5.4.18-stable review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 5.4.18-stable review
This is the start of the stable review cycle for the 5.4.18 release. There are 90 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 05 Feb 2020 16:17:59 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.18-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.4.18-rc1
Praveen Chaudhary <[email protected]>
net: Fix skb->csum update in inet_proto_csum_replace16().
wenxu <[email protected]>
netfilter: nf_tables_offload: fix check the chain offload flag
Jiri Wiesner <[email protected]>
netfilter: conntrack: sctp: use distinct states for new SCTP connections
Vasily Averin <[email protected]>
l2t_seq_next should increase position index
Vasily Averin <[email protected]>
seq_tab_next() should increase position index
Madalin Bucur <[email protected]>
net: fsl/fman: rename IF_MODE_XGMII to IF_MODE_10G
Madalin Bucur <[email protected]>
net/fsl: treat fsl,erratum-a011043
Madalin Bucur <[email protected]>
powerpc/fsl/dts: add fsl,erratum-a011043
Manish Chopra <[email protected]>
qlcnic: Fix CPU soft lockup while collecting firmware dump
Raag Jadav <[email protected]>
ARM: dts: am43x-epos-evm: set data pin directions for spi0 and spi1
Hayes Wang <[email protected]>
r8152: disable DelayPhyPwrChg
Hayes Wang <[email protected]>
r8152: avoid the MCU to clear the lanwake
Hayes Wang <[email protected]>
r8152: disable test IO for RTL8153B
Hayes Wang <[email protected]>
r8152: Disable PLA MCU clock speed down
Hayes Wang <[email protected]>
r8152: disable U2P3 for RTL8153B
Hayes Wang <[email protected]>
r8152: get default setting of WOL before initializing
Vincenzo Frascino <[email protected]>
tee: optee: Fix compilation issue with nommu
Bartosz Golaszewski <[email protected]>
led: max77650: add of_match table
Vladimir Murzin <[email protected]>
ARM: 8955/1: virt: Relax arch timer version check during early boot
Hannes Reinecke <[email protected]>
scsi: fnic: do not queue commands during fwreset
Bartosz Golaszewski <[email protected]>
Input: max77650-onkey - add of_match table
Xu Wang <[email protected]>
xfrm: interface: do not confirm neighbor when do pmtu update
Nicolas Dichtel <[email protected]>
xfrm interface: fix packet tx through bpf_redirect()
Nicolas Dichtel <[email protected]>
vti[6]: fix packet tx through bpf_redirect()
Matwey V. Kornilov <[email protected]>
ARM: dts: am335x-boneblack-common: fix memory size
Johan Hovold <[email protected]>
Input: aiptek - use descriptors of current altsetting
Miles Chen <[email protected]>
Input: evdev - convert kzalloc()/vzalloc() to kvzalloc()
Shahar S Matityahu <[email protected]>
iwlwifi: dbg: force stop the debug monitor HW
Haim Dreyfuss <[email protected]>
iwlwifi: Don't ignore the cap field upon mcc update
Luca Coelho <[email protected]>
iwlwifi: mvm: fix NVM check for 3168 devices
Johannes Berg <[email protected]>
iwlwifi: pcie: allocate smaller dev_cmd for TX headers
Matthew Wilcox (Oracle) <[email protected]>
XArray: Fix xas_pause at ULONG_MAX
Olof Johansson <[email protected]>
riscv: Less inefficient gcc tishift helpers (and export their symbols)
Ilie Halip <[email protected]>
riscv: delete temporary files
Kan Liang <[email protected]>
perf/x86/intel/uncore: Remove PCIe3 unit for SNR
Kan Liang <[email protected]>
perf/x86/intel/uncore: Add PCI ID of IMC for Xeon E3 V5 Family
Arnd Bergmann <[email protected]>
wireless: wext: avoid gcc -O3 warning
Jouni Malinen <[email protected]>
mac80211: Fix TKIP replay protection immediately after key setup
Orr Mazor <[email protected]>
cfg80211: Fix radar event during another phy CAC
Ganapathi Bhat <[email protected]>
wireless: fix enabling channel 12 for custom regulatory domain
Brendan Higgins <[email protected]>
lkdtm/bugs: fix build error in lkdtm_UNSET_SMEP
Krzysztof Kozlowski <[email protected]>
parisc: Use proper printk format for resource_size_t
Kristian Evensen <[email protected]>
qmi_wwan: Add support for Quectel RM500Q
Arnaud Pouliquen <[email protected]>
ASoC: sti: fix possible sleep-in-atomic
Kai Vehmanen <[email protected]>
ASoC: hdac_hda: Fix error in driver removal after failed probe
Kai Vehmanen <[email protected]>
ASoC: SOF: Intel: fix HDA codec driver probe with multiple controllers
Harry Pan <[email protected]>
platform/x86: intel_pmc_core: update Comet Lake platform driver
Hans de Goede <[email protected]>
platform/x86: GPD pocket fan: Allow somewhat lower/higher temperature limits
Stefan Assmann <[email protected]>
iavf: remove current MAC address filter on VF reset
Manfred Rudigier <[email protected]>
igb: Fix SGMII SFP module discovery for 100FX/LX.
Cambda Zhu <[email protected]>
ixgbe: Fix calculation of queue with VFs and flow director on interface flap
Radoslaw Tyl <[email protected]>
ixgbevf: Remove limit of 10 entries for unicast filter list
Brett Creeley <[email protected]>
i40e: Fix virtchnl_queue_select bitmap validation
Harald Freudenberger <[email protected]>
s390/zcrypt: move ap device reset from bus to driver code
Dmitry Osipenko <[email protected]>
ASoC: rt5640: Fix NULL dereference on module unload
Lubomir Rintel <[email protected]>
clk: mmp2: Fix the order of timer mux parents
Markus Theil <[email protected]>
mac80211: mesh: restrict airtime metric to peered established plinks
Samuel Holland <[email protected]>
clk: sunxi-ng: h6-r: Fix AR100/R_APB2 parent order
Samuel Holland <[email protected]>
clk: sunxi-ng: sun8i-r: Fix divider on APB0 clock
Mathieu Desnoyers <[email protected]>
rseq: Unregister rseq for clone CLONE_VM
Hewenliang <[email protected]>
tools lib traceevent: Fix memory leakage in filter_event
Dave Gerlach <[email protected]>
soc: ti: wkup_m3_ipc: Fix race condition with rproc_boot
Kishon Vijay Abraham I <[email protected]>
ARM: dts: beagle-x15-common: Model 5V0 regulator
Kishon Vijay Abraham I <[email protected]>
ARM: dts: am57xx-beagle-x15/am57xx-idk: Remove "gpios" for endpoint dt nodes
Marek Szyprowski <[email protected]>
ARM: dts: sun8i: a83t: Correct USB3503 GPIOs polarity
Guillaume La Roque <[email protected]>
arm64: dts: meson-sm1-sei610: add gpio bluetooth interrupt
Yunhao Tian <[email protected]>
clk: sunxi-ng: v3s: Fix incorrect number of hw_clks.
Michal Koutný <[email protected]>
cgroup: Prevent double killing of css when enabling threaded cgroup
Dan Carpenter <[email protected]>
Bluetooth: Fix race condition in hci_release_sock()
Zhenzhong Duan <[email protected]>
ttyprintk: fix a potential deadlock in interrupt context issue
Tetsuo Handa <[email protected]>
tomoyo: Use atomic_t for statistics counter
Hans Verkuil <[email protected]>
media: dvb-usb/dvb-usb-urb.c: initialize actlen to 0
Hans Verkuil <[email protected]>
media: gspca: zero usb_buf
Sean Young <[email protected]>
media: vp7045: do not read uninitialized values if usb transfer fails
Sean Young <[email protected]>
media: af9005: uninitialized variable printked
Sean Young <[email protected]>
media: digitv: don't continue if remote control state can't be read
Jan Kara <[email protected]>
reiserfs: Fix memory leak of journal device string
Dan Carpenter <[email protected]>
mm/mempolicy.c: fix out of bounds write in mpol_parse_str()
Dirk Behme <[email protected]>
arm64: kbuild: remove compressed images on 'make ARCH=arm64 (dist)clean'
Vitaly Chikunov <[email protected]>
tools lib: Fix builds when glibc contains strlcpy()
Chanwoo Choi <[email protected]>
PM / devfreq: Add new name attribute for sysfs
Andres Freund <[email protected]>
perf c2c: Fix return type for histogram sorting comparision functions
Andreas Gruenbacher <[email protected]>
gfs2: Another gfs2_find_jhead fix
Jeff Kirsher <[email protected]>
e1000e: Revert "e1000e: Make watchdog use delayed work"
Alexander Duyck <[email protected]>
e1000e: Drop unnecessary __E1000_DOWN bit twiddling
Xiaochen Shen <[email protected]>
x86/resctrl: Fix use-after-free due to inaccurate refcount of rdtgroup
Xiaochen Shen <[email protected]>
x86/resctrl: Fix use-after-free when deleting resource groups
Xiaochen Shen <[email protected]>
x86/resctrl: Fix a deadlock due to inaccurate reference
Ronnie Sahlberg <[email protected]>
cifs: fix soft mounts hanging in the reconnect code
Al Viro <[email protected]>
vfs: fix do_last() regression
-------------
Diffstat:
Documentation/ABI/testing/sysfs-class-devfreq | 7 ++ Makefile | 4 +- arch/arm/boot/dts/am335x-boneblack-common.dtsi | 5 ++ arch/arm/boot/dts/am43x-epos-evm.dts | 2 + arch/arm/boot/dts/am571x-idk.dts | 4 -- arch/arm/boot/dts/am572x-idk-common.dtsi | 4 -- arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi | 25 +++++-- arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts | 2 +- arch/arm/kernel/hyp-stub.S | 7 +- arch/arm64/boot/Makefile | 2 +- arch/arm64/boot/dts/amlogic/meson-sm1-sei610.dts | 2 + arch/parisc/kernel/drivers.c | 4 +- .../dts/fsl/qoriq-fman3-0-10g-0-best-effort.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0.dtsi | 1 + .../dts/fsl/qoriq-fman3-0-10g-1-best-effort.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-0.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-1.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-2.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-3.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-4.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-5.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-0.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-1.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-0.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-1.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-2.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-3.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-4.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-5.dtsi | 1 + arch/riscv/include/asm/asm-prototypes.h | 4 ++ arch/riscv/kernel/vdso/Makefile | 3 +- arch/riscv/lib/tishift.S | 75 +++++++++++++++----- arch/x86/events/intel/uncore_snb.c | 6 ++ arch/x86/events/intel/uncore_snbep.c | 24 ------- arch/x86/kernel/cpu/resctrl/rdtgroup.c | 32 +++++---- drivers/char/ttyprintk.c | 15 ++-- drivers/clk/mmp/clk-of-mmp2.c | 2 +- drivers/clk/sunxi-ng/ccu-sun50i-h6-r.c | 4 +- drivers/clk/sunxi-ng/ccu-sun8i-r.c | 21 +----- drivers/clk/sunxi-ng/ccu-sun8i-v3s.c | 4 +- drivers/clk/sunxi-ng/ccu-sun8i-v3s.h | 2 - drivers/devfreq/devfreq.c | 9 +++ drivers/input/evdev.c | 5 +- drivers/input/misc/max77650-onkey.c | 7 ++ drivers/input/tablet/aiptek.c | 2 +- drivers/leds/leds-max77650.c | 7 ++ drivers/media/usb/dvb-usb/af9005.c | 2 +- drivers/media/usb/dvb-usb/digitv.c | 10 ++- drivers/media/usb/dvb-usb/dvb-usb-urb.c | 2 +- drivers/media/usb/dvb-usb/vp7045.c | 21 ++++-- drivers/media/usb/gspca/gspca.c | 2 +- drivers/misc/lkdtm/bugs.c | 2 +- drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c | 3 +- drivers/net/ethernet/chelsio/cxgb4/l2t.c | 3 +- drivers/net/ethernet/freescale/fman/fman_memac.c | 4 +- drivers/net/ethernet/freescale/xgmac_mdio.c | 7 +- drivers/net/ethernet/intel/e1000e/e1000.h | 5 +- drivers/net/ethernet/intel/e1000e/netdev.c | 61 +++++++--------- drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 22 ++++-- drivers/net/ethernet/intel/iavf/iavf.h | 2 + drivers/net/ethernet/intel/iavf/iavf_main.c | 17 +++-- drivers/net/ethernet/intel/iavf/iavf_virtchnl.c | 3 + drivers/net/ethernet/intel/igb/e1000_82575.c | 8 +-- drivers/net/ethernet/intel/igb/igb_ethtool.c | 2 +- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 37 +++++++--- drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 5 -- .../net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c | 1 + .../net/ethernet/qlogic/qlcnic/qlcnic_minidump.c | 2 + drivers/net/usb/qmi_wwan.c | 1 + drivers/net/usb/r8152.c | 82 +++++++++++++++++++--- drivers/net/wireless/intel/iwlwifi/dvm/tx.c | 3 +- drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 7 +- drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c | 48 ++++++++++++- drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.h | 6 +- drivers/net/wireless/intel/iwlwifi/iwl-trans.c | 10 +-- drivers/net/wireless/intel/iwlwifi/iwl-trans.h | 26 +++++-- drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 3 +- drivers/net/wireless/intel/iwlwifi/mvm/nvm.c | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 15 ++-- drivers/net/wireless/intel/iwlwifi/pcie/internal.h | 6 +- drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 32 ++++++--- drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c | 21 ++++-- drivers/net/wireless/intel/iwlwifi/pcie/tx.c | 20 +++--- drivers/platform/x86/gpd-pocket-fan.c | 2 +- drivers/platform/x86/intel_pmc_core_pltdrv.c | 2 + drivers/s390/crypto/ap_bus.c | 2 - drivers/s390/crypto/ap_bus.h | 2 +- drivers/s390/crypto/ap_queue.c | 5 +- drivers/s390/crypto/zcrypt_cex2a.c | 1 + drivers/s390/crypto/zcrypt_cex2c.c | 2 + drivers/s390/crypto/zcrypt_cex4.c | 1 + drivers/scsi/fnic/fnic_scsi.c | 3 + drivers/soc/ti/wkup_m3_ipc.c | 4 +- drivers/tee/optee/Kconfig | 1 + fs/cifs/smb2pdu.c | 2 +- fs/gfs2/lops.c | 68 +++++++++++------- fs/namei.c | 4 +- fs/reiserfs/super.c | 2 + include/linux/sched.h | 4 +- include/net/cfg80211.h | 5 ++ kernel/cgroup/cgroup.c | 11 +-- lib/test_xarray.c | 22 ++++++ lib/xarray.c | 8 ++- mm/mempolicy.c | 6 +- net/bluetooth/hci_sock.c | 3 + net/core/utils.c | 20 +++++- net/ipv4/ip_vti.c | 13 +++- net/ipv6/ip6_vti.c | 13 +++- net/mac80211/cfg.c | 23 ++++++ net/mac80211/mesh_hwmp.c | 3 + net/mac80211/tkip.c | 18 ++++- net/netfilter/nf_conntrack_proto_sctp.c | 6 +- net/netfilter/nf_tables_offload.c | 2 +- net/wireless/rdev-ops.h | 10 +++ net/wireless/reg.c | 36 ++++++++-- net/wireless/trace.h | 5 ++ net/wireless/wext-core.c | 3 +- net/xfrm/xfrm_interface.c | 34 ++++++--- security/tomoyo/common.c | 11 ++- sound/soc/codecs/hdac_hda.c | 4 +- sound/soc/codecs/rt5640.c | 7 ++ sound/soc/sof/intel/hda-codec.c | 19 +++-- sound/soc/sti/uniperif_player.c | 7 +- tools/include/linux/string.h | 8 +++ tools/lib/string.c | 7 ++ tools/lib/traceevent/parse-filter.c | 4 +- tools/perf/builtin-c2c.c | 10 +-- 128 files changed, 864 insertions(+), 370 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/90 vfs: fix do_last() regression
From: Al Viro <[email protected]>
commit 6404674acd596de41fd3ad5f267b4525494a891a upstream.
Brown paperbag time: fetching ->i_uid/->i_mode really should've been done from nd->inode. I even suggested that, but the reason for that has slipped through the cracks and I went for dir->d_inode instead - made for more "obvious" patch.
Analysis:
- at the entry into do_last() and all the way to step_into(): dir (aka nd->path.dentry) is known not to have been freed; so's nd->inode and it's equal to dir->d_inode unless we are already doomed to -ECHILD. inode of the file to get opened is not known.
- after step_into(): inode of the file to get opened is known; dir might be pointing to freed memory/be negative/etc.
- at the call of may_create_in_sticky(): guaranteed to be out of RCU mode; inode of the file to get opened is known and pinned; dir might be garbage.
The last was the reason for the original patch. Except that at the do_last() entry we can be in RCU mode and it is possible that nd->path.dentry->d_inode has already changed under us.
In that case we are going to fail with -ECHILD, but we need to be careful; nd->inode is pointing to valid struct inode and it's the same as nd->path.dentry->d_inode in "won't fail with -ECHILD" case, so we should use that.
Wearing-brown-paperbag: Al Viro <[email protected]>
--- fs/namei.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/namei.c +2 -2
@@ -3249,8 +3249,8 @@ static int do_last(struct nameidata *nd, struct file *file, const struct open_flags *op) { struct dentry *dir = nd->path.dentry; -kuid_t dir_uid = dir->d_inode->i_uid; -umode_t dir_mode = dir->d_inode->i_mode; +kuid_t dir_uid = nd->inode->i_uid; +umode_t dir_mode = nd->inode->i_mode;int open_flag = op->open_flag;bool will_truncate = (open_flag &O_TRUNC ) !=0 ;bool got_write = false;
Greg Kroah-Hartman
maintainerPATCH 2/90 cifs: fix soft mounts hanging in the reconnect code
In reply to Greg Kroah-HartmanFrom: Ronnie Sahlberg <[email protected]>
commit c54849ddd832ae0a45cab16bcd1ed2db7da090d7 upstream.
RHBZ: 1795429
In recent DFS updates we have a new variable controlling how many times we will retry to reconnect the share.
If DFS is not used, then this variable is initialized to 0 in:
static inline intdfs_cache_get_nr_tgts(const struct dfs_cache_tgt_list *tl)
{
return tl ? tl->tl_numtgts : 0;
}This means that in the reconnect loop in smb2_reconnect() we will immediately wrap retries to -1 and never actually get to pass this conditional:
if (--retries)
continue;The effect is that we no longer reach the point where we fail the commands with -EHOSTDOWN and basically the kernel threads are virtually hung and unkillable.
--- fs/cifs/smb2pdu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/cifs/smb2pdu.c +1 -1
@@ -312,7 +312,7 @@ smb2_reconnect(__le16 smb2_command, struif (server->tcpStatus != CifsNeedReconnect)break ; -if (--retries) +if (retries && --retries)continue ;/*
Greg Kroah-Hartman
maintainerPATCH 3/90 x86/resctrl: Fix a deadlock due to inaccurate reference
In reply to Greg Kroah-HartmanFrom: Xiaochen Shen <[email protected]>
[ Upstream commit 334b0f4e9b1b4a1d475f803419d202f6c5e4d18e ]
There is a race condition which results in a deadlock when rmdir and mkdir execute concurrently:
$ ls /sys/fs/resctrl/c1/mon_groups/m1/ cpus cpus_list mon_data tasks
Thread 1: rmdir /sys/fs/resctrl/c1
Thread 2: mkdir /sys/fs/resctrl/c1/mon_groups/m1
3 locks held by mkdir/48649:
#0: (sb_writers#17){.+.+}, at: [<ffffffffb4ca2aa0>] mnt_want_write+0x20/0x50
#1: (&type->i_mutex_dir_key#8/1){+.+.}, at: [<ffffffffb4c8c13b>] filename_create+0x7b/0x170
#2: (rdtgroup_mutex){+.+.}, at: [<ffffffffb4a4389d>] rdtgroup_kn_lock_live+0x3d/0x704 locks held by rmdir/48652:
#0: (sb_writers#17){.+.+}, at: [<ffffffffb4ca2aa0>] mnt_want_write+0x20/0x50
#1: (&type->i_mutex_dir_key#8/1){+.+.}, at: [<ffffffffb4c8c3cf>] do_rmdir+0x13f/0x1e0
#2: (&type->i_mutex_dir_key#8){++++}, at: [<ffffffffb4c86d5d>] vfs_rmdir+0x4d/0x120
#3: (rdtgroup_mutex){+.+.}, at: [<ffffffffb4a4389d>] rdtgroup_kn_lock_live+0x3d/0x70Thread 1 is deleting control group "c1". Holding rdtgroup_mutex, kernfs_remove() removes all kernfs nodes under directory "c1" recursively, then waits for sub kernfs node "mon_groups" to drop active reference.
Thread 2 is trying to create a subdirectory "m1" in the "mon_groups" directory. The wrapper kernfs_iop_mkdir() takes an active reference to the "mon_groups" directory but the code drops the active reference to the parent directory "c1" instead.
As a result, Thread 1 is blocked on waiting for active reference to drop and never release rdtgroup_mutex, while Thread 2 is also blocked on trying to get rdtgroup_mutex.
Thread 1 (rdtgroup_rmdir) Thread 2 (rdtgroup_mkdir) (rmdir /sys/fs/resctrl/c1) (mkdir /sys/fs/resctrl/c1/mon_groups/m1) ------------------------- -------------------------
kernfs_iop_mkdir
/*
* kn: "m1", parent_kn: "mon_groups",
* prgrp_kn: parent_kn->parent: "c1", *
* "mon_groups", parent_kn->active++: 1 */
kernfs_get_active(parent_kn)kernfs_iop_rmdir
/* "c1", kn->active++ */
kernfs_get_active(kn)
rdtgroup_kn_lock_live
atomic_inc(&rdtgrp->waitcount)
/* "c1", kn->active-- */
kernfs_break_active_protection(kn)
mutex_lock rdtgroup_rmdir_ctrl
free_all_child_rdtgrp
sentry->flags = RDT_DELETED
rdtgroup_ctrl_remove
rdtgrp->flags = RDT_DELETED
kernfs_get(kn)
kernfs_remove(rdtgrp->kn)
__kernfs_remove
/* "mon_groups", sub_kn */
atomic_add(KN_DEACTIVATED_BIAS, &sub_kn->active)
kernfs_drain(sub_kn)
/*
* sub_kn->active == KN_DEACTIVATED_BIAS + 1,
* waiting on sub_kn->active to drop, but it
* never drops in Thread 2 which is blocked
* on getting rdtgroup_mutex.
*/Thread 1 hangs here ---->
wait_event(sub_kn->active == KN_DEACTIVATED_BIAS)
...
rdtgroup_mkdir
rdtgroup_mkdir_mon(parent_kn, prgrp_kn)
mkdir_rdt_prepare(parent_kn, prgrp_kn)
rdtgroup_kn_lock_live(prgrp_kn)
atomic_inc(&rdtgrp->waitcount) /*
* "c1", prgrp_kn->active-- *
* The active reference on "c1" is
* dropped, but not matching the
* actual active reference taken
* on "mon_groups", thus causing
* Thread 1 to wait forever while
* holding rdtgroup_mutex. */
kernfs_break_active_protection(
prgrp_kn)
/*
* Trying to get rdtgroup_mutex
* which is held by Thread 1. */
Thread 2 hangs here ----> mutex_lock
...
The problem is that the creation of a subdirectory in the "mon_groups" directory incorrectly releases the active protection of its parent directory instead of itself before it starts waiting for rdtgroup_mutex. This is triggered by the rdtgroup_mkdir() flow calling rdtgroup_kn_lock_live()/rdtgroup_kn_unlock() with kernfs node of the parent control group ("c1") as argument. It should be called with kernfs node "mon_groups" instead. What is currently missing is that the kn->priv of "mon_groups" is NULL instead of pointing to the rdtgrp.
Fix it by pointing kn->priv to rdtgrp when "mon_groups" is created. Then it could be passed to rdtgroup_kn_lock_live()/rdtgroup_kn_unlock() instead. And then it operates on the same rdtgroup structure but handles the active reference of kernfs node "mon_groups" to prevent deadlock. The same changes are also made to the "mon_data" directories.
This results in some unused function parameters that will be cleaned up in follow-up patch as the focus here is on the fix only in support of backporting efforts.
--- arch/x86/kernel/cpu/resctrl/rdtgroup.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
arch/x86/kernel/cpu/resctrl/rdtgroup.c +8 -8
@@ -1970,7 +1970,7 @@ static int rdt_get_tree(struct fs_context *fc)if (rdt_mon_capable) { ret =mongroup_create_dir (rdtgroup_default.kn, -NULL ,"mon_groups" , + &rdtgroup_default,"mon_groups" , &kn_mongrp);if (ret <0 ) goto out_info;
@@ -2446,7 +2446,7 @@ static int mkdir_mondata_all(struct kernfs_node *parent_kn,/* * Create the mon_data directory first. */ - ret =mongroup_create_dir (parent_kn,NULL ,"mon_data" , &kn); + ret =mongroup_create_dir (parent_kn, prgrp,"mon_data" , &kn);if (ret)return ret;
@@ -2645,7 +2645,7 @@ static int mkdir_rdt_prepare(struct kernfs_node *parent_kn,uint files =0 ;int ret; - prdtgrp =rdtgroup_kn_lock_live (prgrp_kn); + prdtgrp =rdtgroup_kn_lock_live (parent_kn);if (!prdtgrp) { ret = -ENODEV ; goto out_unlock;
@@ -2718,7 +2718,7 @@ static int mkdir_rdt_prepare(struct kernfs_node *parent_kn,kernfs_activate (kn);/* -* The caller unlocks the prgrp_kn upon success. +* The caller unlocks the parent_kn upon success. */ return 0 ;
@@ -2729,7 +2729,7 @@ static int mkdir_rdt_prepare(struct kernfs_node *parent_kn, out_free_rgrp:kfree (rdtgrp); out_unlock: -rdtgroup_kn_unlock (prgrp_kn); +rdtgroup_kn_unlock (parent_kn);return ret; }
@@ -2767,7 +2767,7 @@ static int rdtgroup_mkdir_mon(struct kernfs_node *parent_kn,*/ list_add_tail (&rdtgrp->mon.crdtgrp_list, &prgrp->mon.crdtgrp_list); -rdtgroup_kn_unlock (prgrp_kn); +rdtgroup_kn_unlock (parent_kn);return ret; }
@@ -2810,7 +2810,7 @@ static int rdtgroup_mkdir_ctrl_mon(struct kernfs_node *parent_kn,* Create an empty mon_groups directory to hold the subset * of tasks and cpus to monitor. */ - ret =mongroup_create_dir (kn,NULL ,"mon_groups" ,NULL ); + ret =mongroup_create_dir (kn, rdtgrp,"mon_groups" ,NULL );if (ret) {rdt_last_cmd_puts ("kernfs subdir error\n" ); goto out_del_list;
@@ -2826,7 +2826,7 @@ static int rdtgroup_mkdir_ctrl_mon(struct kernfs_node *parent_kn, out_common_fail:mkdir_rdt_prepare_clean (rdtgrp); out_unlock: -rdtgroup_kn_unlock (prgrp_kn); +rdtgroup_kn_unlock (parent_kn);return ret; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 4/90 x86/resctrl: Fix use-after-free when deleting resource groups
In reply to Greg Kroah-HartmanFrom: Xiaochen Shen <[email protected]>
[ Upstream commit b8511ccc75c033f6d54188ea4df7bf1e85778740 ]
A resource group (rdtgrp) contains a reference count (rdtgrp->waitcount) that indicates how many waiters expect this rdtgrp to exist. Waiters could be waiting on rdtgroup_mutex or some work sitting on a task's workqueue for when the task returns from kernel mode or exits.
The deletion of a rdtgrp is intended to have two phases:
(1) while holding rdtgroup_mutex the necessary cleanup is done and rdtgrp->flags is set to RDT_DELETED,
(2) after releasing the rdtgroup_mutex, the rdtgrp structure is freed only if there are no waiters and its flag is set to RDT_DELETED. Upon gaining access to rdtgroup_mutex or rdtgrp, a waiter is required to check for the RDT_DELETED flag.
When unmounting the resctrl file system or deleting ctrl_mon groups, all of the subdirectories are removed and the data structure of rdtgrp is forcibly freed without checking rdtgrp->waitcount. If at this point there was a waiter on rdtgrp then a use-after-free issue occurs when the waiter starts running and accesses the rdtgrp structure it was waiting on.
See kfree() calls in [1], [2] and [3] in these two call paths in following scenarios:
(1) rdt_kill_sb() -> rmdir_all_sub() -> free_all_child_rdtgrp()
(2) rdtgroup_rmdir() -> rdtgroup_rmdir_ctrl() -> free_all_child_rdtgrp()
There are several scenarios that result in use-after-free issue in following:
Scenario 1:
-----------
In Thread 1, rdtgroup_tasks_write() adds a task_work callback move_myself(). If move_myself() is scheduled to execute after Thread 2 rdt_kill_sb() is finished, referring to earlier rdtgrp memory (rdtgrp->waitcount) which was already freed in Thread 2 results in use-after-free issue.
Thread 1 (rdtgroup_tasks_write) Thread 2 (rdt_kill_sb)
------------------------------- ----------------------rdtgroup_kn_lock_live
atomic_inc(&rdtgrp->waitcount)
mutex_lockrdtgroup_move_task
__rdtgroup_move_task
/*
* Take an extra refcount, so rdtgrp cannot be freed
* before the call back move_myself has been invoked
*/
atomic_inc(&rdtgrp->waitcount)
/* Callback move_myself will be scheduled for later */
task_work_add(move_myself)rdtgroup_kn_unlock
mutex_unlock
atomic_dec_and_test(&rdtgrp->waitcount)
&& (flags & RDT_DELETED)
mutex_lock
rmdir_all_sub
/*
* sentry and rdtgrp are freed
* without checking refcount
*/
free_all_child_rdtgrp
kfree(sentry)*[1]
kfree(rdtgrp)*[2]
mutex_unlock/*
* Callback is scheduled to execute
* after rdt_kill_sb is finished
*/move_myself
/*
* Use-after-free: refer to earlier rdtgrp
* memory which was freed in [1] or [2].
*/
atomic_dec_and_test(&rdtgrp->waitcount)
&& (flags & RDT_DELETED)
kfree(rdtgrp)
Scenario 2:
-----------
In Thread 1, rdtgroup_tasks_write() adds a task_work callback move_myself(). If move_myself() is scheduled to execute after Thread 2 rdtgroup_rmdir() is finished, referring to earlier rdtgrp memory (rdtgrp->waitcount) which was already freed in Thread 2 results in use-after-free issue.
Thread 1 (rdtgroup_tasks_write) Thread 2 (rdtgroup_rmdir)
------------------------------- -------------------------rdtgroup_kn_lock_live
atomic_inc(&rdtgrp->waitcount)
mutex_lockrdtgroup_move_task
__rdtgroup_move_task
/*
* Take an extra refcount, so rdtgrp cannot be freed
* before the call back move_myself has been invoked
*/
atomic_inc(&rdtgrp->waitcount)
/* Callback move_myself will be scheduled for later */
task_work_add(move_myself)rdtgroup_kn_unlock
mutex_unlock
atomic_dec_and_test(&rdtgrp->waitcount)
&& (flags & RDT_DELETED)
rdtgroup_kn_lock_live
atomic_inc(&rdtgrp->waitcount)
mutex_lock
rdtgroup_rmdir_ctrl
free_all_child_rdtgrp
/*
* sentry is freed without
* checking refcount
*/
kfree(sentry)*[3]
rdtgroup_ctrl_remove
rdtgrp->flags = RDT_DELETED
rdtgroup_kn_unlock
mutex_unlock
atomic_dec_and_test(
&rdtgrp->waitcount)
&& (flags & RDT_DELETED)
kfree(rdtgrp)/*
* Callback is scheduled to execute
* after rdt_kill_sb is finished
*/move_myself
/*
* Use-after-free: refer to earlier rdtgrp
* memory which was freed in [3].
*/
atomic_dec_and_test(&rdtgrp->waitcount)
&& (flags & RDT_DELETED)
kfree(rdtgrp)
If CONFIG_DEBUG_SLAB=y, Slab corruption on kmalloc-2k can be observed like following. Note that "0x6b" is POISON_FREE after kfree(). The corrupted bits "0x6a", "0x64" at offset 0x424 correspond to waitcount member of struct rdtgroup which was freed:
Slab corruption (Not tainted): kmalloc-2k start=ffff9504c5b0d000, len=2048 420: 6b 6b 6b 6b 6a 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkjkkkkkkkkkkk Single bit error detected. Probably bad RAM.
Run memtest86+ or a similar memory test tool.
