6.12.16-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 6.12.16-rc1 review
This is the start of the stable review cycle for the 6.12.16 release. There are 230 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 21 Feb 2025 08:25:11 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.16-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.12.16-rc1
Greg Kroah-Hartman <[email protected]>
Revert "vfio/platform: check the bounds of read/write syscalls"
Michal Luczaj <[email protected]>
vsock: Orphan socket after transport release
Michal Luczaj <[email protected]>
vsock: Keep the binding until socket destruction
Pavel Begunkov <[email protected]>
io_uring/kbuf: reallocate buf lists on upgrade
Avri Altman <[email protected]>
scsi: ufs: core: Ensure clk_gating.lock is used only after initialization
Jakub Kicinski <[email protected]>
net: ipv6: fix dst refleaks in rpl, seg6 and ioam6 lwtunnels
Dhananjay Ugwekar <[email protected]>
cpufreq/amd-pstate: Remove the goto label in amd_pstate_update_limits
Ping-Ke Shih <[email protected]>
wifi: rtw89: pci: disable PCIE wake bit when PCIE deinit
Jiri Olsa <[email protected]>
selftests/bpf: Fix uprobe consumer test
Jason Xing <[email protected]>
bpf: handle implicit declaration of function gettid in bpf_iter.c
Andrew Cooper <[email protected]>
x86/static-call: Remove early_boot_irqs_disabled check to fix Xen PVH dom0
Juri Lelli <[email protected]>
sched/deadline: Check bandwidth overflow earlier for hotplug
Juri Lelli <[email protected]>
sched/deadline: Correctly account for allocated bandwidth during hotplug
Juri Lelli <[email protected]>
sched/deadline: Restore dl_server bandwidth on non-destructive root domain changes
Hangbin Liu <[email protected]>
selftests: rtnetlink: update netdevsim ipsec output format
Hangbin Liu <[email protected]>
netdevsim: print human readable IP address
Chris Brandt <[email protected]>
drm: renesas: rz-du: Increase supported resolutions
Thomas Hellström <[email protected]>
drm/xe/tracing: Fix a potential TP_printk UAF
Christian Gmeiner <[email protected]>
drm/v3d: Stop active perfmon if it is being destroyed
Dmitry Baryshkov <[email protected]>
drm/msm/dpu1: don't choke on disabling the writeback connector
Stephan Gerhold <[email protected]>
drm/msm/dpu: fix x1e80100 intf_6 underrun/vsync interrupt
Tomi Valkeinen <[email protected]>
drm/rcar-du: dsi: Fix PHY lock bit check
Dan Carpenter <[email protected]>
drm/msm/gem: prevent integer overflow in msm_ioctl_gem_submit()
Devarsh Thakkar <[email protected]>
drm/tidss: Clear the interrupt status for interrupts being disabled
Devarsh Thakkar <[email protected]>
drm/tidss: Fix race condition while handling interrupt registers
Tomi Valkeinen <[email protected]>
drm/tidss: Fix issue in irq handling causing irq-flood issue
Eric Dumazet <[email protected]>
ipv6: mcast: add RCU protection to mld_newpack()
Filipe Manana <[email protected]>
btrfs: fix stale page cache after race between readahead and direct IO write
David Sterba <[email protected]>
btrfs: rename __get_extent_map() and pass btrfs_inode
Eric Dumazet <[email protected]>
ipv6: mcast: extend RCU protection in igmp6_send()
Eric Dumazet <[email protected]>
ndisc: extend RCU protection in ndisc_send_skb()
Eric Dumazet <[email protected]>
openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
Eric Dumazet <[email protected]>
arp: use RCU protection in arp_xmit()
Eric Dumazet <[email protected]>
neighbour: use RCU protection in __neigh_notify()
Eric Dumazet <[email protected]>
ndisc: use RCU protection in ndisc_alloc_skb()
Vicki Pfau <[email protected]>
HID: hid-steam: Move hidraw input (un)registering to work
Vicki Pfau <[email protected]>
HID: hid-steam: Make sure rumble work is canceled on removal
Eric Dumazet <[email protected]>
ipv6: icmp: convert to dev_net_rcu()
Eric Dumazet <[email protected]>
ipv6: use RCU protection in ip6_default_advmss()
Eric Dumazet <[email protected]>
flow_dissector: use RCU protection to fetch dev_net()
Eric Dumazet <[email protected]>
ipv4: icmp: convert to dev_net_rcu()
Eric Dumazet <[email protected]>
ipv4: use RCU protection in __ip_rt_update_pmtu()
Vladimir Vdovin <[email protected]>
net: ipv4: Cache pmtu for all packet paths if multipath enabled
Eric Dumazet <[email protected]>
ipv4: use RCU protection in inet_select_addr()
Eric Dumazet <[email protected]>
ipv4: use RCU protection in rt_is_expired()
Eric Dumazet <[email protected]>
ipv4: use RCU protection in ipv4_default_advmss()
Eric Dumazet <[email protected]>
net: add dev_net_rcu() helper
Eric Dumazet <[email protected]>
ipv4: use RCU protection in ip_dst_mtu_maybe_forward()
Eric Dumazet <[email protected]>
ipv4: add RCU protection to ip4_dst_hoplimit()
Dhananjay Ugwekar <[email protected]>
cpufreq/amd-pstate: Fix cpufreq_policy ref counting
Mario Limonciello <[email protected]>
cpufreq/amd-pstate: convert mutex use to guard()
Dhananjay Ugwekar <[email protected]>
cpufreq/amd-pstate: Merge amd_pstate_epp_cpu_offline() and amd_pstate_epp_offline()
Dhananjay Ugwekar <[email protected]>
cpufreq/amd-pstate: Remove the cppc_state check in offline/online functions
Dhananjay Ugwekar <[email protected]>
cpufreq/amd-pstate: Refactor amd_pstate_epp_reenable() and amd_pstate_epp_offline()
Dhananjay Ugwekar <[email protected]>
cpufreq/amd-pstate: Align offline flow of shared memory and MSR based systems
Dhananjay Ugwekar <[email protected]>
cpufreq/amd-pstate: Call cppc_set_epp_perf in the reenable function
Justin M. Forbes <[email protected]>
rust: kbuild: add -fzero-init-padding-bits to bindgen_skip_cflags
Avri Altman <[email protected]>
scsi: ufs: Fix toggling of clk_gating.state when clock gating is not allowed
Avri Altman <[email protected]>
scsi: ufs: core: Introduce a new clock_gating lock
Avri Altman <[email protected]>
scsi: ufs: core: Prepare to introduce a new clock_gating lock
Avri Altman <[email protected]>
scsi: ufs: core: Introduce ufshcd_has_pending_tasks()
Waiman Long <[email protected]>
clocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic context
Waiman Long <[email protected]>
clocksource: Use pr_info() for "Checking clocksource synchronization" message
Jakub Kicinski <[email protected]>
net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels
Justin Iurman <[email protected]>
net: ipv6: rpl_iptunnel: mitigate 2-realloc issue
Justin Iurman <[email protected]>
net: ipv6: seg6_iptunnel: mitigate 2-realloc issue
Justin Iurman <[email protected]>
net: ipv6: ioam6_iptunnel: mitigate 2-realloc issue
Justin Iurman <[email protected]>
include: net: add static inline dst_dev_overhead() to dst.h
Filipe Manana <[email protected]>
btrfs: fix hole expansion when writing at an offset beyond EOF
Wentao Liang <[email protected]>
mlxsw: Add return value check for mlxsw_sp_port_get_stats_raw()
Shyam Prasad N <[email protected]>
cifs: pick channels for individual subrequests
Song Yoong Siang <[email protected]>
igc: Set buffer type for empty frames in igc_init_empty_frame
Andy-ld Lu <[email protected]>
mmc: mtk-sd: Fix register settings for hs400(es) mode
Nathan Chancellor <[email protected]>
arm64: Handle .ARM.attributes section in linker scripts
Jiasheng Jiang <[email protected]>
regmap-irq: Add missing kfree()
Lu Baolu <[email protected]>
iommu: Fix potential memory leak in iopf_queue_remove_device()
Varadarajan Narayanan <[email protected]>
regulator: qcom_smd: Add l2, l5 sub-node to mp5496 regulator
Tejun Heo <[email protected]>
sched_ext: Fix incorrect autogroup migration detection
Jann Horn <[email protected]>
partitions: mac: fix handling of bogus partition table
Wentao Liang <[email protected]>
gpio: stmpe: Check return value of stmpe_reg_read in stmpe_gpio_irq_sync_unlock
Mario Limonciello <[email protected]>
gpiolib: acpi: Add a quirk for Acer Nitro ANV14
Niklas Schnelle <[email protected]>
s390/pci: Fix handling of isolated VFs
Niklas Schnelle <[email protected]>
s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn()
Ivan Kokshaysky <[email protected]>
alpha: align stack for page fault and user unaligned trap handlers
Ivan Kokshaysky <[email protected]>
alpha: replace hardcoded stack offsets with autogenerated ones
John Keeping <[email protected]>
serial: 8250: Fix fifo underflow on flush
Andy Shevchenko <[email protected]>
serial: port: Always update ->iotype in __uart_read_properties()
Andy Shevchenko <[email protected]>
serial: port: Assign ->iotype correctly when ->iobase is set
Shakeel Butt <[email protected]>
cgroup: fix race between fork and cgroup.kill
Miguel Ojeda <[email protected]>
rust: rbtree: fix overindented list item
Miguel Ojeda <[email protected]>
objtool/rust: add one more noreturn Rust function
Miguel Ojeda <[email protected]>
arm64: rust: clean Rust 1.85.0 warning using softfloat target
Ard Biesheuvel <[email protected]>
efi: Avoid cold plugged memory for placing the kernel
Thomas Weißschuh <[email protected]>
kbuild: userprogs: fix bitsize and target detection on clang
Bjorn Helgaas <[email protected]>
PCI: Avoid FLR for Mediatek MT7922 WiFi
Aditya Kumar Singh <[email protected]>
wifi: ath12k: fix handling of 6 GHz rules
Ivan Kokshaysky <[email protected]>
alpha: make stack 16-byte aligned (most cases)
Vincent Mailhol <[email protected]>
can: etas_es58x: fix potential NULL pointer dereference on udev->serial
Robin van der Gracht <[email protected]>
can: rockchip: rkcanfd_handle_rx_fifo_overflow_int(): bail out if skb cannot be allocated
Alexander Hölzl <[email protected]>
can: j1939: j1939_sk_send_loop(): fix unable to send messages with data length zero
Krzysztof Kozlowski <[email protected]>
can: c_can: fix unbalanced runtime PM disable in error path
Fedor Pchelkin <[email protected]>
can: ctucanfd: handle skb allocation failure
Johan Hovold <[email protected]>
USB: serial: option: drop MeiG Smart defines
Fabio Porcedda <[email protected]>
USB: serial: option: fix Telit Cinterion FN990A name
Fabio Porcedda <[email protected]>
USB: serial: option: add Telit Cinterion FN990B compositions
Chester A. Unal <[email protected]>
USB: serial: option: add MeiG Smart SLM828
Roy Luo <[email protected]>
usb: gadget: core: flush gadget workqueue after device removal
Jann Horn <[email protected]>
usb: cdc-acm: Fix handling of oversized fragments
Jann Horn <[email protected]>
usb: cdc-acm: Check control transfer buffer size before access
Marek Vasut <[email protected]>
USB: cdc-acm: Fill in Renesas R-Car D3 USB Download mode quirk
Alan Stern <[email protected]>
USB: hub: Ignore non-compliant devices with too many configs or interfaces
John Keeping <[email protected]>
usb: gadget: f_midi: fix MIDI Streaming descriptor lengths
Mathias Nyman <[email protected]>
USB: Add USB_QUIRK_NO_LPM quirk for sony xperia xz1 smartphone
Lei Huang <[email protected]>
USB: quirks: add USB_QUIRK_NO_LPM quirk for Teclast dist
Stefan Eichenberger <[email protected]>
usb: core: fix pipe creation for get_bMaxPacketSize0
Huacai Chen <[email protected]>
USB: pci-quirks: Fix HCCPARAMS register error for LS7A EHCI
Michal Pecio <[email protected]>
usb: xhci: Restore xhci_pci support for Renesas HCs
Fabrice Gasnier <[email protected]>
usb: dwc2: gadget: remove of_node reference upon udc_stop
Guo Ren <[email protected]>
usb: gadget: udc: renesas_usb3: Fix compiler warning
Elson Roy Serrao <[email protected]>
usb: roles: set switch registered flag early on
Selvarasu Ganesan <[email protected]>
usb: dwc3: Fix timeout issue during controller enter/exit from halt state
Selvarasu Ganesan <[email protected]>
usb: gadget: f_midi: Fixing wMaxPacketSize exceeded issue during MIDI bind retries
Steven Rostedt <[email protected]>
ring-buffer: Update pages_touched to reflect persistent buffer content
Steven Rostedt <[email protected]>
ring-buffer: Validate the persistent meta data subbuf array
Steven Rostedt <[email protected]>
tracing: Do not allow mmap() of persistent ring buffer
Steven Rostedt <[email protected]>
ring-buffer: Unlock resize on mmap error
Sean Christopherson <[email protected]>
perf/x86/intel: Ensure LBRs are disabled when a CPU is starting
Kan Liang <[email protected]>
perf/x86/intel: Fix ARCH_PERFMON_NUM_COUNTER_LEAF
Sean Christopherson <[email protected]>
KVM: nSVM: Enter guest mode before initializing nested NPT MMU
Sean Christopherson <[email protected]>
KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop
Sean Christopherson <[email protected]>
KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel
Jiang Liu <[email protected]>
drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table()
Alex Deucher <[email protected]>
drm/amdgpu: bump version for RV/PCO compute fix
Alex Deucher <[email protected]>
drm/amdgpu/gfx9: manually control gfxoff for CS on RV
Sven Eckelmann <[email protected]>
batman-adv: Drop unmanaged ELP metric worker
Sven Eckelmann <[email protected]>
batman-adv: Ignore neighbor throughput metrics in error case
Andy Strohman <[email protected]>
batman-adv: fix panic during interface removal
Kees Cook <[email protected]>
kbuild: Use -fzero-init-padding-bits=all
Hans de Goede <[email protected]>
ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10 tablet 5V
Masahiro Yamada <[email protected]>
kbuild: suppress stdout from merge_config for silent builds
Mike Marshall <[email protected]>
orangefs: fix a oob in orangefs_debug_write
Rik van Riel <[email protected]>
x86/mm/tlb: Only trim the mm_cpumask once a second
Hans de Goede <[email protected]>
ACPI: x86: Add skip i2c clients quirk for Vexia EDU ATLA 10 tablet 5V
Koichiro Den <[email protected]>
selftests: gpio: gpio-sim: Fix missing chip disablements
Maksym Planeta <[email protected]>
Grab mm lock before grabbing pt lock
Konstantin Komarov <[email protected]>
fs/ntfs3: Unify inode corruption marking with _ntfs_bad_inode()
Ankit Agrawal <[email protected]>
vfio/nvgrace-gpu: Expose the blackwell device PF BAR1 to the VM
Ankit Agrawal <[email protected]>
vfio/nvgrace-gpu: Read dvsec register to determine need for uncached resmem
Zichen Xie <[email protected]>
NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client()
Ramesh Thomas <[email protected]>
vfio/pci: Enable iowrite64 and ioread64 for vfio pci
Brian Norris <[email protected]>
kunit: platform: Resolve 'struct completion' warning
Rengarajan S <[email protected]>
8250: microchip: pci1xxxx: Add workaround for RTS bit toggle
Andy Shevchenko <[email protected]>
serial: 8250_pci: Share WCH IDs with parport_serial driver
Andy Shevchenko <[email protected]>
serial: 8250_pci: Resolve WCH vendor ID ambiguity
Tomas Glozar <[email protected]>
rtla/timerlat_top: Abort event processing on second signal
Tomas Glozar <[email protected]>
rtla/timerlat_hist: Abort event processing on second signal
Guixin Liu <[email protected]>
scsi: ufs: bsg: Set bsg_queue to NULL after removal
Rakesh Babu Saladi <[email protected]>
PCI: switchtec: Add Microchip PCI100X device IDs
Takashi Iwai <[email protected]>
PCI/DPC: Quirk PIO log size for Intel Raptor Lake-P
Edward Adam Davis <[email protected]>
media: vidtv: Fix a null-ptr-deref in vidtv_mux_stop_thread
Isaac Scott <[email protected]>
media: uvcvideo: Add Kurokesu C1 PRO camera
Isaac Scott <[email protected]>
media: uvcvideo: Add new quirk definition for the Sonix Technology Co. 292a camera
Isaac Scott <[email protected]>
media: uvcvideo: Implement dual stream quirk to fix loss of usb packets
Naushir Patuck <[email protected]>
media: bcm2835-unicam: Disable trigger mode operation
Tomi Valkeinen <[email protected]>
media: i2c: ds90ub953: Add error handling for i2c reads/writes
Tomi Valkeinen <[email protected]>
media: i2c: ds90ub913: Add error handling to ub913_hw_init()
Arnd Bergmann <[email protected]>
media: cxd2841er: fix 64-bit division on gcc-9
Jarkko Nikula <[email protected]>
i3c: mipi-i3c-hci: Add support for MIPI I3C HCI on PCI bus
Jarkko Nikula <[email protected]>
i3c: mipi-i3c-hci: Add Intel specific quirk to ring resuming
Kartik Rajput <[email protected]>
soc/tegra: fuse: Update Tegra234 nvmem keepout list
Aaro Koskinen <[email protected]>
fbdev: omap: use threaded IRQ for LCD DMA
Krzysztof Kozlowski <[email protected]>
firmware: qcom: scm: smc: Handle missing SCM device
Michael Margolin <[email protected]>
RDMA/efa: Reset device on probe failure
Masahiro Yamada <[email protected]>
tools: fix annoying "mkdir -p ..." logs when building tools in parallel
Vasant Hegde <[email protected]>
iommu/amd: Expicitly enable CNTRL.EPHEn bit in resume path
Andy Shevchenko <[email protected]>
gpiolib: Fix crash on error in gpiochip_get_ngpios()
Chuyi Zhou <[email protected]>
sched_ext: Use SCX_CALL_OP_TASK in task_tick_scx
Chuyi Zhou <[email protected]>
sched_ext: Fix the incorrect bpf_list kfunc API in common.bpf.h.
Jens Axboe <[email protected]>
block: cleanup and fix batch completion adding conditions
Juergen Gross <[email protected]>
x86/xen: allow larger contiguous memory regions in PV guests
Juergen Gross <[email protected]>
xen/swiotlb: relax alignment requirements
Imre Deak <[email protected]>
drm: Fix DSC BPP increment decoding
Jiang Liu <[email protected]>
drm/amdgpu: bail out when failed to load fw in psp_init_cap_microcode()
Zhu Lingshan <[email protected]>
amdkfd: properly free gang_ctx_bo when failed to init user queue
Jens Axboe <[email protected]>
io_uring/uring_cmd: remove dead req_has_async_data() check
Pavel Begunkov <[email protected]>
io_uring/waitid: don't abuse io_tw_state
Artur Weber <[email protected]>
gpio: bcm-kona: Add missing newline to dev_err format string
Artur Weber <[email protected]>
gpio: bcm-kona: Make sure GPIO bits are unlocked when requesting IRQ
Artur Weber <[email protected]>
gpio: bcm-kona: Fix GPIO lock/unlock for banks above bank 0
Krzysztof Karas <[email protected]>
drm/i915/selftests: avoid using uninitialized context
Tejas Upadhyay <[email protected]>
drm/xe/client: bo->client does not need bos_lock
Kan Liang <[email protected]>
perf/x86/intel: Clean up PEBS-via-PT on hybrid
Muhammad Adeel <[email protected]>
cgroup: Remove steal time from usage_usec
Rupinderjit Singh <[email protected]>
gpu: host1x: Fix a use of uninitialized mutex
Radu Rendec <[email protected]>
arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
Maxime Ripard <[email protected]>
drm/tests: hdmi: Fix WW_MUTEX_SLOWPATH failures
Andrea Righi <[email protected]>
sched_ext: Fix lock imbalance in dispatch_to_local_dsq()
Lai Jiangshan <[email protected]>
workqueue: Put the pwq after detaching the rescuer from the pool
Eric Dumazet <[email protected]>
team: better TEAM_OPTION_TYPE_STRING validation
Kiran K <[email protected]>
Bluetooth: btintel_pcie: Fix a potential race condition
Roger Quadros <[email protected]>
net: ethernet: ti: am65_cpsw: fix tx_cleanup for XDP case
Roger Quadros <[email protected]>
net: ethernet: ti: am65-cpsw: fix memleak in certain XDP cases
Bibo Mao <[email protected]>
LoongArch: KVM: Fix typo issue about GCFG feature detection
Yuli Wang <[email protected]>
LoongArch: csum: Fix OoB access in IP checksum code for negative lengths
Marco Crivellari <[email protected]>
LoongArch: Fix idle VS timer enqueue
Eric Dumazet <[email protected]>
vxlan: check vxlan_vnigroup_init() return value
Zdenek Bouska <[email protected]>
igc: Fix HW RX timestamp when passed by ZC XDP
Joshua Hay <[email protected]>
idpf: call set_real_num_queues in idpf_open
Sridhar Samudrala <[email protected]>
idpf: record rx queue in skb for RSC packets
Sridhar Samudrala <[email protected]>
idpf: fix handling rsc packet with a single segment
Eric Dumazet <[email protected]>
vrf: use RCU protection in l3mdev_l3_out()
Eric Dumazet <[email protected]>
ndisc: ndisc_send_redirect() must use dev_get_by_index_rcu()
Reyders Morales <[email protected]>
Documentation/networking: fix basic node example document ISO 15765-2
Eric Dumazet <[email protected]>
net: fib_rules: annotate data-races around rule->[io]ifindex
Murad Masimov <[email protected]>
ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt
Kunihiko Hayashi <[email protected]>
spi: sn-f-ospi: Fix division by zero
Vicki Pfau <[email protected]>
HID: hid-steam: Don't use cancel_delayed_work_sync in IRQ context
Tulio Fernandes <[email protected]>
HID: hid-thrustmaster: fix stack-out-of-bounds read in usb_check_int_endpoints()
Claudiu Beznea <[email protected]>
pinctrl: pinconf-generic: Print unsigned value if a format is registered
Nathan Chancellor <[email protected]>
scripts/Makefile.extrawarn: Do not show clang's non-kprintf warnings at W=1
Charles Han <[email protected]>
HID: multitouch: Add NULL check in mt_input_configured
Charles Han <[email protected]>
HID: winwing: Add NULL check in winwing_init_led()
Andy Shevchenko <[email protected]>
pinctrl: cy8c95x0: Respect IRQ trigger settings from firmware
Andy Shevchenko <[email protected]>
pinctrl: cy8c95x0: Rename PWMSEL to SELPWM
Andy Shevchenko <[email protected]>
pinctrl: cy8c95x0: Enable regmap locking for debug
Andy Shevchenko <[email protected]>
pinctrl: cy8c95x0: Avoid accessing reserved registers
Patrick Bellasi <[email protected]>
x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit
Jeff Layton <[email protected]>
nfsd: validate the nfsd_serv pointer before calling svc_wake_up
Dai Ngo <[email protected]>
NFSD: fix hang in nfsd4_shutdown_callback
Li Lingfeng <[email protected]>
nfsd: clear acl_access/acl_default after releasing them
-------------
Diffstat:
.../bindings/regulator/qcom,smd-rpm-regulator.yaml | 2 +- Documentation/networking/iso15765-2.rst | 4 +- Makefile | 17 +-- arch/alpha/include/uapi/asm/ptrace.h | 2 + arch/alpha/kernel/asm-offsets.c | 4 + arch/alpha/kernel/entry.S | 24 ++-- arch/alpha/kernel/traps.c | 2 +- arch/alpha/mm/fault.c | 4 +- arch/arm64/Makefile | 4 + arch/arm64/kernel/cacheinfo.c | 12 +- arch/arm64/kernel/vdso/vdso.lds.S | 1 + arch/arm64/kernel/vmlinux.lds.S | 1 + arch/loongarch/kernel/genex.S | 28 ++-- arch/loongarch/kernel/idle.c | 3 +- arch/loongarch/kernel/reset.c | 6 +- arch/loongarch/kvm/main.c | 4 +- arch/loongarch/lib/csum.c | 2 +- arch/s390/pci/pci_bus.c | 20 +++ arch/s390/pci/pci_iov.c | 56 ++++++-- arch/s390/pci/pci_iov.h | 7 + arch/x86/Kconfig | 3 +- arch/x86/events/intel/core.c | 33 ++--- arch/x86/events/intel/ds.c | 10 +- arch/x86/include/asm/kvm-x86-ops.h | 1 + arch/x86/include/asm/kvm_host.h | 1 + arch/x86/include/asm/mmu.h | 2 + arch/x86/include/asm/mmu_context.h | 1 + arch/x86/include/asm/msr-index.h | 3 +- arch/x86/include/asm/perf_event.h | 28 +++- arch/x86/include/asm/tlbflush.h | 1 + arch/x86/kernel/cpu/bugs.c | 21 ++- arch/x86/kernel/static_call.c | 1 - arch/x86/kvm/hyperv.c | 6 +- arch/x86/kvm/mmu/mmu.c | 2 +- arch/x86/kvm/svm/nested.c | 10 +- arch/x86/kvm/svm/svm.c | 13 +- arch/x86/kvm/vmx/main.c | 1 + arch/x86/kvm/vmx/vmx.c | 10 +- arch/x86/kvm/vmx/x86_ops.h | 1 + arch/x86/kvm/x86.c | 3 + arch/x86/mm/tlb.c | 35 ++++- arch/x86/xen/mmu_pv.c | 75 +++++++++-- block/partitions/mac.c | 18 ++- drivers/acpi/x86/utils.c | 13 ++ drivers/base/regmap/regmap-irq.c | 2 + drivers/bluetooth/btintel_pcie.c | 5 +- drivers/cpufreq/amd-pstate.c | 104 +++++---------- drivers/firmware/efi/efi.c | 6 +- drivers/firmware/efi/libstub/randomalloc.c | 3 + drivers/firmware/efi/libstub/relocate.c | 3 + drivers/firmware/qcom/qcom_scm-smc.c | 3 + drivers/gpio/gpio-bcm-kona.c | 71 ++++++++-- drivers/gpio/gpio-stmpe.c | 15 ++- drivers/gpio/gpiolib-acpi.c | 14 ++ drivers/gpio/gpiolib.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 5 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 36 ++++- .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 2 +- drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 3 +- drivers/gpu/drm/display/drm_dp_helper.c | 2 +- drivers/gpu/drm/i915/selftests/i915_gem_gtt.c | 4 +- .../drm/msm/disp/dpu1/catalog/dpu_9_2_x1e80100.h | 4 +- drivers/gpu/drm/msm/disp/dpu1/dpu_writeback.c | 3 - drivers/gpu/drm/msm/msm_gem_submit.c | 3 +- drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c | 2 +- .../gpu/drm/renesas/rcar-du/rcar_mipi_dsi_regs.h | 1 - drivers/gpu/drm/renesas/rz-du/rzg2l_du_kms.c | 6 +- drivers/gpu/drm/tests/drm_hdmi_state_helper_test.c | 7 + drivers/gpu/drm/tidss/tidss_dispc.c | 26 ++-- drivers/gpu/drm/tidss/tidss_irq.c | 2 + drivers/gpu/drm/v3d/v3d_perfmon.c | 5 + drivers/gpu/drm/xe/xe_drm_client.c | 2 +- drivers/gpu/drm/xe/xe_trace_bo.h | 12 +- drivers/gpu/host1x/dev.c | 2 + drivers/gpu/host1x/intr.c | 2 - drivers/hid/hid-multitouch.c | 5 +- drivers/hid/hid-steam.c | 41 ++++-- drivers/hid/hid-thrustmaster.c | 2 +- drivers/hid/hid-winwing.c | 2 + drivers/i3c/master/Kconfig | 11 ++ drivers/i3c/master/mipi-i3c-hci/Makefile | 1 + drivers/i3c/master/mipi-i3c-hci/dma.c | 17 +++ drivers/i3c/master/mipi-i3c-hci/mipi-i3c-hci-pci.c | 148 +++++++++++++++++++++ drivers/infiniband/hw/efa/efa_main.c | 9 +- drivers/iommu/amd/amd_iommu_types.h | 1 + drivers/iommu/amd/init.c | 4 + drivers/iommu/io-pgfault.c | 1 + drivers/media/dvb-frontends/cxd2841er.c | 8 +- drivers/media/i2c/ds90ub913.c | 25 +++- drivers/media/i2c/ds90ub953.c | 46 +++++-- drivers/media/platform/broadcom/bcm2835-unicam.c | 8 +- drivers/media/test-drivers/vidtv/vidtv_bridge.c | 8 +- drivers/media/usb/uvc/uvc_driver.c | 18 +++ drivers/media/usb/uvc/uvc_video.c | 27 +++- drivers/media/usb/uvc/uvcvideo.h | 1 + drivers/mmc/host/mtk-sd.c | 31 +++-- drivers/net/can/c_can/c_can_platform.c | 5 +- drivers/net/can/ctucanfd/ctucanfd_base.c | 10 +- drivers/net/can/rockchip/rockchip_canfd-core.c | 2 +- drivers/net/can/usb/etas_es58x/es58x_devlink.c | 6 +- drivers/net/ethernet/intel/idpf/idpf_lib.c | 5 + drivers/net/ethernet/intel/idpf/idpf_txrx.c | 5 +- drivers/net/ethernet/intel/igc/igc_main.c | 22 +-- .../net/ethernet/mellanox/mlxsw/spectrum_ethtool.c | 4 +- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 40 +++--- drivers/net/netdevsim/ipsec.c | 12 +- drivers/net/team/team_core.c | 4 +- drivers/net/vxlan/vxlan_core.c | 7 +- drivers/net/wireless/ath/ath12k/wmi.c | 61 ++++++--- drivers/net/wireless/ath/ath12k/wmi.h | 1 - drivers/net/wireless/realtek/rtw89/pci.c | 17 ++- drivers/net/wireless/realtek/rtw89/pci.h | 11 ++ drivers/net/wireless/realtek/rtw89/pci_be.c | 2 + drivers/parport/parport_serial.c | 12 +- drivers/pci/quirks.c | 15 ++- drivers/pci/switch/switchtec.c | 26 ++++ drivers/pinctrl/pinconf-generic.c | 8 +- drivers/pinctrl/pinctrl-cy8c95x0.c | 36 +++-- drivers/soc/tegra/fuse/fuse-tegra30.c | 17 ++- drivers/spi/spi-sn-f-ospi.c | 3 + drivers/tty/serial/8250/8250.h | 2 + drivers/tty/serial/8250/8250_dma.c | 16 +++ drivers/tty/serial/8250/8250_pci.c | 76 +++++------ drivers/tty/serial/8250/8250_pci1xxxx.c | 60 ++++++++- drivers/tty/serial/8250/8250_port.c | 9 ++ drivers/tty/serial/serial_port.c | 5 +- drivers/ufs/core/ufs_bsg.c | 1 + drivers/ufs/core/ufshcd.c | 127 +++++++++--------- drivers/usb/class/cdc-acm.c | 28 +++- drivers/usb/core/hub.c | 14 +- drivers/usb/core/quirks.c | 6 + drivers/usb/dwc2/gadget.c | 1 + drivers/usb/dwc3/gadget.c | 34 +++++ drivers/usb/gadget/function/f_midi.c | 17 ++- drivers/usb/gadget/udc/core.c | 2 +- drivers/usb/gadget/udc/renesas_usb3.c | 2 +- drivers/usb/host/pci-quirks.c | 9 ++ drivers/usb/host/xhci-pci.c | 7 +- drivers/usb/roles/class.c | 5 +- drivers/usb/serial/option.c | 49 ++++--- drivers/vfio/pci/nvgrace-gpu/main.c | 95 ++++++++++--- drivers/vfio/pci/vfio_pci_rdwr.c | 1 + drivers/vfio/platform/vfio_platform_common.c | 10 -- drivers/video/fbdev/omap/lcd_dma.c | 4 +- drivers/xen/swiotlb-xen.c | 20 +-- fs/btrfs/extent_io.c | 29 ++-- fs/btrfs/file.c | 4 +- fs/nfs/sysfs.c | 6 +- fs/nfsd/filecache.c | 11 +- fs/nfsd/nfs2acl.c | 2 + fs/nfsd/nfs3acl.c | 2 + fs/nfsd/nfs4callback.c | 7 +- fs/ntfs3/attrib.c | 4 +- fs/ntfs3/dir.c | 2 +- fs/ntfs3/frecord.c | 12 +- fs/ntfs3/fsntfs.c | 6 +- fs/ntfs3/index.c | 6 +- fs/ntfs3/inode.c | 3 + fs/orangefs/orangefs-debugfs.c | 4 +- fs/smb/client/cifsglob.h | 1 - fs/smb/client/file.c | 7 +- include/drm/display/drm_dp.h | 1 + include/kunit/platform_device.h | 1 + include/linux/blk-mq.h | 18 ++- include/linux/cgroup-defs.h | 6 +- include/linux/efi.h | 1 + include/linux/netdevice.h | 6 + include/linux/pci_ids.h | 11 ++ include/linux/sched/task.h | 1 + include/net/dst.h | 9 ++ include/net/ip.h | 13 +- include/net/l3mdev.h | 2 + include/net/net_namespace.h | 2 +- include/net/route.h | 9 +- include/ufs/ufshcd.h | 9 +- io_uring/kbuf.c | 15 ++- io_uring/uring_cmd.c | 3 - io_uring/waitid.c | 4 +- kernel/cgroup/cgroup.c | 20 +-- kernel/cgroup/rstat.c | 1 - kernel/sched/autogroup.c | 4 +- kernel/sched/core.c | 29 ++-- kernel/sched/deadline.c | 73 ++++++++-- kernel/sched/ext.c | 35 ++--- kernel/sched/ext.h | 4 +- kernel/sched/sched.h | 4 +- kernel/sched/topology.c | 8 +- kernel/time/clocksource.c | 9 +- kernel/trace/ring_buffer.c | 28 +++- kernel/trace/trace.c | 4 + kernel/workqueue.c | 12 +- net/ax25/af_ax25.c | 11 ++ net/batman-adv/bat_v.c | 2 - net/batman-adv/bat_v_elp.c | 122 ++++++++++++----- net/batman-adv/bat_v_elp.h | 2 - net/batman-adv/types.h | 3 - net/can/j1939/socket.c | 4 +- net/can/j1939/transport.c | 5 +- net/core/fib_rules.c | 24 ++-- net/core/flow_dissector.c | 21 +-- net/core/neighbour.c | 8 +- net/ipv4/arp.c | 4 +- net/ipv4/devinet.c | 3 +- net/ipv4/icmp.c | 31 +++-- net/ipv4/route.c | 39 +++++- net/ipv6/icmp.c | 42 +++--- net/ipv6/ioam6_iptunnel.c | 73 +++++----- net/ipv6/mcast.c | 45 ++++--- net/ipv6/ndisc.c | 28 ++-- net/ipv6/route.c | 7 +- net/ipv6/rpl_iptunnel.c | 59 ++++---- net/ipv6/seg6_iptunnel.c | 98 ++++++++------ net/openvswitch/datapath.c | 12 +- net/vmw_vsock/af_vsock.c | 12 +- rust/Makefile | 1 + rust/kernel/rbtree.rs | 2 +- scripts/Makefile.defconf | 13 +- scripts/Makefile.extrawarn | 13 +- scripts/kconfig/Makefile | 4 +- sound/soc/intel/boards/bytcr_rt5640.c | 17 ++- tools/objtool/check.c | 1 + tools/sched_ext/include/scx/common.bpf.h | 12 +- tools/testing/selftests/bpf/prog_tests/bpf_iter.c | 6 +- .../selftests/bpf/prog_tests/uprobe_multi_test.c | 9 +- tools/testing/selftests/gpio/gpio-sim.sh | 31 ++++- tools/testing/selftests/net/pmtu.sh | 112 +++++++++++++--- tools/testing/selftests/net/rtnetlink.sh | 4 +- tools/tracing/rtla/src/timerlat_hist.c | 8 ++ tools/tracing/rtla/src/timerlat_top.c | 8 ++ 230 files changed, 2499 insertions(+), 1049 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/230 nfsd: clear acl_access/acl_default after releasing them
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Lingfeng <[email protected]>
commit 7faf14a7b0366f153284db0ad3347c457ea70136 upstream.
If getting acl_default fails, acl_access and acl_default will be released simultaneously. However, acl_access will still retain a pointer pointing to the released posix_acl, which will trigger a WARNING in nfs3svc_release_getacl like this:
------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 26 PID: 3199 at lib/refcount.c:28 refcount_warn_saturate+0xb5/0x170 Modules linked in: CPU: 26 UID: 0 PID: 3199 Comm: nfsd Not tainted 6.12.0-rc6-00079-g04ae226af01f-dirty #8 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 RIP: 0010:refcount_warn_saturate+0xb5/0x170 Code: cc cc 0f b6 1d b3 20 a5 03 80 fb 01 0f 87 65 48 d8 00 83 e3 01 75 e4 48 c7 c7 c0 3b 9b 85 c6 05 97 20 a5 03 01 e8 fb 3e 30 ff <0f> 0b eb cd 0f b6 1d 8a3 RSP: 0018:ffffc90008637cd8 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff83904fde RDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffff88871ed36380 RBP: ffff888158beeb40 R08: 0000000000000001 R09: fffff520010c6f56 R10: ffffc90008637ab7 R11: 0000000000000001 R12: 0000000000000001 R13: ffff888140e77400 R14: ffff888140e77408 R15: ffffffff858b42c0 FS: 0000000000000000(0000) GS:ffff88871ed00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000562384d32158 CR3: 000000055cc6a000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? refcount_warn_saturate+0xb5/0x170 ? __warn+0xa5/0x140 ? refcount_warn_saturate+0xb5/0x170 ? report_bug+0x1b1/0x1e0 ? handle_bug+0x53/0xa0 ? exc_invalid_op+0x17/0x40 ? asm_exc_invalid_op+0x1a/0x20 ? tick_nohz_tick_stopped+0x1e/0x40 ? refcount_warn_saturate+0xb5/0x170 ? refcount_warn_saturate+0xb5/0x170 nfs3svc_release_getacl+0xc9/0xe0 svc_process_common+0x5db/0xb60 ? __pfx_svc_process_common+0x10/0x10 ? __rcu_read_unlock+0x69/0xa0 ? __pfx_nfsd_dispatch+0x10/0x10 ? svc_xprt_received+0xa1/0x120 ? xdr_init_decode+0x11d/0x190 svc_process+0x2a7/0x330 svc_handle_xprt+0x69d/0x940 svc_recv+0x180/0x2d0 nfsd+0x168/0x200 ? __pfx_nfsd+0x10/0x10 kthread+0x1a2/0x1e0 ? kthread+0xf4/0x1e0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x34/0x60 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Kernel panic - not syncing: kernel: panic_on_warn set ...
Clear acl_access/acl_default after posix_acl_release is called to prevent UAF from being triggered.
--- fs/nfsd/nfs2acl.c | 2 ++ fs/nfsd/nfs3acl.c | 2 ++ 2 files changed, 4 insertions(+)
fs/nfsd/nfs2acl.c +2 -0
@@ -84,6 +84,8 @@ out: fail:posix_acl_release (resp->acl_access);posix_acl_release (resp->acl_default); + resp->acl_access =NULL ; + resp->acl_default =NULL ; goto out; }
fs/nfsd/nfs3acl.c +2 -0
@@ -76,6 +76,8 @@ out: fail:posix_acl_release (resp->acl_access);posix_acl_release (resp->acl_default); + resp->acl_access =NULL ; + resp->acl_default =NULL ; goto out; }
Greg Kroah-Hartman
maintainerPATCH 2/230 NFSD: fix hang in nfsd4_shutdown_callback
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dai Ngo <[email protected]>
commit 036ac2778f7b28885814c6fbc07e156ad1624d03 upstream.
If nfs4_client is in courtesy state then there is no point to send the callback. This causes nfsd4_shutdown_callback to hang since cl_cb_inflight is not 0. This hang lasts about 15 minutes until TCP notifies NFSD that the connection was dropped.
This patch modifies nfsd4_run_cb_work to skip the RPC call if nfs4_client is in courtesy state.
--- fs/nfsd/nfs4callback.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
fs/nfsd/nfs4callback.c +5 -2
@@ -1486,8 +1486,11 @@ nfsd4_run_cb_work(struct work_struct *wonfsd4_process_cb_update (cb); clnt = clp->cl_cb_client; -if (!clnt) { -/* Callback channel broken, or client killed; give up: */ +if (!clnt || clp->cl_state ==NFSD4_COURTESY ) { +/* +* Callback channel broken, client killed or +* nfs4_client in courtesy state; give up. +*/ nfsd41_destroy_cb (cb);return ; }
Greg Kroah-Hartman
maintainerPATCH 3/230 nfsd: validate the nfsd_serv pointer before calling svc_wake_up
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <[email protected]>
commit b9382e29ca538b879645899ce45d652a304e2ed2 upstream.
nfsd_file_dispose_list_delayed can be called from the filecache laundrette, which is shut down after the nfsd threads are shut down and the nfsd_serv pointer is cleared. If nn->nfsd_serv is NULL then there are no threads to wake.
Ensure that the nn->nfsd_serv pointer is non-NULL before calling svc_wake_up in nfsd_file_dispose_list_delayed. This is safe since the svc_serv is not freed until after the filecache laundrette is cancelled.
--- fs/nfsd/filecache.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
fs/nfsd/filecache.c +10 -1
@@ -445,11 +445,20 @@ nfsd_file_dispose_list_delayed(struct li struct nfsd_file, nf_gc);struct nfsd_net *nn =net_generic (nf->nf_net, nfsd_net_id);struct nfsd_fcache_disposal *l = nn->fcache_disposal; +struct svc_serv *serv;spin_lock (&l->lock);list_move_tail (&nf->nf_gc, &l->freeme);spin_unlock (&l->lock); -svc_wake_up (nn->nfsd_serv); + +/* +* The filecache laundrette is shut down after the +* nn->nfsd_serv pointer is cleared, but before the +* svc_serv is freed. +*/ + serv = nn->nfsd_serv; +if (serv) +svc_wake_up (serv); } }
Greg Kroah-Hartman
maintainerPATCH 4/230 x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patrick Bellasi <[email protected]>
commit 318e8c339c9a0891c389298bb328ed0762a9935e upstream.
In [1] the meaning of the synthetic IBPB flags has been redefined for a better separation of concerns:
- ENTRY_IBPB -- issue IBPB on entry only
- IBPB_ON_VMEXIT -- issue IBPB on VM-Exit only
and the Retbleed mitigations have been updated to match this new semantics.
Commit [2] was merged shortly before [1], and their interaction was not handled properly. This resulted in IBPB not being triggered on VM-Exit in all SRSO mitigation configs requesting an IBPB there.
Specifically, an IBPB on VM-Exit is triggered only when X86_FEATURE_IBPB_ON_VMEXIT is set. However:
- X86_FEATURE_IBPB_ON_VMEXIT is not set for "spec_rstack_overflow=ibpb", because before [1] having X86_FEATURE_ENTRY_IBPB was enough. Hence, an IBPB is triggered on entry but the expected IBPB on VM-exit is not.
- X86_FEATURE_IBPB_ON_VMEXIT is not set also when "spec_rstack_overflow=ibpb-vmexit" if X86_FEATURE_ENTRY_IBPB is already set.
That's because before [1] this was effectively redundant. Hence, e.g. a "retbleed=ibpb spec_rstack_overflow=bpb-vmexit" config mistakenly reports the machine still vulnerable to SRSO, despite an IBPB being triggered both on entry and VM-Exit, because of the Retbleed selected mitigation config.
- UNTRAIN_RET_VM won't still actually do anything unless CONFIG_MITIGATION_IBPB_ENTRY is set.
For "spec_rstack_overflow=ibpb", enable IBPB on both entry and VM-Exit and clear X86_FEATURE_RSB_VMEXIT which is made superfluous by X86_FEATURE_IBPB_ON_VMEXIT. This effectively makes this mitigation option similar to the one for 'retbleed=ibpb', thus re-order the code for the RETBLEED_MITIGATION_IBPB option to be less confusing by having all features enabling before the disabling of the not needed ones.
For "spec_rstack_overflow=ibpb-vmexit", guard this mitigation setting with CONFIG_MITIGATION_IBPB_ENTRY to ensure UNTRAIN_RET_VM sequence is effectively compiled in. Drop instead the CONFIG_MITIGATION_SRSO guard, since none of the SRSO compile cruft is required in this configuration. Also, check only that the required microcode is present to effectively enabled the IBPB on VM-Exit.
Finally, update the KConfig description for CONFIG_MITIGATION_IBPB_ENTRY to list also all SRSO config settings enabled by this guard.
--- arch/x86/Kconfig | 3 ++- arch/x86/kernel/cpu/bugs.c | 21 ++++++++++++++------- 2 files changed, 16 insertions(+), 8 deletions(-)
arch/x86/Kconfig +2 -1
@@ -2582,7 +2582,8 @@ config MITIGATION_IBPB_ENTRY depends on CPU_SUP_AMD && X86_64 default y help - Compile the kernel with support for the retbleed=ibpb mitigation. + Compile the kernel with support for the retbleed=ibpb and + spec_rstack_overflow={ibpb,ibpb-vmexit} mitigations. config MITIGATION_IBRS_ENTRY bool "Enable IBRS on kernel entry"
arch/x86/kernel/cpu/bugs.c +14 -7
@@ -1115,6 +1115,8 @@ do_cmd_auto:case RETBLEED_MITIGATION_IBPB :setup_force_cpu_cap (X86_FEATURE_ENTRY_IBPB ); +setup_force_cpu_cap (X86_FEATURE_IBPB_ON_VMEXIT ); + mitigate_smt = true;/* * IBPB on entry already obviates the need for
@@ -1124,9 +1126,6 @@ do_cmd_auto:setup_clear_cpu_cap (X86_FEATURE_UNRET );setup_clear_cpu_cap (X86_FEATURE_RETHUNK ); -setup_force_cpu_cap (X86_FEATURE_IBPB_ON_VMEXIT ); - mitigate_smt = true; -/* * There is no need for RSB filling: entry_ibpb() ensures * all predictions, including the RSB, are invalidated,
@@ -2643,6 +2642,7 @@ static void __init srso_select_mitigatioif (IS_ENABLED (CONFIG_MITIGATION_IBPB_ENTRY )) {if (has_microcode) {setup_force_cpu_cap (X86_FEATURE_ENTRY_IBPB ); +setup_force_cpu_cap (X86_FEATURE_IBPB_ON_VMEXIT ); srso_mitigation =SRSO_MITIGATION_IBPB ;/*
@@ -2652,6 +2652,13 @@ static void __init srso_select_mitigatio*/ setup_clear_cpu_cap (X86_FEATURE_UNRET );setup_clear_cpu_cap (X86_FEATURE_RETHUNK ); + +/* +* There is no need for RSB filling: entry_ibpb() ensures +* all predictions, including the RSB, are invalidated, +* regardless of IBPB implementation. +*/ +setup_clear_cpu_cap (X86_FEATURE_RSB_VMEXIT ); } }else {pr_err ("WARNING: kernel not compiled with MITIGATION_IBPB_ENTRY.\n" );
@@ -2659,8 +2666,8 @@ static void __init srso_select_mitigatiobreak ;case SRSO_CMD_IBPB_ON_VMEXIT : -if (IS_ENABLED (CONFIG_MITIGATION_SRSO )) { -if (!boot_cpu_has (X86_FEATURE_ENTRY_IBPB ) && has_microcode) { +if (IS_ENABLED (CONFIG_MITIGATION_IBPB_ENTRY )) { +if (has_microcode) {setup_force_cpu_cap (X86_FEATURE_IBPB_ON_VMEXIT ); srso_mitigation =SRSO_MITIGATION_IBPB_ON_VMEXIT ;
@@ -2672,8 +2679,8 @@ static void __init srso_select_mitigatiosetup_clear_cpu_cap (X86_FEATURE_RSB_VMEXIT ); } }else { -pr_err ("WARNING: kernel not compiled with MITIGATION_SRSO.\n" ); - } +pr_err ("WARNING: kernel not compiled with MITIGATION_IBPB_ENTRY.\n" ); + }break ;default :break ;
Greg Kroah-Hartman
maintainerPATCH 5/230 pinctrl: cy8c95x0: Avoid accessing reserved registers
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 3fbe3fe28764455e4fc3578afb9765f46f9ce93d ]
The checks for vrtual registers in the cy8c95x0_readable_register() and cy8c95x0_writeable_register() are not aligned and broken.
Fix that by explicitly avoiding reserved registers to be accessed.
--- drivers/pinctrl/pinctrl-cy8c95x0.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
drivers/pinctrl/pinctrl-cy8c95x0.c +10 -6
@@ -330,14 +330,14 @@ static int cypress_get_pin_mask(struct cy8c95x0_pinctrl *chip, unsigned int pin)static bool cy8c95x0_readable_register (struct device *dev,unsigned int reg) {/* -* Only 12 registers are present per port (see Table 6 in the -* datasheet). +* Only 12 registers are present per port (see Table 6 in the datasheet). */ -if (reg >=CY8C95X0_VIRTUAL && (reg %MUXED_STRIDE ) <12 ) -return true; +if (reg >=CY8C95X0_VIRTUAL && (reg %MUXED_STRIDE ) >=12 ) +return false;switch (reg) { case 0x24 ... 0x27: + case 0x31 ... 0x3f:return false;default :return true;
@@ -346,8 +346,11 @@ static bool cy8c95x0_readable_register(struct device *dev, unsigned int reg)static bool cy8c95x0_writeable_register (struct device *dev,unsigned int reg) { -if (reg >=CY8C95X0_VIRTUAL ) -return true; +/* +* Only 12 registers are present per port (see Table 6 in the datasheet). +*/ +if (reg >=CY8C95X0_VIRTUAL && (reg %MUXED_STRIDE ) >=12 ) +return false;switch (reg) { case CY8C95X0_INPUT_(0) ... CY8C95X0_INPUT_(7):
@@ -355,6 +358,7 @@ static bool cy8c95x0_writeable_register(struct device *dev, unsigned int reg)case CY8C95X0_DEVID :return false; case 0x24 ... 0x27: + case 0x31 ... 0x3f:return false;default :return true;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 6/230 pinctrl: cy8c95x0: Enable regmap locking for debug
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit aac4470fa6e695e4d6ac94cc77d4690b57f1d2bc ]
When regmap locking is disabled, debugfs is also disabled. Enable locking for debug when CONFIG_DEBUG_PINCTRL is set.
