5.5.12-rc1 review
Greg Kroah-Hartman
maintainerPATCH 10/119 powerpc: Include .BTF section
In reply to Greg Kroah-HartmanFrom: Naveen N. Rao <[email protected]>
[ Upstream commit cb0cc635c7a9fa8a3a0f75d4d896721819c63add ]
Selecting CONFIG_DEBUG_INFO_BTF results in the below warning from ld:
ld: warning: orphan section .BTF' from .btf.vmlinux.bin.o' being placed in section `.BTF'
Include .BTF section in vmlinux explicitly to fix the same.
--- arch/powerpc/kernel/vmlinux.lds.S | 6 ++++++ 1 file changed, 6 insertions(+)
arch/powerpc/kernel/vmlinux.lds.S +6 -0
@@ -303,6 +303,12 @@ SECTIONS *(.branch_lt) } +#ifdef CONFIG_DEBUG_INFO_BTF + .BTF : AT(ADDR(.BTF) - LOAD_OFFSET) { + *(.BTF) + } +#endif + .opd : AT(ADDR(.opd) - LOAD_OFFSET) { __start_opd = .; KEEP(*(.opd))
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 11/119 cifs: fix potential mismatch of UNC paths
In reply to Greg Kroah-HartmanFrom: Paulo Alcantara (SUSE) <[email protected]>
[ Upstream commit 154255233830e1e4dd0d99ac929a5dce588c0b81 ]
Ensure that full_path is an UNC path that contains '\\' as delimiter, which is required by cifs_build_devname().
The build_path_from_dentry_optional_prefix() function may return a path with '/' as delimiter when using SMB1 UNIX extensions, for example.
--- fs/cifs/cifs_dfs_ref.c | 2 ++ 1 file changed, 2 insertions(+)
fs/cifs/cifs_dfs_ref.c +2 -0
@@ -324,6 +324,8 @@ static struct vfsmount *cifs_dfs_do_automount(struct dentry *mntpt)if (full_path ==NULL ) goto cdda_exit; +convert_delimiter (full_path,'\\' ); +cifs_dbg (FYI ,"%s: full_path: %s\n" , __func__, full_path);if (!cifs_sb_master_tlink (cifs_sb)) {
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 12/119 cifs: add missing mount option to /proc/mounts
In reply to Greg Kroah-HartmanFrom: Steve French <[email protected]>
[ Upstream commit ec57010acd03428a749d2600bf09bd537eaae993 ]
We were not displaying the mount option "signloosely" in /proc/mounts for cifs mounts which some users found confusing recently
--- fs/cifs/cifsfs.c | 2 ++ 1 file changed, 2 insertions(+)
fs/cifs/cifsfs.c +2 -0
@@ -530,6 +530,8 @@ cifs_show_options(struct seq_file *s, struct dentry *root)if (tcon->seal)seq_puts (s,",seal" ); +else if (tcon->ses->server->ignore_signature) +seq_puts (s,",signloosely" );if (tcon->nocase)seq_puts (s,",nocase" );if (tcon->local_lease)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 13/119 ARM: dts: dra7: Add "dma-ranges" property to PCIe RC DT nodes
In reply to Greg Kroah-HartmanFrom: Kishon Vijay Abraham I <[email protected]>
[ Upstream commit 27f13774654ea6bd0b6fc9b97cce8d19e5735661 ]
'dma-ranges' in a PCI bridge node does correctly set dma masks for PCI devices not described in the DT. Certain DRA7 platforms (e.g., DRA76) has RAM above 32-bit boundary (accessible with LPAE config) though the PCIe bridge will be able to access only 32-bits. Add 'dma-ranges' property in PCIe RC DT nodes to indicate the host bridge can access only 32 bits.
--- arch/arm/boot/dts/dra7.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/arm/boot/dts/dra7.dtsi +2 -0
@@ -184,6 +184,7 @@ device_type = "pci"; ranges = <0x81000000 0 0 0x03000 0 0x00010000 0x82000000 0 0x20013000 0x13000 0 0xffed000>; + dma-ranges = <0x02000000 0x0 0x00000000 0x00000000 0x1 0x00000000>; bus-range = <0x00 0xff>; #interrupt-cells = <1>; num-lanes = <1>;
@@ -238,6 +239,7 @@ device_type = "pci"; ranges = <0x81000000 0 0 0x03000 0 0x00010000 0x82000000 0 0x30013000 0x13000 0 0xffed000>; + dma-ranges = <0x02000000 0x0 0x00000000 0x00000000 0x1 0x00000000>; bus-range = <0x00 0xff>; #interrupt-cells = <1>; num-lanes = <1>;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 14/119 spi: pxa2xx: Add CS control clock quirk
In reply to Greg Kroah-HartmanFrom: Evan Green <[email protected]>
[ Upstream commit 683f65ded66a9a7ff01ed7280804d2132ebfdf7e ]
In some circumstances on Intel LPSS controllers, toggling the LPSS CS control register doesn't actually cause the CS line to toggle. This seems to be failure of dynamic clock gating that occurs after going through a suspend/resume transition, where the controller is sent through a reset transition. This ruins SPI transactions that either rely on delay_usecs, or toggle the CS line without sending data.
Whenever CS is toggled, momentarily set the clock gating register to "Force On" to poke the controller into acting on CS.
--- drivers/spi/spi-pxa2xx.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+)
drivers/spi/spi-pxa2xx.c +23 -0
@@ -70,6 +70,10 @@ MODULE_ALIAS("platform:pxa2xx-spi");#define LPSS_CAPS_CS_EN_SHIFT 9#define LPSS_CAPS_CS_EN_MASK (0xf << LPSS_CAPS_CS_EN_SHIFT) +#define LPSS_PRIV_CLOCK_GATE 0x38 +#define LPSS_PRIV_CLOCK_GATE_CLK_CTL_MASK 0x3 +#define LPSS_PRIV_CLOCK_GATE_CLK_CTL_FORCE_ON 0x3 +struct lpss_config {/* LPSS offset from drv_data->ioaddr */ unsigned offset;
@@ -86,6 +90,8 @@ struct lpss_config {unsigned cs_sel_shift;unsigned cs_sel_mask;unsigned cs_num; +/* Quirks */ + unsigned cs_clk_stays_gated : 1; };/* Keep these sorted with enum pxa_ssp_type */
@@ -156,6 +162,7 @@ static const struct lpss_config lpss_platforms[] = { .tx_threshold_hi = 56, .cs_sel_shift = 8, .cs_sel_mask = 3 << 8, + .cs_clk_stays_gated = true, }, };
@@ -383,6 +390,22 @@ static void lpss_ssp_cs_control(struct spi_device *spi, bool enable)else value |=LPSS_CS_CONTROL_CS_HIGH ;__lpss_ssp_write_priv (drv_data, config->reg_cs_ctrl, value); +if (config->cs_clk_stays_gated) { +u32 clkgate; + +/* +* Changing CS alone when dynamic clock gating is on won't +* actually flip CS at that time. This ruins SPI transfers +* that specify delays, or have no data. Toggle the clock mode +* to force on briefly to poke the CS pin to move. +*/ + clkgate =__lpss_ssp_read_priv (drv_data,LPSS_PRIV_CLOCK_GATE ); + value = (clkgate & ~LPSS_PRIV_CLOCK_GATE_CLK_CTL_MASK ) | +LPSS_PRIV_CLOCK_GATE_CLK_CTL_FORCE_ON ; + +__lpss_ssp_write_priv (drv_data,LPSS_PRIV_CLOCK_GATE , value); +__lpss_ssp_write_priv (drv_data,LPSS_PRIV_CLOCK_GATE , clkgate); + } }static void cs_assert (struct spi_device *spi)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 17/119 drm/exynos: dsi: propagate error value and silence meaningless warning
In reply to Greg Kroah-HartmanFrom: Marek Szyprowski <[email protected]>
[ Upstream commit 0a9d1e3f3f038785ebc72d53f1c409d07f6b4ff5 ]
Properly propagate error value from devm_regulator_bulk_get() and don't confuse user with meaningless warning about failure in getting regulators in case of deferred probe.
--- drivers/gpu/drm/exynos/exynos_drm_dsi.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/gpu/drm/exynos/exynos_drm_dsi.c +3 -2
@@ -1751,8 +1751,9 @@ static int exynos_dsi_probe(struct platform_device *pdev) ret =devm_regulator_bulk_get (dev,ARRAY_SIZE (dsi->supplies), dsi->supplies);if (ret) { -dev_info (dev,"failed to get regulators: %d\n" , ret); -return -EPROBE_DEFER ; +if (ret != -EPROBE_DEFER ) +dev_info (dev,"failed to get regulators: %d\n" , ret); +return ret; } dsi->clks = devm_kcalloc(dev,
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 15/119 spi/zynqmp: remove entry that causes a cs glitch
In reply to Greg Kroah-HartmanFrom: Thommy Jakobsson <[email protected]>
[ Upstream commit 5dd8304981ecffa77bb72b1c57c4be5dfe6cfae9 ]
In the public interface for chipselect, there is always an entry commented as "Dummy generic FIFO entry" pushed down to the fifo right after the activate/deactivate command. The dummy entry is 0x0, irregardless if the intention was to activate or deactive the cs. This causes the cs line to glitch rather than beeing activated in the case when there was an activate command.
This has been observed on oscilloscope, and have caused problems for at least one specific flash device type connected to the qspi port. After the change the glitch is gone and cs goes active when intended.
The reason why this worked before (except for the glitch) was because when sending the actual data, the CS bits are once again set. Since most flashes uses mode 0, there is always a half clk period anyway for cs to clk active setup time. If someone would rely on timing from a chip_select call to a transfer_one, it would fail though.
It is unknown why the dummy entry was there in the first place, git log seems to be of no help in this case. The reference manual gives no indication of the necessity of this. In fact the lower 8 bits are a setup (or hold in case of deactivate) time expressed in cycles. So this should not be needed to fulfill any setup/hold timings.
--- drivers/spi/spi-zynqmp-gqspi.c | 3 --- 1 file changed, 3 deletions(-)
drivers/spi/spi-zynqmp-gqspi.c +0 -3
@@ -401,9 +401,6 @@ static void zynqmp_qspi_chipselect(struct spi_device *qspi, bool is_high)zynqmp_gqspi_write (xqspi,GQSPI_GEN_FIFO_OFST , genfifoentry); -/* Dummy generic FIFO entry */ -zynqmp_gqspi_write (xqspi,GQSPI_GEN_FIFO_OFST ,0x0 ); -/* Manually start the generic FIFO command */ zynqmp_gqspi_write(xqspi, GQSPI_CONFIG_OFST, zynqmp_gqspi_read(xqspi, GQSPI_CONFIG_OFST) |
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 18/119 drm/exynos: dsi: fix workaround for the legacy clock name
In reply to Greg Kroah-HartmanFrom: Marek Szyprowski <[email protected]>
[ Upstream commit c0fd99d659ba5582e09625c7a985d63fc2ca74b5 ]
Writing to the built-in strings arrays doesn't work if driver is loaded as kernel module. This is also considered as a bad pattern. Fix this by adding a call to clk_get() with legacy clock name. This fixes following kernel oops if driver is loaded as module:
Unable to handle kernel paging request at virtual address bf047978 pgd = (ptrval) [bf047978] *pgd=59344811, *pte=5903c6df, *ppte=5903c65f Internal error: Oops: 80f [#1] SMP ARM Modules linked in: mc exynosdrm(+) analogix_dp rtc_s3c exynos_ppmu i2c_gpio CPU: 1 PID: 212 Comm: systemd-udevd Not tainted 5.6.0-rc2-next-20200219 #326 videodev: Linux video capture interface: v2.00 Hardware name: Samsung Exynos (Flattened Device Tree) PC is at exynos_dsi_probe+0x1f0/0x384 [exynosdrm] LR is at exynos_dsi_probe+0x1dc/0x384 [exynosdrm] ... Process systemd-udevd (pid: 212, stack limit = 0x(ptrval)) ... [<bf03cf14>] (exynos_dsi_probe [exynosdrm]) from [<c09b1ca0>] (platform_drv_probe+0x6c/0xa4) [<c09b1ca0>] (platform_drv_probe) from [<c09afcb8>] (really_probe+0x210/0x350) [<c09afcb8>] (really_probe) from [<c09aff74>] (driver_probe_device+0x60/0x1a0) [<c09aff74>] (driver_probe_device) from [<c09b0254>] (device_driver_attach+0x58/0x60) [<c09b0254>] (device_driver_attach) from [<c09b02dc>] (__driver_attach+0x80/0xbc) [<c09b02dc>] (__driver_attach) from [<c09ade00>] (bus_for_each_dev+0x68/0xb4) [<c09ade00>] (bus_for_each_dev) from [<c09aefd8>] (bus_add_driver+0x130/0x1e8) [<c09aefd8>] (bus_add_driver) from [<c09b0d64>] (driver_register+0x78/0x110) [<c09b0d64>] (driver_register) from [<bf038558>] (exynos_drm_init+0xe8/0x11c [exynosdrm]) [<bf038558>] (exynos_drm_init [exynosdrm]) from [<c0302fa8>] (do_one_initcall+0x50/0x220) [<c0302fa8>] (do_one_initcall) from [<c03dd02c>] (do_init_module+0x60/0x210) [<c03dd02c>] (do_init_module) from [<c03dbf44>] (load_module+0x1c0c/0x2310) [<c03dbf44>] (load_module) from [<c03dc85c>] (sys_finit_module+0xac/0xbc) [<c03dc85c>] (sys_finit_module) from [<c0301000>] (ret_fast_syscall+0x0/0x54) Exception stack(0xd979bfa8 to 0xd979bff0) ... ---[ end trace db16efe05faab470 ]---
--- drivers/gpu/drm/exynos/exynos_drm_dsi.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/gpu/drm/exynos/exynos_drm_dsi.c +4 -3
@@ -1766,9 +1766,10 @@ static int exynos_dsi_probe(struct platform_device *pdev) dsi->clks[i] =devm_clk_get (dev, clk_names[i]);if (IS_ERR (dsi->clks[i])) {if (strcmp (clk_names[i],"sclk_mipi" ) ==0 ) { -strcpy (clk_names[i],OLD_SCLK_MIPI_CLK_NAME ); - i--; -continue ; + dsi->clks[i] =devm_clk_get (dev, +OLD_SCLK_MIPI_CLK_NAME ); +if (!IS_ERR (dsi->clks[i])) +continue ; } dev_info(dev, "failed to get the clock: %s\n",
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 2/119 locks: reinstate locks_delete_block optimization
In reply to Greg Kroah-HartmanFrom: Linus Torvalds <[email protected]>
[ Upstream commit dcf23ac3e846ca0cf626c155a0e3fcbbcf4fae8a ]
There is measurable performance impact in some synthetic tests due to commit 6d390e4b5d48 (locks: fix a potential use-after-free problem when wakeup a waiter). Fix the race condition instead by clearing the fl_blocker pointer after the wake_up, using explicit acquire/release semantics.
This does mean that we can no longer use the clearing of fl_blocker as the wait condition, so switch the waiters over to checking whether the fl_blocked_member list_head is empty.
--- fs/cifs/file.c | 3 ++- fs/locks.c | 54 ++++++++++++++++++++++++++++++++++++++++++++------ 2 files changed, 50 insertions(+), 7 deletions(-)
fs/cifs/file.c +2 -1
@@ -1175,7 +1175,8 @@ cifs_posix_lock_set(struct file *file, struct file_lock *flock) rc =posix_lock_file (file, flock,NULL );up_write (&cinode->lock_sem);if (rc ==FILE_LOCK_DEFERRED ) { - rc =wait_event_interruptible (flock->fl_wait, !flock->fl_blocker); + rc =wait_event_interruptible (flock->fl_wait, +list_empty (&flock->fl_blocked_member));if (!rc) goto try_again;locks_delete_block (flock);
fs/locks.c +48 -6
107 lines not on this page · raw message
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 19/119 drm/exynos: hdmi: dont leak enable HDMI_EN regulator if probe fails
In reply to Greg Kroah-HartmanFrom: Marek Szyprowski <[email protected]>
[ Upstream commit 3b6a9b19ab652efac7ad4c392add6f1235019568 ]
Move enabling and disabling HDMI_EN optional regulator to probe() function to keep track on the regulator status. This fixes following warning if probe() fails (for example when I2C DDC adapter cannot be yet gathered due to the missing driver). This fixes following warning observed on Arndale5250 board with multi_v7_defconfig:
[drm] Failed to get ddc i2c adapter by node
------------[ cut here ]------------ WARNING: CPU: 0 PID: 214 at drivers/regulator/core.c:2051 _regulator_put+0x16c/0x184 Modules linked in: ... CPU: 0 PID: 214 Comm: systemd-udevd Not tainted 5.6.0-rc2-next-20200219-00040-g38af1dfafdbb #7570 Hardware name: Samsung Exynos (Flattened Device Tree) [<c0312258>] (unwind_backtrace) from [<c030cc10>] (show_stack+0x10/0x14) [<c030cc10>] (show_stack) from [<c0f0d3a0>] (dump_stack+0xcc/0xe0) [<c0f0d3a0>] (dump_stack) from [<c0346a58>] (__warn+0xe0/0xf8) [<c0346a58>] (__warn) from [<c0346b20>] (warn_slowpath_fmt+0xb0/0xb8) [<c0346b20>] (warn_slowpath_fmt) from [<c0893f58>] (_regulator_put+0x16c/0x184) [<c0893f58>] (_regulator_put) from [<c0893f8c>] (regulator_put+0x1c/0x2c) [<c0893f8c>] (regulator_put) from [<c09b2664>] (release_nodes+0x17c/0x200) [<c09b2664>] (release_nodes) from [<c09aebe8>] (really_probe+0x10c/0x350) [<c09aebe8>] (really_probe) from [<c09aefa8>] (driver_probe_device+0x60/0x1a0) [<c09aefa8>] (driver_probe_device) from [<c09af288>] (device_driver_attach+0x58/0x60) [<c09af288>] (device_driver_attach) from [<c09af310>] (__driver_attach+0x80/0xbc) [<c09af310>] (__driver_attach) from [<c09ace34>] (bus_for_each_dev+0x68/0xb4) [<c09ace34>] (bus_for_each_dev) from [<c09ae00c>] (bus_add_driver+0x130/0x1e8) [<c09ae00c>] (bus_add_driver) from [<c09afd98>] (driver_register+0x78/0x110) [<c09afd98>] (driver_register) from [<bf139558>] (exynos_drm_init+0xe8/0x11c [exynosdrm]) [<bf139558>] (exynos_drm_init [exynosdrm]) from [<c0302fa8>] (do_one_initcall+0x50/0x220) [<c0302fa8>] (do_one_initcall) from [<c03dc02c>] (do_init_module+0x60/0x210) [<c03dc02c>] (do_init_module) from [<c03daf44>] (load_module+0x1c0c/0x2310) [<c03daf44>] (load_module) from [<c03db85c>] (sys_finit_module+0xac/0xbc) [<c03db85c>] (sys_finit_module) from [<c0301000>] (ret_fast_syscall+0x0/0x54) Exception stack(0xecca3fa8 to 0xecca3ff0) ... ---[ end trace 276c91214635905c ]---
--- drivers/gpu/drm/exynos/exynos_hdmi.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-)
drivers/gpu/drm/exynos/exynos_hdmi.c +12 -10
@@ -1803,18 +1803,10 @@ static int hdmi_resources_init(struct hdmi_context *hdata) hdata->reg_hdmi_en =devm_regulator_get_optional (dev,"hdmi-en" ); -if (PTR_ERR (hdata->reg_hdmi_en) != -ENODEV ) { +if (PTR_ERR (hdata->reg_hdmi_en) != -ENODEV )if (IS_ERR (hdata->reg_hdmi_en))return PTR_ERR (hdata->reg_hdmi_en); - ret =regulator_enable (hdata->reg_hdmi_en); -if (ret) { -DRM_DEV_ERROR (dev, -"failed to enable hdmi-en regulator\n" ); -return ret; - } - } -return hdmi_bridge_init (hdata); }
@@ -2021,6 +2013,15 @@ static int hdmi_probe(struct platform_device *pdev) } } +if (!IS_ERR (hdata->reg_hdmi_en)) { + ret =regulator_enable (hdata->reg_hdmi_en); +if (ret) { +DRM_DEV_ERROR (dev, +"failed to enable hdmi-en regulator\n" ); + goto err_hdmiphy; + } + } +pm_runtime_enable (dev); audio_infoframe = &hdata->audio.infoframe;
@@ -2045,7 +2046,8 @@ static int hdmi_probe(struct platform_device *pdev) err_rpm_disable:pm_runtime_disable (dev); - +if (!IS_ERR (hdata->reg_hdmi_en)) +regulator_disable (hdata->reg_hdmi_en); err_hdmiphy:if (hdata->hdmiphy_port)put_device (&hdata->hdmiphy_port->dev);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 22/119 io-wq: fix IO_WQ_WORK_NO_CANCEL cancellation
In reply to Greg Kroah-HartmanFrom: Pavel Begunkov <[email protected]>
[ Upstream commit fc04c39bae01a607454f7619665309870c60937a ]
To cancel a work, io-wq sets IO_WQ_WORK_CANCEL and executes the callback. However, IO_WQ_WORK_NO_CANCEL works will just execute and may return next work, which will be ignored and lost.
Cancel the whole link.
--- fs/io-wq.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-)
fs/io-wq.c +14 -6
@@ -733,6 +733,17 @@ static bool io_wq_can_queue(struct io_wqe *wqe, struct io_wqe_acct *acct,return true; } +static void io_run_cancel (struct io_wq_work *work) +{ +do { +struct io_wq_work *old_work = work; + + work->flags |=IO_WQ_WORK_CANCEL ; + work->func (&work); + work = (work == old_work) ?NULL : work; + }while (work); +} +static void io_wqe_enqueue (struct io_wqe *wqe,struct io_wq_work *work) {struct io_wqe_acct *acct =io_work_get_acct (wqe, work);
@@ -745,8 +756,7 @@ static void io_wqe_enqueue(struct io_wqe *wqe, struct io_wq_work *work)* It's close enough to not be an issue, fork() has the same delay. */ if (unlikely (!io_wq_can_queue (wqe, acct, work))) { - work->flags |=IO_WQ_WORK_CANCEL ; - work->func (&work); +io_run_cancel (work);return ; }
@@ -882,8 +892,7 @@ static enum io_wq_cancel io_wqe_cancel_cb_work(struct io_wqe *wqe,spin_unlock_irqrestore (&wqe->lock, flags);if (found) { - work->flags |=IO_WQ_WORK_CANCEL ; - work->func (&work); +io_run_cancel (work);return IO_WQ_CANCEL_OK ; }
@@ -957,8 +966,7 @@ static enum io_wq_cancel io_wqe_cancel_work(struct io_wqe *wqe,spin_unlock_irqrestore (&wqe->lock, flags);if (found) { - work->flags |=IO_WQ_WORK_CANCEL ; - work->func (&work); +io_run_cancel (work);return IO_WQ_CANCEL_OK ; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 24/119 altera-stapl: altera_get_note: prevent write beyond end of key
In reply to Greg Kroah-HartmanFrom: Daniel Axtens <[email protected]>
[ Upstream commit 3745488e9d599916a0b40d45d3f30e3d4720288e ]
altera_get_note is called from altera_init, where key is kzalloc(33).
When the allocation functions are annotated to allow the compiler to see the sizes of objects, and with FORTIFY_SOURCE, we see:
In file included from drivers/misc/altera-stapl/altera.c:14:0:
In function ‘strlcpy’,
inlined from ‘altera_init’ at drivers/misc/altera-stapl/altera.c:2189:5:include/linux/string.h:378:4: error: call to ‘__write_overflow’ declared with attribute error: detected write beyond size of object passed as 1st parameter
__write_overflow();
^~~~~~~~~~~~~~~~~~That refers to this code in altera_get_note:
if (key != NULL)
strlcpy(key, &p[note_strings +
get_unaligned_be32(
&p[note_table + (8 * i)])],
length);The error triggers because the length of 'key' is 33, but the copy uses length supplied as the 'length' parameter, which is always
256. Split the size parameter into key_len and val_len, and use the appropriate length depending on what is being copied.
Detected by compiler error, only compile-tested.
--- drivers/misc/altera-stapl/altera.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/misc/altera-stapl/altera.c +6 -6
@@ -2112,8 +2112,8 @@ static int altera_execute(struct altera_state *astate,return status; } -static int altera_get_note (u8 *p,s32 program_size, -s32 *offset,char *key,char *value,int length) +static int altera_get_note (u8 *p,s32 program_size,s32 *offset, +char *key,char *value,int keylen,int vallen)/* * Gets key and value of NOTE fields in the JBC file. * Can be called in two modes: if offset pointer is NULL,
@@ -2170,7 +2170,7 @@ static int altera_get_note(u8 *p, s32 program_size, &p[note_table + (8 * i) + 4])];if (value !=NULL ) -strlcpy (value, value_ptr, length); +strlcpy (value, value_ptr, vallen); } }
@@ -2189,13 +2189,13 @@ static int altera_get_note(u8 *p, s32 program_size,strlcpy (key, &p[note_strings +get_unaligned_be32 ( &p[note_table + (8 * i)])], - length); + keylen);if (value !=NULL )strlcpy (value, &p[note_strings +get_unaligned_be32 ( &p[note_table + (8 * i) +4 ])], - length); + vallen); *offset = i +1 ; }
@@ -2449,7 +2449,7 @@ int altera_init(struct altera_config *config, const struct firmware *fw) __func__, (format_version ==2 ) ?"Jam STAPL" : "pre-standardized Jam 1.1");while (altera_get_note ((u8 *)fw->data, fw->size, - &offset, key, value,256 ) ==0 ) + &offset, key, value,32 ,256 ) ==0 )printk (KERN_INFO "%s: NOTE \"%s\" = \"%s\"\n" , __func__, key, value); }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 23/119 ARM: bcm2835_defconfig: Explicitly restore CONFIG_DEBUG_FS
In reply to Greg Kroah-HartmanFrom: Stefan Wahren <[email protected]>
[ Upstream commit 1bba60808404b873defa0f3560497eb2e8fe86b8 ]
The commit 0e4a459f56c3 ("tracing: Remove unnecessary DEBUG_FS dependency") accidentally dropped the DEBUG FS support in bcm2835_defconfig. So restore the config as before the commit.
--- arch/arm/configs/bcm2835_defconfig | 1 + 1 file changed, 1 insertion(+)
arch/arm/configs/bcm2835_defconfig +1 -0
@@ -178,6 +178,7 @@ CONFIG_SCHED_TRACER=y CONFIG_STACK_TRACER=y CONFIG_FUNCTION_PROFILER=y CONFIG_TEST_KSTRTOX=y +CONFIG_DEBUG_FS=y CONFIG_KGDB=y CONFIG_KGDB_KDB=y CONFIG_STRICT_DEVMEM=y
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 25/119 dm bio record: save/restore bi_end_io and bi_integrity
In reply to Greg Kroah-HartmanFrom: Mike Snitzer <[email protected]>
[ Upstream commit 1b17159e52bb31f982f82a6278acd7fab1d3f67b ]
Also, save/restore __bi_remaining in case the bio was used in a BIO_CHAIN (e.g. due to blk_queue_split).
--- drivers/md/dm-bio-record.h | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
drivers/md/dm-bio-record.h +15 -0
@@ -20,8 +20,13 @@struct dm_bio_details {struct gendisk *bi_disk;u8 bi_partno; +int __bi_remaining;unsigned long bi_flags;struct bvec_iter bi_iter; +bio_end_io_t *bi_end_io; +#if defined(CONFIG_BLK_DEV_INTEGRITY ) +struct bio_integrity_payload *bi_integrity; +#endif };static inline void dm_bio_record (struct dm_bio_details *bd,struct bio *bio)
@@ -30,6 +35,11 @@ static inline void dm_bio_record(struct dm_bio_details *bd, struct bio *bio) bd->bi_partno = bio->bi_partno; bd->bi_flags = bio->bi_flags; bd->bi_iter = bio->bi_iter; + bd->__bi_remaining =atomic_read (&bio->__bi_remaining); + bd->bi_end_io = bio->bi_end_io; +#if defined(CONFIG_BLK_DEV_INTEGRITY ) + bd->bi_integrity =bio_integrity (bio); +#endif }static inline void dm_bio_restore (struct dm_bio_details *bd,struct bio *bio)
@@ -38,6 +48,11 @@ static inline void dm_bio_restore(struct dm_bio_details *bd, struct bio *bio) bio->bi_partno = bd->bi_partno; bio->bi_flags = bd->bi_flags; bio->bi_iter = bd->bi_iter; +atomic_set (&bio->__bi_remaining, bd->__bi_remaining); + bio->bi_end_io = bd->bi_end_io; +#if defined(CONFIG_BLK_DEV_INTEGRITY ) + bio->bi_integrity = bd->bi_integrity; +#endif }#endif
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 26/119 dm integrity: use dm_bio_record and dm_bio_restore
In reply to Greg Kroah-HartmanFrom: Mike Snitzer <[email protected]>
[ Upstream commit 248aa2645aa7fc9175d1107c2593cc90d4af5a4e ]
In cases where dec_in_flight() has to requeue the integrity_bio_wait work to transfer the rest of the data, the bio's __bi_remaining might already have been decremented to 0, e.g.: if bio passed to underlying data device was split via blk_queue_split().
Use dm_bio_{record,restore} rather than effectively open-coding them in dm-integrity -- these methods now manage __bi_remaining too.
Depends-on: f7f0b057a9c1 ("dm bio record: save/restore bi_end_io and bi_integrity")
--- drivers/md/dm-integrity.c | 32 +++++++++----------------------- 1 file changed, 9 insertions(+), 23 deletions(-)
drivers/md/dm-integrity.c +9 -23
@@ -6,6 +6,8 @@* This file is released under the GPL. */ +#include "dm-bio-record.h" +#include <linux/compiler.h> #include <linux/module.h> #include <linux/device-mapper.h>
@@ -295,11 +297,7 @@ struct dm_integrity_io {struct completion *completion; -struct gendisk *orig_bi_disk; -u8 orig_bi_partno; -bio_end_io_t *orig_bi_end_io; -struct bio_integrity_payload *orig_bi_integrity; -struct bvec_iter orig_bi_iter; +struct dm_bio_details bio_details; };struct journal_completion {
@@ -1452,14 +1450,9 @@ static void integrity_end_io(struct bio *bio) {struct dm_integrity_io *dio =dm_per_bio_data (bio,sizeof (struct dm_integrity_io )); - bio->bi_iter = dio->orig_bi_iter; - bio->bi_disk = dio->orig_bi_disk; - bio->bi_partno = dio->orig_bi_partno; -if (dio->orig_bi_integrity) { - bio->bi_integrity = dio->orig_bi_integrity; +dm_bio_restore (&dio->bio_details, bio); +if (bio->bi_integrity) bio->bi_opf |=REQ_INTEGRITY ; - } - bio->bi_end_io = dio->orig_bi_end_io;if (dio->completion)complete (dio->completion);
@@ -1544,7 +1537,7 @@ static void integrity_metadata(struct work_struct *w) } } -__bio_for_each_segment (bv, bio, iter, dio->orig_bi_iter) { +__bio_for_each_segment (bv, bio, iter, dio->bio_details.bi_iter) {unsigned pos;char *mem, *checksums_ptr;
@@ -1588,7 +1581,7 @@ static void integrity_metadata(struct work_struct *w)if (likely (checksums != checksums_onstack))kfree (checksums); }else { -struct bio_integrity_payload *bip = dio->orig_bi_integrity; +struct bio_integrity_payload *bip = dio->bio_details.bi_integrity;if (bip) {struct bio_vec biv;
@@ -2007,20 +2000,13 @@ static void dm_integrity_map_continue(struct dm_integrity_io *dio, bool from_map }else dio->completion =NULL ; - dio->orig_bi_iter = bio->bi_iter; - - dio->orig_bi_disk = bio->bi_disk; - dio->orig_bi_partno = bio->bi_partno; +dm_bio_record (&dio->bio_details, bio);bio_set_dev (bio, ic->dev->bdev); - - dio->orig_bi_integrity =bio_integrity (bio); bio->bi_integrity =NULL ; bio->bi_opf &= ~REQ_INTEGRITY ; - - dio->orig_bi_end_io = bio->bi_end_io; bio->bi_end_io = integrity_end_io; - bio->bi_iter.bi_size = dio->range.n_sectors <<SECTOR_SHIFT ; +generic_make_request (bio);if (need_sync_io) {
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 27/119 riscv: avoid the PIC offset of static percpu data in module beyond 2G limits
In reply to Greg Kroah-HartmanFrom: Vincent Chen <[email protected]>
[ Upstream commit 0cff8bff7af886af0923d5c91776cd51603e531f ]
The compiler uses the PIC-relative method to access static variables instead of GOT when the code model is PIC. Therefore, the limitation of the access range from the instruction to the symbol address is +-2GB. Under this circumstance, the kernel cannot load a kernel module if this module has static per-CPU symbols declared by DEFINE_PER_CPU(). The reason is that kernel relocates the .data..percpu section of the kernel module to the end of kernel's .data..percpu. Hence, the distance between the per-CPU symbols and the instruction will exceed the 2GB limits. To solve this problem, the kernel should place the loaded module in the memory area [&_end-2G, VMALLOC_END].
--- arch/riscv/kernel/module.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
arch/riscv/kernel/module.c +16 -0
@@ -8,6 +8,10 @@#include <linux/err.h> #include <linux/errno.h> #include <linux/moduleloader.h> +#include <linux/vmalloc.h> +#include <linux/sizes.h> +#include <asm/pgtable.h> +#include <asm/sections.h> static int apply_r_riscv_32_rela (struct module *me,u32 *location,Elf_Addr v) {
@@ -386,3 +390,15 @@ int apply_relocate_add(Elf_Shdr *sechdrs, const char *strtab,return 0 ; } + +#if defined(CONFIG_MMU ) && defined(CONFIG_64BIT ) +#define VMALLOC_MODULE_START \ + max(PFN_ALIGN((unsigned long)&_end - SZ_2G), VMALLOC_START) +void *module_alloc (unsigned long size) +{ +return __vmalloc_node_range (size,1 ,VMALLOC_MODULE_START , +VMALLOC_END ,GFP_KERNEL , +PAGE_KERNEL_EXEC ,0 ,NUMA_NO_NODE , +__builtin_return_address (0 )); +} +#endif
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 28/119 ASoC: stm32: sai: manage rebind issue
In reply to Greg Kroah-HartmanFrom: Olivier Moysan <[email protected]>
[ Upstream commit 0d6defc7e0e437a9fd53622f7fd85740f38d5693 ]
The commit e894efef9ac7 ("ASoC: core: add support to card rebind") allows to rebind the sound card after a rebind of one of its component. With this commit, the sound card is actually rebound,
but may be no more functional. The following problems have been seen with STM32 SAI driver.
