6.1.14-rc1 review
Greg Kroah-Hartman
maintainerPATCH 1/46 drm/etnaviv: dont truncate physical page address
In reply to Greg Kroah-HartmanFrom: Lucas Stach <[email protected]>
[ Upstream commit d37c120b73128690434cc093952439eef9d56af1 ]
While the interface for the MMU mapping takes phys_addr_t to hold a full 64bit address when necessary and MMUv2 is able to map physical addresses with up to 40bit, etnaviv_iommu_map() truncates the address to 32bits. Fix this by using the correct type.
--- drivers/gpu/drm/etnaviv/etnaviv_mmu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/etnaviv/etnaviv_mmu.c +2 -2
@@ -80,10 +80,10 @@ static int etnaviv_iommu_map(struct etnaviv_iommu_context *context, u32 iova,return -EINVAL ;for_each_sgtable_dma_sg (sgt, sg, i) { -u32 pa =sg_dma_address (sg) - sg->offset; +phys_addr_t pa =sg_dma_address (sg) - sg->offset;size_t bytes =sg_dma_len (sg) + sg->offset; -VERB ("map[%d]: %08x %08x(%zx)" , i, iova, pa, bytes); +VERB ("map[%d]: %08x %pap(%zx)" , i, iova, &pa, bytes); ret =etnaviv_context_map (context, da, pa, bytes, prot);if (ret)
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 2/46 wifi: ath11k: fix warning in dma_free_coherent() of memory chunks while recovery
In reply to Greg Kroah-HartmanFrom: Wen Gong <[email protected]>
[ Upstream commit f74878433d5ade360447da5d92e9c2e535780d80 ]
Commit 26f3a021b37c ("ath11k: allocate smaller chunks of memory for firmware") and commit f6f92968e1e5 ("ath11k: qmi: try to allocate a big block of DMA memory first") change ath11k to allocate the memory chunks for target twice while wlan load. It fails for the 1st time because of large memory and then changed to allocate many small chunks for the 2nd time sometimes as below log.
1st time failed:
[10411.640620] ath11k_pci 0000:05:00.0: qmi firmware request memory request [10411.640625] ath11k_pci 0000:05:00.0: qmi mem seg type 1 size 6881280 [10411.640630] ath11k_pci 0000:05:00.0: qmi mem seg type 4 size 3784704 [10411.640658] ath11k_pci 0000:05:00.0: qmi dma allocation failed (6881280 B type 1), will try later with small size [10411.640671] ath11k_pci 0000:05:00.0: qmi delays mem_request 2 [10411.640677] ath11k_pci 0000:05:00.0: qmi respond memory request delayed 1 2nd time success: [10411.642004] ath11k_pci 0000:05:00.0: qmi firmware request memory request [10411.642008] ath11k_pci 0000:05:00.0: qmi mem seg type 1 size 524288 [10411.642012] ath11k_pci 0000:05:00.0: qmi mem seg type 1 size 524288 [10411.642014] ath11k_pci 0000:05:00.0: qmi mem seg type 1 size 524288 [10411.642016] ath11k_pci 0000:05:00.0: qmi mem seg type 1 size 524288 [10411.642018] ath11k_pci 0000:05:00.0: qmi mem seg type 1 size 524288 [10411.642020] ath11k_pci 0000:05:00.0: qmi mem seg type 1 size 524288 [10411.642022] ath11k_pci 0000:05:00.0: qmi mem seg type 1 size 524288 [10411.642024] ath11k_pci 0000:05:00.0: qmi mem seg type 1 size 524288 [10411.642027] ath11k_pci 0000:05:00.0: qmi mem seg type 1 size 524288 [10411.642029] ath11k_pci 0000:05:00.0: qmi mem seg type 1 size 524288 [10411.642031] ath11k_pci 0000:05:00.0: qmi mem seg type 1 size 458752 [10411.642033] ath11k_pci 0000:05:00.0: qmi mem seg type 1 size 131072 [10411.642035] ath11k_pci 0000:05:00.0: qmi mem seg type 4 size 524288 [10411.642037] ath11k_pci 0000:05:00.0: qmi mem seg type 4 size 524288 [10411.642039] ath11k_pci 0000:05:00.0: qmi mem seg type 4 size 524288 [10411.642041] ath11k_pci 0000:05:00.0: qmi mem seg type 4 size 524288 [10411.642043] ath11k_pci 0000:05:00.0: qmi mem seg type 4 size 524288 [10411.642045] ath11k_pci 0000:05:00.0: qmi mem seg type 4 size 524288 [10411.642047] ath11k_pci 0000:05:00.0: qmi mem seg type 4 size 491520 [10411.642049] ath11k_pci 0000:05:00.0: qmi mem seg type 1 size 524288
And then commit 5962f370ce41 ("ath11k: Reuse the available memory after firmware reload") skip the ath11k_qmi_free_resource() which frees the memory chunks while recovery, after that, when run recovery test on WCN6855, a warning happened every time as below and finally leads fail for recovery.
[ 159.570318] BUG: Bad page state in process kworker/u16:5 pfn:33300 [ 159.570320] page:0000000096ffdbb9 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x33300 [ 159.570324] flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff) [ 159.570329] raw: 000fffffc0000000 0000000000000000 dead000000000122 0000000000000000 [ 159.570332] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 159.570334] page dumped because: nonzero _refcount [ 159.570440] firewire_ohci syscopyarea sysfillrect psmouse sdhci_pci ahci sysimgblt firewire_core fb_sys_fops libahci crc_itu_t cqhci drm sdhci e1000e wmi video [ 159.570460] CPU: 2 PID: 217 Comm: kworker/u16:5 Kdump: loaded Tainted: G B 5.19.0-rc1-wt-ath+ #3 [ 159.570465] Hardware name: LENOVO 418065C/418065C, BIOS 83ET63WW (1.33 ) 07/29/2011 [ 159.570467] Workqueue: qmi_msg_handler qmi_data_ready_work [qmi_helpers] [ 159.570475] Call Trace: [ 159.570476] <TASK> [ 159.570478] dump_stack_lvl+0x49/0x5f [ 159.570486] dump_stack+0x10/0x12 [ 159.570493] bad_page+0xab/0xf0 [ 159.570502] check_free_page_bad+0x66/0x70 [ 159.570511] __free_pages_ok+0x530/0x9a0 [ 159.570517] ? __dev_printk+0x58/0x6b [ 159.570525] ? _dev_printk+0x56/0x72 [ 159.570534] ? qmi_decode+0x119/0x470 [qmi_helpers] [ 159.570543] __free_pages+0x91/0xd0 [ 159.570548] dma_free_contiguous+0x50/0x60 [ 159.570556] dma_direct_free+0xe5/0x140 [ 159.570564] dma_free_attrs+0x35/0x50 [ 159.570570] ath11k_qmi_msg_mem_request_cb+0x2ae/0x3c0 [ath11k] [ 159.570620] qmi_invoke_handler+0xac/0xe0 [qmi_helpers] [ 159.570630] qmi_handle_message+0x6d/0x180 [qmi_helpers] [ 159.570643] qmi_data_ready_work+0x2ca/0x440 [qmi_helpers] [ 159.570656] process_one_work+0x227/0x440 [ 159.570667] worker_thread+0x31/0x3d0 [ 159.570676] ? process_one_work+0x440/0x440 [ 159.570685] kthread+0xfe/0x130 [ 159.570692] ? kthread_complete_and_exit+0x20/0x20 [ 159.570701] ret_from_fork+0x22/0x30 [ 159.570712] </TASK>
The reason is because when wlan start to recovery, the type, size and count is not same for the 1st and 2nd QMI_WLFW_REQUEST_MEM_IND message, Then it leads the parameter size is not correct for the dma_free_coherent(). For the chunk[1], the actual dma size is 524288 which allocate in the 2nd time of the initial wlan load phase, and the size which pass to dma_free_coherent() is 3784704 which is got in the 1st time of recovery phase, then warning above happened.
Change to use prev_size of struct target_mem_chunk for the paramter of dma_free_coherent() since prev_size is the real size of last load/recovery. Also change to check both type and size of struct target_mem_chunk to reuse the memory to avoid mismatch buffer size for target. Then the warning disappear and recovery success. When the 1st QMI_WLFW_REQUEST_MEM_IND for recovery arrived, the trunk[0] is freed in ath11k_qmi_alloc_target_mem_chunk() and then dma_alloc_coherent() failed caused by large size, and then trunk[1] is freed in ath11k_qmi_free_target_mem_chunk(), the left 18 trunks will be reuse for the 2nd QMI_WLFW_REQUEST_MEM_IND message.
Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3
--- drivers/net/wireless/ath/ath11k/qmi.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/wireless/ath/ath11k/qmi.c +3 -3
@@ -1964,7 +1964,7 @@ static void ath11k_qmi_free_target_mem_chunk(struct ath11k_base *ab)continue ;dma_free_coherent (ab->dev, - ab->qmi.target_mem[i].size, + ab->qmi.target_mem[i].prev_size, ab->qmi.target_mem[i].vaddr, ab->qmi.target_mem[i].paddr); ab->qmi.target_mem[i].vaddr =NULL ;
@@ -1985,12 +1985,12 @@ static int ath11k_qmi_alloc_target_mem_chunk(struct ath11k_base *ab)* in such case, no need to allocate memory for FW again. */ if (chunk->vaddr) { -if (chunk->prev_type == chunk->type || +if (chunk->prev_type == chunk->type && chunk->prev_size == chunk->size)continue ;/* cannot reuse the existing chunk */ -dma_free_coherent (ab->dev, chunk->size, +dma_free_coherent (ab->dev, chunk->prev_size, chunk->vaddr, chunk->paddr); chunk->vaddr =NULL ; }
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainercover 6.1.14-rc1 review
This is the start of the stable review cycle for the 6.1.14 release. There are 46 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 25 Feb 2023 13:04:16 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.14-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.1.14-rc1
Eric Biggers <[email protected]>
randstruct: disable Clang 15 support
Kees Cook <[email protected]>
ext4: Fix function prototype mismatch for ext4_feat_ktype
Hans de Goede <[email protected]>
platform/x86: nvidia-wmi-ec-backlight: Add force module parameter
Shyam Sundar S K <[email protected]>
platform/x86/amd/pmf: Add depends on CONFIG_POWER_SUPPLY
Paul Moore <[email protected]>
audit: update the mailing list in MAINTAINERS
Lukas Wunner <[email protected]>
wifi: mwifiex: Add missing compatible string for SD8787
Tom Saeger <[email protected]>
sh: define RUNTIME_DISCARD_EXIT
Masahiro Yamada <[email protected]>
s390: define RUNTIME_DISCARD_EXIT to fix link error with GNU ld < 2.36
Michael Ellerman <[email protected]>
powerpc/vmlinux.lds: Don't discard .rela* for relocatable builds
Michael Ellerman <[email protected]>
powerpc/vmlinux.lds: Define RUNTIME_DISCARD_EXIT
Masahiro Yamada <[email protected]>
arch: fix broken BuildID for arm64 and riscv
Masahiro Yamada <[email protected]>
arm64: remove special treatment for the link order of head.o
Jisheng Zhang <[email protected]>
riscv: remove special treatment for the link order of head.o
Shengyu Qu <[email protected]>
Bluetooth: btusb: Add more device IDs for WCN6855
Peter Zijlstra <[email protected]>
x86/static_call: Add support for Jcc tail-calls
Peter Zijlstra <[email protected]>
x86/alternatives: Teach text_poke_bp() to patch Jcc.d32 instructions
Peter Zijlstra <[email protected]>
x86/alternatives: Introduce int3_emulate_jcc()
Dave Hansen <[email protected]>
uaccess: Add speculation barrier to copy_from_user()
Yu Xiao <[email protected]>
nfp: ethtool: fix the bug of setting unsupported port speed
Yu Xiao <[email protected]>
nfp: ethtool: support reporting link modes
Michael Ellerman <[email protected]>
powerpc/64s/radix: Fix RWX mapping with relocated kernel
Paolo Bonzini <[email protected]>
selftests: kvm: move declaration at the beginning of main()
Paolo Bonzini <[email protected]>
KVM: x86: fix deadlock for KVM_XEN_EVTCHN_RESET
Lucas De Marchi <[email protected]>
drm/i915: Remove __maybe_unused from mtl_info
Ricardo Ribalda <[email protected]>
spi: mediatek: Enable irq before the spi registration
Sean Anderson <[email protected]>
powerpc: dts: t208x: Disable 10G on MAC1 and MAC2
Marc Kleine-Budde <[email protected]>
can: kvaser_usb: hydra: help gcc-13 to figure out cmd_len
Jim Mattson <[email protected]>
KVM: VMX: Execute IBPB on emulated VM-exit when guest has IBRS
Sean Christopherson <[email protected]>
KVM: SVM: Skip WRMSR fastpath on VM-Exit if next RIP isn't valid
Sean Christopherson <[email protected]>
KVM: x86: Fail emulation during EMULTYPE_SKIP on any exception
Yicong Yang <[email protected]>
docs: perf: Fix PMU instance name of hisi-pcie-pmu
Ricardo Ribalda <[email protected]>
spi: mediatek: Enable irq when pdata is ready
Jie Zhan <[email protected]>
scsi: hisi_sas: Fix SATA devices missing issue during I_T nexus reset
Jie Zhan <[email protected]>
scsi: libsas: Add smp_ata_check_ready_type()
Jason A. Donenfeld <[email protected]>
random: always mix cycle counter in add_latent_entropy()
Suren Baghdasaryan <[email protected]>
sched/psi: Stop relying on timer_pending() for poll_work rescheduling
Rahul Tanwar <[email protected]>
clk: mxl: syscon_node_to_regmap() returns error pointers
Sean Anderson <[email protected]>
powerpc: dts: t208x: Mark MAC1 and MAC2 as 10G
Rahul Tanwar <[email protected]>
clk: mxl: Fix a clk entry by adding relevant flags
Rahul Tanwar <[email protected]>
clk: mxl: Add option to override gate clks
Rahul Tanwar <[email protected]>
clk: mxl: Remove redundant spinlocks
Rahul Tanwar <[email protected]>
clk: mxl: Switch from direct readl/writel based IO to regmap based IO
Ankit Nautiyal <[email protected]>
drm/edid: Fix minimum bpc supported with DSC1.2 for HDMI sink
Bitterblue Smith <[email protected]>
wifi: rtl8xxxu: gen2: Turn on the rate control
Wen Gong <[email protected]>
wifi: ath11k: fix warning in dma_free_coherent() of memory chunks while recovery
Lucas Stach <[email protected]>
drm/etnaviv: don't truncate physical page address
-------------
Diffstat:
Documentation/admin-guide/perf/hisi-pcie-pmu.rst | 22 +-- MAINTAINERS | 2 +- Makefile | 4 +- arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-2.dtsi | 44 +++++ arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-3.dtsi | 44 +++++ arch/powerpc/boot/dts/fsl/t2081si-post.dtsi | 20 ++- arch/powerpc/kernel/vmlinux.lds.S | 6 +- arch/powerpc/mm/book3s64/radix_pgtable.c | 13 ++ arch/s390/kernel/vmlinux.lds.S | 2 + arch/sh/kernel/vmlinux.lds.S | 1 + arch/x86/include/asm/text-patching.h | 31 ++++ arch/x86/kernel/alternative.c | 59 +++++-- arch/x86/kernel/kprobes/core.c | 38 +--- arch/x86/kernel/static_call.c | 49 +++++- arch/x86/kvm/svm/svm.c | 10 +- arch/x86/kvm/vmx/nested.c | 11 ++ arch/x86/kvm/vmx/vmx.c | 6 +- arch/x86/kvm/x86.c | 4 +- arch/x86/kvm/xen.c | 30 +++- drivers/bluetooth/btusb.c | 84 +++++++++ drivers/clk/x86/Kconfig | 5 +- drivers/clk/x86/clk-cgu-pll.c | 23 +-- drivers/clk/x86/clk-cgu.c | 106 ++++------- drivers/clk/x86/clk-cgu.h | 46 ++--- drivers/clk/x86/clk-lgm.c | 18 +- drivers/gpu/drm/drm_edid.c | 3 +- drivers/gpu/drm/etnaviv/etnaviv_mmu.c | 4 +- drivers/gpu/drm/i915/i915_pci.c | 1 - drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 33 +++- drivers/net/ethernet/netronome/nfp/nfp_main.h | 1 + .../net/ethernet/netronome/nfp/nfp_net_ethtool.c | 195 +++++++++++++++++++++ drivers/net/ethernet/netronome/nfp/nfp_port.h | 12 ++ .../net/ethernet/netronome/nfp/nfpcore/nfp_nsp.c | 17 ++ .../net/ethernet/netronome/nfp/nfpcore/nfp_nsp.h | 56 ++++++ .../ethernet/netronome/nfp/nfpcore/nfp_nsp_eth.c | 26 +++ drivers/net/wireless/ath/ath11k/qmi.c | 6 +- drivers/net/wireless/marvell/mwifiex/sdio.c | 1 + .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 8 +- drivers/platform/x86/amd/pmf/Kconfig | 1 + drivers/platform/x86/nvidia-wmi-ec-backlight.c | 6 +- drivers/scsi/hisi_sas/hisi_sas_main.c | 8 +- drivers/scsi/libsas/sas_ata.c | 25 +++ drivers/scsi/libsas/sas_expander.c | 4 +- drivers/scsi/libsas/sas_internal.h | 2 + drivers/spi/spi-mt65xx.c | 10 +- fs/ext4/sysfs.c | 7 +- include/asm-generic/vmlinux.lds.h | 5 + include/linux/nospec.h | 4 + include/linux/psi_types.h | 1 + include/linux/random.h | 6 +- include/scsi/sas_ata.h | 6 + kernel/bpf/core.c | 2 - kernel/sched/psi.c | 62 +++++-- lib/usercopy.c | 7 + scripts/head-object-list.txt | 2 - security/Kconfig.hardening | 3 + .../testing/selftests/kvm/x86_64/xen_shinfo_test.c | 5 + 57 files changed, 962 insertions(+), 245 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 4/46 drm/edid: Fix minimum bpc supported with DSC1.2 for HDMI sink
From: Ankit Nautiyal <[email protected]>
[ Upstream commit 18feaf6d0784dcba888859109676adf1e0260dfd ]
HF-VSDB/SCDB has bits to advertise support for 16, 12 and 10 bpc. If none of the bits are set, the minimum bpc supported with DSC is 8.
This patch corrects the min bpc supported to be 8, instead of 0.
v2: s/DSC1.2/DSC 1.2
--- drivers/gpu/drm/drm_edid.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/drm_edid.c +2 -1
@@ -5827,7 +5827,8 @@ static void drm_parse_hdmi_forum_scds(struct drm_connector *connector,else if (hf_scds[11 ] &DRM_EDID_DSC_10BPC ) hdmi_dsc->bpc_supported =10 ;else - hdmi_dsc->bpc_supported =0 ; +/* Supports min 8 BPC if DSC 1.2 is supported*/ + hdmi_dsc->bpc_supported =8 ; dsc_max_frl_rate = (hf_scds[12 ] &DRM_EDID_DSC_MAX_FRL_RATE_MASK ) >>4 ; drm_get_max_frl_rate(dsc_max_frl_rate, &hdmi_dsc->max_lanes,
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 13/46 scsi: libsas: Add smp_ata_check_ready_type()
In reply to Greg Kroah-HartmanFrom: Jie Zhan <[email protected]>
[ Upstream commit 9181ce3cb5d96f0ee28246a857ca651830fa3746 ]
Create function smp_ata_check_ready_type() for LLDDs to wait for SATA devices to come up after a link reset.
