6.1.139-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 6.1.139-rc1 review
This is the start of the stable review cycle for the 6.1.139 release. There are 92 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 14 May 2025 17:19:58 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.139-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.1.139-rc1
Peter Zijlstra <[email protected]>
x86/its: Use dynamic thunks for indirect branches
Pawan Gupta <[email protected]>
x86/ibt: Keep IBT disabled during alternative patching
Pawan Gupta <[email protected]>
x86/its: Align RETs in BHB clear sequence to avoid thunking
Pawan Gupta <[email protected]>
x86/its: Add "vmexit" option to skip mitigation on some CPUs
Pawan Gupta <[email protected]>
x86/its: Enable Indirect Target Selection mitigation
Pawan Gupta <[email protected]>
x86/its: Add support for ITS-safe return thunk
Pawan Gupta <[email protected]>
x86/its: Add support for ITS-safe indirect thunk
Pawan Gupta <[email protected]>
x86/its: Enumerate Indirect Target Selection (ITS) bug
Pawan Gupta <[email protected]>
Documentation: x86/bugs/its: Add ITS documentation
Pawan Gupta <[email protected]>
x86/speculation: Remove the extra #ifdef around CALL_NOSPEC
Pawan Gupta <[email protected]>
x86/speculation: Add a conditional CS prefix to CALL_NOSPEC
Pawan Gupta <[email protected]>
x86/speculation: Simplify and make CALL_NOSPEC consistent
Pawan Gupta <[email protected]>
x86/bhi: Do not set BHI_DIS_S in 32-bit mode
Daniel Sneddon <[email protected]>
x86/bpf: Add IBHF call at end of classic BPF
Daniel Sneddon <[email protected]>
x86/bpf: Call branch history clearing sequence on exit
James Morse <[email protected]>
arm64: proton-pack: Add new CPUs 'k' values for branch mitigation
James Morse <[email protected]>
arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users
James Morse <[email protected]>
arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs
James Morse <[email protected]>
arm64: proton-pack: Expose whether the branchy loop k value
James Morse <[email protected]>
arm64: proton-pack: Expose whether the platform is mitigated by firmware
James Morse <[email protected]>
arm64: insn: Add support for encoding DSB
Greg Kroah-Hartman <[email protected]>
Revert "net: phy: microchip: force IRQ polling mode for lan88xx"
Jens Axboe <[email protected]>
io_uring: ensure deferred completions are posted for multishot
Jens Axboe <[email protected]>
io_uring: always arm linked timeouts prior to issue
Al Viro <[email protected]>
do_umount(): add missing barrier before refcount checks in sync case
Daniel Wagner <[email protected]>
nvme: unblock ctrl state transition for firmware update
Kevin Baker <[email protected]>
drm/panel: simple: Update timings for AUO G101EVN010
Thorsten Blum <[email protected]>
MIPS: Fix MAX_REG_OFFSET
Jonathan Cameron <[email protected]>
iio: adc: dln2: Use aligned_s64 for timestamp
Jonathan Cameron <[email protected]>
iio: accel: adxl355: Make timestamp 64-bit aligned using aligned_s64
Andy Shevchenko <[email protected]>
types: Complement the aligned types with signed 64-bit one
Jonathan Cameron <[email protected]>
iio: temp: maxim-thermocouple: Fix potential lack of DMA safe buffer.
Lothar Rubusch <[email protected]>
iio: accel: adxl367: fix setting odr for activity time update
Dave Penkler <[email protected]>
usb: usbtmc: Fix erroneous generic_read ioctl return
Dave Penkler <[email protected]>
usb: usbtmc: Fix erroneous wait_srq ioctl return
Dave Penkler <[email protected]>
usb: usbtmc: Fix erroneous get_stb ioctl error returns
Oliver Neukum <[email protected]>
USB: usbtmc: use interruptible sleep in usbtmc_read
Andrei Kuchynski <[email protected]>
usb: typec: ucsi: displayport: Fix NULL pointer access
RD Babiera <[email protected]>
usb: typec: tcpm: delay SNK_TRY_WAIT_DEBOUNCE to SRC_TRYWAIT transition
Jim Lin <[email protected]>
usb: host: tegra: Prevent host controller crash when OTG port is used
Wayne Chang <[email protected]>
usb: gadget: tegra-xudc: ACK ST_RC after clearing CTRL_RUN
Pawel Laszczak <[email protected]>
usb: cdnsp: fix L1 resume issue for RTL_REVISION_NEW_LPM version
Pawel Laszczak <[email protected]>
usb: cdnsp: Fix issue with resuming from L1
Jan Kara <[email protected]>
ocfs2: stop quota recovery before disabling quotas
Jan Kara <[email protected]>
ocfs2: implement handshaking with ocfs2 recovery thread
Jan Kara <[email protected]>
ocfs2: switch osb->disable_recovery to enum
Dmitry Antipov <[email protected]>
module: ensure that kobject_put() is safe for module type kobjects
Jason Andryuk <[email protected]>
xenbus: Use kref to track req lifetime
Alexey Charkov <[email protected]>
usb: uhci-platform: Make the clock really optional
Alex Deucher <[email protected]>
drm/amdgpu/hdp5.2: use memcfg register to post the write for HDP flush
Wayne Lin <[email protected]>
drm/amd/display: Copy AUX read reply data whenever length > 0
Wayne Lin <[email protected]>
drm/amd/display: Fix wrong handling for AUX_DEFER case
Wayne Lin <[email protected]>
drm/amd/display: Remove incorrect checking in dmub aux handler
Wayne Lin <[email protected]>
drm/amd/display: Fix the checking condition in dmub aux handling
Maíra Canal <[email protected]>
drm/v3d: Add job to pending list if the reset was skipped
Silvano Seva <[email protected]>
iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo
Silvano Seva <[email protected]>
iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo
Gabriel Shahrouzi <[email protected]>
iio: adis16201: Correct inclinometer channel resolution
Angelo Dureghello <[email protected]>
iio: adc: ad7606: fix serial register access
Wayne Lin <[email protected]>
drm/amd/display: Shift DMUB AUX reply command if necessary
Dave Hansen <[email protected]>
x86/mm: Eliminate window where TLB flushes may be inadvertently skipped
Gabriel Shahrouzi <[email protected]>
staging: axis-fifo: Correct handling of tx_fifo_depth for size validation
Gabriel Shahrouzi <[email protected]>
staging: axis-fifo: Remove hardware resets for user errors
Gabriel Shahrouzi <[email protected]>
staging: iio: adc: ad7816: Correct conditional logic for store mode
Aditya Garg <[email protected]>
Input: synaptics - enable InterTouch on TUXEDO InfinityBook Pro 14 v5
Dmitry Torokhov <[email protected]>
Input: synaptics - enable SMBus for HP Elitebook 850 G1
Aditya Garg <[email protected]>
Input: synaptics - enable InterTouch on Dell Precision M3800
Aditya Garg <[email protected]>
Input: synaptics - enable InterTouch on Dynabook Portege X30L-G
Manuel Fombuena <[email protected]>
Input: synaptics - enable InterTouch on Dynabook Portege X30-D
Gary Bisson <[email protected]>
Input: mtk-pmic-keys - fix possible null pointer dereference
Jonas Gorski <[email protected]>
net: dsa: b53: fix learning on VLAN unaware bridges
Jonas Gorski <[email protected]>
net: dsa: b53: always rejoin default untagged VLAN on bridge leave
Jonas Gorski <[email protected]>
net: dsa: b53: fix VLAN ID for untagged vlan on bridge leave
Jonas Gorski <[email protected]>
net: dsa: b53: fix flushing old pvid VLAN on pvid change
Jonas Gorski <[email protected]>
net: dsa: b53: fix clearing PVID of a port
Jonas Gorski <[email protected]>
net: dsa: b53: allow leaky reserved multicast
Paul Chaignon <[email protected]>
bpf: Scrub packet on bpf_redirect_peer
Jozsef Kadlecsik <[email protected]>
netfilter: ipset: fix region locking in hash types
Julian Anastasov <[email protected]>
ipvs: fix uninit-value for saddr in do_output_route4
Guillaume Nault <[email protected]>
ipv4: Drop tos parameter from flowi4_update_output()
Oliver Hartkopp <[email protected]>
can: gw: fix RCU/BH usage in cgw_create_job()
Uladzislau Rezki (Sony) <[email protected]>
rcu/kvfree: Add kvfree_rcu_mightsleep() and kfree_rcu_mightsleep()
Kelsey Maes <[email protected]>
can: mcp251xfd: fix TDC setting for low data bit rates
Guillaume Nault <[email protected]>
gre: Fix again IPv6 link-local address generation.
Cong Wang <[email protected]>
sch_htb: make htb_deactivate() idempotent
Wang Zhaolong <[email protected]>
ksmbd: fix memory leak in parse_lease_state()
Eelco Chaudron <[email protected]>
openvswitch: Fix unsafe attribute parsing in output_userspace()
Norbert Szetei <[email protected]>
ksmbd: prevent out-of-bounds stream writes by validating *pos
Marc Kleine-Budde <[email protected]>
can: mcp251xfd: mcp251xfd_remove(): fix order of unregistration calls
Marc Kleine-Budde <[email protected]>
can: mcan: m_can_class_unregister(): fix order of unregistration calls
Wojciech Dubowik <[email protected]>
arm64: dts: imx8mm-verdin: Link reg_usdhc2_vqmmc to usdhc2
Dan Carpenter <[email protected]>
dm: add missing unlock on in dm_keyslot_evict()
-------------
Diffstat:
Documentation/ABI/testing/sysfs-devices-system-cpu | 1 + Documentation/admin-guide/hw-vuln/index.rst | 1 + .../hw-vuln/indirect-target-selection.rst | 156 ++++++++++++++ Documentation/admin-guide/kernel-parameters.txt | 15 ++ Makefile | 4 +- arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi | 25 ++- arch/arm64/include/asm/cputype.h | 2 + arch/arm64/include/asm/insn.h | 1 + arch/arm64/include/asm/spectre.h | 3 + arch/arm64/kernel/proton-pack.c | 13 +- arch/arm64/lib/insn.c | 76 ++++--- arch/arm64/net/bpf_jit_comp.c | 57 +++++- arch/mips/include/asm/ptrace.h | 3 +- arch/x86/Kconfig | 11 + arch/x86/entry/entry_64.S | 20 +- arch/x86/include/asm/alternative.h | 24 +++ arch/x86/include/asm/cpufeatures.h | 3 + arch/x86/include/asm/msr-index.h | 8 + arch/x86/include/asm/nospec-branch.h | 38 ++-- arch/x86/kernel/alternative.c | 226 ++++++++++++++++++++- arch/x86/kernel/cpu/bugs.c | 144 ++++++++++++- arch/x86/kernel/cpu/common.c | 72 +++++-- arch/x86/kernel/ftrace.c | 2 +- arch/x86/kernel/module.c | 7 + arch/x86/kernel/static_call.c | 2 +- arch/x86/kernel/vmlinux.lds.S | 10 + arch/x86/kvm/x86.c | 4 +- arch/x86/lib/retpoline.S | 39 ++++ arch/x86/mm/tlb.c | 23 ++- arch/x86/net/bpf_jit_comp.c | 60 +++++- drivers/base/cpu.c | 8 + drivers/gpu/drm/amd/amdgpu/hdp_v5_2.c | 12 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 20 +- .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 28 ++- drivers/gpu/drm/panel/panel-simple.c | 25 +-- drivers/gpu/drm/v3d/v3d_sched.c | 28 ++- drivers/iio/accel/adis16201.c | 4 +- drivers/iio/accel/adxl355_core.c | 2 +- drivers/iio/accel/adxl367.c | 10 +- drivers/iio/adc/ad7606_spi.c | 2 +- drivers/iio/adc/dln2-adc.c | 2 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 6 + drivers/iio/temperature/maxim_thermocouple.c | 2 +- drivers/input/keyboard/mtk-pmic-keys.c | 4 +- drivers/input/mouse/synaptics.c | 5 + drivers/md/dm-table.c | 3 +- drivers/net/can/m_can/m_can.c | 2 +- drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c | 42 +++- drivers/net/dsa/b53/b53_common.c | 36 ++-- drivers/net/phy/microchip.c | 46 ++++- drivers/nvme/host/core.c | 3 +- drivers/staging/axis-fifo/axis-fifo.c | 14 +- drivers/staging/iio/adc/ad7816.c | 2 +- drivers/usb/cdns3/cdnsp-gadget.c | 31 +++ drivers/usb/cdns3/cdnsp-gadget.h | 6 + drivers/usb/cdns3/cdnsp-pci.c | 12 +- drivers/usb/cdns3/cdnsp-ring.c | 3 +- drivers/usb/cdns3/core.h | 3 + drivers/usb/class/usbtmc.c | 59 +++--- drivers/usb/gadget/udc/tegra-xudc.c | 4 + drivers/usb/host/uhci-platform.c | 2 +- drivers/usb/host/xhci-tegra.c | 3 + drivers/usb/typec/tcpm/tcpm.c | 2 +- drivers/usb/typec/ucsi/displayport.c | 2 + drivers/xen/xenbus/xenbus.h | 2 + drivers/xen/xenbus/xenbus_comms.c | 9 +- drivers/xen/xenbus/xenbus_dev_frontend.c | 2 +- drivers/xen/xenbus/xenbus_xs.c | 18 +- fs/namespace.c | 3 +- fs/ocfs2/journal.c | 80 ++++++-- fs/ocfs2/journal.h | 1 + fs/ocfs2/ocfs2.h | 17 +- fs/ocfs2/quota_local.c | 9 +- fs/ocfs2/super.c | 3 + fs/smb/server/oplock.c | 7 +- fs/smb/server/vfs.c | 7 + include/linux/cpu.h | 2 + include/linux/module.h | 5 + include/linux/rcupdate.h | 3 + include/linux/types.h | 3 +- include/net/flow.h | 3 +- include/net/route.h | 6 +- include/uapi/linux/types.h | 1 + io_uring/io_uring.c | 61 +++--- kernel/params.c | 4 +- net/can/gw.c | 151 ++++++++------ net/core/filter.c | 1 + net/ipv6/addrconf.c | 15 +- net/netfilter/ipset/ip_set_hash_gen.h | 2 +- net/netfilter/ipvs/ip_vs_xmit.c | 29 +-- net/openvswitch/actions.c | 3 +- net/sched/sch_htb.c | 15 +- net/sctp/protocol.c | 4 +- 93 files changed, 1554 insertions(+), 395 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/92 dm: add missing unlock on in dm_keyslot_evict()
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit 650266ac4c7230c89bcd1307acf5c9c92cfa85e2 upstream.
We need to call dm_put_live_table() even if dm_get_live_table() returns NULL.
--- drivers/md/dm-table.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/md/dm-table.c +2 -1
@@ -1243,7 +1243,7 @@ static int dm_keyslot_evict(struct blk_c t =dm_get_live_table (md, &srcu_idx);if (!t) -return 0 ; + goto put_live_table;for (unsigned int i =0 ; i < t->num_targets; i++) {struct dm_target *ti =dm_table_get_target (t, i);
@@ -1254,6 +1254,7 @@ static int dm_keyslot_evict(struct blk_c (void *)key); } +put_live_table:dm_put_live_table (md, srcu_idx);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 2/92 arm64: dts: imx8mm-verdin: Link reg_usdhc2_vqmmc to usdhc2
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wojciech Dubowik <[email protected]>
commit 5591ce0069ddda97cdbbea596bed53e698f399c2 upstream.
Define vqmmc regulator-gpio for usdhc2 with vin-supply coming from LDO5.
Without this definition LDO5 will be powered down, disabling SD card after bootup. This has been introduced in commit f5aab0438ef1 ("regulator: pca9450: Fix enable register for LDO5").
--- arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi | 25 ++++++++++++++++++----- 1 file changed, 20 insertions(+), 5 deletions(-)
arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi +20 -5
@@ -144,6 +144,19 @@ startup-delay-us = <20000>; }; + reg_usdhc2_vqmmc: regulator-usdhc2-vqmmc { + compatible = "regulator-gpio"; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_usdhc2_vsel>; + gpios = <&gpio1 4 GPIO_ACTIVE_HIGH>; + regulator-max-microvolt = <3300000>; + regulator-min-microvolt = <1800000>; + states = <1800000 0x1>, + <3300000 0x0>; + regulator-name = "PMIC_USDHC_VSELECT"; + vin-supply = <®_nvcc_sd>; + }; + reserved-memory { #address-cells = <2>; #size-cells = <2>;
@@ -262,7 +275,7 @@ "SODIMM_19", "", "", - "", + "PMIC_USDHC_VSELECT", "", "", "",
@@ -788,6 +801,7 @@ pinctrl-2 = <&pinctrl_usdhc2_200mhz>, <&pinctrl_usdhc2_cd>; pinctrl-3 = <&pinctrl_usdhc2_sleep>, <&pinctrl_usdhc2_cd_sleep>; vmmc-supply = <®_usdhc2_vmmc>; + vqmmc-supply = <®_usdhc2_vqmmc>; }; &wdog1 {
@@ -1210,13 +1224,17 @@ <MX8MM_IOMUXC_NAND_CLE_GPIO3_IO5 0x6>; /* SODIMM 76 */ }; + pinctrl_usdhc2_vsel: usdhc2vselgrp { + fsl,pins = + <MX8MM_IOMUXC_GPIO1_IO04_GPIO1_IO4 0x10>; /* PMIC_USDHC_VSELECT */ + }; + /* * Note: Due to ERR050080 we use discrete external on-module resistors pulling-up to the * on-module +V3.3_1.8_SD (LDO5) rail and explicitly disable the internal pull-ups here. */ pinctrl_usdhc2: usdhc2grp { fsl,pins = - <MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT 0x10>, <MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK 0x90>, /* SODIMM 78 */ <MX8MM_IOMUXC_SD2_CMD_USDHC2_CMD 0x90>, /* SODIMM 74 */ <MX8MM_IOMUXC_SD2_DATA0_USDHC2_DATA0 0x90>, /* SODIMM 80 */
@@ -1227,7 +1245,6 @@ pinctrl_usdhc2_100mhz: usdhc2-100mhzgrp { fsl,pins = - <MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT 0x10>, <MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK 0x94>, <MX8MM_IOMUXC_SD2_CMD_USDHC2_CMD 0x94>, <MX8MM_IOMUXC_SD2_DATA0_USDHC2_DATA0 0x94>,
@@ -1238,7 +1255,6 @@ pinctrl_usdhc2_200mhz: usdhc2-200mhzgrp { fsl,pins = - <MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT 0x10>, <MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK 0x96>, <MX8MM_IOMUXC_SD2_CMD_USDHC2_CMD 0x96>, <MX8MM_IOMUXC_SD2_DATA0_USDHC2_DATA0 0x96>,
@@ -1250,7 +1266,6 @@ /* Avoid backfeeding with removed card power */ pinctrl_usdhc2_sleep: usdhc2slpgrp { fsl,pins = - <MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT 0x0>, <MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK 0x0>, <MX8MM_IOMUXC_SD2_CMD_USDHC2_CMD 0x0>, <MX8MM_IOMUXC_SD2_DATA0_USDHC2_DATA0 0x0>,
Greg Kroah-Hartman
maintainerPATCH 3/92 can: mcan: m_can_class_unregister(): fix order of unregistration calls
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
commit 0713a1b3276b98c7dafbeefef00d7bc3a9119a84 upstream.
If a driver is removed, the driver framework invokes the driver's remove callback. A CAN driver's remove function calls unregister_candev(), which calls net_device_ops::ndo_stop further down in the call stack for interfaces which are in the "up" state.
The removal of the module causes a warning, as can_rx_offload_del() deletes the NAPI, while it is still active, because the interface is still up.
To fix the warning, first unregister the network interface, which calls net_device_ops::ndo_stop, which disables the NAPI, and then call can_rx_offload_del().
--- drivers/net/can/m_can/m_can.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/can/m_can/m_can.c +1 -1
@@ -2047,9 +2047,9 @@ EXPORT_SYMBOL_GPL(m_can_class_register);void m_can_class_unregister (struct m_can_classdev *cdev) { +unregister_candev (cdev->net);if (cdev->is_peripheral)can_rx_offload_del (&cdev->offload); -unregister_candev (cdev->net); }EXPORT_SYMBOL_GPL (m_can_class_unregister);
Greg Kroah-Hartman
maintainerPATCH 4/92 can: mcp251xfd: mcp251xfd_remove(): fix order of unregistration calls
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
commit 84f5eb833f53ae192baed4cfb8d9eaab43481fc9 upstream.
If a driver is removed, the driver framework invokes the driver's remove callback. A CAN driver's remove function calls unregister_candev(), which calls net_device_ops::ndo_stop further down in the call stack for interfaces which are in the "up" state.
With the mcp251xfd driver the removal of the module causes the following warning:
| WARNING: CPU: 0 PID: 352 at net/core/dev.c:7342 __netif_napi_del_locked+0xc8/0xd8
as can_rx_offload_del() deletes the NAPI, while it is still active, because the interface is still up.
To fix the warning, first unregister the network interface, which calls net_device_ops::ndo_stop, which disables the NAPI, and then call can_rx_offload_del().
--- drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c +1 -1
@@ -2179,8 +2179,8 @@ static void mcp251xfd_remove(struct spi_struct mcp251xfd_priv *priv =spi_get_drvdata (spi);struct net_device *ndev = priv->ndev; -can_rx_offload_del (&priv->offload);mcp251xfd_unregister (priv); +can_rx_offload_del (&priv->offload); spi->max_speed_hz = priv->spi_max_speed_hz_orig;free_candev (ndev); }
Greg Kroah-Hartman
maintainerPATCH 5/92 ksmbd: prevent out-of-bounds stream writes by validating *pos
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Norbert Szetei <[email protected]>
commit 0ca6df4f40cf4c32487944aaf48319cb6c25accc upstream.
ksmbd_vfs_stream_write() did not validate whether the write offset (*pos) was within the bounds of the existing stream data length (v_len). If *pos was greater than or equal to v_len, this could lead to an out-of-bounds memory write.
This patch adds a check to ensure *pos is less than v_len before proceeding. If the condition fails, -EINVAL is returned.
--- fs/smb/server/vfs.c | 7 +++++++ 1 file changed, 7 insertions(+)
fs/smb/server/vfs.c +7 -0
@@ -440,6 +440,13 @@ static int ksmbd_vfs_stream_write(struct goto out; } +if (v_len <= *pos) { +pr_err ("stream write position %lld is out of bounds (stream length: %zd)\n" , + *pos, v_len); + err = -EINVAL ; + goto out; + } +if (v_len < size) { wbuf =kvzalloc (size,GFP_KERNEL );if (!wbuf) {
Greg Kroah-Hartman
maintainerPATCH 6/92 openvswitch: Fix unsafe attribute parsing in output_userspace()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eelco Chaudron <[email protected]>
commit 6beb6835c1fbb3f676aebb51a5fee6b77fed9308 upstream.
This patch replaces the manual Netlink attribute iteration in output_userspace() with nla_for_each_nested(), which ensures that only well-formed attributes are processed.
--- net/openvswitch/actions.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
net/openvswitch/actions.c +1 -2
@@ -954,8 +954,7 @@ static int output_userspace(struct datap upcall.cmd =OVS_PACKET_CMD_ACTION ; upcall.mru =OVS_CB (skb)->mru; -for (a =nla_data (attr), rem =nla_len (attr); rem >0 ; - a =nla_next (a, &rem)) { +nla_for_each_nested (a, attr, rem) {switch (nla_type (a)) {case OVS_USERSPACE_ATTR_USERDATA : upcall.userdata = a;
Greg Kroah-Hartman
maintainerPATCH 7/92 ksmbd: fix memory leak in parse_lease_state()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Zhaolong <[email protected]>
[ Upstream commit eb4447bcce915b43b691123118893fca4f372a8f ]
The previous patch that added bounds check for create lease context introduced a memory leak. When the bounds check fails, the function returns NULL without freeing the previously allocated lease_ctx_info structure.
This patch fixes the issue by adding kfree(lreq) before returning NULL in both boundary check cases.
--- fs/smb/server/oplock.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
fs/smb/server/oplock.c +5 -2
@@ -1536,7 +1536,7 @@ struct lease_ctx_info *parse_lease_state(void *open_req, bool is_dir)if (le16_to_cpu (cc->DataOffset) +le32_to_cpu (cc->DataLength) <sizeof (struct create_lease_v2 ) -4 ) -return NULL ; + goto err_out;memcpy (lreq->lease_key, lc->lcontext.LeaseKey,SMB2_LEASE_KEY_SIZE );if (is_dir) {
@@ -1557,7 +1557,7 @@ struct lease_ctx_info *parse_lease_state(void *open_req, bool is_dir)if (le16_to_cpu (cc->DataOffset) +le32_to_cpu (cc->DataLength) <sizeof (struct create_lease )) -return NULL ; + goto err_out;memcpy (lreq->lease_key, lc->lcontext.LeaseKey,SMB2_LEASE_KEY_SIZE ); lreq->req_state = lc->lcontext.LeaseState;
@@ -1566,6 +1566,9 @@ struct lease_ctx_info *parse_lease_state(void *open_req, bool is_dir) lreq->version =1 ; }return lreq; +err_out: +kfree (lreq); +return NULL ; }/**
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 8/92 sch_htb: make htb_deactivate() idempotent
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cong Wang <[email protected]>
[ Upstream commit 3769478610135e82b262640252d90f6efb05be71 ]
Alan reported a NULL pointer dereference in htb_next_rb_node() after we made htb_qlen_notify() idempotent.
It turns out in the following case it introduced some regression:
htb_dequeue_tree():
|-> fq_codel_dequeue()
|-> qdisc_tree_reduce_backlog()
|-> htb_qlen_notify()
|-> htb_deactivate() |-> htb_next_rb_node()
|-> htb_deactivate()
For htb_next_rb_node(), after calling the 1st htb_deactivate(), the clprio[prio]->ptr could be already set to NULL, which means htb_next_rb_node() is vulnerable here.
For htb_deactivate(), although we checked qlen before calling it, in case of qlen==0 after qdisc_tree_reduce_backlog(), we may call it again which triggers the warning inside.
To fix the issues here, we need to:
1) Make htb_deactivate() idempotent, that is, simply return if we already call it before.
2) Make htb_next_rb_node() safe against ptr==NULL.
Many thanks to Alan for testing and for the reproducer.
--- net/sched/sch_htb.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-)
net/sched/sch_htb.c +6 -9
@@ -345,7 +345,8 @@ static void htb_add_to_wait_tree(struct htb_sched *q,*/ static inline void htb_next_rb_node (struct rb_node **n) { - *n =rb_next (*n); +if (*n) + *n =rb_next (*n); }/**
@@ -606,8 +607,8 @@ static inline void htb_activate(struct htb_sched *q, struct htb_class *cl)*/ static inline void htb_deactivate (struct htb_sched *q,struct htb_class *cl) { -WARN_ON (!cl->prio_activity); - +if (!cl->prio_activity) +return ;htb_deactivate_prios (q, cl); cl->prio_activity =0 ; }
@@ -1482,8 +1483,6 @@ static void htb_qlen_notify(struct Qdisc *sch, unsigned long arg) {struct htb_class *cl = (struct htb_class *)arg; -if (!cl->prio_activity) -return ;htb_deactivate (qdisc_priv (sch), cl); }
@@ -1735,8 +1734,7 @@ static int htb_delete(struct Qdisc *sch, unsigned long arg,if (cl->parent) cl->parent->children--; -if (cl->prio_activity) -htb_deactivate (q, cl); +htb_deactivate (q, cl);if (cl->cmode !=HTB_CAN_SEND ) htb_safe_rb_erase(&cl->pq_node,
@@ -1948,8 +1946,7 @@ static int htb_change_class(struct Qdisc *sch, u32 classid,/* turn parent into inner node */ qdisc_purge_queue (parent->leaf.q); parent_qdisc = parent->leaf.q; -if (parent->prio_activity) -htb_deactivate (q, parent); +htb_deactivate (q, parent);/* remove from evt list because of level change */ if (parent->cmode !=HTB_CAN_SEND ) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 9/92 gre: Fix again IPv6 link-local address generation.
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Nault <[email protected]>
[ Upstream commit 3e6a0243ff002ddbd7ee18a8974ae61d2e6ed00d ]
Use addrconf_addr_gen() to generate IPv6 link-local addresses on GRE devices in most cases and fall back to using add_v4_addrs() only in case the GRE configuration is incompatible with addrconf_addr_gen().
GRE used to use addrconf_addr_gen() until commit e5dd729460ca ("ip/ip6_gre:
use the same logic as SIT interfaces when computing v6LL address") restricted this use to gretap and ip6gretap devices, and created add_v4_addrs() (borrowed from SIT) for non-Ethernet GRE ones.
The original problem came when commit 9af28511be10 ("addrconf: refuse isatap eui64 for INADDR_ANY") made __ipv6_isatap_ifid() fail when its addr parameter was 0. The commit says that this would create an invalid address, however, I couldn't find any RFC saying that the generated interface identifier would be wrong. Anyway, since gre over IPv4 devices pass their local tunnel address to __ipv6_isatap_ifid(), that commit broke their IPv6 link-local address generation when the local address was unspecified.
Then commit e5dd729460ca ("ip/ip6_gre: use the same logic as SIT interfaces when computing v6LL address") tried to fix that case by defining add_v4_addrs() and calling it to generate the IPv6 link-local address instead of using addrconf_addr_gen() (apart for gretap and ip6gretap devices, which would still use the regular addrconf_addr_gen(), since they have a MAC address).
That broke several use cases because add_v4_addrs() isn't properly integrated into the rest of IPv6 Neighbor Discovery code. Several of these shortcomings have been fixed over time, but add_v4_addrs() remains broken on several aspects. In particular, it doesn't send any Router Sollicitations, so the SLAAC process doesn't start until the interface receives a Router Advertisement. Also, add_v4_addrs() mostly ignores the address generation mode of the interface (/proc/sys/net/ipv6/conf/*/addr_gen_mode), thus breaking the IN6_ADDR_GEN_MODE_RANDOM and IN6_ADDR_GEN_MODE_STABLE_PRIVACY cases.
Fix the situation by using add_v4_addrs() only in the specific scenario where the normal method would fail. That is, for interfaces that have all of the following characteristics:
* run over IPv4,
* transport IP packets directly, not Ethernet (that is, not gretap interfaces),
* tunnel endpoint is INADDR_ANY (that is, 0),
* device address generation mode is EUI64.
In all other cases, revert back to the regular addrconf_addr_gen().
Also, remove the special case for ip6gre interfaces in add_v4_addrs(), since ip6gre devices now always use addrconf_addr_gen() instead.
Note:
This patch was originally applied as commit 183185a18ff9 ("gre: Fix IPv6 link-local address generation."). However, it was then reverted by commit fc486c2d060f ("Revert "gre: Fix IPv6 link-local address generation."") because it uncovered another bug that ended up breaking net/forwarding/ip6gre_custom_multipath_hash.sh. That other bug has now been fixed by commit 4d0ab3a6885e ("ipv6: Start path selection from the first nexthop"). Therefore we can now revive this GRE patch (no changes since original commit 183185a18ff9 ("gre: Fix IPv6 link-local address generation.").
--- net/ipv6/addrconf.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
net/ipv6/addrconf.c +9 -6
@@ -3162,16 +3162,13 @@ static void add_v4_addrs(struct inet6_dev *idev)struct in6_addr addr;struct net_device *dev;struct net *net =dev_net (idev->dev); -int scope, plen, offset =0 ; +int scope, plen;u32 pflags =0 ;ASSERT_RTNL ();memset (&addr,0 ,sizeof (struct in6_addr )); -/* in case of IP6GRE the dev_addr is an IPv6 and therefore we use only the last 4 bytes */ -if (idev->dev->addr_len ==sizeof (struct in6_addr )) - offset =sizeof (struct in6_addr ) -4 ; -memcpy (&addr.s6_addr32[3 ], idev->dev->dev_addr + offset,4 ); +memcpy (&addr.s6_addr32[3 ], idev->dev->dev_addr,4 );if (!(idev->dev->flags &IFF_POINTOPOINT ) && idev->dev->type ==ARPHRD_SIT ) { scope = IPV6_ADDR_COMPATv4;
@@ -3481,7 +3478,13 @@ static void addrconf_gre_config(struct net_device *dev)return ; } -if (dev->type ==ARPHRD_ETHER ) { +/* Generate the IPv6 link-local address using addrconf_addr_gen(), +* unless we have an IPv4 GRE device not bound to an IP address and +* which is in EUI64 mode (as __ipv6_isatap_ifid() would fail in this +* case). Such devices fall back to add_v4_addrs() instead. +*/ +if (!(dev->type ==ARPHRD_IPGRE && *(__be32 *)dev->dev_addr ==0 && + idev->cnf.addr_gen_mode ==IN6_ADDR_GEN_MODE_EUI64 )) {addrconf_addr_gen (idev, true);return ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 10/92 can: mcp251xfd: fix TDC setting for low data bit rates
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kelsey Maes <[email protected]>
[ Upstream commit 5e1663810e11c64956aa7e280cf74b2f3284d816 ]
The TDC is currently hardcoded enabled. This means that even for lower CAN-FD data bitrates (with a DBRP (data bitrate prescaler) > 2) a TDC is configured. This leads to a bus-off condition.
