6.11.11-rc1 review
Subsystems (6)
Greg Kroah-Hartman
maintainerPATCH 260/817 selftests/bpf: netns_new() and netns_free() helpers.
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kui-Feng Lee <[email protected]>
[ Upstream commit 1e115a58be0ffca63727dc0495dae924a19f8cd4 ]
netns_new()/netns_free() create/delete network namespaces. They support the option '-m' of test_progs to start/stop traffic monitor for the network namespace being created for matched tests.
Stable-dep-of: 5bf1557e3d6a ("selftests/bpf: Fix backtrace printing for selftests crashes")
--- tools/testing/selftests/bpf/network_helpers.c | 46 ++++++++++ tools/testing/selftests/bpf/network_helpers.h | 2 + tools/testing/selftests/bpf/test_progs.c | 88 +++++++++++++++++++ tools/testing/selftests/bpf/test_progs.h | 4 + 4 files changed, 140 insertions(+)
tools/testing/selftests/bpf/network_helpers.c +46 -0
@@ -448,6 +448,52 @@ char *ping_command(int family)return "ping" ; } +int remove_netns (const char *name) +{ +char *cmd; +int r; + + r =asprintf (&cmd,"ip netns del %s >/dev/null 2>&1" , name); +if (r <0 ) { +log_err ("Failed to malloc cmd" ); +return -1 ; + } + + r =system (cmd); +free (cmd); +return r; +} + +int make_netns (const char *name) +{ +char *cmd; +int r; + + r =asprintf (&cmd,"ip netns add %s" , name); +if (r <0 ) { +log_err ("Failed to malloc cmd" ); +return -1 ; + } + + r =system (cmd); +free (cmd); + +if (r) +return r; + + r =asprintf (&cmd,"ip -n %s link set lo up" , name); +if (r <0 ) { +log_err ("Failed to malloc cmd for setting up lo" ); +remove_netns (name); +return -1 ; + } + + r =system (cmd); +free (cmd); + +return r; +} +struct nstoken {int orig_netns_fd; };
tools/testing/selftests/bpf/network_helpers.h +2 -0
@@ -92,6 +92,8 @@ struct nstoken;struct nstoken *open_netns (const char *name);void close_netns (struct nstoken *token);int send_recv_data (int lfd,int fd,uint32_t total_bytes); +int make_netns (const char *name); +int remove_netns (const char *name);static __u16 csum_fold (__u32 csum) {
tools/testing/selftests/bpf/test_progs.c +88 -0
100 lines not on this page · raw message
tools/testing/selftests/bpf/test_progs.h +4 -0
@@ -428,6 +428,10 @@ int write_sysctl(const char *sysctl, const char *value);int get_bpf_max_tramp_links_from (struct btf *btf);int get_bpf_max_tramp_links (void ); +struct netns_obj ; +struct netns_obj *netns_new (const char *name,bool open); +void netns_free (struct netns_obj *netns); +#ifdef __x86_64__#define SYS_NANOSLEEP_KPROBE_NAME "__x64_sys_nanosleep"#elif defined(__s390x__)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 261/817 selftests/bpf: Fix backtrace printing for selftests crashes
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eduard Zingerman <[email protected]>
[ Upstream commit 5bf1557e3d6a69113649d831276ea2f97585fc33 ]
test_progs uses glibc specific functions backtrace() and backtrace_symbols_fd() to print backtrace in case of SIGSEGV.
Recent commit (see fixes) updated test_progs.c to define stub versions of the same functions with attriubte "weak" in order to allow linking test_progs against musl libc. Unfortunately this broke the backtrace handling for glibc builds.
As it turns out, glibc defines backtrace() and backtrace_symbols_fd() as weak:
$ llvm-readelf --symbols /lib64/libc.so.6 \
| grep -P '( backtrace_symbols_fd| backtrace)$'
4910: 0000000000126b40 161 FUNC WEAK DEFAULT 16 backtrace
6843: 0000000000126f90 852 FUNC WEAK DEFAULT 16 backtrace_symbols_fdSo does test_progs:
$ llvm-readelf --symbols test_progs \
| grep -P '( backtrace_symbols_fd| backtrace)$'
2891: 00000000006ad190 15 FUNC WEAK DEFAULT 13 backtrace
11215: 00000000006ad1a0 41 FUNC WEAK DEFAULT 13 backtrace_symbols_fdIn such situation dynamic linker is not obliged to favour glibc implementation over the one defined in test_progs.
Compiling with the following simple modification to test_progs.c demonstrates the issue:
$ git diff
...
\--- a/tools/testing/selftests/bpf/test_progs.c
\+++ b/tools/testing/selftests/bpf/test_progs.c
\@@ -1817,6 +1817,7 @@ int main(int argc, char **argv)
if (err)
return err; + *(int *)0xdeadbeef = 42;
err = cd_flavor_subdir(argv[0]);
if (err)
return err;$ ./test_progs [0]: Caught signal #11! Stack trace: <backtrace not supported> Segmentation fault (core dumped)
Resolve this by hiding stub definitions behind __GLIBC__ macro check instead of using "weak" attribute.
--- tools/testing/selftests/bpf/test_progs.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
tools/testing/selftests/bpf/test_progs.c +6 -3
@@ -20,11 +20,13 @@#include "network_helpers.h" +/* backtrace() and backtrace_symbols_fd() are glibc specific, +* use header file when glibc is available and provide stub +* implementations when another libc implementation is used. +*/ #ifdef __GLIBC__#include <execinfo.h> /* backtrace */ -#endif - -/* Default backtrace funcs if missing at link */ +#else __weak int backtrace (void **buffer,int size) {return 0 ;
@@ -34,6 +36,7 @@ __weak void backtrace_symbols_fd(void *const *buffer, int size, int fd) {dprintf (fd,"<backtrace not supported>\n" ); } +#endif /*__GLIBC__ */ static bool verbose (void ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 262/817 wifi: ath11k: Fix CE offset address calculation for WCN6750 in SSR
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Balaji Pothunoori <[email protected]>
[ Upstream commit 4c57ec6c4bb9979b42ae7fa7273fc2d4a361d576 ]
Currently, mem_ce and mem iomem addresses are used to calculate the CE offset address. mem_ce is initialized with mem address, and for targets where ce_remap is needed, mem_ce is remapped to a new address space during AHB probe.
For targets such as WCN6750 in which CE address space is same as WCSS address space (i.e. "ce_remap" hw_param is set to false), mem_ce and mem iomem addresses are same. In the initial SRNG setup for such targets, the CE offset address and hence CE register base addresses are calculated correctly in ath11k_hal_srng_init() as both mem and mem_ce are initialized with same iomem address.
Later, after the firmware download, mem is initialized with BAR address received in qmi_wlanfw_device_info_resp_msg_v01 QMI message, while mem_ce is not updated.
After initial setup success, during Subsystem Restart (SSR), as part of reinitialization, ath11k_hal_srng_init() will be called again, and CE offset address will be calculated incorrectly this time as mem_ce address was not updated. Due to the incorrect CE offset address, APPS accesses an invalid CE register address which leads to improper behavior in firmware after SSR is triggered.
To fix the above issue, update mem_ce to mem iomem address in ath11k_qmi_request_device_info() for targets which do not support ce_remap feature.
--- drivers/net/wireless/ath/ath11k/qmi.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/wireless/ath/ath11k/qmi.c +3 -0
@@ -2180,6 +2180,9 @@ static int ath11k_qmi_request_device_info(struct ath11k_base *ab) ab->mem = bar_addr_va; ab->mem_len = resp.bar_size; +if (!ab->hw_params.ce_remap) + ab->mem_ce = ab->mem; +return 0 ; out:return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 263/817 selftests/bpf: add missing header include for htons
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexis Lothoré (eBPF Foundation) <[email protected]>
[ Upstream commit bc9b3fb827fceec4e05564d6e668280f4470ab5b ]
Including the network_helpers.h header in tests can lead to the following build error:
./network_helpers.h: In function ‘csum_tcpudp_magic’:
./network_helpers.h:116:14: error: implicit declaration of function \
‘htons’ [-Werror=implicit-function-declaration]
116 | s += htons(proto + len);
The error is avoided in many cases thanks to some other headers included earlier and bringing in arpa/inet.h (ie: test_progs.h).
Make sure that test_progs build success does not depend on header ordering by adding the missing header include in network_helpers.h
--- tools/testing/selftests/bpf/network_helpers.h | 1 + 1 file changed, 1 insertion(+)
tools/testing/selftests/bpf/network_helpers.h +1 -0
@@ -1,6 +1,7 @@/* SPDX-License-Identifier: GPL-2.0 */ #ifndef __NETWORK_HELPERS_H#define __NETWORK_HELPERS_H +#include <arpa/inet.h> #include <sys/socket.h> #include <sys/types.h> #include <linux/types.h>
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 264/817 wifi: cfg80211: check radio iface combination for multi radio per wiphy
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karthikeyan Periyasamy <[email protected]>
[ Upstream commit bd9813d13be439851a7ff3e6372e53caa6e387a6 ]
Currently, wiphy_verify_combinations() fails for the multi-radio per wiphy due to the condition check on new global interface combination that DFS only works on one channel. In a multi-radio scenario, new global interface combination encompasses the capabilities of all radio combinations, so it supports more than one channel with DFS. For multi-radio per wiphy, interface combination verification needs to be performed for radio specific interface combinations. This is necessary as the new global interface combination combines the capabilities of all radio combinations.
--- net/wireless/core.c | 64 ++++++++++++++++++++++++++++++++++++++------- 1 file changed, 54 insertions(+), 10 deletions(-)
net/wireless/core.c +54 -10
@@ -603,16 +603,20 @@ struct wiphy *wiphy_new_nm(const struct cfg80211_ops *ops, int sizeof_priv, }EXPORT_SYMBOL (wiphy_new_nm); -static int wiphy_verify_combinations (struct wiphy *wiphy) +static +int wiphy_verify_iface_combinations (struct wiphy *wiphy, +const struct ieee80211_iface_combination *iface_comb, +int n_iface_comb, +bool combined_radio) {const struct ieee80211_iface_combination *c;int i, j; -for (i =0 ; i < wiphy->n_iface_combinations; i++) { +for (i =0 ; i < n_iface_comb; i++) {u32 cnt =0 ;u16 all_iftypes =0 ; - c = &wiphy->iface_combinations[i]; + c = &iface_comb[i];/* * Combinations with just one interface aren't real,
@@ -625,9 +629,13 @@ static int wiphy_verify_combinations(struct wiphy *wiphy)if (WARN_ON (!c->num_different_channels))return -EINVAL ; -/* DFS only works on one channel. */ -if (WARN_ON (c->radar_detect_widths && - (c->num_different_channels >1 ))) +/* DFS only works on one channel. Avoid this check +* for multi-radio global combination, since it hold +* the capabilities of all radio combinations. +*/ +if (!combined_radio && +WARN_ON (c->radar_detect_widths && + c->num_different_channels >1 ))return -EINVAL ;if (WARN_ON (!c->n_limits))
@@ -648,13 +656,21 @@ static int wiphy_verify_combinations(struct wiphy *wiphy)if (WARN_ON (wiphy->software_iftypes & types))return -EINVAL ; -/* Only a single P2P_DEVICE can be allowed */ -if (WARN_ON (types &BIT (NL80211_IFTYPE_P2P_DEVICE ) && +/* Only a single P2P_DEVICE can be allowed, avoid this +* check for multi-radio global combination, since it +* hold the capabilities of all radio combinations. +*/ +if (!combined_radio && +WARN_ON (types &BIT (NL80211_IFTYPE_P2P_DEVICE ) && c->limits[j].max >1 ))return -EINVAL ; -/* Only a single NAN can be allowed */ -if (WARN_ON (types &BIT (NL80211_IFTYPE_NAN ) && +/* Only a single NAN can be allowed, avoid this +* check for multi-radio global combination, since it +* hold the capabilities of all radio combinations. +*/ +if (!combined_radio && +WARN_ON (types &BIT (NL80211_IFTYPE_NAN ) && c->limits[j].max >1 ))return -EINVAL ;
@@ -693,6 +709,34 @@ static int wiphy_verify_combinations(struct wiphy *wiphy)return 0 ; } +static int wiphy_verify_combinations (struct wiphy *wiphy) +{ +int i, ret; +bool combined_radio = false; + +if (wiphy->n_radio) { +for (i =0 ; i < wiphy->n_radio; i++) { +const struct wiphy_radio *radio = &wiphy->radio[i]; + + ret =wiphy_verify_iface_combinations (wiphy, + radio->iface_combinations, + radio->n_iface_combinations, + false); +if (ret) +return ret; + } + + combined_radio = true; + } + + ret =wiphy_verify_iface_combinations (wiphy, + wiphy->iface_combinations, + wiphy->n_iface_combinations, + combined_radio); + +return ret; +} +int wiphy_register (struct wiphy *wiphy) {struct cfg80211_registered_device *rdev =wiphy_to_rdev (wiphy);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 265/817 ice: consistently use q_idx in ice_vc_cfg_qs_msg()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Keller <[email protected]>
[ Upstream commit a884c304e18a40e1c7a6525a9274e64c2c061c3f ]
The ice_vc_cfg_qs_msg() function is used to configure VF queues in response to a VIRTCHNL_OP_CONFIG_VSI_QUEUES command.
The virtchnl command contains an array of queue pair data for configuring Tx and Rx queues. This data includes a queue ID. When configuring the queues, the driver generally uses this queue ID to determine which Tx and Rx ring to program. However, a handful of places use the index into the queue pair data from the VF. While most VF implementations appear to send this data in order, it is not mandated by the virtchnl and it is not verified that the queue pair data comes in order.
Fix the driver to consistently use the q_idx field instead of the 'i' iterator value when accessing the rings. For the Rx case, introduce a local ring variable to keep lines short.
--- drivers/net/ethernet/intel/ice/ice_virtchnl.c | 21 +++++++++---------- 1 file changed, 10 insertions(+), 11 deletions(-)
drivers/net/ethernet/intel/ice/ice_virtchnl.c +10 -11
@@ -1711,8 +1711,8 @@ static int ice_vc_cfg_qs_msg(struct ice_vf *vf, u8 *msg)/* copy Tx queue info from VF into VSI */ if (qpi->txq.ring_len >0 ) { - vsi->tx_rings[i]->dma = qpi->txq.dma_ring_addr; - vsi->tx_rings[i]->count = qpi->txq.ring_len; + vsi->tx_rings[q_idx]->dma = qpi->txq.dma_ring_addr; + vsi->tx_rings[q_idx]->count = qpi->txq.ring_len;/* Disable any existing queue first */ if (ice_vf_vsi_dis_single_txq (vf, vsi, q_idx))
@@ -1721,7 +1721,7 @@ static int ice_vc_cfg_qs_msg(struct ice_vf *vf, u8 *msg)/* Configure a queue with the requested settings */ if (ice_vsi_cfg_single_txq (vsi, vsi->tx_rings, q_idx)) {dev_warn (ice_pf_to_dev (pf),"VF-%d failed to configure TX queue %d\n" , - vf->vf_id, i); + vf->vf_id, q_idx); goto error_param; } }
@@ -1729,24 +1729,23 @@ static int ice_vc_cfg_qs_msg(struct ice_vf *vf, u8 *msg)/* copy Rx queue info from VF into VSI */ if (qpi->rxq.ring_len >0 ) {u16 max_frame_size =ice_vc_get_max_frame_size (vf); +struct ice_rx_ring *ring = vsi->rx_rings[q_idx];u32 rxdid; - vsi->rx_rings[i]->dma = qpi->rxq.dma_ring_addr; - vsi->rx_rings[i]->count = qpi->rxq.ring_len; + ring->dma = qpi->rxq.dma_ring_addr; + ring->count = qpi->rxq.ring_len;if (qpi->rxq.crc_disable) - vsi->rx_rings[q_idx]->flags |= -ICE_RX_FLAGS_CRC_STRIP_DIS ; + ring->flags |=ICE_RX_FLAGS_CRC_STRIP_DIS ;else - vsi->rx_rings[q_idx]->flags &= - ~ICE_RX_FLAGS_CRC_STRIP_DIS ; + ring->flags &= ~ICE_RX_FLAGS_CRC_STRIP_DIS ;if (qpi->rxq.databuffer_size !=0 && (qpi->rxq.databuffer_size > ((16 *1024 ) -128 ) || qpi->rxq.databuffer_size <1024 )) goto error_param; vsi->rx_buf_len = qpi->rxq.databuffer_size; - vsi->rx_rings[i]->rx_buf_len = vsi->rx_buf_len; + ring->rx_buf_len = vsi->rx_buf_len;if (qpi->rxq.max_pkt_size > max_frame_size || qpi->rxq.max_pkt_size <64 ) goto error_param;
@@ -1761,7 +1760,7 @@ static int ice_vc_cfg_qs_msg(struct ice_vf *vf, u8 *msg)if (ice_vsi_cfg_single_rxq (vsi, q_idx)) {dev_warn (ice_pf_to_dev (pf),"VF-%d failed to configure RX queue %d\n" , - vf->vf_id, i); + vf->vf_id, q_idx); goto error_param; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 266/817 drm/vc4: hdmi: Increase audio MAI fifo dreq threshold
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dom Cobley <[email protected]>
[ Upstream commit 59f8b2b7fb8e460881d21c7d5b32604993973879 ]
Now we wait for write responses and have a burst size of 4, we can set the fifo threshold much higher.
Set it to 28 (of the 32 entry size) to keep fifo
fuller and reduce chance of underflow.
Stable-dep-of: cf1c87d978d4 ("drm/vc4: Match drm_dev_enter and exit calls in vc4_hvs_lut_load")
--- drivers/gpu/drm/vc4/vc4_hdmi.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-)
drivers/gpu/drm/vc4/vc4_hdmi.c +13 -5
@@ -2051,6 +2051,7 @@ static int vc4_hdmi_audio_prepare(struct device *dev, void *data,struct vc4_hdmi *vc4_hdmi =dev_get_drvdata (dev);struct drm_device *drm = vc4_hdmi->connector.dev;struct drm_connector *connector = &vc4_hdmi->connector; +struct vc4_dev *vc4 =to_vc4_dev (drm);unsigned int sample_rate = params->sample_rate;unsigned int channels = params->channels;unsigned long flags;
@@ -2108,11 +2109,18 @@ static int vc4_hdmi_audio_prepare(struct device *dev, void *data, VC4_HDMI_AUDIO_PACKET_CEA_MASK);/* Set the MAI threshold */ -HDMI_WRITE (HDMI_MAI_THR , -VC4_SET_FIELD (0x08 ,VC4_HD_MAI_THR_PANICHIGH ) | -VC4_SET_FIELD (0x08 ,VC4_HD_MAI_THR_PANICLOW ) | -VC4_SET_FIELD (0x06 ,VC4_HD_MAI_THR_DREQHIGH ) | -VC4_SET_FIELD (0x08 ,VC4_HD_MAI_THR_DREQLOW )); +if (vc4->is_vc5) +HDMI_WRITE (HDMI_MAI_THR , +VC4_SET_FIELD (0x10 ,VC4_HD_MAI_THR_PANICHIGH ) | +VC4_SET_FIELD (0x10 ,VC4_HD_MAI_THR_PANICLOW ) | +VC4_SET_FIELD (0x1c ,VC4_HD_MAI_THR_DREQHIGH ) | +VC4_SET_FIELD (0x1c ,VC4_HD_MAI_THR_DREQLOW )); +else +HDMI_WRITE (HDMI_MAI_THR , +VC4_SET_FIELD (0x8 ,VC4_HD_MAI_THR_PANICHIGH ) | +VC4_SET_FIELD (0x8 ,VC4_HD_MAI_THR_PANICLOW ) | +VC4_SET_FIELD (0x6 ,VC4_HD_MAI_THR_DREQHIGH ) | +VC4_SET_FIELD (0x8 ,VC4_HD_MAI_THR_DREQLOW )); HDMI_WRITE(HDMI_MAI_CONFIG, VC4_HDMI_MAI_CONFIG_BIT_REVERSE |
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 267/817 drm/vc4: Introduce generation number enum
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxime Ripard <[email protected]>
[ Upstream commit 24c5ed3ddf27313b248900455b0312bd7a9d3554 ]
With the introduction of the BCM2712 support, we will get yet another generation of display engine to support.
The binary check of whether it's VC5 or not thus doesn't work anymore, especially since some parts of the driver will have changed with BCM2711, and some others with BCM2712.
Let's introduce an enum to store the generation the driver is running on, which should provide more flexibility.
Stable-dep-of: cf1c87d978d4 ("drm/vc4: Match drm_dev_enter and exit calls in vc4_hvs_lut_load")
--- drivers/gpu/drm/vc4/tests/vc4_mock.c | 12 +++---- drivers/gpu/drm/vc4/vc4_bo.c | 28 +++++++-------- drivers/gpu/drm/vc4/vc4_crtc.c | 13 ++++--- drivers/gpu/drm/vc4/vc4_drv.c | 22 +++++++----- drivers/gpu/drm/vc4/vc4_drv.h | 7 +++- drivers/gpu/drm/vc4/vc4_gem.c | 24 ++++++------- drivers/gpu/drm/vc4/vc4_hdmi.c | 2 +- drivers/gpu/drm/vc4/vc4_hvs.c | 42 ++++++++++++---------- drivers/gpu/drm/vc4/vc4_irq.c | 10 +++--- drivers/gpu/drm/vc4/vc4_kms.c | 14 ++++---- drivers/gpu/drm/vc4/vc4_perfmon.c | 20 +++++------ drivers/gpu/drm/vc4/vc4_plane.c | 12 +++---- drivers/gpu/drm/vc4/vc4_render_cl.c | 2 +- drivers/gpu/drm/vc4/vc4_v3d.c | 10 +++--- drivers/gpu/drm/vc4/vc4_validate.c | 8 ++--- drivers/gpu/drm/vc4/vc4_validate_shaders.c | 2 +- 16 files changed, 121 insertions(+), 107 deletions(-)
drivers/gpu/drm/vc4/tests/vc4_mock.c +6 -6
@@ -155,11 +155,11 @@ KUNIT_DEFINE_ACTION_WRAPPER(kunit_action_drm_dev_unregister, drm_dev_unregister, struct drm_device *); -static struct vc4_dev *__mock_device (struct kunit *test,bool is_vc5) +static struct vc4_dev *__mock_device (struct kunit *test,enum vc4_gen gen) {struct drm_device *drm; -const struct drm_driver *drv = is_vc5 ? &vc5_drm_driver : &vc4_drm_driver; -const struct vc4_mock_desc *desc = is_vc5 ? &vc5_mock : &vc4_mock; +const struct drm_driver *drv = (gen ==VC4_GEN_5 ) ? &vc5_drm_driver : &vc4_drm_driver; +const struct vc4_mock_desc *desc = (gen ==VC4_GEN_5 ) ? &vc5_mock : &vc4_mock;struct vc4_dev *vc4;struct device *dev;int ret;
@@ -173,7 +173,7 @@ static struct vc4_dev *__mock_device(struct kunit *test, bool is_vc5)KUNIT_ASSERT_NOT_ERR_OR_NULL (test, vc4); vc4->dev = dev; - vc4->is_vc5 = is_vc5; + vc4->gen = gen; vc4->hvs =__vc4_hvs_alloc (vc4,NULL );KUNIT_ASSERT_NOT_ERR_OR_NULL (test, vc4->hvs);
@@ -198,10 +198,10 @@ static struct vc4_dev *__mock_device(struct kunit *test, bool is_vc5)struct vc4_dev *vc4_mock_device (struct kunit *test) { -return __mock_device (test, false); +return __mock_device (test,VC4_GEN_4 ); }struct vc4_dev *vc5_mock_device (struct kunit *test) { -return __mock_device (test, true); +return __mock_device (test,VC4_GEN_5 ); }
drivers/gpu/drm/vc4/vc4_bo.c +14 -14
@@ -251,7 +251,7 @@ void vc4_bo_add_to_purgeable_pool(struct vc4_bo *bo) {struct vc4_dev *vc4 =to_vc4_dev (bo->base.base.dev); -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return ;mutex_lock (&vc4->purgeable.lock);
@@ -265,7 +265,7 @@ static void vc4_bo_remove_from_purgeable_pool_locked(struct vc4_bo *bo) {struct vc4_dev *vc4 =to_vc4_dev (bo->base.base.dev); -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return ;/* list_del_init() is used here because the caller might release
@@ -396,7 +396,7 @@ struct drm_gem_object *vc4_create_object(struct drm_device *dev, size_t size)struct vc4_dev *vc4 =to_vc4_dev (dev);struct vc4_bo *bo; -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return ERR_PTR (-ENODEV ); bo =kzalloc (sizeof (*bo),GFP_KERNEL );
@@ -427,7 +427,7 @@ struct vc4_bo *vc4_bo_create(struct drm_device *dev, size_t unaligned_size,struct drm_gem_dma_object *dma_obj;struct vc4_bo *bo; -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return ERR_PTR (-ENODEV );if (size ==0 )
@@ -496,7 +496,7 @@ int vc4_bo_dumb_create(struct drm_file *file_priv,struct vc4_bo *bo =NULL ;int ret; -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return -ENODEV ; ret =vc4_dumb_fixup_args (args);
@@ -622,7 +622,7 @@ int vc4_bo_inc_usecnt(struct vc4_bo *bo)struct vc4_dev *vc4 =to_vc4_dev (bo->base.base.dev);int ret; -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return -ENODEV ;/* Fast path: if the BO is already retained by someone, no need to
@@ -661,7 +661,7 @@ void vc4_bo_dec_usecnt(struct vc4_bo *bo) {struct vc4_dev *vc4 =to_vc4_dev (bo->base.base.dev); -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return ;/* Fast path: if the BO is still retained by someone, no need to test
@@ -783,7 +783,7 @@ int vc4_create_bo_ioctl(struct drm_device *dev, void *data,struct vc4_bo *bo =NULL ;int ret; -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return -ENODEV ; ret =vc4_grab_bin_bo (vc4, vc4file);
@@ -813,7 +813,7 @@ int vc4_mmap_bo_ioctl(struct drm_device *dev, void *data,struct drm_vc4_mmap_bo *args = data;struct drm_gem_object *gem_obj; -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return -ENODEV ; gem_obj =drm_gem_object_lookup (file_priv, args->handle);
@@ -839,7 +839,7 @@ vc4_create_shader_bo_ioctl(struct drm_device *dev, void *data,struct vc4_bo *bo =NULL ;int ret; -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return -ENODEV ;if (args->size ==0 )
@@ -918,7 +918,7 @@ int vc4_set_tiling_ioctl(struct drm_device *dev, void *data,struct vc4_bo *bo;bool t_format; -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return -ENODEV ;if (args->flags !=0 )
@@ -964,7 +964,7 @@ int vc4_get_tiling_ioctl(struct drm_device *dev, void *data,struct drm_gem_object *gem_obj;struct vc4_bo *bo; -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return -ENODEV ;if (args->flags !=0 || args->modifier !=0 )
@@ -1007,7 +1007,7 @@ int vc4_bo_cache_init(struct drm_device *dev)int ret;int i; -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return -ENODEV ;/* Create the initial set of BO labels that the kernel will
@@ -1071,7 +1071,7 @@ int vc4_label_bo_ioctl(struct drm_device *dev, void *data,struct drm_gem_object *gem_obj;int ret =0 , label; -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return -ENODEV ;if (!args->len)
drivers/gpu/drm/vc4/vc4_crtc.c +6 -7
@@ -263,7 +263,7 @@ static u32 vc4_get_fifo_full_level(struct vc4_crtc *vc4_crtc, u32 format)* Removing 1 from the FIFO full level however * seems to completely remove that issue. */ -if (!vc4->is_vc5) +if (vc4->gen ==VC4_GEN_4 )return fifo_len_bytes -3 *HVS_FIFO_LATENCY_PIX -1 ;return fifo_len_bytes -3 *HVS_FIFO_LATENCY_PIX ;
@@ -428,7 +428,7 @@ static void vc4_crtc_config_pv(struct drm_crtc *crtc, struct drm_encoder *encodeif (is_dsi)CRTC_WRITE (PV_HACT_ACT , mode->hdisplay * pixel_rep); -if (vc4->is_vc5) +if (vc4->gen ==VC4_GEN_5 )CRTC_WRITE (PV_MUX_CFG ,VC4_SET_FIELD (PV_MUX_CFG_RGB_PIXEL_MUX_MODE_NO_SWAP ,PV_MUX_CFG_RGB_PIXEL_MUX_MODE ));
@@ -913,7 +913,7 @@ static int vc4_async_set_fence_cb(struct drm_device *dev,struct dma_fence *fence;int ret; -if (!vc4->is_vc5) { +if (vc4->gen ==VC4_GEN_4 ) {struct vc4_bo *bo =to_vc4_bo (&dma_bo->base); return vc4_queue_seqno_cb(dev, &flip_state->cb.seqno, bo->seqno,
@@ -1000,7 +1000,7 @@ static int vc4_async_page_flip(struct drm_crtc *crtc,struct vc4_bo *bo =to_vc4_bo (&dma_bo->base);int ret; -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return -ENODEV ;/*
@@ -1043,7 +1043,7 @@ int vc4_page_flip(struct drm_crtc *crtc,struct drm_device *dev = crtc->dev;struct vc4_dev *vc4 =to_vc4_dev (dev); -if (vc4->is_vc5) +if (vc4->gen ==VC4_GEN_5 )return vc5_async_page_flip (crtc, fb, event, flags);else return vc4_async_page_flip (crtc, fb, event, flags);
@@ -1338,9 +1338,8 @@ int __vc4_crtc_init(struct drm_device *drm,drm_crtc_helper_add (crtc, crtc_helper_funcs); -if (!vc4->is_vc5) { +if (vc4->gen ==VC4_GEN_4 ) {drm_mode_crtc_set_gamma_size (crtc,ARRAY_SIZE (vc4_crtc->lut_r)); -drm_crtc_enable_color_mgmt (crtc,0 , false, crtc->gamma_size);/* We support CTM, but only for one CRTC at a time. It's therefore
drivers/gpu/drm/vc4/vc4_drv.c +13 -9
@@ -98,7 +98,7 @@ static int vc4_get_param_ioctl(struct drm_device *dev, void *data,if (args->pad !=0 )return -EINVAL ; -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return -ENODEV ;if (!vc4->v3d)
@@ -147,7 +147,7 @@ static int vc4_open(struct drm_device *dev, struct drm_file *file)struct vc4_dev *vc4 =to_vc4_dev (dev);struct vc4_file *vc4file; -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return -ENODEV ; vc4file =kzalloc (sizeof (*vc4file),GFP_KERNEL );
@@ -165,7 +165,7 @@ static void vc4_close(struct drm_device *dev, struct drm_file *file)struct vc4_dev *vc4 =to_vc4_dev (dev);struct vc4_file *vc4file = file->driver_priv; -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return ;if (vc4file->bin_bo_used)
@@ -291,13 +291,17 @@ static int vc4_drm_bind(struct device *dev)struct vc4_dev *vc4;struct device_node *node;struct drm_crtc *crtc; -bool is_vc5; +enum vc4_gen gen;int ret =0 ; dev->coherent_dma_mask =DMA_BIT_MASK (32 ); - is_vc5 =of_device_is_compatible (dev->of_node,"brcm,bcm2711-vc5" ); -if (is_vc5) +if (of_device_is_compatible (dev->of_node,"brcm,bcm2711-vc5" )) + gen =VC4_GEN_5 ; +else + gen =VC4_GEN_4 ; + +if (gen ==VC4_GEN_5 ) driver = &vc5_drm_driver;else driver = &vc4_drm_driver;
@@ -315,13 +319,13 @@ static int vc4_drm_bind(struct device *dev) vc4 = devm_drm_dev_alloc(dev, driver, struct vc4_dev, base);if (IS_ERR (vc4))return PTR_ERR (vc4); - vc4->is_vc5 = is_vc5; + vc4->gen = gen; vc4->dev = dev; drm = &vc4->base;platform_set_drvdata (pdev, drm); -if (!is_vc5) { +if (gen ==VC4_GEN_4 ) { ret =drmm_mutex_init (drm, &vc4->bin_bo_lock);if (ret) goto err;
@@ -335,7 +339,7 @@ static int vc4_drm_bind(struct device *dev)if (ret) goto err; -if (!is_vc5) { +if (gen ==VC4_GEN_4 ) { ret =vc4_gem_init (drm);if (ret) goto err;
drivers/gpu/drm/vc4/vc4_drv.h +6 -1
@@ -80,11 +80,16 @@ struct vc4_perfmon { u64 counters[] __counted_by(ncounters); }; +enum vc4_gen { +VC4_GEN_4 , +VC4_GEN_5 , +}; +struct vc4_dev {struct drm_device base;struct device *dev; -bool is_vc5; +enum vc4_gen gen;unsigned int irq;
drivers/gpu/drm/vc4/vc4_gem.c +12 -12
@@ -76,7 +76,7 @@ vc4_get_hang_state_ioctl(struct drm_device *dev, void *data,u32 i;int ret =0 ; -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return -ENODEV ;if (!vc4->v3d) {
@@ -389,7 +389,7 @@ vc4_wait_for_seqno(struct drm_device *dev, uint64_t seqno, uint64_t timeout_ns,unsigned long timeout_expire;DEFINE_WAIT (wait); -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return -ENODEV ;if (vc4->finished_seqno >= seqno)
@@ -474,7 +474,7 @@ vc4_submit_next_bin_job(struct drm_device *dev)struct vc4_dev *vc4 =to_vc4_dev (dev);struct vc4_exec_info *exec; -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return ; again:
@@ -522,7 +522,7 @@ vc4_submit_next_render_job(struct drm_device *dev)if (!exec)return ; -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return ;/* A previous RCL may have written to one of our textures, and
@@ -543,7 +543,7 @@ vc4_move_job_to_render(struct drm_device *dev, struct vc4_exec_info *exec)struct vc4_dev *vc4 =to_vc4_dev (dev);bool was_empty =list_empty (&vc4->render_job_list); -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return ;list_move_tail (&exec->head, &vc4->render_job_list);
@@ -970,7 +970,7 @@ vc4_job_handle_completed(struct vc4_dev *vc4)unsigned long irqflags;struct vc4_seqno_cb *cb, *cb_temp; -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return ;spin_lock_irqsave (&vc4->job_lock, irqflags);
@@ -1009,7 +1009,7 @@ int vc4_queue_seqno_cb(struct drm_device *dev,struct vc4_dev *vc4 =to_vc4_dev (dev);unsigned long irqflags; -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return -ENODEV ; cb->func = func;
@@ -1065,7 +1065,7 @@ vc4_wait_seqno_ioctl(struct drm_device *dev, void *data,struct vc4_dev *vc4 =to_vc4_dev (dev);struct drm_vc4_wait_seqno *args = data; -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return -ENODEV ; return vc4_wait_for_seqno_ioctl_helper(dev, args->seqno,
@@ -1082,7 +1082,7 @@ vc4_wait_bo_ioctl(struct drm_device *dev, void *data,struct drm_gem_object *gem_obj;struct vc4_bo *bo; -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return -ENODEV ;if (args->pad !=0 )
@@ -1131,7 +1131,7 @@ vc4_submit_cl_ioctl(struct drm_device *dev, void *data, args->shader_rec_size, args->bo_handle_count); -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return -ENODEV ;if (!vc4->v3d) {
@@ -1268,7 +1268,7 @@ int vc4_gem_init(struct drm_device *dev)struct vc4_dev *vc4 =to_vc4_dev (dev);int ret; -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return -ENODEV ; vc4->dma_fence_context =dma_fence_context_alloc (1 );
@@ -1327,7 +1327,7 @@ int vc4_gem_madvise_ioctl(struct drm_device *dev, void *data,struct vc4_bo *bo;int ret; -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return -ENODEV ;switch (args->madv) {
drivers/gpu/drm/vc4/vc4_hdmi.c +1 -1
@@ -2109,7 +2109,7 @@ static int vc4_hdmi_audio_prepare(struct device *dev, void *data, VC4_HDMI_AUDIO_PACKET_CEA_MASK);/* Set the MAI threshold */ -if (vc4->is_vc5) +if (vc4->gen >=VC4_GEN_5 ) HDMI_WRITE(HDMI_MAI_THR, VC4_SET_FIELD(0x10, VC4_HD_MAI_THR_PANICHIGH) | VC4_SET_FIELD(0x10, VC4_HD_MAI_THR_PANICLOW) |
drivers/gpu/drm/vc4/vc4_hvs.c +24 -18
132 lines not on this page · raw message
drivers/gpu/drm/vc4/vc4_irq.c +5 -5
@@ -263,7 +263,7 @@ vc4_irq_enable(struct drm_device *dev) {struct vc4_dev *vc4 =to_vc4_dev (dev); -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return ;if (!vc4->v3d)
@@ -280,7 +280,7 @@ vc4_irq_disable(struct drm_device *dev) {struct vc4_dev *vc4 =to_vc4_dev (dev); -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return ;if (!vc4->v3d)
@@ -303,7 +303,7 @@ int vc4_irq_install(struct drm_device *dev, int irq)struct vc4_dev *vc4 =to_vc4_dev (dev);int ret; -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return -ENODEV ;if (irq ==IRQ_NOTCONNECTED )
@@ -324,7 +324,7 @@ void vc4_irq_uninstall(struct drm_device *dev) {struct vc4_dev *vc4 =to_vc4_dev (dev); -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return ;vc4_irq_disable (dev);
@@ -337,7 +337,7 @@ void vc4_irq_reset(struct drm_device *dev)struct vc4_dev *vc4 =to_vc4_dev (dev);unsigned long irqflags; -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return ;/* Acknowledge any stale IRQs. */
drivers/gpu/drm/vc4/vc4_kms.c +7 -7
@@ -369,7 +369,7 @@ static void vc4_atomic_commit_tail(struct drm_atomic_state *state) old_hvs_state->fifo_state[channel].pending_commit =NULL ; } -if (vc4->is_vc5) { +if (vc4->gen ==VC4_GEN_5 ) {unsigned long state_rate =max (old_hvs_state->core_clock_rate, new_hvs_state->core_clock_rate); unsigned long core_rate = clamp_t(unsigned long, state_rate,
@@ -388,7 +388,7 @@ static void vc4_atomic_commit_tail(struct drm_atomic_state *state)vc4_ctm_commit (vc4, state); -if (vc4->is_vc5) +if (vc4->gen ==VC4_GEN_5 )vc5_hvs_pv_muxing_commit (vc4, state);else vc4_hvs_pv_muxing_commit (vc4, state);
@@ -406,7 +406,7 @@ static void vc4_atomic_commit_tail(struct drm_atomic_state *state)drm_atomic_helper_cleanup_planes (dev, state); -if (vc4->is_vc5) { +if (vc4->gen ==VC4_GEN_5 ) { unsigned long core_rate = min_t(unsigned long, hvs->max_core_rate, new_hvs_state->core_clock_rate);
@@ -461,7 +461,7 @@ static struct drm_framebuffer *vc4_fb_create(struct drm_device *dev,struct vc4_dev *vc4 =to_vc4_dev (dev);struct drm_mode_fb_cmd2 mode_cmd_local; -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return ERR_PTR (-ENODEV );/* If the user didn't specify a modifier, use the
@@ -1040,7 +1040,7 @@ int vc4_kms_load(struct drm_device *dev)* the BCM2711, but the load tracker computations are used for * the core clock rate calculation. */ -if (!vc4->is_vc5) { +if (vc4->gen ==VC4_GEN_4 ) {/* Start with the load tracker enabled. Can be * disabled through the debugfs load_tracker file. */
@@ -1056,7 +1056,7 @@ int vc4_kms_load(struct drm_device *dev)return ret; } -if (vc4->is_vc5) { +if (vc4->gen ==VC4_GEN_5 ) { dev->mode_config.max_width =7680 ; dev->mode_config.max_height =7680 ; }else {
@@ -1064,7 +1064,7 @@ int vc4_kms_load(struct drm_device *dev) dev->mode_config.max_height =2048 ; } - dev->mode_config.funcs = vc4->is_vc5 ? &vc5_mode_funcs : &vc4_mode_funcs; + dev->mode_config.funcs = (vc4->gen >VC4_GEN_4 ) ? &vc5_mode_funcs : &vc4_mode_funcs; dev->mode_config.helper_private = &vc4_mode_config_helpers; dev->mode_config.preferred_depth =24 ; dev->mode_config.async_page_flip = true;
drivers/gpu/drm/vc4/vc4_perfmon.c +10 -10
@@ -23,7 +23,7 @@ void vc4_perfmon_get(struct vc4_perfmon *perfmon)return ; vc4 = perfmon->dev; -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return ;refcount_inc (&perfmon->refcnt);
@@ -37,7 +37,7 @@ void vc4_perfmon_put(struct vc4_perfmon *perfmon)return ; vc4 = perfmon->dev; -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return ;if (refcount_dec_and_test (&perfmon->refcnt))
@@ -49,7 +49,7 @@ void vc4_perfmon_start(struct vc4_dev *vc4, struct vc4_perfmon *perfmon)unsigned int i;u32 mask; -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return ;if (WARN_ON_ONCE (!perfmon || vc4->active_perfmon))
@@ -69,7 +69,7 @@ void vc4_perfmon_stop(struct vc4_dev *vc4, struct vc4_perfmon *perfmon, {unsigned int i; -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return ; if (WARN_ON_ONCE(!vc4->active_perfmon ||
@@ -90,7 +90,7 @@ struct vc4_perfmon *vc4_perfmon_find(struct vc4_file *vc4file, int id)struct vc4_dev *vc4 = vc4file->dev;struct vc4_perfmon *perfmon; -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return NULL ;mutex_lock (&vc4file->perfmon.lock);
@@ -105,7 +105,7 @@ void vc4_perfmon_open_file(struct vc4_file *vc4file) {struct vc4_dev *vc4 = vc4file->dev; -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return ;mutex_init (&vc4file->perfmon.lock);
@@ -131,7 +131,7 @@ void vc4_perfmon_close_file(struct vc4_file *vc4file) {struct vc4_dev *vc4 = vc4file->dev; -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return ;mutex_lock (&vc4file->perfmon.lock);
@@ -151,7 +151,7 @@ int vc4_perfmon_create_ioctl(struct drm_device *dev, void *data,unsigned int i;int ret; -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return -ENODEV ;if (!vc4->v3d) {
@@ -205,7 +205,7 @@ int vc4_perfmon_destroy_ioctl(struct drm_device *dev, void *data,struct drm_vc4_perfmon_destroy *req = data;struct vc4_perfmon *perfmon; -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return -ENODEV ;if (!vc4->v3d) {
@@ -233,7 +233,7 @@ int vc4_perfmon_get_values_ioctl(struct drm_device *dev, void *data,struct vc4_perfmon *perfmon;int ret; -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return -ENODEV ;if (!vc4->v3d) {
drivers/gpu/drm/vc4/vc4_plane.c +6 -6
@@ -587,10 +587,10 @@ static u32 vc4_lbm_size(struct drm_plane_state *state) }/* Align it to 64 or 128 (hvs5) bytes */ - lbm =roundup (lbm, vc4->is_vc5 ?128 :64 ); + lbm =roundup (lbm, vc4->gen ==VC4_GEN_5 ?128 :64 );/* Each "word" of the LBM memory contains 2 or 4 (hvs5) pixels */ - lbm /= vc4->is_vc5 ?4 :2 ; + lbm /= vc4->gen ==VC4_GEN_5 ?4 :2 ;return lbm; }
@@ -706,7 +706,7 @@ static int vc4_plane_allocate_lbm(struct drm_plane_state *state) ret =drm_mm_insert_node_generic (&vc4->hvs->lbm_mm, &vc4_state->lbm, lbm_size, - vc4->is_vc5 ?64 :32 , + vc4->gen ==VC4_GEN_5 ?64 :32 ,0 ,0 );spin_unlock_irqrestore (&vc4->hvs->mm_lock, irqflags);
@@ -1057,7 +1057,7 @@ static int vc4_plane_mode_set(struct drm_plane *plane, mix_plane_alpha = state->alpha !=DRM_BLEND_ALPHA_OPAQUE && fb->format->has_alpha; -if (!vc4->is_vc5) { +if (vc4->gen ==VC4_GEN_4 ) {/* Control word */ vc4_dlist_write(vc4_state, SCALER_CTL0_VALID |
@@ -1632,7 +1632,7 @@ struct drm_plane *vc4_plane_init(struct drm_device *dev, };for (i =0 ; i <ARRAY_SIZE (hvs_formats); i++) { -if (!hvs_formats[i].hvs5_only || vc4->is_vc5) { +if (!hvs_formats[i].hvs5_only || vc4->gen ==VC4_GEN_5 ) { formats[num_formats] = hvs_formats[i].drm; num_formats++; }
@@ -1647,7 +1647,7 @@ struct drm_plane *vc4_plane_init(struct drm_device *dev,return ERR_CAST (vc4_plane); plane = &vc4_plane->base; -if (vc4->is_vc5) +if (vc4->gen ==VC4_GEN_5 )drm_plane_helper_add (plane, &vc5_plane_helper_funcs);else drm_plane_helper_add (plane, &vc4_plane_helper_funcs);
drivers/gpu/drm/vc4/vc4_render_cl.c +1 -1
@@ -599,7 +599,7 @@ int vc4_get_rcl(struct drm_device *dev, struct vc4_exec_info *exec)bool has_bin = args->bin_cl_size !=0 ;int ret; -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return -ENODEV ; if (args->min_x_tile > args->max_x_tile ||
drivers/gpu/drm/vc4/vc4_v3d.c +5 -5
@@ -127,7 +127,7 @@ static int vc4_v3d_debugfs_ident(struct seq_file *m, void *unused)int vc4_v3d_pm_get (struct vc4_dev *vc4) { -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return -ENODEV ;mutex_lock (&vc4->power_lock);
@@ -148,7 +148,7 @@ vc4_v3d_pm_get(struct vc4_dev *vc4)void vc4_v3d_pm_put (struct vc4_dev *vc4) { -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return ;mutex_lock (&vc4->power_lock);
@@ -178,7 +178,7 @@ int vc4_v3d_get_bin_slot(struct vc4_dev *vc4)uint64_t seqno =0 ;struct vc4_exec_info *exec; -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return -ENODEV ; try_again:
@@ -325,7 +325,7 @@ int vc4_v3d_bin_bo_get(struct vc4_dev *vc4, bool *used) {int ret =0 ; -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return -ENODEV ;mutex_lock (&vc4->bin_bo_lock);
@@ -360,7 +360,7 @@ static void bin_bo_release(struct kref *ref)void vc4_v3d_bin_bo_put (struct vc4_dev *vc4) { -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return ;mutex_lock (&vc4->bin_bo_lock);
drivers/gpu/drm/vc4/vc4_validate.c +4 -4
@@ -109,7 +109,7 @@ vc4_use_bo(struct vc4_exec_info *exec, uint32_t hindex)struct drm_gem_dma_object *obj;struct vc4_bo *bo; -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return NULL ;if (hindex >= exec->bo_count) {
@@ -169,7 +169,7 @@ vc4_check_tex_size(struct vc4_exec_info *exec, struct drm_gem_dma_object *fbo,uint32_t utile_w =utile_width (cpp);uint32_t utile_h =utile_height (cpp); -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return false;/* The shaded vertex format stores signed 12.4 fixed point
@@ -495,7 +495,7 @@ vc4_validate_bin_cl(struct drm_device *dev,uint32_t dst_offset =0 ;uint32_t src_offset =0 ; -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return -ENODEV ;while (src_offset < len) {
@@ -942,7 +942,7 @@ vc4_validate_shader_recs(struct drm_device *dev,uint32_t i;int ret =0 ; -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return -ENODEV ;for (i =0 ; i < exec->shader_state_count; i++) {
drivers/gpu/drm/vc4/vc4_validate_shaders.c +1 -1
@@ -786,7 +786,7 @@ vc4_validate_shader(struct drm_gem_dma_object *shader_obj)struct vc4_validated_shader_info *validated_shader =NULL ;struct vc4_shader_validation_state validation_state; -if (WARN_ON_ONCE (vc4->is_vc5)) +if (WARN_ON_ONCE (vc4->gen ==VC4_GEN_5 ))return NULL ;memset (&validation_state,0 ,sizeof (validation_state));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 268/817 drm/vc4: Match drm_dev_enter and exit calls in vc4_hvs_lut_load
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Stevenson <[email protected]>
[ Upstream commit cf1c87d978d47339a39bfa7a6133ecd3f8f87525 ]
Commit 52efe364d196 ("drm/vc4: hvs: Don't write gamma luts on 2711") added a return path to vc4_hvs_lut_load that had called drm_dev_enter, but not drm_dev_exit.