Next obj: start=ffff9504c5b0d800, len=2048
000: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk 010: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Slab corruption (Not tainted): kmalloc-2k start=ffff9504c58ab800, len=2048 420: 6b 6b 6b 6b 64 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkdkkkkkkkkkkk Prev obj: start=ffff9504c58ab000, len=2048
000: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk 010: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Fix this by taking reference count (waitcount) of rdtgrp into account in the two call paths that currently do not do so. Instead of always freeing the resource group it will only be freed if there are no waiters on it. If there are waiters, the resource group will have its flags set to RDT_DELETED.
It will be left to the waiter to free the resource group when it starts running and finding that it was the last waiter and the resource group has been removed (rdtgrp->flags & RDT_DELETED) since. (1) rdt_kill_sb() -> rmdir_all_sub() -> free_all_child_rdtgrp() (2) rdtgroup_rmdir() -> rdtgroup_rmdir_ctrl() -> free_all_child_rdtgrp()
--- arch/x86/kernel/cpu/resctrl/rdtgroup.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
arch/x86/kernel/cpu/resctrl/rdtgroup.c +10 -2
@@ -2205,7 +2205,11 @@ static void free_all_child_rdtgrp(struct rdtgroup *rdtgrp)list_for_each_entry_safe (sentry, stmp, head, mon.crdtgrp_list) {free_rmid (sentry->mon.rmid);list_del (&sentry->mon.crdtgrp_list); -kfree (sentry); + +if (atomic_read (&sentry->waitcount) !=0 ) + sentry->flags =RDT_DELETED ; +else +kfree (sentry); } }
@@ -2243,7 +2247,11 @@ static void rmdir_all_sub(void)kernfs_remove (rdtgrp->kn);list_del (&rdtgrp->rdtgroup_list); -kfree (rdtgrp); + +if (atomic_read (&rdtgrp->waitcount) !=0 ) + rdtgrp->flags =RDT_DELETED ; +else +kfree (rdtgrp); }/* Notify online CPUs to update per cpu storage and PQR_ASSOC MSR */ update_closid_rmid (cpu_online_mask, &rdtgroup_default);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 5/90 x86/resctrl: Fix use-after-free due to inaccurate refcount of rdtgroup
In reply to Greg Kroah-HartmanFrom: Xiaochen Shen <[email protected]>
[ Upstream commit 074fadee59ee7a9d2b216e9854bd4efb5dad679f ]
There is a race condition in the following scenario which results in an use-after-free issue when reading a monitoring file and deleting the parent ctrl_mon group concurrently:
Thread 1 calls atomic_inc() to take refcount of rdtgrp and then calls kernfs_break_active_protection() to drop the active reference of kernfs node in rdtgroup_kn_lock_live().
In Thread 2, kernfs_remove() is a blocking routine. It waits on all sub kernfs nodes to drop the active reference when removing all subtree kernfs nodes recursively. Thread 2 could block on kernfs_remove() until Thread 1 calls kernfs_break_active_protection(). Only after kernfs_remove() completes the refcount of rdtgrp could be trusted.
Before Thread 1 calls atomic_inc() and kernfs_break_active_protection(), Thread 2 could call kfree() when the refcount of rdtgrp (sentry) is 0 instead of 1 due to the race.
In Thread 1, in rdtgroup_kn_unlock(), referring to earlier rdtgrp memory (rdtgrp->waitcount) which was already freed in Thread 2 results in use-after-free issue.
Thread 1 (rdtgroup_mondata_show) Thread 2 (rdtgroup_rmdir) -------------------------------- ------------------------- rdtgroup_kn_lock_live
/*
* kn active protection until
* kernfs_break_active_protection(kn)
*/
rdtgrp = kernfs_to_rdtgroup(kn)
rdtgroup_kn_lock_live
atomic_inc(&rdtgrp->waitcount)
mutex_lock
rdtgroup_rmdir_ctrl
free_all_child_rdtgrp
/*
* sentry->waitcount should be 1
* but is 0 now due to the race.
*/
kfree(sentry)*[1]
/*
* Only after kernfs_remove()
* completes, the refcount of
* rdtgrp could be trusted.
*/
atomic_inc(&rdtgrp->waitcount)
/* kn->active-- */
kernfs_break_active_protection(kn)
rdtgroup_ctrl_remove
rdtgrp->flags = RDT_DELETED
/*
* Blocking routine, wait for
* all sub kernfs nodes to drop
* active reference in
* kernfs_break_active_protection.
*/
kernfs_remove(rdtgrp->kn)
rdtgroup_kn_unlock
mutex_unlock
atomic_dec_and_test(
&rdtgrp->waitcount)
&& (flags & RDT_DELETED)
kernfs_unbreak_active_protection(kn)
kfree(rdtgrp) mutex_lockmon_event_readrdtgroup_kn_unlock
mutex_unlock
/*
* Use-after-free: refer to earlier rdtgrp
* memory which was freed in [1].
*/
atomic_dec_and_test(&rdtgrp->waitcount)
&& (flags & RDT_DELETED)
/* kn->active++ */
kernfs_unbreak_active_protection(kn)
kfree(rdtgrp)Fix it by moving free_all_child_rdtgrp() to after kernfs_remove() in rdtgroup_rmdir_ctrl() to ensure it has the accurate refcount of rdtgrp.
--- arch/x86/kernel/cpu/resctrl/rdtgroup.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/kernel/cpu/resctrl/rdtgroup.c +2 -2
@@ -2960,13 +2960,13 @@ static int rdtgroup_rmdir_ctrl(struct kernfs_node *kn, struct rdtgroup *rdtgrp,closid_free (rdtgrp->closid);free_rmid (rdtgrp->mon.rmid); +rdtgroup_ctrl_remove (kn, rdtgrp); +/* * Free all the child monitor group rmids. */ free_all_child_rdtgrp (rdtgrp); -rdtgroup_ctrl_remove (kn, rdtgrp); -return 0 ; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 6/90 e1000e: Drop unnecessary __E1000_DOWN bit twiddling
In reply to Greg Kroah-HartmanFrom: Alexander Duyck <[email protected]>
[ Upstream commit daee5598e491d8d3979bd4ad6c447d89ce57b446 ]
Since we no longer check for __E1000_DOWN in e1000e_close we can drop the spot where we were restoring the bit. This saves us a bit of unnecessary complexity.
--- drivers/net/ethernet/intel/e1000e/netdev.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-)
drivers/net/ethernet/intel/e1000e/netdev.c +1 -6
@@ -7407,15 +7407,13 @@ static void e1000_remove(struct pci_dev *pdev) {struct net_device *netdev =pci_get_drvdata (pdev);struct e1000_adapter *adapter =netdev_priv (netdev); -bool down =test_bit (__E1000_DOWN, &adapter->state);e1000e_ptp_remove (adapter);/* The timers may be rescheduled, so explicitly disable them * from being rescheduled. */ -if (!down) -set_bit (__E1000_DOWN, &adapter->state); +set_bit (__E1000_DOWN, &adapter->state);del_timer_sync (&adapter->phy_info_timer);cancel_work_sync (&adapter->reset_task);
@@ -7435,9 +7433,6 @@ static void e1000_remove(struct pci_dev *pdev) } } -/* Don't lie to e1000_close() down the road. */ -if (!down) -clear_bit (__E1000_DOWN, &adapter->state);unregister_netdev (netdev);if (pci_dev_run_wake (pdev))
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 7/90 e1000e: Revert "e1000e: Make watchdog use delayed work"
In reply to Greg Kroah-HartmanFrom: Jeff Kirsher <[email protected]>
[ Upstream commit d5ad7a6a7f3c87b278d7e4973b65682be4e588dd ]
This reverts commit 59653e6497d16f7ac1d9db088f3959f57ee8c3db.
This is due to this commit causing driver crashes and connections to reset unexpectedly.
--- drivers/net/ethernet/intel/e1000e/e1000.h | 5 +- drivers/net/ethernet/intel/e1000e/netdev.c | 54 ++++++++++------------ 2 files changed, 27 insertions(+), 32 deletions(-)
drivers/net/ethernet/intel/e1000e/e1000.h +2 -3
@@ -185,13 +185,12 @@ struct e1000_phy_regs {/* board specific private data structure */ struct e1000_adapter { +struct timer_list watchdog_timer;struct timer_list phy_info_timer;struct timer_list blink_timer;struct work_struct reset_task; -struct delayed_work watchdog_task; - -struct workqueue_struct *e1000_workqueue; +struct work_struct watchdog_task;const struct e1000_info *ei;
drivers/net/ethernet/intel/e1000e/netdev.c +25 -29
122 lines not on this page · raw message
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 8/90 gfs2: Another gfs2_find_jhead fix
In reply to Greg Kroah-HartmanFrom: Andreas Gruenbacher <[email protected]>
commit eed0f953b90e86e765197a1dad06bb48aedc27fe upstream.
On filesystems with a block size smaller than the page size, gfs2_find_jhead can split a page across two bios (for example, when blocks are not allocated consecutively). When that happens, the first bio that completes will unlock the page in its bi_end_io handler even though the page hasn't been read completely yet. Fix that by using a chained bio for the rest of the page.
While at it, clean up the sector calculation logic in gfs2_log_alloc_bio. In gfs2_find_jhead, simplify the disk block and offset calculation logic and fix a variable name.
--- fs/gfs2/lops.c | 68 ++++++++++++++++++++++++++++++++++++--------------------- 1 file changed, 44 insertions(+), 24 deletions(-)
fs/gfs2/lops.c +44 -24
@@ -264,7 +264,7 @@ static struct bio *gfs2_log_alloc_bio(ststruct super_block *sb = sdp->sd_vfs;struct bio *bio =bio_alloc (GFP_NOIO ,BIO_MAX_PAGES ); - bio->bi_iter.bi_sector = blkno * (sb->s_blocksize >>9 ); + bio->bi_iter.bi_sector = blkno << (sb->s_blocksize_bits -9 );bio_set_dev (bio, sb->s_bdev); bio->bi_end_io = end_io; bio->bi_private = sdp;
@@ -471,6 +471,20 @@ static void gfs2_jhead_process_page(struput_page (page);/* Once more for find_or_create_page */ } +static struct bio *gfs2_chain_bio (struct bio *prev,unsigned int nr_iovecs) +{ +struct bio *new; + + new =bio_alloc (GFP_NOIO , nr_iovecs); +bio_copy_dev (new, prev); + new->bi_iter.bi_sector =bio_end_sector (prev); + new->bi_opf = prev->bi_opf; + new->bi_write_hint = prev->bi_write_hint; +bio_chain (new, prev); +submit_bio (prev); +return new; +} +/** * gfs2_find_jhead - find the head of a log * @jd: The journal descriptor
@@ -487,15 +501,15 @@ int gfs2_find_jhead(struct gfs2_jdesc *jstruct gfs2_sbd *sdp =GFS2_SB (jd->jd_inode);struct address_space *mapping = jd->jd_inode->i_mapping;unsigned int block =0 , blocks_submitted =0 , blocks_read =0 ; -unsigned int bsize = sdp->sd_sb.sb_bsize; +unsigned int bsize = sdp->sd_sb.sb_bsize, off;unsigned int bsize_shift = sdp->sd_sb.sb_bsize_shift;unsigned int shift =PAGE_SHIFT - bsize_shift; -unsigned int readhead_blocks =BIO_MAX_PAGES << shift; +unsigned int readahead_blocks =BIO_MAX_PAGES << shift;struct gfs2_journal_extent *je;int sz, ret =0 ;struct bio *bio =NULL ;struct page *page =NULL ; -bool done = false; +bool bio_chained = false, done = false;errseq_t since;memset (head,0 ,sizeof (*head));
@@ -504,9 +518,9 @@ int gfs2_find_jhead(struct gfs2_jdesc *j since =filemap_sample_wb_err (mapping);list_for_each_entry (je, &jd->extent_list, list) { -for (; block < je->lblock + je->blocks; block++) { -u64 dblock; +u64 dblock = je->dblock; +for (; block < je->lblock + je->blocks; block++, dblock++) {if (!page) { page =find_or_create_page (mapping, block >> shift,GFP_NOFS );
@@ -515,35 +529,41 @@ int gfs2_find_jhead(struct gfs2_jdesc *j done = true; goto out; } + off =0 ; } -if (bio) { -unsigned int off; - - off = (block << bsize_shift) & ~PAGE_MASK ; +if (!bio || (bio_chained && !off)) { +/* start new bio */ + }else { sz =bio_add_page (bio, page, bsize, off); -if (sz == bsize) {/* block added */ -if (off + bsize ==PAGE_SIZE ) { - page =NULL ; - goto page_added; - } -continue ; +if (sz == bsize) + goto block_added; +if (off) { +unsigned int blocks = + (PAGE_SIZE - off) >> bsize_shift; + + bio =gfs2_chain_bio (bio, blocks); + bio_chained = true; + goto add_block_to_new_bio; } + } + +if (bio) { blocks_submitted = block +1 ;submit_bio (bio); - bio =NULL ; } - dblock = je->dblock + (block - je->lblock); bio =gfs2_log_alloc_bio (sdp, dblock, gfs2_end_log_read); bio->bi_opf =REQ_OP_READ ; - sz =bio_add_page (bio, page, bsize,0 ); -gfs2_assert_warn (sdp, sz == bsize); -if (bsize ==PAGE_SIZE ) + bio_chained = false; +add_block_to_new_bio: + sz =bio_add_page (bio, page, bsize, off); +BUG_ON (sz != bsize); +block_added: + off += bsize; +if (off ==PAGE_SIZE ) page =NULL ; - -page_added: -if (blocks_submitted < blocks_read + readhead_blocks) { +if (blocks_submitted < blocks_read + readahead_blocks) {/* Keep at least one bio in flight */ continue ; }
Greg Kroah-Hartman
maintainerPATCH 9/90 perf c2c: Fix return type for histogram sorting comparision functions
In reply to Greg Kroah-HartmanFrom: Andres Freund <[email protected]>
commit c1c8013ec34d7163431d18367808ea40b2e305f8 upstream.
Commit 722ddfde366f ("perf tools: Fix time sorting") changed - correctly so - hist_entry__sort to return int64. Unfortunately several of the builtin-c2c.c comparison routines only happened to work due the cast caused by the wrong return type.
This causes meaningless ordering of both the cacheline list, and the cacheline details page. E.g a simple:
perf c2c record -a sleep 3
perf c2c report
will result in cacheline table like
=================================================
Shared Data Cache Line Table
=================================================
#
# ------- Cacheline ---------- Total Tot - LLC Load Hitm - - Store Reference - - Load Dram - LLC Total - Core Load Hit - - LLC Load Hit - # Index Address Node PA cnt records Hitm Total Lcl Rmt Total L1Hit L1Miss Lcl Rmt Ld Miss Loads FB L1 L2 Llc Rmt # ..... .............. .... ...... ....... ...... ..... ..... ... .... ..... ...... ...... .... ...... ..... ..... ..... ... .... .......
0 0x7f0d27ffba00 N/A 0 52 0.12% 13 6 7 12 12 0 0 7 14 40 4 16 0 0 0
1 0x7f0d27ff61c0 N/A 0 6353 14.04% 1475 801 674 779 779 0 0 718 1392 5574 1299 1967 0 115 0
2 0x7f0d26d3ec80 N/A 0 71 0.15% 16 4 12 13 13 0 0 12 24 58 1 20 0 9 0
3 0x7f0d26d3ec00 N/A 0 98 0.22% 23 17 6 19 19 0 0 6 12 79 0 40 0 10 0i.e. with the list not being ordered by Total Hitm.
--- tools/perf/builtin-c2c.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
tools/perf/builtin-c2c.c +6 -4
@@ -595,8 +595,8 @@ tot_hitm_cmp(struct perf_hpp_fmt *fmt __ {struct c2c_hist_entry *c2c_left;struct c2c_hist_entry *c2c_right; -unsigned int tot_hitm_left; -unsigned int tot_hitm_right; +uint64_t tot_hitm_left; +uint64_t tot_hitm_right; c2c_left = container_of(left, struct c2c_hist_entry, he); c2c_right = container_of(right, struct c2c_hist_entry, he);
@@ -629,7 +629,8 @@ __f ## _cmp(struct perf_hpp_fmt *fmt __m \ c2c_left = container_of(left, struct c2c_hist_entry, he); \ c2c_right = container_of(right, struct c2c_hist_entry, he); \ -return c2c_left->stats.__f - c2c_right->stats.__f; \ +return (uint64_t ) c2c_left->stats.__f - \ + (uint64_t ) c2c_right->stats.__f; \ }#define STAT_FN (__f) \
@@ -682,7 +683,8 @@ ld_llcmiss_cmp(struct perf_hpp_fmt *fmt c2c_left = container_of(left, struct c2c_hist_entry, he); c2c_right = container_of(right, struct c2c_hist_entry, he); -return llc_miss (&c2c_left->stats) -llc_miss (&c2c_right->stats); +return (uint64_t )llc_miss (&c2c_left->stats) - + (uint64_t )llc_miss (&c2c_right->stats); }static uint64_t total_records (struct c2c_stats *stats)
Greg Kroah-Hartman
maintainerPATCH 10/90 PM / devfreq: Add new name attribute for sysfs
In reply to Greg Kroah-HartmanFrom: Chanwoo Choi <[email protected]>
commit 2fee1a7cc6b1ce6634bb0f025be2c94a58dfa34d upstream.
The commit 4585fbcb5331 ("PM / devfreq: Modify the device name as devfreq(X) for sysfs") changed the node name to devfreq(x). After this commit, it is not possible to get the device name through /sys/class/devfreq/devfreq(X)/*.
Add new name attribute in order to get device name.
--- Documentation/ABI/testing/sysfs-class-devfreq | 7 +++++++ drivers/devfreq/devfreq.c | 9 +++++++++ 2 files changed, 16 insertions(+)
Documentation/ABI/testing/sysfs-class-devfreq +7 -0
@@ -7,6 +7,13 @@ Description: The name of devfreq object denoted as ... is same as the name of device using devfreq. +What: /sys/class/devfreq/.../name +Date: November 2019 +Contact: Chanwoo Choi <[email protected]> +Description: + The /sys/class/devfreq/.../name shows the name of device + of the corresponding devfreq object. + What: /sys/class/devfreq/.../governor Date: September 2011 Contact: MyungJoo Ham <[email protected]>
drivers/devfreq/devfreq.c +9 -0
@@ -1112,6 +1112,14 @@ err_out: }EXPORT_SYMBOL (devfreq_remove_governor); +static ssize_t name_show (struct device *dev, +struct device_attribute *attr,char *buf) +{ +struct devfreq *devfreq =to_devfreq (dev); +return sprintf (buf,"%s\n" ,dev_name (devfreq->dev.parent)); +} +static DEVICE_ATTR_RO (name); +static ssize_t governor_show (struct device *dev,struct device_attribute *attr,char *buf) {
@@ -1440,6 +1448,7 @@ static ssize_t trans_stat_show(struct destatic DEVICE_ATTR_RO (trans_stat);static struct attribute *devfreq_attrs[] = { + &dev_attr_name.attr, &dev_attr_governor.attr, &dev_attr_available_governors.attr, &dev_attr_cur_freq.attr,
Greg Kroah-Hartman
maintainerPATCH 11/90 tools lib: Fix builds when glibc contains strlcpy()
In reply to Greg Kroah-HartmanFrom: Vitaly Chikunov <[email protected]>
commit 6c4798d3f08b81c2c52936b10e0fa872590c96ae upstream.
Disable a couple of compilation warnings (which are treated as errors) on strlcpy() definition and declaration, allowing users to compile perf and kernel (objtool) when:
1. glibc have strlcpy() (such as in ALT Linux since 2004) objtool and perf build fails with this (in gcc):
In file included from exec-cmd.c:3:
tools/include/linux/string.h:20:15: error: redundant redeclaration of ‘strlcpy’ [-Werror=redundant-decls]
20 | extern size_t strlcpy(char *dest, const char *src, size_t size);
2. clang ignores `-Wredundant-decls', but produces another warning when building perf:
CC util/string.o
../lib/string.c:99:8: error: attribute declaration must precede definition [-Werror,-Wignored-attributes] size_t __weak strlcpy(char *dest, const char *src, size_t size) ../../tools/include/linux/compiler.h:66:34: note: expanded from macro '__weak'
# define __weak __attribute__((weak)) /usr/include/bits/string_fortified.h:151:8: note: previous definition is here __NTH (strlcpy (char *__restrict __dest, const char *__restrict __src,
Committer notes:
The
#pragma GCC diagnostic
directive was introduced in gcc 4.6, so check for that as well.
Resolves: https://bugzilla.kernel.org/show_bug.cgi?id=118481
--- tools/include/linux/string.h | 8 ++++++++ tools/lib/string.c | 7 +++++++ 2 files changed, 15 insertions(+)
tools/include/linux/string.h +8 -0
@@ -17,7 +17,15 @@ int strtobool(const char *s, bool *res);* However uClibc headers also define __GLIBC__ hence the hack below */ #if defined(__GLIBC__) && !defined(__UCLIBC__) +// pragma diagnostic was introduced in gcc 4.6 +#if __GNUC__ >4 || (__GNUC__ ==4 && __GNUC_MINOR__ >=6 ) +#pragma GCC diagnostic push +#pragma GCC diagnostic ignored "-Wredundant-decls" +#endif extern size_t strlcpy (char *dest,const char *src,size_t size); +#if __GNUC__ >4 || (__GNUC__ ==4 && __GNUC_MINOR__ >=6 ) +#pragma GCC diagnostic pop +#endif #endif char *str_error_r (int errnum,char *buf,size_t buflen);
tools/lib/string.c +7 -0
@@ -96,6 +96,10 @@ int strtobool(const char *s, bool *res)* If libc has strlcpy() then that version will override this * implementation: */ +#ifdef __clang__ +#pragma clang diagnostic push +#pragma clang diagnostic ignored "-Wignored-attributes" +#endif size_t __weak strlcpy (char *dest,const char *src,size_t size) {size_t ret =strlen (src);
@@ -107,6 +111,9 @@ size_t __weak strlcpy(char *dest, const }return ret; } +#ifdef __clang__ +#pragma clang diagnostic pop +#endif /** * skip_spaces - Removes leading whitespace from @str.
Greg Kroah-Hartman
maintainerPATCH 12/90 arm64: kbuild: remove compressed images on make ARCH=arm64 (dist)clean
In reply to Greg Kroah-HartmanFrom: Dirk Behme <[email protected]>
commit d7bbd6c1b01cb5dd13c245d4586a83145c1d5f52 upstream.
Since v4.3-rc1 commit 0723c05fb75e44 ("arm64: enable more compressed Image formats"), it is possible to build Image.{bz2,lz4,lzma,lzo} AArch64 images. However, the commit missed adding support for removing those images on 'make ARCH=arm64 (dist)clean'.
Fix this by adding them to the target list.
Make sure to match the order of the recipes in the makefile.
--- arch/arm64/boot/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/Makefile +1 -1
@@ -16,7 +16,7 @@ OBJCOPYFLAGS_Image :=-O binary -R .note -R .note.gnu.build-id -R .comment -S -targets := Image Image.gz +targets := Image Image.bz2 Image.gz Image.lz4 Image.lzma Image.lzo $(obj)/Image: vmlinux FORCE $(call if_changed,objcopy)
Greg Kroah-Hartman
maintainerPATCH 13/90 mm/mempolicy.c: fix out of bounds write in mpol_parse_str()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
commit c7a91bc7c2e17e0a9c8b9745a2cb118891218fd1 upstream.
What we are trying to do is change the '=' character to a NUL terminator and then at the end of the function we restore it back to an '='. The problem is there are two error paths where we jump to the end of the function before we have replaced the '=' with NUL.
We end up putting the '=' in the wrong place (possibly one element before the start of the buffer).
Dmitry Vyukov <[email protected]>
--- mm/mempolicy.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
mm/mempolicy.c +3 -3
@@ -2802,6 +2802,9 @@ int mpol_parse_str(char *str, struct memchar *flags =strchr (str,'=' );int err =1 , mode; +if (flags) + *flags++ ='\0' ;/* terminate mode string */ +if (nodelist) {/* NUL-terminate mode or flags string */ *nodelist++ ='\0' ;
@@ -2812,9 +2815,6 @@ int mpol_parse_str(char *str, struct mem }else nodes_clear (nodes); -if (flags) - *flags++ ='\0' ;/* terminate mode string */ - mode =match_string (policy_modes,MPOL_MAX , str);if (mode <0 ) goto out;
Greg Kroah-Hartman
maintainerPATCH 14/90 reiserfs: Fix memory leak of journal device string
In reply to Greg Kroah-HartmanFrom: Jan Kara <[email protected]>
commit 5474ca7da6f34fa95e82edc747d5faa19cbdfb5c upstream.
When a filesystem is mounted with jdev mount option, we store the journal device name in an allocated string in superblock. However we fail to ever free that string. Fix it.
--- fs/reiserfs/super.c | 2 ++ 1 file changed, 2 insertions(+)
fs/reiserfs/super.c +2 -0
@@ -629,6 +629,7 @@ static void reiserfs_put_super(struct sureiserfs_write_unlock (s);mutex_destroy (&REISERFS_SB (s)->lock);destroy_workqueue (REISERFS_SB (s)->commit_wq); +kfree (REISERFS_SB (s)->s_jdev);kfree (s->s_fs_info); s->s_fs_info =NULL ; }
@@ -2240,6 +2241,7 @@ error_unlocked: kfree(qf_names[j]); }#endif +kfree (sbi->s_jdev);kfree (sbi); s->s_fs_info =NULL ;
Greg Kroah-Hartman
maintainerPATCH 15/90 media: digitv: dont continue if remote control state cant be read
In reply to Greg Kroah-HartmanFrom: Sean Young <[email protected]>
commit eecc70d22ae51225de1ef629c1159f7116476b2e upstream.
This results in an uninitialized variable read.
--- drivers/media/usb/dvb-usb/digitv.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/media/usb/dvb-usb/digitv.c +7 -3
@@ -230,18 +230,22 @@ static struct rc_map_table rc_map_digitvstatic int digitv_rc_query (struct dvb_usb_device *d,u32 *event,int *state) { -int i; +int ret, i;u8 key[5 ];u8 b[4 ] = {0 }; *event =0 ; *state =REMOTE_NO_KEY_PRESSED ; -digitv_ctrl_msg (d,USB_READ_REMOTE ,0 ,NULL ,0 ,&key[1 ],4 ); + ret =digitv_ctrl_msg (d,USB_READ_REMOTE ,0 ,NULL ,0 , &key[1 ],4 ); +if (ret) +return ret;/* Tell the device we've read the remote. Not sure how necessary this is, but the Nebula SDK does it. */ -digitv_ctrl_msg (d,USB_WRITE_REMOTE ,0 ,b,4 ,NULL ,0 ); + ret =digitv_ctrl_msg (d,USB_WRITE_REMOTE ,0 , b,4 ,NULL ,0 ); +if (ret) +return ret;/* if something is inside the buffer, simulate key press */ if (key[1 ] !=0 )
Greg Kroah-Hartman
maintainerPATCH 16/90 media: af9005: uninitialized variable printked
In reply to Greg Kroah-HartmanFrom: Sean Young <[email protected]>
commit 51d0c99b391f0cac61ad7b827c26f549ee55672c upstream.
If usb_bulk_msg() fails, actual_length can be uninitialized.
--- drivers/media/usb/dvb-usb/af9005.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/usb/dvb-usb/af9005.c +1 -1
@@ -554,7 +554,7 @@ static int af9005_boot_packet(struct usb u8 *buf, int size) {u16 checksum; -int act_len, i, ret; +int act_len =0 , i, ret;memset (buf,0 , size); buf[0 ] = (u8) (FW_BULKOUT_SIZE &0xff );
Greg Kroah-Hartman
maintainerPATCH 17/90 media: vp7045: do not read uninitialized values if usb transfer fails
In reply to Greg Kroah-HartmanFrom: Sean Young <[email protected]>
commit 26cff637121d8bb866ebd6515c430ac890e6ec80 upstream.
It is not a fatal error if reading the mac address or the remote control decoder state fails.
--- drivers/media/usb/dvb-usb/vp7045.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-)
drivers/media/usb/dvb-usb/vp7045.c +14 -7
@@ -96,10 +96,14 @@ static int vp7045_power_ctrl(struct dvb_static int vp7045_rc_query (struct dvb_usb_device *d) { +int ret;u8 key; -vp7045_usb_op (d,RC_VAL_READ ,NULL ,0 ,&key,1 ,20 ); -deb_rc ("remote query key: %x %d\n" ,key,key); + ret =vp7045_usb_op (d,RC_VAL_READ ,NULL ,0 , &key,1 ,20 ); +if (ret) +return ret; + +deb_rc ("remote query key: %x\n" , key);if (key !=0x44 ) {/*
@@ -115,15 +119,18 @@ static int vp7045_rc_query(struct dvb_usstatic int vp7045_read_eeprom (struct dvb_usb_device *d,u8 *buf,int len,int offset) { -int i =0 ; -u8 v,br[2 ]; +int i, ret; +u8 v, br[2 ];for (i=0 ; i < len; i++) { v = offset + i; -vp7045_usb_op (d,GET_EE_VALUE ,&v,1 ,br,2 ,5 ); + ret =vp7045_usb_op (d,GET_EE_VALUE , &v,1 , br,2 ,5 ); +if (ret) +return ret; + buf[i] = br[1 ]; } -deb_info ("VP7045 EEPROM read (offs: %d, len: %d) : " ,offset, i); -debug_dump (buf,i,deb_info); +deb_info ("VP7045 EEPROM read (offs: %d, len: %d) : " , offset, i); +debug_dump (buf, i, deb_info);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 18/90 media: gspca: zero usb_buf
In reply to Greg Kroah-HartmanFrom: Hans Verkuil <[email protected]>
commit de89d0864f66c2a1b75becfdd6bf3793c07ce870 upstream.
Allocate gspca_dev->usb_buf with kzalloc instead of kmalloc to ensure it is property zeroed. This fixes various syzbot errors about uninitialized data.
Syzbot links:
https://syzkaller.appspot.com/bug?extid=32310fc2aea76898d074
https://syzkaller.appspot.com/bug?extid=99706d6390be1ac542a2
https://syzkaller.appspot.com/bug?extid=64437af5c781a7f0e08e
--- drivers/media/usb/gspca/gspca.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/usb/gspca/gspca.c +1 -1
@@ -1461,7 +1461,7 @@ int gspca_dev_probe2(struct usb_interfacpr_err ("couldn't kzalloc gspca struct\n" );return -ENOMEM ; } - gspca_dev->usb_buf =kmalloc (USB_BUF_SZ ,GFP_KERNEL ); + gspca_dev->usb_buf =kzalloc (USB_BUF_SZ ,GFP_KERNEL );if (!gspca_dev->usb_buf) {pr_err ("out of memory\n" ); ret = -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 19/90 media: dvb-usb/dvb-usb-urb.c: initialize actlen to 0
In reply to Greg Kroah-HartmanFrom: Hans Verkuil <[email protected]>
commit 569bc8d6a6a50acb5fcf07fb10b8d2d461fdbf93 upstream.
This fixes a syzbot failure since actlen could be uninitialized, but it was still used.
Syzbot link:
https://syzkaller.appspot.com/bug?extid=6bf9606ee955b646c0e1
--- drivers/media/usb/dvb-usb/dvb-usb-urb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/usb/dvb-usb/dvb-usb-urb.c +1 -1
@@ -12,7 +12,7 @@int dvb_usb_generic_rw (struct dvb_usb_device *d,u8 *wbuf,u16 wlen,u8 *rbuf,u16 rlen,int delay_ms) { -int actlen,ret = -ENOMEM ; +int actlen =0 , ret = -ENOMEM ;if (!d || wbuf ==NULL || wlen ==0 )return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 20/90 tomoyo: Use atomic_t for statistics counter
In reply to Greg Kroah-HartmanFrom: Tetsuo Handa <[email protected]>
commit a8772fad0172aeae339144598b809fd8d4823331 upstream.
syzbot is reporting that there is a race at tomoyo_stat_update() [1]. Although it is acceptable to fail to track exact number of times policy was updated, convert to atomic_t because this is not a hot path.