ISO 11898-1 section 11.3.3 says "Transmitter delay compensation" (TDC) is only applicable if DBRP is 1 or 2.
To fix the problem, switch the driver to use the TDC calculation provided by the CAN driver framework (which respects ISO 11898-1 section 11.3.3). This has the positive side effect that userspace can control TDC as needed.
Demonstration of the feature in action:
| $ ip link set can0 up type can bitrate 125000 dbitrate 500000 fd on | $ ip -details link show can0 | 3: can0: <NOARP,UP,LOWER_UP,ECHO> mtu 72 qdisc pfifo_fast state UP mode DEFAULT group default qlen 10 | link/can promiscuity 0 allmulti 0 minmtu 0 maxmtu 0 | can <FD> state ERROR-ACTIVE (berr-counter tx 0 rx 0) restart-ms 0 | bitrate 125000 sample-point 0.875 | tq 50 prop-seg 69 phase-seg1 70 phase-seg2 20 sjw 10 brp 2 | mcp251xfd: tseg1 2..256 tseg2 1..128 sjw 1..128 brp 1..256 brp_inc 1 | dbitrate 500000 dsample-point 0.875 | dtq 125 dprop-seg 6 dphase-seg1 7 dphase-seg2 2 dsjw 1 dbrp 5 | mcp251xfd: dtseg1 1..32 dtseg2 1..16 dsjw 1..16 dbrp 1..256 dbrp_inc 1 | tdcv 0..63 tdco 0..63 | clock 40000000 numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535 tso_max_size 65536 tso_max_segs 65535 gro_max_size 65536 parentbus spi parentdev spi0.0 | $ ip link set can0 up type can bitrate 1000000 dbitrate 4000000 fd on | $ ip -details link show can0 | 3: can0: <NOARP,UP,LOWER_UP,ECHO> mtu 72 qdisc pfifo_fast state UP mode DEFAULT group default qlen 10 | link/can promiscuity 0 allmulti 0 minmtu 0 maxmtu 0 | can <FD,TDC-AUTO> state ERROR-ACTIVE (berr-counter tx 0 rx 0) restart-ms 0 | bitrate 1000000 sample-point 0.750 | tq 25 prop-seg 14 phase-seg1 15 phase-seg2 10 sjw 5 brp 1 | mcp251xfd: tseg1 2..256 tseg2 1..128 sjw 1..128 brp 1..256 brp_inc 1 | dbitrate 4000000 dsample-point 0.700 | dtq 25 dprop-seg 3 dphase-seg1 3 dphase-seg2 3 dsjw 1 dbrp 1 | tdco 7 | mcp251xfd: dtseg1 1..32 dtseg2 1..16 dsjw 1..16 dbrp 1..256 dbrp_inc 1 | tdcv 0..63 tdco 0..63 | clock 40000000 numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535 tso_max_size 65536 tso_max_segs 65535 gro_max_size 65536 parentbus spi parentdev spi0.0
There has been some confusion about the MCP2518FD using a relative or absolute TDCO due to the datasheet specifying a range of [-64,63]. I have a custom board with a 40 MHz clock and an estimated loop delay of 100 to 216 ns. During testing at a data bit rate of 4 Mbit/s I found that using can_get_relative_tdco() resulted in bus-off errors. The final TDCO value was 1 which corresponds to a 10% SSP in an absolute configuration. This behavior is expected if the TDCO value is really absolute and not relative. Using priv->can.tdc.tdco instead results in a final TDCO of 8, setting the SSP at exactly 80%. This configuration works.
The automatic, manual, and off TDC modes were tested at speeds up to, and including, 8 Mbit/s on real hardware and behave as expected.
--- .../net/can/spi/mcp251xfd/mcp251xfd-core.c | 40 +++++++++++++++---- 1 file changed, 32 insertions(+), 8 deletions(-)
drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c +32 -8
@@ -75,6 +75,24 @@ static const struct can_bittiming_const mcp251xfd_data_bittiming_const = { .brp_inc = 1, }; +/* The datasheet of the mcp2518fd (DS20006027B) specifies a range of +* [-64,63] for TDCO, indicating a relative TDCO. +* +* Manual tests have shown, that using a relative TDCO configuration +* results in bus off, while an absolute configuration works. +* +* For TDCO use the max value (63) from the data sheet, but 0 as the +* minimum. +*/ +static const struct can_tdc_const mcp251xfd_tdc_const = { + .tdcv_min =0 , + .tdcv_max =63 , + .tdco_min =0 , + .tdco_max =63 , + .tdcf_min =0 , + .tdcf_max =0 , +}; +static const char *__mcp251xfd_get_model_str (enum mcp251xfd_model model) {switch (model) {
@@ -510,8 +528,7 @@ static int mcp251xfd_set_bittiming(const struct mcp251xfd_priv *priv) {const struct can_bittiming *bt = &priv->can.bittiming;const struct can_bittiming *dbt = &priv->can.data_bittiming; -u32 val =0 ; -s8 tdco; +u32 tdcmod, val =0 ;int err;/* CAN Control Register
@@ -575,11 +592,16 @@ static int mcp251xfd_set_bittiming(const struct mcp251xfd_priv *priv)return err;/* Transmitter Delay Compensation */ - tdco =clamp_t (int, dbt->brp * (dbt->prop_seg + dbt->phase_seg1), --64 ,63 ); - val =FIELD_PREP (MCP251XFD_REG_TDC_TDCMOD_MASK , -MCP251XFD_REG_TDC_TDCMOD_AUTO ) | -FIELD_PREP (MCP251XFD_REG_TDC_TDCO_MASK , tdco); +if (priv->can.ctrlmode &CAN_CTRLMODE_TDC_AUTO ) + tdcmod =MCP251XFD_REG_TDC_TDCMOD_AUTO ; +else if (priv->can.ctrlmode &CAN_CTRLMODE_TDC_MANUAL ) + tdcmod =MCP251XFD_REG_TDC_TDCMOD_MANUAL ; +else + tdcmod =MCP251XFD_REG_TDC_TDCMOD_DISABLED ; + + val =FIELD_PREP (MCP251XFD_REG_TDC_TDCMOD_MASK , tdcmod) | +FIELD_PREP (MCP251XFD_REG_TDC_TDCV_MASK , priv->can.tdc.tdcv) | +FIELD_PREP (MCP251XFD_REG_TDC_TDCO_MASK , priv->can.tdc.tdco);return regmap_write (priv->map_reg,MCP251XFD_REG_TDC , val); }
@@ -2083,10 +2105,12 @@ static int mcp251xfd_probe(struct spi_device *spi) priv->can.do_get_berr_counter = mcp251xfd_get_berr_counter; priv->can.bittiming_const = &mcp251xfd_bittiming_const; priv->can.data_bittiming_const = &mcp251xfd_data_bittiming_const; + priv->can.tdc_const = &mcp251xfd_tdc_const; priv->can.ctrlmode_supported =CAN_CTRLMODE_LOOPBACK |CAN_CTRLMODE_LISTENONLY |CAN_CTRLMODE_BERR_REPORTING |CAN_CTRLMODE_FD |CAN_CTRLMODE_FD_NON_ISO | -CAN_CTRLMODE_CC_LEN8_DLC ; +CAN_CTRLMODE_CC_LEN8_DLC |CAN_CTRLMODE_TDC_AUTO | +CAN_CTRLMODE_TDC_MANUAL ;set_bit (MCP251XFD_FLAGS_DOWN , priv->flags); priv->ndev = ndev; priv->spi = spi;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 11/92 rcu/kvfree: Add kvfree_rcu_mightsleep() and kfree_rcu_mightsleep()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uladzislau Rezki (Sony) <[email protected]>
[ Upstream commit 608723c41cd951fb32ade2f8371e61c270816175 ]
The kvfree_rcu() and kfree_rcu() APIs are hazardous in that if you forget the second argument, it works, but might sleep. This sleeping can be a correctness bug from atomic contexts, and even in non-atomic contexts it might introduce unacceptable latencies. This commit therefore adds kvfree_rcu_mightsleep() and kfree_rcu_mightsleep(), which will replace the single-argument kvfree_rcu() and kfree_rcu(), respectively.
This commit enables a series of commits that switch from single-argument kvfree_rcu() and kfree_rcu() to their _mightsleep() counterparts. Once all of these commits land, the single-argument versions will be removed.
Stable-dep-of: 511e64e13d8c ("can: gw: fix RCU/BH usage in cgw_create_job()")
--- include/linux/rcupdate.h | 3 +++ 1 file changed, 3 insertions(+)
include/linux/rcupdate.h +3 -0
@@ -1031,6 +1031,9 @@ static inline notrace void rcu_read_unlock_sched_notrace(void)#define kvfree_rcu (...) KVFREE_GET_MACRO(__VA_ARGS__, \ kvfree_rcu_arg_2, kvfree_rcu_arg_1)(__VA_ARGS__) +#define kvfree_rcu_mightsleep (ptr) kvfree_rcu_arg_1(ptr) +#define kfree_rcu_mightsleep (ptr) kvfree_rcu_mightsleep(ptr) +#define KVFREE_GET_MACRO (_1, _2,NAME , ...) NAME#define kvfree_rcu_arg_2 (ptr, rhf) \ do { \
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 12/92 can: gw: fix RCU/BH usage in cgw_create_job()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <[email protected]>
[ Upstream commit 511e64e13d8cc72853275832e3f372607466c18c ]
As reported by Sebastian Andrzej Siewior the use of local_bh_disable() is only feasible in uni processor systems to update the modification rules. The usual use-case to update the modification rules is to update the data of the modifications but not the modification types (AND/OR/XOR/SET) or the checksum functions itself.
To omit additional memory allocations to maintain fast modification switching times, the modification description space is doubled at gw-job creation time so that only the reference to the active modification description is changed under rcu protection.
Rename cgw_job::mod to cf_mod and make it a RCU pointer. Allocate in cgw_create_job() and free it together with cgw_job in cgw_job_free_rcu(). Update all users to dereference cgw_job::cf_mod with a RCU accessor and if possible once.
[bigeasy: Replace mod1/mod2 from the Oliver's original patch with dynamic allocation, use RCU annotation and accessor]
--- net/can/gw.c | 149 +++++++++++++++++++++++++++++++-------------------- 1 file changed, 90 insertions(+), 59 deletions(-)
net/can/gw.c +90 -59
@@ -130,7 +130,7 @@ struct cgw_job {u32 handled_frames;u32 dropped_frames;u32 deleted_frames; -struct cf_mod mod; +struct cf_mod __rcu *cf_mod;union {/* CAN frame data source */ struct net_device *dev;
@@ -459,6 +459,7 @@ static void can_can_gw_rcv(struct sk_buff *skb, void *data)struct cgw_job *gwj = (struct cgw_job *)data;struct canfd_frame *cf;struct sk_buff *nskb; +struct cf_mod *mod;int modidx =0 ;/* process strictly Classic CAN or CAN FD frames */
@@ -506,7 +507,8 @@ static void can_can_gw_rcv(struct sk_buff *skb, void *data)* When there is at least one modification function activated, * we need to copy the skb as we want to modify skb->data. */ -if (gwj->mod.modfunc[0 ]) + mod =rcu_dereference (gwj->cf_mod); +if (mod->modfunc[0 ]) nskb =skb_copy (skb,GFP_ATOMIC );else nskb =skb_clone (skb,GFP_ATOMIC );
@@ -529,8 +531,8 @@ static void can_can_gw_rcv(struct sk_buff *skb, void *data) cf = (struct canfd_frame *)nskb->data;/* perform preprocessed modification functions if there are any */ -while (modidx <MAX_MODFUNCTIONS && gwj->mod.modfunc[modidx]) - (*gwj->mod.modfunc[modidx++])(cf, &gwj->mod); +while (modidx <MAX_MODFUNCTIONS && mod->modfunc[modidx]) + (*mod->modfunc[modidx++])(cf, mod);/* Has the CAN frame been modified? */ if (modidx) {
@@ -546,11 +548,11 @@ static void can_can_gw_rcv(struct sk_buff *skb, void *data) }/* check for checksum updates */ -if (gwj->mod.csumfunc.crc8) - (*gwj->mod.csumfunc.crc8)(cf, &gwj->mod.csum.crc8); +if (mod->csumfunc.crc8) + (*mod->csumfunc.crc8)(cf, &mod->csum.crc8); -if (gwj->mod.csumfunc.xor) - (*gwj->mod.csumfunc.xor)(cf, &gwj->mod.csum.xor); +if (mod->csumfunc.xor) + (*mod->csumfunc.xor)(cf, &mod->csum.xor); }/* clear the skb timestamp if not configured the other way */
@@ -581,9 +583,20 @@ static void cgw_job_free_rcu(struct rcu_head *rcu_head) { struct cgw_job *gwj = container_of(rcu_head, struct cgw_job, rcu); +/* cgw_job::cf_mod is always accessed from the same cgw_job object within +* the same RCU read section. Once cgw_job is scheduled for removal, +* cf_mod can also be removed without mandating an additional grace period. +*/ +kfree (rcu_access_pointer (gwj->cf_mod));kmem_cache_free (cgw_cache, gwj); } +/* Return cgw_job::cf_mod with RTNL protected section */ +static struct cf_mod *cgw_job_cf_mod (struct cgw_job *gwj) +{ +return rcu_dereference_protected (gwj->cf_mod,rtnl_is_locked ()); +} +static int cgw_notifier (struct notifier_block *nb,unsigned long msg,void *ptr) {
@@ -616,6 +629,7 @@ static int cgw_put_job(struct sk_buff *skb, struct cgw_job *gwj, int type, {struct rtcanmsg *rtcan;struct nlmsghdr *nlh; +struct cf_mod *mod; nlh =nlmsg_put (skb, pid, seq, type,sizeof (*rtcan), flags);if (!nlh)
@@ -650,82 +664,83 @@ static int cgw_put_job(struct sk_buff *skb, struct cgw_job *gwj, int type, goto cancel; } + mod =cgw_job_cf_mod (gwj);if (gwj->flags &CGW_FLAGS_CAN_FD ) {struct cgw_fdframe_mod mb; -if (gwj->mod.modtype.and) { -memcpy (&mb.cf, &gwj->mod.modframe.and,sizeof (mb.cf)); - mb.modtype = gwj->mod.modtype.and; +if (mod->modtype.and) { +memcpy (&mb.cf, &mod->modframe.and,sizeof (mb.cf)); + mb.modtype = mod->modtype.and;if (nla_put (skb,CGW_FDMOD_AND ,sizeof (mb), &mb) <0 ) goto cancel; } -if (gwj->mod.modtype.or) { -memcpy (&mb.cf, &gwj->mod.modframe.or,sizeof (mb.cf)); - mb.modtype = gwj->mod.modtype.or; +if (mod->modtype.or) { +memcpy (&mb.cf, &mod->modframe.or,sizeof (mb.cf)); + mb.modtype = mod->modtype.or;if (nla_put (skb,CGW_FDMOD_OR ,sizeof (mb), &mb) <0 ) goto cancel; } -if (gwj->mod.modtype.xor) { -memcpy (&mb.cf, &gwj->mod.modframe.xor,sizeof (mb.cf)); - mb.modtype = gwj->mod.modtype.xor; +if (mod->modtype.xor) { +memcpy (&mb.cf, &mod->modframe.xor,sizeof (mb.cf)); + mb.modtype = mod->modtype.xor;if (nla_put (skb,CGW_FDMOD_XOR ,sizeof (mb), &mb) <0 ) goto cancel; } -if (gwj->mod.modtype.set) { -memcpy (&mb.cf, &gwj->mod.modframe.set,sizeof (mb.cf)); - mb.modtype = gwj->mod.modtype.set; +if (mod->modtype.set) { +memcpy (&mb.cf, &mod->modframe.set,sizeof (mb.cf)); + mb.modtype = mod->modtype.set;if (nla_put (skb,CGW_FDMOD_SET ,sizeof (mb), &mb) <0 ) goto cancel; } }else {struct cgw_frame_mod mb; -if (gwj->mod.modtype.and) { -memcpy (&mb.cf, &gwj->mod.modframe.and,sizeof (mb.cf)); - mb.modtype = gwj->mod.modtype.and; +if (mod->modtype.and) { +memcpy (&mb.cf, &mod->modframe.and,sizeof (mb.cf)); + mb.modtype = mod->modtype.and;if (nla_put (skb,CGW_MOD_AND ,sizeof (mb), &mb) <0 ) goto cancel; } -if (gwj->mod.modtype.or) { -memcpy (&mb.cf, &gwj->mod.modframe.or,sizeof (mb.cf)); - mb.modtype = gwj->mod.modtype.or; +if (mod->modtype.or) { +memcpy (&mb.cf, &mod->modframe.or,sizeof (mb.cf)); + mb.modtype = mod->modtype.or;if (nla_put (skb,CGW_MOD_OR ,sizeof (mb), &mb) <0 ) goto cancel; } -if (gwj->mod.modtype.xor) { -memcpy (&mb.cf, &gwj->mod.modframe.xor,sizeof (mb.cf)); - mb.modtype = gwj->mod.modtype.xor; +if (mod->modtype.xor) { +memcpy (&mb.cf, &mod->modframe.xor,sizeof (mb.cf)); + mb.modtype = mod->modtype.xor;if (nla_put (skb,CGW_MOD_XOR ,sizeof (mb), &mb) <0 ) goto cancel; } -if (gwj->mod.modtype.set) { -memcpy (&mb.cf, &gwj->mod.modframe.set,sizeof (mb.cf)); - mb.modtype = gwj->mod.modtype.set; +if (mod->modtype.set) { +memcpy (&mb.cf, &mod->modframe.set,sizeof (mb.cf)); + mb.modtype = mod->modtype.set;if (nla_put (skb,CGW_MOD_SET ,sizeof (mb), &mb) <0 ) goto cancel; } } -if (gwj->mod.uid) { -if (nla_put_u32 (skb,CGW_MOD_UID , gwj->mod.uid) <0 ) +if (mod->uid) { +if (nla_put_u32 (skb,CGW_MOD_UID , mod->uid) <0 ) goto cancel; } -if (gwj->mod.csumfunc.crc8) { +if (mod->csumfunc.crc8) {if (nla_put (skb,CGW_CS_CRC8 ,CGW_CS_CRC8_LEN , - &gwj->mod.csum.crc8) <0 ) + &mod->csum.crc8) <0 ) goto cancel; } -if (gwj->mod.csumfunc.xor) { +if (mod->csumfunc.xor) {if (nla_put (skb,CGW_CS_XOR ,CGW_CS_XOR_LEN , - &gwj->mod.csum.xor) <0 ) + &mod->csum.xor) <0 ) goto cancel; }
@@ -1059,7 +1074,7 @@ static int cgw_create_job(struct sk_buff *skb, struct nlmsghdr *nlh,struct net *net =sock_net (skb->sk);struct rtcanmsg *r;struct cgw_job *gwj; -struct cf_mod mod; +struct cf_mod *mod;struct can_can_gw ccgw;u8 limhops =0 ;int err =0 ;
@@ -1078,37 +1093,48 @@ static int cgw_create_job(struct sk_buff *skb, struct nlmsghdr *nlh,if (r->gwtype !=CGW_TYPE_CAN_CAN )return -EINVAL ; - err =cgw_parse_attr (nlh, &mod,CGW_TYPE_CAN_CAN , &ccgw, &limhops); + mod =kmalloc (sizeof (*mod),GFP_KERNEL ); +if (!mod) +return -ENOMEM ; + + err =cgw_parse_attr (nlh, mod,CGW_TYPE_CAN_CAN , &ccgw, &limhops);if (err <0 ) -return err; + goto out_free_cf; -if (mod.uid) { +if (mod->uid) {ASSERT_RTNL ();/* check for updating an existing job with identical uid */ hlist_for_each_entry (gwj, &net->can.cgw_list, list) { -if (gwj->mod.uid != mod.uid) +struct cf_mod *old_cf; + + old_cf =cgw_job_cf_mod (gwj); +if (old_cf->uid != mod->uid)continue ;/* interfaces & filters must be identical */ -if (memcmp (&gwj->ccgw, &ccgw,sizeof (ccgw))) -return -EINVAL ; +if (memcmp (&gwj->ccgw, &ccgw,sizeof (ccgw))) { + err = -EINVAL ; + goto out_free_cf; + } -/* update modifications with disabled softirq & quit */ -local_bh_disable (); -memcpy (&gwj->mod, &mod,sizeof (mod)); -local_bh_enable (); +rcu_assign_pointer (gwj->cf_mod, mod); +kfree_rcu_mightsleep (old_cf);return 0 ; } }/* ifindex == 0 is not allowed for job creation */ -if (!ccgw.src_idx || !ccgw.dst_idx) -return -ENODEV ; +if (!ccgw.src_idx || !ccgw.dst_idx) { + err = -ENODEV ; + goto out_free_cf; + } gwj =kmem_cache_alloc (cgw_cache,GFP_KERNEL ); -if (!gwj) -return -ENOMEM ; +if (!gwj) { + err = -ENOMEM ; + goto out_free_cf; + } gwj->handled_frames =0 ; gwj->dropped_frames =0 ;
@@ -1118,7 +1144,7 @@ static int cgw_create_job(struct sk_buff *skb, struct nlmsghdr *nlh, gwj->limit_hops = limhops;/* insert already parsed information */ -memcpy (&gwj->mod, &mod,sizeof (mod)); +RCU_INIT_POINTER (gwj->cf_mod, mod);memcpy (&gwj->ccgw, &ccgw,sizeof (ccgw)); err = -ENODEV ;
@@ -1145,9 +1171,11 @@ static int cgw_create_job(struct sk_buff *skb, struct nlmsghdr *nlh,if (!err)hlist_add_head_rcu (&gwj->list, &net->can.cgw_list); out: -if (err) +if (err) {kmem_cache_free (cgw_cache, gwj); - +out_free_cf: +kfree (mod); + }return err; }
@@ -1207,19 +1235,22 @@ static int cgw_remove_job(struct sk_buff *skb, struct nlmsghdr *nlh,/* remove only the first matching entry */ hlist_for_each_entry_safe (gwj, nx, &net->can.cgw_list, list) { +struct cf_mod *cf_mod; +if (gwj->flags != r->flags)continue ;if (gwj->limit_hops != limhops)continue ; + cf_mod =cgw_job_cf_mod (gwj);/* we have a match when uid is enabled and identical */ -if (gwj->mod.uid || mod.uid) { -if (gwj->mod.uid != mod.uid) +if (cf_mod->uid || mod.uid) { +if (cf_mod->uid != mod.uid)continue ; }else {/* no uid => check for identical modifications */ -if (memcmp (&gwj->mod, &mod,sizeof (mod))) +if (memcmp (cf_mod, &mod,sizeof (mod)))continue ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 13/92 ipv4: Drop tos parameter from flowi4_update_output()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Nault <[email protected]>
[ Upstream commit 3f06760c00f56c5fe6c7f3361c2cf64becee1174 ]
Callers of flowi4_update_output() never try to update ->flowi4_tos:
* ip_route_connect() updates ->flowi4_tos with its own current value.
* ip_route_newports() has two users: tcp_v4_connect() and
dccp_v4_connect. Both initialise fl4 with ip_route_connect(), which
in turn sets ->flowi4_tos with RT_TOS(inet_sk(sk)->tos) and
->flowi4_scope based on SOCK_LOCALROUTE.
Then ip_route_newports() updates ->flowi4_tos with
RT_CONN_FLAGS(sk), which is the same as RT_TOS(inet_sk(sk)->tos),
unless SOCK_LOCALROUTE is set on the socket. In that case, the
lowest order bit is set to 1, to eventually inform
ip_route_output_key_hash() to restrict the scope to RT_SCOPE_LINK.
This is equivalent to properly setting ->flowi4_scope as
ip_route_connect() did. * ip_vs_xmit.c initialises ->flowi4_tos with memset(0), then calls flowi4_update_output() with tos=0.
* sctp_v4_get_dst() uses the same RT_CONN_FLAGS_TOS() when
initialising ->flowi4_tos and when calling flowi4_update_output().
In the end, ->flowi4_tos never changes. So let's just drop the tos parameter. This will simplify the conversion of ->flowi4_tos from __u8 to dscp_t.
Stable-dep-of: e34090d7214e ("ipvs: fix uninit-value for saddr in do_output_route4")
--- include/net/flow.h | 3 +-- include/net/route.h | 6 ++---- net/netfilter/ipvs/ip_vs_xmit.c | 4 ++-- net/sctp/protocol.c | 4 +--- 4 files changed, 6 insertions(+), 11 deletions(-)
include/net/flow.h +1 -2
@@ -115,11 +115,10 @@ static inline void flowi4_init_output(struct flowi4 *fl4, int oif, }/* Reset some input parameters after previous lookup */ -static inline void flowi4_update_output (struct flowi4 *fl4,int oif,__u8 tos, +static inline void flowi4_update_output (struct flowi4 *fl4,int oif,__be32 daddr,__be32 saddr) { fl4->flowi4_oif = oif; - fl4->flowi4_tos = tos; fl4->daddr = daddr; fl4->saddr = saddr; }
include/net/route.h +2 -4
@@ -325,8 +325,7 @@ static inline struct rtable *ip_route_connect(struct flowi4 *fl4, __be32 dst,if (IS_ERR (rt))return rt;ip_rt_put (rt); -flowi4_update_output (fl4, oif, fl4->flowi4_tos, fl4->daddr, - fl4->saddr); +flowi4_update_output (fl4, oif, fl4->daddr, fl4->saddr); }security_sk_classify_flow (sk,flowi4_to_flowi_common (fl4));return ip_route_output_flow (net, fl4, sk);
@@ -341,8 +340,7 @@ static inline struct rtable *ip_route_newports(struct flowi4 *fl4, struct rtable fl4->fl4_dport = dport; fl4->fl4_sport = sport;ip_rt_put (rt); -flowi4_update_output (fl4, sk->sk_bound_dev_if, -RT_CONN_FLAGS (sk), fl4->daddr, +flowi4_update_output (fl4, sk->sk_bound_dev_if, fl4->daddr, fl4->saddr);security_sk_classify_flow (sk,flowi4_to_flowi_common (fl4));return ip_route_output_flow (sock_net (sk), fl4, sk);
net/netfilter/ipvs/ip_vs_xmit.c +2 -2
@@ -139,7 +139,7 @@ static struct rtable *do_output_route4(struct net *net, __be32 daddr,if (PTR_ERR (rt) == -EINVAL && *saddr && rt_mode &IP_VS_RT_MODE_CONNECT && !loop) { *saddr =0 ; -flowi4_update_output (&fl4,0 ,0 , daddr,0 ); +flowi4_update_output (&fl4,0 , daddr,0 ); goto retry; }IP_VS_DBG_RL ("ip_route_output error, dest: %pI4\n" , &daddr);
@@ -147,7 +147,7 @@ static struct rtable *do_output_route4(struct net *net, __be32 daddr, }else if (!*saddr && rt_mode &IP_VS_RT_MODE_CONNECT && fl4.saddr) {ip_rt_put (rt); *saddr = fl4.saddr; -flowi4_update_output (&fl4,0 ,0 , daddr, fl4.saddr); +flowi4_update_output (&fl4,0 , daddr, fl4.saddr); loop = true; goto retry; }
net/sctp/protocol.c +1 -3
@@ -497,9 +497,7 @@ static void sctp_v4_get_dst(struct sctp_transport *t, union sctp_addr *saddr,continue ; fl4->fl4_sport = laddr->a.v4.sin_port; -flowi4_update_output (fl4, - asoc->base.sk->sk_bound_dev_if, -RT_CONN_FLAGS_TOS (asoc->base.sk, tos), +flowi4_update_output (fl4, asoc->base.sk->sk_bound_dev_if, daddr->v4.sin_addr.s_addr, laddr->a.v4.sin_addr.s_addr);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 14/92 ipvs: fix uninit-value for saddr in do_output_route4
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Anastasov <[email protected]>
[ Upstream commit e34090d7214e0516eb8722aee295cb2507317c07 ]
syzbot reports for uninit-value for the saddr argument [1]. commit 4754957f04f5 ("ipvs: do not use random local source address for tunnels") already implies that the input value of saddr should be ignored but the code is still reading it which can prevent to connect the route. Fix it by changing the argument to ret_saddr.