--- drivers/pinctrl/pinctrl-cy8c95x0.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/pinctrl/pinctrl-cy8c95x0.c +4 -0
@@ -472,7 +472,11 @@ static const struct regmap_config cy8c9520_i2c_regmap = { .max_register = 0, /* Updated at runtime */ .num_reg_defaults_raw = 0, /* Updated at runtime */ .use_single_read = true, /* Workaround for regcache bug */ +#if IS_ENABLED (CONFIG_DEBUG_PINCTRL ) + .disable_locking = false, +#else .disable_locking = true, +#endif }; static inline int cy8c95x0_regmap_update_bits_base(struct cy8c95x0_pinctrl *chip,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 7/230 pinctrl: cy8c95x0: Rename PWMSEL to SELPWM
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 0a7404fc5399e1100b14e7e2a4af2e4fd5e3b602 ]
There are two registers in the hardware, one, "Select PWM", is per-port configuration enabling PWM function instead of GPIO. The other one is "PWM Select" is per-PWM selector to configure PWM itself. Original code uses abbreviation of the latter to describe the former. Rename it to follow the datasheet.
--- drivers/pinctrl/pinctrl-cy8c95x0.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/pinctrl/pinctrl-cy8c95x0.c +7 -7
@@ -42,7 +42,7 @@#define CY8C95X0_PORTSEL 0x18/* Port settings, write PORTSEL first */ #define CY8C95X0_INTMASK 0x19 -#define CY8C95X0_PWMSEL 0x1A +#define CY8C95X0_SELPWM 0x1A#define CY8C95X0_INVERT 0x1B#define CY8C95X0_DIRECTION 0x1C/* Drive mode register change state on writing '1' */
@@ -371,8 +371,8 @@ static bool cy8c95x0_volatile_register(struct device *dev, unsigned int reg) case CY8C95X0_INPUT_(0) ... CY8C95X0_INPUT_(7): case CY8C95X0_INTSTATUS_(0) ... CY8C95X0_INTSTATUS_(7):case CY8C95X0_INTMASK : +case CY8C95X0_SELPWM :case CY8C95X0_INVERT : -case CY8C95X0_PWMSEL :case CY8C95X0_DIRECTION :case CY8C95X0_DRV_PU :case CY8C95X0_DRV_PD :
@@ -401,7 +401,7 @@ static bool cy8c95x0_muxed_register(unsigned int reg) {switch (reg) {case CY8C95X0_INTMASK : -case CY8C95X0_PWMSEL : +case CY8C95X0_SELPWM :case CY8C95X0_INVERT :case CY8C95X0_DIRECTION :case CY8C95X0_DRV_PU :
@@ -807,7 +807,7 @@ static int cy8c95x0_gpio_get_pincfg(struct cy8c95x0_pinctrl *chip, reg =CY8C95X0_DIRECTION ;break ;case PIN_CONFIG_MODE_PWM : - reg =CY8C95X0_PWMSEL ; + reg =CY8C95X0_SELPWM ;break ;case PIN_CONFIG_OUTPUT : reg =CY8C95X0_OUTPUT ;
@@ -889,7 +889,7 @@ static int cy8c95x0_gpio_set_pincfg(struct cy8c95x0_pinctrl *chip, reg =CY8C95X0_DRV_PP_FAST ;break ;case PIN_CONFIG_MODE_PWM : - reg =CY8C95X0_PWMSEL ; + reg =CY8C95X0_SELPWM ;break ;case PIN_CONFIG_OUTPUT_ENABLE : ret =cy8c95x0_pinmux_direction (chip, off, !arg);
@@ -1179,7 +1179,7 @@ static void cy8c95x0_pin_dbg_show(struct pinctrl_dev *pctldev, struct seq_file *bitmap_zero (mask,MAX_LINE );__set_bit (pin, mask); -if (cy8c95x0_read_regs_mask (chip,CY8C95X0_PWMSEL , pwm, mask)) { +if (cy8c95x0_read_regs_mask (chip,CY8C95X0_SELPWM , pwm, mask)) {seq_puts (s,"not available" );return ; }
@@ -1224,7 +1224,7 @@ static int cy8c95x0_set_mode(struct cy8c95x0_pinctrl *chip, unsigned int off, bou8 port =cypress_get_port (chip, off);u8 bit =cypress_get_pin_mask (chip, off); -return cy8c95x0_regmap_write_bits (chip,CY8C95X0_PWMSEL , port, bit, mode ? bit :0 ); +return cy8c95x0_regmap_write_bits (chip,CY8C95X0_SELPWM , port, bit, mode ? bit :0 ); } static int cy8c95x0_pinmux_mode(struct cy8c95x0_pinctrl *chip,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 8/230 pinctrl: cy8c95x0: Respect IRQ trigger settings from firmware
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 1ddee69108d305bbc059cbf31c0b47626796be77 ]
Some of the platforms may connect the INT pin via inversion logic effectively make the triggering to be active-low.
Remove explicit trigger flag to respect the settings from firmware.
Without this change even idling chip produces spurious interrupts and kernel disables the line in the result:
irq 33: nobody cared (try booting with the "irqpoll" option)
CPU: 0 UID: 0 PID: 125 Comm: irq/33-i2c-INT3 Not tainted 6.12.0-00236-g8b874ed11dae #64 Hardware name: Intel Corp. QUARK/Galileo, BIOS 0x01000900 01/01/2014 ... handlers: [<86e86bea>] irq_default_primary_handler threaded [<d153e44a>] cy8c95x0_irq_handler [pinctrl_cy8c95x0] Disabling IRQ #33
--- drivers/pinctrl/pinctrl-cy8c95x0.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pinctrl/pinctrl-cy8c95x0.c +1 -1
@@ -1373,7 +1373,7 @@ static int cy8c95x0_irq_setup(struct cy8c95x0_pinctrl *chip, int irq) ret =devm_request_threaded_irq (chip->dev, irq,NULL , cy8c95x0_irq_handler, -IRQF_ONESHOT |IRQF_SHARED |IRQF_TRIGGER_HIGH , +IRQF_ONESHOT |IRQF_SHARED ,dev_name (chip->dev), chip);if (ret) {dev_err (chip->dev,"failed to request irq %d\n" , irq);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 9/230 HID: winwing: Add NULL check in winwing_init_led()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Han <[email protected]>
[ Upstream commit 45ab5166a82d038c898985b0ad43ead69c1f9573 ]
devm_kasprintf() can return a NULL pointer on failure,but this returned value in winwing_init_led() is not checked. Add NULL check in winwing_init_led(), to handle kernel NULL pointer dereference error.
--- drivers/hid/hid-winwing.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/hid/hid-winwing.c +2 -0
@@ -106,6 +106,8 @@ static int winwing_init_led(struct hid_device *hdev,"%s::%s" ,dev_name (&input->dev), info->led_name); +if (!led->cdev.name) +return -ENOMEM ; ret =devm_led_classdev_register (&hdev->dev, &led->cdev);if (ret)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 10/230 HID: multitouch: Add NULL check in mt_input_configured
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Han <[email protected]>
[ Upstream commit 9b8e2220d3a052a690b1d1b23019673e612494c5 ]
devm_kasprintf() can return a NULL pointer on failure,but this returned value in mt_input_configured() is not checked. Add NULL check in mt_input_configured(), to handle kernel NULL pointer dereference error.
--- drivers/hid/hid-multitouch.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/hid/hid-multitouch.c +4 -1
@@ -1673,9 +1673,12 @@ static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi)break ; } -if (suffix) +if (suffix) { hi->input->name =devm_kasprintf (&hdev->dev,GFP_KERNEL ,"%s %s" , hdev->name, suffix); +if (!hi->input->name) +return -ENOMEM ; + }return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 11/230 scripts/Makefile.extrawarn: Do not show clangs non-kprintf warnings at W=1
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <[email protected]>
[ Upstream commit 738fc998b639407346a9e026514f0562301462cd ]
Clang's -Wformat-overflow and -Wformat-truncation have chosen to check '%p' unlike GCC but it does not know about the kernel's pointer extensions in lib/vsprintf.c, so the developers split that part of the warning out for the kernel to disable because there will always be false positives.
Commit 908dd508276d ("kbuild: enable -Wformat-truncation on clang") did disabled these warnings but only in a block that would be called when W=1 was not passed, so they would appear with W=1. Move the disabling of the non-kprintf warnings to a block that always runs so that they are never seen, regardless of warning level.
--- scripts/Makefile.extrawarn | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
scripts/Makefile.extrawarn +5 -5
@@ -31,6 +31,11 @@ KBUILD_CFLAGS-$(CONFIG_CC_NO_ARRAY_BOUNDS) += -Wno-array-bounds ifdef CONFIG_CC_IS_CLANG # The kernel builds with '-std=gnu11' so use of GNU extensions is acceptable. KBUILD_CFLAGS += -Wno-gnu + +# Clang checks for overflow/truncation with '%p', while GCC does not: +# https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111219 +KBUILD_CFLAGS += $(call cc-disable-warning, format-overflow-non-kprintf) +KBUILD_CFLAGS += $(call cc-disable-warning, format-truncation-non-kprintf) else # gcc inanely warns about local variables called 'main'
@@ -102,11 +107,6 @@ KBUILD_CFLAGS += $(call cc-disable-warning, packed-not-aligned) KBUILD_CFLAGS += $(call cc-disable-warning, format-overflow) ifdef CONFIG_CC_IS_GCC KBUILD_CFLAGS += $(call cc-disable-warning, format-truncation) -else -# Clang checks for overflow/truncation with '%p', while GCC does not: -# https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111219 -KBUILD_CFLAGS += $(call cc-disable-warning, format-overflow-non-kprintf) -KBUILD_CFLAGS += $(call cc-disable-warning, format-truncation-non-kprintf) endif KBUILD_CFLAGS += $(call cc-disable-warning, stringop-truncation)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 12/230 pinctrl: pinconf-generic: Print unsigned value if a format is registered
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <[email protected]>
[ Upstream commit 0af4c120f5e7a1ea70aff7da2dfb65b6148a3e84 ]
Commit 3ba11e684d16 ("pinctrl: pinconf-generic: print hex value") unconditionally switched to printing hex values in pinconf_generic_dump_one(). However, if a dump format is registered for the dumped pin, the hex value is printed as well. This hex value does not necessarily correspond 1:1 with the hardware register value (as noted by commit 3ba11e684d16 ("pinctrl: pinconf-generic: print hex value")). As a result, user-facing output may include information like:
output drive strength (0x100 uA).
To address this, check if a dump format is registered for the dumped property, and print the unsigned value instead when applicable.
--- drivers/pinctrl/pinconf-generic.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/pinctrl/pinconf-generic.c +4 -4
@@ -89,12 +89,12 @@ static void pinconf_generic_dump_one(struct pinctrl_dev *pctldev,seq_puts (s, items[i].display);/* Print unit if available */ if (items[i].has_arg) { -seq_printf (s," (0x%x" , -pinconf_to_config_argument (config)); +u32 val =pinconf_to_config_argument (config); +if (items[i].format) -seq_printf (s," %s)" , items[i].format); +seq_printf (s," (%u %s)" , val, items[i].format);else -seq_puts (s,")" ); +seq_printf (s," (0x%x)" , val); } } }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 13/230 HID: hid-thrustmaster: fix stack-out-of-bounds read in usb_check_int_endpoints()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tulio Fernandes <[email protected]>
[ Upstream commit 0b43d98ff29be3144e86294486b1373b5df74c0e ]
Syzbot[1] has detected a stack-out-of-bounds read of the ep_addr array from hid-thrustmaster driver. This array is passed to usb_check_int_endpoints function from usb.c core driver, which executes a for loop that iterates over the elements of the passed array. Not finding a null element at the end of the array, it tries to read the next, non-existent element, crashing the kernel.
To fix this, a 0 element was added at the end of the array to break the for loop.
[1] https://syzkaller.appspot.com/bug?extid=9c9179ac46169c56c1ad
--- drivers/hid/hid-thrustmaster.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hid/hid-thrustmaster.c +1 -1
@@ -171,7 +171,7 @@ static void thrustmaster_interrupts(struct hid_device *hdev) b_ep = ep->desc.bEndpointAddress;/* Are the expected endpoints present? */ -u8 ep_addr[1 ] = {b_ep}; +u8 ep_addr[2 ] = {b_ep,0 };if (!usb_check_int_endpoints (usbif, ep_addr)) {hid_err (hdev,"Unexpected non-int endpoint\n" );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 14/230 HID: hid-steam: Dont use cancel_delayed_work_sync in IRQ context
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vicki Pfau <[email protected]>
[ Upstream commit b051ffa2aeb2a60e092387b6fb2af1ad42f51a3c ]
Lockdep reported that, as steam_do_deck_input_event is called from steam_raw_event inside of an IRQ context, it can lead to issues if that IRQ occurs while the work to be cancelled is running. By using cancel_delayed_work, this issue can be avoided. The exact ordering of the work and the event processing is not super important, so this is safe.
--- drivers/hid/hid-steam.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hid/hid-steam.c +1 -1
@@ -1592,7 +1592,7 @@ static void steam_do_deck_input_event(struct steam_device *steam,if (!(b9 &BIT (6 )) && steam->did_mode_switch) { steam->did_mode_switch = false; -cancel_delayed_work_sync (&steam->mode_switch); +cancel_delayed_work (&steam->mode_switch); }else if (!steam->client_opened && (b9 &BIT (6 )) && !steam->did_mode_switch) { steam->did_mode_switch = true;schedule_delayed_work (&steam->mode_switch,45 *HZ /100 );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 15/230 spi: sn-f-ospi: Fix division by zero
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kunihiko Hayashi <[email protected]>
[ Upstream commit 3588b1c0fde2f58d166e3f94a5a58d64b893526c ]
When there is no dummy cycle in the spi-nor commands, both dummy bus cycle bytes and width are zero. Because of the cpu's warning when divided by zero, the warning should be avoided. Return just zero to avoid such calculations.
--- drivers/spi/spi-sn-f-ospi.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/spi/spi-sn-f-ospi.c +3 -0
@@ -116,6 +116,9 @@ struct f_ospi {static u32 f_ospi_get_dummy_cycle (const struct spi_mem_op *op) { +if (!op->dummy.nbytes) +return 0 ; +return (op->dummy.nbytes *8 ) / op->dummy.buswidth; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 16/230 ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Murad Masimov <[email protected]>
[ Upstream commit bca0902e61731a75fc4860c8720168d9f1bae3b6 ]
If an AX25 device is bound to a socket by setting the SO_BINDTODEVICE socket option, a refcount leak will occur in ax25_release().
Commit 9fd75b66b8f6 ("ax25: Fix refcount leaks caused by ax25_cb_del()") added decrement of device refcounts in ax25_release(). In order for that to work correctly the refcounts must already be incremented when the device is bound to the socket. An AX25 device can be bound to a socket by either calling ax25_bind() or setting SO_BINDTODEVICE socket option. In both cases the refcounts should be incremented, but in fact it is done only in ax25_bind().
This bug leads to the following issue reported by Syzkaller:
================================================================refcount_t: decrement hit 0; leaking memory.
WARNING: CPU: 1 PID: 5932 at lib/refcount.c:31 refcount_warn_saturate+0x1ed/0x210 lib/refcount.c:31 Modules linked in: CPU: 1 UID: 0 PID: 5932 Comm: syz-executor424 Not tainted 6.13.0-rc4-syzkaller-00110-g4099a71718b0 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:refcount_warn_saturate+0x1ed/0x210 lib/refcount.c:31 Call Trace: <TASK> __refcount_dec include/linux/refcount.h:336 [inline] refcount_dec include/linux/refcount.h:351 [inline] ref_tracker_free+0x710/0x820 lib/ref_tracker.c:236 netdev_tracker_free include/linux/netdevice.h:4156 [inline] netdev_put include/linux/netdevice.h:4173 [inline] netdev_put include/linux/netdevice.h:4169 [inline] ax25_release+0x33f/0xa10 net/ax25/af_ax25.c:1069 __sock_release+0xb0/0x270 net/socket.c:640 sock_close+0x1c/0x30 net/socket.c:1408 ... do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f ... </TASK> ================================================================
Fix the implementation of ax25_setsockopt() by adding increment of refcounts for the new device bound, and decrement of refcounts for the old unbound device.
--- net/ax25/af_ax25.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
net/ax25/af_ax25.c +11 -0
@@ -685,6 +685,15 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,break ; } +if (ax25->ax25_dev) { +if (dev == ax25->ax25_dev->dev) { +rcu_read_unlock (); +break ; + } +netdev_put (ax25->ax25_dev->dev, &ax25->dev_tracker); +ax25_dev_put (ax25->ax25_dev); + } + ax25->ax25_dev =ax25_dev_ax25dev (dev);if (!ax25->ax25_dev) {rcu_read_unlock ();
@@ -692,6 +701,8 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,break ; }ax25_fillin_cb (ax25, ax25->ax25_dev); +netdev_hold (dev, &ax25->dev_tracker,GFP_ATOMIC ); +ax25_dev_hold (ax25->ax25_dev);rcu_read_unlock ();break ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 17/230 net: fib_rules: annotate data-races around rule->[io]ifindex
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit cb827db50a88aebec516151681adb6db10b688ee ]
rule->iifindex and rule->oifindex can be read without holding RTNL.
Add READ_ONCE()/WRITE_ONCE() annotations where needed.
--- net/core/fib_rules.c | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-)
net/core/fib_rules.c +13 -11
@@ -37,8 +37,8 @@ static const struct fib_kuid_range fib_kuid_range_unset = {bool fib_rule_matchall (const struct fib_rule *rule) { -if (rule->iifindex || rule->oifindex || rule->mark || rule->tun_id || - rule->flags) +if (READ_ONCE (rule->iifindex) ||READ_ONCE (rule->oifindex) || + rule->mark || rule->tun_id || rule->flags)return false;if (rule->suppress_ifgroup !=-1 || rule->suppress_prefixlen !=-1 )return false;
@@ -260,12 +260,14 @@ static int fib_rule_match(struct fib_rule *rule, struct fib_rules_ops *ops, struct flowi *fl, int flags, struct fib_lookup_arg *arg) { - int ret = 0; + int iifindex, oifindex, ret = 0; -if (rule->iifindex && (rule->iifindex != fl->flowi_iif)) + iifindex =READ_ONCE (rule->iifindex); +if (iifindex && (iifindex != fl->flowi_iif)) goto out; -if (rule->oifindex && (rule->oifindex != fl->flowi_oif)) + oifindex =READ_ONCE (rule->oifindex); +if (oifindex && (oifindex != fl->flowi_oif)) goto out;if ((rule->mark ^ fl->flowi_mark) & rule->mark_mask)
@@ -1038,14 +1040,14 @@ static int fib_nl_fill_rule(struct sk_buff *skb, struct fib_rule *rule,if (rule->iifname[0 ]) {if (nla_put_string (skb,FRA_IIFNAME , rule->iifname)) goto nla_put_failure; -if (rule->iifindex ==-1 ) +if (READ_ONCE (rule->iifindex) ==-1 ) frh->flags |=FIB_RULE_IIF_DETACHED ; }if (rule->oifname[0 ]) {if (nla_put_string (skb,FRA_OIFNAME , rule->oifname)) goto nla_put_failure; -if (rule->oifindex ==-1 ) +if (READ_ONCE (rule->oifindex) ==-1 ) frh->flags |=FIB_RULE_OIF_DETACHED ; }
@@ -1217,10 +1219,10 @@ static void attach_rules(struct list_head *rules, struct net_device *dev)list_for_each_entry (rule, rules, list) {if (rule->iifindex ==-1 &&strcmp (dev->name, rule->iifname) ==0 ) - rule->iifindex = dev->ifindex; +WRITE_ONCE (rule->iifindex, dev->ifindex);if (rule->oifindex ==-1 &&strcmp (dev->name, rule->oifname) ==0 ) - rule->oifindex = dev->ifindex; +WRITE_ONCE (rule->oifindex, dev->ifindex); } }
@@ -1230,9 +1232,9 @@ static void detach_rules(struct list_head *rules, struct net_device *dev)list_for_each_entry (rule, rules, list) {if (rule->iifindex == dev->ifindex) - rule->iifindex =-1 ; +WRITE_ONCE (rule->iifindex,-1 );if (rule->oifindex == dev->ifindex) - rule->oifindex =-1 ; +WRITE_ONCE (rule->oifindex,-1 ); } }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 18/230 Documentation/networking: fix basic node example document ISO 15765-2
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Reyders Morales <[email protected]>
[ Upstream commit d0b197b6505fe3788860fc2a81b3ce53cbecc69c ]
In the current struct sockaddr_can tp is member of can_addr. tp is not member of struct sockaddr_can.
--- Documentation/networking/iso15765-2.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
Documentation/networking/iso15765-2.rst +2 -2
@@ -369,8 +369,8 @@ to their default. addr.can_family = AF_CAN; addr.can_ifindex = if_nametoindex("can0"); - addr.tp.tx_id = 0x18DA42F1 | CAN_EFF_FLAG; - addr.tp.rx_id = 0x18DAF142 | CAN_EFF_FLAG; + addr.can_addr.tp.tx_id = 0x18DA42F1 | CAN_EFF_FLAG; + addr.can_addr.tp.rx_id = 0x18DAF142 | CAN_EFF_FLAG; ret = bind(s, (struct sockaddr *)&addr, sizeof(addr)); if (ret < 0)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 19/230 ndisc: ndisc_send_redirect() must use dev_get_by_index_rcu()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 48145a57d4bbe3496e8e4880b23ea6b511e6e519 ]
ndisc_send_redirect() is called under RCU protection, not RTNL.
It must use dev_get_by_index_rcu() instead of __dev_get_by_index()
--- net/ipv6/ndisc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv6/ndisc.c +1 -1
@@ -1694,7 +1694,7 @@ void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)bool ret;if (netif_is_l3_master (skb->dev)) { - dev =__dev_get_by_index (dev_net (skb->dev),IPCB (skb)->iif); + dev =dev_get_by_index_rcu (dev_net (skb->dev),IPCB (skb)->iif);if (!dev)return ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 20/230 vrf: use RCU protection in l3mdev_l3_out()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 6d0ce46a93135d96b7fa075a94a88fe0da8e8773 ]
l3mdev_l3_out() can be called without RCU being held:
raw_sendmsg()
ip_push_pending_frames()
ip_send_skb()
ip_local_out()
__ip_local_out()
l3mdev_ip_out()Add rcu_read_lock() / rcu_read_unlock() pair to avoid a potential UAF.
--- include/net/l3mdev.h | 2 ++ 1 file changed, 2 insertions(+)
include/net/l3mdev.h +2 -0
@@ -198,10 +198,12 @@ struct sk_buff *l3mdev_l3_out(struct sock *sk, struct sk_buff *skb, u16 proto)if (netif_is_l3_slave (dev)) {struct net_device *master; +rcu_read_lock (); master =netdev_master_upper_dev_get_rcu (dev);if (master && master->l3mdev_ops->l3mdev_l3_out) skb = master->l3mdev_ops->l3mdev_l3_out (master, sk, skb, proto); +rcu_read_unlock (); }return skb;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 21/230 idpf: fix handling rsc packet with a single segment
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sridhar Samudrala <[email protected]>
[ Upstream commit 69ab25a74e2df53edc2de4acfce0a484bdb88155 ]
Handle rsc packet with a single segment same as a multi segment rsc packet so that CHECKSUM_PARTIAL is set in the skb->ip_summed field. The current code is passing CHECKSUM_NONE resulting in TCP GRO layer doing checksum in SW and hiding the issue. This will fail when using dmabufs as payload buffers as skb frag would be unreadable.
--- drivers/net/ethernet/intel/idpf/idpf_txrx.c | 2 -- 1 file changed, 2 deletions(-)
drivers/net/ethernet/intel/idpf/idpf_txrx.c +0 -2
@@ -3008,8 +3008,6 @@ static int idpf_rx_rsc(struct idpf_rx_queue *rxq, struct sk_buff *skb,return -EINVAL ; rsc_segments =DIV_ROUND_UP (skb->data_len, rsc_seg_len); -if (unlikely (rsc_segments ==1 )) -return 0 ;NAPI_GRO_CB (skb)->count = rsc_segments;skb_shinfo (skb)->gso_size = rsc_seg_len;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 22/230 idpf: record rx queue in skb for RSC packets
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sridhar Samudrala <[email protected]>
[ Upstream commit 2ff66c2f9ea4e9311e9a00004348b6c465bd5d3b ]
Move the call to skb_record_rx_queue in idpf_rx_process_skb_fields() so that RX queue is recorded for RSC packets too.
--- drivers/net/ethernet/intel/idpf/idpf_txrx.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/ethernet/intel/idpf/idpf_txrx.c +1 -2
@@ -3070,6 +3070,7 @@ idpf_rx_process_skb_fields(struct idpf_rx_queue *rxq, struct sk_buff *skb,idpf_rx_hash (rxq, skb, rx_desc, decoded); skb->protocol =eth_type_trans (skb, rxq->netdev); +skb_record_rx_queue (skb, rxq->idx);if (le16_get_bits (rx_desc->hdrlen_flags,VIRTCHNL2_RX_FLEX_DESC_ADV_RSC_M ))
@@ -3078,8 +3079,6 @@ idpf_rx_process_skb_fields(struct idpf_rx_queue *rxq, struct sk_buff *skb, csum_bits =idpf_rx_splitq_extract_csum_bits (rx_desc);idpf_rx_csum (rxq, skb, csum_bits, decoded); -skb_record_rx_queue (skb, rxq->idx); -return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 23/230 idpf: call set_real_num_queues in idpf_open
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Hay <[email protected]>
[ Upstream commit 52c11d31b5a1d1c747bb5f36cc4808e93e2348f4 ]
On initial driver load, alloc_etherdev_mqs is called with whatever max queue values are provided by the control plane. However, if the driver is loaded on a system where num_online_cpus() returns less than the max queues, the netdev will think there are more queues than are actually available. Only num_online_cpus() will be allocated, but skb_get_queue_mapping(skb) could possibly return an index beyond the range of allocated queues. Consequently, the packet is silently dropped and it appears as if TX is broken.
Set the real number of queues during open so the netdev knows how many queues will be allocated.
--- drivers/net/ethernet/intel/idpf/idpf_lib.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/intel/idpf/idpf_lib.c +5 -0
@@ -2159,8 +2159,13 @@ static int idpf_open(struct net_device *netdev)idpf_vport_ctrl_lock (netdev); vport =idpf_netdev_to_vport (netdev); + err =idpf_set_real_num_queues (vport); +if (err) + goto unlock; + err =idpf_vport_open (vport); +unlock:idpf_vport_ctrl_unlock (netdev);return err;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 24/230 igc: Fix HW RX timestamp when passed by ZC XDP
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zdenek Bouska <[email protected]>
[ Upstream commit 7822dd4d6d4bebca5045a395e1784ef09cae2d43 ]
Fixes HW RX timestamp in the following scenario:
- AF_PACKET socket with enabled HW RX timestamps is created
- AF_XDP socket with enabled zero copy is created
- frame is forwarded to the BPF program, where the timestamp should still be readable (extracted by igc_xdp_rx_timestamp(), kfunc behind bpf_xdp_metadata_rx_timestamp())
- the frame got XDP_PASS from BPF program, redirecting to the stack
- AF_PACKET socket receives the frame with HW RX timestamp
Moves the skb timestamp setting from igc_dispatch_skb_zc() to igc_construct_skb_zc() so that igc_construct_skb_zc() is similar to igc_construct_skb().
This issue can also be reproduced by running:
# tools/testing/selftests/bpf/xdp_hw_metadata enp1s0 When a frame with the wrong port 9092 (instead of 9091) is used: # echo -n xdp | nc -u -q1 192.168.10.9 9092 then the RX timestamp is missing and xdp_hw_metadata prints: skb hwtstamp is not found!
With this fix or when copy mode is used:
# tools/testing/selftests/bpf/xdp_hw_metadata -c enp1s0 then RX timestamp is found and xdp_hw_metadata prints: found skb hwtstamp = 1736509937.852786132
--- drivers/net/ethernet/intel/igc/igc_main.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-)
drivers/net/ethernet/intel/igc/igc_main.c +12 -9
@@ -2707,8 +2707,9 @@ static int igc_clean_rx_irq(struct igc_q_vector *q_vector, const int budget) }static struct sk_buff *igc_construct_skb_zc (struct igc_ring *ring, -struct xdp_buff *xdp) +struct igc_xdp_buff *ctx) { +struct xdp_buff *xdp = &ctx->xdp;unsigned int totalsize = xdp->data_end - xdp->data_meta;unsigned int metasize = xdp->data - xdp->data_meta;struct sk_buff *skb;
@@ -2727,27 +2728,28 @@ static struct sk_buff *igc_construct_skb_zc(struct igc_ring *ring,__skb_pull (skb, metasize); } +if (ctx->rx_ts) { +skb_shinfo (skb)->tx_flags |=SKBTX_HW_TSTAMP_NETDEV ; +skb_hwtstamps (skb)->netdev_data = ctx->rx_ts; + } +return skb; }static void igc_dispatch_skb_zc (struct igc_q_vector *q_vector,union igc_adv_rx_desc *desc, -struct xdp_buff *xdp, -ktime_t timestamp) +struct igc_xdp_buff *ctx) {struct igc_ring *ring = q_vector->rx.ring;struct sk_buff *skb; - skb =igc_construct_skb_zc (ring, xdp); + skb =igc_construct_skb_zc (ring, ctx);if (!skb) { ring->rx_stats.alloc_failed++;set_bit (IGC_RING_FLAG_RX_ALLOC_FAILED , &ring->flags);return ; } -if (timestamp) -skb_hwtstamps (skb)->hwtstamp = timestamp; -if (igc_cleanup_headers (ring, desc, skb))return ;
@@ -2783,7 +2785,6 @@ static int igc_clean_rx_irq_zc(struct igc_q_vector *q_vector, const int budget)union igc_adv_rx_desc *desc;struct igc_rx_buffer *bi;struct igc_xdp_buff *ctx; -ktime_t timestamp =0 ;unsigned int size;int res;
@@ -2813,6 +2814,8 @@ static int igc_clean_rx_irq_zc(struct igc_q_vector *q_vector, const int budget)*/ bi->xdp->data_meta +=IGC_TS_HDR_LEN ; size -=IGC_TS_HDR_LEN ; + }else { + ctx->rx_ts =NULL ; } bi->xdp->data_end = bi->xdp->data + size;
@@ -2821,7 +2824,7 @@ static int igc_clean_rx_irq_zc(struct igc_q_vector *q_vector, const int budget) res =__igc_xdp_run_prog (adapter, prog, bi->xdp);switch (res) {case IGC_XDP_PASS : -igc_dispatch_skb_zc (q_vector, desc, bi->xdp, timestamp); +igc_dispatch_skb_zc (q_vector, desc, ctx); fallthrough;case IGC_XDP_CONSUMED :xsk_buff_free (bi->xdp);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 25/230 vxlan: check vxlan_vnigroup_init() return value
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 5805402dcc56241987bca674a1b4da79a249bab7 ]
vxlan_init() must check vxlan_vnigroup_init() success otherwise a crash happens later, spotted by syzbot.
Oops: general protection fault, probably for non-canonical address 0xdffffc000000002c: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000160-0x0000000000000167] CPU: 0 UID: 0 PID: 7313 Comm: syz-executor147 Not tainted 6.14.0-rc1-syzkaller-00276-g69b54314c975 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:vxlan_vnigroup_uninit+0x89/0x500 drivers/net/vxlan/vxlan_vnifilter.c:912 Code: 00 48 8b 44 24 08 4c 8b b0 98 41 00 00 49 8d 86 60 01 00 00 48 89 c2 48 89 44 24 10 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 4d 04 00 00 49 8b 86 60 01 00 00 48 ba 00 00 00 RSP: 0018:ffffc9000cc1eea8 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffffff8672effb RDX: 000000000000002c RSI: ffffffff8672ecb9 RDI: ffff8880461b4f18 RBP: ffff8880461b4ef4 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000020000 R13: ffff8880461b0d80 R14: 0000000000000000 R15: dffffc0000000000 FS: 00007fecfa95d6c0(0000) GS:ffff88806a600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fecfa95cfb8 CR3: 000000004472c000 CR4: 0000000000352ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> vxlan_uninit+0x1ab/0x200 drivers/net/vxlan/vxlan_core.c:2942 unregister_netdevice_many_notify+0x12d6/0x1f30 net/core/dev.c:11824 unregister_netdevice_many net/core/dev.c:11866 [inline] unregister_netdevice_queue+0x307/0x3f0 net/core/dev.c:11736 register_netdevice+0x1829/0x1eb0 net/core/dev.c:10901 __vxlan_dev_create+0x7c6/0xa30 drivers/net/vxlan/vxlan_core.c:3981 vxlan_newlink+0xd1/0x130 drivers/net/vxlan/vxlan_core.c:4407 rtnl_newlink_create net/core/rtnetlink.c:3795 [inline] __rtnl_newlink net/core/rtnetlink.c:3906 [inline]
--- drivers/net/vxlan/vxlan_core.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/net/vxlan/vxlan_core.c +5 -2
@@ -2871,8 +2871,11 @@ static int vxlan_init(struct net_device *dev)struct vxlan_dev *vxlan =netdev_priv (dev);int err; -if (vxlan->cfg.flags &VXLAN_F_VNIFILTER ) -vxlan_vnigroup_init (vxlan); +if (vxlan->cfg.flags &VXLAN_F_VNIFILTER ) { + err =vxlan_vnigroup_init (vxlan); +if (err) +return err; + } err =gro_cells_init (&vxlan->gro_cells, dev);if (err)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 26/230 LoongArch: Fix idle VS timer enqueue
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marco Crivellari <[email protected]>
[ Upstream commit edb1942542bc538707cea221e9c7923a6270465f ]
LoongArch re-enables interrupts on its idle routine and performs a TIF_NEED_RESCHED check afterwards before putting the CPU to sleep.
The IRQs firing between the check and the idle instruction may set the TIF_NEED_RESCHED flag. In order to deal with such a race, IRQs interrupting __arch_cpu_idle() rollback their return address to the beginning of __arch_cpu_idle() so that TIF_NEED_RESCHED is checked again before going back to sleep.
However idle IRQs can also queue timers that may require a tick reprogramming through a new generic idle loop iteration but those timers would go unnoticed here because __arch_cpu_idle() only checks TIF_NEED_RESCHED. It doesn't check for pending timers.
Fix this with fast-forwarding idle IRQs return address to the end of the idle routine instead of the beginning, so that the generic idle loop can handle both TIF_NEED_RESCHED and pending timers.
--- arch/loongarch/kernel/genex.S | 28 +++++++++++++++------------- arch/loongarch/kernel/idle.c | 3 +-- arch/loongarch/kernel/reset.c | 6 +++--- 3 files changed, 19 insertions(+), 18 deletions(-)
arch/loongarch/kernel/genex.S +15 -13
@@ -18,16 +18,19 @@ .align 5 SYM_FUNC_START(__arch_cpu_idle) - /* start of rollback region */ - LONG_L t0, tp, TI_FLAGS - nop - andi t0, t0, _TIF_NEED_RESCHED - bnez t0, 1f - nop - nop - nop + /* start of idle interrupt region */ + ori t0, zero, CSR_CRMD_IE + /* idle instruction needs irq enabled */ + csrxchg t0, t0, LOONGARCH_CSR_CRMD + /* + * If an interrupt lands here; between enabling interrupts above and + * going idle on the next instruction, we must *NOT* go idle since the + * interrupt could have set TIF_NEED_RESCHED or caused an timer to need + * reprogramming. Fall through -- see handle_vint() below -- and have + * the idle loop take care of things. + */ idle 0 - /* end of rollback region */ + /* end of idle interrupt region */ 1: jr ra SYM_FUNC_END(__arch_cpu_idle)
@@ -35,11 +38,10 @@ SYM_CODE_START(handle_vint) UNWIND_HINT_UNDEFINED BACKUP_T0T1 SAVE_ALL - la_abs t1, __arch_cpu_idle + la_abs t1, 1b LONG_L t0, sp, PT_ERA - /* 32 byte rollback region */ - ori t0, t0, 0x1f - xori t0, t0, 0x1f + /* 3 instructions idle interrupt region */ + ori t0, t0, 0b1100 bne t0, t1, 1f LONG_S t0, sp, PT_ERA 1: move a0, sp
arch/loongarch/kernel/idle.c +1 -2
@@ -11,7 +11,6 @@ void __cpuidle arch_cpu_idle(void) { -raw_local_irq_enable (); -__arch_cpu_idle ();/* idle instruction needs irq enabled */ +__arch_cpu_idle ();raw_local_irq_disable (); }
arch/loongarch/kernel/reset.c +3 -3
@@ -33,7 +33,7 @@ void machine_halt(void)console_flush_on_panic (CONSOLE_FLUSH_PENDING );while (true) { -__arch_cpu_idle (); + __asm__ __volatile__("idle 0" : : :"memory" ); } }
@@ -53,7 +53,7 @@ void machine_power_off(void)#endif while (true) { -__arch_cpu_idle (); + __asm__ __volatile__("idle 0" : : :"memory" ); } }
@@ -74,6 +74,6 @@ void machine_restart(char *command)acpi_reboot ();while (true) { -__arch_cpu_idle (); + __asm__ __volatile__("idle 0" : : :"memory" ); } }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 27/230 LoongArch: csum: Fix OoB access in IP checksum code for negative lengths
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuli Wang <[email protected]>
[ Upstream commit 6287f1a8c16138c2ec750953e35039634018c84a ]
Commit 69e3a6aa6be2 ("LoongArch: Add checksum optimization for 64-bit system") would cause an undefined shift and an out-of-bounds read.
Commit 8bd795fedb84 ("arm64: csum: Fix OoB access in IP checksum code for negative lengths") fixes the same issue on ARM64.
--- arch/loongarch/lib/csum.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/loongarch/lib/csum.c +1 -1
@@ -25,7 +25,7 @@ unsigned int __no_sanitize_address do_csum(const unsigned char *buff, int len)const u64 *ptr;u64 data, sum64 =0 ; -if (unlikely (len ==0 )) +if (unlikely (len <=0 ))return 0 ; offset = (unsigned long )buff &7 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 28/230 LoongArch: KVM: Fix typo issue about GCFG feature detection
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bibo Mao <[email protected]>
[ Upstream commit bdb13252e5d1518823b81f458d9975c85d5240c2 ]
This is typo issue and misusage about GCFG feature macro. The code is wrong, only that it does not cause obvious problem since GCFG is set again on vCPU context switch.
--- arch/loongarch/kvm/main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/loongarch/kvm/main.c +2 -2
@@ -283,9 +283,9 @@ int kvm_arch_enable_virtualization_cpu(void)* TOE=0: Trap on Exception. * TIT=0: Trap on Timer. */ -if (env &CSR_GCFG_GCIP_ALL ) +if (env &CSR_GCFG_GCIP_SECURE ) gcfg |=CSR_GCFG_GCI_SECURE ; -if (env &CSR_GCFG_MATC_ROOT ) +if (env &CSR_GCFG_MATP_ROOT ) gcfg |=CSR_GCFG_MATC_ROOT ;write_csr_gcfg (gcfg);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 29/230 net: ethernet: ti: am65-cpsw: fix memleak in certain XDP cases
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roger Quadros <[email protected]>
[ Upstream commit 5db843258de1e4e6b1ef1cbd1797923c9e3de548 ]
If the XDP program doesn't result in XDP_PASS then we leak the memory allocated by am65_cpsw_build_skb().
It is pointless to allocate SKB memory before running the XDP program as we would be wasting CPU cycles for cases other than XDP_PASS. Move the SKB allocation after evaluating the XDP program result.
This fixes the memleak. A performance boost is seen for XDP_DROP test.
XDP_DROP test:
Before: 460256 rx/s 0 err/s After: 784130 rx/s 0 err/s
--- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 26 ++++++++++++------------ 1 file changed, 13 insertions(+), 13 deletions(-)
drivers/net/ethernet/ti/am65-cpsw-nuss.c +13 -13
@@ -599,7 +599,8 @@ static void am65_cpsw_nuss_tx_cleanup(void *data, dma_addr_t desc_dma)static struct sk_buff *am65_cpsw_build_skb (void *page_addr,struct net_device *ndev, -unsigned int len) +unsigned int len, +unsigned int headroom) {struct sk_buff *skb;
@@ -609,7 +610,7 @@ static struct sk_buff *am65_cpsw_build_skb(void *page_addr,if (unlikely (!skb))return NULL ; -skb_reserve (skb,AM65_CPSW_HEADROOM ); +skb_reserve (skb, headroom); skb->dev = ndev;return skb;
@@ -1191,16 +1192,8 @@ static int am65_cpsw_nuss_rx_packets(struct am65_cpsw_rx_flow *flow,dev_dbg (dev,"%s rx csum_info:%#x\n" , __func__, csum_info);dma_unmap_single (rx_chn->dma_dev, buf_dma, buf_dma_len,DMA_FROM_DEVICE ); -k3_cppi_desc_pool_free (rx_chn->desc_pool, desc_rx); - skb =am65_cpsw_build_skb (page_addr, ndev, -AM65_CPSW_MAX_PACKET_SIZE ); -if (unlikely (!skb)) { - new_page = page; - goto requeue; - } -if (port->xdp_prog) {xdp_init_buff (&xdp,PAGE_SIZE , &port->xdp_rxq[flow->id]); xdp_prepare_buff(&xdp, page_addr, AM65_CPSW_HEADROOM,
@@ -1210,9 +1203,16 @@ static int am65_cpsw_nuss_rx_packets(struct am65_cpsw_rx_flow *flow,if (*xdp_state !=AM65_CPSW_XDP_PASS ) goto allocate; -/* Compute additional headroom to be reserved */ - headroom = (xdp.data - xdp.data_hard_start) -skb_headroom (skb); -skb_reserve (skb, headroom); + headroom = xdp.data - xdp.data_hard_start; + }else { + headroom =AM65_CPSW_HEADROOM ; + } + + skb =am65_cpsw_build_skb (page_addr, ndev, +AM65_CPSW_MAX_PACKET_SIZE , headroom); +if (unlikely (!skb)) { + new_page = page; + goto requeue; } ndev_priv =netdev_priv (ndev);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 30/230 net: ethernet: ti: am65_cpsw: fix tx_cleanup for XDP case
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roger Quadros <[email protected]>
[ Upstream commit 4542536f664f752db5feba2c5998b165933c34f2 ]
For XDP transmit case, swdata doesn't contain SKB but the XDP Frame. Infer the correct swdata based on buffer type and return the XDP Frame for XDP transmit case.
--- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
drivers/net/ethernet/ti/am65-cpsw-nuss.c +11 -3
@@ -585,16 +585,24 @@ static void am65_cpsw_nuss_xmit_free(struct am65_cpsw_tx_chn *tx_chn,static void am65_cpsw_nuss_tx_cleanup (void *data,dma_addr_t desc_dma) {struct am65_cpsw_tx_chn *tx_chn = data; +enum am65_cpsw_tx_buf_type buf_type;struct cppi5_host_desc_t *desc_tx; +struct xdp_frame *xdpf;struct sk_buff *skb;void **swdata; desc_tx =k3_cppi_desc_pool_dma2virt (tx_chn->desc_pool, desc_dma); swdata =cppi5_hdesc_get_swdata (desc_tx); - skb = *(swdata); -am65_cpsw_nuss_xmit_free (tx_chn, desc_tx); + buf_type =am65_cpsw_nuss_buf_type (tx_chn, desc_dma); +if (buf_type ==AM65_CPSW_TX_BUF_TYPE_SKB ) { + skb = *(swdata); +dev_kfree_skb_any (skb); + }else { + xdpf = *(swdata); +xdp_return_frame (xdpf); + } -dev_kfree_skb_any (skb); +am65_cpsw_nuss_xmit_free (tx_chn, desc_tx); } static struct sk_buff *am65_cpsw_build_skb(void *page_addr,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 31/230 Bluetooth: btintel_pcie: Fix a potential race condition
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kiran K <[email protected]>
[ Upstream commit 872274b992839ff64fe560767fe7ee5f942ccdb1 ]
On HCI_OP_RESET command, firmware raises alive interrupt. Driver needs to wait for this before sending other command. This patch fixes the potential miss of alive interrupt due to which HCI_OP_RESET can timeout.
Expected flow:
If tx command is HCI_OP_RESET,
1. set data->gp0_received = false
2. send HCI_OP_RESET
3. wait for alive interrupt
Actual flow having potential race:
If tx command is HCI_OP_RESET,
1. send HCI_OP_RESET
1a. Firmware raises alive interrupt here and in ISR
data->gp0_received is set to true
2. set data->gp0_received = false
3. wait for alive interrupt
--- drivers/bluetooth/btintel_pcie.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/bluetooth/btintel_pcie.c +4 -1
@@ -1312,6 +1312,10 @@ static int btintel_pcie_send_frame(struct hci_dev *hdev,if (opcode ==0xfc01 )btintel_pcie_inject_cmd_complete (hdev, opcode); } +/* Firmware raises alive interrupt on HCI_OP_RESET */ +if (opcode ==HCI_OP_RESET ) + data->gp0_received = false; + hdev->stat.cmd_tx++;break ;case HCI_ACLDATA_PKT :
@@ -1349,7 +1353,6 @@ static int btintel_pcie_send_frame(struct hci_dev *hdev, opcode,btintel_pcie_alivectxt_state2str (old_ctxt), btintel_pcie_alivectxt_state2str(data->alive_intr_ctxt));if (opcode ==HCI_OP_RESET ) { - data->gp0_received = false; ret =wait_event_timeout (data->gp0_wait_q, data->gp0_received,msecs_to_jiffies (BTINTEL_DEFAULT_INTR_TIMEOUT_MS ));
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 32/230 team: better TEAM_OPTION_TYPE_STRING validation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 5bef3ac184b5626ea62385d6b82a1992b89d7940 ]
syzbot reported following splat [1]
Make sure user-provided data contains one nul byte.
[1]
BUG: KMSAN: uninit-value in string_nocheck lib/vsprintf.c:633 [inline] BUG: KMSAN: uninit-value in string+0x3ec/0x5f0 lib/vsprintf.c:714 string_nocheck lib/vsprintf.c:633 [inline] string+0x3ec/0x5f0 lib/vsprintf.c:714 vsnprintf+0xa5d/0x1960 lib/vsprintf.c:2843 __request_module+0x252/0x9f0 kernel/module/kmod.c:149 team_mode_get drivers/net/team/team_core.c:480 [inline] team_change_mode drivers/net/team/team_core.c:607 [inline] team_mode_option_set+0x437/0x970 drivers/net/team/team_core.c:1401 team_option_set drivers/net/team/team_core.c:375 [inline] team_nl_options_set_doit+0x1339/0x1f90 drivers/net/team/team_core.c:2662 genl_family_rcv_msg_doit net/netlink/genetlink.c:1115 [inline] genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0x1214/0x12c0 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x375/0x650 net/netlink/af_netlink.c:2543 genl_rcv+0x40/0x60 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1322 [inline] netlink_unicast+0xf52/0x1260 net/netlink/af_netlink.c:1348 netlink_sendmsg+0x10da/0x11e0 net/netlink/af_netlink.c:1892 sock_sendmsg_nosec net/socket.c:718 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:733 ____sys_sendmsg+0x877/0xb60 net/socket.c:2573 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2627 __sys_sendmsg net/socket.c:2659 [inline] __do_sys_sendmsg net/socket.c:2664 [inline] __se_sys_sendmsg net/socket.c:2662 [inline] __x64_sys_sendmsg+0x212/0x3c0 net/socket.c:2662 x64_sys_call+0x2ed6/0x3c30 arch/x86/include/generated/asm/syscalls_64.h:47 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f
--- drivers/net/team/team_core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/team/team_core.c +3 -1
@@ -2640,7 +2640,9 @@ int team_nl_options_set_doit(struct sk_buff *skb, struct genl_info *info) ctx.data.u32_val =nla_get_u32 (attr_data);break ;case TEAM_OPTION_TYPE_STRING : -if (nla_len (attr_data) >TEAM_STRING_MAX_LEN ) { +if (nla_len (attr_data) >TEAM_STRING_MAX_LEN || + !memchr (nla_data (attr_data),'\0' , +nla_len (attr_data))) { err = -EINVAL ; goto team_put; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 33/230 workqueue: Put the pwq after detaching the rescuer from the pool
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lai Jiangshan <[email protected]>
[ Upstream commit e76946110137703c16423baf6ee177b751a34b7e ]
The commit 68f83057b913("workqueue: Reap workers via kthread_stop() and remove detach_completion") adds code to reap the normal workers but mistakenly does not handle the rescuer and also removes the code waiting for the rescuer in put_unbound_pool(), which caused a use-after-free bug reported by Cheung Wall.
To avoid the use-after-free bug, the pool’s reference must be held until the detachment is complete. Therefore, move the code that puts the pwq after detaching the rescuer from the pool.
--- kernel/workqueue.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
kernel/workqueue.c +6 -6
@@ -3509,12 +3509,6 @@ static int rescuer_thread(void *__rescuer) } } -/* -* Put the reference grabbed by send_mayday(). @pool won't -* go away while we're still attached to it. -*/ -put_pwq (pwq); -/* * Leave this pool. Notify regular workers; otherwise, we end up * with 0 concurrency and stalling the execution.
@@ -3525,6 +3519,12 @@ static int rescuer_thread(void *__rescuer)worker_detach_from_pool (rescuer); +/* +* Put the reference grabbed by send_mayday(). @pool might +* go away any time after it. +*/ +put_pwq_unlocked (pwq); +raw_spin_lock_irq (&wq_mayday_lock); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 34/230 sched_ext: Fix lock imbalance in dispatch_to_local_dsq()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrea Righi <[email protected]>
[ Upstream commit 1626e5ef0b00386a4fd083fa7c46c8edbd75f9b4 ]
While performing the rq locking dance in dispatch_to_local_dsq(), we may trigger the following lock imbalance condition, in particular when multiple tasks are rapidly changing CPU affinity (i.e., running a stress-ng --race-sched 0):
[ 13.413579] =====================================
[ 13.413660] WARNING: bad unlock balance detected!
[ 13.413729] 6.13.0-virtme #15 Not tainted
[ 13.413792] -------------------------------------
[ 13.413859] kworker/1:1/80 is trying to release lock (&rq->__lock) at:
[ 13.413954] [<ffffffff873c6c48>] dispatch_to_local_dsq+0x108/0x1a0
[ 13.414111] but there are no more locks to release!