Ensure we call drm_dev_exit.
--- drivers/gpu/drm/vc4/vc4_hvs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/vc4/vc4_hvs.c +2 -1
@@ -225,7 +225,7 @@ static void vc4_hvs_lut_load(struct vc4_hvs *hvs,return ;if (hvs->vc4->gen ==VC4_GEN_4 ) -return ; + goto exit;/* The LUT memory is laid out with each HVS channel in order, * each of which takes 256 writes for R, 256 for G, then 256
@@ -242,6 +242,7 @@ static void vc4_hvs_lut_load(struct vc4_hvs *hvs,for (i =0 ; i < crtc->gamma_size; i++)HVS_WRITE (SCALER_GAMDATA , vc4_crtc->lut_b[i]); +exit:drm_dev_exit (idx); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 269/817 drm/vc4: Match drm_dev_enter and exit calls in vc4_hvs_atomic_flush
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Stevenson <[email protected]>
[ Upstream commit 6b0bd1b02ea24b10522c92b2503981970b26d1a2 ]
Commit 92c17d16476c ("drm/vc4: hvs: Ignore atomic_flush if we're disabled") added a path which returned early without having called drm_dev_exit.
Ensure all paths call drm_dev_exit.
--- drivers/gpu/drm/vc4/vc4_hvs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/vc4/vc4_hvs.c +2 -1
@@ -584,7 +584,7 @@ void vc4_hvs_atomic_flush(struct drm_crtc *crtc, }if (vc4_state->assigned_channel ==VC4_HVS_CHANNEL_DISABLED ) -return ; + goto exit;if (debug_dump_regs) {DRM_INFO ("CRTC %d HVS before:\n" ,drm_crtc_index (crtc));
@@ -667,6 +667,7 @@ void vc4_hvs_atomic_flush(struct drm_crtc *crtc,vc4_hvs_dump_state (hvs); } +exit:drm_dev_exit (idx); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 270/817 drm/vc4: Correct generation check in vc4_hvs_lut_load
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Stevenson <[email protected]>
[ Upstream commit 42aa18d1c3e7762bcebd89a5857ed7774e669d92 ]
Commit 24c5ed3ddf27 ("drm/vc4: Introduce generation number enum") incorrectly swapped a check of hvs->vc4->is_vc5 to hvs->vc4->gen == VC4_GEN_4 in vc4_hvs_lut_load, hence breaking loading the gamma look up table on Pi0-3.
Correct that conditional.
--- drivers/gpu/drm/vc4/vc4_hvs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/vc4/vc4_hvs.c +1 -1
@@ -224,7 +224,7 @@ static void vc4_hvs_lut_load(struct vc4_hvs *hvs,if (!drm_dev_enter (drm, &idx))return ; -if (hvs->vc4->gen ==VC4_GEN_4 ) +if (hvs->vc4->gen !=VC4_GEN_4 ) goto exit;/* The LUT memory is laid out with each HVS channel in order,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 271/817 libbpf: fix sym_is_subprog() logic for weak global subprogs
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrii Nakryiko <[email protected]>
[ Upstream commit 4073213488be542f563eb4b2457ab4cbcfc2b738 ]
sym_is_subprog() is incorrectly rejecting relocations against *weak* global subprogs. Fix that by realizing that STB_WEAK is also a global function.
While it seems like verifier doesn't support taking an address of non-static subprog right now, it's still best to fix support for it on libbpf side, otherwise users will get a very confusing error during BPF skeleton generation or static linking due to misinterpreted relocation:
libbpf: prog 'handle_tp': bad map relo against 'foo' in section '.text'
Error: failed to open BPF object file: Relocation failed
It's clearly not a map relocation, but is treated and reported as such without this fix.
--- tools/lib/bpf/libbpf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/lib/bpf/libbpf.c +1 -1
@@ -3985,7 +3985,7 @@ static bool sym_is_subprog(const Elf64_Sym *sym, int text_shndx)return true;/* global function */ -return bind ==STB_GLOBAL && type ==STT_FUNC ; +return (bind ==STB_GLOBAL || bind ==STB_WEAK ) && type ==STT_FUNC ; }static int find_extern_btf_id (const struct btf *btf,const char *ext_name)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 272/817 accel/ivpu: Prevent recovery invocation during probe and resume
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karol Wachowski <[email protected]>
[ Upstream commit 5eaa497411197c41b0813d61ba3fbd6267049082 ]
Refactor IPC send and receive functions to allow correct handling of operations that should not trigger a recovery process.
Expose ivpu_send_receive_internal(), which is now utilized by the D0i3 entry, DCT initialization, and HWS initialization functions. These functions have been modified to return error codes gracefully, rather than initiating recovery.
The updated functions are invoked within ivpu_probe() and ivpu_resume(), ensuring that any errors encountered during these stages result in a proper teardown or shutdown sequence. The previous approach of triggering recovery within these functions could lead to a race condition, potentially causing undefined behavior and kernel crashes due to null pointer dereferences.
--- drivers/accel/ivpu/ivpu_ipc.c | 35 +++++++++++-------------------- drivers/accel/ivpu/ivpu_ipc.h | 7 +++---- drivers/accel/ivpu/ivpu_jsm_msg.c | 19 +++++++---------- 3 files changed, 23 insertions(+), 38 deletions(-)
drivers/accel/ivpu/ivpu_ipc.c +12 -23
@@ -291,15 +291,16 @@ int ivpu_ipc_receive(struct ivpu_device *vdev, struct ivpu_ipc_consumer *cons,return ret; } -static int +int ivpu_ipc_send_receive_internal (struct ivpu_device *vdev,struct vpu_jsm_msg *req,enum vpu_ipc_msg_type expected_resp_type, -struct vpu_jsm_msg *resp,u32 channel, -unsigned long timeout_ms) +struct vpu_jsm_msg *resp,u32 channel,unsigned long timeout_ms) {struct ivpu_ipc_consumer cons;int ret; +drm_WARN_ON (&vdev->drm,pm_runtime_status_suspended (vdev->drm.dev)); +ivpu_ipc_consumer_add (vdev, &cons, channel,NULL ); ret =ivpu_ipc_send (vdev, &cons, req);
@@ -325,19 +326,21 @@ ivpu_ipc_send_receive_internal(struct ivpu_device *vdev, struct vpu_jsm_msg *reqreturn ret; } -int ivpu_ipc_send_receive_active (struct ivpu_device *vdev,struct vpu_jsm_msg *req, -enum vpu_ipc_msg_type expected_resp,struct vpu_jsm_msg *resp, -u32 channel,unsigned long timeout_ms) +int ivpu_ipc_send_receive (struct ivpu_device *vdev,struct vpu_jsm_msg *req, +enum vpu_ipc_msg_type expected_resp,struct vpu_jsm_msg *resp, +u32 channel,unsigned long timeout_ms) {struct vpu_jsm_msg hb_req = { .type =VPU_JSM_MSG_QUERY_ENGINE_HB };struct vpu_jsm_msg hb_resp;int ret, hb_ret; -drm_WARN_ON (&vdev->drm,pm_runtime_status_suspended (vdev->drm.dev)); + ret =ivpu_rpm_get (vdev); +if (ret <0 ) +return ret; ret =ivpu_ipc_send_receive_internal (vdev, req, expected_resp, resp, channel, timeout_ms);if (ret != -ETIMEDOUT ) -return ret; + goto rpm_put; hb_ret = ivpu_ipc_send_receive_internal(vdev, &hb_req, VPU_JSM_MSG_QUERY_ENGINE_HB_DONE, &hb_resp, VPU_IPC_CHAN_ASYNC_CMD,
@@ -345,21 +348,7 @@ int ivpu_ipc_send_receive_active(struct ivpu_device *vdev, struct vpu_jsm_msg *rif (hb_ret == -ETIMEDOUT )ivpu_pm_trigger_recovery (vdev,"IPC timeout" ); -return ret; -} - -int ivpu_ipc_send_receive (struct ivpu_device *vdev,struct vpu_jsm_msg *req, -enum vpu_ipc_msg_type expected_resp,struct vpu_jsm_msg *resp, -u32 channel,unsigned long timeout_ms) -{ -int ret; - - ret =ivpu_rpm_get (vdev); -if (ret <0 ) -return ret; - - ret =ivpu_ipc_send_receive_active (vdev, req, expected_resp, resp, channel, timeout_ms); - +rpm_put:ivpu_rpm_put (vdev);return ret; }
drivers/accel/ivpu/ivpu_ipc.h +3 -4
@@ -101,10 +101,9 @@ int ivpu_ipc_send(struct ivpu_device *vdev, struct ivpu_ipc_consumer *cons,int ivpu_ipc_receive (struct ivpu_device *vdev,struct ivpu_ipc_consumer *cons,struct ivpu_ipc_hdr *ipc_buf,struct vpu_jsm_msg *jsm_msg,unsigned long timeout_ms); - -int ivpu_ipc_send_receive_active (struct ivpu_device *vdev,struct vpu_jsm_msg *req, -enum vpu_ipc_msg_type expected_resp,struct vpu_jsm_msg *resp, -u32 channel,unsigned long timeout_ms); +int ivpu_ipc_send_receive_internal (struct ivpu_device *vdev,struct vpu_jsm_msg *req, +enum vpu_ipc_msg_type expected_resp_type, +struct vpu_jsm_msg *resp,u32 channel,unsigned long timeout_ms);int ivpu_ipc_send_receive (struct ivpu_device *vdev,struct vpu_jsm_msg *req,enum vpu_ipc_msg_type expected_resp,struct vpu_jsm_msg *resp,u32 channel,unsigned long timeout_ms);
drivers/accel/ivpu/ivpu_jsm_msg.c +8 -11
@@ -270,9 +270,8 @@ int ivpu_jsm_pwr_d0i3_enter(struct ivpu_device *vdev) req.payload.pwr_d0i3_enter.send_response =1 ; - ret =ivpu_ipc_send_receive_active (vdev, &req,VPU_JSM_MSG_PWR_D0I3_ENTER_DONE , - &resp,VPU_IPC_CHAN_GEN_CMD , - vdev->timeout.d0i3_entry_msg); + ret =ivpu_ipc_send_receive_internal (vdev, &req,VPU_JSM_MSG_PWR_D0I3_ENTER_DONE , &resp, +VPU_IPC_CHAN_GEN_CMD , vdev->timeout.d0i3_entry_msg);if (ret)return ret;
@@ -430,8 +429,8 @@ int ivpu_jsm_hws_setup_priority_bands(struct ivpu_device *vdev) req.payload.hws_priority_band_setup.normal_band_percentage =10 ; - ret =ivpu_ipc_send_receive_active (vdev, &req,VPU_JSM_MSG_SET_PRIORITY_BAND_SETUP_RSP , - &resp,VPU_IPC_CHAN_ASYNC_CMD , vdev->timeout.jsm); + ret =ivpu_ipc_send_receive_internal (vdev, &req,VPU_JSM_MSG_SET_PRIORITY_BAND_SETUP_RSP , + &resp,VPU_IPC_CHAN_ASYNC_CMD , vdev->timeout.jsm);if (ret)ivpu_warn_ratelimited (vdev,"Failed to set priority bands: %d\n" , ret);
@@ -544,9 +543,8 @@ int ivpu_jsm_dct_enable(struct ivpu_device *vdev, u32 active_us, u32 inactive_us req.payload.pwr_dct_control.dct_active_us = active_us; req.payload.pwr_dct_control.dct_inactive_us = inactive_us; -return ivpu_ipc_send_receive_active (vdev, &req,VPU_JSM_MSG_DCT_ENABLE_DONE , - &resp,VPU_IPC_CHAN_ASYNC_CMD , - vdev->timeout.jsm); +return ivpu_ipc_send_receive_internal (vdev, &req,VPU_JSM_MSG_DCT_ENABLE_DONE , &resp, +VPU_IPC_CHAN_ASYNC_CMD , vdev->timeout.jsm); }int ivpu_jsm_dct_disable (struct ivpu_device *vdev)
@@ -554,7 +552,6 @@ int ivpu_jsm_dct_disable(struct ivpu_device *vdev)struct vpu_jsm_msg req = { .type =VPU_JSM_MSG_DCT_DISABLE };struct vpu_jsm_msg resp; -return ivpu_ipc_send_receive_active (vdev, &req,VPU_JSM_MSG_DCT_DISABLE_DONE , - &resp,VPU_IPC_CHAN_ASYNC_CMD , - vdev->timeout.jsm); +return ivpu_ipc_send_receive_internal (vdev, &req,VPU_JSM_MSG_DCT_DISABLE_DONE , &resp, +VPU_IPC_CHAN_ASYNC_CMD , vdev->timeout.jsm); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 273/817 ASoC: rt722-sdca: Remove logically deadcode in rt722-sdca.c
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Everest K.C <[email protected]>
[ Upstream commit 22206e569fb54bf9c95db9a0138a7485ba9e13bc ]
As the same condition was checked in inner and outer if statements. The code never reaches the inner else statement.
Fix this by removing the logically dead inner else statement.
--- sound/soc/codecs/rt722-sdca.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
sound/soc/codecs/rt722-sdca.c +2 -6
@@ -607,12 +607,8 @@ static int rt722_sdca_dmic_set_gain_get(struct snd_kcontrol *kcontrol,if (!adc_vol_flag)/* boost gain */ ctl = regvalue / boost_step; -else {/* ADC gain */ -if (adc_vol_flag) - ctl = p->max - (((vol_max - regvalue) &0xffff ) / interval_offset); -else - ctl = p->max - (((0 - regvalue) &0xffff ) / interval_offset); - } +else /* ADC gain */ + ctl = p->max - (((vol_max - regvalue) &0xffff ) / interval_offset); ucontrol->value.integer.value[i] = ctl; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 274/817 libbpf: never interpret subprogs in .text as entry programs
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrii Nakryiko <[email protected]>
[ Upstream commit db089c9158c1d535a36dfc010e5db37fccea2561 ]
Libbpf pre-1.0 had a legacy logic of allowing singular non-annotated (i.e., not having explicit SEC() annotation) function to be treated as sole entry BPF program (unless there were other explicit entry programs).
This behavior was dropped during libbpf 1.0 transition period (unless LIBBPF_STRICT_SEC_NAME flag was unset in libbpf_mode). When 1.0 was released and all the legacy behavior was removed, the bug slipped through leaving this legacy behavior around.
Fix this for good, as it actually causes very confusing behavior if BPF object file only has subprograms, but no entry programs.
--- tools/lib/bpf/libbpf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/lib/bpf/libbpf.c +1 -1
@@ -4389,7 +4389,7 @@ static int bpf_object__collect_externs(struct bpf_object *obj)static bool prog_is_subprog (const struct bpf_object *obj,const struct bpf_program *prog) { -return prog->sec_idx == obj->efile.text_shndx && obj->nr_programs >1 ; +return prog->sec_idx == obj->efile.text_shndx; } struct bpf_program *
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 275/817 netdevsim: copy addresses for both in and out paths
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <[email protected]>
[ Upstream commit 2cf567f421dbfe7e53b7e5ddee9400da10efb75d ]
The current code only copies the address for the in path, leaving the out path address set to 0. This patch corrects the issue by copying the addresses for both the in and out paths. Before this patch:
# cat /sys/kernel/debug/netdevsim/netdevsim0/ports/0/ipsec SA count=2 tx=20 sa[0] tx ipaddr=0.0.0.0 sa[0] spi=0x00000100 proto=0x32 salt=0x0adecc3a crypt=1 sa[0] key=0x3167608a ca4f1397 43565909 941fa627 sa[1] rx ipaddr=192.168.0.1 sa[1] spi=0x00000101 proto=0x32 salt=0x0adecc3a crypt=1 sa[1] key=0x3167608a ca4f1397 43565909 941fa627
After this patch:
= cat /sys/kernel/debug/netdevsim/netdevsim0/ports/0/ipsec SA count=2 tx=20
sa[0] tx ipaddr=192.168.0.2
sa[0] spi=0x00000100 proto=0x32 salt=0x0adecc3a crypt=1
sa[0] key=0x3167608a ca4f1397 43565909 941fa627
sa[1] rx ipaddr=192.168.0.1
sa[1] spi=0x00000101 proto=0x32 salt=0x0adecc3a crypt=1
sa[1] key=0x3167608a ca4f1397 43565909 941fa627
--- drivers/net/netdevsim/ipsec.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)
drivers/net/netdevsim/ipsec.c +5 -6
@@ -176,14 +176,13 @@ static int nsim_ipsec_add_sa(struct xfrm_state *xs,return ret; } -if (xs->xso.dir ==XFRM_DEV_OFFLOAD_IN ) { +if (xs->xso.dir ==XFRM_DEV_OFFLOAD_IN ) sa.rx = true; -if (xs->props.family ==AF_INET6 ) -memcpy (sa.ipaddr, &xs->id.daddr.a6,16 ); -else -memcpy (&sa.ipaddr[3 ], &xs->id.daddr.a4,4 ); - } +if (xs->props.family ==AF_INET6 ) +memcpy (sa.ipaddr, &xs->id.daddr.a6,16 ); +else +memcpy (&sa.ipaddr[3 ], &xs->id.daddr.a4,4 );/* the preparations worked, so save the info */ memcpy (&ipsec->sa[sa_idx], &sa,sizeof (sa));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 276/817 drm/bridge: tc358767: Fix link properties discovery
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <[email protected]>
[ Upstream commit 2d343723c7e1f9f6d64f721f07cfdfc2993758d1 ]
When a display controller driver uses DRM_BRIDGE_ATTACH_NO_CONNECTOR, tc358767 will behave properly and skip the creation of the connector.
However, tc_get_display_props(), which is used to find out about the DP monitor and link, is only called from two places: .atomic_enable() and tc_connector_get_modes(). The latter is only used when tc358767 creates its own connector, i.e. when DRM_BRIDGE_ATTACH_NO_CONNECTOR is _not_ set.
Thus, the driver never finds out the link properties before get_edid() is called. With num_lanes of 0 and link_rate of 0 there are not many valid modes...
Fix this by adding tc_get_display_props() call at the beginning of get_edid(), so that we have up to date information before looking at the modes.
--- drivers/gpu/drm/bridge/tc358767.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/gpu/drm/bridge/tc358767.c +7 -0
@@ -1695,6 +1695,13 @@ static const struct drm_edid *tc_edid_read(struct drm_bridge *bridge, struct drm_connector *connector) {struct tc_data *tc =bridge_to_tc (bridge); +int ret; + + ret =tc_get_display_props (tc); +if (ret <0 ) { +dev_err (tc->dev,"failed to read display props: %d\n" , ret); +return 0 ; + }return drm_edid_read_ddc (connector, &tc->aux.ddc); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 277/817 selftests/bpf: Fix msg_verify_data in test_sockmap
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijian Zhang <[email protected]>
[ Upstream commit ee9b352ce4650ffc0d8ca0ac373d7c009c7e561e ]
Function msg_verify_data should have context of bytes_cnt and k instead of assuming they are zero. Otherwise, test_sockmap with data integrity test will report some errors. I also fix the logic related to size and index j
1/ 6 sockmap::txmsg test passthrough:FAIL 2/ 6 sockmap::txmsg test redirect:FAIL 7/12 sockmap::txmsg test apply:FAIL 10/11 sockmap::txmsg test push_data:FAIL 11/17 sockmap::txmsg test pull-data:FAIL 12/ 9 sockmap::txmsg test pop-data:FAIL 13/ 1 sockmap::txmsg test push/pop data:FAIL
...
Pass: 24 Fail: 52
After applying this patch, some of the errors are solved, but for push, pull and pop, we may need more fixes to msg_verify_data, added a TODO
10/11 sockmap::txmsg test push_data:FAIL 11/17 sockmap::txmsg test pull-data:FAIL 12/ 9 sockmap::txmsg test pop-data:FAIL
...
Pass: 37 Fail: 15
Besides, added a custom errno EDATAINTEGRITY for msg_verify_data, we shall not ignore the error in txmsg_cork case.
--- tools/testing/selftests/bpf/test_sockmap.c | 30 ++++++++++++++-------- 1 file changed, 20 insertions(+), 10 deletions(-)
tools/testing/selftests/bpf/test_sockmap.c +20 -10
@@ -56,6 +56,8 @@ static void running_handler(int a);#define BPF_SOCKHASH_FILENAME "test_sockhash_kern.bpf.o"#define CG_PATH "/sockmap" +#define EDATAINTEGRITY 2001 +/* global sockets */ int s1, s2, c1, c2, p1, p2;int test_cnt;
@@ -510,23 +512,25 @@ static int msg_alloc_iov(struct msghdr *msg,return -ENOMEM ; } -static int msg_verify_data (struct msghdr *msg,int size,int chunk_sz) +/* TODO: Add verification logic for push, pull and pop data */ +static int msg_verify_data (struct msghdr *msg,int size,int chunk_sz, +unsigned char *k_p,int *bytes_cnt_p) { -int i, j =0 , bytes_cnt =0 ; -unsigned char k =0 ; +int i, j, bytes_cnt = *bytes_cnt_p; +unsigned char k = *k_p; -for (i =0 ; i < msg->msg_iovlen; i++) { +for (i =0 , j =0 ; i < msg->msg_iovlen && size; i++, j =0 ) {unsigned char *d = msg->msg_iov[i].iov_base;/* Special case test for skb ingress + ktls */ if (i ==0 && txmsg_ktls_skb) {if (msg->msg_iov[i].iov_len <4 ) -return -EIO ; +return -EDATAINTEGRITY ;if (memcmp (d,"PASS" ,4 ) !=0 ) {fprintf (stderr,"detected skb data error with skb ingress update @iov[%i]:%i \"%02x %02x %02x %02x\" != \"PASS\"\n" , i,0 , d[0 ], d[1 ], d[2 ], d[3 ]); -return -EIO ; +return -EDATAINTEGRITY ; } j =4 ;/* advance index past PASS header */ }
@@ -536,7 +540,7 @@ static int msg_verify_data(struct msghdr *msg, int size, int chunk_sz)fprintf (stderr,"detected data corruption @iov[%i]:%i %02x != %02x, %02x ?= %02x\n" , i, j, d[j], k -1 , d[j+1 ], k); -return -EIO ; +return -EDATAINTEGRITY ; } bytes_cnt++;if (bytes_cnt == chunk_sz) {
@@ -546,6 +550,8 @@ static int msg_verify_data(struct msghdr *msg, int size, int chunk_sz) size--; } } + *k_p = k; + *bytes_cnt_p = bytes_cnt;return 0 ; }
@@ -602,6 +608,8 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt,float total_bytes, txmsg_pop_total;int fd_flags =O_NONBLOCK ;struct timeval timeout; +unsigned char k =0 ; +int bytes_cnt =0 ;fd_set w;fcntl (fd, fd_flags);
@@ -696,7 +704,7 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt, iov_length * cnt :iov_length * iov_count; - errno =msg_verify_data (&msg, recv, chunk_sz); + errno =msg_verify_data (&msg, recv, chunk_sz, &k, &bytes_cnt);if (errno) {perror ("data verify msg failed" ); goto out_errno;
@@ -704,7 +712,9 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt,if (recvp) { errno =msg_verify_data (&msg_peek, recvp, - chunk_sz); + chunk_sz, + &k, + &bytes_cnt);if (errno) {perror ("data verify msg_peek failed" ); goto out_errno;
@@ -812,7 +822,7 @@ static int sendmsg_test(struct sockmap_options *opt) s.bytes_sent, sent_Bps, sent_Bps/giga, s.bytes_recvd, recvd_Bps, recvd_Bps/giga, peek_flag ? "(peek_msg)" : ""); -if (err && txmsg_cork) +if (err && err != -EDATAINTEGRITY && txmsg_cork) err =0 ;exit (err ?1 :0 ); }else if (rxpid ==-1 ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 278/817 selftests/bpf: Fix txmsg_redir of test_txmsg_pull in test_sockmap
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijian Zhang <[email protected]>
[ Upstream commit b29e231d66303c12b7b8ac3ac2a057df06b161e8 ]
txmsg_redir in "Test pull + redirect" case of test_txmsg_pull should be 1 instead of 0.
--- tools/testing/selftests/bpf/test_sockmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/bpf/test_sockmap.c +1 -1
@@ -1606,7 +1606,7 @@ static void test_txmsg_pull(int cgrp, struct sockmap_options *opt)test_send_large (opt, cgrp);/* Test pull + redirect */ - txmsg_redir =0 ; + txmsg_redir =1 ; txmsg_start =1 ; txmsg_end =2 ;test_send (opt, cgrp);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 279/817 wifi: wilc1000: Set MAC after operation mode
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
[ Upstream commit 29dd3e48b9bd88bf65a1e760126fa18d1def7b30 ]
It seems it is necessary to set WILC MAC address after operation mode, otherwise the MAC address of the WILC MAC is reset back to what is in nvmem. This causes a failure to associate with AP after the WILC MAC address was overridden by userspace.
Test case:
"
ap$ cat << EOF > hostap.conf
interface=wlan0
ssid=ssid
hw_mode=g
channel=6
wpa=2
wpa_passphrase=pass
wpa_key_mgmt=WPA-PSK
EOF
ap$ hostapd -d hostap.conf
ap$ ifconfig wlan0 10.0.0.1
"
"
sta$ ifconfig wlan0 hw ether 00:11:22:33:44:55 sta$ wpa_supplicant -i wlan0 -c <(wpa_passphrase ssid pass) sta$ ifconfig wlan0 10.0.0.2
sta$ ping 10.0.0.1 # fails without this patch
"
AP still indicates SA with original MAC address from nvmem without this patch:
"
nl80211: RX frame da=ff:ff:ff:ff:ff:ff sa=60:01:23:45:67:89 bssid=ff:ff:ff:ff:ff:ff ...
^^^^^^^^^^^^^^^^^
"
--- drivers/net/wireless/microchip/wilc1000/netdev.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/wireless/microchip/wilc1000/netdev.c +3 -3
@@ -608,6 +608,9 @@ static int wilc_mac_open(struct net_device *ndev)return ret; } +wilc_set_operation_mode (vif,wilc_get_vif_idx (vif), vif->iftype, + vif->idx); +netdev_dbg (ndev,"Mac address: %pM\n" , ndev->dev_addr); ret =wilc_set_mac_address (vif, ndev->dev_addr);if (ret) {
@@ -618,9 +621,6 @@ static int wilc_mac_open(struct net_device *ndev)return ret; } -wilc_set_operation_mode (vif,wilc_get_vif_idx (vif), vif->iftype, - vif->idx); - mgmt_regs.interface_stypes = vif->mgmt_reg_stypes;/* so we detect a change */ vif->mgmt_reg_stypes =0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 280/817 wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alper Nebi Yasak <[email protected]>
[ Upstream commit d241a139c2e9f8a479f25c75ebd5391e6a448500 ]
Replace one-element array with a flexible-array member in struct mwifiex_ie_types_wildcard_ssid_params to fix the following warning on a MT8173 Chromebook (mt8173-elm-hana):
[ 356.775250] ------------[ cut here ]------------ [ 356.784543] memcpy: detected field-spanning write (size 6) of single field "wildcard_ssid_tlv->ssid" at drivers/net/wireless/marvell/mwifiex/scan.c:904 (size 1) [ 356.813403] WARNING: CPU: 3 PID: 742 at drivers/net/wireless/marvell/mwifiex/scan.c:904 mwifiex_scan_networks+0x4fc/0xf28 [mwifiex]
The "(size 6)" above is exactly the length of the SSID of the network this device was connected to. The source of the warning looks like:
ssid_len = user_scan_in->ssid_list[i].ssid_len;
[...]
memcpy(wildcard_ssid_tlv->ssid,
user_scan_in->ssid_list[i].ssid, ssid_len);There is a #define WILDCARD_SSID_TLV_MAX_SIZE that uses sizeof() on this struct, but it already didn't account for the size of the one-element array, so it doesn't need to be changed.
--- drivers/net/wireless/marvell/mwifiex/fw.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/marvell/mwifiex/fw.h +1 -1
@@ -842,7 +842,7 @@ struct mwifiex_ietypes_chanstats {struct mwifiex_ie_types_wildcard_ssid_params {struct mwifiex_ie_types_header header;u8 max_ssid_length; -u8 ssid[1 ]; +u8 ssid[]; } __packed;#define TSF_DATA_SIZE 8
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 281/817 drm: fsl-dcu: enable PIXCLK on LS1021A
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthias Schiffer <[email protected]>
[ Upstream commit ffcde9e44d3e18fde3d18bfff8d9318935413bfd ]
The PIXCLK needs to be enabled in SCFG before accessing certain DCU registers, or the access will hang. For simplicity, the PIXCLK is enabled unconditionally, resulting in increased power consumption.
--- drivers/gpu/drm/fsl-dcu/Kconfig | 1 + drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c | 15 +++++++++++++++ drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.h | 3 +++ 3 files changed, 19 insertions(+)
drivers/gpu/drm/fsl-dcu/Kconfig +1 -0
@@ -8,6 +8,7 @@ config DRM_FSL_DCU select DRM_PANEL select REGMAP_MMIO select VIDEOMODE_HELPERS + select MFD_SYSCON if SOC_LS1021A help Choose this option if you have an Freescale DCU chipset. If M is selected the module will be called fsl-dcu-drm.
drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c +15 -0
@@ -100,6 +100,7 @@ static void fsl_dcu_irq_uninstall(struct drm_device *dev)static int fsl_dcu_load (struct drm_device *dev,unsigned long flags) {struct fsl_dcu_drm_device *fsl_dev = dev->dev_private; +struct regmap *scfg;int ret; ret =fsl_dcu_drm_modeset_init (fsl_dev);
@@ -108,6 +109,20 @@ static int fsl_dcu_load(struct drm_device *dev, unsigned long flags)return ret; } + scfg =syscon_regmap_lookup_by_compatible ("fsl,ls1021a-scfg" ); +if (PTR_ERR (scfg) != -ENODEV ) { +/* +* For simplicity, enable the PIXCLK unconditionally, +* resulting in increased power consumption. Disabling +* the clock in PM or on unload could be implemented as +* a future improvement. +*/ + ret =regmap_update_bits (scfg,SCFG_PIXCLKCR ,SCFG_PIXCLKCR_PXCEN , +SCFG_PIXCLKCR_PXCEN ); +if (ret <0 ) +return dev_err_probe (dev->dev, ret,"failed to enable pixclk\n" ); + } + ret =drm_vblank_init (dev, dev->mode_config.num_crtc);if (ret <0 ) {dev_err (dev->dev,"failed to initialize vblank\n" );
drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.h +3 -0
@@ -160,6 +160,9 @@#define FSL_DCU_ARGB4444 12#define FSL_DCU_YUV422 14 +#define SCFG_PIXCLKCR 0x28 +#define SCFG_PIXCLKCR_PXCEN BIT(31) +#define VF610_LAYER_REG_NUM 9#define LS1021A_LAYER_REG_NUM 10
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 282/817 drm: panel: nv3052c: correct spi_device_id for RG35XX panel
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryan Walklin <[email protected]>
[ Upstream commit 45608a3eb4902f32010a8328c0a01ccda4b38c9b ]
The Anbernic RG35XX devices use an SPI LCD panel from an unknown OEM, with an NV3052C driver chip.
As discussed previously, the integrating vendor and device name are preferred instead of the OEM serial. A previous patch corrected the device tree binding and of_device_id in the NV3052C driver, however the spi_device_id also needs correction.
Correct the spi_device_id for the RG35XX panel.
--- drivers/gpu/drm/panel/panel-newvision-nv3052c.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/panel/panel-newvision-nv3052c.c +1 -1
@@ -917,7 +917,7 @@ static const struct nv3052c_panel_info wl_355608_a8_panel_info = {static const struct spi_device_id nv3052c_ids[] = { {"ltk035c5444t" , }, {"fs035vg158" , }, - {"wl-355608-a8" , }, + {"rg35xx-plus-panel" , }, {/* sentinel */ } };MODULE_DEVICE_TABLE (spi, nv3052c_ids);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 283/817 drm/msm/dpu: on SDM845 move DSPP_3 to LM_5 block
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 768a272d5357269b17b4b06dd8647e21bdc0ca3c ]
On the SDM845 platform the DSPP_3 is used by the LM_5. Correct corresponding entries in the sdm845_lm array.
Patchwork: https://patchwork.freedesktop.org/patch/612584/
--- drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_4_0_sdm845.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_4_0_sdm845.h +1 -1
@@ -161,7 +161,6 @@ static const struct dpu_lm_cfg sdm845_lm[] = { .features = MIXER_SDM845_MASK, .sblk = &sdm845_lm_sblk, .pingpong = PINGPONG_NONE, - .dspp = DSPP_3, }, { .name = "lm_4", .id = LM_4, .base = 0x0, .len = 0x320,
@@ -175,6 +174,7 @@ static const struct dpu_lm_cfg sdm845_lm[] = { .sblk = &sdm845_lm_sblk, .lm_pair = LM_2, .pingpong = PINGPONG_3, + .dspp = DSPP_3, }, };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 284/817 drm/msm/dpu: drop LM_3 / LM_4 on SDM845
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit d39271061d67c6fcbe8f361c532b493069232cf8 ]
On the SDM845 platform ther are no LM_3 and LM_4 blocks. Drop them from the SDM845 catalog.