[1]
BUG: KMSAN: uninit-value in do_output_route4+0x42c/0x4d0 net/netfilter/ipvs/ip_vs_xmit.c:147 do_output_route4+0x42c/0x4d0 net/netfilter/ipvs/ip_vs_xmit.c:147 __ip_vs_get_out_rt+0x403/0x21d0 net/netfilter/ipvs/ip_vs_xmit.c:330 ip_vs_tunnel_xmit+0x205/0x2380 net/netfilter/ipvs/ip_vs_xmit.c:1136 ip_vs_in_hook+0x1aa5/0x35b0 net/netfilter/ipvs/ip_vs_core.c:2063 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf7/0x400 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:269 [inline] __ip_local_out+0x758/0x7e0 net/ipv4/ip_output.c:118 ip_local_out net/ipv4/ip_output.c:127 [inline] ip_send_skb+0x6a/0x3c0 net/ipv4/ip_output.c:1501 udp_send_skb+0xfda/0x1b70 net/ipv4/udp.c:1195 udp_sendmsg+0x2fe3/0x33c0 net/ipv4/udp.c:1483 inet_sendmsg+0x1fc/0x280 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg+0x267/0x380 net/socket.c:727 ____sys_sendmsg+0x91b/0xda0 net/socket.c:2566 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2620 __sys_sendmmsg+0x41d/0x880 net/socket.c:2702 __compat_sys_sendmmsg net/compat.c:360 [inline] __do_compat_sys_sendmmsg net/compat.c:367 [inline] __se_compat_sys_sendmmsg net/compat.c:364 [inline] __ia32_compat_sys_sendmmsg+0xc8/0x140 net/compat.c:364 ia32_sys_call+0x3ffa/0x41f0 arch/x86/include/generated/asm/syscalls_32.h:346 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] __do_fast_syscall_32+0xb0/0x110 arch/x86/entry/syscall_32.c:306 do_fast_syscall_32+0x38/0x80 arch/x86/entry/syscall_32.c:331 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/syscall_32.c:369 entry_SYSENTER_compat_after_hwframe+0x84/0x8e
Uninit was created at:
slab_post_alloc_hook mm/slub.c:4167 [inline] slab_alloc_node mm/slub.c:4210 [inline] __kmalloc_cache_noprof+0x8fa/0xe00 mm/slub.c:4367 kmalloc_noprof include/linux/slab.h:905 [inline] ip_vs_dest_dst_alloc net/netfilter/ipvs/ip_vs_xmit.c:61 [inline] __ip_vs_get_out_rt+0x35d/0x21d0 net/netfilter/ipvs/ip_vs_xmit.c:323 ip_vs_tunnel_xmit+0x205/0x2380 net/netfilter/ipvs/ip_vs_xmit.c:1136 ip_vs_in_hook+0x1aa5/0x35b0 net/netfilter/ipvs/ip_vs_core.c:2063 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf7/0x400 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:269 [inline] __ip_local_out+0x758/0x7e0 net/ipv4/ip_output.c:118 ip_local_out net/ipv4/ip_output.c:127 [inline] ip_send_skb+0x6a/0x3c0 net/ipv4/ip_output.c:1501 udp_send_skb+0xfda/0x1b70 net/ipv4/udp.c:1195 udp_sendmsg+0x2fe3/0x33c0 net/ipv4/udp.c:1483 inet_sendmsg+0x1fc/0x280 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg+0x267/0x380 net/socket.c:727 ____sys_sendmsg+0x91b/0xda0 net/socket.c:2566 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2620 __sys_sendmmsg+0x41d/0x880 net/socket.c:2702 __compat_sys_sendmmsg net/compat.c:360 [inline] __do_compat_sys_sendmmsg net/compat.c:367 [inline] __se_compat_sys_sendmmsg net/compat.c:364 [inline] __ia32_compat_sys_sendmmsg+0xc8/0x140 net/compat.c:364 ia32_sys_call+0x3ffa/0x41f0 arch/x86/include/generated/asm/syscalls_32.h:346 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] __do_fast_syscall_32+0xb0/0x110 arch/x86/entry/syscall_32.c:306 do_fast_syscall_32+0x38/0x80 arch/x86/entry/syscall_32.c:331 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/syscall_32.c:369 entry_SYSENTER_compat_after_hwframe+0x84/0x8e CPU: 0 UID: 0 PID: 22408 Comm: syz.4.5165 Not tainted 6.15.0-rc3-syzkaller-00019-gbc3372351d0c #0 PREEMPT(undef) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
--- net/netfilter/ipvs/ip_vs_xmit.c | 27 ++++++++------------------- 1 file changed, 8 insertions(+), 19 deletions(-)
net/netfilter/ipvs/ip_vs_xmit.c +8 -19
@@ -119,13 +119,12 @@ __mtu_check_toobig_v6(const struct sk_buff *skb, u32 mtu)return false; } -/* Get route to daddr, update *saddr, optionally bind route to saddr */ +/* Get route to daddr, optionally bind route to saddr */ static struct rtable *do_output_route4 (struct net *net,__be32 daddr, -int rt_mode,__be32 *saddr) +int rt_mode,__be32 *ret_saddr) {struct flowi4 fl4;struct rtable *rt; -bool loop = false;memset (&fl4,0 ,sizeof (fl4)); fl4.daddr = daddr;
@@ -135,23 +134,17 @@ static struct rtable *do_output_route4(struct net *net, __be32 daddr, retry: rt =ip_route_output_key (net, &fl4);if (IS_ERR (rt)) { -/* Invalid saddr ? */ -if (PTR_ERR (rt) == -EINVAL && *saddr && - rt_mode &IP_VS_RT_MODE_CONNECT && !loop) { - *saddr =0 ; -flowi4_update_output (&fl4,0 , daddr,0 ); - goto retry; - }IP_VS_DBG_RL ("ip_route_output error, dest: %pI4\n" , &daddr);return NULL ; - }else if (!*saddr && rt_mode &IP_VS_RT_MODE_CONNECT && fl4.saddr) { + } +if (rt_mode &IP_VS_RT_MODE_CONNECT && fl4.saddr) {ip_rt_put (rt); - *saddr = fl4.saddr;flowi4_update_output (&fl4,0 , daddr, fl4.saddr); - loop = true; + rt_mode =0 ; goto retry; } - *saddr = fl4.saddr; +if (ret_saddr) + *ret_saddr = fl4.saddr;return rt; }
@@ -344,19 +337,15 @@ __ip_vs_get_out_rt(struct netns_ipvs *ipvs, int skb_af, struct sk_buff *skb,if (ret_saddr) *ret_saddr = dest_dst->dst_saddr.ip; }else { -__be32 saddr =htonl (INADDR_ANY ); - noref =0 ;/* For such unconfigured boxes avoid many route lookups * for performance reasons because we do not remember saddr */ rt_mode &= ~IP_VS_RT_MODE_CONNECT ; - rt =do_output_route4 (net, daddr, rt_mode, &saddr); + rt =do_output_route4 (net, daddr, rt_mode, ret_saddr);if (!rt) goto err_unreach; -if (ret_saddr) - *ret_saddr = saddr; } local = (rt->rt_flags &RTCF_LOCAL ) ?1 :0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 15/92 netfilter: ipset: fix region locking in hash types
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jozsef Kadlecsik <[email protected]>
[ Upstream commit 8478a729c0462273188263136880480729e9efca ]
Region locking introduced in v5.6-rc4 contained three macros to handle the region locks: ahash_bucket_start(), ahash_bucket_end() which gave back the start and end hash bucket values belonging to a given region lock and ahash_region() which should give back the region lock belonging to a given hash bucket. The latter was incorrect which can lead to a race condition between the garbage collector and adding new elements when a hash type of set is defined with timeouts.
--- net/netfilter/ipset/ip_set_hash_gen.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/ipset/ip_set_hash_gen.h +1 -1
@@ -63,7 +63,7 @@ struct hbucket {#define ahash_sizeof_regions (htable_bits) \ (ahash_numof_locks(htable_bits) * sizeof(struct ip_set_region))#define ahash_region (n, htable_bits) \ - ((n) % ahash_numof_locks(htable_bits)) + ((n) / jhash_size(HTABLE_REGION_BITS))#define ahash_bucket_start (h, htable_bits) \ ((htable_bits) < HTABLE_REGION_BITS ? 0 \ : (h) * jhash_size(HTABLE_REGION_BITS))
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 16/92 bpf: Scrub packet on bpf_redirect_peer
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Chaignon <[email protected]>
[ Upstream commit c4327229948879814229b46aa26a750718888503 ]
When bpf_redirect_peer is used to redirect packets to a device in another network namespace, the skb isn't scrubbed. That can lead skb information from one namespace to be "misused" in another namespace.
As one example, this is causing Cilium to drop traffic when using bpf_redirect_peer to redirect packets that just went through IPsec decryption to a container namespace. The following pwru trace shows (1) the packet path from the host's XFRM layer to the container's XFRM layer where it's dropped and (2) the number of active skb extensions at each function.
NETNS MARK IFACE TUPLE FUNC
4026533547 d00 eth0 10.244.3.124:35473->10.244.2.158:53 xfrm_rcv_cb
.active_extensions = (__u8)2,
4026533547 d00 eth0 10.244.3.124:35473->10.244.2.158:53 xfrm4_rcv_cb
.active_extensions = (__u8)2,
4026533547 d00 eth0 10.244.3.124:35473->10.244.2.158:53 gro_cells_receive
.active_extensions = (__u8)2,
[...]
4026533547 0 eth0 10.244.3.124:35473->10.244.2.158:53 skb_do_redirect
.active_extensions = (__u8)2,
4026534999 0 eth0 10.244.3.124:35473->10.244.2.158:53 ip_rcv
.active_extensions = (__u8)2,
4026534999 0 eth0 10.244.3.124:35473->10.244.2.158:53 ip_rcv_core
.active_extensions = (__u8)2,
[...]
4026534999 0 eth0 10.244.3.124:35473->10.244.2.158:53 udp_queue_rcv_one_skb
.active_extensions = (__u8)2,
4026534999 0 eth0 10.244.3.124:35473->10.244.2.158:53 __xfrm_policy_check
.active_extensions = (__u8)2,
4026534999 0 eth0 10.244.3.124:35473->10.244.2.158:53 __xfrm_decode_session
.active_extensions = (__u8)2,
4026534999 0 eth0 10.244.3.124:35473->10.244.2.158:53 security_xfrm_decode_session
.active_extensions = (__u8)2,
4026534999 0 eth0 10.244.3.124:35473->10.244.2.158:53 kfree_skb_reason(SKB_DROP_REASON_XFRM_POLICY)
.active_extensions = (__u8)2,In this case, there are no XFRM policies in the container's network namespace so the drop is unexpected. When we decrypt the IPsec packet, the XFRM state used for decryption is set in the skb extensions. This information is preserved across the netns switch. When we reach the XFRM policy check in the container's netns, __xfrm_policy_check drops the packet with LINUX_MIB_XFRMINNOPOLS because a (container-side) XFRM policy can't be found that matches the (host-side) XFRM state used for decryption.
This patch fixes this by scrubbing the packet when using bpf_redirect_peer, as is done on typical netns switches via veth devices except skb->mark and skb->tstamp are not zeroed.
--- net/core/filter.c | 1 + 1 file changed, 1 insertion(+)
net/core/filter.c +1 -0
@@ -2500,6 +2500,7 @@ int skb_do_redirect(struct sk_buff *skb) goto out_drop; skb->dev = dev;dev_sw_netstats_rx_add (dev, skb->len); +skb_scrub_packet (skb, false);return -EAGAIN ; } return flags & BPF_F_NEIGH ?
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 17/92 net: dsa: b53: allow leaky reserved multicast
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <[email protected]>
[ Upstream commit 5f93185a757ff38b36f849c659aeef368db15a68 ]
Allow reserved multicast to ignore VLAN membership so STP and other management protocols work without a PVID VLAN configured when using a vlan aware bridge.
--- drivers/net/dsa/b53/b53_common.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/dsa/b53/b53_common.c +4 -2
@@ -373,9 +373,11 @@ static void b53_enable_vlan(struct b53_device *dev, int port, bool enable,b53_read8 (dev,B53_VLAN_PAGE ,B53_VLAN_CTRL5 , &vc5); } + vc1 &= ~VC1_RX_MCST_FWD_EN ; +if (enable) { vc0 |=VC0_VLAN_EN |VC0_VID_CHK_EN |VC0_VID_HASH_VID ; - vc1 |=VC1_RX_MCST_UNTAG_EN |VC1_RX_MCST_FWD_EN ; + vc1 |=VC1_RX_MCST_UNTAG_EN ; vc4 &= ~VC4_ING_VID_CHECK_MASK ;if (enable_filtering) { vc4 |=VC4_ING_VID_VIO_DROP <<VC4_ING_VID_CHECK_S ;
@@ -393,7 +395,7 @@ static void b53_enable_vlan(struct b53_device *dev, int port, bool enable, }else { vc0 &= ~(VC0_VLAN_EN |VC0_VID_CHK_EN |VC0_VID_HASH_VID ); - vc1 &= ~(VC1_RX_MCST_UNTAG_EN |VC1_RX_MCST_FWD_EN ); + vc1 &= ~VC1_RX_MCST_UNTAG_EN ; vc4 &= ~VC4_ING_VID_CHECK_MASK ; vc5 &= ~VC5_DROP_VTABLE_MISS ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 18/92 net: dsa: b53: fix clearing PVID of a port
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <[email protected]>
[ Upstream commit f480851981043d9bb6447ca9883ade9247b9a0ad ]
Currently the PVID of ports are only set when adding/updating VLANs with PVID set or removing VLANs, but not when clearing the PVID flag of a VLAN.
E.g. the following flow
$ ip link add br0 type bridge vlan_filtering 1 $ ip link set sw1p1 master bridge $ bridge vlan add dev sw1p1 vid 10 pvid untagged $ bridge vlan add dev sw1p1 vid 10 untagged
Would keep the PVID set as 10, despite the flag being cleared. Fix this by checking if we need to unset the PVID on vlan updates.
--- drivers/net/dsa/b53/b53_common.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
drivers/net/dsa/b53/b53_common.c +11 -2
@@ -1477,12 +1477,21 @@ int b53_vlan_add(struct dsa_switch *ds, int port,bool untagged = vlan->flags &BRIDGE_VLAN_INFO_UNTAGGED ;bool pvid = vlan->flags &BRIDGE_VLAN_INFO_PVID ;struct b53_vlan *vl; +u16 old_pvid, new_pvid;int err; err =b53_vlan_prepare (ds, port, vlan);if (err)return err; +b53_read16 (dev,B53_VLAN_PAGE ,B53_VLAN_PORT_DEF_TAG (port), &old_pvid); +if (pvid) + new_pvid = vlan->vid; +else if (!pvid && vlan->vid == old_pvid) + new_pvid =b53_default_pvid (dev); +else + new_pvid = old_pvid; + vl = &dev->vlans[vlan->vid];b53_get_vlan_entry (dev, vlan->vid, vl);
@@ -1499,9 +1508,9 @@ int b53_vlan_add(struct dsa_switch *ds, int port,b53_set_vlan_entry (dev, vlan->vid, vl);b53_fast_age_vlan (dev, vlan->vid); -if (pvid && !dsa_is_cpu_port (ds, port)) { +if (!dsa_is_cpu_port (ds, port) && new_pvid != old_pvid) {b53_write16 (dev,B53_VLAN_PAGE ,B53_VLAN_PORT_DEF_TAG (port), - vlan->vid); + new_pvid);b53_fast_age_vlan (dev, vlan->vid); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 19/92 net: dsa: b53: fix flushing old pvid VLAN on pvid change
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <[email protected]>
[ Upstream commit 083c6b28c0cbcd83b6af1a10f2c82937129b3438 ]
Presumably the intention here was to flush the VLAN of the old pvid, not the added VLAN again, which we already flushed before.
--- drivers/net/dsa/b53/b53_common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/dsa/b53/b53_common.c +1 -1
@@ -1511,7 +1511,7 @@ int b53_vlan_add(struct dsa_switch *ds, int port,if (!dsa_is_cpu_port (ds, port) && new_pvid != old_pvid) {b53_write16 (dev,B53_VLAN_PAGE ,B53_VLAN_PORT_DEF_TAG (port), new_pvid); -b53_fast_age_vlan (dev, vlan->vid); +b53_fast_age_vlan (dev, old_pvid); }return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 20/92 net: dsa: b53: fix VLAN ID for untagged vlan on bridge leave
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <[email protected]>
[ Upstream commit a1c1901c5cc881425cc45992ab6c5418174e9e5a ]
The untagged default VLAN is added to the default vlan, which may be one, but we modify the VLAN 0 entry on bridge leave.
Fix this to use the correct VLAN entry for the default pvid.
--- drivers/net/dsa/b53/b53_common.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/dsa/b53/b53_common.c +2 -1
@@ -1923,7 +1923,7 @@ EXPORT_SYMBOL(b53_br_join);void b53_br_leave (struct dsa_switch *ds,int port,struct dsa_bridge bridge) {struct b53_device *dev = ds->priv; -struct b53_vlan *vl = &dev->vlans[0 ]; +struct b53_vlan *vl;s8 cpu_port =dsa_to_port (ds, port)->cpu_dp->index;unsigned int i;u16 pvlan, reg, pvid;
@@ -1949,6 +1949,7 @@ void b53_br_leave(struct dsa_switch *ds, int port, struct dsa_bridge bridge) dev->ports[port].vlan_ctl_mask = pvlan; pvid =b53_default_pvid (dev); + vl = &dev->vlans[pvid];/* Make this port join all VLANs without VLAN entries */ if (is58xx (dev)) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 21/92 net: dsa: b53: always rejoin default untagged VLAN on bridge leave
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <[email protected]>
[ Upstream commit 13b152ae40495966501697693f048f47430c50fd ]
While JOIN_ALL_VLAN allows to join all VLANs, we still need to keep the default VLAN enabled so that untagged traffic stays untagged.
So rejoin the default VLAN even for switches with JOIN_ALL_VLAN support.
--- drivers/net/dsa/b53/b53_common.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/net/dsa/b53/b53_common.c +5 -5
@@ -1958,12 +1958,12 @@ void b53_br_leave(struct dsa_switch *ds, int port, struct dsa_bridge bridge)if (!(reg &BIT (cpu_port))) reg |=BIT (cpu_port);b53_write16 (dev,B53_VLAN_PAGE ,B53_JOIN_ALL_VLAN_EN , reg); - }else { -b53_get_vlan_entry (dev, pvid, vl); - vl->members |=BIT (port) |BIT (cpu_port); - vl->untag |=BIT (port) |BIT (cpu_port); -b53_set_vlan_entry (dev, pvid, vl); } + +b53_get_vlan_entry (dev, pvid, vl); + vl->members |=BIT (port) |BIT (cpu_port); + vl->untag |=BIT (port) |BIT (cpu_port); +b53_set_vlan_entry (dev, pvid, vl); }EXPORT_SYMBOL (b53_br_leave);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 22/92 net: dsa: b53: fix learning on VLAN unaware bridges
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <[email protected]>
[ Upstream commit 9f34ad89bcf0e6df6f8b01f1bdab211493fc66d1 ]
When VLAN filtering is off, we configure the switch to forward, but not learn on VLAN table misses. This effectively disables learning while not filtering.
Fix this by switching to forward and learn. Setting the learning disable register will still control whether learning actually happens.
--- drivers/net/dsa/b53/b53_common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/dsa/b53/b53_common.c +1 -1
@@ -383,7 +383,7 @@ static void b53_enable_vlan(struct b53_device *dev, int port, bool enable, vc4 |=VC4_ING_VID_VIO_DROP <<VC4_ING_VID_CHECK_S ; vc5 |=VC5_DROP_VTABLE_MISS ; }else { - vc4 |=VC4_ING_VID_VIO_FWD <<VC4_ING_VID_CHECK_S ; + vc4 |=VC4_NO_ING_VID_CHK <<VC4_ING_VID_CHECK_S ; vc5 &= ~VC5_DROP_VTABLE_MISS ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 23/92 Input: mtk-pmic-keys - fix possible null pointer dereference
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gary Bisson <[email protected]>
commit 11cdb506d0fbf5ac05bf55f5afcb3a215c316490 upstream.
In mtk_pmic_keys_probe, the regs parameter is only set if the button is parsed in the device tree. However, on hardware where the button is left floating, that node will most likely be removed not to enable that input. In that case the code will try to dereference a null pointer.
Let's use the regs struct instead as it is defined for all supported platforms. Note that it is ok setting the key reg even if that latter is disabled as the interrupt won't be enabled anyway.
--- drivers/input/keyboard/mtk-pmic-keys.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/input/keyboard/mtk-pmic-keys.c +2 -2
@@ -133,8 +133,8 @@ static void mtk_pmic_keys_lp_reset_setupu32 value, mask;int error; - kregs_home = keys->keys[MTK_PMIC_HOMEKEY_INDEX ].regs; - kregs_pwr = keys->keys[MTK_PMIC_PWRKEY_INDEX ].regs; + kregs_home = ®s->keys_regs[MTK_PMIC_HOMEKEY_INDEX ]; + kregs_pwr = ®s->keys_regs[MTK_PMIC_PWRKEY_INDEX ]; error =of_property_read_u32 (keys->dev->of_node,"power-off-time-sec" , &long_press_debounce);
Greg Kroah-Hartman
maintainerPATCH 24/92 Input: synaptics - enable InterTouch on Dynabook Portege X30-D
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manuel Fombuena <[email protected]>
commit 6d7ea0881000966607772451b789b5fb5766f11d upstream.
[ 5.989588] psmouse serio1: synaptics: Your touchpad (PNP: TOS0213 PNP0f03) says it can support a different bus. If i2c-hid and hid-rmi are not used, you might want to try setting psmouse.synaptics_intertouch to 1 and report this to [email protected]. [ 6.039923] psmouse serio1: synaptics: Touchpad model: 1, fw: 9.32, id: 0x1e2a1, caps: 0xf00223/0x840300/0x12e800/0x52d884, board id: 3322, fw id: 2658004
The board is labelled TM3322.
Present on the Toshiba / Dynabook Portege X30-D and possibly others.
Confirmed working well with psmouse.synaptics_intertouch=1 and local build.
--- drivers/input/mouse/synaptics.c | 1 + 1 file changed, 1 insertion(+)
drivers/input/mouse/synaptics.c +1 -0
@@ -194,6 +194,7 @@ static const char * const smbus_pnp_ids["SYN3221" ,/* HP 15-ay000 */ "SYN323d" ,/* HP Spectre X360 13-w013dx */ "SYN3257" ,/* HP Envy 13-ad105ng */ +"TOS0213" ,/* Dynabook Portege X30-D */ NULL };
Greg Kroah-Hartman
maintainerPATCH 25/92 Input: synaptics - enable InterTouch on Dynabook Portege X30L-G
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aditya Garg <[email protected]>
commit 47d768b32e644b56901bb4bbbdb1feb01ea86c85 upstream.
Enable InterTouch mode on Dynabook Portege X30L-G by adding "TOS01f6" to the list of SMBus-enabled variants.
--- drivers/input/mouse/synaptics.c | 1 + 1 file changed, 1 insertion(+)
drivers/input/mouse/synaptics.c +1 -0
@@ -194,6 +194,7 @@ static const char * const smbus_pnp_ids["SYN3221" ,/* HP 15-ay000 */ "SYN323d" ,/* HP Spectre X360 13-w013dx */ "SYN3257" ,/* HP Envy 13-ad105ng */ +"TOS01f6" ,/* Dynabook Portege X30L-G */ "TOS0213" ,/* Dynabook Portege X30-D */ NULL };
Greg Kroah-Hartman
maintainerPATCH 26/92 Input: synaptics - enable InterTouch on Dell Precision M3800
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aditya Garg <[email protected]>
commit a609cb4cc07aa9ab8f50466622814356c06f2c17 upstream.
Enable InterTouch mode on Dell Precision M3800 by adding "DLL060d" to the list of SMBus-enabled variants.
--- drivers/input/mouse/synaptics.c | 1 + 1 file changed, 1 insertion(+)
drivers/input/mouse/synaptics.c +1 -0
@@ -163,6 +163,7 @@ static const char * const topbuttonpad_pstatic const char *const smbus_pnp_ids[] = {/* all of the topbuttonpad_pnp_ids are valid, we just add some extras */ +"DLL060d" ,/* Dell Precision M3800 */ "LEN0048" ,/* X1 Carbon 3 */ "LEN0046" ,/* X250 */ "LEN0049" ,/* Yoga 11e */
Greg Kroah-Hartman
maintainerPATCH 27/92 Input: synaptics - enable SMBus for HP Elitebook 850 G1
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
commit f04f03d3e99bc8f89b6af5debf07ff67d961bc23 upstream.
The kernel reports that the touchpad for this device can support SMBus mode.
--- drivers/input/mouse/synaptics.c | 1 + 1 file changed, 1 insertion(+)
drivers/input/mouse/synaptics.c +1 -0
@@ -190,6 +190,7 @@ static const char * const smbus_pnp_ids["LEN2054" ,/* E480 */ "LEN2055" ,/* E580 */ "LEN2068" ,/* T14 Gen 1 */ +"SYN3003" ,/* HP EliteBook 850 G1 */ "SYN3015" ,/* HP EliteBook 840 G2 */ "SYN3052" ,/* HP EliteBook 840 G4 */ "SYN3221", /* HP 15-ay000 */
Greg Kroah-Hartman
maintainerPATCH 28/92 Input: synaptics - enable InterTouch on TUXEDO InfinityBook Pro 14 v5
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aditya Garg <[email protected]>
commit 2abc698ac77314e0de5b33a6d96a39c5159d88e4 upstream.
Enable InterTouch mode on TUXEDO InfinityBook Pro 14 v5 by adding "SYN1221" to the list of SMBus-enabled variants.
Add support for InterTouch on SYN1221 by adding it to the list of SMBus-enabled variants.
--- drivers/input/mouse/synaptics.c | 1 + 1 file changed, 1 insertion(+)
drivers/input/mouse/synaptics.c +1 -0
@@ -190,6 +190,7 @@ static const char * const smbus_pnp_ids["LEN2054" ,/* E480 */ "LEN2055" ,/* E580 */ "LEN2068" ,/* T14 Gen 1 */ +"SYN1221" ,/* TUXEDO InfinityBook Pro 14 v5 */ "SYN3003" ,/* HP EliteBook 850 G1 */ "SYN3015" ,/* HP EliteBook 840 G2 */ "SYN3052", /* HP EliteBook 840 G4 */
Greg Kroah-Hartman
maintainerPATCH 29/92 staging: iio: adc: ad7816: Correct conditional logic for store mode
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabriel Shahrouzi <[email protected]>
commit 2e922956277187655ed9bedf7b5c28906e51708f upstream.
The mode setting logic in ad7816_store_mode was reversed due to incorrect handling of the strcmp return value. strcmp returns 0 on match, so the if (strcmp(buf, "full")) block executed when the input was not "full".
This resulted in "full" setting the mode to AD7816_PD (power-down) and other inputs setting it to AD7816_FULL.
Fix this by checking it against 0 to correctly check for "full" and "power-down", mapping them to AD7816_FULL and AD7816_PD respectively.
--- drivers/staging/iio/adc/ad7816.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/iio/adc/ad7816.c +1 -1
@@ -136,7 +136,7 @@ static ssize_t ad7816_store_mode(structstruct iio_dev *indio_dev =dev_to_iio_dev (dev);struct ad7816_chip_info *chip =iio_priv (indio_dev); -if (strcmp (buf,"full" )) { +if (strcmp (buf,"full" ) ==0 ) {gpiod_set_value (chip->rdwr_pin,1 ); chip->mode =AD7816_FULL ; }else {
Greg Kroah-Hartman
maintainerPATCH 30/92 staging: axis-fifo: Remove hardware resets for user errors
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabriel Shahrouzi <[email protected]>
commit c6e8d85fafa7193613db37da29c0e8d6e2515b13 upstream.
The axis-fifo driver performs a full hardware reset (via reset_ip_core()) in several error paths within the read and write functions. This reset flushes both TX and RX FIFOs and resets the AXI-Stream links.
Allow the user to handle the error without causing hardware disruption or data loss in other FIFO paths.
--- drivers/staging/axis-fifo/axis-fifo.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-)
drivers/staging/axis-fifo/axis-fifo.c +3 -8
@@ -400,16 +400,14 @@ static ssize_t axis_fifo_read(struct fil bytes_available =ioread32 (fifo->base_addr +XLLF_RLR_OFFSET );if (!bytes_available) { -dev_err (fifo->dt_device,"received a packet of length 0 - fifo core will be reset\n" ); -reset_ip_core (fifo); +dev_err (fifo->dt_device,"received a packet of length 0\n" ); ret = -EIO ; goto end_unlock; }if (bytes_available > len) { -dev_err (fifo->dt_device,"user read buffer too small (available bytes=%zu user buffer bytes=%zu) - fifo core will be reset\n" , +dev_err (fifo->dt_device,"user read buffer too small (available bytes=%zu user buffer bytes=%zu)\n" , bytes_available, len); -reset_ip_core (fifo); ret = -EINVAL ; goto end_unlock; }
@@ -418,8 +416,7 @@ static ssize_t axis_fifo_read(struct fil/* this probably can't happen unless IP * registers were previously mishandled */ -dev_err (fifo->dt_device,"received a packet that isn't word-aligned - fifo core will be reset\n" ); -reset_ip_core (fifo); +dev_err (fifo->dt_device,"received a packet that isn't word-aligned\n" ); ret = -EIO ; goto end_unlock; }
@@ -440,7 +437,6 @@ static ssize_t axis_fifo_read(struct filif (copy_to_user (buf + copied *sizeof (u32), tmp_buf, copy *sizeof (u32))) { -reset_ip_core (fifo); ret = -EFAULT ; goto end_unlock; }
@@ -549,7 +545,6 @@ static ssize_t axis_fifo_write(struct fiif (copy_from_user (tmp_buf, buf + copied *sizeof (u32), copy *sizeof (u32))) { -reset_ip_core (fifo); ret = -EFAULT ; goto end_unlock; }
Greg Kroah-Hartman
maintainerPATCH 31/92 staging: axis-fifo: Correct handling of tx_fifo_depth for size validation
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabriel Shahrouzi <[email protected]>
commit 2ca34b508774aaa590fc3698a54204706ecca4ba upstream.
Remove erroneous subtraction of 4 from the total FIFO depth read from device tree. The stored depth is for checking against total capacity, not initial vacancy. This prevented writes near the FIFO's full size.
The check performed just before data transfer, which uses live reads of the TDFV register to determine current vacancy, correctly handles the initial Depth - 4 hardware state and subsequent FIFO fullness.
--- drivers/staging/axis-fifo/axis-fifo.c | 3 --- 1 file changed, 3 deletions(-)
drivers/staging/axis-fifo/axis-fifo.c +0 -3
@@ -777,9 +777,6 @@ static int axis_fifo_parse_dt(struct axi goto end; } -/* IP sets TDFV to fifo depth - 4 so we will do the same */ - fifo->tx_fifo_depth -=4 ; - ret =get_dts_property (fifo,"xlnx,use-rx-data" , &fifo->has_rx_fifo);if (ret) {dev_err (fifo->dt_device,"missing xlnx,use-rx-data property\n" );
Greg Kroah-Hartman
maintainerPATCH 32/92 x86/mm: Eliminate window where TLB flushes may be inadvertently skipped
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Hansen <[email protected]>
commit fea4e317f9e7e1f449ce90dedc27a2d2a95bee5a upstream.
tl;dr: There is a window in the mm switching code where the new CR3 is set and the CPU should be getting TLB flushes for the new mm. But should_flush_tlb() has a bug and suppresses the flush. Fix it by widening the window where should_flush_tlb() sends an IPI.
Long Version:
=== History ===
There were a few things leading up to this.
First, updating mm_cpumask() was observed to be too expensive, so it was made lazier. But being lazy caused too many unnecessary IPIs to CPUs due to the now-lazy mm_cpumask(). So code was added to cull mm_cpumask() periodically[2]. But that culling was a bit too aggressive and skipped sending TLB flushes to CPUs that need them. So here we are again.
=== Problem ===
The too-aggressive code in should_flush_tlb() strikes in this window:
// Turn on IPIs for this CPU/mm combination, but only
// if should_flush_tlb() agrees:
cpumask_set_cpu(cpu, mm_cpumask(next));
next_tlb_gen = atomic64_read(&next->context.tlb_gen);
choose_new_asid(next, next_tlb_gen, &new_asid, &need_flush);
load_new_mm_cr3(need_flush);
// ^ After 'need_flush' is set to false, IPIs *MUST*
// be sent to this CPU and not be ignored.
this_cpu_write(cpu_tlbstate.loaded_mm, next);
// ^ Not until this point does should_flush_tlb()
// become true!should_flush_tlb() will suppress TLB flushes between load_new_mm_cr3() and writing to 'loaded_mm', which is a window where they should not be suppressed. Whoops.
=== Solution ===
Thankfully, the fuzzy "just about to write CR3" window is already marked with loaded_mm==LOADED_MM_SWITCHING. Simply checking for that state in should_flush_tlb() is sufficient to ensure that the CPU is targeted with an IPI.
This will cause more TLB flush IPIs. But the window is relatively small and I do not expect this to cause any kind of measurable performance impact.
Update the comment where LOADED_MM_SWITCHING is written since it grew yet another user.
Peter Z also raised a concern that should_flush_tlb() might not observe 'loaded_mm' and 'is_lazy' in the same order that switch_mm_irqs_off() writes them. Add a barrier to ensure that they are observed in the order they are written.
--- arch/x86/mm/tlb.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-)
arch/x86/mm/tlb.c +21 -2
@@ -617,7 +617,11 @@ void switch_mm_irqs_off(struct mm_structchoose_new_asid (next, next_tlb_gen, &new_asid, &need_flush); -/* Let nmi_uaccess_okay() know that we're changing CR3. */ +/* +* Indicate that CR3 is about to change. nmi_uaccess_okay() +* and others are sensitive to the window where mm_cpumask(), +* CR3 and cpu_tlbstate.loaded_mm are not all in sync. +*/ this_cpu_write (cpu_tlbstate.loaded_mm,LOADED_MM_SWITCHING );barrier (); }
@@ -880,8 +884,16 @@ done:static bool should_flush_tlb (int cpu,void *data) { +struct mm_struct *loaded_mm =per_cpu (cpu_tlbstate.loaded_mm, cpu);struct flush_tlb_info *info = data; +/* +* Order the 'loaded_mm' and 'is_lazy' against their +* write ordering in switch_mm_irqs_off(). Ensure +* 'is_lazy' is at least as new as 'loaded_mm'. +*/ +smp_rmb (); +/* Lazy TLB will get flushed at the next context switch. */ if (per_cpu (cpu_tlbstate_shared.is_lazy, cpu))return false;
@@ -890,8 +902,15 @@ static bool should_flush_tlb(int cpu, voif (!info->mm)return true; +/* +* While switching, the remote CPU could have state from +* either the prev or next mm. Assume the worst and flush. +*/ +if (loaded_mm ==LOADED_MM_SWITCHING ) +return true; +/* The target mm is loaded, and the CPU is not lazy. */ -if (per_cpu (cpu_tlbstate.loaded_mm, cpu) == info->mm) +if (loaded_mm == info->mm)return true;/* In cpumask, but not the loaded mm? Periodically remove by flushing. */
Greg Kroah-Hartman
maintainerPATCH 33/92 drm/amd/display: Shift DMUB AUX reply command if necessary
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wayne Lin <[email protected]>
commit 5a3846648c0523fd850b7f0aec78c0139453ab8b upstream.
[Why]
Defined value of dmub AUX reply command field get updated but didn't adjust dm receiving side accordingly.