1) DMA channel is not requested:
With the sound card rebind the simplified call sequence is:stm32_sai_sub_probe
snd_soc_register_component
snd_soc_try_rebind_card
snd_soc_instantiate_card
devm_snd_dmaengine_pcm_register
The problem occurs because the pcm must be registered, before snd_soc_instantiate_card() is called.
Modify SAI driver, to change the call sequence as follows:stm32_sai_sub_probe
devm_snd_dmaengine_pcm_register snd_soc_register_component
snd_soc_try_rebind_card
2) DMA channel is not released:
dma_release_channel() is not called when devm_dmaengine_pcm_release() is executed.
This occurs because SND_DMAENGINE_PCM_DRV_NAME component, has already been released through devm_component_release().
devm_dmaengine_pcm_release() should be called before devm_component_release() to avoid this problem.
Call snd_dmaengine_pcm_unregister() and snd_soc_unregister_component() explicitly from SAI driver, to have the right sequence.
Message-Id: <[email protected]>
--- sound/soc/stm/stm32_sai_sub.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-)
sound/soc/stm/stm32_sai_sub.c +10 -8
@@ -1543,20 +1543,20 @@ static int stm32_sai_sub_probe(struct platform_device *pdev)return ret; } - ret =devm_snd_soc_register_component (&pdev->dev, &stm32_component, - &sai->cpu_dai_drv,1 ); + ret =snd_dmaengine_pcm_register (&pdev->dev, conf,0 ); +if (ret) { +dev_err (&pdev->dev,"Could not register pcm dma\n" ); +return ret; + } + + ret =snd_soc_register_component (&pdev->dev, &stm32_component, + &sai->cpu_dai_drv,1 );if (ret)return ret;if (STM_SAI_PROTOCOL_IS_SPDIF (sai)) conf = &stm32_sai_pcm_config_spdif; - ret =devm_snd_dmaengine_pcm_register (&pdev->dev, conf,0 ); -if (ret) { -dev_err (&pdev->dev,"Could not register pcm dma\n" ); -return ret; - } -return 0 ; }
@@ -1565,6 +1565,8 @@ static int stm32_sai_sub_remove(struct platform_device *pdev)struct stm32_sai_sub_data *sai =dev_get_drvdata (&pdev->dev);clk_unprepare (sai->pdata->pclk); +snd_dmaengine_pcm_unregister (&pdev->dev); +snd_soc_unregister_component (&pdev->dev);return 0 ; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 29/119 spi: spi_register_controller(): free bus id on error paths
In reply to Greg Kroah-HartmanFrom: Aaro Koskinen <[email protected]>
[ Upstream commit f9981d4f50b475d7dbb70f3022b87a3c8bba9fd6 ]
Some error paths leave the bus id allocated. As a result the IDR allocation will fail after a deferred probe. Fix by freeing the bus id always on error.
Message-Id: <[email protected]>
--- drivers/spi/spi.c | 32 +++++++++++++++----------------- 1 file changed, 15 insertions(+), 17 deletions(-)
drivers/spi/spi.c +15 -17
@@ -2615,7 +2615,7 @@ int spi_register_controller(struct spi_controller *ctlr)if (ctlr->use_gpio_descriptors) { status =spi_get_gpio_descs (ctlr);if (status) -return status; + goto free_bus_id;/* * A controller using GPIO descriptors always * supports SPI_CS_HIGH if need be.
@@ -2625,7 +2625,7 @@ int spi_register_controller(struct spi_controller *ctlr)/* Legacy code path for GPIOs from DT */ status =of_spi_get_gpio_numbers (ctlr);if (status) -return status; + goto free_bus_id; } }
@@ -2633,17 +2633,14 @@ int spi_register_controller(struct spi_controller *ctlr)* Even if it's just one always-selected device, there must * be at least one chipselect. */ -if (!ctlr->num_chipselect) -return -EINVAL ; +if (!ctlr->num_chipselect) { + status = -EINVAL ; + goto free_bus_id; + } status =device_add (&ctlr->dev); -if (status <0 ) { -/* free bus id */ -mutex_lock (&board_lock); -idr_remove (&spi_master_idr, ctlr->bus_num); -mutex_unlock (&board_lock); - goto done; - } +if (status <0 ) + goto free_bus_id;dev_dbg (dev,"registered %s %s\n" ,spi_controller_is_slave (ctlr) ?"slave" :"master" ,dev_name (&ctlr->dev));
@@ -2659,11 +2656,7 @@ int spi_register_controller(struct spi_controller *ctlr) status =spi_controller_initialize_queue (ctlr);if (status) {device_del (&ctlr->dev); -/* free bus id */ -mutex_lock (&board_lock); -idr_remove (&spi_master_idr, ctlr->bus_num); -mutex_unlock (&board_lock); - goto done; + goto free_bus_id; } }/* add statistics */
@@ -2678,7 +2671,12 @@ int spi_register_controller(struct spi_controller *ctlr)/* Register devices from the device tree and ACPI */ of_register_spi_devices (ctlr);acpi_register_spi_devices (ctlr); -done: +return status; + +free_bus_id: +mutex_lock (&board_lock); +idr_remove (&spi_master_idr, ctlr->bus_num); +mutex_unlock (&board_lock);return status; }EXPORT_SYMBOL_GPL (spi_register_controller);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 30/119 riscv: Force flat memory model with no-mmu
In reply to Greg Kroah-HartmanFrom: Damien Le Moal <[email protected]>
[ Upstream commit aa2734202acc506d09c8e641db4da161f902df27 ]
Compilation errors trigger if ARCH_SPARSEMEM_ENABLE is enabled for a nommu kernel. Since the sparsemem model does not make sense anyway for the nommu case, do not allow selecting this option to always use the flatmem model.
--- arch/riscv/Kconfig | 1 + 1 file changed, 1 insertion(+)
arch/riscv/Kconfig +1 -0
@@ -121,6 +121,7 @@ config ARCH_FLATMEM_ENABLE config ARCH_SPARSEMEM_ENABLE def_bool y + depends on MMU select SPARSEMEM_VMEMMAP_ENABLE config ARCH_SELECT_MEMORY_MODEL
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 3/119 spi: spi-omap2-mcspi: Support probe deferral for DMA channels
In reply to Greg Kroah-HartmanFrom: Vignesh Raghavendra <[email protected]>
[ Upstream commit 32f2fc5dc3992b4b60cc6b1a6a31be605cc9c3a2 ]
dma_request_channel() can return -EPROBE_DEFER, if DMA driver is not ready. Currently driver just falls back to PIO mode on probe deferral. Fix this by requesting all required channels during probe and propagating EPROBE_DEFER error code.
--- drivers/spi/spi-omap2-mcspi.c | 77 ++++++++++++++++++++---------------------- 1 file changed, 38 insertions(+), 39 deletions(-)
drivers/spi/spi-omap2-mcspi.c +38 -39
@@ -974,20 +974,12 @@ static int omap2_mcspi_setup_transfer(st* Note that we currently allow DMA only if we get a channel * for both rx and tx. Otherwise we'll do PIO for both rx and tx. */ -static int omap2_mcspi_request_dma (struct spi_device *spi) +static int omap2_mcspi_request_dma (struct omap2_mcspi *mcspi, +struct omap2_mcspi_dma *mcspi_dma) { -struct spi_master *master = spi->master; -struct omap2_mcspi *mcspi; -struct omap2_mcspi_dma *mcspi_dma;int ret =0 ; - mcspi =spi_master_get_devdata (master); - mcspi_dma = mcspi->dma_channels + spi->chip_select; - -init_completion (&mcspi_dma->dma_rx_completion); -init_completion (&mcspi_dma->dma_tx_completion); - - mcspi_dma->dma_rx =dma_request_chan (&master->dev, + mcspi_dma->dma_rx =dma_request_chan (mcspi->dev, mcspi_dma->dma_rx_ch_name);if (IS_ERR (mcspi_dma->dma_rx)) { ret =PTR_ERR (mcspi_dma->dma_rx);
@@ -995,7 +987,7 @@ static int omap2_mcspi_request_dma(struc goto no_dma; } - mcspi_dma->dma_tx =dma_request_chan (&master->dev, + mcspi_dma->dma_tx =dma_request_chan (mcspi->dev, mcspi_dma->dma_tx_ch_name);if (IS_ERR (mcspi_dma->dma_tx)) { ret =PTR_ERR (mcspi_dma->dma_tx);
@@ -1004,20 +996,40 @@ static int omap2_mcspi_request_dma(struc mcspi_dma->dma_rx =NULL ; } +init_completion (&mcspi_dma->dma_rx_completion); +init_completion (&mcspi_dma->dma_tx_completion); + no_dma:return ret; } +static void omap2_mcspi_release_dma (struct spi_master *master) +{ +struct omap2_mcspi *mcspi =spi_master_get_devdata (master); +struct omap2_mcspi_dma *mcspi_dma; +int i; + +for (i =0 ; i < master->num_chipselect; i++) { + mcspi_dma = &mcspi->dma_channels[i]; + +if (mcspi_dma->dma_rx) { +dma_release_channel (mcspi_dma->dma_rx); + mcspi_dma->dma_rx =NULL ; + } +if (mcspi_dma->dma_tx) { +dma_release_channel (mcspi_dma->dma_tx); + mcspi_dma->dma_tx =NULL ; + } + } +} +static int omap2_mcspi_setup (struct spi_device *spi) {int ret;struct omap2_mcspi *mcspi =spi_master_get_devdata (spi->master);struct omap2_mcspi_regs *ctx = &mcspi->ctx; -struct omap2_mcspi_dma *mcspi_dma;struct omap2_mcspi_cs *cs = spi->controller_state; - mcspi_dma = &mcspi->dma_channels[spi->chip_select]; -if (!cs) { cs =kzalloc (sizeof *cs,GFP_KERNEL );if (!cs)
@@ -1042,13 +1054,6 @@ static int omap2_mcspi_setup(struct spi_ } } -if (!mcspi_dma->dma_rx || !mcspi_dma->dma_tx) { - ret =omap2_mcspi_request_dma (spi); -if (ret) -dev_warn (&spi->dev,"not using DMA for McSPI (%d)\n" , - ret); - } - ret =pm_runtime_get_sync (mcspi->dev);if (ret <0 ) {pm_runtime_put_noidle (mcspi->dev);
@@ -1065,12 +1070,8 @@ static int omap2_mcspi_setup(struct spi_static void omap2_mcspi_cleanup (struct spi_device *spi) { -struct omap2_mcspi *mcspi; -struct omap2_mcspi_dma *mcspi_dma;struct omap2_mcspi_cs *cs; - mcspi =spi_master_get_devdata (spi->master); -if (spi->controller_state) {/* Unlink controller state from context save list */ cs = spi->controller_state;
@@ -1079,19 +1080,6 @@ static void omap2_mcspi_cleanup(struct skfree (cs); } -if (spi->chip_select < spi->master->num_chipselect) { - mcspi_dma = &mcspi->dma_channels[spi->chip_select]; - -if (mcspi_dma->dma_rx) { -dma_release_channel (mcspi_dma->dma_rx); - mcspi_dma->dma_rx =NULL ; - } -if (mcspi_dma->dma_tx) { -dma_release_channel (mcspi_dma->dma_tx); - mcspi_dma->dma_tx =NULL ; - } - } -if (gpio_is_valid (spi->cs_gpio))gpio_free (spi->cs_gpio); }
@@ -1302,6 +1290,9 @@ static bool omap2_mcspi_can_dma(struct sif (spi_controller_is_slave (master))return true; + master->dma_rx = mcspi_dma->dma_rx; + master->dma_tx = mcspi_dma->dma_tx; +return (xfer->len >=DMA_MIN_BYTES ); }
@@ -1464,6 +1455,11 @@ static int omap2_mcspi_probe(struct platfor (i =0 ; i < master->num_chipselect; i++) {sprintf (mcspi->dma_channels[i].dma_rx_ch_name,"rx%d" , i);sprintf (mcspi->dma_channels[i].dma_tx_ch_name,"tx%d" , i); + + status =omap2_mcspi_request_dma (mcspi, + &mcspi->dma_channels[i]); +if (status == -EPROBE_DEFER ) + goto free_master; } status =platform_get_irq (pdev,0 );
@@ -1501,6 +1497,7 @@ disable_pm:pm_runtime_put_sync (&pdev->dev);pm_runtime_disable (&pdev->dev); free_master: +omap2_mcspi_release_dma (master);spi_master_put (master);return status; }
@@ -1510,6 +1507,8 @@ static int omap2_mcspi_remove(struct plastruct spi_master *master =platform_get_drvdata (pdev);struct omap2_mcspi *mcspi =spi_master_get_devdata (master); +omap2_mcspi_release_dma (master); +pm_runtime_dont_use_autosuspend (mcspi->dev);pm_runtime_put_sync (mcspi->dev);pm_runtime_disable (&pdev->dev);
Greg Kroah-Hartman
maintainerPATCH 31/119 riscv: Fix range looking for kernel image memblock
In reply to Greg Kroah-HartmanFrom: Alexandre Ghiti <[email protected]>
[ Upstream commit a160eed4b783d7b250a32f7e5787c9867abc5686 ]
When looking for the memblock where the kernel lives, we should check that the memory range associated to the memblock entirely comprises the kernel image and not only intersects with it.
--- arch/riscv/mm/init.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/riscv/mm/init.c +1 -1
@@ -131,7 +131,7 @@ void __init setup_bootmem(void)for_each_memblock (memory, reg) {phys_addr_t end = reg->base + reg->size; -if (reg->base <= vmlinux_end && vmlinux_end <= end) { +if (reg->base <= vmlinux_start && vmlinux_end <= end) { mem_size =min (reg->size, (phys_addr_t)-PAGE_OFFSET );/*
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 32/119 drm/amdgpu: clean wptr on wb when gpu recovery
In reply to Greg Kroah-HartmanFrom: Yintian Tao <[email protected]>
[ Upstream commit 2ab7e274b86739f4ceed5d94b6879f2d07b2802f ]
The TDR will be randomly failed due to compute ring
test failure. If the compute ring wptr & 0x7ff(ring_buf_mask) is 0x100 then after map mqd the compute ring rptr will be synced with 0x100. And the ring test packet size is also 0x100. Then after invocation of amdgpu_ring_commit, the cp will not really handle the packet on the ring buffer because rptr is equal to wptr.
--- drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 1 + drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 1 + 2 files changed, 2 insertions(+)
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +1 -0
@@ -3496,6 +3496,7 @@ static int gfx_v10_0_kcq_init_queue(struct amdgpu_ring *ring)/* reset ring buffer */ ring->wptr =0 ; +atomic64_set ((atomic64_t *)&adev->wb.wb[ring->wptr_offs],0 );amdgpu_ring_clear_ring (ring); }else {amdgpu_ring_clear_ring (ring);
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +1 -0
@@ -3538,6 +3538,7 @@ static int gfx_v9_0_kcq_init_queue(struct amdgpu_ring *ring)/* reset ring buffer */ ring->wptr =0 ; +atomic64_set ((atomic64_t *)&adev->wb.wb[ring->wptr_offs],0 );amdgpu_ring_clear_ring (ring); }else {amdgpu_ring_clear_ring (ring);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 33/119 drm/amd/display: Clear link settings on MST disable connector
In reply to Greg Kroah-HartmanFrom: Bhawanpreet Lakha <[email protected]>
[ Upstream commit 5ac7fd2f597b88ee81f4748ee50cab06192a8dc3 ]
[Why]
If we have a single MST display and we disconnect it, we dont disable that link. This causes the old link settings to still exist
Now on a replug for MST we think its a link loss and will try to reallocate mst payload which will fail, throwing warning below.
[ 129.374192] [drm] Failed to updateMST allocation table forpipe idx:0 [ 129.374206] ------------[ cut here ]------------ [ 129.374284] WARNING: CPU: 14 PID: 1710 at
drivers/gpu/drm/amd/amdgpu/../dal-dev/dc/core/dc_link.c:3153 dc_link_allocate_mst_payload+0x1f7/0x220 [amdgpu]
[ 129.374285] Modules linked in: amdgpu(OE) amd_iommu_v2 gpu_sched ttm
drm_kms_helper drm fb_sys_fops syscopyarea sysfillrect sysimgblt binfmt_misc nls_iso8859_1 edac_mce_amd snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio kvm snd_hda_codec_hdmi snd_hda_intel snd_intel_nhlt snd_hda_codec irqbypass snd_hda_core snd_hwdep snd_pcm snd_seq_midi snd_seq_midi_event snd_rawmidi crct10dif_pclmul snd_seq crc32_pclmul ghash_clmulni_intel snd_seq_device snd_timer snd aesni_intel eeepc_wmi crypto_simd asus_wmi joydev cryptd sparse_keymap input_leds soundcore video glue_helper wmi_bmof mxm_wmi k10temp ccp mac_hid sch_fq_codel parport_pc ppdev lp parport ip_tables x_tables autofs4 hid_generic usbhid hid igb i2c_algo_bit ahci dca i2c_piix4 libahci gpio_amdpt wmi gpio_generic
[ 129.374318] CPU: 14 PID: 1710 Comm: kworker/14:2 Tainted: G W OE 5.4.0-rc7bhawan+ #480 [ 129.374318] Hardware name: System manufacturer System Product Name/PRIME X370-PRO, BIOS 0515 03/30/2017 [ 129.374397] Workqueue: events dm_irq_work_func [amdgpu] [ 129.374468] RIP: 0010:dc_link_allocate_mst_payload+0x1f7/0x220 [amdgpu] [ 129.374470] Code: 52 20 e8 1c 63 ad f4 48 8b 5d d0 65 48 33 1c 25 28 00 00 00 b8 01 00 00 00 75 16 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 <0f> 0b e9 fa fe ff ff e8 ed 5b d6 f3 41 0f b6 b6 c4 02 00 00 48 c7 [ 129.374471] RSP: 0018:ffff9f9141e7fcc0 EFLAGS: 00010246 [ 129.374472] RAX: 0000000000000000 RBX: ffff91ef0762f800 RCX: 0000000000000000 [ 129.374473] RDX: 0000000000000005 RSI: ffffffffc0c4a988 RDI: 0000000000000004 [ 129.374474] RBP: ffff9f9141e7fd10 R08: 0000000000000005 R09: 0000000000000000 [ 129.374475] R10: 0000000000000002 R11: 0000000000000001 R12: ffff91eebd510c00 [ 129.374475] R13: ffff91eebd510e58 R14: ffff91ef052c01b8 R15: 0000000000000006 [ 129.374476] FS: 0000000000000000(0000) GS:ffff91ef0ef80000(0000) knlGS:0000000000000000 [ 129.374477] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 129.374478] CR2: 000055623ea01d50 CR3: 0000000408a8c000 CR4: 00000000003406e0 [ 129.374479] Call Trace: [ 129.374550] dc_link_reallocate_mst_payload+0x12e/0x150 [amdgpu] [ 129.374617] dc_link_handle_hpd_rx_irq+0x6d4/0x6e0 [amdgpu] [ 129.374693] handle_hpd_rx_irq+0x77/0x310 [amdgpu] [ 129.374768] dm_irq_work_func+0x53/0x70 [amdgpu] [ 129.374774] process_one_work+0x1fd/0x3f0 [ 129.374776] worker_thread+0x255/0x410 [ 129.374778] kthread+0x121/0x140 [ 129.374780] ? process_one_work+0x3f0/0x3f0 [ 129.374781] ? kthread_park+0x90/0x90 [ 129.374785] ret_from_fork+0x22/0x40
[How]
when we disable MST we should clear the cur link settings (lane_count=0 is good enough). This will cause us to not reallocate payloads earlier than expected and not throw the warning
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c +1 -0
@@ -382,6 +382,7 @@ static void dm_dp_destroy_mst_connector(struct drm_dp_mst_topology_mgr *mgr, aconnector->dc_sink);dc_sink_release (aconnector->dc_sink); aconnector->dc_sink =NULL ; + aconnector->dc_link->cur_link_settings.lane_count =0 ; }drm_connector_unregister (connector);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 34/119 drm/amd/display: fix dcc swath size calculations on dcn1
In reply to Greg Kroah-HartmanFrom: Josip Pavic <[email protected]>
[ Upstream commit a0275dfc82c9034eefbeffd556cca6dd239d7925 ]
[Why]
Swath sizes are being calculated incorrectly. The horizontal swath size should be the product of block height, viewport width, and bytes per element, but the calculation uses viewport height instead of width. The vertical swath size is similarly incorrectly calculated. The effect of this is that we report the wrong DCC caps.
[How]
Use viewport width in the horizontal swath size calculation and viewport height in the vertical swath size calculation.
--- drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubbub.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubbub.c +2 -2
@@ -840,8 +840,8 @@ static void hubbub1_det_request_size(hubbub1_get_blk256_size (&blk256_width, &blk256_height, bpe); - swath_bytes_horz_wc = height * blk256_height * bpe; - swath_bytes_vert_wc = width * blk256_width * bpe; + swath_bytes_horz_wc = width * blk256_height * bpe; + swath_bytes_vert_wc = height * blk256_width * bpe; *req128_horz_wc = (2 * swath_bytes_horz_wc <= detile_buf_size) ? false : /* full 256B request */
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 35/119 xenbus: req->body should be updated before req->state
In reply to Greg Kroah-HartmanFrom: Dongli Zhang <[email protected]>
[ Upstream commit 1b6a51e86cce38cf4d48ce9c242120283ae2f603 ]
The req->body should be updated before req->state is updated and the order should be guaranteed by a barrier.
Otherwise, read_reply() might return req->body = NULL.
Below is sample callstack when the issue is reproduced on purpose by reordering the updates of req->body and req->state and adding delay in code between updates of req->state and req->body.
[ 22.356105] general protection fault: 0000 [#1] SMP PTI [ 22.361185] CPU: 2 PID: 52 Comm: xenwatch Not tainted 5.5.0xen+ #6 [ 22.366727] Hardware name: Xen HVM domU, BIOS ... [ 22.372245] RIP: 0010:_parse_integer_fixup_radix+0x6/0x60 ... ... [ 22.392163] RSP: 0018:ffffb2d64023fdf0 EFLAGS: 00010246 [ 22.395933] RAX: 0000000000000000 RBX: 75746e7562755f6d RCX: 0000000000000000 [ 22.400871] RDX: 0000000000000000 RSI: ffffb2d64023fdfc RDI: 75746e7562755f6d [ 22.405874] RBP: 0000000000000000 R08: 00000000000001e8 R09: 0000000000cdcdcd [ 22.410945] R10: ffffb2d6402ffe00 R11: ffff9d95395eaeb0 R12: ffff9d9535935000 [ 22.417613] R13: ffff9d9526d4a000 R14: ffff9d9526f4f340 R15: ffff9d9537654000 [ 22.423726] FS: 0000000000000000(0000) GS:ffff9d953bc80000(0000) knlGS:0000000000000000 [ 22.429898] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 22.434342] CR2: 000000c4206a9000 CR3: 00000001ea3fc002 CR4: 00000000001606e0 [ 22.439645] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 22.444941] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 22.450342] Call Trace: [ 22.452509] simple_strtoull+0x27/0x70 [ 22.455572] xenbus_transaction_start+0x31/0x50 [ 22.459104] netback_changed+0x76c/0xcc1 [xen_netfront] [ 22.463279] ? find_watch+0x40/0x40 [ 22.466156] xenwatch_thread+0xb4/0x150 [ 22.469309] ? wait_woken+0x80/0x80 [ 22.472198] kthread+0x10e/0x130 [ 22.474925] ? kthread_park+0x80/0x80 [ 22.477946] ret_from_fork+0x35/0x40 [ 22.480968] Modules linked in: xen_kbdfront xen_fbfront(+) xen_netfront xen_blkfront [ 22.486783] ---[ end trace a9222030a747c3f7 ]--- [ 22.490424] RIP: 0010:_parse_integer_fixup_radix+0x6/0x60
The virt_rmb() is added in the 'true' path of test_reply(). The "while" is changed to "do while" so that test_reply() is used as a read memory barrier.
--- drivers/xen/xenbus/xenbus_comms.c | 2 ++ drivers/xen/xenbus/xenbus_xs.c | 9 ++++++--- 2 files changed, 8 insertions(+), 3 deletions(-)
drivers/xen/xenbus/xenbus_comms.c +2 -0
@@ -313,6 +313,8 @@ static int process_msg(void) req->msg.type = state.msg.type; req->msg.len = state.msg.len; req->body = state.body; +/* write body, then update state */ +virt_wmb (); req->state = xb_req_state_got_reply; req->cb (req); }else
drivers/xen/xenbus/xenbus_xs.c +6 -3
@@ -191,8 +191,11 @@ static bool xenbus_ok(void)static bool test_reply (struct xb_req_data *req) { -if (req->state == xb_req_state_got_reply || !xenbus_ok ()) +if (req->state == xb_req_state_got_reply || !xenbus_ok ()) { +/* read req->state before all other fields */ +virt_rmb ();return true; + }/* Make sure to reread req->state each time. */ barrier ();
@@ -202,7 +205,7 @@ static bool test_reply(struct xb_req_data *req)static void *read_reply (struct xb_req_data *req) { -while (req->state != xb_req_state_got_reply) { + do { wait_event(req->wq, test_reply(req)); if (!xenbus_ok())
@@ -216,7 +219,7 @@ static void *read_reply(struct xb_req_data *req)if (req->err)return ERR_PTR (req->err); - } + }while (req->state != xb_req_state_got_reply);return req->body; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 36/119 xenbus: req->err should be updated before req->state
In reply to Greg Kroah-HartmanFrom: Dongli Zhang <[email protected]>
[ Upstream commit 8130b9d5b5abf26f9927b487c15319a187775f34 ]
This patch adds the barrier to guarantee that req->err is always updated before req->state.
Otherwise, read_reply() would not return ERR_PTR(req->err) but req->body, when process_writes()->xb_write() is failed.
--- drivers/xen/xenbus/xenbus_comms.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/xen/xenbus/xenbus_comms.c +2 -0
@@ -397,6 +397,8 @@ static int process_writes(void)if (state.req->state == xb_req_state_aborted)kfree (state.req);else { +/* write err, then update state */ +virt_wmb (); state.req->state = xb_req_state_got_reply;wake_up (&state.req->wq); }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 37/119 riscv: fix seccomp reject syscall code path
In reply to Greg Kroah-HartmanFrom: Tycho Andersen <[email protected]>
[ Upstream commit af33d2433b03d63ed31fcfda842f46676a5e1afc ]
If secure_computing() rejected a system call, we were previously setting the system call number to -1, to indicate to later code that the syscall failed. However, if something (e.g. a user notification) was sleeping, and received a signal, we may set a0 to -ERESTARTSYS and re-try the system call again.
In this case, seccomp "denies" the syscall (because of the signal), and we would set a7 to -1, thus losing the value of the system call we want to restart.
Instead, let's return -1 from do_syscall_trace_enter() to indicate that the syscall was rejected, so we don't clobber the value in case of -ERESTARTSYS or whatever.
This commit fixes the user_notification_signal seccomp selftest on riscv to no longer hang. That test expects the system call to be re-issued after the signal, and it wasn't due to the above bug. Now that it is, everything works normally.
Note that in the ptrace (tracer) case, the tracer can set the register values to whatever they want, so we still need to keep the code that handles out-of-bounds syscalls. However, we can drop the comment.
We can also drop syscall_set_nr(), since it is no longer used anywhere, and the code that re-loads the value in a7 because of it.
Reported in: https://lore.kernel.org/bpf/CAEn-LTp=ss0Dfv6J00=rCAy+N78U2AmhqJNjfqjr2FDpPYjxEQ@mail.gmail.com/
--- arch/riscv/include/asm/syscall.h | 7 ------- arch/riscv/kernel/entry.S | 11 +++-------- arch/riscv/kernel/ptrace.c | 11 +++++------ 3 files changed, 8 insertions(+), 21 deletions(-)
arch/riscv/include/asm/syscall.h +0 -7
@@ -28,13 +28,6 @@ static inline int syscall_get_nr(struct task_struct *task,return regs->a7; } -static inline void syscall_set_nr (struct task_struct *task, -struct pt_regs *regs, -int sysno) -{ - regs->a7 = sysno; -} -static inline void syscall_rollback (struct task_struct *task,struct pt_regs *regs) {
arch/riscv/kernel/entry.S +3 -8
@@ -228,20 +228,13 @@ check_syscall_nr: /* Check to make sure we don't jump to a bogus syscall number. */ li t0, __NR_syscalls la s0, sys_ni_syscall - /* - * The tracer can change syscall number to valid/invalid value. - * We use syscall_set_nr helper in syscall_trace_enter thus we - * cannot trust the current value in a7 and have to reload from - * the current task pt_regs. - */ - REG_L a7, PT_A7(sp) /* * Syscall number held in a7. * If syscall number is above allowed value, redirect to ni_syscall. */ bge a7, t0, 1f /* - * Check if syscall is rejected by tracer or seccomp, i.e., a7 == -1. + * Check if syscall is rejected by tracer, i.e., a7 == -1. * If yes, we pretend it was executed. */ li t1, -1
@@ -334,6 +327,7 @@ work_resched: handle_syscall_trace_enter: move a0, sp call do_syscall_trace_enter + move t0, a0 REG_L a0, PT_A0(sp) REG_L a1, PT_A1(sp) REG_L a2, PT_A2(sp)
@@ -342,6 +336,7 @@ handle_syscall_trace_enter: REG_L a5, PT_A5(sp) REG_L a6, PT_A6(sp) REG_L a7, PT_A7(sp) + bnez t0, ret_from_syscall_rejected j check_syscall_nr handle_syscall_trace_exit: move a0, sp
arch/riscv/kernel/ptrace.c +5 -6
@@ -148,21 +148,19 @@ long arch_ptrace(struct task_struct *child, long request,* Allows PTRACE_SYSCALL to work. These are called from entry.S in * {handle,ret_from}_syscall. */ -__visible void do_syscall_trace_enter(struct pt_regs *regs) +__visible int do_syscall_trace_enter(struct pt_regs *regs) {if (test_thread_flag (TIF_SYSCALL_TRACE ))if (tracehook_report_syscall_entry (regs)) -syscall_set_nr (current, regs,-1 ); +return -1 ;/* * Do the secure computing after ptrace; failures should be fast. * If this fails we might have return value in a0 from seccomp * (via SECCOMP_RET_ERRNO/TRACE). */ -if (secure_computing () ==-1 ) { -syscall_set_nr (current, regs,-1 ); -return ; - } +if (secure_computing () ==-1 ) +return -1 ;#ifdef CONFIG_HAVE_SYSCALL_TRACEPOINTS if (test_thread_flag (TIF_SYSCALL_TRACEPOINT ))
@@ -170,6 +168,7 @@ __visible void do_syscall_trace_enter(struct pt_regs *regs)#endif audit_syscall_entry (regs->a7, regs->a0, regs->a1, regs->a2, regs->a3); +return 0 ; } __visible void do_syscall_trace_exit(struct pt_regs *regs)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 4/119 drm/mediatek: Find the cursor plane instead of hard coding it
In reply to Greg Kroah-HartmanFrom: Evan Benn <[email protected]>
[ Upstream commit 318caac7c81cdf5806df30c3d72385659a5f0f53 ]
The cursor and primary planes were hard coded.
Now search for them for passing to drm_crtc_init_with_planes
--- drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
drivers/gpu/drm/mediatek/mtk_drm_crtc.c +12 -6
@@ -549,10 +549,18 @@ static const struct drm_crtc_helper_funcs mtk_crtc_helper_funcs = {static int mtk_drm_crtc_init (struct drm_device *drm,struct mtk_drm_crtc *mtk_crtc, -struct drm_plane *primary, -struct drm_plane *cursor,unsigned int pipe) +unsigned int pipe) { -int ret; +struct drm_plane *primary =NULL ; +struct drm_plane *cursor =NULL ; +int i, ret; + +for (i =0 ; i < mtk_crtc->layer_nr; i++) { +if (mtk_crtc->planes[i].type ==DRM_PLANE_TYPE_PRIMARY ) + primary = &mtk_crtc->planes[i]; +else if (mtk_crtc->planes[i].type ==DRM_PLANE_TYPE_CURSOR ) + cursor = &mtk_crtc->planes[i]; + } ret =drm_crtc_init_with_planes (drm, &mtk_crtc->base, primary, cursor, &mtk_crtc_funcs,NULL );
@@ -710,9 +718,7 @@ int mtk_drm_crtc_create(struct drm_device *drm_dev,return ret; } - ret =mtk_drm_crtc_init (drm_dev, mtk_crtc, &mtk_crtc->planes[0 ], - mtk_crtc->layer_nr >1 ? &mtk_crtc->planes[1 ] : -NULL , pipe); + ret =mtk_drm_crtc_init (drm_dev, mtk_crtc, pipe);if (ret <0 )return ret;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 8/119 ARM: dts: dra7-l4: mark timer13-16 as pwm capable
In reply to Greg Kroah-HartmanFrom: Grygorii Strashko <[email protected]>
[ Upstream commit 00a39c92c8ab94727f021297d1748531af113fcd ]
DMTimers 13 - 16 are PWM capable and also can be used for CPTS input signals generation. Hence, mark them as "ti,timer-pwm".
