg); + +e1000e_enable_phy_retry (hw); + +/* Force SMBus mode in MAC */ + mac_reg =er32 (CTRL_EXT ); + mac_reg |=E1000_CTRL_EXT_FORCE_SMBUS ; +ew32 (CTRL_EXT , mac_reg); + hw->phy.ops.release (hw); out:if (ret_val)
drivers/net/ethernet/intel/e1000e/netdev.c +0 -18
@@ -6623,7 +6623,6 @@ static int __e1000_shutdown(struct pci_dev *pdev, bool runtime)struct e1000_hw *hw = &adapter->hw;u32 ctrl, ctrl_ext, rctl, status, wufc;int retval =0 ; -u16 smb_ctrl;/* Runtime suspend should only enable wakeup for link changes */ if (runtime)
@@ -6701,23 +6700,6 @@ static int __e1000_shutdown(struct pci_dev *pdev, bool runtime) goto skip_phy_configurations; } } - -/* Force SMBUS to allow WOL */ -/* Switching PHY interface always returns MDI error -* so disable retry mechanism to avoid wasting time -*/ -e1000e_disable_phy_retry (hw); - -e1e_rphy (hw,CV_SMB_CTRL , &smb_ctrl); - smb_ctrl |=CV_SMB_CTRL_FORCE_SMBUS ; -e1e_wphy (hw,CV_SMB_CTRL , smb_ctrl); - -e1000e_enable_phy_retry (hw); - -/* Force SMBus mode in MAC */ - ctrl_ext =er32 (CTRL_EXT ); - ctrl_ext |=E1000_CTRL_EXT_FORCE_SMBUS ; -ew32 (CTRL_EXT , ctrl_ext); }/* Ensure that the appropriate bits are set in LPI_CTRL
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 35/213 bootconfig: Fix the kerneldoc of _xbc_exit()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu (Google) <[email protected]>
[ Upstream commit 298b871cd55a607037ac8af0011b9fdeb54c1e65 ]
Fix the kerneldoc of _xbc_exit() which is updated to have an @early argument and the function name is changed.
--- lib/bootconfig.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
lib/bootconfig.c +2 -1
@@ -901,7 +901,8 @@ static int __init xbc_parse_tree(void) }/** -* xbc_exit() - Clean up all parsed bootconfig +* _xbc_exit() - Clean up all parsed bootconfig +* @early: Set true if this is called before budy system is initialized. * * This clears all data structures of parsed bootconfig on memory. * If you need to reuse xbc_init() with new boot config, you can
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 36/213 perf sched: Move start_work_mutex and work_done_wait_mutex initialization to perf_sched__replay()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Jihong <[email protected]>
[ Upstream commit c6907863519cf97ee09653cc8ec338a2328c2b6f ]
The start_work_mutex and work_done_wait_mutex are used only for the 'perf sched replay'. Put their initialization in perf_sched__replay () to reduce unnecessary actions in other commands.
Simple functional testing:
# perf sched record perf bench sched messaging # Running 'sched/messaging' benchmark: # 20 sender and receiver processes per group # 10 groups == 400 processes run
Total time: 0.197 [sec]
[ perf record: Woken up 1 times to write data ]
[ perf record: Captured and wrote 14.952 MB perf.data (134165 samples) ]
# perf sched replay run measurement overhead: 108 nsecs sleep measurement overhead: 65658 nsecs the run test took 999991 nsecs the sleep test took 1079324 nsecs nr_run_events: 42378 nr_sleep_events: 43102 nr_wakeup_events: 31852 target-less wakeups: 17 multi-target wakeups: 712 task 0 ( swapper: 0), nr_events: 10451 task 1 ( swapper: 1), nr_events: 3 task 2 ( swapper: 2), nr_events: 1 <SNIP> task 717 ( sched-messaging: 74483), nr_events: 152 task 718 ( sched-messaging: 74484), nr_events: 1944 task 719 ( sched-messaging: 74485), nr_events: 73 task 720 ( sched-messaging: 74486), nr_events: 163 task 721 ( sched-messaging: 74487), nr_events: 942 task 722 ( sched-messaging: 74488), nr_events: 78 task 723 ( sched-messaging: 74489), nr_events: 1090 ------------------------------------------------------------ #1 : 1366.507, ravg: 1366.51, cpu: 7682.70 / 7682.70 #2 : 1410.072, ravg: 1370.86, cpu: 7723.88 / 7686.82 #3 : 1396.296, ravg: 1373.41, cpu: 7568.20 / 7674.96 #4 : 1381.019, ravg: 1374.17, cpu: 7531.81 / 7660.64 #5 : 1393.826, ravg: 1376.13, cpu: 7725.25 / 7667.11 #6 : 1401.581, ravg: 1378.68, cpu: 7594.82 / 7659.88 #7 : 1381.337, ravg: 1378.94, cpu: 7371.22 / 7631.01 #8 : 1373.842, ravg: 1378.43, cpu: 7894.92 / 7657.40 #9 : 1364.697, ravg: 1377.06, cpu: 7324.91 / 7624.15 #10 : 1363.613, ravg: 1375.72, cpu: 7209.55 / 7582.69 # echo $? 0
Stable-dep-of: 1a5efc9e13f3 ("libsubcmd: Don't free the usage string")
--- tools/perf/builtin-sched.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-)
tools/perf/builtin-sched.c +12 -7
@@ -3329,15 +3329,20 @@ static int perf_sched__map(struct perf_sched *sched)static int perf_sched__replay (struct perf_sched *sched) { +int ret;unsigned long i; +mutex_init (&sched->start_work_mutex); +mutex_init (&sched->work_done_wait_mutex); +calibrate_run_measurement_overhead (sched);calibrate_sleep_measurement_overhead (sched);test_calibrations (sched); -if (perf_sched__read_events (sched)) -return -1 ; + ret =perf_sched__read_events (sched); +if (ret) + goto out_mutex_destroy;printf ("nr_run_events: %ld\n" , sched->nr_run_events);printf ("nr_sleep_events: %ld\n" , sched->nr_sleep_events);
@@ -3362,7 +3367,11 @@ static int perf_sched__replay(struct perf_sched *sched) sched->thread_funcs_exit = true;destroy_tasks (sched); -return 0 ; + +out_mutex_destroy: +mutex_destroy (&sched->start_work_mutex); +mutex_destroy (&sched->work_done_wait_mutex); +return ret; } static void setup_sorting(struct perf_sched *sched, const struct option *options,
@@ -3600,8 +3609,6 @@ int cmd_sched(int argc, const char **argv)unsigned int i;int ret =0 ; -mutex_init (&sched.start_work_mutex); -mutex_init (&sched.work_done_wait_mutex); sched.curr_thread =calloc (MAX_CPUS ,sizeof (*sched.curr_thread));if (!sched.curr_thread) { ret = -ENOMEM ;
@@ -3689,8 +3696,6 @@ int cmd_sched(int argc, const char **argv)free (sched.curr_pid);free (sched.cpu_last_switched);free (sched.curr_thread); -mutex_destroy (&sched.start_work_mutex); -mutex_destroy (&sched.work_done_wait_mutex);return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 37/213 perf sched: Fix memory leak in perf_sched__map()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Jihong <[email protected]>
[ Upstream commit ef76a5af819743d405674f6de5d0e63320ac653e ]
perf_sched__map() needs to free memory of map_cpus, color_pids and color_cpus in normal path and rollback allocated memory in error path.
Stable-dep-of: 1a5efc9e13f3 ("libsubcmd: Don't free the usage string")
--- tools/perf/builtin-sched.c | 41 ++++++++++++++++++++++++-------------- 1 file changed, 26 insertions(+), 15 deletions(-)
tools/perf/builtin-sched.c +26 -15
@@ -3252,8 +3252,6 @@ static int perf_sched__lat(struct perf_sched *sched)static int setup_map_cpus (struct perf_sched *sched) { -struct perf_cpu_map *map; - sched->max_cpu.cpu =sysconf (_SC_NPROCESSORS_CONF);if (sched->map.comp) {
@@ -3262,16 +3260,15 @@ static int setup_map_cpus(struct perf_sched *sched)return -1 ; } -if (!sched->map.cpus_str) -return 0 ; - - map =perf_cpu_map__new (sched->map.cpus_str); -if (!map) { -pr_err ("failed to get cpus map from %s\n" , sched->map.cpus_str); -return -1 ; +if (sched->map.cpus_str) { + sched->map.cpus =perf_cpu_map__new (sched->map.cpus_str); +if (!sched->map.cpus) { +pr_err ("failed to get cpus map from %s\n" , sched->map.cpus_str); +zfree (&sched->map.comp_cpus); +return -1 ; + } } - sched->map.cpus = map;return 0 ; }
@@ -3311,20 +3308,34 @@ static int setup_color_cpus(struct perf_sched *sched)static int perf_sched__map (struct perf_sched *sched) { +int rc =-1 ; +if (setup_map_cpus (sched)) -return -1 ; +return rc;if (setup_color_pids (sched)) -return -1 ; + goto out_put_map_cpus;if (setup_color_cpus (sched)) -return -1 ; + goto out_put_color_pids;setup_pager ();if (perf_sched__read_events (sched)) -return -1 ; + goto out_put_color_cpus; + + rc =0 ;print_bad_events (sched); -return 0 ; + +out_put_color_cpus: +perf_cpu_map__put (sched->map.color_cpus); + +out_put_color_pids: +perf_thread_map__put (sched->map.color_pids); + +out_put_map_cpus: +zfree (&sched->map.comp_cpus); +perf_cpu_map__put (sched->map.cpus); +return rc; }static int perf_sched__replay (struct perf_sched *sched)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 38/213 perf sched: Move curr_thread initialization to perf_sched__map()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Jihong <[email protected]>
[ Upstream commit 5e895278697c014e95ae7ae5e79a72ef68c5184e ]
The curr_thread is used only for the 'perf sched map'. Put initialization in perf_sched__map() to reduce unnecessary actions in other commands.
Simple functional testing:
# perf sched record perf bench sched messaging # Running 'sched/messaging' benchmark: # 20 sender and receiver processes per group # 10 groups == 400 processes run
Total time: 0.197 [sec]
[ perf record: Woken up 1 times to write data ]
[ perf record: Captured and wrote 15.526 MB perf.data (140095 samples) ]
# perf sched map
*A0 451264.532445 secs A0 => migration/0:15
*. 451264.532468 secs . => swapper:0
. *B0 451264.532537 secs B0 => migration/1:21
. *. 451264.532560 secs
. . *C0 451264.532644 secs C0 => migration/2:27
. . *. 451264.532668 secs
. . . *D0 451264.532753 secs D0 => migration/3:33
. . . *. 451264.532778 secs
. . . . *E0 451264.532861 secs E0 => migration/4:39
. . . . *. 451264.532886 secs
. . . . . *F0 451264.532973 secs F0 => migration/5:45
<SNIP>
A7 A7 A7 A7 A7 *A7 . . . . . . . . . . 451264.790785 secs
A7 A7 A7 A7 A7 A7 *A7 . . . . . . . . . 451264.790858 secs
A7 A7 A7 A7 A7 A7 A7 *A7 . . . . . . . . 451264.790934 secs
A7 A7 A7 A7 A7 A7 A7 A7 *A7 . . . . . . . 451264.791004 secs
A7 A7 A7 A7 A7 A7 A7 A7 A7 *A7 . . . . . . 451264.791075 secs
A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 *A7 . . . . . 451264.791143 secs
A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 *A7 . . . . 451264.791232 secs
A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 *A7 . . . 451264.791336 secs
A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 *A7 . . 451264.791407 secs
A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 *A7 . 451264.791484 secs
A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 *A7 451264.791553 secs
# echo $?
0Stable-dep-of: 1a5efc9e13f3 ("libsubcmd: Don't free the usage string")
--- tools/perf/builtin-sched.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-)
tools/perf/builtin-sched.c +8 -7
@@ -3310,9 +3310,13 @@ static int perf_sched__map(struct perf_sched *sched) {int rc =-1 ; -if (setup_map_cpus (sched)) + sched->curr_thread =calloc (MAX_CPUS ,sizeof (*(sched->curr_thread))); +if (!sched->curr_thread)return rc; +if (setup_map_cpus (sched)) + goto out_free_curr_thread; +if (setup_color_pids (sched)) goto out_put_map_cpus;
@@ -3335,6 +3339,9 @@ static int perf_sched__map(struct perf_sched *sched) out_put_map_cpus:zfree (&sched->map.comp_cpus);perf_cpu_map__put (sched->map.cpus); + +out_free_curr_thread: +zfree (&sched->curr_thread);return rc; }
@@ -3620,11 +3627,6 @@ int cmd_sched(int argc, const char **argv)unsigned int i;int ret =0 ; - sched.curr_thread =calloc (MAX_CPUS ,sizeof (*sched.curr_thread)); -if (!sched.curr_thread) { - ret = -ENOMEM ; - goto out; - } sched.cpu_last_switched =calloc (MAX_CPUS ,sizeof (*sched.cpu_last_switched));if (!sched.cpu_last_switched) { ret = -ENOMEM ;
@@ -3706,7 +3708,6 @@ int cmd_sched(int argc, const char **argv) out:free (sched.curr_pid);free (sched.cpu_last_switched); -free (sched.curr_thread);return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 39/213 perf sched: Move curr_pid and cpu_last_switched initialization to perf_sched__{lat|map|replay}()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Jihong <[email protected]>
[ Upstream commit bd2cdf26b9ea000339d54adc82e87fdbf22c21c3 ]
The curr_pid and cpu_last_switched are used only for the 'perf sched replay/latency/map'. Put their initialization in perf_sched__{lat|map|replay () to reduce unnecessary actions in other commands.
Simple functional testing:
# perf sched record perf bench sched messaging # Running 'sched/messaging' benchmark: # 20 sender and receiver processes per group # 10 groups == 400 processes run
Total time: 0.209 [sec]
[ perf record: Woken up 1 times to write data ]
[ perf record: Captured and wrote 16.456 MB perf.data (147907 samples) ]
# perf sched lat
-------------------------------------------------------------------------------------------------------------------------------------------
Task | Runtime ms | Switches | Avg delay ms | Max delay ms | Max delay start | Max delay end |
-------------------------------------------------------------------------------------------------------------------------------------------
sched-messaging:(401) | 2990.699 ms | 38705 | avg: 0.661 ms | max: 67.046 ms | max start: 456532.624830 s | max end: 456532.691876 s
qemu-system-x86:(7) | 179.764 ms | 2191 | avg: 0.152 ms | max: 21.857 ms | max start: 456532.576434 s | max end: 456532.598291 s
sshd:48125 | 0.522 ms | 2 | avg: 0.037 ms | max: 0.046 ms | max start: 456532.514610 s | max end: 456532.514656 s
<SNIP>
ksoftirqd/11:82 | 0.063 ms | 1 | avg: 0.005 ms | max: 0.005 ms | max start: 456532.769366 s | max end: 456532.769371 s
kworker/9:0-mm_:34624 | 0.233 ms | 20 | avg: 0.004 ms | max: 0.007 ms | max start: 456532.690804 s | max end: 456532.690812 s
migration/13:93 | 0.000 ms | 1 | avg: 0.004 ms | max: 0.004 ms | max start: 456532.512669 s | max end: 456532.512674 s
-----------------------------------------------------------------------------------------------------------------
TOTAL: | 3180.750 ms | 41368 |---------------------------------------------------
# echo $? 0
# perf sched map
*A0 456532.510141 secs A0 => migration/0:15
*. 456532.510171 secs . => swapper:0
. *B0 456532.510261 secs B0 => migration/1:21
. *. 456532.510279 secs
<SNIP>
L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 *L7 . . . . 456532.785979 secs
L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 *L7 . . . 456532.786054 secs
L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 *L7 . . 456532.786127 secs
L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 *L7 . 456532.786197 secs
L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 *L7 456532.786270 secs
# echo $?
0# perf sched replay run measurement overhead: 108 nsecs sleep measurement overhead: 66473 nsecs the run test took 1000002 nsecs the sleep test took 1082686 nsecs nr_run_events: 49334 nr_sleep_events: 50054 nr_wakeup_events: 34701 target-less wakeups: 165 multi-target wakeups: 766 task 0 ( swapper: 0), nr_events: 15419 task 1 ( swapper: 1), nr_events: 1 task 2 ( swapper: 2), nr_events: 1 <SNIP> task 715 ( sched-messaging: 110248), nr_events: 1438 task 716 ( sched-messaging: 110249), nr_events: 512 task 717 ( sched-messaging: 110250), nr_events: 500 task 718 ( sched-messaging: 110251), nr_events: 537 task 719 ( sched-messaging: 110252), nr_events: 823 ------------------------------------------------------------ #1 : 1325.288, ravg: 1325.29, cpu: 7823.35 / 7823.35 #2 : 1363.606, ravg: 1329.12, cpu: 7655.53 / 7806.56 #3 : 1349.494, ravg: 1331.16, cpu: 7544.80 / 7780.39 #4 : 1311.488, ravg: 1329.19, cpu: 7495.13 / 7751.86 #5 : 1309.902, ravg: 1327.26, cpu: 7266.65 / 7703.34 #6 : 1309.535, ravg: 1325.49, cpu: 7843.86 / 7717.39 #7 : 1316.482, ravg: 1324.59, cpu: 7854.41 / 7731.09 #8 : 1366.604, ravg: 1328.79, cpu: 7955.81 / 7753.57 #9 : 1326.286, ravg: 1328.54, cpu: 7466.86 / 7724.90 #10 : 1356.653, ravg: 1331.35, cpu: 7566.60 / 7709.07 # echo $? 0
Stable-dep-of: 1a5efc9e13f3 ("libsubcmd: Don't free the usage string")
--- tools/perf/builtin-sched.c | 94 +++++++++++++++++++++++++------------- 1 file changed, 61 insertions(+), 33 deletions(-)
tools/perf/builtin-sched.c +61 -33
@@ -3211,14 +3211,44 @@ static void perf_sched__merge_lat(struct perf_sched *sched) } } +static int setup_cpus_switch_event (struct perf_sched *sched) +{ +unsigned int i; + + sched->cpu_last_switched =calloc (MAX_CPUS ,sizeof (*(sched->cpu_last_switched))); +if (!sched->cpu_last_switched) +return -1 ; + + sched->curr_pid =malloc (MAX_CPUS *sizeof (*(sched->curr_pid))); +if (!sched->curr_pid) { +zfree (&sched->cpu_last_switched); +return -1 ; + } + +for (i =0 ; i <MAX_CPUS ; i++) + sched->curr_pid[i] =-1 ; + +return 0 ; +} + +static void free_cpus_switch_event (struct perf_sched *sched) +{ +zfree (&sched->curr_pid); +zfree (&sched->cpu_last_switched); +} +static int perf_sched__lat (struct perf_sched *sched) { +int rc =-1 ;struct rb_node *next;setup_pager (); +if (setup_cpus_switch_event (sched)) +return rc; +if (perf_sched__read_events (sched)) -return -1 ; + goto out_free_cpus_switch_event;perf_sched__merge_lat (sched);perf_sched__sort_lat (sched);
@@ -3247,7 +3277,11 @@ static int perf_sched__lat(struct perf_sched *sched)print_bad_events (sched);printf ("\n" ); -return 0 ; + rc =0 ; + +out_free_cpus_switch_event: +free_cpus_switch_event (sched); +return rc; }static int setup_map_cpus (struct perf_sched *sched)
@@ -3314,9 +3348,12 @@ static int perf_sched__map(struct perf_sched *sched)if (!sched->curr_thread)return rc; -if (setup_map_cpus (sched)) +if (setup_cpus_switch_event (sched)) goto out_free_curr_thread; +if (setup_map_cpus (sched)) + goto out_free_cpus_switch_event; +if (setup_color_pids (sched)) goto out_put_map_cpus;
@@ -3340,6 +3377,9 @@ static int perf_sched__map(struct perf_sched *sched)zfree (&sched->map.comp_cpus);perf_cpu_map__put (sched->map.cpus); +out_free_cpus_switch_event: +free_cpus_switch_event (sched); + out_free_curr_thread:zfree (&sched->curr_thread);return rc;
@@ -3353,6 +3393,10 @@ static int perf_sched__replay(struct perf_sched *sched)mutex_init (&sched->start_work_mutex);mutex_init (&sched->work_done_wait_mutex); + ret =setup_cpus_switch_event (sched); +if (ret) + goto out_mutex_destroy; +calibrate_run_measurement_overhead (sched);calibrate_sleep_measurement_overhead (sched);
@@ -3360,7 +3404,7 @@ static int perf_sched__replay(struct perf_sched *sched) ret =perf_sched__read_events (sched);if (ret) - goto out_mutex_destroy; + goto out_free_cpus_switch_event;printf ("nr_run_events: %ld\n" , sched->nr_run_events);printf ("nr_sleep_events: %ld\n" , sched->nr_sleep_events);
@@ -3386,6 +3430,9 @@ static int perf_sched__replay(struct perf_sched *sched) sched->thread_funcs_exit = true;destroy_tasks (sched); +out_free_cpus_switch_event: +free_cpus_switch_event (sched); + out_mutex_destroy:mutex_destroy (&sched->start_work_mutex);mutex_destroy (&sched->work_done_wait_mutex);
@@ -3624,21 +3671,7 @@ int cmd_sched(int argc, const char **argv) .switch_event = replay_switch_event, .fork_event = replay_fork_event, }; -unsigned int i; -int ret =0 ; - - sched.cpu_last_switched =calloc (MAX_CPUS ,sizeof (*sched.cpu_last_switched)); -if (!sched.cpu_last_switched) { - ret = -ENOMEM ; - goto out; - } - sched.curr_pid =malloc (MAX_CPUS *sizeof (*sched.curr_pid)); -if (!sched.curr_pid) { - ret = -ENOMEM ; - goto out; - } -for (i =0 ; i <MAX_CPUS ; i++) - sched.curr_pid[i] =-1 ; +int ret; argc =parse_options_subcommand (argc, argv, sched_options, sched_subcommands, sched_usage,PARSE_OPT_STOP_AT_NON_OPTION );
@@ -3649,9 +3682,9 @@ int cmd_sched(int argc, const char **argv)* Aliased to 'perf script' for now: */ if (!strcmp (argv[0 ],"script" )) { - ret =cmd_script (argc, argv); +return cmd_script (argc, argv); }else if (strlen (argv[0 ]) >2 &&strstarts ("record" , argv[0 ])) { - ret =__cmd_record (argc, argv); +return __cmd_record (argc, argv); }else if (strlen (argv[0 ]) >2 &&strstarts ("latency" , argv[0 ])) { sched.tp_handler = &lat_ops;if (argc >1 ) {
@@ -3660,7 +3693,7 @@ int cmd_sched(int argc, const char **argv)usage_with_options (latency_usage, latency_options); }setup_sorting (&sched, latency_options, latency_usage); - ret =perf_sched__lat (&sched); +return perf_sched__lat (&sched); }else if (!strcmp (argv[0 ],"map" )) {if (argc) { argc =parse_options (argc, argv, map_options, map_usage,0 );
@@ -3669,7 +3702,7 @@ int cmd_sched(int argc, const char **argv) } sched.tp_handler = &map_ops;setup_sorting (&sched, latency_options, latency_usage); - ret =perf_sched__map (&sched); +return perf_sched__map (&sched); }else if (strlen (argv[0 ]) >2 &&strstarts ("replay" , argv[0 ])) { sched.tp_handler = &replay_ops;if (argc) {
@@ -3677,7 +3710,7 @@ int cmd_sched(int argc, const char **argv)if (argc)usage_with_options (replay_usage, replay_options); } - ret =perf_sched__replay (&sched); +return perf_sched__replay (&sched); }else if (!strcmp (argv[0 ],"timehist" )) {if (argc) { argc = parse_options(argc, argv, timehist_options,
@@ -3693,21 +3726,16 @@ int cmd_sched(int argc, const char **argv)parse_options_usage (NULL , timehist_options,"w" , true);if (sched.show_next)parse_options_usage (NULL , timehist_options,"n" , true); - ret = -EINVAL ; - goto out; +return -EINVAL ; } ret =symbol__validate_sym_arguments ();if (ret) - goto out; +return ret; - ret =perf_sched__timehist (&sched); +return perf_sched__timehist (&sched); }else {usage_with_options (sched_usage, sched_options); } -out: -free (sched.curr_pid); -free (sched.cpu_last_switched); - -return ret; +return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 40/213 libsubcmd: Dont free the usage string
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aditya Gupta <[email protected]>
[ Upstream commit 1a5efc9e13f357abc396dbf445b25d08914c8060 ]
Currently, commands which depend on 'parse_options_subcommand()' don't show the usage string, and instead show '(null)'
$ ./perf sched Usage: (null)
-D, --dump-raw-trace dump raw trace in ASCII
-f, --force don't complain, do it
-i, --input <file> input file name
-v, --verbose be more verbose (show symbol address, etc)'parse_options_subcommand()' is generally expected to initialise the usage string, with information in the passed 'subcommands[]' array
This behaviour was changed in:
230a7a71f92212e7 ("libsubcmd: Fix parse-options memory leak")
Where the generated usage string is deallocated, and usage[0] string is reassigned as NULL.
As discussed in [1], free the allocated usage string in the main function itself, and don't reset usage string to NULL in parse_options_subcommand
With this change, the behaviour is restored.
$ ./perf sched
Usage: perf sched [<options>] {record|latency|map|replay|script|timehist} -D, --dump-raw-trace dump raw trace in ASCII
-f, --force don't complain, do it
-i, --input <file> input file name
-v, --verbose be more verbose (show symbol address, etc)--- tools/lib/subcmd/parse-options.c | 8 +++----- tools/perf/builtin-kmem.c | 2 ++ tools/perf/builtin-kvm.c | 3 +++ tools/perf/builtin-kwork.c | 3 +++ tools/perf/builtin-lock.c | 3 +++ tools/perf/builtin-mem.c | 3 +++ tools/perf/builtin-sched.c | 3 +++ 7 files changed, 20 insertions(+), 5 deletions(-)
tools/lib/subcmd/parse-options.c +3 -5
@@ -633,10 +633,11 @@ int parse_options_subcommand(int argc, const char **argv, const struct option *o const char *const subcommands[], const char *usagestr[], int flags) { struct parse_opt_ctx_t ctx; -char *buf =NULL ;/* build usage string if it's not provided */ if (subcommands && !usagestr[0 ]) { +char *buf =NULL ; +astrcatf (&buf,"%s %s [<options>] {" , subcmd_config.exec_name, argv[0 ]);for (int i =0 ; subcommands[i]; i++) {
@@ -678,10 +679,7 @@ int parse_options_subcommand(int argc, const char **argv, const struct option *oastrcatf (&error_buf,"unknown switch `%c'" , *ctx.opt);usage_with_options (usagestr, options); } -if (buf) { - usagestr[0 ] =NULL ; -free (buf); - } +return parse_options_end (&ctx); }
tools/perf/builtin-kmem.c +2 -0
@@ -2058,6 +2058,8 @@ int cmd_kmem(int argc, const char **argv) out_delete:perf_session__delete (session); +/* free usage string allocated by parse_options_subcommand */ +free ((void *)kmem_usage[0 ]);return ret; }
tools/perf/builtin-kvm.c +3 -0
@@ -2187,5 +2187,8 @@ int cmd_kvm(int argc, const char **argv)else usage_with_options (kvm_usage, kvm_options); +/* free usage string allocated by parse_options_subcommand */ +free ((void *)kvm_usage[0 ]); +return 0 ; }
tools/perf/builtin-kwork.c +3 -0
@@ -1853,5 +1853,8 @@ int cmd_kwork(int argc, const char **argv) }else usage_with_options (kwork_usage, kwork_options); +/* free usage string allocated by parse_options_subcommand */ +free ((void *)kwork_usage[0 ]); +return 0 ; }
tools/perf/builtin-lock.c +3 -0
@@ -2622,6 +2622,9 @@ int cmd_lock(int argc, const char **argv)usage_with_options (lock_usage, lock_options); } +/* free usage string allocated by parse_options_subcommand */ +free ((void *)lock_usage[0 ]); +zfree (&lockhash_table);return rc; }
tools/perf/builtin-mem.c +3 -0
@@ -518,5 +518,8 @@ int cmd_mem(int argc, const char **argv)else usage_with_options (mem_usage, mem_options); +/* free usage string allocated by parse_options_subcommand */ +free ((void *)mem_usage[0 ]); +return 0 ; }
tools/perf/builtin-sched.c +3 -0
@@ -3737,5 +3737,8 @@ int cmd_sched(int argc, const char **argv)usage_with_options (sched_usage, sched_options); } +/* free usage string allocated by parse_options_subcommand */ +free ((void *)sched_usage[0 ]); +return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 41/213 selftests: net: Remove executable bits from library scripts
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Poirier <[email protected]>
[ Upstream commit 9d851dd4dab63e95c1911a2fa847796d1ec5d58d ]
setup_loopback.sh and net_helper.sh are meant to be sourced from other scripts, not executed directly. Therefore, remove the executable bits from those files' permissions.
This change is similar to commit 49078c1b80b6 ("selftests: forwarding:
Remove executable bits from lib.sh")
--- tools/testing/selftests/net/setup_loopback.sh | 0 1 file changed, 0 insertions(+), 0 deletions(-) mode change 100755 => 100644 tools/testing/selftests/net/setup_loopback.sh
tools/testing/selftests/net/setup_loopback.sh +0 -0
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 42/213 selftests: Introduce Makefile variable to list shared bash scripts
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Poirier <[email protected]>
[ Upstream commit 2a0683be5b4c9829e8335e494a21d1148e832822 ]
Some tests written in bash source other files in a parent directory. For example, drivers/net/bonding/dev_addr_lists.sh sources net/forwarding/lib.sh. If a subset of tests is exported and run outside the source tree (for example by using make -C tools/testing/selftests gen_tar TARGETS="drivers/net/bonding"), these other files must be made available as well.
Commit ae108c48b5d2 ("selftests: net: Fix cross-tree inclusion of scripts") addressed this problem by symlinking and copying the sourced files but this only works for direct dependencies. Commit 25ae948b4478 ("selftests/net:
add lib.sh") changed net/forwarding/lib.sh to source net/lib.sh. As a result, that latter file must be included as well when the former is exported. This was not handled and was reverted in commit 2114e83381d3 ("selftests: forwarding: Avoid failures to source net/lib.sh"). In order to allow reinstating the inclusion of net/lib.sh from net/forwarding/lib.sh, add a mechanism to list dependent files in a new Makefile variable and export them. This allows sourcing those files using the same expression whether tests are run in-tree or exported.
Dependencies are not resolved recursively so transitive dependencies must be listed in TEST_INCLUDES. For example, if net/forwarding/lib.sh sources net/lib.sh; the Makefile related to a test that sources net/forwarding/lib.sh from a parent directory must list:
TEST_INCLUDES := \ ../../../net/forwarding/lib.sh \ ../../../net/lib.sh
v2:
Fix rst syntax in Documentation/dev-tools/kselftest.rst (Jakub Kicinski)
v1 (from RFC):
* changed TEST_INCLUDES to take relative paths, like other TEST_* variables (Vladimir Oltean)
* preserved common "$(MAKE) OUTPUT=... -C ... target" ordering in Makefile (Petr Machata)
--- Documentation/dev-tools/kselftest.rst | 12 ++++++++++++ tools/testing/selftests/Makefile | 7 ++++++- tools/testing/selftests/lib.mk | 19 +++++++++++++++++++ 3 files changed, 37 insertions(+), 1 deletion(-)
Documentation/dev-tools/kselftest.rst +12 -0
@@ -255,9 +255,21 @@ Contributing new tests (details) TEST_PROGS_EXTENDED, TEST_GEN_PROGS_EXTENDED mean it is the executable which is not tested by default. + TEST_FILES, TEST_GEN_FILES mean it is the file which is used by test. + TEST_INCLUDES is similar to TEST_FILES, it lists files which should be + included when exporting or installing the tests, with the following + differences: + + * symlinks to files in other directories are preserved + * the part of paths below tools/testing/selftests/ is preserved when + copying the files to the output directory + + TEST_INCLUDES is meant to list dependencies located in other directories of + the selftests hierarchy. + * First use the headers inside the kernel source and/or git repo, and then the system headers. Headers for the kernel release as opposed to headers installed by the distro on the system should be the primary focus to be able
tools/testing/selftests/Makefile +6 -1
@@ -184,6 +184,8 @@ run_tests: all @for TARGET in $(TARGETS); do \ BUILD_TARGET=$$BUILD/$$TARGET; \ $(MAKE) OUTPUT=$$BUILD_TARGET -C $$TARGET run_tests \ + SRC_PATH=$(shell readlink -e $$(pwd)) \ + OBJ_PATH=$(BUILD) \ O=$(abs_objtree); \ done;
@@ -234,7 +236,10 @@ ifdef INSTALL_PATH @ret=1; \ for TARGET in $(TARGETS); do \ BUILD_TARGET=$$BUILD/$$TARGET; \ - $(MAKE) OUTPUT=$$BUILD_TARGET -C $$TARGET INSTALL_PATH=$(INSTALL_PATH)/$$TARGET install \ + $(MAKE) OUTPUT=$$BUILD_TARGET -C $$TARGET install \ + INSTALL_PATH=$(INSTALL_PATH)/$$TARGET \ + SRC_PATH=$(shell readlink -e $$(pwd)) \ + OBJ_PATH=$(INSTALL_PATH) \ O=$(abs_objtree) \ $(if $(FORCE_TARGETS),|| exit); \ ret=$$((ret * $$?)); \
tools/testing/selftests/lib.mk +19 -0
@@ -77,11 +77,29 @@ define RUN_TESTS run_many $(1) endef +define INSTALL_INCLUDES + $(if $(TEST_INCLUDES), \ + relative_files=""; \ + for entry in $(TEST_INCLUDES); do \ + entry_dir=$$(readlink -e "$$(dirname "$$entry")"); \ + entry_name=$$(basename "$$entry"); \ + relative_dir=$${entry_dir#"$$SRC_PATH"/}; \ + if [ "$$relative_dir" = "$$entry_dir" ]; then \ + echo "Error: TEST_INCLUDES entry \"$$entry\" not located inside selftests directory ($$SRC_PATH)" >&2; \ + exit 1; \ + fi; \ + relative_files="$$relative_files $$relative_dir/$$entry_name"; \ + done; \ + cd $(SRC_PATH) && rsync -aR $$relative_files $(OBJ_PATH)/ \ + ) +endef + run_tests: all ifdef building_out_of_srctree @if [ "X$(TEST_PROGS)$(TEST_PROGS_EXTENDED)$(TEST_FILES)" != "X" ]; then \ rsync -aq --copy-unsafe-links $(TEST_PROGS) $(TEST_PROGS_EXTENDED) $(TEST_FILES) $(OUTPUT); \ fi + @$(INSTALL_INCLUDES) @if [ "X$(TEST_PROGS)" != "X" ]; then \ $(call RUN_TESTS, $(TEST_GEN_PROGS) $(TEST_CUSTOM_PROGS) \ $(addprefix $(OUTPUT)/,$(TEST_PROGS))) ; \
@@ -111,6 +129,7 @@ endef install: all ifdef INSTALL_PATH $(INSTALL_RULE) + $(INSTALL_INCLUDES) else $(error Error: set INSTALL_PATH to use install) endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 43/213 Bluetooth: Fix usage of __hci_cmd_sync_status
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 87be7b189b2c50d4b51512f59e4e97db4eedee8a ]
__hci_cmd_sync_status shall only be used if hci_req_sync_lock is _not_ required which is not the case of hci_dev_cmd so it needs to use hci_cmd_sync_status which uses hci_req_sync_lock internally.