[How]
Check the received reply command value to see if it's updated version or not. Adjust it if necessary.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +4 -1
@@ -10702,8 +10702,11 @@ int amdgpu_dm_process_dmub_aux_transfer_ goto out; } + payload->reply[0 ] = adev->dm.dmub_notify->aux_reply.command &0xF ; +if (adev->dm.dmub_notify->aux_reply.command &0xF0 ) +/* The reply is stored in the top nibble of the command. */ + payload->reply[0 ] = (adev->dm.dmub_notify->aux_reply.command >>4 ) &0xF ; - payload->reply[0 ] = adev->dm.dmub_notify->aux_reply.command;if (!payload->write && p_notify->aux_reply.length && (payload->reply[0 ] ==AUX_TRANSACTION_REPLY_AUX_ACK )) {
Greg Kroah-Hartman
maintainerPATCH 34/92 iio: adc: ad7606: fix serial register access
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Angelo Dureghello <[email protected]>
commit f083f8a21cc785ebe3a33f756a3fa3660611f8db upstream.
Fix register read/write routine as per datasheet.
When reading multiple consecutive registers, only the first one is read properly. This is due to missing chip select deassert and assert again between first and second 16bit transfer, as shown in the datasheet AD7606C-16, rev 0, figure 110.
--- drivers/iio/adc/ad7606_spi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/adc/ad7606_spi.c +1 -1
@@ -127,7 +127,7 @@ static int ad7606_spi_reg_read(struct ad { .tx_buf = &st->d16[0], .len = 2, - .cs_change = 0, + .cs_change = 1, }, { .rx_buf = &st->d16[1], .len = 2,
Greg Kroah-Hartman
maintainerPATCH 35/92 iio: adis16201: Correct inclinometer channel resolution
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabriel Shahrouzi <[email protected]>
commit 609bc31eca06c7408e6860d8b46311ebe45c1fef upstream.
The inclinometer channels were previously defined with 14 realbits. However, the ADIS16201 datasheet states the resolution for these output channels is 12 bits (Page 14, text description; Page 15, table 7).
Correct the realbits value to 12 to accurately reflect the hardware.
--- drivers/iio/accel/adis16201.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/iio/accel/adis16201.c +2 -2
@@ -211,9 +211,9 @@ static const struct iio_chan_spec adis16 BIT(IIO_CHAN_INFO_CALIBBIAS), 0, 14),ADIS_AUX_ADC_CHAN (ADIS16201_AUX_ADC_REG ,ADIS16201_SCAN_AUX_ADC ,0 ,12 ),ADIS_INCLI_CHAN (X ,ADIS16201_XINCL_OUT_REG ,ADIS16201_SCAN_INCLI_X , -BIT (IIO_CHAN_INFO_CALIBBIAS ),0 ,14 ), +BIT (IIO_CHAN_INFO_CALIBBIAS ),0 ,12 ),ADIS_INCLI_CHAN (Y ,ADIS16201_YINCL_OUT_REG ,ADIS16201_SCAN_INCLI_Y , -BIT (IIO_CHAN_INFO_CALIBBIAS ),0 ,14 ), +BIT (IIO_CHAN_INFO_CALIBBIAS ),0 ,12 ), IIO_CHAN_SOFT_TIMESTAMP(7) };
Greg Kroah-Hartman
maintainerPATCH 36/92 iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Silvano Seva <[email protected]>
commit 159ca7f18129834b6f4c7eae67de48e96c752fc9 upstream.
Prevent st_lsm6dsx_read_fifo from falling in an infinite loop in case pattern_len is equal to zero and the device FIFO is not empty.
--- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c +3 -0
@@ -370,6 +370,9 @@ int st_lsm6dsx_read_fifo(struct st_lsm6dif (fifo_status &cpu_to_le16 (ST_LSM6DSX_FIFO_EMPTY_MASK ))return 0 ; +if (!pattern_len) + pattern_len =ST_LSM6DSX_SAMPLE_SIZE ; + fifo_len = (le16_to_cpu (fifo_status) & fifo_diff_mask) *ST_LSM6DSX_CHAN_SIZE ; fifo_len = (fifo_len / pattern_len) * pattern_len;
Greg Kroah-Hartman
maintainerPATCH 37/92 iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Silvano Seva <[email protected]>
commit 8114ef86e2058e2554111b793596f17bee23fa15 upstream.
Prevent st_lsm6dsx_read_tagged_fifo from falling in an infinite loop in case pattern_len is equal to zero and the device FIFO is not empty.
--- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c +3 -0
@@ -590,6 +590,9 @@ int st_lsm6dsx_read_tagged_fifo(struct sif (!fifo_len)return 0 ; +if (!pattern_len) + pattern_len =ST_LSM6DSX_TAGGED_SAMPLE_SIZE ; +for (read_len =0 ; read_len < fifo_len; read_len += pattern_len) { err = st_lsm6dsx_read_block(hw, ST_LSM6DSX_REG_FIFO_OUT_TAG_ADDR,
Greg Kroah-Hartman
maintainerPATCH 38/92 drm/v3d: Add job to pending list if the reset was skipped
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maíra Canal <[email protected]>
commit 35e4079bf1a2570abffce6ababa631afcf8ea0e5 upstream.
When a CL/CSD job times out, we check if the GPU has made any progress since the last timeout. If so, instead of resetting the hardware, we skip the reset and let the timer get rearmed. This gives long-running jobs a chance to complete.
However, when timedout_job() is called, the job in question is removed from the pending list, which means it won't be automatically freed through free_job(). Consequently, when we skip the reset and keep the job running, the job won't be freed when it finally completes.
This situation leads to a memory leak, as exposed in [1] and [2].
Similarly to commit 704d3d60fec4 ("drm/etnaviv: don't block scheduler when GPU is still active"), this patch ensures the job is put back on the pending list when extending the timeout.
--- drivers/gpu/drm/v3d/v3d_sched.c | 28 +++++++++++++++++++++------- 1 file changed, 21 insertions(+), 7 deletions(-)
drivers/gpu/drm/v3d/v3d_sched.c +21 -7
@@ -289,11 +289,16 @@ v3d_gpu_reset_for_timeout(struct v3d_devreturn DRM_GPU_SCHED_STAT_NOMINAL ; } -/* If the current address or return address have changed, then the GPU -* has probably made progress and we should delay the reset. This -* could fail if the GPU got in an infinite loop in the CL, but that -* is pretty unlikely outside of an i-g-t testcase. -*/ +static void +v3d_sched_skip_reset (struct drm_sched_job *sched_job) +{ +struct drm_gpu_scheduler *sched = sched_job->sched; + +spin_lock (&sched->job_list_lock); +list_add (&sched_job->list, &sched->pending_list); +spin_unlock (&sched->job_list_lock); +} +static enum drm_gpu_sched_stat v3d_cl_job_timedout (struct drm_sched_job *sched_job,enum v3d_queue q,u32 *timedout_ctca,u32 *timedout_ctra)
@@ -303,9 +308,16 @@ v3d_cl_job_timedout(struct drm_sched_jobu32 ctca =V3D_CORE_READ (0 ,V3D_CLE_CTNCA (q));u32 ctra =V3D_CORE_READ (0 ,V3D_CLE_CTNRA (q)); +/* If the current address or return address have changed, then the GPU +* has probably made progress and we should delay the reset. This +* could fail if the GPU got in an infinite loop in the CL, but that +* is pretty unlikely outside of an i-g-t testcase. +*/ if (*timedout_ctca != ctca || *timedout_ctra != ctra) { *timedout_ctca = ctca; *timedout_ctra = ctra; + +v3d_sched_skip_reset (sched_job);return DRM_GPU_SCHED_STAT_NOMINAL ; }
@@ -345,11 +357,13 @@ v3d_csd_job_timedout(struct drm_sched_jostruct v3d_dev *v3d = job->base.v3d;u32 batches =V3D_CORE_READ (0 ,V3D_CSD_CURRENT_CFG4 ); -/* If we've made progress, skip reset and let the timer get -* rearmed. +/* If we've made progress, skip reset, add the job to the pending +* list, and let the timer get rearmed. */ if (job->timedout_batches != batches) { job->timedout_batches = batches; + +v3d_sched_skip_reset (sched_job);return DRM_GPU_SCHED_STAT_NOMINAL ; }
Greg Kroah-Hartman
maintainerPATCH 39/92 drm/amd/display: Fix the checking condition in dmub aux handling
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wayne Lin <[email protected]>
commit bc70e11b550d37fbd9eaed0f113ba560894f1609 upstream.
[Why & How]
Fix the checking condition for detecting AUX_RET_ERROR_PROTOCOL_ERROR. It was wrongly checking by "not equals to"
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +1 -1
@@ -10693,7 +10693,7 @@ int amdgpu_dm_process_dmub_aux_transfer_* Transient states before tunneling is enabled could * lead to this error. We can ignore this for now. */ -if (p_notify->result !=AUX_RET_ERROR_PROTOCOL_ERROR ) { +if (p_notify->result ==AUX_RET_ERROR_PROTOCOL_ERROR ) {DRM_WARN ("DPIA AUX failed on 0x%x(%d), error %d\n" , payload->address, payload->length, p_notify->result);
Greg Kroah-Hartman
maintainerPATCH 40/92 drm/amd/display: Remove incorrect checking in dmub aux handler
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wayne Lin <[email protected]>
commit 396dc51b3b7ea524bf8061f478332d0039e96d5d upstream.
[Why & How]
"Request length != reply length" is expected behavior defined in spec. It's not an invalid reply. Besides, replied data handling logic is not designed to be written in amdgpu_dm_process_dmub_aux_transfer_sync(). Remove the incorrectly handling section.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +1 -11
@@ -10708,19 +10708,9 @@ int amdgpu_dm_process_dmub_aux_transfer_ payload->reply[0 ] = (adev->dm.dmub_notify->aux_reply.command >>4 ) &0xF ;if (!payload->write && p_notify->aux_reply.length && - (payload->reply[0 ] ==AUX_TRANSACTION_REPLY_AUX_ACK )) { - -if (payload->length != p_notify->aux_reply.length) { -DRM_WARN ("invalid read length %d from DPIA AUX 0x%x(%d)!\n" , - p_notify->aux_reply.length, - payload->address, payload->length); - *operation_result =AUX_RET_ERROR_INVALID_REPLY ; - goto out; - } - + (payload->reply[0 ] ==AUX_TRANSACTION_REPLY_AUX_ACK ))memcpy (payload->data, p_notify->aux_reply.data, p_notify->aux_reply.length); - }/* success */ ret = p_notify->aux_reply.length;
Greg Kroah-Hartman
maintainerPATCH 41/92 drm/amd/display: Fix wrong handling for AUX_DEFER case
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wayne Lin <[email protected]>
commit 65924ec69b29296845c7f628112353438e63ea56 upstream.
[Why]
We incorrectly ack all bytes get written when the reply actually is defer. When it's defer, means sink is not ready for the request. We should retry the request.
[How]
Only reply all data get written when receive I2C_ACK|AUX_ACK. Otherwise, reply the number of actual written bytes received from the sink. Add some messages to facilitate debugging as well.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 28 ++++++++++-- 1 file changed, 24 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c +24 -4
@@ -55,6 +55,9 @@ bool is_timing_changed(struct dc_stream_ struct dc_stream_state *new_stream); +/* +* This function handles both native AUX and I2C-Over-AUX transactions. +*/ static ssize_t dm_dp_aux_transfer (struct drm_dp_aux *aux,struct drm_dp_aux_msg *msg) {
@@ -91,15 +94,25 @@ static ssize_t dm_dp_aux_transfer(structif (adev->dm.aux_hpd_discon_quirk) {if (msg->address ==DP_SIDEBAND_MSG_DOWN_REQ_BASE && operation_result ==AUX_RET_ERROR_HPD_DISCON ) { - result =0 ; + result = msg->size; operation_result =AUX_RET_SUCCESS ; } } -if (payload.write && result >=0 ) - result = msg->size; +/* +* result equals to 0 includes the cases of AUX_DEFER/I2C_DEFER +*/ +if (payload.write && result >=0 ) { +if (result) { +/*one byte indicating partially written bytes. Force 0 to retry*/ +drm_info (adev_to_drm (adev),"amdgpu: AUX partially written\n" ); + result =0 ; + }else if (!payload.reply[0 ]) +/*I2C_ACK|AUX_ACK*/ + result = msg->size; + } -if (result <0 ) +if (result <0 ) {switch (operation_result) {case AUX_RET_SUCCESS :break ;
@@ -118,6 +131,13 @@ static ssize_t dm_dp_aux_transfer(structbreak ; } +drm_info (adev_to_drm (adev),"amdgpu: DP AUX transfer fail:%d\n" , operation_result); + } + +if (payload.reply[0 ]) +drm_info (adev_to_drm (adev),"amdgpu: AUX reply command not ACK: 0x%02x." , + payload.reply[0 ]); +return result; }
Greg Kroah-Hartman
maintainerPATCH 42/92 drm/amd/display: Copy AUX read reply data whenever length > 0
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wayne Lin <[email protected]>
commit 3924f45d4de7250a603fd7b50379237a6a0e5adf upstream.
[Why]amdgpu_dm_process_dmub_aux_transfer_sync() should return all exact data reply from the sink side. Don't do the analysis job in it.
[How]
Remove unnecessary check condition AUX_TRANSACTION_REPLY_AUX_ACK.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +1 -2
@@ -10707,8 +10707,7 @@ int amdgpu_dm_process_dmub_aux_transfer_/* The reply is stored in the top nibble of the command. */ payload->reply[0 ] = (adev->dm.dmub_notify->aux_reply.command >>4 ) &0xF ; -if (!payload->write && p_notify->aux_reply.length && - (payload->reply[0 ] ==AUX_TRANSACTION_REPLY_AUX_ACK )) +if (!payload->write && p_notify->aux_reply.length)memcpy (payload->data, p_notify->aux_reply.data, p_notify->aux_reply.length);
Greg Kroah-Hartman
maintainerPATCH 43/92 drm/amdgpu/hdp5.2: use memcfg register to post the write for HDP flush
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit dbc988c689333faeeed44d5561f372ff20395304 upstream.
Reading back the remapped HDP flush register seems to cause problems on some platforms. All we need is a read, so read back the memcfg register.
--- drivers/gpu/drm/amd/amdgpu/hdp_v5_2.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/hdp_v5_2.c +11 -1
@@ -34,7 +34,17 @@ static void hdp_v5_2_flush_hdp(struct amif (!ring || !ring->funcs->emit_wreg) {WREG32_NO_KIQ ((adev->rmmio_remap.reg_offset +KFD_MMIO_REMAP_HDP_MEM_FLUSH_CNTL ) >>2 ,0 ); -RREG32_NO_KIQ ((adev->rmmio_remap.reg_offset +KFD_MMIO_REMAP_HDP_MEM_FLUSH_CNTL ) >>2 ); +if (amdgpu_sriov_vf (adev)) { +/* this is fine because SR_IOV doesn't remap the register */ +RREG32_NO_KIQ ((adev->rmmio_remap.reg_offset +KFD_MMIO_REMAP_HDP_MEM_FLUSH_CNTL ) >>2 ); + }else { +/* We just need to read back a register to post the write. +* Reading back the remapped register causes problems on +* some platforms so just read back the memory size register. +*/ +if (adev->nbio.funcs->get_memsize) + adev->nbio.funcs->get_memsize (adev); + } }else { amdgpu_ring_emit_wreg(ring, (adev->rmmio_remap.reg_offset + KFD_MMIO_REMAP_HDP_MEM_FLUSH_CNTL) >> 2,
Greg Kroah-Hartman
maintainerPATCH 44/92 usb: uhci-platform: Make the clock really optional
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Charkov <[email protected]>
commit a5c7973539b010874a37a0e846e62ac6f00553ba upstream.
Device tree bindings state that the clock is optional for UHCI platform controllers, and some existing device trees don't provide those - such as those for VIA/WonderMedia devices.
The driver however fails to probe now if no clock is provided, because devm_clk_get returns an error pointer in such case.
Switch to devm_clk_get_optional instead, so that it could probe again on those platforms where no clocks are given.
--- drivers/usb/host/uhci-platform.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/host/uhci-platform.c +1 -1
@@ -122,7 +122,7 @@ static int uhci_hcd_platform_probe(struc }/* Get and enable clock if any specified */ - uhci->clk =devm_clk_get (&pdev->dev,NULL ); + uhci->clk =devm_clk_get_optional (&pdev->dev,NULL );if (IS_ERR (uhci->clk)) { ret =PTR_ERR (uhci->clk); goto err_rmr;
Greg Kroah-Hartman
maintainerPATCH 45/92 xenbus: Use kref to track req lifetime
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Andryuk <[email protected]>
commit 1f0304dfd9d217c2f8b04a9ef4b3258a66eedd27 upstream.
Marek reported seeing a NULL pointer fault in the xenbus_thread callstack:
BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: e030:__wake_up_common+0x4c/0x180 Call Trace: <TASK> __wake_up_common_lock+0x82/0xd0 process_msg+0x18e/0x2f0 xenbus_thread+0x165/0x1c0
process_msg+0x18e is req->cb(req). req->cb is set to xs_wake_up(), a thin wrapper around wake_up(), or xenbus_dev_queue_reply(). It seems like it was xs_wake_up() in this case.
It seems like req may have woken up the xs_wait_for_reply(), which kfree()ed the req. When xenbus_thread resumes, it faults on the zero-ed data.
Linux Device Drivers 2nd edition states:
"Normally, a wake_up call can cause an immediate reschedule to happen, meaning that other processes might run before wake_up returns." ... which would match the behaviour observed.
Change to keeping two krefs on each request. One for the caller, and one for xenbus_thread. Each will kref_put() when finished, and the last will free it.
This use of kref matches the description inDocumentation/core-api/kref.rst
Message-ID: <[email protected]>
--- drivers/xen/xenbus/xenbus.h | 2 ++ drivers/xen/xenbus/xenbus_comms.c | 9 ++++----- drivers/xen/xenbus/xenbus_dev_frontend.c | 2 +- drivers/xen/xenbus/xenbus_xs.c | 18 ++++++++++++++++-- 4 files changed, 23 insertions(+), 8 deletions(-)
drivers/xen/xenbus/xenbus.h +2 -0
@@ -77,6 +77,7 @@ enum xb_req_state {struct xb_req_data {struct list_head list;wait_queue_head_t wq; +struct kref kref;struct xsd_sockmsg msg;uint32_t caller_req_id;enum xsd_sockmsg_type type;
@@ -103,6 +104,7 @@ int xb_init_comms(void);void xb_deinit_comms (void );int xs_watch_msg (struct xs_watch_event *event);void xs_request_exit (struct xb_req_data *req); +void xs_free_req (struct kref *kref);int xenbus_match (struct device *_dev,struct device_driver *_drv);int xenbus_dev_probe (struct device *_dev);
drivers/xen/xenbus/xenbus_comms.c +4 -5
@@ -309,8 +309,8 @@ static int process_msg(void)virt_wmb (); req->state = xb_req_state_got_reply; req->cb (req); - }else -kfree (req); + } +kref_put (&req->kref, xs_free_req); }mutex_unlock (&xs_response_mutex);
@@ -386,14 +386,13 @@ static int process_writes(void) state.req->msg.type =XS_ERROR ; state.req->err = err;list_del (&state.req->list); -if (state.req->state == xb_req_state_aborted) -kfree (state.req); -else { +if (state.req->state != xb_req_state_aborted) {/* write err, then update state */ virt_wmb (); state.req->state = xb_req_state_got_reply;wake_up (&state.req->wq); } +kref_put (&state.req->kref, xs_free_req);mutex_unlock (&xb_write_mutex);
drivers/xen/xenbus/xenbus_dev_frontend.c +1 -1
@@ -406,7 +406,7 @@ void xenbus_dev_queue_reply(struct xb_remutex_unlock (&u->reply_mutex);kfree (req->body); -kfree (req); +kref_put (&req->kref, xs_free_req);kref_put (&u->kref, xenbus_file_free);
drivers/xen/xenbus/xenbus_xs.c +16 -2
@@ -112,6 +112,12 @@ static void xs_suspend_exit(void)wake_up_all (&xs_state_enter_wq); } +void xs_free_req (struct kref *kref) +{ + struct xb_req_data *req = container_of(kref, struct xb_req_data, kref); +kfree (req); +} +static uint32_t xs_request_enter (struct xb_req_data *req) {uint32_t rq_id;
@@ -237,6 +243,12 @@ static void xs_send(struct xb_req_data * req->caller_req_id = req->msg.req_id; req->msg.req_id =xs_request_enter (req); +/* +* Take 2nd ref. One for this thread, and the second for the +* xenbus_thread. +*/ +kref_get (&req->kref); +mutex_lock (&xb_write_mutex);list_add_tail (&req->list, &xb_write_list); notify =list_is_singular (&xb_write_list);
@@ -261,8 +273,8 @@ static void *xs_wait_for_reply(struct xbif (req->state == xb_req_state_queued || req->state == xb_req_state_wait_reply) req->state = xb_req_state_aborted; -else -kfree (req); + +kref_put (&req->kref, xs_free_req);mutex_unlock (&xb_write_mutex);return ret;
@@ -291,6 +303,7 @@ int xenbus_dev_request_and_reply(struct req->cb = xenbus_dev_queue_reply; req->par = par; req->user_req = true; +kref_init (&req->kref);xs_send (req, msg);
@@ -319,6 +332,7 @@ static void *xs_talkv(struct xenbus_tran req->num_vecs = num_vecs; req->cb = xs_wake_up; req->user_req = false; +kref_init (&req->kref); msg.req_id =0 ; msg.tx_id = t.id;
Greg Kroah-Hartman
maintainerPATCH 46/92 module: ensure that kobject_put() is safe for module type kobjects
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
commit a6aeb739974ec73e5217c75a7c008a688d3d5cf1 upstream.
In 'lookup_or_create_module_kobject()', an internal kobject is created using 'module_ktype'. So call to 'kobject_put()' on error handling path causes an attempt to use an uninitialized completion pointer in 'module_kobject_release()'. In this scenario, we just want to release kobject without an extra synchronization required for a regular module unloading process, so adding an extra check whether 'complete()' is actually required makes 'kobject_put()' safe.
--- kernel/params.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
kernel/params.c +3 -1
@@ -945,7 +945,9 @@ int module_sysfs_initialized;static void module_kobj_release (struct kobject *kobj) {struct module_kobject *mk =to_module_kobject (kobj); -complete (mk->kobj_completion); + +if (mk->kobj_completion) +complete (mk->kobj_completion); }struct kobj_type module_ktype = {
Greg Kroah-Hartman
maintainerPATCH 47/92 ocfs2: switch osb->disable_recovery to enum
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit c0fb83088f0cc4ee4706e0495ee8b06f49daa716 upstream.
Patch series "ocfs2: Fix deadlocks in quota recovery", v3.
This implements another approach to fixing quota recovery deadlocks. We avoid grabbing sb->s_umount semaphore from ocfs2_finish_quota_recovery() and instead stop quota recovery early in ocfs2_dismount_volume().
This patch (of 3):
We will need more recovery states than just pure enable / disable to fix deadlocks with quota recovery. Switch osb->disable_recovery to enum.
--- fs/ocfs2/journal.c | 14 ++++++++------ fs/ocfs2/ocfs2.h | 7 ++++++- 2 files changed, 14 insertions(+), 7 deletions(-)
fs/ocfs2/journal.c +8 -6
@@ -173,7 +173,7 @@ int ocfs2_recovery_init(struct ocfs2_supstruct ocfs2_recovery_map *rm;mutex_init (&osb->recovery_lock); - osb->disable_recovery =0 ; + osb->recovery_state =OCFS2_REC_ENABLED ; osb->recovery_thread_task =NULL ;init_waitqueue_head (&osb->recovery_event);
@@ -208,7 +208,7 @@ void ocfs2_recovery_exit(struct ocfs2_su/* disable any new recovery threads and wait for any currently * running ones to exit. Do this before setting the vol_state. */ mutex_lock (&osb->recovery_lock); - osb->disable_recovery =1 ; + osb->recovery_state =OCFS2_REC_DISABLED ;mutex_unlock (&osb->recovery_lock);wait_event (osb->recovery_event, !ocfs2_recovery_thread_running (osb));
@@ -1549,14 +1549,16 @@ bail:void ocfs2_recovery_thread (struct ocfs2_super *osb,int node_num) { +int was_set =-1 ; +mutex_lock (&osb->recovery_lock); +if (osb->recovery_state <OCFS2_REC_DISABLED ) + was_set =ocfs2_recovery_map_set (osb, node_num);trace_ocfs2_recovery_thread (node_num, osb->node_num, - osb->disable_recovery, osb->recovery_thread_task, - osb->disable_recovery ? --1 :ocfs2_recovery_map_set (osb, node_num)); + osb->recovery_state, osb->recovery_thread_task, was_set); -if (osb->disable_recovery) +if (osb->recovery_state ==OCFS2_REC_DISABLED ) goto out;if (osb->recovery_thread_task)
fs/ocfs2/ocfs2.h +6 -1
@@ -284,6 +284,11 @@ enum ocfs2_mount_options#define OCFS2_OSB_ERROR_FS 0x0004#define OCFS2_DEFAULT_ATIME_QUANTUM 60 +enum ocfs2_recovery_state { +OCFS2_REC_ENABLED =0 , +OCFS2_REC_DISABLED , +}; +struct ocfs2_journal ;struct ocfs2_slot_info ;struct ocfs2_recovery_map ;
@@ -346,7 +351,7 @@ struct ocfs2_superstruct ocfs2_recovery_map *recovery_map;struct ocfs2_replay_map *replay_map;struct task_struct *recovery_thread_task; -int disable_recovery; +enum ocfs2_recovery_state recovery_state;wait_queue_head_t checkpoint_event;struct ocfs2_journal *journal;unsigned long osb_commit_interval;
Greg Kroah-Hartman
maintainerPATCH 48/92 ocfs2: implement handshaking with ocfs2 recovery thread
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit 8f947e0fd595951460f5a6e1ac29baa82fa02eab upstream.
We will need ocfs2 recovery thread to acknowledge transitions of recovery_state when disabling particular types of recovery. This is similar to what currently happens when disabling recovery completely, just more general. Implement the handshake and use it for exit from recovery.
--- fs/ocfs2/journal.c | 52 +++++++++++++++++++++++++++++++++++----------------- fs/ocfs2/ocfs2.h | 4 ++++ 2 files changed, 39 insertions(+), 17 deletions(-)
fs/ocfs2/journal.c +35 -17
@@ -192,31 +192,48 @@ int ocfs2_recovery_init(struct ocfs2_supreturn 0 ; } -/* we can't grab the goofy sem lock from inside wait_event, so we use -* memory barriers to make sure that we'll see the null task before -* being woken up */ static int ocfs2_recovery_thread_running (struct ocfs2_super *osb) { -mb ();return osb->recovery_thread_task !=NULL ; } -void ocfs2_recovery_exit (struct ocfs2_super *osb) +static void ocfs2_recovery_disable (struct ocfs2_super *osb, +enum ocfs2_recovery_state state) { -struct ocfs2_recovery_map *rm; - -/* disable any new recovery threads and wait for any currently -* running ones to exit. Do this before setting the vol_state. */ mutex_lock (&osb->recovery_lock); - osb->recovery_state =OCFS2_REC_DISABLED ; +/* +* If recovery thread is not running, we can directly transition to +* final state. +*/ +if (!ocfs2_recovery_thread_running (osb)) { + osb->recovery_state = state +1 ; + goto out_lock; + } + osb->recovery_state = state; +/* Wait for recovery thread to acknowledge state transition */ +wait_event_cmd (osb->recovery_event, + !ocfs2_recovery_thread_running (osb) || + osb->recovery_state >= state +1 , +mutex_unlock (&osb->recovery_lock), +mutex_lock (&osb->recovery_lock)); +out_lock:mutex_unlock (&osb->recovery_lock); -wait_event (osb->recovery_event, !ocfs2_recovery_thread_running (osb)); -/* At this point, we know that no more recovery threads can be -* launched, so wait for any recovery completion work to -* complete. */ +/* +* At this point we know that no more recovery work can be queued so +* wait for any recovery completion work to complete. +*/ if (osb->ocfs2_wq)flush_workqueue (osb->ocfs2_wq); +} + +void ocfs2_recovery_exit (struct ocfs2_super *osb) +{ +struct ocfs2_recovery_map *rm; + +/* disable any new recovery threads and wait for any currently +* running ones to exit. Do this before setting the vol_state. */ +ocfs2_recovery_disable (osb,OCFS2_REC_WANT_DISABLE );/* * Now that recovery is shut down, and the osb is about to be
@@ -1536,7 +1553,8 @@ bail:ocfs2_free_replay_slots (osb); osb->recovery_thread_task =NULL ; -mb ();/* sync with ocfs2_recovery_thread_running */ +if (osb->recovery_state ==OCFS2_REC_WANT_DISABLE ) + osb->recovery_state =OCFS2_REC_DISABLED ;wake_up (&osb->recovery_event);mutex_unlock (&osb->recovery_lock);
@@ -1552,13 +1570,13 @@ void ocfs2_recovery_thread(struct ocfs2_int was_set =-1 ;mutex_lock (&osb->recovery_lock); -if (osb->recovery_state <OCFS2_REC_DISABLED ) +if (osb->recovery_state <OCFS2_REC_WANT_DISABLE ) was_set =ocfs2_recovery_map_set (osb, node_num);trace_ocfs2_recovery_thread (node_num, osb->node_num, osb->recovery_state, osb->recovery_thread_task, was_set); -if (osb->recovery_state ==OCFS2_REC_DISABLED ) +if (osb->recovery_state >=OCFS2_REC_WANT_DISABLE ) goto out;if (osb->recovery_thread_task)
fs/ocfs2/ocfs2.h +4 -0
@@ -286,6 +286,10 @@ enum ocfs2_mount_optionsenum ocfs2_recovery_state {OCFS2_REC_ENABLED =0 , +OCFS2_REC_WANT_DISABLE , +/* +* Must be OCFS2_REC_WANT_DISABLE + 1 for ocfs2_recovery_exit() to work +*/ OCFS2_REC_DISABLED , };
Greg Kroah-Hartman
maintainerPATCH 49/92 ocfs2: stop quota recovery before disabling quotas
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit fcaf3b2683b05a9684acdebda706a12025a6927a upstream.
Currently quota recovery is synchronized with unmount using sb->s_umount semaphore. That is however prone to deadlocks because flush_workqueue(osb->ocfs2_wq) called from umount code can wait for quota recovery to complete while ocfs2_finish_quota_recovery() waits for sb->s_umount semaphore.
Grabbing of sb->s_umount semaphore in ocfs2_finish_quota_recovery() is only needed to protect that function from disabling of quotas from ocfs2_dismount_volume(). Handle this problem by disabling quota recovery early during unmount in ocfs2_dismount_volume() instead so that we can drop acquisition of sb->s_umount from ocfs2_finish_quota_recovery().
