6.17.4-rc1 review
Subsystems (7)
Greg Kroah-Hartman
maintainercover 6.17.4-rc1 review
This is the start of the stable review cycle for the 6.17.4 release. There are 371 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun, 19 Oct 2025 14:50:59 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.17.4-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.17.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.17.4-rc1
Christian Brauner <[email protected]>
mount: handle NULL values in mnt_ns_release()
Christian Brauner <[email protected]>
pidfs: validate extensible ioctls
Darrick J. Wong <[email protected]>
iomap: error out on file IO when there is no inline_data buffer
Jan Kara <[email protected]>
writeback: Avoid excessively long inode switching times
Jan Kara <[email protected]>
writeback: Avoid softlockup when switching many inodes
Al Viro <[email protected]>
mnt_ns_tree_remove(): DTRT if mnt_ns had never been added to mnt_ns_list
Christian Brauner <[email protected]>
nsfs: validate extensible ioctls
Tetsuo Handa <[email protected]>
cramfs: Verify inode mode when loading from disk
Lichen Liu <[email protected]>
fs: Add 'initramfs_options' to set initramfs mount options
Oleg Nesterov <[email protected]>
pid: make __task_pid_nr_ns(ns => NULL) safe for zombie callers
gaoxiang17 <[email protected]>
pid: Add a judgment for ns null in pid_nr_ns
Tetsuo Handa <[email protected]>
minixfs: Verify inode mode when loading from disk
Miklos Szeredi <[email protected]>
copy_file_range: limit size if in compat mode
Lucas Zampieri <[email protected]>
irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume
Rafael J. Wysocki <[email protected]>
ACPI: property: Do not pass NULL handles to acpi_attach_data()
Rafael J. Wysocki <[email protected]>
ACPI: property: Add code comments explaining what is going on
Rafael J. Wysocki <[email protected]>
ACPI: property: Disregard references in data-only subnode lists
Viken Dadhaniya <[email protected]>
arm64: dts: qcom: qcs615: add missing dt property in QUP SEs
Edward Adam Davis <[email protected]>
media: mc: Clear minor number before put device
Donet Tom <[email protected]>
mm/ksm: fix incorrect KSM counter handling in mm_struct during fork
Phillip Lougher <[email protected]>
Squashfs: reject negative file sizes in squashfs_read_inode()
Phillip Lougher <[email protected]>
Squashfs: add additional inode sanity checking
Guenter Roeck <[email protected]>
ipmi: Fix handling of messages with provided receive message pointer
Jan Kara <[email protected]>
ext4: free orphan info with kvfree
Huacai Chen <[email protected]>
ACPICA: Allow to skip Global Lock initialization
Deepanshu Kartikey <[email protected]>
ext4: validate ea_ino and size in check_xattrs
Ahmet Eray Karadag <[email protected]>
ext4: guard against EA inode refcount underflow in xattr update
Zhang Yi <[email protected]>
ext4: fix an off-by-one issue during moving extents
Theodore Ts'o <[email protected]>
ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()
Ojaswin Mujoo <[email protected]>
ext4: correctly handle queries for metadata mappings
Yongjian Sun <[email protected]>
ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch()
Jan Kara <[email protected]>
ext4: verify orphan file size is not too big
Jan Kara <[email protected]>
ext4: fail unaligned direct IO write with EINVAL
Baokun Li <[email protected]>
ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches()
Dikshita Agarwal <[email protected]>
media: iris: Allow stop on firmware only if start was issued.
Dikshita Agarwal <[email protected]>
media: iris: Fix format check for CAPTURE plane in try_fmt
Dikshita Agarwal <[email protected]>
media: iris: Fix missing LAST flag handling during drain
Dikshita Agarwal <[email protected]>
media: iris: Send dummy buffer address for all codecs during drain
Dikshita Agarwal <[email protected]>
media: iris: Update vbuf flags before v4l2_m2m_buf_done
Dikshita Agarwal <[email protected]>
media: iris: Simplify session stop logic by relying on vb2 checks
Dikshita Agarwal <[email protected]>
media: iris: Always destroy internal buffers on firmware release response
Dikshita Agarwal <[email protected]>
media: iris: Allow substate transition to load resources during output streaming
Dikshita Agarwal <[email protected]>
media: iris: Fix buffer count reporting in internal buffer check
Dikshita Agarwal <[email protected]>
media: iris: Fix port streaming handling
Dikshita Agarwal <[email protected]>
media: iris: vpu3x: Add MNoC low power handshake during hardware power-off
Neil Armstrong <[email protected]>
media: iris: fix module removal if firmware download failed
Stephan Gerhold <[email protected]>
media: iris: Fix firmware reference leak and unmap memory after load
Krzysztof Kozlowski <[email protected]>
media: iris: Call correct power off callback in cleanup path
Olga Kornievskaia <[email protected]>
nfsd: nfserr_jukebox in nlm_fopen should lead to a retry
Thorsten Blum <[email protected]>
NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul()
Scott Mayhew <[email protected]>
nfsd: decouple the xprtsec policy check from check_nfsd_access()
SeongJae Park <[email protected]>
mm/damon/lru_sort: use param_ctx for damon_attrs staging
SeongJae Park <[email protected]>
mm/damon/vaddr: do not repeat pte_offset_map_lock() until success
Li RongQing <[email protected]>
mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0
Thadeu Lima de Souza Cascardo <[email protected]>
mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations
Lance Yang <[email protected]>
mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage
Lance Yang <[email protected]>
mm/thp: fix MTE tag mismatch when replacing zero-filled subpages
Nick Morrow <[email protected]>
wifi: mt76: mt7921u: Add VID/PID for Netgear A7500
Nick Morrow <[email protected]>
wifi: mt76: mt7925u: Add VID/PID for Netgear A9000
Fedor Pchelkin <[email protected]>
wifi: rtw89: avoid possible TX wait initialization race
Miaoqian Lin <[email protected]>
wifi: iwlwifi: Fix dentry reference leak in iwl_mld_add_link_debugfs
Muhammad Usama Anjum <[email protected]>
wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again
Suren Baghdasaryan <[email protected]>
slab: mark slab->obj_exts allocation failures unconditionally
Suren Baghdasaryan <[email protected]>
slab: prevent warnings when slab obj_exts vector allocation fails
Heiko Carstens <[email protected]>
s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR
Jaehoon Kim <[email protected]>
s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request
Jaehoon Kim <[email protected]>
s390/dasd: enforce dma_alignment to ensure proper buffer validation
Heiko Carstens <[email protected]>
s390/cio/ioasm: Fix __xsch() condition code handling
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: validate C-flag + def limit
Matthieu Baerts (NGI0) <[email protected]>
mptcp: reset blackhole on success with non-loopback ifaces
Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: in-kernel: usable client side with C-flag
Sean Christopherson <[email protected]>
x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases)
Sean Christopherson <[email protected]>
x86/umip: Check that the instruction opcode is at least two bytes
Xin Li (Intel) <[email protected]>
x86/fred: Remove ENDBR64 from FRED entry points
Darrick J. Wong <[email protected]>
xfs: use deferred intent items for reaping crosslinked blocks
Santhosh Kumar K <[email protected]>
spi: cadence-quadspi: Fix cqspi_setup_flash()
Pratyush Yadav <[email protected]>
spi: cadence-quadspi: Flush posted register writes before DAC access
Pratyush Yadav <[email protected]>
spi: cadence-quadspi: Flush posted register writes before INDAC access
Johan Hovold <[email protected]>
PCI/pwrctrl: Fix device leak at device stop
Johan Hovold <[email protected]>
PCI/pwrctrl: Fix device and OF node leak at bus scan
Johan Hovold <[email protected]>
PCI/pwrctrl: Fix device leak at registration
Niklas Cassel <[email protected]>
PCI: tegra194: Reset BARs when running in PCIe endpoint mode
Vidya Sagar <[email protected]>
PCI: tegra194: Handle errors in BPMP response
Niklas Cassel <[email protected]>
PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq()
Marek Vasut <[email protected]>
PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock
Marek Vasut <[email protected]>
PCI: rcar-host: Drop PMSR spinlock
Marek Vasut <[email protected]>
PCI: rcar-gen4: Fix PHY initialization
Siddharth Vadapalli <[email protected]>
PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit
Siddharth Vadapalli <[email protected]>
PCI: j721e: Fix programming sequence of "strap" settings
Siddharth Vadapalli <[email protected]>
PCI: j721e: Fix module autoloading
Ilpo Järvinen <[email protected]>
PCI: Fix failure detection during resource resize
Ilpo Järvinen <[email protected]>
PCI: Ensure relaxed tail alignment does not increase min_align
Lukas Wunner <[email protected]>
PCI/AER: Support errors introduced by PCIe r6.0
Niklas Schnelle <[email protected]>
PCI/AER: Fix missing uevent on recovery when a reset is requested
Lukas Wunner <[email protected]>
PCI/ERR: Fix uevent on failure to recover
Niklas Schnelle <[email protected]>
PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV
Brian Norris <[email protected]>
PCI/sysfs: Ensure devices are powered for config reads
Marek Vasut <[email protected]>
PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock
Jani Nurminen <[email protected]>
PCI: xilinx-nwl: Fix ECAM programming
Sean Christopherson <[email protected]>
rseq/selftests: Use weak symbol reference, not definition, to link with glibc
Esben Haabendal <[email protected]>
rtc: interface: Fix long-standing race when setting alarm
Esben Haabendal <[email protected]>
rtc: interface: Ensure alarm irq is enabled when UIE is enabled
Patrice Chotard <[email protected]>
memory: stm32_omm: Fix req2ack update test
Zhen Ni <[email protected]>
memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe
Rex Chen <[email protected]>
mmc: mmc_spi: multiple block read remove read crc ack
Rex Chen <[email protected]>
mmc: core: SPI mode remove cmd7
Maarten Zanders <[email protected]>
mtd: nand: raw: gpmi: fix clocks when CONFIG_PM=N
Linus Walleij <[email protected]>
mtd: rawnand: fsmc: Default to autodetect buswidth
Alexander Lobakin <[email protected]>
xsk: Harden userspace-supplied xdp_desc validation
Miaoqian Lin <[email protected]>
xtensa: simdisk: add input size check in proc_write_simdisk
Ma Ke <[email protected]>
sparc: fix error handling in scan_one_device()
Anthony Yznaga <[email protected]>
sparc64: fix hugetlb for sun4u
Bharath SM <[email protected]>
smb client: fix bug with newly created file in cached dir
Eric Biggers <[email protected]>
sctp: Fix MAC comparison to be constant-time
Abinash Singh <[email protected]>
scsi: sd: Fix build warning in sd_revalidate_disk()
Thorsten Blum <[email protected]>
scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl()
Harshit Agarwal <[email protected]>
sched/deadline: Fix race in push_dl_task()
Alexandre Ghiti <[email protected]>
riscv: use an atomic xchg in pudp_huge_get_and_clear()
Corey Minyard <[email protected]>
Revert "ipmi: fix msg stack when IPMI is disconnected"
Colin Ian King <[email protected]>
pwm: Fix incorrect variable used in error message
Jisheng Zhang <[email protected]>
pwm: berlin: Fix wrong register in suspend/resume
Nam Cao <[email protected]>
powerpc/pseries/msi: Fix potential underflow and leak issue
Nam Cao <[email protected]>
powerpc/powernv/pci: Fix underflow and leak issue
Dzmitry Sankouski <[email protected]>
power: supply: max77976_charger: fix constant current reporting
Rafael J. Wysocki <[email protected]>
PM: hibernate: Restrict GFP mask in power_down()
Mario Limonciello (AMD) <[email protected]>
PM: hibernate: Fix hybrid-sleep
Christian Loehle <[email protected]>
PM: EM: Fix late boot with holes in CPU topology
Krzysztof Kozlowski <[email protected]>
pinctrl: samsung: Drop unused S3C24xx driver data
Georg Gottleuber <[email protected]>
nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk
John David Anglin <[email protected]>
parisc: Remove spurious if statement from raw_copy_from_user()
Sam James <[email protected]>
parisc: don't reference obsolete termio struct for TC* constants
Xiao Liang <[email protected]>
padata: Reset next CPU when reorder sequence wraps around
Askar Safin <[email protected]>
openat2: don't trigger automounts with RESOLVE_NO_XDEV
Ma Ke <[email protected]>
of: unittest: Fix device reference count leak in of_unittest_pci_node_verify
Yu Kuai <[email protected]>
md: fix mssing blktrace bio split events
Li Chen <[email protected]>
loop: fix backing file reference leak on validation error
Johan Hovold <[email protected]>
lib/genalloc: fix device leak in of_gen_pool_get()
Pratyush Yadav <[email protected]>
kho: only fill kimage if KHO is finalized
Eric Biggers <[email protected]>
KEYS: trusted_tpm1: Compare HMAC values in constant time
Oleg Nesterov <[email protected]>
kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths
Corey Minyard <[email protected]>
ipmi:msghandler:Change seq_lock to a mutex
Corey Minyard <[email protected]>
ipmi: Rework user message limit handling
Lu Baolu <[email protected]>
iommu/vt-d: PRS isn't usable if PDS isn't supported
Sean Nyekjaer <[email protected]>
iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended
Sean Nyekjaer <[email protected]>
iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume
Sean Nyekjaer <[email protected]>
iio: imu: inv_icm42600: Simplify pm_runtime setup
Huacai Chen <[email protected]>
init: handle bootloader identifier in kernel parameters
Sean Anderson <[email protected]>
iio: xilinx-ams: Unmask interrupts after updating alarms
Sean Anderson <[email protected]>
iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK
Michael Hennerich <[email protected]>
iio: frequency: adf4350: Fix prescaler usage.
Qianfeng Rong <[email protected]>
iio: dac: ad5421: use int type to store negative error codes
Qianfeng Rong <[email protected]>
iio: dac: ad5360: use int type to store negative error codes
Aleksandar Gerasimovski <[email protected]>
iio/adc/pac1934: fix channel disable configuration
Jarkko Nikula <[email protected]>
i3c: Fix default I2C adapter timeout value
Conor Dooley <[email protected]>
gpio: mpfs: fix setting gpio direction to output
Darrick J. Wong <[email protected]>
fuse: fix livelock in synchronous file put from fuseblk workers
Miklos Szeredi <[email protected]>
fuse: fix possibly missing fuse_copy_finish() call in fuse_notify()
Ryan Roberts <[email protected]>
fsnotify: pass correct offset to fsnotify_mmap_perm()
Shashank A P <[email protected]>
fs: quota: create dedicated workqueue for quota_release_work
Haoxiang Li <[email protected]>
fs/ntfs3: Fix a resource leak bug in wnd_extend()
Finn Thain <[email protected]>
fbdev: Fix logic error in "offb" name match
Nam Cao <[email protected]>
eventpoll: Replace rwlock with spinlock
Thomas Fourier <[email protected]>
crypto: rockchip - Fix dma_unmap_sg() nents value
Thomas Fourier <[email protected]>
crypto: atmel - Fix dma_unmap_sg() direction
Thomas Fourier <[email protected]>
crypto: aspeed - Fix dma_unmap_sg() direction
Rafael J. Wysocki <[email protected]>
cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()
Rafael J. Wysocki <[email protected]>
cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay
Simon Schuster <[email protected]>
copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64)
Denzeel Oliva <[email protected]>
clk: samsung: exynos990: Replace bogus divs with fixed-factor clocks
Denzeel Oliva <[email protected]>
clk: samsung: exynos990: Fix CMU_TOP mux/div bit widths
Denzeel Oliva <[email protected]>
clk: samsung: exynos990: Use PLL_CON0 for PLL parent muxes
Abel Vesa <[email protected]>
clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk
Miaoqian Lin <[email protected]>
cdx: Fix device node reference leak in cdx_msi_domain_init
Adam Xue <[email protected]>
bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup()
Sumit Kumar <[email protected]>
bus: mhi: ep: Fix chained transfer handling in read path
Anderson Nascimento <[email protected]>
btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
Yu Kuai <[email protected]>
blk-crypto: fix missing blktrace bio split events
Ard Biesheuvel <[email protected]>
drm/amd/display: Fix unsafe uses of kernel mode FPU
Fangzhi Zuo <[email protected]>
drm/amd/display: Enable Dynamic DTBCLK Switch
Jesse Agate <[email protected]>
drm/amd/display: Incorrect Mirror Cositing
Matthew Auld <[email protected]>
drm/xe/uapi: loosen used tracking restriction
Shuhao Fu <[email protected]>
drm/nouveau: fix bad ret code in nouveau_bo_move_prep
Marek Vasut <[email protected]>
drm/rcar-du: dsi: Fix 1/2/3 lane support
Akhil P Oommen <[email protected]>
drm/msm/a6xx: Fix PDC sleep sequence
Jann Horn <[email protected]>
drm/panthor: Fix memory leak in panthor_ioctl_group_create()
Kaustabh Chakraborty <[email protected]>
drm/exynos: exynos7_drm_decon: remove ctx->suspended
Ma Ke <[email protected]>
media: lirc: Fix error handling in lirc_register()
Jai Luthra <[email protected]>
media: ti: j721e-csi2rx: Fix source subdev link creation
Jai Luthra <[email protected]>
media: ti: j721e-csi2rx: Use devm_of_platform_populate
Laurent Pinchart <[email protected]>
media: vsp1: Export missing vsp1_isp_free_buffer symbol
Hans Verkuil <[email protected]>
media: vivid: fix disappearing <Vendor Command With ID> messages
Renjiang Han <[email protected]>
media: venus: pm_helpers: add fallback for the opp-table
Stephan Gerhold <[email protected]>
media: venus: firmware: Use correct reset sequence for IRIS2
Desnes Nunes <[email protected]>
media: uvcvideo: Avoid variable shadowing in uvc_ctrl_cleanup_fh
Bingbu Cao <[email protected]>
media: staging/ipu7: fix isys device runtime PM usage in firmware closing
Arnd Bergmann <[email protected]>
media: s5p-mfc: remove an unused/uninitialized variable
Nícolas F. R. A. Prado <[email protected]>
media: platform: mtk-mdp3: Add missing MT8188 compatible to comp_dt_ids
David Lechner <[email protected]>
media: pci: mg4b: fix uninitialized iio scan data
Thomas Fourier <[email protected]>
media: pci: ivtv: Add missing check after DMA map
Laurent Pinchart <[email protected]>
media: mc: Fix MUST_CONNECT handling for pads with no links
Qianfeng Rong <[email protected]>
media: i2c: mt9v111: fix incorrect type for ret
Hans Verkuil <[email protected]>
media: i2c: mt9p031: fix mbus code initialization
Thomas Fourier <[email protected]>
media: cx18: Add missing check after DMA map
Randy Dunlap <[email protected]>
media: cec: extron-da-hd-4k-plus: drop external-module make commands
Johan Hovold <[email protected]>
firmware: meson_sm: fix device leak at probe
Tudor Ambarus <[email protected]>
firmware: exynos-acpm: fix PMIC returned errno
Jason Andryuk <[email protected]>
xen/events: Update virq_to_irq on migration
Jason Andryuk <[email protected]>
xen/events: Return -EEXIST for bound VIRQs
Lukas Wunner <[email protected]>
xen/manage: Fix suspend error path
Jason Andryuk <[email protected]>
xen/events: Cleanup find_virq() return codes
Marek Marczykowski-Górecki <[email protected]>
xen: take system_transition_mutex on suspend
Michael Riesch <[email protected]>
dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required
Tony Lindgren <[email protected]>
KVM: TDX: Fix uninitialized error code for __tdx_bringup()
Hou Wenlong <[email protected]>
KVM: SVM: Re-load current, not host, TSC_AUX on #VMEXIT from SEV-ES guest
Sean Christopherson <[email protected]>
x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP
Fuad Tabba <[email protected]>
KVM: arm64: Fix page leak in user_mem_abort()
Ben Horgan <[email protected]>
KVM: arm64: Fix debug checking for np-guests using huge mappings
Gautam Gala <[email protected]>
KVM: s390: Fix to clear PTE when discarding a swapped page
Robin Murphy <[email protected]>
perf/arm-cmn: Fix CMN S3 DTM offset
Johan Hovold <[email protected]>
firmware: arm_scmi: quirk: Prevent writes to string constants
Miaoqian Lin <[email protected]>
ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init
Alexander Sverdlin <[email protected]>
ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset)
Catalin Marinas <[email protected]>
arm64: mte: Do not flag the zero page as PG_mte_tagged
Yang Shi <[email protected]>
arm64: kprobes: call set_memory_rox() for kprobe page
Judith Mendez <[email protected]>
arm64: dts: ti: k3-am62p: Fix supported hardware for 1GHz OPP
Vibhore Vardhan <[email protected]>
arm64: dts: ti: k3-am62a-main: Fix main padcfg length
Aleksandrs Vinarskis <[email protected]>
arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default
Stephan Gerhold <[email protected]>
arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees
Stephan Gerhold <[email protected]>
arm64: dts: qcom: msm8939: Add missing MDSS reset
Stephan Gerhold <[email protected]>
arm64: dts: qcom: msm8916: Add missing MDSS reset
Rafael J. Wysocki <[email protected]>
ACPI: battery: Add synchronization between interface updates
Amir Mohammad Jahangirzad <[email protected]>
ACPI: debug: fix signedness issues in read/write helpers
Ahmed Salem <[email protected]>
ACPICA: Debugger: drop ACPI_NONSTRING attribute from name_seg
Daniel Tang <[email protected]>
ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT
Rafael J. Wysocki <[email protected]>
ACPI: property: Fix buffer properties extraction for subnodes
Ahmed Salem <[email protected]>
ACPICA: acpidump: drop ACPI_NONSTRING attribute from file_name
Nathan Chancellor <[email protected]>
s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections
Alexey Gladkov <[email protected]>
s390: vmlinux.lds.S: Reorder sections
Nathan Chancellor <[email protected]>
kbuild: Add '.rel.*' strip pattern for vmlinux
Nathan Chancellor <[email protected]>
kbuild: Restore pattern to avoid stripping .rela.dyn from vmlinux
Masahiro Yamada <[email protected]>
kbuild: keep .modinfo section in vmlinux.unstripped
Masahiro Yamada <[email protected]>
kbuild: always create intermediate vmlinux.unstripped
KaFai Wan <[email protected]>
bpf: Avoid RCU context warning when unpinning htab with internal structs
Bartosz Golaszewski <[email protected]>
gpio: wcd934x: mark the GPIO controller as sleeping
Gunnar Kudrjavets <[email protected]>
tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
Pali Rohár <[email protected]>
cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points
Esben Haabendal <[email protected]>
rtc: isl12022: Fix initial enable_irq/disable_irq balance
Paulo Alcantara <[email protected]>
smb: client: fix missing timestamp updates after utime(2)
Fushuai Wang <[email protected]>
cifs: Fix copy_to_iter return value check
Lorenzo Bianconi <[email protected]>
net: airoha: Fix loopback mode configuration for GDM2 port
Herbert Xu <[email protected]>
crypto: essiv - Check ssize for decryption and in-place encryption
Pavel Begunkov <[email protected]>
io_uring/zcrx: increment fallback loop src offset
Florian Westphal <[email protected]>
selftests: netfilter: query conntrack state to check for port clash resolution
Florian Westphal <[email protected]>
selftests: netfilter: nft_fib.sh: fix spurious test failures
Eric Woudstra <[email protected]>
bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu()
Fernando Fernandez Mancera <[email protected]>
netfilter: nft_objref: validate objref and objrefmap expressions
T Pratham <[email protected]>
crypto: skcipher - Fix reqsize handling
Thomas Wismer <[email protected]>
net: pse-pd: tps23881: Fix current measurement scaling
Philip Yang <[email protected]>
drm/amdkfd: Fix kfd process ref leaking when userptr unmapping
Timur Kristóf <[email protected]>
drm/amd/display: Disable scaling on DCE6 for now
Timur Kristóf <[email protected]>
drm/amd/display: Properly disable scaling on DCE6
Timur Kristóf <[email protected]>
drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6
Timur Kristóf <[email protected]>
drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs
Alex Deucher <[email protected]>
drm/amdgpu: Add additional DCE6 SCL registers
Jason-JH Lin <[email protected]>
mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data()
Carolina Jubran <[email protected]>
net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed
Carolina Jubran <[email protected]>
net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables
Daniel Machon <[email protected]>
net: sparx5/lan969x: fix flooding configuration on bridge join/leave
Maxime Chevallier <[email protected]>
net: mdio: mdio-i2c: Hold the i2c bus lock during smbus transactions
Daniel Borkmann <[email protected]>
bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}Harini T <[email protected]>
mailbox: zynqmp-ipi: Fix SGI cleanup on unbind
Harini T <[email protected]>
mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop
Harini T <[email protected]>
mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes
Harini T <[email protected]>
mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call
Vincent Minet <[email protected]>
perf tools: Fix arm64 libjvmti build by generating unistd_64.h
Eric Dumazet <[email protected]>
tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat()
Leo Yan <[email protected]>
perf python: split Clang options when invoking Popen
Leo Yan <[email protected]>
tools build: Align warning options with perf
Erick Karanja <[email protected]>
net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe
Haotian Zhang <[email protected]>
ice: ice_adapter: release xa entry on adapter allocation failure
Sidharth Seela <[email protected]>
selftest: net: ovpn: Fix uninit return values
Duoming Zhou <[email protected]>
net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work
Kuniyuki Iwashima <[email protected]>
tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
Alexandr Sapozhnikov <[email protected]>
net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
Ian Forbes <[email protected]>
drm/vmwgfx: Fix copy-paste typo in validation
Ian Forbes <[email protected]>
drm/vmwgfx: Fix Use-after-free in validation
Zack Rusin <[email protected]>
drm/vmwgfx: Fix a null-ptr access in the cursor snooper
Vineeth Vijayan <[email protected]>
s390/cio: Update purge function to unregister the unused subchannels
Raag Jadav <[email protected]>
drm/xe/i2c: Don't rely on d3cold.allowed flag in system PM path
Shuicheng Lin <[email protected]>
drm/xe/hw_engine_group: Fix double write lock release in error path
Dan Carpenter <[email protected]>
net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
Bhanu Seshu Kumar Valluri <[email protected]>
net: usb: lan78xx: Fix lost EEPROM read timeout error(-ETIMEDOUT) in lan78xx_read_raw_eeprom
Peter Ujfalusi <[email protected]>
ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel
Huacai Chen <[email protected]>
LoongArch: Init acpi_gbl_use_global_lock to false
Huacai Chen <[email protected]>
LoongArch: Fix build error for LTO with LLVM-18
Tiezhu Yang <[email protected]>
LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference
Peter Ujfalusi <[email protected]>
ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time
Peter Ujfalusi <[email protected]>
ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size
Peter Ujfalusi <[email protected]>
ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size
Ian Rogers <[email protected]>
perf bpf_counter: Fix handling of cpumap fixing hybrid
Sean Christopherson <[email protected]>
mshv: Handle NEED_RESCHED_LAZY before transferring to guest
Daniel Lee <[email protected]>
scsi: ufs: sysfs: Make HID attributes visible
Ian Rogers <[email protected]>
perf bpf-filter: Fix opts declaration on older libbpfs
Duoming Zhou <[email protected]>
scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
Aaron Kling <[email protected]>
cpufreq: tegra186: Set target frequency for all cpus in policy
Pin-yen Lin <[email protected]>
PM: sleep: Do not wait on SYNC_STATE_ONLY device links
Rafael J. Wysocki <[email protected]>
PM: core: Add two macros for walking device links
Rafael J. Wysocki <[email protected]>
PM: core: Annotate loops walking device links as _srcu
Feng Yang <[email protected]>
tracing: Fix the bug where bpf_get_stackid returns -EFAULT on the ARM64
Jeff Layton <[email protected]>
nfsd: fix timestamp updates in CB_GETATTR
Jeff Layton <[email protected]>
nfsd: fix SETATTR updates for delegated timestamps
Jeff Layton <[email protected]>
nfsd: track original timestamps in nfs4_delegation
Jeff Layton <[email protected]>
nfsd: use ATTR_CTIME_SET for delegated ctime updates
Jeff Layton <[email protected]>
vfs: add ATTR_CTIME_SET flag
Jeff Layton <[email protected]>
nfsd: ignore ATTR_DELEG when checking ia_valid before notify_change()
Jeff Layton <[email protected]>
nfsd: fix assignment of ia_ctime.tv_nsec on delegated mtime update
Fedor Pchelkin <[email protected]>
clk: tegra: do not overallocate memory for bpmp clocks
Alok Tiwari <[email protected]>
clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver
Brian Masney <[email protected]>
clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate()
Chen-Yu Tsai <[email protected]>
clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags()
AngeloGioacchino Del Regno <[email protected]>
clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m
Ian Rogers <[email protected]>
perf build-id: Ensure snprintf string is empty when size is 0
Ian Rogers <[email protected]>
perf evsel: Ensure the fallback message is always written to
Ian Rogers <[email protected]>
perf test: Avoid uncore_imc/clockticks in uniquification test
Ian Rogers <[email protected]>
perf evsel: Fix uniquification when PMU given without suffix
Ian Rogers <[email protected]>
perf test: Don't leak workload gopipe in PERF_RECORD_*
Leo Yan <[email protected]>
perf session: Fix handling when buffer exceeds 2 GiB
Fushuai Wang <[email protected]>
perf trace: Fix IS_ERR() vs NULL check bug
Ian Rogers <[email protected]>
perf test shell lbr: Avoid failures with perf event paranoia
Ian Rogers <[email protected]>
perf test: AMD IBS swfilt skip kernel tests if paranoia is >1
Ilkka Koskinen <[email protected]>
perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches
Leo Yan <[email protected]>
perf arm_spe: Correct memory level for remote access
Leo Yan <[email protected]>
perf arm_spe: Correct setting remote access
Clément Le Goffic <[email protected]>
rtc: optee: fix memory leak on driver removal
Rob Herring (Arm) <[email protected]>
rtc: x1205: Fix Xicor X1205 vendor prefix
Yunseong Kim <[email protected]>
perf util: Fix compression checks returning -1 as bool
GuoHan Zhao <[email protected]>
perf drm_pmu: Fix fd_dir leaks in for_each_drm_fdinfo_in_dir()
Christophe Leroy <[email protected]>
perf: Completely remove possibility to override MAX_NR_CPUS
Yuan CHen <[email protected]>
clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init()
Brian Masney <[email protected]>
clk: at91: peripheral: fix return value
Ian Rogers <[email protected]>
perf parse-events: Handle fake PMUs in CPU terms
Lukas Bulwahn <[email protected]>
clk: qcom: Select the intended config in QCS_DISPCC_615
Dan Carpenter <[email protected]>
clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register()
Ian Rogers <[email protected]>
libperf event: Ensure tracing data is multiple of 8 sized
Ian Rogers <[email protected]>
perf evsel: Avoid container_of on a NULL leader
Ian Rogers <[email protected]>
perf test trace_btf_enum: Skip if permissions are insufficient
Ian Rogers <[email protected]>
perf disasm: Avoid undefined behavior in incrementing NULL
Claudiu Beznea <[email protected]>
clk: renesas: r9a08g045: Add MSTOP for GPIO
Michal Wilczynski <[email protected]>
clk: thead: Correct parent for DPU pixel clocks
Icenowy Zheng <[email protected]>
clk: thead: th1520-ap: fix parent of padctrl0 clock
Icenowy Zheng <[email protected]>
clk: thead: th1520-ap: describe gate clocks with clk_gate
Arnd Bergmann <[email protected]>
clk: npcm: select CONFIG_AUXILIARY_BUS
Varad Gautam <[email protected]>
asm-generic/io.h: Skip trace helpers if rwmmio events are disabled
Tomi Valkeinen <[email protected]>
media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try()
Michael Hennerich <[email protected]>
iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE
Sean Christopherson <[email protected]>
KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2
Hou Wenlong <[email protected]>
KVM: x86: Add helper to retrieve current value of user return MSR
Olga Kornievskaia <[email protected]>
nfsd: unregister with rpcbind when deleting a transport
Rafael J. Wysocki <[email protected]>
cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency
Petr Tesarik <[email protected]>
dma-mapping: fix direction in dma_alloc direction traces
Brian Norris <[email protected]>
PM: runtime: Update kerneldoc return codes
Toke Høiland-Jørgensen <[email protected]>
page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches
Shakeel Butt <[email protected]>
memcg: skip cgroup_file_notify if spinning is not allowed
Zhen Ni <[email protected]>
clocksource/drivers/clps711x: Fix resource leaks in error paths
Christian Brauner <[email protected]>
listmount: don't call path_put() under namespace semaphore
Christian Brauner <[email protected]>
statmount: don't call path_put() under namespace semaphore
Thomas Gleixner <[email protected]>
rseq: Protect event mask against membarrier IPI
Omar Sandoval <[email protected]>
arm64: map [_text, _stext) virtual address range non-executable+read-only
Qu Wenruo <[email protected]>
btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range()
Aleksa Sarai <[email protected]>
fscontext: do not consume log entries when returning -EMSGSIZE
Thomas Weißschuh <[email protected]>
fs: always return zero on success from replace_fd()
-------------
Diffstat:
Documentation/admin-guide/kernel-parameters.txt | 3 + .../bindings/phy/rockchip-inno-csi-dphy.yaml | 15 +- Makefile | 4 +- arch/arm/mach-omap2/am33xx-restart.c | 36 ++ arch/arm/mach-omap2/pm33xx-core.c | 6 +- arch/arm64/boot/dts/qcom/msm8916.dtsi | 2 + arch/arm64/boot/dts/qcom/msm8939.dtsi | 2 + arch/arm64/boot/dts/qcom/qcs615.dtsi | 6 + arch/arm64/boot/dts/qcom/sdm845.dtsi | 4 +- arch/arm64/boot/dts/qcom/x1e80100-pmics.dtsi | 2 + arch/arm64/boot/dts/ti/k3-am62a-main.dtsi | 2 +- arch/arm64/boot/dts/ti/k3-am62p5.dtsi | 2 +- arch/arm64/include/asm/ftrace.h | 1 + arch/arm64/kernel/cpufeature.c | 10 +- arch/arm64/kernel/mte.c | 2 +- arch/arm64/kernel/pi/map_kernel.c | 6 + arch/arm64/kernel/probes/kprobes.c | 12 + arch/arm64/kernel/setup.c | 4 +- arch/arm64/kvm/hyp/nvhe/mem_protect.c | 9 +- arch/arm64/kvm/mmu.c | 9 +- arch/arm64/mm/init.c | 2 +- arch/arm64/mm/mmu.c | 14 +- arch/loongarch/Makefile | 4 +- arch/loongarch/kernel/setup.c | 1 + arch/parisc/include/uapi/asm/ioctls.h | 8 +- arch/parisc/lib/memcpy.c | 1 - arch/powerpc/platforms/powernv/pci-ioda.c | 2 +- arch/powerpc/platforms/pseries/msi.c | 2 +- arch/riscv/include/asm/pgtable.h | 11 + arch/s390/Makefile | 1 + arch/s390/include/asm/pgtable.h | 22 + arch/s390/kernel/vmlinux.lds.S | 54 +-- arch/s390/mm/gmap_helpers.c | 12 +- arch/s390/mm/pgtable.c | 23 +- arch/sparc/kernel/of_device_32.c | 1 + arch/sparc/kernel/of_device_64.c | 1 + arch/sparc/mm/hugetlbpage.c | 20 + arch/x86/entry/entry_64_fred.S | 2 +- arch/x86/include/asm/kvm_host.h | 1 + arch/x86/include/asm/msr-index.h | 1 + arch/x86/kernel/kvm.c | 21 +- arch/x86/kernel/umip.c | 15 +- arch/x86/kvm/pmu.c | 5 + arch/x86/kvm/svm/pmu.c | 1 + arch/x86/kvm/svm/sev.c | 10 + arch/x86/kvm/svm/svm.c | 25 +- arch/x86/kvm/svm/svm.h | 2 + arch/x86/kvm/vmx/tdx.c | 10 +- arch/x86/kvm/x86.c | 8 + arch/xtensa/platforms/iss/simdisk.c | 6 +- block/blk-crypto-fallback.c | 3 + crypto/essiv.c | 14 +- crypto/skcipher.c | 2 + drivers/acpi/acpi_dbg.c | 26 +- drivers/acpi/acpi_tad.c | 3 + drivers/acpi/acpica/acdebug.h | 2 +- drivers/acpi/acpica/evglock.c | 4 + drivers/acpi/battery.c | 43 +- drivers/acpi/property.c | 139 +++--- drivers/base/base.h | 9 + drivers/base/core.c | 2 +- drivers/base/power/main.c | 24 +- drivers/base/power/runtime.c | 3 +- drivers/block/loop.c | 8 +- drivers/bus/mhi/ep/main.c | 37 +- drivers/bus/mhi/host/init.c | 5 +- drivers/cdx/cdx_msi.c | 1 + drivers/char/ipmi/ipmi_kcs_sm.c | 16 +- drivers/char/ipmi/ipmi_msghandler.c | 490 ++++++++++----------- drivers/char/tpm/tpm_tis_core.c | 4 +- drivers/clk/Kconfig | 1 + drivers/clk/at91/clk-peripheral.c | 7 +- drivers/clk/mediatek/clk-mt8195-infra_ao.c | 2 +- drivers/clk/mediatek/clk-mux.c | 4 +- drivers/clk/nxp/clk-lpc18xx-cgu.c | 20 +- drivers/clk/qcom/Kconfig | 2 +- drivers/clk/qcom/common.c | 4 +- drivers/clk/qcom/tcsrcc-x1e80100.c | 4 + drivers/clk/renesas/r9a08g045-cpg.c | 3 +- drivers/clk/renesas/renesas-cpg-mssr.c | 7 +- drivers/clk/samsung/clk-exynos990.c | 52 ++- drivers/clk/tegra/clk-bpmp.c | 2 +- drivers/clk/thead/clk-th1520-ap.c | 390 ++++++++-------- drivers/clocksource/clps711x-timer.c | 23 +- drivers/cpufreq/cppc_cpufreq.c | 14 +- drivers/cpufreq/cpufreq-dt.c | 2 +- drivers/cpufreq/imx6q-cpufreq.c | 2 +- drivers/cpufreq/intel_pstate.c | 8 +- drivers/cpufreq/mediatek-cpufreq-hw.c | 2 +- drivers/cpufreq/rcpufreq_dt.rs | 2 +- drivers/cpufreq/scmi-cpufreq.c | 2 +- drivers/cpufreq/scpi-cpufreq.c | 2 +- drivers/cpufreq/spear-cpufreq.c | 2 +- drivers/cpufreq/tegra186-cpufreq.c | 8 +- drivers/crypto/aspeed/aspeed-hace-crypto.c | 2 +- drivers/crypto/atmel-tdes.c | 2 +- drivers/crypto/rockchip/rk3288_crypto_ahash.c | 2 +- drivers/firmware/arm_scmi/quirks.c | 15 +- drivers/firmware/meson/meson_sm.c | 7 +- drivers/firmware/samsung/exynos-acpm-pmic.c | 25 +- drivers/gpio/gpio-mpfs.c | 2 +- drivers/gpio/gpio-wcd934x.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 9 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 + drivers/gpu/drm/amd/display/dc/dce/dce_transform.c | 21 +- drivers/gpu/drm/amd/display/dc/dce/dce_transform.h | 4 + .../gpu/drm/amd/display/dc/dml/dcn31/dcn31_fpu.c | 4 + .../gpu/drm/amd/display/dc/dml/dcn35/dcn35_fpu.c | 6 +- .../gpu/drm/amd/display/dc/dml/dcn351/dcn351_fpu.c | 4 +- .../amd/display/dc/resource/dce60/dce60_resource.c | 4 +- .../amd/display/dc/resource/dcn35/dcn35_resource.c | 16 +- .../display/dc/resource/dcn351/dcn351_resource.c | 17 +- .../amd/display/dc/resource/dcn36/dcn36_resource.c | 16 +- drivers/gpu/drm/amd/display/dc/sspl/dc_spl.c | 10 +- .../gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h | 7 + .../drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h | 2 + drivers/gpu/drm/exynos/exynos7_drm_decon.c | 36 -- drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 28 +- drivers/gpu/drm/msm/adreno/a6xx_gmu.h | 6 + drivers/gpu/drm/nouveau/nouveau_bo.c | 2 +- drivers/gpu/drm/panthor/panthor_drv.c | 11 +- drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c | 5 +- .../gpu/drm/renesas/rcar-du/rcar_mipi_dsi_regs.h | 8 +- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 17 +- drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 6 +- drivers/gpu/drm/xe/xe_hw_engine_group.c | 6 +- drivers/gpu/drm/xe/xe_pm.c | 2 +- drivers/gpu/drm/xe/xe_query.c | 15 +- drivers/hv/mshv_common.c | 2 +- drivers/hv/mshv_root_main.c | 3 +- drivers/i3c/master.c | 2 +- drivers/iio/adc/pac1934.c | 20 +- drivers/iio/adc/xilinx-ams.c | 47 +- drivers/iio/dac/ad5360.c | 2 +- drivers/iio/dac/ad5421.c | 2 +- drivers/iio/frequency/adf4350.c | 20 +- drivers/iio/imu/inv_icm42600/inv_icm42600_core.c | 39 +- drivers/iommu/intel/iommu.c | 2 +- drivers/irqchip/irq-sifive-plic.c | 6 +- drivers/mailbox/mtk-cmdq-mailbox.c | 12 +- drivers/mailbox/zynqmp-ipi-mailbox.c | 24 +- drivers/md/md-linear.c | 1 + drivers/md/raid0.c | 4 + drivers/md/raid1.c | 4 + drivers/md/raid10.c | 8 + drivers/md/raid5.c | 2 + .../media/cec/usb/extron-da-hd-4k-plus/Makefile | 6 - drivers/media/i2c/mt9p031.c | 4 +- drivers/media/i2c/mt9v111.c | 2 +- drivers/media/mc/mc-devnode.c | 6 +- drivers/media/mc/mc-entity.c | 2 +- drivers/media/pci/cx18/cx18-queue.c | 13 +- drivers/media/pci/ivtv/ivtv-irq.c | 2 +- drivers/media/pci/ivtv/ivtv-yuv.c | 8 +- drivers/media/pci/mgb4/mgb4_trigger.c | 2 +- .../media/platform/mediatek/mdp3/mtk-mdp3-comp.c | 3 + drivers/media/platform/qcom/iris/iris_buffer.c | 31 +- drivers/media/platform/qcom/iris/iris_buffer.h | 1 + drivers/media/platform/qcom/iris/iris_core.c | 10 +- drivers/media/platform/qcom/iris/iris_firmware.c | 15 +- .../platform/qcom/iris/iris_hfi_gen1_command.c | 45 +- .../platform/qcom/iris/iris_hfi_gen1_response.c | 4 +- .../platform/qcom/iris/iris_hfi_gen2_response.c | 5 +- drivers/media/platform/qcom/iris/iris_state.c | 5 +- drivers/media/platform/qcom/iris/iris_state.h | 1 + drivers/media/platform/qcom/iris/iris_vb2.c | 8 +- drivers/media/platform/qcom/iris/iris_vdec.c | 2 +- drivers/media/platform/qcom/iris/iris_vidc.c | 1 + drivers/media/platform/qcom/iris/iris_vpu3x.c | 32 +- drivers/media/platform/qcom/iris/iris_vpu_common.c | 2 +- drivers/media/platform/qcom/venus/firmware.c | 8 +- drivers/media/platform/qcom/venus/pm_helpers.c | 9 +- drivers/media/platform/renesas/vsp1/vsp1_vspx.c | 1 + .../platform/samsung/s5p-mfc/s5p_mfc_cmd_v6.c | 35 +- .../media/platform/ti/j721e-csi2rx/j721e-csi2rx.c | 9 +- drivers/media/rc/lirc_dev.c | 9 +- drivers/media/test-drivers/vivid/vivid-cec.c | 12 +- drivers/media/usb/uvc/uvc_ctrl.c | 3 +- drivers/memory/samsung/exynos-srom.c | 10 +- drivers/memory/stm32_omm.c | 2 +- drivers/mmc/core/sdio.c | 6 +- drivers/mmc/host/mmc_spi.c | 2 +- drivers/mtd/nand/raw/fsmc_nand.c | 6 +- drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 14 +- drivers/net/ethernet/airoha/airoha_eth.c | 4 +- drivers/net/ethernet/airoha/airoha_regs.h | 3 + drivers/net/ethernet/freescale/fsl_pq_mdio.c | 2 + drivers/net/ethernet/intel/ice/ice_adapter.c | 10 +- drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 2 +- .../ethernet/mellanox/mlx5/core/en_accel/ipsec.c | 38 +- .../ethernet/mellanox/mlx5/core/en_accel/ipsec.h | 2 +- .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 32 +- drivers/net/ethernet/mellanox/mlx5/core/eswitch.h | 5 +- .../ethernet/mellanox/mlx5/core/eswitch_offloads.c | 18 +- .../net/ethernet/microchip/sparx5/sparx5_main.c | 5 + .../ethernet/microchip/sparx5/sparx5_switchdev.c | 12 + .../net/ethernet/microchip/sparx5/sparx5_vlan.c | 10 - drivers/net/ethernet/mscc/ocelot_stats.c | 2 +- drivers/net/mdio/mdio-i2c.c | 39 +- drivers/net/pse-pd/tps23881.c | 2 +- drivers/net/usb/lan78xx.c | 11 +- drivers/net/wireless/ath/ath11k/core.c | 6 +- drivers/net/wireless/ath/ath11k/hal.c | 16 + drivers/net/wireless/ath/ath11k/hal.h | 1 + drivers/net/wireless/intel/iwlwifi/mld/debugfs.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7921/usb.c | 3 + drivers/net/wireless/mediatek/mt76/mt7925/usb.c | 3 + drivers/net/wireless/realtek/rtw89/core.c | 39 +- drivers/net/wireless/realtek/rtw89/core.h | 3 +- drivers/net/wireless/realtek/rtw89/pci.c | 2 - drivers/nvme/host/pci.c | 2 + drivers/of/unittest.c | 1 + drivers/pci/bus.c | 14 +- drivers/pci/controller/cadence/pci-j721e.c | 26 ++ drivers/pci/controller/dwc/pci-keystone.c | 4 +- drivers/pci/controller/dwc/pcie-rcar-gen4.c | 2 +- drivers/pci/controller/dwc/pcie-tegra194.c | 32 +- drivers/pci/controller/pci-tegra.c | 27 +- drivers/pci/controller/pcie-rcar-host.c | 40 +- drivers/pci/controller/pcie-xilinx-nwl.c | 7 +- drivers/pci/iov.c | 5 + drivers/pci/pci-driver.c | 1 + drivers/pci/pci-sysfs.c | 20 +- drivers/pci/pcie/aer.c | 12 +- drivers/pci/pcie/err.c | 8 +- drivers/pci/probe.c | 19 +- drivers/pci/remove.c | 2 + drivers/pci/setup-bus.c | 37 +- drivers/perf/arm-cmn.c | 9 +- drivers/pinctrl/samsung/pinctrl-samsung.h | 4 - drivers/power/supply/max77976_charger.c | 12 +- drivers/pwm/core.c | 2 +- drivers/pwm/pwm-berlin.c | 4 +- drivers/rtc/interface.c | 27 ++ drivers/rtc/rtc-isl12022.c | 1 + drivers/rtc/rtc-optee.c | 1 + drivers/rtc/rtc-x1205.c | 2 +- drivers/s390/block/dasd.c | 17 +- drivers/s390/cio/device.c | 37 +- drivers/s390/cio/ioasm.c | 7 +- drivers/scsi/hpsa.c | 21 +- drivers/scsi/mvsas/mv_init.c | 2 +- drivers/scsi/sd.c | 50 ++- drivers/spi/spi-cadence-quadspi.c | 18 +- drivers/staging/media/ipu7/ipu7-isys-video.c | 1 + drivers/ufs/core/ufs-sysfs.c | 2 +- drivers/ufs/core/ufs-sysfs.h | 1 + drivers/ufs/core/ufshcd.c | 2 + drivers/video/fbdev/core/fb_cmdline.c | 2 +- drivers/xen/events/events_base.c | 37 +- drivers/xen/manage.c | 14 +- fs/attr.c | 44 +- fs/btrfs/export.c | 8 +- fs/btrfs/extent_io.c | 14 +- fs/cramfs/inode.c | 11 +- fs/eventpoll.c | 139 ++---- fs/ext4/ext4.h | 2 + fs/ext4/fsmap.c | 14 +- fs/ext4/indirect.c | 2 +- fs/ext4/inode.c | 45 +- fs/ext4/move_extent.c | 2 +- fs/ext4/orphan.c | 17 +- fs/ext4/super.c | 26 +- fs/ext4/xattr.c | 19 +- fs/file.c | 5 +- fs/fs-writeback.c | 32 +- fs/fsopen.c | 70 +-- fs/fuse/dev.c | 2 +- fs/fuse/file.c | 8 +- fs/iomap/buffered-io.c | 15 +- fs/iomap/direct-io.c | 3 + fs/minix/inode.c | 8 +- fs/namei.c | 8 + fs/namespace.c | 110 +++-- fs/nfsd/export.c | 82 ++-- fs/nfsd/export.h | 3 + fs/nfsd/lockd.c | 15 + fs/nfsd/nfs4proc.c | 33 +- fs/nfsd/nfs4state.c | 44 +- fs/nfsd/nfs4xdr.c | 5 +- fs/nfsd/nfsfh.c | 24 +- fs/nfsd/state.h | 8 + fs/nfsd/vfs.c | 2 +- fs/nsfs.c | 4 +- fs/ntfs3/bitmap.c | 1 + fs/pidfs.c | 2 +- fs/quota/dquot.c | 10 +- fs/read_write.c | 14 +- fs/smb/client/dir.c | 1 + fs/smb/client/smb1ops.c | 62 ++- fs/smb/client/smb2inode.c | 22 +- fs/smb/client/smb2ops.c | 10 +- fs/squashfs/inode.c | 24 +- fs/xfs/scrub/reap.c | 9 +- include/acpi/acpixf.h | 6 + include/asm-generic/io.h | 98 +++-- include/asm-generic/vmlinux.lds.h | 2 +- include/linux/cpufreq.h | 3 + include/linux/fs.h | 15 + include/linux/iio/frequency/adf4350.h | 2 +- include/linux/ksm.h | 8 +- include/linux/memcontrol.h | 26 +- include/linux/mm.h | 22 +- include/linux/pm_runtime.h | 56 +-- include/linux/rseq.h | 11 +- include/linux/sunrpc/svc_xprt.h | 3 + include/media/v4l2-subdev.h | 30 +- include/trace/events/dma.h | 1 + init/main.c | 12 + io_uring/zcrx.c | 1 + kernel/bpf/inode.c | 4 +- kernel/fork.c | 2 +- kernel/kexec_handover.c | 2 +- kernel/padata.c | 6 +- kernel/pid.c | 5 +- kernel/power/energy_model.c | 11 +- kernel/power/hibernate.c | 6 + kernel/rseq.c | 10 +- kernel/sched/deadline.c | 73 ++- kernel/sys.c | 22 +- lib/genalloc.c | 5 +- mm/damon/lru_sort.c | 2 +- mm/damon/vaddr.c | 8 +- mm/huge_memory.c | 15 +- mm/hugetlb.c | 3 + mm/memcontrol.c | 7 +- mm/migrate.c | 23 +- mm/page_alloc.c | 2 +- mm/slab.h | 8 +- mm/slub.c | 3 +- mm/util.c | 3 +- net/bridge/br_vlan.c | 2 +- net/core/filter.c | 2 + net/core/page_pool.c | 76 +++- net/ipv4/tcp.c | 5 +- net/ipv4/tcp_input.c | 1 - net/mptcp/ctrl.c | 2 +- net/mptcp/pm.c | 7 +- net/mptcp/pm_kernel.c | 50 ++- net/mptcp/protocol.h | 8 + net/netfilter/nft_objref.c | 39 ++ net/sctp/sm_make_chunk.c | 3 +- net/sctp/sm_statefuns.c | 6 +- net/sunrpc/svc_xprt.c | 13 + net/sunrpc/svcsock.c | 2 + net/xdp/xsk_queue.h | 45 +- rust/kernel/cpufreq.rs | 7 +- scripts/Makefile.vmlinux | 51 ++- scripts/mksysmap | 3 + security/keys/trusted-keys/trusted_tpm1.c | 7 +- sound/soc/sof/intel/hda-pcm.c | 29 +- sound/soc/sof/intel/hda-stream.c | 29 +- sound/soc/sof/ipc4-topology.c | 9 +- sound/soc/sof/ipc4-topology.h | 7 +- tools/build/feature/Makefile | 4 +- tools/lib/perf/include/perf/event.h | 1 + tools/perf/Makefile.perf | 2 +- tools/perf/builtin-trace.c | 4 +- tools/perf/perf.h | 2 - .../arch/arm64/ampere/ampereonex/metrics.json | 10 +- tools/perf/tests/perf-record.c | 4 + tools/perf/tests/shell/amd-ibs-swfilt.sh | 51 ++- tools/perf/tests/shell/record_lbr.sh | 26 +- tools/perf/tests/shell/stat+event_uniquifying.sh | 113 +++-- tools/perf/tests/shell/trace_btf_enum.sh | 11 + tools/perf/util/arm-spe.c | 6 +- tools/perf/util/bpf-filter.c | 8 + tools/perf/util/bpf_counter.c | 26 +- tools/perf/util/bpf_counter_cgroup.c | 3 +- tools/perf/util/bpf_skel/kwork_top.bpf.c | 2 - tools/perf/util/build-id.c | 7 + tools/perf/util/disasm.c | 7 +- tools/perf/util/drm_pmu.c | 4 +- tools/perf/util/evsel.c | 44 +- tools/perf/util/lzma.c | 2 +- tools/perf/util/parse-events.c | 116 ++--- tools/perf/util/session.c | 2 +- tools/perf/util/setup.py | 5 +- tools/perf/util/zlib.c | 2 +- tools/power/acpi/tools/acpidump/apfiles.c | 2 +- tools/testing/selftests/net/mptcp/mptcp_join.sh | 11 + .../selftests/net/netfilter/nf_nat_edemux.sh | 58 ++- tools/testing/selftests/net/netfilter/nft_fib.sh | 13 +- tools/testing/selftests/net/ovpn/ovpn-cli.c | 2 + tools/testing/selftests/rseq/rseq.c | 8 +- 385 files changed, 3704 insertions(+), 2240 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/371 fs: always return zero on success from replace_fd()
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
commit 708c04a5c2b78e22f56e2350de41feba74dfccd9 upstream.
replace_fd() returns the number of the new file descriptor through the return value of do_dup2(). However its callers never care about the specific returned number. In fact the caller in receive_fd_replace() treats any non-zero return value as an error and therefore never calls __receive_sock() for most file descriptors, which is a bug.