[ 13.414176]
[ 13.414176] other info that might help us debug this:
[ 13.414258] 1 lock held by kworker/1:1/80:
[ 13.414318] #0: ffff8b66feb41698 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x20/0x90
[ 13.414612]
[ 13.414612] stack backtrace:
[ 13.415255] CPU: 1 UID: 0 PID: 80 Comm: kworker/1:1 Not tainted 6.13.0-virtme #15
[ 13.415505] Workqueue: 0x0 (events)
[ 13.415567] Sched_ext: dsp_local_on (enabled+all), task: runnable_at=-2ms
[ 13.415570] Call Trace:
[ 13.415700] <TASK>
[ 13.415744] dump_stack_lvl+0x78/0xe0
[ 13.415806] ? dispatch_to_local_dsq+0x108/0x1a0
[ 13.415884] print_unlock_imbalance_bug+0x11b/0x130
[ 13.415965] ? dispatch_to_local_dsq+0x108/0x1a0
[ 13.416226] lock_release+0x231/0x2c0
[ 13.416326] _raw_spin_unlock+0x1b/0x40
[ 13.416422] dispatch_to_local_dsq+0x108/0x1a0
[ 13.416554] flush_dispatch_buf+0x199/0x1d0
[ 13.416652] balance_one+0x194/0x370
[ 13.416751] balance_scx+0x61/0x1e0
[ 13.416848] prev_balance+0x43/0xb0
[ 13.416947] __pick_next_task+0x6b/0x1b0
[ 13.417052] __schedule+0x20d/0x1740This happens because dispatch_to_local_dsq() is racing with dispatch_dequeue() and, when the latter wins, we incorrectly assume that the task has been moved to dst_rq.
Fix by properly tracking the currently locked rq.
--- kernel/sched/ext.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
kernel/sched/ext.c +10 -4
@@ -2458,6 +2458,9 @@ static void dispatch_to_local_dsq(struct rq *rq, struct scx_dispatch_q *dst_dsq, {struct rq *src_rq =task_rq (p); struct rq *dst_rq = container_of(dst_dsq, struct rq, scx.local_dsq); +#ifdef CONFIG_SMP +struct rq *locked_rq = rq; +#endif /* * We're synchronized against dequeue through DISPATCHING. As @p can't
@@ -2494,8 +2497,9 @@ static void dispatch_to_local_dsq(struct rq *rq, struct scx_dispatch_q *dst_dsq,atomic_long_set_release (&p->scx.ops_state,SCX_OPSS_NONE );/* switch to @src_rq lock */ -if (rq != src_rq) { -raw_spin_rq_unlock (rq); +if (locked_rq != src_rq) { +raw_spin_rq_unlock (locked_rq); + locked_rq = src_rq;raw_spin_rq_lock (src_rq); }
@@ -2513,6 +2517,8 @@ static void dispatch_to_local_dsq(struct rq *rq, struct scx_dispatch_q *dst_dsq, }else {move_remote_task_to_local_dsq (p, enq_flags, src_rq, dst_rq); +/* task has been moved to dst_rq, which is now locked */ + locked_rq = dst_rq; }/* if the destination CPU is idle, wake it up */
@@ -2521,8 +2527,8 @@ static void dispatch_to_local_dsq(struct rq *rq, struct scx_dispatch_q *dst_dsq, }/* switch back to @rq lock */ -if (rq != dst_rq) { -raw_spin_rq_unlock (dst_rq); +if (locked_rq != rq) { +raw_spin_rq_unlock (locked_rq);raw_spin_rq_lock (rq); }#else /* CONFIG_SMP */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 35/230 drm/tests: hdmi: Fix WW_MUTEX_SLOWPATH failures
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxime Ripard <[email protected]>
[ Upstream commit fb97bc2e47f694f79d6358d981ae0428db8e8088 ]
The light_up_connector helper function in the HDMI infrastructure unit tests uses drm_atomic_set_crtc_for_connector(), but fails when it returns an error.
This function can return EDEADLK though if the sequence needs to be restarted, and WW_MUTEX_SLOWPATH is meant to test that we handle it properly.
Let's handle EDEADLK and restart the sequence in our tests as well.
--- drivers/gpu/drm/tests/drm_hdmi_state_helper_test.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/gpu/drm/tests/drm_hdmi_state_helper_test.c +7 -0
@@ -70,10 +70,17 @@ static int light_up_connector(struct kunit *test, state =drm_kunit_helper_atomic_state_alloc (test, drm, ctx);KUNIT_ASSERT_NOT_ERR_OR_NULL (test, state); +retry: conn_state =drm_atomic_get_connector_state (state, connector);KUNIT_ASSERT_NOT_ERR_OR_NULL (test, conn_state); ret =drm_atomic_set_crtc_for_connector (conn_state, crtc); +if (ret == -EDEADLK ) { +drm_atomic_state_clear (state); + ret =drm_modeset_backoff (ctx); +if (!ret) + goto retry; + }KUNIT_EXPECT_EQ (test, ret,0 ); crtc_state =drm_atomic_get_crtc_state (state, crtc);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 36/230 arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Radu Rendec <[email protected]>
[ Upstream commit 875d742cf5327c93cba1f11e12b08d3cce7a88d2 ]
The loop that detects/populates cache information already has a bounds check on the array size but does not account for cache levels with separate data/instructions cache. Fix this by incrementing the index for any populated leaf (instead of any populated level).
--- arch/arm64/kernel/cacheinfo.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
arch/arm64/kernel/cacheinfo.c +7 -5
@@ -101,16 +101,18 @@ int populate_cache_leaves(unsigned int cpu)unsigned int level, idx;enum cache_type type;struct cpu_cacheinfo *this_cpu_ci =get_cpu_cacheinfo (cpu); -struct cacheinfo *this_leaf = this_cpu_ci->info_list; +struct cacheinfo *infos = this_cpu_ci->info_list;for (idx =0 , level =1 ; level <= this_cpu_ci->num_levels && - idx < this_cpu_ci->num_leaves; idx++, level++) { + idx < this_cpu_ci->num_leaves; level++) { type =get_cache_type (level);if (type ==CACHE_TYPE_SEPARATE ) { -ci_leaf_init (this_leaf++,CACHE_TYPE_DATA , level); -ci_leaf_init (this_leaf++,CACHE_TYPE_INST , level); +if (idx +1 >= this_cpu_ci->num_leaves) +break ; +ci_leaf_init (&infos[idx++],CACHE_TYPE_DATA , level); +ci_leaf_init (&infos[idx++],CACHE_TYPE_INST , level); }else { -ci_leaf_init (this_leaf++, type, level); +ci_leaf_init (&infos[idx++], type, level); } }return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 37/230 gpu: host1x: Fix a use of uninitialized mutex
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rupinderjit Singh <[email protected]>
[ Upstream commit 02458fbfaa0170aabf8506f7d4ed054f02414251 ]
commit c8347f915e67 ("gpu: host1x: Fix boot regression for Tegra") caused a use of uninitialized mutex leading to below warning when CONFIG_DEBUG_MUTEXES and CONFIG_DEBUG_LOCK_ALLOC are enabled.
[ 41.662843] ------------[ cut here ]------------ [ 41.663012] DEBUG_LOCKS_WARN_ON(lock->magic != lock) [ 41.663035] WARNING: CPU: 4 PID: 794 at kernel/locking/mutex.c:587 __mutex_lock+0x670/0x878 [ 41.663458] Modules linked in: rtw88_8822c(+) bluetooth(+) rtw88_pci rtw88_core mac80211 aquantia libarc4 crc_itu_t cfg80211 tegra194_cpufreq dwmac_tegra(+) arm_dsu_pmu stmmac_platform stmmac pcs_xpcs rfkill at24 host1x(+) tegra_bpmp_thermal ramoops reed_solomon fuse loop nfnetlink xfs mmc_block rpmb_core ucsi_ccg ina3221 crct10dif_ce xhci_tegra ghash_ce lm90 sha2_ce sha256_arm64 sha1_ce sdhci_tegra pwm_fan sdhci_pltfm sdhci gpio_keys rtc_tegra cqhci mmc_core phy_tegra_xusb i2c_tegra tegra186_gpc_dma i2c_tegra_bpmp spi_tegra114 dm_mirror dm_region_hash dm_log dm_mod [ 41.665078] CPU: 4 UID: 0 PID: 794 Comm: (udev-worker) Not tainted 6.11.0-29.31_1538613708.el10.aarch64+debug #1 [ 41.665838] Hardware name: NVIDIA NVIDIA Jetson AGX Orin Developer Kit/Jetson, BIOS 36.3.0-gcid-35594366 02/26/2024 [ 41.672555] pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 41.679636] pc : __mutex_lock+0x670/0x878 [ 41.683834] lr : __mutex_lock+0x670/0x878 [ 41.688035] sp : ffff800084b77090 [ 41.691446] x29: ffff800084b77160 x28: ffffdd4bebf7b000 x27: ffffdd4be96b1000 [ 41.698799] x26: 1fffe0002308361c x25: 1ffff0001096ee18 x24: 0000000000000000 [ 41.706149] x23: 0000000000000000 x22: 0000000000000002 x21: ffffdd4be6e3c7a0 [ 41.713500] x20: ffff800084b770f0 x19: ffff00011841b1e8 x18: 0000000000000000 [ 41.720675] x17: 0000000000000000 x16: 0000000000000000 x15: 0720072007200720 [ 41.728023] x14: 0000000000000000 x13: 0000000000000001 x12: ffff6001a96eaab3 [ 41.735375] x11: 1fffe001a96eaab2 x10: ffff6001a96eaab2 x9 : ffffdd4be4838bbc [ 41.742723] x8 : 00009ffe5691554e x7 : ffff000d4b755593 x6 : 0000000000000001 [ 41.749985] x5 : ffff000d4b755590 x4 : 1fffe0001d88f001 x3 : dfff800000000000 [ 41.756988] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000ec478000 [ 41.764251] Call trace: [ 41.766695] __mutex_lock+0x670/0x878 [ 41.770373] mutex_lock_nested+0x2c/0x40 [ 41.774134] host1x_intr_start+0x54/0xf8 [host1x] [ 41.778863] host1x_runtime_resume+0x150/0x228 [host1x] [ 41.783935] pm_generic_runtime_resume+0x84/0xc8 [ 41.788485] __rpm_callback+0xa0/0x478 [ 41.792422] rpm_callback+0x15c/0x1a8 [ 41.795922] rpm_resume+0x698/0xc08 [ 41.799597] __pm_runtime_resume+0xa8/0x140 [ 41.803621] host1x_probe+0x810/0xbc0 [host1x] [ 41.807909] platform_probe+0xcc/0x1a8 [ 41.811845] really_probe+0x188/0x800 [ 41.815347] __driver_probe_device+0x164/0x360 [ 41.819810] driver_probe_device+0x64/0x1a8 [ 41.823834] __driver_attach+0x180/0x490 [ 41.827773] bus_for_each_dev+0x104/0x1a0 [ 41.831797] driver_attach+0x44/0x68 [ 41.835296] bus_add_driver+0x23c/0x4e8 [ 41.839235] driver_register+0x15c/0x3a8 [ 41.843170] __platform_register_drivers+0xa4/0x208 [ 41.848159] tegra_host1x_init+0x4c/0xff8 [host1x] [ 41.853147] do_one_initcall+0xd4/0x380 [ 41.856997] do_init_module+0x1dc/0x698 [ 41.860758] load_module+0xc70/0x1300 [ 41.864435] __do_sys_init_module+0x1a8/0x1d0 [ 41.868721] __arm64_sys_init_module+0x74/0xb0 [ 41.873183] invoke_syscall.constprop.0+0xdc/0x1e8 [ 41.877997] do_el0_svc+0x154/0x1d0 [ 41.881671] el0_svc+0x54/0x140 [ 41.884820] el0t_64_sync_handler+0x120/0x130 [ 41.889285] el0t_64_sync+0x1a4/0x1a8 [ 41.892960] irq event stamp: 69737 [ 41.896370] hardirqs last enabled at (69737): [<ffffdd4be6d7768c>] _raw_spin_unlock_irqrestore+0x44/0xe8 [ 41.905739] hardirqs last disabled at (69736): [<ffffdd4be59dcd40>] clk_enable_lock+0x98/0x198 [ 41.914314] softirqs last enabled at (68082): [<ffffdd4be466b1d0>] handle_softirqs+0x4c8/0x890 [ 41.922977] softirqs last disabled at (67945): [<ffffdd4be44f02a4>] __do_softirq+0x1c/0x28 [ 41.931289] ---[ end trace 0000000000000000 ]---
Inside the probe function when pm_runtime_enable() is called, the PM core invokes a resume callback if the device Host1x is in a suspended state. As it can be seen in the logs above, this leads to host1x_intr_start() function call which is trying to acquire a mutex lock. But, the function host_intr_init() only gets called after the pm_runtime_enable() where mutex is initialised leading to the use of mutex prior to its initialisation.
Fix this by moving the mutex initialisation prior to the runtime PM enablement function pm_runtime_enable() in probe.
--- drivers/gpu/host1x/dev.c | 2 ++ drivers/gpu/host1x/intr.c | 2 -- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/host1x/dev.c +2 -0
@@ -625,6 +625,8 @@ static int host1x_probe(struct platform_device *pdev) goto free_contexts; } +mutex_init (&host->intr_mutex); +pm_runtime_enable (&pdev->dev); err =devm_tegra_core_dev_init_opp_table_common (&pdev->dev);
drivers/gpu/host1x/intr.c +0 -2
@@ -104,8 +104,6 @@ int host1x_intr_init(struct host1x *host)unsigned int id;int i, err; -mutex_init (&host->intr_mutex); -for (id =0 ; id <host1x_syncpt_nb_pts (host); ++id) {struct host1x_syncpt *syncpt = &host->syncpt[id];
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 38/230 cgroup: Remove steal time from usage_usec
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Adeel <[email protected]>
[ Upstream commit db5fd3cf8bf41b84b577b8ad5234ea95f327c9be ]
The CPU usage time is the time when user, system or both are using the CPU. Steal time is the time when CPU is waiting to be run by the Hypervisor. It should not be added to the CPU usage time, hence removing it from the usage_usec entry.
--- kernel/cgroup/rstat.c | 1 - 1 file changed, 1 deletion(-)
kernel/cgroup/rstat.c +0 -1
@@ -586,7 +586,6 @@ static void root_cgroup_cputime(struct cgroup_base_stat *bstat) cputime->sum_exec_runtime += user; cputime->sum_exec_runtime += sys; - cputime->sum_exec_runtime += cpustat[CPUTIME_STEAL ];#ifdef CONFIG_SCHED_CORE bstat->forceidle_sum += cpustat[CPUTIME_FORCEIDLE ];
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 39/230 perf/x86/intel: Clean up PEBS-via-PT on hybrid
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kan Liang <[email protected]>
[ Upstream commit 0a5561501397e2bbd0fb0e300eb489f72a90597a ]
The PEBS-via-PT feature is exposed for the e-core of some hybrid platforms, e.g., ADL and MTL. But it never works.
$ dmesg | grep PEBS [ 1.793888] core: cpu_atom PMU driver: PEBS-via-PT
$ perf record -c 1000 -e '{intel_pt/branch=0/,
cpu_atom/cpu-cycles,aux-output/pp}' -C8
Error:
The sys_perf_event_open() syscall returned with 22 (Invalid argument)
for event (cpu_atom/cpu-cycles,aux-output/pp).
"dmesg | grep -i perf" may provide additional information.The "PEBS-via-PT" is printed if the corresponding bit of per-PMU capabilities is set. Since the feature is supported by the e-core HW, perf sets the bit for e-core. However, for Intel PT, if a feature is not supported on all CPUs, it is not supported at all. The PEBS-via-PT event cannot be created successfully.
The PEBS-via-PT is no longer enumerated on the latest hybrid platform. It will be deprecated on future platforms with Arch PEBS. Let's remove it from the existing hybrid platforms.
--- arch/x86/events/intel/core.c | 10 ---------- arch/x86/events/intel/ds.c | 10 +++++++++- 2 files changed, 9 insertions(+), 11 deletions(-)
arch/x86/events/intel/core.c +0 -10
@@ -4901,11 +4901,6 @@ static void intel_pmu_check_hybrid_pmus(struct x86_hybrid_pmu *pmu)else pmu->intel_ctrl &= ~(1ULL <<GLOBAL_CTRL_EN_PERF_METRICS ); -if (pmu->intel_cap.pebs_output_pt_available) - pmu->pmu.capabilities |=PERF_PMU_CAP_AUX_OUTPUT ; -else - pmu->pmu.capabilities &= ~PERF_PMU_CAP_AUX_OUTPUT ; - intel_pmu_check_event_constraints(pmu->event_constraints, pmu->cntr_mask64, pmu->fixed_cntr_mask64,
@@ -4974,9 +4969,6 @@ static bool init_hybrid_pmu(int cpu)pr_info ("%s PMU driver: " , pmu->name); -if (pmu->intel_cap.pebs_output_pt_available) -pr_cont ("PEBS-via-PT " ); -pr_cont ("\n" );x86_pmu_show_pmu_cap (&pmu->pmu);
@@ -6284,11 +6276,9 @@ static __always_inline int intel_pmu_init_hybrid(enum hybrid_pmu_type pmus) pmu->intel_cap.capabilities = x86_pmu.intel_cap.capabilities;if (pmu->pmu_type & hybrid_small) { pmu->intel_cap.perf_metrics =0 ; - pmu->intel_cap.pebs_output_pt_available =1 ; pmu->mid_ack = true; }else if (pmu->pmu_type & hybrid_big) { pmu->intel_cap.perf_metrics =1 ; - pmu->intel_cap.pebs_output_pt_available =0 ; pmu->late_ack = true; } }
arch/x86/events/intel/ds.c +9 -1
@@ -2523,7 +2523,15 @@ void __init intel_ds_init(void) }pr_cont ("PEBS fmt4%c%s, " , pebs_type, pebs_qual); -if (!is_hybrid () && x86_pmu.intel_cap.pebs_output_pt_available) { +/* +* The PEBS-via-PT is not supported on hybrid platforms, +* because not all CPUs of a hybrid machine support it. +* The global x86_pmu.intel_cap, which only contains the +* common capabilities, is used to check the availability +* of the feature. The per-PMU pebs_output_pt_available +* in a hybrid machine should be ignored. +*/ +if (x86_pmu.intel_cap.pebs_output_pt_available) {pr_cont ("PEBS-via-PT, " );x86_get_pmu (smp_processor_id ())->capabilities |=PERF_PMU_CAP_AUX_OUTPUT ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 40/230 drm/xe/client: bo->client does not need bos_lock
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejas Upadhyay <[email protected]>
[ Upstream commit fc876c9524e2a9f816f51d533ed31df789cff65a ]
bos_lock is to protect list of bos used by client, it is not required to protect bo->client so bring it outside of bos_lock.
--- drivers/gpu/drm/xe/xe_drm_client.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/xe/xe_drm_client.c +1 -1
@@ -135,8 +135,8 @@ void xe_drm_client_add_bo(struct xe_drm_client *client,XE_WARN_ON (bo->client);XE_WARN_ON (!list_empty (&bo->client_link)); -spin_lock (&client->bos_lock); bo->client =xe_drm_client_get (client); +spin_lock (&client->bos_lock);list_add_tail (&bo->client_link, &client->bos_list);spin_unlock (&client->bos_lock); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 41/230 drm/i915/selftests: avoid using uninitialized context
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Karas <[email protected]>
[ Upstream commit 53139b3f9998ea07289e7b70b909fea2264a0de9 ]
There is an error path in igt_ppgtt_alloc(), which leads to ww object being passed down to i915_gem_ww_ctx_fini() without initialization. Correct that by only putting ppgtt->vm and returning early.
--- drivers/gpu/drm/i915/selftests/i915_gem_gtt.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/i915/selftests/i915_gem_gtt.c +2 -2
@@ -168,7 +168,7 @@ static int igt_ppgtt_alloc(void *arg)return PTR_ERR (ppgtt);if (!ppgtt->vm.allocate_va_range) - goto err_ppgtt_cleanup; + goto ppgtt_vm_put;/* * While we only allocate the page tables here and so we could
@@ -236,7 +236,7 @@ static int igt_ppgtt_alloc(void *arg) goto retry; }i915_gem_ww_ctx_fini (&ww); - +ppgtt_vm_put:i915_vm_put (&ppgtt->vm);return err; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 42/230 gpio: bcm-kona: Fix GPIO lock/unlock for banks above bank 0
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Artur Weber <[email protected]>
[ Upstream commit de1d0d160f64ee76df1d364d521b2faf465a091c ]
The GPIO lock/unlock functions clear/write a bit to the relevant register for each bank. However, due to an oversight the bit that was being written was based on the total GPIO number, not the index of the GPIO within the relevant bank, causing it to fail for any GPIO above 32 (thus any GPIO for banks above bank 0).
Fix lock/unlock for these banks by using the correct bit.
--- drivers/gpio/gpio-bcm-kona.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/gpio/gpio-bcm-kona.c +4 -2
@@ -86,11 +86,12 @@ static void bcm_kona_gpio_lock_gpio(struct bcm_kona_gpio *kona_gpio,u32 val;unsigned long flags;int bank_id =GPIO_BANK (gpio); +int bit =GPIO_BIT (gpio);raw_spin_lock_irqsave (&kona_gpio->lock, flags); val =readl (kona_gpio->reg_base +GPIO_PWD_STATUS (bank_id)); - val |=BIT (gpio); + val |=BIT (bit);bcm_kona_gpio_write_lock_regs (kona_gpio->reg_base, bank_id, val);raw_spin_unlock_irqrestore (&kona_gpio->lock, flags);
@@ -102,11 +103,12 @@ static void bcm_kona_gpio_unlock_gpio(struct bcm_kona_gpio *kona_gpio,u32 val;unsigned long flags;int bank_id =GPIO_BANK (gpio); +int bit =GPIO_BIT (gpio);raw_spin_lock_irqsave (&kona_gpio->lock, flags); val =readl (kona_gpio->reg_base +GPIO_PWD_STATUS (bank_id)); - val &= ~BIT (gpio); + val &= ~BIT (bit);bcm_kona_gpio_write_lock_regs (kona_gpio->reg_base, bank_id, val);raw_spin_unlock_irqrestore (&kona_gpio->lock, flags);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 43/230 gpio: bcm-kona: Make sure GPIO bits are unlocked when requesting IRQ
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Artur Weber <[email protected]>
[ Upstream commit 57f5db77a915cc29461a679a6bcae7097967be1a ]
The settings for all GPIOs are locked by default in bcm_kona_gpio_reset. The settings for a GPIO are unlocked when requesting it as a GPIO, but not when requesting it as an interrupt, causing the IRQ settings to not get applied.
Fix this by making sure to unlock the right bits when an IRQ is requested. To avoid a situation where an IRQ being released causes a lock despite the same GPIO being used by a GPIO request or vice versa, add an unlock counter and only lock if it reaches 0.
--- drivers/gpio/gpio-bcm-kona.c | 67 +++++++++++++++++++++++++++++------- 1 file changed, 55 insertions(+), 12 deletions(-)
drivers/gpio/gpio-bcm-kona.c +55 -12
@@ -69,6 +69,22 @@ struct bcm_kona_gpio {struct bcm_kona_gpio_bank {int id;int irq; +/* +* Used to keep track of lock/unlock operations for each GPIO in the +* bank. +* +* All GPIOs are locked by default (see bcm_kona_gpio_reset), and the +* unlock count for all GPIOs is 0 by default. Each unlock increments +* the counter, and each lock decrements the counter. +* +* The lock function only locks the GPIO once its unlock counter is +* down to 0. This is necessary because the GPIO is unlocked in two +* places in this driver: once for requested GPIOs, and once for +* requested IRQs. Since it is possible for a GPIO to be requested +* as both a GPIO and an IRQ, we need to ensure that we don't lock it +* too early. +*/ +u8 gpio_unlock_count[GPIO_PER_BANK ];/* Used in the interrupt handler */ struct bcm_kona_gpio *kona_gpio; };
@@ -87,14 +103,23 @@ static void bcm_kona_gpio_lock_gpio(struct bcm_kona_gpio *kona_gpio,unsigned long flags;int bank_id =GPIO_BANK (gpio);int bit =GPIO_BIT (gpio); +struct bcm_kona_gpio_bank *bank = &kona_gpio->banks[bank_id]; -raw_spin_lock_irqsave (&kona_gpio->lock, flags); +if (bank->gpio_unlock_count[bit] ==0 ) { +dev_err (kona_gpio->gpio_chip.parent, +"Unbalanced locks for GPIO %u\n" , gpio); +return ; + } - val =readl (kona_gpio->reg_base +GPIO_PWD_STATUS (bank_id)); - val |=BIT (bit); -bcm_kona_gpio_write_lock_regs (kona_gpio->reg_base, bank_id, val); +if (--bank->gpio_unlock_count[bit] ==0 ) { +raw_spin_lock_irqsave (&kona_gpio->lock, flags); -raw_spin_unlock_irqrestore (&kona_gpio->lock, flags); + val =readl (kona_gpio->reg_base +GPIO_PWD_STATUS (bank_id)); + val |=BIT (bit); +bcm_kona_gpio_write_lock_regs (kona_gpio->reg_base, bank_id, val); + +raw_spin_unlock_irqrestore (&kona_gpio->lock, flags); + } } static void bcm_kona_gpio_unlock_gpio(struct bcm_kona_gpio *kona_gpio,
@@ -104,14 +129,19 @@ static void bcm_kona_gpio_unlock_gpio(struct bcm_kona_gpio *kona_gpio,unsigned long flags;int bank_id =GPIO_BANK (gpio);int bit =GPIO_BIT (gpio); +struct bcm_kona_gpio_bank *bank = &kona_gpio->banks[bank_id]; -raw_spin_lock_irqsave (&kona_gpio->lock, flags); +if (bank->gpio_unlock_count[bit] ==0 ) { +raw_spin_lock_irqsave (&kona_gpio->lock, flags); - val =readl (kona_gpio->reg_base +GPIO_PWD_STATUS (bank_id)); - val &= ~BIT (bit); -bcm_kona_gpio_write_lock_regs (kona_gpio->reg_base, bank_id, val); + val =readl (kona_gpio->reg_base +GPIO_PWD_STATUS (bank_id)); + val &= ~BIT (bit); +bcm_kona_gpio_write_lock_regs (kona_gpio->reg_base, bank_id, val); -raw_spin_unlock_irqrestore (&kona_gpio->lock, flags); +raw_spin_unlock_irqrestore (&kona_gpio->lock, flags); + } + + ++bank->gpio_unlock_count[bit]; }static int bcm_kona_gpio_get_dir (struct gpio_chip *chip,unsigned gpio)
@@ -362,6 +392,7 @@ static void bcm_kona_gpio_irq_mask(struct irq_data *d) kona_gpio =irq_data_get_irq_chip_data (d); reg_base = kona_gpio->reg_base; +raw_spin_lock_irqsave (&kona_gpio->lock, flags); val =readl (reg_base +GPIO_INT_MASK (bank_id));
@@ -384,6 +415,7 @@ static void bcm_kona_gpio_irq_unmask(struct irq_data *d) kona_gpio =irq_data_get_irq_chip_data (d); reg_base = kona_gpio->reg_base; +raw_spin_lock_irqsave (&kona_gpio->lock, flags); val =readl (reg_base +GPIO_INT_MSKCLR (bank_id));
@@ -479,15 +511,26 @@ static void bcm_kona_gpio_irq_handler(struct irq_desc *desc)static int bcm_kona_gpio_irq_reqres (struct irq_data *d) {struct bcm_kona_gpio *kona_gpio =irq_data_get_irq_chip_data (d); +unsigned int gpio = d->hwirq; + +/* +* We need to unlock the GPIO before any other operations are performed +* on the relevant GPIO configuration registers +*/ +bcm_kona_gpio_unlock_gpio (kona_gpio, gpio); -return gpiochip_reqres_irq (&kona_gpio->gpio_chip, d->hwirq); +return gpiochip_reqres_irq (&kona_gpio->gpio_chip, gpio); }static void bcm_kona_gpio_irq_relres (struct irq_data *d) {struct bcm_kona_gpio *kona_gpio =irq_data_get_irq_chip_data (d); +unsigned int gpio = d->hwirq; + +/* Once we no longer use it, lock the GPIO again */ +bcm_kona_gpio_lock_gpio (kona_gpio, gpio); -gpiochip_relres_irq (&kona_gpio->gpio_chip, d->hwirq); +gpiochip_relres_irq (&kona_gpio->gpio_chip, gpio); }static struct irq_chip bcm_gpio_irq_chip = {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 44/230 gpio: bcm-kona: Add missing newline to dev_err format string
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Artur Weber <[email protected]>
[ Upstream commit 615279db222c3ac56d5c93716efd72b843295c1f ]
Add a missing newline to the format string of the "Couldn't get IRQ for bank..." error message.
--- drivers/gpio/gpio-bcm-kona.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpio/gpio-bcm-kona.c +1 -1
@@ -659,7 +659,7 @@ static int bcm_kona_gpio_probe(struct platform_device *pdev) bank->irq =platform_get_irq (pdev, i); bank->kona_gpio = kona_gpio;if (bank->irq <0 ) { -dev_err (dev,"Couldn't get IRQ for bank %d" , i); +dev_err (dev,"Couldn't get IRQ for bank %d\n" , i); ret = -ENOENT ; goto err_irq_domain; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 45/230 io_uring/waitid: dont abuse io_tw_state
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Begunkov <[email protected]>
[ Upstream commit 06521ac0485effdcc9c792cb0b40ed8e6f2f5fb8 ]
struct io_tw_state is managed by core io_uring, and opcode handling code must never try to cheat and create their own instances, it's plain incorrect.
io_waitid_complete() attempts exactly that outside of the task work context, and even though the ring is locked, there would be no one to reap the requests from the defer completion list. It only works now because luckily it's called before io_uring_try_cancel_uring_cmd(), which flushes completions.
--- io_uring/waitid.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
io_uring/waitid.c +2 -2
@@ -118,7 +118,6 @@ static int io_waitid_finish(struct io_kiocb *req, int ret)static void io_waitid_complete (struct io_kiocb *req,int ret) { struct io_waitid *iw = io_kiocb_to_cmd(req, struct io_waitid); -struct io_tw_state ts = {};/* anyone completing better be holding a reference */ WARN_ON_ONCE (!(atomic_read (&iw->refs) &IO_WAITID_REF_MASK ));
@@ -131,7 +130,6 @@ static void io_waitid_complete(struct io_kiocb *req, int ret)if (ret <0 )req_set_fail (req);io_req_set_res (req, ret,0 ); -io_req_task_complete (req, &ts); }static bool __io_waitid_cancel (struct io_ring_ctx *ctx,struct io_kiocb *req)
@@ -153,6 +151,7 @@ static bool __io_waitid_cancel(struct io_ring_ctx *ctx, struct io_kiocb *req)list_del_init (&iwa->wo.child_wait.entry);spin_unlock_irq (&iw->head->lock);io_waitid_complete (req, -ECANCELED ); +io_req_queue_tw_complete (req, -ECANCELED );return true; }
@@ -258,6 +257,7 @@ static void io_waitid_cb(struct io_kiocb *req, struct io_tw_state *ts) }io_waitid_complete (req, ret); +io_req_task_complete (req, ts); } static int io_waitid_wait(struct wait_queue_entry *wait, unsigned mode,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 46/230 io_uring/uring_cmd: remove dead req_has_async_data() check
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <[email protected]>
[ Upstream commit 0edf1283a9d1419a2095b4fcdd95c11ac00a191c ]
Any uring_cmd always has async data allocated now, there's no reason to check and clear a cached copy of the SQE.
--- io_uring/uring_cmd.c | 3 --- 1 file changed, 3 deletions(-)
io_uring/uring_cmd.c +0 -3
@@ -65,9 +65,6 @@ bool io_uring_try_cancel_uring_cmd(struct io_ring_ctx *ctx,continue ;if (cmd->flags &IORING_URING_CMD_CANCELABLE ) { -/* ->sqe isn't available if no async data */ -if (!req_has_async_data (req)) - cmd->sqe =NULL ; file->f_op->uring_cmd (cmd,IO_URING_F_CANCEL |IO_URING_F_COMPLETE_DEFER ); ret = true;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 47/230 amdkfd: properly free gang_ctx_bo when failed to init user queue
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhu Lingshan <[email protected]>
[ Upstream commit a33f7f9660705fb2ecf3467b2c48965564f392ce ]
The destructor of a gtt bo is declared as
void amdgpu_amdkfd_free_gtt_mem(struct amdgpu_device *adev, void **mem_obj); Which takes void** as the second parameter.
GCC allows passing void* to the function because void* can be implicitly casted to any other types, so it can pass compiling.
However, passing this void* parameter into the function's execution process(which expects void** and dereferencing void**) will result in errors.
--- drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c +1 -1
@@ -298,7 +298,7 @@ static int init_user_queue(struct process_queue_manager *pqm,return 0 ; free_gang_ctx_bo: -amdgpu_amdkfd_free_gtt_mem (dev->adev, (*q)->gang_ctx_bo); +amdgpu_amdkfd_free_gtt_mem (dev->adev, &(*q)->gang_ctx_bo); cleanup:uninit_queue (*q); *q =NULL ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 48/230 drm/amdgpu: bail out when failed to load fw in psp_init_cap_microcode()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiang Liu <[email protected]>
[ Upstream commit a0a455b4bc7483ad60e8b8a50330c1e05bb7bfcf ]
In function psp_init_cap_microcode(), it should bail out when failed to load firmware, otherwise it may cause invalid memory access.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +3 -2
@@ -3713,9 +3713,10 @@ int psp_init_cap_microcode(struct psp_context *psp, const char *chip_name)if (err == -ENODEV ) {dev_warn (adev->dev,"cap microcode does not exist, skip\n" ); err =0 ; - goto out; + }else { +dev_err (adev->dev,"fail to initialize cap microcode\n" ); } -dev_err (adev->dev,"fail to initialize cap microcode\n" ); + goto out; } info = &adev->firmware.ucode[AMDGPU_UCODE_ID_CAP ];
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 49/230 drm: Fix DSC BPP increment decoding
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Imre Deak <[email protected]>
[ Upstream commit e00a2e5d485faf53c7a24b9d1b575a642227947f ]
Starting with DPCD version 2.0 bits 6:3 of the DP_DSC_BITS_PER_PIXEL_INC DPCD register contains the NativeYCbCr422_MAX_bpp_DELTA field, which can be non-zero as opposed to earlier DPCD versions, hence decoding the bit_per_pixel increment value at bits 2:0 in the same register requires applying a mask, do so.
--- drivers/gpu/drm/display/drm_dp_helper.c | 2 +- include/drm/display/drm_dp.h | 1 + 2 files changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/display/drm_dp_helper.c +1 -1
@@ -2421,7 +2421,7 @@ u8 drm_dp_dsc_sink_bpp_incr(const u8 dsc_dpcd[DP_DSC_RECEIVER_CAP_SIZE]) {u8 bpp_increment_dpcd = dsc_dpcd[DP_DSC_BITS_PER_PIXEL_INC -DP_DSC_SUPPORT ]; -switch (bpp_increment_dpcd) { +switch (bpp_increment_dpcd &DP_DSC_BITS_PER_PIXEL_MASK ) {case DP_DSC_BITS_PER_PIXEL_1_16 :return 16 ;case DP_DSC_BITS_PER_PIXEL_1_8 :
include/drm/display/drm_dp.h +1 -0
@@ -359,6 +359,7 @@# define DP_DSC_BITS_PER_PIXEL_1_4 0x2# define DP_DSC_BITS_PER_PIXEL_1_2 0x3# define DP_DSC_BITS_PER_PIXEL_1_1 0x4 +# define DP_DSC_BITS_PER_PIXEL_MASK 0x7#define DP_PSR_SUPPORT 0x070/* XXX 1.2? */ # define DP_PSR_IS_SUPPORTED 1
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 50/230 xen/swiotlb: relax alignment requirements
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juergen Gross <[email protected]>
[ Upstream commit 85fcb57c983f423180ba6ec5d0034242da05cc54 ]
When mapping a buffer for DMA via .map_page or .map_sg DMA operations, there is no need to check the machine frames to be aligned according to the mapped areas size. All what is needed in these cases is that the buffer is contiguous at machine level.
So carve out the alignment check from range_straddles_page_boundary() and move it to a helper called by xen_swiotlb_alloc_coherent() and xen_swiotlb_free_coherent() directly.
--- drivers/xen/swiotlb-xen.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-)
drivers/xen/swiotlb-xen.c +12 -8
@@ -74,19 +74,21 @@ static inline phys_addr_t xen_dma_to_phys(struct device *dev,return xen_bus_to_phys (dev,dma_to_phys (dev, dma_addr)); } +static inline bool range_requires_alignment (phys_addr_t p,size_t size) +{ +phys_addr_t algn =1ULL << (get_order (size) +PAGE_SHIFT ); +phys_addr_t bus_addr =pfn_to_bfn (XEN_PFN_DOWN (p)) <<XEN_PAGE_SHIFT ; + +return IS_ALIGNED (p, algn) && !IS_ALIGNED (bus_addr, algn); +} +static inline int range_straddles_page_boundary (phys_addr_t p,size_t size) {unsigned long next_bfn, xen_pfn =XEN_PFN_DOWN (p);unsigned int i, nr_pages =XEN_PFN_UP (xen_offset_in_page (p) + size); -phys_addr_t algn =1ULL << (get_order (size) +PAGE_SHIFT ); next_bfn =pfn_to_bfn (xen_pfn); -/* If buffer is physically aligned, ensure DMA alignment. */ -if (IS_ALIGNED (p, algn) && - !IS_ALIGNED ((phys_addr_t )next_bfn <<XEN_PAGE_SHIFT , algn)) -return 1 ; -for (i =1 ; i < nr_pages; i++)if (pfn_to_bfn (++xen_pfn) != ++next_bfn)return 1 ;
@@ -156,7 +158,8 @@ xen_swiotlb_alloc_coherent(struct device *dev, size_t size, *dma_handle =xen_phys_to_dma (dev, phys);if (*dma_handle + size -1 > dma_mask || -range_straddles_page_boundary (phys, size)) { +range_straddles_page_boundary (phys, size) || +range_requires_alignment (phys, size)) {if (xen_create_contiguous_region (phys, order,fls64 (dma_mask), dma_handle) !=0 ) goto out_free_pages;
@@ -182,7 +185,8 @@ xen_swiotlb_free_coherent(struct device *dev, size_t size, void *vaddr, size =ALIGN (size,XEN_PAGE_SIZE );if (WARN_ON_ONCE (dma_handle + size -1 > dev->coherent_dma_mask) || -WARN_ON_ONCE (range_straddles_page_boundary (phys, size))) +WARN_ON_ONCE (range_straddles_page_boundary (phys, size) || +range_requires_alignment (phys, size)))return ;if (TestClearPageXenRemapped (virt_to_page (vaddr)))
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 51/230 x86/xen: allow larger contiguous memory regions in PV guests
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juergen Gross <[email protected]>
[ Upstream commit e93ec87286bd1fd30b7389e7a387cfb259f297e3 ]
Today a PV guest (including dom0) can create 2MB contiguous memory regions for DMA buffers at max. This has led to problems at least with the megaraid_sas driver, which wants to allocate a 2.3MB DMA buffer.
The limiting factor is the frame array used to do the hypercall for making the memory contiguous, which has 512 entries and is just a static array in mmu_pv.c.
In order to not waste memory for non-PV guests, put the initial frame array into .init.data section and dynamically allocate an array from the .init_after_bootmem hook of PV guests.
In case a contiguous memory area larger than the initially supported 2MB is requested, allocate a larger buffer for the frame list. Note that such an allocation is tried only after memory management has been initialized properly, which is tested via a flag being set in the .init_after_bootmem hook.
--- arch/x86/xen/mmu_pv.c | 71 +++++++++++++++++++++++++++++++++++++------ 1 file changed, 62 insertions(+), 9 deletions(-)
arch/x86/xen/mmu_pv.c +62 -9
@@ -111,6 +111,51 @@ static pud_t level3_user_vsyscall[PTRS_PER_PUD] __page_aligned_bss;*/ static DEFINE_SPINLOCK (xen_reservation_lock); +/* Protected by xen_reservation_lock. */ +#define MIN_CONTIG_ORDER 9/* 2MB */ +static unsigned int discontig_frames_order =MIN_CONTIG_ORDER ; +static unsigned long discontig_frames_early[1UL <<MIN_CONTIG_ORDER ]__initdata ; +static unsigned long *discontig_frames__refdata = discontig_frames_early; +static bool discontig_frames_dyn; + +static int alloc_discontig_frames (unsigned int order) +{ +unsigned long *new_array, *old_array; +unsigned int old_order; +unsigned long flags; + +BUG_ON (order <MIN_CONTIG_ORDER ); +BUILD_BUG_ON (sizeof (discontig_frames_early) !=PAGE_SIZE ); + + new_array = (unsigned long *)__get_free_pages (GFP_KERNEL , + order -MIN_CONTIG_ORDER ); +if (!new_array) +return -ENOMEM ; + +spin_lock_irqsave (&xen_reservation_lock, flags); + + old_order = discontig_frames_order; + +if (order > discontig_frames_order || !discontig_frames_dyn) { +if (!discontig_frames_dyn) + old_array =NULL ; +else + old_array = discontig_frames; + + discontig_frames = new_array; + discontig_frames_order = order; + discontig_frames_dyn = true; + }else { + old_array = new_array; + } + +spin_unlock_irqrestore (&xen_reservation_lock, flags); + +free_pages ((unsigned long )old_array, old_order -MIN_CONTIG_ORDER ); + +return 0 ; +} +/* * Note about cr3 (pagetable base) values: *
@@ -812,6 +857,9 @@ static void __init xen_after_bootmem(void)SetPagePinned (virt_to_page (level3_user_vsyscall));#endif xen_pgd_walk (&init_mm, xen_mark_pinned,FIXADDR_TOP ); + +if (alloc_discontig_frames (MIN_CONTIG_ORDER )) +BUG (); } static void xen_unpin_page(struct mm_struct *mm, struct page *page,
@@ -2199,10 +2247,6 @@ void __init xen_init_mmu_ops(void)memset (dummy_mapping,0xff ,PAGE_SIZE ); } -/* Protected by xen_reservation_lock. */ -#define MAX_CONTIG_ORDER 9/* 2MB */ -static unsigned long discontig_frames[1 <<MAX_CONTIG_ORDER ]; -#define VOID_PTE (mfn_pte(0, __pgprot(0))) static void xen_zap_pfn_range(unsigned long vaddr, unsigned int order, unsigned long *in_frames,
@@ -2319,18 +2363,25 @@ int xen_create_contiguous_region(phys_addr_t pstart, unsigned int order,unsigned int address_bits, dma_addr_t *dma_handle) { - unsigned long *in_frames = discontig_frames, out_frame; + unsigned long *in_frames, out_frame;unsigned long flags;int success;unsigned long vstart = (unsigned long )phys_to_virt (pstart); -if (unlikely (order >MAX_CONTIG_ORDER )) -return -ENOMEM ; +if (unlikely (order > discontig_frames_order)) { +if (!discontig_frames_dyn) +return -ENOMEM ; + +if (alloc_discontig_frames (order)) +return -ENOMEM ; + }memset ((void *) vstart,0 ,PAGE_SIZE << order);spin_lock_irqsave (&xen_reservation_lock, flags); + in_frames = discontig_frames; +/* 1. Zap current PTEs, remembering MFNs. */ xen_zap_pfn_range (vstart, order, in_frames,NULL );
@@ -2354,12 +2405,12 @@ int xen_create_contiguous_region(phys_addr_t pstart, unsigned int order,void xen_destroy_contiguous_region (phys_addr_t pstart,unsigned int order) { -unsigned long *out_frames = discontig_frames, in_frame; +unsigned long *out_frames, in_frame;unsigned long flags;int success;unsigned long vstart; -if (unlikely (order >MAX_CONTIG_ORDER )) +if (unlikely (order > discontig_frames_order))return ; vstart = (unsigned long )phys_to_virt (pstart);
@@ -2367,6 +2418,8 @@ void xen_destroy_contiguous_region(phys_addr_t pstart, unsigned int order)spin_lock_irqsave (&xen_reservation_lock, flags); + out_frames = discontig_frames; +/* 1. Find start MFN of contiguous extent. */ in_frame =virt_to_mfn ((void *)vstart);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 52/230 block: cleanup and fix batch completion adding conditions
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <[email protected]>
[ Upstream commit 1f47ed294a2bd577d5ae43e6e28e1c9a3be4a833 ]
The conditions for whether or not a request is allowed adding to a completion batch are a bit hard to read, and they also have a few issues. One is that ioerror may indeed be a random value on passthrough, and it's being checked unconditionally of whether or not the given request is a passthrough request or not.
Rewrite the conditions to be separate for easier reading, and only check ioerror for non-passthrough requests. This fixes an issue with bio unmapping on passthrough, where it fails getting added to a batch. This both leads to suboptimal performance, and may trigger a potential schedule-under-atomic condition for polled passthrough IO.
--- include/linux/blk-mq.h | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-)
include/linux/blk-mq.h +14 -4
@@ -880,12 +880,22 @@ static inline bool blk_mq_add_to_batch(struct request *req, void (*complete)(struct io_comp_batch *)) {/* -* blk_mq_end_request_batch() can't end request allocated from -* sched tags +* Check various conditions that exclude batch processing: +* 1) No batch container +* 2) Has scheduler data attached +* 3) Not a passthrough request and end_io set +* 4) Not a passthrough request and an ioerror */ -if (!iob || (req->rq_flags &RQF_SCHED_TAGS ) || ioerror || - (req->end_io && !blk_rq_is_passthrough (req))) +if (!iob)return false; +if (req->rq_flags &RQF_SCHED_TAGS ) +return false; +if (!blk_rq_is_passthrough (req)) { +if (req->end_io) +return false; +if (ioerror <0 ) +return false; + }if (!iob->complete) iob->complete = complete;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 53/230 sched_ext: Fix the incorrect bpf_list kfunc API in common.bpf.h.
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuyi Zhou <[email protected]>
[ Upstream commit 2e2006c91c842c551521434466f9b4324719c9a7 ]
Now BPF only supports bpf_list_push_{front,back}_impl kfunc, not bpf_list_ push_{front,back}.
This patch fix this issue. Without this patch, if we use bpf_list kfunc in scx, the BPF verifier would complain:
libbpf: extern (func ksym) 'bpf_list_push_back': not found in kernel or module BTFs
libbpf: failed to load object 'scx_foo'
libbpf: failed to load BPF skeleton 'scx_foo': -EINVAL
With this patch, the bpf list kfunc will work as expected.
--- tools/sched_ext/include/scx/common.bpf.h | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
tools/sched_ext/include/scx/common.bpf.h +10 -2
@@ -251,8 +251,16 @@ void bpf_obj_drop_impl(void *kptr, void *meta) __ksym;#define bpf_obj_new (type) ((type *)bpf_obj_new_impl(bpf_core_type_id_local(type), NULL))#define bpf_obj_drop (kptr) bpf_obj_drop_impl(kptr, NULL) -void bpf_list_push_front(struct bpf_list_head *head, struct bpf_list_node *node) __ksym; -void bpf_list_push_back(struct bpf_list_head *head, struct bpf_list_node *node) __ksym; +int bpf_list_push_front_impl(struct bpf_list_head *head, + struct bpf_list_node *node, + void *meta, __u64 off) __ksym; +#define bpf_list_push_front (head, node) bpf_list_push_front_impl(head, node, NULL, 0) + +int bpf_list_push_back_impl(struct bpf_list_head *head, + struct bpf_list_node *node, + void *meta, __u64 off) __ksym; +#define bpf_list_push_back (head, node) bpf_list_push_back_impl(head, node, NULL, 0) +struct bpf_list_node *bpf_list_pop_front (struct bpf_list_head *head) __ksym;struct bpf_list_node *bpf_list_pop_back (struct bpf_list_head *head) __ksym; struct bpf_rb_node *bpf_rbtree_remove(struct bpf_rb_root *root,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 54/230 sched_ext: Use SCX_CALL_OP_TASK in task_tick_scx
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuyi Zhou <[email protected]>
[ Upstream commit f5717c93a1b999970f3a64d771a1a9ee68cc37d0 ]
Now when we use scx_bpf_task_cgroup() in ops.tick() to get the cgroup of the current task, the following error will occur:
scx_foo[3795244] triggered exit kind 1024:
runtime error (called on a task not being operated on)
The reason is that we are using SCX_CALL_OP() instead of SCX_CALL_OP_TASK() when calling ops.tick(), which triggers the error during the subsequent scx_kf_allowed_on_arg_tasks() check.
SCX_CALL_OP_TASK() was first introduced in commit 36454023f50b ("sched_ext:
Track tasks that are subjects of the in-flight SCX operation") to ensure task's rq lock is held when accessing task's sched_group. Since ops.tick() is marked as SCX_KF_TERMINAL and task_tick_scx() is protected by the rq lock, we can use SCX_CALL_OP_TASK() to avoid the above issue. Similarly, the same changes should be made for ops.disable() and ops.exit_task(), as they are also protected by task_rq_lock() and it's safe to access the task's task_group.
--- kernel/sched/ext.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
kernel/sched/ext.c +3 -3
@@ -3447,7 +3447,7 @@ static void task_tick_scx(struct rq *rq, struct task_struct *curr, int queued) curr->scx.slice =0 ;touch_core_sched (rq, curr); }else if (SCX_HAS_OP (tick)) { -SCX_CALL_OP (SCX_KF_REST , tick, curr); +SCX_CALL_OP_TASK (SCX_KF_REST , tick, curr); }if (!curr->scx.slice)
@@ -3594,7 +3594,7 @@ static void scx_ops_disable_task(struct task_struct *p)WARN_ON_ONCE (scx_get_task_state (p) !=SCX_TASK_ENABLED );if (SCX_HAS_OP (disable)) -SCX_CALL_OP (SCX_KF_REST , disable, p); +SCX_CALL_OP_TASK (SCX_KF_REST , disable, p);scx_set_task_state (p,SCX_TASK_READY ); }
@@ -3623,7 +3623,7 @@ static void scx_ops_exit_task(struct task_struct *p) }if (SCX_HAS_OP (exit_task)) -SCX_CALL_OP (SCX_KF_REST , exit_task, p, &args); +SCX_CALL_OP_TASK (SCX_KF_REST , exit_task, p, &args);scx_set_task_state (p,SCX_TASK_NONE ); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 55/230 gpiolib: Fix crash on error in gpiochip_get_ngpios()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 7b4aebeecbbd5b5fe73e35fad3f62ed21aa7ef44 ]
The gpiochip_get_ngpios() uses chip_*() macros to print messages. However these macros rely on gpiodev to be initialised and set, which is not the case when called via bgpio_init(). In such a case the printing messages will crash on NULL pointer dereference. Replace chip_*() macros by the respective dev_*() ones to avoid such crash.