Patchwork: https://patchwork.freedesktop.org/patch/612586/
--- .../gpu/drm/msm/disp/dpu1/catalog/dpu_4_0_sdm845.h | 12 ------------ 1 file changed, 12 deletions(-)
drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_4_0_sdm845.h +0 -12
@@ -155,18 +155,6 @@ static const struct dpu_lm_cfg sdm845_lm[] = { .lm_pair = LM_5, .pingpong = PINGPONG_2, .dspp = DSPP_2, - }, { - .name = "lm_3", .id = LM_3, - .base = 0x0, .len = 0x320, - .features = MIXER_SDM845_MASK, - .sblk = &sdm845_lm_sblk, - .pingpong = PINGPONG_NONE, - }, { - .name = "lm_4", .id = LM_4, - .base = 0x0, .len = 0x320, - .features = MIXER_SDM845_MASK, - .sblk = &sdm845_lm_sblk, - .pingpong = PINGPONG_NONE, }, { .name = "lm_5", .id = LM_5, .base = 0x49000, .len = 0x320,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 285/817 drm/msm/dpu: drop LM_3 / LM_4 on MSM8998
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit c59afe50773d5c972f6684f9bbd9a2ddb2fb92fa ]
On the MSM8998 platform ther are no LM_3 and LM_4 blocks. Drop them from the MSM8998 catalog.
Patchwork: https://patchwork.freedesktop.org/patch/612585/
--- .../gpu/drm/msm/disp/dpu1/catalog/dpu_3_0_msm8998.h | 12 ------------ 1 file changed, 12 deletions(-)
drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_3_0_msm8998.h +0 -12
@@ -156,18 +156,6 @@ static const struct dpu_lm_cfg msm8998_lm[] = { .sblk = &msm8998_lm_sblk, .lm_pair = LM_5, .pingpong = PINGPONG_2, - }, { - .name = "lm_3", .id = LM_3, - .base = 0x47000, .len = 0x320, - .features = MIXER_MSM8998_MASK, - .sblk = &msm8998_lm_sblk, - .pingpong = PINGPONG_NONE, - }, { - .name = "lm_4", .id = LM_4, - .base = 0x48000, .len = 0x320, - .features = MIXER_MSM8998_MASK, - .sblk = &msm8998_lm_sblk, - .pingpong = PINGPONG_NONE, }, { .name = "lm_5", .id = LM_5, .base = 0x49000, .len = 0x320,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 286/817 octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_common.c
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dipendra Khadka <[email protected]>
[ Upstream commit 0fbc7a5027c6f7f2c785adae3dcec22b2f2b69b3 ]
Add error pointer check after calling otx2_mbox_get_rsp().
--- drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c +4 -0
@@ -1837,6 +1837,10 @@ u16 otx2_get_max_mtu(struct otx2_nic *pfvf)if (!rc) { rsp = (struct nix_hw_info *)otx2_mbox_get_rsp (&pfvf->mbox.mbox,0 , &req->hdr); +if (IS_ERR (rsp)) { + rc =PTR_ERR (rsp); + goto out; + }/* HW counts VLAN insertion bytes (8 for double tag) * irrespective of whether SQE is requesting to insert VLAN
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 287/817 octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dipendra Khadka <[email protected]>
[ Upstream commit e26f8eac6bb20b20fdb8f7dc695711ebce4c7c5c ]
Add error pointer check after calling otx2_mbox_get_rsp().
--- .../net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c +10 -0
@@ -343,6 +343,11 @@ static void otx2_get_pauseparam(struct net_device *netdev,if (!otx2_sync_mbox_msg (&pfvf->mbox)) { rsp = (struct cgx_pause_frm_cfg *)otx2_mbox_get_rsp (&pfvf->mbox.mbox,0 , &req->hdr); +if (IS_ERR (rsp)) { +mutex_unlock (&pfvf->mbox.lock); +return ; + } + pause->rx_pause = rsp->rx_pause; pause->tx_pause = rsp->tx_pause; }
@@ -1074,6 +1079,11 @@ static int otx2_set_fecparam(struct net_device *netdev, rsp = (struct fec_mode *)otx2_mbox_get_rsp (&pfvf->mbox.mbox,0 , &req->hdr); +if (IS_ERR (rsp)) { + err =PTR_ERR (rsp); + goto end; + } +if (rsp->fec >=0 ) pfvf->linfo.fec = rsp->fec;else
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 288/817 octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_flows.c
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dipendra Khadka <[email protected]>
[ Upstream commit bd3110bc102ab6292656b8118be819faa0de8dd0 ]
Adding error pointer check after calling otx2_mbox_get_rsp().
--- .../net/ethernet/marvell/octeontx2/nic/otx2_flows.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c +10 -0
@@ -119,6 +119,8 @@ int otx2_alloc_mcam_entries(struct otx2_nic *pfvf, u16 count) rsp = (struct npc_mcam_alloc_entry_rsp *)otx2_mbox_get_rsp (&pfvf->mbox.mbox,0 , &req->hdr); +if (IS_ERR (rsp)) + goto exit;for (ent =0 ; ent < rsp->count; ent++) flow_cfg->flow_ent[ent + allocated] = rsp->entry_list[ent];
@@ -197,6 +199,10 @@ int otx2_mcam_entry_init(struct otx2_nic *pfvf) rsp = (struct npc_mcam_alloc_entry_rsp *)otx2_mbox_get_rsp (&pfvf->mbox.mbox,0 , &req->hdr); +if (IS_ERR (rsp)) { +mutex_unlock (&pfvf->mbox.lock); +return PTR_ERR (rsp); + }if (rsp->count != req->count) { netdev_info(pfvf->netdev,
@@ -232,6 +238,10 @@ int otx2_mcam_entry_init(struct otx2_nic *pfvf) frsp = (struct npc_get_field_status_rsp *)otx2_mbox_get_rsp (&pfvf->mbox.mbox,0 , &freq->hdr); +if (IS_ERR (frsp)) { +mutex_unlock (&pfvf->mbox.lock); +return PTR_ERR (frsp); + }if (frsp->enable) { pfvf->flags |=OTX2_FLAG_RX_VLAN_SUPPORT ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 289/817 octeontx2-pf: handle otx2_mbox_get_rsp errors in cn10k.c
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dipendra Khadka <[email protected]>
[ Upstream commit ac9183023b6a9c09467516abd8aab04f9a2f9564 ]
Add error pointer check after calling otx2_mbox_get_rsp().
--- drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c +5 -0
@@ -203,6 +203,11 @@ int cn10k_alloc_leaf_profile(struct otx2_nic *pfvf, u16 *leaf) rsp = (struct nix_bandprof_alloc_rsp *)otx2_mbox_get_rsp (&pfvf->mbox.mbox,0 , &req->hdr); +if (IS_ERR (rsp)) { + rc =PTR_ERR (rsp); + goto out; + } +if (!rsp->prof_count[BAND_PROF_LEAF_LAYER ]) { rc = -EIO ; goto out;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 290/817 octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dmac_flt.c
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dipendra Khadka <[email protected]>
[ Upstream commit f5b942e6c54b13246ee49d42dcfb71b7f29e3c64 ]
Add error pointer checks after calling otx2_mbox_get_rsp().
--- .../net/ethernet/marvell/octeontx2/nic/otx2_dmac_flt.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/net/ethernet/marvell/octeontx2/nic/otx2_dmac_flt.c +9 -0
@@ -28,6 +28,11 @@ static int otx2_dmacflt_do_add(struct otx2_nic *pf, const u8 *mac,if (!err) { rsp = (struct cgx_mac_addr_add_rsp *)otx2_mbox_get_rsp (&pf->mbox.mbox,0 , &req->hdr); +if (IS_ERR (rsp)) { +mutex_unlock (&pf->mbox.lock); +return PTR_ERR (rsp); + } + *dmac_index = rsp->index; }
@@ -200,6 +205,10 @@ int otx2_dmacflt_update(struct otx2_nic *pf, u8 *mac, u32 bit_pos) rsp = (struct cgx_mac_addr_update_rsp *)otx2_mbox_get_rsp (&pf->mbox.mbox,0 , &req->hdr); +if (IS_ERR (rsp)) { + rc =PTR_ERR (rsp); + goto out; + } pf->flow_cfg->bmap_to_dmacindex[bit_pos] = rsp->index;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 291/817 octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dcbnl.c
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dipendra Khadka <[email protected]>
[ Upstream commit 69297b0d3369488af259e3a7cf53d69157938ea1 ]
Add error pointer check after calling otx2_mbox_get_rsp().
--- drivers/net/ethernet/marvell/octeontx2/nic/otx2_dcbnl.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/marvell/octeontx2/nic/otx2_dcbnl.c +5 -0
@@ -315,6 +315,11 @@ int otx2_config_priority_flow_ctrl(struct otx2_nic *pfvf)if (!otx2_sync_mbox_msg (&pfvf->mbox)) { rsp = (struct cgx_pfc_rsp *)otx2_mbox_get_rsp (&pfvf->mbox.mbox,0 , &req->hdr); +if (IS_ERR (rsp)) { + err =PTR_ERR (rsp); + goto unlock; + } +if (req->rx_pause != rsp->rx_pause || req->tx_pause != rsp->tx_pause) {dev_warn (pfvf->dev,"Failed to config PFC\n" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 292/817 selftests/bpf: fix test_spin_lock_fail.cs global vars usage
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrii Nakryiko <[email protected]>
[ Upstream commit 1b2bfc29695d273492c3dd8512775261f3272686 ]
Global variables of special types (like struct bpf_spin_lock) make underlying ARRAY maps non-mmapable. To make this work with libbpf's mmaping logic, application is expected to declare such special variables as static, so libbpf doesn't even attempt to mmap() such ARRAYs.
test_spin_lock_fail.c didn't follow this rule, but given it relied on this test to trigger failures, this went unnoticed, as we never got to the step of mmap()'ing these ARRAY maps.
It is fragile and relies on specific sequence of libbpf steps, which are an internal implementation details.
Fix the test by marking lockA and lockB as static.
--- tools/testing/selftests/bpf/progs/test_spin_lock_fail.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/testing/selftests/bpf/progs/test_spin_lock_fail.c +2 -2
@@ -28,8 +28,8 @@ struct { }, }; -SEC(".data.A") struct bpf_spin_lock lockA; -SEC(".data.B") struct bpf_spin_lock lockB; +static struct bpf_spin_lock lockA SEC(".data.A"); +static struct bpf_spin_lock lockB SEC(".data.B"); SEC("?tc")int lock_id_kptr_preserve (void *ctx)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 293/817 libbpf: move global data mmap()ing into bpf_object__load()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrii Nakryiko <[email protected]>
[ Upstream commit 137978f422516a128326df55c0ba23605f925e21 ]
Since BPF skeleton inception libbpf has been doing mmap()'ing of global data ARRAY maps in bpf_object__load_skeleton() API, which is used by code generated .skel.h files (i.e., by BPF skeletons only).
This is wrong because if BPF object is loaded through generic bpf_object__load() API, global data maps won't be re-mmap()'ed after load step, and memory pointers returned from bpf_map__initial_value() would be wrong and won't reflect the actual memory shared between BPF program and user space.
bpf_map__initial_value() return result is rarely used after load, so this went unnoticed for a really long time, until bpftrace project attempted to load BPF object through generic bpf_object__load() API and then used BPF subskeleton instantiated from such bpf_object. It turned out that .data/.rodata/.bss data updates through such subskeleton was "blackholed", all because libbpf wouldn't re-mmap() those maps during bpf_object__load() phase.
Long story short, this step should be done by libbpf regardless of BPF skeleton usage, right after BPF map is created in the kernel. This patch moves this functionality into bpf_object__populate_internal_map() to achieve this. And bpf_object__load_skeleton() is now simple and almost trivial, only propagating these mmap()'ed pointers into user-supplied skeleton structs.
We also do trivial adjustments to error reporting inside bpf_object__populate_internal_map() for consistency with the rest of libbpf's map-handling code.
--- tools/lib/bpf/libbpf.c | 83 ++++++++++++++++++++---------------------- 1 file changed, 40 insertions(+), 43 deletions(-)
tools/lib/bpf/libbpf.c +40 -43
@@ -5094,6 +5094,7 @@ bpf_object__populate_internal_map(struct bpf_object *obj, struct bpf_map *map)enum libbpf_map_type map_type = map->libbpf_type;char *cp, errmsg[STRERR_BUFSIZE ];int err, zero =0 ; +size_t mmap_sz;if (obj->gen_loader) { bpf_gen__map_update_elem(obj->gen_loader, map - obj->maps,
@@ -5107,8 +5108,8 @@ bpf_object__populate_internal_map(struct bpf_object *obj, struct bpf_map *map)if (err) { err = -errno; cp =libbpf_strerror_r (err, errmsg,sizeof (errmsg)); -pr_warn ("Error setting initial map(%s) contents: %s\n" , - map->name, cp); +pr_warn ("map '%s': failed to set initial contents: %s\n" , +bpf_map__name (map), cp);return err; }
@@ -5118,11 +5119,43 @@ bpf_object__populate_internal_map(struct bpf_object *obj, struct bpf_map *map)if (err) { err = -errno; cp =libbpf_strerror_r (err, errmsg,sizeof (errmsg)); -pr_warn ("Error freezing map(%s) as read-only: %s\n" , - map->name, cp); +pr_warn ("map '%s': failed to freeze as read-only: %s\n" , +bpf_map__name (map), cp);return err; } } + +/* Remap anonymous mmap()-ed "map initialization image" as +* a BPF map-backed mmap()-ed memory, but preserving the same +* memory address. This will cause kernel to change process' +* page table to point to a different piece of kernel memory, +* but from userspace point of view memory address (and its +* contents, being identical at this point) will stay the +* same. This mapping will be released by bpf_object__close() +* as per normal clean up procedure. +*/ + mmap_sz =bpf_map_mmap_sz (map); +if (map->def.map_flags &BPF_F_MMAPABLE ) { +void *mmaped; +int prot; + +if (map->def.map_flags &BPF_F_RDONLY_PROG ) + prot =PROT_READ ; +else + prot =PROT_READ |PROT_WRITE ; + mmaped =mmap (map->mmaped, mmap_sz, prot,MAP_SHARED |MAP_FIXED , map->fd,0 ); +if (mmaped ==MAP_FAILED ) { + err = -errno; +pr_warn ("map '%s': failed to re-mmap() contents: %d\n" , +bpf_map__name (map), err); +return err; + } + map->mmaped = mmaped; + }else if (map->mmaped) { +munmap (map->mmaped, mmap_sz); + map->mmaped =NULL ; + } +return 0 ; }
@@ -5439,8 +5472,7 @@ bpf_object__create_maps(struct bpf_object *obj) err =bpf_object__populate_internal_map (obj, map);if (err <0 ) goto err_out; - } -if (map->def.type ==BPF_MAP_TYPE_ARENA ) { + }else if (map->def.type ==BPF_MAP_TYPE_ARENA ) { map->mmaped = mmap((void *)(long)map->map_extra, bpf_map_mmap_sz(map), PROT_READ | PROT_WRITE, map->map_extra ? MAP_SHARED | MAP_FIXED : MAP_SHARED,
@@ -13876,46 +13908,11 @@ int bpf_object__load_skeleton(struct bpf_object_skeleton *s)for (i =0 ; i < s->map_cnt; i++) {struct bpf_map_skeleton *map_skel = (void *)s->maps + i * s->map_skel_sz;struct bpf_map *map = *map_skel->map; -size_t mmap_sz =bpf_map_mmap_sz (map); -int prot, map_fd = map->fd; -void **mmaped = map_skel->mmaped; - -if (!mmaped) -continue ; - -if (!(map->def.map_flags &BPF_F_MMAPABLE )) { - *mmaped =NULL ; -continue ; - } -if (map->def.type ==BPF_MAP_TYPE_ARENA ) { - *mmaped = map->mmaped; +if (!map_skel->mmaped)continue ; - } - -if (map->def.map_flags &BPF_F_RDONLY_PROG ) - prot =PROT_READ ; -else - prot =PROT_READ |PROT_WRITE ; -/* Remap anonymous mmap()-ed "map initialization image" as -* a BPF map-backed mmap()-ed memory, but preserving the same -* memory address. This will cause kernel to change process' -* page table to point to a different piece of kernel memory, -* but from userspace point of view memory address (and its -* contents, being identical at this point) will stay the -* same. This mapping will be released by bpf_object__close() -* as per normal clean up procedure, so we don't need to worry -* about it from skeleton's clean up perspective. -*/ - *mmaped =mmap (map->mmaped, mmap_sz, prot,MAP_SHARED |MAP_FIXED , map_fd,0 ); -if (*mmaped ==MAP_FAILED ) { - err = -errno; - *mmaped =NULL ; -pr_warn ("failed to re-mmap() map '%s': %d\n" , -bpf_map__name (map), err); -return libbpf_err (err); - } + *map_skel->mmaped = map->mmaped; }return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 294/817 drm/panfrost: Remove unused id_mask from struct panfrost_model
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Price <[email protected]>
[ Upstream commit 581d1f8248550f2b67847e6d84f29fbe3751ea0a ]
The id_mask field of struct panfrost_model has never been used.
--- drivers/gpu/drm/panfrost/panfrost_gpu.c | 1 - 1 file changed, 1 deletion(-)
drivers/gpu/drm/panfrost/panfrost_gpu.c +0 -1
@@ -177,7 +177,6 @@ static void panfrost_gpu_init_quirks(struct panfrost_device *pfdev)struct panfrost_model {const char *name;u32 id; -u32 id_mask;u64 features;u64 issues;struct {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 295/817 bpf, arm64: Remove garbage frame for struct_ops trampoline
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Kuohai <[email protected]>
[ Upstream commit 87cb58aebdf7005661a07e9fd5a900f924d48c75 ]
The callsite layout for arm64 fentry is:
mov x9, lr
nop
When a bpf prog is attached, the nop instruction is patched to a call to bpf trampoline:
mov x9, lr
bl <bpf trampoline>
So two return addresses are passed to bpf trampoline: the return address for the traced function/prog, stored in x9, and the return address for the bpf trampoline itself, stored in lr. To obtain a full and accurate call stack, the bpf trampoline constructs two fake function frames using x9 and lr.
However, struct_ops progs are invoked directly as function callbacks, meaning that x9 is not set as it is in the fentry callsite. In this case, the frame constructed using x9 is garbage. The following stack trace for struct_ops, captured by perf sampling, illustrates this issue, where tcp_ack+0x404 is a garbage frame:
ffffffc0801a04b4 bpf_prog_50992e55a0f655a9_bpf_cubic_cong_avoid+0x98 (bpf_prog_50992e55a0f655a9_bpf_cubic_cong_avoid) ffffffc0801a228c [unknown] ([kernel.kallsyms]) // bpf trampolineffffffd08d362590 tcp_ack+0x798 ([kernel.kallsyms]) // caller for bpf trampolineffffffd08d3621fc tcp_ack+0x404 ([kernel.kallsyms]) // garbage frameffffffd08d36452c tcp_rcv_established+0x4ac ([kernel.kallsyms])ffffffd08d375c58 tcp_v4_do_rcv+0x1f0 ([kernel.kallsyms])ffffffd08d378630 tcp_v4_rcv+0xeb8 ([kernel.kallsyms])
To fix it, construct only one frame using lr for struct_ops.
The above stack trace also indicates that there is no kernel symbol for struct_ops bpf trampoline. This will be addressed in a follow-up patch.
--- arch/arm64/net/bpf_jit_comp.c | 47 +++++++++++++++++++++++------------ 1 file changed, 31 insertions(+), 16 deletions(-)
arch/arm64/net/bpf_jit_comp.c +31 -16
@@ -2046,6 +2046,12 @@ static void restore_args(struct jit_ctx *ctx, int args_off, int nregs) } } +static bool is_struct_ops_tramp (const struct bpf_tramp_links *fentry_links) +{ +return fentry_links->nr_links ==1 && + fentry_links->links[0 ]->link.type ==BPF_LINK_TYPE_STRUCT_OPS ; +} +/* Based on the x86's implementation of arch_prepare_bpf_trampoline(). * * bpf prog and function entry before bpf trampoline hooked:
@@ -2075,6 +2081,7 @@ static int prepare_trampoline(struct jit_ctx *ctx, struct bpf_tramp_image *im,struct bpf_tramp_links *fmod_ret = &tlinks[BPF_TRAMP_MODIFY_RETURN ];bool save_ret;__le32 **branches =NULL ; +bool is_struct_ops =is_struct_ops_tramp (fentry);/* trampoline stack layout: * [ parent ip ]
@@ -2143,11 +2150,14 @@ static int prepare_trampoline(struct jit_ctx *ctx, struct bpf_tramp_image *im,*/ emit_bti (A64_BTI_JC , ctx); -/* frame for parent function */ -emit (A64_PUSH (A64_FP ,A64_R (9 ),A64_SP ), ctx); -emit (A64_MOV (1 ,A64_FP ,A64_SP ), ctx); +/* x9 is not set for struct_ops */ +if (!is_struct_ops) { +/* frame for parent function */ +emit (A64_PUSH (A64_FP ,A64_R (9 ),A64_SP ), ctx); +emit (A64_MOV (1 ,A64_FP ,A64_SP ), ctx); + } -/* frame for patched function */ +/* frame for patched function for tracing, or caller for struct_ops */ emit (A64_PUSH (A64_FP ,A64_LR ,A64_SP ), ctx);emit (A64_MOV (1 ,A64_FP ,A64_SP ), ctx);
@@ -2241,19 +2251,24 @@ static int prepare_trampoline(struct jit_ctx *ctx, struct bpf_tramp_image *im,/* reset SP */ emit (A64_MOV (1 ,A64_SP ,A64_FP ), ctx); -/* pop frames */ -emit (A64_POP (A64_FP ,A64_LR ,A64_SP ), ctx); -emit (A64_POP (A64_FP ,A64_R (9 ),A64_SP ), ctx); - -if (flags &BPF_TRAMP_F_SKIP_FRAME ) { -/* skip patched function, return to parent */ -emit (A64_MOV (1 ,A64_LR ,A64_R (9 )), ctx); -emit (A64_RET (A64_R (9 )), ctx); +if (is_struct_ops) { +emit (A64_POP (A64_FP ,A64_LR ,A64_SP ), ctx); +emit (A64_RET (A64_LR ), ctx); }else { -/* return to patched function */ -emit (A64_MOV (1 ,A64_R (10 ),A64_LR ), ctx); -emit (A64_MOV (1 ,A64_LR ,A64_R (9 )), ctx); -emit (A64_RET (A64_R (10 )), ctx); +/* pop frames */ +emit (A64_POP (A64_FP ,A64_LR ,A64_SP ), ctx); +emit (A64_POP (A64_FP ,A64_R (9 ),A64_SP ), ctx); + +if (flags &BPF_TRAMP_F_SKIP_FRAME ) { +/* skip patched function, return to parent */ +emit (A64_MOV (1 ,A64_LR ,A64_R (9 )), ctx); +emit (A64_RET (A64_R (9 )), ctx); + }else { +/* return to patched function */ +emit (A64_MOV (1 ,A64_R (10 ),A64_LR ), ctx); +emit (A64_MOV (1 ,A64_LR ,A64_R (9 )), ctx); +emit (A64_RET (A64_R (10 )), ctx); + } }kfree (branches);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 296/817 drm/msm/adreno: Use IRQF_NO_AUTOEN flag in request_irq()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 394679f322649d06fea3c646ba65f5a0887f52c3 ]
disable_irq() after request_irq() still has a time gap in which interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will disable IRQ auto-enable when request IRQ.
Patchwork: https://patchwork.freedesktop.org/patch/614075/
--- drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/gpu/drm/msm/adreno/a6xx_gmu.c +1 -3
@@ -1505,15 +1505,13 @@ static int a6xx_gmu_get_irq(struct a6xx_gmu *gmu, struct platform_device *pdev, irq =platform_get_irq_byname (pdev, name); - ret =request_irq (irq, handler,IRQF_TRIGGER_HIGH , name, gmu); + ret =request_irq (irq, handler,IRQF_TRIGGER_HIGH |IRQF_NO_AUTOEN , name, gmu);if (ret) {DRM_DEV_ERROR (&pdev->dev,"Unable to get interrupt %s %d\n" , name, ret);return ret; } -disable_irq (irq); -return irq; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 297/817 drm/msm/gpu: Check the status of registration to PM QoS
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukasz Luba <[email protected]>
[ Upstream commit 8f32ddd87e499ba6d2dc74ce30b6932baf1e1fc3 ]
There is a need to check the returned value of the registration function. In case of returned error, print that and stop the init process.
Patchwork: https://patchwork.freedesktop.org/patch/620336/
--- drivers/gpu/drm/msm/msm_gpu_devfreq.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/gpu/drm/msm/msm_gpu_devfreq.c +7 -2
@@ -140,6 +140,7 @@ void msm_devfreq_init(struct msm_gpu *gpu) {struct msm_gpu_devfreq *df = &gpu->devfreq;struct msm_drm_private *priv = gpu->dev->dev_private; +int ret;/* We need target support to do devfreq */ if (!gpu->funcs->gpu_busy)
@@ -156,8 +157,12 @@ void msm_devfreq_init(struct msm_gpu *gpu)mutex_init (&df->lock); -dev_pm_qos_add_request (&gpu->pdev->dev, &df->boost_freq, -DEV_PM_QOS_MIN_FREQUENCY ,0 ); + ret =dev_pm_qos_add_request (&gpu->pdev->dev, &df->boost_freq, +DEV_PM_QOS_MIN_FREQUENCY ,0 ); +if (ret <0 ) { +DRM_DEV_ERROR (&gpu->pdev->dev,"Couldn't initialize QoS\n" ); +return ; + } msm_devfreq_profile.initial_freq = gpu->fast_rate;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 298/817 drm/xe/hdcp: Fix gsc structure check in fw check status
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Suraj Kandpal <[email protected]>
[ Upstream commit 182a32bcc223203c57761889fac7fa2dbb34684b ]
Fix the condition for gsc structure validity in gsc_cs_status_check(). It needs to be an OR and not an AND condition
--- drivers/gpu/drm/xe/display/xe_hdcp_gsc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/xe/display/xe_hdcp_gsc.c +1 -1
@@ -43,7 +43,7 @@ bool intel_hdcp_gsc_check_status(struct xe_device *xe)struct xe_gsc *gsc = >->uc.gsc;bool ret = true; -if (!gsc && !xe_uc_fw_is_enabled (&gsc->fw)) { +if (!gsc || !xe_uc_fw_is_enabled (&gsc->fw)) {drm_dbg_kms (&xe->drm,"GSC Components not ready for HDCP2.x\n" );return false;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 299/817 drm/etnaviv: Request pages from DMA32 zone on addressing_limited
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaolei Wang <[email protected]>
[ Upstream commit 13c96ac9a3f0f1c7ba1ff0656ea508e7fa065e7e ]
Remove __GFP_HIGHMEM when requesting a page from DMA32 zone, and since all vivante GPUs in the system will share the same DMA constraints, move the check of whether to get a page from DMA32 to etnaviv_bind().
--- drivers/gpu/drm/etnaviv/etnaviv_drv.c | 10 ++++++++++ drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 8 -------- 2 files changed, 10 insertions(+), 8 deletions(-)
drivers/gpu/drm/etnaviv/etnaviv_drv.c +10 -0
@@ -538,6 +538,16 @@ static int etnaviv_bind(struct device *dev) priv->num_gpus =0 ; priv->shm_gfp_mask =GFP_HIGHUSER | __GFP_RETRY_MAYFAIL | __GFP_NOWARN; +/* +* If the GPU is part of a system with DMA addressing limitations, +* request pages for our SHM backend buffers from the DMA32 zone to +* hopefully avoid performance killing SWIOTLB bounce buffering. +*/ +if (dma_addressing_limited (dev)) { + priv->shm_gfp_mask |=GFP_DMA32 ; + priv->shm_gfp_mask &= ~__GFP_HIGHMEM; + } + priv->cmdbuf_suballoc =etnaviv_cmdbuf_suballoc_new (drm->dev);if (IS_ERR (priv->cmdbuf_suballoc)) {dev_err (drm->dev,"Failed to create cmdbuf suballocator\n" );
drivers/gpu/drm/etnaviv/etnaviv_gpu.c +0 -8
@@ -839,14 +839,6 @@ int etnaviv_gpu_init(struct etnaviv_gpu *gpu)if (ret) goto fail; -/* -* If the GPU is part of a system with DMA addressing limitations, -* request pages for our SHM backend buffers from the DMA32 zone to -* hopefully avoid performance killing SWIOTLB bounce buffering. -*/ -if (dma_addressing_limited (gpu->dev)) - priv->shm_gfp_mask |=GFP_DMA32 ; -/* Create buffer: */ ret =etnaviv_cmdbuf_init (priv->cmdbuf_suballoc, &gpu->buffer,PAGE_SIZE );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 300/817 drm/etnaviv: hold GPU lock across perfmon sampling
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lucas Stach <[email protected]>
[ Upstream commit 37dc4737447a7667f8e9ec790dac251da057eb27 ]
The perfmon sampling mutates shared GPU state (e.g. VIVS_HI_CLOCK_CONTROL to select the pipe for the perf counter reads). To avoid clashing with other functions mutating the same state (e.g. etnaviv_gpu_update_clock) the perfmon sampling needs to hold the GPU lock.
--- drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-)
drivers/gpu/drm/etnaviv/etnaviv_gpu.c +14 -6
@@ -1322,6 +1322,8 @@ static void sync_point_perfmon_sample_pre(struct etnaviv_gpu *gpu, {u32 val; +mutex_lock (&gpu->lock); +/* disable clock gating */ val =gpu_read_power (gpu,VIVS_PM_POWER_CONTROLS ); val &= ~VIVS_PM_POWER_CONTROLS_ENABLE_MODULE_CLOCK_GATING ;
@@ -1333,6 +1335,8 @@ static void sync_point_perfmon_sample_pre(struct etnaviv_gpu *gpu,gpu_write (gpu,VIVS_HI_CLOCK_CONTROL , val);sync_point_perfmon_sample (gpu, event,ETNA_PM_PROCESS_PRE ); + +mutex_unlock (&gpu->lock); } static void sync_point_perfmon_sample_post(struct etnaviv_gpu *gpu,
@@ -1342,13 +1346,9 @@ static void sync_point_perfmon_sample_post(struct etnaviv_gpu *gpu,unsigned int i;u32 val; -sync_point_perfmon_sample (gpu, event,ETNA_PM_PROCESS_POST ); - -for (i =0 ; i < submit->nr_pmrs; i++) { -const struct etnaviv_perfmon_request *pmr = submit->pmrs + i; +mutex_lock (&gpu->lock); - *pmr->bo_vma = pmr->sequence; - } +sync_point_perfmon_sample (gpu, event,ETNA_PM_PROCESS_POST );/* disable debug register */ val =gpu_read (gpu,VIVS_HI_CLOCK_CONTROL );
@@ -1359,6 +1359,14 @@ static void sync_point_perfmon_sample_post(struct etnaviv_gpu *gpu, val =gpu_read_power (gpu,VIVS_PM_POWER_CONTROLS ); val |=VIVS_PM_POWER_CONTROLS_ENABLE_MODULE_CLOCK_GATING ;gpu_write_power (gpu,VIVS_PM_POWER_CONTROLS , val); + +mutex_unlock (&gpu->lock); + +for (i =0 ; i < submit->nr_pmrs; i++) { +const struct etnaviv_perfmon_request *pmr = submit->pmrs + i; + + *pmr->bo_vma = pmr->sequence; + } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 301/817 drm/amd/display: Increase idle worker HPD detection time
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roman Li <[email protected]>
[ Upstream commit 60612f75992d96955fb7154468c58d5d168cf1ab ]
[Why]
Idle worker thread waits HPD_DETECTION_TIME for HPD processing complete. Some displays require longer time for that.
[How]
Increase HPD_DETECTION_TIME to 100ms.
Stable-dep-of: a88b19b13fb4 ("drm/amd/display: Reduce HPD Detection Interval for IPS")
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c +1 -1
@@ -36,7 +36,7 @@#include "amdgpu_dm_debugfs.h" #define HPD_DETECTION_PERIOD_uS 5000000 -#define HPD_DETECTION_TIME_uS 1000 +#define HPD_DETECTION_TIME_uS 100000void amdgpu_dm_crtc_handle_vblank (struct amdgpu_crtc *acrtc) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 302/817 drm/amd/display: Reduce HPD Detection Interval for IPS
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fangzhi Zuo <[email protected]>
[ Upstream commit a88b19b13fb41a3fa03ec67b5f57cc267fbfb160 ]
Fix DP Compliance test 4.2.1.3, 4.2.2.8, 4.3.1.12, 4.3.1.13 when IPS enabled.
Original HPD detection interval is set to 5s which violates DP compliance.
Reduce the interval parameter, such that link training can be finished within 5 seconds.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c +1 -1
@@ -35,7 +35,7 @@#include "amdgpu_dm_trace.h" #include "amdgpu_dm_debugfs.h" -#define HPD_DETECTION_PERIOD_uS 5000000 +#define HPD_DETECTION_PERIOD_uS 2000000#define HPD_DETECTION_TIME_uS 100000void amdgpu_dm_crtc_handle_vblank (struct amdgpu_crtc *acrtc)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 303/817 drm/nouveau/gr/gf100: Fix missing unlock in gf100_gr_chan_new()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Huafei <[email protected]>
[ Upstream commit a2f599046c671d6b46d93aed95b37241ce4504cf ]
When the call to gf100_grctx_generate() fails, unlock gr->fecs.mutex before returning the error.
Fixes smatch warning:
drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c:480 gf100_gr_chan_new() warn: inconsistent returns '&gr->fecs.mutex'.
--- drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c +1 -0
@@ -443,6 +443,7 @@ gf100_gr_chan_new(struct nvkm_gr *base, struct nvkm_chan *fifoch, ret =gf100_grctx_generate (gr, chan, fifoch->inst);if (ret) {nvkm_error (&base->engine.subdev,"failed to construct context\n" ); +mutex_unlock (&gr->fecs.mutex);return ret; } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 304/817 drm: zynqmp_kms: Unplug DRM device before removal
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Anderson <[email protected]>
[ Upstream commit 2e07c88914fc5289c21820b1aa94f058feb38197 ]
Prevent userspace accesses to the DRM device from causing use-after-frees by unplugging the device before we remove it. This causes any further userspace accesses to result in an error without further calls into this driver's internals.
--- drivers/gpu/drm/xlnx/zynqmp_kms.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/xlnx/zynqmp_kms.c +1 -1
@@ -536,7 +536,7 @@ void zynqmp_dpsub_drm_cleanup(struct zynqmp_dpsub *dpsub) {struct drm_device *drm = &dpsub->drm->dev; -drm_dev_unregister (drm); +drm_dev_unplug (drm);drm_atomic_helper_shutdown (drm);drm_encoder_cleanup (&dpsub->drm->encoder);drm_kms_helper_poll_fini (drm);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 305/817 drm: xlnx: zynqmp_disp: layer may be null while releasing
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steffen Dirkwinkel <[email protected]>
[ Upstream commit 223842c7702b52846b1c5aef8aca7474ec1fd29b ]
layer->info can be null if we have an error on the first layer in zynqmp_disp_create_layers
--- drivers/gpu/drm/xlnx/zynqmp_disp.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/xlnx/zynqmp_disp.c +3 -0
@@ -1200,6 +1200,9 @@ static void zynqmp_disp_layer_release_dma(struct zynqmp_disp *disp, {unsigned int i; +if (!layer->info) +return ; +for (i =0 ; i < layer->info->num_channels; i++) {struct zynqmp_disp_layer_dma *dma = &layer->dmas[i];
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 306/817 wifi: wfx: Fix error handling in wfx_core_init()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuan Can <[email protected]>
[ Upstream commit 3b88a9876779b55478a4dde867e73f7a100ffa23 ]
The wfx_core_init() returns without checking the retval from sdio_register_driver().
If the sdio_register_driver() failed, the module failed to install, leaving the wfx_spi_driver not unregistered.
--- drivers/net/wireless/silabs/wfx/main.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-)
drivers/net/wireless/silabs/wfx/main.c +15 -2
@@ -480,10 +480,23 @@ static int __init wfx_core_init(void) {int ret =0 ; -if (IS_ENABLED (CONFIG_SPI )) +if (IS_ENABLED (CONFIG_SPI )) { ret =spi_register_driver (&wfx_spi_driver); -if (IS_ENABLED (CONFIG_MMC ) && !ret) +if (ret) + goto out; + } +if (IS_ENABLED (CONFIG_MMC )) { ret =sdio_register_driver (&wfx_sdio_driver); +if (ret) + goto unregister_spi; + } + +return 0 ; + +unregister_spi: +if (IS_ENABLED (CONFIG_SPI )) +spi_unregister_driver (&wfx_spi_driver); +out:return ret; }module_init (wfx_core_init);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 307/817 wifi: cw1200: Fix potential NULL dereference
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <[email protected]>
[ Upstream commit 2b94751626a6d49bbe42a19cc1503bd391016bd5 ]
A recent refactoring was identified by static analysis to cause a potential NULL dereference, fix this!
--- drivers/net/wireless/st/cw1200/cw1200_spi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/st/cw1200/cw1200_spi.c +1 -1
@@ -450,7 +450,7 @@ static int __maybe_unused cw1200_spi_suspend(struct device *dev) {struct hwbus_priv *self =spi_get_drvdata (to_spi_device (dev)); -if (!cw1200_can_suspend (self->core)) +if (self && !cw1200_can_suspend (self->core))return -EAGAIN ;/* XXX notify host that we have to keep CW1200 powered on? */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 308/817 drm/msm/dpu: cast crtc_clk calculation to u64 in _dpu_core_perf_calc_clk()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zichen Xie <[email protected]>
[ Upstream commit 20c7b42d9dbd048019bfe0af39229e3014007a98 ]
There may be a potential integer overflow issue in _dpu_core_perf_calc_clk(). crtc_clk is defined as u64, while mode->vtotal, mode->hdisplay, and drm_mode_vrefresh(mode) are defined as a smaller data type. The result of the calculation will be limited to "int" in this case without correct casting. In screen with high resolution and high refresh rate, integer overflow may happen. So, we recommend adding an extra cast to prevent potential integer overflow.
Patchwork: https://patchwork.freedesktop.org/patch/622206/
--- drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c +1 -1
@@ -80,7 +80,7 @@ static u64 _dpu_core_perf_calc_clk(const struct dpu_perf_cfg *perf_cfg, mode = &state->adjusted_mode; - crtc_clk = mode->vtotal * mode->hdisplay *drm_mode_vrefresh (mode); + crtc_clk = (u64 )mode->vtotal * mode->hdisplay *drm_mode_vrefresh (mode);drm_atomic_crtc_for_each_plane (plane, crtc) { pstate =to_dpu_plane_state (plane->state);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 309/817 bpf, bpftool: Fix incorrect disasm pc
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Hwang <[email protected]>
[ Upstream commit 4d99e509c161f8610de125202c648fa4acd00541 ]
This patch addresses the bpftool issue "Wrong callq address displayed"[0].
The issue stemmed from an incorrect program counter (PC) value used during disassembly with LLVM or libbfd.
For LLVM: The PC argument must represent the actual address in the kernel to compute the correct relative address.
For libbfd: The relative address can be adjusted by adding func_ksym within the custom info->print_address_func to yield the correct address.
Links:
[0] https://github.com/libbpf/bpftool/issues/109
Changes:
v2 -> v3:
* Address comment from Quentin:
* Remove the typedef.
v1 -> v2:
* Fix the broken libbfd disassembler.