--- net/bluetooth/hci_core.c | 27 ++++++++++++--------------- 1 file changed, 12 insertions(+), 15 deletions(-)
net/bluetooth/hci_core.c +12 -15
@@ -711,8 +711,8 @@ int hci_dev_cmd(unsigned int cmd, void __user *arg)switch (cmd) {case HCISETAUTH : - err =__hci_cmd_sync_status (hdev,HCI_OP_WRITE_AUTH_ENABLE , -1 , &dr.dev_opt,HCI_CMD_TIMEOUT ); + err =hci_cmd_sync_status (hdev,HCI_OP_WRITE_AUTH_ENABLE , +1 , &dr.dev_opt,HCI_CMD_TIMEOUT );break ;case HCISETENCRYPT :
@@ -723,23 +723,21 @@ int hci_dev_cmd(unsigned int cmd, void __user *arg)if (!test_bit (HCI_AUTH , &hdev->flags)) {/* Auth must be enabled first */ - err =__hci_cmd_sync_status (hdev, -HCI_OP_WRITE_AUTH_ENABLE , -1 , &dr.dev_opt, -HCI_CMD_TIMEOUT ); + err =hci_cmd_sync_status (hdev, +HCI_OP_WRITE_AUTH_ENABLE , +1 , &dr.dev_opt, +HCI_CMD_TIMEOUT );if (err)break ; } - err =__hci_cmd_sync_status (hdev,HCI_OP_WRITE_ENCRYPT_MODE , -1 , &dr.dev_opt, -HCI_CMD_TIMEOUT ); + err =hci_cmd_sync_status (hdev,HCI_OP_WRITE_ENCRYPT_MODE , +1 , &dr.dev_opt,HCI_CMD_TIMEOUT );break ;case HCISETSCAN : - err =__hci_cmd_sync_status (hdev,HCI_OP_WRITE_SCAN_ENABLE , -1 , &dr.dev_opt, -HCI_CMD_TIMEOUT ); + err =hci_cmd_sync_status (hdev,HCI_OP_WRITE_SCAN_ENABLE , +1 , &dr.dev_opt,HCI_CMD_TIMEOUT );/* Ensure that the connectable and discoverable states * get correctly modified as this was a non-mgmt change.
@@ -751,9 +749,8 @@ int hci_dev_cmd(unsigned int cmd, void __user *arg)case HCISETLINKPOL : policy =cpu_to_le16 (dr.dev_opt); - err =__hci_cmd_sync_status (hdev,HCI_OP_WRITE_DEF_LINK_POLICY , -2 , &policy, -HCI_CMD_TIMEOUT ); + err =hci_cmd_sync_status (hdev,HCI_OP_WRITE_DEF_LINK_POLICY , +2 , &policy,HCI_CMD_TIMEOUT );break ;case HCISETLINKMODE :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 44/213 jbd2: fix kernel-doc for j_transaction_overhead_buffers
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <[email protected]>
[ Upstream commit 7e8fb2eda9885ea2d13179a4c0bbf810f900ef25 ]
Use the correct struct member name in the kernel-doc notation to prevent a kernel-doc build warning.
include/linux/jbd2.h:1303: warning: Function parameter or struct member 'j_transaction_overhead_buffers' not described in 'journal_s' include/linux/jbd2.h:1303: warning: Excess struct member 'j_transaction_overhead' description in 'journal_s'
--- include/linux/jbd2.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/jbd2.h +1 -1
@@ -1084,7 +1084,7 @@ struct journal_sint j_revoke_records_per_block;/** -* @j_transaction_overhead: +* @j_transaction_overhead_buffers: * * Number of blocks each transaction needs for its own bookkeeping */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 45/213 lib/build_OID_registry: avoid non-destructive substitution for Perl < 5.13.2 compat
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Menzel <[email protected]>
[ Upstream commit 2fe29fe945637b9834c5569fbb1c9d4f881d8263 ]
On a system with Perl 5.12.1, commit 5ef6dc08cfde ("lib/build_OID_registry: don't mention the full path of the script in output") causes the build to fail with the error below.
Bareword found where operator expected at ./lib/build_OID_registry line 41, near "s#^\Q$abs_srctree/\E##r" syntax error at ./lib/build_OID_registry line 41, near "s#^\Q$abs_srctree/\E##r" Execution of ./lib/build_OID_registry aborted due to compilation errors.
make[3]: *** [lib/Makefile:352: lib/oid_registry_data.c] Error 255
Ahmad Fatoum analyzed that non-destructive substitution is only supported since Perl 5.13.2. Instead of dropping r and having the side effect of modifying $0, introduce a dedicated variable to support older Perl versions.
--- lib/build_OID_registry | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
lib/build_OID_registry +3 -1
@@ -38,7 +38,9 @@ close IN_FILE || die; # open C_FILE, ">$ARGV[1]" or die; print C_FILE "/*\n"; -print C_FILE " * Automatically generated by ", $0 =~ s#^\Q$abs_srctree/\E##r, ". Do not edit\n"; +my $scriptname = $0; +$scriptname =~ s#^\Q$abs_srctree/\E##; +print C_FILE " * Automatically generated by ", $scriptname, ". Do not edit\n"; print C_FILE " */\n"; #
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 46/213 drm/amd/display: Remove a redundant check in authenticated_dp
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenjing Liu <[email protected]>
[ Upstream commit 4b22869f76563ce1e10858d2ae3305affa8d4a6a ]
[WHY]mod_hdcp_execute_and_set returns (*status == MOD_HDCP_STATUS_SUCCESS). When it return 0, it is guaranteed that status == MOD_HDCP_STATUS_SUCCESS will be evaluated as false. Since now we are using goto out already, all 3 if (status == MOD_HDCP_STATUS_SUCCESS) clauses are guaranteed to enter. Therefore we are removing the if statements due to redundancy.
Stable-dep-of: bc2fe69f16c7 ("drm/amd/display: Revert "Check HDCP returned status"")
--- .../display/modules/hdcp/hdcp1_execution.c | 27 +++++++++---------- 1 file changed, 12 insertions(+), 15 deletions(-)
drivers/gpu/drm/amd/display/modules/hdcp/hdcp1_execution.c +12 -15
@@ -432,21 +432,18 @@ static enum mod_hdcp_status authenticated_dp(struct mod_hdcp *hdcp, goto out; } -if (status ==MOD_HDCP_STATUS_SUCCESS ) -if (!mod_hdcp_execute_and_set (mod_hdcp_read_bstatus, - &input->bstatus_read, &status, - hdcp,"bstatus_read" )) - goto out; -if (status ==MOD_HDCP_STATUS_SUCCESS ) -if (!mod_hdcp_execute_and_set (check_link_integrity_dp, - &input->link_integrity_check, &status, - hdcp,"link_integrity_check" )) - goto out; -if (status ==MOD_HDCP_STATUS_SUCCESS ) -if (!mod_hdcp_execute_and_set (check_no_reauthentication_request_dp, - &input->reauth_request_check, &status, - hdcp,"reauth_request_check" )) - goto out; +if (!mod_hdcp_execute_and_set (mod_hdcp_read_bstatus, + &input->bstatus_read, &status, + hdcp,"bstatus_read" )) + goto out; +if (!mod_hdcp_execute_and_set (check_link_integrity_dp, + &input->link_integrity_check, &status, + hdcp,"link_integrity_check" )) + goto out; +if (!mod_hdcp_execute_and_set (check_no_reauthentication_request_dp, + &input->reauth_request_check, &status, + hdcp,"reauth_request_check" )) + goto out; out:return status; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 47/213 drm/amd/display: Revert "Check HDCP returned status"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit bc2fe69f16c7122b5dabc294aa2d6065d8da2169 ]
This reverts commit 5d93060d430b359e16e7c555c8f151ead1ac614b due to a power consumption regression.
--- .../amd/display/modules/hdcp/hdcp1_execution.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/gpu/drm/amd/display/modules/hdcp/hdcp1_execution.c +9 -9
@@ -432,18 +432,18 @@ static enum mod_hdcp_status authenticated_dp(struct mod_hdcp *hdcp, goto out; } -if (!mod_hdcp_execute_and_set (mod_hdcp_read_bstatus, +mod_hdcp_execute_and_set (mod_hdcp_read_bstatus, &input->bstatus_read, &status, - hdcp,"bstatus_read" )) - goto out; -if (!mod_hdcp_execute_and_set (check_link_integrity_dp, + hdcp,"bstatus_read" ); + +mod_hdcp_execute_and_set (check_link_integrity_dp, &input->link_integrity_check, &status, - hdcp,"link_integrity_check" )) - goto out; -if (!mod_hdcp_execute_and_set (check_no_reauthentication_request_dp, + hdcp,"link_integrity_check" ); + +mod_hdcp_execute_and_set (check_no_reauthentication_request_dp, &input->reauth_request_check, &status, - hdcp,"reauth_request_check" )) - goto out; + hdcp,"reauth_request_check" ); + out:return status; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 48/213 fs/ntfs3: Do not call file_modified if collapse range failed
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <[email protected]>
[ Upstream commit 2db86f7995fe6b62a4d6fee9f3cdeba3c6d27606 ]
--- fs/ntfs3/file.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/ntfs3/file.c +3 -1
@@ -418,7 +418,7 @@ static int ntfs_truncate(struct inode *inode, loff_t new_size) }/* -* ntfs_fallocate +* ntfs_fallocate - file_operations::ntfs_fallocate * * Preallocate space for a file. This implements ntfs's fallocate file * operation, which gets called from sys_fallocate system call. User
@@ -553,6 +553,8 @@ static long ntfs_fallocate(struct file *file, int mode, loff_t vbo, loff_t len)ni_lock (ni); err =attr_collapse_range (ni, vbo, len);ni_unlock (ni); +if (err) + goto out; }else if (mode &FALLOC_FL_INSERT_RANGE ) {/* Check new size. */ err =inode_newsize_ok (inode, new_size);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 49/213 fs/ntfs3: Fix sparse warning in ni_fiemap
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <[email protected]>
[ Upstream commit 62fea783f96ce825f0ac9e40ce9530ddc1ea2a29 ]
The interface of fiemap_fill_next_extent_k() was modified to eliminate the sparse warning.
--- fs/ntfs3/frecord.c | 21 ++++++++------------- 1 file changed, 8 insertions(+), 13 deletions(-)
fs/ntfs3/frecord.c +8 -13
@@ -1900,13 +1900,13 @@ enum REPARSE_SIGN ni_parse_reparse(struct ntfs_inode *ni, struct ATTRIB *attr,/* * fiemap_fill_next_extent_k - a copy of fiemap_fill_next_extent -* but it accepts kernel address for fi_extents_start +* but it uses 'fe_k' instead of fieinfo->fi_extents_start */ static int fiemap_fill_next_extent_k (struct fiemap_extent_info *fieinfo, -u64 logical,u64 phys,u64 len,u32 flags) +struct fiemap_extent *fe_k,u64 logical, +u64 phys,u64 len,u32 flags) {struct fiemap_extent extent; -struct fiemap_extent __user *dest = fieinfo->fi_extents_start;/* only count the extents */ if (fieinfo->fi_extents_max ==0 ) {
@@ -1930,8 +1930,7 @@ static int fiemap_fill_next_extent_k(struct fiemap_extent_info *fieinfo, extent.fe_length = len; extent.fe_flags = flags; - dest += fieinfo->fi_extents_mapped; -memcpy (dest, &extent,sizeof (extent)); +memcpy (fe_k + fieinfo->fi_extents_mapped, &extent,sizeof (extent)); fieinfo->fi_extents_mapped++;if (fieinfo->fi_extents_mapped == fieinfo->fi_extents_max)
@@ -1949,7 +1948,6 @@ int ni_fiemap(struct ntfs_inode *ni, struct fiemap_extent_info *fieinfo, __u64 vbo, __u64 len) { int err = 0; -struct fiemap_extent __user *fe_u = fieinfo->fi_extents_start;struct fiemap_extent *fe_k =NULL ;struct ntfs_sb_info *sbi = ni->mi.sbi;u8 cluster_bits = sbi->cluster_bits;
@@ -2008,7 +2006,6 @@ int ni_fiemap(struct ntfs_inode *ni, struct fiemap_extent_info *fieinfo, err = -ENOMEM ; goto out; } - fieinfo->fi_extents_start = fe_k; end = vbo + len; alloc_size =le64_to_cpu (attr->nres.alloc_size);
@@ -2098,8 +2095,8 @@ int ni_fiemap(struct ntfs_inode *ni, struct fiemap_extent_info *fieinfo,if (vbo + dlen >= end) flags |=FIEMAP_EXTENT_LAST ; - err =fiemap_fill_next_extent_k (fieinfo, vbo, lbo, dlen, - flags); + err =fiemap_fill_next_extent_k (fieinfo, fe_k, vbo, lbo, + dlen, flags);if (err <0 )break ;
@@ -2120,7 +2117,7 @@ int ni_fiemap(struct ntfs_inode *ni, struct fiemap_extent_info *fieinfo,if (vbo + bytes >= end) flags |=FIEMAP_EXTENT_LAST ; - err =fiemap_fill_next_extent_k (fieinfo, vbo, lbo, bytes, + err =fiemap_fill_next_extent_k (fieinfo, fe_k, vbo, lbo, bytes, flags);if (err <0 )break ;
@@ -2137,15 +2134,13 @@ int ni_fiemap(struct ntfs_inode *ni, struct fiemap_extent_info *fieinfo,/* * Copy to user memory out of lock */ -if (copy_to_user (fe_u, fe_k, +if (copy_to_user (fieinfo->fi_extents_start, fe_k, fieinfo->fi_extents_max *sizeof (struct fiemap_extent ))) { err = -EFAULT ; } out: -/* Restore original pointer. */ - fieinfo->fi_extents_start = fe_u;kfree (fe_k);return err; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 50/213 fs/ntfs3: Refactor enum_rstbl to suppress static checker
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <[email protected]>
[ Upstream commit 56c16d5459d5c050a97a138a00a82b105a8e0a66 ]
Comments and brief description of function enum_rstbl added.
--- fs/ntfs3/fslog.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-)
fs/ntfs3/fslog.c +17 -2
@@ -609,14 +609,29 @@ static inline void add_client(struct CLIENT_REC *ca, u16 index, __le16 *head) *head =cpu_to_le16 (index); } +/* +* Enumerate restart table. +* +* @t - table to enumerate. +* @c - current enumerated element. +* +* enumeration starts with @c == NULL +* returns next element or NULL +*/ static inline void *enum_rstbl (struct RESTART_TABLE *t,void *c) {__le32 *e;u32 bprt; -u16 rsize = t ?le16_to_cpu (t->size) :0 ; +u16 rsize; + +if (!t) +return NULL ; + + rsize =le16_to_cpu (t->size);if (!c) { -if (!t || !t->total) +/* start enumeration. */ +if (!t->total)return NULL ; e =Add2Ptr (t,sizeof (struct RESTART_TABLE )); }else {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 51/213 virtio_console: fix misc probe bugs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael S. Tsirkin <[email protected]>
[ Upstream commit b9efbe2b8f0177fa97bfab290d60858900aa196b ]
This fixes the following issue discovered by code review:
after vqs have been created, a buggy device can send an interrupt.
A control vq callback will then try to schedule control_work which has not been initialized yet. Similarly for config interrupt. Further, in and out vq callbacks invoke find_port_by_vq which attempts to take ports_lock which also has not been initialized.
To fix, init all locks and work before creating vqs.
Message-ID: <ad982e975a6160ad110c623c016041311ca15b4f.1726511547.git.mst@redhat.com>
--- drivers/char/virtio_console.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-)
drivers/char/virtio_console.c +10 -8
@@ -2052,25 +2052,27 @@ static int virtcons_probe(struct virtio_device *vdev) multiport = true; } - err =init_vqs (portdev); -if (err <0 ) { -dev_err (&vdev->dev,"Error %d initializing vqs\n" , err); - goto free_chrdev; - } -spin_lock_init (&portdev->ports_lock);INIT_LIST_HEAD (&portdev->ports);INIT_LIST_HEAD (&portdev->list); -virtio_device_ready (portdev->vdev); -INIT_WORK (&portdev->config_work, &config_work_handler);INIT_WORK (&portdev->control_work, &control_work_handler);if (multiport) {spin_lock_init (&portdev->c_ivq_lock);spin_lock_init (&portdev->c_ovq_lock); + } + err =init_vqs (portdev); +if (err <0 ) { +dev_err (&vdev->dev,"Error %d initializing vqs\n" , err); + goto free_chrdev; + } + +virtio_device_ready (portdev->vdev); + +if (multiport) { err =fill_queue (portdev->c_ivq, &portdev->c_ivq_lock);if (err <0 ) { dev_err(&vdev->dev,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 52/213 ntfs3: Change to non-blocking allocation in ntfs_d_hash
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Diogo Jahchan Koike <[email protected]>
[ Upstream commit 589996bf8c459deb5bbc9747d8f1c51658608103 ]
d_hash is done while under "rcu-walk" and should not sleep. __get_name() allocates using GFP_KERNEL, having the possibility to sleep when under memory pressure. Change the allocation to GFP_NOWAIT.
--- fs/ntfs3/namei.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/ntfs3/namei.c +2 -2
@@ -501,7 +501,7 @@ static int ntfs_d_hash(const struct dentry *dentry, struct qstr *name)/* * Try slow way with current upcase table */ - uni =__getname (); + uni =kmem_cache_alloc (names_cachep,GFP_NOWAIT );if (!uni)return -ENOMEM ;
@@ -523,7 +523,7 @@ static int ntfs_d_hash(const struct dentry *dentry, struct qstr *name) err =0 ; out: -__putname (uni); +kmem_cache_free (names_cachep, uni);return err; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 53/213 zram: free secondary algorithms names
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Senozhatsky <[email protected]>
[ Upstream commit 684826f8271ad97580b138b9ffd462005e470b99 ]
We need to kfree() secondary algorithms names when reset zram device that had multi-streams, otherwise we leak memory.
--- drivers/block/zram/zram_drv.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/block/zram/zram_drv.c +5 -0
@@ -1983,6 +1983,11 @@ static void zram_destroy_comps(struct zram *zram)zcomp_destroy (comp); zram->num_active_comps--; } + +for (prio =ZRAM_SECONDARY_COMP ; prio <ZRAM_MAX_COMPS ; prio++) { +kfree (zram->comp_algs[prio]); + zram->comp_algs[prio] =NULL ; + } }static void zram_reset_device (struct zram *zram)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 54/213 zram: dont free statically defined names
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Skvortsov <[email protected]>
[ Upstream commit 486fd58af7ac1098b68370b1d4d9f94a2a1c7124 ]
When CONFIG_ZRAM_MULTI_COMP isn't set ZRAM_SECONDARY_COMP can hold default_compressor, because it's the same offset as ZRAM_PRIMARY_COMP, so we need to make sure that we don't attempt to kfree() the statically defined compressor name.
This is detected by KASAN.
==================================================================
Call trace: kfree+0x60/0x3a0 zram_destroy_comps+0x98/0x198 [zram] zram_reset_device+0x22c/0x4a8 [zram] reset_store+0x1bc/0x2d8 [zram] dev_attr_store+0x44/0x80 sysfs_kf_write+0xfc/0x188 kernfs_fop_write_iter+0x28c/0x428 vfs_write+0x4dc/0x9b8 ksys_write+0x100/0x1f8 __arm64_sys_write+0x74/0xb8 invoke_syscall+0xd8/0x260 el0_svc_common.constprop.0+0xb4/0x240 do_el0_svc+0x48/0x68 el0_svc+0x40/0xc8 el0t_64_sync_handler+0x120/0x130 el0t_64_sync+0x190/0x198 ==================================================================
--- drivers/block/zram/zram_drv.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/block/zram/zram_drv.c +4 -2
@@ -1984,8 +1984,10 @@ static void zram_destroy_comps(struct zram *zram) zram->num_active_comps--; } -for (prio =ZRAM_SECONDARY_COMP ; prio <ZRAM_MAX_COMPS ; prio++) { -kfree (zram->comp_algs[prio]); +for (prio =ZRAM_PRIMARY_COMP ; prio <ZRAM_MAX_COMPS ; prio++) { +/* Do not free statically defined compression algorithms */ +if (zram->comp_algs[prio] != default_compressor) +kfree (zram->comp_algs[prio]); zram->comp_algs[prio] =NULL ; } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 55/213 Input: synaptics-rmi4 - fix UAF of IRQ domain on driver removal
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Krause <[email protected]>
commit fbf8d71742557abaf558d8efb96742d442720cc2 upstream.
Calling irq_domain_remove() will lead to freeing the IRQ domain prematurely. The domain is still referenced and will be attempted to get used via rmi_free_function_list() -> rmi_unregister_function() -> irq_dispose_mapping() -> irq_get_irq_data()'s ->domain pointer.
With PaX's MEMORY_SANITIZE this will lead to an access fault when attempting to dereference embedded pointers, as in Torsten's report that was faulting on the 'domain->ops->unmap' test.
Fix this by releasing the IRQ domain only after all related IRQs have been deactivated.
--- drivers/input/rmi4/rmi_driver.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/input/rmi4/rmi_driver.c +3 -3
@@ -978,12 +978,12 @@ static int rmi_driver_remove(struct device *dev)rmi_disable_irq (rmi_dev, false); -irq_domain_remove (data->irqdomain); - data->irqdomain =NULL ; -rmi_f34_remove_sysfs (rmi_dev);rmi_free_function_list (rmi_dev); +irq_domain_remove (data->irqdomain); + data->irqdomain =NULL ; +return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 56/213 selftests/bpf: Fix ARG_PTR_TO_LONG {half-,}uninitialized test
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
[ Upstream commit b8e188f023e07a733b47d5865311ade51878fe40 ]
The assumption of 'in privileged mode reads from uninitialized stack locations are permitted' is not quite correct since the verifier was probing for read access rather than write access. Both tests need to be annotated as __success for privileged and unprivileged.
--- tools/testing/selftests/bpf/progs/verifier_int_ptr.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
tools/testing/selftests/bpf/progs/verifier_int_ptr.c +1 -4
@@ -8,7 +8,6 @@ SEC("socket") __description("ARG_PTR_TO_LONG uninitialized") __success -__failure_unpriv __msg_unpriv("invalid indirect read from stack R4 off -16+0 size 8")__naked void arg_ptr_to_long_uninitialized (void ) { asm volatile (" \
@@ -36,9 +35,7 @@ __naked void arg_ptr_to_long_uninitialized(void) SEC("socket") __description("ARG_PTR_TO_LONG half-uninitialized") -/* in privileged mode reads from uninitialized stack locations are permitted */ -__success __failure_unpriv -__msg_unpriv("invalid indirect read from stack R4 off -16+4 size 8") +__success __retval(0) __naked void ptr_to_long_half_uninitialized(void) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 57/213 bpf: Check percpu map value size first
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tao Chen <[email protected]>
[ Upstream commit 1d244784be6b01162b732a5a7d637dfc024c3203 ]
Percpu map is often used, but the map value size limit often ignored, like issue: https://github.com/iovisor/bcc/issues/2519. Actually, percpu map value size is bound by PCPU_MIN_UNIT_SIZE, so we can check the value size whether it exceeds PCPU_MIN_UNIT_SIZE first, like percpu map of local_storage. Maybe the error message seems clearer compared with "cannot allocate memory".
--- kernel/bpf/arraymap.c | 3 +++ kernel/bpf/hashtab.c | 3 +++ 2 files changed, 6 insertions(+)
kernel/bpf/arraymap.c +3 -0
@@ -73,6 +73,9 @@ int array_map_alloc_check(union bpf_attr *attr)/* avoid overflow on round_up(map->value_size) */ if (attr->value_size >INT_MAX )return -E2BIG ; +/* percpu map value size is bound by PCPU_MIN_UNIT_SIZE */ +if (percpu &&round_up (attr->value_size,8 ) >PCPU_MIN_UNIT_SIZE ) +return -E2BIG ;return 0 ; }
kernel/bpf/hashtab.c +3 -0
@@ -458,6 +458,9 @@ static int htab_map_alloc_check(union bpf_attr *attr)* kmalloc-able later in htab_map_update_elem() */ return -E2BIG ; +/* percpu map value size is bound by PCPU_MIN_UNIT_SIZE */ +if (percpu &&round_up (attr->value_size,8 ) >PCPU_MIN_UNIT_SIZE ) +return -E2BIG ;return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 58/213 s390/boot: Compile all files with the same march flag
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <[email protected]>
[ Upstream commit fccb175bc89a0d37e3ff513bb6bf1f73b3a48950 ]
Only a couple of files of the decompressor are compiled with the minimum architecture level. This is problematic for potential function calls between compile units, especially if a target function is within a compile until compiled for a higher architecture level, since that may lead to an unexpected operation exception.
Therefore compile all files of the decompressor for the same (minimum) architecture level.
--- arch/s390/boot/Makefile | 19 +++++-------------- 1 file changed, 5 insertions(+), 14 deletions(-)
arch/s390/boot/Makefile +5 -14
@@ -9,11 +9,8 @@ UBSAN_SANITIZE := n KASAN_SANITIZE := n KCSAN_SANITIZE := n -KBUILD_AFLAGS := $(KBUILD_AFLAGS_DECOMPRESSOR) -KBUILD_CFLAGS := $(KBUILD_CFLAGS_DECOMPRESSOR) - # -# Use minimum architecture for als.c to be able to print an error +# Use minimum architecture level so it is possible to print an error # message if the kernel is started on a machine which is too old # ifndef CONFIG_CC_IS_CLANG
@@ -22,16 +19,10 @@ else CC_FLAGS_MARCH_MINIMUM := -march=z10 endif -ifneq ($(CC_FLAGS_MARCH),$(CC_FLAGS_MARCH_MINIMUM)) -AFLAGS_REMOVE_head.o += $(CC_FLAGS_MARCH) -AFLAGS_head.o += $(CC_FLAGS_MARCH_MINIMUM) -AFLAGS_REMOVE_mem.o += $(CC_FLAGS_MARCH) -AFLAGS_mem.o += $(CC_FLAGS_MARCH_MINIMUM) -CFLAGS_REMOVE_als.o += $(CC_FLAGS_MARCH) -CFLAGS_als.o += $(CC_FLAGS_MARCH_MINIMUM) -CFLAGS_REMOVE_sclp_early_core.o += $(CC_FLAGS_MARCH) -CFLAGS_sclp_early_core.o += $(CC_FLAGS_MARCH_MINIMUM) -endif +KBUILD_AFLAGS := $(filter-out $(CC_FLAGS_MARCH),$(KBUILD_AFLAGS_DECOMPRESSOR)) +KBUILD_CFLAGS := $(filter-out $(CC_FLAGS_MARCH),$(KBUILD_CFLAGS_DECOMPRESSOR)) +KBUILD_AFLAGS += $(CC_FLAGS_MARCH_MINIMUM) +KBUILD_CFLAGS += $(CC_FLAGS_MARCH_MINIMUM) CFLAGS_sclp_early_core.o += -I$(srctree)/drivers/s390/char
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 59/213 s390/facility: Disable compile time optimization for decompressor code
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <[email protected]>
[ Upstream commit 0147addc4fb72a39448b8873d8acdf3a0f29aa65 ]
Disable compile time optimizations of test_facility() for the decompressor. The decompressor should not contain any optimized code depending on the architecture level set the kernel image is compiled for to avoid unexpected operation exceptions.
Add a __DECOMPRESSOR check to test_facility() to enforce that facilities are always checked during runtime for the decompressor.
--- arch/s390/include/asm/facility.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
arch/s390/include/asm/facility.h +4 -2
@@ -60,8 +60,10 @@ static inline int test_facility(unsigned long nr)unsigned long facilities_als[] = {FACILITIES_ALS };if (__builtin_constant_p (nr) && nr <sizeof (facilities_als) *8 ) { -if (__test_facility (nr, &facilities_als)) -return 1 ; +if (__test_facility (nr, &facilities_als)) { +if (!__is_defined (__DECOMPRESSOR)) +return 1 ; + } }return __test_facility (nr, &stfle_fac_list); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 60/213 s390/mm: Add cond_resched() to cmm_alloc/free_pages()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gerald Schaefer <[email protected]>
[ Upstream commit 131b8db78558120f58c5dc745ea9655f6b854162 ]
Adding/removing large amount of pages at once to/from the CMM balloon can result in rcu_sched stalls or workqueue lockups, because of busy looping w/o cond_resched().
Prevent this by adding a cond_resched(). cmm_free_pages() holds a spin_lock while looping, so it cannot be added directly to the existing loop. Instead, introduce a wrapper function that operates on maximum 256 pages at once, and add it there.
--- arch/s390/mm/cmm.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-)
arch/s390/mm/cmm.c +17 -1
@@ -95,11 +95,12 @@ static long cmm_alloc_pages(long nr, long *counter, (*counter)++;spin_unlock (&cmm_lock); nr--; +cond_resched (); }return nr; } -static long cmm_free_pages (long nr,long *counter,struct cmm_page_array **list) +static long __cmm_free_pages (long nr,long *counter,struct cmm_page_array **list) {struct cmm_page_array *pa;unsigned long addr;
@@ -123,6 +124,21 @@ static long cmm_free_pages(long nr, long *counter, struct cmm_page_array **list)return nr; } +static long cmm_free_pages (long nr,long *counter,struct cmm_page_array **list) +{ +long inc =0 ; + +while (nr) { + inc =min (256L , nr); + nr -= inc; + inc =__cmm_free_pages (inc, counter, list); +if (inc) +break ; +cond_resched (); + } +return nr + inc; +} +static int cmm_oom_notify (struct notifier_block *self,unsigned long dummy,void *parm) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 61/213 bpf, x64: Fix a jit convergence issue
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yonghong Song <[email protected]>
[ Upstream commit c8831bdbfbab672c006a18006d36932a494b2fd6 ]
Daniel Hodges reported a jit error when playing with a sched-ext program. The error message is:
unexpected jmp_cond padding: -4 bytes
But further investigation shows the error is actual due to failed convergence. The following are some analysis:
...
pass4, final_proglen=4391:
...
20e: 48 85 ff test rdi,rdi
211: 74 7d je 0x290
213: 48 8b 77 00 mov rsi,QWORD PTR [rdi+0x0]
...
289: 48 85 ff test rdi,rdi
28c: 74 17 je 0x2a5
28e: e9 7f ff ff ff jmp 0x212
293: bf 03 00 00 00 mov edi,0x3Note that insn at 0x211 is 2-byte cond jump insn for offset 0x7d (-125) and insn at 0x28e is 5-byte jmp insn with offset -129.
pass5, final_proglen=4392:
...
20e: 48 85 ff test rdi,rdi
211: 0f 84 80 00 00 00 je 0x297
217: 48 8b 77 00 mov rsi,QWORD PTR [rdi+0x0]
...
28d: 48 85 ff test rdi,rdi
290: 74 1a je 0x2ac
292: eb 84 jmp 0x218
294: bf 03 00 00 00 mov edi,0x3Note that insn at 0x211 is 6-byte cond jump insn now since its offset becomes 0x80 based on previous round (0x293 - 0x213 = 0x80). At the same time, insn at 0x292 is a 2-byte insn since its offset is -124.
pass6 will repeat the same code as in pass4. pass7 will repeat the same code as in pass5, and so on. This will prevent eventual convergence.
Passes 1-14 are with padding = 0. At pass15, padding is 1 and related insn looks like:
211: 0f 84 80 00 00 00 je 0x297
217: 48 8b 77 00 mov rsi,QWORD PTR [rdi+0x0] ...
24d: 48 85 d2 test rdx,rdx
The similar code in pass14:
211: 74 7d je 0x290
213: 48 8b 77 00 mov rsi,QWORD PTR [rdi+0x0]
...
249: 48 85 d2 test rdx,rdx
24c: 74 21 je 0x26f
24e: 48 01 f7 add rdi,rsi
...Before generating the following insn,
250: 74 21 je 0x273
"padding = 1" enables some checking to ensure nops is either 0 or 4 where
#define INSN_SZ_DIFF (((addrs[i] - addrs[i - 1]) - (prog - temp))) nops = INSN_SZ_DIFF - 2
In this specific case,
addrs[i] = 0x24e // from pass14 addrs[i-1] = 0x24d // from pass15
prog - temp = 3 // from 'test rdx,rdx' in pass15
so
nops = -4
and this triggers the failure.
To fix the issue, we need to break cycles of je <-> jmp. For example, in the above case, we have
211: 74 7d je 0x290
the offset is 0x7d. If 2-byte je insn is generated only if the offset is less than 0x7d (<= 0x7c), the cycle can be break and we can achieve the convergence.