--- drivers/gpio/gpiolib.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpio/gpiolib.c +3 -3
@@ -905,13 +905,13 @@ int gpiochip_get_ngpios(struct gpio_chip *gc, struct device *dev) }if (gc->ngpio ==0 ) { -chip_err (gc,"tried to insert a GPIO chip with zero lines\n" ); +dev_err (dev,"tried to insert a GPIO chip with zero lines\n" );return -EINVAL ; }if (gc->ngpio >FASTPATH_NGPIO ) -chip_warn (gc,"line cnt %u is greater than fast path cnt %u\n" , - gc->ngpio,FASTPATH_NGPIO ); +dev_warn (dev,"line cnt %u is greater than fast path cnt %u\n" , + gc->ngpio,FASTPATH_NGPIO );return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 56/230 iommu/amd: Expicitly enable CNTRL.EPHEn bit in resume path
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasant Hegde <[email protected]>
[ Upstream commit ef75966abf950c0539534effa4960caa29fb7167 ]
With recent kernel, AMDGPU failed to resume after suspend on certain laptop.
Sample log:
-----------
Nov 14 11:52:19 Thinkbook kernel: iommu ivhd0: AMD-Vi: Event logged [ILLEGAL_DEV_TABLE_ENTRY device=0000:06:00.0 pasid=0x00000 address=0x135300000 flags=0x0080] Nov 14 11:52:19 Thinkbook kernel: AMD-Vi: DTE[0]: 7d90000000000003 Nov 14 11:52:19 Thinkbook kernel: AMD-Vi: DTE[1]: 0000100103fc0009 Nov 14 11:52:19 Thinkbook kernel: AMD-Vi: DTE[2]: 2000000117840013 Nov 14 11:52:19 Thinkbook kernel: AMD-Vi: DTE[3]: 0000000000000000
This is because in resume path, CNTRL[EPHEn] is not set. Fix this by setting CNTRL[EPHEn] to 1 in resume path if EFR[EPHSUP] is set.
Note
May be better approach is to save the control register in suspend path and restore it in resume path instead of trying to set indivisual bits. We will have separate patch for that.
--- drivers/iommu/amd/amd_iommu_types.h | 1 + drivers/iommu/amd/init.c | 4 ++++ 2 files changed, 5 insertions(+)
drivers/iommu/amd/amd_iommu_types.h +1 -0
@@ -175,6 +175,7 @@#define CONTROL_GAM_EN 25#define CONTROL_GALOG_EN 28#define CONTROL_GAINT_EN 29 +#define CONTROL_EPH_EN 45#define CONTROL_XT_EN 50#define CONTROL_INTCAPXT_EN 51#define CONTROL_IRTCACHEDIS 59
drivers/iommu/amd/init.c +4 -0
@@ -2647,6 +2647,10 @@ static void iommu_init_flags(struct amd_iommu *iommu)/* Set IOTLB invalidation timeout to 1s */ iommu_set_inv_tlb_timeout (iommu,CTRL_INV_TO_1S ); + +/* Enable Enhanced Peripheral Page Request Handling */ +if (check_feature (FEATURE_EPHSUP )) +iommu_feature_enable (iommu,CONTROL_EPH_EN ); }static void iommu_apply_resume_quirks (struct amd_iommu *iommu)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 57/230 tools: fix annoying "mkdir -p ..." logs when building tools in parallel
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masahiro Yamada <[email protected]>
[ Upstream commit d1d0963121769d8d16150b913fe886e48efefa51 ]
When CONFIG_OBJTOOL=y or CONFIG_DEBUG_INFO_BTF=y, parallel builds show awkward "mkdir -p ..." logs.
$ make -j16
[ snip ]
mkdir -p /home/masahiro/ref/linux/tools/objtool && make O=/home/masahiro/ref/linux subdir=tools/objtool --no-print-directory -C objtool
mkdir -p /home/masahiro/ref/linux/tools/bpf/resolve_btfids && make O=/home/masahiro/ref/linux subdir=tools/bpf/resolve_btfids --no-print-directory -C bpf/resolve_btfidsDefining MAKEFLAGS=<value> on the command line wipes out command line switches from the resultant MAKEFLAGS definition, even though the command line switches are active. [1]
MAKEFLAGS puts all single-letter options into the first word, and that word will be empty if no single-letter options were given. [2] However, this breaks if MAKEFLAGS=<value> is given on the command line.
The tools/ and tools/% targets set MAKEFLAGS=<value> on the command line, which breaks the following code in tools/scripts/Makefile.include:
short-opts := $(firstword -$(MAKEFLAGS))
If MAKEFLAGS really needs modification, it should be done through the environment variable, as follows:
MAKEFLAGS=<value> $(MAKE) ...
That said, I question whether modifying MAKEFLAGS is necessary here. The only flag we might want to exclude is --no-print-directory, as the tools build system changes the working directory. However, people might find the "Entering/Leaving directory" logs annoying.
I simply removed the offending MAKEFLAGS=<value>.
[1]: https://savannah.gnu.org/bugs/?62469
[2]: https://www.gnu.org/software/make/manual/make.html#Testing-Flags
--- Makefile | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-)
Makefile +2 -7
@@ -1357,18 +1357,13 @@ ifneq ($(wildcard $(resolve_btfids_O)),) $(Q)$(MAKE) -sC $(srctree)/tools/bpf/resolve_btfids O=$(resolve_btfids_O) clean endif -# Clear a bunch of variables before executing the submake -ifeq ($(quiet),silent_) -tools_silent=s -endif - tools/: FORCE $(Q)mkdir -p $(objtree)/tools - $(Q)$(MAKE) LDFLAGS= MAKEFLAGS="$(tools_silent) $(filter --j% -j,$(MAKEFLAGS))" O=$(abspath $(objtree)) subdir=tools -C $(srctree)/tools/ + $(Q)$(MAKE) LDFLAGS= O=$(abspath $(objtree)) subdir=tools -C $(srctree)/tools/ tools/%: FORCE $(Q)mkdir -p $(objtree)/tools - $(Q)$(MAKE) LDFLAGS= MAKEFLAGS="$(tools_silent) $(filter --j% -j,$(MAKEFLAGS))" O=$(abspath $(objtree)) subdir=tools -C $(srctree)/tools/ $* + $(Q)$(MAKE) LDFLAGS= O=$(abspath $(objtree)) subdir=tools -C $(srctree)/tools/ $* # --------------------------------------------------------------------------- # Kernel selftest
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 58/230 RDMA/efa: Reset device on probe failure
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Margolin <[email protected]>
[ Upstream commit 123c13f10ed3627ba112172d8bd122a72cae226d ]
Make sure the device is being reset on driver exit whatever the reason is, to keep the device aligned and allow it to close shared resources (e.g. admin queue).
--- drivers/infiniband/hw/efa/efa_main.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/infiniband/hw/efa/efa_main.c +5 -4
@@ -470,7 +470,6 @@ static void efa_ib_device_remove(struct efa_dev *dev)ibdev_info (&dev->ibdev,"Unregister ib device\n" );ib_unregister_device (&dev->ibdev);efa_destroy_eqs (dev); -efa_com_dev_reset (&dev->edev,EFA_REGS_RESET_NORMAL );efa_release_doorbell_bar (dev); }
@@ -643,12 +642,14 @@ static struct efa_dev *efa_probe_device(struct pci_dev *pdev)return ERR_PTR (err); } -static void efa_remove_device (struct pci_dev *pdev) +static void efa_remove_device (struct pci_dev *pdev, +enum efa_regs_reset_reason_types reset_reason) {struct efa_dev *dev =pci_get_drvdata (pdev);struct efa_com_dev *edev; edev = &dev->edev; +efa_com_dev_reset (edev, reset_reason);efa_com_admin_destroy (edev);efa_free_irq (dev, &dev->admin_irq);efa_disable_msix (dev);
@@ -676,7 +677,7 @@ static int efa_probe(struct pci_dev *pdev, const struct pci_device_id *ent)return 0 ; err_remove_device: -efa_remove_device (pdev); +efa_remove_device (pdev,EFA_REGS_RESET_INIT_ERR );return err; }
@@ -685,7 +686,7 @@ static void efa_remove(struct pci_dev *pdev)struct efa_dev *dev =pci_get_drvdata (pdev);efa_ib_device_remove (dev); -efa_remove_device (pdev); +efa_remove_device (pdev,EFA_REGS_RESET_NORMAL ); }static void efa_shutdown (struct pci_dev *pdev)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 59/230 firmware: qcom: scm: smc: Handle missing SCM device
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 94f48ecf0a538019ca2025e0b0da391f8e7cc58c ]
Commit ca61d6836e6f ("firmware: qcom: scm: fix a NULL-pointer dereference") makes it explicit that qcom_scm_get_tzmem_pool() can return NULL, therefore its users should handle this.
--- drivers/firmware/qcom/qcom_scm-smc.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/firmware/qcom/qcom_scm-smc.c +3 -0
@@ -173,6 +173,9 @@ int __scm_smc_call(struct device *dev, const struct qcom_scm_desc *desc, smc.args[i +SCM_SMC_FIRST_REG_IDX ] = desc->args[i];if (unlikely (arglen >SCM_SMC_N_REG_ARGS )) { +if (!mempool) +return -EINVAL ; + args_virt =qcom_tzmem_alloc (mempool,SCM_SMC_N_EXT_ARGS *sizeof (u64), flag);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 60/230 fbdev: omap: use threaded IRQ for LCD DMA
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaro Koskinen <[email protected]>
[ Upstream commit e4b6b665df815b4841e71b72f06446884e8aad40 ]
When using touchscreen and framebuffer, Nokia 770 crashes easily with:
BUG: scheduling while atomic: irq/144-ads7846/82/0x00010000
Modules linked in: usb_f_ecm g_ether usb_f_rndis u_ether libcomposite configfs omap_udc ohci_omap ohci_hcd
CPU: 0 UID: 0 PID: 82 Comm: irq/144-ads7846 Not tainted 6.12.7-770 #2
Hardware name: Nokia 770
Call trace:
unwind_backtrace from show_stack+0x10/0x14
show_stack from dump_stack_lvl+0x54/0x5c
dump_stack_lvl from __schedule_bug+0x50/0x70
__schedule_bug from __schedule+0x4d4/0x5bc
__schedule from schedule+0x34/0xa0
schedule from schedule_preempt_disabled+0xc/0x10
schedule_preempt_disabled from __mutex_lock.constprop.0+0x218/0x3b4
__mutex_lock.constprop.0 from clk_prepare_lock+0x38/0xe4
clk_prepare_lock from clk_set_rate+0x18/0x154
clk_set_rate from sossi_read_data+0x4c/0x168
sossi_read_data from hwa742_read_reg+0x5c/0x8c
hwa742_read_reg from send_frame_handler+0xfc/0x300
send_frame_handler from process_pending_requests+0x74/0xd0
process_pending_requests from lcd_dma_irq_handler+0x50/0x74
lcd_dma_irq_handler from __handle_irq_event_percpu+0x44/0x130
__handle_irq_event_percpu from handle_irq_event+0x28/0x68
handle_irq_event from handle_level_irq+0x9c/0x170
handle_level_irq from generic_handle_domain_irq+0x2c/0x3c
generic_handle_domain_irq from omap1_handle_irq+0x40/0x8c
omap1_handle_irq from generic_handle_arch_irq+0x28/0x3c
generic_handle_arch_irq from call_with_stack+0x1c/0x24
call_with_stack from __irq_svc+0x94/0xa8
Exception stack(0xc5255da0 to 0xc5255de8)
5da0: 00000001 c22fc620 00000000 00000000 c08384a8 c106fc00 00000000 c240c248
5dc0: c113a600 c3f6ec30 00000001 00000000 c22fc620 c5255df0 c22fc620 c0279a94
5de0: 60000013 ffffffff
__irq_svc from clk_prepare_lock+0x4c/0xe4
clk_prepare_lock from clk_get_rate+0x10/0x74
clk_get_rate from uwire_setup_transfer+0x40/0x180
uwire_setup_transfer from spi_bitbang_transfer_one+0x2c/0x9c
spi_bitbang_transfer_one from spi_transfer_one_message+0x2d0/0x664
spi_transfer_one_message from __spi_pump_transfer_message+0x29c/0x498
__spi_pump_transfer_message from __spi_sync+0x1f8/0x2e8
__spi_sync from spi_sync+0x24/0x40
spi_sync from ads7846_halfd_read_state+0x5c/0x1c0
ads7846_halfd_read_state from ads7846_irq+0x58/0x348
ads7846_irq from irq_thread_fn+0x1c/0x78
irq_thread_fn from irq_thread+0x120/0x228
irq_thread from kthread+0xc8/0xe8
kthread from ret_from_fork+0x14/0x28As a quick fix, switch to a threaded IRQ which provides a stable system.
--- drivers/video/fbdev/omap/lcd_dma.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/video/fbdev/omap/lcd_dma.c +2 -2
@@ -432,8 +432,8 @@ static int __init omap_init_lcd_dma(void)spin_lock_init (&lcd_dma.lock); - r =request_irq (INT_DMA_LCD , lcd_dma_irq_handler,0 , -"LCD DMA" ,NULL ); + r =request_threaded_irq (INT_DMA_LCD ,NULL , lcd_dma_irq_handler, +IRQF_ONESHOT ,"LCD DMA" ,NULL );if (r !=0 )pr_err ("unable to request IRQ for LCD DMA (error %d)\n" , r);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 61/230 soc/tegra: fuse: Update Tegra234 nvmem keepout list
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kartik Rajput <[email protected]>
[ Upstream commit 836b341cc8dab680acc06a7883bfeea89680b689 ]
Various Nvidia userspace applications and tests access following fuse via Fuse nvmem interface:
* odmid
* odminfo
* boot_security_info
* public_key_hash
* reserved_odm0
* reserved_odm1
* reserved_odm2
* reserved_odm3
* reserved_odm4
* reserved_odm5
* reserved_odm6
* reserved_odm7
* odm_lock
* pk_h1
* pk_h2
* revoke_pk_h0
* revoke_pk_h1
* security_mode
* system_fw_field_ratchet0
* system_fw_field_ratchet1
* system_fw_field_ratchet2
* system_fw_field_ratchet3
* optin_enable
Update tegra234_fuse_keepouts list to allow reading these fuse from nvmem sysfs interface.
--- drivers/soc/tegra/fuse/fuse-tegra30.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-)
drivers/soc/tegra/fuse/fuse-tegra30.c +11 -6
@@ -647,15 +647,20 @@ static const struct nvmem_cell_lookup tegra234_fuse_lookups[] = { };static const struct nvmem_keepout tegra234_fuse_keepouts[] = { - { .start =0x01c , .end =0x0c8 }, - { .start =0x12c , .end =0x184 }, + { .start =0x01c , .end =0x064 }, + { .start =0x084 , .end =0x0a0 }, + { .start =0x0a4 , .end =0x0c8 }, + { .start =0x12c , .end =0x164 }, + { .start =0x16c , .end =0x184 }, { .start =0x190 , .end =0x198 }, { .start =0x1a0 , .end =0x204 }, - { .start =0x21c , .end =0x250 }, - { .start =0x25c , .end =0x2f0 }, + { .start =0x21c , .end =0x2f0 }, { .start =0x310 , .end =0x3d8 }, - { .start =0x400 , .end =0x4f0 }, - { .start =0x4f8 , .end =0x7e8 }, + { .start =0x400 , .end =0x420 }, + { .start =0x444 , .end =0x490 }, + { .start =0x4bc , .end =0x4f0 }, + { .start =0x4f8 , .end =0x54c }, + { .start =0x57c , .end =0x7e8 }, { .start =0x8d0 , .end =0x8d8 }, { .start =0xacc , .end =0xf00 } };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 62/230 i3c: mipi-i3c-hci: Add Intel specific quirk to ring resuming
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jarkko Nikula <[email protected]>
[ Upstream commit ccdb2e0e3b00d13df90ac7a0524dd855173f1171 ]
MIPI I3C HCI on Intel hardware requires a quirk where ring needs to stop and set to run again after resuming the halted controller. This is not expected from the MIPI I3C HCI specification and is Intel specific.
Add this quirk to generic aborted transfer handling and execute it only when ring is not in running state after a transfer error and attempted controller resume. This is the case on Intel hardware.
It is not fully clear to me what is the ring running state in generic hardware in such case. I would expect if ring is not running, then stop request is a no-op and run request is either required or does the same what controller resume would do.
--- drivers/i3c/master/mipi-i3c-hci/dma.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)
drivers/i3c/master/mipi-i3c-hci/dma.c +17 -0
@@ -762,9 +762,26 @@ static bool hci_dma_irq_handler(struct i3c_hci *hci, unsigned int mask)complete (&rh->op_done);if (status &INTR_TRANSFER_ABORT ) { +u32 ring_status; +dev_notice_ratelimited (&hci->master.dev,"ring %d: Transfer Aborted\n" , i);mipi_i3c_hci_resume (hci); + ring_status =rh_reg_read (RING_STATUS ); +if (!(ring_status &RING_STATUS_RUNNING ) && + status &INTR_TRANSFER_COMPLETION && + status &INTR_TRANSFER_ERR ) { +/* +* Ring stop followed by run is an Intel +* specific required quirk after resuming the +* halted controller. Do it only when the ring +* is not in running state after a transfer +* error. +*/ +rh_reg_write (RING_CONTROL ,RING_CTRL_ENABLE ); +rh_reg_write (RING_CONTROL ,RING_CTRL_ENABLE | +RING_CTRL_RUN_STOP ); + } }if (status &INTR_WARN_INS_STOP_MODE ) dev_warn_ratelimited(&hci->master.dev,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 63/230 i3c: mipi-i3c-hci: Add support for MIPI I3C HCI on PCI bus
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jarkko Nikula <[email protected]>
[ Upstream commit 30bb1ce71215645fa6a92f4fa8cbb8f58db68f12 ]
Add a glue code for the MIPI I3C HCI on PCI bus with Intel Panther Lake I3C controller PCI IDs.
MIPI I3C HCI on Intel platforms has additional logic around the MIPI I3C HCI core logic. Those together create so called I3C slice on PCI bus. Intel specific initialization code does a reset cycle to the I3C slice before probing the MIPI I3C HCI part.
--- drivers/i3c/master/Kconfig | 11 ++ drivers/i3c/master/mipi-i3c-hci/Makefile | 1 + .../master/mipi-i3c-hci/mipi-i3c-hci-pci.c | 148 ++++++++++++++++++ 3 files changed, 160 insertions(+) create mode 100644 drivers/i3c/master/mipi-i3c-hci/mipi-i3c-hci-pci.c
drivers/i3c/master/Kconfig +11 -0
@@ -57,3 +57,14 @@ config MIPI_I3C_HCI This driver can also be built as a module. If so, the module will be called mipi-i3c-hci. + +config MIPI_I3C_HCI_PCI + tristate "MIPI I3C Host Controller Interface PCI support" + depends on MIPI_I3C_HCI + depends on PCI + help + Support for MIPI I3C Host Controller Interface compatible hardware + on the PCI bus. + + This driver can also be built as a module. If so, the module will be + called mipi-i3c-hci-pci.
drivers/i3c/master/mipi-i3c-hci/Makefile +1 -0
@@ -5,3 +5,4 @@ mipi-i3c-hci-y := core.o ext_caps.o pio.o dma.o \ cmd_v1.o cmd_v2.o \ dat_v1.o dct_v1.o \ hci_quirks.o +obj-$(CONFIG_MIPI_I3C_HCI_PCI) += mipi-i3c-hci-pci.o
drivers/i3c/master/mipi-i3c-hci/mipi-i3c-hci-pci.c new file +148 -0
148 lines not on this page · raw message
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 64/230 media: cxd2841er: fix 64-bit division on gcc-9
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 8d46603eeeb4c6abff1d2e49f2a6ae289dac765e ]
It appears that do_div() once more gets confused by a complex expression that ends up not quite being constant despite __builtin_constant_p() thinking it is:
ERROR: modpost: "__aeabi_uldivmod" [drivers/media/dvb-frontends/cxd2841er.ko] undefined!
Use div_u64() instead, forcing the expression to be evaluated first, and making it a bit more readable.
--- drivers/media/dvb-frontends/cxd2841er.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
drivers/media/dvb-frontends/cxd2841er.c +2 -6
@@ -311,12 +311,8 @@ static int cxd2841er_set_reg_bits(struct cxd2841er_priv *priv,static u32 cxd2841er_calc_iffreq_xtal (enum cxd2841er_xtal xtal,u32 ifhz) { -u64 tmp; - - tmp = (u64 ) ifhz *16777216 ; -do_div (tmp, ((xtal ==SONY_XTAL_24000 ) ?48000000 :41000000 )); - -return (u32 ) tmp; +return div_u64 (ifhz *16777216ull , + (xtal ==SONY_XTAL_24000 ) ?48000000 :41000000 ); }static u32 cxd2841er_calc_iffreq (u32 ifhz)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 65/230 media: i2c: ds90ub913: Add error handling to ub913_hw_init()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <[email protected]>
[ Upstream commit acd8f58d7a3bce0fbd3263961cd09555c00464ba ]
Add error handling to ub913_hw_init() using a new helper function, ub913_update_bits().
--- drivers/media/i2c/ds90ub913.c | 25 +++++++++++++++++++++---- 1 file changed, 21 insertions(+), 4 deletions(-)
drivers/media/i2c/ds90ub913.c +21 -4
@@ -8,6 +8,7 @@* Copyright (c) 2023 Tomi Valkeinen <[email protected]> */ +#include <linux/bitfield.h> #include <linux/clk-provider.h> #include <linux/clk.h> #include <linux/delay.h>
@@ -146,6 +147,19 @@ static int ub913_write(const struct ub913_data *priv, u8 reg, u8 val)return ret; } +static int ub913_update_bits (const struct ub913_data *priv,u8 reg,u8 mask, +u8 val) +{ +int ret; + + ret =regmap_update_bits (priv->regmap, reg, mask, val); +if (ret <0 ) +dev_err (&priv->client->dev, +"Cannot update register 0x%02x %d!\n" , reg, ret); + +return ret; +} +/* * GPIO chip */
@@ -733,10 +747,13 @@ static int ub913_hw_init(struct ub913_data *priv)if (ret)return dev_err_probe (dev, ret,"i2c master init failed\n" ); -ub913_read (priv,UB913_REG_GENERAL_CFG , &v); - v &= ~UB913_REG_GENERAL_CFG_PCLK_RISING ; - v |= priv->pclk_polarity_rising ?UB913_REG_GENERAL_CFG_PCLK_RISING :0 ; -ub913_write (priv,UB913_REG_GENERAL_CFG , v); + ret =ub913_update_bits (priv,UB913_REG_GENERAL_CFG , +UB913_REG_GENERAL_CFG_PCLK_RISING , +FIELD_PREP (UB913_REG_GENERAL_CFG_PCLK_RISING , + priv->pclk_polarity_rising)); + +if (ret) +return ret;return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 66/230 media: i2c: ds90ub953: Add error handling for i2c reads/writes
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <[email protected]>
[ Upstream commit 0794c43ea1e451007e80246e1288ebbf44139397 ]
Add error handling for i2c reads/writes in various places.
--- drivers/media/i2c/ds90ub953.c | 46 ++++++++++++++++++++++++----------- 1 file changed, 32 insertions(+), 14 deletions(-)
drivers/media/i2c/ds90ub953.c +32 -14
@@ -398,8 +398,13 @@ static int ub953_gpiochip_probe(struct ub953_data *priv)int ret;/* Set all GPIOs to local input mode */ -ub953_write (priv,UB953_REG_LOCAL_GPIO_DATA ,0 ); -ub953_write (priv,UB953_REG_GPIO_INPUT_CTRL ,0xf ); + ret =ub953_write (priv,UB953_REG_LOCAL_GPIO_DATA ,0 ); +if (ret) +return ret; + + ret =ub953_write (priv,UB953_REG_GPIO_INPUT_CTRL ,0xf ); +if (ret) +return ret; gc->label =dev_name (dev); gc->parent = dev;
@@ -961,10 +966,11 @@ static void ub953_calc_clkout_params(struct ub953_data *priv, clkout_data->rate = clkout_rate; } -static void ub953_write_clkout_regs (struct ub953_data *priv, -const struct ub953_clkout_data *clkout_data) +static int ub953_write_clkout_regs (struct ub953_data *priv, +const struct ub953_clkout_data *clkout_data) {u8 clkout_ctrl0, clkout_ctrl1; +int ret;if (priv->hw_data->is_ub971) clkout_ctrl0 = clkout_data->m;
@@ -974,8 +980,15 @@ static void ub953_write_clkout_regs(struct ub953_data *priv, clkout_ctrl1 = clkout_data->n; -ub953_write (priv,UB953_REG_CLKOUT_CTRL0 , clkout_ctrl0); -ub953_write (priv,UB953_REG_CLKOUT_CTRL1 , clkout_ctrl1); + ret =ub953_write (priv,UB953_REG_CLKOUT_CTRL0 , clkout_ctrl0); +if (ret) +return ret; + + ret =ub953_write (priv,UB953_REG_CLKOUT_CTRL1 , clkout_ctrl1); +if (ret) +return ret; + +return 0 ; } static unsigned long ub953_clkout_recalc_rate(struct clk_hw *hw,
@@ -1055,9 +1068,7 @@ static int ub953_clkout_set_rate(struct clk_hw *hw, unsigned long rate,dev_dbg (&priv->client->dev,"%s %lu (requested %lu)\n" , __func__, clkout_data.rate, rate); -ub953_write_clkout_regs (priv, &clkout_data); - -return 0 ; +return ub953_write_clkout_regs (priv, &clkout_data); }static const struct clk_ops ub953_clkout_ops = {
@@ -1082,7 +1093,9 @@ static int ub953_register_clkout(struct ub953_data *priv)/* Initialize clkout to 25MHz by default */ ub953_calc_clkout_params (priv,UB953_DEFAULT_CLKOUT_RATE , &clkout_data); -ub953_write_clkout_regs (priv, &clkout_data); + ret =ub953_write_clkout_regs (priv, &clkout_data); +if (ret) +return ret; priv->clkout_clk_hw.init = &init;
@@ -1229,10 +1242,15 @@ static int ub953_hw_init(struct ub953_data *priv)if (ret)return dev_err_probe (dev, ret,"i2c init failed\n" ); -ub953_write (priv,UB953_REG_GENERAL_CFG , - (priv->non_continous_clk ?0 :UB953_REG_GENERAL_CFG_CONT_CLK ) | - ((priv->num_data_lanes -1 ) <<UB953_REG_GENERAL_CFG_CSI_LANE_SEL_SHIFT ) | -UB953_REG_GENERAL_CFG_CRC_TX_GEN_ENABLE ); + v =0 ; + v |= priv->non_continous_clk ?0 :UB953_REG_GENERAL_CFG_CONT_CLK ; + v |= (priv->num_data_lanes -1 ) << +UB953_REG_GENERAL_CFG_CSI_LANE_SEL_SHIFT ; + v |=UB953_REG_GENERAL_CFG_CRC_TX_GEN_ENABLE ; + + ret =ub953_write (priv,UB953_REG_GENERAL_CFG , v); +if (ret) +return ret;return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 67/230 media: bcm2835-unicam: Disable trigger mode operation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naushir Patuck <[email protected]>
[ Upstream commit 697a252bb2ea414cc1c0b4cf4e3d94a879eaf162 ]
The imx219/imx708 sensors frequently generate a single corrupt frame (image or embedded data) when the sensor first starts. This can either be a missing line, or invalid samples within the line. This only occurrs using the upstream Unicam kernel driver.
Disabling trigger mode elimiates this corruption. Since trigger mode is a legacy feature copied from the firmware driver and not expected to be needed, remove it. Tested on the Raspberry Pi cameras and shows no ill effects.
--- drivers/media/platform/broadcom/bcm2835-unicam.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-)
drivers/media/platform/broadcom/bcm2835-unicam.c +1 -7
@@ -816,11 +816,6 @@ static irqreturn_t unicam_isr(int irq, void *dev) } } -if (unicam_reg_read (unicam,UNICAM_ICTL ) &UNICAM_FCM ) { -/* Switch out of trigger mode if selected */ -unicam_reg_write_field (unicam,UNICAM_ICTL ,1 ,UNICAM_TFC ); -unicam_reg_write_field (unicam,UNICAM_ICTL ,0 ,UNICAM_FCM ); - }return IRQ_HANDLED ; }
@@ -984,8 +979,7 @@ static void unicam_start_rx(struct unicam_device *unicam,unicam_reg_write_field (unicam,UNICAM_ANA ,0 ,UNICAM_DDL ); -/* Always start in trigger frame capture mode (UNICAM_FCM set) */ - val =UNICAM_FSIE |UNICAM_FEIE |UNICAM_FCM |UNICAM_IBOB ; + val =UNICAM_FSIE |UNICAM_FEIE |UNICAM_IBOB ; line_int_freq =max (fmt->height >>2 ,128 );unicam_set_field (&val, line_int_freq,UNICAM_LCIE_MASK );unicam_reg_write (unicam,UNICAM_ICTL , val);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 68/230 media: uvcvideo: Implement dual stream quirk to fix loss of usb packets
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Isaac Scott <[email protected]>
[ Upstream commit c2eda35e675b6ea4a0a21a4b1167b121571a9036 ]
Some cameras, such as the Sonix Technology Co. 292A, exhibit issues when running two parallel streams, causing USB packets to be dropped when an H.264 stream posts a keyframe while an MJPEG stream is running simultaneously. This occasionally causes the driver to erroneously output two consecutive JPEG images as a single frame.
To fix this, we inspect the buffer, and trigger a new frame when we find an SOI.
--- drivers/media/usb/uvc/uvc_video.c | 27 ++++++++++++++++++++++++++- drivers/media/usb/uvc/uvcvideo.h | 1 + 2 files changed, 27 insertions(+), 1 deletion(-)
drivers/media/usb/uvc/uvc_video.c +26 -1
@@ -20,6 +20,7 @@#include <linux/atomic.h> #include <linux/unaligned.h> +#include <media/jpeg.h> #include <media/v4l2-common.h> #include "uvcvideo.h"
@@ -1137,6 +1138,7 @@ static void uvc_video_stats_stop(struct uvc_streaming *stream)static int uvc_video_decode_start (struct uvc_streaming *stream,struct uvc_buffer *buf,const u8 *data,int len) { +u8 header_len;u8 fid;/*
@@ -1150,6 +1152,7 @@ static int uvc_video_decode_start(struct uvc_streaming *stream,return -EINVAL ; } + header_len = data[0 ]; fid = data[1 ] &UVC_STREAM_FID ;/*
@@ -1231,9 +1234,31 @@ static int uvc_video_decode_start(struct uvc_streaming *stream,return -EAGAIN ; } +/* +* Some cameras, when running two parallel streams (one MJPEG alongside +* another non-MJPEG stream), are known to lose the EOF packet for a frame. +* We can detect the end of a frame by checking for a new SOI marker, as +* the SOI always lies on the packet boundary between two frames for +* these devices. +*/ +if (stream->dev->quirks &UVC_QUIRK_MJPEG_NO_EOF && + (stream->cur_format->fcc ==V4L2_PIX_FMT_MJPEG || + stream->cur_format->fcc ==V4L2_PIX_FMT_JPEG )) { +const u8 *packet = data + header_len; + +if (len >= header_len +2 && + packet[0 ] ==0xff && packet[1 ] ==JPEG_MARKER_SOI && + buf->bytesused !=0 ) { + buf->state =UVC_BUF_STATE_READY ; + buf->error =1 ; + stream->last_fid ^=UVC_STREAM_FID ; +return -EAGAIN ; + } + } + stream->last_fid = fid; -return data[0 ]; +return header_len; } static inline enum dma_data_direction uvc_stream_dir(
drivers/media/usb/uvc/uvcvideo.h +1 -0
@@ -76,6 +76,7 @@#define UVC_QUIRK_NO_RESET_RESUME 0x00004000#define UVC_QUIRK_DISABLE_AUTOSUSPEND 0x00008000#define UVC_QUIRK_INVALID_DEVICE_SOF 0x00010000 +#define UVC_QUIRK_MJPEG_NO_EOF 0x00020000/* Format flags */ #define UVC_FMT_FLAG_COMPRESSED 0x00000001
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 69/230 media: uvcvideo: Add new quirk definition for the Sonix Technology Co. 292a camera
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Isaac Scott <[email protected]>
[ Upstream commit 81f8c0e138c43610cf09b8d2a533068aa58e538e ]
The Sonix Technology Co. 292A camera (which uses an AR0330 sensor), can produce MJPEG and H.264 streams concurrently. When doing so, it drops the last packets of MJPEG frames every time the H.264 stream generates a key frame. Set the UVC_QUIRK_MJPEG_NO_EOF quirk to work around the issue.
--- drivers/media/usb/uvc/uvc_driver.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/media/usb/uvc/uvc_driver.c +9 -0
@@ -2809,6 +2809,15 @@ static const struct usb_device_id uvc_ids[] = { .bInterfaceSubClass = 1, .bInterfaceProtocol = 0, .driver_info = (kernel_ulong_t)&uvc_quirk_probe_minmax }, +/* Sonix Technology Co. Ltd. - 292A IPC AR0330 */ + { .match_flags = USB_DEVICE_ID_MATCH_DEVICE + | USB_DEVICE_ID_MATCH_INT_INFO, + .idVendor = 0x0c45, + .idProduct = 0x6366, + .bInterfaceClass = USB_CLASS_VIDEO, + .bInterfaceSubClass = 1, + .bInterfaceProtocol = 0, + .driver_info = UVC_INFO_QUIRK(UVC_QUIRK_MJPEG_NO_EOF) }, /* MT6227 */ { .match_flags = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 70/230 media: uvcvideo: Add Kurokesu C1 PRO camera
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Isaac Scott <[email protected]>
[ Upstream commit 2762eab6d4140781840f253f9a04b8627017248b ]
Add support for the Kurokesu C1 PRO camera. This camera experiences the same issues faced by the Sonix Technology Co. 292A IPC AR0330. As such, enable the UVC_QUIRK_MJPEG_NO_EOF quirk for this device to prevent frames from being erroneously dropped.
--- drivers/media/usb/uvc/uvc_driver.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/media/usb/uvc/uvc_driver.c +9 -0
@@ -2846,6 +2846,15 @@ static const struct usb_device_id uvc_ids[] = { .bInterfaceSubClass = 1, .bInterfaceProtocol = 0, .driver_info = (kernel_ulong_t)&uvc_quirk_probe_minmax }, +/* Kurokesu C1 PRO */ + { .match_flags = USB_DEVICE_ID_MATCH_DEVICE + | USB_DEVICE_ID_MATCH_INT_INFO, + .idVendor = 0x16d0, + .idProduct = 0x0ed1, + .bInterfaceClass = USB_CLASS_VIDEO, + .bInterfaceSubClass = 1, + .bInterfaceProtocol = 0, + .driver_info = UVC_INFO_QUIRK(UVC_QUIRK_MJPEG_NO_EOF) }, /* Syntek (HP Spartan) */ { .match_flags = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 71/230 media: vidtv: Fix a null-ptr-deref in vidtv_mux_stop_thread
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
[ Upstream commit 1221989555db711578a327a9367f1be46500cb48 ]
syzbot report a null-ptr-deref in vidtv_mux_stop_thread. [1]
If dvb->mux is not initialized successfully by vidtv_mux_init() in the vidtv_start_streaming(), it will trigger null pointer dereference about mux in vidtv_mux_stop_thread().
Adjust the timing of streaming initialization and check it before stopping it.
[1]
KASAN: null-ptr-deref in range [0x0000000000000128-0x000000000000012f] CPU: 0 UID: 0 PID: 5842 Comm: syz-executor248 Not tainted 6.13.0-rc4-syzkaller-00012-g9b2ffa6148b1 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 RIP: 0010:vidtv_mux_stop_thread+0x26/0x80 drivers/media/test-drivers/vidtv/vidtv_mux.c:471 Code: 90 90 90 90 66 0f 1f 00 55 53 48 89 fb e8 82 2e c8 f9 48 8d bb 28 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 02 7e 3b 0f b6 ab 28 01 00 00 31 ff 89 ee e8 RSP: 0018:ffffc90003f2faa8 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff87cfb125 RDX: 0000000000000025 RSI: ffffffff87d120ce RDI: 0000000000000128 RBP: ffff888029b8d220 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000003 R12: ffff888029b8d188 R13: ffffffff8f590aa0 R14: ffffc9000581c5c8 R15: ffff888029a17710 FS: 00007f7eef5156c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7eef5e635c CR3: 0000000076ca6000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> vidtv_stop_streaming drivers/media/test-drivers/vidtv/vidtv_bridge.c:209 [inline] vidtv_stop_feed+0x151/0x250 drivers/media/test-drivers/vidtv/vidtv_bridge.c:252 dmx_section_feed_stop_filtering+0x90/0x160 drivers/media/dvb-core/dvb_demux.c:1000 dvb_dmxdev_feed_stop.isra.0+0x1ee/0x270 drivers/media/dvb-core/dmxdev.c:486 dvb_dmxdev_filter_stop+0x22a/0x3a0 drivers/media/dvb-core/dmxdev.c:559 dvb_dmxdev_filter_free drivers/media/dvb-core/dmxdev.c:840 [inline] dvb_demux_release+0x92/0x550 drivers/media/dvb-core/dmxdev.c:1246 __fput+0x3f8/0xb60 fs/file_table.c:450 task_work_run+0x14e/0x250 kernel/task_work.c:239 get_signal+0x1d3/0x2610 kernel/signal.c:2790 arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218 do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f
--- drivers/media/test-drivers/vidtv/vidtv_bridge.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/media/test-drivers/vidtv/vidtv_bridge.c +7 -1
@@ -191,10 +191,11 @@ static int vidtv_start_streaming(struct vidtv_dvb *dvb) mux_args.mux_buf_sz = mux_buf_sz; - dvb->streaming = true; dvb->mux =vidtv_mux_init (dvb->fe[0 ], dev, &mux_args);if (!dvb->mux)return -ENOMEM ; + + dvb->streaming = true;vidtv_mux_start_thread (dvb->mux);dev_dbg_ratelimited (dev,"Started streaming\n" );
@@ -205,6 +206,11 @@ static int vidtv_stop_streaming(struct vidtv_dvb *dvb) {struct device *dev = &dvb->pdev->dev; +if (!dvb->streaming) { +dev_warn_ratelimited (dev,"No streaming. Skipping.\n" ); +return 0 ; + } + dvb->streaming = false;vidtv_mux_stop_thread (dvb->mux);vidtv_mux_destroy (dvb->mux);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 72/230 PCI/DPC: Quirk PIO log size for Intel Raptor Lake-P
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit b198499c7d2508a76243b98e7cca992f6fd2b7f7 ]
Apparently the Raptor Lake-P reference firmware configures the PIO log size correctly, but some vendor BIOSes, including at least ASUSTeK COMPUTER INC. Zenbook UX3402VA_UX3402VA, do not.
Apply the quirk for Raptor Lake-P. This prevents kernel complaints like:
DPC: RP PIO log size 0 is invalid
and also enables the DPC driver to dump the RP PIO Log registers when DPC is triggered.
Note that the bug report also mentions 8086:a76e, which has been already added by 627c6db20703 ("PCI/DPC: Quirk PIO log size for Intel Raptor Lake Root Ports").
--- drivers/pci/quirks.c | 1 + 1 file changed, 1 insertion(+)
drivers/pci/quirks.c +1 -0
@@ -6254,6 +6254,7 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9a2b, dpc_log_size);DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x9a2d , dpc_log_size);DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x9a2f , dpc_log_size);DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x9a31 , dpc_log_size); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0xa72f , dpc_log_size);DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0xa73f , dpc_log_size);DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0xa76e , dpc_log_size);#endif
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 73/230 PCI: switchtec: Add Microchip PCI100X device IDs
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rakesh Babu Saladi <[email protected]>
[ Upstream commit a3282f84b2151d254dc4abf24d1255c6382be774 ]
Add Microchip parts to the Device ID table so the driver supports PCI100x devices.
Add a new macro to quirk the Microchip Switchtec PCI100x parts to allow DMA access via NTB to work when the IOMMU is turned on.
PCI100x family has 6 variants; each variant is designed for different application usages, different port counts and lane counts:
PCI1001 has 1 x4 upstream port and 3 x4 downstream ports PCI1002 has 1 x4 upstream port and 4 x2 downstream ports PCI1003 has 2 x4 upstream ports, 2 x2 upstream ports, and 2 x2
downstream ports
PCI1004 has 4 x4 upstream ports
PCI1005 has 1 x4 upstream port and 6 x2 downstream ports PCI1006 has 6 x2 upstream ports and 2 x2 downstream ports
[Historical note: these parts use PCI_VENDOR_ID_EFAR (0x1055), from EFAR Microsystems, which was acquired in 1996 by Standard Microsystems Corp, which was acquired by Microchip Technology in 2012. The PCI-SIG confirms that Vendor ID 0x1055 is assigned to Microchip even though it's not visible via https://pcisig.com/membership/member-companies]
--- drivers/pci/quirks.c | 11 +++++++++++ drivers/pci/switch/switchtec.c | 26 ++++++++++++++++++++++++++ 2 files changed, 37 insertions(+)
drivers/pci/quirks.c +11 -0
@@ -5985,6 +5985,17 @@ SWITCHTEC_QUIRK(0x5552); /* PAXA 52XG5 */SWITCHTEC_QUIRK (0x5536 );/* PAXA 36XG5 */ SWITCHTEC_QUIRK (0x5528 );/* PAXA 28XG5 */ +#define SWITCHTEC_PCI100X_QUIRK (vid) \ + DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_VENDOR_ID_EFAR, vid, \ + PCI_CLASS_BRIDGE_OTHER, 8, quirk_switchtec_ntb_dma_alias) +SWITCHTEC_PCI100X_QUIRK (0x1001 );/* PCI1001XG4 */ +SWITCHTEC_PCI100X_QUIRK (0x1002 );/* PCI1002XG4 */ +SWITCHTEC_PCI100X_QUIRK (0x1003 );/* PCI1003XG4 */ +SWITCHTEC_PCI100X_QUIRK (0x1004 );/* PCI1004XG4 */ +SWITCHTEC_PCI100X_QUIRK (0x1005 );/* PCI1005XG4 */ +SWITCHTEC_PCI100X_QUIRK (0x1006 );/* PCI1006XG4 */ + +/* * The PLX NTB uses devfn proxy IDs to move TLPs between NT endpoints. * These IDs are used to forward responses to the originator on the other
drivers/pci/switch/switchtec.c +26 -0
@@ -1739,6 +1739,26 @@ static void switchtec_pci_remove(struct pci_dev *pdev) .driver_data = gen, \ } +#define SWITCHTEC_PCI100X_DEVICE (device_id, gen) \ + { \ + .vendor = PCI_VENDOR_ID_EFAR, \ + .device = device_id, \ + .subvendor = PCI_ANY_ID, \ + .subdevice = PCI_ANY_ID, \ + .class = (PCI_CLASS_MEMORY_OTHER << 8), \ + .class_mask = 0xFFFFFFFF, \ + .driver_data = gen, \ + }, \ + { \ + .vendor = PCI_VENDOR_ID_EFAR, \ + .device = device_id, \ + .subvendor = PCI_ANY_ID, \ + .subdevice = PCI_ANY_ID, \ + .class = (PCI_CLASS_BRIDGE_OTHER << 8), \ + .class_mask = 0xFFFFFFFF, \ + .driver_data = gen, \ + } +static const struct pci_device_id switchtec_pci_tbl[] = {SWITCHTEC_PCI_DEVICE (0x8531 ,SWITCHTEC_GEN3 ),/* PFX 24xG3 */ SWITCHTEC_PCI_DEVICE (0x8532 ,SWITCHTEC_GEN3 ),/* PFX 32xG3 */
@@ -1833,6 +1853,12 @@ static const struct pci_device_id switchtec_pci_tbl[] = {SWITCHTEC_PCI_DEVICE (0x5552 ,SWITCHTEC_GEN5 ),/* PAXA 52XG5 */ SWITCHTEC_PCI_DEVICE (0x5536 ,SWITCHTEC_GEN5 ),/* PAXA 36XG5 */ SWITCHTEC_PCI_DEVICE (0x5528 ,SWITCHTEC_GEN5 ),/* PAXA 28XG5 */ +SWITCHTEC_PCI100X_DEVICE (0x1001 ,SWITCHTEC_GEN4 ),/* PCI1001 16XG4 */ +SWITCHTEC_PCI100X_DEVICE (0x1002 ,SWITCHTEC_GEN4 ),/* PCI1002 12XG4 */ +SWITCHTEC_PCI100X_DEVICE (0x1003 ,SWITCHTEC_GEN4 ),/* PCI1003 16XG4 */ +SWITCHTEC_PCI100X_DEVICE (0x1004 ,SWITCHTEC_GEN4 ),/* PCI1004 16XG4 */ +SWITCHTEC_PCI100X_DEVICE (0x1005 ,SWITCHTEC_GEN4 ),/* PCI1005 16XG4 */ +SWITCHTEC_PCI100X_DEVICE (0x1006 ,SWITCHTEC_GEN4 ),/* PCI1006 16XG4 */ {0} };MODULE_DEVICE_TABLE (pci, switchtec_pci_tbl);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 74/230 scsi: ufs: bsg: Set bsg_queue to NULL after removal
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guixin Liu <[email protected]>
[ Upstream commit 1e95c798d8a7f70965f0f88d4657b682ff0ec75f ]
Currently, this does not cause any issues, but I believe it is necessary to set bsg_queue to NULL after removing it to prevent potential use-after-free (UAF) access.
--- drivers/ufs/core/ufs_bsg.c | 1 + 1 file changed, 1 insertion(+)
drivers/ufs/core/ufs_bsg.c +1 -0
@@ -216,6 +216,7 @@ void ufs_bsg_remove(struct ufs_hba *hba)return ;bsg_remove_queue (hba->bsg_queue); + hba->bsg_queue =NULL ;device_del (bsg_dev);put_device (bsg_dev);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 75/230 rtla/timerlat_hist: Abort event processing on second signal
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomas Glozar <[email protected]>
[ Upstream commit d6899e560366e10141189697502bc5521940c588 ]
If either SIGINT is received twice, or after a SIGALRM (that is, after timerlat was supposed to stop), abort processing events currently left in the tracefs buffer and exit immediately.
This allows the user to exit rtla without waiting for processing all events, should that take longer than wanted, at the cost of not processing all samples.
--- tools/tracing/rtla/src/timerlat_hist.c | 8 ++++++++ 1 file changed, 8 insertions(+)
tools/tracing/rtla/src/timerlat_hist.c +8 -0
@@ -1143,6 +1143,14 @@ static int stop_tracing;static struct trace_instance *hist_inst =NULL ;static void stop_hist (int sig) { +if (stop_tracing) { +/* +* Stop requested twice in a row; abort event processing and +* exit immediately +*/ +tracefs_iterate_stop (hist_inst->inst); +return ; + } stop_tracing =1 ;if (hist_inst)trace_instance_stop (hist_inst);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 76/230 rtla/timerlat_top: Abort event processing on second signal
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomas Glozar <[email protected]>
[ Upstream commit 80967b354a76b360943af384c10d807d98bea5c4 ]
If either SIGINT is received twice, or after a SIGALRM (that is, after timerlat was supposed to stop), abort processing events currently left in the tracefs buffer and exit immediately.
This allows the user to exit rtla without waiting for processing all events, should that take longer than wanted, at the cost of not processing all samples.
--- tools/tracing/rtla/src/timerlat_top.c | 8 ++++++++ 1 file changed, 8 insertions(+)
tools/tracing/rtla/src/timerlat_top.c +8 -0
@@ -897,6 +897,14 @@ static int stop_tracing;static struct trace_instance *top_inst =NULL ;static void stop_top (int sig) { +if (stop_tracing) { +/* +* Stop requested twice in a row; abort event processing and +* exit immediately +*/ +tracefs_iterate_stop (top_inst->inst); +return ; + } stop_tracing =1 ;if (top_inst)trace_instance_stop (top_inst);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 77/230 serial: 8250_pci: Resolve WCH vendor ID ambiguity
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 16076ca3a1565491bcb28689e555d569a39391c7 ]
There are two sites of the same brand: wch.cn and wch-ic.com. They are property of the same company, but it appears that they managed to get two different PCI vendor IDs. Rename them accordingly using standard pattern, i.e. PCI_VENDOR_ID_...
While at it, move to PCI_VDEVICE() in the ID tables.