--- arch/arm/boot/dts/dra7-l4.dtsi | 4 ++++ 1 file changed, 4 insertions(+)
arch/arm/boot/dts/dra7-l4.dtsi +4 -0
@@ -3461,6 +3461,7 @@ clocks = <&l4per3_clkctrl DRA7_L4PER3_TIMER13_CLKCTRL 24>; clock-names = "fck"; interrupts = <GIC_SPI 339 IRQ_TYPE_LEVEL_HIGH>; + ti,timer-pwm; }; };
@@ -3489,6 +3490,7 @@ clocks = <&l4per3_clkctrl DRA7_L4PER3_TIMER14_CLKCTRL 24>; clock-names = "fck"; interrupts = <GIC_SPI 340 IRQ_TYPE_LEVEL_HIGH>; + ti,timer-pwm; }; };
@@ -3517,6 +3519,7 @@ clocks = <&l4per3_clkctrl DRA7_L4PER3_TIMER15_CLKCTRL 24>; clock-names = "fck"; interrupts = <GIC_SPI 341 IRQ_TYPE_LEVEL_HIGH>; + ti,timer-pwm; }; };
@@ -3545,6 +3548,7 @@ clocks = <&l4per3_clkctrl DRA7_L4PER3_TIMER16_CLKCTRL 24>; clock-names = "fck"; interrupts = <GIC_SPI 342 IRQ_TYPE_LEVEL_HIGH>; + ti,timer-pwm; }; };
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 5/119 drm/mediatek: Ensure the cursor plane is on top of other overlays
In reply to Greg Kroah-HartmanFrom: Sean Paul <[email protected]>
[ Upstream commit 26d696192aa5f4fe9119d6d23f90ed535053abca ]
Currently the cursor is placed on the first overlay plane, which means it will be at the bottom of the stack when the hw does the compositing with anything other than primary plane. Since mtk doesn't support plane zpos, change the cursor location to the top-most plane.
--- drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/gpu/drm/mediatek/mtk_drm_crtc.c +5 -3
@@ -606,11 +606,12 @@ static int mtk_drm_crtc_num_comp_planes(struct mtk_drm_crtc *mtk_crtc, }static inline -enum drm_plane_type mtk_drm_crtc_plane_type (unsigned int plane_idx) +enum drm_plane_type mtk_drm_crtc_plane_type (unsigned int plane_idx, +unsigned int num_planes) {if (plane_idx ==0 )return DRM_PLANE_TYPE_PRIMARY ; -else if (plane_idx ==1 ) +else if (plane_idx == (num_planes -1 ))return DRM_PLANE_TYPE_CURSOR ;else return DRM_PLANE_TYPE_OVERLAY ;
@@ -629,7 +630,8 @@ static int mtk_drm_crtc_init_comp_planes(struct drm_device *drm_dev, ret =mtk_plane_init (drm_dev, &mtk_crtc->planes[mtk_crtc->layer_nr],BIT (pipe), -mtk_drm_crtc_plane_type (mtk_crtc->layer_nr), +mtk_drm_crtc_plane_type (mtk_crtc->layer_nr, + num_planes),mtk_ddp_comp_supported_rotations (comp));if (ret)return ret;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 9/119 spi: qup: call spi_qup_pm_resume_runtime before suspending
In reply to Greg Kroah-HartmanFrom: Yuji Sasaki <[email protected]>
[ Upstream commit 136b5cd2e2f97581ae560cff0db2a3b5369112da ]
spi_qup_suspend() will cause synchronous external abort when runtime suspend is enabled and applied, as it tries to access SPI controller register while clock is already disabled in spi_qup_pm_suspend_runtime().
--- drivers/spi/spi-qup.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
drivers/spi/spi-qup.c +7 -4
@@ -1217,6 +1217,11 @@ static int spi_qup_suspend(struct device *device)struct spi_qup *controller =spi_master_get_devdata (master);int ret; +if (pm_runtime_suspended (device)) { + ret =spi_qup_pm_resume_runtime (device); +if (ret) +return ret; + } ret =spi_master_suspend (master);if (ret)return ret;
@@ -1225,10 +1230,8 @@ static int spi_qup_suspend(struct device *device)if (ret)return ret; -if (!pm_runtime_suspended (device)) { -clk_disable_unprepare (controller->cclk); -clk_disable_unprepare (controller->iclk); - } +clk_disable_unprepare (controller->cclk); +clk_disable_unprepare (controller->iclk);return 0 ; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainercover 5.5.12-rc1 review
This is the start of the stable review cycle for the 5.5.12 release. There are 119 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 26 Mar 2020 13:06:42 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.5.12-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.5.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.5.12-rc1
Masahiro Yamada <[email protected]>
int128: fix __uint128_t compiler test in Kconfig
Masahiro Yamada <[email protected]>
kconfig: introduce m32-flag and m64-flag
Johan Hovold <[email protected]>
staging: greybus: loopback_test: fix potential path truncations
Johan Hovold <[email protected]>
staging: greybus: loopback_test: fix potential path truncation
Matt Roper <[email protected]>
drm/i915: Handle all MCR ranges
Chris Wilson <[email protected]>
drm/i915/execlists: Track active elements during dequeue
Jernej Skrabec <[email protected]>
drm/bridge: dw-hdmi: fix AVI frame colorimetry
Caz Yokoyama <[email protected]>
Revert "drm/i915/tgl: Add extra hdc flush workaround"
Filipe Manana <[email protected]>
btrfs: fix removal of raid[56|1c34} incompat flags after removing block group
Xiao Yang <[email protected]>
modpost: Get proper section index by get_secindex() instead of st_shndx
Sagi Grimberg <[email protected]>
nvmet-tcp: set MSG_MORE only if we actually have more to send
Cristian Marussi <[email protected]>
arm64: smp: fix crash_smp_send_stop() behaviour
Cristian Marussi <[email protected]>
arm64: smp: fix smp_send_stop() behaviour
Dan Carpenter <[email protected]>
thunderbolt: Fix error code in tb_port_is_width_supported()
Kai-Heng Feng <[email protected]>
ALSA: hda/realtek: Fix pop noise on ALC225
Thomas Gleixner <[email protected]>
futex: Unbreak futex hashing
Peter Zijlstra <[email protected]>
futex: Fix inode life-time issue
Pavel Begunkov <[email protected]>
io_uring: NULL-deref for IOSQE_{ASYNC,DRAIN}Joerg Roedel <[email protected]>
x86/mm: split vmalloc_sync_all()
Qian Cai <[email protected]>
page-flags: fix a crash at SetPageError(THP_SWAP)
Vlastimil Babka <[email protected]>
mm, slub: prevent kmalloc_node crashes and memory leaks
Linus Torvalds <[email protected]>
mm: slub: be more careful about the double cmpxchg of freelist
Roman Penyaev <[email protected]>
epoll: fix possible lost wakeup on epoll_ctl() path
Michal Hocko <[email protected]>
mm: do not allow MADV_PAGEOUT for CoW pages
Baoquan He <[email protected]>
mm/hotplug: fix hot remove failure in SPARSEMEM|!VMEMMAP case
Chris Down <[email protected]>
mm, memcg: throttle allocators based on ancestral memory.high
Chris Down <[email protected]>
mm, memcg: fix corruption on 64-bit divisor in memory.high throttling
Chunguang Xu <[email protected]>
memcg: fix NULL pointer dereference in __mem_cgroup_usage_unregister_event
Alexander Shishkin <[email protected]>
stm class: sys-t: Fix the use of time_after()
Qiujun Huang <[email protected]>
drm/lease: fix WARNING in idr_destroy
Tom St Denis <[email protected]>
drm/amd/amdgpu: Fix GPR read from debugfs (v2)
Filipe Manana <[email protected]>
btrfs: fix log context list corruption after rename whiteout error
Steven Rostedt (VMware) <[email protected]>
xhci: Do not open code __print_symbolic() in xhci trace events
Vincenzo Frascino <[email protected]>
arm64: compat: Fix syscall number of compat_clock_getres
Corentin Labbe <[email protected]>
rtc: max8907: add missing select REGMAP_IRQ
Jessica Yu <[email protected]>
modpost: move the namespace field in Module.symvers last
Alexander Shishkin <[email protected]>
intel_th: pci: Add Elkhart Lake CPU support
Alexander Shishkin <[email protected]>
intel_th: Fix user-visible error codes
Alexander Shishkin <[email protected]>
intel_th: msu: Fix the unexpected state warning
Samuel Thibault <[email protected]>
staging/speakup: fix get_word non-space look-ahead
Johan Hovold <[email protected]>
staging: greybus: loopback_test: fix poll-mask build breakage
Michael Straube <[email protected]>
staging: rtl8188eu: Add device id for MERCUSYS MW150US v2
Nathan Chancellor <[email protected]>
kbuild: Disable -Wpointer-to-enum-cast
Murphy Zhou <[email protected]>
CIFS: fiemap: do not return EINVAL if get nothing
Hans de Goede <[email protected]>
mmc: sdhci-acpi: Disable write protect detection on Acer Aspire Switch 10 (SW5-012)
Hans de Goede <[email protected]>
mmc: sdhci-acpi: Switch signal voltage back to 3.3V on suspend on external microSD on Lenovo Miix 320
Masahiro Yamada <[email protected]>
mmc: sdhci-cadence: set SDHCI_QUIRK2_PRESET_VALUE_BROKEN for UniPhier
Michał Mirosław <[email protected]>
mmc: sdhci-of-at91: fix cd-gpios for SAMA5D2
Ricky Wu <[email protected]>
mmc: rtsx_pci: Fix support for speed-modes that relies on tuning
Tomas Novotny <[email protected]>
iio: light: vcnl4000: update sampling periods for vcnl4040
Tomas Novotny <[email protected]>
iio: light: vcnl4000: update sampling periods for vcnl4200
Eugen Hristev <[email protected]>
iio: adc: at91-sama5d2_adc: fix differential channels in triggered mode
Olivier Moysan <[email protected]>
iio: adc: stm32-dfsdm: fix sleep in atomic context
Stephan Gerhold <[email protected]>
iio: magnetometer: ak8974: Fix negative raw values in sysfs
Alexandru Tachici <[email protected]>
iio: accel: adxl372: Set iio_chan BE
Fabrice Gasnier <[email protected]>
iio: trigger: stm32-timer: disable master mode when stopping
Wen-chien Jesse Sung <[email protected]>
iio: st_sensors: remap SMO8840 to LIS2DH12
Petr Štetiar <[email protected]>
iio: chemical: sps30: fix missing triggered buffer dependency
Eric Biggers <[email protected]>
tty: fix compat TIOCGSERIAL checking wrong function ptr
Eric Biggers <[email protected]>
tty: fix compat TIOCGSERIAL leaking uninitialized memory
Takashi Iwai <[email protected]>
ALSA: pcm: oss: Remove WARNING from snd_pcm_plug_alloc() checks
Takashi Iwai <[email protected]>
ALSA: pcm: oss: Avoid plugin buffer overflow
Takashi Iwai <[email protected]>
ALSA: seq: oss: Fix running status after receiving sysex
Takashi Iwai <[email protected]>
ALSA: seq: virmidi: Fix running status after receiving sysex
Jian-Hong Pan <[email protected]>
ALSA: hda/realtek - Enable the headset of Acer N50-600 with ALC662
Jian-Hong Pan <[email protected]>
ALSA: hda/realtek - Enable headset mic of Acer X2660G with ALC662
Takashi Iwai <[email protected]>
ALSA: line6: Fix endless MIDI read loop
Anthony Mallet <[email protected]>
USB: cdc-acm: fix rounding error in TIOCSSERIAL
Anthony Mallet <[email protected]>
USB: cdc-acm: fix close_delay and closing_wait units in TIOCSSERIAL
Heikki Krogerus <[email protected]>
usb: typec: ucsi: displayport: Fix a potential race during registration
Heikki Krogerus <[email protected]>
usb: typec: ucsi: displayport: Fix NULL pointer dereference
Alberto Mattea <[email protected]>
usb: xhci: apply XHCI_SUSPEND_DELAY to AMD XHCI controller 1022:145c
Scott Chen <[email protected]>
USB: serial: pl2303: add device-id for HP LD381
Ran Wang <[email protected]>
usb: host: xhci-plat: add a shutdown
Peter Chen <[email protected]>
usb: chipidea: udc: fix sleeping function called from invalid context
Daniele Palmas <[email protected]>
USB: serial: option: add ME910G1 ECM composition 0x110b
Hans de Goede <[email protected]>
usb: quirks: add NO_LPM quirk for RTL8153 based ethernet adapters
Kai-Heng Feng <[email protected]>
USB: Disable LPM on WD19's Realtek Hub
Sasha Levin <[email protected]>
Revert "drm/fbdev: Fallback to non tiled mode if all tiles not present"
Christian Brauner <[email protected]>
binderfs: use refcount for binder control devices too
Pavel Begunkov <[email protected]>
io_uring: fix lockup with timeouts
Jonathan Neuschäfer <[email protected]>
parse-maintainers: Mark as executable
Tycho Andersen <[email protected]>
riscv: fix seccomp reject syscall code path
Dongli Zhang <[email protected]>
xenbus: req->err should be updated before req->state
Dongli Zhang <[email protected]>
xenbus: req->body should be updated before req->state
Josip Pavic <[email protected]>
drm/amd/display: fix dcc swath size calculations on dcn1
Bhawanpreet Lakha <[email protected]>
drm/amd/display: Clear link settings on MST disable connector
Yintian Tao <[email protected]>
drm/amdgpu: clean wptr on wb when gpu recovery
Alexandre Ghiti <[email protected]>
riscv: Fix range looking for kernel image memblock
Damien Le Moal <[email protected]>
riscv: Force flat memory model with no-mmu
Aaro Koskinen <[email protected]>
spi: spi_register_controller(): free bus id on error paths
Olivier Moysan <[email protected]>
ASoC: stm32: sai: manage rebind issue
Vincent Chen <[email protected]>
riscv: avoid the PIC offset of static percpu data in module beyond 2G limits
Mike Snitzer <[email protected]>
dm integrity: use dm_bio_record and dm_bio_restore
Mike Snitzer <[email protected]>
dm bio record: save/restore bi_end_io and bi_integrity
Daniel Axtens <[email protected]>
altera-stapl: altera_get_note: prevent write beyond end of 'key'
Stefan Wahren <[email protected]>
ARM: bcm2835_defconfig: Explicitly restore CONFIG_DEBUG_FS
Pavel Begunkov <[email protected]>
io-wq: fix IO_WQ_WORK_NO_CANCEL cancellation
luanshi <[email protected]>
drivers/perf: arm_pmu_acpi: Fix incorrect checking of gicc pointer
Joakim Zhang <[email protected]>
drivers/perf: fsl_imx8_ddr: Correct the CLEAR bit definition
Marek Szyprowski <[email protected]>
drm/exynos: hdmi: don't leak enable HDMI_EN regulator if probe fails
Marek Szyprowski <[email protected]>
drm/exynos: dsi: fix workaround for the legacy clock name
Marek Szyprowski <[email protected]>
drm/exynos: dsi: propagate error value and silence meaningless warning
Stefan Wahren <[email protected]>
ARM: dts: bcm283x: Add missing properties to the PWR LED
Thommy Jakobsson <[email protected]>
spi/zynqmp: remove entry that causes a cs glitch
Evan Green <[email protected]>
spi: pxa2xx: Add CS control clock quirk
Kishon Vijay Abraham I <[email protected]>
ARM: dts: dra7: Add "dma-ranges" property to PCIe RC DT nodes
Steve French <[email protected]>
cifs: add missing mount option to /proc/mounts
Paulo Alcantara (SUSE) <[email protected]>
cifs: fix potential mismatch of UNC paths
Naveen N. Rao <[email protected]>
powerpc: Include .BTF section
Yuji Sasaki <[email protected]>
spi: qup: call spi_qup_pm_resume_runtime before suspending
Grygorii Strashko <[email protected]>
ARM: dts: dra7-l4: mark timer13-16 as pwm capable
Grygorii Strashko <[email protected]>
phy: ti: gmii-sel: do not fail in case of gmii
Grygorii Strashko <[email protected]>
phy: ti: gmii-sel: fix set of copy-paste errors
Sean Paul <[email protected]>
drm/mediatek: Ensure the cursor plane is on top of other overlays
Evan Benn <[email protected]>
drm/mediatek: Find the cursor plane instead of hard coding it
Vignesh Raghavendra <[email protected]>
spi: spi-omap2-mcspi: Support probe deferral for DMA channels
Linus Torvalds <[email protected]>
locks: reinstate locks_delete_block optimization
yangerkun <[email protected]>
locks: fix a potential use-after-free problem when wakeup a waiter
-------------
Diffstat:
Documentation/kbuild/modules.rst | 4 +- Makefile | 4 +- arch/arm/boot/dts/bcm2711-rpi-4-b.dts | 2 + arch/arm/boot/dts/bcm2837-rpi-3-a-plus.dts | 2 + arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts | 2 + arch/arm/boot/dts/dra7-l4.dtsi | 4 + arch/arm/boot/dts/dra7.dtsi | 2 + arch/arm/configs/bcm2835_defconfig | 1 + arch/arm64/include/asm/unistd.h | 2 +- arch/arm64/kernel/smp.c | 25 ++++- arch/powerpc/kernel/vmlinux.lds.S | 6 ++ arch/riscv/Kconfig | 1 + arch/riscv/include/asm/syscall.h | 7 -- arch/riscv/kernel/entry.S | 11 +-- arch/riscv/kernel/module.c | 16 ++++ arch/riscv/kernel/ptrace.c | 11 +-- arch/riscv/mm/init.c | 2 +- arch/x86/mm/fault.c | 26 +++++- drivers/acpi/apei/ghes.c | 2 +- drivers/android/binderfs.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 6 +- drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 1 + drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 1 + .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 1 + .../gpu/drm/amd/display/dc/dcn10/dcn10_hubbub.c | 4 +- drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 46 +++++---- drivers/gpu/drm/drm_client_modeset.c | 72 -------------- drivers/gpu/drm/drm_lease.c | 3 +- drivers/gpu/drm/exynos/exynos_drm_dsi.c | 12 ++- drivers/gpu/drm/exynos/exynos_hdmi.c | 22 +++-- drivers/gpu/drm/i915/gt/intel_lrc.c | 52 +++-------- drivers/gpu/drm/i915/gt/intel_workarounds.c | 25 ++++- drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 26 ++++-- drivers/hwtracing/intel_th/msu.c | 13 +-- drivers/hwtracing/intel_th/pci.c | 5 + drivers/hwtracing/stm/p_sys-t.c | 6 +- drivers/iio/accel/adxl372.c | 1 + drivers/iio/accel/st_accel_i2c.c | 2 +- drivers/iio/adc/at91-sama5d2_adc.c | 15 +++ drivers/iio/adc/stm32-dfsdm-adc.c | 43 ++------- drivers/iio/chemical/Kconfig | 2 + drivers/iio/light/vcnl4000.c | 15 +-- drivers/iio/magnetometer/ak8974.c | 2 +- drivers/iio/trigger/stm32-timer-trigger.c | 11 ++- drivers/md/dm-bio-record.h | 15 +++ drivers/md/dm-integrity.c | 32 ++----- drivers/misc/altera-stapl/altera.c | 12 +-- drivers/misc/cardreader/rts5227.c | 2 +- drivers/misc/cardreader/rts5249.c | 2 + drivers/misc/cardreader/rts5260.c | 2 +- drivers/misc/cardreader/rts5261.c | 2 +- drivers/mmc/host/rtsx_pci_sdmmc.c | 13 ++- drivers/mmc/host/sdhci-acpi.c | 84 ++++++++++++++++- drivers/mmc/host/sdhci-cadence.c | 18 +++- drivers/mmc/host/sdhci-of-at91.c | 8 +- drivers/nvme/target/tcp.c | 12 ++- drivers/perf/arm_pmu_acpi.c | 7 +- drivers/perf/fsl_imx8_ddr_perf.c | 10 +- drivers/phy/ti/phy-gmii-sel.c | 10 +- drivers/rtc/Kconfig | 1 + drivers/spi/spi-omap2-mcspi.c | 77 ++++++++------- drivers/spi/spi-pxa2xx.c | 23 +++++ drivers/spi/spi-qup.c | 11 ++- drivers/spi/spi-zynqmp-gqspi.c | 3 - drivers/spi/spi.c | 32 +++---- drivers/staging/greybus/tools/loopback_test.c | 21 +++-- drivers/staging/rtl8188eu/os_dep/usb_intf.c | 1 + drivers/staging/speakup/main.c | 2 +- drivers/thunderbolt/switch.c | 2 +- drivers/tty/tty_io.c | 6 +- drivers/usb/chipidea/udc.c | 7 +- drivers/usb/class/cdc-acm.c | 34 ++++--- drivers/usb/core/quirks.c | 6 ++ drivers/usb/host/xhci-pci.c | 3 +- drivers/usb/host/xhci-plat.c | 1 + drivers/usb/host/xhci-trace.h | 23 ++--- drivers/usb/serial/option.c | 2 + drivers/usb/serial/pl2303.c | 1 + drivers/usb/serial/pl2303.h | 1 + drivers/usb/typec/ucsi/displayport.c | 12 ++- drivers/xen/xenbus/xenbus_comms.c | 4 + drivers/xen/xenbus/xenbus_xs.c | 9 +- fs/btrfs/block-group.c | 4 +- fs/btrfs/inode.c | 4 + fs/cifs/cifs_dfs_ref.c | 2 + fs/cifs/cifsfs.c | 2 + fs/cifs/file.c | 3 +- fs/cifs/smb2ops.c | 2 +- fs/eventpoll.c | 8 +- fs/inode.c | 1 + fs/io-wq.c | 20 ++-- fs/io_uring.c | 9 ++ fs/locks.c | 60 ++++++++---- include/linux/fs.h | 1 + include/linux/futex.h | 17 ++-- include/linux/page-flags.h | 2 +- include/linux/vmalloc.h | 5 +- init/Kconfig | 3 +- kernel/futex.c | 93 +++++++++++-------- kernel/notifier.c | 2 +- mm/madvise.c | 12 ++- mm/memcontrol.c | 103 +++++++++++++-------- mm/nommu.c | 10 +- mm/slub.c | 32 ++++--- mm/sparse.c | 8 +- mm/vmalloc.c | 11 ++- scripts/Kconfig.include | 7 ++ scripts/Makefile.extrawarn | 1 + scripts/export_report.pl | 2 +- scripts/mod/modpost.c | 27 +++--- scripts/parse-maintainers.pl | 0 sound/core/oss/pcm_plugin.c | 12 ++- sound/core/seq/oss/seq_oss_midi.c | 1 + sound/core/seq/seq_virmidi.c | 1 + sound/pci/hda/patch_realtek.c | 25 +++++ sound/soc/stm/stm32_sai_sub.c | 18 ++-- sound/usb/line6/driver.c | 2 +- sound/usb/line6/midibuf.c | 2 +- 118 files changed, 945 insertions(+), 595 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 39/119 io_uring: fix lockup with timeouts
From: Pavel Begunkov <[email protected]>
[ Upstream commit f0e20b8943509d81200cef5e30af2adfddba0f5c ]
There is a recipe to deadlock the kernel: submit a timeout sqe with a linked_timeout (e.g. test_single_link_timeout_ception() from liburing), and SIGKILL the process.
Then, io_kill_timeouts() takes @ctx->completion_lock, but the timeout isn't flagged with REQ_F_COMP_LOCKED, and will try to double grab it during io_put_free() to cancel the linked timeout. Probably, the same can happen with another io_kill_timeout() call site, that is io_commit_cqring().
--- fs/io_uring.c | 1 + 1 file changed, 1 insertion(+)
fs/io_uring.c +1 -0
@@ -688,6 +688,7 @@ static void io_kill_timeout(struct io_kiocb *req)if (ret !=-1 ) {atomic_inc (&req->ctx->cq_timeouts);list_del_init (&req->list); + req->flags |=REQ_F_COMP_LOCKED ;io_cqring_fill_event (req,0 );io_put_req (req); }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 48/119 usb: xhci: apply XHCI_SUSPEND_DELAY to AMD XHCI controller 1022:145c
In reply to Greg Kroah-HartmanFrom: Alberto Mattea <[email protected]>
commit 16263abc12d09871156a1c8650fb651f0e552f5e upstream.
This controller timeouts during suspend (S3) with
[ 240.521724] xhci_hcd 0000:30:00.3: WARN: xHC save state timeout [ 240.521729] xhci_hcd 0000:30:00.3: ERROR mismatched command completion event
thus preventing the system from entering S3.
Moreover it remains in an undefined state where some connected devices stop working until a reboot.
Apply the XHCI_SUSPEND_DELAY quirk to make it suspend properly.
--- drivers/usb/host/xhci-pci.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/host/xhci-pci.c +2 -1
@@ -136,7 +136,8 @@ static void xhci_pci_quirks(struct devic xhci->quirks |=XHCI_AMD_PLL_FIX ;if (pdev->vendor ==PCI_VENDOR_ID_AMD && - (pdev->device ==0x15e0 || + (pdev->device ==0x145c || + pdev->device ==0x15e0 || pdev->device ==0x15e1 || pdev->device ==0x43bb )) xhci->quirks |=XHCI_SUSPEND_DELAY ;
Greg Kroah-Hartman
maintainerPATCH 49/119 usb: typec: ucsi: displayport: Fix NULL pointer dereference
In reply to Greg Kroah-HartmanFrom: Heikki Krogerus <[email protected]>
commit d16e7b62c5adcd13832c6b0ba364c3468d21b856 upstream.
If the registration of the DisplayPort was not successful, or if the port does not support DisplayPort alt mode in the first place, the function ucsi_displayport_remove_partner() will fail with NULL pointer dereference when it attempts to access the driver data.
Adding a check to the function to make sure there really is driver data for the device before modifying it.
--- drivers/usb/typec/ucsi/displayport.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/typec/ucsi/displayport.c +3 -0
@@ -271,6 +271,9 @@ void ucsi_displayport_remove_partner(strreturn ; dp =typec_altmode_get_drvdata (alt); +if (!dp) +return ; + dp->data.conf =0 ; dp->data.status =0 ; dp->initialized = false;
Greg Kroah-Hartman
maintainerPATCH 52/119 USB: cdc-acm: fix rounding error in TIOCSSERIAL
In reply to Greg Kroah-HartmanFrom: Anthony Mallet <[email protected]>
commit b401f8c4f492cbf74f3f59c9141e5be3071071bb upstream.
By default, tty_port_init() initializes those parameters to a multiple of HZ. For instance in line 69 of tty_port.c:
port->close_delay = (50 * HZ) / 100;
https://github.com/torvalds/linux/blob/master/drivers/tty/tty_port.c#L69
With e.g. CONFIG_HZ = 250 (as this is the case for Ubuntu 18.04 linux-image-4.15.0-37-generic), the default setting for close_delay is thus 125.
When ioctl(fd, TIOCGSERIAL, &s) is executed, the setting returned in user space is '12' (125/10). When ioctl(fd, TIOCSSERIAL, &s) is then executed with the same setting '12', the value is interpreted as '120' which is different from the current setting and a EPERM error may be raised by set_serial_info() if !CAP_SYS_ADMIN.
https://github.com/torvalds/linux/blob/master/drivers/usb/class/cdc-acm.c#L919
--- drivers/usb/class/cdc-acm.c | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-)
drivers/usb/class/cdc-acm.c +16 -9
@@ -907,6 +907,7 @@ static int set_serial_info(struct tty_st {struct acm *acm = tty->driver_data;unsigned int closing_wait, close_delay; +unsigned int old_closing_wait, old_close_delay;int retval =0 ; close_delay =msecs_to_jiffies (ss->close_delay *10 );
@@ -914,18 +915,24 @@ static int set_serial_info(struct tty_st ASYNC_CLOSING_WAIT_NONE :msecs_to_jiffies (ss->closing_wait *10 ); +/* we must redo the rounding here, so that the values match */ + old_close_delay =jiffies_to_msecs (acm->port.close_delay) /10 ; + old_closing_wait = acm->port.closing_wait ==ASYNC_CLOSING_WAIT_NONE ? +ASYNC_CLOSING_WAIT_NONE : +jiffies_to_msecs (acm->port.closing_wait) /10 ; +mutex_lock (&acm->port.mutex); -if (!capable (CAP_SYS_ADMIN )) { -if ((close_delay != acm->port.close_delay) || - (closing_wait != acm->port.closing_wait)) +if ((ss->close_delay != old_close_delay) || + (ss->closing_wait != old_closing_wait)) { +if (!capable (CAP_SYS_ADMIN )) retval = -EPERM ; -else - retval = -EOPNOTSUPP ; - }else { - acm->port.close_delay = close_delay; - acm->port.closing_wait = closing_wait; - } +else { + acm->port.close_delay = close_delay; + acm->port.closing_wait = closing_wait; + } + }else + retval = -EOPNOTSUPP ;mutex_unlock (&acm->port.mutex);return retval;
Greg Kroah-Hartman
maintainerPATCH 50/119 usb: typec: ucsi: displayport: Fix a potential race during registration
In reply to Greg Kroah-HartmanFrom: Heikki Krogerus <[email protected]>
commit 081da1325d351ea8804cf74e65263ea120834f33 upstream.
Locking the connector in ucsi_register_displayport() to make sure that nothing can access the displayport alternate mode before the function has finished and the alternate mode is actually ready.
--- drivers/usb/typec/ucsi/displayport.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/usb/typec/ucsi/displayport.c +8 -1
@@ -288,6 +288,8 @@ struct typec_altmode *ucsi_register_dispstruct typec_altmode *alt;struct ucsi_dp *dp; +mutex_lock (&con->lock); +/* We can't rely on the firmware with the capabilities. */ desc->vdo |=DP_CAP_DP_SIGNALING |DP_CAP_RECEPTACLE ;
@@ -296,12 +298,15 @@ struct typec_altmode *ucsi_register_disp desc->vdo |= all_assignments <<16 ; alt =typec_port_register_altmode (con->port, desc); -if (IS_ERR (alt)) +if (IS_ERR (alt)) { +mutex_unlock (&con->lock);return alt; + } dp =devm_kzalloc (&alt->dev,sizeof (*dp),GFP_KERNEL );if (!dp) {typec_unregister_altmode (alt); +mutex_unlock (&con->lock);return ERR_PTR (-ENOMEM ); }
@@ -314,5 +319,7 @@ struct typec_altmode *ucsi_register_disp alt->ops = &ucsi_displayport_ops;typec_altmode_set_drvdata (alt, dp); +mutex_unlock (&con->lock); +return alt; }
Greg Kroah-Hartman
maintainerPATCH 53/119 ALSA: line6: Fix endless MIDI read loop
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit d683469b3c93d7e2afd39e6e1970f24700eb7a68 upstream.
The MIDI input event parser of the LINE6 driver may enter into an endless loop when the unexpected data sequence is given, as it tries to continue the secondary bytes without termination. Also, when the input data is too short, the parser returns a negative error, while the caller doesn't handle it properly. This would lead to the unexpected behavior as well.
This patch addresses those issues by checking the return value correctly and handling the one-byte event in the parser properly.
The bug was reported by syzkaller.
--- sound/usb/line6/driver.c | 2 +- sound/usb/line6/midibuf.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
sound/usb/line6/driver.c +1 -1
@@ -305,7 +305,7 @@ static void line6_data_received(struct uline6_midibuf_read (mb, line6->buffer_message,LINE6_MIDI_MESSAGE_MAXLEN ); -if (done ==0 ) +if (done <=0 )break ; line6->message_length = done;
sound/usb/line6/midibuf.c +1 -1
@@ -159,7 +159,7 @@ int line6_midibuf_read(struct midi_buffeint midi_length_prev =midibuf_message_length (this->command_prev); -if (midi_length_prev >0 ) { +if (midi_length_prev >1 ) { midi_length = midi_length_prev -1 ; repeat =1 ; }else
Greg Kroah-Hartman
maintainerPATCH 55/119 ALSA: hda/realtek - Enable the headset of Acer N50-600 with ALC662
In reply to Greg Kroah-HartmanFrom: Jian-Hong Pan <[email protected]>
commit a124458a127ccd7629e20cd7bae3e1f758ed32aa upstream.
A headset on the desktop like Acer N50-600 does not work, until quirk ALC662_FIXUP_ACER_NITRO_HEADSET_MODE is applied.
--- sound/pci/hda/patch_realtek.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
sound/pci/hda/patch_realtek.c +12 -0
@@ -8611,6 +8611,7 @@ enum {ALC669_FIXUP_ACER_ASPIRE_ETHOS_HEADSET ,ALC671_FIXUP_HP_HEADSET_MIC2 ,ALC662_FIXUP_ACER_X2660G_HEADSET_MODE , + ALC662_FIXUP_ACER_NITRO_HEADSET_MODE, }; static const struct hda_fixup alc662_fixups[] = {
@@ -8965,6 +8966,16 @@ static const struct hda_fixup alc662_fix .chained = true, .chain_id =ALC662_FIXUP_USI_FUNC }, + [ALC662_FIXUP_ACER_NITRO_HEADSET_MODE] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl []) { + {0x1a ,0x01a11140 },/* use as headset mic, without its own jack detect */ + {0x1b ,0x0221144f }, + { } + }, + .chained = true, + .chain_id =ALC662_FIXUP_USI_FUNC + }, };static const struct snd_pci_quirk alc662_fixup_tbl[] = {
@@ -8976,6 +8987,7 @@ static const struct snd_pci_quirk alc662SND_PCI_QUIRK (0x1025 ,0x0349 ,"eMachines eM250" ,ALC662_FIXUP_INV_DMIC ),SND_PCI_QUIRK (0x1025 ,0x034a ,"Gateway LT27" ,ALC662_FIXUP_INV_DMIC ),SND_PCI_QUIRK (0x1025 ,0x038b ,"Acer Aspire 8943G" ,ALC662_FIXUP_ASPIRE ), +SND_PCI_QUIRK (0x1025 ,0x123c ,"Acer Nitro N50-600" ,ALC662_FIXUP_ACER_NITRO_HEADSET_MODE ),SND_PCI_QUIRK (0x1025 ,0x124e ,"Acer 2660G" ,ALC662_FIXUP_ACER_X2660G_HEADSET_MODE ),SND_PCI_QUIRK (0x1028 ,0x05d8 ,"Dell" ,ALC668_FIXUP_DELL_MIC_NO_PRESENCE ), SND_PCI_QUIRK(0x1028, 0x05db, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
Greg Kroah-Hartman
maintainerPATCH 56/119 ALSA: seq: virmidi: Fix running status after receiving sysex
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 4384f167ce5fa7241b61bb0984d651bc528ddebe upstream.