To fix the bug in receive_fd_replace() and to avoid the same issue happening in future callers, signal success through a plain zero.
--- fs/file.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/file.c +4 -1
@@ -1330,7 +1330,10 @@ int replace_fd(unsigned fd, struct file err =expand_files (files, fd);if (unlikely (err <0 )) goto out_unlock; -return do_dup2 (files, file, fd, flags); + err =do_dup2 (files, file, fd, flags); +if (err <0 ) +return err; +return 0 ; out_unlock:spin_unlock (&files->file_lock);
Greg Kroah-Hartman
maintainerPATCH 2/371 fscontext: do not consume log entries when returning -EMSGSIZE
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksa Sarai <[email protected]>
commit 72d271a7baa7062cb27e774ac37c5459c6d20e22 upstream.
Userspace generally expects APIs that return -EMSGSIZE to allow for them to adjust their buffer size and retry the operation. However, the fscontext log would previously clear the message even in the -EMSGSIZE case.
Given that it is very cheap for us to check whether the buffer is too small before we remove the message from the ring buffer, let's just do that instead. While we're at it, refactor some fscontext_read() into a separate helper to make the ring buffer logic a bit easier to read.
--- fs/fsopen.c | 70 ++++++++++++++++++++++++++++++++---------------------------- 1 file changed, 38 insertions(+), 32 deletions(-)
fs/fsopen.c +38 -32
@@ -18,50 +18,56 @@#include "internal.h" #include "mount.h" +static inline const char *fetch_message_locked (struct fc_log *log,size_t len, +bool *need_free) +{ +const char *p; +int index; + +if (unlikely (log->head == log->tail)) +return ERR_PTR (-ENODATA ); + + index = log->tail & (ARRAY_SIZE (log->buffer) -1 ); + p = log->buffer[index]; +if (unlikely (strlen (p) > len)) +return ERR_PTR (-EMSGSIZE ); + + log->buffer[index] =NULL ; + *need_free = log->need_free & (1 << index); + log->need_free &= ~(1 << index); + log->tail++; + +return p; +} +/* * Allow the user to read back any error, warning or informational messages. +* Only one message is returned for each read(2) call. */ static ssize_t fscontext_read (struct file *file,char __user *_buf,size_t len,loff_t *pos) {struct fs_context *fc = file->private_data; -struct fc_log *log = fc->log.log; -unsigned int logsize =ARRAY_SIZE (log->buffer); -ssize_t ret; -char *p; +ssize_t err; + const char *p __free(kfree) = NULL, *message;bool need_free; -int index, n; - - ret =mutex_lock_interruptible (&fc->uapi_mutex); -if (ret <0 ) -return ret; - -if (log->head == log->tail) { -mutex_unlock (&fc->uapi_mutex); -return -ENODATA ; - } +int n; - index = log->tail & (logsize -1 ); - p = log->buffer[index]; - need_free = log->need_free & (1 << index); - log->buffer[index] =NULL ; - log->need_free &= ~(1 << index); - log->tail++; + err =mutex_lock_interruptible (&fc->uapi_mutex); +if (err <0 ) +return err; + message =fetch_message_locked (fc->log.log, len, &need_free);mutex_unlock (&fc->uapi_mutex); +if (IS_ERR (message)) +return PTR_ERR (message); - ret = -EMSGSIZE ; - n =strlen (p); -if (n > len) - goto err_free; - ret = -EFAULT ; -if (copy_to_user (_buf, p, n) !=0 ) - goto err_free; - ret = n; - -err_free:if (need_free) -kfree (p); -return ret; + p = message; + + n =strlen (message); +if (copy_to_user (_buf, message, n)) +return -EFAULT ; +return n; }static int fscontext_release (struct inode *inode,struct file *file)
Greg Kroah-Hartman
maintainerPATCH 3/371 btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qu Wenruo <[email protected]>
commit 7b26da407420e5054e3f06c5d13271697add9423 upstream.
[BUG]
With my local branch to enable bs > ps support for btrfs, sometimes I hit the following ASSERT() inside submit_one_sector():
ASSERT(block_start != EXTENT_MAP_HOLE);
Please note that it's not yet possible to hit this ASSERT() in the wild yet, as it requires btrfs bs > ps support, which is not even in the development branch.
But on the other hand, there is also a very low chance to hit above ASSERT() with bs < ps cases, so this is an existing bug affect not only the incoming bs > ps support but also the existing bs < ps support.
[CAUSE]
Firstly that ASSERT() means we're trying to submit a dirty block but without a real extent map nor ordered extent map backing it.
Furthermore with extra debugging, the folio triggering such ASSERT() is always larger than the fs block size in my bs > ps case.
(8K block size, 4K page size)
After some more debugging, the ASSERT() is trigger by the following sequence:
extent_writepage()
| We got a 32K folio (4 fs blocks) at file offset 0, and the fs block
| size is 8K, page size is 4K.
| And there is another 8K folio at file offset 32K, which is also
| dirty.
| So the filemap layout looks like the following:
|
| "||" is the filio boundary in the filemap.
| "//| is the dirty range.
|
| 0 8K 16K 24K 32K 40K
| |////////| |//////////////////////||////////|
|
|- writepage_delalloc()
| |- find_lock_delalloc_range() for [0, 8K)
| | Now range [0, 8K) is properly locked.
| |
| |- find_lock_delalloc_range() for [16K, 40K)
| | |- btrfs_find_delalloc_range() returned range [16K, 40K)
| | |- lock_delalloc_folios() locked folio 0 successfully
| | |
| | | The filemap range [32K, 40K) got dropped from filemap.
| | |
| | |- lock_delalloc_folios() failed with -EAGAIN on folio 32K
| | | As the folio at 32K is dropped.
| | |
| | |- loops = 1;
| | |- max_bytes = PAGE_SIZE;
| | |- goto again;
| | | This will re-do the lookup for dirty delalloc ranges.
| | |
| | |- btrfs_find_delalloc_range() called with @max_bytes == 4K
| | | This is smaller than block size, so
| | | btrfs_find_delalloc_range() is unable to return any range.
| | \- return false;
| |
| \- Now only range [0, 8K) has an OE for it, but for dirty range
| [16K, 32K) it's dirty without an OE.
| This breaks the assumption that writepage_delalloc() will find
| and lock all dirty ranges inside the folio.
|
|- extent_writepage_io()
|- submit_one_sector() for [0, 8K)
| Succeeded
|
|- submit_one_sector() for [16K, 24K) Triggering the ASSERT(), as there is no OE, and the original extent map is a hole.
Please note that, this also exposed the same problem for bs < ps support. E.g. with 64K page size and 4K block size.
If we failed to lock a folio, and falls back into the "loops = 1;" branch, we will re-do the search using 64K as max_bytes. Which may fail again to lock the next folio, and exit early without handling all dirty blocks inside the folio.
[FIX]
Instead of using the fixed size PAGE_SIZE as @max_bytes, use @sectorsize, so that we are ensured to find and lock any remaining blocks inside the folio.
And since we're here, add an extra ASSERT() to
before calling btrfs_find_delalloc_range() to make sure the @max_bytes is at least no smaller than a block to avoid false negative.
--- fs/btrfs/extent_io.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
fs/btrfs/extent_io.c +11 -3
@@ -345,6 +345,13 @@ again:/* step one, find a bunch of delalloc bytes starting at start */ delalloc_start = *start; delalloc_end =0 ; + +/* +* If @max_bytes is smaller than a block, btrfs_find_delalloc_range() can +* return early without handling any dirty ranges. +*/ +ASSERT (max_bytes >= fs_info->sectorsize); + found =btrfs_find_delalloc_range (tree, &delalloc_start, &delalloc_end, max_bytes, &cached_state);if (!found || delalloc_end <= *start || delalloc_start > orig_end) {
@@ -375,13 +382,14 @@ again: delalloc_end);ASSERT (!ret || ret == -EAGAIN );if (ret == -EAGAIN ) { -/* some of the folios are gone, lets avoid looping by -* shortening the size of the delalloc range we're searching +/* +* Some of the folios are gone, lets avoid looping by +* shortening the size of the delalloc range we're searching. */ btrfs_free_extent_state (cached_state); cached_state =NULL ;if (!loops) { - max_bytes =PAGE_SIZE ; + max_bytes = fs_info->sectorsize; loops =1 ; goto again; }else {
Re: [PATCH 6.17 003/371] btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range()
Quoted 95 lines · Greg Kroah-Hartman
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qu Wenruo <[email protected]>
commit
7b26da407420e5054e3f06c5d13271697add9423upstream.[BUG]
With my local branch to enable bs > ps support for btrfs, sometimes I hit the followingASSERT()insidesubmit_one_sector():ASSERT(block_start != EXTENT_MAP_HOLE);Please note that it's not yet possible to hit this
ASSERT()in the wild yet, as it requires btrfs bs > ps support, which is not even in the development branch.But on the other hand, there is also a very low chance to hit above
ASSERT()with bs < ps cases, so this is an existing bug affect not only the incoming bs > ps support but also the existing bs < ps support.[CAUSE]
Firstly thatASSERT()means we're trying to submit a dirty block but without a real extent map nor ordered extent map backing it.Furthermore with extra debugging, the folio triggering such
ASSERT()is always larger than the fs block size in my bs > ps case.
(8K block size, 4K page size)After some more debugging, the
ASSERT()is trigger by the following sequence:
extent_writepage()| We got a 32K folio (4 fs blocks) at file offset 0, and the fs block | size is 8K, page size is 4K. | And there is another 8K folio at file offset 32K, which is also | dirty. | So the filemap layout looks like the following: | | "||" is the filio boundary in the filemap. | "//| is the dirty range. | | 0 8K 16K 24K 32K 40K | |////////| |//////////////////////||////////| | |- writepage_delalloc() | |- find_lock_delalloc_range() for [0, 8K) | | Now range [0, 8K) is properly locked. | | | |- find_lock_delalloc_range() for [16K, 40K) | | |- btrfs_find_delalloc_range() returned range [16K, 40K) | | |- lock_delalloc_folios() locked folio 0 successfully | | | | | | The filemap range [32K, 40K) got dropped from filemap. | | | | | |- lock_delalloc_folios() failed with -EAGAIN on folio 32K | | | As the folio at 32K is dropped. | | | | | |- loops = 1; | | |- max_bytes = PAGE_SIZE; | | |- goto again; | | | This will re-do the lookup for dirty delalloc ranges. | | | | | |- btrfs_find_delalloc_range() called with @max_bytes == 4K | | | This is smaller than block size, so | | | btrfs_find_delalloc_range() is unable to return any range. | | \- return false; | | | \- Now only range [0, 8K) has an OE for it, but for dirty range | [16K, 32K) it's dirty without an OE. | This breaks the assumption that writepage_delalloc() will find | and lock all dirty ranges inside the folio. | |- extent_writepage_io() |- submit_one_sector() for [0, 8K) | Succeeded | |- submit_one_sector() for [16K, 24K)Triggering the
ASSERT(), as there is no OE, and the original extent map is a hole.Please note that, this also exposed the same problem for bs < ps support. E.g. with 64K page size and 4K block size.
If we failed to lock a folio, and falls back into the "loops = 1;" branch, we will re-do the search using 64K as
max_bytes. Which may fail again to lock the next folio, and exit early without handling all dirty blocks inside the folio.[FIX]
Instead of using the fixed sizePAGE_SIZEas @max_bytes, use @sectorsize, so that we are ensured to find and lock any remaining blocks inside the folio.
Quoted 8 lines
And since we're here, add an extra
ASSERT()to
before callingbtrfs_find_delalloc_range()to make sure the @max_bytes is at least no smaller than a block to avoid false negative.Cc [email protected] # 5.15+Signed-off-by Qu Wenruo <[email protected]>Signed-off-by David Sterba <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>
Please drop this patch from all stable branch, this is for an unfinished feature and not available in any release.
Greg Kroah-Hartman
maintainerPATCH 4/371 arm64: map [_text, _stext) virtual address range non-executable+read-only
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Omar Sandoval <[email protected]>
commit 5973a62efa34c80c9a4e5eac1fca6f6209b902af upstream.
Since the referenced fixes commit, the kernel's .text section is only mapped starting from _stext; the region [_text, _stext) is omitted. As a result, other vmalloc/vmap allocations may use the virtual addresses nominally in the range [_text, _stext). This address reuse confuses multiple things:
1. crash_prepare_elf64_headers() sets up a segment in /proc/vmcore mapping the entire range [_text, _end) to [__pa_symbol(_text), __pa_symbol(_end)). Reading an address in [_text, _stext) from /proc/vmcore therefore gives the incorrect result.
2. Tools doing symbolization (either by reading /proc/kallsyms or based on the vmlinux ELF file) will incorrectly identify vmalloc/vmap allocations in [_text, _stext) as kernel symbols.
In practice, both of these issues affect the drgn debugger. Specifically, there were cases where the vmap IRQ stacks for some CPUs were allocated in [_text, _stext). As a result, drgn could not get the stack trace for a crash in an IRQ handler because the core dump contained invalid data for the IRQ stack address. The stack addresses were also symbolized as being in the _text symbol.
Fix this by bringing back the mapping of [_text, _stext), but now make it non-executable and read-only. This prevents other allocations from using it while still achieving the original goal of not mapping unpredictable data as executable. Other than the changed protection, this is effectively a revert of the fixes commit.
--- arch/arm64/kernel/pi/map_kernel.c | 6 ++++++ arch/arm64/kernel/setup.c | 4 ++-- arch/arm64/mm/init.c | 2 +- arch/arm64/mm/mmu.c | 14 +++++++++----- 4 files changed, 18 insertions(+), 8 deletions(-)
arch/arm64/kernel/pi/map_kernel.c +6 -0
@@ -78,6 +78,12 @@ static void __init map_kernel(u64 kaslr_ twopass |= enable_scs; prot = twopass ? data_prot : text_prot; +/* +* [_stext, _text) isn't executed after boot and contains some +* non-executable, unpredictable data, so map it non-executable. +*/ +map_segment (init_pg_dir, &pgdp, va_offset, _text, _stext, data_prot, + false, root_level);map_segment (init_pg_dir, &pgdp, va_offset, _stext, _etext, prot, !twopass, root_level); map_segment(init_pg_dir, &pgdp, va_offset, __start_rodata,
arch/arm64/kernel/setup.c +2 -2
@@ -214,7 +214,7 @@ static void __init request_standard_resounsigned long i =0 ;size_t res_size; - kernel_code.start =__pa_symbol (_stext); + kernel_code.start =__pa_symbol (_text); kernel_code.end =__pa_symbol (__init_begin -1 ); kernel_data.start =__pa_symbol (_sdata); kernel_data.end =__pa_symbol (_end -1 );
@@ -280,7 +280,7 @@ u64 cpu_logical_map(unsigned int cpu) void __init __no_sanitize_address setup_arch(char **cmdline_p) { -setup_initial_init_mm (_stext, _etext, _edata, _end); +setup_initial_init_mm (_text, _etext, _edata, _end); *cmdline_p = boot_command_line;
arch/arm64/mm/init.c +1 -1
@@ -279,7 +279,7 @@ void __init arm64_memblock_init(void)* Register the kernel text, kernel data, initrd, and initial * pagetables with memblock. */ -memblock_reserve (__pa_symbol (_stext), _end - _stext); +memblock_reserve (__pa_symbol (_text), _end - _text);if (IS_ENABLED (CONFIG_BLK_DEV_INITRD ) && phys_initrd_size) {/* the generic initrd code expects virtual addresses */ initrd_start =__phys_to_virt (phys_initrd_start);
arch/arm64/mm/mmu.c +9 -5
@@ -574,8 +574,8 @@ void __init mark_linear_text_alias_ro(vo/* * Remove the write permissions from the linear alias of .text/.rodata */ -update_mapping_prot (__pa_symbol (_stext), (unsigned long )lm_alias (_stext), - (unsigned long )__init_begin - (unsigned long )_stext, +update_mapping_prot (__pa_symbol (_text), (unsigned long )lm_alias (_text), + (unsigned long )__init_begin - (unsigned long )_text,PAGE_KERNEL_RO ); }
@@ -636,7 +636,7 @@ static inline void arm64_kfence_map_poolstatic void __init map_mem (pgd_t *pgdp) {static const u64 direct_map_end =_PAGE_END (VA_BITS_MIN ); -phys_addr_t kernel_start =__pa_symbol (_stext); +phys_addr_t kernel_start =__pa_symbol (_text);phys_addr_t kernel_end =__pa_symbol (__init_begin);phys_addr_t start, end;phys_addr_t early_kfence_pool;
@@ -683,7 +683,7 @@ static void __init map_mem(pgd_t *pgdp) }/* -* Map the linear alias of the [_stext, __init_begin) interval +* Map the linear alias of the [_text, __init_begin) interval * as non-executable now, and remove the write permission in * mark_linear_text_alias_ro() below (which will be called after * alternative patching has completed). This makes the contents
@@ -710,6 +710,10 @@ void mark_rodata_ro(void)WRITE_ONCE (rodata_is_rw, false);update_mapping_prot (__pa_symbol (__start_rodata), (unsigned long )__start_rodata, section_size,PAGE_KERNEL_RO ); +/* mark the range between _text and _stext as read only. */ +update_mapping_prot (__pa_symbol (_text), (unsigned long )_text, + (unsigned long )_stext - (unsigned long )_text, +PAGE_KERNEL_RO ); } static void __init declare_vma(struct vm_struct *vma,
@@ -780,7 +784,7 @@ static void __init declare_kernel_vmas(v {static struct vm_struct vmlinux_seg[KERNEL_SEGMENT_COUNT ]; -declare_vma (&vmlinux_seg[0 ], _stext, _etext,VM_NO_GUARD ); +declare_vma (&vmlinux_seg[0 ], _text, _etext,VM_NO_GUARD );declare_vma (&vmlinux_seg[1 ], __start_rodata, __inittext_begin,VM_NO_GUARD );declare_vma (&vmlinux_seg[2 ], __inittext_begin, __inittext_end,VM_NO_GUARD );declare_vma (&vmlinux_seg[3 ], __initdata_begin, __initdata_end,VM_NO_GUARD );
Greg Kroah-Hartman
maintainerPATCH 5/371 rseq: Protect event mask against membarrier IPI
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
commit 6eb350a2233100a283f882c023e5ad426d0ed63b upstream.
rseq_need_restart() reads and clears task::rseq_event_mask with preemption disabled to guard against the scheduler.
But membarrier() uses an IPI and sets the PREEMPT bit in the event mask from the IPI, which leaves that RMW operation unprotected.
Use guard(irq) if CONFIG_MEMBARRIER is enabled to fix that.
--- include/linux/rseq.h | 11 ++++++++--- kernel/rseq.c | 10 +++++----- 2 files changed, 13 insertions(+), 8 deletions(-)
include/linux/rseq.h +8 -3
@@ -7,6 +7,12 @@#include <linux/preempt.h> #include <linux/sched.h> +#ifdef CONFIG_MEMBARRIER +# define RSEQ_EVENT_GUARD irq +#else +# define RSEQ_EVENT_GUARD preempt +#endif +/* * Map the event mask on the user-space ABI enum rseq_cs_flags * for direct mask checks.
@@ -41,9 +47,8 @@ static inline void rseq_handle_notify_restatic inline void rseq_signal_deliver (struct ksignal *ksig,struct pt_regs *regs) { -preempt_disable (); -__set_bit (RSEQ_EVENT_SIGNAL_BIT , ¤t->rseq_event_mask); -preempt_enable (); +scoped_guard (RSEQ_EVENT_GUARD) + __set_bit(RSEQ_EVENT_SIGNAL_BIT, ¤t->rseq_event_mask);rseq_handle_notify_resume (ksig, regs); }
kernel/rseq.c +5 -5
@@ -342,12 +342,12 @@ static int rseq_need_restart(struct task/* * Load and clear event mask atomically with respect to -* scheduler preemption. +* scheduler preemption and membarrier IPIs. */ -preempt_disable (); - event_mask = t->rseq_event_mask; - t->rseq_event_mask =0 ; -preempt_enable (); +scoped_guard (RSEQ_EVENT_GUARD ) { + event_mask = t->rseq_event_mask; + t->rseq_event_mask =0 ; + }return !!event_mask; }
Greg Kroah-Hartman
maintainerPATCH 6/371 statmount: dont call path_put() under namespace semaphore
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Brauner <[email protected]>
commit e8c84e2082e69335f66c8ade4895e80ec270d7c4 upstream.
Massage statmount() and make sure we don't call path_put() under the namespace semaphore. If we put the last reference we're fscked.
--- fs/namespace.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
fs/namespace.c +3 -5
@@ -5711,7 +5711,6 @@ static int grab_requested_root(struct mnstatic int do_statmount (struct kstatmount *s,u64 mnt_id,u64 mnt_ns_id,struct mnt_namespace *ns) { - struct path root __free(path_put) = {};struct mount *m;int err;
@@ -5723,7 +5722,7 @@ static int do_statmount(struct kstatmounif (!s->mnt)return -ENOENT ; - err =grab_requested_root (ns, &root); + err =grab_requested_root (ns, &s->root);if (err)return err;
@@ -5732,7 +5731,7 @@ static int do_statmount(struct kstatmoun* mounts to show users. */ m =real_mount (s->mnt); -if (!is_path_reachable (m, m->mnt.mnt_root, &root) && +if (!is_path_reachable (m, m->mnt.mnt_root, &s->root) && !ns_capable_noaudit (ns->user_ns,CAP_SYS_ADMIN ))return -EPERM ;
@@ -5740,8 +5739,6 @@ static int do_statmount(struct kstatmounif (err)return err; - s->root = root; -/* * Note that mount properties in mnt->mnt_flags, mnt->mnt_idmap * can change concurrently as we only hold the read-side of the
@@ -5963,6 +5960,7 @@ retry:if (!ret) ret =copy_statmount_to_user (ks);kvfree (ks->seq.buf); +path_put (&ks->root);if (retry_statmount (ret, &seq_size)) goto retry;return ret;
Greg Kroah-Hartman
maintainerPATCH 7/371 listmount: dont call path_put() under namespace semaphore
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Brauner <[email protected]>
commit c1f86d0ac322c7e77f6f8dbd216c65d39358ffc0 upstream.
Massage listmount() and make sure we don't call path_put() under the namespace semaphore. If we put the last reference we're fscked.
--- fs/namespace.c | 87 ++++++++++++++++++++++++++++++++++++++------------------- 1 file changed, 59 insertions(+), 28 deletions(-)
fs/namespace.c +59 -28
@@ -5966,23 +5966,34 @@ retry:return ret; } -static ssize_t do_listmount (struct mnt_namespace *ns,u64 mnt_parent_id, -u64 last_mnt_id,u64 *mnt_ids,size_t nr_mnt_ids, -bool reverse) +struct klistmount { +u64 last_mnt_id; +u64 mnt_parent_id; +u64 *kmnt_ids; +u32 nr_mnt_ids; +struct mnt_namespace *ns; +struct path root; +}; + +static ssize_t do_listmount (struct klistmount *kls,bool reverse) { - struct path root __free(path_put) = {}; +struct mnt_namespace *ns = kls->ns; +u64 mnt_parent_id = kls->mnt_parent_id; +u64 last_mnt_id = kls->last_mnt_id; +u64 *mnt_ids = kls->kmnt_ids; +size_t nr_mnt_ids = kls->nr_mnt_ids;struct path orig;struct mount *r, *first;ssize_t ret;rwsem_assert_held (&namespace_sem); - ret =grab_requested_root (ns, &root); + ret =grab_requested_root (ns, &kls->root);if (ret)return ret;if (mnt_parent_id ==LSMT_ROOT ) { - orig = root; + orig = kls->root; }else { orig.mnt =lookup_mnt_in_ns (mnt_parent_id, ns);if (!orig.mnt)
@@ -5994,7 +6005,7 @@ static ssize_t do_listmount(struct mnt_n* Don't trigger audit denials. We just want to determine what * mounts to show users. */ -if (!is_path_reachable (real_mount (orig.mnt), orig.dentry, &root) && +if (!is_path_reachable (real_mount (orig.mnt), orig.dentry, &kls->root) && !ns_capable_noaudit (ns->user_ns,CAP_SYS_ADMIN ))return -EPERM ;
@@ -6027,14 +6038,45 @@ static ssize_t do_listmount(struct mnt_nreturn ret; } +static void __free_klistmount_free (const struct klistmount *kls) +{ +path_put (&kls->root); +kvfree (kls->kmnt_ids); +mnt_ns_release (kls->ns); +} + +static inline int prepare_klistmount (struct klistmount *kls,struct mnt_id_req *kreq, +size_t nr_mnt_ids) +{ + +u64 last_mnt_id = kreq->param; + +/* The first valid unique mount id is MNT_UNIQUE_ID_OFFSET + 1. */ +if (last_mnt_id !=0 && last_mnt_id <=MNT_UNIQUE_ID_OFFSET ) +return -EINVAL ; + + kls->last_mnt_id = last_mnt_id; + + kls->nr_mnt_ids = nr_mnt_ids; + kls->kmnt_ids =kvmalloc_array (nr_mnt_ids,sizeof (*kls->kmnt_ids), +GFP_KERNEL_ACCOUNT ); +if (!kls->kmnt_ids) +return -ENOMEM ; + + kls->ns =grab_requested_mnt_ns (kreq); +if (!kls->ns) +return -ENOENT ; + + kls->mnt_parent_id = kreq->mnt_id; +return 0 ; +} + SYSCALL_DEFINE4(listmount, const struct mnt_id_req __user *, req, u64 __user *, mnt_ids, size_t, nr_mnt_ids, unsigned int, flags) { - u64 *kmnt_ids __free(kvfree) = NULL; + struct klistmount kls __free(klistmount_free) = {};const size_t maxcount =1000000 ; - struct mnt_namespace *ns __free(mnt_ns_release) = NULL;struct mnt_id_req kreq; -u64 last_mnt_id;ssize_t ret;if (flags & ~LISTMOUNT_REVERSE )
@@ -6055,22 +6097,12 @@ SYSCALL_DEFINE4(listmount, const structif (ret)return ret; - last_mnt_id = kreq.param; -/* The first valid unique mount id is MNT_UNIQUE_ID_OFFSET + 1. */ -if (last_mnt_id !=0 && last_mnt_id <=MNT_UNIQUE_ID_OFFSET ) -return -EINVAL ; - - kmnt_ids =kvmalloc_array (nr_mnt_ids,sizeof (*kmnt_ids), -GFP_KERNEL_ACCOUNT ); -if (!kmnt_ids) -return -ENOMEM ; - - ns =grab_requested_mnt_ns (&kreq); -if (!ns) -return -ENOENT ; + ret =prepare_klistmount (&kls, &kreq, nr_mnt_ids); +if (ret) +return ret; -if (kreq.mnt_ns_id && (ns != current->nsproxy->mnt_ns) && - !ns_capable_noaudit (ns->user_ns,CAP_SYS_ADMIN )) +if (kreq.mnt_ns_id && (kls.ns != current->nsproxy->mnt_ns) && + !ns_capable_noaudit (kls.ns->user_ns,CAP_SYS_ADMIN ))return -ENOENT ;/*
@@ -6078,12 +6110,11 @@ SYSCALL_DEFINE4(listmount, const struct* listmount() doesn't care about any mount properties. */ scoped_guard (rwsem_read, &namespace_sem) - ret = do_listmount(ns, kreq.mnt_id, last_mnt_id, kmnt_ids, - nr_mnt_ids, (flags &LISTMOUNT_REVERSE )); + ret = do_listmount(&kls, (flags & LISTMOUNT_REVERSE));if (ret <=0 )return ret; -if (copy_to_user (mnt_ids, kmnt_ids, ret *sizeof (*mnt_ids))) +if (copy_to_user (mnt_ids, kls.kmnt_ids, ret *sizeof (*mnt_ids)))return -EFAULT ;return ret;
Greg Kroah-Hartman
maintainerPATCH 8/371 clocksource/drivers/clps711x: Fix resource leaks in error paths
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhen Ni <[email protected]>
commit cd32e596f02fc981674573402c1138f616df1728 upstream.
The current implementation of clps711x_timer_init() has multiple error paths that directly return without releasing the base I/O memory mapped via of_iomap(). Fix of_iomap leaks in error paths.
--- drivers/clocksource/clps711x-timer.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-)
drivers/clocksource/clps711x-timer.c +16 -7
@@ -78,24 +78,33 @@ static int __init clps711x_timer_init(stunsigned int irq =irq_of_parse_and_map (np,0 );struct clk *clock =of_clk_get (np,0 );void __iomem *base =of_iomap (np,0 ); +int ret =0 ;if (!base)return -ENOMEM ; -if (!irq) -return -EINVAL ; -if (IS_ERR (clock)) -return PTR_ERR (clock); +if (!irq) { + ret = -EINVAL ; + goto unmap_io; + } +if (IS_ERR (clock)) { + ret =PTR_ERR (clock); + goto unmap_io; + }switch (of_alias_get_id (np,"timer" )) {case CLPS711X_CLKSRC_CLOCKSOURCE :clps711x_clksrc_init (clock, base);break ;case CLPS711X_CLKSRC_CLOCKEVENT : -return _clps711x_clkevt_init (clock, base, irq); + ret =_clps711x_clkevt_init (clock, base, irq); +break ;default : -return -EINVAL ; + ret = -EINVAL ; +break ; } -return 0 ; +unmap_io: +iounmap (base); +return ret; }TIMER_OF_DECLARE (clps711x,"cirrus,ep7209-timer" , clps711x_timer_init);
Greg Kroah-Hartman
maintainerPATCH 9/371 memcg: skip cgroup_file_notify if spinning is not allowed
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shakeel Butt <[email protected]>
commit fcc0669c5aa681994c507b50f1c706c969d99730 upstream.
Generally memcg charging is allowed from all the contexts including NMI where even spinning on spinlock can cause locking issues. However one call chain was missed during the addition of memcg charging from any context support. That is try_charge_memcg() -> memcg_memory_event() -> cgroup_file_notify().
The possible function call tree under cgroup_file_notify() can acquire many different spin locks in spinning mode. Some of them are cgroup_file_kn_lock, kernfs_notify_lock, pool_workqeue's lock. So, let's just skip cgroup_file_notify() from memcg charging if the context does not allow spinning.
Alternative approach was also explored where instead of skipping cgroup_file_notify(), we defer the memcg event processing to irq_work [1]. However it adds complexity and it was decided to keep things simple until we need more memcg events with !allow_spinning requirement.
--- include/linux/memcontrol.h | 26 +++++++++++++++++++------- mm/memcontrol.c | 7 ++++--- 2 files changed, 23 insertions(+), 10 deletions(-)
include/linux/memcontrol.h +19 -7
@@ -987,22 +987,28 @@ static inline void count_memcg_event_mm(count_memcg_events_mm (mm, idx,1 ); } -static inline void memcg_memory_event (struct mem_cgroup *memcg, -enum memcg_memory_event event) +static inline void __memcg_memory_event (struct mem_cgroup *memcg, +enum memcg_memory_event event, +bool allow_spinning) {bool swap_event = event ==MEMCG_SWAP_HIGH || event ==MEMCG_SWAP_MAX || event ==MEMCG_SWAP_FAIL ; +/* For now only MEMCG_MAX can happen with !allow_spinning context. */ +VM_WARN_ON_ONCE (!allow_spinning && event !=MEMCG_MAX ); +atomic_long_inc (&memcg->memory_events_local[event]); -if (!swap_event) +if (!swap_event && allow_spinning)cgroup_file_notify (&memcg->events_local_file); do { atomic_long_inc(&memcg->memory_events[event]); - if (swap_event) - cgroup_file_notify(&memcg->swap_events_file); - else - cgroup_file_notify(&memcg->events_file); + if (allow_spinning) { + if (swap_event) + cgroup_file_notify(&memcg->swap_events_file); + else + cgroup_file_notify(&memcg->events_file); + } if (!cgroup_subsys_on_dfl(memory_cgrp_subsys)) break;
@@ -1012,6 +1018,12 @@ static inline void memcg_memory_event(st !mem_cgroup_is_root(memcg)); } +static inline void memcg_memory_event (struct mem_cgroup *memcg, +enum memcg_memory_event event) +{ +__memcg_memory_event (memcg, event, true); +} +static inline void memcg_memory_event_mm (struct mm_struct *mm,enum memcg_memory_event event) {
mm/memcontrol.c +4 -3
@@ -2309,12 +2309,13 @@ static int try_charge_memcg(struct mem_cbool drained = false;bool raised_max_event = false;unsigned long pflags; +bool allow_spinning =gfpflags_allow_spinning (gfp_mask); retry:if (consume_stock (memcg, nr_pages))return 0 ; -if (!gfpflags_allow_spinning (gfp_mask)) +if (!allow_spinning)/* Avoid the refill and flush of the older stock */ batch = nr_pages;
@@ -2350,7 +2351,7 @@ retry:if (!gfpflags_allow_blocking (gfp_mask)) goto nomem; -memcg_memory_event (mem_over_limit,MEMCG_MAX ); +__memcg_memory_event (mem_over_limit,MEMCG_MAX , allow_spinning); raised_max_event = true;psi_memstall_enter (&pflags);
@@ -2417,7 +2418,7 @@ force:* a MEMCG_MAX event. */ if (!raised_max_event) -memcg_memory_event (mem_over_limit,MEMCG_MAX ); +__memcg_memory_event (mem_over_limit,MEMCG_MAX , allow_spinning);/* * The allocation either can't fail or will lead to more memory
Greg Kroah-Hartman
maintainerPATCH 10/371 page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toke Høiland-Jørgensen <[email protected]>
commit 95920c2ed02bde551ab654e9749c2ca7bc3100e0 upstream.
Helge reported that the introduction of PP_MAGIC_MASK let to crashes on boot on his 32-bit parisc machine. The cause of this is the mask is set too wide, so the page_pool_page_is_pp() incurs false positives which crashes the machine.
Just disabling the check in page_pool_is_pp() will lead to the page_pool code itself malfunctioning; so instead of doing this, this patch changes the define for PP_DMA_INDEX_BITS to avoid mistaking arbitrary kernel pointers for page_pool-tagged pages.
The fix relies on the kernel pointers that alias with the pp_magic field always being above PAGE_OFFSET. With this assumption, we can use the lowest bit of the value of PAGE_OFFSET as the upper bound of the PP_DMA_INDEX_MASK, which should avoid the false positives.
Because we cannot rely on PAGE_OFFSET always being a compile-time constant, nor on it always being >0, we fall back to disabling the dma_index storage when there are not enough bits available. This leaves us in the situation we were in before the patch in the Fixes tag, but only on a subset of architecture configurations. This seems to be the best we can do until the transition to page types in complete for page_pool pages.
v2:
- Make sure there's at least 8 bits available and that the PAGE_OFFSET bit calculation doesn't wrap
--- include/linux/mm.h | 22 ++++++++------ net/core/page_pool.c | 76 +++++++++++++++++++++++++++++++++++---------------- 2 files changed, 66 insertions(+), 32 deletions(-)
include/linux/mm.h +13 -9
@@ -4159,14 +4159,13 @@ int arch_lock_shadow_stack_status(struct* since this value becomes part of PP_SIGNATURE; meaning we can just use the * space between the PP_SIGNATURE value (without POISON_POINTER_DELTA), and the * lowest bits of POISON_POINTER_DELTA. On arches where POISON_POINTER_DELTA is -* 0, we make sure that we leave the two topmost bits empty, as that guarantees -* we won't mistake a valid kernel pointer for a value we set, regardless of the -* VMSPLIT setting. +* 0, we use the lowest bit of PAGE_OFFSET as the boundary if that value is +* known at compile-time. * -* Altogether, this means that the number of bits available is constrained by -* the size of an unsigned long (at the upper end, subtracting two bits per the -* above), and the definition of PP_SIGNATURE (with or without -* POISON_POINTER_DELTA). +* If the value of PAGE_OFFSET is not known at compile time, or if it is too +* small to leave at least 8 bits available above PP_SIGNATURE, we define the +* number of bits to be 0, which turns off the DMA index tracking altogether +* (see page_pool_register_dma_index()). */ #define PP_DMA_INDEX_SHIFT (1 + __fls(PP_SIGNATURE - POISON_POINTER_DELTA))#if POISON_POINTER_DELTA >0
@@ -4175,8 +4174,13 @@ int arch_lock_shadow_stack_status(struct*/ #define PP_DMA_INDEX_BITS MIN(32, __ffs(POISON_POINTER_DELTA) - PP_DMA_INDEX_SHIFT)#else -/* Always leave out the topmost two; see above. */ -#define PP_DMA_INDEX_BITS MIN(32, BITS_PER_LONG - PP_DMA_INDEX_SHIFT - 2) +/* Use the lowest bit of PAGE_OFFSET if there's at least 8 bits available; see above */ +#define PP_DMA_INDEX_MIN_OFFSET (1 << (PP_DMA_INDEX_SHIFT + 8)) +#define PP_DMA_INDEX_BITS ((__builtin_constant_p(PAGE_OFFSET) && \ + PAGE_OFFSET >= PP_DMA_INDEX_MIN_OFFSET && \ + !(PAGE_OFFSET & (PP_DMA_INDEX_MIN_OFFSET - 1))) ? \ + MIN(32, __ffs(PAGE_OFFSET) - PP_DMA_INDEX_SHIFT) : 0) +#endif #define PP_DMA_INDEX_MASK GENMASK(PP_DMA_INDEX_BITS + PP_DMA_INDEX_SHIFT - 1, \
net/core/page_pool.c +53 -23
112 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 11/371 PM: runtime: Update kerneldoc return codes
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Norris <[email protected]>
commit fed7eaa4f037361fe4f3d4170649d6849a25998d upstream.
APIs based on __pm_runtime_idle() (pm_runtime_idle(), pm_request_idle()) do not return 1 when already suspended. They return -EAGAIN. This is already covered in the docs, so the entry for "1" is redundant and conflicting.
(pm_runtime_put() and pm_runtime_put_sync() were previously incorrect, but that's fixed in "PM: runtime: pm_runtime_put{,_sync}() returns 1 when already suspended", to ensure consistency with APIs like pm_runtime_put_autosuspend().)
RPM_GET_PUT APIs based on __pm_runtime_suspend() do return 1 when already suspended, but the language is a little unclear -- it's not really an "error", so it seems better to list as a clarification before the 0/success case. Additionally, they only actually return 1 when the refcount makes it to 0; if the usage counter is still non-zero, we return 0.
pm_runtime_put(), etc., also don't appear at first like they can ever see "-EAGAIN: Runtime PM usage_count non-zero", because in non-racy conditions, pm_runtime_put() would drop its reference count, see it's non-zero, and return early (in __pm_runtime_idle()). However, it's possible to race with another actor that increments the usage_count afterward, since rpm_idle() is protected by a separate lock; in such a case, we may see -EAGAIN.
Because this case is only seen in the presence of concurrent actors, it makes sense to clarify that this is when "usage_count **became** non-zero", by way of some racing actor.
Lastly, pm_runtime_put_sync_suspend() duplicated some -EAGAIN language. Fix that.