--- fs/ocfs2/journal.c | 20 ++++++++++++++++++-- fs/ocfs2/journal.h | 1 + fs/ocfs2/ocfs2.h | 6 ++++++ fs/ocfs2/quota_local.c | 9 ++------- fs/ocfs2/super.c | 3 +++ 5 files changed, 30 insertions(+), 9 deletions(-)
fs/ocfs2/journal.c +18 -2
@@ -227,6 +227,11 @@ out_lock:flush_workqueue (osb->ocfs2_wq); } +void ocfs2_recovery_disable_quota (struct ocfs2_super *osb) +{ +ocfs2_recovery_disable (osb,OCFS2_REC_QUOTA_WANT_DISABLE ); +} +void ocfs2_recovery_exit (struct ocfs2_super *osb) {struct ocfs2_recovery_map *rm;
@@ -1456,6 +1461,18 @@ static int __ocfs2_recovery_thread(void } } restart: +if (quota_enabled) { +mutex_lock (&osb->recovery_lock); +/* Confirm that recovery thread will no longer recover quotas */ +if (osb->recovery_state ==OCFS2_REC_QUOTA_WANT_DISABLE ) { + osb->recovery_state =OCFS2_REC_QUOTA_DISABLED ; +wake_up (&osb->recovery_event); + } +if (osb->recovery_state >=OCFS2_REC_QUOTA_DISABLED ) + quota_enabled =0 ; +mutex_unlock (&osb->recovery_lock); + } + status =ocfs2_super_lock (osb,1 );if (status <0 ) {mlog_errno (status);
@@ -1559,8 +1576,7 @@ bail:mutex_unlock (&osb->recovery_lock); -if (quota_enabled) -kfree (rm_quota); +kfree (rm_quota);return status; }
fs/ocfs2/journal.h +1 -0
@@ -148,6 +148,7 @@ void ocfs2_wait_for_recovery(struct ocfsint ocfs2_recovery_init (struct ocfs2_super *osb);void ocfs2_recovery_exit (struct ocfs2_super *osb); +void ocfs2_recovery_disable_quota (struct ocfs2_super *osb);int ocfs2_compute_replay_slots (struct ocfs2_super *osb);void ocfs2_free_replay_slots (struct ocfs2_super *osb);
fs/ocfs2/ocfs2.h +6 -0
@@ -286,6 +286,12 @@ enum ocfs2_mount_optionsenum ocfs2_recovery_state {OCFS2_REC_ENABLED =0 , +OCFS2_REC_QUOTA_WANT_DISABLE , +/* +* Must be OCFS2_REC_QUOTA_WANT_DISABLE + 1 for +* ocfs2_recovery_disable_quota() to work. +*/ +OCFS2_REC_QUOTA_DISABLED ,OCFS2_REC_WANT_DISABLE ,/* * Must be OCFS2_REC_WANT_DISABLE + 1 for ocfs2_recovery_exit() to work
fs/ocfs2/quota_local.c +2 -7
@@ -453,8 +453,7 @@ out:/* Sync changes in local quota file into global quota file and * reinitialize local quota file. -* The function expects local quota file to be already locked and -* s_umount locked in shared mode. */ +* The function expects local quota file to be already locked. */ static int ocfs2_recover_local_quota_file (struct inode *lqinode,int type,struct ocfs2_quota_recovery *rec)
@@ -585,7 +584,6 @@ int ocfs2_finish_quota_recovery(struct o {unsigned int ino[OCFS2_MAXQUOTAS ] = {LOCAL_USER_QUOTA_SYSTEM_INODE ,LOCAL_GROUP_QUOTA_SYSTEM_INODE }; -struct super_block *sb = osb->sb;struct ocfs2_local_disk_dqinfo *ldinfo;struct buffer_head *bh;handle_t *handle;
@@ -597,7 +595,6 @@ int ocfs2_finish_quota_recovery(struct oprintk (KERN_NOTICE "ocfs2: Finishing quota recovery on device (%s) for " "slot %u\n" , osb->dev_str, slot_num); -down_read (&sb->s_umount);for (type =0 ; type <OCFS2_MAXQUOTAS ; type++) {if (list_empty (&(rec->r_list[type])))continue ;
@@ -674,7 +671,6 @@ out_put:break ; } out: -up_read (&sb->s_umount);kfree (rec);return status; }
@@ -840,8 +836,7 @@ static int ocfs2_local_free_info(structocfs2_release_local_quota_bitmaps (&oinfo->dqi_chunk);/* -* s_umount held in exclusive mode protects us against racing with -* recovery thread... +* ocfs2_dismount_volume() has already aborted quota recovery... */ if (oinfo->dqi_rec) {ocfs2_free_quota_recovery (oinfo->dqi_rec);
fs/ocfs2/super.c +3 -0
@@ -1869,6 +1869,9 @@ static void ocfs2_dismount_volume(struct/* Orphan scan should be stopped as early as possible */ ocfs2_orphan_scan_stop (osb); +/* Stop quota recovery so that we can disable quotas */ +ocfs2_recovery_disable_quota (osb); +ocfs2_disable_quotas (osb);/* All dquots should be freed by now */
Greg Kroah-Hartman
maintainerPATCH 50/92 usb: cdnsp: Fix issue with resuming from L1
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawel Laszczak <[email protected]>
commit 241e2ce88e5a494be7a5d44c0697592f1632fbee upstream.
In very rare cases after resuming controller from L1 to L0 it reads registers before the clock UTMI have been enabled and as the result driver reads incorrect value.
Most of registers are in APB domain clock but some of them (e.g. PORTSC) are in UTMI domain clock.
After entering to L1 state the UTMI clock can be disabled. When controller transition from L1 to L0 the port status change event is reported and in interrupt runtime function driver reads PORTSC. During this read operation controller synchronize UTMI and APB domain but UTMI clock is still disabled and in result it reads 0xFFFFFFFF value. To fix this issue driver increases APB timeout value.
The issue is platform specific and if the default value of APB timeout is not sufficient then this time should be set Individually for each platform.
--- drivers/usb/cdns3/cdnsp-gadget.c | 29 +++++++++++++++++++++++++++++ drivers/usb/cdns3/cdnsp-gadget.h | 3 +++ drivers/usb/cdns3/cdnsp-pci.c | 12 ++++++++++-- drivers/usb/cdns3/core.h | 3 +++ 4 files changed, 45 insertions(+), 2 deletions(-)
drivers/usb/cdns3/cdnsp-gadget.c +29 -0
@@ -138,6 +138,26 @@ static void cdnsp_clear_port_change_bit( (portsc & PORT_CHANGE_BITS), port_regs); } +static void cdnsp_set_apb_timeout_value (struct cdnsp_device *pdev) +{ +struct cdns *cdns =dev_get_drvdata (pdev->dev); +__le32 __iomem *reg; +void __iomem *base; +u32 offset =0 ; +u32 val; + +if (!cdns->override_apb_timeout) +return ; + + base = &pdev->cap_regs->hc_capbase; + offset =cdnsp_find_next_ext_cap (base, offset,D_XEC_PRE_REGS_CAP ); + reg = base + offset +REG_CHICKEN_BITS_3_OFFSET ; + + val =le32_to_cpu (readl (reg)); + val =CHICKEN_APB_TIMEOUT_SET (val, cdns->override_apb_timeout); +writel (cpu_to_le32 (val), reg); +} +static void cdnsp_set_chicken_bits_2 (struct cdnsp_device *pdev,u32 bit) {__le32 __iomem *reg;
@@ -1801,6 +1821,15 @@ static int cdnsp_gen_setup(struct cdnsp_ pdev->hci_version =HC_VERSION (pdev->hcc_params); pdev->hcc_params =readl (&pdev->cap_regs->hcc_params); +/* +* Override the APB timeout value to give the controller more time for +* enabling UTMI clock and synchronizing APB and UTMI clock domains. +* This fix is platform specific and is required to fixes issue with +* reading incorrect value from PORTSC register after resuming +* from L1 state. +*/ +cdnsp_set_apb_timeout_value (pdev); +cdnsp_get_rev_cap (pdev);/* Make sure the Device Controller is halted. */
drivers/usb/cdns3/cdnsp-gadget.h +3 -0
@@ -520,6 +520,9 @@ struct cdnsp_rev_cap {#define REG_CHICKEN_BITS_2_OFFSET 0x48#define CHICKEN_XDMA_2_TP_CACHE_DIS BIT(28) +#define REG_CHICKEN_BITS_3_OFFSET 0x4C +#define CHICKEN_APB_TIMEOUT_SET (p, val) (((p) & ~GENMASK(21, 0)) | (val)) +/* XBUF Extended Capability ID. */ #define XBUF_CAP_ID 0xCB#define XBUF_RX_TAG_MASK_0_OFFSET 0x1C
drivers/usb/cdns3/cdnsp-pci.c +10 -2
@@ -33,6 +33,8 @@#define CDNS_DRD_ID 0x0100#define CDNS_DRD_IF (PCI_CLASS_SERIAL_USB << 8 | 0x80) +#define CHICKEN_APB_TIMEOUT_VALUE 0x1C20 +static struct pci_dev *cdnsp_get_second_fun (struct pci_dev *pdev) {/*
@@ -144,6 +146,14 @@ static int cdnsp_pci_probe(struct pci_de cdnsp->otg_irq = pdev->irq; } +/* +* Cadence PCI based platform require some longer timeout for APB +* to fixes domain clock synchronization issue after resuming +* controller from L1 state. +*/ + cdnsp->override_apb_timeout =CHICKEN_APB_TIMEOUT_VALUE ; +pci_set_drvdata (pdev, cdnsp); +if (pci_is_enabled (func)) { cdnsp->dev = dev; cdnsp->gadget_init = cdnsp_gadget_init;
@@ -153,8 +163,6 @@ static int cdnsp_pci_probe(struct pci_de goto free_cdnsp; } -pci_set_drvdata (pdev, cdnsp); -device_wakeup_enable (&pdev->dev);if (pci_dev_run_wake (pdev))pm_runtime_put_noidle (&pdev->dev);
drivers/usb/cdns3/core.h +3 -0
@@ -79,6 +79,8 @@ struct cdns3_platform_data {* @pdata: platform data from glue layer * @lock: spinlock structure * @xhci_plat_data: xhci private data structure pointer +* @override_apb_timeout: hold value of APB timeout. For value 0 the default +* value in CHICKEN_BITS_3 will be preserved. * @gadget_init: pointer to gadget initialization function */ struct cdns {
@@ -117,6 +119,7 @@ struct cdns {struct cdns3_platform_data *pdata;spinlock_t lock;struct xhci_plat_priv *xhci_plat_data; +u32 override_apb_timeout;int (*gadget_init)(struct cdns *cdns); };
Greg Kroah-Hartman
maintainerPATCH 51/92 usb: cdnsp: fix L1 resume issue for RTL_REVISION_NEW_LPM version
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawel Laszczak <[email protected]>
commit 8614ecdb1570e4fffe87ebdc62b613ed66f1f6a6 upstream.
The controllers with rtl version larger than RTL_REVISION_NEW_LPM (0x00002700) has bug which causes that controller doesn't resume from L1 state. It happens if after receiving LPM packet controller starts transitioning to L1 and in this moment the driver force resuming by write operation to PORTSC.PLS.
It's corner case and happens when write operation to PORTSC occurs during device delay before transitioning to L1 after transmitting ACK time (TL1TokenRetry).
Forcing transition from L1->L0 by driver for revision larger than RTL_REVISION_NEW_LPM is not needed, so driver can simply fix this issue through block call of cdnsp_force_l0_go function.
--- drivers/usb/cdns3/cdnsp-gadget.c | 2 ++ drivers/usb/cdns3/cdnsp-gadget.h | 3 +++ drivers/usb/cdns3/cdnsp-ring.c | 3 ++- 3 files changed, 7 insertions(+), 1 deletion(-)
drivers/usb/cdns3/cdnsp-gadget.c +2 -0
@@ -1796,6 +1796,8 @@ static void cdnsp_get_rev_cap(struct cdn reg +=cdnsp_find_next_ext_cap (reg,0 ,RTL_REV_CAP ); pdev->rev_cap = reg; + pdev->rtl_revision =readl (&pdev->rev_cap->rtl_revision); + dev_info(pdev->dev, "Rev: %08x/%08x, eps: %08x, buff: %08x/%08x\n", readl(&pdev->rev_cap->ctrl_revision), readl(&pdev->rev_cap->rtl_revision),
drivers/usb/cdns3/cdnsp-gadget.h +3 -0
@@ -1362,6 +1362,7 @@ struct cdnsp_port {* @rev_cap: Controller Capabilities Registers. * @hcs_params1: Cached register copies of read-only HCSPARAMS1 * @hcc_params: Cached register copies of read-only HCCPARAMS1 +* @rtl_revision: Cached controller rtl revision. * @setup: Temporary buffer for setup packet. * @ep0_preq: Internal allocated request used during enumeration. * @ep0_stage: ep0 stage during enumeration process.
@@ -1416,6 +1417,8 @@ struct cdnsp_device {__u32 hcs_params1;__u32 hcs_params3;__u32 hcc_params; +#define RTL_REVISION_NEW_LPM 0x2700 +__u32 rtl_revision;/* Lock used in interrupt thread context. */ spinlock_t lock;struct usb_ctrlrequest setup;
drivers/usb/cdns3/cdnsp-ring.c +2 -1
@@ -308,7 +308,8 @@ static bool cdnsp_ring_ep_doorbell(strucwritel (db_value, reg_addr); -cdnsp_force_l0_go (pdev); +if (pdev->rtl_revision <RTL_REVISION_NEW_LPM ) +cdnsp_force_l0_go (pdev);/* Doorbell was set. */ return true;
Greg Kroah-Hartman
maintainerPATCH 52/92 usb: gadget: tegra-xudc: ACK ST_RC after clearing CTRL_RUN
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wayne Chang <[email protected]>
commit 59820fde001500c167342257650541280c622b73 upstream.
We identified a bug where the ST_RC bit in the status register was not being acknowledged after clearing the CTRL_RUN bit in the control register. This could lead to unexpected behavior in the USB gadget drivers.
This patch resolves the issue by adding the necessary code to explicitly acknowledge ST_RC after clearing CTRL_RUN based on the programming sequence, ensuring proper state transition.
--- drivers/usb/gadget/udc/tegra-xudc.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/gadget/udc/tegra-xudc.c +4 -0
@@ -1743,6 +1743,10 @@ static int __tegra_xudc_ep_disable(struc val =xudc_readl (xudc,CTRL ); val &= ~CTRL_RUN ;xudc_writel (xudc, val,CTRL ); + + val =xudc_readl (xudc,ST ); +if (val &ST_RC ) +xudc_writel (xudc,ST_RC ,ST ); }dev_info (xudc->dev,"ep %u disabled\n" , ep->index);
Greg Kroah-Hartman
maintainerPATCH 53/92 usb: host: tegra: Prevent host controller crash when OTG port is used
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jim Lin <[email protected]>
commit 732f35cf8bdfece582f6e4a9c659119036577308 upstream.
When a USB device is connected to the OTG port, the tegra_xhci_id_work() routine transitions the PHY to host mode and calls xhci_hub_control() with the SetPortFeature command to enable port power.
In certain cases, the XHCI controller may be in a low-power state when this operation occurs. If xhci_hub_control() is invoked while the controller is suspended, the PORTSC register may return 0xFFFFFFFF, indicating a read failure. This causes xhci_hc_died() to be triggered, leading to host controller shutdown.
Example backtrace:
[ 105.445736] Workqueue: events tegra_xhci_id_work [ 105.445747] dump_backtrace+0x0/0x1e8 [ 105.445759] xhci_hc_died.part.48+0x40/0x270 [ 105.445769] tegra_xhci_set_port_power+0xc0/0x240 [ 105.445774] tegra_xhci_id_work+0x130/0x240
To prevent this, ensure the controller is fully resumed before interacting with hardware registers by calling pm_runtime_get_sync() prior to the host mode transition and xhci_hub_control().
--- drivers/usb/host/xhci-tegra.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/host/xhci-tegra.c +3 -0
@@ -1228,6 +1228,7 @@ static void tegra_xhci_id_work(struct wo tegra->otg_usb3_port =tegra_xusb_padctl_get_usb3_companion (tegra->padctl, tegra->otg_usb2_port); +pm_runtime_get_sync (tegra->dev);if (tegra->host_mode) {/* switch to host mode */ if (tegra->otg_usb3_port >=0 ) {
@@ -1257,6 +1258,7 @@ static void tegra_xhci_id_work(struct wo }tegra_xhci_set_port_power (tegra, true, true); +pm_runtime_mark_last_busy (tegra->dev); }else {if (tegra->otg_usb3_port >=0 )
@@ -1264,6 +1266,7 @@ static void tegra_xhci_id_work(struct wotegra_xhci_set_port_power (tegra, true, false); } +pm_runtime_put_autosuspend (tegra->dev); }#if IS_ENABLED (CONFIG_PM ) ||IS_ENABLED (CONFIG_PM_SLEEP )
Greg Kroah-Hartman
maintainerPATCH 54/92 usb: typec: tcpm: delay SNK_TRY_WAIT_DEBOUNCE to SRC_TRYWAIT transition
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: RD Babiera <[email protected]>
commit e918d3959b5ae0e793b8f815ce62240e10ba03a4 upstream.
This patch fixes Type-C Compliance Test TD 4.7.6 - Try.SNK DRP Connect SNKAS.
The compliance tester moves into SNK_UNATTACHED during toggling and expects the PUT to apply Rp after tPDDebounce of detection. If the port is in SNK_TRY_WAIT_DEBOUNCE, it will move into SRC_TRYWAIT immediately and apply Rp. This violates TD 4.7.5.V.3, where the tester confirms that the PUT attaches Rp after the transitions to Unattached.SNK for tPDDebounce.
Change the tcpm_set_state delay between SNK_TRY_WAIT_DEBOUNCE and SRC_TRYWAIT to tPDDebounce.
--- drivers/usb/typec/tcpm/tcpm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/typec/tcpm/tcpm.c +1 -1
@@ -5136,7 +5136,7 @@ static void _tcpm_cc_change(struct tcpm_case SNK_TRY_WAIT_DEBOUNCE :if (!tcpm_port_is_sink (port)) { port->max_wait =0 ; -tcpm_set_state (port,SRC_TRYWAIT ,0 ); +tcpm_set_state (port,SRC_TRYWAIT ,PD_T_PD_DEBOUNCE ); }break ;case SRC_TRY_WAIT :
Greg Kroah-Hartman
maintainerPATCH 55/92 usb: typec: ucsi: displayport: Fix NULL pointer access
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrei Kuchynski <[email protected]>
commit 312d79669e71283d05c05cc49a1a31e59e3d9e0e upstream.
This patch ensures that the UCSI driver waits for all pending tasks in the ucsi_displayport_work workqueue to finish executing before proceeding with the partner removal.
--- drivers/usb/typec/ucsi/displayport.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/typec/ucsi/displayport.c +2 -0
@@ -296,6 +296,8 @@ void ucsi_displayport_remove_partner(strif (!dp)return ; +cancel_work_sync (&dp->work); + dp->data.conf =0 ; dp->data.status =0 ; dp->initialized = false;
Greg Kroah-Hartman
maintainerPATCH 56/92 USB: usbtmc: use interruptible sleep in usbtmc_read
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
commit 054c5145540e5ad5b80adf23a5e3e2fc281fb8aa upstream.
usbtmc_read() calls usbtmc_generic_read() which uses interruptible sleep, but usbtmc_read() itself uses uninterruptble sleep for mutual exclusion between threads. That makes no sense.
Both should use interruptible sleep.
--- drivers/usb/class/usbtmc.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/usb/class/usbtmc.c +5 -1
@@ -1380,7 +1380,10 @@ static ssize_t usbtmc_read(struct file *if (!buffer)return -ENOMEM ; -mutex_lock (&data->io_mutex); + retval =mutex_lock_interruptible (&data->io_mutex); +if (retval <0 ) + goto exit_nolock; +if (data->zombie) { retval = -ENODEV ; goto exit;
@@ -1503,6 +1506,7 @@ static ssize_t usbtmc_read(struct file * exit:mutex_unlock (&data->io_mutex); +exit_nolock:kfree (buffer);return retval; }
Greg Kroah-Hartman
maintainerPATCH 57/92 usb: usbtmc: Fix erroneous get_stb ioctl error returns
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Penkler <[email protected]>
commit cac01bd178d6a2a23727f138d647ce1a0e8a73a1 upstream.
wait_event_interruptible_timeout returns a long
The return was being assigned to an int causing an integer overflow when the remaining jiffies > INT_MAX resulting in random error returns.
Use a long return value and convert to int ioctl return only on error.
When the return value of wait_event_interruptible_timeout was <= INT_MAX the number of remaining jiffies was returned which has no meaning for the user. Return 0 on success.
--- drivers/usb/class/usbtmc.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/usb/class/usbtmc.c +8 -4
@@ -482,6 +482,7 @@ static int usbtmc_get_stb(struct usbtmc_u8 *buffer;u8 tag;int rv; +long wait_rv;dev_dbg (dev,"Enter ioctl_read_stb iin_ep_present: %d\n" , data->iin_ep_present);
@@ -511,16 +512,17 @@ static int usbtmc_get_stb(struct usbtmc_ }if (data->iin_ep_present) { - rv =wait_event_interruptible_timeout ( + wait_rv =wait_event_interruptible_timeout ( data->waitq,atomic_read (&data->iin_data_valid) !=0 , file_data->timeout); -if (rv <0 ) { -dev_dbg (dev,"wait interrupted %d\n" , rv); +if (wait_rv <0 ) { +dev_dbg (dev,"wait interrupted %ld\n" , wait_rv); + rv = wait_rv; goto exit; } -if (rv ==0 ) { +if (wait_rv ==0 ) {dev_dbg (dev,"wait timed out\n" ); rv = -ETIMEDOUT ; goto exit;
@@ -539,6 +541,8 @@ static int usbtmc_get_stb(struct usbtmc_dev_dbg (dev,"stb:0x%02x received %d\n" , (unsigned int )*stb, rv); + rv =0 ; + exit:/* bump interrupt bTag */ data->iin_bTag +=1 ;
Greg Kroah-Hartman
maintainerPATCH 58/92 usb: usbtmc: Fix erroneous wait_srq ioctl return
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Penkler <[email protected]>
commit a9747c9b8b59ab4207effd20eb91a890acb44e16 upstream.
wait_event_interruptible_timeout returns a long
The return was being assigned to an int causing an integer overflow when the remaining jiffies > INT_MAX resulting in random error returns.
Use a long return value, converting to the int ioctl return only on error.
--- drivers/usb/class/usbtmc.c | 23 +++++++++++------------ 1 file changed, 11 insertions(+), 12 deletions(-)
drivers/usb/class/usbtmc.c +11 -12
@@ -606,9 +606,9 @@ static int usbtmc488_ioctl_wait_srq(stru {struct usbtmc_device_data *data = file_data->data;struct device *dev = &data->intf->dev; -int rv;u32 timeout;unsigned long expire; +long wait_rv;if (!data->iin_ep_present) {dev_dbg (dev,"no interrupt endpoint present\n" );
@@ -622,25 +622,24 @@ static int usbtmc488_ioctl_wait_srq(strumutex_unlock (&data->io_mutex); - rv =wait_event_interruptible_timeout ( - data->waitq, -atomic_read (&file_data->srq_asserted) !=0 || -atomic_read (&file_data->closing), - expire); + wait_rv =wait_event_interruptible_timeout ( + data->waitq, +atomic_read (&file_data->srq_asserted) !=0 || +atomic_read (&file_data->closing), + expire);mutex_lock (&data->io_mutex);/* Note! disconnect or close could be called in the meantime */ if (atomic_read (&file_data->closing) || data->zombie) - rv = -ENODEV ; +return -ENODEV ; -if (rv <0 ) { -/* dev can be invalid now! */ -pr_debug ("%s - wait interrupted %d\n" , __func__, rv); -return rv; +if (wait_rv <0 ) { +dev_dbg (dev,"%s - wait interrupted %ld\n" , __func__, wait_rv); +return wait_rv; } -if (rv ==0 ) { +if (wait_rv ==0 ) {dev_dbg (dev,"%s - wait timed out\n" , __func__);return -ETIMEDOUT ; }
Greg Kroah-Hartman
maintainerPATCH 59/92 usb: usbtmc: Fix erroneous generic_read ioctl return
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Penkler <[email protected]>
commit 4e77d3ec7c7c0d9535ccf1138827cb9bb5480b9b upstream.
wait_event_interruptible_timeout returns a long
The return value was being assigned to an int causing an integer overflow when the remaining jiffies > INT_MAX which resulted in random error returns.
Use a long return value, converting to the int ioctl return only on error.
--- drivers/usb/class/usbtmc.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
drivers/usb/class/usbtmc.c +12 -6
@@ -833,6 +833,7 @@ static ssize_t usbtmc_generic_read(strucunsigned long expire;int bufcount =1 ;int again =0 ; +long wait_rv;/* mutex already locked */
@@ -945,19 +946,24 @@ static ssize_t usbtmc_generic_read(strucif (!(flags &USBTMC_FLAG_ASYNC )) {dev_dbg (dev,"%s: before wait time %lu\n" , __func__, expire); - retval =wait_event_interruptible_timeout ( + wait_rv =wait_event_interruptible_timeout ( file_data->wait_bulk_in,usbtmc_do_transfer (file_data), expire); -dev_dbg (dev,"%s: wait returned %d\n" , - __func__, retval); +dev_dbg (dev,"%s: wait returned %ld\n" , + __func__, wait_rv); -if (retval <=0 ) { -if (retval ==0 ) - retval = -ETIMEDOUT ; +if (wait_rv <0 ) { + retval = wait_rv; goto error; } + +if (wait_rv ==0 ) { + retval = -ETIMEDOUT ; + goto error; + } + } urb =usb_get_from_anchor (&file_data->in_anchor);
Greg Kroah-Hartman
maintainerPATCH 60/92 iio: accel: adxl367: fix setting odr for activity time update
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lothar Rubusch <[email protected]>
[ Upstream commit 38f67d0264929762e54ae5948703a21f841fe706 ]
Fix setting the odr value to update activity time based on frequency derrived by recent odr, and not by obsolete odr value.
The [small] bug: When _adxl367_set_odr() is called with a new odr value, it first writes the new odr value to the hardware register ADXL367_REG_FILTER_CTL.
Second, it calls _adxl367_set_act_time_ms(), which calls adxl367_time_ms_to_samples(). Here st->odr still holds the old odr value. This st->odr member is used to derrive a frequency value, which is applied to update ADXL367_REG_TIME_ACT. Hence, the idea is to update activity time, based on possibilities and power consumption by the current ODR rate.
Finally, when the function calls return, again in _adxl367_set_odr() the new ODR is assigned to st->odr.
The fix: When setting a new ODR value is set to ADXL367_REG_FILTER_CTL, also ADXL367_REG_TIME_ACT should probably be updated with a frequency based on the recent ODR value and not the old one. Changing the location of the assignment to st->odr fixes this.
--- drivers/iio/accel/adxl367.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-)
drivers/iio/accel/adxl367.c +3 -7
@@ -622,18 +622,14 @@ static int _adxl367_set_odr(struct adxl367_state *st, enum adxl367_odr odr)if (ret)return ret; + st->odr = odr; +/* Activity timers depend on ODR */ ret =_adxl367_set_act_time_ms (st, st->act_time_ms);if (ret)return ret; - ret =_adxl367_set_inact_time_ms (st, st->inact_time_ms); -if (ret) -return ret; - - st->odr = odr; - -return 0 ; +return _adxl367_set_inact_time_ms (st, st->inact_time_ms); }static int adxl367_set_odr (struct iio_dev *indio_dev,enum adxl367_odr odr)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 61/92 iio: temp: maxim-thermocouple: Fix potential lack of DMA safe buffer.
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Cameron <[email protected]>
[ Upstream commit f79aeb6c631b57395f37acbfbe59727e355a714c ]
The trick of using __aligned(IIO_DMA_MINALIGN) ensures that there is no overlap between buffers used for DMA and those used for driver state storage that are before the marking. It doesn't ensure anything above state variables found after the marking. Hence move this particular bit of state earlier in the structure.
--- drivers/iio/temperature/maxim_thermocouple.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/temperature/maxim_thermocouple.c +1 -1
@@ -121,9 +121,9 @@ static const struct maxim_thermocouple_chip maxim_thermocouple_chips[] = {struct maxim_thermocouple_data {struct spi_device *spi;const struct maxim_thermocouple_chip *chip; +char tc_type;u8 buffer[16 ]__aligned(IIO_DMA_MINALIGN) ; -char tc_type; }; static int maxim_thermocouple_read(struct maxim_thermocouple_data *data,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 62/92 types: Complement the aligned types with signed 64-bit one
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit e4ca0e59c39442546866f3dd514a3a5956577daf ]
Some user may want to use aligned signed 64-bit type. Provide it for them.
Stable-dep-of: 1bb942287e05 ("iio: accel: adxl355: Make timestamp 64-bit aligned using aligned_s64")
--- include/linux/types.h | 3 ++- include/uapi/linux/types.h | 1 + 2 files changed, 3 insertions(+), 1 deletion(-)
include/linux/types.h +2 -1
@@ -109,8 +109,9 @@ typedef u64 u_int64_t;typedef s64 int64_t ;#endif -/* this is a special 64bit data type that is 8-byte aligned */ +/* These are the special 64-bit data types that are 8-byte aligned */ #define aligned_u64 __aligned_u64 +#define aligned_s64 __aligned_s64#define aligned_be64 __aligned_be64#define aligned_le64 __aligned_le64
include/uapi/linux/types.h +1 -0
@@ -49,6 +49,7 @@ typedef __u32 __bitwise __wsum;* No conversions are necessary between 32-bit user-space and a 64-bit kernel. */ #define __aligned_u64 __u64 __attribute__((aligned(8))) +#define __aligned_s64 __s64 __attribute__((aligned(8)))#define __aligned_be64 __be64 __attribute__((aligned(8)))#define __aligned_le64 __le64 __attribute__((aligned(8)))
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 63/92 iio: accel: adxl355: Make timestamp 64-bit aligned using aligned_s64
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Cameron <[email protected]>
[ Upstream commit 1bb942287e05dc4c304a003ea85e6dd9a5e7db39 ]
The IIO ABI requires 64-bit aligned timestamps. In this case insufficient padding would have been added on architectures where an s64 is only 32-bit aligned. Use aligned_s64 to enforce the correct alignment.
--- drivers/iio/accel/adxl355_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/accel/adxl355_core.c +1 -1
@@ -175,7 +175,7 @@ struct adxl355_data {u8 transf_buf[3 ];struct {u8 buf[14 ]; -s64 ts; +aligned_s64 ts; } buffer; }__aligned(IIO_DMA_MINALIGN) ; };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 64/92 iio: adc: dln2: Use aligned_s64 for timestamp
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Cameron <[email protected]>
[ Upstream commit 5097eaae98e53f9ab9d35801c70da819b92ca907 ]
Here the lack of marking allows the overall structure to not be sufficiently aligned resulting in misplacement of the timestamp in iio_push_to_buffers_with_timestamp(). Use aligned_s64 to force the alignment on all architectures.
--- drivers/iio/adc/dln2-adc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/adc/dln2-adc.c +1 -1
@@ -483,7 +483,7 @@ static irqreturn_t dln2_adc_trigger_h(int irq, void *p)struct iio_dev *indio_dev = pf->indio_dev;struct {__le16 values[DLN2_ADC_MAX_CHANNELS ]; -int64_t timestamp_space; +aligned_s64 timestamp_space; } data;struct dln2_adc_get_all_vals dev_data;struct dln2_adc *dln2 =iio_priv (indio_dev);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 65/92 MIPS: Fix MAX_REG_OFFSET
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <[email protected]>
[ Upstream commit c44572e0cc13c9afff83fd333135a0aa9b27ba26 ]
Fix MAX_REG_OFFSET to point to the last register in 'pt_regs' and not to the marker itself, which could allow regs_get_register() to return an invalid offset.
--- arch/mips/include/asm/ptrace.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/mips/include/asm/ptrace.h +2 -1
@@ -65,7 +65,8 @@ static inline void instruction_pointer_set(struct pt_regs *regs,/* Query offset/name of register from its name/offset */ extern int regs_query_register_offset (const char *name); -#define MAX_REG_OFFSET (offsetof(struct pt_regs, __last)) +#define MAX_REG_OFFSET \ + (offsetof(struct pt_regs, __last) - sizeof(unsigned long))/** * regs_get_register() - get register value from its offset
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 66/92 drm/panel: simple: Update timings for AUO G101EVN010
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kevin Baker <[email protected]>
[ Upstream commit 7c6fa1797a725732981f2d77711c867166737719 ]
Switch to panel timings based on datasheet for the AUO G101EVN01.0 LVDS panel. Default timings were tested on the panel.
Previous mode-based timings resulted in horizontal display shift.
--- drivers/gpu/drm/panel/panel-simple.c | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-)
drivers/gpu/drm/panel/panel-simple.c +13 -12
@@ -921,27 +921,28 @@ static const struct panel_desc auo_g070vvn01 = { }, }; -static const struct drm_display_mode auo_g101evn010_mode = { - .clock =68930 , - .hdisplay =1280 , - .hsync_start =1280 +82 , - .hsync_end =1280 +82 +2 , - .htotal =1280 +82 +2 +84 , - .vdisplay =800 , - .vsync_start =800 +8 , - .vsync_end =800 +8 +2 , - .vtotal =800 +8 +2 +6 , +static const struct display_timing auo_g101evn010_timing = { + .pixelclock = {64000000 ,68930000 ,85000000 }, + .hactive = {1280 ,1280 ,1280 }, + .hfront_porch = {8 ,64 ,256 }, + .hback_porch = {8 ,64 ,256 }, + .hsync_len = {40 ,168 ,767 }, + .vactive = {800 ,800 ,800 }, + .vfront_porch = {4 ,8 ,100 }, + .vback_porch = {4 ,8 ,100 }, + .vsync_len = {8 ,16 ,223 }, };static const struct panel_desc auo_g101evn010 = { - .modes = &auo_g101evn010_mode, - .num_modes =1 , + .timings = &auo_g101evn010_timing, + .num_timings =1 , .bpc =6 , .size = { .width =216 , .height =135 , }, .bus_format =MEDIA_BUS_FMT_RGB666_1X7X3_SPWG , + .bus_flags =DRM_BUS_FLAG_DE_HIGH , .connector_type =DRM_MODE_CONNECTOR_LVDS , };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 67/92 nvme: unblock ctrl state transition for firmware update
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Wagner <[email protected]>
[ Upstream commit 650415fca0a97472fdd79725e35152614d1aad76 ]
The original nvme subsystem design didn't have a CONNECTING state; the state machine allowed transitions from RESETTING to LIVE directly.