The virmidi driver handles sysex event exceptionally in a short-cut snd_seq_dump_var_event() call, but this missed the reset of the running status. As a result, it may lead to an incomplete command right after the sysex when an event with the same running status was queued.
Fix it by clearing the running status properly via alling snd_midi_event_reset_decode() for that code path.
--- sound/core/seq/seq_virmidi.c | 1 + 1 file changed, 1 insertion(+)
sound/core/seq/seq_virmidi.c +1 -0
@@ -81,6 +81,7 @@ static int snd_virmidi_dev_receive_eventif ((ev->flags &SNDRV_SEQ_EVENT_LENGTH_MASK ) !=SNDRV_SEQ_EVENT_LENGTH_VARIABLE )continue ;snd_seq_dump_var_event (ev, (snd_seq_dump_func_t )snd_rawmidi_receive, vmidi->substream); +snd_midi_event_reset_decode (vmidi->parser); }else { len =snd_midi_event_decode (vmidi->parser, msg,sizeof (msg), ev);if (len >0 )
Greg Kroah-Hartman
maintainerPATCH 57/119 ALSA: seq: oss: Fix running status after receiving sysex
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 6c3171ef76a0bad892050f6959a7eac02fb16df7 upstream.
This is a similar bug like the previous case for virmidi: the invalid running status is kept after receiving a sysex message.
Again the fix is to clear the running status after handling the sysex.
--- sound/core/seq/oss/seq_oss_midi.c | 1 + 1 file changed, 1 insertion(+)
sound/core/seq/oss/seq_oss_midi.c +1 -0
@@ -602,6 +602,7 @@ send_midi_event(struct seq_oss_devinfo * len =snd_seq_oss_timer_start (dp->timer);if (ev->type ==SNDRV_SEQ_EVENT_SYSEX ) {snd_seq_oss_readq_sysex (dp->readq, mdev->seq_device, ev); +snd_midi_event_reset_decode (mdev->coder); }else { len =snd_midi_event_decode (mdev->coder, msg,sizeof (msg), ev);if (len >0 )
Greg Kroah-Hartman
maintainerPATCH 40/119 binderfs: use refcount for binder control devices too
In reply to Greg Kroah-HartmanFrom: Christian Brauner <[email protected]>
[ Upstream commit 211b64e4b5b6bd5fdc19cd525c2cc9a90e6b0ec9 ]
Binderfs binder-control devices are cleaned up via binderfs_evict_inode too() which will use refcount_dec_and_test(). However, we missed to set the refcount for binderfs binder-control devices and so we underflowed when the binderfs instance got unmounted. Pretty obvious oversight and should have been part of the more general UAF fix. The good news is that having test cases (suprisingly) helps.
Technically, we could detect that we're about to cleanup the binder-control dentry in binderfs_evict_inode() and then simply clean it up. But that makes the assumption that the binder driver itself will never make use of a binderfs binder-control device after the binderfs instance it belongs to has been unmounted and the superblock for it been destroyed. While it is unlikely to ever come to this let's be on the safe side. Performance-wise this also really doesn't matter since the binder-control device is only every really when creating the binderfs filesystem or creating additional binder devices. Both operations are pretty rare.
--- drivers/android/binderfs.c | 1 + 1 file changed, 1 insertion(+)
drivers/android/binderfs.c +1 -0
@@ -448,6 +448,7 @@ static int binderfs_binder_ctl_create(struct super_block *sb) inode->i_uid = info->root_uid; inode->i_gid = info->root_gid; +refcount_set (&device->ref,1 ); device->binderfs_inode = inode; device->miscdev.minor = minor;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 58/119 ALSA: pcm: oss: Avoid plugin buffer overflow
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit f2ecf903ef06eb1bbbfa969db9889643d487e73a upstream.
Each OSS PCM plugins allocate its internal buffer per pre-calculation of the max buffer size through the chain of plugins (calling src_frames and dst_frames callbacks). This works for most plugins, but the rate plugin might behave incorrectly. The calculation in the rate plugin involves with the fractional position, i.e. it may vary depending on the input position. Since the buffer size pre-calculation is always done with the offset zero, it may return a shorter size than it might be; this may result in the out-of-bound access as spotted by fuzzer.
This patch addresses those possible buffer overflow accesses by simply setting the upper limit per the given buffer size for each plugin before src_frames() and after dst_frames() calls.
--- sound/core/oss/pcm_plugin.c | 8 ++++++++ 1 file changed, 8 insertions(+)
sound/core/oss/pcm_plugin.c +8 -0
@@ -209,6 +209,8 @@ snd_pcm_sframes_t snd_pcm_plug_client_siif (stream ==SNDRV_PCM_STREAM_PLAYBACK ) { plugin =snd_pcm_plug_last (plug);while (plugin && drv_frames >0 ) { +if (drv_frames > plugin->buf_frames) + drv_frames = plugin->buf_frames; plugin_prev = plugin->prev;if (plugin->src_frames) drv_frames = plugin->src_frames (plugin, drv_frames);
@@ -220,6 +222,8 @@ snd_pcm_sframes_t snd_pcm_plug_client_si plugin_next = plugin->next;if (plugin->dst_frames) drv_frames = plugin->dst_frames (plugin, drv_frames); +if (drv_frames > plugin->buf_frames) + drv_frames = plugin->buf_frames; plugin = plugin_next; } }else
@@ -248,11 +252,15 @@ snd_pcm_sframes_t snd_pcm_plug_slave_sizif (frames <0 )return frames; } +if (frames > plugin->buf_frames) + frames = plugin->buf_frames; plugin = plugin_next; } }else if (stream ==SNDRV_PCM_STREAM_CAPTURE ) { plugin =snd_pcm_plug_last (plug);while (plugin) { +if (frames > plugin->buf_frames) + frames = plugin->buf_frames; plugin_prev = plugin->prev;if (plugin->src_frames) { frames = plugin->src_frames (plugin, frames);
Greg Kroah-Hartman
maintainerPATCH 59/119 ALSA: pcm: oss: Remove WARNING from snd_pcm_plug_alloc() checks
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 5461e0530c222129dfc941058be114b5cbc00837 upstream.
The return value checks in snd_pcm_plug_alloc() are covered with snd_BUG_ON() macro that may trigger a kernel WARNING depending on the kconfig. But since the error condition can be triggered by a weird user space parameter passed to OSS layer, we shouldn't give the kernel stack trace just for that. As it's a normal error condition, let's remove snd_BUG_ON() macro usage there.
--- sound/core/oss/pcm_plugin.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/core/oss/pcm_plugin.c +2 -2
@@ -111,7 +111,7 @@ int snd_pcm_plug_alloc(struct snd_pcm_suwhile (plugin->next) {if (plugin->dst_frames) frames = plugin->dst_frames (plugin, frames); -if (snd_BUG_ON ((snd_pcm_sframes_t )frames <=0 )) +if ((snd_pcm_sframes_t )frames <=0 )return -ENXIO ; plugin = plugin->next; err =snd_pcm_plugin_alloc (plugin, frames);
@@ -123,7 +123,7 @@ int snd_pcm_plug_alloc(struct snd_pcm_suwhile (plugin->prev) {if (plugin->src_frames) frames = plugin->src_frames (plugin, frames); -if (snd_BUG_ON ((snd_pcm_sframes_t )frames <=0 )) +if ((snd_pcm_sframes_t )frames <=0 )return -ENXIO ; plugin = plugin->prev; err =snd_pcm_plugin_alloc (plugin, frames);
Greg Kroah-Hartman
maintainerPATCH 60/119 tty: fix compat TIOCGSERIAL leaking uninitialized memory
In reply to Greg Kroah-HartmanFrom: Eric Biggers <[email protected]>
commit 17329563a97df3ba474eca5037c1336e46e14ff8 upstream.
Commit 77654350306a ("take compat TIOC[SG]SERIAL treatment into tty_compat_ioctl()") changed the compat version of TIOCGSERIAL to start copying a whole 'serial_struct32' to userspace rather than individual fields, but failed to initialize all padding and fields -- namely the hole after the 'iomem_reg_shift' field, and the 'reserved' field.
Fix this by initializing the struct to zero.
[v2: use sizeof, and convert the adjacent line for consistency.]
--- drivers/tty/tty_io.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/tty/tty_io.c +3 -1
@@ -2734,7 +2734,9 @@ static int compat_tty_tiocgserial(structstruct serial_struct32 v32;struct serial_struct v;int err; -memset (&v,0 ,sizeof (struct serial_struct )); + +memset (&v,0 ,sizeof (v)); +memset (&v32,0 ,sizeof (v32));if (!tty->ops->set_serial)return -ENOTTY ;
Greg Kroah-Hartman
maintainerPATCH 62/119 iio: chemical: sps30: fix missing triggered buffer dependency
In reply to Greg Kroah-HartmanFrom: Petr Štetiar <[email protected]>
commit 016a8845f6da65b2203f102f192046fbb624e250 upstream.
SPS30 uses triggered buffer, but the dependency is not specified in the Kconfig file. Fix this by selecting IIO_BUFFER and IIO_TRIGGERED_BUFFER config symbols.
--- drivers/iio/chemical/Kconfig | 2 ++ 1 file changed, 2 insertions(+)
drivers/iio/chemical/Kconfig +2 -0
@@ -91,6 +91,8 @@ config SPS30 tristate "SPS30 particulate matter sensor" depends on I2C select CRC8 + select IIO_BUFFER + select IIO_TRIGGERED_BUFFER help Say Y here to build support for the Sensirion SPS30 particulate matter sensor.
Greg Kroah-Hartman
maintainerPATCH 63/119 iio: st_sensors: remap SMO8840 to LIS2DH12
In reply to Greg Kroah-HartmanFrom: Wen-chien Jesse Sung <[email protected]>
commit e43d110cdc206b6df4dd438cd10c81d1da910aad upstream.
According to ST, the HID is for LIS2DH12.
--- drivers/iio/accel/st_accel_i2c.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/accel/st_accel_i2c.c +1 -1
@@ -114,7 +114,7 @@ MODULE_DEVICE_TABLE(of, st_accel_of_matc#ifdef CONFIG_ACPI static const struct acpi_device_id st_accel_acpi_match[] = { - {"SMO8840" , (kernel_ulong_t )LNG2DM_ACCEL_DEV_NAME }, + {"SMO8840" , (kernel_ulong_t )LIS2DH12_ACCEL_DEV_NAME }, {"SMO8A90" , (kernel_ulong_t )LNG2DM_ACCEL_DEV_NAME }, { }, };
Greg Kroah-Hartman
maintainerPATCH 64/119 iio: trigger: stm32-timer: disable master mode when stopping
In reply to Greg Kroah-HartmanFrom: Fabrice Gasnier <[email protected]>
commit 29e8c8253d7d5265f58122c0a7902e26df6c6f61 upstream.
Master mode should be disabled when stopping. This mainly impacts possible other use-case after timer has been stopped. Currently, master mode remains set (from start routine).
--- drivers/iio/trigger/stm32-timer-trigger.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
drivers/iio/trigger/stm32-timer-trigger.c +9 -2
@@ -161,7 +161,8 @@ static int stm32_timer_start(struct stm3return 0 ; } -static void stm32_timer_stop (struct stm32_timer_trigger *priv) +static void stm32_timer_stop (struct stm32_timer_trigger *priv, +struct iio_trigger *trig) {u32 ccer, cr1;
@@ -179,6 +180,12 @@ static void stm32_timer_stop(struct stm3regmap_write (priv->regmap,TIM_PSC ,0 );regmap_write (priv->regmap,TIM_ARR ,0 ); +/* Force disable master mode */ +if (stm32_timer_is_trgo2_name (trig->name)) +regmap_update_bits (priv->regmap,TIM_CR2 ,TIM_CR2_MMS2 ,0 ); +else +regmap_update_bits (priv->regmap,TIM_CR2 ,TIM_CR2_MMS ,0 ); +/* Make sure that registers are updated */ regmap_update_bits (priv->regmap,TIM_EGR ,TIM_EGR_UG ,TIM_EGR_UG ); }
@@ -197,7 +204,7 @@ static ssize_t stm32_tt_store_frequency(return ret;if (freq ==0 ) { -stm32_timer_stop (priv); +stm32_timer_stop (priv, trig); }else { ret =stm32_timer_start (priv, trig, freq);if (ret)
Greg Kroah-Hartman
maintainerPATCH 67/119 iio: adc: stm32-dfsdm: fix sleep in atomic context
In reply to Greg Kroah-HartmanFrom: Olivier Moysan <[email protected]>
commit e19ac9d9a978f8238a85a28ed624094a497d5ae6 upstream.
This commit fixes the error message:
"BUG: sleeping function called from invalid context at kernel/irq/chip.c" Suppress the trigger irq handler. Make the buffer transfers directly in DMA callback, instead.
Push buffers without timestamps, as timestamps are not supported in DFSDM driver.
--- drivers/iio/adc/stm32-dfsdm-adc.c | 43 ++++++++------------------------------ 1 file changed, 10 insertions(+), 33 deletions(-)
drivers/iio/adc/stm32-dfsdm-adc.c +10 -33
@@ -842,31 +842,6 @@ static inline void stm32_dfsdm_process_d } } -static irqreturn_t stm32_dfsdm_adc_trigger_handler (int irq,void *p) -{ -struct iio_poll_func *pf = p; -struct iio_dev *indio_dev = pf->indio_dev; -struct stm32_dfsdm_adc *adc =iio_priv (indio_dev); -int available =stm32_dfsdm_adc_dma_residue (adc); - -while (available >= indio_dev->scan_bytes) { -s32 *buffer = (s32 *)&adc->rx_buf[adc->bufi]; - -stm32_dfsdm_process_data (adc, buffer); - -iio_push_to_buffers_with_timestamp (indio_dev, buffer, - pf->timestamp); - available -= indio_dev->scan_bytes; - adc->bufi += indio_dev->scan_bytes; -if (adc->bufi >= adc->buf_sz) - adc->bufi =0 ; - } - -iio_trigger_notify_done (indio_dev->trig); - -return IRQ_HANDLED ; -} -static void stm32_dfsdm_dma_buffer_done (void *data) {struct iio_dev *indio_dev = data;
@@ -874,11 +849,6 @@ static void stm32_dfsdm_dma_buffer_done(int available =stm32_dfsdm_adc_dma_residue (adc);size_t old_pos; -if (indio_dev->currentmode &INDIO_BUFFER_TRIGGERED ) { -iio_trigger_poll_chained (indio_dev->trig); -return ; - } -/* * FIXME: In Kernel interface does not support cyclic DMA buffer,and * offers only an interface to push data samples per samples.
@@ -906,7 +876,15 @@ static void stm32_dfsdm_dma_buffer_done( adc->bufi =0 ; old_pos =0 ; } -/* regular iio buffer without trigger */ +/* +* In DMA mode the trigger services of IIO are not used +* (e.g. no call to iio_trigger_poll). +* Calling irq handler associated to the hardware trigger is not +* relevant as the conversions have already been done. Data +* transfers are performed directly in DMA callback instead. +* This implementation avoids to call trigger irq handler that +* may sleep, in an atomic context (DMA irq handler context). +*/ if (adc->dev_data->type ==DFSDM_IIO )iio_push_to_buffers (indio_dev, buffer); }
@@ -1517,8 +1495,7 @@ static int stm32_dfsdm_adc_init(struct i } ret =iio_triggered_buffer_setup (indio_dev, - &iio_pollfunc_store_time, - &stm32_dfsdm_adc_trigger_handler, + &iio_pollfunc_store_time,NULL , &stm32_dfsdm_buffer_setup_ops);if (ret) {stm32_dfsdm_dma_release (indio_dev);
Greg Kroah-Hartman
maintainerPATCH 69/119 iio: light: vcnl4000: update sampling periods for vcnl4200
In reply to Greg Kroah-HartmanFrom: Tomas Novotny <[email protected]>
commit b42aa97ed5f1169cfd37175ef388ea62ff2dcf43 upstream.
Vishay has published a new version of "Designing the VCNL4200 Into an Application" application note in October 2019. The new version specifies that there is +-20% of part to part tolerance. This explains the drift seen during experiments. The proximity pulse width is also changed from 32us to 30us. According to the support, the tolerance also applies to ambient light.
So update the sampling periods. As the reading is blocking, current users may notice slightly longer response time.
--- drivers/iio/light/vcnl4000.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/iio/light/vcnl4000.c +4 -4
@@ -167,10 +167,10 @@ static int vcnl4200_init(struct vcnl4000 data->vcnl4200_ps.reg =VCNL4200_PS_DATA ;switch (id) {case VCNL4200_PROD_ID : -/* Integration time is 50ms, but the experiments */ -/* show 54ms in total. */ - data->vcnl4200_al.sampling_rate =ktime_set (0 ,54000 *1000 ); - data->vcnl4200_ps.sampling_rate =ktime_set (0 ,4200 *1000 ); +/* Default wait time is 50ms, add 20% tolerance. */ + data->vcnl4200_al.sampling_rate =ktime_set (0 ,60000 *1000 ); +/* Default wait time is 4.8ms, add 20% tolerance. */ + data->vcnl4200_ps.sampling_rate =ktime_set (0 ,5760 *1000 ); data->al_scale =24000 ;break ;case VCNL4040_PROD_ID :
Greg Kroah-Hartman
maintainerPATCH 71/119 mmc: rtsx_pci: Fix support for speed-modes that relies on tuning
In reply to Greg Kroah-HartmanFrom: Ricky Wu <[email protected]>
commit 4686392c32361c97e8434adf9cc77ad7991bfa81 upstream.
The TX/RX register should not be treated the same way to allow for better support of tuning. Fix this by using a default initial value for TX.
--- drivers/misc/cardreader/rts5227.c | 2 +- drivers/misc/cardreader/rts5249.c | 2 ++ drivers/misc/cardreader/rts5260.c | 2 +- drivers/misc/cardreader/rts5261.c | 2 +- drivers/mmc/host/rtsx_pci_sdmmc.c | 13 ++++++++----- 5 files changed, 13 insertions(+), 8 deletions(-)
drivers/misc/cardreader/rts5227.c +1 -1
@@ -394,7 +394,7 @@ static const struct pcr_ops rts522a_pcr_void rts522a_init_params (struct rtsx_pcr *pcr) {rts5227_init_params (pcr); - + pcr->tx_initial_phase =SET_CLOCK_PHASE (20 ,20 ,11 ); pcr->reg_pm_ctrl3 =RTS522A_PM_CTRL3 ; pcr->option.ocp_en =1 ;
drivers/misc/cardreader/rts5249.c +2 -0
@@ -618,6 +618,7 @@ static const struct pcr_ops rts524a_pcr_void rts524a_init_params (struct rtsx_pcr *pcr) {rts5249_init_params (pcr); + pcr->tx_initial_phase =SET_CLOCK_PHASE (27 ,29 ,11 ); pcr->option.ltr_l1off_sspwrgate =LTR_L1OFF_SSPWRGATE_5250_DEF ; pcr->option.ltr_l1off_snooze_sspwrgate =LTR_L1OFF_SNOOZE_SSPWRGATE_5250_DEF ;
@@ -733,6 +734,7 @@ static const struct pcr_ops rts525a_pcr_void rts525a_init_params (struct rtsx_pcr *pcr) {rts5249_init_params (pcr); + pcr->tx_initial_phase =SET_CLOCK_PHASE (25 ,29 ,11 ); pcr->option.ltr_l1off_sspwrgate =LTR_L1OFF_SSPWRGATE_5250_DEF ; pcr->option.ltr_l1off_snooze_sspwrgate =LTR_L1OFF_SNOOZE_SSPWRGATE_5250_DEF ;
drivers/misc/cardreader/rts5260.c +1 -1
@@ -662,7 +662,7 @@ void rts5260_init_params(struct rtsx_pcr pcr->sd30_drive_sel_1v8 =CFG_DRIVER_TYPE_B ; pcr->sd30_drive_sel_3v3 =CFG_DRIVER_TYPE_B ; pcr->aspm_en =ASPM_L1_EN ; - pcr->tx_initial_phase =SET_CLOCK_PHASE (1 ,29 ,16 ); + pcr->tx_initial_phase =SET_CLOCK_PHASE (27 ,29 ,11 ); pcr->rx_initial_phase =SET_CLOCK_PHASE (24 ,6 ,5 ); pcr->ic_version =rts5260_get_ic_version (pcr);
drivers/misc/cardreader/rts5261.c +1 -1
@@ -763,7 +763,7 @@ void rts5261_init_params(struct rtsx_pcr pcr->sd30_drive_sel_1v8 =CFG_DRIVER_TYPE_B ; pcr->sd30_drive_sel_3v3 =CFG_DRIVER_TYPE_B ; pcr->aspm_en =ASPM_L1_EN ; - pcr->tx_initial_phase =SET_CLOCK_PHASE (20 ,27 ,16 ); + pcr->tx_initial_phase =SET_CLOCK_PHASE (27 ,27 ,11 ); pcr->rx_initial_phase =SET_CLOCK_PHASE (24 ,6 ,5 ); pcr->ic_version =rts5261_get_ic_version (pcr);
drivers/mmc/host/rtsx_pci_sdmmc.c +8 -5
@@ -606,19 +606,22 @@ static int sd_change_phase(struct realte u8 sample_point, bool rx) {struct rtsx_pcr *pcr = host->pcr; - +u16 SD_VP_CTL =0 ;dev_dbg (sdmmc_dev (host),"%s(%s): sample_point = %d\n" , __func__, rx ?"RX" :"TX" , sample_point);rtsx_pci_write_register (pcr,CLK_CTL ,CHANGE_CLK ,CHANGE_CLK ); -if (rx) +if (rx) { +SD_VP_CTL =SD_VPRX_CTL ;rtsx_pci_write_register (pcr,SD_VPRX_CTL ,PHASE_SELECT_MASK , sample_point); -else + }else { +SD_VP_CTL =SD_VPTX_CTL ;rtsx_pci_write_register (pcr,SD_VPTX_CTL ,PHASE_SELECT_MASK , sample_point); -rtsx_pci_write_register (pcr,SD_VPCLK0_CTL ,PHASE_NOT_RESET ,0 ); -rtsx_pci_write_register (pcr,SD_VPCLK0_CTL ,PHASE_NOT_RESET , + } +rtsx_pci_write_register (pcr,SD_VP_CTL ,PHASE_NOT_RESET ,0 ); +rtsx_pci_write_register (pcr,SD_VP_CTL ,PHASE_NOT_RESET ,PHASE_NOT_RESET );rtsx_pci_write_register (pcr,CLK_CTL ,CHANGE_CLK ,0 );rtsx_pci_write_register (pcr,SD_CFG1 ,SD_ASYNC_FIFO_NOT_RST ,0 );
Greg Kroah-Hartman
maintainerPATCH 72/119 mmc: sdhci-of-at91: fix cd-gpios for SAMA5D2
In reply to Greg Kroah-HartmanFrom: Michał Mirosław <[email protected]>
commit 53dd0a7cd65edc83b0c243d1c08377c8b876b2ee upstream.
SAMA5D2x doesn't drive CMD line if GPIO is used as CD line (at least SAMA5D27 doesn't). Fix this by forcing card-detect in the module if module-controlled CD is not used.
Fixed commit addresses the problem only for non-removable cards. This amends it to also cover gpio-cd case.
--- drivers/mmc/host/sdhci-of-at91.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/mmc/host/sdhci-of-at91.c +6 -2
@@ -125,7 +125,8 @@ static void sdhci_at91_reset(struct sdhcsdhci_reset (host, mask); -if (host->mmc->caps &MMC_CAP_NONREMOVABLE ) +if ((host->mmc->caps &MMC_CAP_NONREMOVABLE ) + ||mmc_gpio_get_cd (host->mmc) >=0 )sdhci_at91_set_force_card_detect (host);if (priv->cal_always_on && (mask &SDHCI_RESET_ALL ))
@@ -416,8 +417,11 @@ static int sdhci_at91_probe(struct platf* detection procedure using the SDMCC_CD signal is bypassed. * This bit is reset when a software reset for all command is performed * so we need to implement our own reset function to set back this bit. +* +* WA: SAMA5D2 doesn't drive CMD if using CD GPIO line. */ -if (host->mmc->caps &MMC_CAP_NONREMOVABLE ) +if ((host->mmc->caps &MMC_CAP_NONREMOVABLE ) + ||mmc_gpio_get_cd (host->mmc) >=0 )sdhci_at91_set_force_card_detect (host);pm_runtime_put_autosuspend (&pdev->dev);
Greg Kroah-Hartman
maintainerPATCH 74/119 mmc: sdhci-acpi: Switch signal voltage back to 3.3V on suspend on external microSD on Lenovo Miix 320
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit 84d49b3d08a1d33690cc159036f381c31c27c17b upstream.
Based on a sample of 7 DSDTs from Cherry Trail devices using an AXP288 PMIC depending on the design one of 2 possible LDOs on the PMIC is used for the MMC signalling voltage, either DLDO3 or GPIO1LDO (GPIO1 pin in low noise LDO mode).
The Lenovo Miix 320-10ICR uses GPIO1LDO in the SHC1 ACPI device's DSM methods to set 3.3 or 1.8 signalling voltage and this appears to work as advertised, so presumably the device is actually using GPIO1LDO for the external microSD signalling voltage.
But this device has a bug in the _PS0 method of the SHC1 ACPI device, the DSM remembers the last set signalling voltage and the _PS0 restores this after a (runtime) suspend-resume cycle, but it "restores" the voltage on DLDO3 instead of setting it on GPIO1LDO as the DSM method does. DLDO3 is used for the LCD and setting it to 1.8V causes the LCD to go black.
This commit works around this issue by calling the Intel DSM to reset the signal voltage to 3.3V after the host has been runtime suspended. This will make the _PS0 method reprogram the DLDO3 voltage to 3.3V, which leaves it at its original setting fixing the LCD going black.
This commit adds and uses a DMI quirk mechanism to only trigger this workaround on the Lenovo Miix 320 while leaving the behavior of the driver unchanged on other devices.
--- drivers/mmc/host/sdhci-acpi.c | 68 ++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 66 insertions(+), 2 deletions(-)
drivers/mmc/host/sdhci-acpi.c +66 -2
@@ -23,6 +23,7 @@#include <linux/pm.h> #include <linux/pm_runtime.h> #include <linux/delay.h> +#include <linux/dmi.h> #include <linux/mmc/host.h> #include <linux/mmc/pm.h>
@@ -72,9 +73,15 @@ struct sdhci_acpi_host {const struct sdhci_acpi_slot *slot;struct platform_device *pdev;bool use_runtime_pm; +bool is_intel; +bool reset_signal_volt_on_suspend;unsigned long private[0 ]____cacheline_aligned ; }; +enum { +DMI_QUIRK_RESET_SD_SIGNAL_VOLT_ON_SUSP =BIT (0 ), +}; +static inline void *sdhci_acpi_priv (struct sdhci_acpi_host *c) {return (void *)c->private;
@@ -391,6 +398,8 @@ static int intel_probe_slot(struct platf host->mmc_host_ops.start_signal_voltage_switch = intel_start_signal_voltage_switch; + c->is_intel = true; +return 0 ; }
@@ -647,6 +656,24 @@ static const struct acpi_device_id sdhci };MODULE_DEVICE_TABLE (acpi, sdhci_acpi_ids); +static const struct dmi_system_id sdhci_acpi_quirks[] = { + { +/* +* The Lenovo Miix 320-10ICR has a bug in the _PS0 method of +* the SHC1 ACPI device, this bug causes it to reprogram the +* wrong LDO (DLDO3) to 1.8V if 1.8V modes are used and the +* card is (runtime) suspended + resumed. DLDO3 is used for +* the LCD and setting it to 1.8V causes the LCD to go black. +*/ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"LENOVO" ), +DMI_MATCH (DMI_PRODUCT_VERSION ,"Lenovo MIIX 320-10ICR" ), + }, + .driver_data = (void *)DMI_QUIRK_RESET_SD_SIGNAL_VOLT_ON_SUSP , + }, + {}/* Terminating entry */ +}; +static const struct sdhci_acpi_slot *sdhci_acpi_get_slot (struct acpi_device *adev) {const struct sdhci_acpi_uid_slot *u;
@@ -663,17 +690,23 @@ static int sdhci_acpi_probe(struct platfstruct device *dev = &pdev->dev;const struct sdhci_acpi_slot *slot;struct acpi_device *device, *child; +const struct dmi_system_id *id;struct sdhci_acpi_host *c;struct sdhci_host *host;struct resource *iomem;resource_size_t len;size_t priv_size; +int quirks =0 ;int err; device =ACPI_COMPANION (dev);if (!device)return -ENODEV ; + id =dmi_first_match (sdhci_acpi_quirks); +if (id) + quirks = (long )id->driver_data; + slot =sdhci_acpi_get_slot (device);/* Power on the SDHCI controller and its children */
@@ -759,6 +792,9 @@ static int sdhci_acpi_probe(struct platfdev_warn (dev,"failed to setup card detect gpio\n" ); c->use_runtime_pm = false; } + +if (quirks &DMI_QUIRK_RESET_SD_SIGNAL_VOLT_ON_SUSP ) + c->reset_signal_volt_on_suspend = true; } err =sdhci_setup_host (host);
@@ -823,17 +859,39 @@ static int sdhci_acpi_remove(struct platreturn 0 ; } +static void __maybe_unused sdhci_acpi_reset_signal_voltage_if_needed ( +struct device *dev) +{ +struct sdhci_acpi_host *c =dev_get_drvdata (dev); +struct sdhci_host *host = c->host; + +if (c->is_intel && c->reset_signal_volt_on_suspend && + host->mmc->ios.signal_voltage !=MMC_SIGNAL_VOLTAGE_330 ) { +struct intel_host *intel_host =sdhci_acpi_priv (c); +unsigned int fn =INTEL_DSM_V33_SWITCH ; +u32 result =0 ; + +intel_dsm (intel_host, dev, fn, &result); + } +} +#ifdef CONFIG_PM_SLEEP static int sdhci_acpi_suspend (struct device *dev) {struct sdhci_acpi_host *c =dev_get_drvdata (dev);struct sdhci_host *host = c->host; +int ret;if (host->tuning_mode !=SDHCI_TUNING_MODE_3 )mmc_retune_needed (host->mmc); -return sdhci_suspend_host (host); + ret =sdhci_suspend_host (host); +if (ret) +return ret; + +sdhci_acpi_reset_signal_voltage_if_needed (dev); +return 0 ; }static int sdhci_acpi_resume (struct device *dev)
@@ -853,11 +911,17 @@ static int sdhci_acpi_runtime_suspend(st {struct sdhci_acpi_host *c =dev_get_drvdata (dev);struct sdhci_host *host = c->host; +int ret;if (host->tuning_mode !=SDHCI_TUNING_MODE_3 )mmc_retune_needed (host->mmc); -return sdhci_runtime_suspend_host (host); + ret =sdhci_runtime_suspend_host (host); +if (ret) +return ret; + +sdhci_acpi_reset_signal_voltage_if_needed (dev); +return 0 ; }static int sdhci_acpi_runtime_resume (struct device *dev)
Greg Kroah-Hartman
maintainerPATCH 73/119 mmc: sdhci-cadence: set SDHCI_QUIRK2_PRESET_VALUE_BROKEN for UniPhier
In reply to Greg Kroah-HartmanFrom: Masahiro Yamada <[email protected]>
commit 18b587b45c13bb6a07ed0edac15f06892593d07a upstream.
The SDHCI_PRESET_FOR_* registers are not set for the UniPhier platform integration. (They are all read as zeros).
Set the SDHCI_QUIRK2_PRESET_VALUE_BROKEN quirk flag. Otherwise, the High Speed DDR mode on the eMMC controller (MMC_TIMING_MMC_DDR52) would not work.
I split the platform data to give no impact to other platforms, although the UniPhier platform is currently only the upstream user of this IP.
The SDHCI_QUIRK2_PRESET_VALUE_BROKEN flag is set if the compatible string matches to "socionext,uniphier-sd4hc".
--- drivers/mmc/host/sdhci-cadence.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-)
drivers/mmc/host/sdhci-cadence.c +16 -2
@@ -11,6 +11,7 @@#include <linux/mmc/host.h> #include <linux/mmc/mmc.h> #include <linux/of.h> +#include <linux/of_device.h> #include "sdhci-pltfm.h"
@@ -235,6 +236,11 @@ static const struct sdhci_ops sdhci_cdns .set_uhs_signaling = sdhci_cdns_set_uhs_signaling, }; +static const struct sdhci_pltfm_data sdhci_cdns_uniphier_pltfm_data = { + .ops = &sdhci_cdns_ops, + .quirks2 =SDHCI_QUIRK2_PRESET_VALUE_BROKEN , +}; +static const struct sdhci_pltfm_data sdhci_cdns_pltfm_data = { .ops = &sdhci_cdns_ops, };
@@ -334,6 +340,7 @@ static void sdhci_cdns_hs400_enhanced_ststatic int sdhci_cdns_probe (struct platform_device *pdev) {struct sdhci_host *host; +const struct sdhci_pltfm_data *data;struct sdhci_pltfm_host *pltfm_host;struct sdhci_cdns_priv *priv;struct clk *clk;
@@ -350,8 +357,12 @@ static int sdhci_cdns_probe(struct platfif (ret)return ret; + data =of_device_get_match_data (dev); +if (!data) + data = &sdhci_cdns_pltfm_data; + nr_phy_params =sdhci_cdns_phy_param_count (dev->of_node); - host =sdhci_pltfm_init (pdev, &sdhci_cdns_pltfm_data, + host =sdhci_pltfm_init (pdev, data,struct_size (priv, phy_params, nr_phy_params));if (IS_ERR (host)) { ret =PTR_ERR (host);
@@ -431,7 +442,10 @@ static const struct dev_pm_ops sdhci_cdn };static const struct of_device_id sdhci_cdns_match[] = { - { .compatible ="socionext,uniphier-sd4hc" }, + { + .compatible ="socionext,uniphier-sd4hc" , + .data = &sdhci_cdns_uniphier_pltfm_data, + }, { .compatible ="cdns,sd4hc" }, {/* sentinel */ } };
Greg Kroah-Hartman
maintainerPATCH 75/119 mmc: sdhci-acpi: Disable write protect detection on Acer Aspire Switch 10 (SW5-012)
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit 3397b251ea02003f47f0b1667f3fe30bb4f9ce90 upstream.