--- include/linux/pm_runtime.h | 56 ++++++++++++++++++++++++--------------------- 1 file changed, 31 insertions(+), 25 deletions(-)
include/linux/pm_runtime.h +31 -25
@@ -350,13 +350,12 @@ static inline int pm_runtime_force_resum* * 0: Success. * * -EINVAL: Runtime PM error. * * -EACCES: Runtime PM disabled. -* * -EAGAIN: Runtime PM usage_count non-zero, Runtime PM status change ongoing -* or device not in %RPM_ACTIVE state. +* * -EAGAIN: Runtime PM usage counter non-zero, Runtime PM status change +* ongoing or device not in %RPM_ACTIVE state. * * -EBUSY: Runtime PM child_count non-zero. * * -EPERM: Device PM QoS resume latency 0. * * -EINPROGRESS: Suspend already in progress. * * -ENOSYS: CONFIG_PM not enabled. -* * 1: Device already suspended. * Other values and conditions for the above values are possible as returned by * Runtime PM idle and suspend callbacks. */
@@ -370,14 +369,15 @@ static inline int pm_runtime_idle(struct* @dev: Target device. * * Return: +* * 1: Success; device was already suspended. * * 0: Success. * * -EINVAL: Runtime PM error. * * -EACCES: Runtime PM disabled. -* * -EAGAIN: Runtime PM usage_count non-zero or Runtime PM status change ongoing. +* * -EAGAIN: Runtime PM usage counter non-zero or Runtime PM status change +* ongoing. * * -EBUSY: Runtime PM child_count non-zero. * * -EPERM: Device PM QoS resume latency 0. * * -ENOSYS: CONFIG_PM not enabled. -* * 1: Device already suspended. * Other values and conditions for the above values are possible as returned by * Runtime PM suspend callbacks. */
@@ -396,14 +396,15 @@ static inline int pm_runtime_suspend(str* engaging its "idle check" callback. * * Return: +* * 1: Success; device was already suspended. * * 0: Success. * * -EINVAL: Runtime PM error. * * -EACCES: Runtime PM disabled. -* * -EAGAIN: Runtime PM usage_count non-zero or Runtime PM status change ongoing. +* * -EAGAIN: Runtime PM usage counter non-zero or Runtime PM status change +* ongoing. * * -EBUSY: Runtime PM child_count non-zero. * * -EPERM: Device PM QoS resume latency 0. * * -ENOSYS: CONFIG_PM not enabled. -* * 1: Device already suspended. * Other values and conditions for the above values are possible as returned by * Runtime PM suspend callbacks. */
@@ -433,13 +434,12 @@ static inline int pm_runtime_resume(stru* * 0: Success. * * -EINVAL: Runtime PM error. * * -EACCES: Runtime PM disabled. -* * -EAGAIN: Runtime PM usage_count non-zero, Runtime PM status change ongoing -* or device not in %RPM_ACTIVE state. +* * -EAGAIN: Runtime PM usage counter non-zero, Runtime PM status change +* ongoing or device not in %RPM_ACTIVE state. * * -EBUSY: Runtime PM child_count non-zero. * * -EPERM: Device PM QoS resume latency 0. * * -EINPROGRESS: Suspend already in progress. * * -ENOSYS: CONFIG_PM not enabled. -* * 1: Device already suspended. */ static inline int pm_request_idle (struct device *dev) {
@@ -464,15 +464,16 @@ static inline int pm_request_resume(stru* equivalent pm_runtime_autosuspend() for @dev asynchronously. * * Return: +* * 1: Success; device was already suspended. * * 0: Success. * * -EINVAL: Runtime PM error. * * -EACCES: Runtime PM disabled. -* * -EAGAIN: Runtime PM usage_count non-zero or Runtime PM status change ongoing. +* * -EAGAIN: Runtime PM usage counter non-zero or Runtime PM status change +* ongoing. * * -EBUSY: Runtime PM child_count non-zero. * * -EPERM: Device PM QoS resume latency 0. * * -EINPROGRESS: Suspend already in progress. * * -ENOSYS: CONFIG_PM not enabled. -* * 1: Device already suspended. */ static inline int pm_request_autosuspend (struct device *dev) {
@@ -540,15 +541,16 @@ static inline int pm_runtime_resume_and_* equal to 0, queue up a work item for @dev like in pm_request_idle(). * * Return: +* * 1: Success. Usage counter dropped to zero, but device was already suspended. * * 0: Success. * * -EINVAL: Runtime PM error. * * -EACCES: Runtime PM disabled. -* * -EAGAIN: Runtime PM usage_count non-zero or Runtime PM status change ongoing. +* * -EAGAIN: Runtime PM usage counter became non-zero or Runtime PM status +* change ongoing. * * -EBUSY: Runtime PM child_count non-zero. * * -EPERM: Device PM QoS resume latency 0. * * -EINPROGRESS: Suspend already in progress. * * -ENOSYS: CONFIG_PM not enabled. -* * 1: Device already suspended. */ static inline int pm_runtime_put (struct device *dev) {
@@ -565,15 +567,16 @@ DEFINE_FREE(pm_runtime_put, struct devic* equal to 0, queue up a work item for @dev like in pm_request_autosuspend(). * * Return: +* * 1: Success. Usage counter dropped to zero, but device was already suspended. * * 0: Success. * * -EINVAL: Runtime PM error. * * -EACCES: Runtime PM disabled. -* * -EAGAIN: Runtime PM usage_count non-zero or Runtime PM status change ongoing. +* * -EAGAIN: Runtime PM usage counter became non-zero or Runtime PM status +* change ongoing. * * -EBUSY: Runtime PM child_count non-zero. * * -EPERM: Device PM QoS resume latency 0. * * -EINPROGRESS: Suspend already in progress. * * -ENOSYS: CONFIG_PM not enabled. -* * 1: Device already suspended. */ static inline int __pm_runtime_put_autosuspend (struct device *dev) {
@@ -590,15 +593,16 @@ static inline int __pm_runtime_put_autos* in pm_request_autosuspend(). * * Return: +* * 1: Success. Usage counter dropped to zero, but device was already suspended. * * 0: Success. * * -EINVAL: Runtime PM error. * * -EACCES: Runtime PM disabled. -* * -EAGAIN: Runtime PM usage_count non-zero or Runtime PM status change ongoing. +* * -EAGAIN: Runtime PM usage counter became non-zero or Runtime PM status +* change ongoing. * * -EBUSY: Runtime PM child_count non-zero. * * -EPERM: Device PM QoS resume latency 0. * * -EINPROGRESS: Suspend already in progress. * * -ENOSYS: CONFIG_PM not enabled. -* * 1: Device already suspended. */ static inline int pm_runtime_put_autosuspend (struct device *dev) {
@@ -619,14 +623,15 @@ static inline int pm_runtime_put_autosus* if it returns an error code. * * Return: +* * 1: Success. Usage counter dropped to zero, but device was already suspended. * * 0: Success. * * -EINVAL: Runtime PM error. * * -EACCES: Runtime PM disabled. -* * -EAGAIN: Runtime PM usage_count non-zero or Runtime PM status change ongoing. +* * -EAGAIN: Runtime PM usage counter became non-zero or Runtime PM status +* change ongoing. * * -EBUSY: Runtime PM child_count non-zero. * * -EPERM: Device PM QoS resume latency 0. * * -ENOSYS: CONFIG_PM not enabled. -* * 1: Device already suspended. * Other values and conditions for the above values are possible as returned by * Runtime PM suspend callbacks. */
@@ -646,15 +651,15 @@ static inline int pm_runtime_put_sync(st* if it returns an error code. * * Return: +* * 1: Success. Usage counter dropped to zero, but device was already suspended. * * 0: Success. * * -EINVAL: Runtime PM error. * * -EACCES: Runtime PM disabled. -* * -EAGAIN: Runtime PM usage_count non-zero or Runtime PM status change ongoing. -* * -EAGAIN: usage_count non-zero or Runtime PM status change ongoing. +* * -EAGAIN: Runtime PM usage counter became non-zero or Runtime PM status +* change ongoing. * * -EBUSY: Runtime PM child_count non-zero. * * -EPERM: Device PM QoS resume latency 0. * * -ENOSYS: CONFIG_PM not enabled. -* * 1: Device already suspended. * Other values and conditions for the above values are possible as returned by * Runtime PM suspend callbacks. */
@@ -677,15 +682,16 @@ static inline int pm_runtime_put_sync_su* if it returns an error code. * * Return: +* * 1: Success. Usage counter dropped to zero, but device was already suspended. * * 0: Success. * * -EINVAL: Runtime PM error. * * -EACCES: Runtime PM disabled. -* * -EAGAIN: Runtime PM usage_count non-zero or Runtime PM status change ongoing. +* * -EAGAIN: Runtime PM usage counter became non-zero or Runtime PM status +* change ongoing. * * -EBUSY: Runtime PM child_count non-zero. * * -EPERM: Device PM QoS resume latency 0. * * -EINPROGRESS: Suspend already in progress. * * -ENOSYS: CONFIG_PM not enabled. -* * 1: Device already suspended. * Other values and conditions for the above values are possible as returned by * Runtime PM suspend callbacks. */
Greg Kroah-Hartman
maintainerPATCH 12/371 dma-mapping: fix direction in dma_alloc direction traces
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Tesarik <[email protected]>
commit 16abbabc004bedeeaa702e11913da9d4fa70e63a upstream.
Set __entry->dir to the actual "dir" parameter of all trace events in dma_alloc_class. This struct member was left uninitialized by mistake.
--- include/trace/events/dma.h | 1 + 1 file changed, 1 insertion(+)
include/trace/events/dma.h +1 -0
@@ -134,6 +134,7 @@ DECLARE_EVENT_CLASS(dma_alloc_class, __entry->dma_addr = dma_addr; __entry->size = size; __entry->flags = flags; + __entry->dir = dir; __entry->attrs = attrs; ),
Greg Kroah-Hartman
maintainerPATCH 13/371 cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
commit f97aef092e199c10a3da96ae79b571edd5362faa upstream.
Commit a755d0e2d41b ("cpufreq: Honour transition_latency over transition_delay_us") caused platforms where cpuinfo.transition_latency is CPUFREQ_ETERNAL to get a very large transition latency whereas previously it had been capped at 10 ms (and later at 2 ms).
This led to a user-observable regression between 6.6 and 6.12 as described by Shawn:
"The dbs sampling_rate was 10000 us on 6.6 and suddently becomes
6442450 us (4294967295 / 1000 * 1.5) on 6.12 for these platforms because the default transition delay was dropped [...].
It slows down dbs governor's reacting to CPU loading change dramatically. Also, as transition_delay_us is used by schedutil governor as rate_limit_us, it shows a negative impact on device idle power consumption, because the device gets slightly less time in the lowest OPP."
Evidently, the expectation of the drivers using CPUFREQ_ETERNAL as cpuinfo.transition_latency was that it would be capped by the core, but they may as well return a default transition latency value instead of CPUFREQ_ETERNAL and the core need not do anything with it.
Accordingly, introduce CPUFREQ_DEFAULT_TRANSITION_LATENCY_NS and make all of the drivers in question use it instead of CPUFREQ_ETERNAL. Also update the related Rust binding.
--- drivers/cpufreq/cpufreq-dt.c | 2 +- drivers/cpufreq/imx6q-cpufreq.c | 2 +- drivers/cpufreq/mediatek-cpufreq-hw.c | 2 +- drivers/cpufreq/rcpufreq_dt.rs | 2 +- drivers/cpufreq/scmi-cpufreq.c | 2 +- drivers/cpufreq/scpi-cpufreq.c | 2 +- drivers/cpufreq/spear-cpufreq.c | 2 +- include/linux/cpufreq.h | 3 +++ rust/kernel/cpufreq.rs | 7 ++++--- 9 files changed, 14 insertions(+), 10 deletions(-)
drivers/cpufreq/cpufreq-dt.c +1 -1
@@ -104,7 +104,7 @@ static int cpufreq_init(struct cpufreq_p transition_latency =dev_pm_opp_get_max_transition_latency (cpu_dev);if (!transition_latency) - transition_latency =CPUFREQ_ETERNAL ; + transition_latency =CPUFREQ_DEFAULT_TRANSITION_LATENCY_NS ;cpumask_copy (policy->cpus, priv->cpus); policy->driver_data = priv;
drivers/cpufreq/imx6q-cpufreq.c +1 -1
@@ -442,7 +442,7 @@ soc_opp_out: }if (of_property_read_u32 (np,"clock-latency" , &transition_latency)) - transition_latency =CPUFREQ_ETERNAL ; + transition_latency =CPUFREQ_DEFAULT_TRANSITION_LATENCY_NS ;/* * Calculate the ramp time for max voltage change in the
drivers/cpufreq/mediatek-cpufreq-hw.c +1 -1
@@ -238,7 +238,7 @@ static int mtk_cpufreq_hw_cpu_init(struc latency =readl_relaxed (data->reg_bases[REG_FREQ_LATENCY ]) *1000 ;if (!latency) - latency =CPUFREQ_ETERNAL ; + latency =CPUFREQ_DEFAULT_TRANSITION_LATENCY_NS ; policy->cpuinfo.transition_latency = latency; policy->fast_switch_possible = true;
drivers/cpufreq/rcpufreq_dt.rs +1 -1
@@ -123,7 +123,7 @@ impl cpufreq::Driver for CPUFreqDTDriverlet mut transition_latency = opp_table.max_transition_latency_ns ()as u32 ;if transition_latency ==0 { - transition_latency = cpufreq::ETERNAL_LATENCY_NS ; + transition_latency = cpufreq::DEFAULT_TRANSITION_LATENCY_NS ; } policy
drivers/cpufreq/scmi-cpufreq.c +1 -1
@@ -294,7 +294,7 @@ static int scmi_cpufreq_init(struct cpuf latency = perf_ops->transition_latency_get (ph, domain);if (!latency) - latency =CPUFREQ_ETERNAL ; + latency =CPUFREQ_DEFAULT_TRANSITION_LATENCY_NS ; policy->cpuinfo.transition_latency = latency;
drivers/cpufreq/scpi-cpufreq.c +1 -1
@@ -157,7 +157,7 @@ static int scpi_cpufreq_init(struct cpuf latency = scpi_ops->get_transition_latency (cpu_dev);if (!latency) - latency =CPUFREQ_ETERNAL ; + latency =CPUFREQ_DEFAULT_TRANSITION_LATENCY_NS ; policy->cpuinfo.transition_latency = latency;
drivers/cpufreq/spear-cpufreq.c +1 -1
@@ -182,7 +182,7 @@ static int spear_cpufreq_probe(struct plif (of_property_read_u32 (np,"clock-latency" , &spear_cpufreq.transition_latency)) - spear_cpufreq.transition_latency =CPUFREQ_ETERNAL ; + spear_cpufreq.transition_latency =CPUFREQ_DEFAULT_TRANSITION_LATENCY_NS ; cnt =of_property_count_u32_elems (np,"cpufreq_tbl" );if (cnt <=0 ) {
include/linux/cpufreq.h +3 -0
@@ -32,6 +32,9 @@*/ #define CPUFREQ_ETERNAL (-1) + +#define CPUFREQ_DEFAULT_TRANSITION_LATENCY_NS NSEC_PER_MSEC +#define CPUFREQ_NAME_LEN 16/* Print length for names. Extra 1 space for accommodating '\n' in prints */ #define CPUFREQ_NAME_PLEN (CPUFREQ_NAME_LEN + 1)
rust/kernel/cpufreq.rs +4 -3
@@ -39,7 +39,8 @@ use macros::vtable;const CPUFREQ_NAME_LEN :usize = bindings::CPUFREQ_NAME_LEN as usize ;/// Default transition latency value in nanoseconds. -pub const ETERNAL_LATENCY_NS :u32 = bindings::CPUFREQ_ETERNAL as u32 ; +pub const DEFAULT_TRANSITION_LATENCY_NS :u32 = + bindings::CPUFREQ_DEFAULT_TRANSITION_LATENCY_NS ;/// CPU frequency driver flags. pub mod flags {
@@ -400,13 +401,13 @@ impl TableBuilder {/// The following example demonstrates how to create a CPU frequency table. /// /// ``` -/// use kernel::cpufreq::{ETERNAL_LATENCY_NS, Policy}; +/// use kernel::cpufreq::{DEFAULT_TRANSITION_LATENCY_NS, Policy}; /// /// fn update_policy(policy: &mut Policy) { /// policy /// .set_dvfs_possible_from_any_cpu(true) /// .set_fast_switch_possible(true) -/// .set_transition_latency_ns(ETERNAL_LATENCY_NS); +/// .set_transition_latency_ns(DEFAULT_TRANSITION_LATENCY_NS); /// /// pr_info!("The policy details are: {:?}\n", (policy.cpu(), policy.cur())); /// }
Greg Kroah-Hartman
maintainerPATCH 14/371 nfsd: unregister with rpcbind when deleting a transport
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olga Kornievskaia <[email protected]>
commit 898374fdd7f06fa4c4a66e8be3135efeae6128d5 upstream.
When a listener is added, a part of creation of transport also registers program/port with rpcbind. However, when the listener is removed, while transport goes away, rpcbind still has the entry for that port/type.
When deleting the transport, unregister with rpcbind when appropriate.
---v2 created a new xpt_flag XPT_RPCB_UNREG to mark TCP and UDP transport and at xprt destroy send rpcbind unregister if flag set.
--- include/linux/sunrpc/svc_xprt.h | 3 +++ net/sunrpc/svc_xprt.c | 13 +++++++++++++ net/sunrpc/svcsock.c | 2 ++ 3 files changed, 18 insertions(+)
include/linux/sunrpc/svc_xprt.h +3 -0
@@ -104,6 +104,9 @@ enum {* it has access to. It is NOT counted * in ->sv_tmpcnt. */ + XPT_RPCB_UNREG, /* transport that needs unregistering +* with rpcbind (TCP, UDP) on destroy +*/ };/*
net/sunrpc/svc_xprt.c +13 -0
@@ -1014,6 +1014,19 @@ static void svc_delete_xprt(struct svc_xstruct svc_serv *serv = xprt->xpt_server;struct svc_deferred_req *dr; +/* unregister with rpcbind for when transport type is TCP or UDP. +*/ +if (test_bit (XPT_RPCB_UNREG , &xprt->xpt_flags)) { + struct svc_sock *svsk = container_of(xprt, struct svc_sock, + sk_xprt); +struct socket *sock = svsk->sk_sock; + +if (svc_register (serv, xprt->xpt_net, sock->sk->sk_family, + sock->sk->sk_protocol,0 ) <0 ) +pr_warn ("failed to unregister %s with rpcbind\n" , + xprt->xpt_class->xcl_name); + } +if (test_and_set_bit (XPT_DEAD , &xprt->xpt_flags))return ;
net/sunrpc/svcsock.c +2 -0
@@ -836,6 +836,7 @@ static void svc_udp_init(struct svc_sock/* data might have come in before data_ready set up */ set_bit (XPT_DATA , &svsk->sk_xprt.xpt_flags);set_bit (XPT_CHNGBUF , &svsk->sk_xprt.xpt_flags); +set_bit (XPT_RPCB_UNREG , &svsk->sk_xprt.xpt_flags);/* make sure we get destination address info */ switch (svsk->sk_sk->sk_family) {
@@ -1355,6 +1356,7 @@ static void svc_tcp_init(struct svc_sockif (sk->sk_state ==TCP_LISTEN ) {strcpy (svsk->sk_xprt.xpt_remotebuf,"listener" );set_bit (XPT_LISTENER , &svsk->sk_xprt.xpt_flags); +set_bit (XPT_RPCB_UNREG , &svsk->sk_xprt.xpt_flags); sk->sk_data_ready = svc_tcp_listen_data_ready;set_bit (XPT_CONN , &svsk->sk_xprt.xpt_flags); }else {
Greg Kroah-Hartman
maintainerPATCH 15/371 KVM: x86: Add helper to retrieve current value of user return MSR
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hou Wenlong <[email protected]>
commit 9bc366350734246301b090802fc71f9924daad39 upstream.
In the user return MSR support, the cached value is always the hardware value of the specific MSR. Therefore, add a helper to retrieve the cached value, which can replace the need for RDMSR, for example, to allow SEV-ES guests to restore the correct host hardware value without using RDMSR.
--- arch/x86/include/asm/kvm_host.h | 1 + arch/x86/kvm/x86.c | 6 ++++++ 2 files changed, 7 insertions(+)
arch/x86/include/asm/kvm_host.h +1 -0
@@ -2356,6 +2356,7 @@ int kvm_add_user_return_msr(u32 msr);int kvm_find_user_return_msr (u32 msr);int kvm_set_user_return_msr (unsigned index,u64 val,u64 mask);void kvm_user_return_msr_update_cache (unsigned int index,u64 val); +u64 kvm_get_user_return_msr (unsigned int slot);static inline bool kvm_is_supported_user_return_msr (u32 msr) {
arch/x86/kvm/x86.c +6 -0
@@ -677,6 +677,12 @@ void kvm_user_return_msr_update_cache(un }EXPORT_SYMBOL_GPL (kvm_user_return_msr_update_cache); +u64 kvm_get_user_return_msr (unsigned int slot) +{ +return this_cpu_ptr (user_return_msrs)->values[slot].curr; +} +EXPORT_SYMBOL_GPL (kvm_get_user_return_msr); +static void drop_user_return_notifiers (void ) {struct kvm_user_return_msrs *msrs =this_cpu_ptr (user_return_msrs);
Greg Kroah-Hartman
maintainerPATCH 16/371 KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit 68e61f6fd65610e73b17882f86fedfd784d99229 upstream.
Emulate PERF_CNTR_GLOBAL_STATUS_SET when PerfMonV2 is enumerated to the guest, as the MSR is supposed to exist in all AMD v2 PMUs.
--- arch/x86/include/asm/msr-index.h | 1 + arch/x86/kvm/pmu.c | 5 +++++ arch/x86/kvm/svm/pmu.c | 1 + arch/x86/kvm/x86.c | 2 ++ 4 files changed, 9 insertions(+)
arch/x86/include/asm/msr-index.h +1 -0
@@ -733,6 +733,7 @@#define MSR_AMD64_PERF_CNTR_GLOBAL_STATUS 0xc0000300#define MSR_AMD64_PERF_CNTR_GLOBAL_CTL 0xc0000301#define MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_CLR 0xc0000302 +#define MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_SET 0xc0000303/* AMD Hardware Feedback Support MSRs */ #define MSR_AMD_WORKLOAD_CLASS_CONFIG 0xc0000500
arch/x86/kvm/pmu.c +5 -0
@@ -650,6 +650,7 @@ int kvm_pmu_get_msr(struct kvm_vcpu *vcp msr_info->data = pmu->global_ctrl;break ;case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_CLR : +case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_SET :case MSR_CORE_PERF_GLOBAL_OVF_CTRL : msr_info->data =0 ;break ;
@@ -711,6 +712,10 @@ int kvm_pmu_set_msr(struct kvm_vcpu *vcpif (!msr_info->host_initiated) pmu->global_status &= ~data;break ; +case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_SET : +if (!msr_info->host_initiated) + pmu->global_status |= data & ~pmu->global_status_rsvd; +break ;default :kvm_pmu_mark_pmc_in_use (vcpu, msr_info->index);return kvm_pmu_call (set_msr)(vcpu, msr_info);
arch/x86/kvm/svm/pmu.c +1 -0
@@ -113,6 +113,7 @@ static bool amd_is_valid_msr(struct kvm_case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS :case MSR_AMD64_PERF_CNTR_GLOBAL_CTL :case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_CLR : +case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_SET :return pmu->version >1 ;default : if (msr > MSR_F15H_PERF_CTR5 &&
arch/x86/kvm/x86.c +2 -0
@@ -367,6 +367,7 @@ static const u32 msrs_to_save_pmu[] = {MSR_AMD64_PERF_CNTR_GLOBAL_CTL ,MSR_AMD64_PERF_CNTR_GLOBAL_STATUS ,MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_CLR , + MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_SET, }; static u32 msrs_to_save[ARRAY_SIZE(msrs_to_save_base) +
@@ -7359,6 +7360,7 @@ static void kvm_probe_msr_to_save(u32 mscase MSR_AMD64_PERF_CNTR_GLOBAL_CTL :case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS :case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_CLR : +case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_SET :if (!kvm_cpu_cap_has (X86_FEATURE_PERFMON_V2 ))return ;break ;
Greg Kroah-Hartman
maintainerPATCH 17/371 iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Hennerich <[email protected]>
commit 1d8fdabe19267338f29b58f968499e5b55e6a3b6 upstream.
The clk div bits (2 bits wide) do not start in bit 16 but in bit 15. Fix it accordingly.
--- include/linux/iio/frequency/adf4350.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/iio/frequency/adf4350.h +1 -1
@@ -51,7 +51,7 @@/* REG3 Bit Definitions */ #define ADF4350_REG3_12BIT_CLKDIV (x) ((x) << 3) -#define ADF4350_REG3_12BIT_CLKDIV_MODE (x) ((x) << 16) +#define ADF4350_REG3_12BIT_CLKDIV_MODE (x) ((x) << 15)#define ADF4350_REG3_12BIT_CSR_EN (1 << 18)#define ADF4351_REG3_CHARGE_CANCELLATION_EN (1 << 21)#define ADF4351_REG3_ANTI_BACKLASH_3ns_EN (1 << 22)
Greg Kroah-Hartman
maintainerPATCH 18/371 media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <[email protected]>
commit f37df9a0eb5e43fcfe02cbaef076123dc0d79c7e upstream.
v4l2_subdev_call_state_try() macro allocates a subdev state with __v4l2_subdev_state_alloc(), but does not check the returned value. If __v4l2_subdev_state_alloc fails, it returns an ERR_PTR, and that would cause v4l2_subdev_call_state_try() to crash.
Add proper error handling to v4l2_subdev_call_state_try().
--- include/media/v4l2-subdev.h | 30 +++++++++++++++++------------- 1 file changed, 17 insertions(+), 13 deletions(-)
include/media/v4l2-subdev.h +17 -13
@@ -1962,19 +1962,23 @@ extern const struct v4l2_subdev_ops v4l2* * Note: only legacy non-MC drivers may need this macro. */ -#define v4l2_subdev_call_state_try(sd, o, f, args...) \ - ({ \ - int __result; \ - static struct lock_class_key __key; \ - const char *name = KBUILD_BASENAME \ - ":" __stringify(__LINE__) ":state->lock"; \ - struct v4l2_subdev_state *state = \ - __v4l2_subdev_state_alloc(sd, name, &__key); \ - v4l2_subdev_lock_state(state); \ - __result = v4l2_subdev_call(sd, o, f, state, ##args); \ - v4l2_subdev_unlock_state(state); \ - __v4l2_subdev_state_free(state); \ - __result; \ +#define v4l2_subdev_call_state_try(sd, o, f, args...) \ + ({ \ + int __result; \ + static struct lock_class_key __key; \ + const char *name = KBUILD_BASENAME \ + ":" __stringify(__LINE__) ":state->lock"; \ + struct v4l2_subdev_state *state = \ + __v4l2_subdev_state_alloc(sd, name, &__key); \ + if (IS_ERR(state)) { \ + __result = PTR_ERR(state); \ + } else { \ + v4l2_subdev_lock_state(state); \ + __result = v4l2_subdev_call(sd, o, f, state, ##args); \ + v4l2_subdev_unlock_state(state); \ + __v4l2_subdev_state_free(state); \ + } \ + __result; \ })/**
Greg Kroah-Hartman
maintainerPATCH 19/371 asm-generic/io.h: Skip trace helpers if rwmmio events are disabled
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Varad Gautam <[email protected]>
commit 8327bd4fcb6c1dab01ce5c6ff00b42496836dcd2 upstream.
With CONFIG_TRACE_MMIO_ACCESS=y, the {read,write}{b,w,l,q}{_relaxed}() mmio accessors unconditionally call log_{post_}{read,write}_mmio() helpers, which in turn call the ftrace ops for rwmmio trace events
This adds a performance penalty per mmio accessor call, even when rwmmio events are disabled at runtime (~80% overhead on local measurement).
Guard these with tracepoint_enabled().
--- include/asm-generic/io.h | 98 +++++++++++++++++++++++++++++++---------------- 1 file changed, 66 insertions(+), 32 deletions(-)
include/asm-generic/io.h +66 -32
@@ -75,6 +75,7 @@#if IS_ENABLED (CONFIG_TRACE_MMIO_ACCESS ) && !(defined(__DISABLE_TRACE_MMIO__))#include <linux/tracepoint-defs.h> +#define rwmmio_tracepoint_enabled (tracepoint) tracepoint_enabled(tracepoint)DECLARE_TRACEPOINT (rwmmio_write);DECLARE_TRACEPOINT (rwmmio_post_write);DECLARE_TRACEPOINT (rwmmio_read);
@@ -91,6 +92,7 @@ void log_post_read_mmio(u64 val, u8 widt#else +#define rwmmio_tracepoint_enabled (tracepoint) falsestatic inline void log_write_mmio (u64 val,u8 width,volatile void __iomem *addr,unsigned long caller_addr,unsigned long caller_addr0) {} static inline void log_post_write_mmio(u64 val, u8 width, volatile void __iomem *addr,
@@ -189,11 +191,13 @@ static inline u8 readb(const volatile vo {u8 val; -log_read_mmio (8 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_read)) +log_read_mmio (8 , addr, _THIS_IP_, _RET_IP_);__io_br (); val =__raw_readb (addr);__io_ar (val); -log_post_read_mmio (val,8 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_read)) +log_post_read_mmio (val,8 , addr, _THIS_IP_, _RET_IP_);return val; }#endif
@@ -204,11 +208,13 @@ static inline u16 readw(const volatile v {u16 val; -log_read_mmio (16 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_read)) +log_read_mmio (16 , addr, _THIS_IP_, _RET_IP_);__io_br (); val =__le16_to_cpu ((__le16 __force )__raw_readw (addr));__io_ar (val); -log_post_read_mmio (val,16 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_read)) +log_post_read_mmio (val,16 , addr, _THIS_IP_, _RET_IP_);return val; }#endif
@@ -219,11 +225,13 @@ static inline u32 readl(const volatile v {u32 val; -log_read_mmio (32 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_read)) +log_read_mmio (32 , addr, _THIS_IP_, _RET_IP_);__io_br (); val =__le32_to_cpu ((__le32 __force )__raw_readl (addr));__io_ar (val); -log_post_read_mmio (val,32 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_read)) +log_post_read_mmio (val,32 , addr, _THIS_IP_, _RET_IP_);return val; }#endif
@@ -235,11 +243,13 @@ static inline u64 readq(const volatile v {u64 val; -log_read_mmio (64 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_read)) +log_read_mmio (64 , addr, _THIS_IP_, _RET_IP_);__io_br (); val =__le64_to_cpu ((__le64 __force )__raw_readq (addr));__io_ar (val); -log_post_read_mmio (val,64 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_read)) +log_post_read_mmio (val,64 , addr, _THIS_IP_, _RET_IP_);return val; }#endif
@@ -249,11 +259,13 @@ static inline u64 readq(const volatile v#define writeb writebstatic inline void writeb (u8 value,volatile void __iomem *addr) { -log_write_mmio (value,8 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_write)) +log_write_mmio (value,8 , addr, _THIS_IP_, _RET_IP_);__io_bw ();__raw_writeb (value, addr);__io_aw (); -log_post_write_mmio (value,8 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_write)) +log_post_write_mmio (value,8 , addr, _THIS_IP_, _RET_IP_); }#endif
@@ -261,11 +273,13 @@ static inline void writeb(u8 value, vola#define writew writewstatic inline void writew (u16 value,volatile void __iomem *addr) { -log_write_mmio (value,16 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_write)) +log_write_mmio (value,16 , addr, _THIS_IP_, _RET_IP_);__io_bw ();__raw_writew ((u16 __force )cpu_to_le16 (value), addr);__io_aw (); -log_post_write_mmio (value,16 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_write)) +log_post_write_mmio (value,16 , addr, _THIS_IP_, _RET_IP_); }#endif
@@ -273,11 +287,13 @@ static inline void writew(u16 value, vol#define writel writelstatic inline void writel (u32 value,volatile void __iomem *addr) { -log_write_mmio (value,32 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_write)) +log_write_mmio (value,32 , addr, _THIS_IP_, _RET_IP_);__io_bw ();__raw_writel ((u32 __force )__cpu_to_le32 (value), addr);__io_aw (); -log_post_write_mmio (value,32 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_write)) +log_post_write_mmio (value,32 , addr, _THIS_IP_, _RET_IP_); }#endif
@@ -286,11 +302,13 @@ static inline void writel(u32 value, vol#define writeq writeqstatic inline void writeq (u64 value,volatile void __iomem *addr) { -log_write_mmio (value,64 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_write)) +log_write_mmio (value,64 , addr, _THIS_IP_, _RET_IP_);__io_bw ();__raw_writeq ((u64 __force )__cpu_to_le64 (value), addr);__io_aw (); -log_post_write_mmio (value,64 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_write)) +log_post_write_mmio (value,64 , addr, _THIS_IP_, _RET_IP_); }#endif #endif /* CONFIG_64BIT */
@@ -306,9 +324,11 @@ static inline u8 readb_relaxed(const vol {u8 val; -log_read_mmio (8 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_read)) +log_read_mmio (8 , addr, _THIS_IP_, _RET_IP_); val =__raw_readb (addr); -log_post_read_mmio (val,8 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_read)) +log_post_read_mmio (val,8 , addr, _THIS_IP_, _RET_IP_);return val; }#endif
@@ -319,9 +339,11 @@ static inline u16 readw_relaxed(const vo {u16 val; -log_read_mmio (16 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_read)) +log_read_mmio (16 , addr, _THIS_IP_, _RET_IP_); val =__le16_to_cpu ((__le16 __force )__raw_readw (addr)); -log_post_read_mmio (val,16 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_read)) +log_post_read_mmio (val,16 , addr, _THIS_IP_, _RET_IP_);return val; }#endif
@@ -332,9 +354,11 @@ static inline u32 readl_relaxed(const vo {u32 val; -log_read_mmio (32 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_read)) +log_read_mmio (32 , addr, _THIS_IP_, _RET_IP_); val =__le32_to_cpu ((__le32 __force )__raw_readl (addr)); -log_post_read_mmio (val,32 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_read)) +log_post_read_mmio (val,32 , addr, _THIS_IP_, _RET_IP_);return val; }#endif
@@ -345,9 +369,11 @@ static inline u64 readq_relaxed(const vo {u64 val; -log_read_mmio (64 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_read)) +log_read_mmio (64 , addr, _THIS_IP_, _RET_IP_); val =__le64_to_cpu ((__le64 __force )__raw_readq (addr)); -log_post_read_mmio (val,64 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_read)) +log_post_read_mmio (val,64 , addr, _THIS_IP_, _RET_IP_);return val; }#endif
@@ -356,9 +382,11 @@ static inline u64 readq_relaxed(const vo#define writeb_relaxed writeb_relaxedstatic inline void writeb_relaxed (u8 value,volatile void __iomem *addr) { -log_write_mmio (value,8 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_write)) +log_write_mmio (value,8 , addr, _THIS_IP_, _RET_IP_);__raw_writeb (value, addr); -log_post_write_mmio (value,8 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_write)) +log_post_write_mmio (value,8 , addr, _THIS_IP_, _RET_IP_); }#endif
@@ -366,9 +394,11 @@ static inline void writeb_relaxed(u8 val#define writew_relaxed writew_relaxedstatic inline void writew_relaxed (u16 value,volatile void __iomem *addr) { -log_write_mmio (value,16 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_write)) +log_write_mmio (value,16 , addr, _THIS_IP_, _RET_IP_);__raw_writew ((u16 __force )cpu_to_le16 (value), addr); -log_post_write_mmio (value,16 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_write)) +log_post_write_mmio (value,16 , addr, _THIS_IP_, _RET_IP_); }#endif
@@ -376,9 +406,11 @@ static inline void writew_relaxed(u16 va#define writel_relaxed writel_relaxedstatic inline void writel_relaxed (u32 value,volatile void __iomem *addr) { -log_write_mmio (value,32 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_write)) +log_write_mmio (value,32 , addr, _THIS_IP_, _RET_IP_);__raw_writel ((u32 __force )__cpu_to_le32 (value), addr); -log_post_write_mmio (value,32 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_write)) +log_post_write_mmio (value,32 , addr, _THIS_IP_, _RET_IP_); }#endif
@@ -386,9 +418,11 @@ static inline void writel_relaxed(u32 va#define writeq_relaxed writeq_relaxedstatic inline void writeq_relaxed (u64 value,volatile void __iomem *addr) { -log_write_mmio (value,64 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_write)) +log_write_mmio (value,64 , addr, _THIS_IP_, _RET_IP_);__raw_writeq ((u64 __force )__cpu_to_le64 (value), addr); -log_post_write_mmio (value,64 , addr, _THIS_IP_, _RET_IP_); +if (rwmmio_tracepoint_enabled (rwmmio_post_write)) +log_post_write_mmio (value,64 , addr, _THIS_IP_, _RET_IP_); }#endif
Greg Kroah-Hartman
maintainerPATCH 20/371 clk: npcm: select CONFIG_AUXILIARY_BUS
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit c123519bffd29e6320d3a8c4977f9e5a86d6b83d ]
There are very rare randconfig builds that turn on this driver but don't already select CONFIG_AUXILIARY_BUS from another driver, and this results in a build failure:
arm-linux-gnueabi-ld: drivers/clk/clk-npcm8xx.o: in function `npcm8xx_clock_driver_init':
clk-npcm8xx.c:(.init.text+0x18): undefined reference to `__auxiliary_driver_register'
Select the bus here, as all other clk drivers using it do.
--- drivers/clk/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/clk/Kconfig +1 -0
@@ -364,6 +364,7 @@ config COMMON_CLK_LOCHNAGAR config COMMON_CLK_NPCM8XX tristate "Clock driver for the NPCM8XX SoC Family" depends on ARCH_NPCM || COMPILE_TEST + select AUXILIARY_BUS help This driver supports the clocks on the Nuvoton BMC NPCM8XX SoC Family, all the clocks are initialized by the bootloader, so this driver
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 21/371 clk: thead: th1520-ap: describe gate clocks with clk_gate
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Icenowy Zheng <[email protected]>
[ Upstream commit aaa75cbd5d4f63e4edf8b74118d367361dcf92f7 ]
Similar to previous situation of mux clocks, the gate clocks of clk-th1520-ap drivers are also using a helper that creates a temporary struct clk_hw and abandons the struct clk_hw in struct ccu_common, which prevents clock gates to be clock parents.
Do the similar refactor of dropping struct ccu_common and directly use struct clk_gate here.
This patch mimics the refactor done on struct ccu_mux in 54edba916e29 ("clk: thead: th1520-ap: Describe mux clocks with clk_mux").