Stable-dep-of: 3c2673a09cf1 ("scsi: hisi_sas: Fix SATA devices missing issue during I_T nexus reset")
--- drivers/scsi/libsas/sas_ata.c | 25 +++++++++++++++++++++++++ drivers/scsi/libsas/sas_expander.c | 4 ++-- drivers/scsi/libsas/sas_internal.h | 2 ++ include/scsi/sas_ata.h | 6 ++++++ 4 files changed, 35 insertions(+), 2 deletions(-)
drivers/scsi/libsas/sas_ata.c +25 -0
@@ -287,6 +287,31 @@ static int sas_ata_clear_pending(struct domain_device *dev, struct ex_phy *phy)return 1 ; } +int smp_ata_check_ready_type (struct ata_link *link) +{ +struct domain_device *dev = link->ap->private_data; +struct sas_phy *phy =sas_get_local_phy (dev); +struct domain_device *ex_dev = dev->parent; +enum sas_device_type type =SAS_PHY_UNUSED ; +u8 sas_addr[SAS_ADDR_SIZE ]; +int res; + + res =sas_get_phy_attached_dev (ex_dev, phy->number, sas_addr, &type); +sas_put_local_phy (phy); +if (res) +return res; + +switch (type) { +case SAS_SATA_PENDING : +return 0 ; +case SAS_END_DEVICE : +return 1 ; +default : +return -ENODEV ; + } +} +EXPORT_SYMBOL_GPL (smp_ata_check_ready_type); +static int smp_ata_check_ready (struct ata_link *link) {int res;
drivers/scsi/libsas/sas_expander.c +2 -2
@@ -1693,8 +1693,8 @@ static int sas_get_phy_change_count(struct domain_device *dev,return res; } -static int sas_get_phy_attached_dev (struct domain_device *dev,int phy_id, -u8 *sas_addr,enum sas_device_type *type) +int sas_get_phy_attached_dev (struct domain_device *dev,int phy_id, +u8 *sas_addr,enum sas_device_type *type) {int res;struct smp_disc_resp *disc_resp;
drivers/scsi/libsas/sas_internal.h +2 -0
@@ -84,6 +84,8 @@ struct domain_device *sas_ex_to_ata(struct domain_device *ex_dev, int phy_id);int sas_ex_phy_discover (struct domain_device *dev,int single);int sas_get_report_phy_sata (struct domain_device *dev,int phy_id,struct smp_rps_resp *rps_resp); +int sas_get_phy_attached_dev (struct domain_device *dev,int phy_id, +u8 *sas_addr,enum sas_device_type *type);int sas_try_ata_reset (struct asd_sas_phy *phy);void sas_hae_reset (struct work_struct *work);
include/scsi/sas_ata.h +6 -0
@@ -35,6 +35,7 @@ void sas_ata_end_eh(struct ata_port *ap);int sas_execute_ata_cmd (struct domain_device *device,u8 *fis,int force_phy_id);int sas_ata_wait_after_reset (struct domain_device *dev,unsigned long deadline); +int smp_ata_check_ready_type (struct ata_link *link);#else
@@ -98,6 +99,11 @@ static inline int sas_ata_wait_after_reset(struct domain_device *dev, {return -ETIMEDOUT ; } + +static inline int smp_ata_check_ready_type (struct ata_link *link) +{ +return 0 ; +}#endif #endif /* _SAS_ATA_H_ */
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 14/46 scsi: hisi_sas: Fix SATA devices missing issue during I_T nexus reset
In reply to Greg Kroah-HartmanFrom: Jie Zhan <[email protected]>
[ Upstream commit 3c2673a09cf1181318c07b7dbc1bc532ba3d33e3 ]
SATA devices on an expander may be removed and not be found again when I_T nexus reset and revalidation are processed simultaneously.
The issue comes from:
- Revalidation can remove SATA devices in link reset, e.g. in hisi_sas_clear_nexus_ha().
- However, hisi_sas_debug_I_T_nexus_reset() polls the state of a SATA device on an expander after sending link_reset, where it calls:
hisi_sas_debug_I_T_nexus_reset
sas_ata_wait_after_reset
ata_wait_after_reset
ata_wait_ready
smp_ata_check_ready
sas_ex_phy_discover
sas_ex_phy_discover_helper
sas_set_ex_phy
The ex_phy's change count is updated in sas_set_ex_phy(), so SATA devices after a link reset may not be found later through revalidation.
A similar issue was reported in:
commit 0f3fce5cc77e ("[SCSI] libsas: fix ata_eh clobbering ex_phys via smp_ata_check_ready")
commit 87c8331fcf72 ("[SCSI] libsas: prevent domain rediscovery competing with ata error handling").
To address this issue, in hisi_sas_debug_I_T_nexus_reset(), we now call smp_ata_check_ready_type() that only polls the device type while not updating the ex_phy's data of libsas.
--- drivers/scsi/hisi_sas/hisi_sas_main.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/scsi/hisi_sas/hisi_sas_main.c +5 -3
@@ -1708,13 +1708,15 @@ static int hisi_sas_debug_I_T_nexus_reset(struct domain_device *device)return rc; } +/* Remote phy */ if (rc)return rc; -/* Remote phy */ if (dev_is_sata (device)) { - rc =sas_ata_wait_after_reset (device, -HISI_SAS_WAIT_PHYUP_TIMEOUT ); +struct ata_link *link = &device->sata_dev.ap->link; + + rc =ata_wait_after_reset (link,HISI_SAS_WAIT_PHYUP_TIMEOUT , + smp_ata_check_ready_type); }else {msleep (2000 ); }
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 15/46 spi: mediatek: Enable irq when pdata is ready
In reply to Greg Kroah-HartmanFrom: Ricardo Ribalda <[email protected]>
[ Upstream commit c6f7874687f7027d7c4b2f53ff6e4d22850f915d ]
If the device does not come straight from reset, we might receive an IRQ before we are ready to handle it.
Fixes:
[ 0.832328] Unable to handle kernel read from unreadable memory at virtual address 0000000000000010 [ 1.040343] Call trace: [ 1.040347] mtk_spi_can_dma+0xc/0x40 ... [ 1.262265] start_kernel+0x338/0x42c
--- drivers/spi/spi-mt65xx.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/spi/spi-mt65xx.c +7 -5
@@ -1192,11 +1192,6 @@ static int mtk_spi_probe(struct platform_device *pdev)else dma_set_max_seg_size (dev,SZ_256K ); - ret =devm_request_irq (dev, irq, mtk_spi_interrupt, -IRQF_TRIGGER_NONE ,dev_name (dev), master); -if (ret) -return dev_err_probe (dev, ret,"failed to register irq\n" ); - mdata->parent_clk =devm_clk_get (dev,"parent-clk" );if (IS_ERR (mdata->parent_clk)) return dev_err_probe(dev, PTR_ERR(mdata->parent_clk),
@@ -1266,6 +1261,13 @@ static int mtk_spi_probe(struct platform_device *pdev)return dev_err_probe (dev, ret,"failed to register master\n" ); } + ret =devm_request_irq (dev, irq, mtk_spi_interrupt, +IRQF_TRIGGER_NONE ,dev_name (dev), master); +if (ret) { +pm_runtime_disable (dev); +return dev_err_probe (dev, ret,"failed to register irq\n" ); + } +return 0 ; }
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 16/46 docs: perf: Fix PMU instance name of hisi-pcie-pmu
In reply to Greg Kroah-HartmanFrom: Yicong Yang <[email protected]>
[ Upstream commit eb79f12b4c41dd2403a0d16772ee72fcd6416015 ]
The PMU instance will be called hisi_pcie<sicl>_core<core> rather than hisi_pcie<sicl>_<core>. Fix this in the documentation.
--- .../admin-guide/perf/hisi-pcie-pmu.rst | 22 +++++++++---------- 1 file changed, 11 insertions(+), 11 deletions(-)
Documentation/admin-guide/perf/hisi-pcie-pmu.rst +11 -11
@@ -15,10 +15,10 @@ HiSilicon PCIe PMU driver The PCIe PMU driver registers a perf PMU with the name of its sicl-id and PCIe Core id.:: - /sys/bus/event_source/hisi_pcie<sicl>_<core> + /sys/bus/event_source/hisi_pcie<sicl>_core<core> PMU driver provides description of available events and filter options in sysfs, -see /sys/bus/event_source/devices/hisi_pcie<sicl>_<core>. +see /sys/bus/event_source/devices/hisi_pcie<sicl>_core<core>. The "format" directory describes all formats of the config (events) and config1 (filter options) fields of the perf_event_attr structure. The "events" directory
@@ -33,13 +33,13 @@ monitored by PMU. Example usage of perf:: $# perf list - hisi_pcie0_0/rx_mwr_latency/ [kernel PMU event] - hisi_pcie0_0/rx_mwr_cnt/ [kernel PMU event] + hisi_pcie0_core0/rx_mwr_latency/ [kernel PMU event] + hisi_pcie0_core0/rx_mwr_cnt/ [kernel PMU event] ------------------------------------------ - $# perf stat -e hisi_pcie0_0/rx_mwr_latency/ - $# perf stat -e hisi_pcie0_0/rx_mwr_cnt/ - $# perf stat -g -e hisi_pcie0_0/rx_mwr_latency/ -e hisi_pcie0_0/rx_mwr_cnt/ + $# perf stat -e hisi_pcie0_core0/rx_mwr_latency/ + $# perf stat -e hisi_pcie0_core0/rx_mwr_cnt/ + $# perf stat -g -e hisi_pcie0_core0/rx_mwr_latency/ -e hisi_pcie0_core0/rx_mwr_cnt/ The current driver does not support sampling. So "perf record" is unsupported. Also attach to a task is unsupported for PCIe PMU.
@@ -64,7 +64,7 @@ bit8 is set, port=0x100; if these two Root Ports are both monitored, port=0x101. Example usage of perf:: - $# perf stat -e hisi_pcie0_0/rx_mwr_latency,port=0x1/ sleep 5 + $# perf stat -e hisi_pcie0_core0/rx_mwr_latency,port=0x1/ sleep 5 -bdf
@@ -76,7 +76,7 @@ For example, "bdf=0x3900" means BDF of target Endpoint is 0000:39:00.0. Example usage of perf:: - $# perf stat -e hisi_pcie0_0/rx_mrd_flux,bdf=0x3900/ sleep 5 + $# perf stat -e hisi_pcie0_core0/rx_mrd_flux,bdf=0x3900/ sleep 5 2. Trigger filter Event statistics start when the first time TLP length is greater/smaller
@@ -90,7 +90,7 @@ means start when TLP length < condition. Example usage of perf:: - $# perf stat -e hisi_pcie0_0/rx_mrd_flux,trig_len=0x4,trig_mode=1/ sleep 5 + $# perf stat -e hisi_pcie0_core0/rx_mrd_flux,trig_len=0x4,trig_mode=1/ sleep 5 3. Threshold filter Counter counts when TLP length within the specified range. You can set the
@@ -103,4 +103,4 @@ when TLP length < threshold. Example usage of perf:: - $# perf stat -e hisi_pcie0_0/rx_mrd_flux,thr_len=0x4,thr_mode=1/ sleep 5 + $# perf stat -e hisi_pcie0_core0/rx_mrd_flux,thr_len=0x4,thr_mode=1/ sleep 5
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 17/46 KVM: x86: Fail emulation during EMULTYPE_SKIP on any exception
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
[ Upstream commit 17122c06b86c9f77f45b86b8e62c3ed440847a59 ]
Treat any exception during instruction decode for EMULTYPE_SKIP as a "full" emulation failure, i.e. signal failure instead of queuing the exception. When decoding purely to skip an instruction, KVM and/or the CPU has already done some amount of emulation that cannot be unwound, e.g. on an EPT misconfig VM-Exit KVM has already processeed the emulated MMIO. KVM already does this if a #UD is encountered, but not for other exceptions, e.g. if a #PF is encountered during fetch.
In SVM's soft-injection use case, queueing the exception is particularly problematic as queueing exceptions while injecting events can put KVM into an infinite loop due to bailing from VM-Enter to service the newly pending exception. E.g. multiple warnings to detect such behavior fire:
------------[ cut here ]------------ WARNING: CPU: 3 PID: 1017 at arch/x86/kvm/x86.c:9873 kvm_arch_vcpu_ioctl_run+0x1de5/0x20a0 [kvm] Modules linked in: kvm_amd ccp kvm irqbypass CPU: 3 PID: 1017 Comm: svm_nested_soft Not tainted 6.0.0-rc1+ #220 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:kvm_arch_vcpu_ioctl_run+0x1de5/0x20a0 [kvm] Call Trace: kvm_vcpu_ioctl+0x223/0x6d0 [kvm] __x64_sys_ioctl+0x85/0xc0 do_syscall_64+0x2b/0x50 entry_SYSCALL_64_after_hwframe+0x46/0xb0 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ WARNING: CPU: 3 PID: 1017 at arch/x86/kvm/x86.c:9987 kvm_arch_vcpu_ioctl_run+0x12a3/0x20a0 [kvm] Modules linked in: kvm_amd ccp kvm irqbypass CPU: 3 PID: 1017 Comm: svm_nested_soft Tainted: G W 6.0.0-rc1+ #220 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:kvm_arch_vcpu_ioctl_run+0x12a3/0x20a0 [kvm] Call Trace: kvm_vcpu_ioctl+0x223/0x6d0 [kvm] __x64_sys_ioctl+0x85/0xc0 do_syscall_64+0x2b/0x50 entry_SYSCALL_64_after_hwframe+0x46/0xb0 ---[ end trace 0000000000000000 ]---
--- arch/x86/kvm/x86.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/x86/kvm/x86.c +3 -1
@@ -8860,7 +8860,9 @@ int x86_emulate_instruction(struct kvm_vcpu *vcpu, gpa_t cr2_or_gpa, write_fault_to_spt, emulation_type))return 1 ; -if (ctxt->have_exception) { + +if (ctxt->have_exception && + !(emulation_type &EMULTYPE_SKIP )) {/* * #UD should result in just EMULATION_FAILED, and trap-like * exception should not be encountered during decode.
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 18/46 KVM: SVM: Skip WRMSR fastpath on VM-Exit if next RIP isnt valid
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
[ Upstream commit 5c30e8101e8d5d020b1d7119117889756a6ed713 ]
Skip the WRMSR fastpath in SVM's VM-Exit handler if the next RIP isn't valid, e.g. because KVM is running with nrips=false. SVM must decode and emulate to skip the WRMSR if the CPU doesn't provide the next RIP. Getting the instruction bytes to decode the WRMSR requires reading guest memory, which in turn means dereferencing memslots, and that isn't safe because KVM doesn't hold SRCU when the fastpath runs.
Don't bother trying to enable the fastpath for this case, e.g. by doing only the WRMSR and leaving the "skip" until later. NRIPS is supported on all modern CPUs (KVM has considered making it mandatory), and the next RIP will be valid the vast, vast majority of the time.
=============================
WARNING: suspicious RCU usage
6.0.0-smp--4e557fcd3d80-skip #13 Tainted: G O
-----------------------------
include/linux/kvm_host.h:954 suspicious rcu_dereference_check() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
1 lock held by stable/206475:
#0: ffff9d9dfebcc0f0 (&vcpu->mutex){+.+.}-{3:3}, at: kvm_vcpu_ioctl+0x8b/0x620 [kvm]
stack backtrace: CPU: 152 PID: 206475 Comm: stable Tainted: G O 6.0.0-smp--4e557fcd3d80-skip #13 Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 10.48.0 01/27/2022 Call Trace: <TASK> dump_stack_lvl+0x69/0xaa dump_stack+0x10/0x12 lockdep_rcu_suspicious+0x11e/0x130 kvm_vcpu_gfn_to_memslot+0x155/0x190 [kvm] kvm_vcpu_gfn_to_hva_prot+0x18/0x80 [kvm] paging64_walk_addr_generic+0x183/0x450 [kvm] paging64_gva_to_gpa+0x63/0xd0 [kvm] kvm_fetch_guest_virt+0x53/0xc0 [kvm] __do_insn_fetch_bytes+0x18b/0x1c0 [kvm] x86_decode_insn+0xf0/0xef0 [kvm] x86_emulate_instruction+0xba/0x790 [kvm] kvm_emulate_instruction+0x17/0x20 [kvm] __svm_skip_emulated_instruction+0x85/0x100 [kvm_amd] svm_skip_emulated_instruction+0x13/0x20 [kvm_amd] handle_fastpath_set_msr_irqoff+0xae/0x180 [kvm] svm_vcpu_run+0x4b8/0x5a0 [kvm_amd] vcpu_enter_guest+0x16ca/0x22f0 [kvm] kvm_arch_vcpu_ioctl_run+0x39d/0x900 [kvm] kvm_vcpu_ioctl+0x538/0x620 [kvm] __se_sys_ioctl+0x77/0xc0 __x64_sys_ioctl+0x1d/0x20 do_syscall_64+0x3d/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
--- arch/x86/kvm/svm/svm.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
arch/x86/kvm/svm/svm.c +8 -2
@@ -3889,8 +3889,14 @@ static int svm_vcpu_pre_run(struct kvm_vcpu *vcpu)static fastpath_t svm_exit_handlers_fastpath (struct kvm_vcpu *vcpu) { -if (to_svm (vcpu)->vmcb->control.exit_code ==SVM_EXIT_MSR && -to_svm (vcpu)->vmcb->control.exit_info_1) +struct vmcb_control_area *control = &to_svm (vcpu)->vmcb->control; + +/* +* Note, the next RIP must be provided as SRCU isn't held, i.e. KVM +* can't read guest memory (dereference memslots) to decode the WRMSR. +*/ +if (control->exit_code ==SVM_EXIT_MSR && control->exit_info_1 && + nrips && control->next_rip)return handle_fastpath_set_msr_irqoff (vcpu);return EXIT_FASTPATH_NONE ;
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 19/46 KVM: VMX: Execute IBPB on emulated VM-exit when guest has IBRS
In reply to Greg Kroah-HartmanFrom: Jim Mattson <[email protected]>
[ Upstream commit 2e7eab81425ad6c875f2ed47c0ce01e78afc38a5 ]
According to Intel's document on Indirect Branch Restricted Speculation, "Enabling IBRS does not prevent software from controlling the predicted targets of indirect branches of unrelated software executed later at the same predictor mode (for example, between two different user applications, or two different virtual machines). Such isolation can be ensured through use of the Indirect Branch Predictor Barrier (IBPB) command." This applies to both basic and enhanced IBRS.
Since L1 and L2 VMs share hardware predictor modes (guest-user and guest-kernel), hardware IBRS is not sufficient to virtualize IBRS. (The way that basic IBRS is implemented on pre-eIBRS parts, hardware IBRS is actually sufficient in practice, even though it isn't sufficient architecturally.)
For virtual CPUs that support IBRS, add an indirect branch prediction barrier on emulated VM-exit, to ensure that the predicted targets of indirect branches executed in L1 cannot be controlled by software that was executed in L2.
Since we typically don't intercept guest writes to IA32_SPEC_CTRL, perform the IBPB at emulated VM-exit regardless of the current IA32_SPEC_CTRL.IBRS value, even though the IBPB could technically be deferred until L1 sets IA32_SPEC_CTRL.IBRS, if IA32_SPEC_CTRL.IBRS is clear at emulated VM-exit.
This is CVE-2022-2196.
--- arch/x86/kvm/vmx/nested.c | 11 +++++++++++ arch/x86/kvm/vmx/vmx.c | 6 ++++-- 2 files changed, 15 insertions(+), 2 deletions(-)
arch/x86/kvm/vmx/nested.c +11 -0
@@ -4767,6 +4767,17 @@ void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 vm_exit_reason,vmx_switch_vmcs (vcpu, &vmx->vmcs01); +/* +* If IBRS is advertised to the vCPU, KVM must flush the indirect +* branch predictors when transitioning from L2 to L1, as L1 expects +* hardware (KVM in this case) to provide separate predictor modes. +* Bare metal isolates VMX root (host) from VMX non-root (guest), but +* doesn't isolate different VMCSs, i.e. in this case, doesn't provide +* separate modes for L2 vs L1. +*/ +if (guest_cpuid_has (vcpu,X86_FEATURE_SPEC_CTRL )) +indirect_branch_prediction_barrier (); +/* Update any VMCS fields that might have changed while L2 ran */ vmcs_write32 (VM_EXIT_MSR_LOAD_COUNT , vmx->msr_autoload.host.nr);vmcs_write32 (VM_ENTRY_MSR_LOAD_COUNT , vmx->msr_autoload.guest.nr);
arch/x86/kvm/vmx/vmx.c +4 -2
@@ -1348,8 +1348,10 @@ void vmx_vcpu_load_vmcs(struct kvm_vcpu *vcpu, int cpu,/* * No indirect branch prediction barrier needed when switching -* the active VMCS within a guest, e.g. on nested VM-Enter. -* The L1 VMM can protect itself with retpolines, IBPB or IBRS. +* the active VMCS within a vCPU, unless IBRS is advertised to +* the vCPU. To minimize the number of IBPBs executed, KVM +* performs IBPB on nested VM-Exit (a single nested transition +* may switch the active VMCS multiple times). */ if (!buddy ||WARN_ON_ONCE (buddy->vmcs != prev))indirect_branch_prediction_barrier ();
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 20/46 can: kvaser_usb: hydra: help gcc-13 to figure out cmd_len
In reply to Greg Kroah-HartmanFrom: Marc Kleine-Budde <[email protected]>
[ Upstream commit f006229135b7debf4037adb1eb93e358559593db ]
Debian's gcc-13 [1] throws the following error inkvaser_usb_hydra_cmd_size():
[1] gcc version 13.0.0 20221214 (experimental) [master r13-4693-g512098a3316] (Debian 13-20221214-1)
| drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c:502:65: error: | array subscript ‘struct kvaser_cmd_ext[0]’ is partly outside array | bounds of ‘unsigned char[32]’ [-Werror=array-bounds=] | 502 | ret = le16_to_cpu(((struct kvaser_cmd_ext *)cmd)->len);
kvaser_usb_hydra_cmd_size() returns the size of given command. It depends on the command number (cmd->header.cmd_no). For extended commands (cmd->header.cmd_no == CMD_EXTENDED) the above shown code is executed.