On the Acer Aspire Switch 10 (SW5-012) microSD slot always reports the card being write-protected even though microSD cards do not have a write-protect switch at all.
Add a new DMI_QUIRK_SD_NO_WRITE_PROTECT quirk which when set sets the MMC_CAP2_NO_WRITE_PROTECT flag on the controller for the external SD slot; and add a DMI quirk table entry which selects this quirk for the Acer SW5-012.
--- drivers/mmc/host/sdhci-acpi.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
drivers/mmc/host/sdhci-acpi.c +16 -0
@@ -80,6 +80,7 @@ struct sdhci_acpi_host {enum {DMI_QUIRK_RESET_SD_SIGNAL_VOLT_ON_SUSP =BIT (0 ), +DMI_QUIRK_SD_NO_WRITE_PROTECT =BIT (1 ), };static inline void *sdhci_acpi_priv (struct sdhci_acpi_host *c)
@@ -671,6 +672,18 @@ static const struct dmi_system_id sdhci_ }, .driver_data = (void *)DMI_QUIRK_RESET_SD_SIGNAL_VOLT_ON_SUSP, }, + { + /* + * The Acer Aspire Switch 10 (SW5-012) microSD slot always + * reports the card being write-protected even though microSD + * cards do not have a write-protect switch at all. + */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Acer"), + DMI_MATCH(DMI_PRODUCT_NAME, "Aspire SW5-012"), + }, + .driver_data = (void *)DMI_QUIRK_SD_NO_WRITE_PROTECT, + }, {} /* Terminating entry */ };
@@ -795,6 +808,9 @@ static int sdhci_acpi_probe(struct platfif (quirks &DMI_QUIRK_RESET_SD_SIGNAL_VOLT_ON_SUSP ) c->reset_signal_volt_on_suspend = true; + +if (quirks &DMI_QUIRK_SD_NO_WRITE_PROTECT ) + host->mmc->caps2 |=MMC_CAP2_NO_WRITE_PROTECT ; } err =sdhci_setup_host (host);
Greg Kroah-Hartman
maintainerPATCH 77/119 kbuild: Disable -Wpointer-to-enum-cast
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
commit 82f2bc2fcc0160d6f82dd1ac64518ae0a4dd183f upstream.
Clang's -Wpointer-to-int-cast deviates from GCC in that it warns when casting to enums. The kernel does this in certain places, such as device tree matches to set the version of the device being used, which allows the kernel to avoid using a gigantic union.
https://elixir.bootlin.com/linux/v5.5.8/source/drivers/ata/ahci_brcm.c#L428
https://elixir.bootlin.com/linux/v5.5.8/source/drivers/ata/ahci_brcm.c#L402
https://elixir.bootlin.com/linux/v5.5.8/source/include/linux/mod_devicetable.h#L264
To avoid a ton of false positive warnings, disable this particular part of the warning, which has been split off into a separate diagnostic so that the entire warning does not need to be turned off for clang. It will be visible under W=1 in case people want to go about fixing these easily and enabling the warning treewide.
--- scripts/Makefile.extrawarn | 1 + 1 file changed, 1 insertion(+)
scripts/Makefile.extrawarn +1 -0
@@ -48,6 +48,7 @@ KBUILD_CFLAGS += -Wno-initializer-overri KBUILD_CFLAGS += -Wno-format KBUILD_CFLAGS += -Wno-sign-compare KBUILD_CFLAGS += -Wno-format-zero-length +KBUILD_CFLAGS += $(call cc-disable-warning, pointer-to-enum-cast) endif endif
Greg Kroah-Hartman
maintainerPATCH 42/119 USB: Disable LPM on WD19s Realtek Hub
In reply to Greg Kroah-HartmanFrom: Kai-Heng Feng <[email protected]>
commit b63e48fb50e1ca71db301ca9082befa6f16c55c4 upstream.
Realtek Hub (0bda:0x0487) used in Dell Dock WD19 sometimes drops off the bus when bringing underlying ports from U3 to U0.
Disabling LPM on the hub during setting link state is not enough, so let's disable LPM completely for this hub.
--- drivers/usb/core/quirks.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/core/quirks.c +3 -0
@@ -378,6 +378,9 @@ static const struct usb_device_id usb_qu { USB_DEVICE(0x0b05, 0x17e0), .driver_info = USB_QUIRK_IGNORE_REMOTE_WAKEUP }, + /* Realtek hub in Dell WD19 (Type-C) */ + { USB_DEVICE(0x0bda, 0x0487), .driver_info = USB_QUIRK_NO_LPM }, + /* Action Semiconductor flash disk */ { USB_DEVICE(0x10d6, 0x2200), .driver_info = USB_QUIRK_STRING_FETCH_255 },
Greg Kroah-Hartman
maintainerPATCH 78/119 staging: rtl8188eu: Add device id for MERCUSYS MW150US v2
In reply to Greg Kroah-HartmanFrom: Michael Straube <[email protected]>
commit bb5786b9286c253557a0115bc8d21879e61b7b94 upstream.
This device was added to the stand-alone driver on github. Add it to the staging driver as well.
--- drivers/staging/rtl8188eu/os_dep/usb_intf.c | 1 + 1 file changed, 1 insertion(+)
drivers/staging/rtl8188eu/os_dep/usb_intf.c +1 -0
@@ -38,6 +38,7 @@ static const struct usb_device_id rtw_us {USB_DEVICE(0x2001, 0x331B)}, /* D-Link DWA-121 rev B1 */ {USB_DEVICE(0x2357, 0x010c)}, /* TP-Link TL-WN722N v2 */ {USB_DEVICE(0x2357, 0x0111)}, /* TP-Link TL-WN727N v5.21 */ + {USB_DEVICE(0x2C4E, 0x0102)}, /* MERCUSYS MW150US v2 */ {USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */ {USB_DEVICE(USB_VENDER_ID_REALTEK, 0xffef)}, /* Rosewill RNX-N150NUB */ {} /* Terminating entry */
Greg Kroah-Hartman
maintainerPATCH 79/119 staging: greybus: loopback_test: fix poll-mask build breakage
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 8f3675be4bda33adbdc1dd2ab3b6c76a7599a79e upstream.
A scripted conversion from userland POLL* to kernel EPOLL* constants mistakingly replaced the poll flags in the loopback_test tool, which therefore no longer builds.
--- drivers/staging/greybus/tools/loopback_test.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/staging/greybus/tools/loopback_test.c +2 -2
@@ -655,7 +655,7 @@ static int open_poll_files(struct loopba goto err; }read (t->fds[fds_idx].fd, &dummy,1 ); - t->fds[fds_idx].events =EPOLLERR |EPOLLPRI ; + t->fds[fds_idx].events =POLLERR |POLLPRI ; t->fds[fds_idx].revents =0 ; fds_idx++; }
@@ -748,7 +748,7 @@ static int wait_for_complete(struct loop }for (i =0 ; i < t->poll_count; i++) { -if (t->fds[i].revents &EPOLLPRI ) { +if (t->fds[i].revents &POLLPRI ) {/* Dummy read to clear the event */ read (t->fds[i].fd, &dummy,1 ); number_of_events++;
Greg Kroah-Hartman
maintainerPATCH 43/119 usb: quirks: add NO_LPM quirk for RTL8153 based ethernet adapters
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit 75d7676ead19b1fbb5e0ee934c9ccddcb666b68c upstream.
We have been receiving bug reports that ethernet connections over RTL8153 based ethernet adapters stops working after a while with errors like these showing up in dmesg when the ethernet stops working:
[12696.189484] r8152 6-1:1.0 enp10s0u1: Tx timeout [12702.333456] r8152 6-1:1.0 enp10s0u1: Tx timeout [12707.965422] r8152 6-1:1.0 enp10s0u1: Tx timeout
This has been reported on Dell WD15 docks, Belkin USB-C Express Dock 3.1 docks and with generic USB to ethernet dongles using the RTL8153 chipsets. Some users have tried adding usbcore.quirks=0bda:8153:k to the kernel commandline and all users who have tried this report that this fixes this.
Also note that we already have an existing NO_LPM quirk for the RTL8153 used in the Microsoft Surface Dock (where it uses a different usb-id).
This commit adds a NO_LPM quirk for the generic Realtek RTL8153 0bda:8153 usb-id, fixing the Tx timeout errors on these devices.
--- drivers/usb/core/quirks.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/core/quirks.c +3 -0
@@ -381,6 +381,9 @@ static const struct usb_device_id usb_qu/* Realtek hub in Dell WD19 (Type-C) */ { USB_DEVICE(0x0bda, 0x0487), .driver_info = USB_QUIRK_NO_LPM }, + /* Generic RTL8153 based ethernet adapters */ + { USB_DEVICE(0x0bda, 0x8153), .driver_info = USB_QUIRK_NO_LPM }, + /* Action Semiconductor flash disk */ { USB_DEVICE(0x10d6, 0x2200), .driver_info = USB_QUIRK_STRING_FETCH_255 },
Greg Kroah-Hartman
maintainerPATCH 44/119 USB: serial: option: add ME910G1 ECM composition 0x110b
In reply to Greg Kroah-HartmanFrom: Daniele Palmas <[email protected]>
commit 8e852a7953be2a6ee371449f7257fe15ace6a1fc upstream.
Add ME910G1 ECM composition 0x110b: tty, tty, tty, ecm
--- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/option.c +2 -0
@@ -1183,6 +1183,8 @@ static const struct usb_device_id option .driver_info = NCTRL(0) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x110a, 0xff), /* Telit ME910G1 */ .driver_info = NCTRL(0) | RSVD(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x110b, 0xff), /* Telit ME910G1 (ECM) */ + .driver_info = NCTRL(0) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910), .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4),
Greg Kroah-Hartman
maintainerPATCH 45/119 usb: chipidea: udc: fix sleeping function called from invalid context
In reply to Greg Kroah-HartmanFrom: Peter Chen <[email protected]>
commit 7368760d1bcdabf515c41a502568b489de3da683 upstream.
The code calls pm_runtime_get_sync with irq disabled, it causes below warning:
BUG: sleeping function called from invalid context at wer/runtime.c:1075 in_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: er/u8:1 CPU: 1 PID: 37 Comm: kworker/u8:1 Not tainted 20200304-00181-gbebfd2a5be98 #1588 Hardware name: NVIDIA Tegra SoC (Flattened Device Tree) Workqueue: ci_otg ci_otg_work
[<c010e8bd>] (unwind_backtrace) from [<c010a315>] 1/0x14)
[<c010a315>] (show_stack) from [<c0987d29>] 5/0x94)
[<c0987d29>] (dump_stack) from [<c013e77f>] +0xeb/0x118)
[<c013e77f>] (___might_sleep) from [<c052fa1d>] esume+0x75/0x78)
[<c052fa1d>] (__pm_runtime_resume) from [<c0627a33>] 0x23/0x74)
[<c0627a33>] (ci_udc_pullup) from [<c062fb93>] nect+0x2b/0xcc)
[<c062fb93>] (usb_gadget_connect) from [<c062769d>] _connect+0x59/0x104)
[<c062769d>] (ci_hdrc_gadget_connect) from [<c062778b>] ssion+0x43/0x48)
[<c062778b>] (ci_udc_vbus_session) from [<c062f997>] s_connect+0x17/0x9c)
[<c062f997>] (usb_gadget_vbus_connect) from [<c062634d>] bd/0x128)
[<c062634d>] (ci_otg_work) from [<c0134719>] rk+0x149/0x404)
[<c0134719>] (process_one_work) from [<c0134acb>] 0xf7/0x3bc)
[<c0134acb>] (worker_thread) from [<c0139433>] x118)
[<c0139433>] (kthread) from [<c01010bd>] (ret_from_fork+0x11/0x34)
--- drivers/usb/chipidea/udc.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/usb/chipidea/udc.c +4 -3
@@ -1530,18 +1530,19 @@ static const struct usb_ep_ops usb_ep_opstatic void ci_hdrc_gadget_connect (struct usb_gadget *_gadget,int is_active) { struct ci_hdrc *ci = container_of(_gadget, struct ci_hdrc, gadget); -unsigned long flags;if (is_active) {pm_runtime_get_sync (&_gadget->dev);hw_device_reset (ci); -spin_lock_irqsave (&ci->lock, flags); +spin_lock_irq (&ci->lock);if (ci->driver) {hw_device_state (ci, ci->ep0out->qh.dma);usb_gadget_set_state (_gadget,USB_STATE_POWERED ); +spin_unlock_irq (&ci->lock);usb_udc_vbus_handler (_gadget, true); + }else { +spin_unlock_irq (&ci->lock); } -spin_unlock_irqrestore (&ci->lock, flags); }else {usb_udc_vbus_handler (_gadget, false);if (ci->driver)
Greg Kroah-Hartman
maintainerPATCH 76/119 CIFS: fiemap: do not return EINVAL if get nothing
In reply to Greg Kroah-HartmanFrom: Murphy Zhou <[email protected]>
commit 979a2665eb6c603ddce0ab374041ab101827b2e7 upstream.
If we call fiemap on a truncated file with none blocks allocated, it makes sense we get nothing from this call. No output means no blocks have been counted, but the call succeeded. It's a valid response.
Simple example reproducer:xfs_io -f 'truncate 2M' -c 'fiemap -v' /cifssch/testfilexfs_io: ioctl(FS_IOC_FIEMAP) ["/cifssch/testfile"]: Invalid argument
--- fs/cifs/smb2ops.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/cifs/smb2ops.c +1 -1
@@ -3315,7 +3315,7 @@ static int smb3_fiemap(struct cifs_tconif (rc) goto out; -if (out_data_len <sizeof (struct file_allocated_range_buffer )) { +if (out_data_len && out_data_len <sizeof (struct file_allocated_range_buffer )) { rc = -EINVAL ; goto out; }
Greg Kroah-Hartman
maintainerPATCH 46/119 usb: host: xhci-plat: add a shutdown
In reply to Greg Kroah-HartmanFrom: Ran Wang <[email protected]>
commit b433e340e7565110b0ce9ca4b3e26f4b97a1decf upstream.
When loading new kernel via kexec, we need to shutdown host controller to avoid any un-expected memory accessing during new kernel boot.
--- drivers/usb/host/xhci-plat.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/host/xhci-plat.c +1 -0
@@ -445,6 +445,7 @@ MODULE_DEVICE_TABLE(acpi, usb_xhci_acpi_static struct platform_driver usb_xhci_driver = { .probe = xhci_plat_probe, .remove = xhci_plat_remove, + .shutdown = usb_hcd_platform_shutdown, .driver = { .name ="xhci-hcd" , .pm = &xhci_plat_pm_ops,
Greg Kroah-Hartman
maintainerPATCH 47/119 USB: serial: pl2303: add device-id for HP LD381
In reply to Greg Kroah-HartmanFrom: Scott Chen <[email protected]>
commit cecc113c1af0dd41ccf265c1fdb84dbd05e63423 upstream.
Add a device id for HP LD381 Display
LD381: 03f0:0f7f
--- drivers/usb/serial/pl2303.c | 1 + drivers/usb/serial/pl2303.h | 1 + 2 files changed, 2 insertions(+)
drivers/usb/serial/pl2303.c +1 -0
@@ -99,6 +99,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(SUPERIAL_VENDOR_ID, SUPERIAL_PRODUCT_ID) }, { USB_DEVICE(HP_VENDOR_ID, HP_LD220_PRODUCT_ID) }, { USB_DEVICE(HP_VENDOR_ID, HP_LD220TA_PRODUCT_ID) }, + { USB_DEVICE(HP_VENDOR_ID, HP_LD381_PRODUCT_ID) }, { USB_DEVICE(HP_VENDOR_ID, HP_LD960_PRODUCT_ID) }, { USB_DEVICE(HP_VENDOR_ID, HP_LD960TA_PRODUCT_ID) }, { USB_DEVICE(HP_VENDOR_ID, HP_LCM220_PRODUCT_ID) },
drivers/usb/serial/pl2303.h +1 -0
@@ -130,6 +130,7 @@#define HP_LM920_PRODUCT_ID 0x026b#define HP_TD620_PRODUCT_ID 0x0956#define HP_LD960_PRODUCT_ID 0x0b39 +#define HP_LD381_PRODUCT_ID 0x0f7f#define HP_LCM220_PRODUCT_ID 0x3139#define HP_LCM960_PRODUCT_ID 0x3239#define HP_LD220_PRODUCT_ID 0x3524
Greg Kroah-Hartman
maintainerPATCH 38/119 parse-maintainers: Mark as executable
In reply to Greg Kroah-HartmanFrom: Jonathan Neuschäfer <[email protected]>
[ Upstream commit 611d61f9ac99dc9e1494473fb90117a960a89dfa ]
This makes the script more convenient to run.
--- scripts/parse-maintainers.pl | 0 1 file changed, 0 insertions(+), 0 deletions(-) mode change 100644 => 100755 scripts/parse-maintainers.pl
scripts/parse-maintainers.pl +0 -0
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 81/119 intel_th: msu: Fix the unexpected state warning
In reply to Greg Kroah-HartmanFrom: Alexander Shishkin <[email protected]>
commit 885f123554bbdc1807ca25a374be6e9b3bddf4de upstream.
The unexpected state warning should only warn on illegal state transitions. Fix that.
--- drivers/hwtracing/intel_th/msu.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/hwtracing/intel_th/msu.c +4 -3
@@ -718,9 +718,6 @@ static int msc_win_set_lockout(struct msif (old != expect) { ret = -EINVAL ; -dev_warn_ratelimited (msc_dev (win->msc), -"expected lockout state %d, got %d\n" , - expect, old); goto unlock; }
@@ -741,6 +738,10 @@ unlock:/* from intel_th_msc_window_unlock(), don't warn if not locked */ if (expect ==WIN_LOCKED && old == new)return 0 ; + +dev_warn_ratelimited (msc_dev (win->msc), +"expected lockout state %d, got %d\n" , + expect, old); }return ret;
Greg Kroah-Hartman
maintainerPATCH 90/119 drm/lease: fix WARNING in idr_destroy
In reply to Greg Kroah-HartmanFrom: Qiujun Huang <[email protected]>
commit b216a8e7908cd750550c0480cf7d2b3a37f06954 upstream.
drm_lease_create takes ownership of leases. And leases will be released by drm_master_put.
drm_master_put
->drm_master_destroy
->idr_destroySo we needn't call idr_destroy again.
--- drivers/gpu/drm/drm_lease.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/drm_lease.c +2 -1
@@ -542,10 +542,12 @@ int drm_mode_create_lease_ioctl(struct d }DRM_DEBUG_LEASE ("Creating lease\n" ); +/* lessee will take the ownership of leases */ lessee =drm_lease_create (lessor, &leases);if (IS_ERR (lessee)) { ret =PTR_ERR (lessee); +idr_destroy (&leases); goto out_leases; }
@@ -580,7 +582,6 @@ out_lessee: out_leases:put_unused_fd (fd); -idr_destroy (&leases);DRM_DEBUG_LEASE ("drm_mode_create_lease_ioctl failed: %d\n" , ret);return ret;
Greg Kroah-Hartman
maintainerPATCH 91/119 stm class: sys-t: Fix the use of time_after()
In reply to Greg Kroah-HartmanFrom: Alexander Shishkin <[email protected]>
commit 283f87c0d5d32b4a5c22636adc559bca82196ed3 upstream.
The operands of time_after() are in a wrong order in both instances in the sys-t driver. Fix that.
--- drivers/hwtracing/stm/p_sys-t.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/hwtracing/stm/p_sys-t.c +3 -3
@@ -238,7 +238,7 @@ static struct configfs_attribute *sys_t_static inline bool sys_t_need_ts (struct sys_t_output *op) {if (op->node.ts_interval && -time_after (op->ts_jiffies + op->node.ts_interval, jiffies)) { +time_after (jiffies, op->ts_jiffies + op->node.ts_interval)) { op->ts_jiffies = jiffies;return true;
@@ -250,8 +250,8 @@ static inline bool sys_t_need_ts(structstatic bool sys_t_need_clock_sync (struct sys_t_output *op) {if (op->node.clocksync_interval && -time_after (op->clocksync_jiffies + op->node.clocksync_interval, - jiffies)) { +time_after (jiffies, + op->clocksync_jiffies + op->node.clocksync_interval)) { op->clocksync_jiffies = jiffies;return true;
Greg Kroah-Hartman
maintainerPATCH 92/119 memcg: fix NULL pointer dereference in __mem_cgroup_usage_unregister_event
In reply to Greg Kroah-HartmanFrom: Chunguang Xu <[email protected]>
commit 7d36665a5886c27ca4c4d0afd3ecc50b400f3587 upstream.
An eventfd monitors multiple memory thresholds of the cgroup, closes them, the kernel deletes all events related to this eventfd. Before all events are deleted, another eventfd monitors the memory threshold of this cgroup, leading to a crash:
BUG: kernel NULL pointer dereference, address: 0000000000000004
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD 800000033058e067 P4D 800000033058e067 PUD 3355ce067 PMD 0
Oops: 0002 [#1] SMP PTI
CPU: 2 PID: 14012 Comm: kworker/2:6 Kdump: loaded Not tainted 5.6.0-rc4 #3
Hardware name: LENOVO 20AWS01K00/20AWS01K00, BIOS GLET70WW (2.24 ) 05/21/2014
Workqueue: events memcg_event_remove
RIP: 0010:__mem_cgroup_usage_unregister_event+0xb3/0x190
RSP: 0018:ffffb47e01c4fe18 EFLAGS: 00010202
RAX: 0000000000000001 RBX: ffff8bb223a8a000 RCX: 0000000000000001
RDX: 0000000000000001 RSI: ffff8bb22fb83540 RDI: 0000000000000001
RBP: ffffb47e01c4fe48 R08: 0000000000000000 R09: 0000000000000010
R10: 000000000000000c R11: 071c71c71c71c71c R12: ffff8bb226aba880
R13: ffff8bb223a8a480 R14: 0000000000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8bb242680000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000004 CR3: 000000032c29c003 CR4: 00000000001606e0
Call Trace:
memcg_event_remove+0x32/0x90
process_one_work+0x172/0x380
worker_thread+0x49/0x3f0
kthread+0xf8/0x130
ret_from_fork+0x35/0x40
CR2: 0000000000000004We can reproduce this problem in the following ways:
1. We create a new cgroup subdirectory and a new eventfd, and then we monitor multiple memory thresholds of the cgroup through this eventfd.
2. closing this eventfd, and __mem_cgroup_usage_unregister_event () will be called multiple times to delete all events related to this eventfd.
The first time __mem_cgroup_usage_unregister_event() is called, the kernel will clear all items related to this eventfd in thresholds-> primary.
Since there is currently only one eventfd, thresholds-> primary becomes empty, so the kernel will set thresholds-> primary and hresholds-> spare to NULL. If at this time, the user creates a new eventfd and monitor the memory threshold of this cgroup, kernel will re-initialize thresholds-> primary.
Then when __mem_cgroup_usage_unregister_event () is called for the second time, because thresholds-> primary is not empty, the system will access thresholds-> spare, but thresholds-> spare is NULL, which will trigger a crash.
In general, the longer it takes to delete all events related to this eventfd, the easier it is to trigger this problem.
The solution is to check whether the thresholds associated with the eventfd has been cleared when deleting the event. If so, we do nothing.
--- mm/memcontrol.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
mm/memcontrol.c +8 -2
@@ -4027,7 +4027,7 @@ static void __mem_cgroup_usage_unregistestruct mem_cgroup_thresholds *thresholds;struct mem_cgroup_threshold_ary *new;unsigned long usage; -int i, j, size; +int i, j, size, entries;mutex_lock (&memcg->thresholds_lock);
@@ -4047,14 +4047,20 @@ static void __mem_cgroup_usage_unregiste__mem_cgroup_threshold (memcg, type == _MEMSWAP);/* Calculate new number of threshold */ - size =0 ; + size = entries =0 ;for (i =0 ; i < thresholds->primary->size; i++) {if (thresholds->primary->entries[i].eventfd != eventfd) size++; +else + entries++; } new = thresholds->spare; +/* If no items related to eventfd have been cleared, nothing to do */ +if (!entries) + goto unlock; +/* Set thresholds array to NULL if we don't have thresholds */ if (!size) {kfree (new);
Greg Kroah-Hartman
maintainerPATCH 93/119 mm, memcg: fix corruption on 64-bit divisor in memory.high throttling
In reply to Greg Kroah-HartmanFrom: Chris Down <[email protected]>
commit d397a45fc741c80c32a14e2de008441e9976f50c upstream.
Commit 0e4b01df8659 had a bunch of fixups to use the right division method. However, it seems that after all that it still wasn't right -- div_u64 takes a 32-bit divisor.
The headroom is still large (2^32 pages), so on mundane systems you won't hit this, but this should definitely be fixed.
--- mm/memcontrol.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/memcontrol.c +1 -1
@@ -2339,7 +2339,7 @@ void mem_cgroup_handle_over_high(void)*/ clamped_high =max (high,1UL ); - overage =div_u64 ((u64)(usage - high) <<MEMCG_DELAY_PRECISION_SHIFT , + overage =div64_u64 ((u64)(usage - high) <<MEMCG_DELAY_PRECISION_SHIFT , clamped_high); penalty_jiffies = ((u64 )overage * overage *HZ )
Greg Kroah-Hartman
maintainerPATCH 94/119 mm, memcg: throttle allocators based on ancestral memory.high
In reply to Greg Kroah-HartmanFrom: Chris Down <[email protected]>
commit e26733e0d0ec6798eca93daa300bc3f43616127f upstream.
Prior to this commit, we only directly check the affected cgroup's memory.high against its usage. However, it's possible that we are being reclaimed as a result of hitting an ancestor memory.high and should be penalised based on that, instead.
This patch changes memory.high overage throttling to use the largest overage in its ancestors when considering how many penalty jiffies to charge. This makes sure that we penalise poorly behaving cgroups in the same way regardless of at what level of the hierarchy memory.high was breached.
--- mm/memcontrol.c | 93 ++++++++++++++++++++++++++++++++++---------------------- 1 file changed, 58 insertions(+), 35 deletions(-)
mm/memcontrol.c +58 -35
@@ -2297,28 +2297,41 @@ static void high_work_func(struct work_s#define MEMCG_DELAY_SCALING_SHIFT 14/* -* Scheduled by try_charge() to be executed from the userland return path -* and reclaims memory over the high limit. +* Get the number of jiffies that we should penalise a mischievous cgroup which +* is exceeding its memory.high by checking both it and its ancestors. */ -void mem_cgroup_handle_over_high (void ) +static unsigned long calculate_high_delay (struct mem_cgroup *memcg, +unsigned int nr_pages) { -unsigned long usage, high, clamped_high; -unsigned long pflags; -unsigned long penalty_jiffies, overage; -unsigned int nr_pages = current->memcg_nr_pages_over_high; -struct mem_cgroup *memcg; +unsigned long penalty_jiffies; +u64 max_overage =0 ; -if (likely (!nr_pages)) -return ; +do { +unsigned long usage, high; +u64 overage; + + usage =page_counter_read (&memcg->memory); + high =READ_ONCE (memcg->high); + +/* +* Prevent division by 0 in overage calculation by acting as if +* it was a threshold of 1 page +*/ + high =max (high,1UL ); + + overage = usage - high; + overage <<=MEMCG_DELAY_PRECISION_SHIFT ; + overage =div64_u64 (overage, high); + +if (overage > max_overage) + max_overage = overage; + }while ((memcg =parent_mem_cgroup (memcg)) && + !mem_cgroup_is_root (memcg)); - memcg =get_mem_cgroup_from_mm (current->mm); -reclaim_high (memcg, nr_pages,GFP_KERNEL ); - current->memcg_nr_pages_over_high =0 ; +if (!max_overage) +return 0 ;/* -* memory.high is breached and reclaim is unable to keep up. Throttle -* allocators proactively to slow down excessive growth. -* * We use overage compared to memory.high to calculate the number of * jiffies to sleep (penalty_jiffies). Ideally this value should be * fairly lenient on small overages, and increasingly harsh when the
@@ -2326,24 +2339,9 @@ void mem_cgroup_handle_over_high(void)* its crazy behaviour, so we exponentially increase the delay based on * overage amount. */ - - usage =page_counter_read (&memcg->memory); - high =READ_ONCE (memcg->high); - -if (usage <= high) - goto out; - -/* -* Prevent division by 0 in overage calculation by acting as if it was a -* threshold of 1 page -*/ - clamped_high =max (high,1UL ); - - overage =div64_u64 ((u64)(usage - high) <<MEMCG_DELAY_PRECISION_SHIFT , - clamped_high); - - penalty_jiffies = ((u64 )overage * overage *HZ ) - >> (MEMCG_DELAY_PRECISION_SHIFT +MEMCG_DELAY_SCALING_SHIFT ); + penalty_jiffies = max_overage * max_overage *HZ ; + penalty_jiffies >>=MEMCG_DELAY_PRECISION_SHIFT ; + penalty_jiffies >>=MEMCG_DELAY_SCALING_SHIFT ;/* * Factor in the task's own contribution to the overage, such that four
@@ -2360,7 +2358,32 @@ void mem_cgroup_handle_over_high(void)* application moving forwards and also permit diagnostics, albeit * extremely slowly. */ - penalty_jiffies =min (penalty_jiffies,MEMCG_MAX_HIGH_DELAY_JIFFIES ); +return min (penalty_jiffies,MEMCG_MAX_HIGH_DELAY_JIFFIES ); +} + +/* +* Scheduled by try_charge() to be executed from the userland return path +* and reclaims memory over the high limit. +*/ +void mem_cgroup_handle_over_high (void ) +{ +unsigned long penalty_jiffies; +unsigned long pflags; +unsigned int nr_pages = current->memcg_nr_pages_over_high; +struct mem_cgroup *memcg; + +if (likely (!nr_pages)) +return ; + + memcg =get_mem_cgroup_from_mm (current->mm); +reclaim_high (memcg, nr_pages,GFP_KERNEL ); + current->memcg_nr_pages_over_high =0 ; + +/* +* memory.high is breached and reclaim is unable to keep up. Throttle +* allocators proactively to slow down excessive growth. +*/ + penalty_jiffies =calculate_high_delay (memcg, nr_pages);/* * Don't sleep if the amount of jiffies this memcg owes us is so low
Greg Kroah-Hartman
maintainerPATCH 95/119 mm/hotplug: fix hot remove failure in SPARSEMEM|!VMEMMAP case
In reply to Greg Kroah-HartmanFrom: Baoquan He <[email protected]>
commit d41e2f3bd54699f85b3d6f45abd09fa24a222cb9 upstream.
In section_deactivate(), pfn_to_page() doesn't work any more after ms->section_mem_map is resetting to NULL in SPARSEMEM|!VMEMMAP case. It causes a hot remove failure:
kernel BUG at mm/page_alloc.c:4806!
invalid opcode: 0000 [#1] SMP PTI
CPU: 3 PID: 8 Comm: kworker/u16:0 Tainted: G W 5.5.0-next-20200205+ #340 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015 Workqueue: kacpi_hotplug acpi_hotplug_work_fn RIP: 0010:free_pages+0x85/0xa0 Call Trace: __remove_pages+0x99/0xc0 arch_remove_memory+0x23/0x4d try_remove_memory+0xc8/0x130 __remove_memory+0xa/0x11 acpi_memory_device_remove+0x72/0x100 acpi_bus_trim+0x55/0x90 acpi_device_hotplug+0x2eb/0x3d0 acpi_hotplug_work_fn+0x1a/0x30 process_one_work+0x1a7/0x370 worker_thread+0x30/0x380 kthread+0x112/0x130 ret_from_fork+0x35/0x40
Let's move the ->section_mem_map resetting afterdepopulate_section_memmap() to fix it.
--- mm/sparse.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
mm/sparse.c +6 -2
@@ -744,6 +744,7 @@ static void section_deactivate(unsignedstruct mem_section *ms =__pfn_to_section (pfn);bool section_is_early =early_section (ms);struct page *memmap =NULL ; +bool empty;unsigned long *subsection_map = ms->usage ? &ms->usage->subsection_map[0 ] :NULL ;
@@ -774,7 +775,8 @@ static void section_deactivate(unsigned* For 2/ and 3/ the SPARSEMEM_VMEMMAP={y,n} cases are unified */ bitmap_xor (subsection_map, map, subsection_map,SUBSECTIONS_PER_SECTION ); -if (bitmap_empty (subsection_map,SUBSECTIONS_PER_SECTION )) { + empty =bitmap_empty (subsection_map,SUBSECTIONS_PER_SECTION ); +if (empty) {unsigned long section_nr =pfn_to_section_nr (pfn);/*
@@ -789,13 +791,15 @@ static void section_deactivate(unsigned ms->usage =NULL ; } memmap =sparse_decode_mem_map (ms->section_mem_map, section_nr); - ms->section_mem_map = (unsigned long )NULL ; }if (section_is_early && memmap)free_map_bootmem (memmap);else depopulate_section_memmap (pfn, nr_pages, altmap); + +if (empty) + ms->section_mem_map = (unsigned long )NULL ; } static struct page * __meminit section_activate(int nid, unsigned long pfn,
Greg Kroah-Hartman
maintainerPATCH 96/119 mm: do not allow MADV_PAGEOUT for CoW pages
In reply to Greg Kroah-HartmanFrom: Michal Hocko <[email protected]>
commit 12e967fd8e4e6c3d275b4c69c890adc838891300 upstream.
Jann has brought up a very interesting point [1]. While shared pages are excluded from MADV_PAGEOUT normally, CoW pages can be easily reclaimed that way. This can lead to all sorts of hard to debug problems. E.g. performance problems outlined by Daniel [2].
There are runtime environments where there is a substantial memory shared among security domains via CoW memory and a easy to reclaim way of that memory, which MADV_{COLD,PAGEOUT} offers, can lead to either performance degradation in for the parent process which might be more privileged or even open side channel attacks.
The feasibility of the latter is not really clear to me TBH but there is no real reason for exposure at this stage. It seems there is no real use case to depend on reclaiming CoW memory via madvise at this stage so it is much easier to simply disallow it and this is what this patch does. Put it simply MADV_{PAGEOUT,COLD} can operate only on the exclusively owned memory which is a straightforward semantic.