--- drivers/clk/thead/clk-th1520-ap.c | 382 +++++++++++++++--------------- 1 file changed, 185 insertions(+), 197 deletions(-)
drivers/clk/thead/clk-th1520-ap.c +185 -197
@@ -48,8 +48,9 @@ struct ccu_mux { };struct ccu_gate { -u32 enable; -struct ccu_common common; +int clkid; +u32 reg; +struct clk_gate gate; };struct ccu_div {
@@ -87,12 +88,12 @@ struct ccu_pll { 0), \ } -#define CCU_GATE (_clkid, _struct, _name, _parent, _reg, _gate, _flags) \ +#define CCU_GATE (_clkid, _struct, _name, _parent, _reg, _bit, _flags) \ struct ccu_gate _struct = { \ - .enable = _gate, \ - .common = { \ - .clkid = _clkid, \ - .cfg0 = _reg, \ + .clkid = _clkid, \ + .reg = _reg, \ + .gate = { \ + .bit_idx = _bit, \ .hw.init = CLK_HW_INIT_PARENTS_DATA( \ _name, \ _parent, \
@@ -120,13 +121,6 @@ static inline struct ccu_div *hw_to_ccu_div(struct clk_hw *hw) return container_of(common, struct ccu_div, common); } -static inline struct ccu_gate *hw_to_ccu_gate (struct clk_hw *hw) -{ -struct ccu_common *common =hw_to_ccu_common (hw); - - return container_of(common, struct ccu_gate, common); -} -static u8 ccu_get_parent_helper (struct ccu_common *common,struct ccu_internal *mux) {
@@ -786,128 +780,128 @@ static const struct clk_parent_data emmc_sdio_ref_clk_pd[] = { { .hw = &emmc_sdio_ref_clk.hw }, }; -static CCU_GATE(CLK_BROM, brom_clk, "brom", ahb2_cpusys_hclk_pd, 0x100, BIT(4), 0); -static CCU_GATE(CLK_BMU, bmu_clk, "bmu", axi4_cpusys2_aclk_pd, 0x100, BIT(5), 0); +static CCU_GATE(CLK_BROM, brom_clk, "brom", ahb2_cpusys_hclk_pd, 0x100, 4, 0); +static CCU_GATE(CLK_BMU, bmu_clk, "bmu", axi4_cpusys2_aclk_pd, 0x100, 5, 0); static CCU_GATE(CLK_AON2CPU_A2X, aon2cpu_a2x_clk, "aon2cpu-a2x", axi4_cpusys2_aclk_pd, - 0x134, BIT(8), 0); + 0x134, 8, 0); static CCU_GATE(CLK_X2X_CPUSYS, x2x_cpusys_clk, "x2x-cpusys", axi4_cpusys2_aclk_pd, - 0x134, BIT(7), 0); + 0x134, 7, 0); static CCU_GATE(CLK_CPU2AON_X2H, cpu2aon_x2h_clk, "cpu2aon-x2h", axi_aclk_pd, - 0x138, BIT(8), CLK_IGNORE_UNUSED); + 0x138, 8, CLK_IGNORE_UNUSED); static CCU_GATE(CLK_CPU2PERI_X2H, cpu2peri_x2h_clk, "cpu2peri-x2h", axi4_cpusys2_aclk_pd, - 0x140, BIT(9), CLK_IGNORE_UNUSED); + 0x140, 9, CLK_IGNORE_UNUSED); static CCU_GATE(CLK_PERISYS_APB1_HCLK, perisys_apb1_hclk, "perisys-apb1-hclk", perisys_ahb_hclk_pd, - 0x150, BIT(9), CLK_IGNORE_UNUSED); + 0x150, 9, CLK_IGNORE_UNUSED); static CCU_GATE(CLK_PERISYS_APB2_HCLK, perisys_apb2_hclk, "perisys-apb2-hclk", perisys_ahb_hclk_pd, - 0x150, BIT(10), CLK_IGNORE_UNUSED); + 0x150, 10, CLK_IGNORE_UNUSED); static CCU_GATE(CLK_PERISYS_APB3_HCLK, perisys_apb3_hclk, "perisys-apb3-hclk", perisys_ahb_hclk_pd, - 0x150, BIT(11), CLK_IGNORE_UNUSED); + 0x150, 11, CLK_IGNORE_UNUSED); static CCU_GATE(CLK_PERISYS_APB4_HCLK, perisys_apb4_hclk, "perisys-apb4-hclk", perisys_ahb_hclk_pd, - 0x150, BIT(12), 0); -static CCU_GATE(CLK_NPU_AXI, npu_axi_clk, "npu-axi", axi_aclk_pd, 0x1c8, BIT(5), 0); -static CCU_GATE(CLK_CPU2VP, cpu2vp_clk, "cpu2vp", axi_aclk_pd, 0x1e0, BIT(13), 0); -static CCU_GATE(CLK_EMMC_SDIO, emmc_sdio_clk, "emmc-sdio", emmc_sdio_ref_clk_pd, 0x204, BIT(30), 0); -static CCU_GATE(CLK_GMAC1, gmac1_clk, "gmac1", gmac_pll_clk_pd, 0x204, BIT(26), 0); -static CCU_GATE(CLK_PADCTRL1, padctrl1_clk, "padctrl1", perisys_apb_pclk_pd, 0x204, BIT(24), 0); -static CCU_GATE(CLK_DSMART, dsmart_clk, "dsmart", perisys_apb_pclk_pd, 0x204, BIT(23), 0); -static CCU_GATE(CLK_PADCTRL0, padctrl0_clk, "padctrl0", perisys_apb_pclk_pd, 0x204, BIT(22), 0); -static CCU_GATE(CLK_GMAC_AXI, gmac_axi_clk, "gmac-axi", axi4_cpusys2_aclk_pd, 0x204, BIT(21), 0); -static CCU_GATE(CLK_GPIO3, gpio3_clk, "gpio3-clk", peri2sys_apb_pclk_pd, 0x204, BIT(20), 0); -static CCU_GATE(CLK_GMAC0, gmac0_clk, "gmac0", gmac_pll_clk_pd, 0x204, BIT(19), 0); -static CCU_GATE(CLK_PWM, pwm_clk, "pwm", perisys_apb_pclk_pd, 0x204, BIT(18), 0); -static CCU_GATE(CLK_QSPI0, qspi0_clk, "qspi0", video_pll_clk_pd, 0x204, BIT(17), 0); -static CCU_GATE(CLK_QSPI1, qspi1_clk, "qspi1", video_pll_clk_pd, 0x204, BIT(16), 0); -static CCU_GATE(CLK_SPI, spi_clk, "spi", video_pll_clk_pd, 0x204, BIT(15), 0); -static CCU_GATE(CLK_UART0_PCLK, uart0_pclk, "uart0-pclk", perisys_apb_pclk_pd, 0x204, BIT(14), 0); -static CCU_GATE(CLK_UART1_PCLK, uart1_pclk, "uart1-pclk", perisys_apb_pclk_pd, 0x204, BIT(13), 0); -static CCU_GATE(CLK_UART2_PCLK, uart2_pclk, "uart2-pclk", perisys_apb_pclk_pd, 0x204, BIT(12), 0); -static CCU_GATE(CLK_UART3_PCLK, uart3_pclk, "uart3-pclk", perisys_apb_pclk_pd, 0x204, BIT(11), 0); -static CCU_GATE(CLK_UART4_PCLK, uart4_pclk, "uart4-pclk", perisys_apb_pclk_pd, 0x204, BIT(10), 0); -static CCU_GATE(CLK_UART5_PCLK, uart5_pclk, "uart5-pclk", perisys_apb_pclk_pd, 0x204, BIT(9), 0); -static CCU_GATE(CLK_GPIO0, gpio0_clk, "gpio0-clk", perisys_apb_pclk_pd, 0x204, BIT(8), 0); -static CCU_GATE(CLK_GPIO1, gpio1_clk, "gpio1-clk", perisys_apb_pclk_pd, 0x204, BIT(7), 0); -static CCU_GATE(CLK_GPIO2, gpio2_clk, "gpio2-clk", peri2sys_apb_pclk_pd, 0x204, BIT(6), 0); -static CCU_GATE(CLK_I2C0, i2c0_clk, "i2c0", perisys_apb_pclk_pd, 0x204, BIT(5), 0); -static CCU_GATE(CLK_I2C1, i2c1_clk, "i2c1", perisys_apb_pclk_pd, 0x204, BIT(4), 0); -static CCU_GATE(CLK_I2C2, i2c2_clk, "i2c2", perisys_apb_pclk_pd, 0x204, BIT(3), 0); -static CCU_GATE(CLK_I2C3, i2c3_clk, "i2c3", perisys_apb_pclk_pd, 0x204, BIT(2), 0); -static CCU_GATE(CLK_I2C4, i2c4_clk, "i2c4", perisys_apb_pclk_pd, 0x204, BIT(1), 0); -static CCU_GATE(CLK_I2C5, i2c5_clk, "i2c5", perisys_apb_pclk_pd, 0x204, BIT(0), 0); -static CCU_GATE(CLK_SPINLOCK, spinlock_clk, "spinlock", ahb2_cpusys_hclk_pd, 0x208, BIT(10), 0); -static CCU_GATE(CLK_DMA, dma_clk, "dma", axi4_cpusys2_aclk_pd, 0x208, BIT(8), 0); -static CCU_GATE(CLK_MBOX0, mbox0_clk, "mbox0", apb3_cpusys_pclk_pd, 0x208, BIT(7), 0); -static CCU_GATE(CLK_MBOX1, mbox1_clk, "mbox1", apb3_cpusys_pclk_pd, 0x208, BIT(6), 0); -static CCU_GATE(CLK_MBOX2, mbox2_clk, "mbox2", apb3_cpusys_pclk_pd, 0x208, BIT(5), 0); -static CCU_GATE(CLK_MBOX3, mbox3_clk, "mbox3", apb3_cpusys_pclk_pd, 0x208, BIT(4), 0); -static CCU_GATE(CLK_WDT0, wdt0_clk, "wdt0", apb3_cpusys_pclk_pd, 0x208, BIT(3), 0); -static CCU_GATE(CLK_WDT1, wdt1_clk, "wdt1", apb3_cpusys_pclk_pd, 0x208, BIT(2), 0); -static CCU_GATE(CLK_TIMER0, timer0_clk, "timer0", apb3_cpusys_pclk_pd, 0x208, BIT(1), 0); -static CCU_GATE(CLK_TIMER1, timer1_clk, "timer1", apb3_cpusys_pclk_pd, 0x208, BIT(0), 0); -static CCU_GATE(CLK_SRAM0, sram0_clk, "sram0", axi_aclk_pd, 0x20c, BIT(4), 0); -static CCU_GATE(CLK_SRAM1, sram1_clk, "sram1", axi_aclk_pd, 0x20c, BIT(3), 0); -static CCU_GATE(CLK_SRAM2, sram2_clk, "sram2", axi_aclk_pd, 0x20c, BIT(2), 0); -static CCU_GATE(CLK_SRAM3, sram3_clk, "sram3", axi_aclk_pd, 0x20c, BIT(1), 0); + 0x150, 12, 0); +static CCU_GATE(CLK_NPU_AXI, npu_axi_clk, "npu-axi", axi_aclk_pd, 0x1c8, 5, 0); +static CCU_GATE(CLK_CPU2VP, cpu2vp_clk, "cpu2vp", axi_aclk_pd, 0x1e0, 13, 0); +static CCU_GATE(CLK_EMMC_SDIO, emmc_sdio_clk, "emmc-sdio", emmc_sdio_ref_clk_pd, 0x204, 30, 0); +static CCU_GATE(CLK_GMAC1, gmac1_clk, "gmac1", gmac_pll_clk_pd, 0x204, 26, 0); +static CCU_GATE(CLK_PADCTRL1, padctrl1_clk, "padctrl1", perisys_apb_pclk_pd, 0x204, 24, 0); +static CCU_GATE(CLK_DSMART, dsmart_clk, "dsmart", perisys_apb_pclk_pd, 0x204, 23, 0); +static CCU_GATE(CLK_PADCTRL0, padctrl0_clk, "padctrl0", perisys_apb_pclk_pd, 0x204, 22, 0); +static CCU_GATE(CLK_GMAC_AXI, gmac_axi_clk, "gmac-axi", axi4_cpusys2_aclk_pd, 0x204, 21, 0); +static CCU_GATE(CLK_GPIO3, gpio3_clk, "gpio3-clk", peri2sys_apb_pclk_pd, 0x204, 20, 0); +static CCU_GATE(CLK_GMAC0, gmac0_clk, "gmac0", gmac_pll_clk_pd, 0x204, 19, 0); +static CCU_GATE(CLK_PWM, pwm_clk, "pwm", perisys_apb_pclk_pd, 0x204, 18, 0); +static CCU_GATE(CLK_QSPI0, qspi0_clk, "qspi0", video_pll_clk_pd, 0x204, 17, 0); +static CCU_GATE(CLK_QSPI1, qspi1_clk, "qspi1", video_pll_clk_pd, 0x204, 16, 0); +static CCU_GATE(CLK_SPI, spi_clk, "spi", video_pll_clk_pd, 0x204, 15, 0); +static CCU_GATE(CLK_UART0_PCLK, uart0_pclk, "uart0-pclk", perisys_apb_pclk_pd, 0x204, 14, 0); +static CCU_GATE(CLK_UART1_PCLK, uart1_pclk, "uart1-pclk", perisys_apb_pclk_pd, 0x204, 13, 0); +static CCU_GATE(CLK_UART2_PCLK, uart2_pclk, "uart2-pclk", perisys_apb_pclk_pd, 0x204, 12, 0); +static CCU_GATE(CLK_UART3_PCLK, uart3_pclk, "uart3-pclk", perisys_apb_pclk_pd, 0x204, 11, 0); +static CCU_GATE(CLK_UART4_PCLK, uart4_pclk, "uart4-pclk", perisys_apb_pclk_pd, 0x204, 10, 0); +static CCU_GATE(CLK_UART5_PCLK, uart5_pclk, "uart5-pclk", perisys_apb_pclk_pd, 0x204, 9, 0); +static CCU_GATE(CLK_GPIO0, gpio0_clk, "gpio0-clk", perisys_apb_pclk_pd, 0x204, 8, 0); +static CCU_GATE(CLK_GPIO1, gpio1_clk, "gpio1-clk", perisys_apb_pclk_pd, 0x204, 7, 0); +static CCU_GATE(CLK_GPIO2, gpio2_clk, "gpio2-clk", peri2sys_apb_pclk_pd, 0x204, 6, 0); +static CCU_GATE(CLK_I2C0, i2c0_clk, "i2c0", perisys_apb_pclk_pd, 0x204, 5, 0); +static CCU_GATE(CLK_I2C1, i2c1_clk, "i2c1", perisys_apb_pclk_pd, 0x204, 4, 0); +static CCU_GATE(CLK_I2C2, i2c2_clk, "i2c2", perisys_apb_pclk_pd, 0x204, 3, 0); +static CCU_GATE(CLK_I2C3, i2c3_clk, "i2c3", perisys_apb_pclk_pd, 0x204, 2, 0); +static CCU_GATE(CLK_I2C4, i2c4_clk, "i2c4", perisys_apb_pclk_pd, 0x204, 1, 0); +static CCU_GATE(CLK_I2C5, i2c5_clk, "i2c5", perisys_apb_pclk_pd, 0x204, 0, 0); +static CCU_GATE(CLK_SPINLOCK, spinlock_clk, "spinlock", ahb2_cpusys_hclk_pd, 0x208, 10, 0); +static CCU_GATE(CLK_DMA, dma_clk, "dma", axi4_cpusys2_aclk_pd, 0x208, 8, 0); +static CCU_GATE(CLK_MBOX0, mbox0_clk, "mbox0", apb3_cpusys_pclk_pd, 0x208, 7, 0); +static CCU_GATE(CLK_MBOX1, mbox1_clk, "mbox1", apb3_cpusys_pclk_pd, 0x208, 6, 0); +static CCU_GATE(CLK_MBOX2, mbox2_clk, "mbox2", apb3_cpusys_pclk_pd, 0x208, 5, 0); +static CCU_GATE(CLK_MBOX3, mbox3_clk, "mbox3", apb3_cpusys_pclk_pd, 0x208, 4, 0); +static CCU_GATE(CLK_WDT0, wdt0_clk, "wdt0", apb3_cpusys_pclk_pd, 0x208, 3, 0); +static CCU_GATE(CLK_WDT1, wdt1_clk, "wdt1", apb3_cpusys_pclk_pd, 0x208, 2, 0); +static CCU_GATE(CLK_TIMER0, timer0_clk, "timer0", apb3_cpusys_pclk_pd, 0x208, 1, 0); +static CCU_GATE(CLK_TIMER1, timer1_clk, "timer1", apb3_cpusys_pclk_pd, 0x208, 0, 0); +static CCU_GATE(CLK_SRAM0, sram0_clk, "sram0", axi_aclk_pd, 0x20c, 4, 0); +static CCU_GATE(CLK_SRAM1, sram1_clk, "sram1", axi_aclk_pd, 0x20c, 3, 0); +static CCU_GATE(CLK_SRAM2, sram2_clk, "sram2", axi_aclk_pd, 0x20c, 2, 0); +static CCU_GATE(CLK_SRAM3, sram3_clk, "sram3", axi_aclk_pd, 0x20c, 1, 0); static CCU_GATE(CLK_AXI4_VO_ACLK, axi4_vo_aclk, "axi4-vo-aclk", - video_pll_clk_pd, 0x0, BIT(0), 0); + video_pll_clk_pd, 0x0, 0, 0); static CCU_GATE(CLK_GPU_CORE, gpu_core_clk, "gpu-core-clk", video_pll_clk_pd, - 0x0, BIT(3), 0); + 0x0, 3, 0); static CCU_GATE(CLK_GPU_CFG_ACLK, gpu_cfg_aclk, "gpu-cfg-aclk", - video_pll_clk_pd, 0x0, BIT(4), 0); + video_pll_clk_pd, 0x0, 4, 0); static CCU_GATE(CLK_DPU_PIXELCLK0, dpu0_pixelclk, "dpu0-pixelclk", - video_pll_clk_pd, 0x0, BIT(5), 0); + video_pll_clk_pd, 0x0, 5, 0); static CCU_GATE(CLK_DPU_PIXELCLK1, dpu1_pixelclk, "dpu1-pixelclk", - video_pll_clk_pd, 0x0, BIT(6), 0); + video_pll_clk_pd, 0x0, 6, 0); static CCU_GATE(CLK_DPU_HCLK, dpu_hclk, "dpu-hclk", video_pll_clk_pd, 0x0, - BIT(7), 0); + 7, 0); static CCU_GATE(CLK_DPU_ACLK, dpu_aclk, "dpu-aclk", video_pll_clk_pd, 0x0, - BIT(8), 0); + 8, 0); static CCU_GATE(CLK_DPU_CCLK, dpu_cclk, "dpu-cclk", video_pll_clk_pd, 0x0, - BIT(9), 0); + 9, 0); static CCU_GATE(CLK_HDMI_SFR, hdmi_sfr_clk, "hdmi-sfr-clk", video_pll_clk_pd, - 0x0, BIT(10), 0); + 0x0, 10, 0); static CCU_GATE(CLK_HDMI_PCLK, hdmi_pclk, "hdmi-pclk", video_pll_clk_pd, 0x0, - BIT(11), 0); + 11, 0); static CCU_GATE(CLK_HDMI_CEC, hdmi_cec_clk, "hdmi-cec-clk", video_pll_clk_pd, - 0x0, BIT(12), 0); + 0x0, 12, 0); static CCU_GATE(CLK_MIPI_DSI0_PCLK, mipi_dsi0_pclk, "mipi-dsi0-pclk", - video_pll_clk_pd, 0x0, BIT(13), 0); + video_pll_clk_pd, 0x0, 13, 0); static CCU_GATE(CLK_MIPI_DSI1_PCLK, mipi_dsi1_pclk, "mipi-dsi1-pclk", - video_pll_clk_pd, 0x0, BIT(14), 0); + video_pll_clk_pd, 0x0, 14, 0); static CCU_GATE(CLK_MIPI_DSI0_CFG, mipi_dsi0_cfg_clk, "mipi-dsi0-cfg-clk", - video_pll_clk_pd, 0x0, BIT(15), 0); + video_pll_clk_pd, 0x0, 15, 0); static CCU_GATE(CLK_MIPI_DSI1_CFG, mipi_dsi1_cfg_clk, "mipi-dsi1-cfg-clk", - video_pll_clk_pd, 0x0, BIT(16), 0); + video_pll_clk_pd, 0x0, 16, 0); static CCU_GATE(CLK_MIPI_DSI0_REFCLK, mipi_dsi0_refclk, "mipi-dsi0-refclk", - video_pll_clk_pd, 0x0, BIT(17), 0); + video_pll_clk_pd, 0x0, 17, 0); static CCU_GATE(CLK_MIPI_DSI1_REFCLK, mipi_dsi1_refclk, "mipi-dsi1-refclk", - video_pll_clk_pd, 0x0, BIT(18), 0); + video_pll_clk_pd, 0x0, 18, 0); static CCU_GATE(CLK_HDMI_I2S, hdmi_i2s_clk, "hdmi-i2s-clk", video_pll_clk_pd, - 0x0, BIT(19), 0); + 0x0, 19, 0); static CCU_GATE(CLK_X2H_DPU1_ACLK, x2h_dpu1_aclk, "x2h-dpu1-aclk", - video_pll_clk_pd, 0x0, BIT(20), 0); + video_pll_clk_pd, 0x0, 20, 0); static CCU_GATE(CLK_X2H_DPU_ACLK, x2h_dpu_aclk, "x2h-dpu-aclk", - video_pll_clk_pd, 0x0, BIT(21), 0); + video_pll_clk_pd, 0x0, 21, 0); static CCU_GATE(CLK_AXI4_VO_PCLK, axi4_vo_pclk, "axi4-vo-pclk", - video_pll_clk_pd, 0x0, BIT(22), 0); + video_pll_clk_pd, 0x0, 22, 0); static CCU_GATE(CLK_IOPMP_VOSYS_DPU_PCLK, iopmp_vosys_dpu_pclk, - "iopmp-vosys-dpu-pclk", video_pll_clk_pd, 0x0, BIT(23), 0); + "iopmp-vosys-dpu-pclk", video_pll_clk_pd, 0x0, 23, 0); static CCU_GATE(CLK_IOPMP_VOSYS_DPU1_PCLK, iopmp_vosys_dpu1_pclk, - "iopmp-vosys-dpu1-pclk", video_pll_clk_pd, 0x0, BIT(24), 0); + "iopmp-vosys-dpu1-pclk", video_pll_clk_pd, 0x0, 24, 0); static CCU_GATE(CLK_IOPMP_VOSYS_GPU_PCLK, iopmp_vosys_gpu_pclk, - "iopmp-vosys-gpu-pclk", video_pll_clk_pd, 0x0, BIT(25), 0); + "iopmp-vosys-gpu-pclk", video_pll_clk_pd, 0x0, 25, 0); static CCU_GATE(CLK_IOPMP_DPU1_ACLK, iopmp_dpu1_aclk, "iopmp-dpu1-aclk", - video_pll_clk_pd, 0x0, BIT(27), 0); + video_pll_clk_pd, 0x0, 27, 0); static CCU_GATE(CLK_IOPMP_DPU_ACLK, iopmp_dpu_aclk, "iopmp-dpu-aclk", - video_pll_clk_pd, 0x0, BIT(28), 0); + video_pll_clk_pd, 0x0, 28, 0); static CCU_GATE(CLK_IOPMP_GPU_ACLK, iopmp_gpu_aclk, "iopmp-gpu-aclk", - video_pll_clk_pd, 0x0, BIT(29), 0); + video_pll_clk_pd, 0x0, 29, 0); static CCU_GATE(CLK_MIPIDSI0_PIXCLK, mipi_dsi0_pixclk, "mipi-dsi0-pixclk", - video_pll_clk_pd, 0x0, BIT(30), 0); + video_pll_clk_pd, 0x0, 30, 0); static CCU_GATE(CLK_MIPIDSI1_PIXCLK, mipi_dsi1_pixclk, "mipi-dsi1-pixclk", - video_pll_clk_pd, 0x0, BIT(31), 0); + video_pll_clk_pd, 0x0, 31, 0); static CCU_GATE(CLK_HDMI_PIXCLK, hdmi_pixclk, "hdmi-pixclk", video_pll_clk_pd, - 0x4, BIT(0), 0); + 0x4, 0, 0); static CLK_FIXED_FACTOR_HW(gmac_pll_clk_100m, "gmac-pll-clk-100m", &gmac_pll_clk.common.hw, 10, 1, 0);
@@ -963,93 +957,93 @@ static struct ccu_mux *th1520_mux_clks[] = { &uart_sclk, }; -static struct ccu_common *th1520_gate_clks[] = { - &emmc_sdio_clk.common, - &aon2cpu_a2x_clk.common, - &x2x_cpusys_clk.common, - &brom_clk.common, - &bmu_clk.common, - &cpu2aon_x2h_clk.common, - &cpu2peri_x2h_clk.common, - &cpu2vp_clk.common, - &perisys_apb1_hclk.common, - &perisys_apb2_hclk.common, - &perisys_apb3_hclk.common, - &perisys_apb4_hclk.common, - &npu_axi_clk.common, - &gmac1_clk.common, - &padctrl1_clk.common, - &dsmart_clk.common, - &padctrl0_clk.common, - &gmac_axi_clk.common, - &gpio3_clk.common, - &gmac0_clk.common, - &pwm_clk.common, - &qspi0_clk.common, - &qspi1_clk.common, - &spi_clk.common, - &uart0_pclk.common, - &uart1_pclk.common, - &uart2_pclk.common, - &uart3_pclk.common, - &uart4_pclk.common, - &uart5_pclk.common, - &gpio0_clk.common, - &gpio1_clk.common, - &gpio2_clk.common, - &i2c0_clk.common, - &i2c1_clk.common, - &i2c2_clk.common, - &i2c3_clk.common, - &i2c4_clk.common, - &i2c5_clk.common, - &spinlock_clk.common, - &dma_clk.common, - &mbox0_clk.common, - &mbox1_clk.common, - &mbox2_clk.common, - &mbox3_clk.common, - &wdt0_clk.common, - &wdt1_clk.common, - &timer0_clk.common, - &timer1_clk.common, - &sram0_clk.common, - &sram1_clk.common, - &sram2_clk.common, - &sram3_clk.common, -}; - -static struct ccu_common *th1520_vo_gate_clks[] = { - &axi4_vo_aclk.common, - &gpu_core_clk.common, - &gpu_cfg_aclk.common, - &dpu0_pixelclk.common, - &dpu1_pixelclk.common, - &dpu_hclk.common, - &dpu_aclk.common, - &dpu_cclk.common, - &hdmi_sfr_clk.common, - &hdmi_pclk.common, - &hdmi_cec_clk.common, - &mipi_dsi0_pclk.common, - &mipi_dsi1_pclk.common, - &mipi_dsi0_cfg_clk.common, - &mipi_dsi1_cfg_clk.common, - &mipi_dsi0_refclk.common, - &mipi_dsi1_refclk.common, - &hdmi_i2s_clk.common, - &x2h_dpu1_aclk.common, - &x2h_dpu_aclk.common, - &axi4_vo_pclk.common, - &iopmp_vosys_dpu_pclk.common, - &iopmp_vosys_dpu1_pclk.common, - &iopmp_vosys_gpu_pclk.common, - &iopmp_dpu1_aclk.common, - &iopmp_dpu_aclk.common, - &iopmp_gpu_aclk.common, - &mipi_dsi0_pixclk.common, - &mipi_dsi1_pixclk.common, - &hdmi_pixclk.common +static struct ccu_gate *th1520_gate_clks[] = { + &emmc_sdio_clk, + &aon2cpu_a2x_clk, + &x2x_cpusys_clk, + &brom_clk, + &bmu_clk, + &cpu2aon_x2h_clk, + &cpu2peri_x2h_clk, + &cpu2vp_clk, + &perisys_apb1_hclk, + &perisys_apb2_hclk, + &perisys_apb3_hclk, + &perisys_apb4_hclk, + &npu_axi_clk, + &gmac1_clk, + &padctrl1_clk, + &dsmart_clk, + &padctrl0_clk, + &gmac_axi_clk, + &gpio3_clk, + &gmac0_clk, + &pwm_clk, + &qspi0_clk, + &qspi1_clk, + &spi_clk, + &uart0_pclk, + &uart1_pclk, + &uart2_pclk, + &uart3_pclk, + &uart4_pclk, + &uart5_pclk, + &gpio0_clk, + &gpio1_clk, + &gpio2_clk, + &i2c0_clk, + &i2c1_clk, + &i2c2_clk, + &i2c3_clk, + &i2c4_clk, + &i2c5_clk, + &spinlock_clk, + &dma_clk, + &mbox0_clk, + &mbox1_clk, + &mbox2_clk, + &mbox3_clk, + &wdt0_clk, + &wdt1_clk, + &timer0_clk, + &timer1_clk, + &sram0_clk, + &sram1_clk, + &sram2_clk, + &sram3_clk, +}; + +static struct ccu_gate *th1520_vo_gate_clks[] = { + &axi4_vo_aclk, + &gpu_core_clk, + &gpu_cfg_aclk, + &dpu0_pixelclk, + &dpu1_pixelclk, + &dpu_hclk, + &dpu_aclk, + &dpu_cclk, + &hdmi_sfr_clk, + &hdmi_pclk, + &hdmi_cec_clk, + &mipi_dsi0_pclk, + &mipi_dsi1_pclk, + &mipi_dsi0_cfg_clk, + &mipi_dsi1_cfg_clk, + &mipi_dsi0_refclk, + &mipi_dsi1_refclk, + &hdmi_i2s_clk, + &x2h_dpu1_aclk, + &x2h_dpu_aclk, + &axi4_vo_pclk, + &iopmp_vosys_dpu_pclk, + &iopmp_vosys_dpu1_pclk, + &iopmp_vosys_gpu_pclk, + &iopmp_dpu1_aclk, + &iopmp_dpu_aclk, + &iopmp_gpu_aclk, + &mipi_dsi0_pixclk, + &mipi_dsi1_pixclk, + &hdmi_pixclk };static const struct regmap_config th1520_clk_regmap_config = {
@@ -1063,7 +1057,7 @@ struct th1520_plat_data {struct ccu_common **th1520_pll_clks;struct ccu_common **th1520_div_clks;struct ccu_mux **th1520_mux_clks; -struct ccu_common **th1520_gate_clks; +struct ccu_gate **th1520_gate_clks;int nr_clks;int nr_pll_clks;
@@ -1102,7 +1096,6 @@ static int th1520_clk_probe(struct platform_device *pdev)struct regmap *map;void __iomem *base; -struct clk_hw *hw;int ret, i; plat_data =device_get_match_data (&pdev->dev);
@@ -1161,20 +1154,15 @@ static int th1520_clk_probe(struct platform_device *pdev) }for (i =0 ; i < plat_data->nr_gate_clks; i++) { -struct ccu_gate *cg =hw_to_ccu_gate (&plat_data->th1520_gate_clks[i]->hw); +struct ccu_gate *cg = plat_data->th1520_gate_clks[i]; - plat_data->th1520_gate_clks[i]->map = map; + cg->gate.reg = base + cg->reg; - hw =devm_clk_hw_register_gate_parent_data (dev, - cg->common.hw.init->name, - cg->common.hw.init->parent_data, - cg->common.hw.init->flags, - base + cg->common.cfg0, -ffs (cg->enable) -1 ,0 ,NULL ); -if (IS_ERR (hw)) -return PTR_ERR (hw); + ret =devm_clk_hw_register (dev, &cg->gate.hw); +if (ret) +return ret; - priv->hws[cg->common.clkid] = hw; + priv->hws[cg->clkid] = &cg->gate.hw; }if (plat_data == &th1520_ap_platdata) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 22/371 clk: thead: th1520-ap: fix parent of padctrl0 clock
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Icenowy Zheng <[email protected]>
[ Upstream commit 9e99b992c8874f323091d50a5e4727bbd138192d ]
The padctrl0 clock seems to be a child of the perisys_apb4_hclk clock, gating the later makes padctrl0 registers stuck too.
Fix this relationship.
--- drivers/clk/thead/clk-th1520-ap.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/clk/thead/clk-th1520-ap.c +5 -1
@@ -798,13 +798,17 @@ static CCU_GATE(CLK_PERISYS_APB3_HCLK, perisys_apb3_hclk, "perisys-apb3-hclk", p 0x150, 11, CLK_IGNORE_UNUSED); static CCU_GATE(CLK_PERISYS_APB4_HCLK, perisys_apb4_hclk, "perisys-apb4-hclk", perisys_ahb_hclk_pd, 0x150, 12, 0); +static const struct clk_parent_data perisys_apb4_hclk_pd[] = { + { .hw = &perisys_apb4_hclk.gate.hw }, +}; + static CCU_GATE(CLK_NPU_AXI, npu_axi_clk, "npu-axi", axi_aclk_pd, 0x1c8, 5, 0); static CCU_GATE(CLK_CPU2VP, cpu2vp_clk, "cpu2vp", axi_aclk_pd, 0x1e0, 13, 0); static CCU_GATE(CLK_EMMC_SDIO, emmc_sdio_clk, "emmc-sdio", emmc_sdio_ref_clk_pd, 0x204, 30, 0); static CCU_GATE(CLK_GMAC1, gmac1_clk, "gmac1", gmac_pll_clk_pd, 0x204, 26, 0); static CCU_GATE(CLK_PADCTRL1, padctrl1_clk, "padctrl1", perisys_apb_pclk_pd, 0x204, 24, 0); static CCU_GATE(CLK_DSMART, dsmart_clk, "dsmart", perisys_apb_pclk_pd, 0x204, 23, 0); -static CCU_GATE(CLK_PADCTRL0, padctrl0_clk, "padctrl0", perisys_apb_pclk_pd, 0x204, 22, 0); +static CCU_GATE(CLK_PADCTRL0, padctrl0_clk, "padctrl0", perisys_apb4_hclk_pd, 0x204, 22, 0); static CCU_GATE(CLK_GMAC_AXI, gmac_axi_clk, "gmac-axi", axi4_cpusys2_aclk_pd, 0x204, 21, 0); static CCU_GATE(CLK_GPIO3, gpio3_clk, "gpio3-clk", peri2sys_apb_pclk_pd, 0x204, 20, 0); static CCU_GATE(CLK_GMAC0, gmac0_clk, "gmac0", gmac_pll_clk_pd, 0x204, 19, 0);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 23/371 clk: thead: Correct parent for DPU pixel clocks
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Wilczynski <[email protected]>
[ Upstream commit c51a37ffea3813374a8f7955abbba6da25357388 ]
The dpu0_pixelclk and dpu1_pixelclk gates were incorrectly parented to the video_pll_clk.
According to the TH1520 TRM, the "dpu0_pixelclk" should be sourced from "DPU0 PLL DIV CLK". In this driver, "DPU0 PLL DIV CLK" corresponds to the dpu0_clk clock, which is a divider whose parent is the dpu0_pll_clk.
This patch corrects the clock hierarchy by reparenting dpu0_pixelclk to dpu0_clk. By symmetry, dpu1_pixelclk is also reparented to its correct source, dpu1_clk.
--- drivers/clk/thead/clk-th1520-ap.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/clk/thead/clk-th1520-ap.c +10 -2
@@ -761,6 +761,10 @@ static struct ccu_div dpu0_clk = { }, }; +static const struct clk_parent_data dpu0_clk_pd[] = { + { .hw = &dpu0_clk.common.hw } +}; +static struct ccu_div dpu1_clk = { .div =TH_CCU_DIV_FLAGS (0 ,8 ,CLK_DIVIDER_ONE_BASED ), .common = {
@@ -773,6 +777,10 @@ static struct ccu_div dpu1_clk = { }, }; +static const struct clk_parent_data dpu1_clk_pd[] = { + { .hw = &dpu1_clk.common.hw } +}; + static CLK_FIXED_FACTOR_HW(emmc_sdio_ref_clk, "emmc-sdio-ref", &video_pll_clk.common.hw, 4, 1, 0);
@@ -853,9 +861,9 @@ static CCU_GATE(CLK_GPU_CORE, gpu_core_clk, "gpu-core-clk", video_pll_clk_pd, static CCU_GATE(CLK_GPU_CFG_ACLK, gpu_cfg_aclk, "gpu-cfg-aclk", video_pll_clk_pd, 0x0, 4, 0); static CCU_GATE(CLK_DPU_PIXELCLK0, dpu0_pixelclk, "dpu0-pixelclk", - video_pll_clk_pd, 0x0, 5, 0); + dpu0_clk_pd, 0x0, 5, 0); static CCU_GATE(CLK_DPU_PIXELCLK1, dpu1_pixelclk, "dpu1-pixelclk", - video_pll_clk_pd, 0x0, 6, 0); + dpu1_clk_pd, 0x0, 6, 0); static CCU_GATE(CLK_DPU_HCLK, dpu_hclk, "dpu-hclk", video_pll_clk_pd, 0x0, 7, 0); static CCU_GATE(CLK_DPU_ACLK, dpu_aclk, "dpu-aclk", video_pll_clk_pd, 0x0,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 24/371 clk: renesas: r9a08g045: Add MSTOP for GPIO
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <[email protected]>
[ Upstream commit f0cb3463d0244765ab66792a88dc5e2152c130e1 ]
The GPIO module also supports MSTOP. Add it in the description of the gpio clock.
--- drivers/clk/renesas/r9a08g045-cpg.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/clk/renesas/r9a08g045-cpg.c +2 -1
@@ -284,7 +284,8 @@ static const struct rzg2l_mod_clk r9a08g045_mod_clks[] = { MSTOP(BUS_MCPU2, BIT(5))),DEF_MOD ("scif5_clk_pck" ,R9A08G045_SCIF5_CLK_PCK ,R9A08G045_CLK_P0 ,0x584 ,5 ,MSTOP (BUS_MCPU3 ,BIT (4 ))), -DEF_MOD ("gpio_hclk" ,R9A08G045_GPIO_HCLK ,R9A08G045_OSCCLK ,0x598 ,0 ,0 ), +DEF_MOD ("gpio_hclk" ,R9A08G045_GPIO_HCLK ,R9A08G045_OSCCLK ,0x598 ,0 , +MSTOP (BUS_PERI_CPU ,BIT (6 ))),DEF_MOD ("adc_adclk" ,R9A08G045_ADC_ADCLK ,R9A08G045_CLK_TSU ,0x5a8 ,0 ,MSTOP (BUS_MCPU2 ,BIT (14 ))), DEF_MOD("adc_pclk", R9A08G045_ADC_PCLK, R9A08G045_CLK_TSU, 0x5a8, 1,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 25/371 perf disasm: Avoid undefined behavior in incrementing NULL
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 78d853512d6f979cf0cc41566e4f6cd82995ff34 ]
Incrementing NULL is undefined behavior and triggers ubsan during the perf annotate test.
Split a compound statement over two lines to avoid this.
--- tools/perf/util/disasm.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
tools/perf/util/disasm.c +5 -2
@@ -390,13 +390,16 @@ static int jump__parse(struct arch *arch, struct ins_operands *ops, struct map_s* skip over possible up to 2 operands to get to address, e.g.: * tbnz w0, #26, ffff0000083cd190 <security_file_permission+0xd0> */ -if (c++ !=NULL ) { +if (c !=NULL ) { + c++; ops->target.addr =strtoull (c,NULL ,16 );if (!ops->target.addr) { c =strchr (c,',' ); c =validate_comma (c, ops); -if (c++ !=NULL ) +if (c !=NULL ) { + c++; ops->target.addr =strtoull (c,NULL ,16 ); + } } }else { ops->target.addr =strtoull (ops->raw,NULL ,16 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 26/371 perf test trace_btf_enum: Skip if permissions are insufficient
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 4bd5bd8dbd41a208fb73afb65bda6f38e2b5a637 ]
Modify test behavior to skip if BPF calls fail with "Operation not permitted".
--- tools/perf/tests/shell/trace_btf_enum.sh | 11 +++++++++++ 1 file changed, 11 insertions(+)
tools/perf/tests/shell/trace_btf_enum.sh +11 -0
@@ -23,6 +23,14 @@ check_vmlinux() { fi } +check_permissions() { + if perf trace -e $syscall $TESTPROG 2>&1 | grep -q "Operation not permitted" + then + echo "trace+enum test [Skipped permissions]" + err=2 + fi +} + trace_landlock() { echo "Tracing syscall ${syscall}"
@@ -56,6 +64,9 @@ trace_non_syscall() { } check_vmlinux +if [ $err = 0 ]; then + check_permissions +fi if [ $err = 0 ]; then trace_landlock
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 27/371 perf evsel: Avoid container_of on a NULL leader
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 2354479026d726954ff86ce82f4b649637319661 ]
An evsel should typically have a leader of itself, however, in tests like 'Sample parsing' a NULL leader may occur and the container_of will return a corrupt pointer.
Avoid this with an explicit NULL test.
--- tools/perf/util/evsel.c | 2 ++ 1 file changed, 2 insertions(+)
tools/perf/util/evsel.c +2 -0
@@ -3935,6 +3935,8 @@ bool evsel__is_hybrid(const struct evsel *evsel)struct evsel *evsel__leader (const struct evsel *evsel) { +if (evsel->core.leader ==NULL ) +return NULL ; return container_of(evsel->core.leader, struct evsel, core); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 28/371 libperf event: Ensure tracing data is multiple of 8 sized
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit b39c915a4f365cce6bdc0e538ed95d31823aea8f ]
Perf's synthetic-events.c will ensure 8-byte alignment of tracing data, writing it after a perf_record_header_tracing_data event.
Add padding to struct perf_record_header_tracing_data to make it 16-byte rather than 12-byte sized.
--- tools/lib/perf/include/perf/event.h | 1 + 1 file changed, 1 insertion(+)
tools/lib/perf/include/perf/event.h +1 -0
@@ -291,6 +291,7 @@ struct perf_record_header_event_type {struct perf_record_header_tracing_data {struct perf_event_header header;__u32 size; +__u32 pad; };#define PERF_RECORD_MISC_BUILD_ID_SIZE (1 << 15)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 29/371 clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 1e50f5c9965252ed6657b8692cd7366784d60616 ]
The devm_clk_hw_get_clk() function doesn't return NULL, it returns error pointers. Update the checking to match.
--- drivers/clk/qcom/common.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/clk/qcom/common.c +2 -2
@@ -277,8 +277,8 @@ static int qcom_cc_icc_register(struct device *dev, icd[i].slave_id = desc->icc_hws[i].slave_id; hws = &desc->clks[desc->icc_hws[i].clk_id]->hw; icd[i].clk =devm_clk_hw_get_clk (dev, hws,"icc" ); -if (!icd[i].clk) -return dev_err_probe (dev, -ENOENT , +if (IS_ERR (icd[i].clk)) +return dev_err_probe (dev,PTR_ERR (icd[i].clk),"(%d) clock entry is null\n" , i); icd[i].name =clk_hw_get_name (hws); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 30/371 clk: qcom: Select the intended config in QCS_DISPCC_615
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Bulwahn <[email protected]>
[ Upstream commit 9524f95c4042545ee8fc3191b9b89c61a1aca6fb ]
Commit 9b47105f5434 ("clk: qcom: dispcc-qcs615: Add QCS615 display clock controller driver") adds the config QCS_DISPCC_615, which selects the non-existing config QCM_GCC_615. Probably, this is just a three-letter abbreviation mix-up here, though. There is a config named QCS_GCC_615, and the related config QCS_CAMCC_615 selects that config.
Fix the typo and use the intended config name in the select command.
--- drivers/clk/qcom/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/qcom/Kconfig +1 -1
@@ -495,7 +495,7 @@ config QCM_DISPCC_2290 config QCS_DISPCC_615 tristate "QCS615 Display Clock Controller" - select QCM_GCC_615 + select QCS_GCC_615 help Support for the display clock controller on Qualcomm Technologies, Inc QCS615 devices.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 31/371 perf parse-events: Handle fake PMUs in CPU terms
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 1a461a62fb422db9cf870a4f184885cc69873b7f ]
The "Parsing of PMU event table metrics with fake PMUs" will test metrics on machines/models that may be missing a PMU, in such a case the fake_pmu should be used to avoid errors.
Metrics that get the cpumask from a different PMU, such as "tsc/cpu=cpu_atom/", also need to be resilient in this test.
The parse_events_state fake_pmu is set when missing PMUs should be ignored.
So that it can be queried, pass it to the config term functions, as well as to get_config_cpu, then ignore failures when fake_pmu is set.
Some minor code refactoring to cut down on the indent and remove some redundant checks.
--- tools/perf/util/parse-events.c | 116 +++++++++++++++++---------------- 1 file changed, 60 insertions(+), 56 deletions(-)
tools/perf/util/parse-events.c +60 -56
@@ -126,7 +126,8 @@ static char *get_config_name(const struct parse_events_terms *head_terms)return get_config_str (head_terms,PARSE_EVENTS__TERM_TYPE_NAME ); } -static struct perf_cpu_map *get_config_cpu (const struct parse_events_terms *head_terms) +static struct perf_cpu_map *get_config_cpu (const struct parse_events_terms *head_terms, +bool fake_pmu) {struct parse_events_term *term;struct perf_cpu_map *cpus =NULL ;
@@ -135,24 +136,33 @@ static struct perf_cpu_map *get_config_cpu(const struct parse_events_terms *headreturn NULL ;list_for_each_entry (term, &head_terms->terms, list) { -if (term->type_term ==PARSE_EVENTS__TERM_TYPE_CPU ) { -struct perf_cpu_map *term_cpus; +struct perf_cpu_map *term_cpus; -if (term->type_val ==PARSE_EVENTS__TERM_TYPE_NUM ) { - term_cpus =perf_cpu_map__new_int (term->val.num); +if (term->type_term !=PARSE_EVENTS__TERM_TYPE_CPU ) +continue ; + +if (term->type_val ==PARSE_EVENTS__TERM_TYPE_NUM ) { + term_cpus =perf_cpu_map__new_int (term->val.num); + }else { +struct perf_pmu *pmu =perf_pmus__find (term->val.str); + +if (pmu) { + term_cpus = pmu->is_core &&perf_cpu_map__is_empty (pmu->cpus) + ?cpu_map__online () + :perf_cpu_map__get (pmu->cpus); }else { -struct perf_pmu *pmu =perf_pmus__find (term->val.str); - -if (pmu &&perf_cpu_map__is_empty (pmu->cpus)) - term_cpus = pmu->is_core ?cpu_map__online () :NULL ; -else if (pmu) - term_cpus =perf_cpu_map__get (pmu->cpus); -else - term_cpus =perf_cpu_map__new (term->val.str); + term_cpus =perf_cpu_map__new (term->val.str); +if (!term_cpus && fake_pmu) { +/* +* Assume the PMU string makes sense on a different +* machine and fake a value with all online CPUs. +*/ + term_cpus =cpu_map__online (); + } } -perf_cpu_map__merge (&cpus, term_cpus); -perf_cpu_map__put (term_cpus); } +perf_cpu_map__merge (&cpus, term_cpus); +perf_cpu_map__put (term_cpus); }return cpus;
@@ -369,13 +379,13 @@ static int parse_aliases(const char *str, const char *const names[][EVSEL__MAX_Atypedef int config_term_func_t (struct perf_event_attr *attr,struct parse_events_term *term, -struct parse_events_error *err); +struct parse_events_state *parse_state);static int config_term_common (struct perf_event_attr *attr,struct parse_events_term *term, -struct parse_events_error *err); +struct parse_events_state *parse_state);static int config_attr (struct perf_event_attr *attr,const struct parse_events_terms *head, -struct parse_events_error *err, +struct parse_events_state *parse_state,config_term_func_t config_term);/**
@@ -471,7 +481,7 @@ int parse_events_add_cache(struct list_head *list, int *idx, const char *name,bool found_supported = false;const char *config_name =get_config_name (parsed_terms);const char *metric_id =get_config_metric_id (parsed_terms); -struct perf_cpu_map *cpus =get_config_cpu (parsed_terms); +struct perf_cpu_map *cpus =get_config_cpu (parsed_terms, parse_state->fake_pmu);int ret =0 ;struct evsel *first_wildcard_match =NULL ;
@@ -514,8 +524,7 @@ int parse_events_add_cache(struct list_head *list, int *idx, const char *name, found_supported = true;if (parsed_terms) { -if (config_attr (&attr, parsed_terms, parse_state->error, - config_term_common)) { +if (config_attr (&attr, parsed_terms, parse_state, config_term_common)) { ret = -EINVAL ; goto out_err; }
@@ -767,8 +776,7 @@ int parse_events_add_breakpoint(struct parse_events_state *parse_state, attr.sample_period =1 ;if (head_config) { -if (config_attr (&attr, head_config, parse_state->error, - config_term_common)) +if (config_attr (&attr, head_config, parse_state, config_term_common))return -EINVAL ;if (get_config_terms (head_config, &config_terms))
@@ -903,12 +911,12 @@ void parse_events__shrink_config_terms(void)static int config_term_common (struct perf_event_attr *attr,struct parse_events_term *term, -struct parse_events_error *err) +struct parse_events_state *parse_state) { -#define CHECK_TYPE_VAL (type) \ -do { \ - if (check_type_val(term, err, PARSE_EVENTS__TERM_TYPE_ ## type)) \ - return -EINVAL; \ +#define CHECK_TYPE_VAL (type) \ +do { \ + if (check_type_val(term, parse_state->error, PARSE_EVENTS__TERM_TYPE_ ## type)) \ + return -EINVAL; \ } while (0)switch (term->type_term) {
@@ -939,7 +947,7 @@ do { \if (strcmp (term->val.str,"no" ) &&parse_branch_str (term->val.str, &attr->branch_sample_type)) { -parse_events_error__handle (err, term->err_val, +parse_events_error__handle (parse_state->error, term->err_val,strdup ("invalid branch sample type" ),NULL );return -EINVAL ;
@@ -948,7 +956,7 @@ do { \case PARSE_EVENTS__TERM_TYPE_TIME :CHECK_TYPE_VAL (NUM );if (term->val.num >1 ) { -parse_events_error__handle (err, term->err_val, +parse_events_error__handle (parse_state->error, term->err_val,strdup ("expected 0 or 1" ),NULL );return -EINVAL ;
@@ -990,7 +998,7 @@ do { \case PARSE_EVENTS__TERM_TYPE_PERCORE :CHECK_TYPE_VAL (NUM );if ((unsigned int )term->val.num >1 ) { -parse_events_error__handle (err, term->err_val, +parse_events_error__handle (parse_state->error, term->err_val,strdup ("expected 0 or 1" ),NULL );return -EINVAL ;
@@ -1005,7 +1013,7 @@ do { \case PARSE_EVENTS__TERM_TYPE_AUX_SAMPLE_SIZE :CHECK_TYPE_VAL (NUM );if (term->val.num >UINT_MAX ) { -parse_events_error__handle (err, term->err_val, +parse_events_error__handle (parse_state->error, term->err_val,strdup ("too big" ),NULL );return -EINVAL ;
@@ -1016,7 +1024,7 @@ do { \if (term->type_val ==PARSE_EVENTS__TERM_TYPE_NUM ) {if (term->val.num >= (u64 )cpu__max_present_cpu ().cpu) { -parse_events_error__handle (err, term->err_val, +parse_events_error__handle (parse_state->error, term->err_val,strdup ("too big" ),/*help=*/ NULL );return -EINVAL ;
@@ -1028,8 +1036,8 @@ do { \break ; map =perf_cpu_map__new (term->val.str); -if (!map) { -parse_events_error__handle (err, term->err_val, +if (!map && !parse_state->fake_pmu) { +parse_events_error__handle (parse_state->error, term->err_val,strdup ("not a valid PMU or CPU number" ),/*help=*/ NULL );return -EINVAL ;
@@ -1042,7 +1050,7 @@ do { \case PARSE_EVENTS__TERM_TYPE_LEGACY_CACHE :case PARSE_EVENTS__TERM_TYPE_HARDWARE :default : -parse_events_error__handle (err, term->err_term, +parse_events_error__handle (parse_state->error, term->err_term,strdup (parse_events__term_type_str (term->type_term)),parse_events_formats_error_string (NULL ));return -EINVAL ;
@@ -1057,7 +1065,7 @@ do { \* if an invalid config term is provided for legacy events * (for example, instructions/badterm/...), which is confusing. */ -if (!config_term_avail (term->type_term, err)) +if (!config_term_avail (term->type_term, parse_state->error))return -EINVAL ;return 0 ;#undef CHECK_TYPE_VAL
@@ -1065,7 +1073,7 @@ do { \static int config_term_pmu (struct perf_event_attr *attr,struct parse_events_term *term, -struct parse_events_error *err) +struct parse_events_state *parse_state) {if (term->type_term ==PARSE_EVENTS__TERM_TYPE_LEGACY_CACHE ) {struct perf_pmu *pmu =perf_pmus__find_by_type (attr->type);
@@ -1074,7 +1082,7 @@ static int config_term_pmu(struct perf_event_attr *attr,char *err_str;if (asprintf (&err_str,"Failed to find PMU for type %d" , attr->type) >=0 ) -parse_events_error__handle (err, term->err_term, +parse_events_error__handle (parse_state->error, term->err_term, err_str,/*help=*/ NULL );return -EINVAL ; }
@@ -1100,7 +1108,7 @@ static int config_term_pmu(struct perf_event_attr *attr,char *err_str;if (asprintf (&err_str,"Failed to find PMU for type %d" , attr->type) >=0 ) -parse_events_error__handle (err, term->err_term, +parse_events_error__handle (parse_state->error, term->err_term, err_str,/*help=*/ NULL );return -EINVAL ; }
@@ -1128,12 +1136,12 @@ static int config_term_pmu(struct perf_event_attr *attr,*/ return 0 ; } -return config_term_common (attr, term, err); +return config_term_common (attr, term, parse_state); }static int config_term_tracepoint (struct perf_event_attr *attr,struct parse_events_term *term, -struct parse_events_error *err) +struct parse_events_state *parse_state) {switch (term->type_term) {case PARSE_EVENTS__TERM_TYPE_CALLGRAPH :
@@ -1147,7 +1155,7 @@ static int config_term_tracepoint(struct perf_event_attr *attr,case PARSE_EVENTS__TERM_TYPE_AUX_OUTPUT :case PARSE_EVENTS__TERM_TYPE_AUX_ACTION :case PARSE_EVENTS__TERM_TYPE_AUX_SAMPLE_SIZE : -return config_term_common (attr, term, err); +return config_term_common (attr, term, parse_state);case PARSE_EVENTS__TERM_TYPE_USER :case PARSE_EVENTS__TERM_TYPE_CONFIG :case PARSE_EVENTS__TERM_TYPE_CONFIG1 :
@@ -1166,12 +1174,10 @@ static int config_term_tracepoint(struct perf_event_attr *attr,case PARSE_EVENTS__TERM_TYPE_HARDWARE :case PARSE_EVENTS__TERM_TYPE_CPU :default : -if (err) { -parse_events_error__handle (err, term->err_term, +parse_events_error__handle (parse_state->error, term->err_term,strdup (parse_events__term_type_str (term->type_term)),strdup ("valid terms: call-graph,stack-size\n" ) ); - }return -EINVAL ; }
@@ -1180,13 +1186,13 @@ static int config_term_tracepoint(struct perf_event_attr *attr,static int config_attr (struct perf_event_attr *attr,const struct parse_events_terms *head, -struct parse_events_error *err, +struct parse_events_state *parse_state,config_term_func_t config_term) {struct parse_events_term *term;list_for_each_entry (term, &head->terms, list) -if (config_term (attr, term, err)) +if (config_term (attr, term, parse_state))return -EINVAL ;return 0 ;
@@ -1378,8 +1384,7 @@ int parse_events_add_tracepoint(struct parse_events_state *parse_state,if (head_config) {struct perf_event_attr attr; -if (config_attr (&attr, head_config, err, - config_term_tracepoint)) +if (config_attr (&attr, head_config, parse_state, config_term_tracepoint))return -EINVAL ; }
@@ -1408,8 +1413,7 @@ static int __parse_events_add_numeric(struct parse_events_state *parse_state, }if (head_config) { -if (config_attr (&attr, head_config, parse_state->error, - config_term_common)) +if (config_attr (&attr, head_config, parse_state, config_term_common))return -EINVAL ;if (get_config_terms (head_config, &config_terms))
@@ -1418,7 +1422,7 @@ static int __parse_events_add_numeric(struct parse_events_state *parse_state, name =get_config_name (head_config); metric_id =get_config_metric_id (head_config); - cpus =get_config_cpu (head_config); + cpus =get_config_cpu (head_config, parse_state->fake_pmu); ret =__add_event (list, &parse_state->idx, &attr,/*init_attr*/ true, name, metric_id, pmu, &config_terms, first_wildcard_match, cpus,/*alternate_hw_config=*/ PERF_COUNT_HW_MAX ) ?0 : -ENOMEM ;
@@ -1531,7 +1535,7 @@ static int parse_events_add_pmu(struct parse_events_state *parse_state,fix_raw (&parsed_terms, pmu);/* Configure attr/terms with a known PMU, this will set hardcoded terms. */ -if (config_attr (&attr, &parsed_terms, parse_state->error, config_term_pmu)) { +if (config_attr (&attr, &parsed_terms, parse_state, config_term_pmu)) {parse_events_terms__exit (&parsed_terms);return -EINVAL ; }
@@ -1555,7 +1559,7 @@ static int parse_events_add_pmu(struct parse_events_state *parse_state,/* Configure attr/terms again if an alias was expanded. */ if (alias_rewrote_terms && -config_attr (&attr, &parsed_terms, parse_state->error, config_term_pmu)) { +config_attr (&attr, &parsed_terms, parse_state, config_term_pmu)) {parse_events_terms__exit (&parsed_terms);return -EINVAL ; }
@@ -1583,7 +1587,7 @@ static int parse_events_add_pmu(struct parse_events_state *parse_state,return -EINVAL ; } - term_cpu =get_config_cpu (&parsed_terms); + term_cpu =get_config_cpu (&parsed_terms, parse_state->fake_pmu); evsel = __add_event(list, &parse_state->idx, &attr, /*init_attr=*/true, get_config_name(&parsed_terms), get_config_metric_id(&parsed_terms), pmu,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 32/371 clk: at91: peripheral: fix return value
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Masney <[email protected]>
[ Upstream commit 47b13635dabc14f1c2fdcaa5468b47ddadbdd1b5 ]
determine_rate() is expected to return an error code, or 0 on success. clk_sam9x5_peripheral_determine_rate() has a branch that returns the parent rate on a certain case. This is the behavior of round_rate(), so let's go ahead and fix this by setting req->rate.
--- drivers/clk/at91/clk-peripheral.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/clk/at91/clk-peripheral.c +5 -2
@@ -279,8 +279,11 @@ static int clk_sam9x5_peripheral_determine_rate(struct clk_hw *hw,long best_diff =LONG_MIN ;u32 shift; -if (periph->id <PERIPHERAL_ID_MIN || !periph->range.max) -return parent_rate; +if (periph->id <PERIPHERAL_ID_MIN || !periph->range.max) { + req->rate = parent_rate; + +return 0 ; + }/* Fist step: check the available dividers. */ for (shift =0 ; shift <=PERIPHERAL_MAX_SHIFT ; shift++) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 33/371 clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuan CHen <[email protected]>
[ Upstream commit cc55fc58fc1b7f405003fd2ecf79e74653461f0b ]
In case of krealloc_array() failure, the current error handling just returns from the function without freeing the original array. Fix this memory leak by freeing the original array.
--- drivers/clk/renesas/renesas-cpg-mssr.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/clk/renesas/renesas-cpg-mssr.c +5 -2
@@ -1082,6 +1082,7 @@ static int __init cpg_mssr_reserved_init(struct cpg_mssr_priv *priv,of_for_each_phandle (&it, rc, node,"clocks" ,"#clock-cells" ,-1 ) {int idx; +unsigned int *new_ids;if (it.node != priv->np)continue ;
@@ -1092,11 +1093,13 @@ static int __init cpg_mssr_reserved_init(struct cpg_mssr_priv *priv,if (args[0 ] !=CPG_MOD )continue ; - ids =krealloc_array (ids, (num +1 ),sizeof (*ids),GFP_KERNEL ); -if (!ids) { + new_ids =krealloc_array (ids, (num +1 ),sizeof (*ids),GFP_KERNEL ); +if (!new_ids) {of_node_put (it.node); +kfree (ids);return -ENOMEM ; } + ids = new_ids;if (priv->reg_layout ==CLK_REG_LAYOUT_RZ_A ) idx =MOD_CLK_PACK_10 (args[1 ]);/* for DEF_MOD_STB() */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 34/371 perf: Completely remove possibility to override MAX_NR_CPUS
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit 6f8fb022ef2c6694e47f6e2f5676eb63be66c208 ]
Commit 21b8732eb447 ("perf tools: Allow overriding MAX_NR_CPUS at compile time") added the capability to override MAX_NR_CPUS. At that time it was necessary to reduce the huge amount of RAM used by static stats variables.
But this has been unnecessary since commit 6a1e2c5c2673 ("perf stat:
Remove a set of shadow stats static variables"), and commit e8399d34d568 ("libperf cpumap: Hide/reduce scope of MAX_NR_CPUS") broke the build in that case because it failed to add the guard around the new definition of MAX_NR_CPUS.
So cleanup things and remove guards completely to officialise it is not necessary anymore to override MAX_NR_CPUS.
--- tools/perf/perf.h | 2 -- tools/perf/util/bpf_skel/kwork_top.bpf.c | 2 -- 2 files changed, 4 deletions(-)
tools/perf/perf.h +0 -2
@@ -2,9 +2,7 @@#ifndef _PERF_PERF_H#define _PERF_PERF_H -#ifndef MAX_NR_CPUS #define MAX_NR_CPUS 4096 -#endif enum perf_affinity { PERF_AFFINITY_SYS = 0,
tools/perf/util/bpf_skel/kwork_top.bpf.c +0 -2
@@ -18,9 +18,7 @@ enum kwork_class_type { };#define MAX_ENTRIES 102400 -#ifndef MAX_NR_CPUS #define MAX_NR_CPUS 4096 -#endif #define PF_KTHREAD 0x00200000#define MAX_COMMAND_LEN 16
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 35/371 perf drm_pmu: Fix fd_dir leaks in for_each_drm_fdinfo_in_dir()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: GuoHan Zhao <[email protected]>
[ Upstream commit baa03483fdf3545f2b223a4ca775e1938d956284 ]
Fix file descriptor leak when callback function returns error. The function was directly returning without closing fdinfo_dir_fd and fd_dir when cb() returned non-zero value.