--- drivers/tty/serial/8250/8250_pci.c | 82 +++++++++++++++--------------- 1 file changed, 41 insertions(+), 41 deletions(-)
drivers/tty/serial/8250/8250_pci.c +41 -41
@@ -64,23 +64,23 @@#define PCIE_DEVICE_ID_NEO_2_OX_IBM 0x00F6#define PCI_DEVICE_ID_PLX_CRONYX_OMEGA 0xc001#define PCI_DEVICE_ID_INTEL_PATSBURG_KT 0x1d3d -#define PCI_VENDOR_ID_WCH 0x4348 -#define PCI_DEVICE_ID_WCH_CH352_2S 0x3253 -#define PCI_DEVICE_ID_WCH_CH353_4S 0x3453 -#define PCI_DEVICE_ID_WCH_CH353_2S1PF 0x5046 -#define PCI_DEVICE_ID_WCH_CH353_1S1P 0x5053 -#define PCI_DEVICE_ID_WCH_CH353_2S1P 0x7053 -#define PCI_DEVICE_ID_WCH_CH355_4S 0x7173 +#define PCI_VENDOR_ID_WCHCN 0x4348 +#define PCI_DEVICE_ID_WCHCN_CH352_2S 0x3253 +#define PCI_DEVICE_ID_WCHCN_CH353_4S 0x3453 +#define PCI_DEVICE_ID_WCHCN_CH353_2S1PF 0x5046 +#define PCI_DEVICE_ID_WCHCN_CH353_1S1P 0x5053 +#define PCI_DEVICE_ID_WCHCN_CH353_2S1P 0x7053 +#define PCI_DEVICE_ID_WCHCN_CH355_4S 0x7173#define PCI_VENDOR_ID_AGESTAR 0x5372#define PCI_DEVICE_ID_AGESTAR_9375 0x6872#define PCI_DEVICE_ID_BROADCOM_TRUMANAGE 0x160a#define PCI_DEVICE_ID_AMCC_ADDIDATA_APCI7800 0x818e -#define PCIE_VENDOR_ID_WCH 0x1c00 -#define PCIE_DEVICE_ID_WCH_CH382_2S1P 0x3250 -#define PCIE_DEVICE_ID_WCH_CH384_4S 0x3470 -#define PCIE_DEVICE_ID_WCH_CH384_8S 0x3853 -#define PCIE_DEVICE_ID_WCH_CH382_2S 0x3253 +#define PCI_VENDOR_ID_WCHIC 0x1c00 +#define PCI_DEVICE_ID_WCHIC_CH382_2S1P 0x3250 +#define PCI_DEVICE_ID_WCHIC_CH384_4S 0x3470 +#define PCI_DEVICE_ID_WCHIC_CH384_8S 0x3853 +#define PCI_DEVICE_ID_WCHIC_CH382_2S 0x3253#define PCI_DEVICE_ID_MOXA_CP102E 0x1024#define PCI_DEVICE_ID_MOXA_CP102EL 0x1025
@@ -2777,80 +2777,80 @@ static struct pci_serial_quirk pci_serial_quirks[] = { },/* WCH CH353 1S1P card (16550 clone) */ { - .vendor = PCI_VENDOR_ID_WCH, - .device = PCI_DEVICE_ID_WCH_CH353_1S1P, + .vendor = PCI_VENDOR_ID_WCHCN, + .device = PCI_DEVICE_ID_WCHCN_CH353_1S1P, .subvendor = PCI_ANY_ID, .subdevice = PCI_ANY_ID, .setup = pci_wch_ch353_setup, }, /* WCH CH353 2S1P card (16550 clone) */ { - .vendor = PCI_VENDOR_ID_WCH, - .device = PCI_DEVICE_ID_WCH_CH353_2S1P, + .vendor = PCI_VENDOR_ID_WCHCN, + .device = PCI_DEVICE_ID_WCHCN_CH353_2S1P, .subvendor = PCI_ANY_ID, .subdevice = PCI_ANY_ID, .setup = pci_wch_ch353_setup, }, /* WCH CH353 4S card (16550 clone) */ { - .vendor = PCI_VENDOR_ID_WCH, - .device = PCI_DEVICE_ID_WCH_CH353_4S, + .vendor = PCI_VENDOR_ID_WCHCN, + .device = PCI_DEVICE_ID_WCHCN_CH353_4S, .subvendor = PCI_ANY_ID, .subdevice = PCI_ANY_ID, .setup = pci_wch_ch353_setup, }, /* WCH CH353 2S1PF card (16550 clone) */ { - .vendor = PCI_VENDOR_ID_WCH, - .device = PCI_DEVICE_ID_WCH_CH353_2S1PF, + .vendor = PCI_VENDOR_ID_WCHCN, + .device = PCI_DEVICE_ID_WCHCN_CH353_2S1PF, .subvendor = PCI_ANY_ID, .subdevice = PCI_ANY_ID, .setup = pci_wch_ch353_setup, }, /* WCH CH352 2S card (16550 clone) */ { - .vendor = PCI_VENDOR_ID_WCH, - .device = PCI_DEVICE_ID_WCH_CH352_2S, + .vendor = PCI_VENDOR_ID_WCHCN, + .device = PCI_DEVICE_ID_WCHCN_CH352_2S, .subvendor = PCI_ANY_ID, .subdevice = PCI_ANY_ID, .setup = pci_wch_ch353_setup, }, /* WCH CH355 4S card (16550 clone) */ { - .vendor = PCI_VENDOR_ID_WCH, - .device = PCI_DEVICE_ID_WCH_CH355_4S, + .vendor = PCI_VENDOR_ID_WCHCN, + .device = PCI_DEVICE_ID_WCHCN_CH355_4S, .subvendor = PCI_ANY_ID, .subdevice = PCI_ANY_ID, .setup = pci_wch_ch355_setup, }, /* WCH CH382 2S card (16850 clone) */ { - .vendor = PCIE_VENDOR_ID_WCH, - .device = PCIE_DEVICE_ID_WCH_CH382_2S, + .vendor = PCI_VENDOR_ID_WCHIC, + .device = PCI_DEVICE_ID_WCHIC_CH382_2S, .subvendor = PCI_ANY_ID, .subdevice = PCI_ANY_ID, .setup = pci_wch_ch38x_setup, }, /* WCH CH382 2S1P card (16850 clone) */ { - .vendor = PCIE_VENDOR_ID_WCH, - .device = PCIE_DEVICE_ID_WCH_CH382_2S1P, + .vendor = PCI_VENDOR_ID_WCHIC, + .device = PCI_DEVICE_ID_WCHIC_CH382_2S1P, .subvendor = PCI_ANY_ID, .subdevice = PCI_ANY_ID, .setup = pci_wch_ch38x_setup, }, /* WCH CH384 4S card (16850 clone) */ { - .vendor = PCIE_VENDOR_ID_WCH, - .device = PCIE_DEVICE_ID_WCH_CH384_4S, + .vendor = PCI_VENDOR_ID_WCHIC, + .device = PCI_DEVICE_ID_WCHIC_CH384_4S, .subvendor = PCI_ANY_ID, .subdevice = PCI_ANY_ID, .setup = pci_wch_ch38x_setup, }, /* WCH CH384 8S card (16850 clone) */ { - .vendor = PCIE_VENDOR_ID_WCH, - .device = PCIE_DEVICE_ID_WCH_CH384_8S, + .vendor = PCI_VENDOR_ID_WCHIC, + .device = PCI_DEVICE_ID_WCHIC_CH384_8S, .subvendor = PCI_ANY_ID, .subdevice = PCI_ANY_ID, .init = pci_wch_ch38x_init,
@@ -3927,11 +3927,11 @@ static const struct pci_device_id blacklist[] = {/* multi-io cards handled by parport_serial */ /* WCH CH353 2S1P */ - { PCI_DEVICE(0x4348, 0x7053), 0, 0, REPORT_CONFIG(PARPORT_SERIAL), }, + { PCI_VDEVICE(WCHCN, 0x7053), REPORT_CONFIG(PARPORT_SERIAL), }, /* WCH CH353 1S1P */ - { PCI_DEVICE(0x4348, 0x5053), 0, 0, REPORT_CONFIG(PARPORT_SERIAL), }, + { PCI_VDEVICE(WCHCN, 0x5053), REPORT_CONFIG(PARPORT_SERIAL), }, /* WCH CH382 2S1P */ - { PCI_DEVICE(0x1c00, 0x3250), 0, 0, REPORT_CONFIG(PARPORT_SERIAL), }, + { PCI_VDEVICE(WCHIC, 0x3250), REPORT_CONFIG(PARPORT_SERIAL), }, /* Intel platforms with MID UART */ { PCI_VDEVICE(INTEL, 0x081b), REPORT_8250_CONFIG(MID), },
@@ -6004,27 +6004,27 @@ static const struct pci_device_id serial_pci_tbl[] = {* WCH CH353 series devices: The 2S1P is handled by parport_serial * so not listed here. */ - {PCI_VENDOR_ID_WCH ,PCI_DEVICE_ID_WCH_CH353_4S , + {PCI_VENDOR_ID_WCHCN ,PCI_DEVICE_ID_WCHCN_CH353_4S ,PCI_ANY_ID ,PCI_ANY_ID , 0, 0, pbn_b0_bt_4_115200 }, - { PCI_VENDOR_ID_WCH, PCI_DEVICE_ID_WCH_CH353_2S1PF, + { PCI_VENDOR_ID_WCHCN, PCI_DEVICE_ID_WCHCN_CH353_2S1PF,PCI_ANY_ID ,PCI_ANY_ID , 0, 0, pbn_b0_bt_2_115200 }, - { PCI_VENDOR_ID_WCH, PCI_DEVICE_ID_WCH_CH355_4S, + { PCI_VENDOR_ID_WCHCN, PCI_DEVICE_ID_WCHCN_CH355_4S,PCI_ANY_ID ,PCI_ANY_ID , 0, 0, pbn_b0_bt_4_115200 }, - { PCIE_VENDOR_ID_WCH, PCIE_DEVICE_ID_WCH_CH382_2S, + { PCI_VENDOR_ID_WCHIC, PCI_DEVICE_ID_WCHIC_CH382_2S,PCI_ANY_ID ,PCI_ANY_ID , 0, 0, pbn_wch382_2 }, - { PCIE_VENDOR_ID_WCH, PCIE_DEVICE_ID_WCH_CH384_4S, + { PCI_VENDOR_ID_WCHIC, PCI_DEVICE_ID_WCHIC_CH384_4S,PCI_ANY_ID ,PCI_ANY_ID , 0, 0, pbn_wch384_4 }, - { PCIE_VENDOR_ID_WCH, PCIE_DEVICE_ID_WCH_CH384_8S, + { PCI_VENDOR_ID_WCHIC, PCI_DEVICE_ID_WCHIC_CH384_8S,PCI_ANY_ID ,PCI_ANY_ID , 0, 0, pbn_wch384_8 },/*
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 78/230 serial: 8250_pci: Share WCH IDs with parport_serial driver
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 535a07698b8b3e6f305673102d297262cae2360a ]
parport_serial driver uses subset of WCH IDs that are present in 8250_pci. Share them via pci_ids.h and switch parport_serial to use defined constants.
--- drivers/parport/parport_serial.c | 12 ++++++++---- drivers/tty/serial/8250/8250_pci.c | 10 ++-------- include/linux/pci_ids.h | 11 +++++++++++ 3 files changed, 21 insertions(+), 12 deletions(-)
drivers/parport/parport_serial.c +8 -4
@@ -266,10 +266,14 @@ static struct pci_device_id parport_serial_pci_tbl[] = { { 0x1409, 0x7168, 0x1409, 0xd079, 0, 0, timedia_9079c },/* WCH CARDS */ - { 0x4348, 0x5053, PCI_ANY_ID, PCI_ANY_ID, 0, 0, wch_ch353_1s1p}, - { 0x4348, 0x7053, 0x4348, 0x3253, 0, 0, wch_ch353_2s1p}, - { 0x1c00, 0x3050, 0x1c00, 0x3050, 0, 0, wch_ch382_0s1p}, - { 0x1c00, 0x3250, 0x1c00, 0x3250, 0, 0, wch_ch382_2s1p}, + { PCI_VENDOR_ID_WCHCN, PCI_DEVICE_ID_WCHCN_CH353_1S1P, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, wch_ch353_1s1p }, + { PCI_VENDOR_ID_WCHCN, PCI_DEVICE_ID_WCHCN_CH353_2S1P, + 0x4348, 0x3253, 0, 0, wch_ch353_2s1p }, + { PCI_VENDOR_ID_WCHIC, PCI_DEVICE_ID_WCHIC_CH382_0S1P, + 0x1c00, 0x3050, 0, 0, wch_ch382_0s1p }, + { PCI_VENDOR_ID_WCHIC, PCI_DEVICE_ID_WCHIC_CH382_2S1P, + 0x1c00, 0x3250, 0, 0, wch_ch382_2s1p },/* BrainBoxes PX272/PX306 MIO card */ { PCI_VENDOR_ID_INTASHIELD, 0x4100,
drivers/tty/serial/8250/8250_pci.c +2 -8
@@ -64,23 +64,17 @@#define PCIE_DEVICE_ID_NEO_2_OX_IBM 0x00F6#define PCI_DEVICE_ID_PLX_CRONYX_OMEGA 0xc001#define PCI_DEVICE_ID_INTEL_PATSBURG_KT 0x1d3d -#define PCI_VENDOR_ID_WCHCN 0x4348 +#define PCI_DEVICE_ID_WCHCN_CH352_2S 0x3253 -#define PCI_DEVICE_ID_WCHCN_CH353_4S 0x3453 -#define PCI_DEVICE_ID_WCHCN_CH353_2S1PF 0x5046 -#define PCI_DEVICE_ID_WCHCN_CH353_1S1P 0x5053 -#define PCI_DEVICE_ID_WCHCN_CH353_2S1P 0x7053#define PCI_DEVICE_ID_WCHCN_CH355_4S 0x7173 +#define PCI_VENDOR_ID_AGESTAR 0x5372#define PCI_DEVICE_ID_AGESTAR_9375 0x6872#define PCI_DEVICE_ID_BROADCOM_TRUMANAGE 0x160a#define PCI_DEVICE_ID_AMCC_ADDIDATA_APCI7800 0x818e -#define PCI_VENDOR_ID_WCHIC 0x1c00 -#define PCI_DEVICE_ID_WCHIC_CH382_2S1P 0x3250#define PCI_DEVICE_ID_WCHIC_CH384_4S 0x3470#define PCI_DEVICE_ID_WCHIC_CH384_8S 0x3853 -#define PCI_DEVICE_ID_WCHIC_CH382_2S 0x3253#define PCI_DEVICE_ID_MOXA_CP102E 0x1024#define PCI_DEVICE_ID_MOXA_CP102EL 0x1025
include/linux/pci_ids.h +11 -0
@@ -2589,6 +2589,11 @@#define PCI_VENDOR_ID_REDHAT 0x1b36 +#define PCI_VENDOR_ID_WCHIC 0x1c00 +#define PCI_DEVICE_ID_WCHIC_CH382_0S1P 0x3050 +#define PCI_DEVICE_ID_WCHIC_CH382_2S1P 0x3250 +#define PCI_DEVICE_ID_WCHIC_CH382_2S 0x3253 +#define PCI_VENDOR_ID_SILICOM_DENMARK 0x1c2c#define PCI_VENDOR_ID_AMAZON_ANNAPURNA_LABS 0x1c36
@@ -2643,6 +2648,12 @@#define PCI_VENDOR_ID_AKS 0x416c#define PCI_DEVICE_ID_AKS_ALADDINCARD 0x0100 +#define PCI_VENDOR_ID_WCHCN 0x4348 +#define PCI_DEVICE_ID_WCHCN_CH353_4S 0x3453 +#define PCI_DEVICE_ID_WCHCN_CH353_2S1PF 0x5046 +#define PCI_DEVICE_ID_WCHCN_CH353_1S1P 0x5053 +#define PCI_DEVICE_ID_WCHCN_CH353_2S1P 0x7053 +#define PCI_VENDOR_ID_ACCESSIO 0x494f#define PCI_DEVICE_ID_ACCESSIO_WDG_CSM 0x22c0
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 79/230 8250: microchip: pci1xxxx: Add workaround for RTS bit toggle
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rengarajan S <[email protected]>
[ Upstream commit e95cb63e57381f00d9274533ea7fd0ac3bf4e5b0 ]
In the B0 revision, the RTS pin remains high due to incorrect hardware mapping. To address this issue, enable auto-direction control with the RTS bit in ADCL_CFG_REG. This configuration ensures that the RTS pin goes low when the terminal is opened and high when the terminal is closed. Additionally, we reset the step counter for Rx and Tx engines by writing into FRAC_DIV_CFG_REG.
--- drivers/tty/serial/8250/8250_pci1xxxx.c | 60 ++++++++++++++++++++++++- 1 file changed, 59 insertions(+), 1 deletion(-)
drivers/tty/serial/8250/8250_pci1xxxx.c +59 -1
@@ -78,6 +78,12 @@#define UART_TX_BYTE_FIFO 0x00#define UART_FIFO_CTL 0x02 +#define UART_MODEM_CTL_REG 0x04 +#define UART_MODEM_CTL_RTS_SET BIT(1) + +#define UART_LINE_STAT_REG 0x05 +#define UART_LINE_XMIT_CHECK_MASK GENMASK(6, 5) +#define UART_ACTV_REG 0x11#define UART_BLOCK_SET_ACTIVE BIT(0)
@@ -94,6 +100,7 @@#define UART_BIT_SAMPLE_CNT_16 16#define BAUD_CLOCK_DIV_INT_MSK GENMASK(31, 8)#define ADCL_CFG_RTS_DELAY_MASK GENMASK(11, 8) +#define FRAC_DIV_TX_END_POINT_MASK GENMASK(23, 20)#define UART_WAKE_REG 0x8C#define UART_WAKE_MASK_REG 0x90
@@ -134,6 +141,11 @@#define UART_BST_STAT_LSR_FRAME_ERR 0x8000000#define UART_BST_STAT_LSR_THRE 0x20000000 +#define GET_MODEM_CTL_RTS_STATUS (reg) ((reg) & UART_MODEM_CTL_RTS_SET) +#define GET_RTS_PIN_STATUS (val) (((val) & TIOCM_RTS) >> 1) +#define RTS_TOGGLE_STATUS_MASK (val, reg) (GET_MODEM_CTL_RTS_STATUS(reg) \ + != GET_RTS_PIN_STATUS(val)) +struct pci1xxxx_8250 {unsigned int nr;u8 dev_rev;
@@ -254,6 +266,47 @@ static void pci1xxxx_set_divisor(struct uart_port *port, unsigned int baud, port->membase + UART_BAUD_CLK_DIVISOR_REG); } +static void pci1xxxx_set_mctrl (struct uart_port *port,unsigned int mctrl) +{ +u32 fract_div_cfg_reg; +u32 line_stat_reg; +u32 modem_ctl_reg; +u32 adcl_cfg_reg; + + adcl_cfg_reg =readl (port->membase +ADCL_CFG_REG ); + +/* HW is responsible in ADCL_EN case */ +if ((adcl_cfg_reg & (ADCL_CFG_EN |ADCL_CFG_PIN_SEL ))) +return ; + + modem_ctl_reg =readl (port->membase +UART_MODEM_CTL_REG ); + +serial8250_do_set_mctrl (port, mctrl); + +if (RTS_TOGGLE_STATUS_MASK (mctrl, modem_ctl_reg)) { + line_stat_reg =readl (port->membase +UART_LINE_STAT_REG ); +if (line_stat_reg &UART_LINE_XMIT_CHECK_MASK ) { + fract_div_cfg_reg =readl (port->membase + +FRAC_DIV_CFG_REG ); + +writel ((fract_div_cfg_reg & + ~(FRAC_DIV_TX_END_POINT_MASK )), + port->membase +FRAC_DIV_CFG_REG ); + +/* Enable ADC and set the nRTS pin */ +writel ((adcl_cfg_reg | (ADCL_CFG_EN | +ADCL_CFG_PIN_SEL )), + port->membase +ADCL_CFG_REG ); + +/* Revert to the original settings */ +writel (adcl_cfg_reg, port->membase +ADCL_CFG_REG ); + +writel (fract_div_cfg_reg, port->membase + +FRAC_DIV_CFG_REG ); + } + } +} +static int pci1xxxx_rs485_config (struct uart_port *port,struct ktermios *termios,struct serial_rs485 *rs485)
@@ -631,9 +684,14 @@ static int pci1xxxx_setup(struct pci_dev *pdev, port->port.rs485_config = pci1xxxx_rs485_config; port->port.rs485_supported = pci1xxxx_rs485_supported; -/* From C0 rev Burst operation is supported */ +/* +* C0 and later revisions support Burst operation. +* RTS workaround in mctrl is applicable only to B0. +*/ if (rev >=0xC0 ) port->port.handle_irq = pci1xxxx_handle_irq; +else if (rev ==0xB0 ) + port->port.set_mctrl = pci1xxxx_set_mctrl; ret =serial8250_pci_setup_port (pdev, port,0 ,PORT_OFFSET * port_idx,0 );if (ret <0 )
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 80/230 kunit: platform: Resolve struct completion warning
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Norris <[email protected]>
[ Upstream commit 7687c66c18c66d4ccd9949c6f641c0e7b5773483 ]
If the <kunit/platform_device.h> header is included in a test without certain other headers, it produces compiler warnings like:
In file included from [...] ../include/kunit/platform_device.h:15:57: warning: ‘struct completion’ declared inside parameter list will not be visible outside of this definition or declaration
15 | struct completion *x);
| ^~~~~~~~~~
Add a 'struct completion' forward declaration to resolve this.
--- include/kunit/platform_device.h | 1 + 1 file changed, 1 insertion(+)
include/kunit/platform_device.h +1 -0
@@ -2,6 +2,7 @@#ifndef _KUNIT_PLATFORM_DRIVER_H#define _KUNIT_PLATFORM_DRIVER_H +struct completion ;struct kunit ;struct platform_device ;struct platform_driver ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 81/230 vfio/pci: Enable iowrite64 and ioread64 for vfio pci
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ramesh Thomas <[email protected]>
[ Upstream commit 2b938e3db335e3670475e31a722c2bee34748c5a ]
Definitions of ioread64 and iowrite64 macros in asm/io.h called by vfio pci implementations are enclosed inside check for CONFIG_GENERIC_IOMAP. They don't get defined if CONFIG_GENERIC_IOMAP is defined. Include linux/io-64-nonatomic-lo-hi.h to define iowrite64 and ioread64 macros when they are not defined. io-64-nonatomic-lo-hi.h maps the macros to generic implementation in lib/iomap.c. The generic implementation does 64 bit rw if readq/writeq is defined for the architecture, otherwise it would do 32 bit back to back rw.
Note that there are two versions of the generic implementation that differs in the order the 32 bit words are written if 64 bit support is not present. This is not the little/big endian ordering, which is handled separately. This patch uses the lo followed by hi word ordering which is consistent with current back to back implementation in the vfio/pci code.
--- drivers/vfio/pci/vfio_pci_rdwr.c | 1 + 1 file changed, 1 insertion(+)
drivers/vfio/pci/vfio_pci_rdwr.c +1 -0
@@ -16,6 +16,7 @@#include <linux/io.h> #include <linux/vfio.h> #include <linux/vgaarb.h> +#include <linux/io-64-nonatomic-lo-hi.h> #include "vfio_pci_priv.h"
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 82/230 NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zichen Xie <[email protected]>
[ Upstream commit 49fd4e34751e90e6df009b70cd0659dc839e7ca8 ]
name is char[64] where the size of clnt->cl_program->name remains unknown. Invoking strcat() directly will also lead to potential buffer overflow. Change them to strscpy() and strncat() to fix potential issues.
--- fs/nfs/sysfs.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
fs/nfs/sysfs.c +3 -3
@@ -280,9 +280,9 @@ void nfs_sysfs_link_rpc_client(struct nfs_server *server,char name[RPC_CLIENT_NAME_SIZE ];int ret; -strcpy (name, clnt->cl_program->name); -strcat (name, uniq ? uniq :"" ); -strcat (name,"_client" ); +strscpy (name, clnt->cl_program->name,sizeof (name)); +strncat (name, uniq ? uniq :"" ,sizeof (name) -strlen (name) -1 ); +strncat (name,"_client" ,sizeof (name) -strlen (name) -1 ); ret =sysfs_create_link_nowarn (&server->kobj, &clnt->cl_sysfs->kobject, name);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 83/230 vfio/nvgrace-gpu: Read dvsec register to determine need for uncached resmem
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ankit Agrawal <[email protected]>
[ Upstream commit bd53764a60ad586ad5b6ed339423ad5e67824464 ]
NVIDIA's recently introduced Grace Blackwell (GB) Superchip is a continuation with the Grace Hopper (GH) superchip that provides a cache coherent access to CPU and GPU to each other's memory with an internal proprietary chip-to-chip cache coherent interconnect.
There is a HW defect on GH systems to support the Multi-Instance GPU (MIG) feature [1] that necessiated the presence of a 1G region with uncached mapping carved out from the device memory. The 1G region is shown as a fake BAR (comprising region 2 and 3) to workaround the issue. This is fixed on the GB systems.
The presence of the fix for the HW defect is communicated by the device firmware through the DVSEC PCI config register with ID 3. The module reads this to take a different codepath on GB vs GH.
Scan through the DVSEC registers to identify the correct one and use it to determine the presence of the fix. Save the value in the device's nvgrace_gpu_pci_core_device structure.
--- drivers/vfio/pci/nvgrace-gpu/main.c | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+)
drivers/vfio/pci/nvgrace-gpu/main.c +28 -0
@@ -23,6 +23,11 @@/* A hardwired and constant ABI value between the GPU FW and VFIO driver. */ #define MEMBLK_SIZE SZ_512M +#define DVSEC_BITMAP_OFFSET 0xA +#define MIG_SUPPORTED_WITH_CACHED_RESMEM BIT(0) + +#define GPU_CAP_DVSEC_REGISTER 3 +/* * The state of the two device memory region - resmem and usemem - is * saved as struct mem_region.
@@ -46,6 +51,7 @@ struct nvgrace_gpu_pci_core_device {struct mem_region resmem;/* Lock to control device memory kernel mapping */ struct mutex remap_lock; +bool has_mig_hw_bug; };static void nvgrace_gpu_init_fake_bar_emu_regs (struct vfio_device *core_vdev)
@@ -812,6 +818,26 @@ nvgrace_gpu_init_nvdev_struct(struct pci_dev *pdev,return ret; } +static bool nvgrace_gpu_has_mig_hw_bug (struct pci_dev *pdev) +{ +int pcie_dvsec; +u16 dvsec_ctrl16; + + pcie_dvsec =pci_find_dvsec_capability (pdev,PCI_VENDOR_ID_NVIDIA , +GPU_CAP_DVSEC_REGISTER ); + +if (pcie_dvsec) { +pci_read_config_word (pdev, + pcie_dvsec +DVSEC_BITMAP_OFFSET , + &dvsec_ctrl16); + +if (dvsec_ctrl16 &MIG_SUPPORTED_WITH_CACHED_RESMEM ) +return false; + } + +return true; +} +static int nvgrace_gpu_probe (struct pci_dev *pdev,const struct pci_device_id *id) {
@@ -832,6 +858,8 @@ static int nvgrace_gpu_probe(struct pci_dev *pdev,dev_set_drvdata (&pdev->dev, &nvdev->core_device);if (ops == &nvgrace_gpu_pci_ops) { + nvdev->has_mig_hw_bug =nvgrace_gpu_has_mig_hw_bug (pdev); +/* * Device memory properties are identified in the host ACPI * table. Set the nvgrace_gpu_pci_core_device structure.
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 84/230 vfio/nvgrace-gpu: Expose the blackwell device PF BAR1 to the VM
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ankit Agrawal <[email protected]>
[ Upstream commit 6a9eb2d125ba90d13b45bcfabcddf9f61268f6a8 ]
There is a HW defect on Grace Hopper (GH) to support the Multi-Instance GPU (MIG) feature [1] that necessiated the presence of a 1G region carved out from the device memory and mapped as uncached. The 1G region is shown as a fake BAR (comprising region 2 and 3) to workaround the issue.
The Grace Blackwell systems (GB) differ from GH systems in the following aspects:
1. The aforementioned HW defect is fixed on GB systems.
2. There is a usable BAR1 (region 2 and 3) on GB systems for the GPUdirect RDMA feature [2].
This patch accommodate those GB changes by showing the 64b physical device BAR1 (region2 and 3) to the VM instead of the fake one. This takes care of both the differences.
Moreover, the entire device memory is exposed on GB as cacheable to the VM as there is no carveout required.
--- drivers/vfio/pci/nvgrace-gpu/main.c | 67 +++++++++++++++++++---------- 1 file changed, 45 insertions(+), 22 deletions(-)
drivers/vfio/pci/nvgrace-gpu/main.c +45 -22
@@ -17,9 +17,6 @@#define RESMEM_REGION_INDEX VFIO_PCI_BAR2_REGION_INDEX#define USEMEM_REGION_INDEX VFIO_PCI_BAR4_REGION_INDEX -/* Memory size expected as non cached and reserved by the VM driver */ -#define RESMEM_SIZE SZ_1G -/* A hardwired and constant ABI value between the GPU FW and VFIO driver. */ #define MEMBLK_SIZE SZ_512M
@@ -72,7 +69,7 @@ nvgrace_gpu_memregion(int index,if (index ==USEMEM_REGION_INDEX )return &nvdev->usemem; -if (index ==RESMEM_REGION_INDEX ) +if (nvdev->resmem.memlength && index ==RESMEM_REGION_INDEX )return &nvdev->resmem;return NULL ;
@@ -757,40 +754,67 @@ nvgrace_gpu_init_nvdev_struct(struct pci_dev *pdev, u64 memphys, u64 memlength) { int ret = 0; +u64 resmem_size =0 ;/* -* The VM GPU device driver needs a non-cacheable region to support -* the MIG feature. Since the device memory is mapped as NORMAL cached, -* carve out a region from the end with a different NORMAL_NC -* property (called as reserved memory and represented as resmem). This -* region then is exposed as a 64b BAR (region 2 and 3) to the VM, while -* exposing the rest (termed as usable memory and represented using usemem) -* as cacheable 64b BAR (region 4 and 5). +* On Grace Hopper systems, the VM GPU device driver needs a non-cacheable +* region to support the MIG feature owing to a hardware bug. Since the +* device memory is mapped as NORMAL cached, carve out a region from the end +* with a different NORMAL_NC property (called as reserved memory and +* represented as resmem). This region then is exposed as a 64b BAR +* (region 2 and 3) to the VM, while exposing the rest (termed as usable +* memory and represented using usemem) as cacheable 64b BAR (region 4 and 5). * * devmem (memlength) * |-------------------------------------------------| * | | * usemem.memphys resmem.memphys +* +* This hardware bug is fixed on the Grace Blackwell platforms and the +* presence of the bug can be determined through nvdev->has_mig_hw_bug. +* Thus on systems with the hardware fix, there is no need to partition +* the GPU device memory and the entire memory is usable and mapped as +* NORMAL cached (i.e. resmem size is 0). */ +if (nvdev->has_mig_hw_bug) + resmem_size =SZ_1G ; + nvdev->usemem.memphys = memphys;/* * The device memory exposed to the VM is added to the kernel by the -* VM driver module in chunks of memory block size. Only the usable -* memory (usemem) is added to the kernel for usage by the VM -* workloads. Make the usable memory size memblock aligned. +* VM driver module in chunks of memory block size. Note that only the +* usable memory (usemem) is added to the kernel for usage by the VM +* workloads. */ -if (check_sub_overflow (memlength,RESMEM_SIZE , +if (check_sub_overflow (memlength, resmem_size, &nvdev->usemem.memlength)) { ret = -EOVERFLOW ; goto done; }/* -* The USEMEM part of the device memory has to be MEMBLK_SIZE -* aligned. This is a hardwired ABI value between the GPU FW and -* VFIO driver. The VM device driver is also aware of it and make -* use of the value for its calculation to determine USEMEM size. +* The usemem region is exposed as a 64B Bar composed of region 4 and 5. +* Calculate and save the BAR size for the region. +*/ + nvdev->usemem.bar_size =roundup_pow_of_two (nvdev->usemem.memlength); + +/* +* If the hardware has the fix for MIG, there is no requirement +* for splitting the device memory to create RESMEM. The entire +* device memory is usable and will be USEMEM. Return here for +* such case. +*/ +if (!nvdev->has_mig_hw_bug) + goto done; + +/* +* When the device memory is split to workaround the MIG bug on +* Grace Hopper, the USEMEM part of the device memory has to be +* MEMBLK_SIZE aligned. This is a hardwired ABI value between the +* GPU FW and VFIO driver. The VM device driver is also aware of it +* and make use of the value for its calculation to determine USEMEM +* size. Note that the device memory may not be 512M aligned. */ nvdev->usemem.memlength =round_down (nvdev->usemem.memlength,MEMBLK_SIZE );
@@ -809,10 +833,9 @@ nvgrace_gpu_init_nvdev_struct(struct pci_dev *pdev, }/* -* The memory regions are exposed as BARs. Calculate and save -* the BAR size for them. +* The resmem region is exposed as a 64b BAR composed of region 2 and 3 +* for Grace Hopper. Calculate and save the BAR size for the region. */ - nvdev->usemem.bar_size =roundup_pow_of_two (nvdev->usemem.memlength); nvdev->resmem.bar_size =roundup_pow_of_two (nvdev->resmem.memlength); done:return ret;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 85/230 fs/ntfs3: Unify inode corruption marking with _ntfs_bad_inode()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <[email protected]>
[ Upstream commit 55ad333de0f80bc0caee10c6c27196cdcf8891bb ]
Also reworked error handling in a couple of places.
--- fs/ntfs3/attrib.c | 4 ++-- fs/ntfs3/dir.c | 2 +- fs/ntfs3/frecord.c | 12 +++++++----- fs/ntfs3/fsntfs.c | 6 +++++- fs/ntfs3/index.c | 6 ++---- fs/ntfs3/inode.c | 3 +++ 6 files changed, 20 insertions(+), 13 deletions(-)
fs/ntfs3/attrib.c +2 -2
@@ -1406,7 +1406,7 @@ int attr_wof_frame_info(struct ntfs_inode *ni, struct ATTRIB *attr,*/ if (!attr->non_res) {if (vbo[1 ] + bytes_per_off >le32_to_cpu (attr->res.data_size)) { -ntfs_inode_err (&ni->vfs_inode,"is corrupted" ); +_ntfs_bad_inode (&ni->vfs_inode);return -EINVAL ; } addr =resident_data (attr);
@@ -2587,7 +2587,7 @@ int attr_force_nonresident(struct ntfs_inode *ni) attr =ni_find_attr (ni,NULL , &le,ATTR_DATA ,NULL ,0 ,NULL , &mi);if (!attr) { -ntfs_bad_inode (&ni->vfs_inode,"no data attribute" ); +_ntfs_bad_inode (&ni->vfs_inode);return -ENOENT ; }
fs/ntfs3/dir.c +1 -1
@@ -512,7 +512,7 @@ static int ntfs_readdir(struct file *file, struct dir_context *ctx) ctx->pos = pos; }else if (err <0 ) {if (err == -EINVAL ) -ntfs_inode_err (dir,"directory corrupted" ); +_ntfs_bad_inode (dir); ctx->pos = eod; }
fs/ntfs3/frecord.c +7 -5
@@ -148,8 +148,10 @@ int ni_load_mi_ex(struct ntfs_inode *ni, CLST rno, struct mft_inode **mi) goto out; err =mi_get (ni->mi.sbi, rno, &r); -if (err) +if (err) { +_ntfs_bad_inode (&ni->vfs_inode);return err; + }ni_add_mi (ni, r);
@@ -238,8 +240,7 @@ struct ATTRIB *ni_find_attr(struct ntfs_inode *ni, struct ATTRIB *attr,return attr; out: -ntfs_inode_err (&ni->vfs_inode,"failed to parse mft record" ); -ntfs_set_state (ni->mi.sbi,NTFS_DIRTY_ERROR ); +_ntfs_bad_inode (&ni->vfs_inode);return NULL ; }
@@ -330,6 +331,7 @@ struct ATTRIB *ni_load_attr(struct ntfs_inode *ni, enum ATTR_TYPE type, vcn <= le64_to_cpu(attr->nres.evcn))return attr; +_ntfs_bad_inode (&ni->vfs_inode);return NULL ; }
@@ -1604,8 +1606,8 @@ int ni_delete_all(struct ntfs_inode *ni) roff =le16_to_cpu (attr->nres.run_off);if (roff > asize) { -_ntfs_bad_inode (&ni->vfs_inode); -return -EINVAL ; +/* ni_enum_attr_ex checks this case. */ +continue ; }/* run==1 means unpack and deallocate. */
fs/ntfs3/fsntfs.c +5 -1
@@ -908,7 +908,11 @@ void ntfs_bad_inode(struct inode *inode, const char *hint)ntfs_inode_err (inode,"%s" , hint);make_bad_inode (inode); -ntfs_set_state (sbi,NTFS_DIRTY_ERROR ); +/* Avoid recursion if bad inode is $Volume. */ +if (inode->i_ino !=MFT_REC_VOL && + !(sbi->flags &NTFS_FLAGS_LOG_REPLAYING )) { +ntfs_set_state (sbi,NTFS_DIRTY_ERROR ); + } }/*
fs/ntfs3/index.c +2 -4
@@ -1094,8 +1094,7 @@ int indx_read(struct ntfs_index *indx, struct ntfs_inode *ni, CLST vbn, ok:if (!index_buf_check (ib, bytes, &vbn)) { -ntfs_inode_err (&ni->vfs_inode,"directory corrupted" ); -ntfs_set_state (ni->mi.sbi,NTFS_DIRTY_ERROR ); +_ntfs_bad_inode (&ni->vfs_inode); err = -EINVAL ; goto out; }
@@ -1117,8 +1116,7 @@ int indx_read(struct ntfs_index *indx, struct ntfs_inode *ni, CLST vbn, out:if (err == -E_NTFS_CORRUPT ) { -ntfs_inode_err (&ni->vfs_inode,"directory corrupted" ); -ntfs_set_state (ni->mi.sbi,NTFS_DIRTY_ERROR ); +_ntfs_bad_inode (&ni->vfs_inode); err = -EINVAL ; }
fs/ntfs3/inode.c +3 -0
@@ -410,6 +410,9 @@ static struct inode *ntfs_read_mft(struct inode *inode,if (!std5) goto out; +if (is_bad_inode (inode)) + goto out; +if (!is_match && name) { err = -ENOENT ; goto out;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 86/230 Grab mm lock before grabbing pt lock
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maksym Planeta <[email protected]>
[ Upstream commit 6d002348789bc16e9203e9818b7a3688787e3b29 ]
Function xen_pin_page calls xen_pte_lock, which in turn grab page table lock (ptlock). When locking, xen_pte_lock expect mm->page_table_lock to be held before grabbing ptlock, but this does not happen when pinning is caused by xen_mm_pin_all.
This commit addresses lockdep warning below, which shows up when suspending a Xen VM.
[ 3680.658422] Freezing user space processes
[ 3680.660156] Freezing user space processes completed (elapsed 0.001 seconds)
[ 3680.660182] OOM killer disabled.
[ 3680.660192] Freezing remaining freezable tasks
[ 3680.661485] Freezing remaining freezable tasks completed (elapsed 0.001 seconds)
[ 3680.685254]
[ 3680.685265] ==================================
[ 3680.685269] WARNING: Nested lock was not taken
[ 3680.685274] 6.12.0+ #16 Tainted: G W
[ 3680.685279] ----------------------------------
[ 3680.685283] migration/0/19 is trying to lock:
[ 3680.685288] ffff88800bac33c0 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: xen_pin_page+0x175/0x1d0
[ 3680.685303]
[ 3680.685303] but this task is not holding:
[ 3680.685308] init_mm.page_table_lock
[ 3680.685311]
[ 3680.685311] stack backtrace:
[ 3680.685316] CPU: 0 UID: 0 PID: 19 Comm: migration/0 Tainted: G W 6.12.0+ #16
[ 3680.685324] Tainted: [W]=WARN
[ 3680.685328] Stopper: multi_cpu_stop+0x0/0x120 <- __stop_cpus.constprop.0+0x8c/0xd0
[ 3680.685339] Call Trace:
[ 3680.685344] <TASK>
[ 3680.685347] dump_stack_lvl+0x77/0xb0
[ 3680.685356] __lock_acquire+0x917/0x2310
[ 3680.685364] lock_acquire+0xce/0x2c0
[ 3680.685369] ? xen_pin_page+0x175/0x1d0
[ 3680.685373] _raw_spin_lock_nest_lock+0x2f/0x70
[ 3680.685381] ? xen_pin_page+0x175/0x1d0
[ 3680.685386] xen_pin_page+0x175/0x1d0
[ 3680.685390] ? __pfx_xen_pin_page+0x10/0x10
[ 3680.685394] __xen_pgd_walk+0x233/0x2c0
[ 3680.685401] ? stop_one_cpu+0x91/0x100
[ 3680.685405] __xen_pgd_pin+0x5d/0x250
[ 3680.685410] xen_mm_pin_all+0x70/0xa0
[ 3680.685415] xen_pv_pre_suspend+0xf/0x280
[ 3680.685420] xen_suspend+0x57/0x1a0
[ 3680.685428] multi_cpu_stop+0x6b/0x120
[ 3680.685432] ? update_cpumasks_hier+0x7c/0xa60
[ 3680.685439] ? __pfx_multi_cpu_stop+0x10/0x10
[ 3680.685443] cpu_stopper_thread+0x8c/0x140
[ 3680.685448] ? smpboot_thread_fn+0x20/0x1f0
[ 3680.685454] ? __pfx_smpboot_thread_fn+0x10/0x10
[ 3680.685458] smpboot_thread_fn+0xed/0x1f0
[ 3680.685462] kthread+0xde/0x110
[ 3680.685467] ? __pfx_kthread+0x10/0x10
[ 3680.685471] ret_from_fork+0x2f/0x50
[ 3680.685478] ? __pfx_kthread+0x10/0x10
[ 3680.685482] ret_from_fork_asm+0x1a/0x30
[ 3680.685489] </TASK>
[ 3680.685491]
[ 3680.685491] other info that might help us debug this:
[ 3680.685497] 1 lock held by migration/0/19:
[ 3680.685500] #0: ffffffff8284df38 (pgd_lock){+.+.}-{3:3}, at: xen_mm_pin_all+0x14/0xa0
[ 3680.685512]
[ 3680.685512] stack backtrace:
[ 3680.685518] CPU: 0 UID: 0 PID: 19 Comm: migration/0 Tainted: G W 6.12.0+ #16
[ 3680.685528] Tainted: [W]=WARN
[ 3680.685531] Stopper: multi_cpu_stop+0x0/0x120 <- __stop_cpus.constprop.0+0x8c/0xd0
[ 3680.685538] Call Trace:
[ 3680.685541] <TASK>
[ 3680.685544] dump_stack_lvl+0x77/0xb0
[ 3680.685549] __lock_acquire+0x93c/0x2310
[ 3680.685554] lock_acquire+0xce/0x2c0
[ 3680.685558] ? xen_pin_page+0x175/0x1d0
[ 3680.685562] _raw_spin_lock_nest_lock+0x2f/0x70
[ 3680.685568] ? xen_pin_page+0x175/0x1d0
[ 3680.685572] xen_pin_page+0x175/0x1d0
[ 3680.685578] ? __pfx_xen_pin_page+0x10/0x10
[ 3680.685582] __xen_pgd_walk+0x233/0x2c0
[ 3680.685588] ? stop_one_cpu+0x91/0x100
[ 3680.685592] __xen_pgd_pin+0x5d/0x250
[ 3680.685596] xen_mm_pin_all+0x70/0xa0
[ 3680.685600] xen_pv_pre_suspend+0xf/0x280
[ 3680.685607] xen_suspend+0x57/0x1a0
[ 3680.685611] multi_cpu_stop+0x6b/0x120
[ 3680.685615] ? update_cpumasks_hier+0x7c/0xa60
[ 3680.685620] ? __pfx_multi_cpu_stop+0x10/0x10
[ 3680.685625] cpu_stopper_thread+0x8c/0x140
[ 3680.685629] ? smpboot_thread_fn+0x20/0x1f0
[ 3680.685634] ? __pfx_smpboot_thread_fn+0x10/0x10
[ 3680.685638] smpboot_thread_fn+0xed/0x1f0
[ 3680.685642] kthread+0xde/0x110
[ 3680.685645] ? __pfx_kthread+0x10/0x10
[ 3680.685649] ret_from_fork+0x2f/0x50
[ 3680.685654] ? __pfx_kthread+0x10/0x10
[ 3680.685657] ret_from_fork_asm+0x1a/0x30
[ 3680.685662] </TASK>
[ 3680.685267] xen:grant_table: Grant tables using version 1 layout
[ 3680.685921] OOM killer enabled.
[ 3680.685934] Restarting tasks ... done.Message-ID: <[email protected]>
--- arch/x86/xen/mmu_pv.c | 4 ++++ 1 file changed, 4 insertions(+)
arch/x86/xen/mmu_pv.c +4 -0
@@ -826,6 +826,7 @@ void xen_mm_pin_all(void) {struct page *page; +spin_lock (&init_mm.page_table_lock);spin_lock (&pgd_lock);list_for_each_entry (page, &pgd_list, lru) {
@@ -836,6 +837,7 @@ void xen_mm_pin_all(void) }spin_unlock (&pgd_lock); +spin_unlock (&init_mm.page_table_lock); } static void __init xen_mark_pinned(struct mm_struct *mm, struct page *page,
@@ -935,6 +937,7 @@ void xen_mm_unpin_all(void) {struct page *page; +spin_lock (&init_mm.page_table_lock);spin_lock (&pgd_lock);list_for_each_entry (page, &pgd_list, lru) {
@@ -946,6 +949,7 @@ void xen_mm_unpin_all(void) }spin_unlock (&pgd_lock); +spin_unlock (&init_mm.page_table_lock); }static void xen_enter_mmap (struct mm_struct *mm)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 87/230 selftests: gpio: gpio-sim: Fix missing chip disablements
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koichiro Den <[email protected]>
[ Upstream commit f8524ac33cd452aef5384504b3264db6039a455e ]
Since upstream commit 8bd76b3d3f3a ("gpio: sim: lock up configfs that an instantiated device depends on"), rmdir for an active virtual devices been prohibited.
Update gpio-sim selftest to align with the change.
--- tools/testing/selftests/gpio/gpio-sim.sh | 31 +++++++++++++++++++----- 1 file changed, 25 insertions(+), 6 deletions(-)
tools/testing/selftests/gpio/gpio-sim.sh +25 -6
@@ -46,12 +46,6 @@ remove_chip() { rmdir $CONFIGFS_DIR/$CHIP || fail "Unable to remove the chip" } -configfs_cleanup() { - for CHIP in `ls $CONFIGFS_DIR/`; do - remove_chip $CHIP - done -} - create_chip() { local CHIP=$1
@@ -105,6 +99,13 @@ disable_chip() { echo 0 > $CONFIGFS_DIR/$CHIP/live || fail "Unable to disable the chip" } +configfs_cleanup() { + for CHIP in `ls $CONFIGFS_DIR/`; do + disable_chip $CHIP + remove_chip $CHIP + done +} + configfs_chip_name() { local CHIP=$1 local BANK=$2
@@ -181,6 +182,7 @@ create_chip chip create_bank chip bank enable_chip chip test -n `cat $CONFIGFS_DIR/chip/bank/chip_name` || fail "chip_name doesn't work" +disable_chip chip remove_chip chip echo "1.2. chip_name returns 'none' if the chip is still pending"
@@ -195,6 +197,7 @@ create_chip chip create_bank chip bank enable_chip chip test -n `cat $CONFIGFS_DIR/chip/dev_name` || fail "dev_name doesn't work" +disable_chip chip remove_chip chip echo "2. Creating and configuring simulated chips"
@@ -204,6 +207,7 @@ create_chip chip create_bank chip bank enable_chip chip test "`get_chip_num_lines chip bank`" = "1" || fail "default number of lines is not 1" +disable_chip chip remove_chip chip echo "2.2. Number of lines can be specified"
@@ -212,6 +216,7 @@ create_bank chip bank set_num_lines chip bank 16 enable_chip chip test "`get_chip_num_lines chip bank`" = "16" || fail "number of lines is not 16" +disable_chip chip remove_chip chip echo "2.3. Label can be set"
@@ -220,6 +225,7 @@ create_bank chip bank set_label chip bank foobar enable_chip chip test "`get_chip_label chip bank`" = "foobar" || fail "label is incorrect" +disable_chip chip remove_chip chip echo "2.4. Label can be left empty"
@@ -227,6 +233,7 @@ create_chip chip create_bank chip bank enable_chip chip test -z "`cat $CONFIGFS_DIR/chip/bank/label`" || fail "label is not empty" +disable_chip chip remove_chip chip echo "2.5. Line names can be configured"
@@ -238,6 +245,7 @@ set_line_name chip bank 2 bar enable_chip chip test "`get_line_name chip bank 0`" = "foo" || fail "line name is incorrect" test "`get_line_name chip bank 2`" = "bar" || fail "line name is incorrect" +disable_chip chip remove_chip chip echo "2.6. Line config can remain unused if offset is greater than number of lines"
@@ -248,6 +256,7 @@ set_line_name chip bank 5 foobar enable_chip chip test "`get_line_name chip bank 0`" = "" || fail "line name is incorrect" test "`get_line_name chip bank 1`" = "" || fail "line name is incorrect" +disable_chip chip remove_chip chip echo "2.7. Line configfs directory names are sanitized"
@@ -267,6 +276,7 @@ for CHIP in $CHIPS; do enable_chip $CHIP done for CHIP in $CHIPS; do + disable_chip $CHIP remove_chip $CHIP done
@@ -278,6 +288,7 @@ echo foobar > $CONFIGFS_DIR/chip/bank/label 2> /dev/null && \ fail "Setting label of a live chip should fail" echo 8 > $CONFIGFS_DIR/chip/bank/num_lines 2> /dev/null && \ fail "Setting number of lines of a live chip should fail" +disable_chip chip remove_chip chip echo "2.10. Can't create line items when chip is live"
@@ -285,6 +296,7 @@ create_chip chip create_bank chip bank enable_chip chip mkdir $CONFIGFS_DIR/chip/bank/line0 2> /dev/null && fail "Creating line item should fail" +disable_chip chip remove_chip chip echo "2.11. Probe errors are propagated to user-space"
@@ -316,6 +328,7 @@ mkdir -p $CONFIGFS_DIR/chip/bank/line4/hog enable_chip chip $BASE_DIR/gpio-mockup-cdev -s 1 /dev/`configfs_chip_name chip bank` 4 2> /dev/null && \ fail "Setting the value of a hogged line shouldn't succeed" +disable_chip chip remove_chip chip echo "3. Controlling simulated chips"
@@ -331,6 +344,7 @@ test "$?" = "1" || fail "pull set incorrectly" sysfs_set_pull chip bank 0 pull-down $BASE_DIR/gpio-mockup-cdev /dev/`configfs_chip_name chip bank` 1 test "$?" = "0" || fail "pull set incorrectly" +disable_chip chip remove_chip chip echo "3.2. Pull can be read from sysfs"
@@ -344,6 +358,7 @@ SYSFS_PATH=/sys/devices/platform/$DEVNAME/$CHIPNAME/sim_gpio0/pull test `cat $SYSFS_PATH` = "pull-down" || fail "reading the pull failed" sysfs_set_pull chip bank 0 pull-up test `cat $SYSFS_PATH` = "pull-up" || fail "reading the pull failed" +disable_chip chip remove_chip chip echo "3.3. Incorrect input in sysfs is rejected"
@@ -355,6 +370,7 @@ DEVNAME=`configfs_dev_name chip` CHIPNAME=`configfs_chip_name chip bank` SYSFS_PATH="/sys/devices/platform/$DEVNAME/$CHIPNAME/sim_gpio0/pull" echo foobar > $SYSFS_PATH 2> /dev/null && fail "invalid input not detected" +disable_chip chip remove_chip chip echo "3.4. Can't write to value"
@@ -365,6 +381,7 @@ DEVNAME=`configfs_dev_name chip` CHIPNAME=`configfs_chip_name chip bank` SYSFS_PATH="/sys/devices/platform/$DEVNAME/$CHIPNAME/sim_gpio0/value" echo 1 > $SYSFS_PATH 2> /dev/null && fail "writing to 'value' succeeded unexpectedly" +disable_chip chip remove_chip chip echo "4. Simulated GPIO chips are functional"
@@ -382,6 +399,7 @@ $BASE_DIR/gpio-mockup-cdev -s 1 /dev/`configfs_chip_name chip bank` 0 & sleep 0.1 # FIXME Any better way? test `cat $SYSFS_PATH` = "1" || fail "incorrect value read from sysfs" kill $! +disable_chip chip remove_chip chip echo "4.2. Bias settings work correctly"
@@ -394,6 +412,7 @@ CHIPNAME=`configfs_chip_name chip bank` SYSFS_PATH="/sys/devices/platform/$DEVNAME/$CHIPNAME/sim_gpio0/value" $BASE_DIR/gpio-mockup-cdev -b pull-up /dev/`configfs_chip_name chip bank` 0 test `cat $SYSFS_PATH` = "1" || fail "bias setting does not work" +disable_chip chip remove_chip chip echo "GPIO $MODULE test PASS"
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 88/230 ACPI: x86: Add skip i2c clients quirk for Vexia EDU ATLA 10 tablet 5V
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 8f62ca9c338aae4f73e9ce0221c3d4668359ddd8 ]
The Vexia EDU ATLA 10 tablet comes in 2 different versions with significantly different mainboards. The only outward difference is that the charging barrel on one is marked 5V and the other is marked 9V.