I did some study on other cases like je <-> je, jmp <-> je and jmp <-> jmp which may cause cycles. Those cases are not from actual reproducible cases since it is pretty hard to construct a test case for them. the results show that the offset <= 0x7b (0x7b = 123) should be enough to cover all cases. This patch added a new helper to generate 8-bit cond/uncond jmp insns only if the offset range is [-128, 123].
--- arch/x86/net/bpf_jit_comp.c | 54 +++++++++++++++++++++++++++++++++++-- 1 file changed, 52 insertions(+), 2 deletions(-)
arch/x86/net/bpf_jit_comp.c +52 -2
@@ -58,6 +58,56 @@ static bool is_imm8(int value)return value <=127 && value >=-128 ; } +/* +* Let us limit the positive offset to be <= 123. +* This is to ensure eventual jit convergence For the following patterns: +* ... +* pass4, final_proglen=4391: +* ... +* 20e: 48 85 ff test rdi,rdi +* 211: 74 7d je 0x290 +* 213: 48 8b 77 00 mov rsi,QWORD PTR [rdi+0x0] +* ... +* 289: 48 85 ff test rdi,rdi +* 28c: 74 17 je 0x2a5 +* 28e: e9 7f ff ff ff jmp 0x212 +* 293: bf 03 00 00 00 mov edi,0x3 +* Note that insn at 0x211 is 2-byte cond jump insn for offset 0x7d (-125) +* and insn at 0x28e is 5-byte jmp insn with offset -129. +* +* pass5, final_proglen=4392: +* ... +* 20e: 48 85 ff test rdi,rdi +* 211: 0f 84 80 00 00 00 je 0x297 +* 217: 48 8b 77 00 mov rsi,QWORD PTR [rdi+0x0] +* ... +* 28d: 48 85 ff test rdi,rdi +* 290: 74 1a je 0x2ac +* 292: eb 84 jmp 0x218 +* 294: bf 03 00 00 00 mov edi,0x3 +* Note that insn at 0x211 is 6-byte cond jump insn now since its offset +* becomes 0x80 based on previous round (0x293 - 0x213 = 0x80). +* At the same time, insn at 0x292 is a 2-byte insn since its offset is +* -124. +* +* pass6 will repeat the same code as in pass4 and this will prevent +* eventual convergence. +* +* To fix this issue, we need to break je (2->6 bytes) <-> jmp (5->2 bytes) +* cycle in the above. In the above example je offset <= 0x7c should work. +* +* For other cases, je <-> je needs offset <= 0x7b to avoid no convergence +* issue. For jmp <-> je and jmp <-> jmp cases, jmp offset <= 0x7c should +* avoid no convergence issue. +* +* Overall, let us limit the positive offset for 8bit cond/uncond jmp insn +* to maximum 123 (0x7b). This way, the jit pass can eventually converge. +*/ +static bool is_imm8_jmp_offset (int value) +{ +return value <=123 && value >=-128 ; +} +static bool is_simm32 (s64 value) {return value == (s64 )(s32 )value;
@@ -1774,7 +1824,7 @@ st: if (is_imm8(insn->off))return -EFAULT ; } jmp_offset = addrs[i + insn->off] - addrs[i]; -if (is_imm8 (jmp_offset)) { +if (is_imm8_jmp_offset (jmp_offset)) {if (jmp_padding) {/* To keep the jmp_offset valid, the extra bytes are * padded before the jump insn, so we subtract the
@@ -1856,7 +1906,7 @@ st: if (is_imm8(insn->off))break ; } emit_jmp: -if (is_imm8 (jmp_offset)) { +if (is_imm8_jmp_offset (jmp_offset)) {if (jmp_padding) {/* To avoid breaking jmp_offset, the extra bytes * are padded before the actual jmp insn, so
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 62/213 ext4: dont set SB_RDONLY after filesystem errors
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
[ Upstream commit d3476f3dad4ad68ae5f6b008ea6591d1520da5d8 ]
When the filesystem is mounted with errors=remount-ro, we were setting SB_RDONLY flag to stop all filesystem modifications. We knew this misses proper locking (sb->s_umount) and does not go through proper filesystem remount procedure but it has been the way this worked since early ext2 days and it was good enough for catastrophic situation damage mitigation. Recently, syzbot has found a way (see link) to trigger warnings in filesystem freezing because the code got confused by SB_RDONLY changing under its hands. Since these days we set EXT4_FLAGS_SHUTDOWN on the superblock which is enough to stop all filesystem modifications, modifying SB_RDONLY shouldn't be needed. So stop doing that.
--- fs/ext4/super.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
fs/ext4/super.c +5 -4
@@ -744,11 +744,12 @@ static void ext4_handle_error(struct super_block *sb, bool force_ro, int error,ext4_msg (sb,KERN_CRIT ,"Remounting filesystem read-only" );/* -* Make sure updated value of ->s_mount_flags will be visible before -* ->s_flags update +* EXT4_FLAGS_SHUTDOWN was set which stops all filesystem +* modifications. We don't set SB_RDONLY because that requires +* sb->s_umount semaphore and setting it without proper remount +* procedure is confusing code such as freeze_super() leading to +* deadlocks and other problems. */ -smp_wmb (); - sb->s_flags |=SB_RDONLY ; }static void update_super_work (struct work_struct *work)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 63/213 ext4: nested locking for xattr inode
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wojciech Gładysz <[email protected]>
[ Upstream commit d1bc560e9a9c78d0b2314692847fc8661e0aeb99 ]
Add nested locking with I_MUTEX_XATTR subclass to avoid lockdep warning while handling xattr inode on file open syscall at ext4_xattr_inode_iget.
Backtrace
EXT4-fs (loop0): Ignoring removed oldalloc option
======================================================
WARNING: possible circular locking dependency detected
5.10.0-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor543/2794 is trying to acquire lock:ffff8880215e1a48 (&ea_inode->i_rwsem#7/1){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:782 [inline] ffff8880215e1a48 (&ea_inode->i_rwsem#7/1){+.+.}-{3:3}, at: ext4_xattr_inode_iget+0x42a/0x5c0 fs/ext4/xattr.c:425
but task is already holding lock:ffff8880215e3278 (&ei->i_data_sem/3){++++}-{3:3}, at: ext4_setattr+0x136d/0x19c0 fs/ext4/inode.c:5559
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (&ei->i_data_sem/3){++++}-{3:3}:
lock_acquire+0x197/0x480 kernel/locking/lockdep.c:5566
down_write+0x93/0x180 kernel/locking/rwsem.c:1564
ext4_update_i_disksize fs/ext4/ext4.h:3267 [inline]
ext4_xattr_inode_write fs/ext4/xattr.c:1390 [inline]
ext4_xattr_inode_lookup_create fs/ext4/xattr.c:1538 [inline]
ext4_xattr_set_entry+0x331a/0x3d80 fs/ext4/xattr.c:1662
ext4_xattr_ibody_set+0x124/0x390 fs/ext4/xattr.c:2228
ext4_xattr_set_handle+0xc27/0x14e0 fs/ext4/xattr.c:2385
ext4_xattr_set+0x219/0x390 fs/ext4/xattr.c:2498
ext4_xattr_user_set+0xc9/0xf0 fs/ext4/xattr_user.c:40
__vfs_setxattr+0x404/0x450 fs/xattr.c:177
__vfs_setxattr_noperm+0x11d/0x4f0 fs/xattr.c:208
__vfs_setxattr_locked+0x1f9/0x210 fs/xattr.c:266
vfs_setxattr+0x112/0x2c0 fs/xattr.c:283
setxattr+0x1db/0x3e0 fs/xattr.c:548
path_setxattr+0x15a/0x240 fs/xattr.c:567
__do_sys_setxattr fs/xattr.c:582 [inline]
__se_sys_setxattr fs/xattr.c:578 [inline]
__x64_sys_setxattr+0xc5/0xe0 fs/xattr.c:578
do_syscall_64+0x6d/0xa0 arch/x86/entry/common.c:62
entry_SYSCALL_64_after_hwframe+0x61/0xcb-> #0 (&ea_inode->i_rwsem#7/1){+.+.}-{3:3}:
check_prev_add kernel/locking/lockdep.c:2988 [inline]
check_prevs_add kernel/locking/lockdep.c:3113 [inline]
validate_chain+0x1695/0x58f0 kernel/locking/lockdep.c:3729
__lock_acquire+0x12fd/0x20d0 kernel/locking/lockdep.c:4955
lock_acquire+0x197/0x480 kernel/locking/lockdep.c:5566
down_write+0x93/0x180 kernel/locking/rwsem.c:1564
inode_lock include/linux/fs.h:782 [inline]
ext4_xattr_inode_iget+0x42a/0x5c0 fs/ext4/xattr.c:425
ext4_xattr_inode_get+0x138/0x410 fs/ext4/xattr.c:485
ext4_xattr_move_to_block fs/ext4/xattr.c:2580 [inline]
ext4_xattr_make_inode_space fs/ext4/xattr.c:2682 [inline]
ext4_expand_extra_isize_ea+0xe70/0x1bb0 fs/ext4/xattr.c:2774
__ext4_expand_extra_isize+0x304/0x3f0 fs/ext4/inode.c:5898
ext4_try_to_expand_extra_isize fs/ext4/inode.c:5941 [inline]
__ext4_mark_inode_dirty+0x591/0x810 fs/ext4/inode.c:6018
ext4_setattr+0x1400/0x19c0 fs/ext4/inode.c:5562
notify_change+0xbb6/0xe60 fs/attr.c:435
do_truncate+0x1de/0x2c0 fs/open.c:64
handle_truncate fs/namei.c:2970 [inline]
do_open fs/namei.c:3311 [inline]
path_openat+0x29f3/0x3290 fs/namei.c:3425
do_filp_open+0x20b/0x450 fs/namei.c:3452
do_sys_openat2+0x124/0x460 fs/open.c:1207
do_sys_open fs/open.c:1223 [inline]
__do_sys_open fs/open.c:1231 [inline]
__se_sys_open fs/open.c:1227 [inline]
__x64_sys_open+0x221/0x270 fs/open.c:1227
do_syscall_64+0x6d/0xa0 arch/x86/entry/common.c:62
entry_SYSCALL_64_after_hwframe+0x61/0xcbother info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&ei->i_data_sem/3);
lock(&ea_inode->i_rwsem#7/1);
lock(&ei->i_data_sem/3); lock(&ea_inode->i_rwsem#7/1);
*** DEADLOCK ***
5 locks held by syz-executor543/2794:
#0: ffff888026fbc448 (sb_writers#4){.+.+}-{0:0}, at: mnt_want_write+0x4a/0x2a0 fs/namespace.c:365 #1: ffff8880215e3488 (&sb->s_type->i_mutex_key#7){++++}-{3:3}, at: inode_lock include/linux/fs.h:782 [inline] #1: ffff8880215e3488 (&sb->s_type->i_mutex_key#7){++++}-{3:3}, at: do_truncate+0x1cf/0x2c0 fs/open.c:62 #2: ffff8880215e3310 (&ei->i_mmap_sem){++++}-{3:3}, at: ext4_setattr+0xec4/0x19c0 fs/ext4/inode.c:5519 #3: ffff8880215e3278 (&ei->i_data_sem/3){++++}-{3:3}, at: ext4_setattr+0x136d/0x19c0 fs/ext4/inode.c:5559 #4: ffff8880215e30c8 (&ei->xattr_sem){++++}-{3:3}, at: ext4_write_trylock_xattr fs/ext4/xattr.h:162 [inline] #4: ffff8880215e30c8 (&ei->xattr_sem){++++}-{3:3}, at: ext4_try_to_expand_extra_isize fs/ext4/inode.c:5938 [inline] #4: ffff8880215e30c8 (&ei->xattr_sem){++++}-{3:3}, at: __ext4_mark_inode_dirty+0x4fb/0x810 fs/ext4/inode.c:6018
stack backtrace: CPU: 1 PID: 2794 Comm: syz-executor543 Not tainted 5.10.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x177/0x211 lib/dump_stack.c:118 print_circular_bug+0x146/0x1b0 kernel/locking/lockdep.c:2002 check_noncircular+0x2cc/0x390 kernel/locking/lockdep.c:2123 check_prev_add kernel/locking/lockdep.c:2988 [inline] check_prevs_add kernel/locking/lockdep.c:3113 [inline] validate_chain+0x1695/0x58f0 kernel/locking/lockdep.c:3729 __lock_acquire+0x12fd/0x20d0 kernel/locking/lockdep.c:4955 lock_acquire+0x197/0x480 kernel/locking/lockdep.c:5566 down_write+0x93/0x180 kernel/locking/rwsem.c:1564 inode_lock include/linux/fs.h:782 [inline] ext4_xattr_inode_iget+0x42a/0x5c0 fs/ext4/xattr.c:425 ext4_xattr_inode_get+0x138/0x410 fs/ext4/xattr.c:485 ext4_xattr_move_to_block fs/ext4/xattr.c:2580 [inline] ext4_xattr_make_inode_space fs/ext4/xattr.c:2682 [inline] ext4_expand_extra_isize_ea+0xe70/0x1bb0 fs/ext4/xattr.c:2774 __ext4_expand_extra_isize+0x304/0x3f0 fs/ext4/inode.c:5898 ext4_try_to_expand_extra_isize fs/ext4/inode.c:5941 [inline] __ext4_mark_inode_dirty+0x591/0x810 fs/ext4/inode.c:6018 ext4_setattr+0x1400/0x19c0 fs/ext4/inode.c:5562 notify_change+0xbb6/0xe60 fs/attr.c:435 do_truncate+0x1de/0x2c0 fs/open.c:64 handle_truncate fs/namei.c:2970 [inline] do_open fs/namei.c:3311 [inline] path_openat+0x29f3/0x3290 fs/namei.c:3425 do_filp_open+0x20b/0x450 fs/namei.c:3452 do_sys_openat2+0x124/0x460 fs/open.c:1207 do_sys_open fs/open.c:1223 [inline] __do_sys_open fs/open.c:1231 [inline] __se_sys_open fs/open.c:1227 [inline] __x64_sys_open+0x221/0x270 fs/open.c:1227 do_syscall_64+0x6d/0xa0 arch/x86/entry/common.c:62 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f0cde4ea229 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 21 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd81d1c978 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 RAX: ffffffffffffffda RBX: 0030656c69662f30 RCX: 00007f0cde4ea229 RDX: 0000000000000089 RSI: 00000000000a0a00 RDI: 00000000200001c0 RBP: 2f30656c69662f2e R08: 0000000000208000 R09: 0000000000208000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd81d1c9c0 R13: 00007ffd81d1ca00 R14: 0000000000080000 R15: 0000000000000003
EXT4-fs error (device loop0): ext4_expand_extra_isize_ea:2730: inode #13: comm syz-executor543: corrupted in-inode xattr
--- fs/ext4/xattr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/ext4/xattr.c +2 -2
@@ -458,7 +458,7 @@ static int ext4_xattr_inode_iget(struct inode *parent, unsigned long ea_ino,ext4_set_inode_state (inode,EXT4_STATE_LUSTRE_EA_INODE );ext4_xattr_inode_set_ref (inode,1 ); }else { -inode_lock (inode); +inode_lock_nested (inode,I_MUTEX_XATTR ); inode->i_flags |=S_NOQUOTA ;inode_unlock (inode); }
@@ -1039,7 +1039,7 @@ static int ext4_xattr_inode_update_ref(handle_t *handle, struct inode *ea_inode,s64 ref_count;int ret; -inode_lock (ea_inode); +inode_lock_nested (ea_inode,I_MUTEX_XATTR ); ret =ext4_reserve_inode_write (handle, ea_inode, &iloc);if (ret)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 64/213 s390/cpum_sf: Remove WARN_ON_ONCE statements
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Richter <[email protected]>
[ Upstream commit b495e710157606889f2d8bdc62aebf2aa02f67a7 ]
Remove WARN_ON_ONCE statements. These have not triggered in the past.
--- arch/s390/kernel/perf_cpum_sf.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-)
arch/s390/kernel/perf_cpum_sf.c +4 -8
@@ -1463,7 +1463,7 @@ static int aux_output_begin(struct perf_output_handle *handle,unsigned long range, i, range_scan, idx, head, base, offset;struct hws_trailer_entry *te; -if (WARN_ON_ONCE (handle->head & ~PAGE_MASK )) +if (handle->head & ~PAGE_MASK )return -EINVAL ; aux->head = handle->head >>PAGE_SHIFT ;
@@ -1642,7 +1642,7 @@ static void hw_collect_aux(struct cpu_hw_sf *cpuhw)unsigned long num_sdb; aux =perf_get_aux (handle); -if (WARN_ON_ONCE (!aux)) +if (!aux)return ;/* Inform user space new data arrived */
@@ -1661,7 +1661,7 @@ static void hw_collect_aux(struct cpu_hw_sf *cpuhw) num_sdb);break ; } -if (WARN_ON_ONCE (!aux)) +if (!aux)return ;/* Update head and alert_mark to new position */
@@ -1896,12 +1896,8 @@ static void cpumsf_pmu_start(struct perf_event *event, int flags) {struct cpu_hw_sf *cpuhw =this_cpu_ptr (&cpu_hw_sf); -if (WARN_ON_ONCE (!(event->hw.state &PERF_HES_STOPPED ))) +if (!(event->hw.state &PERF_HES_STOPPED ))return ; - -if (flags &PERF_EF_RELOAD ) -WARN_ON_ONCE (!(event->hw.state &PERF_HES_UPTODATE )); -perf_pmu_disable (event->pmu); event->hw.state =0 ; cpuhw->lsctl.cs =1 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 65/213 s390/traps: Handle early warnings gracefully
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <[email protected]>
[ Upstream commit 3c4d0ae0671827f4b536cc2d26f8b9c54584ccc5 ]
Add missing warning handling to the early program check handler. This way a warning is printed to the console as soon as the early console is setup, and the kernel continues to boot.
Before this change a disabled wait psw was loaded instead and the machine was silently stopped without giving an idea about what happened.
--- arch/s390/kernel/early.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-)
arch/s390/kernel/early.c +15 -2
@@ -174,8 +174,21 @@ static __init void setup_topology(void)void __do_early_pgm_check (struct pt_regs *regs) { -if (!fixup_exception (regs)) -disabled_wait (); +struct lowcore *lc =get_lowcore (); +unsigned long ip; + + regs->int_code = lc->pgm_int_code; + regs->int_parm_long = lc->trans_exc_code; + ip =__rewind_psw (regs->psw, regs->int_code >>16 ); + +/* Monitor Event? Might be a warning */ +if ((regs->int_code &PGM_INT_CODE_MASK ) ==0x40 ) { +if (report_bug (ip, regs) ==BUG_TRAP_TYPE_WARN ) +return ; + } +if (fixup_exception (regs)) +return ; +disabled_wait (); } static noinline __init void setup_lowcore_early(void)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 66/213 bpf: Prevent tail call between progs attached to different hooks
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Kuohai <[email protected]>
[ Upstream commit 28ead3eaabc16ecc907cfb71876da028080f6356 ]
bpf progs can be attached to kernel functions, and the attached functions can take different parameters or return different return values. If prog attached to one kernel function tail calls prog attached to another kernel function, the ctx access or return value verification could be bypassed.
For example, if prog1 is attached to func1 which takes only 1 parameter and prog2 is attached to func2 which takes two parameters. Since verifier assumes the bpf ctx passed to prog2 is constructed based on func2's prototype, verifier allows prog2 to access the second parameter from the bpf ctx passed to it. The problem is that verifier does not prevent prog1 from passing its bpf ctx to prog2 via tail call. In this case, the bpf ctx passed to prog2 is constructed from func1 instead of func2, that is, the assumption for ctx access verification is bypassed.
Another example, if BPF LSM prog1 is attached to hook file_alloc_security, and BPF LSM prog2 is attached to hook bpf_lsm_audit_rule_known. Verifier knows the return value rules for these two hooks, e.g. it is legal for bpf_lsm_audit_rule_known to return positive number 1, and it is illegal for file_alloc_security to return positive number. So verifier allows prog2 to return positive number 1, but does not allow prog1 to return positive number. The problem is that verifier does not prevent prog1 from calling prog2 via tail call. In this case, prog2's return value 1 will be used as the return value for prog1's hook file_alloc_security. That is, the return value rule is bypassed.
This patch adds restriction for tail call to prevent such bypasses.
--- include/linux/bpf.h | 1 + kernel/bpf/core.c | 21 ++++++++++++++++++--- 2 files changed, 19 insertions(+), 3 deletions(-)
include/linux/bpf.h +1 -0
@@ -288,6 +288,7 @@ struct bpf_map {* same prog type, JITed flag and xdp_has_frags flag. */ struct { +const struct btf_type *attach_func_proto;spinlock_t lock;enum bpf_prog_type type;bool jited;
kernel/bpf/core.c +18 -3
@@ -2259,6 +2259,7 @@ bool bpf_prog_map_compatible(struct bpf_map *map, {enum bpf_prog_type prog_type =resolve_prog_type (fp);bool ret; +struct bpf_prog_aux *aux = fp->aux;if (fp->kprobe_override)return false;
@@ -2268,7 +2269,7 @@ bool bpf_prog_map_compatible(struct bpf_map *map,* in the case of devmap and cpumap). Until device checks * are implemented, prohibit adding dev-bound programs to program maps. */ -if (bpf_prog_is_dev_bound (fp->aux)) +if (bpf_prog_is_dev_bound (aux))return false;spin_lock (&map->owner.lock);
@@ -2278,12 +2279,26 @@ bool bpf_prog_map_compatible(struct bpf_map *map,*/ map->owner.type = prog_type; map->owner.jited = fp->jited; - map->owner.xdp_has_frags = fp->aux->xdp_has_frags; + map->owner.xdp_has_frags = aux->xdp_has_frags; + map->owner.attach_func_proto = aux->attach_func_proto; ret = true; }else { ret = map->owner.type == prog_type && map->owner.jited == fp->jited && - map->owner.xdp_has_frags == fp->aux->xdp_has_frags; + map->owner.xdp_has_frags == aux->xdp_has_frags; +if (ret && + map->owner.attach_func_proto != aux->attach_func_proto) { +switch (prog_type) { +case BPF_PROG_TYPE_TRACING : +case BPF_PROG_TYPE_LSM : +case BPF_PROG_TYPE_EXT : +case BPF_PROG_TYPE_STRUCT_OPS : + ret = false; +break ; +default : +break ; + } + } }spin_unlock (&map->owner.lock);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 67/213 ktest.pl: Avoid false positives with grub2 skip regex
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Jordan <[email protected]>
[ Upstream commit 2351e8c65404aabc433300b6bf90c7a37e8bbc4d ]
Some distros have grub2 config files with the lines
if [ x"${feature_menuentry_id}" = xy ]; then
menuentry_id_option="--id"
else
menuentry_id_option=""
fiwhich match the skip regex defined for grub2 in get_grub_index():
$skip = '^\s*menuentry';
These false positives cause the grub number to be higher than it should be, and the wrong kernel can end up booting.
Grub documents the menuentry command with whitespace between it and the title, so make the skip regex reflect this.
--- tools/testing/ktest/ktest.pl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/ktest/ktest.pl +1 -1
@@ -2043,7 +2043,7 @@ sub get_grub_index { } elsif ($reboot_type eq "grub2") { $command = "cat $grub_file"; $target = '^\s*menuentry.*' . $grub_menu_qt; - $skip = '^\s*menuentry'; + $skip = '^\s*menuentry\s'; $submenu = '^\s*submenu\s'; } elsif ($reboot_type eq "grub2bls") { $command = $grub_bls_get;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 68/213 RDMA/mad: Improve handling of timed out WRs of mad agent
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saravanan Vajravel <[email protected]>
[ Upstream commit 2a777679b8ccd09a9a65ea0716ef10365179caac ]
Current timeout handler of mad agent acquires/releases mad_agent_priv lock for every timed out WRs. This causes heavy locking contention when higher no. of WRs are to be handled inside timeout handler.
This leads to softlockup with below trace in some use cases where rdma-cm path is used to establish connection between peer nodes
Trace:
-----
BUG: soft lockup - CPU#4 stuck for 26s! [kworker/u128:3:19767]
CPU: 4 PID: 19767 Comm: kworker/u128:3 Kdump: loaded Tainted: G OE
------- --- 5.14.0-427.13.1.el9_4.x86_64 #1
Hardware name: Dell Inc. PowerEdge R740/01YM03, BIOS 2.4.8 11/26/2019
Workqueue: ib_mad1 timeout_sends [ib_core]
RIP: 0010:__do_softirq+0x78/0x2ac
RSP: 0018:ffffb253449e4f98 EFLAGS: 00000246
RAX: 00000000ffffffff RBX: 0000000000000000 RCX: 000000000000001f
RDX: 000000000000001d RSI: 000000003d1879ab RDI: fff363b66fd3a86b
RBP: ffffb253604cbcd8 R08: 0000009065635f3b R09: 0000000000000000
R10: 0000000000000040 R11: ffffb253449e4ff8 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000040
FS: 0000000000000000(0000) GS:ffff8caa1fc80000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fd9ec9db900 CR3: 0000000891934006 CR4: 00000000007706e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
<IRQ>
? show_trace_log_lvl+0x1c4/0x2df
? show_trace_log_lvl+0x1c4/0x2df
? __irq_exit_rcu+0xa1/0xc0
? watchdog_timer_fn+0x1b2/0x210
? __pfx_watchdog_timer_fn+0x10/0x10
? __hrtimer_run_queues+0x127/0x2c0
? hrtimer_interrupt+0xfc/0x210
? __sysvec_apic_timer_interrupt+0x5c/0x110
? sysvec_apic_timer_interrupt+0x37/0x90
? asm_sysvec_apic_timer_interrupt+0x16/0x20
? __do_softirq+0x78/0x2ac
? __do_softirq+0x60/0x2ac
__irq_exit_rcu+0xa1/0xc0
sysvec_call_function_single+0x72/0x90
</IRQ>
<TASK>
asm_sysvec_call_function_single+0x16/0x20
RIP: 0010:_raw_spin_unlock_irq+0x14/0x30
RSP: 0018:ffffb253604cbd88 EFLAGS: 00000247
RAX: 000000000001960d RBX: 0000000000000002 RCX: ffff8cad2a064800
RDX: 000000008020001b RSI: 0000000000000001 RDI: ffff8cad5d39f66c
RBP: ffff8cad5d39f600 R08: 0000000000000001 R09: 0000000000000000
R10: ffff8caa443e0c00 R11: ffffb253604cbcd8 R12: ffff8cacb8682538
R13: 0000000000000005 R14: ffffb253604cbd90 R15: ffff8cad5d39f66c
cm_process_send_error+0x122/0x1d0 [ib_cm]
timeout_sends+0x1dd/0x270 [ib_core]
process_one_work+0x1e2/0x3b0
? __pfx_worker_thread+0x10/0x10
worker_thread+0x50/0x3a0
? __pfx_worker_thread+0x10/0x10
kthread+0xdd/0x100
? __pfx_kthread+0x10/0x10
ret_from_fork+0x29/0x50
</TASK>Simplified timeout handler by creating local list of timed out WRs and invoke send handler post creating the list. The new method acquires/ releases lock once to fetch the list and hence helps to reduce locking contetiong when processing higher no. of WRs
--- drivers/infiniband/core/mad.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
drivers/infiniband/core/mad.c +8 -6
@@ -2616,14 +2616,16 @@ static int retry_send(struct ib_mad_send_wr_private *mad_send_wr)static void timeout_sends (struct work_struct *work) { +struct ib_mad_send_wr_private *mad_send_wr, *n;struct ib_mad_agent_private *mad_agent_priv; -struct ib_mad_send_wr_private *mad_send_wr;struct ib_mad_send_wc mad_send_wc; +struct list_head local_list;unsigned long flags, delay; mad_agent_priv = container_of(work, struct ib_mad_agent_private, timed_work.work); mad_send_wc.vendor_err =0 ; +INIT_LIST_HEAD (&local_list);spin_lock_irqsave (&mad_agent_priv->lock, flags);while (!list_empty (&mad_agent_priv->wait_list)) {
@@ -2641,13 +2643,16 @@ static void timeout_sends(struct work_struct *work)break ; } -list_del (&mad_send_wr->agent_list); +list_del_init (&mad_send_wr->agent_list);if (mad_send_wr->status ==IB_WC_SUCCESS && !retry_send (mad_send_wr))continue ; -spin_unlock_irqrestore (&mad_agent_priv->lock, flags); +list_add_tail (&mad_send_wr->agent_list, &local_list); + } +spin_unlock_irqrestore (&mad_agent_priv->lock, flags); +list_for_each_entry_safe (mad_send_wr, n, &local_list, agent_list) {if (mad_send_wr->status ==IB_WC_SUCCESS ) mad_send_wc.status =IB_WC_RESP_TIMEOUT_ERR ;else
@@ -2655,11 +2660,8 @@ static void timeout_sends(struct work_struct *work) mad_send_wc.send_buf = &mad_send_wr->send_buf; mad_agent_priv->agent.send_handler (&mad_agent_priv->agent, &mad_send_wc); -deref_mad_agent (mad_agent_priv); -spin_lock_irqsave (&mad_agent_priv->lock, flags); } -spin_unlock_irqrestore (&mad_agent_priv->lock, flags); }/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 69/213 soundwire: intel_bus_common: enable interrupts before exiting reset
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre-Louis Bossart <[email protected]>
[ Upstream commit 5aedb8d8336b0a0421b58ca27d1b572aa6695b5b ]
The existing code enables the Cadence IP interrupts after the bus reset sequence. The problem with this sequence is that it might be pre-empted, giving SoundWire devices time to sync and report as ATTACHED before the interrupts are enabled. In that case, the Cadence IP will not detect a state change and will not throw an interrupt to proceed with the enumeration of a Device0.
In our overnight stress tests, we observed that a slight sub-millisecond delay in enabling interrupts after the reset was correlated with detection failures. This problem is more prevalent on the LunarLake silicon, likely due to SOC integration changes, but it was observed on earlier generations as well.
This patch reverts the sequence, with the interrupts enabled before performing the bus reset. This removes the race condition and makes sure the Cadence IP is able to detect the presence of a Device0 in all cases.
--- drivers/soundwire/intel_bus_common.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/soundwire/intel_bus_common.c +8 -8
@@ -45,15 +45,15 @@ int intel_start_bus(struct sdw_intel *sdw)return ret; } - ret =sdw_cdns_exit_reset (cdns); + ret =sdw_cdns_enable_interrupt (cdns, true);if (ret <0 ) { -dev_err (dev,"%s: unable to exit bus reset sequence: %d\n" , __func__, ret); +dev_err (dev,"%s: cannot enable interrupts: %d\n" , __func__, ret);return ret; } - ret =sdw_cdns_enable_interrupt (cdns, true); + ret =sdw_cdns_exit_reset (cdns);if (ret <0 ) { -dev_err (dev,"%s: cannot enable interrupts: %d\n" , __func__, ret); +dev_err (dev,"%s: unable to exit bus reset sequence: %d\n" , __func__, ret);return ret; }
@@ -136,15 +136,15 @@ int intel_start_bus_after_reset(struct sdw_intel *sdw)return ret; } - ret =sdw_cdns_exit_reset (cdns); + ret =sdw_cdns_enable_interrupt (cdns, true);if (ret <0 ) { -dev_err (dev,"unable to exit bus reset sequence during resume\n" ); +dev_err (dev,"cannot enable interrupts during resume\n" );return ret; } - ret =sdw_cdns_enable_interrupt (cdns, true); + ret =sdw_cdns_exit_reset (cdns);if (ret <0 ) { -dev_err (dev,"cannot enable interrupts during resume\n" ); +dev_err (dev,"unable to exit bus reset sequence during resume\n" );return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 70/213 PCI: Add function 0 DMA alias quirk for Glenfly Arise chip
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: WangYuli <[email protected]>
[ Upstream commit 9246b487ab3c3b5993aae7552b7a4c541cc14a49 ]
Add DMA support for audio function of Glenfly Arise chip, which uses Requester ID of function 0.
--- drivers/pci/quirks.c | 4 ++++ include/linux/pci_ids.h | 2 ++ sound/pci/hda/hda_intel.c | 2 +- 3 files changed, 7 insertions(+), 1 deletion(-)
drivers/pci/quirks.c +4 -0
@@ -4252,6 +4252,10 @@ static void quirk_dma_func0_alias(struct pci_dev *dev)DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_RICOH ,0xe832 , quirk_dma_func0_alias);DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_RICOH ,0xe476 , quirk_dma_func0_alias); +/* Some Glenfly chips use function 0 as the PCIe Requester ID for DMA */ +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_GLENFLY ,0x3d40 , quirk_dma_func0_alias); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_GLENFLY ,0x3d41 , quirk_dma_func0_alias); +static void quirk_dma_func1_alias (struct pci_dev *dev) {if (PCI_FUNC (dev->devfn) !=1 )
include/linux/pci_ids.h +2 -0
@@ -2653,6 +2653,8 @@#define PCI_DEVICE_ID_DCI_PCCOM8 0x0002#define PCI_DEVICE_ID_DCI_PCCOM2 0x0004 +#define PCI_VENDOR_ID_GLENFLY 0x6766 +#define PCI_VENDOR_ID_INTEL 0x8086#define PCI_DEVICE_ID_INTEL_EESSC 0x0008#define PCI_DEVICE_ID_INTEL_HDA_CML_LP 0x02c8
sound/pci/hda/hda_intel.c +1 -1
@@ -2682,7 +2682,7 @@ static const struct pci_device_id azx_ids[] = { .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS | AZX_DCAPS_PM_RUNTIME },/* GLENFLY */ - { PCI_DEVICE(0x6766, PCI_ANY_ID), + { PCI_DEVICE(PCI_VENDOR_ID_GLENFLY, PCI_ANY_ID), .class = PCI_CLASS_MULTIMEDIA_HD_AUDIO << 8, .class_mask = 0xffffff, .driver_data = AZX_DRIVER_GFHDMI | AZX_DCAPS_POSFIX_LPIB |
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 71/213 RDMA/rtrs-srv: Avoid null pointer deref during path establishment
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Md Haris Iqbal <[email protected]>
[ Upstream commit d0e62bf7b575fbfe591f6f570e7595dd60a2f5eb ]
For RTRS path establishment, RTRS client initiates and completes con_num of connections. After establishing all its connections, the information is exchanged between the client and server through the info_req message. During this exchange, it is essential that all connections have been established, and the state of the RTRS srv path is CONNECTED.