--- tools/bpf/bpftool/jit_disasm.c | 40 ++++++++++++++++++++++++---------- 1 file changed, 29 insertions(+), 11 deletions(-)
tools/bpf/bpftool/jit_disasm.c +29 -11
@@ -80,7 +80,8 @@ symbol_lookup_callback(__maybe_unused void *disasm_info,static int init_context (disasm_ctx_t *ctx,const char *arch,__maybe_unused const char *disassembler_options, -__maybe_unused unsigned char *image,__maybe_unused ssize_t len) +__maybe_unused unsigned char *image,__maybe_unused ssize_t len, +__maybe_unused __u64 func_ksym) {char *triple;
@@ -109,12 +110,13 @@ static void destroy_context(disasm_ctx_t *ctx) }static int -disassemble_insn (disasm_ctx_t *ctx,unsigned char *image,ssize_t len,int pc) +disassemble_insn (disasm_ctx_t *ctx,unsigned char *image,ssize_t len,int pc, +__u64 func_ksym) {char buf[256 ];int count; - count =LLVMDisasmInstruction (*ctx, image + pc, len - pc, pc, + count =LLVMDisasmInstruction (*ctx, image + pc, len - pc, func_ksym + pc, buf,sizeof (buf));if (json_output)printf_json (buf);
@@ -136,8 +138,21 @@ int disasm_init(void)#ifdef HAVE_LIBBFD_SUPPORT #define DISASM_SPACER "\t" +struct disasm_info { +struct disassemble_info info; +__u64 func_ksym; +}; + +static void disasm_print_addr (bfd_vma addr,struct disassemble_info *info) +{ + struct disasm_info *dinfo = container_of(info, struct disasm_info, info); + + addr += dinfo->func_ksym; +generic_print_address (addr, info); +} +typedef struct { -struct disassemble_info *info; +struct disasm_info *info;disassembler_ftype disassemble;bfd *bfdf; }disasm_ctx_t ;
@@ -215,7 +230,7 @@ static int fprintf_json_styled(void *out,static int init_context (disasm_ctx_t *ctx,const char *arch,const char *disassembler_options, -unsigned char *image,ssize_t len) +unsigned char *image,ssize_t len,__u64 func_ksym) {struct disassemble_info *info;char tpath[PATH_MAX ];
@@ -238,12 +253,13 @@ static int init_context(disasm_ctx_t *ctx, const char *arch, } bfdf = ctx->bfdf; - ctx->info =malloc (sizeof (struct disassemble_info )); + ctx->info =malloc (sizeof (struct disasm_info ));if (!ctx->info) {p_err ("mem alloc failed" ); goto err_close; } - info = ctx->info; + ctx->info->func_ksym = func_ksym; + info = &ctx->info->info;if (json_output) init_disassemble_info_compat(info, stdout,
@@ -272,6 +288,7 @@ static int init_context(disasm_ctx_t *ctx, const char *arch, info->disassembler_options = disassembler_options; info->buffer = image; info->buffer_length = len; + info->print_address_func = disasm_print_addr;disassemble_init_for_target (info);
@@ -304,9 +321,10 @@ static void destroy_context(disasm_ctx_t *ctx)static int disassemble_insn (disasm_ctx_t *ctx,__maybe_unused unsigned char *image, -__maybe_unused ssize_t len,int pc) +__maybe_unused ssize_t len,int pc, +__maybe_unused __u64 func_ksym) { -return ctx->disassemble (pc, ctx->info); +return ctx->disassemble (pc, &ctx->info->info); }int disasm_init (void )
@@ -331,7 +349,7 @@ int disasm_print_insn(unsigned char *image, ssize_t len, int opcodes,if (!len)return -1 ; -if (init_context (&ctx, arch, disassembler_options, image, len)) +if (init_context (&ctx, arch, disassembler_options, image, len, func_ksym))return -1 ;if (json_output)
@@ -360,7 +378,7 @@ int disasm_print_insn(unsigned char *image, ssize_t len, int opcodes,printf ("%4x:" DISASM_SPACER , pc); } - count =disassemble_insn (&ctx, image, len, pc); + count =disassemble_insn (&ctx, image, len, pc, func_ksym);if (json_output) {/* Operand array, was started in fprintf_json. Before
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 310/817 bpf: Tighten tail call checks for lingering locks, RCU, preempt_disable
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kumar Kartikeya Dwivedi <[email protected]>
[ Upstream commit 46f7ed32f7a873d6675ea72e1d6317df41a55f81 ]
There are three situations when a program logically exits and transfers control to the kernel or another program: bpf_throw, BPF_EXIT, and tail calls. The former two check for any lingering locks and references, but tail calls currently do not. Expand the checks to check for spin locks, RCU read sections and preempt disabled sections.
Spin locks are indirectly preventing tail calls as function calls are disallowed, but the checks for preemption and RCU are more relaxed, hence ensure tail calls are prevented in their presence.
--- kernel/bpf/verifier.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
kernel/bpf/verifier.c +15 -0
@@ -10459,11 +10459,26 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insnswitch (func_id) {case BPF_FUNC_tail_call: +if (env->cur_state->active_lock.ptr) { +verbose (env,"tail_call cannot be used inside bpf_spin_lock-ed region\n" ); +return -EINVAL ; + } + err =check_reference_leak (env, false);if (err) {verbose (env,"tail_call would lead to reference leak\n" );return err; } + +if (env->cur_state->active_rcu_lock) { +verbose (env,"tail_call cannot be used inside bpf_rcu_read_lock-ed region\n" ); +return -EINVAL ; + } + +if (env->cur_state->active_preempt_lock) { +verbose (env,"tail_call cannot be used inside bpf_preempt_disable-ed region\n" ); +return -EINVAL ; + }break ;case BPF_FUNC_get_local_storage:/* check that flags argument in get_local_storage(map, flags) is 0,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 311/817 drm/vkms: Drop unnecessary call to drm_crtc_cleanup()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: José Expósito <[email protected]>
[ Upstream commit 1d43dddd7c38ea1aa93f78f7ee10087afb0a561f ]
CRTC creation uses drmm_crtc_init_with_planes(), which automatically handles cleanup. However, an unnecessary call to drm_crtc_cleanup() is still present in the vkms_output_init() error path.
--- drivers/gpu/drm/vkms/vkms_output.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/gpu/drm/vkms/vkms_output.c +1 -4
@@ -84,7 +84,7 @@ int vkms_output_init(struct vkms_device *vkmsdev, int index) DRM_MODE_CONNECTOR_VIRTUAL);if (ret) {DRM_ERROR ("Failed to init connector\n" ); - goto err_connector; +return ret; }drm_connector_helper_add (connector, &vkms_conn_helper_funcs);
@@ -119,8 +119,5 @@ int vkms_output_init(struct vkms_device *vkmsdev, int index) err_encoder:drm_connector_cleanup (connector); -err_connector: -drm_crtc_cleanup (crtc); -return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 312/817 drm/amdgpu: Fix the memory allocation issue in amdgpu_discovery_get_nps_info()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Huafei <[email protected]>
[ Upstream commit a1144da794adedb9447437c57d69add56494309d ]
Fix two issues with memory allocation in amdgpu_discovery_get_nps_info() for mem_ranges:
- Add a check for allocation failure to avoid dereferencing a null pointer.
- As suggested by Christophe, use kvcalloc() for memory allocation, which checks for multiplication overflow.
Additionally, assign the output parameters nps_type and range_cnt after the kvcalloc() call to prevent modifying the output parameters in case of an error return.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c +5 -3
@@ -1757,11 +1757,13 @@ int amdgpu_discovery_get_nps_info(struct amdgpu_device *adev,switch (le16_to_cpu (nps_info->v1.header.version_major)) {case 1 : + mem_ranges =kvcalloc (nps_info->v1.count, +sizeof (*mem_ranges), +GFP_KERNEL ); +if (!mem_ranges) +return -ENOMEM ; *nps_type = nps_info->v1.nps_type; *range_cnt = nps_info->v1.count; - mem_ranges =kvzalloc ( - *range_cnt *sizeof (struct amdgpu_gmc_memrange ), -GFP_KERNEL );for (i =0 ; i < *range_cnt; i++) { mem_ranges[i].base_address = nps_info->v1.instance_info[i].base_address;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 313/817 bpf: Support __nullable argument suffix for tp_btf
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philo Lu <[email protected]>
[ Upstream commit 8aeaed21befc90f27f4fca6dd190850d97d2e9e3 ]
Pointers passed to tp_btf were trusted to be valid, but some tracepoints do take NULL pointer as input, such as trace_tcp_send_reset(). Then the invalid memory access cannot be detected by verifier.
This patch fix it by add a suffix "__nullable" to the unreliable argument. The suffix is shown in btf, and PTR_MAYBE_NULL will be added to nullable arguments. Then users must check the pointer before use it.
A problem here is that we use "btf_trace_##call" to search func_proto. As it is a typedef, argument names as well as the suffix are not recorded. To solve this, I use bpf_raw_event_map to find "__bpf_trace##template" from "btf_trace_##call", and then we can see the suffix.
Stable-dep-of: cb4158ce8ec8 ("bpf: Mark raw_tp arguments with PTR_MAYBE_NULL")
--- kernel/bpf/btf.c | 3 +++ kernel/bpf/verifier.c | 36 ++++++++++++++++++++++++++++++++---- 2 files changed, 35 insertions(+), 4 deletions(-)
kernel/bpf/btf.c +3 -0
@@ -6534,6 +6534,9 @@ bool btf_ctx_access(int off, int size, enum bpf_access_type type,if (prog_args_trusted (prog)) info->reg_type |=PTR_TRUSTED ; +if (btf_param_match_suffix (btf, &args[arg],"__nullable" )) + info->reg_type |=PTR_MAYBE_NULL ; +if (tgt_prog) {enum bpf_prog_type tgt_type;
kernel/bpf/verifier.c +32 -4
@@ -28,6 +28,8 @@#include <linux/cpumask.h> #include <linux/bpf_mem_alloc.h> #include <net/xdp.h> +#include <linux/trace_events.h> +#include <linux/kallsyms.h> #include "disasm.h"
@@ -21308,11 +21310,13 @@ int bpf_check_attach_target(struct bpf_verifier_log *log, {bool prog_extension = prog->type ==BPF_PROG_TYPE_EXT ;bool prog_tracing = prog->type ==BPF_PROG_TYPE_TRACING ; +char trace_symbol[KSYM_SYMBOL_LEN ];const char prefix[] ="btf_trace_" ; +struct bpf_raw_event_map *btp;int ret =0 , subprog =-1 , i;const struct btf_type *t;bool conservative = true; -const char *tname; +const char *tname, *fname;struct btf *btf;long addr =0 ;struct module *mod =NULL ;
@@ -21443,10 +21447,34 @@ int bpf_check_attach_target(struct bpf_verifier_log *log,return -EINVAL ; } tname +=sizeof (prefix) -1 ; - t =btf_type_by_id (btf, t->type); -if (!btf_type_is_ptr (t)) -/* should never happen in valid vmlinux build */ + +/* The func_proto of "btf_trace_##tname" is generated from typedef without argument +* names. Thus using bpf_raw_event_map to get argument names. +*/ + btp =bpf_get_raw_tracepoint (tname); +if (!btp)return -EINVAL ; + fname =kallsyms_lookup ((unsigned long )btp->bpf_func,NULL ,NULL ,NULL , + trace_symbol); +bpf_put_raw_tracepoint (btp); + +if (fname) + ret =btf_find_by_name_kind (btf, fname,BTF_KIND_FUNC ); + +if (!fname || ret <0 ) { +bpf_log (log,"Cannot find btf of tracepoint template, fall back to %s%s.\n" , + prefix, tname); + t =btf_type_by_id (btf, t->type); +if (!btf_type_is_ptr (t)) +/* should never happen in valid vmlinux build */ +return -EINVAL ; + }else { + t =btf_type_by_id (btf, ret); +if (!btf_type_is_func (t)) +/* should never happen in valid vmlinux build */ +return -EINVAL ; + } + t =btf_type_by_id (btf, t->type);if (!btf_type_is_func_proto (t))/* should never happen in valid vmlinux build */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 314/817 selftests/bpf: Add test for __nullable suffix in tp_btf
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philo Lu <[email protected]>
[ Upstream commit 2060f07f861a237345922023e9347a204c0795af ]
Add a tracepoint with __nullable suffix in bpf_testmod, and add cases for it:
$ ./test_progs -t "tp_btf_nullable" #406/1 tp_btf_nullable/handle_tp_btf_nullable_bare1:OK #406/2 tp_btf_nullable/handle_tp_btf_nullable_bare2:OK #406 tp_btf_nullable:OK Summary: 1/2 PASSED, 0 SKIPPED, 0 FAILED
Stable-dep-of: cb4158ce8ec8 ("bpf: Mark raw_tp arguments with PTR_MAYBE_NULL")
--- .../bpf/bpf_testmod/bpf_testmod-events.h | 6 +++++ .../selftests/bpf/bpf_testmod/bpf_testmod.c | 2 ++ .../bpf/prog_tests/tp_btf_nullable.c | 14 +++++++++++ .../bpf/progs/test_tp_btf_nullable.c | 24 +++++++++++++++++++ 4 files changed, 46 insertions(+) create mode 100644 tools/testing/selftests/bpf/prog_tests/tp_btf_nullable.c create mode 100644 tools/testing/selftests/bpf/progs/test_tp_btf_nullable.c
tools/testing/selftests/bpf/bpf_testmod/bpf_testmod-events.h +6 -0
@@ -34,6 +34,12 @@ DECLARE_TRACE(bpf_testmod_test_write_bare,TP_ARGS (task, ctx) ); +/* Used in bpf_testmod_test_read() to test __nullable suffix */ +DECLARE_TRACE (bpf_testmod_test_nullable_bare, + TP_PROTO(struct bpf_testmod_test_read_ctx *ctx__nullable), +TP_ARGS (ctx__nullable) +); +#undef BPF_TESTMOD_DECLARE_TRACE#ifdef DECLARE_TRACE_WRITABLE #define BPF_TESTMOD_DECLARE_TRACE (call, proto, args, size) \
tools/testing/selftests/bpf/bpf_testmod/bpf_testmod.c +2 -0
@@ -356,6 +356,8 @@ bpf_testmod_test_read(struct file *file, struct kobject *kobj,if (bpf_testmod_loop_test (101 ) >100 )trace_bpf_testmod_test_read (current, &ctx); +trace_bpf_testmod_test_nullable_bare (NULL ); +/* Magic number to enable writable tp */ if (len ==64 ) {struct bpf_testmod_test_writable_ctx writable = {
tools/testing/selftests/bpf/prog_tests/tp_btf_nullable.c new file +14 -0
@@ -0,0 +1,14 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include <test_progs.h> +#include "test_tp_btf_nullable.skel.h" + +void test_tp_btf_nullable (void ) +{ +if (!env.has_testmod) { +test__skip (); +return ; + } + +RUN_TESTS (test_tp_btf_nullable); +}
tools/testing/selftests/bpf/progs/test_tp_btf_nullable.c new file +24 -0
@@ -0,0 +1,24 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include "vmlinux.h" +#include <bpf/bpf_helpers.h> +#include <bpf/bpf_tracing.h> +#include "../bpf_testmod/bpf_testmod.h" +#include "bpf_misc.h" + +SEC("tp_btf/bpf_testmod_test_nullable_bare") +__failure __msg("R1 invalid mem access 'trusted_ptr_or_null_'") +int BPF_PROG(handle_tp_btf_nullable_bare1, struct bpf_testmod_test_read_ctx *nullable_ctx) +{ +return nullable_ctx->len; +} + +SEC("tp_btf/bpf_testmod_test_nullable_bare") +int BPF_PROG (handle_tp_btf_nullable_bare2 ,struct bpf_testmod_test_read_ctx *nullable_ctx) +{ +if (nullable_ctx) +return nullable_ctx->len; +return 0 ; +} + +char _license[] SEC("license") = "GPL";
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 315/817 bpf: Mark raw_tp arguments with PTR_MAYBE_NULL
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kumar Kartikeya Dwivedi <[email protected]>
[ Upstream commit cb4158ce8ec8a5bb528cc1693356a5eb8058094d ]
Arguments to a raw tracepoint are tagged as trusted, which carries the semantics that the pointer will be non-NULL. However, in certain cases, a raw tracepoint argument may end up being NULL. More context about this issue is available in [0].
Thus, there is a discrepancy between the reality, that raw_tp arguments can actually be NULL, and the verifier's knowledge, that they are never NULL, causing explicit NULL checks to be deleted, and accesses to such pointers potentially crashing the kernel.
To fix this, mark raw_tp arguments as PTR_MAYBE_NULL, and then special case the dereference and pointer arithmetic to permit it, and allow passing them into helpers/kfuncs; these exceptions are made for raw_tp programs only. Ensure that we don't do this when ref_obj_id > 0, as in that case this is an acquired object and doesn't need such adjustment.
The reason we do mask_raw_tp_trusted_reg logic is because other will recheck in places whether the register is a trusted_reg, and then consider our register as untrusted when detecting the presence of the PTR_MAYBE_NULL flag.
To allow safe dereference, we enable PROBE_MEM marking when we see loads into trusted pointers with PTR_MAYBE_NULL.
While trusted raw_tp arguments can also be passed into helpers or kfuncs where such broken assumption may cause issues, a future patch set will tackle their case separately, as PTR_TO_BTF_ID (without PTR_TRUSTED) can already be passed into helpers and causes similar problems. Thus, they are left alone for now.
It is possible that these checks also permit passing non-raw_tp args that are trusted PTR_TO_BTF_ID with null marking. In such a case, allowing dereference when pointer is NULL expands allowed behavior, so won't regress existing programs, and the case of passing these into helpers is the same as above and will be dealt with later.
Also update the failure case in tp_btf_nullable selftest to capture the new behavior, as the verifier will no longer cause an error when directly dereference a raw tracepoint argument marked as __nullable.
[0]: https://lore.kernel.org/bpf/[email protected]
--- include/linux/bpf.h | 6 ++ kernel/bpf/btf.c | 5 +- kernel/bpf/verifier.c | 79 +++++++++++++++++-- .../bpf/progs/test_tp_btf_nullable.c | 6 +- 4 files changed, 87 insertions(+), 9 deletions(-)
include/linux/bpf.h +6 -0
@@ -3436,4 +3436,10 @@ static inline bool bpf_is_subprog(const struct bpf_prog *prog) return prog->aux->func_idx != 0; } +static inline bool bpf_prog_is_raw_tp (const struct bpf_prog *prog) +{ +return prog->type ==BPF_PROG_TYPE_TRACING && + prog->expected_attach_type ==BPF_TRACE_RAW_TP ; +} +#endif /* _LINUX_BPF_H */
kernel/bpf/btf.c +4 -1
@@ -6534,7 +6534,10 @@ bool btf_ctx_access(int off, int size, enum bpf_access_type type,if (prog_args_trusted (prog)) info->reg_type |=PTR_TRUSTED ; -if (btf_param_match_suffix (btf, &args[arg],"__nullable" )) +/* Raw tracepoint arguments always get marked as maybe NULL */ +if (bpf_prog_is_raw_tp (prog)) + info->reg_type |=PTR_MAYBE_NULL ; +else if (btf_param_match_suffix (btf, &args[arg],"__nullable" )) info->reg_type |=PTR_MAYBE_NULL ;if (tgt_prog) {
kernel/bpf/verifier.c +72 -7
223 lines not on this page · raw message
tools/testing/selftests/bpf/progs/test_tp_btf_nullable.c +5 -1
@@ -7,7 +7,11 @@#include "bpf_misc.h" SEC ("tp_btf/bpf_testmod_test_nullable_bare" ) -__failure __msg("R1 invalid mem access 'trusted_ptr_or_null_'") +/* This used to be a failure test, but raw_tp nullable arguments can now +* directly be dereferenced, whether they have nullable annotation or not, +* and don't need to be explicitly checked. + */ +__success int BPF_PROG(handle_tp_btf_nullable_bare1, struct bpf_testmod_test_read_ctx *nullable_ctx) {return nullable_ctx->len;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 316/817 drm: use ATOMIC64_INIT() for atomic64_t
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Gray <[email protected]>
[ Upstream commit 9877bb2775d020fb7000af5ca989331d09d0e372 ]
use ATOMIC64_INIT() not ATOMIC_INIT() for atomic64_t
--- drivers/gpu/drm/drm_file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/drm_file.c +1 -1
@@ -138,7 +138,7 @@ bool drm_dev_needs_global_mutex(struct drm_device *dev)*/ struct drm_file *drm_file_alloc (struct drm_minor *minor) { -static atomic64_t ident =ATOMIC_INIT (0 ); +static atomic64_t ident =ATOMIC64_INIT (0 );struct drm_device *dev = minor->dev;struct drm_file *file;int ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 317/817 netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 9adbb4198bf6cf3634032871118a7052aeaa573f ]
On rule delete we get:
WARNING: suspicious RCU usage
net/netfilter/nf_tables_api.c:3420 RCU-list traversed in non-reader section!!
1 lock held by iptables/134:
#0: ffff888008c4fcc8 (&nft_net->commit_mutex){+.+.}-{3:3}, at: nf_tables_valid_genid (include/linux/jiffies.h:101) nf_tables
Code is fine, no other CPU can change the list because we're holding transaction mutex.
Pass the needed lockdep annotation to the iterator and fix two comments for functions that are no longer restricted to rcu-only context.
This is enough to resolve rule delete, but there are several other missing annotations, added in followup-patches.
--- net/netfilter/nf_tables_api.c | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-)
net/netfilter/nf_tables_api.c +13 -10
@@ -3410,13 +3410,15 @@ void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr)* Rules */ -static struct nft_rule *__nft_rule_lookup (const struct nft_chain *chain, +static struct nft_rule *__nft_rule_lookup (const struct net *net, +const struct nft_chain *chain,u64 handle) {struct nft_rule *rule;// FIXME: this sucks -list_for_each_entry_rcu (rule, &chain->rules, list) { +list_for_each_entry_rcu (rule, &chain->rules, list, +lockdep_commit_lock_is_held (net)) {if (handle == rule->handle)return rule; }
@@ -3424,13 +3426,14 @@ static struct nft_rule *__nft_rule_lookup(const struct nft_chain *chain,return ERR_PTR (-ENOENT ); } -static struct nft_rule *nft_rule_lookup (const struct nft_chain *chain, +static struct nft_rule *nft_rule_lookup (const struct net *net, +const struct nft_chain *chain,const struct nlattr *nla) {if (nla ==NULL )return ERR_PTR (-EINVAL ); -return __nft_rule_lookup (chain,be64_to_cpu (nla_get_be64 (nla))); +return __nft_rule_lookup (net, chain,be64_to_cpu (nla_get_be64 (nla))); }static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX +1 ] = {
@@ -3731,7 +3734,7 @@ static int nf_tables_dump_rules_done(struct netlink_callback *cb)return 0 ; } -/* called with rcu_read_lock held */ +/* Caller must hold rcu read lock or transaction mutex */ static struct sk_buff *nf_tables_getrule_single (u32 portid,const struct nfnl_info *info,const struct nlattr *const nla[],bool reset)
@@ -3758,7 +3761,7 @@ nf_tables_getrule_single(u32 portid, const struct nfnl_info *info,return ERR_CAST (chain); } - rule =nft_rule_lookup (chain, nla[NFTA_RULE_HANDLE ]); + rule =nft_rule_lookup (net, chain, nla[NFTA_RULE_HANDLE ]);if (IS_ERR (rule)) {NL_SET_BAD_ATTR (extack, nla[NFTA_RULE_HANDLE ]);return ERR_CAST (rule);
@@ -4057,7 +4060,7 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info,if (nla[NFTA_RULE_HANDLE ]) { handle =be64_to_cpu (nla_get_be64 (nla[NFTA_RULE_HANDLE ])); - rule =__nft_rule_lookup (chain, handle); + rule =__nft_rule_lookup (net, chain, handle);if (IS_ERR (rule)) {NL_SET_BAD_ATTR (extack, nla[NFTA_RULE_HANDLE ]);return PTR_ERR (rule);
@@ -4079,7 +4082,7 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info,if (nla[NFTA_RULE_POSITION ]) { pos_handle =be64_to_cpu (nla_get_be64 (nla[NFTA_RULE_POSITION ])); - old_rule =__nft_rule_lookup (chain, pos_handle); + old_rule =__nft_rule_lookup (net, chain, pos_handle);if (IS_ERR (old_rule)) {NL_SET_BAD_ATTR (extack, nla[NFTA_RULE_POSITION ]);return PTR_ERR (old_rule);
@@ -4296,7 +4299,7 @@ static int nf_tables_delrule(struct sk_buff *skb, const struct nfnl_info *info,if (chain) {if (nla[NFTA_RULE_HANDLE ]) { - rule =nft_rule_lookup (chain, nla[NFTA_RULE_HANDLE ]); + rule =nft_rule_lookup (info->net, chain, nla[NFTA_RULE_HANDLE ]);if (IS_ERR (rule)) {if (PTR_ERR (rule) == -ENOENT &&NFNL_MSG_TYPE (info->nlh->nlmsg_type) ==NFT_MSG_DESTROYRULE )
@@ -8082,7 +8085,7 @@ static int nf_tables_dump_obj_done(struct netlink_callback *cb)return 0 ; } -/* called with rcu_read_lock held */ +/* Caller must hold rcu read lock or transaction mutex */ static struct sk_buff *nf_tables_getobj_single (u32 portid,const struct nfnl_info *info,const struct nlattr *const nla[],bool reset)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 318/817 netfilter: nf_tables: must hold rcu read lock while iterating expression type list
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit ee666a541ed957937454d50afa4757924508cd74 ]
nft shell tests trigger:
WARNING: suspicious RCU usage
net/netfilter/nf_tables_api.c:3125 RCU-list traversed in non-reader section!!
1 lock held by nft/2068:
#0: ffff888106c6f8c8 (&nft_net->commit_mutex){+.+.}-{4:4}, at: nf_tables_valid_genid+0x3c/0xf0
But the transaction mutex doesn't protect this list, the nfnl subsystem mutex would, but we can't acquire it here without risk of ABBA deadlocks.
Acquire the rcu read lock to avoid this issue.
v3: add a comment that explains the ->inner_ops check implies expression is builtin and lack of a module owner reference is ok.
--- net/netfilter/nf_tables_api.c | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-)
net/netfilter/nf_tables_api.c +18 -6
@@ -3293,25 +3293,37 @@ int nft_expr_inner_parse(const struct nft_ctx *ctx, const struct nlattr *nla,if (!tb[NFTA_EXPR_DATA ] || !tb[NFTA_EXPR_NAME ])return -EINVAL ; +rcu_read_lock (); + type =__nft_expr_type_get (ctx->family, tb[NFTA_EXPR_NAME ]); -if (!type) -return -ENOENT ; +if (!type) { + err = -ENOENT ; + goto out_unlock; + } -if (!type->inner_ops) -return -EOPNOTSUPP ; +if (!type->inner_ops) { + err = -EOPNOTSUPP ; + goto out_unlock; + } err =nla_parse_nested_deprecated (info->tb, type->maxattr, tb[NFTA_EXPR_DATA ], type->policy,NULL );if (err <0 ) - goto err_nla_parse; + goto out_unlock; info->attr = nla; info->ops = type->inner_ops; +/* No module reference will be taken on type->owner. +* Presence of type->inner_ops implies that the expression +* is builtin, so it cannot go away. +*/ +rcu_read_unlock ();return 0 ; -err_nla_parse: +out_unlock: +rcu_read_unlock ();return err; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 319/817 netfilter: nf_tables: must hold rcu read lock while iterating object type list
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit cddc04275f95ca3b18da5c0fb111705ac173af89 ]
Update of stateful object triggers:
WARNING: suspicious RCU usagenet/netfilter/nf_tables_api.c:7759 RCU-list traversed in non-reader section!!
other info that might help us debug this:rcu_scheduler_active = 2, debug_locks = 1
1 lock held by nft/3060:
#0: ffff88810f0578c8 (&nft_net->commit_mutex){+.+.}-{4:4}, [..]
... but this list is not protected by the transaction mutex but the nfnl nftables subsystem mutex.
Switch to nft_obj_type_get which will acquire rcu read lock, bump refcount, and returns the result.
v3: Dan Carpenter points out nft_obj_type_get returns error pointer, not NULL, on error.
--- net/netfilter/nf_tables_api.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
net/netfilter/nf_tables_api.c +6 -7
@@ -7783,9 +7783,7 @@ static int nf_tables_updobj(const struct nft_ctx *ctx,struct nft_trans *trans;int err = -ENOMEM ; -if (!try_module_get (type->owner)) -return -ENOENT ; - +/* caller must have obtained type->owner reference. */ trans =nft_trans_alloc (ctx,NFT_MSG_NEWOBJ ,sizeof (struct nft_trans_obj ));if (!trans)
@@ -7853,15 +7851,16 @@ static int nf_tables_newobj(struct sk_buff *skb, const struct nfnl_info *info,if (info->nlh->nlmsg_flags &NLM_F_REPLACE )return -EOPNOTSUPP ; - type =__nft_obj_type_get (objtype, family); -if (WARN_ON_ONCE (!type)) -return -ENOENT ; -if (!obj->ops->update)return 0 ; + type =nft_obj_type_get (net, objtype, family); +if (WARN_ON_ONCE (IS_ERR (type))) +return PTR_ERR (type); +nft_ctx_init (&ctx, net, skb, info->nlh, family, table,NULL , nla); +/* type->owner reference is put when transaction object is released. */ return nf_tables_updobj (&ctx, type, nla[NFTA_OBJ_DATA ], obj); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 320/817 netlink: typographical error in nlmsg_type constants definition
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maurice Lambert <[email protected]>
[ Upstream commit 84bfbfbbd32aee136afea4b6bf82581dce79c305 ]
This commit fix a typographical error in netlink nlmsg_type constants definition in the include/uapi/linux/rtnetlink.h at line 177. The definition is RTM_NEWNVLAN RTM_NEWVLAN instead of RTM_NEWVLAN RTM_NEWVLAN.
--- include/uapi/linux/rtnetlink.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/uapi/linux/rtnetlink.h +1 -1
@@ -174,7 +174,7 @@ enum {#define RTM_GETLINKPROP RTM_GETLINKPROP RTM_NEWVLAN = 112, -#define RTM_NEWNVLAN RTM_NEWVLAN +#define RTM_NEWVLAN RTM_NEWVLAN RTM_DELVLAN,#define RTM_DELVLAN RTM_DELVLAN RTM_GETVLAN,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 321/817 wifi: rtw89: coex: check NULL return of kmalloc in btc_fw_set_monreg()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pei Xiao <[email protected]>
[ Upstream commit 81df5ed446b448bdc327b7c7f0b50121fc1f4aa2 ]
kmalloc may fail, return value might be NULL and will cause NULL pointer dereference. Add check NULL return of kmalloc in btc_fw_set_monreg().
--- drivers/net/wireless/realtek/rtw89/coex.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/wireless/realtek/rtw89/coex.c +4 -0
@@ -2449,6 +2449,8 @@ static void btc_fw_set_monreg(struct rtw89_dev *rtwdev)if (ver->fcxmreg ==7 ) { sz =struct_size (v7, regs, n); v7 =kmalloc (sz,GFP_KERNEL ); +if (!v7) +return ; v7->type =RPT_EN_MREG ; v7->fver = ver->fcxmreg; v7->len = n;
@@ -2463,6 +2465,8 @@ static void btc_fw_set_monreg(struct rtw89_dev *rtwdev) }else { sz =struct_size (v1, regs, n); v1 =kmalloc (sz,GFP_KERNEL ); +if (!v1) +return ; v1->fver = ver->fcxmreg; v1->reg_num = n;memcpy (v1->regs, chip->mon_reg,flex_array_size (v1, regs, n));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 322/817 drm/panfrost: Add missing OPP table refcnt decremental
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrián Larumbe <[email protected]>
[ Upstream commit 043e8afebf6c19abde9da1ac3d5cbf8b7ac8393f ]
Commit f11b0417eec2 ("drm/panfrost: Add fdinfo support GPU load metrics") retrieves the OPP for the maximum device clock frequency, but forgets to keep the reference count balanced by putting the returned OPP object. This eventually leads to an OPP core warning when removing the device.
Fix it by putting OPP objects as many times as they're retrieved.
Also remove an unnecessary whitespace.
--- drivers/gpu/drm/panfrost/panfrost_devfreq.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/panfrost/panfrost_devfreq.c +2 -1
@@ -38,7 +38,7 @@ static int panfrost_devfreq_target(struct device *dev, unsigned long *freq,return PTR_ERR (opp);dev_pm_opp_put (opp); - err =dev_pm_opp_set_rate (dev, *freq); + err =dev_pm_opp_set_rate (dev, *freq);if (!err) ptdev->pfdevfreq.current_frequency = *freq;
@@ -182,6 +182,7 @@ int panfrost_devfreq_init(struct panfrost_device *pfdev)* if any and will avoid a switch off by regulator_late_cleanup() */ ret =dev_pm_opp_set_opp (dev, opp); +dev_pm_opp_put (opp);if (ret) {DRM_DEV_ERROR (dev,"Couldn't set recommended OPP\n" );return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 323/817 drm/panthor: introduce job cycle and timestamp accounting
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrián Larumbe <[email protected]>
[ Upstream commit f8ff51a4708451763e6cfa36cc83dea8513d3318 ]
Enable calculations of job submission times in clock cycles and wall time. This is done by expanding the boilerplate command stream when running a job to include instructions that compute said times right before and after a user CS.
A separate kernel BO is created per queue to store those values. Jobs can access their sampled data through an index different from that of the queue's ringbuffer. The reason for this is saving memory on the profiling information kernel BO, since the amount of simultaneous profiled jobs we can write into the queue's ringbuffer might be much smaller than for regular jobs, as the former take more CSF instructions.
This commit is done in preparation for enabling DRM fdinfo support in the Panthor driver, which depends on the numbers calculated herein.
A profile mode mask has been added that will in a future commit allow UM to toggle performance metric sampling behaviour, which is disabled by default to save power. When a ringbuffer CS is constructed, timestamp and cycling sampling instructions are added depending on the enabled flags in the profiling mask.
A helper was provided that calculates the number of instructions for a given set of enablement mask, and these are passed as the number of credits when initialising a DRM scheduler job.
Stable-dep-of: 21c23e4b64e3 ("drm/panthor: Fix OPP refcnt leaks in devfreq initialisation")
--- drivers/gpu/drm/panthor/panthor_device.h | 22 ++ drivers/gpu/drm/panthor/panthor_sched.c | 333 +++++++++++++++++++---- 2 files changed, 306 insertions(+), 49 deletions(-)
drivers/gpu/drm/panthor/panthor_device.h +22 -0
@@ -66,6 +66,25 @@ struct panthor_irq {atomic_t suspended; }; +/** +* enum panthor_device_profiling_mode - Profiling state +*/ +enum panthor_device_profiling_flags { +/** @PANTHOR_DEVICE_PROFILING_DISABLED: Profiling is disabled. */ +PANTHOR_DEVICE_PROFILING_DISABLED =0 , + +/** @PANTHOR_DEVICE_PROFILING_CYCLES: Sampling job cycles. */ +PANTHOR_DEVICE_PROFILING_CYCLES =BIT (0 ), + +/** @PANTHOR_DEVICE_PROFILING_TIMESTAMP: Sampling job timestamp. */ +PANTHOR_DEVICE_PROFILING_TIMESTAMP =BIT (1 ), + +/** @PANTHOR_DEVICE_PROFILING_ALL: Sampling everything. */ +PANTHOR_DEVICE_PROFILING_ALL = +PANTHOR_DEVICE_PROFILING_CYCLES | +PANTHOR_DEVICE_PROFILING_TIMESTAMP , +}; +/** * struct panthor_device - Panthor device */
@@ -162,6 +181,9 @@ struct panthor_device {*/ struct page *dummy_latest_flush; } pm; + +/** @profile_mask: User-set profiling flags for job accounting. */ +u32 profile_mask; };/**
drivers/gpu/drm/panthor/panthor_sched.c +284 -49
434 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 324/817 drm/panthor: record current and maximum device clock frequencies
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrián Larumbe <[email protected]>
[ Upstream commit 37591ae11f89cdfc0a647945a589468642a44c17 ]
In order to support UM in calculating rates of GPU utilisation, the current operating and maximum GPU clock frequencies must be recorded during device initialisation, and also during OPP state transitions.
Stable-dep-of: 21c23e4b64e3 ("drm/panthor: Fix OPP refcnt leaks in devfreq initialisation")
--- drivers/gpu/drm/panthor/panthor_devfreq.c | 18 +++++++++++++++++- drivers/gpu/drm/panthor/panthor_device.h | 6 ++++++ 2 files changed, 23 insertions(+), 1 deletion(-)
drivers/gpu/drm/panthor/panthor_devfreq.c +17 -1
@@ -62,14 +62,20 @@ static void panthor_devfreq_update_utilization(struct panthor_devfreq *pdevfreq)static int panthor_devfreq_target (struct device *dev,unsigned long *freq,u32 flags) { +struct panthor_device *ptdev =dev_get_drvdata (dev);struct dev_pm_opp *opp; +int err; opp =devfreq_recommended_opp (dev, freq, flags);if (IS_ERR (opp))return PTR_ERR (opp);dev_pm_opp_put (opp); -return dev_pm_opp_set_rate (dev, *freq); + err =dev_pm_opp_set_rate (dev, *freq); +if (!err) + ptdev->current_frequency = *freq; + +return err; }static void panthor_devfreq_reset (struct panthor_devfreq *pdevfreq)
@@ -130,6 +136,7 @@ int panthor_devfreq_init(struct panthor_device *ptdev)struct panthor_devfreq *pdevfreq;struct dev_pm_opp *opp;unsigned long cur_freq; +unsigned long freq =ULONG_MAX ;int ret; pdevfreq =drmm_kzalloc (&ptdev->base,sizeof (*ptdev->devfreq),GFP_KERNEL );
@@ -161,6 +168,7 @@ int panthor_devfreq_init(struct panthor_device *ptdev)return PTR_ERR (opp); panthor_devfreq_profile.initial_freq = cur_freq; + ptdev->current_frequency = cur_freq;/* Regulator coupling only takes care of synchronizing/balancing voltage * updates, but the coupled regulator needs to be enabled manually.
@@ -204,6 +212,14 @@ int panthor_devfreq_init(struct panthor_device *ptdev)dev_pm_opp_put (opp); +/* Find the fastest defined rate */ + opp =dev_pm_opp_find_freq_floor (dev, &freq); +if (IS_ERR (opp)) +return PTR_ERR (opp); + ptdev->fast_rate = freq; + +dev_pm_opp_put (opp); +/* * Setup default thresholds for the simple_ondemand governor. * The values are chosen based on experiments.
drivers/gpu/drm/panthor/panthor_device.h +6 -0
@@ -184,6 +184,12 @@ struct panthor_device {/** @profile_mask: User-set profiling flags for job accounting. */ u32 profile_mask; + +/** @current_frequency: Device clock frequency at present. Set by DVFS*/ +unsigned long current_frequency; + +/** @fast_rate: Maximum device clock frequency. Set by DVFS */ +unsigned long fast_rate; };/**
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 325/817 drm/panthor: Fix OPP refcnt leaks in devfreq initialisation
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrián Larumbe <[email protected]>
[ Upstream commit 21c23e4b64e360d74d31b480f0572c2add0e8558 ]
Rearrange lookup of recommended OPP for the Mali GPU device and its refcnt decremental to make sure no OPP object leaks happen in the error path.
--- drivers/gpu/drm/panthor/panthor_devfreq.c | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-)
drivers/gpu/drm/panthor/panthor_devfreq.c +8 -9
@@ -163,13 +163,6 @@ int panthor_devfreq_init(struct panthor_device *ptdev) cur_freq =clk_get_rate (ptdev->clks.core); - opp =devfreq_recommended_opp (dev, &cur_freq,0 ); -if (IS_ERR (opp)) -return PTR_ERR (opp); - - panthor_devfreq_profile.initial_freq = cur_freq; - ptdev->current_frequency = cur_freq; -/* Regulator coupling only takes care of synchronizing/balancing voltage * updates, but the coupled regulator needs to be enabled manually. *
@@ -200,18 +193,24 @@ int panthor_devfreq_init(struct panthor_device *ptdev)return ret; } + opp =devfreq_recommended_opp (dev, &cur_freq,0 ); +if (IS_ERR (opp)) +return PTR_ERR (opp); + + panthor_devfreq_profile.initial_freq = cur_freq; + ptdev->current_frequency = cur_freq; +/* * Set the recommend OPP this will enable and configure the regulator * if any and will avoid a switch off by regulator_late_cleanup() */ ret =dev_pm_opp_set_opp (dev, opp); +dev_pm_opp_put (opp);if (ret) {DRM_DEV_ERROR (dev,"Couldn't set recommended OPP\n" );return ret; } -dev_pm_opp_put (opp); -/* Find the fastest defined rate */ opp =dev_pm_opp_find_freq_floor (dev, &freq);if (IS_ERR (opp))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 326/817 isofs: avoid memory leak in iocharset
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hao Ge <[email protected]>
[ Upstream commit 0b5bbeee4de616a268db77e2f40f19ab010a367b ]
A memleak was found as below:
unreferenced object 0xffff0000d10164d8 (size 8):
comm "pool-udisksd", pid 108217, jiffies 4295408555 hex dump (first 8 bytes):
75 74 66 38 00 cc cc cc utf8....
backtrace (crc de430d31):
[<ffff800081046e6c>] kmemleak_alloc+0xb8/0xc8
[<ffff8000803e6c3c>] __kmalloc_node_track_caller_noprof+0x380/0x474
[<ffff800080363b74>] kstrdup+0x70/0xfc
[<ffff80007bb3c6a4>] isofs_parse_param+0x228/0x2c0 [isofs]
[<ffff8000804d7f68>] vfs_parse_fs_param+0xf4/0x164
[<ffff8000804d8064>] vfs_parse_fs_string+0x8c/0xd4
[<ffff8000804d815c>] vfs_parse_monolithic_sep+0xb0/0xfc
[<ffff8000804d81d8>] generic_parse_monolithic+0x30/0x3c
[<ffff8000804d8bfc>] parse_monolithic_mount_data+0x40/0x4c
[<ffff8000804b6a64>] path_mount+0x6c4/0x9ec
[<ffff8000804b6e38>] do_mount+0xac/0xc4
[<ffff8000804b7494>] __arm64_sys_mount+0x16c/0x2b0
[<ffff80008002b8dc>] invoke_syscall+0x7c/0x104
[<ffff80008002ba44>] el0_svc_common.constprop.1+0xe0/0x104
[<ffff80008002ba94>] do_el0_svc+0x2c/0x38
[<ffff800081041108>] el0_svc+0x3c/0x1b8The opt->iocharset is freed inside the isofs_fill_super function, But there may be situations where it's not possible to enter this function.