[1] http://lkml.kernel.org/r/CAG48ez0G3JkMq61gUmyQAaCq=_TwHbi1XKzWRooxZkv08PQKuw@mail.gmail.com
[2] http://lkml.kernel.org/r/CAKOZueua_v8jHCpmEtTB6f3i9e2YnmX4mqdYVWhV4E=Z-n+zRQ@mail.gmail.com
--- mm/madvise.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
mm/madvise.c +9 -3
@@ -335,12 +335,14 @@ static int madvise_cold_or_pageout_pte_r } page =pmd_page (orig_pmd); + +/* Do not interfere with other mappings of this page */ +if (page_mapcount (page) !=1 ) + goto huge_unlock; +if (next - addr !=HPAGE_PMD_SIZE ) {int err; -if (page_mapcount (page) !=1 ) - goto huge_unlock; -get_page (page);spin_unlock (ptl);lock_page (page);
@@ -426,6 +428,10 @@ regular_page:continue ; } +/* Do not interfere with other mappings of this page */ +if (page_mapcount (page) !=1 ) +continue ; +VM_BUG_ON_PAGE (PageTransCompound (page), page);if (pte_young (ptent)) {
Greg Kroah-Hartman
maintainerPATCH 97/119 epoll: fix possible lost wakeup on epoll_ctl() path
In reply to Greg Kroah-HartmanFrom: Roman Penyaev <[email protected]>
commit 1b53734bd0b2feed8e7761771b2e76fc9126ea0c upstream.
This fixes possible lost wakeup introduced by commit a218cc491420. Originally modifications to ep->wq were serialized by ep->wq.lock, but in commit a218cc491420 ("epoll: use rwlock in order to reduce ep_poll_callback() contention") a new rw lock was introduced in order to relax fd event path, i.e. callers of ep_poll_callback() function.
After the change ep_modify and ep_insert (both are called on epoll_ctl() path) were switched to ep->lock, but ep_poll (epoll_wait) was using ep->wq.lock on wqueue list modification.
The bug doesn't lead to any wqueue list corruptions, because wake up path and list modifications were serialized by ep->wq.lock internally, but actual waitqueue_active() check prior wake_up() call can be reordered with modifications of ep ready list, thus wake up can be lost.
And yes, can be healed by explicit smp_mb():
list_add_tail(&epi->rdlink, &ep->rdllist);
smp_mb();
if (waitqueue_active(&ep->wq))
wake_up(&ep->wp);
But let's make it simple, thus current patch replaces ep->wq.lock with the ep->lock for wqueue modifications, thus wake up path always observes activeness of the wqueue correcty.
--- fs/eventpoll.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
fs/eventpoll.c +4 -4
@@ -1860,9 +1860,9 @@ fetch_events: waiter = true;init_waitqueue_entry (&wait, current); -spin_lock_irq (&ep->wq.lock); +write_lock_irq (&ep->lock);__add_wait_queue_exclusive (&ep->wq, &wait); -spin_unlock_irq (&ep->wq.lock); +write_unlock_irq (&ep->lock); }for (;;) {
@@ -1910,9 +1910,9 @@ send_events: goto fetch_events;if (waiter) { -spin_lock_irq (&ep->wq.lock); +write_lock_irq (&ep->lock);__remove_wait_queue (&ep->wq, &wait); -spin_unlock_irq (&ep->wq.lock); +write_unlock_irq (&ep->lock); }return res;
Greg Kroah-Hartman
maintainerPATCH 98/119 mm: slub: be more careful about the double cmpxchg of freelist
In reply to Greg Kroah-HartmanFrom: Linus Torvalds <[email protected]>
commit 5076190daded2197f62fe92cf69674488be44175 upstream.
This is just a cleanup addition to Jann's fix to properly update the transaction ID for the slub slowpath in commit fd4d9c7d0c71 ("mm: slub:
add missing TID bump..").
The transaction ID is what protects us against any concurrent accesses, but we should really also make sure to make the 'freelist' comparison itself always use the same freelist value that we then used as the new next free pointer.
Jann points out that if we do all of this carefully, we could skip the transaction ID update for all the paths that only remove entries from the lists, and only update the TID when adding entries (to avoid the ABA issue with cmpxchg and list handling re-adding a previously seen value).
But this patch just does the "make sure to cmpxchg the same value we used" rather than then try to be clever.
--- mm/slub.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
mm/slub.c +4 -2
@@ -2978,11 +2978,13 @@ redo:barrier ();if (likely (page == c->page)) { -set_freepointer (s, tail_obj, c->freelist); +void **freelist =READ_ONCE (c->freelist); + +set_freepointer (s, tail_obj, freelist);if (unlikely (!this_cpu_cmpxchg_double ( s->cpu_slab->freelist, s->cpu_slab->tid, - c->freelist, tid, + freelist, tid, head,next_tid (tid)))) {note_cmpxchg_failure ("slab_free" , s, tid);
Greg Kroah-Hartman
maintainerPATCH 99/119 mm, slub: prevent kmalloc_node crashes and memory leaks
In reply to Greg Kroah-HartmanFrom: Vlastimil Babka <[email protected]>
commit 0715e6c516f106ed553828a671d30ad9a3431536 upstream.
Sachin reports [1] a crash in SLUB __slab_alloc():
BUG: Kernel NULL pointer dereference on read at 0x000073b0
Faulting instruction address: 0xc0000000003d55f4
Oops: Kernel access of bad area, sig: 11 [#1]
LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries
Modules linked in:
CPU: 19 PID: 1 Comm: systemd Not tainted 5.6.0-rc2-next-20200218-autotest #1
NIP: c0000000003d55f4 LR: c0000000003d5b94 CTR: 0000000000000000
REGS: c0000008b37836d0 TRAP: 0300 Not tainted (5.6.0-rc2-next-20200218-autotest)
MSR: 8000000000009033 <SF,EE,ME,IR,DR,RI,LE> CR: 24004844 XER: 00000000
CFAR: c00000000000dec4 DAR: 00000000000073b0 DSISR: 40000000 IRQMASK: 1
GPR00: c0000000003d5b94 c0000008b3783960 c00000000155d400 c0000008b301f500
GPR04: 0000000000000dc0 0000000000000002 c0000000003443d8 c0000008bb398620
GPR08: 00000008ba2f0000 0000000000000001 0000000000000000 0000000000000000
GPR12: 0000000024004844 c00000001ec52a00 0000000000000000 0000000000000000
GPR16: c0000008a1b20048 c000000001595898 c000000001750c18 0000000000000002
GPR20: c000000001750c28 c000000001624470 0000000fffffffe0 5deadbeef0000122
GPR24: 0000000000000001 0000000000000dc0 0000000000000002 c0000000003443d8
GPR28: c0000008b301f500 c0000008bb398620 0000000000000000 c00c000002287180
NIP ___slab_alloc+0x1f4/0x760
LR __slab_alloc+0x34/0x60
Call Trace:
___slab_alloc+0x334/0x760 (unreliable)
__slab_alloc+0x34/0x60
__kmalloc_node+0x110/0x490
kvmalloc_node+0x58/0x110
mem_cgroup_css_online+0x108/0x270
online_css+0x48/0xd0
cgroup_apply_control_enable+0x2ec/0x4d0
cgroup_mkdir+0x228/0x5f0
kernfs_iop_mkdir+0x90/0xf0
vfs_mkdir+0x110/0x230
do_mkdirat+0xb0/0x1a0
system_call+0x5c/0x68This is a PowerPC platform with following NUMA topology:
available: 2 nodes (0-1)
node 0 cpus:
node 0 size: 0 MB
node 0 free: 0 MB
node 1 cpus: 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 node 1 size: 35247 MB
node 1 free: 30907 MB
node distances:
node 0 1
0: 10 40
1: 40 10possible numa nodes: 0-31
This only happens with a mmotm patch "mm/memcontrol.c: allocate shrinker_map on appropriate NUMA node" [2] which effectively calls kmalloc_node for each possible node. SLUB however only allocates kmem_cache_node on online N_NORMAL_MEMORY nodes, and relies on node_to_mem_node to return such valid node for other nodes since commit a561ce00b09e ("slub: fall back to node_to_mem_node() node if allocating on memoryless node"). This is however not true in this configuration where the _node_numa_mem_ array is not initialized for nodes 0 and 2-31, thus it contains zeroes and get_partial() ends up accessing non-allocated kmem_cache_node.
A related issue was reported by Bharata (originally by Ramachandran) [3] where a similar PowerPC configuration, but with mainline kernel without patch [2] ends up allocating large amounts of pages by kmalloc-1k kmalloc-512. This seems to have the same underlying issue with node_to_mem_node() not behaving as expected, and might probably also lead to an infinite loop with CONFIG_SLUB_CPU_PARTIAL [4].
This patch should fix both issues by not relying on node_to_mem_node() anymore and instead simply falling back to NUMA_NO_NODE, when kmalloc_node(node) is attempted for a node that's not online, or has no usable memory. The "usable memory" condition is also changed from node_present_pages() to N_NORMAL_MEMORY node state, as that is exactly the condition that SLUB uses to allocate kmem_cache_node structures. The check in get_partial() is removed completely, as the checks in ___slab_alloc() are now sufficient to prevent get_partial() being reached with an invalid node.
[1] https://lore.kernel.org/linux-next/[email protected]/
[2] https://lore.kernel.org/linux-mm/[email protected]/
[3] https://lore.kernel.org/linux-mm/[email protected]/
[4] https://lore.kernel.org/linux-mm/[email protected]/
--- mm/slub.c | 26 +++++++++++++++++--------- 1 file changed, 17 insertions(+), 9 deletions(-)
mm/slub.c +17 -9
@@ -1954,8 +1954,6 @@ static void *get_partial(struct kmem_cacif (node ==NUMA_NO_NODE ) searchnode =numa_mem_id (); -else if (!node_present_pages (node)) - searchnode =node_to_mem_node (node); object =get_partial_node (s,get_node (s, searchnode), c, flags);if (object || node !=NUMA_NO_NODE )
@@ -2544,17 +2542,27 @@ static void *___slab_alloc(struct kmem_cstruct page *page; page = c->page; -if (!page) +if (!page) { +/* +* if the node is not online or has no normal memory, just +* ignore the node constraint +*/ +if (unlikely (node !=NUMA_NO_NODE && + !node_state (node,N_NORMAL_MEMORY ))) + node =NUMA_NO_NODE ; goto new_slab; + } redo:if (unlikely (!node_match (page, node))) { -int searchnode = node; - -if (node !=NUMA_NO_NODE && !node_present_pages (node)) - searchnode =node_to_mem_node (node); - -if (unlikely (!node_match (page, searchnode))) { +/* +* same as above but node_match() being false already +* implies node != NUMA_NO_NODE +*/ +if (!node_state (node,N_NORMAL_MEMORY )) { + node =NUMA_NO_NODE ; + goto redo; + }else {stat (s,ALLOC_NODE_MISMATCH );deactivate_slab (s, page, c->freelist, c); goto new_slab;
Greg Kroah-Hartman
maintainerPATCH 82/119 intel_th: Fix user-visible error codes
In reply to Greg Kroah-HartmanFrom: Alexander Shishkin <[email protected]>
commit ce666be89a8a09c5924ff08fc32e119f974bdab6 upstream.
There are a few places in the driver that end up returning ENOTSUPP to the user, replace those with EINVAL.
--- drivers/hwtracing/intel_th/msu.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/hwtracing/intel_th/msu.c +3 -3
@@ -761,7 +761,7 @@ static int msc_configure(struct msc *msclockdep_assert_held (&msc->buf_mutex);if (msc->mode >MSC_MODE_MULTI ) -return -ENOTSUPP ; +return -EINVAL ;if (msc->mode ==MSC_MODE_MULTI ) {if (msc_win_set_lockout (msc->cur_win,WIN_READY ,WIN_INUSE ))
@@ -1295,7 +1295,7 @@ static int msc_buffer_alloc(struct msc * }else if (msc->mode ==MSC_MODE_MULTI ) { ret =msc_buffer_multi_alloc (msc, nr_pages, nr_wins); }else { - ret = -ENOTSUPP ; + ret = -EINVAL ; }if (!ret) {
@@ -1531,7 +1531,7 @@ static ssize_t intel_th_msc_read(structif (ret >=0 ) *ppos = iter->offset; }else { - ret = -ENOTSUPP ; + ret = -EINVAL ; } put_count:
Greg Kroah-Hartman
maintainerPATCH 100/119 page-flags: fix a crash at SetPageError(THP_SWAP)
In reply to Greg Kroah-HartmanFrom: Qian Cai <[email protected]>
commit d72520ad004a8ce18a6ba6cde317f0081b27365a upstream.
Commit bd4c82c22c36 ("mm, THP, swap: delay splitting THP after swapped out") supported writing THP to a swap device but forgot to upgrade an older commit df8c94d13c7e ("page-flags: define behavior of FS/IO-related flags on compound pages") which could trigger a crash during THP swapping out with DEBUG_VM_PGFLAGS=y,
kernel BUG at include/linux/page-flags.h:317!
page dumped because: VM_BUG_ON_PAGE(1 && PageCompound(page)) page:fffff3b2ec3a8000 refcount:512 mapcount:0 mapping:000000009eb0338c index:0x7f6e58200 head:fffff3b2ec3a8000 order:9 compound_mapcount:0 compound_pincount:0 anon flags: 0x45fffe0000d8454(uptodate|lru|workingset|owner_priv_1|writeback|head|reclaim|swapbacked)
end_swap_bio_write()
SetPageError(page)
VM_BUG_ON_PAGE(1 && PageCompound(page))<IRQ> bio_endio+0x297/0x560 dec_pending+0x218/0x430 [dm_mod] clone_endio+0xe4/0x2c0 [dm_mod] bio_endio+0x297/0x560 blk_update_request+0x201/0x920 scsi_end_request+0x6b/0x4b0 scsi_io_completion+0x509/0x7e0 scsi_finish_command+0x1ed/0x2a0 scsi_softirq_done+0x1c9/0x1d0 __blk_mqnterrupt+0xf/0x20 </IRQ>
Fix by checking PF_NO_TAIL in those places instead.
--- include/linux/page-flags.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/page-flags.h +1 -1
@@ -311,7 +311,7 @@ static inline int TestClearPage##uname(s __PAGEFLAG(Locked, locked, PF_NO_TAIL) PAGEFLAG(Waiters, waiters, PF_ONLY_HEAD) __CLEARPAGEFLAG(Waiters, waiters, PF_ONLY_HEAD) -PAGEFLAG(Error, error, PF_NO_COMPOUND) TESTCLEARFLAG(Error, error, PF_NO_COMPOUND) +PAGEFLAG(Error, error, PF_NO_TAIL) TESTCLEARFLAG(Error, error, PF_NO_TAIL) PAGEFLAG(Referenced, referenced, PF_HEAD) TESTCLEARFLAG(Referenced, referenced, PF_HEAD)__SETPAGEFLAG (Referenced, referenced,PF_HEAD )
Greg Kroah-Hartman
maintainerPATCH 101/119 x86/mm: split vmalloc_sync_all()
In reply to Greg Kroah-HartmanFrom: Joerg Roedel <[email protected]>
commit 763802b53a427ed3cbd419dbba255c414fdd9e7c upstream.
Commit 3f8fd02b1bf1 ("mm/vmalloc: Sync unmappings in __purge_vmap_area_lazy()") introduced a call to vmalloc_sync_all() in the vunmap() code-path. While this change was necessary to maintain correctness on x86-32-pae kernels, it also adds additional cycles for architectures that don't need it.
Specifically on x86-64 with CONFIG_VMAP_STACK=y some people reported severe performance regressions in micro-benchmarks because it now also calls the x86-64 implementation of vmalloc_sync_all() on vunmap(). But the vmalloc_sync_all() implementation on x86-64 is only needed for newly created mappings.
To avoid the unnecessary work on x86-64 and to gain the performance back, split up vmalloc_sync_all() into two functions:
* vmalloc_sync_mappings(), and
* vmalloc_sync_unmappings()
Most call-sites to vmalloc_sync_all() only care about new mappings being synchronized. The only exception is the new call-site added in the above mentioned commit.
Shile Zhang directed us to a report of an 80% regression in reaim throughput.
--- arch/x86/mm/fault.c | 26 ++++++++++++++++++++++++-- drivers/acpi/apei/ghes.c | 2 +- include/linux/vmalloc.h | 5 +++-- kernel/notifier.c | 2 +- mm/nommu.c | 10 +++++++--- mm/vmalloc.c | 11 +++++++---- 6 files changed, 43 insertions(+), 13 deletions(-)
arch/x86/mm/fault.c +24 -2
@@ -189,7 +189,7 @@ static inline pmd_t *vmalloc_sync_one(pgreturn pmd_k; } -void vmalloc_sync_all (void ) +static void vmalloc_sync (void ) {unsigned long address;
@@ -216,6 +216,16 @@ void vmalloc_sync_all(void) } } +void vmalloc_sync_mappings (void ) +{ +vmalloc_sync (); +} + +void vmalloc_sync_unmappings (void ) +{ +vmalloc_sync (); +} +/* * 32-bit: *
@@ -318,11 +328,23 @@ out:#else /* CONFIG_X86_64: */ -void vmalloc_sync_all (void ) +void vmalloc_sync_mappings (void ) { +/* +* 64-bit mappings might allocate new p4d/pud pages +* that need to be propagated to all tasks' PGDs. +*/ sync_global_pgds (VMALLOC_START &PGDIR_MASK ,VMALLOC_END ); } +void vmalloc_sync_unmappings (void ) +{ +/* +* Unmappings never allocate or free p4d/pud pages. +* No work is required here. +*/ +} +/* * 64-bit: *
drivers/acpi/apei/ghes.c +1 -1
@@ -171,7 +171,7 @@ int ghes_estatus_pool_init(int num_ghes)* New allocation must be visible in all pgd before it can be found by * an NMI allocating from the pool. */ -vmalloc_sync_all (); +vmalloc_sync_mappings (); rc =gen_pool_add (ghes_estatus_pool, addr,PAGE_ALIGN (len),-1 );if (rc)
include/linux/vmalloc.h +3 -2
@@ -139,8 +139,9 @@ extern int remap_vmalloc_range_partial(sextern int remap_vmalloc_range (struct vm_area_struct *vma,void *addr,unsigned long pgoff); -void vmalloc_sync_all (void ); - +void vmalloc_sync_mappings (void ); +void vmalloc_sync_unmappings (void ); +/* * Lowlevel-APIs (not for driver use!) */
kernel/notifier.c +1 -1
@@ -519,7 +519,7 @@ NOKPROBE_SYMBOL(notify_die);int register_die_notifier (struct notifier_block *nb) { -vmalloc_sync_all (); +vmalloc_sync_mappings ();return atomic_notifier_chain_register (&die_chain, nb); }EXPORT_SYMBOL_GPL (register_die_notifier);
mm/nommu.c +7 -3
@@ -370,10 +370,14 @@ void vm_unmap_aliases(void)EXPORT_SYMBOL_GPL (vm_unmap_aliases);/* -* Implement a stub for vmalloc_sync_all() if the architecture chose not to -* have one. +* Implement a stub for vmalloc_sync_[un]mapping() if the architecture +* chose not to have one. */ -void __weak vmalloc_sync_all (void ) +void __weak vmalloc_sync_mappings (void ) +{ +} + +void __weak vmalloc_sync_unmappings (void ) { }
mm/vmalloc.c +7 -4
@@ -1287,7 +1287,7 @@ static bool __purge_vmap_area_lazy(unsig* First make sure the mappings are removed from all page-tables * before they are freed. */ -vmalloc_sync_all (); +vmalloc_sync_unmappings ();/* * TODO: to calculate a flush range without looping.
@@ -3120,16 +3120,19 @@ int remap_vmalloc_range(struct vm_area_sEXPORT_SYMBOL (remap_vmalloc_range);/* -* Implement a stub for vmalloc_sync_all() if the architecture chose not to -* have one. +* Implement stubs for vmalloc_sync_[un]mappings () if the architecture chose +* not to have one. * * The purpose of this function is to make sure the vmalloc area * mappings are identical in all page-tables in the system. */ -void __weak vmalloc_sync_all (void ) +void __weak vmalloc_sync_mappings (void ) { } +void __weak vmalloc_sync_unmappings (void ) +{ +}static int f (pte_t *pte,unsigned long addr,void *data) {
Greg Kroah-Hartman
maintainerPATCH 102/119 io_uring: NULL-deref for IOSQE_{ASYNC,DRAIN}
In reply to Greg Kroah-HartmanFrom: Pavel Begunkov <[email protected]>
[ Upstream commit f1d96a8fcbbbb22d4fbc1d69eaaa678bbb0ff6e2 ]
Processing links, io_submit_sqe() prepares requests, drops sqes, and passes them with sqe=NULL to io_queue_sqe(). There IOSQE_DRAIN and/or IOSQE_ASYNC requests will go through the same prep, which doesn't expect sqe=NULL and fail with NULL pointer deference.
Always do full prepare including io_alloc_async_ctx() for linked requests, and then it can skip the second preparation.
--- fs/io_uring.c | 8 ++++++++ 1 file changed, 8 insertions(+)
fs/io_uring.c +8 -0
@@ -3098,6 +3098,9 @@ static int io_req_defer_prep(struct io_kiocb *req, {ssize_t ret =0 ; +if (!sqe) +return 0 ; +switch (req->opcode) {case IORING_OP_NOP :break ;
@@ -3681,6 +3684,11 @@ static bool io_submit_sqe(struct io_kiocb *req, const struct io_uring_sqe *sqe, req->flags |=REQ_F_HARDLINK ;INIT_LIST_HEAD (&req->link_list); + +if (io_alloc_async_ctx (req)) { + ret = -EAGAIN ; + goto err_req; + } ret =io_req_defer_prep (req, sqe);if (ret) req->flags |=REQ_F_FAIL_LINK ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 103/119 futex: Fix inode life-time issue
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
commit 8019ad13ef7f64be44d4f892af9c840179009254 upstream.
As reported by Jann, ihold() does not in fact guarantee inode persistence. And instead of making it so, replace the usage of inode pointers with a per boot, machine wide, unique inode identifier.
This sequence number is global, but shared (file backed) futexes are rare enough that this should not become a performance issue.
--- fs/inode.c | 1 include/linux/fs.h | 1 include/linux/futex.h | 17 +++++---- kernel/futex.c | 89 +++++++++++++++++++++++++++++--------------------- 4 files changed, 65 insertions(+), 43 deletions(-)
fs/inode.c +1 -0
@@ -137,6 +137,7 @@ int inode_init_always(struct super_block inode->i_sb = sb; inode->i_blkbits = sb->s_blocksize_bits; inode->i_flags =0 ; +atomic64_set (&inode->i_sequence,0 );atomic_set (&inode->i_count,1 ); inode->i_op = &empty_iops; inode->i_fop = &no_open_fops;
include/linux/fs.h +1 -0
@@ -698,6 +698,7 @@ struct inode {struct rcu_head i_rcu; };atomic64_t i_version; +atomic64_t i_sequence;/* see futex */ atomic_t i_count;atomic_t i_dio_count;atomic_t i_writecount;
include/linux/futex.h +10 -7
@@ -31,23 +31,26 @@ struct task_struct;union futex_key {struct { +u64 i_seq;unsigned long pgoff; -struct inode *inode; -int offset; +unsigned int offset; } shared;struct { +union { +struct mm_struct *mm; +u64 __tmp; + };unsigned long address; -struct mm_struct *mm; -int offset; +unsigned int offset; } private;struct { +u64 ptr;unsigned long word; -void *ptr; -int offset; +unsigned int offset; } both; }; -#define FUTEX_KEY_INIT (union futex_key) { .both = { .ptr = NULL } } +#define FUTEX_KEY_INIT (union futex_key) { .both = { .ptr = 0ULL } }#ifdef CONFIG_FUTEX enum {
kernel/futex.c +53 -36
130 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 104/119 futex: Unbreak futex hashing
In reply to Greg Kroah-HartmanFrom: Thomas Gleixner <[email protected]>
commit 8d67743653dce5a0e7aa500fcccb237cde7ad88e upstream.
The recent futex inode life time fix changed the ordering of the futex key union struct members, but forgot to adjust the hash function accordingly,
As a result the hashing omits the leading 64bit and even hashes beyond the futex key causing a bad hash distribution which led to a ~100% performance regression.
Hand in the futex key pointer instead of a random struct member and make the size calculation based of the struct offset.
--- kernel/futex.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/futex.c +2 -2
@@ -385,9 +385,9 @@ static inline int hb_waiters_pending(str*/ static struct futex_hash_bucket *hash_futex (union futex_key *key) { -u32 hash =jhash2 ((u32 *)&key->both.word, - (sizeof (key->both.word)+sizeof (key->both.ptr))/4 , + u32 hash = jhash2((u32 *)key, offsetof(typeof(*key), both.offset) / 4, key->both.offset); +return &futex_queues[hash & (futex_hashsize -1 )]; }
Greg Kroah-Hartman
maintainerPATCH 105/119 ALSA: hda/realtek: Fix pop noise on ALC225
In reply to Greg Kroah-HartmanFrom: Kai-Heng Feng <[email protected]>
commit 3b36b13d5e69d6f51ff1c55d1b404a74646c9757 upstream.
Commit 317d9313925c ("ALSA: hda/realtek - Set default power save node to 0") makes the ALC225 have pop noise on S3 resume and cold boot.
So partially revert this commit for ALC225 to fix the regression.
--- sound/pci/hda/patch_realtek.c | 2 ++ 1 file changed, 2 insertions(+)
sound/pci/hda/patch_realtek.c +2 -0
@@ -8051,6 +8051,8 @@ static int patch_alc269(struct hda_codec spec->gen.mixer_nid =0 ;break ;case 0x10ec0225 : + codec->power_save_node =1 ; +/* fall through */ case 0x10ec0295 :case 0x10ec0299 : spec->codec_variant =ALC269_TYPE_ALC225 ;
Greg Kroah-Hartman
maintainerPATCH 106/119 thunderbolt: Fix error code in tb_port_is_width_supported()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
commit e9d0e7511fda92a6511904996dd0aa57b6d7687a upstream.
This function is type bool, and it's supposed to return true on success. Unfortunately, this path takes negative error codes and casts them to bool (true) so it's treated as success instead of failure.
--- drivers/thunderbolt/switch.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/thunderbolt/switch.c +1 -1
@@ -848,7 +848,7 @@ static bool tb_port_is_width_supported(s ret =tb_port_read (port, &phy,TB_CFG_PORT , port->cap_phy +LANE_ADP_CS_0 ,1 );if (ret) -return ret; +return false; widths = (phy &LANE_ADP_CS_0_SUPPORTED_WIDTH_MASK ) >>LANE_ADP_CS_0_SUPPORTED_WIDTH_SHIFT ;
Greg Kroah-Hartman
maintainerPATCH 107/119 arm64: smp: fix smp_send_stop() behaviour
In reply to Greg Kroah-HartmanFrom: Cristian Marussi <[email protected]>
commit d0bab0c39e32d39a8c5cddca72e5b4a3059fe050 upstream.
On a system with only one CPU online, when another one CPU panics while starting-up, smp_send_stop() will fail to send any STOP message to the other already online core, resulting in a system still responsive and alive at the end of the panic procedure.
[ 186.700083] CPU3: shutdown [ 187.075462] CPU2: shutdown [ 187.162869] CPU1: shutdown [ 188.689998] ------------[ cut here ]------------ [ 188.691645] kernel BUG at arch/arm64/kernel/cpufeature.c:886! [ 188.692079] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP [ 188.692444] Modules linked in: [ 188.693031] CPU: 3 PID: 0 Comm: swapper/3 Not tainted 5.6.0-rc4-00001-g338d25c35a98 #104 [ 188.693175] Hardware name: Foundation-v8A (DT) [ 188.693492] pstate: 200001c5 (nzCv dAIF -PAN -UAO) [ 188.694183] pc : has_cpuid_feature+0xf0/0x348 [ 188.694311] lr : verify_local_elf_hwcaps+0x84/0xe8 [ 188.694410] sp : ffff800011b1bf60 [ 188.694536] x29: ffff800011b1bf60 x28: 0000000000000000 [ 188.694707] x27: 0000000000000000 x26: 0000000000000000 [ 188.694801] x25: 0000000000000000 x24: ffff80001189a25c [ 188.694905] x23: 0000000000000000 x22: 0000000000000000 [ 188.694996] x21: ffff8000114aa018 x20: ffff800011156a38 [ 188.695089] x19: ffff800010c944a0 x18: 0000000000000004 [ 188.695187] x17: 0000000000000000 x16: 0000000000000000 [ 188.695280] x15: 0000249dbde5431e x14: 0262cbe497efa1fa [ 188.695371] x13: 0000000000000002 x12: 0000000000002592 [ 188.695472] x11: 0000000000000080 x10: 00400032b5503510 [ 188.695572] x9 : 0000000000000000 x8 : ffff800010c80204 [ 188.695659] x7 : 00000000410fd0f0 x6 : 0000000000000001 [ 188.695750] x5 : 00000000410fd0f0 x4 : 0000000000000000 [ 188.695836] x3 : 0000000000000000 x2 : ffff8000100939d8 [ 188.695919] x1 : 0000000000180420 x0 : 0000000000180480 [ 188.696253] Call trace: [ 188.696410] has_cpuid_feature+0xf0/0x348 [ 188.696504] verify_local_elf_hwcaps+0x84/0xe8 [ 188.696591] check_local_cpu_capabilities+0x44/0x128 [ 188.696666] secondary_start_kernel+0xf4/0x188 [ 188.697150] Code: 52805001 72a00301 6b01001f 54000ec0 (d4210000) [ 188.698639] ---[ end trace 3f12ca47652f7b72 ]--- [ 188.699160] Kernel panic - not syncing: Attempted to kill the idle task! [ 188.699546] Kernel Offset: disabled [ 188.699828] CPU features: 0x00004,20c02008 [ 188.700012] Memory Limit: none [ 188.700538] ---[ end Kernel panic - not syncing: Attempted to kill the idle task! ]---
[root@arch ~]# echo Helo
Helo
[root@arch ~]# cat /proc/cpuinfo | grep proce
processor : 0
Make smp_send_stop() account also for the online status of the calling CPU while evaluating how many CPUs are effectively online: this way, the right number of STOPs is sent, so enforcing a proper freeze of the system at the end of panic even under the above conditions.
--- arch/arm64/kernel/smp.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-)
arch/arm64/kernel/smp.c +14 -3
@@ -958,11 +958,22 @@ void tick_broadcast(const struct cpumask }#endif +/* +* The number of CPUs online, not counting this CPU (which may not be +* fully online and so not counted in num_online_cpus()). +*/ +static inline unsigned int num_other_online_cpus (void ) +{ +unsigned int this_cpu_online =cpu_online (smp_processor_id ()); + +return num_online_cpus () - this_cpu_online; +} +void smp_send_stop (void ) {unsigned long timeout; -if (num_online_cpus () >1 ) { +if (num_other_online_cpus ()) {cpumask_t mask;cpumask_copy (&mask, cpu_online_mask);
@@ -975,10 +986,10 @@ void smp_send_stop(void)/* Wait up to one second for other CPUs to stop */ timeout =USEC_PER_SEC ; -while (num_online_cpus () >1 && timeout--) +while (num_other_online_cpus () && timeout--)udelay (1 ); -if (num_online_cpus () >1 ) +if (num_other_online_cpus ())pr_warn ("SMP: failed to stop secondary CPUs %*pbl\n" ,cpumask_pr_args (cpu_online_mask));
Greg Kroah-Hartman
maintainerPATCH 108/119 arm64: smp: fix crash_smp_send_stop() behaviour
In reply to Greg Kroah-HartmanFrom: Cristian Marussi <[email protected]>
commit f50b7dacccbab2b9e3ef18f52a6dcc18ed2050b9 upstream.
On a system configured to trigger a crash_kexec() reboot, when only one CPU is online and another CPU panics while starting-up, crash_smp_send_stop() will fail to send any STOP message to the other already online core, resulting in fail to freeze and registers not properly saved.
Moreover even if the proper messages are sent (case CPUs > 2) it will similarly fail to account for the booting CPU when executing the final stop wait-loop, so potentially resulting in some CPU not been waited for shutdown before rebooting.
