6.13.7-rc1 review
Subsystems (4)
Greg Kroah-Hartman
maintainercover 6.13.7-rc1 review
This is the start of the stable review cycle for the 6.13.7 release. There are 207 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 12 Mar 2025 17:04:00 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.13.7-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.13.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.13.7-rc1
Maurizio Lombardi <[email protected]>
nvme-tcp: Fix a C2HTermReq error message
Arnd Bergmann <[email protected]>
ALSA: hda: realtek: fix incorrect IS_REACHABLE() usage
Steven Rostedt <[email protected]>
fprobe: Fix accounting of when to unregister from function graph
Steven Rostedt <[email protected]>
fprobe: Always unregister fgraph function from ops
Lukas Bulwahn <[email protected]>
arm64: Kconfig: Remove selecting replaced HAVE_FUNCTION_GRAPH_RETVAL
Arnd Bergmann <[email protected]>
kbuild: hdrcheck: fix cross build with clang
Angelo Dureghello <[email protected]>
iio: adc: ad7606: fix wrong scale available
Angelo Dureghello <[email protected]>
dt-bindings: iio: dac: adi-axi-adc: fix ad7606 pwm-names
Ricardo Ribalda <[email protected]>
iio: hid-sensor-prox: Split difference from multiple channels
Ryan Roberts <[email protected]>
arm64: hugetlb: Fix huge_ptep_get_and_clear() for non-present ptes
Ryan Roberts <[email protected]>
mm: hugetlb: Add huge page size param to huge_ptep_get_and_clear()
Nayab Sayed <[email protected]>
iio: adc: at91-sama5d2_adc: fix sama7g5 realbits value
Markus Burri <[email protected]>
iio: adc: ad7192: fix channel select
Angelo Dureghello <[email protected]>
iio: dac: ad3552r: clear reset status flag
Javier Carrasco <[email protected]>
iio: light: apds9306: fix max_scale_nano values
Sam Winchenbach <[email protected]>
iio: filter: admv8818: Force initialization of SDO
Haoyu Li <[email protected]>
drivers: virt: acrn: hsm: Use kzalloc to avoid info leak in pmcmd_ioctl
Andy Shevchenko <[email protected]>
eeprom: digsy_mtc: Make GPIO lookup table match the device
Manivannan Sadhasivam <[email protected]>
bus: mhi: host: pci_generic: Use pci_try_reset_function() to avoid deadlock
Visweswara Tanuku <[email protected]>
slimbus: messaging: Free transaction ID in delayed interrupt scenario
Luca Ceresoli <[email protected]>
drivers: core: fix device leak in __fw_devlink_relax_cycles()
Thadeu Lima de Souza Cascardo <[email protected]>
char: misc: deallocate static minor in error path
Alexander Shishkin <[email protected]>
intel_th: pci: Add Panther Lake-P/U support
Alexander Shishkin <[email protected]>
intel_th: pci: Add Panther Lake-H support
Pawel Chmielewski <[email protected]>
intel_th: pci: Add Arrow Lake support
Hans de Goede <[email protected]>
mei: vsc: Use "wakeuphostint" when getting the host wakeup GPIO
Alexander Usyskin <[email protected]>
mei: me: add panther lake P DID
Qiu-ji Chen <[email protected]>
cdx: Fix possible UAF error in driver_override_show()
Xiaoyao Li <[email protected]>
KVM: x86: Explicitly zero EAX and EBX when PERFMON_V2 isn't supported by KVM
Sean Christopherson <[email protected]>
KVM: x86: Snapshot the host's DEBUGCTL after disabling IRQs
Sean Christopherson <[email protected]>
KVM: SVM: Manually context switch DEBUGCTL if LBR virtualization is disabled
Sean Christopherson <[email protected]>
KVM: x86: Snapshot the host's DEBUGCTL in common x86
Sean Christopherson <[email protected]>
KVM: SVM: Suppress DEBUGCTL.BTF on AMD
Sean Christopherson <[email protected]>
KVM: SVM: Drop DEBUGCTL[5:2] from guest's effective value
Sean Christopherson <[email protected]>
KVM: SVM: Save host DR masks on CPUs with DebugSwap
Sean Christopherson <[email protected]>
KVM: SVM: Set RFLAGS.IF=1 in C code, to get VMRUN out of the STI shadow
Christian A. Ehrhardt <[email protected]>
acpi: typec: ucsi: Introduce a ->poll_cci method
Thomas Weißschuh <[email protected]>
kbuild: userprogs: use correct lld when linking through clang
Prashanth K <[email protected]>
usb: gadget: Check bmAttributes only if configuration is valid
Marek Szyprowski <[email protected]>
usb: gadget: Fix setting self-powered state on suspend
Prashanth K <[email protected]>
usb: gadget: Set self-powered based on MaxPower and bmAttributes
AngeloGioacchino Del Regno <[email protected]>
usb: typec: tcpci_rt1711h: Unmask alert interrupts to fix functionality
Fedor Pchelkin <[email protected]>
usb: typec: ucsi: increase timeout for PPM reset operations
Badhri Jagan Sridharan <[email protected]>
usb: dwc3: gadget: Prevent irq storm when TH re-executes
Thinh Nguyen <[email protected]>
usb: dwc3: Set SUSPENDENABLE soon after phy init
Nikita Zhandarovich <[email protected]>
usb: atm: cxacru: fix a flaw in existing endpoint checks
Prashanth K <[email protected]>
usb: gadget: u_ether: Set is_suspend flag if remote wakeup fails
Michal Pecio <[email protected]>
usb: xhci: Enable the TRB overfetch quirk on VIA VL805
Claudiu Beznea <[email protected]>
usb: renesas_usbhs: Flush the notify_hotplug_work
Andrei Kuchynski <[email protected]>
usb: typec: ucsi: Fix NULL pointer access
Michal Pecio <[email protected]>
usb: xhci: Fix host controllers "dying" after suspend and resume
Miao Li <[email protected]>
usb: quirks: Add DELAY_INIT and NO_LPM for Prolific Mass Storage Card Reader
Pawel Laszczak <[email protected]>
usb: hub: lack of clearing xHC resources
Claudiu Beznea <[email protected]>
usb: renesas_usbhs: Use devm_usb_get_phy()
Marc Zyngier <[email protected]>
xhci: Restrict USB4 tunnel detection for USB3 devices to Intel hosts
Claudiu Beznea <[email protected]>
usb: renesas_usbhs: Call clk_put()
Christian Heusel <[email protected]>
Revert "drivers/card_reader/rtsx_usb: Restore interrupt based detection"
Fabrizio Castro <[email protected]>
gpio: rcar: Fix missing of_node_put() call
Justin Iurman <[email protected]>
net: ipv6: fix missing dst ref drop in ila lwtunnel
Justin Iurman <[email protected]>
net: ipv6: fix dst ref loop in ila lwtunnel
Matt Johnston <[email protected]>
mctp i3c: handle NULL header address
Takashi Iwai <[email protected]>
drm/bochs: Fix DPMS regression
Lorenzo Bianconi <[email protected]>
net: dsa: mt7530: Fix traffic flooding for MMIO devices
Dan Carpenter <[email protected]>
nvme-tcp: fix signedness bug in nvme_tcp_init_connection()
Zecheng Li <[email protected]>
sched/fair: Fix potential memory corruption in child_cfs_rq_on_list
Uday Shankar <[email protected]>
ublk: set_params: properly check if parameters can be applied
Jason Xing <[email protected]>
net-timestamp: support TCP GSO case for a few missing flags
Eric Sandeen <[email protected]>
exfat: short-circuit zero-byte writes in exfat_file_write_iter
Namjae Jeon <[email protected]>
exfat: fix soft lockup in exfat_clear_bitmap
Yuezhang Mo <[email protected]>
exfat: fix just enough dentries but allocate a new cluster to dir
Jarkko Sakkinen <[email protected]>
x86/sgx: Fix size overflows in sgx_encl_create()
Oscar Maes <[email protected]>
vlan: enforce underlying device type
Maxime Chevallier <[email protected]>
net: ethtool: netlink: Allow NULL nlattrs when getting a phy_device
Jakub Kicinski <[email protected]>
net: ethtool: plumb PHY stats to PHY drivers
Oleksij Rempel <[email protected]>
ethtool: linkstate: migrate linkstate functions to support multi-PHY setups
Jiayuan Chen <[email protected]>
ppp: Fix KMSAN uninit-value warning with bpf
Luca Weiss <[email protected]>
net: ipa: Enable checksum for IPA_ENDPOINT_AP_MODEM_{RX,TX} for v4.7
Luca Weiss <[email protected]>
net: ipa: Fix QSB data for v4.7
Luca Weiss <[email protected]>
net: ipa: Fix v4.7 resource group names
Vicki Pfau <[email protected]>
HID: hid-steam: Fix use-after-free when detaching device
Maarten Lankhorst <[email protected]>
drm/xe: Remove double pageflip
Peiyang Wang <[email protected]>
net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error
Nikolay Aleksandrov <[email protected]>
be2net: fix sleeping while atomic bugs in be_ndo_bridge_getlink
Philipp Stanner <[email protected]>
drm/sched: Fix preprocessor guard
Xinghuo Chen <[email protected]>
hwmon: fix a NULL vs IS_ERR_OR_NULL() check in xgene_hwmon_probe()
Eric Dumazet <[email protected]>
llc: do not use skb_get() before dev_queue_xmit()
Murad Masimov <[email protected]>
ALSA: usx2y: validate nrpacks module parameter on probe
Alessio Belle <[email protected]>
drm/imagination: Fix timestamps in firmware traces
Masami Hiramatsu (Google) <[email protected]>
tracing: probe-events: Remove unused MAX_ARG_BUF_LEN macro
Erik Schumacher <[email protected]>
hwmon: (ad7314) Validate leading zero bits and return error
Maud Spierings <[email protected]>
hwmon: (ntc_thermistor) Fix the ncpXXxh103 sensor table
Titus Rwantare <[email protected]>
hwmon: (pmbus) Initialise page count in pmbus_identify()
Herbert Xu <[email protected]>
cred: Fix RCU warnings in override/revert_creds
Christian Brauner <[email protected]>
cred: return old creds from revert_creds_light()
Peter Zijlstra <[email protected]>
perf/core: Fix pmus_lock vs. pmus_srcu ordering
Vitaliy Shevtsov <[email protected]>
caif_virtio: fix wrong pointer check in cfv_probe()
Antoine Tenart <[email protected]>
net: gso: fix ownership in __udp_gso_segment
Antheas Kapenekakis <[email protected]>
ALSA: hda/realtek: Remove (revert) duplicate Ally X config
Meir Elisha <[email protected]>
nvmet-tcp: Fix a possible sporadic response drops in weakly ordered arch
Maurizio Lombardi <[email protected]>
nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu()
Maurizio Lombardi <[email protected]>
nvme-tcp: add basic support for the C2HTermReq PDU
Maurizio Lombardi <[email protected]>
nvmet: remove old function prototype
Salah Triki <[email protected]>
bluetooth: btusb: Initialize .owner field of force_poll_sync_fops
Dave Airlie <[email protected]>
drm/nouveau: select FW caching
Masami Hiramatsu (Google) <[email protected]>
tracing: fprobe-events: Log error for exceeding the number of entry args
Masami Hiramatsu (Google) <[email protected]>
fprobe: Rewrite fprobe on function-graph tracer
Masami Hiramatsu (Google) <[email protected]>
tracing: Add ftrace_fill_perf_regs() for perf event
Masami Hiramatsu (Google) <[email protected]>
tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs
Masami Hiramatsu (Google) <[email protected]>
fprobe: Use ftrace_regs in fprobe exit handler
Masami Hiramatsu (Google) <[email protected]>
fprobe: Use ftrace_regs in fprobe entry handler
Masami Hiramatsu (Google) <[email protected]>
fgraph: Replace fgraph_ret_regs with ftrace_regs
Johannes Berg <[email protected]>
wifi: mac80211: fix vendor-specific inheritance
Johannes Berg <[email protected]>
wifi: mac80211: fix MLE non-inheritance parsing
Ilan Peer <[email protected]>
wifi: mac80211: Support parsing EPCS ML element
Keith Busch <[email protected]>
nvme-ioctl: fix leaked requests on mapping error
Kees Cook <[email protected]>
coredump: Only sort VMAs when core_sort_vma sysctl is set
Zhang Lixu <[email protected]>
HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove()
Zhang Lixu <[email protected]>
HID: intel-ish-hid: Fix use-after-free issue in hid_ishtp_cl_remove()
Yu-Chun Lin <[email protected]>
HID: google: fix unused variable warning under !CONFIG_ACPI
Ilan Peer <[email protected]>
wifi: iwlwifi: Fix A-MSDU TSO preparation
Ilan Peer <[email protected]>
wifi: iwlwifi: Free pages allocated when failing to build A-MSDU
Johannes Berg <[email protected]>
wifi: iwlwifi: limit printed string from FW file
Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: mvm: don't try to talk to a dead firmware
Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: mvm: don't dump the firmware state upon RFKILL while suspend
Benjamin Berg <[email protected]>
wifi: iwlwifi: mvm: log error for failures after D3
Johannes Berg <[email protected]>
wifi: iwlwifi: mvm: clean up ROC on failure
Miri Korenblit <[email protected]>
wifi: iwlwifi: fw: avoid using an uninitialized variable
Ma Wupeng <[email protected]>
mm: memory-hotplug: check folio ref count first in do_migrate_range
Ma Wupeng <[email protected]>
hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio
Brian Geffon <[email protected]>
mm: fix finish_fault() handling for large folios
Ryan Roberts <[email protected]>
mm: don't skip arch_sync_kernel_mappings() in error paths
Ma Wupeng <[email protected]>
mm: memory-failure: update ttu flag inside unmap_poisoned_folio
Lorenzo Stoakes <[email protected]>
mm: abort vma_modify() on merge out of memory failure
Hao Zhang <[email protected]>
mm/page_alloc: fix uninitialized variable
Olivier Gayot <[email protected]>
block: fix conversion of GPT partition name to 7-bit
Qi Zheng <[email protected]>
arm: pgtable: fix NULL pointer dereference issue
Suren Baghdasaryan <[email protected]>
userfaultfd: do not block on locking a large folio with raised refcount
Mike Snitzer <[email protected]>
NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback
Heiko Carstens <[email protected]>
s390/traps: Fix test_monitor_call() inline assembly
Sebastian Andrzej Siewior <[email protected]>
dma: kmsan: export kmsan_handle_dma() for modules
Haoxiang Li <[email protected]>
rapidio: fix an API misues when rio_add_net() fails
Haoxiang Li <[email protected]>
rapidio: add check for rio_add_net() in rio_scan_alloc_net()
SeongJae Park <[email protected]>
selftests/damon/damon_nr_regions: sort collected regiosn before checking with min/max boundaries
SeongJae Park <[email protected]>
selftests/damon/damon_nr_regions: set ops update for merge results check to 100ms
SeongJae Park <[email protected]>
selftests/damon/damos_quota: make real expectation of quota exceeds
SeongJae Park <[email protected]>
selftests/damon/damos_quota_goal: handle minimum quota that cannot be further reduced
Vitaliy Shevtsov <[email protected]>
wifi: nl80211: reject cooked mode if it is set along with other flags
Nikita Zhandarovich <[email protected]>
wifi: cfg80211: regulatory: improve invalid hints checking
Haoxiang Li <[email protected]>
Bluetooth: Add check for mgmt_alloc_skb() in mgmt_device_connected()
Haoxiang Li <[email protected]>
Bluetooth: Add check for mgmt_alloc_skb() in mgmt_remote_name()
Thomas Hellström <[email protected]>
drm/xe/userptr: Unmap userptrs in the mmu notifier
Matthew Auld <[email protected]>
drm/xe/userptr: properly setup pfn_flags_mask
Thomas Hellström <[email protected]>
drm/xe: Fix fault mode invalidation with unbind
Tvrtko Ursulin <[email protected]>
drm/xe: Fix GT "for each engine" workarounds
Krister Johansen <[email protected]>
mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr
Thomas Hellström <[email protected]>
drm/xe/vm: Validate userptr during gpu vma prefetching
Thomas Hellström <[email protected]>
drm/xe/vm: Fix a misplaced #endif
Thomas Hellström <[email protected]>
drm/xe/hmm: Don't dereference struct page pointers without notifier lock
Thomas Hellström <[email protected]>
drm/xe/hmm: Style- and include fixes
Matthew Brost <[email protected]>
drm/xe: Add staging tree for VM binds
Ahmed S. Darwish <[email protected]>
x86/cpu: Properly parse CPUID leaf 0x2 TLB descriptor 0x63
Ahmed S. Darwish <[email protected]>
x86/cpu: Validate CPUID leaf 0x2 EDX output
Ahmed S. Darwish <[email protected]>
x86/cacheinfo: Validate CPUID leaf 0x2 EDX output
Ard Biesheuvel <[email protected]>
x86/boot: Sanitize boot params before parsing command line
Mingcong Bai <[email protected]>
platform/x86: thinkpad_acpi: Add battery quirk for ThinkPad X131e
John Hubbard <[email protected]>
Revert "selftests/mm: remove local __NR_* definitions"
Gabriel Krisman Bertazi <[email protected]>
Revert "mm/page_alloc.c: don't show protection in zone's ->lowmem_reserve[] for empty zone"
Richard Thier <[email protected]>
drm/radeon: Fix rs400_gpu_init for ATI mobility radeon Xpress 200M
Brendan King <[email protected]>
drm/imagination: only init job done fences once
Brendan King <[email protected]>
drm/imagination: Hold drm_gem_gpuva lock for unmap
Brendan King <[email protected]>
drm/imagination: avoid deadlock on fence release
Kenneth Feng <[email protected]>
drm/amd/pm: always allow ih interrupt from fw
Andrew Martin <[email protected]>
drm/amdkfd: Fix NULL Pointer Dereference in KFD queue
Ma Ke <[email protected]>
drm/amd/display: Fix null check for pipe_ctx->plane_state in resource_build_scaling_params
Paul Fertser <[email protected]>
hwmon: (peci/dimmtemp) Do not provide fake thresholds data
Nikunj A Dadhania <[email protected]>
virt: sev-guest: Allocate request data dynamically
Haoxiang Li <[email protected]>
btrfs: fix a leaked chunk map issue in read_one_chunk()
Naohiro Aota <[email protected]>
btrfs: zoned: fix extent range end unlock in cow_file_range()
Kailang Yang <[email protected]>
ALSA: hda/realtek: update ALC222 depop optimize
Kailang Yang <[email protected]>
ALSA: hda/realtek - add supported Mic Mute LED for Lenovo platform
Hoku Ishibe <[email protected]>
ALSA: hda: intel: Add Dell ALC3271 to power_save denylist
Takashi Iwai <[email protected]>
ALSA: seq: Avoid module auto-load handling at event delivery
Koichiro Den <[email protected]>
gpio: aggregator: protect driver attr handlers against module unload
Niklas Söderlund <[email protected]>
gpio: rcar: Use raw_spinlock to protect register access
Namjae Jeon <[email protected]>
ksmbd: fix bug on trap in smb2_lock
Namjae Jeon <[email protected]>
ksmbd: fix use-after-free in smb2_lock
Namjae Jeon <[email protected]>
ksmbd: fix out-of-bounds in parse_sec_desc()
Namjae Jeon <[email protected]>
ksmbd: fix type confusion via race condition when using ipc_msg_send_request
Stuart Hayhurst <[email protected]>
HID: corsair-void: Update power supply values with a unified work handler
Daniil Dulov <[email protected]>
HID: appleir: Fix potential NULL dereference at raw event handle
Bibo Mao <[email protected]>
LoongArch: KVM: Fix GPA size issue about VM
Bibo Mao <[email protected]>
LoongArch: KVM: Reload guest CSR registers after sleep
Bibo Mao <[email protected]>
LoongArch: KVM: Add interrupt checking for AVEC
Bibo Mao <[email protected]>
LoongArch: Set max_pfn with the PFN of the last page
Bibo Mao <[email protected]>
LoongArch: Set hugetlb mmap base address aligned with pmd size
Huacai Chen <[email protected]>
LoongArch: Use polling play_dead() when resuming from hibernation
Tiezhu Yang <[email protected]>
LoongArch: Convert unreachable() to BUG()
Philipp Stanner <[email protected]>
stmmac: loongson: Pass correct arg to PCI function
Masami Hiramatsu (Google) <[email protected]>
tracing: tprobe-events: Reject invalid tracepoint name
Masami Hiramatsu (Google) <[email protected]>
tracing: tprobe-events: Fix a memory leak when tprobe with $retval
Rob Herring (Arm) <[email protected]>
Revert "of: reserved-memory: Fix using wrong number of cells to get property 'alignment'"
Peter Zijlstra <[email protected]>
loongarch: Use ASM_REACHABLE
Borislav Petkov (AMD) <[email protected]>
x86/microcode/AMD: Add some forgotten models to the SHA check
Steve French <[email protected]>
smb311: failure to open files of length 1040 when mounting with SMB3.1.1 POSIX extensions
Pali Rohár <[email protected]>
cifs: Remove symlink member from cifs_open_info_data union
Yutaro Ohno <[email protected]>
rust: block: fix formatting in GenDisk doc
Andrew Cooper <[email protected]>
x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range()
-------------
Diffstat:
Documentation/admin-guide/sysctl/kernel.rst | 11 + .../devicetree/bindings/iio/adc/adi,ad7606.yaml | 1 + Makefile | 9 +- arch/arm/mm/fault-armv.c | 37 +- arch/arm64/Kconfig | 2 +- arch/arm64/include/asm/ftrace.h | 49 +- arch/arm64/include/asm/hugetlb.h | 4 +- arch/arm64/kernel/asm-offsets.c | 12 - arch/arm64/kernel/entry-ftrace.S | 32 +- arch/arm64/mm/hugetlbpage.c | 59 +- arch/loongarch/Kconfig | 3 +- arch/loongarch/include/asm/bug.h | 13 +- arch/loongarch/include/asm/ftrace.h | 32 +- arch/loongarch/include/asm/hugetlb.h | 6 +- arch/loongarch/kernel/asm-offsets.c | 12 - arch/loongarch/kernel/machine_kexec.c | 4 +- arch/loongarch/kernel/mcount.S | 17 +- arch/loongarch/kernel/mcount_dyn.S | 14 +- arch/loongarch/kernel/setup.c | 3 + arch/loongarch/kernel/smp.c | 47 +- arch/loongarch/kvm/exit.c | 6 + arch/loongarch/kvm/main.c | 7 + arch/loongarch/kvm/vcpu.c | 2 +- arch/loongarch/kvm/vm.c | 6 +- arch/loongarch/mm/mmap.c | 6 +- arch/mips/include/asm/hugetlb.h | 6 +- arch/parisc/include/asm/hugetlb.h | 2 +- arch/parisc/mm/hugetlbpage.c | 2 +- arch/powerpc/include/asm/ftrace.h | 13 + arch/powerpc/include/asm/hugetlb.h | 6 +- arch/riscv/Kconfig | 2 +- arch/riscv/include/asm/ftrace.h | 45 +- arch/riscv/include/asm/hugetlb.h | 3 +- arch/riscv/kernel/mcount.S | 24 +- arch/riscv/mm/hugetlbpage.c | 2 +- arch/s390/Kconfig | 3 +- arch/s390/include/asm/ftrace.h | 36 +- arch/s390/include/asm/hugetlb.h | 18 +- arch/s390/kernel/asm-offsets.c | 6 - arch/s390/kernel/mcount.S | 12 +- arch/s390/kernel/traps.c | 6 +- arch/s390/mm/hugetlbpage.c | 4 +- arch/sparc/include/asm/hugetlb.h | 2 +- arch/sparc/mm/hugetlbpage.c | 2 +- arch/x86/Kconfig | 3 +- arch/x86/boot/compressed/pgtable_64.c | 2 + arch/x86/include/asm/ftrace.h | 33 +- arch/x86/include/asm/kvm_host.h | 1 + arch/x86/kernel/amd_nb.c | 9 +- arch/x86/kernel/cpu/cacheinfo.c | 2 +- arch/x86/kernel/cpu/intel.c | 52 +- arch/x86/kernel/cpu/microcode/amd.c | 6 + arch/x86/kernel/cpu/sgx/ioctl.c | 7 + arch/x86/kernel/ftrace_32.S | 13 +- arch/x86/kernel/ftrace_64.S | 17 +- arch/x86/kvm/cpuid.c | 2 +- arch/x86/kvm/svm/sev.c | 13 +- arch/x86/kvm/svm/svm.c | 49 ++ arch/x86/kvm/svm/svm.h | 2 +- arch/x86/kvm/svm/vmenter.S | 10 +- arch/x86/kvm/vmx/vmx.c | 8 +- arch/x86/kvm/vmx/vmx.h | 2 - arch/x86/kvm/x86.c | 2 + block/partitions/efi.c | 2 +- drivers/base/core.c | 1 + drivers/block/ublk_drv.c | 7 +- drivers/bluetooth/btusb.c | 1 + drivers/bus/mhi/host/pci_generic.c | 5 +- drivers/cdx/cdx.c | 6 +- drivers/char/misc.c | 2 +- drivers/gpio/gpio-aggregator.c | 20 +- drivers/gpio/gpio-rcar.c | 31 +- drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 4 +- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 3 +- drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c | 12 +- drivers/gpu/drm/imagination/pvr_fw_meta.c | 6 +- drivers/gpu/drm/imagination/pvr_fw_trace.c | 4 +- drivers/gpu/drm/imagination/pvr_queue.c | 18 +- drivers/gpu/drm/imagination/pvr_queue.h | 4 + drivers/gpu/drm/imagination/pvr_vm.c | 134 ++++- drivers/gpu/drm/imagination/pvr_vm.h | 3 + drivers/gpu/drm/nouveau/Kconfig | 1 + drivers/gpu/drm/radeon/r300.c | 3 +- drivers/gpu/drm/radeon/radeon_asic.h | 1 + drivers/gpu/drm/radeon/rs400.c | 18 +- drivers/gpu/drm/scheduler/gpu_scheduler_trace.h | 4 +- drivers/gpu/drm/tiny/bochs.c | 5 +- drivers/gpu/drm/xe/display/xe_plane_initial.c | 10 - drivers/gpu/drm/xe/xe_gt.c | 4 +- drivers/gpu/drm/xe/xe_hmm.c | 194 ++++-- drivers/gpu/drm/xe/xe_hmm.h | 7 + drivers/gpu/drm/xe/xe_pt.c | 96 +-- drivers/gpu/drm/xe/xe_pt_walk.c | 3 +- drivers/gpu/drm/xe/xe_pt_walk.h | 4 + drivers/gpu/drm/xe/xe_vm.c | 100 +++- drivers/gpu/drm/xe/xe_vm.h | 10 +- drivers/gpu/drm/xe/xe_vm_types.h | 8 +- drivers/hid/hid-appleir.c | 2 +- drivers/hid/hid-corsair-void.c | 83 +-- drivers/hid/hid-google-hammer.c | 2 + drivers/hid/hid-steam.c | 2 +- drivers/hid/intel-ish-hid/ishtp-hid-client.c | 2 +- drivers/hid/intel-ish-hid/ishtp-hid.c | 4 +- drivers/hwmon/ad7314.c | 10 + drivers/hwmon/ntc_thermistor.c | 66 +-- drivers/hwmon/peci/dimmtemp.c | 10 +- drivers/hwmon/pmbus/pmbus.c | 2 + drivers/hwmon/xgene-hwmon.c | 2 +- drivers/hwtracing/intel_th/pci.c | 15 + drivers/iio/adc/ad7192.c | 2 +- drivers/iio/adc/ad7606.c | 2 +- drivers/iio/adc/at91-sama5d2_adc.c | 68 ++- drivers/iio/dac/ad3552r.c | 6 + drivers/iio/filter/admv8818.c | 14 +- drivers/iio/light/apds9306.c | 4 +- drivers/iio/light/hid-sensor-prox.c | 7 +- drivers/misc/cardreader/rtsx_usb.c | 15 - drivers/misc/eeprom/digsy_mtc_eeprom.c | 2 +- drivers/misc/mei/hw-me-regs.h | 2 + drivers/misc/mei/pci-me.c | 2 + drivers/misc/mei/vsc-tp.c | 2 +- drivers/net/caif/caif_virtio.c | 2 +- drivers/net/dsa/mt7530.c | 8 +- drivers/net/ethernet/emulex/benet/be.h | 2 +- drivers/net/ethernet/emulex/benet/be_cmds.c | 197 ++++--- drivers/net/ethernet/emulex/benet/be_main.c | 2 +- .../net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c | 2 +- .../net/ethernet/stmicro/stmmac/dwmac-loongson.c | 6 +- drivers/net/ipa/data/ipa_data-v4.7.c | 18 +- drivers/net/mctp/mctp-i3c.c | 3 + drivers/net/phy/phy.c | 43 ++ drivers/net/phy/phy_device.c | 2 + drivers/net/ppp/ppp_generic.c | 28 +- drivers/net/wireless/intel/iwlwifi/fw/dump.c | 3 + drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 77 ++- drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c | 7 + .../net/wireless/intel/iwlwifi/mvm/time-event.c | 2 + drivers/net/wireless/intel/iwlwifi/pcie/internal.h | 5 +- drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c | 6 +- drivers/net/wireless/intel/iwlwifi/pcie/tx.c | 20 +- drivers/nvme/host/ioctl.c | 12 +- drivers/nvme/host/tcp.c | 81 ++- drivers/nvme/target/nvmet.h | 1 - drivers/nvme/target/tcp.c | 15 +- drivers/of/of_reserved_mem.c | 4 +- drivers/platform/x86/thinkpad_acpi.c | 1 + drivers/rapidio/devices/rio_mport_cdev.c | 3 +- drivers/rapidio/rio-scan.c | 5 +- drivers/slimbus/messaging.c | 5 +- drivers/usb/atm/cxacru.c | 13 +- drivers/usb/core/hub.c | 33 ++ drivers/usb/core/quirks.c | 4 + drivers/usb/dwc3/core.c | 85 +-- drivers/usb/dwc3/core.h | 2 +- drivers/usb/dwc3/drd.c | 4 +- drivers/usb/dwc3/gadget.c | 10 +- drivers/usb/gadget/composite.c | 17 +- drivers/usb/gadget/function/u_ether.c | 4 +- drivers/usb/host/xhci-hub.c | 8 + drivers/usb/host/xhci-mem.c | 3 +- drivers/usb/host/xhci-pci.c | 10 +- drivers/usb/host/xhci.c | 6 +- drivers/usb/host/xhci.h | 2 +- drivers/usb/renesas_usbhs/common.c | 6 +- drivers/usb/renesas_usbhs/mod_gadget.c | 2 +- drivers/usb/typec/tcpm/tcpci_rt1711h.c | 11 + drivers/usb/typec/ucsi/ucsi.c | 25 +- drivers/usb/typec/ucsi/ucsi.h | 2 + drivers/usb/typec/ucsi/ucsi_acpi.c | 21 +- drivers/usb/typec/ucsi/ucsi_ccg.c | 1 + drivers/usb/typec/ucsi/ucsi_glink.c | 1 + drivers/usb/typec/ucsi/ucsi_stm32g0.c | 1 + drivers/usb/typec/ucsi/ucsi_yoga_c630.c | 1 + drivers/virt/acrn/hsm.c | 6 +- drivers/virt/coco/sev-guest/sev-guest.c | 24 +- fs/btrfs/inode.c | 9 +- fs/btrfs/volumes.c | 1 + fs/coredump.c | 15 +- fs/exfat/balloc.c | 10 +- fs/exfat/exfat_fs.h | 2 +- fs/exfat/fatent.c | 11 +- fs/exfat/file.c | 2 +- fs/exfat/namei.c | 2 +- fs/nfs/file.c | 3 +- fs/smb/client/cifsglob.h | 6 +- fs/smb/client/inode.c | 2 +- fs/smb/client/reparse.h | 28 +- fs/smb/client/smb1ops.c | 4 +- fs/smb/client/smb2inode.c | 4 + fs/smb/client/smb2ops.c | 3 +- fs/smb/server/smb2pdu.c | 8 +- fs/smb/server/smbacl.c | 16 + fs/smb/server/transport_ipc.c | 1 + include/asm-generic/hugetlb.h | 2 +- include/linux/compaction.h | 5 + include/linux/cred.h | 9 +- include/linux/ethtool.h | 23 + include/linux/fprobe.h | 62 +- include/linux/ftrace.h | 66 ++- include/linux/ftrace_regs.h | 2 + include/linux/hugetlb.h | 4 +- include/linux/nvme-tcp.h | 2 + include/linux/phy.h | 36 ++ include/linux/phylib_stubs.h | 42 ++ include/linux/sched.h | 2 +- kernel/events/core.c | 4 +- kernel/sched/fair.c | 6 +- kernel/trace/Kconfig | 18 +- kernel/trace/bpf_trace.c | 16 +- kernel/trace/fgraph.c | 21 +- kernel/trace/fprobe.c | 653 +++++++++++++++------ kernel/trace/trace_fprobe.c | 37 +- kernel/trace/trace_probe.h | 5 +- lib/test_fprobe.c | 51 +- mm/compaction.c | 3 + mm/hugetlb.c | 4 +- mm/internal.h | 5 +- mm/kmsan/hooks.c | 1 + mm/memory-failure.c | 63 +- mm/memory.c | 21 +- mm/memory_hotplug.c | 28 +- mm/page_alloc.c | 4 +- mm/userfaultfd.c | 17 +- mm/vma.c | 12 +- mm/vmalloc.c | 4 +- net/8021q/vlan.c | 3 +- net/bluetooth/mgmt.c | 5 + net/ethtool/cabletest.c | 8 +- net/ethtool/linkstate.c | 26 +- net/ethtool/netlink.c | 6 +- net/ethtool/netlink.h | 5 +- net/ethtool/phy.c | 2 +- net/ethtool/plca.c | 6 +- net/ethtool/pse-pd.c | 4 +- net/ethtool/stats.c | 18 + net/ethtool/strset.c | 2 +- net/ipv4/tcp_offload.c | 11 +- net/ipv4/udp_offload.c | 8 +- net/ipv6/ila/ila_lwt.c | 4 +- net/llc/llc_s_ac.c | 49 +- net/mac80211/ieee80211_i.h | 2 + net/mac80211/mlme.c | 1 + net/mac80211/parse.c | 164 ++++-- net/mptcp/pm_netlink.c | 18 +- net/wireless/nl80211.c | 5 + net/wireless/reg.c | 3 +- rust/kernel/block/mq/gen_disk.rs | 6 +- samples/fprobe/fprobe_example.c | 4 +- sound/core/seq/seq_clientmgr.c | 46 +- sound/pci/hda/Kconfig | 1 + sound/pci/hda/hda_intel.c | 2 + sound/pci/hda/patch_realtek.c | 107 +++- sound/usb/usx2y/usbusx2y.c | 11 + sound/usb/usx2y/usbusx2y.h | 26 + sound/usb/usx2y/usbusx2yaudio.c | 27 - tools/testing/selftests/damon/damon_nr_regions.py | 2 + tools/testing/selftests/damon/damos_quota.py | 9 +- tools/testing/selftests/damon/damos_quota_goal.py | 3 + tools/testing/selftests/mm/hugepage-mremap.c | 2 +- tools/testing/selftests/mm/ksm_functional_tests.c | 8 +- tools/testing/selftests/mm/memfd_secret.c | 14 +- tools/testing/selftests/mm/mkdirty.c | 8 +- tools/testing/selftests/mm/mlock2.h | 1 - tools/testing/selftests/mm/protection_keys.c | 2 +- tools/testing/selftests/mm/uffd-common.c | 4 + tools/testing/selftests/mm/uffd-stress.c | 15 +- tools/testing/selftests/mm/uffd-unit-tests.c | 14 +- usr/include/Makefile | 2 +- 269 files changed, 3214 insertions(+), 1547 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/207 x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range()
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Cooper <[email protected]>
commit 14cb5d83068ecf15d2da6f7d0e9ea9edbcbc0457 upstream.
Xen doesn't offer MSR_FAM10H_MMIO_CONF_BASE to all guests. This results in the following warning:
unchecked MSR access error: RDMSR from 0xc0010058 at rIP: 0xffffffff8101d19f (xen_do_read_msr+0x7f/0xa0)
Call Trace: xen_read_msr+0x1e/0x30 amd_get_mmconfig_range+0x2b/0x80 quirk_amd_mmconfig_area+0x28/0x100 pnp_fixup_device+0x39/0x50 __pnp_add_device+0xf/0x150 pnp_add_device+0x3d/0x100 pnpacpi_add_device_handler+0x1f9/0x280 acpi_ns_get_device_callback+0x104/0x1c0 acpi_ns_walk_namespace+0x1d0/0x260 acpi_get_devices+0x8a/0xb0 pnpacpi_init+0x50/0x80 do_one_initcall+0x46/0x2e0 kernel_init_freeable+0x1da/0x2f0 kernel_init+0x16/0x1b0 ret_from_fork+0x30/0x50 ret_from_fork_asm+0x1b/0x30
based on quirks for a "PNP0c01" device. Treating MMCFG as disabled is the right course of action, so no change is needed there.
This was most likely exposed by fixing the Xen MSR accessors to not be silently-safe.
--- arch/x86/kernel/amd_nb.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
arch/x86/kernel/amd_nb.c +3 -6
@@ -405,7 +405,6 @@ bool __init early_is_amd_nb(u32 device)struct resource *amd_get_mmconfig_range (struct resource *res) { -u32 address;u64 base, msr;unsigned int segn_busn_bits;
@@ -413,13 +412,11 @@ struct resource *amd_get_mmconfig_range( boot_cpu_data.x86_vendor != X86_VENDOR_HYGON)return NULL ; -/* assume all cpus from fam10h have mmconfig */ -if (boot_cpu_data.x86 <0x10 ) +/* Assume CPUs from Fam10h have mmconfig, although not all VMs do */ +if (boot_cpu_data.x86 <0x10 || +rdmsrl_safe (MSR_FAM10H_MMIO_CONF_BASE , &msr))return NULL ; - address =MSR_FAM10H_MMIO_CONF_BASE ; -rdmsrl (address, msr); -/* mmconfig is not enabled */ if (!(msr &FAM10H_MMIO_CONF_ENABLE ))return NULL ;
Greg Kroah-Hartman
maintainerPATCH 2/207 rust: block: fix formatting in GenDisk doc
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yutaro Ohno <[email protected]>
commit 0c5928deada15a8d075516e6e0d9ee19011bb000 upstream.
Align bullet points and improve indentation in the Invariants section of the GenDisk struct documentation for better readability.
[ Yutaro is also working on implementing the lint we suggested to catch
this sort of issue in upstream Rust:
https://github.com/rust-lang/rust-clippy/issues/13601 https://github.com/rust-lang/rust-clippy/pull/13711
Thanks a lot! - Miguel ]
--- rust/kernel/block/mq/gen_disk.rs | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
rust/kernel/block/mq/gen_disk.rs +3 -3
@@ -174,9 +174,9 @@ impl GenDiskBuilder {/// /// # Invariants /// -/// - `gendisk` must always point to an initialized and valid `struct gendisk`. -/// - `gendisk` was added to the VFS through a call to -/// `bindings::device_add_disk`. +/// - `gendisk` must always point to an initialized and valid `struct gendisk`. +/// - `gendisk` was added to the VFS through a call to +/// `bindings::device_add_disk`. pub struct GenDisk <T :Operations > { _tagset:Arc <TagSet <T >>, gendisk: *mut bindings::gendisk ,
Greg Kroah-Hartman
maintainerPATCH 3/207 cifs: Remove symlink member from cifs_open_info_data union
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pali Rohár <[email protected]>
[ Upstream commit 65c49767dd4fc058673f9259fda1772fd398eaa7 ]
Member 'symlink' is part of the union in struct cifs_open_info_data. Its value is assigned on few places, but is always read through another union member 'reparse_point'. So to make code more readable, always use only 'reparse_point' member and drop whole union structure. No function change.
Stable-dep-of: 9df23801c83d ("smb311: failure to open files of length 1040 when mounting with SMB3.1.1 POSIX extensions")
--- fs/smb/client/cifsglob.h | 5 +---- fs/smb/client/inode.c | 2 +- fs/smb/client/smb1ops.c | 4 ++-- 3 files changed, 4 insertions(+), 7 deletions(-)
fs/smb/client/cifsglob.h +1 -4
@@ -215,10 +215,7 @@ struct cifs_cred { struct cifs_open_info_data { bool adjust_tz; - union { - bool reparse_point; - bool symlink; - }; + bool reparse_point; struct { /* ioctl response buffer */ struct {
fs/smb/client/inode.c +1 -1
@@ -990,7 +990,7 @@ cifs_get_file_info(struct file *filp)/* TODO: add support to query reparse tag */ data.adjust_tz = false;if (data.symlink_target) { - data.symlink = true; + data.reparse_point = true; data.reparse.tag =IO_REPARSE_TAG_SYMLINK ; } path =build_path_from_dentry (dentry, page);
fs/smb/client/smb1ops.c +2 -2
@@ -551,7 +551,7 @@ static int cifs_query_path_info(const unsigned int xid,int rc;FILE_ALL_INFO fi = {}; - data->symlink = false; + data->reparse_point = false; data->adjust_tz = false;/* could do find first instead but this returns more info */
@@ -592,7 +592,7 @@ static int cifs_query_path_info(const unsigned int xid,/* Need to check if this is a symbolic link or not */ tmprc =CIFS_open (xid, &oparms, &oplock,NULL );if (tmprc == -EOPNOTSUPP ) - data->symlink = true; + data->reparse_point = true;else if (tmprc ==0 )CIFSSMBClose (xid, tcon, fid.netfid); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 4/207 smb311: failure to open files of length 1040 when mounting with SMB3.1.1 POSIX extensions
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steve French <[email protected]>
[ Upstream commit 9df23801c83d3e12b4c09be39d37d2be385e52f9 ]
If a file size has bits 0x410 = ATTR_DIRECTORY | ATTR_REPARSE set then during queryinfo (stat) the file is regarded as a directory and subsequent opens can fail. A simple test example is trying to open any file 1040 bytes long when mounting with "posix" (SMB3.1.1 POSIX/Linux Extensions).
The cause of this bug is that Attributes field in smb2_file_all_info struct occupies the same place that EndOfFile field in smb311_posix_qinfo, and sometimes the latter struct is incorrectly processed as if it was the first one.
--- fs/smb/client/cifsglob.h | 1 + fs/smb/client/reparse.h | 28 ++++++++++++++++++++++------ fs/smb/client/smb2inode.c | 4 ++++ fs/smb/client/smb2ops.c | 3 ++- 4 files changed, 29 insertions(+), 7 deletions(-)
fs/smb/client/cifsglob.h +1 -0
@@ -216,6 +216,7 @@ struct cifs_cred { struct cifs_open_info_data { bool adjust_tz; bool reparse_point; + bool contains_posix_file_info; struct { /* ioctl response buffer */ struct {
fs/smb/client/reparse.h +22 -6
@@ -97,14 +97,30 @@ static inline bool reparse_inode_match(struct inode *inode,static inline bool cifs_open_data_reparse (struct cifs_open_info_data *data) { -struct smb2_file_all_info *fi = &data->fi; -u32 attrs =le32_to_cpu (fi->Attributes); +u32 attrs;bool ret; - ret = data->reparse_point || (attrs &ATTR_REPARSE ); -if (ret) - attrs |=ATTR_REPARSE ; - fi->Attributes =cpu_to_le32 (attrs); +if (data->contains_posix_file_info) { +struct smb311_posix_qinfo *fi = &data->posix_fi; + + attrs =le32_to_cpu (fi->DosAttributes); +if (data->reparse_point) { + attrs |=ATTR_REPARSE ; + fi->DosAttributes =cpu_to_le32 (attrs); + } + + }else { +struct smb2_file_all_info *fi = &data->fi; + + attrs =le32_to_cpu (fi->Attributes); +if (data->reparse_point) { + attrs |=ATTR_REPARSE ; + fi->Attributes =cpu_to_le32 (attrs); + } + } + + ret = attrs &ATTR_REPARSE ; +return ret; }
fs/smb/client/smb2inode.c +4 -0
@@ -648,6 +648,7 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon,switch (cmds[i]) {case SMB2_OP_QUERY_INFO : idata = in_iov[i].iov_base; + idata->contains_posix_file_info = false;if (rc ==0 && cfile && cfile->symlink_target) { idata->symlink_target =kstrdup (cfile->symlink_target,GFP_KERNEL );if (!idata->symlink_target)
@@ -671,6 +672,7 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon,break ;case SMB2_OP_POSIX_QUERY_INFO : idata = in_iov[i].iov_base; + idata->contains_posix_file_info = true;if (rc ==0 && cfile && cfile->symlink_target) { idata->symlink_target =kstrdup (cfile->symlink_target,GFP_KERNEL );if (!idata->symlink_target)
@@ -768,6 +770,7 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon, idata = in_iov[i].iov_base; idata->reparse.io.iov = *iov; idata->reparse.io.buftype = resp_buftype[i +1 ]; + idata->contains_posix_file_info = false;/* BB VERIFY */ rbuf =reparse_buf_ptr (iov);if (IS_ERR (rbuf)) { rc =PTR_ERR (rbuf);
@@ -789,6 +792,7 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon,case SMB2_OP_QUERY_WSL_EA :if (!rc) { idata = in_iov[i].iov_base; + idata->contains_posix_file_info = false; qi_rsp = rsp_iov[i +1 ].iov_base; data[0 ] = (u8 *)qi_rsp +le16_to_cpu (qi_rsp->OutputBufferOffset); size[0 ] =le32_to_cpu (qi_rsp->OutputBufferLength);
fs/smb/client/smb2ops.c +2 -1
@@ -1001,6 +1001,7 @@ static int smb2_query_file_info(const unsigned int xid, struct cifs_tcon *tcon,if (!data->symlink_target)return -ENOMEM ; } + data->contains_posix_file_info = false;return SMB2_query_info (xid, tcon, fid->persistent_fid, fid->volatile_fid, &data->fi); }
@@ -5150,7 +5151,7 @@ int __cifs_sfu_make_node(unsigned int xid, struct inode *inode,FILE_CREATE ,CREATE_NOT_DIR | CREATE_OPTION_SPECIAL, ACL_NO_MODE); oparms.fid = &fid; - + idata.contains_posix_file_info = false; rc = server->ops->open (xid, &oparms, &oplock, &idata);if (rc) goto out;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 5/207 x86/microcode/AMD: Add some forgotten models to the SHA check
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov (AMD) <[email protected]>
commit 058a6bec37c6c3b826158f6d26b75de43816a880 upstream.
Add some more forgotten models to the SHA check.
--- arch/x86/kernel/cpu/microcode/amd.c | 6 ++++++ 1 file changed, 6 insertions(+)
arch/x86/kernel/cpu/microcode/amd.c +6 -0
@@ -175,23 +175,29 @@ static bool need_sha_check(u32 cur_rev) {switch (cur_rev >>8 ) {case 0x80012 :return cur_rev <=0x800126f ;break ; +case 0x80082 :return cur_rev <=0x800820f ;break ;case 0x83010 :return cur_rev <=0x830107c ;break ;case 0x86001 :return cur_rev <=0x860010e ;break ;case 0x86081 :return cur_rev <=0x8608108 ;break ;case 0x87010 :return cur_rev <=0x8701034 ;break ;case 0x8a000 :return cur_rev <=0x8a0000a ;break ; +case 0xa0010 :return cur_rev <=0xa00107a ;break ;case 0xa0011 :return cur_rev <=0xa0011da ;break ;case 0xa0012 :return cur_rev <=0xa001243 ;break ; +case 0xa0082 :return cur_rev <=0xa00820e ;break ;case 0xa1011 :return cur_rev <=0xa101153 ;break ;case 0xa1012 :return cur_rev <=0xa10124e ;break ;case 0xa1081 :return cur_rev <=0xa108109 ;break ;case 0xa2010 :return cur_rev <=0xa20102f ;break ;case 0xa2012 :return cur_rev <=0xa201212 ;break ; +case 0xa4041 :return cur_rev <=0xa404109 ;break ; +case 0xa5000 :return cur_rev <=0xa500013 ;break ;case 0xa6012 :return cur_rev <=0xa60120a ;break ;case 0xa7041 :return cur_rev <=0xa704109 ;break ;case 0xa7052 :return cur_rev <=0xa705208 ;break ;case 0xa7080 :return cur_rev <=0xa708009 ;break ;case 0xa70c0 :return cur_rev <=0xa70C009 ;break ; +case 0xaa001 :return cur_rev <=0xaa00116 ;break ;case 0xaa002 :return cur_rev <=0xaa00218 ;break ;default :break ; }
Greg Kroah-Hartman
maintainerPATCH 6/207 loongarch: Use ASM_REACHABLE
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
commit 624bde3465f660e54a7cd4c1efc3e536349fead5 upstream.
annotate_reachable() is unreliable since the compiler is free to place random code inbetween two consecutive asm() statements.
This removes the last and only annotate_reachable() user.