[1] https://syzkaller.appspot.com/bug?id=a4d7b973972eeed410596e6604580e0133b0fc04
--- security/tomoyo/common.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-)
security/tomoyo/common.c +4 -7
@@ -2322,9 +2322,9 @@ static const char * const tomoyo_memory_ [TOMOYO_MEMORY_QUERY] = "query message:", }; -/* Timestamp counter for last updated. */ -static unsigned int tomoyo_stat_updated[TOMOYO_MAX_POLICY_STAT ];/* Counter for number of updates. */ +static atomic_t tomoyo_stat_updated[TOMOYO_MAX_POLICY_STAT ]; +/* Timestamp counter for last updated. */ static time64_t tomoyo_stat_modified[TOMOYO_MAX_POLICY_STAT ];/**
@@ -2336,10 +2336,7 @@ static time64_t tomoyo_stat_modified[TOM*/ void tomoyo_update_stat (const u8 index) { -/* -* I don't use atomic operations because race condition is not fatal. -*/ - tomoyo_stat_updated[index]++; +atomic_inc (&tomoyo_stat_updated[index]); tomoyo_stat_modified[index] =ktime_get_real_seconds (); }
@@ -2360,7 +2357,7 @@ static void tomoyo_read_stat(struct tomofor (i =0 ; i <TOMOYO_MAX_POLICY_STAT ; i++) {tomoyo_io_printf (head,"Policy %-30s %10u" , tomoyo_policy_headers[i], - tomoyo_stat_updated[i]); +atomic_read (&tomoyo_stat_updated[i]));if (tomoyo_stat_modified[i]) {struct tomoyo_time stamp;
Greg Kroah-Hartman
maintainerPATCH 21/90 ttyprintk: fix a potential deadlock in interrupt context issue
In reply to Greg Kroah-HartmanFrom: Zhenzhong Duan <[email protected]>
commit 9a655c77ff8fc65699a3f98e237db563b37c439b upstream.
tpk_write()/tpk_close() could be interrupted when holding a mutex, then in timer handler tpk_write() may be called again trying to acquire same mutex, lead to deadlock.
Google syzbot reported this issue with CONFIG_DEBUG_ATOMIC_SLEEP enabled:
BUG: sleeping function called from invalid context at
kernel/locking/mutex.c:938in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 0, name: swapper/1 1 lock held by swapper/1/0:
...
Call Trace: <IRQ> dump_stack+0x197/0x210 ___might_sleep.cold+0x1fb/0x23e __might_sleep+0x95/0x190 __mutex_lock+0xc5/0x13c0 mutex_lock_nested+0x16/0x20 tpk_write+0x5d/0x340 resync_tnc+0x1b6/0x320 call_timer_fn+0x1ac/0x780 run_timer_softirq+0x6c3/0x1790 __do_softirq+0x262/0x98c irq_exit+0x19b/0x1e0 smp_apic_timer_interrupt+0x1a3/0x610 apic_timer_interrupt+0xf/0x20 </IRQ>
See link https://syzkaller.appspot.com/bug?extid=2eeef62ee31f9460ad65 for more details.
Fix it by using spinlock in process context instead of mutex and having interrupt disabled in critical section.
--- drivers/char/ttyprintk.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
drivers/char/ttyprintk.c +9 -6
@@ -15,10 +15,11 @@#include <linux/serial.h> #include <linux/tty.h> #include <linux/module.h> +#include <linux/spinlock.h> struct ttyprintk_port {struct tty_port port; -struct mutex port_write_mutex; +spinlock_t spinlock; };static struct ttyprintk_port tpk_port;
@@ -99,11 +100,12 @@ static int tpk_open(struct tty_struct *tstatic void tpk_close (struct tty_struct *tty,struct file *filp) {struct ttyprintk_port *tpkp = tty->driver_data; +unsigned long flags; -mutex_lock (&tpkp->port_write_mutex); +spin_lock_irqsave (&tpkp->spinlock, flags);/* flush tpk_printk buffer */ tpk_printk (NULL ,0 ); -mutex_unlock (&tpkp->port_write_mutex); +spin_unlock_irqrestore (&tpkp->spinlock, flags);tty_port_close (&tpkp->port, tty, filp); }
@@ -115,13 +117,14 @@ static int tpk_write(struct tty_struct * const unsigned char *buf, int count) {struct ttyprintk_port *tpkp = tty->driver_data; +unsigned long flags;int ret;/* exclusive use of tpk_printk within this tty */ -mutex_lock (&tpkp->port_write_mutex); +spin_lock_irqsave (&tpkp->spinlock, flags); ret =tpk_printk (buf, count); -mutex_unlock (&tpkp->port_write_mutex); +spin_unlock_irqrestore (&tpkp->spinlock, flags);return ret; }
@@ -171,7 +174,7 @@ static int __init ttyprintk_init(void) {int ret = -ENOMEM ; -mutex_init (&tpk_port.port_write_mutex); +spin_lock_init (&tpk_port.spinlock); ttyprintk_driver = tty_alloc_driver(1, TTY_DRIVER_RESET_TERMIOS |
Greg Kroah-Hartman
maintainerPATCH 22/90 Bluetooth: Fix race condition in hci_release_sock()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
commit 11eb85ec42dc8c7a7ec519b90ccf2eeae9409de8 upstream.
Syzbot managed to trigger a use after free "KASAN: use-after-free Write in hci_sock_bind". I have reviewed the code manually and one possibly cause I have found is that we are not holding lock_sock(sk) when we do the hci_dev_put(hdev) in hci_sock_release(). My theory is that the bind and the release are racing against each other which results in this use after free.
--- net/bluetooth/hci_sock.c | 3 +++ 1 file changed, 3 insertions(+)
net/bluetooth/hci_sock.c +3 -0
@@ -831,6 +831,8 @@ static int hci_sock_release(struct sockeif (!sk)return 0 ; +lock_sock (sk); +switch (hci_pi (sk)->channel) {case HCI_CHANNEL_MONITOR :atomic_dec (&monitor_promisc);
@@ -878,6 +880,7 @@ static int hci_sock_release(struct sockeskb_queue_purge (&sk->sk_receive_queue);skb_queue_purge (&sk->sk_write_queue); +release_sock (sk);sock_put (sk);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 23/90 cgroup: Prevent double killing of css when enabling threaded cgroup
In reply to Greg Kroah-HartmanFrom: Michal Koutný <[email protected]>
commit 3bc0bb36fa30e95ca829e9cf480e1ef7f7638333 upstream.
The test_cgcore_no_internal_process_constraint_on_threads selftest when running with subsystem controlling noise triggers two warnings:
Quoted 2 lines
[ 597.443115] WARNING: CPU: 1 PID: 28167 at kernel/cgroup/cgroup.c:3131 cgroup_apply_control_enable+0xe0/0x3f0 [ 597.443413] WARNING: CPU: 1 PID: 28167 at kernel/cgroup/cgroup.c:3177 cgroup_apply_control_disable+0xa6/0x160
Both stem from a call to cgroup_type_write. The first warning was also triggered by syzkaller.
When we're switching cgroup to threaded mode shortly after a subsystem was disabled on it, we can see the respective subsystem css dying there.
The warning in cgroup_apply_control_enable is harmless in this case since we're not adding new subsys anyway.
The warning in cgroup_apply_control_disable indicates an attempt to kill css of recently disabled subsystem repeatedly.
The commit prevents these situations by making cgroup_type_write wait for all dying csses to go away before re-applying subtree controls. When at it, the locations of WARN_ON_ONCE calls are moved so that warning is triggered only when we are about to misuse the dying css.
--- kernel/cgroup/cgroup.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
kernel/cgroup/cgroup.c +6 -5
@@ -3111,8 +3111,6 @@ static int cgroup_apply_control_enable(sfor_each_subsys (ss, ssid) {struct cgroup_subsys_state *css =cgroup_css (dsct, ss); -WARN_ON_ONCE (css &&percpu_ref_is_dying (&css->refcnt)); -if (!(cgroup_ss_mask (dsct) & (1 << ss->id)))continue ;
@@ -3122,6 +3120,8 @@ static int cgroup_apply_control_enable(sreturn PTR_ERR (css); } +WARN_ON_ONCE (percpu_ref_is_dying (&css->refcnt)); +if (css_visible (css)) { ret =css_populate_dir (css);if (ret)
@@ -3157,11 +3157,11 @@ static void cgroup_apply_control_disablefor_each_subsys (ss, ssid) {struct cgroup_subsys_state *css =cgroup_css (dsct, ss); -WARN_ON_ONCE (css &&percpu_ref_is_dying (&css->refcnt)); -if (!css)continue ; +WARN_ON_ONCE (percpu_ref_is_dying (&css->refcnt)); +if (css->parent && !(cgroup_ss_mask (dsct) & (1 << ss->id))) {kill_css (css);
@@ -3448,7 +3448,8 @@ static ssize_t cgroup_type_write(structif (strcmp (strstrip (buf),"threaded" ))return -EINVAL ; - cgrp =cgroup_kn_lock_live (of->kn, false); +/* drain dying csses before we re-apply (threaded) subtree control */ + cgrp =cgroup_kn_lock_live (of->kn, true);if (!cgrp)return -ENOENT ;
Greg Kroah-Hartman
maintainerPATCH 24/90 clk: sunxi-ng: v3s: Fix incorrect number of hw_clks.
In reply to Greg Kroah-HartmanFrom: Yunhao Tian <[email protected]>
[ Upstream commit 4ff40d140e2a2060ef6051800a4a9eab07624f42 ]
The hws field of sun8i_v3s_hw_clks has only 74 members. However, the number specified by CLK_NUMBER is 77 (= CLK_I2S0 + 1). This leads to runtime segmentation fault that is not always reproducible.
This patch fixes the problem by specifying correct clock number.
--- drivers/clk/sunxi-ng/ccu-sun8i-v3s.c | 4 ++-- drivers/clk/sunxi-ng/ccu-sun8i-v3s.h | 2 -- 2 files changed, 2 insertions(+), 4 deletions(-)
drivers/clk/sunxi-ng/ccu-sun8i-v3s.c +2 -2
@@ -618,7 +618,7 @@ static struct clk_hw_onecell_data sun8i_v3s_hw_clks = { [CLK_MBUS] = &mbus_clk.common.hw, [CLK_MIPI_CSI] = &mipi_csi_clk.common.hw, }, - .num = CLK_NUMBER, + .num = CLK_PLL_DDR1 + 1, };static struct clk_hw_onecell_data sun8i_v3_hw_clks = {
@@ -700,7 +700,7 @@ static struct clk_hw_onecell_data sun8i_v3_hw_clks = { [CLK_MBUS] = &mbus_clk.common.hw, [CLK_MIPI_CSI] = &mipi_csi_clk.common.hw, }, - .num = CLK_NUMBER, + .num = CLK_I2S0 + 1, };static struct ccu_reset_map sun8i_v3s_ccu_resets[] = {
drivers/clk/sunxi-ng/ccu-sun8i-v3s.h +0 -2
@@ -51,6 +51,4 @@#define CLK_PLL_DDR1 74 -#define CLK_NUMBER (CLK_I2S0 + 1) -#endif /* _CCU_SUN8I_H3_H_ */
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 25/90 arm64: dts: meson-sm1-sei610: add gpio bluetooth interrupt
In reply to Greg Kroah-HartmanFrom: Guillaume La Roque <[email protected]>
[ Upstream commit 30388cc075720aa0af4f2cb5933afa1f8f39d313 ]
add gpio irq to support interrupt trigger mode.
--- arch/arm64/boot/dts/amlogic/meson-sm1-sei610.dts | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/boot/dts/amlogic/meson-sm1-sei610.dts +2 -0
@@ -361,6 +361,8 @@ bluetooth { compatible = "brcm,bcm43438-bt"; + interrupt-parent = <&gpio_intc>; + interrupts = <95 IRQ_TYPE_LEVEL_HIGH>; shutdown-gpios = <&gpio GPIOX_17 GPIO_ACTIVE_HIGH>; max-speed = <2000000>; clocks = <&wifi32k>;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 26/90 ARM: dts: sun8i: a83t: Correct USB3503 GPIOs polarity
In reply to Greg Kroah-HartmanFrom: Marek Szyprowski <[email protected]>
[ Upstream commit 1c226017d3ec93547b58082bdf778d9db7401c95 ]
Current USB3503 driver ignores GPIO polarity and always operates as if the GPIO lines were flagged as ACTIVE_HIGH. Fix the polarity for the existing USB3503 chip applications to match the chip specification and common convention for naming the pins. The only pin, which has to be ACTIVE_LOW is the reset pin. The remaining are ACTIVE_HIGH. This change allows later to fix the USB3503 driver to properly use generic GPIO bindings and read polarity from DT.
--- arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts +1 -1
@@ -101,7 +101,7 @@ initial-mode = <1>; /* initialize in HUB mode */ disabled-ports = <1>; intn-gpios = <&pio 7 5 GPIO_ACTIVE_HIGH>; /* PH5 */ - reset-gpios = <&pio 4 16 GPIO_ACTIVE_HIGH>; /* PE16 */ + reset-gpios = <&pio 4 16 GPIO_ACTIVE_LOW>; /* PE16 */ connect-gpios = <&pio 4 17 GPIO_ACTIVE_HIGH>; /* PE17 */ refclk-frequency = <19200000>; };
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 27/90 ARM: dts: am57xx-beagle-x15/am57xx-idk: Remove "gpios" for endpoint dt nodes
In reply to Greg Kroah-HartmanFrom: Kishon Vijay Abraham I <[email protected]>
[ Upstream commit 81cc0877840f72210e809bbedd6346d686560fc1 ]
PERST# line in the PCIE connector is driven by the host mode and not EP mode. The gpios property here is used for driving the PERST# line. Remove gpios property from all endpoint device tree nodes.
--- arch/arm/boot/dts/am571x-idk.dts | 4 ---- arch/arm/boot/dts/am572x-idk-common.dtsi | 4 ---- arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi | 4 ---- 3 files changed, 12 deletions(-)
arch/arm/boot/dts/am571x-idk.dts +0 -4
@@ -170,10 +170,6 @@ gpios = <&gpio5 18 GPIO_ACTIVE_HIGH>; }; -&pcie1_ep { - gpios = <&gpio3 23 GPIO_ACTIVE_HIGH>; -}; - &mmc1 { pinctrl-names = "default", "hs"; pinctrl-0 = <&mmc1_pins_default_no_clk_pu>;
arch/arm/boot/dts/am572x-idk-common.dtsi +0 -4
@@ -147,10 +147,6 @@ gpios = <&gpio3 23 GPIO_ACTIVE_HIGH>; }; -&pcie1_ep { - gpios = <&gpio3 23 GPIO_ACTIVE_HIGH>; -}; - &mailbox5 { status = "okay"; mbox_ipu1_ipc3x: mbox_ipu1_ipc3x {
arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi +0 -4
@@ -547,10 +547,6 @@ gpios = <&gpio2 8 GPIO_ACTIVE_LOW>; }; -&pcie1_ep { - gpios = <&gpio2 8 GPIO_ACTIVE_LOW>; -}; - &mcasp3 { #sound-dai-cells = <0>; assigned-clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP3_CLKCTRL 24>;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 28/90 ARM: dts: beagle-x15-common: Model 5V0 regulator
In reply to Greg Kroah-HartmanFrom: Kishon Vijay Abraham I <[email protected]>
[ Upstream commit e17e7c498d4f734df93c300441e100818ed58168 ]
On am57xx-beagle-x15, 5V0 is connected to P16, P17, P18 and P19 connectors. On am57xx-evm, 5V0 regulator is used to get 3V6 regulator which is connected to the COMQ port. Model 5V0 regulator here in order for it to be used in am57xx-evm to model 3V6 regulator.
--- .../boot/dts/am57xx-beagle-x15-common.dtsi | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+)
arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi +21 -0
@@ -29,6 +29,27 @@ reg = <0x0 0x80000000 0x0 0x80000000>; }; + main_12v0: fixedregulator-main_12v0 { + /* main supply */ + compatible = "regulator-fixed"; + regulator-name = "main_12v0"; + regulator-min-microvolt = <12000000>; + regulator-max-microvolt = <12000000>; + regulator-always-on; + regulator-boot-on; + }; + + evm_5v0: fixedregulator-evm_5v0 { + /* Output of TPS54531D */ + compatible = "regulator-fixed"; + regulator-name = "evm_5v0"; + regulator-min-microvolt = <5000000>; + regulator-max-microvolt = <5000000>; + vin-supply = <&main_12v0>; + regulator-always-on; + regulator-boot-on; + }; + vdd_3v3: fixedregulator-vdd_3v3 { compatible = "regulator-fixed"; regulator-name = "vdd_3v3";
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 29/90 soc: ti: wkup_m3_ipc: Fix race condition with rproc_boot
In reply to Greg Kroah-HartmanFrom: Dave Gerlach <[email protected]>
[ Upstream commit 03729cfa0d543bc996bf959e762ec999afc8f3d2 ]
Any user of wkup_m3_ipc calls wkup_m3_ipc_get to get a handle and this checks the value of the static variable m3_ipc_state to see if the wkup_m3 is ready. Currently this is populated during probe before rproc_boot has been called, meaning there is a window of time that wkup_m3_ipc_get can return a valid handle but the wkup_m3 itself is not ready, leading to invalid IPC calls to the wkup_m3 and system instability.
To avoid this, move the population of the m3_ipc_state variable until after rproc_boot has succeeded to guarantee a valid and usable handle is always returned.
--- drivers/soc/ti/wkup_m3_ipc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/soc/ti/wkup_m3_ipc.c +2 -2
@@ -419,6 +419,8 @@ static void wkup_m3_rproc_boot_thread(struct wkup_m3_ipc *m3_ipc) ret =rproc_boot (m3_ipc->rproc);if (ret)dev_err (dev,"rproc_boot failed\n" ); +else + m3_ipc_state = m3_ipc;do_exit (0 ); }
@@ -505,8 +507,6 @@ static int wkup_m3_ipc_probe(struct platform_device *pdev) goto err_put_rproc; } - m3_ipc_state = m3_ipc; -return 0 ; err_put_rproc:
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 30/90 tools lib traceevent: Fix memory leakage in filter_event
In reply to Greg Kroah-HartmanFrom: Hewenliang <[email protected]>
[ Upstream commit f84ae29a6169318f9c929720c49d96323d2bbab9 ]
It is necessary to call free_arg(arg) when add_filter_type() returns NULL in filter_event().
--- tools/lib/traceevent/parse-filter.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
tools/lib/traceevent/parse-filter.c +3 -1
@@ -1228,8 +1228,10 @@ filter_event(struct tep_event_filter *filter, struct tep_event *event, } filter_type =add_filter_type (filter, event->id); -if (filter_type ==NULL ) +if (filter_type ==NULL ) { +free_arg (arg);return TEP_ERRNO__MEM_ALLOC_FAILED ; + }if (filter_type->filter)free_arg (filter_type->filter);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 31/90 rseq: Unregister rseq for clone CLONE_VM
In reply to Greg Kroah-HartmanFrom: Mathieu Desnoyers <[email protected]>
[ Upstream commit 463f550fb47bede3a5d7d5177f363a6c3b45d50b ]
It has been reported by Google that rseq is not behaving properly with respect to clone when CLONE_VM is used without CLONE_THREAD.
It keeps the prior thread's rseq TLS registered when the TLS of the thread has moved, so the kernel can corrupt the TLS of the parent.
The approach of clearing the per task-struct rseq registration on clone with CLONE_THREAD flag is incomplete. It does not cover the use-case of clone with CLONE_VM set, but without CLONE_THREAD.
Here is the rationale for unregistering rseq on clone with CLONE_VM flag set:
1) CLONE_THREAD requires CLONE_SIGHAND, which requires CLONE_VM to be set. Therefore, just checking for CLONE_VM covers all CLONE_THREAD uses. There is no point in checking for both CLONE_THREAD and CLONE_VM,
2) There is the possibility of an unlikely scenario where CLONE_SETTLS is used without CLONE_VM. In order to be an issue, it would require that the rseq TLS is in a shared memory area.
I do not plan on adding CLONE_SETTLS to the set of clone flags which unregister RSEQ, because it would require that we also unregister RSEQ on set_thread_area(2) and arch_prctl(2) ARCH_SET_FS for completeness. So rather than doing a partial solution, it appears better to let user-space explicitly perform rseq unregistration across clone if needed in scenarios where CLONE_VM is not set.
--- include/linux/sched.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/linux/sched.h +2 -2
@@ -1915,11 +1915,11 @@ static inline void rseq_migrate(struct task_struct *t)/* * If parent process has a registered restartable sequences area, the -* child inherits. Only applies when forking a process, not a thread. +* child inherits. Unregister rseq for a clone with CLONE_VM set. */ static inline void rseq_fork (struct task_struct *t,unsigned long clone_flags) { -if (clone_flags &CLONE_THREAD ) { +if (clone_flags &CLONE_VM ) { t->rseq =NULL ; t->rseq_sig =0 ; t->rseq_event_mask =0 ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 32/90 clk: sunxi-ng: sun8i-r: Fix divider on APB0 clock
In reply to Greg Kroah-HartmanFrom: Samuel Holland <[email protected]>
[ Upstream commit 47d64fef1f3ffbdf960d3330b9865fc9f12fdf84 ]
According to the BSP source code, the APB0 clock on the H3 and H5 has a normal M divider, not a power-of-two divider. This matches the hardware in the A83T (as described in both the BSP source code and the manual). Since the A83T and H3/A64 clocks are actually the same, we can merge the definitions.
--- drivers/clk/sunxi-ng/ccu-sun8i-r.c | 21 +++------------------ 1 file changed, 3 insertions(+), 18 deletions(-)
drivers/clk/sunxi-ng/ccu-sun8i-r.c +3 -18
@@ -51,19 +51,7 @@ static struct ccu_div ar100_clk = { static CLK_FIXED_FACTOR_HW(ahb0_clk, "ahb0", &ar100_clk.common.hw, 1, 1, 0); -static struct ccu_div apb0_clk = { - .div =_SUNXI_CCU_DIV_FLAGS (0 ,2 ,CLK_DIVIDER_POWER_OF_TWO ), - - .common = { - .reg =0x0c , - .hw.init =CLK_HW_INIT_HW ("apb0" , - &ahb0_clk.hw, - &ccu_div_ops, -0 ), - }, -}; - -static SUNXI_CCU_M(a83t_apb0_clk, "apb0", "ahb0", 0x0c, 0, 2, 0); +static SUNXI_CCU_M(apb0_clk, "apb0", "ahb0", 0x0c, 0, 2, 0);/* * Define the parent as an array that can be reused to save space
@@ -127,7 +115,7 @@ static struct ccu_mp a83t_ir_clk = {static struct ccu_common *sun8i_a83t_r_ccu_clks[] = { &ar100_clk.common, - &a83t_apb0_clk.common, + &apb0_clk.common, &apb0_pio_clk.common, &apb0_ir_clk.common, &apb0_timer_clk.common,
@@ -167,7 +155,7 @@ static struct clk_hw_onecell_data sun8i_a83t_r_hw_clks = { .hws = { [CLK_AR100] = &ar100_clk.common.hw, [CLK_AHB0] = &ahb0_clk.hw, - [CLK_APB0] = &a83t_apb0_clk.common.hw, + [CLK_APB0] = &apb0_clk.common.hw, [CLK_APB0_PIO] = &apb0_pio_clk.common.hw, [CLK_APB0_IR] = &apb0_ir_clk.common.hw, [CLK_APB0_TIMER] = &apb0_timer_clk.common.hw,
@@ -282,9 +270,6 @@ static void __init sunxi_r_ccu_init(struct device_node *node,static void __init sun8i_a83t_r_ccu_setup (struct device_node *node) { -/* Fix apb0 bus gate parents here */ - apb0_gate_parent[0 ] = &a83t_apb0_clk.common.hw; -sunxi_r_ccu_init (node, &sun8i_a83t_r_ccu_desc); } CLK_OF_DECLARE(sun8i_a83t_r_ccu, "allwinner,sun8i-a83t-r-ccu",
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 33/90 clk: sunxi-ng: h6-r: Fix AR100/R_APB2 parent order
In reply to Greg Kroah-HartmanFrom: Samuel Holland <[email protected]>
[ Upstream commit 0c545240aebc2ccb8f661dc54283a14d64659804 ]
According to the BSP source code, both the AR100 and R_APB2 clocks have PLL_PERIPH0 as mux index 3, not 2 as it was on previous chips. The pre- divider used for PLL_PERIPH0 should be changed to index 3 to match.
This was verified by running a rough benchmark on the AR100 with various clock settings:
| mux | pre-divider | iterations/second | clock source |
|=====|=============|===================|==============|
| 0 | 0 | 19033 (stable) | osc24M |
| 2 | 5 | 11466 (unstable) | iosc/osc16M |
| 2 | 17 | 11422 (unstable) | iosc/osc16M |
| 3 | 5 | 85338 (stable) | pll-periph0 |
| 3 | 17 | 27167 (stable) | pll-periph0 |The relative performance numbers all match up (with pll-periph0 running at its default 600MHz).
--- drivers/clk/sunxi-ng/ccu-sun50i-h6-r.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/clk/sunxi-ng/ccu-sun50i-h6-r.c +2 -2
@@ -23,9 +23,9 @@*/ static const char *const ar100_r_apb2_parents[] = {"osc24M" ,"osc32k" , -"pll-periph0" ,"iosc" }; +"iosc" ,"pll-periph0" };static const struct ccu_mux_var_prediv ar100_r_apb2_predivs[] = { - { .index =2 , .shift =0 , .width =5 }, + { .index =3 , .shift =0 , .width =5 }, };static struct ccu_div ar100_clk = {
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 34/90 mac80211: mesh: restrict airtime metric to peered established plinks
In reply to Greg Kroah-HartmanFrom: Markus Theil <[email protected]>
[ Upstream commit 02a614499600af836137c3fbc4404cd96365fff2 ]
The following warning is triggered every time an unestablished mesh peer gets dumped. Checks if a peer link is established before retrieving the airtime link metric.
[ 9563.022567] WARNING: CPU: 0 PID: 6287 at net/mac80211/mesh_hwmp.c:345
airtime_link_metric_get+0xa2/0xb0 [mac80211]
[ 9563.022697] Hardware name: PC Engines apu2/apu2, BIOS v4.10.0.3
[ 9563.022756] RIP: 0010:airtime_link_metric_get+0xa2/0xb0 [mac80211]
[ 9563.022838] Call Trace:
[ 9563.022897] sta_set_sinfo+0x936/0xa10 [mac80211]
[ 9563.022964] ieee80211_dump_station+0x6d/0x90 [mac80211]
[ 9563.023062] nl80211_dump_station+0x154/0x2a0 [cfg80211]
[ 9563.023120] netlink_dump+0x17b/0x370
[ 9563.023130] netlink_recvmsg+0x2a4/0x480
[ 9563.023140] ____sys_recvmsg+0xa6/0x160
[ 9563.023154] ___sys_recvmsg+0x93/0xe0
[ 9563.023169] __sys_recvmsg+0x7e/0xd0
[ 9563.023210] do_syscall_64+0x4e/0x140
[ 9563.023217] entry_SYSCALL_64_after_hwframe+0x44/0xa9--- net/mac80211/mesh_hwmp.c | 3 +++ 1 file changed, 3 insertions(+)
net/mac80211/mesh_hwmp.c +3 -0
@@ -328,6 +328,9 @@ u32 airtime_link_metric_get(struct ieee80211_local *local,unsigned long fail_avg =ewma_mesh_fail_avg_read (&sta->mesh->fail_avg); +if (sta->mesh->plink_state !=NL80211_PLINK_ESTAB ) +return MAX_METRIC ; +/* Try to get rate based on HW/SW RC algorithm. * Rate is returned in units of Kbps, correct this * to comply with airtime calculation units
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 35/90 clk: mmp2: Fix the order of timer mux parents
In reply to Greg Kroah-HartmanFrom: Lubomir Rintel <[email protected]>
[ Upstream commit 8bea5ac0fbc5b2103f8779ddff216122e3c2e1ad ]
Determined empirically, no documentation is available.
The OLPC XO-1.75 laptop used parent 1, that one being VCTCXO/4 (65MHz), but thought it's a VCTCXO/2 (130MHz). The mmp2 timer driver, not knowing what is going on, ended up just dividing the rate as of
commit f36797ee4380 ("ARM: mmp/mmp2: dt: enable the clock")'
--- drivers/clk/mmp/clk-of-mmp2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/mmp/clk-of-mmp2.c +1 -1
@@ -134,7 +134,7 @@ static DEFINE_SPINLOCK(ssp3_lock);static const char *ssp_parent_names[] = {"vctcxo_4" ,"vctcxo_2" ,"vctcxo" ,"pll1_16" };static DEFINE_SPINLOCK (timer_lock); -static const char *timer_parent_names[] = {"clk32" ,"vctcxo_2" ,"vctcxo_4" ,"vctcxo" }; +static const char *timer_parent_names[] = {"clk32" ,"vctcxo_4" ,"vctcxo_2" ,"vctcxo" };static DEFINE_SPINLOCK (reset_lock);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 36/90 ASoC: rt5640: Fix NULL dereference on module unload
In reply to Greg Kroah-HartmanFrom: Dmitry Osipenko <[email protected]>
[ Upstream commit 89b71b3f02d8ae5a08a1dd6f4a2098b7b868d498 ]
The rt5640->jack is NULL if jack is already disabled at the time of driver's module unloading.
--- sound/soc/codecs/rt5640.c | 7 +++++++ 1 file changed, 7 insertions(+)
sound/soc/codecs/rt5640.c +7 -0
@@ -2432,6 +2432,13 @@ static void rt5640_disable_jack_detect(struct snd_soc_component *component) {struct rt5640_priv *rt5640 =snd_soc_component_get_drvdata (component); +/* +* soc_remove_component() force-disables jack and thus rt5640->jack +* could be NULL at the time of driver's module unloading. +*/ +if (!rt5640->jack) +return ; +disable_irq (rt5640->irq);rt5640_cancel_work (rt5640);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 37/90 s390/zcrypt: move ap device reset from bus to driver code
In reply to Greg Kroah-HartmanFrom: Harald Freudenberger <[email protected]>
[ Upstream commit 0c874cd04292c7ee22d70eefc341fa2648f41f46 ]
This patch moves the reset invocation of an ap device when fresh detected from the ap bus to the probe() function of the driver responsible for this device.
The virtualisation of ap devices makes it necessary to remove unconditioned resets on fresh appearing apqn devices. It may be that such a device is already enabled for guest usage. So there may be a race condition between host ap bus and guest ap bus doing the reset. This patch moves the reset from the ap bus to the zcrypt drivers. So if there is no zcrypt driver bound to an ap device - for example the ap device is bound to the vfio device driver - the ap device is untouched passed to the vfio device driver.
--- drivers/s390/crypto/ap_bus.c | 2 -- drivers/s390/crypto/ap_bus.h | 2 +- drivers/s390/crypto/ap_queue.c | 5 +++-- drivers/s390/crypto/zcrypt_cex2a.c | 1 + drivers/s390/crypto/zcrypt_cex2c.c | 2 ++ drivers/s390/crypto/zcrypt_cex4.c | 1 + 6 files changed, 8 insertions(+), 5 deletions(-)
drivers/s390/crypto/ap_bus.c +0 -2
@@ -793,8 +793,6 @@ static int ap_device_probe(struct device *dev) drvres = ap_drv->flags &AP_DRIVER_FLAG_DEFAULT ;if (!!devres != !!drvres)return -ENODEV ; -/* (re-)init queue's state machine */ -ap_queue_reinit_state (to_ap_queue (dev)); }/* Add queue/card to list of active queues/cards */
drivers/s390/crypto/ap_bus.h +1 -1
@@ -261,7 +261,7 @@ void ap_queue_prepare_remove(struct ap_queue *aq);void ap_queue_remove (struct ap_queue *aq);void ap_queue_suspend (struct ap_device *ap_dev);void ap_queue_resume (struct ap_device *ap_dev); -void ap_queue_reinit_state (struct ap_queue *aq); +void ap_queue_init_state (struct ap_queue *aq);struct ap_card *ap_card_create (int id,int queue_depth,int raw_device_type,int comp_device_type,unsigned int functions);
drivers/s390/crypto/ap_queue.c +3 -2
@@ -638,7 +638,7 @@ struct ap_queue *ap_queue_create(ap_qid_t qid, int device_type) aq->ap_dev.device.type = &ap_queue_type; aq->ap_dev.device_type = device_type; aq->qid = qid; - aq->state =AP_STATE_RESET_START ; + aq->state =AP_STATE_UNBOUND ; aq->interrupt =AP_INTR_DISABLED ;spin_lock_init (&aq->lock);INIT_LIST_HEAD (&aq->list);
@@ -771,10 +771,11 @@ void ap_queue_remove(struct ap_queue *aq)spin_unlock_bh (&aq->lock); } -void ap_queue_reinit_state (struct ap_queue *aq) +void ap_queue_init_state (struct ap_queue *aq) {spin_lock_bh (&aq->lock); aq->state =AP_STATE_RESET_START ;ap_wait (ap_sm_event (aq,AP_EVENT_POLL ));spin_unlock_bh (&aq->lock); } +EXPORT_SYMBOL (ap_queue_init_state);
drivers/s390/crypto/zcrypt_cex2a.c +1 -0
@@ -175,6 +175,7 @@ static int zcrypt_cex2a_queue_probe(struct ap_device *ap_dev) zq->queue = aq; zq->online =1 ;atomic_set (&zq->load,0 ); +ap_queue_init_state (aq);ap_queue_init_reply (aq, &zq->reply); aq->request_timeout =CEX2A_CLEANUP_TIME , aq->private = zq;
drivers/s390/crypto/zcrypt_cex2c.c +2 -0
@@ -220,6 +220,7 @@ static int zcrypt_cex2c_queue_probe(struct ap_device *ap_dev) zq->queue = aq; zq->online =1 ;atomic_set (&zq->load,0 ); +ap_rapq (aq->qid); rc =zcrypt_cex2c_rng_supported (aq);if (rc <0 ) {zcrypt_queue_free (zq);
@@ -231,6 +232,7 @@ static int zcrypt_cex2c_queue_probe(struct ap_device *ap_dev)else zq->ops =zcrypt_msgtype (MSGTYPE06_NAME ,MSGTYPE06_VARIANT_NORNG ); +ap_queue_init_state (aq);ap_queue_init_reply (aq, &zq->reply); aq->request_timeout =CEX2C_CLEANUP_TIME ; aq->private = zq;
drivers/s390/crypto/zcrypt_cex4.c +1 -0
@@ -381,6 +381,7 @@ static int zcrypt_cex4_queue_probe(struct ap_device *ap_dev) zq->queue = aq; zq->online =1 ;atomic_set (&zq->load,0 ); +ap_queue_init_state (aq);ap_queue_init_reply (aq, &zq->reply); aq->request_timeout =CEX4_CLEANUP_TIME , aq->private = zq;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 38/90 i40e: Fix virtchnl_queue_select bitmap validation
In reply to Greg Kroah-HartmanFrom: Brett Creeley <[email protected]>
[ Upstream commit d9d6a9aed3f66f8ce5fa3ca6ca26007d75032296 ]
Currently in i40e_vc_disable_queues_msg() we are incorrectly validating the virtchnl queue select bitmaps. The virtchnl_queue_select rx_queues and tx_queue bitmap is being compared against ICE_MAX_VF_QUEUES, but the problem is that these bitmaps can have a value greater than I40E_MAX_VF_QUEUES. Fix this by comparing the bitmaps against BIT(I40E_MAX_VF_QUEUES).