For example, in the get_tree_bdev_flags function,when encountering the situation where "Can't mount, would change RO state," In such a case, isofs_fill_super will not have the opportunity to be called,which means that opt->iocharset will not have the chance to be freed,ultimately leading to a memory leak.
Let's move the memory freeing of opt->iocharset into isofs_free_fc function.
--- fs/isofs/inode.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
fs/isofs/inode.c +4 -4
@@ -948,8 +948,6 @@ static int isofs_fill_super(struct super_block *s, struct fs_context *fc) goto out_no_inode; } -kfree (opt->iocharset); -return 0 ;/*
@@ -987,7 +985,6 @@ static int isofs_fill_super(struct super_block *s, struct fs_context *fc)brelse (bh);brelse (pri_bh); out_freesbi: -kfree (opt->iocharset);kfree (sbi); s->s_fs_info =NULL ;return error;
@@ -1528,7 +1525,10 @@ static int isofs_get_tree(struct fs_context *fc)static void isofs_free_fc (struct fs_context *fc) { -kfree (fc->fs_private); +struct isofs_options *opt = fc->fs_private; + +kfree (opt->iocharset); +kfree (opt); }static const struct fs_context_operations isofs_context_ops = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 327/817 selftests/bpf: Add txmsg_pass to pull/push/pop in test_sockmap
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijian Zhang <[email protected]>
[ Upstream commit 66c54c20408d994be34be2c070fba08472f69eee ]
Add txmsg_pass to test_txmsg_pull/push/pop. If txmsg_pass is missing, tx_prog will be NULL, and no program will be attached to the sockmap. As a result, pull/push/pop are never invoked.
--- tools/testing/selftests/bpf/test_sockmap.c | 7 +++++++ 1 file changed, 7 insertions(+)
tools/testing/selftests/bpf/test_sockmap.c +7 -0
@@ -1596,11 +1596,13 @@ static void test_txmsg_cork_hangs(int cgrp, struct sockmap_options *opt)static void test_txmsg_pull (int cgrp,struct sockmap_options *opt) {/* Test basic start/end */ + txmsg_pass =1 ; txmsg_start =1 ; txmsg_end =2 ;test_send (opt, cgrp);/* Test >4k pull */ + txmsg_pass =1 ; txmsg_start =4096 ; txmsg_end =9182 ;test_send_large (opt, cgrp);
@@ -1629,11 +1631,13 @@ static void test_txmsg_pull(int cgrp, struct sockmap_options *opt)static void test_txmsg_pop (int cgrp,struct sockmap_options *opt) {/* Test basic pop */ + txmsg_pass =1 ; txmsg_start_pop =1 ; txmsg_pop =2 ;test_send_many (opt, cgrp);/* Test pop with >4k */ + txmsg_pass =1 ; txmsg_start_pop =4096 ; txmsg_pop =4096 ;test_send_large (opt, cgrp);
@@ -1662,11 +1666,13 @@ static void test_txmsg_pop(int cgrp, struct sockmap_options *opt)static void test_txmsg_push (int cgrp,struct sockmap_options *opt) {/* Test basic push */ + txmsg_pass =1 ; txmsg_start_push =1 ; txmsg_end_push =1 ;test_send (opt, cgrp);/* Test push 4kB >4k */ + txmsg_pass =1 ; txmsg_start_push =4096 ; txmsg_end_push =4096 ;test_send_large (opt, cgrp);
@@ -1687,6 +1693,7 @@ static void test_txmsg_push(int cgrp, struct sockmap_options *opt)static void test_txmsg_push_pop (int cgrp,struct sockmap_options *opt) { + txmsg_pass =1 ; txmsg_start_push =1 ; txmsg_end_push =10 ; txmsg_start_pop =5 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 328/817 selftests/bpf: Fix SENDPAGE data logic in test_sockmap
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijian Zhang <[email protected]>
[ Upstream commit 4095031463d4e99b534d2cd82035a417295764ae ]
In the SENDPAGE test, "opt->iov_length * cnt" size of data will be sent cnt times by sendfile.
1. In push/pop tests, they will be invoked cnt times, for the simplicity of msg_verify_data, change chunk_sz to iov_length
2. Change iov_length in test_send_large from 1024 to 8192. We have pop test where txmsg_start_pop is 4096. 4096 > 1024, an error will be returned.
--- tools/testing/selftests/bpf/test_sockmap.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-)
tools/testing/selftests/bpf/test_sockmap.c +11 -7
@@ -420,16 +420,18 @@ static int msg_loop_sendpage(int fd, int iov_length, int cnt, {bool drop = opt->drop_expected;unsigned char k =0 ; +int i, j, fp;FILE *file; -int i, fp; file =tmpfile ();if (!file) {perror ("create file for sendpage" );return 1 ; } -for (i =0 ; i < iov_length * cnt; i++, k++) -fwrite (&k,sizeof (char ),1 , file); +for (i =0 ; i < cnt; i++, k =0 ) { +for (j =0 ; j < iov_length; j++, k++) +fwrite (&k,sizeof (char ),1 , file); + }fflush (file);fseek (file,0 ,SEEK_SET );
@@ -623,7 +625,9 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt,* This is really only useful for testing edge cases in code * paths. */ - total_bytes = (float )iov_count * (float )iov_length * (float )cnt; + total_bytes = (float )iov_length * (float )cnt; +if (!opt->sendpage) + total_bytes *= (float )iov_count;if (txmsg_apply) txmsg_pop_total = txmsg_pop * (total_bytes / txmsg_apply);else
@@ -701,7 +705,7 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt,if (data) {int chunk_sz = opt->sendpage ? - iov_length * cnt : + iov_length : iov_length * iov_count; errno =msg_verify_data (&msg, recv, chunk_sz, &k, &bytes_cnt);
@@ -1466,8 +1470,8 @@ static void test_send_many(struct sockmap_options *opt, int cgrp)static void test_send_large (struct sockmap_options *opt,int cgrp) { - opt->iov_length =256 ; - opt->iov_count =1024 ; + opt->iov_length =8192 ; + opt->iov_count =32 ; opt->rate =2 ;test_exec (cgrp, opt); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 329/817 selftests/bpf: Fix total_bytes in msg_loop_rx in test_sockmap
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijian Zhang <[email protected]>
[ Upstream commit 523dffccbadea0cfd65f1ff04944b864c558c4a8 ]
total_bytes in msg_loop_rx should also take push into account, otherwise total_bytes will be a smaller value, which makes the msg_loop_rx end early.
Besides, total_bytes has already taken pop into account, so we don't need to subtract some bytes from iov_buf in sendmsg_test. The additional subtraction may make total_bytes a negative number, and msg_loop_rx will just end without checking anything.
--- tools/testing/selftests/bpf/test_sockmap.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
tools/testing/selftests/bpf/test_sockmap.c +7 -5
@@ -606,8 +606,8 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt, }clock_gettime (CLOCK_MONOTONIC , &s->end); }else { +float total_bytes, txmsg_pop_total, txmsg_push_total;int slct, recvp =0 , recv, max_fd = fd; -float total_bytes, txmsg_pop_total;int fd_flags =O_NONBLOCK ;struct timeval timeout;unsigned char k =0 ;
@@ -628,10 +628,14 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt, total_bytes = (float )iov_length * (float )cnt;if (!opt->sendpage) total_bytes *= (float )iov_count; -if (txmsg_apply) +if (txmsg_apply) { + txmsg_push_total = txmsg_end_push * (total_bytes / txmsg_apply); txmsg_pop_total = txmsg_pop * (total_bytes / txmsg_apply); -else + }else { + txmsg_push_total = txmsg_end_push * cnt; txmsg_pop_total = txmsg_pop * cnt; + } + total_bytes += txmsg_push_total; total_bytes -= txmsg_pop_total; err =clock_gettime (CLOCK_MONOTONIC , &s->start);if (err <0 )
@@ -800,8 +804,6 @@ static int sendmsg_test(struct sockmap_options *opt) rxpid =fork ();if (rxpid ==0 ) { -if (txmsg_pop || txmsg_start_pop) - iov_buf -= (txmsg_pop - txmsg_start_pop +1 );if (opt->drop_expected || txmsg_ktls_skb_drop)_exit (0 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 330/817 selftests/bpf: Add push/pop checking for msg_verify_data in test_sockmap
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijian Zhang <[email protected]>
[ Upstream commit 862087c3d36219ed44569666eb263efc97f00c9a ]
Add push/pop checking for msg_verify_data in test_sockmap, except for pop/push with cork tests, in these tests the logic will be different.
1. With corking, pop/push might not be invoked in each sendmsg, it makes the layout of the received data difficult
2. It makes it hard to calculate the total_bytes in the recvmsg Temporarily skip the data integrity test for these cases now, added a TODO
--- tools/testing/selftests/bpf/test_sockmap.c | 106 ++++++++++++++++++++- 1 file changed, 101 insertions(+), 5 deletions(-)
tools/testing/selftests/bpf/test_sockmap.c +101 -5
@@ -88,6 +88,10 @@ int ktls;int peek_flag;int skb_use_parser;int txmsg_omit_skb_parser; +int verify_push_start; +int verify_push_len; +int verify_pop_start; +int verify_pop_len;static const struct option long_options[] = { {"help" , no_argument,NULL ,'h' },
@@ -514,12 +518,41 @@ static int msg_alloc_iov(struct msghdr *msg,return -ENOMEM ; } -/* TODO: Add verification logic for push, pull and pop data */ +/* In push or pop test, we need to do some calculations for msg_verify_data */ +static void msg_verify_date_prep (void ) +{ +int push_range_end = txmsg_start_push + txmsg_end_push -1 ; +int pop_range_end = txmsg_start_pop + txmsg_pop -1 ; + +if (txmsg_end_push && txmsg_pop && + txmsg_start_push <= pop_range_end && txmsg_start_pop <= push_range_end) { +/* The push range and the pop range overlap */ +int overlap_len; + + verify_push_start = txmsg_start_push; + verify_pop_start = txmsg_start_pop; +if (txmsg_start_push < txmsg_start_pop) + overlap_len =min (push_range_end - txmsg_start_pop +1 , txmsg_pop); +else + overlap_len =min (pop_range_end - txmsg_start_push +1 , txmsg_end_push); + verify_push_len =max (txmsg_end_push - overlap_len,0 ); + verify_pop_len =max (txmsg_pop - overlap_len,0 ); + }else { +/* Otherwise */ + verify_push_start = txmsg_start_push; + verify_pop_start = txmsg_start_pop; + verify_push_len = txmsg_end_push; + verify_pop_len = txmsg_pop; + } +} +static int msg_verify_data (struct msghdr *msg,int size,int chunk_sz, -unsigned char *k_p,int *bytes_cnt_p) +unsigned char *k_p,int *bytes_cnt_p, +int *check_cnt_p,int *push_p) { -int i, j, bytes_cnt = *bytes_cnt_p; +int bytes_cnt = *bytes_cnt_p, check_cnt = *check_cnt_p, push = *push_p;unsigned char k = *k_p; +int i, j;for (i =0 , j =0 ; i < msg->msg_iovlen && size; i++, j =0 ) {unsigned char *d = msg->msg_iov[i].iov_base;
@@ -538,6 +571,37 @@ static int msg_verify_data(struct msghdr *msg, int size, int chunk_sz, }for (; j < msg->msg_iov[i].iov_len && size; j++) { +if (push >0 && + check_cnt == verify_push_start + verify_push_len - push) { +int skipped; +revisit_push: + skipped = push; +if (j + push >= msg->msg_iov[i].iov_len) + skipped = msg->msg_iov[i].iov_len - j; + push -= skipped; + size -= skipped; + j += skipped -1 ; + check_cnt += skipped; +continue ; + } + +if (verify_pop_len >0 && check_cnt == verify_pop_start) { + bytes_cnt += verify_pop_len; + check_cnt += verify_pop_len; + k += verify_pop_len; + +if (bytes_cnt == chunk_sz) { + k =0 ; + bytes_cnt =0 ; + check_cnt =0 ; + push = verify_push_len; + } + +if (push >0 && + check_cnt == verify_push_start + verify_push_len - push) + goto revisit_push; + } +if (d[j] != k++) { fprintf(stderr, "detected data corruption @iov[%i]:%i %02x != %02x, %02x ?= %02x\n",
@@ -545,15 +609,20 @@ static int msg_verify_data(struct msghdr *msg, int size, int chunk_sz,return -EDATAINTEGRITY ; } bytes_cnt++; + check_cnt++;if (bytes_cnt == chunk_sz) { k =0 ; bytes_cnt =0 ; + check_cnt =0 ; + push = verify_push_len; } size--; } } *k_p = k; *bytes_cnt_p = bytes_cnt; + *check_cnt_p = check_cnt; + *push_p = push;return 0 ; }
@@ -612,6 +681,8 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt,struct timeval timeout;unsigned char k =0 ;int bytes_cnt =0 ; +int check_cnt =0 ; +int push =0 ;fd_set w;fcntl (fd, fd_flags);
@@ -637,6 +708,10 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt, } total_bytes += txmsg_push_total; total_bytes -= txmsg_pop_total; +if (data) { +msg_verify_date_prep (); + push = verify_push_len; + } err =clock_gettime (CLOCK_MONOTONIC , &s->start);if (err <0 )perror ("recv start time" );
@@ -712,7 +787,8 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt, iov_length :iov_length * iov_count; - errno =msg_verify_data (&msg, recv, chunk_sz, &k, &bytes_cnt); + errno =msg_verify_data (&msg, recv, chunk_sz, &k, &bytes_cnt, + &check_cnt, &push);if (errno) {perror ("data verify msg failed" ); goto out_errno;
@@ -722,7 +798,9 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt, recvp, chunk_sz, &k, - &bytes_cnt); + &bytes_cnt, + &check_cnt, + &push);if (errno) {perror ("data verify msg_peek failed" ); goto out_errno;
@@ -1636,6 +1714,8 @@ static void test_txmsg_pull(int cgrp, struct sockmap_options *opt)static void test_txmsg_pop (int cgrp,struct sockmap_options *opt) { +bool data = opt->data_test; +/* Test basic pop */ txmsg_pass =1 ; txmsg_start_pop =1 ;
@@ -1654,6 +1734,12 @@ static void test_txmsg_pop(int cgrp, struct sockmap_options *opt) txmsg_pop =2 ;test_send_many (opt, cgrp); +/* TODO: Test for pop + cork should be different, +* - It makes the layout of the received data difficult +* - It makes it hard to calculate the total_bytes in the recvmsg +* Temporarily skip the data integrity test for this case now. +*/ + opt->data_test = false;/* Test pop + cork */ txmsg_redir =0 ; txmsg_cork =512 ;
@@ -1667,10 +1753,13 @@ static void test_txmsg_pop(int cgrp, struct sockmap_options *opt) txmsg_start_pop =1 ; txmsg_pop =2 ;test_send_many (opt, cgrp); + opt->data_test = data; }static void test_txmsg_push (int cgrp,struct sockmap_options *opt) { +bool data = opt->data_test; +/* Test basic push */ txmsg_pass =1 ; txmsg_start_push =1 ;
@@ -1689,12 +1778,19 @@ static void test_txmsg_push(int cgrp, struct sockmap_options *opt) txmsg_end_push =2 ;test_send_many (opt, cgrp); +/* TODO: Test for push + cork should be different, +* - It makes the layout of the received data difficult +* - It makes it hard to calculate the total_bytes in the recvmsg +* Temporarily skip the data integrity test for this case now. +*/ + opt->data_test = false;/* Test push + cork */ txmsg_redir =0 ; txmsg_cork =512 ; txmsg_start_push =1 ; txmsg_end_push =2 ;test_send_many (opt, cgrp); + opt->data_test = data; }static void test_txmsg_push_pop (int cgrp,struct sockmap_options *opt)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 331/817 bpf, sockmap: Several fixes to bpf_msg_push_data
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijian Zhang <[email protected]>
[ Upstream commit 15ab0548e3107665c34579ae523b2b6e7c22082a ]
Several fixes to bpf_msg_push_data,
1. test_sockmap has tests where bpf_msg_push_data is invoked to push some data at the end of a message, but -EINVAL is returned. In this case, in bpf_msg_push_data, after the first loop, i will be set to msg->sg.end, add the logic to handle it.
2. In the code block of "if (start - offset)", it's possible that "i" points to the last of sk_msg_elem. In this case, "sk_msg_iter_next(msg, end)" might still be called twice, another invoking is in "if (!copy)" code block, but actually only one is needed. Add the logic to handle it, and reconstruct the code to make the logic more clear.
--- net/core/filter.c | 53 +++++++++++++++++++++++++++++------------------ 1 file changed, 33 insertions(+), 20 deletions(-)
net/core/filter.c +33 -20
@@ -2794,7 +2794,7 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_msg *, msg, u32, start,sk_msg_iter_var_next (i); }while (i != msg->sg.end); -if (start >= offset + l) +if (start > offset + l)return -EINVAL ; space =MAX_MSG_FRAGS -sk_msg_elem_used (msg);
@@ -2819,6 +2819,8 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_msg *, msg, u32, start, raw =page_address (page); +if (i == msg->sg.end) +sk_msg_iter_var_prev (i); psge =sk_msg_elem (msg, i); front = start - offset; back = psge->length - front;
@@ -2835,7 +2837,13 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_msg *, msg, u32, start, }put_page (sg_page (psge)); - }else if (start - offset) { + new = i; + goto place_new; + } + +if (start - offset) { +if (i == msg->sg.end) +sk_msg_iter_var_prev (i); psge =sk_msg_elem (msg, i); rsge =sk_msg_elem_cpy (msg, i);
@@ -2846,39 +2854,44 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_msg *, msg, u32, start,sk_msg_iter_var_next (i);sg_unmark_end (psge);sg_unmark_end (&rsge); -sk_msg_iter_next (msg, end); }/* Slot(s) to place newly allocated data */ +sk_msg_iter_next (msg, end); new = i; +sk_msg_iter_var_next (i); + +if (i == msg->sg.end) { +if (!rsge.length) + goto place_new; +sk_msg_iter_next (msg, end); + goto place_new; + }/* Shift one or two slots as needed */ -if (!copy) { - sge =sk_msg_elem_cpy (msg, i); + sge =sk_msg_elem_cpy (msg, new); +sg_unmark_end (&sge); + nsge =sk_msg_elem_cpy (msg, i); +if (rsge.length) {sk_msg_iter_var_next (i); -sg_unmark_end (&sge); + nnsge =sk_msg_elem_cpy (msg, i);sk_msg_iter_next (msg, end); + } - nsge =sk_msg_elem_cpy (msg, i); +while (i != msg->sg.end) { + msg->sg.data[i] = sge; + sge = nsge; +sk_msg_iter_var_next (i);if (rsge.length) { -sk_msg_iter_var_next (i); + nsge = nnsge; nnsge =sk_msg_elem_cpy (msg, i); - } - -while (i != msg->sg.end) { - msg->sg.data[i] = sge; - sge = nsge; -sk_msg_iter_var_next (i); -if (rsge.length) { - nsge = nnsge; - nnsge =sk_msg_elem_cpy (msg, i); - }else { - nsge =sk_msg_elem_cpy (msg, i); - } + }else { + nsge =sk_msg_elem_cpy (msg, i); } } +place_new:/* Place newly allocated data buffer */ sk_mem_charge (msg->sk, len); msg->sg.size += len;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 332/817 bpf, sockmap: Several fixes to bpf_msg_pop_data
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijian Zhang <[email protected]>
[ Upstream commit 5d609ba262475db450ba69b8e8a557bd768ac07a ]
Several fixes to bpf_msg_pop_data,
1. In sk_msg_shift_left, we should put_page
2. if (len == 0), return early is better
3. pop the entire sk_msg (last == msg->sg.size) should be supported
4. Fix for the value of variable "a"
5. In sk_msg_shift_left, after shifting, i has already pointed to the next element. Addtional sk_msg_iter_var_next may result in BUG.
--- net/core/filter.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
net/core/filter.c +9 -6
@@ -2920,8 +2920,10 @@ static const struct bpf_func_proto bpf_msg_push_data_proto = {static void sk_msg_shift_left (struct sk_msg *msg,int i) { +struct scatterlist *sge =sk_msg_elem (msg, i);int prev; +put_page (sg_page (sge)); do { prev = i; sk_msg_iter_var_next(i);
@@ -2958,6 +2960,9 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start,if (unlikely (flags))return -EINVAL ; +if (unlikely (len ==0 )) +return 0 ; +/* First find the starting scatterlist element */ i = msg->sg.start; do {
@@ -2970,7 +2975,7 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start, }while (i != msg->sg.end);/* Bounds checks: start and pop must be inside message */ -if (start >= offset + l || last >= msg->sg.size) +if (start >= offset + l || last > msg->sg.size)return -EINVAL ; space =MAX_MSG_FRAGS -sk_msg_elem_used (msg);
@@ -2999,12 +3004,12 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start,*/ if (start != offset) {struct scatterlist *nsge, *sge =sk_msg_elem (msg, i); -int a = start; +int a = start - offset;int b = sge->length - pop - a;sk_msg_iter_var_next (i); -if (pop < sge->length - a) { +if (b >0 ) {if (space) { sge->length = a;sk_msg_shift_right (msg, i);
@@ -3023,7 +3028,6 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start,if (unlikely (!page))return -ENOMEM ; - sge->length = a; orig =sg_page (sge); from =sg_virt (sge); to =page_address (page);
@@ -3033,7 +3037,7 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start,put_page (orig); } pop =0 ; - }else if (pop >= sge->length - a) { + }else { pop -= (sge->length - a); sge->length = a; }
@@ -3067,7 +3071,6 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start, pop -= sge->length;sk_msg_shift_left (msg, i); } -sk_msg_iter_var_next (i); }sk_mem_uncharge (msg->sk, len - pop);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 333/817 bpf, sockmap: Fix sk_msg_reset_curr
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijian Zhang <[email protected]>
[ Upstream commit 955afd57dc4bf7e8c620a0a9e3af3c881c2c6dff ]
Found in the test_txmsg_pull in test_sockmap,
``` txmsg_cork = 512; // corking is importrant here opt->iov_length = 3; opt->iov_count = 1; opt->rate = 512; // sendmsg will be invoked 512 times ```
The first sendmsg will send an sk_msg with size 3, and bpf_msg_pull_data will be invoked the first time. sk_msg_reset_curr will reset the copybreak from 3 to 0. In the second sendmsg, since we are in the stage of corking, psock->cork will be reused in func sk_msg_alloc. msg->sg.copybreak is 0 now, the second msg will overwrite the first msg. As a result, we could not pass the data integrity test.
The same problem happens in push and pop test. Thus, fix sk_msg_reset_curr to restore the correct copybreak.
--- net/core/filter.c | 20 +++++++++----------- 1 file changed, 9 insertions(+), 11 deletions(-)
net/core/filter.c +9 -11
@@ -2620,18 +2620,16 @@ BPF_CALL_2(bpf_msg_cork_bytes, struct sk_msg *, msg, u32, bytes)static void sk_msg_reset_curr (struct sk_msg *msg) { -u32 i = msg->sg.start; -u32 len =0 ; - -do { - len +=sk_msg_elem (msg, i)->length; -sk_msg_iter_var_next (i); -if (len >= msg->sg.size) -break ; - }while (i != msg->sg.end); +if (!msg->sg.size) { + msg->sg.curr = msg->sg.start; + msg->sg.copybreak =0 ; + }else { +u32 i = msg->sg.end; - msg->sg.curr = i; - msg->sg.copybreak =0 ; +sk_msg_iter_var_prev (i); + msg->sg.curr = i; + msg->sg.copybreak = msg->sg.data[i].length; + } }static const struct bpf_func_proto bpf_msg_cork_bytes_proto = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 334/817 ipv6: release nexthop on device removal
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
[ Upstream commit eb02688c5c45c3e7af7e71f036a7144f5639cbfe ]
The CI is hitting some aperiodic hangup at device removal time in the pmtu.sh self-test:
unregister_netdevice: waiting for veth_A-R1 to become free. Usage count = 6ref_tracker: veth_A-R1@ffff888013df15d8 has 1/5 users at
dst_init+0x84/0x4a0 dst_alloc+0x97/0x150 ip6_dst_alloc+0x23/0x90 ip6_rt_pcpu_alloc+0x1e6/0x520 ip6_pol_route+0x56f/0x840 fib6_rule_lookup+0x334/0x630 ip6_route_output_flags+0x259/0x480 ip6_dst_lookup_tail.constprop.0+0x5c2/0x940 ip6_dst_lookup_flow+0x88/0x190 udp_tunnel6_dst_lookup+0x2a7/0x4c0 vxlan_xmit_one+0xbde/0x4a50 [vxlan] vxlan_xmit+0x9ad/0xf20 [vxlan] dev_hard_start_xmit+0x10e/0x360 __dev_queue_xmit+0xf95/0x18c0 arp_solicit+0x4a2/0xe00 neigh_probe+0xaa/0xf0
While the first suspect is the dst_cache, explicitly tracking the dst owing the last device reference via probes proved such dst is held by the nexthop in the originating fib6_info.
Similar to commit f5b51fe804ec ("ipv6: route: purge exception on removal"), we need to explicitly release the originating fib info when disconnecting a to-be-removed device from a live ipv6 dst: move the fib6_info cleanup into ip6_dst_ifdown().
Tested running:
./pmtu.sh cleanup_ipv6_exception
in a tight loop for more than 400 iterations with no spat, running an unpatched kernel I observed a splat every ~10 iterations.
--- net/ipv6/route.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/ipv6/route.c +3 -3
@@ -374,6 +374,7 @@ static void ip6_dst_ifdown(struct dst_entry *dst, struct net_device *dev) {struct rt6_info *rt =dst_rt6_info (dst);struct inet6_dev *idev = rt->rt6i_idev; +struct fib6_info *from;if (idev && idev->dev != blackhole_netdev) {struct inet6_dev *blackhole_idev =in6_dev_get (blackhole_netdev);
@@ -383,6 +384,8 @@ static void ip6_dst_ifdown(struct dst_entry *dst, struct net_device *dev)in6_dev_put (idev); } } + from =unrcu_pointer (xchg (&rt->from,NULL )); +fib6_info_release (from); }static bool __rt6_check_expired (const struct rt6_info *rt)
@@ -1455,7 +1458,6 @@ static DEFINE_SPINLOCK(rt6_exception_lock);static void rt6_remove_exception (struct rt6_exception_bucket *bucket,struct rt6_exception *rt6_ex) { -struct fib6_info *from;struct net *net;if (!bucket || !rt6_ex)
@@ -1467,8 +1469,6 @@ static void rt6_remove_exception(struct rt6_exception_bucket *bucket,/* purge completely the exception to allow releasing the held resources: * some [sk] cache may keep the dst around for unlimited time */ - from =unrcu_pointer (xchg (&rt6_ex->rt6i->from,NULL )); -fib6_info_release (from);dst_dev_put (&rt6_ex->rt6i->dst);hlist_del_rcu (&rt6_ex->hlist);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 335/817 selftests: net: really check for bg process completion
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
[ Upstream commit 52ed077aa6336dbef83a2d6d21c52d1706fb7f16 ]
A recent refactor transformed the check for process completion in a true statement, due to a typo.
As a result, the relevant test-case is unable to catch the regression it was supposed to detect.
Restore the correct condition.
--- tools/testing/selftests/net/pmtu.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/net/pmtu.sh +1 -1
@@ -2062,7 +2062,7 @@ check_running() { pid=${1} cmd=${2} - [ "$(cat /proc/${pid}/cmdline 2>/dev/null | tr -d '\0')" = "{cmd}" ] + [ "$(cat /proc/${pid}/cmdline 2>/dev/null | tr -d '\0')" = "${cmd}" ] } test_cleanup_vxlanX_exception() {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 336/817 wifi: cfg80211: Remove the Medium Synchronization Delay validity check
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lingbo Kong <[email protected]>
[ Upstream commit b4ebb58cb9a4b1b5cb5278b09d6afdcd71b2a6b4 ]
Currently, when the driver attempts to connect to an AP MLD with multiple APs, the cfg80211_mlme_check_mlo_compat() function requires the Medium Synchronization Delay values from different APs of the same AP MLD to be equal, which may result in connection failures.
This is because when the driver receives a multi-link probe response from an AP MLD with multiple APs, cfg80211 updates the Elements for each AP based on the multi-link probe response. If the Medium Synchronization Delay is set in the multi-link probe response, the Elements for each AP belonging to the same AP MLD will have the Medium Synchronization Delay set simultaneously. If non-multi-link probe responses are received from different APs of the same MLD AP, cfg80211 will still update the Elements based on the non-multi-link probe response. Since the non-multi-link probe response does not set the Medium Synchronization Delay
(IEEE 802.11be-2024-35.3.4.4), if the Elements from a non-multi-link probe response overwrite those from a multi-link probe response that has set the Medium Synchronization Delay, the Medium Synchronization Delay values for APs belonging to the same AP MLD will not be equal. This discrepancy causes the cfg80211_mlme_check_mlo_compat() function to fail, leading to connection failures. Commit ccb964b4ab16
("wifi: cfg80211: validate MLO connections better") did not take this into account.
To address this issue, remove this validity check.
--- net/wireless/mlme.c | 6 ------ 1 file changed, 6 deletions(-)
net/wireless/mlme.c +0 -6
@@ -340,12 +340,6 @@ cfg80211_mlme_check_mlo_compat(const struct ieee80211_multi_link_elem *mle_a,return -EINVAL ; } -if (ieee80211_mle_get_eml_med_sync_delay ((const u8 *)mle_a) != -ieee80211_mle_get_eml_med_sync_delay ((const u8 *)mle_b)) { -NL_SET_ERR_MSG (extack,"link EML medium sync delay mismatch" ); -return -EINVAL ; - } -if (ieee80211_mle_get_eml_cap ((const u8 *)mle_a) !=ieee80211_mle_get_eml_cap ((const u8 *)mle_b)) {NL_SET_ERR_MSG (extack,"link EML capabilities mismatch" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 337/817 wifi: iwlwifi: allow fast resume on ax200
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
[ Upstream commit e53ebc72054efca12e0329d69342e3daf7250a5a ]
This feature can be used on ax200 as well. It'll avoid to restart the firmware upon suspend / resume flow. Doing so also avoids releasing and re-allocating all the device related memory which makes the memory's subsystem task easier.
Stable-dep-of: d1a54ec21b8e ("wifi: iwlwifi: mvm: tell iwlmei when we finished suspending")
--- drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +1 -1
@@ -1376,7 +1376,7 @@ void __iwl_mvm_mac_stop(struct iwl_mvm *mvm, bool suspend)iwl_mvm_rm_aux_sta (mvm);if (suspend && - mvm->trans->trans_cfg->device_family >=IWL_DEVICE_FAMILY_AX210 ) + mvm->trans->trans_cfg->device_family >=IWL_DEVICE_FAMILY_22000 )iwl_mvm_fast_suspend (mvm);else iwl_mvm_stop_device (mvm);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 338/817 wifi: iwlwifi: mvm: tell iwlmei when we finished suspending
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
[ Upstream commit d1a54ec21b8e7bca59141ff1ac6ce73e07d744f2 ]
Since we no longer shut down the device in suspend, we also no longer call iwl_mvm_mei_device_state() and this is a problem because iwlmei expects this to be called when it runs its own suspend sequence. It checks mei->device_down in iwl_mei_remove() which is called upon suspend.
Fix this by telling iwlmei when we're done accessing the device. When we'll wake up, the device should be untouched if CSME didn't use it during the suspend time. If CSME used it, we'll notice it through the CSR_FUNC_SCRATCH register.
--- drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +6 -2
@@ -1236,6 +1236,7 @@ int __iwl_mvm_mac_start(struct iwl_mvm *mvm) fast_resume = mvm->fast_resume;if (fast_resume) { +iwl_mvm_mei_device_state (mvm, true); ret =iwl_mvm_fast_resume (mvm);if (ret) {iwl_mvm_stop_device (mvm);
@@ -1376,10 +1377,13 @@ void __iwl_mvm_mac_stop(struct iwl_mvm *mvm, bool suspend)iwl_mvm_rm_aux_sta (mvm);if (suspend && - mvm->trans->trans_cfg->device_family >=IWL_DEVICE_FAMILY_22000 ) + mvm->trans->trans_cfg->device_family >=IWL_DEVICE_FAMILY_22000 ) {iwl_mvm_fast_suspend (mvm); -else +/* From this point on, we won't touch the device */ +iwl_mvm_mei_device_state (mvm, false); + }else {iwl_mvm_stop_device (mvm); + }iwl_mvm_async_handlers_purge (mvm);/* async_handlers_list is empty and will stay empty: HW is stopped */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 339/817 drm/amdgpu: fix ACA bank count boundary check error
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Wang <[email protected]>
[ Upstream commit 2bb7dced1c2f8c0e705cc74840f776406db492c3 ]
fix ACA bank count boundary check error.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c +1 -1
@@ -158,7 +158,7 @@ static int aca_smu_get_valid_aca_banks(struct amdgpu_device *adev, enum aca_smu_return -EINVAL ; } -if (start + count >= max_count) +if (start + count > max_count)return -EINVAL ; count =min_t (int, count, max_count);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 340/817 drm/amdgpu: Fix map/unmap queue logic
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lijo Lazar <[email protected]>
[ Upstream commit fa31798582882740f2b13d19e1bd43b4ef918e2f ]
In current logic, it calls ring_alloc followed by a ring_test. ring_test in turn will call another ring_alloc. This is illegal usage as a ring_alloc is expected to be closed properly with a ring_commit. Change to commit the map/unmap queue packet first followed by a ring_test. Add a comment about the usage of ring_test.
Also, reorder the current pre-condition checks of job hang or kiq ring scheduler not ready. Without them being met, it is not useful to attempt ring or memory allocations.
Fixes tag refers to the original patch which introduced this issue which then got carried over into newer code.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 13 ++++- drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 63 +++++++++++++++------- drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 7 +++ 3 files changed, 63 insertions(+), 20 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c +11 -2
@@ -850,6 +850,9 @@ int amdgpu_amdkfd_unmap_hiq(struct amdgpu_device *adev, u32 doorbell_off,if (!kiq->pmf || !kiq->pmf->kiq_unmap_queues)return -EINVAL ; +if (!kiq_ring->sched.ready || adev->job_hang) +return 0 ; + ring_funcs =kzalloc (sizeof (*ring_funcs),GFP_KERNEL );if (!ring_funcs)return -ENOMEM ;
@@ -874,8 +877,14 @@ int amdgpu_amdkfd_unmap_hiq(struct amdgpu_device *adev, u32 doorbell_off, kiq->pmf->kiq_unmap_queues (kiq_ring, ring,RESET_QUEUES ,0 ,0 ); -if (kiq_ring->sched.ready && !adev->job_hang) - r =amdgpu_ring_test_helper (kiq_ring); +/* Submit unmap queue packet */ +amdgpu_ring_commit (kiq_ring); +/* +* Ring test will do a basic scratch register change check. Just run +* this to ensure that unmap queues that is submitted before got +* processed successfully before returning. +*/ + r =amdgpu_ring_test_helper (kiq_ring);spin_unlock (&kiq->ring_lock);
drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c +45 -18
104 lines not on this page · raw message
drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c +7 -0
@@ -4823,6 +4823,13 @@ static int gfx_v8_0_kcq_disable(struct amdgpu_device *adev)amdgpu_ring_write (kiq_ring,0 );amdgpu_ring_write (kiq_ring,0 ); } +/* Submit unmap queue packet */ +amdgpu_ring_commit (kiq_ring); +/* +* Ring test will do a basic scratch register change check. Just run +* this to ensure that unmap queues that is submitted before got +* processed successfully before returning. +*/ r =amdgpu_ring_test_helper (kiq_ring);if (r)DRM_ERROR ("KCQ disable failed\n" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 341/817 drm/amdkfd: Fix wrong usage of INIT_WORK()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuan Can <[email protected]>
[ Upstream commit 21cae8debc6a1d243f64fa82cd1b41cb612b5c61 ]
In kfd_procfs_show(), the sdma_activity_work_handler is a local variable and the sdma_activity_work_handler.sdma_activity_work should initialize with INIT_WORK_ONSTACK() instead of INIT_WORK().
--- drivers/gpu/drm/amd/amdkfd/kfd_process.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdkfd/kfd_process.c +3 -2
@@ -312,8 +312,8 @@ static ssize_t kfd_procfs_show(struct kobject *kobj, struct attribute *attr, attr_sdma);struct kfd_sdma_activity_handler_workarea sdma_activity_work_handler; -INIT_WORK (&sdma_activity_work_handler.sdma_activity_work, - kfd_sdma_activity_worker); +INIT_WORK_ONSTACK (&sdma_activity_work_handler.sdma_activity_work, + kfd_sdma_activity_worker); sdma_activity_work_handler.pdd = pdd; sdma_activity_work_handler.sdma_activity_counter =0 ;
@@ -321,6 +321,7 @@ static ssize_t kfd_procfs_show(struct kobject *kobj, struct attribute *attr,schedule_work (&sdma_activity_work_handler.sdma_activity_work);flush_work (&sdma_activity_work_handler.sdma_activity_work); +destroy_work_on_stack (&sdma_activity_work_handler.sdma_activity_work); return snprintf(buffer, PAGE_SIZE, "%llu\n", (sdma_activity_work_handler.sdma_activity_counter)/
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 342/817 bpf: Allow return values 0 and 1 for kprobe session
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Olsa <[email protected]>
[ Upstream commit 17c4b65a24938c6dd79496cce5df15f70d9c253c ]
The kprobe session program can return only 0 or 1, instruct verifier to check for that.
--- kernel/bpf/verifier.c | 9 +++++++++ 1 file changed, 9 insertions(+)
kernel/bpf/verifier.c +9 -0
@@ -15798,6 +15798,15 @@ static int check_return_code(struct bpf_verifier_env *env, int regno, const charreturn -ENOTSUPP ; }break ; +case BPF_PROG_TYPE_KPROBE : +switch (env->prog->expected_attach_type) { +case BPF_TRACE_KPROBE_SESSION : + range =retval_range (0 ,1 ); +break ; +default : +return 0 ; + } +break ;case BPF_PROG_TYPE_SK_LOOKUP : range =retval_range (SK_DROP ,SK_PASS );break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 343/817 bpf: Force uprobe bpf program to always return 0
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Olsa <[email protected]>
[ Upstream commit f505005bc7426f4309880da94cfbfc37efa225bd ]
As suggested by Andrii make uprobe multi bpf programs to always return 0, so they can't force uprobe removal.
Keeping the int return type for uprobe_prog_run, because it will be used in following session changes.
--- kernel/trace/bpf_trace.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
kernel/trace/bpf_trace.c +2 -3
@@ -3294,7 +3294,6 @@ static int uprobe_prog_run(struct bpf_uprobe *uprobe,struct bpf_prog *prog = link->link.prog;bool sleepable = prog->sleepable;struct bpf_run_ctx *old_run_ctx; -int err =0 ;if (link->task && current->mm != link->task->mm)return 0 ;
@@ -3307,7 +3306,7 @@ static int uprobe_prog_run(struct bpf_uprobe *uprobe,migrate_disable (); old_run_ctx =bpf_set_run_ctx (&run_ctx.run_ctx); - err =bpf_prog_run (link->link.prog, regs); +bpf_prog_run (link->link.prog, regs);bpf_reset_run_ctx (old_run_ctx);migrate_enable ();
@@ -3316,7 +3315,7 @@ static int uprobe_prog_run(struct bpf_uprobe *uprobe,rcu_read_unlock_trace (); elsercu_read_unlock (); -return err; +return 0 ; } static bool
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 344/817 selftests/bpf: skip the timer_lockup test for single-CPU nodes
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viktor Malik <[email protected]>
[ Upstream commit 937a1c29a287e8f48c4cea714c76a13e14d989ac ]
The timer_lockup test needs 2 CPUs to work, on single-CPU nodes it fails to set thread affinity to CPU 1 since it doesn't exist:
# ./test_progs -t timer_lockup
test_timer_lockup:PASS:timer_lockup__open_and_load 0 nsec
test_timer_lockup:PASS:pthread_create thread1 0 nsec
test_timer_lockup:PASS:pthread_create thread2 0 nsec
timer_lockup_thread:PASS:cpu affinity 0 nsec
timer_lockup_thread:FAIL:cpu affinity unexpected error: 22 (errno 0)
test_timer_lockup:PASS: 0 nsec
#406 timer_lockup:FAILSkip the test if only 1 CPU is available.