--- arch/loongarch/include/asm/bug.h | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
arch/loongarch/include/asm/bug.h +7 -6
@@ -4,6 +4,7 @@#include <asm/break.h> #include <linux/stringify.h> +#include <linux/objtool.h> #ifndef CONFIG_DEBUG_BUGVERBOSE #define _BUGVERBOSE_LOCATION (file, line)
@@ -33,25 +34,25 @@#define ASM_BUG_FLAGS (flags) \ __BUG_ENTRY(flags) \ - break BRK_BUG + break BRK_BUG;#define ASM_BUG () ASM_BUG_FLAGS(0) -#define __BUG_FLAGS (flags) \ - asm_inline volatile (__stringify(ASM_BUG_FLAGS(flags))); +#define __BUG_FLAGS (flags, extra) \ + asm_inline volatile (__stringify(ASM_BUG_FLAGS(flags)) \ + extra);#define __WARN_FLAGS (flags) \ do { \ instrumentation_begin(); \ - __BUG_FLAGS(BUGFLAG_WARNING|(flags)); \ - annotate_reachable(); \ + __BUG_FLAGS(BUGFLAG_WARNING|(flags), ASM_REACHABLE); \ instrumentation_end(); \ } while (0)#define BUG () \ do { \ instrumentation_begin(); \ - __BUG_FLAGS(0); \ + __BUG_FLAGS(0, ""); \ unreachable(); \ } while (0)
Greg Kroah-Hartman
maintainerPATCH 7/207 Revert "of: reserved-memory: Fix using wrong number of cells to get property alignment"
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Herring (Arm) <[email protected]>
commit 75f1f311d883dfaffb98be3c1da208d6ed5d4df9 upstream.
This reverts commit 267b21d0bef8e67dbe6c591c9991444e58237ec9.
Turns out some DTs do depend on this behavior. Specifically, a downstream Pixel 6 DT. Revert the change at least until we can decide if the DT spec can be changed instead.
--- drivers/of/of_reserved_mem.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/of/of_reserved_mem.c +2 -2
@@ -415,12 +415,12 @@ static int __init __reserved_mem_alloc_s prop =of_get_flat_dt_prop (node,"alignment" , &len);if (prop) { -if (len != dt_root_size_cells *sizeof (__be32)) { +if (len != dt_root_addr_cells *sizeof (__be32)) {pr_err ("invalid alignment property in '%s' node.\n" , uname);return -EINVAL ; } - align =dt_mem_next_cell (dt_root_size_cells, &prop); + align =dt_mem_next_cell (dt_root_addr_cells, &prop); } nomap =of_get_flat_dt_prop (node,"no-map" ,NULL ) !=NULL ;
Greg Kroah-Hartman
maintainerPATCH 8/207 tracing: tprobe-events: Fix a memory leak when tprobe with $retval
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu (Google) <[email protected]>
commit ac965d7d88fc36fb42e3d50225c0a44dd8326da4 upstream.
Fix a memory leak when a tprobe is defined with $retval. This combination is not allowed, but the parse_symbol_and_return() does not free the *symbol which should not be used if it returns the error. Thus, it leaks the *symbol memory in that error path.
--- kernel/trace/trace_fprobe.c | 2 ++ 1 file changed, 2 insertions(+)
kernel/trace/trace_fprobe.c +2 -0
@@ -1025,6 +1025,8 @@ static int parse_symbol_and_return(int aif (is_tracepoint) {trace_probe_log_set_index (i);trace_probe_log_err (tmp - argv[i],RETVAL_ON_PROBE ); +kfree (*symbol); + *symbol =NULL ;return -EINVAL ; } *is_return = true;
Greg Kroah-Hartman
maintainerPATCH 9/207 tracing: tprobe-events: Reject invalid tracepoint name
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu (Google) <[email protected]>
commit d0453655b6ddc685a4837f3cc0776ae8eef62d01 upstream.
Commit 57a7e6de9e30 ("tracing/fprobe: Support raw tracepoints on future loaded modules") allows user to set a tprobe on non-exist tracepoint but it does not check the tracepoint name is acceptable. So it leads tprobe has a wrong character for events (e.g. with subsystem prefix). In this case, the event is not shown in the events directory.
Reject such invalid tracepoint name.
The tracepoint name must consist of alphabet or digit or '_'.
--- kernel/trace/trace_fprobe.c | 13 +++++++++++++ kernel/trace/trace_probe.h | 1 + 2 files changed, 14 insertions(+)
kernel/trace/trace_fprobe.c +13 -0
@@ -1018,6 +1018,19 @@ static int parse_symbol_and_return(int aif (*is_return)return 0 ; +if (is_tracepoint) { + tmp = *symbol; +while (*tmp && (isalnum (*tmp) || *tmp =='_' )) + tmp++; +if (*tmp) { +/* find a wrong character. */ +trace_probe_log_err (tmp - *symbol,BAD_TP_NAME ); +kfree (*symbol); + *symbol =NULL ; +return -EINVAL ; + } + } +/* If there is $retval, this should be a return fprobe. */ for (i =2 ; i < argc; i++) { tmp =strstr (argv[i],"$retval" );
kernel/trace/trace_probe.h +1 -0
@@ -481,6 +481,7 @@ extern int traceprobe_define_arg_fields(C (NON_UNIQ_SYMBOL ,"The symbol is not unique" ), \C (BAD_RETPROBE ,"Retprobe address must be an function entry" ), \C (NO_TRACEPOINT ,"Tracepoint is not found" ), \ +C (BAD_TP_NAME ,"Invalid character in tracepoint name" ),\C (BAD_ADDR_SUFFIX ,"Invalid probed address suffix" ), \C (NO_GROUP_NAME ,"Group name is not specified" ), \ C(GROUP_TOO_LONG, "Group name is too long"), \
Greg Kroah-Hartman
maintainerPATCH 10/207 stmmac: loongson: Pass correct arg to PCI function
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philipp Stanner <[email protected]>
commit 00371a3f48775967950c2fe3ec97b7c786ca956d upstream.
pcim_iomap_regions() should receive the driver's name as its third parameter, not the PCI device's name.
Define the driver name with a macro and use it at the appropriate places, including pcim_iomap_regions().
--- drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c +4 -2
@@ -11,6 +11,8 @@#include "dwmac_dma.h" #include "dwmac1000.h" +#define DRIVER_NAME "dwmac-loongson-pci" +/* Normal Loongson Tx Summary */ #define DMA_INTR_ENA_NIE_TX_LOONGSON 0x00040000/* Normal Loongson Rx Summary */
@@ -568,7 +570,7 @@ static int loongson_dwmac_probe(struct pfor (i =0 ; i <PCI_STD_NUM_BARS ; i++) {if (pci_resource_len (pdev, i) ==0 )continue ; - ret =pcim_iomap_regions (pdev,BIT (0 ),pci_name (pdev)); + ret =pcim_iomap_regions (pdev,BIT (0 ),DRIVER_NAME );if (ret) goto err_disable_device;break ;
@@ -687,7 +689,7 @@ static const struct pci_device_id loongsMODULE_DEVICE_TABLE (pci, loongson_dwmac_id_table);static struct pci_driver loongson_dwmac_driver = { - .name ="dwmac-loongson-pci" , + .name =DRIVER_NAME , .id_table = loongson_dwmac_id_table, .probe = loongson_dwmac_probe, .remove = loongson_dwmac_remove,
Greg Kroah-Hartman
maintainerPATCH 11/207 LoongArch: Convert unreachable() to BUG()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiezhu Yang <[email protected]>
commit da64a2359092ceec4f9dea5b329d0aef20104217 upstream.
When compiling on LoongArch, there exists the following objtool warning in arch/loongarch/kernel/machine_kexec.o:
kexec_reboot() falls through to next function crash_shutdown_secondary()
Avoid using unreachable() as it can (and will in the absence of UBSAN) generate fall-through code. Use BUG() so we get a "break BRK_BUG" trap (with unreachable annotation).
--- arch/loongarch/kernel/machine_kexec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/loongarch/kernel/machine_kexec.c +2 -2
@@ -126,14 +126,14 @@ void kexec_reboot(void)/* All secondary cpus go to kexec_smp_wait */ if (smp_processor_id () >0 ) {relocated_kexec_smp_wait (NULL ); -unreachable (); +BUG (); }#endif do_kexec = (void *)reboot_code_buffer;do_kexec (efi_boot, cmdline_ptr, systable_ptr, start_addr, first_ind_entry); -unreachable (); +BUG (); }
Greg Kroah-Hartman
maintainerPATCH 12/207 LoongArch: Use polling play_dead() when resuming from hibernation
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
commit c9117434c8f7523f0b77db4c5766f5011cc94677 upstream.
When CONFIG_RANDOM_KMALLOC_CACHES or other randomization infrastructrue enabled, the idle_task's stack may different between the booting kernel and target kernel. So when resuming from hibernation, an ACTION_BOOT_CPU IPI wakeup the idle instruction in arch_cpu_idle_dead() and jump to the interrupt handler. But since the stack pointer is changed, the interrupt handler cannot restore correct context.
So rename the current arch_cpu_idle_dead() to idle_play_dead(), make it as the default version of play_dead(), and the new arch_cpu_idle_dead() call play_dead() directly. For hibernation, implement an arch-specific hibernate_resume_nonboot_cpu_disable() to use the polling version (idle instruction is replace by nop, and irq is disabled) of play_dead(), i.e. poll_play_dead(), to avoid IPI handler corrupting the idle_task's stack when resuming from hibernation.
This solution is a little similar to commit 406f992e4a372dafbe3c ("x86 /
hibernate: Use hlt_play_dead() when resuming from hibernation").
--- arch/loongarch/kernel/smp.c | 47 +++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 46 insertions(+), 1 deletion(-)
arch/loongarch/kernel/smp.c +46 -1
@@ -19,6 +19,7 @@#include <linux/smp.h> #include <linux/threads.h> #include <linux/export.h> +#include <linux/suspend.h> #include <linux/syscore_ops.h> #include <linux/time.h> #include <linux/tracepoint.h>
@@ -423,7 +424,7 @@ void loongson_cpu_die(unsigned int cpu)mb (); } -void __noreturn arch_cpu_idle_dead (void ) +static void __noreturn idle_play_dead (void ) { registeruint64_t addr; registervoid (*init_fn)(void );
@@ -447,6 +448,50 @@ void __noreturn arch_cpu_idle_dead(void)BUG (); } +#ifdef CONFIG_HIBERNATION +static void __noreturn poll_play_dead (void ) +{ + registeruint64_t addr; + registervoid (*init_fn)(void ); + +idle_task_exit (); +__this_cpu_write (cpu_state,CPU_DEAD ); + +__smp_mb (); +do { + __asm__ __volatile__("nop\n\t" ); + addr =iocsr_read64 (LOONGARCH_IOCSR_MBUF0 ); + }while (addr ==0 ); + + init_fn = (void *)TO_CACHE (addr); +iocsr_write32 (0xffffffff ,LOONGARCH_IOCSR_IPI_CLEAR ); + +init_fn (); +BUG (); +} +#endif + +static void (*play_dead)(void ) = idle_play_dead; + +void __noreturn arch_cpu_idle_dead (void ) +{ +play_dead (); +BUG ();/* play_dead() doesn't return */ +} + +#ifdef CONFIG_HIBERNATION +int hibernate_resume_nonboot_cpu_disable (void ) +{ +int ret; + + play_dead = poll_play_dead; + ret =suspend_disable_secondary_cpus (); + play_dead = idle_play_dead; + +return ret; +} +#endif +#endif /*
Greg Kroah-Hartman
maintainerPATCH 13/207 LoongArch: Set hugetlb mmap base address aligned with pmd size
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bibo Mao <[email protected]>
commit 3109d5ff484b7bc7b955f166974c6776d91f247b upstream.
With ltp test case "testcases/bin/hugefork02", there is a dmesg error report message such as:
kernel BUG at mm/hugetlb.c:5550!
Oops - BUG[#1]:
CPU: 0 UID: 0 PID: 1517 Comm: hugefork02 Not tainted 6.14.0-rc2+ #241
Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 2/2/2022
pc 90000000004eaf1c ra 9000000000485538 tp 900000010edbc000 sp 900000010edbf940
a0 900000010edbfb00 a1 9000000108d20280 a2 00007fffe9474000 a3 00007ffff3474000
a4 0000000000000000 a5 0000000000000003 a6 00000000003cadd3 a7 0000000000000000
t0 0000000001ffffff t1 0000000001474000 t2 900000010ecd7900 t3 00007fffe9474000
t4 00007fffe9474000 t5 0000000000000040 t6 900000010edbfb00 t7 0000000000000001
t8 0000000000000005 u0 90000000004849d0 s9 900000010edbfa00 s0 9000000108d20280
s1 00007fffe9474000 s2 0000000002000000 s3 9000000108d20280 s4 9000000002b38b10
s5 900000010edbfb00 s6 00007ffff3474000 s7 0000000000000406 s8 900000010edbfa08
ra: 9000000000485538 unmap_vmas+0x130/0x218
ERA: 90000000004eaf1c __unmap_hugepage_range+0x6f4/0x7d0
PRMD: 00000004 (PPLV0 +PIE -PWE)
EUEN: 00000007 (+FPE +SXE +ASXE -BTE)
ECFG: 00071c1d (LIE=0,2-4,10-12 VS=7)
ESTAT: 000c0000 [BRK] (IS= ECode=12 EsubCode=0)
PRID: 0014c010 (Loongson-64bit, Loongson-3A5000)
Process hugefork02 (pid: 1517, threadinfo=00000000a670eaf4, task=000000007a95fc64)
Call Trace:
[<90000000004eaf1c>] __unmap_hugepage_range+0x6f4/0x7d0
[<9000000000485534>] unmap_vmas+0x12c/0x218
[<9000000000494068>] exit_mmap+0xe0/0x308
[<900000000025fdc4>] mmput+0x74/0x180
[<900000000026a284>] do_exit+0x294/0x898
[<900000000026aa30>] do_group_exit+0x30/0x98
[<900000000027bed4>] get_signal+0x83c/0x868
[<90000000002457b4>] arch_do_signal_or_restart+0x54/0xfa0
[<90000000015795e8>] irqentry_exit_to_user_mode+0xb8/0x138
[<90000000002572d0>] tlb_do_page_fault_1+0x114/0x1b4The problem is that base address allocated from hugetlbfs is not aligned with pmd size. Here add a checking for hugetlbfs and align base address with pmd size. After this patch the test case "testcases/bin/hugefork02" passes to run.
This is similar to the commit 7f24cbc9c4d42db8a3c8484d1 ("mm/mmap: teach generic_get_unmapped_area{_topdown} to handle hugetlb mappings").
--- arch/loongarch/mm/mmap.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
arch/loongarch/mm/mmap.c +5 -1
@@ -3,6 +3,7 @@* Copyright (C) 2020-2022 Loongson Technology Corporation Limited */ #include <linux/export.h> +#include <linux/hugetlb.h> #include <linux/io.h> #include <linux/kfence.h> #include <linux/memblock.h>
@@ -63,8 +64,11 @@ static unsigned long arch_get_unmapped_a } info.length = len; - info.align_mask = do_color_align ? (PAGE_MASK &SHM_ALIGN_MASK ) :0 ; info.align_offset = pgoff <<PAGE_SHIFT ; +if (filp &&is_file_hugepages (filp)) + info.align_mask =huge_page_mask_align (filp); +else + info.align_mask = do_color_align ? (PAGE_MASK &SHM_ALIGN_MASK ) :0 ;if (dir ==DOWN ) { info.flags =VM_UNMAPPED_AREA_TOPDOWN ;
Greg Kroah-Hartman
maintainerPATCH 14/207 LoongArch: Set max_pfn with the PFN of the last page
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bibo Mao <[email protected]>
commit c8477bb0a8e7f6b2e47952b403c5cb67a6929e55 upstream.
The current max_pfn equals to zero. In this case, it causes user cannot get some page information through /proc filesystem such as kpagecount. The following message is displayed by stress-ng test suite with command "stress-ng --verbose --physpage 1 -t 1".
# stress-ng --verbose --physpage 1 -t 1 stress-ng: error: [1691] physpage: cannot read page count for address 0x134ac000 in /proc/kpagecount, errno=22 (Invalid argument) stress-ng: error: [1691] physpage: cannot read page count for address 0x7ffff207c3a8 in /proc/kpagecount, errno=22 (Invalid argument) stress-ng: error: [1691] physpage: cannot read page count for address 0x134b0000 in /proc/kpagecount, errno=22 (Invalid argument) ...
After applying this patch, the kernel can pass the test.
# stress-ng --verbose --physpage 1 -t 1 stress-ng: debug: [1701] physpage: [1701] started (instance 0 on CPU 3) stress-ng: debug: [1701] physpage: [1701] exited (instance 0 on CPU 3) stress-ng: debug: [1700] physpage: [1701] terminated (success)
--- arch/loongarch/kernel/setup.c | 3 +++ 1 file changed, 3 insertions(+)
arch/loongarch/kernel/setup.c +3 -0
@@ -387,6 +387,9 @@ static void __init check_kernel_sections*/ static void __init arch_mem_init (char **cmdline_p) { +/* Recalculate max_low_pfn for "mem=xxx" */ + max_pfn = max_low_pfn =PHYS_PFN (memblock_end_of_DRAM ()); +if (usermem)pr_info ("User-defined physical RAM map overwrite\n" );
Greg Kroah-Hartman
maintainerPATCH 15/207 LoongArch: KVM: Add interrupt checking for AVEC
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bibo Mao <[email protected]>
commit 6fb1867d5a44b0a061cf39d2492d23d314bcb8ce upstream.
There is a newly added macro INT_AVEC with CSR ESTAT register, which is bit 14 used for LoongArch AVEC support. AVEC interrupt status bit 14 is supported with macro CSR_ESTAT_IS, so here replace the hard-coded value 0x1fff with macro CSR_ESTAT_IS so that the AVEC interrupt status is also supported by KVM.
--- arch/loongarch/kvm/vcpu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/loongarch/kvm/vcpu.c +1 -1
@@ -311,7 +311,7 @@ static int kvm_handle_exit(struct kvm_ru {int ret =RESUME_GUEST ;unsigned long estat = vcpu->arch.host_estat; -u32 intr = estat &0x1fff ;/* Ignore NMI */ +u32 intr = estat &CSR_ESTAT_IS ;u32 ecode = (estat &CSR_ESTAT_EXC ) >>CSR_ESTAT_EXC_SHIFT ; vcpu->mode =OUTSIDE_GUEST_MODE ;
Greg Kroah-Hartman
maintainerPATCH 16/207 LoongArch: KVM: Reload guest CSR registers after sleep
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bibo Mao <[email protected]>
commit 78d7bc5a02e1468df53896df354fa80727f35b7d upstream.
On host, the HW guest CSR registers are lost after suspend and resume operation. Since last_vcpu of boot CPU still records latest vCPU pointer so that the guest CSR register skips to reload when boot CPU resumes and vCPU is scheduled.
Here last_vcpu is cleared so that guest CSR registers will reload from scheduled vCPU context after suspend and resume.
--- arch/loongarch/kvm/main.c | 7 +++++++ 1 file changed, 7 insertions(+)
arch/loongarch/kvm/main.c +7 -0
@@ -299,6 +299,13 @@ int kvm_arch_enable_virtualization_cpu(vkvm_debug ("GCFG:%lx GSTAT:%lx GINTC:%lx GTLBC:%lx" ,read_csr_gcfg (),read_csr_gstat (),read_csr_gintc (),read_csr_gtlbc ()); +/* +* HW Guest CSR registers are lost after CPU suspend and resume. +* Clear last_vcpu so that Guest CSR registers forced to reload +* from vCPU SW state. +*/ +this_cpu_ptr (vmcs)->last_vcpu =NULL ; +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 17/207 LoongArch: KVM: Fix GPA size issue about VM
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bibo Mao <[email protected]>
commit 6bdbb73dc8d99fbb77f5db79dbb6f108708090b4 upstream.
Physical address space is 48 bit on Loongson-3A5000 physical machine, however it is 47 bit for VM on Loongson-3A5000 system. Size of physical address space of VM is the same with the size of virtual user space (a half) of physical machine.
Variable cpu_vabits represents user address space, kernel address space is not included (user space and kernel space are both a half of total). Here cpu_vabits, rather than cpu_vabits - 1, is to represent the size of guest physical address space.
Also there is strict checking about page fault GPA address, inject error if it is larger than maximum GPA address of VM.
--- arch/loongarch/kvm/exit.c | 6 ++++++ arch/loongarch/kvm/vm.c | 6 +++++- 2 files changed, 11 insertions(+), 1 deletion(-)
arch/loongarch/kvm/exit.c +6 -0
@@ -669,6 +669,12 @@ static int kvm_handle_rdwr_fault(structstruct kvm_run *run = vcpu->run;unsigned long badv = vcpu->arch.badv; +/* Inject ADE exception if exceed max GPA size */ +if (unlikely (badv >= vcpu->kvm->arch.gpa_size)) { +kvm_queue_exception (vcpu,EXCCODE_ADE ,EXSUBCODE_ADEM ); +return RESUME_GUEST ; + } + ret =kvm_handle_mm_fault (vcpu, badv, write);if (ret) {/* Treat as MMIO */
arch/loongarch/kvm/vm.c +5 -1
@@ -48,7 +48,11 @@ int kvm_arch_init_vm(struct kvm *kvm, unif (kvm_pvtime_supported ()) kvm->arch.pv_features |=BIT (KVM_FEATURE_STEAL_TIME ); - kvm->arch.gpa_size =BIT (cpu_vabits -1 ); +/* +* cpu_vabits means user address space only (a half of total). +* GPA size of VM is the same with the size of user address space. +*/ + kvm->arch.gpa_size =BIT (cpu_vabits); kvm->arch.root_level =CONFIG_PGTABLE_LEVELS -1 ; kvm->arch.invalid_ptes[0 ] =0 ; kvm->arch.invalid_ptes[1 ] = (unsigned long )invalid_pte_table;
Greg Kroah-Hartman
maintainerPATCH 18/207 HID: appleir: Fix potential NULL dereference at raw event handle
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniil Dulov <[email protected]>
commit 2ff5baa9b5275e3acafdf7f2089f74cccb2f38d1 upstream.
Syzkaller reports a NULL pointer dereference issue in input_event().
BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:68 [inline] BUG: KASAN: null-ptr-deref in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] BUG: KASAN: null-ptr-deref in is_event_supported drivers/input/input.c:67 [inline] BUG: KASAN: null-ptr-deref in input_event+0x42/0xa0 drivers/input/input.c:395 Read of size 8 at addr 0000000000000028 by task syz-executor199/2949 CPU: 0 UID: 0 PID: 2949 Comm: syz-executor199 Not tainted 6.13.0-rc4-syzkaller-00076-gf097a36ef88d #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 kasan_report+0xd9/0x110 mm/kasan/report.c:602 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189 instrument_atomic_read include/linux/instrumented.h:68 [inline] _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] is_event_supported drivers/input/input.c:67 [inline] input_event+0x42/0xa0 drivers/input/input.c:395 input_report_key include/linux/input.h:439 [inline] key_down drivers/hid/hid-appleir.c:159 [inline] appleir_raw_event+0x3e5/0x5e0 drivers/hid/hid-appleir.c:232 __hid_input_report.constprop.0+0x312/0x440 drivers/hid/hid-core.c:2111 hid_ctrl+0x49f/0x550 drivers/hid/usbhid/hid-core.c:484 __usb_hcd_giveback_urb+0x389/0x6e0 drivers/usb/core/hcd.c:1650 usb_hcd_giveback_urb+0x396/0x450 drivers/usb/core/hcd.c:1734 dummy_timer+0x17f7/0x3960 drivers/usb/gadget/udc/dummy_hcd.c:1993 __run_hrtimer kernel/time/hrtimer.c:1739 [inline] __hrtimer_run_queues+0x20a/0xae0 kernel/time/hrtimer.c:1803 hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1820 handle_softirqs+0x206/0x8d0 kernel/softirq.c:561 __do_softirq kernel/softirq.c:595 [inline] invoke_softirq kernel/softirq.c:435 [inline] __irq_exit_rcu+0xfa/0x160 kernel/softirq.c:662 irq_exit_rcu+0x9/0x30 kernel/softirq.c:678 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0x90/0xb0 arch/x86/kernel/apic/apic.c:1049 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 __mod_timer+0x8f6/0xdc0 kernel/time/timer.c:1185 add_timer+0x62/0x90 kernel/time/timer.c:1295 schedule_timeout+0x11f/0x280 kernel/time/sleep_timeout.c:98 usbhid_wait_io+0x1c7/0x380 drivers/hid/usbhid/hid-core.c:645 usbhid_init_reports+0x19f/0x390 drivers/hid/usbhid/hid-core.c:784 hiddev_ioctl+0x1133/0x15b0 drivers/hid/usbhid/hiddev.c:794 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl fs/ioctl.c:892 [inline] __x64_sys_ioctl+0x190/0x200 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK>
This happens due to the malformed report items sent by the emulated device which results in a report, that has no fields, being added to the report list. Due to this appleir_input_configured() is never called, hidinput_connect() fails which results in the HID_CLAIMED_INPUT flag is not being set. However, it does not make appleir_probe() fail and lets the event callback to be called without the associated input device.
Thus, add a check for the HID_CLAIMED_INPUT flag and leave the event hook early if the driver didn't claim any input_dev for some reason. Moreover, some other hid drivers accessing input_dev in their event callbacks do have similar checks, too.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
--- drivers/hid/hid-appleir.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hid/hid-appleir.c +1 -1
@@ -188,7 +188,7 @@ static int appleir_raw_event(struct hid_static const u8 flatbattery[] = {0x25 ,0x87 ,0xe0 };unsigned long flags; -if (len !=5 ) +if (len !=5 || !(hid->claimed &HID_CLAIMED_INPUT )) goto out;if (!memcmp (data, keydown,sizeof (keydown))) {
Greg Kroah-Hartman
maintainerPATCH 19/207 HID: corsair-void: Update power supply values with a unified work handler
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stuart Hayhurst <[email protected]>
commit 0c28e4d1e10d2aae608094620bb386e6fd73d55e upstream.
corsair_void_process_receiver can be called from an interrupt context, locking battery_mutex in it was causing a kernel panic.
Fix it by moving the critical section into its own work, sharing this work with battery_add_work and battery_remove_work to remove the need for any locking
--- drivers/hid/hid-corsair-void.c | 83 ++++++++++++++++++---------------- 1 file changed, 43 insertions(+), 40 deletions(-)
drivers/hid/hid-corsair-void.c +43 -40
@@ -71,11 +71,9 @@#include <linux/bitfield.h> #include <linux/bitops.h> -#include <linux/cleanup.h> #include <linux/device.h> #include <linux/hid.h> #include <linux/module.h> -#include <linux/mutex.h> #include <linux/power_supply.h> #include <linux/usb.h> #include <linux/workqueue.h>
@@ -120,6 +118,12 @@ enum { CORSAIR_VOID_BATTERY_CHARGING = 5, }; +enum { +CORSAIR_VOID_ADD_BATTERY =0 , +CORSAIR_VOID_REMOVE_BATTERY =1 , +CORSAIR_VOID_UPDATE_BATTERY =2 , +}; +static enum power_supply_property corsair_void_battery_props[] = {POWER_SUPPLY_PROP_STATUS ,POWER_SUPPLY_PROP_PRESENT ,
@@ -155,12 +159,12 @@ struct corsair_void_drvdata {struct power_supply *battery;struct power_supply_desc battery_desc; -struct mutex battery_mutex;struct delayed_work delayed_status_work;struct delayed_work delayed_firmware_work; -struct work_struct battery_remove_work; -struct work_struct battery_add_work; + +unsigned long battery_work_flags; +struct work_struct battery_work; };/*
@@ -260,11 +264,9 @@ static void corsair_void_process_receiver(struct corsair_void_drvdata *drvdata,/* Inform power supply if battery values changed */ if (memcmp (&orig_battery_data, battery_data,sizeof (*battery_data))) { - scoped_guard(mutex, &drvdata->battery_mutex) { -if (drvdata->battery) { -power_supply_changed (drvdata->battery); - } - } +set_bit (CORSAIR_VOID_UPDATE_BATTERY , + &drvdata->battery_work_flags); +schedule_work (&drvdata->battery_work); } }
@@ -536,29 +538,11 @@ static void corsair_void_firmware_work_handler(struct work_struct *work) } -static void corsair_void_battery_remove_work_handler (struct work_struct *work) +static void corsair_void_add_battery (struct corsair_void_drvdata *drvdata) { -struct corsair_void_drvdata *drvdata; - - drvdata = container_of(work, struct corsair_void_drvdata, - battery_remove_work); - scoped_guard(mutex, &drvdata->battery_mutex) { -if (drvdata->battery) { -power_supply_unregister (drvdata->battery); - drvdata->battery =NULL ; - } - } -} - -static void corsair_void_battery_add_work_handler (struct work_struct *work) -{ -struct corsair_void_drvdata *drvdata;struct power_supply_config psy_cfg = {};struct power_supply *new_supply; - drvdata = container_of(work, struct corsair_void_drvdata, - battery_add_work); -guard (mutex)(&drvdata->battery_mutex);if (drvdata->battery)return ;
@@ -583,16 +567,42 @@ static void corsair_void_battery_add_work_handler(struct work_struct *work) drvdata->battery = new_supply; } +static void corsair_void_battery_work_handler (struct work_struct *work) +{ +struct corsair_void_drvdata *drvdata =container_of (work, + struct corsair_void_drvdata, battery_work); + +bool add_battery =test_and_clear_bit (CORSAIR_VOID_ADD_BATTERY , + &drvdata->battery_work_flags); +bool remove_battery =test_and_clear_bit (CORSAIR_VOID_REMOVE_BATTERY , + &drvdata->battery_work_flags); +bool update_battery =test_and_clear_bit (CORSAIR_VOID_UPDATE_BATTERY , + &drvdata->battery_work_flags); + +if (add_battery && !remove_battery) { +corsair_void_add_battery (drvdata); + }else if (remove_battery && !add_battery && drvdata->battery) { +power_supply_unregister (drvdata->battery); + drvdata->battery =NULL ; + } + +if (update_battery && drvdata->battery) +power_supply_changed (drvdata->battery); + +} +static void corsair_void_headset_connected (struct corsair_void_drvdata *drvdata) { -schedule_work (&drvdata->battery_add_work); +set_bit (CORSAIR_VOID_ADD_BATTERY , &drvdata->battery_work_flags); +schedule_work (&drvdata->battery_work);schedule_delayed_work (&drvdata->delayed_firmware_work,msecs_to_jiffies (100 )); }static void corsair_void_headset_disconnected (struct corsair_void_drvdata *drvdata) { -schedule_work (&drvdata->battery_remove_work); +set_bit (CORSAIR_VOID_REMOVE_BATTERY , &drvdata->battery_work_flags); +schedule_work (&drvdata->battery_work);corsair_void_set_unknown_wireless_data (drvdata);corsair_void_set_unknown_batt (drvdata);
@@ -678,13 +688,7 @@ static int corsair_void_probe(struct hid_device *hid_dev, drvdata->battery_desc.get_property = corsair_void_battery_get_property; drvdata->battery =NULL ; -INIT_WORK (&drvdata->battery_remove_work, - corsair_void_battery_remove_work_handler); -INIT_WORK (&drvdata->battery_add_work, - corsair_void_battery_add_work_handler); - ret =devm_mutex_init (drvdata->dev, &drvdata->battery_mutex); -if (ret) -return ret; +INIT_WORK (&drvdata->battery_work, corsair_void_battery_work_handler); ret =sysfs_create_group (&hid_dev->dev.kobj, &corsair_void_attr_group);if (ret)
@@ -721,8 +725,7 @@ static void corsair_void_remove(struct hid_device *hid_dev)struct corsair_void_drvdata *drvdata =hid_get_drvdata (hid_dev);hid_hw_stop (hid_dev); -cancel_work_sync (&drvdata->battery_remove_work); -cancel_work_sync (&drvdata->battery_add_work); +cancel_work_sync (&drvdata->battery_work);if (drvdata->battery)power_supply_unregister (drvdata->battery);
Signature · 1 line
2.48.1
Greg Kroah-Hartman
maintainerPATCH 20/207 ksmbd: fix type confusion via race condition when using ipc_msg_send_request
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
commit e2ff19f0b7a30e03516e6eb73b948e27a55bc9d2 upstream.
req->handle is allocated using ksmbd_acquire_id(&ipc_ida), based on ida_alloc. req->handle from ksmbd_ipc_login_request and FSCTL_PIPE_TRANSCEIVE ioctl can be same and it could lead to type confusion between messages, resulting in access to unexpected parts of memory after an incorrect delivery. ksmbd check type of ipc response but missing add continue to check next ipc reponse.
--- fs/smb/server/transport_ipc.c | 1 + 1 file changed, 1 insertion(+)
fs/smb/server/transport_ipc.c +1 -0
@@ -281,6 +281,7 @@ static int handle_response(int type, voiif (entry->type +1 != type) {pr_err ("Waiting for IPC type %d, got %d. Ignore.\n" , entry->type +1 , type); +continue ; } entry->response =kvzalloc (sz,KSMBD_DEFAULT_GFP );
Greg Kroah-Hartman
maintainerPATCH 21/207 ksmbd: fix out-of-bounds in parse_sec_desc()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
commit d6e13e19063db24f94b690159d0633aaf72a0f03 upstream.
If osidoffset, gsidoffset and dacloffset could be greater than smb_ntsd struct size. If it is smaller, It could cause slab-out-of-bounds. And when validating sid, It need to check it included subauth array size.
--- fs/smb/server/smbacl.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
fs/smb/server/smbacl.c +16 -0
@@ -807,6 +807,13 @@ static int parse_sid(struct smb_sid *psireturn -EINVAL ; } +if (!psid->num_subauth) +return 0 ; + +if (psid->num_subauth >SID_MAX_SUB_AUTHORITIES || + end_of_acl < (char *)psid +8 +sizeof (__le32) * psid->num_subauth) +return -EINVAL ; +return 0 ; }
@@ -848,6 +855,9 @@ int parse_sec_desc(struct mnt_idmap *idm pntsd->type =cpu_to_le16 (DACL_PRESENT );if (pntsd->osidoffset) { +if (le32_to_cpu (pntsd->osidoffset) <sizeof (struct smb_ntsd )) +return -EINVAL ; + rc =parse_sid (owner_sid_ptr, end_of_acl);if (rc) {pr_err ("%s: Error %d parsing Owner SID\n" , __func__, rc);
@@ -863,6 +873,9 @@ int parse_sec_desc(struct mnt_idmap *idm }if (pntsd->gsidoffset) { +if (le32_to_cpu (pntsd->gsidoffset) <sizeof (struct smb_ntsd )) +return -EINVAL ; + rc =parse_sid (group_sid_ptr, end_of_acl);if (rc) { pr_err("%s: Error %d mapping Owner SID to gid\n",
@@ -884,6 +897,9 @@ int parse_sec_desc(struct mnt_idmap *idm pntsd->type |=cpu_to_le16 (DACL_PROTECTED );if (dacloffset) { +if (dacloffset <sizeof (struct smb_ntsd )) +return -EINVAL ; +parse_dacl (idmap, dacl_ptr, end_of_acl, owner_sid_ptr, group_sid_ptr, fattr); }
Greg Kroah-Hartman
maintainerPATCH 22/207 ksmbd: fix use-after-free in smb2_lock
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
commit 84d2d1641b71dec326e8736a749b7ee76a9599fc upstream.
If smb_lock->zero_len has value, ->llist of smb_lock is not delete and flock is old one. It will cause use-after-free on error handling routine.
--- fs/smb/server/smb2pdu.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
fs/smb/server/smb2pdu.c +3 -3
@@ -7457,13 +7457,13 @@ out_check_cl: } no_check_cl: + flock = smb_lock->fl; +list_del (&smb_lock->llist); +if (smb_lock->zero_len) { err =0 ; goto skip; } - - flock = smb_lock->fl; -list_del (&smb_lock->llist); retry: rc =vfs_lock_file (filp, smb_lock->cmd, flock,NULL ); skip:
Greg Kroah-Hartman
maintainerPATCH 23/207 ksmbd: fix bug on trap in smb2_lock
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
commit e26e2d2e15daf1ab33e0135caf2304a0cfa2744b upstream.
If lock count is greater than 1, flags could be old value. It should be checked with flags of smb_lock, not flags. It will cause bug-on trap from locks_free_lock in error handling routine.
--- fs/smb/server/smb2pdu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/smb/server/smb2pdu.c +1 -1
@@ -7467,7 +7467,7 @@ no_check_cl: retry: rc =vfs_lock_file (filp, smb_lock->cmd, flock,NULL ); skip: -if (flags &SMB2_LOCKFLAG_UNLOCK ) { +if (smb_lock->flags &SMB2_LOCKFLAG_UNLOCK ) {if (!rc) {ksmbd_debug (SMB ,"File unlocked\n" ); }else if (rc == -ENOENT ) {
Greg Kroah-Hartman
maintainerPATCH 24/207 gpio: rcar: Use raw_spinlock to protect register access
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Söderlund <[email protected]>
commit f02c41f87cfe61440c18bf77d1ef0a884b9ee2b5 upstream.
Use raw_spinlock in order to fix spurious messages about invalid context when spinlock debugging is enabled. The lock is only used to serialize register access.
[ 4.239592] =============================
[ 4.239595] [ BUG: Invalid wait context ]
[ 4.239599] 6.13.0-rc7-arm64-renesas-05496-gd088502a519f #35 Not tainted
[ 4.239603] -----------------------------
[ 4.239606] kworker/u8:5/76 is trying to lock:
[ 4.239609] ffff0000091898a0 (&p->lock){....}-{3:3}, at: gpio_rcar_config_interrupt_input_mode+0x34/0x164
[ 4.239641] other info that might help us debug this:
[ 4.239643] context-{5:5}
[ 4.239646] 5 locks held by kworker/u8:5/76:
[ 4.239651] #0: ffff0000080fb148 ((wq_completion)async){+.+.}-{0:0}, at: process_one_work+0x190/0x62c
[ 4.250180] OF: /soc/sound@ec500000/ports/port@0/endpoint: Read of boolean property 'frame-master' with a value.
[ 4.254094] #1: ffff80008299bd80 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_one_work+0x1b8/0x62c
[ 4.254109] #2: ffff00000920c8f8
[ 4.258345] OF: /soc/sound@ec500000/ports/port@1/endpoint: Read of boolean property 'bitclock-master' with a value.
[ 4.264803] (&dev->mutex){....}-{4:4}, at: __device_attach_async_helper+0x3c/0xdc
[ 4.264820] #3: ffff00000a50ca40 (request_class#2){+.+.}-{4:4}, at: __setup_irq+0xa0/0x690
[ 4.264840] #4:
[ 4.268872] OF: /soc/sound@ec500000/ports/port@1/endpoint: Read of boolean property 'frame-master' with a value.
[ 4.273275] ffff00000a50c8c8 (lock_class){....}-{2:2}, at: __setup_irq+0xc4/0x690
[ 4.296130] renesas_sdhi_internal_dmac ee100000.mmc: mmc1 base at 0x00000000ee100000, max clock rate 200 MHz
[ 4.304082] stack backtrace:
[ 4.304086] CPU: 1 UID: 0 PID: 76 Comm: kworker/u8:5 Not tainted 6.13.0-rc7-arm64-renesas-05496-gd088502a519f #35
[ 4.304092] Hardware name: Renesas Salvator-X 2nd version board based on r8a77965 (DT)
[ 4.304097] Workqueue: async async_run_entry_fn
[ 4.304106] Call trace:
[ 4.304110] show_stack+0x14/0x20 (C)
[ 4.304122] dump_stack_lvl+0x6c/0x90
[ 4.304131] dump_stack+0x14/0x1c
[ 4.304138] __lock_acquire+0xdfc/0x1584
[ 4.426274] lock_acquire+0x1c4/0x33c
[ 4.429942] _raw_spin_lock_irqsave+0x5c/0x80
[ 4.434307] gpio_rcar_config_interrupt_input_mode+0x34/0x164
[ 4.440061] gpio_rcar_irq_set_type+0xd4/0xd8
[ 4.444422] __irq_set_trigger+0x5c/0x178
[ 4.448435] __setup_irq+0x2e4/0x690
[ 4.452012] request_threaded_irq+0xc4/0x190
[ 4.456285] devm_request_threaded_irq+0x7c/0xf4
[ 4.459398] ata1: link resume succeeded after 1 retries
[ 4.460902] mmc_gpiod_request_cd_irq+0x68/0xe0
[ 4.470660] mmc_start_host+0x50/0xac
[ 4.474327] mmc_add_host+0x80/0xe4
[ 4.477817] tmio_mmc_host_probe+0x2b0/0x440
[ 4.482094] renesas_sdhi_probe+0x488/0x6f4
[ 4.486281] renesas_sdhi_internal_dmac_probe+0x60/0x78
[ 4.491509] platform_probe+0x64/0xd8
[ 4.495178] really_probe+0xb8/0x2a8
[ 4.498756] __driver_probe_device+0x74/0x118
[ 4.503116] driver_probe_device+0x3c/0x154
[ 4.507303] __device_attach_driver+0xd4/0x160
[ 4.511750] bus_for_each_drv+0x84/0xe0
[ 4.515588] __device_attach_async_helper+0xb0/0xdc
[ 4.520470] async_run_entry_fn+0x30/0xd8
[ 4.524481] process_one_work+0x210/0x62c
[ 4.528494] worker_thread+0x1ac/0x340
[ 4.532245] kthread+0x10c/0x110
[ 4.535476] ret_from_fork+0x10/0x20--- drivers/gpio/gpio-rcar.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-)
drivers/gpio/gpio-rcar.c +12 -12
@@ -40,7 +40,7 @@ struct gpio_rcar_info {struct gpio_rcar_priv {void __iomem *base; -spinlock_t lock; +raw_spinlock_t lock;struct device *dev;struct gpio_chip gpio_chip;unsigned int irq_parent;
@@ -123,7 +123,7 @@ static void gpio_rcar_config_interrupt_i* "Setting Level-Sensitive Interrupt Input Mode" */ -spin_lock_irqsave (&p->lock, flags); +raw_spin_lock_irqsave (&p->lock, flags);/* Configure positive or negative logic in POSNEG */ gpio_rcar_modify_bit (p,POSNEG , hwirq, !active_high_rising_edge);
@@ -142,7 +142,7 @@ static void gpio_rcar_config_interrupt_iif (!level_trigger)gpio_rcar_write (p,INTCLR ,BIT (hwirq)); -spin_unlock_irqrestore (&p->lock, flags); +raw_spin_unlock_irqrestore (&p->lock, flags); }static int gpio_rcar_irq_set_type (struct irq_data *d,unsigned int type)
@@ -246,7 +246,7 @@ static void gpio_rcar_config_general_inp* "Setting General Input Mode" */ -spin_lock_irqsave (&p->lock, flags); +raw_spin_lock_irqsave (&p->lock, flags);/* Configure positive logic in POSNEG */ gpio_rcar_modify_bit (p,POSNEG , gpio, false);
@@ -261,7 +261,7 @@ static void gpio_rcar_config_general_inpif (p->info.has_outdtsel && output)gpio_rcar_modify_bit (p,OUTDTSEL , gpio, false); -spin_unlock_irqrestore (&p->lock, flags); +raw_spin_unlock_irqrestore (&p->lock, flags); }static int gpio_rcar_request (struct gpio_chip *chip,unsigned offset)
@@ -347,7 +347,7 @@ static int gpio_rcar_get_multiple(structreturn 0 ; } -spin_lock_irqsave (&p->lock, flags); +raw_spin_lock_irqsave (&p->lock, flags); outputs =gpio_rcar_read (p,INOUTSEL ); m = outputs & bankmask;if (m)
@@ -356,7 +356,7 @@ static int gpio_rcar_get_multiple(struct m = ~outputs & bankmask;if (m) val |=gpio_rcar_read (p,INDT ) & m; -spin_unlock_irqrestore (&p->lock, flags); +raw_spin_unlock_irqrestore (&p->lock, flags); bits[0 ] = val;return 0 ;
@@ -367,9 +367,9 @@ static void gpio_rcar_set(struct gpio_chstruct gpio_rcar_priv *p =gpiochip_get_data (chip);unsigned long flags; -spin_lock_irqsave (&p->lock, flags); +raw_spin_lock_irqsave (&p->lock, flags);gpio_rcar_modify_bit (p,OUTDT , offset, value); -spin_unlock_irqrestore (&p->lock, flags); +raw_spin_unlock_irqrestore (&p->lock, flags); } static void gpio_rcar_set_multiple(struct gpio_chip *chip, unsigned long *mask,
@@ -386,12 +386,12 @@ static void gpio_rcar_set_multiple(strucif (!bankmask)return ; -spin_lock_irqsave (&p->lock, flags); +raw_spin_lock_irqsave (&p->lock, flags); val =gpio_rcar_read (p,OUTDT ); val &= ~bankmask; val |= (bankmask & bits[0 ]);gpio_rcar_write (p,OUTDT , val); -spin_unlock_irqrestore (&p->lock, flags); +raw_spin_unlock_irqrestore (&p->lock, flags); } static int gpio_rcar_direction_output(struct gpio_chip *chip, unsigned offset,
@@ -505,7 +505,7 @@ static int gpio_rcar_probe(struct platforeturn -ENOMEM ; p->dev = dev; -spin_lock_init (&p->lock); +raw_spin_lock_init (&p->lock);/* Get device configuration from DT node */ ret =gpio_rcar_parse_dt (p, &npins);
Greg Kroah-Hartman
maintainerPATCH 25/207 gpio: aggregator: protect driver attr handlers against module unload
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koichiro Den <[email protected]>
commit 12f65d1203507f7db3ba59930fe29a3b8eee9945 upstream.
Both new_device_store and delete_device_store touch module global resources (e.g. gpio_aggregator_lock). To prevent race conditions with module unload, a reference needs to be held.
Add try_module_get() in these handlers.
For new_device_store, this eliminates what appears to be the most dangerous
scenario: if an id is allocated from gpio_aggregator_idr but platform_device_register has not yet been called or completed, a concurrent module unload could fail to unregister/delete the device, leaving behind a dangling platform device/GPIO forwarder. This can result in various issues. The following simple reproducer demonstrates these problems:
#!/bin/bash
while :; do
# note: whether 'gpiochip0 0' exists or not does not matter. echo 'gpiochip0 0' > /sys/bus/platform/drivers/gpio-aggregator/new_device
done &
while :; do
modprobe gpio-aggregator
modprobe -r gpio-aggregator
done &
wait
Starting with the following warning, several kinds of warnings will appear and the system may become unstable:
------------[ cut here ]------------ list_del corruption, ffff888103e2e980->next is LIST_POISON1 (dead000000000100) WARNING: CPU: 1 PID: 1327 at lib/list_debug.c:56 __list_del_entry_valid_or_report+0xa3/0x120 [...] RIP: 0010:__list_del_entry_valid_or_report+0xa3/0x120 [...] Call Trace: <TASK> ? __list_del_entry_valid_or_report+0xa3/0x120 ? __warn.cold+0x93/0xf2 ? __list_del_entry_valid_or_report+0xa3/0x120 ? report_bug+0xe6/0x170 ? __irq_work_queue_local+0x39/0xe0 ? handle_bug+0x58/0x90 ? exc_invalid_op+0x13/0x60 ? asm_exc_invalid_op+0x16/0x20 ? __list_del_entry_valid_or_report+0xa3/0x120 gpiod_remove_lookup_table+0x22/0x60 new_device_store+0x315/0x350 [gpio_aggregator] kernfs_fop_write_iter+0x137/0x1f0 vfs_write+0x262/0x430 ksys_write+0x60/0xd0 do_syscall_64+0x6c/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e [...] </TASK> ---[ end trace 0000000000000000 ]---
--- drivers/gpio/gpio-aggregator.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-)
drivers/gpio/gpio-aggregator.c +17 -3
@@ -119,10 +119,15 @@ static ssize_t new_device_store(struct dstruct platform_device *pdev;int res, id; +if (!try_module_get (THIS_MODULE )) +return -ENOENT ; +/* kernfs guarantees string termination, so count + 1 is safe */ aggr =kzalloc (sizeof (*aggr) + count +1 ,GFP_KERNEL ); -if (!aggr) -return -ENOMEM ; +if (!aggr) { + res = -ENOMEM ; + goto put_module; + }memcpy (aggr->args, buf, count +1 );
@@ -161,6 +166,7 @@ static ssize_t new_device_store(struct d } aggr->pdev = pdev; +module_put (THIS_MODULE );return count; remove_table:
@@ -175,6 +181,8 @@ free_table:kfree (aggr->lookups); free_ga:kfree (aggr); +put_module: +module_put (THIS_MODULE );return res; }
@@ -203,13 +211,19 @@ static ssize_t delete_device_store(strucif (error)return error; +if (!try_module_get (THIS_MODULE )) +return -ENOENT ; +mutex_lock (&gpio_aggregator_lock); aggr =idr_remove (&gpio_aggregator_idr, id);mutex_unlock (&gpio_aggregator_lock); -if (!aggr) +if (!aggr) { +module_put (THIS_MODULE );return -ENOENT ; + }gpio_aggregator_free (aggr); +module_put (THIS_MODULE );return count; }static DRIVER_ATTR_WO (delete_device);
Greg Kroah-Hartman
maintainerPATCH 26/207 ALSA: seq: Avoid module auto-load handling at event delivery
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit c9ce148ea753bef66686460fa3cec6641cdfbb9f upstream.
snd_seq_client_use_ptr() is supposed to return the snd_seq_client object for the given client ID, and it tries to handle the module auto-loading when no matching object is found. Although the module handling is performed only conditionally with "!in_interrupt()", this condition may be fragile, e.g. when the code is called from the ALSA timer callback where the spinlock is temporarily disabled while the irq is disabled. Then his doesn't fit well and spews the error about sleep from invalid context, as complained recently by syzbot.
Also, in general, handling the module-loading at each time if no matching object is found is really an overkill. It can be still useful when performed at the top-level ioctl or proc reads, but it shouldn't be done at event delivery at all.
For addressing the issues above, this patch disables the module handling in snd_seq_client_use_ptr() in normal cases like event deliveries, but allow only in limited and safe situations. A new function client_load_and_use_ptr() is used for the cases where the module loading can be done safely, instead.