Help gcc to recognize that this code path is not taken in all cases, by calling kvaser_usb_hydra_cmd_size() directly after assigning the command number.
--- .../net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 33 ++++++++++++++----- 1 file changed, 24 insertions(+), 9 deletions(-)
drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c +24 -9
@@ -545,6 +545,7 @@ static int kvaser_usb_hydra_send_simple_cmd(struct kvaser_usb *dev, u8 cmd_no, int channel) {struct kvaser_cmd *cmd; +size_t cmd_len;int err; cmd =kzalloc (sizeof (*cmd),GFP_KERNEL );
@@ -552,6 +553,7 @@ static int kvaser_usb_hydra_send_simple_cmd(struct kvaser_usb *dev,return -ENOMEM ; cmd->header.cmd_no = cmd_no; + cmd_len =kvaser_usb_hydra_cmd_size (cmd);if (channel <0 ) {kvaser_usb_hydra_set_cmd_dest_he (cmd,KVASER_USB_HYDRA_HE_ADDRESS_ILLEGAL );
@@ -568,7 +570,7 @@ static int kvaser_usb_hydra_send_simple_cmd(struct kvaser_usb *dev,kvaser_usb_hydra_set_cmd_transid (cmd,kvaser_usb_hydra_get_next_transid (dev)); - err =kvaser_usb_send_cmd (dev, cmd,kvaser_usb_hydra_cmd_size (cmd)); + err =kvaser_usb_send_cmd (dev, cmd, cmd_len);if (err) goto end;
@@ -584,6 +586,7 @@ kvaser_usb_hydra_send_simple_cmd_async(struct kvaser_usb_net_priv *priv, {struct kvaser_cmd *cmd;struct kvaser_usb *dev = priv->dev; +size_t cmd_len;int err; cmd =kzalloc (sizeof (*cmd),GFP_ATOMIC );
@@ -591,14 +594,14 @@ kvaser_usb_hydra_send_simple_cmd_async(struct kvaser_usb_net_priv *priv,return -ENOMEM ; cmd->header.cmd_no = cmd_no; + cmd_len =kvaser_usb_hydra_cmd_size (cmd);kvaser_usb_hydra_set_cmd_dest_he (cmd, dev->card_data.hydra.channel_to_he[priv->channel]);kvaser_usb_hydra_set_cmd_transid (cmd,kvaser_usb_hydra_get_next_transid (dev)); - err =kvaser_usb_send_cmd_async (priv, cmd, -kvaser_usb_hydra_cmd_size (cmd)); + err =kvaser_usb_send_cmd_async (priv, cmd, cmd_len);if (err)kfree (cmd);
@@ -742,6 +745,7 @@ static int kvaser_usb_hydra_get_single_capability(struct kvaser_usb *dev, {struct kvaser_usb_dev_card_data *card_data = &dev->card_data;struct kvaser_cmd *cmd; +size_t cmd_len;u32 value =0 ;u32 mask =0 ;u16 cap_cmd_res;
@@ -753,13 +757,14 @@ static int kvaser_usb_hydra_get_single_capability(struct kvaser_usb *dev,return -ENOMEM ; cmd->header.cmd_no =CMD_GET_CAPABILITIES_REQ ; + cmd_len =kvaser_usb_hydra_cmd_size (cmd); cmd->cap_req.cap_cmd =cpu_to_le16 (cap_cmd_req);kvaser_usb_hydra_set_cmd_dest_he (cmd, card_data->hydra.sysdbg_he);kvaser_usb_hydra_set_cmd_transid (cmd,kvaser_usb_hydra_get_next_transid (dev)); - err =kvaser_usb_send_cmd (dev, cmd,kvaser_usb_hydra_cmd_size (cmd)); + err =kvaser_usb_send_cmd (dev, cmd, cmd_len);if (err) goto end;
@@ -1578,6 +1583,7 @@ static int kvaser_usb_hydra_get_busparams(struct kvaser_usb_net_priv *priv,struct kvaser_usb *dev = priv->dev;struct kvaser_usb_net_hydra_priv *hydra = priv->sub_priv;struct kvaser_cmd *cmd; +size_t cmd_len;int err;if (!hydra)
@@ -1588,6 +1594,7 @@ static int kvaser_usb_hydra_get_busparams(struct kvaser_usb_net_priv *priv,return -ENOMEM ; cmd->header.cmd_no =CMD_GET_BUSPARAMS_REQ ; + cmd_len =kvaser_usb_hydra_cmd_size (cmd);kvaser_usb_hydra_set_cmd_dest_he (cmd, dev->card_data.hydra.channel_to_he[priv->channel]); kvaser_usb_hydra_set_cmd_transid
@@ -1597,7 +1604,7 @@ static int kvaser_usb_hydra_get_busparams(struct kvaser_usb_net_priv *priv,reinit_completion (&priv->get_busparams_comp); - err =kvaser_usb_send_cmd (dev, cmd,kvaser_usb_hydra_cmd_size (cmd)); + err =kvaser_usb_send_cmd (dev, cmd, cmd_len);if (err)return err;
@@ -1624,6 +1631,7 @@ static int kvaser_usb_hydra_set_bittiming(const struct net_device *netdev,struct kvaser_cmd *cmd;struct kvaser_usb_net_priv *priv =netdev_priv (netdev);struct kvaser_usb *dev = priv->dev; +size_t cmd_len;int err; cmd =kzalloc (sizeof (*cmd),GFP_KERNEL );
@@ -1631,6 +1639,7 @@ static int kvaser_usb_hydra_set_bittiming(const struct net_device *netdev,return -ENOMEM ; cmd->header.cmd_no =CMD_SET_BUSPARAMS_REQ ; + cmd_len =kvaser_usb_hydra_cmd_size (cmd);memcpy (&cmd->set_busparams_req.busparams_nominal, busparams,sizeof (cmd->set_busparams_req.busparams_nominal));
@@ -1639,7 +1648,7 @@ static int kvaser_usb_hydra_set_bittiming(const struct net_device *netdev,kvaser_usb_hydra_set_cmd_transid (cmd,kvaser_usb_hydra_get_next_transid (dev)); - err =kvaser_usb_send_cmd (dev, cmd,kvaser_usb_hydra_cmd_size (cmd)); + err =kvaser_usb_send_cmd (dev, cmd, cmd_len);kfree (cmd);
@@ -1652,6 +1661,7 @@ static int kvaser_usb_hydra_set_data_bittiming(const struct net_device *netdev,struct kvaser_cmd *cmd;struct kvaser_usb_net_priv *priv =netdev_priv (netdev);struct kvaser_usb *dev = priv->dev; +size_t cmd_len;int err; cmd =kzalloc (sizeof (*cmd),GFP_KERNEL );
@@ -1659,6 +1669,7 @@ static int kvaser_usb_hydra_set_data_bittiming(const struct net_device *netdev,return -ENOMEM ; cmd->header.cmd_no =CMD_SET_BUSPARAMS_FD_REQ ; + cmd_len =kvaser_usb_hydra_cmd_size (cmd);memcpy (&cmd->set_busparams_req.busparams_data, busparams,sizeof (cmd->set_busparams_req.busparams_data));
@@ -1676,7 +1687,7 @@ static int kvaser_usb_hydra_set_data_bittiming(const struct net_device *netdev,kvaser_usb_hydra_set_cmd_transid (cmd,kvaser_usb_hydra_get_next_transid (dev)); - err =kvaser_usb_send_cmd (dev, cmd,kvaser_usb_hydra_cmd_size (cmd)); + err =kvaser_usb_send_cmd (dev, cmd, cmd_len);kfree (cmd);
@@ -1804,6 +1815,7 @@ static int kvaser_usb_hydra_get_software_info(struct kvaser_usb *dev)static int kvaser_usb_hydra_get_software_details (struct kvaser_usb *dev) {struct kvaser_cmd *cmd; +size_t cmd_len;int err;u32 flags;struct kvaser_usb_dev_card_data *card_data = &dev->card_data;
@@ -1813,6 +1825,7 @@ static int kvaser_usb_hydra_get_software_details(struct kvaser_usb *dev)return -ENOMEM ; cmd->header.cmd_no =CMD_GET_SOFTWARE_DETAILS_REQ ; + cmd_len =kvaser_usb_hydra_cmd_size (cmd); cmd->sw_detail_req.use_ext_cmd =1 ;kvaser_usb_hydra_set_cmd_dest_he (cmd,KVASER_USB_HYDRA_HE_ADDRESS_ILLEGAL );
@@ -1820,7 +1833,7 @@ static int kvaser_usb_hydra_get_software_details(struct kvaser_usb *dev)kvaser_usb_hydra_set_cmd_transid (cmd,kvaser_usb_hydra_get_next_transid (dev)); - err =kvaser_usb_send_cmd (dev, cmd,kvaser_usb_hydra_cmd_size (cmd)); + err =kvaser_usb_send_cmd (dev, cmd, cmd_len);if (err) goto end;
@@ -1938,6 +1951,7 @@ static int kvaser_usb_hydra_set_opt_mode(const struct kvaser_usb_net_priv *priv) {struct kvaser_usb *dev = priv->dev;struct kvaser_cmd *cmd; +size_t cmd_len;int err; if ((priv->can.ctrlmode &
@@ -1953,6 +1967,7 @@ static int kvaser_usb_hydra_set_opt_mode(const struct kvaser_usb_net_priv *priv)return -ENOMEM ; cmd->header.cmd_no =CMD_SET_DRIVERMODE_REQ ; + cmd_len =kvaser_usb_hydra_cmd_size (cmd);kvaser_usb_hydra_set_cmd_dest_he (cmd, dev->card_data.hydra.channel_to_he[priv->channel]); kvaser_usb_hydra_set_cmd_transid
@@ -1962,7 +1977,7 @@ static int kvaser_usb_hydra_set_opt_mode(const struct kvaser_usb_net_priv *priv)else cmd->set_ctrlmode.mode =KVASER_USB_HYDRA_CTRLMODE_NORMAL ; - err =kvaser_usb_send_cmd (dev, cmd,kvaser_usb_hydra_cmd_size (cmd)); + err =kvaser_usb_send_cmd (dev, cmd, cmd_len);kfree (cmd);return err;
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 21/46 powerpc: dts: t208x: Disable 10G on MAC1 and MAC2
In reply to Greg Kroah-HartmanFrom: Sean Anderson <[email protected]>
[ Upstream commit 8d8bee13ae9e316443c6666286360126a19c8d94 ]
There aren't enough resources to run these ports at 10G speeds. Disable 10G for these ports, reverting to the previous speed.
--- arch/powerpc/boot/dts/fsl/t2081si-post.dtsi | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
arch/powerpc/boot/dts/fsl/t2081si-post.dtsi +16 -0
@@ -659,3 +659,19 @@ interrupts = <16 2 1 9>; }; }; + +&fman0_rx_0x08 { + /delete-property/ fsl,fman-10g-port; +}; + +&fman0_tx_0x28 { + /delete-property/ fsl,fman-10g-port; +}; + +&fman0_rx_0x09 { + /delete-property/ fsl,fman-10g-port; +}; + +&fman0_tx_0x29 { + /delete-property/ fsl,fman-10g-port; +};
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 22/46 spi: mediatek: Enable irq before the spi registration
In reply to Greg Kroah-HartmanFrom: Ricardo Ribalda <[email protected]>
[ Upstream commit b24cded8c065d7cef8690b2c7b82b828cce57708 ]
If the irq is enabled after the spi si registered, there can be a race with the initialization of the devices on the spi bus.
Eg:
mtk-spi 1100a000.spi: spi-mem transfer timeout
spi-nor: probe of spi0.0 failed with error -110
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010 ... Call trace: mtk_spi_can_dma+0x0/0x2c
--- drivers/spi/spi-mt65xx.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-)
drivers/spi/spi-mt65xx.c +5 -7
@@ -1253,6 +1253,11 @@ static int mtk_spi_probe(struct platform_device *pdev)dev_notice (dev,"SPI dma_set_mask(%d) failed, ret:%d\n" , addr_bits, ret); + ret =devm_request_irq (dev, irq, mtk_spi_interrupt, +IRQF_TRIGGER_NONE ,dev_name (dev), master); +if (ret) +return dev_err_probe (dev, ret,"failed to register irq\n" ); +pm_runtime_enable (dev); ret =devm_spi_register_master (dev, master);
@@ -1261,13 +1266,6 @@ static int mtk_spi_probe(struct platform_device *pdev)return dev_err_probe (dev, ret,"failed to register master\n" ); } - ret =devm_request_irq (dev, irq, mtk_spi_interrupt, -IRQF_TRIGGER_NONE ,dev_name (dev), master); -if (ret) { -pm_runtime_disable (dev); -return dev_err_probe (dev, ret,"failed to register irq\n" ); - } -return 0 ; }
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 5/46 clk: mxl: Switch from direct readl/writel based IO to regmap based IO
In reply to Greg Kroah-HartmanFrom: Rahul Tanwar <[email protected]>
[ Upstream commit 036177310bac5534de44ff6a7b60a4d2c0b6567c ]
Earlier version of driver used direct io remapped register read writes using readl/writel. But we need secure boot access which is only possible when registers are read & written using regmap. This is because the security bus/hook is written & coupled only with regmap layer.
Switch the driver from direct readl/writel based register accesses to regmap based register accesses.
Additionally, update the license headers to latest status.
Stable-dep-of: 106ef3bda210 ("clk: mxl: Fix a clk entry by adding relevant flags")
--- drivers/clk/x86/Kconfig | 5 +++-- drivers/clk/x86/clk-cgu-pll.c | 10 +++++---- drivers/clk/x86/clk-cgu.c | 5 +++-- drivers/clk/x86/clk-cgu.h | 38 +++++++++++++++++++---------------- drivers/clk/x86/clk-lgm.c | 13 ++++++++---- 5 files changed, 42 insertions(+), 29 deletions(-)
drivers/clk/x86/Kconfig +3 -2
@@ -1,8 +1,9 @@ # SPDX-License-Identifier: GPL-2.0-only config CLK_LGM_CGU depends on OF && HAS_IOMEM && (X86 || COMPILE_TEST) + select MFD_SYSCON select OF_EARLY_FLATTREE bool "Clock driver for Lightning Mountain(LGM) platform" help - Clock Generation Unit(CGU) driver for Intel Lightning Mountain(LGM) - network processor SoC. + Clock Generation Unit(CGU) driver for MaxLinear's x86 based + Lightning Mountain(LGM) network processor SoC.
drivers/clk/x86/clk-cgu-pll.c +6 -4
@@ -1,8 +1,9 @@// SPDX-License-Identifier: GPL-2.0 /* +* Copyright (C) 2020-2022 MaxLinear, Inc. * Copyright (C) 2020 Intel Corporation. -* Zhu YiXin <[email protected]> -* Rahul Tanwar <[email protected]> +* Zhu Yixin <[email protected]> +* Rahul Tanwar <[email protected]> */ #include <linux/clk-provider.h>
@@ -76,8 +77,9 @@ static int lgm_pll_enable(struct clk_hw *hw)spin_lock_irqsave (&pll->lock, flags);lgm_set_clk_val (pll->membase, pll->reg,0 ,1 ,1 ); - ret =readl_poll_timeout_atomic (pll->membase + pll->reg, - val, (val &0x1 ),1 ,100 ); + ret =regmap_read_poll_timeout_atomic (pll->membase, pll->reg, + val, (val &0x1 ),1 ,100 ); +spin_unlock_irqrestore (&pll->lock, flags);return ret;
drivers/clk/x86/clk-cgu.c +3 -2
@@ -1,8 +1,9 @@// SPDX-License-Identifier: GPL-2.0 /* +* Copyright (C) 2020-2022 MaxLinear, Inc. * Copyright (C) 2020 Intel Corporation. -* Zhu YiXin <[email protected]> -* Rahul Tanwar <[email protected]> +* Zhu Yixin <[email protected]> +* Rahul Tanwar <[email protected]> */ #include <linux/clk-provider.h> #include <linux/device.h>
drivers/clk/x86/clk-cgu.h +21 -17
@@ -1,18 +1,19 @@/* SPDX-License-Identifier: GPL-2.0 */ /* -* Copyright(c) 2020 Intel Corporation. -* Zhu YiXin <[email protected]> -* Rahul Tanwar <[email protected]> +* Copyright (C) 2020-2022 MaxLinear, Inc. +* Copyright (C) 2020 Intel Corporation. +* Zhu Yixin <[email protected]> +* Rahul Tanwar <[email protected]> */ #ifndef __CLK_CGU_H #define __CLK_CGU_H -#include <linux/io.h> +#include <linux/regmap.h> struct lgm_clk_mux { struct clk_hw hw; - void __iomem *membase; + struct regmap *membase; unsigned int reg; u8 shift; u8 width;
@@ -22,7 +23,7 @@ struct lgm_clk_mux {struct lgm_clk_divider {struct clk_hw hw; -void __iomem *membase; +struct regmap *membase;unsigned int reg;u8 shift;u8 width;
@@ -35,7 +36,7 @@ struct lgm_clk_divider {struct lgm_clk_ddiv {struct clk_hw hw; -void __iomem *membase; +struct regmap *membase;unsigned int reg;u8 shift0;u8 width0;
@@ -53,7 +54,7 @@ struct lgm_clk_ddiv {struct lgm_clk_gate {struct clk_hw hw; -void __iomem *membase; +struct regmap *membase;unsigned int reg;u8 shift;unsigned long flags;
@@ -77,7 +78,7 @@ enum lgm_clk_type {* @clk_data: array of hw clocks and clk number. */ struct lgm_clk_provider { -void __iomem *membase; +struct regmap *membase;struct device_node *np;struct device *dev;struct clk_hw_onecell_data clk_data;
@@ -92,7 +93,7 @@ enum pll_type {struct lgm_clk_pll {struct clk_hw hw; -void __iomem *membase; +struct regmap *membase;unsigned int reg;unsigned long flags;enum pll_type type;
@@ -300,29 +301,32 @@ struct lgm_clk_branch { .div = _d, \ } -static inline void lgm_set_clk_val (void __iomem *membase,u32 reg, +static inline void lgm_set_clk_val (struct regmap *membase,u32 reg,u8 shift,u8 width,u32 set_val) {u32 mask = (GENMASK (width -1 ,0 ) << shift); -u32 regval; - regval =readl (membase + reg); - regval = (regval & ~mask) | ((set_val << shift) & mask); -writel (regval, membase + reg); +regmap_update_bits (membase, reg, mask, set_val << shift); } -static inline u32 lgm_get_clk_val (void __iomem *membase,u32 reg, +static inline u32 lgm_get_clk_val (struct regmap *membase,u32 reg,u8 shift,u8 width) {u32 mask = (GENMASK (width -1 ,0 ) << shift);u32 val; - val =readl (membase + reg); +if (regmap_read (membase, reg, &val)) { +WARN_ONCE (1 ,"Failed to read clk reg: 0x%x\n" , reg); +return 0 ; + } + val = (val & mask) >> shift;return val; } + +int lgm_clk_register_branches (struct lgm_clk_provider *ctx,const struct lgm_clk_branch *list,unsigned int nr_clk);
drivers/clk/x86/clk-lgm.c +9 -4
@@ -1,10 +1,12 @@// SPDX-License-Identifier: GPL-2.0 /* +* Copyright (C) 2020-2022 MaxLinear, Inc. * Copyright (C) 2020 Intel Corporation. -* Zhu YiXin <[email protected]> -* Rahul Tanwar <[email protected]> +* Zhu Yixin <[email protected]> +* Rahul Tanwar <[email protected]> */ #include <linux/clk-provider.h> +#include <linux/mfd/syscon.h> #include <linux/of.h> #include <linux/platform_device.h> #include <dt-bindings/clock/intel,lgm-clk.h>
@@ -433,9 +435,12 @@ static int lgm_cgu_probe(struct platform_device *pdev) ctx->clk_data.num =CLK_NR_CLKS ; - ctx->membase =devm_platform_ioremap_resource (pdev,0 ); -if (IS_ERR (ctx->membase)) + ctx->membase =syscon_node_to_regmap (np); +if (IS_ERR_OR_NULL (ctx->membase)) { +dev_err (dev,"Failed to get clk CGU iomem\n" );return PTR_ERR (ctx->membase); + } + ctx->np = np; ctx->dev = dev;
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 23/46 drm/i915: Remove __maybe_unused from mtl_info
In reply to Greg Kroah-HartmanFrom: Lucas De Marchi <[email protected]>
[ Upstream commit fff758698842fb6722be37498d8773e0fb47f000 ]
The attribute __maybe_unused should remain only until the respective info is not in the pciidlist. The info can't be added together with its definition because that would cause the driver to automatically probe for the device, while it's still not ready for that. However once pciidlist contains it, the attribute can be removed.
