6.12.20-rc1 review
Subsystems (4)
Greg Kroah-Hartman
maintainercover 6.12.20-rc1 review
This is the start of the stable review cycle for the 6.12.20 release. There are 231 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 21 Mar 2025 14:29:55 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.20-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.12.20-rc1
Max Kellermann <[email protected]>
fs/netfs/read_collect: add to next->prev_donated
Alex Henrie <[email protected]>
HID: apple: disable Fn key handling on the Omoton KB066
Daniel Wagner <[email protected]>
nvme-fc: rely on state transitions to handle connectivity loss
Luiz Augusto von Dentz <[email protected]>
Bluetooth: L2CAP: Fix corrupted list in hci_chan_del
Andrea Righi <[email protected]>
tools/sched_ext: Add helper to check task migration state
Andrea Righi <[email protected]>
sched_ext: selftests/dsp_local_on: Fix selftest on UP systems
Henrique Carvalho <[email protected]>
smb: client: Fix match_session bug preventing session reuse
Steve French <[email protected]>
smb3: add support for IAKerb
Ge Yang <[email protected]>
mm/hugetlb: wait for hugetlb folios to be freed
Christophe JAILLET <[email protected]>
i2c: sis630: Fix an error handling path in sis630_probe()
Christophe JAILLET <[email protected]>
i2c: ali15x3: Fix an error handling path in ali15x3_probe()
Christophe JAILLET <[email protected]>
i2c: ali1535: Fix an error handling path in ali1535_probe()
Ajay Kaher <[email protected]>
x86/vmware: Parse MP tables for SEV-SNP enabled guests under VMware hypervisors
Murad Masimov <[email protected]>
cifs: Fix integer overflow while processing closetimeo mount option
Murad Masimov <[email protected]>
cifs: Fix integer overflow while processing actimeo mount option
Murad Masimov <[email protected]>
cifs: Fix integer overflow while processing acdirmax mount option
Murad Masimov <[email protected]>
cifs: Fix integer overflow while processing acregmax mount option
Shin'ichiro Kawasaki <[email protected]>
block: change blk_mq_add_to_batch() third argument type to bool
Tamir Duberstein <[email protected]>
scripts: generate_rust_analyzer: add uapi crate
Tamir Duberstein <[email protected]>
scripts: generate_rust_analyzer: add missing include_dirs
Tamir Duberstein <[email protected]>
scripts: generate_rust_analyzer: add missing macros deps
José Roberto de Souza <[email protected]>
drm/i915: Increase I915_PARAM_MMAP_GTT_VERSION version to indicate support for partial mmaps
Christophe JAILLET <[email protected]>
ASoC: codecs: wm0010: Fix error handling path in wm0010_spi_probe()
Shin'ichiro Kawasaki <[email protected]>
nvme: move error logging from nvme_end_req() to __nvme_end_req()
Rodrigo Vivi <[email protected]>
drm/xe/pm: Temporarily disable D3Cold on BMG
Thomas Hellström <[email protected]>
drm/xe/userptr: Fix an incorrect assert
Tejas Upadhyay <[email protected]>
drm/xe: Release guc ids before cancelling work
Tejas Upadhyay <[email protected]>
drm/xe: cancel pending job timer before freeing scheduler
Bard Liao <[email protected]>
ASoC: rt722-sdca: add missing readable registers
Alban Kurti <[email protected]>
rust: init: add missing newline to pr_info! calls
Charles Keepax <[email protected]>
ASoC: cs42l43: Fix maximum ADC Volume
Ivan Abramov <[email protected]>
drm/gma500: Add NULL check for pci_gfx_root in mid_get_vbt_data()
Alban Kurti <[email protected]>
rust: error: add missing newline to pr_warn! calls
Charles Keepax <[email protected]>
ASoC: ops: Consistently treat platform_max as control value
Andrea Righi <[email protected]>
sched_ext: Validate prev_cpu in scx_bpf_select_cpu_dfl()
Andrei Botila <[email protected]>
net: phy: nxp-c45-tja11xx: add TJA112XB SGMII PCS restart errata
Andrei Botila <[email protected]>
net: phy: nxp-c45-tja11xx: add TJA112X PHY configuration errata
Paulo Alcantara <[email protected]>
smb: client: fix regression with guest option
Haoxiang Li <[email protected]>
qlcnic: fix memory leak issues in qlcnic_sriov_common.c
Piotr Jaroszynski <[email protected]>
Fix mmu notifiers for range-based invalidates
Zhenhua Huang <[email protected]>
arm64: mm: Populate vmemmap at the page level if not section aligned
Kent Overstreet <[email protected]>
dm-flakey: Fix memory corruption in optional corrupt_bio_byte feature
Mina Almasry <[email protected]>
netmem: prevent TX of unreadable skbs
Thomas Mizrahi <[email protected]>
ASoC: amd: yc: Support mic on another Lenovo ThinkPad E16 Gen 2 model
Peter Ujfalusi <[email protected]>
ASoC: Intel: sof_sdw: Fix unlikely uninitialized variable use in create_sdw_dailinks()
Peter Griffin <[email protected]>
clk: samsung: gs101: fix synchronous external abort in samsung_clk_save()
Varada Pavani <[email protected]>
clk: samsung: update PLL locktime for PLL142XX used on FSD platform
Namjae Jeon <[email protected]>
ksmbd: prevent connection release during oplock break notification
Namjae Jeon <[email protected]>
ksmbd: fix use-after-free in ksmbd_free_work_struct
Mario Limonciello <[email protected]>
drm/amd/display: Fix slab-use-after-free on hdcp_work
Alex Hung <[email protected]>
drm/amd/display: Assign normalized_pix_clk when color depth = 14
Mario Limonciello <[email protected]>
drm/amd/display: Restore correct backlight brightness after a GPU reset
Aliaksei Urbanski <[email protected]>
drm/amd/display: fix missing .is_two_pixels_per_container
Mario Limonciello <[email protected]>
drm/amd/display: fix default brightness
Leo Li <[email protected]>
drm/amd/display: Disable unneeded hpd interrupts during dm_init
David Rosca <[email protected]>
drm/amdgpu/display: Allow DCC for video formats on GFX12
Yifan Zha <[email protected]>
drm/amd/amdkfd: Evict all queues even HWS remove queue failed
Natalie Vock <[email protected]>
drm/amdgpu: NULL-check BO's backing store when determining GFX12 PTE flags
Imre Deak <[email protected]>
drm/dp_mst: Fix locking when skipping CSN before topology probing
Ville Syrjälä <[email protected]>
drm/atomic: Filter out redundant DPMS calls
Miguel Ojeda <[email protected]>
drm/panic: fix overindented list items in documentation
Miguel Ojeda <[email protected]>
drm/panic: use div_ceil to clean Clippy warning
Ville Syrjälä <[email protected]>
drm/i915/cdclk: Do cdclk post plane programming later
Conor Dooley <[email protected]>
spi: microchip-core: prevent RX overflows when transmit size > FIFO size
Florent Revest <[email protected]>
x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes
Benno Lossin <[email protected]>
rust: init: fix Zeroable implementation for Option<NonNull<T>> and Option<KBox<T>>
Matthew Maurer <[email protected]>
rust: Disallow BTF generation with Rust + LTO
Tamir Duberstein <[email protected]>
rust: alloc: satisfy POSIX alignment requirement
Miguel Ojeda <[email protected]>
rust: remove leftover mentions of the alloc crate
Mitchell Levy <[email protected]>
rust: lockdep: Remove support for dynamically allocated LockClassKeys
Johan Hovold <[email protected]>
USB: serial: option: match on interface class for Telit FN990B
Fabio Porcedda <[email protected]>
USB: serial: option: fix Telit Cinterion FE990A name
Fabio Porcedda <[email protected]>
USB: serial: option: add Telit Cinterion FE990B compositions
Boon Khai Ng <[email protected]>
USB: serial: ftdi_sio: add support for Altera USB Blaster 3
Werner Sembach <[email protected]>
Input: i8042 - swap old quirk combination with new quirk for more devices
Werner Sembach <[email protected]>
Input: i8042 - swap old quirk combination with new quirk for several devices
Werner Sembach <[email protected]>
Input: i8042 - add required quirks for missing old boardnames
Werner Sembach <[email protected]>
Input: i8042 - swap old quirk combination with new quirk for NHxxRZQ
Antheas Kapenekakis <[email protected]>
Input: xpad - rename QH controller to Legion Go S
Antheas Kapenekakis <[email protected]>
Input: xpad - add support for TECNO Pocket Go
Antheas Kapenekakis <[email protected]>
Input: xpad - add support for ZOTAC Gaming Zone
Pavel Rojtberg <[email protected]>
Input: xpad - add multiple supported devices
Nilton Perim Neto <[email protected]>
Input: xpad - add 8BitDo SN30 Pro, Hyperkin X91 and Gamesir G7 SE controllers
Jeff LaBundy <[email protected]>
Input: iqs7222 - preserve system status register
H. Nikolaus Schaller <[email protected]>
Input: ads7846 - fix gpiod allocation
Luca Weiss <[email protected]>
Input: goodix-berlin - fix vddio regulator references
Pali Rohár <[email protected]>
cifs: Throw -EOPNOTSUPP error on unsupported reparse point type from parse_reparse_point()
Pali Rohár <[email protected]>
cifs: Validate content of WSL reparse point buffers
Keith Busch <[email protected]>
vhost: return task creation error instead of NULL
Ming Lei <[email protected]>
block: fix 'kmem_cache of name 'bio-108' already exists'
Frederic Weisbecker <[email protected]>
net: Handle napi_schedule() calls from non-interrupt
Thomas Zimmermann <[email protected]>
drm/nouveau: Do not override forced connector status
Matthieu Baerts (NGI0) <[email protected]>
mptcp: safety check before fallback
Aaron Ma <[email protected]>
perf/x86/rapl: Add support for Intel Arrow Lake U
Arnd Bergmann <[email protected]>
x86/irq: Define trace events conditionally
Dmytro Maluka <[email protected]>
x86/of: Don't use DTB for SMP setup if ACPI is enabled
Kan Liang <[email protected]>
perf/x86/intel: Use better start period for frequency mode
Harry Wentland <[email protected]>
drm/vkms: Round fixp2int conversion in lerp_u16
Bard Liao <[email protected]>
ASoC: SOF: Intel: don't check number of sdw links when set dmic_fixup
Nicolas Frattaroli <[email protected]>
ASoC: dapm-graph: set fill colour of turned on nodes
Miklos Szeredi <[email protected]>
fuse: don't truncate cached, mutated symlink
Hector Martin <[email protected]>
ASoC: tas2764: Set the SDOUT polarity correctly
Hector Martin <[email protected]>
ASoC: tas2764: Fix power control mask
Hector Martin <[email protected]>
ASoC: tas2770: Fix volume scale
Andrew Davis <[email protected]>
phy: ti: gmii-sel: Do not use syscon helper to build regmap
Daniel Wagner <[email protected]>
nvme: only allow entering LIVE from CONNECTING state
Yu-Chun Lin <[email protected]>
sctp: Fix undefined behavior in left shift operation
Pali Rohár <[email protected]>
cifs: Treat unhandled directory name surrogate reparse points as mount directory nodes
Hector Martin <[email protected]>
apple-nvme: Release power domains when probe fails
Ruozhu Li <[email protected]>
nvmet-rdma: recheck queue state is LIVE in state lock in recv done
Christopher Lentocha <[email protected]>
nvme-pci: quirk Acer FA100 for non-uniqueue identifiers
Uday Shankar <[email protected]>
io-wq: backoff when retrying worker creation
Stephan Gerhold <[email protected]>
net: wwan: mhi_wwan_mbim: Silence sequence number glitch errors
Cristian Ciocaltea <[email protected]>
ASoC: SOF: amd: Handle IPC replies before FW_BOOT_COMPLETE
Cristian Ciocaltea <[email protected]>
ASoC: SOF: amd: Add post_fw_run_delay ACP quirk
Pierre-Louis Bossart <[email protected]>
ALSA: hda: hda-intel: add Panther Lake-H support
Peter Ujfalusi <[email protected]>
ASoC: SOF: Intel: pci-ptl: Add support for PTL-H
Pierre-Louis Bossart <[email protected]>
ALSA: hda: intel-dsp-config: Add PTL-H support
Pierre-Louis Bossart <[email protected]>
PCI: pci_ids: add INTEL_HDA_PTL_H
Terry Cheong <[email protected]>
ASoC: SOF: Intel: hda: add softdep pre to snd-hda-codec-hdmi module
Vitaly Rodionov <[email protected]>
ASoC: arizona/madera: use fsleep() in up/down DAPM event delays.
Kuninori Morimoto <[email protected]>
ASoC: rsnd: adjust convert rate limitation
Kuninori Morimoto <[email protected]>
ASoC: rsnd: don't indicate warning on rsnd_kctrl_accept_runtime()
Kuninori Morimoto <[email protected]>
ASoC: rsnd: indicate unsupported clock rate
Edson Juliano Drosdeck <[email protected]>
ALSA: hda/realtek: Limit mic boost on Positivo ARN50
Kuninori Morimoto <[email protected]>
ASoC: simple-card-utils.c: add missing dlc->of_node
Bard Liao <[email protected]>
ASoC: Intel: soc-acpi-intel-mtl-match: declare adr as ull
Richard Fitzgerald <[email protected]>
ASoC: Intel: sof_sdw: Add quirk for Asus Zenbook S14
Richard Fitzgerald <[email protected]>
ASoC: Intel: sof_sdw: Add lookup of quirk using PCI subsystem ID
Jiayuan Chen <[email protected]>
selftests/bpf: Fix invalid flag of recv()
Maxime Ripard <[email protected]>
drm/tests: hdmi: Fix recursive locking
Maxime Ripard <[email protected]>
drm/tests: hdmi: Reorder DRM entities variables assignment
Maxime Ripard <[email protected]>
drm/tests: hdmi: Remove redundant assignments
Luiz Augusto von Dentz <[email protected]>
Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd
Jan Beulich <[email protected]>
Xen/swiotlb: mark xen_swiotlb_fixup() __init
Beata Michalska <[email protected]>
arm64: amu: Delay allocating cpumask for AMU FIE support
Bibo Mao <[email protected]>
LoongArch: KVM: Set host with kernel mode when switch to VM mode
Huacai Chen <[email protected]>
LoongArch: Fix kernel_page_present() for KPRANGE/XKPRANGE
Daniel Lezcano <[email protected]>
thermal/cpufreq_cooling: Remove structure member documentation
Peter Oberparleiter <[email protected]>
s390/cio: Fix CHPID "configure" attribute caching
Sakari Ailus <[email protected]>
platform/x86: int3472: Call "reset" GPIO "enable" for INT347E
Sakari Ailus <[email protected]>
platform/x86: int3472: Use correct type for "polarity", call it gpio_flags
Mark Pearson <[email protected]>
platform/x86: thinkpad_acpi: Support for V9 DYTC platform profiles
Sybil Isabel Dorsett <[email protected]>
platform/x86: thinkpad_acpi: Fix invalid fan speed on ThinkPad X120e
Jann Horn <[email protected]>
sched: Clarify wake_up_q()'s write to task->wake_q.next
Josh Poimboeuf <[email protected]>
objtool: Ignore dangling jump table entries
Matthew Wilcox (Oracle) <[email protected]>
btrfs: fix two misuses of folio_shift()
Alex Henrie <[email protected]>
HID: apple: fix up the F6 key on the Omoton KB066 keyboard
Ievgen Vovk <[email protected]>
HID: hid-apple: Apple Magic Keyboard a3203 USB-C support
Bharadwaj Raju <[email protected]>
selftests/cgroup: use bash in test_cpuset_v1_hp.sh
Daniel Brackenbury <[email protected]>
HID: topre: Fix n-key rollover on Realforce R3S TKL boards
Zhang Lixu <[email protected]>
HID: intel-ish-hid: ipc: Add Panther Lake PCI device IDs
Alexander Stein <[email protected]>
usb: phy: generic: Use proper helper for property detection
Vicki Pfau <[email protected]>
HID: hid-steam: Fix issues with disabling both gamepad mode and lizard mode
Chia-Lin Kao (AceLan) <[email protected]>
HID: ignore non-functional sensor in HP 5MP Camera
Zhang Lixu <[email protected]>
HID: intel-ish-hid: Send clock sync message immediately after reset
Zhang Lixu <[email protected]>
HID: intel-ish-hid: fix the length of MNG_SYNC_FW_CLOCK in doorbell
Tejun Heo <[email protected]>
sched_ext: selftests/dsp_local_on: Fix sporadic failures
Miklos Szeredi <[email protected]>
selftests: always check mask returned by statmount(2)
Brahmajit Das <[email protected]>
vboxsf: fix building with GCC 15
Eric W. Biederman <[email protected]>
alpha/elf: Fix misc/setarch test of util-linux by removing 32bit support
Paulo Alcantara <[email protected]>
smb: client: fix noisy when tree connecting to DFS interlink targets
Gannon Kolding <[email protected]>
ACPI: resource: IRQ override for Eluktronics MECH-17
Magnus Lindholm <[email protected]>
scsi: qla1280: Fix kernel oops when debug level > 2
Seunghui Lee <[email protected]>
scsi: ufs: core: Fix error return with query response
Rik van Riel <[email protected]>
scsi: core: Use GFP_NOIO to avoid circular locking dependency
Alex Hung <[email protected]>
drm/amd/display: Fix out-of-bound accesses
Dmitry Kandybka <[email protected]>
platform/x86/intel: pmc: fix ltr decode in pmc_core_ltr_show()
Christian Loehle <[email protected]>
sched/debug: Provide slice length for fair tasks
Chengen Du <[email protected]>
iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
Jens Axboe <[email protected]>
futex: Pass in task to futex_queue()
Filipe Manana <[email protected]>
btrfs: avoid starting new transaction when cleaning qgroup during subvolume drop
Joe Hattori <[email protected]>
powercap: call put_device() on an error path in powercap_register_control_type()
Andy Shevchenko <[email protected]>
hrtimers: Mark is_migration_base() with __always_inline
Daniel Wagner <[email protected]>
nvme-fc: do not ignore connectivity loss during connecting
Daniel Wagner <[email protected]>
nvme-fc: go straight to connecting state when initializing
Carolina Jubran <[email protected]>
net/mlx5e: Prevent bridge link show failure for non-eswitch-allowed devices
Jianbo Liu <[email protected]>
net/mlx5: Bridge, fix the crash caused by LAG state check
Shay Drory <[email protected]>
net/mlx5: Lag, Check shared fdb before creating MultiPort E-Switch
Shay Drory <[email protected]>
net/mlx5: Fix incorrect IRQ pool usage when releasing IRQs
Vlad Dogaru <[email protected]>
net/mlx5: HWS, Rightsize bwc matcher priority
Xin Long <[email protected]>
Revert "openvswitch: switch to per-action label counting in conntrack"
Ilya Maximets <[email protected]>
net: openvswitch: remove misbehaving actions length check
Guillaume Nault <[email protected]>
gre: Fix IPv6 link-local address generation.
Alexey Kashavkin <[email protected]>
netfilter: nft_exthdr: fix offset with ipv4_find_option()
Cong Wang <[email protected]>
net_sched: Prevent creation of classes with TC_H_ROOT
Dan Carpenter <[email protected]>
ipvs: prevent integer overflow in do_ip_vs_get_ctl()
Kohei Enju <[email protected]>
netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree()
Justin Lai <[email protected]>
rtase: Fix improper release of ring list entries in rtase_sw_reset
Hangbin Liu <[email protected]>
selftests: bonding: fix incorrect mac address
Hangbin Liu <[email protected]>
bonding: fix incorrect MAC address setting to receive NS messages
Matt Johnston <[email protected]>
net: mctp: unshare packets when reassembling
Amit Cohen <[email protected]>
net: switchdev: Convert blocking notification chain to a raw one
Taehee Yoo <[email protected]>
eth: bnxt: fix memory leak in queue reset
David Wei <[email protected]>
bnxt_en: handle tpa_info in queue API implementation
David Wei <[email protected]>
bnxt_en: refactor tpa_info alloc/free into helpers
Jakub Kicinski <[email protected]>
eth: bnxt: use page pool for head frags
Taehee Yoo <[email protected]>
eth: bnxt: fix kernel panic in the bnxt_get_queue_stats{rx | tx}Taehee Yoo <[email protected]>
eth: bnxt: do not update checksum in bnxt_xdp_build_skb()
Taehee Yoo <[email protected]>
eth: bnxt: do not use BNXT_VNIC_NTUPLE unconditionally in queue restart logic
Taehee Yoo <[email protected]>
eth: bnxt: return fail if interface is down in bnxt_queue_mem_alloc()
Taehee Yoo <[email protected]>
eth: bnxt: fix truesize for mb-xdp-pass case
Wentao Liang <[email protected]>
net/mlx5: handle errors in mlx5_chains_create_table()
Michael Kelley <[email protected]>
Drivers: hv: vmbus: Don't release fb_mmio resource in vmbus_free_mmio()
Saurabh Sengar <[email protected]>
fbdev: hyperv_fb: Allow graceful removal of framebuffer
Saurabh Sengar <[email protected]>
fbdev: hyperv_fb: Simplify hvfb_putmem
Michael Kelley <[email protected]>
fbdev: hyperv_fb: Fix hang in kdump kernel when on Hyper-V Gen 2 VMs
Michael Kelley <[email protected]>
drm/hyperv: Fix address space leak when Hyper-V DRM device is removed
Breno Leitao <[email protected]>
netpoll: hold rcu read lock in __netpoll_send_skb()
Matt Johnston <[email protected]>
net: mctp i2c: Copy headers if cloned
Matt Johnston <[email protected]>
net: mctp i3c: Copy headers if cloned
Joseph Huang <[email protected]>
net: dsa: mv88e6xxx: Verify after ATU Load ops
Jiri Pirko <[email protected]>
net/mlx5: Fill out devlink dev info only for PFs
Luiz Augusto von Dentz <[email protected]>
Revert "Bluetooth: hci_core: Fix sleeping function called from invalid context"
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_event: Fix enabling passive scanning
Miri Korenblit <[email protected]>
wifi: cfg80211: cancel wiphy_work before freeing wiphy
Miri Korenblit <[email protected]>
wifi: mac80211: don't queue sdata::work for a non-running sdata
Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: mvm: fix PNVM timeout for non-MSI-X platforms
Jun Yang <[email protected]>
sched: address a potential NULL pointer dereference in the GRED scheduler.
Florian Westphal <[email protected]>
netfilter: nf_tables: make destruction work queue pernet
Nicklas Bo Jensen <[email protected]>
netfilter: nf_conncount: garbage collection is not skipped when jiffies wrap around
Marcin Szycik <[email protected]>
ice: Fix switchdev slow-path in LAG
Grzegorz Nitka <[email protected]>
ice: fix memory leak in aRFS after reset
Larysa Zaremba <[email protected]>
ice: do not configure destination override for switchdev
Sebastian Andrzej Siewior <[email protected]>
netfilter: nft_ct: Use __refcount_inc() for per-CPU nft_ct_pcpu_template.
Charles Han <[email protected]>
pinctrl: nuvoton: npcm8xx: Add NULL check in npcm8xx_gpio_fw
Artur Weber <[email protected]>
pinctrl: bcm281xx: Fix incorrect regmap max_registers value
Michael Kelley <[email protected]>
fbdev: hyperv_fb: iounmap() the correct memory when removing a device
Suren Baghdasaryan <[email protected]>
userfaultfd: fix PTE unmapping stack-allocated PTE copies
Barry Song <[email protected]>
mm: fix kernel BUG when userfaultfd_move encounters swapcache
Uladzislau Rezki (Sony) <[email protected]>
mm/slab/kvfree_rcu: Switch to WQ_MEM_RECLAIM wq
-------------
Diffstat:
Documentation/rust/quick-start.rst | 2 +- Makefile | 4 +- arch/alpha/include/asm/elf.h | 6 +- arch/alpha/include/asm/pgtable.h | 2 +- arch/alpha/include/asm/processor.h | 8 +- arch/alpha/kernel/osf_sys.c | 11 +- arch/arm64/include/asm/tlbflush.h | 22 +- arch/arm64/kernel/topology.c | 22 +- arch/arm64/mm/mmu.c | 5 +- arch/loongarch/kvm/switch.S | 2 +- arch/loongarch/mm/pageattr.c | 3 +- arch/x86/events/intel/core.c | 85 ++++++ arch/x86/events/rapl.c | 1 + arch/x86/kernel/cpu/microcode/amd.c | 2 +- arch/x86/kernel/cpu/vmware.c | 4 + arch/x86/kernel/devicetree.c | 3 +- arch/x86/kernel/irq.c | 2 + arch/x86/kvm/mmu/mmu.c | 2 +- block/bio.c | 2 +- drivers/acpi/resource.c | 6 + drivers/block/null_blk/main.c | 4 +- drivers/block/virtio_blk.c | 5 +- drivers/clk/samsung/clk-gs101.c | 8 - drivers/clk/samsung/clk-pll.c | 7 +- drivers/firmware/iscsi_ibft.c | 5 +- drivers/gpu/drm/amd/amdgpu/gmc_v12_0.c | 5 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 8 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 12 +- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c | 1 + .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c | 64 +++-- .../drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c | 7 +- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 7 +- .../amd/display/dc/dce60/dce60_timing_generator.c | 1 + .../dc/dml2/dml21/dml21_translation_helper.c | 4 +- .../amd/display/dc/dml2/dml2_translation_helper.c | 6 +- drivers/gpu/drm/display/drm_dp_mst_topology.c | 40 +-- drivers/gpu/drm/drm_atomic_uapi.c | 4 + drivers/gpu/drm/drm_connector.c | 4 + drivers/gpu/drm/drm_panic_qr.rs | 16 +- drivers/gpu/drm/gma500/mid_bios.c | 5 + drivers/gpu/drm/hyperv/hyperv_drm_drv.c | 2 + drivers/gpu/drm/i915/display/intel_display.c | 5 +- drivers/gpu/drm/i915/gem/i915_gem_mman.c | 5 +- drivers/gpu/drm/nouveau/nouveau_connector.c | 1 - drivers/gpu/drm/tests/drm_hdmi_state_helper_test.c | 193 +++++++------- drivers/gpu/drm/vkms/vkms_composer.c | 2 +- drivers/gpu/drm/xe/xe_guc_submit.c | 4 +- drivers/gpu/drm/xe/xe_hmm.c | 6 +- drivers/gpu/drm/xe/xe_pm.c | 13 +- drivers/hid/Kconfig | 3 +- drivers/hid/hid-apple.c | 13 +- drivers/hid/hid-ids.h | 3 + drivers/hid/hid-quirks.c | 1 + drivers/hid/hid-steam.c | 6 +- drivers/hid/hid-topre.c | 7 + drivers/hid/intel-ish-hid/ipc/hw-ish.h | 2 + drivers/hid/intel-ish-hid/ipc/ipc.c | 15 +- drivers/hid/intel-ish-hid/ipc/pci-ish.c | 7 + drivers/hid/intel-ish-hid/ishtp/ishtp-dev.h | 2 + drivers/hv/vmbus_drv.c | 13 + drivers/i2c/busses/i2c-ali1535.c | 12 +- drivers/i2c/busses/i2c-ali15x3.c | 12 +- drivers/i2c/busses/i2c-sis630.c | 12 +- drivers/input/joystick/xpad.c | 39 ++- drivers/input/misc/iqs7222.c | 50 ++-- drivers/input/serio/i8042-acpipnpio.h | 111 ++++---- drivers/input/touchscreen/ads7846.c | 2 +- drivers/input/touchscreen/goodix_berlin_core.c | 24 +- drivers/md/dm-flakey.c | 2 +- drivers/net/bonding/bond_options.c | 55 +++- drivers/net/dsa/mv88e6xxx/chip.c | 59 ++++- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 286 +++++++++++++-------- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 + drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 13 +- drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.h | 3 +- drivers/net/ethernet/intel/ice/ice_arfs.c | 2 +- drivers/net/ethernet/intel/ice/ice_eswitch.c | 6 - drivers/net/ethernet/intel/ice/ice_lag.c | 27 ++ drivers/net/ethernet/intel/ice/ice_lib.c | 18 -- drivers/net/ethernet/intel/ice/ice_lib.h | 4 - drivers/net/ethernet/intel/ice/ice_txrx.c | 4 +- drivers/net/ethernet/mellanox/mlx5/core/devlink.c | 3 + .../ethernet/mellanox/mlx5/core/en/rep/bridge.c | 12 +- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 6 +- drivers/net/ethernet/mellanox/mlx5/core/eq.c | 2 +- .../net/ethernet/mellanox/mlx5/core/irq_affinity.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c | 4 +- drivers/net/ethernet/mellanox/mlx5/core/lag/lag.h | 1 + .../net/ethernet/mellanox/mlx5/core/lag/mpesw.c | 3 +- .../ethernet/mellanox/mlx5/core/lib/fs_chains.c | 5 + drivers/net/ethernet/mellanox/mlx5/core/mlx5_irq.h | 4 +- drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c | 13 +- drivers/net/ethernet/mellanox/mlx5/core/pci_irq.h | 2 +- .../mellanox/mlx5/core/steering/hws/mlx5hws_bwc.h | 2 +- .../ethernet/qlogic/qlcnic/qlcnic_sriov_common.c | 8 +- drivers/net/ethernet/realtek/rtase/rtase_main.c | 10 + drivers/net/mctp/mctp-i2c.c | 5 + drivers/net/mctp/mctp-i3c.c | 5 + drivers/net/phy/nxp-c45-tja11xx.c | 68 +++++ drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 6 +- drivers/net/wwan/mhi_wwan_mbim.c | 2 +- drivers/nvme/host/apple.c | 5 +- drivers/nvme/host/core.c | 14 +- drivers/nvme/host/fc.c | 59 +---- drivers/nvme/host/pci.c | 7 +- drivers/nvme/target/rdma.c | 33 ++- drivers/phy/ti/phy-gmii-sel.c | 15 +- drivers/pinctrl/bcm/pinctrl-bcm281xx.c | 2 +- drivers/pinctrl/nuvoton/pinctrl-npcm8xx.c | 3 + drivers/platform/x86/intel/int3472/discrete.c | 85 ++++-- drivers/platform/x86/intel/pmc/core.c | 4 +- drivers/platform/x86/thinkpad_acpi.c | 50 +++- drivers/powercap/powercap_sys.c | 3 +- drivers/s390/cio/chp.c | 3 +- drivers/scsi/qla1280.c | 2 +- drivers/scsi/scsi_scan.c | 2 +- drivers/spi/spi-microchip-core.c | 41 ++- drivers/thermal/cpufreq_cooling.c | 2 - drivers/ufs/core/ufshcd.c | 7 +- drivers/usb/phy/phy-generic.c | 2 +- drivers/usb/serial/ftdi_sio.c | 14 + drivers/usb/serial/ftdi_sio_ids.h | 13 + drivers/usb/serial/option.c | 48 ++-- drivers/vhost/vhost.c | 2 +- drivers/video/fbdev/hyperv_fb.c | 52 ++-- drivers/xen/swiotlb-xen.c | 2 +- fs/btrfs/extent_io.c | 11 +- fs/btrfs/qgroup.c | 6 +- fs/fuse/dir.c | 2 +- fs/namei.c | 24 +- fs/netfs/read_collect.c | 2 +- fs/smb/client/asn1.c | 2 + fs/smb/client/cifs_spnego.c | 4 +- fs/smb/client/cifsglob.h | 4 + fs/smb/client/connect.c | 16 +- fs/smb/client/fs_context.c | 18 +- fs/smb/client/inode.c | 13 + fs/smb/client/reparse.c | 10 +- fs/smb/client/sess.c | 3 +- fs/smb/client/smb2pdu.c | 4 +- fs/smb/common/smbfsctl.h | 3 + fs/smb/server/connection.c | 20 ++ fs/smb/server/connection.h | 2 + fs/smb/server/ksmbd_work.c | 3 - fs/smb/server/ksmbd_work.h | 1 - fs/smb/server/oplock.c | 43 ++-- fs/smb/server/oplock.h | 1 - fs/smb/server/server.c | 14 +- fs/vboxsf/super.c | 3 +- include/linux/blk-mq.h | 16 +- include/linux/fs.h | 2 + include/linux/hugetlb.h | 5 + include/linux/pci_ids.h | 1 + include/net/bluetooth/hci_core.h | 108 +++----- include/net/bluetooth/l2cap.h | 3 +- include/net/netfilter/nf_tables.h | 4 +- include/sound/soc.h | 5 +- init/Kconfig | 2 +- io_uring/futex.c | 2 +- io_uring/io-wq.c | 23 +- kernel/futex/core.c | 5 +- kernel/futex/futex.h | 11 +- kernel/futex/pi.c | 2 +- kernel/futex/waitwake.c | 4 +- kernel/rcu/tree.c | 14 +- kernel/sched/core.c | 5 +- kernel/sched/debug.c | 2 + kernel/sched/ext.c | 3 + kernel/time/hrtimer.c | 22 +- kernel/vhost_task.c | 4 +- mm/hugetlb.c | 8 + mm/page_isolation.c | 10 + mm/userfaultfd.c | 91 +++++-- net/bluetooth/hci_core.c | 10 +- net/bluetooth/hci_event.c | 37 +-- net/bluetooth/iso.c | 6 - net/bluetooth/l2cap_core.c | 181 ++++++------- net/bluetooth/l2cap_sock.c | 15 +- net/bluetooth/rfcomm/core.c | 6 - net/bluetooth/sco.c | 12 +- net/core/dev.c | 5 +- net/core/netpoll.c | 9 +- net/ipv6/addrconf.c | 15 +- net/mac80211/util.c | 8 +- net/mctp/route.c | 10 +- net/mctp/test/route-test.c | 109 ++++++++ net/mptcp/protocol.h | 2 + net/netfilter/ipvs/ip_vs_ctl.c | 8 +- net/netfilter/nf_conncount.c | 6 +- net/netfilter/nf_tables_api.c | 24 +- net/netfilter/nft_compat.c | 8 +- net/netfilter/nft_ct.c | 6 +- net/netfilter/nft_exthdr.c | 10 +- net/openvswitch/conntrack.c | 30 ++- net/openvswitch/datapath.h | 3 + net/openvswitch/flow_netlink.c | 15 +- net/sched/sch_api.c | 6 + net/sched/sch_gred.c | 3 +- net/sctp/stream.c | 2 +- net/switchdev/switchdev.c | 25 +- net/wireless/core.c | 7 + rust/kernel/alloc/allocator_test.rs | 18 ++ rust/kernel/error.rs | 2 +- rust/kernel/init.rs | 23 +- rust/kernel/init/macros.rs | 6 +- rust/kernel/lib.rs | 2 +- rust/kernel/sync.rs | 16 +- scripts/generate_rust_analyzer.py | 71 ++--- scripts/rustdoc_test_gen.rs | 4 +- sound/hda/intel-dsp-config.c | 5 + sound/pci/hda/hda_intel.c | 2 + sound/pci/hda/patch_realtek.c | 1 + sound/soc/amd/yc/acp6x-mach.c | 7 + sound/soc/codecs/arizona.c | 14 +- sound/soc/codecs/cs42l43.c | 2 +- sound/soc/codecs/madera.c | 10 +- sound/soc/codecs/rt722-sdca-sdw.c | 4 + sound/soc/codecs/tas2764.c | 10 +- sound/soc/codecs/tas2764.h | 8 +- sound/soc/codecs/tas2770.c | 2 +- sound/soc/codecs/wm0010.c | 13 +- sound/soc/codecs/wm5110.c | 8 +- sound/soc/generic/simple-card-utils.c | 1 + sound/soc/intel/boards/sof_sdw.c | 33 ++- sound/soc/intel/common/soc-acpi-intel-mtl-match.c | 2 +- sound/soc/sh/rcar/core.c | 14 - sound/soc/sh/rcar/rsnd.h | 1 - sound/soc/sh/rcar/src.c | 116 +++++++-- sound/soc/sh/rcar/ssi.c | 3 +- sound/soc/soc-ops.c | 15 +- sound/soc/sof/amd/acp-ipc.c | 23 +- sound/soc/sof/amd/acp.c | 1 + sound/soc/sof/amd/acp.h | 1 + sound/soc/sof/amd/vangogh.c | 18 ++ sound/soc/sof/intel/hda-codec.c | 1 + sound/soc/sof/intel/hda.c | 18 +- sound/soc/sof/intel/pci-ptl.c | 1 + tools/objtool/check.c | 9 + tools/sched_ext/include/scx/common.bpf.h | 11 + tools/sound/dapm-graph | 2 +- .../selftests/bpf/prog_tests/sockmap_basic.c | 6 +- .../testing/selftests/cgroup/test_cpuset_v1_hp.sh | 2 +- .../selftests/drivers/net/bonding/bond_options.sh | 4 +- .../filesystems/statmount/statmount_test.c | 22 +- .../testing/selftests/sched_ext/dsp_local_on.bpf.c | 2 +- 245 files changed, 2447 insertions(+), 1311 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/231 mm/slab/kvfree_rcu: Switch to WQ_MEM_RECLAIM wq
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uladzislau Rezki (Sony) <[email protected]>
commit dfd3df31c9db752234d7d2e09bef2aeabb643ce4 upstream.
Currently kvfree_rcu() APIs use a system workqueue which is "system_unbound_wq" to driver RCU machinery to reclaim a memory.
Recently, it has been noted that the following kernel warning can be observed:
<snip>
workqueue: WQ_MEM_RECLAIM nvme-wq:nvme_scan_work is flushing !WQ_MEM_RECLAIM events_unbound:kfree_rcu_work
WARNING: CPU: 21 PID: 330 at kernel/workqueue.c:3719 check_flush_dependency+0x112/0x120 Modules linked in: intel_uncore_frequency(E) intel_uncore_frequency_common(E) skx_edac(E) ... CPU: 21 UID: 0 PID: 330 Comm: kworker/u144:6 Tainted: G E 6.13.2-0_g925d379822da #1 Hardware name: Wiwynn Twin Lakes MP/Twin Lakes Passive MP, BIOS YMM20 02/01/2023 Workqueue: nvme-wq nvme_scan_work RIP: 0010:check_flush_dependency+0x112/0x120 Code: 05 9a 40 14 02 01 48 81 c6 c0 00 00 00 48 8b 50 18 48 81 c7 c0 00 00 00 48 89 f9 48 ... RSP: 0018:ffffc90000df7bd8 EFLAGS: 00010082 RAX: 000000000000006a RBX: ffffffff81622390 RCX: 0000000000000027 RDX: 00000000fffeffff RSI: 000000000057ffa8 RDI: ffff88907f960c88 RBP: 0000000000000000 R08: ffffffff83068e50 R09: 000000000002fffd R10: 0000000000000004 R11: 0000000000000000 R12: ffff8881001a4400 R13: 0000000000000000 R14: ffff88907f420fb8 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff88907f940000(0000) knlGS:0000000000000000 CR2: 00007f60c3001000 CR3: 000000107d010005 CR4: 00000000007726f0 PKRU: 55555554 Call Trace: <TASK> ? __warn+0xa4/0x140 ? check_flush_dependency+0x112/0x120 ? report_bug+0xe1/0x140 ? check_flush_dependency+0x112/0x120 ? handle_bug+0x5e/0x90 ? exc_invalid_op+0x16/0x40 ? asm_exc_invalid_op+0x16/0x20 ? timer_recalc_next_expiry+0x190/0x190 ? check_flush_dependency+0x112/0x120 ? check_flush_dependency+0x112/0x120 __flush_work.llvm.1643880146586177030+0x174/0x2c0 flush_rcu_work+0x28/0x30 kvfree_rcu_barrier+0x12f/0x160 kmem_cache_destroy+0x18/0x120 bioset_exit+0x10c/0x150 disk_release.llvm.6740012984264378178+0x61/0xd0 device_release+0x4f/0x90 kobject_put+0x95/0x180 nvme_put_ns+0x23/0xc0 nvme_remove_invalid_namespaces+0xb3/0xd0 nvme_scan_work+0x342/0x490 process_scheduled_works+0x1a2/0x370 worker_thread+0x2ff/0x390 ? pwq_release_workfn+0x1e0/0x1e0 kthread+0xb1/0xe0 ? __kthread_parkme+0x70/0x70 ret_from_fork+0x30/0x40 ? __kthread_parkme+0x70/0x70 ret_from_fork_asm+0x11/0x20 </TASK> ---[ end trace 0000000000000000 ]---
<snip>
To address this switch to use of independent WQ_MEM_RECLAIM workqueue, so the rules are not violated from workqueue framework point of view.
Apart of that, since kvfree_rcu() does reclaim memory it is worth to go with WQ_MEM_RECLAIM type of wq because it is designed for this purpose.
--- kernel/rcu/tree.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
kernel/rcu/tree.c +10 -4
@@ -3191,6 +3191,8 @@ void call_rcu(struct rcu_head *head, rcu }EXPORT_SYMBOL_GPL (call_rcu); +static struct workqueue_struct *rcu_reclaim_wq; +/* Maximum number of jiffies to wait before draining a batch. */ #define KFREE_DRAIN_JIFFIES (5 * HZ)#define KFREE_N_BATCHES 2
@@ -3519,10 +3521,10 @@ __schedule_delayed_monitor_work(struct kif (delayed_work_pending (&krcp->monitor_work)) { delay_left = krcp->monitor_work.timer.expires - jiffies;if (delay < delay_left) -mod_delayed_work (system_unbound_wq, &krcp->monitor_work, delay); +mod_delayed_work (rcu_reclaim_wq, &krcp->monitor_work, delay);return ; } -queue_delayed_work (system_unbound_wq, &krcp->monitor_work, delay); +queue_delayed_work (rcu_reclaim_wq, &krcp->monitor_work, delay); } static void
@@ -3620,7 +3622,7 @@ kvfree_rcu_queue_batch(struct kfree_rcu_// "free channels", the batch can handle. Break // the loop since it is done with this CPU thus // queuing an RCU work is _always_ success here. - queued =queue_rcu_work (system_unbound_wq, &krwp->rcu_work); + queued =queue_rcu_work (rcu_reclaim_wq, &krwp->rcu_work);WARN_ON_ONCE (!queued);break ; }
@@ -3708,7 +3710,7 @@ run_page_cache_worker(struct kfree_rcu_cif (rcu_scheduler_active ==RCU_SCHEDULER_RUNNING && !atomic_xchg (&krcp->work_in_progress,1 )) {if (atomic_read (&krcp->backoff_page_cache_fill)) { -queue_delayed_work (system_unbound_wq, +queue_delayed_work (rcu_reclaim_wq, &krcp->page_cache_work,msecs_to_jiffies (rcu_delay_page_cache_fill_msec)); }else {
@@ -5662,6 +5664,10 @@ static void __init kfree_rcu_batch_init(int i, j;struct shrinker *kfree_rcu_shrinker; + rcu_reclaim_wq =alloc_workqueue ("kvfree_rcu_reclaim" , +WQ_UNBOUND |WQ_MEM_RECLAIM ,0 ); +WARN_ON (!rcu_reclaim_wq); +/* Clamp it to [0:100] seconds interval. */ if (rcu_delay_page_cache_fill_msec <0 || rcu_delay_page_cache_fill_msec >100 *MSEC_PER_SEC ) {
Greg Kroah-Hartman
maintainerPATCH 2/231 mm: fix kernel BUG when userfaultfd_move encounters swapcache
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Barry Song <[email protected]>
commit c50f8e6053b0503375c2975bf47f182445aebb4c upstream.
userfaultfd_move() checks whether the PTE entry is present or a swap entry.
- If the PTE entry is present, move_present_pte() handles folio migration by setting:
src_folio->index = linear_page_index(dst_vma, dst_addr);
- If the PTE entry is a swap entry, move_swap_pte() simply copies the PTE to the new dst_addr.
This approach is incorrect because, even if the PTE is a swap entry, it can still reference a folio that remains in the swap cache.
This creates a race window between steps 2 and 4.
1. add_to_swap: The folio is added to the swapcache.
2. try_to_unmap: PTEs are converted to swap entries.
3. pageout: The folio is written back.
4. Swapcache is cleared.
If userfaultfd_move() occurs in the window between steps 2 and 4, after the swap PTE has been moved to the destination, accessing the destination triggers do_swap_page(), which may locate the folio in the swapcache. However, since the folio's index has not been updated to match the destination VMA, do_swap_page() will detect a mismatch.
This can result in two critical issues depending on the system configuration.
If KSM is disabled, both small and large folios can trigger a BUG during the add_rmap operation due to:
page_pgoff(folio, page) != linear_page_index(vma, address)
[ 13.336953] page: refcount:6 mapcount:1 mapping:00000000f43db19c index:0xffffaf150 pfn:0x4667c [ 13.337520] head: order:2 mapcount:1 entire_mapcount:0 nr_pages_mapped:1 pincount:0 [ 13.337716] memcg:ffff00000405f000 [ 13.337849] anon flags: 0x3fffc0000020459(locked|uptodate|dirty|owner_priv_1|head|swapbacked|node=0|zone=0|lastcpupid=0xffff) [ 13.338630] raw: 03fffc0000020459 ffff80008507b538 ffff80008507b538 ffff000006260361 [ 13.338831] raw: 0000000ffffaf150 0000000000004000 0000000600000000 ffff00000405f000 [ 13.339031] head: 03fffc0000020459 ffff80008507b538 ffff80008507b538 ffff000006260361 [ 13.339204] head: 0000000ffffaf150 0000000000004000 0000000600000000 ffff00000405f000 [ 13.339375] head: 03fffc0000000202 fffffdffc0199f01 ffffffff00000000 0000000000000001 [ 13.339546] head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000 [ 13.339736] page dumped because: VM_BUG_ON_PAGE(page_pgoff(folio, page) != linear_page_index(vma, address)) [ 13.340190] ------------[ cut here ]------------ [ 13.340316] kernel BUG at mm/rmap.c:1380! [ 13.340683] Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP [ 13.340969] Modules linked in: [ 13.341257] CPU: 1 UID: 0 PID: 107 Comm: a.out Not tainted 6.14.0-rc3-gcf42737e247a-dirty #299 [ 13.341470] Hardware name: linux,dummy-virt (DT) [ 13.341671] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 13.341815] pc : __page_check_anon_rmap+0xa0/0xb0 [ 13.341920] lr : __page_check_anon_rmap+0xa0/0xb0 [ 13.342018] sp : ffff80008752bb20 [ 13.342093] x29: ffff80008752bb20 x28: fffffdffc0199f00 x27: 0000000000000001 [ 13.342404] x26: 0000000000000000 x25: 0000000000000001 x24: 0000000000000001 [ 13.342575] x23: 0000ffffaf0d0000 x22: 0000ffffaf0d0000 x21: fffffdffc0199f00 [ 13.342731] x20: fffffdffc0199f00 x19: ffff000006210700 x18: 00000000ffffffff [ 13.342881] x17: 6c203d2120296567 x16: 6170202c6f696c6f x15: 662866666f67705f [ 13.343033] x14: 6567617028454741 x13: 2929737365726464 x12: ffff800083728ab0 [ 13.343183] x11: ffff800082996bf8 x10: 0000000000000fd7 x9 : ffff80008011bc40 [ 13.343351] x8 : 0000000000017fe8 x7 : 00000000fffff000 x6 : ffff8000829eebf8 [ 13.343498] x5 : c0000000fffff000 x4 : 0000000000000000 x3 : 0000000000000000 [ 13.343645] x2 : 0000000000000000 x1 : ffff0000062db980 x0 : 000000000000005f [ 13.343876] Call trace: [ 13.344045] __page_check_anon_rmap+0xa0/0xb0 (P) [ 13.344234] folio_add_anon_rmap_ptes+0x22c/0x320 [ 13.344333] do_swap_page+0x1060/0x1400 [ 13.344417] __handle_mm_fault+0x61c/0xbc8 [ 13.344504] handle_mm_fault+0xd8/0x2e8 [ 13.344586] do_page_fault+0x20c/0x770 [ 13.344673] do_translation_fault+0xb4/0xf0 [ 13.344759] do_mem_abort+0x48/0xa0 [ 13.344842] el0_da+0x58/0x130 [ 13.344914] el0t_64_sync_handler+0xc4/0x138 [ 13.345002] el0t_64_sync+0x1ac/0x1b0 [ 13.345208] Code: aa1503e0 f000f801 910f6021 97ff5779 (d4210000) [ 13.345504] ---[ end trace 0000000000000000 ]--- [ 13.345715] note: a.out[107] exited with irqs disabled [ 13.345954] note: a.out[107] exited with preempt_count 2
If KSM is enabled, Peter Xu also discovered that do_swap_page() may trigger an unexpected CoW operation for small folios because ksm_might_need_to_copy() allocates a new folio when the folio index does not match linear_page_index(vma, addr).
This patch also checks the swapcache when handling swap entries. If a match is found in the swapcache, it processes it similarly to a present PTE.
However, there are some differences. For example, the folio is no longer exclusive because folio_try_share_anon_rmap_pte() is performed during unmapping.
Furthermore, in the case of swapcache, the folio has already been unmapped, eliminating the risk of concurrent rmap walks and removing the need to acquire src_folio's anon_vma or lock.
Note that for large folios, in the swapcache handling path, we directly return -EBUSY since split_folio() will return -EBUSY regardless if the folio is under writeback or unmapped. This is not an urgent issue, so a follow-up patch may address it separately.
[ surenb: resolved merged conflict caused by the difference in
move_swap_pte() arguments ]
--- mm/userfaultfd.c | 75 ++++++++++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 66 insertions(+), 9 deletions(-)
mm/userfaultfd.c +66 -9
@@ -18,6 +18,7 @@#include <asm/tlbflush.h> #include <asm/tlb.h> #include "internal.h" +#include "swap.h" static __always_inline bool validate_dst_vma(struct vm_area_struct *dst_vma, unsigned long dst_end)
@@ -1067,15 +1068,13 @@ out:return err; } -static int move_swap_pte (struct mm_struct *mm, +static int move_swap_pte (struct mm_struct *mm,struct vm_area_struct *dst_vma,unsigned long dst_addr,unsigned long src_addr,pte_t *dst_pte,pte_t *src_pte,pte_t orig_dst_pte,pte_t orig_src_pte, -spinlock_t *dst_ptl,spinlock_t *src_ptl) +spinlock_t *dst_ptl,spinlock_t *src_ptl, +struct folio *src_folio) { -if (!pte_swp_exclusive (orig_src_pte)) -return -EBUSY ; -double_pt_lock (dst_ptl, src_ptl); if (!pte_same(ptep_get(src_pte), orig_src_pte) ||
@@ -1084,6 +1083,16 @@ static int move_swap_pte(struct mm_strucreturn -EAGAIN ; } +/* +* The src_folio resides in the swapcache, requiring an update to its +* index and mapping to align with the dst_vma, where a swap-in may +* occur and hit the swapcache after moving the PTE. +*/ +if (src_folio) { +folio_move_anon_rmap (src_folio, dst_vma); + src_folio->index =linear_page_index (dst_vma, dst_addr); + } + orig_src_pte =ptep_get_and_clear (mm, src_addr, src_pte);set_pte_at (mm, dst_addr, dst_pte, orig_src_pte);double_pt_unlock (dst_ptl, src_ptl);
@@ -1130,6 +1139,7 @@ static int move_pages_pte(struct mm_stru __u64 mode) {swp_entry_t entry; +struct swap_info_struct *si =NULL ;pte_t orig_src_pte, orig_dst_pte;pte_t src_folio_pte;spinlock_t *src_ptl, *dst_ptl;
@@ -1312,6 +1322,8 @@ retry: orig_dst_pte, orig_src_pte, dst_ptl, src_ptl, src_folio); }else { +struct folio *folio =NULL ; + entry =pte_to_swp_entry (orig_src_pte);if (non_swap_entry (entry)) {if (is_migration_entry (entry)) {
@@ -1325,10 +1337,53 @@ retry: goto out; } - err =move_swap_pte (mm, dst_addr, src_addr, - dst_pte, src_pte, - orig_dst_pte, orig_src_pte, - dst_ptl, src_ptl); +if (!pte_swp_exclusive (orig_src_pte)) { + err = -EBUSY ; + goto out; + } + + si =get_swap_device (entry); +if (unlikely (!si)) { + err = -EAGAIN ; + goto out; + } +/* +* Verify the existence of the swapcache. If present, the folio's +* index and mapping must be updated even when the PTE is a swap +* entry. The anon_vma lock is not taken during this process since +* the folio has already been unmapped, and the swap entry is +* exclusive, preventing rmap walks. +* +* For large folios, return -EBUSY immediately, as split_folio() +* also returns -EBUSY when attempting to split unmapped large +* folios in the swapcache. This issue needs to be resolved +* separately to allow proper handling. +*/ +if (!src_folio) + folio =filemap_get_folio (swap_address_space (entry), +swap_cache_index (entry)); +if (!IS_ERR_OR_NULL (folio)) { +if (folio_test_large (folio)) { + err = -EBUSY ; +folio_put (folio); + goto out; + } + src_folio = folio; + src_folio_pte = orig_src_pte; +if (!folio_trylock (src_folio)) { +pte_unmap (&orig_src_pte); +pte_unmap (&orig_dst_pte); + src_pte = dst_pte =NULL ; +put_swap_device (si); + si =NULL ; +/* now we can block and wait */ +folio_lock (src_folio); + goto retry; + } + } + err =move_swap_pte (mm, dst_vma, dst_addr, src_addr, dst_pte, src_pte, + orig_dst_pte, orig_src_pte, + dst_ptl, src_ptl, src_folio); } out:
@@ -1345,6 +1400,8 @@ out:if (src_pte)pte_unmap (src_pte);mmu_notifier_invalidate_range_end (&range); +if (si) +put_swap_device (si);return err; }
Greg Kroah-Hartman
maintainerPATCH 3/231 userfaultfd: fix PTE unmapping stack-allocated PTE copies
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Suren Baghdasaryan <[email protected]>
commit 927e926d72d9155fde3264459fe9bfd7b5e40d28 upstream.