With the introduction of nvme fabrics the CONNECTING state was introduce. Over time the nvme-pci started to use the CONNECTING state as well.
Eventually, a bug fix for the nvme-fc started to depend that the only valid transition to LIVE was from CONNECTING. Though this change didn't update the firmware update handler which was still depending on RESETTING to LIVE transition.
The simplest way to address it for the time being is to switch into CONNECTING state before going to LIVE state.
--- drivers/nvme/host/core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/nvme/host/core.c +2 -1
@@ -4881,7 +4881,8 @@ static void nvme_fw_act_work(struct work_struct *work)msleep (100 ); } -if (!nvme_change_ctrl_state (ctrl,NVME_CTRL_LIVE )) +if (!nvme_change_ctrl_state (ctrl,NVME_CTRL_CONNECTING ) || + !nvme_change_ctrl_state (ctrl,NVME_CTRL_LIVE ))return ;nvme_start_queues (ctrl);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 68/92 do_umount(): add missing barrier before refcount checks in sync case
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit 65781e19dcfcb4aed1167d87a3ffcc2a0c071d47 ]
do_umount() analogue of the race fixed in 119e1ef80ecf "fix __legitimize_mnt()/mntput() race". Here we want to make sure that if __legitimize_mnt() doesn't notice our lock_mount_hash(), we will notice their refcount increment. Harder to hit than mntput_no_expire() one, fortunately, and consequences are milder (sync umount acting like umount -l on a rare race with RCU pathwalk hitting at just the wrong time instead of use-after-free galore mntput_no_expire() counterpart used to be hit). Still a bug...
--- fs/namespace.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/namespace.c +2 -1
@@ -629,7 +629,7 @@ int __legitimize_mnt(struct vfsmount *bastard, unsigned seq)return 0 ; mnt =real_mount (bastard);mnt_add_count (mnt,1 ); -smp_mb ();// see mntput_no_expire() +smp_mb ();// see mntput_no_expire() and do_umount() if (likely (!read_seqretry (&mount_lock, seq)))return 0 ;if (bastard->mnt_flags &MNT_SYNC_UMOUNT ) {
@@ -1707,6 +1707,7 @@ static int do_umount(struct mount *mnt, int flags)umount_tree (mnt,UMOUNT_PROPAGATE ); retval =0 ; }else { +smp_mb ();// paired with __legitimize_mnt() shrink_submounts (mnt); retval = -EBUSY ;if (!propagate_mount_busy (mnt,2 )) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 69/92 io_uring: always arm linked timeouts prior to issue
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <[email protected]>
Commit b53e523261bf058ea4a518b482222e7a277b186b upstream.
There are a few spots where linked timeouts are armed, and not all of them adhere to the pre-arm, attempt issue, post-arm pattern. This can be problematic if the linked request returns that it will trigger a callback later, and does so before the linked timeout is fully armed.
Consolidate all the linked timeout handling into __io_issue_sqe(), rather than have it spread throughout the various issue entry points.
--- io_uring/io_uring.c | 53 +++++++++++++++------------------------------------- 1 file changed, 16 insertions(+), 37 deletions(-)
io_uring/io_uring.c +16 -37
@@ -372,24 +372,6 @@ static struct io_kiocb *__io_prep_linkedreturn req->link; } -static inline struct io_kiocb *io_prep_linked_timeout (struct io_kiocb *req) -{ -if (likely (!(req->flags &REQ_F_ARM_LTIMEOUT ))) -return NULL ; -return __io_prep_linked_timeout (req); -} - -static noinline void __io_arm_ltimeout(struct io_kiocb *req) -{ -io_queue_linked_timeout (__io_prep_linked_timeout (req)); -} - -static inline void io_arm_ltimeout (struct io_kiocb *req) -{ -if (unlikely (req->flags &REQ_F_ARM_LTIMEOUT )) -__io_arm_ltimeout (req); -} -static void io_prep_async_work (struct io_kiocb *req) {const struct io_op_def *def = &io_op_defs[req->opcode];
@@ -437,7 +419,6 @@ static void io_prep_async_link(struct iostatic void io_queue_iowq (struct io_kiocb *req) { -struct io_kiocb *link =io_prep_linked_timeout (req);struct io_uring_task *tctx = req->task->io_uring;BUG_ON (!tctx);
@@ -462,8 +443,6 @@ static void io_queue_iowq(struct io_kioctrace_io_uring_queue_async_work (req,io_wq_is_hashed (&req->work));io_wq_enqueue (tctx->io_wq, &req->work); -if (link) -io_queue_linked_timeout (link); }static __cold void io_queue_deferred (struct io_ring_ctx *ctx)
@@ -1741,17 +1720,24 @@ static bool io_assign_file(struct io_kioreturn !!req->file; } +#define REQ_ISSUE_SLOW_FLAGS (REQ_F_CREDS | REQ_F_ARM_LTIMEOUT) +static int io_issue_sqe (struct io_kiocb *req,unsigned int issue_flags) {const struct io_op_def *def = &io_op_defs[req->opcode];const struct cred *creds =NULL ; +struct io_kiocb *link =NULL ;int ret;if (unlikely (!io_assign_file (req, issue_flags)))return -EBADF ; -if (unlikely ((req->flags &REQ_F_CREDS ) && req->creds !=current_cred ())) - creds =override_creds (req->creds); +if (unlikely (req->flags &REQ_ISSUE_SLOW_FLAGS )) { +if ((req->flags &REQ_F_CREDS ) && req->creds !=current_cred ()) + creds =override_creds (req->creds); +if (req->flags &REQ_F_ARM_LTIMEOUT ) + link =__io_prep_linked_timeout (req); + }if (!def->audit_skip)audit_uring_entry (req->opcode);
@@ -1761,8 +1747,12 @@ static int io_issue_sqe(struct io_kiocbif (!def->audit_skip)audit_uring_exit (!ret, ret); -if (creds) -revert_creds (creds); +if (unlikely (creds || link)) { +if (creds) +revert_creds (creds); +if (link) +io_queue_linked_timeout (link); + }if (ret ==IOU_OK ) {if (issue_flags &IO_URING_F_COMPLETE_DEFER )
@@ -1809,8 +1799,6 @@ void io_wq_submit_work(struct io_wq_workelse req_ref_get (req); -io_arm_ltimeout (req); -/* either cancelled or io-wq is dying, so don't touch tctx->iowq */ if (work->flags &IO_WQ_WORK_CANCEL ) { fail:
@@ -1908,15 +1896,11 @@ struct file *io_file_get_normal(struct istatic void io_queue_async (struct io_kiocb *req,int ret) __must_hold(&req->ctx->uring_lock) { -struct io_kiocb *linked_timeout; -if (ret != -EAGAIN || (req->flags &REQ_F_NOWAIT )) {io_req_complete_failed (req, ret);return ; } - linked_timeout =io_prep_linked_timeout (req); -switch (io_arm_poll_handler (req,0 )) {case IO_APOLL_READY :io_kbuf_recycle (req,0 );
@@ -1929,9 +1913,6 @@ static void io_queue_async(struct io_kiocase IO_APOLL_OK :break ; } - -if (linked_timeout) -io_queue_linked_timeout (linked_timeout); }static inline void io_queue_sqe (struct io_kiocb *req)
@@ -1945,9 +1926,7 @@ static inline void io_queue_sqe(struct i* We async punt it if the file wasn't marked NOWAIT, or if the file * doesn't support non-blocking read/write attempts */ -if (likely (!ret)) -io_arm_ltimeout (req); -else +if (unlikely (ret))io_queue_async (req, ret); }
Greg Kroah-Hartman
maintainerPATCH 70/92 io_uring: ensure deferred completions are posted for multishot
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <[email protected]>
Commit 687b2bae0efff9b25e071737d6af5004e6e35af5 upstream.
Multishot normally uses io_req_post_cqe() to post completions, but when stopping it, it may finish up with a deferred completion. This is fine, except if another multishot event triggers before the deferred completions get flushed. If this occurs, then CQEs may get reordered in the CQ ring, and cause confusion on the application side.
When multishot posting via io_req_post_cqe(), flush any pending deferred completions first, if any.
--- io_uring/io_uring.c | 8 ++++++++ 1 file changed, 8 insertions(+)
io_uring/io_uring.c +8 -0
@@ -819,6 +819,14 @@ bool io_post_aux_cqe(struct io_ring_ctx {bool filled; +/* +* If multishot has already posted deferred completions, ensure that +* those are flushed first before posting this one. If not, CQEs +* could get reordered. +*/ +if (!wq_list_empty (&ctx->submit_state.compl_reqs)) +__io_submit_flush_completions (ctx); +io_cq_lock (ctx); filled =io_fill_cqe_aux (ctx, user_data, res, cflags, allow_overflow);io_cq_unlock_post (ctx);
Greg Kroah-Hartman
maintainerPATCH 71/92 Revert "net: phy: microchip: force IRQ polling mode for lan88xx"
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
This reverts commit 9b89102fbb8fc5393e2a0f981aafdb3cf43591ee which is commit 30a41ed32d3088cd0d682a13d7f30b23baed7e93 upstream.
It is reported to cause NFS boot problems on a Raspberry Pi 3b so revert it from this branch for now.
--- drivers/net/phy/microchip.c | 46 +++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 43 insertions(+), 3 deletions(-)
drivers/net/phy/microchip.c +43 -3
@@ -31,6 +31,47 @@ static int lan88xx_write_page(struct phyreturn __phy_write (phydev,LAN88XX_EXT_PAGE_ACCESS , page); } +static int lan88xx_phy_config_intr (struct phy_device *phydev) +{ +int rc; + +if (phydev->interrupts ==PHY_INTERRUPT_ENABLED ) { +/* unmask all source and clear them before enable */ + rc =phy_write (phydev,LAN88XX_INT_MASK ,0x7FFF ); + rc =phy_read (phydev,LAN88XX_INT_STS ); + rc =phy_write (phydev,LAN88XX_INT_MASK , +LAN88XX_INT_MASK_MDINTPIN_EN_ | +LAN88XX_INT_MASK_LINK_CHANGE_ ); + }else { + rc =phy_write (phydev,LAN88XX_INT_MASK ,0 ); +if (rc) +return rc; + +/* Ack interrupts after they have been disabled */ + rc =phy_read (phydev,LAN88XX_INT_STS ); + } + +return rc <0 ? rc :0 ; +} + +static irqreturn_t lan88xx_handle_interrupt (struct phy_device *phydev) +{ +int irq_status; + + irq_status =phy_read (phydev,LAN88XX_INT_STS ); +if (irq_status <0 ) { +phy_error (phydev); +return IRQ_NONE ; + } + +if (!(irq_status &LAN88XX_INT_STS_LINK_CHANGE_ )) +return IRQ_NONE ; + +phy_trigger_machine (phydev); + +return IRQ_HANDLED ; +} +static int lan88xx_suspend (struct phy_device *phydev) {struct lan88xx_priv *priv = phydev->priv;
@@ -351,9 +392,8 @@ static struct phy_driver microchip_phy_d .config_aneg = lan88xx_config_aneg, .link_change_notify = lan88xx_link_change_notify, -/* Interrupt handling is broken, do not define related -* functions to force polling. -*/ + .config_intr = lan88xx_phy_config_intr, + .handle_interrupt = lan88xx_handle_interrupt, .suspend = lan88xx_suspend, .resume = genphy_resume,
Greg Kroah-Hartman
maintainerPATCH 72/92 arm64: insn: Add support for encoding DSB
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Morse <[email protected]>
commit 63de8abd97ddb9b758bd8f915ecbd18e1f1a87a0 upstream.
To generate code in the eBPF epilogue that uses the DSB instruction, insn.c needs a heler to encode the type and domain.
Re-use the crm encoding logic from the DMB instruction.
--- arch/arm64/include/asm/insn.h | 1 arch/arm64/lib/insn.c | 60 +++++++++++++++++++++++++----------------- 2 files changed, 38 insertions(+), 23 deletions(-)
arch/arm64/include/asm/insn.h +1 -0
@@ -619,6 +619,7 @@ u32 aarch64_insn_gen_cas(enum aarch64_in }#endif u32 aarch64_insn_gen_dmb (enum aarch64_insn_mb_type type); +u32 aarch64_insn_gen_dsb (enum aarch64_insn_mb_type type);s32 aarch64_get_branch_offset (u32 insn);u32 aarch64_set_branch_offset (u32 insn,s32 offset);
arch/arm64/lib/insn.c +37 -23
90 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 73/92 arm64: proton-pack: Expose whether the platform is mitigated by firmware
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Morse <[email protected]>
commit e7956c92f396a44eeeb6eaf7a5b5e1ad24db6748 upstream.
is_spectre_bhb_fw_affected() allows the caller to determine if the CPU is known to need a firmware mitigation. CPUs are either on the list of CPUs we know about, or firmware has been queried and reported that the platform is affected - and mitigated by firmware.
This helper is not useful to determine if the platform is mitigated by firmware. A CPU could be on the know list, but the firmware may not be implemented. Its affected but not mitigated.
spectre_bhb_enable_mitigation() handles this distinction by checking the firmware state before enabling the mitigation.
Add a helper to expose this state. This will be used by the BPF JIT to determine if calling firmware for a mitigation is necessary and supported.
--- arch/arm64/include/asm/spectre.h | 1 + arch/arm64/kernel/proton-pack.c | 5 +++++ 2 files changed, 6 insertions(+)
arch/arm64/include/asm/spectre.h +1 -0
@@ -96,6 +96,7 @@ enum mitigation_state arm64_get_meltdownenum mitigation_state arm64_get_spectre_bhb_state (void );bool is_spectre_bhb_affected (const struct arm64_cpu_capabilities *entry,int scope); +bool is_spectre_bhb_fw_mitigated (void );void spectre_bhb_enable_mitigation (const struct arm64_cpu_capabilities *__unused);#endif /* __ASSEMBLY__ */ #endif /* __ASM_SPECTRE_H */
arch/arm64/kernel/proton-pack.c +5 -0
@@ -1108,6 +1108,11 @@ void spectre_bhb_enable_mitigation(constupdate_mitigation_state (&spectre_bhb_state, state); } +bool is_spectre_bhb_fw_mitigated (void ) +{ +return test_bit (BHB_FW , &system_bhb_mitigations); +} +/* Patched to NOP when enabled */ void noinstr spectre_bhb_patch_loop_mitigation_enable(struct alt_instr *alt, __le32 *origptr,
Greg Kroah-Hartman
maintainerPATCH 74/92 arm64: proton-pack: Expose whether the branchy loop k value
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Morse <[email protected]>
commit a1152be30a043d2d4dcb1683415f328bf3c51978 upstream.
Add a helper to expose the k value of the branchy loop. This is needed by the BPF JIT to generate the mitigation sequence in BPF programs.
--- arch/arm64/include/asm/spectre.h | 1 + arch/arm64/kernel/proton-pack.c | 5 +++++ 2 files changed, 6 insertions(+)
arch/arm64/include/asm/spectre.h +1 -0
@@ -96,6 +96,7 @@ enum mitigation_state arm64_get_meltdownenum mitigation_state arm64_get_spectre_bhb_state (void );bool is_spectre_bhb_affected (const struct arm64_cpu_capabilities *entry,int scope); +u8 get_spectre_bhb_loop_value (void );bool is_spectre_bhb_fw_mitigated (void );void spectre_bhb_enable_mitigation (const struct arm64_cpu_capabilities *__unused);#endif /* __ASSEMBLY__ */
arch/arm64/kernel/proton-pack.c +5 -0
@@ -1010,6 +1010,11 @@ bool is_spectre_bhb_affected(const strucreturn true; } +u8 get_spectre_bhb_loop_value (void ) +{ +return max_bhb_k; +} +static void this_cpu_set_vectors (enum arm64_bp_harden_el1_vectors slot) {const char *v =arm64_get_bp_hardening_vector (slot);
Greg Kroah-Hartman
maintainerPATCH 75/92 arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Morse <[email protected]>
commit 0dfefc2ea2f29ced2416017d7e5b1253a54c2735 upstream.
A malicious BPF program may manipulate the branch history to influence what the hardware speculates will happen next.
On exit from a BPF program, emit the BHB mititgation sequence.
This is only applied for 'classic' cBPF programs that are loaded by seccomp.
--- arch/arm64/include/asm/spectre.h | 1 arch/arm64/kernel/proton-pack.c | 2 - arch/arm64/net/bpf_jit_comp.c | 54 ++++++++++++++++++++++++++++++++++++--- 3 files changed, 52 insertions(+), 5 deletions(-)
arch/arm64/include/asm/spectre.h +1 -0
@@ -96,6 +96,7 @@ enum mitigation_state arm64_get_meltdownenum mitigation_state arm64_get_spectre_bhb_state (void );bool is_spectre_bhb_affected (const struct arm64_cpu_capabilities *entry,int scope); +extern bool __nospectre_bhb;u8 get_spectre_bhb_loop_value (void );bool is_spectre_bhb_fw_mitigated (void );void spectre_bhb_enable_mitigation (const struct arm64_cpu_capabilities *__unused);
arch/arm64/kernel/proton-pack.c +1 -1
@@ -1035,7 +1035,7 @@ static void this_cpu_set_vectors(enum arisb (); } -static bool __read_mostly __nospectre_bhb; +bool __read_mostly __nospectre_bhb;static int __init parse_spectre_bhb_param (char *str) { __nospectre_bhb = true;
arch/arm64/net/bpf_jit_comp.c +50 -4
93 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 76/92 arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Morse <[email protected]>
commit f300769ead032513a68e4a02e806393402e626f8 upstream.
Support for eBPF programs loaded by unprivileged users is typically disabled. This means only cBPF programs need to be mitigated for BHB.
In addition, only mitigate cBPF programs that were loaded by an unprivileged user. Privileged users can also load the same program via eBPF, making the mitigation pointless.
--- arch/arm64/net/bpf_jit_comp.c | 3 +++ 1 file changed, 3 insertions(+)
arch/arm64/net/bpf_jit_comp.c +3 -0
@@ -666,6 +666,9 @@ static void __maybe_unused build_bhb_mit arm64_get_spectre_v2_state() == SPECTRE_VULNERABLE)return ; +if (capable (CAP_SYS_ADMIN )) +return ; +if (supports_clearbhb (SCOPE_SYSTEM )) {emit (aarch64_insn_gen_hint (AARCH64_INSN_HINT_CLEARBHB ), ctx);return ;
Greg Kroah-Hartman
maintainerPATCH 77/92 arm64: proton-pack: Add new CPUs k values for branch mitigation
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Morse <[email protected]>
commit efe676a1a7554219eae0b0dcfe1e0cdcc9ef9aef upstream.
Update the list of 'k' values for the branch mitigation from arm's website.
Add the values for Cortex-X1C. The MIDR_EL1 value can be found here:
https://developer.arm.com/documentation/101968/0002/Register-descriptions/AArch>
--- arch/arm64/include/asm/cputype.h | 2 ++ arch/arm64/kernel/proton-pack.c | 1 + 2 files changed, 3 insertions(+)
arch/arm64/include/asm/cputype.h +2 -0
@@ -81,6 +81,7 @@#define ARM_CPU_PART_CORTEX_A78AE 0xD42#define ARM_CPU_PART_CORTEX_X1 0xD44#define ARM_CPU_PART_CORTEX_A510 0xD46 +#define ARM_CPU_PART_CORTEX_X1C 0xD4C#define ARM_CPU_PART_CORTEX_A520 0xD80#define ARM_CPU_PART_CORTEX_A710 0xD47#define ARM_CPU_PART_CORTEX_A715 0xD4D
@@ -159,6 +160,7 @@#define MIDR_CORTEX_A78AE MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78AE)#define MIDR_CORTEX_X1 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X1)#define MIDR_CORTEX_A510 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A510) +#define MIDR_CORTEX_X1C MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X1C)#define MIDR_CORTEX_A520 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A520)#define MIDR_CORTEX_A710 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A710)#define MIDR_CORTEX_A715 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A715)
arch/arm64/kernel/proton-pack.c +1 -0
@@ -903,6 +903,7 @@ static u8 spectre_bhb_loop_affected(voidMIDR_ALL_VERSIONS (MIDR_CORTEX_A78AE ),MIDR_ALL_VERSIONS (MIDR_CORTEX_A78C ),MIDR_ALL_VERSIONS (MIDR_CORTEX_X1 ), +MIDR_ALL_VERSIONS (MIDR_CORTEX_X1C ),MIDR_ALL_VERSIONS (MIDR_CORTEX_A710 ),MIDR_ALL_VERSIONS (MIDR_CORTEX_X2 ), MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2),
Greg Kroah-Hartman
maintainerPATCH 78/92 x86/bpf: Call branch history clearing sequence on exit
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Sneddon <[email protected]>
commit d4e89d212d401672e9cdfe825d947ee3a9fbe3f5 upstream.
Classic BPF programs have been identified as potential vectors for intra-mode Branch Target Injection (BTI) attacks. Classic BPF programs can be run by unprivileged users. They allow unprivileged code to execute inside the kernel. Attackers can use unprivileged cBPF to craft branch history in kernel mode that can influence the target of indirect branches.
Introduce a branch history buffer (BHB) clearing sequence during the JIT compilation of classic BPF programs. The clearing sequence is the same as is used in previous mitigations to protect syscalls. Since eBPF programs already have their own mitigations in place, only insert the call on classic programs that aren't run by privileged users.
--- arch/x86/net/bpf_jit_comp.c | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+)
arch/x86/net/bpf_jit_comp.c +32 -0
@@ -947,6 +947,29 @@ static void emit_nops(u8 **pprog, int le#define RESTORE_TAIL_CALL_CNT (stack) \ EMIT3_off32(0x48, 0x8B, 0x85, -round_up(stack, 8) - 8) +static int emit_spectre_bhb_barrier (u8 **pprog,u8 *ip, +struct bpf_prog *bpf_prog) +{ +u8 *prog = *pprog; +u8 *func; + +if (cpu_feature_enabled (X86_FEATURE_CLEAR_BHB_LOOP )) { +/* The clearing sequence clobbers eax and ecx. */ +EMIT1 (0x50 );/* push rax */ +EMIT1 (0x51 );/* push rcx */ + ip +=2 ; + + func = (u8 *)clear_bhb_loop; + +if (emit_call (&prog, func, ip)) +return -EINVAL ; +EMIT1 (0x59 );/* pop rcx */ +EMIT1 (0x58 );/* pop rax */ + } + *pprog = prog; +return 0 ; +} +static int do_jit (struct bpf_prog *bpf_prog,int *addrs,u8 *image,u8 *rw_image,int oldproglen,struct jit_context *ctx,bool jmp_padding) {
@@ -1760,6 +1783,15 @@ emit_jmp: seen_exit = true;/* Update cleanup_addr */ ctx->cleanup_addr = proglen; + +if (bpf_prog_was_classic (bpf_prog) && + !capable (CAP_SYS_ADMIN )) { +u8 *ip = image + addrs[i -1 ]; + +if (emit_spectre_bhb_barrier (&prog, ip, bpf_prog)) +return -EINVAL ; + } +pop_callee_regs (&prog, callee_regs_used);EMIT1 (0xC9 );/* leave */ emit_return (&prog, image + addrs[i -1 ] + (prog - temp));
Greg Kroah-Hartman
maintainerPATCH 79/92 x86/bpf: Add IBHF call at end of classic BPF
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Sneddon <[email protected]>
commit 9f725eec8fc0b39bdc07dcc8897283c367c1a163 upstream.
Classic BPF programs can be run by unprivileged users, allowing unprivileged code to execute inside the kernel. Attackers can use this to craft branch history in kernel mode that can influence the target of indirect branches.
BHI_DIS_S provides user-kernel isolation of branch history, but cBPF can be used to bypass this protection by crafting branch history in kernel mode. To stop intra-mode attacks via cBPF programs, Intel created a new instruction Indirect Branch History Fence (IBHF). IBHF prevents the predicted targets of subsequent indirect branches from being influenced by branch history prior to the IBHF. IBHF is only effective while BHI_DIS_S is enabled.
Add the IBHF instruction to cBPF jitted code's exit path. Add the new fence when the hardware mitigation is enabled (i.e., X86_FEATURE_CLEAR_BHB_HW is set) or after the software sequence (X86_FEATURE_CLEAR_BHB_LOOP) is being used in a virtual machine. Note that X86_FEATURE_CLEAR_BHB_HW and X86_FEATURE_CLEAR_BHB_LOOP are mutually exclusive, so the JIT compiler will only emit the new fence, not the SW sequence, when X86_FEATURE_CLEAR_BHB_HW is set.
Hardware that enumerates BHI_NO basically has BHI_DIS_S protections always enabled, regardless of the value of BHI_DIS_S. Since BHI_DIS_S doesn't protect against intra-mode attacks, enumerate BHI bug on BHI_NO hardware as well.
--- arch/x86/kernel/cpu/common.c | 9 ++++++--- arch/x86/net/bpf_jit_comp.c | 19 +++++++++++++++++++ 2 files changed, 25 insertions(+), 3 deletions(-)
arch/x86/kernel/cpu/common.c +6 -3
@@ -1455,9 +1455,12 @@ static void __init cpu_set_bug_bits(struif (vulnerable_to_rfds (x86_arch_cap_msr))setup_force_cpu_bug (X86_BUG_RFDS ); -/* When virtualized, eIBRS could be hidden, assume vulnerable */ -if (!(x86_arch_cap_msr &ARCH_CAP_BHI_NO ) && - !cpu_matches (cpu_vuln_whitelist,NO_BHI ) && +/* +* Intel parts with eIBRS are vulnerable to BHI attacks. Parts with +* BHI_NO still need to use the BHI mitigation to prevent Intra-mode +* attacks. When virtualized, eIBRS could be hidden, assume vulnerable. +*/ +if (!cpu_matches (cpu_vuln_whitelist,NO_BHI ) && (boot_cpu_has (X86_FEATURE_IBRS_ENHANCED ) ||boot_cpu_has (X86_FEATURE_HYPERVISOR )))setup_force_cpu_bug (X86_BUG_BHI );
arch/x86/net/bpf_jit_comp.c +19 -0
@@ -36,6 +36,8 @@ static u8 *emit_code(u8 *ptr, u32 bytes,#define EMIT2 (b1, b2) EMIT((b1) + ((b2) << 8), 2)#define EMIT3 (b1, b2, b3) EMIT((b1) + ((b2) << 8) + ((b3) << 16), 3)#define EMIT4 (b1, b2, b3, b4) EMIT((b1) + ((b2) << 8) + ((b3) << 16) + ((b4) << 24), 4) +#define EMIT5 (b1, b2, b3, b4, b5) \ + do { EMIT1(b1); EMIT4(b2, b3, b4, b5); } while (0)#define EMIT1_off32 (b1, off) \ do { EMIT1(b1); EMIT(off, 4); } while (0)
@@ -966,6 +968,23 @@ static int emit_spectre_bhb_barrier(u8 *EMIT1 (0x59 );/* pop rcx */ EMIT1 (0x58 );/* pop rax */ } +/* Insert IBHF instruction */ +if ((cpu_feature_enabled (X86_FEATURE_CLEAR_BHB_LOOP ) && +cpu_feature_enabled (X86_FEATURE_HYPERVISOR )) || + (cpu_feature_enabled (X86_FEATURE_CLEAR_BHB_HW ) && +IS_ENABLED (CONFIG_X86_64 ))) { +/* +* Add an Indirect Branch History Fence (IBHF). IBHF acts as a +* fence preventing branch history from before the fence from +* affecting indirect branches after the fence. This is +* specifically used in cBPF jitted code to prevent Intra-mode +* BHI attacks. The IBHF instruction is designed to be a NOP on +* hardware that doesn't need or support it. The REP and REX.W +* prefixes are required by the microcode, and they also ensure +* that the NOP is unlikely to be used in existing code. +*/ +EMIT5 (0xF3 ,0x48 ,0x0F ,0x1E ,0xF8 );/* ibhf */ + } *pprog = prog;return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 80/92 x86/bhi: Do not set BHI_DIS_S in 32-bit mode
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawan Gupta <[email protected]>
commit 073fdbe02c69c43fb7c0d547ec265c7747d4a646 upstream.
With the possibility of intra-mode BHI via cBPF, complete mitigation for BHI is to use IBHF (history fence) instruction with BHI_DIS_S set. Since this new instruction is only available in 64-bit mode, setting BHI_DIS_S in 32-bit mode is only a partial mitigation.
Do not set BHI_DIS_S in 32-bit mode so as to avoid reporting misleading mitigated status. With this change IBHF won't be used in 32-bit mode, also remove the CONFIG_X86_64 check from emit_spectre_bhb_barrier().
--- arch/x86/kernel/cpu/bugs.c | 5 +++-- arch/x86/net/bpf_jit_comp.c | 5 +++-- 2 files changed, 6 insertions(+), 4 deletions(-)
arch/x86/kernel/cpu/bugs.c +3 -2
@@ -1656,10 +1656,11 @@ static void __init bhi_select_mitigationreturn ; } -if (spec_ctrl_bhi_dis ()) +if (!IS_ENABLED (CONFIG_X86_64 ))return ; -if (!IS_ENABLED (CONFIG_X86_64 )) +/* Mitigate in hardware if supported */ +if (spec_ctrl_bhi_dis ())return ;/* Mitigate KVM by default */
arch/x86/net/bpf_jit_comp.c +3 -2
@@ -971,8 +971,7 @@ static int emit_spectre_bhb_barrier(u8 */* Insert IBHF instruction */ if ((cpu_feature_enabled (X86_FEATURE_CLEAR_BHB_LOOP ) &&cpu_feature_enabled (X86_FEATURE_HYPERVISOR )) || - (cpu_feature_enabled (X86_FEATURE_CLEAR_BHB_HW ) && -IS_ENABLED (CONFIG_X86_64 ))) { +cpu_feature_enabled (X86_FEATURE_CLEAR_BHB_HW )) {/* * Add an Indirect Branch History Fence (IBHF). IBHF acts as a * fence preventing branch history from before the fence from
@@ -982,6 +981,8 @@ static int emit_spectre_bhb_barrier(u8 ** hardware that doesn't need or support it. The REP and REX.W * prefixes are required by the microcode, and they also ensure * that the NOP is unlikely to be used in existing code. +* +* IBHF is not a valid instruction in 32-bit mode. */ EMIT5 (0xF3 ,0x48 ,0x0F ,0x1E ,0xF8 );/* ibhf */ }
Greg Kroah-Hartman
maintainerPATCH 81/92 x86/speculation: Simplify and make CALL_NOSPEC consistent
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawan Gupta <[email protected]>
commit cfceff8526a426948b53445c02bcb98453c7330d upstream.
CALL_NOSPEC macro is used to generate Spectre-v2 mitigation friendly indirect branches. At compile time the macro defaults to indirect branch, and at runtime those can be patched to thunk based mitigations.
This approach is opposite of what is done for the rest of the kernel, where the compile time default is to replace indirect calls with retpoline thunk calls.
Make CALL_NOSPEC consistent with the rest of the kernel, default to retpoline thunk at compile time when CONFIG_RETPOLINE is enabled.