--- sound/core/seq/seq_clientmgr.c | 46 ++++++++++++++++++++++++++--------------- 1 file changed, 30 insertions(+), 16 deletions(-)
sound/core/seq/seq_clientmgr.c +30 -16
@@ -106,7 +106,7 @@ static struct snd_seq_client *clientptr(return clienttab[clientid]; } -struct snd_seq_client *snd_seq_client_use_ptr (int clientid) +static struct snd_seq_client *client_use_ptr (int clientid,bool load_module) {unsigned long flags;struct snd_seq_client *client;
@@ -126,7 +126,7 @@ struct snd_seq_client *snd_seq_client_us }spin_unlock_irqrestore (&clients_lock, flags);#ifdef CONFIG_MODULES -if (!in_interrupt ()) { +if (load_module) { static DECLARE_BITMAP(client_requested, SNDRV_SEQ_GLOBAL_CLIENTS); static DECLARE_BITMAP(card_requested, SNDRV_CARDS);
@@ -168,6 +168,20 @@ struct snd_seq_client *snd_seq_client_usreturn client; } +/* get snd_seq_client object for the given id quickly */ +struct snd_seq_client *snd_seq_client_use_ptr (int clientid) +{ +return client_use_ptr (clientid, false); +} + +/* get snd_seq_client object for the given id; +* if not found, retry after loading the modules +*/ +static struct snd_seq_client *client_load_and_use_ptr (int clientid) +{ +return client_use_ptr (clientid,IS_ENABLED (CONFIG_MODULES )); +} +/* Take refcount and perform ioctl_mutex lock on the given client; * used only for OSS sequencer * Unlock via snd_seq_client_ioctl_unlock() below
@@ -176,7 +190,7 @@ bool snd_seq_client_ioctl_lock(int clien {struct snd_seq_client *client; - client =snd_seq_client_use_ptr (clientid); + client =client_load_and_use_ptr (clientid);if (!client)return false;mutex_lock (&client->ioctl_mutex);
@@ -1195,7 +1209,7 @@ static int snd_seq_ioctl_running_mode(stint err =0 ;/* requested client number */ - cptr =snd_seq_client_use_ptr (info->client); + cptr =client_load_and_use_ptr (info->client);if (cptr ==NULL )return -ENOENT ;/* don't change !!! */
@@ -1257,7 +1271,7 @@ static int snd_seq_ioctl_get_client_infostruct snd_seq_client *cptr;/* requested client number */ - cptr =snd_seq_client_use_ptr (client_info->client); + cptr =client_load_and_use_ptr (client_info->client);if (cptr ==NULL )return -ENOENT ;/* don't change !!! */
@@ -1392,7 +1406,7 @@ static int snd_seq_ioctl_get_port_info(sstruct snd_seq_client *cptr;struct snd_seq_client_port *port; - cptr =snd_seq_client_use_ptr (info->addr.client); + cptr =client_load_and_use_ptr (info->addr.client);if (cptr ==NULL )return -ENXIO ;
@@ -1496,10 +1510,10 @@ static int snd_seq_ioctl_subscribe_port(struct snd_seq_client *receiver =NULL , *sender =NULL ;struct snd_seq_client_port *sport =NULL , *dport =NULL ; - receiver =snd_seq_client_use_ptr (subs->dest.client); + receiver =client_load_and_use_ptr (subs->dest.client);if (!receiver) goto __end; - sender =snd_seq_client_use_ptr (subs->sender.client); + sender =client_load_and_use_ptr (subs->sender.client);if (!sender) goto __end; sport =snd_seq_port_use_ptr (sender, subs->sender.port);
@@ -1864,7 +1878,7 @@ static int snd_seq_ioctl_get_client_poolstruct snd_seq_client_pool *info = arg;struct snd_seq_client *cptr; - cptr =snd_seq_client_use_ptr (info->client); + cptr =client_load_and_use_ptr (info->client);if (cptr ==NULL )return -ENOENT ;memset (info,0 ,sizeof (*info));
@@ -1968,7 +1982,7 @@ static int snd_seq_ioctl_get_subscriptiostruct snd_seq_client_port *sport =NULL ; result = -EINVAL ; - sender =snd_seq_client_use_ptr (subs->sender.client); + sender =client_load_and_use_ptr (subs->sender.client);if (!sender) goto __end; sport =snd_seq_port_use_ptr (sender, subs->sender.port);
@@ -1999,7 +2013,7 @@ static int snd_seq_ioctl_query_subs(strustruct list_head *p;int i; - cptr =snd_seq_client_use_ptr (subs->root.client); + cptr =client_load_and_use_ptr (subs->root.client);if (!cptr) goto __end; port =snd_seq_port_use_ptr (cptr, subs->root.port);
@@ -2066,7 +2080,7 @@ static int snd_seq_ioctl_query_next_clieif (info->client <0 ) info->client =0 ;for (; info->client <SNDRV_SEQ_MAX_CLIENTS ; info->client++) { - cptr =snd_seq_client_use_ptr (info->client); + cptr =client_load_and_use_ptr (info->client);if (cptr)break ;/* found */ }
@@ -2089,7 +2103,7 @@ static int snd_seq_ioctl_query_next_portstruct snd_seq_client *cptr;struct snd_seq_client_port *port =NULL ; - cptr =snd_seq_client_use_ptr (info->addr.client); + cptr =client_load_and_use_ptr (info->addr.client);if (cptr ==NULL )return -ENXIO ;
@@ -2186,7 +2200,7 @@ static int snd_seq_ioctl_client_ump_info size =sizeof (struct snd_ump_endpoint_info ); else size =sizeof (struct snd_ump_block_info ); - cptr =snd_seq_client_use_ptr (client); + cptr =client_load_and_use_ptr (client);if (!cptr)return -ENOENT ;
@@ -2458,7 +2472,7 @@ int snd_seq_kernel_client_enqueue(int clif (check_event_type_and_length (ev))return -EINVAL ; - cptr =snd_seq_client_use_ptr (client); + cptr =client_load_and_use_ptr (client);if (cptr ==NULL )return -EINVAL ;
@@ -2690,7 +2704,7 @@ void snd_seq_info_clients_read(struct sn/* list the client table */ for (c =0 ; c <SNDRV_SEQ_MAX_CLIENTS ; c++) { - client =snd_seq_client_use_ptr (c); + client =client_load_and_use_ptr (c);if (client ==NULL )continue ;if (client->type ==NO_CLIENT ) {
Greg Kroah-Hartman
maintainerPATCH 27/207 ALSA: hda: intel: Add Dell ALC3271 to power_save denylist
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hoku Ishibe <[email protected]>
commit 1ee5aa765c22a0577ec552d460bf2035300b4b51 upstream.
Dell XPS 13 7390 with the Realtek ALC3271 codec experiences persistent humming noise when the power_save mode is enabled. This issue occurs when the codec enters power saving mode, leading to unwanted noise from the speakers.
This patch adds the affected model (PCI ID 0x1028:0x0962) to the power_save denylist to ensure power_save is disabled by default, preventing power-off related noise issues.
Steps to Reproduce
1. Boot the system with snd_hda_intel loaded.
2. Verify that power_save mode is enabled:
```sh cat /sys/module/snd_hda_intel/parameters/power_save ````
output: 10 (default power save timeout)
3. Wait for the power save timeout
4. Observe a persistent humming noise from the speakers
5. Disable power_save manually:
```sh echo 0 | sudo tee /sys/module/snd_hda_intel/parameters/power_save ````
6. Confirm that the noise disappears immediately.
This issue has been observed on my system, and this patch successfully eliminates the unwanted noise. If other users experience similar issues, additional reports would be helpful.
--- sound/pci/hda/hda_intel.c | 2 ++ 1 file changed, 2 insertions(+)
sound/pci/hda/hda_intel.c +2 -0
@@ -2232,6 +2232,8 @@ static const struct snd_pci_quirk power_SND_PCI_QUIRK (0x1631 ,0xe017 ,"Packard Bell NEC IMEDIA 5204" ,0 ),/* KONTRON SinglePC may cause a stall at runtime resume */ SND_PCI_QUIRK (0x1734 ,0x1232 ,"KONTRON SinglePC" ,0 ), +/* Dell ALC3271 */ + SND_PCI_QUIRK(0x1028, 0x0962, "Dell ALC3271", 0), {} };
Greg Kroah-Hartman
maintainerPATCH 28/207 ALSA: hda/realtek - add supported Mic Mute LED for Lenovo platform
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kailang Yang <[email protected]>
commit f603b159231b0c58f0c27ab39348534063d38223 upstream.
Support Mic Mute LED for ThinkCentre M series.
--- sound/pci/hda/patch_realtek.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
sound/pci/hda/patch_realtek.c +18 -0
@@ -5055,6 +5055,16 @@ static void alc269_fixup_hp_line1_mic1_l } } +static void alc233_fixup_lenovo_low_en_micmute_led (struct hda_codec *codec, +const struct hda_fixup *fix,int action) +{ +struct alc_spec *spec = codec->spec; + +if (action ==HDA_FIXUP_ACT_PRE_PROBE ) + spec->micmute_led_polarity =1 ; +alc233_fixup_lenovo_line2_mic_hotkey (codec, fix, action); +} +static void alc_hp_mute_disable (struct hda_codec *codec,unsigned int delay) {if (delay <=0 )
@@ -7608,6 +7618,7 @@ enum {ALC275_FIXUP_DELL_XPS ,ALC293_FIXUP_LENOVO_SPK_NOISE ,ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY , +ALC233_FIXUP_LENOVO_L2MH_LOW_ENLED ,ALC255_FIXUP_DELL_SPK_NOISE ,ALC225_FIXUP_DISABLE_MIC_VREF , ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
@@ -8596,6 +8607,10 @@ static const struct hda_fixup alc269_fix .type = HDA_FIXUP_FUNC, .v.func = alc233_fixup_lenovo_line2_mic_hotkey, }, + [ALC233_FIXUP_LENOVO_L2MH_LOW_ENLED] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc233_fixup_lenovo_low_en_micmute_led, + }, [ALC233_FIXUP_INTEL_NUC8_DMIC] = { .type = HDA_FIXUP_FUNC, .v.func = alc_fixup_inv_dmic,
@@ -10884,6 +10899,9 @@ static const struct hda_quirk alc269_fixSND_PCI_QUIRK (0x17aa ,0x3178 ,"ThinkCentre Station" ,ALC283_FIXUP_HEADSET_MIC ),SND_PCI_QUIRK (0x17aa ,0x31af ,"ThinkCentre Station" ,ALC623_FIXUP_LENOVO_THINKSTATION_P340 ),SND_PCI_QUIRK (0x17aa ,0x334b ,"Lenovo ThinkCentre M70 Gen5" ,ALC283_FIXUP_HEADSET_MIC ), +SND_PCI_QUIRK (0x17aa ,0x3384 ,"ThinkCentre M90a PRO" ,ALC233_FIXUP_LENOVO_L2MH_LOW_ENLED ), +SND_PCI_QUIRK (0x17aa ,0x3386 ,"ThinkCentre M90a Gen6" ,ALC233_FIXUP_LENOVO_L2MH_LOW_ENLED ), +SND_PCI_QUIRK (0x17aa ,0x3387 ,"ThinkCentre M70a Gen6" ,ALC233_FIXUP_LENOVO_L2MH_LOW_ENLED ),SND_PCI_QUIRK (0x17aa ,0x3801 ,"Lenovo Yoga9 14IAP7" ,ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN ),HDA_CODEC_QUIRK (0x17aa ,0x3802 ,"DuetITL 2021" ,ALC287_FIXUP_YOGA7_14ITL_SPEAKERS ), SND_PCI_QUIRK(0x17aa, 0x3802, "Lenovo Yoga Pro 9 14IRP8", ALC287_FIXUP_TAS2781_I2C),
Greg Kroah-Hartman
maintainerPATCH 29/207 ALSA: hda/realtek: update ALC222 depop optimize
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kailang Yang <[email protected]>
commit ca0dedaff92307591f66c9206933fbdfe87add10 upstream.
Add ALC222 its own depop functions for alc_init and alc_shutup.
[note: this fixes pop noise issues on the models with two headphone
jacks -- tiwai ]
--- sound/pci/hda/patch_realtek.c | 76 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 76 insertions(+)
sound/pci/hda/patch_realtek.c +76 -0
@@ -3845,6 +3845,79 @@ static void alc225_shutup(struct hda_cod } } +static void alc222_init (struct hda_codec *codec) +{ +struct alc_spec *spec = codec->spec; +hda_nid_t hp_pin =alc_get_hp_pin (spec); +bool hp1_pin_sense, hp2_pin_sense; + +if (!hp_pin) +return ; + +msleep (30 ); + + hp1_pin_sense =snd_hda_jack_detect (codec, hp_pin); + hp2_pin_sense =snd_hda_jack_detect (codec,0x14 ); + +if (hp1_pin_sense || hp2_pin_sense) { +msleep (2 ); + +if (hp1_pin_sense) +snd_hda_codec_write (codec, hp_pin,0 , +AC_VERB_SET_PIN_WIDGET_CONTROL ,PIN_OUT ); +if (hp2_pin_sense) +snd_hda_codec_write (codec,0x14 ,0 , +AC_VERB_SET_PIN_WIDGET_CONTROL ,PIN_OUT ); +msleep (75 ); + +if (hp1_pin_sense) +snd_hda_codec_write (codec, hp_pin,0 , +AC_VERB_SET_AMP_GAIN_MUTE ,AMP_OUT_UNMUTE ); +if (hp2_pin_sense) +snd_hda_codec_write (codec,0x14 ,0 , +AC_VERB_SET_AMP_GAIN_MUTE ,AMP_OUT_UNMUTE ); + +msleep (75 ); + } +} + +static void alc222_shutup (struct hda_codec *codec) +{ +struct alc_spec *spec = codec->spec; +hda_nid_t hp_pin =alc_get_hp_pin (spec); +bool hp1_pin_sense, hp2_pin_sense; + +if (!hp_pin) + hp_pin =0x21 ; + + hp1_pin_sense =snd_hda_jack_detect (codec, hp_pin); + hp2_pin_sense =snd_hda_jack_detect (codec,0x14 ); + +if (hp1_pin_sense || hp2_pin_sense) { +msleep (2 ); + +if (hp1_pin_sense) +snd_hda_codec_write (codec, hp_pin,0 , +AC_VERB_SET_AMP_GAIN_MUTE ,AMP_OUT_MUTE ); +if (hp2_pin_sense) +snd_hda_codec_write (codec,0x14 ,0 , +AC_VERB_SET_AMP_GAIN_MUTE ,AMP_OUT_MUTE ); + +msleep (75 ); + +if (hp1_pin_sense) +snd_hda_codec_write (codec, hp_pin,0 , +AC_VERB_SET_PIN_WIDGET_CONTROL ,0x0 ); +if (hp2_pin_sense) +snd_hda_codec_write (codec,0x14 ,0 , +AC_VERB_SET_PIN_WIDGET_CONTROL ,0x0 ); + +msleep (75 ); + } +alc_auto_setup_eapd (codec, false); +alc_shutup_pins (codec); +} +static void alc_default_init (struct hda_codec *codec) {struct alc_spec *spec = codec->spec;
@@ -11888,8 +11961,11 @@ static int patch_alc269(struct hda_codec spec->codec_variant =ALC269_TYPE_ALC300 ; spec->gen.mixer_nid =0 ;/* no loopback on ALC300 */ break ; +case 0x10ec0222 :case 0x10ec0623 : spec->codec_variant =ALC269_TYPE_ALC623 ; + spec->shutup = alc222_shutup; + spec->init_hook = alc222_init;break ;case 0x10ec0700 :case 0x10ec0701 :
Greg Kroah-Hartman
maintainerPATCH 30/207 btrfs: zoned: fix extent range end unlock in cow_file_range()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naohiro Aota <[email protected]>
commit 5a4041f2c47247575a6c2e53ce14f7b0ac946c33 upstream.
Running generic/751 on the for-next branch often results in a hang like below. They are both stack by locking an extent. This suggests someone forget to unlock an extent.
INFO: task kworker/u128:1:12 blocked for more than 323 seconds.
Not tainted 6.13.0-BTRFS-ZNS+ #503
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u128:1 state:D stack:0 pid:12 tgid:12 ppid:2 flags:0x00004000
Workqueue: btrfs-fixup btrfs_work_helper [btrfs]
Call Trace:
<TASK>
__schedule+0x534/0xdd0
schedule+0x39/0x140
__lock_extent+0x31b/0x380 [btrfs]
? __pfx_autoremove_wake_function+0x10/0x10
btrfs_writepage_fixup_worker+0xf1/0x3a0 [btrfs]
btrfs_work_helper+0xff/0x480 [btrfs]
? lock_release+0x178/0x2c0
process_one_work+0x1ee/0x570
? srso_return_thunk+0x5/0x5f
worker_thread+0x1d1/0x3b0
? __pfx_worker_thread+0x10/0x10
kthread+0x10b/0x230
? __pfx_kthread+0x10/0x10
ret_from_fork+0x30/0x50
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1a/0x30
</TASK>
INFO: task kworker/u134:0:184 blocked for more than 323 seconds.
Not tainted 6.13.0-BTRFS-ZNS+ #503
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u134:0 state:D stack:0 pid:184 tgid:184 ppid:2 flags:0x00004000
Workqueue: writeback wb_workfn (flush-btrfs-4)
Call Trace:
<TASK>
__schedule+0x534/0xdd0
schedule+0x39/0x140
__lock_extent+0x31b/0x380 [btrfs]
? __pfx_autoremove_wake_function+0x10/0x10
find_lock_delalloc_range+0xdb/0x260 [btrfs]
writepage_delalloc+0x12f/0x500 [btrfs]
? srso_return_thunk+0x5/0x5f
extent_write_cache_pages+0x232/0x840 [btrfs]
btrfs_writepages+0x72/0x130 [btrfs]
do_writepages+0xe7/0x260
? srso_return_thunk+0x5/0x5f
? lock_acquire+0xd2/0x300
? srso_return_thunk+0x5/0x5f
? find_held_lock+0x2b/0x80
? wbc_attach_and_unlock_inode.part.0+0x102/0x250
? wbc_attach_and_unlock_inode.part.0+0x102/0x250
__writeback_single_inode+0x5c/0x4b0
writeback_sb_inodes+0x22d/0x550
__writeback_inodes_wb+0x4c/0xe0
wb_writeback+0x2f6/0x3f0
wb_workfn+0x32a/0x510
process_one_work+0x1ee/0x570
? srso_return_thunk+0x5/0x5f
worker_thread+0x1d1/0x3b0
? __pfx_worker_thread+0x10/0x10
kthread+0x10b/0x230
? __pfx_kthread+0x10/0x10
ret_from_fork+0x30/0x50
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1a/0x30
</TASK>This happens because we have another success path for the zoned mode. When there is no active zone available, btrfs_reserve_extent() returns -EAGAIN. In this case, we have two reactions.
(1) If the given range is never allocated, we can only wait for someone to finish a zone, so wait on BTRFS_FS_NEED_ZONE_FINISH bit and retry afterward.
(2) Or, if some allocations are already done, we must bail out and let the caller to send IOs for the allocation. This is because these IOs may be necessary to finish a zone.
The commit 06f364284794 ("btrfs: do proper folio cleanup when cow_file_range() failed") moved the unlock code from the inside of the loop to the outside. So, previously, the allocated extents are unlocked just after the allocation and so before returning from the function. However, they are no longer unlocked on the case (2) above. That caused the hang issue.
Fix the issue by modifying the 'end' to the end of the allocated range. Then, we can exit the loop and the same unlock code can properly handle the case.
--- fs/btrfs/inode.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
fs/btrfs/inode.c +7 -2
@@ -1426,8 +1426,13 @@ static noinline int cow_file_range(struccontinue ; }if (done_offset) { - *done_offset = start -1 ; -return 0 ; +/* +* Move @end to the end of the processed range, +* and exit the loop to unlock the processed extents. +*/ + end = start -1 ; + ret =0 ; +break ; } ret = -ENOSPC ; }
Greg Kroah-Hartman
maintainerPATCH 31/207 btrfs: fix a leaked chunk map issue in read_one_chunk()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <[email protected]>
commit 35d99c68af40a8ca175babc5a89ef7e2226fb3ca upstream.
Add btrfs_free_chunk_map() to free the memory allocated by btrfs_alloc_chunk_map() if btrfs_add_chunk_map() fails.
--- fs/btrfs/volumes.c | 1 + 1 file changed, 1 insertion(+)
fs/btrfs/volumes.c +1 -0
@@ -7076,6 +7076,7 @@ static int read_one_chunk(struct btrfs_kbtrfs_err (fs_info,"failed to add chunk map, start=%llu len=%llu: %d" , map->start, map->chunk_len, ret); +btrfs_free_chunk_map (map); }return ret;
Greg Kroah-Hartman
maintainerPATCH 32/207 virt: sev-guest: Allocate request data dynamically
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikunj A Dadhania <[email protected]>
commit ac7c06acaa3738b38e83815ac0f07140ad320f13 upstream.
Commit
ae596615d93d ("virt: sev-guest: Reduce the scope of SNP command mutex")
narrowed the command mutex scope to snp_send_guest_request(). However, GET_REPORT, GET_DERIVED_KEY, and GET_EXT_REPORT share the req structure in snp_guest_dev. Without the mutex protection, concurrent requests can overwrite each other's data. Fix it by dynamically allocating the request structure.
--- drivers/virt/coco/sev-guest/sev-guest.c | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-)
drivers/virt/coco/sev-guest/sev-guest.c +15 -9
@@ -41,12 +41,6 @@ struct snp_guest_dev {struct miscdevice misc;struct snp_msg_desc *msg_desc; - -union { -struct snp_report_req report; -struct snp_derived_key_req derived_key; -struct snp_ext_report_req ext_report; - } req; };/*
@@ -390,7 +384,7 @@ struct snp_req_resp {static int get_report (struct snp_guest_dev *snp_dev,struct snp_guest_request_ioctl *arg) { -struct snp_report_req *report_req = &snp_dev->req.report; + struct snp_report_req *report_req __free(kfree) = NULL;struct snp_msg_desc *mdesc = snp_dev->msg_desc;struct snp_report_resp *report_resp;struct snp_guest_req req = {};
@@ -399,6 +393,10 @@ static int get_report(struct snp_guest_dif (!arg->req_data || !arg->resp_data)return -EINVAL ; + report_req =kzalloc (sizeof (*report_req),GFP_KERNEL_ACCOUNT ); +if (!report_req) +return -ENOMEM ; +if (copy_from_user (report_req, (void __user *)arg->req_data,sizeof (*report_req)))return -EFAULT ;
@@ -435,7 +433,7 @@ e_free:static int get_derived_key (struct snp_guest_dev *snp_dev,struct snp_guest_request_ioctl *arg) { -struct snp_derived_key_req *derived_key_req = &snp_dev->req.derived_key; + struct snp_derived_key_req *derived_key_req __free(kfree) = NULL;struct snp_derived_key_resp derived_key_resp = {0 };struct snp_msg_desc *mdesc = snp_dev->msg_desc;struct snp_guest_req req = {};
@@ -455,6 +453,10 @@ static int get_derived_key(struct snp_guif (sizeof (buf) < resp_len)return -ENOMEM ; + derived_key_req =kzalloc (sizeof (*derived_key_req),GFP_KERNEL_ACCOUNT ); +if (!derived_key_req) +return -ENOMEM ; +if (copy_from_user (derived_key_req, (void __user *)arg->req_data,sizeof (*derived_key_req)))return -EFAULT ;
@@ -487,7 +489,7 @@ static int get_ext_report(struct snp_gue struct snp_req_resp *io) { -struct snp_ext_report_req *report_req = &snp_dev->req.ext_report; + struct snp_ext_report_req *report_req __free(kfree) = NULL;struct snp_msg_desc *mdesc = snp_dev->msg_desc;struct snp_report_resp *report_resp;struct snp_guest_req req = {};
@@ -497,6 +499,10 @@ static int get_ext_report(struct snp_gueif (sockptr_is_null (io->req_data) ||sockptr_is_null (io->resp_data))return -EINVAL ; + report_req =kzalloc (sizeof (*report_req),GFP_KERNEL_ACCOUNT ); +if (!report_req) +return -ENOMEM ; +if (copy_from_sockptr (report_req, io->req_data,sizeof (*report_req)))return -EFAULT ;
Greg Kroah-Hartman
maintainerPATCH 33/207 hwmon: (peci/dimmtemp) Do not provide fake thresholds data
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Fertser <[email protected]>
commit 5797c04400ee117bfe459ff1e468d0ea38054ab4 upstream.
When an Icelake or Sapphire Rapids CPU isn't providing the maximum and critical thresholds for particular DIMM the driver should return an error to the userspace instead of giving it stale (best case) or wrong (the structure contains all zeros after kzalloc() call) data.
The issue can be reproduced by binding the peci driver while the host is fully booted and idle, this makes PECI interaction unreliable enough.
--- drivers/hwmon/peci/dimmtemp.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
drivers/hwmon/peci/dimmtemp.c +4 -6
@@ -127,8 +127,6 @@ static int update_thresholds(struct pecireturn 0 ; ret = priv->gen_info->read_thresholds (priv, dimm_order, chan_rank, &data); -if (ret == -ENODATA )/* Use default or previous value */ -return 0 ;if (ret)return ret;
@@ -509,11 +507,11 @@ read_thresholds_icx(struct peci_dimmtemp ret =peci_ep_pci_local_read (priv->peci_dev,0 ,13 ,0 ,2 ,0xd4 , ®_val);if (ret || !(reg_val &BIT (31 ))) -return -ENODATA ;/* Use default or previous value */ +return -ENODATA ; ret =peci_ep_pci_local_read (priv->peci_dev,0 ,13 ,0 ,2 ,0xd0 , ®_val);if (ret) -return -ENODATA ;/* Use default or previous value */ +return -ENODATA ;/* * Device 26, Offset 224e0: IMC 0 channel 0 -> rank 0
@@ -546,11 +544,11 @@ read_thresholds_spr(struct peci_dimmtemp ret =peci_ep_pci_local_read (priv->peci_dev,0 ,30 ,0 ,2 ,0xd4 , ®_val);if (ret || !(reg_val &BIT (31 ))) -return -ENODATA ;/* Use default or previous value */ +return -ENODATA ; ret =peci_ep_pci_local_read (priv->peci_dev,0 ,30 ,0 ,2 ,0xd0 , ®_val);if (ret) -return -ENODATA ;/* Use default or previous value */ +return -ENODATA ;/* * Device 26, Offset 219a8: IMC 0 channel 0 -> rank 0
Greg Kroah-Hartman
maintainerPATCH 34/207 drm/amd/display: Fix null check for pipe_ctx->plane_state in resource_build_scaling_params
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
commit 374c9faac5a763a05bc3f68ad9f73dab3c6aec90 upstream.
Null pointer dereference issue could occur when pipe_ctx->plane_state is null. The fix adds a check to ensure 'pipe_ctx->plane_state' is not null before accessing. This prevents a null pointer dereference.
Found by code review.
--- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/core/dc_resource.c +2 -1
@@ -1455,7 +1455,8 @@ bool resource_build_scaling_params(strucDC_LOGGER_INIT (pipe_ctx->stream->ctx->logger);/* Invalid input */ -if (!plane_state->dst_rect.width || +if (!plane_state || + !plane_state->dst_rect.width || !plane_state->dst_rect.height || !plane_state->src_rect.width || !plane_state->src_rect.height) {
Greg Kroah-Hartman
maintainerPATCH 35/207 drm/amdkfd: Fix NULL Pointer Dereference in KFD queue
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Martin <[email protected]>
commit fd617ea3b79d2116d53f76cdb5a3601c0ba6e42f upstream.
Through KFD IOCTL Fuzzing we encountered a NULL pointer derefrence when calling kfd_queue_acquire_buffers.
--- drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdkfd/kfd_queue.c +2 -2
@@ -266,8 +266,8 @@ int kfd_queue_acquire_buffers(struct kfd/* EOP buffer is not required for all ASICs */ if (properties->eop_ring_buffer_address) {if (properties->eop_ring_buffer_size != topo_dev->node_props.eop_buffer_size) { -pr_debug ("queue eop bo size 0x%lx not equal to node eop buf size 0x%x\n" , - properties->eop_buf_bo->tbo.base.size, +pr_debug ("queue eop bo size 0x%x not equal to node eop buf size 0x%x\n" , + properties->eop_ring_buffer_size, topo_dev->node_props.eop_buffer_size); err = -EINVAL ; goto out_err_unreserve;
Greg Kroah-Hartman
maintainerPATCH 36/207 drm/amd/pm: always allow ih interrupt from fw
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kenneth Feng <[email protected]>
commit da552bda987420e877500fdd90bd0172e3bf412b upstream.
always allow ih interrupt from fw on smu v14 based on the interface requirement
--- drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-)
drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c +1 -11
@@ -1899,16 +1899,6 @@ static int smu_v14_0_allow_ih_interrupt( NULL); } -static int smu_v14_0_process_pending_interrupt (struct smu_context *smu) -{ -int ret =0 ; - -if (smu_cmn_feature_is_enabled (smu,SMU_FEATURE_ACDC_BIT )) - ret =smu_v14_0_allow_ih_interrupt (smu); - -return ret; -} -int smu_v14_0_enable_thermal_alert (struct smu_context *smu) {int ret =0 ;
@@ -1920,7 +1910,7 @@ int smu_v14_0_enable_thermal_alert(strucif (ret)return ret; -return smu_v14_0_process_pending_interrupt (smu); +return smu_v14_0_allow_ih_interrupt (smu); }int smu_v14_0_disable_thermal_alert (struct smu_context *smu)
Greg Kroah-Hartman
maintainerPATCH 37/207 drm/imagination: avoid deadlock on fence release
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brendan King <[email protected]>
commit df1a1ed5e1bdd9cc13148e0e5549f5ebcf76cf13 upstream.
Do scheduler queue fence release processing on a workqueue, rather than in the release function itself.
Fixes deadlock issues such as the following:
[ 607.400437] ============================================
[ 607.405755] WARNING: possible recursive locking detected
[ 607.415500] --------------------------------------------
[ 607.420817] weston:zfq0/24149 is trying to acquire lock:
[ 607.426131] ffff000017d041a0 (reservation_ww_class_mutex){+.+.}-{3:3}, at: pvr_gem_object_vunmap+0x40/0xc0 [powervr]
[ 607.436728]
but task is already holding lock:
[ 607.442554] ffff000017d105a0 (reservation_ww_class_mutex){+.+.}-{3:3}, at: dma_buf_ioctl+0x250/0x554
[ 607.451727]
other info that might help us debug this:
[ 607.458245] Possible unsafe locking scenario:[ 607.464155] CPU0
[ 607.466601] ----
[ 607.469044] lock(reservation_ww_class_mutex);
[ 607.473584] lock(reservation_ww_class_mutex);
[ 607.478114]
*** DEADLOCK ***--- drivers/gpu/drm/imagination/pvr_queue.c | 13 +++++++++++-- drivers/gpu/drm/imagination/pvr_queue.h | 4 ++++ 2 files changed, 15 insertions(+), 2 deletions(-)
drivers/gpu/drm/imagination/pvr_queue.c +11 -2
@@ -109,12 +109,20 @@ pvr_queue_fence_get_driver_name(struct dreturn PVR_DRIVER_NAME ; } +static void pvr_queue_fence_release_work (struct work_struct *w) +{ + struct pvr_queue_fence *fence = container_of(w, struct pvr_queue_fence, release_work); + +pvr_context_put (fence->queue->ctx); +dma_fence_free (&fence->base); +} +static void pvr_queue_fence_release (struct dma_fence *f) { struct pvr_queue_fence *fence = container_of(f, struct pvr_queue_fence, base); +struct pvr_device *pvr_dev = fence->queue->ctx->pvr_dev; -pvr_context_put (fence->queue->ctx); -dma_fence_free (f); +queue_work (pvr_dev->sched_wq, &fence->release_work); } static const char *
@@ -268,6 +276,7 @@ pvr_queue_fence_init(struct dma_fence *fpvr_context_get (queue->ctx); fence->queue = queue; +INIT_WORK (&fence->release_work, pvr_queue_fence_release_work);dma_fence_init (&fence->base, fence_ops, &fence_ctx->lock, fence_ctx->id,atomic_inc_return (&fence_ctx->seqno));
drivers/gpu/drm/imagination/pvr_queue.h +4 -0
@@ -5,6 +5,7 @@#define PVR_QUEUE_H #include <drm/gpu_scheduler.h> +#include <linux/workqueue.h> #include "pvr_cccb.h" #include "pvr_device.h"
@@ -63,6 +64,9 @@ struct pvr_queue_fence {/** @queue: Queue that created this fence. */ struct pvr_queue *queue; + +/** @release_work: Fence release work structure. */ +struct work_struct release_work; };/**
Greg Kroah-Hartman
maintainerPATCH 38/207 drm/imagination: Hold drm_gem_gpuva lock for unmap
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brendan King <[email protected]>
commit a5c4c3ba95a52d66315acdfbaba9bd82ed39c250 upstream.
Avoid a warning from drm_gem_gpuva_assert_lock_held in drm_gpuva_unlink.
The Imagination driver uses the GEM object reservation lock to protect the gpuva list, but the GEM object was not always known in the code paths that ended up calling drm_gpuva_unlink. When the GEM object isn't known, it is found by calling drm_gpuva_find to lookup the object associated with a given virtual address range, or by calling drm_gpuva_find_first when removing all mappings.
--- drivers/gpu/drm/imagination/pvr_fw_meta.c | 6 - drivers/gpu/drm/imagination/pvr_vm.c | 134 ++++++++++++++++++++++++------ drivers/gpu/drm/imagination/pvr_vm.h | 3 3 files changed, 115 insertions(+), 28 deletions(-)
drivers/gpu/drm/imagination/pvr_fw_meta.c +4 -2
@@ -527,8 +527,10 @@ pvr_meta_vm_map(struct pvr_device *pvr_dstatic void pvr_meta_vm_unmap (struct pvr_device *pvr_dev,struct pvr_fw_object *fw_obj) { -pvr_vm_unmap (pvr_dev->kernel_vm_ctx, fw_obj->fw_mm_node.start, - fw_obj->fw_mm_node.size); +struct pvr_gem_object *pvr_obj = fw_obj->gem; + +pvr_vm_unmap_obj (pvr_dev->kernel_vm_ctx, pvr_obj, + fw_obj->fw_mm_node.start, fw_obj->fw_mm_node.size); } static bool
drivers/gpu/drm/imagination/pvr_vm.c +108 -26
187 lines not on this page · raw message
drivers/gpu/drm/imagination/pvr_vm.h +3 -0
@@ -38,6 +38,9 @@ struct pvr_vm_context *pvr_vm_create_conint pvr_vm_map (struct pvr_vm_context *vm_ctx,struct pvr_gem_object *pvr_obj,u64 pvr_obj_offset,u64 device_addr,u64 size); +int pvr_vm_unmap_obj (struct pvr_vm_context *vm_ctx, +struct pvr_gem_object *pvr_obj, +u64 device_addr,u64 size);int pvr_vm_unmap (struct pvr_vm_context *vm_ctx,u64 device_addr,u64 size);void pvr_vm_unmap_all (struct pvr_vm_context *vm_ctx);
Greg Kroah-Hartman
maintainerPATCH 39/207 drm/imagination: only init job done fences once
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brendan King <[email protected]>
commit 68c3de7f707e8a70e0a6d8087cf0fe4a3d5dbfb0 upstream.
Ensure job done fences are only initialised once.
This fixes a memory manager not clean warning from drm_mm_takedown on module unload.
--- drivers/gpu/drm/imagination/pvr_queue.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/gpu/drm/imagination/pvr_queue.c +3 -2
@@ -313,8 +313,9 @@ pvr_queue_cccb_fence_init(struct dma_fenstatic void pvr_queue_job_fence_init (struct dma_fence *fence,struct pvr_queue *queue) { -pvr_queue_fence_init (fence, queue, &pvr_queue_job_fence_ops, - &queue->job_fence_ctx); +if (!fence->ops) +pvr_queue_fence_init (fence, queue, &pvr_queue_job_fence_ops, + &queue->job_fence_ctx); }/**
Greg Kroah-Hartman
maintainerPATCH 40/207 drm/radeon: Fix rs400_gpu_init for ATI mobility radeon Xpress 200M
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Thier <[email protected]>
commit 29ffeb73b216ce3eff10229eb077cf9b7812119d upstream.
num_gb_pipes was set to a wrong value using r420_pipe_config
This have lead to HyperZ glitches on fast Z clearing.
--- drivers/gpu/drm/radeon/r300.c | 3 ++- drivers/gpu/drm/radeon/radeon_asic.h | 1 + drivers/gpu/drm/radeon/rs400.c | 18 ++++++++++++++++-- 3 files changed, 19 insertions(+), 3 deletions(-)
drivers/gpu/drm/radeon/r300.c +2 -1
@@ -359,7 +359,8 @@ int r300_mc_wait_for_idle(struct radeon_return -1 ; } -static void r300_gpu_init (struct radeon_device *rdev) +/* rs400_gpu_init also calls this! */ +void r300_gpu_init (struct radeon_device *rdev) {uint32_t gb_tile_config, tmp;
drivers/gpu/drm/radeon/radeon_asic.h +1 -0
@@ -165,6 +165,7 @@ void r200_set_safe_registers(struct rade*/ extern int r300_init (struct radeon_device *rdev);extern void r300_fini (struct radeon_device *rdev); +extern void r300_gpu_init (struct radeon_device *rdev);extern int r300_suspend (struct radeon_device *rdev);extern int r300_resume (struct radeon_device *rdev);extern int r300_asic_reset (struct radeon_device *rdev,bool hard);
drivers/gpu/drm/radeon/rs400.c +16 -2
@@ -256,8 +256,22 @@ int rs400_mc_wait_for_idle(struct radeonstatic void rs400_gpu_init (struct radeon_device *rdev) { -/* FIXME: is this correct ? */ -r420_pipes_init (rdev); +/* Earlier code was calling r420_pipes_init and then +* rs400_mc_wait_for_idle(rdev). The problem is that +* at least on my Mobility Radeon Xpress 200M RC410 card +* that ends up in this code path ends up num_gb_pipes == 3 +* while the card seems to have only one pipe. With the +* r420 pipe initialization method. +* +* Problems shown up as HyperZ glitches, see: +* https://bugs.freedesktop.org/show_bug.cgi?id=110897 +* +* Delegating initialization to r300 code seems to work +* and results in proper pipe numbers. The rs400 cards +* are said to be not r400, but r300 kind of cards. +*/ +r300_gpu_init (rdev); +if (rs400_mc_wait_for_idle (rdev)) {pr_warn ("rs400: Failed to wait MC idle while programming pipes. Bad things might happen. %08x\n" ,RREG32 (RADEON_MC_STATUS ));
Greg Kroah-Hartman
maintainerPATCH 41/207 Revert "mm/page_alloc.c: dont show protection in zones ->lowmem_reserve[] for empty zone"
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabriel Krisman Bertazi <[email protected]>
commit eae116d1f0449ade3269ca47a67432622f5c6438 upstream.
Commit 96a5c186efff ("mm/page_alloc.c: don't show protection in zone's ->lowmem_reserve[] for empty zone") removes the protection of lower zones from allocations targeting memory-less high zones. This had an unintended impact on the pattern of reclaims because it makes the high-zone-targeted allocation more likely to succeed in lower zones, which adds pressure to said zones. I.e, the following corresponding checks in zone_watermark_ok/zone_watermark_fast are less likely to trigger:
if (free_pages <= min + z->lowmem_reserve[highest_zoneidx])
return false;As a result, we are observing an increase in reclaim and kswapd scans, due to the increased pressure. This was initially observed as increased latency in filesystem operations when benchmarking with fio on a machine with some memory-less zones, but it has since been associated with increased contention in locks related to memory reclaim. By reverting this patch, the original performance was recovered on that machine.
The original commit was introduced as a clarification of the /proc/zoneinfo output, so it doesn't seem there are usecases depending on it, making the revert a simple solution.
For reference, I collected vmstat with and without this patch on a freshly booted system running intensive randread io from an nvme for 5 minutes. I got:
rpm-6.12.0-slfo.1.2 -> pgscan_kswapd 5629543865
Patched -> pgscan_kswapd 33580844
33M scans is similar to what we had in kernels predating this patch. These numbers is fairly representative of the workload on this machine, as measured in several runs. So we are talking about a 2-order of magnitude increase.
--- mm/page_alloc.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
mm/page_alloc.c +1 -2
@@ -5858,11 +5858,10 @@ static void setup_per_zone_lowmem_reservfor (j = i +1 ; j <MAX_NR_ZONES ; j++) {struct zone *upper_zone = &pgdat->node_zones[j]; -bool empty = !zone_managed_pages (upper_zone); managed_pages +=zone_managed_pages (upper_zone); -if (clear || empty) +if (clear) zone->lowmem_reserve[j] =0 ;else zone->lowmem_reserve[j] = managed_pages / ratio;
Greg Kroah-Hartman
maintainerPATCH 42/207 Revert "selftests/mm: remove local __NR_* definitions"
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Hubbard <[email protected]>
commit 0a7565ee6ec31eb16c0476adbfc1af3f2271cb6b upstream.
This reverts commit a5c6bc590094a1a73cf6fa3f505e1945d2bf2461.
The general approach described in commit e076eaca5906 ("selftests: break the dependency upon local header files") was taken one step too far here:
it should not have been extended to include the syscall numbers. This is because doing so would require per-arch support in tools/include/uapi, and no such support exists.
This revert fixes two separate reports of test failures, from Dave Hansen[1], and Li Wang[2]. An excerpt of Dave's report:
Before this commit (a5c6bc590094a1a73cf6fa3f505e1945d2bf2461) things are fine. But after, I get:
running PKEY tests for unsupported CPU/OS
An excerpt of Li's report:
I just found that mlock2_() return a wrong value in mlock2-test
[1] https://lore.kernel.org/[email protected]
[2] https://lore.kernel.org/CAEemH2eW=UMu9+turT2jRie7+6ewUazXmA6kL+VBo3cGDGU6RA@mail.gmail.com
--- tools/testing/selftests/mm/hugepage-mremap.c | 2 +- tools/testing/selftests/mm/ksm_functional_tests.c | 8 +++++++- tools/testing/selftests/mm/memfd_secret.c | 14 +++++++++++++- tools/testing/selftests/mm/mkdirty.c | 8 +++++++- tools/testing/selftests/mm/mlock2.h | 1 - tools/testing/selftests/mm/protection_keys.c | 2 +- tools/testing/selftests/mm/uffd-common.c | 4 ++++ tools/testing/selftests/mm/uffd-stress.c | 15 ++++++++++++++- tools/testing/selftests/mm/uffd-unit-tests.c | 14 +++++++++++++- 9 files changed, 60 insertions(+), 8 deletions(-)
tools/testing/selftests/mm/hugepage-mremap.c +1 -1
@@ -15,7 +15,7 @@#define _GNU_SOURCE#include <stdlib.h> #include <stdio.h> -#include <asm-generic/unistd.h> +#include <unistd.h> #include <sys/mman.h> #include <errno.h> #include <fcntl.h> /* Definition of O_* constants */
tools/testing/selftests/mm/ksm_functional_tests.c +7 -1
@@ -11,7 +11,7 @@#include <string.h> #include <stdbool.h> #include <stdint.h> -#include <asm-generic/unistd.h> +#include <unistd.h> #include <errno.h> #include <fcntl.h> #include <sys/mman.h>
@@ -369,6 +369,7 @@ unmap:munmap (map, size); } +#ifdef __NR_userfaultfdstatic void test_unmerge_uffd_wp (void ) {struct uffdio_writeprotect uffd_writeprotect;
@@ -429,6 +430,7 @@ close_uffd: unmap: munmap(map, size); } +#endif /* Verify that KSM can be enabled / queried with prctl. */ static void test_prctl (void )
@@ -684,7 +686,9 @@ int main(int argc, char **argv)exit (test_child_ksm ()); } +#ifdef __NR_userfaultfd tests++; +#endif ksft_print_header ();ksft_set_plan (tests);
@@ -696,7 +700,9 @@ int main(int argc, char **argv)test_unmerge ();test_unmerge_zero_pages ();test_unmerge_discarded (); +#ifdef __NR_userfaultfdtest_unmerge_uffd_wp (); +#endif test_prot_none ();
tools/testing/selftests/mm/memfd_secret.c +13 -1
@@ -17,7 +17,7 @@#include <stdlib.h> #include <string.h> -#include <asm-generic/unistd.h> +#include <unistd.h> #include <errno.h> #include <stdio.h> #include <fcntl.h>
@@ -28,6 +28,8 @@#define pass (fmt, ...) ksft_test_result_pass(fmt, ##__VA_ARGS__)#define skip (fmt, ...) ksft_test_result_skip(fmt, ##__VA_ARGS__) +#ifdef __NR_memfd_secret +#define PATTERN 0x55static const int prot =PROT_READ |PROT_WRITE ;
@@ -332,3 +334,13 @@ int main(int argc, char *argv[]) ksft_finished(); } + +#else /* __NR_memfd_secret */ + +int main (int argc,char *argv[]) +{ +printf ("skip: skipping memfd_secret test (missing __NR_memfd_secret)\n" ); +return KSFT_SKIP ; +} + +#endif /* __NR_memfd_secret */
tools/testing/selftests/mm/mkdirty.c +7 -1
@@ -9,7 +9,7 @@*/ #include <fcntl.h> #include <signal.h> -#include <asm-generic/unistd.h> +#include <unistd.h> #include <string.h> #include <errno.h> #include <stdlib.h>
@@ -265,6 +265,7 @@ munmap:munmap (mmap_mem, mmap_size); } +#ifdef __NR_userfaultfdstatic void test_uffdio_copy (void ) {struct uffdio_register uffdio_register;
@@ -321,6 +322,7 @@ munmap:munmap (dst, pagesize); free(src); } +#endif /* __NR_userfaultfd */ int main (void ) {
@@ -333,7 +335,9 @@ int main(void) thpsize / 1024); tests +=3 ; } +#ifdef __NR_userfaultfd tests +=1 ; +#endif /* __NR_userfaultfd */ ksft_print_header ();ksft_set_plan (tests);
@@ -363,7 +367,9 @@ int main(void)if (thpsize)test_pte_mapped_thp ();/* Placing a fresh page via userfaultfd may set the PTE dirty. */ +#ifdef __NR_userfaultfdtest_uffdio_copy (); +#endif /* __NR_userfaultfd */ err =ksft_get_fail_cnt ();if (err)
tools/testing/selftests/mm/mlock2.h +0 -1
@@ -3,7 +3,6 @@#include <errno.h> #include <stdio.h> #include <stdlib.h> -#include <asm-generic/unistd.h> static int mlock2_ (void *start,size_t len,int flags) {
tools/testing/selftests/mm/protection_keys.c +1 -1
@@ -42,7 +42,7 @@#include <sys/wait.h> #include <sys/stat.h> #include <fcntl.h> -#include <asm-generic/unistd.h> +#include <unistd.h> #include <sys/ptrace.h> #include <setjmp.h>
tools/testing/selftests/mm/uffd-common.c +4 -0
@@ -673,7 +673,11 @@ int uffd_open_dev(unsigned int flags)int uffd_open_sys (unsigned int flags) { +#ifdef __NR_userfaultfdreturn syscall (__NR_userfaultfd, flags); +#else +return -1 ; +#endif }int uffd_open (unsigned int flags)
tools/testing/selftests/mm/uffd-stress.c +14 -1
@@ -33,10 +33,11 @@* pthread_mutex_lock will also verify the atomicity of the memory * transfer (UFFDIO_COPY). */ -#include <asm-generic/unistd.h> +#include "uffd-common.h" uint64_t features; +#ifdef __NR_userfaultfd#define BOUNCE_RANDOM (1<<0)#define BOUNCE_RACINGFAULTS (1<<1)
@@ -471,3 +472,15 @@ int main(int argc, char **argv) nr_pages, nr_pages_per_cpu); return userfaultfd_stress(); } + +#else /* __NR_userfaultfd */ + +#warning "missing __NR_userfaultfd definition" + +int main (void ) +{ +printf ("skip: Skipping userfaultfd test (missing __NR_userfaultfd)\n" ); +return KSFT_SKIP ; +} + +#endif /* __NR_userfaultfd */
tools/testing/selftests/mm/uffd-unit-tests.c +13 -1
@@ -5,11 +5,12 @@* Copyright (C) 2015-2023 Red Hat, Inc. */ -#include <asm-generic/unistd.h> #include "uffd-common.h" #include "../../../../mm/gup_test.h" +#ifdef __NR_userfaultfd +/* The unit test doesn't need a large or random size, make it 32MB for now */ #define UFFD_TEST_MEM_SIZE (32UL << 20)
@@ -1558,3 +1559,14 @@ int main(int argc, char *argv[]) return ksft_get_fail_cnt() ? KSFT_FAIL : KSFT_PASS; } +#else /* __NR_userfaultfd */ + +#warning "missing __NR_userfaultfd definition" + +int main (void ) +{ +printf ("Skipping %s (missing __NR_userfaultfd)\n" , __file__); +return KSFT_SKIP ; +} + +#endif /* __NR_userfaultfd */
Greg Kroah-Hartman
maintainerPATCH 43/207 platform/x86: thinkpad_acpi: Add battery quirk for ThinkPad X131e
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mingcong Bai <[email protected]>
commit d0d10eaedcb53740883d7e5d53c5e15c879b48fb upstream.
Based on the dmesg messages from the original reporter:
[ 4.964073] ACPI: \_SB_.PCI0.LPCB.EC__.HKEY: BCTG evaluated but flagged as error [ 4.964083] thinkpad_acpi: Error probing battery 2
Lenovo ThinkPad X131e also needs this battery quirk.