So add these sanity checks, to make sure we detect and abort process in error scenarios to avoid null pointer deref.
--- drivers/infiniband/ulp/rtrs/rtrs-srv.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
drivers/infiniband/ulp/rtrs/rtrs-srv.c +11 -2
@@ -931,12 +931,11 @@ static void rtrs_srv_info_req_done(struct ib_cq *cq, struct ib_wc *wc)if (err) goto close; -out:rtrs_iu_free (iu, srv_path->s.dev->ib_dev,1 );return ; close: +rtrs_iu_free (iu, srv_path->s.dev->ib_dev,1 );close_path (srv_path); - goto out; }static int post_recv_info_req (struct rtrs_srv_con *con)
@@ -987,6 +986,16 @@ static int post_recv_path(struct rtrs_srv_path *srv_path) q_size =SERVICE_CON_QUEUE_DEPTH ; else q_size = srv->queue_depth; +if (srv_path->state !=RTRS_SRV_CONNECTING ) { +rtrs_err (s,"Path state invalid. state %s\n" , +rtrs_srv_state_str (srv_path->state)); +return -EIO ; + } + +if (!srv_path->s.con[cid]) { +rtrs_err (s,"Conn not set for %d\n" , cid); +return -EIO ; + } err =post_recv_io (to_srv_con (srv_path->s.con[cid]), q_size);if (err) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 72/213 clk: bcm: bcm53573: fix OF node leak in init
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit f92d67e23b8caa81f6322a2bad1d633b00ca000e ]
Driver code is leaking OF node reference from of_get_parent() in bcm53573_ilp_init(). Usage of of_get_parent() is not needed in the first place, because the parent node will not be freed while we are processing given node (triggered by CLK_OF_DECLARE()). Thus fix the leak by accessing parent directly, instead of of_get_parent().
--- drivers/clk/bcm/clk-bcm53573-ilp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/bcm/clk-bcm53573-ilp.c +1 -1
@@ -112,7 +112,7 @@ static void bcm53573_ilp_init(struct device_node *np) goto err_free_ilp; } - ilp->regmap =syscon_node_to_regmap (of_get_parent (np)); + ilp->regmap =syscon_node_to_regmap (np->parent);if (IS_ERR (ilp->regmap)) { err =PTR_ERR (ilp->regmap); goto err_free_ilp;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 73/213 PCI: Add ACS quirk for Qualcomm SA8775P
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Subramanian Ananthanarayanan <[email protected]>
[ Upstream commit 026f84d3fa62d215b11cbeb5a5d97df941e93b5c ]
The Qualcomm SA8775P root ports don't advertise an ACS capability, but they do provide ACS-like features to disable peer transactions and validate bus numbers in requests.
Thus, add an ACS quirk for the SA8775P.
--- drivers/pci/quirks.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/pci/quirks.c +2 -0
@@ -5080,6 +5080,8 @@ static const struct pci_dev_acs_enabled {/* QCOM QDF2xxx root ports */ { PCI_VENDOR_ID_QCOM, 0x0400, pci_quirk_qcom_rp_acs }, { PCI_VENDOR_ID_QCOM, 0x0401, pci_quirk_qcom_rp_acs }, +/* QCOM SA8775P root port */ + { PCI_VENDOR_ID_QCOM, 0x0115, pci_quirk_qcom_rp_acs },/* HXT SD4800 root ports. The ACS design is same as QCOM QDF2xxx */ { PCI_VENDOR_ID_HXT, 0x0401, pci_quirk_qcom_rp_acs }, /* Intel PCH root ports */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 74/213 i2c: i801: Use a different adapter-name for IDF adapters
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 43457ada98c824f310adb7bd96bd5f2fcd9a3279 ]
On chipsets with a second 'Integrated Device Function' SMBus controller use a different adapter-name for the second IDF adapter.
This allows platform glue code which is looking for the primary i801 adapter to manually instantiate i2c_clients on to differentiate between the 2.
This allows such code to find the primary i801 adapter by name, without needing to duplicate the PCI-ids to feature-flags mapping from i2c-i801.c.
--- drivers/i2c/busses/i2c-i801.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/i2c/busses/i2c-i801.c +8 -1
@@ -1754,8 +1754,15 @@ static int i801_probe(struct pci_dev *dev, const struct pci_device_id *id)i801_add_tco (priv); +/* +* adapter.name is used by platform code to find the main I801 adapter +* to instantiante i2c_clients, do not change. +*/ snprintf (priv->adapter.name,sizeof (priv->adapter.name), -"SMBus I801 adapter at %04lx" , priv->smba); +"SMBus %s adapter at %04lx" , + (priv->features &FEATURE_IDF ) ?"I801 IDF" :"I801" , + priv->smba); + err =i2c_add_adapter (&priv->adapter);if (err) {platform_device_unregister (priv->tco_pdev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 75/213 PCI: Mark Creative Labs EMU20k2 INTx masking as broken
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Williamson <[email protected]>
[ Upstream commit 2910306655a7072640021563ec9501bfa67f0cb1 ]
Per user reports, the Creative Labs EMU20k2 (Sound Blaster X-Fi Titanium Series) generates spurious interrupts when used with vfio-pci unless DisINTx masking support is disabled.
Thus, quirk the device to mark INTx masking as broken.
--- drivers/pci/quirks.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/pci/quirks.c +2 -0
@@ -3614,6 +3614,8 @@ DECLARE_PCI_FIXUP_FINAL(0x1814, 0x0601, /* Ralink RT2800 802.11n PCI */ quirk_broken_intx_masking);DECLARE_PCI_FIXUP_FINAL (0x1b7c ,0x0004 ,/* Ceton InfiniTV4 */ quirk_broken_intx_masking); +DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_CREATIVE ,PCI_DEVICE_ID_CREATIVE_20K2 , + quirk_broken_intx_masking);/* * Realtek RTL8169 PCI Gigabit Ethernet Controller (rev 10)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 76/213 i3c: master: cdns: Fix use after free vulnerability in cdns_i3c_master Driver Due to Race Condition
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaixin Wang <[email protected]>
[ Upstream commit 609366e7a06d035990df78f1562291c3bf0d4a12 ]
In the cdns_i3c_master_probe function, &master->hj_work is bound with cdns_i3c_master_hj. And cdns_i3c_master_interrupt can call cnds_i3c_master_demux_ibis function to start the work.
If we remove the module which will call cdns_i3c_master_remove to make cleanup, it will free master->base through i3c_master_unregister while the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows:
CPU0 CPU1
| cdns_i3c_master_hj
cdns_i3c_master_remove |
i3c_master_unregister(&master->base) |
device_unregister(&master->dev) |
device_release |
//free master->base |
| i3c_master_do_daa(&master->base)
| //use master->baseFix it by ensuring that the work is canceled before proceeding with the cleanup in cdns_i3c_master_remove.
--- drivers/i3c/master/i3c-master-cdns.c | 1 + 1 file changed, 1 insertion(+)
drivers/i3c/master/i3c-master-cdns.c +1 -0
@@ -1666,6 +1666,7 @@ static void cdns_i3c_master_remove(struct platform_device *pdev) {struct cdns_i3c_master *master =platform_get_drvdata (pdev); +cancel_work_sync (&master->hj_work);i3c_master_unregister (&master->base);clk_disable_unprepare (master->sysclk);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 77/213 RISC-V: Dont have MAX_PHYSMEM_BITS exceed phys_addr_t
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Palmer Dabbelt <[email protected]>
[ Upstream commit ad380f6a0a5e82e794b45bb2eaec24ed51a56846 ]
I recently ended up with a warning on some compilers along the lines of
CC kernel/resource.o
In file included from include/linux/ioport.h:16,
from kernel/resource.c:15:
kernel/resource.c: In function 'gfr_start':
include/linux/minmax.h:49:37: error: conversion from 'long long unsigned int' to 'resource_size_t' {aka 'unsigned int'} changes value from '17179869183' to '4294967295' [-Werror=overflow]
49 | ({ type ux = (x); type uy = (y); __cmp(op, ux, uy); })
| ^
include/linux/minmax.h:52:9: note: in expansion of macro '__cmp_once_unique'
52 | __cmp_once_unique(op, type, x, y, __UNIQUE_ID(x_), __UNIQUE_ID(y_))
| ^~~~~~~~~~~~~~~~~
include/linux/minmax.h:161:27: note: in expansion of macro '__cmp_once'
161 | #define min_t(type, x, y) __cmp_once(min, type, x, y)
| ^~~~~~~~~~
kernel/resource.c:1829:23: note: in expansion of macro 'min_t'
1829 | end = min_t(resource_size_t, base->end,
| ^~~~~
kernel/resource.c: In function 'gfr_continue':
include/linux/minmax.h:49:37: error: conversion from 'long long unsigned int' to 'resource_size_t' {aka 'unsigned int'} changes value from '17179869183' to '4294967295' [-Werror=overflow]
49 | ({ type ux = (x); type uy = (y); __cmp(op, ux, uy); })
| ^
include/linux/minmax.h:52:9: note: in expansion of macro '__cmp_once_unique'
52 | __cmp_once_unique(op, type, x, y, __UNIQUE_ID(x_), __UNIQUE_ID(y_))
| ^~~~~~~~~~~~~~~~~
include/linux/minmax.h:161:27: note: in expansion of macro '__cmp_once'
161 | #define min_t(type, x, y) __cmp_once(min, type, x, y)
| ^~~~~~~~~~
kernel/resource.c:1847:24: note: in expansion of macro 'min_t'
1847 | addr <= min_t(resource_size_t, base->end,
| ^~~~~
cc1: all warnings being treated as errorswhich looks like a real problem: our phys_addr_t is only 32 bits now, so having 34-bit masks is just going to result in overflows.
--- arch/riscv/include/asm/sparsemem.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/riscv/include/asm/sparsemem.h +1 -1
@@ -7,7 +7,7 @@#ifdef CONFIG_64BIT #define MAX_PHYSMEM_BITS 56#else -#define MAX_PHYSMEM_BITS 34 +#define MAX_PHYSMEM_BITS 32#endif /* CONFIG_64BIT */ #define SECTION_SIZE_BITS 27#endif /* CONFIG_SPARSEMEM */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 78/213 io_uring: check if we need to reschedule during overflow flush
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <[email protected]>
[ Upstream commit eac2ca2d682f94f46b1973bdf5e77d85d77b8e53 ]
In terms of normal application usage, this list will always be empty. And if an application does overflow a bit, it'll have a few entries. However, nothing obviously prevents syzbot from running a test case that generates a ton of overflow entries, and then flushing them can take quite a while.
Check for needing to reschedule while flushing, and drop our locks and do so if necessary. There's no state to maintain here as overflows always prune from head-of-list, hence it's fine to drop and reacquire the locks at the end of the loop.
--- io_uring/io_uring.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
io_uring/io_uring.c +15 -0
@@ -701,6 +701,21 @@ static void __io_cqring_overflow_flush(struct io_ring_ctx *ctx)memcpy (cqe, &ocqe->cqe, cqe_size);list_del (&ocqe->list);kfree (ocqe); + +/* +* For silly syzbot cases that deliberately overflow by huge +* amounts, check if we need to resched and drop and +* reacquire the locks if so. Nothing real would ever hit this. +* Ideally we'd have a non-posting unlock for this, but hard +* to care for a non-real case. +*/ +if (need_resched ()) { +io_cq_unlock_post (ctx); +mutex_unlock (&ctx->uring_lock); +cond_resched (); +mutex_lock (&ctx->uring_lock); +io_cq_lock (ctx); + } }if (list_empty (&ctx->cq_overflow_list)) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 79/213 ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaixin Wang <[email protected]>
[ Upstream commit e51aded92d42784313ba16c12f4f88cc4f973bbb ]
In the switchtec_ntb_add function, it can call switchtec_ntb_init_sndev function, then &sndev->check_link_status_work is bound with check_link_status_work. switchtec_ntb_link_notification may be called to start the work.
If we remove the module which will call switchtec_ntb_remove to make cleanup, it will free sndev through kfree(sndev), while the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows:
CPU0 CPU1
| check_link_status_work
switchtec_ntb_remove |
kfree(sndev); |
| if (sndev->link_force_down)
| // use sndevFix it by ensuring that the work is canceled before proceeding with the cleanup in switchtec_ntb_remove.
--- drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 1 + 1 file changed, 1 insertion(+)
drivers/ntb/hw/mscc/ntb_hw_switchtec.c +1 -0
@@ -1554,6 +1554,7 @@ static void switchtec_ntb_remove(struct device *dev)switchtec_ntb_deinit_db_msg_irq (sndev);switchtec_ntb_deinit_shared_mw (sndev);switchtec_ntb_deinit_crosslink (sndev); +cancel_work_sync (&sndev->check_link_status_work);kfree (sndev);dev_info (dev,"ntb device unregistered\n" ); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 80/213 mfd: intel_soc_pmic_chtwc: Make Lenovo Yoga Tab 3 X90F DMI match less strict
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit ae7eee56cdcfcb6a886f76232778d6517fd58690 ]
There are 2G and 4G RAM versions of the Lenovo Yoga Tab 3 X90F and it turns out that the 2G version has a DMI product name of "CHERRYVIEW D1 PLATFORM" where as the 4G version has "CHERRYVIEW C0 PLATFORM". The sys-vendor + product-version check are unique enough that the product-name check is not necessary.
Drop the product-name check so that the existing DMI match for the 4G RAM version also matches the 2G RAM version.
--- drivers/mfd/intel_soc_pmic_chtwc.c | 1 - 1 file changed, 1 deletion(-)
drivers/mfd/intel_soc_pmic_chtwc.c +0 -1
@@ -178,7 +178,6 @@ static const struct dmi_system_id cht_wc_model_dmi_ids[] = { .driver_data = (void *)(long)INTEL_CHT_WC_LENOVO_YT3_X90, .matches = {DMI_MATCH (DMI_SYS_VENDOR ,"Intel Corporation" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"CHERRYVIEW D1 PLATFORM" ), DMI_MATCH(DMI_PRODUCT_VERSION, "Blade3-10A-001"), }, },
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 81/213 riscv: avoid Imbalance in RAS
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jisheng Zhang <[email protected]>
[ Upstream commit 8f1534e7440382d118c3d655d3a6014128b2086d ]
Inspired by[1], modify the code to remove the code of modifying ra to avoid imbalance RAS (return address stack) which may lead to incorret predictions on return.
--- arch/riscv/kernel/entry.S | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/riscv/kernel/entry.S +2 -2
@@ -219,8 +219,8 @@ SYM_CODE_START(ret_from_fork) jalr s0 1: move a0, sp /* pt_regs */ - la ra, ret_from_exception - tail syscall_exit_to_user_mode + call syscall_exit_to_user_mode + j ret_from_exception SYM_CODE_END(ret_from_fork) /*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 82/213 RDMA/mlx5: Enforce umem boundaries for explicit ODP page faults
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Guralnik <[email protected]>
[ Upstream commit 8c6d097d830f779fc1725fbaa1314f20a7a07b4b ]
The new memory scheme page faults are requesting the driver to fetch additinal pages to the faulted memory access.
This is done in order to prefetch pages before and after the area that got the page fault, assuming this will reduce the total amount of page faults.
The driver should ensure it handles only the pages that are within the umem range.
--- drivers/infiniband/hw/mlx5/odp.c | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-)
drivers/infiniband/hw/mlx5/odp.c +16 -9
@@ -733,24 +733,31 @@ static int pagefault_dmabuf_mr(struct mlx5_ib_mr *mr, size_t bcnt,* >0: Number of pages mapped */ static int pagefault_mr (struct mlx5_ib_mr *mr,u64 io_virt,size_t bcnt, -u32 *bytes_mapped,u32 flags) +u32 *bytes_mapped,u32 flags,bool permissive_fault) {struct ib_umem_odp *odp =to_ib_umem_odp (mr->umem); -if (unlikely (io_virt < mr->ibmr.iova)) +if (unlikely (io_virt < mr->ibmr.iova) && !permissive_fault)return -EFAULT ;if (mr->umem->is_dmabuf)return pagefault_dmabuf_mr (mr, bcnt, bytes_mapped, flags);if (!odp->is_implicit_odp) { +u64 offset = io_virt < mr->ibmr.iova ?0 : io_virt - mr->ibmr.iova;u64 user_va; -if (check_add_overflow (io_virt - mr->ibmr.iova, - (u64 )odp->umem.address, &user_va)) +if (check_add_overflow (offset, (u64 )odp->umem.address, + &user_va))return -EFAULT ; -if (unlikely (user_va >=ib_umem_end (odp) || -ib_umem_end (odp) - user_va < bcnt)) + +if (permissive_fault) { +if (user_va <ib_umem_start (odp)) + user_va =ib_umem_start (odp); +if ((user_va + bcnt) >ib_umem_end (odp)) + bcnt =ib_umem_end (odp) - user_va; + }else if (unlikely (user_va >=ib_umem_end (odp) || +ib_umem_end (odp) - user_va < bcnt))return -EFAULT ;return pagefault_real_mr (mr, odp, user_va, bcnt, bytes_mapped, flags);
@@ -857,7 +864,7 @@ static int pagefault_single_data_segment(struct mlx5_ib_dev *dev,case MLX5_MKEY_MR : mr = container_of(mmkey, struct mlx5_ib_mr, mmkey); - ret =pagefault_mr (mr, io_virt, bcnt, bytes_mapped,0 ); + ret =pagefault_mr (mr, io_virt, bcnt, bytes_mapped,0 , false);if (ret <0 ) goto end;
@@ -1710,7 +1717,7 @@ static void mlx5_ib_prefetch_mr_work(struct work_struct *w)for (i =0 ; i < work->num_sge; ++i) { ret =pagefault_mr (work->frags[i].mr, work->frags[i].io_virt, work->frags[i].length, &bytes_mapped, - work->pf_flags); + work->pf_flags, false);if (ret <=0 )continue ;mlx5_update_odp_stats (work->frags[i].mr, prefetch, ret);
@@ -1761,7 +1768,7 @@ static int mlx5_ib_prefetch_sg_list(struct ib_pd *pd,if (IS_ERR (mr))return PTR_ERR (mr); ret =pagefault_mr (mr, sg_list[i].addr, sg_list[i].length, - &bytes_mapped, pf_flags); + &bytes_mapped, pf_flags, false);if (ret <0 ) {mlx5r_deref_odp_mkey (&mr->mmkey);return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 83/213 soundwire: cadence: re-check Peripheral status with delayed_work
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre-Louis Bossart <[email protected]>
[ Upstream commit f8c35d61ba01afa76846905c67862cdace7f66b0 ]
The SoundWire peripheral enumeration is entirely based on interrupts, more specifically sticky bits tracking state changes.
This patch adds a defensive programming check on the actual status reported in PING frames. If for some reason an interrupt was lost or delayed, the delayed work would detect a peripheral change of status after the bus starts.
The 100ms defined for the delay is not completely arbitrary, if a Peripheral didn't join the bus within that delay then probably the hardware link is broken, and conversely if the detection didn't happen because of software issues the 100ms is still acceptable in terms of user experience.
The overhead of the one-shot workqueue is minimal, and the mutual exclusion ensures that the interrupt and delayed work cannot update the status concurrently.
--- drivers/soundwire/cadence_master.c | 39 ++++++++++++++++++++++++++-- drivers/soundwire/cadence_master.h | 5 ++++ drivers/soundwire/intel.h | 2 ++ drivers/soundwire/intel_auxdevice.c | 1 + drivers/soundwire/intel_bus_common.c | 11 ++++++++ 5 files changed, 56 insertions(+), 2 deletions(-)
drivers/soundwire/cadence_master.c +37 -2
@@ -891,8 +891,14 @@ static int cdns_update_slave_status(struct sdw_cdns *cdns, } } -if (is_slave) -return sdw_handle_slave_status (&cdns->bus, status); +if (is_slave) { +int ret; + +mutex_lock (&cdns->status_update_lock); + ret =sdw_handle_slave_status (&cdns->bus, status); +mutex_unlock (&cdns->status_update_lock); +return ret; + }return 0 ; }
@@ -989,6 +995,31 @@ irqreturn_t sdw_cdns_irq(int irq, void *dev_id) }EXPORT_SYMBOL (sdw_cdns_irq); +static void cdns_check_attached_status_dwork (struct work_struct *work) +{ +struct sdw_cdns *cdns = + container_of(work, struct sdw_cdns, attach_dwork.work); +enum sdw_slave_status status[SDW_MAX_DEVICES +1 ]; +u32 val; +int ret; +int i; + + val =cdns_readl (cdns,CDNS_MCP_SLAVE_STAT ); + +for (i =0 ; i <=SDW_MAX_DEVICES ; i++) { + status[i] = val &0x3 ; +if (status[i]) +dev_dbg (cdns->dev,"Peripheral %d status: %d\n" , i, status[i]); + val >>=2 ; + } + +mutex_lock (&cdns->status_update_lock); + ret =sdw_handle_slave_status (&cdns->bus, status); +mutex_unlock (&cdns->status_update_lock); +if (ret <0 ) +dev_err (cdns->dev,"%s: sdw_handle_slave_status failed: %d\n" , __func__, ret); +} +/** * cdns_update_slave_status_work - update slave status in a work since we will need to handle * other interrupts eg. CDNS_MCP_INT_RX_WL during the update slave
@@ -1745,7 +1776,11 @@ int sdw_cdns_probe(struct sdw_cdns *cdns)init_completion (&cdns->tx_complete); cdns->bus.port_ops = &cdns_port_ops; +mutex_init (&cdns->status_update_lock); +INIT_WORK (&cdns->work, cdns_update_slave_status_work); +INIT_DELAYED_WORK (&cdns->attach_dwork, cdns_check_attached_status_dwork); +return 0 ; }EXPORT_SYMBOL (sdw_cdns_probe);
drivers/soundwire/cadence_master.h +5 -0
@@ -117,6 +117,8 @@ struct sdw_cdns_dai_runtime {* @link_up: Link status * @msg_count: Messages sent on bus * @dai_runtime_array: runtime context for each allocated DAI. +* @status_update_lock: protect concurrency between interrupt-based and delayed work +* status update */ struct sdw_cdns {struct device *dev;
@@ -148,10 +150,13 @@ struct sdw_cdns {bool interrupt_enabled;struct work_struct work; +struct delayed_work attach_dwork;struct list_head list;struct sdw_cdns_dai_runtime **dai_runtime_array; + +struct mutex status_update_lock;/* add mutual exclusion to sdw_handle_slave_status() */ };#define bus_to_cdns (_bus) container_of(_bus, struct sdw_cdns, bus)
drivers/soundwire/intel.h +2 -0
@@ -91,6 +91,8 @@ static inline void intel_writew(void __iomem *base, int offset, u16 value)#define INTEL_MASTER_RESET_ITERATIONS 10 +#define SDW_INTEL_DELAYED_ENUMERATION_MS 100 +#define SDW_INTEL_CHECK_OPS (sdw, cb) ((sdw) && (sdw)->link_res && (sdw)->link_res->hw_ops && \ (sdw)->link_res->hw_ops->cb)#define SDW_INTEL_OPS (sdw, cb) ((sdw)->link_res->hw_ops->cb)
drivers/soundwire/intel_auxdevice.c +1 -0
@@ -398,6 +398,7 @@ static void intel_link_remove(struct auxiliary_device *auxdev)*/ if (!bus->prop.hw_disabled) {sdw_intel_debugfs_exit (sdw); +cancel_delayed_work_sync (&cdns->attach_dwork);sdw_cdns_enable_interrupt (cdns, false); }sdw_bus_master_delete (bus);
drivers/soundwire/intel_bus_common.c +11 -0
@@ -60,6 +60,9 @@ int intel_start_bus(struct sdw_intel *sdw)sdw_cdns_check_self_clearing_bits (cdns, __func__, true,INTEL_MASTER_RESET_ITERATIONS ); +schedule_delayed_work (&cdns->attach_dwork, +msecs_to_jiffies (SDW_INTEL_DELAYED_ENUMERATION_MS )); +return 0 ; }
@@ -151,6 +154,9 @@ int intel_start_bus_after_reset(struct sdw_intel *sdw) }sdw_cdns_check_self_clearing_bits (cdns, __func__, true,INTEL_MASTER_RESET_ITERATIONS ); +schedule_delayed_work (&cdns->attach_dwork, +msecs_to_jiffies (SDW_INTEL_DELAYED_ENUMERATION_MS )); +return 0 ; }
@@ -184,6 +190,9 @@ int intel_start_bus_after_clock_stop(struct sdw_intel *sdw)sdw_cdns_check_self_clearing_bits (cdns, __func__, true,INTEL_MASTER_RESET_ITERATIONS ); +schedule_delayed_work (&cdns->attach_dwork, +msecs_to_jiffies (SDW_INTEL_DELAYED_ENUMERATION_MS )); +return 0 ; }
@@ -194,6 +203,8 @@ int intel_stop_bus(struct sdw_intel *sdw, bool clock_stop)bool wake_enable = false;int ret; +cancel_delayed_work_sync (&cdns->attach_dwork); +if (clock_stop) { ret =sdw_cdns_clock_stop (cdns, true);if (ret <0 )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 84/213 riscv/kexec_file: Fix relocation type R_RISCV_ADD16 and R_RISCV_SUB16 unknown
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ying Sun <[email protected]>
[ Upstream commit c6ebf2c528470a09be77d0d9df2c6617ea037ac5 ]
Runs on the kernel with CONFIG_RISCV_ALTERNATIVE enabled:
kexec -sl vmlinux
Error:
kexec_image: Unknown rela relocation: 34
kexec_image: Error loading purgatory ret=-8
and
kexec_image: Unknown rela relocation: 38
kexec_image: Error loading purgatory ret=-8
The purgatory code uses the 16-bit addition and subtraction relocation type, but not handled, resulting in kexec_file_load failure. So add handle to arch_kexec_apply_relocations_add().
Tested on RISC-V64 Qemu-virt, issue fixed.
--- arch/riscv/kernel/elf_kexec.c | 6 ++++++ 1 file changed, 6 insertions(+)
arch/riscv/kernel/elf_kexec.c +6 -0
@@ -444,6 +444,12 @@ int arch_kexec_apply_relocations_add(struct purgatory_info *pi, *(u32 *)loc =CLEAN_IMM (CJTYPE , *(u32 *)loc) |ENCODE_CJTYPE_IMM (val - addr);break ; +case R_RISCV_ADD16 : + *(u16 *)loc += val; +break ; +case R_RISCV_SUB16 : + *(u16 *)loc -= val; +break ;case R_RISCV_ADD32 : *(u32 *)loc += val;break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 85/213 media: videobuf2-core: clear memory related fields in __vb2_plane_dmabuf_put()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yunke Cao <[email protected]>
[ Upstream commit 6a9c97ab6b7e85697e0b74e86062192a5ffffd99 ]
Clear vb2_plane's memory related fields in __vb2_plane_dmabuf_put(), including bytesused, length, fd and data_offset.
Remove the duplicated code in __prepare_dmabuf().
--- drivers/media/common/videobuf2/videobuf2-core.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/media/common/videobuf2/videobuf2-core.c +4 -4
@@ -302,6 +302,10 @@ static void __vb2_plane_dmabuf_put(struct vb2_buffer *vb, struct vb2_plane *p) p->mem_priv =NULL ; p->dbuf =NULL ; p->dbuf_mapped =0 ; + p->bytesused =0 ; + p->length =0 ; + p->m.fd =0 ; + p->data_offset =0 ; }/*
@@ -1296,10 +1300,6 @@ static int __prepare_dmabuf(struct vb2_buffer *vb)/* Release previously acquired memory if present */ __vb2_plane_dmabuf_put (vb, &vb->planes[plane]); - vb->planes[plane].bytesused =0 ; - vb->planes[plane].length =0 ; - vb->planes[plane].m.fd =0 ; - vb->planes[plane].data_offset =0 ;/* Acquire each plane's memory */ mem_priv = call_ptr_memop(attach_dmabuf,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 86/213 remoteproc: imx_rproc: Use imx specific hook for find_loaded_rsc_table
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <[email protected]>
[ Upstream commit e954a1bd16102abc800629f9900715d8ec4c3130 ]
If there is a resource table device tree node, use the address as the resource table address, otherwise use the address(where .resource_table section loaded) inside the Cortex-M elf file.
And there is an update in NXP SDK that Resource Domain Control(RDC) enabled to protect TCM, linux not able to write the TCM space when updating resource table status and cause kernel dump. So use the address from device tree could avoid kernel dump.
Note: NXP M4 SDK not check resource table update, so it does not matter use whether resource table address specified in elf file or in device tree. But to reflect the fact that if people specific resource table address in device tree, it means people are aware and going to use it, not the address specified in elf file.
--- drivers/remoteproc/imx_rproc.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
drivers/remoteproc/imx_rproc.c +12 -1
@@ -669,6 +669,17 @@ static struct resource_table *imx_rproc_get_loaded_rsc_table(struct rproc *rprocreturn (struct resource_table *)priv->rsc_table; } +static struct resource_table * +imx_rproc_elf_find_loaded_rsc_table (struct rproc *rproc,const struct firmware *fw) +{ +struct imx_rproc *priv = rproc->priv; + +if (priv->rsc_table) +return (struct resource_table *)priv->rsc_table; + +return rproc_elf_find_loaded_rsc_table (rproc, fw); +} +static const struct rproc_ops imx_rproc_ops = { .prepare = imx_rproc_prepare, .attach = imx_rproc_attach,
@@ -679,7 +690,7 @@ static const struct rproc_ops imx_rproc_ops = { .da_to_va = imx_rproc_da_to_va, .load = rproc_elf_load_segments, .parse_fw = imx_rproc_parse_fw, - .find_loaded_rsc_table = rproc_elf_find_loaded_rsc_table, + .find_loaded_rsc_table = imx_rproc_elf_find_loaded_rsc_table, .get_loaded_rsc_table = imx_rproc_get_loaded_rsc_table, .sanity_check = rproc_elf_sanity_check, .get_boot_addr = rproc_elf_get_boot_addr,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 87/213 clk: imx: Remove CLK_SET_PARENT_GATE for DRAM mux for i.MX7D
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <[email protected]>
[ Upstream commit a54c441b46a0745683c2eef5a359d22856d27323 ]
For i.MX7D DRAM related mux clock, the clock source change should ONLY be done done in low level asm code without accessing DRAM, and then calling clk API to sync the HW clock status with clk tree, it should never touch real clock source switch via clk API, so CLK_SET_PARENT_GATE flag should NOT be added, otherwise, DRAM's clock parent will be disabled when DRAM is active, and system will hang.
--- drivers/clk/imx/clk-imx7d.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/clk/imx/clk-imx7d.c +2 -2
@@ -498,9 +498,9 @@ static void __init imx7d_clocks_init(struct device_node *ccm_node) hws[IMX7D_ENET_AXI_ROOT_SRC ] =imx_clk_hw_mux2_flags ("enet_axi_src" , base +0x8900 ,24 ,3 , enet_axi_sel,ARRAY_SIZE (enet_axi_sel),CLK_SET_PARENT_GATE ); hws[IMX7D_NAND_USDHC_BUS_ROOT_SRC ] =imx_clk_hw_mux2_flags ("nand_usdhc_src" , base +0x8980 ,24 ,3 , nand_usdhc_bus_sel,ARRAY_SIZE (nand_usdhc_bus_sel),CLK_SET_PARENT_GATE ); hws[IMX7D_DRAM_PHYM_ROOT_SRC ] =imx_clk_hw_mux2_flags ("dram_phym_src" , base +0x9800 ,24 ,1 , dram_phym_sel,ARRAY_SIZE (dram_phym_sel),CLK_SET_PARENT_GATE ); - hws[IMX7D_DRAM_ROOT_SRC ] =imx_clk_hw_mux2_flags ("dram_src" , base +0x9880 ,24 ,1 , dram_sel,ARRAY_SIZE (dram_sel),CLK_SET_PARENT_GATE ); + hws[IMX7D_DRAM_ROOT_SRC ] =imx_clk_hw_mux2 ("dram_src" , base +0x9880 ,24 ,1 , dram_sel,ARRAY_SIZE (dram_sel)); hws[IMX7D_DRAM_PHYM_ALT_ROOT_SRC ] =imx_clk_hw_mux2_flags ("dram_phym_alt_src" , base +0xa000 ,24 ,3 , dram_phym_alt_sel,ARRAY_SIZE (dram_phym_alt_sel),CLK_SET_PARENT_GATE ); - hws[IMX7D_DRAM_ALT_ROOT_SRC ] =imx_clk_hw_mux2_flags ("dram_alt_src" , base +0xa080 ,24 ,3 , dram_alt_sel,ARRAY_SIZE (dram_alt_sel),CLK_SET_PARENT_GATE ); + hws[IMX7D_DRAM_ALT_ROOT_SRC ] =imx_clk_hw_mux2 ("dram_alt_src" , base +0xa080 ,24 ,3 , dram_alt_sel,ARRAY_SIZE (dram_alt_sel)); hws[IMX7D_USB_HSIC_ROOT_SRC ] =imx_clk_hw_mux2_flags ("usb_hsic_src" , base +0xa100 ,24 ,3 , usb_hsic_sel,ARRAY_SIZE (usb_hsic_sel),CLK_SET_PARENT_GATE ); hws[IMX7D_PCIE_CTRL_ROOT_SRC ] =imx_clk_hw_mux2_flags ("pcie_ctrl_src" , base +0xa180 ,24 ,3 , pcie_ctrl_sel,ARRAY_SIZE (pcie_ctrl_sel),CLK_SET_PARENT_GATE ); hws[IMX7D_PCIE_PHY_ROOT_SRC ] =imx_clk_hw_mux2_flags ("pcie_phy_src" , base +0xa200 ,24 ,3 , pcie_phy_sel,ARRAY_SIZE (pcie_phy_sel),CLK_SET_PARENT_GATE );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 88/213 serial: protect uart_port_dtr_rts() in uart_shutdown() too
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Slaby (SUSE) <[email protected]>
[ Upstream commit 602babaa84d627923713acaf5f7e9a4369e77473 ]
Commit af224ca2df29 (serial: core: Prevent unsafe uart port access, part
3) added few uport == NULL checks. It added one to uart_shutdown(), so the commit assumes, uport can be NULL in there. But right after that protection, there is an unprotected "uart_port_dtr_rts(uport, false);" call. That is invoked only if HUPCL is set, so I assume that is the reason why we do not see lots of these reports.