--- tools/testing/selftests/bpf/prog_tests/timer_lockup.c | 6 ++++++ 1 file changed, 6 insertions(+)
tools/testing/selftests/bpf/prog_tests/timer_lockup.c +6 -0
@@ -5,6 +5,7 @@#include <test_progs.h> #include <pthread.h> #include <network_helpers.h> +#include <sys/sysinfo.h> #include "timer_lockup.skel.h"
@@ -52,6 +53,11 @@ void test_timer_lockup(void)pthread_t thrds[2 ];void *ret; +if (get_nprocs () <2 ) { +test__skip (); +return ; + } + skel =timer_lockup__open_and_load ();if (!ASSERT_OK_PTR (skel,"timer_lockup__open_and_load" ))return ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 345/817 ipv6: Fix soft lockups in fib6_select_path under high next hop churn
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Omid Ehtemam-Haghighi <[email protected]>
[ Upstream commit d9ccb18f83ea2bb654289b6ecf014fd267cc988b ]
Soft lockups have been observed on a cluster of Linux-based edge routers located in a highly dynamic environment. Using the bird service, these routers continuously update BGP-advertised routes due to frequently changing nexthop destinations, while also managing significant IPv6 traffic. The lockups occur during the traversal of the multipath circular linked-list in the fib6_select_path function, particularly while iterating through the siblings in the list. The issue typically arises when the nodes of the linked list are unexpectedly deleted concurrently on a different core—indicated by their 'next' and 'previous' elements pointing back to the node itself and their reference count dropping to zero. This results in an infinite loop, leading to a soft lockup that triggers a system panic via the watchdog timer.
Apply RCU primitives in the problematic code sections to resolve the issue. Where necessary, update the references to fib6_siblings to annotate or use the RCU APIs.
Include a test script that reproduces the issue. The script periodically updates the routing table while generating a heavy load of outgoing IPv6 traffic through multiple iperf3 clients. It consistently induces infinite soft lockups within a couple of minutes.
Kernel log:
0 [ffffbd13003e8d30] machine_kexec at ffffffff8ceaf3eb
1 [ffffbd13003e8d90] __crash_kexec at ffffffff8d0120e3
2 [ffffbd13003e8e58] panic at ffffffff8cef65d4
3 [ffffbd13003e8ed8] watchdog_timer_fn at ffffffff8d05cb03
4 [ffffbd13003e8f08] __hrtimer_run_queues at ffffffff8cfec62f 5 [ffffbd13003e8f70] hrtimer_interrupt at ffffffff8cfed756
6 [ffffbd13003e8fd0] __sysvec_apic_timer_interrupt at ffffffff8cea01af 7 [ffffbd13003e8ff0] sysvec_apic_timer_interrupt at ffffffff8df1b83d
-- <IRQ stack> --
8 [ffffbd13003d3708] asm_sysvec_apic_timer_interrupt at ffffffff8e000ecb
[exception RIP: fib6_select_path+299]
RIP: ffffffff8ddafe7b RSP: ffffbd13003d37b8 RFLAGS: 00000287
RAX: ffff975850b43600 RBX: ffff975850b40200 RCX: 0000000000000000
RDX: 000000003fffffff RSI: 0000000051d383e4 RDI: ffff975850b43618
RBP: ffffbd13003d3800 R8: 0000000000000000 R9: ffff975850b40200
R10: 0000000000000000 R11: 0000000000000000 R12: ffffbd13003d3830
R13: ffff975850b436a8 R14: ffff975850b43600 R15: 0000000000000007
ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 9 [ffffbd13003d3808] ip6_pol_route at ffffffff8ddb030c
10 [ffffbd13003d3888] ip6_pol_route_input at ffffffff8ddb068c 11 [ffffbd13003d3898] fib6_rule_lookup at ffffffff8ddf02b5
12 [ffffbd13003d3928] ip6_route_input at ffffffff8ddb0f47
13 [ffffbd13003d3a18] ip6_rcv_finish_core.constprop.0 at ffffffff8dd950d0 14 [ffffbd13003d3a30] ip6_list_rcv_finish.constprop.0 at ffffffff8dd96274 15 [ffffbd13003d3a98] ip6_sublist_rcv at ffffffff8dd96474
16 [ffffbd13003d3af8] ipv6_list_rcv at ffffffff8dd96615
17 [ffffbd13003d3b60] __netif_receive_skb_list_core at ffffffff8dc16fec 18 [ffffbd13003d3be0] netif_receive_skb_list_internal at ffffffff8dc176b3 19 [ffffbd13003d3c50] napi_gro_receive at ffffffff8dc565b9
20 [ffffbd13003d3c80] ice_receive_skb at ffffffffc087e4f5 [ice] 21 [ffffbd13003d3c90] ice_clean_rx_irq at ffffffffc0881b80 [ice] 22 [ffffbd13003d3d20] ice_napi_poll at ffffffffc088232f [ice] 23 [ffffbd13003d3d80] __napi_poll at ffffffff8dc18000
24 [ffffbd13003d3db8] net_rx_action at ffffffff8dc18581
25 [ffffbd13003d3e40] __do_softirq at ffffffff8df352e9
26 [ffffbd13003d3eb0] run_ksoftirqd at ffffffff8ceffe47
27 [ffffbd13003d3ec0] smpboot_thread_fn at ffffffff8cf36a30 28 [ffffbd13003d3ee8] kthread at ffffffff8cf2b39f
29 [ffffbd13003d3f28] ret_from_fork at ffffffff8ce5fa64
30 [ffffbd13003d3f50] ret_from_fork_asm at ffffffff8ce03cbb
--- net/ipv6/ip6_fib.c | 8 +- net/ipv6/route.c | 45 ++- tools/testing/selftests/net/Makefile | 1 + .../net/ipv6_route_update_soft_lockup.sh | 262 ++++++++++++++++++ 4 files changed, 297 insertions(+), 19 deletions(-) create mode 100755 tools/testing/selftests/net/ipv6_route_update_soft_lockup.sh
net/ipv6/ip6_fib.c +4 -4
@@ -1190,8 +1190,8 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt,while (sibling) {if (sibling->fib6_metric == rt->fib6_metric &&rt6_qualify_for_ecmp (sibling)) { -list_add_tail (&rt->fib6_siblings, - &sibling->fib6_siblings); +list_add_tail_rcu (&rt->fib6_siblings, + &sibling->fib6_siblings);break ; } sibling = rcu_dereference_protected(sibling->fib6_next,
@@ -1252,7 +1252,7 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt, fib6_siblings) sibling->fib6_nsiblings--; rt->fib6_nsiblings =0 ; -list_del_init (&rt->fib6_siblings); +list_del_rcu (&rt->fib6_siblings);rt6_multipath_rebalance (next_sibling);return err; }
@@ -1970,7 +1970,7 @@ static void fib6_del_route(struct fib6_table *table, struct fib6_node *fn, &rt->fib6_siblings, fib6_siblings) sibling->fib6_nsiblings--; rt->fib6_nsiblings =0 ; -list_del_init (&rt->fib6_siblings); +list_del_rcu (&rt->fib6_siblings);rt6_multipath_rebalance (next_sibling); }
net/ipv6/route.c +30 -15
112 lines not on this page · raw message
tools/testing/selftests/net/Makefile +1 -0
@@ -95,6 +95,7 @@ TEST_PROGS += fdb_flush.sh TEST_PROGS += fq_band_pktlimit.sh TEST_PROGS += vlan_hw_filter.sh TEST_PROGS += bpf_offload.py +TEST_PROGS += ipv6_route_update_soft_lockup.sh TEST_FILES := settings TEST_FILES += in_netns.sh lib.sh net_helper.sh setup_loopback.sh setup_veth.sh
tools/testing/selftests/net/ipv6_route_update_soft_lockup.sh new file +262 -0
262 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 346/817 net: rfkill: gpio: Add check for clk_enable()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mingwei Zheng <[email protected]>
[ Upstream commit 8251e7621b25ccdb689f1dd9553b8789e3745ea1 ]
Add check for the return value of clk_enable() to catch the potential error.
--- net/rfkill/rfkill-gpio.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
net/rfkill/rfkill-gpio.c +6 -2
@@ -31,8 +31,12 @@ static int rfkill_gpio_set_power(void *data, bool blocked) {struct rfkill_gpio_data *rfkill = data; -if (!blocked && !IS_ERR (rfkill->clk) && !rfkill->clk_enabled) -clk_enable (rfkill->clk); +if (!blocked && !IS_ERR (rfkill->clk) && !rfkill->clk_enabled) { +int ret =clk_enable (rfkill->clk); + +if (ret) +return ret; + }gpiod_set_value_cansleep (rfkill->shutdown_gpio, !blocked);gpiod_set_value_cansleep (rfkill->reset_gpio, !blocked);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 347/817 Revert "wifi: iwlegacy: do not skip frames with bad FCS"
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kalle Valo <[email protected]>
[ Upstream commit 11597043d74809daf5d14256b96d6781749b3f82 ]
This reverts commit 02b682d54598f61cbb7dbb14d98ec1801112b878.
Alf reports that this commit causes the connection to eventually die on iwl4965. The reason is that rx_status.flag is zeroed after RX_FLAG_FAILED_FCS_CRC is set and mac80211 doesn't know the received frame is corrupted.
--- drivers/net/wireless/intel/iwlegacy/3945.c | 2 +- drivers/net/wireless/intel/iwlegacy/4965-mac.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/intel/iwlegacy/3945.c +1 -1
@@ -566,7 +566,7 @@ il3945_hdl_rx(struct il_priv *il, struct il_rx_buf *rxb)if (!(rx_end->status &RX_RES_STATUS_NO_CRC32_ERROR ) || !(rx_end->status &RX_RES_STATUS_NO_RXE_OVERFLOW )) {D_RX ("Bad CRC or FIFO: 0x%08X.\n" , rx_end->status); - rx_status.flag |=RX_FLAG_FAILED_FCS_CRC ; +return ; }/* Convert 3945's rssi indicator to dBm */
drivers/net/wireless/intel/iwlegacy/4965-mac.c +1 -1
@@ -664,7 +664,7 @@ il4965_hdl_rx(struct il_priv *il, struct il_rx_buf *rxb)if (!(rx_pkt_status &RX_RES_STATUS_NO_CRC32_ERROR ) || !(rx_pkt_status &RX_RES_STATUS_NO_RXE_OVERFLOW )) {D_RX ("Bad CRC or FIFO: 0x%08X.\n" ,le32_to_cpu (rx_pkt_status)); - rx_status.flag |=RX_FLAG_FAILED_FCS_CRC ; +return ; }/* This will be used in several places later */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 348/817 bpf: Use function pointers count as struct_ops links count
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Kuohai <[email protected]>
[ Upstream commit 821a3fa32bbe3bc0fa23b3189325d3720a49a24c ]
Only function pointers in a struct_ops structure can be linked to bpf progs, so set the links count to the function pointers count, instead of the total members count in the structure.
Stable-dep-of: 7c8ce4ffb684 ("bpf: Add kernel symbol for struct_ops trampoline")
--- kernel/bpf/bpf_struct_ops.c | 35 +++++++++++++++++++++++++---------- 1 file changed, 25 insertions(+), 10 deletions(-)
kernel/bpf/bpf_struct_ops.c +25 -10
@@ -32,7 +32,7 @@ struct bpf_struct_ops_map {* (in kvalue.data). */ struct bpf_link **links; -u32 links_cnt; +u32 funcs_cnt;u32 image_pages_cnt;/* image_pages is an array of pages that has all the trampolines * that stores the func args before calling the bpf_prog.
@@ -481,11 +481,11 @@ static void bpf_struct_ops_map_put_progs(struct bpf_struct_ops_map *st_map) {u32 i; -for (i =0 ; i < st_map->links_cnt; i++) { -if (st_map->links[i]) { -bpf_link_put (st_map->links[i]); - st_map->links[i] =NULL ; - } +for (i =0 ; i < st_map->funcs_cnt; i++) { +if (!st_map->links[i]) +break ; +bpf_link_put (st_map->links[i]); + st_map->links[i] =NULL ; } }
@@ -601,6 +601,7 @@ static long bpf_struct_ops_map_update_elem(struct bpf_map *map, void *key,int prog_fd, err;u32 i, trampoline_start, image_off =0 ;void *cur_image =NULL , *image =NULL ; +struct bpf_link **plink;if (flags)return -EINVAL ;
@@ -639,6 +640,7 @@ static long bpf_struct_ops_map_update_elem(struct bpf_map *map, void *key, udata = &uvalue->data; kdata = &kvalue->data; + plink = st_map->links; module_type =btf_type_by_id (btf_vmlinux, st_ops_ids[IDX_MODULE_ID ]);for_each_member (i, t, member) {const struct btf_type *mtype, *ptype;
@@ -714,7 +716,7 @@ static long bpf_struct_ops_map_update_elem(struct bpf_map *map, void *key, }bpf_link_init (&link->link,BPF_LINK_TYPE_STRUCT_OPS , &bpf_struct_ops_link_lops, prog); - st_map->links[i] = &link->link; + *plink++ = &link->link; trampoline_start = image_off; err = bpf_struct_ops_prepare_trampoline(tlinks, link,
@@ -895,6 +897,19 @@ static int bpf_struct_ops_map_alloc_check(union bpf_attr *attr)return 0 ; } +static u32 count_func_ptrs (const struct btf *btf,const struct btf_type *t) +{ +int i; +u32 count; +const struct btf_member *member; + + count =0 ; +for_each_member (i, t, member) +if (btf_type_resolve_func_ptr (btf, member->type,NULL )) + count++; +return count; +} +static struct bpf_map *bpf_struct_ops_map_alloc (union bpf_attr *attr) {const struct bpf_struct_ops_desc *st_ops_desc;
@@ -961,9 +976,9 @@ static struct bpf_map *bpf_struct_ops_map_alloc(union bpf_attr *attr) map = &st_map->map; st_map->uvalue =bpf_map_area_alloc (vt->size,NUMA_NO_NODE ); - st_map->links_cnt =btf_type_vlen (t); + st_map->funcs_cnt =count_func_ptrs (btf, t); st_map->links = -bpf_map_area_alloc (st_map->links_cnt *sizeof (struct bpf_links *), +bpf_map_area_alloc (st_map->funcs_cnt *sizeof (struct bpf_link *),NUMA_NO_NODE );if (!st_map->uvalue || !st_map->links) { ret = -ENOMEM ;
@@ -994,7 +1009,7 @@ static u64 bpf_struct_ops_map_mem_usage(const struct bpf_map *map) usage =sizeof (*st_map) + vt->size -sizeof (struct bpf_struct_ops_value ); usage += vt->size; - usage +=btf_type_vlen (vt) *sizeof (struct bpf_links *); + usage += st_map->funcs_cnt *sizeof (struct bpf_link *); usage +=PAGE_SIZE ;return usage; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 349/817 bpf: Add kernel symbol for struct_ops trampoline
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Kuohai <[email protected]>
[ Upstream commit 7c8ce4ffb684676039b1ff9ff81c126794e8d88e ]
Without kernel symbols for struct_ops trampoline, the unwinder may produce unexpected stacktraces.
For example, the x86 ORC and FP unwinders check if an IP is in kernel text by verifying the presence of the IP's kernel symbol. When a struct_ops trampoline address is encountered, the unwinder stops due to the absence of symbol, resulting in an incomplete stacktrace that consists only of direct and indirect child functions called from the trampoline.
The arm64 unwinder is another example. While the arm64 unwinder can proceed across a struct_ops trampoline address, the corresponding symbol name is displayed as "unknown", which is confusing.
Thus, add kernel symbol for struct_ops trampoline. The name is bpf__<struct_ops_name>_<member_name>, where <struct_ops_name> is the type name of the struct_ops, and <member_name> is the name of the member that the trampoline is linked to.
Below is a comparison of stacktraces captured on x86 by perf record, before and after this patch.
Before:ffffffff8116545d __lock_acquire+0xad ([kernel.kallsyms]) ffffffff81167fcc lock_acquire+0xcc ([kernel.kallsyms]) ffffffff813088f4 __bpf_prog_enter+0x34 ([kernel.kallsyms])
After:ffffffff811656bd __lock_acquire+0x30d ([kernel.kallsyms]) ffffffff81167fcc lock_acquire+0xcc ([kernel.kallsyms]) ffffffff81309024 __bpf_prog_enter+0x34 ([kernel.kallsyms]) ffffffffc000d7e9 bpf__tcp_congestion_ops_cong_avoid+0x3e ([kernel.kallsyms]) ffffffff81f250a5 tcp_ack+0x10d5 ([kernel.kallsyms]) ffffffff81f27c66 tcp_rcv_established+0x3b6 ([kernel.kallsyms]) ffffffff81f3ad03 tcp_v4_do_rcv+0x193 ([kernel.kallsyms]) ffffffff81d65a18 __release_sock+0xd8 ([kernel.kallsyms]) ffffffff81d65af4 release_sock+0x34 ([kernel.kallsyms]) ffffffff81f15c4b tcp_sendmsg+0x3b ([kernel.kallsyms]) ffffffff81f663d7 inet_sendmsg+0x47 ([kernel.kallsyms]) ffffffff81d5ab40 sock_write_iter+0x160 ([kernel.kallsyms]) ffffffff8149c67b vfs_write+0x3fb ([kernel.kallsyms]) ffffffff8149caf6 ksys_write+0xc6 ([kernel.kallsyms]) ffffffff8149cb5d __x64_sys_write+0x1d ([kernel.kallsyms]) ffffffff81009200 x64_sys_call+0x1d30 ([kernel.kallsyms]) ffffffff82232d28 do_syscall_64+0x68 ([kernel.kallsyms]) ffffffff8240012f entry_SYSCALL_64_after_hwframe+0x76 ([kernel.kallsyms])
--- include/linux/bpf.h | 3 +- kernel/bpf/bpf_struct_ops.c | 79 ++++++++++++++++++++++++++++++++++++- kernel/bpf/dispatcher.c | 3 +- kernel/bpf/trampoline.c | 9 ++++- 4 files changed, 89 insertions(+), 5 deletions(-)
include/linux/bpf.h +2 -1
@@ -1365,7 +1365,8 @@ int arch_prepare_bpf_dispatcher(void *image, void *buf, s64 *funcs, int num_funcvoid bpf_dispatcher_change_prog (struct bpf_dispatcher *d,struct bpf_prog *from,struct bpf_prog *to);/* Called only from JIT-enabled code, so there's no need for stubs. */ -void bpf_image_ksym_add (void *data,unsigned int size,struct bpf_ksym *ksym); +void bpf_image_ksym_init (void *data,unsigned int size,struct bpf_ksym *ksym); +void bpf_image_ksym_add (struct bpf_ksym *ksym);void bpf_image_ksym_del (struct bpf_ksym *ksym);void bpf_ksym_add (struct bpf_ksym *ksym);void bpf_ksym_del (struct bpf_ksym *ksym);
kernel/bpf/bpf_struct_ops.c +78 -1
160 lines not on this page · raw message
kernel/bpf/dispatcher.c +2 -1
@@ -154,7 +154,8 @@ void bpf_dispatcher_change_prog(struct bpf_dispatcher *d, struct bpf_prog *from, d->image =NULL ; goto out; } -bpf_image_ksym_add (d->image,PAGE_SIZE , &d->ksym); +bpf_image_ksym_init (d->image,PAGE_SIZE , &d->ksym); +bpf_image_ksym_add (&d->ksym); } prev_num_progs = d->num_progs;
kernel/bpf/trampoline.c +7 -2
@@ -115,10 +115,14 @@ bool bpf_prog_has_trampoline(const struct bpf_prog *prog) (ptype ==BPF_PROG_TYPE_LSM && eatype ==BPF_LSM_MAC ); } -void bpf_image_ksym_add (void *data,unsigned int size,struct bpf_ksym *ksym) +void bpf_image_ksym_init (void *data,unsigned int size,struct bpf_ksym *ksym) { ksym->start = (unsigned long ) data; ksym->end = ksym->start + size; +} + +void bpf_image_ksym_add (struct bpf_ksym *ksym) +{bpf_ksym_add (ksym);perf_event_ksymbol (PERF_RECORD_KSYMBOL_TYPE_BPF , ksym->start,PAGE_SIZE , false, ksym->name);
@@ -377,7 +381,8 @@ static struct bpf_tramp_image *bpf_tramp_image_alloc(u64 key, int size) ksym = &im->ksym;INIT_LIST_HEAD_RCU (&ksym->lnode);snprintf (ksym->name,KSYM_NAME_LEN ,"bpf_trampoline_%llu" , key); -bpf_image_ksym_add (image, size, ksym); +bpf_image_ksym_init (image, size, ksym); +bpf_image_ksym_add (ksym);return im; out_free_image:
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 350/817 ALSA: usx2y: Use snd_card_free_when_closed() at disconnection
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit dafb28f02be407e07a6f679e922a626592b481b0 ]
The USB disconnect callback is supposed to be short and not too-long waiting. OTOH, the current code uses snd_card_free() at disconnection, but this waits for the close of all used fds, hence it can take long. It eventually blocks the upper layer USB ioctls, which may trigger a soft lockup.
An easy workaround is to replace snd_card_free() with snd_card_free_when_closed(). This variant returns immediately while the release of resources is done asynchronously by the card device release at the last close.
--- sound/usb/usx2y/usbusx2y.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/usb/usx2y/usbusx2y.c +1 -1
@@ -423,7 +423,7 @@ static void snd_usx2y_disconnect(struct usb_interface *intf) }if (usx2y->us428ctls_sharedmem)wake_up (&usx2y->us428ctls_wait_queue_head); -snd_card_free (card); +snd_card_free_when_closed (card); } static int snd_usx2y_probe(struct usb_interface *intf,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 351/817 ALSA: us122l: Use snd_card_free_when_closed() at disconnection
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit b7df09bb348016943f56b09dcaafe221e3f73947 ]
The USB disconnect callback is supposed to be short and not too-long waiting. OTOH, the current code uses snd_card_free() at disconnection, but this waits for the close of all used fds, hence it can take long. It eventually blocks the upper layer USB ioctls, which may trigger a soft lockup.
An easy workaround is to replace snd_card_free() with snd_card_free_when_closed(). This variant returns immediately while the release of resources is done asynchronously by the card device release at the last close.
The loop of us122l->mmap_count check is dropped as well. The check is useless for the asynchronous operation with *_when_closed().
--- sound/usb/usx2y/us122l.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
sound/usb/usx2y/us122l.c +1 -4
@@ -617,10 +617,7 @@ static void snd_us122l_disconnect(struct usb_interface *intf)usb_put_intf (usb_ifnum_to_if (us122l->dev,1 ));usb_put_dev (us122l->dev); -while (atomic_read (&us122l->mmap_count)) -msleep (500 ); - -snd_card_free (card); +snd_card_free_when_closed (card); }static int snd_us122l_suspend (struct usb_interface *intf,pm_message_t message)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 352/817 ALSA: caiaq: Use snd_card_free_when_closed() at disconnection
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit b04dcbb7f7b1908806b7dc22671cdbe78ff2b82c ]
The USB disconnect callback is supposed to be short and not too-long waiting. OTOH, the current code uses snd_card_free() at disconnection, but this waits for the close of all used fds, hence it can take long. It eventually blocks the upper layer USB ioctls, which may trigger a soft lockup.
An easy workaround is to replace snd_card_free() with snd_card_free_when_closed(). This variant returns immediately while the release of resources is done asynchronously by the card device release at the last close.
This patch also splits the code to the disconnect and the free phases; the former is called immediately at the USB disconnect callback while the latter is called from the card destructor.
--- sound/usb/caiaq/audio.c | 10 ++++++++-- sound/usb/caiaq/audio.h | 1 + sound/usb/caiaq/device.c | 19 +++++++++++++++---- sound/usb/caiaq/input.c | 12 +++++++++--- sound/usb/caiaq/input.h | 1 + 5 files changed, 34 insertions(+), 9 deletions(-)
sound/usb/caiaq/audio.c +8 -2
@@ -869,14 +869,20 @@ int snd_usb_caiaq_audio_init(struct snd_usb_caiaqdev *cdev)return 0 ; } -void snd_usb_caiaq_audio_free (struct snd_usb_caiaqdev *cdev) +void snd_usb_caiaq_audio_disconnect (struct snd_usb_caiaqdev *cdev) {struct device *dev =caiaqdev_to_dev (cdev);dev_dbg (dev,"%s(%p)\n" , __func__, cdev);stream_stop (cdev); +} + +void snd_usb_caiaq_audio_free (struct snd_usb_caiaqdev *cdev) +{ +struct device *dev =caiaqdev_to_dev (cdev); + +dev_dbg (dev,"%s(%p)\n" , __func__, cdev);free_urbs (cdev->data_urbs_in);free_urbs (cdev->data_urbs_out);kfree (cdev->data_cb_info); } -
sound/usb/caiaq/audio.h +1 -0
@@ -3,6 +3,7 @@#define CAIAQ_AUDIO_H int snd_usb_caiaq_audio_init (struct snd_usb_caiaqdev *cdev); +void snd_usb_caiaq_audio_disconnect (struct snd_usb_caiaqdev *cdev);void snd_usb_caiaq_audio_free (struct snd_usb_caiaqdev *cdev);#endif /* CAIAQ_AUDIO_H */
sound/usb/caiaq/device.c +15 -4
@@ -376,6 +376,17 @@ static void setup_card(struct snd_usb_caiaqdev *cdev)dev_err (dev,"Unable to set up control system (ret=%d)\n" , ret); } +static void card_free (struct snd_card *card) +{ +struct snd_usb_caiaqdev *cdev =caiaqdev (card); + +#ifdef CONFIG_SND_USB_CAIAQ_INPUT +snd_usb_caiaq_input_free (cdev); +#endif +snd_usb_caiaq_audio_free (cdev); +usb_reset_device (cdev->chip.dev); +} +static int create_card (struct usb_device *usb_dev,struct usb_interface *intf,struct snd_card **cardp)
@@ -489,6 +500,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev) cdev->vendor_name, cdev->product_name, usbpath);setup_card (cdev); + card->private_free = card_free;return 0 ; err_kill_urb:
@@ -534,15 +546,14 @@ static void snd_disconnect(struct usb_interface *intf)snd_card_disconnect (card);#ifdef CONFIG_SND_USB_CAIAQ_INPUT -snd_usb_caiaq_input_free (cdev); +snd_usb_caiaq_input_disconnect (cdev);#endif -snd_usb_caiaq_audio_free (cdev); +snd_usb_caiaq_audio_disconnect (cdev);usb_kill_urb (&cdev->ep1_in_urb);usb_kill_urb (&cdev->midi_out_urb); -snd_card_free (card); -usb_reset_device (interface_to_usbdev (intf)); +snd_card_free_when_closed (card); }
sound/usb/caiaq/input.c +9 -3
@@ -829,15 +829,21 @@ int snd_usb_caiaq_input_init(struct snd_usb_caiaqdev *cdev)return ret; } -void snd_usb_caiaq_input_free (struct snd_usb_caiaqdev *cdev) +void snd_usb_caiaq_input_disconnect (struct snd_usb_caiaqdev *cdev) {if (!cdev || !cdev->input_dev)return ;usb_kill_urb (cdev->ep4_in_urb); +input_unregister_device (cdev->input_dev); +} + +void snd_usb_caiaq_input_free (struct snd_usb_caiaqdev *cdev) +{ +if (!cdev || !cdev->input_dev) +return ; +usb_free_urb (cdev->ep4_in_urb); cdev->ep4_in_urb =NULL ; - -input_unregister_device (cdev->input_dev); cdev->input_dev =NULL ; }
sound/usb/caiaq/input.h +1 -0
@@ -4,6 +4,7 @@void snd_usb_caiaq_input_dispatch (struct snd_usb_caiaqdev *cdev,char *buf,unsigned int len);int snd_usb_caiaq_input_init (struct snd_usb_caiaqdev *cdev); +void snd_usb_caiaq_input_disconnect (struct snd_usb_caiaqdev *cdev);void snd_usb_caiaq_input_free (struct snd_usb_caiaqdev *cdev);#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 353/817 ALSA: 6fire: Release resources at card release
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit a0810c3d6dd2d29a9b92604d682eacd2902ce947 ]
The current 6fire code tries to release the resources right after the call of usb6fire_chip_abort(). But at this moment, the card object might be still in use (as we're calling snd_card_free_when_closed()).
For avoid potential UAFs, move the release of resources to the card's private_free instead of the manual call of usb6fire_chip_destroy() at the USB disconnect callback.
--- sound/usb/6fire/chip.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
sound/usb/6fire/chip.c +5 -5
@@ -61,8 +61,10 @@ static void usb6fire_chip_abort(struct sfire_chip *chip) } } -static void usb6fire_chip_destroy (struct sfire_chip *chip) +static void usb6fire_card_free (struct snd_card *card) { +struct sfire_chip *chip = card->private_data; +if (chip) {if (chip->pcm)usb6fire_pcm_destroy (chip);
@@ -72,8 +74,6 @@ static void usb6fire_chip_destroy(struct sfire_chip *chip)usb6fire_comm_destroy (chip);if (chip->control)usb6fire_control_destroy (chip); -if (chip->card) -snd_card_free (chip->card); } }
@@ -136,6 +136,7 @@ static int usb6fire_chip_probe(struct usb_interface *intf, chip->regidx = regidx; chip->intf_count =1 ; chip->card = card; + card->private_free = usb6fire_card_free; ret =usb6fire_comm_init (chip);if (ret <0 )
@@ -162,7 +163,7 @@ static int usb6fire_chip_probe(struct usb_interface *intf,return 0 ; destroy_chip: -usb6fire_chip_destroy (chip); +snd_card_free (card);return ret; }
@@ -181,7 +182,6 @@ static void usb6fire_chip_disconnect(struct usb_interface *intf) chip->shutdown = true;usb6fire_chip_abort (chip); -usb6fire_chip_destroy (chip); } } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 354/817 i2c: dev: Fix memory leak when underlying adapter does not support I2C
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Igor Pylypiv <[email protected]>
[ Upstream commit 48730a9d04ffccda541602d722d1ff81920a85d8 ]
Early return in i2cdev_ioctl_rdwr() failed to free the memory allocated by the caller. Move freeing the memory to the function where it has been allocated to prevent similar leaks in the future.
--- drivers/i2c/i2c-dev.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-)
drivers/i2c/i2c-dev.c +9 -8
@@ -251,10 +251,8 @@ static noinline int i2cdev_ioctl_rdwr(struct i2c_client *client,return -EOPNOTSUPP ; data_ptrs =kmalloc_array (nmsgs,sizeof (u8 __user *),GFP_KERNEL ); -if (data_ptrs ==NULL ) { -kfree (msgs); +if (!data_ptrs)return -ENOMEM ; - } res =0 ;for (i =0 ; i < nmsgs; i++) {
@@ -302,7 +300,6 @@ static noinline int i2cdev_ioctl_rdwr(struct i2c_client *client,for (j =0 ; j < i; ++j)kfree (msgs[j].buf);kfree (data_ptrs); -kfree (msgs);return res; }
@@ -316,7 +313,6 @@ static noinline int i2cdev_ioctl_rdwr(struct i2c_client *client,kfree (msgs[i].buf); }kfree (data_ptrs); -kfree (msgs);return res; }
@@ -446,6 +442,7 @@ static long i2cdev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)case I2C_RDWR : {struct i2c_rdwr_ioctl_data rdwr_arg;struct i2c_msg *rdwr_pa; +int res; if (copy_from_user(&rdwr_arg, (struct i2c_rdwr_ioctl_data __user *)arg,
@@ -467,7 +464,9 @@ static long i2cdev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)if (IS_ERR (rdwr_pa))return PTR_ERR (rdwr_pa); -return i2cdev_ioctl_rdwr (client, rdwr_arg.nmsgs, rdwr_pa); + res =i2cdev_ioctl_rdwr (client, rdwr_arg.nmsgs, rdwr_pa); +kfree (rdwr_pa); +return res; }case I2C_SMBUS : {
@@ -540,7 +539,7 @@ static long compat_i2cdev_ioctl(struct file *file, unsigned int cmd, unsigned lostruct i2c_rdwr_ioctl_data32 rdwr_arg;struct i2c_msg32 __user *p;struct i2c_msg *rdwr_pa; -int i; +int i, res; if (copy_from_user(&rdwr_arg, (struct i2c_rdwr_ioctl_data32 __user *)arg,
@@ -573,7 +572,9 @@ static long compat_i2cdev_ioctl(struct file *file, unsigned int cmd, unsigned lo }; } -return i2cdev_ioctl_rdwr (client, rdwr_arg.nmsgs, rdwr_pa); + res =i2cdev_ioctl_rdwr (client, rdwr_arg.nmsgs, rdwr_pa); +kfree (rdwr_pa); +return res; }case I2C_SMBUS : {struct i2c_smbus_ioctl_data32 data32;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 355/817 selftests: netfilter: Fix missing return values in conntrack_dump_flush
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: guanjing <[email protected]>
[ Upstream commit 041bd1e4f2d82859690cd8b41c35f0f9404c3770 ]
Fix the bug of some functions were missing return values.
--- .../testing/selftests/net/netfilter/conntrack_dump_flush.c | 6 ++++++ 1 file changed, 6 insertions(+)
tools/testing/selftests/net/netfilter/conntrack_dump_flush.c +6 -0
@@ -43,6 +43,8 @@ static int build_cta_tuple_v4(struct nlmsghdr *nlh, int type,mnl_attr_nest_end (nlh, nest_proto);mnl_attr_nest_end (nlh, nest); + +return 0 ; } static int build_cta_tuple_v6(struct nlmsghdr *nlh, int type,
@@ -71,6 +73,8 @@ static int build_cta_tuple_v6(struct nlmsghdr *nlh, int type,mnl_attr_nest_end (nlh, nest_proto);mnl_attr_nest_end (nlh, nest); + +return 0 ; }static int build_cta_proto (struct nlmsghdr *nlh)
@@ -90,6 +94,8 @@ static int build_cta_proto(struct nlmsghdr *nlh)mnl_attr_nest_end (nlh, nest_proto);mnl_attr_nest_end (nlh, nest); + +return 0 ; } static int conntrack_data_insert(struct mnl_socket *sock, struct nlmsghdr *nlh,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 356/817 Bluetooth: btintel_pcie: Add handshake between driver and firmware
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kiran K <[email protected]>
[ Upstream commit 05c200c8f0295c9c91beeb3ee0552331c1f8adbe ]
The following handshake mechanism needs be followed after firmware download is completed to bring the firmware to running state.
After firmware fragments of Operational image are downloaded and secure sends result of the image succeeds,
1. Driver sends HCI Intel reset with boot option #1 to switch FW image.
2. FW sends Alive GP[0] MSIx
3. Driver enables data path (doorbell 0x460 for RBDs, etc...)
4. Driver gets Bootup event from firmware
5. Driver performs D0 entry to device (WRITE to IPC_Sleep_Control =0x0)
6. FW sends Alive GP[0] MSIx
7. Device host interface is fully set for BT protocol stack operation.
8. Driver may optionally get debug event with ID 0x97 which can be dropped
For Intermediate loadger image, all the above steps are applicable expcept #5 and #6.
On HCI_OP_RESET, firmware raises alive interrupt. Driver needs to wait for it before passing control over to bluetooth stack.
Stable-dep-of: 510e8380b038 ("Bluetooth: btintel: Do no pass vendor events to stack")
--- drivers/bluetooth/btintel.c | 56 ++++++- drivers/bluetooth/btintel.h | 7 + drivers/bluetooth/btintel_pcie.c | 262 ++++++++++++++++++++++++++++++- drivers/bluetooth/btintel_pcie.h | 16 +- 4 files changed, 329 insertions(+), 12 deletions(-)
drivers/bluetooth/btintel.c +52 -4
@@ -1841,6 +1841,37 @@ static int btintel_boot_wait(struct hci_dev *hdev, ktime_t calltime, int msec)return 0 ; } +static int btintel_boot_wait_d0 (struct hci_dev *hdev,ktime_t calltime, +int msec) +{ +ktime_t delta, rettime; +unsigned long long duration; +int err; + +bt_dev_info (hdev,"Waiting for device transition to d0" ); + + err =btintel_wait_on_flag_timeout (hdev,INTEL_WAIT_FOR_D0 , +TASK_INTERRUPTIBLE , +msecs_to_jiffies (msec)); +if (err == -EINTR ) { +bt_dev_err (hdev,"Device d0 move interrupted" ); +return -EINTR ; + } + +if (err) { +bt_dev_err (hdev,"Device d0 move timeout" ); +return -ETIMEDOUT ; + } + + rettime =ktime_get (); + delta =ktime_sub (rettime, calltime); + duration = (unsigned long long )ktime_to_ns (delta) >>10 ; + +bt_dev_info (hdev,"Device moved to D0 in %llu usecs" , duration); + +return 0 ; +} +static int btintel_boot (struct hci_dev *hdev,u32 boot_addr) {ktime_t calltime;
@@ -1849,6 +1880,7 @@ static int btintel_boot(struct hci_dev *hdev, u32 boot_addr) calltime =ktime_get ();btintel_set_flag (hdev,INTEL_BOOTING ); +btintel_set_flag (hdev,INTEL_WAIT_FOR_D0 ); err =btintel_send_intel_reset (hdev, boot_addr);if (err) {
@@ -1861,13 +1893,28 @@ static int btintel_boot(struct hci_dev *hdev, u32 boot_addr)* is done by the operational firmware sending bootup notification. * * Booting into operational firmware should not take longer than -* 1 second. However if that happens, then just fail the setup +* 5 second. However if that happens, then just fail the setup * since something went wrong. */ - err =btintel_boot_wait (hdev, calltime,1000 ); -if (err == -ETIMEDOUT ) + err =btintel_boot_wait (hdev, calltime,5000 ); +if (err == -ETIMEDOUT ) {btintel_reset_to_bootloader (hdev); + goto exit_error; + } +if (hdev->bus ==HCI_PCI ) { +/* In case of PCIe, after receiving bootup event, driver performs +* D0 entry by writing 0 to sleep control register (check +* btintel_pcie_recv_event()) +* Firmware acks with alive interrupt indicating host is full ready to +* perform BT operation. Lets wait here till INTEL_WAIT_FOR_D0 +* bit is cleared. +*/ + calltime =ktime_get (); + err =btintel_boot_wait_d0 (hdev, calltime,2000 ); + } + +exit_error:return err; }
@@ -3273,7 +3320,7 @@ int btintel_configure_setup(struct hci_dev *hdev, const char *driver_name) }EXPORT_SYMBOL_GPL (btintel_configure_setup); -static int btintel_diagnostics (struct hci_dev *hdev,struct sk_buff *skb) +int btintel_diagnostics (struct hci_dev *hdev,struct sk_buff *skb) {struct intel_tlv *tlv = (void *)&skb->data[5 ];
@@ -3301,6 +3348,7 @@ static int btintel_diagnostics(struct hci_dev *hdev, struct sk_buff *skb) recv_frame:return hci_recv_frame (hdev, skb); } +EXPORT_SYMBOL_GPL (btintel_diagnostics);int btintel_recv_event (struct hci_dev *hdev,struct sk_buff *skb) {
drivers/bluetooth/btintel.h +7 -0
@@ -178,6 +178,7 @@ enum {INTEL_ROM_LEGACY ,INTEL_ROM_LEGACY_NO_WBS_SUPPORT ,INTEL_ACPI_RESET_ACTIVE , +INTEL_WAIT_FOR_D0 , __INTEL_NUM_FLAGS, };
@@ -249,6 +250,7 @@ int btintel_bootloader_setup_tlv(struct hci_dev *hdev,int btintel_shutdown_combined (struct hci_dev *hdev);void btintel_hw_error (struct hci_dev *hdev,u8 code);void btintel_print_fseq_info (struct hci_dev *hdev); +int btintel_diagnostics (struct hci_dev *hdev,struct sk_buff *skb);#else static inline int btintel_check_bdaddr (struct hci_dev *hdev)
@@ -382,4 +384,9 @@ static inline void btintel_hw_error(struct hci_dev *hdev, u8 code)static inline void btintel_print_fseq_info (struct hci_dev *hdev) { } + +static inline int btintel_diagnostics (struct hci_dev *hdev,struct sk_buff *skb) +{ +return -EOPNOTSUPP ; +}#endif
drivers/bluetooth/btintel_pcie.c +255 -7
334 lines not on this page · raw message
drivers/bluetooth/btintel_pcie.h +15 -1
@@ -12,6 +12,7 @@#define BTINTEL_PCIE_CSR_HW_REV_REG (BTINTEL_PCIE_CSR_BASE + 0x028)#define BTINTEL_PCIE_CSR_RF_ID_REG (BTINTEL_PCIE_CSR_BASE + 0x09C)#define BTINTEL_PCIE_CSR_BOOT_STAGE_REG (BTINTEL_PCIE_CSR_BASE + 0x108) +#define BTINTEL_PCIE_CSR_IPC_SLEEP_CTL_REG (BTINTEL_PCIE_CSR_BASE + 0x114)#define BTINTEL_PCIE_CSR_CI_ADDR_LSB_REG (BTINTEL_PCIE_CSR_BASE + 0x118)#define BTINTEL_PCIE_CSR_CI_ADDR_MSB_REG (BTINTEL_PCIE_CSR_BASE + 0x11C)#define BTINTEL_PCIE_CSR_IMG_RESPONSE_REG (BTINTEL_PCIE_CSR_BASE + 0x12C)
@@ -32,6 +33,7 @@#define BTINTEL_PCIE_CSR_BOOT_STAGE_IML_LOCKDOWN (BIT(11))#define BTINTEL_PCIE_CSR_BOOT_STAGE_MAC_ACCESS_ON (BIT(16))#define BTINTEL_PCIE_CSR_BOOT_STAGE_ALIVE (BIT(23)) +#define BTINTEL_PCIE_CSR_BOOT_STAGE_D3_STATE_READY (BIT(24))/* Registers for MSI-X */ #define BTINTEL_PCIE_CSR_MSIX_BASE (0x2000)
@@ -55,6 +57,16 @@ enum msix_hw_int_causes { BTINTEL_PCIE_MSIX_HW_INT_CAUSES_GP0 = BIT(0), /* cause 32 */ }; +/* PCIe device states +* Host-Device interface is active +* Host-Device interface is inactive(as reflected by IPC_SLEEP_CONTROL_CSR_AD) +* Host-Device interface is inactive(as reflected by IPC_SLEEP_CONTROL_CSR_AD) +*/ +enum { +BTINTEL_PCIE_STATE_D0 =0 , +BTINTEL_PCIE_STATE_D3_HOT =2 , +BTINTEL_PCIE_STATE_D3_COLD =3 , +};#define BTINTEL_PCIE_MSIX_NON_AUTO_CLEAR_CAUSE BIT(7)/* Minimum and Maximum number of MSI-X Vector
@@ -67,7 +79,7 @@ enum msix_hw_int_causes {#define BTINTEL_DEFAULT_MAC_ACCESS_TIMEOUT_US 200000/* Default interrupt timeout in msec */ -#define BTINTEL_DEFAULT_INTR_TIMEOUT 3000 +#define BTINTEL_DEFAULT_INTR_TIMEOUT_MS 3000/* The number of descriptors in TX/RX queues */ #define BTINTEL_DESCS_COUNT 16
@@ -343,6 +355,7 @@ struct rxq {* @ia: Index Array struct * @txq: TX Queue struct * @rxq: RX Queue struct +* @alive_intr_ctxt: Alive interrupt context */ struct btintel_pcie_data {struct pci_dev *pdev;
@@ -389,6 +402,7 @@ struct btintel_pcie_data {struct ia ia;struct txq txq;struct rxq rxq; +u32 alive_intr_ctxt; }; static inline u32 btintel_pcie_rd_reg32(struct btintel_pcie_data *data,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 357/817 Bluetooth: btintel: Do no pass vendor events to stack
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kiran K <[email protected]>
[ Upstream commit 510e8380b0382ee3b070748656b00f83c9a5bf80 ]
During firmware download, vendor specific events like boot up and secure send result are generated. These events can be safely processed at the driver level. Passing on these events to stack prints unnecessary log as below.