--- drivers/platform/x86/thinkpad_acpi.c | 1 + 1 file changed, 1 insertion(+)
drivers/platform/x86/thinkpad_acpi.c +1 -0
@@ -9958,6 +9958,7 @@ static const struct tpacpi_quirk battery* Individual addressing is broken on models that expose the * primary battery as BAT1. */ +TPACPI_Q_LNV ('G' ,'8' , true),/* ThinkPad X131e */ TPACPI_Q_LNV ('8' ,'F' , true),/* Thinkpad X120e */ TPACPI_Q_LNV ('J' ,'7' , true),/* B5400 */ TPACPI_Q_LNV('J', 'I', true), /* Thinkpad 11e */
Greg Kroah-Hartman
maintainerPATCH 44/207 x86/boot: Sanitize boot params before parsing command line
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <[email protected]>
commit c00b413a96261faef4ce22329153c6abd4acef25 upstream.
The 5-level paging code parses the command line to look for the 'no5lvl' string, and does so very early, before sanitize_boot_params() has been called and has been given the opportunity to wipe bogus data from the fields in boot_params that are not covered by struct setup_header, and are therefore supposed to be initialized to zero by the bootloader.
This triggers an early boot crash when using syslinux-efi to boot a recent kernel built with CONFIG_X86_5LEVEL=y and CONFIG_EFI_STUB=n, as the 0xff padding that now fills the unused PE/COFF header is copied into boot_params by the bootloader, and interpreted as the top half of the command line pointer.
Fix this by sanitizing the boot_params before use. Note that there is no harm in calling this more than once; subsequent invocations are able to spot that the boot_params have already been cleaned up.
--- arch/x86/boot/compressed/pgtable_64.c | 2 ++ 1 file changed, 2 insertions(+)
arch/x86/boot/compressed/pgtable_64.c +2 -0
@@ -1,6 +1,7 @@// SPDX-License-Identifier: GPL-2.0 #include "misc.h" #include <asm/bootparam.h> +#include <asm/bootparam_utils.h> #include <asm/e820/types.h> #include <asm/processor.h> #include "pgtable.h"
@@ -107,6 +108,7 @@ asmlinkage void configure_5level_paging(bool l5_required = false;/* Initialize boot_params. Required for cmdline_find_option_bool(). */ +sanitize_boot_params (bp); boot_params_ptr = bp;/*
Greg Kroah-Hartman
maintainerPATCH 45/207 x86/cacheinfo: Validate CPUID leaf 0x2 EDX output
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ahmed S. Darwish <[email protected]>
commit 8177c6bedb7013cf736137da586cf783922309dd upstream.
CPUID leaf 0x2 emits one-byte descriptors in its four output registers EAX, EBX, ECX, and EDX. For these descriptors to be valid, the most significant bit (MSB) of each register must be clear.
The historical Git commit:
019361a20f016 ("- pre6: Intel: start to add Pentium IV specific stuff (128-byte cacheline etc)...")
introduced leaf 0x2 output parsing. It only validated the MSBs of EAX, EBX, and ECX, but left EDX unchecked.
Validate EDX's most-significant bit.
--- arch/x86/kernel/cpu/cacheinfo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/cpu/cacheinfo.c +1 -1
@@ -808,7 +808,7 @@ void init_intel_cacheinfo(struct cpuinfocpuid (2 , ®s[0 ], ®s[1 ], ®s[2 ], ®s[3 ]);/* If bit 31 is set, this is an unknown format */ -for (j =0 ; j <3 ; j++) +for (j =0 ; j <4 ; j++)if (regs[j] & (1 <<31 )) regs[j] =0 ;
Greg Kroah-Hartman
maintainerPATCH 46/207 x86/cpu: Validate CPUID leaf 0x2 EDX output
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ahmed S. Darwish <[email protected]>
commit 1881148215c67151b146450fb89ec22fd92337a7 upstream.
CPUID leaf 0x2 emits one-byte descriptors in its four output registers EAX, EBX, ECX, and EDX. For these descriptors to be valid, the most significant bit (MSB) of each register must be clear.
Leaf 0x2 parsing at intel.c only validated the MSBs of EAX, EBX, and ECX, but left EDX unchecked.
Validate EDX's most-significant bit as well.
--- arch/x86/kernel/cpu/intel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/cpu/intel.c +1 -1
@@ -804,7 +804,7 @@ static void intel_detect_tlb(struct cpuicpuid (2 , ®s[0 ], ®s[1 ], ®s[2 ], ®s[3 ]);/* If bit 31 is set, this is an unknown format */ -for (j =0 ; j <3 ; j++) +for (j =0 ; j <4 ; j++)if (regs[j] & (1 <<31 )) regs[j] =0 ;
Greg Kroah-Hartman
maintainerPATCH 47/207 x86/cpu: Properly parse CPUID leaf 0x2 TLB descriptor 0x63
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ahmed S. Darwish <[email protected]>
commit f6bdaab79ee4228a143ee1b4cb80416d6ffc0c63 upstream.
CPUID leaf 0x2's one-byte TLB descriptors report the number of entries for specific TLB types, among other properties.
Typically, each emitted descriptor implies the same number of entries for its respective TLB type(s). An emitted 0x63 descriptor is an
exception: it implies 4 data TLB entries for 1GB pages and 32 data TLB entries for 2MB or 4MB pages.
For the TLB descriptors parsing code, the entry count for 1GB pages is encoded at the intel_tlb_table[] mapping, but the 2MB/4MB entry count is totally ignored.
Update leaf 0x2's parsing logic 0x2 to account for 32 data TLB entries for 2MB/4MB pages implied by the 0x63 descriptor.
--- arch/x86/kernel/cpu/intel.c | 60 ++++++++++++++++++++++++++++---------------- 1 file changed, 39 insertions(+), 21 deletions(-)
arch/x86/kernel/cpu/intel.c +39 -21
@@ -640,26 +640,37 @@ static unsigned int intel_size_cache(str }#endif -#define TLB_INST_4K 0x01 -#define TLB_INST_4M 0x02 -#define TLB_INST_2M_4M 0x03 - -#define TLB_INST_ALL 0x05 -#define TLB_INST_1G 0x06 - -#define TLB_DATA_4K 0x11 -#define TLB_DATA_4M 0x12 -#define TLB_DATA_2M_4M 0x13 -#define TLB_DATA_4K_4M 0x14 - -#define TLB_DATA_1G 0x16 - -#define TLB_DATA0_4K 0x21 -#define TLB_DATA0_4M 0x22 -#define TLB_DATA0_2M_4M 0x23 - -#define STLB_4K 0x41 -#define STLB_4K_2M 0x42 +#define TLB_INST_4K 0x01 +#define TLB_INST_4M 0x02 +#define TLB_INST_2M_4M 0x03 + +#define TLB_INST_ALL 0x05 +#define TLB_INST_1G 0x06 + +#define TLB_DATA_4K 0x11 +#define TLB_DATA_4M 0x12 +#define TLB_DATA_2M_4M 0x13 +#define TLB_DATA_4K_4M 0x14 + +#define TLB_DATA_1G 0x16 +#define TLB_DATA_1G_2M_4M 0x17 + +#define TLB_DATA0_4K 0x21 +#define TLB_DATA0_4M 0x22 +#define TLB_DATA0_2M_4M 0x23 + +#define STLB_4K 0x41 +#define STLB_4K_2M 0x42 + +/* +* All of leaf 0x2's one-byte TLB descriptors implies the same number of +* entries for their respective TLB types. The 0x63 descriptor is an +* exception: it implies 4 dTLB entries for 1GB pages 32 dTLB entries +* for 2MB or 4MB pages. Encode descriptor 0x63 dTLB entry count for +* 2MB/4MB pages here, as its count for dTLB 1GB pages is already at the +* intel_tlb_table[] mapping. +*/ +#define TLB_0x63_2M_4M_ENTRIES 32static const struct _tlb_table intel_tlb_table[] = { {0x01 ,TLB_INST_4K ,32 ," TLB_INST 4 KByte pages, 4-way set associative" },
@@ -681,7 +692,8 @@ static const struct _tlb_table intel_tlb { 0x5c, TLB_DATA_4K_4M, 128, " TLB_DATA 4 KByte and 4 MByte pages" }, { 0x5d, TLB_DATA_4K_4M, 256, " TLB_DATA 4 KByte and 4 MByte pages" }, { 0x61, TLB_INST_4K, 48, " TLB_INST 4 KByte pages, full associative" }, - { 0x63, TLB_DATA_1G, 4, " TLB_DATA 1 GByte pages, 4-way set associative" }, + { 0x63, TLB_DATA_1G_2M_4M, 4, " TLB_DATA 1 GByte pages, 4-way set associative" + " (plus 32 entries TLB_DATA 2 MByte or 4 MByte pages, not encoded here)" }, { 0x6b, TLB_DATA_4K, 256, " TLB_DATA 4 KByte pages, 8-way associative" }, { 0x6c, TLB_DATA_2M_4M, 128, " TLB_DATA 2 MByte or 4 MByte pages, 8-way associative" }, { 0x6d, TLB_DATA_1G, 16, " TLB_DATA 1 GByte pages, fully associative" },
@@ -781,6 +793,12 @@ static void intel_tlb_lookup(const unsigif (tlb_lld_4m[ENTRIES ] < intel_tlb_table[k].entries) tlb_lld_4m[ENTRIES ] = intel_tlb_table[k].entries;break ; +case TLB_DATA_1G_2M_4M : +if (tlb_lld_2m[ENTRIES ] < TLB_0x63_2M_4M_ENTRIES) + tlb_lld_2m[ENTRIES ] = TLB_0x63_2M_4M_ENTRIES; +if (tlb_lld_4m[ENTRIES ] < TLB_0x63_2M_4M_ENTRIES) + tlb_lld_4m[ENTRIES ] = TLB_0x63_2M_4M_ENTRIES; + fallthrough;case TLB_DATA_1G :if (tlb_lld_1g[ENTRIES ] < intel_tlb_table[k].entries) tlb_lld_1g[ENTRIES ] = intel_tlb_table[k].entries;
Greg Kroah-Hartman
maintainerPATCH 48/207 drm/xe: Add staging tree for VM binds
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Brost <[email protected]>
commit ae482ec8cd1a85bde3307f71921a7780086fbec0 upstream.
Concurrent VM bind staging and zapping of PTEs from a userptr notifier do not work because the view of PTEs is not stable. VM binds cannot acquire the notifier lock during staging, as memory allocations are required. To resolve this race condition, use a staging tree for VM binds that is committed only under the userptr notifier lock during the final step of the bind. This ensures a consistent view of the PTEs in the userptr notifier.
A follow up may only use staging for VM in fault mode as this is the only mode in which the above race exists.
v3:
- Drop zap PTE change (Thomas)
- s/xe_pt_entry/xe_pt_entry_staging (Thomas)
--- drivers/gpu/drm/xe/xe_pt.c | 58 +++++++++++++++++++++++++++------------- drivers/gpu/drm/xe/xe_pt_walk.c | 3 +- drivers/gpu/drm/xe/xe_pt_walk.h | 4 ++ 3 files changed, 46 insertions(+), 19 deletions(-)
drivers/gpu/drm/xe/xe_pt.c +40 -18
@@ -28,6 +28,8 @@ struct xe_pt_dir {struct xe_pt pt;/** @children: Array of page-table child nodes */ struct xe_ptw *children[XE_PDES ]; +/** @staging: Array of page-table staging nodes */ +struct xe_ptw *staging[XE_PDES ]; };#if IS_ENABLED (CONFIG_DRM_XE_DEBUG_VM )
@@ -48,9 +50,10 @@ static struct xe_pt_dir *as_xe_pt_dir(st return container_of(pt, struct xe_pt_dir, pt); } -static struct xe_pt *xe_pt_entry (struct xe_pt_dir *pt_dir,unsigned int index) +static struct xe_pt * +xe_pt_entry_staging (struct xe_pt_dir *pt_dir,unsigned int index) { - return container_of(pt_dir->children[index], struct xe_pt, base); + return container_of(pt_dir->staging[index], struct xe_pt, base); } static u64 __xe_pt_empty_pte(struct xe_tile *tile, struct xe_vm *vm,
@@ -125,6 +128,7 @@ struct xe_pt *xe_pt_create(struct xe_vm } pt->bo = bo; pt->base.children = level ?as_xe_pt_dir (pt)->children :NULL ; + pt->base.staging = level ?as_xe_pt_dir (pt)->staging :NULL ;if (vm->xef)xe_drm_client_add_bo (vm->xef->client, pt->bo);
@@ -205,8 +209,8 @@ void xe_pt_destroy(struct xe_pt *pt, u32struct xe_pt_dir *pt_dir =as_xe_pt_dir (pt);for (i =0 ; i <XE_PDES ; i++) { -if (xe_pt_entry (pt_dir, i)) -xe_pt_destroy (xe_pt_entry (pt_dir, i), flags, +if (xe_pt_entry_staging (pt_dir, i)) +xe_pt_destroy (xe_pt_entry_staging (pt_dir, i), flags, deferred); } }
@@ -375,8 +379,10 @@ xe_pt_insert_entry(struct xe_pt_stage_bi/* Continue building a non-connected subtree. */ struct iosys_map *map = &parent->bo->vmap; -if (unlikely (xe_child)) +if (unlikely (xe_child)) { parent->base.children[offset] = &xe_child->base; + parent->base.staging[offset] = &xe_child->base; + }xe_pt_write (xe_walk->vm->xe, map, offset, pte); parent->num_live++;
@@ -613,6 +619,7 @@ xe_pt_stage_bind(struct xe_tile *tile, s .ops = &xe_pt_stage_bind_ops, .shifts = xe_normal_pt_shifts, .max_level = XE_PT_HIGHEST_LEVEL, + .staging = true, }, .vm = xe_vma_vm(vma), .tile = tile,
@@ -872,7 +879,7 @@ static void xe_pt_cancel_bind(struct xe_ } } -static void xe_pt_commit_locks_assert (struct xe_vma *vma) +static void xe_pt_commit_prepare_locks_assert (struct xe_vma *vma) {struct xe_vm *vm =xe_vma_vm (vma);
@@ -884,6 +891,16 @@ static void xe_pt_commit_locks_assert(stxe_vm_assert_held (vm); } +static void xe_pt_commit_locks_assert (struct xe_vma *vma) +{ +struct xe_vm *vm =xe_vma_vm (vma); + +xe_pt_commit_prepare_locks_assert (vma); + +if (xe_vma_is_userptr (vma)) +lockdep_assert_held_read (&vm->userptr.notifier_lock); +} +static void xe_pt_commit (struct xe_vma *vma,struct xe_vm_pgtable_update *entries,u32 num_entries,struct llist_head *deferred)
@@ -894,13 +911,17 @@ static void xe_pt_commit(struct xe_vma *for (i =0 ; i < num_entries; i++) {struct xe_pt *pt = entries[i].pt; +struct xe_pt_dir *pt_dir;if (!pt->level)continue ; + pt_dir =as_xe_pt_dir (pt);for (j =0 ; j < entries[i].qwords; j++) {struct xe_pt *oldpte = entries[i].pt_entries[j].pt; +int j_ = j + entries[i].ofs; + pt_dir->children[j_] = pt_dir->staging[j_];xe_pt_destroy (oldpte,xe_vma_vm (vma)->flags, deferred); } }
@@ -912,7 +933,7 @@ static void xe_pt_abort_bind(struct xe_v {int i, j; -xe_pt_commit_locks_assert (vma); +xe_pt_commit_prepare_locks_assert (vma);for (i = num_entries -1 ; i >=0 ; --i) {struct xe_pt *pt = entries[i].pt;
@@ -927,10 +948,10 @@ static void xe_pt_abort_bind(struct xe_v pt_dir =as_xe_pt_dir (pt);for (j =0 ; j < entries[i].qwords; j++) {u32 j_ = j + entries[i].ofs; -struct xe_pt *newpte =xe_pt_entry (pt_dir, j_); +struct xe_pt *newpte =xe_pt_entry_staging (pt_dir, j_);struct xe_pt *oldpte = entries[i].pt_entries[j].pt; - pt_dir->children[j_] = oldpte ? &oldpte->base :0 ; + pt_dir->staging[j_] = oldpte ? &oldpte->base :0 ;xe_pt_destroy (newpte,xe_vma_vm (vma)->flags,NULL ); } }
@@ -942,7 +963,7 @@ static void xe_pt_commit_prepare_bind(st {u32 i, j; -xe_pt_commit_locks_assert (vma); +xe_pt_commit_prepare_locks_assert (vma);for (i =0 ; i < num_entries; i++) {struct xe_pt *pt = entries[i].pt;
@@ -960,10 +981,10 @@ static void xe_pt_commit_prepare_bind(ststruct xe_pt *newpte = entries[i].pt_entries[j].pt;struct xe_pt *oldpte =NULL ; -if (xe_pt_entry (pt_dir, j_)) - oldpte =xe_pt_entry (pt_dir, j_); +if (xe_pt_entry_staging (pt_dir, j_)) + oldpte =xe_pt_entry_staging (pt_dir, j_); - pt_dir->children[j_] = &newpte->base; + pt_dir->staging[j_] = &newpte->base; entries[i].pt_entries[j].pt = oldpte; } }
@@ -1513,6 +1534,7 @@ static unsigned int xe_pt_stage_unbind(s .ops = &xe_pt_stage_unbind_ops, .shifts = xe_normal_pt_shifts, .max_level = XE_PT_HIGHEST_LEVEL, + .staging = true, }, .tile = tile, .modified_start = xe_vma_start(vma),
@@ -1554,7 +1576,7 @@ static void xe_pt_abort_unbind(struct xe {int i, j; -xe_pt_commit_locks_assert (vma); +xe_pt_commit_prepare_locks_assert (vma);for (i = num_entries -1 ; i >=0 ; --i) {struct xe_vm_pgtable_update *entry = &entries[i];
@@ -1567,7 +1589,7 @@ static void xe_pt_abort_unbind(struct xecontinue ;for (j = entry->ofs; j < entry->ofs + entry->qwords; j++) - pt_dir->children[j] = + pt_dir->staging[j] = entries[i].pt_entries[j - entry->ofs].pt ? &entries[i].pt_entries[j - entry->ofs].pt->base :NULL ; }
@@ -1580,7 +1602,7 @@ xe_pt_commit_prepare_unbind(struct xe_vm {int i, j; -xe_pt_commit_locks_assert (vma); +xe_pt_commit_prepare_locks_assert (vma);for (i =0 ; i < num_entries; ++i) {struct xe_vm_pgtable_update *entry = &entries[i];
@@ -1594,8 +1616,8 @@ xe_pt_commit_prepare_unbind(struct xe_vm pt_dir =as_xe_pt_dir (pt);for (j = entry->ofs; j < entry->ofs + entry->qwords; j++) { entry->pt_entries[j - entry->ofs].pt = -xe_pt_entry (pt_dir, j); - pt_dir->children[j] =NULL ; +xe_pt_entry_staging (pt_dir, j); + pt_dir->staging[j] =NULL ; } } }
drivers/gpu/drm/xe/xe_pt_walk.c +2 -1
@@ -74,7 +74,8 @@ int xe_pt_walk_range(struct xe_ptw *pare u64 addr, u64 end, struct xe_pt_walk *walk) { pgoff_t offset = xe_pt_offset(addr, level, walk); -struct xe_ptw **entries = parent->children ? parent->children :NULL ; +struct xe_ptw **entries = walk->staging ? (parent->staging ?:NULL ) : + (parent->children ?:NULL );const struct xe_pt_walk_ops *ops = walk->ops;enum page_walk_action action;struct xe_ptw *child;
drivers/gpu/drm/xe/xe_pt_walk.h +4 -0
@@ -11,12 +11,14 @@/** * struct xe_ptw - base class for driver pagetable subclassing. * @children: Pointer to an array of children if any. +* @staging: Pointer to an array of staging if any. * * Drivers could subclass this, and if it's a page-directory, typically * embed an array of xe_ptw pointers. */ struct xe_ptw {struct xe_ptw **children; +struct xe_ptw **staging; };/**
@@ -41,6 +43,8 @@ struct xe_pt_walk {* as shared pagetables. */ bool shared_pt_mode; +/** @staging: Walk staging PT structure */ +bool staging; };/**
Greg Kroah-Hartman
maintainerPATCH 49/207 drm/xe/hmm: Style- and include fixes
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Hellström <[email protected]>
commit e3e2e7fc4cd8414c9a966ef1b344db543f8614f4 upstream.
Add proper #ifndef around the xe_hmm.h header, proper spacing and since the documentation mostly follows kerneldoc format, make it kerneldoc. Also prepare for upcoming -stable fixes.
--- drivers/gpu/drm/xe/xe_hmm.c | 9 +++------ drivers/gpu/drm/xe/xe_hmm.h | 5 +++++ 2 files changed, 8 insertions(+), 6 deletions(-)
drivers/gpu/drm/xe/xe_hmm.c +3 -6
@@ -19,11 +19,10 @@ static u64 xe_npages_in_range(unsigned lreturn (end - start) >>PAGE_SHIFT ; } -/* +/** * xe_mark_range_accessed() - mark a range is accessed, so core mm * have such information for memory eviction or write back to * hard disk -* * @range: the range to mark * @write: if write to this range, we mark pages in this range * as dirty
@@ -43,11 +42,10 @@ static void xe_mark_range_accessed(struc } } -/* +/** * xe_build_sg() - build a scatter gather table for all the physical pages/pfn * in a hmm_range. dma-map pages if necessary. dma-address is save in sg table * and will be used to program GPU page table later. -* * @xe: the xe device who will access the dma-address in sg table * @range: the hmm range that we build the sg table from. range->hmm_pfns[] * has the pfn numbers of pages that back up this hmm address range.
@@ -112,9 +110,8 @@ free_pages:return ret; } -/* +/** * xe_hmm_userptr_free_sg() - Free the scatter gather table of userptr -* * @uvma: the userptr vma which hold the scatter gather table * * With function xe_userptr_populate_range, we allocate storage of
drivers/gpu/drm/xe/xe_hmm.h +5 -0
@@ -3,9 +3,14 @@* Copyright © 2024 Intel Corporation */ +#ifndef _XE_HMM_H_ +#define _XE_HMM_H_ +#include <linux/types.h> struct xe_userptr_vma ;int xe_hmm_userptr_populate_range (struct xe_userptr_vma *uvma,bool is_mm_mmap_locked); +void xe_hmm_userptr_free_sg (struct xe_userptr_vma *uvma); +#endif
Greg Kroah-Hartman
maintainerPATCH 50/207 drm/xe/hmm: Dont dereference struct page pointers without notifier lock
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Hellström <[email protected]>
commit 0a98219bcc961edd3388960576e4353e123b4a51 upstream.
The pnfs that we obtain from hmm_range_fault() point to pages that we don't have a reference on, and the guarantee that they are still in the cpu page-tables is that the notifier lock must be held and the notifier seqno is still valid.
So while building the sg table and marking the pages accesses / dirty we need to hold this lock with a validated seqno.
However, the lock is reclaim tainted which makes sg_alloc_table_from_pages_segment() unusable, since it internally allocates memory.
Instead build the sg-table manually. For the non-iommu case this might lead to fewer coalesces, but if that's a problem it can be fixed up later in the resource cursor code. For the iommu case, the whole sg-table may still be coalesced to a single contigous device va region.
This avoids marking pages that we don't own dirty and accessed, and it also avoid dereferencing struct pages that we don't own.
v2:
- Use assert to check whether hmm pfns are valid (Matthew Auld)
- Take into account that large pages may cross range boundaries (Matthew Auld)
v3:
- Don't unnecessarily check for a non-freed sg-table. (Matthew Auld)
- Add a missing up_read() in an error path. (Matthew Auld)
--- drivers/gpu/drm/xe/xe_hmm.c | 120 +++++++++++++++++++++++++++++++++----------- 1 file changed, 90 insertions(+), 30 deletions(-)
drivers/gpu/drm/xe/xe_hmm.c +90 -30
@@ -42,6 +42,42 @@ static void xe_mark_range_accessed(struc } } +static int xe_alloc_sg (struct xe_device *xe,struct sg_table *st, +struct hmm_range *range,struct rw_semaphore *notifier_sem) +{ +unsigned long i, npages, hmm_pfn; +unsigned long num_chunks =0 ; +int ret; + +/* HMM docs says this is needed. */ + ret =down_read_interruptible (notifier_sem); +if (ret) +return ret; + +if (mmu_interval_read_retry (range->notifier, range->notifier_seq)) { +up_read (notifier_sem); +return -EAGAIN ; + } + + npages =xe_npages_in_range (range->start, range->end); +for (i =0 ; i < npages;) { +unsigned long len; + + hmm_pfn = range->hmm_pfns[i]; +xe_assert (xe, hmm_pfn &HMM_PFN_VALID ); + + len =1UL <<hmm_pfn_to_map_order (hmm_pfn); + +/* If order > 0 the page may extend beyond range->start */ + len -= (hmm_pfn & ~HMM_PFN_FLAGS ) & (len -1 ); + i += len; + num_chunks++; + } +up_read (notifier_sem); + +return sg_alloc_table (st, num_chunks,GFP_KERNEL ); +} +/** * xe_build_sg() - build a scatter gather table for all the physical pages/pfn * in a hmm_range. dma-map pages if necessary. dma-address is save in sg table
@@ -50,6 +86,7 @@ static void xe_mark_range_accessed(struc* @range: the hmm range that we build the sg table from. range->hmm_pfns[] * has the pfn numbers of pages that back up this hmm address range. * @st: pointer to the sg table. +* @notifier_sem: The xe notifier lock. * @write: whether we write to this range. This decides dma map direction * for system pages. If write we map it bi-diretional; otherwise * DMA_TO_DEVICE
@@ -76,38 +113,41 @@ static void xe_mark_range_accessed(struc* Returns 0 if successful; -ENOMEM if fails to allocate memory */ static int xe_build_sg (struct xe_device *xe,struct hmm_range *range, -struct sg_table *st,bool write) +struct sg_table *st, +struct rw_semaphore *notifier_sem, +bool write) { +unsigned long npages =xe_npages_in_range (range->start, range->end);struct device *dev = xe->drm.dev; -struct page **pages; -u64 i, npages; -int ret; - - npages =xe_npages_in_range (range->start, range->end); - pages =kvmalloc_array (npages,sizeof (*pages),GFP_KERNEL ); -if (!pages) -return -ENOMEM ; - -for (i =0 ; i < npages; i++) { - pages[i] =hmm_pfn_to_page (range->hmm_pfns[i]); -xe_assert (xe, !is_device_private_page (pages[i])); - } - - ret =sg_alloc_table_from_pages_segment (st, pages, npages,0 , npages <<PAGE_SHIFT , -xe_sg_segment_size (dev),GFP_KERNEL ); -if (ret) - goto free_pages; - - ret =dma_map_sgtable (dev, st, write ?DMA_BIDIRECTIONAL :DMA_TO_DEVICE , -DMA_ATTR_SKIP_CPU_SYNC |DMA_ATTR_NO_KERNEL_MAPPING ); -if (ret) { -sg_free_table (st); - st =NULL ; +struct scatterlist *sgl; +struct page *page; +unsigned long i, j; + +lockdep_assert_held (notifier_sem); + + i =0 ; +for_each_sg (st->sgl, sgl, st->nents, j) { +unsigned long hmm_pfn, size; + + hmm_pfn = range->hmm_pfns[i]; + page =hmm_pfn_to_page (hmm_pfn); +xe_assert (xe, !is_device_private_page (page)); + + size =1UL <<hmm_pfn_to_map_order (hmm_pfn); + size -=page_to_pfn (page) & (size -1 ); + i += size; + +if (unlikely (j == st->nents -1 )) { +if (i > npages) + size -= (i - npages); +sg_mark_end (sgl); + } +sg_set_page (sgl, page, size <<PAGE_SHIFT ,0 ); } +xe_assert (xe, i == npages); -free_pages: -kvfree (pages); -return ret; +return dma_map_sgtable (dev, st, write ?DMA_BIDIRECTIONAL :DMA_TO_DEVICE , +DMA_ATTR_SKIP_CPU_SYNC |DMA_ATTR_NO_KERNEL_MAPPING ); }/**
@@ -235,16 +275,36 @@ int xe_hmm_userptr_populate_range(structif (ret) goto free_pfns; - ret =xe_build_sg (vm->xe, &hmm_range, &userptr->sgt, write); + ret =xe_alloc_sg (vm->xe, &userptr->sgt, &hmm_range, &vm->userptr.notifier_lock);if (ret) goto free_pfns; + ret =down_read_interruptible (&vm->userptr.notifier_lock); +if (ret) + goto free_st; + +if (mmu_interval_read_retry (hmm_range.notifier, hmm_range.notifier_seq)) { + ret = -EAGAIN ; + goto out_unlock; + } + + ret =xe_build_sg (vm->xe, &hmm_range, &userptr->sgt, + &vm->userptr.notifier_lock, write); +if (ret) + goto out_unlock; +xe_mark_range_accessed (&hmm_range, write); userptr->sg = &userptr->sgt; userptr->notifier_seq = hmm_range.notifier_seq; +up_read (&vm->userptr.notifier_lock); +kvfree (pfns); +return 0 ; +out_unlock: +up_read (&vm->userptr.notifier_lock); +free_st: +sg_free_table (&userptr->sgt); free_pfns:kvfree (pfns);return ret; } -
Greg Kroah-Hartman
maintainerPATCH 51/207 drm/xe/vm: Fix a misplaced #endif
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Hellström <[email protected]>
commit 1414d95d5805b1dc221d22db9b8dc5287ef083bc upstream.
Fix a (harmless) misplaced #endif leading to declarations appearing multiple times.
--- drivers/gpu/drm/xe/xe_vm.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/xe/xe_vm.h +1 -1
@@ -275,9 +275,9 @@ static inline void vm_dbg(const struct d const char *format, ...) {/* noop */ }#endif -#endif struct xe_vm_snapshot *xe_vm_snapshot_capture (struct xe_vm *vm);void xe_vm_snapshot_capture_delayed (struct xe_vm_snapshot *snap);void xe_vm_snapshot_print (struct xe_vm_snapshot *snap,struct drm_printer *p);void xe_vm_snapshot_free (struct xe_vm_snapshot *snap); +#endif
Greg Kroah-Hartman
maintainerPATCH 52/207 drm/xe/vm: Validate userptr during gpu vma prefetching
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Hellström <[email protected]>
commit e775e2a060d99180edc5366fb9f4299d0f07b66c upstream.
If a userptr vma subject to prefetching was already invalidated or invalidated during the prefetch operation, the operation would repeatedly return -EAGAIN which would typically cause an infinite loop.
Validate the userptr to ensure this doesn't happen.
v2:
- Don't fallthrough from UNMAP to PREFETCH (Matthew Brost)
--- drivers/gpu/drm/xe/xe_vm.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
drivers/gpu/drm/xe/xe_vm.c +10 -1
@@ -2284,8 +2284,17 @@ static int vm_bind_ioctl_ops_parse(strucbreak ; }case DRM_GPUVA_OP_UNMAP : +xe_vma_ops_incr_pt_update_ops (vops, op->tile_mask); +break ;case DRM_GPUVA_OP_PREFETCH : -/* FIXME: Need to skip some prefetch ops */ + vma =gpuva_to_vma (op->base.prefetch.va); + +if (xe_vma_is_userptr (vma)) { + err =xe_vma_userptr_pin_pages (to_userptr_vma (vma)); +if (err) +return err; + } +xe_vma_ops_incr_pt_update_ops (vops, op->tile_mask);break ;default :
Greg Kroah-Hartman
maintainerPATCH 53/207 mptcp: fix scheduling while atomic in mptcp_pm_nl_append_new_local_addr
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krister Johansen <[email protected]>
commit 022bfe24aad8937705704ff2e414b100cf0f2e1a upstream.
If multiple connection requests attempt to create an implicit mptcp endpoint in parallel, more than one caller may end up in mptcp_pm_nl_append_new_local_addr because none found the address in local_addr_list during their call to mptcp_pm_nl_get_local_id. In this case, the concurrent new_local_addr calls may delete the address entry created by the previous caller. These deletes use synchronize_rcu, but this is not permitted in some of the contexts where this function may be called. During packet recv, the caller may be in a rcu read critical section and have preemption disabled.
An example stack:
BUG: scheduling while atomic: swapper/2/0/0x00000302 Call Trace: <IRQ> dump_stack_lvl (lib/dump_stack.c:117 (discriminator 1)) dump_stack (lib/dump_stack.c:124) __schedule_bug (kernel/sched/core.c:5943) schedule_debug.constprop.0 (arch/x86/include/asm/preempt.h:33 kernel/sched/core.c:5970) __schedule (arch/x86/include/asm/jump_label.h:27 include/linux/jump_label.h:207 kernel/sched/features.h:29 kernel/sched/core.c:6621) schedule (arch/x86/include/asm/preempt.h:84 kernel/sched/core.c:6804 kernel/sched/core.c:6818) schedule_timeout (kernel/time/timer.c:2160) wait_for_completion (kernel/sched/completion.c:96 kernel/sched/completion.c:116 kernel/sched/completion.c:127 kernel/sched/completion.c:148) __wait_rcu_gp (include/linux/rcupdate.h:311 kernel/rcu/update.c:444) synchronize_rcu (kernel/rcu/tree.c:3609) mptcp_pm_nl_append_new_local_addr (net/mptcp/pm_netlink.c:966 net/mptcp/pm_netlink.c:1061) mptcp_pm_nl_get_local_id (net/mptcp/pm_netlink.c:1164) mptcp_pm_get_local_id (net/mptcp/pm.c:420) subflow_check_req (net/mptcp/subflow.c:98 net/mptcp/subflow.c:213) subflow_v4_route_req (net/mptcp/subflow.c:305) tcp_conn_request (net/ipv4/tcp_input.c:7216) subflow_v4_conn_request (net/mptcp/subflow.c:651) tcp_rcv_state_process (net/ipv4/tcp_input.c:6709) tcp_v4_do_rcv (net/ipv4/tcp_ipv4.c:1934) tcp_v4_rcv (net/ipv4/tcp_ipv4.c:2334) ip_protocol_deliver_rcu (net/ipv4/ip_input.c:205 (discriminator 1)) ip_local_deliver_finish (include/linux/rcupdate.h:813 net/ipv4/ip_input.c:234) ip_local_deliver (include/linux/netfilter.h:314 include/linux/netfilter.h:308 net/ipv4/ip_input.c:254) ip_sublist_rcv_finish (include/net/dst.h:461 net/ipv4/ip_input.c:580) ip_sublist_rcv (net/ipv4/ip_input.c:640) ip_list_rcv (net/ipv4/ip_input.c:675) __netif_receive_skb_list_core (net/core/dev.c:5583 net/core/dev.c:5631) netif_receive_skb_list_internal (net/core/dev.c:5685 net/core/dev.c:5774) napi_complete_done (include/linux/list.h:37 include/net/gro.h:449 include/net/gro.h:444 net/core/dev.c:6114) igb_poll (drivers/net/ethernet/intel/igb/igb_main.c:8244) igb __napi_poll (net/core/dev.c:6582) net_rx_action (net/core/dev.c:6653 net/core/dev.c:6787) handle_softirqs (kernel/softirq.c:553) __irq_exit_rcu (kernel/softirq.c:588 kernel/softirq.c:427 kernel/softirq.c:636) irq_exit_rcu (kernel/softirq.c:651) common_interrupt (arch/x86/kernel/irq.c:247 (discriminator 14)) </IRQ>
This problem seems particularly prevalent if the user advertises an endpoint that has a different external vs internal address. In the case where the external address is advertised and multiple connections already exist, multiple subflow SYNs arrive in parallel which tends to trigger the race during creation of the first local_addr_list entries which have the internal address instead.
Fix by skipping the replacement of an existing implicit local address if called via mptcp_pm_nl_get_local_id.
--- net/mptcp/pm_netlink.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-)
net/mptcp/pm_netlink.c +15 -3
@@ -977,7 +977,7 @@ static void __mptcp_pm_release_addr_entrstatic int mptcp_pm_nl_append_new_local_addr (struct pm_nl_pernet *pernet,struct mptcp_pm_addr_entry *entry, -bool needs_id) +bool needs_id,bool replace) {struct mptcp_pm_addr_entry *cur, *del_entry =NULL ;unsigned int addr_max;
@@ -1017,6 +1017,17 @@ static int mptcp_pm_nl_append_new_local_if (entry->addr.id) goto out; +/* allow callers that only need to look up the local +* addr's id to skip replacement. This allows them to +* avoid calling synchronize_rcu in the packet recv +* path. +*/ +if (!replace) { +kfree (entry); + ret = cur->addr.id; + goto out; + } + pernet->addrs--; entry->addr.id = cur->addr.id;list_del_rcu (&cur->list);
@@ -1165,7 +1176,7 @@ int mptcp_pm_nl_get_local_id(struct mptc entry->ifindex =0 ; entry->flags =MPTCP_PM_ADDR_FLAG_IMPLICIT ; entry->lsk =NULL ; - ret =mptcp_pm_nl_append_new_local_addr (pernet, entry, true); + ret =mptcp_pm_nl_append_new_local_addr (pernet, entry, true, false);if (ret <0 )kfree (entry);
@@ -1433,7 +1444,8 @@ int mptcp_pm_nl_add_addr_doit(struct sk_ } } ret =mptcp_pm_nl_append_new_local_addr (pernet, entry, - !mptcp_pm_has_addr_attr_id (attr, info)); + !mptcp_pm_has_addr_attr_id (attr, info), + true);if (ret <0 ) {GENL_SET_ERR_MSG_FMT (info,"too many addresses or duplicate one: %d" , ret); goto out_free;
Greg Kroah-Hartman
maintainerPATCH 54/207 drm/xe: Fix GT "for each engine" workarounds
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tvrtko Ursulin <[email protected]>
commit 54f94dc7f6b4db45dbc23b4db3d20c7194e2c54f upstream.
Any rules using engine matching are currently broken due RTP processing happening too in early init, before the list of hardware engines has been initialised.
Fix this by moving workaround processing to later in the driver probe sequence, to just before the processed list is used for the first time.
Looking at the debugfs gt0/workarounds on ADL-P we notice 14011060649 should be present while we see, before:
GT Workarounds
14011059788
14015795083And with the patch:
GT Workarounds
14011060649
14011059788
14015795083--- drivers/gpu/drm/xe/xe_gt.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/xe/xe_gt.c +2 -2
@@ -380,9 +380,7 @@ int xe_gt_init_early(struct xe_gt *gt)if (err)return err; -xe_wa_process_gt (gt);xe_wa_process_oob (gt); -xe_tuning_process_gt (gt);xe_force_wake_init_gt (gt,gt_to_fw (gt));spin_lock_init (>->global_invl_lock);
@@ -474,6 +472,8 @@ static int all_fw_domain_init(struct xe_ }xe_gt_mcr_set_implicit_defaults (gt); +xe_wa_process_gt (gt); +xe_tuning_process_gt (gt);xe_reg_sr_apply_mmio (>->reg_sr, gt); err =xe_gt_clock_init (gt);
Greg Kroah-Hartman
maintainerPATCH 55/207 drm/xe: Fix fault mode invalidation with unbind
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Hellström <[email protected]>
commit 84211b1c0db6b9dbe0020fa97192fb9661617f24 upstream.
Fix fault mode invalidation racing with unbind leading to the PTE zapping potentially traversing an invalid page-table tree. Do this by holding the notifier lock across PTE zapping. This might transfer any contention waiting on the notifier seqlock read side to the notifier lock read side, but that shouldn't be a major problem.
At the same time get rid of the open-coded invalidation in the bind code by relying on the notifier even when the vma bind is not yet committed.
Finally let userptr invalidation call a dedicated xe_vm function performing a full invalidation.
--- drivers/gpu/drm/xe/xe_pt.c | 38 ++++------------- drivers/gpu/drm/xe/xe_vm.c | 85 +++++++++++++++++++++++++-------------- drivers/gpu/drm/xe/xe_vm.h | 8 +++ drivers/gpu/drm/xe/xe_vm_types.h | 4 - 4 files changed, 75 insertions(+), 60 deletions(-)
drivers/gpu/drm/xe/xe_pt.c +9 -29
@@ -1233,42 +1233,22 @@ static int vma_check_userptr(struct xe_vreturn 0 ; uvma =to_userptr_vma (vma); - notifier_seq = uvma->userptr.notifier_seq; +if (xe_pt_userptr_inject_eagain (uvma)) +xe_vma_userptr_force_invalidate (uvma); -if (uvma->userptr.initial_bind && !xe_vm_in_fault_mode (vm)) -return 0 ; + notifier_seq = uvma->userptr.notifier_seq;if (!mmu_interval_read_retry (&uvma->userptr.notifier, - notifier_seq) && - !xe_pt_userptr_inject_eagain (uvma)) + notifier_seq))return 0 ; -if (xe_vm_in_fault_mode (vm)) { +if (xe_vm_in_fault_mode (vm))return -EAGAIN ; - }else { -spin_lock (&vm->userptr.invalidated_lock); -list_move_tail (&uvma->userptr.invalidate_link, - &vm->userptr.invalidated); -spin_unlock (&vm->userptr.invalidated_lock); - -if (xe_vm_in_preempt_fence_mode (vm)) { -struct dma_resv_iter cursor; -struct dma_fence *fence; -long err; - -dma_resv_iter_begin (&cursor,xe_vm_resv (vm), -DMA_RESV_USAGE_BOOKKEEP ); -dma_resv_for_each_fence_unlocked (&cursor, fence) -dma_fence_enable_sw_signaling (fence); -dma_resv_iter_end (&cursor); - - err =dma_resv_wait_timeout (xe_vm_resv (vm), -DMA_RESV_USAGE_BOOKKEEP , - false,MAX_SCHEDULE_TIMEOUT ); -XE_WARN_ON (err <=0 ); - } - } +/* +* Just continue the operation since exec or rebind worker +* will take care of rebinding. +*/ return 0 ; }
drivers/gpu/drm/xe/xe_vm.c +56 -29
124 lines not on this page · raw message
drivers/gpu/drm/xe/xe_vm.h +8 -0
@@ -280,4 +280,12 @@ struct xe_vm_snapshot *xe_vm_snapshot_cavoid xe_vm_snapshot_capture_delayed (struct xe_vm_snapshot *snap);void xe_vm_snapshot_print (struct xe_vm_snapshot *snap,struct drm_printer *p);void xe_vm_snapshot_free (struct xe_vm_snapshot *snap); + +#if IS_ENABLED (CONFIG_DRM_XE_USERPTR_INVAL_INJECT ) +void xe_vma_userptr_force_invalidate (struct xe_userptr_vma *uvma); +#else +static inline void xe_vma_userptr_force_invalidate (struct xe_userptr_vma *uvma) +{ +} +#endif #endif
drivers/gpu/drm/xe/xe_vm_types.h +2 -2
@@ -227,8 +227,8 @@ struct xe_vm {* up for revalidation. Protected from access with the * @invalidated_lock. Removing items from the list * additionally requires @lock in write mode, and adding -* items to the list requires the @userptr.notifer_lock in -* write mode. +* items to the list requires either the @userptr.notifer_lock in +* write mode, OR @lock in write mode. */ struct list_head invalidated; } userptr;
Greg Kroah-Hartman
maintainerPATCH 56/207 drm/xe/userptr: properly setup pfn_flags_mask
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Auld <[email protected]>
commit 475d06e00b7496c7915d87f7ae67af26738e4649 upstream.
Currently we just leave it uninitialised, which at first looks harmless, however we also don't zero out the pfn array, and with pfn_flags_mask the idea is to be able set individual flags for a given range of pfn or completely ignore them, outside of default_flags. So here we end up with pfn[i] & pfn_flags_mask, and if both are uninitialised we might get back an unexpected flags value, like asking for read only with default_flags, but getting back write on top, leading to potentially bogus behaviour.
To fix this ensure we zero the pfn_flags_mask, such that hmm only considers the default_flags and not also the initial pfn[i] value.
v2 (Thomas):
- Prefer proper initializer.
--- drivers/gpu/drm/xe/xe_hmm.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-)
drivers/gpu/drm/xe/xe_hmm.c +10 -8
@@ -203,13 +203,20 @@ int xe_hmm_userptr_populate_range(struct {unsigned long timeout = jiffies +msecs_to_jiffies (HMM_RANGE_DEFAULT_TIMEOUT ); -unsigned long *pfns, flags =HMM_PFN_REQ_FAULT ; +unsigned long *pfns;struct xe_userptr *userptr;struct xe_vma *vma = &uvma->vma;u64 userptr_start =xe_vma_userptr (vma);u64 userptr_end = userptr_start +xe_vma_size (vma);struct xe_vm *vm =xe_vma_vm (vma); -struct hmm_range hmm_range; +struct hmm_range hmm_range = { + .pfn_flags_mask =0 ,/* ignore pfns */ + .default_flags =HMM_PFN_REQ_FAULT , + .start = userptr_start, + .end = userptr_end, + .notifier = &uvma->userptr.notifier, + .dev_private_owner = vm->xe, + };bool write = !xe_vma_read_only (vma);unsigned long notifier_seq;u64 npages;
@@ -236,19 +243,14 @@ int xe_hmm_userptr_populate_range(structreturn -ENOMEM ;if (write) - flags |=HMM_PFN_REQ_WRITE ; + hmm_range.default_flags |=HMM_PFN_REQ_WRITE ;if (!mmget_not_zero (userptr->notifier.mm)) { ret = -EFAULT ; goto free_pfns; } - hmm_range.default_flags = flags; hmm_range.hmm_pfns = pfns; - hmm_range.notifier = &userptr->notifier; - hmm_range.start = userptr_start; - hmm_range.end = userptr_end; - hmm_range.dev_private_owner = vm->xe;while (true) { hmm_range.notifier_seq =mmu_interval_read_begin (&userptr->notifier);
Greg Kroah-Hartman
maintainerPATCH 57/207 drm/xe/userptr: Unmap userptrs in the mmu notifier
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Hellström <[email protected]>
commit 333b8906336174478efbbfc1e24a89e3397ffe65 upstream.
If userptr pages are freed after a call to the xe mmu notifier, the device will not be blocked out from theoretically accessing these pages unless they are also unmapped from the iommu, and this violates some aspects of the iommu-imposed security.
Ensure that userptrs are unmapped in the mmu notifier to mitigate this. A naive attempt would try to free the sg table, but the sg table itself may be accessed by a concurrent bind operation, so settle for only unmapping.
v3:
- Update lockdep asserts.
- Fix a typo (Matthew Auld)
--- drivers/gpu/drm/xe/xe_hmm.c | 51 ++++++++++++++++++++++++++++++++------- drivers/gpu/drm/xe/xe_hmm.h | 2 + drivers/gpu/drm/xe/xe_vm.c | 4 +++ drivers/gpu/drm/xe/xe_vm_types.h | 4 +++ 4 files changed, 52 insertions(+), 9 deletions(-)
drivers/gpu/drm/xe/xe_hmm.c +42 -9
@@ -150,6 +150,45 @@ static int xe_build_sg(struct xe_device DMA_ATTR_SKIP_CPU_SYNC | DMA_ATTR_NO_KERNEL_MAPPING); } +static void xe_hmm_userptr_set_mapped (struct xe_userptr_vma *uvma) +{ +struct xe_userptr *userptr = &uvma->userptr; +struct xe_vm *vm =xe_vma_vm (&uvma->vma); + +lockdep_assert_held_write (&vm->lock); +lockdep_assert_held (&vm->userptr.notifier_lock); + +mutex_lock (&userptr->unmap_mutex); +xe_assert (vm->xe, !userptr->mapped); + userptr->mapped = true; +mutex_unlock (&userptr->unmap_mutex); +} + +void xe_hmm_userptr_unmap (struct xe_userptr_vma *uvma) +{ +struct xe_userptr *userptr = &uvma->userptr; +struct xe_vma *vma = &uvma->vma; +bool write = !xe_vma_read_only (vma); +struct xe_vm *vm =xe_vma_vm (vma); +struct xe_device *xe = vm->xe; + +if (!lockdep_is_held_type (&vm->userptr.notifier_lock,0 ) && + !lockdep_is_held_type (&vm->lock,0 ) && + !(vma->gpuva.flags &XE_VMA_DESTROYED )) { +/* Don't unmap in exec critical section. */ +xe_vm_assert_held (vm); +/* Don't unmap while mapping the sg. */ +lockdep_assert_held (&vm->lock); + } + +mutex_lock (&userptr->unmap_mutex); +if (userptr->sg && userptr->mapped) +dma_unmap_sgtable (xe->drm.dev, userptr->sg, + write ?DMA_BIDIRECTIONAL :DMA_TO_DEVICE ,0 ); + userptr->mapped = false; +mutex_unlock (&userptr->unmap_mutex); +} +/** * xe_hmm_userptr_free_sg() - Free the scatter gather table of userptr * @uvma: the userptr vma which hold the scatter gather table
@@ -161,16 +200,9 @@ static int xe_build_sg(struct xe_devicevoid xe_hmm_userptr_free_sg (struct xe_userptr_vma *uvma) {struct xe_userptr *userptr = &uvma->userptr; -struct xe_vma *vma = &uvma->vma; -bool write = !xe_vma_read_only (vma); -struct xe_vm *vm =xe_vma_vm (vma); -struct xe_device *xe = vm->xe; -struct device *dev = xe->drm.dev; - -xe_assert (xe, userptr->sg); -dma_unmap_sgtable (dev, userptr->sg, - write ?DMA_BIDIRECTIONAL :DMA_TO_DEVICE ,0 ); +xe_assert (xe_vma_vm (&uvma->vma)->xe, userptr->sg); +xe_hmm_userptr_unmap (uvma);sg_free_table (userptr->sg); userptr->sg =NULL ; }
@@ -297,6 +329,7 @@ int xe_hmm_userptr_populate_range(structxe_mark_range_accessed (&hmm_range, write); userptr->sg = &userptr->sgt; +xe_hmm_userptr_set_mapped (uvma); userptr->notifier_seq = hmm_range.notifier_seq;up_read (&vm->userptr.notifier_lock);kvfree (pfns);
drivers/gpu/drm/xe/xe_hmm.h +2 -0
@@ -13,4 +13,6 @@ struct xe_userptr_vma;int xe_hmm_userptr_populate_range (struct xe_userptr_vma *uvma,bool is_mm_mmap_locked);void xe_hmm_userptr_free_sg (struct xe_userptr_vma *uvma); + +void xe_hmm_userptr_unmap (struct xe_userptr_vma *uvma);#endif
drivers/gpu/drm/xe/xe_vm.c +4 -0
@@ -621,6 +621,8 @@ static void __vma_userptr_invalidate(str err =xe_vm_invalidate_vma (vma);XE_WARN_ON (err); } + +xe_hmm_userptr_unmap (uvma); } static bool vma_userptr_invalidate(struct mmu_interval_notifier *mni,
@@ -1039,6 +1041,7 @@ static struct xe_vma *xe_vma_create(struINIT_LIST_HEAD (&userptr->invalidate_link);INIT_LIST_HEAD (&userptr->repin_link); vma->gpuva.gem.offset = bo_offset_or_userptr; +mutex_init (&userptr->unmap_mutex); err = mmu_interval_notifier_insert(&userptr->notifier, current->mm,
@@ -1080,6 +1083,7 @@ static void xe_vma_destroy_late(struct x* them anymore */ mmu_interval_notifier_remove (&userptr->notifier); +mutex_destroy (&userptr->unmap_mutex);xe_vm_put (vm); }else if (xe_vma_is_null (vma)) {xe_vm_put (vm);
drivers/gpu/drm/xe/xe_vm_types.h +4 -0
@@ -59,12 +59,16 @@ struct xe_userptr {struct sg_table *sg;/** @notifier_seq: notifier sequence number */ unsigned long notifier_seq; +/** @unmap_mutex: Mutex protecting dma-unmapping */ +struct mutex unmap_mutex;/** * @initial_bind: user pointer has been bound at least once. * write: vm->userptr.notifier_lock in read mode and vm->resv held. * read: vm->userptr.notifier_lock in write mode or vm->resv held. */ bool initial_bind; +/** @mapped: Whether the @sgt sg-table is dma-mapped. Protected by @unmap_mutex. */ +bool mapped;#if IS_ENABLED (CONFIG_DRM_XE_USERPTR_INVAL_INJECT )u32 divisor;#endif
Greg Kroah-Hartman
maintainerPATCH 58/207 Bluetooth: Add check for mgmt_alloc_skb() in mgmt_remote_name()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <[email protected]>
commit f2176a07e7b19f73e05c805cf3d130a2999154cb upstream.