--- drivers/gpu/drm/i915/i915_pci.c | 1 - 1 file changed, 1 deletion(-)
drivers/gpu/drm/i915/i915_pci.c +0 -1
@@ -1130,7 +1130,6 @@ static const struct intel_gt_definition xelpmp_extra_gt[] = { {} }; -__maybe_unused static const struct intel_device_info mtl_info = {XE_HP_FEATURES ,XE_LPDP_FEATURES ,
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 24/46 KVM: x86: fix deadlock for KVM_XEN_EVTCHN_RESET
In reply to Greg Kroah-HartmanFrom: Paolo Bonzini <[email protected]>
[ Upstream commit a79b53aaaab53de017517bf9579b6106397a523c ]
While KVM_XEN_EVTCHN_RESET is usually called with no vCPUs running, if that happened it could cause a deadlock. This is due to kvm_xen_eventfd_reset() doing a synchronize_srcu() inside a kvm->lock critical section.
To avoid this, first collect all the evtchnfd objects in an array and free all of them once the kvm->lock critical section is over and th SRCU grace period has expired.
--- arch/x86/kvm/xen.c | 30 +++++++++++++++++-- .../selftests/kvm/x86_64/xen_shinfo_test.c | 6 ++++ 2 files changed, 33 insertions(+), 3 deletions(-)
arch/x86/kvm/xen.c +27 -3
@@ -1757,18 +1757,42 @@ static int kvm_xen_eventfd_deassign(struct kvm *kvm, u32 port)static int kvm_xen_eventfd_reset (struct kvm *kvm) { -struct evtchnfd *evtchnfd; +struct evtchnfd *evtchnfd, **all_evtchnfds;int i; +int n =0 ;mutex_lock (&kvm->lock); + +/* +* Because synchronize_srcu() cannot be called inside the +* critical section, first collect all the evtchnfd objects +* in an array as they are removed from evtchn_ports. +*/ +idr_for_each_entry (&kvm->arch.xen.evtchn_ports, evtchnfd, i) + n++; + + all_evtchnfds =kmalloc_array (n,sizeof (struct evtchnfd *),GFP_KERNEL ); +if (!all_evtchnfds) { +mutex_unlock (&kvm->lock); +return -ENOMEM ; + } + + n =0 ;idr_for_each_entry (&kvm->arch.xen.evtchn_ports, evtchnfd, i) { + all_evtchnfds[n++] = evtchnfd;idr_remove (&kvm->arch.xen.evtchn_ports, evtchnfd->send_port); -synchronize_srcu (&kvm->srcu); + } +mutex_unlock (&kvm->lock); + +synchronize_srcu (&kvm->srcu); + +while (n--) { + evtchnfd = all_evtchnfds[n];if (!evtchnfd->deliver.port.port)eventfd_ctx_put (evtchnfd->deliver.eventfd.ctx);kfree (evtchnfd); } -mutex_unlock (&kvm->lock); +kfree (all_evtchnfds);return 0 ; }
tools/testing/selftests/kvm/x86_64/xen_shinfo_test.c +6 -0
@@ -942,6 +942,12 @@ int main(int argc, char *argv[]) } done: +struct kvm_xen_hvm_attr evt_reset = { + .type =KVM_XEN_ATTR_TYPE_EVTCHN , + .u.evtchn.flags =KVM_XEN_EVTCHN_RESET , + }; +vm_ioctl (vm,KVM_XEN_HVM_SET_ATTR , &evt_reset); +alarm (0 );clock_gettime (CLOCK_REALTIME , &max_ts);
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 25/46 selftests: kvm: move declaration at the beginning of main()
In reply to Greg Kroah-HartmanFrom: Paolo Bonzini <[email protected]>
[ Upstream commit 50aa870ba2f7735f556e52d15f61cd0f359c4c0b ]
Placing a declaration of evt_reset is pedantically invalid according to the C standard. While GCC does not really care and only warns with -Wpedantic, clang ignores the declaration altogether with an error:
x86_64/xen_shinfo_test.c:965:2: error: expected expression
struct kvm_xen_hvm_attr evt_reset = {
^
x86_64/xen_shinfo_test.c:969:38: error: use of undeclared identifier evt_reset
vm_ioctl(vm, KVM_XEN_HVM_SET_ATTR, &evt_reset);
^--- tools/testing/selftests/kvm/x86_64/xen_shinfo_test.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
tools/testing/selftests/kvm/x86_64/xen_shinfo_test.c +3 -4
@@ -428,6 +428,7 @@ static void *juggle_shinfo_state(void *arg)int main (int argc,char *argv[]) {struct timespec min_ts, max_ts, vm_ts; +struct kvm_xen_hvm_attr evt_reset;struct kvm_vm *vm;pthread_t thread;bool verbose;
@@ -942,10 +943,8 @@ int main(int argc, char *argv[]) } done: -struct kvm_xen_hvm_attr evt_reset = { - .type =KVM_XEN_ATTR_TYPE_EVTCHN , - .u.evtchn.flags =KVM_XEN_EVTCHN_RESET , - }; + evt_reset.type =KVM_XEN_ATTR_TYPE_EVTCHN ; + evt_reset.u.evtchn.flags =KVM_XEN_EVTCHN_RESET ;vm_ioctl (vm,KVM_XEN_HVM_SET_ATTR , &evt_reset);alarm (0 );
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 26/46 powerpc/64s/radix: Fix RWX mapping with relocated kernel
In reply to Greg Kroah-HartmanFrom: Michael Ellerman <[email protected]>
[ Upstream commit 111bcb37385353f0510e5847d5abcd1c613dba23 ]
If a relocatable kernel is loaded at a non-zero address and told not to relocate to zero (kdump or RELOCATABLE_TEST), the mapping of the interrupt code at zero is left with RWX permissions.
That is a security weakness, and leads to a warning at boot if CONFIG_DEBUG_WX is enabled:
powerpc/mm: Found insecure W+X mapping at address 00000000056435bc/0xc000000000000000
WARNING: CPU: 1 PID: 1 at arch/powerpc/mm/ptdump/ptdump.c:193 note_page+0x484/0x4c0
CPU: 1 PID: 1 Comm: swapper/0 Not tainted 6.2.0-rc1-00001-g8ae8e98aea82-dirty #175
Hardware name: IBM pSeries (emulated by qemu) POWER9 (raw) 0x4e1202 0xf000005 of:SLOF,git-dd0dca hv:linux,kvm pSeries
NIP: c0000000004a1c34 LR: c0000000004a1c30 CTR: 0000000000000000
REGS: c000000003503770 TRAP: 0700 Not tainted (6.2.0-rc1-00001-g8ae8e98aea82-dirty)
MSR: 8000000002029033 <SF,VEC,EE,ME,IR,DR,RI,LE> CR: 24000220 XER: 00000000
CFAR: c000000000545a58 IRQMASK: 0
...
NIP note_page+0x484/0x4c0
LR note_page+0x480/0x4c0
Call Trace:
note_page+0x480/0x4c0 (unreliable)
ptdump_pmd_entry+0xc8/0x100
walk_pgd_range+0x618/0xab0
walk_page_range_novma+0x74/0xc0
ptdump_walk_pgd+0x98/0x170
ptdump_check_wx+0x94/0x100
mark_rodata_ro+0x30/0x70
kernel_init+0x78/0x1a0
ret_from_kernel_thread+0x5c/0x64The fix has two parts. Firstly the pages from zero up to the end of interrupts need to be marked read-only, so that they are left with R-X permissions. Secondly the mapping logic needs to be taught to ensure there is a page boundary at the end of the interrupt region, so that the permission change only applies to the interrupt text, and not the region following it.
--- arch/powerpc/mm/book3s64/radix_pgtable.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
arch/powerpc/mm/book3s64/radix_pgtable.c +13 -0
@@ -234,6 +234,14 @@ void radix__mark_rodata_ro(void) end = (unsigned long )__end_rodata;radix__change_memory_range (start, end, _PAGE_WRITE); + +for (start =PAGE_OFFSET ; start < (unsigned long )_stext; start +=PAGE_SIZE ) { + end = start +PAGE_SIZE ; +if (overlaps_interrupt_vector_text (start, end)) +radix__change_memory_range (start, end, _PAGE_WRITE); +else +break ; + } }void radix__mark_initmem_nx (void )
@@ -268,6 +276,11 @@ static unsigned long next_boundary(unsigned long addr, unsigned long end)// Relocatable kernel running at non-zero real address if (stext_phys !=0 ) { +// The end of interrupts code at zero is a rodata boundary +unsigned long end_intr =__pa_symbol (__end_interrupts) - stext_phys; +if (addr < end_intr) +return end_intr; +// Start of relocated kernel text is a rodata boundary if (addr < stext_phys)return stext_phys;
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 27/46 nfp: ethtool: support reporting link modes
In reply to Greg Kroah-HartmanFrom: Yu Xiao <[email protected]>
[ Upstream commit a61474c41e8c530c54a26db4f5434f050ef7718d ]
Add support for reporting link modes,
including Supported link modes and Advertised link modes, via ethtool $DEV.
A new command SPCODE_READ_MEDIA is added to read info from management firmware. Also, the mapping table nfp_eth_media_table associates the link modes between NFP and kernel. Both of them help to support this ability.
Stable-dep-of: 821de68c1f9c ("nfp: ethtool: fix the bug of setting unsupported port speed")
--- drivers/net/ethernet/netronome/nfp/nfp_main.h | 1 + .../ethernet/netronome/nfp/nfp_net_ethtool.c | 73 +++++++++++++++++++ .../ethernet/netronome/nfp/nfpcore/nfp_nsp.c | 17 +++++ .../ethernet/netronome/nfp/nfpcore/nfp_nsp.h | 56 ++++++++++++++ .../netronome/nfp/nfpcore/nfp_nsp_eth.c | 26 +++++++ 5 files changed, 173 insertions(+)
drivers/net/ethernet/netronome/nfp/nfp_main.h +1 -0
@@ -28,6 +28,7 @@ struct nfp_hwinfo;struct nfp_mip ;struct nfp_net ;struct nfp_nsp_identify ; +struct nfp_eth_media_buf ;struct nfp_port ;struct nfp_rtsym ;struct nfp_rtsym_table ;
drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c +73 -0
91 lines not on this page · raw message
drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nsp.c +17 -0
@@ -100,6 +100,7 @@ enum nfp_nsp_cmd {SPCODE_FW_LOADED =19 ,/* Is application firmware loaded */ SPCODE_VERSIONS =21 ,/* Report FW versions */ SPCODE_READ_SFF_EEPROM =22 ,/* Read module EEPROM */ + SPCODE_READ_MEDIA = 23, /* Get either the supported or advertised media for a port */ }; struct nfp_nsp_dma_buf {
@@ -1100,4 +1101,20 @@ int nfp_nsp_read_module_eeprom(struct nfp_nsp *state, int eth_index,kfree (buf);return ret; +}; + +int nfp_nsp_read_media (struct nfp_nsp *state,void *buf,unsigned int size) +{ +struct nfp_nsp_command_buf_arg media = { + { + .code =SPCODE_READ_MEDIA , + .option = size, + }, + .in_buf = buf, + .in_size = size, + .out_buf = buf, + .out_size = size, + }; + +return nfp_nsp_command_buf (state, &media); }
drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nsp.h +56 -0
74 lines not on this page · raw message
drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nsp_eth.c +26 -0
@@ -647,3 +647,29 @@ int __nfp_eth_set_split(struct nfp_nsp *nsp, unsigned int lanes)return NFP_ETH_SET_BIT_CONFIG (nsp,NSP_ETH_RAW_PORT ,NSP_ETH_PORT_LANES , lanes,NSP_ETH_CTRL_SET_LANES ); } + +int nfp_eth_read_media (struct nfp_cpp *cpp,struct nfp_eth_media_buf *ethm) +{ +struct nfp_nsp *nsp; +int ret; + + nsp =nfp_nsp_open (cpp); +if (IS_ERR (nsp)) { +nfp_err (cpp,"Failed to access the NSP: %pe\n" , nsp); +return PTR_ERR (nsp); + } + +if (!nfp_nsp_has_read_media (nsp)) { +nfp_warn (cpp,"Reading media link modes not supported. Please update flash\n" ); + ret = -EOPNOTSUPP ; + goto exit_close_nsp; + } + + ret =nfp_nsp_read_media (nsp, ethm,sizeof (*ethm)); +if (ret) +nfp_err (cpp,"Reading media link modes failed: %pe\n" ,ERR_PTR (ret)); + +exit_close_nsp: +nfp_nsp_close (nsp); +return ret; +}
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 28/46 nfp: ethtool: fix the bug of setting unsupported port speed
In reply to Greg Kroah-HartmanFrom: Yu Xiao <[email protected]>
[ Upstream commit 821de68c1f9c0236b0b9c10834cda900ae9b443c ]
Unsupported port speed can be set and cause error. Now fixing it and return an error if setting unsupported speed.
This fix depends on the following, which was included in v6.2-rc1:
commit a61474c41e8c ("nfp: ethtool: support reporting link modes").