A tangible effect of this behaviour can be observed when, after a panic with kexec enabled and loaded, on the following reboot triggered by kexec, the cpu that could not be successfully stopped fails to come back online:
[ 362.291022] ------------[ cut here ]------------ [ 362.291525] kernel BUG at arch/arm64/kernel/cpufeature.c:886! [ 362.292023] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP [ 362.292400] Modules linked in: [ 362.292970] CPU: 3 PID: 0 Comm: swapper/3 Kdump: loaded Not tainted 5.6.0-rc4-00003-gc780b890948a #105 [ 362.293136] Hardware name: Foundation-v8A (DT) [ 362.293382] pstate: 200001c5 (nzCv dAIF -PAN -UAO) [ 362.294063] pc : has_cpuid_feature+0xf0/0x348 [ 362.294177] lr : verify_local_elf_hwcaps+0x84/0xe8 [ 362.294280] sp : ffff800011b1bf60 [ 362.294362] x29: ffff800011b1bf60 x28: 0000000000000000 [ 362.294534] x27: 0000000000000000 x26: 0000000000000000 [ 362.294631] x25: 0000000000000000 x24: ffff80001189a25c [ 362.294718] x23: 0000000000000000 x22: 0000000000000000 [ 362.294803] x21: ffff8000114aa018 x20: ffff800011156a00 [ 362.294897] x19: ffff800010c944a0 x18: 0000000000000004 [ 362.294987] x17: 0000000000000000 x16: 0000000000000000 [ 362.295073] x15: 00004e53b831ae3c x14: 00004e53b831ae3c [ 362.295165] x13: 0000000000000384 x12: 0000000000000000 [ 362.295251] x11: 0000000000000000 x10: 00400032b5503510 [ 362.295334] x9 : 0000000000000000 x8 : ffff800010c7e204 [ 362.295426] x7 : 00000000410fd0f0 x6 : 0000000000000001 [ 362.295508] x5 : 00000000410fd0f0 x4 : 0000000000000000 [ 362.295592] x3 : 0000000000000000 x2 : ffff8000100939d8 [ 362.295683] x1 : 0000000000180420 x0 : 0000000000180480 [ 362.296011] Call trace: [ 362.296257] has_cpuid_feature+0xf0/0x348 [ 362.296350] verify_local_elf_hwcaps+0x84/0xe8 [ 362.296424] check_local_cpu_capabilities+0x44/0x128 [ 362.296497] secondary_start_kernel+0xf4/0x188 [ 362.296998] Code: 52805001 72a00301 6b01001f 54000ec0 (d4210000) [ 362.298652] SMP: stopping secondary CPUs [ 362.300615] Starting crashdump kernel... [ 362.301168] Bye! [ 0.000000] Booting Linux on physical CPU 0x0000000003 [0x410fd0f0] [ 0.000000] Linux version 5.6.0-rc4-00003-gc780b890948a (crimar01@e120937-lin) (gcc version 8.3.0 (GNU Toolchain for the A-profile Architecture 8.3-2019.03 (arm-rel-8.36))) #105 SMP PREEMPT Fri Mar 6 17:00:42 GMT 2020 [ 0.000000] Machine model: Foundation-v8A [ 0.000000] earlycon: pl11 at MMIO 0x000000001c090000 (options '') [ 0.000000] printk: bootconsole [pl11] enabled ..... [ 0.138024] rcu: Hierarchical SRCU implementation. [ 0.153472] its@2f020000: unable to locate ITS domain [ 0.154078] its@2f020000: Unable to locate ITS domain [ 0.157541] EFI services will not be available. [ 0.175395] smp: Bringing up secondary CPUs ... [ 0.209182] psci: failed to boot CPU1 (-22) [ 0.209377] CPU1: failed to boot: -22 [ 0.274598] Detected PIPT I-cache on CPU2 [ 0.278707] GICv3: CPU2: found redistributor 1 region 0:0x000000002f120000 [ 0.285212] CPU2: Booted secondary processor 0x0000000001 [0x410fd0f0] [ 0.369053] Detected PIPT I-cache on CPU3 [ 0.372947] GICv3: CPU3: found redistributor 2 region 0:0x000000002f140000 [ 0.378664] CPU3: Booted secondary processor 0x0000000002 [0x410fd0f0] [ 0.401707] smp: Brought up 1 node, 3 CPUs [ 0.404057] SMP: Total of 3 processors activated.
Make crash_smp_send_stop() account also for the online status of the calling CPU while evaluating how many CPUs are effectively online: this way the right number of STOPs is sent and all other stopped-cores's registers are properly saved.
--- arch/arm64/kernel/smp.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
arch/arm64/kernel/smp.c +6 -2
@@ -1012,7 +1012,11 @@ void crash_smp_send_stop(void) cpus_stopped =1 ; -if (num_online_cpus () ==1 ) { +/* +* If this cpu is the only one alive at this point in time, online or +* not, there are no stop messages to be sent around, so just back out. +*/ +if (num_other_online_cpus () ==0 ) {sdei_mask_local_cpu ();return ; }
@@ -1020,7 +1024,7 @@ void crash_smp_send_stop(void)cpumask_copy (&mask, cpu_online_mask);cpumask_clear_cpu (smp_processor_id (), &mask); -atomic_set (&waiting_for_crash_ipi,num_online_cpus () -1 ); +atomic_set (&waiting_for_crash_ipi,num_other_online_cpus ());pr_crit ("SMP: stopping secondary CPUs\n" );smp_cross_call (&mask,IPI_CPU_CRASH_STOP );
Greg Kroah-Hartman
maintainerPATCH 109/119 nvmet-tcp: set MSG_MORE only if we actually have more to send
In reply to Greg Kroah-HartmanFrom: Sagi Grimberg <[email protected]>
commit 98fd5c723730f560e5bea919a64ac5b83d45eb72 upstream.
When we send PDU data, we want to optimize the tcp stack operation if we have more data to send. So when we set MSG_MORE when:
- We have more fragments coming in the batch, or
- We have a more data to send in this PDU
- We don't have a data digest trailer
- We optimize with the SUCCESS flag and omit the NVMe completion (used if sq_head pointer update is disabled)
This addresses a regression in QD=1 with SUCCESS flag optimization as we unconditionally set MSG_MORE when we didn't actually have more data to send.
--- drivers/nvme/target/tcp.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
drivers/nvme/target/tcp.c +9 -3
@@ -515,7 +515,7 @@ static int nvmet_try_send_data_pdu(strucreturn 1 ; } -static int nvmet_try_send_data (struct nvmet_tcp_cmd *cmd) +static int nvmet_try_send_data (struct nvmet_tcp_cmd *cmd,bool last_in_batch) {struct nvmet_tcp_queue *queue = cmd->queue;int ret;
@@ -523,9 +523,15 @@ static int nvmet_try_send_data(struct nvwhile (cmd->cur_sg) {struct page *page =sg_page (cmd->cur_sg);u32 left = cmd->cur_sg->length - cmd->offset; +int flags =MSG_DONTWAIT ; + +if ((!last_in_batch && cmd->queue->send_list_len) || + cmd->wbytes_done + left < cmd->req.transfer_len || + queue->data_digest || !queue->nvme_sq.sqhd_disabled) + flags |=MSG_MORE ; ret =kernel_sendpage (cmd->queue->sock, page, cmd->offset, - left,MSG_DONTWAIT |MSG_MORE ); + left, flags);if (ret <=0 )return ret;
@@ -660,7 +666,7 @@ static int nvmet_tcp_try_send_one(struct }if (cmd->state ==NVMET_TCP_SEND_DATA ) { - ret =nvmet_try_send_data (cmd); + ret =nvmet_try_send_data (cmd, last_in_batch);if (ret <=0 ) goto done_send; }
Greg Kroah-Hartman
maintainerPATCH 83/119 intel_th: pci: Add Elkhart Lake CPU support
In reply to Greg Kroah-HartmanFrom: Alexander Shishkin <[email protected]>
commit add492d2e9446a77ede9bb43699ec85ca8fc1aba upstream.
This adds support for the Trace Hub in Elkhart Lake CPU.
--- drivers/hwtracing/intel_th/pci.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/hwtracing/intel_th/pci.c +5 -0
@@ -235,6 +235,11 @@ static const struct pci_device_id intel_ .driver_data = (kernel_ulong_t)&intel_th_2x, }, { +/* Elkhart Lake CPU */ + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4529), + .driver_data = (kernel_ulong_t)&intel_th_2x, + }, + {/* Elkhart Lake */ PCI_DEVICE (PCI_VENDOR_ID_INTEL ,0x4b26 ), .driver_data = (kernel_ulong_t)&intel_th_2x,
Greg Kroah-Hartman
maintainerPATCH 110/119 modpost: Get proper section index by get_secindex() instead of st_shndx
In reply to Greg Kroah-HartmanFrom: Xiao Yang <[email protected]>
commit 4b8a5cfb5fd375cf4c7502a18f0096ed2881be27 upstream.
(uint16_t) st_shndx is limited to 65535(i.e. SHN_XINDEX) so sym_get_data() gets wrong section index by st_shndx if requested symbol contains extended section index that is more than 65535. In this case, we need to get proper section index by .symtab_shndx section.
Module.symvers generated by building kernel with "-ffunction-sections -fdata-sections" shows the issue.
--- scripts/mod/modpost.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
scripts/mod/modpost.c +2 -1
@@ -307,7 +307,8 @@ static const char *sec_name(struct elf_istatic void *sym_get_data (const struct elf_info *info,const Elf_Sym *sym) { -Elf_Shdr *sechdr = &info->sechdrs[sym->st_shndx]; +unsigned int secindex =get_secindex (info, sym); +Elf_Shdr *sechdr = &info->sechdrs[secindex];unsigned long offset; offset = sym->st_value;
Greg Kroah-Hartman
maintainerPATCH 111/119 btrfs: fix removal of raid[56|1c34} incompat flags after removing block group
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
commit d8e6fd5c7991033037842b32c9774370a038e902 upstream.
We are incorrectly dropping the raid56 and raid1c34 incompat flags when there are still raid56 and raid1c34 block groups, not when we do not any of those anymore. The logic just got unintentionally broken after adding the support for the raid1c34 modes.
Fix this by clear the flags only if we do not have block groups with the respective profiles.
--- fs/btrfs/block-group.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/btrfs/block-group.c +2 -2
@@ -849,9 +849,9 @@ static void clear_incompat_bg_bits(struc found_raid1c34 = true;up_read (&sinfo->groups_sem); } -if (found_raid56) +if (!found_raid56)btrfs_clear_fs_incompat (fs_info,RAID56 ); -if (found_raid1c34) +if (!found_raid1c34)btrfs_clear_fs_incompat (fs_info,RAID1C34 ); } }
Greg Kroah-Hartman
maintainerPATCH 112/119 Revert "drm/i915/tgl: Add extra hdc flush workaround"
In reply to Greg Kroah-HartmanFrom: Caz Yokoyama <[email protected]>
commit c09f6b4d0883dfb859c1ddcfb04c3260ef310ce0 upstream.
This reverts commit 36a6b5d964d995b536b1925ec42052ee40ba92c4.
The commit takes care Wa_1604544889 which was fixed on a0 stepping based on a0 replan. So no SW workaround is required on any stepping now.
--- drivers/gpu/drm/i915/gt/intel_lrc.c | 20 -------------------- 1 file changed, 20 deletions(-)
drivers/gpu/drm/i915/gt/intel_lrc.c +0 -20
@@ -3503,26 +3503,6 @@ static int gen12_emit_flush_render(struc *cs++ =preparser_disable (false);intel_ring_advance (request, cs); - -/* -* Wa_1604544889:tgl -*/ -if (IS_TGL_REVID (request->i915,TGL_REVID_A0 ,TGL_REVID_A0 )) { - flags =0 ; - flags |=PIPE_CONTROL_CS_STALL ; - flags |=PIPE_CONTROL_HDC_PIPELINE_FLUSH ; - - flags |=PIPE_CONTROL_STORE_DATA_INDEX ; - flags |=PIPE_CONTROL_QW_WRITE ; - - cs =intel_ring_begin (request,6 ); -if (IS_ERR (cs)) -return PTR_ERR (cs); - - cs =gen8_emit_pipe_control (cs, flags, -LRC_PPHWSP_SCRATCH_ADDR ); -intel_ring_advance (request, cs); - } }return 0 ;
Greg Kroah-Hartman
maintainerPATCH 113/119 drm/bridge: dw-hdmi: fix AVI frame colorimetry
In reply to Greg Kroah-HartmanFrom: Jernej Skrabec <[email protected]>
commit e8dca30f7118461d47e1c3510d0e31b277439151 upstream.
CTA-861-F explicitly states that for RGB colorspace colorimetry should be set to "none". Fix that.
--- drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 46 ++++++++++++++++-------------- 1 file changed, 26 insertions(+), 20 deletions(-)
drivers/gpu/drm/bridge/synopsys/dw-hdmi.c +26 -20
@@ -1624,28 +1624,34 @@ static void hdmi_config_AVI(struct dw_hd frame.colorspace =HDMI_COLORSPACE_RGB ;/* Set up colorimetry */ -switch (hdmi->hdmi_data.enc_out_encoding) { -case V4L2_YCBCR_ENC_601 : -if (hdmi->hdmi_data.enc_in_encoding ==V4L2_YCBCR_ENC_XV601 ) - frame.colorimetry =HDMI_COLORIMETRY_EXTENDED ; -else +if (!hdmi_bus_fmt_is_rgb (hdmi->hdmi_data.enc_out_bus_format)) { +switch (hdmi->hdmi_data.enc_out_encoding) { +case V4L2_YCBCR_ENC_601 : +if (hdmi->hdmi_data.enc_in_encoding ==V4L2_YCBCR_ENC_XV601 ) + frame.colorimetry =HDMI_COLORIMETRY_EXTENDED ; +else + frame.colorimetry =HDMI_COLORIMETRY_ITU_601 ; + frame.extended_colorimetry = +HDMI_EXTENDED_COLORIMETRY_XV_YCC_601 ; +break ; +case V4L2_YCBCR_ENC_709 : +if (hdmi->hdmi_data.enc_in_encoding ==V4L2_YCBCR_ENC_XV709 ) + frame.colorimetry =HDMI_COLORIMETRY_EXTENDED ; +else + frame.colorimetry =HDMI_COLORIMETRY_ITU_709 ; + frame.extended_colorimetry = +HDMI_EXTENDED_COLORIMETRY_XV_YCC_709 ; +break ; +default :/* Carries no data */ frame.colorimetry =HDMI_COLORIMETRY_ITU_601 ; + frame.extended_colorimetry = +HDMI_EXTENDED_COLORIMETRY_XV_YCC_601 ; +break ; + } + }else { + frame.colorimetry =HDMI_COLORIMETRY_NONE ; frame.extended_colorimetry = -HDMI_EXTENDED_COLORIMETRY_XV_YCC_601 ; -break ; -case V4L2_YCBCR_ENC_709 : -if (hdmi->hdmi_data.enc_in_encoding ==V4L2_YCBCR_ENC_XV709 ) - frame.colorimetry =HDMI_COLORIMETRY_EXTENDED ; -else - frame.colorimetry =HDMI_COLORIMETRY_ITU_709 ; - frame.extended_colorimetry = -HDMI_EXTENDED_COLORIMETRY_XV_YCC_709 ; -break ; -default :/* Carries no data */ - frame.colorimetry =HDMI_COLORIMETRY_ITU_601 ; - frame.extended_colorimetry = -HDMI_EXTENDED_COLORIMETRY_XV_YCC_601 ; -break ; +HDMI_EXTENDED_COLORIMETRY_XV_YCC_601 ; } frame.scan_mode =HDMI_SCAN_MODE_NONE ;
Greg Kroah-Hartman
maintainerPATCH 114/119 drm/i915/execlists: Track active elements during dequeue
In reply to Greg Kroah-HartmanFrom: Chris Wilson <[email protected]>
commit 9777d8b2d2a148bc5d46694ec4f2559282fec8cf upstream.
Record the initial active element we use when building the next ELSP submission, so that we can compare against it latter to see if there's no change.
--- drivers/gpu/drm/i915/gt/intel_lrc.c | 32 ++++++++++++-------------------- 1 file changed, 12 insertions(+), 20 deletions(-)
drivers/gpu/drm/i915/gt/intel_lrc.c +12 -20
@@ -1422,17 +1422,6 @@ static void virtual_xfer_breadcrumbs(strspin_unlock (&old->breadcrumbs.irq_lock); } -static struct i915_request * -last_active (const struct intel_engine_execlists *execlists) -{ -struct i915_request *const *last =READ_ONCE (execlists->active); - -while (*last &&i915_request_completed (*last)) - last++; - -return *last; -} -#define for_each_waiter (p__, rq__) \ list_for_each_entry_lockless(p__, \ &(rq__)->sched.waiters_list, \
@@ -1562,11 +1551,9 @@ static void record_preemption(struct int (void )I915_SELFTEST_ONLY (execlists->preempt_hang.count++); } -static unsigned long active_preempt_timeout (struct intel_engine_cs *engine) +static unsigned long active_preempt_timeout (struct intel_engine_cs *engine, +const struct i915_request *rq) { -struct i915_request *rq; - - rq =last_active (&engine->execlists);if (!rq)return 0 ;
@@ -1577,13 +1564,14 @@ static unsigned long active_preempt_timereturn READ_ONCE (engine->props.preempt_timeout_ms); } -static void set_preempt_timeout (struct intel_engine_cs *engine) +static void set_preempt_timeout (struct intel_engine_cs *engine, +const struct i915_request *rq) {if (!intel_engine_has_preempt_reset (engine))return ;set_timer_ms (&engine->execlists.preempt, -active_preempt_timeout (engine)); +active_preempt_timeout (engine, rq)); }static void execlists_dequeue (struct intel_engine_cs *engine)
@@ -1591,6 +1579,7 @@ static void execlists_dequeue(struct intstruct intel_engine_execlists *const execlists = &engine->execlists;struct i915_request **port = execlists->pending;struct i915_request **const last_port = port + execlists->port_mask; +struct i915_request *const *active;struct i915_request *last;struct rb_node *rb;bool submit = false;
@@ -1645,7 +1634,10 @@ static void execlists_dequeue(struct int* i.e. we will retrigger preemption following the ack in case * of trouble. */ - last =last_active (execlists); + active =READ_ONCE (execlists->active); +while ((last = *active) &&i915_request_completed (last)) + active++; +if (last) {if (need_preempt (engine, last, rb)) { GEM_TRACE("%s: preempting last=%llx:%lld, prio=%d, hint=%d\n",
@@ -1930,7 +1922,7 @@ done:* Skip if we ended up with exactly the same set of requests, * e.g. trying to timeslice a pair of ordered contexts */ -if (!memcmp (execlists->active, execlists->pending, +if (!memcmp (active, execlists->pending, (port - execlists->pending +1 ) *sizeof (*port))) { do execlists_schedule_out(fetch_and_zero(port));
@@ -1942,7 +1934,7 @@ done:memset (port +1 ,0 , (last_port - port) *sizeof (*port));execlists_submit_ports (engine); -set_preempt_timeout (engine); +set_preempt_timeout (engine, *active); }else { skip_submit:ring_set_paused (engine,0 );
Greg Kroah-Hartman
maintainerPATCH 115/119 drm/i915: Handle all MCR ranges
In reply to Greg Kroah-HartmanFrom: Matt Roper <[email protected]>
commit fe8b7085cac3b0db03cdbb26d9309bc27325df0a upstream.
The bspec documents multiple MCR ranges; make sure they're all captured by the driver.
Bspec: 13991, 52079
--- drivers/gpu/drm/i915/gt/intel_workarounds.c | 25 ++++++++++++++++++++++--- 1 file changed, 22 insertions(+), 3 deletions(-)
drivers/gpu/drm/i915/gt/intel_workarounds.c +22 -3
@@ -1504,15 +1504,34 @@ err_obj:return ERR_PTR (err); } +static const struct { +u32 start; +u32 end; +} mcr_ranges_gen8[] = { + { .start =0x5500 , .end =0x55ff }, + { .start =0x7000 , .end =0x7fff }, + { .start =0x9400 , .end =0x97ff }, + { .start =0xb000 , .end =0xb3ff }, + { .start =0xe000 , .end =0xe7ff }, + {}, +}; +static bool mcr_range (struct drm_i915_private *i915,u32 offset) { +int i; + +if (INTEL_GEN (i915) <8 ) +return false; +/* -* Registers in this range are affected by the MCR selector +* Registers in these ranges are affected by the MCR selector * which only controls CPU initiated MMIO. Routing does not * work for CS access so we cannot verify them on this path. */ -if (INTEL_GEN (i915) >=8 && (offset >=0xb000 && offset <=0xb4ff )) -return true; +for (i =0 ; mcr_ranges_gen8[i].start; i++) +if (offset >= mcr_ranges_gen8[i].start && + offset <= mcr_ranges_gen8[i].end) +return true;return false; }
Greg Kroah-Hartman
maintainerPATCH 116/119 staging: greybus: loopback_test: fix potential path truncation
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit f16023834863932f95dfad13fac3fc47f77d2f29 upstream.
Newer GCC warns about a possible truncation of a generated sysfs path name as we're concatenating a directory path with a file name and placing the result in a buffer that is half the size of the maximum length of the directory path (which is user controlled).
loopback_test.c: In function 'open_poll_files':
loopback_test.c:651:31: warning: '%s' directive output may be truncated writing up to 511 bytes into a region of size 255 [-Wformat-truncation=]
651 | snprintf(buf, sizeof(buf), "%s%s", dev->sysfs_entry, "iteration_count");
| ^~
loopback_test.c:651:3: note: 'snprintf' output between 16 and 527 bytes into a destination of size 255
651 | snprintf(buf, sizeof(buf), "%s%s", dev->sysfs_entry, "iteration_count");
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Fix this by making sure the buffer is large enough the concatenated strings.
--- drivers/staging/greybus/tools/loopback_test.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/greybus/tools/loopback_test.c +1 -1
@@ -637,7 +637,7 @@ baddir:static int open_poll_files (struct loopback_test *t) {struct loopback_device *dev; -char buf[MAX_STR_LEN ]; +char buf[MAX_SYSFS_PATH +MAX_STR_LEN ];char dummy;int fds_idx =0 ;int i;
Greg Kroah-Hartman
maintainerPATCH 117/119 staging: greybus: loopback_test: fix potential path truncations
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit ae62cf5eb2792d9a818c2d93728ed92119357017 upstream.
Newer GCC warns about possible truncations of two generated path names as we're concatenating the configurable sysfs and debugfs path prefixes with a filename and placing the results in buffers of the same size as the maximum length of the prefixes.
snprintf(d->name, MAX_STR_LEN, "gb_loopback%u", dev_id); snprintf(d->sysfs_entry, MAX_SYSFS_PATH, "%s%s/", t->sysfs_prefix, d->name); snprintf(d->debugfs_entry, MAX_SYSFS_PATH, "%sraw_latency_%s", t->debugfs_prefix, d->name);
Fix this by separating the maximum path length from the maximum prefix length and reducing the latter enough to fit the generated strings.
Note that we also need to reduce the device-name buffer size as GCC isn't smart enough to figure out that we ever only used MAX_STR_LEN bytes of it.
--- drivers/staging/greybus/tools/loopback_test.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-)
drivers/staging/greybus/tools/loopback_test.c +8 -7
@@ -19,6 +19,7 @@#include <signal.h> #define MAX_NUM_DEVICES 10 +#define MAX_SYSFS_PREFIX 0x80#define MAX_SYSFS_PATH 0x200#define CSV_MAX_LINE 0x1000#define SYSFS_MAX_INT 0x20
@@ -67,7 +68,7 @@ struct loopback_results { };struct loopback_device { -char name[MAX_SYSFS_PATH ]; +char name[MAX_STR_LEN ];char sysfs_entry[MAX_SYSFS_PATH ];char debugfs_entry[MAX_SYSFS_PATH ];struct loopback_results results;
@@ -93,8 +94,8 @@ struct loopback_test {int stop_all;int poll_count;char test_name[MAX_STR_LEN ]; -char sysfs_prefix[MAX_SYSFS_PATH ]; -char debugfs_prefix[MAX_SYSFS_PATH ]; +char sysfs_prefix[MAX_SYSFS_PREFIX ]; +char debugfs_prefix[MAX_SYSFS_PREFIX ];struct timespec poll_timeout;struct loopback_device devices[MAX_NUM_DEVICES ];struct loopback_results aggregate_results;
@@ -907,10 +908,10 @@ int main(int argc, char *argv[]) t.iteration_max =atoi (optarg);break ;case 'S' : -snprintf (t.sysfs_prefix,MAX_SYSFS_PATH ,"%s" , optarg); +snprintf (t.sysfs_prefix,MAX_SYSFS_PREFIX ,"%s" , optarg);break ;case 'D' : -snprintf (t.debugfs_prefix,MAX_SYSFS_PATH ,"%s" , optarg); +snprintf (t.debugfs_prefix,MAX_SYSFS_PREFIX ,"%s" , optarg);break ;case 'm' : t.mask =atol (optarg);
@@ -961,10 +962,10 @@ int main(int argc, char *argv[]) }if (!strcmp (t.sysfs_prefix,"" )) -snprintf (t.sysfs_prefix,MAX_SYSFS_PATH ,"%s" , sysfs_prefix); +snprintf (t.sysfs_prefix,MAX_SYSFS_PREFIX ,"%s" , sysfs_prefix);if (!strcmp (t.debugfs_prefix,"" )) -snprintf (t.debugfs_prefix,MAX_SYSFS_PATH ,"%s" , debugfs_prefix); +snprintf (t.debugfs_prefix,MAX_SYSFS_PREFIX ,"%s" , debugfs_prefix); ret =find_loopback_devices (&t);if (ret)
Greg Kroah-Hartman
maintainerPATCH 119/119 int128: fix __uint128_t compiler test in Kconfig
In reply to Greg Kroah-HartmanFrom: Masahiro Yamada <[email protected]>
commit 3a7c733165a4799fa1beb262fe244bfbcdd1c163 upstream.
The support for __uint128_t is dependent on the target bit size.
GCC that defaults to the 32-bit can still build the 64-bit kernel with -m64 flag passed.
However, $(cc-option,-D__SIZEOF_INT128__=0) is evaluated against the default machine bit, which may not match to the kernel it is building.
Theoretically, this could be evaluated separately for 64BIT/32BIT.
config CC_HAS_INT128
bool
default !$(cc-option,$(m64-flag) -D__SIZEOF_INT128__=0) if 64BIT
default !$(cc-option,$(m32-flag) -D__SIZEOF_INT128__=0)I simplified it more because the 32-bit compiler is unlikely to support __uint128_t.
--- init/Kconfig | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
init/Kconfig +1 -2
@@ -767,8 +767,7 @@ config ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH bool config CC_HAS_INT128 - def_bool y - depends on !$(cc-option,-D__SIZEOF_INT128__=0) + def_bool !$(cc-option,$(m64-flag) -D__SIZEOF_INT128__=0) && 64BIT # # For architectures that know their GCC __int128 support is sound
Greg Kroah-Hartman
maintainerPATCH 84/119 modpost: move the namespace field in Module.symvers last
In reply to Greg Kroah-HartmanFrom: Jessica Yu <[email protected]>
commit 5190044c2965514a973184ca68ef5fad57a24670 upstream.
In order to preserve backwards compatability with kmod tools, we have to move the namespace field in Module.symvers last, as the depmod -e -E option looks at the first three fields in Module.symvers to check symbol versions (and it's expected they stay in the original order of crc, symbol, module).
In addition, update an ancient comment above read_dump() in modpost that suggested that the export type field in Module.symvers was optional. I suspect that there were historical reasons behind that comment that are no longer accurate. We have been unconditionally printing the export type since 2.6.18 (commit bd5cbcedf44), which is over a decade ago now.
Fix up read_dump() to treat each field as non-optional. I suspect the original read_dump() code treated the export field as optional in order to support pre <= 2.6.18 Module.symvers (which did not have the export type field). Note that although symbol namespaces are optional, the field will not be omitted from Module.symvers if a symbol does not have a namespace. In this case, the field will simply be empty and the next delimiter or end of line will follow.
--- Documentation/kbuild/modules.rst | 4 ++-- scripts/export_report.pl | 2 +- scripts/mod/modpost.c | 24 ++++++++++++------------ 3 files changed, 15 insertions(+), 15 deletions(-)
Documentation/kbuild/modules.rst +2 -2
@@ -470,9 +470,9 @@ build. The syntax of the Module.symvers file is:: - <CRC> <Symbol> <Namespace> <Module> <Export Type> + <CRC> <Symbol> <Module> <Export Type> <Namespace> - 0xe1cc2a05 usb_stor_suspend USB_STORAGE drivers/usb/storage/usb-storage EXPORT_SYMBOL_GPL + 0xe1cc2a05 usb_stor_suspend drivers/usb/storage/usb-storage EXPORT_SYMBOL_GPL USB_STORAGE The fields are separated by tabs and values may be empty (e.g. if no namespace is defined for an exported symbol).
scripts/export_report.pl +1 -1
@@ -94,7 +94,7 @@ if (defined $opt{'o'}) { # while ( <$module_symvers> ) { chomp; - my (undef, $symbol, $namespace, $module, $gpl) = split('\t'); + my (undef, $symbol, $module, $gpl, $namespace) = split('\t'); $SYMBOL { $symbol } = [ $module , "0" , $symbol, $gpl]; } close($module_symvers);
scripts/mod/modpost.c +12 -12
@@ -2433,7 +2433,7 @@ static void write_if_changed(struct buff }/* parse Module.symvers file. line format: -* 0x12345678<tab>symbol<tab>module[[<tab>export]<tab>something] +* 0x12345678<tab>symbol<tab>module<tab>export<tab>namespace **/ static void read_dump (const char *fname,unsigned int kernel) {
@@ -2446,7 +2446,7 @@ static void read_dump(const char *fname,return ;while ((line =get_next_line (&pos, file, size))) { -char *symname, *namespace, *modname, *d, *export, *end; +char *symname, *namespace, *modname, *d, *export;unsigned int crc;struct module *mod;struct symbol *s;
@@ -2454,16 +2454,16 @@ static void read_dump(const char *fname,if (!(symname =strchr (line,'\t' ))) goto fail; *symname++ ='\0' ; -if (!(namespace =strchr (symname,'\t' ))) - goto fail; - *namespace++ ='\0' ; -if (!(modname =strchr (namespace,'\t' ))) +if (!(modname =strchr (symname,'\t' ))) goto fail; *modname++ ='\0' ; -if ((export =strchr (modname,'\t' )) !=NULL ) - *export++ ='\0' ; -if (export && ((end =strchr (export,'\t' )) !=NULL )) - *end ='\0' ; +if (!(export =strchr (modname,'\t' ))) + goto fail; + *export++ ='\0' ; +if (!(namespace =strchr (export,'\t' ))) + goto fail; + *namespace++ ='\0' ; + crc =strtoul (line, &d,16 );if (*symname =='\0' || *modname =='\0' || *d !='\0' ) goto fail;
@@ -2514,9 +2514,9 @@ static void write_dump(const char *fname namespace = symbol->namespace;buf_printf (&buf,"0x%08x\t%s\t%s\t%s\t%s\n" , symbol->crc, symbol->name, - namespace ? namespace :"" , symbol->module->name, -export_str (symbol->export)); +export_str (symbol->export), + namespace ? namespace :"" ); } symbol = symbol->next; }
Greg Kroah-Hartman
maintainerPATCH 85/119 rtc: max8907: add missing select REGMAP_IRQ
In reply to Greg Kroah-HartmanFrom: Corentin Labbe <[email protected]>
commit 5d892919fdd0cefd361697472d4e1b174a594991 upstream.
I have hit the following build error:
armv7a-hardfloat-linux-gnueabi-ld: drivers/rtc/rtc-max8907.o: in function `max8907_rtc_probe':
rtc-max8907.c:(.text+0x400): undefined reference to `regmap_irq_get_virq'
max8907 should select REGMAP_IRQ
--- drivers/rtc/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/rtc/Kconfig +1 -0
@@ -327,6 +327,7 @@ config RTC_DRV_MAX6900 config RTC_DRV_MAX8907 tristate "Maxim MAX8907" depends on MFD_MAX8907 || COMPILE_TEST + select REGMAP_IRQ help If you say yes here you will get support for the RTC of Maxim MAX8907 PMIC.
Greg Kroah-Hartman
maintainerPATCH 86/119 arm64: compat: Fix syscall number of compat_clock_getres
In reply to Greg Kroah-HartmanFrom: Vincenzo Frascino <[email protected]>
commit 3568b88944fef28db3ee989b957da49ffc627ede upstream.
The syscall number of compat_clock_getres was erroneously set to 247 (__NR_io_cancel!) instead of 264. This causes the vDSO fallback of clock_getres() to land on the wrong syscall for compat tasks.
Fix the numbering.
--- arch/arm64/include/asm/unistd.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/include/asm/unistd.h +1 -1
@@ -25,8 +25,8 @@#define __NR_compat_gettimeofday 78#define __NR_compat_sigreturn 119#define __NR_compat_rt_sigreturn 173 -#define __NR_compat_clock_getres 247#define __NR_compat_clock_gettime 263 +#define __NR_compat_clock_getres 264#define __NR_compat_clock_gettime64 403#define __NR_compat_clock_getres_time64 406
Greg Kroah-Hartman
maintainerPATCH 87/119 xhci: Do not open code __print_symbolic() in xhci trace events
In reply to Greg Kroah-HartmanFrom: Steven Rostedt (VMware) <[email protected]>
commit 045706bff837ee89c13f1ace173db71922c1c40b upstream.
libtraceevent (used by perf and trace-cmd) failed to parse the xhci_urb_dequeue trace event. This is because the user space trace event format parsing is not a full C compiler. It can handle some basic logic, but is not meant to be able to handle everything C can do.
In cases where a trace event field needs to be converted from a number to a string, there's the __print_symbolic() macro that should be used:
See samples/trace_events/trace-events-sample.h
Some xhci trace events open coded the __print_symbolic() causing the user spaces tools to fail to parse it. This has to be replaced with __print_symbolic() instead.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=206531
--- drivers/usb/host/xhci-trace.h | 23 ++++++----------------- 1 file changed, 6 insertions(+), 17 deletions(-)
drivers/usb/host/xhci-trace.h +6 -17
@@ -289,23 +289,12 @@ DECLARE_EVENT_CLASS(xhci_log_urb, ),TP_printk ("ep%d%s-%s: urb %p pipe %u slot %d length %d/%d sgs %d/%d stream %d flags %08x" , __entry->epnum, __entry->dir_in ?"in" :"out" , - ({char *s; -switch (__entry->type) { -case USB_ENDPOINT_XFER_INT : - s ="intr" ; -break ; -case USB_ENDPOINT_XFER_CONTROL : - s ="control" ; -break ; -case USB_ENDPOINT_XFER_BULK : - s ="bulk" ; -break ; -case USB_ENDPOINT_XFER_ISOC : - s ="isoc" ; -break ; -default : - s ="UNKNOWN" ; - } s; }), __entry->urb, __entry->pipe, __entry->slot_id, +__print_symbolic (__entry->type, + { USB_ENDPOINT_XFER_INT, "intr" }, + { USB_ENDPOINT_XFER_CONTROL, "control" }, + { USB_ENDPOINT_XFER_BULK, "bulk" }, + { USB_ENDPOINT_XFER_ISOC, "isoc" }), + __entry->urb, __entry->pipe, __entry->slot_id, __entry->actual, __entry->length, __entry->num_mapped_sgs, __entry->num_sgs, __entry->stream, __entry->flags )
Greg Kroah-Hartman
maintainerPATCH 88/119 btrfs: fix log context list corruption after rename whiteout error
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
commit 236ebc20d9afc5e9ff52f3cf3f365a91583aac10 upstream.
During a rename whiteout, if btrfs_whiteout_for_rename() returns an error we can end up returning from btrfs_rename() with the log context object still in the root's log context list - this happens if 'sync_log' was set to true before we called btrfs_whiteout_for_rename() and it is dangerous because we end up with a corrupt linked list (root->log_ctxs) as the log context object was allocated on the stack.
