6.1.91-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 6.1.91-rc1 review
This is the start of the stable review cycle for the 6.1.91 release. There are 236 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 16 May 2024 10:09:32 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.91-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.1.91-rc1
Johan Hovold <[email protected]>
Bluetooth: qca: fix firmware check error path
Johan Hovold <[email protected]>
Bluetooth: qca: fix info leak when fetching fw build id
Johan Hovold <[email protected]>
Bluetooth: qca: fix info leak when fetching board id
Johan Hovold <[email protected]>
Bluetooth: qca: fix NVM configuration parsing
Johan Hovold <[email protected]>
Bluetooth: qca: add missing firmware sanity checks
Namjae Jeon <[email protected]>
ksmbd: do not grant v2 lease if parent lease key and epoch are not set
Namjae Jeon <[email protected]>
ksmbd: avoid to send duplicate lease break notifications
Namjae Jeon <[email protected]>
ksmbd: off ipv6only for both ipv4/ipv6 binding
Conor Dooley <[email protected]>
spi: microchip-core-qspi: fix setting spi bus clock rate
Johan Hovold <[email protected]>
regulator: core: fix debugfs creation regression
Kefeng Wang <[email protected]>
mm: use memalloc_nofs_save() in page_cache_ra_order()
Lakshmi Yadlapati <[email protected]>
hwmon: (pmbus/ucd9000) Increase delay from 250 to 500us
Thadeu Lima de Souza Cascardo <[email protected]>
net: fix out-of-bounds access in ops_init
George Shen <[email protected]>
drm/amd/display: Handle Y carry-over in VCP X.Y calculation
Karthikeyan Ramasubramanian <[email protected]>
drm/i915/bios: Fix parsing backlight BDB data
Zack Rusin <[email protected]>
drm/vmwgfx: Fix invalid reads in fence signaled events
Alex Deucher <[email protected]>
drm/amdkfd: don't allow mapping the MMIO HDP page with large pages
Alexander Usyskin <[email protected]>
mei: me: add lunar lake point M DID
Viken Dadhaniya <[email protected]>
slimbus: qcom-ngd-ctrl: Add timeout for wait operation
Jim Cromie <[email protected]>
dyndbg: fix old BUG_ON in >control parser
Joao Paulo Goncalves <[email protected]>
ASoC: ti: davinci-mcasp: Fix race condition during probe
Sameer Pujar <[email protected]>
ASoC: tegra: Fix DSPK 16-bit playback
Doug Berger <[email protected]>
net: bcmgenet: synchronize UMAC_CMD access
Doug Berger <[email protected]>
net: bcmgenet: synchronize use of bcmgenet_set_rx_mode()
Doug Berger <[email protected]>
net: bcmgenet: synchronize EXT_RGMII_OOB_CTRL access
Paolo Abeni <[email protected]>
tipc: fix UAF in error path
Alexander Potapenko <[email protected]>
kmsan: compiler_types: declare __no_sanitize_or_inline
Hans de Goede <[email protected]>
iio: accel: mxc4005: Interrupt handling fixes
Ramona Gradinariu <[email protected]>
iio:imu: adis16475: Fix sync mode setting
Javier Carrasco <[email protected]>
dt-bindings: iio: health: maxim,max30102: fix compatible check
Paolo Abeni <[email protected]>
mptcp: ensure snd_nxt is properly initialized on connect
Dan Carpenter <[email protected]>
mm/slab: make __free(kfree) accept error pointers
Dominique Martinet <[email protected]>
btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks()
Aman Dhoot <[email protected]>
ALSA: hda/realtek: Fix mute led of HP Laptop 15-da3001TU
Badhri Jagan Sridharan <[email protected]>
usb: typec: tcpm: Check for port partner validity before consuming it
Amit Sunil Dhamne <[email protected]>
usb: typec: tcpm: unregister existing source caps before re-registration
Thinh Nguyen <[email protected]>
usb: dwc3: core: Prevent phy suspend during init
Thinh Nguyen <[email protected]>
usb: xhci-plat: Don't include xhci.h
Chris Wulff <[email protected]>
usb: gadget: f_fs: Fix a race condition when processing setup packets.
Peter Korsgaard <[email protected]>
usb: gadget: composite: fix OS descriptors w_value logic
Alan Stern <[email protected]>
USB: core: Fix access violation during port device removal
Guenter Roeck <[email protected]>
usb: ohci: Prevent missed ohci interrupts
Alan Stern <[email protected]>
usb: Fix regression caused by invalid ep0 maxpacket in virtual SuperSpeed device
Christian A. Ehrhardt <[email protected]>
usb: typec: ucsi: Fix connector check on init
Christian A. Ehrhardt <[email protected]>
usb: typec: ucsi: Check for notifications after init
Benno Lossin <[email protected]>
rust: macros: fix soundness issue in module! macro
Thomas Bertschinger <[email protected]>
rust: module: place generated init_module() function in .init.text
Andrea Righi <[email protected]>
btf, scripts: rust: drop is_rust_module.sh
Andrea Righi <[email protected]>
rust: fix regexp in scripts/is_rust_module.sh
Asahi Lina <[email protected]>
rust: error: Rename to_kernel_errno() -> to_errno()
Linus Torvalds <[email protected]>
Reapply "drm/qxl: simplify qxl_fence_wait"
Thanassis Avgerinos <[email protected]>
firewire: nosy: ensure user_length is taken into account when fetching packet contents
Dmitry Antipov <[email protected]>
btrfs: fix kvcalloc() arguments order in btrfs_ioctl_send()
Christian König <[email protected]>
drm/amdgpu: once more fix the call oder in amdgpu_ttm_move() v2
Leah Rumancik <[email protected]>
MAINTAINERS: add leah to 6.1 MAINTAINERS file
Gabe Teeger <[email protected]>
drm/amd/display: Atom Integrated System Info v2_2 for DCN35
Kent Gibson <[email protected]>
gpiolib: cdev: fix uninitialised kfifo
Kent Gibson <[email protected]>
gpiolib: cdev: relocate debounce_period_us from struct gpio_desc
Andy Shevchenko <[email protected]>
gpiolib: cdev: Add missing header(s)
Mario Limonciello <[email protected]>
dm/amd/pm: Fix problems with reboot/shutdown for some SMU 13.0.4/13.0.11 users
Douglas Anderson <[email protected]>
drm/connector: Add \n to message about demoting connector force-probes
Jerome Brunet <[email protected]>
drm/meson: dw-hdmi: add bandgap setting for g12
Jerome Brunet <[email protected]>
drm/meson: dw-hdmi: power up phy on device init
Yonglong Liu <[email protected]>
net: hns3: fix kernel crash when devlink reload during initialization
Yonglong Liu <[email protected]>
net: hns3: fix port vlan filter not disabled issue
Peiyang Wang <[email protected]>
net: hns3: use appropriate barrier function after setting a bit value
Peiyang Wang <[email protected]>
net: hns3: release PTP resources if pf initialization failed
Peiyang Wang <[email protected]>
net: hns3: change type of numa_node_mask as nodemask_t
Jian Shen <[email protected]>
net: hns3: direct return when receive a unknown mailbox message
Peiyang Wang <[email protected]>
net: hns3: using user configure after hardware reset
Wen Gu <[email protected]>
net/smc: fix neighbour and rtable leak in smc_ib_find_route()
Eric Dumazet <[email protected]>
ipv6: prevent NULL dereference in ip6_output()
Eric Dumazet <[email protected]>
ipv6: annotate data-races around cnf.disable_ipv6
Lukasz Majewski <[email protected]>
hsr: Simplify code for announcing HSR nodes timer setup
Eric Dumazet <[email protected]>
net-sysfs: convert dev->operstate reads to lockless ones
Thomas Gleixner <[email protected]>
timers: Rename del_timer() to timer_delete()
Thomas Gleixner <[email protected]>
timers: Get rid of del_singleshot_timer_sync()
Eric Dumazet <[email protected]>
ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()
Felix Fietkau <[email protected]>
net: bridge: fix corrupted ethernet header on multicast-to-unicast
Eric Dumazet <[email protected]>
phonet: fix rtm_phonet_notify() skb allocation
Aleksa Savic <[email protected]>
hwmon: (corsair-cpro) Protect ccp->wait_input_report with a spinlock
Aleksa Savic <[email protected]>
hwmon: (corsair-cpro) Use complete_all() instead of complete() in ccp_raw_event()
Aleksa Savic <[email protected]>
hwmon: (corsair-cpro) Use a separate buffer for sending commands
Roded Zats <[email protected]>
rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
Marek Vasut <[email protected]>
net: ks8851: Queue RX packets in IRQ handler instead of disabling BHs
Duoming Zhou <[email protected]>
Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout
Sungwoo Kim <[email protected]>
Bluetooth: msft: fix slab-use-after-free in msft_do_close()
Duoming Zhou <[email protected]>
Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout
Kuniyuki Iwashima <[email protected]>
tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().
Eric Dumazet <[email protected]>
tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets
Boy.Wu <[email protected]>
ARM: 9381/1: kasan: clear stale stack poison
Paul Davey <[email protected]>
xfrm: Preserve vlan tags for transport mode software GRO
Al Viro <[email protected]>
qibfs: fix dentry leak
Namhyung Kim <[email protected]>
perf unwind-libdw: Handle JIT-generated DSOs properly
Namhyung Kim <[email protected]>
perf unwind-libunwind: Fix base address for .eh_frame
Geert Uytterhoeven <[email protected]>
spi: Merge spi_controller.{slave,target}_abort()
Miguel Ojeda <[email protected]>
kbuild: rust: avoid creating temporary files
Vanillan Wang <[email protected]>
net:usb:qmi_wwan: support Rolling modules
Lyude Paul <[email protected]>
drm/nouveau/dp: Don't probe eDP ports twice harder
Joakim Sindholt <[email protected]>
fs/9p: drop inodes immediately on non-.L too
Stephen Boyd <[email protected]>
clk: Don't hold prepare_lock when calling kref_put()
Andy Shevchenko <[email protected]>
gpio: crystalcove: Use -ENOTSUPP consistently
Andy Shevchenko <[email protected]>
gpio: wcove: Use -ENOTSUPP consistently
Jeff Layton <[email protected]>
9p: explicitly deny setlease attempts
Joakim Sindholt <[email protected]>
fs/9p: translate O_TRUNC into OTRUNC
Joakim Sindholt <[email protected]>
fs/9p: only translate RWX permissions for plain 9P2000
Krzysztof Kozlowski <[email protected]>
iommu: mtk: fix module autoloading
Michael Kelley <[email protected]>
Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted
Rick Edgecombe <[email protected]>
uio_hv_generic: Don't free decrypted memory
Rick Edgecombe <[email protected]>
Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl
John Stultz <[email protected]>
selftests: timers: Fix valid-adjtimex signed left-shift undefined behavior
Lijo Lazar <[email protected]>
drm/amdgpu: Refine IB schedule error logging
Justin Ernst <[email protected]>
tools/power/turbostat: Fix uncore frequency file string
Jiaxun Yang <[email protected]>
MIPS: scall: Save thread_info.syscall unconditionally on entry
Thierry Reding <[email protected]>
gpu: host1x: Do not setup DMA for virtual devices
Rik van Riel <[email protected]>
blk-iocost: avoid out of bounds shift
Maurizio Lombardi <[email protected]>
scsi: target: Fix SELinux error when systemd-modules loads the target module
Wei Yang <[email protected]>
memblock tests: fix undefined reference to `BIT'
Wei Yang <[email protected]>
memblock tests: fix undefined reference to `panic'
Wei Yang <[email protected]>
memblock tests: fix undefined reference to `early_pfn_to_nid'
Boris Burkov <[email protected]>
btrfs: always clear PERTRANS metadata during commit
Boris Burkov <[email protected]>
btrfs: make btrfs_clear_delalloc_extent() free delalloc reserve
Peng Liu <[email protected]>
tools/power turbostat: Fix Bzy_MHz documentation typo
Wyes Karny <[email protected]>
tools/power turbostat: Increase the limit for fd opened
Doug Smythies <[email protected]>
tools/power turbostat: Fix added raw MSR output
Adam Goldman <[email protected]>
firewire: ohci: mask bus reset interrupts between ISR and bottom half
Chen Ni <[email protected]>
ata: sata_gemini: Check clk_enable() result
Phil Elwell <[email protected]>
net: bcmgenet: Reset RBUF on first open
Li Nan <[email protected]>
block: fix overflow in blk_ioctl_discard()
Takashi Iwai <[email protected]>
ALSA: line6: Zero-initialize message buffers
Peter Wang <[email protected]>
scsi: ufs: core: WLUN suspend dev/link state error recovery
Borislav Petkov (AMD) <[email protected]>
kbuild: Disable KCSAN for autogenerated *.mod.c intermediaries
Andrei Matei <[email protected]>
bpf: Check bloom filter map value size
Anand Jain <[email protected]>
btrfs: return accurate error code on open failure in open_fs_devices()
Saurav Kashyap <[email protected]>
scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload
Shin'ichiro Kawasaki <[email protected]>
scsi: mpi3mr: Avoid memcpy field-spanning write WARNING
linke li <[email protected]>
net: mark racy access on sk->sk_rcvbuf
Igor Artemiev <[email protected]>
wifi: cfg80211: fix rdev_dump_mpp() arguments order
Jeff Johnson <[email protected]>
wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc
Andrew Price <[email protected]>
gfs2: Fix invalid metadata access in punch_hole
Justin Tee <[email protected]>
scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()
Justin Tee <[email protected]>
scsi: lpfc: Replace hbalock with ndlp lock in lpfc_nvme_unregister_port()
Justin Tee <[email protected]>
scsi: lpfc: Update lpfc_ramp_down_queue_handler() logic
Justin Tee <[email protected]>
scsi: lpfc: Move NPIV's transport unregistration to after resource clean up
Oliver Upton <[email protected]>
KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr()
Marc Zyngier <[email protected]>
KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id
Gaurav Batra <[email protected]>
powerpc/pseries/iommu: LPAR panics during boot up with a frozen PE
Nayna Jain <[email protected]>
powerpc/pseries: make max polling consistent for longer H_CALLs
Nayna Jain <[email protected]>
powerpc/pseries: Implement signed update for PLPKS objects
Russell Currey <[email protected]>
powerpc/pseries: Move PLPKS constants to header file
Nayna Jain <[email protected]>
powerpc/pseries: replace kmalloc with kzalloc in PLPKS driver
Jernej Skrabec <[email protected]>
clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change
Richard Gobert <[email protected]>
net: gro: add flush check in udp_gro_receive_segment
Andy Shevchenko <[email protected]>
drm/panel: ili9341: Use predefined error codes
Andy Shevchenko <[email protected]>
drm/panel: ili9341: Respect deferred probe
Alexandra Winter <[email protected]>
s390/qeth: Fix kernel panic after setting hsuid
Guillaume Nault <[email protected]>
vxlan: Pull inner IP header in vxlan_rcv().
Xin Long <[email protected]>
tipc: fix a possible memleak in tipc_buf_append
Felix Fietkau <[email protected]>
net: core: reject skb_copy(_expand) for fraglist GSO skbs
Felix Fietkau <[email protected]>
net: bridge: fix multicast-to-unicast with fraglist GSO
Mans Rullgard <[email protected]>
spi: fix null pointer dereference within spi_sync
Marek Behún <[email protected]>
net: dsa: mv88e6xxx: Fix number of databases for 88E6141 / 88E6341
Sebastian Andrzej Siewior <[email protected]>
cxgb4: Properly lock TX queue for the selftest.
Bui Quang Minh <[email protected]>
s390/cio: Ensure the copied buf is NUL terminated
Pierre-Louis Bossart <[email protected]>
ALSA: hda: intel-sdw-acpi: fix usage of device_get_named_child_node()
Jerome Brunet <[email protected]>
ASoC: meson: cards: select SND_DYNAMIC_MINORS
Jerome Brunet <[email protected]>
ASoC: meson: axg-tdm-interface: manage formatters in trigger
Jerome Brunet <[email protected]>
ASoC: meson: axg-card: make links nonatomic
Jerome Brunet <[email protected]>
ASoC: meson: axg-fifo: use threaded irq to check periods
Jerome Brunet <[email protected]>
ASoC: meson: axg-fifo: use FIELD helpers
Asbjørn Sloth Tønnesen <[email protected]>
net: qede: use return from qede_parse_actions()
Asbjørn Sloth Tønnesen <[email protected]>
net: qede: use return from qede_parse_flow_attr() for flow_spec
Asbjørn Sloth Tønnesen <[email protected]>
net: qede: use return from qede_parse_flow_attr() for flower
Asbjørn Sloth Tønnesen <[email protected]>
net: qede: sanitize 'rc' in qede_add_tc_flower_fltr()
Jens Remus <[email protected]>
s390/vdso: Add CFI for RA register to asm macro vdso_func
David Bauer <[email protected]>
net l2tp: drop flow hash on forward
Kuniyuki Iwashima <[email protected]>
nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().Bui Quang Minh <[email protected]>
octeontx2-af: avoid off-by-one read from userspace
Bui Quang Minh <[email protected]>
bna: ensure the copied buf is NUL terminated
Toke Høiland-Jørgensen <[email protected]>
xdp: use flags field to disambiguate broadcast redirect
Claudio Imbrenda <[email protected]>
s390/mm: Fix clearing storage keys for huge pages
Claudio Imbrenda <[email protected]>
s390/mm: Fix storage key clearing for guest huge pages
Xu Kuohai <[email protected]>
bpf, arm64: Fix incorrect runtime stats
Devyn Liu <[email protected]>
spi: hisi-kunpeng: Delete the dump interface of data registers in debugfs
David Lechner <[email protected]>
spi: axi-spi-engine: fix version format string
David Lechner <[email protected]>
spi: axi-spi-engine: use common AXI macros
David Lechner <[email protected]>
spi: axi-spi-engine: move msg state to new struct
David Lechner <[email protected]>
spi: axi-spi-engine: use devm_spi_alloc_host()
David Lechner <[email protected]>
spi: axi-spi-engine: simplify driver data allocation
Li Zetao <[email protected]>
spi: spi-axi-spi-engine: Use helper function devm_clk_get_enabled()
Yang Yingliang <[email protected]>
spi: spi-axi-spi-engine: switch to use modern name
Uwe Kleine-König <[email protected]>
spi: axi-spi-engine: Convert to platform remove callback returning void
Yang Yingliang <[email protected]>
spi: introduce new helpers with using modern naming
Anton Protopopov <[email protected]>
bpf: Fix a verifier verbose message
Yi Zhang <[email protected]>
nvme: fix warn output about shared namespaces without CONFIG_NVME_MULTIPATH
Jason Xing <[email protected]>
bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue
Andrii Nakryiko <[email protected]>
bpf, kconfig: Fix DEBUG_INFO_BTF_MODULES Kconfig definition
Matti Vaittinen <[email protected]>
regulator: change devm_regulator_get_enable_optional() stub to return Ok
Matti Vaittinen <[email protected]>
regulator: change stubbed devm_regulator_get_enable to return Ok
AngeloGioacchino Del Regno <[email protected]>
regulator: mt6360: De-capitalize devicetree regulator subnodes
Zeng Heng <[email protected]>
pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
AngeloGioacchino Del Regno <[email protected]>
power: supply: mt6360_charger: Fix of_match for usb-otg-vbus regulator
Arnd Bergmann <[email protected]>
power: rt9455: hide unused rt9455_boost_voltage_values
Hans de Goede <[email protected]>
pinctrl: baytrail: Fix selecting gpio pinctrl state
Andy Shevchenko <[email protected]>
pinctrl: intel: Make use of struct pinfunction and PINCTRL_PINFUNCTION()
Andy Shevchenko <[email protected]>
pinctrl: Introduce struct pinfunction and PINCTRL_PINFUNCTION() macro
Kuniyuki Iwashima <[email protected]>
nfs: Handle error of rpc_proc_register() in nfs_net_init().
Josef Bacik <[email protected]>
nfs: make the rpc_stat per net namespace
Josef Bacik <[email protected]>
nfs: expose /proc/net/sunrpc/nfs in net namespaces
Josef Bacik <[email protected]>
sunrpc: add a struct rpc_stats arg to rpc_create_args
Chen-Yu Tsai <[email protected]>
pinctrl: mediatek: paris: Rework support for PIN_CONFIG_{INPUT,OUTPUT}_ENABLE
Chen-Yu Tsai <[email protected]>
pinctrl: mediatek: paris: Fix PIN_CONFIG_INPUT_SCHMITT_ENABLE readback
Dan Carpenter <[email protected]>
pinctrl: core: delete incorrect free in pinctrl_enable()
Jan Dakinevich <[email protected]>
pinctrl/meson: fix typo in PDM's pin name
Billy Tsai <[email protected]>
pinctrl: pinctrl-aspeed-g6: Fix register offset for pinconf of GPIOR-T
Steve French <[email protected]>
smb3: missing lock when picking channel
Shyam Prasad N <[email protected]>
cifs: use the least loaded channel for sending requests
Masahiro Yamada <[email protected]>
kbuild: specify output names separately for each emission type from rustc
Masahiro Yamada <[email protected]>
kbuild: refactor host*_flags
Peter Xu <[email protected]>
mm/hugetlb: fix missing hugetlb_lock for resv uncharge
Sidhartha Kumar <[email protected]>
mm/hugetlb_cgroup: convert hugetlb_cgroup_uncharge_page() to folios
Sidhartha Kumar <[email protected]>
mm/hugetlb: convert free_huge_page to folios
Sidhartha Kumar <[email protected]>
mm/hugetlb_cgroup: convert hugetlb_cgroup_from_page() to folios
Sidhartha Kumar <[email protected]>
mm/hugetlb_cgroup: convert __set_hugetlb_cgroup() to folios
Sidhartha Kumar <[email protected]>
mm/hugetlb: add folio_hstate()
Sidhartha Kumar <[email protected]>
mm/hugetlb: add hugetlb_folio_subpool() helpers
Sidhartha Kumar <[email protected]>
mm: add private field of first tail to struct page and struct folio
Sidhartha Kumar <[email protected]>
mm/hugetlb: add folio support to hugetlb specific flag macros
Tim Jiang <[email protected]>
Bluetooth: qca: add support for QCA2066
Daniel Okazaki <[email protected]>
eeprom: at24: fix memory corruption race condition
Heiner Kallweit <[email protected]>
eeprom: at24: Probe for DDR3 thermal sensor in the SPD case
Alexander Stein <[email protected]>
eeprom: at24: Use dev_err_probe for nvmem register failure
Wedson Almeida Filho <[email protected]>
rust: kernel: require Send for Module implementations
Johannes Berg <[email protected]>
wifi: nl80211: don't free NULL coalescing rule
Vinod Koul <[email protected]>
dmaengine: Revert "dmaengine: pl330: issue_pending waits until WFP state"
Bumyong Lee <[email protected]>
dmaengine: pl330: issue_pending waits until WFP state
-------------
Diffstat:
.../bindings/iio/health/maxim,max30102.yaml | 2 +- MAINTAINERS | 1 + Makefile | 4 +- arch/arm/kernel/sleep.S | 4 + arch/arm64/kvm/vgic/vgic-kvm-device.c | 12 +- arch/arm64/net/bpf_jit_comp.c | 6 +- arch/mips/include/asm/ptrace.h | 2 +- arch/mips/kernel/asm-offsets.c | 1 + arch/mips/kernel/ptrace.c | 15 +- arch/mips/kernel/scall32-o32.S | 23 +- arch/mips/kernel/scall64-n32.S | 3 +- arch/mips/kernel/scall64-n64.S | 3 +- arch/mips/kernel/scall64-o32.S | 33 +-- arch/powerpc/include/asm/hvcall.h | 1 + arch/powerpc/platforms/pseries/iommu.c | 8 + arch/powerpc/platforms/pseries/plpks.c | 135 ++++++---- arch/powerpc/platforms/pseries/plpks.h | 40 ++- arch/s390/include/asm/dwarf.h | 1 + arch/s390/kernel/vdso64/vdso_user_wrapper.S | 2 + arch/s390/mm/gmap.c | 2 +- arch/s390/mm/hugetlbpage.c | 2 +- block/blk-iocost.c | 7 +- block/ioctl.c | 5 +- drivers/ata/sata_gemini.c | 5 +- drivers/bluetooth/btqca.c | 162 +++++++++++- drivers/bluetooth/btqca.h | 6 +- drivers/bluetooth/hci_qca.c | 11 + drivers/char/tpm/tpm-dev-common.c | 4 +- drivers/clk/clk.c | 12 +- drivers/clk/sunxi-ng/ccu-sun50i-h6.c | 19 +- drivers/firewire/nosy.c | 6 +- drivers/firewire/ohci.c | 6 +- drivers/gpio/gpio-crystalcove.c | 2 +- drivers/gpio/gpio-wcove.c | 2 +- drivers/gpio/gpiolib-cdev.c | 183 ++++++++++++-- drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 7 +- drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 14 +- drivers/gpu/drm/amd/amdgpu/amdgpu_object.h | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 52 ++-- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 7 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 1 + .../display/dc/dcn31/dcn31_hpo_dp_link_encoder.c | 6 + .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_4_ppt.c | 2 +- drivers/gpu/drm/drm_connector.c | 2 +- drivers/gpu/drm/i915/display/intel_bios.c | 19 +- drivers/gpu/drm/i915/display/intel_vbt_defs.h | 5 - drivers/gpu/drm/meson/meson_dw_hdmi.c | 70 +++--- drivers/gpu/drm/nouveau/nouveau_dp.c | 13 +- drivers/gpu/drm/panel/panel-ilitek-ili9341.c | 8 +- drivers/gpu/drm/qxl/qxl_release.c | 50 +--- drivers/gpu/drm/vmwgfx/vmwgfx_fence.c | 2 +- drivers/gpu/host1x/bus.c | 8 - drivers/hv/channel.c | 29 ++- drivers/hwmon/corsair-cpro.c | 43 +++- drivers/hwmon/pmbus/ucd9000.c | 6 +- drivers/iio/accel/mxc4005.c | 24 +- drivers/iio/imu/adis16475.c | 4 +- drivers/infiniband/hw/qib/qib_fs.c | 1 + drivers/iommu/mtk_iommu.c | 1 + drivers/iommu/mtk_iommu_v1.c | 1 + drivers/misc/eeprom/at24.c | 46 +++- drivers/misc/mei/hw-me-regs.h | 2 + drivers/misc/mei/pci-me.c | 2 + drivers/net/dsa/mv88e6xxx/chip.c | 4 +- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 32 ++- drivers/net/ethernet/broadcom/genet/bcmgenet.h | 4 +- drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c | 8 +- drivers/net/ethernet/broadcom/genet/bcmmii.c | 6 +- drivers/net/ethernet/brocade/bna/bnad_debugfs.c | 4 +- drivers/net/ethernet/chelsio/cxgb4/sge.c | 6 +- drivers/net/ethernet/hisilicon/hns3/hnae3.h | 2 +- .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 52 ++-- .../ethernet/hisilicon/hns3/hns3pf/hclge_main.h | 5 +- .../net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 7 +- .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 20 +- .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h | 2 +- .../ethernet/marvell/octeontx2/af/rvu_debugfs.c | 4 +- drivers/net/ethernet/micrel/ks8851_common.c | 16 +- drivers/net/ethernet/qlogic/qede/qede_filter.c | 14 +- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/vxlan/vxlan_core.c | 19 +- drivers/nvme/host/core.c | 2 +- drivers/pinctrl/aspeed/pinctrl-aspeed-g6.c | 34 +-- drivers/pinctrl/core.c | 8 +- drivers/pinctrl/devicetree.c | 10 +- drivers/pinctrl/intel/pinctrl-baytrail.c | 74 +++--- drivers/pinctrl/intel/pinctrl-intel.c | 6 +- drivers/pinctrl/intel/pinctrl-intel.h | 17 +- drivers/pinctrl/mediatek/pinctrl-paris.c | 40 +-- drivers/pinctrl/meson/pinctrl-meson-a1.c | 6 +- drivers/power/supply/mt6360_charger.c | 2 +- drivers/power/supply/rt9455_charger.c | 2 + drivers/regulator/core.c | 27 +- drivers/regulator/mt6360-regulator.c | 32 ++- drivers/s390/cio/cio_inject.c | 2 +- drivers/s390/net/qeth_core_main.c | 69 +++--- drivers/scsi/bnx2fc/bnx2fc_tgt.c | 2 - drivers/scsi/lpfc/lpfc.h | 1 - drivers/scsi/lpfc/lpfc_els.c | 20 +- drivers/scsi/lpfc/lpfc_hbadisc.c | 5 +- drivers/scsi/lpfc/lpfc_nvme.c | 4 +- drivers/scsi/lpfc/lpfc_scsi.c | 13 +- drivers/scsi/lpfc/lpfc_sli.c | 14 +- drivers/scsi/lpfc/lpfc_vport.c | 8 +- drivers/scsi/mpi3mr/mpi3mr_app.c | 2 +- drivers/slimbus/qcom-ngd-ctrl.c | 6 +- drivers/spi/spi-axi-spi-engine.c | 275 +++++++++++---------- drivers/spi/spi-hisi-kunpeng.c | 2 - drivers/spi/spi-microchip-core-qspi.c | 1 + drivers/spi/spi.c | 12 + drivers/staging/wlan-ng/hfa384x_usb.c | 4 +- drivers/staging/wlan-ng/prism2usb.c | 6 +- drivers/target/target_core_configfs.c | 12 + drivers/ufs/core/ufshcd.c | 5 +- drivers/uio/uio_hv_generic.c | 12 +- drivers/usb/core/hub.c | 5 +- drivers/usb/core/port.c | 8 +- drivers/usb/dwc3/core.c | 90 +++---- drivers/usb/dwc3/core.h | 1 + drivers/usb/dwc3/gadget.c | 2 + drivers/usb/dwc3/host.c | 27 ++ drivers/usb/gadget/composite.c | 6 +- drivers/usb/gadget/function/f_fs.c | 2 +- drivers/usb/host/ohci-hcd.c | 8 + drivers/usb/host/xhci-plat.h | 4 +- drivers/usb/typec/tcpm/tcpm.c | 35 ++- drivers/usb/typec/ucsi/ucsi.c | 12 +- fs/9p/vfs_file.c | 2 + fs/9p/vfs_inode.c | 5 +- fs/9p/vfs_super.c | 1 + fs/btrfs/inode.c | 2 +- fs/btrfs/send.c | 4 +- fs/btrfs/transaction.c | 2 +- fs/btrfs/volumes.c | 18 +- fs/gfs2/bmap.c | 5 +- fs/hugetlbfs/inode.c | 8 +- fs/nfs/client.c | 5 +- fs/nfs/inode.c | 13 +- fs/nfs/internal.h | 2 - fs/nfs/netns.h | 2 + fs/smb/client/transport.c | 37 ++- fs/smb/server/oplock.c | 35 ++- fs/smb/server/transport_tcp.c | 4 + include/linux/compiler_types.h | 11 + include/linux/dma-fence.h | 7 - include/linux/gfp_types.h | 2 + include/linux/hugetlb.h | 53 +++- include/linux/hugetlb_cgroup.h | 69 +++--- include/linux/hyperv.h | 1 + include/linux/mm_types.h | 14 ++ include/linux/pinctrl/pinctrl.h | 20 ++ include/linux/regulator/consumer.h | 4 +- include/linux/skbuff.h | 15 ++ include/linux/skmsg.h | 2 + include/linux/slab.h | 2 +- include/linux/spi/spi.h | 51 +++- include/linux/sunrpc/clnt.h | 1 + include/linux/timer.h | 15 +- include/net/xfrm.h | 3 + include/uapi/scsi/scsi_bsg_mpi3mr.h | 2 +- kernel/bpf/bloom_filter.c | 13 + kernel/bpf/verifier.c | 3 +- kernel/time/timer.c | 8 +- lib/Kconfig.debug | 5 +- lib/dynamic_debug.c | 6 +- mm/hugetlb.c | 52 ++-- mm/hugetlb_cgroup.c | 34 +-- mm/migrate.c | 2 +- mm/readahead.c | 4 + net/bluetooth/hci_core.c | 3 +- net/bluetooth/l2cap_core.c | 3 + net/bluetooth/msft.c | 2 +- net/bluetooth/msft.h | 4 +- net/bluetooth/sco.c | 4 + net/bridge/br_forward.c | 9 +- net/bridge/br_netlink.c | 3 +- net/core/filter.c | 42 +++- net/core/link_watch.c | 4 +- net/core/net-sysfs.c | 4 +- net/core/net_namespace.c | 13 +- net/core/rtnetlink.c | 6 +- net/core/skbuff.c | 27 +- net/core/skmsg.c | 5 +- net/core/sock.c | 4 +- net/hsr/hsr_device.c | 31 ++- net/ipv4/tcp.c | 4 +- net/ipv4/tcp_input.c | 2 + net/ipv4/tcp_ipv4.c | 8 +- net/ipv4/tcp_output.c | 4 +- net/ipv4/udp_offload.c | 12 +- net/ipv4/xfrm4_input.c | 6 +- net/ipv6/addrconf.c | 11 +- net/ipv6/fib6_rules.c | 6 +- net/ipv6/ip6_input.c | 4 +- net/ipv6/ip6_output.c | 2 +- net/ipv6/xfrm6_input.c | 6 +- net/l2tp/l2tp_eth.c | 3 + net/mac80211/ieee80211_i.h | 4 +- net/mptcp/protocol.c | 3 + net/nsh/nsh.c | 14 +- net/phonet/pn_netlink.c | 2 +- net/smc/smc_ib.c | 19 +- net/sunrpc/clnt.c | 5 +- net/sunrpc/xprt.c | 2 +- net/tipc/msg.c | 8 +- net/wireless/nl80211.c | 2 + net/wireless/trace.h | 2 +- net/xfrm/xfrm_input.c | 8 + rust/Makefile | 11 +- rust/kernel/error.rs | 2 +- rust/kernel/lib.rs | 2 +- rust/macros/module.rs | 185 ++++++++------ scripts/Makefile.build | 17 +- scripts/Makefile.host | 27 +- scripts/Makefile.modfinal | 4 +- scripts/is_rust_module.sh | 16 -- sound/hda/intel-sdw-acpi.c | 2 + sound/pci/hda/patch_realtek.c | 1 + sound/soc/meson/Kconfig | 1 + sound/soc/meson/axg-card.c | 1 + sound/soc/meson/axg-fifo.c | 56 +++-- sound/soc/meson/axg-fifo.h | 12 +- sound/soc/meson/axg-frddr.c | 5 +- sound/soc/meson/axg-tdm-interface.c | 34 +-- sound/soc/meson/axg-toddr.c | 22 +- sound/soc/tegra/tegra186_dspk.c | 7 +- sound/soc/ti/davinci-mcasp.c | 12 +- sound/usb/line6/driver.c | 6 +- tools/include/linux/kernel.h | 1 + tools/include/linux/mm.h | 5 + tools/include/linux/panic.h | 19 ++ tools/perf/util/unwind-libdw.c | 21 +- tools/perf/util/unwind-libunwind-local.c | 2 +- tools/power/x86/turbostat/turbostat.8 | 2 +- tools/power/x86/turbostat/turbostat.c | 30 ++- .../selftests/bpf/prog_tests/bloom_filter_map.c | 6 + tools/testing/selftests/timers/valid-adjtimex.c | 73 +++--- 237 files changed, 2399 insertions(+), 1328 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/236 dmaengine: pl330: issue_pending waits until WFP state
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bumyong Lee <[email protected]>
[ Upstream commit 22a9d9585812440211b0b34a6bc02ade62314be4 ]
According to DMA-330 errata notice[1] 71930, DMAKILL cannot clear internal signal, named pipeline_req_active. it makes that pl330 would wait forever in WFP state although dma already send dma request if pl330 gets dma request before entering WFP state.
The errata suggests that polling until entering WFP state as workaround and then peripherals allows to issue dma request.
[1]: https://developer.arm.com/documentation/genc008428/latest
Stable-dep-of: afc89870ea67 ("dmaengine: Revert "dmaengine: pl330: issue_pending waits until WFP state"")
--- drivers/dma/pl330.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/dma/pl330.c +3 -0
@@ -1053,6 +1053,9 @@ static bool _trigger(struct pl330_thread *thrd) thrd->req_running = idx; +if (desc->rqtype ==DMA_MEM_TO_DEV || desc->rqtype ==DMA_DEV_TO_MEM ) +UNTIL (thrd,PL330_STATE_WFP ); +return true; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 2/236 dmaengine: Revert "dmaengine: pl330: issue_pending waits until WFP state"
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vinod Koul <[email protected]>
[ Upstream commit afc89870ea677bd5a44516eb981f7a259b74280c ]
This reverts commit 22a9d9585812 ("dmaengine: pl330: issue_pending waits until WFP state") as it seems to cause regression in pl330 driver. Note the issue now exists in mainline so a fix to be done.
--- drivers/dma/pl330.c | 3 --- 1 file changed, 3 deletions(-)
drivers/dma/pl330.c +0 -3
@@ -1053,9 +1053,6 @@ static bool _trigger(struct pl330_thread *thrd) thrd->req_running = idx; -if (desc->rqtype ==DMA_MEM_TO_DEV || desc->rqtype ==DMA_DEV_TO_MEM ) -UNTIL (thrd,PL330_STATE_WFP ); -return true; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 3/236 wifi: nl80211: dont free NULL coalescing rule
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 801ea33ae82d6a9d954074fbcf8ea9d18f1543a7 ]
If the parsing fails, we can dereference a NULL pointer here.
--- net/wireless/nl80211.c | 2 ++ 1 file changed, 2 insertions(+)
net/wireless/nl80211.c +2 -0
@@ -13802,6 +13802,8 @@ static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info) error:for (i =0 ; i < new_coalesce.n_rules; i++) { tmp_rule = &new_coalesce.rules[i]; +if (!tmp_rule) +continue ;for (j =0 ; j < tmp_rule->n_patterns; j++)kfree (tmp_rule->patterns[j].mask);kfree (tmp_rule->patterns);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 4/236 rust: kernel: require `Send` for `Module` implementations
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wedson Almeida Filho <[email protected]>
[ Upstream commit 323617f649c0966ad5e741e47e27e06d3a680d8f ]
The thread that calls the module initialisation code when a module is loaded is not guaranteed [in fact, it is unlikely] to be the same one that calls the module cleanup code on module unload, therefore, Module implementations must be Send to account for them moving from one thread to another implicitly.
--- rust/kernel/lib.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
rust/kernel/lib.rs +1 -1
@@ -37,7 +37,7 @@/// The top level entrypoint to implementing a kernel module. /// /// For any teardown or cleanup operations, your type may implement [`Drop`]. -pub trait Module :Sized +Sync { +pub trait Module :Sized +Sync +Send {/// Called at module initialization time. /// /// Use this method to perform whatever setup or registration your module
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 5/236 eeprom: at24: Use dev_err_probe for nvmem register failure
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Stein <[email protected]>
[ Upstream commit a3c10035d12f5ec10915d5c00c2e8f7d7c066182 ]
When using nvmem layouts it is possible devm_nvmem_register returns -EPROBE_DEFER, resulting in an 'empty' in /sys/kernel/debug/devices_deferred. Use dev_err_probe for providing additional information.
Stable-dep-of: f42c97027fb7 ("eeprom: at24: fix memory corruption race condition")
--- drivers/misc/eeprom/at24.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/misc/eeprom/at24.c +2 -1
@@ -761,7 +761,8 @@ static int at24_probe(struct i2c_client *client)pm_runtime_disable (dev);if (!pm_runtime_status_suspended (dev))regulator_disable (at24->vcc_reg); -return PTR_ERR (at24->nvmem); +return dev_err_probe (dev,PTR_ERR (at24->nvmem), +"failed to register nvmem\n" ); }/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 6/236 eeprom: at24: Probe for DDR3 thermal sensor in the SPD case
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiner Kallweit <[email protected]>
[ Upstream commit caba40ec3531b0849f44502a03117796e8c9f4a1 ]
The DDR3 SPD data structure advertises the presence of a thermal sensor on a DDR3 module in byte 32, bit 7. Let's use this information to explicitly instantiate the thermal sensor I2C client instead of having to rely on class-based I2C probing.
The temp sensor i2c address can be derived from the SPD i2c address, so we can directly instantiate the device and don't have to probe for it. If the temp sensor has been instantiated already by other means (e.g. class-based auto-detection), then the busy-check in i2c_new_client_device will detect this.
Note: Thermal sensors on DDR4 DIMM's are instantiated from the
ee1004 driver.
Stable-dep-of: f42c97027fb7 ("eeprom: at24: fix memory corruption race condition")
--- drivers/misc/eeprom/at24.c | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+)
drivers/misc/eeprom/at24.c +29 -0
@@ -581,6 +581,31 @@ static unsigned int at24_get_offset_adj(u8 flags, unsigned int byte_len) } } +static void at24_probe_temp_sensor (struct i2c_client *client) +{ +struct at24_data *at24 =i2c_get_clientdata (client); +struct i2c_board_info info = { .type ="jc42" }; +int ret; +u8 val; + +/* +* Byte 2 has value 11 for DDR3, earlier versions don't +* support the thermal sensor present flag +*/ + ret =at24_read (at24,2 , &val,1 ); +if (ret || val !=11 ) +return ; + +/* Byte 32, bit 7 is set if temp sensor is present */ + ret =at24_read (at24,32 , &val,1 ); +if (ret || !(val &BIT (7 ))) +return ; + + info.addr =0x18 | (client->addr &7 ); + +i2c_new_client_device (client->adapter, &info); +} +static int at24_probe (struct i2c_client *client) {struct regmap_config regmap_config = { };
@@ -780,6 +805,10 @@ static int at24_probe(struct i2c_client *client) } } +/* If this a SPD EEPROM, probe for DDR3 thermal sensor */ +if (cdata == &at24_data_spd) +at24_probe_temp_sensor (client); +pm_runtime_idle (dev);if (writable)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 7/236 eeprom: at24: fix memory corruption race condition
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Okazaki <[email protected]>
[ Upstream commit f42c97027fb75776e2e9358d16bf4a99aeb04cf2 ]
If the eeprom is not accessible, an nvmem device will be registered, the read will fail, and the device will be torn down. If another driver accesses the nvmem device after the teardown, it will reference invalid memory.
Move the failure point before registering the nvmem device.
--- drivers/misc/eeprom/at24.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/misc/eeprom/at24.c +9 -9
@@ -781,15 +781,6 @@ static int at24_probe(struct i2c_client *client) }pm_runtime_enable (dev); - at24->nvmem =devm_nvmem_register (dev, &nvmem_config); -if (IS_ERR (at24->nvmem)) { -pm_runtime_disable (dev); -if (!pm_runtime_status_suspended (dev)) -regulator_disable (at24->vcc_reg); -return dev_err_probe (dev,PTR_ERR (at24->nvmem), -"failed to register nvmem\n" ); - } -/* * Perform a one-byte test read to verify that the chip is functional, * unless powering on the device is to be avoided during probe (i.e.
@@ -805,6 +796,15 @@ static int at24_probe(struct i2c_client *client) } } + at24->nvmem =devm_nvmem_register (dev, &nvmem_config); +if (IS_ERR (at24->nvmem)) { +pm_runtime_disable (dev); +if (!pm_runtime_status_suspended (dev)) +regulator_disable (at24->vcc_reg); +return dev_err_probe (dev,PTR_ERR (at24->nvmem), +"failed to register nvmem\n" ); + } +/* If this a SPD EEPROM, probe for DDR3 thermal sensor */ if (cdata == &at24_data_spd)at24_probe_temp_sensor (client);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 8/236 Bluetooth: qca: add support for QCA2066
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Jiang <[email protected]>
[ Upstream commit a7f8dedb4be2cc930a29af24427b885405ecd15d ]
This patch adds support for QCA2066 firmware patch and NVM downloading. as the RF performance of QCA2066 SOC chip from different foundries may vary. Therefore we use different NVM to configure them based on board ID.
Changes in v2
- optimize the function qca_generate_hsp_nvm_name
- remove redundant debug code for function qca_read_fw_board_id
Stable-dep-of: 32868e126c78 ("Bluetooth: qca: fix invalid device address check")
--- drivers/bluetooth/btqca.c | 68 +++++++++++++++++++++++++++++++++++++ drivers/bluetooth/btqca.h | 5 ++- drivers/bluetooth/hci_qca.c | 11 ++++++ 3 files changed, 83 insertions(+), 1 deletion(-)
drivers/bluetooth/btqca.c +68 -0
@@ -205,6 +205,44 @@ static int qca_send_reset(struct hci_dev *hdev)return 0 ; } +static int qca_read_fw_board_id (struct hci_dev *hdev,u16 *bid) +{ +u8 cmd; +struct sk_buff *skb; +struct edl_event_hdr *edl; +int err =0 ; + + cmd =EDL_GET_BID_REQ_CMD ; + skb =__hci_cmd_sync_ev (hdev,EDL_PATCH_CMD_OPCODE ,EDL_PATCH_CMD_LEN , + &cmd,0 ,HCI_INIT_TIMEOUT ); +if (IS_ERR (skb)) { + err =PTR_ERR (skb); +bt_dev_err (hdev,"Reading QCA board ID failed (%d)" , err); +return err; + } + + edl =skb_pull_data (skb,sizeof (*edl)); +if (!edl) { +bt_dev_err (hdev,"QCA read board ID with no header" ); + err = -EILSEQ ; + goto out; + } + +if (edl->cresp !=EDL_CMD_REQ_RES_EVT || + edl->rtype !=EDL_GET_BID_REQ_CMD ) { +bt_dev_err (hdev,"QCA Wrong packet: %d %d" , edl->cresp, edl->rtype); + err = -EIO ; + goto out; + } + + *bid = (edl->data[1 ] <<8 ) + edl->data[2 ]; +bt_dev_dbg (hdev,"%s: bid = %x" , __func__, *bid); + +out: +kfree_skb (skb); +return err; +} +int qca_send_pre_shutdown_cmd (struct hci_dev *hdev) {struct sk_buff *skb;
@@ -574,6 +612,23 @@ int qca_set_bdaddr_rome(struct hci_dev *hdev, const bdaddr_t *bdaddr) }EXPORT_SYMBOL_GPL (qca_set_bdaddr_rome); +static void qca_generate_hsp_nvm_name (char *fwname,size_t max_size, +struct qca_btsoc_version ver,u8 rom_ver,u16 bid) +{ +const char *variant; + +/* hsp gf chip */ +if ((le32_to_cpu (ver.soc_id) &QCA_HSP_GF_SOC_MASK ) ==QCA_HSP_GF_SOC_ID ) + variant ="g" ; +else + variant ="" ; + +if (bid ==0x0 ) +snprintf (fwname, max_size,"qca/hpnv%02x%s.bin" , rom_ver, variant); +else +snprintf (fwname, max_size,"qca/hpnv%02x%s.%x" , rom_ver, variant, bid); +} +int qca_uart_setup (struct hci_dev *hdev,uint8_t baudrate,enum qca_btsoc_type soc_type,struct qca_btsoc_version ver,const char *firmware_name)
@@ -582,6 +637,7 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate,int err;u8 rom_ver =0 ;u32 soc_ver; +u16 boardid =0 ;bt_dev_dbg (hdev,"QCA setup on UART" );
@@ -615,6 +671,10 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate,snprintf (config.fwname,sizeof (config.fwname),"qca/apbtfw%02x.tlv" , rom_ver);break ; +case QCA_QCA2066 : +snprintf (config.fwname,sizeof (config.fwname), +"qca/hpbtfw%02x.tlv" , rom_ver); +break ;case QCA_QCA6390 :snprintf (config.fwname,sizeof (config.fwname),"qca/htbtfw%02x.tlv" , rom_ver);
@@ -649,6 +709,9 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate,/* Give the controller some time to get ready to receive the NVM */ msleep (10 ); +if (soc_type ==QCA_QCA2066 ) +qca_read_fw_board_id (hdev, &boardid); +/* Download NVM configuration */ config.type =TLV_TYPE_NVM ;if (firmware_name) {
@@ -671,6 +734,10 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate,snprintf (config.fwname,sizeof (config.fwname),"qca/apnv%02x.bin" , rom_ver);break ; +case QCA_QCA2066 : +qca_generate_hsp_nvm_name (config.fwname, +sizeof (config.fwname), ver, rom_ver, boardid); +break ;case QCA_QCA6390 :snprintf (config.fwname,sizeof (config.fwname),"qca/htnv%02x.bin" , rom_ver);
@@ -702,6 +769,7 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate,switch (soc_type) {case QCA_WCN3991 : +case QCA_QCA2066 :case QCA_QCA6390 :case QCA_WCN6750 :case QCA_WCN6855 :
drivers/bluetooth/btqca.h +4 -1
@@ -12,6 +12,7 @@#define EDL_PATCH_VER_REQ_CMD (0x19)#define EDL_PATCH_TLV_REQ_CMD (0x1E)#define EDL_GET_BUILD_INFO_CMD (0x20) +#define EDL_GET_BID_REQ_CMD (0x23)#define EDL_NVM_ACCESS_SET_REQ_CMD (0x01)#define EDL_PATCH_CONFIG_CMD (0x28)#define MAX_SIZE_PER_TLV_SEGMENT (243)
@@ -47,7 +48,8 @@ ((le32_to_cpu(soc_id) << 16) | (le16_to_cpu(rom_ver)))#define QCA_FW_BUILD_VER_LEN 255 - +#define QCA_HSP_GF_SOC_ID 0x1200 +#define QCA_HSP_GF_SOC_MASK 0x0000ff00enum qca_baudrate {QCA_BAUDRATE_115200 =0 ,
@@ -146,6 +148,7 @@ enum qca_btsoc_type {QCA_WCN3990 ,QCA_WCN3998 ,QCA_WCN3991 , +QCA_QCA2066 ,QCA_QCA6390 ,QCA_WCN6750 , QCA_WCN6855,
drivers/bluetooth/hci_qca.c +11 -0
@@ -1808,6 +1808,10 @@ static int qca_setup(struct hci_uart *hu)set_bit (HCI_QUIRK_SIMULTANEOUS_DISCOVERY , &hdev->quirks);switch (soc_type) { +case QCA_QCA2066 : + soc_name ="qca2066" ; +break ; +case QCA_WCN3988 :case QCA_WCN3990 :case QCA_WCN3991 :
@@ -2000,6 +2004,11 @@ static const struct qca_device_data qca_soc_data_wcn3998 __maybe_unused = { .num_vregs = 4, }; +static const struct qca_device_data qca_soc_data_qca2066__maybe_unused = { + .soc_type =QCA_QCA2066 , + .num_vregs =0 , +}; +static const struct qca_device_data qca_soc_data_qca6390__maybe_unused = { .soc_type =QCA_QCA6390 , .num_vregs =0 ,
@@ -2539,6 +2548,7 @@ static SIMPLE_DEV_PM_OPS(qca_pm_ops, qca_suspend, qca_resume);#ifdef CONFIG_OF static const struct of_device_id qca_bluetooth_of_match[] = { + { .compatible ="qcom,qca2066-bt" , .data = &qca_soc_data_qca2066}, { .compatible ="qcom,qca6174-bt" }, { .compatible ="qcom,qca6390-bt" , .data = &qca_soc_data_qca6390}, { .compatible = "qcom,qca9377-bt" },
@@ -2556,6 +2566,7 @@ MODULE_DEVICE_TABLE(of, qca_bluetooth_of_match);#ifdef CONFIG_ACPI static const struct acpi_device_id qca_bluetooth_acpi_match[] = { + {"QCOM2066" , (kernel_ulong_t)&qca_soc_data_qca2066 }, {"QCOM6390" , (kernel_ulong_t)&qca_soc_data_qca6390 }, {"DLA16390" , (kernel_ulong_t)&qca_soc_data_qca6390 }, { "DLB16390", (kernel_ulong_t)&qca_soc_data_qca6390 },
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 9/236 mm/hugetlb: add folio support to hugetlb specific flag macros
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sidhartha Kumar <[email protected]>
[ Upstream commit d03c376d9066532551dc56837c7c5490e4fcbbfe ]
Patch series "begin converting hugetlb code to folios", v4.