--- tools/perf/util/drm_pmu.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
tools/perf/util/drm_pmu.c +3 -1
@@ -458,8 +458,10 @@ static int for_each_drm_fdinfo_in_dir(int (*cb)(void *args, int fdinfo_dir_fd, c } ret =cb (args, fdinfo_dir_fd, fd_entry->d_name);if (ret) -return ret; + goto close_fdinfo; } + +close_fdinfo:if (fdinfo_dir_fd !=-1 )close (fdinfo_dir_fd);closedir (fd_dir);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 36/371 perf util: Fix compression checks returning -1 as bool
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yunseong Kim <[email protected]>
[ Upstream commit 43fa1141e2c1af79c91aaa4df03e436c415a6fc3 ]
The lzma_is_compressed and gzip_is_compressed functions are declared to return a "bool" type, but in case of an error (e.g., file open failure), they incorrectly returned -1.
A bool type is a boolean value that is either true or false. Returning -1 for a bool return type can lead to unexpected behavior and may violate strict type-checking in some compilers.
Fix the return value to be false in error cases, ensuring the function adheres to its declared return type improves for preventing potential bugs related to type mismatch.
--- tools/perf/util/lzma.c | 2 +- tools/perf/util/zlib.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
tools/perf/util/lzma.c +1 -1
@@ -120,7 +120,7 @@ bool lzma_is_compressed(const char *input)ssize_t rc;if (fd <0 ) -return -1 ; +return false; rc =read (fd, buf,sizeof (buf));close (fd);
tools/perf/util/zlib.c +1 -1
@@ -88,7 +88,7 @@ bool gzip_is_compressed(const char *input)ssize_t rc;if (fd <0 ) -return -1 ; +return false; rc =read (fd, buf,sizeof (buf));close (fd);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 37/371 rtc: x1205: Fix Xicor X1205 vendor prefix
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Herring (Arm) <[email protected]>
[ Upstream commit 606d19ee37de3a72f1b6e95a4ea544f6f20dbb46 ]
The vendor for the X1205 RTC is not Xircom, but Xicor which was acquired by Intersil. Since the I2C subsystem drops the vendor prefix for driver matching, the vendor prefix hasn't mattered.
--- drivers/rtc/rtc-x1205.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/rtc/rtc-x1205.c +1 -1
@@ -669,7 +669,7 @@ static const struct i2c_device_id x1205_id[] = {MODULE_DEVICE_TABLE (i2c, x1205_id);static const struct of_device_id x1205_dt_ids[] = { - { .compatible ="xircom,x1205" , }, + { .compatible ="xicor,x1205" , }, {}, };MODULE_DEVICE_TABLE (of, x1205_dt_ids);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 38/371 rtc: optee: fix memory leak on driver removal
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Clément Le Goffic <[email protected]>
[ Upstream commit a531350d2fe58f7fc4516e555f22391dee94efd9 ]
Fix a memory leak in case of driver removal.
Free the shared memory used for arguments exchanges between kernel and OP-TEE RTC PTA.
--- drivers/rtc/rtc-optee.c | 1 + 1 file changed, 1 insertion(+)
drivers/rtc/rtc-optee.c +1 -0
@@ -320,6 +320,7 @@ static int optee_rtc_remove(struct device *dev) {struct optee_rtc *priv =dev_get_drvdata (dev); +tee_shm_free (priv->shm);tee_client_close_session (priv->ctx, priv->session_id);tee_client_close_context (priv->ctx);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 39/371 perf arm_spe: Correct setting remote access
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit 039fd0634a0629132432632d7ac9a14915406b5c ]
Set the mem_remote field for a remote access to appropriately represent the event.
--- tools/perf/util/arm-spe.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/util/arm-spe.c +1 -1
@@ -839,7 +839,7 @@ static void arm_spe__synth_memory_level(const struct arm_spe_record *record, }if (record->type &ARM_SPE_REMOTE_ACCESS ) - data_src->mem_lvl |=PERF_MEM_LVL_REM_CCE1 ; + data_src->mem_remote =PERF_MEM_REMOTE_REMOTE ; } static bool arm_spe__synth_ds(struct arm_spe_queue *speq,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 40/371 perf arm_spe: Correct memory level for remote access
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit cb300e3515057fb555983ce47e8acc86a5c69c3c ]
For remote accesses, the data source packet does not contain information about the memory level. To avoid misinformation, set the memory level to NA (Not Available).
--- tools/perf/util/arm-spe.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/perf/util/arm-spe.c +2 -2
@@ -670,8 +670,8 @@ static void arm_spe__synth_data_source_common(const struct arm_spe_record *recor* socket */ case ARM_SPE_COMMON_DS_REMOTE : - data_src->mem_lvl =PERF_MEM_LVL_REM_CCE1 ; - data_src->mem_lvl_num =PERF_MEM_LVLNUM_ANY_CACHE ; + data_src->mem_lvl =PERF_MEM_LVL_NA ; + data_src->mem_lvl_num =PERF_MEM_LVLNUM_NA ; data_src->mem_remote =PERF_MEM_REMOTE_REMOTE ; data_src->mem_snoopx =PERF_MEM_SNOOPX_PEER ;break ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 41/371 perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilkka Koskinen <[email protected]>
[ Upstream commit 97996580da08f06f8b09a86f3384ed9fa7a52e32 ]
Add missing 'h' to l1d_cache_access_prefetces
Also fix a couple of typos and use consistent term in brief descriptions
--- .../arch/arm64/ampere/ampereonex/metrics.json | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
tools/perf/pmu-events/arch/arm64/ampere/ampereonex/metrics.json +5 -5
@@ -113,7 +113,7 @@ { "MetricName": "load_store_spec_rate", "MetricExpr": "LDST_SPEC / INST_SPEC", - "BriefDescription": "The rate of load or store instructions speculatively executed to overall instructions speclatively executed", + "BriefDescription": "The rate of load or store instructions speculatively executed to overall instructions speculatively executed", "MetricGroup": "Operation_Mix", "ScaleUnit": "100percent of operations" },
@@ -132,7 +132,7 @@ { "MetricName": "pc_write_spec_rate", "MetricExpr": "PC_WRITE_SPEC / INST_SPEC", - "BriefDescription": "The rate of software change of the PC speculatively executed to overall instructions speclatively executed", + "BriefDescription": "The rate of software change of the PC speculatively executed to overall instructions speculatively executed", "MetricGroup": "Operation_Mix", "ScaleUnit": "100percent of operations" },
@@ -195,14 +195,14 @@ { "MetricName": "stall_frontend_cache_rate", "MetricExpr": "STALL_FRONTEND_CACHE / CPU_CYCLES", - "BriefDescription": "Proportion of cycles stalled and no ops delivered from frontend and cache miss", + "BriefDescription": "Proportion of cycles stalled and no operations delivered from frontend and cache miss", "MetricGroup": "Stall", "ScaleUnit": "100percent of cycles" }, { "MetricName": "stall_frontend_tlb_rate", "MetricExpr": "STALL_FRONTEND_TLB / CPU_CYCLES", - "BriefDescription": "Proportion of cycles stalled and no ops delivered from frontend and TLB miss", + "BriefDescription": "Proportion of cycles stalled and no operations delivered from frontend and TLB miss", "MetricGroup": "Stall", "ScaleUnit": "100percent of cycles" },
@@ -391,7 +391,7 @@ "ScaleUnit": "100percent of cache acceses" }, { - "MetricName": "l1d_cache_access_prefetces", + "MetricName": "l1d_cache_access_prefetches", "MetricExpr": "L1D_CACHE_PRFM / L1D_CACHE", "BriefDescription": "L1D cache access - prefetch", "MetricGroup": "Cache",
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 42/371 perf test: AMD IBS swfilt skip kernel tests if paranoia is >1
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 2e3501212293c5005873c6ca6bb4f963a7eec442 ]
If not root and the perf_event_paranoid is set >1 swfilt will fail to open the event failing the test. Add check to skip the test in that case.
--- tools/perf/tests/shell/amd-ibs-swfilt.sh | 51 ++++++++++++++++++------ 1 file changed, 38 insertions(+), 13 deletions(-)
tools/perf/tests/shell/amd-ibs-swfilt.sh +38 -13
@@ -1,6 +1,10 @@ #!/bin/bash # AMD IBS software filtering +ParanoidAndNotRoot() { + [ "$(id -u)" != 0 ] && [ "$(cat /proc/sys/kernel/perf_event_paranoid)" -gt $1 ] +} + echo "check availability of IBS swfilt" # check if IBS PMU is available
@@ -16,6 +20,7 @@ if [ ! -f /sys/bus/event_source/devices/ibs_op/format/swfilt ]; then fi echo "run perf record with modifier and swfilt" +err=0 # setting any modifiers should fail perf record -B -e ibs_op//u -o /dev/null true 2> /dev/null
@@ -31,11 +36,17 @@ if [ $? -ne 0 ]; then exit 1 fi -# setting it with swfilt=1 should be fine -perf record -B -e ibs_op/swfilt=1/k -o /dev/null true -if [ $? -ne 0 ]; then - echo "[FAIL] IBS op PMU cannot handle swfilt for exclude_user" - exit 1 +if ! ParanoidAndNotRoot 1 +then + # setting it with swfilt=1 should be fine + perf record -B -e ibs_op/swfilt=1/k -o /dev/null true + if [ $? -ne 0 ]; then + echo "[FAIL] IBS op PMU cannot handle swfilt for exclude_user" + exit 1 + fi +else + echo "[SKIP] not root and perf_event_paranoid too high for exclude_user" + err=2 fi # check ibs_fetch PMU as well
@@ -46,10 +57,16 @@ if [ $? -ne 0 ]; then fi # check system wide recording -perf record -aB --synth=no -e ibs_op/swfilt/k -o /dev/null true -if [ $? -ne 0 ]; then - echo "[FAIL] IBS op PMU cannot handle swfilt in system-wide mode" - exit 1 +if ! ParanoidAndNotRoot 0 +then + perf record -aB --synth=no -e ibs_op/swfilt/k -o /dev/null true + if [ $? -ne 0 ]; then + echo "[FAIL] IBS op PMU cannot handle swfilt in system-wide mode" + exit 1 + fi +else + echo "[SKIP] not root and perf_event_paranoid too high for system-wide/exclude_user" + err=2 fi echo "check number of samples with swfilt"
@@ -60,8 +77,16 @@ if [ ${kernel_sample} -ne 0 ]; then exit 1 fi -user_sample=$(perf record -e ibs_fetch/swfilt/k -o- true | perf script -i- -F misc | grep -c ^U) -if [ ${user_sample} -ne 0 ]; then - echo "[FAIL] unexpected user samples: " ${user_sample} - exit 1 +if ! ParanoidAndNotRoot 1 +then + user_sample=$(perf record -e ibs_fetch/swfilt/k -o- true | perf script -i- -F misc | grep -c ^U) + if [ ${user_sample} -ne 0 ]; then + echo "[FAIL] unexpected user samples: " ${user_sample} + exit 1 + fi +else + echo "[SKIP] not root and perf_event_paranoid too high for exclude_user" + err=2 fi + +exit $err
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 43/371 perf test shell lbr: Avoid failures with perf event paranoia
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 48314d20fe467d6653783cbf5536cb2fcc9bdd7c ]
When not running as root and with higher perf event paranoia values the perf record LBR tests could fail rather than skipping the problematic tests.
Add the sensitivity to the test and confirm it passes with paranoia values from -1 to 2.
Committer testing:
Testing with '$ perf test -vv lbr', i.e. as non root, and then comparing the output shows the mentioned errors before this patch:
acme@x1:~$ grep -m1 "model name" /proc/cpuinfo model name : 13th Gen Intel(R) Core(TM) i7-1365U acme@x1:~$
Before:
132: perf record LBR tests : Skip
After:
132: perf record LBR tests : Ok
--- tools/perf/tests/shell/record_lbr.sh | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-)
tools/perf/tests/shell/record_lbr.sh +20 -6
@@ -4,6 +4,10 @@ set -e +ParanoidAndNotRoot() { + [ "$(id -u)" != 0 ] && [ "$(cat /proc/sys/kernel/perf_event_paranoid)" -gt $1 ] +} + if [ ! -f /sys/bus/event_source/devices/cpu/caps/branches ] && [ ! -f /sys/bus/event_source/devices/cpu_core/caps/branches ] then
@@ -23,6 +27,7 @@ cleanup() { } trap_cleanup() { + echo "Unexpected signal in ${FUNCNAME[1]}" cleanup exit 1 }
@@ -123,8 +128,11 @@ lbr_test "-j ind_call" "any indirect call" 2 lbr_test "-j ind_jmp" "any indirect jump" 100 lbr_test "-j call" "direct calls" 2 lbr_test "-j ind_call,u" "any indirect user call" 100 -lbr_test "-a -b" "system wide any branch" 2 -lbr_test "-a -j any_call" "system wide any call" 2 +if ! ParanoidAndNotRoot 1 +then + lbr_test "-a -b" "system wide any branch" 2 + lbr_test "-a -j any_call" "system wide any call" 2 +fi # Parallel parallel_lbr_test "-b" "parallel any branch" 100 &
@@ -141,10 +149,16 @@ parallel_lbr_test "-j call" "parallel direct calls" 100 & pid6=$! parallel_lbr_test "-j ind_call,u" "parallel any indirect user call" 100 & pid7=$! -parallel_lbr_test "-a -b" "parallel system wide any branch" 100 & -pid8=$! -parallel_lbr_test "-a -j any_call" "parallel system wide any call" 100 & -pid9=$! +if ParanoidAndNotRoot 1 +then + pid8= + pid9= +else + parallel_lbr_test "-a -b" "parallel system wide any branch" 100 & + pid8=$! + parallel_lbr_test "-a -j any_call" "parallel system wide any call" 100 & + pid9=$! +fi for pid in $pid1 $pid2 $pid3 $pid4 $pid5 $pid6 $pid7 $pid8 $pid9 do
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 44/371 perf trace: Fix IS_ERR() vs NULL check bug
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fushuai Wang <[email protected]>
[ Upstream commit b0f4ade163e551d0c470ead7ac57eaf373eec71a ]
The alloc_syscall_stats() function always returns an error pointer (ERR_PTR) on failure.
So replace NULL check with IS_ERR() check after calling alloc_syscall_stats() function.
--- tools/perf/builtin-trace.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/perf/builtin-trace.c +2 -2
@@ -4440,7 +4440,7 @@ static int trace__run(struct trace *trace, int argc, const char **argv)if (trace->summary_mode ==SUMMARY__BY_TOTAL && !trace->summary_bpf) { trace->syscall_stats =alloc_syscall_stats (); -if (trace->syscall_stats ==NULL ) +if (IS_ERR (trace->syscall_stats)) goto out_delete_evlist; }
@@ -4748,7 +4748,7 @@ static int trace__replay(struct trace *trace)if (trace->summary_mode ==SUMMARY__BY_TOTAL ) { trace->syscall_stats =alloc_syscall_stats (); -if (trace->syscall_stats ==NULL ) +if (IS_ERR (trace->syscall_stats)) goto out; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 45/371 perf session: Fix handling when buffer exceeds 2 GiB
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit c17dda8013495d8132c976cbf349be9949d0fbd1 ]
If a user specifies an AUX buffer larger than 2 GiB, the returned size may exceed 0x80000000. Since the err variable is defined as a signed 32-bit integer, such a value overflows and becomes negative.
As a result, the perf record command reports an error:
0x146e8 [0x30]: failed to process type: 71 [Unknown error 183711232]
Change the type of the err variable to a signed 64-bit integer to accommodate large buffer sizes correctly.
--- tools/perf/util/session.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/util/session.c +1 -1
@@ -1402,7 +1402,7 @@ static s64 perf_session__process_user_event(struct perf_session *session,const struct perf_tool *tool = session->tool;struct perf_sample sample;int fd =perf_data__fd (session->data); -int err; +s64 err;perf_sample__init (&sample,/*all=*/ true); if ((event->header.type != PERF_RECORD_COMPRESSED &&
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 46/371 perf test: Dont leak workload gopipe in PERF_RECORD_*
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 48918cacefd226af44373e914e63304927c0e7dc ]
The test starts a workload and then opens events. If the events fail to open, for example because of perf_event_paranoid, the gopipe of the workload is leaked and the file descriptor leak check fails when the test exits. To avoid this cancel the workload when opening the events fails.
Before:
```
$ perf test -vv 7
7: PERF_RECORD_* events & perf_sample fields:
--- start ---
test child forked, pid 1189568
Using CPUID GenuineIntel-6-B7-1
------------------------------------------------------------
perf_event_attr:
type 0 (PERF_TYPE_HARDWARE)
config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/)
disabled 1
------------------------------------------------------------
sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8
sys_perf_event_open failed, error -13
------------------------------------------------------------
perf_event_attr:
type 0 (PERF_TYPE_HARDWARE)
config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/)
disabled 1
exclude_kernel 1
------------------------------------------------------------
sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3
------------------------------------------------------------
perf_event_attr:
type 0 (PERF_TYPE_HARDWARE)
config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/)
disabled 1
------------------------------------------------------------
sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8
sys_perf_event_open failed, error -13
------------------------------------------------------------
perf_event_attr:
type 0 (PERF_TYPE_HARDWARE)
config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/)
disabled 1
exclude_kernel 1
------------------------------------------------------------
sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3
Attempt to add: software/cpu-clock/
..after resolving event: software/config=0/
cpu-clock -> software/cpu-clock/
------------------------------------------------------------
perf_event_attr:
type 1 (PERF_TYPE_SOFTWARE)
size 136
config 0x9 (PERF_COUNT_SW_DUMMY)
sample_type IP|TID|TIME|CPU
read_format ID|LOST
disabled 1
inherit 1
mmap 1
comm 1
enable_on_exec 1
task 1
sample_id_all 1
mmap2 1
comm_exec 1
ksymbol 1
bpf_event 1
{ wakeup_events, wakeup_watermark } 1
------------------------------------------------------------
sys_perf_event_open: pid 1189569 cpu 0 group_fd -1 flags 0x8
sys_perf_event_open failed, error -13
perf_evlist__open: Permission denied
---- end(-2) ----
Leak of file descriptor 6 that opened: 'pipe:[14200347]'
---- unexpected signal (6) ----
iFailed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
#0 0x565358f6666e in child_test_sig_handler builtin-test.c:311
#1 0x7f29ce849df0 in __restore_rt libc_sigaction.c:0
#2 0x7f29ce89e95c in __pthread_kill_implementation pthread_kill.c:44
#3 0x7f29ce849cc2 in raise raise.c:27
#4 0x7f29ce8324ac in abort abort.c:81
#5 0x565358f662d4 in check_leaks builtin-test.c:226
#6 0x565358f6682e in run_test_child builtin-test.c:344
#7 0x565358ef7121 in start_command run-command.c:128
#8 0x565358f67273 in start_test builtin-test.c:545
#9 0x565358f6771d in __cmd_test builtin-test.c:647
#10 0x565358f682bd in cmd_test builtin-test.c:849
#11 0x565358ee5ded in run_builtin perf.c:349
#12 0x565358ee6085 in handle_internal_command perf.c:401
#13 0x565358ee61de in run_argv perf.c:448
#14 0x565358ee6527 in main perf.c:555
#15 0x7f29ce833ca8 in __libc_start_call_main libc_start_call_main.h:74
#16 0x7f29ce833d65 in __libc_start_main@@GLIBC_2.34 libc-start.c:128
#17 0x565358e391c1 in _start perf[851c1]
7: PERF_RECORD_* events & perf_sample fields : FAILED!
```After:
``` $ perf test 7 7: PERF_RECORD_* events & perf_sample fields : Skip (permissions) ```
--- tools/perf/tests/perf-record.c | 4 ++++ 1 file changed, 4 insertions(+)
tools/perf/tests/perf-record.c +4 -0
@@ -115,6 +115,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtestif (err <0 ) {pr_debug ("sched__get_first_possible_cpu: %s\n" ,str_error_r (errno, sbuf,sizeof (sbuf))); +evlist__cancel_workload (evlist); goto out_delete_evlist; }
@@ -126,6 +127,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtestif (sched_setaffinity (evlist->workload.pid, cpu_mask_size, &cpu_mask) <0 ) {pr_debug ("sched_setaffinity: %s\n" ,str_error_r (errno, sbuf,sizeof (sbuf))); +evlist__cancel_workload (evlist); goto out_delete_evlist; }
@@ -137,6 +139,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtestif (err <0 ) {pr_debug ("perf_evlist__open: %s\n" ,str_error_r (errno, sbuf,sizeof (sbuf))); +evlist__cancel_workload (evlist); goto out_delete_evlist; }
@@ -149,6 +152,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtestif (err <0 ) {pr_debug ("evlist__mmap: %s\n" ,str_error_r (errno, sbuf,sizeof (sbuf))); +evlist__cancel_workload (evlist); goto out_delete_evlist; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 47/371 perf evsel: Fix uniquification when PMU given without suffix
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 693101792e45eefc888c7ba10b91108047399f5d ]
The PMU name is appearing twice in:
```
$ perf stat -e uncore_imc_free_running/data_total/ -A true
Performance counter stats for 'system wide':
CPU0 1.57 MiB uncore_imc_free_running_0/uncore_imc_free_running,data_total/
CPU0 1.58 MiB uncore_imc_free_running_1/uncore_imc_free_running,data_total/
0.000892376 seconds time elapsed
```Use the pmu_name_len_no_suffix to avoid this problem.
Committer testing:
After this patch:
root@x1:~# perf stat -e uncore_imc_free_running/data_total/ -A true
Performance counter stats for 'system wide':
CPU0 1.69 MiB uncore_imc_free_running_0/data_total/ CPU0 1.68 MiB uncore_imc_free_running_1/data_total/
0.002141605 seconds time elapsed
root@x1:~#
--- tools/perf/util/evsel.c | 28 ++++++++++++++++++---------- 1 file changed, 18 insertions(+), 10 deletions(-)
tools/perf/util/evsel.c +18 -10
@@ -4050,9 +4050,9 @@ bool evsel__set_needs_uniquify(struct evsel *counter, const struct perf_stat_convoid evsel__uniquify_counter (struct evsel *counter) { -const char *name, *pmu_name; -char *new_name, *config; -int ret; +const char *name, *pmu_name, *config; +char *new_name; +int len, ret;/* No uniquification necessary. */ if (!counter->needs_uniquify)
@@ -4066,15 +4066,23 @@ void evsel__uniquify_counter(struct evsel *counter) counter->uniquified_name = true; name =evsel__name (counter); + config =strchr (name,'/' ); pmu_name = counter->pmu->name; -/* Already prefixed by the PMU name. */ -if (!strncmp (name, pmu_name,strlen (pmu_name))) -return ; - config =strchr (name,'/' ); -if (config) { -int len = config - name; +/* Already prefixed by the PMU name? */ + len =pmu_name_len_no_suffix (pmu_name); + +if (!strncmp (name, pmu_name, len)) { +/* +* If the PMU name is there, then there is no sense in not +* having a slash. Do this for robustness. +*/ +if (config ==NULL ) + config = name -1 ; + ret =asprintf (&new_name,"%s/%s" , pmu_name, config +1 ); + }else if (config) { + len = config - name;if (config[1 ] =='/' ) {/* case: event// */ ret =asprintf (&new_name,"%s/%.*s/%s" , pmu_name, len, name, config +2 );
@@ -4086,7 +4094,7 @@ void evsel__uniquify_counter(struct evsel *counter) config =strchr (name,':' );if (config) {/* case: event:.. */ -int len = config - name; + len = config - name; ret =asprintf (&new_name,"%s/%.*s/%s" , pmu_name, len, name, config +1 ); }else {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 48/371 perf test: Avoid uncore_imc/clockticks in uniquification test
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit edaeb4bcf1511fe4e464fff9dd4a3abf6b0096da ]
The detection of uncore_imc may happen for free running PMUs and the clockticks event may be present on uncore_clock. Rewrite the test to detect duplicated/deduplicated events from perf list, not hardcoded to uncore_imc.
If perf stat fails then assume it is permissions and skip the test.
Committer testing:
Before:
root@x1:~# perf test -vv uniquifyi 96: perf stat events uniquifying: --- start --- test child forked, pid 220851 stat event uniquifying test grep: Unmatched [, [^, [:, [., or [= Event is not uniquified [Failed] perf stat -e clockticks -A -o /tmp/__perf_test.stat_output.X7ChD -- true # started on Fri Sep 19 16:48:38 2025
Performance counter stats for 'system wide':
CPU0 2,310,956 uncore_clock/clockticks/
0.001746771 seconds time elapsed
---- end(-1) ----
96: perf stat events uniquifying : FAILED!
root@x1:~#
After:
root@x1:~# perf test -vv uniquifyi 96: perf stat events uniquifying: --- start --- test child forked, pid 222366 Uniquification of PMU sysfs events test Testing event uncore_imc_free_running/data_read/ is uniquified to uncore_imc_free_running_0/data_read/ Testing event uncore_imc_free_running/data_total/ is uniquified to uncore_imc_free_running_0/data_total/ Testing event uncore_imc_free_running/data_write/ is uniquified to uncore_imc_free_running_0/data_write/ Testing event uncore_imc_free_running/data_read/ is uniquified to uncore_imc_free_running_1/data_read/ Testing event uncore_imc_free_running/data_total/ is uniquified to uncore_imc_free_running_1/data_total/ Testing event uncore_imc_free_running/data_write/ is uniquified to uncore_imc_free_running_1/data_write/ ---- end(0) ---- 96: perf stat events uniquifying : Ok root@x1:~#
--- .../tests/shell/stat+event_uniquifying.sh | 109 ++++++++---------- 1 file changed, 49 insertions(+), 60 deletions(-)
tools/perf/tests/shell/stat+event_uniquifying.sh +49 -60
@@ -4,74 +4,63 @@ set -e -stat_output=$(mktemp /tmp/__perf_test.stat_output.XXXXX) -perf_tool=perf err=0 +stat_output=$(mktemp /tmp/__perf_test.stat_output.XXXXX) -test_event_uniquifying() { - # We use `clockticks` in `uncore_imc` to verify the uniquify behavior. - pmu="uncore_imc" - event="clockticks" - - # If the `-A` option is added, the event should be uniquified. - # - # $perf list -v clockticks - # - # List of pre-defined events (to be used in -e or -M): - # - # uncore_imc_0/clockticks/ [Kernel PMU event] - # uncore_imc_1/clockticks/ [Kernel PMU event] - # uncore_imc_2/clockticks/ [Kernel PMU event] - # uncore_imc_3/clockticks/ [Kernel PMU event] - # uncore_imc_4/clockticks/ [Kernel PMU event] - # uncore_imc_5/clockticks/ [Kernel PMU event] - # - # ... - # - # $perf stat -e clockticks -A -- true - # - # Performance counter stats for 'system wide': - # - # CPU0 3,773,018 uncore_imc_0/clockticks/ - # CPU0 3,609,025 uncore_imc_1/clockticks/ - # CPU0 0 uncore_imc_2/clockticks/ - # CPU0 3,230,009 uncore_imc_3/clockticks/ - # CPU0 3,049,897 uncore_imc_4/clockticks/ - # CPU0 0 uncore_imc_5/clockticks/ - # - # 0.002029828 seconds time elapsed - - echo "stat event uniquifying test" - uniquified_event_array=() +cleanup() { + rm -f "${stat_output}" - # Skip if the machine does not have `uncore_imc` device. - if ! ${perf_tool} list pmu | grep -q ${pmu}; then - echo "Target does not support PMU ${pmu} [Skipped]" - err=2 - return - fi + trap - EXIT TERM INT +} - # Check how many uniquified events. - while IFS= read -r line; do - uniquified_event=$(echo "$line" | awk '{print $1}') - uniquified_event_array+=("${uniquified_event}") - done < <(${perf_tool} list -v ${event} | grep ${pmu}) +trap_cleanup() { + echo "Unexpected signal in ${FUNCNAME[1]}" + cleanup + exit 1 +} +trap trap_cleanup EXIT TERM INT - perf_command="${perf_tool} stat -e $event -A -o ${stat_output} -- true" - $perf_command +test_event_uniquifying() { + echo "Uniquification of PMU sysfs events test" - # Check the output contains all uniquified events. - for uniquified_event in "${uniquified_event_array[@]}"; do - if ! cat "${stat_output}" | grep -q "${uniquified_event}"; then - echo "Event is not uniquified [Failed]" - echo "${perf_command}" - cat "${stat_output}" - err=1 - break - fi + # Read events from perf list with and without -v. With -v the duplicate PMUs + # aren't deduplicated. Note, json events are listed by perf list without a + # PMU. + read -ra pmu_events <<< "$(perf list --raw pmu)" + read -ra pmu_v_events <<< "$(perf list -v --raw pmu)" + # For all non-deduplicated events. + for pmu_v_event in "${pmu_v_events[@]}"; do + # If the event matches an event in the deduplicated events then it musn't + # be an event with duplicate PMUs, continue the outer loop. + for pmu_event in "${pmu_events[@]}"; do + if [[ "$pmu_v_event" == "$pmu_event" ]]; then + continue 2 + fi + done + # Strip the suffix from the non-deduplicated event's PMU. + event=$(echo "$pmu_v_event" | sed -E 's/_[0-9]+//') + for pmu_event in "${pmu_events[@]}"; do + if [[ "$event" == "$pmu_event" ]]; then + echo "Testing event ${event} is uniquified to ${pmu_v_event}" + if ! perf stat -e "$event" -A -o ${stat_output} -- true; then + echo "Error running perf stat for event '$event' [Skip]" + if [ $err = 0 ]; then + err=2 + fi + continue + fi + # Ensure the non-deduplicated event appears in the output. + if ! grep -q "${pmu_v_event}" "${stat_output}"; then + echo "Uniquification of PMU sysfs events test [Failed]" + cat "${stat_output}" + err=1 + fi + break + fi + done done } test_event_uniquifying -rm -f "${stat_output}" +cleanup exit $err
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 49/371 perf evsel: Ensure the fallback message is always written to
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 24937ee839e4bbc097acde73eeed67812bad2d99 ]
The fallback message is unconditionally printed in places like record__open().
If no fallback is attempted this can lead to printing uninitialized data, crashes, etc.
--- tools/perf/util/evsel.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
tools/perf/util/evsel.c +7 -5
@@ -3562,7 +3562,7 @@ bool evsel__fallback(struct evsel *evsel, struct target *target, int err,/* If event has exclude user then don't exclude kernel. */ if (evsel->core.attr.exclude_user) -return false; + goto no_fallback;/* Is there already the separator in the name. */ if (strchr(name, '/') ||
@@ -3570,7 +3570,7 @@ bool evsel__fallback(struct evsel *evsel, struct target *target, int err, sep ="" ;if (asprintf (&new_name,"%s%su" , name, sep) <0 ) -return false; + goto no_fallback;free (evsel->name); evsel->name = new_name;
@@ -3593,17 +3593,19 @@ bool evsel__fallback(struct evsel *evsel, struct target *target, int err, sep ="" ;if (asprintf (&new_name,"%s%sH" , name, sep) <0 ) -return false; + goto no_fallback;free (evsel->name); evsel->name = new_name;/* Apple M1 requires exclude_guest */ -scnprintf (msg, msgsize,"trying to fall back to excluding guest samples" ); +scnprintf (msg, msgsize,"Trying to fall back to excluding guest samples" ); evsel->core.attr.exclude_guest =1 ;return true; } - +no_fallback: +scnprintf (msg, msgsize,"No fallback found for '%s' for error %d" , +evsel__name (evsel), err);return false; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 50/371 perf build-id: Ensure snprintf string is empty when size is 0
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 0dc96cae063cbf9ebf6631b33b08e9ba02324248 ]
The string result of build_id__snprintf() is unconditionally used in places like dsos__fprintf_buildid_cb(). If the build id has size 0 then this creates a use of uninitialized memory. Add null termination for the size 0 case.
A similar fix was written by Jiri Olsa in commit 6311951d4f8f28c4 ("perf
tools: Initialize output buffer in build_id__sprintf") but lost in the transition to snprintf.
--- tools/perf/util/build-id.c | 7 +++++++ 1 file changed, 7 insertions(+)
tools/perf/util/build-id.c +7 -0
@@ -86,6 +86,13 @@ int build_id__snprintf(const struct build_id *build_id, char *bf, size_t bf_size {size_t offs =0 ; +if (build_id->size ==0 ) { +/* Ensure bf is always \0 terminated. */ +if (bf_size >0 ) + bf[0 ] ='\0' ; +return 0 ; + } +for (size_t i =0 ; i < build_id->size && offs < bf_size; ++i) offs +=snprintf (bf + offs, bf_size - offs,"%02x" , build_id->data[i]);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 51/371 clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <[email protected]>
[ Upstream commit 6c4c26b624790098988c1034541087e3e5ed5bed ]
The infrastructure gate for the HDMI specific crystal needs the top_hdmi_xtal clock to be configured in order to ungate the 26m clock to the HDMI IP, and it wouldn't work without.
Reparent the infra_ao_hdmi_26m clock to top_hdmi_xtal to fix that.
--- drivers/clk/mediatek/clk-mt8195-infra_ao.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/mediatek/clk-mt8195-infra_ao.c +1 -1
@@ -103,7 +103,7 @@ static const struct mtk_gate infra_ao_clks[] = {GATE_INFRA_AO0 (CLK_INFRA_AO_CQ_DMA_FPC ,"infra_ao_cq_dma_fpc" ,"fpc" ,28 ),GATE_INFRA_AO0 (CLK_INFRA_AO_UART5 ,"infra_ao_uart5" ,"top_uart" ,29 ),/* INFRA_AO1 */ -GATE_INFRA_AO1 (CLK_INFRA_AO_HDMI_26M ,"infra_ao_hdmi_26m" ,"clk26m" ,0 ), +GATE_INFRA_AO1 (CLK_INFRA_AO_HDMI_26M ,"infra_ao_hdmi_26m" ,"top_hdmi_xtal" ,0 ),GATE_INFRA_AO1 (CLK_INFRA_AO_SPI0 ,"infra_ao_spi0" ,"top_spi" ,1 ),GATE_INFRA_AO1 (CLK_INFRA_AO_MSDC0 ,"infra_ao_msdc0" ,"top_msdc50_0_hclk" ,2 ), GATE_INFRA_AO1(CLK_INFRA_AO_MSDC1, "infra_ao_msdc1", "top_axi", 4),
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 52/371 clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <[email protected]>
[ Upstream commit 5e121370a7ad3414c7f3a77002e2b18abe5c6fe1 ]
The flags in |struct mtk_mux| are core clk flags, not mux clk flags. Passing one to the other is wrong.
Since there aren't any actual users adding CLK_MUX_* flags, just drop it for now.
--- drivers/clk/mediatek/clk-mux.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/clk/mediatek/clk-mux.c +1 -3
@@ -146,9 +146,7 @@ static int mtk_clk_mux_set_parent_setclr_lock(struct clk_hw *hw, u8 index)static int mtk_clk_mux_determine_rate (struct clk_hw *hw,struct clk_rate_request *req) { -struct mtk_clk_mux *mux =to_mtk_clk_mux (hw); - -return clk_mux_determine_rate_flags (hw, req, mux->data->flags); +return clk_mux_determine_rate_flags (hw, req,0 ); }const struct clk_ops mtk_mux_clr_set_upd_ops = {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 53/371 clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Masney <[email protected]>
[ Upstream commit b46a3d323a5b7942e65025254c13801d0f475f02 ]
The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series.
Stable-dep-of: 1624dead9a4d ("clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver")
--- drivers/clk/nxp/clk-lpc18xx-cgu.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
drivers/clk/nxp/clk-lpc18xx-cgu.c +9 -7
@@ -370,23 +370,25 @@ static unsigned long lpc18xx_pll0_recalc_rate(struct clk_hw *hw,return 0 ; } -static long lpc18xx_pll0_round_rate (struct clk_hw *hw,unsigned long rate, -unsigned long *prate) +static int lpc18xx_pll0_determine_rate (struct clk_hw *hw, +struct clk_rate_request *req) {unsigned long m; -if (*prate < rate) { +if (req->best_parent_rate < req->rate) {pr_warn ("%s: pll dividers not supported\n" , __func__);return -EINVAL ; } - m =DIV_ROUND_UP_ULL (*prate, rate *2 ); + m =DIV_ROUND_UP_ULL (req->best_parent_rate, req->rate *2 );if (m <=0 && m >LPC18XX_PLL0_MSEL_MAX ) { -pr_warn ("%s: unable to support rate %lu\n" , __func__, rate); +pr_warn ("%s: unable to support rate %lu\n" , __func__, req->rate);return -EINVAL ; } -return 2 * *prate * m; + req->rate =2 * req->best_parent_rate * m; + +return 0 ; } static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate,
@@ -443,7 +445,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate,static const struct clk_ops lpc18xx_pll0_ops = { .recalc_rate = lpc18xx_pll0_recalc_rate, - .round_rate = lpc18xx_pll0_round_rate, + .determine_rate = lpc18xx_pll0_determine_rate, .set_rate = lpc18xx_pll0_set_rate, };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 54/371 clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit 1624dead9a4d288a594fdf19735ebfe4bb567cb8 ]
The conditional check for the PLL0 multiplier 'm' used a logical AND instead of OR, making the range check ineffective. This patch replaces && with || to correctly reject invalid values of 'm' that are either less than or equal to 0 or greater than LPC18XX_PLL0_MSEL_MAX.
This ensures proper bounds checking during clk rate setting and rounding.
--- drivers/clk/nxp/clk-lpc18xx-cgu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/clk/nxp/clk-lpc18xx-cgu.c +2 -2
@@ -381,7 +381,7 @@ static int lpc18xx_pll0_determine_rate(struct clk_hw *hw, } m =DIV_ROUND_UP_ULL (req->best_parent_rate, req->rate *2 ); -if (m <=0 && m >LPC18XX_PLL0_MSEL_MAX ) { +if (m ==0 || m >LPC18XX_PLL0_MSEL_MAX ) {pr_warn ("%s: unable to support rate %lu\n" , __func__, req->rate);return -EINVAL ; }
@@ -404,7 +404,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate, } m =DIV_ROUND_UP_ULL (parent_rate, rate *2 ); -if (m <=0 && m >LPC18XX_PLL0_MSEL_MAX ) { +if (m ==0 || m >LPC18XX_PLL0_MSEL_MAX ) {pr_warn ("%s: unable to support rate %lu\n" , __func__, rate);return -EINVAL ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 55/371 clk: tegra: do not overallocate memory for bpmp clocks
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <[email protected]>
[ Upstream commit 49ef6491106209c595476fc122c3922dfd03253f ]
struct tegra_bpmp::clocks is a pointer to a dynamically allocated array of pointers to 'struct tegra_bpmp_clk'.
But the size of the allocated area is calculated like it is an array containing actual 'struct tegra_bpmp_clk' objects - it's not true, there are just pointers.
Found by Linux Verification Center (linuxtesting.org) with Svace static analysis tool.
--- drivers/clk/tegra/clk-bpmp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/tegra/clk-bpmp.c +1 -1
@@ -635,7 +635,7 @@ static int tegra_bpmp_register_clocks(struct tegra_bpmp *bpmp, bpmp->num_clocks = count; - bpmp->clocks =devm_kcalloc (bpmp->dev, count,sizeof (struct tegra_bpmp_clk ),GFP_KERNEL ); + bpmp->clocks =devm_kcalloc (bpmp->dev, count,sizeof (*bpmp->clocks),GFP_KERNEL );if (!bpmp->clocks)return -ENOMEM ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 56/371 nfsd: fix assignment of ia_ctime.tv_nsec on delegated mtime update
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <[email protected]>
[ Upstream commit 2990b5a47984c27873d165de9e88099deee95c8d ]
The ia_ctime.tv_nsec field should be set to modify.nseconds.
--- fs/nfsd/nfs4xdr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfsd/nfs4xdr.c +1 -1
@@ -538,7 +538,7 @@ nfsd4_decode_fattr4(struct nfsd4_compoundargs *argp, u32 *bmval, u32 bmlen, iattr->ia_mtime.tv_sec = modify.seconds; iattr->ia_mtime.tv_nsec = modify.nseconds; iattr->ia_ctime.tv_sec = modify.seconds; - iattr->ia_ctime.tv_nsec = modify.seconds; + iattr->ia_ctime.tv_nsec = modify.nseconds; iattr->ia_valid |=ATTR_CTIME |ATTR_MTIME |ATTR_MTIME_SET |ATTR_DELEG ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 57/371 nfsd: ignore ATTR_DELEG when checking ia_valid before notify_change()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <[email protected]>
[ Upstream commit 5affb498e70bba3053b835c478a199bf92c99c4d ]
If the only flag left is ATTR_DELEG, then there are no changes to be made.
--- fs/nfsd/vfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfsd/vfs.c +1 -1
@@ -467,7 +467,7 @@ static int __nfsd_setattr(struct dentry *dentry, struct iattr *iap)return 0 ; } -if (!iap->ia_valid) +if ((iap->ia_valid & ~ATTR_DELEG ) ==0 )return 0 ;/*
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 58/371 vfs: add ATTR_CTIME_SET flag
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <[email protected]>
[ Upstream commit afc5b36e29b95fbd31a60b9630d148857e5e513d ]
When ATTR_ATIME_SET and ATTR_MTIME_SET are set in the ia_valid mask, the notify_change() logic takes that to mean that the request should set those values explicitly, and not override them with "now".
With the advent of delegated timestamps, similar functionality is needed for the ctime. Add a ATTR_CTIME_SET flag, and use that to indicate that the ctime should be accepted as-is. Also, clean up the if statements to eliminate the extra negatives.
In setattr_copy() and setattr_copy_mgtime() use inode_set_ctime_deleg() when ATTR_CTIME_SET is set, instead of basing the decision on ATTR_DELEG.
Stable-dep-of: c066ff58e5d6 ("nfsd: use ATTR_CTIME_SET for delegated ctime updates")
--- fs/attr.c | 44 +++++++++++++++++++------------------------- include/linux/fs.h | 1 + 2 files changed, 20 insertions(+), 25 deletions(-)
fs/attr.c +19 -25
@@ -286,20 +286,12 @@ static void setattr_copy_mgtime(struct inode *inode, const struct iattr *attr)unsigned int ia_valid = attr->ia_valid;struct timespec64 now; -if (ia_valid &ATTR_CTIME ) { -/* -* In the case of an update for a write delegation, we must respect -* the value in ia_ctime and not use the current time. -*/ -if (ia_valid &ATTR_DELEG ) - now =inode_set_ctime_deleg (inode, attr->ia_ctime); -else - now =inode_set_ctime_current (inode); - }else { -/* If ATTR_CTIME isn't set, then ATTR_MTIME shouldn't be either. */ -WARN_ON_ONCE (ia_valid &ATTR_MTIME ); +if (ia_valid &ATTR_CTIME_SET ) + now =inode_set_ctime_deleg (inode, attr->ia_ctime); +else if (ia_valid &ATTR_CTIME ) + now =inode_set_ctime_current (inode); +else now =current_time (inode); - }if (ia_valid &ATTR_ATIME_SET )inode_set_atime_to_ts (inode, attr->ia_atime);
@@ -359,12 +351,11 @@ void setattr_copy(struct mnt_idmap *idmap, struct inode *inode,inode_set_atime_to_ts (inode, attr->ia_atime);if (ia_valid &ATTR_MTIME )inode_set_mtime_to_ts (inode, attr->ia_mtime); -if (ia_valid &ATTR_CTIME ) { -if (ia_valid &ATTR_DELEG ) -inode_set_ctime_deleg (inode, attr->ia_ctime); -else -inode_set_ctime_to_ts (inode, attr->ia_ctime); - } + +if (ia_valid &ATTR_CTIME_SET ) +inode_set_ctime_deleg (inode, attr->ia_ctime); +else if (ia_valid &ATTR_CTIME ) +inode_set_ctime_to_ts (inode, attr->ia_ctime); }EXPORT_SYMBOL (setattr_copy);
@@ -463,15 +454,18 @@ int notify_change(struct mnt_idmap *idmap, struct dentry *dentry, now =current_time (inode); - attr->ia_ctime = now; -if (!(ia_valid &ATTR_ATIME_SET )) - attr->ia_atime = now; -else +if (ia_valid &ATTR_ATIME_SET ) attr->ia_atime =timestamp_truncate (attr->ia_atime, inode); -if (!(ia_valid &ATTR_MTIME_SET )) - attr->ia_mtime = now;else + attr->ia_atime = now; +if (ia_valid &ATTR_CTIME_SET ) + attr->ia_ctime =timestamp_truncate (attr->ia_ctime, inode); +else + attr->ia_ctime = now; +if (ia_valid &ATTR_MTIME_SET ) attr->ia_mtime =timestamp_truncate (attr->ia_mtime, inode); +else + attr->ia_mtime = now;if (ia_valid &ATTR_KILL_PRIV ) { error =security_inode_need_killpriv (dentry);
include/linux/fs.h +1 -0
@@ -238,6 +238,7 @@ typedef int (dio_iodone_t)(struct kiocb *iocb, loff_t offset,#define ATTR_ATIME_SET (1 << 7)#define ATTR_MTIME_SET (1 << 8)#define ATTR_FORCE (1 << 9)/* Not a change, but a change it */ +#define ATTR_CTIME_SET (1 << 10)#define ATTR_KILL_SUID (1 << 11)#define ATTR_KILL_SGID (1 << 12)#define ATTR_FILE (1 << 13)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 59/371 nfsd: use ATTR_CTIME_SET for delegated ctime updates
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <[email protected]>
[ Upstream commit c066ff58e5d6e5d7400e5fda0c33f95b8c37dd02 ]
Ensure that notify_change() doesn't clobber a delegated ctime update with current_time() by setting ATTR_CTIME_SET for those updates.
Don't bother setting the timestamps in cb_getattr_update_times() in the non-delegated case. notify_change() will do that itself.
--- fs/nfsd/nfs4state.c | 6 +++--- fs/nfsd/nfs4xdr.c | 3 ++- 2 files changed, 5 insertions(+), 4 deletions(-)
fs/nfsd/nfs4state.c +3 -3
@@ -9167,7 +9167,6 @@ static bool set_cb_time(struct timespec64 *cb, const struct timespec64 *orig,static int cb_getattr_update_times (struct dentry *dentry,struct nfs4_delegation *dp) {struct inode *inode =d_inode (dentry); -struct timespec64 now =current_time (inode);struct nfs4_cb_fattr *ncf = &dp->dl_cb_fattr;struct iattr attrs = { };int ret;
@@ -9175,6 +9174,7 @@ static int cb_getattr_update_times(struct dentry *dentry, struct nfs4_delegationif (deleg_attrs_deleg (dp->dl_type)) {struct timespec64 atime =inode_get_atime (inode);struct timespec64 mtime =inode_get_mtime (inode); +struct timespec64 now =current_time (inode); attrs.ia_atime = ncf->ncf_cb_atime; attrs.ia_mtime = ncf->ncf_cb_mtime;
@@ -9183,12 +9183,12 @@ static int cb_getattr_update_times(struct dentry *dentry, struct nfs4_delegation attrs.ia_valid |=ATTR_ATIME |ATTR_ATIME_SET ;if (set_cb_time (&attrs.ia_mtime, &mtime, &now)) { - attrs.ia_valid |=ATTR_CTIME |ATTR_MTIME |ATTR_MTIME_SET ; + attrs.ia_valid |=ATTR_CTIME |ATTR_CTIME_SET | +ATTR_MTIME |ATTR_MTIME_SET ; attrs.ia_ctime = attrs.ia_mtime; } }else { attrs.ia_valid |=ATTR_MTIME |ATTR_CTIME ; - attrs.ia_mtime = attrs.ia_ctime = now; }if (!attrs.ia_valid)
fs/nfsd/nfs4xdr.c +2 -1
@@ -539,7 +539,8 @@ nfsd4_decode_fattr4(struct nfsd4_compoundargs *argp, u32 *bmval, u32 bmlen, iattr->ia_mtime.tv_nsec = modify.nseconds; iattr->ia_ctime.tv_sec = modify.seconds; iattr->ia_ctime.tv_nsec = modify.nseconds; - iattr->ia_valid |=ATTR_CTIME |ATTR_MTIME |ATTR_MTIME_SET |ATTR_DELEG ; + iattr->ia_valid |=ATTR_CTIME |ATTR_CTIME_SET | +ATTR_MTIME |ATTR_MTIME_SET |ATTR_DELEG ; }/* request sanity: did attrlist4 contain the expected number of words? */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 60/371 nfsd: track original timestamps in nfs4_delegation
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <[email protected]>
[ Upstream commit 7663e963a51122792811811c8119fd55c9ab254a ]
As Trond points out [1], the "original time" mentioned in RFC 9754 refers to the timestamps on the files at the time that the delegation was granted, and not the current timestamp of the file on the server.
Store the current timestamps for the file in the nfs4_delegation when granting one. Add STATX_ATIME and STATX_MTIME to the request mask in nfs4_delegation_stat(). When granting OPEN_DELEGATE_READ_ATTRS_DELEG, do a nfs4_delegation_stat() and save the correct atime. If the stat() fails for any reason, fall back to granting a normal read deleg.