Both ship with Android 4.4 as factory OS and have the usual broken DSDT issues for x86 Android tablets.
Add a quirk to skip ACPI I2C client enumeration for the 5V version to complement the existing quirk for the 9V version.
--- drivers/acpi/x86/utils.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
drivers/acpi/x86/utils.c +13 -0
@@ -407,6 +407,19 @@ static const struct dmi_system_id acpi_quirk_skip_dmi_ids[] = { .driver_data = (void *)(ACPI_QUIRK_SKIP_I2C_CLIENTS | ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY), }, + { +/* Vexia Edu Atla 10 tablet 5V version */ + .matches = { +/* Having all 3 of these not set is somewhat unique */ +DMI_MATCH (DMI_SYS_VENDOR ,"To be filled by O.E.M." ), +DMI_MATCH (DMI_PRODUCT_NAME ,"To be filled by O.E.M." ), +DMI_MATCH (DMI_BOARD_NAME ,"To be filled by O.E.M." ), +/* Above strings are too generic, also match on BIOS date */ + DMI_MATCH(DMI_BIOS_DATE, "05/14/2015"), + }, + .driver_data = (void *)(ACPI_QUIRK_SKIP_I2C_CLIENTS | + ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY), + }, {/* Vexia Edu Atla 10 tablet 9V version */ .matches = {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 89/230 x86/mm/tlb: Only trim the mm_cpumask once a second
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rik van Riel <[email protected]>
[ Upstream commit 6db2526c1d694c91c6e05e2f186c085e9460f202 ]
Setting and clearing CPU bits in the mm_cpumask is only ever done by the CPU itself, from the context switch code or the TLB flush code.
Synchronization is handled by switch_mm_irqs_off() blocking interrupts.
Sending TLB flush IPIs to CPUs that are in the mm_cpumask, but no longer running the program causes a regression in the will-it-scale tlbflush2 test. This test is contrived, but a large regression here might cause a small regression in some real world workload.
Instead of always sending IPIs to CPUs that are in the mm_cpumask, but no longer running the program, send these IPIs only once a second.
The rest of the time we can skip over CPUs where the loaded_mm is different from the target mm.
--- arch/x86/include/asm/mmu.h | 2 ++ arch/x86/include/asm/mmu_context.h | 1 + arch/x86/include/asm/tlbflush.h | 1 + arch/x86/mm/tlb.c | 35 +++++++++++++++++++++++++++--- 4 files changed, 36 insertions(+), 3 deletions(-)
arch/x86/include/asm/mmu.h +2 -0
@@ -37,6 +37,8 @@ typedef struct {*/ atomic64_t tlb_gen; +unsigned long next_trim_cpumask; +#ifdef CONFIG_MODIFY_LDT_SYSCALL struct rw_semaphore ldt_usr_sem;struct ldt_struct *ldt;
arch/x86/include/asm/mmu_context.h +1 -0
@@ -151,6 +151,7 @@ static inline int init_new_context(struct task_struct *tsk, mm->context.ctx_id =atomic64_inc_return (&last_mm_ctx_id);atomic64_set (&mm->context.tlb_gen,0 ); + mm->context.next_trim_cpumask = jiffies +HZ ;#ifdef CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS if (cpu_feature_enabled (X86_FEATURE_OSPKE )) {
arch/x86/include/asm/tlbflush.h +1 -0
@@ -222,6 +222,7 @@ struct flush_tlb_info {unsigned int initiating_cpu;u8 stride_shift;u8 freed_tables; +u8 trim_cpumask; };void flush_tlb_local (void );
arch/x86/mm/tlb.c +32 -3
@@ -893,9 +893,36 @@ static void flush_tlb_func(void *info) nr_invalidate); } -static bool tlb_is_not_lazy (int cpu,void *data) +static bool should_flush_tlb (int cpu,void *data) { -return !per_cpu (cpu_tlbstate_shared.is_lazy, cpu); +struct flush_tlb_info *info = data; + +/* Lazy TLB will get flushed at the next context switch. */ +if (per_cpu (cpu_tlbstate_shared.is_lazy, cpu)) +return false; + +/* No mm means kernel memory flush. */ +if (!info->mm) +return true; + +/* The target mm is loaded, and the CPU is not lazy. */ +if (per_cpu (cpu_tlbstate.loaded_mm, cpu) == info->mm) +return true; + +/* In cpumask, but not the loaded mm? Periodically remove by flushing. */ +if (info->trim_cpumask) +return true; + +return false; +} + +static bool should_trim_cpumask (struct mm_struct *mm) +{ +if (time_after (jiffies,READ_ONCE (mm->context.next_trim_cpumask))) { +WRITE_ONCE (mm->context.next_trim_cpumask, jiffies +HZ ); +return true; + } +return false; } DEFINE_PER_CPU_SHARED_ALIGNED(struct tlb_state_shared, cpu_tlbstate_shared);
@@ -929,7 +956,7 @@ STATIC_NOPV void native_flush_tlb_multi(const struct cpumask *cpumask,if (info->freed_tables)on_each_cpu_mask (cpumask, flush_tlb_func, (void *)info, true);else -on_each_cpu_cond_mask (tlb_is_not_lazy, flush_tlb_func, +on_each_cpu_cond_mask (should_flush_tlb, flush_tlb_func, (void *)info,1 , cpumask); }
@@ -980,6 +1007,7 @@ static struct flush_tlb_info *get_flush_tlb_info(struct mm_struct *mm, info->freed_tables = freed_tables; info->new_tlb_gen = new_tlb_gen; info->initiating_cpu =smp_processor_id (); + info->trim_cpumask =0 ;return info; }
@@ -1022,6 +1050,7 @@ void flush_tlb_mm_range(struct mm_struct *mm, unsigned long start,* flush_tlb_func_local() directly in this case. */ if (cpumask_any_but (mm_cpumask (mm), cpu) < nr_cpu_ids) { + info->trim_cpumask =should_trim_cpumask (mm);flush_tlb_multi (mm_cpumask (mm), info); }else if (mm ==this_cpu_read (cpu_tlbstate.loaded_mm)) {lockdep_assert_irqs_enabled ();
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 90/230 orangefs: fix a oob in orangefs_debug_write
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Marshall <[email protected]>
[ Upstream commit f7c848431632598ff9bce57a659db6af60d75b39 ]
I got a syzbot report: slab-out-of-bounds Read in orangefs_debug_write... several people suggested fixes, I tested Al Viro's suggestion and made this patch.
--- fs/orangefs/orangefs-debugfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/orangefs/orangefs-debugfs.c +2 -2
@@ -393,9 +393,9 @@ static ssize_t orangefs_debug_write(struct file *file,* Thwart users who try to jamb a ridiculous number * of bytes into the debug file... */ -if (count >ORANGEFS_MAX_DEBUG_STRING_LEN +1 ) { +if (count >ORANGEFS_MAX_DEBUG_STRING_LEN ) { silly = count; - count =ORANGEFS_MAX_DEBUG_STRING_LEN +1 ; + count =ORANGEFS_MAX_DEBUG_STRING_LEN ; } buf =kzalloc (ORANGEFS_MAX_DEBUG_STRING_LEN ,GFP_KERNEL );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 91/230 kbuild: suppress stdout from merge_config for silent builds
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masahiro Yamada <[email protected]>
[ Upstream commit 1f937a4bcb0472015818f30f4d3c5546d3f09933 ]
merge_config does not respect the Make's -s (--silent) option.
Let's sink the stdout from merge_config for silent builds.
This commit does not cater to the direct invocation of merge_config.sh (e.g. arch/mips/Makefile).
--- scripts/Makefile.defconf | 13 +++++++------ scripts/kconfig/Makefile | 4 +++- 2 files changed, 10 insertions(+), 7 deletions(-)
scripts/Makefile.defconf +7 -6
@@ -1,6 +1,11 @@ # SPDX-License-Identifier: GPL-2.0 # Configuration heplers +cmd_merge_fragments = \ + $(srctree)/scripts/kconfig/merge_config.sh \ + $4 -m -O $(objtree) $(srctree)/arch/$(SRCARCH)/configs/$2 \ + $(foreach config,$3,$(srctree)/arch/$(SRCARCH)/configs/$(config).config) + # Creates 'merged defconfigs' # --------------------------------------------------------------------------- # Usage:
@@ -8,9 +13,7 @@ # # Input config fragments without '.config' suffix define merge_into_defconfig - $(Q)$(CONFIG_SHELL) $(srctree)/scripts/kconfig/merge_config.sh \ - -m -O $(objtree) $(srctree)/arch/$(SRCARCH)/configs/$(1) \ - $(foreach config,$(2),$(srctree)/arch/$(SRCARCH)/configs/$(config).config) + $(call cmd,merge_fragments,$1,$2) +$(Q)$(MAKE) -f $(srctree)/Makefile olddefconfig endef
@@ -22,8 +25,6 @@ endef # # Input config fragments without '.config' suffix define merge_into_defconfig_override - $(Q)$(CONFIG_SHELL) $(srctree)/scripts/kconfig/merge_config.sh \ - -Q -m -O $(objtree) $(srctree)/arch/$(SRCARCH)/configs/$(1) \ - $(foreach config,$(2),$(srctree)/arch/$(SRCARCH)/configs/$(config).config) + $(call cmd,merge_fragments,$1,$2,-Q) +$(Q)$(MAKE) -f $(srctree)/Makefile olddefconfig endef
scripts/kconfig/Makefile +3 -1
@@ -105,9 +105,11 @@ configfiles = $(wildcard $(srctree)/kernel/configs/$(1) $(srctree)/arch/$(SRCARC all-config-fragments = $(call configfiles,*.config) config-fragments = $(call configfiles,$@) +cmd_merge_fragments = $(srctree)/scripts/kconfig/merge_config.sh -m $(KCONFIG_CONFIG) $(config-fragments) + %.config: $(obj)/conf $(if $(config-fragments),, $(error $@ fragment does not exists on this architecture)) - $(Q)$(CONFIG_SHELL) $(srctree)/scripts/kconfig/merge_config.sh -m $(KCONFIG_CONFIG) $(config-fragments) + $(call cmd,merge_fragments) $(Q)$(MAKE) -f $(srctree)/Makefile olddefconfig PHONY += tinyconfig
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 92/230 ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10 tablet 5V
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 6917192378c1ce17ba31df51c4e0d8b1c97a453b ]
The Vexia EDU ATLA 10 tablet comes in 2 different versions with significantly different mainboards. The only outward difference is that the charging barrel on one is marked 5V and the other is marked 9V.
The 5V version mostly works with the BYTCR defaults, except that it is missing a CHAN package in its ACPI tables and the default of using SSP0-AIF2 is wrong, instead SSP0-AIF1 must be used. That and its jack detect signal is not inverted as it usually is.
Add a DMI quirk for the 5V version to fix sound not working.
--- sound/soc/intel/boards/bytcr_rt5640.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-)
sound/soc/intel/boards/bytcr_rt5640.c +16 -1
@@ -1132,7 +1132,22 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = {BYT_RT5640_SSP0_AIF2 | BYT_RT5640_MCLK_EN), }, - { /* Vexia Edu Atla 10 tablet */ + { +/* Vexia Edu Atla 10 tablet 5V version */ + .matches = { +/* Having all 3 of these not set is somewhat unique */ +DMI_MATCH (DMI_SYS_VENDOR ,"To be filled by O.E.M." ), +DMI_MATCH (DMI_PRODUCT_NAME ,"To be filled by O.E.M." ), +DMI_MATCH (DMI_BOARD_NAME ,"To be filled by O.E.M." ), +/* Above strings are too generic, also match on BIOS date */ + DMI_MATCH(DMI_BIOS_DATE, "05/14/2015"), + }, + .driver_data = (void *)(BYTCR_INPUT_DEFAULTS | +BYT_RT5640_JD_NOT_INV | +BYT_RT5640_SSP0_AIF1 | + BYT_RT5640_MCLK_EN), + }, + { /* Vexia Edu Atla 10 tablet 9V version */ .matches = {DMI_MATCH (DMI_BOARD_VENDOR ,"AMI Corporation" ), DMI_MATCH(DMI_BOARD_NAME, "Aptio CRB"),
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 93/230 kbuild: Use -fzero-init-padding-bits=all
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit dce4aab8441d285b9a78b33753e0bf583c1320ee ]
GCC 15 introduces a regression in "= { 0 }" style initialization of unions that Linux has depended on for eliminating uninitialized variable contents. GCC does not seem likely to fix it[1], instead suggesting[2] that affected projects start using -fzero-init-padding-bits=unions.
To avoid future surprises beyond just the current situation with unions, enable -fzero-init-padding-bits=all when available (GCC 15+). This will correctly zero padding bits in unions and structs that might have been left uninitialized, and will make sure there is no immediate regression in union initializations. As seen in the stackinit KUnit selftest union cases, which were passing before, were failing under GCC 15:
not ok 18 test_small_start_old_zero
ok 29 test_small_start_dynamic_partial # SKIP XFAIL uninit bytes: 63 ok 32 test_small_start_assigned_dynamic_partial # SKIP XFAIL uninit bytes: 63 ok 67 test_small_start_static_partial # SKIP XFAIL uninit bytes: 63 ok 70 test_small_start_static_all # SKIP XFAIL uninit bytes: 56 ok 73 test_small_start_dynamic_all # SKIP XFAIL uninit bytes: 56 ok 82 test_small_start_assigned_static_partial # SKIP XFAIL uninit bytes: 63 ok 85 test_small_start_assigned_static_all # SKIP XFAIL uninit bytes: 56 ok 88 test_small_start_assigned_dynamic_all # SKIP XFAIL uninit bytes: 56
The above all now pass again with -fzero-init-padding-bits=all added.
This also fixes the following cases for struct initialization that had been XFAIL until now because there was no compiler support beyond the larger "-ftrivial-auto-var-init=zero" option:
ok 38 test_small_hole_static_all # SKIP XFAIL uninit bytes: 3 ok 39 test_big_hole_static_all # SKIP XFAIL uninit bytes: 124 ok 40 test_trailing_hole_static_all # SKIP XFAIL uninit bytes: 7 ok 42 test_small_hole_dynamic_all # SKIP XFAIL uninit bytes: 3 ok 43 test_big_hole_dynamic_all # SKIP XFAIL uninit bytes: 124 ok 44 test_trailing_hole_dynamic_all # SKIP XFAIL uninit bytes: 7 ok 58 test_small_hole_assigned_static_all # SKIP XFAIL uninit bytes: 3 ok 59 test_big_hole_assigned_static_all # SKIP XFAIL uninit bytes: 124 ok 60 test_trailing_hole_assigned_static_all # SKIP XFAIL uninit bytes: 7 ok 62 test_small_hole_assigned_dynamic_all # SKIP XFAIL uninit bytes: 3 ok 63 test_big_hole_assigned_dynamic_all # SKIP XFAIL uninit bytes: 124 ok 64 test_trailing_hole_assigned_dynamic_all # SKIP XFAIL uninit bytes: 7
All of the above now pass when built under GCC 15. Tests can be seen with:
./tools/testing/kunit/kunit.py run stackinit --arch=x86_64 \
--make_option CC=gcc-15Clang continues to fully initialize these kinds of variables[3] without additional flags.
--- scripts/Makefile.extrawarn | 3 +++ 1 file changed, 3 insertions(+)
scripts/Makefile.extrawarn +3 -0
@@ -82,6 +82,9 @@ KBUILD_CFLAGS += $(call cc-option,-Werror=designated-init) # Warn if there is an enum types mismatch KBUILD_CFLAGS += $(call cc-option,-Wenum-conversion) +# Explicitly clear padding bits during variable initialization +KBUILD_CFLAGS += $(call cc-option,-fzero-init-padding-bits=all) + KBUILD_CFLAGS += -Wextra KBUILD_CFLAGS += -Wunused
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 94/230 batman-adv: fix panic during interface removal
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Strohman <[email protected]>
commit ccb7276a6d26d6f8416e315b43b45e15ee7f29e2 upstream.
Reference counting is used to ensure that batadv_hardif_neigh_node and batadv_hard_iface are not freed before/during batadv_v_elp_throughput_metric_update work is finished.
But there isn't a guarantee that the hard if will remain associated with a soft interface up until the work is finished.
This fixes a crash triggered by reboot that looks like this:
Call trace: batadv_v_mesh_free+0xd0/0x4dc [batman_adv] batadv_v_elp_throughput_metric_update+0x1c/0xa4 process_one_work+0x178/0x398 worker_thread+0x2e8/0x4d0 kthread+0xd8/0xdc ret_from_fork+0x10/0x20
(the batadv_v_mesh_free call is misleading,
and does not actually happen)
I was able to make the issue happen more reliably by changing hardif_neigh->bat_v.metric_work work to be delayed work. This allowed me to track down and confirm the fix.
[[email protected]: prevent entering batadv_v_elp_get_throughput without
soft_iface]
--- net/batman-adv/bat_v_elp.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
net/batman-adv/bat_v_elp.c +8 -1
@@ -66,12 +66,19 @@ static void batadv_v_elp_start_timer(strstatic u32 batadv_v_elp_get_throughput (struct batadv_hardif_neigh_node *neigh) {struct batadv_hard_iface *hard_iface = neigh->if_incoming; +struct net_device *soft_iface = hard_iface->soft_iface;struct ethtool_link_ksettings link_settings;struct net_device *real_netdev;struct station_info sinfo;u32 throughput;int ret; +/* don't query throughput when no longer associated with any +* batman-adv interface +*/ +if (!soft_iface) +return BATADV_THROUGHPUT_DEFAULT_VALUE ; +/* if the user specified a customised value for this interface, then * return it directly */
@@ -141,7 +148,7 @@ static u32 batadv_v_elp_get_throughput(s default_throughput:if (!(hard_iface->bat_v.flags &BATADV_WARNING_DEFAULT )) { - batadv_info(hard_iface->soft_iface, + batadv_info(soft_iface, "WiFi driver or ethtool info does not provide information about link speeds on interface %s, therefore defaulting to hardcoded throughput values of %u.%1u Mbps. Consider overriding the throughput manually or checking your driver.\n", hard_iface->net_dev->name, BATADV_THROUGHPUT_DEFAULT_VALUE / 10,
Greg Kroah-Hartman
maintainerPATCH 95/230 batman-adv: Ignore neighbor throughput metrics in error case
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <[email protected]>
commit e7e34ffc976aaae4f465b7898303241b81ceefc3 upstream.
If a temporary error happened in the evaluation of the neighbor throughput information, then the invalid throughput result should not be stored in the throughtput EWMA.
--- net/batman-adv/bat_v_elp.c | 50 ++++++++++++++++++++++++++++++--------------- 1 file changed, 34 insertions(+), 16 deletions(-)
net/batman-adv/bat_v_elp.c +34 -16
@@ -59,11 +59,13 @@ static void batadv_v_elp_start_timer(str/** * batadv_v_elp_get_throughput() - get the throughput towards a neighbour * @neigh: the neighbour for which the throughput has to be obtained +* @pthroughput: calculated throughput towards the given neighbour in multiples +* of 100kpbs (a value of '1' equals 0.1Mbps, '10' equals 1Mbps, etc). * -* Return: The throughput towards the given neighbour in multiples of 100kpbs -* (a value of '1' equals 0.1Mbps, '10' equals 1Mbps, etc). +* Return: true when value behind @pthroughput was set */ -static u32 batadv_v_elp_get_throughput (struct batadv_hardif_neigh_node *neigh) +static bool batadv_v_elp_get_throughput (struct batadv_hardif_neigh_node *neigh, +u32 *pthroughput) {struct batadv_hard_iface *hard_iface = neigh->if_incoming;struct net_device *soft_iface = hard_iface->soft_iface;
@@ -77,14 +79,16 @@ static u32 batadv_v_elp_get_throughput(s* batman-adv interface */ if (!soft_iface) -return BATADV_THROUGHPUT_DEFAULT_VALUE ; +return false;/* if the user specified a customised value for this interface, then * return it directly */ throughput =atomic_read (&hard_iface->bat_v.throughput_override); -if (throughput !=0 ) -return throughput; +if (throughput !=0 ) { + *pthroughput = throughput; +return true; + }/* if this is a wireless device, then ask its throughput through * cfg80211 API
@@ -111,19 +115,24 @@ static u32 batadv_v_elp_get_throughput(s* possible to delete this neighbor. For now set * the throughput metric to 0. */ -return 0 ; + *pthroughput =0 ; +return true; }if (ret) goto default_throughput; -if (sinfo.filled &BIT (NL80211_STA_INFO_EXPECTED_THROUGHPUT )) -return sinfo.expected_throughput /100 ; +if (sinfo.filled &BIT (NL80211_STA_INFO_EXPECTED_THROUGHPUT )) { + *pthroughput = sinfo.expected_throughput /100 ; +return true; + }/* try to estimate the expected throughput based on reported tx * rates */ -if (sinfo.filled &BIT (NL80211_STA_INFO_TX_BITRATE )) -return cfg80211_calculate_bitrate (&sinfo.txrate) /3 ; +if (sinfo.filled &BIT (NL80211_STA_INFO_TX_BITRATE )) { + *pthroughput =cfg80211_calculate_bitrate (&sinfo.txrate) /3 ; +return true; + } goto default_throughput; }
@@ -142,8 +151,10 @@ static u32 batadv_v_elp_get_throughput(s hard_iface->bat_v.flags &= ~BATADV_FULL_DUPLEX ; throughput = link_settings.base.speed; -if (throughput && throughput !=SPEED_UNKNOWN ) -return throughput *10 ; +if (throughput && throughput !=SPEED_UNKNOWN ) { + *pthroughput = throughput *10 ; +return true; + } } default_throughput:
@@ -157,7 +168,8 @@ default_throughput: }/* if none of the above cases apply, return the base_throughput */ -return BATADV_THROUGHPUT_DEFAULT_VALUE ; + *pthroughput =BATADV_THROUGHPUT_DEFAULT_VALUE ; +return true; }/**
@@ -169,15 +181,21 @@ void batadv_v_elp_throughput_metric_upda {struct batadv_hardif_neigh_node_bat_v *neigh_bat_v;struct batadv_hardif_neigh_node *neigh; +u32 throughput; +bool valid; neigh_bat_v = container_of(work, struct batadv_hardif_neigh_node_bat_v, metric_work); neigh = container_of(neigh_bat_v, struct batadv_hardif_neigh_node, bat_v); -ewma_throughput_add (&neigh->bat_v.throughput, -batadv_v_elp_get_throughput (neigh)); + valid =batadv_v_elp_get_throughput (neigh, &throughput); +if (!valid) + goto put_neigh; + +ewma_throughput_add (&neigh->bat_v.throughput, throughput); +put_neigh:/* decrement refcounter to balance increment performed before scheduling * this task */
Greg Kroah-Hartman
maintainerPATCH 96/230 batman-adv: Drop unmanaged ELP metric worker
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <[email protected]>
commit 8c8ecc98f5c65947b0070a24bac11e12e47cc65d upstream.
The ELP worker needs to calculate new metric values for all neighbors "reachable" over an interface. Some of the used metric sources require locks which might need to sleep. This sleep is incompatible with the RCU list iterator used for the recorded neighbors. The initial approach to work around of this problem was to queue another work item per neighbor and then run this in a new context.
Even when this solved the RCU vs might_sleep() conflict, it has a major
problems: Nothing was stopping the work item in case it is not needed anymore - for example because one of the related interfaces was removed or the batman-adv module was unloaded - resulting in potential invalid memory accesses.
Directly canceling the metric worker also has various problems:
* cancel_work_sync for a to-be-deactivated interface is called with rtnl_lock held. But the code in the ELP metric worker also tries to use rtnl_lock() - which will never return in this case. This also means that cancel_work_sync would never return because it is waiting for the worker to finish.
* iterating over the neighbor list for the to-be-deactivated interface is currently done using the RCU specific methods. Which means that it is possible to miss items when iterating over it without the associated spinlock - a behaviour which is acceptable for a periodic metric check but not for a cleanup routine (which must "stop" all still running workers)
The better approch is to get rid of the per interface neighbor metric worker and handle everything in the interface worker. The original problems are solved by:
* creating a list of neighbors which require new metric information inside the RCU protected context, gathering the metric according to the new list outside the RCU protected context
* only use rcu_trylock inside metric gathering code to avoid a deadlock when the cancel_delayed_work_sync is called in the interface removal code (which is called with the rtnl_lock held)
--- net/batman-adv/bat_v.c | 2 - net/batman-adv/bat_v_elp.c | 71 ++++++++++++++++++++++++++++++--------------- net/batman-adv/bat_v_elp.h | 2 - net/batman-adv/types.h | 3 - 4 files changed, 48 insertions(+), 30 deletions(-)
net/batman-adv/bat_v.c +0 -2
@@ -113,8 +113,6 @@ static void batadv_v_hardif_neigh_init(struct batadv_hardif_neigh_node *hardif_neigh) {ewma_throughput_init (&hardif_neigh->bat_v.throughput); -INIT_WORK (&hardif_neigh->bat_v.metric_work, - batadv_v_elp_throughput_metric_update); }/**
net/batman-adv/bat_v_elp.c +48 -23
143 lines not on this page · raw message
net/batman-adv/bat_v_elp.h +0 -2
@@ -10,7 +10,6 @@#include "main.h" #include <linux/skbuff.h> -#include <linux/workqueue.h> int batadv_v_elp_iface_enable (struct batadv_hard_iface *hard_iface);void batadv_v_elp_iface_disable (struct batadv_hard_iface *hard_iface);
@@ -19,6 +18,5 @@ void batadv_v_elp_iface_activate(structvoid batadv_v_elp_primary_iface_set (struct batadv_hard_iface *primary_iface);int batadv_v_elp_packet_recv (struct sk_buff *skb,struct batadv_hard_iface *if_incoming); -void batadv_v_elp_throughput_metric_update (struct work_struct *work);#endif /* _NET_BATMAN_ADV_BAT_V_ELP_H_ */
net/batman-adv/types.h +0 -3
@@ -596,9 +596,6 @@ struct batadv_hardif_neigh_node_bat_v {* neighbor */ unsigned long last_unicast_tx; - -/** @metric_work: work queue callback item for metric update */ -struct work_struct metric_work; };/**
Greg Kroah-Hartman
maintainerPATCH 97/230 drm/amdgpu/gfx9: manually control gfxoff for CS on RV
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit b35eb9128ebeec534eed1cefd6b9b1b7282cf5ba upstream.
When mesa started using compute queues more often we started seeing additional hangs with compute queues. Disabling gfxoff seems to mitigate that. Manually control gfxoff and gfx pg with command submissions to avoid any issues related to gfxoff. KFD already does the same thing for these chips.
v2: limit to compute
v3: limit to APUs
v4: limit to Raven/PCO
v5: only update the compute ring_funcs
v6: Disable GFX PG
v7: adjust order
--- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 36 ++++++++++++++++++++++++++++++++-- 1 file changed, 34 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +34 -2
@@ -7415,6 +7415,38 @@ static void gfx_v9_0_ring_emit_cleaner_samdgpu_ring_write (ring,0 );/* RESERVED field, programmed to zero */ } +static void gfx_v9_0_ring_begin_use_compute (struct amdgpu_ring *ring) +{ +struct amdgpu_device *adev = ring->adev; +struct amdgpu_ip_block *gfx_block = +amdgpu_device_ip_get_ip_block (adev,AMD_IP_BLOCK_TYPE_GFX ); + +amdgpu_gfx_enforce_isolation_ring_begin_use (ring); + +/* Raven and PCO APUs seem to have stability issues +* with compute and gfxoff and gfx pg. Disable gfx pg during +* submission and allow again afterwards. +*/ +if (gfx_block &&amdgpu_ip_version (adev,GC_HWIP ,0 ) ==IP_VERSION (9 ,1 ,0 )) +gfx_v9_0_set_powergating_state (gfx_block,AMD_PG_STATE_UNGATE ); +} + +static void gfx_v9_0_ring_end_use_compute (struct amdgpu_ring *ring) +{ +struct amdgpu_device *adev = ring->adev; +struct amdgpu_ip_block *gfx_block = +amdgpu_device_ip_get_ip_block (adev,AMD_IP_BLOCK_TYPE_GFX ); + +/* Raven and PCO APUs seem to have stability issues +* with compute and gfxoff and gfx pg. Disable gfx pg during +* submission and allow again afterwards. +*/ +if (gfx_block &&amdgpu_ip_version (adev,GC_HWIP ,0 ) ==IP_VERSION (9 ,1 ,0 )) +gfx_v9_0_set_powergating_state (gfx_block,AMD_PG_STATE_GATE ); + +amdgpu_gfx_enforce_isolation_ring_end_use (ring); +} +static const struct amd_ip_funcs gfx_v9_0_ip_funcs = { .name ="gfx_v9_0" , .early_init = gfx_v9_0_early_init,
@@ -7591,8 +7623,8 @@ static const struct amdgpu_ring_funcs gf .emit_wave_limit = gfx_v9_0_emit_wave_limit, .reset = gfx_v9_0_reset_kcq, .emit_cleaner_shader = gfx_v9_0_ring_emit_cleaner_shader, - .begin_use = amdgpu_gfx_enforce_isolation_ring_begin_use, - .end_use = amdgpu_gfx_enforce_isolation_ring_end_use, + .begin_use = gfx_v9_0_ring_begin_use_compute, + .end_use = gfx_v9_0_ring_end_use_compute, };static const struct amdgpu_ring_funcs gfx_v9_0_ring_funcs_kiq = {
Re: [PATCH 6.12 097/230] drm/amdgpu/gfx9: manually control gfxoff for CS on RV
This patch has to be changed for 6.12 - "gfx_v9_0_set_powergating_state" has 'amdgpu_device' argument instead of 'amdgpu_ip_block' argument there.
Quoted 88 lines · Greg Kroah-Hartman
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit
b35eb9128ebeec534eed1cefd6b9b1b7282cf5baupstream.When mesa started using compute queues more often we started seeing additional hangs with compute queues. Disabling gfxoff seems to mitigate that. Manually control gfxoff and gfx pg with command submissions to avoid any issues related to gfxoff. KFD already does the same thing for these chips.
v2: limit to compute
v3: limit to APUs
v4: limit to Raven/PCO
v5: only update the computering_funcs
v6: Disable GFX PG
v7: adjust orderReviewed-by Lijo Lazar <[email protected]>Suggested-by Błażej Szczygieł <[email protected]>Suggested-by Sergey Kovalenko <[email protected]>Signed-off-by Alex Deucher <[email protected]>Cc [email protected] # 6.12.xSigned-off-by Greg Kroah-Hartman <[email protected]>--- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 36 ++++++++++++++++++++++++++++++++-- 1 file changed, 34 insertions(+), 2 deletions(-)drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +34
-2@@ -7415,6 +7415,38 @@ static void gfx_v9_0_ring_emit_cleaner_samdgpu_ring_write (ring,0 );/* RESERVED field, programmed to zero */ } +static void gfx_v9_0_ring_begin_use_compute (struct amdgpu_ring *ring) +{ +struct amdgpu_device *adev = ring->adev; +struct amdgpu_ip_block *gfx_block = +amdgpu_device_ip_get_ip_block (adev,AMD_IP_BLOCK_TYPE_GFX ); + +amdgpu_gfx_enforce_isolation_ring_begin_use (ring); + +/* Raven and PCO APUs seem to have stability issues +* with compute and gfxoff and gfx pg. Disable gfx pg during +* submission and allow again afterwards. +*/ +if (gfx_block &&amdgpu_ip_version (adev,GC_HWIP ,0 ) ==IP_VERSION (9 ,1 ,0 )) +gfx_v9_0_set_powergating_state (gfx_block,AMD_PG_STATE_UNGATE ); +} + +static void gfx_v9_0_ring_end_use_compute (struct amdgpu_ring *ring) +{ +struct amdgpu_device *adev = ring->adev; +struct amdgpu_ip_block *gfx_block = +amdgpu_device_ip_get_ip_block (adev,AMD_IP_BLOCK_TYPE_GFX ); + +/* Raven and PCO APUs seem to have stability issues +* with compute and gfxoff and gfx pg. Disable gfx pg during +* submission and allow again afterwards. +*/ +if (gfx_block &&amdgpu_ip_version (adev,GC_HWIP ,0 ) ==IP_VERSION (9 ,1 ,0 )) +gfx_v9_0_set_powergating_state (gfx_block,AMD_PG_STATE_GATE ); + +amdgpu_gfx_enforce_isolation_ring_end_use (ring); +} +static const struct amd_ip_funcs gfx_v9_0_ip_funcs = { .name ="gfx_v9_0" , .early_init = gfx_v9_0_early_init,@@ -7591,8 +7623,8 @@ static const struct amdgpu_ring_funcs gf .emit_wave_limit = gfx_v9_0_emit_wave_limit, .reset = gfx_v9_0_reset_kcq, .emit_cleaner_shader = gfx_v9_0_ring_emit_cleaner_shader, - .begin_use = amdgpu_gfx_enforce_isolation_ring_begin_use, - .end_use = amdgpu_gfx_enforce_isolation_ring_end_use, + .begin_use = gfx_v9_0_ring_begin_use_compute, + .end_use = gfx_v9_0_ring_end_use_compute, };static const struct amdgpu_ring_funcs gfx_v9_0_ring_funcs_kiq = {
RE: [PATCH 6.12 097/230] drm/amdgpu/gfx9: manually control gfxoff for CS on RV
In reply to Greg Kroah-Hartman[Public]
Quoted 11 lines
-----Original Message-----
From: Greg Kroah-Hartman <[email protected]>
Sent: Wednesday, February 19, 2025 3:27 AM
To: [email protected]
Cc: Greg Kroah-Hartman <[email protected]>; [email protected]; Lazar, Lijo <[email protected]>; Błażej Szczygieł <[email protected]>; Sergey Kovalenko <[email protected]>; Deucher, Alexander <[email protected]>
Subject: [PATCH 6.12 097/230] drm/amdgpu/gfx9: manually control gfxoff for CS on RV
Quoted 1 line
6.12-stable review patch. If anyone has any objections, please let me know.
Please drop this one as well. I just sent a proper backport for 6.13 and 6.12.
Alex
Quoted 88 lines
------------------
From: Alex Deucher <[email protected]>
commit
b35eb9128ebeec534eed1cefd6b9b1b7282cf5baupstream.When mesa started using compute queues more often we started seeing additional hangs with compute queues.
Disabling gfxoff seems to mitigate that. Manually control gfxoff and gfx pg with command submissions to avoid any issues related to gfxoff. KFD already does the same thing for these chips.v2: limit to compute
v3: limit to APUs
v4: limit to Raven/PCO
v5: only update the computering_funcs
v6: Disable GFX PG
v7: adjust orderReviewed-by Lijo Lazar <[email protected]>Suggested-by Błażej Szczygieł <[email protected]>Suggested-by Sergey Kovalenko <[email protected]>Signed-off-by Alex Deucher <[email protected]>Cc [email protected] # 6.12.xSigned-off-by Greg Kroah-Hartman <[email protected]>--- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 36 ++++++++++++++++++++++++++++++++-- 1 file changed, 34 insertions(+), 2 deletions(-)drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +24
-0@@ -7415,6 +7415,38 @@ static void gfx_v9_0_ring_emit_cleaner_samdgpu_ring_write (ring,0 );/* RESERVED field, programmed to zero */ } +static void gfx_v9_0_ring_begin_use_compute (struct amdgpu_ring *ring) { +struct amdgpu_device *adev = ring->adev; +struct amdgpu_ip_block *gfx_block = +amdgpu_device_ip_get_ip_block (adev,AMD_IP_BLOCK_TYPE_GFX ); + +amdgpu_gfx_enforce_isolation_ring_begin_use (ring); + +/* Raven and PCO APUs seem to have stability issues +* with compute and gfxoff and gfx pg. Disable gfx pg during +* submission and allow again afterwards. +*/ +if (gfx_block &&amdgpu_ip_version (adev,GC_HWIP ,0 ) ==IP_VERSION (9 ,1 ,0 )) +gfx_v9_0_set_powergating_state (gfx_block,AMD_PG_STATE_UNGATE ); } + +static void gfx_v9_0_ring_end_use_compute(struct amdgpu_ring *ring) { + struct amdgpu_device *adev = ring->adev; + struct amdgpu_ip_block *gfx_block = + amdgpu_device_ip_get_ip_block(adev, AMD_IP_BLOCK_TYPE_GFX); + + /* Raven and PCO APUs seem to have stability issues + * with compute and gfxoff and gfx pg. Disable gfx pg during + * submission and allow again afterwards. + */ + if (gfx_block && amdgpu_ip_version(adev, GC_HWIP, 0) ==
IP_VERSION(9, 1, 0))
+ gfx_v9_0_set_powergating_state(gfx_block,AMD_PG_STATE_GATE);drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +6
-2+ +amdgpu_gfx_enforce_isolation_ring_end_use (ring); +} +static const struct amd_ip_funcs gfx_v9_0_ip_funcs = { .name ="gfx_v9_0" , .early_init = gfx_v9_0_early_init,@@ -7591,8 +7623,8 @@ static const struct amdgpu_ring_funcs gf .emit_wave_limit = gfx_v9_0_emit_wave_limit, .reset = gfx_v9_0_reset_kcq, .emit_cleaner_shader = gfx_v9_0_ring_emit_cleaner_shader, - .begin_use = amdgpu_gfx_enforce_isolation_ring_begin_use, - .end_use = amdgpu_gfx_enforce_isolation_ring_end_use, + .begin_use = gfx_v9_0_ring_begin_use_compute, + .end_use = gfx_v9_0_ring_end_use_compute, };static const struct amdgpu_ring_funcs gfx_v9_0_ring_funcs_kiq = {
Greg Kroah-Hartman
maintainerPATCH 98/230 drm/amdgpu: bump version for RV/PCO compute fix
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 55ed2b1b50d029dd7e49a35f6628ca64db6d75d8 upstream.
Bump the driver version for RV/PCO compute stability fix so mesa can use this check to enable compute queues on RV/PCO.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +2 -1
@@ -119,9 +119,10 @@* - 3.58.0 - Add GFX12 DCC support * - 3.59.0 - Cleared VRAM * - 3.60.0 - Add AMDGPU_TILING_GFX12_DCC_WRITE_COMPRESS_DISABLE (Vulkan requirement) +* - 3.61.0 - Contains fix for RV/PCO compute queues */ #define KMS_DRIVER_MAJOR 3 -#define KMS_DRIVER_MINOR 60 +#define KMS_DRIVER_MINOR 61#define KMS_DRIVER_PATCHLEVEL 0/*
RE: [PATCH 6.12 098/230] drm/amdgpu: bump version for RV/PCO compute fix
[Public]
Quoted 11 lines
-----Original Message-----
From: Greg Kroah-Hartman <[email protected]>
Sent: Wednesday, February 19, 2025 3:27 AM
To: [email protected]
Cc: Greg Kroah-Hartman <[email protected]>; [email protected]; Lazar, Lijo <[email protected]>; Deucher, Alexander <[email protected]>
Subject: [PATCH 6.12 098/230] drm/amdgpu: bump version for RV/PCO compute fix6.12-stable review patch. If anyone has any objections, please let me know.
Please drop this one from all stable trees. It has a dependency on another patch that was dropped due to needing a stable specific backport. I'll include it with the backport.
Alex
Quoted 35 lines
------------------
From: Alex Deucher <[email protected]>
commit
55ed2b1b50d029dd7e49a35f6628ca64db6d75d8upstream.Bump the driver version for RV/PCO compute stability fix so mesa can use this check to enable compute queues on RV/PCO.
Reviewed-by Lijo Lazar <[email protected]>Signed-off-by Alex Deucher <[email protected]>Cc [email protected] # 6.12.xSigned-off-by Greg Kroah-Hartman <[email protected]>--- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +0
-0@@ -119,9 +119,10 @@* - 3.58.0 - Add GFX12 DCC support * - 3.59.0 - Cleared VRAM * - 3.60.0 - Add
AMDGPU_TILING_GFX12_DCC_WRITE_COMPRESS_DISABLE(Vulkan requirement)
+ * - 3.61.0 - Contains fix for RV/PCO compute queues */
#defineKMS_DRIVER_MAJOR3drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +1
-1-#define KMS_DRIVER_MINOR 60 +#define KMS_DRIVER_MINOR 61#define KMS_DRIVER_PATCHLEVEL 0/*
Greg Kroah-Hartman
maintainerPATCH 99/230 drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiang Liu <[email protected]>
commit 1abb2648698bf10783d2236a6b4a7ca5e8021699 upstream.
It malicious user provides a small pptable through sysfs and then a bigger pptable, it may cause buffer overflow attack in function smu_sys_set_pp_table().
--- drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c +2 -1
@@ -607,7 +607,8 @@ static int smu_sys_set_pp_table(void *hareturn -EIO ; } -if (!smu_table->hardcode_pptable) { +if (!smu_table->hardcode_pptable || smu_table->power_play_table_size < size) { +kfree (smu_table->hardcode_pptable); smu_table->hardcode_pptable =kzalloc (size,GFP_KERNEL );if (!smu_table->hardcode_pptable)return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 100/230 KVM: x86: Reject Hyper-Vs SEND_IPI hypercalls if local APIC isnt in-kernel
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit a8de7f100bb5989d9c3627d3a223ee1c863f3b69 upstream.
Advertise support for Hyper-V's SEND_IPI and SEND_IPI_EX hypercalls if and only if the local API is emulated/virtualized by KVM, and explicitly reject said hypercalls if the local APIC is emulated in userspace, i.e. don't rely on userspace to opt-in to KVM_CAP_HYPERV_ENFORCE_CPUID.
Rejecting SEND_IPI and SEND_IPI_EX fixes a NULL-pointer dereference if Hyper-V enlightenments are exposed to the guest without an in-kernel local APIC:
dump_stack+0xbe/0xfd __kasan_report.cold+0x34/0x84 kasan_report+0x3a/0x50 __apic_accept_irq+0x3a/0x5c0 kvm_hv_send_ipi.isra.0+0x34e/0x820 kvm_hv_hypercall+0x8d9/0x9d0 kvm_emulate_hypercall+0x506/0x7e0 __vmx_handle_exit+0x283/0xb60 vmx_handle_exit+0x1d/0xd0 vcpu_enter_guest+0x16b0/0x24c0 vcpu_run+0xc0/0x550 kvm_arch_vcpu_ioctl_run+0x170/0x6d0 kvm_vcpu_ioctl+0x413/0xb20 __se_sys_ioctl+0x111/0x160 do_syscal1_64+0x30/0x40 entry_SYSCALL_64_after_hwframe+0x67/0xd1
Note, checking the sending vCPU is sufficient, as the per-VM irqchip_mode can't be modified after vCPUs are created, i.e. if one vCPU has an in-kernel local APIC, then all vCPUs have an in-kernel local APIC.
--- arch/x86/kvm/hyperv.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
arch/x86/kvm/hyperv.c +5 -1
@@ -2226,6 +2226,9 @@ static u64 kvm_hv_send_ipi(struct kvm_vcu32 vector;bool all_cpus; +if (!lapic_in_kernel (vcpu)) +return HV_STATUS_INVALID_HYPERCALL_INPUT ; +if (hc->code ==HVCALL_SEND_IPI ) {if (!hc->fast) { if (unlikely(kvm_read_guest(kvm, hc->ingpa, &send_ipi,
@@ -2852,7 +2855,8 @@ int kvm_get_hv_cpuid(struct kvm_vcpu *vc ent->eax |=HV_X64_REMOTE_TLB_FLUSH_RECOMMENDED ; ent->eax |=HV_X64_APIC_ACCESS_RECOMMENDED ; ent->eax |=HV_X64_RELAXED_TIMING_RECOMMENDED ; - ent->eax |=HV_X64_CLUSTER_IPI_RECOMMENDED ; +if (!vcpu ||lapic_in_kernel (vcpu)) + ent->eax |=HV_X64_CLUSTER_IPI_RECOMMENDED ; ent->eax |=HV_X64_EX_PROCESSOR_MASKS_RECOMMENDED ;if (evmcs_ver) ent->eax |=HV_X64_ENLIGHTENED_VMCS_RECOMMENDED ;
Greg Kroah-Hartman
maintainerPATCH 101/230 KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit c2fee09fc167c74a64adb08656cb993ea475197e upstream.
Move the conditional loading of hardware DR6 with the guest's DR6 value out of the core .vcpu_run() loop to fix a bug where KVM can load hardware with a stale vcpu->arch.dr6.
When the guest accesses a DR and host userspace isn't debugging the guest, KVM disables DR interception and loads the guest's values into hardware on VM-Enter and saves them on VM-Exit. This allows the guest to access DRs at will, e.g. so that a sequence of DR accesses to configure a breakpoint only generates one VM-Exit.
For DR0-DR3, the logic/behavior is identical between VMX and SVM, and also identical between KVM_DEBUGREG_BP_ENABLED (userspace debugging the guest) and KVM_DEBUGREG_WONT_EXIT (guest using DRs), and so KVM handles loading DR0-DR3 in common code, _outside_ of the core kvm_x86_ops.vcpu_run() loop.
But for DR6, the guest's value doesn't need to be loaded into hardware for KVM_DEBUGREG_BP_ENABLED, and SVM provides a dedicated VMCB field whereas VMX requires software to manually load the guest value, and so loading the guest's value into DR6 is handled by {svm,vmx}_vcpu_run(), i.e. is done _inside_ the core run loop.
Unfortunately, saving the guest values on VM-Exit is initiated by common x86, again outside of the core run loop. If the guest modifies DR6 (in hardware, when DR interception is disabled), and then the next VM-Exit is a fastpath VM-Exit, KVM will reload hardware DR6 with vcpu->arch.dr6 and clobber the guest's actual value.
The bug shows up primarily with nested VMX because KVM handles the VMX preemption timer in the fastpath, and the window between hardware DR6 being modified (in guest context) and DR6 being read by guest software is orders of magnitude larger in a nested setup. E.g. in non-nested, the VMX preemption timer would need to fire precisely between #DB injection and the #DB handler's read of DR6, whereas with a KVM-on-KVM setup, the window where hardware DR6 is "dirty" extends all the way from L1 writing DR6 to VMRESUME (in L1).