Current implementation of move_pages_pte() copies source and destination PTEs in order to detect concurrent changes to PTEs involved in the move. However these copies are also used to unmap the PTEs, which will fail if CONFIG_HIGHPTE is enabled because the copies are allocated on the stack. Fix this by using the actual PTEs which were kmap()ed.
--- mm/userfaultfd.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)
mm/userfaultfd.c +10 -10
@@ -1265,8 +1265,8 @@ retry:spin_unlock (src_ptl);if (!locked) { -pte_unmap (&orig_src_pte); -pte_unmap (&orig_dst_pte); +pte_unmap (src_pte); +pte_unmap (dst_pte); src_pte = dst_pte =NULL ;/* now we can block and wait */ folio_lock (src_folio);
@@ -1282,8 +1282,8 @@ retry:/* at this point we have src_folio locked */ if (folio_test_large (src_folio)) {/* split_folio() can block */ -pte_unmap (&orig_src_pte); -pte_unmap (&orig_dst_pte); +pte_unmap (src_pte); +pte_unmap (dst_pte); src_pte = dst_pte =NULL ; err =split_folio (src_folio);if (err)
@@ -1308,8 +1308,8 @@ retry: goto out; }if (!anon_vma_trylock_write (src_anon_vma)) { -pte_unmap (&orig_src_pte); -pte_unmap (&orig_dst_pte); +pte_unmap (src_pte); +pte_unmap (dst_pte); src_pte = dst_pte =NULL ;/* now we can block and wait */ anon_vma_lock_write (src_anon_vma);
@@ -1327,8 +1327,8 @@ retry: entry =pte_to_swp_entry (orig_src_pte);if (non_swap_entry (entry)) {if (is_migration_entry (entry)) { -pte_unmap (&orig_src_pte); -pte_unmap (&orig_dst_pte); +pte_unmap (src_pte); +pte_unmap (dst_pte); src_pte = dst_pte =NULL ;migration_entry_wait (mm, src_pmd, src_addr); err = -EAGAIN ;
@@ -1371,8 +1371,8 @@ retry: src_folio = folio; src_folio_pte = orig_src_pte;if (!folio_trylock (src_folio)) { -pte_unmap (&orig_src_pte); -pte_unmap (&orig_dst_pte); +pte_unmap (src_pte); +pte_unmap (dst_pte); src_pte = dst_pte =NULL ;put_swap_device (si); si =NULL ;
Greg Kroah-Hartman
maintainerPATCH 4/231 fbdev: hyperv_fb: iounmap() the correct memory when removing a device
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Kelley <[email protected]>
[ Upstream commit 7241c886a71797cc51efc6fadec7076fcf6435c2 ]
When a Hyper-V framebuffer device is removed, or the driver is unbound from a device, any allocated and/or mapped memory must be released. In particular, MMIO address space that was mapped to the framebuffer must be unmapped. Current code unmaps the wrong address, resulting in an error like:
[ 4093.980597] iounmap: bad address 00000000c936c05c
followed by a stack dump.
Commit d21987d709e8 ("video: hyperv: hyperv_fb: Support deferred IO for Hyper-V frame buffer driver") changed the kind of address stored in info->screen_base, and the iounmap() call in hvfb_putmem() was not updated accordingly.
Fix this by updating hvfb_putmem() to unmap the correct address.
Message-ID: <[email protected]>
--- drivers/video/fbdev/hyperv_fb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/video/fbdev/hyperv_fb.c +1 -1
@@ -1080,7 +1080,7 @@ static void hvfb_putmem(struct hv_device *hdev, struct fb_info *info)if (par->need_docopy) {vfree (par->dio_vp); -iounmap (info->screen_base); +iounmap (par->mmio_vp);vmbus_free_mmio (par->mem->start, screen_fb_size); }else { hvfb_release_phymem(hdev, info->fix.smem_start,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 5/231 pinctrl: bcm281xx: Fix incorrect regmap max_registers value
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Artur Weber <[email protected]>
[ Upstream commit 68283c1cb573143c0b7515e93206f3503616bc10 ]
The max_registers value does not take into consideration the stride; currently, it's set to the number of the last pin, but this does not accurately represent the final register.
Fix this by multiplying the current value by 4.
--- drivers/pinctrl/bcm/pinctrl-bcm281xx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pinctrl/bcm/pinctrl-bcm281xx.c +1 -1
@@ -974,7 +974,7 @@ static const struct regmap_config bcm281xx_pinctrl_regmap_config = { .reg_bits = 32, .reg_stride = 4, .val_bits = 32, - .max_register = BCM281XX_PIN_VC_CAM3_SDA, + .max_register = BCM281XX_PIN_VC_CAM3_SDA * 4, };static int bcm281xx_pinctrl_get_groups_count (struct pinctrl_dev *pctldev)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 6/231 pinctrl: nuvoton: npcm8xx: Add NULL check in npcm8xx_gpio_fw
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Han <[email protected]>
[ Upstream commit acf40ab42799e4ae1397ee6f5c5941092d66f999 ]
devm_kasprintf() calls can return null pointers on failure. But the return values were not checked in npcm8xx_gpio_fw(). Add NULL check in npcm8xx_gpio_fw(), to handle kernel NULL pointer dereference error.
--- drivers/pinctrl/nuvoton/pinctrl-npcm8xx.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/pinctrl/nuvoton/pinctrl-npcm8xx.c +3 -0
@@ -2374,6 +2374,9 @@ static int npcm8xx_gpio_fw(struct npcm8xx_pinctrl *pctrl) pctrl->gpio_bank[id].gc.parent = dev; pctrl->gpio_bank[id].gc.fwnode = child; pctrl->gpio_bank[id].gc.label =devm_kasprintf (dev,GFP_KERNEL ,"%pfw" , child); +if (pctrl->gpio_bank[id].gc.label ==NULL ) +return -ENOMEM ; + pctrl->gpio_bank[id].gc.dbg_show = npcmgpio_dbg_show; pctrl->gpio_bank[id].direction_input = pctrl->gpio_bank[id].gc.direction_input; pctrl->gpio_bank[id].gc.direction_input = npcmgpio_direction_input;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 7/231 netfilter: nft_ct: Use __refcount_inc() for per-CPU nft_ct_pcpu_template.
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <[email protected]>
[ Upstream commit 5cfe5612ca9590db69b9be29dc83041dbf001108 ]
nft_ct_pcpu_template is a per-CPU variable and relies on disabled BH for its locking. The refcounter is read and if its value is set to one then the refcounter is incremented and variable is used - otherwise it is already in use and left untouched.
Without per-CPU locking in local_bh_disable() on PREEMPT_RT the read-then-increment operation is not atomic and therefore racy.
This can be avoided by using unconditionally __refcount_inc() which will increment counter and return the old value as an atomic operation. In case the returned counter is not one, the variable is in use and we need to decrement counter. Otherwise we can use it.
Use __refcount_inc() instead of read and a conditional increment.
--- net/netfilter/nft_ct.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/netfilter/nft_ct.c +4 -2
@@ -230,6 +230,7 @@ static void nft_ct_set_zone_eval(const struct nft_expr *expr,enum ip_conntrack_info ctinfo;u16 value =nft_reg_load16 (®s->data[priv->sreg]);struct nf_conn *ct; +int oldcnt; ct =nf_ct_get (skb, &ctinfo);if (ct)/* already tracked */
@@ -250,10 +251,11 @@ static void nft_ct_set_zone_eval(const struct nft_expr *expr, ct =this_cpu_read (nft_ct_pcpu_template); -if (likely (refcount_read (&ct->ct_general.use) ==1 )) { -refcount_inc (&ct->ct_general.use); +__refcount_inc (&ct->ct_general.use, &oldcnt); +if (likely (oldcnt ==1 )) {nf_ct_zone_add (ct, &zone); }else { +refcount_dec (&ct->ct_general.use);/* previous skb got queued to userspace, allocate temporary * one until percpu template can be reused. */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 8/231 ice: do not configure destination override for switchdev
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Larysa Zaremba <[email protected]>
[ Upstream commit 3be83ee9de0298f8321aa0b148d8f9995102e40f ]
After switchdev is enabled and disabled later, LLDP packets sending stops, despite working perfectly fine before and during switchdev state. To reproduce (creating/destroying VF is what triggers the reconfiguration):
devlink dev eswitch set pci/<address> mode switchdev echo '2' > /sys/class/net/<ifname>/device/sriov_numvfs echo '0' > /sys/class/net/<ifname>/device/sriov_numvfs
This happens because LLDP relies on the destination override functionality. It needs to 1) set a flag in the descriptor, 2) set the VSI permission to make it valid. The permissions are set when the PF VSI is first configured, but switchdev then enables it for the uplink VSI (which is always the PF) once more when configured and disables when deconfigured, which leads to software-generated LLDP packets being blocked.
Do not modify the destination override permissions when configuring switchdev, as the enabled state is the default configuration that is never modified.
--- drivers/net/ethernet/intel/ice/ice_eswitch.c | 6 ------ drivers/net/ethernet/intel/ice/ice_lib.c | 18 ------------------ drivers/net/ethernet/intel/ice/ice_lib.h | 4 ---- 3 files changed, 28 deletions(-)
drivers/net/ethernet/intel/ice/ice_eswitch.c +0 -6
@@ -49,9 +49,6 @@ static int ice_eswitch_setup_env(struct ice_pf *pf)if (vlan_ops->dis_rx_filtering (uplink_vsi)) goto err_vlan_filtering; -if (ice_vsi_update_security (uplink_vsi, ice_vsi_ctx_set_allow_override)) - goto err_override_uplink; -if (ice_vsi_update_local_lb (uplink_vsi, true)) goto err_override_local_lb;
@@ -63,8 +60,6 @@ static int ice_eswitch_setup_env(struct ice_pf *pf) err_up:ice_vsi_update_local_lb (uplink_vsi, false); err_override_local_lb: -ice_vsi_update_security (uplink_vsi, ice_vsi_ctx_clear_allow_override); -err_override_uplink: vlan_ops->ena_rx_filtering (uplink_vsi); err_vlan_filtering: ice_cfg_dflt_vsi(uplink_vsi->port_info, uplink_vsi->idx, false,
@@ -275,7 +270,6 @@ static void ice_eswitch_release_env(struct ice_pf *pf) vlan_ops =ice_get_compat_vsi_vlan_ops (uplink_vsi);ice_vsi_update_local_lb (uplink_vsi, false); -ice_vsi_update_security (uplink_vsi, ice_vsi_ctx_clear_allow_override); vlan_ops->ena_rx_filtering (uplink_vsi);ice_cfg_dflt_vsi (uplink_vsi->port_info, uplink_vsi->idx, false,ICE_FLTR_TX );
drivers/net/ethernet/intel/ice/ice_lib.c +0 -18
@@ -3928,24 +3928,6 @@ void ice_vsi_ctx_clear_antispoof(struct ice_vsi_ctx *ctx) ICE_AQ_VSI_SEC_TX_PRUNE_ENA_S); } -/** -* ice_vsi_ctx_set_allow_override - allow destination override on VSI -* @ctx: pointer to VSI ctx structure -*/ -void ice_vsi_ctx_set_allow_override (struct ice_vsi_ctx *ctx) -{ - ctx->info.sec_flags |=ICE_AQ_VSI_SEC_FLAG_ALLOW_DEST_OVRD ; -} - -/** -* ice_vsi_ctx_clear_allow_override - turn off destination override on VSI -* @ctx: pointer to VSI ctx structure -*/ -void ice_vsi_ctx_clear_allow_override (struct ice_vsi_ctx *ctx) -{ - ctx->info.sec_flags &= ~ICE_AQ_VSI_SEC_FLAG_ALLOW_DEST_OVRD ; -} -/** * ice_vsi_update_local_lb - update sw block in VSI with local loopback bit * @vsi: pointer to VSI structure
drivers/net/ethernet/intel/ice/ice_lib.h +0 -4
@@ -106,10 +106,6 @@ ice_vsi_update_security(struct ice_vsi *vsi, void (*fill)(struct ice_vsi_ctx *))void ice_vsi_ctx_set_antispoof (struct ice_vsi_ctx *ctx);void ice_vsi_ctx_clear_antispoof (struct ice_vsi_ctx *ctx); - -void ice_vsi_ctx_set_allow_override (struct ice_vsi_ctx *ctx); - -void ice_vsi_ctx_clear_allow_override (struct ice_vsi_ctx *ctx);int ice_vsi_update_local_lb (struct ice_vsi *vsi,bool set);int ice_vsi_add_vlan_zero (struct ice_vsi *vsi);int ice_vsi_del_vlan_zero (struct ice_vsi *vsi);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 9/231 ice: fix memory leak in aRFS after reset
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Grzegorz Nitka <[email protected]>
[ Upstream commit 23d97f18901ef5e4e264e3b1777fe65c760186b5 ]
Fix aRFS (accelerated Receive Flow Steering) structures memory leak by adding a checker to verify if aRFS memory is already allocated while configuring VSI. aRFS objects are allocated in two cases:
- as part of VSI initialization (at probe), and
- as part of reset handling
However, VSI reconfiguration executed during reset involves memory allocation one more time, without prior releasing already allocated resources. This led to the memory leak with the following signature:
[root@os-delivery ~]# cat /sys/kernel/debug/kmemleak unreferenced object 0xff3c1ca7252e6000 (size 8192):
comm "kworker/0:0", pid 8, jiffies 4296833052 hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc 0):
[<ffffffff991ec485>] __kmalloc_cache_noprof+0x275/0x340
[<ffffffffc0a6e06a>] ice_init_arfs+0x3a/0xe0 [ice]
[<ffffffffc09f1027>] ice_vsi_cfg_def+0x607/0x850 [ice]
[<ffffffffc09f244b>] ice_vsi_setup+0x5b/0x130 [ice]
[<ffffffffc09c2131>] ice_init+0x1c1/0x460 [ice]
[<ffffffffc09c64af>] ice_probe+0x2af/0x520 [ice]
[<ffffffff994fbcd3>] local_pci_probe+0x43/0xa0
[<ffffffff98f07103>] work_for_cpu_fn+0x13/0x20
[<ffffffff98f0b6d9>] process_one_work+0x179/0x390
[<ffffffff98f0c1e9>] worker_thread+0x239/0x340
[<ffffffff98f14abc>] kthread+0xcc/0x100
[<ffffffff98e45a6d>] ret_from_fork+0x2d/0x50
[<ffffffff98e083ba>] ret_from_fork_asm+0x1a/0x30
...--- drivers/net/ethernet/intel/ice/ice_arfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/intel/ice/ice_arfs.c +1 -1
@@ -511,7 +511,7 @@ void ice_init_arfs(struct ice_vsi *vsi)struct hlist_head *arfs_fltr_list;unsigned int i; -if (!vsi || vsi->type !=ICE_VSI_PF ) +if (!vsi || vsi->type !=ICE_VSI_PF ||ice_is_arfs_active (vsi))return ; arfs_fltr_list = kcalloc(ICE_MAX_ARFS_LIST, sizeof(*arfs_fltr_list),
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 10/231 ice: Fix switchdev slow-path in LAG
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marcin Szycik <[email protected]>
[ Upstream commit dce97cb0a3e34204c0b99345418a714eac85953f ]
Ever since removing switchdev control VSI and using PF for port representor Tx/Rx, switchdev slow-path has been working improperly after failover in SR-IOV LAG. LAG assumes that the first uplink to be added to the aggregate will own VFs and have switchdev configured. After failing-over to the other uplink, representors are still configured to Tx through the uplink they are set up on, which fails because that uplink is now down.
On failover, update all PRs on primary uplink to use the currently active uplink for Tx. Call netif_keep_dst(), as the secondary uplink might not be in switchdev mode. Also make sure to call ice_eswitch_set_target_vsi() if uplink is in LAG.
On the Rx path, representors are already working properly, because default Tx from VFs is set to PF owning the eswitch. After failover the same PF is receiving traffic from VFs, even though link is down.
--- drivers/net/ethernet/intel/ice/ice_lag.c | 27 +++++++++++++++++++++++ drivers/net/ethernet/intel/ice/ice_txrx.c | 4 +++- 2 files changed, 30 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/ice/ice_lag.c +27 -0
@@ -1000,6 +1000,28 @@ static void ice_lag_link(struct ice_lag *lag)netdev_info (lag->netdev,"Shared SR-IOV resources in bond are active\n" ); } +/** +* ice_lag_config_eswitch - configure eswitch to work with LAG +* @lag: lag info struct +* @netdev: active network interface device struct +* +* Updates all port representors in eswitch to use @netdev for Tx. +* +* Configures the netdev to keep dst metadata (also used in representor Tx). +* This is required for an uplink without switchdev mode configured. +*/ +static void ice_lag_config_eswitch (struct ice_lag *lag, +struct net_device *netdev) +{ +struct ice_repr *repr; +unsigned long id; + +xa_for_each (&lag->pf->eswitch.reprs, id, repr) + repr->dst->u.port_info.lower_dev = netdev; + +netif_keep_dst (netdev); +} +/** * ice_lag_unlink - handle unlink event * @lag: LAG info struct
@@ -1021,6 +1043,9 @@ static void ice_lag_unlink(struct ice_lag *lag)ice_lag_move_vf_nodes (lag, act_port, pri_port); lag->primary = false; lag->active_port =ICE_LAG_INVALID_PORT ; + +/* Config primary's eswitch back to normal operation. */ +ice_lag_config_eswitch (lag, lag->netdev); }else {struct ice_lag *primary_lag;
@@ -1419,6 +1444,7 @@ static void ice_lag_monitor_active(struct ice_lag *lag, void *ptr)ice_lag_move_vf_nodes (lag, prim_port, event_port); lag->active_port = event_port; +ice_lag_config_eswitch (lag, event_netdev);return ; }
@@ -1428,6 +1454,7 @@ static void ice_lag_monitor_active(struct ice_lag *lag, void *ptr)/* new active port */ ice_lag_move_vf_nodes (lag, lag->active_port, event_port); lag->active_port = event_port; +ice_lag_config_eswitch (lag, event_netdev); }else {/* port not set as currently active (e.g. new active port * has already claimed the nodes and filters
drivers/net/ethernet/intel/ice/ice_txrx.c +3 -1
@@ -2424,7 +2424,9 @@ ice_xmit_frame_ring(struct sk_buff *skb, struct ice_tx_ring *tx_ring) ICE_TXD_CTX_QW1_CMD_S);ice_tstamp (tx_ring, skb, first, &offload); -if (ice_is_switchdev_running (vsi->back) && vsi->type !=ICE_VSI_SF ) +if ((ice_is_switchdev_running (vsi->back) || +ice_lag_is_switchdev_running (vsi->back)) && + vsi->type !=ICE_VSI_SF )ice_eswitch_set_target_vsi (skb, &offload);if (offload.cd_qw1 &ICE_TX_DESC_DTYPE_CTX ) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 11/231 netfilter: nf_conncount: garbage collection is not skipped when jiffies wrap around
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicklas Bo Jensen <[email protected]>
[ Upstream commit df08c94baafb001de6cf44bb7098bb557f36c335 ]
nf_conncount is supposed to skip garbage collection if it has already run garbage collection in the same jiffy. Unfortunately, this is broken when jiffies wrap around which this patch fixes.
The problem is that last_gc in the nf_conncount_list struct is an u32, but jiffies is an unsigned long which is 8 bytes on my systems. When those two are compared it only works until last_gc wraps around.
See bug report: https://bugzilla.netfilter.org/show_bug.cgi?id=1778
for more details.
--- net/netfilter/nf_conncount.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/netfilter/nf_conncount.c +2 -2
@@ -132,7 +132,7 @@ static int __nf_conncount_add(struct net *net,struct nf_conn *found_ct;unsigned int collect =0 ; -if (time_is_after_eq_jiffies ((unsigned long )list->last_gc)) +if ((u32 )jiffies == list->last_gc) goto add_new_node;/* check the saved connections */
@@ -234,7 +234,7 @@ bool nf_conncount_gc_list(struct net *net,bool ret = false;/* don't bother if we just did GC */ -if (time_is_after_eq_jiffies ((unsigned long )READ_ONCE (list->last_gc))) +if ((u32 )jiffies ==READ_ONCE (list->last_gc))return false;/* don't bother if other cpu is already doing GC */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 12/231 netfilter: nf_tables: make destruction work queue pernet
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit fb8286562ecfb585e26b033c5e32e6fb85efb0b3 ]
The call to flush_work before tearing down a table from the netlink notifier was supposed to make sure that all earlier updates (e.g. rule add) that might reference that table have been processed.
Unfortunately, flush_work() waits for the last queued instance. This could be an instance that is different from the one that we must wait for.
This is because transactions are protected with a pernet mutex, but the work item is global, so holding the transaction mutex doesn't prevent another netns from queueing more work.
Make the work item pernet so that flush_work() will wait for all transactions queued from this netns.
A welcome side effect is that we no longer need to wait for transaction objects from foreign netns.
The gc work queue is still global. This seems to be ok because nft_set structures are reference counted and each container structure owns a reference on the net namespace.
The destroy_list is still protected by a global spinlock rather than pernet one but the hold time is very short anyway.
v2: call cancel_work_sync before reaping the remaining tables (Pablo).
--- include/net/netfilter/nf_tables.h | 4 +++- net/netfilter/nf_tables_api.c | 24 ++++++++++++++---------- net/netfilter/nft_compat.c | 8 ++++---- 3 files changed, 21 insertions(+), 15 deletions(-)
include/net/netfilter/nf_tables.h +3 -1
@@ -1889,7 +1889,7 @@ void nft_chain_filter_fini(void);void __init nft_chain_route_init (void );void nft_chain_route_fini (void ); -void nf_tables_trans_destroy_flush_work (void ); +void nf_tables_trans_destroy_flush_work (struct net *net);int nf_msecs_to_jiffies64 (const struct nlattr *nla,u64 *result);__be64 nf_jiffies64_to_msecs (u64 input);
@@ -1903,6 +1903,7 @@ static inline int nft_request_module(struct net *net, const char *fmt, ...) { restruct nftables_pernet {struct list_head tables;struct list_head commit_list; +struct list_head destroy_list;struct list_head commit_set_list;struct list_head binding_list;struct list_head module_list;
@@ -1913,6 +1914,7 @@ struct nftables_pernet {unsigned int base_seq;unsigned int gc_seq;u8 validate_state; +struct work_struct destroy_work; };extern unsigned int nf_tables_net_id;
net/netfilter/nf_tables_api.c +14 -10
@@ -31,7 +31,6 @@ unsigned int nf_tables_net_id __read_mostly;static LIST_HEAD (nf_tables_expressions);static LIST_HEAD (nf_tables_objects);static LIST_HEAD (nf_tables_flowtables); -static LIST_HEAD (nf_tables_destroy_list);static LIST_HEAD (nf_tables_gc_list);static DEFINE_SPINLOCK (nf_tables_destroy_list_lock);static DEFINE_SPINLOCK (nf_tables_gc_list_lock);
@@ -122,7 +121,6 @@ static void nft_validate_state_update(struct nft_table *table, u8 new_validate_s table->validate_state = new_validate_state; }static void nf_tables_trans_destroy_work (struct work_struct *w); -static DECLARE_WORK(trans_destroy_work, nf_tables_trans_destroy_work);static void nft_trans_gc_work (struct work_struct *work); static DECLARE_WORK(trans_gc_work, nft_trans_gc_work);
@@ -9748,11 +9746,12 @@ static void nft_commit_release(struct nft_trans *trans)static void nf_tables_trans_destroy_work (struct work_struct *w) { + struct nftables_pernet *nft_net = container_of(w, struct nftables_pernet, destroy_work);struct nft_trans *trans, *next;LIST_HEAD (head);spin_lock (&nf_tables_destroy_list_lock); -list_splice_init (&nf_tables_destroy_list, &head); +list_splice_init (&nft_net->destroy_list, &head);spin_unlock (&nf_tables_destroy_list_lock);if (list_empty (&head))
@@ -9766,9 +9765,11 @@ static void nf_tables_trans_destroy_work(struct work_struct *w) } } -void nf_tables_trans_destroy_flush_work (void ) +void nf_tables_trans_destroy_flush_work (struct net *net) { -flush_work (&trans_destroy_work); +struct nftables_pernet *nft_net =nft_pernet (net); + +flush_work (&nft_net->destroy_work); }EXPORT_SYMBOL_GPL (nf_tables_trans_destroy_flush_work);
@@ -10226,11 +10227,11 @@ static void nf_tables_commit_release(struct net *net) trans->put_net = true;spin_lock (&nf_tables_destroy_list_lock); -list_splice_tail_init (&nft_net->commit_list, &nf_tables_destroy_list); +list_splice_tail_init (&nft_net->commit_list, &nft_net->destroy_list);spin_unlock (&nf_tables_destroy_list_lock);nf_tables_module_autoload_cleanup (net); -schedule_work (&trans_destroy_work); +schedule_work (&nft_net->destroy_work);mutex_unlock (&nft_net->commit_mutex); }
@@ -11653,7 +11654,7 @@ static int nft_rcv_nl_event(struct notifier_block *this, unsigned long event, gc_seq =nft_gc_seq_begin (nft_net); -nf_tables_trans_destroy_flush_work (); +nf_tables_trans_destroy_flush_work (net); again:list_for_each_entry (table, &nft_net->tables, list) { if (nft_table_has_owner(table) &&
@@ -11695,6 +11696,7 @@ static int __net_init nf_tables_init_net(struct net *net)INIT_LIST_HEAD (&nft_net->tables);INIT_LIST_HEAD (&nft_net->commit_list); +INIT_LIST_HEAD (&nft_net->destroy_list);INIT_LIST_HEAD (&nft_net->commit_set_list);INIT_LIST_HEAD (&nft_net->binding_list);INIT_LIST_HEAD (&nft_net->module_list);
@@ -11703,6 +11705,7 @@ static int __net_init nf_tables_init_net(struct net *net) nft_net->base_seq =1 ; nft_net->gc_seq =0 ; nft_net->validate_state =NFT_VALIDATE_SKIP ; +INIT_WORK (&nft_net->destroy_work, nf_tables_trans_destroy_work);return 0 ; }
@@ -11731,14 +11734,17 @@ static void __net_exit nf_tables_exit_net(struct net *net)if (!list_empty (&nft_net->module_list))nf_tables_module_autoload_cleanup (net); +cancel_work_sync (&nft_net->destroy_work);__nft_release_tables (net);nft_gc_seq_end (nft_net, gc_seq);mutex_unlock (&nft_net->commit_mutex); +WARN_ON_ONCE (!list_empty (&nft_net->tables));WARN_ON_ONCE (!list_empty (&nft_net->module_list));WARN_ON_ONCE (!list_empty (&nft_net->notify_list)); +WARN_ON_ONCE (!list_empty (&nft_net->destroy_list)); }static void nf_tables_exit_batch (struct list_head *net_exit_list)
@@ -11829,10 +11835,8 @@ static void __exit nf_tables_module_exit(void)unregister_netdevice_notifier (&nf_tables_flowtable_notifier);nft_chain_filter_fini ();nft_chain_route_fini (); -nf_tables_trans_destroy_flush_work ();unregister_pernet_subsys (&nf_tables_net_ops);cancel_work_sync (&trans_gc_work); -cancel_work_sync (&trans_destroy_work);rcu_barrier ();rhltable_destroy (&nft_objname_ht);nf_tables_core_module_exit ();
net/netfilter/nft_compat.c +4 -4
@@ -228,7 +228,7 @@ static int nft_parse_compat(const struct nlattr *attr, u16 *proto, bool *inv)return 0 ; } -static void nft_compat_wait_for_destructors (void ) +static void nft_compat_wait_for_destructors (struct net *net) {/* xtables matches or targets can have side effects, e.g. * creation/destruction of /proc files.
@@ -236,7 +236,7 @@ static void nft_compat_wait_for_destructors(void)* work queue. If we have pending invocations we thus * need to wait for those to finish. */ -nf_tables_trans_destroy_flush_work (); +nf_tables_trans_destroy_flush_work (net); } static int
@@ -262,7 +262,7 @@ nft_target_init(const struct nft_ctx *ctx, const struct nft_expr *expr,nft_target_set_tgchk_param (&par, ctx, target, info, &e, proto, inv); -nft_compat_wait_for_destructors (); +nft_compat_wait_for_destructors (ctx->net); ret =xt_check_target (&par, size, proto, inv);if (ret <0 ) {
@@ -515,7 +515,7 @@ __nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr,nft_match_set_mtchk_param (&par, ctx, match, info, &e, proto, inv); -nft_compat_wait_for_destructors (); +nft_compat_wait_for_destructors (ctx->net);return xt_check_match (&par, size, proto, inv); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 13/231 sched: address a potential NULL pointer dereference in the GRED scheduler.
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jun Yang <[email protected]>
[ Upstream commit 115ef44a98220fddfab37a39a19370497cd718b9 ]
If kzalloc in gred_init returns a NULL pointer, the code follows the error handling path, invoking gred_destroy. This, in turn, calls gred_offload, where memset could receive a NULL pointer as input, potentially leading to a kernel crash.
When table->opt is NULL in gred_init(), gred_change_table_def() is not called yet, so it is not necessary to call ->ndo_setup_tc() in gred_offload().
--- net/sched/sch_gred.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/sched/sch_gred.c +2 -1
@@ -913,7 +913,8 @@ static void gred_destroy(struct Qdisc *sch)for (i =0 ; i < table->DPs; i++)gred_destroy_vq (table->tab[i]); -gred_offload (sch,TC_GRED_DESTROY ); +if (table->opt) +gred_offload (sch,TC_GRED_DESTROY );kfree (table->opt); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 14/231 wifi: iwlwifi: mvm: fix PNVM timeout for non-MSI-X platforms
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
[ Upstream commit b8c8a03e9b7bfc06f366b75daf3d0812400e7123 ]
When MSI-X is not enabled, we mask all the interrupts in the interrupt handler and re-enable them when the interrupt thread runs. If STATUS_INT_ENABLED is not set, we won't re-enable in the thread. In order to get the ALIVE interrupt, we allow the ALIVE interrupt itself, and RX as well in order to receive the ALIVE notification (which is received as an RX from the firmware.
The problem is that STATUS_INT_ENABLED is clear until the op_mode calls trans_fw_alive which means that until trans_fw_alive is called, any notification from the firmware will not be received.
This became a problem when we inserted the pnvm_load exactly between the ALIVE and trans_fw_alive.
Fix that by calling trans_fw_alive before loading the PNVM. This will allow to get the notification from the firmware about PNVM load being complete and continue the flow normally.
This didn't happen on MSI-X because we don't disable the interrupts in the ISR when MSI-X is available.
The error in the log looks like this:
iwlwifi 0000:00:03.0: Timeout waiting for PNVM load!
iwlwifi 0000:00:03.0: Failed to start RT ucode: -110
iwlwifi 0000:00:03.0: WRT: Collecting data: ini trigger 13 fired (delay=0ms).
--- drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/wireless/intel/iwlwifi/mvm/fw.c +3 -3
@@ -1,6 +1,6 @@// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause /* -* Copyright (C) 2012-2014, 2018-2024 Intel Corporation +* Copyright (C) 2012-2014, 2018-2025 Intel Corporation * Copyright (C) 2013-2015 Intel Mobile Communications GmbH * Copyright (C) 2016-2017 Intel Deutschland GmbH */
@@ -422,6 +422,8 @@ static int iwl_mvm_load_ucode_wait_alive(struct iwl_mvm *mvm,/* if reached this point, Alive notification was received */ iwl_mei_alive_notif (true); +iwl_trans_fw_alive (mvm->trans, alive_data.scd_base_addr); + ret =iwl_pnvm_load (mvm->trans, &mvm->notif_wait, &mvm->fw->ucode_capa);if (ret) {
@@ -430,8 +432,6 @@ static int iwl_mvm_load_ucode_wait_alive(struct iwl_mvm *mvm,return ret; } -iwl_trans_fw_alive (mvm->trans, alive_data.scd_base_addr); -/* * Note: all the queues are enabled as part of the interface * initialization, but in firmware restart scenarios they
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 15/231 wifi: mac80211: dont queue sdata::work for a non-running sdata
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miri Korenblit <[email protected]>
[ Upstream commit 20d5a0b9cd0ccb32e886cf6baecf14936325bf10 ]
The worker really shouldn't be queued for a non-running interface. Also, if ieee80211_setup_sdata is called between queueing and executing the wk, it will be initialized, which will corrupt wiphy_work_list.
--- net/mac80211/util.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
net/mac80211/util.c +5 -3
@@ -6,7 +6,7 @@* Copyright 2007 Johannes Berg <[email protected]> * Copyright 2013-2014 Intel Mobile Communications GmbH * Copyright (C) 2015-2017 Intel Deutschland GmbH -* Copyright (C) 2018-2024 Intel Corporation +* Copyright (C) 2018-2025 Intel Corporation * * utilities for mac80211 */
@@ -2184,8 +2184,10 @@ int ieee80211_reconfig(struct ieee80211_local *local)ieee80211_reconfig_roc (local);/* Requeue all works */ -list_for_each_entry (sdata, &local->interfaces, list) -wiphy_work_queue (local->hw.wiphy, &sdata->work); +list_for_each_entry (sdata, &local->interfaces, list) { +if (ieee80211_sdata_running (sdata)) +wiphy_work_queue (local->hw.wiphy, &sdata->work); + } } ieee80211_wake_queues_by_reason(hw, IEEE80211_MAX_QUEUE_MAP,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 16/231 wifi: cfg80211: cancel wiphy_work before freeing wiphy
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miri Korenblit <[email protected]>
[ Upstream commit 72d520476a2fab6f3489e8388ab524985d6c4b90 ]
A wiphy_work can be queued from the moment the wiphy is allocated and initialized (i.e. wiphy_new_nm). When a wiphy_work is queued, the rdev::wiphy_work is getting queued.
If wiphy_free is called before the rdev::wiphy_work had a chance to run, the wiphy memory will be freed, and then when it eventally gets to run it'll use invalid memory.
Fix this by canceling the work before freeing the wiphy.
--- net/wireless/core.c | 7 +++++++ 1 file changed, 7 insertions(+)
net/wireless/core.c +7 -0
@@ -1198,6 +1198,13 @@ void cfg80211_dev_free(struct cfg80211_registered_device *rdev) {struct cfg80211_internal_bss *scan, *tmp;struct cfg80211_beacon_registration *reg, *treg; +unsigned long flags; + +spin_lock_irqsave (&rdev->wiphy_work_lock, flags); +WARN_ON (!list_empty (&rdev->wiphy_work_list)); +spin_unlock_irqrestore (&rdev->wiphy_work_lock, flags); +cancel_work_sync (&rdev->wiphy_work); +rfkill_destroy (rdev->wiphy.rfkill);list_for_each_entry_safe (reg, treg, &rdev->beacon_registrations, list) {list_del (®->list);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 17/231 Bluetooth: hci_event: Fix enabling passive scanning
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 0bdd88971519cfa8a76d1a4dde182e74cfbd5d5c ]
Passive scanning shall only be enabled when disconnecting LE links, otherwise it may start result in triggering scanning when e.g. an ISO link disconnects:
Quoted 1 line
HCI Event: LE Meta Event (
0x3e) plen 29
LE Connected Isochronous Stream Established (0x19)
Status: Success (0x00)
Connection Handle: 257
CIG Synchronization Delay: 0 us (0x000000)
CIS Synchronization Delay: 0 us (0x000000)
Central to Peripheral Latency: 10000 us (0x002710)
Peripheral to Central Latency: 10000 us (0x002710)
Central to Peripheral PHY: LE 2M (0x02)
Peripheral to Central PHY: LE 2M (0x02)
Number of Subevents: 1
Central to Peripheral Burst Number: 1
Peripheral to Central Burst Number: 1
Central to Peripheral Flush Timeout: 2
Peripheral to Central Flush Timeout: 2
Central to Peripheral MTU: 320
Peripheral to Central MTU: 160
ISO Interval: 10.00 msec (0x0008)...
Quoted 1 line
HCI Event: Disconnect Complete (
0x05) plen 4
Status: Success (0x00)
Handle: 257
Reason: Remote User Terminated Connection (0x13)
< HCI Command: LE Set Extended Scan Enable (0x08|0x0042) plen 6
Extended scan: Enabled (0x01)
Filter duplicates: Enabled (0x01)
Duration: 0 msec (0x0000)
Period: 0.00 sec (0x0000)--- net/bluetooth/hci_event.c | 37 ++++++++++++++++++++++--------------- 1 file changed, 22 insertions(+), 15 deletions(-)
net/bluetooth/hci_event.c +22 -15
@@ -3393,23 +3393,30 @@ static void hci_disconn_complete_evt(struct hci_dev *hdev, void *data,hci_update_scan (hdev); } - params =hci_conn_params_lookup (hdev, &conn->dst, conn->dst_type); -if (params) { -switch (params->auto_connect) { -case HCI_AUTO_CONN_LINK_LOSS : -if (ev->reason !=HCI_ERROR_CONNECTION_TIMEOUT ) +/* Re-enable passive scanning if disconnected device is marked +* as auto-connectable. +*/ +if (conn->type ==LE_LINK ) { + params =hci_conn_params_lookup (hdev, &conn->dst, + conn->dst_type); +if (params) { +switch (params->auto_connect) { +case HCI_AUTO_CONN_LINK_LOSS : +if (ev->reason !=HCI_ERROR_CONNECTION_TIMEOUT ) +break ; + fallthrough; + +case HCI_AUTO_CONN_DIRECT : +case HCI_AUTO_CONN_ALWAYS : +hci_pend_le_list_del_init (params); +hci_pend_le_list_add (params, + &hdev->pend_le_conns); +hci_update_passive_scan (hdev);break ; - fallthrough; -case HCI_AUTO_CONN_DIRECT : -case HCI_AUTO_CONN_ALWAYS : -hci_pend_le_list_del_init (params); -hci_pend_le_list_add (params, &hdev->pend_le_conns); -hci_update_passive_scan (hdev); -break ; - -default : -break ; +default : +break ; + } } }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 18/231 Revert "Bluetooth: hci_core: Fix sleeping function called from invalid context"
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit ab6ab707a4d060a51c45fc13e3b2228d5f7c0b87 ]
This reverts commit 4d94f05558271654670d18c26c912da0c1c15549 which has problems (see [1]) and is no longer needed since 581dd2dc168f ("Bluetooth: hci_event: Fix using rcu_read_(un)lock while iterating") has reworked the code where the original bug has been found.
[1] Link: https://lore.kernel.org/linux-bluetooth/[email protected]/T/#t
--- include/net/bluetooth/hci_core.h | 108 +++++++++++-------------------- net/bluetooth/hci_core.c | 10 ++- net/bluetooth/iso.c | 6 -- net/bluetooth/l2cap_core.c | 12 ++-- net/bluetooth/rfcomm/core.c | 6 -- net/bluetooth/sco.c | 12 ++-- 6 files changed, 57 insertions(+), 97 deletions(-)
include/net/bluetooth/hci_core.h +38 -70
@@ -804,6 +804,7 @@ struct hci_conn_params {extern struct list_head hci_dev_list;extern struct list_head hci_cb_list;extern rwlock_t hci_dev_list_lock; +extern struct mutex hci_cb_list_lock;#define hci_dev_set_flag (hdev, nr) set_bit((nr), (hdev)->dev_flags)#define hci_dev_clear_flag (hdev, nr) clear_bit((nr), (hdev)->dev_flags)
@@ -2006,47 +2007,24 @@ struct hci_cb {char *name; -bool (*match) (struct hci_conn *conn);void (*connect_cfm) (struct hci_conn *conn,__u8 status);void (*disconn_cfm) (struct hci_conn *conn,__u8 status);void (*security_cfm) (struct hci_conn *conn,__u8 status, -__u8 encrypt); +__u8 encrypt);void (*key_change_cfm) (struct hci_conn *conn,__u8 status);void (*role_switch_cfm) (struct hci_conn *conn,__u8 status,__u8 role); }; -static inline void hci_cb_lookup (struct hci_conn *conn,struct list_head *list) -{ -struct hci_cb *cb, *cpy; - -rcu_read_lock (); -list_for_each_entry_rcu (cb, &hci_cb_list, list) { -if (cb->match && cb->match (conn)) { - cpy =kmalloc (sizeof (*cpy),GFP_ATOMIC ); -if (!cpy) -break ; - - *cpy = *cb; -INIT_LIST_HEAD (&cpy->list); -list_add_rcu (&cpy->list, list); - } - } -rcu_read_unlock (); -} -static inline void hci_connect_cfm (struct hci_conn *conn,__u8 status) { -struct list_head list; -struct hci_cb *cb, *tmp; - -INIT_LIST_HEAD (&list); -hci_cb_lookup (conn, &list); +struct hci_cb *cb; -list_for_each_entry_safe (cb, tmp, &list, list) { +mutex_lock (&hci_cb_list_lock); +list_for_each_entry (cb, &hci_cb_list, list) {if (cb->connect_cfm) cb->connect_cfm (conn, status); -kfree (cb); } +mutex_unlock (&hci_cb_list_lock);if (conn->connect_cfm_cb) conn->connect_cfm_cb (conn, status);
@@ -2054,43 +2032,22 @@ static inline void hci_connect_cfm(struct hci_conn *conn, __u8 status)static inline void hci_disconn_cfm (struct hci_conn *conn,__u8 reason) { -struct list_head list; -struct hci_cb *cb, *tmp; - -INIT_LIST_HEAD (&list); -hci_cb_lookup (conn, &list); +struct hci_cb *cb; -list_for_each_entry_safe (cb, tmp, &list, list) { +mutex_lock (&hci_cb_list_lock); +list_for_each_entry (cb, &hci_cb_list, list) {if (cb->disconn_cfm) cb->disconn_cfm (conn, reason); -kfree (cb); } +mutex_unlock (&hci_cb_list_lock);if (conn->disconn_cfm_cb) conn->disconn_cfm_cb (conn, reason); } -static inline void hci_security_cfm (struct hci_conn *conn,__u8 status, -__u8 encrypt) -{ -struct list_head list; -struct hci_cb *cb, *tmp; - -INIT_LIST_HEAD (&list); -hci_cb_lookup (conn, &list); - -list_for_each_entry_safe (cb, tmp, &list, list) { -if (cb->security_cfm) - cb->security_cfm (conn, status, encrypt); -kfree (cb); - } - -if (conn->security_cfm_cb) - conn->security_cfm_cb (conn, status); -} -static inline void hci_auth_cfm (struct hci_conn *conn,__u8 status) { +struct hci_cb *cb;__u8 encrypt;if (test_bit (HCI_CONN_ENCRYPT_PEND , &conn->flags))
@@ -2098,11 +2055,20 @@ static inline void hci_auth_cfm(struct hci_conn *conn, __u8 status) encrypt =test_bit (HCI_CONN_ENCRYPT , &conn->flags) ?0x01 :0x00 ; -hci_security_cfm (conn, status, encrypt); +mutex_lock (&hci_cb_list_lock); +list_for_each_entry (cb, &hci_cb_list, list) { +if (cb->security_cfm) + cb->security_cfm (conn, status, encrypt); + } +mutex_unlock (&hci_cb_list_lock); + +if (conn->security_cfm_cb) + conn->security_cfm_cb (conn, status); }static inline void hci_encrypt_cfm (struct hci_conn *conn,__u8 status) { +struct hci_cb *cb;__u8 encrypt;if (conn->state ==BT_CONFIG ) {
@@ -2129,38 +2095,40 @@ static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status) conn->sec_level = conn->pending_sec_level; } -hci_security_cfm (conn, status, encrypt); +mutex_lock (&hci_cb_list_lock); +list_for_each_entry (cb, &hci_cb_list, list) { +if (cb->security_cfm) + cb->security_cfm (conn, status, encrypt); + } +mutex_unlock (&hci_cb_list_lock); + +if (conn->security_cfm_cb) + conn->security_cfm_cb (conn, status); }static inline void hci_key_change_cfm (struct hci_conn *conn,__u8 status) { -struct list_head list; -struct hci_cb *cb, *tmp; - -INIT_LIST_HEAD (&list); -hci_cb_lookup (conn, &list); +struct hci_cb *cb; -list_for_each_entry_safe (cb, tmp, &list, list) { +mutex_lock (&hci_cb_list_lock); +list_for_each_entry (cb, &hci_cb_list, list) {if (cb->key_change_cfm) cb->key_change_cfm (conn, status); -kfree (cb); } +mutex_unlock (&hci_cb_list_lock); }static inline void hci_role_switch_cfm (struct hci_conn *conn,__u8 status,__u8 role) { -struct list_head list; -struct hci_cb *cb, *tmp; - -INIT_LIST_HEAD (&list); -hci_cb_lookup (conn, &list); +struct hci_cb *cb; -list_for_each_entry_safe (cb, tmp, &list, list) { +mutex_lock (&hci_cb_list_lock); +list_for_each_entry (cb, &hci_cb_list, list) {if (cb->role_switch_cfm) cb->role_switch_cfm (conn, status, role); -kfree (cb); } +mutex_unlock (&hci_cb_list_lock); }static inline bool hci_bdaddr_is_rpa (bdaddr_t *bdaddr,u8 addr_type)
net/bluetooth/hci_core.c +7 -3
@@ -57,6 +57,7 @@ DEFINE_RWLOCK(hci_dev_list_lock);/* HCI callback list */ LIST_HEAD (hci_cb_list); +DEFINE_MUTEX (hci_cb_list_lock);/* HCI ID Numbering */ static DEFINE_IDA (hci_index_ida);
@@ -2992,7 +2993,9 @@ int hci_register_cb(struct hci_cb *cb) {BT_DBG ("%p name %s" , cb, cb->name); -list_add_tail_rcu (&cb->list, &hci_cb_list); +mutex_lock (&hci_cb_list_lock); +list_add_tail (&cb->list, &hci_cb_list); +mutex_unlock (&hci_cb_list_lock);return 0 ; }
@@ -3002,8 +3005,9 @@ int hci_unregister_cb(struct hci_cb *cb) {BT_DBG ("%p name %s" , cb, cb->name); -list_del_rcu (&cb->list); -synchronize_rcu (); +mutex_lock (&hci_cb_list_lock); +list_del (&cb->list); +mutex_unlock (&hci_cb_list_lock);return 0 ; }
net/bluetooth/iso.c +0 -6
@@ -2137,11 +2137,6 @@ int iso_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags)return HCI_LM_ACCEPT ; } -static bool iso_match (struct hci_conn *hcon) -{ -return hcon->type ==ISO_LINK || hcon->type ==LE_LINK ; -} -static void iso_connect_cfm (struct hci_conn *hcon,__u8 status) {if (hcon->type !=ISO_LINK ) {
@@ -2323,7 +2318,6 @@ void iso_recv(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)static struct hci_cb iso_cb = { .name ="ISO" , - .match = iso_match, .connect_cfm = iso_connect_cfm, .disconn_cfm = iso_disconn_cfm, };
net/bluetooth/l2cap_core.c +6 -6
@@ -7222,11 +7222,6 @@ static struct l2cap_chan *l2cap_global_fixed_chan(struct l2cap_chan *c,return NULL ; } -static bool l2cap_match (struct hci_conn *hcon) -{ -return hcon->type ==ACL_LINK || hcon->type ==LE_LINK ; -} -static void l2cap_connect_cfm (struct hci_conn *hcon,u8 status) {struct hci_dev *hdev = hcon->hdev;
@@ -7234,6 +7229,9 @@ static void l2cap_connect_cfm(struct hci_conn *hcon, u8 status)struct l2cap_chan *pchan;u8 dst_type; +if (hcon->type !=ACL_LINK && hcon->type !=LE_LINK ) +return ; +BT_DBG ("hcon %p bdaddr %pMR status %d" , hcon, &hcon->dst, status);if (status) {
@@ -7298,6 +7296,9 @@ int l2cap_disconn_ind(struct hci_conn *hcon)static void l2cap_disconn_cfm (struct hci_conn *hcon,u8 reason) { +if (hcon->type !=ACL_LINK && hcon->type !=LE_LINK ) +return ; +BT_DBG ("hcon %p reason %d" , hcon, reason);l2cap_conn_del (hcon,bt_to_errno (reason));
@@ -7576,7 +7577,6 @@ void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)static struct hci_cb l2cap_cb = { .name ="L2CAP" , - .match = l2cap_match, .connect_cfm = l2cap_connect_cfm, .disconn_cfm = l2cap_disconn_cfm, .security_cfm = l2cap_security_cfm,
net/bluetooth/rfcomm/core.c +0 -6
@@ -2134,11 +2134,6 @@ static int rfcomm_run(void *unused)return 0 ; } -static bool rfcomm_match (struct hci_conn *hcon) -{ -return hcon->type ==ACL_LINK ; -} -static void rfcomm_security_cfm (struct hci_conn *conn,u8 status,u8 encrypt) {struct rfcomm_session *s;
@@ -2185,7 +2180,6 @@ static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt)static struct hci_cb rfcomm_cb = { .name ="RFCOMM" , - .match = rfcomm_match, .security_cfm = rfcomm_security_cfm };
net/bluetooth/sco.c +6 -6
@@ -1355,13 +1355,11 @@ int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags)return lm; } -static bool sco_match (struct hci_conn *hcon) -{ -return hcon->type ==SCO_LINK || hcon->type ==ESCO_LINK ; -} -static void sco_connect_cfm (struct hci_conn *hcon,__u8 status) { +if (hcon->type !=SCO_LINK && hcon->type !=ESCO_LINK ) +return ; +BT_DBG ("hcon %p bdaddr %pMR status %u" , hcon, &hcon->dst, status);if (!status) {
@@ -1376,6 +1374,9 @@ static void sco_connect_cfm(struct hci_conn *hcon, __u8 status)static void sco_disconn_cfm (struct hci_conn *hcon,__u8 reason) { +if (hcon->type !=SCO_LINK && hcon->type !=ESCO_LINK ) +return ; +BT_DBG ("hcon %p reason %d" , hcon, reason);sco_conn_del (hcon,bt_to_errno (reason));
@@ -1401,7 +1402,6 @@ void sco_recv_scodata(struct hci_conn *hcon, struct sk_buff *skb)static struct hci_cb sco_cb = { .name ="SCO" , - .match = sco_match, .connect_cfm = sco_connect_cfm, .disconn_cfm = sco_disconn_cfm, };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 19/231 net/mlx5: Fill out devlink dev info only for PFs
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Pirko <[email protected]>
[ Upstream commit d749d901b2168389f060b654fdaa08acf6b367d2 ]
Firmware version query is supported on the PFs. Due to this following kernel warning log is observed:
[ 188.590344] mlx5_core 0000:08:00.2: mlx5_fw_version_query:816:(pid 1453): fw query isn't supported by the FW
Fix it by restricting the query and devlink info to the PF.
--- drivers/net/ethernet/mellanox/mlx5/core/devlink.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/devlink.c +3 -0
@@ -46,6 +46,9 @@ mlx5_devlink_info_get(struct devlink *devlink, struct devlink_info_req *req,u32 running_fw, stored_fw;int err; +if (!mlx5_core_is_pf (dev)) +return 0 ; + err =devlink_info_version_fixed_put (req,"fw.psid" , dev->board_id);if (err)return err;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 20/231 net: dsa: mv88e6xxx: Verify after ATU Load ops
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joseph Huang <[email protected]>
[ Upstream commit dc5340c3133a3ebe54853fd299116149e528cfaa ]
ATU Load operations could fail silently if there's not enough space on the device to hold the new entry. When this happens, the symptom depends on the unknown flood settings. If unknown multicast flood is disabled, the multicast packets are dropped when the ATU table is full. If unknown multicast flood is enabled, the multicast packets will be flooded to all ports. Either way, IGMP snooping is broken when the ATU Load operation fails silently.
Do a Read-After-Write verification after each fdb/mdb add operation to make sure that the operation was really successful, and return -ENOSPC otherwise.