[1]: https://lore.kernel.org/linux-nfs/[email protected]/
--- fs/nfsd/nfs4state.c | 11 ++++++++--- fs/nfsd/state.h | 5 +++++ 2 files changed, 13 insertions(+), 3 deletions(-)
fs/nfsd/nfs4state.c +8 -3
@@ -6157,7 +6157,8 @@ nfs4_delegation_stat(struct nfs4_delegation *dp, struct svc_fh *currentfh, path.dentry =file_dentry (nf->nf_file); rc =vfs_getattr (&path, stat, - (STATX_MODE |STATX_SIZE |STATX_CTIME |STATX_CHANGE_COOKIE ), +STATX_MODE |STATX_SIZE |STATX_ATIME | +STATX_MTIME |STATX_CTIME |STATX_CHANGE_COOKIE ,AT_STATX_SYNC_AS_STAT );nfsd_file_put (nf);
@@ -6274,10 +6275,14 @@ nfs4_open_delegation(struct svc_rqst *rqstp, struct nfsd4_open *open,OPEN_DELEGATE_WRITE ; dp->dl_cb_fattr.ncf_cur_fsize = stat.size; dp->dl_cb_fattr.ncf_initial_cinfo =nfsd4_change_attribute (&stat); + dp->dl_atime = stat.atime; + dp->dl_ctime = stat.ctime; + dp->dl_mtime = stat.mtime;trace_nfsd_deleg_write (&dp->dl_stid.sc_stateid); }else { - open->op_delegate_type = deleg_ts ?OPEN_DELEGATE_READ_ATTRS_DELEG : -OPEN_DELEGATE_READ ; + open->op_delegate_type = deleg_ts &&nfs4_delegation_stat (dp, currentfh, &stat) ? +OPEN_DELEGATE_READ_ATTRS_DELEG :OPEN_DELEGATE_READ ; + dp->dl_atime = stat.atime;trace_nfsd_deleg_read (&dp->dl_stid.sc_stateid); }nfs4_put_stid (&dp->dl_stid);
fs/nfsd/state.h +5 -0
@@ -224,6 +224,11 @@ struct nfs4_delegation {/* for CB_GETATTR */ struct nfs4_cb_fattr dl_cb_fattr; + +/* For delegated timestamps */ +struct timespec64 dl_atime; +struct timespec64 dl_mtime; +struct timespec64 dl_ctime; };static inline bool deleg_is_read (u32 dl_type)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 61/371 nfsd: fix SETATTR updates for delegated timestamps
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <[email protected]>
[ Upstream commit 3952f1cbcbc454b2cb639ddbf165c07068e90371 ]
SETATTRs containing delegated timestamp updates are currently not being vetted properly. Since we no longer need to compare the timestamps vs. the current timestamps, move the vetting of delegated timestamps wholly into nfsd.
Rename the set_cb_time() helper to nfsd4_vet_deleg_time(), and make it non-static. Add a new vet_deleg_attrs() helper that is called from nfsd4_setattr that uses nfsd4_vet_deleg_time() to properly validate the all the timestamps. If the validation indicates that the update should be skipped, unset the appropriate flags in ia_valid.
--- fs/nfsd/nfs4proc.c | 31 ++++++++++++++++++++++++++++++- fs/nfsd/nfs4state.c | 24 +++++++++++------------- fs/nfsd/state.h | 3 +++ 3 files changed, 44 insertions(+), 14 deletions(-)
fs/nfsd/nfs4proc.c +30 -1
@@ -1133,6 +1133,33 @@ nfsd4_secinfo_no_name_release(union nfsd4_op_u *u)exp_put (u->secinfo_no_name.sin_exp); } +/* +* Validate that the requested timestamps are within the acceptable range. If +* timestamp appears to be in the future, then it will be clamped to +* current_time(). +*/ +static void +vet_deleg_attrs (struct nfsd4_setattr *setattr,struct nfs4_delegation *dp) +{ +struct timespec64 now =current_time (dp->dl_stid.sc_file->fi_inode); +struct iattr *iattr = &setattr->sa_iattr; + +if ((setattr->sa_bmval[2 ] &FATTR4_WORD2_TIME_DELEG_ACCESS ) && + !nfsd4_vet_deleg_time (&iattr->ia_atime, &dp->dl_atime, &now)) + iattr->ia_valid &= ~(ATTR_ATIME |ATTR_ATIME_SET ); + +if (setattr->sa_bmval[2 ] &FATTR4_WORD2_TIME_DELEG_MODIFY ) { +if (nfsd4_vet_deleg_time (&iattr->ia_mtime, &dp->dl_mtime, &now)) { + iattr->ia_ctime = iattr->ia_mtime; +if (!nfsd4_vet_deleg_time (&iattr->ia_ctime, &dp->dl_ctime, &now)) + iattr->ia_valid &= ~(ATTR_CTIME |ATTR_CTIME_SET ); + }else { + iattr->ia_valid &= ~(ATTR_CTIME |ATTR_CTIME_SET | +ATTR_MTIME |ATTR_MTIME_SET ); + } + } +} +static __be32 nfsd4_setattr (struct svc_rqst *rqstp,struct nfsd4_compound_state *cstate,union nfsd4_op_u *u)
@@ -1170,8 +1197,10 @@ nfsd4_setattr(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,struct nfs4_delegation *dp =delegstateid (st);/* Only for *_ATTRS_DELEG flavors */ -if (deleg_attrs_deleg (dp->dl_type)) +if (deleg_attrs_deleg (dp->dl_type)) { +vet_deleg_attrs (setattr, dp); status = nfs_ok; + } } }if (st)
fs/nfsd/nfs4state.c +11 -13
@@ -9135,25 +9135,25 @@ nfsd4_get_writestateid(struct nfsd4_compound_state *cstate, }/** -* set_cb_time - vet and set the timespec for a cb_getattr update -* @cb: timestamp from the CB_GETATTR response +* nfsd4_vet_deleg_time - vet and set the timespec for a delegated timestamp update +* @req: timestamp from the client * @orig: original timestamp in the inode * @now: current time * -* Given a timestamp in a CB_GETATTR response, check it against the +* Given a timestamp from the client response, check it against the * current timestamp in the inode and the current time. Returns true * if the inode's timestamp needs to be updated, and false otherwise. -* @cb may also be changed if the timestamp needs to be clamped. +* @req may also be changed if the timestamp needs to be clamped. */ -static bool set_cb_time (struct timespec64 *cb,const struct timespec64 *orig, -const struct timespec64 *now) +bool nfsd4_vet_deleg_time (struct timespec64 *req,const struct timespec64 *orig, +const struct timespec64 *now) {/* * "When the time presented is before the original time, then the * update is ignored." Also no need to update if there is no change. */ -if (timespec64_compare (cb, orig) <=0 ) +if (timespec64_compare (req, orig) <=0 )return false;/*
@@ -9161,10 +9161,8 @@ static bool set_cb_time(struct timespec64 *cb, const struct timespec64 *orig,* clamp the new time to the current time, or it may * return NFS4ERR_DELAY to the client, allowing it to retry." */ -if (timespec64_compare (cb, now) >0 ) { -/* clamp it */ - *cb = *now; - } +if (timespec64_compare (req, now) >0 ) + *req = *now;return true; }
@@ -9184,10 +9182,10 @@ static int cb_getattr_update_times(struct dentry *dentry, struct nfs4_delegation attrs.ia_atime = ncf->ncf_cb_atime; attrs.ia_mtime = ncf->ncf_cb_mtime; -if (set_cb_time (&attrs.ia_atime, &atime, &now)) +if (nfsd4_vet_deleg_time (&attrs.ia_atime, &atime, &now)) attrs.ia_valid |=ATTR_ATIME |ATTR_ATIME_SET ; -if (set_cb_time (&attrs.ia_mtime, &mtime, &now)) { +if (nfsd4_vet_deleg_time (&attrs.ia_mtime, &mtime, &now)) { attrs.ia_valid |=ATTR_CTIME |ATTR_CTIME_SET |ATTR_MTIME |ATTR_MTIME_SET ; attrs.ia_ctime = attrs.ia_mtime;
fs/nfsd/state.h +3 -0
@@ -247,6 +247,9 @@ static inline bool deleg_attrs_deleg(u32 dl_type) dl_type ==OPEN_DELEGATE_WRITE_ATTRS_DELEG ; } +bool nfsd4_vet_deleg_time (struct timespec64 *cb,const struct timespec64 *orig, +const struct timespec64 *now); +#define cb_to_delegation (cb) \ container_of(cb, struct nfs4_delegation, dl_recall)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 62/371 nfsd: fix timestamp updates in CB_GETATTR
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <[email protected]>
[ Upstream commit b40b1ba37ad5b6099c426765c4bc327c08b390b9 ]
When updating the local timestamps from CB_GETATTR, the updated values are not being properly vetted.
Compare the update times vs. the saved times in the delegation rather than the current times in the inode. Also, ensure that the ctime is properly vetted vs. its original value.
--- fs/nfsd/nfs4state.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)
fs/nfsd/nfs4state.c +5 -6
@@ -9175,20 +9175,19 @@ static int cb_getattr_update_times(struct dentry *dentry, struct nfs4_delegationint ret;if (deleg_attrs_deleg (dp->dl_type)) { -struct timespec64 atime =inode_get_atime (inode); -struct timespec64 mtime =inode_get_mtime (inode);struct timespec64 now =current_time (inode); attrs.ia_atime = ncf->ncf_cb_atime; attrs.ia_mtime = ncf->ncf_cb_mtime; -if (nfsd4_vet_deleg_time (&attrs.ia_atime, &atime, &now)) +if (nfsd4_vet_deleg_time (&attrs.ia_atime, &dp->dl_atime, &now)) attrs.ia_valid |=ATTR_ATIME |ATTR_ATIME_SET ; -if (nfsd4_vet_deleg_time (&attrs.ia_mtime, &mtime, &now)) { - attrs.ia_valid |=ATTR_CTIME |ATTR_CTIME_SET | -ATTR_MTIME |ATTR_MTIME_SET ; +if (nfsd4_vet_deleg_time (&attrs.ia_mtime, &dp->dl_mtime, &now)) { + attrs.ia_valid |=ATTR_MTIME |ATTR_MTIME_SET ; attrs.ia_ctime = attrs.ia_mtime; +if (nfsd4_vet_deleg_time (&attrs.ia_ctime, &dp->dl_ctime, &now)) + attrs.ia_valid |=ATTR_CTIME |ATTR_CTIME_SET ; } }else { attrs.ia_valid |=ATTR_MTIME |ATTR_CTIME ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 63/371 tracing: Fix the bug where bpf_get_stackid returns -EFAULT on the ARM64
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Feng Yang <[email protected]>
[ Upstream commit fd2f74f8f3d3c1a524637caf5bead9757fae4332 ]
When using bpf_program__attach_kprobe_multi_opts on ARM64 to hook a BPF program that contains the bpf_get_stackid function, the BPF program fails to obtain the stack trace and returns -EFAULT.
This is because ftrace_partial_regs omits the configuration of the pstate register, leaving pstate at the default value of 0. When get_perf_callchain executes, it uses user_mode(regs) to determine whether it is in kernel mode. This leads to a misjudgment that the code is in user mode,
so perf_callchain_kernel is not executed and the function returns directly. As a result, trace->nr becomes 0, and finally -EFAULT is returned.
Therefore, the assignment of the pstate register is added here.
--- arch/arm64/include/asm/ftrace.h | 1 + 1 file changed, 1 insertion(+)
arch/arm64/include/asm/ftrace.h +1 -0
@@ -153,6 +153,7 @@ ftrace_partial_regs(const struct ftrace_regs *fregs, struct pt_regs *regs) regs->pc = afregs->pc; regs->regs[29 ] = afregs->fp; regs->regs[30 ] = afregs->lr; + regs->pstate = PSR_MODE_EL1h;return regs; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 64/371 PM: core: Annotate loops walking device links as _srcu
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit fdd9ae23bb989fa9ed1beebba7d3e0c82c7c81ae ]
Since SRCU is used for the protection of device link lists, the loops over device link lists in multiple places in drivers/base/power/main.c and in pm_runtime_get_suppliers() should be annotated as _srcu rather than as _rcu which is the case currently.
Change the annotations accordingly.
Stable-dep-of: 632d31067be2 ("PM: sleep: Do not wait on SYNC_STATE_ONLY device links")
--- drivers/base/power/main.c | 18 +++++++++--------- drivers/base/power/runtime.c | 4 ++-- 2 files changed, 11 insertions(+), 11 deletions(-)
drivers/base/power/main.c +9 -9
@@ -40,8 +40,8 @@typedef int (*pm_callback_t )(struct device *); -#define list_for_each_entry_rcu_locked (pos, head, member) \ - list_for_each_entry_rcu(pos, head, member, \ +#define list_for_each_entry_srcu_locked (pos, head, member) \ + list_for_each_entry_srcu(pos, head, member, \ device_links_read_lock_held())/*
@@ -281,7 +281,7 @@ static void dpm_wait_for_suppliers(struct device *dev, bool async)* callbacks freeing the link objects for the links in the list we're * walking. */ -list_for_each_entry_rcu_locked (link, &dev->links.suppliers, c_node) +list_for_each_entry_srcu_locked (link, &dev->links.suppliers, c_node)if (READ_ONCE (link->status) !=DL_STATE_DORMANT )dpm_wait (link->supplier, async);
@@ -338,7 +338,7 @@ static void dpm_wait_for_consumers(struct device *dev, bool async)* continue instead of trying to continue in parallel with its * unregistration). */ -list_for_each_entry_rcu_locked (link, &dev->links.consumers, s_node) +list_for_each_entry_srcu_locked (link, &dev->links.consumers, s_node)if (READ_ONCE (link->status) !=DL_STATE_DORMANT )dpm_wait (link->consumer, async);
@@ -675,7 +675,7 @@ static void dpm_async_resume_subordinate(struct device *dev, async_func_t func) idx =device_links_read_lock ();/* Start processing the device's "async" consumers. */ -list_for_each_entry_rcu_locked (link, &dev->links.consumers, s_node) +list_for_each_entry_srcu_locked (link, &dev->links.consumers, s_node)if (READ_ONCE (link->status) !=DL_STATE_DORMANT )dpm_async_with_cleanup (link->consumer, func);
@@ -1342,7 +1342,7 @@ static void dpm_async_suspend_superior(struct device *dev, async_func_t func) idx =device_links_read_lock ();/* Start processing the device's "async" suppliers. */ -list_for_each_entry_rcu_locked (link, &dev->links.suppliers, c_node) +list_for_each_entry_srcu_locked (link, &dev->links.suppliers, c_node)if (READ_ONCE (link->status) !=DL_STATE_DORMANT )dpm_async_with_cleanup (link->supplier, func);
@@ -1396,7 +1396,7 @@ static void dpm_superior_set_must_resume(struct device *dev) idx =device_links_read_lock (); -list_for_each_entry_rcu_locked (link, &dev->links.suppliers, c_node) +list_for_each_entry_srcu_locked (link, &dev->links.suppliers, c_node) link->supplier->power.must_resume = true;device_links_read_unlock (idx);
@@ -1825,7 +1825,7 @@ static void dpm_clear_superiors_direct_complete(struct device *dev) idx =device_links_read_lock (); -list_for_each_entry_rcu_locked (link, &dev->links.suppliers, c_node) { +list_for_each_entry_srcu_locked (link, &dev->links.suppliers, c_node) {spin_lock_irq (&link->supplier->power.lock); link->supplier->power.direct_complete = false;spin_unlock_irq (&link->supplier->power.lock);
@@ -2077,7 +2077,7 @@ static bool device_prepare_smart_suspend(struct device *dev) idx =device_links_read_lock (); -list_for_each_entry_rcu_locked (link, &dev->links.suppliers, c_node) { +list_for_each_entry_srcu_locked (link, &dev->links.suppliers, c_node) {if (!device_link_test (link,DL_FLAG_PM_RUNTIME ))continue ;
drivers/base/power/runtime.c +2 -2
@@ -1903,8 +1903,8 @@ void pm_runtime_get_suppliers(struct device *dev) idx =device_links_read_lock (); -list_for_each_entry_rcu (link, &dev->links.suppliers, c_node, -device_links_read_lock_held ()) +list_for_each_entry_srcu (link, &dev->links.suppliers, c_node, +device_links_read_lock_held ())if (device_link_test (link,DL_FLAG_PM_RUNTIME )) { link->supplier_preactivated = true;pm_runtime_get_sync (link->supplier);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 65/371 PM: core: Add two macros for walking device links
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit 3ce3f569991347d2085925041f4932232da43bcf ]
Add separate macros for walking links to suppliers and consumers of a device to help device links users to avoid exposing the internals of struct dev_links_info in their code and possible coding mistakes related to that.
Accordingly, use the new macros to replace open-coded device links list walks in the core power management code.
No intentional functional impact.
Stable-dep-of: 632d31067be2 ("PM: sleep: Do not wait on SYNC_STATE_ONLY device links")
--- drivers/base/base.h | 8 ++++++++ drivers/base/power/main.c | 18 +++++++----------- drivers/base/power/runtime.c | 3 +-- 3 files changed, 16 insertions(+), 13 deletions(-)
drivers/base/base.h +8 -0
@@ -251,6 +251,14 @@ void device_links_unbind_consumers(struct device *dev);void fw_devlink_drivers_done (void );void fw_devlink_probing_done (void ); +#define dev_for_each_link_to_supplier (__link, __dev) \ + list_for_each_entry_srcu(__link, &(__dev)->links.suppliers, c_node, \ + device_links_read_lock_held()) + +#define dev_for_each_link_to_consumer (__link, __dev) \ + list_for_each_entry_srcu(__link, &(__dev)->links.consumers, s_node, \ + device_links_read_lock_held()) +/* device pm support */ void device_pm_move_to_tail (struct device *dev);
drivers/base/power/main.c +7 -11
@@ -40,10 +40,6 @@typedef int (*pm_callback_t )(struct device *); -#define list_for_each_entry_srcu_locked (pos, head, member) \ - list_for_each_entry_srcu(pos, head, member, \ - device_links_read_lock_held()) -/* * The entries in the dpm_list list are in a depth first order, simply * because children are guaranteed to be discovered after parents, and
@@ -281,7 +277,7 @@ static void dpm_wait_for_suppliers(struct device *dev, bool async)* callbacks freeing the link objects for the links in the list we're * walking. */ -list_for_each_entry_srcu_locked (link, &dev->links.suppliers, c_node) +dev_for_each_link_to_supplier (link, dev)if (READ_ONCE (link->status) !=DL_STATE_DORMANT )dpm_wait (link->supplier, async);
@@ -338,7 +334,7 @@ static void dpm_wait_for_consumers(struct device *dev, bool async)* continue instead of trying to continue in parallel with its * unregistration). */ -list_for_each_entry_srcu_locked (link, &dev->links.consumers, s_node) +dev_for_each_link_to_consumer (link, dev)if (READ_ONCE (link->status) !=DL_STATE_DORMANT )dpm_wait (link->consumer, async);
@@ -675,7 +671,7 @@ static void dpm_async_resume_subordinate(struct device *dev, async_func_t func) idx =device_links_read_lock ();/* Start processing the device's "async" consumers. */ -list_for_each_entry_srcu_locked (link, &dev->links.consumers, s_node) +dev_for_each_link_to_consumer (link, dev)if (READ_ONCE (link->status) !=DL_STATE_DORMANT )dpm_async_with_cleanup (link->consumer, func);
@@ -1342,7 +1338,7 @@ static void dpm_async_suspend_superior(struct device *dev, async_func_t func) idx =device_links_read_lock ();/* Start processing the device's "async" suppliers. */ -list_for_each_entry_srcu_locked (link, &dev->links.suppliers, c_node) +dev_for_each_link_to_supplier (link, dev)if (READ_ONCE (link->status) !=DL_STATE_DORMANT )dpm_async_with_cleanup (link->supplier, func);
@@ -1396,7 +1392,7 @@ static void dpm_superior_set_must_resume(struct device *dev) idx =device_links_read_lock (); -list_for_each_entry_srcu_locked (link, &dev->links.suppliers, c_node) +dev_for_each_link_to_supplier (link, dev) link->supplier->power.must_resume = true;device_links_read_unlock (idx);
@@ -1825,7 +1821,7 @@ static void dpm_clear_superiors_direct_complete(struct device *dev) idx =device_links_read_lock (); -list_for_each_entry_srcu_locked (link, &dev->links.suppliers, c_node) { +dev_for_each_link_to_supplier (link, dev) {spin_lock_irq (&link->supplier->power.lock); link->supplier->power.direct_complete = false;spin_unlock_irq (&link->supplier->power.lock);
@@ -2077,7 +2073,7 @@ static bool device_prepare_smart_suspend(struct device *dev) idx =device_links_read_lock (); -list_for_each_entry_srcu_locked (link, &dev->links.suppliers, c_node) { +dev_for_each_link_to_supplier (link, dev) {if (!device_link_test (link,DL_FLAG_PM_RUNTIME ))continue ;
drivers/base/power/runtime.c +1 -2
@@ -1903,8 +1903,7 @@ void pm_runtime_get_suppliers(struct device *dev) idx =device_links_read_lock (); -list_for_each_entry_srcu (link, &dev->links.suppliers, c_node, -device_links_read_lock_held ()) +dev_for_each_link_to_supplier (link, dev)if (device_link_test (link,DL_FLAG_PM_RUNTIME )) { link->supplier_preactivated = true;pm_runtime_get_sync (link->supplier);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 66/371 PM: sleep: Do not wait on SYNC_STATE_ONLY device links
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pin-yen Lin <[email protected]>
[ Upstream commit 632d31067be2f414c57955efcf29c79290cc749b ]
Device links with DL_FLAG_SYNC_STATE_ONLY should not affect system suspend and resume, and functions like device_reorder_to_tail() and device_link_add() don't try to reorder the consumers with that flag.
However, dpm_wait_for_consumers() and dpm_wait_for_suppliers() don't check thas flag before triggering dpm_wait(), leading to potential hang during suspend/resume.
This can be reproduced on MT8186 Corsola Chromebook with devicetree like:
usb-a-connector {
compatible = "usb-a-connector";
port {
usb_a_con: endpoint {
remote-endpoint = <&usb_hs>;
};
};
};usb_host {
compatible = "mediatek,mt8186-xhci", "mediatek,mtk-xhci";
port {
usb_hs: endpoint {
remote-endpoint = <&usb_a_con>;
};
};
};In this case, the two nodes form a cycle and a SYNC_STATE_ONLY devlink between usb_host (supplier) and usb-a-connector (consumer) is created.
Address this by exporting device_link_flag_is_sync_state_only() and making dpm_wait_for_consumers() and dpm_wait_for_suppliers() use it when deciding if dpm_wait() should be called.
--- drivers/base/base.h | 1 + drivers/base/core.c | 2 +- drivers/base/power/main.c | 6 ++++-- 3 files changed, 6 insertions(+), 3 deletions(-)
drivers/base/base.h +1 -0
@@ -248,6 +248,7 @@ void device_links_driver_cleanup(struct device *dev);void device_links_no_driver (struct device *dev);bool device_links_busy (struct device *dev);void device_links_unbind_consumers (struct device *dev); +bool device_link_flag_is_sync_state_only (u32 flags);void fw_devlink_drivers_done (void );void fw_devlink_probing_done (void );
drivers/base/core.c +1 -1
@@ -287,7 +287,7 @@ static bool device_is_ancestor(struct device *dev, struct device *target)#define DL_MARKER_FLAGS (DL_FLAG_INFERRED | \ DL_FLAG_CYCLE | \ DL_FLAG_MANAGED) -static inline bool device_link_flag_is_sync_state_only (u32 flags) +bool device_link_flag_is_sync_state_only (u32 flags) {return (flags & ~DL_MARKER_FLAGS ) ==DL_FLAG_SYNC_STATE_ONLY ; }
drivers/base/power/main.c +4 -2
@@ -278,7 +278,8 @@ static void dpm_wait_for_suppliers(struct device *dev, bool async)* walking. */ dev_for_each_link_to_supplier (link, dev) -if (READ_ONCE (link->status) !=DL_STATE_DORMANT ) +if (READ_ONCE (link->status) !=DL_STATE_DORMANT && + !device_link_flag_is_sync_state_only (link->flags))dpm_wait (link->supplier, async);device_links_read_unlock (idx);
@@ -335,7 +336,8 @@ static void dpm_wait_for_consumers(struct device *dev, bool async)* unregistration). */ dev_for_each_link_to_consumer (link, dev) -if (READ_ONCE (link->status) !=DL_STATE_DORMANT ) +if (READ_ONCE (link->status) !=DL_STATE_DORMANT && + !device_link_flag_is_sync_state_only (link->flags))dpm_wait (link->consumer, async);device_links_read_unlock (idx);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 67/371 cpufreq: tegra186: Set target frequency for all cpus in policy
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaron Kling <[email protected]>
[ Upstream commit 0b1bb980fd7cae126ee3d59f817068a13e321b07 ]
The original commit set all cores in a cluster to a shared policy, but did not update set_target to apply a frequency change to all cores for the policy. This caused most cores to remain stuck at their boot frequency.
--- drivers/cpufreq/tegra186-cpufreq.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/cpufreq/tegra186-cpufreq.c +6 -2
@@ -93,10 +93,14 @@ static int tegra186_cpufreq_set_target(struct cpufreq_policy *policy, {struct tegra186_cpufreq_data *data =cpufreq_get_driver_data ();struct cpufreq_frequency_table *tbl = policy->freq_table + index; -unsigned int edvd_offset = data->cpus[policy->cpu].edvd_offset; +unsigned int edvd_offset;u32 edvd_val = tbl->driver_data; +u32 cpu; -writel (edvd_val, data->regs + edvd_offset); +for_each_cpu (cpu, policy->cpus) { + edvd_offset = data->cpus[cpu].edvd_offset; +writel (edvd_val, data->regs + edvd_offset); + }return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 68/371 scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Duoming Zhou <[email protected]>
[ Upstream commit 60cd16a3b7439ccb699d0bf533799eeb894fd217 ]
During the detaching of Marvell's SAS/SATA controller, the original code calls cancel_delayed_work() in mvs_free() to cancel the delayed work item mwq->work_q. However, if mwq->work_q is already running, the cancel_delayed_work() may fail to cancel it. This can lead to use-after-free scenarios where mvs_free() frees the mvs_info while mvs_work_queue() is still executing and attempts to access the already-freed mvs_info.
A typical race condition is illustrated below:
CPU 0 (remove) | CPU 1 (delayed work callback)
mvs_pci_remove() |
mvs_free() | mvs_work_queue()
cancel_delayed_work() |
kfree(mvi) |
| mvi-> // UAFReplace cancel_delayed_work() with cancel_delayed_work_sync() to ensure that the delayed work item is properly canceled and any executing delayed work item completes before the mvs_info is deallocated.
This bug was found by static analysis.
--- drivers/scsi/mvsas/mv_init.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/mvsas/mv_init.c +1 -1
@@ -124,7 +124,7 @@ static void mvs_free(struct mvs_info *mvi)if (mvi->shost)scsi_host_put (mvi->shost);list_for_each_entry (mwq, &mvi->wq_list, entry) -cancel_delayed_work (&mwq->work_q); +cancel_delayed_work_sync (&mwq->work_q);kfree (mvi->rsvd_tags);kfree (mvi); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 69/371 perf bpf-filter: Fix opts declaration on older libbpfs
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 3a0f56d72a7575f03187a85b7869c76a862b40ab ]
Building perf with LIBBPF_DYNAMIC (ie not the default static linking of libbpf with perf) is breaking as the libbpf isn't version 1.7 or newer, where dont_enable is added to bpf_perf_event_opts.
To avoid this breakage add a compile time version check and don't declare the variable when not present.
--- tools/perf/util/bpf-filter.c | 8 ++++++++ 1 file changed, 8 insertions(+)
tools/perf/util/bpf-filter.c +8 -0
@@ -443,6 +443,10 @@ static int create_idx_hash(struct evsel *evsel, struct perf_bpf_filter_entry *enreturn -1 ; } +#define LIBBPF_CURRENT_VERSION_GEQ (major, minor) \ + (LIBBPF_MAJOR_VERSION > (major) || \ + (LIBBPF_MAJOR_VERSION == (major) && LIBBPF_MINOR_VERSION >= (minor))) +int perf_bpf_filter__prepare (struct evsel *evsel,struct target *target) {int i, x, y, fd, ret;
@@ -451,8 +455,12 @@ int perf_bpf_filter__prepare(struct evsel *evsel, struct target *target)struct bpf_link *link;struct perf_bpf_filter_entry *entry;bool needs_idx_hash = !target__has_cpu (target); +#if LIBBPF_CURRENT_VERSION_GEQ (1 ,7 )DECLARE_LIBBPF_OPTS (bpf_perf_event_opts, pe_opts, .dont_enable = true); +#else +DECLARE_LIBBPF_OPTS (bpf_perf_event_opts, pe_opts); +#endif entry =calloc (MAX_FILTERS ,sizeof (*entry));if (entry ==NULL )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 70/371 scsi: ufs: sysfs: Make HID attributes visible
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Lee <[email protected]>
[ Upstream commit bb7663dec67b691528f104894429b3859fb16c14 ]
Call sysfs_update_group() after reading the device descriptor to ensure the HID sysfs attributes are visible when the feature is supported.
--- drivers/ufs/core/ufs-sysfs.c | 2 +- drivers/ufs/core/ufs-sysfs.h | 1 + drivers/ufs/core/ufshcd.c | 2 ++ 3 files changed, 4 insertions(+), 1 deletion(-)
drivers/ufs/core/ufs-sysfs.c +1 -1
@@ -1949,7 +1949,7 @@ static umode_t ufs_sysfs_hid_is_visible(struct kobject *kobj,return hba->dev_info.hid_sup ? attr->mode :0 ; } -static const struct attribute_group ufs_sysfs_hid_group = { +const struct attribute_group ufs_sysfs_hid_group = { .name ="hid" , .attrs = ufs_sysfs_hid, .is_visible = ufs_sysfs_hid_is_visible,
drivers/ufs/core/ufs-sysfs.h +1 -0
@@ -14,5 +14,6 @@ void ufs_sysfs_remove_nodes(struct device *dev);extern const struct attribute_group ufs_sysfs_unit_descriptor_group;extern const struct attribute_group ufs_sysfs_lun_attributes_group; +extern const struct attribute_group ufs_sysfs_hid_group;#endif
drivers/ufs/core/ufshcd.c +2 -0
@@ -8482,6 +8482,8 @@ static int ufs_get_device_desc(struct ufs_hba *hba) DEVICE_DESC_PARAM_EXT_UFS_FEATURE_SUP) &UFS_DEV_HID_SUPPORT ; +sysfs_update_group (&hba->dev->kobj, &ufs_sysfs_hid_group); + model_index = desc_buf[DEVICE_DESC_PARAM_PRDCT_NAME ]; err = ufshcd_read_string_desc(hba, model_index,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 71/371 mshv: Handle NEED_RESCHED_LAZY before transferring to guest
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
[ Upstream commit 0ebac01a00be972020c002a7fe0bb6b6fca8410f ]
Check for NEED_RESCHED_LAZY, not just NEED_RESCHED, prior to transferring control to a guest. Failure to check for lazy resched can unnecessarily delay rescheduling until the next tick when using a lazy preemption model.
Note, ideally both the checking and processing of TIF bits would be handled in common code, to avoid having to keep three separate paths synchronized, but defer such cleanups to the future to keep the fix as standalone as possible.
--- drivers/hv/mshv_common.c | 2 +- drivers/hv/mshv_root_main.c | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-)
drivers/hv/mshv_common.c +1 -1
@@ -151,7 +151,7 @@ int mshv_do_pre_guest_mode_work(ulong th_flags)if (th_flags & (_TIF_SIGPENDING | _TIF_NOTIFY_SIGNAL))return -EINTR ; -if (th_flags & _TIF_NEED_RESCHED) +if (th_flags & (_TIF_NEED_RESCHED | _TIF_NEED_RESCHED_LAZY))schedule ();if (th_flags & _TIF_NOTIFY_RESUME)
drivers/hv/mshv_root_main.c +2 -1
@@ -490,7 +490,8 @@ mshv_vp_wait_for_hv_kick(struct mshv_vp *vp)static int mshv_pre_guest_mode_work (struct mshv_vp *vp) {const ulong work_flags = _TIF_NOTIFY_SIGNAL | _TIF_SIGPENDING | - _TIF_NEED_RESCHED | _TIF_NOTIFY_RESUME; + _TIF_NEED_RESCHED | _TIF_NEED_RESCHED_LAZY | + _TIF_NOTIFY_RESUME;ulong th_flags; th_flags =read_thread_flags ();
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 72/371 perf bpf_counter: Fix handling of cpumap fixing hybrid
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit b91917c0c6fa6df97ec0222d8d6285ab2d60c21b ]
Don't open evsels on all CPUs, open them just on the CPUs they support. This avoids opening say an e-core event on a p-core and getting a failure - achieve this by getting rid of the "all_cpu_map".
In install_pe functions don't use the cpu_map_idx as a CPU number, translate the cpu_map_idx, which is a dense index into the cpu_map skipping holes at the beginning, to a proper CPU number.
Before:
```
$ perf stat --bpf-counters -a -e cycles,instructions -- sleep 1
Performance counter stats for 'system wide':
<not supported> cpu_atom/cycles/
566,270,672 cpu_core/cycles/
<not supported> cpu_atom/instructions/
572,792,836 cpu_core/instructions/ # 1.01 insn per cycle
1.001595384 seconds time elapsed
```After:
```
$ perf stat --bpf-counters -a -e cycles,instructions -- sleep 1
Performance counter stats for 'system wide':
443,299,201 cpu_atom/cycles/
1,233,919,737 cpu_core/cycles/
213,634,112 cpu_atom/instructions/ # 0.48 insn per cycle
2,758,965,527 cpu_core/instructions/ # 2.24 insn per cycle
1.001699485 seconds time elapsed
```--- tools/perf/util/bpf_counter.c | 26 ++++++++++---------------- tools/perf/util/bpf_counter_cgroup.c | 3 ++- 2 files changed, 12 insertions(+), 17 deletions(-)
tools/perf/util/bpf_counter.c +10 -16
@@ -278,6 +278,7 @@ static int bpf_program_profiler__install_pe(struct evsel *evsel, int cpu_map_idx {struct bpf_prog_profiler_bpf *skel;struct bpf_counter *counter; +int cpu =perf_cpu_map__cpu (evsel->core.cpus, cpu_map_idx).cpu;int ret;list_for_each_entry (counter, &evsel->bpf_counter_list, list) {
@@ -285,7 +286,7 @@ static int bpf_program_profiler__install_pe(struct evsel *evsel, int cpu_map_idxassert (skel !=NULL ); ret =bpf_map_update_elem (bpf_map__fd (skel->maps.events), - &cpu_map_idx, &fd,BPF_ANY ); + &cpu, &fd,BPF_ANY );if (ret)return ret; }
@@ -393,7 +394,6 @@ static int bperf_check_target(struct evsel *evsel,return 0 ; } -static struct perf_cpu_map *all_cpu_map;static __u32 filter_entry_cnt; static int bperf_reload_leader_program(struct evsel *evsel, int attr_map_fd,
@@ -437,7 +437,7 @@ static int bperf_reload_leader_program(struct evsel *evsel, int attr_map_fd,* following evsel__open_per_cpu call */ evsel->leader_skel = skel; -evsel__open_per_cpu (evsel, all_cpu_map,-1 ); +evsel__open (evsel, evsel->core.cpus, evsel->core.threads); out:bperf_leader_bpf__destroy (skel);
@@ -475,12 +475,6 @@ static int bperf__load(struct evsel *evsel, struct target *target)if (bperf_check_target (evsel, target, &filter_type, &filter_entry_cnt))return -1 ; -if (!all_cpu_map) { - all_cpu_map =perf_cpu_map__new_online_cpus (); -if (!all_cpu_map) -return -1 ; - } - evsel->bperf_leader_prog_fd =-1 ; evsel->bperf_leader_link_fd =-1 ;
@@ -598,9 +592,10 @@ static int bperf__load(struct evsel *evsel, struct target *target)static int bperf__install_pe (struct evsel *evsel,int cpu_map_idx,int fd) {struct bperf_leader_bpf *skel = evsel->leader_skel; +int cpu =perf_cpu_map__cpu (evsel->core.cpus, cpu_map_idx).cpu;return bpf_map_update_elem (bpf_map__fd (skel->maps.events), - &cpu_map_idx, &fd,BPF_ANY ); + &cpu, &fd,BPF_ANY ); }/*
@@ -609,13 +604,12 @@ static int bperf__install_pe(struct evsel *evsel, int cpu_map_idx, int fd)*/ static int bperf_sync_counters (struct evsel *evsel) { -int num_cpu, i, cpu; +struct perf_cpu cpu; +int idx; + +perf_cpu_map__for_each_cpu (cpu, idx, evsel->core.cpus) +bperf_trigger_reading (evsel->bperf_leader_prog_fd, cpu.cpu); - num_cpu =perf_cpu_map__nr (all_cpu_map); -for (i =0 ; i < num_cpu; i++) { - cpu =perf_cpu_map__cpu (all_cpu_map, i).cpu; -bperf_trigger_reading (evsel->bperf_leader_prog_fd, cpu); - }return 0 ; }
tools/perf/util/bpf_counter_cgroup.c +2 -1
@@ -185,7 +185,8 @@ static int bperf_cgrp__load(struct evsel *evsel, }static int bperf_cgrp__install_pe (struct evsel *evsel__maybe_unused , -int cpu__maybe_unused ,int fd__maybe_unused ) +int cpu_map_idx__maybe_unused , +int fd__maybe_unused ) {/* nothing to do */ return 0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 73/371 ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <[email protected]>
[ Upstream commit a7fe5ff832d61d9393095bc3dd5f06f4af7da3c1 ]
The firmware has changed the minimum host buffer size from 2 periods to 4 periods (1 period is 1ms) which was missed by the kernel side.
Adjust the SOF_IPC4_MIN_DMA_BUFFER_SIZE to 4 ms to align with firmware.
--- sound/soc/sof/ipc4-topology.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/sof/ipc4-topology.h +2 -2
@@ -61,8 +61,8 @@#define SOF_IPC4_CHAIN_DMA_NODE_ID 0x7fffffff#define SOF_IPC4_INVALID_NODE_ID 0xffffffff -/* FW requires minimum 2ms DMA buffer size */ -#define SOF_IPC4_MIN_DMA_BUFFER_SIZE 2 +/* FW requires minimum 4ms DMA buffer size */ +#define SOF_IPC4_MIN_DMA_BUFFER_SIZE 4/* * The base of multi-gateways. Multi-gateways addressing starts from
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 74/371 ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <[email protected]>
[ Upstream commit 3dcf683bf1062d69014fe81b90d285c7eb85ca8a ]
For ChainDMA the firmware allocates 5ms host buffer instead of the standard 4ms which should be taken into account when setting the constraint on the buffer size.
--- sound/soc/sof/ipc4-topology.c | 9 +++++++-- sound/soc/sof/ipc4-topology.h | 3 +++ 2 files changed, 10 insertions(+), 2 deletions(-)
sound/soc/sof/ipc4-topology.c +7 -2
@@ -623,8 +623,13 @@ static int sof_ipc4_widget_setup_pcm(struct snd_sof_widget *swidget) swidget->tuples, swidget->num_tuples, sizeof(u32), 1);/* Set default DMA buffer size if it is not specified in topology */ -if (!sps->dsp_max_burst_size_in_ms) - sps->dsp_max_burst_size_in_ms =SOF_IPC4_MIN_DMA_BUFFER_SIZE ; +if (!sps->dsp_max_burst_size_in_ms) { +struct snd_sof_widget *pipe_widget = swidget->spipe->pipe_widget; +struct sof_ipc4_pipeline *pipeline = pipe_widget->private; + + sps->dsp_max_burst_size_in_ms = pipeline->use_chain_dma ? +SOF_IPC4_CHAIN_DMA_BUFFER_SIZE :SOF_IPC4_MIN_DMA_BUFFER_SIZE ; + } }else {/* Capture data is copied from DSP to host in 1ms bursts */ spcm->stream[dir].dsp_max_burst_size_in_ms =1 ;
sound/soc/sof/ipc4-topology.h +3 -0
@@ -64,6 +64,9 @@/* FW requires minimum 4ms DMA buffer size */ #define SOF_IPC4_MIN_DMA_BUFFER_SIZE 4 +/* ChainDMA in fw uses 5ms DMA buffer */ +#define SOF_IPC4_CHAIN_DMA_BUFFER_SIZE 5 +/* * The base of multi-gateways. Multi-gateways addressing starts from * ALH_MULTI_GTW_BASE and there are ALH_MULTI_GTW_COUNT multi-sources
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 75/371 ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <[email protected]>
[ Upstream commit 45ad27d9a6f7c620d8bbc80be3bab1faf37dfa0a ]
Instead of constraining the ALSA buffer time to be double of the firmware host buffer size, it is better to set it for the period time. This will implicitly constrain the buffer time to a safe value (num_periods is at least 2) and prohibits applications to set smaller period size than what will be covered by the initial DMA burst.
--- sound/soc/sof/intel/hda-pcm.c | 29 +++++++++++++++++++++-------- 1 file changed, 21 insertions(+), 8 deletions(-)
sound/soc/sof/intel/hda-pcm.c +21 -8
@@ -29,6 +29,8 @@#define SDnFMT_BITS (x) ((x) << 4)#define SDnFMT_CHAN (x) ((x) << 0) +#define HDA_MAX_PERIOD_TIME_HEADROOM 10 +static bool hda_always_enable_dmi_l1;module_param_named (always_enable_dmi_l1, hda_always_enable_dmi_l1, bool,0444 );MODULE_PARM_DESC (always_enable_dmi_l1,"SOF HDA always enable DMI l1" );
@@ -291,19 +293,30 @@ int hda_dsp_pcm_open(struct snd_sof_dev *sdev,* On playback start the DMA will transfer dsp_max_burst_size_in_ms * amount of data in one initial burst to fill up the host DMA buffer. * Consequent DMA burst sizes are shorter and their length can vary. -* To make sure that userspace allocate large enough ALSA buffer we need -* to place a constraint on the buffer time. +* To avoid immediate xrun by the initial burst we need to place +* constraint on the period size (via PERIOD_TIME) to cover the size of +* the host buffer. +* We need to add headroom of max 10ms as the firmware needs time to +* settle to the 1ms pacing and initially it can run faster for few +* internal periods. * * On capture the DMA will transfer 1ms chunks. -* -* Exact dsp_max_burst_size_in_ms constraint is racy, so set the -* constraint to a minimum of 2x dsp_max_burst_size_in_ms. */ -if (spcm->stream[direction].dsp_max_burst_size_in_ms) +if (spcm->stream[direction].dsp_max_burst_size_in_ms) { +unsigned int period_time = spcm->stream[direction].dsp_max_burst_size_in_ms; + +/* +* add headroom over the maximum burst size to cover the time +* needed for the DMA pace to settle. +* Limit the headroom time to HDA_MAX_PERIOD_TIME_HEADROOM +*/ + period_time +=min (period_time,HDA_MAX_PERIOD_TIME_HEADROOM ); +snd_pcm_hw_constraint_minmax (substream->runtime, -SNDRV_PCM_HW_PARAM_BUFFER_TIME , - spcm->stream[direction].dsp_max_burst_size_in_ms *USEC_PER_MSEC *2 , +SNDRV_PCM_HW_PARAM_PERIOD_TIME , + period_time *USEC_PER_MSEC ,UINT_MAX ); + }/* binding pcm substream to hda stream */ substream->runtime->private_data = &dsp_stream->hstream;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 76/371 LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiezhu Yang <[email protected]>
[ Upstream commit abb2a5572264b425e6dd9c213b735a82ab0ca68a ]
Currently, when compiling with GCC, there is no "break 7" instruction for zero division due to using the option -mno-check-zero-division, but the compiler still generates "break 0" instruction for zero division.
Here is a simple example:
$ cat test.c
int div(int a)
{
return a / 0;
}
$ gcc -O2 -S test.c -o test.sGCC generates "break 0" on LoongArch and "ud2" on x86, objtool decodes "ud2" as INSN_BUG for x86, so decode "break 0" as INSN_BUG can fix the objtool warnings for LoongArch, but this is not the intention.
When decoding "break 0" as INSN_TRAP in the previous commit, the aim is to handle "break 0" as a trap. The generated "break 0" for zero division by GCC is not proper, it should generate a break instruction with proper bug type, so add the GCC option -fno-isolate-erroneous-paths-dereference to avoid generating the unexpected "break 0" instruction for now.
--- arch/loongarch/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/loongarch/Makefile +1 -1
@@ -129,7 +129,7 @@ KBUILD_RUSTFLAGS_KERNEL += -Crelocation-model=pie LDFLAGS_vmlinux += -static -pie --no-dynamic-linker -z notext $(call ld-option, --apply-dynamic-relocs) endif -cflags-y += $(call cc-option, -mno-check-zero-division) +cflags-y += $(call cc-option, -mno-check-zero-division -fno-isolate-erroneous-paths-dereference) ifndef CONFIG_KASAN cflags-y += -fno-builtin-memcpy -fno-builtin-memmove -fno-builtin-memset
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 77/371 LoongArch: Fix build error for LTO with LLVM-18
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
[ Upstream commit 19baac378a5f4c34e61007023cfcb605cc64c76d ]
Commit b15212824a01 ("LoongArch: Make LTO case independent in Makefile") moves "KBUILD_LDFLAGS += -mllvm --loongarch-annotate-tablejump" out of CONFIG_CC_HAS_ANNOTATE_TABLEJUMP, which breaks the build for LLVM-18, as '--loongarch-annotate-tablejump' is unimplemented there:
ld.lld: error: -mllvm: ld.lld: Unknown command line argument '--loongarch-annotate-tablejump'.
Call ld-option to detect '--loongarch-annotate-tablejump' before use, so as to fix the build error.
--- arch/loongarch/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/loongarch/Makefile +1 -1
@@ -115,7 +115,7 @@ ifdef CONFIG_LTO_CLANG # The annotate-tablejump option can not be passed to LLVM backend when LTO is enabled. # Ensure it is aware of linker with LTO, '--loongarch-annotate-tablejump' also needs to # be passed via '-mllvm' to ld.lld. -KBUILD_LDFLAGS += -mllvm --loongarch-annotate-tablejump +KBUILD_LDFLAGS += $(call ld-option,-mllvm --loongarch-annotate-tablejump) endif endif
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 78/371 LoongArch: Init acpi_gbl_use_global_lock to false
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
[ Upstream commit 98662be7ef20d2b88b598f72e7ce9b6ac26a40f9 ]
Init acpi_gbl_use_global_lock to false, in order to void error messages during boot phase:
ACPI Error: Could not enable GlobalLock event (20240827/evxfevnt-182) ACPI Error: No response from Global Lock hardware, disabling lock (20240827/evglock-59)
--- arch/loongarch/kernel/setup.c | 1 + 1 file changed, 1 insertion(+)
arch/loongarch/kernel/setup.c +1 -0
@@ -355,6 +355,7 @@ void __init platform_init(void)#ifdef CONFIG_ACPI acpi_table_upgrade (); + acpi_gbl_use_global_lock = false; acpi_gbl_use_default_register_widths = false;acpi_boot_table_init ();#endif
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 79/371 ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <[email protected]>
[ Upstream commit aaab61de1f1e44a2ab527e935474e2e03a0f6b08 ]
It is allowed to mix Link and Host DMA channels in a way that their index is different. In this case we would read the LLP from a channel which is not used or used for other operation.
Such case can be reproduced on cAVS2.5 or ACE1 platforms with soundwire configuration:
playback to SDW would take Host channel 0 (stream_tag 1) and no Link DMA used
Second playback to HDMI (HDA) would use Host channel 1 (stream_tag 2) and Link channel 0 (stream_tag 1).
In this case reading the LLP from channel 2 is incorrect as that is not the Link channel used for the HDMI playback.
To correct this, we should look up the BE and get the channel used on the Link side.