--- .../ethernet/netronome/nfp/nfp_net_ethtool.c | 194 ++++++++++++++---- drivers/net/ethernet/netronome/nfp/nfp_port.h | 12 ++ 2 files changed, 170 insertions(+), 36 deletions(-)
drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c +158 -36
@@ -293,35 +293,131 @@ nfp_net_set_fec_link_mode(struct nfp_eth_table_port *eth_port, } } -static const u16 nfp_eth_media_table[] = { - [NFP_MEDIA_1000BASE_CX ] = ETHTOOL_LINK_MODE_1000baseKX_Full_BIT, - [NFP_MEDIA_1000BASE_KX ] = ETHTOOL_LINK_MODE_1000baseKX_Full_BIT, - [NFP_MEDIA_10GBASE_KX4 ] = ETHTOOL_LINK_MODE_10000baseKX4_Full_BIT, - [NFP_MEDIA_10GBASE_KR ] = ETHTOOL_LINK_MODE_10000baseKR_Full_BIT, - [NFP_MEDIA_10GBASE_CX4 ] = ETHTOOL_LINK_MODE_10000baseKX4_Full_BIT, - [NFP_MEDIA_10GBASE_CR ] = ETHTOOL_LINK_MODE_10000baseCR_Full_BIT, - [NFP_MEDIA_10GBASE_SR ] = ETHTOOL_LINK_MODE_10000baseSR_Full_BIT, - [NFP_MEDIA_10GBASE_ER ] = ETHTOOL_LINK_MODE_10000baseER_Full_BIT, - [NFP_MEDIA_25GBASE_KR ] = ETHTOOL_LINK_MODE_25000baseKR_Full_BIT, - [NFP_MEDIA_25GBASE_KR_S ] = ETHTOOL_LINK_MODE_25000baseKR_Full_BIT, - [NFP_MEDIA_25GBASE_CR ] = ETHTOOL_LINK_MODE_25000baseCR_Full_BIT, - [NFP_MEDIA_25GBASE_CR_S ] = ETHTOOL_LINK_MODE_25000baseCR_Full_BIT, - [NFP_MEDIA_25GBASE_SR ] = ETHTOOL_LINK_MODE_25000baseSR_Full_BIT, - [NFP_MEDIA_40GBASE_CR4 ] = ETHTOOL_LINK_MODE_40000baseCR4_Full_BIT, - [NFP_MEDIA_40GBASE_KR4 ] = ETHTOOL_LINK_MODE_40000baseKR4_Full_BIT, - [NFP_MEDIA_40GBASE_SR4 ] = ETHTOOL_LINK_MODE_40000baseSR4_Full_BIT, - [NFP_MEDIA_40GBASE_LR4 ] = ETHTOOL_LINK_MODE_40000baseLR4_Full_BIT, - [NFP_MEDIA_50GBASE_KR ] = ETHTOOL_LINK_MODE_50000baseKR_Full_BIT, - [NFP_MEDIA_50GBASE_SR ] = ETHTOOL_LINK_MODE_50000baseSR_Full_BIT, - [NFP_MEDIA_50GBASE_CR ] = ETHTOOL_LINK_MODE_50000baseCR_Full_BIT, - [NFP_MEDIA_50GBASE_LR ] = ETHTOOL_LINK_MODE_50000baseLR_ER_FR_Full_BIT, - [NFP_MEDIA_50GBASE_ER ] = ETHTOOL_LINK_MODE_50000baseLR_ER_FR_Full_BIT, - [NFP_MEDIA_50GBASE_FR ] = ETHTOOL_LINK_MODE_50000baseLR_ER_FR_Full_BIT, - [NFP_MEDIA_100GBASE_KR4 ] = ETHTOOL_LINK_MODE_100000baseKR4_Full_BIT, - [NFP_MEDIA_100GBASE_SR4 ] = ETHTOOL_LINK_MODE_100000baseSR4_Full_BIT, - [NFP_MEDIA_100GBASE_CR4 ] = ETHTOOL_LINK_MODE_100000baseCR4_Full_BIT, - [NFP_MEDIA_100GBASE_KP4 ] = ETHTOOL_LINK_MODE_100000baseKR4_Full_BIT, - [NFP_MEDIA_100GBASE_CR10 ] = ETHTOOL_LINK_MODE_100000baseCR4_Full_BIT, +static const struct nfp_eth_media_link_mode { +u16 ethtool_link_mode; +u16 speed; +} nfp_eth_media_table[NFP_MEDIA_LINK_MODES_NUMBER ] = { + [NFP_MEDIA_1000BASE_CX ] = { + .ethtool_link_mode = ETHTOOL_LINK_MODE_1000baseKX_Full_BIT, + .speed =NFP_SPEED_1G , + }, + [NFP_MEDIA_1000BASE_KX ] = { + .ethtool_link_mode = ETHTOOL_LINK_MODE_1000baseKX_Full_BIT, + .speed =NFP_SPEED_1G , + }, + [NFP_MEDIA_10GBASE_KX4 ] = { + .ethtool_link_mode = ETHTOOL_LINK_MODE_10000baseKX4_Full_BIT, + .speed =NFP_SPEED_10G , + }, + [NFP_MEDIA_10GBASE_KR ] = { + .ethtool_link_mode = ETHTOOL_LINK_MODE_10000baseKR_Full_BIT, + .speed =NFP_SPEED_10G , + }, + [NFP_MEDIA_10GBASE_CX4 ] = { + .ethtool_link_mode = ETHTOOL_LINK_MODE_10000baseKX4_Full_BIT, + .speed =NFP_SPEED_10G , + }, + [NFP_MEDIA_10GBASE_CR ] = { + .ethtool_link_mode = ETHTOOL_LINK_MODE_10000baseCR_Full_BIT, + .speed =NFP_SPEED_10G , + }, + [NFP_MEDIA_10GBASE_SR ] = { + .ethtool_link_mode = ETHTOOL_LINK_MODE_10000baseSR_Full_BIT, + .speed =NFP_SPEED_10G , + }, + [NFP_MEDIA_10GBASE_ER ] = { + .ethtool_link_mode = ETHTOOL_LINK_MODE_10000baseER_Full_BIT, + .speed =NFP_SPEED_10G , + }, + [NFP_MEDIA_25GBASE_KR ] = { + .ethtool_link_mode = ETHTOOL_LINK_MODE_25000baseKR_Full_BIT, + .speed =NFP_SPEED_25G , + }, + [NFP_MEDIA_25GBASE_KR_S ] = { + .ethtool_link_mode = ETHTOOL_LINK_MODE_25000baseKR_Full_BIT, + .speed =NFP_SPEED_25G , + }, + [NFP_MEDIA_25GBASE_CR ] = { + .ethtool_link_mode = ETHTOOL_LINK_MODE_25000baseCR_Full_BIT, + .speed =NFP_SPEED_25G , + }, + [NFP_MEDIA_25GBASE_CR_S ] = { + .ethtool_link_mode = ETHTOOL_LINK_MODE_25000baseCR_Full_BIT, + .speed =NFP_SPEED_25G , + }, + [NFP_MEDIA_25GBASE_SR ] = { + .ethtool_link_mode = ETHTOOL_LINK_MODE_25000baseSR_Full_BIT, + .speed =NFP_SPEED_25G , + }, + [NFP_MEDIA_40GBASE_CR4 ] = { + .ethtool_link_mode = ETHTOOL_LINK_MODE_40000baseCR4_Full_BIT, + .speed =NFP_SPEED_40G , + }, + [NFP_MEDIA_40GBASE_KR4 ] = { + .ethtool_link_mode = ETHTOOL_LINK_MODE_40000baseKR4_Full_BIT, + .speed =NFP_SPEED_40G , + }, + [NFP_MEDIA_40GBASE_SR4 ] = { + .ethtool_link_mode = ETHTOOL_LINK_MODE_40000baseSR4_Full_BIT, + .speed =NFP_SPEED_40G , + }, + [NFP_MEDIA_40GBASE_LR4 ] = { + .ethtool_link_mode = ETHTOOL_LINK_MODE_40000baseLR4_Full_BIT, + .speed =NFP_SPEED_40G , + }, + [NFP_MEDIA_50GBASE_KR ] = { + .ethtool_link_mode = ETHTOOL_LINK_MODE_50000baseKR_Full_BIT, + .speed =NFP_SPEED_50G , + }, + [NFP_MEDIA_50GBASE_SR ] = { + .ethtool_link_mode = ETHTOOL_LINK_MODE_50000baseSR_Full_BIT, + .speed =NFP_SPEED_50G , + }, + [NFP_MEDIA_50GBASE_CR ] = { + .ethtool_link_mode = ETHTOOL_LINK_MODE_50000baseCR_Full_BIT, + .speed =NFP_SPEED_50G , + }, + [NFP_MEDIA_50GBASE_LR ] = { + .ethtool_link_mode = ETHTOOL_LINK_MODE_50000baseLR_ER_FR_Full_BIT, + .speed =NFP_SPEED_50G , + }, + [NFP_MEDIA_50GBASE_ER ] = { + .ethtool_link_mode = ETHTOOL_LINK_MODE_50000baseLR_ER_FR_Full_BIT, + .speed =NFP_SPEED_50G , + }, + [NFP_MEDIA_50GBASE_FR ] = { + .ethtool_link_mode = ETHTOOL_LINK_MODE_50000baseLR_ER_FR_Full_BIT, + .speed =NFP_SPEED_50G , + }, + [NFP_MEDIA_100GBASE_KR4 ] = { + .ethtool_link_mode = ETHTOOL_LINK_MODE_100000baseKR4_Full_BIT, + .speed =NFP_SPEED_100G , + }, + [NFP_MEDIA_100GBASE_SR4 ] = { + .ethtool_link_mode = ETHTOOL_LINK_MODE_100000baseSR4_Full_BIT, + .speed =NFP_SPEED_100G , + }, + [NFP_MEDIA_100GBASE_CR4 ] = { + .ethtool_link_mode = ETHTOOL_LINK_MODE_100000baseCR4_Full_BIT, + .speed =NFP_SPEED_100G , + }, + [NFP_MEDIA_100GBASE_KP4 ] = { + .ethtool_link_mode = ETHTOOL_LINK_MODE_100000baseKR4_Full_BIT, + .speed =NFP_SPEED_100G , + }, + [NFP_MEDIA_100GBASE_CR10 ] = { + .ethtool_link_mode = ETHTOOL_LINK_MODE_100000baseCR4_Full_BIT, + .speed =NFP_SPEED_100G , + }, +}; + +static const unsigned int nfp_eth_speed_map[NFP_SUP_SPEED_NUMBER ] = { + [NFP_SPEED_1G ] =SPEED_1000 , + [NFP_SPEED_10G ] =SPEED_10000 , + [NFP_SPEED_25G ] =SPEED_25000 , + [NFP_SPEED_40G ] =SPEED_40000 , + [NFP_SPEED_50G ] =SPEED_50000 , + [NFP_SPEED_100G ] =SPEED_100000 , }; static void nfp_add_media_link_mode(struct nfp_port *port,
@@ -334,8 +430,12 @@ static void nfp_add_media_link_mode(struct nfp_port *port, };struct nfp_cpp *cpp = port->app->cpp; -if (nfp_eth_read_media (cpp, ðm)) +if (nfp_eth_read_media (cpp, ðm)) { +bitmap_fill (port->speed_bitmap,NFP_SUP_SPEED_NUMBER );return ; + } + +bitmap_zero (port->speed_bitmap,NFP_SUP_SPEED_NUMBER );for (u32 i =0 ; i <2 ; i++) { supported_modes[i] =le64_to_cpu (ethm.supported_modes[i]);
@@ -344,20 +444,26 @@ static void nfp_add_media_link_mode(struct nfp_port *port,for (u32 i =0 ; i <NFP_MEDIA_LINK_MODES_NUMBER ; i++) {if (i <64 ) { -if (supported_modes[0 ] &BIT_ULL (i)) -__set_bit (nfp_eth_media_table[i], +if (supported_modes[0 ] &BIT_ULL (i)) { +__set_bit (nfp_eth_media_table[i].ethtool_link_mode, cmd->link_modes.supported); +__set_bit (nfp_eth_media_table[i].speed, + port->speed_bitmap); + }if (advertised_modes[0 ] &BIT_ULL (i)) -__set_bit (nfp_eth_media_table[i], +__set_bit (nfp_eth_media_table[i].ethtool_link_mode, cmd->link_modes.advertising); }else { -if (supported_modes[1 ] &BIT_ULL (i -64 )) -__set_bit (nfp_eth_media_table[i], +if (supported_modes[1 ] &BIT_ULL (i -64 )) { +__set_bit (nfp_eth_media_table[i].ethtool_link_mode, cmd->link_modes.supported); +__set_bit (nfp_eth_media_table[i].speed, + port->speed_bitmap); + }if (advertised_modes[1 ] &BIT_ULL (i -64 )) -__set_bit (nfp_eth_media_table[i], +__set_bit (nfp_eth_media_table[i].ethtool_link_mode, cmd->link_modes.advertising); } }
@@ -468,6 +574,22 @@ nfp_net_set_link_ksettings(struct net_device *netdev,if (cmd->base.speed !=SPEED_UNKNOWN ) {u32 speed = cmd->base.speed / eth_port->lanes; +bool is_supported = false; + +for (u32 i =0 ; i <NFP_SUP_SPEED_NUMBER ; i++) { +if (cmd->base.speed == nfp_eth_speed_map[i] && +test_bit (i, port->speed_bitmap)) { + is_supported = true; +break ; + } + } + +if (!is_supported) { +netdev_err (netdev,"Speed %u is not supported.\n" , + cmd->base.speed); + err = -EINVAL ; + goto err_bad_set; + }if (req_aneg) {netdev_err (netdev,"Speed changing is not allowed when working on autoneg mode.\n" );
drivers/net/ethernet/netronome/nfp/nfp_port.h +12 -0
@@ -38,6 +38,16 @@ enum nfp_port_flags { NFP_PORT_CHANGED = 0, }; +enum { +NFP_SPEED_1G , +NFP_SPEED_10G , +NFP_SPEED_25G , +NFP_SPEED_40G , +NFP_SPEED_50G , +NFP_SPEED_100G , +NFP_SUP_SPEED_NUMBER +}; +/** * struct nfp_port - structure representing NFP port * @netdev: backpointer to associated netdev
@@ -52,6 +62,7 @@ enum nfp_port_flags {* @eth_forced: for %NFP_PORT_PHYS_PORT port is forced UP or DOWN, don't change * @eth_port: for %NFP_PORT_PHYS_PORT translated ETH Table port entry * @eth_stats: for %NFP_PORT_PHYS_PORT MAC stats if available +* @speed_bitmap: for %NFP_PORT_PHYS_PORT supported speed bitmap * @pf_id: for %NFP_PORT_PF_PORT, %NFP_PORT_VF_PORT ID of the PCI PF (0-3) * @vf_id: for %NFP_PORT_VF_PORT ID of the PCI VF within @pf_id * @pf_split: for %NFP_PORT_PF_PORT %true if PCI PF has more than one vNIC
@@ -78,6 +89,7 @@ struct nfp_port {bool eth_forced;struct nfp_eth_table_port *eth_port;u8 __iomem *eth_stats; +DECLARE_BITMAP (speed_bitmap,NFP_SUP_SPEED_NUMBER ); };/* NFP_PORT_PF_PORT, NFP_PORT_VF_PORT */ struct {
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 29/46 uaccess: Add speculation barrier to copy_from_user()
In reply to Greg Kroah-HartmanFrom: Dave Hansen <[email protected]>
commit 74e19ef0ff8061ef55957c3abd71614ef0f42f47 upstream.
The results of "access_ok()" can be mis-speculated. The result is that you can end speculatively:
if (access_ok(from, size)) // Right here
even for bad from/size combinations. On first glance, it would be ideal to just add a speculation barrier to "access_ok()" so that its results can never be mis-speculated.
But there are lots of system calls just doing access_ok() via "copy_to_user()" and friends (example: fstat() and friends). Those are generally not problematic because they do not _consume_ data from userspace other than the pointer. They are also very quick and common system calls that should not be needlessly slowed down.
"copy_from_user()" on the other hand uses a user-controller pointer and is frequently followed up with code that might affect caches. Take something like this:
if (!copy_from_user(&kernelvar, uptr, size)) do_something_with(kernelvar);
If userspace passes in an evil 'uptr' that *actually* points to a kernel addresses, and then do_something_with() has cache (or other) side-effects, it could allow userspace to infer kernel data values.
Add a barrier to the common copy_from_user() code to prevent mis-speculated values which happen after the copy.
Also add a stub for architectures that do not define barrier_nospec(). This makes the macro usable in generic code.
Since the barrier is now usable in generic code, the x86 #ifdef in the BPF code can also go away.
--- include/linux/nospec.h | 4 ++++ kernel/bpf/core.c | 2 -- lib/usercopy.c | 7 +++++++ 3 files changed, 11 insertions(+), 2 deletions(-)
include/linux/nospec.h +4 -0
@@ -11,6 +11,10 @@struct task_struct ; +#ifndef barrier_nospec +# define barrier_nospec () do { } while (0) +#endif +/** * array_index_mask_nospec() - generate a ~0 mask when index < size, 0 otherwise * @index: array element index
kernel/bpf/core.c +0 -2
@@ -1908,9 +1908,7 @@ out:* reuse preexisting logic from Spectre v1 mitigation that * happens to produce the required code on x86 for v4 as well. */ -#ifdef CONFIG_X86 barrier_nospec (); -#endif CONT ;#define LDST (SIZEOP ,SIZE ) \ STX_MEM_##SIZEOP: \
lib/usercopy.c +7 -0
@@ -3,6 +3,7 @@#include <linux/fault-inject-usercopy.h> #include <linux/instrumented.h> #include <linux/uaccess.h> +#include <linux/nospec.h> /* out-of-line parts */
@@ -12,6 +13,12 @@ unsigned long _copy_from_user(void *to,unsigned long res = n;might_fault ();if (!should_fail_usercopy () &&likely (access_ok (from, n))) { +/* +* Ensure that bad access_ok() speculation will not +* lead to nasty side effects *after* the copy is +* finished: +*/ +barrier_nospec ();instrument_copy_from_user_before (to, from, n); res =raw_copy_from_user (to, from, n);instrument_copy_from_user_after (to, from, n, res);
Greg Kroah-Hartman
maintainerPATCH 30/46 x86/alternatives: Introduce int3_emulate_jcc()
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
commit db7adcfd1cec4e95155e37bc066fddab302c6340 upstream.
Move the kprobe Jcc emulation into int3_emulate_jcc() so it can be used by more code -- specifically static_call() will need this.
--- arch/x86/include/asm/text-patching.h | 31 ++++++++++++++++++++++++++++ arch/x86/kernel/kprobes/core.c | 38 +++++++---------------------------- 2 files changed, 39 insertions(+), 30 deletions(-)
arch/x86/include/asm/text-patching.h +31 -0
@@ -183,6 +183,37 @@ void int3_emulate_ret(struct pt_regs *reunsigned long ip =int3_emulate_pop (regs);int3_emulate_jmp (regs, ip); } + +static __always_inline +void int3_emulate_jcc(struct pt_regs *regs, u8 cc, unsigned long ip, unsigned long disp) +{ +static const unsigned long jcc_mask[6 ] = { + [0 ] =X86_EFLAGS_OF , + [1 ] =X86_EFLAGS_CF , + [2 ] =X86_EFLAGS_ZF , + [3 ] =X86_EFLAGS_CF |X86_EFLAGS_ZF , + [4 ] =X86_EFLAGS_SF , + [5 ] =X86_EFLAGS_PF , + }; + +bool invert = cc &1 ; +bool match; + +if (cc <0xc ) { + match = regs->flags & jcc_mask[cc >>1 ]; + }else { + match = ((regs->flags &X86_EFLAGS_SF ) >>X86_EFLAGS_SF_BIT ) ^ + ((regs->flags &X86_EFLAGS_OF ) >>X86_EFLAGS_OF_BIT ); +if (cc >=0xe ) + match = match || (regs->flags &X86_EFLAGS_ZF ); + } + +if ((match && !invert) || (!match && invert)) + ip += disp; + +int3_emulate_jmp (regs, ip); +} +#endif /* !CONFIG_UML_X86 */ #endif /* _ASM_X86_TEXT_PATCHING_H */
arch/x86/kernel/kprobes/core.c +8 -30
@@ -471,50 +471,26 @@ static void kprobe_emulate_call(struct k }NOKPROBE_SYMBOL (kprobe_emulate_call); -static nokprobe_inline -void __kprobe_emulate_jmp(struct kprobe *p, struct pt_regs *regs, bool cond) +static void kprobe_emulate_jmp (struct kprobe *p,struct pt_regs *regs) {unsigned long ip = regs->ip -INT3_INSN_SIZE + p->ainsn.size; -if (cond) - ip += p->ainsn.rel32; + ip += p->ainsn.rel32;int3_emulate_jmp (regs, ip); } - -static void kprobe_emulate_jmp (struct kprobe *p,struct pt_regs *regs) -{ -__kprobe_emulate_jmp (p, regs, true); -}NOKPROBE_SYMBOL (kprobe_emulate_jmp); -static const unsigned long jcc_mask[6 ] = { - [0 ] =X86_EFLAGS_OF , - [1 ] =X86_EFLAGS_CF , - [2 ] =X86_EFLAGS_ZF , - [3 ] =X86_EFLAGS_CF |X86_EFLAGS_ZF , - [4 ] =X86_EFLAGS_SF , - [5 ] =X86_EFLAGS_PF , -}; -static void kprobe_emulate_jcc (struct kprobe *p,struct pt_regs *regs) { -bool invert = p->ainsn.jcc.type &1 ; -bool match; +unsigned long ip = regs->ip -INT3_INSN_SIZE + p->ainsn.size; -if (p->ainsn.jcc.type <0xc ) { - match = regs->flags & jcc_mask[p->ainsn.jcc.type >>1 ]; - }else { - match = ((regs->flags &X86_EFLAGS_SF ) >>X86_EFLAGS_SF_BIT ) ^ - ((regs->flags &X86_EFLAGS_OF ) >>X86_EFLAGS_OF_BIT ); -if (p->ainsn.jcc.type >=0xe ) - match = match || (regs->flags &X86_EFLAGS_ZF ); - } -__kprobe_emulate_jmp (p, regs, (match && !invert) || (!match && invert)); +int3_emulate_jcc (regs, p->ainsn.jcc.type, ip, p->ainsn.rel32); }NOKPROBE_SYMBOL (kprobe_emulate_jcc);static void kprobe_emulate_loop (struct kprobe *p,struct pt_regs *regs) { +unsigned long ip = regs->ip -INT3_INSN_SIZE + p->ainsn.size;bool match;if (p->ainsn.loop.type !=3 ) {/* LOOP* */
@@ -542,7 +518,9 @@ static void kprobe_emulate_loop(struct kelse if (p->ainsn.loop.type ==1 )/* LOOPE */ match = match && (regs->flags &X86_EFLAGS_ZF ); -__kprobe_emulate_jmp (p, regs, match); +if (match) + ip += p->ainsn.rel32; +int3_emulate_jmp (regs, ip); }NOKPROBE_SYMBOL (kprobe_emulate_loop);
Greg Kroah-Hartman
maintainerPATCH 31/46 x86/alternatives: Teach text_poke_bp() to patch Jcc.d32 instructions
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
commit ac0ee0a9560c97fa5fe1409e450c2425d4ebd17a upstream.
In order to re-write Jcc.d32 instructions text_poke_bp() needs to be taught about them.
The biggest hurdle is that the whole machinery is currently made for 5 byte instructions and extending this would grow struct text_poke_loc which is currently a nice 16 bytes and used in an array.
However, since text_poke_loc contains a full copy of the (s32) displacement, it is possible to map the Jcc.d32 2 byte opcodes to Jcc.d8 1 byte opcode for the int3 emulation.
This then leaves the replacement bytes; fudge that by only storing the last 5 bytes and adding the rule that 'length == 6' instruction will be prefixed with a 0x0f byte.