--- drivers/net/dsa/mv88e6xxx/chip.c | 59 ++++++++++++++++++++++++++------ 1 file changed, 48 insertions(+), 11 deletions(-)
drivers/net/dsa/mv88e6xxx/chip.c +48 -11
@@ -2261,13 +2261,11 @@ mv88e6xxx_port_vlan_prepare(struct dsa_switch *ds, int port,return err; } -static int mv88e6xxx_port_db_load_purge (struct mv88e6xxx_chip *chip,int port, -const unsigned char *addr,u16 vid, -u8 state) +static int mv88e6xxx_port_db_get (struct mv88e6xxx_chip *chip, +const unsigned char *addr,u16 vid, +u16 *fid,struct mv88e6xxx_atu_entry *entry) { -struct mv88e6xxx_atu_entry entry;struct mv88e6xxx_vtu_entry vlan; -u16 fid;int err;/* Ports have two private address databases: one for when the port is
@@ -2278,7 +2276,7 @@ static int mv88e6xxx_port_db_load_purge(struct mv88e6xxx_chip *chip, int port,* VLAN ID into the port's database used for VLAN-unaware bridging. */ if (vid ==0 ) { - fid =MV88E6XXX_FID_BRIDGED ; + *fid =MV88E6XXX_FID_BRIDGED ; }else { err =mv88e6xxx_vtu_get (chip, vid, &vlan);if (err)
@@ -2288,14 +2286,39 @@ static int mv88e6xxx_port_db_load_purge(struct mv88e6xxx_chip *chip, int port,if (!vlan.valid)return -EOPNOTSUPP ; - fid = vlan.fid; + *fid = vlan.fid; } - entry.state =0 ; -ether_addr_copy (entry.mac, addr); -eth_addr_dec (entry.mac); + entry->state =0 ; +ether_addr_copy (entry->mac, addr); +eth_addr_dec (entry->mac); + +return mv88e6xxx_g1_atu_getnext (chip, *fid, entry); +} + +static bool mv88e6xxx_port_db_find (struct mv88e6xxx_chip *chip, +const unsigned char *addr,u16 vid) +{ +struct mv88e6xxx_atu_entry entry; +u16 fid; +int err; - err =mv88e6xxx_g1_atu_getnext (chip, fid, &entry); + err =mv88e6xxx_port_db_get (chip, addr, vid, &fid, &entry); +if (err) +return false; + +return entry.state &ðer_addr_equal (entry.mac, addr); +} + +static int mv88e6xxx_port_db_load_purge (struct mv88e6xxx_chip *chip,int port, +const unsigned char *addr,u16 vid, +u8 state) +{ +struct mv88e6xxx_atu_entry entry; +u16 fid; +int err; + + err =mv88e6xxx_port_db_get (chip, addr, vid, &fid, &entry);if (err)return err;
@@ -2893,6 +2916,13 @@ static int mv88e6xxx_port_fdb_add(struct dsa_switch *ds, int port,mv88e6xxx_reg_lock (chip); err =mv88e6xxx_port_db_load_purge (chip, port, addr, vid,MV88E6XXX_G1_ATU_DATA_STATE_UC_STATIC ); +if (err) + goto out; + +if (!mv88e6xxx_port_db_find (chip, addr, vid)) + err = -ENOSPC ; + +out:mv88e6xxx_reg_unlock (chip);return err;
@@ -6593,6 +6623,13 @@ static int mv88e6xxx_port_mdb_add(struct dsa_switch *ds, int port,mv88e6xxx_reg_lock (chip); err =mv88e6xxx_port_db_load_purge (chip, port, mdb->addr, mdb->vid,MV88E6XXX_G1_ATU_DATA_STATE_MC_STATIC ); +if (err) + goto out; + +if (!mv88e6xxx_port_db_find (chip, mdb->addr, mdb->vid)) + err = -ENOSPC ; + +out:mv88e6xxx_reg_unlock (chip);return err;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 21/231 net: mctp i3c: Copy headers if cloned
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Johnston <[email protected]>
[ Upstream commit 26db9c9ee19c36a97dbb1cfef007a3c189c4c874 ]
Use skb_cow_head() prior to modifying the tx skb. This is necessary when the skb has been cloned, to avoid modifying other shared clones.
--- drivers/net/mctp/mctp-i3c.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/mctp/mctp-i3c.c +5 -0
@@ -506,10 +506,15 @@ static int mctp_i3c_header_create(struct sk_buff *skb, struct net_device *dev, const void *saddr, unsigned int len) {struct mctp_i3c_internal_hdr *ihdr; +int rc;if (!daddr || !saddr)return -EINVAL ; + rc =skb_cow_head (skb,sizeof (struct mctp_i3c_internal_hdr )); +if (rc) +return rc; +skb_push (skb,sizeof (struct mctp_i3c_internal_hdr ));skb_reset_mac_header (skb); ihdr = (void *)skb_mac_header (skb);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 22/231 net: mctp i2c: Copy headers if cloned
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Johnston <[email protected]>
[ Upstream commit df8ce77ba8b7c012a3edd1ca7368b46831341466 ]
Use skb_cow_head() prior to modifying the TX SKB. This is necessary when the SKB has been cloned, to avoid modifying other shared clones.
--- drivers/net/mctp/mctp-i2c.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/mctp/mctp-i2c.c +5 -0
@@ -584,6 +584,7 @@ static int mctp_i2c_header_create(struct sk_buff *skb, struct net_device *dev,struct mctp_i2c_hdr *hdr;struct mctp_hdr *mhdr;u8 lldst, llsrc; +int rc;if (len >MCTP_I2C_MAXMTU )return -EMSGSIZE ;
@@ -594,6 +595,10 @@ static int mctp_i2c_header_create(struct sk_buff *skb, struct net_device *dev, lldst = *((u8 *)daddr); llsrc = *((u8 *)saddr); + rc =skb_cow_head (skb,sizeof (struct mctp_i2c_hdr )); +if (rc) +return rc; +skb_push (skb,sizeof (struct mctp_i2c_hdr ));skb_reset_mac_header (skb); hdr = (void *)skb_mac_header (skb);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 23/231 netpoll: hold rcu read lock in __netpoll_send_skb()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <[email protected]>
[ Upstream commit 505ead7ab77f289f12d8a68ac83da068e4d4408b ]
The function __netpoll_send_skb() is being invoked without holding the RCU read lock. This oversight triggers a warning message when CONFIG_PROVE_RCU_LIST is enabled:
net/core/netpoll.c:330 suspicious rcu_dereference_check() usage!
netpoll_send_skb
netpoll_send_udp
write_ext_msg
console_flush_all
console_unlock
vprintk_emit
To prevent npinfo from disappearing unexpectedly, ensure that __netpoll_send_skb() is protected with the RCU read lock.
--- net/core/netpoll.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
net/core/netpoll.c +7 -2
@@ -319,6 +319,7 @@ static int netpoll_owner_active(struct net_device *dev)static netdev_tx_t __netpoll_send_skb (struct netpoll *np,struct sk_buff *skb) {netdev_tx_t status =NETDEV_TX_BUSY ; +netdev_tx_t ret =NET_XMIT_DROP ;struct net_device *dev;unsigned long tries;/* It is up to the caller to keep npinfo alive. */
@@ -327,11 +328,12 @@ static netdev_tx_t __netpoll_send_skb(struct netpoll *np, struct sk_buff *skb)lockdep_assert_irqs_disabled (); dev = np->dev; +rcu_read_lock (); npinfo =rcu_dereference_bh (dev->npinfo);if (!npinfo || !netif_running (dev) || !netif_device_present (dev)) {dev_kfree_skb_irq (skb); -return NET_XMIT_DROP ; + goto out; }/* don't get messages out of order, and no recursion */
@@ -370,7 +372,10 @@ static netdev_tx_t __netpoll_send_skb(struct netpoll *np, struct sk_buff *skb)skb_queue_tail (&npinfo->txq, skb);schedule_delayed_work (&npinfo->tx_work,0 ); } -return NETDEV_TX_OK ; + ret =NETDEV_TX_OK ; +out: +rcu_read_unlock (); +return ret; }netdev_tx_t netpoll_send_skb (struct netpoll *np,struct sk_buff *skb)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 24/231 drm/hyperv: Fix address space leak when Hyper-V DRM device is removed
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Kelley <[email protected]>
[ Upstream commit aed709355fd05ef747e1af24a1d5d78cd7feb81e ]
When a Hyper-V DRM device is probed, the driver allocates MMIO space for the vram, and maps it cacheable. If the device removed, or in the error path for device probing, the MMIO space is released but no unmap is done. Consequently the kernel address space for the mapping is leaked.
Fix this by adding iounmap() calls in the device removal path, and in the error path during device probing.
Message-ID: <[email protected]>
--- drivers/gpu/drm/hyperv/hyperv_drm_drv.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/hyperv/hyperv_drm_drv.c +2 -0
@@ -154,6 +154,7 @@ static int hyperv_vmbus_probe(struct hv_device *hdev,return 0 ; err_free_mmio: +iounmap (hv->vram);vmbus_free_mmio (hv->mem->start, hv->fb_size); err_vmbus_close:vmbus_close (hdev->channel);
@@ -172,6 +173,7 @@ static void hyperv_vmbus_remove(struct hv_device *hdev)vmbus_close (hdev->channel);hv_set_drvdata (hdev,NULL ); +iounmap (hv->vram);vmbus_free_mmio (hv->mem->start, hv->fb_size); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 25/231 fbdev: hyperv_fb: Fix hang in kdump kernel when on Hyper-V Gen 2 VMs
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Kelley <[email protected]>
[ Upstream commit 304386373007aaca9236a3f36afac0bbedcd2bf0 ]
Gen 2 Hyper-V VMs boot via EFI and have a standard EFI framebuffer device. When the kdump kernel runs in such a VM, loading the efifb driver may hang because of accessing the framebuffer at the wrong memory address.
The scenario occurs when the hyperv_fb driver in the original kernel moves the framebuffer to a different MMIO address because of conflicts with an already-running efifb or simplefb driver. The hyperv_fb driver then informs Hyper-V of the change, which is allowed by the Hyper-V FB VMBus device protocol. However, when the kexec command loads the kdump kernel into crash memory via the kexec_file_load() system call, the system call doesn't know the framebuffer has moved, and it sets up the kdump screen_info using the original framebuffer address. The transition to the kdump kernel does not go through the Hyper-V host, so Hyper-V does not reset the framebuffer address like it would do on a reboot. When efifb tries to run, it accesses a non-existent framebuffer address, which traps to the Hyper-V host. After many such accesses, the Hyper-V host thinks the guest is being malicious, and throttles the guest to the point that it runs very slowly or appears to have hung.
When the kdump kernel is loaded into crash memory via the kexec_load() system call, the problem does not occur. In this case, the kexec command builds the screen_info table itself in user space from data returned by the FBIOGET_FSCREENINFO ioctl against /dev/fb0, which gives it the new framebuffer location.
This problem was originally reported in 2020 [1], resulting in commit 3cb73bc3fa2a ("hyperv_fb: Update screen_info after removing old framebuffer"). This commit solved the problem by setting orig_video_isVGA to 0, so the kdump kernel was unaware of the EFI framebuffer. The efifb driver did not try to load, and no hang occurred. But in 2024, commit c25a19afb81c ("fbdev/hyperv_fb: Do not clear global screen_info") effectively reverted 3cb73bc3fa2a. Commit c25a19afb81c has no reference to 3cb73bc3fa2a, so perhaps it was done without knowing the implications that were reported with 3cb73bc3fa2a. In any case, as of commit c25a19afb81c, the original problem came back again.
Interestingly, the hyperv_drm driver does not have this problem because it never moves the framebuffer. The difference is that the hyperv_drm driver removes any conflicting framebuffers *before* allocating an MMIO address, while the hyperv_fb drivers removes conflicting framebuffers *after* allocating an MMIO address. With the "after" ordering, hyperv_fb may encounter a conflict and move the framebuffer to a different MMIO address. But the conflict is essentially bogus because it is removed a few lines of code later.
Rather than fix the problem with the approach from 2020 in commit 3cb73bc3fa2a, instead slightly reorder the steps in hyperv_fb so conflicting framebuffers are removed before allocating an MMIO address. Then the default framebuffer MMIO address should always be available, and there's never any confusion about which framebuffer address the kdump kernel should use -- it's always the original address provided by the Hyper-V host. This approach is already used by the hyperv_drm driver, and is consistent with the usage guidelines at the head of the module with the function aperture_remove_conflicting_devices().
This approach also solves a related minor problem when kexec_load() is used to load the kdump kernel. With current code, unbinding and rebinding the hyperv_fb driver could result in the framebuffer moving back to the default framebuffer address, because on the rebind there are no conflicts. If such a move is done after the kdump kernel is loaded with the new framebuffer address, at kdump time it could again have the wrong address.
This problem and fix are described in terms of the kdump kernel, but it can also occur with any kernel started via kexec.
See extensive discussion of the problem and solution at [2].
[1] https://lore.kernel.org/linux-hyperv/[email protected]/
[2] https://lore.kernel.org/linux-hyperv/BLAPR10MB521793485093FDB448F7B2E5FDE92@BLAPR10MB5217.namprd10.prod.outlook.com/
Message-ID: <[email protected]>
--- drivers/video/fbdev/hyperv_fb.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-)
drivers/video/fbdev/hyperv_fb.c +13 -7
@@ -989,6 +989,7 @@ static int hvfb_getmem(struct hv_device *hdev, struct fb_info *info) base =pci_resource_start (pdev,0 ); size =pci_resource_len (pdev,0 ); +aperture_remove_conflicting_devices (base, size,KBUILD_MODNAME );/* * For Gen 1 VM, we can directly use the contiguous memory
@@ -1010,11 +1011,21 @@ static int hvfb_getmem(struct hv_device *hdev, struct fb_info *info) goto getmem_done; }pr_info ("Unable to allocate enough contiguous physical memory on Gen 1 VM. Using MMIO instead.\n" ); + }else { +aperture_remove_all_conflicting_devices (KBUILD_MODNAME ); }/* -* Cannot use the contiguous physical memory. -* Allocate mmio space for framebuffer. +* Cannot use contiguous physical memory, so allocate MMIO space for +* the framebuffer. At this point in the function, conflicting devices +* that might have claimed the framebuffer MMIO space based on +* screen_info.lfb_base must have already been removed so that +* vmbus_allocate_mmio() does not allocate different MMIO space. If the +* kdump image were to be loaded using kexec_file_load(), the +* framebuffer location in the kdump image would be set from +* screen_info.lfb_base at the time that kdump is enabled. If the +* framebuffer has moved elsewhere, this could be the wrong location, +* causing kdump to hang when efifb (for example) loads. */ dio_fb_size = screen_width * screen_height * screen_depth /8 ;
@@ -1051,11 +1062,6 @@ static int hvfb_getmem(struct hv_device *hdev, struct fb_info *info) info->screen_size = dio_fb_size; getmem_done: -if (base && size) -aperture_remove_conflicting_devices (base, size,KBUILD_MODNAME ); -else -aperture_remove_all_conflicting_devices (KBUILD_MODNAME ); -if (!gen2vm)pci_dev_put (pdev);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 26/231 fbdev: hyperv_fb: Simplify hvfb_putmem
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saurabh Sengar <[email protected]>
[ Upstream commit f5e728a50bb17336a20803dde488515b833ecd1d ]
The device object required in 'hvfb_release_phymem' function for 'dma_free_coherent' can also be obtained from the 'info' pointer, making 'hdev' parameter in 'hvfb_putmem' redundant. Remove the unnecessary 'hdev' argument from 'hvfb_putmem'.
Message-ID: <[email protected]>
Stable-dep-of: ea2f45ab0e53 ("fbdev: hyperv_fb: Allow graceful removal of framebuffer")
--- drivers/video/fbdev/hyperv_fb.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/video/fbdev/hyperv_fb.c +6 -6
@@ -952,7 +952,7 @@ static phys_addr_t hvfb_get_phymem(struct hv_device *hdev, }/* Release contiguous physical memory */ -static void hvfb_release_phymem (struct hv_device *hdev, +static void hvfb_release_phymem (struct device *device,phys_addr_t paddr,unsigned int size) {unsigned int order =get_order (size);
@@ -960,7 +960,7 @@ static void hvfb_release_phymem(struct hv_device *hdev,if (order <=MAX_PAGE_ORDER )__free_pages (pfn_to_page (paddr >>PAGE_SHIFT ), order);else -dma_free_coherent (&hdev->device, +dma_free_coherent (device,round_up (size,PAGE_SIZE ),phys_to_virt (paddr), paddr);
@@ -1080,7 +1080,7 @@ static int hvfb_getmem(struct hv_device *hdev, struct fb_info *info) }/* Release the framebuffer */ -static void hvfb_putmem (struct hv_device *hdev,struct fb_info *info) +static void hvfb_putmem (struct fb_info *info) {struct hvfb_par *par = info->par;
@@ -1089,7 +1089,7 @@ static void hvfb_putmem(struct hv_device *hdev, struct fb_info *info)iounmap (par->mmio_vp);vmbus_free_mmio (par->mem->start, screen_fb_size); }else { -hvfb_release_phymem (hdev, info->fix.smem_start, +hvfb_release_phymem (info->device, info->fix.smem_start, screen_fb_size); }
@@ -1203,7 +1203,7 @@ static int hvfb_probe(struct hv_device *hdev, error:fb_deferred_io_cleanup (info); -hvfb_putmem (hdev, info); +hvfb_putmem (info); error2:vmbus_close (hdev->channel); error1:
@@ -1232,7 +1232,7 @@ static void hvfb_remove(struct hv_device *hdev)vmbus_close (hdev->channel);hv_set_drvdata (hdev,NULL ); -hvfb_putmem (hdev, info); +hvfb_putmem (info);framebuffer_release (info); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 27/231 fbdev: hyperv_fb: Allow graceful removal of framebuffer
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saurabh Sengar <[email protected]>
[ Upstream commit ea2f45ab0e53b255f72c85ccd99e2b394fc5fceb ]
When a Hyper-V framebuffer device is unbind, hyperv_fb driver tries to release the framebuffer forcefully. If this framebuffer is in use it produce the following WARN and hence this framebuffer is never released.
[ 44.111220] WARNING: CPU: 35 PID: 1882 at drivers/video/fbdev/core/fb_info.c:70 framebuffer_release+0x2c/0x40 < snip > [ 44.111289] Call Trace: [ 44.111290] <TASK> [ 44.111291] ? show_regs+0x6c/0x80 [ 44.111295] ? __warn+0x8d/0x150 [ 44.111298] ? framebuffer_release+0x2c/0x40 [ 44.111300] ? report_bug+0x182/0x1b0 [ 44.111303] ? handle_bug+0x6e/0xb0 [ 44.111306] ? exc_invalid_op+0x18/0x80 [ 44.111308] ? asm_exc_invalid_op+0x1b/0x20 [ 44.111311] ? framebuffer_release+0x2c/0x40 [ 44.111313] ? hvfb_remove+0x86/0xa0 [hyperv_fb] [ 44.111315] vmbus_remove+0x24/0x40 [hv_vmbus] [ 44.111323] device_remove+0x40/0x80 [ 44.111325] device_release_driver_internal+0x20b/0x270 [ 44.111327] ? bus_find_device+0xb3/0xf0
Fix this by moving the release of framebuffer and assosiated memory to fb_ops.fb_destroy function, so that framebuffer framework handles it gracefully.
While we fix this, also replace manual registrations/unregistration of framebuffer with devm_register_framebuffer.
Message-ID: <[email protected]>
--- drivers/video/fbdev/hyperv_fb.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-)
drivers/video/fbdev/hyperv_fb.c +15 -5
@@ -282,6 +282,8 @@ static uint screen_depth;static uint screen_fb_size;static uint dio_fb_size;/* FB size for deferred IO */ +static void hvfb_putmem (struct fb_info *info); +/* Send message to Hyper-V host */ static inline int synthvid_send (struct hv_device *hdev,struct synthvid_msg *msg)
@@ -862,6 +864,17 @@ static void hvfb_ops_damage_area(struct fb_info *info, u32 x, u32 y, u32 width,hvfb_ondemand_refresh_throttle (par, x, y, width, height); } +/* +* fb_ops.fb_destroy is called by the last put_fb_info() call at the end +* of unregister_framebuffer() or fb_release(). Do any cleanup related to +* framebuffer here. +*/ +static void hvfb_destroy (struct fb_info *info) +{ +hvfb_putmem (info); +framebuffer_release (info); +} +/* * TODO: GEN1 codepaths allocate from system or DMA-able memory. Fix the * driver to use the _SYSMEM_ or _DMAMEM_ helpers in these cases.
@@ -877,6 +890,7 @@ static const struct fb_ops hvfb_ops = { .fb_set_par = hvfb_set_par, .fb_setcolreg = hvfb_setcolreg, .fb_blank = hvfb_blank, + .fb_destroy = hvfb_destroy, };/* Get options from kernel paramenter "video=" */
@@ -1178,7 +1192,7 @@ static int hvfb_probe(struct hv_device *hdev,if (ret) goto error; - ret =register_framebuffer (info); + ret =devm_register_framebuffer (&hdev->device, info);if (ret) {pr_err ("Unable to register framebuffer\n" ); goto error;
@@ -1226,14 +1240,10 @@ static void hvfb_remove(struct hv_device *hdev)fb_deferred_io_cleanup (info); -unregister_framebuffer (info);cancel_delayed_work_sync (&par->dwork);vmbus_close (hdev->channel);hv_set_drvdata (hdev,NULL ); - -hvfb_putmem (info); -framebuffer_release (info); }static int hvfb_suspend (struct hv_device *hdev)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 28/231 Drivers: hv: vmbus: Dont release fb_mmio resource in vmbus_free_mmio()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Kelley <[email protected]>
[ Upstream commit 73fe9073c0cc28056cb9de0c8a516dac070f1d1f ]
The VMBus driver manages the MMIO space it owns via the hyperv_mmio resource tree. Because the synthetic video framebuffer portion of the MMIO space is initially setup by the Hyper-V host for each guest, the VMBus driver does an early reserve of that portion of MMIO space in the hyperv_mmio resource tree. It saves a pointer to that resource in fb_mmio. When a VMBus driver requests MMIO space and passes "true" for the "fb_overlap_ok" argument, the reserved framebuffer space is used if possible. In that case it's not necessary to do another request against the "shadow" hyperv_mmio resource tree because that resource was already requested in the early reserve steps.
However, the vmbus_free_mmio() function currently does no special handling for the fb_mmio resource. When a framebuffer device is removed, or the driver is unbound, the current code for vmbus_free_mmio() releases the reserved resource, leaving fb_mmio pointing to memory that has been freed. If the same or another driver is subsequently bound to the device, vmbus_allocate_mmio() checks against fb_mmio, and potentially gets garbage. Furthermore a second unbind operation produces this "nonexistent resource" error because of the unbalanced behavior between vmbus_allocate_mmio() and vmbus_free_mmio():
[ 55.499643] resource: Trying to free nonexistent resource <0x00000000f0000000-0x00000000f07fffff>
Fix this by adding logic to vmbus_free_mmio() to recognize when MMIO space in the fb_mmio reserved area would be released, and don't release it. This filtering ensures the fb_mmio resource always exists, and makes vmbus_free_mmio() more parallel with vmbus_allocate_mmio().
Message-ID: <[email protected]>
--- drivers/hv/vmbus_drv.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
drivers/hv/vmbus_drv.c +13 -0
@@ -2262,12 +2262,25 @@ void vmbus_free_mmio(resource_size_t start, resource_size_t size)struct resource *iter;mutex_lock (&hyperv_mmio_lock); + +/* +* If all bytes of the MMIO range to be released are within the +* special case fb_mmio shadow region, skip releasing the shadow +* region since no corresponding __request_region() was done +* in vmbus_allocate_mmio(). +*/ +if (fb_mmio && start >= fb_mmio->start && + (start + size -1 <= fb_mmio->end)) + goto skip_shadow_release; +for (iter = hyperv_mmio; iter; iter = iter->sibling) {if ((iter->start >= start + size) || (iter->end <= start))continue ;__release_region (iter, start, size); } + +skip_shadow_release:release_mem_region (start, size);mutex_unlock (&hyperv_mmio_lock);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 29/231 net/mlx5: handle errors in mlx5_chains_create_table()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <[email protected]>
[ Upstream commit eab0396353be1c778eba1c0b5180176f04dd21ce ]
In mlx5_chains_create_table(), the return value of mlx5_get_fdb_sub_ns() and mlx5_get_flow_namespace() must be checked to prevent NULL pointer dereferences. If either function fails, the function should log error message with mlx5_core_warn() and return error pointer.
--- drivers/net/ethernet/mellanox/mlx5/core/lib/fs_chains.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/lib/fs_chains.c +5 -0
@@ -196,6 +196,11 @@ mlx5_chains_create_table(struct mlx5_fs_chains *chains, ns =mlx5_get_flow_namespace (chains->dev, chains->ns); } +if (!ns) { +mlx5_core_warn (chains->dev,"Failed to get flow namespace\n" ); +return ERR_PTR (-EOPNOTSUPP ); + } + ft_attr.autogroup.num_reserved_entries =2 ; ft_attr.autogroup.max_num_groups = chains->group_num; ft =mlx5_create_auto_grouped_flow_table (ns, &ft_attr);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 30/231 eth: bnxt: fix truesize for mb-xdp-pass case
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taehee Yoo <[email protected]>
[ Upstream commit 9f7b2aa5034e24d3c49db73d5f760c0435fe31c2 ]
When mb-xdp is set and return is XDP_PASS, packet is converted from xdp_buff to sk_buff with xdp_update_skb_shared_info() in bnxt_xdp_build_skb().bnxt_xdp_build_skb() passes incorrect truesize argument to xdp_update_skb_shared_info().
The truesize is calculated as BNXT_RX_PAGE_SIZE * sinfo->nr_frags but the skb_shared_info was wiped by napi_build_skb() before.
So it stores sinfo->nr_frags before bnxt_xdp_build_skb() and use it instead of getting skb_shared_info from xdp_get_shared_info_from_buff().
Splat looks like:
------------[ cut here ]------------ WARNING: CPU: 2 PID: 0 at net/core/skbuff.c:6072 skb_try_coalesce+0x504/0x590 Modules linked in: xt_nat xt_tcpudp veth af_packet xt_conntrack nft_chain_nat xt_MASQUERADE nf_conntrack_netlink xfrm_user xt_addrtype nft_coms CPU: 2 UID: 0 PID: 0 Comm: swapper/2 Not tainted 6.14.0-rc2+ #3 RIP: 0010:skb_try_coalesce+0x504/0x590 Code: 4b fd ff ff 49 8b 34 24 40 80 e6 40 0f 84 3d fd ff ff 49 8b 74 24 48 40 f6 c6 01 0f 84 2e fd ff ff 48 8d 4e ff e9 25 fd ff ff <0f> 0b e99 RSP: 0018:ffffb62c4120caa8 EFLAGS: 00010287 RAX: 0000000000000003 RBX: ffffb62c4120cb14 RCX: 0000000000000ec0 RDX: 0000000000001000 RSI: ffffa06e5d7dc000 RDI: 0000000000000003 RBP: ffffa06e5d7ddec0 R08: ffffa06e6120a800 R09: ffffa06e7a119900 R10: 0000000000002310 R11: ffffa06e5d7dcec0 R12: ffffe4360575f740 R13: ffffe43600000000 R14: 0000000000000002 R15: 0000000000000002 FS: 0000000000000000(0000) GS:ffffa0755f700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f147b76b0f8 CR3: 00000001615d4000 CR4: 00000000007506f0 PKRU: 55555554 Call Trace: <IRQ> ? __warn+0x84/0x130 ? skb_try_coalesce+0x504/0x590 ? report_bug+0x18a/0x1a0 ? handle_bug+0x53/0x90 ? exc_invalid_op+0x14/0x70 ? asm_exc_invalid_op+0x16/0x20 ? skb_try_coalesce+0x504/0x590 inet_frag_reasm_finish+0x11f/0x2e0 ip_defrag+0x37a/0x900 ip_local_deliver+0x51/0x120 ip_sublist_rcv_finish+0x64/0x70 ip_sublist_rcv+0x179/0x210 ip_list_rcv+0xf9/0x130
How to reproduce:
<Node A>
ip link set $interface1 xdp obj xdp_pass.o
ip link set $interface1 mtu 9000 up
ip a a 10.0.0.1/24 dev $interface1
<Node B>
ip link set $interfac2 mtu 9000 up
ip a a 10.0.0.2/24 dev $interface2
ping 10.0.0.1 -s 65000
Following ping.py patch adds xdp-mb-pass case. so ping.py is going to be able to reproduce this issue.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 8 ++++++++ drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 2 +- 2 files changed, 9 insertions(+), 1 deletion(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +8 -0
@@ -2025,6 +2025,7 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr,struct rx_cmp_ext *rxcmp1;u32 tmp_raw_cons = *raw_cons;u16 cons, prod, cp_cons =RING_CMP (tmp_raw_cons); +struct skb_shared_info *sinfo;struct bnxt_sw_rx_bd *rx_buf;unsigned int len;u8 *data_ptr, agg_bufs, cmp_type;
@@ -2151,6 +2152,7 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, false);if (!frag_len) goto oom_next_rx; + } xdp_active = true; }
@@ -2160,6 +2162,12 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, rc =1 ; goto next_rx; } +if (xdp_buff_has_frags (&xdp)) { + sinfo =xdp_get_shared_info_from_buff (&xdp); + agg_bufs = sinfo->nr_frags; + }else { + agg_bufs =0 ; + } }if (len <= bp->rx_copy_thresh) {
drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c +1 -1
@@ -472,7 +472,7 @@ bnxt_xdp_build_skb(struct bnxt *bp, struct sk_buff *skb, u8 num_frags, }xdp_update_skb_shared_info (skb, num_frags, sinfo->xdp_frags_size, -BNXT_RX_PAGE_SIZE * sinfo->nr_frags, +BNXT_RX_PAGE_SIZE * num_frags,xdp_buff_is_frag_pfmemalloc (xdp));return skb; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 31/231 eth: bnxt: return fail if interface is down in bnxt_queue_mem_alloc()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taehee Yoo <[email protected]>
[ Upstream commit ca2456e073957781e1184de68551c65161b2bd30 ]
The bnxt_queue_mem_alloc() is called to allocate new queue memory when a queue is restarted.
It internally accesses rx buffer descriptor corresponding to the index. The rx buffer descriptor is allocated and set when the interface is up and it's freed when the interface is down.
So, if queue is restarted if interface is down, kernel panic occurs.
Splat looks like:
BUG: unable to handle page fault for address: 000000000000b240 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 3 UID: 0 PID: 1563 Comm: ncdevmem2 Not tainted 6.14.0-rc2+ #9 844ddba6e7c459cafd0bf4db9a3198e Hardware name: ASUS System Product Name/PRIME Z690-P D4, BIOS 0603 11/01/2021 RIP: 0010:bnxt_queue_mem_alloc+0x3f/0x4e0 [bnxt_en] Code: 41 54 4d 89 c4 4d 69 c0 c0 05 00 00 55 48 89 f5 53 48 89 fb 4c 8d b5 40 05 00 00 48 83 ec 15 RSP: 0018:ffff9dcc83fef9e8 EFLAGS: 00010202 RAX: ffffffffc0457720 RBX: ffff934ed8d40000 RCX: 0000000000000000 RDX: 000000000000001f RSI: ffff934ea508f800 RDI: ffff934ea508f808 RBP: ffff934ea508f800 R08: 000000000000b240 R09: ffff934e84f4b000 R10: ffff9dcc83fefa30 R11: ffff934e84f4b000 R12: 000000000000001f R13: ffff934ed8d40ac0 R14: ffff934ea508fd40 R15: ffff934e84f4b000 FS: 00007fa73888c740(0000) GS:ffff93559f780000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000b240 CR3: 0000000145a2e000 CR4: 00000000007506f0 PKRU: 55555554 Call Trace: <TASK> ? __die+0x20/0x70 ? page_fault_oops+0x15a/0x460 ? exc_page_fault+0x6e/0x180 ? asm_exc_page_fault+0x22/0x30 ? __pfx_bnxt_queue_mem_alloc+0x10/0x10 [bnxt_en 7f85e76f4d724ba07471d7e39d9e773aea6597b7] ? bnxt_queue_mem_alloc+0x3f/0x4e0 [bnxt_en 7f85e76f4d724ba07471d7e39d9e773aea6597b7] netdev_rx_queue_restart+0xc5/0x240 net_devmem_bind_dmabuf_to_queue+0xf8/0x200 netdev_nl_bind_rx_doit+0x3a7/0x450 genl_family_rcv_msg_doit+0xd9/0x130 genl_rcv_msg+0x184/0x2b0 ? __pfx_netdev_nl_bind_rx_doit+0x10/0x10 ? __pfx_genl_rcv_msg+0x10/0x10 netlink_rcv_skb+0x54/0x100 genl_rcv+0x24/0x40
...
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +3 -0
@@ -15108,6 +15108,9 @@ static int bnxt_queue_mem_alloc(struct net_device *dev, void *qmem, int idx)struct bnxt_ring_struct *ring;int rc; +if (!bp->rx_ring) +return -ENETDOWN ; + rxr = &bp->rx_ring[idx]; clone = qmem;memcpy (clone, rxr,sizeof (*rxr));
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 32/231 eth: bnxt: do not use BNXT_VNIC_NTUPLE unconditionally in queue restart logic
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taehee Yoo <[email protected]>
[ Upstream commit 661958552eda5bf64bfafb4821cbdded935f1f68 ]
When a queue is restarted, it sets MRU to 0 for stopping packet flow. MRU variable is a member of vnic_info[], the first vnic_info is default and the second is ntuple.
Only when ntuple is enabled(ethtool -K eth0 ntuple on), vnic_info for ntuple is allocated in init logic.
The bp->nr_vnics indicates how many vnic_info are allocated. However bnxt_queue_{start | stop}() accesses vnic_info[BNXT_VNIC_NTUPLE] regardless of ntuple state.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +2 -2
@@ -15287,7 +15287,7 @@ static int bnxt_queue_start(struct net_device *dev, void *qmem, int idx) cpr = &rxr->bnapi->cp_ring; cpr->sw_stats->rx.rx_resets++; -for (i =0 ; i <=BNXT_VNIC_NTUPLE ; i++) { +for (i =0 ; i <= bp->nr_vnics; i++) { vnic = &bp->vnic_info[i]; rc =bnxt_hwrm_vnic_set_rss_p5 (bp, vnic, true);
@@ -15315,7 +15315,7 @@ static int bnxt_queue_stop(struct net_device *dev, void *qmem, int idx)struct bnxt_vnic_info *vnic;int i; -for (i =0 ; i <=BNXT_VNIC_NTUPLE ; i++) { +for (i =0 ; i <= bp->nr_vnics; i++) { vnic = &bp->vnic_info[i]; vnic->mru =0 ; bnxt_hwrm_vnic_update(bp, vnic,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 33/231 eth: bnxt: do not update checksum in bnxt_xdp_build_skb()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taehee Yoo <[email protected]>
[ Upstream commit c03e7d05aa0e2f7e9a9ce5ad8a12471a53f941dc ]
The bnxt_rx_pkt() updates ip_summed value at the end if checksum offload is enabled.
When the XDP-MB program is attached and it returns XDP_PASS, the bnxt_xdp_build_skb() is called to update skb_shared_info. The main purpose of bnxt_xdp_build_skb() is to update skb_shared_info, but it updates ip_summed value too if checksum offload is enabled. This is actually duplicate work.
When the bnxt_rx_pkt() updates ip_summed value, it checks if ip_summed is CHECKSUM_NONE or not.
It means that ip_summed should be CHECKSUM_NONE at this moment. But ip_summed may already be updated to CHECKSUM_UNNECESSARY in the XDP-MB-PASS path.
So the by skb_checksum_none_assert() WARNS about it.
This is duplicate work and updating ip_summed in the bnxt_xdp_build_skb() is not needed.
Splat looks like:
WARNING: CPU: 3 PID: 5782 at ./include/linux/skbuff.h:5155 bnxt_rx_pkt+0x479b/0x7610 [bnxt_en] Modules linked in: bnxt_re bnxt_en rdma_ucm rdma_cm iw_cm ib_cm ib_uverbs veth xt_nat xt_tcpudp xt_conntrack nft_chain_nat xt_MASQUERADE nf_] CPU: 3 UID: 0 PID: 5782 Comm: socat Tainted: G W 6.14.0-rc4+ #27 Tainted: [W]=WARN Hardware name: ASUS System Product Name/PRIME Z690-P D4, BIOS 0603 11/01/2021 RIP: 0010:bnxt_rx_pkt+0x479b/0x7610 [bnxt_en] Code: 54 24 0c 4c 89 f1 4c 89 ff c1 ea 1f ff d3 0f 1f 00 49 89 c6 48 85 c0 0f 84 4c e5 ff ff 48 89 c7 e8 ca 3d a0 c8 e9 8f f4 ff ff <0f> 0b f RSP: 0018:ffff88881ba09928 EFLAGS: 00010202 RAX: 0000000000000000 RBX: 00000000c7590303 RCX: 0000000000000000 RDX: 1ffff1104e7d1610 RSI: 0000000000000001 RDI: ffff8881c91300b8 RBP: ffff88881ba09b28 R08: ffff888273e8b0d0 R09: ffff888273e8b070 R10: ffff888273e8b010 R11: ffff888278b0f000 R12: ffff888273e8b080 R13: ffff8881c9130e00 R14: ffff8881505d3800 R15: ffff888273e8b000 FS: 00007f5a2e7be080(0000) GS:ffff88881ba00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fff2e708ff8 CR3: 000000013e3b0000 CR4: 00000000007506f0 PKRU: 55555554 Call Trace: <IRQ> ? __warn+0xcd/0x2f0 ? bnxt_rx_pkt+0x479b/0x7610 ? report_bug+0x326/0x3c0 ? handle_bug+0x53/0xa0 ? exc_invalid_op+0x14/0x50 ? asm_exc_invalid_op+0x16/0x20 ? bnxt_rx_pkt+0x479b/0x7610 ? bnxt_rx_pkt+0x3e41/0x7610 ? __pfx_bnxt_rx_pkt+0x10/0x10 ? napi_complete_done+0x2cf/0x7d0 __bnxt_poll_work+0x4e8/0x1220 ? __pfx___bnxt_poll_work+0x10/0x10 ? __pfx_mark_lock.part.0+0x10/0x10 bnxt_poll_p5+0x36a/0xfa0 ? __pfx_bnxt_poll_p5+0x10/0x10 __napi_poll.constprop.0+0xa0/0x440 net_rx_action+0x899/0xd00
...
Following ping.py patch adds xdp-mb-pass case. so ping.py is going to be able to reproduce this issue.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 ++- drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 11 ++--------- drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.h | 3 +-- 3 files changed, 5 insertions(+), 12 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +2 -1
@@ -2205,7 +2205,8 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr,if (!skb) goto oom_next_rx; }else { - skb =bnxt_xdp_build_skb (bp, skb, agg_bufs, rxr->page_pool, &xdp, rxcmp1); + skb =bnxt_xdp_build_skb (bp, skb, agg_bufs, + rxr->page_pool, &xdp);if (!skb) {/* we should be able to free the old skb here */ bnxt_xdp_buff_frags_free (rxr, &xdp);
drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c +2 -9
@@ -456,20 +456,13 @@ int bnxt_xdp(struct net_device *dev, struct netdev_bpf *xdp)struct sk_buff *bnxt_xdp_build_skb (struct bnxt *bp,struct sk_buff *skb,u8 num_frags, -struct page_pool *pool,struct xdp_buff *xdp, -struct rx_cmp_ext *rxcmp1) +struct page_pool *pool,struct xdp_buff *xdp) {struct skb_shared_info *sinfo =xdp_get_shared_info_from_buff (xdp);if (!skb)return NULL ; -skb_checksum_none_assert (skb); -if (RX_CMP_L4_CS_OK (rxcmp1)) { -if (bp->dev->features &NETIF_F_RXCSUM ) { - skb->ip_summed =CHECKSUM_UNNECESSARY ; - skb->csum_level =RX_CMP_ENCAP (rxcmp1); - } - } + xdp_update_skb_shared_info(skb, num_frags, sinfo->xdp_frags_size, BNXT_RX_PAGE_SIZE * num_frags,
drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.h +1 -2
@@ -33,6 +33,5 @@ void bnxt_xdp_buff_frags_free(struct bnxt_rx_ring_info *rxr, struct xdp_buff *xdp);struct sk_buff *bnxt_xdp_build_skb (struct bnxt *bp,struct sk_buff *skb,u8 num_frags,struct page_pool *pool, -struct xdp_buff *xdp, -struct rx_cmp_ext *rxcmp1); +struct xdp_buff *xdp);#endif
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 34/231 eth: bnxt: fix kernel panic in the bnxt_get_queue_stats{rx | tx}
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taehee Yoo <[email protected]>
[ Upstream commit f09af5fdfbd9b0fcee73aab1116904c53b199e97 ]
When qstats-get operation is executed, callbacks of netdev_stats_ops are called. The bnxt_get_queue_stats{rx | tx} collect per-queue stats from sw_stats in the rings.
But {rx | tx | cp}_ring are allocated when the interface is up. So, these rings are not allocated when the interface is down.
The qstats-get is allowed even if the interface is down. However, the bnxt_get_queue_stats{rx | tx}() accesses cp_ring and tx_ring without null check.
So, it needs to avoid accessing rings if the interface is down.
Reproducer:
ip link set $interface down
./cli.py --spec netdev.yaml --dump qstats-get
OR
ip link set $interface down
python ./stats.py
Splat looks like:
BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 1680fa067 P4D 1680fa067 PUD 16be3b067 PMD 0 Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 0 UID: 0 PID: 1495 Comm: python3 Not tainted 6.14.0-rc4+ #32 5cd0f999d5a15c574ac72b3e4b907341 Hardware name: ASUS System Product Name/PRIME Z690-P D4, BIOS 0603 11/01/2021 RIP: 0010:bnxt_get_queue_stats_rx+0xf/0x70 [bnxt_en] Code: c6 87 b5 18 00 00 02 eb a2 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 01 RSP: 0018:ffffabef43cdb7e0 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffffffffc04c8710 RCX: 0000000000000000 RDX: ffffabef43cdb858 RSI: 0000000000000000 RDI: ffff8d504e850000 RBP: ffff8d506c9f9c00 R08: 0000000000000004 R09: ffff8d506bcd901c R10: 0000000000000015 R11: ffff8d506bcd9000 R12: 0000000000000000 R13: ffffabef43cdb8c0 R14: ffff8d504e850000 R15: 0000000000000000 FS: 00007f2c5462b080(0000) GS:ffff8d575f600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000000167fd0000 CR4: 00000000007506f0 PKRU: 55555554 Call Trace: <TASK> ? __die+0x20/0x70 ? page_fault_oops+0x15a/0x460 ? sched_balance_find_src_group+0x58d/0xd10 ? exc_page_fault+0x6e/0x180 ? asm_exc_page_fault+0x22/0x30 ? bnxt_get_queue_stats_rx+0xf/0x70 [bnxt_en cdd546fd48563c280cfd30e9647efa420db07bf1] netdev_nl_stats_by_netdev+0x2b1/0x4e0 ? xas_load+0x9/0xb0 ? xas_find+0x183/0x1d0 ? xa_find+0x8b/0xe0 netdev_nl_qstats_get_dumpit+0xbf/0x1e0 genl_dumpit+0x31/0x90 netlink_dump+0x1a8/0x360
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +6 -0
@@ -15032,6 +15032,9 @@ static void bnxt_get_queue_stats_rx(struct net_device *dev, int i,struct bnxt_cp_ring_info *cpr;u64 *sw; +if (!bp->bnapi) +return ; + cpr = &bp->bnapi[i]->cp_ring; sw = cpr->stats.sw_stats;
@@ -15055,6 +15058,9 @@ static void bnxt_get_queue_stats_tx(struct net_device *dev, int i,struct bnxt_napi *bnapi;u64 *sw; +if (!bp->tx_ring) +return ; + bnapi = bp->tx_ring[bp->tx_ring_map[i]].bnapi; sw = bnapi->cp_ring.stats.sw_stats;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 35/231 eth: bnxt: use page pool for head frags
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 7ed816be35abc3d5bed39d3edc5f2efed2ca5216 ]
Testing small size RPCs (300B-400B) on a large AMD system suggests that page pool recycling is very useful even for just the head frags. With this patch (and copy break disabled) I see a 30% performance improvement (82Gbps -> 106Gbps).
Convert bnxt from normal page frags to page pool frags for head buffers.
On systems with small page size we can use the same pool as for TPA pages. On systems with large pages the frag allocation logic of the page pool is already used to split a large page into TPA chunks. TPA chunks are much larger than heads (8k or 64k, AFAICT vs 1kB) and we always allocate the same sized chunks. Mixing allocation of TPA and head pages would lead to sub-optimal memory use. Plus Taehee's work on zero-copy / devmem will need to differentiate between TPA and non-TPA page pool, anyway. Conditionally allocate a new page pool for heads.
Stable-dep-of: 87dd2850835d ("eth: bnxt: fix memory leak in queue reset")
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 98 ++++++++++++----------- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 + 2 files changed, 51 insertions(+), 48 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +50 -48
@@ -864,6 +864,11 @@ static void bnxt_tx_int(struct bnxt *bp, struct bnxt_napi *bnapi, int budget) bnapi->events &= ~BNXT_TX_CMP_EVENT ; } +static bool bnxt_separate_head_pool (void ) +{ +return PAGE_SIZE >BNXT_RX_PAGE_SIZE ; +} + static struct page *__bnxt_alloc_rx_page(struct bnxt *bp, dma_addr_t *mapping, struct bnxt_rx_ring_info *rxr, unsigned int *offset,
@@ -886,27 +891,19 @@ static struct page *__bnxt_alloc_rx_page(struct bnxt *bp, dma_addr_t *mapping, }static inline u8 *__bnxt_alloc_rx_frag (struct bnxt *bp,dma_addr_t *mapping, +struct bnxt_rx_ring_info *rxr,gfp_t gfp) { -u8 *data; -struct pci_dev *pdev = bp->pdev; +unsigned int offset; +struct page *page; -if (gfp ==GFP_ATOMIC ) - data =napi_alloc_frag (bp->rx_buf_size); -else - data =netdev_alloc_frag (bp->rx_buf_size); -if (!data) + page =page_pool_alloc_frag (rxr->head_pool, &offset, + bp->rx_buf_size, gfp); +if (!page)return NULL ; - *mapping =dma_map_single_attrs (&pdev->dev, data + bp->rx_dma_offset, - bp->rx_buf_use_size, bp->rx_dir, -DMA_ATTR_WEAK_ORDERING ); - -if (dma_mapping_error (&pdev->dev, *mapping)) { -skb_free_frag (data); - data =NULL ; - } -return data; + *mapping =page_pool_get_dma_addr (page) + bp->rx_dma_offset + offset; +return page_address (page) + offset; } int bnxt_alloc_rx_data(struct bnxt *bp, struct bnxt_rx_ring_info *rxr,
@@ -928,7 +925,7 @@ int bnxt_alloc_rx_data(struct bnxt *bp, struct bnxt_rx_ring_info *rxr, rx_buf->data = page; rx_buf->data_ptr =page_address (page) + offset + bp->rx_offset; }else { -u8 *data =__bnxt_alloc_rx_frag (bp, &mapping, gfp); +u8 *data =__bnxt_alloc_rx_frag (bp, &mapping, rxr, gfp);if (!data)return -ENOMEM ;
@@ -1179,13 +1176,14 @@ static struct sk_buff *bnxt_rx_skb(struct bnxt *bp, } skb =napi_build_skb (data, bp->rx_buf_size); -dma_unmap_single_attrs (&bp->pdev->dev, dma_addr, bp->rx_buf_use_size, - bp->rx_dir,DMA_ATTR_WEAK_ORDERING ); +dma_sync_single_for_cpu (&bp->pdev->dev, dma_addr, bp->rx_buf_use_size, + bp->rx_dir);if (!skb) { -skb_free_frag (data); +page_pool_free_va (rxr->head_pool, data, true);return NULL ; } +skb_mark_for_recycle (skb);skb_reserve (skb, bp->rx_offset);skb_put (skb, offset_and_len &0xffff );return skb;
@@ -1840,7 +1838,8 @@ static inline struct sk_buff *bnxt_tpa_end(struct bnxt *bp,u8 *new_data;dma_addr_t new_mapping; - new_data =__bnxt_alloc_rx_frag (bp, &new_mapping,GFP_ATOMIC ); + new_data =__bnxt_alloc_rx_frag (bp, &new_mapping, rxr, +GFP_ATOMIC );if (!new_data) {bnxt_abort_tpa (cpr, idx, agg_bufs); cpr->sw_stats->rx.rx_oom_discards +=1 ;
@@ -1852,16 +1851,16 @@ static inline struct sk_buff *bnxt_tpa_end(struct bnxt *bp, tpa_info->mapping = new_mapping; skb =napi_build_skb (data, bp->rx_buf_size); -dma_unmap_single_attrs (&bp->pdev->dev, mapping, - bp->rx_buf_use_size, bp->rx_dir, -DMA_ATTR_WEAK_ORDERING ); +dma_sync_single_for_cpu (&bp->pdev->dev, mapping, + bp->rx_buf_use_size, bp->rx_dir);if (!skb) { -skb_free_frag (data); +page_pool_free_va (rxr->head_pool, data, true);bnxt_abort_tpa (cpr, idx, agg_bufs); cpr->sw_stats->rx.rx_oom_discards +=1 ;return NULL ; } +skb_mark_for_recycle (skb);skb_reserve (skb, bp->rx_offset);skb_put (skb, len); }
@@ -3325,28 +3324,22 @@ static void bnxt_free_tx_skbs(struct bnxt *bp)static void bnxt_free_one_rx_ring (struct bnxt *bp,struct bnxt_rx_ring_info *rxr) { -struct pci_dev *pdev = bp->pdev;int i, max_idx; max_idx = bp->rx_nr_pages *RX_DESC_CNT ;for (i =0 ; i < max_idx; i++) {struct bnxt_sw_rx_bd *rx_buf = &rxr->rx_buf_ring[i]; -dma_addr_t mapping = rx_buf->mapping;void *data = rx_buf->data;if (!data)continue ; rx_buf->data =NULL ; -if (BNXT_RX_PAGE_MODE (bp)) { +if (BNXT_RX_PAGE_MODE (bp))page_pool_recycle_direct (rxr->page_pool, data); - }else { -dma_unmap_single_attrs (&pdev->dev, mapping, - bp->rx_buf_use_size, bp->rx_dir, -DMA_ATTR_WEAK_ORDERING ); -skb_free_frag (data); - } +else +page_pool_free_va (rxr->head_pool, data, true); } }
@@ -3373,7 +3366,6 @@ static void bnxt_free_one_rx_agg_ring(struct bnxt *bp, struct bnxt_rx_ring_infostatic void bnxt_free_one_rx_ring_skbs (struct bnxt *bp,int ring_nr) {struct bnxt_rx_ring_info *rxr = &bp->rx_ring[ring_nr]; -struct pci_dev *pdev = bp->pdev;struct bnxt_tpa_idx_map *map;int i;
@@ -3387,13 +3379,8 @@ static void bnxt_free_one_rx_ring_skbs(struct bnxt *bp, int ring_nr)if (!data)continue ; -dma_unmap_single_attrs (&pdev->dev, tpa_info->mapping, - bp->rx_buf_use_size, bp->rx_dir, -DMA_ATTR_WEAK_ORDERING ); - tpa_info->data =NULL ; - -skb_free_frag (data); +page_pool_free_va (rxr->head_pool, data, false); } skip_rx_tpa_free:
@@ -3609,7 +3596,9 @@ static void bnxt_free_rx_rings(struct bnxt *bp)xdp_rxq_info_unreg (&rxr->xdp_rxq);page_pool_destroy (rxr->page_pool); - rxr->page_pool =NULL ; +if (rxr->page_pool != rxr->head_pool) +page_pool_destroy (rxr->head_pool); + rxr->page_pool = rxr->head_pool =NULL ;kfree (rxr->rx_agg_bmap); rxr->rx_agg_bmap =NULL ;
@@ -3627,6 +3616,7 @@ static int bnxt_alloc_rx_page_pool(struct bnxt *bp, int numa_node) {struct page_pool_params pp = {0 }; +struct page_pool *pool; pp.pool_size = bp->rx_agg_ring_size;if (BNXT_RX_PAGE_MODE (bp))
@@ -3639,14 +3629,25 @@ static int bnxt_alloc_rx_page_pool(struct bnxt *bp, pp.max_len =PAGE_SIZE ; pp.flags =PP_FLAG_DMA_MAP |PP_FLAG_DMA_SYNC_DEV ; - rxr->page_pool =page_pool_create (&pp); -if (IS_ERR (rxr->page_pool)) { -int err =PTR_ERR (rxr->page_pool); + pool =page_pool_create (&pp); +if (IS_ERR (pool)) +return PTR_ERR (pool); + rxr->page_pool = pool; - rxr->page_pool =NULL ; -return err; +if (bnxt_separate_head_pool ()) { + pp.pool_size =max (bp->rx_ring_size,1024 ); + pool =page_pool_create (&pp); +if (IS_ERR (pool)) + goto err_destroy_pp; } + rxr->head_pool = pool; +return 0 ; + +err_destroy_pp: +page_pool_destroy (rxr->page_pool); + rxr->page_pool =NULL ; +return PTR_ERR (pool); }static int bnxt_alloc_rx_rings (struct bnxt *bp)
@@ -4197,7 +4198,8 @@ static int bnxt_alloc_one_rx_ring(struct bnxt *bp, int ring_nr)u8 *data;for (i =0 ; i < bp->max_tpa; i++) { - data =__bnxt_alloc_rx_frag (bp, &mapping,GFP_KERNEL ); + data =__bnxt_alloc_rx_frag (bp, &mapping, rxr, +GFP_KERNEL );if (!data)return -ENOMEM ;
drivers/net/ethernet/broadcom/bnxt/bnxt.h +1 -0
@@ -1108,6 +1108,7 @@ struct bnxt_rx_ring_info {struct bnxt_ring_struct rx_agg_ring_struct;struct xdp_rxq_info xdp_rxq;struct page_pool *page_pool; +struct page_pool *head_pool; };struct bnxt_rx_sw_stats {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 36/231 bnxt_en: refactor tpa_info alloc/free into helpers
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Wei <[email protected]>
[ Upstream commit 5883a3e0babf55d85422fddec3422f211c853f6e ]
Refactor bnxt_rx_ring_info->tpa_info operations into helpers that work on a single tpa_info in prep for queue API using them.