This patch series starts the conversion of the hugetlb code to operate on struct folios rather than struct pages. This removes the ambiguitiy of whether functions are operating on head pages, tail pages of compound pages, or base pages.
This series passes the linux test project hugetlb test cases.
Patch 1 adds hugeltb specific page macros that can operate on folios.
Patch 2 adds the private field of the first tail page to struct page. For 32-bit, _private_1 alinging with page[1].private was confirmed by using pahole.
Patch 3 introduces hugetlb subpool helper functions which operate on struct folios. These patches were tested using the hugepage-mmap.c selftest along with the migratepages command.
Patch 4 converts hugetlb_delete_from_page_cache() to use folios.
Patch 5 adds a folio_hstate() function to get hstate information from a folio and adds a user of folio_hstate().
Bpftrace was used to track time spent in the free_huge_pages function during the ltp test cases as it is a caller of the hugetlb subpool functions. From the histogram, the performance is similar before and after the patch series.
Time spent in 'free_huge_page'
6.0.0-rc2.master.20220823
@nsecs:
[256, 512) 14770 |@@@@@@@@@@@@@@@@@@@@@@@@@@@
|@@@@@@@@@@@@@@@@@@@@@@@@@ | [512, 1K) 155 | | [1K, 2K) 169 | | [2K, 4K) 50 | | [4K, 8K) 14 | | [8K, 16K) 3 | | [16K, 32K) 3 | |
6.0.0-rc2.master.20220823 + patch series
@nsecs:
[256, 512) 13678 |@@@@@@@@@@@@@@@@@@@@@@@@@@@ |
|@@@@@@@@@@@@@@@@@@@@@@@@@ | [512, 1K) 142 | | [1K, 2K) 199 | | [2K, 4K) 44 | | [4K, 8K) 13 | | [8K, 16K) 4 | | [16K, 32K) 1 | |
This patch (of 5):
Allow the macros which test, set, and clear hugetlb specific page flags to take a hugetlb folio as an input. The macrros are generated as folio_{test, set, clear}_hugetlb_{restore_reserve, migratable, temporary, freed, vmemmap_optimized, raw_hwp_unreliable}.
Stable-dep-of: b76b46902c2d ("mm/hugetlb: fix missing hugetlb_lock for resv uncharge")
--- include/linux/hugetlb.h | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+)
include/linux/hugetlb.h +24 -0
@@ -625,26 +625,50 @@ enum hugetlb_page_flags {*/ #ifdef CONFIG_HUGETLB_PAGE #define TESTHPAGEFLAG (uname, flname) \ +static __always_inline \ +bool folio_test_hugetlb_##flname(struct folio *folio) \ + { void *private = &folio->private; \ + return test_bit(HPG_##flname, private); \ + } \ static inline int HPage##uname(struct page *page) \ { return test_bit(HPG_##flname, &(page->private)); }#define SETHPAGEFLAG (uname, flname) \ +static __always_inline \ +void folio_set_hugetlb_##flname(struct folio *folio) \ + { void *private = &folio->private; \ + set_bit(HPG_##flname, private); \ + } \ static inline void SetHPage##uname(struct page *page) \ { set_bit(HPG_##flname, &(page->private)); }#define CLEARHPAGEFLAG (uname, flname) \ +static __always_inline \ +void folio_clear_hugetlb_##flname(struct folio *folio) \ + { void *private = &folio->private; \ + clear_bit(HPG_##flname, private); \ + } \ static inline void ClearHPage##uname(struct page *page) \ { clear_bit(HPG_##flname, &(page->private)); }#else #define TESTHPAGEFLAG (uname, flname) \ +static inline bool \ +folio_test_hugetlb_##flname(struct folio *folio) \ + { return 0; } \ static inline int HPage##uname(struct page *page) \ { return 0; }#define SETHPAGEFLAG (uname, flname) \ +static inline void \ +folio_set_hugetlb_##flname(struct folio *folio) \ + { } \ static inline void SetHPage##uname(struct page *page) \ { }#define CLEARHPAGEFLAG (uname, flname) \ +static inline void \ +folio_clear_hugetlb_##flname(struct folio *folio) \ + { } \ static inline void ClearHPage##uname(struct page *page) \ { }#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 10/236 mm: add private field of first tail to struct page and struct folio
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sidhartha Kumar <[email protected]>
[ Upstream commit d340625f4849ab5dbfebbc7d84709fbfcd39e52f ]
Allow struct folio to store hugetlb metadata that is contained in the private field of the first tail page. On 32-bit, _private_1 aligns with page[1].private.
Stable-dep-of: b76b46902c2d ("mm/hugetlb: fix missing hugetlb_lock for resv uncharge")
--- include/linux/mm_types.h | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
include/linux/mm_types.h +14 -0
@@ -144,6 +144,7 @@ struct page {atomic_t compound_pincount;#ifdef CONFIG_64BIT unsigned int compound_nr;/* 1 << compound_order */ +unsigned long _private_1;#endif };struct {/* Second tail page of compound page */
@@ -264,6 +265,7 @@ struct page {* @_total_mapcount: Do not use directly, call folio_entire_mapcount(). * @_pincount: Do not use directly, call folio_maybe_dma_pinned(). * @_folio_nr_pages: Do not use directly, call folio_nr_pages(). +* @_private_1: Do not use directly, call folio_get_private_1(). * * A folio is a physically, virtually and logically contiguous set * of bytes. It is a power-of-two in size, and it is aligned to that
@@ -311,6 +313,7 @@ struct folio {#ifdef CONFIG_64BIT unsigned int _folio_nr_pages;#endif +unsigned long _private_1; };#define FOLIO_MATCH (pg, fl) \
@@ -338,6 +341,7 @@ FOLIO_MATCH(compound_mapcount, _total_mapcount);FOLIO_MATCH (compound_pincount, _pincount);#ifdef CONFIG_64BIT FOLIO_MATCH (compound_nr, _folio_nr_pages); +FOLIO_MATCH (_private_1, _private_1);#endif #undef FOLIO_MATCH
@@ -383,6 +387,16 @@ static inline void *folio_get_private(struct folio *folio)return folio->private; } +static inline void folio_set_private_1 (struct folio *folio,unsigned long private) +{ + folio->_private_1 = private; +} + +static inline unsigned long folio_get_private_1 (struct folio *folio) +{ +return folio->_private_1; +} +struct page_frag_cache {void * va;#if (PAGE_SIZE <PAGE_FRAG_CACHE_MAX_SIZE )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 11/236 mm/hugetlb: add hugetlb_folio_subpool() helpers
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sidhartha Kumar <[email protected]>
[ Upstream commit 149562f7509404c382c32c3fa8a6ba356135e5cf ]
Allow hugetlbfs_migrate_folio to check and read subpool information by passing in a folio.
Stable-dep-of: b76b46902c2d ("mm/hugetlb: fix missing hugetlb_lock for resv uncharge")
--- fs/hugetlbfs/inode.c | 8 ++++---- include/linux/hugetlb.h | 15 +++++++++++++-- 2 files changed, 17 insertions(+), 6 deletions(-)
fs/hugetlbfs/inode.c +4 -4
@@ -1108,10 +1108,10 @@ static int hugetlbfs_migrate_folio(struct address_space *mapping,if (rc !=MIGRATEPAGE_SUCCESS )return rc; -if (hugetlb_page_subpool (&src->page)) { -hugetlb_set_page_subpool (&dst->page, -hugetlb_page_subpool (&src->page)); -hugetlb_set_page_subpool (&src->page,NULL ); +if (hugetlb_folio_subpool (src)) { +hugetlb_set_folio_subpool (dst, +hugetlb_folio_subpool (src)); +hugetlb_set_folio_subpool (src,NULL ); }if (mode !=MIGRATE_SYNC_NO_COPY )
include/linux/hugetlb.h +13 -2
@@ -754,18 +754,29 @@ extern unsigned int default_hstate_idx;#define default_hstate (hstates[default_hstate_idx]) +static inline struct hugepage_subpool *hugetlb_folio_subpool (struct folio *folio) +{ +return (void *)folio_get_private_1 (folio); +} +/* * hugetlb page subpool pointer located in hpage[1].private */ static inline struct hugepage_subpool *hugetlb_page_subpool (struct page *hpage) { -return (void *)page_private (hpage +SUBPAGE_INDEX_SUBPOOL ); +return hugetlb_folio_subpool (page_folio (hpage)); +} + +static inline void hugetlb_set_folio_subpool (struct folio *folio, +struct hugepage_subpool *subpool) +{ +folio_set_private_1 (folio, (unsigned long )subpool); }static inline void hugetlb_set_page_subpool (struct page *hpage,struct hugepage_subpool *subpool) { -set_page_private (hpage +SUBPAGE_INDEX_SUBPOOL , (unsigned long )subpool); +hugetlb_set_folio_subpool (page_folio (hpage), subpool); }static inline struct hstate *hstate_file (struct file *f)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 12/236 mm/hugetlb: add folio_hstate()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sidhartha Kumar <[email protected]>
[ Upstream commit e51da3a9b6c2f67879880259a25c51dbda01c462 ]
Helper function to retrieve hstate information from a hugetlb folio.
Stable-dep-of: b76b46902c2d ("mm/hugetlb: fix missing hugetlb_lock for resv uncharge")
--- include/linux/hugetlb.h | 14 ++++++++++++-- mm/migrate.c | 2 +- 2 files changed, 13 insertions(+), 3 deletions(-)
include/linux/hugetlb.h +12 -2
@@ -863,10 +863,15 @@ static inline pte_t arch_make_huge_pte(pte_t entry, unsigned int shift, }#endif +static inline struct hstate *folio_hstate (struct folio *folio) +{ +VM_BUG_ON_FOLIO (!folio_test_hugetlb (folio), folio); +return size_to_hstate (folio_size (folio)); +} +static inline struct hstate *page_hstate (struct page *page) { -VM_BUG_ON_PAGE (!PageHuge (page), page); -return size_to_hstate (page_size (page)); +return folio_hstate (page_folio (page)); }static inline unsigned hstate_index_to_shift (unsigned index)
@@ -1077,6 +1082,11 @@ static inline struct hstate *hstate_vma(struct vm_area_struct *vma)return NULL ; } +static inline struct hstate *folio_hstate (struct folio *folio) +{ +return NULL ; +} +static inline struct hstate *page_hstate (struct page *page) {return NULL ;
mm/migrate.c +1 -1
@@ -1632,7 +1632,7 @@ struct page *alloc_migration_target(struct page *page, unsigned long private) nid =folio_nid (folio);if (folio_test_hugetlb (folio)) { -struct hstate *h =page_hstate (&folio->page); +struct hstate *h =folio_hstate (folio); gfp_mask =htlb_modify_alloc_mask (h, gfp_mask);return alloc_huge_page_nodemask (h, nid, mtc->nmask, gfp_mask);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 13/236 mm/hugetlb_cgroup: convert __set_hugetlb_cgroup() to folios
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sidhartha Kumar <[email protected]>
[ Upstream commit a098c977722ca27d3b4bfeb966767af3cce45f85 ]
Patch series "convert hugetlb_cgroup helper functions to folios", v2.
This patch series continues the conversion of hugetlb code from being managed in pages to folios by converting many of the hugetlb_cgroup helper functions to use folios. This allows the core hugetlb functions to pass in a folio to these helper functions.
This patch (of 9);
Change __set_hugetlb_cgroup() to use folios so it is explicit that the function operates on a head page.
Stable-dep-of: b76b46902c2d ("mm/hugetlb: fix missing hugetlb_lock for resv uncharge")
--- include/linux/hugetlb_cgroup.h | 14 +++++++------- mm/hugetlb_cgroup.c | 4 ++-- 2 files changed, 9 insertions(+), 9 deletions(-)
include/linux/hugetlb_cgroup.h +7 -7
@@ -90,31 +90,31 @@ hugetlb_cgroup_from_page_rsvd(struct page *page)return __hugetlb_cgroup_from_page (page, true); } -static inline void __set_hugetlb_cgroup (struct page *page, +static inline void __set_hugetlb_cgroup (struct folio *folio,struct hugetlb_cgroup *h_cg,bool rsvd) { -VM_BUG_ON_PAGE (!PageHuge (page), page); +VM_BUG_ON_FOLIO (!folio_test_hugetlb (folio), folio); -if (compound_order (page) <HUGETLB_CGROUP_MIN_ORDER ) +if (folio_order (folio) <HUGETLB_CGROUP_MIN_ORDER )return ;if (rsvd) -set_page_private (page +SUBPAGE_INDEX_CGROUP_RSVD , +set_page_private (folio_page (folio,SUBPAGE_INDEX_CGROUP_RSVD ), (unsigned long )h_cg);else -set_page_private (page +SUBPAGE_INDEX_CGROUP , +set_page_private (folio_page (folio,SUBPAGE_INDEX_CGROUP ), (unsigned long )h_cg); }static inline void set_hugetlb_cgroup (struct page *page,struct hugetlb_cgroup *h_cg) { -__set_hugetlb_cgroup (page, h_cg, false); +__set_hugetlb_cgroup (page_folio (page), h_cg, false); }static inline void set_hugetlb_cgroup_rsvd (struct page *page,struct hugetlb_cgroup *h_cg) { -__set_hugetlb_cgroup (page, h_cg, true); +__set_hugetlb_cgroup (page_folio (page), h_cg, true); }static inline bool hugetlb_cgroup_disabled (void )
mm/hugetlb_cgroup.c +2 -2
@@ -314,7 +314,7 @@ static void __hugetlb_cgroup_commit_charge(int idx, unsigned long nr_pages,if (hugetlb_cgroup_disabled () || !h_cg)return ; -__set_hugetlb_cgroup (page, h_cg, rsvd); +__set_hugetlb_cgroup (page_folio (page), h_cg, rsvd);if (!rsvd) {unsigned long usage = h_cg->nodeinfo[page_to_nid (page)]->usage[idx];
@@ -356,7 +356,7 @@ static void __hugetlb_cgroup_uncharge_page(int idx, unsigned long nr_pages, h_cg =__hugetlb_cgroup_from_page (page, rsvd);if (unlikely (!h_cg))return ; -__set_hugetlb_cgroup (page,NULL , rsvd); +__set_hugetlb_cgroup (page_folio (page),NULL , rsvd); page_counter_uncharge(__hugetlb_cgroup_counter_from_cgroup(h_cg, idx, rsvd),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 14/236 mm/hugetlb_cgroup: convert hugetlb_cgroup_from_page() to folios
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sidhartha Kumar <[email protected]>
[ Upstream commit f074732d599e19a2a5b12e54743ad5eaccbe6550 ]
Introduce folios in __remove_hugetlb_page() by converting hugetlb_cgroup_from_page() to use folios.
Also gets rid of unsed hugetlb_cgroup_from_page_resv() function.
Stable-dep-of: b76b46902c2d ("mm/hugetlb: fix missing hugetlb_lock for resv uncharge")
--- include/linux/hugetlb_cgroup.h | 39 +++++++++++++++++----------------- mm/hugetlb.c | 5 +++-- mm/hugetlb_cgroup.c | 13 +++++++----- 3 files changed, 31 insertions(+), 26 deletions(-)
include/linux/hugetlb_cgroup.h +20 -19
@@ -67,27 +67,34 @@ struct hugetlb_cgroup { };static inline struct hugetlb_cgroup * -__hugetlb_cgroup_from_page (struct page *page,bool rsvd) +__hugetlb_cgroup_from_folio (struct folio *folio,bool rsvd) { -VM_BUG_ON_PAGE (!PageHuge (page), page); +struct page *tail; -if (compound_order (page) <HUGETLB_CGROUP_MIN_ORDER ) +VM_BUG_ON_FOLIO (!folio_test_hugetlb (folio), folio); +if (folio_order (folio) <HUGETLB_CGROUP_MIN_ORDER )return NULL ; -if (rsvd) -return (void *)page_private (page +SUBPAGE_INDEX_CGROUP_RSVD ); -else -return (void *)page_private (page +SUBPAGE_INDEX_CGROUP ); + +if (rsvd) { + tail =folio_page (folio,SUBPAGE_INDEX_CGROUP_RSVD ); +return (void *)page_private (tail); + } + +else { + tail =folio_page (folio,SUBPAGE_INDEX_CGROUP ); +return (void *)page_private (tail); + } } -static inline struct hugetlb_cgroup *hugetlb_cgroup_from_page (struct page *page) +static inline struct hugetlb_cgroup *hugetlb_cgroup_from_folio (struct folio *folio) { -return __hugetlb_cgroup_from_page (page, false); +return __hugetlb_cgroup_from_folio (folio, false); }static inline struct hugetlb_cgroup * -hugetlb_cgroup_from_page_rsvd (struct page *page) +hugetlb_cgroup_from_folio_rsvd (struct folio *folio) { -return __hugetlb_cgroup_from_page (page, true); +return __hugetlb_cgroup_from_folio (folio, true); } static inline void __set_hugetlb_cgroup(struct folio *folio,
@@ -181,19 +188,13 @@ static inline void hugetlb_cgroup_uncharge_file_region(struct resv_map *resv, { } -static inline struct hugetlb_cgroup *hugetlb_cgroup_from_page (struct page *page) -{ -return NULL ; -} - -static inline struct hugetlb_cgroup * -hugetlb_cgroup_from_page_resv (struct page *page) +static inline struct hugetlb_cgroup *hugetlb_cgroup_from_folio (struct folio *folio) {return NULL ; }static inline struct hugetlb_cgroup * -hugetlb_cgroup_from_page_rsvd (struct page *page) +hugetlb_cgroup_from_folio_rsvd (struct folio *folio) {return NULL ; }
mm/hugetlb.c +3 -2
@@ -1661,9 +1661,10 @@ static void __remove_hugetlb_page(struct hstate *h, struct page *page, bool demote) {int nid =page_to_nid (page); +struct folio *folio =page_folio (page); -VM_BUG_ON_PAGE (hugetlb_cgroup_from_page (page), page); -VM_BUG_ON_PAGE (hugetlb_cgroup_from_page_rsvd (page), page); +VM_BUG_ON_FOLIO (hugetlb_cgroup_from_folio (folio), folio); +VM_BUG_ON_FOLIO (hugetlb_cgroup_from_folio_rsvd (folio), folio);lockdep_assert_held (&hugetlb_lock);if (hstate_is_gigantic (h) && !gigantic_page_runtime_supported ())
mm/hugetlb_cgroup.c +8 -5
@@ -191,8 +191,9 @@ static void hugetlb_cgroup_move_parent(int idx, struct hugetlb_cgroup *h_cg,struct page_counter *counter;struct hugetlb_cgroup *page_hcg;struct hugetlb_cgroup *parent =parent_hugetlb_cgroup (h_cg); +struct folio *folio =page_folio (page); - page_hcg =hugetlb_cgroup_from_page (page); + page_hcg =hugetlb_cgroup_from_folio (folio);/* * We can have pages in active list without any cgroup * ie, hugepage with less than 3 pages. We can safely
@@ -349,14 +350,15 @@ static void __hugetlb_cgroup_uncharge_page(int idx, unsigned long nr_pages, struct page *page, bool rsvd) {struct hugetlb_cgroup *h_cg; +struct folio *folio =page_folio (page);if (hugetlb_cgroup_disabled ())return ;lockdep_assert_held (&hugetlb_lock); - h_cg =__hugetlb_cgroup_from_page (page, rsvd); + h_cg =__hugetlb_cgroup_from_folio (folio, rsvd);if (unlikely (!h_cg))return ; -__set_hugetlb_cgroup (page_folio (page),NULL , rsvd); +__set_hugetlb_cgroup (folio,NULL , rsvd); page_counter_uncharge(__hugetlb_cgroup_counter_from_cgroup(h_cg, idx, rsvd),
@@ -888,13 +890,14 @@ void hugetlb_cgroup_migrate(struct page *oldhpage, struct page *newhpage)struct hugetlb_cgroup *h_cg;struct hugetlb_cgroup *h_cg_rsvd;struct hstate *h =page_hstate (oldhpage); +struct folio *old_folio =page_folio (oldhpage);if (hugetlb_cgroup_disabled ())return ;spin_lock_irq (&hugetlb_lock); - h_cg =hugetlb_cgroup_from_page (oldhpage); - h_cg_rsvd =hugetlb_cgroup_from_page_rsvd (oldhpage); + h_cg =hugetlb_cgroup_from_folio (old_folio); + h_cg_rsvd =hugetlb_cgroup_from_folio_rsvd (old_folio);set_hugetlb_cgroup (oldhpage,NULL );set_hugetlb_cgroup_rsvd (oldhpage,NULL );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 15/236 mm/hugetlb: convert free_huge_page to folios
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sidhartha Kumar <[email protected]>
[ Upstream commit 0356c4b96f6890dd61af4c902f681764f4bdba09 ]
Use folios inside free_huge_page(), this is in preparation for converting hugetlb_cgroup_uncharge_page() to take in a folio.
Stable-dep-of: b76b46902c2d ("mm/hugetlb: fix missing hugetlb_lock for resv uncharge")
--- mm/hugetlb.c | 27 ++++++++++++++------------- 1 file changed, 14 insertions(+), 13 deletions(-)
mm/hugetlb.c +14 -13
@@ -1918,21 +1918,22 @@ void free_huge_page(struct page *page)* Can't pass hstate in here because it is called from the * compound page destructor. */ -struct hstate *h =page_hstate (page); -int nid =page_to_nid (page); -struct hugepage_subpool *spool =hugetlb_page_subpool (page); +struct folio *folio =page_folio (page); +struct hstate *h =folio_hstate (folio); +int nid =folio_nid (folio); +struct hugepage_subpool *spool =hugetlb_folio_subpool (folio);bool restore_reserve;unsigned long flags; -VM_BUG_ON_PAGE (page_count (page), page); -VM_BUG_ON_PAGE (page_mapcount (page), page); +VM_BUG_ON_FOLIO (folio_ref_count (folio), folio); +VM_BUG_ON_FOLIO (folio_mapcount (folio), folio); -hugetlb_set_page_subpool (page,NULL ); -if (PageAnon (page)) -__ClearPageAnonExclusive (page); - page->mapping =NULL ; - restore_reserve =HPageRestoreReserve (page); -ClearHPageRestoreReserve (page); +hugetlb_set_folio_subpool (folio,NULL ); +if (folio_test_anon (folio)) +__ClearPageAnonExclusive (&folio->page); + folio->mapping =NULL ; + restore_reserve =folio_test_hugetlb_restore_reserve (folio); +folio_clear_hugetlb_restore_reserve (folio);/* * If HPageRestoreReserve was set on page, page allocation consumed a
@@ -1954,7 +1955,7 @@ void free_huge_page(struct page *page) }spin_lock_irqsave (&hugetlb_lock, flags); -ClearHPageMigratable (page); +folio_clear_hugetlb_migratable (folio);hugetlb_cgroup_uncharge_page (hstate_index (h),pages_per_huge_page (h), page); hugetlb_cgroup_uncharge_page_rsvd(hstate_index(h),
@@ -1962,7 +1963,7 @@ void free_huge_page(struct page *page)if (restore_reserve) h->resv_huge_pages++; -if (HPageTemporary (page)) { +if (folio_test_hugetlb_temporary (folio)) {remove_hugetlb_page (h, page, false);spin_unlock_irqrestore (&hugetlb_lock, flags);update_and_free_page (h, page, true);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 16/236 mm/hugetlb_cgroup: convert hugetlb_cgroup_uncharge_page() to folios
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sidhartha Kumar <[email protected]>
[ Upstream commit d4ab0316cc33aeedf6dcb1c2c25e097a25766132 ]
Continue to use a folio inside free_huge_page() by converting hugetlb_cgroup_uncharge_page*() to folios.
Stable-dep-of: b76b46902c2d ("mm/hugetlb: fix missing hugetlb_lock for resv uncharge")
--- include/linux/hugetlb_cgroup.h | 16 ++++++++-------- mm/hugetlb.c | 15 +++++++++------ mm/hugetlb_cgroup.c | 21 ++++++++++----------- 3 files changed, 27 insertions(+), 25 deletions(-)
include/linux/hugetlb_cgroup.h +8 -8
@@ -158,10 +158,10 @@ extern void hugetlb_cgroup_commit_charge(int idx, unsigned long nr_pages,extern void hugetlb_cgroup_commit_charge_rsvd (int idx,unsigned long nr_pages,struct hugetlb_cgroup *h_cg,struct page *page); -extern void hugetlb_cgroup_uncharge_page (int idx,unsigned long nr_pages, -struct page *page); -extern void hugetlb_cgroup_uncharge_page_rsvd (int idx,unsigned long nr_pages, -struct page *page); +extern void hugetlb_cgroup_uncharge_folio (int idx,unsigned long nr_pages, +struct folio *folio); +extern void hugetlb_cgroup_uncharge_folio_rsvd (int idx,unsigned long nr_pages, +struct folio *folio);extern void hugetlb_cgroup_uncharge_cgroup (int idx,unsigned long nr_pages,struct hugetlb_cgroup *h_cg);
@@ -254,14 +254,14 @@ hugetlb_cgroup_commit_charge_rsvd(int idx, unsigned long nr_pages, { } -static inline void hugetlb_cgroup_uncharge_page (int idx,unsigned long nr_pages, -struct page *page) +static inline void hugetlb_cgroup_uncharge_folio (int idx,unsigned long nr_pages, +struct folio *folio) { } -static inline void hugetlb_cgroup_uncharge_page_rsvd (int idx, +static inline void hugetlb_cgroup_uncharge_folio_rsvd (int idx,unsigned long nr_pages, -struct page *page) +struct folio *folio) { } static inline void hugetlb_cgroup_uncharge_cgroup(int idx,
mm/hugetlb.c +9 -6
@@ -1956,10 +1956,10 @@ void free_huge_page(struct page *page)spin_lock_irqsave (&hugetlb_lock, flags);folio_clear_hugetlb_migratable (folio); -hugetlb_cgroup_uncharge_page (hstate_index (h), -pages_per_huge_page (h), page); -hugetlb_cgroup_uncharge_page_rsvd (hstate_index (h), -pages_per_huge_page (h), page); +hugetlb_cgroup_uncharge_folio (hstate_index (h), +pages_per_huge_page (h), folio); +hugetlb_cgroup_uncharge_folio_rsvd (hstate_index (h), +pages_per_huge_page (h), folio);if (restore_reserve) h->resv_huge_pages++;
@@ -3082,6 +3082,7 @@ struct page *alloc_huge_page(struct vm_area_struct *vma,struct hugepage_subpool *spool =subpool_vma (vma);struct hstate *h =hstate_vma (vma);struct page *page; +struct folio *folio;long map_chg, map_commit;long gbl_chg;int ret, idx;
@@ -3145,6 +3146,7 @@ struct page *alloc_huge_page(struct vm_area_struct *vma,* a reservation exists for the allocation. */ page =dequeue_huge_page_vma (h, vma, addr, avoid_reserve, gbl_chg); +if (!page) {spin_unlock_irq (&hugetlb_lock); page =alloc_buddy_huge_page_with_mpol (h, vma, addr);
@@ -3159,6 +3161,7 @@ struct page *alloc_huge_page(struct vm_area_struct *vma,set_page_refcounted (page);/* Fall through */ } + folio =page_folio (page);hugetlb_cgroup_commit_charge (idx,pages_per_huge_page (h), h_cg, page);/* If allocation is not consuming a reservation, also store the * hugetlb_cgroup pointer on the page.
@@ -3188,8 +3191,8 @@ struct page *alloc_huge_page(struct vm_area_struct *vma, rsv_adjust =hugepage_subpool_put_pages (spool,1 );hugetlb_acct_memory (h, -rsv_adjust);if (deferred_reserve) -hugetlb_cgroup_uncharge_page_rsvd (hstate_index (h), -pages_per_huge_page (h), page); +hugetlb_cgroup_uncharge_folio_rsvd (hstate_index (h), +pages_per_huge_page (h), folio); }return page;
mm/hugetlb_cgroup.c +10 -11
@@ -346,11 +346,10 @@ void hugetlb_cgroup_commit_charge_rsvd(int idx, unsigned long nr_pages,/* * Should be called with hugetlb_lock held */ -static void __hugetlb_cgroup_uncharge_page (int idx,unsigned long nr_pages, -struct page *page,bool rsvd) +static void __hugetlb_cgroup_uncharge_folio (int idx,unsigned long nr_pages, +struct folio *folio,bool rsvd) {struct hugetlb_cgroup *h_cg; -struct folio *folio =page_folio (page);if (hugetlb_cgroup_disabled ())return ;
@@ -368,27 +367,27 @@ static void __hugetlb_cgroup_uncharge_page(int idx, unsigned long nr_pages,css_put (&h_cg->css); else {unsigned long usage = - h_cg->nodeinfo[page_to_nid (page)]->usage[idx]; + h_cg->nodeinfo[folio_nid (folio)]->usage[idx];/* * This write is not atomic due to fetching usage and writing * to it, but that's fine because we call this with * hugetlb_lock held anyway. */ -WRITE_ONCE (h_cg->nodeinfo[page_to_nid (page)]->usage[idx], +WRITE_ONCE (h_cg->nodeinfo[folio_nid (folio)]->usage[idx], usage - nr_pages); } } -void hugetlb_cgroup_uncharge_page (int idx,unsigned long nr_pages, -struct page *page) +void hugetlb_cgroup_uncharge_folio (int idx,unsigned long nr_pages, +struct folio *folio) { -__hugetlb_cgroup_uncharge_page (idx, nr_pages, page, false); +__hugetlb_cgroup_uncharge_folio (idx, nr_pages, folio, false); } -void hugetlb_cgroup_uncharge_page_rsvd (int idx,unsigned long nr_pages, -struct page *page) +void hugetlb_cgroup_uncharge_folio_rsvd (int idx,unsigned long nr_pages, +struct folio *folio) { -__hugetlb_cgroup_uncharge_page (idx, nr_pages, page, true); +__hugetlb_cgroup_uncharge_folio (idx, nr_pages, folio, true); } static void __hugetlb_cgroup_uncharge_cgroup(int idx, unsigned long nr_pages,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 17/236 mm/hugetlb: fix missing hugetlb_lock for resv uncharge
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Xu <[email protected]>
[ Upstream commit b76b46902c2d0395488c8412e1116c2486cdfcb2 ]
There is a recent report on UFFDIO_COPY over hugetlb:
https://lore.kernel.org/all/[email protected]/
350: lockdep_assert_held(&hugetlb_lock);
Should be an issue in hugetlb but triggered in an userfault context, where it goes into the unlikely path where two threads modifying the resv map together. Mike has a fix in that path for resv uncharge but it looks like the locking criteria was overlooked: hugetlb_cgroup_uncharge_folio_rsvd() will update the cgroup pointer, so it requires to be called with the lock held.
--- mm/hugetlb.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
mm/hugetlb.c +4 -1
@@ -3190,9 +3190,12 @@ struct page *alloc_huge_page(struct vm_area_struct *vma, rsv_adjust =hugepage_subpool_put_pages (spool,1 );hugetlb_acct_memory (h, -rsv_adjust); -if (deferred_reserve) +if (deferred_reserve) { +spin_lock_irq (&hugetlb_lock);hugetlb_cgroup_uncharge_folio_rsvd (hstate_index (h),pages_per_huge_page (h), folio); +spin_unlock_irq (&hugetlb_lock); + } }return page;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 18/236 kbuild: refactor host*_flags
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masahiro Yamada <[email protected]>
[ Upstream commit 16169a47d5c36046041527faafb5a3f5c86701c6 ]
Remove _host*_flags. No functional change is intended.
Stable-dep-of: ded103c7eb23 ("kbuild: rust: force alloc extern to allow "empty" Rust files")
--- scripts/Makefile.host | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-)
scripts/Makefile.host +8 -10
@@ -80,25 +80,23 @@ host-rust := $(addprefix $(obj)/,$(host-rust)) ##### # Handle options to gcc. Support building with separate output directory -_hostc_flags = $(KBUILD_HOSTCFLAGS) $(HOST_EXTRACFLAGS) \ +hostc_flags = -Wp,-MMD,$(depfile) \ + $(KBUILD_HOSTCFLAGS) $(HOST_EXTRACFLAGS) \ $(HOSTCFLAGS_$(target-stem).o) -_hostcxx_flags = $(KBUILD_HOSTCXXFLAGS) $(HOST_EXTRACXXFLAGS) \ +hostcxx_flags = -Wp,-MMD,$(depfile) \ + $(KBUILD_HOSTCXXFLAGS) $(HOST_EXTRACXXFLAGS) \ $(HOSTCXXFLAGS_$(target-stem).o) -_hostrust_flags = $(KBUILD_HOSTRUSTFLAGS) $(HOST_EXTRARUSTFLAGS) \ - $(HOSTRUSTFLAGS_$(target-stem)) +hostrust_flags = $(KBUILD_HOSTRUSTFLAGS) $(HOST_EXTRARUSTFLAGS) \ + $(HOSTRUSTFLAGS_$(target-stem)) # $(objtree)/$(obj) for including generated headers from checkin source files ifeq ($(KBUILD_EXTMOD),) ifdef building_out_of_srctree -_hostc_flags += -I $(objtree)/$(obj) -_hostcxx_flags += -I $(objtree)/$(obj) +hostc_flags += -I $(objtree)/$(obj) +hostcxx_flags += -I $(objtree)/$(obj) endif endif -hostc_flags = -Wp,-MMD,$(depfile) $(_hostc_flags) -hostcxx_flags = -Wp,-MMD,$(depfile) $(_hostcxx_flags) -hostrust_flags = $(_hostrust_flags) - ##### # Compile programs on the host
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 19/236 kbuild: specify output names separately for each emission type from rustc
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masahiro Yamada <[email protected]>
[ Upstream commit 295d8398c67e314d99bb070f38883f83fe94a97a ]
In Kbuild, two different rules must not write to the same file, but it happens when compiling rust source files.
For example, set CONFIG_SAMPLE_RUST_MINIMAL=m and run the following:
$ make -j$(nproc) samples/rust/rust_minimal.o samples/rust/rust_minimal.rsi \
samples/rust/rust_minimal.s samples/rust/rust_minimal.ll
[snip]
RUSTC [M] samples/rust/rust_minimal.o
RUSTC [M] samples/rust/rust_minimal.rsi
RUSTC [M] samples/rust/rust_minimal.s
RUSTC [M] samples/rust/rust_minimal.ll
mv: cannot stat 'samples/rust/rust_minimal.d': No such file or directory
make[3]: *** [scripts/Makefile.build:334: samples/rust/rust_minimal.ll] Error 1
make[3]: *** Waiting for unfinished jobs....
mv: cannot stat 'samples/rust/rust_minimal.d': No such file or directory
make[3]: *** [scripts/Makefile.build:309: samples/rust/rust_minimal.o] Error 1
mv: cannot stat 'samples/rust/rust_minimal.d': No such file or directory
make[3]: *** [scripts/Makefile.build:326: samples/rust/rust_minimal.s] Error 1
make[2]: *** [scripts/Makefile.build:504: samples/rust] Error 2
make[1]: *** [scripts/Makefile.build:504: samples] Error 2
make: *** [Makefile:2008: .] Error 2The reason for the error is that 4 threads running in parallel renames the same file, samples/rust/rust_minimal.d.
This does not happen when compiling C or assembly files because -Wp,-MMD,$(depfile) explicitly specifies the dependency filepath. $(depfile) is a unique path for each target.
Currently, rustc is only given --out-dir and --emit=<list-of-types> So, all the rust build rules output the dep-info into the default <CRATE_NAME>.d, which causes the path conflict.
Fortunately, the --emit option is able to specify the output path individually, with the form --emit=<type>=<path>.
Add --emit=dep-info=$(depfile) to the common part. Also, remove the redundant --out-dir because the output path is specified for each type.
The code gets much cleaner because we do not need to rename *.d files.
Stable-dep-of: ded103c7eb23 ("kbuild: rust: force alloc extern to allow "empty" Rust files")
--- rust/Makefile | 11 +++++------ scripts/Makefile.build | 14 +++++++------- scripts/Makefile.host | 7 +++---- 3 files changed, 15 insertions(+), 17 deletions(-)
rust/Makefile +5 -6
@@ -322,10 +322,9 @@ $(obj)/exports_kernel_generated.h: $(obj)/kernel.o FORCE quiet_cmd_rustc_procmacro = $(RUSTC_OR_CLIPPY_QUIET) P $@ cmd_rustc_procmacro = \ $(RUSTC_OR_CLIPPY) $(rust_common_flags) \ - --emit=dep-info,link --extern proc_macro \ - --crate-type proc-macro --out-dir $(objtree)/$(obj) \ + --emit=dep-info=$(depfile) --emit=link=$@ --extern proc_macro \ + --crate-type proc-macro \ --crate-name $(patsubst lib%.so,%,$(notdir $@)) $<; \ - mv $(objtree)/$(obj)/$(patsubst lib%.so,%,$(notdir $@)).d $(depfile); \ sed -i '/^\#/d' $(depfile) # Procedural macros can only be used with the `rustc` that compiled it.
@@ -339,10 +338,10 @@ quiet_cmd_rustc_library = $(if $(skip_clippy),RUSTC,$(RUSTC_OR_CLIPPY_QUIET)) L OBJTREE=$(abspath $(objtree)) \ $(if $(skip_clippy),$(RUSTC),$(RUSTC_OR_CLIPPY)) \ $(filter-out $(skip_flags),$(rust_flags) $(rustc_target_flags)) \ - --emit=dep-info,obj,metadata --crate-type rlib \ - --out-dir $(objtree)/$(obj) -L$(objtree)/$(obj) \ + --emit=dep-info=$(depfile) --emit=obj=$@ \ + --emit=metadata=$(dir $@)$(patsubst %.o,lib%.rmeta,$(notdir $@)) \ + --crate-type rlib -L$(objtree)/$(obj) \ --crate-name $(patsubst %.o,%,$(notdir $@)) $<; \ - mv $(objtree)/$(obj)/$(patsubst %.o,%,$(notdir $@)).d $(depfile); \ sed -i '/^\#/d' $(depfile) \ $(if $(rustc_objcopy),;$(OBJCOPY) $(rustc_objcopy) $@)
scripts/Makefile.build +7 -7
@@ -283,11 +283,11 @@ rust_common_cmd = \ -Zcrate-attr=no_std \ -Zcrate-attr='feature($(rust_allowed_features))' \ --extern alloc --extern kernel \ - --crate-type rlib --out-dir $(obj) -L $(objtree)/rust/ \ - --crate-name $(basename $(notdir $@)) + --crate-type rlib -L $(objtree)/rust/ \ + --crate-name $(basename $(notdir $@)) \ + --emit=dep-info=$(depfile) rust_handle_depfile = \ - mv $(obj)/$(basename $(notdir $@)).d $(depfile); \ sed -i '/^\#/d' $(depfile) # `--emit=obj`, `--emit=asm` and `--emit=llvm-ir` imply a single codegen unit
@@ -300,7 +300,7 @@ rust_handle_depfile = \ quiet_cmd_rustc_o_rs = $(RUSTC_OR_CLIPPY_QUIET) $(quiet_modtag) $@ cmd_rustc_o_rs = \ - $(rust_common_cmd) --emit=dep-info,obj $<; \ + $(rust_common_cmd) --emit=obj=$@ $<; \ $(rust_handle_depfile) $(obj)/%.o: $(src)/%.rs FORCE
@@ -308,7 +308,7 @@ $(obj)/%.o: $(src)/%.rs FORCE quiet_cmd_rustc_rsi_rs = $(RUSTC_OR_CLIPPY_QUIET) $(quiet_modtag) $@ cmd_rustc_rsi_rs = \ - $(rust_common_cmd) --emit=dep-info -Zunpretty=expanded $< >$@; \ + $(rust_common_cmd) -Zunpretty=expanded $< >$@; \ command -v $(RUSTFMT) >/dev/null && $(RUSTFMT) $@; \ $(rust_handle_depfile)
@@ -317,7 +317,7 @@ $(obj)/%.rsi: $(src)/%.rs FORCE quiet_cmd_rustc_s_rs = $(RUSTC_OR_CLIPPY_QUIET) $(quiet_modtag) $@ cmd_rustc_s_rs = \ - $(rust_common_cmd) --emit=dep-info,asm $<; \ + $(rust_common_cmd) --emit=asm=$@ $<; \ $(rust_handle_depfile) $(obj)/%.s: $(src)/%.rs FORCE
@@ -325,7 +325,7 @@ $(obj)/%.s: $(src)/%.rs FORCE quiet_cmd_rustc_ll_rs = $(RUSTC_OR_CLIPPY_QUIET) $(quiet_modtag) $@ cmd_rustc_ll_rs = \ - $(rust_common_cmd) --emit=dep-info,llvm-ir $<; \ + $(rust_common_cmd) --emit=llvm-ir=$@ $<; \ $(rust_handle_depfile) $(obj)/%.ll: $(src)/%.rs FORCE
scripts/Makefile.host +3 -4
@@ -86,7 +86,8 @@ hostc_flags = -Wp,-MMD,$(depfile) \ hostcxx_flags = -Wp,-MMD,$(depfile) \ $(KBUILD_HOSTCXXFLAGS) $(HOST_EXTRACXXFLAGS) \ $(HOSTCXXFLAGS_$(target-stem).o) -hostrust_flags = $(KBUILD_HOSTRUSTFLAGS) $(HOST_EXTRARUSTFLAGS) \ +hostrust_flags = --emit=dep-info=$(depfile) \ + $(KBUILD_HOSTRUSTFLAGS) $(HOST_EXTRARUSTFLAGS) \ $(HOSTRUSTFLAGS_$(target-stem)) # $(objtree)/$(obj) for including generated headers from checkin source files
@@ -147,9 +148,7 @@ $(host-cxxobjs): $(obj)/%.o: $(src)/%.cc FORCE # host-rust -> Executable quiet_cmd_host-rust = HOSTRUSTC $@ cmd_host-rust = \ - $(HOSTRUSTC) $(hostrust_flags) --emit=dep-info,link \ - --out-dir=$(obj)/ $<; \ - mv $(obj)/$(target-stem).d $(depfile); \ + $(HOSTRUSTC) $(hostrust_flags) --emit=link=$@ $<; \ sed -i '/^\#/d' $(depfile) $(host-rust): $(obj)/%: $(src)/%.rs FORCE $(call if_changed_dep,host-rust)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 20/236 cifs: use the least loaded channel for sending requests
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shyam Prasad N <[email protected]>
[ Upstream commit ea90708d3cf3d0d92c02afe445ad463fb3c6bf10 ]
Till now, we've used a simple round robin approach to distribute the requests between the channels. This does not work well if the channels consume the requests at different speeds, even if the advertised speeds are the same.
This change will allow the client to pick the channel with least number of requests currently in-flight. This will disregard the link speed, and select a channel based on the current load of the channels.
For cases when all the channels are equally loaded, fall back to the old round robin method.
Stable-dep-of: 8094a600245e ("smb3: missing lock when picking channel")
--- fs/smb/client/transport.c | 33 +++++++++++++++++++++++++++++---- 1 file changed, 29 insertions(+), 4 deletions(-)
fs/smb/client/transport.c +29 -4
@@ -1045,15 +1045,40 @@ cifs_cancelled_callback(struct mid_q_entry *mid)struct TCP_Server_Info *cifs_pick_channel (struct cifs_ses *ses) {uint index =0 ; +unsigned int min_in_flight =UINT_MAX , max_in_flight =0 ; +struct TCP_Server_Info *server =NULL ; +int i;if (!ses)return NULL ; -/* round robin */ - index = (uint )atomic_inc_return (&ses->chan_seq); -spin_lock (&ses->chan_lock); - index %= ses->chan_count; +for (i =0 ; i < ses->chan_count; i++) { + server = ses->chans[i].server; +if (!server) +continue ; + +/* +* strictly speaking, we should pick up req_lock to read +* server->in_flight. But it shouldn't matter much here if we +* race while reading this data. The worst that can happen is +* that we could use a channel that's not least loaded. Avoiding +* taking the lock could help reduce wait time, which is +* important for this function +*/ +if (server->in_flight < min_in_flight) { + min_in_flight = server->in_flight; + index = i; + } +if (server->in_flight > max_in_flight) + max_in_flight = server->in_flight; + } + +/* if all channels are equally loaded, fall back to round-robin */ +if (min_in_flight == max_in_flight) { + index = (uint )atomic_inc_return (&ses->chan_seq); + index %= ses->chan_count; + }spin_unlock (&ses->chan_lock);return ses->chans[index].server;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 21/236 smb3: missing lock when picking channel
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steve French <[email protected]>
[ Upstream commit 8094a600245e9b28eb36a13036f202ad67c1f887 ]
Coverity spotted a place where we should have been holding the channel lock when accessing the ses channel index.