--- sound/soc/sof/intel/hda-stream.c | 29 +++++++++++++++++++++++++++-- 1 file changed, 27 insertions(+), 2 deletions(-)
sound/soc/sof/intel/hda-stream.c +27 -2
@@ -1129,10 +1129,35 @@ u64 hda_dsp_get_stream_llp(struct snd_sof_dev *sdev,struct snd_soc_component *component, struct snd_pcm_substream *substream) { - struct hdac_stream *hstream = substream->runtime->private_data; -struct hdac_ext_stream *hext_stream =stream_to_hdac_ext_stream (hstream); + struct snd_soc_pcm_runtime *rtd = snd_soc_substream_to_rtd(substream); +struct snd_soc_pcm_runtime *be_rtd =NULL ; +struct hdac_ext_stream *hext_stream; +struct snd_soc_dai *cpu_dai; +struct snd_soc_dpcm *dpcm;u32 llp_l, llp_u; +/* +* The LLP needs to be read from the Link DMA used for this FE as it is +* allowed to use any combination of Link and Host channels +*/ +for_each_dpcm_be (rtd, substream->stream, dpcm) { +if (dpcm->fe != rtd) +continue ; + + be_rtd = dpcm->be; + } + +if (!be_rtd) +return 0 ; + + cpu_dai =snd_soc_rtd_to_cpu (be_rtd,0 ); +if (!cpu_dai) +return 0 ; + + hext_stream =snd_soc_dai_get_dma_data (cpu_dai, substream); +if (!hext_stream) +return 0 ; +/* * The pplc_addr have been calculated during probe in * hda_dsp_stream_init():
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 80/371 net: usb: lan78xx: Fix lost EEPROM read timeout error(-ETIMEDOUT) in lan78xx_read_raw_eeprom
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bhanu Seshu Kumar Valluri <[email protected]>
[ Upstream commit 49bdb63ff64469a6de8ea901aef123c75be9bbe7 ]
Syzbot reported read of uninitialized variable BUG with following call stack.
lan78xx 8-1:1.0 (unnamed net_device) (uninitialized): EEPROM read operation timeout
=====================================================
BUG: KMSAN: uninit-value in lan78xx_read_eeprom drivers/net/usb/lan78xx.c:1095 [inline] BUG: KMSAN: uninit-value in lan78xx_init_mac_address drivers/net/usb/lan78xx.c:1937 [inline] BUG: KMSAN: uninit-value in lan78xx_reset+0x999/0x2cd0 drivers/net/usb/lan78xx.c:3241 lan78xx_read_eeprom drivers/net/usb/lan78xx.c:1095 [inline] lan78xx_init_mac_address drivers/net/usb/lan78xx.c:1937 [inline] lan78xx_reset+0x999/0x2cd0 drivers/net/usb/lan78xx.c:3241 lan78xx_bind+0x711/0x1690 drivers/net/usb/lan78xx.c:3766 lan78xx_probe+0x225c/0x3310 drivers/net/usb/lan78xx.c:4707
Local variable sig.i.i created at:
lan78xx_read_eeprom drivers/net/usb/lan78xx.c:1092 [inline] lan78xx_init_mac_address drivers/net/usb/lan78xx.c:1937 [inline] lan78xx_reset+0x77e/0x2cd0 drivers/net/usb/lan78xx.c:3241 lan78xx_bind+0x711/0x1690 drivers/net/usb/lan78xx.c:3766
The function lan78xx_read_raw_eeprom failed to properly propagate EEPROM read timeout errors (-ETIMEDOUT). In the fallthrough path, it first attempted to restore the pin configuration for LED outputs and then returned only the status of that restore operation, discarding the original timeout error.
As a result, callers could mistakenly treat the data buffer as valid even though the EEPROM read had actually timed out with no data or partial data.
To fix this, handle errors in restoring the LED pin configuration separately. If the restore succeeds, return any prior EEPROM timeout error correctly to the caller.
--- drivers/net/usb/lan78xx.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
drivers/net/usb/lan78xx.c +7 -4
@@ -1079,10 +1079,13 @@ static int lan78xx_read_raw_eeprom(struct lan78xx_net *dev, u32 offset, } read_raw_eeprom_done: -if (dev->chipid ==ID_REV_CHIP_ID_7800_ ) -return lan78xx_write_reg (dev,HW_CFG , saved); - -return 0 ; +if (dev->chipid ==ID_REV_CHIP_ID_7800_ ) { +int rc =lan78xx_write_reg (dev,HW_CFG , saved); +/* If USB fails, there is nothing to do */ +if (rc <0 ) +return rc; + } +return ret; } static int lan78xx_read_eeprom(struct lan78xx_net *dev, u32 offset,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 81/371 net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 4f0d91ba72811fd5dd577bcdccd7fed649aae62c ]
Print "entry->mac" before freeing "entry". The "entry" pointer is freed with kfree_rcu() so it's unlikely that we would trigger this in real life, but it's safer to re-order it.
--- drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx4/en_netdev.c +1 -1
@@ -1180,9 +1180,9 @@ static void mlx4_en_do_uc_filter(struct mlx4_en_priv *priv,mlx4_unregister_mac (mdev->dev, priv->port, mac);hlist_del_rcu (&entry->hlist); -kfree_rcu (entry, rcu);en_dbg (DRV , priv,"Removed MAC %pM on port:%d\n" , entry->mac, priv->port); +kfree_rcu (entry, rcu); ++removed; } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 82/371 drm/xe/hw_engine_group: Fix double write lock release in error path
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuicheng Lin <[email protected]>
[ Upstream commit 08fdfd260e641da203f80aff8d3ed19c5ecceb7d ]
In xe_hw_engine_group_get_mode(), a write lock is acquired before calling switch_mode(), which in turn invokes xe_hw_engine_group_suspend_faulting_lr_jobs().
On failure inside xe_hw_engine_group_suspend_faulting_lr_jobs(), the write lock is released there, and then again in xe_hw_engine_group_get_mode(), leading to a double release.
Fix this by keeping both acquire and release operation in xe_hw_engine_group_get_mode().
--- drivers/gpu/drm/xe/xe_hw_engine_group.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
drivers/gpu/drm/xe/xe_hw_engine_group.c +1 -5
@@ -213,17 +213,13 @@ static int xe_hw_engine_group_suspend_faulting_lr_jobs(struct xe_hw_engine_group err = q->ops->suspend_wait (q);if (err) - goto err_suspend; +return err; }if (need_resume)xe_hw_engine_group_resume_faulting_lr_jobs (group);return 0 ; - -err_suspend: -up_write (&group->mode_sem); -return err; }/**
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 83/371 drm/xe/i2c: Dont rely on d3cold.allowed flag in system PM path
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raag Jadav <[email protected]>
[ Upstream commit 1af59cd5cc2b65d7fc95165f056695ce3f171133 ]
In S3 and above sleep states, the device can loose power regardless of d3cold.allowed flag. Bring up I2C controller explicitly in system PM path to ensure its normal operation after losing power.
v2: Cover S3 and above states (Rodrigo)
--- drivers/gpu/drm/xe/xe_pm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/xe/xe_pm.c +1 -1
@@ -194,7 +194,7 @@ int xe_pm_resume(struct xe_device *xe)if (err) goto err; -xe_i2c_pm_resume (xe, xe->d3cold.allowed); +xe_i2c_pm_resume (xe, true);xe_irq_resume (xe);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 84/371 s390/cio: Update purge function to unregister the unused subchannels
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vineeth Vijayan <[email protected]>
[ Upstream commit 9daa5a8795865f9a3c93d8d1066785b07ded6073 ]
Starting with 'commit 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers")', cio no longer unregisters subchannels when the attached device is invalid or unavailable.
As an unintended side-effect, the cio_ignore purge function no longer removes subchannels for devices on the cio_ignore list if no CCW device is attached. This situation occurs when a CCW device is non-operational or unavailable
To ensure the same outcome of the purge function as when the current cio_ignore list had been active during boot, update the purge function to remove I/O subchannels without working CCW devices if the associated device number is found on the cio_ignore list.
--- drivers/s390/cio/device.c | 37 ++++++++++++++++++++++++------------- 1 file changed, 24 insertions(+), 13 deletions(-)
drivers/s390/cio/device.c +24 -13
@@ -1316,23 +1316,34 @@ void ccw_device_schedule_recovery(void)spin_unlock_irqrestore (&recovery_lock, flags); } -static int purge_fn (struct device *dev,void *data) +static int purge_fn (struct subchannel *sch,void *data) { -struct ccw_device *cdev =to_ccwdev (dev); -struct ccw_dev_id *id = &cdev->private->dev_id; -struct subchannel *sch =to_subchannel (cdev->dev.parent); +struct ccw_device *cdev; -spin_lock_irq (cdev->ccwlock); -if (is_blacklisted (id->ssid, id->devno) && - (cdev->private->state ==DEV_STATE_OFFLINE ) && - (atomic_cmpxchg (&cdev->private->onoff,0 ,1 ) ==0 )) { -CIO_MSG_EVENT (3 ,"ccw: purging 0.%x.%04x\n" , id->ssid, - id->devno); +spin_lock_irq (&sch->lock); +if (sch->st !=SUBCHANNEL_TYPE_IO || !sch->schib.pmcw.dnv) + goto unlock; + +if (!is_blacklisted (sch->schid.ssid, sch->schib.pmcw.dev)) + goto unlock; + + cdev =sch_get_cdev (sch); +if (cdev) { +if (cdev->private->state !=DEV_STATE_OFFLINE ) + goto unlock; + +if (atomic_cmpxchg (&cdev->private->onoff,0 ,1 ) !=0 ) + goto unlock;ccw_device_sched_todo (cdev,CDEV_TODO_UNREG ); -css_sched_sch_todo (sch,SCH_TODO_UNREG );atomic_set (&cdev->private->onoff,0 ); } -spin_unlock_irq (cdev->ccwlock); + +css_sched_sch_todo (sch,SCH_TODO_UNREG ); +CIO_MSG_EVENT (3 ,"ccw: purging 0.%x.%04x%s\n" , sch->schid.ssid, + sch->schib.pmcw.dev, cdev ?"" :" (no cdev)" ); + +unlock: +spin_unlock_irq (&sch->lock);/* Abort loop in case of pending signal. */ if (signal_pending (current))return -EINTR ;
@@ -1348,7 +1359,7 @@ static int purge_fn(struct device *dev, void *data)int ccw_purge_blacklisted (void ) {CIO_MSG_EVENT (2 ,"ccw: purging blacklisted devices\n" ); -bus_for_each_dev (&ccw_bus_type,NULL ,NULL , purge_fn); +for_each_subchannel_staged (purge_fn,NULL ,NULL );return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 85/371 drm/vmwgfx: Fix a null-ptr access in the cursor snooper
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zack Rusin <[email protected]>
[ Upstream commit 5ac2c0279053a2c5265d46903432fb26ae2d0da2 ]
Check that the resource which is converted to a surface exists before trying to use the cursor snooper on it.
vmw_cmd_res_check allows explicit invalid (SVGA3D_INVALID_ID) identifiers because some svga commands accept SVGA3D_INVALID_ID to mean "no surface", unfortunately functions that accept the actual surfaces as objects might (and in case of the cursor snooper, do not) be able to handle null objects. Make sure that we validate not only the identifier (via the vmw_cmd_res_check) but also check that the actual resource exists before trying to do something with it.
Fixes unchecked null-ptr reference in the snooping code.
--- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-)
drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +12 -5
@@ -1497,6 +1497,7 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv, SVGA3dCmdHeader *header) {struct vmw_bo *vmw_bo =NULL ; +struct vmw_resource *res;struct vmw_surface *srf =NULL ;VMW_DECLARE_CMD_VAR (*cmd, SVGA3dCmdSurfaceDMA);int ret;
@@ -1532,18 +1533,24 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv, dirty = (cmd->body.transfer ==SVGA3D_WRITE_HOST_VRAM ) ?VMW_RES_DIRTY_SET :0 ; - ret =vmw_cmd_res_check (dev_priv, sw_context, vmw_res_surface, - dirty, user_surface_converter, - &cmd->body.host.sid,NULL ); + ret =vmw_cmd_res_check (dev_priv, sw_context, vmw_res_surface, dirty, + user_surface_converter, &cmd->body.host.sid, +NULL );if (unlikely (ret !=0 )) {if (unlikely (ret != -ERESTARTSYS ))VMW_DEBUG_USER ("could not find surface for DMA.\n" );return ret; } - srf =vmw_res_to_srf (sw_context->res_cache[vmw_res_surface].res); + res = sw_context->res_cache[vmw_res_surface].res; +if (!res) { +VMW_DEBUG_USER ("Invalid DMA surface.\n" ); +return -EINVAL ; + } -vmw_kms_cursor_snoop (srf, sw_context->fp->tfile, &vmw_bo->tbo, header); + srf =vmw_res_to_srf (res); +vmw_kms_cursor_snoop (srf, sw_context->fp->tfile, &vmw_bo->tbo, + header);return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 86/371 drm/vmwgfx: Fix Use-after-free in validation
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Forbes <[email protected]>
[ Upstream commit dfe1323ab3c8a4dd5625ebfdba44dc47df84512a ]
Nodes stored in the validation duplicates hashtable come from an arena allocator that is cleared at the end of vmw_execbuf_process. All nodes are expected to be cleared in vmw_validation_drop_ht but this node escaped because its resource was destroyed prematurely.
--- drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +3 -1
@@ -308,8 +308,10 @@ int vmw_validation_add_resource(struct vmw_validation_context *ctx,hash_add_rcu (ctx->sw_context->res_ht, &node->hash.head, node->hash.key); } node->res =vmw_resource_reference_unless_doomed (res); -if (!node->res) +if (!node->res) { +hash_del_rcu (&node->hash.head);return -ESRCH ; + } node->first_usage =1 ;if (!res->dev_priv->has_mob) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 87/371 drm/vmwgfx: Fix copy-paste typo in validation
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Forbes <[email protected]>
[ Upstream commit 228c5d44dffe8c293cd2d2f0e7ea45e64565b1c4 ]
'entry' should be 'val' which is the loop iterator.
--- drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +1 -1
@@ -638,7 +638,7 @@ void vmw_validation_drop_ht(struct vmw_validation_context *ctx)hash_del_rcu (&val->hash.head);list_for_each_entry (val, &ctx->resource_ctx_list, head) -hash_del_rcu (&entry->hash.head); +hash_del_rcu (&val->hash.head); ctx->sw_context =NULL ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 88/371 net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandr Sapozhnikov <[email protected]>
[ Upstream commit 2f3119686ef50319490ccaec81a575973da98815 ]
If new_asoc->peer.adaptation_ind=0 and sctp_ulpevent_make_authkey=0 and sctp_ulpevent_make_authkey() returns 0, then the variable ai_ev remains zero and the zero will be dereferenced
in the sctp_ulpevent_free() function.
--- net/sctp/sm_statefuns.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/sctp/sm_statefuns.c +2 -1
@@ -885,7 +885,8 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net,return SCTP_DISPOSITION_CONSUME ; nomem_authev: -sctp_ulpevent_free (ai_ev); +if (ai_ev) +sctp_ulpevent_free (ai_ev); nomem_aiev:sctp_ulpevent_free (ev); nomem_ev:
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 89/371 tcp: Dont call reqsk_fastopen_remove() in tcp_conn_request().
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 2e7cbbbe3d61c63606994b7ff73c72537afe2e1c ]
syzbot reported the splat below in tcp_conn_request(). [0]
If a listener is close()d while a TFO socket is being processed in tcp_conn_request(), inet_csk_reqsk_queue_add() does not set reqsk->sk and calls inet_child_forget(), which calls tcp_disconnect() for the TFO socket.
After the cited commit, tcp_disconnect() calls reqsk_fastopen_remove(), where reqsk_put() is called due to !reqsk->sk.
Then, reqsk_fastopen_remove() in tcp_conn_request() decrements the last req->rsk_refcnt and frees reqsk, and __reqsk_free() at the drop_and_free label causes the refcount underflow for the listener and double-free of the reqsk.
Let's remove reqsk_fastopen_remove() in tcp_conn_request().
Note that other callers make sure tp->fastopen_rsk is not NULL.
[0]:refcount_t: underflow; use-after-free.
WARNING: CPU: 12 PID: 5563 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28) Modules linked in: CPU: 12 UID: 0 PID: 5563 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:refcount_warn_saturate (lib/refcount.c:28) Code: ab e8 8e b4 98 ff 0f 0b c3 cc cc cc cc cc 80 3d a4 e4 d6 01 00 75 9c c6 05 9b e4 d6 01 01 48 c7 c7 e8 df fb ab e8 6a b4 98 ff <0f> 0b e9 03 5b 76 00 cc 80 3d 7d e4 d6 01 00 0f 85 74 ff ff ff c6 RSP: 0018:ffffa79fc0304a98 EFLAGS: 00010246 RAX: d83af4db1c6b3900 RBX: ffff9f65c7a69020 RCX: d83af4db1c6b3900 RDX: 0000000000000000 RSI: 00000000ffff7fff RDI: ffffffffac78a280 RBP: 000000009d781b60 R08: 0000000000007fff R09: ffffffffac6ca280 R10: 0000000000017ffd R11: 0000000000000004 R12: ffff9f65c7b4f100 R13: ffff9f65c7d23c00 R14: ffff9f65c7d26000 R15: ffff9f65c7a64ef8 FS: 00007f9f962176c0(0000) GS:ffff9f65fcf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000000180 CR3: 000000000dbbe006 CR4: 0000000000372ef0 Call Trace: <IRQ> tcp_conn_request (./include/linux/refcount.h:400 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 ./include/net/sock.h:1965 ./include/net/request_sock.h:131 net/ipv4/tcp_input.c:7301) tcp_rcv_state_process (net/ipv4/tcp_input.c:6708) tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1670) tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1906) ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:438) ip6_input (net/ipv6/ip6_input.c:500) ipv6_rcv (net/ipv6/ip6_input.c:311) __netif_receive_skb (net/core/dev.c:6104) process_backlog (net/core/dev.c:6456) __napi_poll (net/core/dev.c:7506) net_rx_action (net/core/dev.c:7569 net/core/dev.c:7696) handle_softirqs (kernel/softirq.c:579) do_softirq (kernel/softirq.c:480) </IRQ>
--- net/ipv4/tcp_input.c | 1 - 1 file changed, 1 deletion(-)
net/ipv4/tcp_input.c +0 -1
@@ -7275,7 +7275,6 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, &foc, TCP_SYNACK_FASTOPEN, skb);/* Add the child socket directly into the accept queue */ if (!inet_csk_reqsk_queue_add (sk, req, fastopen_sk)) { -reqsk_fastopen_remove (fastopen_sk, req, false);bh_unlock_sock (fastopen_sk);sock_put (fastopen_sk); goto drop_and_free;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 90/371 net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Duoming Zhou <[email protected]>
[ Upstream commit bc9ea787079671cb19a8b25ff9f02be5ef6bfcf5 ]
The origin code calls cancel_delayed_work() in ocelot_stats_deinit() to cancel the cyclic delayed work item ocelot->stats_work. However, cancel_delayed_work() may fail to cancel the work item if it is already executing. While destroy_workqueue() does wait for all pending work items in the work queue to complete before destroying the work queue, it cannot prevent the delayed work item from being rescheduled within the ocelot_check_stats_work() function. This limitation exists because the delayed work item is only enqueued into the work queue after its timer expires. Before the timer expiration, destroy_workqueue() has no visibility of this pending work item. Once the work queue appears empty, destroy_workqueue() proceeds with destruction. When the timer eventually expires, the delayed work item gets queued again, leading to the following warning:
workqueue: cannot queue ocelot_check_stats_work on wq ocelot-switch-stats
WARNING: CPU: 2 PID: 0 at kernel/workqueue.c:2255 __queue_work+0x875/0xaf0 ... RIP: 0010:__queue_work+0x875/0xaf0 ... RSP: 0018:ffff88806d108b10 EFLAGS: 00010086 RAX: 0000000000000000 RBX: 0000000000000101 RCX: 0000000000000027 RDX: 0000000000000027 RSI: 0000000000000004 RDI: ffff88806d123e88 RBP: ffffffff813c3170 R08: 0000000000000000 R09: ffffed100da247d2 R10: ffffed100da247d1 R11: ffff88806d123e8b R12: ffff88800c00f000 R13: ffff88800d7285c0 R14: ffff88806d0a5580 R15: ffff88800d7285a0 FS: 0000000000000000(0000) GS:ffff8880e5725000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe18e45ea10 CR3: 0000000005e6c000 CR4: 00000000000006f0 Call Trace: <IRQ> ? kasan_report+0xc6/0xf0 ? __pfx_delayed_work_timer_fn+0x10/0x10 ? __pfx_delayed_work_timer_fn+0x10/0x10 call_timer_fn+0x25/0x1c0 __run_timer_base.part.0+0x3be/0x8c0 ? __pfx_delayed_work_timer_fn+0x10/0x10 ? rcu_sched_clock_irq+0xb06/0x27d0 ? __pfx___run_timer_base.part.0+0x10/0x10 ? try_to_wake_up+0xb15/0x1960 ? _raw_spin_lock_irq+0x80/0xe0 ? __pfx__raw_spin_lock_irq+0x10/0x10 tmigr_handle_remote_up+0x603/0x7e0 ? __pfx_tmigr_handle_remote_up+0x10/0x10 ? sched_balance_trigger+0x1c0/0x9f0 ? sched_tick+0x221/0x5a0 ? _raw_spin_lock_irq+0x80/0xe0 ? __pfx__raw_spin_lock_irq+0x10/0x10 ? tick_nohz_handler+0x339/0x440 ? __pfx_tmigr_handle_remote_up+0x10/0x10 __walk_groups.isra.0+0x42/0x150 tmigr_handle_remote+0x1f4/0x2e0 ? __pfx_tmigr_handle_remote+0x10/0x10 ? ktime_get+0x60/0x140 ? lapic_next_event+0x11/0x20 ? clockevents_program_event+0x1d4/0x2a0 ? hrtimer_interrupt+0x322/0x780 handle_softirqs+0x16a/0x550 irq_exit_rcu+0xaf/0xe0 sysvec_apic_timer_interrupt+0x70/0x80 </IRQ>
...
The following diagram reveals the cause of the above warning:
CPU 0 (remove) | CPU 1 (delayed work callback)
mscc_ocelot_remove() |
ocelot_deinit() | ocelot_check_stats_work()
ocelot_stats_deinit() |
cancel_delayed_work()| ...
| queue_delayed_work()
destroy_workqueue() | (wait a time)
| __queue_work() //UAFThe above scenario actually constitutes a UAF vulnerability.
The ocelot_stats_deinit() is only invoked when initialization failure or resource destruction, so we must ensure that any delayed work items cannot be rescheduled.
Replace cancel_delayed_work() with disable_delayed_work_sync() to guarantee proper cancellation of the delayed work item and ensure completion of any currently executing work before the workqueue is deallocated.
A deadlock concern was considered: ocelot_stats_deinit() is called in a process context and is not holding any locks that the delayed work item might also need. Therefore, the use of the _sync() variant is safe here.
This bug was identified through static analysis. To reproduce the issue and validate the fix, I simulated ocelot-switch device by writing a kernel module and prepared the necessary resources for the virtual ocelot-switch device's probe process. Then, removing the virtual device will trigger the mscc_ocelot_remove() function, which in turn destroys the workqueue.
--- drivers/net/ethernet/mscc/ocelot_stats.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mscc/ocelot_stats.c +1 -1
@@ -1021,6 +1021,6 @@ int ocelot_stats_init(struct ocelot *ocelot)void ocelot_stats_deinit (struct ocelot *ocelot) { -cancel_delayed_work (&ocelot->stats_work); +disable_delayed_work_sync (&ocelot->stats_work);destroy_workqueue (ocelot->stats_queue); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 91/371 selftest: net: ovpn: Fix uninit return values
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sidharth Seela <[email protected]>
[ Upstream commit 7fc25c5a5ae6230d14b4c088fc94dbd58b2a9f3a ]
Fix functions that return undefined values. These issues were caught by running clang using LLVM=1 option.
Clang warnings are as follows:
ovpn-cli.c:1587:6: warning: variable 'ret' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized]
1587 | if (!sock) {
| ^~~~~ovpn-cli.c:1635:9: note: uninitialized use occurs here
1635 | return ret;
| ^~~
ovpn-cli.c:1587:2: note: remove the 'if' if its condition is always false
1587 | if (!sock) {
| ^~~~~~~~~~~~
1588 | fprintf(stderr, "cannot allocate netlink socket\n");
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1589 | goto err_free;
| ~~~~~~~~~~~~~~
1590 | }
| ~
ovpn-cli.c:1584:15: note: initialize the variable 'ret' to silence this warning
1584 | int mcid, ret;
| ^
| = 0
ovpn-cli.c:2107:7: warning: variable 'ret' is used uninitialized whenever switch case is taken [-Wsometimes-uninitialized]
2107 | case CMD_INVALID:
| ^~~~~~~~~~~ovpn-cli.c:2111:9: note: uninitialized use occurs here
2111 | return ret;
| ^~~
ovpn-cli.c:1939:12: note: initialize the variable 'ret' to silence this warning
1939 | int n, ret;
| ^
|--- tools/testing/selftests/net/ovpn/ovpn-cli.c | 2 ++ 1 file changed, 2 insertions(+)
tools/testing/selftests/net/ovpn/ovpn-cli.c +2 -0
@@ -1586,6 +1586,7 @@ static int ovpn_listen_mcast(void) sock =nl_socket_alloc ();if (!sock) {fprintf (stderr,"cannot allocate netlink socket\n" ); + ret = -ENOMEM ; goto err_free; }
@@ -2105,6 +2106,7 @@ static int ovpn_run_cmd(struct ovpn_ctx *ovpn) ret =ovpn_listen_mcast ();break ;case CMD_INVALID : + ret = -EINVAL ;break ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 92/371 ice: ice_adapter: release xa entry on adapter allocation failure
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 2db687f3469dbc5c59bc53d55acafd75d530b497 ]
When ice_adapter_new() fails, the reserved XArray entry created by xa_insert() is not released. This causes subsequent insertions at the same index to return -EBUSY, potentially leading to NULL pointer dereferences.
Reorder the operations as suggested by Przemek Kitszel:
1. Check if adapter already exists (xa_load)
2. Reserve the XArray slot (xa_reserve)
3. Allocate the adapter (ice_adapter_new)
4. Store the adapter (xa_store)
--- drivers/net/ethernet/intel/ice/ice_adapter.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/net/ethernet/intel/ice/ice_adapter.c +6 -4
@@ -99,19 +99,21 @@ struct ice_adapter *ice_adapter_get(struct pci_dev *pdev) index =ice_adapter_xa_index (pdev); scoped_guard(mutex, &ice_adapters_mutex) { - err =xa_insert (&ice_adapters, index,NULL ,GFP_KERNEL ); -if (err == -EBUSY ) { - adapter =xa_load (&ice_adapters, index); + adapter =xa_load (&ice_adapters, index); +if (adapter) {refcount_inc (&adapter->refcount);WARN_ON_ONCE (adapter->index !=ice_adapter_index (pdev));return adapter; } + err =xa_reserve (&ice_adapters, index,GFP_KERNEL );if (err)return ERR_PTR (err); adapter =ice_adapter_new (pdev); -if (!adapter) +if (!adapter) { +xa_release (&ice_adapters, index);return ERR_PTR (-ENOMEM ); + }xa_store (&ice_adapters, index, adapter,GFP_KERNEL ); }return adapter;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 93/371 net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Erick Karanja <[email protected]>
[ Upstream commit 521405cb54cd2812bbb6dedd5afc14bca1e7e98a ]
Add missing of_node_put call to release device node tbi obtained via for_each_child_of_node.
--- drivers/net/ethernet/freescale/fsl_pq_mdio.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/freescale/fsl_pq_mdio.c +2 -0
@@ -479,10 +479,12 @@ static int fsl_pq_mdio_probe(struct platform_device *pdev)"missing 'reg' property in node %pOF\n" , tbi); err = -EBUSY ; +of_node_put (tbi); goto error; }set_tbipa (*prop, pdev, data->get_tbipa, priv->map, &res); +of_node_put (tbi); } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 94/371 tools build: Align warning options with perf
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit 53d067feb8c4f16d1f24ce3f4df4450bb18c555f ]
The feature test programs are built without enabling '-Wall -Werror' options. As a result, a feature may appear to be available, but later building in perf can fail with stricter checks.
Make the feature test program use the same warning options as perf.
--- tools/build/feature/Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/build/feature/Makefile +2 -2
@@ -316,10 +316,10 @@ $(OUTPUT)test-libcapstone.bin: $(BUILD) # -lcapstone provided by $(FEATURE_CHECK_LDFLAGS-libcapstone) $(OUTPUT)test-compile-32.bin: - $(CC) -m32 -o $@ test-compile.c + $(CC) -m32 -Wall -Werror -o $@ test-compile.c $(OUTPUT)test-compile-x32.bin: - $(CC) -mx32 -o $@ test-compile.c + $(CC) -mx32 -Wall -Werror -o $@ test-compile.c $(OUTPUT)test-zlib.bin: $(BUILD) -lz
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 95/371 perf python: split Clang options when invoking Popen
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit c6a43bc3e8f6102a47da0d2e53428d08f00172fb ]
When passing a list to subprocess.Popen, each element maps to one argv token. Current code bundles multiple Clang flags into a single element, something like:
cmd = ['clang',
'--target=x86_64-linux-gnu -fintegrated-as -Wno-cast-function-type-mismatch', 'test-hello.c']
So Clang only sees one long, invalid option instead of separate flags, as a result, the script cannot capture any log via PIPE.
Fix this by using shlex.split() to separate the string so each option becomes its own argv element. The fixed list will be:
cmd = ['clang',
'--target=x86_64-linux-gnu', '-fintegrated-as', '-Wno-cast-function-type-mismatch', 'test-hello.c']
--- tools/perf/util/setup.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
tools/perf/util/setup.py +4 -1
@@ -1,6 +1,7 @@ from os import getenv, path from subprocess import Popen, PIPE from re import sub +import shlex cc = getenv("CC") assert cc, "Environment variable CC not set"
@@ -22,7 +23,9 @@ assert srctree, "Environment variable srctree, for the Linux sources, not set" src_feature_tests = f'{srctree}/tools/build/feature' def clang_has_option(option): - cc_output = Popen([cc, cc_options + option, path.join(src_feature_tests, "test-hello.c") ], stderr=PIPE).stderr.readlines() + cmd = shlex.split(f"{cc} {cc_options} {option}") + cmd.append(path.join(src_feature_tests, "test-hello.c")) + cc_output = Popen(cmd, stderr=PIPE).stderr.readlines() return [o for o in cc_output if ((b"unknown argument" in o) or (b"is not supported" in o) or (b"unknown warning option" in o))] == [ ] if cc_is_clang:
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 96/371 tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 21b29e74ffe5a6c851c235bb80bf5ee26292c67b ]
Some applications (like selftests/net/tcp_mmap.c) call SO_RCVLOWAT on their listener, before accept().
This has an unfortunate effect on wscale selection in tcp_select_initial_window() during 3WHS.
For instance, tcp_mmap was negotiating wscale 4, regardless of tcp_rmem[2] and sysctl_rmem_max.
Do not change tp->window_clamp if it is zero
or bigger than our computed value.
Zero value is special, it allows tcp_select_initial_window() to enable autotuning.
Note that SO_RCVLOWAT use on listener is probably not wise, because tp->scaling_ratio has a default value, possibly wrong.
--- net/ipv4/tcp.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
net/ipv4/tcp.c +4 -1
@@ -1771,6 +1771,7 @@ EXPORT_IPV6_MOD(tcp_peek_len);/* Make sure sk_rcvbuf is big enough to satisfy SO_RCVLOWAT hint */ int tcp_set_rcvlowat (struct sock *sk,int val) { +struct tcp_sock *tp =tcp_sk (sk);int space, cap;if (sk->sk_userlocks &SOCK_RCVBUF_LOCK )
@@ -1789,7 +1790,9 @@ int tcp_set_rcvlowat(struct sock *sk, int val) space =tcp_space_from_win (sk, val);if (space > sk->sk_rcvbuf) {WRITE_ONCE (sk->sk_rcvbuf, space); -WRITE_ONCE (tcp_sk (sk)->window_clamp, val); + +if (tp->window_clamp && tp->window_clamp < val) +WRITE_ONCE (tp->window_clamp, val); }return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 97/371 perf tools: Fix arm64 libjvmti build by generating unistd_64.h
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vincent Minet <[email protected]>
[ Upstream commit f3b601f900902ab80902c44f820a8985384ac021 ]
Since commit 22f72088ffe6 ("tools headers: Update the syscall table with the kernel sources") the arm64 syscall header is generated at build time. Later, commit bfb713ea53c7 ("perf tools: Fix arm64 build by generating unistd_64.h") added a dependency to libperf to guarantee that this header was created before building libperf or perf itself.
However, libjvmti also requires this header but does not depend on libperf, leading to build failures such as:
In file included from /usr/include/sys/syscall.h:24,
from /usr/include/syscall.h:1,
from jvmti/jvmti_agent.c:36:
tools/arch/arm64/include/uapi/asm/unistd.h:2:10: fatal error: asm/unistd_64.h: No such file or directory
2 | #include <asm/unistd_64.h>
Fix this by ensuring that libperf is built before libjvmti, so that unistd_64.h is always available.
--- tools/perf/Makefile.perf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/Makefile.perf +1 -1
@@ -941,7 +941,7 @@ $(OUTPUT)dlfilters/%.so: $(OUTPUT)dlfilters/%.o ifndef NO_JVMTI LIBJVMTI_IN := $(OUTPUT)jvmti/jvmti-in.o -$(LIBJVMTI_IN): FORCE +$(LIBJVMTI_IN): prepare FORCE $(Q)$(MAKE) -f $(srctree)/tools/build/Makefile.build dir=jvmti obj=jvmti $(OUTPUT)$(LIBJVMTI): $(LIBJVMTI_IN)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 98/371 mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harini T <[email protected]>
[ Upstream commit 341867f730d3d3bb54491ee64e8b1a0c446656e7 ]
The controller is registered using the device-managed function 'devm_mbox_controller_register()'. As documented in mailbox.c, this ensures the devres framework automatically calls mbox_controller_unregister() when device_unregister() is invoked, making the explicit call unnecessary.
Remove redundant mbox_controller_unregister() call as device_unregister() handles controller cleanup.
--- drivers/mailbox/zynqmp-ipi-mailbox.c | 1 - 1 file changed, 1 deletion(-)
drivers/mailbox/zynqmp-ipi-mailbox.c +0 -1
@@ -894,7 +894,6 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata)for (; i >=0 ; i--) { ipi_mbox = &pdata->ipi_mboxes[i];if (ipi_mbox->dev.parent) { -mbox_controller_unregister (&ipi_mbox->mbox);if (device_is_registered (&ipi_mbox->dev))device_unregister (&ipi_mbox->dev); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 99/371 mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harini T <[email protected]>
[ Upstream commit 019e3f4550fc7d319a7fd03eff487255f8e8aecd ]
The ipi_mbox->dev.parent check is unreliable proxy for registration status as it fails to protect against probe failures that occur after the parent is assigned but before device_register() completes.
device_is_registered() is the canonical and robust method to verify the registration status.
Remove ipi_mbox->dev.parent check in zynqmp_ipi_free_mboxes().
--- drivers/mailbox/zynqmp-ipi-mailbox.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/mailbox/zynqmp-ipi-mailbox.c +2 -4
@@ -893,10 +893,8 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata) i = pdata->num_mboxes;for (; i >=0 ; i--) { ipi_mbox = &pdata->ipi_mboxes[i]; -if (ipi_mbox->dev.parent) { -if (device_is_registered (&ipi_mbox->dev)) -device_unregister (&ipi_mbox->dev); - } +if (device_is_registered (&ipi_mbox->dev)) +device_unregister (&ipi_mbox->dev); } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 100/371 mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harini T <[email protected]>
[ Upstream commit 0aead8197fc1a85b0a89646e418feb49a564b029 ]
The cleanup loop was starting at the wrong array index, causing out-of-bounds access.
Start the loop at the correct index for zero-indexed arrays to prevent accessing memory beyond the allocated array bounds.
--- drivers/mailbox/zynqmp-ipi-mailbox.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mailbox/zynqmp-ipi-mailbox.c +1 -1
@@ -890,7 +890,7 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata)if (pdata->irq <MAX_SGI )xlnx_mbox_cleanup_sgi (pdata); - i = pdata->num_mboxes; + i = pdata->num_mboxes -1 ;for (; i >=0 ; i--) { ipi_mbox = &pdata->ipi_mboxes[i];if (device_is_registered (&ipi_mbox->dev))
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 101/371 mailbox: zynqmp-ipi: Fix SGI cleanup on unbind
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harini T <[email protected]>
[ Upstream commit bb160e791ab15b89188a7a19589b8e11f681bef3 ]
The driver incorrectly determines SGI vs SPI interrupts by checking IRQ number < 16, which fails with dynamic IRQ allocation. During unbind, this causes improper SGI cleanup leading to kernel crash.
Add explicit irq_type field to pdata for reliable identification of SGI interrupts (type-2) and only clean up SGI resources when appropriate.
--- drivers/mailbox/zynqmp-ipi-mailbox.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
drivers/mailbox/zynqmp-ipi-mailbox.c +10 -5
@@ -62,7 +62,8 @@#define DST_BIT_POS 9U#define SRC_BITMASK GENMASK(11, 8) -#define MAX_SGI 16 +/* Macro to represent SGI type for IPI IRQs */ +#define IPI_IRQ_TYPE_SGI 2/* * Module parameters
@@ -121,6 +122,7 @@ struct zynqmp_ipi_mbox {* @dev: device pointer corresponding to the Xilinx ZynqMP * IPI agent * @irq: IPI agent interrupt ID +* @irq_type: IPI SGI or SPI IRQ type * @method: IPI SMC or HVC is going to be used * @local_id: local IPI agent ID * @virq_sgi: IRQ number mapped to SGI
@@ -130,6 +132,7 @@ struct zynqmp_ipi_mbox {struct zynqmp_ipi_pdata {struct device *dev;int irq; +unsigned int irq_type;unsigned int method;u32 local_id;int virq_sgi;
@@ -887,7 +890,7 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata)struct zynqmp_ipi_mbox *ipi_mbox;int i; -if (pdata->irq <MAX_SGI ) +if (pdata->irq_type ==IPI_IRQ_TYPE_SGI )xlnx_mbox_cleanup_sgi (pdata); i = pdata->num_mboxes -1 ;
@@ -956,14 +959,16 @@ static int zynqmp_ipi_probe(struct platform_device *pdev)dev_err (dev,"failed to parse interrupts\n" ); goto free_mbox_dev; } - ret = out_irq.args[1 ]; + +/* Use interrupt type to distinguish SGI and SPI interrupts */ + pdata->irq_type = out_irq.args[0 ];/* * If Interrupt number is in SGI range, then request SGI else request * IPI system IRQ. */ -if (ret <MAX_SGI ) { - pdata->irq = ret; +if (pdata->irq_type ==IPI_IRQ_TYPE_SGI ) { + pdata->irq = out_irq.args[1 ]; ret =xlnx_mbox_init_sgi (pdev, pdata->irq, pdata);if (ret) goto free_mbox_dev;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 102/371 bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
[ Upstream commit 23f3770e1a53e6c7a553135011f547209e141e72 ]
Cilium has a BPF egress gateway feature which forces outgoing K8s Pod traffic to pass through dedicated egress gateways which then SNAT the traffic in order to interact with stable IPs outside the cluster.
The traffic is directed to the gateway via vxlan tunnel in collect md mode. A recent BPF change utilized the bpf_redirect_neigh() helper to forward packets after the arrival and decap on vxlan, which turned out over time that the kmalloc-256 slab usage in kernel was ever-increasing.
The issue was that vxlan allocates the metadata_dst object and attaches it through a fake dst entry to the skb. The latter was never released though given bpf_redirect_neigh() was merely setting the new dst entry via skb_dst_set() without dropping an existing one first.
--- net/core/filter.c | 2 ++ 1 file changed, 2 insertions(+)
net/core/filter.c +2 -0
@@ -2281,6 +2281,7 @@ static int __bpf_redirect_neigh_v6(struct sk_buff *skb, struct net_device *dev,if (IS_ERR (dst)) goto out_drop; +skb_dst_drop (skb);skb_dst_set (skb, dst); }else if (nh->nh_family !=AF_INET6 ) { goto out_drop;
@@ -2389,6 +2390,7 @@ static int __bpf_redirect_neigh_v4(struct sk_buff *skb, struct net_device *dev, goto out_drop; } +skb_dst_drop (skb);skb_dst_set (skb, &rt->dst); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 103/371 net: mdio: mdio-i2c: Hold the i2c bus lock during smbus transactions
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxime Chevallier <[email protected]>
[ Upstream commit 4dc8b26a3ac2cb79f19f252d9077696d3ef0823a ]
When accessing an MDIO register using single-byte smbus accesses, we have to perform 2 consecutive operations targeting the same address, first accessing the MSB then the LSB of the 16 bit register:
read_1_byte(addr); <- returns MSB of register at address 'addr' read_1_byte(addr); <- returns LSB
Some PHY devices present in SFP such as the Broadcom 5461 don't like seeing foreign i2c transactions in-between these 2 smbus accesses, and will return the MSB a second time when trying to read the LSB :
read_1_byte(addr); <- returns MSB
i2c_transaction_for_other_device_on_the_bus();
read_1_byte(addr); <- returns MSB again
Given the already fragile nature of accessing PHYs/SFPs with single-byte smbus accesses, it's safe to say that this Broadcom PHY may not be the only one acting like this.
Let's therefore hold the i2c bus lock while performing our smbus transactions to avoid interleaved accesses.
--- drivers/net/mdio/mdio-i2c.c | 39 ++++++++++++++++++++++++------------- 1 file changed, 25 insertions(+), 14 deletions(-)
drivers/net/mdio/mdio-i2c.c +25 -14
@@ -116,17 +116,23 @@ static int smbus_byte_mii_read_default_c22(struct mii_bus *bus, int phy_id,if (!i2c_mii_valid_phy_id (phy_id))return 0 ; - ret =i2c_smbus_xfer (i2c,i2c_mii_phy_addr (phy_id),0 , -I2C_SMBUS_READ , reg, -I2C_SMBUS_BYTE_DATA , &smbus_data); +i2c_lock_bus (i2c,I2C_LOCK_SEGMENT ); + + ret =__i2c_smbus_xfer (i2c,i2c_mii_phy_addr (phy_id),0 , +I2C_SMBUS_READ , reg, +I2C_SMBUS_BYTE_DATA , &smbus_data);if (ret <0 ) -return ret; + goto unlock; val = (smbus_data.byte &0xff ) <<8 ; - ret =i2c_smbus_xfer (i2c,i2c_mii_phy_addr (phy_id),0 , -I2C_SMBUS_READ , reg, -I2C_SMBUS_BYTE_DATA , &smbus_data); + ret =__i2c_smbus_xfer (i2c,i2c_mii_phy_addr (phy_id),0 , +I2C_SMBUS_READ , reg, +I2C_SMBUS_BYTE_DATA , &smbus_data); + +unlock: +i2c_unlock_bus (i2c,I2C_LOCK_SEGMENT ); +if (ret <0 )return ret;
@@ -147,17 +153,22 @@ static int smbus_byte_mii_write_default_c22(struct mii_bus *bus, int phy_id, smbus_data.byte = (val &0xff00 ) >>8 ; - ret =i2c_smbus_xfer (i2c,i2c_mii_phy_addr (phy_id),0 , -I2C_SMBUS_WRITE , reg, -I2C_SMBUS_BYTE_DATA , &smbus_data); +i2c_lock_bus (i2c,I2C_LOCK_SEGMENT ); + + ret =__i2c_smbus_xfer (i2c,i2c_mii_phy_addr (phy_id),0 , +I2C_SMBUS_WRITE , reg, +I2C_SMBUS_BYTE_DATA , &smbus_data);if (ret <0 ) -return ret; + goto unlock; smbus_data.byte = val &0xff ; - ret =i2c_smbus_xfer (i2c,i2c_mii_phy_addr (phy_id),0 , -I2C_SMBUS_WRITE , reg, -I2C_SMBUS_BYTE_DATA , &smbus_data); + ret =__i2c_smbus_xfer (i2c,i2c_mii_phy_addr (phy_id),0 , +I2C_SMBUS_WRITE , reg, +I2C_SMBUS_BYTE_DATA , &smbus_data); + +unlock: +i2c_unlock_bus (i2c,I2C_LOCK_SEGMENT );return ret <0 ? ret :0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 104/371 net: sparx5/lan969x: fix flooding configuration on bridge join/leave
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Machon <[email protected]>
[ Upstream commit c9d1b0b54258ba13b567dd116ead3c7c30cba7d8 ]
The sparx5 driver programs UC/MC/BC flooding in sparx5_update_fwd() by unconditionally applying bridge_fwd_mask to all flood PGIDs. Any bridge topology change that triggers sparx5_update_fwd() (for example enslaving another port) therefore reinstalls flooding in hardware for already bridged ports, regardless of their per-port flood flags.
This results in clobbering of the flood masks, and desynchronization between software and hardware: the bridge still reports “flood off” for the port, but hardware has flooding enabled due to unconditional PGID reprogramming.
Steps to reproduce:
$ ip link add br0 type bridge
$ ip link set br0 up
$ ip link set eth0 master br0
$ ip link set eth0 up
$ bridge link set dev eth0 flood off
$ ip link set eth1 master br0
$ ip link set eth1 upAt this point, flooding is silently re-enabled for eth0. Software still shows “flood off” for eth0, but hardware has flooding enabled.
To fix this, flooding is now set explicitly during bridge join/leave, through sparx5_port_attr_bridge_flags():
On bridge join, UC/MC/BC flooding is enabled by default.
On bridge leave, UC/MC/BC flooding is disabled.
sparx5_update_fwd() no longer touches the flood PGIDs, clobbering the flood masks, and desynchronizing software and hardware.
Initialization of the flooding PGIDs have been moved to sparx5_start(). This is required as flooding PGIDs defaults to 0x3fffffff in hardware and the initialization was previously handled in sparx5_update_fwd(), which was removed.
With this change, user-configured flooding flags persist across bridge updates and are no longer overridden by sparx5_update_fwd().
--- drivers/net/ethernet/microchip/sparx5/sparx5_main.c | 5 +++++ .../net/ethernet/microchip/sparx5/sparx5_switchdev.c | 12 ++++++++++++ drivers/net/ethernet/microchip/sparx5/sparx5_vlan.c | 10 ---------- 3 files changed, 17 insertions(+), 10 deletions(-)
drivers/net/ethernet/microchip/sparx5/sparx5_main.c +5 -0
@@ -708,6 +708,11 @@ static int sparx5_start(struct sparx5 *sparx5)/* Init masks */ sparx5_update_fwd (sparx5); +/* Init flood masks */ +for (int pgid =sparx5_get_pgid (sparx5,PGID_UC_FLOOD ); + pgid <=sparx5_get_pgid (sparx5,PGID_BCAST ); pgid++) +sparx5_pgid_clear (sparx5, pgid); +/* CPU copy CPU pgids */ spx5_wr (ANA_AC_PGID_MISC_CFG_PGID_CPU_COPY_ENA_SET (1 ), sparx5,ANA_AC_PGID_MISC_CFG (sparx5_get_pgid (sparx5,PGID_CPU )));
drivers/net/ethernet/microchip/sparx5/sparx5_switchdev.c +12 -0
@@ -176,6 +176,7 @@ static int sparx5_port_bridge_join(struct sparx5_port *port,struct net_device *bridge, struct netlink_ext_ack *extack) { + struct switchdev_brport_flags flags = {0};struct sparx5 *sparx5 = port->sparx5;struct net_device *ndev = port->ndev;int err;
@@ -205,6 +206,11 @@ static int sparx5_port_bridge_join(struct sparx5_port *port,*/ __dev_mc_unsync (ndev, sparx5_mc_unsync); +/* Enable uc/mc/bc flooding */ + flags.mask =BR_FLOOD |BR_MCAST_FLOOD |BR_BCAST_FLOOD ; + flags.val = flags.mask; +sparx5_port_attr_bridge_flags (port, flags); +return 0 ; err_switchdev_offload:
@@ -215,6 +221,7 @@ static int sparx5_port_bridge_join(struct sparx5_port *port,static void sparx5_port_bridge_leave (struct sparx5_port *port,struct net_device *bridge) { +struct switchdev_brport_flags flags = {0 };struct sparx5 *sparx5 = port->sparx5;switchdev_bridge_port_unoffload (port->ndev,NULL ,NULL ,NULL );
@@ -234,6 +241,11 @@ static void sparx5_port_bridge_leave(struct sparx5_port *port,/* Port enters in host more therefore restore mc list */ __dev_mc_sync (port->ndev, sparx5_mc_sync, sparx5_mc_unsync); + +/* Disable uc/mc/bc flooding */ + flags.mask =BR_FLOOD |BR_MCAST_FLOOD |BR_BCAST_FLOOD ; + flags.val =0 ; +sparx5_port_attr_bridge_flags (port, flags); } static int sparx5_port_changeupper(struct net_device *dev,
drivers/net/ethernet/microchip/sparx5/sparx5_vlan.c +0 -10
@@ -167,16 +167,6 @@ void sparx5_update_fwd(struct sparx5 *sparx5)/* Divide up fwd mask in 32 bit words */ bitmap_to_arr32 (mask, sparx5->bridge_fwd_mask,SPX5_PORTS ); -/* Update flood masks */ -for (port =sparx5_get_pgid (sparx5,PGID_UC_FLOOD ); - port <=sparx5_get_pgid (sparx5,PGID_BCAST ); port++) { -spx5_wr (mask[0 ], sparx5,ANA_AC_PGID_CFG (port)); -if (is_sparx5 (sparx5)) { -spx5_wr (mask[1 ], sparx5,ANA_AC_PGID_CFG1 (port)); -spx5_wr (mask[2 ], sparx5,ANA_AC_PGID_CFG2 (port)); - } - } -/* Update SRC masks */ for (port =0 ; port < sparx5->data->consts->n_ports; port++) {if (test_bit (port, sparx5->bridge_fwd_mask)) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 105/371 net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carolina Jubran <[email protected]>
[ Upstream commit 7593439c13933164f701eed9c83d89358f203469 ]
When creating IPsec flow tables with tunnel mode enabled, the driver uses mlx5_eswitch_block_encap() to prevent tunnel encapsulation conflicts across different domains (NIC_RX/NIC_TX and FDB), since the firmware doesn’t allow both at the same time.