There are 2 pairs of operations:
* bnxt_alloc_one_tpa_info()
* bnxt_free_one_tpa_info()
These alloc/free the tpa_info array itself.
* bnxt_alloc_one_tpa_info_data()
* bnxt_free_one_tpa_info_data()
These alloc/free the frags stored in tpa_info array.
Stable-dep-of: 87dd2850835d ("eth: bnxt: fix memory leak in queue reset")
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 142 ++++++++++++++-------- 1 file changed, 90 insertions(+), 52 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +90 -52
@@ -3363,15 +3363,11 @@ static void bnxt_free_one_rx_agg_ring(struct bnxt *bp, struct bnxt_rx_ring_info } } -static void bnxt_free_one_rx_ring_skbs (struct bnxt *bp,int ring_nr) +static void bnxt_free_one_tpa_info_data (struct bnxt *bp, +struct bnxt_rx_ring_info *rxr) { -struct bnxt_rx_ring_info *rxr = &bp->rx_ring[ring_nr]; -struct bnxt_tpa_idx_map *map;int i; -if (!rxr->rx_tpa) - goto skip_rx_tpa_free; -for (i =0 ; i < bp->max_tpa; i++) {struct bnxt_tpa_info *tpa_info = &rxr->rx_tpa[i];u8 *data = tpa_info->data;
@@ -3382,6 +3378,17 @@ static void bnxt_free_one_rx_ring_skbs(struct bnxt *bp, int ring_nr) tpa_info->data =NULL ;page_pool_free_va (rxr->head_pool, data, false); } +} + +static void bnxt_free_one_rx_ring_skbs (struct bnxt *bp, +struct bnxt_rx_ring_info *rxr) +{ +struct bnxt_tpa_idx_map *map; + +if (!rxr->rx_tpa) + goto skip_rx_tpa_free; + +bnxt_free_one_tpa_info_data (bp, rxr); skip_rx_tpa_free:if (!rxr->rx_buf_ring)
@@ -3409,7 +3416,7 @@ static void bnxt_free_rx_skbs(struct bnxt *bp)return ;for (i =0 ; i < bp->rx_nr_rings; i++) -bnxt_free_one_rx_ring_skbs (bp, i); +bnxt_free_one_rx_ring_skbs (bp, &bp->rx_ring[i]); }static void bnxt_free_skbs (struct bnxt *bp)
@@ -3521,29 +3528,64 @@ static int bnxt_alloc_ring(struct bnxt *bp, struct bnxt_ring_mem_info *rmem)return 0 ; } +static void bnxt_free_one_tpa_info (struct bnxt *bp, +struct bnxt_rx_ring_info *rxr) +{ +int i; + +kfree (rxr->rx_tpa_idx_map); + rxr->rx_tpa_idx_map =NULL ; +if (rxr->rx_tpa) { +for (i =0 ; i < bp->max_tpa; i++) { +kfree (rxr->rx_tpa[i].agg_arr); + rxr->rx_tpa[i].agg_arr =NULL ; + } + } +kfree (rxr->rx_tpa); + rxr->rx_tpa =NULL ; +} +static void bnxt_free_tpa_info (struct bnxt *bp) { -int i, j; +int i;for (i =0 ; i < bp->rx_nr_rings; i++) {struct bnxt_rx_ring_info *rxr = &bp->rx_ring[i]; -kfree (rxr->rx_tpa_idx_map); - rxr->rx_tpa_idx_map =NULL ; -if (rxr->rx_tpa) { -for (j =0 ; j < bp->max_tpa; j++) { -kfree (rxr->rx_tpa[j].agg_arr); - rxr->rx_tpa[j].agg_arr =NULL ; - } - } -kfree (rxr->rx_tpa); - rxr->rx_tpa =NULL ; +bnxt_free_one_tpa_info (bp, rxr); } } +static int bnxt_alloc_one_tpa_info (struct bnxt *bp, +struct bnxt_rx_ring_info *rxr) +{ +struct rx_agg_cmp *agg; +int i; + + rxr->rx_tpa =kcalloc (bp->max_tpa,sizeof (struct bnxt_tpa_info ), +GFP_KERNEL ); +if (!rxr->rx_tpa) +return -ENOMEM ; + +if (!(bp->flags &BNXT_FLAG_CHIP_P5_PLUS )) +return 0 ; +for (i =0 ; i < bp->max_tpa; i++) { + agg =kcalloc (MAX_SKB_FRAGS ,sizeof (*agg),GFP_KERNEL ); +if (!agg) +return -ENOMEM ; + rxr->rx_tpa[i].agg_arr = agg; + } + rxr->rx_tpa_idx_map =kzalloc (sizeof (*rxr->rx_tpa_idx_map), +GFP_KERNEL ); +if (!rxr->rx_tpa_idx_map) +return -ENOMEM ; + +return 0 ; +} +static int bnxt_alloc_tpa_info (struct bnxt *bp) { -int i, j; +int i, rc; bp->max_tpa =MAX_TPA ;if (bp->flags &BNXT_FLAG_CHIP_P5_PLUS ) {
@@ -3554,25 +3596,10 @@ static int bnxt_alloc_tpa_info(struct bnxt *bp)for (i =0 ; i < bp->rx_nr_rings; i++) {struct bnxt_rx_ring_info *rxr = &bp->rx_ring[i]; -struct rx_agg_cmp *agg; - - rxr->rx_tpa =kcalloc (bp->max_tpa,sizeof (struct bnxt_tpa_info ), -GFP_KERNEL ); -if (!rxr->rx_tpa) -return -ENOMEM ; -if (!(bp->flags &BNXT_FLAG_CHIP_P5_PLUS )) -continue ; -for (j =0 ; j < bp->max_tpa; j++) { - agg =kcalloc (MAX_SKB_FRAGS ,sizeof (*agg),GFP_KERNEL ); -if (!agg) -return -ENOMEM ; - rxr->rx_tpa[j].agg_arr = agg; - } - rxr->rx_tpa_idx_map =kzalloc (sizeof (*rxr->rx_tpa_idx_map), -GFP_KERNEL ); -if (!rxr->rx_tpa_idx_map) -return -ENOMEM ; + rc =bnxt_alloc_one_tpa_info (bp, rxr); +if (rc) +return rc; }return 0 ; }
@@ -4181,10 +4208,31 @@ static void bnxt_alloc_one_rx_ring_page(struct bnxt *bp, rxr->rx_agg_prod = prod; } +static int bnxt_alloc_one_tpa_info_data (struct bnxt *bp, +struct bnxt_rx_ring_info *rxr) +{ +dma_addr_t mapping; +u8 *data; +int i; + +for (i =0 ; i < bp->max_tpa; i++) { + data =__bnxt_alloc_rx_frag (bp, &mapping, rxr, +GFP_KERNEL ); +if (!data) +return -ENOMEM ; + + rxr->rx_tpa[i].data = data; + rxr->rx_tpa[i].data_ptr = data + bp->rx_offset; + rxr->rx_tpa[i].mapping = mapping; + } + +return 0 ; +} +static int bnxt_alloc_one_rx_ring (struct bnxt *bp,int ring_nr) {struct bnxt_rx_ring_info *rxr = &bp->rx_ring[ring_nr]; -int i; +int rc;bnxt_alloc_one_rx_ring_skb (bp, rxr, ring_nr);
@@ -4194,19 +4242,9 @@ static int bnxt_alloc_one_rx_ring(struct bnxt *bp, int ring_nr)bnxt_alloc_one_rx_ring_page (bp, rxr, ring_nr);if (rxr->rx_tpa) { -dma_addr_t mapping; -u8 *data; - -for (i =0 ; i < bp->max_tpa; i++) { - data =__bnxt_alloc_rx_frag (bp, &mapping, rxr, -GFP_KERNEL ); -if (!data) -return -ENOMEM ; - - rxr->rx_tpa[i].data = data; - rxr->rx_tpa[i].data_ptr = data + bp->rx_offset; - rxr->rx_tpa[i].mapping = mapping; - } + rc =bnxt_alloc_one_tpa_info_data (bp, rxr); +if (rc) +return rc; }return 0 ; }
@@ -13463,7 +13501,7 @@ static void bnxt_rx_ring_reset(struct bnxt *bp)bnxt_reset_task (bp, true);break ; } -bnxt_free_one_rx_ring_skbs (bp, i); +bnxt_free_one_rx_ring_skbs (bp, rxr); rxr->rx_prod =0 ; rxr->rx_agg_prod =0 ; rxr->rx_sw_agg_prod =0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 37/231 bnxt_en: handle tpa_info in queue API implementation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Wei <[email protected]>
[ Upstream commit bd649c5cc958169b8a8a3e77ea926d92d472b02a ]
Commit 7ed816be35ab ("eth: bnxt: use page pool for head frags") added a page pool for header frags, which may be distinct from the existing pool for the aggregation ring. Prior to this change, frags used in the TPA ring rx_tpa were allocated from system memory e.g. napi_alloc_frag() meaning their lifetimes were not associated with a page pool. They can be returned at any time and so the queue API did not alloc or free rx_tpa.
But now frags come from a separate head_pool which may be different to page_pool. Without allocating and freeing rx_tpa, frags allocated from the old head_pool may be returned to a different new head_pool which causes a mismatch between the pp hold/release count.
Fix this problem by properly freeing and allocating rx_tpa in the queue API implementation.
Stable-dep-of: 87dd2850835d ("eth: bnxt: fix memory leak in queue reset")
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 27 +++++++++++++++++++---- 1 file changed, 23 insertions(+), 4 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +23 -4
@@ -3623,7 +3623,7 @@ static void bnxt_free_rx_rings(struct bnxt *bp)xdp_rxq_info_unreg (&rxr->xdp_rxq);page_pool_destroy (rxr->page_pool); -if (rxr->page_pool != rxr->head_pool) +if (bnxt_separate_head_pool ())page_pool_destroy (rxr->head_pool); rxr->page_pool = rxr->head_pool =NULL ;
@@ -15199,15 +15199,25 @@ static int bnxt_queue_mem_alloc(struct net_device *dev, void *qmem, int idx) goto err_free_rx_agg_ring; } +if (bp->flags &BNXT_FLAG_TPA ) { + rc =bnxt_alloc_one_tpa_info (bp, clone); +if (rc) + goto err_free_tpa_info; + } +bnxt_init_one_rx_ring_rxbd (bp, clone);bnxt_init_one_rx_agg_ring_rxbd (bp, clone);bnxt_alloc_one_rx_ring_skb (bp, clone, idx);if (bp->flags &BNXT_FLAG_AGG_RINGS )bnxt_alloc_one_rx_ring_page (bp, clone, idx); +if (bp->flags &BNXT_FLAG_TPA ) +bnxt_alloc_one_tpa_info_data (bp, clone);return 0 ; +err_free_tpa_info: +bnxt_free_one_tpa_info (bp, clone); err_free_rx_agg_ring:bnxt_free_ring (bp, &clone->rx_agg_ring_struct.ring_mem); err_free_rx_ring:
@@ -15215,9 +15225,11 @@ static int bnxt_queue_mem_alloc(struct net_device *dev, void *qmem, int idx) err_rxq_info_unreg:xdp_rxq_info_unreg (&clone->xdp_rxq); err_page_pool_destroy: - clone->page_pool->p.napi =NULL ;page_pool_destroy (clone->page_pool); +if (bnxt_separate_head_pool ()) +page_pool_destroy (clone->head_pool); clone->page_pool =NULL ; + clone->head_pool =NULL ;return rc; }
@@ -15227,13 +15239,15 @@ static void bnxt_queue_mem_free(struct net_device *dev, void *qmem)struct bnxt *bp =netdev_priv (dev);struct bnxt_ring_struct *ring; -bnxt_free_one_rx_ring (bp, rxr); -bnxt_free_one_rx_agg_ring (bp, rxr); +bnxt_free_one_rx_ring_skbs (bp, rxr);xdp_rxq_info_unreg (&rxr->xdp_rxq);page_pool_destroy (rxr->page_pool); +if (bnxt_separate_head_pool ()) +page_pool_destroy (rxr->head_pool); rxr->page_pool =NULL ; + rxr->head_pool =NULL ; ring = &rxr->rx_ring_struct;bnxt_free_ring (bp, &ring->ring_mem);
@@ -15315,7 +15329,10 @@ static int bnxt_queue_start(struct net_device *dev, void *qmem, int idx) rxr->rx_agg_prod = clone->rx_agg_prod; rxr->rx_sw_agg_prod = clone->rx_sw_agg_prod; rxr->rx_next_cons = clone->rx_next_cons; + rxr->rx_tpa = clone->rx_tpa; + rxr->rx_tpa_idx_map = clone->rx_tpa_idx_map; rxr->page_pool = clone->page_pool; + rxr->head_pool = clone->head_pool; rxr->xdp_rxq = clone->xdp_rxq;bnxt_copy_rx_ring (bp, rxr, clone);
@@ -15376,6 +15393,8 @@ static int bnxt_queue_stop(struct net_device *dev, void *qmem, int idx)bnxt_hwrm_rx_agg_ring_free (bp, rxr, false); rxr->rx_next_cons =0 ;page_pool_disable_direct_recycling (rxr->page_pool); +if (bnxt_separate_head_pool ()) +page_pool_disable_direct_recycling (rxr->head_pool);memcpy (qmem, rxr,sizeof (*rxr));bnxt_init_rx_ring_struct (bp, qmem);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 38/231 eth: bnxt: fix memory leak in queue reset
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taehee Yoo <[email protected]>
[ Upstream commit 87dd2850835dd7886726b428a8ef7d73a60520c7 ]
When the queue is reset, the bnxt_alloc_one_tpa_info() is called to allocate tpa_info for the new queue.
And then the old queue's tpa_info should be removed by the bnxt_free_one_tpa_info(), but it is not called.
So memory leak occurs.
It adds the bnxt_free_one_tpa_info() in the bnxt_queue_mem_free().
unreferenced object 0xffff888293cc0000 (size 16384):
comm "ncdevmem", pid 2076, jiffies 4296604081 hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 40 75 78 93 82 88 ff ff ........@ux.....
40 75 78 93 02 00 00 00 00 00 00 00 00 00 00 00 @ux.............
backtrace (crc 5d7d4798):
___kmalloc_large_node+0x10d/0x1b0
__kmalloc_large_node_noprof+0x17/0x60
__kmalloc_noprof+0x3f6/0x520
bnxt_alloc_one_tpa_info+0x5f/0x300 [bnxt_en]
bnxt_queue_mem_alloc+0x8e8/0x14f0 [bnxt_en]
netdev_rx_queue_restart+0x233/0x620
net_devmem_bind_dmabuf_to_queue+0x2a3/0x600
netdev_nl_bind_rx_doit+0xc00/0x10a0
genl_family_rcv_msg_doit+0x1d4/0x2b0
genl_rcv_msg+0x3fb/0x6c0
netlink_rcv_skb+0x12c/0x360
genl_rcv+0x24/0x40
netlink_unicast+0x447/0x710
netlink_sendmsg+0x712/0xbc0
__sys_sendto+0x3fd/0x4d0
__x64_sys_sendto+0xdc/0x1b0--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +1 -0
@@ -15240,6 +15240,7 @@ static void bnxt_queue_mem_free(struct net_device *dev, void *qmem)struct bnxt_ring_struct *ring;bnxt_free_one_rx_ring_skbs (bp, rxr); +bnxt_free_one_tpa_info (bp, rxr);xdp_rxq_info_unreg (&rxr->xdp_rxq);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 39/231 net: switchdev: Convert blocking notification chain to a raw one
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amit Cohen <[email protected]>
[ Upstream commit 62531a1effa87bdab12d5104015af72e60d926ff ]
A blocking notification chain uses a read-write semaphore to protect the integrity of the chain. The semaphore is acquired for writing when adding / removing notifiers to / from the chain and acquired for reading when traversing the chain and informing notifiers about an event.
In case of the blocking switchdev notification chain, recursive notifications are possible which leads to the semaphore being acquired twice for reading and to lockdep warnings being generated [1].
Specifically, this can happen when the bridge driver processes a SWITCHDEV_BRPORT_UNOFFLOADED event which causes it to emit notifications about deferred events when calling switchdev_deferred_process().
Fix this by converting the notification chain to a raw notification chain in a similar fashion to the netdev notification chain. Protect the chain using the RTNL mutex by acquiring it when modifying the chain. Events are always informed under the RTNL mutex, but add an assertion in call_switchdev_blocking_notifiers() to make sure this is not violated in the future.
Maintain the "blocking" prefix as events are always emitted from process context and listeners are allowed to block.
[1]:
WARNING: possible recursive locking detected
6.14.0-rc4-custom-g079270089484 #1 Not tainted
--------------------------------------------
ip/52731 is trying to acquire lock:ffffffff850918d8 ((switchdev_blocking_notif_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x58/0xa0
but task is already holding lock:ffffffff850918d8 ((switchdev_blocking_notif_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x58/0xa0
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock((switchdev_blocking_notif_chain).rwsem);
lock((switchdev_blocking_notif_chain).rwsem);
*** DEADLOCK ***
May be due to missing lock nesting notation
3 locks held by ip/52731:
#0: ffffffff84f795b0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x727/0x1dc0
#1: ffffffff8731f628 (&net->rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x790/0x1dc0
#2: ffffffff850918d8 ((switchdev_blocking_notif_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x58/0xa0
stack backtrace: ... ? __pfx_down_read+0x10/0x10 ? __pfx_mark_lock+0x10/0x10 ? __pfx_switchdev_port_attr_set_deferred+0x10/0x10 blocking_notifier_call_chain+0x58/0xa0 switchdev_port_attr_notify.constprop.0+0xb3/0x1b0 ? __pfx_switchdev_port_attr_notify.constprop.0+0x10/0x10 ? mark_held_locks+0x94/0xe0 ? switchdev_deferred_process+0x11a/0x340 switchdev_port_attr_set_deferred+0x27/0xd0 switchdev_deferred_process+0x164/0x340 br_switchdev_port_unoffload+0xc8/0x100 [bridge] br_switchdev_blocking_event+0x29f/0x580 [bridge] notifier_call_chain+0xa2/0x440 blocking_notifier_call_chain+0x6e/0xa0 switchdev_bridge_port_unoffload+0xde/0x1a0
...
--- net/switchdev/switchdev.c | 25 ++++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-)
net/switchdev/switchdev.c +18 -7
@@ -472,7 +472,7 @@ bool switchdev_port_obj_act_is_deferred(struct net_device *dev,EXPORT_SYMBOL_GPL (switchdev_port_obj_act_is_deferred);static ATOMIC_NOTIFIER_HEAD (switchdev_notif_chain); -static BLOCKING_NOTIFIER_HEAD (switchdev_blocking_notif_chain); +static RAW_NOTIFIER_HEAD (switchdev_blocking_notif_chain);/** * register_switchdev_notifier - Register notifier
@@ -518,17 +518,27 @@ EXPORT_SYMBOL_GPL(call_switchdev_notifiers);int register_switchdev_blocking_notifier (struct notifier_block *nb) { -struct blocking_notifier_head *chain = &switchdev_blocking_notif_chain; +struct raw_notifier_head *chain = &switchdev_blocking_notif_chain; +int err; + +rtnl_lock (); + err =raw_notifier_chain_register (chain, nb); +rtnl_unlock (); -return blocking_notifier_chain_register (chain, nb); +return err; }EXPORT_SYMBOL_GPL (register_switchdev_blocking_notifier);int unregister_switchdev_blocking_notifier (struct notifier_block *nb) { -struct blocking_notifier_head *chain = &switchdev_blocking_notif_chain; +struct raw_notifier_head *chain = &switchdev_blocking_notif_chain; +int err; -return blocking_notifier_chain_unregister (chain, nb); +rtnl_lock (); + err =raw_notifier_chain_unregister (chain, nb); +rtnl_unlock (); + +return err; }EXPORT_SYMBOL_GPL (unregister_switchdev_blocking_notifier);
@@ -536,10 +546,11 @@ int call_switchdev_blocking_notifiers(unsigned long val, struct net_device *dev,struct switchdev_notifier_info *info, struct netlink_ext_ack *extack) { +ASSERT_RTNL (); info->dev = dev; info->extack = extack; -return blocking_notifier_call_chain (&switchdev_blocking_notif_chain, - val, info); +return raw_notifier_call_chain (&switchdev_blocking_notif_chain, + val, info); }EXPORT_SYMBOL_GPL (call_switchdev_blocking_notifiers);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 40/231 net: mctp: unshare packets when reassembling
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Johnston <[email protected]>
[ Upstream commit f5d83cf0eeb90fade4d5c4d17d24b8bee9ceeecc ]
Ensure that the frag_list used for reassembly isn't shared with other packets. This avoids incorrect reassembly when packets are cloned, and prevents a memory leak due to circular references between fragments and their skb_shared_info.
The upcoming MCTP-over-USB driver uses skb_clone which can trigger the problem - other MCTP drivers don't share SKBs.
A kunit test is added to reproduce the issue.
--- net/mctp/route.c | 10 +++- net/mctp/test/route-test.c | 109 +++++++++++++++++++++++++++++++++++++ 2 files changed, 117 insertions(+), 2 deletions(-)
net/mctp/route.c +8 -2
@@ -332,8 +332,14 @@ static int mctp_frag_queue(struct mctp_sk_key *key, struct sk_buff *skb) &MCTP_HDR_SEQ_MASK ;if (!key->reasm_head) { - key->reasm_head = skb; - key->reasm_tailp = &(skb_shinfo (skb)->frag_list); +/* Since we're manipulating the shared frag_list, ensure it isn't +* shared with any other SKBs. +*/ + key->reasm_head =skb_unshare (skb,GFP_ATOMIC ); +if (!key->reasm_head) +return -ENOMEM ; + + key->reasm_tailp = &(skb_shinfo (key->reasm_head)->frag_list); key->last_seq = this_seq;return 0 ; }
net/mctp/test/route-test.c +109 -0
121 lines not on this page · raw message
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 41/231 bonding: fix incorrect MAC address setting to receive NS messages
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <[email protected]>
[ Upstream commit 0c5e145a350de3b38cd5ae77a401b12c46fb7c1d ]
When validation on the backup slave is enabled, we need to validate the Neighbor Solicitation (NS) messages received on the backup slave. To receive these messages, the correct destination MAC address must be added to the slave. However, the target in bonding is a unicast address, which we cannot use directly. Instead, we should first convert it to a Solicited-Node Multicast Address and then derive the corresponding MAC address.
Fix the incorrect MAC address setting on both slave_set_ns_maddr() and slave_set_ns_maddrs(). Since the two function names are similar. Add some description for the functions. Also only use one mac_addr variable in slave_set_ns_maddr() to save some code and logic.
--- drivers/net/bonding/bond_options.c | 55 +++++++++++++++++++++++++----- 1 file changed, 47 insertions(+), 8 deletions(-)
drivers/net/bonding/bond_options.c +47 -8
@@ -1242,10 +1242,28 @@ static bool slave_can_set_ns_maddr(const struct bonding *bond, struct slave *sla slave->dev->flags &IFF_MULTICAST ; } +/** +* slave_set_ns_maddrs - add/del all NS mac addresses for slave +* @bond: bond device +* @slave: slave device +* @add: add or remove all the NS mac addresses +* +* This function tries to add or delete all the NS mac addresses on the slave +* +* Note, the IPv6 NS target address is the unicast address in Neighbor +* Solicitation (NS) message. The dest address of NS message should be +* solicited-node multicast address of the target. The dest mac of NS message +* is converted from the solicited-node multicast address. +* +* This function is called when +* * arp_validate changes +* * enslaving, releasing new slaves +*/ static void slave_set_ns_maddrs (struct bonding *bond,struct slave *slave,bool add) {struct in6_addr *targets = bond->params.ns_targets;char slot_maddr[MAX_ADDR_LEN ]; +struct in6_addr mcaddr;int i;if (!slave_can_set_ns_maddr (bond, slave))
@@ -1255,7 +1273,8 @@ static void slave_set_ns_maddrs(struct bonding *bond, struct slave *slave, boolif (ipv6_addr_any (&targets[i]))break ; -if (!ndisc_mc_map (&targets[i], slot_maddr, slave->dev,0 )) { +addrconf_addr_solict_mult (&targets[i], &mcaddr); +if (!ndisc_mc_map (&mcaddr, slot_maddr, slave->dev,0 )) {if (add)dev_mc_add (slave->dev, slot_maddr);else
@@ -1278,23 +1297,43 @@ void bond_slave_ns_maddrs_del(struct bonding *bond, struct slave *slave)slave_set_ns_maddrs (bond, slave, false); } +/** +* slave_set_ns_maddr - set new NS mac address for slave +* @bond: bond device +* @slave: slave device +* @target: the new IPv6 target +* @slot: the old IPv6 target in the slot +* +* This function tries to replace the old mac address to new one on the slave. +* +* Note, the target/slot IPv6 address is the unicast address in Neighbor +* Solicitation (NS) message. The dest address of NS message should be +* solicited-node multicast address of the target. The dest mac of NS message +* is converted from the solicited-node multicast address. +* +* This function is called when +* * An IPv6 NS target is added or removed. +*/ static void slave_set_ns_maddr (struct bonding *bond,struct slave *slave,struct in6_addr *target,struct in6_addr *slot) { -char target_maddr[MAX_ADDR_LEN ], slot_maddr[MAX_ADDR_LEN ]; +char mac_addr[MAX_ADDR_LEN ]; +struct in6_addr mcast_addr;if (!bond->params.arp_validate || !slave_can_set_ns_maddr (bond, slave))return ; -/* remove the previous maddr from slave */ +/* remove the previous mac addr from slave */ +addrconf_addr_solict_mult (slot, &mcast_addr);if (!ipv6_addr_any (slot) && - !ndisc_mc_map (slot, slot_maddr, slave->dev,0 )) -dev_mc_del (slave->dev, slot_maddr); + !ndisc_mc_map (&mcast_addr, mac_addr, slave->dev,0 )) +dev_mc_del (slave->dev, mac_addr); -/* add new maddr on slave if target is set */ +/* add new mac addr on slave if target is set */ +addrconf_addr_solict_mult (target, &mcast_addr);if (!ipv6_addr_any (target) && - !ndisc_mc_map (target, target_maddr, slave->dev,0 )) -dev_mc_add (slave->dev, target_maddr); + !ndisc_mc_map (&mcast_addr, mac_addr, slave->dev,0 )) +dev_mc_add (slave->dev, mac_addr); } static void _bond_options_ns_ip6_target_set(struct bonding *bond, int slot,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 42/231 selftests: bonding: fix incorrect mac address
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <[email protected]>
[ Upstream commit 9318dc2357b6b8b2ea1200ab7f2d5877851b7382 ]
The correct mac address for NS target 2001:db8::254 is 33:33:ff:00:02:54, not 33:33:00:00:02:54. The same with client maddress.
--- tools/testing/selftests/drivers/net/bonding/bond_options.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/testing/selftests/drivers/net/bonding/bond_options.sh +2 -2
@@ -11,8 +11,8 @@ ALL_TESTS=" lib_dir=$(dirname "$0") source ${lib_dir}/bond_topo_3d1c.sh -c_maddr="33:33:00:00:00:10" -g_maddr="33:33:00:00:02:54" +c_maddr="33:33:ff:00:00:10" +g_maddr="33:33:ff:00:02:54" skip_prio() {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 43/231 rtase: Fix improper release of ring list entries in rtase_sw_reset
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Lai <[email protected]>
[ Upstream commit 415f135ace7fd824cde083184a922e39156055b5 ]
Since rtase_init_ring, which is called within rtase_sw_reset, adds ring entries already present in the ring list back into the list, it causes the ring list to form a cycle. This results in list_for_each_entry_safe failing to find an endpoint during traversal, leading to an error. Therefore, it is necessary to remove the previously added ring_list nodes before calling rtase_init_ring.
--- drivers/net/ethernet/realtek/rtase/rtase_main.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/net/ethernet/realtek/rtase/rtase_main.c +10 -0
@@ -1501,7 +1501,10 @@ static void rtase_wait_for_quiescence(const struct net_device *dev)static void rtase_sw_reset (struct net_device *dev) {struct rtase_private *tp =netdev_priv (dev); +struct rtase_ring *ring, *tmp; +struct rtase_int_vector *ivec;int ret; +u32 i;netif_stop_queue (dev);netif_carrier_off (dev);
@@ -1512,6 +1515,13 @@ static void rtase_sw_reset(struct net_device *dev)rtase_tx_clear (tp);rtase_rx_clear (tp); +for (i =0 ; i < tp->int_nums; i++) { + ivec = &tp->int_vector[i]; +list_for_each_entry_safe (ring, tmp, &ivec->ring_list, + ring_entry) +list_del (&ring->ring_entry); + } + ret =rtase_init_ring (dev);if (ret) {netdev_err (dev,"unable to init ring\n" );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 44/231 netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kohei Enju <[email protected]>
[ Upstream commit d653bfeb07ebb3499c403404c21ac58a16531607 ]
Since commit b36e4523d4d5 ("netfilter: nf_conncount: fix garbage collection confirm race"), cpu and jiffies32 were introduced to the struct nf_conncount_tuple.
The commit made nf_conncount_add() initialize conn->cpu and conn->jiffies32 when allocating the struct.
In contrast, count_tree() was not changed to initialize them.
By commit 34848d5c896e ("netfilter: nf_conncount: Split insert and traversal"), count_tree() was split and the relevant allocation code now resides in insert_tree().
Initialize conn->cpu and conn->jiffies32 in insert_tree().
BUG: KMSAN: uninit-value in find_or_evict net/netfilter/nf_conncount.c:117 [inline] BUG: KMSAN: uninit-value in __nf_conncount_add+0xd9c/0x2850 net/netfilter/nf_conncount.c:143 find_or_evict net/netfilter/nf_conncount.c:117 [inline] __nf_conncount_add+0xd9c/0x2850 net/netfilter/nf_conncount.c:143 count_tree net/netfilter/nf_conncount.c:438 [inline] nf_conncount_count+0x82f/0x1e80 net/netfilter/nf_conncount.c:521 connlimit_mt+0x7f6/0xbd0 net/netfilter/xt_connlimit.c:72 __nft_match_eval net/netfilter/nft_compat.c:403 [inline] nft_match_eval+0x1a5/0x300 net/netfilter/nft_compat.c:433 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x426/0x2290 net/netfilter/nf_tables_core.c:288 nft_do_chain_ipv4+0x1a5/0x230 net/netfilter/nft_chain_filter.c:23 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626 nf_hook_slow_list+0x24d/0x860 net/netfilter/core.c:663 NF_HOOK_LIST include/linux/netfilter.h:350 [inline] ip_sublist_rcv+0x17b7/0x17f0 net/ipv4/ip_input.c:633 ip_list_rcv+0x9ef/0xa40 net/ipv4/ip_input.c:669 __netif_receive_skb_list_ptype net/core/dev.c:5936 [inline] __netif_receive_skb_list_core+0x15c5/0x1670 net/core/dev.c:5983 __netif_receive_skb_list net/core/dev.c:6035 [inline] netif_receive_skb_list_internal+0x1085/0x1700 net/core/dev.c:6126 netif_receive_skb_list+0x5a/0x460 net/core/dev.c:6178 xdp_recv_frames net/bpf/test_run.c:280 [inline] xdp_test_run_batch net/bpf/test_run.c:361 [inline] bpf_test_run_xdp_live+0x2e86/0x3480 net/bpf/test_run.c:390 bpf_prog_test_run_xdp+0xf1d/0x1ae0 net/bpf/test_run.c:1316 bpf_prog_test_run+0x5e5/0xa30 kernel/bpf/syscall.c:4407 __sys_bpf+0x6aa/0xd90 kernel/bpf/syscall.c:5813 __do_sys_bpf kernel/bpf/syscall.c:5902 [inline] __se_sys_bpf kernel/bpf/syscall.c:5900 [inline] __ia32_sys_bpf+0xa0/0xe0 kernel/bpf/syscall.c:5900 ia32_sys_call+0x394d/0x4180 arch/x86/include/generated/asm/syscalls_32.h:358 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline] __do_fast_syscall_32+0xb0/0x110 arch/x86/entry/common.c:387 do_fast_syscall_32+0x38/0x80 arch/x86/entry/common.c:412 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:450 entry_SYSENTER_compat_after_hwframe+0x84/0x8e
Uninit was created at:
slab_post_alloc_hook mm/slub.c:4121 [inline] slab_alloc_node mm/slub.c:4164 [inline] kmem_cache_alloc_noprof+0x915/0xe10 mm/slub.c:4171 insert_tree net/netfilter/nf_conncount.c:372 [inline] count_tree net/netfilter/nf_conncount.c:450 [inline] nf_conncount_count+0x1415/0x1e80 net/netfilter/nf_conncount.c:521 connlimit_mt+0x7f6/0xbd0 net/netfilter/xt_connlimit.c:72 __nft_match_eval net/netfilter/nft_compat.c:403 [inline] nft_match_eval+0x1a5/0x300 net/netfilter/nft_compat.c:433 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x426/0x2290 net/netfilter/nf_tables_core.c:288 nft_do_chain_ipv4+0x1a5/0x230 net/netfilter/nft_chain_filter.c:23 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626 nf_hook_slow_list+0x24d/0x860 net/netfilter/core.c:663 NF_HOOK_LIST include/linux/netfilter.h:350 [inline] ip_sublist_rcv+0x17b7/0x17f0 net/ipv4/ip_input.c:633 ip_list_rcv+0x9ef/0xa40 net/ipv4/ip_input.c:669 __netif_receive_skb_list_ptype net/core/dev.c:5936 [inline] __netif_receive_skb_list_core+0x15c5/0x1670 net/core/dev.c:5983 __netif_receive_skb_list net/core/dev.c:6035 [inline] netif_receive_skb_list_internal+0x1085/0x1700 net/core/dev.c:6126 netif_receive_skb_list+0x5a/0x460 net/core/dev.c:6178 xdp_recv_frames net/bpf/test_run.c:280 [inline] xdp_test_run_batch net/bpf/test_run.c:361 [inline] bpf_test_run_xdp_live+0x2e86/0x3480 net/bpf/test_run.c:390 bpf_prog_test_run_xdp+0xf1d/0x1ae0 net/bpf/test_run.c:1316 bpf_prog_test_run+0x5e5/0xa30 kernel/bpf/syscall.c:4407 __sys_bpf+0x6aa/0xd90 kernel/bpf/syscall.c:5813 __do_sys_bpf kernel/bpf/syscall.c:5902 [inline] __se_sys_bpf kernel/bpf/syscall.c:5900 [inline] __ia32_sys_bpf+0xa0/0xe0 kernel/bpf/syscall.c:5900 ia32_sys_call+0x394d/0x4180 arch/x86/include/generated/asm/syscalls_32.h:358 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline] __do_fast_syscall_32+0xb0/0x110 arch/x86/entry/common.c:387 do_fast_syscall_32+0x38/0x80 arch/x86/entry/common.c:412 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:450 entry_SYSENTER_compat_after_hwframe+0x84/0x8e
--- net/netfilter/nf_conncount.c | 2 ++ 1 file changed, 2 insertions(+)
net/netfilter/nf_conncount.c +2 -0
@@ -377,6 +377,8 @@ insert_tree(struct net *net, conn->tuple = *tuple; conn->zone = *zone; + conn->cpu =raw_smp_processor_id (); + conn->jiffies32 = (u32 )jiffies;memcpy (rbconn->key, key,sizeof (u32) * data->keylen);nf_conncount_list_init (&rbconn->list);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 45/231 ipvs: prevent integer overflow in do_ip_vs_get_ctl()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 80b78c39eb86e6b55f56363b709eb817527da5aa ]
The get->num_services variable is an unsigned int which is controlled by the user. The struct_size() function ensures that the size calculation does not overflow an unsigned long, however, we are saving the result to an int so the calculation can overflow.
Both "len" and "get->num_services" come from the user. This check is just a sanity check to help the user and ensure they are using the API correctly. An integer overflow here is not a big deal. This has no security impact.
Save the result from struct_size() type size_t to fix this integer overflow bug.
--- net/netfilter/ipvs/ip_vs_ctl.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
net/netfilter/ipvs/ip_vs_ctl.c +4 -4
@@ -3091,12 +3091,12 @@ do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)case IP_VS_SO_GET_SERVICES : {struct ip_vs_get_services *get; -int size; +size_t size; get = (struct ip_vs_get_services *)arg; size =struct_size (get, entrytable, get->num_services);if (*len != size) { -pr_err ("length: %u != %u\n" , *len, size); +pr_err ("length: %u != %zu\n" , *len, size); ret = -EINVAL ; goto out; }
@@ -3132,12 +3132,12 @@ do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)case IP_VS_SO_GET_DESTS : {struct ip_vs_get_dests *get; -int size; +size_t size; get = (struct ip_vs_get_dests *)arg; size =struct_size (get, entrytable, get->num_dests);if (*len != size) { -pr_err ("length: %u != %u\n" , *len, size); +pr_err ("length: %u != %zu\n" , *len, size); ret = -EINVAL ; goto out; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 46/231 net_sched: Prevent creation of classes with TC_H_ROOT
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cong Wang <[email protected]>
[ Upstream commit 0c3057a5a04d07120b3d0ec9c79568fceb9c921e ]
The function qdisc_tree_reduce_backlog() uses TC_H_ROOT as a termination condition when traversing up the qdisc tree to update parent backlog counters. However, if a class is created with classid TC_H_ROOT, the traversal terminates prematurely at this class instead of reaching the actual root qdisc, causing parent statistics to be incorrectly maintained. In case of DRR, this could lead to a crash as reported by Mingi Cho.
Prevent the creation of any Qdisc class with classid TC_H_ROOT (0xFFFFFFFF) across all qdisc types, as suggested by Jamal.
--- net/sched/sch_api.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/sched/sch_api.c +6 -0
@@ -2254,6 +2254,12 @@ static int tc_ctl_tclass(struct sk_buff *skb, struct nlmsghdr *n,return -EOPNOTSUPP ; } +/* Prevent creation of traffic classes with classid TC_H_ROOT */ +if (clid ==TC_H_ROOT ) { +NL_SET_ERR_MSG (extack,"Cannot create traffic class with classid TC_H_ROOT" ); +return -EINVAL ; + } + new_cl = cl; err = -EOPNOTSUPP ;if (cops->change)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 47/231 netfilter: nft_exthdr: fix offset with ipv4_find_option()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Kashavkin <[email protected]>
[ Upstream commit 6edd78af9506bb182518da7f6feebd75655d9a0e ]
There is an incorrect calculation in the offset variable which causes the nft_skb_copy_to_reg() function to always return -EFAULT. Adding the start variable is redundant. In the __ip_options_compile() function the correct offset is specified when finding the function. There is no need to add the size of the iphdr structure to the offset.
--- net/netfilter/nft_exthdr.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
net/netfilter/nft_exthdr.c +4 -6
@@ -85,7 +85,6 @@ static int ipv4_find_option(struct net *net, struct sk_buff *skb,unsigned char optbuf[sizeof (struct ip_options ) +40 ];struct ip_options *opt = (struct ip_options *)optbuf;struct iphdr *iph, _iph; -unsigned int start;bool found = false;__be32 info;int optlen;
@@ -93,7 +92,6 @@ static int ipv4_find_option(struct net *net, struct sk_buff *skb, iph =skb_header_pointer (skb,0 ,sizeof (_iph), &_iph);if (!iph)return -EBADMSG ; - start =sizeof (struct iphdr ); optlen = iph->ihl *4 - (int )sizeof (struct iphdr );if (optlen <=0 )
@@ -103,7 +101,7 @@ static int ipv4_find_option(struct net *net, struct sk_buff *skb,/* Copy the options since __ip_options_compile() modifies * the options. */ -if (skb_copy_bits (skb, start, opt->__data, optlen)) +if (skb_copy_bits (skb,sizeof (struct iphdr ), opt->__data, optlen))return -EBADMSG ; opt->optlen = optlen;
@@ -118,18 +116,18 @@ static int ipv4_find_option(struct net *net, struct sk_buff *skb, found = target ==IPOPT_SSRR ? opt->is_strictroute : !opt->is_strictroute;if (found) - *offset = opt->srr + start; + *offset = opt->srr;break ;case IPOPT_RR :if (!opt->rr)break ; - *offset = opt->rr + start; + *offset = opt->rr; found = true;break ;case IPOPT_RA :if (!opt->router_alert)break ; - *offset = opt->router_alert + start; + *offset = opt->router_alert; found = true;break ;default :
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 48/231 gre: Fix IPv6 link-local address generation.
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Nault <[email protected]>
[ Upstream commit 183185a18ff96751db52a46ccf93fff3a1f42815 ]
Use addrconf_addr_gen() to generate IPv6 link-local addresses on GRE devices in most cases and fall back to using add_v4_addrs() only in case the GRE configuration is incompatible with addrconf_addr_gen().
GRE used to use addrconf_addr_gen() until commit e5dd729460ca ("ip/ip6_gre: use the same logic as SIT interfaces when computing v6LL address") restricted this use to gretap and ip6gretap devices, and created add_v4_addrs() (borrowed from SIT) for non-Ethernet GRE ones.
The original problem came when commit 9af28511be10 ("addrconf: refuse isatap eui64 for INADDR_ANY") made __ipv6_isatap_ifid() fail when its addr parameter was 0. The commit says that this would create an invalid address, however, I couldn't find any RFC saying that the generated interface identifier would be wrong. Anyway, since gre over IPv4 devices pass their local tunnel address to __ipv6_isatap_ifid(), that commit broke their IPv6 link-local address generation when the local address was unspecified.
Then commit e5dd729460ca ("ip/ip6_gre: use the same logic as SIT interfaces when computing v6LL address") tried to fix that case by defining add_v4_addrs() and calling it to generate the IPv6 link-local address instead of using addrconf_addr_gen() (apart for gretap and ip6gretap devices, which would still use the regular addrconf_addr_gen(), since they have a MAC address).
That broke several use cases because add_v4_addrs() isn't properly integrated into the rest of IPv6 Neighbor Discovery code. Several of these shortcomings have been fixed over time, but add_v4_addrs() remains broken on several aspects. In particular, it doesn't send any Router Sollicitations, so the SLAAC process doesn't start until the interface receives a Router Advertisement. Also, add_v4_addrs() mostly ignores the address generation mode of the interface (/proc/sys/net/ipv6/conf/*/addr_gen_mode), thus breaking the IN6_ADDR_GEN_MODE_RANDOM and IN6_ADDR_GEN_MODE_STABLE_PRIVACY cases.
Fix the situation by using add_v4_addrs() only in the specific scenario where the normal method would fail. That is, for interfaces that have all of the following characteristics:
* run over IPv4,
* transport IP packets directly, not Ethernet (that is, not gretap interfaces),
* tunnel endpoint is INADDR_ANY (that is, 0),
* device address generation mode is EUI64.
In all other cases, revert back to the regular addrconf_addr_gen().
Also, remove the special case for ip6gre interfaces in add_v4_addrs(), since ip6gre devices now always use addrconf_addr_gen() instead.
--- net/ipv6/addrconf.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
net/ipv6/addrconf.c +9 -6
@@ -3237,16 +3237,13 @@ static void add_v4_addrs(struct inet6_dev *idev)struct in6_addr addr;struct net_device *dev;struct net *net =dev_net (idev->dev); -int scope, plen, offset =0 ; +int scope, plen;u32 pflags =0 ;ASSERT_RTNL ();memset (&addr,0 ,sizeof (struct in6_addr )); -/* in case of IP6GRE the dev_addr is an IPv6 and therefore we use only the last 4 bytes */ -if (idev->dev->addr_len ==sizeof (struct in6_addr )) - offset =sizeof (struct in6_addr ) -4 ; -memcpy (&addr.s6_addr32[3 ], idev->dev->dev_addr + offset,4 ); +memcpy (&addr.s6_addr32[3 ], idev->dev->dev_addr,4 );if (!(idev->dev->flags &IFF_POINTOPOINT ) && idev->dev->type ==ARPHRD_SIT ) { scope = IPV6_ADDR_COMPATv4;
@@ -3557,7 +3554,13 @@ static void addrconf_gre_config(struct net_device *dev)return ; } -if (dev->type ==ARPHRD_ETHER ) { +/* Generate the IPv6 link-local address using addrconf_addr_gen(), +* unless we have an IPv4 GRE device not bound to an IP address and +* which is in EUI64 mode (as __ipv6_isatap_ifid() would fail in this +* case). Such devices fall back to add_v4_addrs() instead. +*/ +if (!(dev->type ==ARPHRD_IPGRE && *(__be32 *)dev->dev_addr ==0 && + idev->cnf.addr_gen_mode ==IN6_ADDR_GEN_MODE_EUI64 )) {addrconf_addr_gen (idev, true);return ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 49/231 net: openvswitch: remove misbehaving actions length check
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Maximets <[email protected]>
[ Upstream commit a1e64addf3ff9257b45b78bc7d743781c3f41340 ]
The actions length check is unreliable and produces different results depending on the initial length of the provided netlink attribute and the composition of the actual actions inside of it. For example, a user can add 4088 empty clone() actions without triggering -EMSGSIZE, on attempt to add 4089 such actions the operation will fail with the -EMSGSIZE verdict. However, if another 16 KB of other actions will be *appended* to the previous 4089 clone() actions, the check passes and the flow is successfully installed into the openvswitch datapath.
The reason for a such a weird behavior is the way memory is allocated. When ovs_flow_cmd_new() is invoked, it calls ovs_nla_copy_actions(), that in turn calls nla_alloc_flow_actions() with either the actual length of the user-provided actions or the MAX_ACTIONS_BUFSIZE. The function adds the size of the sw_flow_actions structure and then the actually allocated memory is rounded up to the closest power of two.
So, if the user-provided actions are larger than MAX_ACTIONS_BUFSIZE, then MAX_ACTIONS_BUFSIZE + sizeof(*sfa) rounded up is 32K + 24 -> 64K. Later, while copying individual actions, we look at ksize(), which is 64K, so this way the MAX_ACTIONS_BUFSIZE check is not actually triggered and the user can easily allocate almost 64 KB of actions.
However, when the initial size is less than MAX_ACTIONS_BUFSIZE, but the actions contain ones that require size increase while copying (such as clone() or sample()), then the limit check will be performed during the reserve_sfa_size() and the user will not be allowed to create actions that yield more than 32 KB internally.
This is one part of the problem. The other part is that it's not actually possible for the userspace application to know beforehand if the particular set of actions will be rejected or not.
Certain actions require more space in the internal representation, e.g. an empty clone() takes 4 bytes in the action list passed in by the user, but it takes 12 bytes in the internal representation due to an extra nested attribute, and some actions require less space in the internal representations, e.g. set(tunnel(..)) normally takes 64+ bytes in the action list provided by the user, but only needs to store a single pointer in the internal implementation, since all the data is stored in the tunnel_info structure instead.
And the action size limit is applied to the internal representation, not to the action list passed by the user. So, it's not possible for the userpsace application to predict if the certain combination of actions will be rejected or not, because it is not possible for it to calculate how much space these actions will take in the internal representation without knowing kernel internals.
All that is causing random failures in ovs-vswitchd in userspace and inability to handle certain traffic patterns as a result. For example, it is reported that adding a bit more than a 1100 VMs in an OpenStack setup breaks the network due to OVS not being able to handle ARP traffic anymore in some cases (it tries to install a proper datapath flow, but the kernel rejects it with -EMSGSIZE, even though the action list isn't actually that large.)
Kernel behavior must be consistent and predictable in order for the userspace application to use it in a reasonable way. ovs-vswitchd has a mechanism to re-direct parts of the traffic and partially handle it in userspace if the required action list is oversized, but that doesn't work properly if we can't actually tell if the action list is oversized or not.
Solution for this is to check the size of the user-provided actions instead of the internal representation. This commit just removes the check from the internal part because there is already an implicit size check imposed by the netlink protocol. The attribute can't be larger than 64 KB. Realistically, we could reduce the limit to 32 KB, but we'll be risking to break some existing setups that rely on the fact that it's possible to create nearly 64 KB action lists today.
Vast majority of flows in real setups are below 100-ish bytes. So removal of the limit will not change real memory consumption on the system. The absolutely worst case scenario is if someone adds a flow with 64 KB of empty clone() actions. That will yield a 192 KB in the internal representation consuming 256 KB block of memory. However, that list of actions is not meaningful and also a no-op. Real world very large action lists (that can occur for a rare cases of BUM traffic handling) are unlikely to contain a large number of clones and will likely have a lot of tunnel attributes making the internal representation comparable in size to the original action list. So, it should be fine to just remove the limit.
Commit in the 'Fixes' tag is the first one that introduced the difference between internal representation and the user-provided action lists, but there were many more afterwards that lead to the situation we have today.
--- net/openvswitch/flow_netlink.c | 15 +-------------- 1 file changed, 1 insertion(+), 14 deletions(-)
net/openvswitch/flow_netlink.c +1 -14
@@ -2317,14 +2317,10 @@ int ovs_nla_put_mask(const struct sw_flow *flow, struct sk_buff *skb) OVS_FLOW_ATTR_MASK, true, skb); } -#define MAX_ACTIONS_BUFSIZE (32 * 1024) -static struct sw_flow_actions *nla_alloc_flow_actions (int size) {struct sw_flow_actions *sfa; -WARN_ON_ONCE (size >MAX_ACTIONS_BUFSIZE ); - sfa =kmalloc (kmalloc_size_roundup (sizeof (*sfa) + size),GFP_KERNEL );if (!sfa)return ERR_PTR (-ENOMEM );
@@ -2480,15 +2476,6 @@ static struct nlattr *reserve_sfa_size(struct sw_flow_actions **sfa, new_acts_size =max (next_offset + req_size,ksize (*sfa) *2 ); -if (new_acts_size >MAX_ACTIONS_BUFSIZE ) { -if ((next_offset + req_size) >MAX_ACTIONS_BUFSIZE ) { -OVS_NLERR (log,"Flow action size exceeds max %u" , -MAX_ACTIONS_BUFSIZE ); -return ERR_PTR (-EMSGSIZE ); - } - new_acts_size =MAX_ACTIONS_BUFSIZE ; - } - acts =nla_alloc_flow_actions (new_acts_size);if (IS_ERR (acts))return ERR_CAST (acts);
@@ -3545,7 +3532,7 @@ int ovs_nla_copy_actions(struct net *net, const struct nlattr *attr,int err;u32 mpls_label_count =0 ; - *sfa =nla_alloc_flow_actions (min (nla_len (attr),MAX_ACTIONS_BUFSIZE )); + *sfa =nla_alloc_flow_actions (nla_len (attr));if (IS_ERR (*sfa))return PTR_ERR (*sfa);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 50/231 Revert "openvswitch: switch to per-action label counting in conntrack"
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit 1063ae07383c0ddc5bcce170260c143825846b03 ]
Currently, ovs_ct_set_labels() is only called for confirmed conntrack entries (ct) within ovs_ct_commit(). However, if the conntrack entry does not have the labels_ext extension, attempting to allocate it in ovs_ct_get_conn_labels() for a confirmed entry triggers a warning in nf_ct_ext_add():
WARN_ON(nf_ct_is_confirmed(ct));
This happens when the conntrack entry is created externally before OVS increments net->ct.labels_used. The issue has become more likely since commit fcb1aa5163b1 ("openvswitch: switch to per-action label counting in conntrack"), which changed to use per-action label counting and increment net->ct.labels_used when a flow with ct action is added.
Since there’s no straightforward way to fully resolve this issue at the moment, this reverts the commit to avoid breaking existing use cases.