Addresses-Coverity: 1582039 ("Data race condition (MISSING_LOCK)")
--- fs/smb/client/transport.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/smb/client/transport.c +3 -1
@@ -1079,9 +1079,11 @@ struct TCP_Server_Info *cifs_pick_channel(struct cifs_ses *ses) index = (uint )atomic_inc_return (&ses->chan_seq); index %= ses->chan_count; } + + server = ses->chans[index].server;spin_unlock (&ses->chan_lock); -return ses->chans[index].server; +return server; }int
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 22/236 pinctrl: pinctrl-aspeed-g6: Fix register offset for pinconf of GPIOR-T
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Billy Tsai <[email protected]>
[ Upstream commit c10cd03d69403fa0f00be8631bd4cb4690440ebd ]
The register offset to disable the internal pull-down of GPIOR~T is 0x630 instead of 0x620, as specified in the Ast2600 datasheet v15 The datasheet can download from the official Aspeed website.
Message-ID: <[email protected]>
--- drivers/pinctrl/aspeed/pinctrl-aspeed-g6.c | 34 +++++++++++----------- 1 file changed, 17 insertions(+), 17 deletions(-)
drivers/pinctrl/aspeed/pinctrl-aspeed-g6.c +17 -17
@@ -43,7 +43,7 @@#define SCU614 0x614/* Disable GPIO Internal Pull-Down #1 */ #define SCU618 0x618/* Disable GPIO Internal Pull-Down #2 */ #define SCU61C 0x61c/* Disable GPIO Internal Pull-Down #3 */ -#define SCU620 0x620/* Disable GPIO Internal Pull-Down #4 */ +#define SCU630 0x630/* Disable GPIO Internal Pull-Down #4 */ #define SCU634 0x634/* Disable GPIO Internal Pull-Down #5 */ #define SCU638 0x638/* Disable GPIO Internal Pull-Down #6 */ #define SCU690 0x690/* Multi-function Pin Control #24 */
@@ -2494,38 +2494,38 @@ static struct aspeed_pin_config aspeed_g6_configs[] = {ASPEED_PULL_DOWN_PINCONF (D14 ,SCU61C ,0 ),/* GPIOS7 */ -ASPEED_PULL_DOWN_PINCONF (T24 ,SCU620 ,23 ), +ASPEED_PULL_DOWN_PINCONF (T24 ,SCU630 ,23 ),/* GPIOS6 */ -ASPEED_PULL_DOWN_PINCONF (P23 ,SCU620 ,22 ), +ASPEED_PULL_DOWN_PINCONF (P23 ,SCU630 ,22 ),/* GPIOS5 */ -ASPEED_PULL_DOWN_PINCONF (P24 ,SCU620 ,21 ), +ASPEED_PULL_DOWN_PINCONF (P24 ,SCU630 ,21 ),/* GPIOS4 */ -ASPEED_PULL_DOWN_PINCONF (R26 ,SCU620 ,20 ), +ASPEED_PULL_DOWN_PINCONF (R26 ,SCU630 ,20 ),/* GPIOS3*/ -ASPEED_PULL_DOWN_PINCONF (R24 ,SCU620 ,19 ), +ASPEED_PULL_DOWN_PINCONF (R24 ,SCU630 ,19 ),/* GPIOS2 */ -ASPEED_PULL_DOWN_PINCONF (T26 ,SCU620 ,18 ), +ASPEED_PULL_DOWN_PINCONF (T26 ,SCU630 ,18 ),/* GPIOS1 */ -ASPEED_PULL_DOWN_PINCONF (T25 ,SCU620 ,17 ), +ASPEED_PULL_DOWN_PINCONF (T25 ,SCU630 ,17 ),/* GPIOS0 */ -ASPEED_PULL_DOWN_PINCONF (R23 ,SCU620 ,16 ), +ASPEED_PULL_DOWN_PINCONF (R23 ,SCU630 ,16 ),/* GPIOR7 */ -ASPEED_PULL_DOWN_PINCONF (U26 ,SCU620 ,15 ), +ASPEED_PULL_DOWN_PINCONF (U26 ,SCU630 ,15 ),/* GPIOR6 */ -ASPEED_PULL_DOWN_PINCONF (W26 ,SCU620 ,14 ), +ASPEED_PULL_DOWN_PINCONF (W26 ,SCU630 ,14 ),/* GPIOR5 */ -ASPEED_PULL_DOWN_PINCONF (T23 ,SCU620 ,13 ), +ASPEED_PULL_DOWN_PINCONF (T23 ,SCU630 ,13 ),/* GPIOR4 */ -ASPEED_PULL_DOWN_PINCONF (U25 ,SCU620 ,12 ), +ASPEED_PULL_DOWN_PINCONF (U25 ,SCU630 ,12 ),/* GPIOR3*/ -ASPEED_PULL_DOWN_PINCONF (V26 ,SCU620 ,11 ), +ASPEED_PULL_DOWN_PINCONF (V26 ,SCU630 ,11 ),/* GPIOR2 */ -ASPEED_PULL_DOWN_PINCONF (V24 ,SCU620 ,10 ), +ASPEED_PULL_DOWN_PINCONF (V24 ,SCU630 ,10 ),/* GPIOR1 */ -ASPEED_PULL_DOWN_PINCONF (U24 ,SCU620 ,9 ), +ASPEED_PULL_DOWN_PINCONF (U24 ,SCU630 ,9 ),/* GPIOR0 */ -ASPEED_PULL_DOWN_PINCONF (V25 ,SCU620 ,8 ), +ASPEED_PULL_DOWN_PINCONF (V25 ,SCU630 ,8 ),/* GPIOX7 */ ASPEED_PULL_DOWN_PINCONF(AB10, SCU634, 31),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 23/236 pinctrl/meson: fix typo in PDMs pin name
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Dakinevich <[email protected]>
[ Upstream commit 368a90e651faeeb7049a876599cf2b0d74954796 ]
Other pins have _a or _x suffix, but this one doesn't have any. Most likely this is a typo.
Message-ID: <[email protected]>
--- drivers/pinctrl/meson/pinctrl-meson-a1.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/pinctrl/meson/pinctrl-meson-a1.c +3 -3
@@ -250,7 +250,7 @@ static const unsigned int pdm_dclk_x_pins[] = { GPIOX_10 };static const unsigned int pdm_din2_a_pins[] = {GPIOA_6 };static const unsigned int pdm_din1_a_pins[] = {GPIOA_7 };static const unsigned int pdm_din0_a_pins[] = {GPIOA_8 }; -static const unsigned int pdm_dclk_pins[] = {GPIOA_9 }; +static const unsigned int pdm_dclk_a_pins[] = {GPIOA_9 };/* gen_clk */ static const unsigned int gen_clk_x_pins[] = {GPIOX_7 };
@@ -591,7 +591,7 @@ static struct meson_pmx_group meson_a1_periphs_groups[] = {GROUP (pdm_din2_a,3 ),GROUP (pdm_din1_a,3 ),GROUP (pdm_din0_a,3 ), -GROUP (pdm_dclk,3 ), +GROUP (pdm_dclk_a,3 ),GROUP (pwm_c_a,3 ), GROUP(pwm_b_a, 3),
@@ -755,7 +755,7 @@ static const char * const spi_a_groups[] = {static const char *const pdm_groups[] = {"pdm_din0_x" ,"pdm_din1_x" ,"pdm_din2_x" ,"pdm_dclk_x" ,"pdm_din2_a" , -"pdm_din1_a" ,"pdm_din0_a" ,"pdm_dclk" , +"pdm_din1_a" ,"pdm_din0_a" ,"pdm_dclk_a" , };static const char *const gen_clk_groups[] = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 24/236 pinctrl: core: delete incorrect free in pinctrl_enable()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 5038a66dad0199de60e5671603ea6623eb9e5c79 ]
The "pctldev" struct is allocated in devm_pinctrl_register_and_init(). It's a devm_ managed pointer that is freed by devm_pinctrl_dev_release(), so freeing it in pinctrl_enable() will lead to a double free.
The devm_pinctrl_dev_release() function frees the pindescs and destroys the mutex as well.
Message-ID: <[email protected]>
--- drivers/pinctrl/core.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-)
drivers/pinctrl/core.c +1 -7
@@ -2098,13 +2098,7 @@ int pinctrl_enable(struct pinctrl_dev *pctldev) error =pinctrl_claim_hogs (pctldev);if (error) { -dev_err (pctldev->dev,"could not claim hogs: %i\n" , - error); -pinctrl_free_pindescs (pctldev, pctldev->desc->pins, - pctldev->desc->npins); -mutex_destroy (&pctldev->mutex); -kfree (pctldev); - +dev_err (pctldev->dev,"could not claim hogs: %i\n" , error);return error; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 25/236 pinctrl: mediatek: paris: Fix PIN_CONFIG_INPUT_SCHMITT_ENABLE readback
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <[email protected]>
[ Upstream commit 08f66a8edd08f6f7cfa769c81634b29a2b123908 ]
In the generic pin config library, readback of some options are handled differently compared to the setting of those options: the argument value is used to convey enable/disable of an option in the set path, but success or -EINVAL is used to convey if an option is enabled or disabled in the debugfs readback path.
PIN_CONFIG_INPUT_SCHMITT_ENABLE is one such option. Fix the readback of the option in the mediatek-paris library, so that the debugfs dump is not showing "input schmitt enabled" for pins that don't have it enabled.
Message-ID: <[email protected]>
--- drivers/pinctrl/mediatek/pinctrl-paris.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/pinctrl/mediatek/pinctrl-paris.c +2 -0
@@ -188,6 +188,8 @@ static int mtk_pinconf_get(struct pinctrl_dev *pctldev, } err =mtk_hw_get_value (hw, desc,PINCTRL_PIN_REG_SMT , &ret); +if (!ret) + err = -EINVAL ;break ;case PIN_CONFIG_DRIVE_STRENGTH :if (!hw->soc->drive_get)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 26/236 pinctrl: mediatek: paris: Rework support for PIN_CONFIG_{INPUT,OUTPUT}_ENABLE
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <[email protected]>
[ Upstream commit c5d3b64c568a344e998830e0e94a7c04e372f89b ]
There is a misinterpretation of some of the PIN_CONFIG_* options in this driver library. PIN_CONFIG_OUTPUT_ENABLE should refer to a buffer or switch in the output direction of the electrical path. The MediaTek hardware does not have such a thing. The driver incorrectly maps this option to the GPIO function's direction.
Likewise, PIN_CONFIG_INPUT_ENABLE should refer to a buffer or switch in the input direction. The hardware does have such a mechanism, and is mapped to the IES bit. The driver however sets the direction in addition to the IES bit, which is incorrect. On readback, the IES bit isn't even considered.
Ironically, the driver does not support readback for PIN_CONFIG_OUTPUT, while its readback of PIN_CONFIG_{INPUT,OUTPUT}_ENABLE is what it should be doing for PIN_CONFIG_OUTPUT.
Rework support for these three options, so that PIN_CONFIG_OUTPUT_ENABLE is completely removed, PIN_CONFIG_INPUT_ENABLE is only linked to the IES bit, and PIN_CONFIG_OUTPUT is linked to the GPIO function's direction and output level.
Message-ID: <[email protected]>
--- drivers/pinctrl/mediatek/pinctrl-paris.c | 38 +++++++----------------- 1 file changed, 11 insertions(+), 27 deletions(-)
drivers/pinctrl/mediatek/pinctrl-paris.c +11 -27
@@ -160,20 +160,21 @@ static int mtk_pinconf_get(struct pinctrl_dev *pctldev, err =mtk_hw_get_value (hw, desc,PINCTRL_PIN_REG_SR , &ret);break ;case PIN_CONFIG_INPUT_ENABLE : -case PIN_CONFIG_OUTPUT_ENABLE : + err =mtk_hw_get_value (hw, desc,PINCTRL_PIN_REG_IES , &ret); +if (!ret) + err = -EINVAL ; +break ; +case PIN_CONFIG_OUTPUT : err =mtk_hw_get_value (hw, desc,PINCTRL_PIN_REG_DIR , &ret);if (err)break ; -/* CONFIG Current direction return value -* ------------- ----------------- ---------------------- -* OUTPUT_ENABLE output 1 (= HW value) -* input 0 (= HW value) -* INPUT_ENABLE output 0 (= reverse HW value) -* input 1 (= reverse HW value) -*/ -if (param ==PIN_CONFIG_INPUT_ENABLE ) - ret = !ret; +if (!ret) { + err = -EINVAL ; +break ; + } + + err =mtk_hw_get_value (hw, desc,PINCTRL_PIN_REG_DO , &ret);break ;case PIN_CONFIG_INPUT_SCHMITT_ENABLE : err =mtk_hw_get_value (hw, desc,PINCTRL_PIN_REG_DIR , &ret);
@@ -278,26 +279,9 @@ static int mtk_pinconf_set(struct pinctrl_dev *pctldev, unsigned int pin,break ; err = hw->soc->bias_set_combo (hw, desc,0 , arg);break ; -case PIN_CONFIG_OUTPUT_ENABLE : - err =mtk_hw_set_value (hw, desc,PINCTRL_PIN_REG_SMT , -MTK_DISABLE ); -/* Keep set direction to consider the case that a GPIO pin -* does not have SMT control -*/ -if (err != -ENOTSUPP ) -break ; - - err =mtk_hw_set_value (hw, desc,PINCTRL_PIN_REG_DIR , -MTK_OUTPUT ); -break ;case PIN_CONFIG_INPUT_ENABLE :/* regard all non-zero value as enable */ err =mtk_hw_set_value (hw, desc,PINCTRL_PIN_REG_IES , !!arg); -if (err) -break ; - - err =mtk_hw_set_value (hw, desc,PINCTRL_PIN_REG_DIR , -MTK_INPUT );break ;case PIN_CONFIG_SLEW_RATE :/* regard all non-zero value as enable */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 27/236 sunrpc: add a struct rpc_stats arg to rpc_create_args
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <[email protected]>
[ Upstream commit 2057a48d0dd00c6a2a94ded7df2bf1d3f2a4a0da ]
We want to be able to have our rpc stats handled in a per network namespace manner, so add an option to rpc_create_args to specify a different rpc_stats struct instead of using the one on the rpc_program.
Stable-dep-of: 24457f1be29f ("nfs: Handle error of rpc_proc_register() in nfs_net_init().")
--- include/linux/sunrpc/clnt.h | 1 + net/sunrpc/clnt.c | 5 ++++- 2 files changed, 5 insertions(+), 1 deletion(-)
include/linux/sunrpc/clnt.h +1 -0
@@ -131,6 +131,7 @@ struct rpc_create_args {const char *servername;const char *nodename;const struct rpc_program *program; +struct rpc_stat *stats;u32 prognumber;/* overrides program->number */ u32 version;rpc_authflavor_t authflavor;
net/sunrpc/clnt.c +4 -1
@@ -398,7 +398,7 @@ static struct rpc_clnt * rpc_new_client(const struct rpc_create_args *args, clnt->cl_maxproc = version->nrprocs; clnt->cl_prog = args->prognumber ? : program->number; clnt->cl_vers = version->number; - clnt->cl_stats = program->stats; + clnt->cl_stats = args->stats ? : program->stats; clnt->cl_metrics =rpc_alloc_iostats (clnt);rpc_init_pipe_dir_head (&clnt->cl_pipedir_objects); err = -ENOMEM ;
@@ -677,6 +677,7 @@ struct rpc_clnt *rpc_clone_client(struct rpc_clnt *clnt) .version = clnt->cl_vers, .authflavor = clnt->cl_auth->au_flavor, .cred = clnt->cl_cred, + .stats = clnt->cl_stats, };return __rpc_clone_client (&args, clnt); }
@@ -699,6 +700,7 @@ rpc_clone_client_set_auth(struct rpc_clnt *clnt, rpc_authflavor_t flavor) .version = clnt->cl_vers, .authflavor = flavor, .cred = clnt->cl_cred, + .stats = clnt->cl_stats, };return __rpc_clone_client (&args, clnt); }
@@ -1044,6 +1046,7 @@ struct rpc_clnt *rpc_bind_new_program(struct rpc_clnt *old, .version = vers, .authflavor = old->cl_auth->au_flavor, .cred = old->cl_cred, + .stats = old->cl_stats, };struct rpc_clnt *clnt;int err;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 28/236 nfs: expose /proc/net/sunrpc/nfs in net namespaces
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <[email protected]>
[ Upstream commit d47151b79e3220e72ae323b8b8e9d6da20dc884e ]
We're using nfs mounts inside of containers in production and noticed that the nfs stats are not exposed in /proc. This is a problem for us as we use these stats for monitoring, and have to do this awkward bind mount from the main host into the container in order to get to these states.
Add the rpc_proc_register call to the pernet operations entry and exit points so these stats can be exposed inside of network namespaces.
Stable-dep-of: 24457f1be29f ("nfs: Handle error of rpc_proc_register() in nfs_net_init().")
--- fs/nfs/inode.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
fs/nfs/inode.c +2 -4
@@ -2334,11 +2334,13 @@ EXPORT_SYMBOL_GPL(nfs_net_id);static int nfs_net_init (struct net *net) {nfs_clients_init (net); +rpc_proc_register (net, &nfs_rpcstat);return nfs_fs_proc_net_init (net); }static void nfs_net_exit (struct net *net) { +rpc_proc_unregister (net,"nfs" );nfs_fs_proc_net_exit (net);nfs_clients_exit (net); }
@@ -2393,15 +2395,12 @@ static int __init init_nfs_fs(void)if (err) goto out1; -rpc_proc_register (&init_net, &nfs_rpcstat); - err =register_nfs_fs ();if (err) goto out0;return 0 ; out0: -rpc_proc_unregister (&init_net,"nfs" );nfs_destroy_directcache (); out1:nfs_destroy_writepagecache ();
@@ -2431,7 +2430,6 @@ static void __exit exit_nfs_fs(void)nfs_destroy_inodecache ();nfs_destroy_nfspagecache ();unregister_pernet_subsys (&nfs_net_ops); -rpc_proc_unregister (&init_net,"nfs" );unregister_nfs_fs ();nfs_fs_proc_exit ();nfsiod_stop ();
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 29/236 nfs: make the rpc_stat per net namespace
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <[email protected]>
[ Upstream commit 1548036ef1204df65ca5a16e8b199c858cb80075 ]
Now that we're exposing the rpc stats on a per-network namespace basis, move this struct into struct nfs_net and use that to make sure only the per-network namespace stats are exposed.
Stable-dep-of: 24457f1be29f ("nfs: Handle error of rpc_proc_register() in nfs_net_init().")
--- fs/nfs/client.c | 5 ++++- fs/nfs/inode.c | 4 +++- fs/nfs/internal.h | 2 -- fs/nfs/netns.h | 2 ++ 4 files changed, 9 insertions(+), 4 deletions(-)
fs/nfs/client.c +4 -1
@@ -73,7 +73,6 @@ const struct rpc_program nfs_program = { .number = NFS_PROGRAM, .nrvers = ARRAY_SIZE(nfs_version), .version = nfs_version, - .stats = &nfs_rpcstat, .pipe_dir_name = NFS_PIPE_DIRNAME, };
@@ -496,6 +495,7 @@ int nfs_create_rpc_client(struct nfs_client *clp,const struct nfs_client_initdata *cl_init, rpc_authflavor_t flavor) { + struct nfs_net *nn = net_generic(clp->cl_net, nfs_net_id);struct rpc_clnt *clnt =NULL ; struct rpc_create_args args = { .net = clp->cl_net,
@@ -507,6 +507,7 @@ int nfs_create_rpc_client(struct nfs_client *clp, .servername = clp->cl_hostname, .nodename = cl_init->nodename, .program = &nfs_program, + .stats = &nn->rpcstats, .version = clp->rpc_ops->version, .authflavor = flavor, .cred = cl_init->cred,
@@ -1142,6 +1143,8 @@ void nfs_clients_init(struct net *net)#endif spin_lock_init (&nn->nfs_client_lock); nn->boot_time =ktime_get_real (); +memset (&nn->rpcstats,0 ,sizeof (nn->rpcstats)); + nn->rpcstats.program = &nfs_program;nfs_netns_sysfs_setup (nn, net); }
fs/nfs/inode.c +3 -1
@@ -2333,8 +2333,10 @@ EXPORT_SYMBOL_GPL(nfs_net_id);static int nfs_net_init (struct net *net) { +struct nfs_net *nn =net_generic (net, nfs_net_id); +nfs_clients_init (net); -rpc_proc_register (net, &nfs_rpcstat); +rpc_proc_register (net, &nn->rpcstats);return nfs_fs_proc_net_init (net); }
fs/nfs/internal.h +0 -2
@@ -443,8 +443,6 @@ int nfs_try_get_tree(struct fs_context *);int nfs_get_tree_common (struct fs_context *);void nfs_kill_super (struct super_block *); -extern struct rpc_stat nfs_rpcstat; -extern int __init register_nfs_fs (void ); extern void __exit unregister_nfs_fs(void);extern bool nfs_sb_active (struct super_block *sb);
fs/nfs/netns.h +2 -0
@@ -9,6 +9,7 @@#include <linux/nfs4.h> #include <net/net_namespace.h> #include <net/netns/generic.h> +#include <linux/sunrpc/stats.h> struct bl_dev_msg {int32_t status;
@@ -34,6 +35,7 @@ struct nfs_net {struct nfs_netns_client *nfs_client;spinlock_t nfs_client_lock;ktime_t boot_time; +struct rpc_stat rpcstats;#ifdef CONFIG_PROC_FS struct proc_dir_entry *proc_nfsfs;#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 30/236 nfs: Handle error of rpc_proc_register() in nfs_net_init().
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 24457f1be29f1e7042e50a7749f5c2dde8c433c8 ]
syzkaller reported a warning [0] triggered while destroying immature netns.
rpc_proc_register() was called in init_nfs_fs(), but its error has been ignored since at least the initial commit 1da177e4c3f4 ("Linux-2.6.12-rc2").
Recently, commit d47151b79e32 ("nfs: expose /proc/net/sunrpc/nfs in net namespaces") converted the procfs to per-netns and made the problem more visible.
Even when rpc_proc_register() fails, nfs_net_init() could succeed, and thus nfs_net_exit() will be called while destroying the netns.
Then, remove_proc_entry() will be called for non-existing proc directory and trigger the warning below.
Let's handle the error of rpc_proc_register() properly in nfs_net_init().
[0]:
name 'nfs'
WARNING: CPU: 1 PID: 1710 at fs/proc/generic.c:711 remove_proc_entry+0x1bb/0x2d0 fs/proc/generic.c:711 Modules linked in: CPU: 1 PID: 1710 Comm: syz-executor.2 Not tainted 6.8.0-12822-gcd51db110a7e #12 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:remove_proc_entry+0x1bb/0x2d0 fs/proc/generic.c:711 Code: 41 5d 41 5e c3 e8 85 09 b5 ff 48 c7 c7 88 58 64 86 e8 09 0e 71 02 e8 74 09 b5 ff 4c 89 e6 48 c7 c7 de 1b 80 84 e8 c5 ad 97 ff <0f> 0b eb b1 e8 5c 09 b5 ff 48 c7 c7 88 58 64 86 e8 e0 0d 71 02 eb RSP: 0018:ffffc9000c6d7ce0 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff8880422b8b00 RCX: ffffffff8110503c RDX: ffff888030652f00 RSI: ffffffff81105045 RDI: 0000000000000001 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: ffffffff81bb62cb R12: ffffffff84807ffc R13: ffff88804ad6fcc0 R14: ffffffff84807ffc R15: ffffffff85741ff8 FS: 00007f30cfba8640(0000) GS:ffff88807dd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ff51afe8000 CR3: 000000005a60a005 CR4: 0000000000770ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> rpc_proc_unregister+0x64/0x70 net/sunrpc/stats.c:310 nfs_net_exit+0x1c/0x30 fs/nfs/inode.c:2438 ops_exit_list+0x62/0xb0 net/core/net_namespace.c:170 setup_net+0x46c/0x660 net/core/net_namespace.c:372 copy_net_ns+0x244/0x590 net/core/net_namespace.c:505 create_new_namespaces+0x2ed/0x770 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0xae/0x160 kernel/nsproxy.c:228 ksys_unshare+0x342/0x760 kernel/fork.c:3322 __do_sys_unshare kernel/fork.c:3393 [inline] __se_sys_unshare kernel/fork.c:3391 [inline] __x64_sys_unshare+0x1f/0x30 kernel/fork.c:3391 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x4f/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x46/0x4e RIP: 0033:0x7f30d0febe5d Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 9f 1b 00 f7 d8 64 89 01 48 RSP: 002b:00007f30cfba7cc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 RAX: ffffffffffffffda RBX: 00000000004bbf80 RCX: 00007f30d0febe5d RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000006c020600 RBP: 00000000004bbf80 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 R13: 000000000000000b R14: 00007f30d104c530 R15: 0000000000000000 </TASK>
--- fs/nfs/inode.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
fs/nfs/inode.c +6 -1
@@ -2336,7 +2336,12 @@ static int nfs_net_init(struct net *net)struct nfs_net *nn =net_generic (net, nfs_net_id);nfs_clients_init (net); -rpc_proc_register (net, &nn->rpcstats); + +if (!rpc_proc_register (net, &nn->rpcstats)) { +nfs_clients_exit (net); +return -ENOMEM ; + } +return nfs_fs_proc_net_init (net); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 31/236 pinctrl: Introduce struct pinfunction and PINCTRL_PINFUNCTION() macro
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 443a0a0f0cf4f432c7af6654b7f2f920d411d379 ]
There are many pin control drivers define their own data type for pin function representation which is the same or embed the same data as newly introduced one. Provide the data type and convenient macro for all pin control drivers.
Stable-dep-of: fed6d9a8e6a6 ("pinctrl: baytrail: Fix selecting gpio pinctrl state")
--- include/linux/pinctrl/pinctrl.h | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)
include/linux/pinctrl/pinctrl.h +20 -0
@@ -206,6 +206,26 @@ extern int pinctrl_get_group_pins(struct pinctrl_dev *pctldev, const char *pin_group, const unsigned **pins, unsigned *num_pins); +/** +* struct pinfunction - Description about a function +* @name: Name of the function +* @groups: An array of groups for this function +* @ngroups: Number of groups in @groups +*/ +struct pinfunction { +const char *name; +const char *const *groups; +size_t ngroups; +}; + +/* Convenience macro to define a single named pinfunction */ +#define PINCTRL_PINFUNCTION (_name, _groups, _ngroups) \ +(struct pinfunction) { \ + .name = (_name), \ + .groups = (_groups), \ + .ngroups = (_ngroups), \ + } +#if IS_ENABLED (CONFIG_OF ) &&IS_ENABLED (CONFIG_PINCTRL )extern struct pinctrl_dev *of_pinctrl_get (struct device_node *np);#else
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 32/236 pinctrl: intel: Make use of struct pinfunction and PINCTRL_PINFUNCTION()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 999b85bfd765f273208cd7348b2977d3c5ae0753 ]
Since pin control provides a generic data type and a macro for the pin function definition, use them in the Intel driver.
Stable-dep-of: fed6d9a8e6a6 ("pinctrl: baytrail: Fix selecting gpio pinctrl state")
--- drivers/pinctrl/intel/pinctrl-intel.c | 6 +++--- drivers/pinctrl/intel/pinctrl-intel.h | 13 ++++++++----- 2 files changed, 11 insertions(+), 8 deletions(-)
drivers/pinctrl/intel/pinctrl-intel.c +3 -3
@@ -362,7 +362,7 @@ static const char *intel_get_function_name(struct pinctrl_dev *pctldev, {struct intel_pinctrl *pctrl =pinctrl_dev_get_drvdata (pctldev); -return pctrl->soc->functions[function].name; +return pctrl->soc->functions[function].func.name; } static int intel_get_function_groups(struct pinctrl_dev *pctldev,
@@ -372,8 +372,8 @@ static int intel_get_function_groups(struct pinctrl_dev *pctldev, {struct intel_pinctrl *pctrl =pinctrl_dev_get_drvdata (pctldev); - *groups = pctrl->soc->functions[function].groups; - *ngroups = pctrl->soc->functions[function].ngroups; + *groups = pctrl->soc->functions[function].func.groups; + *ngroups = pctrl->soc->functions[function].func.ngroups;return 0 ; }
drivers/pinctrl/intel/pinctrl-intel.h +8 -5
@@ -36,11 +36,13 @@ struct intel_pingroup {/** * struct intel_function - Description about a function +* @func: Generic data of the pin function (name and groups of pins) * @name: Name of the function * @groups: An array of groups for this function * @ngroups: Number of groups in @groups */ struct intel_function { +struct pinfunction func;const char *name;const char *const *groups;size_t ngroups;
@@ -158,11 +160,12 @@ struct intel_community { .modes = __builtin_choose_expr(__builtin_constant_p((m)), NULL, (m)), \ } -#define FUNCTION (n, g) \ - { \ - .name = (n), \ - .groups = (g), \ - .ngroups = ARRAY_SIZE((g)), \ +#define FUNCTION (n, g) \ + { \ + .func = PINCTRL_PINFUNCTION((n), (g), ARRAY_SIZE(g)), \ + .name = (n), \ + .groups = (g), \ + .ngroups = ARRAY_SIZE((g)), \ }/**
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 33/236 pinctrl: baytrail: Fix selecting gpio pinctrl state
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit fed6d9a8e6a60ecf6506d0ea004040fbaa109927 ]
For all the "score" pin-groups all the intel_pingroup-s to select the non GPIO function are re-used for byt_score_gpio_groups[].
But this is incorrect since a pin-group includes the mode setting, which for the non GPIO functions generally is 1, where as to select the GPIO function mode must be set to 0.
So the GPIO function needs separate intel_pingroup-s with their own mode value of 0.
Add a new PIN_GROUP_GPIO macro which adds a foo_gpio entry to each pin-group defined this way and update byt_score_gpio_groups[] to point to the new foo_gpio entries.
The "sus" usb_oc_grp usb_ulpi_grp and pcu_spi_grp pin-groups are special because these have a non 0 mode value to select the GPIO functions and these already have matching foo_gpio pin-groups, leave these are unchanged.
The pmu_clk "sus" groups added in commit 2f46d7f7e959 ("pinctrl: baytrail:
Add pinconf group + function for the pmu_clk") do need to use the new PIN_GROUP_GPIO macro.
--- drivers/pinctrl/intel/pinctrl-baytrail.c | 74 ++++++++++++------------ drivers/pinctrl/intel/pinctrl-intel.h | 4 ++ 2 files changed, 42 insertions(+), 36 deletions(-)
drivers/pinctrl/intel/pinctrl-baytrail.c +38 -36
@@ -276,33 +276,33 @@ static const unsigned int byt_score_plt_clk5_pins[] = { 101 };static const unsigned int byt_score_smbus_pins[] = {51 ,52 ,53 };static const struct intel_pingroup byt_score_groups[] = { -PIN_GROUP ("uart1_grp" , byt_score_uart1_pins,1 ), -PIN_GROUP ("uart2_grp" , byt_score_uart2_pins,1 ), -PIN_GROUP ("pwm0_grp" , byt_score_pwm0_pins,1 ), -PIN_GROUP ("pwm1_grp" , byt_score_pwm1_pins,1 ), -PIN_GROUP ("ssp2_grp" , byt_score_ssp2_pins,1 ), -PIN_GROUP ("sio_spi_grp" , byt_score_sio_spi_pins,1 ), -PIN_GROUP ("i2c5_grp" , byt_score_i2c5_pins,1 ), -PIN_GROUP ("i2c6_grp" , byt_score_i2c6_pins,1 ), -PIN_GROUP ("i2c4_grp" , byt_score_i2c4_pins,1 ), -PIN_GROUP ("i2c3_grp" , byt_score_i2c3_pins,1 ), -PIN_GROUP ("i2c2_grp" , byt_score_i2c2_pins,1 ), -PIN_GROUP ("i2c1_grp" , byt_score_i2c1_pins,1 ), -PIN_GROUP ("i2c0_grp" , byt_score_i2c0_pins,1 ), -PIN_GROUP ("ssp0_grp" , byt_score_ssp0_pins,1 ), -PIN_GROUP ("ssp1_grp" , byt_score_ssp1_pins,1 ), -PIN_GROUP ("sdcard_grp" , byt_score_sdcard_pins, byt_score_sdcard_mux_values), -PIN_GROUP ("sdio_grp" , byt_score_sdio_pins,1 ), -PIN_GROUP ("emmc_grp" , byt_score_emmc_pins,1 ), -PIN_GROUP ("lpc_grp" , byt_score_ilb_lpc_pins,1 ), -PIN_GROUP ("sata_grp" , byt_score_sata_pins,1 ), -PIN_GROUP ("plt_clk0_grp" , byt_score_plt_clk0_pins,1 ), -PIN_GROUP ("plt_clk1_grp" , byt_score_plt_clk1_pins,1 ), -PIN_GROUP ("plt_clk2_grp" , byt_score_plt_clk2_pins,1 ), -PIN_GROUP ("plt_clk3_grp" , byt_score_plt_clk3_pins,1 ), -PIN_GROUP ("plt_clk4_grp" , byt_score_plt_clk4_pins,1 ), -PIN_GROUP ("plt_clk5_grp" , byt_score_plt_clk5_pins,1 ), -PIN_GROUP ("smbus_grp" , byt_score_smbus_pins,1 ), +PIN_GROUP_GPIO ("uart1_grp" , byt_score_uart1_pins,1 ), +PIN_GROUP_GPIO ("uart2_grp" , byt_score_uart2_pins,1 ), +PIN_GROUP_GPIO ("pwm0_grp" , byt_score_pwm0_pins,1 ), +PIN_GROUP_GPIO ("pwm1_grp" , byt_score_pwm1_pins,1 ), +PIN_GROUP_GPIO ("ssp2_grp" , byt_score_ssp2_pins,1 ), +PIN_GROUP_GPIO ("sio_spi_grp" , byt_score_sio_spi_pins,1 ), +PIN_GROUP_GPIO ("i2c5_grp" , byt_score_i2c5_pins,1 ), +PIN_GROUP_GPIO ("i2c6_grp" , byt_score_i2c6_pins,1 ), +PIN_GROUP_GPIO ("i2c4_grp" , byt_score_i2c4_pins,1 ), +PIN_GROUP_GPIO ("i2c3_grp" , byt_score_i2c3_pins,1 ), +PIN_GROUP_GPIO ("i2c2_grp" , byt_score_i2c2_pins,1 ), +PIN_GROUP_GPIO ("i2c1_grp" , byt_score_i2c1_pins,1 ), +PIN_GROUP_GPIO ("i2c0_grp" , byt_score_i2c0_pins,1 ), +PIN_GROUP_GPIO ("ssp0_grp" , byt_score_ssp0_pins,1 ), +PIN_GROUP_GPIO ("ssp1_grp" , byt_score_ssp1_pins,1 ), +PIN_GROUP_GPIO ("sdcard_grp" , byt_score_sdcard_pins, byt_score_sdcard_mux_values), +PIN_GROUP_GPIO ("sdio_grp" , byt_score_sdio_pins,1 ), +PIN_GROUP_GPIO ("emmc_grp" , byt_score_emmc_pins,1 ), +PIN_GROUP_GPIO ("lpc_grp" , byt_score_ilb_lpc_pins,1 ), +PIN_GROUP_GPIO ("sata_grp" , byt_score_sata_pins,1 ), +PIN_GROUP_GPIO ("plt_clk0_grp" , byt_score_plt_clk0_pins,1 ), +PIN_GROUP_GPIO ("plt_clk1_grp" , byt_score_plt_clk1_pins,1 ), +PIN_GROUP_GPIO ("plt_clk2_grp" , byt_score_plt_clk2_pins,1 ), +PIN_GROUP_GPIO ("plt_clk3_grp" , byt_score_plt_clk3_pins,1 ), +PIN_GROUP_GPIO ("plt_clk4_grp" , byt_score_plt_clk4_pins,1 ), +PIN_GROUP_GPIO ("plt_clk5_grp" , byt_score_plt_clk5_pins,1 ), +PIN_GROUP_GPIO ("smbus_grp" , byt_score_smbus_pins,1 ), };static const char *const byt_score_uart_groups[] = {
@@ -330,12 +330,14 @@ static const char * const byt_score_plt_clk_groups[] = { };static const char *const byt_score_smbus_groups[] = {"smbus_grp" };static const char *const byt_score_gpio_groups[] = { -"uart1_grp" ,"uart2_grp" ,"pwm0_grp" ,"pwm1_grp" ,"ssp0_grp" , -"ssp1_grp" ,"ssp2_grp" ,"sio_spi_grp" ,"i2c0_grp" ,"i2c1_grp" , -"i2c2_grp" ,"i2c3_grp" ,"i2c4_grp" ,"i2c5_grp" ,"i2c6_grp" , -"sdcard_grp" ,"sdio_grp" ,"emmc_grp" ,"lpc_grp" ,"sata_grp" , -"plt_clk0_grp" ,"plt_clk1_grp" ,"plt_clk2_grp" ,"plt_clk3_grp" , -"plt_clk4_grp" ,"plt_clk5_grp" ,"smbus_grp" , +"uart1_grp_gpio" ,"uart2_grp_gpio" ,"pwm0_grp_gpio" , +"pwm1_grp_gpio" ,"ssp0_grp_gpio" ,"ssp1_grp_gpio" ,"ssp2_grp_gpio" , +"sio_spi_grp_gpio" ,"i2c0_grp_gpio" ,"i2c1_grp_gpio" ,"i2c2_grp_gpio" , +"i2c3_grp_gpio" ,"i2c4_grp_gpio" ,"i2c5_grp_gpio" ,"i2c6_grp_gpio" , +"sdcard_grp_gpio" ,"sdio_grp_gpio" ,"emmc_grp_gpio" ,"lpc_grp_gpio" , +"sata_grp_gpio" ,"plt_clk0_grp_gpio" ,"plt_clk1_grp_gpio" , +"plt_clk2_grp_gpio" ,"plt_clk3_grp_gpio" ,"plt_clk4_grp_gpio" , +"plt_clk5_grp_gpio" ,"smbus_grp_gpio" , };static const struct intel_function byt_score_functions[] = {
@@ -454,8 +456,8 @@ static const struct intel_pingroup byt_sus_groups[] = {PIN_GROUP ("usb_oc_grp_gpio" , byt_sus_usb_over_current_pins, byt_sus_usb_over_current_gpio_mode_values),PIN_GROUP ("usb_ulpi_grp_gpio" , byt_sus_usb_ulpi_pins, byt_sus_usb_ulpi_gpio_mode_values),PIN_GROUP ("pcu_spi_grp_gpio" , byt_sus_pcu_spi_pins, byt_sus_pcu_spi_gpio_mode_values), -PIN_GROUP ("pmu_clk1_grp" , byt_sus_pmu_clk1_pins,1 ), - PIN_GROUP("pmu_clk2_grp", byt_sus_pmu_clk2_pins, 1), +PIN_GROUP_GPIO ("pmu_clk1_grp" , byt_sus_pmu_clk1_pins,1 ), + PIN_GROUP_GPIO("pmu_clk2_grp", byt_sus_pmu_clk2_pins, 1), }; static const char * const byt_sus_usb_groups[] = {
@@ -467,7 +469,7 @@ static const char * const byt_sus_pmu_clk_groups[] = { };static const char *const byt_sus_gpio_groups[] = {"usb_oc_grp_gpio" ,"usb_ulpi_grp_gpio" ,"pcu_spi_grp_gpio" , -"pmu_clk1_grp" ,"pmu_clk2_grp" , +"pmu_clk1_grp_gpio" ,"pmu_clk2_grp_gpio" , };static const struct intel_function byt_sus_functions[] = {
drivers/pinctrl/intel/pinctrl-intel.h +4 -0
@@ -160,6 +160,10 @@ struct intel_community { .modes = __builtin_choose_expr(__builtin_constant_p((m)), NULL, (m)), \ } +#define PIN_GROUP_GPIO (n, p, m) \ + PIN_GROUP(n, p, m), \ + PIN_GROUP(n "_gpio", p, 0) +#define FUNCTION (n, g) \ { \ .func = PINCTRL_PINFUNCTION((n), (g), ARRAY_SIZE(g)), \
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 34/236 power: rt9455: hide unused rt9455_boost_voltage_values
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 452d8950db3e839aba1bb13bc5378f4bac11fa04 ]
The rt9455_boost_voltage_values[] array is only used when USB PHY support is enabled, causing a W=1 warning otherwise:
drivers/power/supply/rt9455_charger.c:200:18: error: 'rt9455_boost_voltage_values' defined but not used [-Werror=unused-const-variable=]
Enclose the definition in the same #ifdef as the references to it.
--- drivers/power/supply/rt9455_charger.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/power/supply/rt9455_charger.c +2 -0
@@ -193,6 +193,7 @@ static const int rt9455_voreg_values[] = { 4450000, 4450000, 4450000, 4450000, 4450000, 4450000, 4450000, 4450000 }; +#if IS_ENABLED (CONFIG_USB_PHY )/* * When the charger is in boost mode, REG02[7:2] represent boost output * voltage.
@@ -208,6 +209,7 @@ static const int rt9455_boost_voltage_values[] = {5600000 ,5600000 ,5600000 ,5600000 ,5600000 ,5600000 ,5600000 ,5600000 , 5600000, 5600000, 5600000, 5600000, 5600000, 5600000, 5600000, 5600000, }; +#endif /* REG07[3:0] (VMREG) in uV */ static const int rt9455_vmreg_values[] = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 35/236 power: supply: mt6360_charger: Fix of_match for usb-otg-vbus regulator
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <[email protected]>
[ Upstream commit 1e0fb113646182e073539db96016b00cfeb18ecc ]
The of_match shall correspond to the name of the regulator subnode, or the deprecated regulator-compatible property must be used:
failing to do so, the regulator won't probe (and the driver will as well not probe).
Since the devicetree binding for this driver is actually correct and wants DTs to use the "usb-otg-vbus-regulator" subnode name, fix this driver by aligning the of_match string to what the DT binding wants.
--- drivers/power/supply/mt6360_charger.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/power/supply/mt6360_charger.c +1 -1
@@ -591,7 +591,7 @@ static const struct regulator_ops mt6360_chg_otg_ops = { };static const struct regulator_desc mt6360_otg_rdesc = { - .of_match ="usb-otg-vbus" , + .of_match ="usb-otg-vbus-regulator" , .name ="usb-otg-vbus" , .ops = &mt6360_chg_otg_ops, .owner =THIS_MODULE ,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 36/236 pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zeng Heng <[email protected]>
[ Upstream commit a0cedbcc8852d6c77b00634b81e41f17f29d9404 ]
If we fail to allocate propname buffer, we need to drop the reference count we just took. Because the pinctrl_dt_free_maps() includes the droping operation, here we call it directly.
Message-ID: <[email protected]>
--- drivers/pinctrl/devicetree.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/pinctrl/devicetree.c +6 -4
@@ -220,14 +220,16 @@ int pinctrl_dt_to_map(struct pinctrl *p, struct pinctrl_dev *pctldev)for (state =0 ; ; state++) {/* Retrieve the pinctrl-* property */ propname =kasprintf (GFP_KERNEL ,"pinctrl-%d" , state); -if (!propname) -return -ENOMEM ; +if (!propname) { + ret = -ENOMEM ; + goto err; + } prop =of_find_property (np, propname, &size);kfree (propname);if (!prop) {if (state ==0 ) { -of_node_put (np); -return -ENODEV ; + ret = -ENODEV ; + goto err; }break ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 37/236 regulator: mt6360: De-capitalize devicetree regulator subnodes
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <[email protected]>
[ Upstream commit d3cf8a17498dd9104c04ad28eeac3ef3339f9f9f ]
The MT6360 regulator binding, the example in the MT6360 mfd binding, and the devicetree users of those bindings are rightfully declaring MT6360 regulator subnodes with non-capital names, and luckily without using the deprecated regulator-compatible property.
With this driver declaring capitalized BUCKx/LDOx as of_match string for the node names, obviously no regulator gets probed: fix that by changing the MT6360_REGULATOR_DESC macro to add a "match" parameter which gets assigned to the of_match.
--- drivers/regulator/mt6360-regulator.c | 32 +++++++++++++++++----------- 1 file changed, 20 insertions(+), 12 deletions(-)
drivers/regulator/mt6360-regulator.c +20 -12
@@ -319,15 +319,15 @@ static unsigned int mt6360_regulator_of_map_mode(unsigned int hw_mode) } } -#define MT6360_REGULATOR_DESC (_name, _sname, ereg, emask, vreg, vmask, \ - mreg, mmask, streg, stmask, vranges, \ - vcnts, offon_delay, irq_tbls) \ +#define MT6360_REGULATOR_DESC (match, _name, _sname, ereg, emask, vreg, \ + vmask, mreg, mmask, streg, stmask, \ + vranges, vcnts, offon_delay, irq_tbls) \ { \ .desc = { \ .name = #_name, \ .supply_name = #_sname, \ .id = MT6360_REGULATOR_##_name, \ - .of_match = of_match_ptr(#_name), \ + .of_match = of_match_ptr(match), \ .regulators_node = of_match_ptr("regulator"), \ .of_map_mode = mt6360_regulator_of_map_mode, \ .owner = THIS_MODULE, \
@@ -351,21 +351,29 @@ static unsigned int mt6360_regulator_of_map_mode(unsigned int hw_mode) }static const struct mt6360_regulator_desc mt6360_regulator_descs[] = { -MT6360_REGULATOR_DESC (BUCK1 ,BUCK1_VIN ,0x117 ,0x40 ,0x110 ,0xff ,0x117 ,0x30 ,0x117 ,0x04 , +MT6360_REGULATOR_DESC ("buck1" ,BUCK1 ,BUCK1_VIN , +0x117 ,0x40 ,0x110 ,0xff ,0x117 ,0x30 ,0x117 ,0x04 , buck_vout_ranges,256 ,0 , buck1_irq_tbls), -MT6360_REGULATOR_DESC (BUCK2 ,BUCK2_VIN ,0x127 ,0x40 ,0x120 ,0xff ,0x127 ,0x30 ,0x127 ,0x04 , +MT6360_REGULATOR_DESC ("buck2" ,BUCK2 ,BUCK2_VIN , +0x127 ,0x40 ,0x120 ,0xff ,0x127 ,0x30 ,0x127 ,0x04 , buck_vout_ranges,256 ,0 , buck2_irq_tbls), -MT6360_REGULATOR_DESC (LDO6 ,LDO_VIN3 ,0x137 ,0x40 ,0x13B ,0xff ,0x137 ,0x30 ,0x137 ,0x04 , +MT6360_REGULATOR_DESC ("ldo6" ,LDO6 ,LDO_VIN3 , +0x137 ,0x40 ,0x13B ,0xff ,0x137 ,0x30 ,0x137 ,0x04 , ldo_vout_ranges1,256 ,0 , ldo6_irq_tbls), -MT6360_REGULATOR_DESC (LDO7 ,LDO_VIN3 ,0x131 ,0x40 ,0x135 ,0xff ,0x131 ,0x30 ,0x131 ,0x04 , +MT6360_REGULATOR_DESC ("ldo7" ,LDO7 ,LDO_VIN3 , +0x131 ,0x40 ,0x135 ,0xff ,0x131 ,0x30 ,0x131 ,0x04 , ldo_vout_ranges1,256 ,0 , ldo7_irq_tbls), -MT6360_REGULATOR_DESC (LDO1 ,LDO_VIN1 ,0x217 ,0x40 ,0x21B ,0xff ,0x217 ,0x30 ,0x217 ,0x04 , +MT6360_REGULATOR_DESC ("ldo1" ,LDO1 ,LDO_VIN1 , +0x217 ,0x40 ,0x21B ,0xff ,0x217 ,0x30 ,0x217 ,0x04 , ldo_vout_ranges2,256 ,0 , ldo1_irq_tbls), -MT6360_REGULATOR_DESC (LDO2 ,LDO_VIN1 ,0x211 ,0x40 ,0x215 ,0xff ,0x211 ,0x30 ,0x211 ,0x04 , +MT6360_REGULATOR_DESC ("ldo2" ,LDO2 ,LDO_VIN1 , +0x211 ,0x40 ,0x215 ,0xff ,0x211 ,0x30 ,0x211 ,0x04 , ldo_vout_ranges2,256 ,0 , ldo2_irq_tbls), -MT6360_REGULATOR_DESC (LDO3 ,LDO_VIN1 ,0x205 ,0x40 ,0x209 ,0xff ,0x205 ,0x30 ,0x205 ,0x04 , +MT6360_REGULATOR_DESC ("ldo3" ,LDO3 ,LDO_VIN1 , +0x205 ,0x40 ,0x209 ,0xff ,0x205 ,0x30 ,0x205 ,0x04 , ldo_vout_ranges2,256 ,100 , ldo3_irq_tbls), -MT6360_REGULATOR_DESC (LDO5 ,LDO_VIN2 ,0x20B ,0x40 ,0x20F ,0x7f ,0x20B ,0x30 ,0x20B ,0x04 , +MT6360_REGULATOR_DESC ("ldo5" ,LDO5 ,LDO_VIN2 , +0x20B ,0x40 ,0x20F ,0x7f ,0x20B ,0x30 ,0x20B ,0x04 , ldo_vout_ranges3,128 ,100 , ldo5_irq_tbls), };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 38/236 regulator: change stubbed devm_regulator_get_enable to return Ok
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matti Vaittinen <[email protected]>
[ Upstream commit 96e20adc43c4f81e9163a5188cee75a6dd393e09 ]
The devm_regulator_get_enable() should be a 'call and forget' API, meaning, when it is used to enable the regulators, the API does not provide a handle to do any further control of the regulators. It gives no real benefit to return an error from the stub if CONFIG_REGULATOR is not set.