Add check for the return value of mgmt_alloc_skb() in mgmt_remote_name() to prevent null pointer dereference.
--- net/bluetooth/mgmt.c | 2 ++ 1 file changed, 2 insertions(+)
net/bluetooth/mgmt.c +2 -0
@@ -10544,6 +10544,8 @@ void mgmt_remote_name(struct hci_dev *hd skb =mgmt_alloc_skb (hdev,MGMT_EV_DEVICE_FOUND ,sizeof (*ev) + (name ?eir_precalc_len (name_len) :0 )); +if (!skb) +return ; ev =skb_put (skb,sizeof (*ev));bacpy (&ev->addr.bdaddr, bdaddr);
Greg Kroah-Hartman
maintainerPATCH 59/207 Bluetooth: Add check for mgmt_alloc_skb() in mgmt_device_connected()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <[email protected]>
commit d8df010f72b8a32aaea393e36121738bb53ed905 upstream.
Add check for the return value of mgmt_alloc_skb() in mgmt_device_connected() to prevent null pointer dereference.
--- net/bluetooth/mgmt.c | 3 +++ 1 file changed, 3 insertions(+)
net/bluetooth/mgmt.c +3 -0
@@ -9791,6 +9791,9 @@ void mgmt_device_connected(struct hci_desizeof (*ev) + (name ?eir_precalc_len (name_len) :0 ) + eir_precalc_len(sizeof(conn->dev_class))); +if (!skb) +return ; + ev =skb_put (skb,sizeof (*ev));bacpy (&ev->addr.bdaddr, &conn->dst); ev->addr.type =link_to_bdaddr (conn->type, conn->dst_type);
Greg Kroah-Hartman
maintainerPATCH 60/207 wifi: cfg80211: regulatory: improve invalid hints checking
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <[email protected]>
commit 59b348be7597c4a9903cb003c69e37df20c04a30 upstream.
Syzbot keeps reporting an issue [1] that occurs when erroneous symbols sent from userspace get through into user_alpha2[] via regulatory_hint_user() call. Such invalid regulatory hints should be rejected.
While a sanity check from commit 47caf685a685 ("cfg80211: regulatory:
reject invalid hints") looks to be enough to deter these very cases, there is a way to get around it due to 2 reasons.
1) The way isalpha() works, symbols other than latin lower and upper letters may be used to determine a country/domain. For instance, greek letters will also be considered upper/lower letters and for such characters isalpha() will return true as well. However, ISO-3166-1 alpha2 codes should only hold latin characters.
2) While processing a user regulatory request, between reg_process_hint_user() and regulatory_hint_user() there happens to be a call to queue_regulatory_request() which modifies letters in request->alpha2[] with toupper(). This works fine for latin symbols, less so for weird letter characters from the second part of _ctype[].
Syzbot triggers a warning in is_user_regdom_saved() by first sending over an unexpected non-latin letter that gets malformed by toupper() into a character that ends up failing isalpha() check.
Prevent this by enhancing is_an_alpha2() to ensure that incoming symbols are latin letters and nothing else.
[1] Syzbot report:
------------[ cut here ]------------ Unexpected user alpha2: A� WARNING: CPU: 1 PID: 964 at net/wireless/reg.c:442 is_user_regdom_saved net/wireless/reg.c:440 [inline] WARNING: CPU: 1 PID: 964 at net/wireless/reg.c:442 restore_alpha2 net/wireless/reg.c:3424 [inline] WARNING: CPU: 1 PID: 964 at net/wireless/reg.c:442 restore_regulatory_settings+0x3c0/0x1e50 net/wireless/reg.c:3516 Modules linked in: CPU: 1 UID: 0 PID: 964 Comm: kworker/1:2 Not tainted 6.12.0-rc5-syzkaller-00044-gc1e939a21eb1 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: events_power_efficient crda_timeout_work RIP: 0010:is_user_regdom_saved net/wireless/reg.c:440 [inline] RIP: 0010:restore_alpha2 net/wireless/reg.c:3424 [inline] RIP: 0010:restore_regulatory_settings+0x3c0/0x1e50 net/wireless/reg.c:3516 ... Call Trace: <TASK> crda_timeout_work+0x27/0x50 net/wireless/reg.c:542 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa65/0x1850 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f2/0x390 kernel/kthread.c:389 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK>
--- net/wireless/reg.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/wireless/reg.c +2 -1
@@ -407,7 +407,8 @@ static bool is_an_alpha2(const char *alp {if (!alpha2)return false; -return isalpha (alpha2[0 ]) &&isalpha (alpha2[1 ]); +return isascii (alpha2[0 ]) &&isalpha (alpha2[0 ]) && +isascii (alpha2[1 ]) &&isalpha (alpha2[1 ]); }static bool alpha2_equal (const char *alpha2_x,const char *alpha2_y)
Greg Kroah-Hartman
maintainerPATCH 61/207 wifi: nl80211: reject cooked mode if it is set along with other flags
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vitaliy Shevtsov <[email protected]>
commit 49f27f29446a5bfe633dd2cc0cfebd48a1a5e77f upstream.
It is possible to set both MONITOR_FLAG_COOK_FRAMES and MONITOR_FLAG_ACTIVE flags simultaneously on the same monitor interface from the userspace. This causes a sub-interface to be created with no IEEE80211_SDATA_IN_DRIVER bit set because the monitor interface is in the cooked state and it takes precedence over all other states. When the interface is then being deleted the kernel calls WARN_ONCE() from check_sdata_in_driver() because of missing that bit.
Fix this by rejecting MONITOR_FLAG_COOK_FRAMES if it is set along with other flags.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
--- net/wireless/nl80211.c | 5 +++++ 1 file changed, 5 insertions(+)
net/wireless/nl80211.c +5 -0
@@ -4221,6 +4221,11 @@ static int parse_monitor_flags(struct nlif (flags[flag]) *mntrflags |= (1 <<flag); +/* cooked monitor mode is incompatible with other modes */ +if (*mntrflags &MONITOR_FLAG_COOK_FRAMES && + *mntrflags !=MONITOR_FLAG_COOK_FRAMES ) +return -EOPNOTSUPP ; + *mntrflags |=MONITOR_FLAG_CHANGED ;return 0 ;
Greg Kroah-Hartman
maintainerPATCH 62/207 selftests/damon/damos_quota_goal: handle minimum quota that cannot be further reduced
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: SeongJae Park <[email protected]>
commit 349db086a66051bc6114b64b4446787c20ac3f00 upstream.
damos_quota_goal.py selftest see if DAMOS quota goals tuning feature increases or reduces the effective size quota for given score as expected. The tuning feature sets the minimum quota size as one byte, so if the effective size quota is already one, we cannot expect it further be reduced. However the test is not aware of the edge case, and fails since it shown no expected change of the effective quota. Handle the case by updating the failure logic for no change to see if it was the case, and simply skips to next test input.
--- tools/testing/selftests/damon/damos_quota_goal.py | 3 +++ 1 file changed, 3 insertions(+)
tools/testing/selftests/damon/damos_quota_goal.py +3 -0
@@ -63,6 +63,9 @@ def main(): if last_effective_bytes != 0 else -1.0)) if last_effective_bytes == goal.effective_bytes: + # effective quota was already minimum that cannot be more reduced + if expect_increase is False and last_effective_bytes == 1: + continue print('efective bytes not changed: %d' % goal.effective_bytes) exit(1)
Greg Kroah-Hartman
maintainerPATCH 63/207 selftests/damon/damos_quota: make real expectation of quota exceeds
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: SeongJae Park <[email protected]>
commit 1c684d77dfbcf926e0dd28f6d260e8fdd8a58e85 upstream.
Patch series "selftests/damon: three fixes for false results".
Fix three DAMON selftest bugs that cause two and one false positive failures and successes.
This patch (of 3):
damos_quota.py assumes the quota will always exceeded. But whether quota will be exceeded or not depend on the monitoring results. Actually the monitored workload has chaning access pattern and hence sometimes the quota may not really be exceeded. As a result, false positive test failures happen. Expect how much time the quota will be exceeded by checking the monitoring results, and use it instead of the naive assumption.
--- tools/testing/selftests/damon/damos_quota.py | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
tools/testing/selftests/damon/damos_quota.py +6 -3
@@ -51,16 +51,19 @@ def main(): nr_quota_exceeds = scheme.stats.qt_exceeds wss_collected.sort() + nr_expected_quota_exceeds = 0 for wss in wss_collected: if wss > sz_quota: print('quota is not kept: %s > %s' % (wss, sz_quota)) print('collected samples are as below') print('\n'.join(['%d' % wss for wss in wss_collected])) exit(1) + if wss == sz_quota: + nr_expected_quota_exceeds += 1 - if nr_quota_exceeds < len(wss_collected): - print('quota is not always exceeded: %d > %d' % - (len(wss_collected), nr_quota_exceeds)) + if nr_quota_exceeds < nr_expected_quota_exceeds: + print('quota is exceeded less than expected: %d < %d' % + (nr_quota_exceeds, nr_expected_quota_exceeds)) exit(1) if __name__ == '__main__':
Greg Kroah-Hartman
maintainerPATCH 64/207 selftests/damon/damon_nr_regions: set ops update for merge results check to 100ms
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: SeongJae Park <[email protected]>
commit 695469c07a65547acb6e229b3fdf6aaa881817e3 upstream.
damon_nr_regions.py updates max_nr_regions to a number smaller than expected number of real regions and confirms DAMON respect the harsh limit. To give time for DAMON to make changes for the regions, 3 aggregation intervals (300 milliseconds) are given.
The internal mechanism works with not only the max_nr_regions, but also sz_limit, though. It avoids merging region if that casn make region of size larger than sz_limit. In the test, sz_limit is set too small to achive the new max_nr_regions, unless it is updated for the new min_nr_regions. But the update is done only once per operations set update interval, which is one second by default.
Hence, the test randomly incurs false positive failures. Fix it by setting the ops interval same to aggregation interval, to make sure sz_limit is updated by the time of the check.
--- tools/testing/selftests/damon/damon_nr_regions.py | 1 + 1 file changed, 1 insertion(+)
tools/testing/selftests/damon/damon_nr_regions.py +1 -0
@@ -109,6 +109,7 @@ def main(): attrs = kdamonds.kdamonds[0].contexts[0].monitoring_attrs attrs.min_nr_regions = 3 attrs.max_nr_regions = 7 + attrs.update_us = 100000 err = kdamonds.kdamonds[0].commit() if err is not None: proc.terminate()
Greg Kroah-Hartman
maintainerPATCH 65/207 selftests/damon/damon_nr_regions: sort collected regiosn before checking with min/max boundaries
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: SeongJae Park <[email protected]>
commit 582ccf78f6090d88b1c7066b1e90b3d9ec952d08 upstream.
damon_nr_regions.py starts DAMON, periodically collect number of regions in snapshots, and see if it is in the requested range. The check code assumes the numbers are sorted on the collection list, but there is no such guarantee. Hence this can result in false positive test success. Sort the list before doing the check.
--- tools/testing/selftests/damon/damon_nr_regions.py | 1 + 1 file changed, 1 insertion(+)
tools/testing/selftests/damon/damon_nr_regions.py +1 -0
@@ -65,6 +65,7 @@ def test_nr_regions(real_nr_regions, min test_name = 'nr_regions test with %d/%d/%d real/min/max nr_regions' % ( real_nr_regions, min_nr_regions, max_nr_regions) + collected_nr_regions.sort() if (collected_nr_regions[0] < min_nr_regions or collected_nr_regions[-1] > max_nr_regions): print('fail %s' % test_name)
Greg Kroah-Hartman
maintainerPATCH 66/207 rapidio: add check for rio_add_net() in rio_scan_alloc_net()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <[email protected]>
commit e842f9a1edf306bf36fe2a4d847a0b0d458770de upstream.
The return value of rio_add_net() should be checked. If it fails, put_device() should be called to free the memory and give up the reference initialized in rio_add_net().
--- drivers/rapidio/rio-scan.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/rapidio/rio-scan.c +4 -1
@@ -871,7 +871,10 @@ static struct rio_net *rio_scan_alloc_nedev_set_name (&net->dev,"rnet_%d" , net->id); net->dev.parent = &mport->dev; net->dev.release = rio_scan_release_dev; -rio_add_net (net); +if (rio_add_net (net)) { +put_device (&net->dev); + net =NULL ; + } }return net;
Greg Kroah-Hartman
maintainerPATCH 67/207 rapidio: fix an API misues when rio_add_net() fails
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <[email protected]>
commit b2ef51c74b0171fde7eb69b6152d3d2f743ef269 upstream.
rio_add_net() calls device_register() and fails when device_register() fails. Thus, put_device() should be used rather than kfree(). Add "mport->net = NULL;" to avoid a use after free issue.
--- drivers/rapidio/devices/rio_mport_cdev.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/rapidio/devices/rio_mport_cdev.c +2 -1
@@ -1742,7 +1742,8 @@ static int rio_mport_add_riodev(struct m err =rio_add_net (net);if (err) {rmcd_debug (RDEV ,"failed to register net, err=%d" , err); -kfree (net); +put_device (&net->dev); + mport->net =NULL ; goto cleanup; } }
Greg Kroah-Hartman
maintainerPATCH 68/207 dma: kmsan: export kmsan_handle_dma() for modules
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <[email protected]>
commit 19fac3c93991502a22c5132824c40b6a2e64b136 upstream.
kmsan_handle_dma() is used by virtio_ring() which can be built as a module. kmsan_handle_dma() needs to be exported otherwise building the virtio_ring fails.
Export kmsan_handle_dma for modules.
--- mm/kmsan/hooks.c | 1 + 1 file changed, 1 insertion(+)
mm/kmsan/hooks.c +1 -0
@@ -357,6 +357,7 @@ void kmsan_handle_dma(struct page *page, size -= to_go; } } +EXPORT_SYMBOL_GPL (kmsan_handle_dma);void kmsan_handle_dma_sg (struct scatterlist *sg,int nents,enum dma_data_direction dir)
Greg Kroah-Hartman
maintainerPATCH 69/207 s390/traps: Fix test_monitor_call() inline assembly
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <[email protected]>
commit 5623bc23a1cb9f9a9470fa73b3a20321dc4c4870 upstream.
The test_monitor_call() inline assembly uses the xgr instruction, which also modifies the condition code, to clear a register. However the clobber list of the inline assembly does not specify that the condition code is modified, which may lead to incorrect code generation.
Use the lhi instruction instead to clear the register without that the condition code is modified. Furthermore this limits clearing to the lower 32 bits of val, since its type is int.
--- arch/s390/kernel/traps.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/s390/kernel/traps.c +3 -3
@@ -285,10 +285,10 @@ static void __init test_monitor_call(voireturn ; asmvolatile (" mc 0,0\n" -"0: xgr %0,%0\n" +"0: lhi %[val],0\n" "1:\n" - EX_TABLE(0b,1b) - : "+d" (val)); + EX_TABLE(0b, 1b) + : [val] "+d" (val)); if (!val)panic ("Monitor call doesn't work!\n" ); }
Greg Kroah-Hartman
maintainerPATCH 70/207 NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Snitzer <[email protected]>
commit ce6d9c1c2b5cc785016faa11b48b6cd317eb367e upstream.
Add PF_KCOMPACTD flag and current_is_kcompactd() helper to check for it so nfs_release_folio() can skip calling nfs_wb_folio() from kcompactd.
Otherwise NFS can deadlock waiting for kcompactd enduced writeback which recurses back to NFS (which triggers writeback to NFSD via NFS loopback mount on the same host, NFSD blocks waiting for XFS's call to __filemap_get_folio):
6070.550357] INFO: task kcompactd0:58 blocked for more than 4435 seconds.
{---
[58] "kcompactd0"
[<0>] folio_wait_bit+0xe8/0x200 [<0>] folio_wait_writeback+0x2b/0x80 [<0>] nfs_wb_folio+0x80/0x1b0 [nfs] [<0>] nfs_release_folio+0x68/0x130 [nfs] [<0>] split_huge_page_to_list_to_order+0x362/0x840 [<0>] migrate_pages_batch+0x43d/0xb90 [<0>] migrate_pages_sync+0x9a/0x240 [<0>] migrate_pages+0x93c/0x9f0 [<0>] compact_zone+0x8e2/0x1030 [<0>] compact_node+0xdb/0x120 [<0>] kcompactd+0x121/0x2e0 [<0>] kthread+0xcf/0x100 [<0>] ret_from_fork+0x31/0x40 [<0>] ret_from_fork_asm+0x1a/0x30
---}
--- fs/nfs/file.c | 3 ++- include/linux/compaction.h | 5 +++++ include/linux/sched.h | 2 +- mm/compaction.c | 3 +++ 4 files changed, 11 insertions(+), 2 deletions(-)
fs/nfs/file.c +2 -1
@@ -29,6 +29,7 @@#include <linux/pagemap.h> #include <linux/gfp.h> #include <linux/swap.h> +#include <linux/compaction.h> #include <linux/uaccess.h> #include <linux/filelock.h>
@@ -457,7 +458,7 @@ static bool nfs_release_folio(struct fol/* If the private flag is set, then the folio is not freeable */ if (folio_test_private (folio)) {if ((current_gfp_context (gfp) &GFP_KERNEL ) !=GFP_KERNEL || -current_is_kswapd ()) +current_is_kswapd () ||current_is_kcompactd ())return false;if (nfs_wb_folio (folio->mapping->host, folio) <0 )return false;
include/linux/compaction.h +5 -0
@@ -80,6 +80,11 @@ static inline unsigned long compact_gap(return 2UL << order; } +static inline int current_is_kcompactd (void ) +{ +return current->flags &PF_KCOMPACTD ; +} +#ifdef CONFIG_COMPACTION extern unsigned int extfrag_for_order (struct zone *zone,unsigned int order);
include/linux/sched.h +1 -1
@@ -1686,7 +1686,7 @@ extern struct pid *cad_pid;#define PF_USED_MATH 0x00002000/* If unset the fpu must be initialized before use */ #define PF_USER_WORKER 0x00004000/* Kernel thread cloned from userspace thread */ #define PF_NOFREEZE 0x00008000/* This thread should not be frozen */ -#define PF__HOLE__00010000 0x00010000 +#define PF_KCOMPACTD 0x00010000/* I am kcompactd */ #define PF_KSWAPD 0x00020000/* I am kswapd */ #define PF_MEMALLOC_NOFS 0x00040000/* All allocations inherit GFP_NOFS. See memalloc_nfs_save() */ #define PF_MEMALLOC_NOIO 0x00080000/* All allocations inherit GFP_NOIO. See memalloc_noio_save() */
mm/compaction.c +3 -0
@@ -3164,6 +3164,7 @@ static int kcompactd(void *p)if (!cpumask_empty (cpumask))set_cpus_allowed_ptr (tsk, cpumask); + current->flags |=PF_KCOMPACTD ;set_freezable (); pgdat->kcompactd_max_order =0 ;
@@ -3220,6 +3221,8 @@ static int kcompactd(void *p) pgdat->proactive_compact_trigger = false; } + current->flags &= ~PF_KCOMPACTD ; +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 71/207 userfaultfd: do not block on locking a large folio with raised refcount
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Suren Baghdasaryan <[email protected]>
commit 37b338eed10581784e854d4262da05c8d960c748 upstream.
Lokesh recently raised an issue about UFFDIO_MOVE getting into a deadlock state when it goes into split_folio() with raised folio refcount. split_folio() expects the reference count to be exactly mapcount + num_pages_in_folio + 1 (see can_split_folio()) and fails with EAGAIN otherwise.
If multiple processes are trying to move the same large folio, they raise the refcount (all tasks succeed in that) then one of them succeeds in locking the folio, while others will block in folio_lock() while keeping the refcount raised. The winner of this race will proceed with calling split_folio() and will fail returning EAGAIN to the caller and unlocking the folio. The next competing process will get the folio locked and will go through the same flow. In the meantime the original winner will be retried and will block in folio_lock(), getting into the queue of waiting processes only to repeat the same path. All this results in a livelock.
An easy fix would be to avoid waiting for the folio lock while holding folio refcount, similar to madvise_free_huge_pmd() where folio lock is acquired before raising the folio refcount. Since we lock and take a refcount of the folio while holding the PTE lock, changing the order of these operations should not break anything.
Modify move_pages_pte() to try locking the folio first and if that fails and the folio is large then return EAGAIN without touching the folio refcount. If the folio is single-page then split_folio() is not called, so we don't have this issue. Lokesh has a reproducer [1] and I verified that this change fixes the issue.
[1] https://github.com/lokeshgidra/uffd_move_ioctl_deadlock
--- mm/userfaultfd.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-)
mm/userfaultfd.c +16 -1
@@ -1224,6 +1224,7 @@ retry:*/ if (!src_folio) {struct folio *folio; +bool locked;/* * Pin the page while holding the lock to be sure the
@@ -1243,12 +1244,26 @@ retry: goto out; } + locked =folio_trylock (folio); +/* +* We avoid waiting for folio lock with a raised +* refcount for large folios because extra refcounts +* will result in split_folio() failing later and +* retrying. If multiple tasks are trying to move a +* large folio we can end up livelocking. +*/ +if (!locked &&folio_test_large (folio)) { +spin_unlock (src_ptl); + err = -EAGAIN ; + goto out; + } +folio_get (folio); src_folio = folio; src_folio_pte = orig_src_pte;spin_unlock (src_ptl); -if (!folio_trylock (src_folio)) { +if (!locked) {pte_unmap (&orig_src_pte);pte_unmap (&orig_dst_pte); src_pte = dst_pte =NULL ;
Greg Kroah-Hartman
maintainerPATCH 72/207 arm: pgtable: fix NULL pointer dereference issue
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qi Zheng <[email protected]>
commit a564ccfe300fa6a065beda06ab7f3c140d6b4d63 upstream.
When update_mmu_cache_range() is called by update_mmu_cache(), the vmf parameter is NULL, which will cause a NULL pointer dereference issue in adjust_pte():
Unable to handle kernel NULL pointer dereference at virtual address 00000030 when read Hardware name: Atmel AT91SAM9 PC is at update_mmu_cache_range+0x1e0/0x278 LR is at pte_offset_map_rw_nolock+0x18/0x2c Call trace: update_mmu_cache_range from remove_migration_pte+0x29c/0x2ec remove_migration_pte from rmap_walk_file+0xcc/0x130 rmap_walk_file from remove_migration_ptes+0x90/0xa4 remove_migration_ptes from migrate_pages_batch+0x6d4/0x858 migrate_pages_batch from migrate_pages+0x188/0x488 migrate_pages from compact_zone+0x56c/0x954 compact_zone from compact_node+0x90/0xf0 compact_node from kcompactd+0x1d4/0x204 kcompactd from kthread+0x120/0x12c kthread from ret_from_fork+0x14/0x38 Exception stack(0xc0d8bfb0 to 0xc0d8bff8)
To fix it, do not rely on whether 'ptl' is equal to decide whether to hold the pte lock, but decide it by whether CONFIG_SPLIT_PTE_PTLOCKS is enabled. In addition, if two vmas map to the same PTE page, there is no need to hold the pte lock again, otherwise a deadlock will occur. Just add the need_lock parameter to let adjust_pte() know this information.
--- arch/arm/mm/fault-armv.c | 37 +++++++++++++++++++++++++------------ 1 file changed, 25 insertions(+), 12 deletions(-)
arch/arm/mm/fault-armv.c +25 -12
@@ -62,7 +62,7 @@ static int do_adjust_pte(struct vm_area_ }static int adjust_pte (struct vm_area_struct *vma,unsigned long address, -unsigned long pfn,struct vm_fault *vmf) +unsigned long pfn,bool need_lock) {spinlock_t *ptl;pgd_t *pgd;
@@ -99,12 +99,11 @@ again:if (!pte)return 0 ; -/* -* If we are using split PTE locks, then we need to take the page -* lock here. Otherwise we are using shared mm->page_table_lock -* which is already locked, thus cannot take it. -*/ -if (ptl != vmf->ptl) { +if (need_lock) { +/* +* Use nested version here to indicate that we are already +* holding one similar spinlock. +*/ spin_lock_nested (ptl,SINGLE_DEPTH_NESTING );if (unlikely (!pmd_same (pmdval,pmdp_get_lockless (pmd)))) {pte_unmap_unlock (pte, ptl);
@@ -114,7 +113,7 @@ again: ret =do_adjust_pte (vma, address, pfn, pte); -if (ptl != vmf->ptl) +if (need_lock)spin_unlock (ptl);pte_unmap (pte);
@@ -123,9 +122,10 @@ again:static void make_coherent (struct address_space *mapping,struct vm_area_struct *vma, -unsigned long addr,pte_t *ptep,unsigned long pfn, -struct vm_fault *vmf) +unsigned long addr,pte_t *ptep,unsigned long pfn) { +const unsigned long pmd_start_addr =ALIGN_DOWN (addr,PMD_SIZE ); +const unsigned long pmd_end_addr = pmd_start_addr +PMD_SIZE ;struct mm_struct *mm = vma->vm_mm;struct vm_area_struct *mpnt;unsigned long offset;
@@ -142,6 +142,14 @@ make_coherent(struct address_space *mappflush_dcache_mmap_lock (mapping); vma_interval_tree_foreach(mpnt, &mapping->i_mmap, pgoff, pgoff) {/* +* If we are using split PTE locks, then we need to take the pte +* lock. Otherwise we are using shared mm->page_table_lock which +* is already locked, thus cannot take it. +*/ +bool need_lock =IS_ENABLED (CONFIG_SPLIT_PTE_PTLOCKS ); +unsigned long mpnt_addr; + +/* * If this VMA is not in our MM, we can ignore it. * Note that we intentionally mask out the VMA * that we are fixing up.
@@ -151,7 +159,12 @@ make_coherent(struct address_space *mappif (!(mpnt->vm_flags &VM_MAYSHARE ))continue ; offset = (pgoff - mpnt->vm_pgoff) <<PAGE_SHIFT ; - aliases +=adjust_pte (mpnt, mpnt->vm_start + offset, pfn, vmf); + mpnt_addr = mpnt->vm_start + offset; + +/* Avoid deadlocks by not grabbing the same PTE lock again. */ +if (mpnt_addr >= pmd_start_addr && mpnt_addr < pmd_end_addr) + need_lock = false; + aliases +=adjust_pte (mpnt, mpnt_addr, pfn, need_lock); }flush_dcache_mmap_unlock (mapping);if (aliases)
@@ -194,7 +207,7 @@ void update_mmu_cache_range(struct vm_fa__flush_dcache_folio (mapping, folio);if (mapping) {if (cache_is_vivt ()) -make_coherent (mapping, vma, addr, ptep, pfn, vmf); +make_coherent (mapping, vma, addr, ptep, pfn);else if (vma->vm_flags &VM_EXEC )__flush_icache_all (); }
Greg Kroah-Hartman
maintainerPATCH 73/207 block: fix conversion of GPT partition name to 7-bit
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olivier Gayot <[email protected]>
commit e06472bab2a5393430cc2fbc3211cd3602422c1e upstream.
The utf16_le_to_7bit function claims to, naively, convert a UTF-16 string to a 7-bit ASCII string. By naively, we mean that it:
* drops the first byte of every character in the original UTF-16 string
* checks if all characters are printable, and otherwise replaces them by exclamation mark "!".
This means that theoretically, all characters outside the 7-bit ASCII range should be replaced by another character. Examples:
* lower-case alpha (ɒ) 0x0252 becomes 0x52 (R)
* ligature OE (œ) 0x0153 becomes 0x53 (S)
* hangul letter pieup (ㅂ) 0x3142 becomes 0x42 (B)
* upper-case gamma (Ɣ) 0x0194 becomes 0x94 (not printable) so gets replaced by "!"
The result of this conversion for the GPT partition name is passed to user-space as PARTNAME via udev, which is confusing and feels questionable.
However, there is a flaw in the conversion function itself. By dropping one byte of each character and using isprint() to check if the remaining byte corresponds to a printable character, we do not actually guarantee that the resulting character is 7-bit ASCII.
This happens because we pass 8-bit characters to isprint(), which in the kernel returns 1 for many values > 0x7f - as defined in ctype.c.
This results in many values which should be replaced by "!" to be kept as-is, despite not being valid 7-bit ASCII. Examples:
* e with acute accent (é) 0x00E9 becomes 0xE9 - kept as-is because isprint(0xE9) returns 1.
* euro sign (€) 0x20AC becomes 0xAC - kept as-is because isprint(0xAC) returns 1.
This way has broken pyudev utility[1], fixes it by using a mask of 7 bits instead of 8 bits before calling isprint.
--- block/partitions/efi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
block/partitions/efi.c +1 -1
@@ -682,7 +682,7 @@ static void utf16_le_to_7bit(const __le1 out[size] =0 ;while (i < size) { -u8 c =le16_to_cpu (in[i]) &0xff ; +u8 c =le16_to_cpu (in[i]) &0x7f ;if (c && !isprint (c)) c ='!' ;
Greg Kroah-Hartman
maintainerPATCH 74/207 mm/page_alloc: fix uninitialized variable
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hao Zhang <[email protected]>
commit 8fe9ed44dc29fba0786b7e956d2e87179e407582 upstream.
The variable "compact_result" is not initialized in function __alloc_pages_slowpath(). It causes should_compact_retry() to use an uninitialized value.
Initialize variable "compact_result" with the value COMPACT_SKIPPED.
BUG: KMSAN: uninit-value in __alloc_pages_slowpath+0xee8/0x16c0 mm/page_alloc.c:4416 __alloc_pages_slowpath+0xee8/0x16c0 mm/page_alloc.c:4416 __alloc_frozen_pages_noprof+0xa4c/0xe00 mm/page_alloc.c:4752 alloc_pages_mpol+0x4cd/0x890 mm/mempolicy.c:2270 alloc_frozen_pages_noprof mm/mempolicy.c:2341 [inline] alloc_pages_noprof mm/mempolicy.c:2361 [inline] folio_alloc_noprof+0x1dc/0x350 mm/mempolicy.c:2371 filemap_alloc_folio_noprof+0xa6/0x440 mm/filemap.c:1019 __filemap_get_folio+0xb9a/0x1840 mm/filemap.c:1970 grow_dev_folio fs/buffer.c:1039 [inline] grow_buffers fs/buffer.c:1105 [inline] __getblk_slow fs/buffer.c:1131 [inline] bdev_getblk+0x2c9/0xab0 fs/buffer.c:1431 getblk_unmovable include/linux/buffer_head.h:369 [inline] ext4_getblk+0x3b7/0xe50 fs/ext4/inode.c:864 ext4_bread_batch+0x9f/0x7d0 fs/ext4/inode.c:933 __ext4_find_entry+0x1ebb/0x36c0 fs/ext4/namei.c:1627 ext4_lookup_entry fs/ext4/namei.c:1729 [inline] ext4_lookup+0x189/0xb40 fs/ext4/namei.c:1797 __lookup_slow+0x538/0x710 fs/namei.c:1793 lookup_slow+0x6a/0xd0 fs/namei.c:1810 walk_component fs/namei.c:2114 [inline] link_path_walk+0xf29/0x1420 fs/namei.c:2479 path_openat+0x30f/0x6250 fs/namei.c:3985 do_filp_open+0x268/0x600 fs/namei.c:4016 do_sys_openat2+0x1bf/0x2f0 fs/open.c:1428 do_sys_open fs/open.c:1443 [inline] __do_sys_openat fs/open.c:1459 [inline] __se_sys_openat fs/open.c:1454 [inline] __x64_sys_openat+0x2a1/0x310 fs/open.c:1454 x64_sys_call+0x36f5/0x3c30 arch/x86/include/generated/asm/syscalls_64.h:258 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Local variable compact_result created at:
__alloc_pages_slowpath+0x66/0x16c0 mm/page_alloc.c:4218 __alloc_frozen_pages_noprof+0xa4c/0xe00 mm/page_alloc.c:4752
--- mm/page_alloc.c | 1 + 1 file changed, 1 insertion(+)
mm/page_alloc.c +1 -0
@@ -4243,6 +4243,7 @@ __alloc_pages_slowpath(gfp_t gfp_mask, u restart: compaction_retries =0 ; no_progress_loops =0 ; + compact_result =COMPACT_SKIPPED ; compact_priority =DEF_COMPACT_PRIORITY ; cpuset_mems_cookie =read_mems_allowed_begin (); zonelist_iter_cookie =zonelist_iter_begin ();
Greg Kroah-Hartman
maintainerPATCH 75/207 mm: abort vma_modify() on merge out of memory failure
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Stoakes <[email protected]>
commit 47b16d0462a460000b8f05dfb1292377ac48f3ca upstream.
The remainder of vma_modify() relies upon the vmg state remaining pristine after a merge attempt.
Usually this is the case, however in the one edge case scenario of a merge attempt failing not due to the specified range being unmergeable, but rather due to an out of memory error arising when attempting to commit the merge, this assumption becomes untrue.
This results in vmg->start, end being modified, and thus the proceeding attempts to split the VMA will be done with invalid start/end values.
Thankfully, it is likely practically impossible for us to hit this in reality, as it would require a maple tree node pre-allocation failure that would likely never happen due to it being 'too small to fail', i.e. the kernel would simply keep retrying reclaim until it succeeded.
However, this scenario remains theoretically possible, and what we are doing here is wrong so we must correct it.
The safest option is, when this scenario occurs, to simply give up the operation. If we cannot allocate memory to merge, then we cannot allocate memory to split either (perhaps moreso!).
Any scenario where this would be happening would be under very extreme (likely fatal) memory pressure, so it's best we give up early.
So there is no doubt it is appropriate to simply bail out in this scenario.
However, in general we must if at all possible never assume VMG state is stable after a merge attempt, since merge operations update VMG fields. As a result, additionally also make this clear by storing start, end in local variables.
The issue was reported originally by syzkaller, and by Brad Spengler (via an off-list discussion), and in both instances it manifested as a triggering of the assert:
VM_WARN_ON_VMG(start >= end, vmg);
In vma_merge_existing_range().
It seems at least one scenario in which this is occurring is one in which the merge being attempted is due to an madvise() across multiple VMAs which looks like this:
start end
|<------>|
|----------|------|
| vma | next |
|----------|------|When madvise_walk_vmas() is invoked, we first find vma in the above (determining prev to be equal to vma as we are offset into vma), and then enter the loop.
We determine the end of vma that forms part of the range we are madvise()'ing by setting 'tmp' to this value:
/* Here vma->vm_start <= start < (end|vma->vm_end) */ tmp = vma->vm_end;
We then invoke the madvise() operation via visit(), letting prev get updated to point to vma as part of the operation:
/* Here vma->vm_start <= start < tmp <= (end|vma->vm_end). */ error = visit(vma, &prev, start, tmp, arg);
Where the visit() function pointer in this instance is madvise_vma_behavior().
As observed in syzkaller reports, it is ultimately madvise_update_vma() that is invoked, calling vma_modify_flags_name() and vma_modify() in turn.
Then, in vma_modify(), we attempt the merge:
merged = vma_merge_existing_range(vmg); if (merged) return merged;
We invoke this with vmg->start, end set to start, tmp as such:
start tmp
|<--->|
|----------|------|
| vma | next |
|----------|------|We find ourselves in the merge right scenario, but the one in which we cannot remove the middle (we are offset into vma).
Here we have a special case where vmg->start, end get set to perhaps unintuitive values - we intended to shrink the middle VMA and expand the next.
This means vmg->start, end are set to... vma->vm_start, start.
Now the commit_merge() fails, and vmg->start, end are left like this. This means we return to the rest of vma_modify() with vmg->start, end (here denoted as start', end') set as:
start' end'
|<-->|
|----------|------|
| vma | next |
|----------|------|So we now erroneously try to split accordingly. This is where the unfortunate stuff begins.
We start with:
/* Split any preceding portion of the VMA. */
if (vma->vm_start < vmg->start) {
...
}This doesn't trigger as we are no longer offset into vma at the start.
But then we invoke:
/* Split any trailing portion of the VMA. */
if (vma->vm_end > vmg->end) {
...
}Which does get invoked. This leaves us with:
start' end'
|<-->|
|----|-----|------|
| vma| new | next |
|----|-----|------|We then return ultimately to madvise_walk_vmas(). Here 'new' is unknown, and putting back the values known in this function we are faced with:
start tmp end
| | |
|----|-----|------|
| vma| new | next |
|----|-----|------|
prevThen:
start = tmp;
So:
start end
| |
|----|-----|------|
| vma| new | next |
|----|-----|------|
prevThe following code does not cause anything to happen:
if (prev && start < prev->vm_end) start = prev->vm_end; if (start >= end) break;
And then we invoke:
if (prev) vma = find_vma(mm, prev->vm_end);
Which is where a problem occurs - we don't know about 'new' so we essentially look for the vma after prev, which is new, whereas we actually intended to discover next!
So we end up with:
start end
| |
|----|-----|------|
|prev| vma | next |
|----|-----|------|And we have successfully bypassed all of the checks madvise_walk_vmas() has to ensure early exit should we end up moving out of range.
We loop around, and hit:
/* Here vma->vm_start <= start < (end|vma->vm_end) */ tmp = vma->vm_end;
Oh dear. Now we have:
tmp
start end
| |
|----|-----|------|
|prev| vma | next |
|----|-----|------|We then invoke:
/* Here vma->vm_start <= start < tmp <= (end|vma->vm_end). */ error = visit(vma, &prev, start, tmp, arg);
Where start == tmp. That is, a zero range. This is not good.
We invoke visit() which is madvise_vma_behavior() which does not check the range (for good reason, it assumes all checks have been done before it was called), which in turn finally calls madvise_update_vma().
The madvise_update_vma() function calls vma_modify_flags_name() in turn, which ultimately invokes vma_modify() with... start == end.
vma_modify() calls vma_merge_existing_range() and finally we hit:
VM_WARN_ON_VMG(start >= end, vmg);
Which triggers, as start == end.
While it might be useful to add some CONFIG_DEBUG_VM asserts in these instances to catch this kind of error, since we have just eliminated any possibility of that happening, we will add such asserts separately as to reduce churn and aid backporting.
--- mm/vma.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
mm/vma.c +8 -4
@@ -1508,24 +1508,28 @@ int do_vmi_munmap(struct vma_iterator *vstatic struct vm_area_struct *vma_modify (struct vma_merge_struct *vmg) {struct vm_area_struct *vma = vmg->vma; +unsigned long start = vmg->start; +unsigned long end = vmg->end;struct vm_area_struct *merged;/* First, try to merge. */ merged =vma_merge_existing_range (vmg);if (merged)return merged; +if (vmg_nomem (vmg)) +return ERR_PTR (-ENOMEM );/* Split any preceding portion of the VMA. */ -if (vma->vm_start < vmg->start) { -int err =split_vma (vmg->vmi, vma, vmg->start,1 ); +if (vma->vm_start < start) { +int err =split_vma (vmg->vmi, vma, start,1 );if (err)return ERR_PTR (err); }/* Split any trailing portion of the VMA. */ -if (vma->vm_end > vmg->end) { -int err =split_vma (vmg->vmi, vma, vmg->end,0 ); +if (vma->vm_end > end) { +int err =split_vma (vmg->vmi, vma, end,0 );if (err)return ERR_PTR (err);
Greg Kroah-Hartman
maintainerPATCH 76/207 mm: memory-failure: update ttu flag inside unmap_poisoned_folio
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Wupeng <[email protected]>
commit b81679b1633aa43c0d973adfa816d78c1ed0d032 upstream.
Patch series "mm: memory_failure: unmap poisoned folio during migrate properly", v3.
Fix two bugs during folio migration if the folio is poisoned.
This patch (of 3):
Commit 6da6b1d4a7df ("mm/hwpoison: convert TTU_IGNORE_HWPOISON to TTU_HWPOISON") introduce TTU_HWPOISON to replace TTU_IGNORE_HWPOISON in order to stop send SIGBUS signal when accessing an error page after a memory error on a clean folio. However during page migration, anon folio must be set with TTU_HWPOISON during unmap_*(). For pagecache we need some policy just like the one in hwpoison_user_mappings to set this flag. So move this policy from hwpoison_user_mappings to unmap_poisoned_folio to handle this warning properly.
Warning will be produced during unamp poison folio with the following log:
------------[ cut here ]------------ WARNING: CPU: 1 PID: 365 at mm/rmap.c:1847 try_to_unmap_one+0x8fc/0xd3c Modules linked in: CPU: 1 UID: 0 PID: 365 Comm: bash Tainted: G W 6.13.0-rc1-00018-gacdb4bbda7ab #42 Tainted: [W]=WARN Hardware name: QEMU QEMU Virtual Machine, BIOS 0.0.0 02/06/2015 pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : try_to_unmap_one+0x8fc/0xd3c lr : try_to_unmap_one+0x3dc/0xd3c Call trace: try_to_unmap_one+0x8fc/0xd3c (P) try_to_unmap_one+0x3dc/0xd3c (L) rmap_walk_anon+0xdc/0x1f8 rmap_walk+0x3c/0x58 try_to_unmap+0x88/0x90 unmap_poisoned_folio+0x30/0xa8 do_migrate_range+0x4a0/0x568 offline_pages+0x5a4/0x670 memory_block_action+0x17c/0x374 memory_subsys_offline+0x3c/0x78 device_offline+0xa4/0xd0 state_store+0x8c/0xf0 dev_attr_store+0x18/0x2c sysfs_kf_write+0x44/0x54 kernfs_fop_write_iter+0x118/0x1a8 vfs_write+0x3a8/0x4bc ksys_write+0x6c/0xf8 __arm64_sys_write+0x1c/0x28 invoke_syscall+0x44/0x100 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x30/0xd0 el0t_64_sync_handler+0xc8/0xcc el0t_64_sync+0x198/0x19c ---[ end trace 0000000000000000 ]---
--- mm/internal.h | 5 ++-- mm/memory-failure.c | 63 +++++++++++++++++++++++++--------------------------- mm/memory_hotplug.c | 3 +- 3 files changed, 36 insertions(+), 35 deletions(-)
mm/internal.h +3 -2
@@ -1102,7 +1102,7 @@ static inline int find_next_best_node(in* mm/memory-failure.c */ #ifdef CONFIG_MEMORY_FAILURE -void unmap_poisoned_folio (struct folio *folio,enum ttu_flags ttu); +int unmap_poisoned_folio (struct folio *folio,unsigned long pfn,bool must_kill);void shake_folio (struct folio *folio);extern int hwpoison_filter (struct page *p);
@@ -1125,8 +1125,9 @@ unsigned long page_mapped_in_vma(const s struct vm_area_struct *vma);#else -static inline void unmap_poisoned_folio (struct folio *folio,enum ttu_flags ttu) +static inline int unmap_poisoned_folio (struct folio *folio,unsigned long pfn,bool must_kill) { +return -EBUSY ; }#endif
mm/memory-failure.c +31 -32
101 lines not on this page · raw message
mm/memory_hotplug.c +2 -1
@@ -1806,7 +1806,8 @@ static void do_migrate_range(unsigned loif (WARN_ON (folio_test_lru (folio)))folio_isolate_lru (folio);if (folio_mapped (folio)) -unmap_poisoned_folio (folio,TTU_IGNORE_MLOCK ); +unmap_poisoned_folio (folio, pfn, false); +continue ; }
Greg Kroah-Hartman
maintainerPATCH 77/207 mm: dont skip arch_sync_kernel_mappings() in error paths
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryan Roberts <[email protected]>
commit 3685024edd270f7c791f993157d65d3c928f3d6e upstream.
Fix callers that previously skipped calling arch_sync_kernel_mappings() if an error occurred during a pgtable update. The call is still required to sync any pgtable updates that may have occurred prior to hitting the error condition.
These are theoretical bugs discovered during code review.
--- mm/memory.c | 6 ++++-- mm/vmalloc.c | 4 ++-- 2 files changed, 6 insertions(+), 4 deletions(-)
mm/memory.c +4 -2
@@ -2971,8 +2971,10 @@ static int __apply_to_page_range(struct next =pgd_addr_end (addr, end);if (pgd_none (*pgd) && !create)continue ; -if (WARN_ON_ONCE (pgd_leaf (*pgd))) -return -EINVAL ; +if (WARN_ON_ONCE (pgd_leaf (*pgd))) { + err = -EINVAL ; +break ; + }if (!pgd_none (*pgd) &&WARN_ON_ONCE (pgd_bad (*pgd))) {if (!create)continue ;
mm/vmalloc.c +2 -2
@@ -586,13 +586,13 @@ static int vmap_small_pages_range_noflus mask |=PGTBL_PGD_MODIFIED ; err =vmap_pages_p4d_range (pgd, addr, next, prot, pages, &nr, &mask);if (err) -return err; +break ; }while (pgd++, addr = next, addr != end);if (mask &ARCH_PAGE_TABLE_SYNC_MASK )arch_sync_kernel_mappings (start, end); -return 0 ; +return err; }/*
Greg Kroah-Hartman
maintainerPATCH 78/207 mm: fix finish_fault() handling for large folios
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Geffon <[email protected]>
commit 34b82f33cf3f03bc39e9a205a913d790e1520ade upstream.
When handling faults for anon shmem finish_fault() will attempt to install ptes for the entire folio. Unfortunately if it encounters a single non-pte_none entry in that range it will bail, even if the pte that triggered the fault is still pte_none. When this situation happens the fault will be retried endlessly never making forward progress.
This patch fixes this behavior and if it detects that a pte in the range is not pte_none it will fall back to setting a single pte.
--- mm/memory.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
mm/memory.c +10 -5
@@ -5104,7 +5104,11 @@ vm_fault_t finish_fault(struct vm_faultbool is_cow = (vmf->flags &FAULT_FLAG_WRITE ) && !(vma->vm_flags &VM_SHARED );int type, nr_pages; -unsigned long addr = vmf->address; +unsigned long addr; +bool needs_fallback = false; + +fallback: + addr = vmf->address;/* Did we COW the page? */ if (is_cow)
@@ -5143,7 +5147,8 @@ vm_fault_t finish_fault(struct vm_fault* approach also applies to non-anonymous-shmem faults to avoid * inflating the RSS of the process. */ -if (!vma_is_anon_shmem (vma) ||unlikely (userfaultfd_armed (vma))) { +if (!vma_is_anon_shmem (vma) ||unlikely (userfaultfd_armed (vma)) || +unlikely (needs_fallback)) { nr_pages =1 ; }else if (nr_pages >1 ) {pgoff_t idx =folio_page_idx (folio, page);
@@ -5179,9 +5184,9 @@ vm_fault_t finish_fault(struct vm_fault ret =VM_FAULT_NOPAGE ; goto unlock; }else if (nr_pages >1 && !pte_range_none (vmf->pte, nr_pages)) { -update_mmu_tlb_range (vma, addr, vmf->pte, nr_pages); - ret =VM_FAULT_NOPAGE ; - goto unlock; + needs_fallback = true; +pte_unmap_unlock (vmf->pte, vmf->ptl); + goto fallback; }folio_ref_add (folio, nr_pages -1 );
Greg Kroah-Hartman
maintainerPATCH 79/207 hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Wupeng <[email protected]>
commit af288a426c3e3552b62595c6138ec6371a17dbba upstream.