--- net/openvswitch/conntrack.c | 30 ++++++++++++++++++------------ net/openvswitch/datapath.h | 3 +++ 2 files changed, 21 insertions(+), 12 deletions(-)
net/openvswitch/conntrack.c +18 -12
@@ -1368,8 +1368,11 @@ bool ovs_ct_verify(struct net *net, enum ovs_key_attr attr) attr == OVS_KEY_ATTR_CT_MARK)return true;if (IS_ENABLED (CONFIG_NF_CONNTRACK_LABELS ) && - attr ==OVS_KEY_ATTR_CT_LABELS ) -return true; + attr ==OVS_KEY_ATTR_CT_LABELS ) { +struct ovs_net *ovs_net =net_generic (net, ovs_net_id); + +return ovs_net->xt_label; + }return false; }
@@ -1378,7 +1381,6 @@ int ovs_ct_copy_action(struct net *net, const struct nlattr *attr,const struct sw_flow_key *key, struct sw_flow_actions **sfa, bool log) { - unsigned int n_bits = sizeof(struct ovs_key_ct_labels) * BITS_PER_BYTE; struct ovs_conntrack_info ct_info;const char *helper =NULL ;u16 family;
@@ -1407,12 +1409,6 @@ int ovs_ct_copy_action(struct net *net, const struct nlattr *attr,return -ENOMEM ; } -if (nf_connlabels_get (net, n_bits -1 )) { -nf_ct_tmpl_free (ct_info.ct); -OVS_NLERR (log,"Failed to set connlabel length" ); -return -EOPNOTSUPP ; - } -if (ct_info.timeout[0 ]) {if (nf_ct_set_timeout (net, ct_info.ct, family, key->ip.proto, ct_info.timeout))
@@ -1581,7 +1577,6 @@ static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info)if (ct_info->ct) {if (ct_info->timeout[0 ])nf_ct_destroy_timeout (ct_info->ct); -nf_connlabels_put (nf_ct_net (ct_info->ct));nf_ct_tmpl_free (ct_info->ct); } }
@@ -2006,9 +2001,17 @@ struct genl_family dp_ct_limit_genl_family __ro_after_init = {int ovs_ct_init (struct net *net) { -#if IS_ENABLED (CONFIG_NETFILTER_CONNCOUNT ) +unsigned int n_bits =sizeof (struct ovs_key_ct_labels ) *BITS_PER_BYTE ;struct ovs_net *ovs_net =net_generic (net, ovs_net_id); +if (nf_connlabels_get (net, n_bits -1 )) { + ovs_net->xt_label = false; +OVS_NLERR (true,"Failed to set connlabel length" ); + }else { + ovs_net->xt_label = true; + } + +#if IS_ENABLED (CONFIG_NETFILTER_CONNCOUNT )return ovs_ct_limit_init (net, ovs_net);#else return 0 ;
@@ -2017,9 +2020,12 @@ int ovs_ct_init(struct net *net)void ovs_ct_exit (struct net *net) { -#if IS_ENABLED (CONFIG_NETFILTER_CONNCOUNT )struct ovs_net *ovs_net =net_generic (net, ovs_net_id); +#if IS_ENABLED (CONFIG_NETFILTER_CONNCOUNT )ovs_ct_limit_exit (net, ovs_net);#endif + +if (ovs_net->xt_label) +nf_connlabels_put (net); }
net/openvswitch/datapath.h +3 -0
@@ -160,6 +160,9 @@ struct ovs_net {#if IS_ENABLED (CONFIG_NETFILTER_CONNCOUNT )struct ovs_ct_limit_info *ct_limit_info;#endif + +/* Module reference for configuring conntrack. */ +bool xt_label; };/**
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 51/231 net/mlx5: HWS, Rightsize bwc matcher priority
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vlad Dogaru <[email protected]>
[ Upstream commit 521992337f67f71ce4436b98bc32563ddb1a5ce3 ]
The bwc layer was clamping the matcher priority from 32 bits to 16 bits. This didn't show up until a matcher was resized, since the initial native matcher was created using the correct 32 bit value.
The fix also reorders fields to avoid some padding.
--- .../net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws_bwc.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws_bwc.h +1 -1
@@ -16,8 +16,8 @@ struct mlx5hws_bwc_matcher {struct mlx5hws_matcher *matcher;struct mlx5hws_match_template *mt;struct mlx5hws_action_template *at[MLX5HWS_BWC_MATCHER_ATTACH_AT_NUM ]; +u32 priority;u8 num_of_at; -u16 priority;u8 size_log;u32 num_of_rules;/* atomically accessed */ struct list_head *rules;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 52/231 net/mlx5: Fix incorrect IRQ pool usage when releasing IRQs
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shay Drory <[email protected]>
[ Upstream commit 32d2724db5b2361ab293427ccd5c24f4f2bcca14 ]
mlx5_irq_pool_get() is a getter for completion IRQ pool only. However, after the cited commit, mlx5_irq_pool_get() is called during ctrl IRQ release flow to retrieve the pool, resulting in the use of an incorrect IRQ pool.
Hence, use the newly introduced mlx5_irq_get_pool() getter to retrieve the correct IRQ pool based on the IRQ itself. While at it, rename mlx5_irq_pool_get() to mlx5_irq_table_get_comp_irq_pool() which accurately reflects its purpose and improves code readability.
--- drivers/net/ethernet/mellanox/mlx5/core/eq.c | 2 +- .../net/ethernet/mellanox/mlx5/core/irq_affinity.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/mlx5_irq.h | 4 +++- drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c | 13 ++++++++++--- drivers/net/ethernet/mellanox/mlx5/core/pci_irq.h | 2 +- 5 files changed, 16 insertions(+), 7 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/eq.c +1 -1
@@ -887,8 +887,8 @@ static void comp_irq_release_sf(struct mlx5_core_dev *dev, u16 vecidx)static int comp_irq_request_sf (struct mlx5_core_dev *dev,u16 vecidx) { +struct mlx5_irq_pool *pool =mlx5_irq_table_get_comp_irq_pool (dev);struct mlx5_eq_table *table = dev->priv.eq_table; -struct mlx5_irq_pool *pool =mlx5_irq_pool_get (dev);struct irq_affinity_desc af_desc = {};struct mlx5_irq *irq;
drivers/net/ethernet/mellanox/mlx5/core/irq_affinity.c +1 -1
@@ -175,7 +175,7 @@ mlx5_irq_affinity_request(struct mlx5_core_dev *dev, struct mlx5_irq_pool *pool,void mlx5_irq_affinity_irq_release (struct mlx5_core_dev *dev,struct mlx5_irq *irq) { -struct mlx5_irq_pool *pool =mlx5_irq_pool_get (dev); +struct mlx5_irq_pool *pool =mlx5_irq_get_pool (irq);int cpu; cpu =cpumask_first (mlx5_irq_get_affinity_mask (irq));
drivers/net/ethernet/mellanox/mlx5/core/mlx5_irq.h +3 -1
@@ -10,12 +10,15 @@struct mlx5_irq ;struct cpu_rmap ; +struct mlx5_irq_pool ;int mlx5_irq_table_init (struct mlx5_core_dev *dev);void mlx5_irq_table_cleanup (struct mlx5_core_dev *dev);int mlx5_irq_table_create (struct mlx5_core_dev *dev);void mlx5_irq_table_destroy (struct mlx5_core_dev *dev);void mlx5_irq_table_free_irqs (struct mlx5_core_dev *dev); +struct mlx5_irq_pool * +mlx5_irq_table_get_comp_irq_pool (struct mlx5_core_dev *dev);int mlx5_irq_table_get_num_comp (struct mlx5_irq_table *table);int mlx5_irq_table_get_sfs_vec (struct mlx5_irq_table *table);struct mlx5_irq_table *mlx5_irq_table_get (struct mlx5_core_dev *dev);
@@ -38,7 +41,6 @@ struct cpumask *mlx5_irq_get_affinity_mask(struct mlx5_irq *irq);int mlx5_irq_get_index (struct mlx5_irq *irq);int mlx5_irq_get_irq (const struct mlx5_irq *irq); -struct mlx5_irq_pool ;#ifdef CONFIG_MLX5_SF struct mlx5_irq *mlx5_irq_affinity_irq_request_auto (struct mlx5_core_dev *dev,struct cpumask *used_cpus,u16 vecidx);
drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c +10 -3
@@ -378,6 +378,11 @@ int mlx5_irq_get_index(struct mlx5_irq *irq)return irq->map.index; } +struct mlx5_irq_pool *mlx5_irq_get_pool (struct mlx5_irq *irq) +{ +return irq->pool; +} +/* irq_pool API */ /* requesting an irq from a given pool according to given index */
@@ -405,18 +410,20 @@ static struct mlx5_irq_pool *sf_ctrl_irq_pool_get(struct mlx5_irq_table *irq_tabreturn irq_table->sf_ctrl_pool; } -static struct mlx5_irq_pool *sf_irq_pool_get (struct mlx5_irq_table *irq_table) +static struct mlx5_irq_pool * +sf_comp_irq_pool_get (struct mlx5_irq_table *irq_table) {return irq_table->sf_comp_pool; } -struct mlx5_irq_pool *mlx5_irq_pool_get (struct mlx5_core_dev *dev) +struct mlx5_irq_pool * +mlx5_irq_table_get_comp_irq_pool (struct mlx5_core_dev *dev) {struct mlx5_irq_table *irq_table =mlx5_irq_table_get (dev);struct mlx5_irq_pool *pool =NULL ;if (mlx5_core_is_sf (dev)) - pool =sf_irq_pool_get (irq_table); + pool =sf_comp_irq_pool_get (irq_table);/* In some configs, there won't be a pool of SFs IRQs. Hence, returning * the PF IRQs pool in case the SF pool doesn't exist.
drivers/net/ethernet/mellanox/mlx5/core/pci_irq.h +1 -1
@@ -28,7 +28,6 @@ struct mlx5_irq_pool {struct mlx5_core_dev *dev; }; -struct mlx5_irq_pool *mlx5_irq_pool_get (struct mlx5_core_dev *dev);static inline bool mlx5_irq_pool_is_sf_pool (struct mlx5_irq_pool *pool) {return !strncmp ("mlx5_sf" , pool->name,strlen ("mlx5_sf" ));
@@ -40,5 +39,6 @@ struct mlx5_irq *mlx5_irq_alloc(struct mlx5_irq_pool *pool, int i,int mlx5_irq_get_locked (struct mlx5_irq *irq);int mlx5_irq_read_locked (struct mlx5_irq *irq);int mlx5_irq_put (struct mlx5_irq *irq); +struct mlx5_irq_pool *mlx5_irq_get_pool (struct mlx5_irq *irq);#endif /* __PCI_IRQ_H__ */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 53/231 net/mlx5: Lag, Check shared fdb before creating MultiPort E-Switch
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shay Drory <[email protected]>
[ Upstream commit 32966984bee1defd9f5a8f9be274d7c32f911ba1 ]
Currently, MultiPort E-Switch is requesting to create a LAG with shared FDB without checking the LAG is supporting shared FDB.
Add the check.
--- drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c | 4 ++-- drivers/net/ethernet/mellanox/mlx5/core/lag/lag.h | 1 + drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.c | 3 ++- 3 files changed, 5 insertions(+), 3 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c +2 -2
@@ -859,7 +859,7 @@ void mlx5_disable_lag(struct mlx5_lag *ldev)mlx5_eswitch_reload_ib_reps (ldev->pf[i].dev->priv.eswitch); } -static bool mlx5_shared_fdb_supported (struct mlx5_lag *ldev) +bool mlx5_lag_shared_fdb_supported (struct mlx5_lag *ldev) {struct mlx5_core_dev *dev;int i;
@@ -937,7 +937,7 @@ static void mlx5_do_bond(struct mlx5_lag *ldev) }if (do_bond && !__mlx5_lag_is_active (ldev)) { -bool shared_fdb =mlx5_shared_fdb_supported (ldev); +bool shared_fdb =mlx5_lag_shared_fdb_supported (ldev); roce_lag =mlx5_lag_is_roce_lag (ldev);
drivers/net/ethernet/mellanox/mlx5/core/lag/lag.h +1 -0
@@ -92,6 +92,7 @@ mlx5_lag_is_ready(struct mlx5_lag *ldev)return test_bit (MLX5_LAG_FLAG_NDEVS_READY , &ldev->state_flags); } +bool mlx5_lag_shared_fdb_supported (struct mlx5_lag *ldev);bool mlx5_lag_check_prereq (struct mlx5_lag *ldev);void mlx5_modify_lag (struct mlx5_lag *ldev,struct lag_tracker *tracker);
drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.c +2 -1
@@ -81,7 +81,8 @@ static int enable_mpesw(struct mlx5_lag *ldev)if (mlx5_eswitch_mode (dev0) !=MLX5_ESWITCH_OFFLOADS || !MLX5_CAP_PORT_SELECTION (dev0, port_select_flow_table) || !MLX5_CAP_GEN (dev0, create_lag_when_not_master_up) || - !mlx5_lag_check_prereq (ldev)) + !mlx5_lag_check_prereq (ldev) || + !mlx5_lag_shared_fdb_supported (ldev))return -EOPNOTSUPP ; err =mlx5_mpesw_metadata_set (ldev);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 54/231 net/mlx5: Bridge, fix the crash caused by LAG state check
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianbo Liu <[email protected]>
[ Upstream commit 4b8eeed4fb105770ce6dc84a2c6ef953c7b71cbb ]
When removing LAG device from bridge, NETDEV_CHANGEUPPER event is triggered. Driver finds the lower devices (PFs) to flush all the offloaded entries. And mlx5_lag_is_shared_fdb is checked, it returns false if one of PF is unloaded. In such case, mlx5_esw_bridge_lag_rep_get() and its caller return NULL, instead of the alive PF, and the flush is skipped.
Besides, the bridge fdb entry's lastuse is updated in mlx5 bridge event handler. But this SWITCHDEV_FDB_ADD_TO_BRIDGE event can be ignored in this case because the upper interface for bond is deleted, and the entry will never be aged because lastuse is never updated.
To make things worse, as the entry is alive, mlx5 bridge workqueue keeps sending that event, which is then handled by kernel bridge notifier. It causes the following crash when accessing the passed bond netdev which is already destroyed.
To fix this issue, remove such checks. LAG state is already checked in commit 15f8f168952f ("net/mlx5: Bridge, verify LAG state when adding bond to bridge"), driver still need to skip offload if LAG becomes invalid state after initialization.
Oops: stack segment: 0000 [#1] SMP CPU: 3 UID: 0 PID: 23695 Comm: kworker/u40:3 Tainted: G OE 6.11.0_mlnx #1 Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Workqueue: mlx5_bridge_wq mlx5_esw_bridge_update_work [mlx5_core] RIP: 0010:br_switchdev_event+0x2c/0x110 [bridge] Code: 44 00 00 48 8b 02 48 f7 00 00 02 00 00 74 69 41 54 55 53 48 83 ec 08 48 8b a8 08 01 00 00 48 85 ed 74 4a 48 83 fe 02 48 89 d3 <4c> 8b 65 00 74 23 76 49 48 83 fe 05 74 7e 48 83 fe 06 75 2f 0f b7 RSP: 0018:ffffc900092cfda0 EFLAGS: 00010297 RAX: ffff888123bfe000 RBX: ffffc900092cfe08 RCX: 00000000ffffffff RDX: ffffc900092cfe08 RSI: 0000000000000001 RDI: ffffffffa0c585f0 RBP: 6669746f6e690a30 R08: 0000000000000000 R09: ffff888123ae92c8 R10: 0000000000000000 R11: fefefefefefefeff R12: ffff888123ae9c60 R13: 0000000000000001 R14: ffffc900092cfe08 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff88852c980000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f15914c8734 CR3: 0000000002830005 CR4: 0000000000770ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> ? __die_body+0x1a/0x60 ? die+0x38/0x60 ? do_trap+0x10b/0x120 ? do_error_trap+0x64/0xa0 ? exc_stack_segment+0x33/0x50 ? asm_exc_stack_segment+0x22/0x30 ? br_switchdev_event+0x2c/0x110 [bridge] ? sched_balance_newidle.isra.149+0x248/0x390 notifier_call_chain+0x4b/0xa0 atomic_notifier_call_chain+0x16/0x20 mlx5_esw_bridge_update+0xec/0x170 [mlx5_core] mlx5_esw_bridge_update_work+0x19/0x40 [mlx5_core] process_scheduled_works+0x81/0x390 worker_thread+0x106/0x250 ? bh_worker+0x110/0x110 kthread+0xb7/0xe0 ? kthread_park+0x80/0x80 ret_from_fork+0x2d/0x50 ? kthread_park+0x80/0x80 ret_from_fork_asm+0x11/0x20 </TASK>
--- .../net/ethernet/mellanox/mlx5/core/en/rep/bridge.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c +5 -7
@@ -48,15 +48,10 @@ mlx5_esw_bridge_lag_rep_get(struct net_device *dev, struct mlx5_eswitch *esw)struct list_head *iter;netdev_for_each_lower_dev (dev, lower, iter) { -struct mlx5_core_dev *mdev; -struct mlx5e_priv *priv; -if (!mlx5e_eswitch_rep (lower))continue ; - priv =netdev_priv (lower); - mdev = priv->mdev; -if (mlx5_lag_is_shared_fdb (mdev) &&mlx5_esw_bridge_dev_same_esw (lower, esw)) +if (mlx5_esw_bridge_dev_same_esw (lower, esw))return lower; }
@@ -125,7 +120,7 @@ static bool mlx5_esw_bridge_is_local(struct net_device *dev, struct net_device * priv =netdev_priv (rep); mdev = priv->mdev;if (netif_is_lag_master (dev)) -return mlx5_lag_is_shared_fdb (mdev) &&mlx5_lag_is_master (mdev); +return mlx5_lag_is_master (mdev);return true; }
@@ -455,6 +450,9 @@ static int mlx5_esw_bridge_switchdev_event(struct notifier_block *nb,if (!rep)return NOTIFY_DONE ; +if (netif_is_lag_master (dev) && !mlx5_lag_is_shared_fdb (esw->dev)) +return NOTIFY_DONE ; +switch (event) {case SWITCHDEV_FDB_ADD_TO_BRIDGE : fdb_info = container_of(info,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 55/231 net/mlx5e: Prevent bridge link show failure for non-eswitch-allowed devices
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carolina Jubran <[email protected]>
[ Upstream commit e92df790d07a8eea873efcb84776e7b71f81c7d5 ]
mlx5_eswitch_get_vepa returns -EPERM if the device lacks eswitch_manager capability, blocking mlx5e_bridge_getlink from retrieving VEPA mode. Since mlx5e_bridge_getlink implements ndo_bridge_getlink, returning -EPERM causes bridge link show to fail instead of skipping devices without this capability.
To avoid this, return -EOPNOTSUPP from mlx5e_bridge_getlink when mlx5_eswitch_get_vepa fails, ensuring the command continues processing other devices while ignoring those without the necessary capability.
--- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +2 -4
@@ -5099,11 +5099,9 @@ static int mlx5e_bridge_getlink(struct sk_buff *skb, u32 pid, u32 seq,struct mlx5e_priv *priv =netdev_priv (dev);struct mlx5_core_dev *mdev = priv->mdev;u8 mode, setting; -int err; - err =mlx5_eswitch_get_vepa (mdev->priv.eswitch, &setting); -if (err) -return err; +if (mlx5_eswitch_get_vepa (mdev->priv.eswitch, &setting)) +return -EOPNOTSUPP ; mode = setting ?BRIDGE_MODE_VEPA :BRIDGE_MODE_VEB ; return ndo_dflt_bridge_getlink(skb, pid, seq, dev, mode,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 56/231 nvme-fc: go straight to connecting state when initializing
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Wagner <[email protected]>
[ Upstream commit d3d380eded7ee5fc2fc53b3b0e72365ded025c4a ]
The initial controller initialization mimiks the reconnect loop behavior by switching from NEW to RESETTING and then to CONNECTING.
The transition from NEW to CONNECTING is a valid transition, so there is no point entering the RESETTING state. TCP and RDMA also transition directly to CONNECTING state.
--- drivers/nvme/host/fc.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/nvme/host/fc.c +1 -2
@@ -3582,8 +3582,7 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,list_add_tail (&ctrl->ctrl_list, &rport->ctrl_list);spin_unlock_irqrestore (&rport->lock, flags); -if (!nvme_change_ctrl_state (&ctrl->ctrl,NVME_CTRL_RESETTING ) || - !nvme_change_ctrl_state (&ctrl->ctrl,NVME_CTRL_CONNECTING )) { +if (!nvme_change_ctrl_state (&ctrl->ctrl,NVME_CTRL_CONNECTING )) {dev_err (ctrl->ctrl.device,"NVME-FC{%d}: failed to init ctrl state\n" , ctrl->cnum); goto fail_ctrl;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 57/231 nvme-fc: do not ignore connectivity loss during connecting
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Wagner <[email protected]>
[ Upstream commit ee59e3820ca92a9f4307ae23dfc7229dc8b8d400 ]
When a connectivity loss occurs while nvme_fc_create_assocation is being executed, it's possible that the ctrl ends up stuck in the LIVE state:
1) nvme nvme10: NVME-FC{10}: create association : ...
2) nvme nvme10: NVME-FC{10}: controller connectivity lost. Awaiting Reconnect
nvme nvme10: queue_size 128 > ctrl maxcmd 32, reducing to maxcmd
3) nvme nvme10: Could not set queue count (880)
nvme nvme10: Failed to configure AEN (cfg 900)
4) nvme nvme10: NVME-FC{10}: controller connect complete
5) nvme nvme10: failed nvme_keep_alive_end_io error=4
A connection attempt starts 1) and the ctrl is in state CONNECTING. Shortly after the LLDD driver detects a connection lost event and calls nvme_fc_ctrl_connectivity_loss 2). Because we are still in CONNECTING state, this event is ignored.
nvme_fc_create_association continues to run in parallel and tries to communicate with the controller and these commands will fail. Though these errors are filtered out, e.g in 3) setting the I/O queues numbers fails which leads to an early exit in nvme_fc_create_io_queues. Because the number of IO queues is 0 at this point, there is nothing left in nvme_fc_create_association which could detected the connection drop. Thus the ctrl enters LIVE state 4).
Eventually the keep alive handler times out 5) but because nothing is being done, the ctrl stays in LIVE state.
There is already the ASSOC_FAILED flag to track connectivity loss event but this bit is set too late in the recovery code path. Move this into the connectivity loss event handler and synchronize it with the state change. This ensures that the ASSOC_FAILED flag is seen by nvme_fc_create_io_queues and it does not enter the LIVE state after a connectivity loss event. If the connectivity loss event happens after we entered the LIVE state the normal error recovery path is executed.
--- drivers/nvme/host/fc.c | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-)
drivers/nvme/host/fc.c +18 -5
@@ -782,11 +782,19 @@ nvme_fc_abort_lsops(struct nvme_fc_rport *rport)static void nvme_fc_ctrl_connectivity_loss (struct nvme_fc_ctrl *ctrl) { +enum nvme_ctrl_state state; +unsigned long flags; +dev_info (ctrl->ctrl.device,"NVME-FC{%d}: controller connectivity lost. Awaiting " "Reconnect" , ctrl->cnum); -switch (nvme_ctrl_state (&ctrl->ctrl)) { +spin_lock_irqsave (&ctrl->lock, flags); +set_bit (ASSOC_FAILED , &ctrl->flags); + state =nvme_ctrl_state (&ctrl->ctrl); +spin_unlock_irqrestore (&ctrl->lock, flags); + +switch (state) {case NVME_CTRL_NEW :case NVME_CTRL_LIVE :/*
@@ -2546,7 +2554,6 @@ nvme_fc_error_recovery(struct nvme_fc_ctrl *ctrl, char *errmsg)*/ if (state ==NVME_CTRL_CONNECTING ) {__nvme_fc_abort_outstanding_ios (ctrl, true); -set_bit (ASSOC_FAILED , &ctrl->flags);dev_warn (ctrl->ctrl.device,"NVME-FC{%d}: transport error during (re)connect\n" , ctrl->cnum);
@@ -3171,12 +3178,18 @@ nvme_fc_create_association(struct nvme_fc_ctrl *ctrl)else ret =nvme_fc_recreate_io_queues (ctrl); } -if (!ret &&test_bit (ASSOC_FAILED , &ctrl->flags)) - ret = -EIO ;if (ret) goto out_term_aen_ops; - changed =nvme_change_ctrl_state (&ctrl->ctrl,NVME_CTRL_LIVE ); +spin_lock_irqsave (&ctrl->lock, flags); +if (!test_bit (ASSOC_FAILED , &ctrl->flags)) + changed =nvme_change_ctrl_state (&ctrl->ctrl,NVME_CTRL_LIVE ); +else + ret = -EIO ; +spin_unlock_irqrestore (&ctrl->lock, flags); + +if (ret) + goto out_term_aen_ops; ctrl->ctrl.nr_reconnects =0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 58/231 hrtimers: Mark is_migration_base() with __always_inline
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 27af31e44949fa85550176520ef7086a0d00fd7b ]
When is_migration_base() is unused, it prevents kernel builds with clang, make W=1 and CONFIG_WERROR=y:
kernel/time/hrtimer.c:156:20: error: unused function 'is_migration_base' [-Werror,-Wunused-function]
156 | static inline bool is_migration_base(struct hrtimer_clock_base *base)
| ^~~~~~~~~~~~~~~~~
Fix this by marking it with __always_inline.
[ tglx: Use __always_inline instead of __maybe_unused and move it into the
usage sites conditional ]
--- kernel/time/hrtimer.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-)
kernel/time/hrtimer.c +12 -10
@@ -156,11 +156,6 @@ static struct hrtimer_cpu_base migration_cpu_base = {#define migration_base migration_cpu_base.clock_base[0] -static inline bool is_migration_base (struct hrtimer_clock_base *base) -{ -return base == &migration_base; -} -/* * We are using hashed locking: holding per_cpu(hrtimer_bases)[n].lock * means that all timers which are tied to this base via timer->base are
@@ -312,11 +307,6 @@ switch_hrtimer_base(struct hrtimer *timer, struct hrtimer_clock_base *base,#else /* CONFIG_SMP */ -static inline bool is_migration_base (struct hrtimer_clock_base *base) -{ -return false; -} -static inline struct hrtimer_clock_base *lock_hrtimer_base (const struct hrtimer *timer,unsigned long *flags) __acquires(&timer->base->cpu_base->lock)
@@ -1441,6 +1431,18 @@ static void hrtimer_sync_wait_running(struct hrtimer_cpu_base *cpu_base, } } +#ifdef CONFIG_SMP +static __always_inline bool is_migration_base(struct hrtimer_clock_base *base) +{ +return base == &migration_base; +} +#else +static __always_inline bool is_migration_base(struct hrtimer_clock_base *base) +{ +return false; +} +#endif +/* * This function is called on PREEMPT_RT kernels when the fast path * deletion of a timer failed because the timer callback function was
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 59/231 powercap: call put_device() on an error path in powercap_register_control_type()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Hattori <[email protected]>
[ Upstream commit 93c66fbc280747ea700bd6199633d661e3c819b3 ]
powercap_register_control_type() calls device_register(), but does not release the refcount of the device when it fails.
Call put_device() before returning an error to balance the refcount.
Since the kfree(control_type) will be done by powercap_release(), remove the lines in powercap_register_control_type() before returning the error.
This bug was found by an experimental verifier that I am developing.
--- drivers/powercap/powercap_sys.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/powercap/powercap_sys.c +1 -2
@@ -627,8 +627,7 @@ struct powercap_control_type *powercap_register_control_type(dev_set_name (&control_type->dev,"%s" , name); result =device_register (&control_type->dev);if (result) { -if (control_type->allocated) -kfree (control_type); +put_device (&control_type->dev);return ERR_PTR (result); }idr_init (&control_type->idr);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 60/231 btrfs: avoid starting new transaction when cleaning qgroup during subvolume drop
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit fdef89ce6fada462aef9cb90a140c93c8c209f0f ]
At btrfs_qgroup_cleanup_dropped_subvolume() all we want to commit the current transaction in order to have all the qgroup rfer/excl numbers up to date. However we are using btrfs_start_transaction(), which joins the current transaction if there is one that is not yet committing, but also starts a new one if there is none or if the current one is already committing (its state is >= TRANS_STATE_COMMIT_START). This later case results in unnecessary IO, wasting time and a pointless rotation of the backup roots in the super block.
So instead of using btrfs_start_transaction() followed by a btrfs_commit_transaction(), use btrfs_commit_current_transaction() which achieves our purpose and avoids starting and committing new transactions.
--- fs/btrfs/qgroup.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
fs/btrfs/qgroup.c +1 -5
@@ -1899,11 +1899,7 @@ int btrfs_qgroup_cleanup_dropped_subvolume(struct btrfs_fs_info *fs_info, u64 su* Commit current transaction to make sure all the rfer/excl numbers * get updated. */ - trans =btrfs_start_transaction (fs_info->quota_root,0 ); -if (IS_ERR (trans)) -return PTR_ERR (trans); - - ret =btrfs_commit_transaction (trans); + ret =btrfs_commit_current_transaction (fs_info->quota_root);if (ret <0 )return ret;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 61/231 futex: Pass in task to futex_queue()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <[email protected]>
[ Upstream commit 5e0e02f0d7e52cfc8b1adfc778dd02181d8b47b4 ]
futex_queue() -> __futex_queue() uses 'current' as the task to store in the struct futex_q->task field. This is fine for synchronous usage of the futex infrastructure, but it's not always correct when used by io_uring where the task doing the initial futex_queue() might not be available later on. This doesn't lead to any issues currently, as the io_uring side doesn't support PI futexes, but it does leave a potentially dangling pointer which is never a good idea.
Have futex_queue() take a task_struct argument, and have the regular callers pass in 'current' for that. Meanwhile io_uring can just pass in NULL, as the task should never be used off that path. In theory req->tctx->task could be used here, but there's no point populating it with a task field that will never be used anyway.
--- io_uring/futex.c | 2 +- kernel/futex/core.c | 5 +++-- kernel/futex/futex.h | 11 ++++++++--- kernel/futex/pi.c | 2 +- kernel/futex/waitwake.c | 4 ++-- 5 files changed, 15 insertions(+), 9 deletions(-)
io_uring/futex.c +1 -1
@@ -349,7 +349,7 @@ int io_futex_wait(struct io_kiocb *req, unsigned int issue_flags)hlist_add_head (&req->hash_node, &ctx->futex_list);io_ring_submit_unlock (ctx, issue_flags); -futex_queue (&ifd->q, hb); +futex_queue (&ifd->q, hb,NULL );return IOU_ISSUE_SKIP_COMPLETE ; }
kernel/futex/core.c +3 -2
@@ -554,7 +554,8 @@ void futex_q_unlock(struct futex_hash_bucket *hb)futex_hb_waiters_dec (hb); } -void __futex_queue (struct futex_q *q,struct futex_hash_bucket *hb) +void __futex_queue (struct futex_q *q,struct futex_hash_bucket *hb, +struct task_struct *task) {int prio;
@@ -570,7 +571,7 @@ void __futex_queue(struct futex_q *q, struct futex_hash_bucket *hb)plist_node_init (&q->list, prio);plist_add (&q->list, &hb->chain); - q->task = current; + q->task = task; }/**
kernel/futex/futex.h +8 -3
@@ -230,13 +230,15 @@ extern int futex_get_value_locked(u32 *dest, u32 __user *from);extern struct futex_q *futex_top_waiter (struct futex_hash_bucket *hb,union futex_key *key);extern void __futex_unqueue (struct futex_q *q); -extern void __futex_queue (struct futex_q *q,struct futex_hash_bucket *hb); +extern void __futex_queue (struct futex_q *q,struct futex_hash_bucket *hb, +struct task_struct *task);extern int futex_unqueue (struct futex_q *q);/** * futex_queue() - Enqueue the futex_q on the futex_hash_bucket * @q: The futex_q to enqueue * @hb: The destination hash bucket +* @task: Task queueing this futex * * The hb->lock must be held by the caller, and is released here. A call to * futex_queue() is typically paired with exactly one call to futex_unqueue(). The
@@ -244,11 +246,14 @@ extern int futex_unqueue(struct futex_q *q);* or nothing if the unqueue is done as part of the wake process and the unqueue * state is implicit in the state of woken task (see futex_wait_requeue_pi() for * an example). +* +* Note that @task may be NULL, for async usage of futexes. */ -static inline void futex_queue (struct futex_q *q,struct futex_hash_bucket *hb) +static inline void futex_queue (struct futex_q *q,struct futex_hash_bucket *hb, +struct task_struct *task) __releases(&hb->lock) { -__futex_queue (q, hb); +__futex_queue (q, hb, task);spin_unlock (&hb->lock); }
kernel/futex/pi.c +1 -1
@@ -981,7 +981,7 @@ int futex_lock_pi(u32 __user *uaddr, unsigned int flags, ktime_t *time, int tryl/* * Only actually queue now that the atomic ops are done: */ -__futex_queue (&q, hb); +__futex_queue (&q, hb, current);if (trylock) { ret =rt_mutex_futex_trylock (&q.pi_state->pi_mutex);
kernel/futex/waitwake.c +2 -2
@@ -350,7 +350,7 @@ void futex_wait_queue(struct futex_hash_bucket *hb, struct futex_q *q,* access to the hash list and forcing another memory barrier. */ set_current_state (TASK_INTERRUPTIBLE |TASK_FREEZABLE ); -futex_queue (q, hb); +futex_queue (q, hb, current);/* Arm the timer */ if (timeout)
@@ -461,7 +461,7 @@ int futex_wait_multiple_setup(struct futex_vector *vs, int count, int *woken)* next futex. Queue each futex at this moment so hb can * be unlocked. */ -futex_queue (q, hb); +futex_queue (q, hb, current);continue ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 62/231 iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengen Du <[email protected]>
[ Upstream commit 07e0d99a2f701123ad3104c0f1a1e66bce74d6e5 ]
When performing an iSCSI boot using IPv6, iscsistart still reads the /sys/firmware/ibft/ethernetX/subnet-mask entry. Since the IPv6 prefix length is 64, this causes the shift exponent to become negative, triggering a UBSAN warning. As the concept of a subnet mask does not apply to IPv6, the value is set to ~0 to suppress the warning message.
--- drivers/firmware/iscsi_ibft.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/firmware/iscsi_ibft.c +4 -1
@@ -310,7 +310,10 @@ static ssize_t ibft_attr_show_nic(void *data, int type, char *buf) str +=sprintf_ipaddr (str, nic->ip_addr);break ;case ISCSI_BOOT_ETH_SUBNET_MASK : - val =cpu_to_be32 (~((1 << (32 -nic->subnet_mask_prefix))-1 )); +if (nic->subnet_mask_prefix >32 ) + val =cpu_to_be32 (~0 ); +else + val =cpu_to_be32 (~((1 << (32 -nic->subnet_mask_prefix))-1 )); str +=sprintf (str,"%pI4" , &val);break ;case ISCSI_BOOT_ETH_PREFIX_LEN :
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 63/231 sched/debug: Provide slice length for fair tasks
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Loehle <[email protected]>
[ Upstream commit 9065ce69754dece78606c8bbb3821449272e56bf ]
Since commit:
857b158dc5e8 ("sched/eevdf: Use sched_attr::sched_runtime to set request/slice suggestion")
... we have the userspace per-task tunable slice length, which is a key parameter that is otherwise difficult to obtain, so provide it in /proc/$PID/sched.
[ mingo: Clarified the changelog. ]
--- kernel/sched/debug.c | 2 ++ 1 file changed, 2 insertions(+)
kernel/sched/debug.c +2 -0
@@ -1264,6 +1264,8 @@ void proc_sched_show_task(struct task_struct *p, struct pid_namespace *ns,if (task_has_dl_policy (p)) {P (dl.runtime);P (dl.deadline); + }else if (fair_policy (p->policy)) { +P (se.slice); }#ifdef CONFIG_SCHED_CLASS_EXT __PS ("ext.enabled" ,task_on_scx (p));
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 64/231 platform/x86/intel: pmc: fix ltr decode in pmc_core_ltr_show()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Kandybka <[email protected]>
[ Upstream commit 583ef25bb2a094813351a727ddec38b35a15b9f8 ]
In pmc_core_ltr_show(), promote 'val' to 'u64' to avoid possible integer overflow. Values (10 bit) are multiplied by the scale, the result of expression is in a range from 1 to 34,326,183,936 which is bigger then UINT32_MAX. Compile tested only.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/platform/x86/intel/pmc/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/platform/x86/intel/pmc/core.c +2 -2
@@ -625,8 +625,8 @@ static u32 convert_ltr_scale(u32 val)static int pmc_core_ltr_show (struct seq_file *s,void *unused) {struct pmc_dev *pmcdev = s->private; -u64 decoded_snoop_ltr, decoded_non_snoop_ltr; -u32 ltr_raw_data, scale, val; +u64 decoded_snoop_ltr, decoded_non_snoop_ltr, val; +u32 ltr_raw_data, scale;u16 snoop_ltr, nonsnoop_ltr;unsigned int i, index, ltr_index =0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 65/231 drm/amd/display: Fix out-of-bound accesses
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit 8adbb2a98b00926315fd513b5fe2596b5716b82d ]
[WHAT & HOW]hpo_stream_to_link_encoder_mapping has size MAX_HPO_DP2_ENCODERS(=4), but location can have size up to 6. As a result, it is necessary to check location against MAX_HPO_DP2_ENCODERS.
Similiarly, disp_cfg_stream_location can be used as an array index which should be 0..5, so the ASSERT's conditions should be less without equal.
--- .../amd/display/dc/dml2/dml21/dml21_translation_helper.c | 4 ++-- .../gpu/drm/amd/display/dc/dml2/dml2_translation_helper.c | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-)
drivers/gpu/drm/amd/display/dc/dml2/dml21/dml21_translation_helper.c +2 -2
@@ -994,7 +994,7 @@ bool dml21_map_dc_state_into_dml_display_cfg(const struct dc *in_dc, struct dc_sif (disp_cfg_stream_location <0 ) disp_cfg_stream_location = dml_dispcfg->num_streams++; -ASSERT (disp_cfg_stream_location >=0 && disp_cfg_stream_location <= __DML2_WRAPPER_MAX_STREAMS_PLANES__); +ASSERT (disp_cfg_stream_location >=0 && disp_cfg_stream_location < __DML2_WRAPPER_MAX_STREAMS_PLANES__);populate_dml21_timing_config_from_stream_state (&dml_dispcfg->stream_descriptors[disp_cfg_stream_location].timing, context->streams[stream_index], dml_ctx);populate_dml21_output_config_from_stream_state (&dml_dispcfg->stream_descriptors[disp_cfg_stream_location].output, context->streams[stream_index], &context->res_ctx.pipe_ctx[stream_index]);populate_dml21_stream_overrides_from_stream_state (&dml_dispcfg->stream_descriptors[disp_cfg_stream_location], context->streams[stream_index]);
@@ -1018,7 +1018,7 @@ bool dml21_map_dc_state_into_dml_display_cfg(const struct dc *in_dc, struct dc_sif (disp_cfg_plane_location <0 ) disp_cfg_plane_location = dml_dispcfg->num_planes++; -ASSERT (disp_cfg_plane_location >=0 && disp_cfg_plane_location <= __DML2_WRAPPER_MAX_STREAMS_PLANES__); +ASSERT (disp_cfg_plane_location >=0 && disp_cfg_plane_location < __DML2_WRAPPER_MAX_STREAMS_PLANES__);populate_dml21_surface_config_from_plane_state (in_dc, &dml_dispcfg->plane_descriptors[disp_cfg_plane_location].surface, context->stream_status[stream_index].plane_states[plane_index]);populate_dml21_plane_config_from_plane_state (dml_ctx, &dml_dispcfg->plane_descriptors[disp_cfg_plane_location], context->stream_status[stream_index].plane_states[plane_index], context, stream_index);
drivers/gpu/drm/amd/display/dc/dml2/dml2_translation_helper.c +3 -3
@@ -746,7 +746,7 @@ static void populate_dml_output_cfg_from_stream_state(struct dml_output_cfg_st *case SIGNAL_TYPE_DISPLAY_PORT_MST :case SIGNAL_TYPE_DISPLAY_PORT : out->OutputEncoder[location] = dml_dp; -if (dml2->v20.scratch.hpo_stream_to_link_encoder_mapping[location] !=-1 ) +if (location <MAX_HPO_DP2_ENCODERS && dml2->v20.scratch.hpo_stream_to_link_encoder_mapping[location] !=-1 ) out->OutputEncoder[dml2->v20.scratch.hpo_stream_to_link_encoder_mapping[location]] = dml_dp2p0;break ;case SIGNAL_TYPE_EDP :
@@ -1303,7 +1303,7 @@ void map_dc_state_into_dml_display_cfg(struct dml2_context *dml2, struct dc_statif (disp_cfg_stream_location <0 ) disp_cfg_stream_location = dml_dispcfg->num_timings++; -ASSERT (disp_cfg_stream_location >=0 && disp_cfg_stream_location <= __DML2_WRAPPER_MAX_STREAMS_PLANES__); +ASSERT (disp_cfg_stream_location >=0 && disp_cfg_stream_location < __DML2_WRAPPER_MAX_STREAMS_PLANES__);populate_dml_timing_cfg_from_stream_state (&dml_dispcfg->timing, disp_cfg_stream_location, context->streams[i]);populate_dml_output_cfg_from_stream_state (&dml_dispcfg->output, disp_cfg_stream_location, context->streams[i], current_pipe_context, dml2);
@@ -1343,7 +1343,7 @@ void map_dc_state_into_dml_display_cfg(struct dml2_context *dml2, struct dc_statif (disp_cfg_plane_location <0 ) disp_cfg_plane_location = dml_dispcfg->num_surfaces++; -ASSERT (disp_cfg_plane_location >=0 && disp_cfg_plane_location <= __DML2_WRAPPER_MAX_STREAMS_PLANES__); +ASSERT (disp_cfg_plane_location >=0 && disp_cfg_plane_location < __DML2_WRAPPER_MAX_STREAMS_PLANES__);populate_dml_surface_cfg_from_plane_state (dml2->v20.dml_core_ctx.project, &dml_dispcfg->surface, disp_cfg_plane_location, context->stream_status[i].plane_states[j]); populate_dml_plane_cfg_from_plane_state(
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 66/231 scsi: core: Use GFP_NOIO to avoid circular locking dependency
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rik van Riel <[email protected]>
[ Upstream commit 5363ee9d110e139584c2d92a0b640bc210588506 ]
Filesystems can write to disk from page reclaim with __GFP_FS set. Marc found a case where scsi_realloc_sdev_budget_map() ends up in page reclaim with GFP_KERNEL, where it could try to take filesystem locks again, leading to a deadlock.
WARNING: possible circular locking dependency detected
6.13.0 #1 Not tainted
------------------------------------------------------
kswapd0/70 is trying to acquire lock:ffff8881025d5d78 (&q->q_usage_counter(io)){++++}-{0:0}, at: blk_mq_submit_bio+0x461/0x6e0
but task is already holding lock:ffffffff81ef5f40 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat+0x9f/0x760
The full lockdep splat can be found in Marc's report:
https://lkml.org/lkml/2025/1/24/1101
Avoid the potential deadlock by doing the allocation with GFP_NOIO, which prevents both filesystem and block layer recursion.
--- drivers/scsi/scsi_scan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/scsi_scan.c +1 -1
@@ -245,7 +245,7 @@ static int scsi_realloc_sdev_budget_map(struct scsi_device *sdev, } ret =sbitmap_init_node (&sdev->budget_map,scsi_device_max_queue_depth (sdev), - new_shift,GFP_KERNEL , + new_shift,GFP_NOIO , sdev->request_queue->node, false, true);if (!ret)sbitmap_resize (&sdev->budget_map, depth);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 67/231 scsi: ufs: core: Fix error return with query response
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seunghui Lee <[email protected]>
[ Upstream commit 1a78a56ea65252bb089e0daace989167227f2d31 ]
There is currently no mechanism to return error from query responses. Return the error and print the corresponding error message with it.
--- drivers/ufs/core/ufshcd.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/ufs/core/ufshcd.c +6 -1
@@ -3138,8 +3138,13 @@ ufshcd_dev_cmd_completion(struct ufs_hba *hba, struct ufshcd_lrb *lrbp)case UPIU_TRANSACTION_QUERY_RSP : {u8 response = lrbp->ucd_rsp_ptr->header.response; -if (response ==0 ) +if (response ==0 ) { err =ufshcd_copy_query_response (hba, lrbp); + }else { + err = -EINVAL ; +dev_err (hba->dev,"%s: unexpected response in Query RSP: %x\n" , + __func__, response); + }break ; }case UPIU_TRANSACTION_REJECT_UPIU :
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 68/231 scsi: qla1280: Fix kernel oops when debug level > 2
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Magnus Lindholm <[email protected]>
[ Upstream commit 5233e3235dec3065ccc632729675575dbe3c6b8a ]
A null dereference or oops exception will eventually occur when qla1280.c driver is compiled with DEBUG_QLA1280 enabled and ql_debug_level > 2. I think its clear from the code that the intention here is sg_dma_len(s) not length of sg_next(s) when printing the debug info.
--- drivers/scsi/qla1280.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/qla1280.c +1 -1
@@ -2867,7 +2867,7 @@ qla1280_64bit_start_scsi(struct scsi_qla_host *ha, struct srb * sp)dprintk (3 ,"S/G Segment phys_addr=%x %x, len=0x%x\n" ,cpu_to_le32 (upper_32_bits (dma_handle)),cpu_to_le32 (lower_32_bits (dma_handle)), -cpu_to_le32 (sg_dma_len (sg_next (s)))); +cpu_to_le32 (sg_dma_len (s))); remseg--; } dprintk(5, "qla1280_64bit_start_scsi: Scatter/gather "
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 69/231 ACPI: resource: IRQ override for Eluktronics MECH-17
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gannon Kolding <[email protected]>
[ Upstream commit 607ab6f85f4194b644ea95ac5fe660ef575db3b4 ]
The Eluktronics MECH-17 (GM7RG7N) needs IRQ overriding for the keyboard to work.
Adding a DMI_MATCH entry for this laptop model makes the internal keyboard function normally.
--- drivers/acpi/resource.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/acpi/resource.c +6 -0
@@ -563,6 +563,12 @@ static const struct dmi_system_id irq1_edge_low_force_override[] = { DMI_MATCH(DMI_BOARD_NAME, "RP-15"), }, }, + { + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Eluktronics Inc." ), + DMI_MATCH(DMI_BOARD_NAME, "MECH-17"), + }, + }, {/* TongFang GM6XGxX/TUXEDO Stellaris 16 Gen5 AMD */ .matches = {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 70/231 smb: client: fix noisy when tree connecting to DFS interlink targets
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Alcantara <[email protected]>
[ Upstream commit 773dc23ff81838b6f74d7fabba5a441cc6a93982 ]
When the client attempts to tree connect to a domain-based DFS namespace from a DFS interlink target, the server will return STATUS_BAD_NETWORK_NAME and the following will appear on dmesg:
CIFS: VFS: BAD_NETWORK_NAME: \\dom\dfs
Since a DFS share might contain several DFS interlinks and they expire after 10 minutes, the above message might end up being flooded on dmesg when mounting or accessing them.
Print this only once per share.
--- fs/smb/client/smb2pdu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/smb/client/smb2pdu.c +1 -1
@@ -2175,7 +2175,7 @@ SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree, tcon_error_exit:if (rsp && rsp->hdr.Status ==STATUS_BAD_NETWORK_NAME ) -cifs_tcon_dbg (VFS ,"BAD_NETWORK_NAME: %s\n" , tree); +cifs_dbg (VFS |ONCE ,"BAD_NETWORK_NAME: %s\n" , tree); goto tcon_exit; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 71/231 alpha/elf: Fix misc/setarch test of util-linux by removing 32bit support
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric W. Biederman <[email protected]>
[ Upstream commit b029628be267cba3c7684ec684749fe3e4372398 ]
Richard Henderson <[email protected]> writes[1]:
Quoted 11 lines
There was a Spec benchmark (I forget which) which was memory bound and ran twice as fast with 32-bit pointers.
I copied the idea from DEC to the ELF abi, but never did all the other work to allow the toolchain to take advantage.
Amusingly, a later Spec changed the benchmark data sets to not fit into a 32-bit address space, specifically because of this.
I expect one could delete the ELF bit and personality and no one would notice. Not even the 10 remaining Alpha users.
In [2] it was pointed out that parts of setarch weren't working properly on alpha because it has it's own SET_PERSONALITY implementation. In the discussion that followed Richard Henderson pointed out that the 32bit pointer support for alpha was never completed.
Fix this by removing alpha's 32bit pointer support.
As a bit of paranoia refuse to execute any alpha binaries that have the EF_ALPHA_32BIT flag set. Just in case someone somewhere has binaries that try to use alpha's 32bit pointer support.
--- arch/alpha/include/asm/elf.h | 6 +----- arch/alpha/include/asm/pgtable.h | 2 +- arch/alpha/include/asm/processor.h | 8 ++------ arch/alpha/kernel/osf_sys.c | 11 ++--------- 4 files changed, 6 insertions(+), 21 deletions(-)
arch/alpha/include/asm/elf.h +1 -5
@@ -74,7 +74,7 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_NFPREG];/* * This is used to ensure we don't load something for the wrong architecture. */ -#define elf_check_arch (x) ((x)->e_machine == EM_ALPHA) +#define elf_check_arch (x) (((x)->e_machine == EM_ALPHA) && !((x)->e_flags & EF_ALPHA_32BIT))/* * These are used to set parameters in the core dumps.
@@ -137,10 +137,6 @@ extern int dump_elf_task(elf_greg_t *dest, struct task_struct *task); : amask (AMASK_CIX) ? "ev6" : "ev67"); \ }) -#define SET_PERSONALITY (EX ) \ - set_personality(((EX).e_flags & EF_ALPHA_32BIT) \ - ? PER_LINUX_32BIT : PER_LINUX) -extern int alpha_l1i_cacheshape;extern int alpha_l1d_cacheshape;extern int alpha_l2_cacheshape;
arch/alpha/include/asm/pgtable.h +1 -1
@@ -360,7 +360,7 @@ static inline pte_t pte_swp_clear_exclusive(pte_t pte)extern void paging_init (void ); -/* We have our own get_unmapped_area to cope with ADDR_LIMIT_32BIT. */ +/* We have our own get_unmapped_area */ #define HAVE_ARCH_UNMAPPED_AREA #endif /* _ALPHA_PGTABLE_H */
arch/alpha/include/asm/processor.h +2 -6
@@ -8,23 +8,19 @@#ifndef __ASM_ALPHA_PROCESSOR_H#define __ASM_ALPHA_PROCESSOR_H -#include <linux/personality.h> /* for ADDR_LIMIT_32BIT */ -/* * We have a 42-bit user address space: 4TB user VM... */ #define TASK_SIZE (0x40000000000UL) -#define STACK_TOP \ - (current->personality & ADDR_LIMIT_32BIT ? 0x80000000 : 0x00120000000UL) +#define STACK_TOP (0x00120000000UL)#define STACK_TOP_MAX 0x00120000000UL/* This decides where the kernel will search for a free chunk of vm * space during mmap's. */ -#define TASK_UNMAPPED_BASE \ - ((current->personality & ADDR_LIMIT_32BIT) ? 0x40000000 : TASK_SIZE / 2) +#define TASK_UNMAPPED_BASE (TASK_SIZE / 2)/* This is dead. Everything has been moved to thread_info. */ struct thread_struct { };
arch/alpha/kernel/osf_sys.c +2 -9
@@ -1211,8 +1211,7 @@ SYSCALL_DEFINE1(old_adjtimex, struct timex32 __user *, txc_p)return ret; } -/* Get an address range which is currently unmapped. Similar to the -generic version except that we know how to honor ADDR_LIMIT_32BIT. */ +/* Get an address range which is currently unmapped. */ static unsigned long arch_get_unmapped_area_1(unsigned long addr, unsigned long len,
@@ -1231,13 +1230,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr, unsigned long len, unsigned long pgoff, unsigned long flags, vm_flags_t vm_flags) { - unsigned long limit; - -/* "32 bit" actually means 31 bit, since pointers sign extend. */ -if (current->personality &ADDR_LIMIT_32BIT ) - limit =0x80000000 ; -else - limit =TASK_SIZE ; + unsigned long limit = TASK_SIZE;if (len > limit)return -ENOMEM ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 72/231 vboxsf: fix building with GCC 15
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brahmajit Das <[email protected]>
[ Upstream commit 4e7487245abcbc5a1a1aea54e4d3b33c53804bda ]
Building with GCC 15 results in build errorfs/vboxsf/super.c:24:54: error: initializer-string for array of ‘unsigned char’ is too long [-Werror=unterminated-string-initialization]
24 | static const unsigned char VBSF_MOUNT_SIGNATURE[4] = "\000\377\376\375";
| ^~~~~~~~~~~~~~~~~~cc1: all warnings being treated as errors
Due to GCC having enabled -Werror=unterminated-string-initialization[0] by default. Separately initializing each array element of VBSF_MOUNT_SIGNATURE to ensure NUL termination, thus satisfying GCC 15 and fixing the build error.
[0]: https://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html#index-Wno-unterminated-string-initialization
--- fs/vboxsf/super.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/vboxsf/super.c +2 -1
@@ -21,7 +21,8 @@#define VBOXSF_SUPER_MAGIC 0x786f4256/* 'VBox' little endian */ -static const unsigned char VBSF_MOUNT_SIGNATURE [4 ] ="\000\377\376\375" ; +static const unsigned char VBSF_MOUNT_SIGNATURE [4 ] = {'\000' ,'\377' ,'\376' , +'\375' };static int follow_symlinks;module_param (follow_symlinks, int,0444 );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 73/231 selftests: always check mask returned by statmount(2)
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <[email protected]>
[ Upstream commit 2cc02059fbc79306b53a44b1f1a4444aa3c76598 ]
STATMOUNT_MNT_OPTS can actually be missing if there are no options. This is a change of behavior since 75ead69a7173 ("fs: don't let statmount return empty strings").
The other checks shouldn't actually trigger, but add them for correctness and for easier debugging if the test fails.