[nathan: Introduce is_jcc32() as part of this change; upstream
introduced it in 3b6c1747da48]
--- arch/x86/kernel/alternative.c | 59 ++++++++++++++++++++++++++++++++++-------- 1 file changed, 48 insertions(+), 11 deletions(-)
arch/x86/kernel/alternative.c +48 -11
@@ -339,6 +339,12 @@ next: } } +static inline bool is_jcc32 (struct insn *insn) +{ +/* Jcc.d32 second opcode byte is in the range: 0x80-0x8f */ +return insn->opcode.bytes[0 ] ==0x0f && (insn->opcode.bytes[1 ] &0xf0 ) ==0x80 ; +} +#if defined(CONFIG_RETPOLINE ) && defined(CONFIG_OBJTOOL )/*
@@ -427,8 +433,7 @@ static int patch_retpoline(void *addr, s* [ NOP ] * 1: */ -/* Jcc.d32 second opcode byte is in the range: 0x80-0x8f */ -if (op ==0x0f && (insn->opcode.bytes[1 ] &0xf0 ) ==0x80 ) { +if (is_jcc32 (insn)) { cc = insn->opcode.bytes[1 ] &0xf ; cc ^=1 ;/* invert condition */
@@ -1311,6 +1316,11 @@ void text_poke_sync(void)on_each_cpu (do_sync_core,NULL ,1 ); } +/* +* NOTE: crazy scheme to allow patching Jcc.d32 but not increase the size of +* this thing. When len == 6 everything is prefixed with 0x0f and we map +* opcode to Jcc.d8, using len to distinguish. +*/ struct text_poke_loc {/* addr := _stext + rel_addr */ s32 rel_addr;
@@ -1432,6 +1442,10 @@ noinstr int poke_int3_handler(struct pt_int3_emulate_jmp (regs, (long )ip + tp->disp);break ; + case 0x70 ... 0x7f: /* Jcc */ +int3_emulate_jcc (regs, tp->opcode &0xf , (long )ip, tp->disp); +break ; +default :BUG (); }
@@ -1505,16 +1519,26 @@ static void text_poke_bp_batch(struct te* Second step: update all but the first byte of the patched range. */ for (do_sync =0 , i =0 ; i < nr_entries; i++) { -u8 old[POKE_MAX_OPCODE_SIZE ] = { tp[i].old, }; +u8 old[POKE_MAX_OPCODE_SIZE +1 ] = { tp[i].old, }; +u8 _new[POKE_MAX_OPCODE_SIZE +1 ]; +const u8 *new = tp[i].text;int len = tp[i].len;if (len -INT3_INSN_SIZE >0 ) {memcpy (old +INT3_INSN_SIZE ,text_poke_addr (&tp[i]) +INT3_INSN_SIZE , len -INT3_INSN_SIZE ); + +if (len ==6 ) { + _new[0 ] =0x0f ; +memcpy (_new +1 , new,5 ); + new = _new; + } +text_poke (text_poke_addr (&tp[i]) +INT3_INSN_SIZE , - (const char *)tp[i].text +INT3_INSN_SIZE , + new +INT3_INSN_SIZE , len -INT3_INSN_SIZE ); + do_sync++; }
@@ -1542,8 +1566,7 @@ static void text_poke_bp_batch(struct te* The old instruction is recorded so that the event can be * processed forwards or backwards. */ -perf_event_text_poke (text_poke_addr (&tp[i]), old, len, - tp[i].text, len); +perf_event_text_poke (text_poke_addr (&tp[i]), old, len, new, len); }if (do_sync) {
@@ -1560,10 +1583,15 @@ static void text_poke_bp_batch(struct te* replacing opcode. */ for (do_sync =0 , i =0 ; i < nr_entries; i++) { -if (tp[i].text[0 ] ==INT3_INSN_OPCODE ) +u8 byte = tp[i].text[0 ]; + +if (tp[i].len ==6 ) + byte =0x0f ; + +if (byte ==INT3_INSN_OPCODE )continue ; -text_poke (text_poke_addr (&tp[i]), tp[i].text,INT3_INSN_SIZE ); +text_poke (text_poke_addr (&tp[i]), &byte,INT3_INSN_SIZE ); do_sync++; }
@@ -1581,9 +1609,11 @@ static void text_poke_loc_init(struct te const void *opcode, size_t len, const void *emulate) { struct insn insn; -int ret, i; +int ret, i =0 ; -memcpy ((void *)tp->text, opcode, len); +if (len ==6 ) + i =1 ; +memcpy ((void *)tp->text, opcode+i, len-i);if (!emulate) emulate = opcode;
@@ -1594,6 +1624,13 @@ static void text_poke_loc_init(struct te tp->len = len; tp->opcode = insn.opcode.bytes[0 ]; +if (is_jcc32 (&insn)) { +/* +* Map Jcc.d32 onto Jcc.d8 and use len to distinguish. +*/ + tp->opcode = insn.opcode.bytes[1 ] -0x10 ; + } +switch (tp->opcode) {case RET_INSN_OPCODE :case JMP32_INSN_OPCODE :
@@ -1610,7 +1647,6 @@ static void text_poke_loc_init(struct teBUG_ON (len != insn.length); }; -switch (tp->opcode) {case INT3_INSN_OPCODE :case RET_INSN_OPCODE :
@@ -1619,6 +1655,7 @@ static void text_poke_loc_init(struct tecase CALL_INSN_OPCODE :case JMP32_INSN_OPCODE :case JMP8_INSN_OPCODE : + case 0x70 ... 0x7f: /* Jcc */ tp->disp = insn.immediate.value;break ;
Greg Kroah-Hartman
maintainerPATCH 32/46 x86/static_call: Add support for Jcc tail-calls
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
commit 923510c88d2b7d947c4217835fd9ca6bd65cc56c upstream.
Clang likes to create conditional tail calls like:
0000000000000350 <amd_pmu_add_event>:
350: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1) 351: R_X86_64_NONE __fentry__-0x4 355: 48 83 bf 20 01 00 00 00 cmpq $0x0,0x120(%rdi) 35d: 0f 85 00 00 00 00 jne 363 <amd_pmu_add_event+0x13> 35f: R_X86_64_PLT32 __SCT__amd_pmu_branch_add-0x4 363: e9 00 00 00 00 jmp 368 <amd_pmu_add_event+0x18> 364: R_X86_64_PLT32 __x86_return_thunk-0x4
Where 0x35d is a static call site that's turned into a conditional tail-call using the Jcc class of instructions.
Teach the in-line static call text patching about this.
Notably, since there is no conditional-ret, in that case patch the Jcc to point at an empty stub function that does the ret -- or the return thunk when needed.
[nathan: Backport to 6.1:
- Use __x86_return_thunk instead of x86_return_thunk for func in __static_call_transform()
- Remove ASM_FUNC_ALIGN in __static_call_return() asm, as call depth tracking was merged in 6.2]
--- arch/x86/kernel/static_call.c | 49 +++++++++++++++++++++++++++++++++++++++--- 1 file changed, 46 insertions(+), 3 deletions(-)
arch/x86/kernel/static_call.c +46 -3
@@ -9,6 +9,7 @@ enum insn_type {NOP =1 ,/* site cond-call */ JMP =2 ,/* tramp / site tail-call */ RET =3 ,/* tramp / site cond-tail-call */ + JCC = 4, };/*
@@ -25,12 +26,39 @@ static const u8 xor5rax[] = { 0x2e, 0x2estatic const u8 retinsn[] = {RET_INSN_OPCODE ,0xcc ,0xcc ,0xcc ,0xcc }; +static u8 __is_Jcc (u8 *insn)/* Jcc.d32 */ +{ +u8 ret =0 ; + +if (insn[0 ] ==0x0f ) { +u8 tmp = insn[1 ]; +if ((tmp &0xf0 ) ==0x80 ) + ret = tmp; + } + +return ret; +} + +extern void __static_call_return (void ); + +asm (".global __static_call_return\n\t" +".type __static_call_return, @function\n\t" +"__static_call_return:\n\t" +ANNOTATE_NOENDBR +ANNOTATE_RETPOLINE_SAFE +"ret; int3\n\t" +".size __static_call_return, . - __static_call_return \n\t" ); +static void __ref __static_call_transform (void *insn,enum insn_type type,void *func,bool modinit) {const void *emulate =NULL ;int size =CALL_INSN_SIZE ;const void *code; +u8 op, buf[6 ]; + +if ((type ==JMP || type ==RET ) && (op =__is_Jcc (insn))) + type =JCC ;switch (type) {case CALL :
@@ -56,6 +84,20 @@ static void __ref __static_call_transforelse code = &retinsn;break ; + +case JCC : +if (!func) { + func = __static_call_return; +if (cpu_feature_enabled (X86_FEATURE_RETHUNK )) + func = __x86_return_thunk; + } + + buf[0 ] =0x0f ; +__text_gen_insn (buf+1 , op, insn+1 , func,5 ); + code = buf; + size =6 ; + +break ; }if (memcmp (insn, code, size) ==0 )
@@ -67,9 +109,9 @@ static void __ref __static_call_transfortext_poke_bp (insn, code, size, emulate); } -static void __static_call_validate (void *insn,bool tail,bool tramp) +static void __static_call_validate (u8 *insn,bool tail,bool tramp) { -u8 opcode = *(u8 *)insn; +u8 opcode = insn[0 ];if (tramp &&memcmp (insn+5 , tramp_ud,3 )) {pr_err ("trampoline signature fail" );
@@ -78,7 +120,8 @@ static void __static_call_validate(voidif (tail) {if (opcode ==JMP32_INSN_OPCODE || - opcode ==RET_INSN_OPCODE ) + opcode ==RET_INSN_OPCODE || +__is_Jcc (insn))return ; }else { if (opcode == CALL_INSN_OPCODE ||
Greg Kroah-Hartman
maintainerPATCH 6/46 clk: mxl: Remove redundant spinlocks
In reply to Greg Kroah-HartmanFrom: Rahul Tanwar <[email protected]>
[ Upstream commit eaabee88a88a26b108be8d120fc072dfaf462cef ]
Patch 1/4 of this patch series switches from direct readl/writel based register access to regmap based register access. Instead of using direct readl/writel, regmap API's are used to read, write & read-modify-write clk registers. Regmap API's already use their own spinlocks to serialize the register accesses across multiple cores in which case additional driver spinlocks becomes redundant.
Hence, remove redundant spinlocks from driver in this patch 2/4.
Stable-dep-of: 106ef3bda210 ("clk: mxl: Fix a clk entry by adding relevant flags")
--- drivers/clk/x86/clk-cgu-pll.c | 13 ------ drivers/clk/x86/clk-cgu.c | 80 ++++------------------------------- drivers/clk/x86/clk-cgu.h | 6 --- drivers/clk/x86/clk-lgm.c | 1 - 4 files changed, 9 insertions(+), 91 deletions(-)
drivers/clk/x86/clk-cgu-pll.c +0 -13
@@ -41,13 +41,10 @@ static unsigned long lgm_pll_recalc_rate(struct clk_hw *hw, unsigned long prate) {struct lgm_clk_pll *pll =to_lgm_clk_pll (hw);unsigned int div, mult, frac; -unsigned long flags; -spin_lock_irqsave (&pll->lock, flags); mult =lgm_get_clk_val (pll->membase,PLL_REF_DIV (pll->reg),0 ,12 ); div =lgm_get_clk_val (pll->membase,PLL_REF_DIV (pll->reg),18 ,6 ); frac =lgm_get_clk_val (pll->membase, pll->reg,2 ,24 ); -spin_unlock_irqrestore (&pll->lock, flags);if (pll->type ==TYPE_LJPLL ) div *=4 ;
@@ -58,12 +55,9 @@ static unsigned long lgm_pll_recalc_rate(struct clk_hw *hw, unsigned long prate)static int lgm_pll_is_enabled (struct clk_hw *hw) {struct lgm_clk_pll *pll =to_lgm_clk_pll (hw); -unsigned long flags;unsigned int ret; -spin_lock_irqsave (&pll->lock, flags); ret =lgm_get_clk_val (pll->membase, pll->reg,0 ,1 ); -spin_unlock_irqrestore (&pll->lock, flags);return ret; }
@@ -71,16 +65,13 @@ static int lgm_pll_is_enabled(struct clk_hw *hw)static int lgm_pll_enable (struct clk_hw *hw) {struct lgm_clk_pll *pll =to_lgm_clk_pll (hw); -unsigned long flags;u32 val;int ret; -spin_lock_irqsave (&pll->lock, flags);lgm_set_clk_val (pll->membase, pll->reg,0 ,1 ,1 ); ret =regmap_read_poll_timeout_atomic (pll->membase, pll->reg, val, (val &0x1 ),1 ,100 ); -spin_unlock_irqrestore (&pll->lock, flags);return ret; }
@@ -88,11 +79,8 @@ static int lgm_pll_enable(struct clk_hw *hw)static void lgm_pll_disable (struct clk_hw *hw) {struct lgm_clk_pll *pll =to_lgm_clk_pll (hw); -unsigned long flags; -spin_lock_irqsave (&pll->lock, flags);lgm_set_clk_val (pll->membase, pll->reg,0 ,1 ,0 ); -spin_unlock_irqrestore (&pll->lock, flags); }static const struct clk_ops lgm_pll_ops = {
@@ -123,7 +111,6 @@ lgm_clk_register_pll(struct lgm_clk_provider *ctx,return ERR_PTR (-ENOMEM ); pll->membase = ctx->membase; - pll->lock = ctx->lock; pll->reg = list->reg; pll->flags = list->flags; pll->type = list->type;
drivers/clk/x86/clk-cgu.c +9 -71
321 lines not on this page · raw message
drivers/clk/x86/clk-cgu.h +0 -6
@@ -18,7 +18,6 @@ struct lgm_clk_mux {u8 shift;u8 width;unsigned long flags; -spinlock_t lock; };struct lgm_clk_divider {
@@ -31,7 +30,6 @@ struct lgm_clk_divider {u8 width_gate;unsigned long flags;const struct clk_div_table *table; -spinlock_t lock; };struct lgm_clk_ddiv {
@@ -49,7 +47,6 @@ struct lgm_clk_ddiv {unsigned int mult;unsigned int div;unsigned long flags; -spinlock_t lock; };struct lgm_clk_gate {
@@ -58,7 +55,6 @@ struct lgm_clk_gate {unsigned int reg;u8 shift;unsigned long flags; -spinlock_t lock; };enum lgm_clk_type {
@@ -82,7 +78,6 @@ struct lgm_clk_provider {struct device_node *np;struct device *dev;struct clk_hw_onecell_data clk_data; -spinlock_t lock; };enum pll_type {
@@ -97,7 +92,6 @@ struct lgm_clk_pll {unsigned int reg;unsigned long flags;enum pll_type type; -spinlock_t lock; };/**
drivers/clk/x86/clk-lgm.c +0 -1
@@ -444,7 +444,6 @@ static int lgm_cgu_probe(struct platform_device *pdev) ctx->np = np; ctx->dev = dev; -spin_lock_init (&ctx->lock); ret =lgm_clk_register_plls (ctx, lgm_pll_clks,ARRAY_SIZE (lgm_pll_clks));
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 33/46 Bluetooth: btusb: Add more device IDs for WCN6855
In reply to Greg Kroah-HartmanFrom: Shengyu Qu <[email protected]>
commit ca2a99447e17acd67258aa1d54d7ea3c404a779c upstream.
Add IDs to usb_device_id table for WCN6855. IDs are extracted from Windows driver of Lenovo Thinkpad T14 Gen 2(Driver version 1.0.0.1205 Windows 10)
Windows driver download address:
https://pcsupport.lenovo.com/us/en/products/laptops-and-netbooks/
thinkpad-t-series-laptops/thinkpad-t14-gen-2-type-20xk-20xl/downloads /driver-list/
--- drivers/bluetooth/btusb.c | 84 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 84 insertions(+)
drivers/bluetooth/btusb.c +84 -0
@@ -316,6 +316,90 @@ static const struct usb_device_id blackl { USB_DEVICE(0x0489, 0xe0d0), .driver_info = BTUSB_QCA_WCN6855 |BTUSB_WIDEBAND_SPEECH | BTUSB_VALID_LE_STATES }, + { USB_DEVICE(0x10ab, 0x9108), .driver_info = BTUSB_QCA_WCN6855 | +BTUSB_WIDEBAND_SPEECH | + BTUSB_VALID_LE_STATES }, + { USB_DEVICE(0x10ab, 0x9109), .driver_info = BTUSB_QCA_WCN6855 | +BTUSB_WIDEBAND_SPEECH | + BTUSB_VALID_LE_STATES }, + { USB_DEVICE(0x10ab, 0x9208), .driver_info = BTUSB_QCA_WCN6855 | +BTUSB_WIDEBAND_SPEECH | + BTUSB_VALID_LE_STATES }, + { USB_DEVICE(0x10ab, 0x9209), .driver_info = BTUSB_QCA_WCN6855 | +BTUSB_WIDEBAND_SPEECH | + BTUSB_VALID_LE_STATES }, + { USB_DEVICE(0x10ab, 0x9308), .driver_info = BTUSB_QCA_WCN6855 | +BTUSB_WIDEBAND_SPEECH | + BTUSB_VALID_LE_STATES }, + { USB_DEVICE(0x10ab, 0x9408), .driver_info = BTUSB_QCA_WCN6855 | +BTUSB_WIDEBAND_SPEECH | + BTUSB_VALID_LE_STATES }, + { USB_DEVICE(0x10ab, 0x9508), .driver_info = BTUSB_QCA_WCN6855 | +BTUSB_WIDEBAND_SPEECH | + BTUSB_VALID_LE_STATES }, + { USB_DEVICE(0x10ab, 0x9509), .driver_info = BTUSB_QCA_WCN6855 | +BTUSB_WIDEBAND_SPEECH | + BTUSB_VALID_LE_STATES }, + { USB_DEVICE(0x10ab, 0x9608), .driver_info = BTUSB_QCA_WCN6855 | +BTUSB_WIDEBAND_SPEECH | + BTUSB_VALID_LE_STATES }, + { USB_DEVICE(0x10ab, 0x9609), .driver_info = BTUSB_QCA_WCN6855 | +BTUSB_WIDEBAND_SPEECH | + BTUSB_VALID_LE_STATES }, + { USB_DEVICE(0x10ab, 0x9f09), .driver_info = BTUSB_QCA_WCN6855 | +BTUSB_WIDEBAND_SPEECH | + BTUSB_VALID_LE_STATES }, + { USB_DEVICE(0x04ca, 0x3022), .driver_info = BTUSB_QCA_WCN6855 | +BTUSB_WIDEBAND_SPEECH | + BTUSB_VALID_LE_STATES }, + { USB_DEVICE(0x0489, 0xe0c7), .driver_info = BTUSB_QCA_WCN6855 | +BTUSB_WIDEBAND_SPEECH | + BTUSB_VALID_LE_STATES }, + { USB_DEVICE(0x0489, 0xe0c9), .driver_info = BTUSB_QCA_WCN6855 | +BTUSB_WIDEBAND_SPEECH | + BTUSB_VALID_LE_STATES }, + { USB_DEVICE(0x0489, 0xe0ca), .driver_info = BTUSB_QCA_WCN6855 | +BTUSB_WIDEBAND_SPEECH | + BTUSB_VALID_LE_STATES }, + { USB_DEVICE(0x0489, 0xe0cb), .driver_info = BTUSB_QCA_WCN6855 | +BTUSB_WIDEBAND_SPEECH | + BTUSB_VALID_LE_STATES }, + { USB_DEVICE(0x0489, 0xe0ce), .driver_info = BTUSB_QCA_WCN6855 | +BTUSB_WIDEBAND_SPEECH | + BTUSB_VALID_LE_STATES }, + { USB_DEVICE(0x0489, 0xe0de), .driver_info = BTUSB_QCA_WCN6855 | +BTUSB_WIDEBAND_SPEECH | + BTUSB_VALID_LE_STATES }, + { USB_DEVICE(0x0489, 0xe0df), .driver_info = BTUSB_QCA_WCN6855 | +BTUSB_WIDEBAND_SPEECH | + BTUSB_VALID_LE_STATES }, + { USB_DEVICE(0x0489, 0xe0e1), .driver_info = BTUSB_QCA_WCN6855 | +BTUSB_WIDEBAND_SPEECH | + BTUSB_VALID_LE_STATES }, + { USB_DEVICE(0x0489, 0xe0ea), .driver_info = BTUSB_QCA_WCN6855 | +BTUSB_WIDEBAND_SPEECH | + BTUSB_VALID_LE_STATES }, + { USB_DEVICE(0x0489, 0xe0ec), .driver_info = BTUSB_QCA_WCN6855 | +BTUSB_WIDEBAND_SPEECH | + BTUSB_VALID_LE_STATES }, + { USB_DEVICE(0x04ca, 0x3023), .driver_info = BTUSB_QCA_WCN6855 | +BTUSB_WIDEBAND_SPEECH | + BTUSB_VALID_LE_STATES }, + { USB_DEVICE(0x04ca, 0x3024), .driver_info = BTUSB_QCA_WCN6855 | +BTUSB_WIDEBAND_SPEECH | + BTUSB_VALID_LE_STATES }, + { USB_DEVICE(0x04ca, 0x3a22), .driver_info = BTUSB_QCA_WCN6855 | +BTUSB_WIDEBAND_SPEECH | + BTUSB_VALID_LE_STATES }, + { USB_DEVICE(0x04ca, 0x3a24), .driver_info = BTUSB_QCA_WCN6855 | +BTUSB_WIDEBAND_SPEECH | + BTUSB_VALID_LE_STATES }, + { USB_DEVICE(0x04ca, 0x3a26), .driver_info = BTUSB_QCA_WCN6855 | +BTUSB_WIDEBAND_SPEECH | + BTUSB_VALID_LE_STATES }, + { USB_DEVICE(0x04ca, 0x3a27), .driver_info = BTUSB_QCA_WCN6855 | +BTUSB_WIDEBAND_SPEECH | + BTUSB_VALID_LE_STATES }, /* QCA WCN785x chipset */ { USB_DEVICE(0x0cf3, 0xe700), .driver_info = BTUSB_QCA_WCN6855 |
Greg Kroah-Hartman
maintainerPATCH 34/46 riscv: remove special treatment for the link order of head.o
In reply to Greg Kroah-HartmanFrom: Jisheng Zhang <[email protected]>
commit 2348e6bf44213c5f447ff698e43c089185241ed7 upstream.
arch/riscv/kernel/head.o does not need any special treatment - the only requirement is the ".head.text" section must be placed before the normal ".text" section.