Currently, the driver attempts to reserve tunnel mode unconditionally for both NIC and FDB IPsec tables. This can lead to conflicting tunnel mode setups, for example, if a flow table was created in the FDB domain with tunnel offload enabled, and we later try to create another one in the NIC, or vice versa.
To resolve this, adjust the blocking logic so that tunnel mode is only reserved by NIC flows. This ensures that tunnel offload is exclusively used in either the NIC or the FDB, and avoids unintended offload conflicts.
--- .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 8 ++++++-- .../net/ethernet/mellanox/mlx5/core/eswitch.h | 5 +++-- .../mellanox/mlx5/core/eswitch_offloads.c | 18 ++++++++++-------- 3 files changed, 19 insertions(+), 12 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c +6 -2
@@ -1045,7 +1045,9 @@ static int rx_create(struct mlx5_core_dev *mdev, struct mlx5e_ipsec *ipsec,/* Create FT */ if (mlx5_ipsec_device_caps (mdev) &MLX5_IPSEC_CAP_TUNNEL ) - rx->allow_tunnel_mode =mlx5_eswitch_block_encap (mdev); + rx->allow_tunnel_mode = +mlx5_eswitch_block_encap (mdev, rx == ipsec->rx_esw); +if (rx->allow_tunnel_mode) flags =MLX5_FLOW_TABLE_TUNNEL_EN_REFORMAT ; ft =ipsec_ft_create (attr.ns, attr.sa_level, attr.prio,1 ,2 , flags);
@@ -1286,7 +1288,9 @@ static int tx_create(struct mlx5e_ipsec *ipsec, struct mlx5e_ipsec_tx *tx, goto err_status_rule;if (mlx5_ipsec_device_caps (mdev) &MLX5_IPSEC_CAP_TUNNEL ) - tx->allow_tunnel_mode =mlx5_eswitch_block_encap (mdev); + tx->allow_tunnel_mode = +mlx5_eswitch_block_encap (mdev, tx == ipsec->tx_esw); +if (tx->allow_tunnel_mode) flags =MLX5_FLOW_TABLE_TUNNEL_EN_REFORMAT ; ft =ipsec_ft_create (tx->ns, attr.sa_level, attr.prio,1 ,4 , flags);
drivers/net/ethernet/mellanox/mlx5/core/eswitch.h +3 -2
@@ -851,7 +851,7 @@ void mlx5_eswitch_offloads_single_fdb_del_one(struct mlx5_eswitch *master_esw, struct mlx5_eswitch *slave_esw);int mlx5_eswitch_reload_ib_reps (struct mlx5_eswitch *esw); -bool mlx5_eswitch_block_encap (struct mlx5_core_dev *dev); +bool mlx5_eswitch_block_encap (struct mlx5_core_dev *dev,bool from_fdb);void mlx5_eswitch_unblock_encap (struct mlx5_core_dev *dev);int mlx5_eswitch_block_mode (struct mlx5_core_dev *dev);
@@ -943,7 +943,8 @@ mlx5_eswitch_reload_ib_reps(struct mlx5_eswitch *esw)return 0 ; } -static inline bool mlx5_eswitch_block_encap (struct mlx5_core_dev *dev) +static inline bool +mlx5_eswitch_block_encap (struct mlx5_core_dev *dev,bool from_fdb) {return true; }
drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +10 -8
@@ -3938,23 +3938,25 @@ int mlx5_devlink_eswitch_inline_mode_get(struct devlink *devlink, u8 *mode)return esw_inline_mode_to_devlink (esw->offloads.inline_mode, mode); } -bool mlx5_eswitch_block_encap (struct mlx5_core_dev *dev) +bool mlx5_eswitch_block_encap (struct mlx5_core_dev *dev,bool from_fdb) {struct mlx5_eswitch *esw = dev->priv.eswitch; +enum devlink_eswitch_encap_mode encap; +bool allow_tunnel = false;if (!mlx5_esw_allowed (esw))return true;down_write (&esw->mode_lock); -if (esw->mode !=MLX5_ESWITCH_LEGACY && - esw->offloads.encap !=DEVLINK_ESWITCH_ENCAP_MODE_NONE ) { -up_write (&esw->mode_lock); -return false; + encap = esw->offloads.encap; +if (esw->mode ==MLX5_ESWITCH_LEGACY || + (encap ==DEVLINK_ESWITCH_ENCAP_MODE_NONE && !from_fdb)) { + allow_tunnel = true; + esw->offloads.num_block_encap++; } - - esw->offloads.num_block_encap++;up_write (&esw->mode_lock); -return true; + +return allow_tunnel; }void mlx5_eswitch_unblock_encap (struct mlx5_core_dev *dev)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 106/371 net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carolina Jubran <[email protected]>
[ Upstream commit 22239eb258bc1e6ccdb2d3502fce1cc2b2a88386 ]
When configuring IPsec packet offload in tunnel mode, the driver tries to create tunnel reformat objects unconditionally. This is incorrect, because tunnel mode is only permitted under specific encapsulation settings, and that decision is already made when the flow table is created.
The offending commit attempted to block this case in the state add path, but the check there happens too late and does not prevent the reformat from being configured.
Fix by taking short reservations for both the eswitch mode and the encap at the start of state setup. This preserves the block ordering (mode --> encap) used later: the mode is blocked during RX/TX get, and the encap is blocked during flow-table creation. This lets us fail early if either reservation cannot be obtained, it means a mode transition is underway or a conflicting configuration already owns encap. If both succeed, the flow-table path later takes the ownership and the reservations are released on exit.
--- .../mellanox/mlx5/core/en_accel/ipsec.c | 38 +++++++++++++------ .../mellanox/mlx5/core/en_accel/ipsec.h | 2 +- .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 24 +++++++----- 3 files changed, 43 insertions(+), 21 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c +27 -11
@@ -772,6 +772,7 @@ static int mlx5e_xfrm_add_state(struct net_device *dev, struct netlink_ext_ack *extack) {struct mlx5e_ipsec_sa_entry *sa_entry =NULL ; +bool allow_tunnel_mode = false;struct mlx5e_ipsec *ipsec;struct mlx5e_priv *priv;gfp_t gfp;
@@ -803,6 +804,20 @@ static int mlx5e_xfrm_add_state(struct net_device *dev, goto err_xfrm; } +if (mlx5_eswitch_block_mode (priv->mdev)) + goto unblock_ipsec; + +if (x->props.mode ==XFRM_MODE_TUNNEL && + x->xso.type ==XFRM_DEV_OFFLOAD_PACKET ) { + allow_tunnel_mode =mlx5e_ipsec_fs_tunnel_allowed (sa_entry); +if (!allow_tunnel_mode) { +NL_SET_ERR_MSG_MOD (extack, +"Packet offload tunnel mode is disabled due to encap settings" ); + err = -EINVAL ; + goto unblock_mode; + } + } +/* check esn */ if (x->props.flags &XFRM_STATE_ESN )mlx5e_ipsec_update_esn_state (sa_entry);
@@ -817,7 +832,7 @@ static int mlx5e_xfrm_add_state(struct net_device *dev, err =mlx5_ipsec_create_work (sa_entry);if (err) - goto unblock_ipsec; + goto unblock_encap; err =mlx5e_ipsec_create_dwork (sa_entry);if (err)
@@ -832,14 +847,6 @@ static int mlx5e_xfrm_add_state(struct net_device *dev,if (err) goto err_hw_ctx; -if (x->props.mode ==XFRM_MODE_TUNNEL && - x->xso.type ==XFRM_DEV_OFFLOAD_PACKET && - !mlx5e_ipsec_fs_tunnel_enabled (sa_entry)) { -NL_SET_ERR_MSG_MOD (extack,"Packet offload tunnel mode is disabled due to encap settings" ); - err = -EINVAL ; - goto err_add_rule; - } -/* We use *_bh() variant because xfrm_timer_handler(), which runs * in softirq context, can reach our state delete logic and we need * xa_erase_bh() there.
@@ -855,8 +862,7 @@ static int mlx5e_xfrm_add_state(struct net_device *dev,queue_delayed_work (ipsec->wq, &sa_entry->dwork->dwork,MLX5_IPSEC_RESCHED ); -if (x->xso.type ==XFRM_DEV_OFFLOAD_PACKET && - x->props.mode ==XFRM_MODE_TUNNEL ) { +if (allow_tunnel_mode) {xa_lock_bh (&ipsec->sadb);__xa_set_mark (&ipsec->sadb, sa_entry->ipsec_obj_id,MLX5E_IPSEC_TUNNEL_SA );
@@ -865,6 +871,11 @@ static int mlx5e_xfrm_add_state(struct net_device *dev, out: x->xso.offload_handle = (unsigned long )sa_entry; +if (allow_tunnel_mode) +mlx5_eswitch_unblock_encap (priv->mdev); + +mlx5_eswitch_unblock_mode (priv->mdev); +return 0 ; err_add_rule:
@@ -877,6 +888,11 @@ static int mlx5e_xfrm_add_state(struct net_device *dev,if (sa_entry->work)kfree (sa_entry->work->data);kfree (sa_entry->work); +unblock_encap: +if (allow_tunnel_mode) +mlx5_eswitch_unblock_encap (priv->mdev); +unblock_mode: +mlx5_eswitch_unblock_mode (priv->mdev); unblock_ipsec:mlx5_eswitch_unblock_ipsec (priv->mdev); err_xfrm:
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h +1 -1
@@ -319,7 +319,7 @@ void mlx5e_accel_ipsec_fs_del_rule(struct mlx5e_ipsec_sa_entry *sa_entry);int mlx5e_accel_ipsec_fs_add_pol (struct mlx5e_ipsec_pol_entry *pol_entry);void mlx5e_accel_ipsec_fs_del_pol (struct mlx5e_ipsec_pol_entry *pol_entry);void mlx5e_accel_ipsec_fs_modify (struct mlx5e_ipsec_sa_entry *sa_entry); -bool mlx5e_ipsec_fs_tunnel_enabled (struct mlx5e_ipsec_sa_entry *sa_entry); +bool mlx5e_ipsec_fs_tunnel_allowed (struct mlx5e_ipsec_sa_entry *sa_entry);int mlx5_ipsec_create_sa_ctx (struct mlx5e_ipsec_sa_entry *sa_entry);void mlx5_ipsec_free_sa_ctx (struct mlx5e_ipsec_sa_entry *sa_entry);
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c +15 -9
@@ -2826,18 +2826,24 @@ void mlx5e_accel_ipsec_fs_modify(struct mlx5e_ipsec_sa_entry *sa_entry)memcpy (sa_entry, &sa_entry_shadow,sizeof (*sa_entry)); } -bool mlx5e_ipsec_fs_tunnel_enabled (struct mlx5e_ipsec_sa_entry *sa_entry) +bool mlx5e_ipsec_fs_tunnel_allowed (struct mlx5e_ipsec_sa_entry *sa_entry) { -struct mlx5_accel_esp_xfrm_attrs *attrs = &sa_entry->attrs; -struct mlx5e_ipsec_rx *rx; -struct mlx5e_ipsec_tx *tx; +struct mlx5e_ipsec *ipsec = sa_entry->ipsec; +struct xfrm_state *x = sa_entry->x; +bool from_fdb; - rx =ipsec_rx (sa_entry->ipsec, attrs->addrs.family, attrs->type); - tx =ipsec_tx (sa_entry->ipsec, attrs->type); -if (sa_entry->attrs.dir ==XFRM_DEV_OFFLOAD_OUT ) -return tx->allow_tunnel_mode; +if (x->xso.dir ==XFRM_DEV_OFFLOAD_OUT ) { +struct mlx5e_ipsec_tx *tx =ipsec_tx (ipsec, x->xso.type); + + from_fdb = (tx == ipsec->tx_esw); + }else { +struct mlx5e_ipsec_rx *rx =ipsec_rx (ipsec, x->props.family, + x->xso.type); + + from_fdb = (rx == ipsec->rx_esw); + } -return rx->allow_tunnel_mode; +return mlx5_eswitch_block_encap (ipsec->mdev, from_fdb); } void mlx5e_ipsec_handle_mpv_event(int event, struct mlx5e_priv *slave_priv,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 107/371 mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason-JH Lin <[email protected]>
[ Upstream commit 3f39f56520374cf56872644acf9afcc618a4b674 ]
pm_runtime_get_sync() and pm_runtime_put_autosuspend() were previously called in cmdq_mbox_send_data(), which is under a spinlock in msg_submit() (mailbox.c). This caused lockdep warnings such as "sleeping function called from invalid context" when running with lockdebug enabled.
The BUG report:
BUG: sleeping function called from invalid context at drivers/base/power/runtime.c:1164
in_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: 3616, name: kworker/u17:3
preempt_count: 1, expected: 0
RCU nest depth: 0, expected: 0
INFO: lockdep is turned off.
irq event stamp: 0
CPU: 1 PID: 3616 Comm: kworker/u17:3 Not tainted 6.1.87-lockdep-14133-g26e933aca785 #1
Hardware name: Google Ciri sku0/unprovisioned board (DT)
Workqueue: imgsys_runner imgsys_runner_func
Call trace:
dump_backtrace+0x100/0x120
show_stack+0x20/0x2c
dump_stack_lvl+0x84/0xb4
dump_stack+0x18/0x48
__might_resched+0x354/0x4c0
__might_sleep+0x98/0xe4
__pm_runtime_resume+0x70/0x124
cmdq_mbox_send_data+0xe4/0xb1c
msg_submit+0x194/0x2dc
mbox_send_message+0x190/0x330
imgsys_cmdq_sendtask+0x1618/0x2224
imgsys_runner_func+0xac/0x11c
process_one_work+0x638/0xf84
worker_thread+0x808/0xcd0
kthread+0x24c/0x324
ret_from_fork+0x10/0x20Additionally, pm_runtime_put_autosuspend() should be invoked from the GCE IRQ handler to ensure the hardware has actually completed its work.
To resolve these issues, remove the pm_runtime calls from cmdq_mbox_send_data() and delegate power management responsibilities to the client driver.
--- drivers/mailbox/mtk-cmdq-mailbox.c | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-)
drivers/mailbox/mtk-cmdq-mailbox.c +1 -11
@@ -379,20 +379,13 @@ static int cmdq_mbox_send_data(struct mbox_chan *chan, void *data)struct cmdq *cmdq =dev_get_drvdata (chan->mbox->dev);struct cmdq_task *task;unsigned long curr_pa, end_pa; -int ret;/* Client should not flush new tasks if suspended. */ WARN_ON (cmdq->suspended); - ret =pm_runtime_get_sync (cmdq->mbox.dev); -if (ret <0 ) -return ret; - task =kzalloc (sizeof (*task),GFP_ATOMIC ); -if (!task) { -pm_runtime_put_autosuspend (cmdq->mbox.dev); +if (!task)return -ENOMEM ; - } task->cmdq = cmdq;INIT_LIST_HEAD (&task->list_entry);
@@ -439,9 +432,6 @@ static int cmdq_mbox_send_data(struct mbox_chan *chan, void *data) }list_move_tail (&task->list_entry, &thread->task_busy_list); -pm_runtime_mark_last_busy (cmdq->mbox.dev); -pm_runtime_put_autosuspend (cmdq->mbox.dev); -return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 108/371 drm/amdgpu: Add additional DCE6 SCL registers
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit 507296328b36ffd00ec1f4fde5b8acafb7222ec7 ]
--- drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h | 7 +++++++ drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h | 2 ++ 2 files changed, 9 insertions(+)
drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h +7 -0
@@ -4115,6 +4115,7 @@#define mmSCL0_SCL_COEF_RAM_CONFLICT_STATUS 0x1B55#define mmSCL0_SCL_COEF_RAM_SELECT 0x1B40#define mmSCL0_SCL_COEF_RAM_TAP_DATA 0x1B41 +#define mmSCL0_SCL_SCALER_ENABLE 0x1B42#define mmSCL0_SCL_CONTROL 0x1B44#define mmSCL0_SCL_DEBUG 0x1B6A#define mmSCL0_SCL_DEBUG2 0x1B69
@@ -4144,6 +4145,7 @@#define mmSCL1_SCL_COEF_RAM_CONFLICT_STATUS 0x1E55#define mmSCL1_SCL_COEF_RAM_SELECT 0x1E40#define mmSCL1_SCL_COEF_RAM_TAP_DATA 0x1E41 +#define mmSCL1_SCL_SCALER_ENABLE 0x1E42#define mmSCL1_SCL_CONTROL 0x1E44#define mmSCL1_SCL_DEBUG 0x1E6A#define mmSCL1_SCL_DEBUG2 0x1E69
@@ -4173,6 +4175,7 @@#define mmSCL2_SCL_COEF_RAM_CONFLICT_STATUS 0x4155#define mmSCL2_SCL_COEF_RAM_SELECT 0x4140#define mmSCL2_SCL_COEF_RAM_TAP_DATA 0x4141 +#define mmSCL2_SCL_SCALER_ENABLE 0x4142#define mmSCL2_SCL_CONTROL 0x4144#define mmSCL2_SCL_DEBUG 0x416A#define mmSCL2_SCL_DEBUG2 0x4169
@@ -4202,6 +4205,7 @@#define mmSCL3_SCL_COEF_RAM_CONFLICT_STATUS 0x4455#define mmSCL3_SCL_COEF_RAM_SELECT 0x4440#define mmSCL3_SCL_COEF_RAM_TAP_DATA 0x4441 +#define mmSCL3_SCL_SCALER_ENABLE 0x4442#define mmSCL3_SCL_CONTROL 0x4444#define mmSCL3_SCL_DEBUG 0x446A#define mmSCL3_SCL_DEBUG2 0x4469
@@ -4231,6 +4235,7 @@#define mmSCL4_SCL_COEF_RAM_CONFLICT_STATUS 0x4755#define mmSCL4_SCL_COEF_RAM_SELECT 0x4740#define mmSCL4_SCL_COEF_RAM_TAP_DATA 0x4741 +#define mmSCL4_SCL_SCALER_ENABLE 0x4742#define mmSCL4_SCL_CONTROL 0x4744#define mmSCL4_SCL_DEBUG 0x476A#define mmSCL4_SCL_DEBUG2 0x4769
@@ -4260,6 +4265,7 @@#define mmSCL5_SCL_COEF_RAM_CONFLICT_STATUS 0x4A55#define mmSCL5_SCL_COEF_RAM_SELECT 0x4A40#define mmSCL5_SCL_COEF_RAM_TAP_DATA 0x4A41 +#define mmSCL5_SCL_SCALER_ENABLE 0x4A42#define mmSCL5_SCL_CONTROL 0x4A44#define mmSCL5_SCL_DEBUG 0x4A6A#define mmSCL5_SCL_DEBUG2 0x4A69
@@ -4287,6 +4293,7 @@#define mmSCL_COEF_RAM_CONFLICT_STATUS 0x1B55#define mmSCL_COEF_RAM_SELECT 0x1B40#define mmSCL_COEF_RAM_TAP_DATA 0x1B41 +#define mmSCL_SCALER_ENABLE 0x1B42#define mmSCL_CONTROL 0x1B44#define mmSCL_DEBUG 0x1B6A#define mmSCL_DEBUG2 0x1B69
drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h +2 -0
@@ -8650,6 +8650,8 @@#define REGAMMA_LUT_INDEX__REGAMMA_LUT_INDEX__SHIFT 0x00000000#define REGAMMA_LUT_WRITE_EN_MASK__REGAMMA_LUT_WRITE_EN_MASK_MASK 0x00000007L#define REGAMMA_LUT_WRITE_EN_MASK__REGAMMA_LUT_WRITE_EN_MASK__SHIFT 0x00000000 +#define SCL_SCALER_ENABLE__SCL_SCALE_EN_MASK 0x00000001L +#define SCL_SCALER_ENABLE__SCL_SCALE_EN__SHIFT 0x00000000#define SCL_ALU_CONTROL__SCL_ALU_DISABLE_MASK 0x00000001L#define SCL_ALU_CONTROL__SCL_ALU_DISABLE__SHIFT 0x00000000#define SCL_BYPASS_CONTROL__SCL_BYPASS_MODE_MASK 0x00000003L
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 109/371 drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit d60f9c45d1bff7e20ecd57492ef7a5e33c94a37c ]
Without these, it's impossible to program these registers.
--- drivers/gpu/drm/amd/display/dc/dce/dce_transform.h | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/display/dc/dce/dce_transform.h +2 -0
@@ -155,6 +155,8 @@SRI (SCL_COEF_RAM_TAP_DATA ,SCL , id), \SRI (VIEWPORT_START ,SCL , id), \SRI (VIEWPORT_SIZE ,SCL , id), \ +SRI (SCL_HORZ_FILTER_INIT_RGB_LUMA ,SCL , id), \ +SRI (SCL_HORZ_FILTER_INIT_CHROMA ,SCL , id), \SRI (SCL_HORZ_FILTER_SCALE_RATIO ,SCL , id), \SRI (SCL_VERT_FILTER_SCALE_RATIO ,SCL , id), \ SRI(SCL_VERT_FILTER_INIT, SCL, id), \
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 110/371 drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit c0aa7cf49dd6cb302fe28e7183992b772cb7420c ]
Previously, the code would set a bit field which didn't exist on DCE6 so it would be effectively a no-op.
--- drivers/gpu/drm/amd/display/dc/dce/dce_transform.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/display/dc/dce/dce_transform.c +2 -4
@@ -527,8 +527,7 @@ static void dce60_transform_set_scaler(if (coeffs_v != xfm_dce->filter_v || coeffs_h != xfm_dce->filter_h) {/* 4. Program vertical filters */ if (xfm_dce->filter_v ==NULL ) -REG_SET (SCL_VERT_FILTER_CONTROL ,0 , -SCL_V_2TAP_HARDCODE_COEF_EN ,0 ); +REG_WRITE (SCL_VERT_FILTER_CONTROL ,0 ); program_multi_taps_filter( xfm_dce, data->taps.v_taps,
@@ -542,8 +541,7 @@ static void dce60_transform_set_scaler(/* 5. Program horizontal filters */ if (xfm_dce->filter_h ==NULL ) -REG_SET (SCL_HORZ_FILTER_CONTROL ,0 , -SCL_H_2TAP_HARDCODE_COEF_EN ,0 ); +REG_WRITE (SCL_HORZ_FILTER_CONTROL ,0 ); program_multi_taps_filter( xfm_dce, data->taps.h_taps,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 111/371 drm/amd/display: Properly disable scaling on DCE6
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit a7dc87f3448bea5ebe054f14e861074b9c289c65 ]
SCL_SCALER_ENABLE can be used to enable/disable the scaler on DCE6. Program it to 0 when scaling isn't used, 1 when used. Additionally, clear some other registers when scaling is disabled and program the SCL_UPDATE register as recommended.
This fixes visible glitches for users whose BIOS sets up a mode with scaling at boot, which DC was unable to clean up.
--- .../gpu/drm/amd/display/dc/dce/dce_transform.c | 15 +++++++++++---- .../gpu/drm/amd/display/dc/dce/dce_transform.h | 2 ++ 2 files changed, 13 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/display/dc/dce/dce_transform.c +11 -4
@@ -154,10 +154,13 @@ static bool dce60_setup_scaling_configuration(REG_SET (SCL_BYPASS_CONTROL ,0 ,SCL_BYPASS_MODE ,0 );if (data->taps.h_taps + data->taps.v_taps <=2 ) { -/* Set bypass */ - -/* DCE6 has no SCL_MODE register, skip scale mode programming */ +/* Disable scaler functionality */ +REG_WRITE (SCL_SCALER_ENABLE ,0 ); +/* Clear registers that can cause glitches even when the scaler is off */ +REG_WRITE (SCL_TAP_CONTROL ,0 ); +REG_WRITE (SCL_AUTOMATIC_MODE_CONTROL ,0 ); +REG_WRITE (SCL_F_SHARP_CONTROL ,0 );return false; }
@@ -165,7 +168,7 @@ static bool dce60_setup_scaling_configuration(SCL_H_NUM_OF_TAPS , data->taps.h_taps -1 , SCL_V_NUM_OF_TAPS, data->taps.v_taps - 1); -/* DCE6 has no SCL_MODE register, skip scale mode programming */ +REG_WRITE (SCL_SCALER_ENABLE ,1 );/* DCE6 has no SCL_BOUNDARY_MODE bit, skip replace out of bound pixels */
@@ -502,6 +505,8 @@ static void dce60_transform_set_scaler(REG_SET (DC_LB_MEM_SIZE ,0 ,DC_LB_MEM_SIZE , xfm_dce->lb_memory_size); +REG_WRITE (SCL_UPDATE ,0x00010000 ); +/* Clear SCL_F_SHARP_CONTROL value to 0 */ REG_WRITE (SCL_F_SHARP_CONTROL ,0 );
@@ -564,6 +569,8 @@ static void dce60_transform_set_scaler(/* DCE6 has no SCL_COEF_UPDATE_COMPLETE bit to flip to new coefficient memory */ /* DCE6 DATA_FORMAT register does not support ALPHA_EN */ + + REG_WRITE(SCL_UPDATE, 0); }#endif
drivers/gpu/drm/amd/display/dc/dce/dce_transform.h +2 -0
@@ -155,6 +155,7 @@SRI (SCL_COEF_RAM_TAP_DATA ,SCL , id), \SRI (VIEWPORT_START ,SCL , id), \SRI (VIEWPORT_SIZE ,SCL , id), \ +SRI (SCL_SCALER_ENABLE ,SCL , id), \SRI (SCL_HORZ_FILTER_INIT_RGB_LUMA ,SCL , id), \SRI (SCL_HORZ_FILTER_INIT_CHROMA ,SCL , id), \ SRI(SCL_HORZ_FILTER_SCALE_RATIO, SCL, id), \
@@ -592,6 +593,7 @@ struct dce_transform_registers {uint32_t SCL_VERT_FILTER_SCALE_RATIO ;uint32_t SCL_HORZ_FILTER_INIT ;#if defined(CONFIG_DRM_AMD_DC_SI ) +uint32_t SCL_SCALER_ENABLE ;uint32_t SCL_HORZ_FILTER_INIT_RGB_LUMA ;uint32_t SCL_HORZ_FILTER_INIT_CHROMA ;#endif
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 112/371 drm/amd/display: Disable scaling on DCE6 for now
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit 0e190a0446ec517666dab4691b296a9b758e590f ]
Scaling doesn't work on DCE6 at the moment, the current register programming produces incorrect output when using fractional scaling (between 100-200%) on resolutions higher than 1080p.
Disable it until we figure out how to program it properly.
--- .../gpu/drm/amd/display/dc/resource/dce60/dce60_resource.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/resource/dce60/dce60_resource.c +2 -2
@@ -403,13 +403,13 @@ static const struct dc_plane_cap plane_cap = { }, .max_upscale_factor = { - .argb8888 = 16000, + .argb8888 = 1, .nv12 = 1, .fp16 =1 }, .max_downscale_factor = { - .argb8888 = 250, + .argb8888 = 1, .nv12 = 1, .fp16 =1 }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 113/371 drm/amdkfd: Fix kfd process ref leaking when userptr unmapping
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philip Yang <[email protected]>
[ Upstream commit 58e6fc2fb94f0f409447e5d46cf6a417b6397fbc ]
kfd_lookup_process_by_pid hold the kfd process reference to ensure it doesn't get destroyed while sending the segfault event to user space.
Calling kfd_lookup_process_by_pid as function parameter leaks the kfd process refcount and miss the NULL pointer check if app process is already destroyed.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c +7 -2
@@ -2583,12 +2583,17 @@ static int update_invalid_user_pages(struct amdkfd_process_info *process_info,* from the KFD, trigger a segmentation fault in VM debug mode. */ if (amdgpu_ttm_adev (bo->tbo.bdev)->debug_vm_userptr) { +struct kfd_process *p; +pr_err ("Pid %d unmapped memory before destroying userptr at GPU addr 0x%llx\n" ,pid_nr (process_info->pid), mem->va);// Send GPU VM fault to user space -kfd_signal_vm_fault_event_with_userptr (kfd_lookup_process_by_pid (process_info->pid), - mem->va); + p =kfd_lookup_process_by_pid (process_info->pid); +if (p) { +kfd_signal_vm_fault_event_with_userptr (p, mem->va); +kfd_unref_process (p); + } } ret =0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 114/371 net: pse-pd: tps23881: Fix current measurement scaling
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Wismer <[email protected]>
[ Upstream commit 2c95a756e0cfc19af6d0b32b0c6cf3bada334998 ]
The TPS23881 improves on the TPS23880 with current sense resistors reduced from 255 mOhm to 200 mOhm. This has a direct impact on the scaling of the current measurement. However, the latest TPS23881 data sheet from May 2023 still shows the scaling of the TPS23880 model.
--- drivers/net/pse-pd/tps23881.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/pse-pd/tps23881.c +1 -1
@@ -62,7 +62,7 @@#define TPS23881_REG_SRAM_DATA 0x61#define TPS23881_UV_STEP 3662 -#define TPS23881_NA_STEP 70190 +#define TPS23881_NA_STEP 89500#define TPS23881_MW_STEP 500#define TPS23881_MIN_PI_PW_LIMIT_MW 2000
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 115/371 crypto: skcipher - Fix reqsize handling
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: T Pratham <[email protected]>
[ Upstream commit 229c586b5e86979badb7cb0d38717b88a9e95ddd ]
Commit afddce13ce81d ("crypto: api - Add reqsize to crypto_alg") introduced cra_reqsize field in crypto_alg struct to replace type specific reqsize fields. It looks like this was introduced specifically for ahash and acomp from the commit description as subsequent commits add necessary changes in these alg frameworks.
However, this is being recommended for use in all crypto algs [1] instead of setting reqsize using crypto_*_set_reqsize(). Using cra_reqsize in skcipher algorithms, hence, causes memory corruptions and crashes as the underlying functions in the algorithm framework have not been updated to set the reqsize properly from cra_reqsize. [2]
Add proper set_reqsize calls in the skcipher init function to properly initialize reqsize for these algorithms in the framework.
[1]: https://lore.kernel.org/linux-crypto/[email protected]/
[2]: https://gist.github.com/Pratham-T/24247446f1faf4b7843e4014d5089f6b
--- crypto/skcipher.c | 2 ++ 1 file changed, 2 insertions(+)
crypto/skcipher.c +2 -0
@@ -294,6 +294,8 @@ static int crypto_skcipher_init_tfm(struct crypto_tfm *tfm)return crypto_init_lskcipher_ops_sg (tfm); } +crypto_skcipher_set_reqsize (skcipher,crypto_tfm_alg_reqsize (tfm)); +if (alg->exit) skcipher->base.exit = crypto_skcipher_exit_tfm;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 116/371 netfilter: nft_objref: validate objref and objrefmap expressions
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernando Fernandez Mancera <[email protected]>
[ Upstream commit f359b809d54c6e3dd1d039b97e0b68390b0e53e4 ]
Referencing a synproxy stateful object from OUTPUT hook causes kernel crash due to infinite recursive calls:
BUG: TASK stack guard page was hit at 000000008bda5b8c (stack is 000000003ab1c4a5..00000000494d8b12) [...] Call Trace: __find_rr_leaf+0x99/0x230 fib6_table_lookup+0x13b/0x2d0 ip6_pol_route+0xa4/0x400 fib6_rule_lookup+0x156/0x240 ip6_route_output_flags+0xc6/0x150 __nf_ip6_route+0x23/0x50 synproxy_send_tcp_ipv6+0x106/0x200 synproxy_send_client_synack_ipv6+0x1aa/0x1f0 nft_synproxy_do_eval+0x263/0x310 nft_do_chain+0x5a8/0x5f0 [nf_tables nft_do_chain_inet+0x98/0x110 nf_hook_slow+0x43/0xc0 __ip6_local_out+0xf0/0x170 ip6_local_out+0x17/0x70 synproxy_send_tcp_ipv6+0x1a2/0x200 synproxy_send_client_synack_ipv6+0x1aa/0x1f0
[...]
Implement objref and objrefmap expression validate functions.
Currently, only NFT_OBJECT_SYNPROXY object type requires validation. This will also handle a jump to a chain using a synproxy object from the OUTPUT hook.
Now when trying to reference a synproxy object in the OUTPUT hook, nft will produce the following error:
synproxy_crash.nft: Error: Could not process rule: Operation not supported
synproxy name mysynproxy
^^^^^^^^^^^^^^^^^^^^^^^^
--- net/netfilter/nft_objref.c | 39 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+)
net/netfilter/nft_objref.c +39 -0
@@ -22,6 +22,35 @@ void nft_objref_eval(const struct nft_expr *expr, obj->ops->eval (obj, regs, pkt); } +static int nft_objref_validate_obj_type (const struct nft_ctx *ctx,u32 type) +{ +unsigned int hooks; + +switch (type) { +case NFT_OBJECT_SYNPROXY : +if (ctx->family !=NFPROTO_IPV4 && + ctx->family !=NFPROTO_IPV6 && + ctx->family !=NFPROTO_INET ) +return -EOPNOTSUPP ; + + hooks = (1 <<NF_INET_LOCAL_IN ) | (1 <<NF_INET_FORWARD ); + +return nft_chain_validate_hooks (ctx->chain, hooks); +default : +break ; + } + +return 0 ; +} + +static int nft_objref_validate (const struct nft_ctx *ctx, +const struct nft_expr *expr) +{ +struct nft_object *obj =nft_objref_priv (expr); + +return nft_objref_validate_obj_type (ctx, obj->ops->type->type); +} +static int nft_objref_init (const struct nft_ctx *ctx,const struct nft_expr *expr,const struct nlattr *const tb[])
@@ -93,6 +122,7 @@ static const struct nft_expr_ops nft_objref_ops = { .activate = nft_objref_activate, .deactivate = nft_objref_deactivate, .dump = nft_objref_dump, + .validate = nft_objref_validate, .reduce = NFT_REDUCE_READONLY, };
@@ -197,6 +227,14 @@ static void nft_objref_map_destroy(const struct nft_ctx *ctx,nf_tables_destroy_set (ctx, priv->set); } +static int nft_objref_map_validate (const struct nft_ctx *ctx, +const struct nft_expr *expr) +{ +const struct nft_objref_map *priv =nft_expr_priv (expr); + +return nft_objref_validate_obj_type (ctx, priv->set->objtype); +} +static const struct nft_expr_ops nft_objref_map_ops = { .type = &nft_objref_type, .size =NFT_EXPR_SIZE (sizeof (struct nft_objref_map )),
@@ -206,6 +244,7 @@ static const struct nft_expr_ops nft_objref_map_ops = { .deactivate = nft_objref_map_deactivate, .destroy = nft_objref_map_destroy, .dump = nft_objref_map_dump, + .validate = nft_objref_map_validate, .reduce = NFT_REDUCE_READONLY, };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 117/371 bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Woudstra <[email protected]>
[ Upstream commit bbf0c98b3ad9edaea1f982de6c199cc11d3b7705 ]
net/bridge/br_private.h:1627 suspicious rcu_dereference_protected() usage! other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
7 locks held by socat/410:
#0: ffff88800d7a9c90 (sk_lock-AF_INET){+.+.}-{0:0}, at: inet_stream_connect+0x43/0xa0 #1: ffffffff9a779900 (rcu_read_lock){....}-{1:3}, at: __ip_queue_xmit+0x62/0x1830 [..]
#6: ffffffff9a779900 (rcu_read_lock){....}-{1:3}, at: nf_hook.constprop.0+0x8a/0x440
Call Trace: lockdep_rcu_suspicious.cold+0x4f/0xb1 br_vlan_fill_forward_path_pvid+0x32c/0x410 [bridge] br_fill_forward_path+0x7a/0x4d0 [bridge]
Use to correct helper, non _rcu variant requires RTNL mutex.
--- net/bridge/br_vlan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/bridge/br_vlan.c +1 -1
@@ -1455,7 +1455,7 @@ void br_vlan_fill_forward_path_pvid(struct net_bridge *br,if (!br_opt_get (br,BROPT_VLAN_ENABLED ))return ; - vg =br_vlan_group (br); + vg =br_vlan_group_rcu (br);if (idx >=0 && ctx->vlan[idx].proto == br->vlan_proto) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 118/371 selftests: netfilter: nft_fib.sh: fix spurious test failures
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit a126ab6b26f107f4eb100c8c77e9f10b706f26e6 ]
Jakub reports spurious failure of nft_fib.sh test.
This is caused by a subtle bug inherited when i moved faulty ping from one test case to another.
nft_fib.sh not only checks that the fib expression matched, it also records the number of matches and then validates we have the expected count. When I did this it was under the assumption that we would have 0 to n matching packets. In case of the failure, the entry has n+1 matching packets.
This happens because ping_unreachable helper uses "ping -c 1 -w 1", instead of the intended "-W". -w alters the meaning of -c (count), namely, its then treated as number of wanted *replies* instead of "number of packets to send".
So, in some cases, ping -c 1 -w 1 ends up sending two packets which then makes the test fail due to the higher-than-expected packet count.
Fix the actual bug (s/-w/-W) and also change the error handling:
1. Show the number of expected packets in the error message
2. Always try to delete the key from the set.
Else, later test that makes sure we don't have unexpected keys in there will always fail as well.
--- tools/testing/selftests/net/netfilter/nft_fib.sh | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
tools/testing/selftests/net/netfilter/nft_fib.sh +8 -5
@@ -256,12 +256,12 @@ test_ping_unreachable() { local daddr4=$1 local daddr6=$2 - if ip netns exec "$ns1" ping -c 1 -w 1 -q "$daddr4" > /dev/null; then + if ip netns exec "$ns1" ping -c 1 -W 0.1 -q "$daddr4" > /dev/null; then echo "FAIL: ${ns1} could reach $daddr4" 1>&2 return 1 fi - if ip netns exec "$ns1" ping -c 1 -w 1 -q "$daddr6" > /dev/null; then + if ip netns exec "$ns1" ping -c 1 -W 0.1 -q "$daddr6" > /dev/null; then echo "FAIL: ${ns1} could reach $daddr6" 1>&2 return 1 fi
@@ -437,14 +437,17 @@ check_type() local addr="$3" local type="$4" local count="$5" + local lret=0 [ -z "$count" ] && count=1 if ! ip netns exec "$nsrouter" nft get element inet t "$setname" { "$iifname" . "$addr" . "$type" } |grep -q "counter packets $count";then - echo "FAIL: did not find $iifname . $addr . $type in $setname" + echo "FAIL: did not find $iifname . $addr . $type in $setname with $count packets" ip netns exec "$nsrouter" nft list set inet t "$setname" ret=1 - return 1 + # do not fail right away, delete entry if it exists so later test that + # checks for unwanted keys don't get confused by this *expected* key. + lret=1 fi # delete the entry, this allows to check if anything unexpected appeared
@@ -456,7 +459,7 @@ check_type() return 1 fi - return 0 + return $lret } check_local()
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 119/371 selftests: netfilter: query conntrack state to check for port clash resolution
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit e84945bdc619ed4243ba4298dbb8ca2062026474 ]
Jakub reported this self test flaking occasionally (fails, but passes on re-run) on debug kernels.
This is because the test checks for elapsed time to determine if both connections were established in parallel.
Rework this to no longer depend on timing.
Use busywait helper to check that both sockets have moved to established state and then query the conntrack engine for the two entries.
--- .../selftests/net/netfilter/nf_nat_edemux.sh | 58 +++++++++++++------ 1 file changed, 41 insertions(+), 17 deletions(-)
tools/testing/selftests/net/netfilter/nf_nat_edemux.sh +41 -17
@@ -17,9 +17,31 @@ cleanup() checktool "socat -h" "run test without socat" checktool "iptables --version" "run test without iptables" +checktool "conntrack --version" "run test without conntrack" trap cleanup EXIT +connect_done() +{ + local ns="$1" + local port="$2" + + ip netns exec "$ns" ss -nt -o state established "dport = :$port" | grep -q "$port" +} + +check_ctstate() +{ + local ns="$1" + local dp="$2" + + if ! ip netns exec "$ns" conntrack --get -s 192.168.1.2 -d 192.168.1.1 -p tcp \ + --sport 10000 --dport "$dp" --state ESTABLISHED > /dev/null 2>&1;then + echo "FAIL: Did not find expected state for dport $2" + ip netns exec "$ns" bash -c 'conntrack -L; conntrack -S; ss -nt' + ret=1 + fi +} + setup_ns ns1 ns2 # Connect the namespaces using a veth pair
@@ -44,15 +66,18 @@ socatpid=$! ip netns exec "$ns2" sysctl -q net.ipv4.ip_local_port_range="10000 10000" # add a virtual IP using DNAT -ip netns exec "$ns2" iptables -t nat -A OUTPUT -d 10.96.0.1/32 -p tcp --dport 443 -j DNAT --to-destination 192.168.1.1:5201 +ip netns exec "$ns2" iptables -t nat -A OUTPUT -d 10.96.0.1/32 -p tcp --dport 443 -j DNAT --to-destination 192.168.1.1:5201 || exit 1 # ... and route it to the other namespace ip netns exec "$ns2" ip route add 10.96.0.1 via 192.168.1.1 -# add a persistent connection from the other namespace -ip netns exec "$ns2" socat -t 10 - TCP:192.168.1.1:5201 > /dev/null & +# listener should be up by now, wait if it isn't yet. +wait_local_port_listen "$ns1" 5201 tcp -sleep 1 +# add a persistent connection from the other namespace +sleep 10 | ip netns exec "$ns2" socat -t 10 - TCP:192.168.1.1:5201 > /dev/null & +cpid0=$! +busywait "$BUSYWAIT_TIMEOUT" connect_done "$ns2" "5201" # ip daddr:dport will be rewritten to 192.168.1.1 5201 # NAT must reallocate source port 10000 because
@@ -71,26 +96,25 @@ fi ip netns exec "$ns1" iptables -t nat -A PREROUTING -p tcp --dport 5202 -j REDIRECT --to-ports 5201 ip netns exec "$ns1" iptables -t nat -A PREROUTING -p tcp --dport 5203 -j REDIRECT --to-ports 5201 -sleep 5 | ip netns exec "$ns2" socat -t 5 -u STDIN TCP:192.168.1.1:5202,connect-timeout=5 >/dev/null & +sleep 5 | ip netns exec "$ns2" socat -T 5 -u STDIN TCP:192.168.1.1:5202,connect-timeout=5 >/dev/null & +cpid1=$! -# if connect succeeds, client closes instantly due to EOF on stdin. -# if connect hangs, it will time out after 5s. -echo | ip netns exec "$ns2" socat -t 3 -u STDIN TCP:192.168.1.1:5203,connect-timeout=5 >/dev/null & +sleep 5 | ip netns exec "$ns2" socat -T 5 -u STDIN TCP:192.168.1.1:5203,connect-timeout=5 >/dev/null & cpid2=$! -time_then=$(date +%s) -wait $cpid2 -rv=$? -time_now=$(date +%s) +busywait "$BUSYWAIT_TIMEOUT" connect_done "$ns2" 5202 +busywait "$BUSYWAIT_TIMEOUT" connect_done "$ns2" 5203 -# Check how much time has elapsed, expectation is for -# 'cpid2' to connect and then exit (and no connect delay). -delta=$((time_now - time_then)) +check_ctstate "$ns1" 5202 +check_ctstate "$ns1" 5203 -if [ $delta -lt 2 ] && [ $rv -eq 0 ]; then +kill $socatpid $cpid0 $cpid1 $cpid2 +socatpid=0 + +if [ $ret -eq 0 ]; then echo "PASS: could connect to service via redirected ports" else - echo "FAIL: socat cannot connect to service via redirect ($delta seconds elapsed, returned $rv)" + echo "FAIL: socat cannot connect to service via redirect" ret=1 fi
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 120/371 io_uring/zcrx: increment fallback loop src offset
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Begunkov <[email protected]>
[ Upstream commit e9a9dcb4ccb32446165800a9d83058e95c4833d2 ]
Don't forget to adjust the source offset in io_copy_page(), otherwise it'll be copying into the same location in some cases for highmem setups.
--- io_uring/zcrx.c | 1 + 1 file changed, 1 insertion(+)
io_uring/zcrx.c +1 -0
@@ -993,6 +993,7 @@ static ssize_t io_copy_page(struct io_copy_cache *cc, struct page *src_page, cc->size -= n; cc->offset += n; + src_offset += n; len -= n; copied += n; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 121/371 crypto: essiv - Check ssize for decryption and in-place encryption
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
[ Upstream commit 6bb73db6948c2de23e407fe1b7ef94bf02b7529f ]
Move the ssize check to the start in essiv_aead_crypt so that it's also checked for decryption and in-place encryption.
--- crypto/essiv.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-)
crypto/essiv.c +6 -8
@@ -186,9 +186,14 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc)const struct essiv_tfm_ctx *tctx =crypto_aead_ctx (tfm);struct essiv_aead_request_ctx *rctx =aead_request_ctx (req);struct aead_request *subreq = &rctx->aead_req; +int ivsize =crypto_aead_ivsize (tfm); +int ssize = req->assoclen - ivsize;struct scatterlist *src = req->src;int err; +if (ssize <0 ) +return -EINVAL ; +crypto_cipher_encrypt_one (tctx->essiv_cipher, req->iv, req->iv);/*
@@ -198,19 +203,12 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc)*/ rctx->assoc =NULL ;if (req->src == req->dst || !enc) { -scatterwalk_map_and_copy (req->iv, req->dst, - req->assoclen -crypto_aead_ivsize (tfm), -crypto_aead_ivsize (tfm),1 ); +scatterwalk_map_and_copy (req->iv, req->dst, ssize, ivsize,1 ); }else {u8 *iv = (u8 *)aead_request_ctx (req) + tctx->ivoffset; -int ivsize =crypto_aead_ivsize (tfm); -int ssize = req->assoclen - ivsize;struct scatterlist *sg;int nents; -if (ssize <0 ) -return -EINVAL ; - nents =sg_nents_for_len (req->src, ssize);if (nents <0 )return -EINVAL ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 122/371 net: airoha: Fix loopback mode configuration for GDM2 port
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Bianconi <[email protected]>
[ Upstream commit fea8cdf6738a8b25fccbb7b109b440795a0892cb ]
Add missing configuration for loopback mode in airhoha_set_gdm2_loopback routine.
--- drivers/net/ethernet/airoha/airoha_eth.c | 4 +++- drivers/net/ethernet/airoha/airoha_regs.h | 3 +++ 2 files changed, 6 insertions(+), 1 deletion(-)
drivers/net/ethernet/airoha/airoha_eth.c +3 -1
@@ -1709,7 +1709,9 @@ static void airhoha_set_gdm2_loopback(struct airoha_gdm_port *port)airoha_fe_wr (eth,REG_GDM_RXCHN_EN (2 ),0xffff );airoha_fe_rmw (eth,REG_GDM_LPBK_CFG (2 ),LPBK_CHAN_MASK |LPBK_MODE_MASK |LPBK_EN_MASK , -FIELD_PREP (LPBK_CHAN_MASK , chan) |LPBK_EN_MASK ); +FIELD_PREP (LPBK_CHAN_MASK , chan) | +LBK_GAP_MODE_MASK |LBK_LEN_MODE_MASK | +LBK_CHAN_MODE_MASK |LPBK_EN_MASK ); airoha_fe_rmw(eth, REG_GDM_LEN_CFG(2), GDM_SHORT_LEN_MASK | GDM_LONG_LEN_MASK, FIELD_PREP(GDM_SHORT_LEN_MASK, 60) |
drivers/net/ethernet/airoha/airoha_regs.h +3 -0
@@ -151,6 +151,9 @@#define LPBK_LEN_MASK GENMASK(23, 10)#define LPBK_CHAN_MASK GENMASK(8, 4)#define LPBK_MODE_MASK GENMASK(3, 1) +#define LBK_GAP_MODE_MASK BIT(3) +#define LBK_LEN_MODE_MASK BIT(2) +#define LBK_CHAN_MODE_MASK BIT(1)#define LPBK_EN_MASK BIT(0)#define REG_GDM_TXCHN_EN (_n) (GDM_BASE(_n) + 0x24)
Signature · 1 line
2.51.0