Or it cannot be NULL at this point at all for some reason :P.
Until the above is investigated, stay on the safe side and move this dereference to the if too.
I got this inconsistency from Coverity under CID 1585130. Thanks.
--- drivers/tty/serial/serial_core.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
drivers/tty/serial/serial_core.c +9 -7
@@ -374,14 +374,16 @@ static void uart_shutdown(struct tty_struct *tty, struct uart_state *state)/* * Turn off DTR and RTS early. */ -if (uport &&uart_console (uport) && tty) { - uport->cons->cflag = tty->termios.c_cflag; - uport->cons->ispeed = tty->termios.c_ispeed; - uport->cons->ospeed = tty->termios.c_ospeed; - } +if (uport) { +if (uart_console (uport) && tty) { + uport->cons->cflag = tty->termios.c_cflag; + uport->cons->ispeed = tty->termios.c_ispeed; + uport->cons->ospeed = tty->termios.c_ospeed; + } -if (!tty ||C_HUPCL (tty)) -uart_port_dtr_rts (uport, false); +if (!tty ||C_HUPCL (tty)) +uart_port_dtr_rts (uport, false); + }uart_port_shutdown (port); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 89/213 usb: typec: tipd: Free IRQ only if it was requested before
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wadim Egorov <[email protected]>
[ Upstream commit db63d9868f7f310de44ba7bea584e2454f8b4ed0 ]
In polling mode, if no IRQ was requested there is no need to free it. Call devm_free_irq() only if client->irq is set. This fixes the warning caused by the tps6598x module removal:
WARNING: CPU: 2 PID: 333 at kernel/irq/devres.c:144 devm_free_irq+0x80/0x8c ... ... Call trace: devm_free_irq+0x80/0x8c tps6598x_remove+0x28/0x88 [tps6598x] i2c_device_remove+0x2c/0x9c device_remove+0x4c/0x80 device_release_driver_internal+0x1cc/0x228 driver_detach+0x50/0x98 bus_remove_driver+0x6c/0xbc driver_unregister+0x30/0x60 i2c_del_driver+0x54/0x64 tps6598x_i2c_driver_exit+0x18/0xc3c [tps6598x] __arm64_sys_delete_module+0x184/0x264 invoke_syscall+0x48/0x110 el0_svc_common.constprop.0+0xc8/0xe8 do_el0_svc+0x20/0x2c el0_svc+0x28/0x98 el0t_64_sync_handler+0x13c/0x158 el0t_64_sync+0x190/0x194
--- drivers/usb/typec/tipd/core.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/typec/tipd/core.c +2 -0
@@ -907,6 +907,8 @@ static void tps6598x_remove(struct i2c_client *client)if (!client->irq)cancel_delayed_work_sync (&tps->wq_poll); +else +devm_free_irq (tps->dev, client->irq, tps);tps6598x_disconnect (tps,0 );typec_unregister_port (tps->port);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 90/213 usb: chipidea: udc: enable suspend interrupt after usb reset
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Yang <[email protected]>
[ Upstream commit e4fdcc10092fb244218013bfe8ff01c55d54e8e4 ]
Currently, suspend interrupt is enabled before pullup enable operation. This will cause a suspend interrupt assert right after pullup DP. This suspend interrupt is meaningless, so this will ignore such interrupt by enable it after usb reset completed.
--- drivers/usb/chipidea/udc.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/usb/chipidea/udc.c +7 -1
@@ -86,7 +86,7 @@ static int hw_device_state(struct ci_hdrc *ci, u32 dma)hw_write (ci,OP_ENDPTLISTADDR , ~0 , dma);/* interrupt, error, port change, reset, sleep/suspend */ hw_write (ci,OP_USBINTR , ~0 , - USBi_UI|USBi_UEI|USBi_PCI|USBi_URI|USBi_SLI); + USBi_UI|USBi_UEI|USBi_PCI|USBi_URI); }else {hw_write (ci,OP_USBINTR , ~0 ,0 ); }
@@ -876,6 +876,7 @@ __releases(ci->lock) __acquires(ci->lock) {int retval; +u32 intr;spin_unlock (&ci->lock);if (ci->gadget.speed !=USB_SPEED_UNKNOWN )
@@ -889,6 +890,11 @@ __acquires(ci->lock)if (retval) goto done; +/* clear SLI */ +hw_write (ci,OP_USBSTS , USBi_SLI, USBi_SLI); + intr =hw_read (ci,OP_USBINTR , ~0 ); +hw_write (ci,OP_USBINTR , ~0 , intr | USBi_SLI); + ci->status =usb_ep_alloc_request (&ci->ep0in->ep,GFP_ATOMIC );if (ci->status ==NULL ) retval = -ENOMEM ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 91/213 usb: dwc2: Adjust the timing of USB Driver Interrupt Registration in the Crashkernel Scenario
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shawn Shao <[email protected]>
[ Upstream commit 4058c39bd176daf11a826802d940d86292a6b02b ]
The issue is that before entering the crash kernel, the DWC USB controller did not perform operations such as resetting the interrupt mask bits. After entering the crash kernel,before the USB interrupt handler registration was completed while loading the DWC USB driver,an GINTSTS_SOF interrupt was received.This triggered the misroute_irq process within the GIC handling framework,ultimately leading to the misrouting of the interrupt,causing it to be handled by the wrong interrupt handler and resulting in the issue.
Summary:In a scenario where the kernel triggers a panic and enters the crash kernel,it is necessary to ensure that the interrupt mask bit is not enabled before the interrupt registration is complete. If an interrupt reaches the CPU at this moment,it will certainly not be handled correctly,especially in cases where this interrupt is reported frequently.
Please refer to the Crashkernel dmesg information as follows (the message on line 3 was added before devm_request_irq is called by the dwc2_driver_probe function):
[ 5.866837][ T1] dwc2 JMIC0010:01: supply vusb_d not found, using dummy regulator [ 5.874588][ T1] dwc2 JMIC0010:01: supply vusb_a not found, using dummy regulator [ 5.882335][ T1] dwc2 JMIC0010:01: before devm_request_irq irq: [71], gintmsk[0xf300080e], gintsts[0x04200009] [ 5.892686][ C0] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.10.0-jmnd1.2_RC #18 [ 5.900327][ C0] Hardware name: CMSS HyperCard4-25G/HyperCard4-25G, BIOS 1.6.4 Jul 8 2024 [ 5.908836][ C0] Call trace: [ 5.911965][ C0] dump_backtrace+0x0/0x1f0 [ 5.916308][ C0] show_stack+0x20/0x30 [ 5.920304][ C0] dump_stack+0xd8/0x140 [ 5.924387][ C0] pcie_xxx_handler+0x3c/0x1d8 [ 5.930121][ C0] __handle_irq_event_percpu+0x64/0x1e0 [ 5.935506][ C0] handle_irq_event+0x80/0x1d0 [ 5.940109][ C0] try_one_irq+0x138/0x174 [ 5.944365][ C0] misrouted_irq+0x134/0x140 [ 5.948795][ C0] note_interrupt+0x1d0/0x30c [ 5.953311][ C0] handle_irq_event+0x13c/0x1d0 [ 5.958001][ C0] handle_fasteoi_irq+0xd4/0x260 [ 5.962779][ C0] __handle_domain_irq+0x88/0xf0 [ 5.967555][ C0] gic_handle_irq+0x9c/0x2f0 [ 5.971985][ C0] el1_irq+0xb8/0x140 [ 5.975807][ C0] __setup_irq+0x3dc/0x7cc [ 5.980064][ C0] request_threaded_irq+0xf4/0x1b4 [ 5.985015][ C0] devm_request_threaded_irq+0x80/0x100 [ 5.990400][ C0] dwc2_driver_probe+0x1b8/0x6b0 [ 5.995178][ C0] platform_drv_probe+0x5c/0xb0 [ 5.999868][ C0] really_probe+0xf8/0x51c [ 6.004125][ C0] driver_probe_device+0xfc/0x170 [ 6.008989][ C0] device_driver_attach+0xc8/0xd0 [ 6.013853][ C0] __driver_attach+0xe8/0x1b0 [ 6.018369][ C0] bus_for_each_dev+0x7c/0xdc [ 6.022886][ C0] driver_attach+0x2c/0x3c [ 6.027143][ C0] bus_add_driver+0xdc/0x240 [ 6.031573][ C0] driver_register+0x80/0x13c [ 6.036090][ C0] __platform_driver_register+0x50/0x5c [ 6.041476][ C0] dwc2_platform_driver_init+0x24/0x30 [ 6.046774][ C0] do_one_initcall+0x50/0x25c [ 6.051291][ C0] do_initcall_level+0xe4/0xfc [ 6.055894][ C0] do_initcalls+0x80/0xa4 [ 6.060064][ C0] kernel_init_freeable+0x198/0x240 [ 6.065102][ C0] kernel_init+0x1c/0x12c
--- drivers/usb/dwc2/platform.c | 26 ++++++++++++++------------ 1 file changed, 14 insertions(+), 12 deletions(-)
drivers/usb/dwc2/platform.c +14 -12
@@ -469,18 +469,6 @@ static int dwc2_driver_probe(struct platform_device *dev)spin_lock_init (&hsotg->lock); - hsotg->irq =platform_get_irq (dev,0 ); -if (hsotg->irq <0 ) -return hsotg->irq; - -dev_dbg (hsotg->dev,"registering common handler for irq%d\n" , - hsotg->irq); - retval =devm_request_irq (hsotg->dev, hsotg->irq, - dwc2_handle_common_intr,IRQF_SHARED , -dev_name (hsotg->dev), hsotg); -if (retval) -return retval; - hsotg->vbus_supply =devm_regulator_get_optional (hsotg->dev,"vbus" );if (IS_ERR (hsotg->vbus_supply)) { retval =PTR_ERR (hsotg->vbus_supply);
@@ -524,6 +512,20 @@ static int dwc2_driver_probe(struct platform_device *dev)if (retval) goto error; + hsotg->irq =platform_get_irq (dev,0 ); +if (hsotg->irq <0 ) { + retval = hsotg->irq; + goto error; + } + +dev_dbg (hsotg->dev,"registering common handler for irq%d\n" , + hsotg->irq); + retval =devm_request_irq (hsotg->dev, hsotg->irq, + dwc2_handle_common_intr,IRQF_SHARED , +dev_name (hsotg->dev), hsotg); +if (retval) + goto error; +/* * For OTG cores, set the force mode bits to reflect the value * of dr_mode. Force mode bits should not be touched at any
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 92/213 comedi: ni_routing: tools: Check when the file could not be opened
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruffalo Lavoisier <[email protected]>
[ Upstream commit 5baeb157b341b1d26a5815aeaa4d3bb9e0444fda ]
- After fopen check NULL before using the file pointer use
--- drivers/comedi/drivers/ni_routing/tools/convert_c_to_py.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/comedi/drivers/ni_routing/tools/convert_c_to_py.c +5 -0
@@ -140,6 +140,11 @@ int main(void) {FILE *fp =fopen ("ni_values.py" ,"w" ); +if (fp ==NULL ) { +fprintf (stderr,"Could not open file!" ); +return -1 ; + } +/* write route register values */ fprintf (fp,"ni_route_values = {\n" );for (int i =0 ; ni_all_route_values[i]; ++i)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 93/213 LoongArch: Fix memleak in pci_acpi_scan_root()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Guan <[email protected]>
[ Upstream commit 5016c3a31a6d74eaf2fdfdec673eae8fcf90379e ]
Add kfree(root_ops) in this case to avoid memleak of root_ops, leaks when pci_find_bus() != 0.
--- arch/loongarch/pci/acpi.c | 1 + 1 file changed, 1 insertion(+)
arch/loongarch/pci/acpi.c +1 -0
@@ -225,6 +225,7 @@ struct pci_bus *pci_acpi_scan_root(struct acpi_pci_root *root)if (bus) {memcpy (bus->sysdata, info->cfg,sizeof (struct pci_config_window ));kfree (info); +kfree (root_ops); }else {struct pci_bus *child;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 94/213 netfilter: nf_nat: dont try nat source port reallocation for reverse dir clash
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit d8f84a9bc7c4e07fdc4edc00f9e868b8db974ccb ]
A conntrack entry can be inserted to the connection tracking table if there is no existing entry with an identical tuple in either direction.
Example:
INITIATOR -> NAT/PAT -> RESPONDER
Initiator passes through NAT/PAT ("us") and SNAT is done (saddr rewrite). Then, later, NAT/PAT machine itself also wants to connect to RESPONDER.
This will not work if the SNAT done earlier has same IP:PORT source pair.
Conntrack table has:
ORIGINAL: $IP_INITATOR:$SPORT -> $IP_RESPONDER:$DPORT REPLY: $IP_RESPONDER:$DPORT -> $IP_NAT:$SPORT
and new locally originating connection wants:
ORIGINAL: $IP_NAT:$SPORT -> $IP_RESPONDER:$DPORT REPLY: $IP_RESPONDER:$DPORT -> $IP_NAT:$SPORT
This is handled by the NAT engine which will do a source port reallocation for the locally originating connection that is colliding with an existing tuple by attempting a source port rewrite.
This is done even if this new connection attempt did not go through a masquerade/snat rule.
There is a rare race condition with connection-less protocols like UDP, where we do the port reallocation even though its not needed.
This happens when new packets from the same, pre-existing flow are received in both directions at the exact same time on different CPUs after the conntrack table was flushed (or conntrack becomes active for first time).
With strict ordering/single cpu, the first packet creates new ct entry and second packet is resolved as established reply packet.
With parallel processing, both packets are picked up as new and both get their own ct entry.
In this case, the 'reply' packet (picked up as ORIGINAL) can be mangled by NAT engine because a port collision is detected.
This change isn't enough to prevent a packet drop later during nf_conntrack_confirm(), the existing clash resolution strategy will not detect such reverse clash case. This is resolved by a followup patch.
--- net/netfilter/nf_nat_core.c | 120 +++++++++++++++++++++++++++++++++++- 1 file changed, 118 insertions(+), 2 deletions(-)
net/netfilter/nf_nat_core.c +118 -2
@@ -183,7 +183,35 @@ hash_by_src(const struct net *net,return reciprocal_scale (hash, nf_nat_htable_size); } -/* Is this tuple already taken? (not by us) */ +/** +* nf_nat_used_tuple - check if proposed nat tuple clashes with existing entry +* @tuple: proposed NAT binding +* @ignored_conntrack: our (unconfirmed) conntrack entry +* +* A conntrack entry can be inserted to the connection tracking table +* if there is no existing entry with an identical tuple in either direction. +* +* Example: +* INITIATOR -> NAT/PAT -> RESPONDER +* +* INITIATOR passes through NAT/PAT ("us") and SNAT is done (saddr rewrite). +* Then, later, NAT/PAT itself also connects to RESPONDER. +* +* This will not work if the SNAT done earlier has same IP:PORT source pair. +* +* Conntrack table has: +* ORIGINAL: $IP_INITIATOR:$SPORT -> $IP_RESPONDER:$DPORT +* REPLY: $IP_RESPONDER:$DPORT -> $IP_NAT:$SPORT +* +* and new locally originating connection wants: +* ORIGINAL: $IP_NAT:$SPORT -> $IP_RESPONDER:$DPORT +* REPLY: $IP_RESPONDER:$DPORT -> $IP_NAT:$SPORT +* +* ... which would mean incoming packets cannot be distinguished between +* the existing and the newly added entry (identical IP_CT_DIR_REPLY tuple). +* +* @return: true if the proposed NAT mapping collides with an existing entry. +*/ static int nf_nat_used_tuple (const struct nf_conntrack_tuple *tuple,const struct nf_conn *ignored_conntrack)
@@ -200,6 +228,94 @@ nf_nat_used_tuple(const struct nf_conntrack_tuple *tuple,return nf_conntrack_tuple_taken (&reply, ignored_conntrack); } +static bool nf_nat_allow_clash (const struct nf_conn *ct) +{ +return nf_ct_l4proto_find (nf_ct_protonum (ct))->allow_clash; +} + +/** +* nf_nat_used_tuple_new - check if to-be-inserted conntrack collides with existing entry +* @tuple: proposed NAT binding +* @ignored_ct: our (unconfirmed) conntrack entry +* +* Same as nf_nat_used_tuple, but also check for rare clash in reverse +* direction. Should be called only when @tuple has not been altered, i.e. +* @ignored_conntrack will not be subject to NAT. +* +* @return: true if the proposed NAT mapping collides with existing entry. +*/ +static noinline bool +nf_nat_used_tuple_new (const struct nf_conntrack_tuple *tuple, +const struct nf_conn *ignored_ct) +{ +static const unsigned long uses_nat =IPS_NAT_MASK |IPS_SEQ_ADJUST_BIT ; +const struct nf_conntrack_tuple_hash *thash; +const struct nf_conntrack_zone *zone; +struct nf_conn *ct; +bool taken = true; +struct net *net; + +if (!nf_nat_used_tuple (tuple, ignored_ct)) +return false; + +if (!nf_nat_allow_clash (ignored_ct)) +return true; + +/* Initial choice clashes with existing conntrack. +* Check for (rare) reverse collision. +* +* This can happen when new packets are received in both directions +* at the exact same time on different CPUs. +* +* Without SMP, first packet creates new conntrack entry and second +* packet is resolved as established reply packet. +* +* With parallel processing, both packets could be picked up as +* new and both get their own ct entry allocated. +* +* If ignored_conntrack and colliding ct are not subject to NAT then +* pretend the tuple is available and let later clash resolution +* handle this at insertion time. +* +* Without it, the 'reply' packet has its source port rewritten +* by nat engine. +*/ +if (READ_ONCE (ignored_ct->status) & uses_nat) +return true; + + net =nf_ct_net (ignored_ct); + zone =nf_ct_zone (ignored_ct); + + thash =nf_conntrack_find_get (net, zone, tuple); +if (unlikely (!thash))/* clashing entry went away */ +return false; + + ct =nf_ct_tuplehash_to_ctrack (thash); + +/* NB: IP_CT_DIR_ORIGINAL should be impossible because +* nf_nat_used_tuple() handles origin collisions. +* +* Handle remote chance other CPU confirmed its ct right after. +*/ +if (thash->tuple.dst.dir !=IP_CT_DIR_REPLY ) + goto out; + +/* clashing connection subject to NAT? Retry with new tuple. */ +if (READ_ONCE (ct->status) & uses_nat) + goto out; + +if (nf_ct_tuple_equal (&ct->tuplehash[IP_CT_DIR_ORIGINAL ].tuple, + &ignored_ct->tuplehash[IP_CT_DIR_REPLY ].tuple) && +nf_ct_tuple_equal (&ct->tuplehash[IP_CT_DIR_REPLY ].tuple, + &ignored_ct->tuplehash[IP_CT_DIR_ORIGINAL ].tuple)) { + taken = false; + goto out; + } +out: +nf_ct_put (ct); +return taken; +} +static bool nf_nat_may_kill (struct nf_conn *ct,unsigned long flags) { static const unsigned long flags_refuse = IPS_FIXED_TIMEOUT |
@@ -608,7 +724,7 @@ get_unique_tuple(struct nf_conntrack_tuple *tuple, !(range->flags & NF_NAT_RANGE_PROTO_RANDOM_ALL)) {/* try the original tuple first */ if (nf_in_range (orig_tuple, range)) { -if (!nf_nat_used_tuple (orig_tuple, ct)) { +if (!nf_nat_used_tuple_new (orig_tuple, ct)) { *tuple = *orig_tuple;return ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 95/213 netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Horman <[email protected]>
[ Upstream commit fc56878ca1c288e49b5cbb43860a5938e3463654 ]
If CONFIG_BRIDGE_NETFILTER is not enabled, which is the case for x86_64 defconfig, then building nf_reject_ipv4.c and nf_reject_ipv6.c with W=1 using gcc-14 results in the following warnings, which are treated as errors:
net/ipv4/netfilter/nf_reject_ipv4.c: In function 'nf_send_reset':net/ipv4/netfilter/nf_reject_ipv4.c:243:23: error: variable 'niph' set but not used [-Werror=unused-but-set-variable]
243 | struct iphdr *niph;
| ^~~~
cc1: all warnings being treated as errorsnet/ipv6/netfilter/nf_reject_ipv6.c: In function 'nf_send_reset6':net/ipv6/netfilter/nf_reject_ipv6.c:286:25: error: variable 'ip6h' set but not used [-Werror=unused-but-set-variable]
286 | struct ipv6hdr *ip6h;
| ^~~~
cc1: all warnings being treated as errors
Address this by reducing the scope of these local variables to where they are used, which is code only compiled when CONFIG_BRIDGE_NETFILTER enabled.
Compile tested and run through netfilter selftests.
--- net/ipv4/netfilter/nf_reject_ipv4.c | 10 ++++------ net/ipv6/netfilter/nf_reject_ipv6.c | 5 ++--- 2 files changed, 6 insertions(+), 9 deletions(-)
net/ipv4/netfilter/nf_reject_ipv4.c +4 -6
@@ -239,9 +239,8 @@ static int nf_reject_fill_skb_dst(struct sk_buff *skb_in)void nf_send_reset (struct net *net,struct sock *sk,struct sk_buff *oldskb,int hook) { -struct sk_buff *nskb; -struct iphdr *niph;const struct tcphdr *oth; +struct sk_buff *nskb;struct tcphdr _oth; oth =nf_reject_ip_tcphdr_get (oldskb, &_oth, hook);
@@ -266,14 +265,12 @@ void nf_send_reset(struct net *net, struct sock *sk, struct sk_buff *oldskb, nskb->mark =IP4_REPLY_MARK (net, oldskb->mark);skb_reserve (nskb,LL_MAX_HEADER ); - niph =nf_reject_iphdr_put (nskb, oldskb,IPPROTO_TCP , -ip4_dst_hoplimit (skb_dst (nskb))); +nf_reject_iphdr_put (nskb, oldskb,IPPROTO_TCP , +ip4_dst_hoplimit (skb_dst (nskb)));nf_reject_ip_tcphdr_put (nskb, oldskb, oth);if (ip_route_me_harder (net, sk, nskb,RTN_UNSPEC )) goto free_nskb; - niph =ip_hdr (nskb); -/* "Never happens" */ if (nskb->len >dst_mtu (skb_dst (nskb))) goto free_nskb;
@@ -290,6 +287,7 @@ void nf_send_reset(struct net *net, struct sock *sk, struct sk_buff *oldskb,*/ if (nf_bridge_info_exists (oldskb)) {struct ethhdr *oeth =eth_hdr (oldskb); +struct iphdr *niph =ip_hdr (nskb);struct net_device *br_indev; br_indev =nf_bridge_get_physindev (oldskb, net);
net/ipv6/netfilter/nf_reject_ipv6.c +2 -3
@@ -273,7 +273,6 @@ void nf_send_reset6(struct net *net, struct sock *sk, struct sk_buff *oldskb,const struct tcphdr *otcph;unsigned int otcplen, hh_len;const struct ipv6hdr *oip6h =ipv6_hdr (oldskb); -struct ipv6hdr *ip6h;struct dst_entry *dst =NULL ;struct flowi6 fl6;
@@ -329,8 +328,7 @@ void nf_send_reset6(struct net *net, struct sock *sk, struct sk_buff *oldskb, nskb->mark = fl6.flowi6_mark;skb_reserve (nskb, hh_len + dst->header_len); - ip6h =nf_reject_ip6hdr_put (nskb, oldskb,IPPROTO_TCP , -ip6_dst_hoplimit (dst)); +nf_reject_ip6hdr_put (nskb, oldskb,IPPROTO_TCP ,ip6_dst_hoplimit (dst));nf_reject_ip6_tcphdr_put (nskb, oldskb, otcph, otcplen);nf_ct_attach (nskb, oldskb);
@@ -345,6 +343,7 @@ void nf_send_reset6(struct net *net, struct sock *sk, struct sk_buff *oldskb,*/ if (nf_bridge_info_exists (oldskb)) {struct ethhdr *oeth =eth_hdr (oldskb); +struct ipv6hdr *ip6h =ipv6_hdr (nskb);struct net_device *br_indev; br_indev =nf_bridge_get_physindev (oldskb, net);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 96/213 virtio_pmem: Check device status before requesting flush
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philip Chen <[email protected]>
[ Upstream commit e25fbcd97cf52c3c9824d44b5c56c19673c3dd50 ]
If a pmem device is in a bad status, the driver side could wait for host ack forever in virtio_pmem_flush(), causing the system to hang.
So add a status check in the beginning of virtio_pmem_flush() to return early if the device is not activated.
Message-Id: <[email protected]>
--- drivers/nvdimm/nd_virtio.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/nvdimm/nd_virtio.c +9 -0
@@ -44,6 +44,15 @@ static int virtio_pmem_flush(struct nd_region *nd_region)unsigned long flags;int err, err1; +/* +* Don't bother to submit the request to the device if the device is +* not activated. +*/ +if (vdev->config->get_status (vdev) &VIRTIO_CONFIG_S_NEEDS_RESET ) { +dev_info (&vdev->dev,"virtio pmem device needs a reset\n" ); +return -EIO ; + } +might_sleep (); req_data =kmalloc (sizeof (*req_data),GFP_KERNEL );if (!req_data)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 97/213 tools/iio: Add memory allocation failure check for trigger_name
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhu Jun <[email protected]>
[ Upstream commit 3c6b818b097dd6932859bcc3d6722a74ec5931c1 ]
Added a check to handle memory allocation failure for trigger_name and return -ENOMEM.
--- tools/iio/iio_generic_buffer.c | 4 ++++ 1 file changed, 4 insertions(+)
tools/iio/iio_generic_buffer.c +4 -0
@@ -498,6 +498,10 @@ int main(int argc, char **argv)return -ENOMEM ; } trigger_name =malloc (IIO_MAX_NAME_LENGTH ); +if (!trigger_name) { + ret = -ENOMEM ; + goto error; + } ret =read_sysfs_string ("name" , trig_dev_name, trigger_name);free (trig_dev_name);if (ret <0 ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 98/213 staging: vme_user: added bound check to geoid
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Riyan Dhiman <[email protected]>
[ Upstream commit a8a8b54350229f59c8ba6496fb5689a1632a59be ]
The geoid is a module parameter that allows users to hardcode the slot number. A bound check for geoid was added in the probe function because only values between 0 and less than VME_MAX_SLOT are valid.
--- drivers/staging/vme_user/vme_fake.c | 6 ++++++ drivers/staging/vme_user/vme_tsi148.c | 6 ++++++ 2 files changed, 12 insertions(+)
drivers/staging/vme_user/vme_fake.c +6 -0
@@ -1064,6 +1064,12 @@ static int __init fake_init(void)struct vme_slave_resource *slave_image;struct vme_lm_resource *lm; +if (geoid <0 || geoid >=VME_MAX_SLOTS ) { +pr_err ("VME geographical address must be between 0 and %d (exclusive), but got %d\n" , +VME_MAX_SLOTS , geoid); +return -EINVAL ; + } +/* We need a fake parent device */ vme_root =root_device_register ("vme" );if (IS_ERR (vme_root))
drivers/staging/vme_user/vme_tsi148.c +6 -0
@@ -2252,6 +2252,12 @@ static int tsi148_probe(struct pci_dev *pdev, const struct pci_device_id *id)struct vme_dma_resource *dma_ctrlr;struct vme_lm_resource *lm; +if (geoid <0 || geoid >=VME_MAX_SLOTS ) { +dev_err (&pdev->dev,"VME geographical address must be between 0 and %d (exclusive), but got %d\n" , +VME_MAX_SLOTS , geoid); +return -EINVAL ; + } +/* If we want to support more than one of each bridge, we need to * dynamically generate this so we get one per device */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 99/213 driver core: bus: Fix double free in driver API bus_register()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijun Hu <[email protected]>
[ Upstream commit bfa54a793ba77ef696755b66f3ac4ed00c7d1248 ]
For bus_register(), any error which happens after kset_register() will cause that @priv are freed twice, fixed by setting @priv with NULL after the first free.
--- drivers/base/bus.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/base/bus.c +2 -0
@@ -920,6 +920,8 @@ int bus_register(const struct bus_type *bus)bus_remove_file (bus, &bus_attr_uevent); bus_uevent_fail:kset_unregister (&priv->subsys); +/* Above kset_unregister() will kfree @priv */ + priv =NULL ; out:kfree (priv);return retval;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 100/213 driver core: bus: Return -EIO instead of 0 when show/store invalid bus attribute
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijun Hu <[email protected]>
[ Upstream commit c0fd973c108cdc22a384854bc4b3e288a9717bb2 ]
Return -EIO instead of 0 for below erroneous bus attribute operations:
- read a bus attribute without show().
- write a bus attribute without store().
--- drivers/base/bus.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/base/bus.c +4 -2
@@ -152,7 +152,8 @@ static ssize_t bus_attr_show(struct kobject *kobj, struct attribute *attr, {struct bus_attribute *bus_attr =to_bus_attr (attr);struct subsys_private *subsys_priv =to_subsys_private (kobj); -ssize_t ret =0 ; +/* return -EIO for reading a bus attribute without show() */ +ssize_t ret = -EIO ;if (bus_attr->show) ret = bus_attr->show (subsys_priv->bus, buf);
@@ -164,7 +165,8 @@ static ssize_t bus_attr_store(struct kobject *kobj, struct attribute *attr, {struct bus_attribute *bus_attr =to_bus_attr (attr);struct subsys_private *subsys_priv =to_subsys_private (kobj); -ssize_t ret =0 ; +/* return -EIO for writing a bus attribute without store() */ +ssize_t ret = -EIO ;if (bus_attr->store) ret = bus_attr->store (subsys_priv->bus, buf, count);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 101/213 scsi: lpfc: Add ELS_RSP cmd to the list of WQEs to flush in lpfc_els_flush_cmd()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit 93bcc5f3984bf4f51da1529700aec351872dbfff ]
During HBA stress testing, a spam of received PLOGIs exposes a resource recovery bug causing leakage of lpfc_sqlq entries from the global phba->sli4_hba.lpfc_els_sgl_list.
The issue is in lpfc_els_flush_cmd(), where the driver attempts to recover outstanding ELS sgls when walking the txcmplq. Only CMD_ELS_REQUEST64_CRs and CMD_GEN_REQUEST64_CRs are added to the abort and cancel lists. A check for CMD_XMIT_ELS_RSP64_WQE is missing in order to recover LS_ACC usages of the phba->sli4_hba.lpfc_els_sgl_list too.
Fix by adding CMD_XMIT_ELS_RSP64_WQE as part of the txcmplq walk when adding WQEs to the abort and cancel list in lpfc_els_flush_cmd(). Also, update naming convention from CRs to WQEs.
--- drivers/scsi/lpfc/lpfc_els.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/scsi/lpfc/lpfc_els.c +4 -3
@@ -9649,11 +9649,12 @@ lpfc_els_flush_cmd(struct lpfc_vport *vport)if (piocb->cmd_flag &LPFC_DRIVER_ABORTED && !mbx_tmo_err)continue ; -/* On the ELS ring we can have ELS_REQUESTs or -* GEN_REQUESTs waiting for a response. +/* On the ELS ring we can have ELS_REQUESTs, ELS_RSPs, +* or GEN_REQUESTs waiting for a CQE response. */ ulp_command =get_job_cmnd (phba, piocb); -if (ulp_command ==CMD_ELS_REQUEST64_CR ) { +if (ulp_command ==CMD_ELS_REQUEST64_WQE || + ulp_command ==CMD_XMIT_ELS_RSP64_WQE ) {list_add_tail (&piocb->dlist, &abort_list);/* If the link is down when flushing ELS commands
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 102/213 scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit 0a3c84f71680684c1d41abb92db05f95c09111e8 ]
Deleting an NPIV instance requires all fabric ndlps to be released before an NPIV's resources can be torn down. Failure to release fabric ndlps beforehand opens kref imbalance race conditions. Fix by forcing the DA_ID to complete synchronously with usage of wait_queue.
--- drivers/scsi/lpfc/lpfc_ct.c | 12 ++++++++++ drivers/scsi/lpfc/lpfc_disc.h | 7 ++++++ drivers/scsi/lpfc/lpfc_vport.c | 43 ++++++++++++++++++++++++++++------ 3 files changed, 55 insertions(+), 7 deletions(-)
drivers/scsi/lpfc/lpfc_ct.c +12 -0
@@ -1671,6 +1671,18 @@ lpfc_cmpl_ct(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, } out: +/* If the caller wanted a synchronous DA_ID completion, signal the +* wait obj and clear flag to reset the vport. +*/ +if (ndlp->save_flags &NLP_WAIT_FOR_DA_ID ) { +if (ndlp->da_id_waitq) +wake_up (ndlp->da_id_waitq); + } + +spin_lock_irq (&ndlp->lock); + ndlp->save_flags &= ~NLP_WAIT_FOR_DA_ID ; +spin_unlock_irq (&ndlp->lock); +lpfc_ct_free_iocb (phba, cmdiocb);lpfc_nlp_put (ndlp);return ;
drivers/scsi/lpfc/lpfc_disc.h +7 -0
@@ -90,6 +90,8 @@ enum lpfc_nlp_save_flags {NLP_IN_RECOV_POST_DEV_LOSS =0x1 ,/* wait for outstanding LOGO to cmpl */ NLP_WAIT_FOR_LOGO =0x2 , +/* wait for outstanding DA_ID to finish */ +NLP_WAIT_FOR_DA_ID =0x4 }; struct lpfc_nodelist {
@@ -159,7 +161,12 @@ struct lpfc_nodelist {uint32_t nvme_fb_size;/* NVME target's supported byte cnt */ #define NVME_FB_BIT_SHIFT 9/* PRLI Rsp first burst in 512B units. */ uint32_t nlp_defer_did; + +/* These wait objects are NPIV specific. These IOs must complete +* synchronously. +*/ wait_queue_head_t *logo_waitq; +wait_queue_head_t *da_id_waitq; };struct lpfc_node_rrq {
drivers/scsi/lpfc/lpfc_vport.c +36 -7
63 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 103/213 drm/amd/display: Check null pointer before dereferencing se
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit ff599ef6970ee000fa5bc38d02fa5ff5f3fc7575 ]
[WHAT & HOW]
se is null checked previously in the same function, indicating it might be null; therefore, it must be checked when used again.