On the contrary, returning and error is causing problems to drivers when hardware is such it works out just fine with no regulator control. Returning an error forces drivers to specifically handle the case where CONFIG_REGULATOR is not set, making the mere existence of the stub questionalble. Furthermore, the stub of the regulator_enable() seems to be returning Ok.
Change the stub implementation for the devm_regulator_get_enable() to return Ok so drivers do not separately handle the case where the CONFIG_REGULATOR is not set.
--- include/linux/regulator/consumer.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/regulator/consumer.h +1 -1
@@ -361,7 +361,7 @@ devm_regulator_get_exclusive(struct device *dev, const char *id)static inline int devm_regulator_get_enable (struct device *dev,const char *id) { -return -ENODEV ; +return 0 ; } static inline int devm_regulator_get_enable_optional(struct device *dev,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 39/236 regulator: change devm_regulator_get_enable_optional() stub to return Ok
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matti Vaittinen <[email protected]>
[ Upstream commit ff33132605c1a0acea59e4c523cb7c6fabe856b2 ]
The devm_regulator_get_enable_optional() should be a 'call and forget' API, meaning, when it is used to enable the regulators, the API does not provide a handle to do any further control of the regulators. It gives no real benefit to return an error from the stub if CONFIG_REGULATOR is not set.
On the contrary, returning an error is causing problems to drivers when hardware is such it works out just fine with no regulator control. Returning an error forces drivers to specifically handle the case where CONFIG_REGULATOR is not set, making the mere existence of the stub questionalble.
Change the stub implementation for the devm_regulator_get_enable_optional() to return Ok so drivers do not separately handle the case where the CONFIG_REGULATOR is not set.
--- include/linux/regulator/consumer.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/regulator/consumer.h +1 -1
@@ -367,7 +367,7 @@ static inline int devm_regulator_get_enable(struct device *dev, const char *id)static inline int devm_regulator_get_enable_optional (struct device *dev,const char *id) { -return -ENODEV ; +return 0 ; } static inline struct regulator *__must_check
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 40/236 bpf, kconfig: Fix DEBUG_INFO_BTF_MODULES Kconfig definition
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrii Nakryiko <[email protected]>
[ Upstream commit 229087f6f1dc2d0c38feba805770f28529980ec0 ]
Turns out that due to CONFIG_DEBUG_INFO_BTF_MODULES not having an explicitly specified "menu item name" in Kconfig, it's basically impossible to turn it off (see [0]).
This patch fixes the issue by defining menu name for CONFIG_DEBUG_INFO_BTF_MODULES, which makes it actually adjustable and independent of CONFIG_DEBUG_INFO_BTF, in the sense that one can have DEBUG_INFO_BTF=y and DEBUG_INFO_BTF_MODULES=n.
We still keep it as defaulting to Y, of course.
--- lib/Kconfig.debug | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
lib/Kconfig.debug +3 -2
@@ -343,7 +343,7 @@ config DEBUG_INFO_SPLIT Incompatible with older versions of ccache. config DEBUG_INFO_BTF - bool "Generate BTF typeinfo" + bool "Generate BTF type information" depends on !DEBUG_INFO_SPLIT && !DEBUG_INFO_REDUCED depends on !GCC_PLUGIN_RANDSTRUCT || COMPILE_TEST depends on BPF_SYSCALL
@@ -374,7 +374,8 @@ config PAHOLE_HAS_LANG_EXCLUDE using DEBUG_INFO_BTF_MODULES. config DEBUG_INFO_BTF_MODULES - def_bool y + bool "Generate BTF type information for kernel modules" + default y depends on DEBUG_INFO_BTF && MODULES && PAHOLE_HAS_SPLIT_BTF help Generate compact split BTF type information for kernel modules.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 41/236 bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Xing <[email protected]>
[ Upstream commit 6648e613226e18897231ab5e42ffc29e63fa3365 ]
Fix NULL pointer data-races in sk_psock_skb_ingress_enqueue() which syzbot reported [1].
[1]
BUG: KCSAN: data-race in sk_psock_drop / sk_psock_skb_ingress_enqueue
write to 0xffff88814b3278b8 of 8 bytes by task 10724 on cpu 1:
sk_psock_stop_verdict net/core/skmsg.c:1257 [inline] sk_psock_drop+0x13e/0x1f0 net/core/skmsg.c:843 sk_psock_put include/linux/skmsg.h:459 [inline] sock_map_close+0x1a7/0x260 net/core/sock_map.c:1648 unix_release+0x4b/0x80 net/unix/af_unix.c:1048 __sock_release net/socket.c:659 [inline] sock_close+0x68/0x150 net/socket.c:1421 __fput+0x2c1/0x660 fs/file_table.c:422 __fput_sync+0x44/0x60 fs/file_table.c:507 __do_sys_close fs/open.c:1556 [inline] __se_sys_close+0x101/0x1b0 fs/open.c:1541 __x64_sys_close+0x1f/0x30 fs/open.c:1541 do_syscall_64+0xd3/0x1d0 entry_SYSCALL_64_after_hwframe+0x6d/0x75
read to 0xffff88814b3278b8 of 8 bytes by task 10713 on cpu 0:
sk_psock_data_ready include/linux/skmsg.h:464 [inline] sk_psock_skb_ingress_enqueue+0x32d/0x390 net/core/skmsg.c:555 sk_psock_skb_ingress_self+0x185/0x1e0 net/core/skmsg.c:606 sk_psock_verdict_apply net/core/skmsg.c:1008 [inline] sk_psock_verdict_recv+0x3e4/0x4a0 net/core/skmsg.c:1202 unix_read_skb net/unix/af_unix.c:2546 [inline] unix_stream_read_skb+0x9e/0xf0 net/unix/af_unix.c:2682 sk_psock_verdict_data_ready+0x77/0x220 net/core/skmsg.c:1223 unix_stream_sendmsg+0x527/0x860 net/unix/af_unix.c:2339 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x140/0x180 net/socket.c:745 ____sys_sendmsg+0x312/0x410 net/socket.c:2584 ___sys_sendmsg net/socket.c:2638 [inline] __sys_sendmsg+0x1e9/0x280 net/socket.c:2667 __do_sys_sendmsg net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline] __x64_sys_sendmsg+0x46/0x50 net/socket.c:2674 do_syscall_64+0xd3/0x1d0 entry_SYSCALL_64_after_hwframe+0x6d/0x75
value changed: 0xffffffff83d7feb0 -> 0x0000000000000000
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 10713 Comm: syz-executor.4 Tainted: G W 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
Prior to this, commit 4cd12c6065df ("bpf, sockmap: Fix NULL pointer dereference in sk_psock_verdict_data_ready()") fixed one NULL pointer similarly due to no protection of saved_data_ready. Here is another different caller causing the same issue because of the same reason. So we should protect it with sk_callback_lock read lock because the writer side in the sk_psock_drop() uses "write_lock_bh(&sk->sk_callback_lock);".
To avoid errors that could happen in future, I move those two pairs of lock into the sk_psock_data_ready(), which is suggested by John Fastabend.
--- include/linux/skmsg.h | 2 ++ net/core/skmsg.c | 5 +---- 2 files changed, 3 insertions(+), 4 deletions(-)
include/linux/skmsg.h +2 -0
@@ -456,10 +456,12 @@ static inline void sk_psock_put(struct sock *sk, struct sk_psock *psock)static inline void sk_psock_data_ready (struct sock *sk,struct sk_psock *psock) { +read_lock_bh (&sk->sk_callback_lock);if (psock->saved_data_ready) psock->saved_data_ready (sk);else sk->sk_data_ready (sk); +read_unlock_bh (&sk->sk_callback_lock); } static inline void psock_set_prog(struct bpf_prog **pprog,
net/core/skmsg.c +1 -4
@@ -1217,11 +1217,8 @@ static void sk_psock_verdict_data_ready(struct sock *sk)rcu_read_lock (); psock =sk_psock (sk); -if (psock) { -read_lock_bh (&sk->sk_callback_lock); +if (psock)sk_psock_data_ready (sk, psock); -read_unlock_bh (&sk->sk_callback_lock); - }rcu_read_unlock (); } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 42/236 nvme: fix warn output about shared namespaces without CONFIG_NVME_MULTIPATH
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yi Zhang <[email protected]>
[ Upstream commit 0bc2e80b9be51712b19e919db5abc97a418f8292 ]
Move the stray '.' that is currently at the end of the line after newline '\n' to before newline character which is the right position.
--- drivers/nvme/host/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nvme/host/core.c +1 -1
@@ -4284,7 +4284,7 @@ static int nvme_init_ns_head(struct nvme_ns *ns, struct nvme_ns_info *info)"Found shared namespace %d, but multipathing not supported.\n" , info->nsid);dev_warn_once (ctrl->device, -"Support for shared namespaces without CONFIG_NVME_MULTIPATH is deprecated and will be removed in Linux 6.0\n." ); +"Support for shared namespaces without CONFIG_NVME_MULTIPATH is deprecated and will be removed in Linux 6.0.\n" ); } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 43/236 bpf: Fix a verifier verbose message
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anton Protopopov <[email protected]>
[ Upstream commit 37eacb9f6e89fb399a79e952bc9c78eb3e16290e ]
Long ago a map file descriptor in a pseudo ldimm64 instruction could only be present as an immediate value insn[0].imm, and thus this value was used in a verbose verifier message printed when the file descriptor wasn't valid. Since addition of BPF_PSEUDO_MAP_IDX_VALUE/BPF_PSEUDO_MAP_IDX the insn[0].imm field can also contain an index pointing to the file descriptor in the attr.fd_array array. However, if the file descriptor is invalid, the verifier still prints the verbose message containing value of insn[0].imm. Patch the verifier message to always print the actual file descriptor value.
--- kernel/bpf/verifier.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
kernel/bpf/verifier.c +1 -2
@@ -13177,8 +13177,7 @@ static int resolve_pseudo_ldimm64(struct bpf_verifier_env *env) f =fdget (fd); map =__bpf_map_get (f);if (IS_ERR (map)) { -verbose (env,"fd %d is not pointing to valid bpf_map\n" , - insn[0 ].imm); +verbose (env,"fd %d is not pointing to valid bpf_map\n" , fd);return PTR_ERR (map); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 44/236 spi: introduce new helpers with using modern naming
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Yingliang <[email protected]>
[ Upstream commit b8d3b056a78dcc941fd1a117697ab2b956c2953f ]
For using modern names host/target to instead of all the legacy names, I think it takes 3 steps:
- step1: introduce new helpers with modern naming.
- step2: switch to use these new helpers in all drivers.
- step3: remove all legacy helpers and update all legacy names.
This patch is for step1, it introduces new helpers with host/target naming for drivers using.
Stable-dep-of: 0064db9ce4aa ("spi: axi-spi-engine: fix version format string")
--- drivers/spi/spi.c | 11 ++++++++++ include/linux/spi/spi.h | 47 +++++++++++++++++++++++++++++++++++++++-- 2 files changed, 56 insertions(+), 2 deletions(-)
drivers/spi/spi.c +11 -0
@@ -2774,6 +2774,17 @@ int spi_slave_abort(struct spi_device *spi) }EXPORT_SYMBOL_GPL (spi_slave_abort); +int spi_target_abort (struct spi_device *spi) +{ +struct spi_controller *ctlr = spi->controller; + +if (spi_controller_is_target (ctlr) && ctlr->target_abort) +return ctlr->target_abort (ctlr); + +return -ENOTSUPP ; +} +EXPORT_SYMBOL_GPL (spi_target_abort); +static ssize_t slave_show (struct device *dev,struct device_attribute *attr,char *buf) {
include/linux/spi/spi.h +45 -2
95 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 45/236 spi: axi-spi-engine: Convert to platform remove callback returning void
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
[ Upstream commit fc87abbef23413943457459e2c473ce607b4dd24 ]
The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void.
Trivially convert this driver from always returning zero in the remove callback to the void returning variant.
Stable-dep-of: 0064db9ce4aa ("spi: axi-spi-engine: fix version format string")
--- drivers/spi/spi-axi-spi-engine.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/spi/spi-axi-spi-engine.c +2 -4
@@ -554,7 +554,7 @@ static int spi_engine_probe(struct platform_device *pdev)return ret; } -static int spi_engine_remove (struct platform_device *pdev) +static void spi_engine_remove (struct platform_device *pdev) {struct spi_master *master =spi_master_get (platform_get_drvdata (pdev));struct spi_engine *spi_engine =spi_master_get_devdata (master);
@@ -572,8 +572,6 @@ static int spi_engine_remove(struct platform_device *pdev)clk_disable_unprepare (spi_engine->ref_clk);clk_disable_unprepare (spi_engine->clk); - -return 0 ; }static const struct of_device_id spi_engine_match_table[] = {
@@ -584,7 +582,7 @@ MODULE_DEVICE_TABLE(of, spi_engine_match_table);static struct platform_driver spi_engine_driver = { .probe = spi_engine_probe, - .remove = spi_engine_remove, + .remove_new = spi_engine_remove, .driver = { .name ="spi-engine" , .of_match_table = spi_engine_match_table,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 46/236 spi: spi-axi-spi-engine: switch to use modern name
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Yingliang <[email protected]>
[ Upstream commit 9d5920b37ab4a970f658a6a30b54cc6d6a7d2d3d ]
Change legacy name master to modern name host or controller.
No functional changed.
Stable-dep-of: 0064db9ce4aa ("spi: axi-spi-engine: fix version format string")
--- drivers/spi/spi-axi-spi-engine.c | 58 ++++++++++++++++---------------- 1 file changed, 29 insertions(+), 29 deletions(-)
drivers/spi/spi-axi-spi-engine.c +29 -29
@@ -356,8 +356,8 @@ static bool spi_engine_read_rx_fifo(struct spi_engine *spi_engine)static irqreturn_t spi_engine_irq (int irq,void *devid) { -struct spi_master *master = devid; -struct spi_engine *spi_engine =spi_master_get_devdata (master); +struct spi_controller *host = devid; +struct spi_engine *spi_engine =spi_controller_get_devdata (host);unsigned int disable_int =0 ;unsigned int pending;
@@ -396,7 +396,7 @@ static irqreturn_t spi_engine_irq(int irq, void *devid) msg->status =0 ; msg->actual_length = msg->frame_length; spi_engine->msg =NULL ; -spi_finalize_current_message (master); +spi_finalize_current_message (host); disable_int |=SPI_ENGINE_INT_SYNC ; } }
@@ -412,11 +412,11 @@ static irqreturn_t spi_engine_irq(int irq, void *devid)return IRQ_HANDLED ; } -static int spi_engine_transfer_one_message (struct spi_master *master, +static int spi_engine_transfer_one_message (struct spi_controller *host,struct spi_message *msg) {struct spi_engine_program p_dry, *p; -struct spi_engine *spi_engine =spi_master_get_devdata (master); +struct spi_engine *spi_engine =spi_controller_get_devdata (host);unsigned int int_enable =0 ;unsigned long flags;size_t size;
@@ -464,7 +464,7 @@ static int spi_engine_transfer_one_message(struct spi_master *master,static int spi_engine_probe (struct platform_device *pdev) {struct spi_engine *spi_engine; -struct spi_master *master; +struct spi_controller *host;unsigned int version;int irq;int ret;
@@ -477,29 +477,29 @@ static int spi_engine_probe(struct platform_device *pdev)if (!spi_engine)return -ENOMEM ; - master =spi_alloc_master (&pdev->dev,0 ); -if (!master) + host =spi_alloc_host (&pdev->dev,0 ); +if (!host)return -ENOMEM ; -spi_master_set_devdata (master, spi_engine); +spi_controller_set_devdata (host, spi_engine);spin_lock_init (&spi_engine->lock); spi_engine->clk =devm_clk_get (&pdev->dev,"s_axi_aclk" );if (IS_ERR (spi_engine->clk)) { ret =PTR_ERR (spi_engine->clk); - goto err_put_master; + goto err_put_host; } spi_engine->ref_clk =devm_clk_get (&pdev->dev,"spi_clk" );if (IS_ERR (spi_engine->ref_clk)) { ret =PTR_ERR (spi_engine->ref_clk); - goto err_put_master; + goto err_put_host; } ret =clk_prepare_enable (spi_engine->clk);if (ret) - goto err_put_master; + goto err_put_host; ret =clk_prepare_enable (spi_engine->ref_clk);if (ret)
@@ -525,46 +525,46 @@ static int spi_engine_probe(struct platform_device *pdev)writel_relaxed (0xff , spi_engine->base +SPI_ENGINE_REG_INT_PENDING );writel_relaxed (0x00 , spi_engine->base +SPI_ENGINE_REG_INT_ENABLE ); - ret =request_irq (irq, spi_engine_irq,0 , pdev->name, master); + ret =request_irq (irq, spi_engine_irq,0 , pdev->name, host);if (ret) goto err_ref_clk_disable; - master->dev.of_node = pdev->dev.of_node; - master->mode_bits =SPI_CPOL |SPI_CPHA |SPI_3WIRE ; - master->bits_per_word_mask =SPI_BPW_MASK (8 ); - master->max_speed_hz =clk_get_rate (spi_engine->ref_clk) /2 ; - master->transfer_one_message = spi_engine_transfer_one_message; - master->num_chipselect =8 ; + host->dev.of_node = pdev->dev.of_node; + host->mode_bits =SPI_CPOL |SPI_CPHA |SPI_3WIRE ; + host->bits_per_word_mask =SPI_BPW_MASK (8 ); + host->max_speed_hz =clk_get_rate (spi_engine->ref_clk) /2 ; + host->transfer_one_message = spi_engine_transfer_one_message; + host->num_chipselect =8 ; - ret =spi_register_master (master); + ret =spi_register_controller (host);if (ret) goto err_free_irq; -platform_set_drvdata (pdev, master); +platform_set_drvdata (pdev, host);return 0 ; err_free_irq: -free_irq (irq, master); +free_irq (irq, host); err_ref_clk_disable:clk_disable_unprepare (spi_engine->ref_clk); err_clk_disable:clk_disable_unprepare (spi_engine->clk); -err_put_master: -spi_master_put (master); +err_put_host: +spi_controller_put (host);return ret; }static void spi_engine_remove (struct platform_device *pdev) { -struct spi_master *master =spi_master_get (platform_get_drvdata (pdev)); -struct spi_engine *spi_engine =spi_master_get_devdata (master); +struct spi_controller *host =spi_controller_get (platform_get_drvdata (pdev)); +struct spi_engine *spi_engine =spi_controller_get_devdata (host);int irq =platform_get_irq (pdev,0 ); -spi_unregister_master (master); +spi_unregister_controller (host); -free_irq (irq, master); +free_irq (irq, host); -spi_master_put (master); +spi_controller_put (host);writel_relaxed (0xff , spi_engine->base +SPI_ENGINE_REG_INT_PENDING );writel_relaxed (0x00 , spi_engine->base +SPI_ENGINE_REG_INT_ENABLE );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 47/236 spi: spi-axi-spi-engine: Use helper function devm_clk_get_enabled()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Zetao <[email protected]>
[ Upstream commit a08199b309f833fd4221ab5ee2391c791fe26385 ]
Since commit 7ef9651e9792 ("clk: Provide new devm_clk helpers for prepared and enabled clocks"), devm_clk_get() and clk_prepare_enable() can now be replaced by devm_clk_get_enabled() when driver enables (and possibly prepares) the clocks for the whole lifetime of the device. Moreover, it is no longer necessary to unprepare and disable the clocks explicitly.
Stable-dep-of: 0064db9ce4aa ("spi: axi-spi-engine: fix version format string")
--- drivers/spi/spi-axi-spi-engine.c | 25 +++++-------------------- 1 file changed, 5 insertions(+), 20 deletions(-)
drivers/spi/spi-axi-spi-engine.c +5 -20
@@ -485,30 +485,22 @@ static int spi_engine_probe(struct platform_device *pdev)spin_lock_init (&spi_engine->lock); - spi_engine->clk =devm_clk_get (&pdev->dev,"s_axi_aclk" ); + spi_engine->clk =devm_clk_get_enabled (&pdev->dev,"s_axi_aclk" );if (IS_ERR (spi_engine->clk)) { ret =PTR_ERR (spi_engine->clk); goto err_put_host; } - spi_engine->ref_clk =devm_clk_get (&pdev->dev,"spi_clk" ); + spi_engine->ref_clk =devm_clk_get_enabled (&pdev->dev,"spi_clk" );if (IS_ERR (spi_engine->ref_clk)) { ret =PTR_ERR (spi_engine->ref_clk); goto err_put_host; } - ret =clk_prepare_enable (spi_engine->clk); -if (ret) - goto err_put_host; - - ret =clk_prepare_enable (spi_engine->ref_clk); -if (ret) - goto err_clk_disable; - spi_engine->base =devm_platform_ioremap_resource (pdev,0 );if (IS_ERR (spi_engine->base)) { ret =PTR_ERR (spi_engine->base); - goto err_ref_clk_disable; + goto err_put_host; } version =readl (spi_engine->base +SPI_ENGINE_REG_VERSION );
@@ -518,7 +510,7 @@ static int spi_engine_probe(struct platform_device *pdev)SPI_ENGINE_VERSION_MINOR (version), SPI_ENGINE_VERSION_PATCH(version)); ret = -ENODEV ; - goto err_ref_clk_disable; + goto err_put_host; }writel_relaxed (0x00 , spi_engine->base +SPI_ENGINE_REG_RESET );
@@ -527,7 +519,7 @@ static int spi_engine_probe(struct platform_device *pdev) ret =request_irq (irq, spi_engine_irq,0 , pdev->name, host);if (ret) - goto err_ref_clk_disable; + goto err_put_host; host->dev.of_node = pdev->dev.of_node; host->mode_bits =SPI_CPOL |SPI_CPHA |SPI_3WIRE ;
@@ -545,10 +537,6 @@ static int spi_engine_probe(struct platform_device *pdev)return 0 ; err_free_irq:free_irq (irq, host); -err_ref_clk_disable: -clk_disable_unprepare (spi_engine->ref_clk); -err_clk_disable: -clk_disable_unprepare (spi_engine->clk); err_put_host:spi_controller_put (host);return ret;
@@ -569,9 +557,6 @@ static void spi_engine_remove(struct platform_device *pdev)writel_relaxed (0xff , spi_engine->base +SPI_ENGINE_REG_INT_PENDING );writel_relaxed (0x00 , spi_engine->base +SPI_ENGINE_REG_INT_ENABLE );writel_relaxed (0x01 , spi_engine->base +SPI_ENGINE_REG_RESET ); - -clk_disable_unprepare (spi_engine->ref_clk); -clk_disable_unprepare (spi_engine->clk); }static const struct of_device_id spi_engine_match_table[] = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 48/236 spi: axi-spi-engine: simplify driver data allocation
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <[email protected]>
[ Upstream commit 9e4ce5220eedea2cc440f3961dec1b5122e815b2 ]
This simplifies the private data allocation in the AXI SPI Engine driver by making use of the feature built into the spi_alloc_host() function instead of doing it manually.
Stable-dep-of: 0064db9ce4aa ("spi: axi-spi-engine: fix version format string")
--- drivers/spi/spi-axi-spi-engine.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
drivers/spi/spi-axi-spi-engine.c +2 -6
@@ -473,15 +473,11 @@ static int spi_engine_probe(struct platform_device *pdev)if (irq <=0 )return -ENXIO ; - spi_engine =devm_kzalloc (&pdev->dev,sizeof (*spi_engine),GFP_KERNEL ); -if (!spi_engine) -return -ENOMEM ; - - host =spi_alloc_host (&pdev->dev,0 ); + host =spi_alloc_host (&pdev->dev,sizeof (*spi_engine));if (!host)return -ENOMEM ; -spi_controller_set_devdata (host, spi_engine); + spi_engine =spi_controller_get_devdata (host);spin_lock_init (&spi_engine->lock);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 49/236 spi: axi-spi-engine: use devm_spi_alloc_host()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <[email protected]>
[ Upstream commit e12cd96e8e93044646fdf4b2c9a1de62cfa01e7c ]
This modifies the AXI SPI Engine driver to use devm_spi_alloc_host() instead of spi_alloc_host() to simplify the code a bit.
In addition to simplifying the error paths in the probe function, we can also remove spi_controller_get/put() calls in the remove function since devm_spi_alloc_host() sets a flag to no longer decrement the controller reference count in the spi_unregister_controller() function.
Stable-dep-of: 0064db9ce4aa ("spi: axi-spi-engine: fix version format string")
--- drivers/spi/spi-axi-spi-engine.c | 31 ++++++++++--------------------- 1 file changed, 10 insertions(+), 21 deletions(-)
drivers/spi/spi-axi-spi-engine.c +10 -21
@@ -473,7 +473,7 @@ static int spi_engine_probe(struct platform_device *pdev)if (irq <=0 )return -ENXIO ; - host =spi_alloc_host (&pdev->dev,sizeof (*spi_engine)); + host =devm_spi_alloc_host (&pdev->dev,sizeof (*spi_engine));if (!host)return -ENOMEM ;
@@ -482,22 +482,16 @@ static int spi_engine_probe(struct platform_device *pdev)spin_lock_init (&spi_engine->lock); spi_engine->clk =devm_clk_get_enabled (&pdev->dev,"s_axi_aclk" ); -if (IS_ERR (spi_engine->clk)) { - ret =PTR_ERR (spi_engine->clk); - goto err_put_host; - } +if (IS_ERR (spi_engine->clk)) +return PTR_ERR (spi_engine->clk); spi_engine->ref_clk =devm_clk_get_enabled (&pdev->dev,"spi_clk" ); -if (IS_ERR (spi_engine->ref_clk)) { - ret =PTR_ERR (spi_engine->ref_clk); - goto err_put_host; - } +if (IS_ERR (spi_engine->ref_clk)) +return PTR_ERR (spi_engine->ref_clk); spi_engine->base =devm_platform_ioremap_resource (pdev,0 ); -if (IS_ERR (spi_engine->base)) { - ret =PTR_ERR (spi_engine->base); - goto err_put_host; - } +if (IS_ERR (spi_engine->base)) +return PTR_ERR (spi_engine->base); version =readl (spi_engine->base +SPI_ENGINE_REG_VERSION );if (SPI_ENGINE_VERSION_MAJOR (version) !=1 ) {
@@ -505,8 +499,7 @@ static int spi_engine_probe(struct platform_device *pdev)SPI_ENGINE_VERSION_MAJOR (version),SPI_ENGINE_VERSION_MINOR (version), SPI_ENGINE_VERSION_PATCH(version)); - ret = -ENODEV ; - goto err_put_host; +return -ENODEV ; }writel_relaxed (0x00 , spi_engine->base +SPI_ENGINE_REG_RESET );
@@ -515,7 +508,7 @@ static int spi_engine_probe(struct platform_device *pdev) ret =request_irq (irq, spi_engine_irq,0 , pdev->name, host);if (ret) - goto err_put_host; +return ret; host->dev.of_node = pdev->dev.of_node; host->mode_bits =SPI_CPOL |SPI_CPHA |SPI_3WIRE ;
@@ -533,14 +526,12 @@ static int spi_engine_probe(struct platform_device *pdev)return 0 ; err_free_irq:free_irq (irq, host); -err_put_host: -spi_controller_put (host);return ret; }static void spi_engine_remove (struct platform_device *pdev) { -struct spi_controller *host =spi_controller_get (platform_get_drvdata (pdev)); +struct spi_controller *host =platform_get_drvdata (pdev);struct spi_engine *spi_engine =spi_controller_get_devdata (host);int irq =platform_get_irq (pdev,0 );
@@ -548,8 +539,6 @@ static void spi_engine_remove(struct platform_device *pdev)free_irq (irq, host); -spi_controller_put (host); -writel_relaxed (0xff , spi_engine->base +SPI_ENGINE_REG_INT_PENDING );writel_relaxed (0x00 , spi_engine->base +SPI_ENGINE_REG_INT_ENABLE );writel_relaxed (0x01 , spi_engine->base +SPI_ENGINE_REG_RESET );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 50/236 spi: axi-spi-engine: move msg state to new struct
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <[email protected]>
[ Upstream commit 7f970ecb77b6759d37ee743fc36fc0daba960e75 ]
This moves the message state in the AXI SPI Engine driver to a new struct spi_engine_msg_state.
Previously, the driver state contained various pointers that pointed to memory owned by a struct spi_message. However, it did not set any of these pointers to NULL when a message was completed. This could lead to use after free bugs.
Example of how this could happen:
1. SPI core calls into spi_engine_transfer_one_message() with msg1.
2. Assume something was misconfigured and spi_engine_tx_next() is not called enough times in interrupt callbacks for msg1 such that spi_engine->tx_xfer is never set to NULL before the msg1 completes.
3. SYNC interrupt is received and spi_finalize_current_message() is called for msg1. spi_engine->msg is set to NULL but no other message-specific state is reset.
4. Caller that sent msg1 is notified of the completion and frees msg1 and the associated xfers and tx/rx buffers.
4. SPI core calls into spi_engine_transfer_one_message() with msg2.
5. When spi_engine_tx_next() is called for msg2, spi_engine->tx_xfer is still be pointing to an xfer from msg1, which was already freed. spi_engine_xfer_next() tries to access xfer->transfer_list of one of the freed xfers and we get a segfault or undefined behavior.
To avoid issues like this, instead of putting per-message state in the driver state struct, we can make use of the struct spi_message::state field to store a pointer to a new struct spi_engine_msg_state. This way, all of the state that belongs to specific message stays with that message and we don't have to remember to manually reset all aspects of the message state when a message is completed. Rather, a new state is allocated for each message.
Most of the changes are just renames where the state is accessed. One place where this wasn't straightforward was the sync_id member. This has been changed to use ida_alloc_range() since we needed to separate the per-message sync_id from the per-controller next available sync_id.
Stable-dep-of: 0064db9ce4aa ("spi: axi-spi-engine: fix version format string")
--- drivers/spi/spi-axi-spi-engine.c | 150 ++++++++++++++++++++----------- 1 file changed, 96 insertions(+), 54 deletions(-)
drivers/spi/spi-axi-spi-engine.c +96 -54
@@ -6,6 +6,7 @@*/ #include <linux/clk.h> +#include <linux/idr.h> #include <linux/interrupt.h> #include <linux/io.h> #include <linux/of.h>
@@ -78,28 +79,42 @@ struct spi_engine_program {uint16_t instructions[]; }; -struct spi_engine { -struct clk *clk; -struct clk *ref_clk; - -spinlock_t lock; - -void __iomem *base; - -struct spi_message *msg; +/** +* struct spi_engine_message_state - SPI engine per-message state +*/ +struct spi_engine_message_state { +/** Instructions for executing this message. */ struct spi_engine_program *p; +/** Number of elements in cmd_buf array. */ unsigned cmd_length; +/** Array of commands not yet written to CMD FIFO. */ const uint16_t *cmd_buf; - +/** Next xfer with tx_buf not yet fully written to TX FIFO. */ struct spi_transfer *tx_xfer; +/** Size of tx_buf in bytes. */ unsigned int tx_length; +/** Bytes not yet written to TX FIFO. */ const uint8_t *tx_buf; - +/** Next xfer with rx_buf not yet fully written to RX FIFO. */ struct spi_transfer *rx_xfer; +/** Size of tx_buf in bytes. */ unsigned int rx_length; +/** Bytes not yet written to the RX FIFO. */ uint8_t *rx_buf; +/** ID to correlate SYNC interrupts with this message. */ +u8 sync_id; +}; + +struct spi_engine { +struct clk *clk; +struct clk *ref_clk; -unsigned int sync_id; +spinlock_t lock; + +void __iomem *base; + +struct spi_message *msg; +struct ida sync_ida;unsigned int completed_id;unsigned int int_enable;
@@ -258,100 +273,105 @@ static void spi_engine_xfer_next(struct spi_engine *spi_engine,static void spi_engine_tx_next (struct spi_engine *spi_engine) { -struct spi_transfer *xfer = spi_engine->tx_xfer; +struct spi_engine_message_state *st = spi_engine->msg->state; +struct spi_transfer *xfer = st->tx_xfer;do {spi_engine_xfer_next (spi_engine, &xfer); }while (xfer && !xfer->tx_buf); - spi_engine->tx_xfer = xfer; + st->tx_xfer = xfer;if (xfer) { - spi_engine->tx_length = xfer->len; - spi_engine->tx_buf = xfer->tx_buf; + st->tx_length = xfer->len; + st->tx_buf = xfer->tx_buf; }else { - spi_engine->tx_buf =NULL ; + st->tx_buf =NULL ; } }static void spi_engine_rx_next (struct spi_engine *spi_engine) { -struct spi_transfer *xfer = spi_engine->rx_xfer; +struct spi_engine_message_state *st = spi_engine->msg->state; +struct spi_transfer *xfer = st->rx_xfer;do {spi_engine_xfer_next (spi_engine, &xfer); }while (xfer && !xfer->rx_buf); - spi_engine->rx_xfer = xfer; + st->rx_xfer = xfer;if (xfer) { - spi_engine->rx_length = xfer->len; - spi_engine->rx_buf = xfer->rx_buf; + st->rx_length = xfer->len; + st->rx_buf = xfer->rx_buf; }else { - spi_engine->rx_buf =NULL ; + st->rx_buf =NULL ; } }static bool spi_engine_write_cmd_fifo (struct spi_engine *spi_engine) {void __iomem *addr = spi_engine->base +SPI_ENGINE_REG_CMD_FIFO ; +struct spi_engine_message_state *st = spi_engine->msg->state;unsigned int n, m, i;const uint16_t *buf; n =readl_relaxed (spi_engine->base +SPI_ENGINE_REG_CMD_FIFO_ROOM ); -while (n && spi_engine->cmd_length) { - m =min (n, spi_engine->cmd_length); - buf = spi_engine->cmd_buf; +while (n && st->cmd_length) { + m =min (n, st->cmd_length); + buf = st->cmd_buf;for (i =0 ; i < m; i++)writel_relaxed (buf[i], addr); - spi_engine->cmd_buf += m; - spi_engine->cmd_length -= m; + st->cmd_buf += m; + st->cmd_length -= m; n -= m; } -return spi_engine->cmd_length !=0 ; +return st->cmd_length !=0 ; }static bool spi_engine_write_tx_fifo (struct spi_engine *spi_engine) {void __iomem *addr = spi_engine->base +SPI_ENGINE_REG_SDO_DATA_FIFO ; +struct spi_engine_message_state *st = spi_engine->msg->state;unsigned int n, m, i;const uint8_t *buf; n =readl_relaxed (spi_engine->base +SPI_ENGINE_REG_SDO_FIFO_ROOM ); -while (n && spi_engine->tx_length) { - m =min (n, spi_engine->tx_length); - buf = spi_engine->tx_buf; +while (n && st->tx_length) { + m =min (n, st->tx_length); + buf = st->tx_buf;for (i =0 ; i < m; i++)writel_relaxed (buf[i], addr); - spi_engine->tx_buf += m; - spi_engine->tx_length -= m; + st->tx_buf += m; + st->tx_length -= m; n -= m; -if (spi_engine->tx_length ==0 ) +if (st->tx_length ==0 )spi_engine_tx_next (spi_engine); } -return spi_engine->tx_length !=0 ; +return st->tx_length !=0 ; }static bool spi_engine_read_rx_fifo (struct spi_engine *spi_engine) {void __iomem *addr = spi_engine->base +SPI_ENGINE_REG_SDI_DATA_FIFO ; +struct spi_engine_message_state *st = spi_engine->msg->state;unsigned int n, m, i;uint8_t *buf; n =readl_relaxed (spi_engine->base +SPI_ENGINE_REG_SDI_FIFO_LEVEL ); -while (n && spi_engine->rx_length) { - m =min (n, spi_engine->rx_length); - buf = spi_engine->rx_buf; +while (n && st->rx_length) { + m =min (n, st->rx_length); + buf = st->rx_buf;for (i =0 ; i < m; i++) buf[i] =readl_relaxed (addr); - spi_engine->rx_buf += m; - spi_engine->rx_length -= m; + st->rx_buf += m; + st->rx_length -= m; n -= m; -if (spi_engine->rx_length ==0 ) +if (st->rx_length ==0 )spi_engine_rx_next (spi_engine); } -return spi_engine->rx_length !=0 ; +return st->rx_length !=0 ; }static irqreturn_t spi_engine_irq (int irq,void *devid)
@@ -387,12 +407,16 @@ static irqreturn_t spi_engine_irq(int irq, void *devid) disable_int |=SPI_ENGINE_INT_SDI_ALMOST_FULL ; } -if (pending &SPI_ENGINE_INT_SYNC ) { -if (spi_engine->msg && - spi_engine->completed_id == spi_engine->sync_id) { +if (pending &SPI_ENGINE_INT_SYNC && spi_engine->msg) { +struct spi_engine_message_state *st = spi_engine->msg->state; + +if (spi_engine->completed_id == st->sync_id) {struct spi_message *msg = spi_engine->msg; +struct spi_engine_message_state *st = msg->state; -kfree (spi_engine->p); +ida_free (&spi_engine->sync_ida, st->sync_id); +kfree (st->p); +kfree (st); msg->status =0 ; msg->actual_length = msg->frame_length; spi_engine->msg =NULL ;
@@ -417,29 +441,46 @@ static int spi_engine_transfer_one_message(struct spi_controller *host, {struct spi_engine_program p_dry, *p;struct spi_engine *spi_engine =spi_controller_get_devdata (host); +struct spi_engine_message_state *st;unsigned int int_enable =0 ;unsigned long flags;size_t size; +int ret; + + st =kzalloc (sizeof (*st),GFP_KERNEL ); +if (!st) +return -ENOMEM ; p_dry.length =0 ;spi_engine_compile_message (spi_engine, msg, true, &p_dry); size =sizeof (*p->instructions) * (p_dry.length +1 ); p =kzalloc (sizeof (*p) + size,GFP_KERNEL ); -if (!p) +if (!p) { +kfree (st);return -ENOMEM ; + } + + ret =ida_alloc_range (&spi_engine->sync_ida,0 ,U8_MAX ,GFP_KERNEL ); +if (ret <0 ) { +kfree (p); +kfree (st); +return ret; + } + + st->sync_id = ret; +spi_engine_compile_message (spi_engine, msg, false, p);spin_lock_irqsave (&spi_engine->lock, flags); - spi_engine->sync_id = (spi_engine->sync_id +1 ) &0xff ; -spi_engine_program_add_cmd (p, false, -SPI_ENGINE_CMD_SYNC (spi_engine->sync_id)); +spi_engine_program_add_cmd (p, false,SPI_ENGINE_CMD_SYNC (st->sync_id)); + msg->state = st; spi_engine->msg = msg; - spi_engine->p = p; + st->p = p; - spi_engine->cmd_buf = p->instructions; - spi_engine->cmd_length = p->length; + st->cmd_buf = p->instructions; + st->cmd_length = p->length;if (spi_engine_write_cmd_fifo (spi_engine)) int_enable |=SPI_ENGINE_INT_CMD_ALMOST_EMPTY ;
@@ -448,7 +489,7 @@ static int spi_engine_transfer_one_message(struct spi_controller *host, int_enable |=SPI_ENGINE_INT_SDO_ALMOST_EMPTY ;spi_engine_rx_next (spi_engine); -if (spi_engine->rx_length !=0 ) +if (st->rx_length !=0 ) int_enable |=SPI_ENGINE_INT_SDI_ALMOST_FULL ; int_enable |=SPI_ENGINE_INT_SYNC ;
@@ -480,6 +521,7 @@ static int spi_engine_probe(struct platform_device *pdev) spi_engine =spi_controller_get_devdata (host);spin_lock_init (&spi_engine->lock); +ida_init (&spi_engine->sync_ida); spi_engine->clk =devm_clk_get_enabled (&pdev->dev,"s_axi_aclk" );if (IS_ERR (spi_engine->clk))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 51/236 spi: axi-spi-engine: use common AXI macros
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <[email protected]>
[ Upstream commit 88c2b56c2690061121cad03f0f551db465287575 ]
This avoid duplicating the same macros in multiple drivers by reusing the common AXI macros for the version register.
Stable-dep-of: 0064db9ce4aa ("spi: axi-spi-engine: fix version format string")
--- drivers/spi/spi-axi-spi-engine.c | 17 ++++++----------- 1 file changed, 6 insertions(+), 11 deletions(-)
drivers/spi/spi-axi-spi-engine.c +6 -11
@@ -6,6 +6,7 @@*/ #include <linux/clk.h> +#include <linux/fpga/adi-axi-common.h> #include <linux/idr.h> #include <linux/interrupt.h> #include <linux/io.h>
@@ -14,12 +15,6 @@#include <linux/platform_device.h> #include <linux/spi/spi.h> -#define SPI_ENGINE_VERSION_MAJOR (x) ((x >> 16) & 0xff) -#define SPI_ENGINE_VERSION_MINOR (x) ((x >> 8) & 0xff) -#define SPI_ENGINE_VERSION_PATCH (x) (x & 0xff) - -#define SPI_ENGINE_REG_VERSION 0x00 -#define SPI_ENGINE_REG_RESET 0x40#define SPI_ENGINE_REG_INT_ENABLE 0x80
@@ -535,12 +530,12 @@ static int spi_engine_probe(struct platform_device *pdev)if (IS_ERR (spi_engine->base))return PTR_ERR (spi_engine->base); - version =readl (spi_engine->base +SPI_ENGINE_REG_VERSION ); -if (SPI_ENGINE_VERSION_MAJOR (version) !=1 ) { + version =readl (spi_engine->base +ADI_AXI_REG_VERSION ); +if (ADI_AXI_PCORE_VER_MAJOR (version) !=1 ) {dev_err (&pdev->dev,"Unsupported peripheral version %u.%u.%c\n" , -SPI_ENGINE_VERSION_MAJOR (version), -SPI_ENGINE_VERSION_MINOR (version), -SPI_ENGINE_VERSION_PATCH (version)); +ADI_AXI_PCORE_VER_MAJOR (version), +ADI_AXI_PCORE_VER_MINOR (version), +ADI_AXI_PCORE_VER_PATCH (version));return -ENODEV ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 52/236 spi: axi-spi-engine: fix version format string
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <[email protected]>
[ Upstream commit 0064db9ce4aa7cc794e6f4aed60dee0f94fc9bcf ]
The version format string in the AXI SPI Engine driver was probably intended to print the version number in the same format as the DT compatible string (e.g. 1.00.a). However, the version just uses semantic versioning so formatting the patch number as a character is not correct and would result in printing control characters for patch numbers less than 32.
--- drivers/spi/spi-axi-spi-engine.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-axi-spi-engine.c +1 -1
@@ -532,7 +532,7 @@ static int spi_engine_probe(struct platform_device *pdev) version =readl (spi_engine->base +ADI_AXI_REG_VERSION );if (ADI_AXI_PCORE_VER_MAJOR (version) !=1 ) { -dev_err (&pdev->dev,"Unsupported peripheral version %u.%u.%c\n" , +dev_err (&pdev->dev,"Unsupported peripheral version %u.%u.%u\n" ,ADI_AXI_PCORE_VER_MAJOR (version),ADI_AXI_PCORE_VER_MINOR (version),ADI_AXI_PCORE_VER_PATCH (version));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 53/236 spi: hisi-kunpeng: Delete the dump interface of data registers in debugfs
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Devyn Liu <[email protected]>
[ Upstream commit 7430764f5a85d30314aeef2d5438dff1fb0b1d68 ]
Due to the reading of FIFO during the dump of data registers in debugfs, if SPI transmission is in progress, it will be affected and may result in transmission failure. Therefore, the dump interface of data registers in debugfs is removed.
--- drivers/spi/spi-hisi-kunpeng.c | 2 -- 1 file changed, 2 deletions(-)
drivers/spi/spi-hisi-kunpeng.c +0 -2
@@ -151,8 +151,6 @@ static const struct debugfs_reg32 hisi_spi_regs[] = {HISI_SPI_DBGFS_REG ("ENR" ,HISI_SPI_ENR ),HISI_SPI_DBGFS_REG ("FIFOC" ,HISI_SPI_FIFOC ),HISI_SPI_DBGFS_REG ("IMR" ,HISI_SPI_IMR ), -HISI_SPI_DBGFS_REG ("DIN" ,HISI_SPI_DIN ), -HISI_SPI_DBGFS_REG ("DOUT" ,HISI_SPI_DOUT ),HISI_SPI_DBGFS_REG ("SR" ,HISI_SPI_SR ),HISI_SPI_DBGFS_REG ("RISR" ,HISI_SPI_RISR ), HISI_SPI_DBGFS_REG("ISR", HISI_SPI_ISR),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 54/236 bpf, arm64: Fix incorrect runtime stats
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Kuohai <[email protected]>
[ Upstream commit dc7d7447b56bcc9cf79a9c22e4edad200a298e4c ]
When __bpf_prog_enter() returns zero, the arm64 register x20 that stores prog start time is not assigned to zero, causing incorrect runtime stats.
To fix it, assign the return value of bpf_prog_enter() to x20 register immediately upon its return.
--- arch/arm64/net/bpf_jit_comp.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/arm64/net/bpf_jit_comp.c +3 -3
@@ -1679,15 +1679,15 @@ static void invoke_bpf_prog(struct jit_ctx *ctx, struct bpf_tramp_link *l,emit_call (enter_prog, ctx); +/* save return value to callee saved register x20 */ +emit (A64_MOV (1 ,A64_R (20 ),A64_R (0 )), ctx); +/* if (__bpf_prog_enter(prog) == 0) * goto skip_exec_of_prog; */ branch = ctx->image + ctx->idx;emit (A64_NOP , ctx); -/* save return value to callee saved register x20 */ -emit (A64_MOV (1 ,A64_R (20 ),A64_R (0 )), ctx); -emit (A64_ADD_I (1 ,A64_R (0 ),A64_SP , args_off), ctx);if (!p->jited)emit_addr_mov_i64 (A64_R (1 ), (const u64 )p->insnsi, ctx);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 55/236 s390/mm: Fix storage key clearing for guest huge pages
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudio Imbrenda <[email protected]>
[ Upstream commit 843c3280686fc1a83d89ee1e0b5599c9f6b09d0c ]
The function __storage_key_init_range() expects the end address to be the first byte outside the range to be initialized. I.e. end - start should be the size of the area to be initialized.
The current code works because __storage_key_init_range() will still loop over every page in the range, but it is slower than using sske_frame().
--- arch/s390/mm/gmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/s390/mm/gmap.c +1 -1
@@ -2642,7 +2642,7 @@ static int __s390_enable_skey_hugetlb(pte_t *pte, unsigned long addr,return 0 ; start =pmd_val (*pmd) &HPAGE_MASK ; - end = start +HPAGE_SIZE -1 ; + end = start +HPAGE_SIZE ;__storage_key_init_range (start, end);set_bit (PG_arch_1, &page->flags);cond_resched ();
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 56/236 s390/mm: Fix clearing storage keys for huge pages
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudio Imbrenda <[email protected]>
[ Upstream commit 412050af2ea39407fe43324b0be4ab641530ce88 ]
The function __storage_key_init_range() expects the end address to be the first byte outside the range to be initialized. I.e. end - start should be the size of the area to be initialized.
The current code works because __storage_key_init_range() will still loop over every page in the range, but it is slower than using sske_frame().