The linker script does the right thing to do. The build system does not need to manipulate the link order of head.o.
--- scripts/head-object-list.txt | 1 - 1 file changed, 1 deletion(-)
scripts/head-object-list.txt +0 -1
@@ -39,7 +39,6 @@ arch/powerpc/kernel/entry_64.o arch/powerpc/kernel/fpu.o arch/powerpc/kernel/vector.o arch/powerpc/kernel/prom_init.o -arch/riscv/kernel/head.o arch/s390/kernel/head64.o arch/sh/kernel/head_32.o arch/sparc/kernel/head_32.o
Greg Kroah-Hartman
maintainerPATCH 7/46 clk: mxl: Add option to override gate clks
In reply to Greg Kroah-HartmanFrom: Rahul Tanwar <[email protected]>
[ Upstream commit a5d49bd369b8588c0ee9d4d0a2c0160558a3ab69 ]
In MxL's LGM SoC, gate clocks can be controlled either from CGU clk driver i.e. this driver or directly from power management driver/daemon. It is dependent on the power policy/profile requirements of the end product.
To support such use cases, provide option to override gate clks enable/disable by adding a flag GATE_CLK_HW which controls if these gate clks are controlled by HW i.e. this driver or overridden in order to allow it to be controlled by power profiles instead.
Stable-dep-of: 106ef3bda210 ("clk: mxl: Fix a clk entry by adding relevant flags")
--- drivers/clk/x86/clk-cgu.c | 16 +++++++++++++++- drivers/clk/x86/clk-cgu.h | 1 + 2 files changed, 16 insertions(+), 1 deletion(-)
drivers/clk/x86/clk-cgu.c +15 -1
@@ -354,8 +354,22 @@ int lgm_clk_register_branches(struct lgm_clk_provider *ctx, hw =lgm_clk_register_fixed_factor (ctx, list);break ;case CLK_TYPE_GATE : - hw =lgm_clk_register_gate (ctx, list); +if (list->gate_flags &GATE_CLK_HW ) { + hw =lgm_clk_register_gate (ctx, list); + }else { +/* +* GATE_CLKs can be controlled either from +* CGU clk driver i.e. this driver or directly +* from power management driver/daemon. It is +* dependent on the power policy/profile requirements +* of the end product. To override control of gate +* clks from this driver, provide NULL for this index +* of gate clk provider. +*/ + hw =NULL ; + }break ; +default :dev_err (ctx->dev,"invalid clk type\n" );return -EINVAL ;
drivers/clk/x86/clk-cgu.h +1 -0
@@ -197,6 +197,7 @@ struct lgm_clk_branch {/* clock flags definition */ #define CLOCK_FLAG_VAL_INIT BIT(16)#define MUX_CLK_SW BIT(17) +#define GATE_CLK_HW BIT(18)#define LGM_MUX (_id, _name, _pdata, _f, _reg, \ _shift, _width, _cf, _v) \
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 8/46 clk: mxl: Fix a clk entry by adding relevant flags
In reply to Greg Kroah-HartmanFrom: Rahul Tanwar <[email protected]>
[ Upstream commit 106ef3bda21006fe37b62c85931230a6355d78d3 ]
One of the clock entry "dcl" clk has some HW limitations. One is that its rate can only by changed by changing its parent clk's rate & two is that HW does not support enable/disable for this clk.
Handle above two limitations by adding relevant flags. Add standard flag CLK_SET_RATE_PARENT to handle rate change and add driver internal flag DIV_CLK_NO_MASK to handle enable/disable.
--- drivers/clk/x86/clk-cgu.c | 5 +++-- drivers/clk/x86/clk-cgu.h | 1 + drivers/clk/x86/clk-lgm.c | 4 ++-- 3 files changed, 6 insertions(+), 4 deletions(-)
drivers/clk/x86/clk-cgu.c +3 -2
@@ -164,8 +164,9 @@ static int lgm_clk_divider_enable_disable(struct clk_hw *hw, int enable) {struct lgm_clk_divider *div =to_lgm_clk_divider (hw); -lgm_set_clk_val (div->membase, div->reg, div->shift_gate, - div->width_gate, enable); +if (div->flags !=DIV_CLK_NO_MASK ) +lgm_set_clk_val (div->membase, div->reg, div->shift_gate, + div->width_gate, enable);return 0 ; }
drivers/clk/x86/clk-cgu.h +1 -0
@@ -198,6 +198,7 @@ struct lgm_clk_branch {#define CLOCK_FLAG_VAL_INIT BIT(16)#define MUX_CLK_SW BIT(17)#define GATE_CLK_HW BIT(18) +#define DIV_CLK_NO_MASK BIT(19)#define LGM_MUX (_id, _name, _pdata, _f, _reg, \ _shift, _width, _cf, _v) \
drivers/clk/x86/clk-lgm.c +2 -2
@@ -255,8 +255,8 @@ static const struct lgm_clk_branch lgm_branch_clks[] = {LGM_FIXED (LGM_CLK_SLIC ,"slic" ,NULL ,0 ,CGU_IF_CLK1 ,8 ,2 ,CLOCK_FLAG_VAL_INIT ,8192000 ,2 ),LGM_FIXED (LGM_CLK_DOCSIS ,"v_docsis" ,NULL ,0 ,0 ,0 ,0 ,0 ,16000000 ,0 ), -LGM_DIV (LGM_CLK_DCL ,"dcl" ,"v_ifclk" ,0 ,CGU_PCMCR , -25 ,3 ,0 ,0 ,0 ,0 , dcl_div), +LGM_DIV (LGM_CLK_DCL ,"dcl" ,"v_ifclk" ,CLK_SET_RATE_PARENT ,CGU_PCMCR , +25 ,3 ,0 ,0 ,DIV_CLK_NO_MASK ,0 , dcl_div),LGM_MUX (LGM_CLK_PCM ,"pcm" , pcm_p,0 ,CGU_C55_PCMCR ,0 ,1 ,CLK_MUX_ROUND_CLOSEST ,0 ), LGM_FIXED_FACTOR(LGM_CLK_DDR_PHY, "ddr_phy", "ddr",
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 9/46 powerpc: dts: t208x: Mark MAC1 and MAC2 as 10G
In reply to Greg Kroah-HartmanFrom: Sean Anderson <[email protected]>
[ Upstream commit 36926a7d70c2d462fca1ed85bfee000d17fd8662 ]
On the T208X SoCs, MAC1 and MAC2 support XGMII. Add some new MAC dtsi fragments, and mark the QMAN ports as 10G.
--- .../boot/dts/fsl/qoriq-fman3-0-10g-2.dtsi | 44 +++++++++++++++++++ .../boot/dts/fsl/qoriq-fman3-0-10g-3.dtsi | 44 +++++++++++++++++++ arch/powerpc/boot/dts/fsl/t2081si-post.dtsi | 4 +- 3 files changed, 90 insertions(+), 2 deletions(-) create mode 100644 arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-2.dtsi create mode 100644 arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-3.dtsi
arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-2.dtsi new file +44 -0
@@ -0,0 +1,44 @@ +// SPDX-License-Identifier: BSD-3-Clause OR GPL-2.0-or-later +/* + * QorIQ FMan v3 10g port #2 device tree stub [ controller @ offset 0x400000 ] + * + * Copyright 2022 Sean Anderson <[email protected]> + * Copyright 2012 - 2015 Freescale Semiconductor Inc. + */ + +fman@400000 { + fman0_rx_0x08: port@88000 { + cell-index = <0x8>; + compatible = "fsl,fman-v3-port-rx"; + reg = <0x88000 0x1000>; + fsl,fman-10g-port; + }; + + fman0_tx_0x28: port@a8000 { + cell-index = <0x28>; + compatible = "fsl,fman-v3-port-tx"; + reg = <0xa8000 0x1000>; + fsl,fman-10g-port; + }; + + ethernet@e0000 { + cell-index = <0>; + compatible = "fsl,fman-memac"; + reg = <0xe0000 0x1000>; + fsl,fman-ports = <&fman0_rx_0x08 &fman0_tx_0x28>; + ptp-timer = <&ptp_timer0>; + pcsphy-handle = <&pcsphy0>; + }; + + mdio@e1000 { + #address-cells = <1>; + #size-cells = <0>; + compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio"; + reg = <0xe1000 0x1000>; + fsl,erratum-a011043; /* must ignore read errors */ + + pcsphy0: ethernet-phy@0 { + reg = <0x0>; + }; + }; +};
arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-3.dtsi new file +44 -0
44 lines not on this page · raw message
arch/powerpc/boot/dts/fsl/t2081si-post.dtsi +2 -2
@@ -609,8 +609,8 @@ /include/ "qoriq-bman1.dtsi" /include/ "qoriq-fman3-0.dtsi" -/include/ "qoriq-fman3-0-1g-0.dtsi" -/include/ "qoriq-fman3-0-1g-1.dtsi" +/include/ "qoriq-fman3-0-10g-2.dtsi" +/include/ "qoriq-fman3-0-10g-3.dtsi" /include/ "qoriq-fman3-0-1g-2.dtsi" /include/ "qoriq-fman3-0-1g-3.dtsi" /include/ "qoriq-fman3-0-1g-4.dtsi"
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 10/46 clk: mxl: syscon_node_to_regmap() returns error pointers
In reply to Greg Kroah-HartmanFrom: Rahul Tanwar <[email protected]>
[ Upstream commit 7256d1f4618b40792d1e9b9b6cb1406a13cad2dd ]
Commit 036177310bac ("clk: mxl: Switch from direct readl/writel based IO to regmap based IO") introduced code resulting in below warning issued by the smatch static checker.
drivers/clk/x86/clk-lgm.c:441 lgm_cgu_probe() warn: passing zero to 'PTR_ERR'
Fix the warning by replacing incorrect IS_ERR_OR_NULL() with IS_ERR().
--- drivers/clk/x86/clk-lgm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/x86/clk-lgm.c +1 -1
@@ -436,7 +436,7 @@ static int lgm_cgu_probe(struct platform_device *pdev) ctx->clk_data.num =CLK_NR_CLKS ; ctx->membase =syscon_node_to_regmap (np); -if (IS_ERR_OR_NULL (ctx->membase)) { +if (IS_ERR (ctx->membase)) {dev_err (dev,"Failed to get clk CGU iomem\n" );return PTR_ERR (ctx->membase); }
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 11/46 sched/psi: Stop relying on timer_pending() for poll_work rescheduling
In reply to Greg Kroah-HartmanFrom: Suren Baghdasaryan <[email protected]>
[ Upstream commit 710ffe671e014d5ccbcff225130a178b088ef090 ]
Psi polling mechanism is trying to minimize the number of wakeups to run psi_poll_work and is currently relying on timer_pending() to detect when this work is already scheduled. This provides a window of opportunity for psi_group_change to schedule an immediate psi_poll_work after poll_timer_fn got called but before psi_poll_work could reschedule itself. Below is the depiction of this entire window:
poll_timer_fn
wake_up_interruptible(&group->poll_wait);
psi_poll_worker
wait_event_interruptible(group->poll_wait, ...)
psi_poll_work
psi_schedule_poll_work
if (timer_pending(&group->poll_timer)) return;
...
mod_timer(&group->poll_timer, jiffies + delay);Prior to 461daba06bdc we used to rely on poll_scheduled atomic which was reset and set back inside psi_poll_work and therefore this race window was much smaller.
The larger window causes increased number of wakeups and our partners report visible power regression of ~10mA after applying 461daba06bdc. Bring back the poll_scheduled atomic and make this race window even narrower by resetting poll_scheduled only when we reach polling expiration time. This does not completely eliminate the possibility of extra wakeups caused by a race with psi_group_change however it will limit it to the worst case scenario of one extra wakeup per every tracking window (0.5s in the worst case).
This patch also ensures correct ordering between clearing poll_scheduled flag and obtaining changed_states using memory barrier. Correct ordering between updating changed_states and setting poll_scheduled is ensured by atomic_xchg operation.
By tracing the number of immediate rescheduling attempts performed by psi_group_change and the number of these attempts being blocked due to psi monitor being already active, we can assess the effects of this change:
Before the patch:
Run#1 Run#2 Run#3 Immediate reschedules attempted: 684365 1385156 1261240 Immediate reschedules blocked: 682846 1381654 1258682 Immediate reschedules (delta): 1519 3502 2558 Immediate reschedules (% of attempted): 0.22% 0.25% 0.20%
After the patch:
Run#1 Run#2 Run#3 Immediate reschedules attempted: 882244 770298 426218 Immediate reschedules blocked: 881996 769796 426074 Immediate reschedules (delta): 248 502 144 Immediate reschedules (% of attempted): 0.03% 0.07% 0.03%
The number of non-blocked immediate reschedules dropped from 0.22-0.25% to 0.03-0.07%. The drop is attributed to the decrease in the race window size and the fact that we allow this race only when psi monitors reach polling window expiration time.
--- include/linux/psi_types.h | 1 + kernel/sched/psi.c | 62 ++++++++++++++++++++++++++++++++------- 2 files changed, 53 insertions(+), 10 deletions(-)
include/linux/psi_types.h +1 -0
@@ -177,6 +177,7 @@ struct psi_group {struct timer_list poll_timer;wait_queue_head_t poll_wait;atomic_t poll_wakeup; +atomic_t poll_scheduled;/* Protects data used by the monitor */ struct mutex trigger_lock;
kernel/sched/psi.c +52 -10
121 lines not on this page · raw message
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 12/46 random: always mix cycle counter in add_latent_entropy()
In reply to Greg Kroah-HartmanFrom: Jason A. Donenfeld <[email protected]>
[ Upstream commit d7bf7f3b813e3755226bcb5114ad2ac477514ebf ]
add_latent_entropy() is called every time a process forks, in kernel_clone(). This in turn calls add_device_randomness() using the latent entropy global state. add_device_randomness() does two things:
2) Mixes into the input pool the latent entropy argument passed; and
1) Mixes in a cycle counter, a sort of measurement of when the event took place, the high precision bits of which are presumably difficult to predict.
(2) is impossible without CONFIG_GCC_PLUGIN_LATENT_ENTROPY=y. But (1) is always possible. However, currently CONFIG_GCC_PLUGIN_LATENT_ENTROPY=n disables both (1) and (2), instead of just (2).
This commit causes the CONFIG_GCC_PLUGIN_LATENT_ENTROPY=n case to still do (1) by passing NULL (len 0) to add_device_randomness() when add_latent_ entropy() is called.
--- include/linux/random.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
include/linux/random.h +3 -3
@@ -19,14 +19,14 @@ void add_input_randomness(unsigned int type, unsigned int code, void add_interrupt_randomness(int irq) __latent_entropy;void add_hwgenerator_randomness (const void *buf,size_t len,size_t entropy); -#if defined(LATENT_ENTROPY_PLUGIN ) && !defined(__CHECKER__)static inline void add_latent_entropy (void ) { +#if defined(LATENT_ENTROPY_PLUGIN ) && !defined(__CHECKER__)add_device_randomness ((const void *)&latent_entropy,sizeof (latent_entropy)); -}#else -static inline void add_latent_entropy (void ) { } +add_device_randomness (NULL ,0 );#endif +}#if IS_ENABLED (CONFIG_VMGENID )void add_vmfork_randomness (const void *unique_vm_id,size_t len);
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 3/46 wifi: rtl8xxxu: gen2: Turn on the rate control
In reply to Greg Kroah-HartmanFrom: Bitterblue Smith <[email protected]>
[ Upstream commit 791082ec0ab843e0be07c8ce3678e4c2afd2e33d ]
Re-enable the function rtl8xxxu_gen2_report_connect.
It informs the firmware when connecting to a network. This makes the firmware enable the rate control, which makes the upload faster.
It also informs the firmware when disconnecting from a network. In the past this made reconnecting impossible because it was sending the auth on queue 0x7 (TXDESC_QUEUE_VO) instead of queue 0x12 (TXDESC_QUEUE_MGNT):
wlp0s20f0u3: send auth to 90:55:de:__:__:__ (try 1/3)
wlp0s20f0u3: send auth to 90:55:de:__:__:__ (try 2/3)
wlp0s20f0u3: send auth to 90:55:de:__:__:__ (try 3/3)
wlp0s20f0u3: authentication with 90:55:de:__:__:__ timed out
Probably the firmware disables the unnecessary TX queues when it knows it's disconnected.
However, this was fixed in commit edd5747aa12e ("wifi: rtl8xxxu: Fix skb misuse in TX queue selection").
--- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +2 -6
@@ -4389,12 +4389,9 @@ void rtl8xxxu_gen1_report_connect(struct rtl8xxxu_priv *priv,void rtl8xxxu_gen2_report_connect (struct rtl8xxxu_priv *priv,u8 macid,bool connect) { -#ifdef RTL8XXXU_GEN2_REPORT_CONNECT /* -* Barry Day reports this causes issues with 8192eu and 8723bu -* devices reconnecting. The reason for this is unclear, but -* until it is better understood, leave the code in place but -* disabled, so it is not lost. +* The firmware turns on the rate control when it knows it's +* connected to a network. */ struct h2c_cmd h2c;
@@ -4407,7 +4404,6 @@ void rtl8xxxu_gen2_report_connect(struct rtl8xxxu_priv *priv, h2c.media_status_rpt.parm &= ~BIT (0 );rtl8xxxu_gen2_h2c_cmd (priv, &h2c,sizeof (h2c.media_status_rpt)); -#endif }void rtl8xxxu_gen1_init_aggregation (struct rtl8xxxu_priv *priv)
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 36/46 arch: fix broken BuildID for arm64 and riscv
In reply to Greg Kroah-HartmanFrom: Masahiro Yamada <[email protected]>
commit 99cb0d917ffa1ab628bb67364ca9b162c07699b1 upstream.
Dennis Gilmore reports that the BuildID is missing in the arm64 vmlinux since commit 994b7ac1697b ("arm64: remove special treatment for the link order of head.o").
The issue is that the type of .notes section, which contains the BuildID, changed from NOTES to PROGBITS.
Ard Biesheuvel figured out that whichever object gets linked first gets to decide the type of a section. The PROGBITS type is the result of the compiler emitting .note.GNU-stack as PROGBITS rather than NOTE.
While Ard provided a fix for arm64, I want to fix this globally because the same issue is happening on riscv since commit 2348e6bf4421 ("riscv:
remove special treatment for the link order of head.o"). This problem will happen in general for other architectures if they start to drop unneeded entries from scripts/head-object-list.txt.
Discard .note.GNU-stack in include/asm-generic/vmlinux.lds.h.
--- include/asm-generic/vmlinux.lds.h | 5 +++++ 1 file changed, 5 insertions(+)
include/asm-generic/vmlinux.lds.h +5 -0
@@ -929,7 +929,12 @@#define PRINTK_INDEX #endif +/* +* Discard .note.GNU-stack, which is emitted as PROGBITS by the compiler. +* Otherwise, the type of .notes section would become PROGBITS instead of NOTES. +*/ #define NOTES \ + /DISCARD/ : { *(.note.GNU-stack) } \ .notes : AT(ADDR(.notes) - LOAD_OFFSET) { \ __start_notes = .; \ KEEP(*(.note.*)) \
Greg Kroah-Hartman
maintainerPATCH 45/46 ext4: Fix function prototype mismatch for ext4_feat_ktype
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
commit 118901ad1f25d2334255b3d50512fa20591531cd upstream.
With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), indirect call targets are validated against the expected function pointer prototype to make sure the call target is valid to help mitigate ROP attacks. If they are not identical, there is a failure at run time, which manifests as either a kernel panic or thread getting killed.
ext4_feat_ktype was setting the "release" handler to "kfree", which doesn't have a matching function prototype. Add a simple wrapper with the correct prototype.
This was found as a result of Clang's new -Wcast-function-type-strict flag, which is more sensitive than the simpler -Wcast-function-type, which only checks for type width mismatches.
Note that this code is only reached when ext4 is a loadable module and it is being unloaded:
CFI failure at kobject_put+0xbb/0x1b0 (target: kfree+0x0/0x180; expected type: 0x7c4aa698)
...