This fixes 1 FORWARD_NULL issue reported by Coverity.
--- drivers/gpu/drm/amd/display/dc/core/dc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/core/dc.c +1 -1
@@ -1691,7 +1691,7 @@ bool dc_validate_boot_timing(const struct dc *dc,if (crtc_timing->pix_clk_100hz != pix_clk_100hz)return false; -if (!se->funcs->dp_get_pixel_format) +if (!se || !se->funcs->dp_get_pixel_format)return false; if (!se->funcs->dp_get_pixel_format(
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 104/213 fbcon: Fix a NULL pointer dereference issue in fbcon_putcs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianqiang Liu <[email protected]>
[ Upstream commit 5b97eebcce1b4f3f07a71f635d6aa3af96c236e7 ]
syzbot has found a NULL pointer dereference bug in fbcon. Here is the simplified C reproducer:
struct param {
uint8_t type;
struct tiocl_selection ts;
};int main()
{
struct fb_con2fbmap con2fb;
struct param param;
int fd = open("/dev/fb1", 0, 0);
con2fb.console = 0x19;
con2fb.framebuffer = 0;
ioctl(fd, FBIOPUT_CON2FBMAP, &con2fb);
param.type = 2;
param.ts.xs = 0; param.ts.ys = 0;
param.ts.xe = 0; param.ts.ye = 0;
param.ts.sel_mode = 0;
int fd1 = open("/dev/tty1", O_RDWR, 0);
ioctl(fd1, TIOCLINUX, ¶m);
con2fb.console = 1;
con2fb.framebuffer = 0;
ioctl(fd, FBIOPUT_CON2FBMAP, &con2fb);
return 0;
}After calling ioctl(fd1, TIOCLINUX, ¶m), the subsequent ioctl(fd, FBIOPUT_CON2FBMAP, &con2fb) causes the kernel to follow a different execution path:
set_con2fb_map
-> con2fb_init_display
-> fbcon_set_disp
-> redraw_screen
-> hide_cursor
-> clear_selection
-> highlight
-> invert_screen
-> do_update_region
-> fbcon_putcs
-> ops->putcsSince ops->putcs is a NULL pointer, this leads to a kernel panic. To prevent this, we need to call set_blitting_type() within set_con2fb_map() to properly initialize ops->putcs.
--- drivers/video/fbdev/core/fbcon.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/video/fbdev/core/fbcon.c +2 -0
@@ -847,6 +847,8 @@ static int set_con2fb_map(int unit, int newidx, int user)return err;fbcon_add_cursor_work (info); + }else if (vc) { +set_blitting_type (vc, info); } con2fb_map[unit] = newidx;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 105/213 smb: client: fix UAF in async decryption
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Enzo Matsumiya <[email protected]>
[ Upstream commit b0abcd65ec545701b8793e12bc27dc98042b151a ]
Doing an async decryption (large read) crashes with a slab-use-after-free way down in the crypto API.
Reproducer:
# mount.cifs -o ...,seal,esize=1 //srv/share /mnt
# dd if=/mnt/largefile of=/dev/null
...
[ 194.196391] ==================================================================
[ 194.196844] BUG: KASAN: slab-use-after-free in gf128mul_4k_lle+0xc1/0x110
[ 194.197269] Read of size 8 at addr ffff888112bd0448 by task kworker/u77:2/899
[ 194.197707]
[ 194.197818] CPU: 12 UID: 0 PID: 899 Comm: kworker/u77:2 Not tainted 6.11.0-lku-00028-gfca3ca14a17a-dirty #43
[ 194.198400] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.2-3-gd478f380-prebuilt.qemu.org 04/01/2014
[ 194.199046] Workqueue: smb3decryptd smb2_decrypt_offload [cifs]
[ 194.200032] Call Trace:
[ 194.200191] <TASK>
[ 194.200327] dump_stack_lvl+0x4e/0x70
[ 194.200558] ? gf128mul_4k_lle+0xc1/0x110
[ 194.200809] print_report+0x174/0x505
[ 194.201040] ? __pfx__raw_spin_lock_irqsave+0x10/0x10
[ 194.201352] ? srso_return_thunk+0x5/0x5f
[ 194.201604] ? __virt_addr_valid+0xdf/0x1c0
[ 194.201868] ? gf128mul_4k_lle+0xc1/0x110
[ 194.202128] kasan_report+0xc8/0x150
[ 194.202361] ? gf128mul_4k_lle+0xc1/0x110
[ 194.202616] gf128mul_4k_lle+0xc1/0x110
[ 194.202863] ghash_update+0x184/0x210
[ 194.203103] shash_ahash_update+0x184/0x2a0
[ 194.203377] ? __pfx_shash_ahash_update+0x10/0x10
[ 194.203651] ? srso_return_thunk+0x5/0x5f
[ 194.203877] ? crypto_gcm_init_common+0x1ba/0x340
[ 194.204142] gcm_hash_assoc_remain_continue+0x10a/0x140
[ 194.204434] crypt_message+0xec1/0x10a0 [cifs]
[ 194.206489] ? __pfx_crypt_message+0x10/0x10 [cifs]
[ 194.208507] ? srso_return_thunk+0x5/0x5f
[ 194.209205] ? srso_return_thunk+0x5/0x5f
[ 194.209925] ? srso_return_thunk+0x5/0x5f
[ 194.210443] ? srso_return_thunk+0x5/0x5f
[ 194.211037] decrypt_raw_data+0x15f/0x250 [cifs]
[ 194.212906] ? __pfx_decrypt_raw_data+0x10/0x10 [cifs]
[ 194.214670] ? srso_return_thunk+0x5/0x5f
[ 194.215193] smb2_decrypt_offload+0x12a/0x6c0 [cifs]This is because TFM is being used in parallel.
Fix this by allocating a new AEAD TFM for async decryption, but keep the existing one for synchronous READ cases (similar to what is done in smb3_calc_signature()).
Also remove the calls to aead_request_set_callback() and crypto_wait_req() since it's always going to be a synchronous operation.
--- fs/smb/client/smb2ops.c | 47 ++++++++++++++++++++++++----------------- fs/smb/client/smb2pdu.c | 6 ++++++ 2 files changed, 34 insertions(+), 19 deletions(-)
fs/smb/client/smb2ops.c +28 -19
@@ -4250,7 +4250,7 @@ smb2_get_enc_key(struct TCP_Server_Info *server, __u64 ses_id, int enc, u8 *key)*/ static int crypt_message (struct TCP_Server_Info *server,int num_rqst, -struct smb_rqst *rqst,int enc) +struct smb_rqst *rqst,int enc,struct crypto_aead *tfm) {struct smb2_transform_hdr *tr_hdr = (struct smb2_transform_hdr *)rqst[0 ].rq_iov[0 ].iov_base;
@@ -4261,8 +4261,6 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst,u8 key[SMB3_ENC_DEC_KEY_SIZE ];struct aead_request *req;u8 *iv; -DECLARE_CRYPTO_WAIT (wait); -struct crypto_aead *tfm;unsigned int crypt_len =le32_to_cpu (tr_hdr->OriginalMessageSize);void *creq;size_t sensitive_size;
@@ -4274,14 +4272,6 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst,return rc; } - rc =smb3_crypto_aead_allocate (server); -if (rc) { -cifs_server_dbg (VFS ,"%s: crypto alloc failed\n" , __func__); -return rc; - } - - tfm = enc ? server->secmech.enc : server->secmech.dec; -if ((server->cipher_type ==SMB2_ENCRYPTION_AES256_CCM ) || (server->cipher_type ==SMB2_ENCRYPTION_AES256_GCM )) rc =crypto_aead_setkey (tfm, key,SMB3_GCM256_CRYPTKEY_SIZE );
@@ -4321,11 +4311,7 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst,aead_request_set_crypt (req, sg, sg, crypt_len, iv);aead_request_set_ad (req, assoc_data_len); -aead_request_set_callback (req,CRYPTO_TFM_REQ_MAY_BACKLOG , - crypto_req_done, &wait); - - rc =crypto_wait_req (enc ?crypto_aead_encrypt (req) - :crypto_aead_decrypt (req), &wait); + rc = enc ?crypto_aead_encrypt (req) :crypto_aead_decrypt (req);if (!rc && enc)memcpy (&tr_hdr->Signature, sign,SMB2_SIGNATURE_SIZE );
@@ -4432,7 +4418,7 @@ smb3_init_transform_rq(struct TCP_Server_Info *server, int num_rqst,/* fill the 1st iov with a transform header */ fill_transform_hdr (tr_hdr, orig_len, old_rq, server->cipher_type); - rc =crypt_message (server, num_rqst, new_rq,1 ); + rc =crypt_message (server, num_rqst, new_rq,1 , server->secmech.enc);cifs_dbg (FYI ,"Encrypt message returned %d\n" , rc);if (rc) goto err_free;
@@ -4457,8 +4443,9 @@ decrypt_raw_data(struct TCP_Server_Info *server, char *buf, unsigned int buf_data_size, struct iov_iter *iter, bool is_offloaded) { - struct kvec iov[2]; + struct crypto_aead *tfm;struct smb_rqst rqst = {NULL }; +struct kvec iov[2 ];size_t iter_size =0 ;int rc;
@@ -4475,9 +4462,31 @@ decrypt_raw_data(struct TCP_Server_Info *server, char *buf, iter_size =iov_iter_count (iter); } - rc =crypt_message (server,1 , &rqst,0 ); +if (is_offloaded) { +if ((server->cipher_type ==SMB2_ENCRYPTION_AES128_GCM ) || + (server->cipher_type ==SMB2_ENCRYPTION_AES256_GCM )) + tfm =crypto_alloc_aead ("gcm(aes)" ,0 ,0 ); +else + tfm =crypto_alloc_aead ("ccm(aes)" ,0 ,0 ); +if (IS_ERR (tfm)) { + rc =PTR_ERR (tfm); +cifs_server_dbg (VFS ,"%s: Failed alloc decrypt TFM, rc=%d\n" , __func__, rc); + +return rc; + } + }else { +if (unlikely (!server->secmech.dec)) +return -EIO ; + + tfm = server->secmech.dec; + } + + rc =crypt_message (server,1 , &rqst,0 , tfm);cifs_dbg (FYI ,"Decrypt message returned %d\n" , rc); +if (is_offloaded) +crypto_free_aead (tfm); +if (rc)return rc;
fs/smb/client/smb2pdu.c +6 -0
@@ -1263,6 +1263,12 @@ SMB2_negotiate(const unsigned int xid,else cifs_server_dbg (VFS ,"Missing expected negotiate contexts\n" ); } + +if (server->cipher_type && !rc) { + rc =smb3_crypto_aead_allocate (server); +if (rc) +cifs_server_dbg (VFS ,"%s: crypto alloc failed, rc=%d\n" , __func__, rc); + } neg_exit:free_rsp_buf (resp_buftype, rsp);return rc;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 106/213 fbdev: sisfb: Fix strbuf array overflow
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Shumilin <[email protected]>
[ Upstream commit 9cf14f5a2746c19455ce9cb44341b5527b5e19c3 ]
The values of the variables xres and yres are placed in strbuf. These variables are obtained from strbuf1.
The strbuf1 array contains digit characters
and a space if the array contains non-digit characters. Then, when executing sprintf(strbuf, "%ux%ux8", xres, yres); more than 16 bytes will be written to strbuf.
It is suggested to increase the size of the strbuf array to 24.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/video/fbdev/sis/sis_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/video/fbdev/sis/sis_main.c +1 -1
@@ -184,7 +184,7 @@ static void sisfb_search_mode(char *name, bool quiet) {unsigned int j =0 , xres =0 , yres =0 , depth =0 , rate =0 ;int i =0 ; -char strbuf[16 ], strbuf1[20 ]; +char strbuf[24 ], strbuf1[20 ];char *nameptr = name;/* We don't know the hardware specs yet and there is no ivideo */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 107/213 x86/amd_nb: Add new PCI IDs for AMD family 0x1a
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shyam Sundar S K <[email protected]>
[ Upstream commit 0e640f0a47d8426eab1fb9c03f0af898dfe810b8 ]
Add the new PCI Device IDs to the MISC IDs list to support new generation of AMD 1Ah family 70h Models of processors.
[ bp: Massage commit message. ]
Stable-dep-of: 59c34008d3bd ("x86/amd_nb: Add new PCI IDs for AMD family 1Ah model 60h")
--- arch/x86/kernel/amd_nb.c | 1 + include/linux/pci_ids.h | 1 + 2 files changed, 2 insertions(+)
arch/x86/kernel/amd_nb.c +1 -0
@@ -92,6 +92,7 @@ static const struct pci_device_id amd_nb_misc_ids[] = { { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_19H_M78H_DF_F3) }, { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_1AH_M00H_DF_F3) }, { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_1AH_M20H_DF_F3) }, + { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_1AH_M70H_DF_F3) }, { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_MI200_DF_F3) }, {} };
include/linux/pci_ids.h +1 -0
@@ -580,6 +580,7 @@#define PCI_DEVICE_ID_AMD_19H_M78H_DF_F3 0x12fb#define PCI_DEVICE_ID_AMD_1AH_M00H_DF_F3 0x12c3#define PCI_DEVICE_ID_AMD_1AH_M20H_DF_F3 0x16fb +#define PCI_DEVICE_ID_AMD_1AH_M70H_DF_F3 0x12bb#define PCI_DEVICE_ID_AMD_MI200_DF_F3 0x14d3#define PCI_DEVICE_ID_AMD_VANGOGH_USB 0x163a#define PCI_DEVICE_ID_AMD_CNB17H_F3 0x1703
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 108/213 x86/amd_nb: Add new PCI IDs for AMD family 1Ah model 60h
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shyam Sundar S K <[email protected]>
[ Upstream commit 59c34008d3bdeef4c8ebc0ed2426109b474334d4 ]
Add new PCI device IDs into the root IDs and miscellaneous IDs lists to provide support for the latest generation of AMD 1Ah family 60h processor models.
--- arch/x86/kernel/amd_nb.c | 3 +++ drivers/hwmon/k10temp.c | 1 + include/linux/pci_ids.h | 1 + 3 files changed, 5 insertions(+)
arch/x86/kernel/amd_nb.c +3 -0
@@ -26,6 +26,7 @@#define PCI_DEVICE_ID_AMD_19H_M70H_ROOT 0x14e8#define PCI_DEVICE_ID_AMD_1AH_M00H_ROOT 0x153a#define PCI_DEVICE_ID_AMD_1AH_M20H_ROOT 0x1507 +#define PCI_DEVICE_ID_AMD_1AH_M60H_ROOT 0x1122#define PCI_DEVICE_ID_AMD_MI200_ROOT 0x14bb#define PCI_DEVICE_ID_AMD_17H_DF_F4 0x1464
@@ -61,6 +62,7 @@ static const struct pci_device_id amd_root_ids[] = { { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_19H_M70H_ROOT) }, { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_1AH_M00H_ROOT) }, { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_1AH_M20H_ROOT) }, + { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_1AH_M60H_ROOT) }, { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_MI200_ROOT) }, {} };
@@ -92,6 +94,7 @@ static const struct pci_device_id amd_nb_misc_ids[] = { { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_19H_M78H_DF_F3) }, { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_1AH_M00H_DF_F3) }, { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_1AH_M20H_DF_F3) }, + { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_1AH_M60H_DF_F3) }, { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_1AH_M70H_DF_F3) }, { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_MI200_DF_F3) }, {}
drivers/hwmon/k10temp.c +1 -0
@@ -545,6 +545,7 @@ static const struct pci_device_id k10temp_id_table[] = { { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_19H_M78H_DF_F3) }, { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M00H_DF_F3) }, { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M20H_DF_F3) }, + { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M60H_DF_F3) }, { PCI_VDEVICE(HYGON, PCI_DEVICE_ID_AMD_17H_DF_F3) }, {} };
include/linux/pci_ids.h +1 -0
@@ -580,6 +580,7 @@#define PCI_DEVICE_ID_AMD_19H_M78H_DF_F3 0x12fb#define PCI_DEVICE_ID_AMD_1AH_M00H_DF_F3 0x12c3#define PCI_DEVICE_ID_AMD_1AH_M20H_DF_F3 0x16fb +#define PCI_DEVICE_ID_AMD_1AH_M60H_DF_F3 0x124b#define PCI_DEVICE_ID_AMD_1AH_M70H_DF_F3 0x12bb#define PCI_DEVICE_ID_AMD_MI200_DF_F3 0x14d3#define PCI_DEVICE_ID_AMD_VANGOGH_USB 0x163a
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 109/213 NFSD: Mark filecache "down" if init fails
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit dc0d0f885aa422f621bc1c2124133eff566b0bc8 ]
NeilBrown says:
Quoted 4 lines
The handling of
NFSD_FILE_CACHE_UPis strange.nfsd_file_cache_init()sets it, but doesn't clear it on failure. So ifnfsd_file_cache_init()fails for some reason,nfsd_file_cache_shutdown()would still try to clean up if it was called.
--- fs/nfsd/filecache.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/nfsd/filecache.c +3 -1
@@ -718,7 +718,7 @@ nfsd_file_cache_init(void) ret =rhltable_init (&nfsd_file_rhltable, &nfsd_file_rhash_params);if (ret) -return ret; + goto out; ret = -ENOMEM ; nfsd_filecache_wq =alloc_workqueue ("nfsd_filecache" ,0 ,0 );
@@ -770,6 +770,8 @@ nfsd_file_cache_init(void)INIT_DELAYED_WORK (&nfsd_filecache_laundrette, nfsd_file_gc_worker); out: +if (ret) +clear_bit (NFSD_FILE_CACHE_UP , &nfsd_file_flags);return ret; out_notifier:lease_unregister_notifier (&nfsd_file_lease_notifier);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 110/213 ice: set correct dst VSI in only LAN filters
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Swiatkowski <[email protected]>
[ Upstream commit 839e3f9bee425c90a0423d14b102a42fe6635c73 ]
The filters set that will reproduce the problem:
$ tc filter add dev $VF0_PR ingress protocol arp prio 0 flower \ skip_sw dst_mac ff:ff:ff:ff:ff:ff action mirred egress \ redirect dev $PF0 $ tc filter add dev $VF0_PR ingress protocol arp prio 0 flower \ skip_sw dst_mac ff:ff:ff:ff:ff:ff src_mac 52:54:00:00:00:10 \ action mirred egress mirror dev $VF1_PR
Expected behaviour is to set all broadcast from VF0 to the LAN. If the src_mac match the value from filters, send packet to LAN and to VF1.
In this case both LAN_EN and LB_EN flags in switch is set in case of packet matching both filters. As dst VSI for the only LAN enable bit is PF VSI, the packet is being seen on PF. To fix this change dst VSI to the source VSI. It will block receiving any packet even when LB_EN is set by switch, because local loopback is clear on VF VSI during normal operation.
Side note: if the second filters action is redirect instead of mirror LAN_EN is clear, because switch is AND-ing LAN_EN from each matched filters and OR-ing LB_EN.
--- drivers/net/ethernet/intel/ice/ice_tc_lib.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/net/ethernet/intel/ice/ice_tc_lib.c +11 -0
@@ -777,6 +777,17 @@ ice_eswitch_add_tc_fltr(struct ice_vsi *vsi, struct ice_tc_flower_fltr *fltr) rule_info.sw_act.flag |=ICE_FLTR_TX ; rule_info.sw_act.src = vsi->idx; rule_info.flags_info.act =ICE_SINGLE_ACT_LAN_ENABLE ; +/* This is a specific case. The destination VSI index is +* overwritten by the source VSI index. This type of filter +* should allow the packet to go to the LAN, not to the +* VSI passed here. It should set LAN_EN bit only. However, +* the VSI must be a valid one. Setting source VSI index +* here is safe. Even if the result from switch is set LAN_EN +* and LB_EN (which normally will pass the packet to this VSI) +* packet won't be seen on the VSI, because local loopback is +* turned off. +*/ + rule_info.sw_act.vsi_handle = vsi->idx; }else {/* VF to VF */ rule_info.sw_act.flag |=ICE_FLTR_TX ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 111/213 ice: fix VLAN replay after reset
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Ertman <[email protected]>
[ Upstream commit 0eae2c136cb624e4050092feb59f18159b4f2512 ]
There is a bug currently when there are more than one VLAN defined and any reset that affects the PF is initiated, after the reset rebuild no traffic will pass on any VLAN but the last one created.
This is caused by the iteration though the VLANs during replay each clearing the vsi_map bitmap of the VSI that is being replayed. The problem is that during rhe replay, the pointer to the vsi_map bitmap is used by each successive vlan to determine if it should be replayed on this VSI.
The logic was that the replay of the VLAN would replace the bit in the map before the next VLAN would iterate through. But, since the replay copies the old bitmap pointer to filt_replay_rules and creates a new one for the recreated VLANS, it does not do this, and leaves the old bitmap broken to be used to replay the remaining VLANs.
Since the old bitmap will be cleaned up in post replay cleanup, there is no need to alter it and break following VLAN replay, so don't clear the bit.
--- drivers/net/ethernet/intel/ice/ice_switch.c | 2 -- 1 file changed, 2 deletions(-)
drivers/net/ethernet/intel/ice/ice_switch.c +0 -2
@@ -6326,8 +6326,6 @@ ice_replay_vsi_fltr(struct ice_hw *hw, u16 vsi_handle, u8 recp_id,if (!itr->vsi_list_info || !test_bit (vsi_handle, itr->vsi_list_info->vsi_map))continue ; -/* Clearing it so that the logic can add it back */ -clear_bit (vsi_handle, itr->vsi_list_info->vsi_map); f_entry.fltr_info.vsi_handle = vsi_handle; f_entry.fltr_info.fltr_act =ICE_FWD_TO_VSI ;/* update the src in case it is VSI num */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 112/213 SUNRPC: Fix integer overflow in decode_rc_list()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 6dbf1f341b6b35bcc20ff95b6b315e509f6c5369 ]
The math in "rc_list->rcl_nrefcalls * 2 * sizeof(uint32_t)" could have an integer overflow. Add bounds checking on rc_list->rcl_nrefcalls to fix that.
--- fs/nfs/callback_xdr.c | 2 ++ 1 file changed, 2 insertions(+)
fs/nfs/callback_xdr.c +2 -0
@@ -372,6 +372,8 @@ static __be32 decode_rc_list(struct xdr_stream *xdr, rc_list->rcl_nrefcalls =ntohl (*p++);if (rc_list->rcl_nrefcalls) { +if (unlikely (rc_list->rcl_nrefcalls > xdr->buf->len)) + goto out; p =xdr_inline_decode (xdr, rc_list->rcl_nrefcalls *2 *sizeof (uint32_t ));if (unlikely (p ==NULL ))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 113/213 NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yanjun Zhang <[email protected]>
[ Upstream commit a848c29e3486189aaabd5663bc11aea50c5bd144 ]
On the node of an NFS client, some files saved in the mountpoint of the NFS server were copied to another location of the same NFS server. Accidentally, the nfs42_complete_copies() got a NULL-pointer dereference crash with the following syslog:
[232064.838881] NFSv4: state recovery failed for open file nfs/pvc-12b5200d-cd0f-46a3-b9f0-af8f4fe0ef64.qcow2, error = -116 [232064.839360] NFSv4: state recovery failed for open file nfs/pvc-12b5200d-cd0f-46a3-b9f0-af8f4fe0ef64.qcow2, error = -116 [232066.588183] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000058 [232066.588586] Mem abort info: [232066.588701] ESR = 0x0000000096000007 [232066.588862] EC = 0x25: DABT (current EL), IL = 32 bits [232066.589084] SET = 0, FnV = 0 [232066.589216] EA = 0, S1PTW = 0 [232066.589340] FSC = 0x07: level 3 translation fault [232066.589559] Data abort info: [232066.589683] ISV = 0, ISS = 0x00000007 [232066.589842] CM = 0, WnR = 0 [232066.589967] user pgtable: 64k pages, 48-bit VAs, pgdp=00002000956ff400 [232066.590231] [0000000000000058] pgd=08001100ae100003, p4d=08001100ae100003, pud=08001100ae100003, pmd=08001100b3c00003, pte=0000000000000000 [232066.590757] Internal error: Oops: 96000007 [#1] SMP [232066.590958] Modules linked in: rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs ocfs2_dlmfs ocfs2_stack_o2cb ocfs2_dlm vhost_net vhost vhost_iotlb tap tun ipt_rpfilter xt_multiport ip_set_hash_ip ip_set_hash_net xfrm_interface xfrm6_tunnel tunnel4 tunnel6 esp4 ah4 wireguard libcurve25519_generic veth xt_addrtype xt_set nf_conntrack_netlink ip_set_hash_ipportnet ip_set_hash_ipportip ip_set_bitmap_port ip_set_hash_ipport dummy ip_set ip_vs_sh ip_vs_wrr ip_vs_rr ip_vs iptable_filter sch_ingress nfnetlink_cttimeout vport_gre ip_gre ip_tunnel gre vport_geneve geneve vport_vxlan vxlan ip6_udp_tunnel udp_tunnel openvswitch nf_conncount dm_round_robin dm_service_time dm_multipath xt_nat xt_MASQUERADE nft_chain_nat nf_nat xt_mark xt_conntrack xt_comment nft_compat nft_counter nf_tables nfnetlink ocfs2 ocfs2_nodemanager ocfs2_stackglue iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi ipmi_ssif nbd overlay 8021q garp mrp bonding tls rfkill sunrpc ext4 mbcache jbd2 [232066.591052] vfat fat cas_cache cas_disk ses enclosure scsi_transport_sas sg acpi_ipmi ipmi_si ipmi_devintf ipmi_msghandler ip_tables vfio_pci vfio_pci_core vfio_virqfd vfio_iommu_type1 vfio dm_mirror dm_region_hash dm_log dm_mod nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 br_netfilter bridge stp llc fuse xfs libcrc32c ast drm_vram_helper qla2xxx drm_kms_helper syscopyarea crct10dif_ce sysfillrect ghash_ce sysimgblt sha2_ce fb_sys_fops cec sha256_arm64 sha1_ce drm_ttm_helper ttm nvme_fc igb sbsa_gwdt nvme_fabrics drm nvme_core i2c_algo_bit i40e scsi_transport_fc megaraid_sas aes_neon_bs [232066.596953] CPU: 6 PID: 4124696 Comm: 10.253.166.125- Kdump: loaded Not tainted 5.15.131-9.cl9_ocfs2.aarch64 #1 [232066.597356] Hardware name: Great Wall .\x93\x8e...RF6260 V5/GWMSSE2GL1T, BIOS T656FBE_V3.0.18 2024-01-06 [232066.597721] pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [232066.598034] pc : nfs4_reclaim_open_state+0x220/0x800 [nfsv4] [232066.598327] lr : nfs4_reclaim_open_state+0x12c/0x800 [nfsv4] [232066.598595] sp : ffff8000f568fc70 [232066.598731] x29: ffff8000f568fc70 x28: 0000000000001000 x27: ffff21003db33000 [232066.599030] x26: ffff800005521ae0 x25: ffff0100f98fa3f0 x24: 0000000000000001 [232066.599319] x23: ffff800009920008 x22: ffff21003db33040 x21: ffff21003db33050 [232066.599628] x20: ffff410172fe9e40 x19: ffff410172fe9e00 x18: 0000000000000000 [232066.599914] x17: 0000000000000000 x16: 0000000000000004 x15: 0000000000000000 [232066.600195] x14: 0000000000000000 x13: ffff800008e685a8 x12: 00000000eac0c6e6 [232066.600498] x11: 0000000000000000 x10: 0000000000000008 x9 : ffff8000054e5828 [232066.600784] x8 : 00000000ffffffbf x7 : 0000000000000001 x6 : 000000000a9eb14a [232066.601062] x5 : 0000000000000000 x4 : ffff70ff8a14a800 x3 : 0000000000000058 [232066.601348] x2 : 0000000000000001 x1 : 54dce46366daa6c6 x0 : 0000000000000000 [232066.601636] Call trace: [232066.601749] nfs4_reclaim_open_state+0x220/0x800 [nfsv4] [232066.601998] nfs4_do_reclaim+0x1b8/0x28c [nfsv4] [232066.602218] nfs4_state_manager+0x928/0x10f0 [nfsv4] [232066.602455] nfs4_run_state_manager+0x78/0x1b0 [nfsv4] [232066.602690] kthread+0x110/0x114 [232066.602830] ret_from_fork+0x10/0x20 [232066.602985] Code: 1400000d f9403f20 f9402e61 91016003 (f9402c00) [232066.603284] SMP: stopping secondary CPUs [232066.606936] Starting crashdump kernel... [232066.607146] Bye!
Analysing the vmcore, we know that nfs4_copy_state listed by destination nfs_server->ss_copies was added by the field copies in handle_async_copy(), and we found a waiting copy process with the stack as:
PID: 3511963 TASK: ffff710028b47e00 CPU: 0 COMMAND: "cp"
#0 [ffff8001116ef740] __switch_to at ffff8000081b92f4
#1 [ffff8001116ef760] __schedule at ffff800008dd0650
#2 [ffff8001116ef7c0] schedule at ffff800008dd0a00
#3 [ffff8001116ef7e0] schedule_timeout at ffff800008dd6aa0
#4 [ffff8001116ef860] __wait_for_common at ffff800008dd166c
#5 [ffff8001116ef8e0] wait_for_completion_interruptible at ffff800008dd1898 #6 [ffff8001116ef8f0] handle_async_copy at ffff8000055142f4 [nfsv4]
#7 [ffff8001116ef970] _nfs42_proc_copy at ffff8000055147c8 [nfsv4]
#8 [ffff8001116efa80] nfs42_proc_copy at ffff800005514cf0 [nfsv4]
#9 [ffff8001116efc50] __nfs4_copy_file_range.constprop.0 at ffff8000054ed694 [nfsv4]
The NULL-pointer dereference was due to nfs42_complete_copies() listed the nfs_server->ss_copies by the field ss_copies of nfs4_copy_state. So the nfs4_copy_state address ffff0100f98fa3f0 was offset by 0x10 and the data accessed through this pointer was also incorrect. Generally, the ordered list nfs4_state_owner->so_states indicate open(O_RDWR) or open(O_WRITE) states are reclaimed firstly by nfs4_reclaim_open_state(). When destination state reclaim is failed with NFS_STATE_RECOVERY_FAILED and copies are not deleted in nfs_server->ss_copies, the source state may be passed to the nfs42_complete_copies() process earlier, resulting in this crash scene finally. To solve this issue, we add a list_head nfs_server->ss_src_copies for a server-to-server copy specially.
--- fs/nfs/client.c | 1 + fs/nfs/nfs42proc.c | 2 +- fs/nfs/nfs4state.c | 2 +- include/linux/nfs_fs_sb.h | 1 + 4 files changed, 4 insertions(+), 2 deletions(-)
fs/nfs/client.c +1 -0
@@ -987,6 +987,7 @@ struct nfs_server *nfs_alloc_server(void)INIT_LIST_HEAD (&server->layouts);INIT_LIST_HEAD (&server->state_owners_lru);INIT_LIST_HEAD (&server->ss_copies); +INIT_LIST_HEAD (&server->ss_src_copies);atomic_set (&server->active,0 );
fs/nfs/nfs42proc.c +1 -1
@@ -218,7 +218,7 @@ static int handle_async_copy(struct nfs42_copy_res *res,if (dst_server != src_server) {spin_lock (&src_server->nfs_client->cl_lock); -list_add_tail (©->src_copies, &src_server->ss_copies); +list_add_tail (©->src_copies, &src_server->ss_src_copies);spin_unlock (&src_server->nfs_client->cl_lock); }
fs/nfs/nfs4state.c +1 -1
@@ -1597,7 +1597,7 @@ static void nfs42_complete_copies(struct nfs4_state_owner *sp, struct nfs4_statecomplete (©->completion); } } -list_for_each_entry (copy, &sp->so_server->ss_copies, src_copies) { +list_for_each_entry (copy, &sp->so_server->ss_src_copies, src_copies) {if ((test_bit (NFS_CLNT_SRC_SSC_COPY_STATE , &state->flags) && !nfs4_stateid_match_other (&state->stateid, ©->parent_src_state->stateid)))
include/linux/nfs_fs_sb.h +1 -0
@@ -238,6 +238,7 @@ struct nfs_server {struct list_head layouts;struct list_head delegations;struct list_head ss_copies; +struct list_head ss_src_copies;unsigned long mig_gen;unsigned long mig_status;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 114/213 net: phy: dp83869: fix memory corruption when enabling fiber
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ingo van Lil <[email protected]>
[ Upstream commit a842e443ca8184f2dc82ab307b43a8b38defd6a5 ]
When configuring the fiber port, the DP83869 PHY driver incorrectly calls linkmode_set_bit() with a bit mask (1 << 10) rather than a bit number (10). This corrupts some other memory location -- in case of arm64 the priv pointer in the same structure.
Since the advertising flags are updated from supported at the end of the function the incorrect line isn't needed at all and can be removed.
--- drivers/net/phy/dp83869.c | 1 - 1 file changed, 1 deletion(-)
drivers/net/phy/dp83869.c +0 -1
@@ -645,7 +645,6 @@ static int dp83869_configure_fiber(struct phy_device *phydev, phydev->supported);linkmode_set_bit (ETHTOOL_LINK_MODE_FIBRE_BIT , phydev->supported); -linkmode_set_bit (ADVERTISED_FIBRE , phydev->advertising);if (dp83869->mode ==DP83869_RGMII_1000_BASE ) { linkmode_set_bit(ETHTOOL_LINK_MODE_1000baseX_Full_BIT,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 115/213 tcp: fix to allow timestamp undo if no retransmits were sent
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neal Cardwell <[email protected]>
[ Upstream commit e37ab7373696e650d3b6262a5b882aadad69bb9e ]
Fix the TCP loss recovery undo logic in tcp_packet_delayed() so that it can trigger undo even if TSQ prevents a fast recovery episode from reaching tcp_retransmit_skb().