L1's view:
==========
<L1 disables DR interception>
CPU 0/KVM-7289 [023] d.... 2925.640961: kvm_entry: vcpu 0
A: L1 Writes DR6
CPU 0/KVM-7289 [023] d.... 2925.640963: <hack>: Set DRs, DR6 = 0xffff0ff1 B: CPU 0/KVM-7289 [023] d.... 2925.640967: kvm_exit: vcpu 0 reason EXTERNAL_INTERRUPT intr_info 0x800000ec
D: L1 reads DR6, arch.dr6 = 0
CPU 0/KVM-7289 [023] d.... 2925.640969: <hack>: Sync DRs, DR6 = 0xffff0ff0
CPU 0/KVM-7289 [023] d.... 2925.640976: kvm_entry: vcpu 0
L2 reads DR6, L1 disables DR interception
CPU 0/KVM-7289 [023] d.... 2925.640980: kvm_exit: vcpu 0 reason DR_ACCESS info1 0x0000000000000216
CPU 0/KVM-7289 [023] d.... 2925.640983: kvm_entry: vcpu 0
CPU 0/KVM-7289 [023] d.... 2925.640983: <hack>: Set DRs, DR6 = 0xffff0ff0
L2 detects failure
CPU 0/KVM-7289 [023] d.... 2925.640987: kvm_exit: vcpu 0 reason HLT
L1 reads DR6 (confirms failure)
CPU 0/KVM-7289 [023] d.... 2925.640990: <hack>: Sync DRs, DR6 = 0xffff0ff0
L0's view:
==========
L2 reads DR6, arch.dr6 = 0
CPU 23/KVM-5046 [001] d.... 3410.005610: kvm_exit: vcpu 23 reason DR_ACCESS info1 0x0000000000000216
CPU 23/KVM-5046 [001] ..... 3410.005610: kvm_nested_vmexit: vcpu 23 reason DR_ACCESS info1 0x0000000000000216
L2 => L1 nested VM-Exit
CPU 23/KVM-5046 [001] ..... 3410.005610: kvm_nested_vmexit_inject: reason: DR_ACCESS ext_inf1: 0x0000000000000216
CPU 23/KVM-5046 [001] d.... 3410.005610: kvm_entry: vcpu 23
CPU 23/KVM-5046 [001] d.... 3410.005611: kvm_exit: vcpu 23 reason VMREAD
CPU 23/KVM-5046 [001] d.... 3410.005611: kvm_entry: vcpu 23
CPU 23/KVM-5046 [001] d.... 3410.005612: kvm_exit: vcpu 23 reason VMREAD
CPU 23/KVM-5046 [001] d.... 3410.005612: kvm_entry: vcpu 23
L1 writes DR7, L0 disables DR interception
CPU 23/KVM-5046 [001] d.... 3410.005612: kvm_exit: vcpu 23 reason DR_ACCESS info1 0x0000000000000007
CPU 23/KVM-5046 [001] d.... 3410.005613: kvm_entry: vcpu 23
L0 writes DR6 = 0 (arch.dr6)
CPU 23/KVM-5046 [001] d.... 3410.005613: <hack>: Set DRs, DR6 = 0xffff0ff0A: <L1 writes DR6 = 1, no interception, arch.dr6 is still '0'>
B: CPU 23/KVM-5046 [001] d.... 3410.005614: kvm_exit: vcpu 23 reason PREEMPTION_TIMER
CPU 23/KVM-5046 [001] d.... 3410.005614: kvm_entry: vcpu 23C: L0 writes DR6 = 0 (arch.dr6)
CPU 23/KVM-5046 [001] d.... 3410.005614: <hack>: Set DRs, DR6 = 0xffff0ff0
L1 => L2 nested VM-Enter
CPU 23/KVM-5046 [001] d.... 3410.005616: kvm_exit: vcpu 23 reason VMRESUME
L0 reads DR6, arch.dr6 = 0--- arch/x86/include/asm/kvm-x86-ops.h | 1 + arch/x86/include/asm/kvm_host.h | 1 + arch/x86/kvm/svm/svm.c | 13 ++++++------- arch/x86/kvm/vmx/main.c | 1 + arch/x86/kvm/vmx/vmx.c | 10 ++++++---- arch/x86/kvm/vmx/x86_ops.h | 1 + arch/x86/kvm/x86.c | 3 +++ 7 files changed, 19 insertions(+), 11 deletions(-)
arch/x86/include/asm/kvm-x86-ops.h +1 -0
@@ -47,6 +47,7 @@ KVM_X86_OP(set_idt) KVM_X86_OP(get_gdt) KVM_X86_OP(set_gdt) KVM_X86_OP(sync_dirty_debug_regs) +KVM_X86_OP(set_dr6) KVM_X86_OP(set_dr7) KVM_X86_OP(cache_reg) KVM_X86_OP(get_rflags)
arch/x86/include/asm/kvm_host.h +1 -0
@@ -1674,6 +1674,7 @@ struct kvm_x86_ops {void (*get_gdt)(struct kvm_vcpu *vcpu,struct desc_ptr *dt);void (*set_gdt)(struct kvm_vcpu *vcpu,struct desc_ptr *dt);void (*sync_dirty_debug_regs)(struct kvm_vcpu *vcpu); +void (*set_dr6)(struct kvm_vcpu *vcpu,unsigned long value);void (*set_dr7)(struct kvm_vcpu *vcpu,unsigned long value);void (*cache_reg)(struct kvm_vcpu *vcpu,enum kvm_reg reg);unsigned long (*get_rflags)(struct kvm_vcpu *vcpu);
arch/x86/kvm/svm/svm.c +6 -7
@@ -1993,11 +1993,11 @@ static void new_asid(struct vcpu_svm *sv svm->asid = sd->next_asid++; } -static void svm_set_dr6 (struct vcpu_svm *svm,unsigned long value) +static void svm_set_dr6 (struct kvm_vcpu *vcpu,unsigned long value) { -struct vmcb *vmcb = svm->vmcb; +struct vmcb *vmcb =to_svm (vcpu)->vmcb; -if (svm->vcpu.arch.guest_state_protected) +if (vcpu->arch.guest_state_protected)return ;if (unlikely (value != vmcb->save.dr6)) {
@@ -4234,10 +4234,8 @@ static __no_kcsan fastpath_t svm_vcpu_ru* Run with all-zero DR6 unless needed, so that we can get the exact cause * of a #DB. */ -if (unlikely (vcpu->arch.switch_db_regs &KVM_DEBUGREG_WONT_EXIT )) -svm_set_dr6 (svm, vcpu->arch.dr6); -else -svm_set_dr6 (svm,DR6_ACTIVE_LOW ); +if (likely (!(vcpu->arch.switch_db_regs &KVM_DEBUGREG_WONT_EXIT ))) +svm_set_dr6 (vcpu,DR6_ACTIVE_LOW );clgi ();kvm_load_guest_xsave_state (vcpu);
@@ -5033,6 +5031,7 @@ static struct kvm_x86_ops svm_x86_ops __ .set_idt = svm_set_idt, .get_gdt = svm_get_gdt, .set_gdt = svm_set_gdt, + .set_dr6 = svm_set_dr6, .set_dr7 = svm_set_dr7, .sync_dirty_debug_regs = svm_sync_dirty_debug_regs, .cache_reg = svm_cache_reg,
arch/x86/kvm/vmx/main.c +1 -0
@@ -60,6 +60,7 @@ struct kvm_x86_ops vt_x86_ops __initdata .set_idt = vmx_set_idt, .get_gdt = vmx_get_gdt, .set_gdt = vmx_set_gdt, + .set_dr6 = vmx_set_dr6, .set_dr7 = vmx_set_dr7, .sync_dirty_debug_regs = vmx_sync_dirty_debug_regs, .cache_reg = vmx_cache_reg,
arch/x86/kvm/vmx/vmx.c +6 -4
@@ -5631,6 +5631,12 @@ void vmx_sync_dirty_debug_regs(struct kvset_debugreg (DR6_RESERVED ,6 ); } +void vmx_set_dr6 (struct kvm_vcpu *vcpu,unsigned long val) +{ +lockdep_assert_irqs_disabled (); +set_debugreg (vcpu->arch.dr6,6 ); +} +void vmx_set_dr7 (struct kvm_vcpu *vcpu,unsigned long val) {vmcs_writel (GUEST_DR7 , val);
@@ -7392,10 +7398,6 @@ fastpath_t vmx_vcpu_run(struct kvm_vcpu vmx->loaded_vmcs->host_state.cr4 = cr4; } -/* When KVM_DEBUGREG_WONT_EXIT, dr6 is accessible in guest. */ -if (unlikely (vcpu->arch.switch_db_regs &KVM_DEBUGREG_WONT_EXIT )) -set_debugreg (vcpu->arch.dr6,6 ); -/* When single-stepping over STI and MOV SS, we must clear the * corresponding interruptibility bits in the guest state. Otherwise * vmentry fails as it then expects bit 14 (BS) in pending debug
arch/x86/kvm/vmx/x86_ops.h +1 -0
@@ -74,6 +74,7 @@ void vmx_get_idt(struct kvm_vcpu *vcpu,void vmx_set_idt (struct kvm_vcpu *vcpu,struct desc_ptr *dt);void vmx_get_gdt (struct kvm_vcpu *vcpu,struct desc_ptr *dt);void vmx_set_gdt (struct kvm_vcpu *vcpu,struct desc_ptr *dt); +void vmx_set_dr6 (struct kvm_vcpu *vcpu,unsigned long val);void vmx_set_dr7 (struct kvm_vcpu *vcpu,unsigned long val);void vmx_sync_dirty_debug_regs (struct kvm_vcpu *vcpu);void vmx_cache_reg (struct kvm_vcpu *vcpu,enum kvm_reg reg);
arch/x86/kvm/x86.c +3 -0
@@ -10968,6 +10968,9 @@ static int vcpu_enter_guest(struct kvm_vset_debugreg (vcpu->arch.eff_db[1 ],1 );set_debugreg (vcpu->arch.eff_db[2 ],2 );set_debugreg (vcpu->arch.eff_db[3 ],3 ); +/* When KVM_DEBUGREG_WONT_EXIT, dr6 is accessible in guest. */ +if (unlikely (vcpu->arch.switch_db_regs &KVM_DEBUGREG_WONT_EXIT )) +kvm_x86_call (set_dr6)(vcpu, vcpu->arch.dr6); }else if (unlikely (hw_breakpoint_active ())) {set_debugreg (0 ,7 ); }
Greg Kroah-Hartman
maintainerPATCH 102/230 KVM: nSVM: Enter guest mode before initializing nested NPT MMU
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit 46d6c6f3ef0eaff71c2db6d77d4e2ebb7adac34f upstream.
When preparing vmcb02 for nested VMRUN (or state restore), "enter" guest mode prior to initializing the MMU for nested NPT so that guest_mode is set in the MMU's role. KVM's model is that all L2 MMUs are tagged with guest_mode, as the behavior of hypervisor MMUs tends to be significantly different than kernel MMUs.
Practically speaking, the bug is relatively benign, as KVM only directly queries role.guest_mode in kvm_mmu_free_guest_mode_roots() and kvm_mmu_page_ad_need_write_protect(), which SVM doesn't use, and in paths that are optimizations (mmu_page_zap_pte() and shadow_mmu_try_split_huge_pages()).
And while the role is incorprated into shadow page usage, because nested NPT requires KVM to be using NPT for L1, reusing shadow pages across L1 and L2 is impossible as L1 MMUs will always have direct=1, while L2 MMUs will have direct=0.
Hoist the TLB processing and setting of HF_GUEST_MASK to the beginning of the flow instead of forcing guest_mode in the MMU, as nothing in nested_vmcb02_prepare_control() between the old and new locations touches TLB flush requests or HF_GUEST_MASK, i.e. there's no reason to present inconsistent vCPU state to the MMU.
--- arch/x86/kvm/mmu/mmu.c | 2 +- arch/x86/kvm/svm/nested.c | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-)
arch/x86/kvm/mmu/mmu.c +1 -1
@@ -5591,7 +5591,7 @@ void kvm_init_shadow_npt_mmu(struct kvm_union kvm_mmu_page_role root_role;/* NPT requires CR0.PG=1. */ -WARN_ON_ONCE (cpu_role.base.direct); +WARN_ON_ONCE (cpu_role.base.direct || !cpu_role.base.guest_mode); root_role = cpu_role.base; root_role.level =kvm_mmu_get_tdp_level (vcpu);
arch/x86/kvm/svm/nested.c +5 -5
@@ -646,6 +646,11 @@ static void nested_vmcb02_prepare_controu32 pause_count12;u32 pause_thresh12; +nested_svm_transition_tlb_flush (vcpu); + +/* Enter Guest-Mode */ +enter_guest_mode (vcpu); +/* * Filled at exit: exit_code, exit_code_hi, exit_info_1, exit_info_2, * exit_int_info, exit_int_info_err, next_rip, insn_len, insn_bytes.
@@ -762,11 +767,6 @@ static void nested_vmcb02_prepare_contro } } -nested_svm_transition_tlb_flush (vcpu); - -/* Enter Guest-Mode */ -enter_guest_mode (vcpu); -/* * Merge guest and host intercepts - must be called with vcpu in * guest-mode to take effect.
Greg Kroah-Hartman
maintainerPATCH 103/230 perf/x86/intel: Fix ARCH_PERFMON_NUM_COUNTER_LEAF
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kan Liang <[email protected]>
commit 47a973fd75639fe80d59f9e1860113bb2a0b112b upstream.
The EAX of the CPUID Leaf 023H enumerates the mask of valid sub-leaves. To tell the availability of the sub-leaf 1 (enumerate the counter mask), perf should check the bit 1 (0x2) of EAS, rather than bit 0 (0x1).
The error is not user-visible on bare metal. Because the sub-leaf 0 and the sub-leaf 1 are always available. However, it may bring issues in a virtualization environment when a VMM only enumerates the sub-leaf 0.
Introduce the cpuid35_e?x to replace the macros, which makes the implementation style consistent.
--- arch/x86/events/intel/core.c | 18 ++++++++++-------- arch/x86/include/asm/perf_event.h | 28 +++++++++++++++++++++++++--- 2 files changed, 35 insertions(+), 11 deletions(-)
arch/x86/events/intel/core.c +10 -8
@@ -4865,20 +4865,22 @@ static inline bool intel_pmu_broken_perfstatic void update_pmu_cap (struct x86_hybrid_pmu *pmu) { -unsigned int sub_bitmaps, eax, ebx, ecx, edx; +unsigned int cntr, fixed_cntr, ecx, edx; +union cpuid35_eax eax; +union cpuid35_ebx ebx; -cpuid (ARCH_PERFMON_EXT_LEAF , &sub_bitmaps, &ebx, &ecx, &edx); +cpuid (ARCH_PERFMON_EXT_LEAF , &eax.full, &ebx.full, &ecx, &edx); -if (ebx &ARCH_PERFMON_EXT_UMASK2 ) +if (ebx.split.umask2) pmu->config_mask |=ARCH_PERFMON_EVENTSEL_UMASK2 ; -if (ebx &ARCH_PERFMON_EXT_EQ ) +if (ebx.split.eq) pmu->config_mask |=ARCH_PERFMON_EVENTSEL_EQ ; -if (sub_bitmaps &ARCH_PERFMON_NUM_COUNTER_LEAF_BIT ) { +if (eax.split.cntr_subleaf) {cpuid_count (ARCH_PERFMON_EXT_LEAF ,ARCH_PERFMON_NUM_COUNTER_LEAF , - &eax, &ebx, &ecx, &edx); - pmu->cntr_mask64 = eax; - pmu->fixed_cntr_mask64 = ebx; + &cntr, &fixed_cntr, &ecx, &edx); + pmu->cntr_mask64 = cntr; + pmu->fixed_cntr_mask64 = fixed_cntr; }if (!intel_pmu_broken_perf_cap ()) {
arch/x86/include/asm/perf_event.h +25 -3
@@ -187,11 +187,33 @@ union cpuid10_edx {* detection/enumeration details: */ #define ARCH_PERFMON_EXT_LEAF 0x00000023 -#define ARCH_PERFMON_EXT_UMASK2 0x1 -#define ARCH_PERFMON_EXT_EQ 0x2 -#define ARCH_PERFMON_NUM_COUNTER_LEAF_BIT 0x1#define ARCH_PERFMON_NUM_COUNTER_LEAF 0x1 +union cpuid35_eax { +struct { +unsigned int leaf0:1 ; +/* Counters Sub-Leaf */ +unsigned int cntr_subleaf:1 ; +/* Auto Counter Reload Sub-Leaf */ +unsigned int acr_subleaf:1 ; +/* Events Sub-Leaf */ +unsigned int events_subleaf:1 ; +unsigned int reserved:28 ; + } split; +unsigned int full; +}; + +union cpuid35_ebx { +struct { +/* UnitMask2 Supported */ +unsigned int umask2:1 ; +/* EQ-bit Supported */ +unsigned int eq:1 ; +unsigned int reserved:30 ; + } split; +unsigned int full; +}; +/* * Intel Architectural LBR CPUID detection/enumeration details: */
Greg Kroah-Hartman
maintainerPATCH 104/230 perf/x86/intel: Ensure LBRs are disabled when a CPU is starting
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit c631a2de7ae48d50434bdc205d901423f8577c65 upstream.
Explicitly clear DEBUGCTL.LBR when a CPU is starting, prior to purging the LBR MSRs themselves, as at least one system has been found to transfer control to the kernel with LBRs enabled (it's unclear whether it's a BIOS flaw or a CPU goof). Because the kernel preserves the original DEBUGCTL, even when toggling LBRs, leaving DEBUGCTL.LBR as is results in running with LBRs enabled at all times.
--- arch/x86/events/intel/core.c | 5 ++++- arch/x86/include/asm/msr-index.h | 3 ++- 2 files changed, 6 insertions(+), 2 deletions(-)
arch/x86/events/intel/core.c +4 -1
@@ -4993,8 +4993,11 @@ static void intel_pmu_cpu_starting(int cinit_debug_store_on_cpu (cpu);/* -* Deal with CPUs that don't clear their LBRs on power-up. +* Deal with CPUs that don't clear their LBRs on power-up, and that may +* even boot with LBRs enabled. */ +if (!static_cpu_has (X86_FEATURE_ARCH_LBR ) && x86_pmu.lbr_nr) +msr_clear_bit (MSR_IA32_DEBUGCTLMSR ,DEBUGCTLMSR_LBR_BIT );intel_pmu_lbr_reset (); cpuc->lbr_sel =NULL ;
arch/x86/include/asm/msr-index.h +2 -1
@@ -395,7 +395,8 @@#define MSR_IA32_PASID_VALID BIT_ULL(31)/* DEBUGCTLMSR bits (others vary by model): */ -#define DEBUGCTLMSR_LBR (1UL << 0)/* last branch recording */ +#define DEBUGCTLMSR_LBR_BIT 0/* last branch recording */ +#define DEBUGCTLMSR_LBR (1UL << DEBUGCTLMSR_LBR_BIT)#define DEBUGCTLMSR_BTF_SHIFT 1#define DEBUGCTLMSR_BTF (1UL << 1)/* single-step on branches */ #define DEBUGCTLMSR_BUS_LOCK_DETECT (1UL << 2)
Greg Kroah-Hartman
maintainerPATCH 105/230 ring-buffer: Unlock resize on mmap error
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <[email protected]>
commit 9ba0e1755a40f9920ad0f4168031291b3eb58d7b upstream.
Memory mapping the tracing ring buffer will disable resizing the buffer. But if there's an error in the memory mapping like an invalid parameter, the function exits out without re-enabling the resizing of the ring buffer, preventing the ring buffer from being resized after that.
--- kernel/trace/ring_buffer.c | 1 + 1 file changed, 1 insertion(+)
kernel/trace/ring_buffer.c +1 -0
@@ -7157,6 +7157,7 @@ int ring_buffer_map(struct trace_bufferkfree (cpu_buffer->subbuf_ids); cpu_buffer->subbuf_ids =NULL ;rb_free_meta_page (cpu_buffer); +atomic_dec (&cpu_buffer->resize_disabled); } unlock:
Greg Kroah-Hartman
maintainerPATCH 106/230 tracing: Do not allow mmap() of persistent ring buffer
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <[email protected]>
commit 129fe718819cc5e24ea2f489db9ccd4371f0c6f6 upstream.
When trying to mmap a trace instance buffer that is attached to reserve_mem, it would crash:
BUG: unable to handle page fault for address: ffffe97bd00025c8 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 2862f3067 P4D 2862f3067 PUD 0 Oops: Oops: 0000 [#1] PREEMPT_RT SMP PTI CPU: 4 UID: 0 PID: 981 Comm: mmap-rb Not tainted 6.14.0-rc2-test-00003-g7f1a5e3fbf9e-dirty #233 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:validate_page_before_insert+0x5/0xb0 Code: e2 01 89 d0 c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 <48> 8b 46 08 a8 01 75 67 66 90 48 89 f0 8b 50 34 85 d2 74 76 48 89 RSP: 0018:ffffb148c2f3f968 EFLAGS: 00010246 RAX: ffff9fa5d3322000 RBX: ffff9fa5ccff9c08 RCX: 00000000b879ed29 RDX: ffffe97bd00025c0 RSI: ffffe97bd00025c0 RDI: ffff9fa5ccff9c08 RBP: ffffb148c2f3f9f0 R08: 0000000000000004 R09: 0000000000000004 R10: 0000000000000000 R11: 0000000000000200 R12: 0000000000000000 R13: 00007f16a18d5000 R14: ffff9fa5c48db6a8 R15: 0000000000000000 FS: 00007f16a1b54740(0000) GS:ffff9fa73df00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffe97bd00025c8 CR3: 00000001048c6006 CR4: 0000000000172ef0 Call Trace: <TASK> ? __die_body.cold+0x19/0x1f ? __die+0x2e/0x40 ? page_fault_oops+0x157/0x2b0 ? search_module_extables+0x53/0x80 ? validate_page_before_insert+0x5/0xb0 ? kernelmode_fixup_or_oops.isra.0+0x5f/0x70 ? __bad_area_nosemaphore+0x16e/0x1b0 ? bad_area_nosemaphore+0x16/0x20 ? do_kern_addr_fault+0x77/0x90 ? exc_page_fault+0x22b/0x230 ? asm_exc_page_fault+0x2b/0x30 ? validate_page_before_insert+0x5/0xb0 ? vm_insert_pages+0x151/0x400 __rb_map_vma+0x21f/0x3f0 ring_buffer_map+0x21b/0x2f0 tracing_buffers_mmap+0x70/0xd0 __mmap_region+0x6f0/0xbd0 mmap_region+0x7f/0x130 do_mmap+0x475/0x610 vm_mmap_pgoff+0xf2/0x1d0 ksys_mmap_pgoff+0x166/0x200 __x64_sys_mmap+0x37/0x50 x64_sys_call+0x1670/0x1d70 do_syscall_64+0xbb/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f
The reason was that the code that maps the ring buffer pages to user space has:
page = virt_to_page((void *)cpu_buffer->subbuf_ids[s]);
And uses that in:
vm_insert_pages(vma, vma->vm_start, pages, &nr_pages);
But virt_to_page() does not work with vmap()'d memory which is what the persistent ring buffer has. It is rather trivial to allow this, but for now just disable mmap() of instances that have their ring buffer from the reserve_mem option.
If an mmap() is performed on a persistent buffer it will return -ENODEV just like it would if the .mmap field wasn't defined in the file_operations structure.
--- kernel/trace/trace.c | 4 ++++ 1 file changed, 4 insertions(+)
kernel/trace/trace.c +4 -0
@@ -8364,6 +8364,10 @@ static int tracing_buffers_mmap(struct fstruct trace_iterator *iter = &info->iter;int ret =0 ; +/* Currently the boot mapped buffer is not supported for mmap */ +if (iter->tr->flags &TRACE_ARRAY_FL_BOOT ) +return -ENODEV ; + ret =get_snapshot_map (iter->tr);if (ret)return ret;
Greg Kroah-Hartman
maintainerPATCH 107/230 ring-buffer: Validate the persistent meta data subbuf array
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <[email protected]>
commit f5b95f1fa2ef3a03f49eeec658ba97e721412b32 upstream.
The meta data for a mapped ring buffer contains an array of indexes of all the subbuffers. The first entry is the reader page, and the rest of the entries lay out the order of the subbuffers in how the ring buffer link list is to be created.
The validator currently makes sure that all the entries are within the range of 0 and nr_subbufs. But it does not check if there are any duplicates.
While working on the ring buffer, I corrupted this array, where I added duplicates. The validator did not catch it and created the ring buffer link list on top of it. Luckily, the corruption was only that the reader page was also in the writer path and only presented corrupted data but did not crash the kernel. But if there were duplicates in the writer side, then it could corrupt the ring buffer link list and cause a crash.
Create a bitmask array with the size of the number of subbuffers. Then clear it. When walking through the subbuf array checking to see if the entries are within the range, test if its bit is already set in the subbuf_mask. If it is, then there is duplicates and fail the validation. If not, set the corresponding bit and continue.
--- kernel/trace/ring_buffer.c | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-)
kernel/trace/ring_buffer.c +20 -2
@@ -1672,7 +1672,8 @@ static void *rb_range_buffer(struct ring_buffer_per_cpu *cpu_buffer, int idx)* must be the same. */ static bool rb_meta_valid (struct ring_buffer_meta *meta,int cpu, -struct trace_buffer *buffer,int nr_pages) +struct trace_buffer *buffer,int nr_pages, +unsigned long *subbuf_mask) {int subbuf_size =PAGE_SIZE ;struct buffer_data_page *subbuf;
@@ -1680,6 +1681,9 @@ static bool rb_meta_valid(struct ring_buffer_meta *meta, int cpu,unsigned long buffers_end;int i; +if (!subbuf_mask) +return false; +/* Check the meta magic and meta struct size */ if (meta->magic !=RING_BUFFER_META_MAGIC || meta->struct_size !=sizeof (*meta)) {
@@ -1712,6 +1716,8 @@ static bool rb_meta_valid(struct ring_buffer_meta *meta, int cpu, subbuf =rb_subbufs_from_meta (meta); +bitmap_clear (subbuf_mask,0 , meta->nr_subbufs); +/* Is the meta buffers and the subbufs themselves have correct data? */ for (i =0 ; i < meta->nr_subbufs; i++) { if (meta->buffers[i] < 0 ||
@@ -1725,6 +1731,12 @@ static bool rb_meta_valid(struct ring_buffer_meta *meta, int cpu,return false; } +if (test_bit (meta->buffers[i], subbuf_mask)) { +pr_info ("Ring buffer boot meta [%d] array has duplicates\n" , cpu); +return false; + } + +set_bit (meta->buffers[i], subbuf_mask); subbuf = (void *)subbuf + subbuf_size; }
@@ -1889,17 +1901,22 @@ static void rb_meta_init_text_addr(struct ring_buffer_meta *meta)static void rb_range_meta_init (struct trace_buffer *buffer,int nr_pages) {struct ring_buffer_meta *meta; +unsigned long *subbuf_mask;unsigned long delta;void *subbuf;int cpu;int i; +/* Create a mask to test the subbuf array */ + subbuf_mask =bitmap_alloc (nr_pages +1 ,GFP_KERNEL ); +/* If subbuf_mask fails to allocate, then rb_meta_valid() will return false */ +for (cpu =0 ; cpu < nr_cpu_ids; cpu++) {void *next_meta; meta =rb_range_meta (buffer, nr_pages, cpu); -if (rb_meta_valid (meta, cpu, buffer, nr_pages)) { +if (rb_meta_valid (meta, cpu, buffer, nr_pages, subbuf_mask)) {/* Make the mappings match the current address */ subbuf =rb_subbufs_from_meta (meta); delta = (unsigned long )subbuf - meta->first_buffer;
@@ -1943,6 +1960,7 @@ static void rb_range_meta_init(struct trace_buffer *buffer, int nr_pages) subbuf += meta->subbuf_size; } } +bitmap_free (subbuf_mask); }static void *rbm_start (struct seq_file *m,loff_t *pos)
Signature · 1 line
2.48.1
Greg Kroah-Hartman
maintainerPATCH 108/230 ring-buffer: Update pages_touched to reflect persistent buffer content
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <[email protected]>
commit 97937834ae876f29565415ab15f1284666dc6be3 upstream.
The pages_touched field represents the number of subbuffers in the ring buffer that have content that can be read. This is used in accounting of "dirty_pages" and "buffer_percent" to allow the user to wait for the buffer to be filled to a certain amount before it reads the buffer in blocking mode.
The persistent buffer never updated this value so it was set to zero, and this accounting would take it as it had no content. This would cause user space to wait for content even though there's enough content in the ring buffer that satisfies the buffer_percent.
--- kernel/trace/ring_buffer.c | 5 +++++ 1 file changed, 5 insertions(+)
kernel/trace/ring_buffer.c +5 -0
@@ -1850,6 +1850,11 @@ static void rb_meta_validate_events(stru cpu_buffer->cpu); goto invalid; } + +/* If the buffer has content, update pages_touched */ +if (ret) +local_inc (&cpu_buffer->pages_touched); + entries += ret; entry_bytes +=local_read (&head_page->page->commit);local_set (&cpu_buffer->head_page->entries, ret);
Greg Kroah-Hartman
maintainerPATCH 109/230 usb: gadget: f_midi: Fixing wMaxPacketSize exceeded issue during MIDI bind retries
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Selvarasu Ganesan <[email protected]>
commit 9e8b21410f310c50733f6e1730bae5a8e30d3570 upstream.
The current implementation sets the wMaxPacketSize of bulk in/out endpoints to 1024 bytes at the end of the f_midi_bind function. However, in cases where there is a failure in the first midi bind attempt, consider rebinding. This scenario may encounter an f_midi_bind issue due to the previous bind setting the bulk endpoint's wMaxPacketSize to 1024 bytes, which exceeds the ep->maxpacket_limit where configured dwc3 TX/RX FIFO's maxpacket size of 512 bytes for IN/OUT endpoints in support HS speed only.
Here the term "rebind" in this context refers to attempting to bind the MIDI function a second time in certain scenarios. The situations where rebinding is considered include:
* When there is a failure in the first UDC write attempt, which may be caused by other functions bind along with MIDI.
* Runtime composition change : Example : MIDI,ADB to MIDI. Or MIDI to MIDI,ADB.
This commit addresses this issue by resetting the wMaxPacketSize before endpoint claim. And here there is no need to reset all values in the usb endpoint descriptor structure, as all members except wMaxPacketSize and bEndpointAddress have predefined values.
This ensures that restores the endpoint to its expected configuration, and preventing conflicts with value of ep->maxpacket_limit. It also aligns with the approach used in other function drivers, which treat endpoint descriptors as if they were full speed before endpoint claim.
--- drivers/usb/gadget/function/f_midi.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/usb/gadget/function/f_midi.c +9 -0
@@ -907,6 +907,15 @@ static int f_midi_bind(struct usb_config status = -ENODEV ; +/* +* Reset wMaxPacketSize with maximum packet size of FS bulk transfer before +* endpoint claim. This ensures that the wMaxPacketSize does not exceed the +* limit during bind retries where configured dwc3 TX/RX FIFO's maxpacket +* size of 512 bytes for IN/OUT endpoints in support HS speed only. +*/ + bulk_in_desc.wMaxPacketSize =cpu_to_le16 (64 ); + bulk_out_desc.wMaxPacketSize =cpu_to_le16 (64 ); +/* allocate instance-specific endpoints */ midi->in_ep =usb_ep_autoconfig (cdev->gadget, &bulk_in_desc);if (!midi->in_ep)
Greg Kroah-Hartman
maintainerPATCH 110/230 usb: dwc3: Fix timeout issue during controller enter/exit from halt state
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Selvarasu Ganesan <[email protected]>
commit d3a8c28426fc1fb3252753a9f1db0d691ffc21b0 upstream.
There is a frequent timeout during controller enter/exit from halt state after toggling the run_stop bit by SW. This timeout occurs when performing frequent role switches between host and device, causing device enumeration issues due to the timeout. This issue was not present when USB2 suspend PHY was disabled by passing the SNPS quirks (snps,dis_u2_susphy_quirk and snps,dis_enblslpm_quirk) from the DTS. However, there is a requirement to enable USB2 suspend PHY by setting of GUSB2PHYCFG.ENBLSLPM and GUSB2PHYCFG.SUSPHY bits when controller starts in gadget or host mode results in the timeout issue.
This commit addresses this timeout issue by ensuring that the bits GUSB2PHYCFG.ENBLSLPM and GUSB2PHYCFG.SUSPHY are cleared before starting the dwc3_gadget_run_stop sequence and restoring them after the dwc3_gadget_run_stop sequence is completed.
--- drivers/usb/dwc3/gadget.c | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+)
drivers/usb/dwc3/gadget.c +34 -0
@@ -2618,10 +2618,38 @@ static int dwc3_gadget_run_stop(struct d {u32 reg;u32 timeout =2000 ; +u32 saved_config =0 ;if (pm_runtime_suspended (dwc->dev))return 0 ; +/* +* When operating in USB 2.0 speeds (HS/FS), ensure that +* GUSB2PHYCFG.ENBLSLPM and GUSB2PHYCFG.SUSPHY are cleared before starting +* or stopping the controller. This resolves timeout issues that occur +* during frequent role switches between host and device modes. +* +* Save and clear these settings, then restore them after completing the +* controller start or stop sequence. +* +* This solution was discovered through experimentation as it is not +* mentioned in the dwc3 programming guide. It has been tested on an +* Exynos platforms. +*/ + reg =dwc3_readl (dwc->regs,DWC3_GUSB2PHYCFG (0 )); +if (reg &DWC3_GUSB2PHYCFG_SUSPHY ) { + saved_config |=DWC3_GUSB2PHYCFG_SUSPHY ; + reg &= ~DWC3_GUSB2PHYCFG_SUSPHY ; + } + +if (reg &DWC3_GUSB2PHYCFG_ENBLSLPM ) { + saved_config |=DWC3_GUSB2PHYCFG_ENBLSLPM ; + reg &= ~DWC3_GUSB2PHYCFG_ENBLSLPM ; + } + +if (saved_config) +dwc3_writel (dwc->regs,DWC3_GUSB2PHYCFG (0 ), reg); + reg =dwc3_readl (dwc->regs,DWC3_DCTL );if (is_on) { if (DWC3_VER_IS_WITHIN(DWC3, ANY, 187A)) {
@@ -2649,6 +2677,12 @@ static int dwc3_gadget_run_stop(struct d reg &=DWC3_DSTS_DEVCTRLHLT ; }while (--timeout && !(!is_on ^ !reg)); +if (saved_config) { + reg =dwc3_readl (dwc->regs,DWC3_GUSB2PHYCFG (0 )); + reg |= saved_config; +dwc3_writel (dwc->regs,DWC3_GUSB2PHYCFG (0 ), reg); + } +if (!timeout)return -ETIMEDOUT ;
Greg Kroah-Hartman
maintainerPATCH 111/230 usb: roles: set switch registered flag early on
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Elson Roy Serrao <[email protected]>
commit 634775a752a86784511018a108f3b530cc3399a7 upstream.
The role switch registration and set_role() can happen in parallel as they are invoked independent of each other. There is a possibility that a driver might spend significant amount of time in usb_role_switch_register() API due to the presence of time intensive operations like component_add() which operate under common mutex. This leads to a time window after allocating the switch and before setting the registered flag where the set role notifications are dropped. Below timeline summarizes this behavior
Thread1 | Thread2usb_role_switch_register() |
| | ---> allocate switch | | | ---> component_add() | usb_role_switch_set_role() | | | | | --> Drop role notifications | | since sw->registered | | flag is not set. | | --->Set registered flag.|
To avoid this, set the registered flag early on in the switch register API.
--- drivers/usb/roles/class.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/usb/roles/class.c +3 -2
@@ -387,8 +387,11 @@ usb_role_switch_register(struct device *dev_set_name (&sw->dev,"%s-role-switch" , desc->name ? desc->name :dev_name (parent)); + sw->registered = true; + ret =device_register (&sw->dev);if (ret) { + sw->registered = false;put_device (&sw->dev);return ERR_PTR (ret); }
@@ -399,8 +402,6 @@ usb_role_switch_register(struct device *dev_warn (&sw->dev,"failed to add component\n" ); } - sw->registered = true; -/* TODO: Symlinks for the host port and the device controller. */ return sw;
Greg Kroah-Hartman
maintainerPATCH 112/230 usb: gadget: udc: renesas_usb3: Fix compiler warning
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guo Ren <[email protected]>
commit 335a1fc1193481f8027f176649c72868172f6f8b upstream.
drivers/usb/gadget/udc/renesas_usb3.c: In function 'renesas_usb3_probe':drivers/usb/gadget/udc/renesas_usb3.c:2638:73: warning: '%d' directive output may be truncated writing between 1 and 11 bytes into a region of size 6 [-Wformat-truncation=]
2638 | snprintf(usb3_ep->ep_name, sizeof(usb3_ep->ep_name), "ep%d", i);
^~~~~~~~~~~~~~~~~~~~~~~~ ^~ ^--- drivers/usb/gadget/udc/renesas_usb3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/gadget/udc/renesas_usb3.c +1 -1
@@ -310,7 +310,7 @@ struct renesas_usb3_request {struct list_head queue; }; -#define USB3_EP_NAME_SIZE 8 +#define USB3_EP_NAME_SIZE 16struct renesas_usb3_ep {struct usb_ep ep;struct renesas_usb3 *usb3;
Greg Kroah-Hartman
maintainerPATCH 113/230 usb: dwc2: gadget: remove of_node reference upon udc_stop
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabrice Gasnier <[email protected]>
commit 58cd423820d5b5610977e55e4acdd06628829ede upstream.
In dwc2_hsotg_udc_start(), e.g. when binding composite driver, "of_node" is set to hsotg->dev->of_node.
It causes errors when binding the gadget driver several times, on stm32mp157c-ev1 board. Below error is seen:
"pin PA10 already requested by 49000000.usb-otg; cannot claim for gadget.0"
The first time, no issue is seen as when registering the driver, of_node isn't NULL:
-> gadget_dev_desc_UDC_store
-> usb_gadget_register_driver_owner
-> driver_register
...
-> really_probe -> pinctrl_bind_pins (no effect)Then dwc2_hsotg_udc_start() sets of_node.
The second time (stop the gadget, reconfigure it, then start it again), of_node has been set, so the probing code tries to acquire pins for the gadget. These pins are hold by the controller, hence the error.
So clear gadget.dev.of_node in udc_stop() routine to avoid the issue.
--- drivers/usb/dwc2/gadget.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/dwc2/gadget.c +1 -0
@@ -4615,6 +4615,7 @@ static int dwc2_hsotg_udc_stop(struct usspin_lock_irqsave (&hsotg->lock, flags); hsotg->driver =NULL ; + hsotg->gadget.dev.of_node =NULL ; hsotg->gadget.speed =USB_SPEED_UNKNOWN ; hsotg->enabled =0 ;
Greg Kroah-Hartman
maintainerPATCH 114/230 usb: xhci: Restore xhci_pci support for Renesas HCs
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Pecio <[email protected]>
commit c81d9fcd5b9402166048f377d4e5e0ee6f9ef26d upstream.
Some Renesas HCs require firmware upload to work, this is handled by the xhci_pci_renesas driver. Other variants of those chips load firmware from a SPI flash and are ready to work with xhci_pci alone.
A refactor merged in v6.12 broke the latter configuration so that users are finding their hardware ignored by the normal driver and are forced to enable the firmware loader which isn't really necessary on their systems.
Let xhci_pci work with those chips as before when the firmware loader is disabled by kernel configuration.
--- drivers/usb/host/xhci-pci.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/usb/host/xhci-pci.c +4 -3
@@ -656,8 +656,8 @@ put_runtime_pm: }EXPORT_SYMBOL_NS_GPL (xhci_pci_common_probe, xhci); -static const struct pci_device_id pci_ids_reject[] = { -/* handled by xhci-pci-renesas */ +/* handled by xhci-pci-renesas if enabled */ +static const struct pci_device_id pci_ids_renesas[] = { {PCI_DEVICE (PCI_VENDOR_ID_RENESAS ,0x0014 ) }, {PCI_DEVICE (PCI_VENDOR_ID_RENESAS ,0x0015 ) }, {/* end: all zeroes */ }
@@ -665,7 +665,8 @@ static const struct pci_device_id pci_idstatic int xhci_pci_probe (struct pci_dev *dev,const struct pci_device_id *id) { -if (pci_match_id (pci_ids_reject, dev)) +if (IS_ENABLED (CONFIG_USB_XHCI_PCI_RENESAS ) && +pci_match_id (pci_ids_renesas, dev))return -ENODEV ;return xhci_pci_common_probe (dev, id);
Greg Kroah-Hartman
maintainerPATCH 115/230 USB: pci-quirks: Fix HCCPARAMS register error for LS7A EHCI
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
commit e71f7f42e3c874ac3314b8f250e8416a706165af upstream.
LS7A EHCI controller doesn't have extended capabilities, so the EECP (EHCI Extended Capabilities Pointer) field of HCCPARAMS register should be 0x0, but it reads as 0xa0 now. This is a hardware flaw and will be fixed in future, now just clear the EECP field to avoid error messages on boot:
......
[ 0.581675] pci 0000:00:04.1: EHCI: unrecognized capability ff [ 0.581699] pci 0000:00:04.1: EHCI: unrecognized capability ff [ 0.581716] pci 0000:00:04.1: EHCI: unrecognized capability ff [ 0.581851] pci 0000:00:04.1: EHCI: unrecognized capability ff ...... [ 0.581916] pci 0000:00:05.1: EHCI: unrecognized capability ff [ 0.581951] pci 0000:00:05.1: EHCI: unrecognized capability ff [ 0.582704] pci 0000:00:05.1: EHCI: unrecognized capability ff [ 0.582799] pci 0000:00:05.1: EHCI: unrecognized capability ff
......
--- drivers/usb/host/pci-quirks.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/usb/host/pci-quirks.c +9 -0
@@ -958,6 +958,15 @@ static void quirk_usb_disable_ehci(struc* booting from USB disk or using a usb keyboard */ hcc_params =readl (base +EHCI_HCC_PARAMS ); + +/* LS7A EHCI controller doesn't have extended capabilities, the +* EECP (EHCI Extended Capabilities Pointer) field of HCCPARAMS +* register should be 0x0 but it reads as 0xa0. So clear it to +* avoid error messages on boot. +*/ +if (pdev->vendor ==PCI_VENDOR_ID_LOONGSON && pdev->device ==0x7a14 ) + hcc_params &= ~(0xffL <<8 ); + offset = (hcc_params >>8 ) &0xff ;while (offset && --count) {pci_read_config_dword (pdev, offset, &cap);
Greg Kroah-Hartman
maintainerPATCH 116/230 usb: core: fix pipe creation for get_bMaxPacketSize0
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Eichenberger <[email protected]>
commit 4aac0db5a0ebc599d4ad9bf5ebab78afa1f33e10 upstream.
When usb_control_msg is used in the get_bMaxPacketSize0 function, the USB pipe does not include the endpoint device number. This can cause failures when a usb hub port is reinitialized after encountering a bad cable connection. As a result, the system logs the following error messages:
usb usb2-port1: cannot reset (err = -32)
usb usb2-port1: Cannot enable. Maybe the USB cable is bad? usb usb2-port1: attempt power cycle
usb 2-1: new high-speed USB device number 5 using ci_hdrc usb 2-1: device descriptor read/8, error -71
The problem began after commit 85d07c556216 ("USB: core: Unite old scheme and new scheme descriptor reads"). There usb_get_device_descriptor was replaced with get_bMaxPacketSize0. Unlike usb_get_device_descriptor, the get_bMaxPacketSize0 function uses the macro usb_rcvaddr0pipe, which does not include the endpoint device number. usb_get_device_descriptor, on the other hand, used the macro usb_rcvctrlpipe, which includes the endpoint device number.
By modifying the get_bMaxPacketSize0 function to use usb_rcvctrlpipe instead of usb_rcvaddr0pipe, the issue can be resolved. This change will ensure that the endpoint device number is included in the USB pipe, preventing reinitialization failures. If the endpoint has not set the device number yet, it will still work because the device number is 0 in udev.
--- drivers/usb/core/hub.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/usb/core/hub.c +1 -2
@@ -4698,7 +4698,6 @@ void usb_ep0_reinit(struct usb_device *uEXPORT_SYMBOL_GPL (usb_ep0_reinit);#define usb_sndaddr0pipe () (PIPE_CONTROL << 30) -#define usb_rcvaddr0pipe () ((PIPE_CONTROL << 30) | USB_DIR_IN)static int hub_set_address (struct usb_device *udev,int devnum) {
@@ -4804,7 +4803,7 @@ static int get_bMaxPacketSize0(struct usfor (i =0 ; i <GET_MAXPACKET0_TRIES ; ++i) {/* Start with invalid values in case the transfer fails */ buf->bDescriptorType = buf->bMaxPacketSize0 =0 ; - rc = usb_control_msg(udev, usb_rcvaddr0pipe(), + rc = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), USB_REQ_GET_DESCRIPTOR, USB_DIR_IN, USB_DT_DEVICE << 8, 0, buf, size,
Greg Kroah-Hartman
maintainerPATCH 117/230 USB: quirks: add USB_QUIRK_NO_LPM quirk for Teclast dist
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lei Huang <[email protected]>
commit e169d96eecd447ff7fd7542ca5fa0911f5622054 upstream.
Teclast disk used on Huawei hisi platforms doesn't work well, losing connectivity intermittently if LPM is enabled. Add quirk disable LPM to resolve the issue.
--- drivers/usb/core/quirks.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/core/quirks.c +3 -0
@@ -522,6 +522,9 @@ static const struct usb_device_id usb_qu/* Blackmagic Design UltraStudio SDI */ { USB_DEVICE(0x1edb, 0xbd4f), .driver_info = USB_QUIRK_NO_LPM }, + /* Teclast disk */ + { USB_DEVICE(0x1f75, 0x0917), .driver_info = USB_QUIRK_NO_LPM }, + /* Hauppauge HVR-950q */ { USB_DEVICE(0x2040, 0x7200), .driver_info = USB_QUIRK_CONFIG_INTF_STRINGS },
Greg Kroah-Hartman
maintainerPATCH 118/230 USB: Add USB_QUIRK_NO_LPM quirk for sony xperia xz1 smartphone
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <[email protected]>
commit 159daf1258227f44b26b5d38f4aa8f37b8cca663 upstream.
The fastboot tool for communicating with Android bootloaders does not work reliably with this device if USB 2 Link Power Management (LPM) is enabled.
Various fastboot commands are affected, including the following, which usually reproduces the problem within two tries:
fastboot getvar kernel
getvar:kernel FAILED (remote: 'GetVar Variable Not found')
This issue was hidden on many systems up until commit 63a1f8454962 ("xhci: stored cached port capability values in one place") as the xhci driver failed to detect USB 2 LPM support if USB 3 ports were listed before USB 2 ports in the "supported protocol capabilities".
Adding the quirk resolves the issue. No drawbacks are expected since the device uses different USB product IDs outside of fastboot mode, and since fastboot commands worked before, until LPM was enabled on the tested system by the aforementioned commit.
Based on a patch from Forest <[email protected]> from which most of the code and commit message is taken.
--- drivers/usb/core/quirks.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/core/quirks.c +3 -0
@@ -432,6 +432,9 @@ static const struct usb_device_id usb_qu { USB_DEVICE(0x0c45, 0x7056), .driver_info = USB_QUIRK_IGNORE_REMOTE_WAKEUP }, + /* Sony Xperia XZ1 Compact (lilac) smartphone in fastboot mode */ + { USB_DEVICE(0x0fce, 0x0dde), .driver_info = USB_QUIRK_NO_LPM }, + /* Action Semiconductor flash disk */ { USB_DEVICE(0x10d6, 0x2200), .driver_info = USB_QUIRK_STRING_FETCH_255 },
Greg Kroah-Hartman
maintainerPATCH 119/230 usb: gadget: f_midi: fix MIDI Streaming descriptor lengths
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Keeping <[email protected]>
commit da1668997052ed1cb00322e1f3b63702615c9429 upstream.
While the MIDI jacks are configured correctly, and the MIDIStreaming endpoint descriptors are filled with the correct information, bNumEmbMIDIJack and bLength are set incorrectly in these descriptors.
This does not matter when the numbers of in and out ports are equal, but when they differ the host will receive broken descriptors with uninitialized stack memory leaking into the descriptor for whichever value is smaller.
The precise meaning of "in" and "out" in the port counts is not clearly defined and can be confusing. But elsewhere the driver consistently uses this to match the USB meaning of IN and OUT viewed from the host, so that "in" ports send data to the host and "out" ports receive data from it.
--- drivers/usb/gadget/function/f_midi.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/usb/gadget/function/f_midi.c +4 -4
@@ -1009,11 +1009,11 @@ static int f_midi_bind(struct usb_config }/* configure the endpoint descriptors ... */ - ms_out_desc.bLength =USB_DT_MS_ENDPOINT_SIZE (midi->in_ports); - ms_out_desc.bNumEmbMIDIJack = midi->in_ports; + ms_out_desc.bLength =USB_DT_MS_ENDPOINT_SIZE (midi->out_ports); + ms_out_desc.bNumEmbMIDIJack = midi->out_ports; - ms_in_desc.bLength =USB_DT_MS_ENDPOINT_SIZE (midi->out_ports); - ms_in_desc.bNumEmbMIDIJack = midi->out_ports; + ms_in_desc.bLength =USB_DT_MS_ENDPOINT_SIZE (midi->in_ports); + ms_in_desc.bNumEmbMIDIJack = midi->in_ports;/* ... and add them to the list */ endpoint_descriptor_index = i;
Greg Kroah-Hartman
maintainerPATCH 120/230 USB: hub: Ignore non-compliant devices with too many configs or interfaces
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit 2240fed37afbcdb5e8b627bc7ad986891100e05d upstream.
Robert Morris created a test program which can cause usb_hub_to_struct_hub() to dereference a NULL or inappropriate pointer:
Oops: general protection fault, probably for non-canonical address 0xcccccccccccccccc: 0000 [#1] SMP DEBUG_PAGEALLOC PTI CPU: 7 UID: 0 PID: 117 Comm: kworker/7:1 Not tainted 6.13.0-rc3-00017-gf44d154d6e3d #14 Hardware name: FreeBSD BHYVE/BHYVE, BIOS 14.0 10/17/2021 Workqueue: usb_hub_wq hub_event RIP: 0010:usb_hub_adjust_deviceremovable+0x78/0x110 ... Call Trace: <TASK> ? die_addr+0x31/0x80 ? exc_general_protection+0x1b4/0x3c0 ? asm_exc_general_protection+0x26/0x30 ? usb_hub_adjust_deviceremovable+0x78/0x110 hub_probe+0x7c7/0xab0 usb_probe_interface+0x14b/0x350 really_probe+0xd0/0x2d0 ? __pfx___device_attach_driver+0x10/0x10 __driver_probe_device+0x6e/0x110 driver_probe_device+0x1a/0x90 __device_attach_driver+0x7e/0xc0 bus_for_each_drv+0x7f/0xd0 __device_attach+0xaa/0x1a0 bus_probe_device+0x8b/0xa0 device_add+0x62e/0x810 usb_set_configuration+0x65d/0x990 usb_generic_driver_probe+0x4b/0x70 usb_probe_device+0x36/0xd0
The cause of this error is that the device has two interfaces, and the hub driver binds to interface 1 instead of interface 0, which is where usb_hub_to_struct_hub() looks.
We can prevent the problem from occurring by refusing to accept hub devices that violate the USB spec by having more than one configuration or interface.
--- drivers/usb/core/hub.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/usb/core/hub.c +11 -0
@@ -1848,6 +1848,17 @@ static int hub_probe(struct usb_interfac hdev =interface_to_usbdev (intf);/* +* The USB 2.0 spec prohibits hubs from having more than one +* configuration or interface, and we rely on this prohibition. +* Refuse to accept a device that violates it. +*/ +if (hdev->descriptor.bNumConfigurations >1 || + hdev->actconfig->desc.bNumInterfaces >1 ) { +dev_err (&intf->dev,"Invalid hub with more than one config or interface\n" ); +return -EINVAL ; + } + +/* * Set default autosuspend delay as 0 to speedup bus suspend, * based on the below considerations: *
Greg Kroah-Hartman
maintainerPATCH 121/230 USB: cdc-acm: Fill in Renesas R-Car D3 USB Download mode quirk
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
commit 7284922f3e4fa285dff1b8bb593aa9a0b8458f30 upstream.
Add Renesas R-Car D3 USB Download mode quirk and update comments on all the other Renesas R-Car USB Download mode quirks to discern them from each other. This follows R-Car Series, 3rd Generation reference manual Rev.2.00 chapter 19.2.8 USB download mode .
--- drivers/usb/class/cdc-acm.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/usb/class/cdc-acm.c +6 -3
@@ -1727,13 +1727,16 @@ static const struct usb_device_id acm_id { USB_DEVICE(0x0870, 0x0001), /* Metricom GS Modem */ .driver_info =NO_UNION_NORMAL ,/* has no union descriptor */ }, - { USB_DEVICE(0x045b, 0x023c), /* Renesas USB Download mode */ + { USB_DEVICE(0x045b, 0x023c), /* Renesas R-Car H3 USB Download mode */ .driver_info = DISABLE_ECHO, /* Don't echo banner */ }, - { USB_DEVICE(0x045b, 0x0248), /* Renesas USB Download mode */ + { USB_DEVICE(0x045b, 0x0247), /* Renesas R-Car D3 USB Download mode */ .driver_info = DISABLE_ECHO, /* Don't echo banner */ }, - { USB_DEVICE(0x045b, 0x024D), /* Renesas USB Download mode */ + { USB_DEVICE(0x045b, 0x0248), /* Renesas R-Car M3-N USB Download mode */ + .driver_info = DISABLE_ECHO, /* Don't echo banner */ + }, + { USB_DEVICE(0x045b, 0x024D), /* Renesas R-Car E3 USB Download mode */ .driver_info = DISABLE_ECHO, /* Don't echo banner */ }, { USB_DEVICE(0x0e8d, 0x0003), /* FIREFLY, MediaTek Inc; [email protected] */
Greg Kroah-Hartman
maintainerPATCH 122/230 usb: cdc-acm: Check control transfer buffer size before access
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <[email protected]>
commit e563b01208f4d1f609bcab13333b6c0e24ce6a01 upstream.
If the first fragment is shorter than struct usb_cdc_notification, we can't calculate an expected_size. Log an error and discard the notification instead of reading lengths from memory outside the received data, which can lead to memory corruption when the expected_size decreases between fragments, causing expected_size - acm->nb_index to wrap.
This issue has been present since the beginning of git history; however, it only leads to memory corruption since commit ea2583529cd1 ("cdc-acm: reassemble fragmented notifications").