After btrfs_rename() returns, any task that is running btrfs_sync_log() concurrently can end up crashing because that linked list is traversed by btrfs_sync_log() (through btrfs_remove_all_log_ctxs()). That results in the same issue that commit e6c617102c7e4 ("Btrfs: fix log context list corruption after rename exchange operation") fixed.
--- fs/btrfs/inode.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/btrfs/inode.c +4 -0
@@ -10159,6 +10159,10 @@ out_fail: ret =btrfs_sync_log (trans,BTRFS_I (old_inode)->root, &ctx);if (ret) commit_transaction = true; + }else if (sync_log) { +mutex_lock (&root->log_mutex); +list_del (&ctx.list); +mutex_unlock (&root->log_mutex); }if (commit_transaction) { ret =btrfs_commit_transaction (trans);
Greg Kroah-Hartman
maintainerPATCH 89/119 drm/amd/amdgpu: Fix GPR read from debugfs (v2)
In reply to Greg Kroah-HartmanFrom: Tom St Denis <[email protected]>
commit 5bbc6604a62814511c32f2e39bc9ffb2c1b92cbe upstream.
The offset into the array was specified in bytes but should be in terms of 32-bit words. Also prevent large reads that would also cause a buffer overread.
v2: Read from correct offset from internal storage buffer.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c +3 -3
@@ -694,11 +694,11 @@ static ssize_t amdgpu_debugfs_gpr_read(sssize_t result =0 ;uint32_t offset, se, sh, cu, wave, simd, thread, bank, *data; -if (size &3 || *pos &3 ) +if (size >4096 || size &3 || *pos &3 )return -EINVAL ;/* decode offset */ - offset = *pos &GENMASK_ULL (11 ,0 ); + offset = (*pos &GENMASK_ULL (11 ,0 )) >>2 ; se = (*pos &GENMASK_ULL (19 ,12 )) >>12 ; sh = (*pos &GENMASK_ULL (27 ,20 )) >>20 ; cu = (*pos &GENMASK_ULL (35 ,28 )) >>28 ;
@@ -729,7 +729,7 @@ static ssize_t amdgpu_debugfs_gpr_read(swhile (size) {uint32_t value; - value = data[offset++]; + value = data[result >>2 ]; r =put_user (value, (uint32_t *)buf);if (r) { result = r;
Greg Kroah-Hartman
maintainerPATCH 80/119 staging/speakup: fix get_word non-space look-ahead
In reply to Greg Kroah-HartmanFrom: Samuel Thibault <[email protected]>
commit 9d32c0cde4e2d1343dfb88a67b2ec6397705b32b upstream.
get_char was erroneously given the address of the pointer to the text instead of the address of the text, thus leading to random crashes when the user requests speaking a word while the current position is on a space character and say_word_ctl is not enabled.
Reported-on: https://github.com/bytefire/speakup/issues/1
--- drivers/staging/speakup/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/speakup/main.c +1 -1
@@ -561,7 +561,7 @@ static u_long get_word(struct vc_data *vreturn 0 ; }else if (tmpx < vc->vc_cols -2 && (ch ==SPACE || ch ==0 || (ch <0x100 &&IS_WDLM (ch))) && -get_char (vc, (u_short *)&tmp_pos +1 , &temp) >SPACE ) { +get_char (vc, (u_short *)tmp_pos +1 , &temp) >SPACE ) { tmp_pos +=2 ; tmpx++; }else {
Greg Kroah-Hartman
maintainerPATCH 70/119 iio: light: vcnl4000: update sampling periods for vcnl4040
In reply to Greg Kroah-HartmanFrom: Tomas Novotny <[email protected]>
commit 2ca5a8792d617b4035aacd0a8be527f667fbf912 upstream.
Vishay has published a new version of "Designing the VCNL4200 Into an Application" application note in October 2019. The new version specifies that there is +-20% of part to part tolerance. Although the application note is related to vcnl4200, according to support the vcnl4040's "ASIC is quite similar to that one for the VCNL4200".
So update the sampling periods (and comment), including the correct sampling period for proximity. Both sampling periods are lower. Users relying on the blocking behaviour of reading will get proximity measurements much earlier.
--- drivers/iio/light/vcnl4000.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/iio/light/vcnl4000.c +4 -3
@@ -174,9 +174,10 @@ static int vcnl4200_init(struct vcnl4000 data->al_scale =24000 ;break ;case VCNL4040_PROD_ID : -/* Integration time is 80ms, add 10ms. */ - data->vcnl4200_al.sampling_rate =ktime_set (0 ,100000 *1000 ); - data->vcnl4200_ps.sampling_rate =ktime_set (0 ,100000 *1000 ); +/* Default wait time is 80ms, add 20% tolerance. */ + data->vcnl4200_al.sampling_rate =ktime_set (0 ,96000 *1000 ); +/* Default wait time is 5ms, add 20% tolerance. */ + data->vcnl4200_ps.sampling_rate =ktime_set (0 ,6000 *1000 ); data->al_scale =120000 ;break ; }
Greg Kroah-Hartman
maintainerPATCH 118/119 kconfig: introduce m32-flag and m64-flag
In reply to Greg Kroah-HartmanFrom: Masahiro Yamada <[email protected]>
commit 8cc4fd73501d9f1370c3eebb70cfe8cc9e24062b upstream.
When a compiler supports multiple architectures, some compiler features can be dependent on the target architecture.
This is typical for Clang, which supports multiple LLVM backends. Even for GCC, we need to take care of biarch compiler cases.
It is not a problem when we evaluate cc-option in Makefiles because cc-option is tested against the flag in question + $(KBUILD_CFLAGS).
The cc-option in Kconfig, on the other hand, does not accumulate tested flags. Due to this simplification, it could potentially test cc-option against a different target.
At first, Kconfig always evaluated cc-option against the host architecture.
Since commit e8de12fb7cde ("kbuild: Check for unknown options with cc-option usage in Kconfig and clang"), in case of cross-compiling with Clang, the target triple is correctly passed to Kconfig.
The case with biarch GCC (and native build with Clang) is still not handled properly. We need to pass some flags to specify the target machine bit.
Due to the design, all the macros in Kconfig are expanded in the parse stage, where we do not know the target bit size yet.
For example, arch/x86/Kconfig allows a user to toggle CONFIG_64BIT. If a compiler flag -foo depends on the machine bit, it must be tested twice, one with -m32 and the other with -m64.
However, -m32/-m64 are not always recognized. So, this commits adds m64-flag and m32-flag macros. They expand to -m32, -m64, respectively if supported. Or, they expand to an empty string if unsupported.
The typical usage is like this:
config FOO
bool
default $(cc-option,$(m64-flag) -foo) if 64BIT
default $(cc-option,$(m32-flag) -foo)This is clumsy, but there is no elegant way to handle this in the current static macro expansion.
There was discussion for static functions vs dynamic functions. The consensus was to go as far as possible with the static functions.
(https://lkml.org/lkml/2018/3/2/22)
--- scripts/Kconfig.include | 7 +++++++ 1 file changed, 7 insertions(+)
scripts/Kconfig.include +7 -0
@@ -40,3 +40,10 @@ $(error-if,$(success, $(LD) -v | grep -q # gcc version including patch level gcc-version := $(shell,$(srctree)/scripts/gcc-version.sh $(CC)) + +# machine bit flags +# $(m32-flag): -m32 if the compiler supports it, or an empty string otherwise. +# $(m64-flag): -m64 if the compiler supports it, or an empty string otherwise. +cc-option-bit = $(if-success,$(CC) -Werror $(1) -E -x c /dev/null -o /dev/null,$(1)) +m32-flag := $(cc-option-bit,-m32) +m64-flag := $(cc-option-bit,-m64)
Greg Kroah-Hartman
maintainerPATCH 41/119 Revert "drm/fbdev: Fallback to non tiled mode if all tiles not present"
In reply to Greg Kroah-Hartman[ Upstream commit f053c83ad5c88427644e06746bfddcefa409c27d ]
This reverts commit f25c7a006cd1 ("drm/fbdev: Fallback to non tiled mode if all tiles not present"). The commit causes flip done timeouts in CI.
Below are the sample errors thrown in logs:
[IGT] core_getversion: executing
[IGT] core_getversion: exiting, ret=0
Setting dangerous option reset - tainting kernel drm:drm_atomic_helper_wait_for_dependencies] ERROR [CRTC:152:pipe B] flip_done timed out drm:drm_atomic_helper_wait_for_dependencies] ERROR [CONNECTOR:299:DP-2] flip_done timed out drm:drm_atomic_helper_wait_for_dependencies] ERROR [PLANE:92:plane 1B] flip_done timed out [drm:drm_atomic_helper_wait_for_flip_done] ERROR [CRTC:152:pipe B] flip_done timed out [drm:drm_atomic_helper_wait_for_dependencies] ERROR [CRTC:152:pipe B] flip_done timed out [drm:drm_atomic_helper_wait_for_dependencies] ERROR [CONNECTOR:299:DP-2] flip_done timed out [drm:drm_atomic_helper_wait_for_dependencies] ERROR [PLANE:92:plane 1B] flip_done timed out [drm:drm_atomic_helper_wait_for_flip_done] ERROR [CRTC:152:pipe B] flip_done timed out
Console: switching to colour frame buffer device 480x135 [drm:drm_atomic_helper_wait_for_dependencies] ERROR [CRTC:152:pipe B] flip_done timed out [drm:drm_atomic_helper_wait_for_dependencies] ERROR [CONNECTOR:299:DP-2] flip_done timed out
Reverting the change for now to unblock CI execution.
--- drivers/gpu/drm/drm_client_modeset.c | 72 ---------------------------- 1 file changed, 72 deletions(-)
drivers/gpu/drm/drm_client_modeset.c +0 -72
@@ -114,33 +114,6 @@ drm_client_find_modeset(struct drm_client_dev *client, struct drm_crtc *crtc)return NULL ; } -static struct drm_display_mode * -drm_connector_get_tiled_mode (struct drm_connector *connector) -{ -struct drm_display_mode *mode; - -list_for_each_entry (mode, &connector->modes, head) { -if (mode->hdisplay == connector->tile_h_size && - mode->vdisplay == connector->tile_v_size) -return mode; - } -return NULL ; -} - -static struct drm_display_mode * -drm_connector_fallback_non_tiled_mode (struct drm_connector *connector) -{ -struct drm_display_mode *mode; - -list_for_each_entry (mode, &connector->modes, head) { -if (mode->hdisplay == connector->tile_h_size && - mode->vdisplay == connector->tile_v_size) -continue ; -return mode; - } -return NULL ; -} -static struct drm_display_mode *drm_connector_has_preferred_mode (struct drm_connector *connector,int width,int height) {
@@ -375,15 +348,8 @@ static bool drm_client_target_preferred(struct drm_connector **connectors,struct drm_connector *connector;u64 conn_configured =0 ;int tile_pass =0 ; -int num_tiled_conns =0 ;int i; -for (i =0 ; i < connector_count; i++) { -if (connectors[i]->has_tile && - connectors[i]->status == connector_status_connected) - num_tiled_conns++; - } - retry:for (i =0 ; i < connector_count; i++) { connector = connectors[i];
@@ -433,28 +399,6 @@ static bool drm_client_target_preferred(struct drm_connector **connectors,list_for_each_entry (modes[i], &connector->modes, head)break ; } -/* -* In case of tiled mode if all tiles not present fallback to -* first available non tiled mode. -* After all tiles are present, try to find the tiled mode -* for all and if tiled mode not present due to fbcon size -* limitations, use first non tiled mode only for -* tile 0,0 and set to no mode for all other tiles. -*/ -if (connector->has_tile) { -if (num_tiled_conns < - connector->num_h_tile * connector->num_v_tile || - (connector->tile_h_loc ==0 && - connector->tile_v_loc ==0 && - !drm_connector_get_tiled_mode (connector))) { -DRM_DEBUG_KMS ("Falling back to non tiled mode on Connector %d\n" , - connector->base.id); - modes[i] =drm_connector_fallback_non_tiled_mode (connector); - }else { - modes[i] =drm_connector_get_tiled_mode (connector); - } - } -DRM_DEBUG_KMS ("found mode %s\n" , modes[i] ? modes[i]->name :"none" ); conn_configured |=BIT_ULL (i);
@@ -571,7 +515,6 @@ static bool drm_client_firmware_config(struct drm_client_dev *client,bool fallback = true, ret = true;int num_connectors_enabled =0 ;int num_connectors_detected =0 ; -int num_tiled_conns =0 ;struct drm_modeset_acquire_ctx ctx;if (!drm_drv_uses_atomic_modeset (dev))
@@ -589,11 +532,6 @@ static bool drm_client_firmware_config(struct drm_client_dev *client,memcpy (save_enabled, enabled, count); mask =GENMASK (count -1 ,0 ); conn_configured =0 ; -for (i =0 ; i < count; i++) { -if (connectors[i]->has_tile && - connectors[i]->status == connector_status_connected) - num_tiled_conns++; - } retry: conn_seq = conn_configured;for (i =0 ; i < count; i++) {
@@ -693,16 +631,6 @@ static bool drm_client_firmware_config(struct drm_client_dev *client, connector->name); modes[i] = &connector->state->crtc->mode; } -/* -* In case of tiled modes, if all tiles are not present -* then fallback to a non tiled mode. -*/ -if (connector->has_tile && - num_tiled_conns < connector->num_h_tile * connector->num_v_tile) { -DRM_DEBUG_KMS ("Falling back to non tiled mode on Connector %d\n" , - connector->base.id); - modes[i] =drm_connector_fallback_non_tiled_mode (connector); - } crtcs[i] = new_crtc; DRM_DEBUG_KMS("connector %s on [CRTC:%d:%s]: %dx%d%s\n",
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 68/119 iio: adc: at91-sama5d2_adc: fix differential channels in triggered mode
In reply to Greg Kroah-HartmanFrom: Eugen Hristev <[email protected]>
commit a500f3bd787f8224341e44b238f318c407b10897 upstream.
The differential channels require writing the channel offset register (COR). Otherwise they do not work in differential mode.
The configuration of COR is missing in triggered mode.
--- drivers/iio/adc/at91-sama5d2_adc.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
drivers/iio/adc/at91-sama5d2_adc.c +15 -0
@@ -723,6 +723,7 @@ static int at91_adc_configure_trigger(stfor_each_set_bit (bit, indio->active_scan_mask, indio->num_channels) {struct iio_chan_spec const *chan =at91_adc_chan_get (indio, bit); +u32 cor;if (!chan)continue ;
@@ -732,6 +733,20 @@ static int at91_adc_configure_trigger(stcontinue ;if (state) { + cor =at91_adc_readl (st,AT91_SAMA5D2_COR ); + +if (chan->differential) + cor |= (BIT (chan->channel) | +BIT (chan->channel2)) << +AT91_SAMA5D2_COR_DIFF_OFFSET ; +else + cor &= ~(BIT (chan->channel) << +AT91_SAMA5D2_COR_DIFF_OFFSET ); + +at91_adc_writel (st,AT91_SAMA5D2_COR , cor); + } + +if (state) {at91_adc_writel (st,AT91_SAMA5D2_CHER ,BIT (chan->channel));/* enable irq only if not using DMA */
Greg Kroah-Hartman
maintainerPATCH 66/119 iio: magnetometer: ak8974: Fix negative raw values in sysfs
In reply to Greg Kroah-HartmanFrom: Stephan Gerhold <[email protected]>
commit b500c086e4110829a308c23e83a7cdc65b26228a upstream.
At the moment, reading from in_magn_*_raw in sysfs tends to return large values around 65000, even though the output of ak8974 is actually limited to ±32768. This happens because the value is never converted to the signed 16-bit integer variant.
Add an explicit cast to s16 to fix this.
--- drivers/iio/magnetometer/ak8974.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/magnetometer/ak8974.c +1 -1
@@ -564,7 +564,7 @@ static int ak8974_read_raw(struct iio_de* We read all axes and discard all but one, for optimized * reading, use the triggered buffer. */ - *val =le16_to_cpu (hw_values[chan->address]); + *val = (s16 )le16_to_cpu (hw_values[chan->address]); ret =IIO_VAL_INT ; }
Greg Kroah-Hartman
maintainerPATCH 65/119 iio: accel: adxl372: Set iio_chan BE
In reply to Greg Kroah-HartmanFrom: Alexandru Tachici <[email protected]>
commit cb2116ff97859d34fda6cb561ac654415f4c6230 upstream.
Data stored in the iio-buffer is BE and this
should be specified in the iio_chan_spec struct.
--- drivers/iio/accel/adxl372.c | 1 + 1 file changed, 1 insertion(+)
drivers/iio/accel/adxl372.c +1 -0
@@ -237,6 +237,7 @@ static const struct adxl372_axis_lookup .realbits = 12, \ .storagebits = 16, \ .shift = 4, \ + .endianness = IIO_BE, \ }, \ }
Greg Kroah-Hartman
maintainerPATCH 61/119 tty: fix compat TIOCGSERIAL checking wrong function ptr
In reply to Greg Kroah-HartmanFrom: Eric Biggers <[email protected]>
commit 6e622cd8bd888c7fa3ee2b7dfb3514ab53b21570 upstream.
Commit 77654350306a ("take compat TIOC[SG]SERIAL treatment into tty_compat_ioctl()") changed the compat version of TIOCGSERIAL to start checking for the presence of the ->set_serial function pointer rather than ->get_serial. This appears to be a copy-and-paste error, since ->get_serial is the function pointer that is called as well as the pointer that is checked by the non-compat version of TIOCGSERIAL.
Fix this by checking the correct function pointer.
--- drivers/tty/tty_io.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/tty_io.c +1 -1
@@ -2738,7 +2738,7 @@ static int compat_tty_tiocgserial(structmemset (&v,0 ,sizeof (v));memset (&v32,0 ,sizeof (v32)); -if (!tty->ops->set_serial) +if (!tty->ops->get_serial)return -ENOTTY ; err = tty->ops->get_serial (tty, &v);if (!err) {
Greg Kroah-Hartman
maintainerPATCH 54/119 ALSA: hda/realtek - Enable headset mic of Acer X2660G with ALC662
In reply to Greg Kroah-HartmanFrom: Jian-Hong Pan <[email protected]>
commit d858c706bdca97698752bd26b60c21ec07ef04f2 upstream.
The Acer desktop X2660G with ALC662 can't detect the headset microphone until ALC662_FIXUP_ACER_X2660G_HEADSET_MODE quirk applied.
--- sound/pci/hda/patch_realtek.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
sound/pci/hda/patch_realtek.c +11 -0
@@ -8610,6 +8610,7 @@ enum {ALC669_FIXUP_ACER_ASPIRE_ETHOS ,ALC669_FIXUP_ACER_ASPIRE_ETHOS_HEADSET ,ALC671_FIXUP_HP_HEADSET_MIC2 , + ALC662_FIXUP_ACER_X2660G_HEADSET_MODE, }; static const struct hda_fixup alc662_fixups[] = {
@@ -8955,6 +8956,15 @@ static const struct hda_fixup alc662_fix .type = HDA_FIXUP_FUNC, .v.func = alc671_fixup_hp_headset_mic2, }, + [ALC662_FIXUP_ACER_X2660G_HEADSET_MODE] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl []) { + {0x1a ,0x02a1113c },/* use as headset mic, without its own jack detect */ + { } + }, + .chained = true, + .chain_id =ALC662_FIXUP_USI_FUNC + }, };static const struct snd_pci_quirk alc662_fixup_tbl[] = {
@@ -8966,6 +8976,7 @@ static const struct snd_pci_quirk alc662SND_PCI_QUIRK (0x1025 ,0x0349 ,"eMachines eM250" ,ALC662_FIXUP_INV_DMIC ),SND_PCI_QUIRK (0x1025 ,0x034a ,"Gateway LT27" ,ALC662_FIXUP_INV_DMIC ),SND_PCI_QUIRK (0x1025 ,0x038b ,"Acer Aspire 8943G" ,ALC662_FIXUP_ASPIRE ), +SND_PCI_QUIRK (0x1025 ,0x124e ,"Acer 2660G" ,ALC662_FIXUP_ACER_X2660G_HEADSET_MODE ),SND_PCI_QUIRK (0x1028 ,0x05d8 ,"Dell" ,ALC668_FIXUP_DELL_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1028 ,0x05db ,"Dell" ,ALC668_FIXUP_DELL_MIC_NO_PRESENCE ), SND_PCI_QUIRK(0x1028, 0x05fe, "Dell XPS 15", ALC668_FIXUP_DELL_XPS13),
Greg Kroah-Hartman
maintainerPATCH 51/119 USB: cdc-acm: fix close_delay and closing_wait units in TIOCSSERIAL
In reply to Greg Kroah-HartmanFrom: Anthony Mallet <[email protected]>
commit 633e2b2ded739a34bd0fb1d8b5b871f7e489ea29 upstream.
close_delay and closing_wait are specified in hundredth of a second but stored internally in jiffies. Use the jiffies_to_msecs() and msecs_to_jiffies() functions to convert from each other.
--- drivers/usb/class/cdc-acm.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/usb/class/cdc-acm.c +5 -4
@@ -896,10 +896,10 @@ static int get_serial_info(struct tty_st ss->xmit_fifo_size = acm->writesize; ss->baud_base =le32_to_cpu (acm->line.dwDTERate); - ss->close_delay = acm->port.close_delay /10 ; + ss->close_delay =jiffies_to_msecs (acm->port.close_delay) /10 ; ss->closing_wait = acm->port.closing_wait ==ASYNC_CLOSING_WAIT_NONE ?ASYNC_CLOSING_WAIT_NONE : - acm->port.closing_wait /10 ; +jiffies_to_msecs (acm->port.closing_wait) /10 ;return 0 ; }
@@ -909,9 +909,10 @@ static int set_serial_info(struct tty_stunsigned int closing_wait, close_delay;int retval =0 ; - close_delay = ss->close_delay *10 ; + close_delay =msecs_to_jiffies (ss->close_delay *10 ); closing_wait = ss->closing_wait ==ASYNC_CLOSING_WAIT_NONE ? -ASYNC_CLOSING_WAIT_NONE : ss->closing_wait *10 ; +ASYNC_CLOSING_WAIT_NONE : +msecs_to_jiffies (ss->closing_wait *10 );mutex_lock (&acm->port.mutex);
Greg Kroah-Hartman
maintainerPATCH 7/119 phy: ti: gmii-sel: do not fail in case of gmii
In reply to Greg Kroah-HartmanFrom: Grygorii Strashko <[email protected]>
[ Upstream commit 58aa7729310db04ffcc022c98002dd8fcb486c58 ]
The "gmii" PHY interface mode is supported on TI AM335x/437x/5xx SoCs, so don't fail if it's selected.
--- drivers/phy/ti/phy-gmii-sel.c | 1 + 1 file changed, 1 insertion(+)
drivers/phy/ti/phy-gmii-sel.c +1 -0
@@ -80,6 +80,7 @@ static int phy_gmii_sel_mode(struct phy *phy, enum phy_mode mode, int submode)break ;case PHY_INTERFACE_MODE_MII : +case PHY_INTERFACE_MODE_GMII : gmii_sel_mode =AM33XX_GMII_SEL_MODE_MII ;break ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 6/119 phy: ti: gmii-sel: fix set of copy-paste errors
In reply to Greg Kroah-HartmanFrom: Grygorii Strashko <[email protected]>
[ Upstream commit eefed634eb61e4094b9fb8183cb8d43b26838517 ]
- under PHY_INTERFACE_MODE_MII the 'mode' func parameter is assigned instead of 'gmii_sel_mode' and it's working only because the default value 'gmii_sel_mode' is set to 0.
- console outputs use 'rgmii_id' and 'mode' values to print PHY mode instead of using 'submode' value which is representing PHY interface mode now.
This patch fixes above two cases.
--- drivers/phy/ti/phy-gmii-sel.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
drivers/phy/ti/phy-gmii-sel.c +4 -5
@@ -80,20 +80,19 @@ static int phy_gmii_sel_mode(struct phy *phy, enum phy_mode mode, int submode)break ;case PHY_INTERFACE_MODE_MII : - mode =AM33XX_GMII_SEL_MODE_MII ; + gmii_sel_mode =AM33XX_GMII_SEL_MODE_MII ;break ;default : -dev_warn (dev, -"port%u: unsupported mode: \"%s\". Defaulting to MII.\n" , - if_phy->id,phy_modes (rgmii_id)); +dev_warn (dev,"port%u: unsupported mode: \"%s\"\n" , + if_phy->id,phy_modes (submode));return -EINVAL ; } if_phy->phy_if_mode = submode;dev_dbg (dev,"%s id:%u mode:%u rgmii_id:%d rmii_clk_ext:%d\n" , - __func__, if_phy->id, mode, rgmii_id, + __func__, if_phy->id, submode, rgmii_id, if_phy->rmii_clock_external); regfield = if_phy->fields[PHY_GMII_SEL_PORT_MODE ];
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 20/119 drivers/perf: fsl_imx8_ddr: Correct the CLEAR bit definition
In reply to Greg Kroah-HartmanFrom: Joakim Zhang <[email protected]>
[ Upstream commit 049d919168458ac54e7fad27cd156a958b042d2f ]
When disabling a counter from ddr_perf_event_stop(), the counter value is reset to 0 at the same time.
Preserve the counter value by performing a read-modify-write of the PMU register and clearing only the enable bit.
--- drivers/perf/fsl_imx8_ddr_perf.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/perf/fsl_imx8_ddr_perf.c +6 -4
@@ -388,9 +388,10 @@ static void ddr_perf_counter_enable(struct ddr_pmu *pmu, int config,if (enable) {/* -* must disable first, then enable again -* otherwise, cycle counter will not work -* if previous state is enabled. +* cycle counter is special which should firstly write 0 then +* write 1 into CLEAR bit to clear it. Other counters only +* need write 0 into CLEAR bit and it turns out to be 1 by +* hardware. Below enable flow is harmless for all counters. */ writel (0 , pmu->base + reg); val =CNTL_EN |CNTL_CLEAR ;
@@ -398,7 +399,8 @@ static void ddr_perf_counter_enable(struct ddr_pmu *pmu, int config,writel (val, pmu->base + reg); }else {/* Disable counter */ -writel (0 , pmu->base + reg); + val =readl_relaxed (pmu->base + reg) &CNTL_EN_MASK ; +writel (val, pmu->base + reg); } }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 21/119 drivers/perf: arm_pmu_acpi: Fix incorrect checking of gicc pointer
In reply to Greg Kroah-HartmanFrom: luanshi <[email protected]>
[ Upstream commit 3ba52ad55b533760a1f65836aa0ec9d35e36bb4f ]
Fix bogus NULL checks on the return value of acpi_cpu_get_madt_gicc() by checking for a 0 'gicc->performance_interrupt' value instead.
--- drivers/perf/arm_pmu_acpi.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
drivers/perf/arm_pmu_acpi.c +2 -5
@@ -24,8 +24,6 @@ static int arm_pmu_acpi_register_irq(int cpu)int gsi, trigger; gicc =acpi_cpu_get_madt_gicc (cpu); -if (WARN_ON (!gicc)) -return -EINVAL ; gsi = gicc->performance_interrupt;
@@ -64,11 +62,10 @@ static void arm_pmu_acpi_unregister_irq(int cpu)int gsi; gicc =acpi_cpu_get_madt_gicc (cpu); -if (!gicc) -return ; gsi = gicc->performance_interrupt; -acpi_unregister_gsi (gsi); +if (gsi) +acpi_unregister_gsi (gsi); }#if IS_ENABLED (CONFIG_ARM_SPE_PMU )
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 16/119 ARM: dts: bcm283x: Add missing properties to the PWR LED
In reply to Greg Kroah-HartmanFrom: Stefan Wahren <[email protected]>
[ Upstream commit bff211bab301db890e38de872d43cbb459940daa ]
This adds the missing properties to the PWR LED for the RPi 3 & 4 boards, which are already set for the other boards. Without them we will lose the LED state after suspend.
--- arch/arm/boot/dts/bcm2711-rpi-4-b.dts | 2 ++ arch/arm/boot/dts/bcm2837-rpi-3-a-plus.dts | 2 ++ arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts | 2 ++ 3 files changed, 6 insertions(+)
arch/arm/boot/dts/bcm2711-rpi-4-b.dts +2 -0
@@ -31,6 +31,8 @@ pwr { label = "PWR"; gpios = <&expgpio 2 GPIO_ACTIVE_LOW>; + default-state = "keep"; + linux,default-trigger = "default-on"; }; };
arch/arm/boot/dts/bcm2837-rpi-3-a-plus.dts +2 -0
@@ -26,6 +26,8 @@ pwr { label = "PWR"; gpios = <&expgpio 2 GPIO_ACTIVE_LOW>; + default-state = "keep"; + linux,default-trigger = "default-on"; }; }; };
arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts +2 -0
@@ -27,6 +27,8 @@ pwr { label = "PWR"; gpios = <&expgpio 2 GPIO_ACTIVE_LOW>; + default-state = "keep"; + linux,default-trigger = "default-on"; }; };
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 1/119 locks: fix a potential use-after-free problem when wakeup a waiter
In reply to Greg Kroah-HartmanFrom: yangerkun <[email protected]>
[ Upstream commit 6d390e4b5d48ec03bb87e63cf0a2bff5f4e116da ]
'16306a61d3b7 ("fs/locks: always delete_block after waiting.")' add the logic to check waiter->fl_blocker without blocked_lock_lock. And it will trigger a UAF when we try to wakeup some waiter：
Thread 1 has create a write flock a on file, and now thread 2 try to unlock and delete flock a, thread 3 try to add flock b on the same file.
Thread2 Thread3
flock syscall(create flock b) ...flock_lock_inode_wait
flock_lock_inode(will insert our fl_blocked_member list to flock a's fl_blocked_requests)
sleep
flock syscall(unlock)
...flock_lock_inode_wait
locks_delete_lock_ctx
...__locks_wake_up_blocks
__locks_delete_blocks(
b->fl_blocker = NULL)
...
break by a signal
locks_delete_block
b->fl_blocker == NULL &&
list_empty(&b->fl_blocked_requests)
success, return directly
locks_free_lock b
wake_up(&b->fl_waiter)
trigger UAFFix it by remove this logic, and this patch may also fix CVE-2019-19769.
--- fs/locks.c | 14 -------------- 1 file changed, 14 deletions(-)
fs/locks.c +0 -14
@@ -753,20 +753,6 @@ int locks_delete_block(struct file_lock *waiter) {int status = -ENOENT ; -/* -* If fl_blocker is NULL, it won't be set again as this thread -* "owns" the lock and is the only one that might try to claim -* the lock. So it is safe to test fl_blocker locklessly. -* Also if fl_blocker is NULL, this waiter is not listed on -* fl_blocked_requests for some lock, so no other request can -* be added to the list of fl_blocked_requests for this -* request. So if fl_blocker is NULL, it is safe to -* locklessly check if fl_blocked_requests is empty. If both -* of these checks succeed, there is no need to take the lock. -*/ -if (waiter->fl_blocker ==NULL && -list_empty (&waiter->fl_blocked_requests)) -return status;spin_lock (&blocked_lock_lock);if (waiter->fl_blocker) status =0 ;
Signature · 1 line
2.20.1
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.5.12 release. There are 119 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 26 Mar 2020 13:06:42 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.5.12-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.5.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.5.12 release. There are 119 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 26 Mar 2020 13:06:42 +0000. Anything received after that time might be too late.
Build results:
total: 157 pass: 157 fail: 0 Qemu test results: total: 428 pass: 428 fail: 0
Guenter
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.5.12 release. There are 119 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 26 Mar 2020 13:06:42 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.5.12-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.5.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
Summary
------------------------------------------------------------------------
kernel: 5.5.12-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-5.5.y
git commit: 738ff80e1bc68169f717060d4bca7cb6098741c5
git describe: v5.5.11-120-g738ff80e1bc6
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-5.5-oe/build/v5.5.11-120-g738ff80e1bc6
No regressions (compared to build v5.5.10-55-gbea94317c526)
No fixes (compared to build v5.5.10-55-gbea94317c526)
Ran 37203 total tests in the following environments and test suites.
Environments
--------------
- dragonboard-410c
- hi6220-hikey
- i386
- juno-r2
- juno-r2-compat
- juno-r2-kasan
- nxp-ls2088
- qemu_arm
- qemu_arm64
- qemu_i386
- qemu_x86_64
- x15
- x86
- x86-kasan
Test Suites
-----------
* build
* install-android-platform-tools-r2600
* install-android-platform-tools-r2800
* libgpiod
* libhugetlbfs
* linux-log-parser
* ltp-cve-tests
* ltp-dio-tests
* ltp-fs-tests
* ltp-io-tests
* perf
* v4l2-compliance
* ltp-cap_bounds-tests
* ltp-cpuhotplug-tests
* ltp-crypto-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* network-basic-tests
* kselftest
* kvm-unit-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-ipc-tests
* ltp-math-tests
* spectre-meltdown-checker-test
* ltp-open-posix-tests
* kselftest-vsyscall-mode-native
* kselftest-vsyscall-mode-none
Signature · 2 lines
Linaro LKFT https://lkft.linaro.org
Greg Kroah-Hartman
maintainerQuoted 15 lines · shuah
Quoted 14 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.5.12 release. There are 119 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 26 Mar 2020 13:06:42 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.5.12-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.5.y
and the diffstat can be found below.
Quoted 6 lines
Quoted 4 lines
thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
Thanks for testing these and letting me know.
greg k-h
Greg Kroah-Hartman
maintainerQuoted 6 lines · Guenter Roeck
Quoted 5 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.5.12 release. There are 119 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 8 lines
Quoted 3 lines
Responses should be made by Thu, 26 Mar 2020 13:06:42 +0000. Anything received after that time might be too late.
Build results:
total: 157 pass: 157 fail: 0 Qemu test results: total: 428 pass: 428 fail: 0
Thanks ofr testinging all of these and letting me know.
greg k-h
Greg Kroah-Hartman
maintainerQuoted 17 lines · Naresh Kamboju
Quoted 15 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.5.12 release. There are 119 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 26 Mar 2020 13:06:42 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.5.12-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.5.y
and the diffstat can be found below.
Quoted 6 lines
Quoted 3 lines
thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm,x86_64, and i386.
Great, thanks for testing these and letting me know.
greg k-h