Geumhwan Yu <[email protected]> recently reported that after this commit from 2019:
commit bc9f38c8328e ("tcp: avoid unconditional congestion window undo on SYN retransmit")
...and before this fix we could have buggy scenarios like the following:
+ Due to reordering, a TCP connection receives some SACKs and enters a spurious fast recovery.
+ TSQ prevents all invocations of tcp_retransmit_skb(), because many skbs are queued in lower layers of the sending machine's network stack; thus tp->retrans_stamp remains 0.
+ The connection receives a TCP timestamp ECR value echoing a timestamp before the fast recovery, indicating that the fast recovery was spurious.
+ The connection fails to undo the spurious fast recovery because tp->retrans_stamp is 0, and thus tcp_packet_delayed() returns false, due to the new logic in the 2019 commit: commit bc9f38c8328e ("tcp:
avoid unconditional congestion window undo on SYN retransmit")
This fix tweaks the logic to be more similar to the tcp_packet_delayed() logic before bc9f38c8328e, except that we take care not to be fooled by the FLAG_SYN_ACKED code path zeroing out tp->retrans_stamp (the bug noted and fixed by Yuchung in bc9f38c8328e).
Note that this returns the high-level behavior of tcp_packet_delayed() to again match the comment for the function, which says: "Nothing was retransmitted or returned timestamp is less than timestamp of the first retransmission." Note that this comment is in the original 2005-04-16 Linux git commit, so this is evidently long-standing behavior.
--- net/ipv4/tcp_input.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-)
net/ipv4/tcp_input.c +16 -2
@@ -2452,8 +2452,22 @@ static bool tcp_skb_spurious_retrans(const struct tcp_sock *tp,*/ static inline bool tcp_packet_delayed (const struct tcp_sock *tp) { -return tp->retrans_stamp && -tcp_tsopt_ecr_before (tp, tp->retrans_stamp); +const struct sock *sk = (const struct sock *)tp; + +if (tp->retrans_stamp && +tcp_tsopt_ecr_before (tp, tp->retrans_stamp)) +return true;/* got echoed TS before first retransmission */ + +/* Check if nothing was retransmitted (retrans_stamp==0), which may +* happen in fast recovery due to TSQ. But we ignore zero retrans_stamp +* in TCP_SYN_SENT, since when we set FLAG_SYN_ACKED we also clear +* retrans_stamp even if we had retransmitted the SYN. +*/ +if (!tp->retrans_stamp &&/* no record of a retransmit/SYN? */ + sk->sk_state !=TCP_SYN_SENT )/* not the FLAG_SYN_ACKED case? */ +return true;/* nothing was retransmitted */ + +return false; }/* Undo procedures. */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 116/213 tcp: fix tcp_enter_recovery() to zero retrans_stamp when its safe
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neal Cardwell <[email protected]>
[ Upstream commit b41b4cbd9655bcebcce941bef3601db8110335be ]
Fix tcp_enter_recovery() so that if there are no retransmits out then we zero retrans_stamp when entering fast recovery. This is necessary to fix two buggy behaviors.
Currently a non-zero retrans_stamp value can persist across multiple back-to-back loss recovery episodes. This is because we generally only clears retrans_stamp if we are completely done with loss recoveries, and get to tcp_try_to_open() and find !tcp_any_retrans_done(sk). This behavior causes two bugs:
(1) When a loss recovery episode (CA_Loss or CA_Recovery) is followed immediately by a new CA_Recovery, the retrans_stamp value can persist and can be a time before this new CA_Recovery episode starts. That means that timestamp-based undo will be using the wrong retrans_stamp (a value that is too old) when comparing incoming TS ecr values to retrans_stamp to see if the current fast recovery episode can be undone.
(2) If there is a roughly minutes-long sequence of back-to-back fast recovery episodes, one after another (e.g. in a shallow-buffered or policed bottleneck), where each fast recovery successfully makes forward progress and recovers one window of sequence space (but leaves at least one retransmit in flight at the end of the recovery), followed by several RTOs, then the ETIMEDOUT check may be using the wrong retrans_stamp (a value set at the start of the first fast recovery in the sequence). This can cause a very premature ETIMEDOUT, killing the connection prematurely.
This commit changes the code to zero retrans_stamp when entering fast recovery, when this is known to be safe (no retransmits are out in the network). That ensures that when starting a fast recovery episode, and it is safe to do so, retrans_stamp is set when we send the fast retransmit packet. That addresses both bug (1) and bug (2) by ensuring that (if no retransmits are out when we start a fast recovery) we use the initial fast retransmit of this fast recovery as the time value for undo and ETIMEDOUT calculations.
This makes intuitive sense, since the start of a new fast recovery episode (in a scenario where no lost packets are out in the network) means that the connection has made forward progress since the last RTO or fast recovery, and we should thus "restart the clock" used for both undo and ETIMEDOUT logic.
Note that if when we start fast recovery there *are* retransmits out in the network, there can still be undesirable (1)/(2) issues. For example, after this patch we can still have the (1) and (2) problems in cases like this:
+ round 1: sender sends flight 1
+ round 2: sender receives SACKs and enters fast recovery 1, retransmits some packets in flight 1 and then sends some new data as flight 2
+ round 3: sender receives some SACKs for flight 2, notes losses, and retransmits some packets to fill the holes in flight 2
+ fast recovery has some lost retransmits in flight 1 and continues for one or more rounds sending retransmits for flight 1 and flight 2
+ fast recovery 1 completes when snd_una reaches high_seq at end of flight 1
+ there are still holes in the SACK scoreboard in flight 2, so we enter fast recovery 2, but some retransmits in the flight 2 sequence range are still in flight (retrans_out > 0), so we can't execute the new retrans_stamp=0 added here to clear retrans_stamp
It's not yet clear how to fix these remaining (1)/(2) issues in an efficient way without breaking undo behavior, given that retrans_stamp is currently used for undo and ETIMEDOUT. Perhaps the optimal (but expensive) strategy would be to set retrans_stamp to the timestamp of the earliest outstanding retransmit when entering fast recovery. But at least this commit makes things better.
Note that this does not change the semantics of retrans_stamp; it simply makes retrans_stamp accurate in some cases where it was not before:
(1) Some loss recovery, followed by an immediate entry into a fast recovery, where there are no retransmits out when entering the fast recovery.
(2) When a TFO server has a SYNACK retransmit that sets retrans_stamp, and then the ACK that completes the 3-way handshake has SACK blocks that trigger a fast recovery. In this case when entering fast recovery we want to zero out the retrans_stamp from the TFO SYNACK retransmit, and set the retrans_stamp based on the timestamp of the fast recovery.
We introduce a tcp_retrans_stamp_cleanup() helper, because this two-line sequence already appears in 3 places and is about to appear in 2 more as a result of this bug fix patch series. Once this bug fix patches series in the net branch makes it into the net-next branch we'll update the 3 other call sites to use the new helper.
This is a long-standing issue. The Fixes tag below is chosen to be the oldest commit at which the patch will apply cleanly, which is from Linux v3.5 in 2012.
--- net/ipv4/tcp_input.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
net/ipv4/tcp_input.c +13 -0
@@ -2501,6 +2501,16 @@ static bool tcp_any_retrans_done(const struct sock *sk)return false; } +/* If loss recovery is finished and there are no retransmits out in the +* network, then we clear retrans_stamp so that upon the next loss recovery +* retransmits_timed_out() and timestamp-undo are using the correct value. +*/ +static void tcp_retrans_stamp_cleanup (struct sock *sk) +{ +if (!tcp_any_retrans_done (sk)) +tcp_sk (sk)->retrans_stamp =0 ; +} +static void DBGUNDO (struct sock *sk,const char *msg) {#if FASTRETRANS_DEBUG >1
@@ -2868,6 +2878,9 @@ void tcp_enter_recovery(struct sock *sk, bool ece_ack)struct tcp_sock *tp =tcp_sk (sk);int mib_idx; +/* Start the clock with our fast retransmit, for undo and ETIMEDOUT. */ +tcp_retrans_stamp_cleanup (sk); +if (tcp_is_reno (tp)) mib_idx =LINUX_MIB_TCPRENORECOVERY ;else
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 117/213 tcp: new TCP_INFO stats for RTO events
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aananth V <[email protected]>
[ Upstream commit 3868ab0f192581eff978501a05f3dc2e01541d77 ]
The 2023 SIGCOMM paper "Improving Network Availability with Protective ReRoute" has indicated Linux TCP's RTO-triggered txhash rehashing can effectively reduce application disruption during outages. To better measure the efficacy of this feature, this patch adds three more detailed stats during RTO recovery and exports via TCP_INFO. Applications and monitoring systems can leverage this data to measure the network path diversity and end-to-end repair latency during network outages to improve their network infrastructure.
The following counters are added to tcp_sock in order to track RTO events over the lifetime of a TCP socket.
1. u16 total_rto - Counts the total number of RTO timeouts.
2. u16 total_rto_recoveries - Counts the total number of RTO recoveries.
3. u32 total_rto_time - Counts the total time spent (ms) in RTO recoveries. (time spent in CA_Loss and CA_Recovery states)
To compute total_rto_time, we add a new u32 rto_stamp field to tcp_sock. rto_stamp records the start timestamp (ms) of the last RTO recovery (CA_Loss).
Corresponding fields are also added to the tcp_info struct.
Stable-dep-of: 27c80efcc204 ("tcp: fix TFO SYN_RECV to not zero retrans_stamp with retransmits out")
--- include/linux/tcp.h | 8 ++++++++ include/uapi/linux/tcp.h | 12 ++++++++++++ net/ipv4/tcp.c | 9 +++++++++ net/ipv4/tcp_input.c | 15 +++++++++++++++ net/ipv4/tcp_minisocks.c | 4 ++++ net/ipv4/tcp_timer.c | 17 +++++++++++++++-- 6 files changed, 63 insertions(+), 2 deletions(-)
include/linux/tcp.h +8 -0
@@ -377,6 +377,14 @@ struct tcp_sock {* Total data bytes retransmitted */ u32 total_retrans;/* Total retransmits for entire connection */ +u32 rto_stamp;/* Start time (ms) of last CA_Loss recovery */ +u16 total_rto;/* Total number of RTO timeouts, including +* SYN/SYN-ACK and recurring timeouts. +*/ +u16 total_rto_recoveries;/* Total number of RTO recoveries, +* including any unfinished recovery. +*/ +u32 total_rto_time;/* ms spent in (completed) RTO recoveries. */ u32 urg_seq;/* Seq of received urgent pointer */ unsigned int keepalive_time;/* time before keep alive takes place */
include/uapi/linux/tcp.h +12 -0
@@ -289,6 +289,18 @@ struct tcp_info {*/ __u32 tcpi_rehash;/* PLB or timeout triggered rehash attempts */ + +__u16 tcpi_total_rto;/* Total number of RTO timeouts, including +* SYN/SYN-ACK and recurring timeouts. +*/ +__u16 tcpi_total_rto_recoveries;/* Total number of RTO +* recoveries, including any +* unfinished recovery. +*/ +__u32 tcpi_total_rto_time;/* Total time spent in RTO recoveries +* in milliseconds, including any +* unfinished recovery. +*/ };/* netlink attributes types for SCM_TIMESTAMPING_OPT_STATS */
net/ipv4/tcp.c +9 -0
@@ -3851,6 +3851,15 @@ void tcp_get_info(struct sock *sk, struct tcp_info *info) info->tcpi_rcv_wnd = tp->rcv_wnd; info->tcpi_rehash = tp->plb_rehash + tp->timeout_rehash; info->tcpi_fastopen_client_fail = tp->fastopen_client_fail; + + info->tcpi_total_rto = tp->total_rto; + info->tcpi_total_rto_recoveries = tp->total_rto_recoveries; + info->tcpi_total_rto_time = tp->total_rto_time; +if (tp->rto_stamp) { + info->tcpi_total_rto_time +=tcp_time_stamp_raw () - + tp->rto_stamp; + } +unlock_sock_fast (sk, slow); }EXPORT_SYMBOL_GPL (tcp_get_info);
net/ipv4/tcp_input.c +15 -0
@@ -2108,6 +2108,10 @@ void tcp_clear_retrans(struct tcp_sock *tp) tp->undo_marker =0 ; tp->undo_retrans =-1 ; tp->sacked_out =0 ; + tp->rto_stamp =0 ; + tp->total_rto =0 ; + tp->total_rto_recoveries =0 ; + tp->total_rto_time =0 ; }static inline void tcp_init_undo (struct tcp_sock *tp)
@@ -2899,6 +2903,14 @@ void tcp_enter_recovery(struct sock *sk, bool ece_ack)tcp_set_ca_state (sk, TCP_CA_Recovery); } +static void tcp_update_rto_time (struct tcp_sock *tp) +{ +if (tp->rto_stamp) { + tp->total_rto_time +=tcp_time_stamp (tp) - tp->rto_stamp; + tp->rto_stamp =0 ; + } +} +/* Process an ACK in CA_Loss state. Move to CA_Open if lost data are * recovered or spurious. Otherwise retransmits more on partial ACKs. */
@@ -3103,6 +3115,8 @@ static void tcp_fastretrans_alert(struct sock *sk, const u32 prior_snd_una,break ;case TCP_CA_Loss:tcp_process_loss (sk, flag, num_dupack, rexmit); +if (icsk->icsk_ca_state != TCP_CA_Loss) +tcp_update_rto_time (tp);tcp_identify_packet_loss (sk, ack_flag);if (!(icsk->icsk_ca_state == TCP_CA_Open || (*ack_flag &FLAG_LOST_RETRANS )))
@@ -6541,6 +6555,7 @@ static void tcp_rcv_synrecv_state_fastopen(struct sock *sk)tcp_try_undo_recovery (sk);/* Reset rtx states to prevent spurious retransmits_timed_out() */ +tcp_update_rto_time (tp); tp->retrans_stamp =0 ;inet_csk (sk)->icsk_retransmits =0 ;
net/ipv4/tcp_minisocks.c +4 -0
@@ -560,6 +560,10 @@ struct sock *tcp_create_openreq_child(const struct sock *sk, newtp->undo_marker = treq->snt_isn; newtp->retrans_stamp =div_u64 (treq->snt_synack,USEC_PER_SEC /TCP_TS_HZ ); + newtp->total_rto = req->num_timeout; + newtp->total_rto_recoveries =1 ; + newtp->total_rto_time =tcp_time_stamp_raw () - + newtp->retrans_stamp; } newtp->tsoffset = treq->ts_off;#ifdef CONFIG_TCP_MD5SIG
net/ipv4/tcp_timer.c +15 -2
@@ -411,6 +411,19 @@ abort: tcp_write_err(sk); } } +static void tcp_update_rto_stats (struct sock *sk) +{ +struct inet_connection_sock *icsk =inet_csk (sk); +struct tcp_sock *tp =tcp_sk (sk); + +if (!icsk->icsk_retransmits) { + tp->total_rto_recoveries++; + tp->rto_stamp =tcp_time_stamp (tp); + } + icsk->icsk_retransmits++; + tp->total_rto++; +} +/* * Timer for Fast Open socket to retransmit SYNACK. Note that the * sk here is the child socket, not the parent (listener) socket.
@@ -443,7 +456,7 @@ static void tcp_fastopen_synack_timer(struct sock *sk, struct request_sock *req)*/ inet_rtx_syn_ack (sk, req); req->num_timeout++; - icsk->icsk_retransmits++; +tcp_update_rto_stats (sk);if (!tp->retrans_stamp) tp->retrans_stamp =tcp_time_stamp (tp); inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
@@ -586,7 +599,7 @@ void tcp_retransmit_timer(struct sock *sk)tcp_enter_loss (sk); - icsk->icsk_retransmits++; +tcp_update_rto_stats (sk);if (tcp_retransmit_skb (sk,tcp_rtx_queue_head (sk),1 ) >0 ) {/* Retransmission failed because of local congestion, * Let senders fight for local resources conservatively.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 118/213 tcp: fix TFO SYN_RECV to not zero retrans_stamp with retransmits out
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neal Cardwell <[email protected]>
[ Upstream commit 27c80efcc20486c82698f05f00e288b44513c86b ]
Fix tcp_rcv_synrecv_state_fastopen() to not zero retrans_stamp if retransmits are outstanding.
tcp_fastopen_synack_timer() sets retrans_stamp, so typically we'll need to zero retrans_stamp here to prevent spurious retransmits_timed_out(). The logic to zero retrans_stamp is from this 2019 commit:
commit cd736d8b67fb ("tcp: fix retrans timestamp on passive Fast Open")
However, in the corner case where the ACK of our TFO SYNACK carried some SACK blocks that caused us to enter TCP_CA_Recovery then that non-zero retrans_stamp corresponds to the active fast recovery, and we need to leave retrans_stamp with its current non-zero value, for correct ETIMEDOUT and undo behavior.
--- net/ipv4/tcp_input.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
net/ipv4/tcp_input.c +9 -2
@@ -6554,10 +6554,17 @@ static void tcp_rcv_synrecv_state_fastopen(struct sock *sk)if (inet_csk (sk)->icsk_ca_state == TCP_CA_Loss && !tp->packets_out)tcp_try_undo_recovery (sk); -/* Reset rtx states to prevent spurious retransmits_timed_out() */ tcp_update_rto_time (tp); - tp->retrans_stamp =0 ;inet_csk (sk)->icsk_retransmits =0 ; +/* In tcp_fastopen_synack_timer() on the first SYNACK RTO we set +* retrans_stamp but don't enter CA_Loss, so in case that happened we +* need to zero retrans_stamp here to prevent spurious +* retransmits_timed_out(). However, if the ACK of our SYNACK caused us +* to enter CA_Recovery then we need to leave retrans_stamp as it was +* set entering CA_Recovery, for correct retransmits_timed_out() and +* undo behavior. +*/ +tcp_retrans_stamp_cleanup (sk);/* Once we leave TCP_SYN_RECV or TCP_FIN_WAIT_1, * we no longer need req so release it.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 119/213 rxrpc: Fix uninitialised variable in rxrpc_send_data()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
[ Upstream commit 7a310f8d7dfe2d92a1f31ddb5357bfdd97eed273 ]
Fix the uninitialised txb variable in rxrpc_send_data() by moving the code that loads it above all the jumps to maybe_error, txb being stored back into call->tx_pending right before the normal return.
--- net/rxrpc/sendmsg.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
net/rxrpc/sendmsg.c +5 -5
@@ -303,6 +303,11 @@ static int rxrpc_send_data(struct rxrpc_sock *rx,sk_clear_bit (SOCKWQ_ASYNC_NOSPACE , sk); reload: + txb = call->tx_pending; + call->tx_pending =NULL ; +if (txb) +rxrpc_see_txbuf (txb, rxrpc_txbuf_see_send_more); + ret = -EPIPE ;if (sk->sk_shutdown &SEND_SHUTDOWN ) goto maybe_error;
@@ -329,11 +334,6 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, goto maybe_error; } - txb = call->tx_pending; - call->tx_pending =NULL ; -if (txb) -rxrpc_see_txbuf (txb, rxrpc_txbuf_see_send_more); - do { if (!txb) { size_t remain, bufsize, chunk, offset;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 120/213 netfilter: br_netfilter: fix panic with metadata_dst skb
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Roulin <[email protected]>
[ Upstream commit f9ff7665cd128012868098bbd07e28993e314fdb ]
Fix a kernel panic in the br_netfilter module when sending untagged traffic via a VxLAN device.
This happens during the check for fragmentation in br_nf_dev_queue_xmit.
It is dependent on:
1) the br_netfilter module being loaded;
2) net.bridge.bridge-nf-call-iptables set to 1;
3) a bridge with a VxLAN (single-vxlan-device) netdevice as a bridge port;
4) untagged frames with size higher than the VxLAN MTU forwarded/flooded
When forwarding the untagged packet to the VxLAN bridge port, before the netfilter hooks are called, br_handle_egress_vlan_tunnel is called and changes the skb_dst to the tunnel dst. The tunnel_dst is a metadata type of dst, i.e., skb_valid_dst(skb) is false, and metadata->dst.dev is NULL.
Then in the br_netfilter hooks, in br_nf_dev_queue_xmit, there's a check for frames that needs to be fragmented: frames with higher MTU than the VxLAN device end up calling br_nf_ip_fragment, which in turns call ip_skb_dst_mtu.
The ip_dst_mtu tries to use the skb_dst(skb) as if it was a valid dst with valid dst->dev, thus the crash.
This case was never supported in the first place, so drop the packet instead.
PING 10.0.0.2 (10.0.0.2) from 0.0.0.0 h1-eth0: 2000(2028) bytes of data.
[ 176.291791] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000110 [ 176.292101] Mem abort info: [ 176.292184] ESR = 0x0000000096000004 [ 176.292322] EC = 0x25: DABT (current EL), IL = 32 bits [ 176.292530] SET = 0, FnV = 0 [ 176.292709] EA = 0, S1PTW = 0 [ 176.292862] FSC = 0x04: level 0 translation fault [ 176.293013] Data abort info: [ 176.293104] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 176.293488] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 176.293787] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 176.293995] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000043ef5000 [ 176.294166] [0000000000000110] pgd=0000000000000000, p4d=0000000000000000 [ 176.294827] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [ 176.295252] Modules linked in: vxlan ip6_udp_tunnel udp_tunnel veth br_netfilter bridge stp llc ipv6 crct10dif_ce [ 176.295923] CPU: 0 PID: 188 Comm: ping Not tainted 6.8.0-rc3-g5b3fbd61b9d1 #2 [ 176.296314] Hardware name: linux,dummy-virt (DT) [ 176.296535] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 176.296808] pc : br_nf_dev_queue_xmit+0x390/0x4ec [br_netfilter] [ 176.297382] lr : br_nf_dev_queue_xmit+0x2ac/0x4ec [br_netfilter] [ 176.297636] sp : ffff800080003630 [ 176.297743] x29: ffff800080003630 x28: 0000000000000008 x27: ffff6828c49ad9f8 [ 176.298093] x26: ffff6828c49ad000 x25: 0000000000000000 x24: 00000000000003e8 [ 176.298430] x23: 0000000000000000 x22: ffff6828c4960b40 x21: ffff6828c3b16d28 [ 176.298652] x20: ffff6828c3167048 x19: ffff6828c3b16d00 x18: 0000000000000014 [ 176.298926] x17: ffffb0476322f000 x16: ffffb7e164023730 x15: 0000000095744632 [ 176.299296] x14: ffff6828c3f1c880 x13: 0000000000000002 x12: ffffb7e137926a70 [ 176.299574] x11: 0000000000000001 x10: ffff6828c3f1c898 x9 : 0000000000000000 [ 176.300049] x8 : ffff6828c49bf070 x7 : 0008460f18d5f20e x6 : f20e0100bebafeca [ 176.300302] x5 : ffff6828c7f918fe x4 : ffff6828c49bf070 x3 : 0000000000000000 [ 176.300586] x2 : 0000000000000000 x1 : ffff6828c3c7ad00 x0 : ffff6828c7f918f0 [ 176.300889] Call trace: [ 176.301123] br_nf_dev_queue_xmit+0x390/0x4ec [br_netfilter] [ 176.301411] br_nf_post_routing+0x2a8/0x3e4 [br_netfilter] [ 176.301703] nf_hook_slow+0x48/0x124 [ 176.302060] br_forward_finish+0xc8/0xe8 [bridge] [ 176.302371] br_nf_hook_thresh+0x124/0x134 [br_netfilter] [ 176.302605] br_nf_forward_finish+0x118/0x22c [br_netfilter] [ 176.302824] br_nf_forward_ip.part.0+0x264/0x290 [br_netfilter] [ 176.303136] br_nf_forward+0x2b8/0x4e0 [br_netfilter] [ 176.303359] nf_hook_slow+0x48/0x124 [ 176.303803] __br_forward+0xc4/0x194 [bridge] [ 176.304013] br_flood+0xd4/0x168 [bridge] [ 176.304300] br_handle_frame_finish+0x1d4/0x5c4 [bridge] [ 176.304536] br_nf_hook_thresh+0x124/0x134 [br_netfilter] [ 176.304978] br_nf_pre_routing_finish+0x29c/0x494 [br_netfilter] [ 176.305188] br_nf_pre_routing+0x250/0x524 [br_netfilter] [ 176.305428] br_handle_frame+0x244/0x3cc [bridge] [ 176.305695] __netif_receive_skb_core.constprop.0+0x33c/0xecc [ 176.306080] __netif_receive_skb_one_core+0x40/0x8c [ 176.306197] __netif_receive_skb+0x18/0x64 [ 176.306369] process_backlog+0x80/0x124 [ 176.306540] __napi_poll+0x38/0x17c [ 176.306636] net_rx_action+0x124/0x26c [ 176.306758] __do_softirq+0x100/0x26c [ 176.307051] ____do_softirq+0x10/0x1c [ 176.307162] call_on_irq_stack+0x24/0x4c [ 176.307289] do_softirq_own_stack+0x1c/0x2c [ 176.307396] do_softirq+0x54/0x6c [ 176.307485] __local_bh_enable_ip+0x8c/0x98 [ 176.307637] __dev_queue_xmit+0x22c/0xd28 [ 176.307775] neigh_resolve_output+0xf4/0x1a0 [ 176.308018] ip_finish_output2+0x1c8/0x628 [ 176.308137] ip_do_fragment+0x5b4/0x658 [ 176.308279] ip_fragment.constprop.0+0x48/0xec [ 176.308420] __ip_finish_output+0xa4/0x254 [ 176.308593] ip_finish_output+0x34/0x130 [ 176.308814] ip_output+0x6c/0x108 [ 176.308929] ip_send_skb+0x50/0xf0 [ 176.309095] ip_push_pending_frames+0x30/0x54 [ 176.309254] raw_sendmsg+0x758/0xaec [ 176.309568] inet_sendmsg+0x44/0x70 [ 176.309667] __sys_sendto+0x110/0x178 [ 176.309758] __arm64_sys_sendto+0x28/0x38 [ 176.309918] invoke_syscall+0x48/0x110 [ 176.310211] el0_svc_common.constprop.0+0x40/0xe0 [ 176.310353] do_el0_svc+0x1c/0x28 [ 176.310434] el0_svc+0x34/0xb4 [ 176.310551] el0t_64_sync_handler+0x120/0x12c [ 176.310690] el0t_64_sync+0x190/0x194 [ 176.311066] Code: f9402e61 79402aa2 927ff821 f9400023 (f9408860) [ 176.315743] ---[ end trace 0000000000000000 ]--- [ 176.316060] Kernel panic - not syncing: Oops: Fatal exception in interrupt [ 176.316371] Kernel Offset: 0x37e0e3000000 from 0xffff800080000000 [ 176.316564] PHYS_OFFSET: 0xffff97d780000000 [ 176.316782] CPU features: 0x0,88000203,3c020000,0100421b [ 176.317210] Memory Limit: none [ 176.317527] ---[ end Kernel panic - not syncing: Oops: Fatal
Exception in interrupt ]---\
--- net/bridge/br_netfilter_hooks.c | 5 +++++ 1 file changed, 5 insertions(+)
net/bridge/br_netfilter_hooks.c +5 -0
@@ -33,6 +33,7 @@#include <net/ip.h> #include <net/ipv6.h> #include <net/addrconf.h> +#include <net/dst_metadata.h> #include <net/route.h> #include <net/netfilter/br_netfilter.h> #include <net/netns/generic.h>
@@ -871,6 +872,10 @@ static int br_nf_dev_queue_xmit(struct net *net, struct sock *sk, struct sk_buffreturn br_dev_queue_push_xmit (net, sk, skb); } +/* Fragmentation on metadata/template dst is not supported */ +if (unlikely (!skb_valid_dst (skb))) + goto drop; +/* This is wrong! We should preserve the original fragment * boundaries by preserving frag_list rather than refragmenting. */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 121/213 selftests: net: no_forwarding: fix VID for $swp2 in one_bridge_two_pvids() test
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kacper Ludwinski <[email protected]>
[ Upstream commit 9f49d14ec41ce7be647028d7d34dea727af55272 ]
Currently, the second bridge command overwrites the first one. Fix this by adding this VID to the interface behind $swp2.
The one_bridge_two_pvids() test intends to check that there is no leakage of traffic between bridge ports which have a single VLAN - the PVID VLAN.
Because of a typo, port $swp1 is configured with a PVID twice (second command overwrites first), and $swp2 isn't configured at all (and since the bridge vlan_default_pvid property is set to 0, this port will not have a PVID at all, so it will drop all untagged and priority-tagged traffic).
So, instead of testing the configuration that was intended, we are testing a different one, where one port has PVID 2 and the other has no PVID. This incorrect version of the test should also pass, but is ineffective for its purpose, so fix the typo.
This typo has an impact on results of the test, potentially leading to wrong conclusions regarding the functionality of a network device.
The tests results:
TEST: Switch ports in VLAN-aware bridge with different PVIDs:
Unicast non-IP untagged [ OK ]
Multicast non-IP untagged [ OK ]
Broadcast non-IP untagged [ OK ]
Unicast IPv4 untagged [ OK ]
Multicast IPv4 untagged [ OK ]
Unicast IPv6 untagged [ OK ]
Multicast IPv6 untagged [ OK ]
Unicast non-IP VID 1 [ OK ]
Multicast non-IP VID 1 [ OK ]
Broadcast non-IP VID 1 [ OK ]
Unicast IPv4 VID 1 [ OK ]
Multicast IPv4 VID 1 [ OK ]
Unicast IPv6 VID 1 [ OK ]
Multicast IPv6 VID 1 [ OK ]
Unicast non-IP VID 4094 [ OK ]
Multicast non-IP VID 4094 [ OK ]
Broadcast non-IP VID 4094 [ OK ]
Unicast IPv4 VID 4094 [ OK ]
Multicast IPv4 VID 4094 [ OK ]
Unicast IPv6 VID 4094 [ OK ]
Multicast IPv6 VID 4094 [ OK ]
--- tools/testing/selftests/net/forwarding/no_forwarding.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/net/forwarding/no_forwarding.sh +1 -1
@@ -202,7 +202,7 @@ one_bridge_two_pvids() ip link set $swp2 master br0 bridge vlan add dev $swp1 vid 1 pvid untagged - bridge vlan add dev $swp1 vid 2 pvid untagged + bridge vlan add dev $swp2 vid 2 pvid untagged run_test "Switch ports in VLAN-aware bridge with different PVIDs"
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 122/213 Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 08d1914293dae38350b8088980e59fbc699a72fe ]
rfcomm_sk_state_change attempts to use sock_lock so it must never be called with it locked but rfcomm_sock_ioctl always attempt to lock it causing the following trace:
======================================================
WARNING: possible circular locking dependency detected
6.8.0-syzkaller-08951-gfe46a7dd189e #0 Not tainted
------------------------------------------------------
syz-executor386/5093 is trying to acquire lock:ffff88807c396258 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1671 [inline] ffff88807c396258 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}, at: rfcomm_sk_state_change+0x5b/0x310 net/bluetooth/rfcomm/sock.c:73
but task is already holding lock:ffff88807badfd28 (&d->lock){+.+.}-{3:3}, at: __rfcomm_dlc_close+0x226/0x6a0 net/bluetooth/rfcomm/core.c:491
--- net/bluetooth/rfcomm/sock.c | 2 -- 1 file changed, 2 deletions(-)
net/bluetooth/rfcomm/sock.c +0 -2
@@ -865,9 +865,7 @@ static int rfcomm_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned lonif (err == -ENOIOCTLCMD ) {#ifdef CONFIG_BT_RFCOMM_TTY -lock_sock (sk); err =rfcomm_dev_ioctl (sk, cmd, (void __user *) arg); -release_sock (sk);#else err = -EOPNOTSUPP ;#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 123/213 net: phy: bcm84881: Fix some error handling paths
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 9234a2549cb6ac038bec36cc7c084218e9575513 ]
If phy_read_mmd() fails, the error code stored in 'bmsr' should be returned instead of 'val' which is likely to be 0.
--- drivers/net/phy/bcm84881.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/phy/bcm84881.c +2 -2
@@ -120,7 +120,7 @@ static int bcm84881_aneg_done(struct phy_device *phydev) bmsr =phy_read_mmd (phydev,MDIO_MMD_AN ,MDIO_AN_C22 +MII_BMSR );if (bmsr <0 ) -return val; +return bmsr;return !!(val &MDIO_AN_STAT1_COMPLETE ) && !!(bmsr &BMSR_ANEGCOMPLETE );
@@ -146,7 +146,7 @@ static int bcm84881_read_status(struct phy_device *phydev) bmsr =phy_read_mmd (phydev,MDIO_MMD_AN ,MDIO_AN_C22 +MII_BMSR );if (bmsr <0 ) -return val; +return bmsr; phydev->autoneg_complete = !!(val &MDIO_AN_STAT1_COMPLETE ) && !!(bmsr &BMSR_ANEGCOMPLETE );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 124/213 thermal: int340x: processor_thermal: Set feature mask before proc_thermal_add
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <[email protected]>
[ Upstream commit 6ebc25d8b053a208786295bab58abbb66b39c318 ]
The function proc_thermal_add() adds sysfs entries for power limits.
The feature mask of available features is not present at that time, so it cannot be used by proc_thermal_add() to selectively create sysfs attributes.
The feature mask is set by proc_thermal_mmio_add(), so modify the code to call it before proc_thermal_add() so as to allow the latter to use the feature mask.
There is no functional impact with this change.