--- arch/s390/mm/hugetlbpage.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/s390/mm/hugetlbpage.c +1 -1
@@ -139,7 +139,7 @@ static void clear_huge_pte_skeys(struct mm_struct *mm, unsigned long rste) }if (!test_and_set_bit (PG_arch_1, &page->flags)) -__storage_key_init_range (paddr, paddr + size -1 ); +__storage_key_init_range (paddr, paddr + size); } void set_huge_pte_at(struct mm_struct *mm, unsigned long addr,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 57/236 xdp: use flags field to disambiguate broadcast redirect
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toke Høiland-Jørgensen <[email protected]>
[ Upstream commit 5bcf0dcbf9066348058b88a510c57f70f384c92c ]
When redirecting a packet using XDP, the bpf_redirect_map() helper will set up the redirect destination information in struct bpf_redirect_info (using the __bpf_xdp_redirect_map() helper function), and the xdp_do_redirect() function will read this information after the XDP program returns and pass the frame on to the right redirect destination.
When using the BPF_F_BROADCAST flag to do multicast redirect to a whole map, __bpf_xdp_redirect_map() sets the 'map' pointer in struct bpf_redirect_info to point to the destination map to be broadcast. And xdp_do_redirect() reacts to the value of this map pointer to decide whether it's dealing with a broadcast or a single-value redirect. However, if the destination map is being destroyed before xdp_do_redirect() is called, the map pointer will be cleared out (by bpf_clear_redirect_map()) without waiting for any XDP programs to stop running. This causes xdp_do_redirect() to think that the redirect was to a single target, but the target pointer is also NULL (since broadcast redirects don't have a single target), so this causes a crash when a NULL pointer is passed to dev_map_enqueue().
To fix this, change xdp_do_redirect() to react directly to the presence of the BPF_F_BROADCAST flag in the 'flags' value in struct bpf_redirect_info to disambiguate between a single-target and a broadcast redirect. And only read the 'map' pointer if the broadcast flag is set, aborting if that has been cleared out in the meantime. This prevents the crash, while keeping the atomic (cmpxchg-based) clearing of the map pointer itself, and without adding any more checks in the non-broadcast fast path.
--- net/core/filter.c | 42 ++++++++++++++++++++++++++++++++---------- 1 file changed, 32 insertions(+), 10 deletions(-)
net/core/filter.c +32 -10
@@ -4244,10 +4244,12 @@ static __always_inline int __xdp_do_redirect_frame(struct bpf_redirect_info *ri,enum bpf_map_type map_type = ri->map_type;void *fwd = ri->tgt_value;u32 map_id = ri->map_id; +u32 flags = ri->flags;struct bpf_map *map;int err; ri->map_id =0 ;/* Valid map id idr range: [1,INT_MAX[ */ + ri->flags =0 ; ri->map_type =BPF_MAP_TYPE_UNSPEC ;if (unlikely (!xdpf)) {
@@ -4259,11 +4261,20 @@ static __always_inline int __xdp_do_redirect_frame(struct bpf_redirect_info *ri,case BPF_MAP_TYPE_DEVMAP : fallthrough;case BPF_MAP_TYPE_DEVMAP_HASH : - map =READ_ONCE (ri->map); -if (unlikely (map)) { +if (unlikely (flags &BPF_F_BROADCAST )) { + map =READ_ONCE (ri->map); + +/* The map pointer is cleared when the map is being torn +* down by bpf_clear_redirect_map() +*/ +if (unlikely (!map)) { + err = -ENOENT ; +break ; + } +WRITE_ONCE (ri->map,NULL ); err =dev_map_enqueue_multi (xdpf, dev, map, - ri->flags &BPF_F_EXCLUDE_INGRESS ); + flags &BPF_F_EXCLUDE_INGRESS ); }else { err =dev_map_enqueue (fwd, xdpf, dev); }
@@ -4334,9 +4345,9 @@ EXPORT_SYMBOL_GPL(xdp_do_redirect_frame);static int xdp_do_generic_redirect_map (struct net_device *dev,struct sk_buff *skb,struct xdp_buff *xdp, -struct bpf_prog *xdp_prog, -void *fwd, -enum bpf_map_type map_type,u32 map_id) +struct bpf_prog *xdp_prog,void *fwd, +enum bpf_map_type map_type,u32 map_id, +u32 flags) {struct bpf_redirect_info *ri =this_cpu_ptr (&bpf_redirect_info);struct bpf_map *map;
@@ -4346,11 +4357,20 @@ static int xdp_do_generic_redirect_map(struct net_device *dev,case BPF_MAP_TYPE_DEVMAP : fallthrough;case BPF_MAP_TYPE_DEVMAP_HASH : - map =READ_ONCE (ri->map); -if (unlikely (map)) { +if (unlikely (flags &BPF_F_BROADCAST )) { + map =READ_ONCE (ri->map); + +/* The map pointer is cleared when the map is being torn +* down by bpf_clear_redirect_map() +*/ +if (unlikely (!map)) { + err = -ENOENT ; +break ; + } +WRITE_ONCE (ri->map,NULL ); err =dev_map_redirect_multi (dev, skb, xdp_prog, map, - ri->flags &BPF_F_EXCLUDE_INGRESS ); + flags &BPF_F_EXCLUDE_INGRESS ); }else { err =dev_map_generic_redirect (fwd, skb, xdp_prog); }
@@ -4387,9 +4407,11 @@ int xdp_do_generic_redirect(struct net_device *dev, struct sk_buff *skb,enum bpf_map_type map_type = ri->map_type;void *fwd = ri->tgt_value;u32 map_id = ri->map_id; +u32 flags = ri->flags;int err; ri->map_id =0 ;/* Valid map id idr range: [1,INT_MAX[ */ + ri->flags =0 ; ri->map_type =BPF_MAP_TYPE_UNSPEC ;if (map_type ==BPF_MAP_TYPE_UNSPEC && map_id ==INT_MAX ) {
@@ -4409,7 +4431,7 @@ int xdp_do_generic_redirect(struct net_device *dev, struct sk_buff *skb,return 0 ; } -return xdp_do_generic_redirect_map (dev, skb, xdp, xdp_prog, fwd, map_type, map_id); +return xdp_do_generic_redirect_map (dev, skb, xdp, xdp_prog, fwd, map_type, map_id, flags); err:_trace_xdp_redirect_err (dev, xdp_prog, ri->tgt_index, err);return err;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 58/236 bna: ensure the copied buf is NUL terminated
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bui Quang Minh <[email protected]>
[ Upstream commit 8c34096c7fdf272fd4c0c37fe411cd2e3ed0ee9f ]
Currently, we allocate a nbytes-sized kernel buffer and copy nbytes from userspace to that buffer. Later, we use sscanf on this buffer but we don't ensure that the string is terminated inside the buffer, this can lead to OOB read when using sscanf. Fix this issue by using memdup_user_nul instead of memdup_user.
--- drivers/net/ethernet/brocade/bna/bnad_debugfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/brocade/bna/bnad_debugfs.c +2 -2
@@ -312,7 +312,7 @@ bnad_debugfs_write_regrd(struct file *file, const char __user *buf,void *kern_buf;/* Copy the user space buf */ - kern_buf =memdup_user (buf, nbytes); + kern_buf =memdup_user_nul (buf, nbytes);if (IS_ERR (kern_buf))return PTR_ERR (kern_buf);
@@ -372,7 +372,7 @@ bnad_debugfs_write_regwr(struct file *file, const char __user *buf,void *kern_buf;/* Copy the user space buf */ - kern_buf =memdup_user (buf, nbytes); + kern_buf =memdup_user_nul (buf, nbytes);if (IS_ERR (kern_buf))return PTR_ERR (kern_buf);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 59/236 octeontx2-af: avoid off-by-one read from userspace
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bui Quang Minh <[email protected]>
[ Upstream commit f299ee709fb45036454ca11e90cb2810fe771878 ]
We try to access count + 1 byte from userspace with memdup_user(buffer, count + 1). However, the userspace only provides buffer of count bytes and only these count bytes are verified to be okay to access. To ensure the copied buffer is NUL terminated, we use memdup_user_nul instead.
--- drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c +1 -3
@@ -999,12 +999,10 @@ static ssize_t rvu_dbg_qsize_write(struct file *filp,u16 pcifunc;int ret, lf; - cmd_buf =memdup_user (buffer, count +1 ); + cmd_buf =memdup_user_nul (buffer, count);if (IS_ERR (cmd_buf))return -ENOMEM ; - cmd_buf[count] ='\0' ; - cmd_buf_tmp =strchr (cmd_buf,'\n' );if (cmd_buf_tmp) { *cmd_buf_tmp ='\0' ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 60/236 nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 4b911a9690d72641879ea6d13cce1de31d346d79 ]
syzbot triggered various splats (see [0] and links) by a crafted GSO packet of VIRTIO_NET_HDR_GSO_UDP layering the following protocols:
ETH_P_8021AD + ETH_P_NSH + ETH_P_IPV6 + IPPROTO_UDP
NSH can encapsulate IPv4, IPv6, Ethernet, NSH, and MPLS. As the inner protocol can be Ethernet, NSH GSO handler, nsh_gso_segment(), calls skb_mac_gso_segment() to invoke inner protocol GSO handlers.
nsh_gso_segment() does the following for the original skb before calling skb_mac_gso_segment()
1. reset skb->network_header
2. save the original skb->{mac_heaeder,mac_len} in a local variable
3. pull the NSH header
4. resets skb->mac_header
5. set up skb->mac_len and skb->protocol for the inner protocol.
and does the following for the segmented skb
6. set ntohs(ETH_P_NSH) to skb->protocol
7. push the NSH header
8. restore skb->mac_header
9. set skb->mac_header + mac_len to skb->network_header
10. restore skb->mac_len
There are two problems in 6-7 and 8-9.
(a)
After 6 & 7, skb->data points to the NSH header, so the outer header (ETH_P_8021AD in this case) is stripped when skb is sent out of netdev.
Also, if NSH is encapsulated by NSH + Ethernet (so NSH-Ethernet-NSH), skb_pull() in the first nsh_gso_segment() will make skb->data point to the middle of the outer NSH or Ethernet header because the Ethernet header is not pulled by the second nsh_gso_segment().
(b)
While restoring skb->{mac_header,network_header} in 8 & 9, nsh_gso_segment() does not assume that the data in the linear buffer is shifted.
However, udp6_ufo_fragment() could shift the data and change skb->mac_header accordingly as demonstrated by syzbot.
If this happens, even the restored skb->mac_header points to the middle of the outer header.
It seems nsh_gso_segment() has never worked with outer headers so far.
At the end of nsh_gso_segment(), the outer header must be restored for the segmented skb, instead of the NSH header.
To do that, let's calculate the outer header position relatively from the inner header and set skb->{data,mac_header,protocol} properly.
[0]:
BUG: KMSAN: uninit-value in ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:524 [inline] BUG: KMSAN: uninit-value in ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline] BUG: KMSAN: uninit-value in ipvlan_queue_xmit+0xf44/0x16b0 drivers/net/ipvlan/ipvlan_core.c:668 ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:524 [inline] ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline] ipvlan_queue_xmit+0xf44/0x16b0 drivers/net/ipvlan/ipvlan_core.c:668 ipvlan_start_xmit+0x5c/0x1a0 drivers/net/ipvlan/ipvlan_main.c:222 __netdev_start_xmit include/linux/netdevice.h:4989 [inline] netdev_start_xmit include/linux/netdevice.h:5003 [inline] xmit_one net/core/dev.c:3547 [inline] dev_hard_start_xmit+0x244/0xa10 net/core/dev.c:3563 __dev_queue_xmit+0x33ed/0x51c0 net/core/dev.c:4351 dev_queue_xmit include/linux/netdevice.h:3171 [inline] packet_xmit+0x9c/0x6b0 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3081 [inline] packet_sendmsg+0x8aef/0x9f10 net/packet/af_packet.c:3113 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] __sys_sendto+0x735/0xa10 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b
Uninit was created at:
slab_post_alloc_hook mm/slub.c:3819 [inline] slab_alloc_node mm/slub.c:3860 [inline] __do_kmalloc_node mm/slub.c:3980 [inline] __kmalloc_node_track_caller+0x705/0x1000 mm/slub.c:4001 kmalloc_reserve+0x249/0x4a0 net/core/skbuff.c:582 __alloc_skb+0x352/0x790 net/core/skbuff.c:651 skb_segment+0x20aa/0x7080 net/core/skbuff.c:4647 udp6_ufo_fragment+0xcab/0x1150 net/ipv6/udp_offload.c:109 ipv6_gso_segment+0x14be/0x2ca0 net/ipv6/ip6_offload.c:152 skb_mac_gso_segment+0x3e8/0x760 net/core/gso.c:53 nsh_gso_segment+0x6f4/0xf70 net/nsh/nsh.c:108 skb_mac_gso_segment+0x3e8/0x760 net/core/gso.c:53 __skb_gso_segment+0x4b0/0x730 net/core/gso.c:124 skb_gso_segment include/net/gso.h:83 [inline] validate_xmit_skb+0x107f/0x1930 net/core/dev.c:3628 __dev_queue_xmit+0x1f28/0x51c0 net/core/dev.c:4343 dev_queue_xmit include/linux/netdevice.h:3171 [inline] packet_xmit+0x9c/0x6b0 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3081 [inline] packet_sendmsg+0x8aef/0x9f10 net/packet/af_packet.c:3113 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] __sys_sendto+0x735/0xa10 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b CPU: 1 PID: 5101 Comm: syz-executor421 Not tainted 6.8.0-rc5-syzkaller-00297-gf2e367d6ad3b #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
--- net/nsh/nsh.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
net/nsh/nsh.c +8 -6
@@ -76,13 +76,15 @@ EXPORT_SYMBOL_GPL(nsh_pop);static struct sk_buff *nsh_gso_segment (struct sk_buff *skb,netdev_features_t features) { +unsigned int outer_hlen, mac_len, nsh_len;struct sk_buff *segs =ERR_PTR (-EINVAL );u16 mac_offset = skb->mac_header; -unsigned int nsh_len, mac_len; -__be16 proto; +__be16 outer_proto, proto;skb_reset_network_header (skb); + outer_proto = skb->protocol; + outer_hlen =skb_mac_header_len (skb); mac_len = skb->mac_len;if (unlikely (!pskb_may_pull (skb,NSH_BASE_HDR_LEN )))
@@ -112,10 +114,10 @@ static struct sk_buff *nsh_gso_segment(struct sk_buff *skb, }for (skb = segs; skb; skb = skb->next) { - skb->protocol =htons (ETH_P_NSH ); -__skb_push (skb, nsh_len); - skb->mac_header = mac_offset; - skb->network_header = skb->mac_header + mac_len; + skb->protocol = outer_proto; +__skb_push (skb, nsh_len + outer_hlen); +skb_reset_mac_header (skb); +skb_set_network_header (skb, outer_hlen); skb->mac_len = mac_len; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 61/236 net l2tp: drop flow hash on forward
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Bauer <[email protected]>
[ Upstream commit 42f853b42899d9b445763b55c3c8adc72be0f0e1 ]
Drop the flow-hash of the skb when forwarding to the L2TP netdev.
This avoids the L2TP qdisc from using the flow-hash from the outer packet, which is identical for every flow within the tunnel.
This does not affect every platform but is specific for the ethernet driver. It depends on the platform including L4 information in the flow-hash.
One such example is the Mediatek Filogic MT798x family of networking processors.
--- net/l2tp/l2tp_eth.c | 3 +++ 1 file changed, 3 insertions(+)
net/l2tp/l2tp_eth.c +3 -0
@@ -136,6 +136,9 @@ static void l2tp_eth_dev_recv(struct l2tp_session *session, struct sk_buff *skb,/* checksums verified by L2TP */ skb->ip_summed =CHECKSUM_NONE ; +/* drop outer flow-hash */ +skb_clear_hash (skb); +skb_dst_drop (skb);nf_reset_ct (skb);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 62/236 s390/vdso: Add CFI for RA register to asm macro vdso_func
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Remus <[email protected]>
[ Upstream commit b961ec10b9f9719987470236feb50c967db5a652 ]
The return-address (RA) register r14 is specified as volatile in the s390x ELF ABI [1]. Nevertheless proper CFI directives must be provided for an unwinder to restore the return address, if the RA register value is changed from its value at function entry, as it is the case.
[1]: s390x ELF ABI, https://github.com/IBM/s390x-abi/releases
--- arch/s390/include/asm/dwarf.h | 1 + arch/s390/kernel/vdso64/vdso_user_wrapper.S | 2 ++ 2 files changed, 3 insertions(+)
arch/s390/include/asm/dwarf.h +1 -0
@@ -9,6 +9,7 @@#define CFI_DEF_CFA_OFFSET .cfi_def_cfa_offset#define CFI_ADJUST_CFA_OFFSET .cfi_adjust_cfa_offset#define CFI_RESTORE .cfi_restore +#define CFI_REL_OFFSET .cfi_rel_offset#ifdef CONFIG_AS_CFI_VAL_OFFSET #define CFI_VAL_OFFSET .cfi_val_offset
arch/s390/kernel/vdso64/vdso_user_wrapper.S +2 -0
@@ -23,8 +23,10 @@ __kernel_\func: CFI_DEF_CFA_OFFSET (STACK_FRAME_OVERHEAD + WRAPPER_FRAME_SIZE) CFI_VAL_OFFSET 15, -STACK_FRAME_OVERHEAD stg %r14,STACK_FRAME_OVERHEAD(%r15) + CFI_REL_OFFSET 14, STACK_FRAME_OVERHEAD brasl %r14,__s390_vdso_\func lg %r14,STACK_FRAME_OVERHEAD(%r15) + CFI_RESTORE 14 aghi %r15,WRAPPER_FRAME_SIZE CFI_DEF_CFA_OFFSET STACK_FRAME_OVERHEAD CFI_RESTORE 15
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 63/236 net: qede: sanitize rc in qede_add_tc_flower_fltr()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Asbjørn Sloth Tønnesen <[email protected]>
[ Upstream commit e25714466abd9d96901b15efddf82c60a38abd86 ]
Explicitly set 'rc' (return code), before jumping to the unlock and return path.
By not having any code depend on that 'rc' remains at it's initial value of -EINVAL, then we can re-use 'rc' for the return code of function calls in subsequent patches.
Only compile tested.
Stable-dep-of: fcee2065a178 ("net: qede: use return from qede_parse_flow_attr() for flower")
--- drivers/net/ethernet/qlogic/qede/qede_filter.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/net/ethernet/qlogic/qede/qede_filter.c +8 -3
@@ -1868,8 +1868,8 @@ int qede_add_tc_flower_fltr(struct qede_dev *edev, __be16 proto, struct flow_cls_offload *f) {struct qede_arfs_fltr_node *n; -int min_hlen, rc = -EINVAL ;struct qede_arfs_tuple t; +int min_hlen, rc;__qede_lock (edev);
@@ -1879,8 +1879,10 @@ int qede_add_tc_flower_fltr(struct qede_dev *edev, __be16 proto, }/* parse flower attribute and prepare filter */ -if (qede_parse_flow_attr (edev, proto, f->rule, &t)) +if (qede_parse_flow_attr (edev, proto, f->rule, &t)) { + rc = -EINVAL ; goto unlock; + }/* Validate profile mode and number of filters */ if ((edev->arfs->filter_count && edev->arfs->mode != t.mode) ||
@@ -1888,12 +1890,15 @@ int qede_add_tc_flower_fltr(struct qede_dev *edev, __be16 proto,DP_NOTICE (edev,"Filter configuration invalidated, filter mode=0x%x, configured mode=0x%x, filter count=0x%x\n" , t.mode, edev->arfs->mode, edev->arfs->filter_count); + rc = -EINVAL ; goto unlock; }/* parse tc actions and get the vf_id */ -if (qede_parse_actions (edev, &f->rule->action, f->common.extack)) +if (qede_parse_actions (edev, &f->rule->action, f->common.extack)) { + rc = -EINVAL ; goto unlock; + }if (qede_flow_find_fltr (edev, &t)) { rc = -EEXIST ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 64/236 net: qede: use return from qede_parse_flow_attr() for flower
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Asbjørn Sloth Tønnesen <[email protected]>
[ Upstream commit fcee2065a178f78be6fd516302830378b17dba3d ]
In qede_add_tc_flower_fltr(), when callingqede_parse_flow_attr() then the return code
was only used for a non-zero check, and then-EINVAL was returned.
qede_parse_flow_attr() can currently fail with:
* -EINVAL
* -EOPNOTSUPP
* -EPROTONOSUPPORT
This patch changes the code to use the actual
return code, not just return -EINVAL.
The blaimed commit introduced these functions.
Only compile tested.
--- drivers/net/ethernet/qlogic/qede/qede_filter.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/net/ethernet/qlogic/qede/qede_filter.c +2 -3
@@ -1879,10 +1879,9 @@ int qede_add_tc_flower_fltr(struct qede_dev *edev, __be16 proto, }/* parse flower attribute and prepare filter */ -if (qede_parse_flow_attr (edev, proto, f->rule, &t)) { - rc = -EINVAL ; + rc =qede_parse_flow_attr (edev, proto, f->rule, &t); +if (rc) goto unlock; - }/* Validate profile mode and number of filters */ if ((edev->arfs->filter_count && edev->arfs->mode != t.mode) ||
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 65/236 net: qede: use return from qede_parse_flow_attr() for flow_spec
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Asbjørn Sloth Tønnesen <[email protected]>
[ Upstream commit 27b44414a34b108c5a37cd5b4894f606061d86e7 ]
In qede_flow_spec_to_rule(), when callingqede_parse_flow_attr() then the return code
was only used for a non-zero check, and then-EINVAL was returned.
qede_parse_flow_attr() can currently fail with:
* -EINVAL
* -EOPNOTSUPP
* -EPROTONOSUPPORT
This patch changes the code to use the actual
return code, not just return -EINVAL.
The blaimed commit introduced qede_flow_spec_to_rule(), and this call to qede_parse_flow_attr(), it looks like it just duplicated how it was already used.
Only compile tested.
--- drivers/net/ethernet/qlogic/qede/qede_filter.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/net/ethernet/qlogic/qede/qede_filter.c +2 -3
@@ -2002,10 +2002,9 @@ static int qede_flow_spec_to_rule(struct qede_dev *edev,if (IS_ERR (flow))return PTR_ERR (flow); -if (qede_parse_flow_attr (edev, proto, flow->rule, t)) { - err = -EINVAL ; + err =qede_parse_flow_attr (edev, proto, flow->rule, t); +if (err) goto err_out; - }/* Make sure location is valid and filter isn't already set */ err = qede_flow_spec_validate(edev, &flow->rule->action, t,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 66/236 net: qede: use return from qede_parse_actions()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Asbjørn Sloth Tønnesen <[email protected]>
[ Upstream commit f26f719a36e56381a1f4230e5364e7ad4d485888 ]
When calling qede_parse_actions() then the
return code was only used for a non-zero check,
and then -EINVAL was returned.
qede_parse_actions() can currently fail with:
* -EINVAL
* -EOPNOTSUPP
This patch changes the code to use the actual
return code, not just return -EINVAL.
The blaimed commit broke the implicit assumption
that only -EINVAL would ever be returned.
Only compile tested.
--- drivers/net/ethernet/qlogic/qede/qede_filter.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/net/ethernet/qlogic/qede/qede_filter.c +2 -3
@@ -1894,10 +1894,9 @@ int qede_add_tc_flower_fltr(struct qede_dev *edev, __be16 proto, }/* parse tc actions and get the vf_id */ -if (qede_parse_actions (edev, &f->rule->action, f->common.extack)) { - rc = -EINVAL ; + rc =qede_parse_actions (edev, &f->rule->action, f->common.extack); +if (rc) goto unlock; - }if (qede_flow_find_fltr (edev, &t)) { rc = -EEXIST ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 67/236 ASoC: meson: axg-fifo: use FIELD helpers
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <[email protected]>
[ Upstream commit 9e6f39535c794adea6ba802a52c722d193c28124 ]
Use FIELD_GET() and FIELD_PREP() helpers instead of doing it manually.
Stable-dep-of: b11d26660dff ("ASoC: meson: axg-fifo: use threaded irq to check periods")
--- sound/soc/meson/axg-fifo.c | 25 +++++++++++++------------ sound/soc/meson/axg-fifo.h | 12 +++++------- sound/soc/meson/axg-frddr.c | 5 +++-- sound/soc/meson/axg-toddr.c | 22 ++++++++++------------ 4 files changed, 31 insertions(+), 33 deletions(-)
sound/soc/meson/axg-fifo.c +13 -12
@@ -3,6 +3,7 @@// Copyright (c) 2018 BayLibre, SAS. // Author: Jerome Brunet <[email protected]> +#include <linux/bitfield.h> #include <linux/clk.h> #include <linux/of_irq.h> #include <linux/of_platform.h>
@@ -145,8 +146,8 @@ int axg_fifo_pcm_hw_params(struct snd_soc_component *component,/* Enable irq if necessary */ irq_en = runtime->no_period_wakeup ?0 :FIFO_INT_COUNT_REPEAT ;regmap_update_bits (fifo->map,FIFO_CTRL0 , -CTRL0_INT_EN (FIFO_INT_COUNT_REPEAT ), -CTRL0_INT_EN (irq_en)); +CTRL0_INT_EN , +FIELD_PREP (CTRL0_INT_EN , irq_en));return 0 ; }
@@ -176,9 +177,9 @@ int axg_fifo_pcm_hw_free(struct snd_soc_component *component, {struct axg_fifo *fifo =axg_fifo_data (ss); -/* Disable the block count irq */ +/* Disable irqs */ regmap_update_bits (fifo->map,FIFO_CTRL0 , -CTRL0_INT_EN (FIFO_INT_COUNT_REPEAT ),0 ); +CTRL0_INT_EN ,0 );return 0 ; }
@@ -187,13 +188,13 @@ EXPORT_SYMBOL_GPL(axg_fifo_pcm_hw_free);static void axg_fifo_ack_irq (struct axg_fifo *fifo,u8 mask) {regmap_update_bits (fifo->map,FIFO_CTRL1 , -CTRL1_INT_CLR (FIFO_INT_MASK ), -CTRL1_INT_CLR (mask)); +CTRL1_INT_CLR , +FIELD_PREP (CTRL1_INT_CLR , mask));/* Clear must also be cleared */ regmap_update_bits (fifo->map,FIFO_CTRL1 , -CTRL1_INT_CLR (FIFO_INT_MASK ), -0 ); +CTRL1_INT_CLR , +FIELD_PREP (CTRL1_INT_CLR ,0 )); }static irqreturn_t axg_fifo_pcm_irq_block (int irq,void *dev_id)
@@ -204,7 +205,7 @@ static irqreturn_t axg_fifo_pcm_irq_block(int irq, void *dev_id)regmap_read (fifo->map,FIFO_STATUS1 , &status); - status =STATUS1_INT_STS (status) &FIFO_INT_MASK ; + status =FIELD_GET (STATUS1_INT_STS , status);if (status &FIFO_INT_COUNT_REPEAT )snd_pcm_period_elapsed (ss);else
@@ -254,15 +255,15 @@ int axg_fifo_pcm_open(struct snd_soc_component *component,/* Setup status2 so it reports the memory pointer */ regmap_update_bits (fifo->map,FIFO_CTRL1 , -CTRL1_STATUS2_SEL_MASK , -CTRL1_STATUS2_SEL (STATUS2_SEL_DDR_READ )); +CTRL1_STATUS2_SEL , +FIELD_PREP (CTRL1_STATUS2_SEL ,STATUS2_SEL_DDR_READ ));/* Make sure the dma is initially disabled */ __dma_enable (fifo, false);/* Disable irqs until params are ready */ regmap_update_bits (fifo->map,FIFO_CTRL0 , -CTRL0_INT_EN (FIFO_INT_MASK ),0 ); +CTRL0_INT_EN ,0 );/* Clear any pending interrupt */ axg_fifo_ack_irq (fifo,FIFO_INT_MASK );
sound/soc/meson/axg-fifo.h +5 -7
@@ -42,21 +42,19 @@ struct snd_soc_pcm_runtime;#define FIFO_CTRL0 0x00#define CTRL0_DMA_EN BIT(31) -#define CTRL0_INT_EN (x) ((x) << 16) +#define CTRL0_INT_EN GENMASK(23, 16)#define CTRL0_SEL_MASK GENMASK(2, 0)#define CTRL0_SEL_SHIFT 0#define FIFO_CTRL1 0x04 -#define CTRL1_INT_CLR (x) ((x) << 0) -#define CTRL1_STATUS2_SEL_MASK GENMASK(11, 8) -#define CTRL1_STATUS2_SEL (x) ((x) << 8) +#define CTRL1_INT_CLR GENMASK(7, 0) +#define CTRL1_STATUS2_SEL GENMASK(11, 8)#define STATUS2_SEL_DDR_READ 0 -#define CTRL1_FRDDR_DEPTH_MASK GENMASK(31, 24) -#define CTRL1_FRDDR_DEPTH (x) ((x) << 24) +#define CTRL1_FRDDR_DEPTH GENMASK(31, 24)#define FIFO_START_ADDR 0x08#define FIFO_FINISH_ADDR 0x0c#define FIFO_INT_ADDR 0x10#define FIFO_STATUS1 0x14 -#define STATUS1_INT_STS (x) ((x) << 0) +#define STATUS1_INT_STS GENMASK(7, 0)#define FIFO_STATUS2 0x18#define FIFO_INIT_ADDR 0x24#define FIFO_CTRL2 0x28
sound/soc/meson/axg-frddr.c +3 -2
@@ -7,6 +7,7 @@* This driver implements the frontend playback DAI of AXG and G12A based SoCs */ +#include <linux/bitfield.h> #include <linux/clk.h> #include <linux/regmap.h> #include <linux/module.h>
@@ -59,8 +60,8 @@ static int axg_frddr_dai_hw_params(struct snd_pcm_substream *substream,/* Trim the FIFO depth if the period is small to improve latency */ depth =min (period, fifo->depth); val = (depth /AXG_FIFO_BURST ) -1 ; -regmap_update_bits (fifo->map,FIFO_CTRL1 ,CTRL1_FRDDR_DEPTH_MASK , -CTRL1_FRDDR_DEPTH (val)); +regmap_update_bits (fifo->map,FIFO_CTRL1 ,CTRL1_FRDDR_DEPTH , +FIELD_PREP (CTRL1_FRDDR_DEPTH , val));return 0 ; }
sound/soc/meson/axg-toddr.c +10 -12
@@ -5,6 +5,7 @@/* This driver implements the frontend capture DAI of AXG based SoCs */ +#include <linux/bitfield.h> #include <linux/clk.h> #include <linux/regmap.h> #include <linux/module.h>
@@ -19,12 +20,9 @@#define CTRL0_TODDR_EXT_SIGNED BIT(29)#define CTRL0_TODDR_PP_MODE BIT(28)#define CTRL0_TODDR_SYNC_CH BIT(27) -#define CTRL0_TODDR_TYPE_MASK GENMASK(15, 13) -#define CTRL0_TODDR_TYPE (x) ((x) << 13) -#define CTRL0_TODDR_MSB_POS_MASK GENMASK(12, 8) -#define CTRL0_TODDR_MSB_POS (x) ((x) << 8) -#define CTRL0_TODDR_LSB_POS_MASK GENMASK(7, 3) -#define CTRL0_TODDR_LSB_POS (x) ((x) << 3) +#define CTRL0_TODDR_TYPE GENMASK(15, 13) +#define CTRL0_TODDR_MSB_POS GENMASK(12, 8) +#define CTRL0_TODDR_LSB_POS GENMASK(7, 3)#define CTRL1_TODDR_FORCE_FINISH BIT(25)#define CTRL1_SEL_SHIFT 28
@@ -76,12 +74,12 @@ static int axg_toddr_dai_hw_params(struct snd_pcm_substream *substream, width =params_width (params);regmap_update_bits (fifo->map,FIFO_CTRL0 , -CTRL0_TODDR_TYPE_MASK | -CTRL0_TODDR_MSB_POS_MASK | -CTRL0_TODDR_LSB_POS_MASK , -CTRL0_TODDR_TYPE (type) | -CTRL0_TODDR_MSB_POS (TODDR_MSB_POS ) | -CTRL0_TODDR_LSB_POS (TODDR_MSB_POS - (width -1 ))); +CTRL0_TODDR_TYPE | +CTRL0_TODDR_MSB_POS | +CTRL0_TODDR_LSB_POS , +FIELD_PREP (CTRL0_TODDR_TYPE , type) | +FIELD_PREP (CTRL0_TODDR_MSB_POS ,TODDR_MSB_POS ) | +FIELD_PREP (CTRL0_TODDR_LSB_POS ,TODDR_MSB_POS - (width -1 )));return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 68/236 ASoC: meson: axg-fifo: use threaded irq to check periods
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <[email protected]>
[ Upstream commit b11d26660dff8d7430892008616452dc8e5fb0f3 ]
With the AXG audio subsystem, there is a possible random channel shift on TDM capture, when the slot number per lane is more than 2, and there is more than one lane used.
The problem has been there since the introduction of the axg audio support but such scenario is pretty uncommon. This is why there is no loud complains about the problem.
Solving the problem require to make the links non-atomic and use the trigger() callback to start FEs and BEs in the appropriate order.
This was tried in the past and reverted because it caused the block irq to sleep while atomic. However, instead of reverting, the solution is to call snd_pcm_period_elapsed() in a non atomic context.
Use the bottom half of a threaded IRQ to do so.
--- sound/soc/meson/axg-fifo.c | 29 +++++++++++++++++++---------- 1 file changed, 19 insertions(+), 10 deletions(-)
sound/soc/meson/axg-fifo.c +19 -10
@@ -204,18 +204,26 @@ static irqreturn_t axg_fifo_pcm_irq_block(int irq, void *dev_id)unsigned int status;regmap_read (fifo->map,FIFO_STATUS1 , &status); - status =FIELD_GET (STATUS1_INT_STS , status); +axg_fifo_ack_irq (fifo, status); + +/* Use the thread to call period elapsed on nonatomic links */ if (status &FIFO_INT_COUNT_REPEAT ) -snd_pcm_period_elapsed (ss); -else -dev_dbg (axg_fifo_dev (ss),"unexpected irq - STS 0x%02x\n" , - status); +return IRQ_WAKE_THREAD ; -/* Ack irqs */ -axg_fifo_ack_irq (fifo, status); +dev_dbg (axg_fifo_dev (ss),"unexpected irq - STS 0x%02x\n" , + status); + +return IRQ_NONE ; +} + +static irqreturn_t axg_fifo_pcm_irq_block_thread (int irq,void *dev_id) +{ +struct snd_pcm_substream *ss = dev_id; + +snd_pcm_period_elapsed (ss); -return IRQ_RETVAL (status); +return IRQ_HANDLED ; } int axg_fifo_pcm_open(struct snd_soc_component *component,
@@ -243,8 +251,9 @@ int axg_fifo_pcm_open(struct snd_soc_component *component,if (ret)return ret; - ret =request_irq (fifo->irq, axg_fifo_pcm_irq_block,0 , -dev_name (dev), ss); + ret =request_threaded_irq (fifo->irq, axg_fifo_pcm_irq_block, + axg_fifo_pcm_irq_block_thread, +IRQF_ONESHOT ,dev_name (dev), ss);if (ret)return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 69/236 ASoC: meson: axg-card: make links nonatomic
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <[email protected]>
[ Upstream commit dcba52ace7d4c12e2c8c273eff55ea03a84c8baf ]
Non atomic operations need to be performed in the trigger callback of the TDM interfaces. Those are BEs but what matters is the nonatomic flag of the FE in the DPCM context. Just set nonatomic for everything so, at least, what is done is clear.
--- sound/soc/meson/axg-card.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/meson/axg-card.c +1 -0
@@ -320,6 +320,7 @@ static int axg_card_add_link(struct snd_soc_card *card, struct device_node *np, dai_link->cpus = cpu; dai_link->num_cpus =1 ; + dai_link->nonatomic = true; ret =meson_card_parse_dai (card, np, &dai_link->cpus->of_node, &dai_link->cpus->dai_name);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 70/236 ASoC: meson: axg-tdm-interface: manage formatters in trigger
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <[email protected]>
[ Upstream commit f949ed458ad15a00d41b37c745ebadaef171aaae ]
So far, the formatters have been reset/enabled using the .prepare() callback. This was done in this callback because walking the formatters use a mutex. A mutex is used because formatter handling require dealing possibly slow clock operation.
With the support of non-atomic, .trigger() callback may be used which also allows to properly enable and disable formatters on start but also pause/resume.
This solve a random shift on TDMIN as well repeated samples on for TDMOUT.
--- sound/soc/meson/axg-tdm-interface.c | 34 ++++++++++++++++------------- 1 file changed, 19 insertions(+), 15 deletions(-)
sound/soc/meson/axg-tdm-interface.c +19 -15
@@ -351,26 +351,31 @@ static int axg_tdm_iface_hw_params(struct snd_pcm_substream *substream,return 0 ; } -static int axg_tdm_iface_hw_free (struct snd_pcm_substream *substream, +static int axg_tdm_iface_trigger (struct snd_pcm_substream *substream, +int cmd,struct snd_soc_dai *dai) { -struct axg_tdm_stream *ts =snd_soc_dai_get_dma_data (dai, substream); +struct axg_tdm_stream *ts = +snd_soc_dai_get_dma_data (dai, substream); -/* Stop all attached formatters */ -axg_tdm_stream_stop (ts); +switch (cmd) { +case SNDRV_PCM_TRIGGER_START : +case SNDRV_PCM_TRIGGER_RESUME : +case SNDRV_PCM_TRIGGER_PAUSE_RELEASE : +axg_tdm_stream_start (ts); +break ; +case SNDRV_PCM_TRIGGER_SUSPEND : +case SNDRV_PCM_TRIGGER_PAUSE_PUSH : +case SNDRV_PCM_TRIGGER_STOP : +axg_tdm_stream_stop (ts); +break ; +default : +return -EINVAL ; + }return 0 ; } -static int axg_tdm_iface_prepare (struct snd_pcm_substream *substream, -struct snd_soc_dai *dai) -{ -struct axg_tdm_stream *ts =snd_soc_dai_get_dma_data (dai, substream); - -/* Force all attached formatters to update */ -return axg_tdm_stream_reset (ts); -} -static int axg_tdm_iface_remove_dai (struct snd_soc_dai *dai) {if (dai->capture_dma_data)
@@ -408,8 +413,7 @@ static const struct snd_soc_dai_ops axg_tdm_iface_ops = { .set_fmt = axg_tdm_iface_set_fmt, .startup = axg_tdm_iface_startup, .hw_params = axg_tdm_iface_hw_params, - .prepare = axg_tdm_iface_prepare, - .hw_free = axg_tdm_iface_hw_free, + .trigger = axg_tdm_iface_trigger, };/* TDM Backend DAIs */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 71/236 ASoC: meson: cards: select SND_DYNAMIC_MINORS
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <[email protected]>
[ Upstream commit 6db26f9ea4edd8a17d39ab3c20111e3ccd704aef ]
Amlogic sound cards do create a lot of pcm interfaces, possibly more than
8. Some pcm interfaces are internal (like DPCM backends and c2c) and not exposed to userspace.
Those interfaces still increase the number passed to snd_find_free_minor(), which eventually exceeds 8 causing -EBUSY error on card registration if CONFIG_SND_DYNAMIC_MINORS=n and the interface is exposed to userspace.
select CONFIG_SND_DYNAMIC_MINORS for Amlogic cards to avoid the problem.
--- sound/soc/meson/Kconfig | 1 + 1 file changed, 1 insertion(+)
sound/soc/meson/Kconfig +1 -0
@@ -99,6 +99,7 @@ config SND_MESON_AXG_PDM config SND_MESON_CARD_UTILS tristate + select SND_DYNAMIC_MINORS config SND_MESON_CODEC_GLUE tristate
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 72/236 ALSA: hda: intel-sdw-acpi: fix usage of device_get_named_child_node()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre-Louis Bossart <[email protected]>
[ Upstream commit c158cf914713efc3bcdc25680c7156c48c12ef6a ]
The documentation for device_get_named_child_node() mentions this important point:
"
The caller is responsible for calling fwnode_handle_put() on the returned fwnode pointer.
"
Add fwnode_handle_put() to avoid a leaked reference.
Message-ID: <[email protected]>
--- sound/hda/intel-sdw-acpi.c | 2 ++ 1 file changed, 2 insertions(+)
sound/hda/intel-sdw-acpi.c +2 -0
@@ -41,6 +41,8 @@ static bool is_link_enabled(struct fwnode_handle *fw_node, u8 idx)"intel-quirk-mask" , &quirk_mask); +fwnode_handle_put (link); +if (quirk_mask &SDW_INTEL_QUIRK_MASK_BUS_DISABLE )return false;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 73/236 s390/cio: Ensure the copied buf is NUL terminated
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bui Quang Minh <[email protected]>
[ Upstream commit da7c622cddd4fe36be69ca61e8c42e43cde94784 ]
Currently, we allocate a lbuf-sized kernel buffer and copy lbuf from userspace to that buffer. Later, we use scanf on this buffer but we don't ensure that the string is terminated inside the buffer, this can lead to OOB read when using scanf. Fix this issue by using memdup_user_nul instead.
--- drivers/s390/cio/cio_inject.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/s390/cio/cio_inject.c +1 -1
@@ -95,7 +95,7 @@ static ssize_t crw_inject_write(struct file *file, const char __user *buf,return -EINVAL ; } - buffer =vmemdup_user (buf, lbuf); + buffer =memdup_user_nul (buf, lbuf);if (IS_ERR (buffer))return -ENOMEM ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 74/236 cxgb4: Properly lock TX queue for the selftest.
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <[email protected]>
[ Upstream commit 9067eccdd7849dd120d5495dbd5a686fa6ed2c1a ]
The selftest for the driver sends a dummy packet and checks if the packet will be received properly as it should be. The regular TX path and the selftest can use the same network queue so locking is required and was missing in the selftest path. This was addressed in the commit cited below.
Unfortunately locking the TX queue requires BH to be disabled which is not the case in selftest path which is invoked in process context. Lockdep should be complaining about this.
Use __netif_tx_lock_bh() for TX queue locking.
--- drivers/net/ethernet/chelsio/cxgb4/sge.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/ethernet/chelsio/cxgb4/sge.c +3 -3
@@ -2684,12 +2684,12 @@ int cxgb4_selftest_lb_pkt(struct net_device *netdev) lb->loopback =1 ; q = &adap->sge.ethtxq[pi->first_qset]; -__netif_tx_lock (q->txq,smp_processor_id ()); +__netif_tx_lock_bh (q->txq);reclaim_completed_tx (adap, &q->q,-1 , true); credits =txq_avail (&q->q) - ndesc;if (unlikely (credits <0 )) { -__netif_tx_unlock (q->txq); +__netif_tx_unlock_bh (q->txq);return -ENOMEM ; }
@@ -2724,7 +2724,7 @@ int cxgb4_selftest_lb_pkt(struct net_device *netdev)init_completion (&lb->completion);txq_advance (&q->q, ndesc);cxgb4_ring_tx_db (adap, &q->q, ndesc); -__netif_tx_unlock (q->txq); +__netif_tx_unlock_bh (q->txq);/* wait for the pkt to return */ ret =wait_for_completion_timeout (&lb->completion,10 *HZ );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 75/236 net: dsa: mv88e6xxx: Fix number of databases for 88E6141 / 88E6341
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Behún <[email protected]>
[ Upstream commit b9a61c20179fda7bdfe2c1210aa72451991ab81a ]
The Topaz family (88E6141 and 88E6341) only support 256 Forwarding Information Tables.
--- drivers/net/dsa/mv88e6xxx/chip.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/dsa/mv88e6xxx/chip.c +2 -2
@@ -5677,7 +5677,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = { .prod_num = MV88E6XXX_PORT_SWITCH_ID_PROD_6141, .family = MV88E6XXX_FAMILY_6341, .name = "Marvell 88E6141", - .num_databases = 4096, + .num_databases = 256, .num_macs = 2048, .num_ports = 6, .num_internal_phys = 5,
@@ -6134,7 +6134,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = { .prod_num = MV88E6XXX_PORT_SWITCH_ID_PROD_6341, .family = MV88E6XXX_FAMILY_6341, .name = "Marvell 88E6341", - .num_databases = 4096, + .num_databases = 256, .num_macs = 2048, .num_internal_phys = 5, .num_ports = 6,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 76/236 spi: fix null pointer dereference within spi_sync
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mans Rullgard <[email protected]>
[ Upstream commit 4756fa529b2f12b7cb8f21fe229b0f6f47190829 ]
If spi_sync() is called with the non-empty queue and the same spi_message is then reused, the complete callback for the message remains set while the context is cleared, leading to a null pointer dereference when the callback is invoked from spi_finalize_current_message().
With function inlining disabled, the call stack might look like this:
_raw_spin_lock_irqsave from complete_with_flags+0x18/0x58 complete_with_flags from spi_complete+0x8/0xc
spi_complete from spi_finalize_current_message+0xec/0x184 spi_finalize_current_message from spi_transfer_one_message+0x2a8/0x474 spi_transfer_one_message from __spi_pump_transfer_message+0x104/0x230 __spi_pump_transfer_message from __spi_transfer_message_noqueue+0x30/0xc4 __spi_transfer_message_noqueue from __spi_sync+0x204/0x248 __spi_sync from spi_sync+0x24/0x3c
spi_sync from mcp251xfd_regmap_crc_read+0x124/0x28c [mcp251xfd] mcp251xfd_regmap_crc_read [mcp251xfd] from _regmap_raw_read+0xf8/0x154 _regmap_raw_read from _regmap_bus_read+0x44/0x70
_regmap_bus_read from _regmap_read+0x60/0xd8
_regmap_read from regmap_read+0x3c/0x5c
regmap_read from mcp251xfd_alloc_can_err_skb+0x1c/0x54 [mcp251xfd] mcp251xfd_alloc_can_err_skb [mcp251xfd] from mcp251xfd_irq+0x194/0xe70 [mcp251xfd] mcp251xfd_irq [mcp251xfd] from irq_thread_fn+0x1c/0x78
irq_thread_fn from irq_thread+0x118/0x1f4
irq_thread from kthread+0xd8/0xf4
kthread from ret_from_fork+0x14/0x28
Fix this by also setting message->complete to NULL when the transfer is complete.
--- drivers/spi/spi.c | 1 + 1 file changed, 1 insertion(+)
drivers/spi/spi.c +1 -0
@@ -4217,6 +4217,7 @@ static int __spi_sync(struct spi_device *spi, struct spi_message *message)wait_for_completion (&done); status = message->status; } + message->complete =NULL ; message->context =NULL ;return status;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 77/236 net: bridge: fix multicast-to-unicast with fraglist GSO
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <[email protected]>
[ Upstream commit 59c878cbcdd80ed39315573b3511d0acfd3501b5 ]
Calling skb_copy on a SKB_GSO_FRAGLIST skb is not valid, since it returns an invalid linearized skb. This code only needs to change the ethernet header, so pskb_copy is the right function to call here.
--- net/bridge/br_forward.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/bridge/br_forward.c +1 -1
@@ -261,7 +261,7 @@ static void maybe_deliver_addr(struct net_bridge_port *p, struct sk_buff *skb,if (skb->dev == p->dev &ðer_addr_equal (src, addr))return ; - skb =skb_copy (skb,GFP_ATOMIC ); + skb =pskb_copy (skb,GFP_ATOMIC );if (!skb) {DEV_STATS_INC (dev, tx_dropped);return ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 78/236 net: core: reject skb_copy(_expand) for fraglist GSO skbs
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <[email protected]>
[ Upstream commit d091e579b864fa790dd6a0cd537a22c383126681 ]
SKB_GSO_FRAGLIST skbs must not be linearized, otherwise they become invalid. Return NULL if such an skb is passed to skb_copy or skb_copy_expand, in order to prevent a crash on a potential later call to skb_gso_segment.