RIP: 0010:kobject_put+0xbb/0x1b0 ... Call Trace: <TASK> ext4_exit_sysfs+0x14/0x60 [ext4] cleanup_module+0x67/0xedb [ext4]
--- fs/ext4/sysfs.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
fs/ext4/sysfs.c +6 -1
@@ -491,6 +491,11 @@ static void ext4_sb_release(struct kobjecomplete (&sbi->s_kobj_unregister); } +static void ext4_feat_release (struct kobject *kobj) +{ +kfree (kobj); +} +static const struct sysfs_ops ext4_attr_ops = { .show = ext4_attr_show, .store = ext4_attr_store,
@@ -505,7 +510,7 @@ static struct kobj_type ext4_sb_ktype =static struct kobj_type ext4_feat_ktype = { .default_groups = ext4_feat_groups, .sysfs_ops = &ext4_attr_ops, - .release = (void (*)(struct kobject *))kfree, + .release = ext4_feat_release, };void ext4_notify_error_sysfs (struct ext4_sb_info *sbi)
Greg Kroah-Hartman
maintainerPATCH 46/46 randstruct: disable Clang 15 support
In reply to Greg Kroah-HartmanFrom: Eric Biggers <[email protected]>
commit 78f7a3fd6dc66cb788c21d7705977ed13c879351 upstream.
The randstruct support released in Clang 15 is unsafe to use due to a bug that can cause miscompilations: "-frandomize-layout-seed inconsistently randomizes all-function-pointers structs"
(https://github.com/llvm/llvm-project/issues/60349). It has been fixed on the Clang 16 release branch, so add a Clang version check.
--- security/Kconfig.hardening | 3 +++ 1 file changed, 3 insertions(+)
security/Kconfig.hardening +3 -0
@@ -281,6 +281,9 @@ endmenu config CC_HAS_RANDSTRUCT def_bool $(cc-option,-frandomize-layout-seed-file=/dev/null) + # Randstruct was first added in Clang 15, but it isn't safe to use until + # Clang 16 due to https://github.com/llvm/llvm-project/issues/60349 + depends on !CC_IS_CLANG || CLANG_VERSION >= 160000 choice prompt "Randomize layout of sensitive kernel structures"
Greg Kroah-Hartman
maintainerPATCH 37/46 powerpc/vmlinux.lds: Define RUNTIME_DISCARD_EXIT
In reply to Greg Kroah-HartmanFrom: Michael Ellerman <[email protected]>
commit 4b9880dbf3bdba3a7c56445137c3d0e30aaa0a40 upstream.
The powerpc linker script explicitly includes .exit.text, because otherwise the link fails due to references from __bug_table and __ex_table. The code is freed (discarded) at runtime along with .init.text and data.
That has worked in the past despite powerpc not defining RUNTIME_DISCARD_EXIT because DISCARDS appears late in the powerpc linker script (line 410), and the explicit inclusion of .exit.text earlier (line 280) supersedes the discard.
However commit 99cb0d917ffa ("arch: fix broken BuildID for arm64 and riscv") introduced an earlier use of DISCARD as part of the RO_DATA macro (line 136). With binutils < 2.36 that causes the DISCARD directives later in the script to be applied earlier [1], causing .exit.text to actually be discarded at link time, leading to build errors:
'.exit.text' referenced in section '__bug_table' of crypto/algboss.o: defined in discarded section '.exit.text' of crypto/algboss.o
'.exit.text' referenced in section '__ex_table' of drivers/nvdimm/core.o: defined in discarded section '.exit.text' of drivers/nvdimm/core.o
Fix it by defining RUNTIME_DISCARD_EXIT, which causes the generic DISCARDS macro to not include .exit.text at all.
1: https://lore.kernel.org/lkml/[email protected]/
--- arch/powerpc/kernel/vmlinux.lds.S | 1 + 1 file changed, 1 insertion(+)
arch/powerpc/kernel/vmlinux.lds.S +1 -0
@@ -8,6 +8,7 @@ #define BSS_FIRST_SECTIONS *(.bss.prominit) #define EMITS_PT_NOTE #define RO_EXCEPTION_TABLE_ALIGN 0 +#define RUNTIME_DISCARD_EXIT #define SOFT_MASK_TABLE(align) \ . = ALIGN(align); \
Greg Kroah-Hartman
maintainerPATCH 38/46 powerpc/vmlinux.lds: Dont discard .rela* for relocatable builds
In reply to Greg Kroah-HartmanFrom: Michael Ellerman <[email protected]>
commit 07b050f9290ee012a407a0f64151db902a1520f5 upstream.
Relocatable kernels must not discard relocations, they need to be processed at runtime. As such they are included for CONFIG_RELOCATABLE builds in the powerpc linker script (line 340).
However they are also unconditionally discarded later in the script (line 414). Previously that worked because the earlier inclusion superseded the discard.
However commit 99cb0d917ffa ("arch: fix broken BuildID for arm64 and riscv") introduced an earlier use of DISCARD as part of the RO_DATA macro (line 137). With binutils < 2.36 that causes the DISCARD directives later in the script to be applied earlier, causing .rela* to actually be discarded at link time, leading to build warnings and a kernel that doesn't boot:
ld: warning: discarding dynamic section .rela.init.rodata
Fix it by conditionally discarding .rela* only when CONFIG_RELOCATABLE is disabled.
--- arch/powerpc/kernel/vmlinux.lds.S | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
arch/powerpc/kernel/vmlinux.lds.S +4 -1
@@ -411,9 +411,12 @@ SECTIONS DISCARDS /DISCARD/ : { *(*.EMB.apuinfo) - *(.glink .iplt .plt .rela* .comment) + *(.glink .iplt .plt .comment) *(.gnu.version*) *(.gnu.attributes) *(.eh_frame) +#ifndef CONFIG_RELOCATABLE + *(.rela*) +#endif } }
Greg Kroah-Hartman
maintainerPATCH 39/46 s390: define RUNTIME_DISCARD_EXIT to fix link error with GNU ld < 2.36
In reply to Greg Kroah-HartmanFrom: Masahiro Yamada <[email protected]>
commit a494398bde273143c2352dd373cad8211f7d94b2 upstream.
Nathan Chancellor reports that the s390 vmlinux fails to link with GNU ld < 2.36 since commit 99cb0d917ffa ("arch: fix broken BuildID for arm64 and riscv").
It happens for defconfig, or more specifically for CONFIG_EXPOLINE=y.
$ s390x-linux-gnu-ld --version | head -n1 GNU ld (GNU Binutils for Debian) 2.35.2 $ make -s ARCH=s390 CROSS_COMPILE=s390x-linux-gnu- allnoconfig $ ./scripts/config -e CONFIG_EXPOLINE $ make -s ARCH=s390 CROSS_COMPILE=s390x-linux-gnu- olddefconfig $ make -s ARCH=s390 CROSS_COMPILE=s390x-linux-gnu- `.exit.text' referenced in section `.s390_return_reg' of drivers/base/dd.o: defined in discarded section `.exit.text' of drivers/base/dd.o make[1]: *** [scripts/Makefile.vmlinux:34: vmlinux] Error 1 make: *** [Makefile:1252: vmlinux] Error 2
arch/s390/kernel/vmlinux.lds.S wants to keep EXIT_TEXT:
.exit.text : {
EXIT_TEXT
}But, at the same time, EXIT_TEXT is thrown away by DISCARD because s390 does not define RUNTIME_DISCARD_EXIT.
I still do not understand why the latter wins after 99cb0d917ffa, but defining RUNTIME_DISCARD_EXIT seems correct because the comment line in arch/s390/kernel/vmlinux.lds.S says:
/*
* .exit.text is discarded at runtime, not link time,
* to deal with references from __bug_table */
Nathan also found that binutils commit 21401fc7bf67 ("Duplicate output sections in scripts") cured this issue, so we cannot reproduce it with binutils 2.36+, but it is better to not rely on it.
--- arch/s390/kernel/vmlinux.lds.S | 2 ++ 1 file changed, 2 insertions(+)
arch/s390/kernel/vmlinux.lds.S +2 -0
@@ -17,6 +17,8 @@ /* Handle ro_after_init data on our own. */ #define RO_AFTER_INIT_DATA +#define RUNTIME_DISCARD_EXIT + #define EMITS_PT_NOTE #include <asm-generic/vmlinux.lds.h>
Greg Kroah-Hartman
maintainerPATCH 40/46 sh: define RUNTIME_DISCARD_EXIT
In reply to Greg Kroah-HartmanFrom: Tom Saeger <[email protected]>
commit c1c551bebf928889e7a8fef7415b44f9a64975f4 upstream.
sh vmlinux fails to link with GNU ld < 2.40 (likely < 2.36) since commit 99cb0d917ffa ("arch: fix broken BuildID for arm64 and riscv").
This is similar to fixes for powerpc and s390:
commit 4b9880dbf3bd ("powerpc/vmlinux.lds: Define RUNTIME_DISCARD_EXIT"). commit a494398bde27 ("s390: define RUNTIME_DISCARD_EXIT to fix link error with GNU ld < 2.36").
$ sh4-linux-gnu-ld --version | head -n1 GNU ld (GNU Binutils for Debian) 2.35.2
$ make ARCH=sh CROSS_COMPILE=sh4-linux-gnu- microdev_defconfig $ make ARCH=sh CROSS_COMPILE=sh4-linux-gnu-
.exit.text' referenced in section __bug_table' of crypto/algboss.o:
defined in discarded section .exit.text' of crypto/algboss.o .exit.text' referenced in section __bug_table' of drivers/char/hw_random/core.o: defined in discarded section .exit.text' of drivers/char/hw_random/core.o
make[2]: *** [scripts/Makefile.vmlinux:34: vmlinux] Error 1 make[1]: *** [Makefile:1252: vmlinux] Error 2
arch/sh/kernel/vmlinux.lds.S keeps EXIT_TEXT:
/*
* .exit.text is discarded at runtime, not link time, to deal with
* references from __bug_table
*/
.exit.text : AT(ADDR(.exit.text)) { EXIT_TEXT }However, EXIT_TEXT is thrown away by DISCARD(include/asm-generic/vmlinux.lds.h) because sh does not define RUNTIME_DISCARD_EXIT.
GNU ld 2.40 does not have this issue and builds fine.
This corresponds with Masahiro's comments in a494398bde27:
"Nathan [Chancellor] also found that binutils
commit 21401fc7bf67 ("Duplicate output sections in scripts") cured this issue, so we cannot reproduce it with binutils 2.36+, but it is better to not rely on it."
--- arch/sh/kernel/vmlinux.lds.S | 1 + 1 file changed, 1 insertion(+)
arch/sh/kernel/vmlinux.lds.S +1 -0
@@ -4,6 +4,7 @@ * Written by Niibe Yutaka and Paul Mundt */ OUTPUT_ARCH(sh) +#define RUNTIME_DISCARD_EXIT #include <asm/thread_info.h> #include <asm/cache.h> #include <asm/vmlinux.lds.h>
Greg Kroah-Hartman
maintainerPATCH 41/46 wifi: mwifiex: Add missing compatible string for SD8787
In reply to Greg Kroah-HartmanFrom: Lukas Wunner <[email protected]>
commit 36dd7a4c6226133b0b7aa92b8e604e688d958d0c upstream.
Commit e3fffc1f0b47 ("devicetree: document new marvell-8xxx and pwrseq-sd8787 options") documented a compatible string for SD8787 in the devicetree bindings, but neglected to add it to the mwifiex driver.
--- drivers/net/wireless/marvell/mwifiex/sdio.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/marvell/mwifiex/sdio.c +1 -0
@@ -480,6 +480,7 @@ static struct memory_type_mapping mem_ty };static const struct of_device_id mwifiex_sdio_of_match_table[] = { + { .compatible ="marvell,sd8787" }, { .compatible ="marvell,sd8897" }, { .compatible ="marvell,sd8997" }, { }
Greg Kroah-Hartman
maintainerPATCH 42/46 audit: update the mailing list in MAINTAINERS
In reply to Greg Kroah-HartmanFrom: Paul Moore <[email protected]>
commit 6c6cd913accd77008f74a1a9d57b816db3651daa upstream.
We've moved the upstream Linux Kernel audit subsystem discussions to a new mailing list, this patch updates the MAINTAINERS info with the new list address.
Marking this for stable inclusion to help speed uptake of the new list across all of the supported kernel releases. This is a doc only patch so the risk should be close to nil.
--- MAINTAINERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
MAINTAINERS +1 -1
@@ -3444,7 +3444,7 @@ F: drivers/net/ieee802154/atusb.h AUDIT SUBSYSTEM M: Paul Moore <[email protected]> M: Eric Paris <[email protected]> -L: [email protected] (moderated for non-subscribers) +L: [email protected] S: Supported W: https://github.com/linux-audit T: git git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit.git
Greg Kroah-Hartman
maintainerPATCH 43/46 platform/x86/amd/pmf: Add depends on CONFIG_POWER_SUPPLY
In reply to Greg Kroah-HartmanFrom: Shyam Sundar S K <[email protected]>
commit 3004e8d2a0a98bbf4223ae146464fadbff68bf78 upstream.
It is reported that amd_pmf driver is missing "depends on" for CONFIG_POWER_SUPPLY causing the following build error.
ld: drivers/platform/x86/amd/pmf/core.o: in function `amd_pmf_remove':
core.c:(.text+0x10): undefined reference to `power_supply_unreg_notifier'
ld: drivers/platform/x86/amd/pmf/core.o: in function `amd_pmf_probe':
core.c:(.text+0x38f): undefined reference to `power_supply_reg_notifier' make[1]: *** [scripts/Makefile.vmlinux:34: vmlinux] Error 1
make: *** [Makefile:1248: vmlinux] Error 2
Add this to the Kconfig file.
--- drivers/platform/x86/amd/pmf/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/platform/x86/amd/pmf/Kconfig +1 -0
@@ -6,6 +6,7 @@ config AMD_PMF tristate "AMD Platform Management Framework" depends on ACPI && PCI + depends on POWER_SUPPLY select ACPI_PLATFORM_PROFILE help This driver provides support for the AMD Platform Management Framework.
Greg Kroah-Hartman
maintainerPATCH 44/46 platform/x86: nvidia-wmi-ec-backlight: Add force module parameter
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit 0d9bdd8a550170306c2021b8d6766c5343b870c2 upstream.
On some Lenovo Legion models, the backlight might be driven by either one of nvidia_wmi_ec_backlight or amdgpu_bl0 at different times.
When the Nvidia WMI EC backlight interface reports the backlight is controlled by the EC, the current backlight handling only registers nvidia_wmi_ec_backlight (and registers no other backlight interfaces).
This hides (never registers) the amdgpu_bl0 interface, where as prior to 6.1.4 users would have both nvidia_wmi_ec_backlight and amdgpu_bl0 and could work around things in userspace.
Add a force module parameter which can be used with acpi_backlight=native to restore the old behavior as a workound (for now) by passing:
"acpi_backlight=native nvidia-wmi-ec-backlight.force=1"
--- drivers/platform/x86/nvidia-wmi-ec-backlight.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/platform/x86/nvidia-wmi-ec-backlight.c +5 -1
@@ -12,6 +12,10 @@#include <linux/wmi.h> #include <acpi/video.h> +static bool force; +module_param (force, bool,0444 ); +MODULE_PARM_DESC (force,"Force loading (disable acpi_backlight=xxx checks" ); +/** * wmi_brightness_notify() - helper function for calling WMI-wrapped ACPI method * @w: Pointer to the struct wmi_device identified by %WMI_BRIGHTNESS_GUID
@@ -91,7 +95,7 @@ static int nvidia_wmi_ec_backlight_probeint ret;/* drivers/acpi/video_detect.c also checks that SOURCE == EC */ -if (acpi_video_get_backlight_type () != acpi_backlight_nvidia_wmi_ec) +if (!force &&acpi_video_get_backlight_type () != acpi_backlight_nvidia_wmi_ec)return -ENODEV ;/*
Greg Kroah-Hartman
maintainerPATCH 35/46 arm64: remove special treatment for the link order of head.o
In reply to Greg Kroah-HartmanFrom: Masahiro Yamada <[email protected]>
commit 994b7ac1697b4581b7726d2ac64321e3c840229b upstream.
In the previous discussion (see the Link tag), Ard pointed out that arm/arm64/kernel/head.o does not need any special treatment - the only piece that must appear right at the start of the binary image is the image header which is emitted into .head.text.
The linker script does the right thing to do. The build system does not need to manipulate the link order of head.o.
--- scripts/head-object-list.txt | 1 - 1 file changed, 1 deletion(-)
scripts/head-object-list.txt +0 -1
@@ -15,7 +15,6 @@ arch/alpha/kernel/head.o arch/arc/kernel/head.o arch/arm/kernel/head-nommu.o arch/arm/kernel/head.o -arch/arm64/kernel/head.o arch/csky/kernel/head.o arch/hexagon/kernel/head.o arch/ia64/kernel/head.o
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.14 release. There are 46 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 25 Feb 2023 13:04:16 +0000. Anything received after that time might be too late.
Quoted 8 lines
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.14-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.Dave Hansen <[email protected]>
uaccess: Add speculation barrier tocopy_from_user()
This breaks the build for me on RISC-V, you need to take f3dd0c53370e ("bpf: add missing header file include") from Linus' tree. It was broken in mainline too, so it is probably broken everywhere you backported it :(
Thanks,
Conor.
Greg Kroah-Hartman
maintainerQuoted 15 lines · Conor Dooley
Quoted 13 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.14 release. There are 46 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 25 Feb 2023 13:04:16 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.14-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.
Quoted 7 lines
Quoted 2 lines
Dave Hansen <[email protected]>
uaccess: Add speculation barrier tocopy_from_user()This breaks the build for me on RISC-V, you need to take
f3dd0c53370e("bpf: add missing header file include") from Linus' tree. It was broken in mainline too, so it is probably broken everywhere you backported it :(
Already fixed up and in -rc2.
thanks,
greg k-h
Quoted 16 lines · Conor Dooley
Quoted 13 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.14 release. There are 46 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 25 Feb 2023 13:04:16 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.14-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.
Quoted 7 lines
Quoted 2 lines
Dave Hansen <[email protected]>
uaccess: Add speculation barrier tocopy_from_user()This breaks the build for me on RISC-V, you need to take
f3dd0c53370e("bpf: add missing header file include") from Linus' tree. It was broken in mainline too, so it is probably broken everywhere you backported it :(
Thanks for your report.
I do see arm and arm64 build breaks with following build warnings / errors:
kernel/bpf/core.c: In function '___bpf_prog_run':kernel/bpf/core.c:1911:17: error: implicit declaration of function 'barrier_nospec' [-Werror=implicit-function-declaration]
1911 | barrier_nospec();
| ^~~~~~~~~~~~~~cc1: some warnings being treated as errors
Quoted 4 lines
Thanks,
Conor.
- Naresh
--
Linaro LKFT
https://lkft.linaro.org
Quoted 19 lines · Greg Kroah-Hartman
Quoted 18 lines · Conor Dooley
Quoted 16 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.14 release. There are 46 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 25 Feb 2023 13:04:16 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.14-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.Dave Hansen <[email protected]>
uaccess: Add speculation barrier tocopy_from_user()
Quoted 6 lines
Quoted 4 lines
This breaks the build for me on RISC-V, you need to take
f3dd0c53370e("bpf: add missing header file include") from Linus' tree. It was broken in mainline too, so it is probably broken everywhere you backported it :(Already fixed up and in -rc2.
Cool, I'll go restart my CI jobs then. Thanks.
Greg Kroah-Hartman
maintainerQuoted 27 lines · Naresh Kamboju
Quoted 16 lines · Conor Dooley
Quoted 13 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.14 release. There are 46 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 25 Feb 2023 13:04:16 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.14-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.Quoted 7 lines
Quoted 2 lines
Dave Hansen <[email protected]>
uaccess: Add speculation barrier tocopy_from_user()This breaks the build for me on RISC-V, you need to take
f3dd0c53370e("bpf: add missing header file include") from Linus' tree. It was broken in mainline too, so it is probably broken everywhere you backported it :(Thanks for your report.
Quoted 8 lines
I do see arm and arm64 build breaks with following build warnings / errors:
kernel/bpf/core.c: In function '___bpf_prog_run':kernel/bpf/core.c:1911:17: error: implicit declaration of function 'barrier_nospec' [-Werror=implicit-function-declaration]1911 | barrier_nospec(); | ^~~~~~~~~~~~~~cc1: some warnings being treated as errors
Should all be fixed up in the -rc2 releases.
thanks,
greg k-h