--- .../filesystems/statmount/statmount_test.c | 22 ++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-)
tools/testing/selftests/filesystems/statmount/statmount_test.c +21 -1
@@ -383,6 +383,10 @@ static void test_statmount_mnt_point(void)return ; } +if (!(sm->mask &STATMOUNT_MNT_POINT )) { +ksft_test_result_fail ("missing STATMOUNT_MNT_POINT in mask\n" ); +return ; + }if (strcmp (sm->str + sm->mnt_point,"/" ) !=0 ) {ksft_test_result_fail ("unexpected mount point: '%s' != '/'\n" , sm->str + sm->mnt_point);
@@ -408,6 +412,10 @@ static void test_statmount_mnt_root(void) strerror(errno));return ; } +if (!(sm->mask &STATMOUNT_MNT_ROOT )) { +ksft_test_result_fail ("missing STATMOUNT_MNT_ROOT in mask\n" ); +return ; + } mnt_root = sm->str + sm->mnt_root; last_root =strrchr (mnt_root,'/' );if (last_root)
@@ -437,6 +445,10 @@ static void test_statmount_fs_type(void) strerror(errno));return ; } +if (!(sm->mask &STATMOUNT_FS_TYPE )) { +ksft_test_result_fail ("missing STATMOUNT_FS_TYPE in mask\n" ); +return ; + } fs_type = sm->str + sm->fs_type;for (s = known_fs; s !=NULL ; s++) {if (strcmp (fs_type, *s) ==0 )
@@ -464,6 +476,11 @@ static void test_statmount_mnt_opts(void)return ; } +if (!(sm->mask &STATMOUNT_MNT_BASIC )) { +ksft_test_result_fail ("missing STATMOUNT_MNT_BASIC in mask\n" ); +return ; + } +while (getline (&line, &len, f_mountinfo) !=-1 ) {int i;char *p, *p2;
@@ -514,7 +531,10 @@ static void test_statmount_mnt_opts(void)if (p2) *p2 ='\0' ; - statmount_opts = sm->str + sm->mnt_opts; +if (sm->mask &STATMOUNT_MNT_OPTS ) + statmount_opts = sm->str + sm->mnt_opts; +else + statmount_opts ="" ;if (strcmp (statmount_opts, p) !=0 ) ksft_test_result_fail( "unexpected mount options: '%s' != '%s'\n",
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 74/231 sched_ext: selftests/dsp_local_on: Fix sporadic failures
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <[email protected]>
[ Upstream commit e9fe182772dcb2630964724fd93e9c90b68ea0fd ]
dsp_local_on has several incorrect assumptions, one of which is that p->nr_cpus_allowed always tracks p->cpus_ptr. This is not true when a task is scheduled out while migration is disabled - p->cpus_ptr is temporarily overridden to the previous CPU while p->nr_cpus_allowed remains unchanged.
This led to sporadic test faliures when dsp_local_on_dispatch() tries to put a migration disabled task to a different CPU. Fix it by keeping the previous CPU when migration is disabled.
There are SCX schedulers that make use of p->nr_cpus_allowed. They should also implement explicit handling for p->migration_disabled.
--- tools/testing/selftests/sched_ext/dsp_local_on.bpf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/sched_ext/dsp_local_on.bpf.c +1 -1
@@ -43,7 +43,7 @@ void BPF_STRUCT_OPS(dsp_local_on_dispatch, s32 cpu, struct task_struct *prev)if (!p)return ; -if (p->nr_cpus_allowed == nr_cpus) +if (p->nr_cpus_allowed == nr_cpus && !p->migration_disabled) target =bpf_get_prandom_u32 () % nr_cpus;else target =scx_bpf_task_cpu (p);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 75/231 HID: intel-ish-hid: fix the length of MNG_SYNC_FW_CLOCK in doorbell
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Lixu <[email protected]>
[ Upstream commit 4b54ae69197b9f416baa0fceadff7e89075f8454 ]
The timestamps in the Firmware log and HID sensor samples are incorrect. They show 1970-01-01 because the current IPC driver only uses the first 8 bytes of bootup time when synchronizing time with the firmware. The firmware converts the bootup time to UTC time, which results in the display of 1970-01-01.
In write_ipc_from_queue(), when sending the MNG_SYNC_FW_CLOCK message, the clock is updated according to the definition of ipc_time_update_msg. However, in _ish_sync_fw_clock(), the message length is specified as the size of uint64_t when building the doorbell. As a result, the firmware only receives the first 8 bytes of struct ipc_time_update_msg. This patch corrects the length in the doorbell to ensure the entire ipc_time_update_msg is sent, fixing the timestamp issue.
--- drivers/hid/intel-ish-hid/ipc/ipc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/hid/intel-ish-hid/ipc/ipc.c +3 -3
@@ -578,14 +578,14 @@ static void fw_reset_work_fn(struct work_struct *work)static void _ish_sync_fw_clock (struct ishtp_device *dev) {static unsigned long prev_sync; -uint64_t usec; +struct ipc_time_update_msg time = {};if (prev_sync &&time_before (jiffies, prev_sync +20 *HZ ))return ; prev_sync = jiffies; - usec =ktime_to_us (ktime_get_boottime ()); -ipc_send_mng_msg (dev,MNG_SYNC_FW_CLOCK , &usec,sizeof (uint64_t )); +/* The fields of time would be updated while sending message */ +ipc_send_mng_msg (dev,MNG_SYNC_FW_CLOCK , &time,sizeof (time)); }/**
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 76/231 HID: intel-ish-hid: Send clock sync message immediately after reset
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Lixu <[email protected]>
[ Upstream commit 7e0d1cff12b895f44f4ddc8cf50311bc1f775201 ]
The ISH driver performs a clock sync with the firmware once at system startup and then every 20 seconds. If a firmware reset occurs right after a clock sync, the driver would wait 20 seconds before performing another clock sync with the firmware. This is particularly problematic with the introduction of the "load firmware from host" feature, where the driver performs a clock sync with the bootloader and then has to wait 20 seconds before syncing with the main firmware.
This patch clears prev_sync immediately upon receiving an IPC reset, so that the main firmware and driver will perform a clock sync immediately after completing the IPC handshake.
--- drivers/hid/intel-ish-hid/ipc/ipc.c | 9 ++++++--- drivers/hid/intel-ish-hid/ishtp/ishtp-dev.h | 2 ++ 2 files changed, 8 insertions(+), 3 deletions(-)
drivers/hid/intel-ish-hid/ipc/ipc.c +6 -3
@@ -517,6 +517,10 @@ static int ish_fw_reset_handler(struct ishtp_device *dev)/* ISH FW is dead */ if (!ish_is_input_ready (dev))return -EPIPE ; + +/* Send clock sync at once after reset */ + ishtp_dev->prev_sync =0 ; +/* * Set HOST2ISH.ILUP. Apparently we need this BEFORE sending * RESET_NOTIFY_ACK - FW will be checking for it
@@ -577,13 +581,12 @@ static void fw_reset_work_fn(struct work_struct *work)*/ static void _ish_sync_fw_clock (struct ishtp_device *dev) { -static unsigned long prev_sync;struct ipc_time_update_msg time = {}; -if (prev_sync &&time_before (jiffies, prev_sync +20 *HZ )) +if (dev->prev_sync &&time_before (jiffies, dev->prev_sync +20 *HZ ))return ; - prev_sync = jiffies; + dev->prev_sync = jiffies;/* The fields of time would be updated while sending message */ ipc_send_mng_msg (dev,MNG_SYNC_FW_CLOCK , &time,sizeof (time)); }
drivers/hid/intel-ish-hid/ishtp/ishtp-dev.h +2 -0
@@ -242,6 +242,8 @@ struct ishtp_device {unsigned int ipc_tx_cnt;unsigned long long ipc_tx_bytes_cnt; +/* Time of the last clock sync */ +unsigned long prev_sync;const struct ishtp_hw_ops *ops;size_t mtu;uint32_t ishtp_msg_hdr;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 77/231 HID: ignore non-functional sensor in HP 5MP Camera
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chia-Lin Kao (AceLan) <[email protected]>
[ Upstream commit 363236d709e75610b628c2a4337ccbe42e454b6d ]
The HP 5MP Camera (USB ID 0408:5473) reports a HID sensor interface that is not actually implemented. Attempting to access this non-functional sensor via iio_info causes system hangs as runtime PM tries to wake up an unresponsive sensor.
[453] hid-sensor-hub 0003:0408:5473.0003: Report latency attributes: ffffffff:ffffffff
[453] hid-sensor-hub 0003:0408:5473.0003: common attributes: 5:1, 2:1, 3:1 ffffffff:ffffffff
Add this device to the HID ignore list since the sensor interface is non-functional by design and should not be exposed to userspace.
--- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-quirks.c | 1 + 2 files changed, 2 insertions(+)
drivers/hid/hid-ids.h +1 -0
@@ -1089,6 +1089,7 @@#define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3001 0x3001#define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3003 0x3003#define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3008 0x3008 +#define USB_DEVICE_ID_QUANTA_HP_5MP_CAMERA_5473 0x5473#define I2C_VENDOR_ID_RAYDIUM 0x2386#define I2C_PRODUCT_ID_RAYDIUM_4B33 0x4b33
drivers/hid/hid-quirks.c +1 -0
@@ -891,6 +891,7 @@ static const struct hid_device_id hid_ignore_list[] = { { HID_USB_DEVICE(USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_DPAD) }, #endif { HID_USB_DEVICE(USB_VENDOR_ID_YEALINK, USB_DEVICE_ID_YEALINK_P1K_P4K_B2K) }, + { HID_USB_DEVICE(USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_HP_5MP_CAMERA_5473) }, { } };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 78/231 HID: hid-steam: Fix issues with disabling both gamepad mode and lizard mode
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vicki Pfau <[email protected]>
[ Upstream commit 05c4ede6951b5d8e083b6bb237950cac59bdeb92 ]
When lizard mode is disabled, there were two issues:
1. Switching between gamepad mode and desktop mode still functioned, even though desktop mode did not. This lead to the ability to "break" gamepad mode by holding down the Options key even while lizard mode is disabled
2. If you were in desktop mode when lizard mode is disabled, you would immediately enter this faulty mode.
This patch properly disables the ability to switch between gamepad mode and the faulty desktop mode by holding the Options key, as well as effectively removing the faulty mode by bypassing the early returns if lizard mode is disabled.
--- drivers/hid/hid-steam.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/hid/hid-steam.c +3 -3
@@ -1051,10 +1051,10 @@ static void steam_mode_switch_cb(struct work_struct *work) struct steam_device, mode_switch);unsigned long flags;bool client_opened; - steam->gamepad_mode = !steam->gamepad_mode;if (!lizard_mode)return ; + steam->gamepad_mode = !steam->gamepad_mode;if (steam->gamepad_mode)steam_set_lizard_mode (steam, false);else {
@@ -1623,7 +1623,7 @@ static void steam_do_deck_input_event(struct steam_device *steam,schedule_delayed_work (&steam->mode_switch,45 *HZ /100 ); } -if (!steam->gamepad_mode) +if (!steam->gamepad_mode && lizard_mode)return ; lpad_touched = b10 &BIT (3 );
@@ -1693,7 +1693,7 @@ static void steam_do_deck_sensors_event(struct steam_device *steam,*/ steam->sensor_timestamp_us +=4000 ; -if (!steam->gamepad_mode) +if (!steam->gamepad_mode && lizard_mode)return ;input_event (sensors,EV_MSC ,MSC_TIMESTAMP , steam->sensor_timestamp_us);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 79/231 usb: phy: generic: Use proper helper for property detection
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Stein <[email protected]>
[ Upstream commit 309005e448c1f3e4b81e4416406991b7c3339c1d ]
Since commit c141ecc3cecd7 ("of: Warn when of_property_read_bool() is used on non-boolean properties") a warning is raised if this function is used for property detection. of_property_present() is the correct helper for this.
--- drivers/usb/phy/phy-generic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/phy/phy-generic.c +1 -1
@@ -212,7 +212,7 @@ int usb_phy_gen_create_phy(struct device *dev, struct usb_phy_generic *nop)if (of_property_read_u32 (node,"clock-frequency" , &clk_rate)) clk_rate =0 ; - needs_clk =of_property_read_bool (node,"clocks" ); + needs_clk =of_property_present (node,"clocks" ); } nop->gpiod_reset =devm_gpiod_get_optional (dev,"reset" ,GPIOD_ASIS );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 80/231 HID: intel-ish-hid: ipc: Add Panther Lake PCI device IDs
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Lixu <[email protected]>
[ Upstream commit 18c966b62819b9d3b99eac8fb8cdc8950826e0c2 ]
Add device IDs of Panther Lake-H and Panther Lake-P into ishtp support list.
--- drivers/hid/intel-ish-hid/ipc/hw-ish.h | 2 ++ drivers/hid/intel-ish-hid/ipc/pci-ish.c | 7 +++++++ 2 files changed, 9 insertions(+)
drivers/hid/intel-ish-hid/ipc/hw-ish.h +2 -0
@@ -36,6 +36,8 @@#define PCI_DEVICE_ID_INTEL_ISH_ARL_H 0x7745#define PCI_DEVICE_ID_INTEL_ISH_ARL_S 0x7F78#define PCI_DEVICE_ID_INTEL_ISH_LNL_M 0xA845 +#define PCI_DEVICE_ID_INTEL_ISH_PTL_H 0xE345 +#define PCI_DEVICE_ID_INTEL_ISH_PTL_P 0xE445#define REVISION_ID_CHT_A0 0x6#define REVISION_ID_CHT_Ax_SI 0x0
drivers/hid/intel-ish-hid/ipc/pci-ish.c +7 -0
@@ -26,9 +26,11 @@enum ishtp_driver_data_index {ISHTP_DRIVER_DATA_NONE ,ISHTP_DRIVER_DATA_LNL_M , +ISHTP_DRIVER_DATA_PTL , };#define ISH_FW_GEN_LNL_M "lnlm" +#define ISH_FW_GEN_PTL "ptl"#define ISH_FIRMWARE_PATH (gen) "intel/ish/ish_" gen ".bin"#define ISH_FIRMWARE_PATH_ALL "intel/ish/ish_*.bin"
@@ -37,6 +39,9 @@ static struct ishtp_driver_data ishtp_driver_data[] = { [ISHTP_DRIVER_DATA_LNL_M ] = { .fw_generation =ISH_FW_GEN_LNL_M , }, + [ISHTP_DRIVER_DATA_PTL ] = { + .fw_generation =ISH_FW_GEN_PTL , + }, };static const struct pci_device_id ish_pci_tbl[] = {
@@ -63,6 +68,8 @@ static const struct pci_device_id ish_pci_tbl[] = { {PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_ISH_ARL_H)}, {PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_ISH_ARL_S)}, {PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_ISH_LNL_M), .driver_data = ISHTP_DRIVER_DATA_LNL_M}, + {PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_ISH_PTL_H), .driver_data = ISHTP_DRIVER_DATA_PTL}, + {PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_ISH_PTL_P), .driver_data = ISHTP_DRIVER_DATA_PTL}, {} };MODULE_DEVICE_TABLE (pci, ish_pci_tbl);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 81/231 HID: topre: Fix n-key rollover on Realforce R3S TKL boards
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Brackenbury <[email protected]>
[ Upstream commit 9271af9d846c7e49c8709b58d5853cb73c00b193 ]
Newer model R3* Topre Realforce keyboards share an issue with their older R2 cousins where a report descriptor fixup is needed in order for n-key rollover to work correctly, otherwise only 6-key rollover is available. This patch adds some new hardware IDs for the R3S 87-key keyboard and makes amendments to the existing hid-topre driver in order to change the correct byte in the new model.
--- drivers/hid/Kconfig | 3 ++- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-topre.c | 7 +++++++ 3 files changed, 10 insertions(+), 1 deletion(-)
drivers/hid/Kconfig +2 -1
@@ -1154,7 +1154,8 @@ config HID_TOPRE tristate "Topre REALFORCE keyboards" depends on HID help - Say Y for N-key rollover support on Topre REALFORCE R2 108/87 key keyboards. + Say Y for N-key rollover support on Topre REALFORCE R2 108/87 key and + Topre REALFORCE R3S 87 key keyboards. config HID_THINGM tristate "ThingM blink(1) USB RGB LED"
drivers/hid/hid-ids.h +1 -0
@@ -1296,6 +1296,7 @@#define USB_VENDOR_ID_TOPRE 0x0853#define USB_DEVICE_ID_TOPRE_REALFORCE_R2_108 0x0148#define USB_DEVICE_ID_TOPRE_REALFORCE_R2_87 0x0146 +#define USB_DEVICE_ID_TOPRE_REALFORCE_R3S_87 0x0313#define USB_VENDOR_ID_TOPSEED 0x0766#define USB_DEVICE_ID_TOPSEED_CYBERLINK 0x0204
drivers/hid/hid-topre.c +7 -0
@@ -29,6 +29,11 @@ static const __u8 *topre_report_fixup(struct hid_device *hdev, __u8 *rdesc,hid_info (hdev,"fixing up Topre REALFORCE keyboard report descriptor\n" ); rdesc[72 ] =0x02 ; + }else if (*rsize >=106 && rdesc[28 ] ==0x29 && rdesc[29 ] ==0xe7 && + rdesc[30 ] ==0x81 && rdesc[31 ] ==0x00 ) { +hid_info (hdev, +"fixing up Topre REALFORCE keyboard report descriptor\n" ); + rdesc[31 ] =0x02 ; }return rdesc; }
@@ -38,6 +43,8 @@ static const struct hid_device_id topre_id_table[] = { USB_DEVICE_ID_TOPRE_REALFORCE_R2_108) }, { HID_USB_DEVICE(USB_VENDOR_ID_TOPRE, USB_DEVICE_ID_TOPRE_REALFORCE_R2_87) }, + { HID_USB_DEVICE(USB_VENDOR_ID_TOPRE, + USB_DEVICE_ID_TOPRE_REALFORCE_R3S_87) }, { } }; MODULE_DEVICE_TABLE(hid, topre_id_table);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 82/231 selftests/cgroup: use bash in test_cpuset_v1_hp.sh
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bharadwaj Raju <[email protected]>
[ Upstream commit fd079124112c6e11c1bca2e7c71470a2d60bc363 ]
The script uses non-POSIX features like [[ for conditionals and hence does not work when run with a POSIX /bin/sh.
Change the shebang to /bin/bash instead, like the other tests in cgroup.
--- tools/testing/selftests/cgroup/test_cpuset_v1_hp.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/cgroup/test_cpuset_v1_hp.sh +1 -1
@@ -1,4 +1,4 @@ -#!/bin/sh +#!/bin/bash # SPDX-License-Identifier: GPL-2.0 # # Test the special cpuset v1 hotplug case where a cpuset become empty of
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 83/231 HID: hid-apple: Apple Magic Keyboard a3203 USB-C support
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ievgen Vovk <[email protected]>
[ Upstream commit 2813e00dcd748cef47d2bffaa04071de93fddf00 ]
Add Apple Magic Keyboard 2024 model (with USB-C port) device ID (0320) to those recognized by the hid-apple driver. Keyboard is otherwise compatible with the existing implementation for its earlier 2021 model.
--- drivers/hid/hid-apple.c | 5 +++++ drivers/hid/hid-ids.h | 1 + 2 files changed, 6 insertions(+)
drivers/hid/hid-apple.c +5 -0
@@ -474,6 +474,7 @@ static int hidinput_apple_event(struct hid_device *hid, struct input_dev *input, hid->product == USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_NUMPAD_2015) table = magic_keyboard_2015_fn_keys; else if (hid->product == USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2021 || + hid->product == USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2024 || hid->product == USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_FINGERPRINT_2021 || hid->product == USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_NUMPAD_2021) table = apple2021_fn_keys;
@@ -1150,6 +1151,10 @@ static const struct hid_device_id apple_devices[] = { .driver_data = APPLE_HAS_FN | APPLE_ISO_TILDE_QUIRK | APPLE_RDESC_BATTERY }, { HID_BLUETOOTH_DEVICE(BT_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2021), .driver_data = APPLE_HAS_FN | APPLE_ISO_TILDE_QUIRK }, + { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2024), + .driver_data = APPLE_HAS_FN | APPLE_ISO_TILDE_QUIRK | APPLE_RDESC_BATTERY }, + { HID_BLUETOOTH_DEVICE(BT_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2024), + .driver_data = APPLE_HAS_FN | APPLE_ISO_TILDE_QUIRK }, { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_FINGERPRINT_2021), .driver_data = APPLE_HAS_FN | APPLE_ISO_TILDE_QUIRK | APPLE_RDESC_BATTERY }, { HID_BLUETOOTH_DEVICE(BT_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_FINGERPRINT_2021),
drivers/hid/hid-ids.h +1 -0
@@ -184,6 +184,7 @@#define USB_DEVICE_ID_APPLE_IRCONTROL4 0x8242#define USB_DEVICE_ID_APPLE_IRCONTROL5 0x8243#define USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2021 0x029c +#define USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2024 0x0320#define USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_FINGERPRINT_2021 0x029a#define USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_NUMPAD_2021 0x029f#define USB_DEVICE_ID_APPLE_TOUCHBAR_BACKLIGHT 0x8102
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 84/231 HID: apple: fix up the F6 key on the Omoton KB066 keyboard
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Henrie <[email protected]>
[ Upstream commit 819083cb6eedcc8495cbf84845877bcc741b93b3 ]
The Omoton KB066 is an Apple A1255 keyboard clone (HID product code 05ac:022c). On both keyboards, the F6 key becomes Num Lock when the Fn key is held. But unlike its Apple exemplar, when the Omoton's F6 key is pressed without Fn, it sends the usage code 0xC0301 from the reserved section of the consumer page instead of the standard F6 usage code 0x7003F from the keyboard page. The nonstandard code is translated to KEY_UNKNOWN and becomes useless on Linux. The Omoton KB066 is a pretty popular keyboard, judging from its 29,058 reviews on Amazon at time of writing, so let's account for its quirk to make it more usable.
By the way, it would be nice if we could automatically set fnmode to 0 for Omoton keyboards because they handle the Fn key internally and the kernel's Fn key handling creates undesirable side effects such as making F1 and F2 always Brightness Up and Brightness Down in fnmode=1 (the default) or always F1 and F2 in fnmode=2. Unfortunately I don't think there's a way to identify Bluetooth keyboards more specifically than the HID product code which is obviously inaccurate. Users of Omoton keyboards will just have to set fnmode to 0 manually to get full Fn key functionality.
--- drivers/hid/hid-apple.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/hid/hid-apple.c +3 -0
@@ -546,6 +546,9 @@ static int hidinput_apple_event(struct hid_device *hid, struct input_dev *input, } } +if (usage->hid ==0xc0301 )/* Omoton KB066 quirk */ + code =KEY_F6 ; +if (usage->code != code) {input_event_with_scancode (input, usage->type, code, usage->hid, value);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 85/231 btrfs: fix two misuses of folio_shift()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Wilcox (Oracle) <[email protected]>
[ Upstream commit 01af106a076352182b2916b143fc50272600bd81 ]
It is meaningless to shift a byte count by folio_shift(). The folio index is in units of PAGE_SIZE, not folio_size(). We can use folio_contains() to make this work for arbitrary-order folios, so remove the assertion that the folios are of order 0.
--- fs/btrfs/extent_io.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)
fs/btrfs/extent_io.c +5 -6
@@ -526,8 +526,6 @@ static void end_bbio_data_read(struct btrfs_bio *bbio)u64 end;u32 len; -/* For now only order 0 folios are supported for data. */ -ASSERT (folio_order (folio) ==0 ); btrfs_debug(fs_info, "%s: bi_sector=%llu, err=%d, mirror=%u", __func__, bio->bi_iter.bi_sector, bio->bi_status,
@@ -555,7 +553,6 @@ static void end_bbio_data_read(struct btrfs_bio *bbio)if (likely (uptodate)) {loff_t i_size =i_size_read (inode); -pgoff_t end_index = i_size >>folio_shift (folio);/* * Zero out the remaining part if this range straddles
@@ -564,9 +561,11 @@ static void end_bbio_data_read(struct btrfs_bio *bbio)* Here we should only zero the range inside the folio, * not touch anything else. * -* NOTE: i_size is exclusive while end is inclusive. +* NOTE: i_size is exclusive while end is inclusive and +* folio_contains() takes PAGE_SIZE units. */ -if (folio_index (folio) == end_index && i_size <= end) { +if (folio_contains (folio, i_size >>PAGE_SHIFT ) && + i_size <= end) {u32 zero_start =max (offset_in_folio (folio, i_size),offset_in_folio (folio, start)); u32 zero_len = offset_in_folio(folio, end) + 1 -
@@ -960,7 +959,7 @@ static int btrfs_do_readpage(struct folio *folio, struct extent_map **em_cached,return ret; } -if (folio->index == last_byte >>folio_shift (folio)) { +if (folio_contains (folio, last_byte >>PAGE_SHIFT )) {size_t zero_offset =offset_in_folio (folio, last_byte);if (zero_offset) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 86/231 objtool: Ignore dangling jump table entries
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <[email protected]>
[ Upstream commit 3724062ca2b1364f02cf44dbea1a552227844ad1 ]
Clang sometimes leaves dangling unused jump table entries which point to the end of the function. Ignore them.
--- tools/objtool/check.c | 9 +++++++++ 1 file changed, 9 insertions(+)
tools/objtool/check.c +9 -0
@@ -2061,6 +2061,14 @@ static int add_jump_table(struct objtool_file *file, struct instruction *insn, reloc_addend(reloc) == pfunc->offset)break ; +/* +* Clang sometimes leaves dangling unused jump table entries +* which point to the end of the function. Ignore them. +*/ +if (reloc->sym->sec == pfunc->sec && +reloc_addend (reloc) == pfunc->offset + pfunc->len) + goto next; + dest_insn =find_insn (file, reloc->sym->sec,reloc_addend (reloc));if (!dest_insn)break ;
@@ -2078,6 +2086,7 @@ static int add_jump_table(struct objtool_file *file, struct instruction *insn, alt->insn = dest_insn; alt->next = insn->alts; insn->alts = alt; +next: prev_offset =reloc_offset (reloc); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 87/231 sched: Clarify wake_up_q()s write to task->wake_q.next
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <[email protected]>
[ Upstream commit bcc6244e13b4d4903511a1ea84368abf925031c0 ]
Clarify that wake_up_q() does an atomic write to task->wake_q.next, after which a concurrent __wake_q_add() can immediately overwrite task->wake_q.next again.
--- kernel/sched/core.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
kernel/sched/core.c +3 -2
@@ -1058,9 +1058,10 @@ void wake_up_q(struct wake_q_head *head)struct task_struct *task; task = container_of(node, struct task_struct, wake_q); -/* Task can safely be re-inserted now: */ node = node->next; - task->wake_q.next =NULL ; +/* pairs with cmpxchg_relaxed() in __wake_q_add() */ +WRITE_ONCE (task->wake_q.next,NULL ); +/* Task can safely be re-inserted now. */ /* * wake_up_process() executes a full barrier, which pairs with
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 88/231 platform/x86: thinkpad_acpi: Fix invalid fan speed on ThinkPad X120e
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sybil Isabel Dorsett <[email protected]>
[ Upstream commit 1046cac109225eda0973b898e053aeb3d6c10e1d ]
On ThinkPad X120e, fan speed is reported in ticks per revolution rather than RPM.
Recalculate the fan speed value reported for ThinkPad X120e to RPM based on a 22.5 kHz clock.
Based on the information on
https://www.thinkwiki.org/wiki/How_to_control_fan_speed,
the same problem is highly likely to be relevant to at least Edge11, but Edge11 is not addressed in this patch.
--- drivers/platform/x86/thinkpad_acpi.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-)
drivers/platform/x86/thinkpad_acpi.c +14 -2
@@ -7883,6 +7883,7 @@ static struct ibm_struct volume_driver_data = {#define FAN_NS_CTRL_STATUS BIT(2)/* Bit which determines control is enabled or not */ #define FAN_NS_CTRL BIT(4)/* Bit which determines control is by host or EC */ +#define FAN_CLOCK_TPM (22500*60)/* Ticks per minute for a 22.5 kHz clock */ enum {/* Fan control constants */ fan_status_offset =0x2f ,/* EC register 0x2f */
@@ -7938,6 +7939,7 @@ static int fan_watchdog_maxinterval;static bool fan_with_ns_addr;static bool ecfw_with_fan_dec_rpm; +static bool fan_speed_in_tpr;static struct mutex fan_mutex;
@@ -8140,8 +8142,11 @@ static int fan_get_speed(unsigned int *speed) !acpi_ec_read(fan_rpm_offset + 1, &hi)))return -EIO ; -if (likely (speed)) +if (likely (speed)) { *speed = (hi <<8 ) | lo; +if (fan_speed_in_tpr && *speed !=0 ) + *speed =FAN_CLOCK_TPM / *speed; + }break ;case TPACPI_FAN_RD_TPEC_NS :if (!acpi_ec_read (fan_rpm_status_ns, &lo))
@@ -8174,8 +8179,11 @@ static int fan2_get_speed(unsigned int *speed)if (rc)return -EIO ; -if (likely (speed)) +if (likely (speed)) { *speed = (hi <<8 ) | lo; +if (fan_speed_in_tpr && *speed !=0 ) + *speed =FAN_CLOCK_TPM / *speed; + }break ;case TPACPI_FAN_RD_TPEC_NS :
@@ -8786,6 +8794,7 @@ static const struct attribute_group fan_driver_attr_group = {#define TPACPI_FAN_NOFAN 0x0008/* no fan available */ #define TPACPI_FAN_NS 0x0010/* For EC with non-Standard register addresses */ #define TPACPI_FAN_DECRPM 0x0020/* For ECFW's with RPM in register as decimal */ +#define TPACPI_FAN_TPR 0x0040/* Fan speed is in Ticks Per Revolution */ static const struct tpacpi_quirk fan_quirk_table[]__initconst = {TPACPI_QEC_IBM ('1' ,'Y' ,TPACPI_FAN_Q1 ),
@@ -8815,6 +8824,7 @@ static const struct tpacpi_quirk fan_quirk_table[] __initconst = {TPACPI_Q_LNV3 ('R' ,'0' ,'V' ,TPACPI_FAN_NS ),/* 11e Gen5 KL-Y */ TPACPI_Q_LNV3 ('N' ,'1' ,'O' ,TPACPI_FAN_NOFAN ),/* X1 Tablet (2nd gen) */ TPACPI_Q_LNV3 ('R' ,'0' ,'Q' ,TPACPI_FAN_DECRPM ),/* L480 */ + TPACPI_Q_LNV('8', 'F', TPACPI_FAN_TPR), /* ThinkPad x120e */ };static int __init fan_init (struct ibm_init_struct *iibm)
@@ -8885,6 +8895,8 @@ static int __init fan_init(struct ibm_init_struct *iibm)if (quirks &TPACPI_FAN_Q1 )fan_quirk1_setup (); +if (quirks &TPACPI_FAN_TPR ) + fan_speed_in_tpr = true;/* Try and probe the 2nd fan */ tp_features.second_fan =1 ;/* needed for get_speed to work */ res =fan2_get_speed (&speed);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 89/231 platform/x86: thinkpad_acpi: Support for V9 DYTC platform profiles
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Pearson <[email protected]>
[ Upstream commit 9cff907cbf8c7fb5345918dbcc7b74a01656f34f ]
Newer Thinkpad AMD platforms are using V9 DYTC and this changes the profiles used for PSC mode. Add support for this update. Tested on P14s G5 AMD
--- drivers/platform/x86/thinkpad_acpi.c | 34 ++++++++++++++++++---------- 1 file changed, 22 insertions(+), 12 deletions(-)
drivers/platform/x86/thinkpad_acpi.c +22 -12
@@ -10330,6 +10330,10 @@ static struct ibm_struct proxsensor_driver_data = {#define DYTC_MODE_PSC_BALANCE 5/* Default mode aka balanced */ #define DYTC_MODE_PSC_PERFORM 7/* High power mode aka performance */ +#define DYTC_MODE_PSCV9_LOWPOWER 1/* Low power mode */ +#define DYTC_MODE_PSCV9_BALANCE 3/* Default mode aka balanced */ +#define DYTC_MODE_PSCV9_PERFORM 4/* High power mode aka performance */ +#define DYTC_ERR_MASK 0xF/* Bits 0-3 in cmd result are the error result */ #define DYTC_ERR_SUCCESS 1/* CMD completed successful */
@@ -10350,6 +10354,10 @@ static int dytc_capabilities;static bool dytc_mmc_get_available;static int profile_force; +static int platform_psc_profile_lowpower =DYTC_MODE_PSC_LOWPOWER ; +static int platform_psc_profile_balanced =DYTC_MODE_PSC_BALANCE ; +static int platform_psc_profile_performance =DYTC_MODE_PSC_PERFORM ; +static int convert_dytc_to_profile (int funcmode,int dytcmode,enum platform_profile_option *profile) {
@@ -10371,19 +10379,15 @@ static int convert_dytc_to_profile(int funcmode, int dytcmode, }return 0 ;case DYTC_FUNCTION_PSC : -switch (dytcmode) { -case DYTC_MODE_PSC_LOWPOWER : +if (dytcmode == platform_psc_profile_lowpower) *profile =PLATFORM_PROFILE_LOW_POWER ; -break ; -case DYTC_MODE_PSC_BALANCE : +else if (dytcmode == platform_psc_profile_balanced) *profile =PLATFORM_PROFILE_BALANCED ; -break ; -case DYTC_MODE_PSC_PERFORM : +else if (dytcmode == platform_psc_profile_performance) *profile =PLATFORM_PROFILE_PERFORMANCE ; -break ; -default :/* Unknown mode */ +else return -EINVAL ; - } +return 0 ;case DYTC_FUNCTION_AMT :/* For now return balanced. It's the closest we have to 'auto' */
@@ -10404,19 +10408,19 @@ static int convert_profile_to_dytc(enum platform_profile_option profile, int *peif (dytc_capabilities &BIT (DYTC_FC_MMC )) *perfmode =DYTC_MODE_MMC_LOWPOWER ;else if (dytc_capabilities &BIT (DYTC_FC_PSC )) - *perfmode =DYTC_MODE_PSC_LOWPOWER ; + *perfmode = platform_psc_profile_lowpower;break ;case PLATFORM_PROFILE_BALANCED :if (dytc_capabilities &BIT (DYTC_FC_MMC )) *perfmode =DYTC_MODE_MMC_BALANCE ;else if (dytc_capabilities &BIT (DYTC_FC_PSC )) - *perfmode =DYTC_MODE_PSC_BALANCE ; + *perfmode = platform_psc_profile_balanced;break ;case PLATFORM_PROFILE_PERFORMANCE :if (dytc_capabilities &BIT (DYTC_FC_MMC )) *perfmode =DYTC_MODE_MMC_PERFORM ;else if (dytc_capabilities &BIT (DYTC_FC_PSC )) - *perfmode =DYTC_MODE_PSC_PERFORM ; + *perfmode = platform_psc_profile_performance;break ;default :/* Unknown profile */ return -EOPNOTSUPP ;
@@ -10605,6 +10609,7 @@ static int tpacpi_dytc_profile_init(struct ibm_init_struct *iibm)if (output &BIT (DYTC_QUERY_ENABLE_BIT )) dytc_version = (output >>DYTC_QUERY_REV_BIT ) &0xF ; +dbg_printk (TPACPI_DBG_INIT ,"DYTC version %d\n" , dytc_version);/* Check DYTC is enabled and supports mode setting */ if (dytc_version <5 )return -ENODEV ;
@@ -10643,6 +10648,11 @@ static int tpacpi_dytc_profile_init(struct ibm_init_struct *iibm) } }else if (dytc_capabilities &BIT (DYTC_FC_PSC )) {/* PSC MODE */ pr_debug ("PSC is supported\n" ); +if (dytc_version >=9 ) {/* update profiles for DYTC 9 and up */ + platform_psc_profile_lowpower =DYTC_MODE_PSCV9_LOWPOWER ; + platform_psc_profile_balanced =DYTC_MODE_PSCV9_BALANCE ; + platform_psc_profile_performance =DYTC_MODE_PSCV9_PERFORM ; + } }else {dbg_printk (TPACPI_DBG_INIT ,"No DYTC support available\n" );return -ENODEV ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 90/231 platform/x86: int3472: Use correct type for "polarity", call it gpio_flags
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <[email protected]>
[ Upstream commit fc22b06fbd2afefa1eddff69a6fd30c539cef577 ]
Struct gpiod_lookup flags field's type is unsigned long. Thus use unsigned long for values to be assigned to that field. Similarly, also call the field gpio_flags which it really is.
--- drivers/platform/x86/intel/int3472/discrete.c | 39 ++++++++++--------- 1 file changed, 20 insertions(+), 19 deletions(-)
drivers/platform/x86/intel/int3472/discrete.c +20 -19
@@ -55,7 +55,7 @@ static void skl_int3472_log_sensor_module_name(struct int3472_discrete_device *istatic int skl_int3472_fill_gpiod_lookup (struct gpiod_lookup *table_entry,struct acpi_resource_gpio *agpio, -const char *func,u32 polarity) +const char *func,unsigned long gpio_flags) {char *path = agpio->resource_source.string_ptr;struct acpi_device *adev;
@@ -70,14 +70,14 @@ static int skl_int3472_fill_gpiod_lookup(struct gpiod_lookup *table_entry,if (!adev)return -ENODEV ; - *table_entry =GPIO_LOOKUP (acpi_dev_name (adev), agpio->pin_table[0 ], func, polarity); + *table_entry =GPIO_LOOKUP (acpi_dev_name (adev), agpio->pin_table[0 ], func, gpio_flags);return 0 ; }static int skl_int3472_map_gpio_to_sensor (struct int3472_discrete_device *int3472,struct acpi_resource_gpio *agpio, -const char *func,u32 polarity) +const char *func,unsigned long gpio_flags) {int ret;
@@ -87,7 +87,7 @@ static int skl_int3472_map_gpio_to_sensor(struct int3472_discrete_device *int347 } ret =skl_int3472_fill_gpiod_lookup (&int3472->gpios.table[int3472->n_sensor_gpios], - agpio, func, polarity); + agpio, func, gpio_flags);if (ret)return ret;
@@ -100,7 +100,7 @@ static int skl_int3472_map_gpio_to_sensor(struct int3472_discrete_device *int347static struct gpio_desc *skl_int3472_gpiod_get_from_temp_lookup (struct int3472_discrete_device *int3472,struct acpi_resource_gpio *agpio, -const char *func,u32 polarity) +const char *func,unsigned long gpio_flags) {struct gpio_desc *desc;int ret;
@@ -111,7 +111,7 @@ skl_int3472_gpiod_get_from_temp_lookup(struct int3472_discrete_device *int3472,return ERR_PTR (-ENOMEM ); lookup->dev_id =dev_name (int3472->dev); - ret =skl_int3472_fill_gpiod_lookup (&lookup->table[0 ], agpio, func, polarity); + ret =skl_int3472_fill_gpiod_lookup (&lookup->table[0 ], agpio, func, gpio_flags);if (ret)return ERR_PTR (ret);
@@ -122,32 +122,33 @@ skl_int3472_gpiod_get_from_temp_lookup(struct int3472_discrete_device *int3472,return desc; } -static void int3472_get_func_and_polarity (u8 type,const char **func,u32 *polarity) +static void int3472_get_func_and_polarity (u8 type,const char **func, +unsigned long *gpio_flags) {switch (type) {case INT3472_GPIO_TYPE_RESET : *func ="reset" ; - *polarity =GPIO_ACTIVE_LOW ; + *gpio_flags =GPIO_ACTIVE_LOW ;break ;case INT3472_GPIO_TYPE_POWERDOWN : *func ="powerdown" ; - *polarity =GPIO_ACTIVE_LOW ; + *gpio_flags =GPIO_ACTIVE_LOW ;break ;case INT3472_GPIO_TYPE_CLK_ENABLE : *func ="clk-enable" ; - *polarity =GPIO_ACTIVE_HIGH ; + *gpio_flags =GPIO_ACTIVE_HIGH ;break ;case INT3472_GPIO_TYPE_PRIVACY_LED : *func ="privacy-led" ; - *polarity =GPIO_ACTIVE_HIGH ; + *gpio_flags =GPIO_ACTIVE_HIGH ;break ;case INT3472_GPIO_TYPE_POWER_ENABLE : *func ="power-enable" ; - *polarity =GPIO_ACTIVE_HIGH ; + *gpio_flags =GPIO_ACTIVE_HIGH ;break ;default : *func ="unknown" ; - *polarity =GPIO_ACTIVE_HIGH ; + *gpio_flags =GPIO_ACTIVE_HIGH ;break ; } }
@@ -194,7 +195,7 @@ static int skl_int3472_handle_gpio_resources(struct acpi_resource *ares,struct gpio_desc *gpio;const char *err_msg;const char *func; -u32 polarity; +unsigned long gpio_flags;int ret;if (!acpi_gpio_get_io_resource (ares, &agpio))
@@ -217,7 +218,7 @@ static int skl_int3472_handle_gpio_resources(struct acpi_resource *ares, type =FIELD_GET (INT3472_GPIO_DSM_TYPE , obj->integer.value); -int3472_get_func_and_polarity (type, &func, &polarity); +int3472_get_func_and_polarity (type, &func, &gpio_flags); pin =FIELD_GET (INT3472_GPIO_DSM_PIN , obj->integer.value);if (pin != agpio->pin_table[0 ])
@@ -227,16 +228,16 @@ static int skl_int3472_handle_gpio_resources(struct acpi_resource *ares, active_value =FIELD_GET (INT3472_GPIO_DSM_SENSOR_ON_VAL , obj->integer.value);if (!active_value) - polarity ^=GPIO_ACTIVE_LOW ; + gpio_flags ^=GPIO_ACTIVE_LOW ;dev_dbg (int3472->dev,"%s %s pin %d active-%s\n" , func, agpio->resource_source.string_ptr, agpio->pin_table[0 ], -str_high_low (polarity ==GPIO_ACTIVE_HIGH )); +str_high_low (gpio_flags ==GPIO_ACTIVE_HIGH ));switch (type) {case INT3472_GPIO_TYPE_RESET :case INT3472_GPIO_TYPE_POWERDOWN : - ret =skl_int3472_map_gpio_to_sensor (int3472, agpio, func, polarity); + ret =skl_int3472_map_gpio_to_sensor (int3472, agpio, func, gpio_flags);if (ret) err_msg ="Failed to map GPIO pin to sensor\n" ;
@@ -244,7 +245,7 @@ static int skl_int3472_handle_gpio_resources(struct acpi_resource *ares,case INT3472_GPIO_TYPE_CLK_ENABLE :case INT3472_GPIO_TYPE_PRIVACY_LED :case INT3472_GPIO_TYPE_POWER_ENABLE : - gpio =skl_int3472_gpiod_get_from_temp_lookup (int3472, agpio, func, polarity); + gpio =skl_int3472_gpiod_get_from_temp_lookup (int3472, agpio, func, gpio_flags);if (IS_ERR (gpio)) { ret =PTR_ERR (gpio); err_msg ="Failed to get GPIO\n" ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 91/231 platform/x86: int3472: Call "reset" GPIO "enable" for INT347E
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <[email protected]>
[ Upstream commit 569617dbbd06286fb73f3f1c2ac91e51d863c7de ]
The DT bindings for ov7251 specify "enable" GPIO (xshutdown in documentation) but the int3472 indiscriminately provides this as a "reset" GPIO to sensor drivers. Take this into account by assigning it as "enable" with active high polarity for INT347E devices, i.e. ov7251. "reset" with active low polarity remains the default GPIO name for other devices.
--- drivers/platform/x86/intel/int3472/discrete.c | 52 +++++++++++++++++-- 1 file changed, 48 insertions(+), 4 deletions(-)
drivers/platform/x86/intel/int3472/discrete.c +48 -4
@@ -2,6 +2,7 @@/* Author: Dan Scally <[email protected]> */ #include <linux/acpi.h> +#include <linux/array_size.h> #include <linux/bitfield.h> #include <linux/device.h> #include <linux/gpio/consumer.h>
@@ -122,10 +123,53 @@ skl_int3472_gpiod_get_from_temp_lookup(struct int3472_discrete_device *int3472,return desc; } -static void int3472_get_func_and_polarity (u8 type,const char **func, -unsigned long *gpio_flags) +/** +* struct int3472_gpio_map - Map GPIOs to whatever is expected by the +* sensor driver (as in DT bindings) +* @hid: The ACPI HID of the device without the instance number e.g. INT347E +* @type_from: The GPIO type from ACPI ?SDT +* @type_to: The assigned GPIO type, typically same as @type_from +* @func: The function, e.g. "enable" +* @polarity_low: GPIO_ACTIVE_LOW true if the @polarity_low is true, +* GPIO_ACTIVE_HIGH otherwise +*/ +struct int3472_gpio_map { +const char *hid; +u8 type_from; +u8 type_to; +bool polarity_low; +const char *func; +}; + +static const struct int3472_gpio_map int3472_gpio_map[] = { + {"INT347E" ,INT3472_GPIO_TYPE_RESET ,INT3472_GPIO_TYPE_RESET , false,"enable" }, +}; + +static void int3472_get_func_and_polarity (struct acpi_device *adev,u8 *type, +const char **func,unsigned long *gpio_flags) { -switch (type) { +unsigned int i; + +for (i =0 ; i <ARRAY_SIZE (int3472_gpio_map); i++) { +/* +* Map the firmware-provided GPIO to whatever a driver expects +* (as in DT bindings). First check if the type matches with the +* GPIO map, then further check that the device _HID matches. +*/ +if (*type != int3472_gpio_map[i].type_from) +continue ; + +if (!acpi_dev_hid_uid_match (adev, int3472_gpio_map[i].hid,NULL )) +continue ; + + *type = int3472_gpio_map[i].type_to; + *gpio_flags = int3472_gpio_map[i].polarity_low ? +GPIO_ACTIVE_LOW :GPIO_ACTIVE_HIGH ; + *func = int3472_gpio_map[i].func; +return ; + } + +switch (*type) {case INT3472_GPIO_TYPE_RESET : *func ="reset" ; *gpio_flags =GPIO_ACTIVE_LOW ;
@@ -218,7 +262,7 @@ static int skl_int3472_handle_gpio_resources(struct acpi_resource *ares, type =FIELD_GET (INT3472_GPIO_DSM_TYPE , obj->integer.value); -int3472_get_func_and_polarity (type, &func, &gpio_flags); +int3472_get_func_and_polarity (int3472->sensor, &type, &func, &gpio_flags); pin =FIELD_GET (INT3472_GPIO_DSM_PIN , obj->integer.value);if (pin != agpio->pin_table[0 ])
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 92/231 s390/cio: Fix CHPID "configure" attribute caching
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Oberparleiter <[email protected]>
[ Upstream commit 32ae4a2992529e2c7934e422035fad1d9b0f1fb5 ]
In some environments, the SCLP firmware interface used to query a CHPID's configured state is not supported. On these environments, rapidly reading the corresponding sysfs attribute produces inconsistent results:
$ cat /sys/devices/css0/chp0.00/configure cat: /sys/devices/css0/chp0.00/configure: Operation not supported $ cat /sys/devices/css0/chp0.00/configure 3
This occurs for example when Linux is run as a KVM guest. The inconsistency is a result of CIO using cached results for generating the value of the "configure" attribute while failing to handle the situation where no data was returned by SCLP.
Fix this by not updating the cache-expiration timestamp when SCLP returns no data. With the fix applied, the system response is consistent:
$ cat /sys/devices/css0/chp0.00/configure cat: /sys/devices/css0/chp0.00/configure: Operation not supported $ cat /sys/devices/css0/chp0.00/configure cat: /sys/devices/css0/chp0.00/configure: Operation not supported
--- drivers/s390/cio/chp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/s390/cio/chp.c +2 -1
@@ -682,7 +682,8 @@ static int info_update(void)if (time_after (jiffies, chp_info_expires)) {/* Data is too old, update. */ rc =sclp_chp_read_info (&chp_info); - chp_info_expires = jiffies +CHP_INFO_UPDATE_INTERVAL ; +if (!rc) + chp_info_expires = jiffies +CHP_INFO_UPDATE_INTERVAL ; }mutex_unlock (&info_lock);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 93/231 thermal/cpufreq_cooling: Remove structure member documentation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Lezcano <[email protected]>
[ Upstream commit a6768c4f92e152265590371975d44c071a5279c7 ]
The structure member documentation refers to a member which does not exist any more. Remove it.
--- drivers/thermal/cpufreq_cooling.c | 2 -- 1 file changed, 2 deletions(-)
drivers/thermal/cpufreq_cooling.c +0 -2
@@ -57,8 +57,6 @@ struct time_in_idle {* @max_level: maximum cooling level. One less than total number of valid * cpufreq frequencies. * @em: Reference on the Energy Model of the device -* @cdev: thermal_cooling_device pointer to keep track of the -* registered cooling device. * @policy: cpufreq policy. * @cooling_ops: cpufreq callbacks to thermal cooling device ops * @idle_time: idle time stats
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 94/231 LoongArch: Fix kernel_page_present() for KPRANGE/XKPRANGE
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
[ Upstream commit 619b52777a4972bdb6ddf86ac54c6f68a47b51c4 ]
Now kernel_page_present() always return true for KPRANGE/XKPRANGE addresses, this isn't correct because hibernation (ACPI S4) use it to distinguish whether a page is saveable. If all KPRANGE/XKPRANGE addresses are considered as saveable, then reserved memory such as EFI_RUNTIME_SERVICES_CODE / EFI_RUNTIME_SERVICES_DATA will also be saved and restored.
Fix this by returning true only if the KPRANGE/XKPRANGE address is in memblock.memory.
--- arch/loongarch/mm/pageattr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/loongarch/mm/pageattr.c +2 -1
@@ -3,6 +3,7 @@* Copyright (C) 2024 Loongson Technology Corporation Limited */ +#include <linux/memblock.h> #include <linux/pagewalk.h> #include <linux/pgtable.h> #include <asm/set_memory.h>
@@ -167,7 +168,7 @@ bool kernel_page_present(struct page *page)unsigned long addr = (unsigned long )page_address (page);if (addr < vm_map_base) -return true; +return memblock_is_memory (__pa (addr)); pgd =pgd_offset_k (addr);if (pgd_none (pgdp_get (pgd)))
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 95/231 LoongArch: KVM: Set host with kernel mode when switch to VM mode
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bibo Mao <[email protected]>
[ Upstream commit 3011b29ec5a33ec16502e687c4264d57416a8b1f ]
PRMD register is only meaningful on the beginning stage of exception entry, and it is overwritten with nested irq or exception.
When CPU runs in VM mode, interrupt need be enabled on host. And the mode for host had better be kernel mode rather than random or user mode.
When VM is running, the running mode with top command comes from CRMD register, and running mode should be kernel mode since kernel function is executing with perf command. It needs be consistent with both top and perf command.
--- arch/loongarch/kvm/switch.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/loongarch/kvm/switch.S +1 -1
@@ -85,7 +85,7 @@ * Guest CRMD comes from separate GCSR_CRMD register */ ori t0, zero, CSR_PRMD_PIE - csrxchg t0, t0, LOONGARCH_CSR_PRMD + csrwr t0, LOONGARCH_CSR_PRMD /* Set PVM bit to setup ertn to guest context */ ori t0, zero, CSR_GSTAT_PVM
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 96/231 arm64: amu: Delay allocating cpumask for AMU FIE support
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Beata Michalska <[email protected]>
[ Upstream commit d923782b041218ef3804b2fed87619b5b1a497f3 ]
For the time being, the amu_fie_cpus cpumask is being exclusively used by the AMU-related internals of FIE support and is guaranteed to be valid on every access currently made. Still the mask is not being invalidated on one of the error handling code paths, which leaves a soft spot with theoretical risk of UAF for CPUMASK_OFFSTACK cases. To make things sound, delay allocating said cpumask
(for CPUMASK_OFFSTACK) avoiding otherwise nasty sanitising case failing to register the cpufreq policy notifications.
--- arch/arm64/kernel/topology.c | 22 ++++++++++------------ 1 file changed, 10 insertions(+), 12 deletions(-)
arch/arm64/kernel/topology.c +10 -12
@@ -194,12 +194,19 @@ static void amu_fie_setup(const struct cpumask *cpus)int cpu;/* We are already set since the last insmod of cpufreq driver */ -if (unlikely (cpumask_subset (cpus, amu_fie_cpus))) +if (cpumask_available (amu_fie_cpus) && +unlikely (cpumask_subset (cpus, amu_fie_cpus)))return ; -for_each_cpu (cpu, cpus) { +for_each_cpu (cpu, cpus)if (!freq_counters_valid (cpu))return ; + +if (!cpumask_available (amu_fie_cpus) && + !zalloc_cpumask_var (&amu_fie_cpus,GFP_KERNEL )) { +WARN_ONCE (1 ,"Failed to allocate FIE cpumask for CPUs[%*pbl]\n" , +cpumask_pr_args (cpus)); +return ; }cpumask_or (amu_fie_cpus, amu_fie_cpus, cpus);
@@ -237,17 +244,8 @@ static struct notifier_block init_amu_fie_notifier = {static int __init init_amu_fie (void ) { -int ret; - -if (!zalloc_cpumask_var (&amu_fie_cpus,GFP_KERNEL )) -return -ENOMEM ; - - ret =cpufreq_register_notifier (&init_amu_fie_notifier, +return cpufreq_register_notifier (&init_amu_fie_notifier,CPUFREQ_POLICY_NOTIFIER ); -if (ret) -free_cpumask_var (amu_fie_cpus); - -return ret; }core_initcall (init_amu_fie);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 97/231 Xen/swiotlb: mark xen_swiotlb_fixup() __init
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Beulich <[email protected]>
[ Upstream commit 75ad02318af2e4ae669e26a79f001bd5e1f97472 ]
It's sole user (pci_xen_swiotlb_init()) is __init, too.