Also, add the function i40e_vc_validate_vqs_bitmaps() that checks to see if both virtchnl_queue_select bitmaps are empty along with checking that the bitmaps only have valid bits set. This function can then be used in both the queue enable and disable flows.
--- .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 22 +++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-)
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +18 -4
@@ -2322,6 +2322,22 @@ static int i40e_ctrl_vf_rx_rings(struct i40e_vsi *vsi, unsigned long q_map,return ret; } +/** +* i40e_vc_validate_vqs_bitmaps - validate Rx/Tx queue bitmaps from VIRTHCHNL +* @vqs: virtchnl_queue_select structure containing bitmaps to validate +* +* Returns true if validation was successful, else false. +*/ +static bool i40e_vc_validate_vqs_bitmaps (struct virtchnl_queue_select *vqs) +{ +if ((!vqs->rx_queues && !vqs->tx_queues) || + vqs->rx_queues >=BIT (I40E_MAX_VF_QUEUES ) || + vqs->tx_queues >=BIT (I40E_MAX_VF_QUEUES )) +return false; + +return true; +} +/** * i40e_vc_enable_queues_msg * @vf: pointer to the VF info
@@ -2347,7 +2363,7 @@ static int i40e_vc_enable_queues_msg(struct i40e_vf *vf, u8 *msg) goto error_param; } -if ((0 == vqs->rx_queues) && (0 == vqs->tx_queues)) { +if (i40e_vc_validate_vqs_bitmaps (vqs)) { aq_ret =I40E_ERR_PARAM ; goto error_param; }
@@ -2409,9 +2425,7 @@ static int i40e_vc_disable_queues_msg(struct i40e_vf *vf, u8 *msg) goto error_param; } -if ((vqs->rx_queues ==0 && vqs->tx_queues ==0 ) || - vqs->rx_queues >I40E_MAX_VF_QUEUES || - vqs->tx_queues >I40E_MAX_VF_QUEUES ) { +if (i40e_vc_validate_vqs_bitmaps (vqs)) { aq_ret =I40E_ERR_PARAM ; goto error_param; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 39/90 ixgbevf: Remove limit of 10 entries for unicast filter list
In reply to Greg Kroah-HartmanFrom: Radoslaw Tyl <[email protected]>
[ Upstream commit aa604651d523b1493988d0bf6710339f3ee60272 ]
Currently, though the FDB entry is added to VF, it does not appear in RAR filters. VF driver only allows to add 10 entries. Attempting to add another causes an error. This patch removes limitation and allows use of all free RAR entries for the FDB if needed.
--- drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 5 ----- 1 file changed, 5 deletions(-)
drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c +0 -5
@@ -2081,11 +2081,6 @@ static int ixgbevf_write_uc_addr_list(struct net_device *netdev)struct ixgbe_hw *hw = &adapter->hw;int count =0 ; -if ((netdev_uc_count (netdev)) >10 ) { -pr_err ("Too many unicast filters - No Space\n" ); -return -ENOSPC ; - } -if (!netdev_uc_empty (netdev)) {struct netdev_hw_addr *ha;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 40/90 ixgbe: Fix calculation of queue with VFs and flow director on interface flap
In reply to Greg Kroah-HartmanFrom: Cambda Zhu <[email protected]>
[ Upstream commit 4fad78ad6422d9bca62135bbed8b6abc4cbb85b8 ]
This patch fixes the calculation of queue when we restore flow director filters after resetting adapter. In ixgbe_fdir_filter_restore(), filter's vf may be zero which makes the queue outside of the rx_ring array.
The calculation is changed to the same as ixgbe_add_ethtool_fdir_entry().
--- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 37 ++++++++++++++----- 1 file changed, 27 insertions(+), 10 deletions(-)
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +27 -10
@@ -5239,7 +5239,7 @@ static void ixgbe_fdir_filter_restore(struct ixgbe_adapter *adapter)struct ixgbe_hw *hw = &adapter->hw;struct hlist_node *node2;struct ixgbe_fdir_filter *filter; -u64 action; +u8 queue;spin_lock (&adapter->fdir_perfect_lock);
@@ -5248,17 +5248,34 @@ static void ixgbe_fdir_filter_restore(struct ixgbe_adapter *adapter)hlist_for_each_entry_safe (filter, node2, &adapter->fdir_filter_list, fdir_node) { - action = filter->action; -if (action !=IXGBE_FDIR_DROP_QUEUE && action !=0 ) - action = - (action >>ETHTOOL_RX_FLOW_SPEC_RING_VF_OFF ) -1 ; +if (filter->action ==IXGBE_FDIR_DROP_QUEUE ) { + queue =IXGBE_FDIR_DROP_QUEUE ; + }else { +u32 ring =ethtool_get_flow_spec_ring (filter->action); +u8 vf =ethtool_get_flow_spec_ring_vf (filter->action); + +if (!vf && (ring >= adapter->num_rx_queues)) { +e_err (drv,"FDIR restore failed without VF, ring: %u\n" , + ring); +continue ; + }else if (vf && + ((vf > adapter->num_vfs) || + ring >= adapter->num_rx_queues_per_pool)) { +e_err (drv,"FDIR restore failed with VF, vf: %hhu, ring: %u\n" , + vf, ring); +continue ; + } + +/* Map the ring onto the absolute queue index */ +if (!vf) + queue = adapter->rx_ring[ring]->reg_idx; +else + queue = ((vf -1 ) * + adapter->num_rx_queues_per_pool) + ring; + }ixgbe_fdir_write_perfect_filter_82599 (hw, - &filter->filter, - filter->sw_idx, - (action ==IXGBE_FDIR_DROP_QUEUE ) ? -IXGBE_FDIR_DROP_QUEUE : - adapter->rx_ring[action]->reg_idx); + &filter->filter, filter->sw_idx, queue); }spin_unlock (&adapter->fdir_perfect_lock);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 41/90 igb: Fix SGMII SFP module discovery for 100FX/LX.
In reply to Greg Kroah-HartmanFrom: Manfred Rudigier <[email protected]>
[ Upstream commit 5365ec1aeff5b9f2962a9c9b31d63f9dad7e0e2d ]
Changing the link mode should also be done for 100BaseFX SGMII modules, otherwise they just don't work when the default link mode in CTRL_EXT coming from the EEPROM is SERDES.
Additionally 100Base-LX SGMII SFP modules are also supported now, which was not the case before.
Tested with an i210 using Flexoptix S.1303.2M.G 100FX and S.1303.10.G 100LX SGMII SFP modules.
--- drivers/net/ethernet/intel/igb/e1000_82575.c | 8 ++------ drivers/net/ethernet/intel/igb/igb_ethtool.c | 2 +- 2 files changed, 3 insertions(+), 7 deletions(-)
drivers/net/ethernet/intel/igb/e1000_82575.c +2 -6
@@ -530,7 +530,7 @@ static s32 igb_set_sfp_media_type_82575(struct e1000_hw *hw) dev_spec->module_plugged = true;if (eth_flags->e1000_base_lx || eth_flags->e1000_base_sx) { hw->phy.media_type = e1000_media_type_internal_serdes; - }else if (eth_flags->e100_base_fx) { + }else if (eth_flags->e100_base_fx || eth_flags->e100_base_lx) { dev_spec->sgmii_active = true; hw->phy.media_type = e1000_media_type_internal_serdes; }else if (eth_flags->e1000_base_t) {
@@ -657,14 +657,10 @@ static s32 igb_get_invariants_82575(struct e1000_hw *hw)break ; } -/* do not change link mode for 100BaseFX */ -if (dev_spec->eth_flags.e100_base_fx) -break ; -/* change current link mode setting */ ctrl_ext &= ~E1000_CTRL_EXT_LINK_MODE_MASK ; -if (hw->phy.media_type == e1000_media_type_copper) +if (dev_spec->sgmii_active) ctrl_ext |=E1000_CTRL_EXT_LINK_MODE_SGMII ;else ctrl_ext |=E1000_CTRL_EXT_LINK_MODE_PCIE_SERDES ;
drivers/net/ethernet/intel/igb/igb_ethtool.c +1 -1
@@ -181,7 +181,7 @@ static int igb_get_link_ksettings(struct net_device *netdev, advertising &= ~ADVERTISED_1000baseKX_Full; } } -if (eth_flags->e100_base_fx) { +if (eth_flags->e100_base_fx || eth_flags->e100_base_lx) { supported |= SUPPORTED_100baseT_Full; advertising |= ADVERTISED_100baseT_Full; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 42/90 iavf: remove current MAC address filter on VF reset
In reply to Greg Kroah-HartmanFrom: Stefan Assmann <[email protected]>
[ Upstream commit 9e05229190380f6b8f702da39aaeb97a0fc80dc3 ]
Currently MAC filters are not altered during a VF reset event. This may lead to a stale filter when an administratively set MAC is forced by the PF.
For an administratively set MAC the PF driver deletes the VFs filters, overwrites the VFs MAC address and triggers a VF reset. However the VF driver itself is not aware of the filter removal, which is what the VF reset is for.
The VF reset queues all filters present in the VF driver to be re-added to the PF filter list (including the filter for the now stale VF MAC address) and triggers a VIRTCHNL_OP_GET_VF_RESOURCES event, which provides the new MAC address to the VF.
When this happens i40e will complain and reject the stale MAC filter,
at least in the untrusted VF case.
i40e 0000:08:00.0: Setting MAC 3c:fa:fa:fa:fa:01 on VF 0
iavf 0000:08:02.0: Reset warning received from the PF
iavf 0000:08:02.0: Scheduling reset task
i40e 0000:08:00.0: Bring down and up the VF interface to make this change effective.
i40e 0000:08:00.0: VF attempting to override administratively set MAC address, bring down and up the VF interface to resume normal operation i40e 0000:08:00.0: VF 0 failed opcode 10, retval: -1
iavf 0000:08:02.0: Failed to add MAC filter, error IAVF_ERR_NVM
To avoid re-adding the stale MAC filter it needs to be removed from the VF driver's filter list before queuing the existing filters. Then during the VIRTCHNL_OP_GET_VF_RESOURCES event the correct filter needs to be added again, at which point the MAC address has been updated.
As a bonus this change makes bringing the VF down and up again superfluous for the administratively set MAC case.
--- drivers/net/ethernet/intel/iavf/iavf.h | 2 ++ drivers/net/ethernet/intel/iavf/iavf_main.c | 17 +++++++++++++---- drivers/net/ethernet/intel/iavf/iavf_virtchnl.c | 3 +++ 3 files changed, 18 insertions(+), 4 deletions(-)
drivers/net/ethernet/intel/iavf/iavf.h +2 -0
@@ -415,4 +415,6 @@ void iavf_enable_channels(struct iavf_adapter *adapter);void iavf_disable_channels (struct iavf_adapter *adapter);void iavf_add_cloud_filter (struct iavf_adapter *adapter);void iavf_del_cloud_filter (struct iavf_adapter *adapter); +struct iavf_mac_filter *iavf_add_filter (struct iavf_adapter *adapter, +const u8 *macaddr);#endif /* _IAVF_H_ */
drivers/net/ethernet/intel/iavf/iavf_main.c +13 -4
@@ -743,9 +743,8 @@ iavf_mac_filter *iavf_find_filter(struct iavf_adapter *adapter,* * Returns ptr to the filter object or NULL when no memory available. **/ -static struct -iavf_mac_filter *iavf_add_filter (struct iavf_adapter *adapter, -const u8 *macaddr) +struct iavf_mac_filter *iavf_add_filter (struct iavf_adapter *adapter, +const u8 *macaddr) {struct iavf_mac_filter *f;
@@ -2065,9 +2064,9 @@ static void iavf_reset_task(struct work_struct *work)struct virtchnl_vf_resource *vfres = adapter->vf_res;struct net_device *netdev = adapter->netdev;struct iavf_hw *hw = &adapter->hw; +struct iavf_mac_filter *f, *ftmp;struct iavf_vlan_filter *vlf;struct iavf_cloud_filter *cf; -struct iavf_mac_filter *f;u32 reg_val;int i =0 , err;bool running;
@@ -2181,6 +2180,16 @@ static void iavf_reset_task(struct work_struct *work)spin_lock_bh (&adapter->mac_vlan_list_lock); +/* Delete filter for the current MAC address, it could have +* been changed by the PF via administratively set MAC. +* Will be re-added via VIRTCHNL_OP_GET_VF_RESOURCES. +*/ +list_for_each_entry_safe (f, ftmp, &adapter->mac_filter_list, list) { +if (ether_addr_equal (f->macaddr, adapter->hw.mac.addr)) { +list_del (&f->list); +kfree (f); + } + }/* re-add all MAC filters */ list_for_each_entry (f, &adapter->mac_filter_list, list) { f->add = true;
drivers/net/ethernet/intel/iavf/iavf_virtchnl.c +3 -0
@@ -1359,6 +1359,9 @@ void iavf_virtchnl_completion(struct iavf_adapter *adapter,ether_addr_copy (netdev->perm_addr, adapter->hw.mac.addr); } +spin_lock_bh (&adapter->mac_vlan_list_lock); +iavf_add_filter (adapter, adapter->hw.mac.addr); +spin_unlock_bh (&adapter->mac_vlan_list_lock);iavf_process_config (adapter); }break ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 43/90 platform/x86: GPD pocket fan: Allow somewhat lower/higher temperature limits
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit 1f27dbd8265dbb379926c8f6a4453fe7fe26d7a3 ]
Allow the user to configure the fan to turn on / speed-up at lower thresholds then before (20 degrees Celcius as minimum instead of 40) and likewise also allow the user to delay the fan speeding-up till the temperature hits 90 degrees Celcius (was 70).
--- drivers/platform/x86/gpd-pocket-fan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/platform/x86/gpd-pocket-fan.c +1 -1
@@ -127,7 +127,7 @@ static int gpd_pocket_fan_probe(struct platform_device *pdev)int i;for (i =0 ; i <ARRAY_SIZE (temp_limits); i++) { -if (temp_limits[i] <40000 || temp_limits[i] >70000 ) { +if (temp_limits[i] <20000 || temp_limits[i] >90000 ) {dev_err (&pdev->dev,"Invalid temp-limit %d (must be between 40000 and 70000)\n" , temp_limits[i]); temp_limits[0 ] =TEMP_LIMIT0_DEFAULT ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 44/90 platform/x86: intel_pmc_core: update Comet Lake platform driver
In reply to Greg Kroah-HartmanFrom: Harry Pan <[email protected]>
[ Upstream commit 515ff674bb9bf06186052e352c4587dab8defaf0 ]
Adding new CML CPU model ID into platform driver support list.
--- drivers/platform/x86/intel_pmc_core_pltdrv.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/platform/x86/intel_pmc_core_pltdrv.c +2 -0
@@ -44,6 +44,8 @@ static const struct x86_cpu_id intel_pmc_core_platform_ids[] = {INTEL_CPU_FAM6 (KABYLAKE , pmc_core_device),INTEL_CPU_FAM6 (CANNONLAKE_L , pmc_core_device),INTEL_CPU_FAM6 (ICELAKE_L , pmc_core_device), +INTEL_CPU_FAM6 (COMETLAKE , pmc_core_device), +INTEL_CPU_FAM6 (COMETLAKE_L , pmc_core_device), {} };MODULE_DEVICE_TABLE (x86cpu, intel_pmc_core_platform_ids);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 45/90 ASoC: SOF: Intel: fix HDA codec driver probe with multiple controllers
In reply to Greg Kroah-HartmanFrom: Kai Vehmanen <[email protected]>
[ Upstream commit 2c63bea714780f8e1fc9cb7bc10deda26fada25b ]
In case system has multiple HDA controllers, it can happen that same HDA codec driver is used for codecs of multiple controllers. In this case, SOF may fail to probe the HDA driver and SOF initialization fails.
SOF HDA code currently relies that a call to request_module() will also run device matching logic to attach driver to the codec instance. However if driver for another HDA controller was already loaded and it already loaded the HDA codec driver, this breaks current logic in SOF. In this case the request_module() SOF does becomes a no-op and HDA Codec driver is not attached to the codec instance sitting on the HDA bus SOF is controlling. Typical scenario would be a system with both external and internal GPUs, with driver of the external GPU loaded first.
Fix this by adding similar logic as is used in legacy HDA driver where an explicit device_attach() call is done after request_module().
Also add logic to propagate errors reported by device_attach() back to caller. This also works in the case where drivers are not built as modules.
--- sound/soc/sof/intel/hda-codec.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-)
sound/soc/sof/intel/hda-codec.c +12 -7
@@ -24,19 +24,18 @@#define IDISP_VID_INTEL 0x80860000/* load the legacy HDA codec driver */ -#ifdef MODULE -static void hda_codec_load_module (struct hda_codec *codec) +static int hda_codec_load_module (struct hda_codec *codec) { +#ifdef MODULE char alias[MODULE_NAME_LEN ];const char *module = alias;snd_hdac_codec_modalias (&codec->core, alias,sizeof (alias));dev_dbg (&codec->core.dev,"loading codec module: %s\n" , module);request_module (module); -} -#else -static void hda_codec_load_module (struct hda_codec *codec) {}#endif +return device_attach (hda_codec_dev (codec)); +}/* enable controller wake up event for all codecs with jack connectors */ void hda_codec_jack_wake_enable (struct snd_sof_dev *sdev)
@@ -116,10 +115,16 @@ static int hda_codec_probe(struct snd_sof_dev *sdev, int address)/* use legacy bus only for HDA codecs, idisp uses ext bus */ if ((resp &0xFFFF0000 ) !=IDISP_VID_INTEL ) { hdev->type =HDA_DEV_LEGACY ; -hda_codec_load_module (&hda_priv->codec); + ret =hda_codec_load_module (&hda_priv->codec); +/* +* handle ret==0 (no driver bound) as an error, but pass +* other return codes without modification +*/ +if (ret ==0 ) + ret = -ENOENT ; } -return 0 ; +return ret;#else hdev =devm_kzalloc (sdev->dev,sizeof (*hdev),GFP_KERNEL );if (!hdev)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 46/90 ASoC: hdac_hda: Fix error in driver removal after failed probe
In reply to Greg Kroah-HartmanFrom: Kai Vehmanen <[email protected]>
[ Upstream commit 552b1a85da9f63856e7e341b81c16e0e078204f1 ]
In case system has multiple HDA codecs, and codec probe fails for at least one but not all codecs, driver will end up cancelling a non-initialized timer context upon driver removal.
Call trace of typical case:
[ 60.593646] WARNING: CPU: 1 PID: 1147 at kernel/workqueue.c:3032 __flush_work+0x18b/0x1a0 [...] [ 60.593670] __cancel_work_timer+0x11f/0x1a0 [ 60.593673] hdac_hda_dev_remove+0x25/0x30 [snd_soc_hdac_hda] [ 60.593674] device_release_driver_internal+0xe0/0x1c0 [ 60.593675] bus_remove_device+0xd6/0x140 [ 60.593677] device_del+0x175/0x3e0 [ 60.593679] ? widget_tree_free.isra.7+0x90/0xb0 [snd_hda_core] [ 60.593680] snd_hdac_device_unregister+0x34/0x50 [snd_hda_core] [ 60.593682] snd_hdac_ext_bus_device_remove+0x2a/0x60 [snd_hda_ext_core] [ 60.593684] hda_dsp_remove+0x26/0x100 [snd_sof_intel_hda_common] [ 60.593686] snd_sof_device_remove+0x84/0xa0 [snd_sof] [ 60.593687] sof_pci_remove+0x10/0x30 [snd_sof_pci] [ 60.593689] pci_device_remove+0x36/0xb0
--- sound/soc/codecs/hdac_hda.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
sound/soc/codecs/hdac_hda.c +3 -1
@@ -498,7 +498,9 @@ static int hdac_hda_dev_remove(struct hdac_device *hdev)struct hdac_hda_priv *hda_pvt; hda_pvt =dev_get_drvdata (&hdev->dev); -cancel_delayed_work_sync (&hda_pvt->codec.jackpoll_work); +if (hda_pvt && hda_pvt->codec.registered) +cancel_delayed_work_sync (&hda_pvt->codec.jackpoll_work); +return 0 ; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 47/90 ASoC: sti: fix possible sleep-in-atomic
In reply to Greg Kroah-HartmanFrom: Arnaud Pouliquen <[email protected]>
[ Upstream commit ce780a47c3c01e1e179d0792df6b853a913928f1 ]
Change mutex and spinlock management to avoid sleep in atomic issue.
--- sound/soc/sti/uniperif_player.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
sound/soc/sti/uniperif_player.c +4 -3
@@ -226,7 +226,6 @@ static void uni_player_set_channel_status(struct uniperif *player,* sampling frequency. If no sample rate is already specified, then * set one. */ -mutex_lock (&player->ctrl_lock);if (runtime) {switch (runtime->rate) {case 22050 :
@@ -303,7 +302,6 @@ static void uni_player_set_channel_status(struct uniperif *player, player->stream_settings.iec958.status[3 + (n *4 )] <<24 ;SET_UNIPERIF_CHANNEL_STA_REGN (player, n, status); } -mutex_unlock (&player->ctrl_lock);/* Update the channel status */ if (player->ver <SND_ST_UNIPERIF_VERSION_UNI_PLR_TOP_1_0 )
@@ -365,8 +363,10 @@ static int uni_player_prepare_iec958(struct uniperif *player,SET_UNIPERIF_CTRL_ZERO_STUFF_HW (player); +mutex_lock (&player->ctrl_lock);/* Update the channel status */ uni_player_set_channel_status (player, runtime); +mutex_unlock (&player->ctrl_lock);/* Clear the user validity user bits */ SET_UNIPERIF_USER_VALIDITY_VALIDITY_LR (player,0 );
@@ -598,7 +598,6 @@ static int uni_player_ctl_iec958_put(struct snd_kcontrol *kcontrol, iec958->status[1 ] = ucontrol->value.iec958.status[1 ]; iec958->status[2 ] = ucontrol->value.iec958.status[2 ]; iec958->status[3 ] = ucontrol->value.iec958.status[3 ]; -mutex_unlock (&player->ctrl_lock);spin_lock_irqsave (&player->irq_lock, flags);if (player->substream && player->substream->runtime)
@@ -608,6 +607,8 @@ static int uni_player_ctl_iec958_put(struct snd_kcontrol *kcontrol,uni_player_set_channel_status (player,NULL );spin_unlock_irqrestore (&player->irq_lock, flags); +mutex_unlock (&player->ctrl_lock); +return 0 ; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 48/90 qmi_wwan: Add support for Quectel RM500Q
In reply to Greg Kroah-HartmanFrom: Kristian Evensen <[email protected]>
[ Upstream commit a9ff44f0e61d074f29770413fef6a5452be7b83e ]
RM500Q is a 5G module from Quectel, supporting both standalone and non-standalone modes. The normal Quectel quirks apply (DTR and dynamic interface numbers).
--- drivers/net/usb/qmi_wwan.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/usb/qmi_wwan.c +1 -0
@@ -1062,6 +1062,7 @@ static const struct usb_device_id products[] = { {QMI_QUIRK_QUECTEL_DYNCFG(0x2c7c, 0x0125)}, /* Quectel EC25, EC20 R2.0 Mini PCIe */ {QMI_QUIRK_QUECTEL_DYNCFG(0x2c7c, 0x0306)}, /* Quectel EP06/EG06/EM06 */ {QMI_QUIRK_QUECTEL_DYNCFG(0x2c7c, 0x0512)}, /* Quectel EG12/EM12 */ + {QMI_QUIRK_QUECTEL_DYNCFG(0x2c7c, 0x0800)}, /* Quectel RM500Q-GL *//* 3. Combined interface devices matching on interface number */ {QMI_FIXED_INTF(0x0408, 0xea42, 4)}, /* Yota / Megafon M100-1 */
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 49/90 parisc: Use proper printk format for resource_size_t
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 4f80b70e1953cb846dbdd1ce72cb17333d4c8d11 ]
resource_size_t should be printed with its own size-independent format to fix warnings when compiling on 64-bit platform (e.g. with COMPILE_TEST):
arch/parisc/kernel/drivers.c: In function 'print_parisc_device':
arch/parisc/kernel/drivers.c:892:9: warning:
format '%p' expects argument of type 'void *',
but argument 4 has type 'resource_size_t {aka unsigned int}' [-Wformat=]
--- arch/parisc/kernel/drivers.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/parisc/kernel/drivers.c +2 -2
@@ -889,8 +889,8 @@ static void print_parisc_device(struct parisc_device *dev)static int count;print_pa_hwpath (dev, hw_path); -pr_info ("%d. %s at 0x%px [%s] { %d, 0x%x, 0x%.3x, 0x%.5x }" , - ++count, dev->name, (void *) dev->hpa.start, hw_path, dev->id.hw_type, +pr_info ("%d. %s at %pap [%s] { %d, 0x%x, 0x%.3x, 0x%.5x }" , + ++count, dev->name, &(dev->hpa.start), hw_path, dev->id.hw_type, dev->id.hversion_rev, dev->id.hversion, dev->id.sversion);if (dev->num_addrs) {
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 50/90 lkdtm/bugs: fix build error in lkdtm_UNSET_SMEP
In reply to Greg Kroah-HartmanFrom: Brendan Higgins <[email protected]>
[ Upstream commit 0e31e3573f0cd94d7b821117db854187ffc85765 ]
When building ARCH=um with CONFIG_UML_X86=y and CONFIG_64BIT=y we get the build errors:
drivers/misc/lkdtm/bugs.c: In function ‘lkdtm_UNSET_SMEP’:drivers/misc/lkdtm/bugs.c:288:8: error: implicit declaration of function ‘native_read_cr4’ [-Werror=implicit-function-declaration]
cr4 = native_read_cr4();
^~~~~~~~~~~~~~~
drivers/misc/lkdtm/bugs.c:290:13: error: ‘X86_CR4_SMEP’ undeclared (first use in this function); did you mean ‘X86_FEATURE_SMEP’?
if ((cr4 & X86_CR4_SMEP) != X86_CR4_SMEP) {
^~~~~~~~~~~~
X86_FEATURE_SMEPdrivers/misc/lkdtm/bugs.c:290:13: note: each undeclared identifier is reported only once for each function it appears in drivers/misc/lkdtm/bugs.c:297:2: error: implicit declaration of function ‘native_write_cr4’; did you mean ‘direct_write_cr4’? [-Werror=implicit-function-declaration]
native_write_cr4(cr4);
^~~~~~~~~~~~~~~~
direct_write_cr4
So specify that this block of code should only build when CONFIG_X86_64=y *AND* CONFIG_UML is unset.
--- drivers/misc/lkdtm/bugs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/misc/lkdtm/bugs.c +1 -1
@@ -274,7 +274,7 @@ void lkdtm_STACK_GUARD_PAGE_TRAILING(void)void lkdtm_UNSET_SMEP (void ) { -#ifdef CONFIG_X86_64 +#if IS_ENABLED (CONFIG_X86_64 ) && !IS_ENABLED (CONFIG_UML )#define MOV_CR4_DEPTH 64void (*direct_write_cr4)(unsigned long val);unsigned char *insn;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 51/90 wireless: fix enabling channel 12 for custom regulatory domain
In reply to Greg Kroah-HartmanFrom: Ganapathi Bhat <[email protected]>
[ Upstream commit c4b9d655e445a8be0bff624aedea190606b5ebbc ]
Commit e33e2241e272 ("Revert "cfg80211: Use 5MHz bandwidth by default when checking usable channels"") fixed a broken regulatory (leaving channel 12 open for AP where not permitted). Apply a similar fix to custom regulatory domain processing.
--- net/wireless/reg.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
net/wireless/reg.c +10 -3
@@ -2261,14 +2261,15 @@ static void update_all_wiphy_regulatory(enum nl80211_reg_initiator initiator)static void handle_channel_custom (struct wiphy *wiphy,struct ieee80211_channel *chan, -const struct ieee80211_regdomain *regd) +const struct ieee80211_regdomain *regd, +u32 min_bw) {u32 bw_flags =0 ;const struct ieee80211_reg_rule *reg_rule =NULL ;const struct ieee80211_power_rule *power_rule =NULL ;u32 bw; -for (bw =MHZ_TO_KHZ (20 ); bw >=MHZ_TO_KHZ (5 ); bw = bw /2 ) { +for (bw =MHZ_TO_KHZ (20 ); bw >= min_bw; bw = bw /2 ) { reg_rule =freq_reg_info_regd (MHZ_TO_KHZ (chan->center_freq), regd, bw);if (!IS_ERR (reg_rule))
@@ -2324,8 +2325,14 @@ static void handle_band_custom(struct wiphy *wiphy,if (!sband)return ; +/* +* We currently assume that you always want at least 20 MHz, +* otherwise channel 12 might get enabled if this rule is +* compatible to US, which permits 2402 - 2472 MHz. +*/ for (i =0 ; i < sband->n_channels; i++) -handle_channel_custom (wiphy, &sband->channels[i], regd); +handle_channel_custom (wiphy, &sband->channels[i], regd, +MHZ_TO_KHZ (20 )); }/* Used by drivers prior to wiphy registration */
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 52/90 cfg80211: Fix radar event during another phy CAC
In reply to Greg Kroah-HartmanFrom: Orr Mazor <[email protected]>
[ Upstream commit 26ec17a1dc5ecdd8d91aba63ead6f8b5ad5dea0d ]
In case a radar event of CAC_FINISHED or RADAR_DETECTED happens during another phy is during CAC we might need to cancel that CAC.
If we got a radar in a channel that another phy is now doing CAC on then the CAC should be canceled there.
If, for example, 2 phys doing CAC on the same channels, or on comptable channels, once on of them will finish his CAC the other might need to cancel his CAC, since it is no longer relevant.
To fix that the commit adds an callback and implement it in mac80211 to end CAC.
This commit also adds a call to said callback if after a radar event we see the CAC is no longer relevant
--- include/net/cfg80211.h | 5 +++++ net/mac80211/cfg.c | 23 +++++++++++++++++++++++ net/wireless/rdev-ops.h | 10 ++++++++++ net/wireless/reg.c | 23 ++++++++++++++++++++++- net/wireless/trace.h | 5 +++++ 5 files changed, 65 insertions(+), 1 deletion(-)
include/net/cfg80211.h +5 -0
@@ -3537,6 +3537,9 @@ struct cfg80211_update_owe_info {* * @start_radar_detection: Start radar detection in the driver. * +* @end_cac: End running CAC, probably because a related CAC +* was finished on another phy. +* * @update_ft_ies: Provide updated Fast BSS Transition information to the * driver. If the SME is in the driver/firmware, this information can be * used in building Authentication and Reassociation Request frames.