--- net/core/skbuff.c | 27 +++++++++++++++++++-------- 1 file changed, 19 insertions(+), 8 deletions(-)
net/core/skbuff.c +19 -8
@@ -1720,11 +1720,17 @@ static inline int skb_alloc_rx_flag(const struct sk_buff *skb)struct sk_buff *skb_copy (const struct sk_buff *skb,gfp_t gfp_mask) { -int headerlen =skb_headroom (skb); -unsigned int size =skb_end_offset (skb) + skb->data_len; -struct sk_buff *n =__alloc_skb (size, gfp_mask, -skb_alloc_rx_flag (skb),NUMA_NO_NODE ); +struct sk_buff *n; +unsigned int size; +int headerlen; + +if (WARN_ON_ONCE (skb_shinfo (skb)->gso_type &SKB_GSO_FRAGLIST )) +return NULL ; + headerlen =skb_headroom (skb); + size =skb_end_offset (skb) + skb->data_len; + n =__alloc_skb (size, gfp_mask, +skb_alloc_rx_flag (skb),NUMA_NO_NODE );if (!n)return NULL ;
@@ -2037,12 +2043,17 @@ struct sk_buff *skb_copy_expand(const struct sk_buff *skb,/* * Allocate the copy buffer */ -struct sk_buff *n =__alloc_skb (newheadroom + skb->len + newtailroom, - gfp_mask,skb_alloc_rx_flag (skb), -NUMA_NO_NODE ); -int oldheadroom =skb_headroom (skb);int head_copy_len, head_copy_off; +struct sk_buff *n; +int oldheadroom; + +if (WARN_ON_ONCE (skb_shinfo (skb)->gso_type &SKB_GSO_FRAGLIST )) +return NULL ; + oldheadroom =skb_headroom (skb); + n =__alloc_skb (newheadroom + skb->len + newtailroom, + gfp_mask,skb_alloc_rx_flag (skb), +NUMA_NO_NODE );if (!n)return NULL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 79/236 tipc: fix a possible memleak in tipc_buf_append
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit 97bf6f81b29a8efaf5d0983251a7450e5794370d ]
__skb_linearize() doesn't free the skb when it fails, so move '*buf = NULL' after __skb_linearize(), so that the skb can be freed on the err path.
--- net/tipc/msg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/tipc/msg.c +1 -1
@@ -142,9 +142,9 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf)if (fragid ==FIRST_FRAGMENT ) {if (unlikely (head)) goto err; - *buf =NULL ;if (skb_has_frag_list (frag) &&__skb_linearize (frag)) goto err; + *buf =NULL ; frag =skb_unshare (frag,GFP_ATOMIC );if (unlikely (!frag)) goto err;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 80/236 vxlan: Pull inner IP header in vxlan_rcv().
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Nault <[email protected]>
[ Upstream commit f7789419137b18e3847d0cc41afd788c3c00663d ]
Ensure the inner IP header is part of skb's linear data before reading its ECN bits. Otherwise we might read garbage.
One symptom is the system erroneously logging errors like "vxlan: non-ECT from xxx.xxx.xxx.xxx with TOS=xxxx".
Similar bugs have been fixed in geneve, ip_tunnel and ip6_tunnel (see commit 1ca1ba465e55 ("geneve: make sure to pull inner header in geneve_rx()") for example). So let's reuse the same code structure for consistency. Maybe we'll can add a common helper in the future.
--- drivers/net/vxlan/vxlan_core.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-)
drivers/net/vxlan/vxlan_core.c +18 -1
@@ -1721,6 +1721,7 @@ static int vxlan_rcv(struct sock *sk, struct sk_buff *skb)bool raw_proto = false;void *oiph;__be32 vni =0 ; +int nh;/* Need UDP and VXLAN header to be present */ if (!pskb_may_pull (skb,VXLAN_HLEN ))
@@ -1809,9 +1810,25 @@ static int vxlan_rcv(struct sock *sk, struct sk_buff *skb) skb->pkt_type =PACKET_HOST ; } - oiph =skb_network_header (skb); +/* Save offset of outer header relative to skb->head, +* because we are going to reset the network header to the inner header +* and might change skb->head. +*/ + nh =skb_network_header (skb) - skb->head; +skb_reset_network_header (skb); +if (!pskb_inet_may_pull (skb)) { +DEV_STATS_INC (vxlan->dev, rx_length_errors); +DEV_STATS_INC (vxlan->dev, rx_errors); +vxlan_vnifilter_count (vxlan, vni, vninode, +VXLAN_VNI_STATS_RX_ERRORS ,0 ); + goto drop; + } + +/* Get the outer header. */ + oiph = skb->head + nh; +if (!vxlan_ecn_decapsulate (vs, oiph, skb)) { ++vxlan->dev->stats.rx_frame_errors; ++vxlan->dev->stats.rx_errors;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 81/236 s390/qeth: Fix kernel panic after setting hsuid
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandra Winter <[email protected]>
[ Upstream commit 8a2e4d37afb8500b276e5ee903dee06f50ab0494 ]
Symptom:
When the hsuid attribute is set for the first time on an IQD Layer3 device while the corresponding network interface is already UP, the kernel will try to execute a napi function pointer that is NULL.
Example:
---------------------------------------------------------------------------
[ 2057.572696] illegal operation: 0001 ilc:1 [#1] SMP
[ 2057.572702] Modules linked in: af_iucv qeth_l3 zfcp scsi_transport_fc sunrpc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6
nft_reject nft_ct nf_tables_set nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables libcrc32c nfnetlink ghash_s390 prng xts aes_s390 des_s390 de
s_generic sha3_512_s390 sha3_256_s390 sha512_s390 vfio_ccw vfio_mdev mdev vfio_iommu_type1 eadm_sch vfio ext4 mbcache jbd2 qeth_l2 bridge stp llc dasd_eckd_mod qeth dasd_mod
qdio ccwgroup pkey zcrypt
[ 2057.572739] CPU: 6 PID: 60182 Comm: stress_client Kdump: loaded Not tainted 4.18.0-541.el8.s390x #1
[ 2057.572742] Hardware name: IBM 3931 A01 704 (LPAR)
[ 2057.572744] Krnl PSW : 0704f00180000000 0000000000000002 (0x2)
[ 2057.572748] R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:3 PM:0 RI:0 EA:3
[ 2057.572751] Krnl GPRS: 0000000000000004 0000000000000000 00000000a3b008d8 0000000000000000
[ 2057.572754] 00000000a3b008d8 cb923a29c779abc5 0000000000000000 00000000814cfd80
[ 2057.572756] 000000000000012c 0000000000000000 00000000a3b008d8 00000000a3b008d8
[ 2057.572758] 00000000bab6d500 00000000814cfd80 0000000091317e46 00000000814cfc68
[ 2057.572762] Krnl Code:#0000000000000000: 0000 illegal
>0000000000000002: 0000 illegal
0000000000000004: 0000 illegal
0000000000000006: 0000 illegal
0000000000000008: 0000 illegal
000000000000000a: 0000 illegal
000000000000000c: 0000 illegal
000000000000000e: 0000 illegal
[ 2057.572800] Call Trace:
[ 2057.572801] ([<00000000ec639700>] 0xec639700)
[ 2057.572803] [<00000000913183e2>] net_rx_action+0x2ba/0x398
[ 2057.572809] [<0000000091515f76>] __do_softirq+0x11e/0x3a0
[ 2057.572813] [<0000000090ce160c>] do_softirq_own_stack+0x3c/0x58
[ 2057.572817] ([<0000000090d2cbd6>] do_softirq.part.1+0x56/0x60)
[ 2057.572822] [<0000000090d2cc60>] __local_bh_enable_ip+0x80/0x98
[ 2057.572825] [<0000000091314706>] __dev_queue_xmit+0x2be/0xd70
[ 2057.572827] [<000003ff803dd6d6>] afiucv_hs_send+0x24e/0x300 [af_iucv]
[ 2057.572830] [<000003ff803dd88a>] iucv_send_ctrl+0x102/0x138 [af_iucv]
[ 2057.572833] [<000003ff803de72a>] iucv_sock_connect+0x37a/0x468 [af_iucv]
[ 2057.572835] [<00000000912e7e90>] __sys_connect+0xa0/0xd8
[ 2057.572839] [<00000000912e9580>] sys_socketcall+0x228/0x348
[ 2057.572841] [<0000000091514e1a>] system_call+0x2a6/0x2c8
[ 2057.572843] Last Breaking-Event-Address:
[ 2057.572844] [<0000000091317e44>] __napi_poll+0x4c/0x1d8
[ 2057.572846]
[ 2057.572847] Kernel panic - not syncing: Fatal exception in interrupt-------------------------------------------------------------------------------------------
Analysis:
There is one napi structure per out_q: card->qdio.out_qs[i].napi The napi.poll functions are set during qeth_open().
Since
commit 1cfef80d4c2b ("s390/qeth: Don't call dev_close/dev_open (DOWN/UP)") qeth_set_offline()/qeth_set_online() no longer call dev_close()/ dev_open(). So if qeth_free_qdio_queues() cleared card->qdio.out_qs[i].napi.poll while the network interface was UP and the card was offline, they are not set again.
Reproduction:
chzdev -e $devno layer2=0
ip link set dev $network_interface up
echo 0 > /sys/bus/ccwgroup/devices/0.0.$devno/online
echo foo > /sys/bus/ccwgroup/devices/0.0.$devno/hsuid
echo 1 > /sys/bus/ccwgroup/devices/0.0.$devno/online
-> Crash (can be enforced e.g. by af_iucv connect(), ip link down/up, ...)
Note that a Completion Queue (CQ) is only enabled or disabled, when hsuid is set for the first time or when it is removed.
Workarounds:
- Set hsuid before setting the device online for the first time or
- Use chzdev -d $devno; chzdev $devno hsuid=xxx; chzdev -e $devno; to set hsuid on an existing device. (this will remove and recreate the network interface)
Fix:
There is no need to free the output queues when a completion queue is added or removed.card->qdio.state now indicates whether the inbound buffer pool and the outbound queues are allocated.card->qdio.c_q indicates whether a CQ is allocated.
--- drivers/s390/net/qeth_core_main.c | 61 ++++++++++++++----------------- 1 file changed, 27 insertions(+), 34 deletions(-)
drivers/s390/net/qeth_core_main.c +27 -34
@@ -364,30 +364,33 @@ static int qeth_cq_init(struct qeth_card *card)return rc; } +static void qeth_free_cq (struct qeth_card *card) +{ +if (card->qdio.c_q) { +qeth_free_qdio_queue (card->qdio.c_q); + card->qdio.c_q =NULL ; + } +} +static int qeth_alloc_cq (struct qeth_card *card) {if (card->options.cq ==QETH_CQ_ENABLED ) {QETH_CARD_TEXT (card,2 ,"cqon" ); - card->qdio.c_q =qeth_alloc_qdio_queue ();if (!card->qdio.c_q) { -dev_err (&card->gdev->dev,"Failed to create completion queue\n" ); -return -ENOMEM ; + card->qdio.c_q =qeth_alloc_qdio_queue (); +if (!card->qdio.c_q) { +dev_err (&card->gdev->dev, +"Failed to create completion queue\n" ); +return -ENOMEM ; + } } }else {QETH_CARD_TEXT (card,2 ,"nocq" ); - card->qdio.c_q =NULL ; +qeth_free_cq (card); }return 0 ; } -static void qeth_free_cq (struct qeth_card *card) -{ -if (card->qdio.c_q) { -qeth_free_qdio_queue (card->qdio.c_q); - card->qdio.c_q =NULL ; - } -} -static enum iucv_tx_notify qeth_compute_cq_notification (int sbalf15,int delayed) {
@@ -2628,6 +2631,10 @@ static int qeth_alloc_qdio_queues(struct qeth_card *card)QETH_CARD_TEXT (card,2 ,"allcqdbf" ); +/* completion */ +if (qeth_alloc_cq (card)) + goto out_err; +if (atomic_cmpxchg (&card->qdio.state,QETH_QDIO_UNINITIALIZED ,QETH_QDIO_ALLOCATED ) !=QETH_QDIO_UNINITIALIZED )return 0 ;
@@ -2663,10 +2670,6 @@ static int qeth_alloc_qdio_queues(struct qeth_card *card) queue->priority =QETH_QIB_PQUE_PRIO_DEFAULT ; } -/* completion */ -if (qeth_alloc_cq (card)) - goto out_freeoutq; -return 0 ; out_freeoutq:
@@ -2677,6 +2680,8 @@ static int qeth_alloc_qdio_queues(struct qeth_card *card)qeth_free_buffer_pool (card); out_buffer_pool:atomic_set (&card->qdio.state,QETH_QDIO_UNINITIALIZED ); +qeth_free_cq (card); +out_err:return -ENOMEM ; }
@@ -2684,11 +2689,12 @@ static void qeth_free_qdio_queues(struct qeth_card *card) {int i, j; +qeth_free_cq (card); +if (atomic_xchg (&card->qdio.state,QETH_QDIO_UNINITIALIZED ) ==QETH_QDIO_UNINITIALIZED )return ; -qeth_free_cq (card);for (j =0 ; j <QDIO_MAX_BUFFERS_PER_Q ; ++j) {if (card->qdio.in_q->bufs[j].rx_skb) {consume_skb (card->qdio.in_q->bufs[j].rx_skb);
@@ -3740,24 +3746,11 @@ static void qeth_qdio_poll(struct ccw_device *cdev, unsigned long card_ptr)int qeth_configure_cq (struct qeth_card *card,enum qeth_cq cq) { -int rc; - -if (card->options.cq ==QETH_CQ_NOTAVAILABLE ) { - rc =-1 ; - goto out; - }else { -if (card->options.cq == cq) { - rc =0 ; - goto out; - } - -qeth_free_qdio_queues (card); - card->options.cq = cq; - rc =0 ; - } -out: -return rc; +if (card->options.cq ==QETH_CQ_NOTAVAILABLE ) +return -1 ; + card->options.cq = cq; +return 0 ; }EXPORT_SYMBOL_GPL (qeth_configure_cq);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 82/236 drm/panel: ili9341: Respect deferred probe
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 740fc1e0509be3f7e2207e89125b06119ed62943 ]
GPIO controller might not be available when driver is being probed. There are plenty of reasons why, one of which is deferred probe.
Since GPIOs are optional, return any error code we got to the upper layer, including deferred probe. With that in mind, use dev_err_probe() in order to avoid spamming the logs.
--- drivers/gpu/drm/panel/panel-ilitek-ili9341.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/panel/panel-ilitek-ili9341.c +2 -2
@@ -717,11 +717,11 @@ static int ili9341_probe(struct spi_device *spi) reset =devm_gpiod_get_optional (dev,"reset" ,GPIOD_OUT_HIGH );if (IS_ERR (reset)) -dev_err (dev,"Failed to get gpio 'reset'\n" ); +return dev_err_probe (dev,PTR_ERR (reset),"Failed to get gpio 'reset'\n" ); dc =devm_gpiod_get_optional (dev,"dc" ,GPIOD_OUT_LOW );if (IS_ERR (dc)) -dev_err (dev,"Failed to get gpio 'dc'\n" ); +return dev_err_probe (dev,PTR_ERR (dc),"Failed to get gpio 'dc'\n" );if (!strcmp (id->name,"sf-tc240t-9370-t" ))return ili9341_dpi_probe (spi, dc, reset);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 83/236 drm/panel: ili9341: Use predefined error codes
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit da85f0aaa9f21999753b01d45c0343f885a8f905 ]
In one case the -1 is returned which is quite confusing code for the wrong device ID, in another the ret is returning instead of plain 0 that also confusing as readed may ask the possible meaning of positive codes, which are never the case there. Convert both to use explicit predefined error codes to make it clear what's going on there.
--- drivers/gpu/drm/panel/panel-ilitek-ili9341.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/panel/panel-ilitek-ili9341.c +2 -2
@@ -420,7 +420,7 @@ static int ili9341_dpi_prepare(struct drm_panel *panel)ili9341_dpi_init (ili); -return ret; +return 0 ; }static int ili9341_dpi_enable (struct drm_panel *panel)
@@ -728,7 +728,7 @@ static int ili9341_probe(struct spi_device *spi)else if (!strcmp (id->name,"yx240qv29" ))return ili9341_dbi_probe (spi, dc, reset); -return -1 ; +return -ENODEV ; }static void ili9341_remove (struct spi_device *spi)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 84/236 net: gro: add flush check in udp_gro_receive_segment
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Gobert <[email protected]>
[ Upstream commit 5babae777c61aa8a8679d59d3cdc54165ad96d42 ]
GRO-GSO path is supposed to be transparent and as such L3 flush checks are relevant to all UDP flows merging in GRO. This patch uses the same logic and code from tcp_gro_receive, terminating merge if flush is non zero.
--- net/ipv4/udp_offload.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
net/ipv4/udp_offload.c +11 -1
@@ -463,6 +463,7 @@ static struct sk_buff *udp_gro_receive_segment(struct list_head *head,struct sk_buff *p;unsigned int ulen;int ret =0 ; +int flush;/* requires non zero csum, for symmetry with GSO */ if (!uh->check) {
@@ -496,13 +497,22 @@ static struct sk_buff *udp_gro_receive_segment(struct list_head *head,return p; } + flush =NAPI_GRO_CB (p)->flush; + +if (NAPI_GRO_CB (p)->flush_id !=1 || +NAPI_GRO_CB (p)->count !=1 || + !NAPI_GRO_CB (p)->is_atomic) + flush |=NAPI_GRO_CB (p)->flush_id; +else +NAPI_GRO_CB (p)->is_atomic = false; +/* Terminate the flow on len mismatch or if it grow "too much". * Under small packet flood GRO count could elsewhere grow a lot * leading to excessive truesize values. * On len mismatch merge the first packet shorter than gso_size, * otherwise complete the GRO packet. */ -if (ulen >ntohs (uh2->len)) { +if (ulen >ntohs (uh2->len) || flush) { pp = p; }else {if (NAPI_GRO_CB (skb)->is_flist) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 85/236 clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jernej Skrabec <[email protected]>
[ Upstream commit 7e91ed763dc07437777bd012af7a2bd4493731ff ]
While PLL CPUX clock rate change when CPU is running from it works in vast majority of cases, now and then it causes instability. This leads to system crashes and other undefined behaviour. After a lot of testing (30+ hours) while also doing a lot of frequency switches, we can't observe any instability issues anymore when doing reparenting to stable clock like 24 MHz oscillator.
--- drivers/clk/sunxi-ng/ccu-sun50i-h6.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-)
drivers/clk/sunxi-ng/ccu-sun50i-h6.c +17 -2
@@ -1181,11 +1181,18 @@ static const u32 usb2_clk_regs[] = { SUN50I_H6_USB3_CLK_REG, }; +static struct ccu_mux_nb sun50i_h6_cpu_nb = { + .common = &cpux_clk.common, + .cm = &cpux_clk.mux, + .delay_us =1 , + .bypass_index =0 ,/* index of 24 MHz oscillator */ +}; +static int sun50i_h6_ccu_probe (struct platform_device *pdev) {void __iomem *reg; +int i, ret;u32 val; -int i; reg =devm_platform_ioremap_resource (pdev,0 );if (IS_ERR (reg))
@@ -1252,7 +1259,15 @@ static int sun50i_h6_ccu_probe(struct platform_device *pdev) val |=BIT (24 );writel (val, reg +SUN50I_H6_HDMI_CEC_CLK_REG ); -return devm_sunxi_ccu_probe (&pdev->dev, reg, &sun50i_h6_ccu_desc); + ret =devm_sunxi_ccu_probe (&pdev->dev, reg, &sun50i_h6_ccu_desc); +if (ret) +return ret; + +/* Reparent CPU during PLL CPUX rate changes */ +ccu_mux_notifier_register (pll_cpux_clk.common.hw.clk, + &sun50i_h6_cpu_nb); + +return 0 ; }static const struct of_device_id sun50i_h6_ccu_ids[] = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 86/236 powerpc/pseries: replace kmalloc with kzalloc in PLPKS driver
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nayna Jain <[email protected]>
[ Upstream commit 212dd5cfbee7815f3c665a51c501701edb881599 ]
Replace kmalloc with kzalloc in construct_auth() function to default initialize structure with zeroes.
Stable-dep-of: 784354349d2c ("powerpc/pseries: make max polling consistent for longer H_CALLs")
--- arch/powerpc/platforms/pseries/plpks.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
arch/powerpc/platforms/pseries/plpks.c +2 -6
@@ -162,19 +162,15 @@ static struct plpks_auth *construct_auth(u8 consumer)if (consumer >PKS_OS_OWNER )return ERR_PTR (-EINVAL ); - auth =kmalloc (struct_size (auth, password, maxpwsize),GFP_KERNEL ); + auth =kzalloc (struct_size (auth, password, maxpwsize),GFP_KERNEL );if (!auth)return ERR_PTR (-ENOMEM ); auth->version =1 ; auth->consumer = consumer; - auth->rsvd0 =0 ; - auth->rsvd1 =0 ; -if (consumer ==PKS_FW_OWNER || consumer ==PKS_BOOTLOADER_OWNER ) { - auth->passwordlength =0 ; +if (consumer ==PKS_FW_OWNER || consumer ==PKS_BOOTLOADER_OWNER )return auth; - }memcpy (auth->password, ospassword, ospasswordlength);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 87/236 powerpc/pseries: Move PLPKS constants to header file
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Russell Currey <[email protected]>
[ Upstream commit 3def7a3e7c2ce2ab5e5c54561da7125206851be4 ]
Move the constants defined in plpks.c to plpks.h, and standardise their naming, so that PLPKS consumers can make use of them later on.
Stable-dep-of: 784354349d2c ("powerpc/pseries: make max polling consistent for longer H_CALLs")
--- arch/powerpc/platforms/pseries/plpks.c | 57 ++++++++++---------------- arch/powerpc/platforms/pseries/plpks.h | 36 +++++++++++++--- 2 files changed, 53 insertions(+), 40 deletions(-)
arch/powerpc/platforms/pseries/plpks.c +22 -35
@@ -21,19 +21,6 @@#include "plpks.h" -#define PKS_FW_OWNER 0x1 -#define PKS_BOOTLOADER_OWNER 0x2 -#define PKS_OS_OWNER 0x3 - -#define LABEL_VERSION 0 -#define MAX_LABEL_ATTR_SIZE 16 -#define MAX_NAME_SIZE 239 -#define MAX_DATA_SIZE 4000 - -#define PKS_FLUSH_MAX_TIMEOUT 5000 //msec -#define PKS_FLUSH_SLEEP 10 //msec -#define PKS_FLUSH_SLEEP_RANGE 400 -static u8 *ospassword;static u16 ospasswordlength;
@@ -60,7 +47,7 @@ struct label_attr {struct label {struct label_attr attr; -u8 name[MAX_NAME_SIZE ]; +u8 name[PLPKS_MAX_NAME_SIZE ];size_t size; };
@@ -123,7 +110,7 @@ static int pseries_status_to_err(int rc)static int plpks_gen_password (void ) {unsigned long retbuf[PLPAR_HCALL_BUFSIZE ] = {0 }; -u8 *password, consumer =PKS_OS_OWNER ; +u8 *password, consumer =PLPKS_OS_OWNER ;int rc; password =kzalloc (maxpwsize,GFP_KERNEL );
@@ -159,7 +146,7 @@ static struct plpks_auth *construct_auth(u8 consumer) {struct plpks_auth *auth; -if (consumer >PKS_OS_OWNER ) +if (consumer >PLPKS_OS_OWNER )return ERR_PTR (-EINVAL ); auth =kzalloc (struct_size (auth, password, maxpwsize),GFP_KERNEL );
@@ -169,7 +156,7 @@ static struct plpks_auth *construct_auth(u8 consumer) auth->version =1 ; auth->consumer = consumer; -if (consumer ==PKS_FW_OWNER || consumer ==PKS_BOOTLOADER_OWNER ) +if (consumer ==PLPKS_FW_OWNER || consumer ==PLPKS_BOOTLOADER_OWNER )return auth;memcpy (auth->password, ospassword, ospasswordlength);
@@ -189,7 +176,7 @@ static struct label *construct_label(char *component, u8 varos, u8 *name,struct label *label;size_t slen; -if (!name || namelen >MAX_NAME_SIZE ) +if (!name || namelen >PLPKS_MAX_NAME_SIZE )return ERR_PTR (-EINVAL ); slen =strlen (component);
@@ -203,9 +190,9 @@ static struct label *construct_label(char *component, u8 varos, u8 *name,if (component)memcpy (&label->attr.prefix, component, slen); - label->attr.version =LABEL_VERSION ; + label->attr.version =PLPKS_LABEL_VERSION ; label->attr.os = varos; - label->attr.length =MAX_LABEL_ATTR_SIZE ; + label->attr.length =PLPKS_MAX_LABEL_ATTR_SIZE ;memcpy (&label->name, name, namelen); label->size =sizeof (struct label_attr ) + namelen;
@@ -267,10 +254,10 @@ static int plpks_confirm_object_flushed(struct label *label,if (!rc && status ==1 )break ; -usleep_range (PKS_FLUSH_SLEEP , -PKS_FLUSH_SLEEP +PKS_FLUSH_SLEEP_RANGE ); - timeout = timeout +PKS_FLUSH_SLEEP ; - }while (timeout <PKS_FLUSH_MAX_TIMEOUT ); +usleep_range (PLPKS_FLUSH_SLEEP , +PLPKS_FLUSH_SLEEP +PLPKS_FLUSH_SLEEP_RANGE ); + timeout = timeout +PLPKS_FLUSH_SLEEP ; + }while (timeout <PLPKS_MAX_TIMEOUT ); rc =pseries_status_to_err (rc);
@@ -285,13 +272,13 @@ int plpks_write_var(struct plpks_var var)int rc;if (!var.component || !var.data || var.datalen <=0 || - var.namelen >MAX_NAME_SIZE || var.datalen >MAX_DATA_SIZE ) + var.namelen >PLPKS_MAX_NAME_SIZE || var.datalen >PLPKS_MAX_DATA_SIZE )return -EINVAL ; -if (var.policy &SIGNEDUPDATE ) +if (var.policy &PLPKS_SIGNEDUPDATE )return -EINVAL ; - auth =construct_auth (PKS_OS_OWNER ); + auth =construct_auth (PLPKS_OS_OWNER );if (IS_ERR (auth))return PTR_ERR (auth);
@@ -327,10 +314,10 @@ int plpks_remove_var(char *component, u8 varos, struct plpks_var_name vname)struct label *label;int rc; -if (!component || vname.namelen >MAX_NAME_SIZE ) +if (!component || vname.namelen >PLPKS_MAX_NAME_SIZE )return -EINVAL ; - auth =construct_auth (PKS_OS_OWNER ); + auth =construct_auth (PLPKS_OS_OWNER );if (IS_ERR (auth))return PTR_ERR (auth);
@@ -366,14 +353,14 @@ static int plpks_read_var(u8 consumer, struct plpks_var *var)u8 *output;int rc; -if (var->namelen >MAX_NAME_SIZE ) +if (var->namelen >PLPKS_MAX_NAME_SIZE )return -EINVAL ; auth =construct_auth (consumer);if (IS_ERR (auth))return PTR_ERR (auth); -if (consumer ==PKS_OS_OWNER ) { +if (consumer ==PLPKS_OS_OWNER ) { label =construct_label (var->component, var->os, var->name, var->namelen);if (IS_ERR (label)) {
@@ -388,7 +375,7 @@ static int plpks_read_var(u8 consumer, struct plpks_var *var) goto out_free_label; } -if (consumer ==PKS_OS_OWNER ) +if (consumer ==PLPKS_OS_OWNER ) rc =plpar_hcall (H_PKS_READ_OBJECT , retbuf,virt_to_phys (auth),virt_to_phys (label), label->size,virt_to_phys (output), maxobjsize);
@@ -430,17 +417,17 @@ static int plpks_read_var(u8 consumer, struct plpks_var *var)int plpks_read_os_var (struct plpks_var *var) { -return plpks_read_var (PKS_OS_OWNER , var); +return plpks_read_var (PLPKS_OS_OWNER , var); }int plpks_read_fw_var (struct plpks_var *var) { -return plpks_read_var (PKS_FW_OWNER , var); +return plpks_read_var (PLPKS_FW_OWNER , var); }int plpks_read_bootloader_var (struct plpks_var *var) { -return plpks_read_var (PKS_BOOTLOADER_OWNER , var); +return plpks_read_var (PLPKS_BOOTLOADER_OWNER , var); }static __init int pseries_plpks_init (void )
arch/powerpc/platforms/pseries/plpks.h +31 -5
@@ -12,14 +12,40 @@#include <linux/types.h> #include <linux/list.h> -#define OSSECBOOTAUDIT 0x40000000 -#define OSSECBOOTENFORCE 0x20000000 -#define WORLDREADABLE 0x08000000 -#define SIGNEDUPDATE 0x01000000 +// Object policy flags from supported_policies +#define PLPKS_OSSECBOOTAUDIT PPC_BIT32(1) // OS secure boot must be audit/enforce +#define PLPKS_OSSECBOOTENFORCE PPC_BIT32(2) // OS secure boot must be enforce +#define PLPKS_PWSET PPC_BIT32(3) // No access without password set +#define PLPKS_WORLDREADABLE PPC_BIT32(4) // Readable without authentication +#define PLPKS_IMMUTABLE PPC_BIT32(5) // Once written, object cannot be removed +#define PLPKS_TRANSIENT PPC_BIT32(6) // Object does not persist through reboot +#define PLPKS_SIGNEDUPDATE PPC_BIT32(7) // Object can only be modified by signed updates +#define PLPKS_HVPROVISIONED PPC_BIT32(28) // Hypervisor has provisioned this object -#define PLPKS_VAR_LINUX 0x02 +// Signature algorithm flags from signed_update_algorithms +#define PLPKS_ALG_RSA2048 PPC_BIT(0) +#define PLPKS_ALG_RSA4096 PPC_BIT(1) + +// Object label OS metadata flags +#define PLPKS_VAR_LINUX 0x02#define PLPKS_VAR_COMMON 0x04 +// Flags for which consumer owns an object is owned by +#define PLPKS_FW_OWNER 0x1 +#define PLPKS_BOOTLOADER_OWNER 0x2 +#define PLPKS_OS_OWNER 0x3 + +// Flags for label metadata fields +#define PLPKS_LABEL_VERSION 0 +#define PLPKS_MAX_LABEL_ATTR_SIZE 16 +#define PLPKS_MAX_NAME_SIZE 239 +#define PLPKS_MAX_DATA_SIZE 4000 + +// Timeouts for PLPKS operations +#define PLPKS_MAX_TIMEOUT 5000 // msec +#define PLPKS_FLUSH_SLEEP 10 // msec +#define PLPKS_FLUSH_SLEEP_RANGE 400 +struct plpks_var {char *component;u8 *name;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 88/236 powerpc/pseries: Implement signed update for PLPKS objects
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nayna Jain <[email protected]>
[ Upstream commit 899d9b8fee66da820eadc60b2a70090eb83db761 ]
The Platform Keystore provides a signed update interface which can be used to create, replace or append to certain variables in the PKS in a secure fashion, with the hypervisor requiring that the update be signed using the Platform Key.
Implement an interface to the H_PKS_SIGNED_UPDATE hcall in the plpks driver to allow signed updates to PKS objects.
(The plpks driver doesn't need to do any cryptography or otherwise handle the actual signed variable contents - that will be handled by userspace tooling.)
Stable-dep-of: 784354349d2c ("powerpc/pseries: make max polling consistent for longer H_CALLs")
--- arch/powerpc/include/asm/hvcall.h | 1 + arch/powerpc/platforms/pseries/plpks.c | 74 ++++++++++++++++++++++++-- arch/powerpc/platforms/pseries/plpks.h | 5 ++ 3 files changed, 75 insertions(+), 5 deletions(-)
arch/powerpc/include/asm/hvcall.h +1 -0
@@ -335,6 +335,7 @@#define H_RPT_INVALIDATE 0x448#define H_SCM_FLUSH 0x44C#define H_GET_ENERGY_SCALE_INFO 0x450 +#define H_PKS_SIGNED_UPDATE 0x454#define H_WATCHDOG 0x45C#define MAX_HCALL_OPCODE H_WATCHDOG
arch/powerpc/platforms/pseries/plpks.c +69 -5
102 lines not on this page · raw message
arch/powerpc/platforms/pseries/plpks.h +5 -0
@@ -66,6 +66,11 @@ struct plpks_var_name_list {struct plpks_var_name varlist[]; }; +/** +* Updates the authenticated variable. It expects NULL as the component. +*/ +int plpks_signed_update_var (struct plpks_var *var,u64 flags); +/** * Writes the specified var and its data to PKS. * Any caller of PKS driver should present a valid component type for
Signature · 1 line
2.43.0
Re: [PATCH 6.1 088/236] powerpc/pseries: Implement signed update for PLPKS objects
Quoted 33 lines · Greg Kroah-Hartman
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nayna Jain <[email protected]>
[ Upstream commit
899d9b8fee66da820eadc60b2a70090eb83db761]The Platform Keystore provides a signed update interface which can be used
to create, replace or append to certain variables in the PKS in a secure
fashion, with the hypervisor requiring that the update be signed using the
Platform Key.Implement an interface to the
H_PKS_SIGNED_UPDATEhcall in the plpks driver to allow signed updates to PKS objects.(The plpks driver doesn't need to do any cryptography or otherwise handle
the actual signed variable contents - that will be handled by userspace
tooling.)Signed-off-by Nayna Jain <[email protected]>[ajd: split patch, add timeout handling and misc cleanups]Co-developed-by Andrew Donnellan <[email protected]>Signed-off-by Andrew Donnellan <[email protected]>Signed-off-by Russell Currey <[email protected]>Reviewed-by Stefan Berger <[email protected]>Signed-off-by Michael Ellerman <[email protected]>
Quoted 5 lines
Link:
https://lore.kernel.org/r/[email protected]
Stable-dep-of:784354349d2c("powerpc/pseries: make max polling consistent for longerH_CALLs")Signed-off-by Sasha Levin <[email protected]>
This is a new feature and I don't think it should be backported. 784354349d2c can be backported by dropping the plpks_signed_update_var() hunk.
Signature · 2 lines
Andrew Donnellan OzLabs, ADL Canberra [email protected] IBM Australia Limited
Greg Kroah-Hartman
maintainerRe: [PATCH 6.1 088/236] powerpc/pseries: Implement signed update for PLPKS objects
Quoted 40 lines · Andrew Donnellan
Quoted 33 lines · Greg Kroah-Hartman
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nayna Jain <[email protected]>
[ Upstream commit
899d9b8fee66da820eadc60b2a70090eb83db761]The Platform Keystore provides a signed update interface which can be used
to create, replace or append to certain variables in the PKS in a secure
fashion, with the hypervisor requiring that the update be signed using the
Platform Key.Implement an interface to the
H_PKS_SIGNED_UPDATEhcall in the plpks driver to allow signed updates to PKS objects.(The plpks driver doesn't need to do any cryptography or otherwise handle
the actual signed variable contents - that will be handled by userspace
tooling.)Signed-off-by Nayna Jain <[email protected]>[ajd: split patch, add timeout handling and misc cleanups]Co-developed-by Andrew Donnellan <[email protected]>Signed-off-by Andrew Donnellan <[email protected]>Signed-off-by Russell Currey <[email protected]>Reviewed-by Stefan Berger <[email protected]>Signed-off-by Michael Ellerman <[email protected]>Quoted 5 lines
Link:
https://lore.kernel.org/r/[email protected]
Stable-dep-of:784354349d2c("powerpc/pseries: make max polling consistent for longerH_CALLs")Signed-off-by Sasha Levin <[email protected]>
Quoted 4 lines
This is a new feature and I don't think it should be backported.
784354349d2ccan be backported by dropping theplpks_signed_update_var()hunk.
Now dropped and fixed up, thanks.
greg k-h
Greg Kroah-Hartman
maintainerPATCH 89/236 powerpc/pseries: make max polling consistent for longer H_CALLs
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nayna Jain <[email protected]>
[ Upstream commit 784354349d2c988590c63a5a001ca37b2a6d4da1 ]
Currently, plpks_confirm_object_flushed() function polls for 5msec in total instead of 5sec.
Keep max polling time consistent for all the H_CALLs, which take longer than expected, to be 5sec. Also, make use of fsleep() everywhere to insert delay.
--- arch/powerpc/platforms/pseries/plpks.c | 10 +++++----- arch/powerpc/platforms/pseries/plpks.h | 5 ++--- 2 files changed, 7 insertions(+), 8 deletions(-)
arch/powerpc/platforms/pseries/plpks.c +5 -5
@@ -263,8 +263,7 @@ static int plpks_confirm_object_flushed(struct label *label,if (!rc && status ==1 )break ; -usleep_range (PLPKS_FLUSH_SLEEP , -PLPKS_FLUSH_SLEEP +PLPKS_FLUSH_SLEEP_RANGE ); +fsleep (PLPKS_FLUSH_SLEEP ); timeout = timeout +PLPKS_FLUSH_SLEEP ; }while (timeout <PLPKS_MAX_TIMEOUT );
@@ -311,9 +310,10 @@ int plpks_signed_update_var(struct plpks_var *var, u64 flags) continuetoken = retbuf[0 ];if (pseries_status_to_err (rc) == -EBUSY ) { -int delay_ms =get_longbusy_msecs (rc); -mdelay (delay_ms); - timeout += delay_ms; +int delay_us =get_longbusy_msecs (rc) *1000 ; + +fsleep (delay_us); + timeout += delay_us; } rc =pseries_status_to_err (rc); }while (rc == -EBUSY && timeout <PLPKS_MAX_TIMEOUT );
arch/powerpc/platforms/pseries/plpks.h +2 -3
@@ -42,9 +42,8 @@#define PLPKS_MAX_DATA_SIZE 4000// Timeouts for PLPKS operations -#define PLPKS_MAX_TIMEOUT 5000 // msec -#define PLPKS_FLUSH_SLEEP 10 // msec -#define PLPKS_FLUSH_SLEEP_RANGE 400 +#define PLPKS_MAX_TIMEOUT (5 * USEC_PER_SEC) +#define PLPKS_FLUSH_SLEEP 10000 // usecstruct plpks_var {char *component;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 90/236 powerpc/pseries/iommu: LPAR panics during boot up with a frozen PE
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gaurav Batra <[email protected]>
[ Upstream commit 49a940dbdc3107fecd5e6d3063dc07128177e058 ]
At the time of LPAR boot up, partition firmware provides Open Firmware property ibm,dma-window for the PE. This property is provided on the PCI bus the PE is attached to.
There are execptions where the partition firmware might not provide this property for the PE at the time of LPAR boot up. One of the scenario is where the firmware has frozen the PE due to some error condition. This PE is frozen for 24 hours or unless the whole system is reinitialized.
Within this time frame, if the LPAR is booted, the frozen PE will be presented to the LPAR but ibm,dma-window property could be missing.
Today, under these circumstances, the LPAR oopses with NULL pointer dereference, when configuring the PCI bus the PE is attached to.
BUG: Kernel NULL pointer dereference on read at 0x000000c8
Faulting instruction address: 0xc0000000001024c0
Oops: Kernel access of bad area, sig: 7 [#1]
LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries
Modules linked in:
Supported: Yes
CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.4.0-150600.9-default #1
Hardware name: IBM,9043-MRX POWER10 (raw) 0x800200 0xf000006 of:IBM,FW1060.00 (NM1060_023) hv:phyp pSeries
NIP: c0000000001024c0 LR: c0000000001024b0 CTR: c000000000102450
REGS: c0000000037db5c0 TRAP: 0300 Not tainted (6.4.0-150600.9-default)
MSR: 8000000002009033 <SF,VEC,EE,ME,IR,DR,RI,LE> CR: 28000822 XER: 00000000
CFAR: c00000000010254c DAR: 00000000000000c8 DSISR: 00080000 IRQMASK: 0
...
NIP [c0000000001024c0] pci_dma_bus_setup_pSeriesLP+0x70/0x2a0
LR [c0000000001024b0] pci_dma_bus_setup_pSeriesLP+0x60/0x2a0
Call Trace:
pci_dma_bus_setup_pSeriesLP+0x60/0x2a0 (unreliable)
pcibios_setup_bus_self+0x1c0/0x370
__of_scan_bus+0x2f8/0x330
pcibios_scan_phb+0x280/0x3d0
pcibios_init+0x88/0x12c
do_one_initcall+0x60/0x320
kernel_init_freeable+0x344/0x3e4
kernel_init+0x34/0x1d0
ret_from_kernel_user_thread+0x14/0x1c--- arch/powerpc/platforms/pseries/iommu.c | 8 ++++++++ 1 file changed, 8 insertions(+)
arch/powerpc/platforms/pseries/iommu.c +8 -0
@@ -781,8 +781,16 @@ static void pci_dma_bus_setup_pSeriesLP(struct pci_bus *bus)* parent bus. During reboot, there will be ibm,dma-window property to * define DMA window. For kdump, there will at least be default window or DDW * or both. +* There is an exception to the above. In case the PE goes into frozen +* state, firmware may not provide ibm,dma-window property at the time +* of LPAR boot up. */ +if (!pdn) { +pr_debug (" no ibm,dma-window property !\n" ); +return ; + } + ppci =PCI_DN (pdn); pr_debug(" parent is %pOF, iommu_table: 0x%p\n",
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 91/236 KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <[email protected]>
[ Upstream commit 4e7728c81a54b17bd33be402ac140bc11bb0c4f4 ]
When parsing a GICv2 attribute that contains a cpuid, handle this as the vcpu_id, not a vcpu_idx, as userspace cannot really know the mapping between the two. For this, use kvm_get_vcpu_by_id() instead of kvm_get_vcpu().
Take this opportunity to get rid of the pointless check against online_vcpus, which doesn't make much sense either, and switch to FIELD_GET as a way to extract the vcpu_id.
Stable-dep-of: 6ddb4f372fc6 ("KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr()")
--- arch/arm64/kvm/vgic/vgic-kvm-device.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
arch/arm64/kvm/vgic/vgic-kvm-device.c +2 -6
@@ -339,13 +339,9 @@ int vgic_v2_parse_attr(struct kvm_device *dev, struct kvm_device_attr *attr, {int cpuid; - cpuid = (attr->attr &KVM_DEV_ARM_VGIC_CPUID_MASK ) >> -KVM_DEV_ARM_VGIC_CPUID_SHIFT ; + cpuid =FIELD_GET (KVM_DEV_ARM_VGIC_CPUID_MASK , attr->attr); -if (cpuid >=atomic_read (&dev->kvm->online_vcpus)) -return -EINVAL ; - - reg_attr->vcpu =kvm_get_vcpu (dev->kvm, cpuid); + reg_attr->vcpu =kvm_get_vcpu_by_id (dev->kvm, cpuid); reg_attr->addr = attr->attr &KVM_DEV_ARM_VGIC_OFFSET_MASK ;return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 92/236 KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Upton <[email protected]>
[ Upstream commit 6ddb4f372fc63210034b903d96ebbeb3c7195adb ]
vgic_v2_parse_attr() is responsible for finding the vCPU that matches the user-provided CPUID, which (of course) may not be valid. If the ID is invalid, kvm_get_vcpu_by_id() returns NULL, which isn't handled gracefully.
Similar to the GICv3 uaccess flow, check that kvm_get_vcpu_by_id() actually returns something and fail the ioctl if not.
--- arch/arm64/kvm/vgic/vgic-kvm-device.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/arm64/kvm/vgic/vgic-kvm-device.c +4 -4
@@ -337,12 +337,12 @@ int kvm_register_vgic_device(unsigned long type)int vgic_v2_parse_attr (struct kvm_device *dev,struct kvm_device_attr *attr,struct vgic_reg_attr *reg_attr) { -int cpuid; +int cpuid =FIELD_GET (KVM_DEV_ARM_VGIC_CPUID_MASK , attr->attr); - cpuid =FIELD_GET (KVM_DEV_ARM_VGIC_CPUID_MASK , attr->attr); - - reg_attr->vcpu =kvm_get_vcpu_by_id (dev->kvm, cpuid); reg_attr->addr = attr->attr &KVM_DEV_ARM_VGIC_OFFSET_MASK ; + reg_attr->vcpu =kvm_get_vcpu_by_id (dev->kvm, cpuid); +if (!reg_attr->vcpu) +return -EINVAL ;return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 93/236 scsi: lpfc: Move NPIVs transport unregistration to after resource clean up
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit 4ddf01f2f1504fa08b766e8cfeec558e9f8eef6c ]
There are cases after NPIV deletion where the fabric switch still believes the NPIV is logged into the fabric. This occurs when a vport is unregistered before the Remove All DA_ID CT and LOGO ELS are sent to the fabric.
Currently fc_remove_host(), which calls dev_loss_tmo for all D_IDs including the fabric D_ID, removes the last ndlp reference and frees the ndlp rport object. This sometimes causes the race condition where the final DA_ID and LOGO are skipped from being sent to the fabric switch.
Fix by moving the fc_remove_host() and scsi_remove_host() calls after DA_ID and LOGO are sent.
--- drivers/scsi/lpfc/lpfc_vport.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/scsi/lpfc/lpfc_vport.c +4 -4
@@ -693,10 +693,6 @@ lpfc_vport_delete(struct fc_vport *fc_vport)lpfc_free_sysfs_attr (vport);lpfc_debugfs_terminate (vport); -/* Remove FC host to break driver binding. */ -fc_remove_host (shost); -scsi_remove_host (shost); -/* Send the DA_ID and Fabric LOGO to cleanup Nameserver entries. */ ndlp =lpfc_findnode_did (vport, Fabric_DID);if (!ndlp)
@@ -740,6 +736,10 @@ lpfc_vport_delete(struct fc_vport *fc_vport) skip_logo: +/* Remove FC host to break driver binding. */ +fc_remove_host (shost); +scsi_remove_host (shost); +lpfc_cleanup (vport);/* Remove scsi host now. The nodes are cleaned up. */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 94/236 scsi: lpfc: Update lpfc_ramp_down_queue_handler() logic
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit bb011631435c705cdeddca68d5c85fd40a4320f9 ]
Typically when an out of resource CQE status is detected, the lpfc_ramp_down_queue_handler() logic is called to help reduce I/O load by reducing an sdev's queue_depth.
However, the current lpfc_rampdown_queue_depth() logic does not help reduce queue_depth. num_cmd_success is never updated and is always zero, which means new_queue_depth will always be set to sdev->queue_depth. So, new_queue_depth = sdev->queue_depth - new_queue_depth always sets new_queue_depth to zero. And, scsi_change_queue_depth(sdev, 0) is essentially a no-op.
Change the lpfc_ramp_down_queue_handler() logic to set new_queue_depth equal to sdev->queue_depth subtracted from number of times num_rsrc_err was incremented. If num_rsrc_err is >= sdev->queue_depth, then set new_queue_depth equal to 1. Eventually, the frequency of Good_Status frames will signal SCSI upper layer to auto increase the queue_depth back to the driver default of 64 via scsi_handle_queue_ramp_up().
--- drivers/scsi/lpfc/lpfc.h | 1 - drivers/scsi/lpfc/lpfc_scsi.c | 13 ++++--------- 2 files changed, 4 insertions(+), 10 deletions(-)
drivers/scsi/lpfc/lpfc.h +0 -1
@@ -1355,7 +1355,6 @@ struct lpfc_hba {struct timer_list fabric_block_timer;unsigned long bit_flags;atomic_t num_rsrc_err; -atomic_t num_cmd_success;unsigned long last_rsrc_error_time;unsigned long last_ramp_down_time;#ifdef CONFIG_SCSI_LPFC_DEBUG_FS
drivers/scsi/lpfc/lpfc_scsi.c +4 -9
@@ -167,11 +167,10 @@ lpfc_ramp_down_queue_handler(struct lpfc_hba *phba)struct Scsi_Host *shost;struct scsi_device *sdev;unsigned long new_queue_depth; -unsigned long num_rsrc_err, num_cmd_success; +unsigned long num_rsrc_err;int i; num_rsrc_err =atomic_read (&phba->num_rsrc_err); - num_cmd_success =atomic_read (&phba->num_cmd_success);/* * The error and success command counters are global per
@@ -186,20 +185,16 @@ lpfc_ramp_down_queue_handler(struct lpfc_hba *phba)for (i =0 ; i <= phba->max_vports && vports[i] !=NULL ; i++) { shost =lpfc_shost_from_vport (vports[i]);shost_for_each_device (sdev, shost) { - new_queue_depth = - sdev->queue_depth * num_rsrc_err / - (num_rsrc_err + num_cmd_success); -if (!new_queue_depth) - new_queue_depth = sdev->queue_depth -1 ; +if (num_rsrc_err >= sdev->queue_depth) + new_queue_depth =1 ;else new_queue_depth = sdev->queue_depth - - new_queue_depth; + num_rsrc_err;scsi_change_queue_depth (sdev, new_queue_depth); } }lpfc_destroy_vport_work_array (phba, vports);atomic_set (&phba->num_rsrc_err,0 ); -atomic_set (&phba->num_cmd_success,0 ); }/**
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 95/236 scsi: lpfc: Replace hbalock with ndlp lock in lpfc_nvme_unregister_port()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit d11272be497e48a8e8f980470eb6b70e92eed0ce ]
The ndlp object update in lpfc_nvme_unregister_port() should be protected by the ndlp lock rather than hbalock.