Message-ID: <[email protected]>
--- drivers/xen/swiotlb-xen.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/xen/swiotlb-xen.c +1 -1
@@ -113,7 +113,7 @@ static struct io_tlb_pool *xen_swiotlb_find_pool(struct device *dev, }#ifdef CONFIG_X86 -int xen_swiotlb_fixup (void *buf,unsigned long nslabs) +int __init xen_swiotlb_fixup (void *buf,unsigned long nslabs) {int rc;unsigned int order =get_order (IO_TLB_SEGSIZE <<IO_TLB_SHIFT );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 98/231 Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit b4f82f9ed43aefa79bec2504ae8c29be0c0f5d1d ]
After the hci sync command releases l2cap_conn, the hci receive data work queue references the released l2cap_conn when sending to the upper layer. Add hci dev lock to the hci receive data work queue to synchronize the two.
[1]
BUG: KASAN: slab-use-after-free in l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954 Read of size 8 at addr ffff8880271a4000 by task kworker/u9:2/5837 CPU: 0 UID: 0 PID: 5837 Comm: kworker/u9:2 Not tainted 6.13.0-rc5-syzkaller-00163-gab75170520d4 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: hci1 hci_rx_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 l2cap_build_cmd net/bluetooth/l2cap_core.c:2964 [inline] l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954 l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5502 [inline] l2cap_sig_channel net/bluetooth/l2cap_core.c:5538 [inline] l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6817 hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline] hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Allocated by task 5837: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329 kmalloc_noprof include/linux/slab.h:901 [inline] kzalloc_noprof include/linux/slab.h:1037 [inline] l2cap_conn_add+0xa9/0x8e0 net/bluetooth/l2cap_core.c:6860 l2cap_connect_cfm+0x115/0x1090 net/bluetooth/l2cap_core.c:7239 hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline] hci_remote_features_evt+0x68e/0xac0 net/bluetooth/hci_event.c:3726 hci_event_func net/bluetooth/hci_event.c:7473 [inline] hci_event_packet+0xac2/0x1540 net/bluetooth/hci_event.c:7525 hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4035 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Freed by task 54: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2353 [inline] slab_free mm/slub.c:4613 [inline] kfree+0x196/0x430 mm/slub.c:4761 l2cap_connect_cfm+0xcc/0x1090 net/bluetooth/l2cap_core.c:7235 hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline] hci_conn_failed+0x287/0x400 net/bluetooth/hci_conn.c:1266 hci_abort_conn_sync+0x56c/0x11f0 net/bluetooth/hci_sync.c:5603 hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
--- net/bluetooth/l2cap_core.c | 39 +++++++++++++++++++++++++++++++++----- 1 file changed, 34 insertions(+), 5 deletions(-)
net/bluetooth/l2cap_core.c +34 -5
@@ -949,6 +949,16 @@ static u8 l2cap_get_ident(struct l2cap_conn *conn)return id; } +static void l2cap_send_acl (struct l2cap_conn *conn,struct sk_buff *skb, +u8 flags) +{ +/* Check if the hcon still valid before attempting to send */ +if (hci_conn_valid (conn->hcon->hdev, conn->hcon)) +hci_send_acl (conn->hchan, skb, flags); +else +kfree_skb (skb); +} +static void l2cap_send_cmd (struct l2cap_conn *conn,u8 ident,u8 code,u16 len,void *data) {
@@ -971,7 +981,7 @@ static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,bt_cb (skb)->force_active =BT_POWER_FORCE_ACTIVE_ON ; skb->priority =HCI_PRIO_MAX ; -hci_send_acl (conn->hchan, skb, flags); +l2cap_send_acl (conn, skb, flags); }static void l2cap_do_send (struct l2cap_chan *chan,struct sk_buff *skb)
@@ -1793,13 +1803,10 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)mutex_unlock (&conn->chan_lock); -hci_chan_del (conn->hchan); -if (conn->info_state &L2CAP_INFO_FEAT_MASK_REQ_SENT )cancel_delayed_work_sync (&conn->info_timer); hcon->l2cap_data =NULL ; - conn->hchan =NULL ;l2cap_conn_put (conn); }
@@ -1807,6 +1814,7 @@ static void l2cap_conn_free(struct kref *ref) { struct l2cap_conn *conn = container_of(ref, struct l2cap_conn, ref); +hci_chan_del (conn->hchan);hci_conn_put (conn->hcon);kfree (conn); }
@@ -7472,14 +7480,33 @@ static void l2cap_recv_reset(struct l2cap_conn *conn) conn->rx_len =0 ; } +static struct l2cap_conn *l2cap_conn_hold_unless_zero (struct l2cap_conn *c) +{ +BT_DBG ("conn %p orig refcnt %u" , c,kref_read (&c->ref)); + +if (!kref_get_unless_zero (&c->ref)) +return NULL ; + +return c; +} +void l2cap_recv_acldata (struct hci_conn *hcon,struct sk_buff *skb,u16 flags) { -struct l2cap_conn *conn = hcon->l2cap_data; +struct l2cap_conn *conn;int len; +/* Lock hdev to access l2cap_data to avoid race with l2cap_conn_del */ +hci_dev_lock (hcon->hdev); + + conn = hcon->l2cap_data; +if (!conn) conn =l2cap_conn_add (hcon); + conn =l2cap_conn_hold_unless_zero (conn); + +hci_dev_unlock (hcon->hdev); +if (!conn) goto drop;
@@ -7571,6 +7598,8 @@ void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)break ; } +l2cap_conn_put (conn); + drop:kfree_skb (skb); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 99/231 drm/tests: hdmi: Remove redundant assignments
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxime Ripard <[email protected]>
[ Upstream commit bb4f929a8875b4801db95b8cf3b2c527c1e475e0 ]
Some tests have the drm pointer assigned multiple times to the same value. Drop the redundant assignments.
--- drivers/gpu/drm/tests/drm_hdmi_state_helper_test.c | 4 ---- 1 file changed, 4 deletions(-)
drivers/gpu/drm/tests/drm_hdmi_state_helper_test.c +0 -4
@@ -450,7 +450,6 @@ static void drm_test_check_broadcast_rgb_auto_cea_mode_vic_1(struct kunit *test) mode =drm_kunit_display_mode_from_cea_vic (test, drm,1 );KUNIT_ASSERT_NOT_NULL (test, mode); - drm = &priv->drm; crtc = priv->crtc; ret =light_up_connector (test, drm, crtc, conn, mode, ctx);KUNIT_ASSERT_EQ (test, ret,0 );
@@ -564,7 +563,6 @@ static void drm_test_check_broadcast_rgb_full_cea_mode_vic_1(struct kunit *test) mode =drm_kunit_display_mode_from_cea_vic (test, drm,1 );KUNIT_ASSERT_NOT_NULL (test, mode); - drm = &priv->drm; crtc = priv->crtc; ret =light_up_connector (test, drm, crtc, conn, mode, ctx);KUNIT_ASSERT_EQ (test, ret,0 );
@@ -680,7 +678,6 @@ static void drm_test_check_broadcast_rgb_limited_cea_mode_vic_1(struct kunit *te mode =drm_kunit_display_mode_from_cea_vic (test, drm,1 );KUNIT_ASSERT_NOT_NULL (test, mode); - drm = &priv->drm; crtc = priv->crtc; ret =light_up_connector (test, drm, crtc, conn, mode, ctx);KUNIT_ASSERT_EQ (test, ret,0 );
@@ -1282,7 +1279,6 @@ static void drm_test_check_output_bpc_format_vic_1(struct kunit *test) rate = mode->clock *1500 ;KUNIT_ASSERT_LT (test, rate, info->max_tmds_clock *1000 ); - drm = &priv->drm; crtc = priv->crtc; ret =light_up_connector (test, drm, crtc, conn, mode, ctx);KUNIT_EXPECT_EQ (test, ret,0 );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 100/231 drm/tests: hdmi: Reorder DRM entities variables assignment
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxime Ripard <[email protected]>
[ Upstream commit 6b6bfd63e1626ceedc738b2a06505aa5b46c1481 ]
The tests all deviate slightly in how they assign their local pointers to DRM entities. This makes refactoring pretty difficult, so let's just move the assignment as soon as the entities are allocated.
--- .../drm/tests/drm_hdmi_state_helper_test.c | 81 ++++++++++--------- 1 file changed, 42 insertions(+), 39 deletions(-)
drivers/gpu/drm/tests/drm_hdmi_state_helper_test.c +42 -39
@@ -258,15 +258,16 @@ static void drm_test_check_broadcast_rgb_crtc_mode_changed(struct kunit *test) 8);KUNIT_ASSERT_NOT_NULL (test, priv); + drm = &priv->drm; + crtc = priv->crtc; + conn = &priv->connector; + ctx =drm_kunit_helper_acquire_ctx_alloc (test);KUNIT_ASSERT_NOT_ERR_OR_NULL (test, ctx); - conn = &priv->connector; preferred =find_preferred_mode (conn);KUNIT_ASSERT_NOT_NULL (test, preferred); - drm = &priv->drm; - crtc = priv->crtc; ret =light_up_connector (test, drm, crtc, conn, preferred, ctx);KUNIT_ASSERT_EQ (test, ret,0 );
@@ -321,15 +322,16 @@ static void drm_test_check_broadcast_rgb_crtc_mode_not_changed(struct kunit *tes 8);KUNIT_ASSERT_NOT_NULL (test, priv); + drm = &priv->drm; + crtc = priv->crtc; + conn = &priv->connector; + ctx =drm_kunit_helper_acquire_ctx_alloc (test);KUNIT_ASSERT_NOT_ERR_OR_NULL (test, ctx); - conn = &priv->connector; preferred =find_preferred_mode (conn);KUNIT_ASSERT_NOT_NULL (test, preferred); - drm = &priv->drm; - crtc = priv->crtc; ret =light_up_connector (test, drm, crtc, conn, preferred, ctx);KUNIT_ASSERT_EQ (test, ret,0 );
@@ -384,6 +386,8 @@ static void drm_test_check_broadcast_rgb_auto_cea_mode(struct kunit *test) 8);KUNIT_ASSERT_NOT_NULL (test, priv); + drm = &priv->drm; + crtc = priv->crtc; conn = &priv->connector;KUNIT_ASSERT_TRUE (test, conn->display_info.is_hdmi);
@@ -394,8 +398,6 @@ static void drm_test_check_broadcast_rgb_auto_cea_mode(struct kunit *test)KUNIT_ASSERT_NOT_NULL (test, preferred);KUNIT_ASSERT_NE (test,drm_match_cea_mode (preferred),1 ); - drm = &priv->drm; - crtc = priv->crtc; ret =light_up_connector (test, drm, crtc, conn, preferred, ctx);KUNIT_ASSERT_EQ (test, ret,0 );
@@ -495,6 +497,8 @@ static void drm_test_check_broadcast_rgb_full_cea_mode(struct kunit *test) 8);KUNIT_ASSERT_NOT_NULL (test, priv); + drm = &priv->drm; + crtc = priv->crtc; conn = &priv->connector;KUNIT_ASSERT_TRUE (test, conn->display_info.is_hdmi);
@@ -505,8 +509,6 @@ static void drm_test_check_broadcast_rgb_full_cea_mode(struct kunit *test)KUNIT_ASSERT_NOT_NULL (test, preferred);KUNIT_ASSERT_NE (test,drm_match_cea_mode (preferred),1 ); - drm = &priv->drm; - crtc = priv->crtc; ret =light_up_connector (test, drm, crtc, conn, preferred, ctx);KUNIT_ASSERT_EQ (test, ret,0 );
@@ -610,6 +612,8 @@ static void drm_test_check_broadcast_rgb_limited_cea_mode(struct kunit *test) 8);KUNIT_ASSERT_NOT_NULL (test, priv); + drm = &priv->drm; + crtc = priv->crtc; conn = &priv->connector;KUNIT_ASSERT_TRUE (test, conn->display_info.is_hdmi);
@@ -620,8 +624,6 @@ static void drm_test_check_broadcast_rgb_limited_cea_mode(struct kunit *test)KUNIT_ASSERT_NOT_NULL (test, preferred);KUNIT_ASSERT_NE (test,drm_match_cea_mode (preferred),1 ); - drm = &priv->drm; - crtc = priv->crtc; ret =light_up_connector (test, drm, crtc, conn, preferred, ctx);KUNIT_ASSERT_EQ (test, ret,0 );
@@ -727,6 +729,8 @@ static void drm_test_check_output_bpc_crtc_mode_changed(struct kunit *test) 10);KUNIT_ASSERT_NOT_NULL (test, priv); + drm = &priv->drm; + crtc = priv->crtc; conn = &priv->connector; ret = set_connector_edid(test, conn, test_edid_hdmi_1080p_rgb_yuv_dc_max_200mhz,
@@ -739,8 +743,6 @@ static void drm_test_check_output_bpc_crtc_mode_changed(struct kunit *test) preferred =find_preferred_mode (conn);KUNIT_ASSERT_NOT_NULL (test, preferred); - drm = &priv->drm; - crtc = priv->crtc; ret =light_up_connector (test, drm, crtc, conn, preferred, ctx);KUNIT_ASSERT_EQ (test, ret,0 );
@@ -801,6 +803,8 @@ static void drm_test_check_output_bpc_crtc_mode_not_changed(struct kunit *test) 10);KUNIT_ASSERT_NOT_NULL (test, priv); + drm = &priv->drm; + crtc = priv->crtc; conn = &priv->connector; ret = set_connector_edid(test, conn, test_edid_hdmi_1080p_rgb_yuv_dc_max_200mhz,
@@ -813,8 +817,6 @@ static void drm_test_check_output_bpc_crtc_mode_not_changed(struct kunit *test) preferred =find_preferred_mode (conn);KUNIT_ASSERT_NOT_NULL (test, preferred); - drm = &priv->drm; - crtc = priv->crtc; ret =light_up_connector (test, drm, crtc, conn, preferred, ctx);KUNIT_ASSERT_EQ (test, ret,0 );
@@ -872,6 +874,8 @@ static void drm_test_check_output_bpc_dvi(struct kunit *test) 12);KUNIT_ASSERT_NOT_NULL (test, priv); + drm = &priv->drm; + crtc = priv->crtc; conn = &priv->connector; ret = set_connector_edid(test, conn, test_edid_dvi_1080p,
@@ -887,8 +891,6 @@ static void drm_test_check_output_bpc_dvi(struct kunit *test) preferred =find_preferred_mode (conn);KUNIT_ASSERT_NOT_NULL (test, preferred); - drm = &priv->drm; - crtc = priv->crtc; ret =light_up_connector (test, drm, crtc, conn, preferred, ctx);KUNIT_ASSERT_EQ (test, ret,0 );
@@ -919,6 +921,8 @@ static void drm_test_check_tmds_char_rate_rgb_8bpc(struct kunit *test) 8);KUNIT_ASSERT_NOT_NULL (test, priv); + drm = &priv->drm; + crtc = priv->crtc; conn = &priv->connector; ret = set_connector_edid(test, conn, test_edid_hdmi_1080p_rgb_max_200mhz,
@@ -932,8 +936,6 @@ static void drm_test_check_tmds_char_rate_rgb_8bpc(struct kunit *test)KUNIT_ASSERT_NOT_NULL (test, preferred);KUNIT_ASSERT_FALSE (test, preferred->flags &DRM_MODE_FLAG_DBLCLK ); - drm = &priv->drm; - crtc = priv->crtc; ret =light_up_connector (test, drm, crtc, conn, preferred, ctx);KUNIT_ASSERT_EQ (test, ret,0 );
@@ -966,6 +968,8 @@ static void drm_test_check_tmds_char_rate_rgb_10bpc(struct kunit *test) 10);KUNIT_ASSERT_NOT_NULL (test, priv); + drm = &priv->drm; + crtc = priv->crtc; conn = &priv->connector; ret = set_connector_edid(test, conn, test_edid_hdmi_1080p_rgb_yuv_dc_max_340mhz,
@@ -979,8 +983,6 @@ static void drm_test_check_tmds_char_rate_rgb_10bpc(struct kunit *test)KUNIT_ASSERT_NOT_NULL (test, preferred);KUNIT_ASSERT_FALSE (test, preferred->flags &DRM_MODE_FLAG_DBLCLK ); - drm = &priv->drm; - crtc = priv->crtc; ret =light_up_connector (test, drm, crtc, conn, preferred, ctx);KUNIT_ASSERT_EQ (test, ret,0 );
@@ -1013,6 +1015,8 @@ static void drm_test_check_tmds_char_rate_rgb_12bpc(struct kunit *test) 12);KUNIT_ASSERT_NOT_NULL (test, priv); + drm = &priv->drm; + crtc = priv->crtc; conn = &priv->connector; ret = set_connector_edid(test, conn, test_edid_hdmi_1080p_rgb_yuv_dc_max_340mhz,
@@ -1026,8 +1030,6 @@ static void drm_test_check_tmds_char_rate_rgb_12bpc(struct kunit *test)KUNIT_ASSERT_NOT_NULL (test, preferred);KUNIT_ASSERT_FALSE (test, preferred->flags &DRM_MODE_FLAG_DBLCLK ); - drm = &priv->drm; - crtc = priv->crtc; ret =light_up_connector (test, drm, crtc, conn, preferred, ctx);KUNIT_ASSERT_EQ (test, ret,0 );
@@ -1064,15 +1066,16 @@ static void drm_test_check_hdmi_funcs_reject_rate(struct kunit *test) 8);KUNIT_ASSERT_NOT_NULL (test, priv); + drm = &priv->drm; + crtc = priv->crtc; + conn = &priv->connector; + ctx =drm_kunit_helper_acquire_ctx_alloc (test);KUNIT_ASSERT_NOT_ERR_OR_NULL (test, ctx); - conn = &priv->connector; preferred =find_preferred_mode (conn);KUNIT_ASSERT_NOT_NULL (test, preferred); - drm = &priv->drm; - crtc = priv->crtc; ret =light_up_connector (test, drm, crtc, conn, preferred, ctx);KUNIT_ASSERT_EQ (test, ret,0 );
@@ -1120,6 +1123,8 @@ static void drm_test_check_max_tmds_rate_bpc_fallback(struct kunit *test) 12);KUNIT_ASSERT_NOT_NULL (test, priv); + drm = &priv->drm; + crtc = priv->crtc; conn = &priv->connector; ret = set_connector_edid(test, conn, test_edid_hdmi_1080p_rgb_yuv_dc_max_200mhz,
@@ -1143,8 +1148,6 @@ static void drm_test_check_max_tmds_rate_bpc_fallback(struct kunit *test) rate =drm_hdmi_compute_mode_clock (preferred,10 ,HDMI_COLORSPACE_RGB );KUNIT_ASSERT_LT (test, rate, info->max_tmds_clock *1000 ); - drm = &priv->drm; - crtc = priv->crtc; ret =light_up_connector (test, drm, crtc, conn, preferred, ctx);KUNIT_EXPECT_EQ (test, ret,0 );
@@ -1189,6 +1192,8 @@ static void drm_test_check_max_tmds_rate_format_fallback(struct kunit *test) 12);KUNIT_ASSERT_NOT_NULL (test, priv); + drm = &priv->drm; + crtc = priv->crtc; conn = &priv->connector; ret = set_connector_edid(test, conn, test_edid_hdmi_1080p_rgb_yuv_dc_max_200mhz,
@@ -1215,8 +1220,6 @@ static void drm_test_check_max_tmds_rate_format_fallback(struct kunit *test) rate =drm_hdmi_compute_mode_clock (preferred,12 ,HDMI_COLORSPACE_YUV422 );KUNIT_ASSERT_LT (test, rate, info->max_tmds_clock *1000 ); - drm = &priv->drm; - crtc = priv->crtc; ret =light_up_connector (test, drm, crtc, conn, preferred, ctx);KUNIT_EXPECT_EQ (test, ret,0 );
@@ -1312,6 +1315,8 @@ static void drm_test_check_output_bpc_format_driver_rgb_only(struct kunit *test) 12);KUNIT_ASSERT_NOT_NULL (test, priv); + drm = &priv->drm; + crtc = priv->crtc; conn = &priv->connector; ret = set_connector_edid(test, conn, test_edid_hdmi_1080p_rgb_yuv_dc_max_200mhz,
@@ -1343,8 +1348,6 @@ static void drm_test_check_output_bpc_format_driver_rgb_only(struct kunit *test) rate =drm_hdmi_compute_mode_clock (preferred,12 ,HDMI_COLORSPACE_YUV422 );KUNIT_ASSERT_LT (test, rate, info->max_tmds_clock *1000 ); - drm = &priv->drm; - crtc = priv->crtc; ret =light_up_connector (test, drm, crtc, conn, preferred, ctx);KUNIT_EXPECT_EQ (test, ret,0 );
@@ -1379,6 +1382,8 @@ static void drm_test_check_output_bpc_format_display_rgb_only(struct kunit *test 12);KUNIT_ASSERT_NOT_NULL (test, priv); + drm = &priv->drm; + crtc = priv->crtc; conn = &priv->connector; ret = set_connector_edid(test, conn, test_edid_hdmi_1080p_rgb_max_200mhz,
@@ -1410,8 +1415,6 @@ static void drm_test_check_output_bpc_format_display_rgb_only(struct kunit *test rate =drm_hdmi_compute_mode_clock (preferred,12 ,HDMI_COLORSPACE_YUV422 );KUNIT_ASSERT_LT (test, rate, info->max_tmds_clock *1000 ); - drm = &priv->drm; - crtc = priv->crtc; ret =light_up_connector (test, drm, crtc, conn, preferred, ctx);KUNIT_EXPECT_EQ (test, ret,0 );
@@ -1445,6 +1448,8 @@ static void drm_test_check_output_bpc_format_driver_8bpc_only(struct kunit *test 8);KUNIT_ASSERT_NOT_NULL (test, priv); + drm = &priv->drm; + crtc = priv->crtc; conn = &priv->connector; ret = set_connector_edid(test, conn, test_edid_hdmi_1080p_rgb_yuv_dc_max_340mhz,
@@ -1468,8 +1473,6 @@ static void drm_test_check_output_bpc_format_driver_8bpc_only(struct kunit *test rate =drm_hdmi_compute_mode_clock (preferred,12 ,HDMI_COLORSPACE_RGB );KUNIT_ASSERT_LT (test, rate, info->max_tmds_clock *1000 ); - drm = &priv->drm; - crtc = priv->crtc; ret =light_up_connector (test, drm, crtc, conn, preferred, ctx);KUNIT_EXPECT_EQ (test, ret,0 );
@@ -1505,6 +1508,8 @@ static void drm_test_check_output_bpc_format_display_8bpc_only(struct kunit *tes 12);KUNIT_ASSERT_NOT_NULL (test, priv); + drm = &priv->drm; + crtc = priv->crtc; conn = &priv->connector; ret = set_connector_edid(test, conn, test_edid_hdmi_1080p_rgb_max_340mhz,
@@ -1528,8 +1533,6 @@ static void drm_test_check_output_bpc_format_display_8bpc_only(struct kunit *tes rate =drm_hdmi_compute_mode_clock (preferred,12 ,HDMI_COLORSPACE_RGB );KUNIT_ASSERT_LT (test, rate, info->max_tmds_clock *1000 ); - drm = &priv->drm; - crtc = priv->crtc; ret =light_up_connector (test, drm, crtc, conn, preferred, ctx);KUNIT_EXPECT_EQ (test, ret,0 );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 101/231 drm/tests: hdmi: Fix recursive locking
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxime Ripard <[email protected]>
[ Upstream commit 5d14c08a47460e8eedf0185a28b116420ea7f29d ]
The find_preferred_mode() functions takes the mode_config mutex, but due to the order most tests have, is called with the crtc_ww_class_mutex taken. This raises a warning for a circular dependency when running the tests with lockdep.
Reorder the tests to call find_preferred_mode before the acquire context has been created to avoid the issue.
--- .../drm/tests/drm_hdmi_state_helper_test.c | 114 +++++++++--------- 1 file changed, 57 insertions(+), 57 deletions(-)
drivers/gpu/drm/tests/drm_hdmi_state_helper_test.c +57 -57
@@ -262,12 +262,12 @@ static void drm_test_check_broadcast_rgb_crtc_mode_changed(struct kunit *test) crtc = priv->crtc; conn = &priv->connector; - ctx =drm_kunit_helper_acquire_ctx_alloc (test); -KUNIT_ASSERT_NOT_ERR_OR_NULL (test, ctx); - preferred =find_preferred_mode (conn);KUNIT_ASSERT_NOT_NULL (test, preferred); + ctx =drm_kunit_helper_acquire_ctx_alloc (test); +KUNIT_ASSERT_NOT_ERR_OR_NULL (test, ctx); + ret =light_up_connector (test, drm, crtc, conn, preferred, ctx);KUNIT_ASSERT_EQ (test, ret,0 );
@@ -326,12 +326,12 @@ static void drm_test_check_broadcast_rgb_crtc_mode_not_changed(struct kunit *tes crtc = priv->crtc; conn = &priv->connector; - ctx =drm_kunit_helper_acquire_ctx_alloc (test); -KUNIT_ASSERT_NOT_ERR_OR_NULL (test, ctx); - preferred =find_preferred_mode (conn);KUNIT_ASSERT_NOT_NULL (test, preferred); + ctx =drm_kunit_helper_acquire_ctx_alloc (test); +KUNIT_ASSERT_NOT_ERR_OR_NULL (test, ctx); + ret =light_up_connector (test, drm, crtc, conn, preferred, ctx);KUNIT_ASSERT_EQ (test, ret,0 );
@@ -391,13 +391,13 @@ static void drm_test_check_broadcast_rgb_auto_cea_mode(struct kunit *test) conn = &priv->connector;KUNIT_ASSERT_TRUE (test, conn->display_info.is_hdmi); - ctx =drm_kunit_helper_acquire_ctx_alloc (test); -KUNIT_ASSERT_NOT_ERR_OR_NULL (test, ctx); - preferred =find_preferred_mode (conn);KUNIT_ASSERT_NOT_NULL (test, preferred);KUNIT_ASSERT_NE (test,drm_match_cea_mode (preferred),1 ); + ctx =drm_kunit_helper_acquire_ctx_alloc (test); +KUNIT_ASSERT_NOT_ERR_OR_NULL (test, ctx); + ret =light_up_connector (test, drm, crtc, conn, preferred, ctx);KUNIT_ASSERT_EQ (test, ret,0 );
@@ -502,13 +502,13 @@ static void drm_test_check_broadcast_rgb_full_cea_mode(struct kunit *test) conn = &priv->connector;KUNIT_ASSERT_TRUE (test, conn->display_info.is_hdmi); - ctx =drm_kunit_helper_acquire_ctx_alloc (test); -KUNIT_ASSERT_NOT_ERR_OR_NULL (test, ctx); - preferred =find_preferred_mode (conn);KUNIT_ASSERT_NOT_NULL (test, preferred);KUNIT_ASSERT_NE (test,drm_match_cea_mode (preferred),1 ); + ctx =drm_kunit_helper_acquire_ctx_alloc (test); +KUNIT_ASSERT_NOT_ERR_OR_NULL (test, ctx); + ret =light_up_connector (test, drm, crtc, conn, preferred, ctx);KUNIT_ASSERT_EQ (test, ret,0 );
@@ -617,13 +617,13 @@ static void drm_test_check_broadcast_rgb_limited_cea_mode(struct kunit *test) conn = &priv->connector;KUNIT_ASSERT_TRUE (test, conn->display_info.is_hdmi); - ctx =drm_kunit_helper_acquire_ctx_alloc (test); -KUNIT_ASSERT_NOT_ERR_OR_NULL (test, ctx); - preferred =find_preferred_mode (conn);KUNIT_ASSERT_NOT_NULL (test, preferred);KUNIT_ASSERT_NE (test,drm_match_cea_mode (preferred),1 ); + ctx =drm_kunit_helper_acquire_ctx_alloc (test); +KUNIT_ASSERT_NOT_ERR_OR_NULL (test, ctx); + ret =light_up_connector (test, drm, crtc, conn, preferred, ctx);KUNIT_ASSERT_EQ (test, ret,0 );
@@ -737,12 +737,12 @@ static void drm_test_check_output_bpc_crtc_mode_changed(struct kunit *test) ARRAY_SIZE(test_edid_hdmi_1080p_rgb_yuv_dc_max_200mhz));KUNIT_ASSERT_GT (test, ret,0 ); - ctx =drm_kunit_helper_acquire_ctx_alloc (test); -KUNIT_ASSERT_NOT_ERR_OR_NULL (test, ctx); - preferred =find_preferred_mode (conn);KUNIT_ASSERT_NOT_NULL (test, preferred); + ctx =drm_kunit_helper_acquire_ctx_alloc (test); +KUNIT_ASSERT_NOT_ERR_OR_NULL (test, ctx); + ret =light_up_connector (test, drm, crtc, conn, preferred, ctx);KUNIT_ASSERT_EQ (test, ret,0 );
@@ -811,12 +811,12 @@ static void drm_test_check_output_bpc_crtc_mode_not_changed(struct kunit *test) ARRAY_SIZE(test_edid_hdmi_1080p_rgb_yuv_dc_max_200mhz));KUNIT_ASSERT_GT (test, ret,0 ); - ctx =drm_kunit_helper_acquire_ctx_alloc (test); -KUNIT_ASSERT_NOT_ERR_OR_NULL (test, ctx); - preferred =find_preferred_mode (conn);KUNIT_ASSERT_NOT_NULL (test, preferred); + ctx =drm_kunit_helper_acquire_ctx_alloc (test); +KUNIT_ASSERT_NOT_ERR_OR_NULL (test, ctx); + ret =light_up_connector (test, drm, crtc, conn, preferred, ctx);KUNIT_ASSERT_EQ (test, ret,0 );
@@ -885,12 +885,12 @@ static void drm_test_check_output_bpc_dvi(struct kunit *test) info = &conn->display_info;KUNIT_ASSERT_FALSE (test, info->is_hdmi); - ctx =drm_kunit_helper_acquire_ctx_alloc (test); -KUNIT_ASSERT_NOT_ERR_OR_NULL (test, ctx); - preferred =find_preferred_mode (conn);KUNIT_ASSERT_NOT_NULL (test, preferred); + ctx =drm_kunit_helper_acquire_ctx_alloc (test); +KUNIT_ASSERT_NOT_ERR_OR_NULL (test, ctx); + ret =light_up_connector (test, drm, crtc, conn, preferred, ctx);KUNIT_ASSERT_EQ (test, ret,0 );
@@ -929,13 +929,13 @@ static void drm_test_check_tmds_char_rate_rgb_8bpc(struct kunit *test) ARRAY_SIZE(test_edid_hdmi_1080p_rgb_max_200mhz));KUNIT_ASSERT_GT (test, ret,0 ); - ctx =drm_kunit_helper_acquire_ctx_alloc (test); -KUNIT_ASSERT_NOT_ERR_OR_NULL (test, ctx); - preferred =find_preferred_mode (conn);KUNIT_ASSERT_NOT_NULL (test, preferred);KUNIT_ASSERT_FALSE (test, preferred->flags &DRM_MODE_FLAG_DBLCLK ); + ctx =drm_kunit_helper_acquire_ctx_alloc (test); +KUNIT_ASSERT_NOT_ERR_OR_NULL (test, ctx); + ret =light_up_connector (test, drm, crtc, conn, preferred, ctx);KUNIT_ASSERT_EQ (test, ret,0 );
@@ -976,13 +976,13 @@ static void drm_test_check_tmds_char_rate_rgb_10bpc(struct kunit *test) ARRAY_SIZE(test_edid_hdmi_1080p_rgb_yuv_dc_max_340mhz));KUNIT_ASSERT_GT (test, ret,0 ); - ctx =drm_kunit_helper_acquire_ctx_alloc (test); -KUNIT_ASSERT_NOT_ERR_OR_NULL (test, ctx); - preferred =find_preferred_mode (conn);KUNIT_ASSERT_NOT_NULL (test, preferred);KUNIT_ASSERT_FALSE (test, preferred->flags &DRM_MODE_FLAG_DBLCLK ); + ctx =drm_kunit_helper_acquire_ctx_alloc (test); +KUNIT_ASSERT_NOT_ERR_OR_NULL (test, ctx); + ret =light_up_connector (test, drm, crtc, conn, preferred, ctx);KUNIT_ASSERT_EQ (test, ret,0 );
@@ -1023,13 +1023,13 @@ static void drm_test_check_tmds_char_rate_rgb_12bpc(struct kunit *test) ARRAY_SIZE(test_edid_hdmi_1080p_rgb_yuv_dc_max_340mhz));KUNIT_ASSERT_GT (test, ret,0 ); - ctx =drm_kunit_helper_acquire_ctx_alloc (test); -KUNIT_ASSERT_NOT_ERR_OR_NULL (test, ctx); - preferred =find_preferred_mode (conn);KUNIT_ASSERT_NOT_NULL (test, preferred);KUNIT_ASSERT_FALSE (test, preferred->flags &DRM_MODE_FLAG_DBLCLK ); + ctx =drm_kunit_helper_acquire_ctx_alloc (test); +KUNIT_ASSERT_NOT_ERR_OR_NULL (test, ctx); + ret =light_up_connector (test, drm, crtc, conn, preferred, ctx);KUNIT_ASSERT_EQ (test, ret,0 );
@@ -1070,12 +1070,12 @@ static void drm_test_check_hdmi_funcs_reject_rate(struct kunit *test) crtc = priv->crtc; conn = &priv->connector; - ctx =drm_kunit_helper_acquire_ctx_alloc (test); -KUNIT_ASSERT_NOT_ERR_OR_NULL (test, ctx); - preferred =find_preferred_mode (conn);KUNIT_ASSERT_NOT_NULL (test, preferred); + ctx =drm_kunit_helper_acquire_ctx_alloc (test); +KUNIT_ASSERT_NOT_ERR_OR_NULL (test, ctx); + ret =light_up_connector (test, drm, crtc, conn, preferred, ctx);KUNIT_ASSERT_EQ (test, ret,0 );
@@ -1135,9 +1135,6 @@ static void drm_test_check_max_tmds_rate_bpc_fallback(struct kunit *test)KUNIT_ASSERT_TRUE (test, info->is_hdmi);KUNIT_ASSERT_GT (test, info->max_tmds_clock,0 ); - ctx =drm_kunit_helper_acquire_ctx_alloc (test); -KUNIT_ASSERT_NOT_ERR_OR_NULL (test, ctx); - preferred =find_preferred_mode (conn);KUNIT_ASSERT_NOT_NULL (test, preferred);KUNIT_ASSERT_FALSE (test, preferred->flags &DRM_MODE_FLAG_DBLCLK );
@@ -1148,6 +1145,9 @@ static void drm_test_check_max_tmds_rate_bpc_fallback(struct kunit *test) rate =drm_hdmi_compute_mode_clock (preferred,10 ,HDMI_COLORSPACE_RGB );KUNIT_ASSERT_LT (test, rate, info->max_tmds_clock *1000 ); + ctx =drm_kunit_helper_acquire_ctx_alloc (test); +KUNIT_ASSERT_NOT_ERR_OR_NULL (test, ctx); + ret =light_up_connector (test, drm, crtc, conn, preferred, ctx);KUNIT_EXPECT_EQ (test, ret,0 );
@@ -1204,9 +1204,6 @@ static void drm_test_check_max_tmds_rate_format_fallback(struct kunit *test)KUNIT_ASSERT_TRUE (test, info->is_hdmi);KUNIT_ASSERT_GT (test, info->max_tmds_clock,0 ); - ctx =drm_kunit_helper_acquire_ctx_alloc (test); -KUNIT_ASSERT_NOT_ERR_OR_NULL (test, ctx); - preferred =find_preferred_mode (conn);KUNIT_ASSERT_NOT_NULL (test, preferred);KUNIT_ASSERT_FALSE (test, preferred->flags &DRM_MODE_FLAG_DBLCLK );
@@ -1220,6 +1217,9 @@ static void drm_test_check_max_tmds_rate_format_fallback(struct kunit *test) rate =drm_hdmi_compute_mode_clock (preferred,12 ,HDMI_COLORSPACE_YUV422 );KUNIT_ASSERT_LT (test, rate, info->max_tmds_clock *1000 ); + ctx =drm_kunit_helper_acquire_ctx_alloc (test); +KUNIT_ASSERT_NOT_ERR_OR_NULL (test, ctx); + ret =light_up_connector (test, drm, crtc, conn, preferred, ctx);KUNIT_EXPECT_EQ (test, ret,0 );
@@ -1266,9 +1266,6 @@ static void drm_test_check_output_bpc_format_vic_1(struct kunit *test)KUNIT_ASSERT_TRUE (test, info->is_hdmi);KUNIT_ASSERT_GT (test, info->max_tmds_clock,0 ); - ctx =drm_kunit_helper_acquire_ctx_alloc (test); -KUNIT_ASSERT_NOT_ERR_OR_NULL (test, ctx); - mode =drm_kunit_display_mode_from_cea_vic (test, drm,1 );KUNIT_ASSERT_NOT_NULL (test, mode);
@@ -1282,6 +1279,9 @@ static void drm_test_check_output_bpc_format_vic_1(struct kunit *test) rate = mode->clock *1500 ;KUNIT_ASSERT_LT (test, rate, info->max_tmds_clock *1000 ); + ctx =drm_kunit_helper_acquire_ctx_alloc (test); +KUNIT_ASSERT_NOT_ERR_OR_NULL (test, ctx); + crtc = priv->crtc; ret =light_up_connector (test, drm, crtc, conn, mode, ctx);KUNIT_EXPECT_EQ (test, ret,0 );
@@ -1327,9 +1327,6 @@ static void drm_test_check_output_bpc_format_driver_rgb_only(struct kunit *test)KUNIT_ASSERT_TRUE (test, info->is_hdmi);KUNIT_ASSERT_GT (test, info->max_tmds_clock,0 ); - ctx =drm_kunit_helper_acquire_ctx_alloc (test); -KUNIT_ASSERT_NOT_ERR_OR_NULL (test, ctx); - preferred =find_preferred_mode (conn);KUNIT_ASSERT_NOT_NULL (test, preferred);
@@ -1348,6 +1345,9 @@ static void drm_test_check_output_bpc_format_driver_rgb_only(struct kunit *test) rate =drm_hdmi_compute_mode_clock (preferred,12 ,HDMI_COLORSPACE_YUV422 );KUNIT_ASSERT_LT (test, rate, info->max_tmds_clock *1000 ); + ctx =drm_kunit_helper_acquire_ctx_alloc (test); +KUNIT_ASSERT_NOT_ERR_OR_NULL (test, ctx); + ret =light_up_connector (test, drm, crtc, conn, preferred, ctx);KUNIT_EXPECT_EQ (test, ret,0 );
@@ -1394,9 +1394,6 @@ static void drm_test_check_output_bpc_format_display_rgb_only(struct kunit *testKUNIT_ASSERT_TRUE (test, info->is_hdmi);KUNIT_ASSERT_GT (test, info->max_tmds_clock,0 ); - ctx =drm_kunit_helper_acquire_ctx_alloc (test); -KUNIT_ASSERT_NOT_ERR_OR_NULL (test, ctx); - preferred =find_preferred_mode (conn);KUNIT_ASSERT_NOT_NULL (test, preferred);
@@ -1415,6 +1412,9 @@ static void drm_test_check_output_bpc_format_display_rgb_only(struct kunit *test rate =drm_hdmi_compute_mode_clock (preferred,12 ,HDMI_COLORSPACE_YUV422 );KUNIT_ASSERT_LT (test, rate, info->max_tmds_clock *1000 ); + ctx =drm_kunit_helper_acquire_ctx_alloc (test); +KUNIT_ASSERT_NOT_ERR_OR_NULL (test, ctx); + ret =light_up_connector (test, drm, crtc, conn, preferred, ctx);KUNIT_EXPECT_EQ (test, ret,0 );
@@ -1460,9 +1460,6 @@ static void drm_test_check_output_bpc_format_driver_8bpc_only(struct kunit *testKUNIT_ASSERT_TRUE (test, info->is_hdmi);KUNIT_ASSERT_GT (test, info->max_tmds_clock,0 ); - ctx =drm_kunit_helper_acquire_ctx_alloc (test); -KUNIT_ASSERT_NOT_ERR_OR_NULL (test, ctx); - preferred =find_preferred_mode (conn);KUNIT_ASSERT_NOT_NULL (test, preferred);
@@ -1473,6 +1470,9 @@ static void drm_test_check_output_bpc_format_driver_8bpc_only(struct kunit *test rate =drm_hdmi_compute_mode_clock (preferred,12 ,HDMI_COLORSPACE_RGB );KUNIT_ASSERT_LT (test, rate, info->max_tmds_clock *1000 ); + ctx =drm_kunit_helper_acquire_ctx_alloc (test); +KUNIT_ASSERT_NOT_ERR_OR_NULL (test, ctx); + ret =light_up_connector (test, drm, crtc, conn, preferred, ctx);KUNIT_EXPECT_EQ (test, ret,0 );
@@ -1520,9 +1520,6 @@ static void drm_test_check_output_bpc_format_display_8bpc_only(struct kunit *tesKUNIT_ASSERT_TRUE (test, info->is_hdmi);KUNIT_ASSERT_GT (test, info->max_tmds_clock,0 ); - ctx =drm_kunit_helper_acquire_ctx_alloc (test); -KUNIT_ASSERT_NOT_ERR_OR_NULL (test, ctx); - preferred =find_preferred_mode (conn);KUNIT_ASSERT_NOT_NULL (test, preferred);
@@ -1533,6 +1530,9 @@ static void drm_test_check_output_bpc_format_display_8bpc_only(struct kunit *tes rate =drm_hdmi_compute_mode_clock (preferred,12 ,HDMI_COLORSPACE_RGB );KUNIT_ASSERT_LT (test, rate, info->max_tmds_clock *1000 ); + ctx =drm_kunit_helper_acquire_ctx_alloc (test); +KUNIT_ASSERT_NOT_ERR_OR_NULL (test, ctx); + ret =light_up_connector (test, drm, crtc, conn, preferred, ctx);KUNIT_EXPECT_EQ (test, ret,0 );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 102/231 selftests/bpf: Fix invalid flag of recv()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <[email protected]>
[ Upstream commit a0c11149509aa905aeec10cf9998091443472b0b ]
SOCK_NONBLOCK flag is only effective during socket creation, not during recv. Use MSG_DONTWAIT instead.
--- tools/testing/selftests/bpf/prog_tests/sockmap_basic.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
tools/testing/selftests/bpf/prog_tests/sockmap_basic.c +3 -3
@@ -492,8 +492,8 @@ static void test_sockmap_skb_verdict_shutdown(void)if (!ASSERT_EQ (err,1 ,"epoll_wait(fd)" )) goto out_close; - n =recv (c1, &b,1 ,SOCK_NONBLOCK ); -ASSERT_EQ (n,0 ,"recv_timeout(fin)" ); + n =recv (c1, &b,1 ,MSG_DONTWAIT ); +ASSERT_EQ (n,0 ,"recv(fin)" ); out_close:close (c1);close (p1);
@@ -546,7 +546,7 @@ static void test_sockmap_skb_verdict_fionread(bool pass_prog)ASSERT_EQ (avail, expected,"ioctl(FIONREAD)" );/* On DROP test there will be no data to read */ if (pass_prog) { - recvd =recv_timeout (c1, &buf,sizeof (buf),SOCK_NONBLOCK ,IO_TIMEOUT_SEC ); + recvd =recv_timeout (c1, &buf,sizeof (buf),MSG_DONTWAIT ,IO_TIMEOUT_SEC );ASSERT_EQ (recvd,sizeof (buf),"recv_timeout(c0)" ); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 103/231 ASoC: Intel: sof_sdw: Add lookup of quirk using PCI subsystem ID
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Fitzgerald <[email protected]>
[ Upstream commit fc016ef7da64fd473d73ee6c261ba1b0b47afe2b ]
Add lookup of PCI subsystem vendor:device ID to find a quirk.
The subsystem ID (SSID) is part of the PCI specification to uniquely identify a particular system-specific implementation of a hardware device.
Unlike DMI information, it identifies the sound hardware itself, rather than a specific model of PC. SSID can be more reliable and stable than DMI strings, and is preferred by some vendors as the way to identify the actual sound hardware.
--- sound/soc/intel/boards/sof_sdw.c | 30 ++++++++++++++++++++++++------ 1 file changed, 24 insertions(+), 6 deletions(-)
sound/soc/intel/boards/sof_sdw.c +24 -6
@@ -13,6 +13,7 @@#include <linux/soundwire/sdw.h> #include <linux/soundwire/sdw_type.h> #include <linux/soundwire/sdw_intel.h> +#include <sound/core.h> #include <sound/soc-acpi.h> #include "sof_sdw_common.h" #include "../../codecs/rt711.h"
@@ -685,6 +686,22 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = { {} }; +static const struct snd_pci_quirk sof_sdw_ssid_quirk_table[] = { + {} +}; + +static void sof_sdw_check_ssid_quirk (const struct snd_soc_acpi_mach *mach) +{ +const struct snd_pci_quirk *quirk_entry; + + quirk_entry =snd_pci_quirk_lookup_id (mach->mach_params.subsystem_vendor, + mach->mach_params.subsystem_device, + sof_sdw_ssid_quirk_table); + +if (quirk_entry) + sof_sdw_quirk = quirk_entry->value; +} +static struct snd_soc_dai_link_component platform_component[] = { {/* name might be overridden during probe */
@@ -1212,6 +1229,13 @@ static int mc_probe(struct platform_device *pdev)snd_soc_card_set_drvdata (card, ctx); +if (mach->mach_params.subsystem_id_set) { +snd_soc_card_set_pci_ssid (card, + mach->mach_params.subsystem_vendor, + mach->mach_params.subsystem_device); +sof_sdw_check_ssid_quirk (mach); + } +dmi_check_system (sof_sdw_quirk_table);if (quirk_override !=-1 ) {
@@ -1227,12 +1251,6 @@ static int mc_probe(struct platform_device *pdev)for (i =0 ; i < ctx->codec_info_list_count; i++) codec_info_list[i].amp_num =0 ; -if (mach->mach_params.subsystem_id_set) { -snd_soc_card_set_pci_ssid (card, - mach->mach_params.subsystem_vendor, - mach->mach_params.subsystem_device); - } - ret =sof_card_dai_links_create (card);if (ret <0 )return ret;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 104/231 ASoC: Intel: sof_sdw: Add quirk for Asus Zenbook S14
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Fitzgerald <[email protected]>
[ Upstream commit 0843449708085c4fb45a3c325c2fbced556f6abf ]
Asus laptops with sound PCI subsystem ID 1043:1e13 have the DMICs connected to the host instead of the CS42L43 so need the SOC_SDW_CODEC_MIC quirk.
--- sound/soc/intel/boards/sof_sdw.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/intel/boards/sof_sdw.c +1 -0
@@ -687,6 +687,7 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = { };static const struct snd_pci_quirk sof_sdw_ssid_quirk_table[] = { +SND_PCI_QUIRK (0x1043 ,0x1e13 ,"ASUS Zenbook S14" ,SOC_SDW_CODEC_MIC ), {} };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 105/231 ASoC: Intel: soc-acpi-intel-mtl-match: declare adr as ull
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bard Liao <[email protected]>
[ Upstream commit 20efccc53abf99fa52ea30a43dec758f6b6b9940 ]
The adr is u64.
--- sound/soc/intel/common/soc-acpi-intel-mtl-match.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/intel/common/soc-acpi-intel-mtl-match.c +1 -1
@@ -297,7 +297,7 @@ static const struct snd_soc_acpi_adr_device rt1316_3_single_adr[] = {static const struct snd_soc_acpi_adr_device rt1318_1_single_adr[] = { { - .adr =0x000130025D131801 , + .adr =0x000130025D131801ull , .num_endpoints =1 , .endpoints = &single_endpoint, .name_prefix ="rt1318-1"
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 106/231 ASoC: simple-card-utils.c: add missing dlc->of_node
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuninori Morimoto <[email protected]>
[ Upstream commit dabbd325b25edb5cdd99c94391817202dd54b651 ]
commit 90de551c1bf ("ASoC: simple-card-utils.c: enable multi Component support") added muiti Component support, but was missing to add dlc->of_node. Because of it, Sound device list will indicates strange name if it was DPCM connection and driver supports dai->driver->dai_args, like below
> aplay -l card X: sndulcbmix [xxxx], device 0: fe.(null).rsnd-dai.0 (*) [] ... ^^^^^^
It will be fixed by this patch
> aplay -l card X: sndulcbmix [xxxx], device 0: [email protected] (*) [] ... ^^^^^^^^^^^^^^
--- sound/soc/generic/simple-card-utils.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/generic/simple-card-utils.c +1 -0
@@ -1097,6 +1097,7 @@ int graph_util_parse_dai(struct device *dev, struct device_node *ep, args.np = ep; dai =snd_soc_get_dai_via_args (&args);if (dai) { + dlc->of_node = node; dlc->dai_name =snd_soc_dai_name_get (dai); dlc->dai_args =snd_soc_copy_dai_args (dev, &args);if (!dlc->dai_args)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 107/231 ALSA: hda/realtek: Limit mic boost on Positivo ARN50
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edson Juliano Drosdeck <[email protected]>
[ Upstream commit 76b0a22d4cf7dc9091129560fdc04e73eb9db4cb ]
The internal mic boost on the Positivo ARN50 is too high.
Fix this by applying the ALC269_FIXUP_LIMIT_INT_MIC_BOOST fixup to the machine to limit the gain.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -11064,6 +11064,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x1d72 ,0x1945 ,"Redmi G" ,ALC256_FIXUP_ASUS_HEADSET_MIC ),SND_PCI_QUIRK (0x1d72 ,0x1947 ,"RedmiBook Air" ,ALC255_FIXUP_XIAOMI_HEADSET_MIC ),SND_PCI_QUIRK (0x1f66 ,0x0105 ,"Ayaneo Portable Game Player" ,ALC287_FIXUP_CS35L41_I2C_2 ), +SND_PCI_QUIRK (0x2014 ,0x800a ,"Positivo ARN50" ,ALC269_FIXUP_LIMIT_INT_MIC_BOOST ),SND_PCI_QUIRK (0x2782 ,0x0214 ,"VAIO VJFE-CL" ,ALC269_FIXUP_LIMIT_INT_MIC_BOOST ),SND_PCI_QUIRK (0x2782 ,0x0228 ,"Infinix ZERO BOOK 13" ,ALC269VB_FIXUP_INFINIX_ZERO_BOOK_13 ), SND_PCI_QUIRK(0x2782, 0x0232, "CHUWI CoreBook XPro", ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO),
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 108/231 ASoC: rsnd: indicate unsupported clock rate
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuninori Morimoto <[email protected]>
[ Upstream commit 796106e29e5df6cd4b4e2b51262a8a19e9fa0625 ]
It will indicate "unsupported clock rate" when setup clock failed. But it is unclear what kind of rate was failed. Indicate it.
--- sound/soc/sh/rcar/ssi.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/soc/sh/rcar/ssi.c +2 -1
@@ -336,7 +336,8 @@ static int rsnd_ssi_master_clk_start(struct rsnd_mod *mod,return 0 ; rate_err: -dev_err (dev,"unsupported clock rate\n" ); +dev_err (dev,"unsupported clock rate (%d)\n" , rate); +return ret; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 109/231 ASoC: rsnd: dont indicate warning on rsnd_kctrl_accept_runtime()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuninori Morimoto <[email protected]>
[ Upstream commit c3fc002b206c6c83d1e3702b979733002ba6fb2c ]
rsnd_kctrl_accept_runtime() (1) is used for runtime convert rate (= Synchronous SRC Mode). Now, rsnd driver has 2 kctrls for it
(A): "SRC Out Rate Switch"
(B): "SRC Out Rate" // it calls (1)
(A): can be called anytime
(B): can be called only runtime, and will indicate warning if it was used
at non-runtime.
To use runtime convert rate (= Synchronous SRC Mode), user might uses command in below order.
(X): > amixer set "SRC Out Rate" on
> aplay xxx.wav &
(Y): > amixer set "SRC Out Rate" 48010 // convert rate to 48010Hz
(Y): calls B
(X): calls both A and B.
In this case, when user calls (X), it calls both (A) and (B), but it is not yet start running. So, (B) will indicate warning.
This warning was added by commit b5c088689847 ("ASoC: rsnd: add warning message to rsnd_kctrl_accept_runtime()"), but the message sounds like the operation was not correct. Let's update warning message.