Commit b15c87263a69 ("hwpoison, memory_hotplug: allow hwpoisoned pages to be offlined) add page poison checks in do_migrate_range in order to make offline hwpoisoned page possible by introducing isolate_lru_page and try_to_unmap for hwpoisoned page. However folio lock must be held before calling try_to_unmap. Add it to fix this problem.
Warning will be produced if folio is not locked during unmap:
------------[ cut here ]------------ kernel BUG at ./include/linux/swapops.h:400! Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 4 UID: 0 PID: 411 Comm: bash Tainted: G W 6.13.0-rc1-00016-g3c434c7ee82a-dirty #41 Tainted: [W]=WARN Hardware name: QEMU QEMU Virtual Machine, BIOS 0.0.0 02/06/2015 pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : try_to_unmap_one+0xb08/0xd3c lr : try_to_unmap_one+0x3dc/0xd3c Call trace: try_to_unmap_one+0xb08/0xd3c (P) try_to_unmap_one+0x3dc/0xd3c (L) rmap_walk_anon+0xdc/0x1f8 rmap_walk+0x3c/0x58 try_to_unmap+0x88/0x90 unmap_poisoned_folio+0x30/0xa8 do_migrate_range+0x4a0/0x568 offline_pages+0x5a4/0x670 memory_block_action+0x17c/0x374 memory_subsys_offline+0x3c/0x78 device_offline+0xa4/0xd0 state_store+0x8c/0xf0 dev_attr_store+0x18/0x2c sysfs_kf_write+0x44/0x54 kernfs_fop_write_iter+0x118/0x1a8 vfs_write+0x3a8/0x4bc ksys_write+0x6c/0xf8 __arm64_sys_write+0x1c/0x28 invoke_syscall+0x44/0x100 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x30/0xd0 el0t_64_sync_handler+0xc8/0xcc el0t_64_sync+0x198/0x19c Code: f9407be0 b5fff320 d4210000 17ffff97 (d4210000) ---[ end trace 0000000000000000 ]---
--- mm/memory_hotplug.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
mm/memory_hotplug.c +4 -1
@@ -1805,8 +1805,11 @@ static void do_migrate_range(unsigned lo (folio_test_large(folio) && folio_test_has_hwpoisoned(folio))) {if (WARN_ON (folio_test_lru (folio)))folio_isolate_lru (folio); -if (folio_mapped (folio)) +if (folio_mapped (folio)) { +folio_lock (folio);unmap_poisoned_folio (folio, pfn, false); +folio_unlock (folio); + }continue ; }
Greg Kroah-Hartman
maintainerPATCH 80/207 mm: memory-hotplug: check folio ref count first in do_migrate_range
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Wupeng <[email protected]>
commit 773b9a6aa6d38894b95088e3ed6f8a701d9f50fd upstream.
If a folio has an increased reference count, folio_try_get() will acquire it, perform necessary operations, and then release it. In the case of a poisoned folio without an elevated reference count (which is unlikely for memory-failure), folio_try_get() will simply bypass it.
Therefore, relocate the folio_try_get() function, responsible for checking and acquiring this reference count at first.
--- mm/memory_hotplug.c | 20 +++++++------------- 1 file changed, 7 insertions(+), 13 deletions(-)
mm/memory_hotplug.c +7 -13
@@ -1795,12 +1795,12 @@ static void do_migrate_range(unsigned loif (folio_test_large (folio)) pfn =folio_pfn (folio) +folio_nr_pages (folio) -1 ; -/* -* HWPoison pages have elevated reference counts so the migration would -* fail on them. It also doesn't make any sense to migrate them in the -* first place. Still try to unmap such a page in case it is still mapped -* (keep the unmap as the catch all safety net). -*/ +if (!folio_try_get (folio)) +continue ; + +if (unlikely (page_folio (page) != folio)) + goto put_folio; +if (folio_test_hwpoison (folio) || (folio_test_large (folio) &&folio_test_has_hwpoisoned (folio))) {if (WARN_ON (folio_test_lru (folio)))
@@ -1811,14 +1811,8 @@ static void do_migrate_range(unsigned lofolio_unlock (folio); } -continue ; - } - -if (!folio_try_get (folio)) -continue ; - -if (unlikely (page_folio (page) != folio)) goto put_folio; + }if (!isolate_folio_to_list (folio, &source)) {if (__ratelimit (&migrate_rs)) {
Greg Kroah-Hartman
maintainerPATCH 81/207 wifi: iwlwifi: fw: avoid using an uninitialized variable
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miri Korenblit <[email protected]>
[ Upstream commit 3f8aa0b8a53df2247a84eaf3b3aa38b6ef86cb1c ]
iwl_fwrt_read_err_table can return true also when it failed to read the memory. In this case, err_id argument is not initialized, but the callers are still using it.
Simply initialize it to 0. If the error table was read successfully it'll be overridden.
--- drivers/net/wireless/intel/iwlwifi/fw/dump.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/wireless/intel/iwlwifi/fw/dump.c +3 -0
@@ -540,6 +540,9 @@ bool iwl_fwrt_read_err_table(struct iwl_trans *trans, u32 base, u32 *err_id) } err_info = {};int ret; +if (err_id) + *err_id =0 ; +if (!base)return false;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 82/207 wifi: iwlwifi: mvm: clean up ROC on failure
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit f9751163bffd3fe60794929829f810968c6de73d ]
If the firmware fails to start the session protection, then we do call iwl_mvm_roc_finished() here, but that won't do anything at all because IWL_MVM_STATUS_ROC_P2P_RUNNING was never set. Set IWL_MVM_STATUS_ROC_P2P_RUNNING in the failure/stop path. If it started successfully before, it's already set, so that doesn't matter, and if it didn't start it needs to be set to clean up.
Not doing so will lead to a WARN_ON() later on a fresh remain- on-channel, since the link is already active when activated as it was never deactivated.
--- drivers/net/wireless/intel/iwlwifi/mvm/time-event.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/wireless/intel/iwlwifi/mvm/time-event.c +2 -0
@@ -1030,6 +1030,8 @@ void iwl_mvm_rx_session_protect_notif(struct iwl_mvm *mvm,/* End TE, notify mac80211 */ mvmvif->time_event_data.id =SESSION_PROTECT_CONF_MAX_ID ; mvmvif->time_event_data.link_id =-1 ; +/* set the bit so the ROC cleanup will actually clean up */ +set_bit (IWL_MVM_STATUS_ROC_P2P_RUNNING , &mvm->status);iwl_mvm_roc_finished (mvm);ieee80211_remain_on_channel_expired (mvm->hw); }else if (le32_to_cpu (notif->start)) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 83/207 wifi: iwlwifi: mvm: log error for failures after D3
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Berg <[email protected]>
[ Upstream commit f8f13ea27fffff51ee257171a8604f944c876fd4 ]
We only logged an error in the fast resume path. However, as the hardware is being restarted it makes sense to log an error to make it easier to understand what is happening.
Add a new error message into the normal resume path and update the error in the fast resume path to match.
Stable-dep-of: d48ff3ce9225 ("wifi: iwlwifi: mvm: don't dump the firmware state upon RFKILL while suspend")
--- drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/intel/iwlwifi/mvm/d3.c +2 -2
@@ -3523,6 +3523,7 @@ static int __iwl_mvm_resume(struct iwl_mvm *mvm, bool test)iwl_fw_dbg_read_d3_debug_data (&mvm->fwrt);if (iwl_mvm_check_rt_status (mvm, vif)) { +IWL_ERR (mvm,"FW Error occurred during suspend. Restarting.\n" );set_bit (STATUS_FW_ERROR , &mvm->trans->status);iwl_mvm_dump_nic_error_log (mvm); iwl_dbg_tlv_time_point(&mvm->fwrt,
@@ -3695,8 +3696,7 @@ int iwl_mvm_fast_resume(struct iwl_mvm *mvm)iwl_fw_dbg_read_d3_debug_data (&mvm->fwrt);if (iwl_mvm_check_rt_status (mvm,NULL )) { -IWL_ERR (mvm, -"iwl_mvm_check_rt_status failed, device is gone during suspend\n" ); +IWL_ERR (mvm,"FW Error occurred during suspend. Restarting.\n" );set_bit (STATUS_FW_ERROR , &mvm->trans->status);iwl_mvm_dump_nic_error_log (mvm); iwl_dbg_tlv_time_point(&mvm->fwrt,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 84/207 wifi: iwlwifi: mvm: dont dump the firmware state upon RFKILL while suspend
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
[ Upstream commit d48ff3ce92259bae7e77732c7cfd7cbc7992c021 ]
This is not really a firmware error. We need to reload the firmware, but this doesn't mean that we should consider this as a firmware error. When the firmware was restarted upon resume, this wasn't felt by the driver. Now that we keep the firmware running during suspend even if we don't have wowlan, this started to pop-up.
--- drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 77 ++++++++++++++------- 1 file changed, 51 insertions(+), 26 deletions(-)
drivers/net/wireless/intel/iwlwifi/mvm/d3.c +51 -26
@@ -3099,8 +3099,14 @@ static void iwl_mvm_d3_disconnect_iter(void *data, u8 *mac,ieee80211_resume_disconnect (vif); } -static bool iwl_mvm_check_rt_status (struct iwl_mvm *mvm, -struct ieee80211_vif *vif) +enum rt_status { +FW_ALIVE , +FW_NEEDS_RESET , +FW_ERROR , +}; + +static enum rt_status iwl_mvm_check_rt_status (struct iwl_mvm *mvm, +struct ieee80211_vif *vif) {u32 err_id;
@@ -3108,29 +3114,35 @@ static bool iwl_mvm_check_rt_status(struct iwl_mvm *mvm,if (iwl_fwrt_read_err_table (mvm->trans, mvm->trans->dbg.lmac_error_event_table[0 ], &err_id)) { -if (err_id ==RF_KILL_INDICATOR_FOR_WOWLAN && vif) { -struct cfg80211_wowlan_wakeup wakeup = { - .rfkill_release = true, - }; -ieee80211_report_wowlan_wakeup (vif, &wakeup, -GFP_KERNEL ); +if (err_id ==RF_KILL_INDICATOR_FOR_WOWLAN ) { +IWL_WARN (mvm,"Rfkill was toggled during suspend\n" ); +if (vif) { +struct cfg80211_wowlan_wakeup wakeup = { + .rfkill_release = true, + }; + +ieee80211_report_wowlan_wakeup (vif, &wakeup, +GFP_KERNEL ); + } + +return FW_NEEDS_RESET ; } -return true; +return FW_ERROR ; }/* check if we have lmac2 set and check for error */ if (iwl_fwrt_read_err_table (mvm->trans, mvm->trans->dbg.lmac_error_event_table[1 ],NULL )) -return true; +return FW_ERROR ;/* check for umac error */ if (iwl_fwrt_read_err_table (mvm->trans, mvm->trans->dbg.umac_error_event_table,NULL )) -return true; +return FW_ERROR ; -return false; +return FW_ALIVE ; }/*
@@ -3499,6 +3511,7 @@ static int __iwl_mvm_resume(struct iwl_mvm *mvm, bool test)bool d0i3_first =fw_has_capa (&mvm->fw->ucode_capa,IWL_UCODE_TLV_CAPA_D0I3_END_FIRST );bool resume_notif_based =iwl_mvm_d3_resume_notif_based (mvm); +enum rt_status rt_status;bool keep = false;mutex_lock (&mvm->mutex);
@@ -3522,14 +3535,19 @@ static int __iwl_mvm_resume(struct iwl_mvm *mvm, bool test)iwl_fw_dbg_read_d3_debug_data (&mvm->fwrt); -if (iwl_mvm_check_rt_status (mvm, vif)) { -IWL_ERR (mvm,"FW Error occurred during suspend. Restarting.\n" ); + rt_status =iwl_mvm_check_rt_status (mvm, vif); +if (rt_status !=FW_ALIVE ) {set_bit (STATUS_FW_ERROR , &mvm->trans->status); -iwl_mvm_dump_nic_error_log (mvm); -iwl_dbg_tlv_time_point (&mvm->fwrt, -IWL_FW_INI_TIME_POINT_FW_ASSERT ,NULL ); -iwl_fw_dbg_collect_desc (&mvm->fwrt, &iwl_dump_desc_assert, - false,0 ); +if (rt_status ==FW_ERROR ) { +IWL_ERR (mvm,"FW Error occurred during suspend. Restarting.\n" ); +iwl_mvm_dump_nic_error_log (mvm); +iwl_dbg_tlv_time_point (&mvm->fwrt, +IWL_FW_INI_TIME_POINT_FW_ASSERT , +NULL ); +iwl_fw_dbg_collect_desc (&mvm->fwrt, + &iwl_dump_desc_assert, + false,0 ); + } ret =1 ; goto err; }
@@ -3686,6 +3704,7 @@ int iwl_mvm_fast_resume(struct iwl_mvm *mvm) .notif_expected = IWL_D3_NOTIF_D3_END_NOTIF, }; +enum rt_status rt_status;int ret;lockdep_assert_held (&mvm->mutex);
@@ -3695,14 +3714,20 @@ int iwl_mvm_fast_resume(struct iwl_mvm *mvm) mvm->last_reset_or_resume_time_jiffies = jiffies;iwl_fw_dbg_read_d3_debug_data (&mvm->fwrt); -if (iwl_mvm_check_rt_status (mvm,NULL )) { -IWL_ERR (mvm,"FW Error occurred during suspend. Restarting.\n" ); + rt_status =iwl_mvm_check_rt_status (mvm,NULL ); +if (rt_status !=FW_ALIVE ) {set_bit (STATUS_FW_ERROR , &mvm->trans->status); -iwl_mvm_dump_nic_error_log (mvm); -iwl_dbg_tlv_time_point (&mvm->fwrt, -IWL_FW_INI_TIME_POINT_FW_ASSERT ,NULL ); -iwl_fw_dbg_collect_desc (&mvm->fwrt, &iwl_dump_desc_assert, - false,0 ); +if (rt_status ==FW_ERROR ) { +IWL_ERR (mvm, +"iwl_mvm_check_rt_status failed, device is gone during suspend\n" ); +iwl_mvm_dump_nic_error_log (mvm); +iwl_dbg_tlv_time_point (&mvm->fwrt, +IWL_FW_INI_TIME_POINT_FW_ASSERT , +NULL ); +iwl_fw_dbg_collect_desc (&mvm->fwrt, + &iwl_dump_desc_assert, + false,0 ); + } mvm->trans->state =IWL_TRANS_NO_FW ; ret = -ENODEV ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 85/207 wifi: iwlwifi: mvm: dont try to talk to a dead firmware
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
[ Upstream commit d73d2c6e3313f0ba60711ab4f4b9044eddca9ca5 ]
This fixes:
bad state = 0
WARNING: CPU: 10 PID: 702 at drivers/net/wireless/inel/iwlwifi/iwl-trans.c:178 iwl_trans_send_cmd+0xba/0xe0 [iwlwifi] Call Trace: <TASK> ? __warn+0xca/0x1c0 ? iwl_trans_send_cmd+0xba/0xe0 [iwlwifi 64fa9ad799a0e0d2ba53d4af93a53ad9a531f8d4] iwl_fw_dbg_clear_monitor_buf+0xd7/0x110 [iwlwifi 64fa9ad799a0e0d2ba53d4af93a53ad9a531f8d4] _iwl_dbgfs_fw_dbg_clear_write+0xe2/0x120 [iwlmvm 0e8adb18cea92d2c341766bcc10b18699290068a]
Ask whether the firmware is alive before sending a command.
--- drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c +7 -0
@@ -1518,6 +1518,13 @@ static ssize_t iwl_dbgfs_fw_dbg_clear_write(struct iwl_mvm *mvm,if (mvm->trans->trans_cfg->device_family <IWL_DEVICE_FAMILY_9000 )return -EOPNOTSUPP ; +/* +* If the firmware is not running, silently succeed since there is +* no data to clear. +*/ +if (!iwl_mvm_firmware_running (mvm)) +return count; +mutex_lock (&mvm->mutex);iwl_fw_dbg_clear_monitor_buf (&mvm->fwrt);mutex_unlock (&mvm->mutex);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 86/207 wifi: iwlwifi: limit printed string from FW file
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit e0dc2c1bef722cbf16ae557690861e5f91208129 ]
There's no guarantee here that the file is always with a NUL-termination, so reading the string may read beyond the end of the TLV. If that's the last TLV in the file, it can perhaps even read beyond the end of the file buffer.
Fix that by limiting the print format to the size of the buffer we have.
--- drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/iwl-drv.c +1 -1
@@ -1197,7 +1197,7 @@ static int iwl_parse_tlv_firmware(struct iwl_drv *drv,if (tlv_len !=sizeof (*fseq_ver)) goto invalid_tlv_len; -IWL_INFO (drv,"TLV_FW_FSEQ_VERSION: %s\n" , +IWL_INFO (drv,"TLV_FW_FSEQ_VERSION: %.32s\n" , fseq_ver->version); }break ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 87/207 wifi: iwlwifi: Free pages allocated when failing to build A-MSDU
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilan Peer <[email protected]>
[ Upstream commit 3b08e608d50c44ca1135beed179f266aa0461da7 ]
When failing to prepare the data needed for A-MSDU transmission, the memory allocated for the TSO management was not freed. Fix it.
--- drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c +1 -0
@@ -347,6 +347,7 @@ iwl_tfh_tfd *iwl_txq_gen2_build_tx_amsdu(struct iwl_trans *trans,return tfd; out_err: +iwl_pcie_free_tso_pages (trans, skb, out_meta);iwl_txq_gen2_tfd_unmap (trans, out_meta, tfd);return NULL ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 88/207 wifi: iwlwifi: Fix A-MSDU TSO preparation
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilan Peer <[email protected]>
[ Upstream commit 3640dbc1f75ce15d128ea4af44226960d894f3fd ]
The TSO preparation assumed that the skb head contained the headers while the rest of the data was in the fragments. Since this is not always true, e.g., it is possible that the data was linearised, modify the TSO preparation to start the data processing after the network headers.
--- .../wireless/intel/iwlwifi/pcie/internal.h | 5 +++-- .../net/wireless/intel/iwlwifi/pcie/tx-gen2.c | 5 +++-- drivers/net/wireless/intel/iwlwifi/pcie/tx.c | 20 +++++++++++-------- 3 files changed, 18 insertions(+), 12 deletions(-)
drivers/net/wireless/intel/iwlwifi/pcie/internal.h +3 -2
@@ -1,6 +1,6 @@/* SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause */ /* -* Copyright (C) 2003-2015, 2018-2024 Intel Corporation +* Copyright (C) 2003-2015, 2018-2025 Intel Corporation * Copyright (C) 2013-2015 Intel Mobile Communications GmbH * Copyright (C) 2016-2017 Intel Deutschland GmbH */
@@ -643,7 +643,8 @@ dma_addr_t iwl_pcie_get_sgt_tb_phys(struct sg_table *sgt, unsigned int offset, unsigned int len);struct sg_table *iwl_pcie_prep_tso (struct iwl_trans *trans,struct sk_buff *skb,struct iwl_cmd_meta *cmd_meta, -u8 **hdr,unsigned int hdr_room); +u8 **hdr,unsigned int hdr_room, +unsigned int offset);void iwl_pcie_free_tso_pages (struct iwl_trans *trans,struct sk_buff *skb,struct iwl_cmd_meta *cmd_meta);
drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c +3 -2
@@ -1,7 +1,7 @@// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause /* * Copyright (C) 2017 Intel Deutschland GmbH -* Copyright (C) 2018-2020, 2023-2024 Intel Corporation +* Copyright (C) 2018-2020, 2023-2025 Intel Corporation */ #include <net/tso.h> #include <linux/tcp.h>
@@ -188,7 +188,8 @@ static int iwl_txq_gen2_build_amsdu(struct iwl_trans *trans, (3 + snap_ip_tcp_hdrlen +sizeof (struct ethhdr ));/* Our device supports 9 segments at most, it will fit in 1 page */ - sgt =iwl_pcie_prep_tso (trans, skb, out_meta, &start_hdr, hdr_room); + sgt =iwl_pcie_prep_tso (trans, skb, out_meta, &start_hdr, hdr_room, + snap_ip_tcp_hdrlen + hdr_len);if (!sgt)return -ENOMEM ;
drivers/net/wireless/intel/iwlwifi/pcie/tx.c +12 -8
@@ -1,6 +1,6 @@// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause /* -* Copyright (C) 2003-2014, 2018-2021, 2023-2024 Intel Corporation +* Copyright (C) 2003-2014, 2018-2021, 2023-2025 Intel Corporation * Copyright (C) 2013-2015 Intel Mobile Communications GmbH * Copyright (C) 2016-2017 Intel Deutschland GmbH */
@@ -1853,6 +1853,7 @@ dma_addr_t iwl_pcie_get_sgt_tb_phys(struct sg_table *sgt, unsigned int offset,* @cmd_meta: command meta to store the scatter list information for unmapping * @hdr: output argument for TSO headers * @hdr_room: requested length for TSO headers +* @offset: offset into the data from which mapping should start * * Allocate space for a scatter gather list and TSO headers and map the SKB * using the scatter gather list. The SKB is unmapped again when the page is
@@ -1862,18 +1863,20 @@ dma_addr_t iwl_pcie_get_sgt_tb_phys(struct sg_table *sgt, unsigned int offset,*/ struct sg_table *iwl_pcie_prep_tso (struct iwl_trans *trans,struct sk_buff *skb,struct iwl_cmd_meta *cmd_meta, -u8 **hdr,unsigned int hdr_room) +u8 **hdr,unsigned int hdr_room, +unsigned int offset) {struct sg_table *sgt; +unsigned int n_segments;if (WARN_ON_ONCE (skb_has_frag_list (skb)))return NULL ; + n_segments =DIV_ROUND_UP (skb->len - offset,skb_shinfo (skb)->gso_size); *hdr =iwl_pcie_get_page_hdr (trans, hdr_room + __alignof__(struct sg_table ) +sizeof (struct sg_table ) + - (skb_shinfo (skb)->nr_frags +1 ) * -sizeof (struct scatterlist ), + n_segments *sizeof (struct scatterlist ), skb);if (!*hdr)return NULL ;
@@ -1881,11 +1884,11 @@ struct sg_table *iwl_pcie_prep_tso(struct iwl_trans *trans, struct sk_buff *skb, sgt = (void *)PTR_ALIGN (*hdr + hdr_room, __alignof__(struct sg_table )); sgt->sgl = (void *)(sgt +1 ); -sg_init_table (sgt->sgl,skb_shinfo (skb)->nr_frags +1 ); +sg_init_table (sgt->sgl, n_segments);/* Only map the data, not the header (it is copied to the TSO page) */ - sgt->orig_nents =skb_to_sgvec (skb, sgt->sgl,skb_headlen (skb), - skb->data_len); + sgt->orig_nents =skb_to_sgvec (skb, sgt->sgl, offset, + skb->len - offset);if (WARN_ON_ONCE (sgt->orig_nents <=0 ))return NULL ;
@@ -1937,7 +1940,8 @@ static int iwl_fill_data_tbs_amsdu(struct iwl_trans *trans, struct sk_buff *skb, (3 + snap_ip_tcp_hdrlen +sizeof (struct ethhdr )) + iv_len;/* Our device supports 9 segments at most, it will fit in 1 page */ - sgt =iwl_pcie_prep_tso (trans, skb, out_meta, &start_hdr, hdr_room); + sgt =iwl_pcie_prep_tso (trans, skb, out_meta, &start_hdr, hdr_room, + snap_ip_tcp_hdrlen + hdr_len + iv_len);if (!sgt)return -ENOMEM ;
Signature · 1 line
2.39.5
Re: [PATCH 6.13 088/207] wifi: iwlwifi: Fix A-MSDU TSO preparation
Hi,
if you pick this patch, then please also pick "wifi: iwlwifi: pcie: Fix TSO preparation" which was submitted recently. Otherwise there is a regression in the n_segments calculation that can lead to packet loss.
Benjamin
Quoted 141 lines · Greg Kroah-Hartman
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilan Peer <[email protected]>
[ Upstream commit
3640dbc1f75ce15d128ea4af44226960d894f3fd]The TSO preparation assumed that the skb head contained the headers while the rest of the data was in the fragments. Since this is not always true, e.g., it is possible that the data was linearised, modify the TSO preparation to start the data processing after the network headers.
Fixes 7f5e3038f029 ("wifi: iwlwifi: map entire SKB when sending AMSDUs")Signed-off-by Ilan Peer <[email protected]>Reviewed-by Benjamin Berg <[email protected]>Signed-off-by Miri Korenblit <[email protected]>Link https://patch.msgid.link/20250209143303.75769a4769bf.Iaf79e8538093cdf8c446c292cc96164ad6498f61@changeid open hereSigned-off-by Johannes Berg <[email protected]>Signed-off-by Sasha Levin <[email protected]>---
.../wireless/intel/iwlwifi/pcie/internal.h | 5 +++--.../net/wireless/intel/iwlwifi/pcie/tx-gen2.c| 5 +++-- drivers/net/wireless/intel/iwlwifi/pcie/tx.c | 20 +++++++++++--------3 files changed, 18 insertions(+), 12 deletions(-)drivers/net/wireless/intel/iwlwifi/pcie/internal.h +3
-2@@ -1,6 +1,6 @@ /* SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause */ /* -* Copyright (C) 2003-2015, 2018-2024 Intel Corporation +* Copyright (C) 2003-2015, 2018-2025 Intel Corporation * Copyright (C) 2013-2015 Intel Mobile Communications GmbH * Copyright (C) 2016-2017 Intel Deutschland GmbH */ @@ -643,7 +643,8 @@ dma_addr_t iwl_pcie_get_sgt_tb_phys(struct sg_table *sgt, unsigned int offset, unsigned int len); struct sg_table *iwl_pcie_prep_tso(struct iwl_trans *trans, struct sk_buff *skb, struct iwl_cmd_meta *cmd_meta, - u8 **hdr, unsigned int hdr_room); + u8 **hdr, unsigned int hdr_room, + unsigned int offset);
voidiwl_pcie_free_tso_pages(struct iwl_trans *trans, struct sk_buff *skb, struct iwl_cmd_meta *cmd_meta);drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c +1
-1@@ -1,7 +1,7 @@ // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause /* * Copyright (C) 2017 Intel Deutschland GmbH - * Copyright (C) 2018-2020, 2023-2024 Intel Corporation + * Copyright (C) 2018-2020, 2023-2025 Intel Corporation */ #include <net/tso.h> #include <linux/tcp.h>@@ -188,7 +188,8 @@ static int iwl_txq_gen2_build_amsdu(struct iwl_trans *trans, (3 + snap_ip_tcp_hdrlen + sizeof(struct ethhdr));
/* Our device supports 9 segments at most, it will fit in 1 page */drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c +2
-1- sgt =iwl_pcie_prep_tso (trans, skb, out_meta, &start_hdr, hdr_room); + sgt =iwl_pcie_prep_tso (trans, skb, out_meta, &start_hdr, hdr_room, + snap_ip_tcp_hdrlen + hdr_len);if (!sgt)
return-ENOMEM;drivers/net/wireless/intel/iwlwifi/pcie/tx.c +5
-2@@ -1,6 +1,6 @@ // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause /* -* Copyright (C) 2003-2014, 2018-2021, 2023-2024 Intel Corporation +* Copyright (C) 2003-2014, 2018-2021, 2023-2025 Intel Corporation * Copyright (C) 2013-2015 Intel Mobile Communications GmbH * Copyright (C) 2016-2017 Intel Deutschland GmbH */ @@ -1853,6 +1853,7 @@ dma_addr_t iwl_pcie_get_sgt_tb_phys(struct sg_table *sgt, unsigned int offset, * @cmd_meta: command meta to store the scatter list information for unmapping * @hdr: output argument for TSO headers * @hdr_room: requested length for TSO headers + * @offset: offset into the data from which mapping should start * * Allocate space for a scatter gather list and TSO headers and map the SKB * using the scatter gather list. The SKB is unmapped again when the page is@@ -1862,18 +1863,20 @@ dma_addr_t iwl_pcie_get_sgt_tb_phys(struct sg_table *sgt, unsigned int offset,*/ struct sg_table *iwl_pcie_prep_tso(struct iwl_trans *trans, struct sk_buff *skb, struct iwl_cmd_meta *cmd_meta, - u8 **hdr, unsigned int hdr_room) + u8 **hdr, unsigned int hdr_room, + unsigned int offset) { struct sg_table *sgt; +unsigned int n_segments;
if (WARN_ON_ONCE(skb_has_frag_list(skb)))
return NULL;drivers/net/wireless/intel/iwlwifi/pcie/tx.c +1
-0+ n_segments =DIV_ROUND_UP (skb->len - offset,skb_shinfo (skb)->gso_size);*hdr = iwl_pcie_get_page_hdr(trans,
hdr_room+__alignof__(struct sg_table)+sizeof(struct sg_table)+drivers/net/wireless/intel/iwlwifi/pcie/tx.c +1
-2- (skb_shinfo(skb)->nr_frags + 1) * - sizeof(struct scatterlist), + n_segments * sizeof(struct scatterlist),skb);
if (!*hdr)
return NULL;drivers/net/wireless/intel/iwlwifi/pcie/tx.c +0
-0@@ -1881,11 +1884,11 @@ struct sg_table *iwl_pcie_prep_tso(struct iwl_trans *trans, struct sk_buff *skb, sgt = (void *)PTR_ALIGN(*hdr + hdr_room, __alignof__(struct sg_table)); sgt->sgl = (void *)(sgt + 1);drivers/net/wireless/intel/iwlwifi/pcie/tx.c +1
-1-sg_init_table (sgt->sgl,skb_shinfo (skb)->nr_frags +1 ); +sg_init_table (sgt->sgl, n_segments);
/* Only map the data, not the header (it is copied to the TSO page) */drivers/net/wireless/intel/iwlwifi/pcie/tx.c +2
-2- sgt->orig_nents =skb_to_sgvec (skb, sgt->sgl,skb_headlen (skb), - skb->data_len); + sgt->orig_nents =skb_to_sgvec (skb, sgt->sgl, offset, + skb->len - offset);if (
WARN_ON_ONCE(sgt->orig_nents <= 0))
return NULL;drivers/net/wireless/intel/iwlwifi/pcie/tx.c +0
-0@@ -1937,7 +1940,8 @@ static int iwl_fill_data_tbs_amsdu(struct iwl_trans *trans, struct sk_buff *skb, (3 + snap_ip_tcp_hdrlen + sizeof(struct ethhdr)) + iv_len;
/* Our device supports 9 segments at most, it will fit in 1 page */drivers/net/wireless/intel/iwlwifi/pcie/tx.c +2
-1- sgt =iwl_pcie_prep_tso (trans, skb, out_meta, &start_hdr, hdr_room); + sgt =iwl_pcie_prep_tso (trans, skb, out_meta, &start_hdr, hdr_room, + snap_ip_tcp_hdrlen + hdr_len + iv_len);if (!sgt)
return-ENOMEM;
Greg Kroah-Hartman
maintainerRe: [PATCH 6.13 088/207] wifi: iwlwifi: Fix A-MSDU TSO preparation
Quoted 8 lines · Benjamin Berg
Hi,
if you pick this patch, then please also pick "wifi: iwlwifi: pcie: Fix TSO preparation" which was submitted recently. Otherwise there is a regression in the
n_segmentscalculation that can lead to packet loss.
I don't see that commit in Linus's tree yet. I'll go grab it from linux-next, thanks.
greg k-h
Greg Kroah-Hartman
maintainerPATCH 89/207 HID: google: fix unused variable warning under !CONFIG_ACPI
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu-Chun Lin <[email protected]>
[ Upstream commit 4bd0725c09f377ffaf22b834241f6c050742e4fc ]
As reported by the kernel test robot, the following warning occurs:
Quoted 1 line
Quoted 1 line
drivers/hid/hid-google-hammer.c:261:36: warning: 'cbas_ec_acpi_ids' defined but not used [-Wunused-const-variable=]
261 | static const struct acpi_device_id cbas_ec_acpi_ids[] = {
| ^~~~~~~~~~~~~~~~The 'cbas_ec_acpi_ids' array is only used when CONFIG_ACPI is enabled. Wrapping its definition and 'MODULE_DEVICE_TABLE' in '#ifdef CONFIG_ACPI' prevents a compiler warning when ACPI is disabled.
--- drivers/hid/hid-google-hammer.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/hid/hid-google-hammer.c +2 -0
@@ -268,11 +268,13 @@ static void cbas_ec_remove(struct platform_device *pdev)mutex_unlock (&cbas_ec_reglock); } +#ifdef CONFIG_ACPI static const struct acpi_device_id cbas_ec_acpi_ids[] = { {"GOOG000B" ,0 }, { } };MODULE_DEVICE_TABLE (acpi, cbas_ec_acpi_ids); +#endif #ifdef CONFIG_OF static const struct of_device_id cbas_ec_of_match[] = {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 90/207 HID: intel-ish-hid: Fix use-after-free issue in hid_ishtp_cl_remove()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Lixu <[email protected]>
[ Upstream commit 823987841424289339fdb4ba90e6d2c3792836db ]
During the rmmod operation for the intel_ishtp_hid driver, a use-after-free issue can occur in the hid_ishtp_cl_remove() function. The function hid_ishtp_cl_deinit() is called before ishtp_hid_remove(), which can lead to accessing freed memory or resources during the removal process.
Call Trace: ? ishtp_cl_send+0x168/0x220 [intel_ishtp] ? hid_output_report+0xe3/0x150 [hid] hid_ishtp_set_feature+0xb5/0x120 [intel_ishtp_hid] ishtp_hid_request+0x7b/0xb0 [intel_ishtp_hid] hid_hw_request+0x1f/0x40 [hid] sensor_hub_set_feature+0x11f/0x190 [hid_sensor_hub] _hid_sensor_power_state+0x147/0x1e0 [hid_sensor_trigger] hid_sensor_runtime_resume+0x22/0x30 [hid_sensor_trigger] sensor_hub_remove+0xa8/0xe0 [hid_sensor_hub] hid_device_remove+0x49/0xb0 [hid] hid_destroy_device+0x6f/0x90 [hid] ishtp_hid_remove+0x42/0x70 [intel_ishtp_hid] hid_ishtp_cl_remove+0x6b/0xb0 [intel_ishtp_hid] ishtp_cl_device_remove+0x4a/0x60 [intel_ishtp] ...
Additionally, ishtp_hid_remove() is a HID level power off, which should occur before the ISHTP level disconnect.
This patch resolves the issue by reordering the calls in hid_ishtp_cl_remove(). The function ishtp_hid_remove() is now called before hid_ishtp_cl_deinit().
--- drivers/hid/intel-ish-hid/ishtp-hid-client.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hid/intel-ish-hid/ishtp-hid-client.c +1 -1
@@ -832,9 +832,9 @@ static void hid_ishtp_cl_remove(struct ishtp_cl_device *cl_device) hid_ishtp_cl);dev_dbg (ishtp_device (cl_device),"%s\n" , __func__); -hid_ishtp_cl_deinit (hid_ishtp_cl);ishtp_put_device (cl_device);ishtp_hid_remove (client_data); +hid_ishtp_cl_deinit (hid_ishtp_cl); hid_ishtp_cl =NULL ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 91/207 HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Lixu <[email protected]>
[ Upstream commit 07583a0010696a17fb0942e0b499a62785c5fc9f ]
The system can experience a random crash a few minutes after the driver is removed. This issue occurs due to improper handling of memory freeing in the ishtp_hid_remove() function.
The function currently frees the driver_data directly within the loop that destroys the HID devices, which can lead to accessing freed memory. Specifically, hid_destroy_device() uses driver_data when it calls hid_ishtp_set_feature() to power off the sensor, so freeing driver_data beforehand can result in accessing invalid memory.
This patch resolves the issue by storing the driver_data in a temporary variable before calling hid_destroy_device(), and then freeing the driver_data after the device is destroyed.
--- drivers/hid/intel-ish-hid/ishtp-hid.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/hid/intel-ish-hid/ishtp-hid.c +3 -1
@@ -261,12 +261,14 @@ int ishtp_hid_probe(unsigned int cur_hid_dev,*/ void ishtp_hid_remove (struct ishtp_cl_data *client_data) { +void *data;int i;for (i =0 ; i < client_data->num_hid_devices; ++i) {if (client_data->hid_sensor_hubs[i]) { -kfree (client_data->hid_sensor_hubs[i]->driver_data); + data = client_data->hid_sensor_hubs[i]->driver_data;hid_destroy_device (client_data->hid_sensor_hubs[i]); +kfree (data); client_data->hid_sensor_hubs[i] =NULL ; } }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 92/207 coredump: Only sort VMAs when core_sort_vma sysctl is set
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit 39ec9eaaa165d297d008d1fa385748430bd18e4d ]
The sorting of VMAs by size in commit 7d442a33bfe8 ("binfmt_elf: Dump smaller VMAs first in ELF cores") breaks elfutils[1]. Instead, sort based on the setting of the new sysctl, core_sort_vma, which defaults to 0, no sorting.
--- Documentation/admin-guide/sysctl/kernel.rst | 11 +++++++++++ fs/coredump.c | 15 +++++++++++++-- 2 files changed, 24 insertions(+), 2 deletions(-)
Documentation/admin-guide/sysctl/kernel.rst +11 -0
@@ -212,6 +212,17 @@ pid>/``). This value defaults to 0. +core_sort_vma +============= + +The default coredump writes VMAs in address order. By setting +``core_sort_vma`` to 1, VMAs will be written from smallest size +to largest size. This is known to break at least elfutils, but +can be handy when dealing with very large (and truncated) +coredumps where the more useful debugging details are included +in the smaller VMAs. + + core_uses_pid =============
fs/coredump.c +13 -2
@@ -63,6 +63,7 @@ static void free_vma_snapshot(struct coredump_params *cprm);static int core_uses_pid;static unsigned int core_pipe_limit; +static unsigned int core_sort_vma;static char core_pattern[CORENAME_MAX_SIZE ] ="core" ;static int core_name_size =CORENAME_MAX_SIZE ;unsigned int core_file_note_size_limit =CORE_FILE_NOTE_SIZE_DEFAULT ;
@@ -1026,6 +1027,15 @@ static struct ctl_table coredump_sysctls[] = { .extra1 = (unsigned int *)&core_file_note_size_min, .extra2 = (unsigned int *)&core_file_note_size_max, }, + { + .procname = "core_sort_vma", + .data = &core_sort_vma, + .maxlen = sizeof(int), + .mode = 0644, + .proc_handler = proc_douintvec_minmax, + .extra1 = SYSCTL_ZERO, + .extra2 = SYSCTL_ONE, + }, };static int __init init_fs_coredump_sysctls (void )
@@ -1256,8 +1266,9 @@ static bool dump_vma_snapshot(struct coredump_params *cprm) cprm->vma_data_size += m->dump_size; } -sort (cprm->vma_meta, cprm->vma_count,sizeof (*cprm->vma_meta), - cmp_vma_size,NULL ); +if (core_sort_vma) +sort (cprm->vma_meta, cprm->vma_count,sizeof (*cprm->vma_meta), + cmp_vma_size,NULL );return true; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 93/207 nvme-ioctl: fix leaked requests on mapping error
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keith Busch <[email protected]>
[ Upstream commit 00817f0f1c45b007965f5676b9a2013bb39c7228 ]
All the callers assume nvme_map_user_request() frees the request on a failure. This wasn't happening on invalid metadata or io_uring command flags, so we've been leaking those requests.
--- drivers/nvme/host/ioctl.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/nvme/host/ioctl.c +8 -4
@@ -128,8 +128,10 @@ static int nvme_map_user_request(struct request *req, u64 ubuffer,if (!nvme_ctrl_sgl_supported (ctrl))dev_warn_once (ctrl->device,"using unchecked data buffer\n" );if (has_metadata) { -if (!supports_metadata) -return -EINVAL ; +if (!supports_metadata) { + ret = -EINVAL ; + goto out; + }if (!nvme_ctrl_meta_sgl_supported (ctrl))dev_warn_once (ctrl->device,"using unchecked metadata buffer\n" );
@@ -139,8 +141,10 @@ static int nvme_map_user_request(struct request *req, u64 ubuffer,struct iov_iter iter;/* fixedbufs is only for non-vectored io */ -if (WARN_ON_ONCE (flags &NVME_IOCTL_VEC )) -return -EINVAL ; +if (WARN_ON_ONCE (flags &NVME_IOCTL_VEC )) { + ret = -EINVAL ; + goto out; + } ret =io_uring_cmd_import_fixed (ubuffer, bufflen,rq_data_dir (req), &iter, ioucmd);if (ret <0 )
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 94/207 wifi: mac80211: Support parsing EPCS ML element
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilan Peer <[email protected]>
[ Upstream commit 24711d60f8492a30622e419cee643d59264ea939 ]
Add support for parsing an ML element of type EPCS priority access, which can optionally be included in EHT protected action frames used to configure EPCS.
Stable-dep-of: 99ca2c28e6b6 ("wifi: mac80211: fix MLE non-inheritance parsing")
--- net/mac80211/ieee80211_i.h | 2 ++ net/mac80211/parse.c | 29 +++++++++++++++++++++++++++++ 2 files changed, 31 insertions(+)
net/mac80211/ieee80211_i.h +2 -0
@@ -1749,6 +1749,7 @@ struct ieee802_11_elems {const struct ieee80211_eht_operation *eht_operation;const struct ieee80211_multi_link_elem *ml_basic;const struct ieee80211_multi_link_elem *ml_reconf; +const struct ieee80211_multi_link_elem *ml_epcs;const struct ieee80211_bandwidth_indication *bandwidth_indication;const struct ieee80211_ttlm_elem *ttlm[IEEE80211_TTLM_MAX_CNT ];
@@ -1779,6 +1780,7 @@ struct ieee802_11_elems {/* mult-link element can be de-fragmented and thus u8 is not sufficient */ size_t ml_basic_len;size_t ml_reconf_len; +size_t ml_epcs_len;u8 ttlm_num;
net/mac80211/parse.c +29 -0
@@ -44,6 +44,9 @@ struct ieee80211_elems_parse {/* The reconfiguration Multi-Link element in the original elements */ const struct element *ml_reconf_elem; +/* The EPCS Multi-Link element in the original elements */ +const struct element *ml_epcs_elem; +/* * scratch buffer that can be used for various element parsing related * tasks, e.g., element de-fragmentation etc.
@@ -159,6 +162,9 @@ ieee80211_parse_extension_element(u32 *crc,case IEEE80211_ML_CONTROL_TYPE_RECONF : elems_parse->ml_reconf_elem = elem;break ; +case IEEE80211_ML_CONTROL_TYPE_PRIO_ACCESS : + elems_parse->ml_epcs_elem = elem; +break ;default :break ; }
@@ -943,6 +949,27 @@ ieee80211_mle_defrag_reconf(struct ieee80211_elems_parse *elems_parse) elems_parse->scratch_pos += ml_len; } +static void +ieee80211_mle_defrag_epcs (struct ieee80211_elems_parse *elems_parse) +{ +struct ieee802_11_elems *elems = &elems_parse->elems; +ssize_t ml_len; + + ml_len =cfg80211_defragment_element (elems_parse->ml_epcs_elem, + elems->ie_start, + elems->total_len, + elems_parse->scratch_pos, + elems_parse->scratch + + elems_parse->scratch_len - + elems_parse->scratch_pos, +WLAN_EID_FRAGMENT ); +if (ml_len <0 ) +return ; + elems->ml_epcs = (void *)elems_parse->scratch_pos; + elems->ml_epcs_len = ml_len; + elems_parse->scratch_pos += ml_len; +} +struct ieee802_11_elems *ieee802_11_parse_elems_full (struct ieee80211_elems_parse_params *params) {
@@ -1001,6 +1028,8 @@ ieee802_11_parse_elems_full(struct ieee80211_elems_parse_params *params)ieee80211_mle_defrag_reconf (elems_parse); +ieee80211_mle_defrag_epcs (elems_parse); +if (elems->tim && !elems->parse_error) {const struct ieee80211_tim_ie *tim_ie = elems->tim;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 95/207 wifi: mac80211: fix MLE non-inheritance parsing
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 99ca2c28e6b68084a0fb65585df09b9e28c3ec16 ]
The code is erroneously applying the non-inheritance element to the inner elements rather than the outer, which is clearly completely wrong. Fix it by finding the MLE basic element at the beginning, and then applying the non-inheritance for the outer parsing.
While at it, do some general cleanups such as not allowing callers to try looking for a specific non-transmitted BSS and link at the same time.
--- net/mac80211/mlme.c | 1 + net/mac80211/parse.c | 127 ++++++++++++++++++++++++++++--------------- 2 files changed, 83 insertions(+), 45 deletions(-)
net/mac80211/mlme.c +1 -0
@@ -4825,6 +4825,7 @@ static bool ieee80211_assoc_config_link(struct ieee80211_link_data *link, parse_params.start = bss_ies->data; parse_params.len = bss_ies->len; parse_params.bss = cbss; + parse_params.link_id =-1 ; bss_elems =ieee802_11_parse_elems_full (&parse_params);if (!bss_elems) { ret = false;
net/mac80211/parse.c +82 -45
209 lines not on this page · raw message
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 96/207 wifi: mac80211: fix vendor-specific inheritance
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 130067e9c13bdc4820748ef16076a6972364745f ]
If there's any vendor-specific element in the subelements then the outer element parsing must not parse any vendor element at all. This isn't implemented correctly now due to parsing into the pointers and then overriding them, so explicitly skip vendor elements if any exist in the sub- elements (non-transmitted profile or per-STA profile).
--- net/mac80211/parse.c | 8 ++++++++ 1 file changed, 8 insertions(+)
net/mac80211/parse.c +8 -0
@@ -48,6 +48,7 @@ struct ieee80211_elems_parse {const struct element *ml_epcs_elem;bool multi_link_inner; +bool skip_vendor;/* * scratch buffer that can be used for various element parsing related
@@ -400,6 +401,9 @@ _ieee802_11_parse_elems_full(struct ieee80211_elems_parse_params *params,IEEE80211_PARSE_ERR_BAD_ELEM_SIZE ;break ;case WLAN_EID_VENDOR_SPECIFIC : +if (elems_parse->skip_vendor) +break ; +if (elen >=4 && pos[0 ] ==0x00 && pos[1 ] ==0x50 && pos[2 ] ==0xf2 ) {/* Microsoft OUI (00:50:F2) */
@@ -1054,12 +1058,16 @@ ieee802_11_parse_elems_full(struct ieee80211_elems_parse_params *params) multi_link_inner = true; } + elems_parse->skip_vendor = +cfg80211_find_elem (WLAN_EID_VENDOR_SPECIFIC , + sub.start, sub.len); elems->crc =_ieee802_11_parse_elems_full (params, elems_parse, non_inherit);/* Override with nontransmitted/per-STA profile if found */ if (sub.len) { elems_parse->multi_link_inner = multi_link_inner; + elems_parse->skip_vendor = false;_ieee802_11_parse_elems_full (&sub, elems_parse,NULL ); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 97/207 fgraph: Replace fgraph_ret_regs with ftrace_regs
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu (Google) <[email protected]>
[ Upstream commit a3ed4157b7d89800a0008de0c9e46a438a5c3745 ]
Use ftrace_regs instead of fgraph_ret_regs for tracing return value on function_graph tracer because of simplifying the callback interface.
The CONFIG_HAVE_FUNCTION_GRAPH_RETVAL is also replaced by CONFIG_HAVE_FUNCTION_GRAPH_FREGS.