Bluetooth: hci0: Malformed MSFT vendor event: 0x02
--- drivers/bluetooth/btintel.c | 6 ++++-- drivers/bluetooth/btintel_pcie.c | 9 ++++++--- 2 files changed, 10 insertions(+), 5 deletions(-)
drivers/bluetooth/btintel.c +4 -2
@@ -3368,7 +3368,8 @@ int btintel_recv_event(struct hci_dev *hdev, struct sk_buff *skb)* indicating that the bootup completed. */ btintel_bootup (hdev, ptr, len); -break ; +kfree_skb (skb); +return 0 ;case 0x06 :/* When the firmware loading completes the * device sends out a vendor specific event
@@ -3376,7 +3377,8 @@ int btintel_recv_event(struct hci_dev *hdev, struct sk_buff *skb)* loading. */ btintel_secure_send_result (hdev, ptr, len); -break ; +kfree_skb (skb); +return 0 ; } }
drivers/bluetooth/btintel_pcie.c +6 -3
@@ -535,7 +535,8 @@ static int btintel_pcie_recv_event(struct hci_dev *hdev, struct sk_buff *skb)if (btintel_pcie_in_op (data)) {btintel_pcie_wr_sleep_cntrl (data,BTINTEL_PCIE_STATE_D0 ); data->alive_intr_ctxt =BTINTEL_PCIE_INTEL_HCI_RESET2 ; -break ; +kfree_skb (skb); +return 0 ; }if (btintel_pcie_in_iml (data)) {
@@ -552,7 +553,8 @@ static int btintel_pcie_recv_event(struct hci_dev *hdev, struct sk_buff *skb)btintel_wake_up_flag (data->hdev,INTEL_WAIT_FOR_D0 ); } -break ; +kfree_skb (skb); +return 0 ;case 0x06 :/* When the firmware loading completes the * device sends out a vendor specific event
@@ -560,7 +562,8 @@ static int btintel_pcie_recv_event(struct hci_dev *hdev, struct sk_buff *skb)* loading. */ btintel_secure_send_result (hdev, ptr, len); -break ; +kfree_skb (skb); +return 0 ; } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 358/817 Bluetooth: btmtk: adjust the position to init iso data anchor
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Lu <[email protected]>
[ Upstream commit 61c5a3def90ac729a538e5ca5ff7f461cff72776 ]
MediaTek iso data anchor init should be moved to where MediaTek claims iso data interface.
If there is an unexpected BT usb disconnect during setup flow, it will cause a NULL pointer crash issue when releasing iso anchor since the anchor wasn't been init yet. Adjust the position to do iso data anchor init.
[ 17.137991] pc : usb_kill_anchored_urbs+0x60/0x168 [ 17.137998] lr : usb_kill_anchored_urbs+0x44/0x168 [ 17.137999] sp : ffffffc0890cb5f0 [ 17.138000] x29: ffffffc0890cb5f0 x28: ffffff80bb6c2e80 [ 17.144081] gpio gpiochip0: registered chardev handle for 1 lines [ 17.148421] x27: 0000000000000000 [ 17.148422] x26: ffffffd301ff4298 x25: 0000000000000003 x24: 00000000000000f0 [ 17.148424] x23: 0000000000000000 x22: 00000000ffffffff x21: 0000000000000001 [ 17.148425] x20: ffffffffffffffd8 x19: ffffff80c0f25560 x18: 0000000000000000 [ 17.148427] x17: ffffffd33864e408 x16: ffffffd33808f7c8 x15: 0000000000200000 [ 17.232789] x14: e0cd73cf80ffffff x13: 50f2137c0a0338c9 x12: 0000000000000001 [ 17.239912] x11: 0000000080150011 x10: 0000000000000002 x9 : 0000000000000001 [ 17.247035] x8 : 0000000000000000 x7 : 0000000000008080 x6 : 8080000000000000 [ 17.254158] x5 : ffffffd33808ebc0 x4 : fffffffe033dcf20 x3 : 0000000080150011 [ 17.261281] x2 : ffffff8087a91400 x1 : 0000000000000000 x0 : ffffff80c0f25588 [ 17.268404] Call trace: [ 17.270841] usb_kill_anchored_urbs+0x60/0x168 [ 17.275274] btusb_mtk_release_iso_intf+0x2c/0xd8 [btusb (HASH:5afe 6)] [ 17.284226] btusb_mtk_disconnect+0x14/0x28 [btusb (HASH:5afe 6)] [ 17.292652] btusb_disconnect+0x70/0x140 [btusb (HASH:5afe 6)] [ 17.300818] usb_unbind_interface+0xc4/0x240 [ 17.305079] device_release_driver_internal+0x18c/0x258 [ 17.310296] device_release_driver+0x1c/0x30 [ 17.314557] bus_remove_device+0x140/0x160 [ 17.318643] device_del+0x1c0/0x330 [ 17.322121] usb_disable_device+0x80/0x180 [ 17.326207] usb_disconnect+0xec/0x300 [ 17.329948] hub_quiesce+0x80/0xd0 [ 17.333339] hub_disconnect+0x44/0x190 [ 17.337078] usb_unbind_interface+0xc4/0x240 [ 17.341337] device_release_driver_internal+0x18c/0x258 [ 17.346551] device_release_driver+0x1c/0x30 [ 17.350810] usb_driver_release_interface+0x70/0x88 [ 17.355677] proc_ioctl+0x13c/0x228 [ 17.359157] proc_ioctl_default+0x50/0x80 [ 17.363155] usbdev_ioctl+0x830/0xd08 [ 17.366808] __arm64_sys_ioctl+0x94/0xd0 [ 17.370723] invoke_syscall+0x6c/0xf8 [ 17.374377] el0_svc_common+0x84/0xe0 [ 17.378030] do_el0_svc+0x20/0x30 [ 17.381334] el0_svc+0x34/0x60 [ 17.384382] el0t_64_sync_handler+0x88/0xf0 [ 17.388554] el0t_64_sync+0x180/0x188 [ 17.392208] Code: f9400677 f100a2f4 54fffea0 d503201f (b8350288) [ 17.398289] ---[ end trace 0000000000000000 ]---
--- drivers/bluetooth/btmtk.c | 1 - drivers/bluetooth/btusb.c | 1 + 2 files changed, 1 insertion(+), 1 deletion(-)
drivers/bluetooth/btmtk.c +0 -1
@@ -1215,7 +1215,6 @@ static int btmtk_usb_isointf_init(struct hci_dev *hdev)struct sk_buff *skb;int err; -init_usb_anchor (&btmtk_data->isopkt_anchor);spin_lock_init (&btmtk_data->isorxlock);__set_mtk_intr_interface (hdev);
drivers/bluetooth/btusb.c +1 -0
@@ -2670,6 +2670,7 @@ static void btusb_mtk_claim_iso_intf(struct btusb_data *data) }set_bit (BTMTK_ISOPKT_OVER_INTR , &btmtk_data->flags); +init_usb_anchor (&btmtk_data->isopkt_anchor); }static void btusb_mtk_release_iso_intf (struct btusb_data *data)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 359/817 Bluetooth: btbcm: fix missing of_node_put() in btbcm_get_board_name()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <[email protected]>
[ Upstream commit e42eec0f182ac0605e658145f6fe3b6a7c256c45 ]
of_find_node_by_path() returns a pointer to a device_node with its refcount incremented, and a call to of_node_put() is required to decrement the refcount again and avoid leaking the resource.
If 'of_property_read_string_index(root, "compatible", 0, &tmp)' fails, the function returns without calling of_node_put(root) before doing so.
The automatic cleanup attribute can be used by means of the __free() macro to automatically call of_node_put() when the variable goes out of scope, fixing the issue and also accounting for new error paths.
--- drivers/bluetooth/btbcm.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/bluetooth/btbcm.c +1 -3
@@ -541,11 +541,10 @@ static const struct bcm_subver_table bcm_usb_subver_table[] = {static const char *btbcm_get_board_name (struct device *dev) {#ifdef CONFIG_OF -struct device_node *root; + struct device_node *root __free(device_node) = of_find_node_by_path("/");char *board_type;const char *tmp; - root =of_find_node_by_path ("/" );if (!root)return NULL ;
@@ -555,7 +554,6 @@ static const char *btbcm_get_board_name(struct device *dev)/* get rid of any '/' in the compatible string */ board_type =devm_kstrdup (dev, tmp,GFP_KERNEL );strreplace (board_type,'/' ,'-' ); -of_node_put (root);return board_type;#else
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 360/817 Bluetooth: ISO: Use kref to track lifetime of iso_conn
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit dc26097bdb864a0d5955b9a25e43376ffc1af99b ]
This make use of kref to keep track of reference of iso_conn which allows better tracking of its lifetime with usage of things like kref_get_unless_zero in a similar way as used in l2cap_chan.
In addition to it remove call to iso_sock_set_timer on iso_sock_disconn since at that point it is useless to set a timer as the sk will be freed there is nothing to be done in iso_sock_timeout.
--- net/bluetooth/iso.c | 88 ++++++++++++++++++++++++++++++++++++--------- 1 file changed, 71 insertions(+), 17 deletions(-)
net/bluetooth/iso.c +71 -17
@@ -35,6 +35,7 @@ struct iso_conn {struct sk_buff *rx_skb;__u32 rx_len;__u16 tx_sn; +struct kref ref; };#define iso_conn_lock (c) spin_lock(&(c)->lock)
@@ -93,6 +94,49 @@ static struct sock *iso_get_sock(bdaddr_t *src, bdaddr_t *dst,#define ISO_CONN_TIMEOUT (HZ * 40)#define ISO_DISCONN_TIMEOUT (HZ * 2) +static void iso_conn_free (struct kref *ref) +{ + struct iso_conn *conn = container_of(ref, struct iso_conn, ref); + +BT_DBG ("conn %p" , conn); + +if (conn->sk) +iso_pi (conn->sk)->conn =NULL ; + +if (conn->hcon) { + conn->hcon->iso_data =NULL ; +hci_conn_drop (conn->hcon); + } + +/* Ensure no more work items will run since hci_conn has been dropped */ +disable_delayed_work_sync (&conn->timeout_work); + +kfree (conn); +} + +static void iso_conn_put (struct iso_conn *conn) +{ +if (!conn) +return ; + +BT_DBG ("conn %p refcnt %d" , conn,kref_read (&conn->ref)); + +kref_put (&conn->ref, iso_conn_free); +} + +static struct iso_conn *iso_conn_hold_unless_zero (struct iso_conn *conn) +{ +if (!conn) +return NULL ; + +BT_DBG ("conn %p refcnt %u" , conn,kref_read (&conn->ref)); + +if (!kref_get_unless_zero (&conn->ref)) +return NULL ; + +return conn; +} +static struct sock *iso_sock_hold (struct iso_conn *conn) {if (!conn || !bt_sock_linked (&iso_sk_list, conn->sk))
@@ -109,9 +153,14 @@ static void iso_sock_timeout(struct work_struct *work) timeout_work.work);struct sock *sk; + conn =iso_conn_hold_unless_zero (conn); +if (!conn) +return ; +iso_conn_lock (conn); sk =iso_sock_hold (conn);iso_conn_unlock (conn); +iso_conn_put (conn);if (!sk)return ;
@@ -149,9 +198,14 @@ static struct iso_conn *iso_conn_add(struct hci_conn *hcon) {struct iso_conn *conn = hcon->iso_data; + conn =iso_conn_hold_unless_zero (conn);if (conn) { -if (!conn->hcon) +if (!conn->hcon) { +iso_conn_lock (conn); conn->hcon = hcon; +iso_conn_unlock (conn); + } +iso_conn_put (conn);return conn; }
@@ -159,6 +213,7 @@ static struct iso_conn *iso_conn_add(struct hci_conn *hcon)if (!conn)return NULL ; +kref_init (&conn->ref);spin_lock_init (&conn->lock);INIT_DELAYED_WORK (&conn->timeout_work, iso_sock_timeout);
@@ -178,17 +233,15 @@ static void iso_chan_del(struct sock *sk, int err)struct sock *parent; conn =iso_pi (sk)->conn; +iso_pi (sk)->conn =NULL ;BT_DBG ("sk %p, conn %p, err %d" , sk, conn, err);if (conn) {iso_conn_lock (conn); conn->sk =NULL ; -iso_pi (sk)->conn =NULL ;iso_conn_unlock (conn); - -if (conn->hcon) -hci_conn_drop (conn->hcon); +iso_conn_put (conn); } sk->sk_state =BT_CLOSED ;
@@ -210,6 +263,7 @@ static void iso_conn_del(struct hci_conn *hcon, int err)struct iso_conn *conn = hcon->iso_data;struct sock *sk; + conn =iso_conn_hold_unless_zero (conn);if (!conn)return ;
@@ -219,20 +273,18 @@ static void iso_conn_del(struct hci_conn *hcon, int err)iso_conn_lock (conn); sk =iso_sock_hold (conn);iso_conn_unlock (conn); +iso_conn_put (conn); -if (sk) { -lock_sock (sk); -iso_sock_clear_timer (sk); -iso_chan_del (sk, err); -release_sock (sk); -sock_put (sk); +if (!sk) { +iso_conn_put (conn); +return ; } -/* Ensure no more work items will run before freeing conn. */ -cancel_delayed_work_sync (&conn->timeout_work); - - hcon->iso_data =NULL ; -kfree (conn); +lock_sock (sk); +iso_sock_clear_timer (sk); +iso_chan_del (sk, err); +release_sock (sk); +sock_put (sk); } static int __iso_chan_add(struct iso_conn *conn, struct sock *sk,
@@ -652,6 +704,8 @@ static void iso_sock_destruct(struct sock *sk) {BT_DBG ("sk %p" , sk); +iso_conn_put (iso_pi (sk)->conn); +skb_queue_purge (&sk->sk_receive_queue);skb_queue_purge (&sk->sk_write_queue); }
@@ -711,6 +765,7 @@ static void iso_sock_disconn(struct sock *sk)*/ if (bis_sk) { hcon->state =BT_OPEN ; + hcon->iso_data =NULL ;iso_pi (sk)->conn->hcon =NULL ;iso_sock_clear_timer (sk);iso_chan_del (sk,bt_to_errno (hcon->abort_reason));
@@ -720,7 +775,6 @@ static void iso_sock_disconn(struct sock *sk) } sk->sk_state =BT_DISCONN ; -iso_sock_set_timer (sk,ISO_DISCONN_TIMEOUT );iso_conn_lock (iso_pi (sk)->conn);hci_conn_drop (iso_pi (sk)->conn->hcon);iso_pi (sk)->conn->hcon =NULL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 361/817 Bluetooth: ISO: Do not emit LE PA Create Sync if previous is pending
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Iulia Tanasescu <[email protected]>
[ Upstream commit 4a5e0ba68676b3a77298cf646cd2b39c94fbd2f5 ]
The Bluetooth Core spec does not allow a LE PA Create sync command to be sent to Controller if another one is pending (Vol 4, Part E, page 2493).
In order to avoid this issue, the HCI_CONN_CREATE_PA_SYNC was added to mark that the LE PA Create Sync command has been sent for a hcon. Once the PA Sync Established event is received, the hcon flag is erased and the next pending hcon is handled.
Stable-dep-of: 07a9342b94a9 ("Bluetooth: ISO: Send BIG Create Sync via hci_sync")
--- include/net/bluetooth/hci.h | 3 +- include/net/bluetooth/hci_core.h | 34 +++++++++ net/bluetooth/hci_conn.c | 123 +++++++++++++++++++++---------- net/bluetooth/hci_event.c | 19 ++++- 4 files changed, 139 insertions(+), 40 deletions(-)
include/net/bluetooth/hci.h +2 -1
@@ -1,7 +1,7 @@/* BlueZ - Bluetooth protocol stack for Linux Copyright (C) 2000-2001 Qualcomm Incorporated -Copyright 2023 NXP +Copyright 2023-2024 NXP Written 2000,2001 by Maxim Krasnyansky <[email protected]>
@@ -683,6 +683,7 @@ enum {#define HCI_RSSI_INVALID 127#define HCI_SYNC_HANDLE_INVALID 0xffff +#define HCI_SID_INVALID 0xff#define HCI_ROLE_MASTER 0x00#define HCI_ROLE_SLAVE 0x01
include/net/bluetooth/hci_core.h +34 -0
@@ -668,6 +668,7 @@ struct hci_conn {__u8 adv_instance;__u16 handle;__u16 sync_handle; +__u8 sid;__u16 state;__u16 mtu;__u8 mode;
@@ -947,6 +948,7 @@ enum {HCI_CONN_CREATE_CIS ,HCI_CONN_BIG_SYNC ,HCI_CONN_BIG_SYNC_FAILED , +HCI_CONN_CREATE_PA_SYNC ,HCI_CONN_PA_SYNC , HCI_CONN_PA_SYNC_FAILED, };
@@ -1099,6 +1101,30 @@ static inline struct hci_conn *hci_conn_hash_lookup_bis(struct hci_dev *hdev,return NULL ; } +static inline struct hci_conn *hci_conn_hash_lookup_sid (struct hci_dev *hdev, +__u8 sid, +bdaddr_t *dst, +__u8 dst_type) +{ +struct hci_conn_hash *h = &hdev->conn_hash; +struct hci_conn *c; + +rcu_read_lock (); + +list_for_each_entry_rcu (c, &h->list, list) { +if (c->type !=ISO_LINK ||bacmp (&c->dst, dst) || + c->dst_type != dst_type || c->sid != sid) +continue ; + +rcu_read_unlock (); +return c; + } + +rcu_read_unlock (); + +return NULL ; +} +static inline struct hci_conn * hci_conn_hash_lookup_per_adv_bis(struct hci_dev *hdev, bdaddr_t *ba,
@@ -1328,6 +1354,13 @@ hci_conn_hash_lookup_pa_sync_handle(struct hci_dev *hdev, __u16 sync_handle)if (c->type !=ISO_LINK )continue ; +/* Ignore the listen hcon, we are looking +* for the child hcon that was created as +* a result of the PA sync established event. +*/ +if (c->state ==BT_LISTEN ) +continue ; +if (c->sync_handle == sync_handle) {rcu_read_unlock ();return c;
@@ -1445,6 +1478,7 @@ bool hci_setup_sync(struct hci_conn *conn, __u16 handle);void hci_sco_setup (struct hci_conn *conn,__u8 status);bool hci_iso_setup_path (struct hci_conn *conn);int hci_le_create_cis_pending (struct hci_dev *hdev); +int hci_pa_create_sync_pending (struct hci_dev *hdev);int hci_conn_check_create_cis (struct hci_conn *conn); struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst,
net/bluetooth/hci_conn.c +85 -38
164 lines not on this page · raw message
net/bluetooth/hci_event.c +18 -1
@@ -6345,7 +6345,7 @@ static void hci_le_pa_sync_estabilished_evt(struct hci_dev *hdev, void *data,struct hci_ev_le_pa_sync_established *ev = data;int mask = hdev->link_mode;__u8 flags =0 ; -struct hci_conn *pa_sync; +struct hci_conn *pa_sync, *conn;bt_dev_dbg (hdev,"status 0x%2.2x" , ev->status);
@@ -6353,6 +6353,20 @@ static void hci_le_pa_sync_estabilished_evt(struct hci_dev *hdev, void *data,hci_dev_clear_flag (hdev,HCI_PA_SYNC ); + conn =hci_conn_hash_lookup_sid (hdev, ev->sid, &ev->bdaddr, + ev->bdaddr_type); +if (!conn) { +bt_dev_err (hdev, +"Unable to find connection for dst %pMR sid 0x%2.2x" , + &ev->bdaddr, ev->sid); + goto unlock; + } + +clear_bit (HCI_CONN_CREATE_PA_SYNC , &conn->flags); + + conn->sync_handle =le16_to_cpu (ev->handle); + conn->sid =HCI_SID_INVALID ; + mask |=hci_proto_connect_ind (hdev, &ev->bdaddr,ISO_LINK , &flags);if (!(mask &HCI_LM_ACCEPT )) {hci_le_pa_term_sync (hdev, ev->handle);
@@ -6379,6 +6393,9 @@ static void hci_le_pa_sync_estabilished_evt(struct hci_dev *hdev, void *data, } unlock: +/* Handle any other pending PA sync command */ +hci_pa_create_sync_pending (hdev); +hci_dev_unlock (hdev); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 362/817 Bluetooth: ISO: Do not emit LE BIG Create Sync if previous is pending
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Iulia Tanasescu <[email protected]>
[ Upstream commit 42ecf1947135110ea08abeaca39741636f9a2285 ]
The Bluetooth Core spec does not allow a LE BIG Create sync command to be sent to Controller if another one is pending (Vol 4, Part E, page 2586).
In order to avoid this issue, the HCI_CONN_CREATE_BIG_SYNC was added to mark that the LE BIG Create Sync command has been sent for a hcon. Once the BIG Sync Established event is received, the hcon flag is erased and the next pending hcon is handled.
Stable-dep-of: 07a9342b94a9 ("Bluetooth: ISO: Send BIG Create Sync via hci_sync")
--- include/net/bluetooth/hci.h | 1 + include/net/bluetooth/hci_core.h | 29 +++++++++++ net/bluetooth/hci_conn.c | 87 +++++++++++++++++++++++++++----- net/bluetooth/hci_event.c | 20 +++++++- net/bluetooth/iso.c | 4 +- 5 files changed, 125 insertions(+), 16 deletions(-)
include/net/bluetooth/hci.h +1 -0
@@ -29,6 +29,7 @@#define HCI_MAX_ACL_SIZE 1024#define HCI_MAX_SCO_SIZE 255#define HCI_MAX_ISO_SIZE 251 +#define HCI_MAX_ISO_BIS 31#define HCI_MAX_EVENT_SIZE 260#define HCI_MAX_FRAME_SIZE (HCI_MAX_ACL_SIZE + 4)
include/net/bluetooth/hci_core.h +29 -0
@@ -711,6 +711,9 @@ struct hci_conn {__s8 tx_power;__s8 max_tx_power;struct bt_iso_qos iso_qos; +__u8 num_bis; +__u8 bis[HCI_MAX_ISO_BIS ]; +unsigned long flags;enum conn_reasons conn_reason;
@@ -946,6 +949,7 @@ enum {HCI_CONN_PER_ADV ,HCI_CONN_BIG_CREATED ,HCI_CONN_CREATE_CIS , +HCI_CONN_CREATE_BIG_SYNC ,HCI_CONN_BIG_SYNC ,HCI_CONN_BIG_SYNC_FAILED , HCI_CONN_CREATE_PA_SYNC,
@@ -1295,6 +1299,30 @@ static inline struct hci_conn *hci_conn_hash_lookup_big(struct hci_dev *hdev,return NULL ; } +static inline struct hci_conn * +hci_conn_hash_lookup_big_sync_pend (struct hci_dev *hdev, +__u8 handle,__u8 num_bis) +{ +struct hci_conn_hash *h = &hdev->conn_hash; +struct hci_conn *c; + +rcu_read_lock (); + +list_for_each_entry_rcu (c, &h->list, list) { +if (c->type !=ISO_LINK ) +continue ; + +if (handle == c->iso_qos.bcast.big && num_bis == c->num_bis) { +rcu_read_unlock (); +return c; + } + } + +rcu_read_unlock (); + +return NULL ; +} +static inline struct hci_conn *hci_conn_hash_lookup_big_state (struct hci_dev *hdev,__u8 handle,__u16 state) {
@@ -1479,6 +1507,7 @@ void hci_sco_setup(struct hci_conn *conn, __u8 status);bool hci_iso_setup_path (struct hci_conn *conn);int hci_le_create_cis_pending (struct hci_dev *hdev);int hci_pa_create_sync_pending (struct hci_dev *hdev); +int hci_le_big_create_sync_pending (struct hci_dev *hdev);int hci_conn_check_create_cis (struct hci_conn *conn); struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst,
net/bluetooth/hci_conn.c +73 -14
107 lines not on this page · raw message
net/bluetooth/hci_event.c +19 -1
@@ -6913,7 +6913,7 @@ static void hci_le_big_sync_established_evt(struct hci_dev *hdev, void *data, struct sk_buff *skb) {struct hci_evt_le_big_sync_estabilished *ev = data; -struct hci_conn *bis; +struct hci_conn *bis, *conn;int i;bt_dev_dbg (hdev,"status 0x%2.2x" , ev->status);
@@ -6924,6 +6924,20 @@ static void hci_le_big_sync_established_evt(struct hci_dev *hdev, void *data,hci_dev_lock (hdev); + conn =hci_conn_hash_lookup_big_sync_pend (hdev, ev->handle, + ev->num_bis); +if (!conn) { +bt_dev_err (hdev, +"Unable to find connection for big 0x%2.2x" , + ev->handle); + goto unlock; + } + +clear_bit (HCI_CONN_CREATE_BIG_SYNC , &conn->flags); + + conn->num_bis =0 ; +memset (conn->bis,0 ,sizeof (conn->num_bis)); +for (i =0 ; i < ev->num_bis; i++) {u16 handle =le16_to_cpu (ev->bis[i]);__le32 interval;
@@ -6973,6 +6987,10 @@ static void hci_le_big_sync_established_evt(struct hci_dev *hdev, void *data,hci_connect_cfm (bis, ev->status); } +unlock: +/* Handle any other pending BIG sync command */ +hci_le_big_create_sync_pending (hdev); +hci_dev_unlock (hdev); }
net/bluetooth/iso.c +3 -1
@@ -1996,6 +1996,7 @@ int iso_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags)if (sk) {int err; +struct hci_conn *hcon =iso_pi (sk)->conn->hcon;iso_pi (sk)->qos.bcast.encryption = ev2->encryption;
@@ -2004,7 +2005,8 @@ int iso_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags)if (!test_bit (BT_SK_DEFER_SETUP , &bt_sk (sk)->flags) && !test_and_set_bit (BT_SK_BIG_SYNC , &iso_pi (sk)->flags)) { - err = hci_le_big_create_sync(hdev, NULL, + err = hci_le_big_create_sync(hdev, + hcon, &iso_pi(sk)->qos, iso_pi(sk)->sync_handle, iso_pi(sk)->bc_num_bis,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 363/817 Bluetooth: ISO: Send BIG Create Sync via hci_sync
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Iulia Tanasescu <[email protected]>
[ Upstream commit 07a9342b94a91b306ed1cf6aa8254aea210764c9 ]
Before issuing the LE BIG Create Sync command, an available BIG handle is chosen by iterating through the conn_hash list and finding the first unused value.
If a BIG is terminated, the associated hcons are removed from the list and the LE BIG Terminate Sync command is sent via hci_sync queue. However, a new LE BIG Create sync command might be issued via hci_send_cmd, before the previous BIG sync was terminated. This can cause the same BIG handle to be reused and the LE BIG Create Sync to fail with Command Disallowed.
< HCI Command: LE Broadcast Isochronous Group Create Sync (0x08|0x006b)
BIG Handle: 0x00
BIG Sync Handle: 0x0002
Encryption: Unencrypted (0x00)
Broadcast Code[16]: 00000000000000000000000000000000
Maximum Number Subevents: 0x00
Timeout: 20000 ms (0x07d0)
Number of BIS: 1
BIS ID: 0x01Quoted 1 line
HCI Event: Command Status (
0x0f) plen 4
LE Broadcast Isochronous Group Create Sync (0x08|0x006b) ncmd 1
Status: Command Disallowed (0x0c)
< HCI Command: LE Broadcast Isochronous Group Terminate Sync (0x08|0x006c)
BIG Handle: 0x00This commit fixes the ordering of the LE BIG Create Sync/LE BIG Terminate Sync commands, to make sure that either the previous BIG sync is terminated before reusing the handle, or that a new handle is chosen for a new sync.
--- net/bluetooth/hci_conn.c | 17 ++++++++++++++++- net/bluetooth/iso.c | 9 +++++++++ 2 files changed, 25 insertions(+), 1 deletion(-)
net/bluetooth/hci_conn.c +16 -1
@@ -2189,7 +2189,15 @@ static bool hci_conn_check_create_big_sync(struct hci_conn *conn)return true; } -int hci_le_big_create_sync_pending (struct hci_dev *hdev) +static void big_create_sync_complete (struct hci_dev *hdev,void *data,int err) +{ +bt_dev_dbg (hdev,"" ); + +if (err) +bt_dev_err (hdev,"Unable to create BIG sync: %d" , err); +} + +static int big_create_sync (struct hci_dev *hdev,void *data) { DEFINE_FLEX(struct hci_cp_le_big_create_sync, pdu, bis, num_bis, 0x11);struct hci_conn *conn;
@@ -2246,6 +2254,13 @@ int hci_le_big_create_sync_pending(struct hci_dev *hdev) struct_size(pdu, bis, pdu->num_bis), pdu); } +int hci_le_big_create_sync_pending (struct hci_dev *hdev) +{ +/* Queue big_create_sync */ +return hci_cmd_sync_queue_once (hdev, big_create_sync, +NULL , big_create_sync_complete); +} +int hci_le_big_create_sync (struct hci_dev *hdev,struct hci_conn *hcon,struct bt_iso_qos *qos,__u16 sync_handle,__u8 num_bis,__u8 bis[])
net/bluetooth/iso.c +9 -0
@@ -1392,6 +1392,13 @@ static void iso_conn_big_sync(struct sock *sk)if (!hdev)return ; +/* hci_le_big_create_sync requires hdev lock to be held, since +* it enqueues the HCI LE BIG Create Sync command via +* hci_cmd_sync_queue_once, which checks hdev flags that might +* change. +*/ +hci_dev_lock (hdev); +if (!test_and_set_bit (BT_SK_BIG_SYNC , &iso_pi (sk)->flags)) { err = hci_le_big_create_sync(hdev, iso_pi(sk)->conn->hcon, &iso_pi(sk)->qos,
@@ -1402,6 +1409,8 @@ static void iso_conn_big_sync(struct sock *sk)bt_dev_err (hdev,"hci_le_big_create_sync: %d" , err); } + +hci_dev_unlock (hdev); } static int iso_sock_recvmsg(struct socket *sock, struct msghdr *msg,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 364/817 Bluetooth: fix use-after-free in device_for_each_child()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit 27aabf27fd014ae037cc179c61b0bee7cff55b3d ]
Syzbot has reported the following KASAN splat:
BUG: KASAN: slab-use-after-free in device_for_each_child+0x18f/0x1a0 Read of size 8 at addr ffff88801f605308 by task kbnepd bnep0/4980 CPU: 0 UID: 0 PID: 4980 Comm: kbnepd bnep0 Not tainted 6.12.0-rc4-00161-gae90f6a6170d #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x100/0x190 ? device_for_each_child+0x18f/0x1a0 print_report+0x13a/0x4cb ? __virt_addr_valid+0x5e/0x590 ? __phys_addr+0xc6/0x150 ? device_for_each_child+0x18f/0x1a0 kasan_report+0xda/0x110 ? device_for_each_child+0x18f/0x1a0 ? __pfx_dev_memalloc_noio+0x10/0x10 device_for_each_child+0x18f/0x1a0 ? __pfx_device_for_each_child+0x10/0x10 pm_runtime_set_memalloc_noio+0xf2/0x180 netdev_unregister_kobject+0x1ed/0x270 unregister_netdevice_many_notify+0x123c/0x1d80 ? __mutex_trylock_common+0xde/0x250 ? __pfx_unregister_netdevice_many_notify+0x10/0x10 ? trace_contention_end+0xe6/0x140 ? __mutex_lock+0x4e7/0x8f0 ? __pfx_lock_acquire.part.0+0x10/0x10 ? rcu_is_watching+0x12/0xc0 ? unregister_netdev+0x12/0x30 unregister_netdevice_queue+0x30d/0x3f0 ? __pfx_unregister_netdevice_queue+0x10/0x10 ? __pfx_down_write+0x10/0x10 unregister_netdev+0x1c/0x30 bnep_session+0x1fb3/0x2ab0 ? __pfx_bnep_session+0x10/0x10 ? __pfx_lock_release+0x10/0x10 ? __pfx_woken_wake_function+0x10/0x10 ? __kthread_parkme+0x132/0x200 ? __pfx_bnep_session+0x10/0x10 ? kthread+0x13a/0x370 ? __pfx_bnep_session+0x10/0x10 kthread+0x2b7/0x370 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x48/0x80 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 4974: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0xaa/0xb0 __kmalloc_noprof+0x1d1/0x440 hci_alloc_dev_priv+0x1d/0x2820 __vhci_create_device+0xef/0x7d0 vhci_write+0x2c7/0x480 vfs_write+0x6a0/0xfc0 ksys_write+0x12f/0x260 do_syscall_64+0xc7/0x250 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 4979: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x4f/0x70 kfree+0x141/0x490 hci_release_dev+0x4d9/0x600 bt_host_release+0x6a/0xb0 device_release+0xa4/0x240 kobject_put+0x1ec/0x5a0 put_device+0x1f/0x30 vhci_release+0x81/0xf0 __fput+0x3f6/0xb30 task_work_run+0x151/0x250 do_exit+0xa79/0x2c30 do_group_exit+0xd5/0x2a0 get_signal+0x1fcd/0x2210 arch_do_signal_or_restart+0x93/0x780 syscall_exit_to_user_mode+0x140/0x290 do_syscall_64+0xd4/0x250 entry_SYSCALL_64_after_hwframe+0x77/0x7f
In 'hci_conn_del_sysfs()', 'device_unregister()' may be called when an underlying (kobject) reference counter is greater than 1. This means that reparenting (happened when the device is actually freed) is delayed and, during that delay, parent controller device (hciX) may be deleted. Since the latter may create a dangling pointer to freed parent, avoid that scenario by reparenting to NULL explicitly.
--- net/bluetooth/hci_sysfs.c | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-)
net/bluetooth/hci_sysfs.c +4 -11
@@ -21,16 +21,6 @@ static const struct device_type bt_link = { .release = bt_link_release, }; -/* -* The rfcomm tty device will possibly retain even when conn -* is down, and sysfs doesn't support move zombie device, -* so we should move the device before conn device is destroyed. -*/ -static int __match_tty (struct device *dev,void *data) -{ -return !strncmp (dev_name (dev),"rfcomm" ,6 ); -} -void hci_conn_init_sysfs (struct hci_conn *conn) {struct hci_dev *hdev = conn->hdev;
@@ -73,10 +63,13 @@ void hci_conn_del_sysfs(struct hci_conn *conn)return ; } +/* If there are devices using the connection as parent reset it to NULL +* before unregistering the device. +*/ while (1 ) {struct device *dev; - dev =device_find_child (&conn->dev,NULL , __match_tty); + dev =device_find_any_child (&conn->dev);if (!dev)break ;device_move (dev,NULL ,DPM_ORDER_DEV_LAST );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 365/817 xsk: Free skb when TX metadata options are invalid
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Maurer <[email protected]>
[ Upstream commit 0c0d0f42ffa6ac94cd79893b7ed419c15e1b45de ]
When a new skb is allocated for transmitting an xsk descriptor, i.e., for every non-multibuf descriptor or the first frag of a multibuf descriptor, but the descriptor is later found to have invalid options set for the TX metadata, the new skb is never freed. This can leak skbs until the send buffer is full which makes sending more packets impossible.
Fix this by freeing the skb in the error path if we are currently dealing with the first frag, i.e., an skb allocated in this iteration of xsk_build_skb.
--- net/xdp/xsk.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
net/xdp/xsk.c +6 -5
@@ -675,6 +675,8 @@ static struct sk_buff *xsk_build_skb(struct xdp_sock *xs, len = desc->len;if (!skb) { + first_frag = true; + hr =max (NET_SKB_PAD ,L1_CACHE_ALIGN (dev->needed_headroom)); tr = dev->needed_tailroom; skb =sock_alloc_send_skb (&xs->sk, hr + len + tr,1 , &err);
@@ -685,12 +687,8 @@ static struct sk_buff *xsk_build_skb(struct xdp_sock *xs,skb_put (skb, len); err =skb_store_bits (skb,0 , buffer, len); -if (unlikely (err)) { -kfree_skb (skb); +if (unlikely (err)) goto free_err; - } - - first_frag = true; }else {int nr_frags =skb_shinfo (skb)->nr_frags;struct page *page;
@@ -758,6 +756,9 @@ static struct sk_buff *xsk_build_skb(struct xdp_sock *xs,return skb; free_err: +if (first_frag && skb) +kfree_skb (skb); +if (err == -EOVERFLOW ) {/* Drop the packet */ xsk_set_destructor_arg (xs->skb);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 366/817 erofs: handle NONHEAD !delta[1] lclusters gracefully
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gao Xiang <[email protected]>
[ Upstream commit 0bc8061ffc733a0a246b8689b2d32a3e9204f43c ]
syzbot reported a WARNING in iomap_iter_done:
iomap_fiemap+0x73b/0x9b0 fs/iomap/fiemap.c:80 ioctl_fiemap fs/ioctl.c:220 [inline]
Generally, NONHEAD lclusters won't have delta[1]==0, except for crafted images and filesystems created by pre-1.0 mkfs versions.
Previously, it would immediately bail out if delta[1]==0, which led to inadequate decompressed lengths (thus FIEMAP is impacted). Treat it as delta[1]=1 to work around these legacy mkfs versions.
lclusterbits > 14 is illegal for compact indexes, error out too.