@@ -3863,6 +3866,8 @@ struct cfg80211_ops {struct net_device *dev, struct cfg80211_chan_def *chandef, u32 cac_time_ms); +void (*end_cac)(struct wiphy *wiphy, +struct net_device *dev);int (*update_ft_ies)(struct wiphy *wiphy,struct net_device *dev,struct cfg80211_update_ft_ies_params *ftie); int (*crit_proto_start)(struct wiphy *wiphy,
net/mac80211/cfg.c +23 -0
@@ -2954,6 +2954,28 @@ static int ieee80211_start_radar_detection(struct wiphy *wiphy,return err; } +static void ieee80211_end_cac (struct wiphy *wiphy, +struct net_device *dev) +{ +struct ieee80211_sub_if_data *sdata =IEEE80211_DEV_TO_SUB_IF (dev); +struct ieee80211_local *local = sdata->local; + +mutex_lock (&local->mtx); +list_for_each_entry (sdata, &local->interfaces, list) { +/* it might be waiting for the local->mtx, but then +* by the time it gets it, sdata->wdev.cac_started +* will no longer be true +*/ +cancel_delayed_work (&sdata->dfs_cac_timer_work); + +if (sdata->wdev.cac_started) { +ieee80211_vif_release_channel (sdata); + sdata->wdev.cac_started = false; + } + } +mutex_unlock (&local->mtx); +} +static struct cfg80211_beacon_data *cfg80211_beacon_dup (struct cfg80211_beacon_data *beacon) {
@@ -4023,6 +4045,7 @@ const struct cfg80211_ops mac80211_config_ops = {#endif .get_channel = ieee80211_cfg_get_channel, .start_radar_detection = ieee80211_start_radar_detection, + .end_cac = ieee80211_end_cac, .channel_switch = ieee80211_channel_switch, .set_qos_map = ieee80211_set_qos_map, .set_ap_chanwidth = ieee80211_set_ap_chanwidth,
net/wireless/rdev-ops.h +10 -0
@@ -1171,6 +1171,16 @@ rdev_start_radar_detection(struct cfg80211_registered_device *rdev,return ret; } +static inline void +rdev_end_cac (struct cfg80211_registered_device *rdev, +struct net_device *dev) +{ +trace_rdev_end_cac (&rdev->wiphy, dev); +if (rdev->ops->end_cac) + rdev->ops->end_cac (&rdev->wiphy, dev); +trace_rdev_return_void (&rdev->wiphy); +} + static inline int rdev_set_mcast_rate(struct cfg80211_registered_device *rdev, struct net_device *dev,
net/wireless/reg.c +22 -1
@@ -3892,6 +3892,25 @@ bool regulatory_pre_cac_allowed(struct wiphy *wiphy) }EXPORT_SYMBOL (regulatory_pre_cac_allowed); +static void cfg80211_check_and_end_cac (struct cfg80211_registered_device *rdev) +{ +struct wireless_dev *wdev; +/* If we finished CAC or received radar, we should end any +* CAC running on the same channels. +* the check !cfg80211_chandef_dfs_usable contain 2 options: +* either all channels are available - those the CAC_FINISHED +* event has effected another wdev state, or there is a channel +* in unavailable state in wdev chandef - those the RADAR_DETECTED +* event has effected another wdev state. +* In both cases we should end the CAC on the wdev. +*/ +list_for_each_entry (wdev, &rdev->wiphy.wdev_list, list) { +if (wdev->cac_started && + !cfg80211_chandef_dfs_usable (&rdev->wiphy, &wdev->chandef)) +rdev_end_cac (rdev, wdev->netdev); + } +} + void regulatory_propagate_dfs_state(struct wiphy *wiphy, struct cfg80211_chan_def *chandef, enum nl80211_dfs_state dfs_state,
@@ -3918,8 +3937,10 @@ void regulatory_propagate_dfs_state(struct wiphy *wiphy,cfg80211_set_dfs_state (&rdev->wiphy, chandef, dfs_state);if (event ==NL80211_RADAR_DETECTED || - event ==NL80211_RADAR_CAC_FINISHED ) + event ==NL80211_RADAR_CAC_FINISHED ) {cfg80211_sched_dfs_chan_update (rdev); +cfg80211_check_and_end_cac (rdev); + }nl80211_radar_notify (rdev, chandef, event,NULL ,GFP_KERNEL ); }
net/wireless/trace.h +5 -0
@@ -646,6 +646,11 @@ DEFINE_EVENT(wiphy_netdev_evt, rdev_flush_pmksa,TP_ARGS (wiphy, netdev) ); +DEFINE_EVENT (wiphy_netdev_evt, rdev_end_cac, + TP_PROTO(struct wiphy *wiphy, struct net_device *netdev), +TP_ARGS (wiphy, netdev) +); + DECLARE_EVENT_CLASS(station_add_change, TP_PROTO(struct wiphy *wiphy, struct net_device *netdev, u8 *mac, struct station_parameters *params),
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 53/90 mac80211: Fix TKIP replay protection immediately after key setup
In reply to Greg Kroah-HartmanFrom: Jouni Malinen <[email protected]>
[ Upstream commit 6f601265215a421f425ba3a4850a35861d024643 ]
TKIP replay protection was skipped for the very first frame received after a new key is configured. While this is potentially needed to avoid dropping a frame in some cases, this does leave a window for replay attacks with group-addressed frames at the station side. Any earlier frame sent by the AP using the same key would be accepted as a valid frame and the internal RSC would then be updated to the TSC from that frame. This would allow multiple previously transmitted group-addressed frames to be replayed until the next valid new group-addressed frame from the AP is received by the station.
Fix this by limiting the no-replay-protection exception to apply only for the case where TSC=0, i.e., when this is for the very first frame protected using the new key, and the local RSC had not been set to a higher value when configuring the key (which may happen with GTK).
--- net/mac80211/tkip.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-)
net/mac80211/tkip.c +15 -3
@@ -263,9 +263,21 @@ int ieee80211_tkip_decrypt_data(struct arc4_ctx *ctx,if ((keyid >>6 ) != key->conf.keyidx)return TKIP_DECRYPT_INVALID_KEYIDX ; -if (rx_ctx->ctx.state !=TKIP_STATE_NOT_INIT && - (iv32 < rx_ctx->iv32 || - (iv32 == rx_ctx->iv32 && iv16 <= rx_ctx->iv16))) +/* Reject replays if the received TSC is smaller than or equal to the +* last received value in a valid message, but with an exception for +* the case where a new key has been set and no valid frame using that +* key has yet received and the local RSC was initialized to 0. This +* exception allows the very first frame sent by the transmitter to be +* accepted even if that transmitter were to use TSC 0 (IEEE 802.11 +* described TSC to be initialized to 1 whenever a new key is taken into +* use). +*/ +if (iv32 < rx_ctx->iv32 || + (iv32 == rx_ctx->iv32 && + (iv16 < rx_ctx->iv16 || + (iv16 == rx_ctx->iv16 && + (rx_ctx->iv32 || rx_ctx->iv16 || + rx_ctx->ctx.state !=TKIP_STATE_NOT_INIT )))))return TKIP_DECRYPT_REPLAY ;if (only_iv) {
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 54/90 wireless: wext: avoid gcc -O3 warning
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit e16119655c9e6c4aa5767cd971baa9c491f41b13 ]
After the introduction of CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE_O3, the wext code produces a bogus warning:
In function 'iw_handler_get_iwstats',
inlined from 'ioctl_standard_call' at net/wireless/wext-core.c:1015:9, inlined from 'wireless_process_ioctl' at net/wireless/wext-core.c:935:10, inlined from 'wext_ioctl_dispatch.part.8' at net/wireless/wext-core.c:986:8, inlined from 'wext_handle_ioctl':net/wireless/wext-core.c:671:3: error: argument 1 null where non-null expected [-Werror=nonnull]
memcpy(extra, stats, sizeof(struct iw_statistics)); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from arch/x86/include/asm/string.h:5,net/wireless/wext-core.c: In function 'wext_handle_ioctl':arch/x86/include/asm/string_64.h:14:14: note: in a call to function 'memcpy' declared here
The problem is that ioctl_standard_call() sometimes calls the handler with a NULL argument that would cause a problem for iw_handler_get_iwstats. However, iw_handler_get_iwstats never actually gets called that way.
Marking that function as noinline avoids the warning and leads to slightly smaller object code as well.
--- net/wireless/wext-core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/wireless/wext-core.c +2 -1
@@ -657,7 +657,8 @@ struct iw_statistics *get_wireless_stats(struct net_device *dev)return NULL ; } -static int iw_handler_get_iwstats (struct net_device * dev, +/* noinline to avoid a bogus warning with -O3 */ +static noinline int iw_handler_get_iwstats(struct net_device * dev,struct iw_request_info * info,union iwreq_data * wrqu,char * extra)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 55/90 perf/x86/intel/uncore: Add PCI ID of IMC for Xeon E3 V5 Family
In reply to Greg Kroah-HartmanFrom: Kan Liang <[email protected]>
[ Upstream commit e74383045119fb8055cf31cb39e0fe951d67163a ]
The IMC uncore support is missed for E3-1585 v5 CPU.
Intel Xeon E3 V5 Family has Sky Lake CPU. Add the PCI ID of IMC for Intel Xeon E3 V5 Family.
--- arch/x86/events/intel/uncore_snb.c | 6 ++++++ 1 file changed, 6 insertions(+)
arch/x86/events/intel/uncore_snb.c +6 -0
@@ -15,6 +15,7 @@#define PCI_DEVICE_ID_INTEL_SKL_HQ_IMC 0x1910#define PCI_DEVICE_ID_INTEL_SKL_SD_IMC 0x190f#define PCI_DEVICE_ID_INTEL_SKL_SQ_IMC 0x191f +#define PCI_DEVICE_ID_INTEL_SKL_E3_IMC 0x1918#define PCI_DEVICE_ID_INTEL_KBL_Y_IMC 0x590c#define PCI_DEVICE_ID_INTEL_KBL_U_IMC 0x5904#define PCI_DEVICE_ID_INTEL_KBL_UQ_IMC 0x5914
@@ -657,6 +658,10 @@ static const struct pci_device_id skl_uncore_pci_ids[] = { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SKL_SQ_IMC), .driver_data =UNCORE_PCI_DEV_DATA (SNB_PCI_UNCORE_IMC ,0 ), }, + { /* IMC */ +PCI_DEVICE (PCI_VENDOR_ID_INTEL ,PCI_DEVICE_ID_INTEL_SKL_E3_IMC ), + .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), + }, { /* IMC */PCI_DEVICE (PCI_VENDOR_ID_INTEL ,PCI_DEVICE_ID_INTEL_KBL_Y_IMC ), .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
@@ -826,6 +831,7 @@ static const struct imc_uncore_pci_dev desktop_imc_pci_ids[] = {IMC_DEV (SKL_HQ_IMC , &skl_uncore_pci_driver),/* 6th Gen Core H Quad Core */ IMC_DEV (SKL_SD_IMC , &skl_uncore_pci_driver),/* 6th Gen Core S Dual Core */ IMC_DEV (SKL_SQ_IMC , &skl_uncore_pci_driver),/* 6th Gen Core S Quad Core */ +IMC_DEV (SKL_E3_IMC , &skl_uncore_pci_driver),/* Xeon E3 V5 Gen Core processor */ IMC_DEV (KBL_Y_IMC , &skl_uncore_pci_driver),/* 7th Gen Core Y */ IMC_DEV (KBL_U_IMC , &skl_uncore_pci_driver),/* 7th Gen Core U */ IMC_DEV(KBL_UQ_IMC, &skl_uncore_pci_driver), /* 7th Gen Core U Quad Core */
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 56/90 perf/x86/intel/uncore: Remove PCIe3 unit for SNR
In reply to Greg Kroah-HartmanFrom: Kan Liang <[email protected]>
[ Upstream commit 2167f1625c2f04a33145f325db0de285630f7bd1 ]
The PCIe Root Port driver for CPU Complex PCIe Root Ports are not loaded on SNR.
The device ID for SNR PCIe3 unit is used by both uncore driver and the PCIe Root Port driver. If uncore driver is loaded, the PCIe Root Port driver never be probed.
Remove the PCIe3 unit for SNR for now. The support for PCIe3 unit will be added later separately.
--- arch/x86/events/intel/uncore_snbep.c | 24 ------------------------ 1 file changed, 24 deletions(-)
arch/x86/events/intel/uncore_snbep.c +0 -24
@@ -369,11 +369,6 @@#define SNR_M2M_PCI_PMON_BOX_CTL 0x438#define SNR_M2M_PCI_PMON_UMASK_EXT 0xff -/* SNR PCIE3 */ -#define SNR_PCIE3_PCI_PMON_CTL0 0x508 -#define SNR_PCIE3_PCI_PMON_CTR0 0x4e8 -#define SNR_PCIE3_PCI_PMON_BOX_CTL 0x4e4 -/* SNR IMC */ #define SNR_IMC_MMIO_PMON_FIXED_CTL 0x54#define SNR_IMC_MMIO_PMON_FIXED_CTR 0x38
@@ -4328,27 +4323,12 @@ static struct intel_uncore_type snr_uncore_m2m = { .format_group = &snr_m2m_uncore_format_group, }; -static struct intel_uncore_type snr_uncore_pcie3 = { - .name ="pcie3" , - .num_counters =4 , - .num_boxes =1 , - .perf_ctr_bits =48 , - .perf_ctr =SNR_PCIE3_PCI_PMON_CTR0 , - .event_ctl =SNR_PCIE3_PCI_PMON_CTL0 , - .event_mask =SNBEP_PMON_RAW_EVENT_MASK , - .box_ctl =SNR_PCIE3_PCI_PMON_BOX_CTL , - .ops = &ivbep_uncore_pci_ops, - .format_group = &ivbep_uncore_format_group, -}; -enum {SNR_PCI_UNCORE_M2M , -SNR_PCI_UNCORE_PCIE3 , };static struct intel_uncore_type *snr_pci_uncores[] = { [SNR_PCI_UNCORE_M2M ] = &snr_uncore_m2m, - [SNR_PCI_UNCORE_PCIE3 ] = &snr_uncore_pcie3,NULL , };
@@ -4357,10 +4337,6 @@ static const struct pci_device_id snr_uncore_pci_ids[] = { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x344a), .driver_data = UNCORE_PCI_DEV_FULL_DATA(12, 0, SNR_PCI_UNCORE_M2M, 0), }, - {/* PCIe3 */ - PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x334a), - .driver_data = UNCORE_PCI_DEV_FULL_DATA(4, 0, SNR_PCI_UNCORE_PCIE3, 0), - }, {/* end: all zeroes */ } };
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 57/90 riscv: delete temporary files
In reply to Greg Kroah-HartmanFrom: Ilie Halip <[email protected]>
[ Upstream commit 95f4d9cced96afa9c69b3da8e79e96102c84fc60 ]
Temporary files used in the VDSO build process linger on even after make
mrproper: vdso-dummy.o.tmp, vdso.so.dbg.tmp.
Delete them once they're no longer needed.
--- arch/riscv/kernel/vdso/Makefile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/riscv/kernel/vdso/Makefile +2 -1
@@ -58,7 +58,8 @@ quiet_cmd_vdsold = VDSOLD $@ cmd_vdsold = $(CC) $(KBUILD_CFLAGS) $(call cc-option, -no-pie) -nostdlib -nostartfiles $(SYSCFLAGS_$(@F)) \ -Wl,-T,$(filter-out FORCE,$^) -o [email protected] && \ $(CROSS_COMPILE)objcopy \ - $(patsubst %, -G __vdso_%, $(vdso-syms)) [email protected] $@ + $(patsubst %, -G __vdso_%, $(vdso-syms)) [email protected] $@ && \ + rm [email protected] # install commands for the unstripped file quiet_cmd_vdso_install = INSTALL $@
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 58/90 riscv: Less inefficient gcc tishift helpers (and export their symbols)
In reply to Greg Kroah-HartmanFrom: Olof Johansson <[email protected]>
[ Upstream commit fc585d4a5cf614727f64d86550b794bcad29d5c3 ]
The existing __lshrti3 was really inefficient, and the other two helpers are also needed to compile some modules.
Add the missing versions, and export all of the symbols like arm64 already does.
This code is based on the assembly generated by libgcc builds.
This fixes a build break triggered by ubsan:
riscv64-unknown-linux-gnu-ld: lib/ubsan.o: in function `.L2':
ubsan.c:(.text.unlikely+0x38): undefined reference to __ashlti3' riscv64-unknown-linux-gnu-ld: ubsan.c:(.text.unlikely+0x42): undefined reference to __ashrti3'
[[email protected]: use SYM_FUNC_{START,END} instead of
ENTRY/ENDPROC; note libgcc origin]
--- arch/riscv/include/asm/asm-prototypes.h | 4 ++ arch/riscv/lib/tishift.S | 75 +++++++++++++++++++------ 2 files changed, 61 insertions(+), 18 deletions(-)
arch/riscv/include/asm/asm-prototypes.h +4 -0
@@ -4,4 +4,8 @@#include <linux/ftrace.h> #include <asm-generic/asm-prototypes.h> +long long __lshrti3 (long long a,int b); +long long __ashrti3 (long long a,int b); +long long __ashlti3 (long long a,int b); +#endif /* _ASM_RISCV_PROTOTYPES_H */
arch/riscv/lib/tishift.S +57 -18
91 lines not on this page · raw message
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 59/90 XArray: Fix xas_pause at ULONG_MAX
In reply to Greg Kroah-HartmanFrom: Matthew Wilcox (Oracle) <[email protected]>
[ Upstream commit 82a22311b7a68a78709699dc8c098953b70e4fd2 ]
If we were unlucky enough to call xas_pause() when the index was at ULONG_MAX (or a multi-slot entry which ends at ULONG_MAX), we would wrap the index back around to 0 and restart the iteration from the beginning. Use the XAS_BOUNDS state to indicate that we should just stop the iteration.
--- lib/test_xarray.c | 22 ++++++++++++++++++++++ lib/xarray.c | 8 +++++--- 2 files changed, 27 insertions(+), 3 deletions(-)
lib/test_xarray.c +22 -0
@@ -1160,6 +1160,27 @@ static noinline void check_move_tiny(struct xarray *xa)XA_BUG_ON (xa, !xa_empty (xa)); } +static noinline void check_move_max(struct xarray *xa) +{ +XA_STATE (xas, xa,0 ); + +xa_store_index (xa,ULONG_MAX ,GFP_KERNEL ); +rcu_read_lock (); +XA_BUG_ON (xa,xas_find (&xas,ULONG_MAX ) !=xa_mk_index (ULONG_MAX )); +XA_BUG_ON (xa,xas_find (&xas,ULONG_MAX ) !=NULL ); +rcu_read_unlock (); + +xas_set (&xas,0 ); +rcu_read_lock (); +XA_BUG_ON (xa,xas_find (&xas,ULONG_MAX ) !=xa_mk_index (ULONG_MAX )); +xas_pause (&xas); +XA_BUG_ON (xa,xas_find (&xas,ULONG_MAX ) !=NULL ); +rcu_read_unlock (); + +xa_erase_index (xa,ULONG_MAX ); +XA_BUG_ON (xa, !xa_empty (xa)); +} + static noinline void check_move_small(struct xarray *xa, unsigned long idx) {XA_STATE (xas, xa,0 );
@@ -1268,6 +1289,7 @@ static noinline void check_move(struct xarray *xa)xa_destroy (xa);check_move_tiny (xa); +check_move_max (xa);for (i =0 ; i <16 ; i++)check_move_small (xa,1UL << i);
lib/xarray.c +5 -3
@@ -968,6 +968,7 @@ void xas_pause(struct xa_state *xas)if (xas_invalid (xas))return ; + xas->xa_node =XAS_RESTART ;if (node) {unsigned int offset = xas->xa_offset;while (++offset <XA_CHUNK_SIZE ) {
@@ -975,10 +976,11 @@ void xas_pause(struct xa_state *xas)break ; } xas->xa_index += (offset - xas->xa_offset) << node->shift; +if (xas->xa_index ==0 ) + xas->xa_node =XAS_BOUNDS ; }else { xas->xa_index++; } - xas->xa_node =XAS_RESTART ; }EXPORT_SYMBOL_GPL (xas_pause);
@@ -1080,7 +1082,7 @@ void *xas_find(struct xa_state *xas, unsigned long max) {void *entry; -if (xas_error (xas)) +if (xas_error (xas) || xas->xa_node ==XAS_BOUNDS )return NULL ;if (xas->xa_index > max)return set_bounds (xas);
@@ -1088,7 +1090,7 @@ void *xas_find(struct xa_state *xas, unsigned long max)if (!xas->xa_node) { xas->xa_index =1 ;return set_bounds (xas); - }else if (xas_top (xas->xa_node)) { + }else if (xas->xa_node ==XAS_RESTART ) { entry =xas_load (xas);if (entry ||xas_not_node (xas->xa_node))return entry;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 60/90 iwlwifi: pcie: allocate smaller dev_cmd for TX headers
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
[ Upstream commit a89c72ffd07369f5ccc74f0332d2785a7077241d ]
As noted in the previous commit, due to the way we allocate the dev_cmd headers with 324 byte size, and 4/8 byte alignment, the part we use of them (bytes 20..40-68) could still cross a page and thus 2^32 boundary.
Address this by using alignment to ensure that the allocation cannot cross a page boundary, on hardware that's affected. To make that not cause more memory consumption, reduce the size of the allocations to the necessary size - we go from 324 bytes in each allocation to 60/68 on gen2 depending on family, and ~120 or so on gen1 (so on gen1 it's a pure reduction in size, since we don't need alignment there).
To avoid size and clearing issues, add a new structure that's just the header, and use kmem_cache_zalloc().
--- drivers/net/wireless/intel/iwlwifi/dvm/tx.c | 3 +- .../net/wireless/intel/iwlwifi/iwl-trans.c | 10 +++--- .../net/wireless/intel/iwlwifi/iwl-trans.h | 26 +++++++++++---- drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 15 +++------ .../wireless/intel/iwlwifi/pcie/internal.h | 6 ++-- .../net/wireless/intel/iwlwifi/pcie/trans.c | 32 ++++++++++++++----- .../net/wireless/intel/iwlwifi/pcie/tx-gen2.c | 21 ++++++++---- drivers/net/wireless/intel/iwlwifi/pcie/tx.c | 20 ++++++------ 8 files changed, 84 insertions(+), 49 deletions(-)
drivers/net/wireless/intel/iwlwifi/dvm/tx.c +1 -2
@@ -267,7 +267,7 @@ int iwlagn_tx_skb(struct iwl_priv *priv,struct ieee80211_tx_info *info =IEEE80211_SKB_CB (skb);struct iwl_station_priv *sta_priv =NULL ;struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS ]; -struct iwl_device_cmd *dev_cmd; +struct iwl_device_tx_cmd *dev_cmd;struct iwl_tx_cmd *tx_cmd;__le16 fc;u8 hdr_len;
@@ -348,7 +348,6 @@ int iwlagn_tx_skb(struct iwl_priv *priv,if (unlikely (!dev_cmd)) goto drop_unlock_priv; -memset (dev_cmd,0 ,sizeof (*dev_cmd)); dev_cmd->hdr.cmd =REPLY_TX ; tx_cmd = (struct iwl_tx_cmd *) dev_cmd->payload;
drivers/net/wireless/intel/iwlwifi/iwl-trans.c +5 -5
@@ -66,7 +66,9 @@struct iwl_trans *iwl_trans_alloc (unsigned int priv_size,struct device *dev, -const struct iwl_trans_ops *ops) +const struct iwl_trans_ops *ops, +unsigned int cmd_pool_size, +unsigned int cmd_pool_align) {struct iwl_trans *trans;#ifdef CONFIG_LOCKDEP
@@ -90,10 +92,8 @@ struct iwl_trans *iwl_trans_alloc(unsigned int priv_size, "iwl_cmd_pool:%s", dev_name(trans->dev)); trans->dev_cmd_pool =kmem_cache_create (trans->dev_cmd_pool_name, -sizeof (struct iwl_device_cmd ), -sizeof (void *), -SLAB_HWCACHE_ALIGN , -NULL ); + cmd_pool_size, cmd_pool_align, +SLAB_HWCACHE_ALIGN ,NULL );if (!trans->dev_cmd_pool)return NULL ;
drivers/net/wireless/intel/iwlwifi/iwl-trans.h +20 -6
@@ -193,6 +193,18 @@ struct iwl_device_cmd { }; } __packed; +/** +* struct iwl_device_tx_cmd - buffer for TX command +* @hdr: the header +* @payload: the payload placeholder +* +* The actual structure is sized dynamically according to need. +*/ +struct iwl_device_tx_cmd { +struct iwl_cmd_header hdr; +u8 payload[]; +} __packed; +#define TFD_MAX_PAYLOAD_SIZE (sizeof(struct iwl_device_cmd))/*
@@ -544,7 +556,7 @@ struct iwl_trans_ops {int (*send_cmd)(struct iwl_trans *trans,struct iwl_host_cmd *cmd);int (*tx)(struct iwl_trans *trans,struct sk_buff *skb, -struct iwl_device_cmd *dev_cmd,int queue); +struct iwl_device_tx_cmd *dev_cmd,int queue);void (*reclaim)(struct iwl_trans *trans,int queue,int ssn,struct sk_buff_head *skbs);
@@ -921,22 +933,22 @@ iwl_trans_dump_data(struct iwl_trans *trans, u32 dump_mask)return trans->ops->dump_data (trans, dump_mask); } -static inline struct iwl_device_cmd * +static inline struct iwl_device_tx_cmd *iwl_trans_alloc_tx_cmd (struct iwl_trans *trans) { -return kmem_cache_alloc (trans->dev_cmd_pool,GFP_ATOMIC ); +return kmem_cache_zalloc (trans->dev_cmd_pool,GFP_ATOMIC ); }int iwl_trans_send_cmd (struct iwl_trans *trans,struct iwl_host_cmd *cmd);static inline void iwl_trans_free_tx_cmd (struct iwl_trans *trans, -struct iwl_device_cmd *dev_cmd) +struct iwl_device_tx_cmd *dev_cmd) {kmem_cache_free (trans->dev_cmd_pool, dev_cmd); }static inline int iwl_trans_tx (struct iwl_trans *trans,struct sk_buff *skb, -struct iwl_device_cmd *dev_cmd,int queue) +struct iwl_device_tx_cmd *dev_cmd,int queue) {if (unlikely (test_bit (STATUS_FW_ERROR , &trans->status)))return -EIO ;
@@ -1239,7 +1251,9 @@ static inline bool iwl_trans_dbg_ini_valid(struct iwl_trans *trans)*****************************************************/ struct iwl_trans *iwl_trans_alloc (unsigned int priv_size,struct device *dev, -const struct iwl_trans_ops *ops); +const struct iwl_trans_ops *ops, +unsigned int cmd_pool_size, +unsigned int cmd_pool_align);void iwl_trans_free (struct iwl_trans *trans);/*****************************************************
drivers/net/wireless/intel/iwlwifi/mvm/tx.c +5 -10
@@ -487,13 +487,13 @@ static void iwl_mvm_set_tx_cmd_crypto(struct iwl_mvm *mvm,/* * Allocates and sets the Tx cmd the driver data pointers in the skb */ -static struct iwl_device_cmd * +static struct iwl_device_tx_cmd *iwl_mvm_set_tx_params (struct iwl_mvm *mvm,struct sk_buff *skb,struct ieee80211_tx_info *info,int hdrlen,struct ieee80211_sta *sta,u8 sta_id) {struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; -struct iwl_device_cmd *dev_cmd; +struct iwl_device_tx_cmd *dev_cmd;struct iwl_tx_cmd *tx_cmd; dev_cmd =iwl_trans_alloc_tx_cmd (mvm->trans);
@@ -501,11 +501,6 @@ iwl_mvm_set_tx_params(struct iwl_mvm *mvm, struct sk_buff *skb,if (unlikely (!dev_cmd))return NULL ; -/* Make sure we zero enough of dev_cmd */ -BUILD_BUG_ON (sizeof (struct iwl_tx_cmd_gen2 ) >sizeof (*tx_cmd)); -BUILD_BUG_ON (sizeof (struct iwl_tx_cmd_gen3 ) >sizeof (*tx_cmd)); - -memset (dev_cmd,0 ,sizeof (dev_cmd->hdr) +sizeof (*tx_cmd)); dev_cmd->hdr.cmd =TX_CMD ;if (iwl_mvm_has_new_tx_api (mvm)) {
@@ -594,7 +589,7 @@ iwl_mvm_set_tx_params(struct iwl_mvm *mvm, struct sk_buff *skb, }static void iwl_mvm_skb_prepare_status (struct sk_buff *skb, -struct iwl_device_cmd *cmd) +struct iwl_device_tx_cmd *cmd) {struct ieee80211_tx_info *skb_info =IEEE80211_SKB_CB (skb);
@@ -713,7 +708,7 @@ int iwl_mvm_tx_skb_non_sta(struct iwl_mvm *mvm, struct sk_buff *skb) {struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;struct ieee80211_tx_info info; -struct iwl_device_cmd *dev_cmd; +struct iwl_device_tx_cmd *dev_cmd;u8 sta_id;int hdrlen =ieee80211_hdrlen (hdr->frame_control);__le16 fc = hdr->frame_control;
@@ -1075,7 +1070,7 @@ static int iwl_mvm_tx_mpdu(struct iwl_mvm *mvm, struct sk_buff *skb, {struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;struct iwl_mvm_sta *mvmsta; -struct iwl_device_cmd *dev_cmd; +struct iwl_device_tx_cmd *dev_cmd;__le16 fc;u16 seq_number =0 ;u8 tid =IWL_MAX_TID_COUNT ;
drivers/net/wireless/intel/iwlwifi/pcie/internal.h +3 -3
@@ -305,7 +305,7 @@ struct iwl_cmd_meta {#define IWL_FIRST_TB_SIZE_ALIGN ALIGN(IWL_FIRST_TB_SIZE, 64)struct iwl_pcie_txq_entry { -struct iwl_device_cmd *cmd; +void *cmd;struct sk_buff *skb;/* buffer to free after command completes */ const void *free_buf;
@@ -690,7 +690,7 @@ void iwl_trans_pcie_txq_set_shared_mode(struct iwl_trans *trans, u32 txq_id,void iwl_trans_pcie_log_scd_error (struct iwl_trans *trans,struct iwl_txq *txq);int iwl_trans_pcie_tx (struct iwl_trans *trans,struct sk_buff *skb, -struct iwl_device_cmd *dev_cmd,int txq_id); +struct iwl_device_tx_cmd *dev_cmd,int txq_id);void iwl_pcie_txq_check_wrptrs (struct iwl_trans *trans);int iwl_trans_pcie_send_hcmd (struct iwl_trans *trans,struct iwl_host_cmd *cmd);void iwl_pcie_cmdq_reclaim (struct iwl_trans *trans,int txq_id,int idx);
@@ -1111,7 +1111,7 @@ int iwl_trans_pcie_dyn_txq_alloc(struct iwl_trans *trans, unsigned int timeout);void iwl_trans_pcie_dyn_txq_free (struct iwl_trans *trans,int queue);int iwl_trans_pcie_gen2_tx (struct iwl_trans *trans,struct sk_buff *skb, -struct iwl_device_cmd *dev_cmd,int txq_id); +struct iwl_device_tx_cmd *dev_cmd,int txq_id);int iwl_trans_pcie_gen2_send_hcmd (struct iwl_trans *trans,struct iwl_host_cmd *cmd);void iwl_trans_pcie_gen2_stop_device (struct iwl_trans *trans);
drivers/net/wireless/intel/iwlwifi/pcie/trans.c +24 -8
@@ -79,6 +79,7 @@#include "iwl-agn-hw.h" #include "fw/error-dump.h" #include "fw/dbg.h" +#include "fw/api/tx.h" #include "internal.h" #include "iwl-fh.h"
@@ -3462,19 +3463,34 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev, {struct iwl_trans_pcie *trans_pcie;struct iwl_trans *trans; -int ret, addr_size; +int ret, addr_size, txcmd_size, txcmd_align; +const struct iwl_trans_ops *ops = &trans_ops_pcie_gen2; + +if (!cfg_trans->gen2) { + ops = &trans_ops_pcie; + txcmd_size =sizeof (struct iwl_tx_cmd ); + txcmd_align =sizeof (void *); + }else if (cfg_trans->device_family <IWL_DEVICE_FAMILY_AX210 ) { + txcmd_size =sizeof (struct iwl_tx_cmd_gen2 ); + txcmd_align =64 ; + }else { + txcmd_size =sizeof (struct iwl_tx_cmd_gen3 ); + txcmd_align =128 ; + } + + txcmd_size +=sizeof (struct iwl_cmd_header ); + txcmd_size +=36 ;/* biggest possible 802.11 header */ + +/* Ensure device TX cmd cannot reach/cross a page boundary in gen2 */ +if (WARN_ON (cfg_trans->gen2 && txcmd_size >= txcmd_align)) +return ERR_PTR (-EINVAL ); ret =pcim_enable_device (pdev);if (ret)return ERR_PTR (ret); -if (cfg_trans->gen2) - trans =iwl_trans_alloc (sizeof (struct iwl_trans_pcie ), - &pdev->dev, &trans_ops_pcie_gen2); -else - trans =iwl_trans_alloc (sizeof (struct iwl_trans_pcie ), - &pdev->dev, &trans_ops_pcie); - + trans =iwl_trans_alloc (sizeof (struct iwl_trans_pcie ), &pdev->dev, ops, + txcmd_size, txcmd_align);if (!trans)return ERR_PTR (-ENOMEM );
drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c +15 -6
@@ -243,7 +243,8 @@ static int iwl_pcie_gen2_set_tb(struct iwl_trans *trans,static int iwl_pcie_gen2_build_amsdu (struct iwl_trans *trans,struct sk_buff *skb,struct iwl_tfh_tfd *tfd,int start_len, -u8 hdr_len,struct iwl_device_cmd *dev_cmd) +u8 hdr_len, +struct iwl_device_tx_cmd *dev_cmd) {#ifdef CONFIG_INET struct iwl_trans_pcie *trans_pcie =IWL_TRANS_GET_PCIE_TRANS (trans);
@@ -371,7 +372,7 @@ static int iwl_pcie_gen2_build_amsdu(struct iwl_trans *trans,static struct iwl_tfh_tfd *iwl_pcie_gen2_build_tx_amsdu(struct iwl_trans *trans, struct iwl_txq *txq, - struct iwl_device_cmd *dev_cmd, + struct iwl_device_tx_cmd *dev_cmd, struct sk_buff *skb, struct iwl_cmd_meta *out_meta, int hdr_len,
@@ -403,6 +404,10 @@ iwl_tfh_tfd *iwl_pcie_gen2_build_tx_amsdu(struct iwl_trans *trans, tb_phys =dma_map_single (trans->dev, tb1_addr, len,DMA_TO_DEVICE );if (unlikely (dma_mapping_error (trans->dev, tb_phys))) goto out_err; +/* +* No need for _with_wa(), we ensure (via alignment) that the data +* here can never cross or end at a page boundary. +*/ iwl_pcie_gen2_set_tb (trans, tfd, tb_phys, len); if (iwl_pcie_gen2_build_amsdu(trans, skb, tfd,
@@ -456,7 +461,7 @@ static int iwl_pcie_gen2_tx_add_frags(struct iwl_trans *trans,static struct iwl_tfh_tfd *iwl_pcie_gen2_build_tx(struct iwl_trans *trans, struct iwl_txq *txq, - struct iwl_device_cmd *dev_cmd, + struct iwl_device_tx_cmd *dev_cmd, struct sk_buff *skb, struct iwl_cmd_meta *out_meta, int hdr_len,
@@ -496,6 +501,10 @@ iwl_tfh_tfd *iwl_pcie_gen2_build_tx(struct iwl_trans *trans, tb_phys =dma_map_single (trans->dev, tb1_addr, tb1_len,DMA_TO_DEVICE );if (unlikely (dma_mapping_error (trans->dev, tb_phys))) goto out_err; +/* +* No need for _with_wa(), we ensure (via alignment) that the data +* here can never cross or end at a page boundary. +*/ iwl_pcie_gen2_set_tb (trans, tfd, tb_phys, tb1_len);trace_iwlwifi_dev_tx (trans->dev, skb, tfd,sizeof (*tfd), &dev_cmd->hdr,IWL_FIRST_TB_SIZE + tb1_len, hdr_len);
@@ -540,7 +549,7 @@ iwl_tfh_tfd *iwl_pcie_gen2_build_tx(struct iwl_trans *trans,static struct iwl_tfh_tfd *iwl_pcie_gen2_build_tfd (struct iwl_trans *trans,struct iwl_txq *txq, -struct iwl_device_cmd *dev_cmd, +struct iwl_device_tx_cmd *dev_cmd,struct sk_buff *skb,struct iwl_cmd_meta *out_meta) {
@@ -580,7 +589,7 @@ struct iwl_tfh_tfd *iwl_pcie_gen2_build_tfd(struct iwl_trans *trans, }int iwl_trans_pcie_gen2_tx (struct iwl_trans *trans,struct sk_buff *skb, -struct iwl_device_cmd *dev_cmd,int txq_id) +struct iwl_device_tx_cmd *dev_cmd,int txq_id) {struct iwl_trans_pcie *trans_pcie =IWL_TRANS_GET_PCIE_TRANS (trans);struct iwl_cmd_meta *out_meta;
@@ -605,7 +614,7 @@ int iwl_trans_pcie_gen2_tx(struct iwl_trans *trans, struct sk_buff *skb,/* don't put the packet on the ring, if there is no room */ if (unlikely (iwl_queue_space (trans, txq) <3 )) { -struct iwl_device_cmd **dev_cmd_ptr; +struct iwl_device_tx_cmd **dev_cmd_ptr; dev_cmd_ptr = (void *)((u8 *)skb->cb + trans_pcie->dev_cmd_offs);
drivers/net/wireless/intel/iwlwifi/pcie/tx.c +11 -9
@@ -213,8 +213,8 @@ static void iwl_pcie_txq_update_byte_cnt_tbl(struct iwl_trans *trans,u8 sec_ctl =0 ;u16 len = byte_cnt +IWL_TX_CRC_SIZE +IWL_TX_DELIMITER_SIZE ;__le16 bc_ent; -struct iwl_tx_cmd *tx_cmd = - (void *)txq->entries[txq->write_ptr].cmd->payload; +struct iwl_device_tx_cmd *dev_cmd = txq->entries[txq->write_ptr].cmd; +struct iwl_tx_cmd *tx_cmd = (void *)dev_cmd->payload;u8 sta_id = tx_cmd->sta_id; scd_bc_tbl = trans_pcie->scd_bc_tbls.addr;
@@ -257,8 +257,8 @@ static void iwl_pcie_txq_inval_byte_cnt_tbl(struct iwl_trans *trans,int read_ptr = txq->read_ptr;u8 sta_id =0 ;__le16 bc_ent; -struct iwl_tx_cmd *tx_cmd = - (void *)txq->entries[read_ptr].cmd->payload; +struct iwl_device_tx_cmd *dev_cmd = txq->entries[read_ptr].cmd; +struct iwl_tx_cmd *tx_cmd = (void *)dev_cmd->payload;WARN_ON (read_ptr >=TFD_QUEUE_SIZE_MAX );
@@ -1196,7 +1196,7 @@ void iwl_trans_pcie_reclaim(struct iwl_trans *trans, int txq_id, int ssn,while (!skb_queue_empty (&overflow_skbs)) {struct sk_buff *skb =__skb_dequeue (&overflow_skbs); -struct iwl_device_cmd *dev_cmd_ptr; +struct iwl_device_tx_cmd *dev_cmd_ptr; dev_cmd_ptr = *(void **)((u8 *)skb->cb + trans_pcie->dev_cmd_offs);
@@ -2099,7 +2099,8 @@ static void iwl_compute_pseudo_hdr_csum(void *iph, struct tcphdr *tcph,static int iwl_fill_data_tbs_amsdu (struct iwl_trans *trans,struct sk_buff *skb,struct iwl_txq *txq,u8 hdr_len,struct iwl_cmd_meta *out_meta, -struct iwl_device_cmd *dev_cmd,u16 tb1_len) +struct iwl_device_tx_cmd *dev_cmd, +u16 tb1_len) {struct iwl_tx_cmd *tx_cmd = (void *)dev_cmd->payload;struct iwl_trans_pcie *trans_pcie = txq->trans_pcie;
@@ -2281,7 +2282,8 @@ static int iwl_fill_data_tbs_amsdu(struct iwl_trans *trans, struct sk_buff *skb,static int iwl_fill_data_tbs_amsdu (struct iwl_trans *trans,struct sk_buff *skb,struct iwl_txq *txq,u8 hdr_len,struct iwl_cmd_meta *out_meta, -struct iwl_device_cmd *dev_cmd,u16 tb1_len) +struct iwl_device_tx_cmd *dev_cmd, +u16 tb1_len) {/* No A-MSDU without CONFIG_INET */ WARN_ON (1 );
@@ -2291,7 +2293,7 @@ static int iwl_fill_data_tbs_amsdu(struct iwl_trans *trans, struct sk_buff *skb,#endif /* CONFIG_INET */ int iwl_trans_pcie_tx (struct iwl_trans *trans,struct sk_buff *skb, -struct iwl_device_cmd *dev_cmd,int txq_id) +struct iwl_device_tx_cmd *dev_cmd,int txq_id) {struct iwl_trans_pcie *trans_pcie =IWL_TRANS_GET_PCIE_TRANS (trans);struct ieee80211_hdr *hdr;
@@ -2348,7 +2350,7 @@ int iwl_trans_pcie_tx(struct iwl_trans *trans, struct sk_buff *skb,/* don't put the packet on the ring, if there is no room */ if (unlikely (iwl_queue_space (trans, txq) <3 )) { -struct iwl_device_cmd **dev_cmd_ptr; +struct iwl_device_tx_cmd **dev_cmd_ptr; dev_cmd_ptr = (void *)((u8 *)skb->cb + trans_pcie->dev_cmd_offs);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 61/90 iwlwifi: mvm: fix NVM check for 3168 devices
In reply to Greg Kroah-HartmanFrom: Luca Coelho <[email protected]>
[ Upstream commit b3f20e098293892388d6a0491d6bbb2efb46fbff ]
We had a check on !NVM_EXT and then a check for NVM_SDP in the else block of this if. The else block, obviously, could only be reached if using NVM_EXT, so it would never be NVM_SDP.