The message is very SRC specific, implement it in src.c
--- sound/soc/sh/rcar/core.c | 14 -------------- sound/soc/sh/rcar/rsnd.h | 1 - sound/soc/sh/rcar/src.c | 18 +++++++++++++++++- 3 files changed, 17 insertions(+), 16 deletions(-)
sound/soc/sh/rcar/core.c +0 -14
@@ -1758,20 +1758,6 @@ int rsnd_kctrl_accept_anytime(struct rsnd_dai_stream *io)return 1 ; } -int rsnd_kctrl_accept_runtime (struct rsnd_dai_stream *io) -{ -struct snd_pcm_runtime *runtime =rsnd_io_to_runtime (io); -struct rsnd_priv *priv =rsnd_io_to_priv (io); -struct device *dev =rsnd_priv_to_dev (priv); - -if (!runtime) { -dev_warn (dev,"Can't update kctrl when idle\n" ); -return 0 ; - } - -return 1 ; -} -struct rsnd_kctrl_cfg *rsnd_kctrl_init_m (struct rsnd_kctrl_cfg_m *cfg) { cfg->cfg.val = cfg->val;
sound/soc/sh/rcar/rsnd.h +0 -1
@@ -742,7 +742,6 @@ struct rsnd_kctrl_cfg_s {#define rsnd_kctrl_vals (x) ((x).val)/* = (x).cfg.val[0] */ int rsnd_kctrl_accept_anytime (struct rsnd_dai_stream *io); -int rsnd_kctrl_accept_runtime (struct rsnd_dai_stream *io);struct rsnd_kctrl_cfg *rsnd_kctrl_init_m (struct rsnd_kctrl_cfg_m *cfg);struct rsnd_kctrl_cfg *rsnd_kctrl_init_s (struct rsnd_kctrl_cfg_s *cfg); int rsnd_kctrl_new(struct rsnd_mod *mod,
sound/soc/sh/rcar/src.c +17 -1
@@ -531,6 +531,22 @@ static irqreturn_t rsnd_src_interrupt(int irq, void *data)return IRQ_HANDLED ; } +static int rsnd_src_kctrl_accept_runtime (struct rsnd_dai_stream *io) +{ +struct snd_pcm_runtime *runtime =rsnd_io_to_runtime (io); + +if (!runtime) { +struct rsnd_priv *priv =rsnd_io_to_priv (io); +struct device *dev =rsnd_priv_to_dev (priv); + +dev_warn (dev,"\"SRC Out Rate\" can use during running\n" ); + +return 0 ; + } + +return 1 ; +} +static int rsnd_src_probe_ (struct rsnd_mod *mod,struct rsnd_dai_stream *io,struct rsnd_priv *priv)
@@ -594,7 +610,7 @@ static int rsnd_src_pcm_new(struct rsnd_mod *mod,rsnd_io_is_play (io) ?"SRC Out Rate" :"SRC In Rate" , - rsnd_kctrl_accept_runtime, + rsnd_src_kctrl_accept_runtime, rsnd_src_set_convert_rate, &src->sync, 192000);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 110/231 ASoC: rsnd: adjust convert rate limitation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuninori Morimoto <[email protected]>
[ Upstream commit 89f9cf185885d4358aa92b48e51d0f09b71775aa ]
Current rsnd driver supports Synchronous SRC Mode, but HW allow to update rate only within 1% from current rate. Adjust to it.
Becially, this feature is used to fine-tune subtle difference that occur during sampling rate conversion in SRC. So, it should be called within 1% margin of rate difference.
If there was difference over 1%, it will apply with 1% increments by using loop without indicating error message.
--- sound/soc/sh/rcar/src.c | 98 ++++++++++++++++++++++++++++++++--------- 1 file changed, 76 insertions(+), 22 deletions(-)
sound/soc/sh/rcar/src.c +76 -22
@@ -35,6 +35,7 @@ struct rsnd_src {struct rsnd_mod *dma;struct rsnd_kctrl_cfg_s sen;/* sync convert enable */ struct rsnd_kctrl_cfg_s sync;/* sync convert */ +u32 current_sync_rate;int irq; };
@@ -100,7 +101,7 @@ static u32 rsnd_src_convert_rate(struct rsnd_dai_stream *io,if (!rsnd_src_sync_is_enabled (mod))return rsnd_io_converted_rate (io); - convert_rate = src->sync.val; + convert_rate = src->current_sync_rate;if (!convert_rate) convert_rate =rsnd_io_converted_rate (io);
@@ -201,13 +202,73 @@ static const u32 chan222222[] = {static void rsnd_src_set_convert_rate (struct rsnd_dai_stream *io,struct rsnd_mod *mod) { +struct snd_pcm_runtime *runtime =rsnd_io_to_runtime (io);struct rsnd_priv *priv =rsnd_mod_to_priv (mod); -struct device *dev =rsnd_priv_to_dev (priv); +struct rsnd_src *src =rsnd_mod_to_src (mod); +u32 fin, fout, new_rate; +int inc, cnt, rate; +u64 base, val; + +if (!runtime) +return ; + +if (!rsnd_src_sync_is_enabled (mod)) +return ; + + fin =rsnd_src_get_in_rate (priv, io); + fout =rsnd_src_get_out_rate (priv, io); + + new_rate = src->sync.val; + +if (!new_rate) + new_rate = fout; + +/* Do nothing if no diff */ +if (new_rate == src->current_sync_rate) +return ; + +/* +* SRCm_IFSVR::INTIFS can change within 1% +* see +* SRCm_IFSVR::INTIFS Note +*/ + inc = fout /100 ; + cnt =abs (new_rate - fout) / inc; +if (fout > new_rate) + inc *=-1 ; + +/* +* After start running SRC, we can update only SRC_IFSVR +* for Synchronous Mode +*/ + base = (u64 )0x0400000 * fin; + rate = fout; +for (int i =0 ; i < cnt; i++) { + val = base; + rate += inc; +do_div (val, rate); + +rsnd_mod_write (mod,SRC_IFSVR , val); + } + val = base; +do_div (val, new_rate); + +rsnd_mod_write (mod,SRC_IFSVR , val); + +/* update current_sync_rate */ + src->current_sync_rate = new_rate; +} + +static void rsnd_src_init_convert_rate (struct rsnd_dai_stream *io, +struct rsnd_mod *mod) +{struct snd_pcm_runtime *runtime =rsnd_io_to_runtime (io); +struct rsnd_priv *priv =rsnd_mod_to_priv (mod); +struct device *dev =rsnd_priv_to_dev (priv);int is_play =rsnd_io_is_play (io);int use_src =0 ;u32 fin, fout; -u32 ifscr, fsrate, adinr; +u32 ifscr, adinr;u32 cr, route;u32 i_busif, o_busif, tmp;const u32 *bsdsr_table;
@@ -245,26 +306,15 @@ static void rsnd_src_set_convert_rate(struct rsnd_dai_stream *io, adinr =rsnd_get_adinr_bit (mod, io) | chan;/* -* SRC_IFSCR / SRC_IFSVR -*/ - ifscr =0 ; - fsrate =0 ; -if (use_src) { -u64 n; - - ifscr =1 ; - n = (u64 )0x0400000 * fin; -do_div (n, fout); - fsrate = n; - } - -/* +* SRC_IFSCR * SRC_SRCCR / SRC_ROUTE_MODE0 */ + ifscr =0 ; cr =0x00011110 ; route =0x0 ;if (use_src) { route =0x1 ; + ifscr =0x1 ;if (rsnd_src_sync_is_enabled (mod)) { cr |=0x1 ;
@@ -335,7 +385,6 @@ static void rsnd_src_set_convert_rate(struct rsnd_dai_stream *io,rsnd_mod_write (mod,SRC_SRCIR ,1 );/* initialize */ rsnd_mod_write (mod,SRC_ADINR , adinr);rsnd_mod_write (mod,SRC_IFSCR , ifscr); -rsnd_mod_write (mod,SRC_IFSVR , fsrate);rsnd_mod_write (mod,SRC_SRCCR , cr);rsnd_mod_write (mod,SRC_BSDSR , bsdsr_table[idx]);rsnd_mod_write (mod,SRC_BSISR , bsisr_table[idx]);
@@ -348,6 +397,9 @@ static void rsnd_src_set_convert_rate(struct rsnd_dai_stream *io,rsnd_adg_set_src_timesel_gen2 (mod, io, fin, fout); +/* update SRC_IFSVR */ +rsnd_src_set_convert_rate (io, mod); +return ; convert_rate_err:
@@ -467,7 +519,8 @@ static int rsnd_src_init(struct rsnd_mod *mod,int ret;/* reset sync convert_rate */ - src->sync.val =0 ; + src->sync.val = + src->current_sync_rate =0 ; ret =rsnd_mod_power_on (mod);if (ret <0 )
@@ -475,7 +528,7 @@ static int rsnd_src_init(struct rsnd_mod *mod,rsnd_src_activation (mod); -rsnd_src_set_convert_rate (io, mod); +rsnd_src_init_convert_rate (io, mod);rsnd_src_status_clear (mod);
@@ -493,7 +546,8 @@ static int rsnd_src_quit(struct rsnd_mod *mod,rsnd_mod_power_off (mod);/* reset sync convert_rate */ - src->sync.val =0 ; + src->sync.val = + src->current_sync_rate =0 ;return 0 ; }
@@ -601,7 +655,7 @@ static int rsnd_src_pcm_new(struct rsnd_mod *mod, "SRC Out Rate Switch" :"SRC In Rate Switch" , rsnd_kctrl_accept_anytime, - rsnd_src_set_convert_rate, + rsnd_src_init_convert_rate, &src->sen, 1);if (ret <0 )return ret;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 111/231 ASoC: arizona/madera: use fsleep() in up/down DAPM event delays.
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vitaly Rodionov <[email protected]>
[ Upstream commit 679074942c2502a95842a80471d8fb718165ac77 ]
Using fsleep instead of msleep resolves some customer complaints regarding the precision of up/down DAPM event timing. fsleep() automatically selects the appropriate sleep function, making the delay time more predictable.
--- sound/soc/codecs/arizona.c | 14 +++++++------- sound/soc/codecs/madera.c | 10 +++++----- sound/soc/codecs/wm5110.c | 8 ++++---- 3 files changed, 16 insertions(+), 16 deletions(-)
sound/soc/codecs/arizona.c +7 -7
@@ -967,7 +967,7 @@ int arizona_out_ev(struct snd_soc_dapm_widget *w,case ARIZONA_OUT3L_ENA_SHIFT :case ARIZONA_OUT3R_ENA_SHIFT : priv->out_up_pending++; - priv->out_up_delay +=17 ; + priv->out_up_delay +=17000 ;break ;case ARIZONA_OUT4L_ENA_SHIFT :case ARIZONA_OUT4R_ENA_SHIFT :
@@ -977,7 +977,7 @@ int arizona_out_ev(struct snd_soc_dapm_widget *w,case WM8997 :break ;default : - priv->out_up_delay +=10 ; + priv->out_up_delay +=10000 ;break ; }break ;
@@ -999,7 +999,7 @@ int arizona_out_ev(struct snd_soc_dapm_widget *w,if (!priv->out_up_pending && priv->out_up_delay) {dev_dbg (component->dev,"Power up delay: %d\n" , priv->out_up_delay); -msleep (priv->out_up_delay); +fsleep (priv->out_up_delay); priv->out_up_delay =0 ; }break ;
@@ -1017,7 +1017,7 @@ int arizona_out_ev(struct snd_soc_dapm_widget *w,case ARIZONA_OUT3L_ENA_SHIFT :case ARIZONA_OUT3R_ENA_SHIFT : priv->out_down_pending++; - priv->out_down_delay++; + priv->out_down_delay +=1000 ;break ;case ARIZONA_OUT4L_ENA_SHIFT :case ARIZONA_OUT4R_ENA_SHIFT :
@@ -1028,10 +1028,10 @@ int arizona_out_ev(struct snd_soc_dapm_widget *w,break ;case WM8998 :case WM1814 : - priv->out_down_delay +=5 ; + priv->out_down_delay +=5000 ;break ;default : - priv->out_down_delay++; + priv->out_down_delay +=1000 ;break ; }break ;
@@ -1053,7 +1053,7 @@ int arizona_out_ev(struct snd_soc_dapm_widget *w,if (!priv->out_down_pending && priv->out_down_delay) {dev_dbg (component->dev,"Power down delay: %d\n" , priv->out_down_delay); -msleep (priv->out_down_delay); +fsleep (priv->out_down_delay); priv->out_down_delay =0 ; }break ;
sound/soc/codecs/madera.c +5 -5
@@ -2322,10 +2322,10 @@ int madera_out_ev(struct snd_soc_dapm_widget *w,case CS42L92 :case CS47L92 :case CS47L93 : - out_up_delay =6 ; + out_up_delay =6000 ;break ;default : - out_up_delay =17 ; + out_up_delay =17000 ;break ; }
@@ -2356,7 +2356,7 @@ int madera_out_ev(struct snd_soc_dapm_widget *w,case MADERA_OUT3R_ENA_SHIFT : priv->out_up_pending--;if (!priv->out_up_pending) { -msleep (priv->out_up_delay); +fsleep (priv->out_up_delay); priv->out_up_delay =0 ; }break ;
@@ -2375,7 +2375,7 @@ int madera_out_ev(struct snd_soc_dapm_widget *w,case MADERA_OUT3L_ENA_SHIFT :case MADERA_OUT3R_ENA_SHIFT : priv->out_down_pending++; - priv->out_down_delay++; + priv->out_down_delay +=1000 ;break ;default :break ;
@@ -2392,7 +2392,7 @@ int madera_out_ev(struct snd_soc_dapm_widget *w,case MADERA_OUT3R_ENA_SHIFT : priv->out_down_pending--;if (!priv->out_down_pending) { -msleep (priv->out_down_delay); +fsleep (priv->out_down_delay); priv->out_down_delay =0 ; }break ;
sound/soc/codecs/wm5110.c +4 -4
@@ -302,7 +302,7 @@ static int wm5110_hp_pre_enable(struct snd_soc_dapm_widget *w) }else { wseq = wm5110_no_dre_left_enable; nregs =ARRAY_SIZE (wm5110_no_dre_left_enable); - priv->out_up_delay +=10 ; + priv->out_up_delay +=10000 ; }break ;case ARIZONA_OUT1R_ENA_SHIFT :
@@ -312,7 +312,7 @@ static int wm5110_hp_pre_enable(struct snd_soc_dapm_widget *w) }else { wseq = wm5110_no_dre_right_enable; nregs =ARRAY_SIZE (wm5110_no_dre_right_enable); - priv->out_up_delay +=10 ; + priv->out_up_delay +=10000 ; }break ;default :
@@ -338,7 +338,7 @@ static int wm5110_hp_pre_disable(struct snd_soc_dapm_widget *w)snd_soc_component_update_bits (component,ARIZONA_SPARE_TRIGGERS ,ARIZONA_WS_TRG1 ,0 ); - priv->out_down_delay +=27 ; + priv->out_down_delay +=27000 ; }break ;case ARIZONA_OUT1R_ENA_SHIFT :
@@ -350,7 +350,7 @@ static int wm5110_hp_pre_disable(struct snd_soc_dapm_widget *w)snd_soc_component_update_bits (component,ARIZONA_SPARE_TRIGGERS ,ARIZONA_WS_TRG2 ,0 ); - priv->out_down_delay +=27 ; + priv->out_down_delay +=27000 ; }break ;default :
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 112/231 ASoC: SOF: Intel: hda: add softdep pre to snd-hda-codec-hdmi module
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Terry Cheong <[email protected]>
[ Upstream commit 33b7dc7843dbdc9b90c91d11ba30b107f9138ffd ]
In enviornment without KMOD requesting module may fail to load snd-hda-codec-hdmi, resulting in HDMI audio not usable.
Add softdep to loading HDMI codec module first to ensure we can load it correctly.
--- sound/soc/sof/intel/hda-codec.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/sof/intel/hda-codec.c +1 -0
@@ -454,6 +454,7 @@ int hda_codec_i915_exit(struct snd_sof_dev *sdev) }EXPORT_SYMBOL_NS_GPL (hda_codec_i915_exit,SND_SOC_SOF_HDA_AUDIO_CODEC_I915 ); +MODULE_SOFTDEP ("pre: snd-hda-codec-hdmi" );#endif MODULE_LICENSE ("Dual BSD/GPL" );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 113/231 PCI: pci_ids: add INTEL_HDA_PTL_H
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre-Louis Bossart <[email protected]>
[ Upstream commit a1f7b7ff0e10ae574d388131596390157222f986 ]
Add Intel PTL-H audio Device ID.
--- include/linux/pci_ids.h | 1 + 1 file changed, 1 insertion(+)
include/linux/pci_ids.h +1 -0
@@ -3133,6 +3133,7 @@#define PCI_DEVICE_ID_INTEL_HDA_LNL_P 0xa828#define PCI_DEVICE_ID_INTEL_S21152BB 0xb152#define PCI_DEVICE_ID_INTEL_HDA_BMG 0xe2f7 +#define PCI_DEVICE_ID_INTEL_HDA_PTL_H 0xe328#define PCI_DEVICE_ID_INTEL_HDA_PTL 0xe428#define PCI_DEVICE_ID_INTEL_HDA_CML_R 0xf0c8#define PCI_DEVICE_ID_INTEL_HDA_RKL_S 0xf1c8
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 114/231 ALSA: hda: intel-dsp-config: Add PTL-H support
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre-Louis Bossart <[email protected]>
[ Upstream commit 214e6be2d91d5d58f28d3a37630480077a1aafbd ]
Use same recipes as PTL for PTL-H.
--- sound/hda/intel-dsp-config.c | 5 +++++ 1 file changed, 5 insertions(+)
sound/hda/intel-dsp-config.c +5 -0
@@ -539,6 +539,11 @@ static const struct config_entry config_table[] = { .flags = FLAG_SOF | FLAG_SOF_ONLY_IF_DMIC_OR_SOUNDWIRE, .device = PCI_DEVICE_ID_INTEL_HDA_PTL, }, + { + .flags = FLAG_SOF | FLAG_SOF_ONLY_IF_DMIC_OR_SOUNDWIRE, + .device = PCI_DEVICE_ID_INTEL_HDA_PTL_H, + }, +#endif };
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 115/231 ASoC: SOF: Intel: pci-ptl: Add support for PTL-H
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <[email protected]>
[ Upstream commit 4e9c87cfcd0584f2a2e2f352a43ff003d688f3a4 ]
PTL-H uses the same configuration as PTL.
--- sound/soc/sof/intel/pci-ptl.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/sof/intel/pci-ptl.c +1 -0
@@ -50,6 +50,7 @@ static const struct sof_dev_desc ptl_desc = {/* PCI IDs */ static const struct pci_device_id sof_pci_ids[] = { {PCI_DEVICE_DATA (INTEL ,HDA_PTL , &ptl_desc) },/* PTL */ + {PCI_DEVICE_DATA (INTEL ,HDA_PTL_H , &ptl_desc) },/* PTL-H */ {0 , } };MODULE_DEVICE_TABLE (pci, sof_pci_ids);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 116/231 ALSA: hda: hda-intel: add Panther Lake-H support
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre-Louis Bossart <[email protected]>
[ Upstream commit d7e2447a4d51de5c3c03e3b7892898e98ddd9769 ]
Add Intel PTL-H audio Device ID.
--- sound/pci/hda/hda_intel.c | 2 ++ 1 file changed, 2 insertions(+)
sound/pci/hda/hda_intel.c +2 -0
@@ -2508,6 +2508,8 @@ static const struct pci_device_id azx_ids[] = { { PCI_DEVICE_DATA(INTEL, HDA_ARL, AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE) },/* Panther Lake */ { PCI_DEVICE_DATA(INTEL, HDA_PTL, AZX_DRIVER_SKL | AZX_DCAPS_INTEL_LNL) }, +/* Panther Lake-H */ + { PCI_DEVICE_DATA(INTEL, HDA_PTL_H, AZX_DRIVER_SKL | AZX_DCAPS_INTEL_LNL) },/* Apollolake (Broxton-P) */ { PCI_DEVICE_DATA(INTEL, HDA_APL, AZX_DRIVER_SKL | AZX_DCAPS_INTEL_BROXTON) },/* Gemini-Lake */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 117/231 ASoC: SOF: amd: Add post_fw_run_delay ACP quirk
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Ciocaltea <[email protected]>
[ Upstream commit 91b98d5a6e8067c5226207487681a48f0d651e46 ]
Stress testing resume from suspend on Valve Steam Deck OLED (Galileo) revealed that the DSP firmware could enter an unrecoverable faulty state, where the kernel ring buffer is flooded with IPC related error messages:
[ +0.017002] snd_sof_amd_vangogh 0000:04:00.5: acp_sof_ipc_send_msg: Failed to acquire HW lock [ +0.000054] snd_sof_amd_vangogh 0000:04:00.5: ipc3_tx_msg_unlocked: ipc message send for 0x30100000 failed: -22 [ +0.000005] snd_sof_amd_vangogh 0000:04:00.5: Failed to setup widget PIPELINE.6.ACPHS1.IN [ +0.000004] snd_sof_amd_vangogh 0000:04:00.5: Failed to restore pipeline after resume -22 [ +0.000003] snd_sof_amd_vangogh 0000:04:00.5: PM: dpm_run_callback(): pci_pm_resume returns -22 [ +0.000009] snd_sof_amd_vangogh 0000:04:00.5: PM: failed to resume async: error -22 [...] [ +0.002582] PM: suspend exit [ +0.065085] snd_sof_amd_vangogh 0000:04:00.5: ipc tx error for 0x30130000 (msg/reply size: 12/0): -22 [ +0.000499] snd_sof_amd_vangogh 0000:04:00.5: error: failed widget list set up for pcm 1 dir 0 [ +0.000011] snd_sof_amd_vangogh 0000:04:00.5: error: set pcm hw_params after resume [ +0.000006] snd_sof_amd_vangogh 0000:04:00.5: ASoC: error at snd_soc_pcm_component_prepare on 0000:04:00.5: -22
[...]
A system reboot would be necessary to restore the speakers functionality.
However, by delaying a bit any host to DSP transmission right after the firmware boot completed, the issue could not be reproduced anymore and sound continued to work flawlessly even after performing thousands of suspend/resume cycles.
Introduce the post_fw_run_delay ACP quirk to allow providing the aforementioned delay via the snd_sof_dsp_ops->post_fw_run() callback for the affected devices.
--- sound/soc/sof/amd/acp.c | 1 + sound/soc/sof/amd/acp.h | 1 + sound/soc/sof/amd/vangogh.c | 18 ++++++++++++++++++ 3 files changed, 20 insertions(+)
sound/soc/sof/amd/acp.c +1 -0
@@ -27,6 +27,7 @@ MODULE_PARM_DESC(enable_fw_debug, "Enable Firmware debug");static struct acp_quirk_entry quirk_valve_galileo = { .signed_fw_image = true, .skip_iram_dram_size_mod = true, + .post_fw_run_delay = true, };const struct dmi_system_id acp_sof_quirk_table[] = {
sound/soc/sof/amd/acp.h +1 -0
@@ -220,6 +220,7 @@ struct sof_amd_acp_desc {struct acp_quirk_entry {bool signed_fw_image;bool skip_iram_dram_size_mod; +bool post_fw_run_delay; };/* Common device data struct for ACP devices */
sound/soc/sof/amd/vangogh.c +18 -0
@@ -11,6 +11,7 @@* Hardware interface for Audio DSP on Vangogh platform */ +#include <linux/delay.h> #include <linux/platform_device.h> #include <linux/module.h>
@@ -136,6 +137,20 @@ static struct snd_soc_dai_driver vangogh_sof_dai[] = { }, }; +static int sof_vangogh_post_fw_run_delay (struct snd_sof_dev *sdev) +{ +/* +* Resuming from suspend in some cases my cause the DSP firmware +* to enter an unrecoverable faulty state. Delaying a bit any host +* to DSP transmission right after firmware boot completion seems +* to resolve the issue. +*/ +if (!sdev->first_boot) +usleep_range (100 ,150 ); + +return 0 ; +} +/* Vangogh ops */ struct snd_sof_dsp_ops sof_vangogh_ops;EXPORT_SYMBOL_NS (sof_vangogh_ops,SND_SOC_SOF_AMD_COMMON );
@@ -157,6 +172,9 @@ int sof_vangogh_ops_init(struct snd_sof_dev *sdev)if (quirks->signed_fw_image) sof_vangogh_ops.load_firmware = acp_sof_load_signed_firmware; + +if (quirks->post_fw_run_delay) + sof_vangogh_ops.post_fw_run = sof_vangogh_post_fw_run_delay; }return 0 ;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 118/231 ASoC: SOF: amd: Handle IPC replies before FW_BOOT_COMPLETE
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Ciocaltea <[email protected]>
[ Upstream commit ac84ca815adb4171a4276b1d44096b75f6a150b7 ]
In some cases, e.g. during resuming from suspend, there is a possibility that some IPC reply messages get received by the host while the DSP firmware has not yet reached the complete boot state.
Detect when this happens and do not attempt to process the unexpected replies from DSP. Instead, provide proper debugging support.
--- sound/soc/sof/amd/acp-ipc.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-)
sound/soc/sof/amd/acp-ipc.c +16 -7
@@ -167,6 +167,7 @@ irqreturn_t acp_sof_ipc_irq_thread(int irq, void *context)if (sdev->first_boot && sdev->fw_state !=SOF_FW_BOOT_COMPLETE ) {acp_mailbox_read (sdev, sdev->dsp_box.offset, &status,sizeof (status)); +if ((status &SOF_IPC_PANIC_MAGIC_MASK ) ==SOF_IPC_PANIC_MAGIC ) {snd_sof_dsp_panic (sdev, sdev->dsp_box.offset +sizeof (status), true);
@@ -188,13 +189,21 @@ irqreturn_t acp_sof_ipc_irq_thread(int irq, void *context) dsp_ack =snd_sof_dsp_read (sdev,ACP_DSP_BAR ,ACP_SCRATCH_REG_0 + dsp_ack_write);if (dsp_ack) { -spin_lock_irq (&sdev->ipc_lock); -/* handle immediate reply from DSP core */ -acp_dsp_ipc_get_reply (sdev); -snd_sof_ipc_reply (sdev,0 ); -/* set the done bit */ -acp_dsp_ipc_dsp_done (sdev); -spin_unlock_irq (&sdev->ipc_lock); +if (likely (sdev->fw_state ==SOF_FW_BOOT_COMPLETE )) { +spin_lock_irq (&sdev->ipc_lock); + +/* handle immediate reply from DSP core */ +acp_dsp_ipc_get_reply (sdev); +snd_sof_ipc_reply (sdev,0 ); +/* set the done bit */ +acp_dsp_ipc_dsp_done (sdev); + +spin_unlock_irq (&sdev->ipc_lock); + }else { +dev_dbg_ratelimited (sdev->dev,"IPC reply before FW_BOOT_COMPLETE: %#x\n" , + dsp_ack); + } + ipc_irq = true; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 119/231 net: wwan: mhi_wwan_mbim: Silence sequence number glitch errors
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <[email protected]>
[ Upstream commit 0d1fac6d26aff5df21bb4ec980d9b7a11c410b96 ]
When using the Qualcomm X55 modem on the ThinkPad X13s, the kernel log is constantly being filled with errors related to a "sequence number glitch", e.g.:
[ 1903.284538] sequence number glitch prev=16 curr=0 [ 1913.812205] sequence number glitch prev=50 curr=0 [ 1923.698219] sequence number glitch prev=142 curr=0 [ 2029.248276] sequence number glitch prev=1555 curr=0 [ 2046.333059] sequence number glitch prev=70 curr=0 [ 2076.520067] sequence number glitch prev=272 curr=0 [ 2158.704202] sequence number glitch prev=2655 curr=0 [ 2218.530776] sequence number glitch prev=2349 curr=0 [ 2225.579092] sequence number glitch prev=6 curr=0
Internet connectivity is working fine, so this error seems harmless. It looks like modem does not preserve the sequence number when entering low power state; the amount of errors depends on how actively the modem is being used.
A similar issue has also been seen on USB-based MBIM modems [1]. However, in cdc_ncm.c the "sequence number glitch" message is a debug message instead of an error. Apply the same to the mhi_wwan_mbim.c driver to silence these errors when using the modem.
[1]: https://lists.freedesktop.org/archives/libmbim-devel/2016-November/000781.html
--- drivers/net/wwan/mhi_wwan_mbim.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wwan/mhi_wwan_mbim.c +1 -1
@@ -220,7 +220,7 @@ static int mbim_rx_verify_nth16(struct mhi_mbim_context *mbim, struct sk_buff *sif (mbim->rx_seq +1 !=le16_to_cpu (nth16->wSequence) && (mbim->rx_seq ||le16_to_cpu (nth16->wSequence)) && !(mbim->rx_seq ==0xffff && !le16_to_cpu (nth16->wSequence))) { -net_err_ratelimited ("sequence number glitch prev=%d curr=%d\n" , +net_dbg_ratelimited ("sequence number glitch prev=%d curr=%d\n" , mbim->rx_seq,le16_to_cpu (nth16->wSequence)); } mbim->rx_seq =le16_to_cpu (nth16->wSequence);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 120/231 io-wq: backoff when retrying worker creation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uday Shankar <[email protected]>
[ Upstream commit 13918315c5dc5a515926c8799042ea6885c2b734 ]
When io_uring submission goes async for the first time on a given task, we'll try to create a worker thread to handle the submission. Creating this worker thread can fail due to various transient conditions, such as an outstanding signal in the forking thread, so we have retry logic with a limit of 3 retries. However, this retry logic appears to be too aggressive/fast - we've observed a thread blowing through the retry limit while having the same outstanding signal the whole time. Here's an excerpt of some tracing that demonstrates the issue:
First, signal 26 is generated for the process. It ends up getting routed to thread 92942.
0) cbd-92284 /* signal_generate: sig=26 errno=0 code=-2 comm=psblkdASD pid=92934 grp=1 res=0 */
This causes create_io_thread in the signalled thread to fail with ERESTARTNOINTR, and thus a retry is queued.
13) task_th-92942 /* io_uring_queue_async_work: ring 000000007325c9ae, request 0000000080c96d8e, user_data 0x0, opcode URING_CMD, flags 0x8240001, normal queue, work 000000006e96dd3f */
13) task_th-92942 io_wq_enqueue() {
13) task_th-92942 _raw_spin_lock();
13) task_th-92942 io_wq_activate_free_worker();
13) task_th-92942 _raw_spin_lock();
13) task_th-92942 create_io_worker() {
13) task_th-92942 __kmalloc_cache_noprof();
13) task_th-92942 __init_swait_queue_head();
13) task_th-92942 kprobe_ftrace_handler() {13) task_th-92942 get_kprobe();
13) task_th-92942 aggr_pre_handler() {
13) task_th-92942 pre_handler_kretprobe();
13) task_th-92942 /* create_enter: (create_io_thread+0x0/0x50) fn=0xffffffff8172c0e0 arg=0xffff888996bb69c0 node=-1 */
13) task_th-92942 } /* aggr_pre_handler */
...
13) task_th-92942 } /* copy_process */
13) task_th-92942 } /* create_io_thread */
13) task_th-92942 kretprobe_rethook_handler() {
13) task_th-92942 /* create_exit: (create_io_worker+0x8a/0x1a0 <- create_io_thread) arg1=0xfffffffffffffdff */
13) task_th-92942 } /* kretprobe_rethook_handler */
13) task_th-92942 queue_work_on() {
...
The CPU is then handed to a kworker to process the queued retry:
------------------------------------------
13) task_th-92942 => kworker-54154
------------------------------------------
13) kworker-54154 io_workqueue_create() {
13) kworker-54154 io_queue_worker_create() {
13) kworker-54154 task_work_add() {
13) kworker-54154 wake_up_state() {
13) kworker-54154 try_to_wake_up() {
13) kworker-54154 _raw_spin_lock_irqsave();
13) kworker-54154 _raw_spin_unlock_irqrestore();
13) kworker-54154 } /* try_to_wake_up */
13) kworker-54154 } /* wake_up_state */
13) kworker-54154 kick_process();
13) kworker-54154 } /* task_work_add */
13) kworker-54154 } /* io_queue_worker_create */
13) kworker-54154 } /* io_workqueue_create */
And then we immediately switch back to the original task to try creating a worker again. This fails, because the original task still hasn't handled its signal.
-----------------------------------------
13) kworker-54154 => task_th-92942
------------------------------------------
13) task_th-92942 create_worker_cont() {
13) task_th-92942 kprobe_ftrace_handler() {
13) task_th-92942 get_kprobe();
13) task_th-92942 aggr_pre_handler() {
13) task_th-92942 pre_handler_kretprobe();
13) task_th-92942 /* create_enter: (create_io_thread+0x0/0x50) fn=0xffffffff8172c0e0 arg=0xffff888996bb69c0 node=-1 */
13) task_th-92942 } /* aggr_pre_handler */
13) task_th-92942 } /* kprobe_ftrace_handler */
13) task_th-92942 create_io_thread() {
13) task_th-92942 copy_process() {
13) task_th-92942 task_active_pid_ns(); 13) task_th-92942 _raw_spin_lock_irq(); 13) task_th-92942 recalc_sigpending(); 13) task_th-92942 _raw_spin_lock_irq();
13) task_th-92942 } /* copy_process */
13) task_th-92942 } /* create_io_thread */
13) task_th-92942 kretprobe_rethook_handler() {
13) task_th-92942 /* create_exit: (create_worker_cont+0x35/0x1b0 <- create_io_thread) arg1=0xfffffffffffffdff */
13) task_th-92942 } /* kretprobe_rethook_handler */
13) task_th-92942 io_worker_release();
13) task_th-92942 queue_work_on() {
13) task_th-92942 clear_pending_if_disabled();
13) task_th-92942 __queue_work() {
13) task_th-92942 } /* __queue_work */13) task_th-92942 } /* queue_work_on */
13) task_th-92942 } /* create_worker_cont */
The pattern repeats another couple times until we blow through the retry counter, at which point we give up. All outstanding work is canceled, and the io_uring command which triggered all this is failed with ECANCELED:
13) task_th-92942 io_acct_cancel_pending_work() {
...
13) task_th-92942 /* io_uring_complete: ring 000000007325c9ae, req 0000000080c96d8e, user_data 0x0, result -125, cflags 0x0 extra1 0 extra2 0 */
Finally, the task gets around to processing its outstanding signal 26, but it's too late.
13) task_th-92942 /* signal_deliver: sig=26 errno=0 code=-2 sa_handler=59566a0 sa_flags=14000000 */
Try to address this issue by adding a small scaling delay when retrying worker creation. This should give the forking thread time to handle its signal in the above case. This isn't a particularly satisfying solution, as sufficiently paradoxical scheduling would still have us hitting the same issue, and I'm open to suggestions for something better. But this is likely to prevent this (already rare) issue from hitting in practice.
--- io_uring/io-wq.c | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-)
io_uring/io-wq.c +18 -5
@@ -64,7 +64,7 @@ struct io_worker {union {struct rcu_head rcu; -struct work_struct work; +struct delayed_work work; }; };
@@ -770,6 +770,18 @@ static inline bool io_should_retry_thread(struct io_worker *worker, long err) } } +static void queue_create_worker_retry (struct io_worker *worker) +{ +/* +* We only bother retrying because there's a chance that the +* failure to create a worker is due to some temporary condition +* in the forking task (e.g. outstanding signal); give the task +* some time to clear that condition. +*/ +schedule_delayed_work (&worker->work, +msecs_to_jiffies (worker->init_retries *5 )); +} +static void create_worker_cont (struct callback_head *cb) {struct io_worker *worker;
@@ -809,12 +821,13 @@ static void create_worker_cont(struct callback_head *cb)/* re-create attempts grab a new worker ref, drop the existing one */ io_worker_release (worker); -schedule_work (&worker->work); +queue_create_worker_retry (worker); }static void io_workqueue_create (struct work_struct *work) { - struct io_worker *worker = container_of(work, struct io_worker, work); + struct io_worker *worker = container_of(work, struct io_worker, + work.work);struct io_wq_acct *acct =io_wq_get_acct (worker);if (!io_queue_worker_create (worker, acct, create_worker_cont))
@@ -855,8 +868,8 @@ static bool create_io_worker(struct io_wq *wq, int index)kfree (worker); goto fail; }else { -INIT_WORK (&worker->work, io_workqueue_create); -schedule_work (&worker->work); +INIT_DELAYED_WORK (&worker->work, io_workqueue_create); +queue_create_worker_retry (worker); }return true;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 121/231 nvme-pci: quirk Acer FA100 for non-uniqueue identifiers
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christopher Lentocha <[email protected]>
[ Upstream commit fcd875445866a5219cf2be3101e276b21fc843f3 ]
In order for two Acer FA100 SSDs to work in one PC (in the case of myself, a Lenovo Legion T5 28IMB05), and not show one drive and not the other, and sometimes mix up what drive shows up (randomly), these two lines of code need to be added, and then both of the SSDs will show up and not conflict when booting off of one of them. If you boot up your computer with both SSDs installed without this patch, you may also randomly get into a kernel panic (if the initrd is not set up) or stuck in the initrd "/init" process, it is set up, however, if you do apply this patch, there should not be problems with booting or seeing both contents of the drive. Tested with the btrfs filesystem with a RAID configuration of having the root drive '/' combined to make two 256GB Acer FA100 SSDs become 512GB in total storage.
Kernel Logs with patch applied (dmesg -t | grep -i nvm):
``` ... nvme 0000:04:00.0: platform quirk: setting simple suspend nvme nvme0: pci function 0000:04:00.0 nvme 0000:05:00.0: platform quirk: setting simple suspend nvme nvme1: pci function 0000:05:00.0 nvme nvme1: missing or invalid SUBNQN field. nvme nvme1: allocated 64 MiB host memory buffer. nvme nvme0: missing or invalid SUBNQN field. nvme nvme0: allocated 64 MiB host memory buffer. nvme nvme1: 8/0/0 default/read/poll queues nvme nvme1: Ignoring bogus Namespace Identifiers nvme nvme0: 8/0/0 default/read/poll queues nvme nvme0: Ignoring bogus Namespace Identifiers nvme0n1: p1 p2 ... ```
Kernel Logs with patch not applied (dmesg -t | grep -i nvm):
``` ... nvme 0000:04:00.0: platform quirk: setting simple suspend nvme nvme0: pci function 0000:04:00.0 nvme 0000:05:00.0: platform quirk: setting simple suspend nvme nvme1: pci function 0000:05:00.0 nvme nvme0: missing or invalid SUBNQN field. nvme nvme1: missing or invalid SUBNQN field. nvme nvme0: allocated 64 MiB host memory buffer. nvme nvme1: allocated 64 MiB host memory buffer. nvme nvme0: 8/0/0 default/read/poll queues nvme nvme1: 8/0/0 default/read/poll queues nvme nvme1: globally duplicate IDs for nsid 1 nvme nvme1: VID:DID 1dbe:5216 model:Acer SSD FA100 256GB firmware:1.Z.J.2X nvme0n1: p1 p2 ... ```
--- drivers/nvme/host/pci.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/nvme/host/pci.c +2 -0
@@ -3669,6 +3669,8 @@ static const struct pci_device_id nvme_id_table[] = { .driver_data = NVME_QUIRK_BOGUS_NID, }, { PCI_DEVICE(0x1cc1, 0x5350), /* ADATA XPG GAMMIX S50 */ .driver_data = NVME_QUIRK_BOGUS_NID, }, + { PCI_DEVICE(0x1dbe, 0x5216), /* Acer/INNOGRIT FA100/5216 NVMe SSD */ + .driver_data = NVME_QUIRK_BOGUS_NID, }, { PCI_DEVICE(0x1dbe, 0x5236), /* ADATA XPG GAMMIX S70 */ .driver_data = NVME_QUIRK_BOGUS_NID, }, { PCI_DEVICE(0x1e49, 0x0021), /* ZHITAI TiPro5000 NVMe SSD */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 122/231 nvmet-rdma: recheck queue state is LIVE in state lock in recv done
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruozhu Li <[email protected]>
[ Upstream commit 3988ac1c67e6e84d2feb987d7b36d5791174b3da ]
The queue state checking in nvmet_rdma_recv_done is not in queue state lock.Queue state can transfer to LIVE in cm establish handler between state checking and state lock here, cause a silent drop of nvme connect cmd.
Recheck queue state whether in LIVE state in state lock to prevent this issue.
--- drivers/nvme/target/rdma.c | 33 +++++++++++++++++++++++---------- 1 file changed, 23 insertions(+), 10 deletions(-)
drivers/nvme/target/rdma.c +23 -10
@@ -996,6 +996,27 @@ static void nvmet_rdma_handle_command(struct nvmet_rdma_queue *queue,nvmet_req_complete (&cmd->req, status); } +static bool nvmet_rdma_recv_not_live (struct nvmet_rdma_queue *queue, +struct nvmet_rdma_rsp *rsp) +{ +unsigned long flags; +bool ret = true; + +spin_lock_irqsave (&queue->state_lock, flags); +/* +* recheck queue state is not live to prevent a race condition +* with RDMA_CM_EVENT_ESTABLISHED handler. +*/ +if (queue->state ==NVMET_RDMA_Q_LIVE ) + ret = false; +else if (queue->state ==NVMET_RDMA_Q_CONNECTING ) +list_add_tail (&rsp->wait_list, &queue->rsp_wait_list); +else +nvmet_rdma_put_rsp (rsp); +spin_unlock_irqrestore (&queue->state_lock, flags); +return ret; +} +static void nvmet_rdma_recv_done (struct ib_cq *cq,struct ib_wc *wc) { struct nvmet_rdma_cmd *cmd =
@@ -1038,17 +1059,9 @@ static void nvmet_rdma_recv_done(struct ib_cq *cq, struct ib_wc *wc) rsp->n_rdma =0 ; rsp->invalidate_rkey =0 ; -if (unlikely (queue->state !=NVMET_RDMA_Q_LIVE )) { -unsigned long flags; - -spin_lock_irqsave (&queue->state_lock, flags); -if (queue->state ==NVMET_RDMA_Q_CONNECTING ) -list_add_tail (&rsp->wait_list, &queue->rsp_wait_list); -else -nvmet_rdma_put_rsp (rsp); -spin_unlock_irqrestore (&queue->state_lock, flags); +if (unlikely (queue->state !=NVMET_RDMA_Q_LIVE ) && +nvmet_rdma_recv_not_live (queue, rsp))return ; - }nvmet_rdma_handle_command (queue, rsp); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 123/231 apple-nvme: Release power domains when probe fails
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hector Martin <[email protected]>
[ Upstream commit eefa72a15ea03fd009333aaa9f0e360b2578e434 ]
--- drivers/nvme/host/apple.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/nvme/host/apple.c +2 -0
@@ -1518,6 +1518,7 @@ static struct apple_nvme *apple_nvme_alloc(struct platform_device *pdev)return anv; put_dev: +apple_nvme_detach_genpd (anv);put_device (anv->dev);return ERR_PTR (ret); }
@@ -1551,6 +1552,7 @@ static int apple_nvme_probe(struct platform_device *pdev)nvme_uninit_ctrl (&anv->ctrl); out_put_ctrl:nvme_put_ctrl (&anv->ctrl); +apple_nvme_detach_genpd (anv);return ret; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 124/231 cifs: Treat unhandled directory name surrogate reparse points as mount directory nodes
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pali Rohár <[email protected]>
[ Upstream commit b587fd128660d48cd2122f870f720ff8e2b4abb3 ]
If the reparse point was not handled (indicated by the -EOPNOTSUPP from ops->parse_reparse_point() call) but reparse tag is of type name surrogate directory type, then treat is as a new mount point.
Name surrogate reparse point represents another named entity in the system.
Quoted 1 line
From SMB client point of view, this another entity is resolved on the SMB
server, and server serves its content automatically. Therefore from Linux client point of view, this name surrogate reparse point of directory type crosses mount point.
--- fs/smb/client/inode.c | 13 +++++++++++++ fs/smb/common/smbfsctl.h | 3 +++ 2 files changed, 16 insertions(+)
fs/smb/client/inode.c +13 -0
@@ -1193,6 +1193,19 @@ static int reparse_info_to_fattr(struct cifs_open_info_data *data, rc = server->ops->parse_reparse_point (cifs_sb, full_path, iov, data); +/* +* If the reparse point was not handled but it is the +* name surrogate which points to directory, then treat +* is as a new mount point. Name surrogate reparse point +* represents another named entity in the system. +*/ +if (rc == -EOPNOTSUPP && +IS_REPARSE_TAG_NAME_SURROGATE (data->reparse.tag) && + (le32_to_cpu (data->fi.Attributes) &ATTR_DIRECTORY )) { + rc =0 ; +cifs_create_junction_fattr (fattr, sb); + goto out; + } }break ; }
fs/smb/common/smbfsctl.h +3 -0
@@ -159,6 +159,9 @@#define IO_REPARSE_TAG_LX_CHR 0x80000025#define IO_REPARSE_TAG_LX_BLK 0x80000026 +/* If Name Surrogate Bit is set, the file or directory represents another named entity in the system. */ +#define IS_REPARSE_TAG_NAME_SURROGATE (tag) (!!((tag) & 0x20000000)) +/* fsctl flags */ /* If Flags is set to this value, the request is an FSCTL not ioctl request */ #define SMB2_0_IOCTL_IS_FSCTL 0x00000001
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 125/231 sctp: Fix undefined behavior in left shift operation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu-Chun Lin <[email protected]>
[ Upstream commit 606572eb22c1786a3957d24307f5760bb058ca19 ]
According to the C11 standard (ISO/IEC 9899:2011, 6.5.7):
"If E1 has a signed type and E1 x 2^E2 is not representable in the result type, the behavior is undefined."
Shifting 1 << 31 causes signed integer overflow, which leads to undefined behavior.
Fix this by explicitly using '1U << 31' to ensure the shift operates on an unsigned type, avoiding undefined behavior.
--- net/sctp/stream.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sctp/stream.c +1 -1
@@ -735,7 +735,7 @@ struct sctp_chunk *sctp_process_strreset_tsnreq(* value SHOULD be the smallest TSN not acknowledged by the * receiver of the request plus 2^31. */ - init_tsn =sctp_tsnmap_get_ctsn (&asoc->peer.tsn_map) + (1 <<31 ); + init_tsn =sctp_tsnmap_get_ctsn (&asoc->peer.tsn_map) + (1U <<31 );sctp_tsnmap_init (&asoc->peer.tsn_map,SCTP_TSN_MAP_INITIAL , init_tsn,GFP_ATOMIC );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 126/231 nvme: only allow entering LIVE from CONNECTING state
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Wagner <[email protected]>
[ Upstream commit d2fe192348f93fe3a0cb1e33e4aba58e646397f4 ]
The fabric transports and also the PCI transport are not entering the LIVE state from NEW or RESETTING. This makes the state machine more restrictive and allows to catch not supported state transitions, e.g. directly switching from RESETTING to LIVE.
--- drivers/nvme/host/core.c | 2 -- 1 file changed, 2 deletions(-)
drivers/nvme/host/core.c +0 -2
@@ -562,8 +562,6 @@ bool nvme_change_ctrl_state(struct nvme_ctrl *ctrl,switch (new_state) {case NVME_CTRL_LIVE :switch (old_state) { -case NVME_CTRL_NEW : -case NVME_CTRL_RESETTING :case NVME_CTRL_CONNECTING : changed = true; fallthrough;
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 127/231 phy: ti: gmii-sel: Do not use syscon helper to build regmap
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Davis <[email protected]>
[ Upstream commit 5ab90f40121a9f6a9b368274cd92d0f435dc7cfa ]
The syscon helper device_node_to_regmap() is used to fetch a regmap registered to a device node. It also currently creates this regmap if the node did not already have a regmap associated with it. This should only be used on "syscon" nodes. This driver is not such a device and instead uses device_node_to_regmap() on its own node as a hacky way to create a regmap for itself.
This will not work going forward and so we should create our regmap the normal way by defining our regmap_config, fetching our memory resource, then using the normal regmap_init_mmio() function.
--- drivers/phy/ti/phy-gmii-sel.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)
drivers/phy/ti/phy-gmii-sel.c +14 -1
@@ -423,6 +423,12 @@ static int phy_gmii_sel_init_ports(struct phy_gmii_sel_priv *priv)return 0 ; } +static const struct regmap_config phy_gmii_sel_regmap_cfg = { + .reg_bits =32 , + .val_bits =32 , + .reg_stride =4 , +}; +static int phy_gmii_sel_probe (struct platform_device *pdev) {struct device *dev = &pdev->dev;
@@ -467,7 +473,14 @@ static int phy_gmii_sel_probe(struct platform_device *pdev) priv->regmap =syscon_node_to_regmap (node->parent);if (IS_ERR (priv->regmap)) { - priv->regmap =device_node_to_regmap (node); +void __iomem *base; + + base =devm_platform_ioremap_resource (pdev,0 ); +if (IS_ERR (base)) +return dev_err_probe (dev,PTR_ERR (base), +"failed to get base memory resource\n" ); + + priv->regmap =regmap_init_mmio (dev, base, &phy_gmii_sel_regmap_cfg);if (IS_ERR (priv->regmap))return dev_err_probe (dev,PTR_ERR (priv->regmap),"Failed to get syscon\n" );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 128/231 ASoC: tas2770: Fix volume scale
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hector Martin <[email protected]>
[ Upstream commit 579cd64b9df8a60284ec3422be919c362de40e41 ]
The scale starts at -100dB, not -128dB.
--- sound/soc/codecs/tas2770.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/tas2770.c +1 -1
@@ -506,7 +506,7 @@ static int tas2770_codec_probe(struct snd_soc_component *component) } static DECLARE_TLV_DB_SCALE(tas2770_digital_tlv, 1100, 50, 0); -static DECLARE_TLV_DB_SCALE(tas2770_playback_volume, -12750, 50, 0); +static DECLARE_TLV_DB_SCALE(tas2770_playback_volume, -10050, 50, 0);static const struct snd_kcontrol_new tas2770_snd_controls[] = { SOC_SINGLE_TLV("Speaker Playback Volume", TAS2770_PLAY_CFG_REG2,
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 129/231 ASoC: tas2764: Fix power control mask
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hector Martin <[email protected]>
[ Upstream commit a3f172359e22b2c11b750d23560481a55bf86af1 ]
--- sound/soc/codecs/tas2764.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/tas2764.h +1 -1
@@ -25,7 +25,7 @@/* Power Control */ #define TAS2764_PWR_CTRL TAS2764_REG(0X0, 0x02) -#define TAS2764_PWR_CTRL_MASK GENMASK(1, 0) +#define TAS2764_PWR_CTRL_MASK GENMASK(2, 0)#define TAS2764_PWR_CTRL_ACTIVE 0x0#define TAS2764_PWR_CTRL_MUTE BIT(0)#define TAS2764_PWR_CTRL_SHUTDOWN BIT(1)
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 130/231 ASoC: tas2764: Set the SDOUT polarity correctly
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hector Martin <[email protected]>
[ Upstream commit f5468beeab1b1adfc63c2717b1f29ef3f49a5fab ]
TX launch polarity needs to be the opposite of RX capture polarity, to generate the right bit slot alignment.
--- sound/soc/codecs/tas2764.c | 10 +++++++++- sound/soc/codecs/tas2764.h | 6 ++++++ 2 files changed, 15 insertions(+), 1 deletion(-)
sound/soc/codecs/tas2764.c +9 -1
@@ -365,7 +365,7 @@ static int tas2764_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) {struct snd_soc_component *component = dai->component;struct tas2764_priv *tas2764 =snd_soc_component_get_drvdata (component); -u8 tdm_rx_start_slot =0 , asi_cfg_0 =0 , asi_cfg_1 =0 ; +u8 tdm_rx_start_slot =0 , asi_cfg_0 =0 , asi_cfg_1 =0 , asi_cfg_4 =0 ;int ret;switch (fmt &SND_SOC_DAIFMT_INV_MASK ) {
@@ -374,12 +374,14 @@ static int tas2764_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) fallthrough;case SND_SOC_DAIFMT_NB_NF : asi_cfg_1 =TAS2764_TDM_CFG1_RX_RISING ; + asi_cfg_4 =TAS2764_TDM_CFG4_TX_FALLING ;break ;case SND_SOC_DAIFMT_IB_IF : asi_cfg_0 ^=TAS2764_TDM_CFG0_FRAME_START ; fallthrough;case SND_SOC_DAIFMT_IB_NF : asi_cfg_1 =TAS2764_TDM_CFG1_RX_FALLING ; + asi_cfg_4 =TAS2764_TDM_CFG4_TX_RISING ;break ; }
@@ -389,6 +391,12 @@ static int tas2764_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)if (ret <0 )return ret; + ret =snd_soc_component_update_bits (component,TAS2764_TDM_CFG4 , +TAS2764_TDM_CFG4_TX_MASK , + asi_cfg_4); +if (ret <0 ) +return ret; +switch (fmt &SND_SOC_DAIFMT_FORMAT_MASK ) {case SND_SOC_DAIFMT_I2S : asi_cfg_0 ^=TAS2764_TDM_CFG0_FRAME_START ;
sound/soc/codecs/tas2764.h +6 -0
@@ -79,6 +79,12 @@#define TAS2764_TDM_CFG3_RXS_SHIFT 0x4#define TAS2764_TDM_CFG3_MASK GENMASK(3, 0) +/* TDM Configuration Reg4 */ +#define TAS2764_TDM_CFG4 TAS2764_REG(0X0, 0x0d) +#define TAS2764_TDM_CFG4_TX_MASK BIT(0) +#define TAS2764_TDM_CFG4_TX_RISING 0x0 +#define TAS2764_TDM_CFG4_TX_FALLING BIT(0) +/* TDM Configuration Reg5 */ #define TAS2764_TDM_CFG5 TAS2764_REG(0X0, 0x0e)#define TAS2764_TDM_CFG5_VSNS_MASK BIT(6)
Signature · 1 line
2.39.5