Stable-dep-of: 99ca0b57e49f ("thermal: intel: int340x: processor: Fix warning during module unload")
--- .../processor_thermal_device_pci.c | 21 +++++++++---------- 1 file changed, 10 insertions(+), 11 deletions(-)
drivers/thermal/intel/int340x_thermal/processor_thermal_device_pci.c +10 -11
@@ -223,19 +223,19 @@ static int proc_thermal_pci_probe(struct pci_dev *pdev, const struct pci_device_INIT_DELAYED_WORK (&pci_info->work, proc_thermal_threshold_work_fn); - ret =proc_thermal_add (&pdev->dev, proc_priv); -if (ret) { -dev_err (&pdev->dev,"error: proc_thermal_add, will continue\n" ); - pci_info->no_legacy =1 ; - } - proc_priv->priv_data = pci_info; pci_info->proc_priv = proc_priv;pci_set_drvdata (pdev, proc_priv); ret =proc_thermal_mmio_add (pdev, proc_priv, id->driver_data);if (ret) - goto err_ret_thermal; +return ret; + + ret =proc_thermal_add (&pdev->dev, proc_priv); +if (ret) { +dev_err (&pdev->dev,"error: proc_thermal_add, will continue\n" ); + pci_info->no_legacy =1 ; + } psv_trip.temperature =get_trip_temp (pci_info);
@@ -245,7 +245,7 @@ static int proc_thermal_pci_probe(struct pci_dev *pdev, const struct pci_device_ &tzone_params, 0, 0);if (IS_ERR (pci_info->tzone)) { ret =PTR_ERR (pci_info->tzone); - goto err_ret_mmio; + goto err_del_legacy; }/* request and enable interrupt */
@@ -276,11 +276,10 @@ static int proc_thermal_pci_probe(struct pci_dev *pdev, const struct pci_device_pci_free_irq_vectors (pdev); err_ret_tzone:thermal_zone_device_unregister (pci_info->tzone); -err_ret_mmio: -proc_thermal_mmio_remove (pdev, proc_priv); -err_ret_thermal: +err_del_legacy:if (!pci_info->no_legacy)proc_thermal_remove (proc_priv); +proc_thermal_mmio_remove (pdev, proc_priv);pci_disable_device (pdev);return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 125/213 thermal: intel: int340x: processor: Fix warning during module unload
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Rui <[email protected]>
[ Upstream commit 99ca0b57e49fb73624eede1c4396d9e3d10ccf14 ]
The processor_thermal driver uses pcim_device_enable() to enable a PCI device, which means the device will be automatically disabled on driver detach. Thus there is no need to call pci_disable_device() again on it.
With recent PCI device resource management improvements, e.g. commit f748a07a0b64 ("PCI: Remove legacy pcim_release()"), this problem is exposed and triggers the warining below.
[ 224.010735] proc_thermal_pci 0000:00:04.0: disabling already-disabled device [ 224.010747] WARNING: CPU: 8 PID: 4442 at drivers/pci/pci.c:2250 pci_disable_device+0xe5/0x100 ... [ 224.010844] Call Trace: [ 224.010845] <TASK> [ 224.010847] ? show_regs+0x6d/0x80 [ 224.010851] ? __warn+0x8c/0x140 [ 224.010854] ? pci_disable_device+0xe5/0x100 [ 224.010856] ? report_bug+0x1c9/0x1e0 [ 224.010859] ? handle_bug+0x46/0x80 [ 224.010862] ? exc_invalid_op+0x1d/0x80 [ 224.010863] ? asm_exc_invalid_op+0x1f/0x30 [ 224.010867] ? pci_disable_device+0xe5/0x100 [ 224.010869] ? pci_disable_device+0xe5/0x100 [ 224.010871] ? kfree+0x21a/0x2b0 [ 224.010873] pcim_disable_device+0x20/0x30 [ 224.010875] devm_action_release+0x16/0x20 [ 224.010878] release_nodes+0x47/0xc0 [ 224.010880] devres_release_all+0x9f/0xe0 [ 224.010883] device_unbind_cleanup+0x12/0x80 [ 224.010885] device_release_driver_internal+0x1ca/0x210 [ 224.010887] driver_detach+0x4e/0xa0 [ 224.010889] bus_remove_driver+0x6f/0xf0 [ 224.010890] driver_unregister+0x35/0x60 [ 224.010892] pci_unregister_driver+0x44/0x90 [ 224.010894] proc_thermal_pci_driver_exit+0x14/0x5f0 [processor_thermal_device_pci] ... [ 224.010921] ---[ end trace 0000000000000000 ]---
Remove the excess pci_disable_device() calls.
--- .../intel/int340x_thermal/processor_thermal_device_pci.c | 2 -- 1 file changed, 2 deletions(-)
drivers/thermal/intel/int340x_thermal/processor_thermal_device_pci.c +0 -2
@@ -280,7 +280,6 @@ static int proc_thermal_pci_probe(struct pci_dev *pdev, const struct pci_device_if (!pci_info->no_legacy)proc_thermal_remove (proc_priv);proc_thermal_mmio_remove (pdev, proc_priv); -pci_disable_device (pdev);return ret; }
@@ -302,7 +301,6 @@ static void proc_thermal_pci_remove(struct pci_dev *pdev)proc_thermal_mmio_remove (pdev, pci_info->proc_priv);if (!pci_info->no_legacy)proc_thermal_remove (proc_priv); -pci_disable_device (pdev); }#ifdef CONFIG_PM_SLEEP
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 126/213 Revert "net: stmmac: set PP_FLAG_DMA_SYNC_DEV only if XDP is enabled"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 5546da79e6cc5bb3324bf25688ed05498fd3f86d ]
This reverts commit b514c47ebf41a6536551ed28a05758036e6eca7c.
The commit describes that we don't have to sync the page when recycling, and it tries to optimize that case. But we do need to sync after allocation. Recycling side should be changed to pass the right sync size instead.
--- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +1 -1
@@ -2018,7 +2018,7 @@ static int __alloc_dma_rx_desc_resources(struct stmmac_priv *priv, rx_q->queue_index = queue; rx_q->priv_data = priv; - pp_params.flags =PP_FLAG_DMA_MAP | (xdp_prog ?PP_FLAG_DMA_SYNC_DEV :0 ); + pp_params.flags =PP_FLAG_DMA_MAP |PP_FLAG_DMA_SYNC_DEV ; pp_params.pool_size = dma_conf->dma_rx_size; num_pages =DIV_ROUND_UP (dma_conf->dma_buf_sz,PAGE_SIZE ); pp_params.order =ilog2 (num_pages);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 127/213 net: ethernet: adi: adin1110: Fix some error handling path in adin1110_read_fifo()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 83211ae1640516accae645de82f5a0a142676897 ]
If 'frame_size' is too small or if 'round_len' is an error code, it is likely that an error code should be returned to the caller.
Actually, 'ret' is likely to be 0, so if one of these sanity checks fails, 'success' is returned.
Return -EINVAL instead.
--- drivers/net/ethernet/adi/adin1110.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/adi/adin1110.c +2 -2
@@ -318,11 +318,11 @@ static int adin1110_read_fifo(struct adin1110_port_priv *port_priv)* from the ADIN1110 frame header. */ if (frame_size <ADIN1110_FRAME_HEADER_LEN +ADIN1110_FEC_LEN ) -return ret; +return -EINVAL ; round_len =adin1110_round_len (frame_size);if (round_len <0 ) -return ret; +return -EINVAL ; frame_size_no_fcs = frame_size -ADIN1110_FRAME_HEADER_LEN -ADIN1110_FEC_LEN ;memset (priv->data,0 ,ADIN1110_RD_HEADER_LEN );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 128/213 net: dsa: b53: fix jumbo frame mtu check
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <[email protected]>
[ Upstream commit 42fb3acf6826c6764ba79feb6e15229b43fd2f9f ]
JMS_MIN_SIZE is the full ethernet frame length, while mtu is just the data payload size. Comparing these two meant that mtus between 1500 and 1518 did not trigger enabling jumbo frames.
So instead compare the set mtu ETH_DATA_LEN, which is equal to JMS_MIN_SIZE - ETH_HLEN - ETH_FCS_LEN;
Also do a check that the requested mtu is actually greater than the minimum length, else we do not need to enable jumbo frames.
In practice this only introduced a very small range of mtus that did not work properly. Newer chips allow 2000 byte large frames by default, and older chips allow 1536 bytes long, which is equivalent to an mtu of 1514. So effectivly only mtus of 1515~1517 were broken.
--- drivers/net/dsa/b53/b53_common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/dsa/b53/b53_common.c +1 -1
@@ -2268,7 +2268,7 @@ static int b53_change_mtu(struct dsa_switch *ds, int port, int mtu)if (!dsa_is_cpu_port (ds, port))return 0 ; - enable_jumbo = (mtu >=JMS_MIN_SIZE ); + enable_jumbo = (mtu >ETH_DATA_LEN ); allow_10_100 = (dev->chip_id ==BCM583XX_DEVICE_ID );return b53_set_jumbo (dev, enable_jumbo, allow_10_100);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 129/213 net: dsa: b53: fix max MTU for 1g switches
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <[email protected]>
[ Upstream commit 680a8217dc00dc7e7da57888b3c053289b60eb2b ]
JMS_MAX_SIZE is the ethernet frame length, not the MTU, which is payload without ethernet headers.
According to the datasheets maximum supported frame length for most gigabyte swithes is 9720 bytes, so convert that to the expected MTU when using VLAN tagged frames.
--- drivers/net/dsa/b53/b53_common.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/dsa/b53/b53_common.c +4 -1
@@ -27,6 +27,7 @@#include <linux/phylink.h> #include <linux/etherdevice.h> #include <linux/if_bridge.h> +#include <linux/if_vlan.h> #include <net/dsa.h> #include "b53_regs.h"
@@ -224,6 +225,8 @@ static const struct b53_mib_desc b53_mibs_58xx[] = {#define B53_MIBS_58XX_SIZE ARRAY_SIZE(b53_mibs_58xx) +#define B53_MAX_MTU (9720 - ETH_HLEN - VLAN_HLEN - ETH_FCS_LEN) +static int b53_do_vlan_op (struct b53_device *dev,u8 op) {unsigned int i;
@@ -2276,7 +2279,7 @@ static int b53_change_mtu(struct dsa_switch *ds, int port, int mtu)static int b53_get_max_mtu (struct dsa_switch *ds,int port) { -return JMS_MAX_SIZE ; +return B53_MAX_MTU ; }static const struct dsa_switch_ops b53_switch_ops = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 130/213 net: dsa: b53: fix max MTU for BCM5325/BCM5365
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <[email protected]>
[ Upstream commit ca8c1f71c10193c270f772d70d34b15ad765d6a8 ]
BCM5325/BCM5365 do not support jumbo frames, so we should not report a jumbo frame mtu for them. But they do support so called "oversized" frames up to 1536 bytes long by default, so report an appropriate MTU.
--- drivers/net/dsa/b53/b53_common.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/dsa/b53/b53_common.c +6 -0
@@ -225,6 +225,7 @@ static const struct b53_mib_desc b53_mibs_58xx[] = {#define B53_MIBS_58XX_SIZE ARRAY_SIZE(b53_mibs_58xx) +#define B53_MAX_MTU_25 (1536 - ETH_HLEN - VLAN_HLEN - ETH_FCS_LEN)#define B53_MAX_MTU (9720 - ETH_HLEN - VLAN_HLEN - ETH_FCS_LEN)static int b53_do_vlan_op (struct b53_device *dev,u8 op)
@@ -2279,6 +2280,11 @@ static int b53_change_mtu(struct dsa_switch *ds, int port, int mtu)static int b53_get_max_mtu (struct dsa_switch *ds,int port) { +struct b53_device *dev = ds->priv; + +if (is5325 (dev) ||is5365 (dev)) +return B53_MAX_MTU_25 ; +return B53_MAX_MTU ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 131/213 net: dsa: b53: allow lower MTUs on BCM5325/5365
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <[email protected]>
[ Upstream commit e4b294f88a32438baf31762441f3dd1c996778be ]
While BCM5325/5365 do not support jumbo frames, they do support slightly oversized frames, so do not error out if requesting a supported MTU for them.
--- drivers/net/dsa/b53/b53_common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/dsa/b53/b53_common.c +1 -1
@@ -2267,7 +2267,7 @@ static int b53_change_mtu(struct dsa_switch *ds, int port, int mtu)bool allow_10_100;if (is5325 (dev) ||is5365 (dev)) -return -EOPNOTSUPP ; +return 0 ;if (!dsa_is_cpu_port (ds, port))return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 132/213 net: dsa: b53: fix jumbo frames on 10/100 ports
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <[email protected]>
[ Upstream commit 2f3dcd0d39affe5b9ba1c351ce0e270c8bdd5109 ]
All modern chips support and need the 10_100 bit set for supporting jumbo frames on 10/100 ports, so instead of enabling it only for 583XX enable it for everything except bcm63xx, where the bit is writeable, but does nothing.
Tested on BCM53115, where jumbo frames were dropped at 10/100 speeds without the bit set.
--- drivers/net/dsa/b53/b53_common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/dsa/b53/b53_common.c +1 -1
@@ -2273,7 +2273,7 @@ static int b53_change_mtu(struct dsa_switch *ds, int port, int mtu)return 0 ; enable_jumbo = (mtu >ETH_DATA_LEN ); - allow_10_100 = (dev->chip_id ==BCM583XX_DEVICE_ID ); + allow_10_100 = !is63xx (dev);return b53_set_jumbo (dev, enable_jumbo, allow_10_100); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 133/213 drm/nouveau: pass cli to nouveau_channel_new() instead of drm+device
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Skeggs <[email protected]>
[ Upstream commit 5cca41ac70e5877383ed925bd017884c37edf09b ]
Both of these are stored in nouveau_cli already, and also allows the removal of some void casts.
Stable-dep-of: 04e0481526e3 ("nouveau/dmem: Fix privileged error in copy engine channel")
--- drivers/gpu/drm/nouveau/dispnv04/crtc.c | 2 +- drivers/gpu/drm/nouveau/nouveau_abi16.c | 2 +- drivers/gpu/drm/nouveau/nouveau_bo.c | 2 +- drivers/gpu/drm/nouveau/nouveau_chan.c | 21 +++++++++++---------- drivers/gpu/drm/nouveau/nouveau_chan.h | 3 ++- drivers/gpu/drm/nouveau/nouveau_drm.c | 4 ++-- 6 files changed, 18 insertions(+), 16 deletions(-)
drivers/gpu/drm/nouveau/dispnv04/crtc.c +1 -1
@@ -1157,7 +1157,7 @@ nv04_crtc_page_flip(struct drm_crtc *crtc, struct drm_framebuffer *fb, chan = drm->channel;if (!chan)return -ENODEV ; - cli = (void *)chan->user.client; + cli = chan->cli; push = chan->chan.push; s =kzalloc (sizeof (*s),GFP_KERNEL );
drivers/gpu/drm/nouveau/nouveau_abi16.c +1 -1
@@ -351,7 +351,7 @@ nouveau_abi16_ioctl_channel_alloc(ABI16_IOCTL_ARGS)list_add (&chan->head, &abi16->channels);/* create channel object and initialise dma and fence management */ - ret =nouveau_channel_new (drm, device, false, runm, init->fb_ctxdma_handle, + ret =nouveau_channel_new (cli, false, runm, init->fb_ctxdma_handle, init->tt_ctxdma_handle, &chan->chan);if (ret) goto done;
drivers/gpu/drm/nouveau/nouveau_bo.c +1 -1
@@ -843,7 +843,7 @@ nouveau_bo_move_m2mf(struct ttm_buffer_object *bo, int evict, {struct nouveau_drm *drm =nouveau_bdev (bo->bdev);struct nouveau_channel *chan = drm->ttm.chan; -struct nouveau_cli *cli = (void *)chan->user.client; +struct nouveau_cli *cli = chan->cli;struct nouveau_fence *fence;int ret;
drivers/gpu/drm/nouveau/nouveau_chan.c +11 -10
@@ -52,7 +52,7 @@ static int nouveau_channel_killed(struct nvif_event *event, void *repv, u32 repc) { struct nouveau_channel *chan = container_of(event, typeof(*chan), kill); -struct nouveau_cli *cli = (void *)chan->user.client; +struct nouveau_cli *cli = chan->cli;NV_PRINTK (warn, cli,"channel %d killed!\n" , chan->chid);
@@ -66,7 +66,7 @@ int nouveau_channel_idle(struct nouveau_channel *chan) {if (likely (chan && chan->fence && !atomic_read (&chan->killed))) { -struct nouveau_cli *cli = (void *)chan->user.client; +struct nouveau_cli *cli = chan->cli;struct nouveau_fence *fence =NULL ;int ret;
@@ -142,10 +142,11 @@ nouveau_channel_wait(struct nvif_push *push, u32 size) }static int -nouveau_channel_prep (struct nouveau_drm *drm,struct nvif_device *device, +nouveau_channel_prep (struct nouveau_cli *cli,u32 size,struct nouveau_channel **pchan) { -struct nouveau_cli *cli = (void *)device->object.client; +struct nouveau_drm *drm = cli->drm; +struct nvif_device *device = &cli->device;struct nv_dma_v0 args = {};struct nouveau_channel *chan;u32 target;
@@ -155,6 +156,7 @@ nouveau_channel_prep(struct nouveau_drm *drm, struct nvif_device *device,if (!chan)return -ENOMEM ; + chan->cli = cli; chan->device = device; chan->drm = drm; chan->vmm =nouveau_cli_vmm (cli);
@@ -254,7 +256,7 @@ nouveau_channel_prep(struct nouveau_drm *drm, struct nvif_device *device, }static int -nouveau_channel_ctor (struct nouveau_drm *drm,struct nvif_device *device,bool priv,u64 runm, +nouveau_channel_ctor (struct nouveau_cli *cli,bool priv,u64 runm,struct nouveau_channel **pchan) {const struct nvif_mclass hosts[] = {
@@ -279,7 +281,7 @@ nouveau_channel_ctor(struct nouveau_drm *drm, struct nvif_device *device, bool pstruct nvif_chan_v0 chan;char name[TASK_COMM_LEN +16 ]; } args; -struct nouveau_cli *cli = (void *)device->object.client; +struct nvif_device *device = &cli->device;struct nouveau_channel *chan;const u64 plength =0x10000 ;const u64 ioffset = plength;
@@ -298,7 +300,7 @@ nouveau_channel_ctor(struct nouveau_drm *drm, struct nvif_device *device, bool p size = ioffset + ilength;/* allocate dma push buffer */ - ret =nouveau_channel_prep (drm, device, size, &chan); + ret =nouveau_channel_prep (cli, size, &chan); *pchan = chan;if (ret)return ret;
@@ -493,13 +495,12 @@ nouveau_channel_init(struct nouveau_channel *chan, u32 vram, u32 gart) }int -nouveau_channel_new (struct nouveau_drm *drm,struct nvif_device *device, +nouveau_channel_new (struct nouveau_cli *cli,bool priv,u64 runm,u32 vram,u32 gart,struct nouveau_channel **pchan) { -struct nouveau_cli *cli = (void *)device->object.client;int ret; - ret =nouveau_channel_ctor (drm, device, priv, runm, pchan); + ret =nouveau_channel_ctor (cli, priv, runm, pchan);if (ret) {NV_PRINTK (dbg, cli,"channel create, %d\n" , ret);return ret;
drivers/gpu/drm/nouveau/nouveau_chan.h +2 -1
@@ -12,6 +12,7 @@ struct nouveau_channel {struct nvif_push *push; } chan; +struct nouveau_cli *cli;struct nvif_device *device;struct nouveau_drm *drm;struct nouveau_vmm *vmm;
@@ -62,7 +63,7 @@ struct nouveau_channel {int nouveau_channels_init (struct nouveau_drm *);void nouveau_channels_fini (struct nouveau_drm *); -int nouveau_channel_new (struct nouveau_drm *,struct nvif_device *,bool priv,u64 runm, +int nouveau_channel_new (struct nouveau_cli *,bool priv,u64 runm,u32 vram,u32 gart,struct nouveau_channel **);void nouveau_channel_del (struct nouveau_channel **);int nouveau_channel_idle (struct nouveau_channel *);
drivers/gpu/drm/nouveau/nouveau_drm.c +2 -2
@@ -343,7 +343,7 @@ nouveau_accel_ce_init(struct nouveau_drm *drm)return ; } - ret =nouveau_channel_new (drm, device, false, runm, NvDmaFB, NvDmaTT, &drm->cechan); + ret =nouveau_channel_new (&drm->client, false, runm, NvDmaFB, NvDmaTT, &drm->cechan);if (ret)NV_ERROR (drm,"failed to create ce channel, %d\n" , ret); }
@@ -371,7 +371,7 @@ nouveau_accel_gr_init(struct nouveau_drm *drm)return ; } - ret =nouveau_channel_new (drm, device, false, runm, NvDmaFB, NvDmaTT, &drm->channel); + ret =nouveau_channel_new (&drm->client, false, runm, NvDmaFB, NvDmaTT, &drm->channel);if (ret) {NV_ERROR (drm,"failed to create kernel channel, %d\n" , ret);nouveau_accel_gr_fini (drm);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 134/213 nouveau/dmem: Fix privileged error in copy engine channel
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yonatan Maman <[email protected]>
[ Upstream commit 04e0481526e30ab8c7e7580033d2f88b7ef2da3f ]
When nouveau_dmem_copy_one is called, the following error occurs:
[272146.675156] nouveau 0000:06:00.0: fifo: PBDMA9: 00000004 [HCE_PRIV]
ch 1 00000300 00003386
This indicates that a copy push command triggered a Host Copy Engine Privileged error on channel 1 (Copy Engine channel). To address this issue, modify the Copy Engine channel to allow privileged push commands
--- drivers/gpu/drm/nouveau/nouveau_drm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/nouveau/nouveau_drm.c +1 -1
@@ -343,7 +343,7 @@ nouveau_accel_ce_init(struct nouveau_drm *drm)return ; } - ret =nouveau_channel_new (&drm->client, false, runm, NvDmaFB, NvDmaTT, &drm->cechan); + ret =nouveau_channel_new (&drm->client, true, runm, NvDmaFB, NvDmaTT, &drm->cechan);if (ret)NV_ERROR (drm,"failed to create ce channel, %d\n" , ret); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 135/213 gpio: aspeed: Add the flush write to ensure the write complete.
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Billy Tsai <[email protected]>
[ Upstream commit 1bb5a99e1f3fd27accb804aa0443a789161f843c ]
Performing a dummy read ensures that the register write operation is fully completed, mitigating any potential bus delays that could otherwise impact the frequency of bitbang usage. E.g., if the JTAG application uses GPIO to control the JTAG pins (TCK, TMS, TDI, TDO, and TRST), and the application sets the TCK clock to 1 MHz, the GPIO's high/low transitions will rely on a delay function to ensure the clock frequency does not exceed 1 MHz. However, this can lead to rapid toggling of the GPIO because the write operation is POSTed and does not wait for a bus acknowledgment.
--- drivers/gpio/gpio-aspeed.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpio/gpio-aspeed.c +2 -0
@@ -406,6 +406,8 @@ static void __aspeed_gpio_set(struct gpio_chip *gc, unsigned int offset, gpio->dcache[GPIO_BANK (offset)] = reg;iowrite32 (reg, addr); +/* Flush write */ +ioread32 (addr); } static void aspeed_gpio_set(struct gpio_chip *gc, unsigned int offset,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 136/213 gpio: aspeed: Use devm_clk api to manage clock source
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Billy Tsai <[email protected]>
[ Upstream commit a6191a3d18119184237f4ee600039081ad992320 ]
Replace of_clk_get with devm_clk_get_enabled to manage the clock source.
--- drivers/gpio/gpio-aspeed.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpio/gpio-aspeed.c +1 -1
@@ -1193,7 +1193,7 @@ static int __init aspeed_gpio_probe(struct platform_device *pdev)if (!gpio_id)return -EINVAL ; - gpio->clk =of_clk_get (pdev->dev.of_node,0 ); + gpio->clk =devm_clk_get_enabled (&pdev->dev,NULL );if (IS_ERR (gpio->clk)) {dev_warn (&pdev->dev,"Failed to get clock from devicetree, debouncing disabled\n" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 137/213 platform/x86/intel/tpmi: Add defines to get version information
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <[email protected]>
[ Upstream commit 8874e414fe78718d0f2861fe511cecbd1cd73f4d ]
Add defines to get major and minor version from a TPMI version field value. This will avoid code duplication to convert in every feature driver. Also add define for invalid version field.
Stable-dep-of: 1d390923974c ("powercap: intel_rapl_tpmi: Ignore minor version change")
--- include/linux/intel_tpmi.h | 6 ++++++ 1 file changed, 6 insertions(+)
include/linux/intel_tpmi.h +6 -0
@@ -6,6 +6,12 @@#ifndef _INTEL_TPMI_H_#define _INTEL_TPMI_H_ +#include <linux/bitfield.h> + +#define TPMI_VERSION_INVALID 0xff +#define TPMI_MINOR_VERSION (val) FIELD_GET(GENMASK(4, 0), val) +#define TPMI_MAJOR_VERSION (val) FIELD_GET(GENMASK(7, 5), val) +/** * struct intel_tpmi_plat_info - Platform information for a TPMI device instance * @package_id: CPU Package id
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 138/213 powercap: intel_rapl_tpmi: Ignore minor version change
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Rui <[email protected]>
[ Upstream commit 1d390923974cc233245649cf23833e06b15a9ef7 ]
The hardware definition of every TPMI feature contains a major and minor version. When there is a change in the MMIO offset or change in the definition of a field, hardware will change major version. For addition of new fields without modifying existing MMIO offsets or fields, only the minor version is changed.
If the driver has not been updated to recognize a new hardware major version, it cannot provide the RAPL interface to users due to possible register layout incompatibilities. However, the driver does not need to be updated every time the hardware minor version changes because in that case it will just miss some new functionality exposed by the hardware.
The current implementation causes the driver to refuse to work for any hardware version change which is unnecessarily restrictive.
If there is a minor version mismatch, log an information message and continue, but if there is a major version mismatch, log a warning and exit (as before).
--- drivers/powercap/intel_rapl_tpmi.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-)
drivers/powercap/intel_rapl_tpmi.c +14 -3
@@ -15,7 +15,8 @@#include <linux/module.h> #include <linux/slab.h> -#define TPMI_RAPL_VERSION 1 +#define TPMI_RAPL_MAJOR_VERSION 0 +#define TPMI_RAPL_MINOR_VERSION 1/* 1 header + 10 registers + 5 reserved. 8 bytes for each. */ #define TPMI_RAPL_DOMAIN_SIZE 128
@@ -154,11 +155,21 @@ static int parse_one_domain(struct tpmi_rapl_package *trp, u32 offset) tpmi_domain_size = tpmi_domain_header >>16 &0xff ; tpmi_domain_flags = tpmi_domain_header >>32 &0xffff ; -if (tpmi_domain_version !=TPMI_RAPL_VERSION ) { -pr_warn (FW_BUG "Unsupported version:%d\n" , tpmi_domain_version); +if (tpmi_domain_version ==TPMI_VERSION_INVALID ) { +pr_warn (FW_BUG "Invalid version\n" );return -ENODEV ; } +if (TPMI_MAJOR_VERSION (tpmi_domain_version) !=TPMI_RAPL_MAJOR_VERSION ) { +pr_warn (FW_BUG "Unsupported major version:%ld\n" , +TPMI_MAJOR_VERSION (tpmi_domain_version)); +return -ENODEV ; + } + +if (TPMI_MINOR_VERSION (tpmi_domain_version) >TPMI_RAPL_MINOR_VERSION ) +pr_info ("Ignore: Unsupported minor version:%ld\n" , +TPMI_MINOR_VERSION (tpmi_domain_version)); +/* Domain size: in unit of 128 Bytes */ if (tpmi_domain_size !=1 ) {pr_warn (FW_BUG "Invalid Domain size %d\n" , tpmi_domain_size);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 139/213 ice: Fix netif_is_ice() in Safe Mode
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marcin Szycik <[email protected]>
[ Upstream commit 8e60dbcbaaa177dacef55a61501790e201bf8c88 ]
netif_is_ice() works by checking the pointer to netdev ops. However, it only checks for the default ice_netdev_ops, not ice_netdev_safe_mode_ops, so in Safe Mode it always returns false, which is unintuitive. While it doesn't look like netif_is_ice() is currently being called anywhere in Safe Mode, this could change and potentially lead to unexpected behaviour.
--- drivers/net/ethernet/intel/ice/ice_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/ice/ice_main.c +2 -1
@@ -84,7 +84,8 @@ ice_indr_setup_tc_cb(struct net_device *netdev, struct Qdisc *sch,bool netif_is_ice (const struct net_device *dev) { -return dev && (dev->netdev_ops == &ice_netdev_ops); +return dev && (dev->netdev_ops == &ice_netdev_ops || + dev->netdev_ops == &ice_netdev_safe_mode_ops); }/**
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 140/213 ice: rename switchdev to eswitch
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Swiatkowski <[email protected]>
[ Upstream commit 5a841e4eb8ed2fea91025b19af8a9ba544f63323 ]
Eswitch is used as a prefix for related functions. Main structure storing all data related to eswitch should also be named as eswitch instead of ice_switchdev_info. Rename it.
Also rename switchdev to eswitch where the context is not about eswitch mode.
::uplink_netdev was changed to netdev for simplicity. There is no other netdev in function scope so it is obvious.
Stable-dep-of: fbcb968a98ac ("ice: Flush FDB entries before reset")
--- drivers/net/ethernet/intel/ice/ice.h | 6 +- drivers/net/ethernet/intel/ice/ice_eswitch.c | 63 ++++++++++--------- .../net/ethernet/intel/ice/ice_eswitch_br.c | 12 ++-- drivers/net/ethernet/intel/ice/ice_tc_lib.c | 4 +- 4 files changed, 43 insertions(+), 42 deletions(-)
drivers/net/ethernet/intel/ice/ice.h +3 -3
@@ -518,7 +518,7 @@ enum ice_misc_thread_tasks {ICE_MISC_THREAD_NBITS /* must be last */ }; -struct ice_switchdev_info { +struct ice_eswitch {struct ice_vsi *control_vsi;struct ice_vsi *uplink_vsi;struct ice_esw_br_offloads *br_offloads;
@@ -631,7 +631,7 @@ struct ice_pf {struct ice_link_default_override_tlv link_dflt_override;struct ice_lag *lag;/* Link Aggregation information */ -struct ice_switchdev_info switchdev; +struct ice_eswitch eswitch;struct ice_esw_br_port *br_port;#define ICE_INVALID_AGG_NODE_ID 0
@@ -838,7 +838,7 @@ static inline struct ice_vsi *ice_find_vsi(struct ice_pf *pf, u16 vsi_num)*/ static inline bool ice_is_switchdev_running (struct ice_pf *pf) { -return pf->switchdev.is_running; +return pf->eswitch.is_running; }#define ICE_FD_STAT_CTR_BLOCK_COUNT 256
drivers/net/ethernet/intel/ice/ice_eswitch.c +32 -31
188 lines not on this page · raw message
drivers/net/ethernet/intel/ice/ice_eswitch_br.c +6 -6
@@ -947,7 +947,7 @@ ice_eswitch_br_vf_repr_port_init(struct ice_esw_br *bridge,static int ice_eswitch_br_uplink_port_init (struct ice_esw_br *bridge,struct ice_pf *pf) { -struct ice_vsi *vsi = pf->switchdev.uplink_vsi; +struct ice_vsi *vsi = pf->eswitch.uplink_vsi;struct ice_esw_br_port *br_port;int err;
@@ -1185,7 +1185,7 @@ ice_eswitch_br_port_event(struct notifier_block *nb,static void ice_eswitch_br_offloads_dealloc (struct ice_pf *pf) { -struct ice_esw_br_offloads *br_offloads = pf->switchdev.br_offloads; +struct ice_esw_br_offloads *br_offloads = pf->eswitch.br_offloads;ASSERT_RTNL ();
@@ -1194,7 +1194,7 @@ ice_eswitch_br_offloads_dealloc(struct ice_pf *pf)ice_eswitch_br_deinit (br_offloads, br_offloads->bridge); - pf->switchdev.br_offloads =NULL ; + pf->eswitch.br_offloads =NULL ;kfree (br_offloads); }
@@ -1205,14 +1205,14 @@ ice_eswitch_br_offloads_alloc(struct ice_pf *pf)ASSERT_RTNL (); -if (pf->switchdev.br_offloads) +if (pf->eswitch.br_offloads)return ERR_PTR (-EEXIST ); br_offloads =kzalloc (sizeof (*br_offloads),GFP_KERNEL );if (!br_offloads)return ERR_PTR (-ENOMEM ); - pf->switchdev.br_offloads = br_offloads; + pf->eswitch.br_offloads = br_offloads; br_offloads->pf = pf;return br_offloads;
@@ -1223,7 +1223,7 @@ ice_eswitch_br_offloads_deinit(struct ice_pf *pf) {struct ice_esw_br_offloads *br_offloads; - br_offloads = pf->switchdev.br_offloads; + br_offloads = pf->eswitch.br_offloads;if (!br_offloads)return ;
drivers/net/ethernet/intel/ice/ice_tc_lib.c +2 -2
@@ -660,7 +660,7 @@ static int ice_tc_setup_redirect_action(struct net_device *filter_dev, ice_tc_is_dev_uplink(target_dev)) { repr =ice_netdev_to_repr (filter_dev); - fltr->dest_vsi = repr->src_vsi->back->switchdev.uplink_vsi; + fltr->dest_vsi = repr->src_vsi->back->eswitch.uplink_vsi; fltr->direction =ICE_ESWITCH_FLTR_EGRESS ; } else if (ice_tc_is_dev_uplink(filter_dev) &&ice_is_port_repr_netdev (target_dev )) {
@@ -772,7 +772,7 @@ ice_eswitch_add_tc_fltr(struct ice_vsi *vsi, struct ice_tc_flower_fltr *fltr) rule_info.sw_act.src = hw->pf_id; rule_info.flags_info.act =ICE_SINGLE_ACT_LB_ENABLE ; }else if (fltr->direction ==ICE_ESWITCH_FLTR_EGRESS && - fltr->dest_vsi == vsi->back->switchdev.uplink_vsi) { + fltr->dest_vsi == vsi->back->eswitch.uplink_vsi) {/* VF to Uplink */ rule_info.sw_act.flag |=ICE_FLTR_TX ; rule_info.sw_act.src = vsi->idx;
Signature · 1 line
2.43.0