Fix that by checking whether the nvm_type is IWL_NVM instead of checking for !IWL_NVM_EXT to solve this issue.
--- drivers/net/wireless/intel/iwlwifi/mvm/nvm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/mvm/nvm.c +1 -1
@@ -281,7 +281,7 @@ iwl_parse_nvm_sections(struct iwl_mvm *mvm)int regulatory_type;/* Checking for required sections */ -if (mvm->trans->cfg->nvm_type !=IWL_NVM_EXT ) { +if (mvm->trans->cfg->nvm_type ==IWL_NVM ) {if (!mvm->nvm_sections[NVM_SECTION_TYPE_SW ].data || !mvm->nvm_sections[mvm->cfg->nvm_hw_section_num].data) {IWL_ERR (mvm,"Can't parse empty OTP/NVM sections\n" );
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 62/90 iwlwifi: Dont ignore the cap field upon mcc update
In reply to Greg Kroah-HartmanFrom: Haim Dreyfuss <[email protected]>
[ Upstream commit 2763bba6328c53c455d8f7f5302b80030551c31b ]
When receiving a new MCC driver get all the data about the new country code and its regulatory information.
Mistakenly, we ignored the cap field, which includes global regulatory information which should be applies to every channel.
Fix it.
--- .../wireless/intel/iwlwifi/iwl-nvm-parse.c | 48 ++++++++++++++++++- .../wireless/intel/iwlwifi/iwl-nvm-parse.h | 6 +-- .../net/wireless/intel/iwlwifi/mvm/mac80211.c | 3 +- 3 files changed, 51 insertions(+), 6 deletions(-)
drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c +46 -2
@@ -225,6 +225,34 @@ enum iwl_nvm_channel_flags { NVM_CHANNEL_DC_HIGH = BIT(12), }; +/** +* enum iwl_reg_capa_flags - global flags applied for the whole regulatory +* domain. +* @REG_CAPA_BF_CCD_LOW_BAND: Beam-forming or Cyclic Delay Diversity in the +* 2.4Ghz band is allowed. +* @REG_CAPA_BF_CCD_HIGH_BAND: Beam-forming or Cyclic Delay Diversity in the +* 5Ghz band is allowed. +* @REG_CAPA_160MHZ_ALLOWED: 11ac channel with a width of 160Mhz is allowed +* for this regulatory domain (valid only in 5Ghz). +* @REG_CAPA_80MHZ_ALLOWED: 11ac channel with a width of 80Mhz is allowed +* for this regulatory domain (valid only in 5Ghz). +* @REG_CAPA_MCS_8_ALLOWED: 11ac with MCS 8 is allowed. +* @REG_CAPA_MCS_9_ALLOWED: 11ac with MCS 9 is allowed. +* @REG_CAPA_40MHZ_FORBIDDEN: 11n channel with a width of 40Mhz is forbidden +* for this regulatory domain (valid only in 5Ghz). +* @REG_CAPA_DC_HIGH_ENABLED: DC HIGH allowed. +*/ +enum iwl_reg_capa_flags { +REG_CAPA_BF_CCD_LOW_BAND =BIT (0 ), +REG_CAPA_BF_CCD_HIGH_BAND =BIT (1 ), +REG_CAPA_160MHZ_ALLOWED =BIT (2 ), +REG_CAPA_80MHZ_ALLOWED =BIT (3 ), +REG_CAPA_MCS_8_ALLOWED =BIT (4 ), +REG_CAPA_MCS_9_ALLOWED =BIT (5 ), +REG_CAPA_40MHZ_FORBIDDEN =BIT (7 ), +REG_CAPA_DC_HIGH_ENABLED =BIT (9 ), +}; +static inline void iwl_nvm_print_channel_flags (struct device *dev,u32 level,int chan,u32 flags) {
@@ -1031,6 +1059,7 @@ IWL_EXPORT_SYMBOL(iwl_parse_nvm_data);static u32 iwl_nvm_get_regdom_bw_flags (const u16 *nvm_chan,int ch_idx,u16 nvm_flags, +u16 cap_flags,const struct iwl_cfg *cfg) {u32 flags =NL80211_RRF_NO_HT40 ;
@@ -1069,13 +1098,27 @@ static u32 iwl_nvm_get_regdom_bw_flags(const u16 *nvm_chan, (flags & NL80211_RRF_NO_IR)) flags |=NL80211_RRF_GO_CONCURRENT ; +/* +* cap_flags is per regulatory domain so apply it for every channel +*/ +if (ch_idx >=NUM_2GHZ_CHANNELS ) { +if (cap_flags ®_CAPA_40MHZ_FORBIDDEN ) + flags |=NL80211_RRF_NO_HT40 ; + +if (!(cap_flags ®_CAPA_80MHZ_ALLOWED )) + flags |=NL80211_RRF_NO_80MHZ ; + +if (!(cap_flags ®_CAPA_160MHZ_ALLOWED )) + flags |=NL80211_RRF_NO_160MHZ ; + } +return flags; }struct ieee80211_regdomain *iwl_parse_nvm_mcc_info (struct device *dev,const struct iwl_cfg *cfg,int num_of_ch,__le32 *channels,u16 fw_mcc, -u16 geo_info) +u16 geo_info,u16 cap) {int ch_idx;u16 ch_flags;
@@ -1133,7 +1176,8 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg, } reg_rule_flags =iwl_nvm_get_regdom_bw_flags (nvm_chan, ch_idx, - ch_flags, cfg); + ch_flags, cap, + cfg);/* we can't continue the same rule */ if (ch_idx == 0 || prev_reg_rule_flags != reg_rule_flags ||
drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.h +3 -3
@@ -7,7 +7,7 @@* * Copyright(c) 2008 - 2015 Intel Corporation. All rights reserved. * Copyright(c) 2016 - 2017 Intel Deutschland GmbH -* Copyright(c) 2018 Intel Corporation +* Copyright(c) 2018 - 2019 Intel Corporation * * This program is free software; you can redistribute it and/or modify * it under the terms of version 2 of the GNU General Public License as
@@ -29,7 +29,7 @@* * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved. * Copyright(c) 2016 - 2017 Intel Deutschland GmbH -* Copyright(c) 2018 Intel Corporation +* Copyright(c) 2018 - 2019 Intel Corporation * All rights reserved. * * Redistribution and use in source and binary forms, with or without
@@ -103,7 +103,7 @@ iwl_parse_nvm_data(struct iwl_trans *trans, const struct iwl_cfg *cfg,struct ieee80211_regdomain *iwl_parse_nvm_mcc_info (struct device *dev,const struct iwl_cfg *cfg,int num_of_ch,__le32 *channels,u16 fw_mcc, -u16 geo_info); +u16 geo_info,u16 cap);/** * struct iwl_nvm_section - describes an NVM section in memory.
drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +2 -1
@@ -256,7 +256,8 @@ struct ieee80211_regdomain *iwl_mvm_get_regdomain(struct wiphy *wiphy,__le32_to_cpu (resp->n_channels), resp->channels,__le16_to_cpu (resp->mcc), - __le16_to_cpu(resp->geo_info)); +__le16_to_cpu (resp->geo_info), + __le16_to_cpu(resp->cap));/* Store the return source id */ src_id = resp->source_id;kfree (resp);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 63/90 iwlwifi: dbg: force stop the debug monitor HW
In reply to Greg Kroah-HartmanFrom: Shahar S Matityahu <[email protected]>
[ Upstream commit 990aba28f5001f6e90fdd84e13612b560a75deda ]
The driver is required to stop the debug monitor HW recording regardless of the debug configuration since the driver is responsible to halt the FW DBGC.
--- drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-)
drivers/net/wireless/intel/iwlwifi/fw/dbg.c +1 -6
@@ -2490,12 +2490,7 @@ int iwl_fw_dbg_stop_restart_recording(struct iwl_fw_runtime *fwrt, {int ret =0 ; -/* if the FW crashed or not debug monitor cfg was given, there is -* no point in changing the recording state -*/ -if (test_bit (STATUS_FW_ERROR , &fwrt->trans->status) || - (!fwrt->trans->dbg.dest_tlv && - fwrt->trans->dbg.ini_dest ==IWL_FW_INI_LOCATION_INVALID )) +if (test_bit (STATUS_FW_ERROR , &fwrt->trans->status))return 0 ; if (fw_has_capa(&fwrt->fw->ucode_capa,
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 64/90 Input: evdev - convert kzalloc()/vzalloc() to kvzalloc()
In reply to Greg Kroah-HartmanFrom: Miles Chen <[email protected]>
[ Upstream commit 7f439bc2d7e8c8cc4e1bab08ab7fe1bb73c9b268 ]
We observed a large(order-3) allocation in evdev_open() and it may cause an OOM kernel panic in kzalloc(), before we getting to the vzalloc() fallback.
Fix it by converting kzalloc()/vzalloc() to kvzalloc() to avoid the OOM killer logic as we have a vmalloc fallback.
InputReader invoked oom-killer: gfp_mask=0x240c2c0 (GFP_KERNEL|__GFP_NOWARN|__GFP_COMP|__GFP_ZERO), nodemask=0, order=3, oom_score_adj=-900
...
(dump_backtrace) from (show_stack+0x18/0x1c)
(show_stack) from (dump_stack+0x94/0xa8)
(dump_stack) from (dump_header+0x7c/0xe4)
(dump_header) from (out_of_memory+0x334/0x348) (out_of_memory) from (__alloc_pages_nodemask+0xe9c/0xeb8) (__alloc_pages_nodemask) from (kmalloc_order_trace+0x34/0x128) (kmalloc_order_trace) from (__kmalloc+0x258/0x36c) (__kmalloc) from (evdev_open+0x5c/0x17c)
(evdev_open) from (chrdev_open+0x100/0x204)
(chrdev_open) from (do_dentry_open+0x21c/0x354) (do_dentry_open) from (vfs_open+0x58/0x84)
(vfs_open) from (path_openat+0x640/0xc98)
(path_openat) from (do_filp_open+0x78/0x11c) (do_filp_open) from (do_sys_open+0x130/0x244) (do_sys_open) from (SyS_openat+0x14/0x18)
(SyS_openat) from (__sys_trace_return+0x0/0x10)
...
Normal: 12488*4kB (UMEH) 6984*8kB (UMEH) 2101*16kB (UMEH) 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 139440kB
HighMem: 206*4kB (H) 131*8kB (H) 42*16kB (H) 2*32kB (H) 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 2608kB
...
Kernel panic - not syncing: Out of memory and no killable processes...
--- drivers/input/evdev.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/input/evdev.c +1 -4
@@ -484,10 +484,7 @@ static int evdev_open(struct inode *inode, struct file *file)struct evdev_client *client;int error; - client =kzalloc (struct_size (client, buffer, bufsize), -GFP_KERNEL | __GFP_NOWARN); -if (!client) - client =vzalloc (struct_size (client, buffer, bufsize)); + client =kvzalloc (struct_size (client, buffer, bufsize),GFP_KERNEL );if (!client)return -ENOMEM ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 65/90 Input: aiptek - use descriptors of current altsetting
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
[ Upstream commit cfa4f6a99fb183742cace65ec551b444852b8ef6 ]
Make sure to always use the descriptors of the current alternate setting to avoid future issues when accessing fields that may differ between settings.
--- drivers/input/tablet/aiptek.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/input/tablet/aiptek.c +1 -1
@@ -1713,7 +1713,7 @@ aiptek_probe(struct usb_interface *intf, const struct usb_device_id *id) aiptek->inputdev = inputdev; aiptek->intf = intf; - aiptek->ifnum = intf->altsetting[0 ].desc.bInterfaceNumber; + aiptek->ifnum = intf->cur_altsetting->desc.bInterfaceNumber; aiptek->inDelay =0 ; aiptek->endDelay =0 ; aiptek->previousJitterable =0 ;
Signature · 1 line
2.20.1
Re: [PATCH 5.4 65/90] Input: aiptek - use descriptors of current altsetting
Quoted 22 lines · Greg Kroah-Hartman
From: Johan Hovold <[email protected]>
[ Upstream commit
cfa4f6a99fb183742cace65ec551b444852b8ef6]Make sure to always use the descriptors of the current alternate setting to avoid future issues when accessing fields that may differ between settings.
Signed-off-by Johan Hovold <[email protected]>Acked-by Vladis Dronov <[email protected]>Signed-off-by Dmitry Torokhov <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- drivers/input/tablet/aiptek.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)drivers/input/tablet/aiptek.c +0
-0
drivers/input/tablet/aiptek.c aiptek_probe(struct usb_interface *intf, const struct usb_device_id *id) · line 1719
Quoted 8 lines
drivers/input/tablet/aiptek.c +1
-1@@ -1713,7 +1713,7 @@ aiptek_probe(struct usb_interface *intf, const struct usb_device_id *id) aiptek->inputdev = inputdev; aiptek->intf = intf; - aiptek->ifnum = intf->altsetting[0 ].desc.bInterfaceNumber; + aiptek->ifnum = intf->cur_altsetting->desc.bInterfaceNumber; aiptek->inDelay =0 ; aiptek->endDelay =0 ; aiptek->previousJitterable =0 ;
I asked Sasha to drop this one directly when he added it, so it's probable gone from all the stable queues by now.
But I'm still curious how this ended up being selected for stable in the first place? There's no fixes or stable tag in the commit, and I never received a mail from the AUTOSEL scripts.
Johan
Greg Kroah-Hartman
maintainerRe: [PATCH 5.4 65/90] Input: aiptek - use descriptors of current altsetting
Quoted 24 lines · Johan Hovold
Quoted 23 lines · Greg Kroah-Hartman
From: Johan Hovold <[email protected]>
[ Upstream commit
cfa4f6a99fb183742cace65ec551b444852b8ef6]Make sure to always use the descriptors of the current alternate setting to avoid future issues when accessing fields that may differ between settings.
Signed-off-by Johan Hovold <[email protected]>Acked-by Vladis Dronov <[email protected]>Signed-off-by Dmitry Torokhov <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- drivers/input/tablet/aiptek.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)drivers/input/tablet/aiptek.c +0
-0@@ -1713,7 +1713,7 @@ aiptek_probe(struct usb_interface *intf, const struct usb_device_id *id)
Quoted 10 lines
drivers/input/tablet/aiptek.c aiptek_probe(struct usb_interface *intf, const struct usb_device_id *id) · line 1719
Quoted 7 lines
drivers/input/tablet/aiptek.c +1
-1aiptek->inputdev = inputdev; aiptek->intf = intf; - aiptek->ifnum = intf->altsetting[0 ].desc.bInterfaceNumber; + aiptek->ifnum = intf->cur_altsetting->desc.bInterfaceNumber; aiptek->inDelay =0 ; aiptek->endDelay =0 ; aiptek->previousJitterable =0 ;I asked Sasha to drop this one directly when he added it, so it's probable gone from all the stable queues by now.
Oops, no, let me go drop it.
Quoted 3 lines
But I'm still curious how this ended up being selected for stable in the first place? There's no fixes or stable tag in the commit, and I never received a mail from the AUTOSEL scripts.
I don't know, there was a bunch of last-minute patches picked up for this round based on some "fixes needed due to other fixes".
thanks,
greg k-h
Re: [PATCH 5.4 65/90] Input: aiptek - use descriptors of current altsetting
Quoted 36 lines · Greg Kroah-Hartman
Quoted 24 lines · Johan Hovold
Quoted 23 lines · Greg Kroah-Hartman
From: Johan Hovold <[email protected]>
[ Upstream commit
cfa4f6a99fb183742cace65ec551b444852b8ef6]Make sure to always use the descriptors of the current alternate setting to avoid future issues when accessing fields that may differ between settings.
Signed-off-by Johan Hovold <[email protected]>Acked-by Vladis Dronov <[email protected]>Signed-off-by Dmitry Torokhov <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- drivers/input/tablet/aiptek.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)drivers/input/tablet/aiptek.c +0
-0@@ -1713,7 +1713,7 @@ aiptek_probe(struct usb_interface *intf, const struct usb_device_id *id)Quoted 10 lines
drivers/input/tablet/aiptek.c aiptek_probe(struct usb_interface *intf, const struct usb_device_id *id) · line 1719
Quoted 7 lines
drivers/input/tablet/aiptek.c +1
-1aiptek->inputdev = inputdev; aiptek->intf = intf; - aiptek->ifnum = intf->altsetting[0 ].desc.bInterfaceNumber; + aiptek->ifnum = intf->cur_altsetting->desc.bInterfaceNumber; aiptek->inDelay =0 ; aiptek->endDelay =0 ; aiptek->previousJitterable =0 ;I asked Sasha to drop this one directly when he added it, so it's probable gone from all the stable queues by now.
Quoted 8 lines
Oops, no, let me go drop it.
Quoted 3 lines
But I'm still curious how this ended up being selected for stable in the first place? There's no fixes or stable tag in the commit, and I never received a mail from the AUTOSEL scripts.
I don't know, there was a bunch of last-minute patches picked up for this round based on some "fixes needed due to other fixes".
Ah, yeah, could be dependencies otherwise, but then you usually send a notice about that. And in this case this is the last commit to this particular driver in Linus's tree too.
Johan
Greg Kroah-Hartman
maintainerRe: [PATCH 5.4 65/90] Input: aiptek - use descriptors of current altsetting
Quoted 43 lines · Johan Hovold
Quoted 42 lines · Greg Kroah-Hartman
Quoted 24 lines · Johan Hovold
Quoted 23 lines · Greg Kroah-Hartman
From: Johan Hovold <[email protected]>
[ Upstream commit
cfa4f6a99fb183742cace65ec551b444852b8ef6]Make sure to always use the descriptors of the current alternate setting to avoid future issues when accessing fields that may differ between settings.
Signed-off-by Johan Hovold <[email protected]>Acked-by Vladis Dronov <[email protected]>Signed-off-by Dmitry Torokhov <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- drivers/input/tablet/aiptek.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)drivers/input/tablet/aiptek.c +0
-0@@ -1713,7 +1713,7 @@ aiptek_probe(struct usb_interface *intf, const struct usb_device_id *id)Quoted 10 lines
drivers/input/tablet/aiptek.c aiptek_probe(struct usb_interface *intf, const struct usb_device_id *id) · line 1719
Quoted 7 lines
drivers/input/tablet/aiptek.c +1
-1aiptek->inputdev = inputdev; aiptek->intf = intf; - aiptek->ifnum = intf->altsetting[0 ].desc.bInterfaceNumber; + aiptek->ifnum = intf->cur_altsetting->desc.bInterfaceNumber; aiptek->inDelay =0 ; aiptek->endDelay =0 ; aiptek->previousJitterable =0 ;I asked Sasha to drop this one directly when he added it, so it's probable gone from all the stable queues by now.
Oops, no, let me go drop it.
Quoted 3 lines
But I'm still curious how this ended up being selected for stable in the first place? There's no fixes or stable tag in the commit, and I never received a mail from the AUTOSEL scripts.
Quoted 6 lines
Quoted 2 lines
I don't know, there was a bunch of last-minute patches picked up for this round based on some "fixes needed due to other fixes".
Ah, yeah, could be dependencies otherwise, but then you usually send a notice about that. And in this case this is the last commit to this particular driver in Linus's tree too.
Yes, things went a bit sideways for this round for various reasons :(
Greg Kroah-Hartman
maintainerPATCH 66/90 ARM: dts: am335x-boneblack-common: fix memory size
In reply to Greg Kroah-HartmanFrom: Matwey V. Kornilov <[email protected]>
[ Upstream commit 5abd45ea0fc3060f7805e131753fdcbafd6c6618 ]
BeagleBone Black series is equipped with 512MB RAM whereas only 256MB is included from am335x-bone-common.dtsi
This leads to an issue with unusual setups when devicetree is loaded by GRUB2 directly.
--- arch/arm/boot/dts/am335x-boneblack-common.dtsi | 5 +++++ 1 file changed, 5 insertions(+)
arch/arm/boot/dts/am335x-boneblack-common.dtsi +5 -0
@@ -131,6 +131,11 @@ }; / { + memory@80000000 { + device_type = "memory"; + reg = <0x80000000 0x20000000>; /* 512 MB */ + }; + clk_mcasp0_fixed: clk_mcasp0_fixed { #clock-cells = <0>; compatible = "fixed-clock";
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 67/90 vti[6]: fix packet tx through bpf_redirect()
In reply to Greg Kroah-HartmanFrom: Nicolas Dichtel <[email protected]>
[ Upstream commit 95224166a9032ff5d08fca633d37113078ce7d01 ]
With an ebpf program that redirects packets through a vti[6] interface, the packets are dropped because no dst is attached.
This could also be reproduced with an AF_PACKET socket, with the following python script (vti1 is an ip_vti interface):
import socket
send_s = socket.socket(socket.AF_PACKET, socket.SOCK_RAW, 0)
# scapy
# p = IP(src='10.100.0.2', dst='10.200.0.1')/ICMP(type='echo-request')
# raw(p)
req = b'E\x00\x00\x1c\x00\x01\x00\x00@\x01e\xb2\nd\x00\x02\n\xc8\x00\x01\x08\x00\xf7\xff\x00\x00\x00\x00'
send_s.sendto(req, ('vti1', 0x800, 0, 0))--- net/ipv4/ip_vti.c | 13 +++++++++++-- net/ipv6/ip6_vti.c | 13 +++++++++++-- 2 files changed, 22 insertions(+), 4 deletions(-)
net/ipv4/ip_vti.c +11 -2
@@ -187,8 +187,17 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev,int mtu;if (!dst) { - dev->stats.tx_carrier_errors++; - goto tx_error_icmp; +struct rtable *rt; + + fl->u.ip4.flowi4_oif = dev->ifindex; + fl->u.ip4.flowi4_flags |=FLOWI_FLAG_ANYSRC ; + rt =__ip_route_output_key (dev_net (dev), &fl->u.ip4); +if (IS_ERR (rt)) { + dev->stats.tx_carrier_errors++; + goto tx_error_icmp; + } + dst = &rt->dst; +skb_dst_set (skb, dst); }dst_hold (dst);
net/ipv6/ip6_vti.c +11 -2
@@ -449,8 +449,17 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)int err =-1 ;int mtu; -if (!dst) - goto tx_err_link_failure; +if (!dst) { + fl->u.ip6.flowi6_oif = dev->ifindex; + fl->u.ip6.flowi6_flags |=FLOWI_FLAG_ANYSRC ; + dst =ip6_route_output (dev_net (dev),NULL , &fl->u.ip6); +if (dst->error) { +dst_release (dst); + dst =NULL ; + goto tx_err_link_failure; + } +skb_dst_set (skb, dst); + }dst_hold (dst); dst =xfrm_lookup (t->net, dst, fl,NULL ,0 );
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 68/90 xfrm interface: fix packet tx through bpf_redirect()
In reply to Greg Kroah-HartmanFrom: Nicolas Dichtel <[email protected]>
[ Upstream commit f042365dbffea98fb8148c98c700402e8d099f02 ]
With an ebpf program that redirects packets through a xfrm interface, packets are dropped because no dst is attached to skb.
This could also be reproduced with an AF_PACKET socket, with the following python script (xfrm1 is a xfrm interface):
import socket
send_s = socket.socket(socket.AF_PACKET, socket.SOCK_RAW, 0)
# scapy
# p = IP(src='10.100.0.2', dst='10.200.0.1')/ICMP(type='echo-request')
# raw(p)
req = b'E\x00\x00\x1c\x00\x01\x00\x00@\x01e\xb2\nd\x00\x02\n\xc8\x00\x01\x08\x00\xf7\xff\x00\x00\x00\x00'
send_s.sendto(req, ('xfrm1', 0x800, 0, 0))It was also not possible to send an ip packet through an AF_PACKET socket because a LL header was expected. Let's remove those LL header constraints.