--- drivers/scsi/lpfc/lpfc_nvme.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/scsi/lpfc/lpfc_nvme.c +2 -2
@@ -2621,9 +2621,9 @@ lpfc_nvme_unregister_port(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp)/* No concern about the role change on the nvme remoteport. * The transport will update it. */ -spin_lock_irq (&vport->phba->hbalock); +spin_lock_irq (&ndlp->lock); ndlp->fc4_xpt_flags |=NVME_XPT_UNREG_WAIT ; -spin_unlock_irq (&vport->phba->hbalock); +spin_unlock_irq (&ndlp->lock);/* Don't let the host nvme transport keep sending keep-alives * on this remoteport. Vport is unloading, no recovery. The
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 96/236 scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit ded20192dff31c91cef2a04f7e20e60e9bb887d3 ]
lpfc_worker_wake_up() calls the lpfc_work_done() routine, which takes the hbalock. Thus, lpfc_worker_wake_up() should not be called while holding the hbalock to avoid potential deadlock.
--- drivers/scsi/lpfc/lpfc_els.c | 20 ++++++++++---------- drivers/scsi/lpfc/lpfc_hbadisc.c | 5 ++--- drivers/scsi/lpfc/lpfc_sli.c | 14 +++++++------- 3 files changed, 19 insertions(+), 20 deletions(-)
drivers/scsi/lpfc/lpfc_els.c +10 -10
@@ -4384,23 +4384,23 @@ lpfc_els_retry_delay(struct timer_list *t)unsigned long flags;struct lpfc_work_evt *evtp = &ndlp->els_retry_evt; +/* Hold a node reference for outstanding queued work */ +if (!lpfc_nlp_get (ndlp)) +return ; +spin_lock_irqsave (&phba->hbalock, flags);if (!list_empty (&evtp->evt_listp)) {spin_unlock_irqrestore (&phba->hbalock, flags); +lpfc_nlp_put (ndlp);return ; } -/* We need to hold the node by incrementing the reference -* count until the queued work is done -*/ - evtp->evt_arg1 =lpfc_nlp_get (ndlp); -if (evtp->evt_arg1) { - evtp->evt =LPFC_EVT_ELS_RETRY ; -list_add_tail (&evtp->evt_listp, &phba->work_list); -lpfc_worker_wake_up (phba); - } + evtp->evt_arg1 = ndlp; + evtp->evt =LPFC_EVT_ELS_RETRY ; +list_add_tail (&evtp->evt_listp, &phba->work_list);spin_unlock_irqrestore (&phba->hbalock, flags); -return ; + +lpfc_worker_wake_up (phba); }/**
drivers/scsi/lpfc/lpfc_hbadisc.c +2 -3
@@ -241,7 +241,9 @@ lpfc_dev_loss_tmo_callbk(struct fc_rport *rport)if (evtp->evt_arg1) { evtp->evt =LPFC_EVT_DEV_LOSS ;list_add_tail (&evtp->evt_listp, &phba->work_list); +spin_unlock_irqrestore (&phba->hbalock, iflags);lpfc_worker_wake_up (phba); +return ; }spin_unlock_irqrestore (&phba->hbalock, iflags); }else {
@@ -259,10 +261,7 @@ lpfc_dev_loss_tmo_callbk(struct fc_rport *rport)lpfc_disc_state_machine (vport, ndlp,NULL ,NLP_EVT_DEVICE_RM ); } - } - -return ; }/**
drivers/scsi/lpfc/lpfc_sli.c +7 -7
@@ -1217,9 +1217,9 @@ lpfc_set_rrq_active(struct lpfc_hba *phba, struct lpfc_nodelist *ndlp, empty =list_empty (&phba->active_rrq_list);list_add_tail (&rrq->list, &phba->active_rrq_list); phba->hba_flag |=HBA_RRQ_ACTIVE ; +spin_unlock_irqrestore (&phba->hbalock, iflags);if (empty)lpfc_worker_wake_up (phba); -spin_unlock_irqrestore (&phba->hbalock, iflags);return 0 ; out:spin_unlock_irqrestore (&phba->hbalock, iflags);
@@ -11361,18 +11361,18 @@ lpfc_sli_post_recovery_event(struct lpfc_hba *phba,unsigned long iflags;struct lpfc_work_evt *evtp = &ndlp->recovery_evt; +/* Hold a node reference for outstanding queued work */ +if (!lpfc_nlp_get (ndlp)) +return ; +spin_lock_irqsave (&phba->hbalock, iflags);if (!list_empty (&evtp->evt_listp)) {spin_unlock_irqrestore (&phba->hbalock, iflags); +lpfc_nlp_put (ndlp);return ; } -/* Incrementing the reference count until the queued work is done. */ - evtp->evt_arg1 =lpfc_nlp_get (ndlp); -if (!evtp->evt_arg1) { -spin_unlock_irqrestore (&phba->hbalock, iflags); -return ; - } + evtp->evt_arg1 = ndlp; evtp->evt =LPFC_EVT_RECOVER_PORT ;list_add_tail (&evtp->evt_listp, &phba->work_list);spin_unlock_irqrestore (&phba->hbalock, iflags);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 97/236 gfs2: Fix invalid metadata access in punch_hole
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Price <[email protected]>
[ Upstream commit c95346ac918c5badf51b9a7ac58a26d3bd5bb224 ]
In punch_hole(), when the offset lies in the final block for a given height, there is no hole to punch, but the maximum size check fails to detect that. Consequently, punch_hole() will try to punch a hole beyond the end of the metadata and fail. Fix the maximum size check.
--- fs/gfs2/bmap.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
fs/gfs2/bmap.c +3 -2
@@ -1702,7 +1702,8 @@ static int punch_hole(struct gfs2_inode *ip, u64 offset, u64 length)struct buffer_head *dibh, *bh;struct gfs2_holder rd_gh;unsigned int bsize_shift = sdp->sd_sb.sb_bsize_shift; -u64 lblock = (offset + (1 << bsize_shift) -1 ) >> bsize_shift; +unsigned int bsize =1 << bsize_shift; +u64 lblock = (offset + bsize -1 ) >> bsize_shift;__u16 start_list[GFS2_MAX_META_HEIGHT ];__u16 __end_list[GFS2_MAX_META_HEIGHT ], *end_list =NULL ;unsigned int start_aligned, end_aligned;
@@ -1713,7 +1714,7 @@ static int punch_hole(struct gfs2_inode *ip, u64 offset, u64 length)u64 prev_bnr =0 ;__be64 *start, *end; -if (offset >= maxsize) { +if (offset + bsize -1 >= maxsize) {/* * The starting point lies beyond the allocated meta-data; * there are no blocks do deallocate.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 98/236 wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Johnson <[email protected]>
[ Upstream commit 774f8841f55d7ac4044c79812691649da203584a ]
Running kernel-doc on ieee80211_i.h flagged the following:net/mac80211/ieee80211_i.h:145: warning: expecting prototype for enum ieee80211_corrupt_data_flags. Prototype was for enum ieee80211_bss_corrupt_data_flags instead net/mac80211/ieee80211_i.h:162: warning: expecting prototype for enum ieee80211_valid_data_flags. Prototype was for enum ieee80211_bss_valid_data_flags instead
Fix these warnings.
--- net/mac80211/ieee80211_i.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/mac80211/ieee80211_i.h +2 -2
@@ -120,7 +120,7 @@ struct ieee80211_bss { };/** -* enum ieee80211_corrupt_data_flags - BSS data corruption flags +* enum ieee80211_bss_corrupt_data_flags - BSS data corruption flags * @IEEE80211_BSS_CORRUPT_BEACON: last beacon frame received was corrupted * @IEEE80211_BSS_CORRUPT_PROBE_RESP: last probe response received was corrupted *
@@ -133,7 +133,7 @@ enum ieee80211_bss_corrupt_data_flags { };/** -* enum ieee80211_valid_data_flags - BSS valid data flags +* enum ieee80211_bss_valid_data_flags - BSS valid data flags * @IEEE80211_BSS_VALID_WMM: WMM/UAPSD data was gathered from non-corrupt IE * @IEEE80211_BSS_VALID_RATES: Supported rates were gathered from non-corrupt IE * @IEEE80211_BSS_VALID_ERP: ERP flag was gathered from non-corrupt IE
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 99/236 wifi: cfg80211: fix rdev_dump_mpp() arguments order
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Igor Artemiev <[email protected]>
[ Upstream commit ec50f3114e55406a1aad24b7dfaa1c3f4336d8eb ]
Fix the order of arguments in the TP_ARGS macro
for the rdev_dump_mpp tracepoint event.
Found by Linux Verification Center (linuxtesting.org).
--- net/wireless/trace.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/wireless/trace.h +1 -1
@@ -1018,7 +1018,7 @@ TRACE_EVENT(rdev_get_mpp, TRACE_EVENT(rdev_dump_mpp, TP_PROTO(struct wiphy *wiphy, struct net_device *netdev, int _idx, u8 *dst, u8 *mpp), - TP_ARGS(wiphy, netdev, _idx, mpp, dst), + TP_ARGS(wiphy, netdev, _idx, dst, mpp), TP_STRUCT__entry( WIPHY_ENTRY NETDEV_ENTRY
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 100/236 net: mark racy access on sk->sk_rcvbuf
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: linke li <[email protected]>
[ Upstream commit c2deb2e971f5d9aca941ef13ee05566979e337a4 ]
sk->sk_rcvbuf in __sock_queue_rcv_skb() and __sk_receive_skb() can be changed by other threads. Mark this as benign using READ_ONCE().
This patch is aimed at reducing the number of benign races reported by KCSAN in order to focus future debugging effort on harmful races.
--- net/core/sock.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/core/sock.c +2 -2
@@ -482,7 +482,7 @@ int __sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)unsigned long flags;struct sk_buff_head *list = &sk->sk_receive_queue; -if (atomic_read (&sk->sk_rmem_alloc) >= sk->sk_rcvbuf) { +if (atomic_read (&sk->sk_rmem_alloc) >=READ_ONCE (sk->sk_rcvbuf)) {atomic_inc (&sk->sk_drops);trace_sock_rcvqueue_full (sk, skb);return -ENOMEM ;
@@ -552,7 +552,7 @@ int __sk_receive_skb(struct sock *sk, struct sk_buff *skb, skb->dev =NULL ; -if (sk_rcvqueues_full (sk, sk->sk_rcvbuf)) { +if (sk_rcvqueues_full (sk,READ_ONCE (sk->sk_rcvbuf))) {atomic_inc (&sk->sk_drops); goto discard_and_relse; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 101/236 scsi: mpi3mr: Avoid memcpy field-spanning write WARNING
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shin'ichiro Kawasaki <[email protected]>
[ Upstream commit 429846b4b6ce9853e0d803a2357bb2e55083adf0 ]
When the "storcli2 show" command is executed for eHBA-9600, mpi3mr driver prints this WARNING message:
memcpy: detected field-spanning write (size 128) of single field "bsg_reply_buf->reply_buf" at drivers/scsi/mpi3mr/mpi3mr_app.c:1658 (size 1)
WARNING: CPU: 0 PID: 12760 at drivers/scsi/mpi3mr/mpi3mr_app.c:1658 mpi3mr_bsg_request+0x6b12/0x7f10 [mpi3mr]
The cause of the WARN is 128 bytes memcpy to the 1 byte size array "__u8 replay_buf[1]" in the struct mpi3mr_bsg_in_reply_buf. The array is intended to be a flexible length array, so the WARN is a false positive.
To suppress the WARN, remove the constant number '1' from the array declaration and clarify that it has flexible length. Also, adjust the memory allocation size to match the change.
--- drivers/scsi/mpi3mr/mpi3mr_app.c | 2 +- include/uapi/scsi/scsi_bsg_mpi3mr.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/scsi/mpi3mr/mpi3mr_app.c +1 -1
@@ -1344,7 +1344,7 @@ static long mpi3mr_bsg_process_mpt_cmds(struct bsg_job *job, unsigned int *replyif ((mpirep_offset !=0xFF ) && drv_bufs[mpirep_offset].bsg_buf_len) { drv_buf_iter = &drv_bufs[mpirep_offset]; - drv_buf_iter->kern_buf_len = (sizeof (*bsg_reply_buf) -1 + + drv_buf_iter->kern_buf_len = (sizeof (*bsg_reply_buf) + mrioc->reply_sz); bsg_reply_buf =kzalloc (drv_buf_iter->kern_buf_len,GFP_KERNEL );
include/uapi/scsi/scsi_bsg_mpi3mr.h +1 -1
@@ -382,7 +382,7 @@ struct mpi3mr_bsg_in_reply_buf {__u8 mpi_reply_type;__u8 rsvd1;__u16 rsvd2; -__u8 reply_buf[1 ]; +__u8 reply_buf[]; };/**
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 102/236 scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saurav Kashyap <[email protected]>
[ Upstream commit c214ed2a4dda35b308b0b28eed804d7ae66401f9 ]
The session resources are used by FW and driver when session is offloaded, once session is uploaded these resources are not used. The lock is not required as these fields won't be used any longer. The offload and upload calls are sequential, hence lock is not required.
This will suppress following BUG_ON():
[ 449.843143] ------------[ cut here ]------------ [ 449.848302] kernel BUG at mm/vmalloc.c:2727! [ 449.853072] invalid opcode: 0000 [#1] PREEMPT SMP PTI [ 449.858712] CPU: 5 PID: 1996 Comm: kworker/u24:2 Not tainted 5.14.0-118.el9.x86_64 #1 Rebooting. [ 449.867454] Hardware name: Dell Inc. PowerEdge R730/0WCJNT, BIOS 2.3.4 11/08/2016 [ 449.876966] Workqueue: fc_rport_eq fc_rport_work [libfc] [ 449.882910] RIP: 0010:vunmap+0x2e/0x30 [ 449.887098] Code: 00 65 8b 05 14 a2 f0 4a a9 00 ff ff 00 75 1b 55 48 89 fd e8 34 36 79 00 48 85 ed 74 0b 48 89 ef 31 f6 5d e9 14 fc ff ff 5d c3 <0f> 0b 0f 1f 44 00 00 41 57 41 56 49 89 ce 41 55 49 89 fd 41 54 41 [ 449.908054] RSP: 0018:ffffb83d878b3d68 EFLAGS: 00010206 [ 449.913887] RAX: 0000000080000201 RBX: ffff8f4355133550 RCX: 000000000d400005 [ 449.921843] RDX: 0000000000000001 RSI: 0000000000001000 RDI: ffffb83da53f5000 [ 449.929808] RBP: ffff8f4ac6675800 R08: ffffb83d878b3d30 R09: 00000000000efbdf [ 449.937774] R10: 0000000000000003 R11: ffff8f434573e000 R12: 0000000000001000 [ 449.945736] R13: 0000000000001000 R14: ffffb83da53f5000 R15: ffff8f43d4ea3ae0 [ 449.953701] FS: 0000000000000000(0000) GS:ffff8f529fc80000(0000) knlGS:0000000000000000 [ 449.962732] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 449.969138] CR2: 00007f8cf993e150 CR3: 0000000efbe10003 CR4: 00000000003706e0 [ 449.977102] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 449.985065] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 449.993028] Call Trace: [ 449.995756] __iommu_dma_free+0x96/0x100 [ 450.000139] bnx2fc_free_session_resc+0x67/0x240 [bnx2fc] [ 450.006171] bnx2fc_upload_session+0xce/0x100 [bnx2fc] [ 450.011910] bnx2fc_rport_event_handler+0x9f/0x240 [bnx2fc] [ 450.018136] fc_rport_work+0x103/0x5b0 [libfc] [ 450.023103] process_one_work+0x1e8/0x3c0 [ 450.027581] worker_thread+0x50/0x3b0 [ 450.031669] ? rescuer_thread+0x370/0x370 [ 450.036143] kthread+0x149/0x170 [ 450.039744] ? set_kthread_struct+0x40/0x40 [ 450.044411] ret_from_fork+0x22/0x30 [ 450.048404] Modules linked in: vfat msdos fat xfs nfs_layout_nfsv41_files rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver dm_service_time qedf qed crc8 bnx2fc libfcoe libfc scsi_transport_fc intel_rapl_msr intel_rapl_common x86_pkg_temp_thermal intel_powerclamp dcdbas rapl intel_cstate intel_uncore mei_me pcspkr mei ipmi_ssif lpc_ich ipmi_si fuse zram ext4 mbcache jbd2 loop nfsv3 nfs_acl nfs lockd grace fscache netfs irdma ice sd_mod t10_pi sg ib_uverbs ib_core 8021q garp mrp stp llc mgag200 i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt mxm_wmi fb_sys_fops cec crct10dif_pclmul ahci crc32_pclmul bnx2x drm ghash_clmulni_intel libahci rfkill i40e libata megaraid_sas mdio wmi sunrpc lrw dm_crypt dm_round_robin dm_multipath dm_snapshot dm_bufio dm_mirror dm_region_hash dm_log dm_zero dm_mod linear raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx raid6_pq libcrc32c crc32c_intel raid1 raid0 iscsi_ibft squashfs be2iscsi bnx2i cnic uio cxgb4i cxgb4 tls [ 450.048497] libcxgbi libcxgb qla4xxx iscsi_boot_sysfs iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi edd ipmi_devintf ipmi_msghandler [ 450.159753] ---[ end trace 712de2c57c64abc8 ]---
--- drivers/scsi/bnx2fc/bnx2fc_tgt.c | 2 -- 1 file changed, 2 deletions(-)
drivers/scsi/bnx2fc/bnx2fc_tgt.c +0 -2
@@ -833,7 +833,6 @@ static void bnx2fc_free_session_resc(struct bnx2fc_hba *hba,BNX2FC_TGT_DBG (tgt,"Freeing up session resources\n" ); -spin_lock_bh (&tgt->cq_lock); ctx_base_ptr = tgt->ctx_base; tgt->ctx_base =NULL ;
@@ -889,7 +888,6 @@ static void bnx2fc_free_session_resc(struct bnx2fc_hba *hba, tgt->sq, tgt->sq_dma); tgt->sq =NULL ; } -spin_unlock_bh (&tgt->cq_lock);if (ctx_base_ptr)iounmap (ctx_base_ptr);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 103/236 btrfs: return accurate error code on open failure in open_fs_devices()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anand Jain <[email protected]>
[ Upstream commit 2f1aeab9fca1a5f583be1add175d1ee95c213cfa ]
When attempting to exclusive open a device which has no exclusive open permission, such as a physical device associated with the flakey dm device, the open operation will fail, resulting in a mount failure.
In this particular scenario, we erroneously return -EINVAL instead of the correct error code provided by the bdev_open_by_path() function, which is -EBUSY.
Fix this, by returning error code from the bdev_open_by_path() function. With this correction, the mount error message will align with that of ext4 and xfs.
--- fs/btrfs/volumes.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-)
fs/btrfs/volumes.c +12 -5
@@ -1233,25 +1233,32 @@ static int open_fs_devices(struct btrfs_fs_devices *fs_devices,struct btrfs_device *device;struct btrfs_device *latest_dev =NULL ;struct btrfs_device *tmp_device; +int ret =0 ; flags |=FMODE_EXCL ;list_for_each_entry_safe (device, tmp_device, &fs_devices->devices, dev_list) { -int ret; +int ret2; - ret =btrfs_open_one_device (fs_devices, device, flags, holder); -if (ret ==0 && + ret2 =btrfs_open_one_device (fs_devices, device, flags, holder); +if (ret2 ==0 && (!latest_dev || device->generation > latest_dev->generation)) { latest_dev = device; - }else if (ret == -ENODATA ) { + }else if (ret2 == -ENODATA ) { fs_devices->num_devices--;list_del (&device->dev_list);btrfs_free_device (device); } +if (ret ==0 && ret2 !=0 ) + ret = ret2; } -if (fs_devices->open_devices ==0 ) + +if (fs_devices->open_devices ==0 ) { +if (ret) +return ret;return -EINVAL ; + } fs_devices->opened =1 ; fs_devices->latest_dev = latest_dev;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 104/236 bpf: Check bloom filter map value size
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrei Matei <[email protected]>
[ Upstream commit a8d89feba7e54e691ca7c4efc2a6264fa83f3687 ]
This patch adds a missing check to bloom filter creating, rejecting values above KMALLOC_MAX_SIZE. This brings the bloom map in line with many other map types.
The lack of this protection can cause kernel crashes for value sizes that overflow int's. Such a crash was caught by syzkaller. The next patch adds more guard-rails at a lower level.
--- kernel/bpf/bloom_filter.c | 13 +++++++++++++ .../selftests/bpf/prog_tests/bloom_filter_map.c | 6 ++++++ 2 files changed, 19 insertions(+)
kernel/bpf/bloom_filter.c +13 -0
@@ -88,6 +88,18 @@ static int bloom_map_get_next_key(struct bpf_map *map, void *key, void *next_keyreturn -EOPNOTSUPP ; } +/* Called from syscall */ +static int bloom_map_alloc_check (union bpf_attr *attr) +{ +if (attr->value_size >KMALLOC_MAX_SIZE ) +/* if value_size is bigger, the user space won't be able to +* access the elements. +*/ +return -E2BIG ; + +return 0 ; +} +static struct bpf_map *bloom_map_alloc (union bpf_attr *attr) {u32 bitset_bytes, bitset_mask, nr_hash_funcs, nr_bits;
@@ -196,6 +208,7 @@ static int bloom_map_check_btf(const struct bpf_map *map, BTF_ID_LIST_SINGLE(bpf_bloom_map_btf_ids, struct, bpf_bloom_filter)const struct bpf_map_ops bloom_filter_map_ops = { .map_meta_equal = bpf_map_meta_equal, + .map_alloc_check = bloom_map_alloc_check, .map_alloc = bloom_map_alloc, .map_free = bloom_map_free, .map_get_next_key = bloom_map_get_next_key,
tools/testing/selftests/bpf/prog_tests/bloom_filter_map.c +6 -0
@@ -2,6 +2,7 @@/* Copyright (c) 2021 Facebook */ #include <sys/syscall.h> +#include <limits.h> #include <test_progs.h> #include "bloom_filter_map.skel.h"
@@ -21,6 +22,11 @@ static void test_fail_cases(void)if (!ASSERT_LT (fd,0 ,"bpf_map_create bloom filter invalid value size 0" ))close (fd); +/* Invalid value size: too big */ + fd =bpf_map_create (BPF_MAP_TYPE_BLOOM_FILTER ,NULL ,0 ,INT32_MAX ,100 ,NULL ); +if (!ASSERT_LT (fd,0 ,"bpf_map_create bloom filter invalid value too large" )) +close (fd); +/* Invalid max entries size */ fd =bpf_map_create (BPF_MAP_TYPE_BLOOM_FILTER ,NULL ,0 ,sizeof (value),0 ,NULL );if (!ASSERT_LT (fd,0 ,"bpf_map_create bloom filter invalid max entries size" ))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 105/236 kbuild: Disable KCSAN for autogenerated *.mod.c intermediaries
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov (AMD) <[email protected]>
[ Upstream commit 54babdc0343fff2f32dfaafaaa9e42c4db278204 ]
When KCSAN and CONSTRUCTORS are enabled, one can trigger the
"Unpatched return thunk in use. This should not happen!"
catch-all warning.
Usually, when objtool runs on the .o objects, it does generate a section .return_sites which contains all offsets in the objects to the return thunks of the functions present there. Those return thunks then get patched at runtime by the alternatives.
KCSAN and CONSTRUCTORS add this to the object file's .text.startup section:
-------------------
Disassembly of section .text.startup:
...
0000000000000010 <_sub_I_00099_0>:
10: f3 0f 1e fa endbr64
14: e8 00 00 00 00 call 19 <_sub_I_00099_0+0x9>
15: R_X86_64_PLT32 __tsan_init-0x4
19: e9 00 00 00 00 jmp 1e <__UNIQUE_ID___addressable_cryptd_alloc_aead349+0x6>
1a: R_X86_64_PLT32 __x86_return_thunk-0x4-------------------
which, if it is built as a module goes through the intermediary stage of creating a <module>.mod.c file which, when translated, receives a second constructor:
-------------------
Disassembly of section .text.startup:
0000000000000010 <_sub_I_00099_0>:
10: f3 0f 1e fa endbr64
14: e8 00 00 00 00 call 19 <_sub_I_00099_0+0x9>
15: R_X86_64_PLT32 __tsan_init-0x4
19: e9 00 00 00 00 jmp 1e <_sub_I_00099_0+0xe>
1a: R_X86_64_PLT32 __x86_return_thunk-0x4...
0000000000000030 <_sub_I_00099_0>:
30: f3 0f 1e fa endbr64
34: e8 00 00 00 00 call 39 <_sub_I_00099_0+0x9>
35: R_X86_64_PLT32 __tsan_init-0x4
39: e9 00 00 00 00 jmp 3e <__ksymtab_cryptd_alloc_ahash+0x2>
3a: R_X86_64_PLT32 __x86_return_thunk-0x4-------------------
in the .ko file.
Objtool has run already so that second constructor's return thunk cannot be added to the .return_sites section and thus the return thunk remains unpatched and the warning rightfully fires.
Drop KCSAN flags from the mod.c generation stage as those constructors do not contain data races one would be interested about.
Debugged together with David Kaplan <[email protected]> and Nikolay Borisov <[email protected]>.
--- scripts/Makefile.modfinal | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
scripts/Makefile.modfinal +1 -1
@@ -23,7 +23,7 @@ modname = $(notdir $(@:.mod.o=)) part-of-module = y quiet_cmd_cc_o_c = CC [M] $@ - cmd_cc_o_c = $(CC) $(filter-out $(CC_FLAGS_CFI) $(CFLAGS_GCOV), $(c_flags)) -c -o $@ $< + cmd_cc_o_c = $(CC) $(filter-out $(CC_FLAGS_CFI) $(CFLAGS_GCOV) $(CFLAGS_KCSAN), $(c_flags)) -c -o $@ $< %.mod.o: %.mod.c FORCE $(call if_changed_dep,cc_o_c)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 106/236 scsi: ufs: core: WLUN suspend dev/link state error recovery
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Wang <[email protected]>
[ Upstream commit 6bc5e70b1c792b31b497e48b4668a9a2909aca0d ]
When wl suspend error occurs, for example BKOP or SSU timeout, the host triggers an error handler and returns -EBUSY to break the wl suspend process. However, it is possible for the runtime PM to enter wl suspend again before the error handler has finished, and return -EINVAL because the device is in an error state. To address this, ensure that the rumtime PM waits for the error handler to finish, or trigger the error handler in such cases, because returning -EINVAL can cause the I/O to hang.
--- drivers/ufs/core/ufshcd.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/ufs/core/ufshcd.c +4 -1
@@ -9044,7 +9044,10 @@ static int __ufshcd_wl_suspend(struct ufs_hba *hba, enum ufs_pm_op pm_op)/* UFS device & link must be active before we enter in this function */ if (!ufshcd_is_ufs_dev_active (hba) || !ufshcd_is_link_active (hba)) { - ret = -EINVAL ; +/* Wait err handler finish or trigger err recovery */ +if (!ufshcd_eh_in_progress (hba)) +ufshcd_force_error_recovery (hba); + ret = -EBUSY ; goto enable_scaling; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 107/236 ALSA: line6: Zero-initialize message buffers
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit c4e51e424e2c772ce1836912a8b0b87cd61bc9d5 ]
For shutting up spurious KMSAN uninit-value warnings, just replace kmalloc() calls with kzalloc() for the buffers used for communications. There should be no real issue with the original code, but it's still better to cover.
Message-ID: <[email protected]>
--- sound/usb/line6/driver.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
sound/usb/line6/driver.c +3 -3
@@ -202,7 +202,7 @@ int line6_send_raw_message_async(struct usb_line6 *line6, const char *buffer,struct urb *urb;/* create message: */ - msg =kmalloc (sizeof (struct message ),GFP_ATOMIC ); + msg =kzalloc (sizeof (struct message ),GFP_ATOMIC );if (msg ==NULL )return -ENOMEM ;
@@ -688,7 +688,7 @@ static int line6_init_cap_control(struct usb_line6 *line6)int ret;/* initialize USB buffers: */ - line6->buffer_listen =kmalloc (LINE6_BUFSIZE_LISTEN ,GFP_KERNEL ); + line6->buffer_listen =kzalloc (LINE6_BUFSIZE_LISTEN ,GFP_KERNEL );if (!line6->buffer_listen)return -ENOMEM ;
@@ -697,7 +697,7 @@ static int line6_init_cap_control(struct usb_line6 *line6)return -ENOMEM ;if (line6->properties->capabilities &LINE6_CAP_CONTROL_MIDI ) { - line6->buffer_message =kmalloc (LINE6_MIDI_MESSAGE_MAXLEN ,GFP_KERNEL ); + line6->buffer_message =kzalloc (LINE6_MIDI_MESSAGE_MAXLEN ,GFP_KERNEL );if (!line6->buffer_message)return -ENOMEM ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 108/236 block: fix overflow in blk_ioctl_discard()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Nan <[email protected]>
[ Upstream commit 22d24a544b0d49bbcbd61c8c0eaf77d3c9297155 ]
There is no check for overflow of 'start + len' in blk_ioctl_discard(). Hung task occurs if submit an discard ioctl with the following param:
start = 0x80000000000ff000, len = 0x8000000000fff000;
Add the overflow validation now.
--- block/ioctl.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
block/ioctl.c +3 -2
@@ -89,7 +89,7 @@ static int blk_ioctl_discard(struct block_device *bdev, fmode_t mode, unsigned long arg) {uint64_t range[2 ]; -uint64_t start, len; +uint64_t start, len, end;struct inode *inode = bdev->bd_inode;int err;
@@ -110,7 +110,8 @@ static int blk_ioctl_discard(struct block_device *bdev, fmode_t mode,if (len &511 )return -EINVAL ; -if (start + len >bdev_nr_bytes (bdev)) +if (check_add_overflow (start, len, &end) || + end >bdev_nr_bytes (bdev))return -EINVAL ;filemap_invalidate_lock (inode->i_mapping);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 109/236 net: bcmgenet: Reset RBUF on first open
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phil Elwell <[email protected]>
[ Upstream commit 0a6380cb4c6b5c1d6dad226ba3130f9090f0ccea ]
If the RBUF logic is not reset when the kernel starts then there may be some data left over from any network boot loader. If the 64-byte packet headers are enabled then this can be fatal.
Extend bcmgenet_dma_disable to do perform the reset, but not when called from bcmgenet_resume in order to preserve a wake packet.
N.B. This different handling of resume is just based on a hunch - why else wouldn't one reset the RBUF as well as the TBUF? If this isn't the case then it's easy to change the patch to make the RBUF reset unconditional.
See: https://github.com/raspberrypi/linux/issues/3850
See: https://github.com/raspberrypi/firmware/issues/1882
--- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
drivers/net/ethernet/broadcom/genet/bcmgenet.c +12 -4
@@ -3298,7 +3298,7 @@ static void bcmgenet_get_hw_addr(struct bcmgenet_priv *priv, }/* Returns a reusable dma control register value */ -static u32 bcmgenet_dma_disable (struct bcmgenet_priv *priv) +static u32 bcmgenet_dma_disable (struct bcmgenet_priv *priv,bool flush_rx) {unsigned int i;u32 reg;
@@ -3323,6 +3323,14 @@ static u32 bcmgenet_dma_disable(struct bcmgenet_priv *priv)udelay (10 );bcmgenet_umac_writel (priv,0 ,UMAC_TX_FLUSH ); +if (flush_rx) { + reg =bcmgenet_rbuf_ctrl_get (priv); +bcmgenet_rbuf_ctrl_set (priv, reg |BIT (0 )); +udelay (10 ); +bcmgenet_rbuf_ctrl_set (priv, reg); +udelay (10 ); + } +return dma_ctrl; }
@@ -3386,8 +3394,8 @@ static int bcmgenet_open(struct net_device *dev)bcmgenet_set_hw_addr (priv, dev->dev_addr); -/* Disable RX/TX DMA and flush TX queues */ - dma_ctrl =bcmgenet_dma_disable (priv); +/* Disable RX/TX DMA and flush TX and RX queues */ + dma_ctrl =bcmgenet_dma_disable (priv, true);/* Reinitialize TDMA and RDMA and SW housekeeping */ ret =bcmgenet_init_dma (priv);
@@ -4258,7 +4266,7 @@ static int bcmgenet_resume(struct device *d)bcmgenet_hfb_create_rxnfc_filter (priv, rule);/* Disable RX/TX DMA and flush TX queues */ - dma_ctrl =bcmgenet_dma_disable (priv); + dma_ctrl =bcmgenet_dma_disable (priv, false);/* Reinitialize TDMA and RDMA and SW housekeeping */ ret =bcmgenet_init_dma (priv);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 110/236 ata: sata_gemini: Check clk_enable() result
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ni <[email protected]>
[ Upstream commit e85006ae7430aef780cc4f0849692e266a102ec0 ]
The call to clk_enable() in gemini_sata_start_bridge() can fail. Add a check to detect such failure.
--- drivers/ata/sata_gemini.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/ata/sata_gemini.c +4 -1
@@ -201,7 +201,10 @@ int gemini_sata_start_bridge(struct sata_gemini *sg, unsigned int bridge) pclk = sg->sata0_pclk; else pclk = sg->sata1_pclk; -clk_enable (pclk); + ret =clk_enable (pclk); +if (ret) +return ret; +msleep (10 );/* Do not keep clocking a bridge that is not online */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 111/236 firewire: ohci: mask bus reset interrupts between ISR and bottom half
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adam Goldman <[email protected]>
[ Upstream commit 752e3c53de0fa3b7d817a83050b6699b8e9c6ec9 ]
In the FireWire OHCI interrupt handler, if a bus reset interrupt has occurred, mask bus reset interrupts until bus_reset_work has serviced and cleared the interrupt.
Normally, we always leave bus reset interrupts masked. We infer the bus reset from the self-ID interrupt that happens shortly thereafter. A scenario where we unmask bus reset interrupts was introduced in 2008 in a007bb857e0b26f5d8b73c2ff90782d9c0972620: If OHCI_PARAM_DEBUG_BUSRESETS (8) is set in the debug parameter bitmask, we will unmask bus reset interrupts so we can log them.
irq_handler logs the bus reset interrupt. However, we can't clear the bus reset event flag in irq_handler, because we won't service the event until later. irq_handler exits with the event flag still set. If the corresponding interrupt is still unmasked, the first bus reset will usually freeze the system due to irq_handler being called again each time it exits. This freeze can be reproduced by loading firewire_ohci with "modprobe firewire_ohci debug=-1" (to enable all debugging output). Apparently there are also some cases where bus_reset_work will get called soon enough to clear the event, and operation will continue normally.
This freeze was first reported a few months after a007bb85 was committed, but until now it was never fixed. The debug level could safely be set to -1 through sysfs after the module was loaded, but this would be ineffectual in logging bus reset interrupts since they were only unmasked during initialization.
irq_handler will now leave the event flag set but mask bus reset interrupts, so irq_handler won't be called again and there will be no freeze. If OHCI_PARAM_DEBUG_BUSRESETS is enabled, bus_reset_work will unmask the interrupt after servicing the event, so future interrupts will be caught as desired.
As a side effect to this change, OHCI_PARAM_DEBUG_BUSRESETS can now be enabled through sysfs in addition to during initial module loading. However, when enabled through sysfs, logging of bus reset interrupts will be effective only starting with the second bus reset, after bus_reset_work has executed.
--- drivers/firewire/ohci.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/firewire/ohci.c +5 -1
@@ -2049,6 +2049,8 @@ static void bus_reset_work(struct work_struct *work) ohci->generation = generation;reg_write (ohci, OHCI1394_IntEventClear, OHCI1394_busReset); +if (param_debug &OHCI_PARAM_DEBUG_BUSRESETS ) +reg_write (ohci, OHCI1394_IntMaskSet, OHCI1394_busReset);if (ohci->quirks &QUIRK_RESET_PACKET ) ohci->request_generation = generation;
@@ -2115,12 +2117,14 @@ static irqreturn_t irq_handler(int irq, void *data)return IRQ_NONE ;/* -* busReset and postedWriteErr must not be cleared yet +* busReset and postedWriteErr events must not be cleared yet * (OHCI 1.1 clauses 7.2.3.2 and 13.2.8.1) */ reg_write (ohci, OHCI1394_IntEventClear, event & ~(OHCI1394_busReset | OHCI1394_postedWriteErr));log_irqs (ohci, event); +if (event & OHCI1394_busReset) +reg_write (ohci, OHCI1394_IntMaskClear, OHCI1394_busReset);if (event & OHCI1394_selfIDComplete)queue_work (selfid_workqueue, &ohci->bus_reset_work);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 112/236 tools/power turbostat: Fix added raw MSR output
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Doug Smythies <[email protected]>
[ Upstream commit e5f4e68eed85fa8495d78cd966eecc2b27bb9e53 ]
When using --Summary mode, added MSRs in raw mode always print zeros. Print the actual register contents.
Example, with patch:
note the added column:
--add msr0x64f,u32,package,raw,REASON
Where:
0x64F is MSR_CORE_PERF_LIMIT_REASONS
Busy% Bzy_MHz PkgTmp PkgWatt CorWatt REASON 0.00 4800 35 1.42 0.76 0x00000000 0.00 4801 34 1.42 0.76 0x00000000 80.08 4531 66 108.17 107.52 0x08000000 98.69 4530 66 133.21 132.54 0x08000000 99.28 4505 66 128.26 127.60 0x0c000400 99.65 4486 68 124.91 124.25 0x0c000400 99.63 4483 68 124.90 124.25 0x0c000400 79.34 4481 41 99.80 99.13 0x0c000000 0.00 4801 41 1.40 0.73 0x0c000000
Where, for the test processor (i5-10600K):
PKG Limit #1: 125.000 Watts, 8.000000 sec
MSR bit 26 = log; bit 10 = status
PKG Limit #2: 136.000 Watts, 0.002441 sec
MSR bit 27 = log; bit 11 = status
Example, without patch:
Busy% Bzy_MHz PkgTmp PkgWatt CorWatt REASON 0.01 4800 35 1.43 0.77 0x00000000 0.00 4801 35 1.39 0.73 0x00000000 83.49 4531 66 112.71 112.06 0x00000000 98.69 4530 68 133.35 132.69 0x00000000 99.31 4500 67 127.96 127.30 0x00000000 99.63 4483 69 124.91 124.25 0x00000000 99.61 4481 69 124.90 124.25 0x00000000 99.61 4481 71 124.92 124.25 0x00000000 59.35 4479 42 75.03 74.37 0x00000000 0.00 4800 42 1.39 0.73 0x00000000 0.00 4801 42 1.42 0.76 0x00000000
c000000
[lenb: simplified patch to apply only to package scope]
--- tools/power/x86/turbostat/turbostat.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
tools/power/x86/turbostat/turbostat.c +4 -3
@@ -1811,9 +1811,10 @@ int sum_counters(struct thread_data *t, struct core_data *c, struct pkg_data *p) average.packages.rapl_dram_perf_status += p->rapl_dram_perf_status;for (i =0 , mp = sys.pp; mp; i++, mp = mp->next) { -if (mp->format ==FORMAT_RAW ) -continue ; - average.packages.counter[i] += p->counter[i]; +if ((mp->format ==FORMAT_RAW ) && (topo.num_packages ==0 )) + average.packages.counter[i] = p->counter[i]; +else + average.packages.counter[i] += p->counter[i]; }return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 113/236 tools/power turbostat: Increase the limit for fd opened
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wyes Karny <[email protected]>
[ Upstream commit 3ac1d14d0583a2de75d49a5234d767e2590384dd ]
When running turbostat, a system with 512 cpus reaches the limit for maximum number of file descriptors that can be opened. To solve this problem, the limit is raised to 2^15, which is a large enough number.
Below data is collected from AMD server systems while running turbostat:
|-----------+-------------------------------| | # of cpus | # of opened fds for turbostat | |-----------+-------------------------------| | 128 | 260 | |-----------+-------------------------------| | 192 | 388 | |-----------+-------------------------------| | 512 | 1028 | |-----------+-------------------------------|
So, the new max limit would be sufficient up to 2^14 cpus (but this also depends on how many counters are enabled).
--- tools/power/x86/turbostat/turbostat.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+)
tools/power/x86/turbostat/turbostat.c +21 -0
@@ -53,6 +53,8 @@#define NAME_BYTES 20#define PATH_BYTES 128 +#define MAX_NOFILE 0x8000 +enum counter_scope {SCOPE_CPU ,SCOPE_CORE ,SCOPE_PACKAGE };enum counter_type {COUNTER_ITEMS ,COUNTER_CYCLES ,COUNTER_SECONDS ,COUNTER_USEC };enum counter_format {FORMAT_RAW ,FORMAT_DELTA ,FORMAT_PERCENT };
@@ -6719,6 +6721,22 @@ void cmdline(int argc, char **argv) } } +void set_rlimit (void ) +{ +struct rlimit limit; + +if (getrlimit (RLIMIT_NOFILE , &limit) <0 ) +err (1 ,"Failed to get rlimit" ); + +if (limit.rlim_max <MAX_NOFILE ) + limit.rlim_max =MAX_NOFILE ; +if (limit.rlim_cur <MAX_NOFILE ) + limit.rlim_cur =MAX_NOFILE ; + +if (setrlimit (RLIMIT_NOFILE , &limit) <0 ) +err (1 ,"Failed to set rlimit" ); +} +int main (int argc,char **argv) { outf = stderr;
@@ -6731,6 +6749,9 @@ int main(int argc, char **argv)probe_sysfs (); +if (!getuid ()) +set_rlimit (); +turbostat_init ();msr_sum_record ();
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 114/236 tools/power turbostat: Fix Bzy_MHz documentation typo
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Liu <[email protected]>
[ Upstream commit 0b13410b52c4636aacb6964a4253a797c0fa0d16 ]
The code calculates Bzy_MHz by multiplying TSC_delta * APERF_delta/MPERF_delta The man page erroneously showed that TSC_delta was divided.
--- tools/power/x86/turbostat/turbostat.8 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/power/x86/turbostat/turbostat.8 +1 -1
@@ -370,7 +370,7 @@ below the processor's base frequency. Busy% = MPERF_delta/TSC_delta -Bzy_MHz = TSC_delta/APERF_delta/MPERF_delta/measurement_interval +Bzy_MHz = TSC_delta*APERF_delta/MPERF_delta/measurement_interval Note that these calculations depend on TSC_delta, so they are not reliable during intervals when TSC_MHz is not running at the base frequency.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 115/236 btrfs: make btrfs_clear_delalloc_extent() free delalloc reserve
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Burkov <[email protected]>
[ Upstream commit 3c6f0c5ecc8910d4ffb0dfe85609ebc0c91c8f34 ]
Currently, this call site in btrfs_clear_delalloc_extent() only converts the reservation. We are marking it not delalloc, so I don't think it makes sense to keep the rsv around. This is a path where we are not sure to join a transaction, so it leads to incorrect free-ing during umount.
Helps with the pass rate of generic/269 and generic/475.
--- fs/btrfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/inode.c +1 -1
@@ -2472,7 +2472,7 @@ void btrfs_clear_delalloc_extent(struct inode *vfs_inode,*/ if (bits &EXTENT_CLEAR_META_RESV && root != fs_info->tree_root) -btrfs_delalloc_release_metadata (inode, len, false); +btrfs_delalloc_release_metadata (inode, len, true);/* For sanity tests. */ if (btrfs_is_testing (fs_info))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 116/236 btrfs: always clear PERTRANS metadata during commit
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Burkov <[email protected]>
[ Upstream commit 6e68de0bb0ed59e0554a0c15ede7308c47351e2d ]
It is possible to clear a root's IN_TRANS tag from the radix tree, but not clear its PERTRANS, if there is some error in between. Eliminate that possibility by moving the free up to where we clear the tag.
--- fs/btrfs/transaction.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/transaction.c +1 -1
@@ -1440,6 +1440,7 @@ static noinline int commit_fs_roots(struct btrfs_trans_handle *trans)radix_tree_tag_clear (&fs_info->fs_roots_radix, (unsigned long )root->root_key.objectid,BTRFS_ROOT_TRANS_TAG ); +btrfs_qgroup_free_meta_all_pertrans (root);spin_unlock (&fs_info->fs_roots_radix_lock);btrfs_free_log (trans, root);
@@ -1464,7 +1465,6 @@ static noinline int commit_fs_roots(struct btrfs_trans_handle *trans)if (ret2)return ret2;spin_lock (&fs_info->fs_roots_radix_lock); -btrfs_qgroup_free_meta_all_pertrans (root); } }spin_unlock (&fs_info->fs_roots_radix_lock);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 117/236 memblock tests: fix undefined reference to `early_pfn_to_nid
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Yang <[email protected]>
[ Upstream commit 7d8ed162e6a92268d4b2b84d364a931216102c8e ]
commit 6a9531c3a880 ("memblock: fix crash when reserved memory is not added to memory") introduce the usage of early_pfn_to_nid, which is not defined in memblock tests.
The original definition of early_pfn_to_nid is defined in mm.h, so let add this in the corresponding mm.h.
--- tools/include/linux/mm.h | 5 +++++ 1 file changed, 5 insertions(+)
tools/include/linux/mm.h +5 -0
@@ -37,4 +37,9 @@ static inline void totalram_pages_add(long count) { } +static inline int early_pfn_to_nid (unsigned long pfn) +{ +return 0 ; +} +#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 118/236 memblock tests: fix undefined reference to `panic
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Yang <[email protected]>
[ Upstream commit e0f5a8e74be88f2476e58b25d3b49a9521bdc4ec ]
commit e96c6b8f212a ("memblock: report failures when memblock_can_resize is not set") introduced the usage of panic, which is not defined in memblock test.
Let's define it directly in panic.h to fix it.
--- tools/include/linux/kernel.h | 1 + tools/include/linux/panic.h | 19 +++++++++++++++++++ 2 files changed, 20 insertions(+) create mode 100644 tools/include/linux/panic.h
tools/include/linux/kernel.h +1 -0
@@ -8,6 +8,7 @@#include <linux/build_bug.h> #include <linux/compiler.h> #include <linux/math.h> +#include <linux/panic.h> #include <endian.h> #include <byteswap.h>
tools/include/linux/panic.h new file +19 -0
@@ -0,0 +1,19 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef _TOOLS_LINUX_PANIC_H +#define _TOOLS_LINUX_PANIC_H + +#include <stdarg.h> +#include <stdio.h> +#include <stdlib.h> + +static inline void panic (const char *fmt, ...) +{ +va_list argp; + +va_start (argp, fmt); +vfprintf (stderr, fmt, argp); +va_end (argp); +exit (-1 ); +} + +#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 119/236 memblock tests: fix undefined reference to `BIT
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Yang <[email protected]>
[ Upstream commit 592447f6cb3c20d606d6c5d8e6af68e99707b786 ]
commit 772dd0342727 ("mm: enumerate all gfp flags") define gfp flags with the help of BIT, while gfp_types.h doesn't include header file for the definition. This through an error on building memblock tests.
Let's include linux/bits.h to fix it.