Stable-dep-of: db5e228611b1 ("tracing: fprobe-events: Log error for exceeding the number of entry args")
--- arch/arm64/Kconfig | 1 + arch/arm64/include/asm/ftrace.h | 23 ++++++--------------- arch/arm64/kernel/asm-offsets.c | 12 ----------- arch/arm64/kernel/entry-ftrace.S | 32 ++++++++++++++++------------- arch/loongarch/Kconfig | 2 +- arch/loongarch/include/asm/ftrace.h | 26 ++++------------------- arch/loongarch/kernel/asm-offsets.c | 12 ----------- arch/loongarch/kernel/mcount.S | 17 ++++++++------- arch/loongarch/kernel/mcount_dyn.S | 14 ++++++------- arch/riscv/Kconfig | 2 +- arch/riscv/include/asm/ftrace.h | 26 +++++------------------ arch/riscv/kernel/mcount.S | 24 ++++++++++++---------- arch/s390/Kconfig | 2 +- arch/s390/include/asm/ftrace.h | 24 +++++++--------------- arch/s390/kernel/asm-offsets.c | 6 ------ arch/s390/kernel/mcount.S | 12 +++++------ arch/x86/Kconfig | 2 +- arch/x86/include/asm/ftrace.h | 20 ------------------ arch/x86/kernel/ftrace_32.S | 13 ++++++------ arch/x86/kernel/ftrace_64.S | 17 +++++++-------- include/linux/ftrace.h | 12 ++++++++--- include/linux/ftrace_regs.h | 2 ++ kernel/trace/Kconfig | 4 ++-- kernel/trace/fgraph.c | 21 ++++++++----------- 24 files changed, 119 insertions(+), 207 deletions(-)
arch/arm64/Kconfig +1 -0
@@ -219,6 +219,7 @@ config ARM64 select HAVE_FTRACE_MCOUNT_RECORD select HAVE_FUNCTION_TRACER select HAVE_FUNCTION_ERROR_INJECTION + select HAVE_FUNCTION_GRAPH_FREGS select HAVE_FUNCTION_GRAPH_TRACER select HAVE_FUNCTION_GRAPH_RETVAL select HAVE_GCC_PLUGINS
arch/arm64/include/asm/ftrace.h +6 -17
@@ -129,6 +129,12 @@ ftrace_override_function_with_return(struct ftrace_regs *fregs)arch_ftrace_regs (fregs)->pc =arch_ftrace_regs (fregs)->lr; } +static __always_inline unsigned long +ftrace_regs_get_frame_pointer (const struct ftrace_regs *fregs) +{ +return arch_ftrace_regs (fregs)->fp; +} +int ftrace_regs_query_register_offset (const char *name);int ftrace_init_nop (struct module *mod,struct dyn_ftrace *rec);
@@ -186,23 +192,6 @@ static inline bool arch_syscall_match_sym_name(const char *sym,#ifndef __ASSEMBLY__#ifdef CONFIG_FUNCTION_GRAPH_TRACER -struct fgraph_ret_regs { -/* x0 - x7 */ -unsigned long regs[8 ]; - -unsigned long fp; -unsigned long __unused; -}; - -static inline unsigned long fgraph_ret_regs_return_value (struct fgraph_ret_regs *ret_regs) -{ -return ret_regs->regs[0 ]; -} - -static inline unsigned long fgraph_ret_regs_frame_pointer (struct fgraph_ret_regs *ret_regs) -{ -return ret_regs->fp; -}void prepare_ftrace_return (unsigned long self_addr,unsigned long *parent,unsigned long frame_pointer);
arch/arm64/kernel/asm-offsets.c +0 -12
@@ -179,18 +179,6 @@ int main(void)DEFINE (FTRACE_OPS_FUNC , offsetof(struct ftrace_ops , func));#endif BLANK (); -#ifdef CONFIG_FUNCTION_GRAPH_TRACER - DEFINE(FGRET_REGS_X0, offsetof(struct fgraph_ret_regs, regs[0])); - DEFINE(FGRET_REGS_X1, offsetof(struct fgraph_ret_regs, regs[1])); - DEFINE(FGRET_REGS_X2, offsetof(struct fgraph_ret_regs, regs[2])); - DEFINE(FGRET_REGS_X3, offsetof(struct fgraph_ret_regs, regs[3])); - DEFINE(FGRET_REGS_X4, offsetof(struct fgraph_ret_regs, regs[4])); - DEFINE(FGRET_REGS_X5, offsetof(struct fgraph_ret_regs, regs[5])); - DEFINE(FGRET_REGS_X6, offsetof(struct fgraph_ret_regs, regs[6])); - DEFINE(FGRET_REGS_X7, offsetof(struct fgraph_ret_regs, regs[7])); -DEFINE (FGRET_REGS_FP , offsetof(struct fgraph_ret_regs , fp)); -DEFINE (FGRET_REGS_SIZE ,sizeof (struct fgraph_ret_regs )); -#endif #ifdef CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS DEFINE (FTRACE_OPS_DIRECT_CALL , offsetof(struct ftrace_ops , direct_call));#endif
arch/arm64/kernel/entry-ftrace.S +18 -14
@@ -329,24 +329,28 @@ SYM_FUNC_END(ftrace_stub_graph) * @fp is checked against the value passed by ftrace_graph_caller(). */ SYM_CODE_START(return_to_handler) - /* save return value regs */ - sub sp, sp, #FGRET_REGS_SIZE - stp x0, x1, [sp, #FGRET_REGS_X0] - stp x2, x3, [sp, #FGRET_REGS_X2] - stp x4, x5, [sp, #FGRET_REGS_X4] - stp x6, x7, [sp, #FGRET_REGS_X6] - str x29, [sp, #FGRET_REGS_FP] // parent's fp + /* Make room for ftrace_regs */ + sub sp, sp, #FREGS_SIZE + + /* Save return value regs */ + stp x0, x1, [sp, #FREGS_X0] + stp x2, x3, [sp, #FREGS_X2] + stp x4, x5, [sp, #FREGS_X4] + stp x6, x7, [sp, #FREGS_X6] + + /* Save the callsite's FP */ + str x29, [sp, #FREGS_FP] mov x0, sp - bl ftrace_return_to_handler // addr = ftrace_return_to_hander(regs); + bl ftrace_return_to_handler // addr = ftrace_return_to_hander(fregs); mov x30, x0 // restore the original return address - /* restore return value regs */ - ldp x0, x1, [sp, #FGRET_REGS_X0] - ldp x2, x3, [sp, #FGRET_REGS_X2] - ldp x4, x5, [sp, #FGRET_REGS_X4] - ldp x6, x7, [sp, #FGRET_REGS_X6] - add sp, sp, #FGRET_REGS_SIZE + /* Restore return value regs */ + ldp x0, x1, [sp, #FREGS_X0] + ldp x2, x3, [sp, #FREGS_X2] + ldp x4, x5, [sp, #FREGS_X4] + ldp x6, x7, [sp, #FREGS_X6] + add sp, sp, #FREGS_SIZE ret SYM_CODE_END(return_to_handler)
arch/loongarch/Kconfig +1 -1
@@ -137,7 +137,7 @@ config LOONGARCH select HAVE_FTRACE_MCOUNT_RECORD select HAVE_FUNCTION_ARG_ACCESS_API select HAVE_FUNCTION_ERROR_INJECTION - select HAVE_FUNCTION_GRAPH_RETVAL if HAVE_FUNCTION_GRAPH_TRACER + select HAVE_FUNCTION_GRAPH_FREGS select HAVE_FUNCTION_GRAPH_TRACER select HAVE_FUNCTION_TRACER select HAVE_GCC_PLUGINS
arch/loongarch/include/asm/ftrace.h +4 -22
@@ -57,6 +57,10 @@ ftrace_regs_set_instruction_pointer(struct ftrace_regs *fregs, unsigned long ip)instruction_pointer_set (&arch_ftrace_regs (fregs)->regs, ip); } +#undef ftrace_regs_get_frame_pointer +#define ftrace_regs_get_frame_pointer (fregs) \ + (arch_ftrace_regs(fregs)->regs.regs[22]) +#define ftrace_graph_func ftrace_graph_funcvoid ftrace_graph_func (unsigned long ip,unsigned long parent_ip,struct ftrace_ops *op,struct ftrace_regs *fregs);
@@ -78,26 +82,4 @@ __arch_ftrace_set_direct_caller(struct pt_regs *regs, unsigned long addr)#endif /* CONFIG_FUNCTION_TRACER */ -#ifndef __ASSEMBLY__ -#ifdef CONFIG_FUNCTION_GRAPH_TRACER -struct fgraph_ret_regs { -/* a0 - a1 */ -unsigned long regs[2 ]; - -unsigned long fp; -unsigned long __unused; -}; - -static inline unsigned long fgraph_ret_regs_return_value (struct fgraph_ret_regs *ret_regs) -{ -return ret_regs->regs[0 ]; -} - -static inline unsigned long fgraph_ret_regs_frame_pointer (struct fgraph_ret_regs *ret_regs) -{ -return ret_regs->fp; -} -#endif /* ifdef CONFIG_FUNCTION_GRAPH_TRACER */ -#endif -#endif /* _ASM_LOONGARCH_FTRACE_H */
arch/loongarch/kernel/asm-offsets.c +0 -12
@@ -280,18 +280,6 @@ static void __used output_pbe_defines(void) }#endif -#ifdef CONFIG_FUNCTION_GRAPH_TRACER -static void __used output_fgraph_ret_regs_defines (void ) -{ -COMMENT ("LoongArch fgraph_ret_regs offsets." ); -OFFSET (FGRET_REGS_A0 , fgraph_ret_regs, regs[0 ]); -OFFSET (FGRET_REGS_A1 , fgraph_ret_regs, regs[1 ]); -OFFSET (FGRET_REGS_FP , fgraph_ret_regs, fp); -DEFINE (FGRET_REGS_SIZE ,sizeof (struct fgraph_ret_regs )); -BLANK (); -} -#endif -static void __used output_kvm_defines (void ) {COMMENT ("KVM/LoongArch Specific offsets." );
arch/loongarch/kernel/mcount.S +10 -7
@@ -79,10 +79,11 @@ SYM_FUNC_START(ftrace_graph_caller) SYM_FUNC_END(ftrace_graph_caller) SYM_FUNC_START(return_to_handler) - PTR_ADDI sp, sp, -FGRET_REGS_SIZE - PTR_S a0, sp, FGRET_REGS_A0 - PTR_S a1, sp, FGRET_REGS_A1 - PTR_S zero, sp, FGRET_REGS_FP + /* Save return value regs */ + PTR_ADDI sp, sp, -PT_SIZE + PTR_S a0, sp, PT_R4 + PTR_S a1, sp, PT_R5 + PTR_S zero, sp, PT_R22 move a0, sp bl ftrace_return_to_handler
@@ -90,9 +91,11 @@ SYM_FUNC_START(return_to_handler) /* Restore the real parent address: a0 -> ra */ move ra, a0 - PTR_L a0, sp, FGRET_REGS_A0 - PTR_L a1, sp, FGRET_REGS_A1 - PTR_ADDI sp, sp, FGRET_REGS_SIZE + /* Restore return value regs */ + PTR_L a0, sp, PT_R4 + PTR_L a1, sp, PT_R5 + PTR_ADDI sp, sp, PT_SIZE + jr ra SYM_FUNC_END(return_to_handler) #endif /* CONFIG_FUNCTION_GRAPH_TRACER */
arch/loongarch/kernel/mcount_dyn.S +7 -7
@@ -140,19 +140,19 @@ SYM_CODE_END(ftrace_graph_caller) SYM_CODE_START(return_to_handler) UNWIND_HINT_UNDEFINED /* Save return value regs */ - PTR_ADDI sp, sp, -FGRET_REGS_SIZE - PTR_S a0, sp, FGRET_REGS_A0 - PTR_S a1, sp, FGRET_REGS_A1 - PTR_S zero, sp, FGRET_REGS_FP + PTR_ADDI sp, sp, -PT_SIZE + PTR_S a0, sp, PT_R4 + PTR_S a1, sp, PT_R5 + PTR_S zero, sp, PT_R22 move a0, sp bl ftrace_return_to_handler move ra, a0 /* Restore return value regs */ - PTR_L a0, sp, FGRET_REGS_A0 - PTR_L a1, sp, FGRET_REGS_A1 - PTR_ADDI sp, sp, FGRET_REGS_SIZE + PTR_L a0, sp, PT_R4 + PTR_L a1, sp, PT_R5 + PTR_ADDI sp, sp, PT_SIZE jr ra SYM_CODE_END(return_to_handler)
arch/riscv/Kconfig +1 -1
@@ -148,7 +148,7 @@ config RISCV select HAVE_DYNAMIC_FTRACE_WITH_ARGS if HAVE_DYNAMIC_FTRACE select HAVE_FTRACE_MCOUNT_RECORD if !XIP_KERNEL select HAVE_FUNCTION_GRAPH_TRACER - select HAVE_FUNCTION_GRAPH_RETVAL if HAVE_FUNCTION_GRAPH_TRACER + select HAVE_FUNCTION_GRAPH_FREGS select HAVE_FUNCTION_TRACER if !XIP_KERNEL && !PREEMPTION select HAVE_EBPF_JIT if MMU select HAVE_GUP_FAST if MMU
arch/riscv/include/asm/ftrace.h +5 -21
@@ -168,6 +168,11 @@ static __always_inline unsigned long ftrace_regs_get_stack_pointer(const structreturn arch_ftrace_regs (fregs)->sp; } +static __always_inline unsigned long ftrace_regs_get_frame_pointer (const struct ftrace_regs *fregs) +{ +return arch_ftrace_regs (fregs)->s0; +} +static __always_inline unsigned long ftrace_regs_get_argument (struct ftrace_regs *fregs,unsigned int n) {
@@ -208,25 +213,4 @@ static inline void arch_ftrace_set_direct_caller(struct ftrace_regs *fregs, unsi#endif /* CONFIG_DYNAMIC_FTRACE */ -#ifndef __ASSEMBLY__ -#ifdef CONFIG_FUNCTION_GRAPH_TRACER -struct fgraph_ret_regs { -unsigned long a1; -unsigned long a0; -unsigned long s0; -unsigned long ra; -}; - -static inline unsigned long fgraph_ret_regs_return_value (struct fgraph_ret_regs *ret_regs) -{ -return ret_regs->a0; -} - -static inline unsigned long fgraph_ret_regs_frame_pointer (struct fgraph_ret_regs *ret_regs) -{ -return ret_regs->s0; -} -#endif /* ifdef CONFIG_FUNCTION_GRAPH_TRACER */ -#endif -#endif /* _ASM_RISCV_FTRACE_H */
arch/riscv/kernel/mcount.S +13 -11
@@ -12,6 +12,8 @@ #include <asm/asm-offsets.h> #include <asm/ftrace.h> +#define ABI_SIZE_ON_STACK 80 + .text .macro SAVE_ABI_STATE
@@ -26,12 +28,12 @@ * register if a0 was not saved. */ .macro SAVE_RET_ABI_STATE - addi sp, sp, -4*SZREG - REG_S s0, 2*SZREG(sp) - REG_S ra, 3*SZREG(sp) - REG_S a0, 1*SZREG(sp) - REG_S a1, 0*SZREG(sp) - addi s0, sp, 4*SZREG + addi sp, sp, -ABI_SIZE_ON_STACK + REG_S ra, 1*SZREG(sp) + REG_S s0, 8*SZREG(sp) + REG_S a0, 10*SZREG(sp) + REG_S a1, 11*SZREG(sp) + addi s0, sp, ABI_SIZE_ON_STACK .endm .macro RESTORE_ABI_STATE
@@ -41,11 +43,11 @@ .endm .macro RESTORE_RET_ABI_STATE - REG_L ra, 3*SZREG(sp) - REG_L s0, 2*SZREG(sp) - REG_L a0, 1*SZREG(sp) - REG_L a1, 0*SZREG(sp) - addi sp, sp, 4*SZREG + REG_L ra, 1*SZREG(sp) + REG_L s0, 8*SZREG(sp) + REG_L a0, 10*SZREG(sp) + REG_L a1, 11*SZREG(sp) + addi sp, sp, ABI_SIZE_ON_STACK .endm SYM_TYPED_FUNC_START(ftrace_stub)
arch/s390/Kconfig +1 -1
@@ -193,7 +193,7 @@ config S390 select HAVE_FTRACE_MCOUNT_RECORD select HAVE_FUNCTION_ARG_ACCESS_API select HAVE_FUNCTION_ERROR_INJECTION - select HAVE_FUNCTION_GRAPH_RETVAL + select HAVE_FUNCTION_GRAPH_FREGS select HAVE_FUNCTION_GRAPH_TRACER select HAVE_FUNCTION_TRACER select HAVE_GCC_PLUGINS
arch/s390/include/asm/ftrace.h +7 -17
@@ -62,23 +62,6 @@ static __always_inline struct pt_regs *arch_ftrace_get_regs(struct ftrace_regs *return NULL ; } -#ifdef CONFIG_FUNCTION_GRAPH_TRACER -struct fgraph_ret_regs { -unsigned long gpr2; -unsigned long fp; -}; - -static __always_inline unsigned long fgraph_ret_regs_return_value (struct fgraph_ret_regs *ret_regs) -{ -return ret_regs->gpr2; -} - -static __always_inline unsigned long fgraph_ret_regs_frame_pointer (struct fgraph_ret_regs *ret_regs) -{ -return ret_regs->fp; -} -#endif /* CONFIG_FUNCTION_GRAPH_TRACER */ - static __always_inline voidftrace_regs_set_instruction_pointer (struct ftrace_regs *fregs,unsigned long ip)
@@ -86,6 +69,13 @@ ftrace_regs_set_instruction_pointer(struct ftrace_regs *fregs,arch_ftrace_regs (fregs)->regs.psw.addr = ip; } +#undef ftrace_regs_get_frame_pointer +static __always_inline unsigned long +ftrace_regs_get_frame_pointer (struct ftrace_regs *fregs) +{ +return ftrace_regs_get_stack_pointer (fregs); +} +#ifdef CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS /* * When an ftrace registered caller is tracing a function that is
arch/s390/kernel/asm-offsets.c +0 -6
@@ -175,12 +175,6 @@ int main(void)DEFINE (OLDMEM_SIZE ,PARMAREA + offsetof(struct parmarea , oldmem_size));DEFINE (COMMAND_LINE ,PARMAREA + offsetof(struct parmarea , command_line));DEFINE (MAX_COMMAND_LINE_SIZE ,PARMAREA + offsetof(struct parmarea , max_command_line_size)); -#ifdef CONFIG_FUNCTION_GRAPH_TRACER -/* function graph return value tracing */ -OFFSET (__FGRAPH_RET_GPR2, fgraph_ret_regs, gpr2); -OFFSET (__FGRAPH_RET_FP, fgraph_ret_regs, fp); -DEFINE (__FGRAPH_RET_SIZE,sizeof (struct fgraph_ret_regs )); -#endif OFFSET (__FTRACE_REGS_PT_REGS, __arch_ftrace_regs, regs);DEFINE (__FTRACE_REGS_SIZE,sizeof (struct __arch_ftrace_regs ));
arch/s390/kernel/mcount.S +6 -6
@@ -134,14 +134,14 @@ SYM_CODE_END(ftrace_common) SYM_FUNC_START(return_to_handler) stmg %r2,%r5,32(%r15) lgr %r1,%r15 - aghi %r15,-(STACK_FRAME_OVERHEAD+__FGRAPH_RET_SIZE) + # allocate ftrace_regs and stack frame for ftrace_return_to_handler + aghi %r15,-STACK_FRAME_SIZE_FREGS stg %r1,__SF_BACKCHAIN(%r15) - la %r3,STACK_FRAME_OVERHEAD(%r15) - stg %r1,__FGRAPH_RET_FP(%r3) - stg %r2,__FGRAPH_RET_GPR2(%r3) - lgr %r2,%r3 + stg %r2,(STACK_FREGS_PTREGS_GPRS+2*8)(%r15) + stg %r1,(STACK_FREGS_PTREGS_GPRS+15*8)(%r15) + la %r2,STACK_FRAME_OVERHEAD(%r15) brasl %r14,ftrace_return_to_handler - aghi %r15,STACK_FRAME_OVERHEAD+__FGRAPH_RET_SIZE + aghi %r15,STACK_FRAME_SIZE_FREGS lgr %r14,%r2 lmg %r2,%r5,32(%r15) BR_EX %r14
arch/x86/Kconfig +1 -1
@@ -234,7 +234,7 @@ config X86 select HAVE_GUP_FAST select HAVE_FENTRY if X86_64 || DYNAMIC_FTRACE select HAVE_FTRACE_MCOUNT_RECORD - select HAVE_FUNCTION_GRAPH_RETVAL if HAVE_FUNCTION_GRAPH_TRACER + select HAVE_FUNCTION_GRAPH_FREGS if HAVE_FUNCTION_GRAPH_TRACER select HAVE_FUNCTION_GRAPH_TRACER if X86_32 || (X86_64 && DYNAMIC_FTRACE) select HAVE_FUNCTION_TRACER select HAVE_GCC_PLUGINS
arch/x86/include/asm/ftrace.h +0 -20
@@ -134,24 +134,4 @@ static inline bool arch_trace_is_compat_syscall(struct pt_regs *regs)#endif /* !COMPILE_OFFSETS */ #endif /* !__ASSEMBLY__ */ -#ifndef __ASSEMBLY__ -#ifdef CONFIG_FUNCTION_GRAPH_TRACER -struct fgraph_ret_regs { -unsigned long ax; -unsigned long dx; -unsigned long bp; -}; - -static inline unsigned long fgraph_ret_regs_return_value (struct fgraph_ret_regs *ret_regs) -{ -return ret_regs->ax; -} - -static inline unsigned long fgraph_ret_regs_frame_pointer (struct fgraph_ret_regs *ret_regs) -{ -return ret_regs->bp; -} -#endif /* ifdef CONFIG_FUNCTION_GRAPH_TRACER */ -#endif -#endif /* _ASM_X86_FTRACE_H */
arch/x86/kernel/ftrace_32.S +7 -6
@@ -187,14 +187,15 @@ SYM_CODE_END(ftrace_graph_caller) .globl return_to_handler return_to_handler: - pushl $0 - pushl %edx - pushl %eax + subl $(PTREGS_SIZE), %esp + movl $0, PT_EBP(%esp) + movl %edx, PT_EDX(%esp) + movl %eax, PT_EAX(%esp) movl %esp, %eax call ftrace_return_to_handler movl %eax, %ecx - popl %eax - popl %edx - addl $4, %esp # skip ebp + movl PT_EAX(%esp), %eax + movl PT_EDX(%esp), %edx + addl $(PTREGS_SIZE), %esp JMP_NOSPEC ecx #endif
arch/x86/kernel/ftrace_64.S +9 -8
@@ -348,21 +348,22 @@ STACK_FRAME_NON_STANDARD_FP(__fentry__) SYM_CODE_START(return_to_handler) UNWIND_HINT_UNDEFINED ANNOTATE_NOENDBR - subq $24, %rsp - /* Save the return values */ - movq %rax, (%rsp) - movq %rdx, 8(%rsp) - movq %rbp, 16(%rsp) + /* Save ftrace_regs for function exit context */ + subq $(FRAME_SIZE), %rsp + + movq %rax, RAX(%rsp) + movq %rdx, RDX(%rsp) + movq %rbp, RBP(%rsp) movq %rsp, %rdi call ftrace_return_to_handler movq %rax, %rdi - movq 8(%rsp), %rdx - movq (%rsp), %rax + movq RDX(%rsp), %rdx + movq RAX(%rsp), %rax - addq $24, %rsp + addq $(FRAME_SIZE), %rsp /* * Jump back to the old return address. This cannot be JMP_NOSPEC rdi * since IBT would demand that contain ENDBR, which simply isn't so for
include/linux/ftrace.h +9 -3
@@ -43,9 +43,8 @@ struct dyn_ftrace;char *arch_ftrace_match_adjust (char *str,const char *search); -#ifdef CONFIG_HAVE_FUNCTION_GRAPH_RETVAL -struct fgraph_ret_regs ; -unsigned long ftrace_return_to_handler (struct fgraph_ret_regs *ret_regs); +#ifdef CONFIG_HAVE_FUNCTION_GRAPH_FREGS +unsigned long ftrace_return_to_handler (struct ftrace_regs *fregs);#else unsigned long ftrace_return_to_handler (unsigned long frame_pointer);#endif
@@ -134,6 +133,13 @@ extern int ftrace_enabled;* Also, architecture dependent fields can be used for internal process. * (e.g. orig_ax on x86_64) * +* Basically, ftrace_regs stores the registers related to the context. +* On function entry, registers for function parameters and hooking the +* function call are stored, and on function exit, registers for function +* return value and frame pointers are stored. +* +* And also, it dpends on the context that which registers are restored +* from the ftrace_regs. * On the function entry, those registers will be restored except for * the stack pointer, so that user can change the function parameters * and instruction pointer (e.g. live patching.)
include/linux/ftrace_regs.h +2 -0
@@ -30,6 +30,8 @@ struct ftrace_regs; override_function_with_return(&arch_ftrace_regs(fregs)->regs)#define ftrace_regs_query_register_offset (name) \ regs_query_register_offset(name) +#define ftrace_regs_get_frame_pointer (fregs) \ + frame_pointer(&arch_ftrace_regs(fregs)->regs)#endif /* HAVE_ARCH_FTRACE_REGS */
kernel/trace/Kconfig +2 -2
@@ -31,7 +31,7 @@ config HAVE_FUNCTION_GRAPH_TRACER help See Documentation/trace/ftrace-design.rst -config HAVE_FUNCTION_GRAPH_RETVAL +config HAVE_FUNCTION_GRAPH_FREGS bool config HAVE_DYNAMIC_FTRACE
@@ -232,7 +232,7 @@ config FUNCTION_GRAPH_TRACER config FUNCTION_GRAPH_RETVAL bool "Kernel Function Graph Return Value" - depends on HAVE_FUNCTION_GRAPH_RETVAL + depends on HAVE_FUNCTION_GRAPH_FREGS depends on FUNCTION_GRAPH_TRACER default n help
kernel/trace/fgraph.c +9 -12
@@ -792,15 +792,12 @@ static struct notifier_block ftrace_suspend_notifier = { .notifier_call = ftrace_suspend_notifier_call, }; -/* fgraph_ret_regs is not defined without CONFIG_FUNCTION_GRAPH_RETVAL */ -struct fgraph_ret_regs ; -/* * Send the trace to the ring-buffer. * @return the original return address. */ -static unsigned long __ftrace_return_to_handler (struct fgraph_ret_regs *ret_regs, -unsigned long frame_pointer) +static inline unsigned long +__ftrace_return_to_handler (struct ftrace_regs *fregs,unsigned long frame_pointer) {struct ftrace_ret_stack *ret_stack;struct ftrace_graph_ret trace;
@@ -820,7 +817,7 @@ static unsigned long __ftrace_return_to_handler(struct fgraph_ret_regs *ret_regs trace.rettime =trace_clock_local ();#ifdef CONFIG_FUNCTION_GRAPH_RETVAL - trace.retval =fgraph_ret_regs_return_value (ret_regs); + trace.retval =ftrace_regs_get_return_value (fregs);#endif bitmap =get_bitmap_bits (current, offset);
@@ -855,14 +852,14 @@ static unsigned long __ftrace_return_to_handler(struct fgraph_ret_regs *ret_regs }/* -* After all architecures have selected HAVE_FUNCTION_GRAPH_RETVAL, we can -* leave only ftrace_return_to_handler(ret_regs). +* After all architecures have selected HAVE_FUNCTION_GRAPH_FREGS, we can +* leave only ftrace_return_to_handler(fregs). */ -#ifdef CONFIG_HAVE_FUNCTION_GRAPH_RETVAL -unsigned long ftrace_return_to_handler (struct fgraph_ret_regs *ret_regs) +#ifdef CONFIG_HAVE_FUNCTION_GRAPH_FREGS +unsigned long ftrace_return_to_handler (struct ftrace_regs *fregs) { -return __ftrace_return_to_handler (ret_regs, -fgraph_ret_regs_frame_pointer (ret_regs)); +return __ftrace_return_to_handler (fregs, +ftrace_regs_get_frame_pointer (fregs)); }#else unsigned long ftrace_return_to_handler (unsigned long frame_pointer)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 98/207 fprobe: Use ftrace_regs in fprobe entry handler
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu (Google) <[email protected]>
[ Upstream commit 46bc082388560a95e3649b698a4675e5ea3262e6 ]
This allows fprobes to be available with CONFIG_DYNAMIC_FTRACE_WITH_ARGS instead of CONFIG_DYNAMIC_FTRACE_WITH_REGS, then we can enable fprobe on arm64.
Stable-dep-of: db5e228611b1 ("tracing: fprobe-events: Log error for exceeding the number of entry args")
--- include/linux/fprobe.h | 2 +- kernel/trace/Kconfig | 3 ++- kernel/trace/bpf_trace.c | 10 +++++++--- kernel/trace/fprobe.c | 3 ++- kernel/trace/trace_fprobe.c | 11 ++++++++--- lib/test_fprobe.c | 4 ++-- samples/fprobe/fprobe_example.c | 2 +- 7 files changed, 23 insertions(+), 12 deletions(-)
include/linux/fprobe.h +1 -1
@@ -10,7 +10,7 @@struct fprobe ;typedef int (*fprobe_entry_cb )(struct fprobe *fp,unsigned long entry_ip, -unsigned long ret_ip,struct pt_regs *regs, +unsigned long ret_ip,struct ftrace_regs *regs,void *entry_data); typedef void (*fprobe_exit_cb)(struct fprobe *fp, unsigned long entry_ip,
kernel/trace/Kconfig +2 -1
@@ -297,7 +297,7 @@ config DYNAMIC_FTRACE_WITH_ARGS config FPROBE bool "Kernel Function Probe (fprobe)" depends on FUNCTION_TRACER - depends on DYNAMIC_FTRACE_WITH_REGS + depends on DYNAMIC_FTRACE_WITH_REGS || DYNAMIC_FTRACE_WITH_ARGS depends on HAVE_RETHOOK select RETHOOK default n
@@ -682,6 +682,7 @@ config FPROBE_EVENTS select TRACING select PROBE_EVENTS select DYNAMIC_EVENTS + depends on DYNAMIC_FTRACE_WITH_REGS default y help This allows user to add tracing events on the function entry and
kernel/trace/bpf_trace.c +7 -3
@@ -2562,7 +2562,7 @@ struct bpf_session_run_ctx {void *data; }; -#ifdef CONFIG_FPROBE +#if defined(CONFIG_FPROBE) && defined(CONFIG_DYNAMIC_FTRACE_WITH_REGS) struct bpf_kprobe_multi_link { struct bpf_link link; struct fprobe fp;
@@ -2814,12 +2814,16 @@ kprobe_multi_link_prog_run(struct bpf_kprobe_multi_link *link,static int kprobe_multi_link_handler (struct fprobe *fp,unsigned long fentry_ip, -unsigned long ret_ip,struct pt_regs *regs, +unsigned long ret_ip,struct ftrace_regs *fregs,void *data) { +struct pt_regs *regs =ftrace_get_regs (fregs);struct bpf_kprobe_multi_link *link;int err; +if (!regs) +return 0 ; + link = container_of(fp, struct bpf_kprobe_multi_link, fp); err =kprobe_multi_link_prog_run (link,get_entry_ip (fentry_ip), regs, false, data);return is_kprobe_session (link->link.prog) ? err :0 ;
@@ -3094,7 +3098,7 @@ int bpf_kprobe_multi_link_attach(const union bpf_attr *attr, struct bpf_prog *prkvfree (cookies); return err; } -#else /* !CONFIG_FPROBE */ +#else /* !CONFIG_FPROBE || !CONFIG_DYNAMIC_FTRACE_WITH_REGS */ int bpf_kprobe_multi_link_attach (const union bpf_attr *attr,struct bpf_prog *prog) {return -EOPNOTSUPP ;
kernel/trace/fprobe.c +2 -1
@@ -46,7 +46,7 @@ static inline void __fprobe_handler(unsigned long ip, unsigned long parent_ip, }if (fp->entry_handler) - ret = fp->entry_handler (fp, ip, parent_ip,ftrace_get_regs (fregs), entry_data); + ret = fp->entry_handler (fp, ip, parent_ip, fregs, entry_data);/* If entry_handler returns !0, nmissed is not counted. */ if (rh) {
@@ -182,6 +182,7 @@ static void fprobe_init(struct fprobe *fp) fp->ops.func = fprobe_kprobe_handler; else fp->ops.func = fprobe_handler; + fp->ops.flags |=FTRACE_OPS_FL_SAVE_REGS ; }
kernel/trace/trace_fprobe.c +8 -3
@@ -217,12 +217,13 @@ NOKPROBE_SYMBOL(fentry_trace_func);/* function exit handler */ static int trace_fprobe_entry_handler (struct fprobe *fp,unsigned long entry_ip, -unsigned long ret_ip,struct pt_regs *regs, +unsigned long ret_ip,struct ftrace_regs *fregs,void *entry_data) { struct trace_fprobe *tf = container_of(fp, struct trace_fprobe, fp); +struct pt_regs *regs =ftrace_get_regs (fregs); -if (tf->tp.entry_arg) +if (regs && tf->tp.entry_arg)store_trace_entry_data (entry_data, &tf->tp, regs);return 0 ;
@@ -339,12 +340,16 @@ NOKPROBE_SYMBOL(fexit_perf_func);#endif /* CONFIG_PERF_EVENTS */ static int fentry_dispatcher (struct fprobe *fp,unsigned long entry_ip, -unsigned long ret_ip,struct pt_regs *regs, +unsigned long ret_ip,struct ftrace_regs *fregs,void *entry_data) { struct trace_fprobe *tf = container_of(fp, struct trace_fprobe, fp); +struct pt_regs *regs =ftrace_get_regs (fregs);int ret =0 ; +if (!regs) +return 0 ; +if (trace_probe_test_flag (&tf->tp,TP_FLAG_TRACE ))fentry_trace_func (tf, entry_ip, regs);#ifdef CONFIG_PERF_EVENTS
lib/test_fprobe.c +2 -2
@@ -40,7 +40,7 @@ static noinline u32 fprobe_selftest_nest_target(u32 value, u32 (*nest)(u32)) static notrace int fp_entry_handler(struct fprobe *fp, unsigned long ip,unsigned long ret_ip, -struct pt_regs *regs,void *data) +struct ftrace_regs *fregs,void *data) {KUNIT_EXPECT_FALSE (current_test,preemptible ());/* This can be called on the fprobe_selftest_target and the fprobe_selftest_target2 */
@@ -81,7 +81,7 @@ static notrace void fp_exit_handler(struct fprobe *fp, unsigned long ip, static notrace int nest_entry_handler(struct fprobe *fp, unsigned long ip,unsigned long ret_ip, -struct pt_regs *regs,void *data) +struct ftrace_regs *fregs,void *data) {KUNIT_EXPECT_FALSE (current_test,preemptible ());return 0 ;
samples/fprobe/fprobe_example.c +1 -1
@@ -50,7 +50,7 @@ static void show_backtrace(void)static int sample_entry_handler (struct fprobe *fp,unsigned long ip,unsigned long ret_ip, -struct pt_regs *regs,void *data) +struct ftrace_regs *fregs,void *data) {if (use_trace)/*
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 99/207 fprobe: Use ftrace_regs in fprobe exit handler
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu (Google) <[email protected]>
[ Upstream commit 762abbc0d09f7ae123c82d315eb1a961c1a2cf7b ]
Change the fprobe exit handler to use ftrace_regs structure instead of pt_regs. This also introduce HAVE_FTRACE_REGS_HAVING_PT_REGS which means the ftrace_regs is including the pt_regs so that ftrace_regs can provide pt_regs without memory allocation.
Fprobe introduces a new dependency with that.
Stable-dep-of: db5e228611b1 ("tracing: fprobe-events: Log error for exceeding the number of entry args")
--- arch/loongarch/Kconfig | 1 + arch/s390/Kconfig | 1 + arch/x86/Kconfig | 1 + include/linux/fprobe.h | 2 +- include/linux/ftrace.h | 6 ++++++ kernel/trace/Kconfig | 7 +++++++ kernel/trace/bpf_trace.c | 6 +++++- kernel/trace/fprobe.c | 3 ++- kernel/trace/trace_fprobe.c | 6 +++++- lib/test_fprobe.c | 6 +++--- samples/fprobe/fprobe_example.c | 2 +- 11 files changed, 33 insertions(+), 8 deletions(-)
arch/loongarch/Kconfig +1 -0
@@ -128,6 +128,7 @@ config LOONGARCH select HAVE_DMA_CONTIGUOUS select HAVE_DYNAMIC_FTRACE select HAVE_DYNAMIC_FTRACE_WITH_ARGS + select HAVE_FTRACE_REGS_HAVING_PT_REGS select HAVE_DYNAMIC_FTRACE_WITH_DIRECT_CALLS select HAVE_DYNAMIC_FTRACE_WITH_REGS select HAVE_EBPF_JIT
arch/s390/Kconfig +1 -0
@@ -184,6 +184,7 @@ config S390 select HAVE_DMA_CONTIGUOUS select HAVE_DYNAMIC_FTRACE select HAVE_DYNAMIC_FTRACE_WITH_ARGS + select HAVE_FTRACE_REGS_HAVING_PT_REGS select HAVE_DYNAMIC_FTRACE_WITH_DIRECT_CALLS select HAVE_DYNAMIC_FTRACE_WITH_REGS select HAVE_EBPF_JIT if HAVE_MARCH_Z196_FEATURES
arch/x86/Kconfig +1 -0
@@ -224,6 +224,7 @@ config X86 select HAVE_DYNAMIC_FTRACE select HAVE_DYNAMIC_FTRACE_WITH_REGS select HAVE_DYNAMIC_FTRACE_WITH_ARGS if X86_64 + select HAVE_FTRACE_REGS_HAVING_PT_REGS if X86_64 select HAVE_DYNAMIC_FTRACE_WITH_DIRECT_CALLS select HAVE_SAMPLE_FTRACE_DIRECT if X86_64 select HAVE_SAMPLE_FTRACE_DIRECT_MULTI if X86_64
include/linux/fprobe.h +1 -1
@@ -14,7 +14,7 @@ typedef int (*fprobe_entry_cb)(struct fprobe *fp, unsigned long entry_ip, void *entry_data);typedef void (*fprobe_exit_cb )(struct fprobe *fp,unsigned long entry_ip, -unsigned long ret_ip,struct pt_regs *regs, +unsigned long ret_ip,struct ftrace_regs *regs,void *entry_data);/**
include/linux/ftrace.h +6 -0
@@ -176,6 +176,12 @@ static inline struct pt_regs *arch_ftrace_get_regs(struct ftrace_regs *fregs)#define ftrace_regs_set_instruction_pointer (fregs, ip) do { } while (0)#endif /* CONFIG_HAVE_DYNAMIC_FTRACE_WITH_ARGS */ +#ifdef CONFIG_HAVE_FTRACE_REGS_HAVING_PT_REGS + +static_assert (sizeof (struct pt_regs ) ==ftrace_regs_size ()); + +#endif /* CONFIG_HAVE_FTRACE_REGS_HAVING_PT_REGS */ + static __always_inline struct pt_regs *ftrace_get_regs(struct ftrace_regs *fregs) {if (!fregs)
kernel/trace/Kconfig +7 -0
@@ -57,6 +57,12 @@ config HAVE_DYNAMIC_FTRACE_WITH_ARGS This allows for use of ftrace_regs_get_argument() and ftrace_regs_get_stack_pointer(). +config HAVE_FTRACE_REGS_HAVING_PT_REGS + bool + help + If this is set, ftrace_regs has pt_regs, thus it can convert to + pt_regs without allocating memory. + config HAVE_DYNAMIC_FTRACE_NO_PATCHABLE bool help
@@ -298,6 +304,7 @@ config FPROBE bool "Kernel Function Probe (fprobe)" depends on FUNCTION_TRACER depends on DYNAMIC_FTRACE_WITH_REGS || DYNAMIC_FTRACE_WITH_ARGS + depends on HAVE_FTRACE_REGS_HAVING_PT_REGS || !HAVE_DYNAMIC_FTRACE_WITH_ARGS depends on HAVE_RETHOOK select RETHOOK default n
kernel/trace/bpf_trace.c +5 -1
@@ -2831,10 +2831,14 @@ kprobe_multi_link_handler(struct fprobe *fp, unsigned long fentry_ip,static void kprobe_multi_link_exit_handler (struct fprobe *fp,unsigned long fentry_ip, -unsigned long ret_ip,struct pt_regs *regs, +unsigned long ret_ip,struct ftrace_regs *fregs,void *data) {struct bpf_kprobe_multi_link *link; +struct pt_regs *regs =ftrace_get_regs (fregs); + +if (!regs) +return ; link = container_of(fp, struct bpf_kprobe_multi_link, fp);kprobe_multi_link_prog_run (link,get_entry_ip (fentry_ip), regs, true, data);
kernel/trace/fprobe.c +2 -1
@@ -124,6 +124,7 @@ static void fprobe_exit_handler(struct rethook_node *rh, void *data, {struct fprobe *fp = (struct fprobe *)data;struct fprobe_rethook_node *fpr; +struct ftrace_regs *fregs = (struct ftrace_regs *)regs;int bit;if (!fp ||fprobe_disabled (fp))
@@ -141,7 +142,7 @@ static void fprobe_exit_handler(struct rethook_node *rh, void *data,return ; } - fp->exit_handler (fp, fpr->entry_ip, ret_ip, regs, + fp->exit_handler (fp, fpr->entry_ip, ret_ip, fregs, fp->entry_data_size ? (void *)fpr->data :NULL );ftrace_test_recursion_unlock (bit); }
kernel/trace/trace_fprobe.c +5 -1
@@ -361,10 +361,14 @@ static int fentry_dispatcher(struct fprobe *fp, unsigned long entry_ip,NOKPROBE_SYMBOL (fentry_dispatcher);static void fexit_dispatcher (struct fprobe *fp,unsigned long entry_ip, -unsigned long ret_ip,struct pt_regs *regs, +unsigned long ret_ip,struct ftrace_regs *fregs,void *entry_data) { struct trace_fprobe *tf = container_of(fp, struct trace_fprobe, fp); +struct pt_regs *regs =ftrace_get_regs (fregs); + +if (!regs) +return ;if (trace_probe_test_flag (&tf->tp,TP_FLAG_TRACE ))fexit_trace_func (tf, entry_ip, ret_ip, regs, entry_data);
lib/test_fprobe.c +3 -3
@@ -59,9 +59,9 @@ static notrace int fp_entry_handler(struct fprobe *fp, unsigned long ip, static notrace void fp_exit_handler(struct fprobe *fp, unsigned long ip,unsigned long ret_ip, -struct pt_regs *regs,void *data) +struct ftrace_regs *fregs,void *data) { -unsigned long ret =regs_return_value (regs); +unsigned long ret =ftrace_regs_get_return_value (fregs);KUNIT_EXPECT_FALSE (current_test,preemptible ());if (ip != target_ip) {
@@ -89,7 +89,7 @@ static notrace int nest_entry_handler(struct fprobe *fp, unsigned long ip, static notrace void nest_exit_handler(struct fprobe *fp, unsigned long ip,unsigned long ret_ip, -struct pt_regs *regs,void *data) +struct ftrace_regs *fregs,void *data) {KUNIT_EXPECT_FALSE (current_test,preemptible ());KUNIT_EXPECT_EQ (current_test, ip, target_nest_ip);
samples/fprobe/fprobe_example.c +1 -1
@@ -67,7 +67,7 @@ static int sample_entry_handler(struct fprobe *fp, unsigned long ip, }static void sample_exit_handler (struct fprobe *fp,unsigned long ip, -unsigned long ret_ip,struct pt_regs *regs, +unsigned long ret_ip,struct ftrace_regs *regs,void *data) {unsigned long rip = ret_ip;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 100/207 tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu (Google) <[email protected]>
[ Upstream commit b9b55c8912ce1e5555715d126486bdd63ddfeaec ]
Add ftrace_partial_regs() which converts the ftrace_regs to pt_regs. This is for the eBPF which needs this to keep the same pt_regs interface to access registers.
Thus when replacing the pt_regs with ftrace_regs in fprobes (which is used by kprobe_multi eBPF event), this will be used.
If the architecture defines its own ftrace_regs, this copies partial registers to pt_regs and returns it. If not, ftrace_regs is the same as pt_regs and ftrace_partial_regs() will return ftrace_regs::regs.
Stable-dep-of: db5e228611b1 ("tracing: fprobe-events: Log error for exceeding the number of entry args")
--- arch/arm64/include/asm/ftrace.h | 13 +++++++++++++ arch/riscv/include/asm/ftrace.h | 14 ++++++++++++++ include/linux/ftrace.h | 17 +++++++++++++++++ 3 files changed, 44 insertions(+)
arch/arm64/include/asm/ftrace.h +13 -0
@@ -135,6 +135,19 @@ ftrace_regs_get_frame_pointer(const struct ftrace_regs *fregs)return arch_ftrace_regs (fregs)->fp; } +static __always_inline struct pt_regs * +ftrace_partial_regs (const struct ftrace_regs *fregs,struct pt_regs *regs) +{ +struct __arch_ftrace_regs *afregs =arch_ftrace_regs (fregs); + +memcpy (regs->regs, afregs->regs,sizeof (afregs->regs)); + regs->sp = afregs->sp; + regs->pc = afregs->pc; + regs->regs[29 ] = afregs->fp; + regs->regs[30 ] = afregs->lr; +return regs; +} +int ftrace_regs_query_register_offset (const char *name);int ftrace_init_nop (struct module *mod,struct dyn_ftrace *rec);
arch/riscv/include/asm/ftrace.h +14 -0
@@ -197,6 +197,20 @@ static __always_inline void ftrace_override_function_with_return(struct ftrace_rarch_ftrace_regs (fregs)->epc =arch_ftrace_regs (fregs)->ra; } +static __always_inline struct pt_regs * +ftrace_partial_regs (const struct ftrace_regs *fregs,struct pt_regs *regs) +{ +struct __arch_ftrace_regs *afregs =arch_ftrace_regs (fregs); + +memcpy (®s->a0, afregs->args,sizeof (afregs->args)); + regs->epc = afregs->epc; + regs->ra = afregs->ra; + regs->sp = afregs->sp; + regs->s0 = afregs->s0; + regs->t1 = afregs->t1; +return regs; +} +int ftrace_regs_query_register_offset (const char *name); void ftrace_graph_func(unsigned long ip, unsigned long parent_ip,
include/linux/ftrace.h +17 -0
@@ -190,6 +190,23 @@ static __always_inline struct pt_regs *ftrace_get_regs(struct ftrace_regs *fregsreturn arch_ftrace_get_regs (fregs); } +#if !defined(CONFIG_HAVE_DYNAMIC_FTRACE_WITH_ARGS ) || \ + defined(CONFIG_HAVE_FTRACE_REGS_HAVING_PT_REGS ) + +static __always_inline struct pt_regs * +ftrace_partial_regs (struct ftrace_regs *fregs,struct pt_regs *regs) +{ +/* +* If CONFIG_HAVE_FTRACE_REGS_HAVING_PT_REGS=y, ftrace_regs memory +* layout is including pt_regs. So always returns that address. +* Since arch_ftrace_get_regs() will check some members and may return +* NULL, we can not use it. +*/ +return &arch_ftrace_regs (fregs)->regs; +} + +#endif /* !CONFIG_HAVE_DYNAMIC_FTRACE_WITH_ARGS || CONFIG_HAVE_FTRACE_REGS_HAVING_PT_REGS */ +/* * When true, the ftrace_regs_{get,set}_*() functions may be used on fregs. * Note: this can be true even when ftrace_get_regs() cannot provide a pt_regs.
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 101/207 tracing: Add ftrace_fill_perf_regs() for perf event
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu (Google) <[email protected]>
[ Upstream commit d5d01b71996ec03af51b3c0736c92d0fc89703b5 ]
Add ftrace_fill_perf_regs() which should be compatible with the perf_fetch_caller_regs(). In other words, the pt_regs returned from the ftrace_fill_perf_regs() must satisfy 'user_mode(regs) == false' and can be used for stack tracing.
Stable-dep-of: db5e228611b1 ("tracing: fprobe-events: Log error for exceeding the number of entry args")
--- arch/arm64/include/asm/ftrace.h | 7 +++++++ arch/powerpc/include/asm/ftrace.h | 7 +++++++ arch/s390/include/asm/ftrace.h | 6 ++++++ arch/x86/include/asm/ftrace.h | 7 +++++++ include/linux/ftrace.h | 31 +++++++++++++++++++++++++++++++ 5 files changed, 58 insertions(+)
arch/arm64/include/asm/ftrace.h +7 -0
@@ -148,6 +148,13 @@ ftrace_partial_regs(const struct ftrace_regs *fregs, struct pt_regs *regs)return regs; } +#define arch_ftrace_fill_perf_regs (fregs, _regs) do { \ + (_regs)->pc = arch_ftrace_regs(fregs)->pc; \ + (_regs)->regs[29] = arch_ftrace_regs(fregs)->fp; \ + (_regs)->sp = arch_ftrace_regs(fregs)->sp; \ + (_regs)->pstate = PSR_MODE_EL1h; \ + } while (0) +int ftrace_regs_query_register_offset (const char *name);int ftrace_init_nop (struct module *mod,struct dyn_ftrace *rec);
arch/powerpc/include/asm/ftrace.h +7 -0
@@ -43,6 +43,13 @@ static __always_inline struct pt_regs *arch_ftrace_get_regs(struct ftrace_regs *return arch_ftrace_regs (fregs)->regs.msr ? &arch_ftrace_regs (fregs)->regs :NULL ; } +#define arch_ftrace_fill_perf_regs (fregs, _regs) do { \ + (_regs)->result = 0; \ + (_regs)->nip = arch_ftrace_regs(fregs)->regs.nip; \ + (_regs)->gpr[1] = arch_ftrace_regs(fregs)->regs.gpr[1]; \ + asm volatile("mfmsr %0" : "=r" ((_regs)->msr)); \ + } while (0) + static __always_inline voidftrace_regs_set_instruction_pointer (struct ftrace_regs *fregs,unsigned long ip)
arch/s390/include/asm/ftrace.h +6 -0
@@ -76,6 +76,12 @@ ftrace_regs_get_frame_pointer(struct ftrace_regs *fregs)return ftrace_regs_get_stack_pointer (fregs); } +#define arch_ftrace_fill_perf_regs (fregs, _regs) do { \ + (_regs)->psw.mask = 0; \ + (_regs)->psw.addr = arch_ftrace_regs(fregs)->regs.psw.addr; \ + (_regs)->gprs[15] = arch_ftrace_regs(fregs)->regs.gprs[15]; \ + } while (0) +#ifdef CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS /* * When an ftrace registered caller is tracing a function that is
arch/x86/include/asm/ftrace.h +7 -0
@@ -47,6 +47,13 @@ arch_ftrace_get_regs(struct ftrace_regs *fregs)return &arch_ftrace_regs (fregs)->regs; } +#define arch_ftrace_fill_perf_regs (fregs, _regs) do { \ + (_regs)->ip = arch_ftrace_regs(fregs)->regs.ip; \ + (_regs)->sp = arch_ftrace_regs(fregs)->regs.sp; \ + (_regs)->cs = __KERNEL_CS; \ + (_regs)->flags = 0; \ + } while (0) +#define ftrace_regs_set_instruction_pointer (fregs, _ip) \ do { arch_ftrace_regs(fregs)->regs.ip = (_ip); } while (0)
include/linux/ftrace.h +31 -0
@@ -207,6 +207,37 @@ ftrace_partial_regs(struct ftrace_regs *fregs, struct pt_regs *regs)#endif /* !CONFIG_HAVE_DYNAMIC_FTRACE_WITH_ARGS || CONFIG_HAVE_FTRACE_REGS_HAVING_PT_REGS */ +#ifdef CONFIG_HAVE_DYNAMIC_FTRACE_WITH_ARGS + +/* +* Please define arch dependent pt_regs which compatible to the +* perf_arch_fetch_caller_regs() but based on ftrace_regs. +* This requires +* - user_mode(_regs) returns false (always kernel mode). +* - able to use the _regs for stack trace. +*/ +#ifndef arch_ftrace_fill_perf_regs +/* As same as perf_arch_fetch_caller_regs(), do nothing by default */ +#define arch_ftrace_fill_perf_regs (fregs, _regs) do {} while (0) +#endif + +static __always_inline struct pt_regs * +ftrace_fill_perf_regs (struct ftrace_regs *fregs,struct pt_regs *regs) +{ +arch_ftrace_fill_perf_regs (fregs, regs); +return regs; +} + +#else /* !CONFIG_HAVE_DYNAMIC_FTRACE_WITH_ARGS */ + +static __always_inline struct pt_regs * +ftrace_fill_perf_regs (struct ftrace_regs *fregs,struct pt_regs *regs) +{ +return &arch_ftrace_regs (fregs)->regs; +} + +#endif +/* * When true, the ftrace_regs_{get,set}_*() functions may be used on fregs. * Note: this can be true even when ftrace_get_regs() cannot provide a pt_regs.