--- net/xfrm/xfrm_interface.c | 32 +++++++++++++++++++++++++------- 1 file changed, 25 insertions(+), 7 deletions(-)
net/xfrm/xfrm_interface.c +25 -7
@@ -268,9 +268,6 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)int err =-1 ;int mtu; -if (!dst) - goto tx_err_link_failure; -dst_hold (dst); dst =xfrm_lookup_with_ifid (xi->net, dst, fl,NULL ,0 , xi->p.if_id);if (IS_ERR (dst)) {
@@ -343,6 +340,7 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev) {struct xfrm_if *xi =netdev_priv (dev);struct net_device_stats *stats = &xi->dev->stats; +struct dst_entry *dst =skb_dst (skb);struct flowi fl;int ret;
@@ -352,10 +350,33 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)case htons (ETH_P_IPV6 ):xfrm_decode_session (skb, &fl,AF_INET6 );memset (IP6CB (skb),0 ,sizeof (*IP6CB (skb))); +if (!dst) { + fl.u.ip6.flowi6_oif = dev->ifindex; + fl.u.ip6.flowi6_flags |=FLOWI_FLAG_ANYSRC ; + dst =ip6_route_output (dev_net (dev),NULL , &fl.u.ip6); +if (dst->error) { +dst_release (dst); + stats->tx_carrier_errors++; + goto tx_err; + } +skb_dst_set (skb, dst); + }break ;case htons (ETH_P_IP ):xfrm_decode_session (skb, &fl,AF_INET );memset (IPCB (skb),0 ,sizeof (*IPCB (skb))); +if (!dst) { +struct rtable *rt; + + fl.u.ip4.flowi4_oif = dev->ifindex; + fl.u.ip4.flowi4_flags |=FLOWI_FLAG_ANYSRC ; + rt =__ip_route_output_key (dev_net (dev), &fl.u.ip4); +if (IS_ERR (rt)) { + stats->tx_carrier_errors++; + goto tx_err; + } +skb_dst_set (skb, &rt->dst); + }break ;default : goto tx_err;
@@ -563,12 +584,9 @@ static void xfrmi_dev_setup(struct net_device *dev) { dev->netdev_ops = &xfrmi_netdev_ops; dev->type =ARPHRD_NONE ; - dev->hard_header_len =ETH_HLEN ; - dev->min_header_len =ETH_HLEN ; dev->mtu =ETH_DATA_LEN ; dev->min_mtu =ETH_MIN_MTU ; - dev->max_mtu =ETH_DATA_LEN ; - dev->addr_len =ETH_ALEN ; + dev->max_mtu =IP_MAX_MTU ; dev->flags =IFF_NOARP ; dev->needs_free_netdev = true; dev->priv_destructor = xfrmi_dev_free;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 69/90 xfrm: interface: do not confirm neighbor when do pmtu update
In reply to Greg Kroah-HartmanFrom: Xu Wang <[email protected]>
[ Upstream commit 8aaea2b0428b6aad7c7e22d3fddc31a78bb1d724 ]
When do IPv6 tunnel PMTU update and calls __ip6_rt_update_pmtu() in the end, we should not call dst_confirm_neigh() as there is no two-way communication.
--- net/xfrm/xfrm_interface.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/xfrm/xfrm_interface.c +1 -1
@@ -294,7 +294,7 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl) mtu =dst_mtu (dst);if (!skb->ignore_df && skb->len > mtu) { -skb_dst_update_pmtu (skb, mtu); +skb_dst_update_pmtu_no_confirm (skb, mtu);if (skb->protocol ==htons (ETH_P_IPV6 )) {if (mtu <IPV6_MIN_MTU )
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 70/90 Input: max77650-onkey - add of_match table
In reply to Greg Kroah-HartmanFrom: Bartosz Golaszewski <[email protected]>
[ Upstream commit ce535a2efb48d8d4c4e4b97e2764d7cee73d9b55 ]
We need the of_match table if we want to use the compatible string in the pmic's child node and get the onkey driver loaded automatically.
--- drivers/input/misc/max77650-onkey.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/input/misc/max77650-onkey.c +7 -0
@@ -108,9 +108,16 @@ static int max77650_onkey_probe(struct platform_device *pdev)return input_register_device (onkey->input); } +static const struct of_device_id max77650_onkey_of_match[] = { + { .compatible ="maxim,max77650-onkey" }, + { } +}; +MODULE_DEVICE_TABLE (of, max77650_onkey_of_match); +static struct platform_driver max77650_onkey_driver = { .driver = { .name ="max77650-onkey" , + .of_match_table = max77650_onkey_of_match, }, .probe = max77650_onkey_probe, };
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 71/90 scsi: fnic: do not queue commands during fwreset
In reply to Greg Kroah-HartmanFrom: Hannes Reinecke <[email protected]>
[ Upstream commit 0e2209629fec427ba75a6351486153a9feddd36b ]
When a link is going down the driver will be calling fnic_cleanup_io(), which will traverse all commands and calling 'done' for each found command. While the traversal is handled under the host_lock, calling 'done' happens after the host_lock is being dropped.
As fnic_queuecommand_lck() is being called with the host_lock held, it might well be that it will pick the command being selected for abortion from the above routine and enqueue it for sending, but then 'done' is being called on that very command from the above routine.
Which of course confuses the hell out of the scsi midlayer.
So fix this by not queueing commands when fnic_cleanup_io is active.
--- drivers/scsi/fnic/fnic_scsi.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/scsi/fnic/fnic_scsi.c +3 -0
@@ -439,6 +439,9 @@ static int fnic_queuecommand_lck(struct scsi_cmnd *sc, void (*done)(struct scsi_if (unlikely (fnic_chk_state_flags_locked (fnic,FNIC_FLAGS_IO_BLOCKED )))return SCSI_MLQUEUE_HOST_BUSY ; +if (unlikely (fnic_chk_state_flags_locked (fnic,FNIC_FLAGS_FWRESET ))) +return SCSI_MLQUEUE_HOST_BUSY ; + rport =starget_to_rport (scsi_target (sc->device));if (!rport) { FNIC_SCSI_DBG(KERN_DEBUG, fnic->lport->host,
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 72/90 ARM: 8955/1: virt: Relax arch timer version check during early boot
In reply to Greg Kroah-HartmanFrom: Vladimir Murzin <[email protected]>
[ Upstream commit 6849b5eba1965ceb0cad3a75877ef4569dd3638e ]
Updates to the Generic Timer architecture allow ID_PFR1.GenTimer to have values other than 0 or 1 while still preserving backward compatibility. At the moment, Linux is quite strict in the way it handles this field at early boot and will not configure arch timer if it doesn't find the value 1.
Since here use ubfx for arch timer version extraction (hyb-stub build with -march=armv7-a, so it is safe)
To help backports (even though the code was correct at the time of writing)
--- arch/arm/kernel/hyp-stub.S | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
arch/arm/kernel/hyp-stub.S +3 -4
@@ -146,10 +146,9 @@ ARM_BE8(orr r7, r7, #(1 << 25)) @ HSCTLR.EE #if !defined(ZIMAGE) && defined(CONFIG_ARM_ARCH_TIMER) @ make CNTP_* and CNTPCT accessible from PL1 mrc p15, 0, r7, c0, c1, 1 @ ID_PFR1 - lsr r7, #16 - and r7, #0xf - cmp r7, #1 - bne 1f + ubfx r7, r7, #16, #4 + teq r7, #0 + beq 1f mrc p15, 4, r7, c14, c1, 0 @ CNTHCTL orr r7, r7, #3 @ PL1PCEN | PL1PCTEN mcr p15, 4, r7, c14, c1, 0 @ CNTHCTL
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 73/90 led: max77650: add of_match table
In reply to Greg Kroah-HartmanFrom: Bartosz Golaszewski <[email protected]>
[ Upstream commit 2424415d25a765d4302ddfb4de75427e9294dc09 ]
We need the of_match table if we want to use the compatible string in the pmic's child node and get the led driver loaded automatically.
--- drivers/leds/leds-max77650.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/leds/leds-max77650.c +7 -0
@@ -135,9 +135,16 @@ static int max77650_led_probe(struct platform_device *pdev)return rv; } +static const struct of_device_id max77650_led_of_match[] = { + { .compatible ="maxim,max77650-led" }, + { } +}; +MODULE_DEVICE_TABLE (of, max77650_led_of_match); +static struct platform_driver max77650_led_driver = { .driver = { .name ="max77650-led" , + .of_match_table = max77650_led_of_match, }, .probe = max77650_led_probe, };
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 74/90 tee: optee: Fix compilation issue with nommu
In reply to Greg Kroah-HartmanFrom: Vincenzo Frascino <[email protected]>
[ Upstream commit 9e0caab8e0f96f0af7d1dd388e62f44184a75372 ]
The optee driver uses specific page table types to verify if a memory region is normal. These types are not defined in nommu systems. Trying to compile the driver in these systems results in a build error:
linux/drivers/tee/optee/call.c: In function ‘is_normal_memory’:
linux/drivers/tee/optee/call.c:533:26: error: ‘L_PTE_MT_MASK’ undeclared
(first use in this function); did you mean ‘PREEMPT_MASK’?
return (pgprot_val(p) & L_PTE_MT_MASK) == L_PTE_MT_WRITEALLOC;
^~~~~~~~~~~~~
PREEMPT_MASK
linux/drivers/tee/optee/call.c:533:26: note: each undeclared identifier is
reported only once for each function it appears in
linux/drivers/tee/optee/call.c:533:44: error: ‘L_PTE_MT_WRITEALLOC’ undeclared
(first use in this function)
return (pgprot_val(p) & L_PTE_MT_MASK) == L_PTE_MT_WRITEALLOC;
^~~~~~~~~~~~~~~~~~~Make the optee driver depend on MMU to fix the compilation issue.
--- drivers/tee/optee/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/tee/optee/Kconfig +1 -0
@@ -3,6 +3,7 @@ config OPTEE tristate "OP-TEE" depends on HAVE_ARM_SMCCC + depends on MMU help This implements the OP-TEE Trusted Execution Environment (TEE) driver.
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 75/90 r8152: get default setting of WOL before initializing
In reply to Greg Kroah-HartmanFrom: Hayes Wang <[email protected]>
[ Upstream commit 9583a3638dc07cc1878f41265e85ed497f72efcb ]
Initailization would reset runtime suspend by tp->saved_wolopts, so the tp->saved_wolopts should be set before initializing.
--- drivers/net/usb/r8152.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/net/usb/r8152.c +5 -4
@@ -5690,6 +5690,11 @@ static int rtl8152_probe(struct usb_interface *intf, intf->needs_remote_wakeup =1 ; +if (!rtl_can_wakeup (tp)) +__rtl_set_wol (tp,0 ); +else + tp->saved_wolopts =__rtl_get_wol (tp); + tp->rtl_ops.init (tp);queue_delayed_work (system_long_wq, &tp->hw_phy_work,0 );set_ethernet_addr (tp);
@@ -5703,10 +5708,6 @@ static int rtl8152_probe(struct usb_interface *intf, goto out1; } -if (!rtl_can_wakeup (tp)) -__rtl_set_wol (tp,0 ); - - tp->saved_wolopts =__rtl_get_wol (tp);if (tp->saved_wolopts)device_set_wakeup_enable (&udev->dev, true);else
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 76/90 r8152: disable U2P3 for RTL8153B
In reply to Greg Kroah-HartmanFrom: Hayes Wang <[email protected]>
[ Upstream commit 809a7fc6593f288d6f820ef6cc57b9d69b5f9474 ]
Enable U2P3 may miss zero packet for bulk-in.
--- drivers/net/usb/r8152.c | 3 --- 1 file changed, 3 deletions(-)
drivers/net/usb/r8152.c +0 -3
@@ -3175,7 +3175,6 @@ static void rtl8153b_runtime_enable(struct r8152 *tp, bool enable)r8153b_ups_en (tp, false);r8153_queue_wake (tp, false);rtl_runtime_suspend_enable (tp, false); -r8153_u2p3en (tp, true);r8153b_u1u2en (tp, true); } }
@@ -3703,7 +3702,6 @@ static void r8153b_hw_phy_cfg(struct r8152 *tp)r8153_aldps_en (tp, true);r8152b_enable_fc (tp); -r8153_u2p3en (tp, true);set_bit (PHY_RESET , &tp->flags); }
@@ -4055,7 +4053,6 @@ static void rtl8153b_up(struct r8152 *tp)ocp_write_dword (tp,MCU_TYPE_USB ,USB_RX_BUF_TH ,RX_THR_B );r8153_aldps_en (tp, true); -r8153_u2p3en (tp, true);r8153b_u1u2en (tp, true); }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 77/90 r8152: Disable PLA MCU clock speed down
In reply to Greg Kroah-HartmanFrom: Hayes Wang <[email protected]>
[ Upstream commit 08997b5eec08a2c29367f19a74abdea54b299406 ]
PLA MCU clock speed down could only be enabled when tx/rx are disabled. Otherwise, the packet loss may occur.
--- drivers/net/usb/r8152.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)
drivers/net/usb/r8152.c +17 -0
@@ -310,6 +310,7 @@#define MAC_CLK_SPDWN_EN BIT(15)/* PLA_MAC_PWR_CTRL3 */ +#define PLA_MCU_SPDWN_EN BIT(14)#define PKT_AVAIL_SPDWN_EN 0x0100#define SUSPEND_SPDWN_EN 0x0004#define U1U2_SPDWN_EN 0x0002
@@ -4042,6 +4043,8 @@ static void rtl8153_down(struct r8152 *tp)static void rtl8153b_up (struct r8152 *tp) { +u32 ocp_data; +if (test_bit (RTL8152_UNPLUG , &tp->flags))return ;
@@ -4052,17 +4055,27 @@ static void rtl8153b_up(struct r8152 *tp)r8153_first_init (tp);ocp_write_dword (tp,MCU_TYPE_USB ,USB_RX_BUF_TH ,RX_THR_B ); + ocp_data =ocp_read_word (tp,MCU_TYPE_PLA ,PLA_MAC_PWR_CTRL3 ); + ocp_data &= ~PLA_MCU_SPDWN_EN ; +ocp_write_word (tp,MCU_TYPE_PLA ,PLA_MAC_PWR_CTRL3 , ocp_data); +r8153_aldps_en (tp, true);r8153b_u1u2en (tp, true); }static void rtl8153b_down (struct r8152 *tp) { +u32 ocp_data; +if (test_bit (RTL8152_UNPLUG , &tp->flags)) {rtl_drop_queued_tx (tp);return ; } + ocp_data =ocp_read_word (tp,MCU_TYPE_PLA ,PLA_MAC_PWR_CTRL3 ); + ocp_data |=PLA_MCU_SPDWN_EN ; +ocp_write_word (tp,MCU_TYPE_PLA ,PLA_MAC_PWR_CTRL3 , ocp_data); +r8153b_u1u2en (tp, false);r8153_u2p3en (tp, false);r8153b_power_cut_en (tp, false);
@@ -4523,6 +4536,10 @@ static void r8153b_init(struct r8152 *tp) ocp_data |=MAC_CLK_SPDWN_EN ;ocp_write_word (tp,MCU_TYPE_PLA ,PLA_MAC_PWR_CTRL2 , ocp_data); + ocp_data =ocp_read_word (tp,MCU_TYPE_PLA ,PLA_MAC_PWR_CTRL3 ); + ocp_data &= ~PLA_MCU_SPDWN_EN ; +ocp_write_word (tp,MCU_TYPE_PLA ,PLA_MAC_PWR_CTRL3 , ocp_data); +set_bit (GREEN_ETHERNET , &tp->flags);/* rx aggregation */
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 78/90 r8152: disable test IO for RTL8153B
In reply to Greg Kroah-HartmanFrom: Hayes Wang <[email protected]>
[ Upstream commit d7f1b59655efb5a285d227c8f9853a98eab5c2fd ]
For RTL8153B with QFN32, disable test IO. Otherwise, it may cause abnormal behavior for the device randomly.
--- drivers/net/usb/r8152.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/net/usb/r8152.c +10 -0
@@ -298,6 +298,7 @@/* PLA_PHY_PWR */ #define TX_10M_IDLE_EN 0x0080#define PFM_PWM_SWITCH 0x0040 +#define TEST_IO_OFF BIT(4)/* PLA_MAC_PWR_CTRL */ #define D3_CLK_GATED_EN 0x00004000
@@ -4540,6 +4541,15 @@ static void r8153b_init(struct r8152 *tp) ocp_data &= ~PLA_MCU_SPDWN_EN ;ocp_write_word (tp,MCU_TYPE_PLA ,PLA_MAC_PWR_CTRL3 , ocp_data); +if (tp->version ==RTL_VER_09 ) { +/* Disable Test IO for 32QFN */ +if (ocp_read_byte (tp,MCU_TYPE_PLA ,0xdc00 ) &BIT (5 )) { + ocp_data =ocp_read_word (tp,MCU_TYPE_PLA ,PLA_PHY_PWR ); + ocp_data |=TEST_IO_OFF ; +ocp_write_word (tp,MCU_TYPE_PLA ,PLA_PHY_PWR , ocp_data); + } + } +set_bit (GREEN_ETHERNET , &tp->flags);/* rx aggregation */
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 79/90 r8152: avoid the MCU to clear the lanwake
In reply to Greg Kroah-HartmanFrom: Hayes Wang <[email protected]>
[ Upstream commit 19813162895a696c5814d76e5f8fb6203d70f6e0 ]
Avoid the MCU to clear the lanwake after suspending. It may cause the WOL fail. Disable LANWAKE_CLR_EN before suspending. Besides,enable it and reset the lanwake status when resuming or initializing.
--- drivers/net/usb/r8152.c | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+)
drivers/net/usb/r8152.c +33 -0
@@ -63,6 +63,7 @@#define PLA_LED_FEATURE 0xdd92#define PLA_PHYAR 0xde00#define PLA_BOOT_CTRL 0xe004 +#define PLA_LWAKE_CTRL_REG 0xe007#define PLA_GPHY_INTR_IMR 0xe022#define PLA_EEE_CR 0xe040#define PLA_EEEP_CR 0xe080
@@ -90,6 +91,7 @@#define PLA_TALLYCNT 0xe890#define PLA_SFF_STS_7 0xe8de#define PLA_PHYSTATUS 0xe908 +#define PLA_CONFIG6 0xe90a/* CONFIG6 */ #define PLA_BP_BA 0xfc26#define PLA_BP_0 0xfc28#define PLA_BP_1 0xfc2a
@@ -286,6 +288,9 @@#define LINK_ON_WAKE_EN 0x0010#define LINK_OFF_WAKE_EN 0x0008 +/* PLA_CONFIG6 */ +#define LANWAKE_CLR_EN BIT(0) +/* PLA_CONFIG5 */ #define BWF_EN 0x0040#define MWF_EN 0x0020
@@ -342,6 +347,9 @@/* PLA_BOOT_CTRL */ #define AUTOLOAD_DONE 0x0002 +/* PLA_LWAKE_CTRL_REG */ +#define LANWAKE_PIN BIT(7) +/* PLA_SUSPEND_FLAG */ #define LINK_CHG_EVENT BIT(0)
@@ -4004,6 +4012,8 @@ static void rtl8152_down(struct r8152 *tp)static void rtl8153_up (struct r8152 *tp) { +u32 ocp_data; +if (test_bit (RTL8152_UNPLUG , &tp->flags))return ;
@@ -4011,6 +4021,15 @@ static void rtl8153_up(struct r8152 *tp)r8153_u2p3en (tp, false);r8153_aldps_en (tp, false);r8153_first_init (tp); + + ocp_data =ocp_read_byte (tp,MCU_TYPE_PLA ,PLA_CONFIG6 ); + ocp_data |=LANWAKE_CLR_EN ; +ocp_write_byte (tp,MCU_TYPE_PLA ,PLA_CONFIG6 , ocp_data); + + ocp_data =ocp_read_byte (tp,MCU_TYPE_PLA ,PLA_LWAKE_CTRL_REG ); + ocp_data &= ~LANWAKE_PIN ; +ocp_write_byte (tp,MCU_TYPE_PLA ,PLA_LWAKE_CTRL_REG , ocp_data); +r8153_aldps_en (tp, true);switch (tp->version) {
@@ -4029,11 +4048,17 @@ static void rtl8153_up(struct r8152 *tp)static void rtl8153_down (struct r8152 *tp) { +u32 ocp_data; +if (test_bit (RTL8152_UNPLUG , &tp->flags)) {rtl_drop_queued_tx (tp);return ; } + ocp_data =ocp_read_byte (tp,MCU_TYPE_PLA ,PLA_CONFIG6 ); + ocp_data &= ~LANWAKE_CLR_EN ; +ocp_write_byte (tp,MCU_TYPE_PLA ,PLA_CONFIG6 , ocp_data); +r8153_u1u2en (tp, false);r8153_u2p3en (tp, false);r8153_power_cut_en (tp, false);
@@ -4465,6 +4490,14 @@ static void r8153_init(struct r8152 *tp)r8153_mac_clk_spd (tp, false);usb_enable_lpm (tp->udev); + ocp_data =ocp_read_byte (tp,MCU_TYPE_PLA ,PLA_CONFIG6 ); + ocp_data |=LANWAKE_CLR_EN ; +ocp_write_byte (tp,MCU_TYPE_PLA ,PLA_CONFIG6 , ocp_data); + + ocp_data =ocp_read_byte (tp,MCU_TYPE_PLA ,PLA_LWAKE_CTRL_REG ); + ocp_data &= ~LANWAKE_PIN ; +ocp_write_byte (tp,MCU_TYPE_PLA ,PLA_LWAKE_CTRL_REG , ocp_data); +/* rx aggregation */ ocp_data =ocp_read_word (tp,MCU_TYPE_USB ,USB_USB_CTRL ); ocp_data &= ~(RX_AGG_DISABLE |RX_ZERO_EN );
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 80/90 r8152: disable DelayPhyPwrChg
In reply to Greg Kroah-HartmanFrom: Hayes Wang <[email protected]>
[ Upstream commit aa475d935272481c9ffb1ae54eeca5c1819fbe1a ]
When enabling this, the device would wait an internal signal which wouldn't be triggered. Then, the device couldn't enter P3 mode, so the power consumption is increased.
--- drivers/net/usb/r8152.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/net/usb/r8152.c +9 -1
@@ -29,7 +29,7 @@#define NETNEXT_VERSION "10"/* Information for net */ -#define NET_VERSION "10" +#define NET_VERSION "11"#define DRIVER_VERSION "v1." NETNEXT_VERSION "." NET_VERSION#define DRIVER_AUTHOR "Realtek linux nic maintainers <[email protected]>"
@@ -104,6 +104,7 @@#define PLA_BP_EN 0xfc38#define USB_USB2PHY 0xb41e +#define USB_SSPHYLINK1 0xb426#define USB_SSPHYLINK2 0xb428#define USB_U2P3_CTRL 0xb460#define USB_CSR_DUMMY1 0xb464
@@ -363,6 +364,9 @@#define USB2PHY_SUSPEND 0x0001#define USB2PHY_L1 0x0002 +/* USB_SSPHYLINK1 */ +#define DELAY_PHY_PWR_CHG BIT(1) +/* USB_SSPHYLINK2 */ #define pwd_dn_scale_mask 0x3ffe#define pwd_dn_scale (x) ((x) << 1)
@@ -4030,6 +4034,10 @@ static void rtl8153_up(struct r8152 *tp) ocp_data &= ~LANWAKE_PIN ;ocp_write_byte (tp,MCU_TYPE_PLA ,PLA_LWAKE_CTRL_REG , ocp_data); + ocp_data =ocp_read_word (tp,MCU_TYPE_USB ,USB_SSPHYLINK1 ); + ocp_data &= ~DELAY_PHY_PWR_CHG ; +ocp_write_word (tp,MCU_TYPE_USB ,USB_SSPHYLINK1 , ocp_data); +r8153_aldps_en (tp, true);switch (tp->version) {
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 81/90 ARM: dts: am43x-epos-evm: set data pin directions for spi0 and spi1
In reply to Greg Kroah-HartmanFrom: Raag Jadav <[email protected]>
[ Upstream commit b0b03951544534d6d9ad4aa2787eefec988fff20 ]
Set d0 and d1 pin directions for spi0 and spi1 as per their pinmux.
--- arch/arm/boot/dts/am43x-epos-evm.dts | 2 ++ 1 file changed, 2 insertions(+)
arch/arm/boot/dts/am43x-epos-evm.dts +2 -0
@@ -848,6 +848,7 @@ pinctrl-names = "default", "sleep"; pinctrl-0 = <&spi0_pins_default>; pinctrl-1 = <&spi0_pins_sleep>; + ti,pindir-d0-out-d1-in = <1>; }; &spi1 {
@@ -855,6 +856,7 @@ pinctrl-names = "default", "sleep"; pinctrl-0 = <&spi1_pins_default>; pinctrl-1 = <&spi1_pins_sleep>; + ti,pindir-d0-out-d1-in = <1>; }; &usb2_phy1 {
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 82/90 qlcnic: Fix CPU soft lockup while collecting firmware dump
In reply to Greg Kroah-HartmanFrom: Manish Chopra <[email protected]>
[ Upstream commit 22e984493a41bf8081f13d9ed84def3ca8cfd427 ]
Driver while collecting firmware dump takes longer time to collect/process some of the firmware dump entries/memories. Bigger capture masks makes it worse as it results in larger amount of data being collected and results in CPU soft lockup. Place cond_resched() in some of the driver flows that are expectedly time consuming to relinquish the CPU to avoid CPU soft lockup panic.
--- drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c | 1 + drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c | 2 ++ 2 files changed, 3 insertions(+)
drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c +1 -0
@@ -2043,6 +2043,7 @@ static void qlcnic_83xx_exec_template_cmd(struct qlcnic_adapter *p_dev,break ; } entry += p_hdr->size; +cond_resched (); } p_dev->ahw->reset.seq_index = index; }
drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c +2 -0
@@ -703,6 +703,7 @@ static u32 qlcnic_read_memory_test_agent(struct qlcnic_adapter *adapter, addr +=16 ; reg_read -=16 ; ret +=16 ; +cond_resched (); } out:mutex_unlock (&adapter->ahw->mem_lock);
@@ -1383,6 +1384,7 @@ int qlcnic_dump_fw(struct qlcnic_adapter *adapter) buf_offset += entry->hdr.cap_size; entry_offset += entry->hdr.offset; buffer = fw_dump->data + buf_offset; +cond_resched (); } fw_dump->clr =1 ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 83/90 powerpc/fsl/dts: add fsl,erratum-a011043
In reply to Greg Kroah-HartmanFrom: Madalin Bucur <[email protected]>
[ Upstream commit 73d527aef68f7644e59f22ce7f9ac75e7b533aea ]
Add fsl,erratum-a011043 to internal MDIO buses. Software may get false read error when reading internal PCS registers through MDIO. As a workaround, all internal MDIO accesses should ignore the MDIO_CFG[MDIO_RD_ER] bit.
--- arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0-best-effort.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1-best-effort.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-0.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-1.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-2.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-3.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-4.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-5.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-0.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-1.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-0.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-1.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-2.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-3.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-4.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-5.dtsi | 1 + 18 files changed, 18 insertions(+)
arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0-best-effort.dtsi +1 -0
@@ -63,6 +63,7 @@ fman@400000 { #size-cells = <0>; compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio"; reg = <0xe1000 0x1000>; + fsl,erratum-a011043; /* must ignore read errors */ pcsphy0: ethernet-phy@0 { reg = <0x0>;
arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0.dtsi +1 -0
@@ -60,6 +60,7 @@ fman@400000 { #size-cells = <0>; compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio"; reg = <0xf1000 0x1000>; + fsl,erratum-a011043; /* must ignore read errors */ pcsphy6: ethernet-phy@0 { reg = <0x0>;
arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1-best-effort.dtsi +1 -0
@@ -63,6 +63,7 @@ fman@400000 { #size-cells = <0>; compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio"; reg = <0xe3000 0x1000>; + fsl,erratum-a011043; /* must ignore read errors */ pcsphy1: ethernet-phy@0 { reg = <0x0>;
arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1.dtsi +1 -0
@@ -60,6 +60,7 @@ fman@400000 { #size-cells = <0>; compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio"; reg = <0xf3000 0x1000>; + fsl,erratum-a011043; /* must ignore read errors */ pcsphy7: ethernet-phy@0 { reg = <0x0>;
arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-0.dtsi +1 -0
@@ -59,6 +59,7 @@ fman@400000 { #size-cells = <0>; compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio"; reg = <0xe1000 0x1000>; + fsl,erratum-a011043; /* must ignore read errors */ pcsphy0: ethernet-phy@0 { reg = <0x0>;
arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-1.dtsi +1 -0
@@ -59,6 +59,7 @@ fman@400000 { #size-cells = <0>; compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio"; reg = <0xe3000 0x1000>; + fsl,erratum-a011043; /* must ignore read errors */ pcsphy1: ethernet-phy@0 { reg = <0x0>;
arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-2.dtsi +1 -0
@@ -59,6 +59,7 @@ fman@400000 { #size-cells = <0>; compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio"; reg = <0xe5000 0x1000>; + fsl,erratum-a011043; /* must ignore read errors */ pcsphy2: ethernet-phy@0 { reg = <0x0>;
arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-3.dtsi +1 -0
@@ -59,6 +59,7 @@ fman@400000 { #size-cells = <0>; compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio"; reg = <0xe7000 0x1000>; + fsl,erratum-a011043; /* must ignore read errors */ pcsphy3: ethernet-phy@0 { reg = <0x0>;
arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-4.dtsi +1 -0
@@ -59,6 +59,7 @@ fman@400000 { #size-cells = <0>; compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio"; reg = <0xe9000 0x1000>; + fsl,erratum-a011043; /* must ignore read errors */ pcsphy4: ethernet-phy@0 { reg = <0x0>;
arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-5.dtsi +1 -0
@@ -59,6 +59,7 @@ fman@400000 { #size-cells = <0>; compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio"; reg = <0xeb000 0x1000>; + fsl,erratum-a011043; /* must ignore read errors */ pcsphy5: ethernet-phy@0 { reg = <0x0>;
arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-0.dtsi +1 -0
@@ -60,6 +60,7 @@ fman@500000 { #size-cells = <0>; compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio"; reg = <0xf1000 0x1000>; + fsl,erratum-a011043; /* must ignore read errors */ pcsphy14: ethernet-phy@0 { reg = <0x0>;
arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-1.dtsi +1 -0
@@ -60,6 +60,7 @@ fman@500000 { #size-cells = <0>; compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio"; reg = <0xf3000 0x1000>; + fsl,erratum-a011043; /* must ignore read errors */ pcsphy15: ethernet-phy@0 { reg = <0x0>;
arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-0.dtsi +1 -0
@@ -59,6 +59,7 @@ fman@500000 { #size-cells = <0>; compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio"; reg = <0xe1000 0x1000>; + fsl,erratum-a011043; /* must ignore read errors */ pcsphy8: ethernet-phy@0 { reg = <0x0>;
arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-1.dtsi +1 -0
@@ -59,6 +59,7 @@ fman@500000 { #size-cells = <0>; compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio"; reg = <0xe3000 0x1000>; + fsl,erratum-a011043; /* must ignore read errors */ pcsphy9: ethernet-phy@0 { reg = <0x0>;
arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-2.dtsi +1 -0
@@ -59,6 +59,7 @@ fman@500000 { #size-cells = <0>; compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio"; reg = <0xe5000 0x1000>; + fsl,erratum-a011043; /* must ignore read errors */ pcsphy10: ethernet-phy@0 { reg = <0x0>;
arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-3.dtsi +1 -0
@@ -59,6 +59,7 @@ fman@500000 { #size-cells = <0>; compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio"; reg = <0xe7000 0x1000>; + fsl,erratum-a011043; /* must ignore read errors */ pcsphy11: ethernet-phy@0 { reg = <0x0>;
arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-4.dtsi +1 -0
@@ -59,6 +59,7 @@ fman@500000 { #size-cells = <0>; compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio"; reg = <0xe9000 0x1000>; + fsl,erratum-a011043; /* must ignore read errors */ pcsphy12: ethernet-phy@0 { reg = <0x0>;
arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-5.dtsi +1 -0
@@ -59,6 +59,7 @@ fman@500000 { #size-cells = <0>; compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio"; reg = <0xeb000 0x1000>; + fsl,erratum-a011043; /* must ignore read errors */ pcsphy13: ethernet-phy@0 { reg = <0x0>;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 84/90 net/fsl: treat fsl,erratum-a011043
In reply to Greg Kroah-HartmanFrom: Madalin Bucur <[email protected]>
[ Upstream commit 1d3ca681b9d9575ccf696ebc2840a1ebb1fd4074 ]
When fsl,erratum-a011043 is set, adjust for erratum A011043:
MDIO reads to internal PCS registers may result in having the MDIO_CFG[MDIO_RD_ER] bit set, even when there is no error and read data (MDIO_DATA[MDIO_DATA]) is correct. Software may get false read error when reading internal PCS registers through MDIO. As a workaround, all internal MDIO accesses should ignore the MDIO_CFG[MDIO_RD_ER] bit.