--- include/linux/gfp_types.h | 2 ++ 1 file changed, 2 insertions(+)
include/linux/gfp_types.h +2 -0
@@ -2,6 +2,8 @@#ifndef __LINUX_GFP_TYPES_H#define __LINUX_GFP_TYPES_H +#include <linux/bits.h> +/* The typedef is in types.h but we want the documentation here */ #if 0 /**
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 120/236 scsi: target: Fix SELinux error when systemd-modules loads the target module
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maurizio Lombardi <[email protected]>
[ Upstream commit 97a54ef596c3fd24ec2b227ba8aaf2cf5415e779 ]
If the systemd-modules service loads the target module, the credentials of that userspace process will be used to validate the access to the target db directory. SELinux will prevent it, reporting an error like the following:
kernel: audit: type=1400 audit(1676301082.205:4): avc: denied { read } for pid=1020 comm="systemd-modules" name="target" dev="dm-3" ino=4657583 scontext=system_u:system_r:systemd_modules_load_t:s0 tcontext=system_u:object_r:targetd_etc_rw_t:s0 tclass=dir permissive=0
Fix the error by using the kernel credentials to access the db directory
--- drivers/target/target_core_configfs.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/target/target_core_configfs.c +12 -0
@@ -3587,6 +3587,8 @@ static int __init target_core_init_configfs(void) {struct configfs_subsystem *subsys = &target_core_fabrics;struct t10_alua_lu_gp *lu_gp; +struct cred *kern_cred; +const struct cred *old_cred;int ret; pr_debug("TARGET_CORE[0]: Loading Generic Kernel Storage"
@@ -3663,11 +3665,21 @@ static int __init target_core_init_configfs(void)if (ret <0 ) goto out; +/* We use the kernel credentials to access the target directory */ + kern_cred =prepare_kernel_cred (&init_task); +if (!kern_cred) { + ret = -ENOMEM ; + goto out; + } + old_cred =override_creds (kern_cred);target_init_dbroot (); +revert_creds (old_cred); +put_cred (kern_cred);return 0 ; out: +target_xcopy_release_pt ();configfs_unregister_subsystem (subsys);core_dev_release_virtual_lun0 ();rd_module_exit ();
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 121/236 blk-iocost: avoid out of bounds shift
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rik van Riel <[email protected]>
[ Upstream commit beaa51b36012fad5a4d3c18b88a617aea7a9b96d ]
UBSAN catches undefined behavior in blk-iocost, where sometimes iocg->delay is shifted right by a number that is too large, resulting in undefined behavior on some architectures.
[ 186.556576] ------------[ cut here ]------------ UBSAN: shift-out-of-bounds in block/blk-iocost.c:1366:23 shift exponent 64 is too large for 64-bit type 'u64' (aka 'unsigned long long') CPU: 16 PID: 0 Comm: swapper/16 Tainted: G S E N 6.9.0-0_fbk700_debug_rc2_kbuilder_0_gc85af715cac0 #1 Hardware name: Quanta Twin Lakes MP/Twin Lakes Passive MP, BIOS F09_3A23 12/08/2020 Call Trace: <IRQ> dump_stack_lvl+0x8f/0xe0 __ubsan_handle_shift_out_of_bounds+0x22c/0x280 iocg_kick_delay+0x30b/0x310 ioc_timer_fn+0x2fb/0x1f80 __run_timer_base+0x1b6/0x250
...
Avoid that undefined behavior by simply taking the "delay = 0" branch if the shift is too large.
I am not sure what the symptoms of an undefined value delay will be, but I suspect it could be more than a little annoying to debug.
--- block/blk-iocost.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
block/blk-iocost.c +4 -3
@@ -1331,7 +1331,7 @@ static bool iocg_kick_delay(struct ioc_gq *iocg, struct ioc_now *now) {struct ioc *ioc = iocg->ioc;struct blkcg_gq *blkg =iocg_to_blkg (iocg); -u64 tdelta, delay, new_delay; +u64 tdelta, delay, new_delay, shift;s64 vover, vover_pct;u32 hwa;
@@ -1346,8 +1346,9 @@ static bool iocg_kick_delay(struct ioc_gq *iocg, struct ioc_now *now)/* calculate the current delay in effect - 1/2 every second */ tdelta = now->now - iocg->delay_at; -if (iocg->delay) - delay = iocg->delay >>div64_u64 (tdelta,USEC_PER_SEC ); + shift =div64_u64 (tdelta,USEC_PER_SEC ); +if (iocg->delay && shift <BITS_PER_LONG ) + delay = iocg->delay >> shift;else delay =0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 122/236 gpu: host1x: Do not setup DMA for virtual devices
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thierry Reding <[email protected]>
[ Upstream commit 8ab58f6841b19423231c5db3378691ec80c778f8 ]
The host1x devices are virtual compound devices and do not perform DMA accesses themselves, so they do not need to be set up for DMA.
Ideally we would also not need to set up DMA masks for the virtual devices, but we currently still need those for legacy support on old hardware.
--- drivers/gpu/host1x/bus.c | 8 -------- 1 file changed, 8 deletions(-)
drivers/gpu/host1x/bus.c +0 -8
@@ -368,11 +368,6 @@ static int host1x_device_uevent(struct device *dev,return 0 ; } -static int host1x_dma_configure (struct device *dev) -{ -return of_dma_configure (dev, dev->of_node, true); -} -static const struct dev_pm_ops host1x_device_pm_ops = { .suspend = pm_generic_suspend, .resume = pm_generic_resume,
@@ -386,7 +381,6 @@ struct bus_type host1x_bus_type = { .name = "host1x", .match = host1x_device_match, .uevent = host1x_device_uevent, - .dma_configure = host1x_dma_configure, .pm = &host1x_device_pm_ops, };
@@ -475,8 +469,6 @@ static int host1x_device_add(struct host1x *host1x, device->dev.bus = &host1x_bus_type; device->dev.parent = host1x->dev; -of_dma_configure (&device->dev, host1x->dev->of_node, true); - device->dev.dma_parms = &device->dma_parms;dma_set_max_seg_size (&device->dev,UINT_MAX );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 123/236 MIPS: scall: Save thread_info.syscall unconditionally on entry
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiaxun Yang <[email protected]>
[ Upstream commit 4370b673ccf240bf7587b0cb8e6726a5ccaf1f17 ]
thread_info.syscall is used by syscall_get_nr to supply syscall nr over a thread stack frame.
Previously, thread_info.syscall is only saved at syscall_trace_enter when syscall tracing is enabled. However rest of the kernel code do expect syscall_get_nr to be available without syscall tracing. The previous design breaks collect_syscall.
Move saving process to syscall entry to fix it.
--- arch/mips/include/asm/ptrace.h | 2 +- arch/mips/kernel/asm-offsets.c | 1 + arch/mips/kernel/ptrace.c | 15 ++++++--------- arch/mips/kernel/scall32-o32.S | 23 +++++++++++++---------- arch/mips/kernel/scall64-n32.S | 3 ++- arch/mips/kernel/scall64-n64.S | 3 ++- arch/mips/kernel/scall64-o32.S | 33 +++++++++++++++++---------------- 7 files changed, 42 insertions(+), 38 deletions(-)
arch/mips/include/asm/ptrace.h +1 -1
@@ -157,7 +157,7 @@ static inline long regs_return_value(struct pt_regs *regs)#define instruction_pointer (regs) ((regs)->cp0_epc)#define profile_pc (regs) instruction_pointer(regs) -extern asmlinkage long syscall_trace_enter (struct pt_regs *regs,long syscall); +extern asmlinkage long syscall_trace_enter (struct pt_regs *regs); extern asmlinkage void syscall_trace_leave(struct pt_regs *regs);extern void die (const char *,struct pt_regs *)__noreturn ;
arch/mips/kernel/asm-offsets.c +1 -0
@@ -98,6 +98,7 @@ void output_thread_info_defines(void)OFFSET (TI_CPU , thread_info, cpu);OFFSET (TI_PRE_COUNT , thread_info, preempt_count);OFFSET (TI_REGS , thread_info, regs); +OFFSET (TI_SYSCALL , thread_info, syscall);DEFINE (_THREAD_SIZE,THREAD_SIZE );DEFINE (_THREAD_MASK,THREAD_MASK );DEFINE (_IRQ_STACK_SIZE,IRQ_STACK_SIZE );
arch/mips/kernel/ptrace.c +6 -9
@@ -1309,16 +1309,13 @@ long arch_ptrace(struct task_struct *child, long request,* Notification of system call entry/exit * - triggered by current->work.syscall_trace */ -asmlinkage long syscall_trace_enter (struct pt_regs *regs,long syscall) +asmlinkage long syscall_trace_enter (struct pt_regs *regs) {user_exit (); -current_thread_info ()->syscall = syscall; -if (test_thread_flag (TIF_SYSCALL_TRACE )) {if (ptrace_report_syscall_entry (regs))return -1 ; - syscall =current_thread_info ()->syscall; }#ifdef CONFIG_SECCOMP
@@ -1327,7 +1324,7 @@ asmlinkage long syscall_trace_enter(struct pt_regs *regs, long syscall)struct seccomp_data sd;unsigned long args[6 ]; - sd.nr = syscall; + sd.nr =current_thread_info ()->syscall; sd.arch =syscall_get_arch (current);syscall_get_arguments (current, regs, args);for (i =0 ; i <6 ; i++)
@@ -1337,23 +1334,23 @@ asmlinkage long syscall_trace_enter(struct pt_regs *regs, long syscall) ret =__secure_computing (&sd);if (ret ==-1 )return ret; - syscall = current_thread_info()->syscall; }#endif if (unlikely (test_thread_flag (TIF_SYSCALL_TRACEPOINT )))trace_sys_enter (regs, regs->regs[2 ]); -audit_syscall_entry (syscall, regs->regs[4 ], regs->regs[5 ], +audit_syscall_entry (current_thread_info ()->syscall, + regs->regs[4 ], regs->regs[5 ], regs->regs[6 ], regs->regs[7 ]);/* * Negative syscall numbers are mistaken for rejected syscalls, but * won't have had the return value set appropriately, so we do so now. */ -if (syscall <0 ) +if (current_thread_info ()->syscall <0 )syscall_set_return_value (current, regs, -ENOSYS ,0 ); -return syscall; +return current_thread_info ()->syscall; }/*
arch/mips/kernel/scall32-o32.S +13 -10
@@ -77,6 +77,18 @@ loads_done: PTR_WD load_a7, bad_stack_a7 .previous + /* + * syscall number is in v0 unless we called syscall(__NR_###) + * where the real syscall number is in a0 + */ + subu t2, v0, __NR_O32_Linux + bnez t2, 1f /* __NR_syscall at offset 0 */ + LONG_S a0, TI_SYSCALL($28) # Save a0 as syscall number + b 2f +1: + LONG_S v0, TI_SYSCALL($28) # Save v0 as syscall number +2: + lw t0, TI_FLAGS($28) # syscall tracing enabled? li t1, _TIF_WORK_SYSCALL_ENTRY and t0, t1
@@ -114,16 +126,7 @@ syscall_trace_entry: SAVE_STATIC move a0, sp - /* - * syscall number is in v0 unless we called syscall(__NR_###) - * where the real syscall number is in a0 - */ - move a1, v0 - subu t2, v0, __NR_O32_Linux - bnez t2, 1f /* __NR_syscall at offset 0 */ - lw a1, PT_R4(sp) - -1: jal syscall_trace_enter + jal syscall_trace_enter bltz v0, 1f # seccomp failed? Skip syscall
arch/mips/kernel/scall64-n32.S +2 -1
@@ -44,6 +44,8 @@ NESTED(handle_sysn32, PT_SIZE, sp) sd a3, PT_R26(sp) # save a3 for syscall restarting + LONG_S v0, TI_SYSCALL($28) # Store syscall number + li t1, _TIF_WORK_SYSCALL_ENTRY LONG_L t0, TI_FLAGS($28) # syscall tracing enabled? and t0, t1, t0
@@ -72,7 +74,6 @@ syscall_common: n32_syscall_trace_entry: SAVE_STATIC move a0, sp - move a1, v0 jal syscall_trace_enter bltz v0, 1f # seccomp failed? Skip syscall
arch/mips/kernel/scall64-n64.S +2 -1
@@ -46,6 +46,8 @@ NESTED(handle_sys64, PT_SIZE, sp) sd a3, PT_R26(sp) # save a3 for syscall restarting + LONG_S v0, TI_SYSCALL($28) # Store syscall number + li t1, _TIF_WORK_SYSCALL_ENTRY LONG_L t0, TI_FLAGS($28) # syscall tracing enabled? and t0, t1, t0
@@ -82,7 +84,6 @@ n64_syscall_exit: syscall_trace_entry: SAVE_STATIC move a0, sp - move a1, v0 jal syscall_trace_enter bltz v0, 1f # seccomp failed? Skip syscall
arch/mips/kernel/scall64-o32.S +17 -16
@@ -79,6 +79,22 @@ loads_done: PTR_WD load_a7, bad_stack_a7 .previous + /* + * absolute syscall number is in v0 unless we called syscall(__NR_###) + * where the real syscall number is in a0 + * note: NR_syscall is the first O32 syscall but the macro is + * only defined when compiling with -mabi=32 (CONFIG_32BIT) + * therefore __NR_O32_Linux is used (4000) + */ + + subu t2, v0, __NR_O32_Linux + bnez t2, 1f /* __NR_syscall at offset 0 */ + LONG_S a0, TI_SYSCALL($28) # Save a0 as syscall number + b 2f +1: + LONG_S v0, TI_SYSCALL($28) # Save v0 as syscall number +2: + li t1, _TIF_WORK_SYSCALL_ENTRY LONG_L t0, TI_FLAGS($28) # syscall tracing enabled? and t0, t1, t0
@@ -113,22 +129,7 @@ trace_a_syscall: sd a7, PT_R11(sp) # For indirect syscalls move a0, sp - /* - * absolute syscall number is in v0 unless we called syscall(__NR_###) - * where the real syscall number is in a0 - * note: NR_syscall is the first O32 syscall but the macro is - * only defined when compiling with -mabi=32 (CONFIG_32BIT) - * therefore __NR_O32_Linux is used (4000) - */ - .set push - .set reorder - subu t1, v0, __NR_O32_Linux - move a1, v0 - bnez t1, 1f /* __NR_syscall at offset 0 */ - ld a1, PT_R4(sp) /* Arg1 for __NR_syscall case */ - .set pop - -1: jal syscall_trace_enter + jal syscall_trace_enter bltz v0, 1f # seccomp failed? Skip syscall
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 124/236 tools/power/turbostat: Fix uncore frequency file string
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Ernst <[email protected]>
[ Upstream commit 60add818ab2543b7e4f2bfeaacf2504743c1eb50 ]
Running turbostat on a 16 socket HPE Scale-up Compute 3200 (SapphireRapids) fails with:
turbostat: /sys/devices/system/cpu/intel_uncore_frequency/package_010_die_00/current_freq_khz: open failed: No such file or directory
We observe the sysfs uncore frequency directories named:
...
package_09_die_00/
package_10_die_00/
package_11_die_00/
...
package_15_die_00/
The culprit is an incorrect sprintf format string "package_0%d_die_0%d" used with each instance of reading uncore frequency files. uncore-frequency-common.c creates the sysfs directory with the format "package_%02d_die_%02d". Once the package value reaches double digits, the formats diverge.
Change each instance of "package_0%d_die_0%d" to "package_%02d_die_%02d".
[lenb: deleted the probe part of this patch, as it was already fixed]
--- tools/power/x86/turbostat/turbostat.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/power/x86/turbostat/turbostat.c +1 -1
@@ -1969,7 +1969,7 @@ unsigned long long get_uncore_mhz(int package, int die) {char path[128 ]; -sprintf (path,"/sys/devices/system/cpu/intel_uncore_frequency/package_0%d_die_0%d/current_freq_khz" , package, +sprintf (path,"/sys/devices/system/cpu/intel_uncore_frequency/package_%02d_die_%02d/current_freq_khz" , package, die);return (snapshot_sysfs_counter (path) /1000 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 125/236 drm/amdgpu: Refine IB schedule error logging
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lijo Lazar <[email protected]>
[ Upstream commit 4b18a91faf1752f9bd69a4ed3aed2c8f6e5b0528 ]
Downgrade to debug information when IBs are skipped. Also, use dev_* to identify the device.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_job.c +5 -2
@@ -301,12 +301,15 @@ static struct dma_fence *amdgpu_job_run(struct drm_sched_job *sched_job)dma_fence_set_error (finished, -ECANCELED );if (finished->error <0 ) { -DRM_INFO ("Skip scheduling IBs!\n" ); +dev_dbg (adev->dev,"Skip scheduling IBs in ring(%s)" , + ring->name); }else { r =amdgpu_ib_schedule (ring, job->num_ibs, job->ibs, job, &fence);if (r) -DRM_ERROR ("Error scheduling IBs (%d)\n" , r); +dev_err (adev->dev, +"Error scheduling IBs (%d) in ring(%s)" , r, + ring->name); } job->job_run_counter++;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 126/236 selftests: timers: Fix valid-adjtimex signed left-shift undefined behavior
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Stultz <[email protected]>
[ Upstream commit 076361362122a6d8a4c45f172ced5576b2d4a50d ]
The struct adjtimex freq field takes a signed value who's units are in shifted (<<16) parts-per-million.
Unfortunately for negative adjustments, the straightforward use of:
freq = ppm << 16 trips undefined behavior warnings with clang:
valid-adjtimex.c:66:6: warning: shifting a negative signed value is undefined [-Wshift-negative-value]
-499<<16,
~~~~^
valid-adjtimex.c:67:6: warning: shifting a negative signed value is undefined [-Wshift-negative-value]
-450<<16,
~~~~^..
Fix it by using a multiply by (1 << 16) instead of shifting negative values in the valid-adjtimex test case. Align the values for better readability.
--- .../testing/selftests/timers/valid-adjtimex.c | 73 +++++++++---------- 1 file changed, 36 insertions(+), 37 deletions(-)
tools/testing/selftests/timers/valid-adjtimex.c +36 -37
@@ -21,9 +21,6 @@* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. */ - - -#include <stdio.h> #include <stdlib.h> #include <time.h>
@@ -62,45 +59,47 @@ int clear_time_state(void)#define NUM_FREQ_OUTOFRANGE 4#define NUM_FREQ_INVALID 2 +#define SHIFTED_PPM (1 << 16) +long valid_freq[NUM_FREQ_VALID ] = { --499 <<16 , --450 <<16 , --400 <<16 , --350 <<16 , --300 <<16 , --250 <<16 , --200 <<16 , --150 <<16 , --100 <<16 , --75 <<16 , --50 <<16 , --25 <<16 , --10 <<16 , --5 <<16 , --1 <<16 , +-499 *SHIFTED_PPM , +-450 *SHIFTED_PPM , +-400 *SHIFTED_PPM , +-350 *SHIFTED_PPM , +-300 *SHIFTED_PPM , +-250 *SHIFTED_PPM , +-200 *SHIFTED_PPM , +-150 *SHIFTED_PPM , +-100 *SHIFTED_PPM , +-75 *SHIFTED_PPM , +-50 *SHIFTED_PPM , +-25 *SHIFTED_PPM , +-10 *SHIFTED_PPM , +-5 *SHIFTED_PPM , +-1 *SHIFTED_PPM ,-1000 , -1 <<16 , -5 <<16 , -10 <<16 , -25 <<16 , -50 <<16 , -75 <<16 , -100 <<16 , -150 <<16 , -200 <<16 , -250 <<16 , -300 <<16 , -350 <<16 , -400 <<16 , -450 <<16 , -499 <<16 , +1 *SHIFTED_PPM , +5 *SHIFTED_PPM , +10 *SHIFTED_PPM , +25 *SHIFTED_PPM , +50 *SHIFTED_PPM , +75 *SHIFTED_PPM , +100 *SHIFTED_PPM , +150 *SHIFTED_PPM , +200 *SHIFTED_PPM , +250 *SHIFTED_PPM , +300 *SHIFTED_PPM , +350 *SHIFTED_PPM , +400 *SHIFTED_PPM , +450 *SHIFTED_PPM , +499 *SHIFTED_PPM , };long outofrange_freq[NUM_FREQ_OUTOFRANGE ] = { --1000 <<16 , --550 <<16 , -550 <<16 , -1000 <<16 , +-1000 *SHIFTED_PPM , +-550 *SHIFTED_PPM , +550 *SHIFTED_PPM , +1000 *SHIFTED_PPM , };#define LONG_MAX (~0UL>>1)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 127/236 Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rick Edgecombe <[email protected]>
[ Upstream commit 211f514ebf1ef5de37b1cf6df9d28a56cfd242ca ]
In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers need to take care to handle these errors to avoid returning decrypted (shared) memory to the page allocator, which could lead to functional or security issues.
In order to make sure callers of vmbus_establish_gpadl() and vmbus_teardown_gpadl() don't return decrypted/shared pages to allocators, add a field in struct vmbus_gpadl to keep track of the decryption status of the buffers. This will allow the callers to know if they should free or leak the pages.
Message-ID: <[email protected]>
--- drivers/hv/channel.c | 25 +++++++++++++++++++++---- include/linux/hyperv.h | 1 + 2 files changed, 22 insertions(+), 4 deletions(-)
drivers/hv/channel.c +21 -4
@@ -472,9 +472,18 @@ static int __vmbus_establish_gpadl(struct vmbus_channel *channel, (atomic_inc_return (&vmbus_connection.next_gpadl_handle) -1 ); ret =create_gpadl_header (type, kbuffer, size, send_offset, &msginfo); -if (ret) +if (ret) { + gpadl->decrypted = false;return ret; + } +/* +* Set the "decrypted" flag to true for the set_memory_decrypted() +* success case. In the failure case, the encryption state of the +* memory is unknown. Leave "decrypted" as true to ensure the +* memory will be leaked instead of going back on the free list. +*/ + gpadl->decrypted = true; ret =set_memory_decrypted ((unsigned long )kbuffer,PFN_UP (size));if (ret) {
@@ -563,9 +572,15 @@ static int __vmbus_establish_gpadl(struct vmbus_channel *channel,kfree (msginfo); -if (ret) -set_memory_encrypted ((unsigned long )kbuffer, -PFN_UP (size)); +if (ret) { +/* +* If set_memory_encrypted() fails, the decrypted flag is +* left as true so the memory is leaked instead of being +* put back on the free list. +*/ +if (!set_memory_encrypted ((unsigned long )kbuffer,PFN_UP (size))) + gpadl->decrypted = false; + }return ret; }
@@ -886,6 +901,8 @@ int vmbus_teardown_gpadl(struct vmbus_channel *channel, struct vmbus_gpadl *gpadif (ret)pr_warn ("Fail to set mem host visibility in GPADL teardown %d.\n" , ret); + gpadl->decrypted = ret; +return ret; }EXPORT_SYMBOL_GPL (vmbus_teardown_gpadl);
include/linux/hyperv.h +1 -0
@@ -832,6 +832,7 @@ struct vmbus_gpadl {u32 gpadl_handle;u32 size;void *buffer; +bool decrypted; };struct vmbus_channel {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 128/236 uio_hv_generic: Dont free decrypted memory
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rick Edgecombe <[email protected]>
[ Upstream commit 3d788b2fbe6a1a1a9e3db09742b90809d51638b7 ]
In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers need to take care to handle these errors to avoid returning decrypted (shared) memory to the page allocator, which could lead to functional or security issues.
The VMBus device UIO driver could free decrypted/shared pages if set_memory_decrypted() fails. Check the decrypted field in the gpadl to decide whether to free the memory.
Message-ID: <[email protected]>
--- drivers/uio/uio_hv_generic.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/uio/uio_hv_generic.c +8 -4
@@ -181,12 +181,14 @@ hv_uio_cleanup(struct hv_device *dev, struct hv_uio_private_data *pdata) {if (pdata->send_gpadl.gpadl_handle) {vmbus_teardown_gpadl (dev->channel, &pdata->send_gpadl); -vfree (pdata->send_buf); +if (!pdata->send_gpadl.decrypted) +vfree (pdata->send_buf); }if (pdata->recv_gpadl.gpadl_handle) {vmbus_teardown_gpadl (dev->channel, &pdata->recv_gpadl); -vfree (pdata->recv_buf); +if (!pdata->recv_gpadl.decrypted) +vfree (pdata->recv_buf); } }
@@ -295,7 +297,8 @@ hv_uio_probe(struct hv_device *dev, ret =vmbus_establish_gpadl (channel, pdata->recv_buf,RECV_BUFFER_SIZE , &pdata->recv_gpadl);if (ret) { -vfree (pdata->recv_buf); +if (!pdata->recv_gpadl.decrypted) +vfree (pdata->recv_buf); goto fail_close; }
@@ -317,7 +320,8 @@ hv_uio_probe(struct hv_device *dev, ret =vmbus_establish_gpadl (channel, pdata->send_buf,SEND_BUFFER_SIZE , &pdata->send_gpadl);if (ret) { -vfree (pdata->send_buf); +if (!pdata->send_gpadl.decrypted) +vfree (pdata->send_buf); goto fail_close; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 129/236 Drivers: hv: vmbus: Dont free ring buffers that couldnt be re-encrypted
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Kelley <[email protected]>
[ Upstream commit 30d18df6567be09c1433e81993e35e3da573ac48 ]
In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers need to take care to handle these errors to avoid returning decrypted (shared) memory to the page allocator, which could lead to functional or security issues.
The VMBus ring buffer code could free decrypted/shared pages if set_memory_decrypted() fails. Check the decrypted field in the struct vmbus_gpadl for the ring buffers to decide whether to free the memory.
Message-ID: <[email protected]>
--- drivers/hv/channel.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/hv/channel.c +3 -1
@@ -153,7 +153,9 @@ void vmbus_free_ring(struct vmbus_channel *channel)hv_ringbuffer_cleanup (&channel->inbound);if (channel->ringbuffer_page) { -__free_pages (channel->ringbuffer_page, +/* In a CoCo VM leak the memory if it didn't get re-encrypted */ +if (!channel->ringbuffer_gpadlhandle.decrypted) +__free_pages (channel->ringbuffer_page,get_order (channel->ringbuffer_pagecount <<PAGE_SHIFT )); channel->ringbuffer_page =NULL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 130/236 iommu: mtk: fix module autoloading
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 7537e31df80cb58c27f3b6fef702534ea87a5957 ]
Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based on the alias from of_device_id table.
--- drivers/iommu/mtk_iommu.c | 1 + drivers/iommu/mtk_iommu_v1.c | 1 + 2 files changed, 2 insertions(+)
drivers/iommu/mtk_iommu.c +1 -0
@@ -1570,6 +1570,7 @@ static const struct of_device_id mtk_iommu_of_ids[] = { { .compatible = "mediatek,mt8195-iommu-vpp", .data = &mt8195_data_vpp}, {} }; +MODULE_DEVICE_TABLE (of, mtk_iommu_of_ids);static struct platform_driver mtk_iommu_driver = { .probe = mtk_iommu_probe,
drivers/iommu/mtk_iommu_v1.c +1 -0
@@ -602,6 +602,7 @@ static const struct of_device_id mtk_iommu_v1_of_ids[] = { { .compatible = "mediatek,mt2701-m4u", }, {} }; +MODULE_DEVICE_TABLE (of, mtk_iommu_v1_of_ids);static const struct component_master_ops mtk_iommu_v1_com_ops = { .bind = mtk_iommu_v1_bind,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 131/236 fs/9p: only translate RWX permissions for plain 9P2000
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joakim Sindholt <[email protected]>
[ Upstream commit cd25e15e57e68a6b18dc9323047fe9c68b99290b ]
Garbage in plain 9P2000's perm bits is allowed through, which causes it to be able to set (among others) the suid bit. This was presumably not the intent since the unix extended bits are handled explicitly and conditionally on .u.
--- fs/9p/vfs_inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/9p/vfs_inode.c +1 -1
@@ -85,7 +85,7 @@ static int p9mode2perm(struct v9fs_session_info *v9ses,int res;int mode = stat->mode; - res = mode &S_IALLUGO ; + res = mode &0777 ;/* S_IRWXUGO */ if (v9fs_proto_dotu (v9ses)) {if ((mode &P9_DMSETUID ) ==P9_DMSETUID ) res |=S_ISUID ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 132/236 fs/9p: translate O_TRUNC into OTRUNC
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joakim Sindholt <[email protected]>
[ Upstream commit 87de39e70503e04ddb58965520b15eb9efa7eef3 ]
This one hits both 9P2000 and .u as it appears v9fs has never translated the O_TRUNC flag.
--- fs/9p/vfs_inode.c | 3 +++ 1 file changed, 3 insertions(+)
fs/9p/vfs_inode.c +3 -0
@@ -181,6 +181,9 @@ int v9fs_uflags2omode(int uflags, int extended)break ; } +if (uflags &O_TRUNC ) + ret |=P9_OTRUNC ; +if (extended) {if (uflags &O_EXCL ) ret |=P9_OEXCL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 133/236 9p: explicitly deny setlease attempts
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <[email protected]>
[ Upstream commit 7a84602297d36617dbdadeba55a2567031e5165b ]
9p is a remote network protocol, and it doesn't support asynchronous notifications from the server. Ensure that we don't hand out any leases since we can't guarantee they'll be broken when a file's contents change.
--- fs/9p/vfs_file.c | 2 ++ 1 file changed, 2 insertions(+)
fs/9p/vfs_file.c +2 -0
@@ -667,6 +667,7 @@ const struct file_operations v9fs_file_operations = { .splice_read = generic_file_splice_read, .splice_write = iter_file_splice_write, .fsync = v9fs_file_fsync, + .setlease = simple_nosetlease, };const struct file_operations v9fs_file_operations_dotl = {
@@ -708,4 +709,5 @@ const struct file_operations v9fs_mmap_file_operations_dotl = { .splice_read = generic_file_splice_read, .splice_write = iter_file_splice_write, .fsync = v9fs_file_fsync_dotl, + .setlease = simple_nosetlease, };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 134/236 gpio: wcove: Use -ENOTSUPP consistently
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 0c3b532ad3fbf82884a2e7e83e37c7dcdd4d1d99 ]
The GPIO library expects the drivers to return -ENOTSUPP in some cases and not using analogue POSIX code. Make the driver to follow this.
--- drivers/gpio/gpio-wcove.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpio/gpio-wcove.c +1 -1
@@ -104,7 +104,7 @@ static inline int to_reg(int gpio, enum ctrl_register type)unsigned int reg = type ==CTRL_IN ?GPIO_IN_CTRL_BASE :GPIO_OUT_CTRL_BASE ;if (gpio >=WCOVE_GPIO_NUM ) -return -EOPNOTSUPP ; +return -ENOTSUPP ;return reg + gpio; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 135/236 gpio: crystalcove: Use -ENOTSUPP consistently
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit ace0ebe5c98d66889f19e0f30e2518d0c58d0e04 ]
The GPIO library expects the drivers to return -ENOTSUPP in some cases and not using analogue POSIX code. Make the driver to follow this.
--- drivers/gpio/gpio-crystalcove.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpio/gpio-crystalcove.c +1 -1
@@ -92,7 +92,7 @@ static inline int to_reg(int gpio, enum ctrl_register reg_type)case 0x5e :return GPIOPANELCTL ;default : -return -EOPNOTSUPP ; +return -ENOTSUPP ; } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 136/236 clk: Dont hold prepare_lock when calling kref_put()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Boyd <[email protected]>
[ Upstream commit 6f63af7511e7058f3fa4ad5b8102210741c9f947 ]
We don't need to hold the prepare_lock when dropping a ref on a struct clk_core. The release function is only freeing memory and any code with a pointer reference has already unlinked anything pointing to the clk_core. This reduces the holding area of the prepare_lock a bit.
Note that we also don't call free_clk() with the prepare_lock held. There isn't any reason to do that.
--- drivers/clk/clk.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-)
drivers/clk/clk.c +5 -7
@@ -4435,7 +4435,8 @@ void clk_unregister(struct clk *clk)if (ops == &clk_nodrv_ops) {pr_err ("%s: unregistered clock: %s\n" , __func__, clk->core->name); - goto unlock; +clk_prepare_unlock (); +return ; }/* * Assign empty clock ops for consumers that might still hold
@@ -4469,11 +4470,10 @@ void clk_unregister(struct clk *clk)if (clk->core->protect_count)pr_warn ("%s: unregistering protected clock: %s\n" , __func__, clk->core->name); +clk_prepare_unlock ();kref_put (&clk->core->ref, __clk_release);free_clk (clk); -unlock: -clk_prepare_unlock (); }EXPORT_SYMBOL_GPL (clk_unregister);
@@ -4632,13 +4632,11 @@ void __clk_put(struct clk *clk)if (clk->min_rate >0 || clk->max_rate <ULONG_MAX )clk_set_rate_range_nolock (clk,0 ,ULONG_MAX ); - owner = clk->core->owner; -kref_put (&clk->core->ref, __clk_release); -clk_prepare_unlock (); + owner = clk->core->owner; +kref_put (&clk->core->ref, __clk_release);module_put (owner); -free_clk (clk); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 137/236 fs/9p: drop inodes immediately on non-.L too
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joakim Sindholt <[email protected]>
[ Upstream commit 7fd524b9bd1be210fe79035800f4bd78a41b349f ]
--- fs/9p/vfs_super.c | 1 + 1 file changed, 1 insertion(+)
fs/9p/vfs_super.c +1 -0
@@ -342,6 +342,7 @@ static const struct super_operations v9fs_super_ops = { .alloc_inode = v9fs_alloc_inode, .free_inode = v9fs_free_inode, .statfs = simple_statfs, + .drop_inode = v9fs_drop_inode, .evict_inode = v9fs_evict_inode, .show_options = v9fs_show_options, .umount_begin = v9fs_umount_begin,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 138/236 drm/nouveau/dp: Dont probe eDP ports twice harder
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lyude Paul <[email protected]>
[ Upstream commit bf52d7f9b2067f02efe7e32697479097aba4a055 ]
I didn't pay close enough attention the last time I tried to fix this problem - while we currently do correctly take care to make sure we don't probe a connected eDP port more then once, we don't do the same thing for eDP ports we found to be disconnected.
So, fix this and make sure we only ever probe eDP ports once and then leave them at that connector state forever (since without HPD, it's not going to change on its own anyway). This should get rid of the last few GSP errors getting spit out during runtime suspend and resume on some machines, as we tried to reprobe eDP ports in response to ACPI hotplug probe events.
--- drivers/gpu/drm/nouveau/nouveau_dp.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
drivers/gpu/drm/nouveau/nouveau_dp.c +8 -5
@@ -109,12 +109,15 @@ nouveau_dp_detect(struct nouveau_connector *nv_connector,u8 *dpcd = nv_encoder->dp.dpcd;int ret =NOUVEAU_DP_NONE , hpd; -/* If we've already read the DPCD on an eDP device, we don't need to -* reread it as it won't change +/* eDP ports don't support hotplugging - so there's no point in probing eDP ports unless we +* haven't probed them once before. */ -if (connector->connector_type == DRM_MODE_CONNECTOR_eDP && - dpcd[DP_DPCD_REV ] !=0 ) -return NOUVEAU_DP_SST ; +if (connector->connector_type == DRM_MODE_CONNECTOR_eDP) { +if (connector->status == connector_status_connected) +return NOUVEAU_DP_SST ; +else if (connector->status == connector_status_disconnected) +return NOUVEAU_DP_NONE ; + }mutex_lock (&nv_encoder->dp.hpd_irq_lock);if (mstm) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 139/236 net:usb:qmi_wwan: support Rolling modules
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vanillan Wang <[email protected]>
[ Upstream commit d362046021ea122309da8c8e0b6850c792ca97b5 ]
Update the qmi_wwan driver support for the Rolling LTE modules.
- VID:PID 33f8:0104, RW101-GL for laptop debug M.2 cards(with RMNET interface for /Linux/Chrome OS)0x0104: RMNET, diag, at, pipe
Here are the outputs of usb-devices:
T: Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0 D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 P: Vendor=33f8 ProdID=0104 Rev=05.04 S: Manufacturer=Rolling Wireless S.a.r.l. S: Product=Rolling Module S: SerialNumber=ba2eb033 C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=896mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=88(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs E: Ad=05(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=89(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
--- drivers/net/usb/qmi_wwan.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/usb/qmi_wwan.c +1 -0
@@ -1429,6 +1429,7 @@ static const struct usb_device_id products[] = { {QMI_FIXED_INTF(0x0489, 0xe0b5, 0)}, /* Foxconn T77W968 LTE with eSIM support*/ {QMI_FIXED_INTF(0x2692, 0x9025, 4)}, /* Cellient MPL200 (rebranded Qualcomm 05c6:9025) */ {QMI_QUIRK_SET_DTR(0x1546, 0x1342, 4)}, /* u-blox LARA-L6 */ + {QMI_QUIRK_SET_DTR(0x33f8, 0x0104, 4)}, /* Rolling RW101 RMNET *//* 4. Gobi 1000 devices */ {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)}, /* Acer Gobi Modem Device */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 140/236 kbuild: rust: avoid creating temporary files
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miguel Ojeda <[email protected]>
[ Upstream commit df01b7cfcef08bf3fdcac2909d0e1910781d6bfd ]
rustc outputs by default the temporary files (i.e. the ones saved by -Csave-temps, such as *.rcgu* files) in the current working directory when -o and --out-dir are not given (even if --emit=x=path is given, i.e. it does not use those for temporaries).
Since out-of-tree modules are compiled from the linux tree, rustc then tries to create them there, which may not be accessible.
Thus pass --out-dir explicitly, even if it is just for the temporary files.
Similarly, do so for Rust host programs too.
--- scripts/Makefile.build | 5 ++++- scripts/Makefile.host | 6 +++++- 2 files changed, 9 insertions(+), 2 deletions(-)
scripts/Makefile.build +4 -1
@@ -277,6 +277,9 @@ $(obj)/%.lst: $(src)/%.c FORCE rust_allowed_features := core_ffi_c +# `--out-dir` is required to avoid temporaries being created by `rustc` in the +# current working directory, which may be not accessible in the out-of-tree +# modules case. rust_common_cmd = \ RUST_MODFILE=$(modfile) $(RUSTC_OR_CLIPPY) $(rust_flags) \ -Zallow-features=$(rust_allowed_features) \
@@ -285,7 +288,7 @@ rust_common_cmd = \ --extern alloc --extern kernel \ --crate-type rlib -L $(objtree)/rust/ \ --crate-name $(basename $(notdir $@)) \ - --emit=dep-info=$(depfile) + --out-dir $(dir $@) --emit=dep-info=$(depfile) rust_handle_depfile = \ sed -i '/^\#/d' $(depfile)
scripts/Makefile.host +5 -1
@@ -86,7 +86,11 @@ hostc_flags = -Wp,-MMD,$(depfile) \ hostcxx_flags = -Wp,-MMD,$(depfile) \ $(KBUILD_HOSTCXXFLAGS) $(HOST_EXTRACXXFLAGS) \ $(HOSTCXXFLAGS_$(target-stem).o) -hostrust_flags = --emit=dep-info=$(depfile) \ + +# `--out-dir` is required to avoid temporaries being created by `rustc` in the +# current working directory, which may be not accessible in the out-of-tree +# modules case. +hostrust_flags = --out-dir $(dir $@) --emit=dep-info=$(depfile) \ $(KBUILD_HOSTRUSTFLAGS) $(HOST_EXTRARUSTFLAGS) \ $(HOSTRUSTFLAGS_$(target-stem))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 141/236 spi: Merge spi_controller.{slave,target}_abort()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit 6c6871cdaef96361f6b79a3e45d451a6475df4d6 ]
Mixing SPI slave/target handlers and SPI slave/target controllers using legacy and modern naming does not work well: there are now two different callbacks for aborting a slave/target operation, of which only one is populated, while spi_{slave,target}_abort() check and use only one, which may be the unpopulated one.
Fix this by merging the slave/target abort callbacks into a single callback using a union, like is already done for the slave/target flags.
--- include/linux/spi/spi.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
include/linux/spi/spi.h +4 -2
@@ -676,8 +676,10 @@ struct spi_controller { struct spi_message *message);int (*unprepare_message)(struct spi_controller *ctlr,struct spi_message *message); -int (*slave_abort)(struct spi_controller *ctlr); -int (*target_abort)(struct spi_controller *ctlr); +union { +int (*slave_abort)(struct spi_controller *ctlr); +int (*target_abort)(struct spi_controller *ctlr); + };/* * These hooks are for drivers that use a generic implementation
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 142/236 perf unwind-libunwind: Fix base address for .eh_frame
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namhyung Kim <[email protected]>
[ Upstream commit 4fb54994b2360ab5029ee3a959161f6fe6bbb349 ]
The base address of a DSO mapping should start at the start of the file. Usually DSOs are mapped from the pgoff 0 so it doesn't matter when it uses the start of the map address.
But generated DSOs for JIT codes doesn't start from the 0 so it should subtract the offset to calculate the .eh_frame table offsets correctly.
--- tools/perf/util/unwind-libunwind-local.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/util/unwind-libunwind-local.c +1 -1
@@ -327,7 +327,7 @@ static int read_unwind_spec_eh_frame(struct dso *dso, struct unwind_info *ui,maps__for_each_entry (ui->thread->maps, map) {if (map->dso == dso && map->start < base_addr) - base_addr = map->start; + base_addr = map->start - map->pgoff; } base_addr -= dso->data.elf_base_addr;/* Address of .eh_frame_hdr */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 143/236 perf unwind-libdw: Handle JIT-generated DSOs properly
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namhyung Kim <[email protected]>
[ Upstream commit c966d23a351a33f8a977fd7efbb6f467132f7383 ]
Usually DSOs are mapped from the beginning of the file, so the base address of the DSO can be calculated by map->start - map->pgoff.
However, JIT DSOs which are generated by perf inject -j, are mapped only the code segment. This makes unwind-libdw code confusing and rejects processing unwinds in the JIT DSOs. It should use the map start address as base for them to fix the confusion.
--- tools/perf/util/unwind-libdw.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-)
tools/perf/util/unwind-libdw.c +17 -4
@@ -45,6 +45,7 @@ static int __report_module(struct addr_location *al, u64 ip, {Dwfl_Module *mod;struct dso *dso =NULL ; +Dwarf_Addr base;/* * Some callers will use al->sym, so we can't just use the * cheaper thread__find_map() here.
@@ -57,24 +58,36 @@ static int __report_module(struct addr_location *al, u64 ip,if (!dso)return 0 ; +/* +* The generated JIT DSO files only map the code segment without +* ELF headers. Since JIT codes used to be packed in a memory +* segment, calculating the base address using pgoff falls info +* a different code in another DSO. So just use the map->start +* directly to pick the correct one. +*/ +if (!strncmp (dso->long_name,"/tmp/jitted-" ,12 )) + base = al->map->start; +else + base = al->map->start - al->map->pgoff; + mod =dwfl_addrmodule (ui->dwfl, ip);if (mod) {Dwarf_Addr s;dwfl_module_info (mod,NULL , &s,NULL ,NULL ,NULL ,NULL ,NULL ); -if (s != al->map->start - al->map->pgoff) - mod =0 ; +if (s != base) + mod =NULL ; }if (!mod) mod =dwfl_report_elf (ui->dwfl, dso->short_name, dso->long_name,-1 , - al->map->start - al->map->pgoff, false); + base, false);if (!mod) {char filename[PATH_MAX ];if (dso__build_id_filename (dso, filename,sizeof (filename), false)) mod =dwfl_report_elf (ui->dwfl, dso->short_name, filename,-1 , - al->map->start - al->map->pgoff, false); + base, false); }if (mod) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 144/236 qibfs: fix dentry leak
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit aa23317d0268b309bb3f0801ddd0d61813ff5afb ]
simple_recursive_removal() drops the pinning references to all positives in subtree. For the cases when its argument has been kept alive by the pinning alone that's exactly the right thing to do, but here the argument comes from dcache lookup, that needs to be balanced by explicit dput().
--- drivers/infiniband/hw/qib/qib_fs.c | 1 + 1 file changed, 1 insertion(+)
drivers/infiniband/hw/qib/qib_fs.c +1 -0
@@ -440,6 +440,7 @@ static int remove_device_files(struct super_block *sb,return PTR_ERR (dir); }simple_recursive_removal (dir,NULL ); +dput (dir);return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 145/236 xfrm: Preserve vlan tags for transport mode software GRO
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Davey <[email protected]>
[ Upstream commit 58fbfecab965014b6e3cc956a76b4a96265a1add ]
The software GRO path for esp transport mode uses skb_mac_header_rebuild prior to re-injecting the packet via the xfrm_napi_dev. This only copies skb->mac_len bytes of header which may not be sufficient if the packet contains 802.1Q tags or other VLAN tags. Worse copying only the initial header will leave a packet marked as being VLAN tagged but without the corresponding tag leading to mangling when it is later untagged.
The VLAN tags are important when receiving the decrypted esp transport mode packet after GRO processing to ensure it is received on the correct interface.
Therefore record the full mac header length in xfrm*_transport_input for later use in corresponding xfrm*_transport_finish to copy the entire mac header when rebuilding the mac header for GRO. The skb->data pointer is left pointing skb->mac_header bytes after the start of the mac header as is expected by the network stack and network and transport header offsets reset to this location.
--- include/linux/skbuff.h | 15 +++++++++++++++ include/net/xfrm.h | 3 +++ net/ipv4/xfrm4_input.c | 6 +++++- net/ipv6/xfrm6_input.c | 6 +++++- net/xfrm/xfrm_input.c | 8 ++++++++ 5 files changed, 36 insertions(+), 2 deletions(-)
include/linux/skbuff.h +15 -0
@@ -2927,6 +2927,21 @@ static inline void skb_mac_header_rebuild(struct sk_buff *skb) } } +/* Move the full mac header up to current network_header. +* Leaves skb->data pointing at offset skb->mac_len into the mac_header. +* Must be provided the complete mac header length. +*/ +static inline void skb_mac_header_rebuild_full (struct sk_buff *skb,u32 full_mac_len) +{ +if (skb_mac_header_was_set (skb)) { +const unsigned char *old_mac =skb_mac_header (skb); + +skb_set_mac_header (skb, -full_mac_len); +memmove (skb_mac_header (skb), old_mac, full_mac_len); +__skb_push (skb, full_mac_len - skb->mac_len); + } +} +static inline int skb_checksum_start_offset (const struct sk_buff *skb) {return skb->csum_start -skb_headroom (skb);
include/net/xfrm.h +3 -0
@@ -1032,6 +1032,9 @@ struct xfrm_offload {#define CRYPTO_INVALID_PACKET_SYNTAX 64#define CRYPTO_INVALID_PROTOCOL 128 +/* Used to keep whole l2 header for transport mode GRO */ +__u32 orig_mac_len; +__u8 proto;__u8 inner_ipproto; };
net/ipv4/xfrm4_input.c +5 -1
@@ -61,7 +61,11 @@ int xfrm4_transport_finish(struct sk_buff *skb, int async)ip_send_check (iph);if (xo && (xo->flags &XFRM_GRO )) { -skb_mac_header_rebuild (skb); +/* The full l2 header needs to be preserved so that re-injecting the packet at l2 +* works correctly in the presence of vlan tags. +*/ +skb_mac_header_rebuild_full (skb, xo->orig_mac_len); +skb_reset_network_header (skb);skb_reset_transport_header (skb);return 0 ; }
net/ipv6/xfrm6_input.c +5 -1
@@ -56,7 +56,11 @@ int xfrm6_transport_finish(struct sk_buff *skb, int async)skb_postpush_rcsum (skb,skb_network_header (skb), nhlen);if (xo && (xo->flags &XFRM_GRO )) { -skb_mac_header_rebuild (skb); +/* The full l2 header needs to be preserved so that re-injecting the packet at l2 +* works correctly in the presence of vlan tags. +*/ +skb_mac_header_rebuild_full (skb, xo->orig_mac_len); +skb_reset_network_header (skb);skb_reset_transport_header (skb);return 0 ; }
net/xfrm/xfrm_input.c +8 -0
@@ -388,11 +388,15 @@ static int xfrm_prepare_input(struct xfrm_state *x, struct sk_buff *skb)*/ static int xfrm4_transport_input (struct xfrm_state *x,struct sk_buff *skb) { +struct xfrm_offload *xo =xfrm_offload (skb);int ihl = skb->data -skb_transport_header (skb);if (skb->transport_header != skb->network_header) {memmove (skb_transport_header (skb),skb_network_header (skb), ihl); +if (xo) + xo->orig_mac_len = +skb_mac_header_was_set (skb) ?skb_mac_header_len (skb) :0 ; skb->network_header = skb->transport_header; }ip_hdr (skb)->tot_len =htons (skb->len + ihl);
@@ -403,11 +407,15 @@ static int xfrm4_transport_input(struct xfrm_state *x, struct sk_buff *skb)static int xfrm6_transport_input (struct xfrm_state *x,struct sk_buff *skb) {#if IS_ENABLED (CONFIG_IPV6 ) +struct xfrm_offload *xo =xfrm_offload (skb);int ihl = skb->data -skb_transport_header (skb);if (skb->transport_header != skb->network_header) {memmove (skb_transport_header (skb),skb_network_header (skb), ihl); +if (xo) + xo->orig_mac_len = +skb_mac_header_was_set (skb) ?skb_mac_header_len (skb) :0 ; skb->network_header = skb->transport_header; } ipv6_hdr(skb)->payload_len = htons(skb->len + ihl -
Signature · 1 line
2.43.0