[ pawan: s/CONFIG_MITIGATION_RETPOLINE/CONFIG_RETPOLINE/ ]
--- arch/x86/include/asm/nospec-branch.h | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-)
arch/x86/include/asm/nospec-branch.h +5 -10
@@ -284,16 +284,11 @@ extern void (*x86_return_thunk)(void);* Inline asm uses the %V modifier which is only in newer GCC * which is ensured when CONFIG_RETPOLINE is defined. */ -# define CALL_NOSPEC \ - ALTERNATIVE_2( \ - ANNOTATE_RETPOLINE_SAFE \ - "call *%[thunk_target]\n", \ - "call __x86_indirect_thunk_%V[thunk_target]\n", \ - X86_FEATURE_RETPOLINE, \ - "lfence;\n" \ - ANNOTATE_RETPOLINE_SAFE \ - "call *%[thunk_target]\n", \ - X86_FEATURE_RETPOLINE_LFENCE) +#ifdef CONFIG_RETPOLINE +#define CALL_NOSPEC "call __x86_indirect_thunk_%V[thunk_target]\n" +#else +#define CALL_NOSPEC "call *%[thunk_target]\n" +#endif # define THUNK_TARGET (addr) [thunk_target] "r" (addr)
Greg Kroah-Hartman
maintainerPATCH 82/92 x86/speculation: Add a conditional CS prefix to CALL_NOSPEC
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawan Gupta <[email protected]>
commit 052040e34c08428a5a388b85787e8531970c0c67 upstream.
Retpoline mitigation for spectre-v2 uses thunks for indirect branches. To support this mitigation compilers add a CS prefix with -mindirect-branch-cs-prefix. For an indirect branch in asm, this needs to be added manually.
CS prefix is already being added to indirect branches in asm files, but not in inline asm. Add CS prefix to CALL_NOSPEC for inline asm as well. There is no JMP_NOSPEC for inline asm.
--- arch/x86/include/asm/nospec-branch.h | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-)
arch/x86/include/asm/nospec-branch.h +15 -4
@@ -119,9 +119,8 @@ .endm /* - * Equivalent to -mindirect-branch-cs-prefix; emit the 5 byte jmp/call - * to the retpoline thunk with a CS prefix when the register requires - * a RAX prefix byte to encode. Also see apply_retpolines(). + * Emits a conditional CS prefix that is compatible with + * -mindirect-branch-cs-prefix. */ .macro __CS_PREFIX reg:req .irp rs,r8,r9,r10,r11,r12,r13,r14,r15
@@ -281,11 +280,23 @@ extern void (*x86_return_thunk)(void);#ifdef CONFIG_X86_64 /* +* Emits a conditional CS prefix that is compatible with +* -mindirect-branch-cs-prefix. +*/ +#define __CS_PREFIX (reg) \ + ".irp rs,r8,r9,r10,r11,r12,r13,r14,r15\n" \ + ".ifc \\rs," reg "\n" \ + ".byte 0x2e\n" \ + ".endif\n" \ + ".endr\n" + +/* * Inline asm uses the %V modifier which is only in newer GCC * which is ensured when CONFIG_RETPOLINE is defined. */ #ifdef CONFIG_RETPOLINE -#define CALL_NOSPEC "call __x86_indirect_thunk_%V[thunk_target]\n" +#define CALL_NOSPEC __CS_PREFIX("%V[thunk_target]") \ + "call __x86_indirect_thunk_%V[thunk_target]\n"#else #define CALL_NOSPEC "call *%[thunk_target]\n"#endif
Greg Kroah-Hartman
maintainerPATCH 83/92 x86/speculation: Remove the extra #ifdef around CALL_NOSPEC
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawan Gupta <[email protected]>
commit c8c81458863ab686cda4fe1e603fccaae0f12460 upstream.
Commit:
010c4a461c1d ("x86/speculation: Simplify and make CALL_NOSPEC consistent")
added an #ifdef CONFIG_RETPOLINE around the CALL_NOSPEC definition. This is not required as this code is already under a larger #ifdef.
Remove the extra #ifdef, no functional change.
vmlinux size remains same before and after this change:
CONFIG_RETPOLINE=y:
text data bss dec hex filename 25434752 7342290 2301212 35078254 217406e vmlinux.before 25434752 7342290 2301212 35078254 217406e vmlinux.after
# CONFIG_RETPOLINE is not set:
text data bss dec hex filename 22943094 6214994 1550152 30708240 1d49210 vmlinux.before 22943094 6214994 1550152 30708240 1d49210 vmlinux.after
[ pawan: s/CONFIG_MITIGATION_RETPOLINE/CONFIG_RETPOLINE/ ]
--- arch/x86/include/asm/nospec-branch.h | 4 ---- 1 file changed, 4 deletions(-)
arch/x86/include/asm/nospec-branch.h +0 -4
@@ -294,12 +294,8 @@ extern void (*x86_return_thunk)(void);* Inline asm uses the %V modifier which is only in newer GCC * which is ensured when CONFIG_RETPOLINE is defined. */ -#ifdef CONFIG_RETPOLINE #define CALL_NOSPEC __CS_PREFIX("%V[thunk_target]") \ "call __x86_indirect_thunk_%V[thunk_target]\n" -#else -#define CALL_NOSPEC "call *%[thunk_target]\n" -#endif # define THUNK_TARGET (addr) [thunk_target] "r" (addr)
Greg Kroah-Hartman
maintainerPATCH 84/92 Documentation: x86/bugs/its: Add ITS documentation
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawan Gupta <[email protected]>
commit 1ac116ce6468670eeda39345a5585df308243dca upstream.
Add the admin-guide for Indirect Target Selection (ITS).
--- Documentation/admin-guide/hw-vuln/index.rst | 1 Documentation/admin-guide/hw-vuln/indirect-target-selection.rst | 156 ++++++++++ 2 files changed, 157 insertions(+) create mode 100644 Documentation/admin-guide/hw-vuln/indirect-target-selection.rst
Documentation/admin-guide/hw-vuln/index.rst +1 -0
@@ -22,3 +22,4 @@ are configurable at compile, boot or run gather_data_sampling.rst srso reg-file-data-sampling + indirect-target-selection
Documentation/admin-guide/hw-vuln/indirect-target-selection.rst new file +156 -0
156 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 85/92 x86/its: Enumerate Indirect Target Selection (ITS) bug
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawan Gupta <[email protected]>
commit 159013a7ca18c271ff64192deb62a689b622d860 upstream.
ITS bug in some pre-Alderlake Intel CPUs may allow indirect branches in the first half of a cache line get predicted to a target of a branch located in the second half of the cache line.
Set X86_BUG_ITS on affected CPUs. Mitigation to follow in later commits.
--- arch/x86/include/asm/cpufeatures.h | 1 arch/x86/include/asm/msr-index.h | 8 +++++ arch/x86/kernel/cpu/common.c | 58 +++++++++++++++++++++++++++++-------- arch/x86/kvm/x86.c | 4 +- 4 files changed, 58 insertions(+), 13 deletions(-)
arch/x86/include/asm/cpufeatures.h +1 -0
@@ -495,4 +495,5 @@#define X86_BUG_RFDS X86_BUG(1*32 + 2)/* CPU is vulnerable to Register File Data Sampling */ #define X86_BUG_BHI X86_BUG(1*32 + 3)/* CPU is affected by Branch History Injection */ #define X86_BUG_IBPB_NO_RET X86_BUG(1*32 + 4)/* "ibpb_no_ret" IBPB omits return target predictions */ +#define X86_BUG_ITS X86_BUG(1*32 + 5)/* CPU is affected by Indirect Target Selection */ #endif /* _ASM_X86_CPUFEATURES_H */
arch/x86/include/asm/msr-index.h +8 -0
@@ -185,6 +185,14 @@* VERW clears CPU Register * File. */ +#define ARCH_CAP_ITS_NO BIT_ULL(62)/* +* Not susceptible to +* Indirect Target Selection. +* This bit is not set by +* HW, but is synthesized by +* VMMs for guests to know +* their affected status. +*/ #define ARCH_CAP_XAPIC_DISABLE BIT(21)/* * IA32_XAPIC_DISABLE_STATUS MSR
arch/x86/kernel/cpu/common.c +46 -12
86 lines not on this page · raw message
arch/x86/kvm/x86.c +3 -1
@@ -1614,7 +1614,7 @@ static unsigned int num_msr_based_featur ARCH_CAP_PSCHANGE_MC_NO | ARCH_CAP_TSX_CTRL_MSR | ARCH_CAP_TAA_NO | \ ARCH_CAP_SBDR_SSDP_NO | ARCH_CAP_FBSDP_NO | ARCH_CAP_PSDP_NO | \ ARCH_CAP_FB_CLEAR | ARCH_CAP_RRSBA | ARCH_CAP_PBRSB_NO | ARCH_CAP_GDS_NO | \ - ARCH_CAP_RFDS_NO | ARCH_CAP_RFDS_CLEAR | ARCH_CAP_BHI_NO) + ARCH_CAP_RFDS_NO | ARCH_CAP_RFDS_CLEAR | ARCH_CAP_BHI_NO | ARCH_CAP_ITS_NO)static u64 kvm_get_arch_capabilities (void ) {
@@ -1653,6 +1653,8 @@ static u64 kvm_get_arch_capabilities(voi data |=ARCH_CAP_MDS_NO ;if (!boot_cpu_has_bug (X86_BUG_RFDS )) data |=ARCH_CAP_RFDS_NO ; +if (!boot_cpu_has_bug (X86_BUG_ITS )) + data |=ARCH_CAP_ITS_NO ;if (!boot_cpu_has (X86_FEATURE_RTM )) {/*
Greg Kroah-Hartman
maintainerPATCH 86/92 x86/its: Add support for ITS-safe indirect thunk
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawan Gupta <[email protected]>
commit 8754e67ad4ac692c67ff1f99c0d07156f04ae40c upstream.
Due to ITS, indirect branches in the lower half of a cacheline may be vulnerable to branch target injection attack.
Introduce ITS-safe thunks to patch indirect branches in the lower half of cacheline with the thunk. Also thunk any eBPF generated indirect branches in emit_indirect_jump().
Below category of indirect branches are not mitigated:
- Indirect branches in the .init section are not mitigated because they are discarded after boot.
- Indirect branches that are explicitly marked retpoline-safe.
Note that retpoline also mitigates the indirect branches against ITS. This is because the retpoline sequence fills an RSB entry before RET, and it does not suffer from RSB-underflow part of the ITS.
--- arch/x86/Kconfig | 11 +++++ arch/x86/include/asm/cpufeatures.h | 1 arch/x86/include/asm/nospec-branch.h | 4 + arch/x86/kernel/alternative.c | 77 +++++++++++++++++++++++++++++++++++ arch/x86/kernel/vmlinux.lds.S | 6 ++ arch/x86/lib/retpoline.S | 28 ++++++++++++ arch/x86/net/bpf_jit_comp.c | 6 ++ 7 files changed, 132 insertions(+), 1 deletion(-)
arch/x86/Kconfig +11 -0
@@ -2575,6 +2575,17 @@ config MITIGATION_SPECTRE_BHI indirect branches. See <file:Documentation/admin-guide/hw-vuln/spectre.rst> +config MITIGATION_ITS + bool "Enable Indirect Target Selection mitigation" + depends on CPU_SUP_INTEL && X86_64 + depends on RETPOLINE && RETHUNK + default y + help + Enable Indirect Target Selection (ITS) mitigation. ITS is a bug in + BPU on some Intel CPUs that may allow Spectre V2 style attacks. If + disabled, mitigation cannot be enabled via cmdline. + See <file:Documentation/admin-guide/hw-vuln/indirect-target-selection.rst> + endif config ARCH_HAS_ADD_PAGES
arch/x86/include/asm/cpufeatures.h +1 -0
@@ -445,6 +445,7 @@#define X86_FEATURE_BHI_CTRL (21*32+ 2)/* "" BHI_DIS_S HW control available */ #define X86_FEATURE_CLEAR_BHB_HW (21*32+ 3)/* "" BHI_DIS_S HW control enabled */ #define X86_FEATURE_CLEAR_BHB_LOOP_ON_VMEXIT (21*32+ 4)/* "" Clear branch history at vmexit using SW loop */ +#define X86_FEATURE_INDIRECT_THUNK_ITS (21*32 + 5)/* "" Use thunk for indirect branches in lower half of cacheline */ /* * BUG word(s)
arch/x86/include/asm/nospec-branch.h +4 -0
@@ -244,8 +244,12 @@ _ASM_PTR" 999b\n\t" \ ".popsection\n\t" +#define ITS_THUNK_SIZE 64 +typedef u8 retpoline_thunk_t [RETPOLINE_THUNK_SIZE ]; +typedef u8 its_thunk_t [ITS_THUNK_SIZE ];extern retpoline_thunk_t __x86_indirect_thunk_array[]; +extern its_thunk_t __x86_indirect_its_thunk_array[];#ifdef CONFIG_RETHUNK extern void __x86_return_thunk (void );
arch/x86/kernel/alternative.c +77 -0
89 lines not on this page · raw message
arch/x86/kernel/vmlinux.lds.S +6 -0
@@ -528,6 +528,12 @@ INIT_PER_CPU(irq_stack_backing_store); "SRSO function pair won't alias"); #endif +#if defined(CONFIG_MITIGATION_ITS) && !defined(CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_64B) +. = ASSERT(__x86_indirect_its_thunk_rax & 0x20, "__x86_indirect_thunk_rax not in second half of cacheline"); +. = ASSERT(((__x86_indirect_its_thunk_rcx - __x86_indirect_its_thunk_rax) % 64) == 0, "Indirect thunks are not cacheline apart"); +. = ASSERT(__x86_indirect_its_thunk_array == __x86_indirect_its_thunk_rax, "Gap in ITS thunk array"); +#endif + #endif /* CONFIG_X86_64 */ #ifdef CONFIG_KEXEC_CORE
arch/x86/lib/retpoline.S +28 -0
@@ -258,6 +258,34 @@ SYM_FUNC_START(entry_untrain_ret) SYM_FUNC_END(entry_untrain_ret) __EXPORT_THUNK(entry_untrain_ret) +#ifdef CONFIG_MITIGATION_ITS + +.macro ITS_THUNK reg + +SYM_INNER_LABEL(__x86_indirect_its_thunk_\reg, SYM_L_GLOBAL) + UNWIND_HINT_EMPTY + ANNOTATE_NOENDBR + ANNOTATE_RETPOLINE_SAFE + jmp *%\reg + int3 + .align 32, 0xcc /* fill to the end of the line */ + .skip 32, 0xcc /* skip to the next upper half */ +.endm + +/* ITS mitigation requires thunks be aligned to upper half of cacheline */ +.align 64, 0xcc +.skip 32, 0xcc +SYM_CODE_START(__x86_indirect_its_thunk_array) + +#define GEN(reg) ITS_THUNK reg +#include <asm/GEN-for-each-reg.h> +#undef GEN + + .align 64, 0xcc +SYM_CODE_END(__x86_indirect_its_thunk_array) + +#endif + SYM_CODE_START(__x86_return_thunk) UNWIND_HINT_FUNC ANNOTATE_NOENDBR
arch/x86/net/bpf_jit_comp.c +5 -1
@@ -464,7 +464,11 @@ static void emit_indirect_jump(u8 **ppro {u8 *prog = *pprog; -if (cpu_feature_enabled (X86_FEATURE_RETPOLINE_LFENCE )) { +if (IS_ENABLED (CONFIG_MITIGATION_ITS ) && +cpu_feature_enabled (X86_FEATURE_INDIRECT_THUNK_ITS )) { +OPTIMIZER_HIDE_VAR (reg); +emit_jump (&prog, &__x86_indirect_its_thunk_array[reg], ip); + }else if (cpu_feature_enabled (X86_FEATURE_RETPOLINE_LFENCE )) {EMIT_LFENCE ();EMIT2 (0xFF ,0xE0 + reg); }else if (cpu_feature_enabled (X86_FEATURE_RETPOLINE )) {
Greg Kroah-Hartman
maintainerPATCH 87/92 x86/its: Add support for ITS-safe return thunk
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawan Gupta <[email protected]>
commit a75bf27fe41abe658c53276a0c486c4bf9adecfc upstream.
RETs in the lower half of cacheline may be affected by ITS bug, specifically when the RSB-underflows. Use ITS-safe return thunk for such RETs.
RETs that are not patched:
- RET in retpoline sequence does not need to be patched, because the sequence itself fills an RSB before RET.
- RET in Call Depth Tracking (CDT) thunks __x86_indirect_{call|jump}_thunk and call_depth_return_thunk are not patched because CDT by design prevents RSB-underflow.
- RETs in .init section are not reachable after init.
- RETs that are explicitly marked safe with ANNOTATE_UNRET_SAFE.
--- arch/x86/include/asm/alternative.h | 14 ++++++++++++++ arch/x86/include/asm/nospec-branch.h | 6 ++++++ arch/x86/kernel/alternative.c | 17 ++++++++++++++++- arch/x86/kernel/ftrace.c | 2 +- arch/x86/kernel/static_call.c | 2 +- arch/x86/kernel/vmlinux.lds.S | 4 ++++ arch/x86/lib/retpoline.S | 13 ++++++++++++- arch/x86/net/bpf_jit_comp.c | 2 +- 8 files changed, 55 insertions(+), 5 deletions(-)
arch/x86/include/asm/alternative.h +14 -0
@@ -81,6 +81,20 @@ extern void apply_ibt_endbr(s32 *start,struct module ; +#if defined(CONFIG_RETHUNK ) && defined(CONFIG_OBJTOOL ) +extern bool cpu_wants_rethunk (void ); +extern bool cpu_wants_rethunk_at (void *addr); +#else +static __always_inline bool cpu_wants_rethunk(void) +{ +return false; +} +static __always_inline bool cpu_wants_rethunk_at(void *addr) +{ +return false; +} +#endif +#ifdef CONFIG_SMP extern void alternatives_smp_module_add(struct module *mod, char *name, void *locks, void *locks_end,
arch/x86/include/asm/nospec-branch.h +6 -0
@@ -257,6 +257,12 @@ extern void __x86_return_thunk(void);static inline void __x86_return_thunk (void ) {}#endif +#ifdef CONFIG_MITIGATION_ITS +extern void its_return_thunk (void ); +#else +static inline void its_return_thunk (void ) {} +#endif +extern void retbleed_return_thunk (void );extern void srso_return_thunk (void );extern void srso_alias_return_thunk (void );
arch/x86/kernel/alternative.c +16 -1
@@ -614,6 +614,21 @@ void __init_or_module noinline apply_ret#ifdef CONFIG_RETHUNK +bool cpu_wants_rethunk (void ) +{ +return cpu_feature_enabled (X86_FEATURE_RETHUNK ); +} + +bool cpu_wants_rethunk_at (void *addr) +{ +if (!cpu_feature_enabled (X86_FEATURE_RETHUNK )) +return false; +if (x86_return_thunk != its_return_thunk) +return true; + +return !((unsigned long )addr &0x20 ); +} +/* * Rewrite the compiler generated return thunk tail-calls. *
@@ -629,7 +644,7 @@ static int patch_return(void *addr, stru {int i =0 ; -if (cpu_feature_enabled (X86_FEATURE_RETHUNK )) { +if (cpu_wants_rethunk_at (addr)) {if (x86_return_thunk == __x86_return_thunk)return -1 ;
arch/x86/kernel/ftrace.c +1 -1
@@ -360,7 +360,7 @@ create_trampoline(struct ftrace_ops *ops goto fail; ip = trampoline + size; -if (cpu_feature_enabled (X86_FEATURE_RETHUNK )) +if (cpu_wants_rethunk_at (ip))__text_gen_insn (ip,JMP32_INSN_OPCODE , ip, x86_return_thunk,JMP32_INSN_SIZE );else memcpy (ip, retq,sizeof (retq));
arch/x86/kernel/static_call.c +1 -1
@@ -79,7 +79,7 @@ static void __ref __static_call_transforbreak ;case RET : -if (cpu_feature_enabled (X86_FEATURE_RETHUNK )) +if (cpu_wants_rethunk_at (insn)) code =text_gen_insn (JMP32_INSN_OPCODE , insn, x86_return_thunk);else code = &retinsn;
arch/x86/kernel/vmlinux.lds.S +4 -0
@@ -534,6 +534,10 @@ INIT_PER_CPU(irq_stack_backing_store); . = ASSERT(__x86_indirect_its_thunk_array == __x86_indirect_its_thunk_rax, "Gap in ITS thunk array"); #endif +#if defined(CONFIG_MITIGATION_ITS) && !defined(CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_64B) +. = ASSERT(its_return_thunk & 0x20, "its_return_thunk not in second half of cacheline"); +#endif + #endif /* CONFIG_X86_64 */ #ifdef CONFIG_KEXEC_CORE
arch/x86/lib/retpoline.S +12 -1
@@ -284,7 +284,18 @@ SYM_CODE_START(__x86_indirect_its_thunk_ .align 64, 0xcc SYM_CODE_END(__x86_indirect_its_thunk_array) -#endif +.align 64, 0xcc +.skip 32, 0xcc +SYM_CODE_START(its_return_thunk) + UNWIND_HINT_FUNC + ANNOTATE_NOENDBR + ANNOTATE_UNRET_SAFE + ret + int3 +SYM_CODE_END(its_return_thunk) +EXPORT_SYMBOL(its_return_thunk) + +#endif /* CONFIG_MITIGATION_ITS */ SYM_CODE_START(__x86_return_thunk) UNWIND_HINT_FUNC
arch/x86/net/bpf_jit_comp.c +1 -1
@@ -487,7 +487,7 @@ static void emit_return(u8 **pprog, u8 * {u8 *prog = *pprog; -if (cpu_feature_enabled (X86_FEATURE_RETHUNK )) { +if (cpu_wants_rethunk ()) {emit_jump (&prog, x86_return_thunk, ip); }else {EMIT1 (0xC3 );/* ret */
Greg Kroah-Hartman
maintainerPATCH 88/92 x86/its: Enable Indirect Target Selection mitigation
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawan Gupta <[email protected]>
commit f4818881c47fd91fcb6d62373c57c7844e3de1c0 upstream.
Indirect Target Selection (ITS) is a bug in some pre-ADL Intel CPUs with eIBRS. It affects prediction of indirect branch and RETs in the lower half of cacheline. Due to ITS such branches may get wrongly predicted to a target of (direct or indirect) branch that is located in the upper half of the cacheline.
Scope of impact
===============
Guest/host isolation
--------------------
When eIBRS is used for guest/host isolation, the indirect branches in the VMM may still be predicted with targets corresponding to branches in the guest.
Intra-mode
----------
cBPF or other native gadgets can be used for intra-mode training and disclosure using ITS.
User/kernel isolation
---------------------
When eIBRS is enabled user/kernel isolation is not impacted.
Indirect Branch Prediction Barrier (IBPB)
-----------------------------------------
After an IBPB, indirect branches may be predicted with targets corresponding to direct branches which were executed prior to IBPB. This is mitigated by a microcode update.
Add cmdline parameter indirect_target_selection=off|on|force to control the mitigation to relocate the affected branches to an ITS-safe thunk i.e. located in the upper half of cacheline. Also add the sysfs reporting.
When retpoline mitigation is deployed, ITS safe-thunks are not needed, because retpoline sequence is already ITS-safe. Similarly, when call depth tracking (CDT) mitigation is deployed (retbleed=stuff), ITS safe return thunk is not used, as CDT prevents RSB-underflow.
To not overcomplicate things, ITS mitigation is not supported with spectre-v2 lfence;jmp mitigation. Moreover, it is less practical to deploy lfence;jmp mitigation on ITS affected parts anyways.
--- Documentation/ABI/testing/sysfs-devices-system-cpu | 1 Documentation/admin-guide/kernel-parameters.txt | 13 ++ arch/x86/kernel/cpu/bugs.c | 128 ++++++++++++++++++++- drivers/base/cpu.c | 8 + include/linux/cpu.h | 2 5 files changed, 149 insertions(+), 3 deletions(-)
Documentation/ABI/testing/sysfs-devices-system-cpu +1 -0
@@ -514,6 +514,7 @@ Description: information about CPUs hete What: /sys/devices/system/cpu/vulnerabilities /sys/devices/system/cpu/vulnerabilities/gather_data_sampling + /sys/devices/system/cpu/vulnerabilities/indirect_target_selection /sys/devices/system/cpu/vulnerabilities/itlb_multihit /sys/devices/system/cpu/vulnerabilities/l1tf /sys/devices/system/cpu/vulnerabilities/mds
Documentation/admin-guide/kernel-parameters.txt +13 -0
@@ -2025,6 +2025,18 @@ different crypto accelerators. This option can be used to achieve best performance for particular HW. + indirect_target_selection= [X86,Intel] Mitigation control for Indirect + Target Selection(ITS) bug in Intel CPUs. Updated + microcode is also required for a fix in IBPB. + + on: Enable mitigation (default). + off: Disable mitigation. + force: Force the ITS bug and deploy default + mitigation. + + For details see: + Documentation/admin-guide/hw-vuln/indirect-target-selection.rst + init= [KNL] Format: <full_path> Run specified binary instead of /sbin/init as init
@@ -3263,6 +3275,7 @@ expose users to several CPU vulnerabilities. Equivalent to: if nokaslr then kpti=0 [ARM64] gather_data_sampling=off [X86] + indirect_target_selection=off [X86] kvm.nx_huge_pages=off [X86] l1tf=off [X86] mds=off [X86]
arch/x86/kernel/cpu/bugs.c +125 -3
182 lines not on this page · raw message
drivers/base/cpu.c +8 -0
@@ -595,6 +595,12 @@ ssize_t __weak cpu_show_reg_file_data_sareturn sysfs_emit (buf,"Not affected\n" ); } +ssize_t __weak cpu_show_indirect_target_selection (struct device *dev, +struct device_attribute *attr,char *buf) +{ +return sysfs_emit (buf,"Not affected\n" ); +} + static DEVICE_ATTR(meltdown, 0444, cpu_show_meltdown, NULL); static DEVICE_ATTR(spectre_v1, 0444, cpu_show_spectre_v1, NULL); static DEVICE_ATTR(spectre_v2, 0444, cpu_show_spectre_v2, NULL);
@@ -609,6 +615,7 @@ static DEVICE_ATTR(retbleed, 0444, cpu_s static DEVICE_ATTR(gather_data_sampling, 0444, cpu_show_gds, NULL); static DEVICE_ATTR(spec_rstack_overflow, 0444, cpu_show_spec_rstack_overflow, NULL); static DEVICE_ATTR(reg_file_data_sampling, 0444, cpu_show_reg_file_data_sampling, NULL); +static DEVICE_ATTR(indirect_target_selection, 0444, cpu_show_indirect_target_selection, NULL);static struct attribute *cpu_root_vulnerabilities_attrs[] = { &dev_attr_meltdown.attr,
@@ -625,6 +632,7 @@ static struct attribute *cpu_root_vulner &dev_attr_gather_data_sampling.attr, &dev_attr_spec_rstack_overflow.attr, &dev_attr_reg_file_data_sampling.attr, + &dev_attr_indirect_target_selection.attr, NULL };
include/linux/cpu.h +2 -0
@@ -76,6 +76,8 @@ extern ssize_t cpu_show_gds(struct devic struct device_attribute *attr, char *buf);extern ssize_t cpu_show_reg_file_data_sampling (struct device *dev,struct device_attribute *attr,char *buf); +extern ssize_t cpu_show_indirect_target_selection (struct device *dev, +struct device_attribute *attr,char *buf); extern __printf(4, 5) struct device *cpu_device_create(struct device *parent, void *drvdata,
Greg Kroah-Hartman
maintainerPATCH 89/92 x86/its: Add "vmexit" option to skip mitigation on some CPUs
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawan Gupta <[email protected]>
commit 2665281a07e19550944e8354a2024635a7b2714a upstream.
Ice Lake generation CPUs are not affected by guest/host isolation part of ITS. If a user is only concerned about KVM guests, they can now choose a new cmdline option "vmexit" that will not deploy the ITS mitigation when CPU is not affected by guest/host isolation. This saves the performance overhead of ITS mitigation on Ice Lake gen CPUs.
When "vmexit" option selected, if the CPU is affected by ITS guest/host isolation, the default ITS mitigation is deployed.
--- Documentation/admin-guide/kernel-parameters.txt | 2 ++ arch/x86/include/asm/cpufeatures.h | 1 + arch/x86/kernel/cpu/bugs.c | 11 +++++++++++ arch/x86/kernel/cpu/common.c | 19 ++++++++++++------- 4 files changed, 26 insertions(+), 7 deletions(-)
Documentation/admin-guide/kernel-parameters.txt +2 -0
@@ -2033,6 +2033,8 @@ off: Disable mitigation. force: Force the ITS bug and deploy default mitigation. + vmexit: Only deploy mitigation if CPU is affected by + guest/host isolation part of ITS. For details see: Documentation/admin-guide/hw-vuln/indirect-target-selection.rst
arch/x86/include/asm/cpufeatures.h +1 -0
@@ -497,4 +497,5 @@#define X86_BUG_BHI X86_BUG(1*32 + 3)/* CPU is affected by Branch History Injection */ #define X86_BUG_IBPB_NO_RET X86_BUG(1*32 + 4)/* "ibpb_no_ret" IBPB omits return target predictions */ #define X86_BUG_ITS X86_BUG(1*32 + 5)/* CPU is affected by Indirect Target Selection */ +#define X86_BUG_ITS_NATIVE_ONLY X86_BUG(1*32 + 6)/* CPU is affected by ITS, VMX is not affected */ #endif /* _ASM_X86_CPUFEATURES_H */
arch/x86/kernel/cpu/bugs.c +11 -0
@@ -1158,15 +1158,18 @@ do_cmd_auto:enum its_mitigation_cmd {ITS_CMD_OFF ,ITS_CMD_ON , +ITS_CMD_VMEXIT , };enum its_mitigation {ITS_MITIGATION_OFF , +ITS_MITIGATION_VMEXIT_ONLY ,ITS_MITIGATION_ALIGNED_THUNKS , };static const char *const its_strings[] = { [ITS_MITIGATION_OFF ] ="Vulnerable" , + [ITS_MITIGATION_VMEXIT_ONLY ] ="Mitigation: Vulnerable, KVM: Not affected" , [ITS_MITIGATION_ALIGNED_THUNKS ] ="Mitigation: Aligned branch/return thunks" , };
@@ -1192,6 +1195,8 @@ static int __init its_parse_cmdline(char }else if (!strcmp (str,"force" )) { its_cmd =ITS_CMD_ON ;setup_force_cpu_bug (X86_BUG_ITS ); + }else if (!strcmp (str,"vmexit" )) { + its_cmd =ITS_CMD_VMEXIT ; }else {pr_err ("Ignoring unknown indirect_target_selection option (%s)." , str); }
@@ -1239,6 +1244,12 @@ static void __init its_select_mitigationcase ITS_CMD_OFF : its_mitigation =ITS_MITIGATION_OFF ;break ; +case ITS_CMD_VMEXIT : +if (boot_cpu_has_bug (X86_BUG_ITS_NATIVE_ONLY )) { + its_mitigation =ITS_MITIGATION_VMEXIT_ONLY ; + goto out; + } + fallthrough;case ITS_CMD_ON : its_mitigation =ITS_MITIGATION_ALIGNED_THUNKS ;if (!boot_cpu_has (X86_FEATURE_RETPOLINE ))
arch/x86/kernel/cpu/common.c +12 -7
@@ -1253,6 +1253,8 @@ static const __initconst struct x86_cpu_#define RFDS BIT(7)/* CPU is affected by Indirect Target Selection */ #define ITS BIT(8) +/* CPU is affected by Indirect Target Selection, but guest-host isolation is not affected */ +#define ITS_NATIVE_ONLY BIT(9)static const struct x86_cpu_id cpu_vuln_blacklist[]__initconst = {VULNBL_INTEL_STEPPINGS (IVYBRIDGE ,X86_STEPPING_ANY ,SRBDS ),
@@ -1273,16 +1275,16 @@ static const struct x86_cpu_id cpu_vuln_VULNBL_INTEL_STEPPINGS (KABYLAKE ,X86_STEPPINGS (0x0 ,0xc ),MMIO |RETBLEED |GDS |SRBDS ),VULNBL_INTEL_STEPPINGS (KABYLAKE ,X86_STEPPING_ANY ,MMIO |RETBLEED |GDS |SRBDS |ITS ),VULNBL_INTEL_STEPPINGS (CANNONLAKE_L ,X86_STEPPING_ANY ,RETBLEED ), -VULNBL_INTEL_STEPPINGS (ICELAKE_L ,X86_STEPPING_ANY ,MMIO |MMIO_SBDS |RETBLEED |GDS |ITS ), -VULNBL_INTEL_STEPPINGS (ICELAKE_D ,X86_STEPPING_ANY ,MMIO |GDS |ITS ), -VULNBL_INTEL_STEPPINGS (ICELAKE_X ,X86_STEPPING_ANY ,MMIO |GDS |ITS ), +VULNBL_INTEL_STEPPINGS (ICELAKE_L ,X86_STEPPING_ANY ,MMIO |MMIO_SBDS |RETBLEED |GDS |ITS |ITS_NATIVE_ONLY ), +VULNBL_INTEL_STEPPINGS (ICELAKE_D ,X86_STEPPING_ANY ,MMIO |GDS |ITS |ITS_NATIVE_ONLY ), +VULNBL_INTEL_STEPPINGS (ICELAKE_X ,X86_STEPPING_ANY ,MMIO |GDS |ITS |ITS_NATIVE_ONLY ),VULNBL_INTEL_STEPPINGS (COMETLAKE ,X86_STEPPING_ANY ,MMIO |MMIO_SBDS |RETBLEED |GDS |ITS ),VULNBL_INTEL_STEPPINGS (COMETLAKE_L ,X86_STEPPINGS (0x0 ,0x0 ),MMIO |RETBLEED |ITS ),VULNBL_INTEL_STEPPINGS (COMETLAKE_L ,X86_STEPPING_ANY ,MMIO |MMIO_SBDS |RETBLEED |GDS |ITS ), -VULNBL_INTEL_STEPPINGS (TIGERLAKE_L ,X86_STEPPING_ANY ,GDS |ITS ), -VULNBL_INTEL_STEPPINGS (TIGERLAKE ,X86_STEPPING_ANY ,GDS |ITS ), +VULNBL_INTEL_STEPPINGS (TIGERLAKE_L ,X86_STEPPING_ANY ,GDS |ITS |ITS_NATIVE_ONLY ), +VULNBL_INTEL_STEPPINGS (TIGERLAKE ,X86_STEPPING_ANY ,GDS |ITS |ITS_NATIVE_ONLY ),VULNBL_INTEL_STEPPINGS (LAKEFIELD ,X86_STEPPING_ANY ,MMIO |MMIO_SBDS |RETBLEED ), -VULNBL_INTEL_STEPPINGS (ROCKETLAKE ,X86_STEPPING_ANY ,MMIO |RETBLEED |GDS |ITS ), +VULNBL_INTEL_STEPPINGS (ROCKETLAKE ,X86_STEPPING_ANY ,MMIO |RETBLEED |GDS |ITS |ITS_NATIVE_ONLY ),VULNBL_INTEL_STEPPINGS (ALDERLAKE ,X86_STEPPING_ANY ,RFDS ),VULNBL_INTEL_STEPPINGS (ALDERLAKE_L ,X86_STEPPING_ANY ,RFDS ), VULNBL_INTEL_STEPPINGS(RAPTORLAKE, X86_STEPPING_ANY, RFDS),
@@ -1499,8 +1501,11 @@ static void __init cpu_set_bug_bits(struif (cpu_has (c,X86_FEATURE_AMD_IBPB ) && !cpu_has (c,X86_FEATURE_AMD_IBPB_RET ))setup_force_cpu_bug (X86_BUG_IBPB_NO_RET ); -if (vulnerable_to_its (x86_arch_cap_msr)) +if (vulnerable_to_its (x86_arch_cap_msr)) {setup_force_cpu_bug (X86_BUG_ITS ); +if (cpu_matches (cpu_vuln_blacklist,ITS_NATIVE_ONLY )) +setup_force_cpu_bug (X86_BUG_ITS_NATIVE_ONLY ); + }if (cpu_matches (cpu_vuln_whitelist,NO_MELTDOWN ))return ;
Greg Kroah-Hartman
maintainerPATCH 90/92 x86/its: Align RETs in BHB clear sequence to avoid thunking
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawan Gupta <[email protected]>
commit f0cd7091cc5a032c8870b4285305d9172569d126 upstream.