--- drivers/net/ethernet/freescale/xgmac_mdio.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/net/ethernet/freescale/xgmac_mdio.c +6 -1
@@ -49,6 +49,7 @@ struct tgec_mdio_controller {struct mdio_fsl_priv {struct tgec_mdio_controller __iomem *mdio_base;bool is_little_endian; +bool has_a011043; }; static u32 xgmac_read32(void __iomem *regs,
@@ -226,7 +227,8 @@ static int xgmac_mdio_read(struct mii_bus *bus, int phy_id, int regnum)return ret;/* Return all Fs if nothing was there */ -if (xgmac_read32 (®s->mdio_stat, endian) &MDIO_STAT_RD_ER ) { +if ((xgmac_read32 (®s->mdio_stat, endian) &MDIO_STAT_RD_ER ) && + !priv->has_a011043) {dev_err (&bus->dev,"Error while reading PHY%d reg at %d.%hhu\n" , phy_id, dev_addr, regnum);
@@ -274,6 +276,9 @@ static int xgmac_mdio_probe(struct platform_device *pdev) priv->is_little_endian =of_property_read_bool (pdev->dev.of_node,"little-endian" ); + priv->has_a011043 =of_property_read_bool (pdev->dev.of_node, +"fsl,erratum-a011043" ); + ret =of_mdiobus_register (bus, np);if (ret) {dev_err (&pdev->dev,"cannot register MDIO bus\n" );
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 85/90 net: fsl/fman: rename IF_MODE_XGMII to IF_MODE_10G
In reply to Greg Kroah-HartmanFrom: Madalin Bucur <[email protected]>
[ Upstream commit 457bfc0a4bf531487ecc3cf82ec728a5e114fb1e ]
As the only 10G PHY interface type defined at the moment the code was developed was XGMII, although the PHY interface mode used was not XGMII, XGMII was used in the code to denote 10G. This patch renames the 10G interface mode to remove the ambiguity.
--- drivers/net/ethernet/freescale/fman/fman_memac.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/freescale/fman/fman_memac.c +2 -2
@@ -110,7 +110,7 @@ do { \/* Interface Mode Register (IF_MODE) */ #define IF_MODE_MASK 0x00000003/* 30-31 Mask on i/f mode bits */ -#define IF_MODE_XGMII 0x00000000/* 30-31 XGMII (10G) interface */ +#define IF_MODE_10G 0x00000000/* 30-31 10G interface */ #define IF_MODE_GMII 0x00000002/* 30-31 GMII (1G) interface */ #define IF_MODE_RGMII 0x00000004#define IF_MODE_RGMII_AUTO 0x00008000
@@ -440,7 +440,7 @@ static int init(struct memac_regs __iomem *regs, struct memac_cfg *cfg, tmp =0 ;switch (phy_if) {case PHY_INTERFACE_MODE_XGMII : - tmp |=IF_MODE_XGMII ; + tmp |=IF_MODE_10G ;break ;default : tmp |=IF_MODE_GMII ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 86/90 seq_tab_next() should increase position index
In reply to Greg Kroah-HartmanFrom: Vasily Averin <[email protected]>
[ Upstream commit 70a87287c821e9721b62463777f55ba588ac4623 ]
if seq_file .next fuction does not change position index, read after some lseek can generate unexpected output.
https://bugzilla.kernel.org/show_bug.cgi?id=206283
--- drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c +1 -2
@@ -70,8 +70,7 @@ static void *seq_tab_start(struct seq_file *seq, loff_t *pos)static void *seq_tab_next (struct seq_file *seq,void *v,loff_t *pos) { v =seq_tab_get_idx (seq->private, *pos +1 ); -if (v) - ++*pos; + ++(*pos);return v; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 87/90 l2t_seq_next should increase position index
In reply to Greg Kroah-HartmanFrom: Vasily Averin <[email protected]>
[ Upstream commit 66018a102f7756cf72db4d2704e1b93969d9d332 ]
if seq_file .next fuction does not change position index, read after some lseek can generate unexpected output.
https://bugzilla.kernel.org/show_bug.cgi?id=206283
--- drivers/net/ethernet/chelsio/cxgb4/l2t.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/ethernet/chelsio/cxgb4/l2t.c +1 -2
@@ -682,8 +682,7 @@ static void *l2t_seq_start(struct seq_file *seq, loff_t *pos)static void *l2t_seq_next (struct seq_file *seq,void *v,loff_t *pos) { v =l2t_get_idx (seq, *pos); -if (v) - ++*pos; + ++(*pos);return v; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 88/90 netfilter: conntrack: sctp: use distinct states for new SCTP connections
In reply to Greg Kroah-HartmanFrom: Jiri Wiesner <[email protected]>
[ Upstream commit ab658b9fa7a2c467f79eac8b53ea308b8f98113d ]
The netlink notifications triggered by the INIT and INIT_ACK chunks for a tracked SCTP association do not include protocol information for the corresponding connection - SCTP state and verification tags for the original and reply direction are missing. Since the connection tracking implementation allows user space programs to receive notifications about a connection and then create a new connection based on the values received in a notification, it makes sense that INIT and INIT_ACK notifications should contain the SCTP state and verification tags available at the time when a notification is sent. The missing verification tags cause a newly created netfilter connection to fail to verify the tags of SCTP packets when this connection has been created from the values previously received in an INIT or INIT_ACK notification.
A PROTOINFO event is cached in sctp_packet() when the state of a connection changes. The CLOSED and COOKIE_WAIT state will be used for connections that have seen an INIT and INIT_ACK chunk, respectively. The distinct states will cause a connection state change in sctp_packet().
--- net/netfilter/nf_conntrack_proto_sctp.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/netfilter/nf_conntrack_proto_sctp.c +3 -3
@@ -114,7 +114,7 @@ static const u8 sctp_conntracks[2][11][SCTP_CONNTRACK_MAX] = { {/* ORIGINAL */ /* sNO, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHS, sHA */ -/* init */ {sCW, sCW, sCW, sCE, sES, sSS, sSR, sSA, sCW, sHA}, +/* init */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA, sCW, sHA}, /* init_ack */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA, sCL, sHA}, /* abort */ {sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL}, /* shutdown */ {sCL, sCL, sCW, sCE, sSS, sSS, sSR, sSA, sCL, sSS},
@@ -130,7 +130,7 @@ static const u8 sctp_conntracks[2][11][SCTP_CONNTRACK_MAX] = {/* REPLY */ /* sNO, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHS, sHA */ /* init */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA, sIV, sHA},/* INIT in sCL Big TODO */ -/* init_ack */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA, sIV, sHA}, +/* init_ack */ {sIV, sCW, sCW, sCE, sES, sSS, sSR, sSA, sIV, sHA}, /* abort */ {sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sIV, sCL}, /* shutdown */ {sIV, sCL, sCW, sCE, sSR, sSS, sSR, sSA, sIV, sSR}, /* shutdown_ack */ {sIV, sCL, sCW, sCE, sES, sSA, sSA, sSA, sIV, sHA},
@@ -316,7 +316,7 @@ sctp_new(struct nf_conn *ct, const struct sk_buff *skb, ct->proto.sctp.vtag[IP_CT_DIR_REPLY ] = sh->vtag; } - ct->proto.sctp.state = new_state; + ct->proto.sctp.state =SCTP_CONNTRACK_NONE ; }return true;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 89/90 netfilter: nf_tables_offload: fix check the chain offload flag
In reply to Greg Kroah-HartmanFrom: wenxu <[email protected]>
[ Upstream commit c83de17dd6308fb74696923e5245de0e3c427206 ]
In the nft_indr_block_cb the chain should check the flag with NFT_CHAIN_HW_OFFLOAD.
--- net/netfilter/nf_tables_offload.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/nf_tables_offload.c +1 -1
@@ -437,7 +437,7 @@ static void nft_indr_block_cb(struct net_device *dev,mutex_lock (&net->nft.commit_mutex); chain =__nft_offload_get_chain (dev); -if (chain) { +if (chain && chain->flags &NFT_CHAIN_HW_OFFLOAD ) {struct nft_base_chain *basechain; basechain =nft_base_chain (chain);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 90/90 net: Fix skb->csum update in inet_proto_csum_replace16().
In reply to Greg Kroah-HartmanFrom: Praveen Chaudhary <[email protected]>
[ Upstream commit 189c9b1e94539b11c80636bc13e9cf47529e7bba ]
skb->csum is updated incorrectly, when manipulation for NF_NAT_MANIP_SRC\DST is done on IPV6 packet.
Fix:
There is no need to update skb->csum in inet_proto_csum_replace16(), because update in two fields a.) IPv6 src/dst address and b.) L4 header checksum cancels each other for skb->csum calculation. Whereas inet_proto_csum_replace4 function needs to update skb->csum, because update in 3 fields a.) IPv4 src/dst address, b.) IPv4 Header checksum and c.) L4 header checksum results in same diff as L4 Header checksum for skb->csum calculation.
--- net/core/utils.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-)
net/core/utils.c +17 -3
@@ -438,6 +438,23 @@ void inet_proto_csum_replace4(__sum16 *sum, struct sk_buff *skb, }EXPORT_SYMBOL (inet_proto_csum_replace4); +/** +* inet_proto_csum_replace16 - update layer 4 header checksum field +* @sum: Layer 4 header checksum field +* @skb: sk_buff for the packet +* @from: old IPv6 address +* @to: new IPv6 address +* @pseudohdr: True if layer 4 header checksum includes pseudoheader +* +* Update layer 4 header as per the update in IPv6 src/dst address. +* +* There is no need to update skb->csum in this function, because update in two +* fields a.) IPv6 src/dst address and b.) L4 header checksum cancels each other +* for skb->csum calculation. Whereas inet_proto_csum_replace4 function needs to +* update skb->csum, because update in 3 fields a.) IPv4 src/dst address, +* b.) IPv4 Header checksum and c.) L4 header checksum results in same diff as +* L4 Header checksum for skb->csum calculation. +*/ void inet_proto_csum_replace16 (__sum16 *sum,struct sk_buff *skb,const __be32 *from,const __be32 *to,bool pseudohdr)
@@ -449,9 +466,6 @@ void inet_proto_csum_replace16(__sum16 *sum, struct sk_buff *skb,if (skb->ip_summed !=CHECKSUM_PARTIAL ) { *sum =csum_fold (csum_partial (diff,sizeof (diff), ~csum_unfold (*sum))); -if (skb->ip_summed ==CHECKSUM_COMPLETE && pseudohdr) - skb->csum = ~csum_partial (diff,sizeof (diff), - ~skb->csum); }else if (pseudohdr) *sum = ~csum_fold (csum_partial (diff,sizeof (diff),csum_unfold (*sum)));
Signature · 1 line
2.20.1
Jon Hunter
maintainerQuoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.18 release. There are 90 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 05 Feb 2020 16:17:59 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.18-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
All tests are passing for Tegra ...
Test results for stable-v5.4:
13 builds: 13 pass, 0 fail
22 boots: 22 pass, 0 fail
40 tests: 40 pass, 0 failLinux version: 5.4.18-rc1-g0c7175ac8c7e
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra20-ventana,
tegra210-p2371-2180, tegra210-p3450-0000,
tegra30-cardhu-a04Cheers
Jon
Signature · 1 line
nvpublic
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.18 release. There are 90 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 05 Feb 2020 16:17:59 +0000. Anything received after that time might be too late.
Building i386:allyesconfig ... failed
Building i386:allmodconfig ... failed
--------------
Error log:
In file included from arch/x86/kernel/pci-dma.c:2:include/linux/dma-direct.h:29:20: error: conflicting types for 'dma_capable'
29 | static inline bool dma_capable(struct device *dev, dma_addr_t addr, size_t size,
| ^~~~~~~~~~~
In file included from include/linux/dma-direct.h:12,
from arch/x86/kernel/pci-dma.c:2:
arch/x86/include/asm/dma-direct.h:5:6: note: previous declaration of 'dma_capable' was here
5 | bool dma_capable(struct device *dev, dma_addr_t addr, size_t size);---
Building riscv:{defconfig, allnoconfig, tinyconfig} ... failed
Error log:arch/riscv/lib/tishift.S: Assembler messages:arch/riscv/lib/tishift.S:9: Error: unrecognized opcode `sym_func_start(__lshrti3)' [ many of those ]
Greg Kroah-Hartman
maintainerQuoted 7 lines · Guenter Roeck
---
Building riscv:{defconfig, allnoconfig, tinyconfig} ... failedError log:
arch/riscv/lib/tishift.S: Assembler messages:arch/riscv/lib/tishift.S:9: Error: unrecognized opcode `sym_func_start(__lshrti3)' [ many of those ]
Dropped the offending patch here, thanks.
greg k-h
Quoted 11 lines · Greg Kroah-Hartman
Quoted 7 lines · Guenter Roeck
---
Building riscv:{defconfig, allnoconfig, tinyconfig} ... failedError log:
arch/riscv/lib/tishift.S: Assembler messages:arch/riscv/lib/tishift.S:9: Error: unrecognized opcode `sym_func_start(__lshrti3)' [ many of those ]Dropped the offending patch here, thanks.
This problem is indeed fixed with v5.4.17-99-gbd0c6624a110 (-rc4).
Guenter
Greg Kroah-Hartman
maintainerQuoted 5 lines · Guenter Roeck
Quoted 4 lines · Greg Kroah-Hartman
Quoted 3 lines · Guenter Roeck
---
Building riscv:{defconfig, allnoconfig, tinyconfig} ... failed
Quoted 8 lines
Quoted 7 lines
Quoted 4 lines
Error log:
arch/riscv/lib/tishift.S: Assembler messages:arch/riscv/lib/tishift.S:9: Error: unrecognized opcode `sym_func_start(__lshrti3)' [ many of those ]Dropped the offending patch here, thanks.
This problem is indeed fixed with v5.4.17-99-gbd0c6624a110 (-rc4).
Good! Thanks for letting me know.
greg k-h
Greg Kroah-Hartman
maintainerQuoted 17 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.18 release. There are 90 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 05 Feb 2020 16:17:59 +0000. Anything received after that time might be too late.
Building i386:allyesconfig ... failed
Building i386:allmodconfig ... failed
--------------
Error log:
In file included fromarch/x86/kernel/pci-dma.c:2:include/linux/dma-direct.h:29:20: error: conflicting types for 'dma_capable'
29 | static inline bool dma_capable(struct device *dev,dma_addr_taddr,size_tsize,
Quoted 5 lines
| ^~~~~~~~~~~
In file included from include/linux/dma-direct.h:12,
from arch/x86/kernel/pci-dma.c:2:
arch/x86/include/asm/dma-direct.h:5:6: note: previous declaration of 'dma_capable' was here
5 | bool dma_capable(struct device *dev, dma_addr_t addr, size_t size);Ok, I think this is now resolved with a patch that Sasha added.
I have pushed out a -rc4 that _should_ build and boot properly.
Hopefully :)
thanks,
greg k-h
Quoted 24 lines · Greg Kroah-Hartman
Quoted 17 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.18 release. There are 90 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 05 Feb 2020 16:17:59 +0000. Anything received after that time might be too late.
Building i386:allyesconfig ... failed
Building i386:allmodconfig ... failed
--------------
Error log:
In file included fromarch/x86/kernel/pci-dma.c:2:include/linux/dma-direct.h:29:20: error: conflicting types for 'dma_capable'
29 | static inline bool dma_capable(struct device *dev,dma_addr_taddr,size_tsize,Quoted 5 lines
| ^~~~~~~~~~~ In file included from include/linux/dma-direct.h:12, from arch/x86/kernel/pci-dma.c:2: arch/x86/include/asm/dma-direct.h:5:6: note: previous declaration of 'dma_capable' was here 5 | bool dma_capable(struct device *dev, dma_addr_t addr, size_t size);
Quoted 4 lines
Ok, I think this is now resolved with a patch that Sasha added.
I have pushed out a -rc4 that _should_ build and boot properly.
The i386 build still fails with v5.4.17-99-gbd0c6624a110 (-rc4).
Guenter
Greg Kroah-Hartman
maintainerQuoted 25 lines · Guenter Roeck
Quoted 24 lines · Greg Kroah-Hartman
Quoted 22 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.18 release. There are 90 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 05 Feb 2020 16:17:59 +0000. Anything received after that time might be too late.
Building i386:allyesconfig ... failed
Building i386:allmodconfig ... failed
--------------
Error log:
In file included fromarch/x86/kernel/pci-dma.c:2:include/linux/dma-direct.h:29:20: error: conflicting types for 'dma_capable'
29 | static inline bool dma_capable(struct device *dev,dma_addr_taddr,size_tsize,| ^~~~~~~~~~~ In file included from include/linux/dma-direct.h:12, from arch/x86/kernel/pci-dma.c:2: arch/x86/include/asm/dma-direct.h:5:6: note: previous declaration of 'dma_capable' was here 5 | bool dma_capable(struct device *dev, dma_addr_t addr, size_t size);
Quoted 5 lines
Quoted 4 lines
Ok, I think this is now resolved with a patch that Sasha added.
I have pushed out a -rc4 that _should_ build and boot properly.
The i386 build still fails with v5.4.17-99-gbd0c6624a110 (-rc4).
Crap.
Ok, let me get some food and then try to figure this out...
greg k-h
Quoted 28 lines · Greg Kroah-Hartman
Quoted 27 lines · Guenter Roeck
Quoted 26 lines · Greg Kroah-Hartman
Quoted 17 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.18 release. There are 90 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 05 Feb 2020 16:17:59 +0000. Anything received after that time might be too late.
Building i386:allyesconfig ... failed
Building i386:allmodconfig ... failed
--------------
Error log:
In file included fromarch/x86/kernel/pci-dma.c:2:include/linux/dma-direct.h:29:20: error: conflicting types for 'dma_capable'
29 | static inline bool dma_capable(struct device *dev,dma_addr_taddr,size_tsize,Quoted 5 lines
| ^~~~~~~~~~~ In file included from include/linux/dma-direct.h:12, from arch/x86/kernel/pci-dma.c:2: arch/x86/include/asm/dma-direct.h:5:6: note: previous declaration of 'dma_capable' was here 5 | bool dma_capable(struct device *dev, dma_addr_t addr, size_t size);Ok, I think this is now resolved with a patch that Sasha added.
Quoted 8 lines
Quoted 3 lines
Quoted 2 lines
I have pushed out a -rc4 that _should_ build and boot properly.
The i386 build still fails with v5.4.17-99-gbd0c6624a110 (-rc4).
Crap.
Ok, let me get some food and then try to figure this out...
# bad: [bd0c6624a110d0f667cd2f3636f88e8de9b75851] Linux 5.4.18-rc4
# good: [313c8460cf0290fb1b9f71a20573fc32ac6c9cee] Linux 5.4.17
git bisect start 'HEAD' 'v5.4.17'
# good: [7c8bd91288c71011d793de1926a30182382141a0] parisc: Use proper printk format for resource_size_t
git bisect good 7c8bd91288c71011d793de1926a30182382141a0
# good: [67040c483ee8137adb12e20bb6448786455f4de6] r8152: Disable PLA MCU clock speed down
git bisect good 67040c483ee8137adb12e20bb6448786455f4de6
# good: [b3f55c9d709e6dcf96af5230295e631f0cbc3a8f] netfilter: nf_tables_offload: fix check the chain offload flag git bisect good b3f55c9d709e6dcf96af5230295e631f0cbc3a8f
# good: [87bd4bf79429566adf306b8b133625604460b7c2] perf report: Fix no libunwind compiled warning break s390 issue git bisect good 87bd4bf79429566adf306b8b133625604460b7c2
# good: [f831fda5fe86918fcb049721fba779ba2300c022] ASoC: topology: fix soc_tplg_fe_link_create() - link->dobj initialization order git bisect good f831fda5fe86918fcb049721fba779ba2300c022
# good: [cc47538aebee48bb7626c84607116e43f57118d5] tracing/uprobe: Fix to make trace_uprobe_filter alignment safe git bisect good cc47538aebee48bb7626c84607116e43f57118d5
# bad: [26f444bf728054ad23e5888bdd4ffa899e364b45] dma-direct: unify the dma_capable definitions
git bisect bad 26f444bf728054ad23e5888bdd4ffa899e364b45
# first bad commit: [26f444bf728054ad23e5888bdd4ffa899e364b45] dma-direct: unify the dma_capable definitions
Reverting 26f444bf728054ad23e5888bdd4ffa899e364b45 fixes that problem, but results in other build failures. After dropping this commit, another bisect yields:
# bad: [56ea21e523a5ebf53e4ce88bc743c60c480d42ff] Linux 5.4.18-rc4
# good: [313c8460cf0290fb1b9f71a20573fc32ac6c9cee] Linux 5.4.17
git bisect start 'HEAD' 'v5.4.17'
# good: [7c8bd91288c71011d793de1926a30182382141a0] parisc: Use proper printk format for resource_size_t git bisect good 7c8bd91288c71011d793de1926a30182382141a0
# good: [afbfe89dc11d19769477c5378a7164837baf75be] r8152: disable U2P3 for RTL8153B
git bisect good afbfe89dc11d19769477c5378a7164837baf75be
# good: [8403906c74753734338665be315175ddd1e03f5e] netfilter: conntrack: sctp: use distinct states for new SCTP connections git bisect good 8403906c74753734338665be315175ddd1e03f5e
# good: [6b1562623df22cd81bf2138d880915029bbd414c] dm thin: fix use-after-free in metadata_pre_commit_callback git bisect good 6b1562623df22cd81bf2138d880915029bbd414c
# bad: [705430d0039088973d204feea9eb0b7740509194] mm/migrate.c: also overwrite error when it is bigger than zero git bisect bad 705430d0039088973d204feea9eb0b7740509194
# bad: [180dafcb1d1c0ee38f935810fe18d02eb7658c9f] dma-direct: exclude dma_direct_map_resource from the min_low_pfn check git bisect bad 180dafcb1d1c0ee38f935810fe18d02eb7658c9f
# good: [87bd4bf79429566adf306b8b133625604460b7c2] perf report: Fix no libunwind compiled warning break s390 issue git bisect good 87bd4bf79429566adf306b8b133625604460b7c2
# first bad commit: [180dafcb1d1c0ee38f935810fe18d02eb7658c9f] dma-direct: exclude dma_direct_map_resource from the min_low_pfn check
Dropping that patch as well fixes the problem for me.
Guenter
Greg Kroah-Hartman
maintainerQuoted 77 lines · Guenter Roeck
Quoted 28 lines · Greg Kroah-Hartman
Quoted 27 lines · Guenter Roeck
Quoted 26 lines · Greg Kroah-Hartman
Quoted 17 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.18 release. There are 90 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 05 Feb 2020 16:17:59 +0000. Anything received after that time might be too late.
Building i386:allyesconfig ... failed
Building i386:allmodconfig ... failed
--------------
Error log:
In file included fromarch/x86/kernel/pci-dma.c:2:include/linux/dma-direct.h:29:20: error: conflicting types for 'dma_capable'
29 | static inline bool dma_capable(struct device *dev,dma_addr_taddr,size_tsize,Quoted 5 lines
| ^~~~~~~~~~~ In file included from include/linux/dma-direct.h:12, from arch/x86/kernel/pci-dma.c:2: arch/x86/include/asm/dma-direct.h:5:6: note: previous declaration of 'dma_capable' was here 5 | bool dma_capable(struct device *dev, dma_addr_t addr, size_t size);Ok, I think this is now resolved with a patch that Sasha added.
Quoted 8 lines
Quoted 3 lines
Quoted 2 lines
I have pushed out a -rc4 that _should_ build and boot properly.
The i386 build still fails with v5.4.17-99-gbd0c6624a110 (-rc4).
Crap.
Ok, let me get some food and then try to figure this out...
# bad: [
bd0c6624a110d0f667cd2f3636f88e8de9b75851] Linux 5.4.18-rc4
# good: [313c8460cf0290fb1b9f71a20573fc32ac6c9cee] Linux 5.4.17
git bisect start 'HEAD' 'v5.4.17'
# good: [7c8bd91288c71011d793de1926a30182382141a0] parisc: Use proper printk format forresource_size_t
git bisect good7c8bd91288c71011d793de1926a30182382141a0
# good: [67040c483ee8137adb12e20bb6448786455f4de6] r8152: Disable PLA MCU clock speed down
git bisect good67040c483ee8137adb12e20bb6448786455f4de6
# good: [b3f55c9d709e6dcf96af5230295e631f0cbc3a8f] netfilter:nf_tables_offload: fix check the chain offload flag git bisect goodb3f55c9d709e6dcf96af5230295e631f0cbc3a8f
# good: [87bd4bf79429566adf306b8b133625604460b7c2] perf report: Fix no libunwind compiled warning break s390 issue git bisect good87bd4bf79429566adf306b8b133625604460b7c2
# good: [f831fda5fe86918fcb049721fba779ba2300c022] ASoC: topology: fixsoc_tplg_fe_link_create()-link->dobjinitialization order git bisect goodf831fda5fe86918fcb049721fba779ba2300c022
# good: [cc47538aebee48bb7626c84607116e43f57118d5] tracing/uprobe: Fix to maketrace_uprobe_filteralignment safe git bisect goodcc47538aebee48bb7626c84607116e43f57118d5
# bad: [26f444bf728054ad23e5888bdd4ffa899e364b45] dma-direct: unify thedma_capabledefinitions
git bisect bad26f444bf728054ad23e5888bdd4ffa899e364b45# first bad commit: [26f444bf728054ad23e5888bdd4ffa899e364b45] dma-direct: unify the dma_capable definitionsReverting
26f444bf728054ad23e5888bdd4ffa899e364b45fixes that problem, but results in other build failures. After dropping this commit, another bisect yields:# bad: [
56ea21e523a5ebf53e4ce88bc743c60c480d42ff] Linux 5.4.18-rc4
# good: [313c8460cf0290fb1b9f71a20573fc32ac6c9cee] Linux 5.4.17
git bisect start 'HEAD' 'v5.4.17'
# good: [7c8bd91288c71011d793de1926a30182382141a0] parisc: Use proper printk format forresource_size_tgit bisect good7c8bd91288c71011d793de1926a30182382141a0
# good: [afbfe89dc11d19769477c5378a7164837baf75be] r8152: disable U2P3 for RTL8153B
git bisect goodafbfe89dc11d19769477c5378a7164837baf75be
# good: [8403906c74753734338665be315175ddd1e03f5e] netfilter: conntrack: sctp: use distinct states for new SCTP connections git bisect good8403906c74753734338665be315175ddd1e03f5e
# good: [6b1562623df22cd81bf2138d880915029bbd414c] dm thin: fix use-after-free inmetadata_pre_commit_callbackgit bisect good6b1562623df22cd81bf2138d880915029bbd414c
# bad: [705430d0039088973d204feea9eb0b7740509194]mm/migrate.c: also overwrite error when it is bigger than zero git bisect bad705430d0039088973d204feea9eb0b7740509194
# bad: [180dafcb1d1c0ee38f935810fe18d02eb7658c9f] dma-direct: excludedma_direct_map_resourcefrom themin_low_pfncheck git bisect bad180dafcb1d1c0ee38f935810fe18d02eb7658c9f
# good: [87bd4bf79429566adf306b8b133625604460b7c2] perf report: Fix no libunwind compiled warning break s390 issue git bisect good87bd4bf79429566adf306b8b133625604460b7c2
Quoted 3 lines
# first bad commit: [180dafcb1d1c0ee38f935810fe18d02eb7658c9f] dma-direct: exclude dma_direct_map_resource from the min_low_pfn checkDropping that patch as well fixes the problem for me.
Ah, now I got my i386 build working, yeah, this works for me too.
Sasha, I think I tried to backport these dma patches earlier in the 5.4.y series, but it was just too hard to unwind, so I figured it wasn't worth it. I've dropped these two patches now and will go do a release...
thanks for the testing and help here, much appreciated.
greg k-h
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.18 release. There are 90 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 05 Feb 2020 16:17:59 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.18-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
Summary
------------------------------------------------------------------------
kernel: 5.4.18-rc3
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-5.4.y
git commit: a59b851019bc15226d5c7c31ac4e0452e9a57d13
git describe: v5.4.17-102-ga59b851019bc
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-5.4-oe/build/v5.4.17-102-ga59b851019bc
No regressions (compared to build v5.4.17)
No fixes (compared to build v5.4.17)
Ran 11805 total tests in the following environments and test suites.
Environments
--------------
- dragonboard-410c
- hi6220-hikey
- i386
- juno-r2
- qemu_arm
- qemu_arm64
- qemu_i386
- qemu_x86_64
- x15
- x86
Test Suites
-----------
* build
* install-android-platform-tools-r2600
* kselftest
* libgpiod
* linux-log-parser
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-cpuhotplug-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* network-basic-tests
* perf
* v4l2-compliance
* kvm-unit-tests
* libhugetlbfs
* ltp-cve-tests
* ltp-open-posix-tests
* ltp-syscalls-tests
* spectre-meltdown-checker-test
Signature · 2 lines
Linaro LKFT https://lkft.linaro.org
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.18 release. There are 90 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 05 Feb 2020 16:17:59 +0000. Anything received after that time might be too late.
Build results:
total: 158 pass: 153 fail: 5
Failed builds:
i386:allyesconfig
i386:allmodconfig
riscv:defconfig
riscv:allnoconfig
riscv:tinyconfig
Qemu test results:
total: 392 pass: 375 fail: 17
Failed tests:
<all riscv>
Errors as already reported.
Guenter
Re: [PATCH 5.4 61/90] iwlwifi: mvm: fix NVM check for 3168 devices
In reply to Greg Kroah-HartmanI believe this commit (upstream commit b3f20e098293892388d6a0491d6bbb2efb46fbff) introduced a regression that causes the driver to fail to initialize for Intel 3168 devices. A patch for the regression has been submitted to the linux-wireless mailing list here:
https://patchwork.kernel.org/patch/11353871/
I would suggest either not including b3f20e0982 in the next v5.4.x stable release, or also applying the above patch, to avoid introducing a regression for users of the v5.4 series. The above patch is also needs inclusion in the v5.5.x series, as the regression is already present there.
Cheers,
-- Dan
Greg KH
maintainerRe: [PATCH 5.4 61/90] iwlwifi: mvm: fix NVM check for 3168 devices
Quoted 6 lines · Dan Moulding
I believe this commit (upstream commit
b3f20e098293892388d6a0491d6bbb2efb46fbff) introduced a regression that causes the driver to fail to initialize for Intel 3168 devices. A patch for the regression has been submitted to the linux-wireless mailing list here:
Quoted 7 lines
https://patchwork.kernel.org/patch/11353871/
I would suggest either not including
b3f20e0982in the next v5.4.x stable release, or also applying the above patch, to avoid introducing a regression for users of the v5.4 series. The above patch is also needs inclusion in the v5.5.x series, as the regression is already present there.
Now dropped from all trees. Can you send us an email with the git commit id of the fix when it lands in Linus's tree so we remember to pick both of these up?
thanks,
greg k-h
Re: [PATCH 5.4 61/90] iwlwifi: mvm: fix NVM check for 3168 devices
Quoted 15 lines · Greg KH
Quoted 6 lines · Dan Moulding
I believe this commit (upstream commit
b3f20e098293892388d6a0491d6bbb2efb46fbff) introduced a regression that causes the driver to fail to initialize for Intel 3168 devices. A patch for the regression has been submitted to the linux-wireless mailing list here:Quoted 7 lines
https://patchwork.kernel.org/patch/11353871/
I would suggest either not including
b3f20e0982in the next v5.4.x stable release, or also applying the above patch, to avoid introducing a regression for users of the v5.4 series. The above patch is also needs inclusion in the v5.5.x series, as the regression is already present there.
Quoted 7 lines
Now dropped from all trees. Can you send us an email with the git commit id of the fix when it lands in Linus's tree so we remember to pick both of these up?
thanks,
greg k-h
The above fix has been merged to Linus's tree and needs to be backported to linux-5.5.y.
Commit a9149d243f259ad8f02b1e23dfe8ba06128f15e1.
Thanks,
-- Dan
Greg KH
maintainerRe: [PATCH 5.4 61/90] iwlwifi: mvm: fix NVM check for 3168 devices
Quoted 20 lines · Dan Moulding
Quoted 19 lines · Greg KH
Quoted 6 lines · Dan Moulding
I believe this commit (upstream commit
b3f20e098293892388d6a0491d6bbb2efb46fbff) introduced a regression that causes the driver to fail to initialize for Intel 3168 devices. A patch for the regression has been submitted to the linux-wireless mailing list here:Quoted 7 lines
https://patchwork.kernel.org/patch/11353871/
I would suggest either not including
b3f20e0982in the next v5.4.x stable release, or also applying the above patch, to avoid introducing a regression for users of the v5.4 series. The above patch is also needs inclusion in the v5.5.x series, as the regression is already present there.Now dropped from all trees. Can you send us an email with the git commit id of the fix when it lands in Linus's tree so we remember to pick both of these up?
Quoted 8 lines
Quoted 3 lines
thanks,
greg k-h
The above fix has been merged to Linus's tree and needs to be backported to linux-5.5.y.
Commit
a9149d243f259ad8f02b1e23dfe8ba06128f15e1.
Looks like it has already been queued up, thansk!
greg k-h