A mitigating factor is that acm_ctrl_irq() can only execute after userspace has opened /dev/ttyACM*; but if ModemManager is running, ModemManager will do that automatically depending on the USB device's vendor/product IDs and its other interfaces.
--- drivers/usb/class/cdc-acm.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-)
drivers/usb/class/cdc-acm.c +14 -3
@@ -371,7 +371,7 @@ static void acm_process_notification(strstatic void acm_ctrl_irq (struct urb *urb) {struct acm *acm = urb->context; -struct usb_cdc_notification *dr = urb->transfer_buffer; +struct usb_cdc_notification *dr;unsigned int current_size = urb->actual_length;unsigned int expected_size, copy_size, alloc_size;int retval;
@@ -398,9 +398,20 @@ static void acm_ctrl_irq(struct urb *urbusb_mark_last_busy (acm->dev); -if (acm->nb_index) +if (acm->nb_index ==0 ) { +/* +* The first chunk of a message must contain at least the +* notification header with the length field, otherwise we +* can't get an expected_size. +*/ +if (current_size <sizeof (struct usb_cdc_notification )) { +dev_dbg (&acm->control->dev,"urb too short\n" ); + goto exit; + } + dr = urb->transfer_buffer; + }else { dr = (struct usb_cdc_notification *)acm->notification_buffer; - + }/* size = notification-header + (optional) data */ expected_size =sizeof (struct usb_cdc_notification ) +le16_to_cpu (dr->wLength);
Greg Kroah-Hartman
maintainerPATCH 123/230 usb: cdc-acm: Fix handling of oversized fragments
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <[email protected]>
commit 12e712964f41d05ae034989892de445781c46730 upstream.
If we receive an initial fragment of size 8 bytes which specifies a wLength of 1 byte (so the reassembled message is supposed to be 9 bytes long), and we then receive a second fragment of size 9 bytes (which is not supposed to happen), we currently wrongly bypass the fragment reassembly code but still pass the pointer to the acm->notification_buffer to acm_process_notification().
Make this less wrong by always going through fragment reassembly when we expect more fragments.
Before this patch, receiving an overlong fragment could lead to newctrl in acm_process_notification() being uninitialized data (instead of data coming from the device).
--- drivers/usb/class/cdc-acm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/class/cdc-acm.c +1 -1
@@ -416,7 +416,7 @@ static void acm_ctrl_irq(struct urb *urb expected_size =sizeof (struct usb_cdc_notification ) +le16_to_cpu (dr->wLength); -if (current_size < expected_size) { +if (acm->nb_index !=0 || current_size < expected_size) {/* notification is transmitted fragmented, reassemble */ if (acm->nb_size < expected_size) {u8 *new_buffer;
Greg Kroah-Hartman
maintainerPATCH 124/230 usb: gadget: core: flush gadget workqueue after device removal
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roy Luo <[email protected]>
commit 399a45e5237ca14037120b1b895bd38a3b4492ea upstream.
device_del() can lead to new work being scheduled in gadget->work workqueue. This is observed, for example, with the dwc3 driver with the following call stack:
device_del()
gadget_unbind_driver()
usb_gadget_disconnect_locked()
dwc3_gadget_pullup()
dwc3_gadget_soft_disconnect()
usb_gadget_set_state()
schedule_work(&gadget->work)Move flush_work() after device_del() to ensure the workqueue is cleaned up.
--- drivers/usb/gadget/udc/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/gadget/udc/core.c +1 -1
@@ -1543,8 +1543,8 @@ void usb_del_gadget(struct usb_gadget *gkobject_uevent (&udc->dev.kobj,KOBJ_REMOVE );sysfs_remove_link (&udc->dev.kobj,"gadget" ); -flush_work (&gadget->work);device_del (&gadget->dev); +flush_work (&gadget->work);ida_free (&gadget_id_numbers, gadget->id_number);cancel_work_sync (&udc->vbus_work);device_unregister (&udc->dev);
Greg Kroah-Hartman
maintainerPATCH 125/230 USB: serial: option: add MeiG Smart SLM828
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chester A. Unal <[email protected]>
commit db79e75460fc59b19f9c89d4b068e61cee59f37d upstream.
MeiG Smart SLM828 is an LTE-A CAT6 modem with the mPCIe form factor. The "Cls=ff(vend.) Sub=10 Prot=02" and "Cls=ff(vend.) Sub=10 Prot=03" interfaces respond to AT commands. Add these interfaces.
The product ID the modem uses is shared across multiple modems. Therefore, add comments to describe which interface is used for which modem.
T: Bus=01 Lev=01 Prnt=05 Port=01 Cnt=01 Dev#= 6 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=2dee ProdID=4d22 Rev=05.04 S: Manufacturer=MEIG S: Product=LTE-A Module S: SerialNumber=4da7ec42 C: #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=10 Prot=01 Driver=(none) E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=10 Prot=02 Driver=(none) E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=10 Prot=03 Driver=(none) E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=10 Prot=04 Driver=(none) E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=88(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=10 Prot=05 Driver=qmi_wwan E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
drivers/usb/serial/option.c +10 -5
@@ -621,7 +621,10 @@ static void option_instat_callback(struc/* MeiG Smart Technology products */ #define MEIGSMART_VENDOR_ID 0x2dee -/* MeiG Smart SRM815/SRM825L based on Qualcomm 315 */ +/* +* MeiG Smart SLM828, SRM815, and SRM825L use the same product ID. SLM828 is +* based on Qualcomm SDX12. SRM815 and SRM825L are based on Qualcomm 315. +*/ #define MEIGSMART_PRODUCT_SRM825L 0x4d22/* MeiG Smart SLM320 based on UNISOC UIS8910 */ #define MEIGSMART_PRODUCT_SLM320 0x4d41
@@ -2405,10 +2408,12 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, LUAT_PRODUCT_AIR720U, 0xff, 0, 0) }, { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SLM320, 0xff, 0, 0) }, { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SLM770A, 0xff, 0, 0) }, - { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0, 0) }, - { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x30) }, - { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x40) }, - { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x60) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0, 0) }, /* MeiG Smart SRM815 */ + { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0x10, 0x02) }, /* MeiG Smart SLM828 */ + { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0x10, 0x03) }, /* MeiG Smart SLM828 */ + { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x30) }, /* MeiG Smart SRM815 and SRM825L */ + { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x40) }, /* MeiG Smart SRM825L */ + { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x60) }, /* MeiG Smart SRM825L */ { USB_DEVICE_INTERFACE_CLASS(0x1bbb, 0x0530, 0xff), /* TCL IK512 MBIM */ .driver_info = NCTRL(1) }, { USB_DEVICE_INTERFACE_CLASS(0x1bbb, 0x0640, 0xff), /* TCL IK512 ECM */
Greg Kroah-Hartman
maintainerPATCH 126/230 USB: serial: option: add Telit Cinterion FN990B compositions
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Porcedda <[email protected]>
commit c979fb5ece2dc11cc9cc3d5c66f750e210bfdee2 upstream.
Add the following Telit Cinterion FN990B40 compositions:
0x10d0: rmnet + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) +
tty (diag) + DPL + QDSS (Qualcomm Debug SubSystem) + adb
T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 17 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10d0 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FN990 S: SerialNumber=43b38f19 C: #Ifs= 9 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 6 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) E: Ad=8c(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none) E: Ad=8d(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 8 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10d1: MBIM + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) +
tty (diag) + DPL + QDSS (Qualcomm Debug SubSystem) + adb
T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 16 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10d1 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FN990 S: SerialNumber=43b38f19 C: #Ifs=10 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) E: Ad=8c(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 8 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none) E: Ad=8d(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 9 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10d2: RNDIS + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) +
tty (diag) + DPL + QDSS (Qualcomm Debug SubSystem) + adb
T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 18 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10d2 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FN990 S: SerialNumber=43b38f19 C: #Ifs=10 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) E: Ad=8c(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 8 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none) E: Ad=8d(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 9 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10d3: ECM + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) +
tty (diag) + DPL + QDSS (Qualcomm Debug SubSystem) + adb
T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 20 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10d3 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FN990 S: SerialNumber=43b38f19 C: #Ifs=10 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) E: Ad=8c(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 8 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none) E: Ad=8d(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 9 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
drivers/usb/serial/option.c +16 -0
@@ -1406,6 +1406,22 @@ static const struct usb_device_id option .driver_info = RSVD(0) | NCTRL(3) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c8, 0xff), /* Telit FE910C04 (rmnet) */ .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) }, + { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d0, 0x60) }, /* Telit FN990B (rmnet) */ + { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d0, 0x40) }, + { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d0, 0x30), + .driver_info = NCTRL(5) }, + { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d1, 0x60) }, /* Telit FN990B (MBIM) */ + { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d1, 0x40) }, + { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d1, 0x30), + .driver_info = NCTRL(6) }, + { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d2, 0x60) }, /* Telit FN990B (RNDIS) */ + { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d2, 0x40) }, + { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d2, 0x30), + .driver_info = NCTRL(6) }, + { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d3, 0x60) }, /* Telit FN990B (ECM) */ + { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d3, 0x40) }, + { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d3, 0x30), + .driver_info = NCTRL(6) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910), .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM),
Greg Kroah-Hartman
maintainerPATCH 127/230 USB: serial: option: fix Telit Cinterion FN990A name
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Porcedda <[email protected]>
commit 12606fe73f33647c5e79bf666833bf0b225e649d upstream.
The correct name for FN990 is FN990A so use it in order to avoid confusion with FN990B.
--- drivers/usb/serial/option.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/usb/serial/option.c +5 -5
@@ -1370,15 +1370,15 @@ static const struct usb_device_id option .driver_info = NCTRL(2) | RSVD(3) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1063, 0xff), /* Telit LN920 (ECM) */ .driver_info = NCTRL(0) | RSVD(1) }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1070, 0xff), /* Telit FN990 (rmnet) */ + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1070, 0xff), /* Telit FN990A (rmnet) */ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1071, 0xff), /* Telit FN990 (MBIM) */ + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1071, 0xff), /* Telit FN990A (MBIM) */ .driver_info = NCTRL(0) | RSVD(1) }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1072, 0xff), /* Telit FN990 (RNDIS) */ + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1072, 0xff), /* Telit FN990A (RNDIS) */ .driver_info = NCTRL(2) | RSVD(3) }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1073, 0xff), /* Telit FN990 (ECM) */ + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1073, 0xff), /* Telit FN990A (ECM) */ .driver_info = NCTRL(0) | RSVD(1) }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1075, 0xff), /* Telit FN990 (PCIe) */ + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1075, 0xff), /* Telit FN990A (PCIe) */ .driver_info = RSVD(0) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1080, 0xff), /* Telit FE990 (rmnet) */ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },
Greg Kroah-Hartman
maintainerPATCH 128/230 USB: serial: option: drop MeiG Smart defines
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 6aa8a63c471eb6756aabd03f880feffe6a7af6c9 upstream.
Several MeiG Smart modems apparently use the same product id, making the defines even less useful.
Drop them in favour of using comments consistently to make the id table slightly less unwieldy.
--- drivers/usb/serial/option.c | 28 ++++++++-------------------- 1 file changed, 8 insertions(+), 20 deletions(-)
drivers/usb/serial/option.c +8 -20
@@ -619,18 +619,6 @@ static void option_instat_callback(struc/* Luat Air72*U series based on UNISOC UIS8910 uses UNISOC's vendor ID */ #define LUAT_PRODUCT_AIR720U 0x4e00 -/* MeiG Smart Technology products */ -#define MEIGSMART_VENDOR_ID 0x2dee -/* -* MeiG Smart SLM828, SRM815, and SRM825L use the same product ID. SLM828 is -* based on Qualcomm SDX12. SRM815 and SRM825L are based on Qualcomm 315. -*/ -#define MEIGSMART_PRODUCT_SRM825L 0x4d22 -/* MeiG Smart SLM320 based on UNISOC UIS8910 */ -#define MEIGSMART_PRODUCT_SLM320 0x4d41 -/* MeiG Smart SLM770A based on ASR1803 */ -#define MEIGSMART_PRODUCT_SLM770A 0x4d57 -/* Device flags */ /* Highest interface number which can be used with NCTRL() and RSVD() */
@@ -2366,6 +2354,14 @@ static const struct usb_device_id option { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0a05, 0xff) }, /* Fibocom FM650-CN (NCM mode) */ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0a06, 0xff) }, /* Fibocom FM650-CN (RNDIS mode) */ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0a07, 0xff) }, /* Fibocom FM650-CN (MBIM mode) */ + { USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d41, 0xff, 0, 0) }, /* MeiG Smart SLM320 */ + { USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d57, 0xff, 0, 0) }, /* MeiG Smart SLM770A */ + { USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d22, 0xff, 0, 0) }, /* MeiG Smart SRM815 */ + { USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d22, 0xff, 0x10, 0x02) }, /* MeiG Smart SLM828 */ + { USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d22, 0xff, 0x10, 0x03) }, /* MeiG Smart SLM828 */ + { USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d22, 0xff, 0xff, 0x30) }, /* MeiG Smart SRM815 and SRM825L */ + { USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d22, 0xff, 0xff, 0x40) }, /* MeiG Smart SRM825L */ + { USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d22, 0xff, 0xff, 0x60) }, /* MeiG Smart SRM825L */ { USB_DEVICE_INTERFACE_CLASS(0x2df3, 0x9d03, 0xff) }, /* LongSung M5710 */ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 RNDIS */ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 MBIM */
@@ -2422,14 +2418,6 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0, 0) }, { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, TOZED_PRODUCT_LT70C, 0xff, 0, 0) }, { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, LUAT_PRODUCT_AIR720U, 0xff, 0, 0) }, - { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SLM320, 0xff, 0, 0) }, - { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SLM770A, 0xff, 0, 0) }, - { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0, 0) }, /* MeiG Smart SRM815 */ - { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0x10, 0x02) }, /* MeiG Smart SLM828 */ - { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0x10, 0x03) }, /* MeiG Smart SLM828 */ - { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x30) }, /* MeiG Smart SRM815 and SRM825L */ - { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x40) }, /* MeiG Smart SRM825L */ - { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x60) }, /* MeiG Smart SRM825L */ { USB_DEVICE_INTERFACE_CLASS(0x1bbb, 0x0530, 0xff), /* TCL IK512 MBIM */ .driver_info = NCTRL(1) }, { USB_DEVICE_INTERFACE_CLASS(0x1bbb, 0x0640, 0xff), /* TCL IK512 ECM */
Greg Kroah-Hartman
maintainerPATCH 129/230 can: ctucanfd: handle skb allocation failure
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <[email protected]>
commit 9bd24927e3eeb85642c7baa3b28be8bea6c2a078 upstream.
If skb allocation fails, the pointer to struct can_frame is NULL. This is actually handled everywhere inside ctucan_err_interrupt() except for the only place.
Add the missed NULL check.
Found by Linux Verification Center (linuxtesting.org) with SVACE static analysis tool.
--- drivers/net/can/ctucanfd/ctucanfd_base.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/net/can/ctucanfd/ctucanfd_base.c +6 -4
@@ -867,10 +867,12 @@ static void ctucan_err_interrupt(struct }break ;case CAN_STATE_ERROR_ACTIVE : - cf->can_id |=CAN_ERR_CNT ; - cf->data[1 ] =CAN_ERR_CRTL_ACTIVE ; - cf->data[6 ] = bec.txerr; - cf->data[7 ] = bec.rxerr; +if (skb) { + cf->can_id |=CAN_ERR_CNT ; + cf->data[1 ] =CAN_ERR_CRTL_ACTIVE ; + cf->data[6 ] = bec.txerr; + cf->data[7 ] = bec.rxerr; + }break ;default : netdev_warn(ndev, "unhandled error state (%d:%s)!\n",
Greg Kroah-Hartman
maintainerPATCH 130/230 can: c_can: fix unbalanced runtime PM disable in error path
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
commit 257a2cd3eb578ee63d6bf90475dc4f4b16984139 upstream.
Runtime PM is enabled as one of the last steps of probe(), so all earlier gotos to "exit_free_device" label were not correct and were leading to unbalanced runtime PM disable depth.
--- drivers/net/can/c_can/c_can_platform.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/can/c_can/c_can_platform.c +3 -2
@@ -385,15 +385,16 @@ static int c_can_plat_probe(struct platfif (ret) {dev_err (&pdev->dev,"registering %s failed (err=%d)\n" ,KBUILD_MODNAME , ret); - goto exit_free_device; + goto exit_pm_runtime; }dev_info (&pdev->dev,"%s device registered (regs=%p, irq=%d)\n" ,KBUILD_MODNAME , priv->base, dev->irq);return 0 ; -exit_free_device: +exit_pm_runtime:pm_runtime_disable (priv->device); +exit_free_device:free_c_can_dev (dev); exit:dev_err (&pdev->dev,"probe failed\n" );
Greg Kroah-Hartman
maintainerPATCH 131/230 can: j1939: j1939_sk_send_loop(): fix unable to send messages with data length zero
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Hölzl <[email protected]>
commit 44de577e61ed239db09f0da9d436866bef9b77dd upstream.
The J1939 standard requires the transmission of messages of length 0.
For example proprietary messages are specified with a data length of 0 to 1785. The transmission of such messages is not possible. Sending results in no error being returned but no corresponding can frame being generated.
Enable the transmission of zero length J1939 messages. In order to facilitate this two changes are necessary:
1) If the transmission of a new message is requested from user space the message is segmented in j1939_sk_send_loop(). Let the segmentation take into account zero length messages, do not terminate immediately, queue the corresponding skb.
2) j1939_session_skb_get_by_offset() selects the next skb to transmit for a session. Take into account that there might be zero length skbs in the queue.
--- net/can/j1939/socket.c | 4 ++-- net/can/j1939/transport.c | 5 +++-- 2 files changed, 5 insertions(+), 4 deletions(-)
net/can/j1939/socket.c +2 -2
@@ -1132,7 +1132,7 @@ static int j1939_sk_send_loop(struct j19 todo_size = size; -while (todo_size) { + do { struct j1939_sk_buff_cb *skcb; segment_size = min_t(size_t, J1939_MAX_TP_PACKET_SIZE,
@@ -1177,7 +1177,7 @@ static int j1939_sk_send_loop(struct j19 todo_size -= segment_size; session->total_queued_size += segment_size; - } + }while (todo_size);switch (ret) {case 0 :/* OK */
net/can/j1939/transport.c +3 -2
@@ -382,8 +382,9 @@ sk_buff *j1939_session_skb_get_by_offset skb_queue_walk(&session->skb_queue, do_skb) { do_skcb =j1939_skb_to_cb (do_skb); -if (offset_start >= do_skcb->offset && - offset_start < (do_skcb->offset + do_skb->len)) { +if ((offset_start >= do_skcb->offset && + offset_start < (do_skcb->offset + do_skb->len)) || + (offset_start ==0 && do_skcb->offset ==0 && do_skb->len ==0 )) { skb = do_skb; } }
Greg Kroah-Hartman
maintainerPATCH 132/230 can: rockchip: rkcanfd_handle_rx_fifo_overflow_int(): bail out if skb cannot be allocated
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin van der Gracht <[email protected]>
commit f7f0adfe64de08803990dc4cbecd2849c04e314a upstream.
Fix NULL pointer check in rkcanfd_handle_rx_fifo_overflow_int() to bail out if skb cannot be allocated.
--- drivers/net/can/rockchip/rockchip_canfd-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/can/rockchip/rockchip_canfd-core.c +1 -1
@@ -622,7 +622,7 @@ rkcanfd_handle_rx_fifo_overflow_int(struct rkcanfd_priv *priv)netdev_dbg (priv->ndev,"RX-FIFO overflow\n" ); skb =rkcanfd_alloc_can_err_skb (priv, &cf, ×tamp); -if (skb) +if (!skb)return 0 ;rkcanfd_get_berr_counter_corrected (priv, &bec);
Signature · 1 line
2.48.1
Greg Kroah-Hartman
maintainerPATCH 133/230 can: etas_es58x: fix potential NULL pointer dereference on udev->serial
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vincent Mailhol <[email protected]>
commit a1ad2109ce41c9e3912dadd07ad8a9c640064ffb upstream.
The driver assumed that es58x_dev->udev->serial could never be NULL. While this is true on commercially available devices, an attacker could spoof the device identity providing a NULL USB serial number. That would trigger a NULL pointer dereference.
Add a check on es58x_dev->udev->serial before accessing it.
--- drivers/net/can/usb/etas_es58x/es58x_devlink.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/net/can/usb/etas_es58x/es58x_devlink.c +5 -1
@@ -248,7 +248,11 @@ static int es58x_devlink_info_get(structreturn ret; } -return devlink_info_serial_number_put (req, es58x_dev->udev->serial); +if (es58x_dev->udev->serial) + ret =devlink_info_serial_number_put (req, + es58x_dev->udev->serial); + +return ret; }const struct devlink_ops es58x_dl_ops = {
Greg Kroah-Hartman
maintainerPATCH 134/230 alpha: make stack 16-byte aligned (most cases)
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Kokshaysky <[email protected]>
commit 0a0f7362b0367634a2d5cb7c96226afc116f19c9 upstream.
The problem is that GCC expects 16-byte alignment of the incoming stack since early 2004, as Maciej found out [1]:
Having actually dug speculatively I can see that the psABI was changed in
GCC 3.5 with commit e5e10fb4a350 ("re PR target/14539 (128-bit long double improperly aligned)") back in Mar 2004, when the stack pointer alignment was increased from 8 bytes to 16 bytes, and arch/alpha/kernel/entry.S has various suspicious stack pointer adjustments, starting with SP_OFF which is not a whole multiple of 16.
Also, as Magnus noted, "ALPHA Calling Standard" [2] required the same:
D.3.1 Stack Alignment
This standard requires that stacks be octaword aligned at the time a new procedure is invoked.
However:
- the "normal" kernel stack is always misaligned by 8 bytes, thanks to the odd number of 64-bit words in 'struct pt_regs', which is the very first thing pushed onto the kernel thread stack;
- syscall, fault, interrupt etc. handlers may, or may not, receive aligned stack depending on numerous factors.
Somehow we got away with it until recently, when we ended up with a stack corruption in kernel/smp.c:smp_call_function_single() due to its use of 32-byte aligned local data and the compiler doing clever things allocating it on the stack.
This adds padding between the PAL-saved and kernel-saved registers so that 'struct pt_regs' have an even number of 64-bit words. This makes the stack properly aligned for most of the kernel code, except two handlers which need special threatment.
Note: struct pt_regs doesn't belong in uapi/asm; this should be fixed, but let's put this off until later.
--- arch/alpha/include/uapi/asm/ptrace.h | 2 ++ 1 file changed, 2 insertions(+)
arch/alpha/include/uapi/asm/ptrace.h +2 -0
@@ -42,6 +42,8 @@ struct pt_regs {unsigned long trap_a0;unsigned long trap_a1;unsigned long trap_a2; +/* This makes the stack 16-byte aligned as GCC expects */ +unsigned long __pad0;/* These are saved by PAL-code: */ unsigned long ps;unsigned long pc;
Greg Kroah-Hartman
maintainerPATCH 135/230 wifi: ath12k: fix handling of 6 GHz rules
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aditya Kumar Singh <[email protected]>
commit 64a1ba4072b34af1b76bf15fca5c2075b8cc4d64 upstream.
In the US country code, to avoid including 6 GHz rules in the 5 GHz rules list, the number of 5 GHz rules is set to a default constant value of 4 (REG_US_5G_NUM_REG_RULES). However, if there are more than 4 valid 5 GHz rules, the current logic will bypass the legitimate 6 GHz rules.
For example, if there are 5 valid 5 GHz rules and 1 valid 6 GHz rule, the current logic will only consider 4 of the 5 GHz rules, treating the last valid rule as a 6 GHz rule. Consequently, the actual 6 GHz rule is never processed, leading to the eventual disabling of 6 GHz channels.
To fix this issue, instead of hardcoding the value to 4, use a helper function to determine the number of 6 GHz rules present in the 5 GHz rules list and ignore only those rules.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1
--- drivers/net/wireless/ath/ath12k/wmi.c | 61 +++++++++++++++++++++++++--------- drivers/net/wireless/ath/ath12k/wmi.h | 1 2 files changed, 45 insertions(+), 17 deletions(-)
drivers/net/wireless/ath/ath12k/wmi.c +45 -16
@@ -4681,6 +4681,22 @@ static struct ath12k_reg_rulereturn reg_rule_ptr; } +static u8 ath12k_wmi_ignore_num_extra_rules (struct ath12k_wmi_reg_rule_ext_params *rule, +u32 num_reg_rules) +{ +u8 num_invalid_5ghz_rules =0 ; +u32 count, start_freq; + +for (count =0 ; count < num_reg_rules; count++) { + start_freq =le32_get_bits (rule[count].freq_info,REG_RULE_START_FREQ ); + +if (start_freq >=ATH12K_MIN_6G_FREQ ) + num_invalid_5ghz_rules++; + } + +return num_invalid_5ghz_rules; +} +static int ath12k_pull_reg_chan_list_ext_update_ev (struct ath12k_base *ab,struct sk_buff *skb,struct ath12k_reg_info *reg_info)
@@ -4691,6 +4707,7 @@ static int ath12k_pull_reg_chan_list_extu32 num_2g_reg_rules, num_5g_reg_rules;u32 num_6g_reg_rules_ap[WMI_REG_CURRENT_MAX_AP_TYPE ];u32 num_6g_reg_rules_cl[WMI_REG_CURRENT_MAX_AP_TYPE ][WMI_REG_MAX_CLIENT_TYPE ]; +u8 num_invalid_5ghz_ext_rules;u32 total_reg_rules =0 ;int ret, i, j;
@@ -4784,20 +4801,6 @@ static int ath12k_pull_reg_chan_list_extmemcpy (reg_info->alpha2, &ev->alpha2,REG_ALPHA2_LEN ); -/* FIXME: Currently FW includes 6G reg rule also in 5G rule -* list for country US. -* Having same 6G reg rule in 5G and 6G rules list causes -* intersect check to be true, and same rules will be shown -* multiple times in iw cmd. So added hack below to avoid -* parsing 6G rule from 5G reg rule list, and this can be -* removed later, after FW updates to remove 6G reg rule -* from 5G rules list. -*/ -if (memcmp (reg_info->alpha2,"US" ,2 ) ==0 ) { - reg_info->num_5g_reg_rules =REG_US_5G_NUM_REG_RULES ; - num_5g_reg_rules = reg_info->num_5g_reg_rules; - } - reg_info->dfs_region =le32_to_cpu (ev->dfs_region); reg_info->phybitmap =le32_to_cpu (ev->phybitmap); reg_info->num_phy =le32_to_cpu (ev->num_phy);
@@ -4900,8 +4903,29 @@ static int ath12k_pull_reg_chan_list_ext } } + ext_wmi_reg_rule += num_2g_reg_rules; + +/* Firmware might include 6 GHz reg rule in 5 GHz rule list +* for few countries along with separate 6 GHz rule. +* Having same 6 GHz reg rule in 5 GHz and 6 GHz rules list +* causes intersect check to be true, and same rules will be +* shown multiple times in iw cmd. +* Hence, avoid parsing 6 GHz rule from 5 GHz reg rule list +*/ + num_invalid_5ghz_ext_rules =ath12k_wmi_ignore_num_extra_rules (ext_wmi_reg_rule, + num_5g_reg_rules); + +if (num_invalid_5ghz_ext_rules) { +ath12k_dbg (ab,ATH12K_DBG_WMI , +"CC: %s 5 GHz reg rules number %d from fw, %d number of invalid 5 GHz rules" , + reg_info->alpha2, reg_info->num_5g_reg_rules, + num_invalid_5ghz_ext_rules); + + num_5g_reg_rules = num_5g_reg_rules - num_invalid_5ghz_ext_rules; + reg_info->num_5g_reg_rules = num_5g_reg_rules; + } +if (num_5g_reg_rules) { - ext_wmi_reg_rule += num_2g_reg_rules; reg_info->reg_rules_5g_ptr =create_ext_reg_rules_from_wmi (num_5g_reg_rules, ext_wmi_reg_rule);
@@ -4913,7 +4937,12 @@ static int ath12k_pull_reg_chan_list_ext } } - ext_wmi_reg_rule += num_5g_reg_rules; +/* We have adjusted the number of 5 GHz reg rules above. But still those +* many rules needs to be adjusted in ext_wmi_reg_rule. +* +* NOTE: num_invalid_5ghz_ext_rules will be 0 for rest other cases. +*/ + ext_wmi_reg_rule += (num_5g_reg_rules + num_invalid_5ghz_ext_rules);for (i =0 ; i <WMI_REG_CURRENT_MAX_AP_TYPE ; i++) { reg_info->reg_rules_6g_ap_ptr[i] =
drivers/net/wireless/ath/ath12k/wmi.h +0 -1
@@ -3943,7 +3943,6 @@ struct ath12k_wmi_eht_rate_set_params {#define MAX_REG_RULES 10#define REG_ALPHA2_LEN 2#define MAX_6G_REG_RULES 5 -#define REG_US_5G_NUM_REG_RULES 4enum wmi_start_event_param {WMI_VDEV_START_RESP_EVENT =0 ,
Greg Kroah-Hartman
maintainerPATCH 136/230 PCI: Avoid FLR for Mediatek MT7922 WiFi
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjorn Helgaas <[email protected]>
commit 81f64e925c29fe6e99f04b131fac1935ac931e81 upstream.
The Mediatek MT7922 WiFi device advertises FLR support, but it apparently does not work, and all subsequent config reads return ~0:
pci 0000:01:00.0: [14c3:0616] type 00 class 0x028000 PCIe Endpoint pciback 0000:01:00.0: not ready 65535ms after FLR; giving up
After an FLR, pci_dev_wait() waits for the device to become ready. Prior to d591f6804e7e ("PCI: Wait for device readiness with Configuration RRS"), it polls PCI_COMMAND until it is something other that PCI_POSSIBLE_ERROR (~0). If it times out, pci_dev_wait() returns -ENOTTY and __pci_reset_function_locked() tries the next available reset method. Typically this is Secondary Bus Reset, which does work, so the MT7922 is eventually usable.
After d591f6804e7e, if Configuration Request Retry Status Software Visibility (RRS SV) is enabled, pci_dev_wait() polls PCI_VENDOR_ID until it is something other than the special 0x0001 Vendor ID that indicates a completion with RRS status.
When RRS SV is enabled, reads of PCI_VENDOR_ID should return either 0x0001, i.e., the config read was completed with RRS, or a valid Vendor ID. On the MT7922, it seems that all config reads after FLR return ~0 indefinitely. When pci_dev_wait() reads PCI_VENDOR_ID and gets 0xffff, it assumes that's a valid Vendor ID and the device is now ready, so it returns with success.
After pci_dev_wait() returns success, we restore config space and continue. Since the MT7922 is not actually ready after the FLR, the restore fails and the device is unusable.
We considered changing pci_dev_wait() to continue polling if a PCI_VENDOR_ID read returns either 0x0001 or 0xffff. This "works" as it did before d591f6804e7e, although we have to wait for the timeout and then fall back to SBR. But it doesn't work for SR-IOV VFs, which *always* return 0xffff as the Vendor ID.
Mark Mediatek MT7922 WiFi devices to avoid the use of FLR completely. This will cause fallback to another reset method, such as SBR.
--- drivers/pci/quirks.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/pci/quirks.c +2 -1
@@ -5522,7 +5522,7 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_IN* AMD Matisse USB 3.0 Host Controller 0x149c * Intel 82579LM Gigabit Ethernet Controller 0x1502 * Intel 82579V Gigabit Ethernet Controller 0x1503 -* +* Mediatek MT7922 802.11ax PCI Express Wireless Network Adapter */ static void quirk_no_flr (struct pci_dev *dev) {
@@ -5534,6 +5534,7 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMDECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_AMD ,0x7901 , quirk_no_flr);DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_INTEL ,0x1502 , quirk_no_flr);DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_INTEL ,0x1503 , quirk_no_flr); +DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_MEDIATEK ,0x0616 , quirk_no_flr);/* FLR may cause the SolidRun SNET DPU (rev 0x1) to hang */ static void quirk_no_flr_snet (struct pci_dev *dev)
Greg Kroah-Hartman
maintainerPATCH 137/230 kbuild: userprogs: fix bitsize and target detection on clang
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
commit 1b71c2fb04e7a713abc6edde4a412416ff3158f2 upstream.
scripts/Makefile.clang was changed in the linked commit to move --target from KBUILD_CFLAGS to KBUILD_CPPFLAGS, as that generally has a broader scope. However that variable is not inspected by the userprogs logic, breaking cross compilation on clang.
Use both variables to detect bitsize and target arguments for userprogs.
--- Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
Makefile +2 -2
@@ -1057,8 +1057,8 @@ LDFLAGS_vmlinux += --orphan-handling=$(C endif # Align the bit size of userspace programs with the kernel -KBUILD_USERCFLAGS += $(filter -m32 -m64 --target=%, $(KBUILD_CFLAGS)) -KBUILD_USERLDFLAGS += $(filter -m32 -m64 --target=%, $(KBUILD_CFLAGS)) +KBUILD_USERCFLAGS += $(filter -m32 -m64 --target=%, $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS)) +KBUILD_USERLDFLAGS += $(filter -m32 -m64 --target=%, $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS)) # make the checker run with the right architecture CHECKFLAGS += --arch=$(ARCH)
Greg Kroah-Hartman
maintainerPATCH 138/230 efi: Avoid cold plugged memory for placing the kernel
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <[email protected]>
commit ba69e0750b0362870294adab09339a0c39c3beaf upstream.
UEFI 2.11 introduced EFI_MEMORY_HOT_PLUGGABLE to annotate system memory regions that are 'cold plugged' at boot, i.e., hot pluggable memory that is available from early boot, and described as system RAM by the firmware.
Existing loaders and EFI applications running in the boot context will happily use this memory for allocating data structures that cannot be freed or moved at runtime, and this prevents the memory from being unplugged. Going forward, the new EFI_MEMORY_HOT_PLUGGABLE attribute should be tested, and memory annotated as such should be avoided for such allocations.
In the EFI stub, there are a couple of occurrences where, instead of the high-level AllocatePages() UEFI boot service, a low-level code sequence is used that traverses the EFI memory map and carves out the requested number of pages from a free region. This is needed, e.g., for allocating as low as possible, or for allocating pages at random.
While AllocatePages() should presumably avoid special purpose memory and cold plugged regions, this manual approach needs to incorporate this logic itself, in order to prevent the kernel itself from ending up in a hot unpluggable region, preventing it from being unplugged.
So add the EFI_MEMORY_HOTPLUGGABLE macro definition, and check for it where appropriate.
--- drivers/firmware/efi/efi.c | 6 ++++-- drivers/firmware/efi/libstub/randomalloc.c | 3 +++ drivers/firmware/efi/libstub/relocate.c | 3 +++ include/linux/efi.h | 1 + 4 files changed, 11 insertions(+), 2 deletions(-)
drivers/firmware/efi/efi.c +4 -2
@@ -922,13 +922,15 @@ char * __init efi_md_typeattr_format(chaEFI_MEMORY_WB |EFI_MEMORY_UCE |EFI_MEMORY_RO |EFI_MEMORY_WP |EFI_MEMORY_RP |EFI_MEMORY_XP |EFI_MEMORY_NV |EFI_MEMORY_SP |EFI_MEMORY_CPU_CRYPTO | - EFI_MEMORY_RUNTIME | EFI_MEMORY_MORE_RELIABLE)) +EFI_MEMORY_MORE_RELIABLE |EFI_MEMORY_HOT_PLUGGABLE | + EFI_MEMORY_RUNTIME)) snprintf(pos, size, "|attr=0x%016llx]", (unsigned long long)attr); else snprintf(pos, size, -"|%3s|%2s|%2s|%2s|%2s|%2s|%2s|%2s|%2s|%3s|%2s|%2s|%2s|%2s]" , +"|%3s|%2s|%2s|%2s|%2s|%2s|%2s|%2s|%2s|%2s|%3s|%2s|%2s|%2s|%2s]" , attr &EFI_MEMORY_RUNTIME ?"RUN" :"" , + attr &EFI_MEMORY_HOT_PLUGGABLE ?"HP" :"" , attr &EFI_MEMORY_MORE_RELIABLE ?"MR" :"" , attr &EFI_MEMORY_CPU_CRYPTO ?"CC" :"" , attr & EFI_MEMORY_SP ? "SP" : "",
drivers/firmware/efi/libstub/randomalloc.c +3 -0
@@ -25,6 +25,9 @@ static unsigned long get_entry_num_slotsif (md->type !=EFI_CONVENTIONAL_MEMORY )return 0 ; +if (md->attribute &EFI_MEMORY_HOT_PLUGGABLE ) +return 0 ; +if (efi_soft_reserve_enabled () && (md->attribute &EFI_MEMORY_SP ))return 0 ;
drivers/firmware/efi/libstub/relocate.c +3 -0
@@ -53,6 +53,9 @@ efi_status_t efi_low_alloc_above(unsigneif (desc->type !=EFI_CONVENTIONAL_MEMORY )continue ; +if (desc->attribute &EFI_MEMORY_HOT_PLUGGABLE ) +continue ; +if (efi_soft_reserve_enabled () && (desc->attribute &EFI_MEMORY_SP ))continue ;
include/linux/efi.h +1 -0
@@ -128,6 +128,7 @@ typedef struct {#define EFI_MEMORY_RO ((u64)0x0000000000020000ULL)/* read-only */ #define EFI_MEMORY_SP ((u64)0x0000000000040000ULL)/* soft reserved */ #define EFI_MEMORY_CPU_CRYPTO ((u64)0x0000000000080000ULL)/* supports encryption */ +#define EFI_MEMORY_HOT_PLUGGABLE BIT_ULL(20)/* supports unplugging at runtime */ #define EFI_MEMORY_RUNTIME ((u64)0x8000000000000000ULL)/* range requires runtime mapping */ #define EFI_MEMORY_DESCRIPTOR_VERSION 1
Greg Kroah-Hartman
maintainerPATCH 139/230 arm64: rust: clean Rust 1.85.0 warning using softfloat target
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miguel Ojeda <[email protected]>
commit 446a8351f160d65a1c5df7097f31c74102ed2bb1 upstream.
Starting with Rust 1.85.0 (to be released 2025-02-20), rustc warns
[1] about disabling neon in the aarch64 hardfloat target:
warning: target feature neon cannot be toggled with
-Ctarget-feature: unsound on hard-float targets because it changes float ABI
|
= note: this was previously accepted by the compiler but
is being phased out; it will become a hard error in a future release!
= note: for more information, see issue #116344
<https://github.com/rust-lang/rust/issues/116344>
Thus, instead, use the softfloat target instead.
While trying it out, I found that the kernel sanitizers were not enabled for that built-in target [2]. Upstream Rust agreed to backport the enablement for the current beta so that it is ready for the 1.85.0 release [3] -- thanks!
However, that still means that before Rust 1.85.0, we cannot switch since sanitizers could be in use. Thus conditionally do so.
--- arch/arm64/Makefile | 4 ++++ 1 file changed, 4 insertions(+)
arch/arm64/Makefile +4 -0
@@ -48,7 +48,11 @@ KBUILD_CFLAGS += $(CC_FLAGS_NO_FPU) \ KBUILD_CFLAGS += $(call cc-disable-warning, psabi) KBUILD_AFLAGS += $(compat_vdso) +ifeq ($(call test-ge, $(CONFIG_RUSTC_VERSION), 108500),y) +KBUILD_RUSTFLAGS += --target=aarch64-unknown-none-softfloat +else KBUILD_RUSTFLAGS += --target=aarch64-unknown-none -Ctarget-feature="-neon" +endif KBUILD_CFLAGS += $(call cc-option,-mabi=lp64) KBUILD_AFLAGS += $(call cc-option,-mabi=lp64)
Signature · 1 line
2.48.1
Greg Kroah-Hartman
maintainerPATCH 140/230 objtool/rust: add one more `noreturn` Rust function
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miguel Ojeda <[email protected]>
commit cee6f9a9c87b6ecfb51845950c28216b231c3610 upstream.
Starting with Rust 1.85.0 (currently in beta, to be released 2025-02-20), under some kernel configurations with CONFIG_RUST_DEBUG_ASSERTIONS=y, one may trigger a new objtool warning:
rust/kernel.o: warning: objtool: _R...securityNtB2_11SecurityCtx8as_bytes() falls through to next function _R...core3ops4drop4Drop4drop()
due to a call to the noreturn symbol:
core::panicking::assert_failed::<usize, usize>
Thus add it to the list so that objtool knows it is actually noreturn. Do so matching with strstr since it is a generic.
See commit 56d680dd23c3 ("objtool/rust: list noreturn Rust functions") for more details.
--- tools/objtool/check.c | 1 + 1 file changed, 1 insertion(+)
tools/objtool/check.c +1 -0
@@ -218,6 +218,7 @@ static bool is_rust_noreturn(const strucstr_ends_with (func->name,"_4core9panicking18panic_bounds_check" ) ||str_ends_with (func->name,"_4core9panicking19assert_failed_inner" ) ||str_ends_with (func->name,"_4core9panicking36panic_misaligned_pointer_dereference" ) || +strstr (func->name,"_4core9panicking13assert_failed" ) ||strstr (func->name,"_4core9panicking11panic_const24panic_const_" ) || (strstr (func->name,"_4core5slice5index24slice_" ) &&str_ends_with (func->name,"_fail" ));
Greg Kroah-Hartman
maintainerPATCH 141/230 rust: rbtree: fix overindented list item
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miguel Ojeda <[email protected]>
commit 2e4f982cf392af2f1282b5537a72144e064799e3 upstream.
Starting with Rust 1.86.0 (to be released 2025-04-03), Clippy will have a new lint, doc_overindented_list_items [1], which catches cases of overindented list items.
The lint has been added by Yutaro Ohno, based on feedback from the kernel
[2] on a patch that fixed a similar case -- commit 0c5928deada1 ("rust:
block: fix formatting in GenDisk doc").
Clippy reports a few cases in the kernel, apart from the one already fixed in the commit above. One is this one:
error: doc list item overindented
--> rust/kernel/rbtree.rs:1152:5
|
1152 | /// null, it is a pointer to the root of the [RBTree].
| ^^^^ help: try using ` ` (2 spaces)
|
= help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#doc_overindented_list_items
= note: -D clippy::doc-overindented-list-items implied by -D warnings
= help: to override -D warnings add #[allow(clippy::doc_overindented_list_items)]
Thus clean it up.
--- rust/kernel/rbtree.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
rust/kernel/rbtree.rs +1 -1
@@ -1147,7 +1147,7 @@ pub struct VacantEntry<'a, K, V> {/// # Invariants /// - `parent` may be null if the new node becomes the root. /// - `child_field_of_parent` is a valid pointer to the left-child or right-child of `parent`. If `parent` is -/// null, it is a pointer to the root of the [`RBTree`]. +/// null, it is a pointer to the root of the [`RBTree`]. struct RawVacantEntry <'a,K ,V > { rbtree: *mut RBTree <K ,V >,/// The node that will become the parent of the new node if we insert one.
Greg Kroah-Hartman
maintainerPATCH 142/230 cgroup: fix race between fork and cgroup.kill
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shakeel Butt <[email protected]>
commit b69bb476dee99d564d65d418e9a20acca6f32c3f upstream.
Tejun reported the following race between fork() and cgroup.kill at [1].
Tejun:
I was looking at cgroup.kill implementation and wondering whether there could be a race window. So, __cgroup_kill() does the following:
k1. Set CGRP_KILL.
k2. Iterate tasks and deliver SIGKILL.
k3. Clear CGRP_KILL.
The copy_process() does the following:
c1. Copy a bunch of stuff.
c2. Grab siglock.
c3. Check fatal_signal_pending().
c4. Commit to forking.
c5. Release siglock.
c6. Call cgroup_post_fork() which puts the task on the css_set and tests
CGRP_KILL.
The intention seems to be that either a forking task gets SIGKILL and terminates on c3 or it sees CGRP_KILL on c6 and kills the child. However, I don't see what guarantees that k3 can't happen before c6. ie. After a forking task passes c5, k2 can take place and then before the forking task reaches c6, k3 can happen. Then, nobody would send SIGKILL to the child. What am I missing?
This is indeed a race. One way to fix this race is by taking cgroup_threadgroup_rwsem in write mode in __cgroup_kill() as the fork() side takes cgroup_threadgroup_rwsem in read mode from cgroup_can_fork() to cgroup_post_fork(). However that would be heavy handed as this adds one more potential stall scenario for cgroup.kill which is usually called under extreme situation like memory pressure.
To fix this race, let's maintain a sequence number per cgroup which gets incremented on __cgroup_kill() call. On the fork() side, the cgroup_can_fork() will cache the sequence number locally and recheck it against the cgroup's sequence number at cgroup_post_fork() site. If the sequence numbers mismatch, it means __cgroup_kill() can been called and we should send SIGKILL to the newly created task.
--- include/linux/cgroup-defs.h | 6 +++--- include/linux/sched/task.h | 1 + kernel/cgroup/cgroup.c | 20 ++++++++++++-------- 3 files changed, 16 insertions(+), 11 deletions(-)
include/linux/cgroup-defs.h +3 -3
@@ -71,9 +71,6 @@ enum {/* Cgroup is frozen. */ CGRP_FROZEN, - -/* Control group has to be killed. */ - CGRP_KILL, };/* cgroup_root->flags */
@@ -460,6 +457,9 @@ struct cgroup {int nr_threaded_children;/* # of live threaded child cgroups */ +/* sequence number for cgroup.kill, serialized by css_set_lock. */ +unsigned int kill_seq; +struct kernfs_node *kn;/* cgroup kernfs entry */ struct cgroup_file procs_file;/* handle for "cgroup.procs" */ struct cgroup_file events_file;/* handle for "cgroup.events" */
include/linux/sched/task.h +1 -0
@@ -43,6 +43,7 @@ struct kernel_clone_args {void *fn_arg;struct cgroup *cgrp;struct css_set *cset; +unsigned int kill_seq; };/*
kernel/cgroup/cgroup.c +12 -8
@@ -4013,7 +4013,7 @@ static void __cgroup_kill(struct cgrouplockdep_assert_held (&cgroup_mutex);spin_lock_irq (&css_set_lock); -set_bit (CGRP_KILL , &cgrp->flags); + cgrp->kill_seq++;spin_unlock_irq (&css_set_lock);css_task_iter_start (&cgrp->self,CSS_TASK_ITER_PROCS |CSS_TASK_ITER_THREADED , &it);
@@ -4029,10 +4029,6 @@ static void __cgroup_kill(struct cgroupsend_sig (SIGKILL , task,0 ); }css_task_iter_end (&it); - -spin_lock_irq (&css_set_lock); -clear_bit (CGRP_KILL , &cgrp->flags); -spin_unlock_irq (&css_set_lock); }static void cgroup_kill (struct cgroup *cgrp)
@@ -6489,6 +6485,10 @@ static int cgroup_css_set_fork(struct kespin_lock_irq (&css_set_lock); cset =task_css_set (current);get_css_set (cset); +if (kargs->cgrp) + kargs->kill_seq = kargs->cgrp->kill_seq; +else + kargs->kill_seq = cset->dfl_cgrp->kill_seq;spin_unlock_irq (&css_set_lock);if (!(kargs->flags &CLONE_INTO_CGROUP )) {
@@ -6672,6 +6672,7 @@ void cgroup_post_fork(struct task_struct struct kernel_clone_args *kargs) __releases(&cgroup_threadgroup_rwsem) __releases(&cgroup_mutex) { + unsigned int cgrp_kill_seq = 0; unsigned long cgrp_flags = 0; bool kill = false; struct cgroup_subsys *ss;
@@ -6685,10 +6686,13 @@ void cgroup_post_fork(struct task_struct/* init tasks are special, only link regular threads */ if (likely (child->pid)) { -if (kargs->cgrp) +if (kargs->cgrp) { cgrp_flags = kargs->cgrp->flags; -else + cgrp_kill_seq = kargs->cgrp->kill_seq; + }else { cgrp_flags = cset->dfl_cgrp->flags; + cgrp_kill_seq = cset->dfl_cgrp->kill_seq; + }WARN_ON_ONCE (!list_empty (&child->cg_list)); cset->nr_tasks++;
@@ -6723,7 +6727,7 @@ void cgroup_post_fork(struct task_struct* child down right after we finished preparing it for * userspace. */ - kill =test_bit (CGRP_KILL , &cgrp_flags); + kill = kargs->kill_seq != cgrp_kill_seq; }spin_unlock_irq (&css_set_lock);
Greg Kroah-Hartman
maintainerPATCH 143/230 serial: port: Assign ->iotype correctly when ->iobase is set
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
commit 166ac2bba167d575e7146beaa66093bc7c072f43 upstream.
Currently the ->iotype is always assigned to the UPIO_MEM when the respective property is not found. However, this will not support the cases when user wants to have UPIO_PORT to be set or preserved. Support this scenario by checking ->iobase value and default the ->iotype respectively.
--- drivers/tty/serial/serial_port.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/tty/serial/serial_port.c +2 -1
@@ -173,6 +173,7 @@ EXPORT_SYMBOL(uart_remove_one_port);* The caller is responsible to initialize the following fields of the @port * ->dev (must be valid) * ->flags +* ->iobase * ->mapbase * ->mapsize * ->regshift (if @use_defaults is false)
@@ -214,7 +215,7 @@ static int __uart_read_properties(struct/* Read the registers I/O access type (default: MMIO 8-bit) */ ret =device_property_read_u32 (dev,"reg-io-width" , &value);if (ret) { - port->iotype =UPIO_MEM ; + port->iotype = port->iobase ?UPIO_PORT :UPIO_MEM ; }else {switch (value) {case 1 :
Greg Kroah-Hartman
maintainerPATCH 144/230 serial: port: Always update ->iotype in __uart_read_properties()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
commit e8486bd50ecf63c9a1e25271f258a8d959f2672f upstream.
The documentation of the __uart_read_properties() states that ->iotype member is always altered after the function call, but the code doesn't do that in the case when use_defaults == false and the value of reg-io-width is unsupported. Make sure the code follows the documentation.
Note, the current users of the uart_read_and_validate_port_properties() will fail and the change doesn't affect their behaviour, neither users of uart_read_port_properties() will be affected since the alteration happens there even in the current code flow.
--- drivers/tty/serial/serial_port.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/serial/serial_port.c +1 -1
@@ -228,11 +228,11 @@ static int __uart_read_properties(struct port->iotype =device_is_big_endian (dev) ?UPIO_MEM32BE :UPIO_MEM32 ;break ;default : + port->iotype =UPIO_UNKNOWN ;if (!use_defaults) {dev_err (dev,"Unsupported reg-io-width (%u)\n" , value);return -EINVAL ; } - port->iotype =UPIO_UNKNOWN ;break ; } }