The software mitigation for BHI is to execute BHB clear sequence at syscall entry, and possibly after a cBPF program. ITS mitigation thunks RETs in the lower half of the cacheline. This causes the RETs in the BHB clear sequence to be thunked as well, adding unnecessary branches to the BHB clear sequence.
Since the sequence is in hot path, align the RET instructions in the sequence to avoid thunking.
This is how disassembly clear_bhb_loop() looks like after this change:
0x44 <+4>: mov $0x5,%ecx 0x49 <+9>: call 0xffffffff81001d9b <clear_bhb_loop+91> 0x4e <+14>: jmp 0xffffffff81001de5 <clear_bhb_loop+165> 0x53 <+19>: int3 ... 0x9b <+91>: call 0xffffffff81001dce <clear_bhb_loop+142> 0xa0 <+96>: ret 0xa1 <+97>: int3 ... 0xce <+142>: mov $0x5,%eax 0xd3 <+147>: jmp 0xffffffff81001dd6 <clear_bhb_loop+150> 0xd5 <+149>: nop 0xd6 <+150>: sub $0x1,%eax 0xd9 <+153>: jne 0xffffffff81001dd3 <clear_bhb_loop+147> 0xdb <+155>: sub $0x1,%ecx 0xde <+158>: jne 0xffffffff81001d9b <clear_bhb_loop+91> 0xe0 <+160>: ret 0xe1 <+161>: int3 0xe2 <+162>: int3 0xe3 <+163>: int3 0xe4 <+164>: int3 0xe5 <+165>: lfence 0xe8 <+168>: pop %rbp 0xe9 <+169>: ret
--- arch/x86/entry/entry_64.S | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-)
arch/x86/entry/entry_64.S +17 -3
@@ -1559,7 +1559,9 @@ SYM_CODE_END(rewind_stack_and_make_dead) * ORC to unwind properly. * * The alignment is for performance and not for safety, and may be safely - * refactored in the future if needed. + * refactored in the future if needed. The .skips are for safety, to ensure + * that all RETs are in the second half of a cacheline to mitigate Indirect + * Target Selection, rather than taking the slowpath via its_return_thunk. */ SYM_FUNC_START(clear_bhb_loop) push %rbp
@@ -1569,10 +1571,22 @@ SYM_FUNC_START(clear_bhb_loop) call 1f jmp 5f .align 64, 0xcc + /* + * Shift instructions so that the RET is in the upper half of the + * cacheline and don't take the slowpath to its_return_thunk. + */ + .skip 32 - (.Lret1 - 1f), 0xcc ANNOTATE_INTRA_FUNCTION_CALL 1: call 2f - RET +.Lret1: RET .align 64, 0xcc + /* + * As above shift instructions for RET at .Lret2 as well. + * + * This should be ideally be: .skip 32 - (.Lret2 - 2f), 0xcc + * but some Clang versions (e.g. 18) don't like this. + */ + .skip 32 - 18, 0xcc 2: movl $5, %eax 3: jmp 4f nop
@@ -1580,7 +1594,7 @@ SYM_FUNC_START(clear_bhb_loop) jnz 3b sub $1, %ecx jnz 1b - RET +.Lret2: RET 5: lfence pop %rbp RET
Greg Kroah-Hartman
maintainerPATCH 91/92 x86/ibt: Keep IBT disabled during alternative patching
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawan Gupta <[email protected]>
commit ebebe30794d38c51f71fe4951ba6af4159d9837d upstream.
cfi_rewrite_callers() updates the fineIBT hash matching at the caller side, but except for paranoid-mode it relies on apply_retpoline() and friends for any ENDBR relocation. This could temporarily cause an indirect branch to land on a poisoned ENDBR.
For instance, with para-virtualization enabled, a simple wrmsrl() could have an indirect branch pointing to native_write_msr() who's ENDBR has been relocated due to fineIBT:
<wrmsrl>:
push %rbp
mov %rsp,%rbp
mov %esi,%eax
mov %rsi,%rdx
shr $0x20,%rdx
mov %edi,%edi
mov %rax,%rsi
call *0x21e65d0(%rip) # <pv_ops+0xb8>
^^^^^^^^^^^^^^^^^^^^^^^Such an indirect call during the alternative patching could #CP if the caller is not *yet* adjusted for the new target ENDBR. To prevent a false
#CP, keep CET-IBT disabled until all callers are patched.
Patching during the module load does not need to be guarded by IBT-disable because the module code is not executed until the patching is complete.
[ pawan: Since apply_paravirt() happens before __apply_fineibt()
relocates the ENDBR, pv_ops in the example above is not relevant. It is still safer to keep this commit because missing an ENDBR means an oops. ]
--- arch/x86/kernel/alternative.c | 8 ++++++++ 1 file changed, 8 insertions(+)
arch/x86/kernel/alternative.c +8 -0
@@ -30,6 +30,7 @@#include <asm/fixmap.h> #include <asm/paravirt.h> #include <asm/asm-prototypes.h> +#include <asm/cfi.h> int __read_mostly alternatives_patched;
@@ -1006,6 +1007,8 @@ static noinline void __init int3_selftesvoid __init alternative_instructions (void ) { +u64 ibt; +int3_selftest ();/*
@@ -1043,6 +1046,9 @@ void __init alternative_instructions(voi*/ paravirt_set_cap (); +/* Keep CET-IBT disabled until caller/callee are patched */ + ibt =ibt_save (); +/* * First patch paravirt functions, such that we overwrite the indirect * call with the direct call.
@@ -1064,6 +1070,8 @@ void __init alternative_instructions(voiapply_ibt_endbr (__ibt_endbr_seal, __ibt_endbr_seal_end); +ibt_restore (ibt); +#ifdef CONFIG_SMP /* Patch to UP if other cpus not imminent. */ if (!noreplace_smp && (num_present_cpus () ==1 || setup_max_cpus <=1 )) {
Greg Kroah-Hartman
maintainerPATCH 92/92 x86/its: Use dynamic thunks for indirect branches
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
commit 872df34d7c51a79523820ea6a14860398c639b87 upstream.
ITS mitigation moves the unsafe indirect branches to a safe thunk. This could degrade the prediction accuracy as the source address of indirect branches becomes same for different execution paths.
To improve the predictions, and hence the performance, assign a separate thunk for each indirect callsite. This is also a defense-in-depth measure to avoid indirect branches aliasing with each other.
As an example, 5000 dynamic thunks would utilize around 16 bits of the address space, thereby gaining entropy. For a BTB that uses 32 bits for indexing, dynamic thunks could provide better prediction accuracy over fixed thunks.
Have ITS thunks be variable sized and use EXECMEM_MODULE_TEXT such that they are both more flexible (got to extend them later) and live in 2M TLBs, just like kernel code, avoiding undue TLB pressure.
[ pawan: CONFIG_EXECMEM and CONFIG_EXECMEM_ROX are not supported on
backport kernel, made changes to use module_alloc() and set_memory_*() for dynamic thunks. ]
--- arch/x86/include/asm/alternative.h | 10 ++ arch/x86/kernel/alternative.c | 130 ++++++++++++++++++++++++++++++++++++- arch/x86/kernel/module.c | 7 + include/linux/module.h | 5 + 4 files changed, 149 insertions(+), 3 deletions(-)
arch/x86/include/asm/alternative.h +10 -0
@@ -81,6 +81,16 @@ extern void apply_ibt_endbr(s32 *start,struct module ; +#ifdef CONFIG_MITIGATION_ITS +extern void its_init_mod (struct module *mod); +extern void its_fini_mod (struct module *mod); +extern void its_free_mod (struct module *mod); +#else /* CONFIG_MITIGATION_ITS */ +static inline void its_init_mod (struct module *mod) { } +static inline void its_fini_mod (struct module *mod) { } +static inline void its_free_mod (struct module *mod) { } +#endif +#if defined(CONFIG_RETHUNK ) && defined(CONFIG_OBJTOOL )extern bool cpu_wants_rethunk (void );extern bool cpu_wants_rethunk_at (void *addr);
arch/x86/kernel/alternative.c +127 -3
154 lines not on this page · raw message
arch/x86/kernel/module.c +7 -0
@@ -285,10 +285,16 @@ int module_finalize(const Elf_Ehdr *hdr,void *pseg = (void *)para->sh_addr;apply_paravirt (pseg, pseg + para->sh_size); } + +its_init_mod (me); +if (retpolines) {void *rseg = (void *)retpolines->sh_addr;apply_retpolines (rseg, rseg + retpolines->sh_size); } + +its_fini_mod (me); +if (returns) {void *rseg = (void *)returns->sh_addr;apply_returns (rseg, rseg + returns->sh_size);
@@ -320,4 +326,5 @@ int module_finalize(const Elf_Ehdr *hdr,void module_arch_cleanup (struct module *mod) {alternatives_smp_module_del (mod); +its_free_mod (mod); }
include/linux/module.h +5 -0
@@ -536,6 +536,11 @@ struct module {atomic_t refcnt;#endif +#ifdef CONFIG_MITIGATION_ITS +int its_num_pages; +void **its_page_array; +#endif +#ifdef CONFIG_CONSTRUCTORS /* Constructor functions. */ ctor_fn_t *ctors;
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.139 release. There are 92 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 14 May 2025 17:19:58 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.139-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v6.1:
10 builds: 10 pass, 0 fail
28 boots: 28 pass, 0 fail
115 tests: 115 pass, 0 failLinux version: 6.1.139-rc1-g490c91e6621e
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra186-p3509-0000+p3636-0001, tegra194-p2972-0000,
tegra194-p3509-0000+p3668-0000, tegra20-ventana,
tegra210-p2371-2180, tegra210-p3450-0000,
tegra30-cardhu-a04Jon
Hi!
Quoted 4 lines
This is the start of the stable review cycle for the 6.1.139 release. There are 92 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
We see same failure as the other kernels here:
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/pipelines/1813565657
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/jobs/10011161709
arch/x86/kernel/alternative.c: In function 'its_fini_mod':
1163arch/x86/kernel/alternative.c:447:32: error: invalid use of undefined type 'struct module' 1164
447 | for (int i = 0; i < mod->its_num_pages; i++) {
1165
| ^~
1166arch/x86/kernel/alternative.c:448:33: error: invalid use of undefined type 'struct module' 1167
448 | void *page = mod->its_page_array[i];
1168
| ^~
1169arch/x86/kernel/alternative.c: In function 'its_free_mod':
1170arch/x86/kernel/alternative.c:459:32: error: invalid use of undefined type 'struct module' 1171
459 | for (int i = 0; i < mod->its_num_pages; i++) {
1172
| ^~
1173
Best regards,
Pavel
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Erika Unter HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.139 release. There are 92 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 14 May 2025 17:19:58 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.139-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:
Signature · 1 line
Florian
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.139 release. There are 92 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.139 release. There are 92 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 14 May 2025 17:19:58 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.139-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.thanks,
greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Am 12.05.2025 um 19:44 schrieb Greg Kroah-Hartman:
Quoted 4 lines
This is the start of the stable review cycle for the 6.1.139 release. There are 92 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Builds, boots and works on my 2-socket Ivy Bridge Xeon E5-2697 v2 server. No dmesg oddities or regressions found.
Beste Grüße,
Peter Schneider
Signature · 8 lines
Climb the mountain not to plant your flag, but to embrace the challenge, enjoy the air and behold the view. Climb it so you can see the world, not so the world can see you. -- David McCullough Jr. OpenPGP: 0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244 Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc https://keys.mailvelope.com/pks/lookup?op=get&[email protected] https://keys.mailvelope.com/pks/lookup?op=get&[email protected]
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.139 release. There are 92 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 14 May 2025 17:19:58 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.139-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
## Build
* kernel: 6.1.139-rc1
* git: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* git commit: 490c91e6621e9ec53a2bd0cced0bd27018fe8597
* git describe: v6.1.138-93-g490c91e6621e
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.1.y/build/v6.1.138-93-g490c91e6621e
## Test Regressions (compared to v6.1.136-100-g7b2996f52bc8)
## Metric Regressions (compared to v6.1.136-100-g7b2996f52bc8)
## Test Fixes (compared to v6.1.136-100-g7b2996f52bc8)
## Metric Fixes (compared to v6.1.136-100-g7b2996f52bc8)
## Test result summary
total: 91883, pass: 73707, fail: 3346, skip: 14630, xfail: 200
## Build Summary
* arc: 5 total, 5 passed, 0 failed
* arm: 133 total, 133 passed, 0 failed
* arm64: 41 total, 41 passed, 0 failed
* i386: 25 total, 19 passed, 6 failed
* mips: 26 total, 22 passed, 4 failed
* parisc: 4 total, 4 passed, 0 failed
* powerpc: 32 total, 31 passed, 1 failed
* riscv: 11 total, 11 passed, 0 failed
* s390: 14 total, 14 passed, 0 failed
* sh: 10 total, 10 passed, 0 failed
* sparc: 7 total, 7 passed, 0 failed
* x86_64: 33 total, 31 passed, 2 failed
## Test suites summary
* boot
* commands
* kselftest-arm64
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-exec
* kselftest-fpu
* kselftest-futex
* kselftest-intel_pstate
* kselftest-kcmp
* kselftest-kvm
* kselftest-livepatch
* kselftest-membarrier
* kselftest-mincore
* kselftest-mqueue
* kselftest-openat2
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-sigaltstack
* kselftest-size
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user_events
* kselftest-vDSO
* kselftest-x86
* kunit
* kvm-unit-tests
* lava
* libgpiod
* libhugetlbfs
* log-parser-boot
* log-parser-build-clang
* log-parser-build-gcc
* log-parser-test
* ltp-capability
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-cpuhotplug
* ltp-crypto
* ltp-cve
* ltp-dio
* ltp-fcntl-locktests
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-hugetlb
* ltp-ipc
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-pty
* ltp-sched
* ltp-smoke
* ltp-syscalls
* ltp-tracing
* perf
* rcutorture
--
Linaro LKFT
https://lkft.linaro.org
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.139 release. There are 92 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 14 May 2025 17:19:58 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.139-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
The kernel, bpf tool and perf tool builds fine for v6.1.139-rc1 on x86 and arm64 Azure VM.
KernelCI with LTP and kselftest results: Tree: stable/linux-6.1.y <https://dashboard.kernelci.org/tree/02b72ccb5f9df707a763d9f7163d7918d3aff0b7?o=microsoft&p=t&ti%7Cc=v6.1.138&ti%7Cch=02b72ccb5f9df707a763d9f7163d7918d3aff0b7&ti%7Cgb=linux-6.1.y&ti%7Cgu=https%3A%2F%2Fgit.kernel.org%2Fpub%2Fscm%2Flinux%2Fkernel%2Fgit%2Fstable%2Flinux.git&ti%7Ct=stable>
Thanks,
Hardik
Quoted 401 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.139 release. There are 92 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 14 May 2025 17:19:58 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.139-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:Greg Kroah-Hartman <[email protected]>
Linux 6.1.139-rc1Peter Zijlstra <[email protected]>
x86/its: Use dynamic thunks for indirect branchesPawan Gupta <[email protected]>
x86/ibt: Keep IBT disabled during alternative patchingPawan Gupta <[email protected]>
x86/its: Align RETs in BHB clear sequence to avoid thunkingPawan Gupta <[email protected]>
x86/its: Add "vmexit" option to skip mitigation on some CPUsPawan Gupta <[email protected]>
x86/its: Enable Indirect Target Selection mitigationPawan Gupta <[email protected]>
x86/its: Add support for ITS-safe return thunkPawan Gupta <[email protected]>
x86/its: Add support for ITS-safe indirect thunkPawan Gupta <[email protected]>
x86/its: Enumerate Indirect Target Selection (ITS) bugPawan Gupta <[email protected]>
Documentation: x86/bugs/its: Add ITS documentationPawan Gupta <[email protected]>
x86/speculation: Remove the extra #ifdef aroundCALL_NOSPECPawan Gupta <[email protected]>
x86/speculation: Add a conditional CS prefix toCALL_NOSPECPawan Gupta <[email protected]>
x86/speculation: Simplify and makeCALL_NOSPECconsistentPawan Gupta <[email protected]>
x86/bhi: Do not setBHI_DIS_Sin 32-bit modeDaniel Sneddon <[email protected]>
x86/bpf: Add IBHF call at end of classic BPFDaniel Sneddon <[email protected]>
x86/bpf: Call branch history clearing sequence on exitJames Morse <[email protected]>
arm64: proton-pack: Add new CPUs 'k' values for branch mitigationJames Morse <[email protected]>
arm64: bpf: Only mitigate cBPF programs loaded by unprivileged usersJames Morse <[email protected]>
arm64: bpf: Add BHB mitigation to the epilogue for cBPF programsJames Morse <[email protected]>
arm64: proton-pack: Expose whether the branchy loop k valueJames Morse <[email protected]>
arm64: proton-pack: Expose whether the platform is mitigated by firmwareJames Morse <[email protected]>
arm64: insn: Add support for encoding DSBGreg Kroah-Hartman <[email protected]>
Revert "net: phy: microchip: force IRQ polling mode for lan88xx"Jens Axboe <[email protected]>
io_uring: ensure deferred completions are posted for multishotJens Axboe <[email protected]>
io_uring: always arm linked timeouts prior to issueAl Viro <[email protected]>
do_umount(): add missing barrier before refcount checks in sync caseDaniel Wagner <[email protected]>
nvme: unblock ctrl state transition for firmware updateKevin Baker <[email protected]>
drm/panel: simple: Update timings for AUO G101EVN010Thorsten Blum <[email protected]>
MIPS: FixMAX_REG_OFFSETJonathan Cameron <[email protected]>
iio: adc: dln2: Usealigned_s64for timestampJonathan Cameron <[email protected]>
iio: accel: adxl355: Make timestamp 64-bit aligned usingaligned_s64Andy Shevchenko <[email protected]>
types: Complement the aligned types with signed 64-bit oneJonathan Cameron <[email protected]>
iio: temp: maxim-thermocouple: Fix potential lack of DMA safe buffer.Lothar Rubusch <[email protected]>
iio: accel: adxl367: fix setting odr for activity time updateDave Penkler <[email protected]>
usb: usbtmc: Fix erroneousgeneric_readioctl returnDave Penkler <[email protected]>
usb: usbtmc: Fix erroneouswait_srqioctl returnDave Penkler <[email protected]>
usb: usbtmc: Fix erroneousget_stbioctl error returnsOliver Neukum <[email protected]>
USB: usbtmc: use interruptible sleep inusbtmc_readAndrei Kuchynski <[email protected]>
usb: typec: ucsi: displayport: Fix NULL pointer accessRD Babiera <[email protected]>
usb: typec: tcpm: delaySNK_TRY_WAIT_DEBOUNCEtoSRC_TRYWAITtransitionJim Lin <[email protected]>
usb: host: tegra: Prevent host controller crash when OTG port is usedWayne Chang <[email protected]>
usb: gadget: tegra-xudc: ACKST_RCafter clearingCTRL_RUNPawel Laszczak <[email protected]>
usb: cdnsp: fix L1 resume issue forRTL_REVISION_NEW_LPMversionPawel Laszczak <[email protected]>
usb: cdnsp: Fix issue with resuming from L1Jan Kara <[email protected]>
ocfs2: stop quota recovery before disabling quotasJan Kara <[email protected]>
ocfs2: implement handshaking with ocfs2 recovery threadJan Kara <[email protected]>
ocfs2: switch osb->disable_recovery to enumDmitry Antipov <[email protected]>
module: ensure thatkobject_put()is safe for module type kobjectsJason Andryuk <[email protected]>
xenbus: Use kref to track req lifetimeAlexey Charkov <[email protected]>
usb: uhci-platform: Make the clock really optionalAlex Deucher <[email protected]>
drm/amdgpu/hdp5.2: use memcfg register to post the write for HDP flushWayne Lin <[email protected]>
drm/amd/display: Copy AUX read reply data whenever length > 0Wayne Lin <[email protected]>
drm/amd/display: Fix wrong handling forAUX_DEFERcaseWayne Lin <[email protected]>
drm/amd/display: Remove incorrect checking in dmub aux handlerWayne Lin <[email protected]>
drm/amd/display: Fix the checking condition in dmub aux handlingMaíra Canal <[email protected]>
drm/v3d: Add job to pending list if the reset was skippedSilvano Seva <[email protected]>
iio: imu:st_lsm6dsx: fix possible lockup inst_lsm6dsx_read_tagged_fifoSilvano Seva <[email protected]>
iio: imu:st_lsm6dsx: fix possible lockup inst_lsm6dsx_read_fifoGabriel Shahrouzi <[email protected]>
iio: adis16201: Correct inclinometer channel resolutionAngelo Dureghello <[email protected]>
iio: adc: ad7606: fix serial register accessWayne Lin <[email protected]>
drm/amd/display: Shift DMUB AUX reply command if necessaryDave Hansen <[email protected]>
x86/mm: Eliminate window where TLB flushes may be inadvertently skippedGabriel Shahrouzi <[email protected]>
staging: axis-fifo: Correct handling oftx_fifo_depthfor size validationGabriel Shahrouzi <[email protected]>
staging: axis-fifo: Remove hardware resets for user errorsGabriel Shahrouzi <[email protected]>
staging: iio: adc: ad7816: Correct conditional logic for store modeAditya Garg <[email protected]>
Input: synaptics - enable InterTouch on TUXEDO InfinityBook Pro 14 v5Dmitry Torokhov <[email protected]>
Input: synaptics - enable SMBus for HP Elitebook 850 G1Aditya Garg <[email protected]>
Input: synaptics - enable InterTouch on Dell Precision M3800Aditya Garg <[email protected]>
Input: synaptics - enable InterTouch on Dynabook Portege X30L-GManuel Fombuena <[email protected]>
Input: synaptics - enable InterTouch on Dynabook Portege X30-DGary Bisson <[email protected]>
Input: mtk-pmic-keys - fix possible null pointer dereferenceJonas Gorski <[email protected]>
net: dsa: b53: fix learning on VLAN unaware bridgesJonas Gorski <[email protected]>
net: dsa: b53: always rejoin default untagged VLAN on bridge leaveJonas Gorski <[email protected]>
net: dsa: b53: fix VLAN ID for untagged vlan on bridge leaveJonas Gorski <[email protected]>
net: dsa: b53: fix flushing old pvid VLAN on pvid changeJonas Gorski <[email protected]>
net: dsa: b53: fix clearing PVID of a portJonas Gorski <[email protected]>
net: dsa: b53: allow leaky reserved multicastPaul Chaignon <[email protected]>
bpf: Scrub packet onbpf_redirect_peerJozsef Kadlecsik <[email protected]>
netfilter: ipset: fix region locking in hash typesJulian Anastasov <[email protected]>
ipvs: fix uninit-value for saddr indo_output_route4Guillaume Nault <[email protected]>
ipv4: Drop tos parameter fromflowi4_update_output()Oliver Hartkopp <[email protected]>
can: gw: fix RCU/BH usage incgw_create_job()Uladzislau Rezki (Sony) <[email protected]>
rcu/kvfree: Addkvfree_rcu_mightsleep()andkfree_rcu_mightsleep()Kelsey Maes <[email protected]>
can: mcp251xfd: fix TDC setting for low data bit ratesGuillaume Nault <[email protected]>
gre: Fix again IPv6 link-local address generation.Cong Wang <[email protected]>
sch_htb: makehtb_deactivate()idempotentWang Zhaolong <[email protected]>
ksmbd: fix memory leak inparse_lease_state()Eelco Chaudron <[email protected]>
openvswitch: Fix unsafe attribute parsing inoutput_userspace()Norbert Szetei <[email protected]>
ksmbd: prevent out-of-bounds stream writes by validating *posMarc Kleine-Budde <[email protected]>
can: mcp251xfd:mcp251xfd_remove(): fix order of unregistration callsMarc Kleine-Budde <[email protected]>
can: mcan:m_can_class_unregister(): fix order of unregistration callsWojciech Dubowik <[email protected]>
arm64: dts: imx8mm-verdin: Linkreg_usdhc2_vqmmcto usdhc2Dan Carpenter <[email protected]>
dm: add missing unlock on indm_keyslot_evict()-------------
Diffstat:
Documentation/ABI/testing/sysfs-devices-system-cpu | 1 + Documentation/admin-guide/hw-vuln/index.rst | 1 + .../hw-vuln/indirect-target-selection.rst | 156 ++++++++++++++ Documentation/admin-guide/kernel-parameters.txt | 15 ++ Makefile | 4 +- arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi | 25 ++- arch/arm64/include/asm/cputype.h | 2 + arch/arm64/include/asm/insn.h | 1 + arch/arm64/include/asm/spectre.h | 3 + arch/arm64/kernel/proton-pack.c | 13 +- arch/arm64/lib/insn.c | 76 ++++--- arch/arm64/net/bpf_jit_comp.c | 57 +++++- arch/mips/include/asm/ptrace.h | 3 +- arch/x86/Kconfig | 11 + arch/x86/entry/entry_64.S | 20 +- arch/x86/include/asm/alternative.h | 24 +++ arch/x86/include/asm/cpufeatures.h | 3 + arch/x86/include/asm/msr-index.h | 8 + arch/x86/include/asm/nospec-branch.h | 38 ++-- arch/x86/kernel/alternative.c | 226 ++++++++++++++++++++- arch/x86/kernel/cpu/bugs.c | 144 ++++++++++++- arch/x86/kernel/cpu/common.c | 72 +++++-- arch/x86/kernel/ftrace.c | 2 +- arch/x86/kernel/module.c | 7 + arch/x86/kernel/static_call.c | 2 +- arch/x86/kernel/vmlinux.lds.S | 10 + arch/x86/kvm/x86.c | 4 +- arch/x86/lib/retpoline.S | 39 ++++ arch/x86/mm/tlb.c | 23 ++- arch/x86/net/bpf_jit_comp.c | 60 +++++- drivers/base/cpu.c | 8 + drivers/gpu/drm/amd/amdgpu/hdp_v5_2.c | 12 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 20 +- .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 28 ++- drivers/gpu/drm/panel/panel-simple.c | 25 +-- drivers/gpu/drm/v3d/v3d_sched.c | 28 ++- drivers/iio/accel/adis16201.c | 4 +- drivers/iio/accel/adxl355_core.c | 2 +- drivers/iio/accel/adxl367.c | 10 +- drivers/iio/adc/ad7606_spi.c | 2 +- drivers/iio/adc/dln2-adc.c | 2 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 6 + drivers/iio/temperature/maxim_thermocouple.c | 2 +- drivers/input/keyboard/mtk-pmic-keys.c | 4 +- drivers/input/mouse/synaptics.c | 5 + drivers/md/dm-table.c | 3 +- drivers/net/can/m_can/m_can.c | 2 +- drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c | 42 +++- drivers/net/dsa/b53/b53_common.c | 36 ++-- drivers/net/phy/microchip.c | 46 ++++- drivers/nvme/host/core.c | 3 +- drivers/staging/axis-fifo/axis-fifo.c | 14 +- drivers/staging/iio/adc/ad7816.c | 2 +- drivers/usb/cdns3/cdnsp-gadget.c | 31 +++ drivers/usb/cdns3/cdnsp-gadget.h | 6 + drivers/usb/cdns3/cdnsp-pci.c | 12 +- drivers/usb/cdns3/cdnsp-ring.c | 3 +- drivers/usb/cdns3/core.h | 3 + drivers/usb/class/usbtmc.c | 59 +++--- drivers/usb/gadget/udc/tegra-xudc.c | 4 + drivers/usb/host/uhci-platform.c | 2 +- drivers/usb/host/xhci-tegra.c | 3 + drivers/usb/typec/tcpm/tcpm.c | 2 +- drivers/usb/typec/ucsi/displayport.c | 2 + drivers/xen/xenbus/xenbus.h | 2 + drivers/xen/xenbus/xenbus_comms.c | 9 +- drivers/xen/xenbus/xenbus_dev_frontend.c | 2 +- drivers/xen/xenbus/xenbus_xs.c | 18 +- fs/namespace.c | 3 +- fs/ocfs2/journal.c | 80 ++++++-- fs/ocfs2/journal.h | 1 + fs/ocfs2/ocfs2.h | 17 +- fs/ocfs2/quota_local.c | 9 +- fs/ocfs2/super.c | 3 + fs/smb/server/oplock.c | 7 +- fs/smb/server/vfs.c | 7 + include/linux/cpu.h | 2 + include/linux/module.h | 5 + include/linux/rcupdate.h | 3 + include/linux/types.h | 3 +- include/net/flow.h | 3 +- include/net/route.h | 6 +- include/uapi/linux/types.h | 1 + io_uring/io_uring.c | 61 +++--- kernel/params.c | 4 +- net/can/gw.c | 151 ++++++++------ net/core/filter.c | 1 + net/ipv6/addrconf.c | 15 +- net/netfilter/ipset/ip_set_hash_gen.h | 2 +- net/netfilter/ipvs/ip_vs_xmit.c | 29 +-- net/openvswitch/actions.c | 3 +- net/sched/sch_htb.c | 15 +- net/sctp/protocol.c | 4 +- 93 files changed, 1554 insertions(+), 395 deletions(-)