--- fs/erofs/zmap.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-)
fs/erofs/zmap.c +9 -8
@@ -223,7 +223,7 @@ static int z_erofs_load_compact_lcluster(struct z_erofs_maprecorder *m,unsigned int amortizedshift;erofs_off_t pos; -if (lcn >= totalidx) +if (lcn >= totalidx || vi->z_logical_clusterbits >14 )return -EINVAL ; m->lcn = lcn;
@@ -398,7 +398,7 @@ static int z_erofs_get_extent_decompressedlen(struct z_erofs_maprecorder *m)u64 lcn = m->lcn, headlcn = map->m_la >> lclusterbits;int err; - do { +while (1 ) {/* handle the last EOF pcluster (no next HEAD lcluster) */ if ((lcn << lclusterbits) >= inode->i_size) { map->m_llen = inode->i_size - map->m_la;
@@ -410,14 +410,16 @@ static int z_erofs_get_extent_decompressedlen(struct z_erofs_maprecorder *m)return err;if (m->type ==Z_EROFS_LCLUSTER_TYPE_NONHEAD ) { -DBG_BUGON (!m->delta[1 ] && - m->clusterofs !=1 << lclusterbits); +/* work around invalid d1 generated by pre-1.0 mkfs */ +if (unlikely (!m->delta[1 ])) { + m->delta[1 ] =1 ; +DBG_BUGON (1 ); + } }else if (m->type ==Z_EROFS_LCLUSTER_TYPE_PLAIN || m->type ==Z_EROFS_LCLUSTER_TYPE_HEAD1 || m->type ==Z_EROFS_LCLUSTER_TYPE_HEAD2 ) { -/* go on until the next HEAD lcluster */ if (lcn != headlcn) -break ; +break ;/* ends at the next HEAD lcluster */ m->delta[1 ] =1 ; }else { erofs_err(inode->i_sb, "unknown type %u @ lcn %llu of nid %llu",
@@ -426,8 +428,7 @@ static int z_erofs_get_extent_decompressedlen(struct z_erofs_maprecorder *m)return -EOPNOTSUPP ; } lcn += m->delta[1 ]; - }while (m->delta[1 ]); - + } map->m_llen = (lcn << lclusterbits) + m->clusterofs - map->m_la;return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 367/817 dlm: fix dlm_recover_members refcount on error
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Aring <[email protected]>
[ Upstream commit 200b977ebbc313a59174ba971006a231b3533dc5 ]
If dlm_recover_members() fails we don't drop the references of the previous created root_list that holds and keep all rsbs alive during the recovery. It might be not an unlikely event because ping_members() could run into an -EINTR if another recovery progress was triggered again.
--- fs/dlm/recoverd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/dlm/recoverd.c +1 -1
@@ -151,7 +151,7 @@ static int ls_recover(struct dlm_ls *ls, struct dlm_recover *rv) error =dlm_recover_members (ls, rv, &neg);if (error) {log_rinfo (ls,"dlm_recover_members error %d" , error); - goto fail; + goto fail_root_list; }dlm_recover_dir_nodeid (ls, &root_list);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 368/817 eth: fbnic: dont disable the PCI device twice
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 62e9c00ea868ceb71156c517747dc69316c25bf1 ]
We use pcim_enable_device(), there is no need to call pci_disable_device().
--- drivers/net/ethernet/meta/fbnic/fbnic_pci.c | 2 -- 1 file changed, 2 deletions(-)
drivers/net/ethernet/meta/fbnic/fbnic_pci.c +0 -2
@@ -319,7 +319,6 @@ static int fbnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent) free_irqs:fbnic_free_irqs (fbd); free_fbd: -pci_disable_device (pdev);fbnic_devlink_free (fbd);return err;
@@ -349,7 +348,6 @@ static void fbnic_remove(struct pci_dev *pdev)fbnic_fw_disable_mbx (fbd);fbnic_free_irqs (fbd); -pci_disable_device (pdev);fbnic_devlink_free (fbd); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 369/817 net: txgbe: remove GPIO interrupt controller
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiawen Wu <[email protected]>
[ Upstream commit e867ed3ac8aa50945170723a450b5c068a56339a ]
Since the GPIO interrupt controller is always not working properly, we need to constantly add workaround to cope with hardware deficiencies. So just remove GPIO interrupt controller, and let the SFP driver poll the GPIO status.
--- .../net/ethernet/wangxun/txgbe/txgbe_irq.c | 24 +-- .../net/ethernet/wangxun/txgbe/txgbe_main.c | 1 - .../net/ethernet/wangxun/txgbe/txgbe_phy.c | 166 ------------------ .../net/ethernet/wangxun/txgbe/txgbe_phy.h | 2 - .../net/ethernet/wangxun/txgbe/txgbe_type.h | 7 +- 5 files changed, 4 insertions(+), 196 deletions(-)
drivers/net/ethernet/wangxun/txgbe/txgbe_irq.c +2 -22
@@ -72,14 +72,6 @@ int txgbe_request_queue_irqs(struct wx *wx)return err; } -static int txgbe_request_gpio_irq (struct txgbe *txgbe) -{ - txgbe->gpio_irq =irq_find_mapping (txgbe->misc.domain,TXGBE_IRQ_GPIO ); -return request_threaded_irq (txgbe->gpio_irq,NULL , - txgbe_gpio_irq_handler, -IRQF_ONESHOT ,"txgbe-gpio-irq" , txgbe); -} -static int txgbe_request_link_irq (struct txgbe *txgbe) { txgbe->link_irq =irq_find_mapping (txgbe->misc.domain,TXGBE_IRQ_LINK );
@@ -149,11 +141,6 @@ static irqreturn_t txgbe_misc_irq_thread_fn(int irq, void *data)u32 eicr; eicr =wx_misc_isb (wx,WX_ISB_MISC ); -if (eicr &TXGBE_PX_MISC_GPIO ) { - sub_irq =irq_find_mapping (txgbe->misc.domain,TXGBE_IRQ_GPIO ); -handle_nested_irq (sub_irq); - nhandled++; - }if (eicr & (TXGBE_PX_MISC_ETH_LK |TXGBE_PX_MISC_ETH_LKDN |TXGBE_PX_MISC_ETH_AN )) { sub_irq =irq_find_mapping (txgbe->misc.domain,TXGBE_IRQ_LINK );
@@ -179,7 +166,6 @@ static void txgbe_del_irq_domain(struct txgbe *txgbe)void txgbe_free_misc_irq (struct txgbe *txgbe) { -free_irq (txgbe->gpio_irq, txgbe);free_irq (txgbe->link_irq, txgbe);free_irq (txgbe->misc.irq, txgbe);txgbe_del_irq_domain (txgbe);
@@ -191,7 +177,7 @@ int txgbe_setup_misc_irq(struct txgbe *txgbe)struct wx *wx = txgbe->wx;int hwirq, err; - txgbe->misc.nirqs =2 ; + txgbe->misc.nirqs =1 ; txgbe->misc.domain =irq_domain_add_simple (NULL , txgbe->misc.nirqs,0 , &txgbe_misc_irq_domain_ops, txgbe);if (!txgbe->misc.domain)
@@ -216,20 +202,14 @@ int txgbe_setup_misc_irq(struct txgbe *txgbe)if (err) goto del_misc_irq; - err =txgbe_request_gpio_irq (txgbe); -if (err) - goto free_msic_irq; - err =txgbe_request_link_irq (txgbe);if (err) - goto free_gpio_irq; + goto free_msic_irq; wx->misc_irq_domain = true;return 0 ; -free_gpio_irq: -free_irq (txgbe->gpio_irq, txgbe); free_msic_irq:free_irq (txgbe->misc.irq, txgbe); del_misc_irq:
drivers/net/ethernet/wangxun/txgbe/txgbe_main.c +0 -1
@@ -82,7 +82,6 @@ static void txgbe_up_complete(struct wx *wx) {struct net_device *netdev = wx->netdev; -txgbe_reinit_gpio_intr (wx);wx_control_hw (wx, true);wx_configure_vectors (wx);
drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c +0 -166
180 lines not on this page · raw message
drivers/net/ethernet/wangxun/txgbe/txgbe_phy.h +0 -2
@@ -4,8 +4,6 @@#ifndef _TXGBE_PHY_H_#define _TXGBE_PHY_H_ -irqreturn_t txgbe_gpio_irq_handler (int irq,void *data); -void txgbe_reinit_gpio_intr (struct wx *wx);irqreturn_t txgbe_link_irq_handler (int irq,void *data);int txgbe_init_phy (struct txgbe *txgbe);void txgbe_remove_phy (struct txgbe *txgbe);
drivers/net/ethernet/wangxun/txgbe/txgbe_type.h +2 -5
@@ -75,8 +75,7 @@#define TXGBE_PX_MISC_IEN_MASK \ (TXGBE_PX_MISC_ETH_LKDN | TXGBE_PX_MISC_DEV_RST | \ TXGBE_PX_MISC_ETH_EVENT | TXGBE_PX_MISC_ETH_LK | \ - TXGBE_PX_MISC_ETH_AN | TXGBE_PX_MISC_INT_ERR | \ - TXGBE_PX_MISC_GPIO) + TXGBE_PX_MISC_ETH_AN | TXGBE_PX_MISC_INT_ERR)/* Port cfg registers */ #define TXGBE_CFG_PORT_ST 0x14404
@@ -313,8 +312,7 @@ struct txgbe_nodes { };enum txgbe_misc_irqs { -TXGBE_IRQ_GPIO =0 , -TXGBE_IRQ_LINK , +TXGBE_IRQ_LINK =0 ,TXGBE_IRQ_MAX };
@@ -335,7 +333,6 @@ struct txgbe {struct clk_lookup *clock;struct clk *clk;struct gpio_chip *gpio; -unsigned int gpio_irq;unsigned int link_irq;/* flow director */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 370/817 net: txgbe: fix null pointer to pcs
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiawen Wu <[email protected]>
[ Upstream commit 2160428bcb20f2f70a72ee84aba91a1264dc4ff3 ]
For 1000BASE-X or SGMII interface mode, the PCS also need to be selected. Only return null pointer when there is a copper NIC with external PHY.
--- drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c +1 -1
@@ -162,7 +162,7 @@ static struct phylink_pcs *txgbe_phylink_mac_select(struct phylink_config *confistruct wx *wx =phylink_to_wx (config);struct txgbe *txgbe = wx->priv; -if (interface ==PHY_INTERFACE_MODE_10GBASER ) +if (wx->media_type != sp_media_copper)return &txgbe->xpcs->pcs;return NULL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 371/817 netpoll: Use rcu_access_pointer() in netpoll_poll_lock
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <[email protected]>
[ Upstream commit a57d5a72f8dec7db8a79d0016fb0a3bdecc82b56 ]
The ndev->npinfo pointer in netpoll_poll_lock() is RCU-protected but is being accessed directly for a NULL check. While no RCU read lock is held in this context, we should still use proper RCU primitives for consistency and correctness.
Replace the direct NULL check with rcu_access_pointer(), which is the appropriate primitive when only checking for NULL without dereferencing the pointer. This function provides the necessary ordering guarantees without requiring RCU read-side protection.
--- include/linux/netpoll.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/netpoll.h +1 -1
@@ -71,7 +71,7 @@ static inline void *netpoll_poll_lock(struct napi_struct *napi) {struct net_device *dev = napi->dev; -if (dev && dev->npinfo) { +if (dev &&rcu_access_pointer (dev->npinfo)) {int owner =smp_processor_id ();while (cmpxchg (&napi->poll_owner,-1 , owner) !=-1 )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 372/817 wireguard: selftests: load nf_conntrack if not present
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <[email protected]>
[ Upstream commit 0290abc9860917f1ee8b58309c2bbd740a39ee8e ]
Some distros may not load nf_conntrack by default, which will cause subsequent nf_conntrack sets to fail. Load this module if it is not already loaded.
--- tools/testing/selftests/wireguard/netns.sh | 1 + 1 file changed, 1 insertion(+)
tools/testing/selftests/wireguard/netns.sh +1 -0
@@ -332,6 +332,7 @@ waitiface $netns1 vethc waitiface $netns2 veths n0 bash -c 'printf 1 > /proc/sys/net/ipv4/ip_forward' +[[ -e /proc/sys/net/netfilter/nf_conntrack_udp_timeout ]] || modprobe nf_conntrack n0 bash -c 'printf 2 > /proc/sys/net/netfilter/nf_conntrack_udp_timeout' n0 bash -c 'printf 2 > /proc/sys/net/netfilter/nf_conntrack_udp_timeout_stream' n0 iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -d 10.0.0.0/24 -j SNAT --to 10.0.0.1
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 373/817 bpf: fix recursive lock when verdict program return SK_PASS
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <[email protected]>
[ Upstream commit 8ca2a1eeadf09862190b2810697702d803ceef2d ]
When the stream_verdict program returns SK_PASS, it places the received skb into its own receive queue, but a recursive lock eventually occurs, leading to an operating system deadlock. This issue has been present since v6.9.
'''sk_psock_strp_data_ready
write_lock_bh(&sk->sk_callback_lock)
strp_data_ready
strp_read_sock
read_sock -> tcp_read_sock
strp_recv
cb.rcv_msg -> sk_psock_strp_read
# now stream_verdict return SK_PASS without peer sock assign
__SK_PASS = sk_psock_map_verd(SK_PASS, NULL)
sk_psock_verdict_apply
sk_psock_skb_ingress_self
sk_psock_skb_ingress_enqueue
sk_psock_data_ready
read_lock_bh(&sk->sk_callback_lock) <= dead lock'''
This topic has been discussed before, but it has not been fixed. Previous discussion:
https://lore.kernel.org/all/[email protected]
--- net/core/skmsg.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/core/skmsg.c +2 -2
@@ -1117,9 +1117,9 @@ static void sk_psock_strp_data_ready(struct sock *sk)if (tls_sw_has_ctx_rx (sk)) { psock->saved_data_ready (sk); }else { -write_lock_bh (&sk->sk_callback_lock); +read_lock_bh (&sk->sk_callback_lock);strp_data_ready (&psock->strp); -write_unlock_bh (&sk->sk_callback_lock); +read_unlock_bh (&sk->sk_callback_lock); } }rcu_read_unlock ();
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 374/817 unicode: Fix utf8_load() error path
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: André Almeida <[email protected]>
[ Upstream commit 156bb2c569cd869583c593d27a5bd69e7b2a4264 ]
utf8_load() requests the symbol "utf8_data_table" and then checks if the requested UTF-8 version is supported. If it's unsupported, it tries to put the data table using symbol_put(). If an unsupported version is requested, symbol_put() fails like this:
kernel BUG at kernel/module/main.c:786!
RIP: 0010:__symbol_put+0x93/0xb0 Call Trace: <TASK> ? __die_body.cold+0x19/0x27 ? die+0x2e/0x50 ? do_trap+0xca/0x110 ? do_error_trap+0x65/0x80 ? __symbol_put+0x93/0xb0 ? exc_invalid_op+0x51/0x70 ? __symbol_put+0x93/0xb0 ? asm_exc_invalid_op+0x1a/0x20 ? __pfx_cmp_name+0x10/0x10 ? __symbol_put+0x93/0xb0 ? __symbol_put+0x62/0xb0 utf8_load+0xf8/0x150
That happens because symbol_put() expects the unique string that identify the symbol, instead of a pointer to the loaded symbol. Fix that by using such string.
--- fs/unicode/utf8-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/unicode/utf8-core.c +1 -1
@@ -198,7 +198,7 @@ struct unicode_map *utf8_load(unsigned int version)return um; out_symbol_put: -symbol_put (um->tables); +symbol_put (utf8_data_table); out_free_um:kfree (um);return ERR_PTR (-EINVAL );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 375/817 cppc_cpufreq: Use desired perf if feedback ctrs are 0 or unchanged
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jie Zhan <[email protected]>
[ Upstream commit c47195631960b626058c335aec31f186fa854f97 ]
The CPPC performance feedback counters could be 0 or unchanged when the target cpu is in a low-power idle state, e.g. power-gated or clock-gated.
When the counters are 0, cppc_cpufreq_get_rate() returns 0 KHz, which makes cpufreq_online() get a false error and fail to generate a cpufreq policy.
When the counters are unchanged, the existing cppc_perf_from_fbctrs() returns a cached desired perf, but some platforms may update the real frequency back to the desired perf reg.
For the above cases in cppc_cpufreq_get_rate(), get the latest desired perf from the CPPC reg to reflect the frequency because some platforms may update the actual frequency back there; if failed, use the cached desired perf.
--- drivers/cpufreq/cppc_cpufreq.c | 57 +++++++++++++++++++++++++++------- 1 file changed, 46 insertions(+), 11 deletions(-)
drivers/cpufreq/cppc_cpufreq.c +46 -11
@@ -118,6 +118,9 @@ static void cppc_scale_freq_workfn(struct kthread_work *work) perf =cppc_perf_from_fbctrs (cpu_data, &cppc_fi->prev_perf_fb_ctrs, &fb_ctrs); +if (!perf) +return ; + cppc_fi->prev_perf_fb_ctrs = fb_ctrs; perf <<=SCHED_CAPACITY_SHIFT ;
@@ -724,13 +727,31 @@ static int cppc_perf_from_fbctrs(struct cppc_cpudata *cpu_data, delta_delivered =get_delta (fb_ctrs_t1->delivered, fb_ctrs_t0->delivered); -/* Check to avoid divide-by zero and invalid delivered_perf */ +/* +* Avoid divide-by zero and unchanged feedback counters. +* Leave it for callers to handle. +*/ if (!delta_reference || !delta_delivered) -return cpu_data->perf_ctrls.desired_perf; +return 0 ;return (reference_perf * delta_delivered) / delta_reference; } +static int cppc_get_perf_ctrs_sample (int cpu, +struct cppc_perf_fb_ctrs *fb_ctrs_t0, +struct cppc_perf_fb_ctrs *fb_ctrs_t1) +{ +int ret; + + ret =cppc_get_perf_ctrs (cpu, fb_ctrs_t0); +if (ret) +return ret; + +udelay (2 );/* 2usec delay between sampling */ + +return cppc_get_perf_ctrs (cpu, fb_ctrs_t1); +} +static unsigned int cppc_cpufreq_get_rate (unsigned int cpu) {struct cppc_perf_fb_ctrs fb_ctrs_t0 = {0 }, fb_ctrs_t1 = {0 };
@@ -746,18 +767,32 @@ static unsigned int cppc_cpufreq_get_rate(unsigned int cpu)cpufreq_cpu_put (policy); - ret =cppc_get_perf_ctrs (cpu, &fb_ctrs_t0); -if (ret) -return 0 ; - -udelay (2 );/* 2usec delay between sampling */ - - ret =cppc_get_perf_ctrs (cpu, &fb_ctrs_t1); -if (ret) -return 0 ; + ret =cppc_get_perf_ctrs_sample (cpu, &fb_ctrs_t0, &fb_ctrs_t1); +if (ret) { +if (ret == -EFAULT ) +/* Any of the associated CPPC regs is 0. */ + goto out_invalid_counters; +else +return 0 ; + } delivered_perf =cppc_perf_from_fbctrs (cpu_data, &fb_ctrs_t0, &fb_ctrs_t1); +if (!delivered_perf) + goto out_invalid_counters; + +return cppc_perf_to_khz (&cpu_data->perf_caps, delivered_perf); + +out_invalid_counters: +/* +* Feedback counters could be unchanged or 0 when a cpu enters a +* low-power idle state, e.g. clock-gated or power-gated. +* Use desired perf for reflecting frequency. Get the latest register +* value first as some platforms may update the actual delivered perf +* there; if failed, resort to the cached desired perf. +*/ +if (cppc_get_desired_perf (cpu, &delivered_perf)) + delivered_perf = cpu_data->perf_ctrls.desired_perf;return cppc_perf_to_khz (&cpu_data->perf_caps, delivered_perf); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 376/817 RDMA/core: Provide rdma_user_mmap_disassociate() to disassociate mmap pages
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengchang Tang <[email protected]>
[ Upstream commit 51976c6cd786151b6a1bdf8b8b3334beac0ba99c ]
Provide a new api rdma_user_mmap_disassociate() for drivers to disassociate mmap pages for a device.
Since drivers can now disassociate mmaps by calling this api, introduce a new disassociation_lock to specifically prevent races between this disassociation process and new mmaps. And thus the old hw_destroy_rwsem is not needed in this api.
Stable-dep-of: 615b94746a54 ("RDMA/hns: Disassociate mmap pages for all uctx when HW is being reset")
--- drivers/infiniband/core/uverbs.h | 2 ++ drivers/infiniband/core/uverbs_main.c | 43 +++++++++++++++++++++++++-- include/rdma/ib_verbs.h | 8 +++++ 3 files changed, 51 insertions(+), 2 deletions(-)
drivers/infiniband/core/uverbs.h +2 -0
@@ -160,6 +160,8 @@ struct ib_uverbs_file {struct page *disassociate_page;struct xarray idr; + +struct mutex disassociation_lock; };struct ib_uverbs_event {
drivers/infiniband/core/uverbs_main.c +41 -2
105 lines not on this page · raw message
include/rdma/ib_verbs.h +8 -0
@@ -2948,6 +2948,14 @@ int rdma_user_mmap_entry_insert_range(struct ib_ucontext *ucontext, size_t length, u32 min_pgoff, u32 max_pgoff); +#if IS_ENABLED (CONFIG_INFINIBAND_USER_ACCESS ) +void rdma_user_mmap_disassociate (struct ib_device *device); +#else +static inline void rdma_user_mmap_disassociate (struct ib_device *device) +{ +} +#endif + static inline int rdma_user_mmap_entry_insert_exact(struct ib_ucontext *ucontext, struct rdma_user_mmap_entry *entry,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 377/817 RDMA/hns: Disassociate mmap pages for all uctx when HW is being reset
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengchang Tang <[email protected]>
[ Upstream commit 615b94746a54702af923b28bd8a629f4ac0ff0d8 ]
When HW is being reset, userspace should not ring doorbell otherwise it may lead to abnormal consequence such as RAS.
Disassociate mmap pages for all uctx to prevent userspace from ringing doorbell to HW. Since all resources will be destroyed during HW reset, no new mmap is allowed after HW reset is completed.
--- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 4 ++++ drivers/infiniband/hw/hns/hns_roce_main.c | 5 +++++ 2 files changed, 9 insertions(+)
drivers/infiniband/hw/hns/hns_roce_hw_v2.c +4 -0
@@ -7017,6 +7017,7 @@ static void hns_roce_hw_v2_uninit_instance(struct hnae3_handle *handle, handle->rinfo.instance_state =HNS_ROCE_STATE_NON_INIT ; } +static int hns_roce_hw_v2_reset_notify_down (struct hnae3_handle *handle) {struct hns_roce_dev *hr_dev;
@@ -7035,6 +7036,9 @@ static int hns_roce_hw_v2_reset_notify_down(struct hnae3_handle *handle) hr_dev->active = false; hr_dev->dis_db = true; + +rdma_user_mmap_disassociate (&hr_dev->ib_dev); + hr_dev->state =HNS_ROCE_DEVICE_STATE_RST_DOWN ;return 0 ;
drivers/infiniband/hw/hns/hns_roce_main.c +5 -0
@@ -466,6 +466,11 @@ static int hns_roce_mmap(struct ib_ucontext *uctx, struct vm_area_struct *vma)pgprot_t prot;int ret; +if (hr_dev->dis_db) { +atomic64_inc (&hr_dev->dfx_cnt[HNS_ROCE_DFX_MMAP_ERR_CNT ]); +return -EPERM ; + } + rdma_entry =rdma_user_mmap_entry_get_pgoff (uctx, vma->vm_pgoff);if (!rdma_entry) {atomic64_inc (&hr_dev->dfx_cnt[HNS_ROCE_DFX_MMAP_ERR_CNT ]);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 378/817 clk: mediatek: drop two dead config options
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Bulwahn <[email protected]>
[ Upstream commit 98619dc3cecc2b3943d6abe1db235c868dc72f8d ]
Commit 0f471d31e5e8 ("clk: mediatek: Split MT8195 clock drivers and allow module build") adds a number of new COMMON_CLK_MT8195_* config options. Among those, the config options COMMON_CLK_MT8195_AUDSYS and COMMON_CLK_MT8195_MSDC have no reference in the source tree and are not used in the Makefile to include a specific file.
Drop the dead config options COMMON_CLK_MT8195_AUDSYS and COMMON_CLK_MT8195_MSDC.
--- drivers/clk/mediatek/Kconfig | 15 --------------- 1 file changed, 15 deletions(-)
drivers/clk/mediatek/Kconfig +0 -15
@@ -887,13 +887,6 @@ config COMMON_CLK_MT8195_APUSYS help This driver supports MediaTek MT8195 AI Processor Unit System clocks. -config COMMON_CLK_MT8195_AUDSYS - tristate "Clock driver for MediaTek MT8195 audsys" - depends on COMMON_CLK_MT8195 - default COMMON_CLK_MT8195 - help - This driver supports MediaTek MT8195 audsys clocks. - config COMMON_CLK_MT8195_IMP_IIC_WRAP tristate "Clock driver for MediaTek MT8195 imp_iic_wrap" depends on COMMON_CLK_MT8195
@@ -908,14 +901,6 @@ config COMMON_CLK_MT8195_MFGCFG help This driver supports MediaTek MT8195 mfgcfg clocks. -config COMMON_CLK_MT8195_MSDC - tristate "Clock driver for MediaTek MT8195 msdc" - depends on COMMON_CLK_MT8195 - default COMMON_CLK_MT8195 - help - This driver supports MediaTek MT8195 MMC and SD Controller's - msdc and msdc_top clocks. - config COMMON_CLK_MT8195_SCP_ADSP tristate "Clock driver for MediaTek MT8195 scp_adsp" depends on COMMON_CLK_MT8195
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 379/817 trace/trace_event_perf: remove duplicate samples on the first tracepoint event
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Levi Yun <[email protected]>
[ Upstream commit afe5960dc208fe069ddaaeb0994d857b24ac19d1 ]
When a tracepoint event is created with attr.freq = 1, 'hwc->period_left' is not initialized correctly. As a result,
in the perf_swevent_overflow() function, when the first time the event occurs, it calculates the event overflow and the perf_swevent_set_period() returns 3, this leads to the event are recorded for three duplicate times.
Step to reproduce:
1. Enable the tracepoint event & starting tracing
$ echo 1 > /sys/kernel/tracing/events/module/module_free $ echo 1 > /sys/kernel/tracing/tracing_on
2. Record with perf
$ perf record -a --strict-freq -F 1 -e "module:module_free"
3. Trigger module_free event.
$ modprobe -i sunrpc
$ modprobe -r sunrpc
Result:
- Trace pipe result:
$ cat trace_pipe
modprobe-174509 [003] ..... 6504.868896: module_free: sunrpc
- perf sample:
modprobe 174509 [003] 6504.868980: module:module_free: sunrpc
modprobe 174509 [003] 6504.868980: module:module_free: sunrpc
modprobe 174509 [003] 6504.868980: module:module_free: sunrpcBy setting period_left via perf_swevent_set_period() as other sw_event did, This problem could be solved.
After patch:
- Trace pipe result:
$ cat trace_pipe
modprobe 1153096 [068] 613468.867774: module:module_free: xfs
- perf sample
modprobe 1153096 [068] 613468.867794: module:module_free: xfs
--- kernel/trace/trace_event_perf.c | 6 ++++++ 1 file changed, 6 insertions(+)
kernel/trace/trace_event_perf.c +6 -0
@@ -352,10 +352,16 @@ void perf_uprobe_destroy(struct perf_event *p_event)int perf_trace_add (struct perf_event *p_event,int flags) {struct trace_event_call *tp_event = p_event->tp_event; +struct hw_perf_event *hwc = &p_event->hw;if (!(flags &PERF_EF_START )) p_event->hw.state =PERF_HES_STOPPED ; +if (is_sampling_event (p_event)) { + hwc->last_period = hwc->sample_period; +perf_swevent_set_period (p_event); + } +/* * If TRACE_REG_PERF_ADD returns false; no custom action was performed * and we need to take the default action of enqueueing our event on
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 380/817 pinctrl: zynqmp: drop excess struct member description
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <[email protected]>
[ Upstream commit 2a85fc7044987d751f27d7f1e4423eebbcecc2c6 ]
The 'node' member has never been part of this structure so drop its description.
--- drivers/pinctrl/pinctrl-zynqmp.c | 1 - 1 file changed, 1 deletion(-)
drivers/pinctrl/pinctrl-zynqmp.c +0 -1
@@ -49,7 +49,6 @@* @name: Name of the pin mux function * @groups: List of pin groups for this function * @ngroups: Number of entries in @groups -* @node: Firmware node matching with the function * * This structure holds information about pin control function * and function group names supporting that function.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 381/817 pinctrl: renesas: Select PINCTRL_RZG2L for RZ/V2H(P) SoC
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lad Prabhakar <[email protected]>
[ Upstream commit 5dcde519a067ac5c85c273e550dde1873e2199bf ]
Add explicit selection of the PINCTRL_RZG2L config option for the RZ/V2H(P) (R9A09G057) SoC, ensuring pin control driver is enabled for this SoC.
--- drivers/pinctrl/renesas/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/pinctrl/renesas/Kconfig +1 -0
@@ -41,6 +41,7 @@ config PINCTRL_RENESAS select PINCTRL_PFC_R8A779H0 if ARCH_R8A779H0 select PINCTRL_RZG2L if ARCH_RZG2L select PINCTRL_RZV2M if ARCH_R9A09G011 + select PINCTRL_RZG2L if ARCH_R9A09G057 select PINCTRL_PFC_SH7203 if CPU_SUBTYPE_SH7203 select PINCTRL_PFC_SH7264 if CPU_SUBTYPE_SH7264 select PINCTRL_PFC_SH7269 if CPU_SUBTYPE_SH7269
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 382/817 clk: qcom: videocc-sm8550: depend on either gcc-sm8550 or gcc-sm8650
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Marek <[email protected]>
[ Upstream commit aab8d53711346d5569261aec9702b7579eecf1ab ]
This driver is compatible with both sm8550 and sm8650, fix the Kconfig entry to reflect that.
--- drivers/clk/qcom/Kconfig | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/clk/qcom/Kconfig +2 -2
@@ -1203,11 +1203,11 @@ config SM_VIDEOCC_8350 config SM_VIDEOCC_8550 tristate "SM8550 Video Clock Controller" depends on ARM64 || COMPILE_TEST - select SM_GCC_8550 + depends on SM_GCC_8550 || SM_GCC_8650 select QCOM_GDSC help Support for the video clock controller on Qualcomm Technologies, Inc. - SM8550 devices. + SM8550 or SM8650 devices. Say Y if you want to support video devices and functionality such as video encode/decode.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 383/817 iommu/s390: Implement blocking domain
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Rosato <[email protected]>
[ Upstream commit ecda483339a5151e3ca30d6b82691ef6f1d17912 ]
This fixes a crash when surprise hot-unplugging a PCI device. This crash happens because during hot-unplug __iommu_group_set_domain_nofail() attaching the default domain fails when the platform no longer recognizes the device as it has already been removed and we end up with a NULL domain pointer and UAF. This is exactly the case referred to in the second comment in __iommu_device_set_domain() and just as stated there if we can instead attach the blocking domain the UAF is prevented as this can handle the already removed device. Implement the blocking domain to use this handling. With this change, the crash is fixed but we still hit a warning attempting to change DMA ownership on a blocked device.
--- arch/s390/include/asm/pci.h | 4 +- arch/s390/pci/pci.c | 3 ++ arch/s390/pci/pci_debug.c | 10 ++++- drivers/iommu/s390-iommu.c | 73 +++++++++++++++++++++++-------------- 4 files changed, 59 insertions(+), 31 deletions(-)
arch/s390/include/asm/pci.h +2 -2
@@ -96,7 +96,6 @@ struct zpci_bar_struct {u8 size;/* order 2 exponent */ }; -struct s390_domain ;struct kvm_zdev ;#define ZPCI_FUNCTIONS_PER_BUS 256
@@ -181,9 +180,10 @@ struct zpci_dev {struct dentry *debugfs_dev;/* IOMMU and passthrough */ -struct s390_domain *s390_domain;/* s390 IOMMU domain data */ +struct iommu_domain *s390_domain;/* attached IOMMU domain */ struct kvm_zdev *kzdev;struct mutex kzdev_lock; +spinlock_t dom_lock;/* protect s390_domain change */ };static inline bool zdev_enabled (struct zpci_dev *zdev)
arch/s390/pci/pci.c +3 -0
@@ -160,6 +160,7 @@ int zpci_fmb_enable_device(struct zpci_dev *zdev)u64 req =ZPCI_CREATE_REQ (zdev->fh,0 ,ZPCI_MOD_FC_SET_MEASURE );struct zpci_iommu_ctrs *ctrs;struct zpci_fib fib = {0 }; +unsigned long flags;u8 cc, status;if (zdev->fmb ||sizeof (*zdev->fmb) < zdev->fmb_length)
@@ -171,6 +172,7 @@ int zpci_fmb_enable_device(struct zpci_dev *zdev)WARN_ON ((u64 ) zdev->fmb &0xf );/* reset software counters */ +spin_lock_irqsave (&zdev->dom_lock, flags); ctrs =zpci_get_iommu_ctrs (zdev);if (ctrs) {atomic64_set (&ctrs->mapped_pages,0 );
@@ -179,6 +181,7 @@ int zpci_fmb_enable_device(struct zpci_dev *zdev)atomic64_set (&ctrs->sync_map_rpcits,0 );atomic64_set (&ctrs->sync_rpcits,0 ); } +spin_unlock_irqrestore (&zdev->dom_lock, flags); fib.fmb_addr =virt_to_phys (zdev->fmb);
arch/s390/pci/pci_debug.c +8 -2
@@ -71,17 +71,23 @@ static void pci_fmb_show(struct seq_file *m, char *name[], int length,static void pci_sw_counter_show (struct seq_file *m) { -struct zpci_iommu_ctrs *ctrs =zpci_get_iommu_ctrs (m->private); +struct zpci_dev *zdev = m->private; +struct zpci_iommu_ctrs *ctrs;atomic64_t *counter; +unsigned long flags;int i; +spin_lock_irqsave (&zdev->dom_lock, flags); + ctrs =zpci_get_iommu_ctrs (m->private);if (!ctrs) -return ; + goto unlock; counter = &ctrs->mapped_pages;for (i =0 ; i <ARRAY_SIZE (pci_sw_names); i++, counter++)seq_printf (m,"%26s:\t%llu\n" , pci_sw_names[i],atomic64_read (counter)); +unlock: +spin_unlock_irqrestore (&zdev->dom_lock, flags); }static int pci_perf_show (struct seq_file *m,void *v)
drivers/iommu/s390-iommu.c +46 -27
131 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 384/817 scsi: hisi_sas: Enable all PHYs that are not disabled by user during controller reset
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yihang Li <[email protected]>
[ Upstream commit 08a07dc71d7fc6f58c35c4fc0bcede2811c5aa4c ]
For the controller reset operation(such as FLR or clear nexus ha in SCSI EH), we will disable all PHYs and then enable PHY based on the hisi_hba->phy_state obtained in hisi_sas_controller_reset_prepare(). If the device is removed before controller reset or the PHY is not attached to any device in directly attached scenario, the corresponding bit of phy_state is not set. After controller reset done, the PHY is disabled. The device cannot be identified even if user reconnect the disk.
Therefore, for PHYs that are not disabled by user, hisi_sas_phy_enable() needs to be executed even if the corresponding bit of phy_state is not set.
--- drivers/scsi/hisi_sas/hisi_sas_main.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/scsi/hisi_sas/hisi_sas_main.c +7 -1
@@ -1545,10 +1545,16 @@ void hisi_sas_controller_reset_done(struct hisi_hba *hisi_hba)/* Init and wait for PHYs to come up and all libsas event finished. */ for (phy_no =0 ; phy_no < hisi_hba->n_phy; phy_no++) {struct hisi_sas_phy *phy = &hisi_hba->phy[phy_no]; +struct asd_sas_phy *sas_phy = &phy->sas_phy; -if (!(hisi_hba->phy_state &BIT (phy_no))) +if (!sas_phy->phy->enabled)continue ; +if (!(hisi_hba->phy_state &BIT (phy_no))) { +hisi_sas_phy_enable (hisi_hba, phy_no,1 ); +continue ; + } +async_schedule_domain (hisi_sas_async_init_wait_phyup, phy, &async); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 385/817 powerpc/vdso: Flag VDSO64 entry points as functions
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit 0161bd38c24312853ed5ae9a425a1c41c4ac674a ]
On powerpc64 as shown below by readelf, vDSO functions symbols have type NOTYPE.
$ powerpc64-linux-gnu-readelf -a arch/powerpc/kernel/vdso/vdso64.so.dbg ELF Header: Magic: 7f 45 4c 46 02 02 01 00 00 00 00 00 00 00 00 00 Class: ELF64 Data: 2's complement, big endian Version: 1 (current) OS/ABI: UNIX - System V ABI Version: 0 Type: DYN (Shared object file) Machine: PowerPC64 Version: 0x1 ...
Symbol table '.dynsym' contains 12 entries:
Num: Value Size Type Bind Vis Ndx Name
...
1: 0000000000000524 84 NOTYPE GLOBAL DEFAULT 8 __[...]@@LINUX_2.6.15
...
4: 0000000000000000 0 OBJECT GLOBAL DEFAULT ABS LINUX_2.6.15
5: 00000000000006c0 48 NOTYPE GLOBAL DEFAULT 8 __[...]@@LINUX_2.6.15Symbol table '.symtab' contains 56 entries:
Num: Value Size Type Bind Vis Ndx Name
...
45: 0000000000000000 0 OBJECT GLOBAL DEFAULT ABS LINUX_2.6.15
46: 00000000000006c0 48 NOTYPE GLOBAL DEFAULT 8 __kernel_getcpu
47: 0000000000000524 84 NOTYPE GLOBAL DEFAULT 8 __kernel_clock_getresTo overcome that, commit ba83b3239e65 ("selftests: vDSO: fix vDSO symbols lookup for powerpc64") was applied to have selftests also look for NOTYPE symbols, but the correct fix should be to flag VDSO entry points as functions.
The original commit that brought VDSO support into powerpc/64 has the following explanation:
Note that the symbols exposed by the vDSO aren't "normal" function symbols, apps can't be expected to link against them directly, the vDSO's are both seen as if they were linked at 0 and the symbols just contain offsets to the various functions. This is done on purpose to avoid a relocation step (ppc64 functions normally have descriptors with abs addresses in them). When glibc uses those functions, it's expected to use it's own trampolines that know how to reach them.
The descriptors it's talking about are the OPD function descriptors used on ABI v1 (big endian). But it would be more correct for a text symbol to have type function, even if there's no function descriptor for it.
glibc has a special case already for handling the VDSO symbols which creates a fake opd pointing at the kernel symbol. So changing the VDSO symbol type to function shouldn't affect that.
For ABI v2, there is no function descriptors and VDSO functions can safely have function type.
So lets flag VDSO entry points as functions and revert the selftest change.
--- arch/powerpc/include/asm/vdso.h | 1 + tools/testing/selftests/vDSO/parse_vdso.c | 3 +-- 2 files changed, 2 insertions(+), 2 deletions(-)
arch/powerpc/include/asm/vdso.h +1 -0
@@ -25,6 +25,7 @@ int vdso_getcpu_init(void);#ifdef __VDSO64__#define V_FUNCTION_BEGIN (name) \ .globl name; \ + .type name,@function; \ name: \#define V_FUNCTION_END (name) \
tools/testing/selftests/vDSO/parse_vdso.c +1 -2
@@ -222,8 +222,7 @@ void *vdso_sym(const char *version, const char *name)ELF (Sym) *sym = &vdso_info.symtab[chain];/* Check for a defined global or weak function w/ right name. */ -if (ELF64_ST_TYPE (sym->st_info) !=STT_FUNC && -ELF64_ST_TYPE (sym->st_info) !=STT_NOTYPE ) +if (ELF64_ST_TYPE (sym->st_info) !=STT_FUNC )continue ;if (ELF64_ST_BIND (sym->st_info) !=STB_GLOBAL &&ELF64_ST_BIND (sym->st_info) !=STB_WEAK )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 386/817 mfd: tps65010: Use IRQF_NO_AUTOEN flag in request_irq() to fix race
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 2174f9a8c9db50f74df769edd5a4ab822c73b6d2 ]
As the comment said, disable_irq() after request_irq() still has a time gap in which interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will disable IRQ auto-enable when request IRQ.
--- drivers/mfd/tps65010.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
drivers/mfd/tps65010.c +2 -6
@@ -544,17 +544,13 @@ static int tps65010_probe(struct i2c_client *client)*/ if (client->irq >0 ) { status =request_irq (client->irq, tps65010_irq, -IRQF_TRIGGER_FALLING ,DRIVER_NAME , tps); +IRQF_TRIGGER_FALLING |IRQF_NO_AUTOEN , +DRIVER_NAME , tps);if (status <0 ) {dev_dbg (&client->dev,"can't get IRQ %d, err %d\n" , client->irq, status);return status; } -/* annoying race here, ideally we'd have an option -* to claim the irq now and enable it later. -* FIXME genirq IRQF_NOAUTOEN now solves that ... -*/ -disable_irq (client->irq);set_bit (FLAG_IRQ_ENABLE , &tps->flags); }else dev_warn (&client->dev,"IRQ not configured!\n" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 387/817 mfd: da9052-spi: Change read-mask to write-mask
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marcus Folkesson <[email protected]>
[ Upstream commit 2e3378f6c79a1b3f7855ded1ef306ea4406352ed ]
Driver has mixed up the R/W bit.
The LSB bit is set on write rather than read.
Change it to avoid nasty things to happen.
--- drivers/mfd/da9052-spi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mfd/da9052-spi.c +1 -1
@@ -37,7 +37,7 @@ static int da9052_spi_probe(struct spi_device *spi)spi_set_drvdata (spi, da9052); config = da9052_regmap_config; - config.read_flag_mask =1 ; + config.write_flag_mask =1 ; config.reg_bits =7 ; config.pad_bits =1 ; config.val_bits =8 ;
Signature · 1 line
2.43.0