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 102/207 fprobe: Rewrite fprobe on function-graph tracer
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu (Google) <[email protected]>
[ Upstream commit 4346ba1604093305a287e08eb465a9c15ba05b80 ]
Rewrite fprobe implementation on function-graph tracer. Major API changes are:
- 'nr_maxactive' field is deprecated.
- This depends on CONFIG_DYNAMIC_FTRACE_WITH_ARGS or !CONFIG_HAVE_DYNAMIC_FTRACE_WITH_ARGS, and CONFIG_HAVE_FUNCTION_GRAPH_FREGS. So currently works only on x86_64.
- Currently the entry size is limited in 15 * sizeof(long).
- If there is too many fprobe exit handler set on the same function, it will fail to probe.
Stable-dep-of: db5e228611b1 ("tracing: fprobe-events: Log error for exceeding the number of entry args")
--- arch/arm64/include/asm/ftrace.h | 6 + arch/loongarch/include/asm/ftrace.h | 6 + arch/powerpc/include/asm/ftrace.h | 6 + arch/riscv/include/asm/ftrace.h | 5 + arch/s390/include/asm/ftrace.h | 6 + arch/x86/include/asm/ftrace.h | 6 + include/linux/fprobe.h | 58 ++- kernel/trace/Kconfig | 8 +- kernel/trace/fprobe.c | 637 ++++++++++++++++++++-------- lib/test_fprobe.c | 45 -- 10 files changed, 538 insertions(+), 245 deletions(-)
arch/arm64/include/asm/ftrace.h +6 -0
@@ -135,6 +135,12 @@ ftrace_regs_get_frame_pointer(const struct ftrace_regs *fregs)return arch_ftrace_regs (fregs)->fp; } +static __always_inline unsigned long +ftrace_regs_get_return_address (const struct ftrace_regs *fregs) +{ +return arch_ftrace_regs (fregs)->lr; +} + static __always_inline struct pt_regs *ftrace_partial_regs (const struct ftrace_regs *fregs,struct pt_regs *regs) {
arch/loongarch/include/asm/ftrace.h +6 -0
@@ -61,6 +61,12 @@ ftrace_regs_set_instruction_pointer(struct ftrace_regs *fregs, unsigned long ip)#define ftrace_regs_get_frame_pointer (fregs) \ (arch_ftrace_regs(fregs)->regs.regs[22]) +static __always_inline unsigned long +ftrace_regs_get_return_address (struct ftrace_regs *fregs) +{ +return *(unsigned long *)(arch_ftrace_regs (fregs)->regs.regs[1 ]); +} +#define ftrace_graph_func ftrace_graph_funcvoid ftrace_graph_func (unsigned long ip,unsigned long parent_ip,struct ftrace_ops *op,struct ftrace_regs *fregs);
arch/powerpc/include/asm/ftrace.h +6 -0
@@ -57,6 +57,12 @@ ftrace_regs_set_instruction_pointer(struct ftrace_regs *fregs,regs_set_return_ip (&arch_ftrace_regs (fregs)->regs, ip); } +static __always_inline unsigned long +ftrace_regs_get_return_address (struct ftrace_regs *fregs) +{ +return arch_ftrace_regs (fregs)->regs.link; +} +struct ftrace_ops ;#define ftrace_graph_func ftrace_graph_func
arch/riscv/include/asm/ftrace.h +5 -0
@@ -186,6 +186,11 @@ static __always_inline unsigned long ftrace_regs_get_return_value(const struct freturn arch_ftrace_regs (fregs)->a0; } +static __always_inline unsigned long ftrace_regs_get_return_address (const struct ftrace_regs *fregs) +{ +return arch_ftrace_regs (fregs)->ra; +} + static __always_inline void ftrace_regs_set_return_value(struct ftrace_regs *fregs,unsigned long ret) {
arch/s390/include/asm/ftrace.h +6 -0
@@ -76,6 +76,12 @@ ftrace_regs_get_frame_pointer(struct ftrace_regs *fregs)return ftrace_regs_get_stack_pointer (fregs); } +static __always_inline unsigned long +ftrace_regs_get_return_address (const struct ftrace_regs *fregs) +{ +return arch_ftrace_regs (fregs)->regs.gprs[14 ]; +} +#define arch_ftrace_fill_perf_regs (fregs, _regs) do { \ (_regs)->psw.mask = 0; \ (_regs)->psw.addr = arch_ftrace_regs(fregs)->regs.psw.addr; \
arch/x86/include/asm/ftrace.h +6 -0
@@ -58,6 +58,12 @@ arch_ftrace_get_regs(struct ftrace_regs *fregs) do { arch_ftrace_regs(fregs)->regs.ip = (_ip); } while (0) +static __always_inline unsigned long +ftrace_regs_get_return_address (struct ftrace_regs *fregs) +{ +return *(unsigned long *)ftrace_regs_get_stack_pointer (fregs); +} +struct ftrace_ops ;#define ftrace_graph_func ftrace_graph_func void ftrace_graph_func(unsigned long ip, unsigned long parent_ip,
include/linux/fprobe.h +43 -15
92 lines not on this page · raw message
kernel/trace/Kconfig +3 -5
@@ -302,11 +302,9 @@ config DYNAMIC_FTRACE_WITH_ARGS config FPROBE bool "Kernel Function Probe (fprobe)" - depends on FUNCTION_TRACER - depends on DYNAMIC_FTRACE_WITH_REGS || DYNAMIC_FTRACE_WITH_ARGS - depends on HAVE_FTRACE_REGS_HAVING_PT_REGS || !HAVE_DYNAMIC_FTRACE_WITH_ARGS - depends on HAVE_RETHOOK - select RETHOOK + depends on HAVE_FUNCTION_GRAPH_FREGS && HAVE_FTRACE_GRAPH_FUNC + depends on DYNAMIC_FTRACE_WITH_ARGS + select FUNCTION_GRAPH_TRACER default n help This option enables kernel function probe (fprobe) based on ftrace.
kernel/trace/fprobe.c +457 -180
767 lines not on this page · raw message
lib/test_fprobe.c +0 -45
85 lines not on this page · raw message
Signature · 1 line
2.39.5
Re: [PATCH 6.13 102/207] fprobe: Rewrite fprobe on function-graph tracer
Quoted 7 lines · Greg Kroah-Hartman
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu (Google) <[email protected]>
[ Upstream commit
4346ba1604093305a287e08eb465a9c15ba05b80]
...
kernel/trace/Kconfig config DYNAMIC_FTRACE_WITH_ARGS · line 305
Quoted 12 lines
kernel/trace/Kconfig +1
-5@@ -302,11 +302,9 @@ config DYNAMIC_FTRACE_WITH_ARGS config FPROBE bool "Kernel Function Probe (fprobe)" - depends on FUNCTION_TRACER - depends on DYNAMIC_FTRACE_WITH_REGS || DYNAMIC_FTRACE_WITH_ARGS - depends on HAVE_FTRACE_REGS_HAVING_PT_REGS || !HAVE_DYNAMIC_FTRACE_WITH_ARGS - depends on HAVE_RETHOOK - select RETHOOK + depends on HAVE_FUNCTION_GRAPH_FREGS && HAVE_FTRACE_GRAPH_FUNC
HAVE_FTRACE_GRAPH_FUNC does not exist on 6.13, so FPROBE is effectively disabled by this backport.
Is this missing (and only this?):
commit a762e9267dca843ced943ec24f20e110ba7c8431
Author: Masami Hiramatsu (Google) <[email protected]> Date: Thu Dec 26 14:13:34 2024 +0900
ftrace: Add CONFIG_HAVE_FTRACE_GRAPH_FUNC
thanks,
Signature · 2 lines
js suse labs
Re: [PATCH 6.13 102/207] fprobe: Rewrite fprobe on function-graph tracer
Quoted 24 lines · Jiri Slaby
Quoted 7 lines · Greg Kroah-Hartman
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu (Google) <[email protected]>
[ Upstream commit
4346ba1604093305a287e08eb465a9c15ba05b80]...
Quoted 4 lines
kernel/trace/Kconfig +0
-0@@ -302,11 +302,9 @@ config DYNAMIC_FTRACE_WITH_ARGSconfig FPROBE
Quoted 8 lines
bool "Kernel Function Probe (fprobe)"
- depends onFUNCTION_TRACER
- depends onDYNAMIC_FTRACE_WITH_REGS||DYNAMIC_FTRACE_WITH_ARGS- depends onHAVE_FTRACE_REGS_HAVING_PT_REGS|| !HAVE_DYNAMIC_FTRACE_WITH_ARGS
- depends onHAVE_RETHOOK
- select RETHOOK
+ depends onHAVE_FUNCTION_GRAPH_FREGS&&HAVE_FTRACE_GRAPH_FUNC
HAVE_FTRACE_GRAPH_FUNCdoes not exist on 6.13, so FPROBE is effectively disabled by this backport.
Quoted 6 lines
Is this missing (and only this?):
commita762e9267dca843ced943ec24f20e110ba7c8431
Author: Masami Hiramatsu (Google) <[email protected]> Date: Thu Dec 26 14:13:34 2024 +0900ftrace: Add
CONFIG_HAVE_FTRACE_GRAPH_FUNC
With this applied, x86_64 is fixed. But ppc and s390 still loose it.
On the top of that, arm64 can indeed have FPROBEs now (the aim of the patches).
Quoted 1 line
thanks,
Signature · 2 lines
js suse labs
Re: [PATCH 6.13 102/207] fprobe: Rewrite fprobe on function-graph tracer
Quoted 25 lines · Jiri Slaby
Quoted 24 lines · Jiri Slaby
Quoted 7 lines · Greg Kroah-Hartman
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu (Google) <[email protected]>
[ Upstream commit
4346ba1604093305a287e08eb465a9c15ba05b80]...
Quoted 4 lines
kernel/trace/Kconfig +0
-0@@ -302,11 +302,9 @@ config DYNAMIC_FTRACE_WITH_ARGSconfig FPROBE
Quoted 8 lines
bool "Kernel Function Probe (fprobe)"
- depends onFUNCTION_TRACER
- depends onDYNAMIC_FTRACE_WITH_REGS||DYNAMIC_FTRACE_WITH_ARGS- depends onHAVE_FTRACE_REGS_HAVING_PT_REGS|| !HAVE_DYNAMIC_FTRACE_WITH_ARGS
- depends onHAVE_RETHOOK
- select RETHOOK
+ depends onHAVE_FUNCTION_GRAPH_FREGS&&HAVE_FTRACE_GRAPH_FUNC
HAVE_FTRACE_GRAPH_FUNCdoes not exist on 6.13, so FPROBE is effectively disabled by this backport.
Quoted 8 lines
Quoted 6 lines
Is this missing (and only this?):
commita762e9267dca843ced943ec24f20e110ba7c8431
Author: Masami Hiramatsu (Google) <[email protected]> Date: Thu Dec 26 14:13:34 2024 +0900ftrace: Add
CONFIG_HAVE_FTRACE_GRAPH_FUNCWith this applied,
x86_64is fixed. But ppc and s390 still loose it.
HAVE_FTRACE_GRAPH_FUNC is missing in ppc completely in upstream too (a bug?).
s390 has it only through (here omitted):
commit 7495e179b478801433cec3cc4a82d2dcea35bf06
Author: Sven Schnelle <[email protected]> Date: Thu Dec 26 14:13:48 2024 +0900
s390/tracing: Enable HAVE_FTRACE_GRAPH_FUNC
Quoted 3 lines
On the top of that, arm64 can indeed have FPROBEs now (the aim of the patches).
Quoted 1 line
thanks,
Signature · 2 lines
js suse labs
Greg Kroah-Hartman
maintainerRe: [PATCH 6.13 102/207] fprobe: Rewrite fprobe on function-graph tracer
Quoted 41 lines · Jiri Slaby
Quoted 27 lines · Jiri Slaby
Quoted 26 lines · Jiri Slaby
Quoted 8 lines · Greg Kroah-Hartman
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu (Google) <[email protected]>
[ Upstream commit
4346ba1604093305a287e08eb465a9c15ba05b80]...
Quoted 4 lines
kernel/trace/Kconfig +0
-0@@ -302,11 +302,9 @@ config DYNAMIC_FTRACE_WITH_ARGSconfig FPROBE
Quoted 8 lines
bool "Kernel Function Probe (fprobe)"
- depends onFUNCTION_TRACER
- depends onDYNAMIC_FTRACE_WITH_REGS||DYNAMIC_FTRACE_WITH_ARGS- depends onHAVE_FTRACE_REGS_HAVING_PT_REGS|| !HAVE_DYNAMIC_FTRACE_WITH_ARGS
- depends onHAVE_RETHOOK
- select RETHOOK
+ depends onHAVE_FUNCTION_GRAPH_FREGS&&HAVE_FTRACE_GRAPH_FUNC
HAVE_FTRACE_GRAPH_FUNCdoes not exist on 6.13, so FPROBE is effectively disabled by this backport.Quoted 8 lines
Quoted 6 lines
Is this missing (and only this?):
commita762e9267dca843ced943ec24f20e110ba7c8431
Author: Masami Hiramatsu (Google) <[email protected]> Date: Thu Dec 26 14:13:34 2024 +0900ftrace: Add
CONFIG_HAVE_FTRACE_GRAPH_FUNCWith this applied,
x86_64is fixed. But ppc and s390 still loose it.
HAVE_FTRACE_GRAPH_FUNCis missing in ppc completely in upstream too (a bug?).
Quoted 6 lines
s390 has it only through (here omitted):
commit7495e179b478801433cec3cc4a82d2dcea35bf06Author: Sven Schnelle <[email protected]> Date: Thu Dec 26 14:13:48 2024 +0900s390/tracing: Enable
HAVE_FTRACE_GRAPH_FUNC
Yeah, this isn't right. I've dropped all of these from the queue now, thanks for the review!
greg k-h
Re: [PATCH 6.13 102/207] fprobe: Rewrite fprobe on function-graph tracer
Quoted 47 lines · On Tue, 11 Mar 2025 15:12:13 +0100 Greg Kroah-Hartman…
Quoted 46 lines · Jiri Slaby
Quoted 27 lines · Jiri Slaby
Quoted 26 lines · Jiri Slaby
Quoted 8 lines · Greg Kroah-Hartman
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu (Google) <[email protected]>
[ Upstream commit
4346ba1604093305a287e08eb465a9c15ba05b80]...
Quoted 4 lines
kernel/trace/Kconfig +0
-0@@ -302,11 +302,9 @@ config DYNAMIC_FTRACE_WITH_ARGSconfig FPROBE
Quoted 8 lines
bool "Kernel Function Probe (fprobe)"
- depends onFUNCTION_TRACER
- depends onDYNAMIC_FTRACE_WITH_REGS||DYNAMIC_FTRACE_WITH_ARGS- depends onHAVE_FTRACE_REGS_HAVING_PT_REGS|| !HAVE_DYNAMIC_FTRACE_WITH_ARGS
- depends onHAVE_RETHOOK
- select RETHOOK
+ depends onHAVE_FUNCTION_GRAPH_FREGS&&HAVE_FTRACE_GRAPH_FUNC
HAVE_FTRACE_GRAPH_FUNCdoes not exist on 6.13, so FPROBE is effectively disabled by this backport.Quoted 8 lines
Quoted 6 lines
Is this missing (and only this?):
commita762e9267dca843ced943ec24f20e110ba7c8431
Author: Masami Hiramatsu (Google) <[email protected]> Date: Thu Dec 26 14:13:34 2024 +0900ftrace: Add
CONFIG_HAVE_FTRACE_GRAPH_FUNCWith this applied,
x86_64is fixed. But ppc and s390 still loose it.
HAVE_FTRACE_GRAPH_FUNCis missing in ppc completely in upstream too (a bug?).s390 has it only through (here omitted):
commit7495e179b478801433cec3cc4a82d2dcea35bf06Author: Sven Schnelle <[email protected]> Date: Thu Dec 26 14:13:48 2024 +0900
Quoted 5 lines
Quoted 1 line
s390/tracing: Enable
HAVE_FTRACE_GRAPH_FUNCYeah, this isn't right. I've dropped all of these from the queue now, thanks for the review!
Thanks Jiri and Greg! BTW, I wonder why this had been backported? I think this has no Fixes tag. maybe dependencies?
Thank you,
Quoted 1 line
greg k-h
Signature · 1 line
Masami Hiramatsu (Google) <[email protected]>
Greg Kroah-Hartman
maintainerPATCH 103/207 tracing: fprobe-events: Log error for exceeding the number of entry args
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu (Google) <[email protected]>
[ Upstream commit db5e228611b118cf7b1f8084063feda5c037f4a7 ]
Add error message when the number of entry argument exceeds the maximum size of entry data.
This is currently checked when registering fprobe, but in this case no error message is shown in the error_log file.
--- kernel/trace/trace_fprobe.c | 5 +++++ kernel/trace/trace_probe.h | 3 ++- 2 files changed, 7 insertions(+), 1 deletion(-)
kernel/trace/trace_fprobe.c +5 -0
@@ -1242,6 +1242,11 @@ static int __trace_fprobe_create(int argc, const char *argv[])if (is_return && tf->tp.entry_arg) { tf->fp.entry_handler = trace_fprobe_entry_handler; tf->fp.entry_data_size =traceprobe_get_entry_data_size (&tf->tp); +if (ALIGN (tf->fp.entry_data_size,sizeof (long )) >MAX_FPROBE_DATA_SIZE ) { +trace_probe_log_set_index (2 ); +trace_probe_log_err (0 ,TOO_MANY_EARGS ); +return -E2BIG ; + } } ret = traceprobe_set_print_fmt(&tf->tp,
kernel/trace/trace_probe.h +2 -1
@@ -545,7 +545,8 @@ extern int traceprobe_define_arg_fields(struct trace_event_call *event_call,C (NO_BTF_FIELD ,"This field is not found." ), \C (BAD_BTF_TID ,"Failed to get BTF type info." ),\C (BAD_TYPE4STR ,"This type does not fit for string." ),\ -C (NEED_STRING_TYPE ,"$comm and immediate-string only accepts string type" ), +C (NEED_STRING_TYPE ,"$comm and immediate-string only accepts string type" ),\ +C (TOO_MANY_EARGS ,"Too many entry arguments specified" ), #undef C #define C(a, b) TP_ERR_##a
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 104/207 drm/nouveau: select FW caching
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Airlie <[email protected]>
[ Upstream commit 6b481ab0e6855fb30e2923c51f62f1662d1cda7e ]
nouveau tries to load some firmware during suspend that it loaded earlier, but with fw caching disabled it hangs suspend, so just rely on FW cache enabling instead of working around it in the driver.
--- drivers/gpu/drm/nouveau/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/nouveau/Kconfig +1 -0
@@ -4,6 +4,7 @@ config DRM_NOUVEAU depends on DRM && PCI && MMU select IOMMU_API select FW_LOADER + select FW_CACHE if PM_SLEEP select DRM_CLIENT_SELECTION select DRM_DISPLAY_DP_HELPER select DRM_DISPLAY_HDMI_HELPER
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 105/207 bluetooth: btusb: Initialize .owner field of force_poll_sync_fops
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Salah Triki <[email protected]>
[ Upstream commit cbf85b9cb80bec6345ffe0368dfff98386f4714f ]
Initialize .owner field of force_poll_sync_fops to THIS_MODULE in order to prevent btusb from being unloaded while its operations are in use.
--- drivers/bluetooth/btusb.c | 1 + 1 file changed, 1 insertion(+)
drivers/bluetooth/btusb.c +1 -0
@@ -3652,6 +3652,7 @@ static ssize_t force_poll_sync_write(struct file *file, }static const struct file_operations force_poll_sync_fops = { + .owner =THIS_MODULE , .open = simple_open, .read = force_poll_sync_read, .write = force_poll_sync_write,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 106/207 nvmet: remove old function prototype
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maurizio Lombardi <[email protected]>
[ Upstream commit 0979ff3676b1b4e6a20970bc265491d23c2da42b ]
nvmet_subsys_nsid_exists() doesn't exist anymore
--- drivers/nvme/target/nvmet.h | 1 - 1 file changed, 1 deletion(-)
drivers/nvme/target/nvmet.h +0 -1
@@ -607,7 +607,6 @@ void nvmet_subsys_disc_changed(struct nvmet_subsys *subsys, struct nvmet_host *host);void nvmet_add_async_event (struct nvmet_ctrl *ctrl,u8 event_type,u8 event_info,u8 log_page); -bool nvmet_subsys_nsid_exists (struct nvmet_subsys *subsys,u32 nsid);#define NVMET_MIN_QUEUE_SIZE 16#define NVMET_MAX_QUEUE_SIZE 1024
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 107/207 nvme-tcp: add basic support for the C2HTermReq PDU
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maurizio Lombardi <[email protected]>
[ Upstream commit 84e009042d0f3dfe91bec60bcd208ee3f866cbcd ]
Previously, the NVMe/TCP host driver did not handle the C2HTermReq PDU, instead printing "unsupported pdu type (3)" when received. This patch adds support for processing the C2HTermReq PDU, allowing the driver to print the Fatal Error Status field.
Example of output:
nvme nvme4: Received C2HTermReq (FES = Invalid PDU Header Field)
Stable-dep-of: ad95bab0cd28 ("nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu()")
--- drivers/nvme/host/tcp.c | 43 ++++++++++++++++++++++++++++++++++++++++ include/linux/nvme-tcp.h | 2 ++ 2 files changed, 45 insertions(+)
drivers/nvme/host/tcp.c +43 -0
@@ -763,6 +763,40 @@ static int nvme_tcp_handle_r2t(struct nvme_tcp_queue *queue,return 0 ; } +static void nvme_tcp_handle_c2h_term (struct nvme_tcp_queue *queue, +struct nvme_tcp_term_pdu *pdu) +{ +u16 fes; +const char *msg; +u32 plen =le32_to_cpu (pdu->hdr.plen); + +static const char *const msg_table[] = { + [NVME_TCP_FES_INVALID_PDU_HDR ] ="Invalid PDU Header Field" , + [NVME_TCP_FES_PDU_SEQ_ERR ] ="PDU Sequence Error" , + [NVME_TCP_FES_HDR_DIGEST_ERR ] ="Header Digest Error" , + [NVME_TCP_FES_DATA_OUT_OF_RANGE ] ="Data Transfer Out Of Range" , + [NVME_TCP_FES_R2T_LIMIT_EXCEEDED ] ="R2T Limit Exceeded" , + [NVME_TCP_FES_UNSUPPORTED_PARAM ] ="Unsupported Parameter" , + }; + +if (plen <NVME_TCP_MIN_C2HTERM_PLEN || + plen >NVME_TCP_MAX_C2HTERM_PLEN ) { +dev_err (queue->ctrl->ctrl.device, +"Received a malformed C2HTermReq PDU (plen = %u)\n" , + plen); +return ; + } + + fes =le16_to_cpu (pdu->fes); +if (fes && fes <ARRAY_SIZE (msg_table)) + msg = msg_table[fes]; +else + msg ="Unknown" ; + +dev_err (queue->ctrl->ctrl.device, +"Received C2HTermReq (FES = %s)\n" , msg); +} +static int nvme_tcp_recv_pdu (struct nvme_tcp_queue *queue,struct sk_buff *skb,unsigned int *offset,size_t *len) {
@@ -784,6 +818,15 @@ static int nvme_tcp_recv_pdu(struct nvme_tcp_queue *queue, struct sk_buff *skb,return 0 ; hdr = queue->pdu; +if (unlikely (hdr->type == nvme_tcp_c2h_term)) { +/* +* C2HTermReq never includes Header or Data digests. +* Skip the checks. +*/ +nvme_tcp_handle_c2h_term (queue, (void *)queue->pdu); +return -EINVAL ; + } +if (queue->hdr_digest) { ret =nvme_tcp_verify_hdgst (queue, queue->pdu, hdr->hlen);if (unlikely (ret))
include/linux/nvme-tcp.h +2 -0
@@ -13,6 +13,8 @@#define NVME_TCP_ADMIN_CCSZ SZ_8K#define NVME_TCP_DIGEST_LENGTH 4#define NVME_TCP_MIN_MAXH2CDATA 4096 +#define NVME_TCP_MIN_C2HTERM_PLEN 24 +#define NVME_TCP_MAX_C2HTERM_PLEN 152enum nvme_tcp_pfv {NVME_TCP_PFV_1_0 =0x0 ,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 108/207 nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maurizio Lombardi <[email protected]>
[ Upstream commit ad95bab0cd28ed77c2c0d0b6e76e03e031391064 ]
nvme_tcp_recv_pdu() doesn't check the validity of the header length. When header digests are enabled, a target might send a packet with an invalid header length (e.g. 255), causing nvme_tcp_verify_hdgst() to access memory outside the allocated area and cause memory corruptions by overwriting it with the calculated digest.
Fix this by rejecting packets with an unexpected header length.
--- drivers/nvme/host/tcp.c | 32 +++++++++++++++++++++++++++++--- 1 file changed, 29 insertions(+), 3 deletions(-)
drivers/nvme/host/tcp.c +29 -3
@@ -217,6 +217,19 @@ static inline int nvme_tcp_queue_id(struct nvme_tcp_queue *queue)return queue - queue->ctrl->queues; } +static inline bool nvme_tcp_recv_pdu_supported (enum nvme_tcp_pdu_type type) +{ +switch (type) { +case nvme_tcp_c2h_term: +case nvme_tcp_c2h_data: +case nvme_tcp_r2t: +case nvme_tcp_rsp: +return true; +default : +return false; + } +} +/* * Check if the queue is TLS encrypted */
@@ -818,6 +831,16 @@ static int nvme_tcp_recv_pdu(struct nvme_tcp_queue *queue, struct sk_buff *skb,return 0 ; hdr = queue->pdu; +if (unlikely (hdr->hlen !=sizeof (struct nvme_tcp_rsp_pdu ))) { +if (!nvme_tcp_recv_pdu_supported (hdr->type)) + goto unsupported_pdu; + +dev_err (queue->ctrl->ctrl.device, +"pdu type %d has unexpected header length (%d)\n" , + hdr->type, hdr->hlen); +return -EPROTO ; + } +if (unlikely (hdr->type == nvme_tcp_c2h_term)) {/* * C2HTermReq never includes Header or Data digests.
@@ -850,10 +873,13 @@ static int nvme_tcp_recv_pdu(struct nvme_tcp_queue *queue, struct sk_buff *skb,nvme_tcp_init_recv_ctx (queue);return nvme_tcp_handle_r2t (queue, (void *)queue->pdu);default : -dev_err (queue->ctrl->ctrl.device, -"unsupported pdu type (%d)\n" , hdr->type); -return -EINVAL ; + goto unsupported_pdu; } + +unsupported_pdu: +dev_err (queue->ctrl->ctrl.device, +"unsupported pdu type (%d)\n" , hdr->type); +return -EINVAL ; }static inline void nvme_tcp_end_request (struct request *rq,u16 status)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 109/207 nvmet-tcp: Fix a possible sporadic response drops in weakly ordered arch
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Meir Elisha <[email protected]>
[ Upstream commit a16f88964c647103dad7743a484b216d488a6352 ]
The order in which queue->cmd and rcv_state are updated is crucial. If these assignments are reordered by the compiler, the worker might not get queued in nvmet_tcp_queue_response(), hanging the IO. to enforce the the correct reordering, set rcv_state using smp_store_release().
--- drivers/nvme/target/tcp.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
drivers/nvme/target/tcp.c +11 -4
@@ -571,10 +571,16 @@ static void nvmet_tcp_queue_response(struct nvmet_req *req)struct nvmet_tcp_cmd *cmd = container_of(req, struct nvmet_tcp_cmd, req);struct nvmet_tcp_queue *queue = cmd->queue; +enum nvmet_tcp_recv_state queue_state; +struct nvmet_tcp_cmd *queue_cmd;struct nvme_sgl_desc *sgl;u32 len; -if (unlikely (cmd == queue->cmd)) { +/* Pairs with store_release in nvmet_prepare_receive_pdu() */ + queue_state =smp_load_acquire (&queue->rcv_state); + queue_cmd =READ_ONCE (queue->cmd); + +if (unlikely (cmd == queue_cmd)) { sgl = &cmd->req.cmd->common.dptr.sgl; len =le32_to_cpu (sgl->length);
@@ -583,7 +589,7 @@ static void nvmet_tcp_queue_response(struct nvmet_req *req)* Avoid using helpers, this might happen before * nvmet_req_init is completed. */ -if (queue->rcv_state ==NVMET_TCP_RECV_PDU && +if (queue_state ==NVMET_TCP_RECV_PDU && len && len <= cmd->req.port->inline_data_size &&nvme_is_write (cmd->req.cmd))return ;
@@ -847,8 +853,9 @@ static void nvmet_prepare_receive_pdu(struct nvmet_tcp_queue *queue) { queue->offset =0 ; queue->left =sizeof (struct nvme_tcp_hdr ); - queue->cmd =NULL ; - queue->rcv_state =NVMET_TCP_RECV_PDU ; +WRITE_ONCE (queue->cmd,NULL ); +/* Ensure rcv_state is visible only after queue->cmd is set */ +smp_store_release (&queue->rcv_state,NVMET_TCP_RECV_PDU ); }static void nvmet_tcp_free_crypto (struct nvmet_tcp_queue *queue)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 110/207 ALSA: hda/realtek: Remove (revert) duplicate Ally X config
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antheas Kapenekakis <[email protected]>
[ Upstream commit 3414cda9d41f41703832d0abd01063dd8de82b89 ]
In commit 1e9c708dc3ae ("ALSA: hda/tas2781: Add new quirk for Lenovo, ASUS, Dell projects") Baojun adds a bunch of projects to the file, including for the Ally X. Turns out the initial Ally X was not sorted properly, so the kernel had 2 quirks for it.
The previous quirk overrode the new one due to being earlier and they are different. When AB testing, the normal pin fixup seems to work ok but causes a bit of a minor popping. Given the other config is more complicated and may cause undefined behavior, revert it.
--- sound/pci/hda/patch_realtek.c | 8 -------- 1 file changed, 8 deletions(-)
sound/pci/hda/patch_realtek.c +0 -8
@@ -7761,7 +7761,6 @@ enum {ALC285_FIXUP_THINKPAD_X1_GEN7 ,ALC285_FIXUP_THINKPAD_HEADSET_JACK ,ALC294_FIXUP_ASUS_ALLY , -ALC294_FIXUP_ASUS_ALLY_X ,ALC294_FIXUP_ASUS_ALLY_PINS ,ALC294_FIXUP_ASUS_ALLY_VERBS , ALC294_FIXUP_ASUS_ALLY_SPEAKER,
@@ -9206,12 +9205,6 @@ static const struct hda_fixup alc269_fixups[] = { .chained = true, .chain_id =ALC294_FIXUP_ASUS_ALLY_PINS }, - [ALC294_FIXUP_ASUS_ALLY_X] = { - .type = HDA_FIXUP_FUNC, - .v.func = tas2781_fixup_i2c, - .chained = true, - .chain_id =ALC294_FIXUP_ASUS_ALLY_PINS - }, [ALC294_FIXUP_ASUS_ALLY_PINS] = { .type = HDA_FIXUP_PINS, .v.pins = (const struct hda_pintbl[]) {
@@ -10705,7 +10698,6 @@ static const struct hda_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x1043 ,0x1740 ,"ASUS UX430UA" ,ALC295_FIXUP_ASUS_DACS ),SND_PCI_QUIRK (0x1043 ,0x17d1 ,"ASUS UX431FL" ,ALC294_FIXUP_ASUS_DUAL_SPK ),SND_PCI_QUIRK (0x1043 ,0x17f3 ,"ROG Ally NR2301L/X" ,ALC294_FIXUP_ASUS_ALLY ), -SND_PCI_QUIRK (0x1043 ,0x1eb3 ,"ROG Ally X RC72LA" ,ALC294_FIXUP_ASUS_ALLY_X ),SND_PCI_QUIRK (0x1043 ,0x1863 ,"ASUS UX6404VI/VV" ,ALC245_FIXUP_CS35L41_SPI_2 ),SND_PCI_QUIRK (0x1043 ,0x1881 ,"ASUS Zephyrus S/M" ,ALC294_FIXUP_ASUS_GX502_PINS ), SND_PCI_QUIRK(0x1043, 0x18b1, "Asus MJ401TA", ALC256_FIXUP_ASUS_HEADSET_MIC),
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 111/207 net: gso: fix ownership in __udp_gso_segment
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antoine Tenart <[email protected]>
[ Upstream commit ee01b2f2d7d0010787c2343463965bbc283a497f ]
In __udp_gso_segment the skb destructor is removed before segmenting the skb but the socket reference is kept as-is. This is an issue if the original skb is later orphaned as we can hit the following bug:
kernel BUG at ./include/linux/skbuff.h:3312! (skb_orphan)
RIP: 0010:ip_rcv_core+0x8b2/0xca0 Call Trace: ip_rcv+0xab/0x6e0 __netif_receive_skb_one_core+0x168/0x1b0 process_backlog+0x384/0x1100 __napi_poll.constprop.0+0xa1/0x370 net_rx_action+0x925/0xe50
The above can happen following a sequence of events when using OpenVSwitch, when an OVS_ACTION_ATTR_USERSPACE action precedes an OVS_ACTION_ATTR_OUTPUT action:
1. OVS_ACTION_ATTR_USERSPACE is handled (in do_execute_actions): the skb goes through queue_gso_packets and then __udp_gso_segment, where its destructor is removed.
2. The segments' data are copied and sent to userspace.
3. OVS_ACTION_ATTR_OUTPUT is handled (in do_execute_actions) and the same original skb is sent to its path.
4. If it later hits skb_orphan, we hit the bug.
Fix this by also removing the reference to the socket in __udp_gso_segment.
--- net/ipv4/udp_offload.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
net/ipv4/udp_offload.c +6 -2
@@ -321,13 +321,17 @@ struct sk_buff *__udp_gso_segment(struct sk_buff *gso_skb,/* clear destructor to avoid skb_segment assigning it to tail */ copy_dtor = gso_skb->destructor == sock_wfree; -if (copy_dtor) +if (copy_dtor) { gso_skb->destructor =NULL ; + gso_skb->sk =NULL ; + } segs =skb_segment (gso_skb, features);if (IS_ERR_OR_NULL (segs)) { -if (copy_dtor) +if (copy_dtor) { gso_skb->destructor = sock_wfree; + gso_skb->sk = sk; + }return segs; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 112/207 caif_virtio: fix wrong pointer check in cfv_probe()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vitaliy Shevtsov <[email protected]>
[ Upstream commit a466fd7e9fafd975949e5945e2f70c33a94b1a70 ]
del_vqs() frees virtqueues, therefore cfv->vq_tx pointer should be checked for NULL before calling it, not cfv->vdev. Also the current implementation is redundant because the pointer cfv->vdev is dereferenced before it is checked for NULL.
Fix this by checking cfv->vq_tx for NULL instead of cfv->vdev before calling del_vqs().
--- drivers/net/caif/caif_virtio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/caif/caif_virtio.c +1 -1
@@ -745,7 +745,7 @@ static int cfv_probe(struct virtio_device *vdev)if (cfv->vr_rx) vdev->vringh_config->del_vrhs (cfv->vdev); -if (cfv->vdev) +if (cfv->vq_tx) vdev->config->del_vqs (cfv->vdev);free_netdev (netdev);return err;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 113/207 perf/core: Fix pmus_lock vs. pmus_srcu ordering
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
[ Upstream commit 2565e42539b120b81a68a58da961ce5d1e34eac8 ]
Commit a63fbed776c7 ("perf/tracing/cpuhotplug: Fix locking order") placed pmus_lock inside pmus_srcu, this makes perf_pmu_unregister() trip lockdep.
Move the locking about such that only pmu_idr and pmus (list) are modified while holding pmus_lock. This avoids doing synchronize_srcu() while holding pmus_lock and all is well again.
--- kernel/events/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/events/core.c +2 -2
@@ -11896,6 +11896,8 @@ void perf_pmu_unregister(struct pmu *pmu) {mutex_lock (&pmus_lock);list_del_rcu (&pmu->entry); +idr_remove (&pmu_idr, pmu->type); +mutex_unlock (&pmus_lock);/* * We dereference the pmu list under both SRCU and regular RCU, so
@@ -11905,7 +11907,6 @@ void perf_pmu_unregister(struct pmu *pmu)synchronize_rcu ();free_percpu (pmu->pmu_disable_count); -idr_remove (&pmu_idr, pmu->type);if (pmu_bus_running && pmu->dev && pmu->dev !=PMU_NULL_DEV ) {if (pmu->nr_addr_filters)device_remove_file (pmu->dev, &dev_attr_nr_addr_filters);
@@ -11913,7 +11914,6 @@ void perf_pmu_unregister(struct pmu *pmu)put_device (pmu->dev); }free_pmu_context (pmu); -mutex_unlock (&pmus_lock); }EXPORT_SYMBOL_GPL (perf_pmu_unregister);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 114/207 cred: return old creds from revert_creds_light()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Brauner <[email protected]>
[ Upstream commit 95c54bc81791c210b131f2b1013942487e74896f ]
So we can easily convert revert_creds() callers over to drop the reference count explicitly.
Stable-dep-of: e04918dc5946 ("cred: Fix RCU warnings in override/revert_creds")
--- include/linux/cred.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
include/linux/cred.h +4 -1
@@ -185,9 +185,12 @@ static inline const struct cred *override_creds_light(const struct cred *overridreturn old; } -static inline void revert_creds_light (const struct cred *revert_cred) +static inline const struct cred *revert_creds_light (const struct cred *revert_cred) { +const struct cred *override_cred = current->cred; +rcu_assign_pointer (current->cred, revert_cred); +return override_cred; }/**
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 115/207 cred: Fix RCU warnings in override/revert_creds
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
[ Upstream commit e04918dc594669068f5d59d567d08db531167188 ]
Fix RCU warnings in override_creds and revert_creds by turning the RCU pointer into a normal pointer using rcu_replace_pointer.
These warnings were previously private to the cred code, but due to the move into the header file they are now polluting unrelated subsystems.
--- include/linux/cred.h | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-)
include/linux/cred.h +2 -8
@@ -179,18 +179,12 @@ static inline bool cap_ambient_invariant_ok(const struct cred *cred)*/ static inline const struct cred *override_creds_light (const struct cred *override_cred) { -const struct cred *old = current->cred; - -rcu_assign_pointer (current->cred, override_cred); -return old; +return rcu_replace_pointer (current->cred, override_cred,1 ); }static inline const struct cred *revert_creds_light (const struct cred *revert_cred) { -const struct cred *override_cred = current->cred; - -rcu_assign_pointer (current->cred, revert_cred); -return override_cred; +return rcu_replace_pointer (current->cred, revert_cred,1 ); }/**
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 116/207 hwmon: (pmbus) Initialise page count in pmbus_identify()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Titus Rwantare <[email protected]>
[ Upstream commit 6b6e2e8fd0de3fa7c6f4f8fe6841b01770b2e7bc ]
The pmbus_identify() function fails to correctly determine the number of supported pages on PMBus devices. This occurs because info->pages is implicitly zero-initialised, and pmbus_set_page() does not perform writes to the page register if info->pages is not yet initialised. Without this patch, info->pages is always set to the maximum after scanning.
This patch initialises info->pages to PMBUS_PAGES before the probing loop, enabling pmbus_set_page() writes to make it out onto the bus correctly identifying the number of pages. PMBUS_PAGES seemed like a reasonable non-zero number because that's the current result of the identification process.
Testing was done with a PMBus device in QEMU.
--- drivers/hwmon/pmbus/pmbus.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/hwmon/pmbus/pmbus.c +2 -0
@@ -103,6 +103,8 @@ static int pmbus_identify(struct i2c_client *client,if (pmbus_check_byte_register (client,0 ,PMBUS_PAGE )) {int page; + info->pages =PMBUS_PAGES ; +for (page =1 ; page <PMBUS_PAGES ; page++) {if (pmbus_set_page (client, page,0xff ) <0 )break ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 117/207 hwmon: (ntc_thermistor) Fix the ncpXXxh103 sensor table
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maud Spierings <[email protected]>
[ Upstream commit 1c7932d5ae0f5c22fa52ac811b4c427bbca5aff5 ]
I could not find a single table that has the values currently present in the table, change it to the actual values that can be found in [1]/[2] and [3] (page 15 column 2)
[1]: https://www.murata.com/products/productdetail?partno=NCP15XH103F03RC
[2]: https://www.murata.com/products/productdata/8796836626462/NTHCG83.txt?1437969843000
[3]: https://nl.mouser.com/datasheet/2/281/r44e-522712.pdf
--- drivers/hwmon/ntc_thermistor.c | 66 +++++++++++++++++----------------- 1 file changed, 33 insertions(+), 33 deletions(-)
drivers/hwmon/ntc_thermistor.c +33 -33
@@ -181,40 +181,40 @@ static const struct ntc_compensation ncpXXwf104[] = { };static const struct ntc_compensation ncpXXxh103[] = { - { .temp_c =-40 , .ohm =247565 }, - { .temp_c =-35 , .ohm =181742 }, - { .temp_c =-30 , .ohm =135128 }, - { .temp_c =-25 , .ohm =101678 }, - { .temp_c =-20 , .ohm =77373 }, - { .temp_c =-15 , .ohm =59504 }, - { .temp_c =-10 , .ohm =46222 }, - { .temp_c =-5 , .ohm =36244 }, - { .temp_c =0 , .ohm =28674 }, - { .temp_c =5 , .ohm =22878 }, - { .temp_c =10 , .ohm =18399 }, - { .temp_c =15 , .ohm =14910 }, - { .temp_c =20 , .ohm =12169 }, + { .temp_c =-40 , .ohm =195652 }, + { .temp_c =-35 , .ohm =148171 }, + { .temp_c =-30 , .ohm =113347 }, + { .temp_c =-25 , .ohm =87559 }, + { .temp_c =-20 , .ohm =68237 }, + { .temp_c =-15 , .ohm =53650 }, + { .temp_c =-10 , .ohm =42506 }, + { .temp_c =-5 , .ohm =33892 }, + { .temp_c =0 , .ohm =27219 }, + { .temp_c =5 , .ohm =22021 }, + { .temp_c =10 , .ohm =17926 }, + { .temp_c =15 , .ohm =14674 }, + { .temp_c =20 , .ohm =12081 }, { .temp_c =25 , .ohm =10000 }, - { .temp_c =30 , .ohm =8271 }, - { .temp_c =35 , .ohm =6883 }, - { .temp_c =40 , .ohm =5762 }, - { .temp_c =45 , .ohm =4851 }, - { .temp_c =50 , .ohm =4105 }, - { .temp_c =55 , .ohm =3492 }, - { .temp_c =60 , .ohm =2985 }, - { .temp_c =65 , .ohm =2563 }, - { .temp_c =70 , .ohm =2211 }, - { .temp_c =75 , .ohm =1915 }, - { .temp_c =80 , .ohm =1666 }, - { .temp_c =85 , .ohm =1454 }, - { .temp_c =90 , .ohm =1275 }, - { .temp_c =95 , .ohm =1121 }, - { .temp_c =100 , .ohm =990 }, - { .temp_c =105 , .ohm =876 }, - { .temp_c =110 , .ohm =779 }, - { .temp_c =115 , .ohm =694 }, - { .temp_c =120 , .ohm =620 }, - { .temp_c =125 , .ohm =556 }, + { .temp_c =30 , .ohm =8315 }, + { .temp_c =35 , .ohm =6948 }, + { .temp_c =40 , .ohm =5834 }, + { .temp_c =45 , .ohm =4917 }, + { .temp_c =50 , .ohm =4161 }, + { .temp_c =55 , .ohm =3535 }, + { .temp_c =60 , .ohm =3014 }, + { .temp_c =65 , .ohm =2586 }, + { .temp_c =70 , .ohm =2228 }, + { .temp_c =75 , .ohm =1925 }, + { .temp_c =80 , .ohm =1669 }, + { .temp_c =85 , .ohm =1452 }, + { .temp_c =90 , .ohm =1268 }, + { .temp_c =95 , .ohm =1110 }, + { .temp_c =100 , .ohm =974 }, + { .temp_c =105 , .ohm =858 }, + { .temp_c =110 , .ohm =758 }, + { .temp_c =115 , .ohm =672 }, + { .temp_c =120 , .ohm =596 }, + { .temp_c =125 , .ohm =531 }, };/*
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 118/207 hwmon: (ad7314) Validate leading zero bits and return error
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Erik Schumacher <[email protected]>
[ Upstream commit e278d5e8aef4c0a1d9a9fa8b8910d713a89aa800 ]
Leading zero bits are sent on the bus before the temperature value is transmitted. If any of these bits are high, the connection might be unstable or there could be no AD7314 / ADT730x (or compatible) at all. Return -EIO in that case.
--- drivers/hwmon/ad7314.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/hwmon/ad7314.c +10 -0
@@ -22,11 +22,13 @@*/ #define AD7314_TEMP_MASK 0x7FE0#define AD7314_TEMP_SHIFT 5 +#define AD7314_LEADING_ZEROS_MASK BIT(15)/* * ADT7301 and ADT7302 temperature masks */ #define ADT7301_TEMP_MASK 0x3FFF +#define ADT7301_LEADING_ZEROS_MASK (BIT(15) | BIT(14))enum ad7314_variant { adt7301,
@@ -65,12 +67,20 @@ static ssize_t ad7314_temperature_show(struct device *dev,return ret;switch (spi_get_device_id (chip->spi_dev)->driver_data) {case ad7314: +if (ret &AD7314_LEADING_ZEROS_MASK ) { +/* Invalid read-out, leading zero part is missing */ +return -EIO ; + } data = (ret &AD7314_TEMP_MASK ) >>AD7314_TEMP_SHIFT ; data =sign_extend32 (data,9 );return sprintf (buf,"%d\n" ,250 * data);case adt7301:case adt7302: +if (ret &ADT7301_LEADING_ZEROS_MASK ) { +/* Invalid read-out, leading zero part is missing */ +return -EIO ; + }/* * Documented as a 13 bit twos complement register * with a sign bit - which is a 14 bit 2's complement
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 119/207 tracing: probe-events: Remove unused MAX_ARG_BUF_LEN macro
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu (Google) <[email protected]>
[ Upstream commit fd5ba38390c59e1c147480ae49b6133c4ac24001 ]
Commit 18b1e870a496 ("tracing/probes: Add $arg* meta argument for all function args") introduced MAX_ARG_BUF_LEN but it is not used. Remove it.
--- kernel/trace/trace_probe.h | 1 - 1 file changed, 1 deletion(-)
kernel/trace/trace_probe.h +0 -1
@@ -36,7 +36,6 @@#define MAX_BTF_ARGS_LEN 128#define MAX_DENTRY_ARGS_LEN 256#define MAX_STRING_SIZE PATH_MAX -#define MAX_ARG_BUF_LEN (MAX_TRACE_ARGS * MAX_ARG_NAME_LEN)/* Reserved field names */ #define FIELD_STRING_IP "__probe_ip"
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 120/207 drm/imagination: Fix timestamps in firmware traces
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alessio Belle <[email protected]>
[ Upstream commit 1d2eabb6616433ccaa13927811bdfa205e91ba60 ]
When firmware traces are enabled, the firmware dumps 48-bit timestamps for each trace as two 32-bit values, highest 32 bits (of which only 16 useful) first.
The driver was reassembling them the other way round i.e. interpreting the first value in memory as the lowest 32 bits, and the second value as the highest 32 bits (then truncated to 16 bits).
Due to this, firmware trace dumps showed very large timestamps even for traces recorded shortly after GPU boot. The timestamps in these dumps would also sometimes jump backwards because of the truncation.
Example trace dumped after loading the powervr module and enabling firmware traces, where each line is commented with the timestamp value in hexadecimal to better show both issues:
[93540092739584] : Host Sync Partition marker: 1 // 0x551300000000 [28419798597632] : GPU units deinit // 0x19d900000000 [28548647616512] : GPU deinit // 0x19f700000000
Update logic to reassemble the timestamps halves in the correct order.
--- drivers/gpu/drm/imagination/pvr_fw_trace.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/imagination/pvr_fw_trace.c +2 -2
@@ -333,8 +333,8 @@ static int fw_trace_seq_show(struct seq_file *s, void *v)if (sf_id ==ROGUE_FW_SF_LAST )return -EINVAL ; - timestamp =read_fw_trace (trace_seq_data,1 ) | - ((u64 )read_fw_trace (trace_seq_data,2 ) <<32 ); + timestamp = ((u64 )read_fw_trace (trace_seq_data,1 ) <<32 ) | +read_fw_trace (trace_seq_data,2 ); timestamp = (timestamp & ~ROGUE_FWT_TIMESTAMP_TIME_CLRMSK ) >>ROGUE_FWT_TIMESTAMP_TIME_SHIFT ;
Signature · 1 line
2.39.5